@vibecheckai/cli 3.2.0 → 3.2.2

package/bin/runners/lib/agent-firewall/interceptor/cursor.js

@@ -0,0 +1,35 @@
+/**
+ * Cursor IDE Interceptor
+ * 
+ * Cursor-specific integration for agent firewall.
+ * Hooks into Cursor's file write events.
+ */
+
+"use strict";
+
+const { interceptFileWrite } = require("./base");
+
+/**
+ * Intercept file write in Cursor
+ * This would be called by Cursor's extension/plugin system
+ */
+async function interceptCursorWrite({
+  projectRoot,
+  filePath,
+  content,
+  oldContent,
+  agentId = "cursor"
+}) {
+  return await interceptFileWrite({
+    projectRoot,
+    agentId,
+    intent: "Cursor AI edit",
+    filePath,
+    content,
+    oldContent
+  });
+}
+
+module.exports = {
+  interceptCursorWrite
+};

package/bin/runners/lib/agent-firewall/interceptor/vscode.js

@@ -0,0 +1,35 @@
+/**
+ * VS Code LSP Interceptor
+ * 
+ * VS Code LSP integration for agent firewall.
+ * Generic LSP hook for file writes.
+ */
+
+"use strict";
+
+const { interceptFileWrite } = require("./base");
+
+/**
+ * Intercept file write via LSP
+ * This would be called by VS Code's LSP server
+ */
+async function interceptVSCodeWrite({
+  projectRoot,
+  filePath,
+  content,
+  oldContent,
+  agentId = "vscode"
+}) {
+  return await interceptFileWrite({
+    projectRoot,
+    agentId,
+    intent: "VS Code AI edit",
+    filePath,
+    content,
+    oldContent
+  });
+}
+
+module.exports = {
+  interceptVSCodeWrite
+};

package/bin/runners/lib/agent-firewall/interceptor/windsurf.js

@@ -0,0 +1,34 @@
+/**
+ * Windsurf IDE Interceptor
+ * 
+ * Windsurf-specific integration for agent firewall.
+ */
+
+"use strict";
+
+const { interceptFileWrite } = require("./base");
+
+/**
+ * Intercept file write in Windsurf
+ * This would be called by Windsurf's extension/plugin system
+ */
+async function interceptWindsurfWrite({
+  projectRoot,
+  filePath,
+  content,
+  oldContent,
+  agentId = "windsurf"
+}) {
+  return await interceptFileWrite({
+    projectRoot,
+    agentId,
+    intent: "Windsurf AI edit",
+    filePath,
+    content,
+    oldContent
+  });
+}
+
+module.exports = {
+  interceptWindsurfWrite
+};

package/bin/runners/lib/agent-firewall/policy/default-policy.json

@@ -0,0 +1,84 @@
+{
+  "version": "1.0",
+  "mode": "enforce",
+  "profile": "repo-lock",
+  "scope": {
+    "max_files_touched": 10,
+    "max_lines_changed": 600,
+    "blocked_paths": [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/.next/**",
+      "**/.vibecheck/packets/**"
+    ],
+    "allowed_paths": [
+      "apps/**",
+      "packages/**",
+      "src/**"
+    ],
+    "require_intent_for_expand_scope": true
+  },
+  "hard_domains": {
+    "routes": true,
+    "env": true,
+    "auth": true,
+    "contracts": true,
+    "payments": true,
+    "side_effects": true
+  },
+  "rules": {
+    "ghost_route": {
+      "severity": "block",
+      "enabled": true
+    },
+    "ghost_env": {
+      "severity": "block",
+      "enabled": true
+    },
+    "auth_drift": {
+      "severity": "block",
+      "enabled": true
+    },
+    "contract_drift": {
+      "severity": "block",
+      "enabled": true
+    },
+    "fake_success_ui": {
+      "severity": "warn",
+      "enabled": true,
+      "block_if_domain": ["payments", "auth", "side_effects"]
+    },
+    "scope_explosion": {
+      "severity": "block",
+      "enabled": true
+    },
+    "unsafe_side_effect": {
+      "severity": "block",
+      "enabled": true
+    }
+  },
+  "evidence": {
+    "require_pointers": true,
+    "acceptable_sources": [
+      "truthpack.routes",
+      "truthpack.env",
+      "truthpack.auth",
+      "truthpack.contracts",
+      "repo.search"
+    ],
+    "pointer_format": "file:lineStart-lineEnd"
+  },
+  "verification": {
+    "require_for_domains": ["auth", "payments", "side_effects"],
+    "accepted": ["tests", "reality"],
+    "reality": {
+      "enabled": true,
+      "block_on": ["fake_success", "no_mutation", "network_error"]
+    }
+  },
+  "output": {
+    "write_change_packets": true,
+    "packet_dir": ".vibecheck/packets",
+    "report_formats": ["md", "html"]
+  }
+}

package/bin/runners/lib/agent-firewall/policy/engine.js

@@ -0,0 +1,72 @@
+/**
+ * Policy Engine
+ * 
+ * Main policy engine that evaluates all rules deterministically.
+ * No LLM opinions - pure rule-based evaluation.
+ */
+
+"use strict";
+
+const ghostRoute = require("./rules/ghost-route");
+const ghostEnv = require("./rules/ghost-env");
+const authDrift = require("./rules/auth-drift");
+const contractDrift = require("./rules/contract-drift");
+const fakeSuccess = require("./rules/fake-success");
+const scope = require("./rules/scope");
+const unsafeSideEffect = require("./rules/unsafe-side-effect");
+const { generateVerdict } = require("./verdict");
+
+/**
+ * Evaluate policy against change packet
+ * @param {object} params
+ * @param {object} params.policy - Policy configuration
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {array} params.files - Changed files
+ * @param {string} params.intent - Agent intent message
+ * @returns {object} Verdict object
+ */
+function evaluatePolicy({ policy, claims, evidence, files, intent }) {
+  const violations = [];
+  
+  // Evaluate all rules
+  const ruleEvaluators = [
+    ghostRoute,
+    ghostEnv,
+    authDrift,
+    contractDrift,
+    fakeSuccess,
+    unsafeSideEffect
+  ];
+  
+  // Evaluate claim-based rules
+  for (const evaluator of ruleEvaluators) {
+    try {
+      const violation = evaluator.evaluate({ claims, evidence, policy });
+      if (violation) {
+        violations.push(violation);
+      }
+    } catch (error) {
+      console.warn(`Rule evaluation error: ${error.message}`);
+    }
+  }
+  
+  // Evaluate scope rule (file-based)
+  try {
+    const violation = scope.evaluate({ files, intent, policy });
+    if (violation) {
+      violations.push(violation);
+    }
+  } catch (error) {
+    console.warn(`Scope rule evaluation error: ${error.message}`);
+  }
+  
+  // Generate final verdict
+  const verdict = generateVerdict(violations);
+  
+  return verdict;
+}
+
+module.exports = {
+  evaluatePolicy
+};

package/bin/runners/lib/agent-firewall/policy/loader.js

@@ -0,0 +1,143 @@
+/**
+ * Policy Loader
+ * 
+ * Loads and validates agent firewall policy from .vibecheck/policy.json
+ * Falls back to default policy if not found.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const Ajv = require("ajv").default || require("ajv");
+
+// Load schema
+const schemaPath = path.join(__dirname, "schema.json");
+const schema = JSON.parse(fs.readFileSync(schemaPath, "utf8"));
+
+// Load default policy
+const defaultPolicyPath = path.join(__dirname, "default-policy.json");
+const defaultPolicy = JSON.parse(fs.readFileSync(defaultPolicyPath, "utf8"));
+
+/**
+ * Load policy from project root
+ * @param {string} projectRoot - Project root directory
+ * @param {object} overrides - Optional policy overrides
+ * @returns {object} Loaded and validated policy
+ */
+function loadPolicy(projectRoot, overrides = {}) {
+  const policyPath = path.join(projectRoot, ".vibecheck", "policy.json");
+  
+  let policy;
+  
+  // Try to load project policy
+  if (fs.existsSync(policyPath)) {
+    try {
+      policy = JSON.parse(fs.readFileSync(policyPath, "utf8"));
+    } catch (error) {
+      throw new Error(`Failed to parse policy file: ${error.message}`);
+    }
+  } else {
+    // Use default policy
+    policy = JSON.parse(JSON.stringify(defaultPolicy));
+  }
+  
+  // Apply overrides (deep merge)
+  if (Object.keys(overrides).length > 0) {
+    policy = deepMerge(policy, overrides);
+  }
+  
+  // Validate against schema
+  const ajv = new Ajv({ allErrors: true });
+  const validate = ajv.compile(schema);
+  const valid = validate(policy);
+  
+  if (!valid) {
+    const errors = validate.errors.map(e => 
+      `${e.instancePath || 'root'} ${e.message}`
+    ).join(', ');
+    throw new Error(`Policy validation failed: ${errors}`);
+  }
+  
+  return policy;
+}
+
+/**
+ * Deep merge two objects
+ * @param {object} target - Target object
+ * @param {object} source - Source object to merge
+ * @returns {object} Merged object
+ */
+function deepMerge(target, source) {
+  const output = Object.assign({}, target);
+  
+  if (isObject(target) && isObject(source)) {
+    Object.keys(source).forEach(key => {
+      if (isObject(source[key])) {
+        if (!(key in target)) {
+          Object.assign(output, { [key]: source[key] });
+        } else {
+          output[key] = deepMerge(target[key], source[key]);
+        }
+      } else {
+        Object.assign(output, { [key]: source[key] });
+      }
+    });
+  }
+  
+  return output;
+}
+
+/**
+ * Check if value is a plain object
+ * @param {*} item - Value to check
+ * @returns {boolean}
+ */
+function isObject(item) {
+  return item && typeof item === 'object' && !Array.isArray(item);
+}
+
+/**
+ * Get default policy
+ * @returns {object} Default policy
+ */
+function getDefaultPolicy() {
+  return JSON.parse(JSON.stringify(defaultPolicy));
+}
+
+/**
+ * Save policy to project root
+ * @param {string} projectRoot - Project root directory
+ * @param {object} policy - Policy to save
+ */
+function savePolicy(projectRoot, policy) {
+  const vibecheckDir = path.join(projectRoot, ".vibecheck");
+  const policyPath = path.join(vibecheckDir, "policy.json");
+  
+  // Ensure .vibecheck directory exists
+  if (!fs.existsSync(vibecheckDir)) {
+    fs.mkdirSync(vibecheckDir, { recursive: true });
+  }
+  
+  // Validate before saving
+  const ajv = new Ajv({ allErrors: true });
+  const validate = ajv.compile(schema);
+  const valid = validate(policy);
+  
+  if (!valid) {
+    const errors = validate.errors.map(e => 
+      `${e.instancePath || 'root'} ${e.message}`
+    ).join(', ');
+    throw new Error(`Policy validation failed: ${errors}`);
+  }
+  
+  fs.writeFileSync(policyPath, JSON.stringify(policy, null, 2));
+}
+
+module.exports = {
+  loadPolicy,
+  getDefaultPolicy,
+  savePolicy,
+  schema,
+  defaultPolicy
+};

package/bin/runners/lib/agent-firewall/policy/rules/auth-drift.js

@@ -0,0 +1,50 @@
+/**
+ * Auth Drift Rule
+ * 
+ * Blocks if auth restriction claimed but not enforced.
+ */
+
+"use strict";
+
+const { CLAIM_TYPES } = require("../../claims/claim-types");
+
+/**
+ * Evaluate auth drift rule
+ * @param {object} params
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {object} params.policy - Policy configuration
+ * @returns {object|null} Violation or null
+ */
+function evaluate({ claims, evidence, policy }) {
+  const ruleConfig = policy.rules?.auth_drift;
+  
+  if (!ruleConfig || !ruleConfig.enabled) {
+    return null;
+  }
+  
+  // Find auth claims with CONTRADICTS evidence
+  for (let i = 0; i < claims.length; i++) {
+    const claim = claims[i];
+    
+    if (claim.type === CLAIM_TYPES.AUTH) {
+      const ev = evidence.find(e => e.claimId === `claim_${i}`);
+      
+      if (ev && ev.result === "CONTRADICTS") {
+        return {
+          rule: "auth_drift",
+          severity: ruleConfig.severity || "block",
+          message: `Auth drift: ${claim.value} claims auth restriction but route is not protected`,
+          claimId: `claim_${i}`,
+          claim
+        };
+      }
+    }
+  }
+  
+  return null;
+}
+
+module.exports = {
+  evaluate
+};

package/bin/runners/lib/agent-firewall/policy/rules/contract-drift.js

@@ -0,0 +1,50 @@
+/**
+ * Contract Drift Rule
+ * 
+ * Blocks if API contract mismatch.
+ */
+
+"use strict";
+
+const { CLAIM_TYPES } = require("../../claims/claim-types");
+
+/**
+ * Evaluate contract drift rule
+ * @param {object} params
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {object} params.policy - Policy configuration
+ * @returns {object|null} Violation or null
+ */
+function evaluate({ claims, evidence, policy }) {
+  const ruleConfig = policy.rules?.contract_drift;
+  
+  if (!ruleConfig || !ruleConfig.enabled) {
+    return null;
+  }
+  
+  // Find contract claims with CONTRADICTS evidence
+  for (let i = 0; i < claims.length; i++) {
+    const claim = claims[i];
+    
+    if (claim.type === CLAIM_TYPES.CONTRACT) {
+      const ev = evidence.find(e => e.claimId === `claim_${i}`);
+      
+      if (ev && ev.result === "CONTRADICTS") {
+        return {
+          rule: "contract_drift",
+          severity: ruleConfig.severity || "block",
+          message: `Contract drift: ${claim.value} API contract mismatch`,
+          claimId: `claim_${i}`,
+          claim
+        };
+      }
+    }
+  }
+  
+  return null;
+}
+
+module.exports = {
+  evaluate
+};

package/bin/runners/lib/agent-firewall/policy/rules/fake-success.js

@@ -0,0 +1,61 @@
+/**
+ * Fake Success UI Rule
+ * 
+ * Warns/blocks if UI shows success without mutation.
+ */
+
+"use strict";
+
+const { CLAIM_TYPES } = require("../../claims/claim-types");
+
+/**
+ * Evaluate fake success UI rule
+ * @param {object} params
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {object} params.policy - Policy configuration
+ * @returns {object|null} Violation or null
+ */
+function evaluate({ claims, evidence, policy }) {
+  const ruleConfig = policy.rules?.fake_success_ui;
+  
+  if (!ruleConfig || !ruleConfig.enabled) {
+    return null;
+  }
+  
+  // Find UI success claims
+  const successClaims = claims.filter(c => c.type === CLAIM_TYPES.UI_SUCCESS);
+  
+  if (successClaims.length === 0) {
+    return null;
+  }
+  
+  // Check if there's a corresponding HTTP call or side effect
+  const hasHttpCall = claims.some(c => 
+    c.type === CLAIM_TYPES.HTTP_CALL || c.type === CLAIM_TYPES.ROUTE
+  );
+  
+  const hasSideEffect = claims.some(c => c.type === CLAIM_TYPES.SIDE_EFFECT);
+  
+  if (!hasHttpCall && !hasSideEffect) {
+    // Check if domain requires blocking
+    const blockDomains = ruleConfig.block_if_domain || [];
+    const fileDomain = successClaims[0].domain || "general";
+    
+    const shouldBlock = blockDomains.includes(fileDomain);
+    
+    return {
+      rule: "fake_success_ui",
+      severity: shouldBlock ? "block" : (ruleConfig.severity || "warn"),
+      message: `Fake success UI: Success message shown but no HTTP call or side effect detected`,
+      claimId: `claim_${claims.indexOf(successClaims[0])}`,
+      claim: successClaims[0]
+    };
+  }
+  
+  return null;
+}
+
+module.exports = {
+  evaluate
+};

package/bin/runners/lib/agent-firewall/policy/rules/ghost-env.js

@@ -0,0 +1,50 @@
+/**
+ * Ghost Env Rule
+ * 
+ * Blocks if process.env.X used but not declared.
+ */
+
+"use strict";
+
+const { CLAIM_TYPES } = require("../../claims/claim-types");
+
+/**
+ * Evaluate ghost env rule
+ * @param {object} params
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {object} params.policy - Policy configuration
+ * @returns {object|null} Violation or null
+ */
+function evaluate({ claims, evidence, policy }) {
+  const ruleConfig = policy.rules?.ghost_env;
+  
+  if (!ruleConfig || !ruleConfig.enabled) {
+    return null;
+  }
+  
+  // Find env claims with UNPROVEN evidence
+  for (let i = 0; i < claims.length; i++) {
+    const claim = claims[i];
+    
+    if (claim.type === CLAIM_TYPES.ENV) {
+      const ev = evidence.find(e => e.claimId === `claim_${i}`);
+      
+      if (ev && ev.result === "UNPROVEN") {
+        return {
+          rule: "ghost_env",
+          severity: ruleConfig.severity || "block",
+          message: `Ghost env var: ${claim.value} is used but not declared`,
+          claimId: `claim_${i}`,
+          claim
+        };
+      }
+    }
+  }
+  
+  return null;
+}
+
+module.exports = {
+  evaluate
+};

package/bin/runners/lib/agent-firewall/policy/rules/ghost-route.js

@@ -0,0 +1,50 @@
+/**
+ * Ghost Route Rule
+ * 
+ * Blocks if UI references route not registered in truthpack.
+ */
+
+"use strict";
+
+const { CLAIM_TYPES } = require("../../claims/claim-types");
+
+/**
+ * Evaluate ghost route rule
+ * @param {object} params
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {object} params.policy - Policy configuration
+ * @returns {object|null} Violation or null
+ */
+function evaluate({ claims, evidence, policy }) {
+  const ruleConfig = policy.rules?.ghost_route;
+  
+  if (!ruleConfig || !ruleConfig.enabled) {
+    return null;
+  }
+  
+  // Find route claims with UNPROVEN evidence
+  for (let i = 0; i < claims.length; i++) {
+    const claim = claims[i];
+    
+    if (claim.type === CLAIM_TYPES.ROUTE || claim.type === CLAIM_TYPES.HTTP_CALL) {
+      const ev = evidence.find(e => e.claimId === `claim_${i}`);
+      
+      if (ev && ev.result === "UNPROVEN") {
+        return {
+          rule: "ghost_route",
+          severity: ruleConfig.severity || "block",
+          message: `Ghost route: ${claim.value} is referenced but not registered in truthpack`,
+          claimId: `claim_${i}`,
+          claim
+        };
+      }
+    }
+  }
+  
+  return null;
+}
+
+module.exports = {
+  evaluate
+};