@vibecheckai/cli 3.2.5 → 3.3.0

package/mcp-server/lib/api-client.cjs

@@ -0,0 +1,305 @@
+/**
+ * API Client for Vibecheck Dashboard Integration
+ * 
+ * Handles communication with the web dashboard API for:
+ * - Creating scan records
+ * - Updating scan progress
+ * - Submitting scan results
+ * - Broadcasting real-time updates
+ */
+
+"use strict";
+
+const https = require("https");
+const http = require("http");
+const { logger } = require("./logger.cjs");
+
+// Configuration
+const API_BASE_URL = process.env.VIBECHECK_API_URL || "https://api.vibecheckai.dev";
+const API_TIMEOUT = 30000; // 30 seconds
+
+/**
+ * Make HTTP request to API
+ */
+async function makeRequest(path, options = {}) {
+  const url = new URL(path, API_BASE_URL);
+  const isHttps = url.protocol === "https:";
+  const client = isHttps ? https : http;
+
+  const defaultOptions = {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "User-Agent": "vibecheck-cli/3.3.0",
+    },
+    timeout: API_TIMEOUT,
+  };
+
+  const requestOptions = {
+    ...defaultOptions,
+    ...options,
+    hostname: url.hostname,
+    port: url.port || (isHttps ? 443 : 80),
+    path: url.pathname + url.search,
+  };
+
+  // Add Authorization header if API key is available
+  const apiKey = process.env.VIBECHECK_API_KEY || getApiKey();
+  if (apiKey) {
+    requestOptions.headers.Authorization = `Bearer ${apiKey}`;
+  }
+
+  return new Promise((resolve, reject) => {
+    const req = client.request(requestOptions, (res) => {
+      let data = "";
+
+      res.on("data", (chunk) => {
+        data += chunk;
+      });
+
+      res.on("end", () => {
+        try {
+          const jsonData = data ? JSON.parse(data) : {};
+          resolve({
+            ok: res.statusCode >= 200 && res.statusCode < 300,
+            status: res.statusCode,
+            data: jsonData,
+          });
+        } catch (err) {
+          resolve({
+            ok: false,
+            status: res.statusCode,
+            data: { error: "Invalid JSON response" },
+          });
+        }
+      });
+    });
+
+    req.on("error", (err) => {
+      logger.debug(`API request failed: ${err.message}`);
+      resolve({
+        ok: false,
+        error: err.message,
+        data: { error: err.message },
+      });
+    });
+
+    req.on("timeout", () => {
+      req.destroy();
+      resolve({
+        ok: false,
+        error: "Request timeout",
+        data: { error: "Request timeout" },
+      });
+    });
+
+    if (options.body) {
+      req.write(JSON.stringify(options.body));
+    }
+
+    req.end();
+  });
+}
+
+/**
+ * Get API key from environment or config
+ */
+function getApiKey() {
+  // Try various environment variables
+  const envVars = [
+    "VIBECHECK_API_KEY",
+    "VIBECHECK_TOKEN",
+    "API_KEY",
+    "TOKEN",
+  ];
+
+  for (const envVar of envVars) {
+    if (process.env[envVar]) {
+      return process.env[envVar];
+    }
+  }
+
+  // Try to read from config file
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const os = require("os");
+
+    const configPaths = [
+      path.join(os.homedir(), ".vibecheck", "config.json"),
+      path.join(process.cwd(), ".vibecheckrc.json"),
+      path.join(process.cwd(), "vibecheck.config.json"),
+    ];
+
+    for (const configPath of configPaths) {
+      if (fs.existsSync(configPath)) {
+        const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+        if (config.apiKey || config.token) {
+          return config.apiKey || config.token;
+        }
+      }
+    }
+  } catch (err) {
+    // Ignore config file errors
+  }
+
+  return null;
+}
+
+// =============================================================================
+// SECURITY: Input Validation
+// =============================================================================
+
+/**
+ * Validate scanId format to prevent path injection.
+ * 
+ * SECURITY FIX: scanId is interpolated into URLs like `/api/scans/${scanId}/progress`.
+ * Without validation, an attacker could inject path segments:
+ *   scanId = "../../admin/delete" 
+ *   → URL becomes "/api/scans/../../admin/delete/progress"
+ * 
+ * @param {string} scanId - The scan ID to validate
+ * @returns {string} - The validated scanId
+ * @throws {Error} - If scanId is invalid
+ */
+function validateScanId(scanId) {
+  if (!scanId || typeof scanId !== 'string') {
+    throw new Error('scanId is required and must be a string');
+  }
+  
+  // Only allow alphanumeric, hyphens, underscores (no dots, slashes, etc.)
+  // Max length 64 to prevent abuse
+  if (!/^[a-zA-Z0-9_-]{1,64}$/.test(scanId)) {
+    throw new Error('Invalid scanId format - must be alphanumeric with hyphens/underscores only, max 64 chars');
+  }
+  
+  return scanId;
+}
+
+/**
+ * Create a new scan record
+ */
+async function createScan(options) {
+  const {
+    repositoryId,
+    repositoryUrl,
+    localPath,
+    branch = "main",
+    enableLLM = false,
+  } = options;
+
+  const response = await makeRequest("/api/scans", {
+    body: {
+      repositoryId,
+      repositoryUrl,
+      localPath,
+      branch,
+      enableLLM,
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error(`Failed to create scan: ${response.data?.error || response.error}`);
+  }
+
+  return response.data.data;
+}
+
+/**
+ * Update scan progress
+ */
+async function updateScanProgress(scanId, progress, status = null) {
+  const validatedId = validateScanId(scanId);
+  
+  const response = await makeRequest(`/api/scans/${validatedId}/progress`, {
+    body: {
+      progress,
+      status,
+    },
+  });
+
+  if (!response.ok) {
+    logger.debug(`Failed to update scan progress: ${response.data?.error || response.error}`);
+  }
+
+  return response.data;
+}
+
+/**
+ * Submit scan results
+ */
+async function submitScanResults(scanId, results) {
+  const validatedId = validateScanId(scanId);
+  
+  const {
+    verdict,
+    score,
+    findings,
+    filesScanned,
+    linesScanned,
+    durationMs,
+    metadata = {},
+  } = results;
+
+  const response = await makeRequest(`/api/scans/${validatedId}/complete`, {
+    body: {
+      verdict,
+      score,
+      findings,
+      filesScanned,
+      linesScanned,
+      durationMs,
+      metadata,
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error(`Failed to submit scan results: ${response.data?.error || response.error}`);
+  }
+
+  return response.data;
+}
+
+/**
+ * Report scan error
+ */
+async function reportScanError(scanId, error) {
+  const validatedId = validateScanId(scanId);
+  
+  const response = await makeRequest(`/api/scans/${validatedId}/error`, {
+    body: {
+      error: error.message || String(error),
+      stack: error.stack,
+    },
+  });
+
+  if (!response.ok) {
+    logger.debug(`Failed to report scan error: ${response.data?.error || response.error}`);
+  }
+
+  return response.data;
+}
+
+/**
+ * Check if API is available
+ */
+async function isApiAvailable() {
+  try {
+    const response = await makeRequest("/api/health", {
+      method: "GET",
+      timeout: 5000,
+    });
+    return response.ok;
+  } catch (err) {
+    return false;
+  }
+}
+
+module.exports = {
+  createScan,
+  updateScanProgress,
+  submitScanResults,
+  reportScanError,
+  isApiAvailable,
+  getApiKey,
+};

package/mcp-server/lib/logger.cjs

@@ -0,0 +1,30 @@
+/**
+ * Simple logger for MCP server
+ * Outputs to stderr to avoid interfering with MCP stdio protocol
+ */
+
+"use strict";
+
+const DEBUG = process.env.VIBECHECK_DEBUG === "true" || process.env.DEBUG === "true";
+
+const logger = {
+  debug(...args) {
+    if (DEBUG) {
+      console.error("[DEBUG]", ...args);
+    }
+  },
+  
+  info(...args) {
+    console.error("[INFO]", ...args);
+  },
+  
+  warn(...args) {
+    console.error("[WARN]", ...args);
+  },
+  
+  error(...args) {
+    console.error("[ERROR]", ...args);
+  },
+};
+
+module.exports = { logger };

package/mcp-server/logger.js

@@ -0,0 +1,173 @@
+/**
+ * VibeCheck MCP Server Logger
+ * 
+ * Centralized logging utility for all MCP server modules.
+ * Avoids console.log/warn/error in production code.
+ */
+
+"use strict";
+
+/**
+ * Log levels
+ */
+export const LOG_LEVELS = {
+  DEBUG: 0,
+  INFO: 1,
+  WARN: 2,
+  ERROR: 3,
+  SILENT: 4,
+};
+
+/**
+ * Current log level (can be set via environment)
+ */
+let currentLevel = LOG_LEVELS.INFO;
+
+// Set from environment
+if (process.env.VIBECHECK_LOG_LEVEL) {
+  const envLevel = process.env.VIBECHECK_LOG_LEVEL.toUpperCase();
+  if (LOG_LEVELS[envLevel] !== undefined) {
+    currentLevel = LOG_LEVELS[envLevel];
+  }
+}
+
+/**
+ * Log buffer for testing/inspection
+ */
+const logBuffer = [];
+const MAX_BUFFER_SIZE = 1000;
+
+/**
+ * Format a log message
+ * @param {string} level - Log level
+ * @param {string} module - Module name
+ * @param {string} message - Log message
+ * @returns {string} Formatted message
+ */
+function formatMessage(level, module, message) {
+  const timestamp = new Date().toISOString();
+  return `[${timestamp}] [${level}] [${module}] ${message}`;
+}
+
+/**
+ * Write a log entry
+ * @param {number} level - Log level number
+ * @param {string} levelName - Level name
+ * @param {string} module - Module name
+ * @param {string} message - Message
+ * @param {Error} [error] - Optional error object
+ */
+function writeLog(level, levelName, module, message, error = null) {
+  if (level < currentLevel) return;
+  
+  const formatted = formatMessage(levelName, module, message);
+  
+  // Add to buffer
+  logBuffer.push({
+    timestamp: new Date(),
+    level: levelName,
+    module,
+    message,
+    error: error ? { message: error.message, stack: error.stack } : null,
+  });
+  
+  // Trim buffer
+  if (logBuffer.length > MAX_BUFFER_SIZE) {
+    logBuffer.shift();
+  }
+  
+  // Write to stderr (MCP servers should write logs to stderr, stdout is for JSON-RPC)
+  if (level >= LOG_LEVELS.WARN) {
+    process.stderr.write(formatted + '\n');
+  } else if (process.env.VIBECHECK_DEBUG || currentLevel === LOG_LEVELS.DEBUG) {
+    process.stderr.write(formatted + '\n');
+  }
+}
+
+/**
+ * Create a logger for a specific module
+ * @param {string} moduleName - Module name
+ * @returns {Object} Logger instance
+ */
+export function createLogger(moduleName) {
+  return {
+    debug: (message) => writeLog(LOG_LEVELS.DEBUG, 'DEBUG', moduleName, message),
+    info: (message) => writeLog(LOG_LEVELS.INFO, 'INFO', moduleName, message),
+    warn: (message, error = null) => writeLog(LOG_LEVELS.WARN, 'WARN', moduleName, message, error),
+    error: (message, error = null) => writeLog(LOG_LEVELS.ERROR, 'ERROR', moduleName, message, error),
+  };
+}
+
+/**
+ * Set the global log level
+ * @param {string|number} level - Level name or number
+ */
+export function setLogLevel(level) {
+  if (typeof level === 'string') {
+    const upperLevel = level.toUpperCase();
+    if (LOG_LEVELS[upperLevel] !== undefined) {
+      currentLevel = LOG_LEVELS[upperLevel];
+    }
+  } else if (typeof level === 'number') {
+    currentLevel = level;
+  }
+}
+
+/**
+ * Get current log level
+ * @returns {number} Current level
+ */
+export function getLogLevel() {
+  return currentLevel;
+}
+
+/**
+ * Get recent log entries
+ * @param {number} count - Number of entries
+ * @returns {Object[]} Log entries
+ */
+export function getRecentLogs(count = 100) {
+  return logBuffer.slice(-count);
+}
+
+/**
+ * Clear log buffer
+ */
+export function clearLogs() {
+  logBuffer.length = 0;
+}
+
+/**
+ * Get error message safely from any error type
+ * @param {unknown} error - Error object
+ * @returns {string} Error message
+ */
+export function getErrorMessage(error) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  if (typeof error === 'string') {
+    return error;
+  }
+  if (error && typeof error === 'object' && 'message' in error) {
+    return String(error.message);
+  }
+  return String(error);
+}
+
+// Pre-created loggers for common modules
+export const conductorLogger = createLogger('Conductor');
+export const lawbookLogger = createLogger('Lawbook');
+export const timeMachineLogger = createLogger('TimeMachine');
+export const clearanceLogger = createLogger('Clearance');
+export const firewallLogger = createLogger('Firewall');
+
+export default {
+  createLogger,
+  setLogLevel,
+  getLogLevel,
+  getRecentLogs,
+  clearLogs,
+  getErrorMessage,
+  LOG_LEVELS,
+};

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecheck-mcp-server",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Professional MCP server for vibecheck - Intelligent development environment vibechecks",
   "type": "module",
   "main": "index.js",
@@ -24,7 +24,7 @@
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.11"
   },
   "author": "vibecheck",
   "license": "MIT",

package/mcp-server/premium-tools.js

@@ -16,7 +16,7 @@
 import fs from 'fs/promises';
 import path from 'path';
 import { execSync, spawn } from 'child_process';
-import { checkFeatureAccess } from "./tier-auth.js";
+import { getFeatureAccessStatus } from "./tier-auth.js";
 
 // State management (in-memory for MCP session, persisted to disk)
 class MCPState {
@@ -434,7 +434,7 @@ export async function handlePremiumTool(name, args, logger) {
 
   const requiredFeature = featureMap[name];
   if (requiredFeature) {
-    const access = await checkFeatureAccess(requiredFeature, args?.apiKey);
+    const access = await getFeatureAccessStatus(requiredFeature, args?.apiKey);
     if (!access.hasAccess) {
       return {
         content: [{