@vibecheckai/cli 3.2.5 → 3.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (197) hide show
  1. package/bin/.generated +25 -25
  2. package/bin/dev/run-v2-torture.js +30 -30
  3. package/bin/registry.js +192 -5
  4. package/bin/runners/lib/__tests__/entitlements-v2.test.js +295 -295
  5. package/bin/runners/lib/agent-firewall/change-packet/builder.js +280 -6
  6. package/bin/runners/lib/agent-firewall/critic/index.js +151 -0
  7. package/bin/runners/lib/agent-firewall/critic/judge.js +432 -0
  8. package/bin/runners/lib/agent-firewall/critic/prompts.js +305 -0
  9. package/bin/runners/lib/agent-firewall/lawbook/distributor.js +465 -0
  10. package/bin/runners/lib/agent-firewall/lawbook/evaluator.js +604 -0
  11. package/bin/runners/lib/agent-firewall/lawbook/index.js +304 -0
  12. package/bin/runners/lib/agent-firewall/lawbook/registry.js +514 -0
  13. package/bin/runners/lib/agent-firewall/lawbook/schema.js +420 -0
  14. package/bin/runners/lib/agent-firewall/logger.js +141 -0
  15. package/bin/runners/lib/agent-firewall/policy/loader.js +312 -4
  16. package/bin/runners/lib/agent-firewall/policy/rules/ghost-env.js +113 -1
  17. package/bin/runners/lib/agent-firewall/policy/rules/ghost-route.js +133 -6
  18. package/bin/runners/lib/agent-firewall/proposal/extractor.js +394 -0
  19. package/bin/runners/lib/agent-firewall/proposal/index.js +212 -0
  20. package/bin/runners/lib/agent-firewall/proposal/schema.js +251 -0
  21. package/bin/runners/lib/agent-firewall/proposal/validator.js +386 -0
  22. package/bin/runners/lib/agent-firewall/reality/index.js +332 -0
  23. package/bin/runners/lib/agent-firewall/reality/state.js +625 -0
  24. package/bin/runners/lib/agent-firewall/reality/watcher.js +322 -0
  25. package/bin/runners/lib/agent-firewall/risk/index.js +173 -0
  26. package/bin/runners/lib/agent-firewall/risk/scorer.js +328 -0
  27. package/bin/runners/lib/agent-firewall/risk/thresholds.js +321 -0
  28. package/bin/runners/lib/agent-firewall/risk/vectors.js +421 -0
  29. package/bin/runners/lib/agent-firewall/simulator/diff-simulator.js +472 -0
  30. package/bin/runners/lib/agent-firewall/simulator/import-resolver.js +346 -0
  31. package/bin/runners/lib/agent-firewall/simulator/index.js +181 -0
  32. package/bin/runners/lib/agent-firewall/simulator/route-validator.js +380 -0
  33. package/bin/runners/lib/agent-firewall/time-machine/incident-correlator.js +661 -0
  34. package/bin/runners/lib/agent-firewall/time-machine/index.js +267 -0
  35. package/bin/runners/lib/agent-firewall/time-machine/replay-engine.js +436 -0
  36. package/bin/runners/lib/agent-firewall/time-machine/state-reconstructor.js +490 -0
  37. package/bin/runners/lib/agent-firewall/time-machine/timeline-builder.js +530 -0
  38. package/bin/runners/lib/analyzers.js +81 -18
  39. package/bin/runners/lib/api-client.js +269 -0
  40. package/bin/runners/lib/auth-truth.js +193 -193
  41. package/bin/runners/lib/authority-badge.js +425 -0
  42. package/bin/runners/lib/backup.js +62 -62
  43. package/bin/runners/lib/billing.js +107 -107
  44. package/bin/runners/lib/claims.js +118 -118
  45. package/bin/runners/lib/cli-output.js +7 -1
  46. package/bin/runners/lib/cli-ui.js +540 -540
  47. package/bin/runners/lib/contracts/auth-contract.js +202 -202
  48. package/bin/runners/lib/contracts/env-contract.js +181 -181
  49. package/bin/runners/lib/contracts/external-contract.js +206 -206
  50. package/bin/runners/lib/contracts/guard.js +168 -168
  51. package/bin/runners/lib/contracts/index.js +89 -89
  52. package/bin/runners/lib/contracts/plan-validator.js +311 -311
  53. package/bin/runners/lib/contracts/route-contract.js +199 -199
  54. package/bin/runners/lib/contracts.js +804 -804
  55. package/bin/runners/lib/detect.js +89 -89
  56. package/bin/runners/lib/doctor/autofix.js +254 -254
  57. package/bin/runners/lib/doctor/index.js +37 -37
  58. package/bin/runners/lib/doctor/modules/dependencies.js +325 -325
  59. package/bin/runners/lib/doctor/modules/index.js +46 -46
  60. package/bin/runners/lib/doctor/modules/network.js +250 -250
  61. package/bin/runners/lib/doctor/modules/project.js +312 -312
  62. package/bin/runners/lib/doctor/modules/runtime.js +224 -224
  63. package/bin/runners/lib/doctor/modules/security.js +348 -348
  64. package/bin/runners/lib/doctor/modules/system.js +213 -213
  65. package/bin/runners/lib/doctor/modules/vibecheck.js +394 -394
  66. package/bin/runners/lib/doctor/reporter.js +262 -262
  67. package/bin/runners/lib/doctor/service.js +262 -262
  68. package/bin/runners/lib/doctor/types.js +113 -113
  69. package/bin/runners/lib/doctor/ui.js +263 -263
  70. package/bin/runners/lib/doctor-v2.js +608 -608
  71. package/bin/runners/lib/drift.js +425 -425
  72. package/bin/runners/lib/enforcement.js +72 -72
  73. package/bin/runners/lib/enterprise-detect.js +603 -603
  74. package/bin/runners/lib/enterprise-init.js +942 -942
  75. package/bin/runners/lib/env-resolver.js +417 -417
  76. package/bin/runners/lib/env-template.js +66 -66
  77. package/bin/runners/lib/env.js +189 -189
  78. package/bin/runners/lib/error-handler.js +16 -9
  79. package/bin/runners/lib/exit-codes.js +275 -0
  80. package/bin/runners/lib/extractors/client-calls.js +990 -990
  81. package/bin/runners/lib/extractors/fastify-route-dump.js +573 -573
  82. package/bin/runners/lib/extractors/fastify-routes.js +426 -426
  83. package/bin/runners/lib/extractors/index.js +363 -363
  84. package/bin/runners/lib/extractors/next-routes.js +524 -524
  85. package/bin/runners/lib/extractors/proof-graph.js +431 -431
  86. package/bin/runners/lib/extractors/route-matcher.js +451 -451
  87. package/bin/runners/lib/extractors/truthpack-v2.js +377 -377
  88. package/bin/runners/lib/extractors/ui-bindings.js +547 -547
  89. package/bin/runners/lib/findings-schema.js +281 -281
  90. package/bin/runners/lib/firewall-prompt.js +50 -50
  91. package/bin/runners/lib/global-flags.js +37 -0
  92. package/bin/runners/lib/graph/graph-builder.js +265 -265
  93. package/bin/runners/lib/graph/html-renderer.js +413 -413
  94. package/bin/runners/lib/graph/index.js +32 -32
  95. package/bin/runners/lib/graph/runtime-collector.js +215 -215
  96. package/bin/runners/lib/graph/static-extractor.js +518 -518
  97. package/bin/runners/lib/help-formatter.js +413 -0
  98. package/bin/runners/lib/html-report.js +650 -650
  99. package/bin/runners/lib/llm.js +75 -75
  100. package/bin/runners/lib/logger.js +38 -0
  101. package/bin/runners/lib/meter.js +61 -61
  102. package/bin/runners/lib/missions/evidence.js +126 -126
  103. package/bin/runners/lib/patch.js +40 -40
  104. package/bin/runners/lib/permissions/auth-model.js +213 -213
  105. package/bin/runners/lib/permissions/idor-prover.js +205 -205
  106. package/bin/runners/lib/permissions/index.js +45 -45
  107. package/bin/runners/lib/permissions/matrix-builder.js +198 -198
  108. package/bin/runners/lib/pkgjson.js +28 -28
  109. package/bin/runners/lib/policy.js +295 -295
  110. package/bin/runners/lib/preflight.js +142 -142
  111. package/bin/runners/lib/reality/correlation-detectors.js +359 -359
  112. package/bin/runners/lib/reality/index.js +318 -318
  113. package/bin/runners/lib/reality/request-hashing.js +416 -416
  114. package/bin/runners/lib/reality/request-mapper.js +453 -453
  115. package/bin/runners/lib/reality/safety-rails.js +463 -463
  116. package/bin/runners/lib/reality/semantic-snapshot.js +408 -408
  117. package/bin/runners/lib/reality/toast-detector.js +393 -393
  118. package/bin/runners/lib/reality-findings.js +84 -84
  119. package/bin/runners/lib/receipts.js +179 -179
  120. package/bin/runners/lib/redact.js +29 -29
  121. package/bin/runners/lib/replay/capsule-manager.js +154 -154
  122. package/bin/runners/lib/replay/index.js +263 -263
  123. package/bin/runners/lib/replay/player.js +348 -348
  124. package/bin/runners/lib/replay/recorder.js +331 -331
  125. package/bin/runners/lib/report.js +135 -135
  126. package/bin/runners/lib/route-detection.js +1140 -1140
  127. package/bin/runners/lib/sandbox/index.js +59 -59
  128. package/bin/runners/lib/sandbox/proof-chain.js +399 -399
  129. package/bin/runners/lib/sandbox/sandbox-runner.js +205 -205
  130. package/bin/runners/lib/sandbox/worktree.js +174 -174
  131. package/bin/runners/lib/schema-validator.js +350 -350
  132. package/bin/runners/lib/schemas/contracts.schema.json +160 -160
  133. package/bin/runners/lib/schemas/finding.schema.json +100 -100
  134. package/bin/runners/lib/schemas/mission-pack.schema.json +206 -206
  135. package/bin/runners/lib/schemas/proof-graph.schema.json +176 -176
  136. package/bin/runners/lib/schemas/reality-report.schema.json +162 -162
  137. package/bin/runners/lib/schemas/share-pack.schema.json +180 -180
  138. package/bin/runners/lib/schemas/ship-report.schema.json +117 -117
  139. package/bin/runners/lib/schemas/truthpack-v2.schema.json +303 -303
  140. package/bin/runners/lib/schemas/validator.js +438 -438
  141. package/bin/runners/lib/score-history.js +282 -282
  142. package/bin/runners/lib/share-pack.js +239 -239
  143. package/bin/runners/lib/snippets.js +67 -67
  144. package/bin/runners/lib/unified-cli-output.js +604 -0
  145. package/bin/runners/lib/upsell.js +658 -510
  146. package/bin/runners/lib/usage.js +153 -153
  147. package/bin/runners/lib/validate-patch.js +156 -156
  148. package/bin/runners/lib/verdict-engine.js +628 -628
  149. package/bin/runners/reality/engine.js +917 -917
  150. package/bin/runners/reality/flows.js +122 -122
  151. package/bin/runners/reality/report.js +378 -378
  152. package/bin/runners/reality/session.js +193 -193
  153. package/bin/runners/runAgent.d.ts +5 -0
  154. package/bin/runners/runApprove.js +1200 -0
  155. package/bin/runners/runAuth.js +324 -95
  156. package/bin/runners/runCheckpoint.js +39 -21
  157. package/bin/runners/runClassify.js +859 -0
  158. package/bin/runners/runContext.js +136 -24
  159. package/bin/runners/runDoctor.js +108 -68
  160. package/bin/runners/runFirewall.d.ts +5 -0
  161. package/bin/runners/runFirewallHook.d.ts +5 -0
  162. package/bin/runners/runFix.js +6 -5
  163. package/bin/runners/runGuard.js +262 -168
  164. package/bin/runners/runInit.js +3 -2
  165. package/bin/runners/runMcp.js +130 -52
  166. package/bin/runners/runPolish.js +43 -20
  167. package/bin/runners/runProve.js +1 -2
  168. package/bin/runners/runReport.js +3 -2
  169. package/bin/runners/runScan.js +145 -44
  170. package/bin/runners/runShip.js +3 -4
  171. package/bin/runners/runTruth.d.ts +5 -0
  172. package/bin/runners/runValidate.js +19 -2
  173. package/bin/runners/runWatch.js +104 -53
  174. package/bin/vibecheck.js +106 -19
  175. package/mcp-server/HARDENING_SUMMARY.md +299 -0
  176. package/mcp-server/agent-firewall-interceptor.js +367 -31
  177. package/mcp-server/authority-tools.js +569 -0
  178. package/mcp-server/conductor/conflict-resolver.js +588 -0
  179. package/mcp-server/conductor/execution-planner.js +544 -0
  180. package/mcp-server/conductor/index.js +377 -0
  181. package/mcp-server/conductor/lock-manager.js +615 -0
  182. package/mcp-server/conductor/request-queue.js +550 -0
  183. package/mcp-server/conductor/session-manager.js +500 -0
  184. package/mcp-server/conductor/tools.js +510 -0
  185. package/mcp-server/index.js +1199 -208
  186. package/mcp-server/lib/api-client.cjs +305 -0
  187. package/mcp-server/lib/logger.cjs +30 -0
  188. package/mcp-server/logger.js +173 -0
  189. package/mcp-server/package.json +2 -2
  190. package/mcp-server/premium-tools.js +2 -2
  191. package/mcp-server/tier-auth.js +351 -136
  192. package/mcp-server/tools/index.js +72 -72
  193. package/mcp-server/truth-firewall-tools.js +145 -15
  194. package/mcp-server/vibecheck-tools.js +2 -2
  195. package/package.json +2 -3
  196. package/mcp-server/index.old.js +0 -4137
  197. package/mcp-server/package-lock.json +0 -165
@@ -0,0 +1,332 @@
1
+ /**
2
+ * Reality Engine
3
+ *
4
+ * Entry point for the Reality State Engine.
5
+ * Provides a unified API for accessing and monitoring repository reality.
6
+ *
7
+ * Usage:
8
+ * const { reality } = require('./reality');
9
+ *
10
+ * // Get current state
11
+ * const state = reality.getState(projectRoot);
12
+ *
13
+ * // Check if something exists
14
+ * reality.routeExists(state, 'GET', '/api/users');
15
+ * reality.envVarExists(state, 'JWT_SECRET');
16
+ *
17
+ * // Watch for changes
18
+ * const watcher = reality.watch(projectRoot);
19
+ * watcher.on('change', ({ state, changes }) => { ... });
20
+ */
21
+
22
+ "use strict";
23
+
24
+ const {
25
+ buildRealityState,
26
+ getRealityState,
27
+ invalidateCache,
28
+ routeExists,
29
+ envVarExists,
30
+ fileExists,
31
+ getFilesByDomain,
32
+ getStateSummary,
33
+ classifyFileDomain,
34
+ hashFile,
35
+ } = require("./state");
36
+
37
+ const { RealityWatcher, createWatcher } = require("./watcher");
38
+
39
+ /**
40
+ * Reality Engine singleton
41
+ */
42
+ const reality = {
43
+ /**
44
+ * Get the current reality state for a project
45
+ * @param {string} projectRoot - Project root directory
46
+ * @param {Object} options - Options
47
+ * @returns {RealityState} The reality state
48
+ */
49
+ getState(projectRoot, options = {}) {
50
+ return getRealityState(projectRoot, options);
51
+ },
52
+
53
+ /**
54
+ * Build a fresh reality state (bypasses cache)
55
+ * @param {string} projectRoot - Project root directory
56
+ * @param {Object} options - Options
57
+ * @returns {RealityState} The reality state
58
+ */
59
+ build(projectRoot, options = {}) {
60
+ return buildRealityState(projectRoot, { ...options, forceRefresh: true });
61
+ },
62
+
63
+ /**
64
+ * Invalidate the cached reality state
65
+ */
66
+ invalidate() {
67
+ invalidateCache();
68
+ },
69
+
70
+ /**
71
+ * Create a watcher for reality state changes
72
+ * @param {string} projectRoot - Project root directory
73
+ * @param {Object} options - Watcher options
74
+ * @returns {RealityWatcher} The watcher instance
75
+ */
76
+ watch(projectRoot, options = {}) {
77
+ const watcher = createWatcher(projectRoot, options);
78
+ return watcher;
79
+ },
80
+
81
+ /**
82
+ * Check if a route exists in the reality state
83
+ * @param {RealityState} state - Reality state
84
+ * @param {string} method - HTTP method
85
+ * @param {string} path - Route path
86
+ * @returns {boolean} True if route exists
87
+ */
88
+ routeExists(state, method, path) {
89
+ return routeExists(state, method, path);
90
+ },
91
+
92
+ /**
93
+ * Check if an environment variable exists (is declared)
94
+ * @param {RealityState} state - Reality state
95
+ * @param {string} varName - Variable name
96
+ * @returns {boolean} True if env var is declared
97
+ */
98
+ envVarExists(state, varName) {
99
+ return envVarExists(state, varName);
100
+ },
101
+
102
+ /**
103
+ * Check if a file exists in the reality state
104
+ * @param {RealityState} state - Reality state
105
+ * @param {string} filePath - File path (relative to project root)
106
+ * @returns {boolean} True if file exists
107
+ */
108
+ fileExists(state, filePath) {
109
+ return fileExists(state, filePath);
110
+ },
111
+
112
+ /**
113
+ * Get all files in a specific domain
114
+ * @param {RealityState} state - Reality state
115
+ * @param {string} domain - Domain name (auth, payments, routes, etc.)
116
+ * @returns {Array} Array of file objects
117
+ */
118
+ getFilesByDomain(state, domain) {
119
+ return getFilesByDomain(state, domain);
120
+ },
121
+
122
+ /**
123
+ * Get a summary of the reality state
124
+ * @param {RealityState} state - Reality state
125
+ * @returns {Object} Summary object
126
+ */
127
+ getSummary(state) {
128
+ return getStateSummary(state);
129
+ },
130
+
131
+ /**
132
+ * Classify a file path into a domain
133
+ * @param {string} filePath - File path
134
+ * @returns {string} Domain name
135
+ */
136
+ classifyDomain(filePath) {
137
+ return classifyFileDomain(filePath);
138
+ },
139
+
140
+ /**
141
+ * Calculate a file's content hash
142
+ * @param {string} filePath - Absolute file path
143
+ * @returns {string|null} Hash or null if file can't be read
144
+ */
145
+ hashFile(filePath) {
146
+ return hashFile(filePath);
147
+ },
148
+
149
+ /**
150
+ * Validate assumptions against reality
151
+ * @param {RealityState} state - Reality state
152
+ * @param {Array} assumptions - Array of assumptions to validate
153
+ * @returns {Object} Validation results
154
+ */
155
+ validateAssumptions(state, assumptions) {
156
+ const results = {
157
+ valid: [],
158
+ invalid: [],
159
+ unknown: [],
160
+ };
161
+
162
+ for (const assumption of assumptions) {
163
+ const result = {
164
+ assumption,
165
+ status: "unknown",
166
+ evidence: null,
167
+ };
168
+
169
+ switch (assumption.type) {
170
+ case "env":
171
+ if (envVarExists(state, assumption.key)) {
172
+ result.status = "valid";
173
+ result.evidence = state.envVars.get(assumption.key);
174
+ } else {
175
+ result.status = "invalid";
176
+ result.evidence = `Environment variable '${assumption.key}' is not declared`;
177
+ }
178
+ break;
179
+
180
+ case "route":
181
+ if (routeExists(state, assumption.method || "GET", assumption.path)) {
182
+ result.status = "valid";
183
+ const route = state.routes.find(r =>
184
+ r.path === assumption.path ||
185
+ r.method.toUpperCase() === (assumption.method || "GET").toUpperCase()
186
+ );
187
+ result.evidence = route;
188
+ } else {
189
+ result.status = "invalid";
190
+ result.evidence = `Route '${assumption.method || "GET"} ${assumption.path}' is not registered`;
191
+ }
192
+ break;
193
+
194
+ case "file":
195
+ if (fileExists(state, assumption.path)) {
196
+ result.status = "valid";
197
+ result.evidence = state.files.get(assumption.path.replace(/\\/g, "/"));
198
+ } else {
199
+ result.status = "invalid";
200
+ result.evidence = `File '${assumption.path}' does not exist`;
201
+ }
202
+ break;
203
+
204
+ case "service":
205
+ const service = state.services.find(s =>
206
+ s.name === assumption.name || s.name === assumption.key
207
+ );
208
+ if (service) {
209
+ result.status = "valid";
210
+ result.evidence = service;
211
+ } else {
212
+ result.status = "invalid";
213
+ result.evidence = `Service '${assumption.name || assumption.key}' is not registered`;
214
+ }
215
+ break;
216
+
217
+ default:
218
+ result.status = "unknown";
219
+ result.evidence = `Unknown assumption type: ${assumption.type}`;
220
+ }
221
+
222
+ if (result.status === "valid") {
223
+ results.valid.push(result);
224
+ } else if (result.status === "invalid") {
225
+ results.invalid.push(result);
226
+ } else {
227
+ results.unknown.push(result);
228
+ }
229
+ }
230
+
231
+ return results;
232
+ },
233
+
234
+ /**
235
+ * Get reality diff between two states
236
+ * @param {RealityState} oldState - Previous state
237
+ * @param {RealityState} newState - Current state
238
+ * @returns {Object} Diff object
239
+ */
240
+ diff(oldState, newState) {
241
+ const diff = {
242
+ files: {
243
+ added: [],
244
+ removed: [],
245
+ modified: [],
246
+ },
247
+ routes: {
248
+ added: [],
249
+ removed: [],
250
+ },
251
+ envVars: {
252
+ added: [],
253
+ removed: [],
254
+ },
255
+ };
256
+
257
+ // File diff
258
+ const oldFiles = new Set(oldState.files.keys());
259
+ const newFiles = new Set(newState.files.keys());
260
+
261
+ for (const file of newFiles) {
262
+ if (!oldFiles.has(file)) {
263
+ diff.files.added.push(file);
264
+ } else {
265
+ const oldMeta = oldState.files.get(file);
266
+ const newMeta = newState.files.get(file);
267
+ if (oldMeta.hash !== newMeta.hash) {
268
+ diff.files.modified.push(file);
269
+ }
270
+ }
271
+ }
272
+
273
+ for (const file of oldFiles) {
274
+ if (!newFiles.has(file)) {
275
+ diff.files.removed.push(file);
276
+ }
277
+ }
278
+
279
+ // Route diff
280
+ const oldRoutes = new Set(oldState.routes.map(r => `${r.method}:${r.path}`));
281
+ const newRoutes = new Set(newState.routes.map(r => `${r.method}:${r.path}`));
282
+
283
+ for (const route of newState.routes) {
284
+ const key = `${route.method}:${route.path}`;
285
+ if (!oldRoutes.has(key)) {
286
+ diff.routes.added.push(route);
287
+ }
288
+ }
289
+
290
+ for (const route of oldState.routes) {
291
+ const key = `${route.method}:${route.path}`;
292
+ if (!newRoutes.has(key)) {
293
+ diff.routes.removed.push(route);
294
+ }
295
+ }
296
+
297
+ // Env var diff
298
+ const oldEnvVars = new Set(oldState.envVars.keys());
299
+ const newEnvVars = new Set(newState.envVars.keys());
300
+
301
+ for (const varName of newEnvVars) {
302
+ if (!oldEnvVars.has(varName)) {
303
+ diff.envVars.added.push(varName);
304
+ }
305
+ }
306
+
307
+ for (const varName of oldEnvVars) {
308
+ if (!newEnvVars.has(varName)) {
309
+ diff.envVars.removed.push(varName);
310
+ }
311
+ }
312
+
313
+ return diff;
314
+ },
315
+ };
316
+
317
+ module.exports = {
318
+ reality,
319
+ RealityWatcher,
320
+ createWatcher,
321
+ // Re-export individual functions for direct access
322
+ buildRealityState,
323
+ getRealityState,
324
+ invalidateCache,
325
+ routeExists,
326
+ envVarExists,
327
+ fileExists,
328
+ getFilesByDomain,
329
+ getStateSummary,
330
+ classifyFileDomain,
331
+ hashFile,
332
+ };