@vibecheckai/cli 3.3.0 → 3.5.0

package/bin/runners/lib/sbom-generator.js

@@ -0,0 +1,641 @@
+/**
+ * Enterprise SBOM Generator
+ * 
+ * Software Bill of Materials with:
+ * - CycloneDX format
+ * - SPDX format
+ * - Vulnerability correlation
+ * - License compliance
+ * - Dependency graph
+ */
+
+"use strict";
+
+const crypto = require("crypto");
+const fs = require("fs");
+const path = require("path");
+const { execSync } = require("child_process");
+
+/**
+ * SBOM formats
+ */
+const SBOM_FORMATS = {
+  CYCLONEDX: "cyclonedx",
+  SPDX: "spdx",
+  JSON: "json",
+};
+
+/**
+ * Component types
+ */
+const COMPONENT_TYPES = {
+  APPLICATION: "application",
+  LIBRARY: "library",
+  FRAMEWORK: "framework",
+  OPERATING_SYSTEM: "operating-system",
+  DEVICE: "device",
+  FILE: "file",
+  CONTAINER: "container",
+  FIRMWARE: "firmware",
+  DATA: "data",
+};
+
+/**
+ * License risk levels
+ */
+const LICENSE_RISK = {
+  GPL: { risk: "high", copyleft: true },
+  "GPL-2.0": { risk: "high", copyleft: true },
+  "GPL-3.0": { risk: "high", copyleft: true },
+  LGPL: { risk: "medium", copyleft: true },
+  "LGPL-2.0": { risk: "medium", copyleft: true },
+  "LGPL-3.0": { risk: "medium", copyleft: true },
+  AGPL: { risk: "critical", copyleft: true },
+  "AGPL-3.0": { risk: "critical", copyleft: true },
+  MIT: { risk: "low", copyleft: false },
+  ISC: { risk: "low", copyleft: false },
+  Apache: { risk: "low", copyleft: false },
+  "Apache-2.0": { risk: "low", copyleft: false },
+  BSD: { risk: "low", copyleft: false },
+  "BSD-2-Clause": { risk: "low", copyleft: false },
+  "BSD-3-Clause": { risk: "low", copyleft: false },
+  Unlicense: { risk: "low", copyleft: false },
+  CC0: { risk: "low", copyleft: false },
+  "0BSD": { risk: "low", copyleft: false },
+};
+
+/**
+ * Known vulnerabilities database (sample - would connect to real DB)
+ */
+const KNOWN_VULNERABILITIES = {
+  "lodash": {
+    "< 4.17.21": [
+      { id: "CVE-2021-23337", severity: "high", title: "Command Injection" },
+      { id: "CVE-2020-8203", severity: "high", title: "Prototype Pollution" },
+    ],
+  },
+  "minimist": {
+    "< 1.2.6": [
+      { id: "CVE-2021-44906", severity: "critical", title: "Prototype Pollution" },
+    ],
+  },
+  "axios": {
+    "< 0.21.2": [
+      { id: "CVE-2021-3749", severity: "high", title: "ReDoS" },
+    ],
+  },
+  "express": {
+    "< 4.17.3": [
+      { id: "CVE-2022-24999", severity: "medium", title: "Open Redirect" },
+    ],
+  },
+  "jsonwebtoken": {
+    "< 9.0.0": [
+      { id: "CVE-2022-23529", severity: "critical", title: "Signature Bypass" },
+    ],
+  },
+};
+
+/**
+ * Parse package.json dependencies
+ */
+function parsePackageJson(packageJsonPath) {
+  const content = fs.readFileSync(packageJsonPath, "utf-8");
+  const pkg = JSON.parse(content);
+  
+  return {
+    name: pkg.name || "unknown",
+    version: pkg.version || "0.0.0",
+    description: pkg.description || "",
+    license: pkg.license || "UNKNOWN",
+    dependencies: pkg.dependencies || {},
+    devDependencies: pkg.devDependencies || {},
+    peerDependencies: pkg.peerDependencies || {},
+    optionalDependencies: pkg.optionalDependencies || {},
+    author: pkg.author,
+    repository: pkg.repository,
+  };
+}
+
+/**
+ * Parse package-lock.json for resolved versions
+ */
+function parsePackageLock(lockPath) {
+  if (!fs.existsSync(lockPath)) {
+    return null;
+  }
+  
+  const content = fs.readFileSync(lockPath, "utf-8");
+  const lock = JSON.parse(content);
+  
+  const packages = new Map();
+  
+  // Handle npm v2 format
+  if (lock.packages) {
+    for (const [pkgPath, pkgInfo] of Object.entries(lock.packages)) {
+      if (!pkgPath) continue; // Skip root
+      
+      const name = pkgPath.replace(/^node_modules\//, "").replace(/\/node_modules\//g, "/");
+      packages.set(name, {
+        version: pkgInfo.version,
+        resolved: pkgInfo.resolved,
+        integrity: pkgInfo.integrity,
+        dev: pkgInfo.dev || false,
+        optional: pkgInfo.optional || false,
+        peer: pkgInfo.peer || false,
+        license: pkgInfo.license,
+        dependencies: pkgInfo.dependencies || {},
+      });
+    }
+  }
+  
+  // Handle npm v1 format
+  if (lock.dependencies) {
+    function extractDeps(deps, prefix = "") {
+      for (const [name, info] of Object.entries(deps)) {
+        const fullName = prefix ? `${prefix}/${name}` : name;
+        packages.set(fullName, {
+          version: info.version,
+          resolved: info.resolved,
+          integrity: info.integrity,
+          dev: info.dev || false,
+          optional: info.optional || false,
+          dependencies: info.dependencies || {},
+        });
+        
+        if (info.dependencies) {
+          extractDeps(info.dependencies, fullName);
+        }
+      }
+    }
+    extractDeps(lock.dependencies);
+  }
+  
+  return packages;
+}
+
+/**
+ * Check for vulnerabilities
+ */
+function checkVulnerabilities(name, version) {
+  const vulns = [];
+  
+  // Simple version check (would use proper semver in production)
+  const pkgVulns = KNOWN_VULNERABILITIES[name];
+  if (pkgVulns) {
+    for (const [range, vulnList] of Object.entries(pkgVulns)) {
+      // Simple less-than check
+      const match = range.match(/^<\s*(.+)$/);
+      if (match) {
+        const maxVersion = match[1];
+        if (compareVersions(version, maxVersion) < 0) {
+          vulns.push(...vulnList);
+        }
+      }
+    }
+  }
+  
+  return vulns;
+}
+
+/**
+ * Simple version comparison
+ */
+function compareVersions(a, b) {
+  const partsA = a.split(".").map(Number);
+  const partsB = b.split(".").map(Number);
+  
+  for (let i = 0; i < Math.max(partsA.length, partsB.length); i++) {
+    const numA = partsA[i] || 0;
+    const numB = partsB[i] || 0;
+    if (numA < numB) return -1;
+    if (numA > numB) return 1;
+  }
+  
+  return 0;
+}
+
+/**
+ * Get license risk assessment
+ */
+function getLicenseRisk(license) {
+  if (!license || license === "UNKNOWN") {
+    return { risk: "unknown", copyleft: null };
+  }
+  
+  // Normalize license name
+  const normalized = license.toUpperCase().replace(/-ONLY|-OR-LATER/g, "");
+  
+  for (const [key, value] of Object.entries(LICENSE_RISK)) {
+    if (normalized.includes(key.toUpperCase())) {
+      return value;
+    }
+  }
+  
+  return { risk: "unknown", copyleft: null };
+}
+
+/**
+ * Generate component purl (Package URL)
+ */
+function generatePurl(type, name, version, qualifier = {}) {
+  const namespace = name.includes("/") ? name.split("/")[0] : null;
+  const pkgName = name.includes("/") ? name.split("/")[1] : name;
+  
+  let purl = `pkg:npm`;
+  if (namespace) {
+    purl += `/${encodeURIComponent(namespace)}`;
+  }
+  purl += `/${encodeURIComponent(pkgName)}@${version}`;
+  
+  if (Object.keys(qualifier).length > 0) {
+    const qs = Object.entries(qualifier)
+      .map(([k, v]) => `${k}=${encodeURIComponent(v)}`)
+      .join("&");
+    purl += `?${qs}`;
+  }
+  
+  return purl;
+}
+
+/**
+ * Generate CycloneDX SBOM
+ */
+function generateCycloneDX(projectPath, options = {}) {
+  const packageJsonPath = path.join(projectPath, "package.json");
+  const lockPath = path.join(projectPath, "package-lock.json");
+  
+  if (!fs.existsSync(packageJsonPath)) {
+    throw new Error("package.json not found");
+  }
+  
+  const pkg = parsePackageJson(packageJsonPath);
+  const lockPackages = parsePackageLock(lockPath);
+  
+  const sbom = {
+    bomFormat: "CycloneDX",
+    specVersion: "1.5",
+    serialNumber: `urn:uuid:${crypto.randomUUID()}`,
+    version: 1,
+    metadata: {
+      timestamp: new Date().toISOString(),
+      tools: [
+        {
+          vendor: "VibeCheck",
+          name: "vibecheck-cli",
+          version: options.version || "1.0.0",
+        },
+      ],
+      authors: [
+        {
+          name: pkg.author?.name || pkg.author || "Unknown",
+        },
+      ],
+      component: {
+        type: COMPONENT_TYPES.APPLICATION,
+        name: pkg.name,
+        version: pkg.version,
+        description: pkg.description,
+        purl: generatePurl("npm", pkg.name, pkg.version),
+        licenses: pkg.license ? [{ license: { id: pkg.license } }] : [],
+      },
+    },
+    components: [],
+    dependencies: [],
+    vulnerabilities: [],
+  };
+  
+  // Collect all dependencies
+  const allDeps = {
+    ...pkg.dependencies,
+    ...pkg.devDependencies,
+    ...pkg.peerDependencies,
+    ...pkg.optionalDependencies,
+  };
+  
+  const componentMap = new Map();
+  
+  for (const [name, versionRange] of Object.entries(allDeps)) {
+    const lockInfo = lockPackages?.get(name);
+    const version = lockInfo?.version || versionRange.replace(/[\^~]/, "");
+    const license = lockInfo?.license || "UNKNOWN";
+    
+    const component = {
+      type: COMPONENT_TYPES.LIBRARY,
+      name,
+      version,
+      purl: generatePurl("npm", name, version),
+      licenses: license !== "UNKNOWN" ? [{ license: { id: license } }] : [],
+      properties: [],
+    };
+    
+    // Check for vulnerabilities
+    const vulns = checkVulnerabilities(name, version);
+    if (vulns.length > 0) {
+      for (const vuln of vulns) {
+        sbom.vulnerabilities.push({
+          id: vuln.id,
+          source: { name: "NVD" },
+          ratings: [
+            {
+              severity: vuln.severity,
+              method: "CVSSv3",
+            },
+          ],
+          description: vuln.title,
+          affects: [
+            {
+              ref: component.purl,
+            },
+          ],
+        });
+      }
+    }
+    
+    // Check license risk
+    const licenseRisk = getLicenseRisk(license);
+    if (licenseRisk.risk !== "low") {
+      component.properties.push({
+        name: "vibecheck:license-risk",
+        value: licenseRisk.risk,
+      });
+    }
+    if (licenseRisk.copyleft) {
+      component.properties.push({
+        name: "vibecheck:copyleft",
+        value: "true",
+      });
+    }
+    
+    // Add dev/optional flags
+    if (pkg.devDependencies?.[name]) {
+      component.properties.push({
+        name: "cdx:npm:dev",
+        value: "true",
+      });
+    }
+    if (pkg.optionalDependencies?.[name]) {
+      component.properties.push({
+        name: "cdx:npm:optional",
+        value: "true",
+      });
+    }
+    
+    sbom.components.push(component);
+    componentMap.set(name, component);
+  }
+  
+  // Build dependency graph
+  sbom.dependencies.push({
+    ref: sbom.metadata.component.purl,
+    dependsOn: Object.keys(pkg.dependencies || {}).map(name => 
+      generatePurl("npm", name, componentMap.get(name)?.version || "*")
+    ),
+  });
+  
+  for (const [name, lockInfo] of lockPackages || []) {
+    if (lockInfo?.dependencies) {
+      const component = componentMap.get(name);
+      if (component) {
+        sbom.dependencies.push({
+          ref: component.purl,
+          dependsOn: Object.keys(lockInfo.dependencies).map(depName =>
+            generatePurl("npm", depName, lockPackages.get(depName)?.version || "*")
+          ),
+        });
+      }
+    }
+  }
+  
+  return sbom;
+}
+
+/**
+ * Generate SPDX SBOM
+ */
+function generateSPDX(projectPath, options = {}) {
+  const packageJsonPath = path.join(projectPath, "package.json");
+  const lockPath = path.join(projectPath, "package-lock.json");
+  
+  if (!fs.existsSync(packageJsonPath)) {
+    throw new Error("package.json not found");
+  }
+  
+  const pkg = parsePackageJson(packageJsonPath);
+  const lockPackages = parsePackageLock(lockPath);
+  
+  const sbom = {
+    spdxVersion: "SPDX-2.3",
+    dataLicense: "CC0-1.0",
+    SPDXID: "SPDXRef-DOCUMENT",
+    name: `${pkg.name}-sbom`,
+    documentNamespace: `https://vibecheck.dev/spdx/${pkg.name}/${crypto.randomUUID()}`,
+    creationInfo: {
+      created: new Date().toISOString(),
+      creators: [
+        "Tool: vibecheck-cli-" + (options.version || "1.0.0"),
+        "Organization: VibeCheck",
+      ],
+      licenseListVersion: "3.21",
+    },
+    packages: [],
+    relationships: [],
+  };
+  
+  // Root package
+  const rootPackage = {
+    SPDXID: "SPDXRef-Package-root",
+    name: pkg.name,
+    versionInfo: pkg.version,
+    downloadLocation: pkg.repository?.url || "NOASSERTION",
+    filesAnalyzed: false,
+    licenseConcluded: pkg.license || "NOASSERTION",
+    licenseDeclared: pkg.license || "NOASSERTION",
+    copyrightText: "NOASSERTION",
+    externalRefs: [
+      {
+        referenceCategory: "PACKAGE-MANAGER",
+        referenceType: "purl",
+        referenceLocator: generatePurl("npm", pkg.name, pkg.version),
+      },
+    ],
+  };
+  
+  sbom.packages.push(rootPackage);
+  
+  // Dependencies
+  const allDeps = {
+    ...pkg.dependencies,
+    ...pkg.devDependencies,
+  };
+  
+  let pkgIndex = 1;
+  for (const [name, versionRange] of Object.entries(allDeps)) {
+    const lockInfo = lockPackages?.get(name);
+    const version = lockInfo?.version || versionRange.replace(/[\^~]/, "");
+    const license = lockInfo?.license || "NOASSERTION";
+    
+    const spdxId = `SPDXRef-Package-${pkgIndex++}`;
+    
+    sbom.packages.push({
+      SPDXID: spdxId,
+      name,
+      versionInfo: version,
+      downloadLocation: lockInfo?.resolved || "NOASSERTION",
+      filesAnalyzed: false,
+      licenseConcluded: license,
+      licenseDeclared: license,
+      copyrightText: "NOASSERTION",
+      checksums: lockInfo?.integrity ? [
+        {
+          algorithm: lockInfo.integrity.startsWith("sha512") ? "SHA512" : "SHA256",
+          checksumValue: lockInfo.integrity.split("-")[1],
+        },
+      ] : [],
+      externalRefs: [
+        {
+          referenceCategory: "PACKAGE-MANAGER",
+          referenceType: "purl",
+          referenceLocator: generatePurl("npm", name, version),
+        },
+      ],
+    });
+    
+    // Relationship
+    sbom.relationships.push({
+      spdxElementId: "SPDXRef-Package-root",
+      relationshipType: pkg.devDependencies?.[name] ? "DEV_DEPENDENCY_OF" : "DEPENDS_ON",
+      relatedSpdxElement: spdxId,
+    });
+  }
+  
+  // Document describes root
+  sbom.relationships.push({
+    spdxElementId: "SPDXRef-DOCUMENT",
+    relationshipType: "DESCRIBES",
+    relatedSpdxElement: "SPDXRef-Package-root",
+  });
+  
+  return sbom;
+}
+
+/**
+ * Generate SBOM summary report
+ */
+function generateSBOMSummary(sbom) {
+  const summary = {
+    format: sbom.bomFormat || (sbom.spdxVersion ? "SPDX" : "Unknown"),
+    totalComponents: sbom.components?.length || sbom.packages?.length || 0,
+    vulnerabilities: {
+      total: sbom.vulnerabilities?.length || 0,
+      critical: 0,
+      high: 0,
+      medium: 0,
+      low: 0,
+    },
+    licenses: {},
+    licenseRisk: {
+      critical: 0,
+      high: 0,
+      medium: 0,
+      low: 0,
+      unknown: 0,
+    },
+  };
+  
+  // Count vulnerabilities by severity
+  for (const vuln of sbom.vulnerabilities || []) {
+    const severity = vuln.ratings?.[0]?.severity || "unknown";
+    if (summary.vulnerabilities[severity] !== undefined) {
+      summary.vulnerabilities[severity]++;
+    }
+  }
+  
+  // Count licenses
+  const components = sbom.components || sbom.packages || [];
+  for (const component of components) {
+    let license = "UNKNOWN";
+    
+    if (component.licenses?.[0]?.license?.id) {
+      license = component.licenses[0].license.id;
+    } else if (component.licenseConcluded) {
+      license = component.licenseConcluded;
+    }
+    
+    summary.licenses[license] = (summary.licenses[license] || 0) + 1;
+    
+    const risk = getLicenseRisk(license);
+    if (summary.licenseRisk[risk.risk] !== undefined) {
+      summary.licenseRisk[risk.risk]++;
+    }
+  }
+  
+  return summary;
+}
+
+// Terminal UI
+let terminalUI;
+try {
+  terminalUI = require("./terminal-ui");
+} catch {
+  terminalUI = {
+    c: { reset: "", bold: "", dim: "" },
+    rgb: () => "",
+  };
+}
+
+const { c, rgb } = terminalUI;
+
+const colors = {
+  critical: rgb(255, 80, 80),
+  high: rgb(255, 150, 50),
+  medium: rgb(255, 200, 0),
+  low: rgb(100, 200, 255),
+  success: rgb(0, 255, 150),
+  accent: rgb(0, 200, 255),
+};
+
+/**
+ * Render SBOM summary for terminal
+ */
+function renderSBOMSummary(summary) {
+  const lines = [];
+  
+  lines.push(`  ${c.dim}╭${"─".repeat(60)}╮${c.reset}`);
+  lines.push(`  ${c.dim}│${c.reset} ${colors.accent}${c.bold}📦 SOFTWARE BILL OF MATERIALS${c.reset}                              ${c.dim}│${c.reset}`);
+  lines.push(`  ${c.dim}├${"─".repeat(60)}┤${c.reset}`);
+  
+  lines.push(`  ${c.dim}│${c.reset} Format: ${c.bold}${summary.format}${c.reset}                                            ${c.dim}│${c.reset}`);
+  lines.push(`  ${c.dim}│${c.reset} Components: ${c.bold}${summary.totalComponents}${c.reset}                                         ${c.dim}│${c.reset}`);
+  
+  lines.push(`  ${c.dim}├${"─".repeat(60)}┤${c.reset}`);
+  lines.push(`  ${c.dim}│${c.reset} ${c.bold}Vulnerabilities:${c.reset}                                           ${c.dim}│${c.reset}`);
+  
+  const vulns = summary.vulnerabilities;
+  lines.push(`  ${c.dim}│${c.reset}   ${colors.critical}● Critical: ${vulns.critical}${c.reset}  ${colors.high}● High: ${vulns.high}${c.reset}  ${colors.medium}● Medium: ${vulns.medium}${c.reset}  ${colors.low}● Low: ${vulns.low}${c.reset}  ${c.dim}│${c.reset}`);
+  
+  lines.push(`  ${c.dim}├${"─".repeat(60)}┤${c.reset}`);
+  lines.push(`  ${c.dim}│${c.reset} ${c.bold}License Risk:${c.reset}                                              ${c.dim}│${c.reset}`);
+  
+  const risk = summary.licenseRisk;
+  lines.push(`  ${c.dim}│${c.reset}   ${colors.critical}● Critical: ${risk.critical}${c.reset}  ${colors.high}● High: ${risk.high}${c.reset}  ${colors.medium}● Medium: ${risk.medium}${c.reset}  ${colors.success}● Low: ${risk.low}${c.reset}   ${c.dim}│${c.reset}`);
+  
+  lines.push(`  ${c.dim}╰${"─".repeat(60)}╯${c.reset}`);
+  
+  return lines.join("\n");
+}
+
+module.exports = {
+  generateCycloneDX,
+  generateSPDX,
+  generateSBOMSummary,
+  renderSBOMSummary,
+  parsePackageJson,
+  parsePackageLock,
+  checkVulnerabilities,
+  getLicenseRisk,
+  generatePurl,
+  SBOM_FORMATS,
+  COMPONENT_TYPES,
+  LICENSE_RISK,
+};