@vibecheckai/cli 3.4.0 → 3.5.0

package/bin/runners/runIaC.js

@@ -0,0 +1,372 @@
+/**
+ * Infrastructure as Code (IaC) Security Scanner CLI
+ * 
+ * Scans Terraform and CloudFormation files for security issues
+ */
+
+"use strict";
+
+const path = require("path");
+const fs = require("fs");
+const { parseGlobalFlags, shouldShowBanner } = require("./lib/global-flags");
+const { EXIT } = require("./lib/exit-codes");
+
+// Terminal UI
+let terminalUI;
+try {
+  terminalUI = require("./lib/terminal-ui");
+} catch {
+  terminalUI = {
+    c: { reset: "", bold: "", dim: "", red: "", yellow: "", green: "", cyan: "" },
+    rgb: () => "",
+    icons: { check: "✓", cross: "✗", warning: "⚠", info: "ℹ" },
+    Spinner: class { start() {} succeed() {} fail() {} },
+  };
+}
+
+const { c, rgb, icons, Spinner } = terminalUI;
+
+// Unified Output System
+const { output } = require("./lib/output/index.js");
+
+// Colors
+const colors = {
+  critical: rgb(255, 80, 80),
+  high: rgb(255, 150, 50),
+  medium: rgb(255, 200, 0),
+  low: rgb(100, 200, 255),
+  info: rgb(150, 150, 150),
+  success: rgb(0, 255, 150),
+  accent: rgb(0, 200, 255),
+  terraform: rgb(123, 66, 255),
+  cloudformation: rgb(255, 153, 0),
+};
+
+const BANNER = `
+${rgb(123, 66, 255)}  ╔═══════════════════════════════════════════════════════════════╗${c.reset}
+${rgb(123, 66, 255)}  ║  ${c.bold}IAC SECURITY${c.reset}${rgb(123, 66, 255)} • Terraform / CloudFormation Scanning       ║${c.reset}
+${rgb(123, 66, 255)}  ╚═══════════════════════════════════════════════════════════════╝${c.reset}
+`;
+
+function printBanner() {
+  console.log(BANNER);
+}
+
+function printHelp() {
+  console.log(`
+${c.bold}Usage:${c.reset} vibecheck iac [options] [path]
+
+${c.bold}Description:${c.reset}
+  Scan Infrastructure as Code files for security misconfigurations.
+  Supports Terraform (.tf) and CloudFormation (YAML/JSON).
+
+${c.bold}Options:${c.reset}
+  ${colors.accent}--path, -p${c.reset}      Path to IaC files or directory (default: .)
+  ${colors.accent}--json${c.reset}          Output as JSON
+  ${colors.accent}--sarif${c.reset}         Output as SARIF for GitHub
+  ${colors.accent}--ignore${c.reset}        Ignore specific rule IDs (comma-separated)
+  ${colors.accent}--min-severity${c.reset}  Minimum severity to report (critical/high/medium/low)
+  ${colors.accent}--provider${c.reset}      Scan only specific provider (terraform/cloudformation)
+  ${colors.accent}--verbose, -v${c.reset}   Show detailed output
+  ${colors.accent}--help, -h${c.reset}      Show this help
+
+${c.bold}Examples:${c.reset}
+  ${c.dim}# Scan current directory${c.reset}
+  vibecheck iac
+
+  ${c.dim}# Scan Terraform files only${c.reset}
+  vibecheck iac --provider terraform
+
+  ${c.dim}# JSON output for CI${c.reset}
+  vibecheck iac --json
+
+  ${c.dim}# SARIF output for GitHub Security${c.reset}
+  vibecheck iac --sarif
+
+  ${c.dim}# Ignore specific rules${c.reset}
+  vibecheck iac --ignore AWS-S3-001,AWS-IAM-001
+`);
+}
+
+function parseArgs(args) {
+  const { flags: globalFlags, cleanArgs } = parseGlobalFlags(args);
+  
+  const opts = {
+    path: globalFlags.path || ".",
+    json: globalFlags.json || false,
+    sarif: false,
+    verbose: globalFlags.verbose || false,
+    help: globalFlags.help || false,
+    ignore: [],
+    minSeverity: null,
+    provider: null,
+    noBanner: globalFlags.noBanner || false,
+    ci: globalFlags.ci || false,
+    quiet: globalFlags.quiet || false,
+  };
+
+  for (let i = 0; i < cleanArgs.length; i++) {
+    const arg = cleanArgs[i];
+    
+    if (arg === "--sarif") opts.sarif = true;
+    else if (arg === "--ignore") {
+      opts.ignore = (cleanArgs[++i] || "").split(",").filter(Boolean);
+    }
+    else if (arg.startsWith("--ignore=")) {
+      opts.ignore = arg.split("=")[1].split(",").filter(Boolean);
+    }
+    else if (arg === "--min-severity") {
+      opts.minSeverity = cleanArgs[++i];
+    }
+    else if (arg.startsWith("--min-severity=")) {
+      opts.minSeverity = arg.split("=")[1];
+    }
+    else if (arg === "--provider") {
+      opts.provider = cleanArgs[++i];
+    }
+    else if (arg.startsWith("--provider=")) {
+      opts.provider = arg.split("=")[1];
+    }
+    else if (!arg.startsWith("-")) {
+      opts.path = arg;
+    }
+  }
+
+  return opts;
+}
+
+function formatFinding(finding, verbose = false) {
+  const severityColors = {
+    critical: colors.critical,
+    high: colors.high,
+    medium: colors.medium,
+    low: colors.low,
+    info: colors.info,
+  };
+  
+  const severityIcons = {
+    critical: "🔴",
+    high: "🟠",
+    medium: "🟡",
+    low: "🔵",
+    info: "⚪",
+  };
+
+  const color = severityColors[finding.severity] || colors.info;
+  const icon = severityIcons[finding.severity] || "⚪";
+  
+  let output = `  ${icon} ${color}${finding.severity.toUpperCase()}${c.reset} ${finding.title}\n`;
+  output += `     ${c.dim}${finding.id}${c.reset}`;
+  
+  if (finding.resource) {
+    output += ` ${c.dim}• ${finding.resource}${c.reset}`;
+  }
+  
+  if (finding.line) {
+    output += ` ${c.dim}(line ${finding.line})${c.reset}`;
+  }
+  
+  output += "\n";
+  
+  if (verbose) {
+    output += `     ${c.dim}${finding.description}${c.reset}\n`;
+    output += `     ${colors.accent}Fix:${c.reset} ${finding.recommendation}\n`;
+    if (finding.cwe) {
+      output += `     ${c.dim}CWE: ${finding.cwe}${c.reset}\n`;
+    }
+  }
+  
+  return output;
+}
+
+async function runIaC(args) {
+  const opts = parseArgs(args);
+
+  if (opts.help) {
+    printHelp();
+    return EXIT.SUCCESS;
+  }
+
+  if (shouldShowBanner(opts)) {
+    printBanner();
+  }
+
+  const spinner = new Spinner();
+  spinner.start("Scanning for IaC files...");
+
+  try {
+    // Dynamic import of the security package
+    let iacScanner;
+    try {
+      iacScanner = require("@vibecheck/security").scanIaC || 
+                  require("@vibecheck/security").iac?.scanIaC;
+      
+      if (!iacScanner) {
+        // Try direct import
+        const security = require("../../packages/security/src/iac/scanner");
+        iacScanner = security.scanIaC;
+      }
+    } catch (e) {
+      // Fallback: try relative path
+      try {
+        const security = require("../../packages/security/src/iac/scanner");
+        iacScanner = security.scanIaC;
+      } catch {
+        spinner.fail("IaC scanning module not available");
+        console.error(`\n  ${colors.critical}${icons.cross}${c.reset} IaC scanning requires @vibecheck/security package\n`);
+        return EXIT.INTERNAL_ERROR;
+      }
+    }
+
+    const targetPath = path.resolve(opts.path);
+    
+    // Determine providers to scan
+    const providers = opts.provider 
+      ? [opts.provider]
+      : ["terraform", "cloudformation"];
+
+    const results = await iacScanner({
+      paths: [targetPath],
+      providers,
+      ignoreRules: opts.ignore,
+      minSeverity: opts.minSeverity,
+      includeInfo: opts.verbose,
+    });
+
+    spinner.succeed(`Found ${results.length} provider(s) with IaC files`);
+
+    if (results.length === 0) {
+      console.log(`\n  ${c.dim}No IaC files found in ${targetPath}${c.reset}\n`);
+      return EXIT.SUCCESS;
+    }
+
+    // Aggregate findings
+    const totalFindings = results.flatMap(r => r.findings);
+    const totalScore = results.length > 0 
+      ? Math.round(results.reduce((sum, r) => sum + r.score, 0) / results.length)
+      : 100;
+
+    // JSON output
+    if (opts.json) {
+      console.log(JSON.stringify({
+        success: true,
+        results,
+        summary: {
+          providersScanned: results.length,
+          filesScanned: results.reduce((sum, r) => sum + r.files.length, 0),
+          resourcesScanned: results.reduce((sum, r) => sum + r.resourceCount, 0),
+          totalFindings: totalFindings.length,
+          score: totalScore,
+          critical: totalFindings.filter(f => f.severity === "critical").length,
+          high: totalFindings.filter(f => f.severity === "high").length,
+          medium: totalFindings.filter(f => f.severity === "medium").length,
+          low: totalFindings.filter(f => f.severity === "low").length,
+        },
+      }, null, 2));
+      
+      return totalFindings.some(f => f.severity === "critical" || f.severity === "high")
+        ? EXIT.BLOCKING
+        : totalFindings.length > 0 ? EXIT.WARNINGS : EXIT.SUCCESS;
+    }
+
+    // SARIF output
+    if (opts.sarif) {
+      let formatAsSARIF;
+      try {
+        formatAsSARIF = require("@vibecheck/security").formatAsSARIF ||
+                       require("../../packages/security/src/iac/scanner").formatAsSARIF;
+      } catch {
+        // Manual SARIF format
+        formatAsSARIF = (results) => ({
+          $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+          version: "2.1.0",
+          runs: results.map(result => ({
+            tool: {
+              driver: {
+                name: `vibecheck-${result.provider}`,
+                version: "1.0.0",
+                informationUri: "https://vibecheckai.dev",
+              },
+            },
+            results: result.findings.map(f => ({
+              ruleId: f.id,
+              level: f.severity === "critical" || f.severity === "high" ? "error" : "warning",
+              message: { text: f.description },
+              locations: [{
+                physicalLocation: {
+                  artifactLocation: { uri: f.file },
+                  region: f.line ? { startLine: f.line } : undefined,
+                },
+              }],
+            })),
+          })),
+        });
+      }
+      
+      console.log(JSON.stringify(formatAsSARIF(results), null, 2));
+      return EXIT.SUCCESS;
+    }
+
+    // Human-readable output
+    console.log("");
+    
+    for (const result of results) {
+      const providerColor = result.provider === "terraform" ? colors.terraform : colors.cloudformation;
+      const providerIcon = result.provider === "terraform" ? "🏗️" : "☁️";
+      
+      console.log(`${providerIcon} ${c.bold}${providerColor}${result.provider.toUpperCase()}${c.reset}`);
+      console.log(`   Files: ${result.files.length} • Resources: ${result.resourceCount} • Score: ${result.score >= 80 ? colors.success : result.score >= 60 ? colors.medium : colors.critical}${result.score}/100${c.reset}`);
+      console.log("");
+      
+      if (result.findings.length === 0) {
+        console.log(`  ${colors.success}${icons.check}${c.reset} No issues found\n`);
+      } else {
+        // Group by severity
+        const bySeverity = {
+          critical: result.findings.filter(f => f.severity === "critical"),
+          high: result.findings.filter(f => f.severity === "high"),
+          medium: result.findings.filter(f => f.severity === "medium"),
+          low: result.findings.filter(f => f.severity === "low"),
+        };
+        
+        for (const [severity, findings] of Object.entries(bySeverity)) {
+          if (findings.length > 0) {
+            for (const finding of findings) {
+              console.log(formatFinding(finding, opts.verbose));
+            }
+          }
+        }
+      }
+      
+      // Show scanned files
+      if (opts.verbose && result.files.length > 0) {
+        console.log(`  ${c.dim}Files scanned:${c.reset}`);
+        for (const file of result.files.slice(0, 10)) {
+          console.log(`    ${c.dim}• ${path.relative(process.cwd(), file)}${c.reset}`);
+        }
+        if (result.files.length > 10) {
+          console.log(`    ${c.dim}... and ${result.files.length - 10} more${c.reset}`);
+        }
+        console.log("");
+      }
+    }
+
+    // Summary
+    console.log(`${c.dim}─────────────────────────────────────────────────────────────${c.reset}`);
+    const totalFiles = results.reduce((sum, r) => sum + r.files.length, 0);
+    const totalResources = results.reduce((sum, r) => sum + r.resourceCount, 0);
+    console.log(`${c.bold}Summary:${c.reset} ${totalFiles} file(s), ${totalResources} resource(s), ${totalFindings.length} finding(s), Score: ${totalScore}/100`);
+    console.log("");
+
+    return totalFindings.some(f => f.severity === "critical" || f.severity === "high")
+      ? EXIT.BLOCKING
+      : totalFindings.length > 0 ? EXIT.WARNINGS : EXIT.SUCCESS;
+
+  } catch (error) {
+    spinner.fail("Scan failed");
+    console.error(`\n  ${colors.critical}${icons.cross}${c.reset} ${error.message}\n`);
+    return EXIT.INTERNAL_ERROR;
+  }
+}
+
+module.exports = { runIaC };

package/bin/runners/runInit.js

@@ -1,8 +1,8 @@
 /**
- * vibecheck init - Enterprise Project Setup
+ * vibecheck init - Project Setup
  *
  * ═══════════════════════════════════════════════════════════════════════════════
- * ENTERPRISE EDITION - World-Class Terminal Experience
+ * Professional Terminal Experience
  * ═══════════════════════════════════════════════════════════════════════════════
  *
  * Configure your project for production-grade verification.
@@ -31,64 +31,15 @@ try {
 }
 
 // ═══════════════════════════════════════════════════════════════════════════════
-// ADVANCED TERMINAL - ANSI CODES & UTILITIES
+// TERMINAL UI - Import from shared module
 // ═══════════════════════════════════════════════════════════════════════════════
 
-const c = {
-  reset: '\x1b[0m',
-  bold: '\x1b[1m',
-  dim: '\x1b[2m',
-  italic: '\x1b[3m',
-  underline: '\x1b[4m',
-  blink: '\x1b[5m',
-  inverse: '\x1b[7m',
-  hidden: '\x1b[8m',
-  strike: '\x1b[9m',
-  // Colors
-  black: '\x1b[30m',
-  red: '\x1b[31m',
-  green: '\x1b[32m',
-  yellow: '\x1b[33m',
-  blue: '\x1b[34m',
-  magenta: '\x1b[35m',
-  cyan: '\x1b[36m',
-  white: '\x1b[37m',
-  // Bright colors
-  gray: '\x1b[90m',
-  brightRed: '\x1b[91m',
-  brightGreen: '\x1b[92m',
-  brightYellow: '\x1b[93m',
-  brightBlue: '\x1b[94m',
-  brightMagenta: '\x1b[95m',
-  brightCyan: '\x1b[96m',
-  brightWhite: '\x1b[97m',
-  // Background
-  bgBlack: '\x1b[40m',
-  bgRed: '\x1b[41m',
-  bgGreen: '\x1b[42m',
-  bgYellow: '\x1b[43m',
-  bgBlue: '\x1b[44m',
-  bgMagenta: '\x1b[45m',
-  bgCyan: '\x1b[46m',
-  bgWhite: '\x1b[47m',
-  // Cursor control
-  cursorUp: (n = 1) => `\x1b[${n}A`,
-  cursorDown: (n = 1) => `\x1b[${n}B`,
-  cursorRight: (n = 1) => `\x1b[${n}C`,
-  cursorLeft: (n = 1) => `\x1b[${n}D`,
-  clearLine: '\x1b[2K',
-  clearScreen: '\x1b[2J',
-  saveCursor: '\x1b[s',
-  restoreCursor: '\x1b[u',
-  hideCursor: '\x1b[?25l',
-  showCursor: '\x1b[?25h',
-};
+const { c, rgb, bgRgb, icons, Spinner } = require("./lib/terminal-ui");
 
-// True color support
-const rgb = (r, g, b) => `\x1b[38;2;${r};${g};${b}m`;
-const bgRgb = (r, g, b) => `\x1b[48;2;${r};${g};${b}m`;
+// Unified Output System
+const { output } = require("./lib/output/index.js");
 
-// Premium color palette (gold/amber theme for "init/setup")
+// Extended color palette for init command (gold/amber theme)
 const colors = {
   // Gradient for banner
   gradient1: rgb(255, 215, 100),   // Gold
@@ -147,7 +98,7 @@ ${rgb(255, 140, 40)}   ╚████╔╝ ██║██████╔╝
 ${rgb(255, 120, 20)}    ╚═══╝  ╚═╝╚═════╝ ╚══════╝ ╚═════╝╚═╝  ╚═╝╚══════╝ ╚═════╝╚═╝  ╚═╝${c.reset}
 
 ${c.dim}  ┌─────────────────────────────────────────────────────────────────────┐${c.reset}
-${c.dim}  │${c.reset}  ${rgb(255, 200, 100)}⚡${c.reset} ${c.bold}INIT${c.reset} ${c.dim}•${c.reset} ${rgb(200, 200, 200)}Project Setup${c.reset} ${c.dim}•${c.reset} ${rgb(150, 150, 150)}Enterprise Ready${c.reset}             ${c.dim}│${c.reset}
+${c.dim}  │${c.reset}  ${rgb(255, 200, 100)}⚡${c.reset} ${c.bold}INIT${c.reset} ${c.dim}•${c.reset} ${rgb(200, 200, 200)}Project Setup${c.reset} ${c.dim}•${c.reset} ${rgb(150, 150, 150)}Production Ready${c.reset}              ${c.dim}│${c.reset}
 ${c.dim}  └─────────────────────────────────────────────────────────────────────┘${c.reset}
 `;
 
@@ -1043,7 +994,7 @@ function printNextSteps(options = {}) {
     if (options.hasCI) {
       steps.push({ num: 3, cmd: 'git push', desc: 'CI will run automatically' });
     } else {
-      steps.push({ num: 3, cmd: 'vibecheck init --connect', desc: 'Add GitHub integration [STARTER]' });
+      steps.push({ num: 3, cmd: 'vibecheck init --connect', desc: 'Add GitHub integration [PRO]' });
     }
   }
   
@@ -1059,8 +1010,7 @@ function printNextSteps(options = {}) {
   // Upsell box
   console.log(`  ${c.dim}╭────────────────────────────────────────────────────────────╮${c.reset}`);
   console.log(`  ${c.dim}│${c.reset}                                                            ${c.dim}│${c.reset}`);
-  console.log(`  ${c.dim}│${c.reset}  ${colors.accent}⚡ STARTER${c.reset} ${c.dim}•${c.reset} AI-powered fixes, GitHub CI, MCP tools       ${c.dim}│${c.reset}`);
-  console.log(`  ${c.dim}│${c.reset}  ${colors.accent}🏆 PRO${c.reset}     ${c.dim}•${c.reset} Runtime proof, verified badges, AI testing   ${c.dim}│${c.reset}`);
+  console.log(`  ${c.dim}│${c.reset}  ${colors.accent}🏆 PRO${c.reset}     ${c.dim}•${c.reset} AI fixes, CI, runtime proof, badges, MCP     ${c.dim}│${c.reset}`);
   console.log(`  ${c.dim}│${c.reset}                                                            ${c.dim}│${c.reset}`);
   console.log(`  ${c.dim}│${c.reset}  ${colors.info}vibecheck login${c.reset} ${c.dim}to upgrade • vibecheck.dev/pricing${c.reset}       ${c.dim}│${c.reset}`);
   console.log(`  ${c.dim}│${c.reset}                                                            ${c.dim}│${c.reset}`);

package/bin/runners/runMcp.js

@@ -14,10 +14,13 @@ const { URL } = require("url");
 const { buildTruthpack, writeTruthpack } = require("./lib/truth");
 const { shipCore } = require("./runShip");
 const { generateRunId } = require("./lib/cli-output");
-const { enforceLimit, enforceFeature, trackUsage } = require("./lib/entitlements");
+const { enforceLimit, enforceFeature, trackUsage } = require("./lib/entitlements-v2");
 const { EXIT } = require("./lib/exit-codes");
 const { parseGlobalFlags, shouldSuppressOutput, isJsonMode } = require("./lib/global-flags");
 
+// Unified Output System
+const { output } = require("./lib/output/index.js");
+
 // MCP Server class
 class VibecheckMCPServer {
   constructor(options = {}) {
@@ -33,9 +36,7 @@ class VibecheckMCPServer {
     this.rateLimits = new Map();
     this.tiers = {
       free: { rpm: 10, burst: 20, daily: 100 },
-      starter: { rpm: 30, burst: 60, daily: 500 },
-      pro: { rpm: 100, burst: 200, daily: 2000 },
-      enterprise: { rpm: 500, burst: 1000, daily: Infinity }
+      pro: { rpm: 100, burst: 200, daily: Infinity }
     };
     
     // Tool definitions
@@ -110,7 +111,7 @@ class VibecheckMCPServer {
         tier: "pro"
       },
       
-      // Enterprise tier tools
+      // Pro tier tools
       policy_check: {
         description: "Validate project against custom compliance policies",
         inputSchema: {
@@ -121,7 +122,7 @@ class VibecheckMCPServer {
             reportFormat: { type: "string", enum: ["json", "sarif", "markdown"], default: "json" }
           }
         },
-        tier: "enterprise"
+        tier: "pro"
       }
     };
   }
@@ -588,7 +589,7 @@ class VibecheckMCPServer {
   }
 
   checkTierAccess(requiredTier, userTier) {
-    const tierOrder = ["free", "starter", "pro", "enterprise"];
+    const tierOrder = ["free", "pro"];
     const requiredIndex = tierOrder.indexOf(requiredTier);
     const userIndex = tierOrder.indexOf(userTier);
     
@@ -677,9 +678,9 @@ async function runMcp(args) {
   
   if (isFreeTier && !isHelpOrConfig) {
     if (json) {
-      console.log(JSON.stringify({ success: false, error: "MCP Server requires STARTER plan or higher" }));
+      console.log(JSON.stringify({ success: false, error: "MCP Server requires PRO plan" }));
     } else if (!quiet) {
-      console.log("\n🔌 MCP Server requires STARTER plan or higher");
+      console.log("\n🔌 MCP Server requires PRO plan");
       console.log("Use --help to see available options or");
       console.log("Upgrade: https://vibecheckai.dev/pricing\n");
     }
@@ -909,9 +910,7 @@ ${c.bold}MCP TOOLS AVAILABLE${c.reset}
   
   ${c.dim}Pro Tier:${c.reset}
   • run_ship           Execute ship check
-  
-  ${c.dim}Enterprise Tier:${c.reset}
-  • policy_check       Validate against policies
+  • policy_check       Validate against policies [PRO]
 
 ${c.bold}CONFIGURATION${c.reset}
   Add to your AI IDE's MCP config: