@vibecheckai/cli 3.5.0 → 3.5.2

package/bin/runners/lib/sbom-generator.js

@@ -1,641 +0,0 @@
-/**
- * Enterprise SBOM Generator
- * 
- * Software Bill of Materials with:
- * - CycloneDX format
- * - SPDX format
- * - Vulnerability correlation
- * - License compliance
- * - Dependency graph
- */
-
-"use strict";
-
-const crypto = require("crypto");
-const fs = require("fs");
-const path = require("path");
-const { execSync } = require("child_process");
-
-/**
- * SBOM formats
- */
-const SBOM_FORMATS = {
-  CYCLONEDX: "cyclonedx",
-  SPDX: "spdx",
-  JSON: "json",
-};
-
-/**
- * Component types
- */
-const COMPONENT_TYPES = {
-  APPLICATION: "application",
-  LIBRARY: "library",
-  FRAMEWORK: "framework",
-  OPERATING_SYSTEM: "operating-system",
-  DEVICE: "device",
-  FILE: "file",
-  CONTAINER: "container",
-  FIRMWARE: "firmware",
-  DATA: "data",
-};
-
-/**
- * License risk levels
- */
-const LICENSE_RISK = {
-  GPL: { risk: "high", copyleft: true },
-  "GPL-2.0": { risk: "high", copyleft: true },
-  "GPL-3.0": { risk: "high", copyleft: true },
-  LGPL: { risk: "medium", copyleft: true },
-  "LGPL-2.0": { risk: "medium", copyleft: true },
-  "LGPL-3.0": { risk: "medium", copyleft: true },
-  AGPL: { risk: "critical", copyleft: true },
-  "AGPL-3.0": { risk: "critical", copyleft: true },
-  MIT: { risk: "low", copyleft: false },
-  ISC: { risk: "low", copyleft: false },
-  Apache: { risk: "low", copyleft: false },
-  "Apache-2.0": { risk: "low", copyleft: false },
-  BSD: { risk: "low", copyleft: false },
-  "BSD-2-Clause": { risk: "low", copyleft: false },
-  "BSD-3-Clause": { risk: "low", copyleft: false },
-  Unlicense: { risk: "low", copyleft: false },
-  CC0: { risk: "low", copyleft: false },
-  "0BSD": { risk: "low", copyleft: false },
-};
-
-/**
- * Known vulnerabilities database (sample - would connect to real DB)
- */
-const KNOWN_VULNERABILITIES = {
-  "lodash": {
-    "< 4.17.21": [
-      { id: "CVE-2021-23337", severity: "high", title: "Command Injection" },
-      { id: "CVE-2020-8203", severity: "high", title: "Prototype Pollution" },
-    ],
-  },
-  "minimist": {
-    "< 1.2.6": [
-      { id: "CVE-2021-44906", severity: "critical", title: "Prototype Pollution" },
-    ],
-  },
-  "axios": {
-    "< 0.21.2": [
-      { id: "CVE-2021-3749", severity: "high", title: "ReDoS" },
-    ],
-  },
-  "express": {
-    "< 4.17.3": [
-      { id: "CVE-2022-24999", severity: "medium", title: "Open Redirect" },
-    ],
-  },
-  "jsonwebtoken": {
-    "< 9.0.0": [
-      { id: "CVE-2022-23529", severity: "critical", title: "Signature Bypass" },
-    ],
-  },
-};
-
-/**
- * Parse package.json dependencies
- */
-function parsePackageJson(packageJsonPath) {
-  const content = fs.readFileSync(packageJsonPath, "utf-8");
-  const pkg = JSON.parse(content);
-  
-  return {
-    name: pkg.name || "unknown",
-    version: pkg.version || "0.0.0",
-    description: pkg.description || "",
-    license: pkg.license || "UNKNOWN",
-    dependencies: pkg.dependencies || {},
-    devDependencies: pkg.devDependencies || {},
-    peerDependencies: pkg.peerDependencies || {},
-    optionalDependencies: pkg.optionalDependencies || {},
-    author: pkg.author,
-    repository: pkg.repository,
-  };
-}
-
-/**
- * Parse package-lock.json for resolved versions
- */
-function parsePackageLock(lockPath) {
-  if (!fs.existsSync(lockPath)) {
-    return null;
-  }
-  
-  const content = fs.readFileSync(lockPath, "utf-8");
-  const lock = JSON.parse(content);
-  
-  const packages = new Map();
-  
-  // Handle npm v2 format
-  if (lock.packages) {
-    for (const [pkgPath, pkgInfo] of Object.entries(lock.packages)) {
-      if (!pkgPath) continue; // Skip root
-      
-      const name = pkgPath.replace(/^node_modules\//, "").replace(/\/node_modules\//g, "/");
-      packages.set(name, {
-        version: pkgInfo.version,
-        resolved: pkgInfo.resolved,
-        integrity: pkgInfo.integrity,
-        dev: pkgInfo.dev || false,
-        optional: pkgInfo.optional || false,
-        peer: pkgInfo.peer || false,
-        license: pkgInfo.license,
-        dependencies: pkgInfo.dependencies || {},
-      });
-    }
-  }
-  
-  // Handle npm v1 format
-  if (lock.dependencies) {
-    function extractDeps(deps, prefix = "") {
-      for (const [name, info] of Object.entries(deps)) {
-        const fullName = prefix ? `${prefix}/${name}` : name;
-        packages.set(fullName, {
-          version: info.version,
-          resolved: info.resolved,
-          integrity: info.integrity,
-          dev: info.dev || false,
-          optional: info.optional || false,
-          dependencies: info.dependencies || {},
-        });
-        
-        if (info.dependencies) {
-          extractDeps(info.dependencies, fullName);
-        }
-      }
-    }
-    extractDeps(lock.dependencies);
-  }
-  
-  return packages;
-}
-
-/**
- * Check for vulnerabilities
- */
-function checkVulnerabilities(name, version) {
-  const vulns = [];
-  
-  // Simple version check (would use proper semver in production)
-  const pkgVulns = KNOWN_VULNERABILITIES[name];
-  if (pkgVulns) {
-    for (const [range, vulnList] of Object.entries(pkgVulns)) {
-      // Simple less-than check
-      const match = range.match(/^<\s*(.+)$/);
-      if (match) {
-        const maxVersion = match[1];
-        if (compareVersions(version, maxVersion) < 0) {
-          vulns.push(...vulnList);
-        }
-      }
-    }
-  }
-  
-  return vulns;
-}
-
-/**
- * Simple version comparison
- */
-function compareVersions(a, b) {
-  const partsA = a.split(".").map(Number);
-  const partsB = b.split(".").map(Number);
-  
-  for (let i = 0; i < Math.max(partsA.length, partsB.length); i++) {
-    const numA = partsA[i] || 0;
-    const numB = partsB[i] || 0;
-    if (numA < numB) return -1;
-    if (numA > numB) return 1;
-  }
-  
-  return 0;
-}
-
-/**
- * Get license risk assessment
- */
-function getLicenseRisk(license) {
-  if (!license || license === "UNKNOWN") {
-    return { risk: "unknown", copyleft: null };
-  }
-  
-  // Normalize license name
-  const normalized = license.toUpperCase().replace(/-ONLY|-OR-LATER/g, "");
-  
-  for (const [key, value] of Object.entries(LICENSE_RISK)) {
-    if (normalized.includes(key.toUpperCase())) {
-      return value;
-    }
-  }
-  
-  return { risk: "unknown", copyleft: null };
-}
-
-/**
- * Generate component purl (Package URL)
- */
-function generatePurl(type, name, version, qualifier = {}) {
-  const namespace = name.includes("/") ? name.split("/")[0] : null;
-  const pkgName = name.includes("/") ? name.split("/")[1] : name;
-  
-  let purl = `pkg:npm`;
-  if (namespace) {
-    purl += `/${encodeURIComponent(namespace)}`;
-  }
-  purl += `/${encodeURIComponent(pkgName)}@${version}`;
-  
-  if (Object.keys(qualifier).length > 0) {
-    const qs = Object.entries(qualifier)
-      .map(([k, v]) => `${k}=${encodeURIComponent(v)}`)
-      .join("&");
-    purl += `?${qs}`;
-  }
-  
-  return purl;
-}
-
-/**
- * Generate CycloneDX SBOM
- */
-function generateCycloneDX(projectPath, options = {}) {
-  const packageJsonPath = path.join(projectPath, "package.json");
-  const lockPath = path.join(projectPath, "package-lock.json");
-  
-  if (!fs.existsSync(packageJsonPath)) {
-    throw new Error("package.json not found");
-  }
-  
-  const pkg = parsePackageJson(packageJsonPath);
-  const lockPackages = parsePackageLock(lockPath);
-  
-  const sbom = {
-    bomFormat: "CycloneDX",
-    specVersion: "1.5",
-    serialNumber: `urn:uuid:${crypto.randomUUID()}`,
-    version: 1,
-    metadata: {
-      timestamp: new Date().toISOString(),
-      tools: [
-        {
-          vendor: "VibeCheck",
-          name: "vibecheck-cli",
-          version: options.version || "1.0.0",
-        },
-      ],
-      authors: [
-        {
-          name: pkg.author?.name || pkg.author || "Unknown",
-        },
-      ],
-      component: {
-        type: COMPONENT_TYPES.APPLICATION,
-        name: pkg.name,
-        version: pkg.version,
-        description: pkg.description,
-        purl: generatePurl("npm", pkg.name, pkg.version),
-        licenses: pkg.license ? [{ license: { id: pkg.license } }] : [],
-      },
-    },
-    components: [],
-    dependencies: [],
-    vulnerabilities: [],
-  };
-  
-  // Collect all dependencies
-  const allDeps = {
-    ...pkg.dependencies,
-    ...pkg.devDependencies,
-    ...pkg.peerDependencies,
-    ...pkg.optionalDependencies,
-  };
-  
-  const componentMap = new Map();
-  
-  for (const [name, versionRange] of Object.entries(allDeps)) {
-    const lockInfo = lockPackages?.get(name);
-    const version = lockInfo?.version || versionRange.replace(/[\^~]/, "");
-    const license = lockInfo?.license || "UNKNOWN";
-    
-    const component = {
-      type: COMPONENT_TYPES.LIBRARY,
-      name,
-      version,
-      purl: generatePurl("npm", name, version),
-      licenses: license !== "UNKNOWN" ? [{ license: { id: license } }] : [],
-      properties: [],
-    };
-    
-    // Check for vulnerabilities
-    const vulns = checkVulnerabilities(name, version);
-    if (vulns.length > 0) {
-      for (const vuln of vulns) {
-        sbom.vulnerabilities.push({
-          id: vuln.id,
-          source: { name: "NVD" },
-          ratings: [
-            {
-              severity: vuln.severity,
-              method: "CVSSv3",
-            },
-          ],
-          description: vuln.title,
-          affects: [
-            {
-              ref: component.purl,
-            },
-          ],
-        });
-      }
-    }
-    
-    // Check license risk
-    const licenseRisk = getLicenseRisk(license);
-    if (licenseRisk.risk !== "low") {
-      component.properties.push({
-        name: "vibecheck:license-risk",
-        value: licenseRisk.risk,
-      });
-    }
-    if (licenseRisk.copyleft) {
-      component.properties.push({
-        name: "vibecheck:copyleft",
-        value: "true",
-      });
-    }
-    
-    // Add dev/optional flags
-    if (pkg.devDependencies?.[name]) {
-      component.properties.push({
-        name: "cdx:npm:dev",
-        value: "true",
-      });
-    }
-    if (pkg.optionalDependencies?.[name]) {
-      component.properties.push({
-        name: "cdx:npm:optional",
-        value: "true",
-      });
-    }
-    
-    sbom.components.push(component);
-    componentMap.set(name, component);
-  }
-  
-  // Build dependency graph
-  sbom.dependencies.push({
-    ref: sbom.metadata.component.purl,
-    dependsOn: Object.keys(pkg.dependencies || {}).map(name => 
-      generatePurl("npm", name, componentMap.get(name)?.version || "*")
-    ),
-  });
-  
-  for (const [name, lockInfo] of lockPackages || []) {
-    if (lockInfo?.dependencies) {
-      const component = componentMap.get(name);
-      if (component) {
-        sbom.dependencies.push({
-          ref: component.purl,
-          dependsOn: Object.keys(lockInfo.dependencies).map(depName =>
-            generatePurl("npm", depName, lockPackages.get(depName)?.version || "*")
-          ),
-        });
-      }
-    }
-  }
-  
-  return sbom;
-}
-
-/**
- * Generate SPDX SBOM
- */
-function generateSPDX(projectPath, options = {}) {
-  const packageJsonPath = path.join(projectPath, "package.json");
-  const lockPath = path.join(projectPath, "package-lock.json");
-  
-  if (!fs.existsSync(packageJsonPath)) {
-    throw new Error("package.json not found");
-  }
-  
-  const pkg = parsePackageJson(packageJsonPath);
-  const lockPackages = parsePackageLock(lockPath);
-  
-  const sbom = {
-    spdxVersion: "SPDX-2.3",
-    dataLicense: "CC0-1.0",
-    SPDXID: "SPDXRef-DOCUMENT",
-    name: `${pkg.name}-sbom`,
-    documentNamespace: `https://vibecheck.dev/spdx/${pkg.name}/${crypto.randomUUID()}`,
-    creationInfo: {
-      created: new Date().toISOString(),
-      creators: [
-        "Tool: vibecheck-cli-" + (options.version || "1.0.0"),
-        "Organization: VibeCheck",
-      ],
-      licenseListVersion: "3.21",
-    },
-    packages: [],
-    relationships: [],
-  };
-  
-  // Root package
-  const rootPackage = {
-    SPDXID: "SPDXRef-Package-root",
-    name: pkg.name,
-    versionInfo: pkg.version,
-    downloadLocation: pkg.repository?.url || "NOASSERTION",
-    filesAnalyzed: false,
-    licenseConcluded: pkg.license || "NOASSERTION",
-    licenseDeclared: pkg.license || "NOASSERTION",
-    copyrightText: "NOASSERTION",
-    externalRefs: [
-      {
-        referenceCategory: "PACKAGE-MANAGER",
-        referenceType: "purl",
-        referenceLocator: generatePurl("npm", pkg.name, pkg.version),
-      },
-    ],
-  };
-  
-  sbom.packages.push(rootPackage);
-  
-  // Dependencies
-  const allDeps = {
-    ...pkg.dependencies,
-    ...pkg.devDependencies,
-  };
-  
-  let pkgIndex = 1;
-  for (const [name, versionRange] of Object.entries(allDeps)) {
-    const lockInfo = lockPackages?.get(name);
-    const version = lockInfo?.version || versionRange.replace(/[\^~]/, "");
-    const license = lockInfo?.license || "NOASSERTION";
-    
-    const spdxId = `SPDXRef-Package-${pkgIndex++}`;
-    
-    sbom.packages.push({
-      SPDXID: spdxId,
-      name,
-      versionInfo: version,
-      downloadLocation: lockInfo?.resolved || "NOASSERTION",
-      filesAnalyzed: false,
-      licenseConcluded: license,
-      licenseDeclared: license,
-      copyrightText: "NOASSERTION",
-      checksums: lockInfo?.integrity ? [
-        {
-          algorithm: lockInfo.integrity.startsWith("sha512") ? "SHA512" : "SHA256",
-          checksumValue: lockInfo.integrity.split("-")[1],
-        },
-      ] : [],
-      externalRefs: [
-        {
-          referenceCategory: "PACKAGE-MANAGER",
-          referenceType: "purl",
-          referenceLocator: generatePurl("npm", name, version),
-        },
-      ],
-    });
-    
-    // Relationship
-    sbom.relationships.push({
-      spdxElementId: "SPDXRef-Package-root",
-      relationshipType: pkg.devDependencies?.[name] ? "DEV_DEPENDENCY_OF" : "DEPENDS_ON",
-      relatedSpdxElement: spdxId,
-    });
-  }
-  
-  // Document describes root
-  sbom.relationships.push({
-    spdxElementId: "SPDXRef-DOCUMENT",
-    relationshipType: "DESCRIBES",
-    relatedSpdxElement: "SPDXRef-Package-root",
-  });
-  
-  return sbom;
-}
-
-/**
- * Generate SBOM summary report
- */
-function generateSBOMSummary(sbom) {
-  const summary = {
-    format: sbom.bomFormat || (sbom.spdxVersion ? "SPDX" : "Unknown"),
-    totalComponents: sbom.components?.length || sbom.packages?.length || 0,
-    vulnerabilities: {
-      total: sbom.vulnerabilities?.length || 0,
-      critical: 0,
-      high: 0,
-      medium: 0,
-      low: 0,
-    },
-    licenses: {},
-    licenseRisk: {
-      critical: 0,
-      high: 0,
-      medium: 0,
-      low: 0,
-      unknown: 0,
-    },
-  };
-  
-  // Count vulnerabilities by severity
-  for (const vuln of sbom.vulnerabilities || []) {
-    const severity = vuln.ratings?.[0]?.severity || "unknown";
-    if (summary.vulnerabilities[severity] !== undefined) {
-      summary.vulnerabilities[severity]++;
-    }
-  }
-  
-  // Count licenses
-  const components = sbom.components || sbom.packages || [];
-  for (const component of components) {
-    let license = "UNKNOWN";
-    
-    if (component.licenses?.[0]?.license?.id) {
-      license = component.licenses[0].license.id;
-    } else if (component.licenseConcluded) {
-      license = component.licenseConcluded;
-    }
-    
-    summary.licenses[license] = (summary.licenses[license] || 0) + 1;
-    
-    const risk = getLicenseRisk(license);
-    if (summary.licenseRisk[risk.risk] !== undefined) {
-      summary.licenseRisk[risk.risk]++;
-    }
-  }
-  
-  return summary;
-}
-
-// Terminal UI
-let terminalUI;
-try {
-  terminalUI = require("./terminal-ui");
-} catch {
-  terminalUI = {
-    c: { reset: "", bold: "", dim: "" },
-    rgb: () => "",
-  };
-}
-
-const { c, rgb } = terminalUI;
-
-const colors = {
-  critical: rgb(255, 80, 80),
-  high: rgb(255, 150, 50),
-  medium: rgb(255, 200, 0),
-  low: rgb(100, 200, 255),
-  success: rgb(0, 255, 150),
-  accent: rgb(0, 200, 255),
-};
-
-/**
- * Render SBOM summary for terminal
- */
-function renderSBOMSummary(summary) {
-  const lines = [];
-  
-  lines.push(`  ${c.dim}╭${"─".repeat(60)}╮${c.reset}`);
-  lines.push(`  ${c.dim}│${c.reset} ${colors.accent}${c.bold}📦 SOFTWARE BILL OF MATERIALS${c.reset}                              ${c.dim}│${c.reset}`);
-  lines.push(`  ${c.dim}├${"─".repeat(60)}┤${c.reset}`);
-  
-  lines.push(`  ${c.dim}│${c.reset} Format: ${c.bold}${summary.format}${c.reset}                                            ${c.dim}│${c.reset}`);
-  lines.push(`  ${c.dim}│${c.reset} Components: ${c.bold}${summary.totalComponents}${c.reset}                                         ${c.dim}│${c.reset}`);
-  
-  lines.push(`  ${c.dim}├${"─".repeat(60)}┤${c.reset}`);
-  lines.push(`  ${c.dim}│${c.reset} ${c.bold}Vulnerabilities:${c.reset}                                           ${c.dim}│${c.reset}`);
-  
-  const vulns = summary.vulnerabilities;
-  lines.push(`  ${c.dim}│${c.reset}   ${colors.critical}● Critical: ${vulns.critical}${c.reset}  ${colors.high}● High: ${vulns.high}${c.reset}  ${colors.medium}● Medium: ${vulns.medium}${c.reset}  ${colors.low}● Low: ${vulns.low}${c.reset}  ${c.dim}│${c.reset}`);
-  
-  lines.push(`  ${c.dim}├${"─".repeat(60)}┤${c.reset}`);
-  lines.push(`  ${c.dim}│${c.reset} ${c.bold}License Risk:${c.reset}                                              ${c.dim}│${c.reset}`);
-  
-  const risk = summary.licenseRisk;
-  lines.push(`  ${c.dim}│${c.reset}   ${colors.critical}● Critical: ${risk.critical}${c.reset}  ${colors.high}● High: ${risk.high}${c.reset}  ${colors.medium}● Medium: ${risk.medium}${c.reset}  ${colors.success}● Low: ${risk.low}${c.reset}   ${c.dim}│${c.reset}`);
-  
-  lines.push(`  ${c.dim}╰${"─".repeat(60)}╯${c.reset}`);
-  
-  return lines.join("\n");
-}
-
-module.exports = {
-  generateCycloneDX,
-  generateSPDX,
-  generateSBOMSummary,
-  renderSBOMSummary,
-  parsePackageJson,
-  parsePackageLock,
-  checkVulnerabilities,
-  getLicenseRisk,
-  generatePurl,
-  SBOM_FORMATS,
-  COMPONENT_TYPES,
-  LICENSE_RISK,
-};