@vibecheckai/cli 3.5.0 → 3.5.2

package/bin/runners/runIaC.js

@@ -1,372 +0,0 @@
-/**
- * Infrastructure as Code (IaC) Security Scanner CLI
- * 
- * Scans Terraform and CloudFormation files for security issues
- */
-
-"use strict";
-
-const path = require("path");
-const fs = require("fs");
-const { parseGlobalFlags, shouldShowBanner } = require("./lib/global-flags");
-const { EXIT } = require("./lib/exit-codes");
-
-// Terminal UI
-let terminalUI;
-try {
-  terminalUI = require("./lib/terminal-ui");
-} catch {
-  terminalUI = {
-    c: { reset: "", bold: "", dim: "", red: "", yellow: "", green: "", cyan: "" },
-    rgb: () => "",
-    icons: { check: "✓", cross: "✗", warning: "⚠", info: "ℹ" },
-    Spinner: class { start() {} succeed() {} fail() {} },
-  };
-}
-
-const { c, rgb, icons, Spinner } = terminalUI;
-
-// Unified Output System
-const { output } = require("./lib/output/index.js");
-
-// Colors
-const colors = {
-  critical: rgb(255, 80, 80),
-  high: rgb(255, 150, 50),
-  medium: rgb(255, 200, 0),
-  low: rgb(100, 200, 255),
-  info: rgb(150, 150, 150),
-  success: rgb(0, 255, 150),
-  accent: rgb(0, 200, 255),
-  terraform: rgb(123, 66, 255),
-  cloudformation: rgb(255, 153, 0),
-};
-
-const BANNER = `
-${rgb(123, 66, 255)}  ╔═══════════════════════════════════════════════════════════════╗${c.reset}
-${rgb(123, 66, 255)}  ║  ${c.bold}IAC SECURITY${c.reset}${rgb(123, 66, 255)} • Terraform / CloudFormation Scanning       ║${c.reset}
-${rgb(123, 66, 255)}  ╚═══════════════════════════════════════════════════════════════╝${c.reset}
-`;
-
-function printBanner() {
-  console.log(BANNER);
-}
-
-function printHelp() {
-  console.log(`
-${c.bold}Usage:${c.reset} vibecheck iac [options] [path]
-
-${c.bold}Description:${c.reset}
-  Scan Infrastructure as Code files for security misconfigurations.
-  Supports Terraform (.tf) and CloudFormation (YAML/JSON).
-
-${c.bold}Options:${c.reset}
-  ${colors.accent}--path, -p${c.reset}      Path to IaC files or directory (default: .)
-  ${colors.accent}--json${c.reset}          Output as JSON
-  ${colors.accent}--sarif${c.reset}         Output as SARIF for GitHub
-  ${colors.accent}--ignore${c.reset}        Ignore specific rule IDs (comma-separated)
-  ${colors.accent}--min-severity${c.reset}  Minimum severity to report (critical/high/medium/low)
-  ${colors.accent}--provider${c.reset}      Scan only specific provider (terraform/cloudformation)
-  ${colors.accent}--verbose, -v${c.reset}   Show detailed output
-  ${colors.accent}--help, -h${c.reset}      Show this help
-
-${c.bold}Examples:${c.reset}
-  ${c.dim}# Scan current directory${c.reset}
-  vibecheck iac
-
-  ${c.dim}# Scan Terraform files only${c.reset}
-  vibecheck iac --provider terraform
-
-  ${c.dim}# JSON output for CI${c.reset}
-  vibecheck iac --json
-
-  ${c.dim}# SARIF output for GitHub Security${c.reset}
-  vibecheck iac --sarif
-
-  ${c.dim}# Ignore specific rules${c.reset}
-  vibecheck iac --ignore AWS-S3-001,AWS-IAM-001
-`);
-}
-
-function parseArgs(args) {
-  const { flags: globalFlags, cleanArgs } = parseGlobalFlags(args);
-  
-  const opts = {
-    path: globalFlags.path || ".",
-    json: globalFlags.json || false,
-    sarif: false,
-    verbose: globalFlags.verbose || false,
-    help: globalFlags.help || false,
-    ignore: [],
-    minSeverity: null,
-    provider: null,
-    noBanner: globalFlags.noBanner || false,
-    ci: globalFlags.ci || false,
-    quiet: globalFlags.quiet || false,
-  };
-
-  for (let i = 0; i < cleanArgs.length; i++) {
-    const arg = cleanArgs[i];
-    
-    if (arg === "--sarif") opts.sarif = true;
-    else if (arg === "--ignore") {
-      opts.ignore = (cleanArgs[++i] || "").split(",").filter(Boolean);
-    }
-    else if (arg.startsWith("--ignore=")) {
-      opts.ignore = arg.split("=")[1].split(",").filter(Boolean);
-    }
-    else if (arg === "--min-severity") {
-      opts.minSeverity = cleanArgs[++i];
-    }
-    else if (arg.startsWith("--min-severity=")) {
-      opts.minSeverity = arg.split("=")[1];
-    }
-    else if (arg === "--provider") {
-      opts.provider = cleanArgs[++i];
-    }
-    else if (arg.startsWith("--provider=")) {
-      opts.provider = arg.split("=")[1];
-    }
-    else if (!arg.startsWith("-")) {
-      opts.path = arg;
-    }
-  }
-
-  return opts;
-}
-
-function formatFinding(finding, verbose = false) {
-  const severityColors = {
-    critical: colors.critical,
-    high: colors.high,
-    medium: colors.medium,
-    low: colors.low,
-    info: colors.info,
-  };
-  
-  const severityIcons = {
-    critical: "🔴",
-    high: "🟠",
-    medium: "🟡",
-    low: "🔵",
-    info: "⚪",
-  };
-
-  const color = severityColors[finding.severity] || colors.info;
-  const icon = severityIcons[finding.severity] || "⚪";
-  
-  let output = `  ${icon} ${color}${finding.severity.toUpperCase()}${c.reset} ${finding.title}\n`;
-  output += `     ${c.dim}${finding.id}${c.reset}`;
-  
-  if (finding.resource) {
-    output += ` ${c.dim}• ${finding.resource}${c.reset}`;
-  }
-  
-  if (finding.line) {
-    output += ` ${c.dim}(line ${finding.line})${c.reset}`;
-  }
-  
-  output += "\n";
-  
-  if (verbose) {
-    output += `     ${c.dim}${finding.description}${c.reset}\n`;
-    output += `     ${colors.accent}Fix:${c.reset} ${finding.recommendation}\n`;
-    if (finding.cwe) {
-      output += `     ${c.dim}CWE: ${finding.cwe}${c.reset}\n`;
-    }
-  }
-  
-  return output;
-}
-
-async function runIaC(args) {
-  const opts = parseArgs(args);
-
-  if (opts.help) {
-    printHelp();
-    return EXIT.SUCCESS;
-  }
-
-  if (shouldShowBanner(opts)) {
-    printBanner();
-  }
-
-  const spinner = new Spinner();
-  spinner.start("Scanning for IaC files...");
-
-  try {
-    // Dynamic import of the security package
-    let iacScanner;
-    try {
-      iacScanner = require("@vibecheck/security").scanIaC || 
-                  require("@vibecheck/security").iac?.scanIaC;
-      
-      if (!iacScanner) {
-        // Try direct import
-        const security = require("../../packages/security/src/iac/scanner");
-        iacScanner = security.scanIaC;
-      }
-    } catch (e) {
-      // Fallback: try relative path
-      try {
-        const security = require("../../packages/security/src/iac/scanner");
-        iacScanner = security.scanIaC;
-      } catch {
-        spinner.fail("IaC scanning module not available");
-        console.error(`\n  ${colors.critical}${icons.cross}${c.reset} IaC scanning requires @vibecheck/security package\n`);
-        return EXIT.INTERNAL_ERROR;
-      }
-    }
-
-    const targetPath = path.resolve(opts.path);
-    
-    // Determine providers to scan
-    const providers = opts.provider 
-      ? [opts.provider]
-      : ["terraform", "cloudformation"];
-
-    const results = await iacScanner({
-      paths: [targetPath],
-      providers,
-      ignoreRules: opts.ignore,
-      minSeverity: opts.minSeverity,
-      includeInfo: opts.verbose,
-    });
-
-    spinner.succeed(`Found ${results.length} provider(s) with IaC files`);
-
-    if (results.length === 0) {
-      console.log(`\n  ${c.dim}No IaC files found in ${targetPath}${c.reset}\n`);
-      return EXIT.SUCCESS;
-    }
-
-    // Aggregate findings
-    const totalFindings = results.flatMap(r => r.findings);
-    const totalScore = results.length > 0 
-      ? Math.round(results.reduce((sum, r) => sum + r.score, 0) / results.length)
-      : 100;
-
-    // JSON output
-    if (opts.json) {
-      console.log(JSON.stringify({
-        success: true,
-        results,
-        summary: {
-          providersScanned: results.length,
-          filesScanned: results.reduce((sum, r) => sum + r.files.length, 0),
-          resourcesScanned: results.reduce((sum, r) => sum + r.resourceCount, 0),
-          totalFindings: totalFindings.length,
-          score: totalScore,
-          critical: totalFindings.filter(f => f.severity === "critical").length,
-          high: totalFindings.filter(f => f.severity === "high").length,
-          medium: totalFindings.filter(f => f.severity === "medium").length,
-          low: totalFindings.filter(f => f.severity === "low").length,
-        },
-      }, null, 2));
-      
-      return totalFindings.some(f => f.severity === "critical" || f.severity === "high")
-        ? EXIT.BLOCKING
-        : totalFindings.length > 0 ? EXIT.WARNINGS : EXIT.SUCCESS;
-    }
-
-    // SARIF output
-    if (opts.sarif) {
-      let formatAsSARIF;
-      try {
-        formatAsSARIF = require("@vibecheck/security").formatAsSARIF ||
-                       require("../../packages/security/src/iac/scanner").formatAsSARIF;
-      } catch {
-        // Manual SARIF format
-        formatAsSARIF = (results) => ({
-          $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
-          version: "2.1.0",
-          runs: results.map(result => ({
-            tool: {
-              driver: {
-                name: `vibecheck-${result.provider}`,
-                version: "1.0.0",
-                informationUri: "https://vibecheckai.dev",
-              },
-            },
-            results: result.findings.map(f => ({
-              ruleId: f.id,
-              level: f.severity === "critical" || f.severity === "high" ? "error" : "warning",
-              message: { text: f.description },
-              locations: [{
-                physicalLocation: {
-                  artifactLocation: { uri: f.file },
-                  region: f.line ? { startLine: f.line } : undefined,
-                },
-              }],
-            })),
-          })),
-        });
-      }
-      
-      console.log(JSON.stringify(formatAsSARIF(results), null, 2));
-      return EXIT.SUCCESS;
-    }
-
-    // Human-readable output
-    console.log("");
-    
-    for (const result of results) {
-      const providerColor = result.provider === "terraform" ? colors.terraform : colors.cloudformation;
-      const providerIcon = result.provider === "terraform" ? "🏗️" : "☁️";
-      
-      console.log(`${providerIcon} ${c.bold}${providerColor}${result.provider.toUpperCase()}${c.reset}`);
-      console.log(`   Files: ${result.files.length} • Resources: ${result.resourceCount} • Score: ${result.score >= 80 ? colors.success : result.score >= 60 ? colors.medium : colors.critical}${result.score}/100${c.reset}`);
-      console.log("");
-      
-      if (result.findings.length === 0) {
-        console.log(`  ${colors.success}${icons.check}${c.reset} No issues found\n`);
-      } else {
-        // Group by severity
-        const bySeverity = {
-          critical: result.findings.filter(f => f.severity === "critical"),
-          high: result.findings.filter(f => f.severity === "high"),
-          medium: result.findings.filter(f => f.severity === "medium"),
-          low: result.findings.filter(f => f.severity === "low"),
-        };
-        
-        for (const [severity, findings] of Object.entries(bySeverity)) {
-          if (findings.length > 0) {
-            for (const finding of findings) {
-              console.log(formatFinding(finding, opts.verbose));
-            }
-          }
-        }
-      }
-      
-      // Show scanned files
-      if (opts.verbose && result.files.length > 0) {
-        console.log(`  ${c.dim}Files scanned:${c.reset}`);
-        for (const file of result.files.slice(0, 10)) {
-          console.log(`    ${c.dim}• ${path.relative(process.cwd(), file)}${c.reset}`);
-        }
-        if (result.files.length > 10) {
-          console.log(`    ${c.dim}... and ${result.files.length - 10} more${c.reset}`);
-        }
-        console.log("");
-      }
-    }
-
-    // Summary
-    console.log(`${c.dim}─────────────────────────────────────────────────────────────${c.reset}`);
-    const totalFiles = results.reduce((sum, r) => sum + r.files.length, 0);
-    const totalResources = results.reduce((sum, r) => sum + r.resourceCount, 0);
-    console.log(`${c.bold}Summary:${c.reset} ${totalFiles} file(s), ${totalResources} resource(s), ${totalFindings.length} finding(s), Score: ${totalScore}/100`);
-    console.log("");
-
-    return totalFindings.some(f => f.severity === "critical" || f.severity === "high")
-      ? EXIT.BLOCKING
-      : totalFindings.length > 0 ? EXIT.WARNINGS : EXIT.SUCCESS;
-
-  } catch (error) {
-    spinner.fail("Scan failed");
-    console.error(`\n  ${colors.critical}${icons.cross}${c.reset} ${error.message}\n`);
-    return EXIT.INTERNAL_ERROR;
-  }
-}
-
-module.exports = { runIaC };