@vibecheckai/cli 3.5.0 → 3.5.2

package/bin/runners/lib/firewall/config.js

@@ -1,341 +0,0 @@
-/**
- * Firewall Configuration Loader
- * 
- * Loads and validates firewall configuration from:
- * - .vibecheck/firewall.json (project-level)
- * - Default configuration (fallback)
- * 
- * Configuration defines:
- * - Forbidden paths (secrets, configs)
- * - Allowed paths (src, lib, test)
- * - Dangerous commands to block
- * - Hallucination patterns to detect
- * - Custom rules
- */
-
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-
-// ============================================================================
-// DEFAULT CONFIGURATION
-// ============================================================================
-
-const DEFAULT_CONFIG = {
-  version: "1.0",
-  mode: "observe",
-  
-  // Path rules
-  paths: {
-    forbidden: [
-      // Secrets and credentials
-      ".env",
-      ".env.*",
-      "*.pem",
-      "*.key",
-      "*.p12",
-      "*.pfx",
-      "secrets/**",
-      "credentials/**",
-      ".secrets/**",
-      
-      // Config files with potential secrets
-      "config/production.*",
-      "config/secrets.*",
-      ".aws/**",
-      ".ssh/**",
-      
-      // Package lock files (can cause issues)
-      "package-lock.json",
-      "pnpm-lock.yaml",
-      "yarn.lock",
-      
-      // Git internals
-      ".git/**",
-      ".gitconfig",
-    ],
-    allowed: [
-      // Source directories
-      "src/**",
-      "lib/**",
-      "app/**",
-      "apps/**",
-      "packages/**",
-      
-      // Test directories
-      "test/**",
-      "tests/**",
-      "__tests__/**",
-      "spec/**",
-      
-      // Common config (non-secret)
-      "*.config.js",
-      "*.config.ts",
-      "tsconfig.json",
-      "package.json",
-    ],
-    // If true, only files in allowed paths can be written
-    enforceAllowList: false,
-  },
-  
-  // Dangerous command patterns
-  commands: {
-    blocked: [
-      // Destructive operations
-      "rm -rf /",
-      "rm -rf /*",
-      "rm -rf ~",
-      "rm -rf .",
-      "rmdir /s /q",
-      
-      // Remote code execution
-      "curl | bash",
-      "curl | sh",
-      "wget | bash",
-      "wget | sh",
-      "curl -s | bash",
-      
-      // System modifications
-      "chmod 777",
-      "sudo rm",
-      "sudo chmod",
-      
-      // Database drops
-      "DROP DATABASE",
-      "DROP TABLE",
-      "TRUNCATE TABLE",
-      
-      // Git force operations
-      "git push --force",
-      "git push -f origin main",
-      "git reset --hard",
-      
-      // NPM publish without verification
-      "npm publish",
-    ],
-    // Patterns that require confirmation
-    requireConfirmation: [
-      "npm install",
-      "yarn add",
-      "pnpm add",
-      "git checkout",
-      "git merge",
-    ],
-  },
-  
-  // Content patterns to detect hallucinations
-  content: {
-    hallucinations: [
-      // Fake API endpoints
-      { pattern: "fetch\\(['\"]https?://example\\.com", name: "fake-api-example.com" },
-      { pattern: "api\\.example\\.com", name: "fake-api-domain" },
-      { pattern: "https?://localhost:\\d+/api", name: "localhost-api", severity: "warn" },
-      
-      // Fake API keys
-      { pattern: "sk-[a-zA-Z0-9]{20,}", name: "fake-openai-key" },
-      { pattern: "AKIA[0-9A-Z]{16}", name: "fake-aws-key" },
-      { pattern: "ghp_[a-zA-Z0-9]{36}", name: "fake-github-token" },
-      
-      // Placeholder patterns
-      { pattern: "\\bTODO\\b.*\\bimplement\\b", name: "todo-implement", severity: "warn" },
-      { pattern: "placeholder", name: "placeholder-text", severity: "warn" },
-      { pattern: "fake.*data", name: "fake-data", severity: "warn" },
-      { pattern: "mock.*response", name: "mock-response", severity: "warn" },
-      
-      // Hardcoded test credentials
-      { pattern: "password.*=.*['\"]test", name: "test-password" },
-      { pattern: "password.*=.*['\"]123", name: "weak-password" },
-      { pattern: "admin.*admin", name: "default-admin-creds" },
-      
-      // AI-generated placeholder values
-      { pattern: "your-api-key-here", name: "placeholder-api-key" },
-      { pattern: "YOUR_.*_KEY", name: "placeholder-env-key" },
-      { pattern: "<your-.*>", name: "placeholder-template" },
-      { pattern: "\\[insert.*here\\]", name: "insert-placeholder" },
-    ],
-    
-    // Patterns that should never appear
-    forbidden: [
-      { pattern: "eval\\(", name: "eval-usage", severity: "critical" },
-      { pattern: "document\\.write\\(", name: "document-write", severity: "warn" },
-      { pattern: "innerHTML\\s*=", name: "innerHTML-assignment", severity: "warn" },
-      { pattern: "dangerouslySetInnerHTML", name: "dangerous-html", severity: "warn" },
-    ],
-  },
-  
-  // Scope limits
-  scope: {
-    maxFilesPerChange: 15,
-    maxLinesPerFile: 1000,
-    maxTotalLines: 5000,
-  },
-  
-  // Output settings
-  output: {
-    logViolations: true,
-    logPath: ".vibecheck/firewall.log",
-    emitEvents: true,
-  },
-};
-
-// ============================================================================
-// CONFIGURATION LOADER
-// ============================================================================
-
-/**
- * Load firewall configuration from project or use defaults
- * @param {string} configPath - Path to configuration file
- * @returns {object} Merged configuration
- */
-function loadFirewallConfig(configPath = ".vibecheck/firewall.json") {
-  const projectRoot = process.cwd();
-  const fullPath = path.isAbsolute(configPath) 
-    ? configPath 
-    : path.join(projectRoot, configPath);
-  
-  let userConfig = {};
-  
-  // Try to load user configuration
-  if (fs.existsSync(fullPath)) {
-    try {
-      const content = fs.readFileSync(fullPath, "utf8");
-      userConfig = JSON.parse(content);
-    } catch (error) {
-      console.warn(`[Firewall] Failed to parse config: ${error.message}`);
-    }
-  }
-  
-  // Deep merge with defaults
-  const config = deepMerge(DEFAULT_CONFIG, userConfig);
-  
-  // Validate configuration
-  validateConfig(config);
-  
-  return config;
-}
-
-/**
- * Deep merge two objects
- * @param {object} target - Target object
- * @param {object} source - Source object
- * @returns {object} Merged object
- */
-function deepMerge(target, source) {
-  const output = { ...target };
-  
-  for (const key of Object.keys(source)) {
-    if (source[key] instanceof Object && !Array.isArray(source[key])) {
-      if (target[key] instanceof Object && !Array.isArray(target[key])) {
-        output[key] = deepMerge(target[key], source[key]);
-      } else {
-        output[key] = { ...source[key] };
-      }
-    } else if (Array.isArray(source[key])) {
-      // For arrays, concatenate user config with defaults
-      output[key] = [...(target[key] || []), ...source[key]];
-    } else {
-      output[key] = source[key];
-    }
-  }
-  
-  return output;
-}
-
-/**
- * Validate configuration structure
- * @param {object} config - Configuration to validate
- * @throws {Error} If configuration is invalid
- */
-function validateConfig(config) {
-  if (config.mode && !["observe", "enforce"].includes(config.mode)) {
-    throw new Error(`Invalid mode: ${config.mode}. Must be 'observe' or 'enforce'`);
-  }
-  
-  if (config.paths) {
-    if (config.paths.forbidden && !Array.isArray(config.paths.forbidden)) {
-      throw new Error("paths.forbidden must be an array");
-    }
-    if (config.paths.allowed && !Array.isArray(config.paths.allowed)) {
-      throw new Error("paths.allowed must be an array");
-    }
-  }
-  
-  if (config.commands) {
-    if (config.commands.blocked && !Array.isArray(config.commands.blocked)) {
-      throw new Error("commands.blocked must be an array");
-    }
-  }
-  
-  if (config.content) {
-    if (config.content.hallucinations && !Array.isArray(config.content.hallucinations)) {
-      throw new Error("content.hallucinations must be an array");
-    }
-  }
-}
-
-/**
- * Get default configuration
- * @returns {object} Default configuration
- */
-function getDefaultConfig() {
-  return JSON.parse(JSON.stringify(DEFAULT_CONFIG));
-}
-
-/**
- * Save firewall configuration to file
- * @param {string} configPath - Path to save configuration
- * @param {object} config - Configuration to save
- */
-function saveFirewallConfig(configPath, config) {
-  const projectRoot = process.cwd();
-  const fullPath = path.isAbsolute(configPath)
-    ? configPath
-    : path.join(projectRoot, configPath);
-  
-  // Ensure directory exists
-  const dir = path.dirname(fullPath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
-  
-  // Validate before saving
-  validateConfig(config);
-  
-  fs.writeFileSync(fullPath, JSON.stringify(config, null, 2));
-}
-
-/**
- * Initialize default firewall configuration in project
- * @param {string} projectRoot - Project root directory
- * @returns {string} Path to created config file
- */
-function initFirewallConfig(projectRoot = process.cwd()) {
-  const configDir = path.join(projectRoot, ".vibecheck");
-  const configPath = path.join(configDir, "firewall.json");
-  
-  // Check if already exists
-  if (fs.existsSync(configPath)) {
-    return configPath;
-  }
-  
-  // Create directory
-  if (!fs.existsSync(configDir)) {
-    fs.mkdirSync(configDir, { recursive: true });
-  }
-  
-  // Write default config
-  const config = getDefaultConfig();
-  fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
-  
-  return configPath;
-}
-
-module.exports = {
-  loadFirewallConfig,
-  getDefaultConfig,
-  saveFirewallConfig,
-  initFirewallConfig,
-  validateConfig,
-  DEFAULT_CONFIG,
-};