@vibefoundry/vibe-shield 0.0.0-stage → 1.1.0

package/dist/src/reporter/patch-prompt-writer.js

@@ -0,0 +1,238 @@
+"use strict";
+/**
+ * vibe-shield :: SECURITY_PATCH_PROMPT.md
+ * ---------------------------------------
+ * `--fix-prompt` writes the file an autonomous agent can *execute*. That means
+ * every finding must be self-contained: exact location, the vulnerable code,
+ * why it is exploitable, the exact replacement, and a verification command.
+ *
+ * The document is ordered by severity and grouped by file so an agent reads one
+ * file's problems, patches them, and moves on — instead of thrashing between
+ * unrelated modules.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PATCH_PROMPT_FILENAME = void 0;
+exports.buildPatchPrompt = buildPatchPrompt;
+exports.writePatchPrompt = writePatchPrompt;
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+exports.PATCH_PROMPT_FILENAME = 'SECURITY_PATCH_PROMPT.md';
+const SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+const SEVERITY_HEADING = {
+    critical: 'Critical — exploitable now, fix first',
+    high: 'High — exploitable with modest effort',
+    medium: 'Medium — needs specific conditions, still worth fixing',
+    low: 'Low — hardening',
+    info: 'Informational',
+};
+const truncate = (value, max) => value.length <= max ? value : `${value.slice(0, Math.max(0, max - 1))}…`;
+/** Fenced code block that cannot be broken by backticks in the code. */
+const fence = (code, language = 'ts') => {
+    const longest = Math.max(2, ...(code.match(/`+/g) ?? []).map((run) => run.length));
+    const marker = '`'.repeat(longest + 1);
+    return [`${marker}${language}`, code.replace(/\r/g, ''), marker];
+};
+/**
+ * Build the patch prompt document.
+ *
+ * The prompt is written *for an agent*: imperative, unambiguous, and explicit
+ * about what must not change. It ends with a self-check the agent is told to run
+ * before reporting the task as done — the same discipline `SKILL.md` enforces.
+ */
+function buildPatchPrompt(result, options = {}) {
+    const minSeverity = options.minSeverity ?? 'info';
+    const maxFindings = options.maxFindings ?? 200;
+    const minRank = SEVERITY_ORDER[minSeverity] ?? 4;
+    const selected = result.findings
+        .filter((finding) => (SEVERITY_ORDER[finding.severity] ?? 4) <= minRank)
+        .sort((a, b) => (SEVERITY_ORDER[a.severity] ?? 4) - (SEVERITY_ORDER[b.severity] ?? 4) ||
+        a.filePath.localeCompare(b.filePath) ||
+        a.line - b.line)
+        .slice(0, maxFindings > 0 ? maxFindings : undefined);
+    const counts = result.score.counts;
+    const lines = [];
+    lines.push('# Security patch prompt');
+    lines.push('');
+    lines.push('> Generated by [vibe-shield](https://github.com/avivgerz-hue/vibe-shield). Hand this file to your coding agent (Claude Code, Codex, Cursor, Windsurf).');
+    lines.push('> Every finding below was detected statically and cites the exact line that must change.');
+    lines.push('');
+    lines.push('## Mission');
+    lines.push('');
+    lines.push(`Fix the ${selected.length} security finding${selected.length === 1 ? '' : 's'} listed below in the repository at \`${result.rootDir}\`. ` +
+        'Apply every remediation exactly as written, then re-run the scanner to prove the finding is gone.');
+    lines.push('');
+    lines.push('## Scanner verdict');
+    lines.push('');
+    lines.push('| Metric | Value |');
+    lines.push('| --- | --- |');
+    lines.push(`| Score | **${result.score.score}/100** |`);
+    lines.push(`| Grade | **${result.score.grade}** |`);
+    lines.push(`| Critical | ${counts.critical} |`);
+    lines.push(`| High | ${counts.high} |`);
+    lines.push(`| Medium | ${counts.medium} |`);
+    lines.push(`| Low | ${counts.low} |`);
+    lines.push(`| Files scanned | ${result.stats.filesScanned} |`);
+    lines.push(`| Generated | ${result.finishedAt} |`);
+    lines.push('');
+    lines.push('## Rules of engagement');
+    lines.push('');
+    lines.push('1. **Rotate before you refactor.** If a finding exposes a credential, tell the user to rotate it at the provider first. Deleting the line does not un-leak it.');
+    lines.push('2. **Never weaken a check to silence a finding.** Do not delete an auth guard, disable RLS, or add `// vibe-shield-disable` to make the report green.');
+    lines.push('3. **One finding at a time.** Patch it, run the verification command, then move on. Do not batch unrelated files into one edit.');
+    lines.push('4. **Preserve behaviour.** The feature must keep working; a fix that breaks the happy path is not a fix.');
+    lines.push('5. **Do not invent code.** If a remediation needs a decision you cannot make (which auth provider, which storage bucket), stop and ask the user.');
+    lines.push('');
+    lines.push('## Verification');
+    lines.push('');
+    lines.push('After each group of fixes run:');
+    lines.push('');
+    lines.push(...fence('npx github:avivgerz-hue/vibe-shield scan --fail-on high', 'bash'));
+    lines.push('');
+    lines.push('The task is complete only when this command exits `0` and every finding below is gone.');
+    lines.push('');
+    if (!selected.length) {
+        lines.push('## Nothing to fix');
+        lines.push('');
+        lines.push('No findings matched the requested severity threshold. 🛡️');
+        lines.push('');
+        return `${lines.join('\n')}\n`;
+    }
+    // Group by severity, then by file: an agent patches file-by-file.
+    const bySeverity = new Map();
+    for (const finding of selected) {
+        const bucket = bySeverity.get(finding.severity) ?? [];
+        bucket.push(finding);
+        bySeverity.set(finding.severity, bucket);
+    }
+    let index = 0;
+    for (const severity of ['critical', 'high', 'medium', 'low', 'info']) {
+        const findings = bySeverity.get(severity);
+        if (!findings?.length)
+            continue;
+        lines.push(`## ${SEVERITY_HEADING[severity] ?? severity} (${findings.length})`);
+        lines.push('');
+        const byFile = new Map();
+        for (const finding of findings) {
+            const bucket = byFile.get(finding.filePath) ?? [];
+            bucket.push(finding);
+            byFile.set(finding.filePath, bucket);
+        }
+        for (const [filePath, fileFindings] of byFile) {
+            lines.push(`### ${filePath}`);
+            lines.push('');
+            for (const finding of fileFindings) {
+                index += 1;
+                lines.push(`#### ${index}. ${finding.title} — \`${filePath}:${finding.line}:${finding.column}\``);
+                lines.push('');
+                lines.push(`- **Rule:** \`${finding.ruleId}\` (${finding.category})`);
+                lines.push(`- **Severity:** ${finding.severity} · **Confidence:** ${finding.confidence}`);
+                lines.push(`- **CWE:** [${finding.cwe.id} — ${finding.cwe.name}](${finding.cwe.url})`);
+                lines.push('');
+                lines.push(finding.message);
+                lines.push('');
+                if (finding.snippet) {
+                    lines.push('**Vulnerable code**');
+                    lines.push('');
+                    lines.push(...fence(truncate(finding.snippet, 400), languageFor(filePath)));
+                    lines.push('');
+                }
+                lines.push('**Required change**');
+                lines.push('');
+                finding.remediation.forEach((step, stepIndex) => {
+                    lines.push(`${stepIndex + 1}. ${step}`);
+                });
+                lines.push('');
+                lines.push('**Target shape after the fix**');
+                lines.push('');
+                lines.push(...fence(finding.secureExample, languageFor(filePath)));
+                lines.push('');
+                if (options.verbose) {
+                    lines.push('**Anti-pattern to remove**');
+                    lines.push('');
+                    lines.push(...fence(finding.insecureExample, languageFor(filePath)));
+                    lines.push('');
+                }
+                if (finding.references.length) {
+                    lines.push(`**Reference:** ${finding.references.slice(0, 3).join(' · ')}`);
+                    lines.push('');
+                }
+            }
+        }
+    }
+    lines.push('## Final checklist');
+    lines.push('');
+    lines.push('- [ ] Every credential that appeared in this report has been rotated by the user.');
+    lines.push('- [ ] `npx github:avivgerz-hue/vibe-shield scan --fail-on high` exits `0`.');
+    lines.push('- [ ] No `vibe-shield-disable` comments were added.');
+    lines.push('- [ ] The application still builds and its tests still pass.');
+    lines.push('');
+    return `${lines.join('\n')}\n`;
+}
+const languageFor = (filePath) => {
+    const extension = (filePath.split('.').pop() ?? '').toLowerCase();
+    const map = {
+        ts: 'ts',
+        tsx: 'tsx',
+        js: 'js',
+        jsx: 'jsx',
+        mjs: 'js',
+        cjs: 'js',
+        py: 'python',
+        rb: 'ruby',
+        php: 'php',
+        go: 'go',
+        rs: 'rust',
+        java: 'java',
+        sql: 'sql',
+        prisma: 'prisma',
+        sh: 'bash',
+        yml: 'yaml',
+        yaml: 'yaml',
+        json: 'json',
+        md: 'markdown',
+        env: 'ini',
+    };
+    return map[extension] ?? '';
+};
+/** Write the patch prompt and return the absolute path written. */
+async function writePatchPrompt(result, options = {}) {
+    const fileName = options.fileName ?? exports.PATCH_PROMPT_FILENAME;
+    const target = path.isAbsolute(fileName) ? fileName : path.join(options.outDir ?? result.rootDir, fileName);
+    const document = buildPatchPrompt(result, options);
+    await node_fs_1.promises.mkdir(path.dirname(target), { recursive: true });
+    await node_fs_1.promises.writeFile(target, document, 'utf8');
+    return target;
+}

package/dist/src/scanner/context.d.ts

@@ -0,0 +1,51 @@
+/**
+ * vibe-shield :: file & project context
+ * -------------------------------------
+ * Everything a rule needs is computed once per file here: language, structural
+ * flags ("is this a client component?", "is this an App Router handler?", "is
+ * this a SQL migration?") and the comment-masked code view.
+ */
+import { type FileContext, type FileFlags, type Language, type ProjectContext, type SqlTableInfo } from './types';
+export declare const toPosix: (value: string) => string;
+/** Resolve the `Language` bucket for a path. */
+export declare function detectLanguage(relativePath: string, fileName: string, extension: string): Language;
+/** Extension without the dot, lower-cased (`.env.local` -> `local`). */
+export declare const extensionOf: (fileName: string) => string;
+/** Compute the structural flags for one file. */
+export declare function computeFlags(relativePath: string, fileName: string, extension: string, language: Language, content: string): FileFlags;
+/** Build the immutable per-file context handed to every rule. */
+export declare function createFileContext(absolutePath: string, rootDir: string, content: string, project: ProjectContext): FileContext;
+/** Strip JSON comments/trailing commas so `jsonc` manifests still parse. */
+export declare function tolerantJsonParse(text: string): unknown;
+export interface DetectProjectOptions {
+    /** Directories (relative) that should not be inspected for manifests. */
+    skip?: (relativePath: string, isDirectory: boolean) => boolean;
+    /** How deep to look for workspace manifests. Default 8. */
+    maxDepth?: number;
+    /** Read the git index to learn which paths are actually tracked. Default true. */
+    readGitIndex?: boolean;
+    /** Maximum number of SQL files parsed for the RLS index. Default 400. */
+    maxSqlFiles?: number;
+    /** Maximum bytes read per SQL file. Default 512 KiB. */
+    maxSqlBytes?: number;
+}
+/** Extract the `matcher` entries declared by a Next.js middleware module. */
+export declare function parseMiddlewareMatchers(source: string): string[];
+/**
+ * Parse every `CREATE TABLE` / `ALTER TABLE ... ROW LEVEL SECURITY` /
+ * `CREATE POLICY` / `GRANT` statement in a SQL file into table records.
+ * Deliberately tolerant: SQL dialects differ, and a partial read is still
+ * better than a missed "RLS is enabled three migrations later".
+ */
+export declare function parseSqlTables(relativePath: string, source: string): SqlTableInfo[];
+/** Merge per-file table records into the project-wide index. */
+export declare function mergeSqlTables(target: SqlTableInfo[], incoming: SqlTableInfo[]): void;
+/** Paths tracked by git, read from the index in a single subprocess call. */
+export declare function readGitTrackedPaths(rootDir: string): string[];
+/**
+ * Cheap project fingerprint: manifests + marker files + SQL RLS posture.
+ * Runs before the scan so rules can ask "does this project even have a CSRF
+ * library installed?" or "is RLS enabled for this table in a later migration?"
+ * without a second pass over the source.
+ */
+export declare function detectProject(rootDir: string, options?: DetectProjectOptions): Promise<ProjectContext>;