@vibefoundry/vibe-shield 1.1.1 → 2.0.0

package/dist/src/init/scaffold.js

@@ -64,128 +64,61 @@ const BANNER = '<!-- Managed by vibe-shield. Edit freely; `npx -y @vibefoundry/v
 /* -------------------------------------------------------------------------- */
 exports.SKILL_TEMPLATE = `---
 name: vibe-shield
-description: Audit any change for AI-introduced security bugs (leaked keys, unguarded API routes, disabled Row Level Security, SQL injection, prompt injection, poisoned MCP servers) and fix them before reporting a task as done. Use whenever you write or modify application code, API routes, server actions, database migrations, auth logic, environment variables, LLM calls, webhook handlers, agent skills or MCP configuration.
+description: Apply a six-phase defensive security review to changes affecting applications, APIs, data, AI agents, and MCP configuration. Use static evidence, preserve behavior, and report limitations.
 allowed-tools: Bash(npx -y @vibefoundry/vibe-shield scan*), Bash(npx -y @vibefoundry/vibe-shield audit-skills*), Bash(npx -y @vibefoundry/vibe-shield explain*), Read(./**), Grep, Glob
 license: MIT
 metadata:
   author: VibeFoundry
   homepage: https://github.com/avivgerz-hue/vibe-shield
-  version: 1.0.0
+  version: 2.0.0
 ---
 
-# vibe-shield
+# Defensive AppSec architect protocol
 
-You are not allowed to say "done" until the code you just wrote passes a security audit.
+Work only within the authorized project. Static findings are evidence for review, not proof of exploitability or a guarantee of safety. Do not transmit source code or secrets. Ask before changing production services, rotating credentials, or making destructive changes.
 
-AI coding agents ship a specific, repeatable class of vulnerability: a \`SUPABASE_SERVICE_ROLE_KEY\` behind a \`NEXT_PUBLIC_\` prefix, a \`DELETE\` route handler with no session check, a \`CREATE TABLE\` with no \`ENABLE ROW LEVEL SECURITY\`, a tool whose \`execute\` forwards model output into \`exec\`. These are not exotic — they are the default shape of code written quickly by something optimising for "it works". This skill is the second pair of eyes.
+## Phase 1: Attack-surface reconnaissance
 
-## When to run
+Map entrypoints and trust boundaries: API methods, authentication and authorization, middleware matchers, database tables and policies, storage, LLM inputs and tools, webhooks, and agent/MCP configuration. Check deployment configuration and exclusions. Identify what the scanner cannot see.
 
-Run the audit **after every change that touches**:
-
-- an API route, route handler, server action, RPC endpoint or GraphQL mutation
-- authentication, session, role, permission or ownership logic
-- a database migration, policy, grant, schema or Supabase table
-- an environment variable, config file, \`.env*\` file or build config
-- anything calling an LLM, a tool, a webhook, a shell command or the filesystem
-- \`.claude/\`, \`.cursor/\`, \`AGENTS.md\`, \`mcp.json\` or any skill/config file
-
-If you did not touch any of those, you do not need to run it.
-
-## The loop
+## Phase 2: Automated static scan and skill audit
 
 \`\`\`bash
-# 1. Scan (a whole-repo scan finishes in well under a second)
-npx -y @vibefoundry/vibe-shield scan --fail-on high
-
-# 2. If it fails, generate the machine-readable fix list
-npx -y @vibefoundry/vibe-shield scan --fix-prompt
-
-# 3. Read SECURITY_PATCH_PROMPT.md and fix every finding, critical first
-#    Each entry has the exact file:line, the vulnerable snippet, the CWE and
-#    the required change. Apply it literally.
-
-# 4. Re-run until it exits 0
-npx -y @vibefoundry/vibe-shield scan --fail-on high
+npx -y @vibefoundry/vibe-shield scan . --format json
+npx -y @vibefoundry/vibe-shield audit-skills . --format json
 \`\`\`
 
-\`--fail-on high\` exits non-zero while any high or critical finding exists. That is the gate.
-
-## Reading a finding
-
-\`\`\`
-CRITICAL 47:15    VSB-CLIENT-001  Server-only secret exposed through a public environment prefix
-         const key = process.env.NEXT_PUBLIC_OPENAI_API_KEY;
-\`\`\`
+Inspect findings, inventory, ignored paths, and the files scanned. The explicit \`.\` includes test and documentation files: review fixtures as examples rather than blindly changing them. Use \`explain <RULE_ID>\` to investigate a rule. These commands run locally; first-time installation with npx requires registry access.
 
-| Part | Meaning |
-| --- | --- |
-| \`47:15\` | exact line and column to edit |
-| \`VSB-CLIENT-001\` | rule id — use it with \`explain\` for full docs |
-| message | why this specific line is exploitable |
-| \`(CWE-200)\` | bug class, for a deeper search if the fix is unclear |
+## Phase 3: Deep contextual threat modeling
 
-Need the full picture? \`npx -y @vibefoundry/vibe-shield explain VSB-CLIENT-001\` prints the vulnerable shape, the fixed shape, remediation steps and references.
+Trace untrusted input through authentication, ownership checks and tenant boundaries to database, filesystem, network, HTML, and LLM sinks. Inspect IDOR, business-logic bypasses, webhook signature verification and asynchronous jobs. Check cross-file guards and deployed database policies; absence of a static finding is not evidence of protection.
 
-## Hard rules
+## Phase 4: Surgical zero-regression remediation
 
-1. **Fix the root cause.** Never delete an auth check, disable RLS, silence a log or add a catch-all \`catch {}\` to make the finding disappear.
-2. **Never suppress.** Do not add \`// vibe-shield-disable\`, do not edit \`.vibe-shieldignore\`, do not pass \`--ignore\`. Suppression is a decision for the human.
-3. **Rotate exposed credentials.** If the scan reported a live key, tell the user to rotate it at the provider in the same message. Removing the line does not un-leak it — the value may already be in a bundle, a cache or a git history.
-4. **Report honestly.** If you cannot fix a finding (you need a decision, a credential or a provider change), say so explicitly, name the rule id, and stop.
-5. **Re-verify.** A fix is not finished until the gate exits 0.
+- On Next.js mutation routes, authenticate the session on the server and authorize the target resource against the session principal before writes. Do not trust identity from request bodies.
+- Enable Supabase RLS and write action-specific policies using the authenticated principal; test both permitted and denied tenants before deploying migrations.
+- Validate inputs at the boundary with a schema such as Zod, then use parameterized database queries. Treat LLM output as untrusted.
+- Use explicit CORS allowlists, secure cookie flags and a CSP appropriate for the application. Test login, redirects, and browser behavior.
+- Report exposed credentials to the owner for provider-side rotation; avoid reproducing their values in reports. Do not suppress findings or weaken controls to obtain a higher score. Ask for missing business or deployment decisions.
 
-## Agent surface audit
+## Phase 5: Verification gate
 
-When you add or modify a skill, rule file, MCP server or instruction file, also run:
+Run project tests and both audits again. Aim for 100/100 Grade A+ with no high or critical findings, but report any unresolved finding, exclusion, false positive, or verification limitation honestly rather than claiming success. Never equate a clean score with a complete security assessment.
 
 \`\`\`bash
-npx -y @vibefoundry/vibe-shield audit-skills
+npx -y @vibefoundry/vibe-shield scan --fail-on high
+npx -y @vibefoundry/vibe-shield audit-skills --fail-on high
 \`\`\`
 
-Twelve \`VSB-AGENT-*\` rules check for hidden Unicode (zero-width and bidi characters used to smuggle instructions past review), \`curl\`/\`wget\` exfiltration of environment variables, credential-harvesting instructions (\`.env\`, \`~/.ssh\`, \`~/.aws\`), registry-tag or remote MCP servers, literal tokens in an \`env\` block, safety-override language, over-broad tool permissions, base64 \`eval\` payloads, remote-instruction fetching, wildcard \`allowed-tools\`, and shell injection in skill scripts.
-
-Each finding carries a \`triage\` field: \`block\` means refuse and escalate, \`review\` means ask the user, \`report\` means mention it and continue. Do not blanket-refuse a repository because a rule fired — read the triage.
-
-## Flags worth knowing
+## Phase 6: Executive security sign-off
 
-| Flag | Effect |
-| --- | --- |
-| \`--format json\` | full machine-readable report (schemaVersion 1) |
-| \`--format sarif\` | SARIF 2.1.0 for GitHub code scanning |
-| \`--format compact\` | one line per finding |
-| \`--format github\` | inline GitHub Actions annotations |
-| \`--severity high\` | only report high and critical |
-| \`--fail-on medium\` | stricter gate |
-| \`--include-tests\` | include test and fixture files |
-| \`--cache\` | reuse results between runs |
-| \`--quiet\` | one-line verdict (ideal for piping) |
-| \`rules\` | list every rule |
-| \`explain <RULE_ID>\` | full documentation for one rule |
-
-If the repository has a \`.mcp.json\`, the same three capabilities are also
-available as MCP tools — \`vibe_shield_scan\`, \`vibe_shield_audit_skills\` and
-\`vibe_shield_explain_rule\`. Prefer those when they are listed, because they
-return structured findings instead of text you have to parse.
-
-## Definition of done
-
-- [ ] \`npx -y @vibefoundry/vibe-shield scan --fail-on high\` exits \`0\`
-- [ ] \`npx -y @vibefoundry/vibe-shield audit-skills\` exits \`0\` if you touched agent files
-- [ ] every credential the scan surfaced has been flagged to the user for rotation
-- [ ] no suppression directive was added
-- [ ] the feature still works and the existing tests still pass
-
-## Install it into a repository
+Produce a Markdown or HTML report with scope, inventory, risks prioritized by severity, evidence, actions, test results and remaining uncertainty. Illustrative code examples are not project-specific patches; review and adapt them. Obtain human approval before deployment or provider-side action.
 
 \`\`\`bash
-npx -y @vibefoundry/vibe-shield init
+npx -y @vibefoundry/vibe-shield scan --report SECURITY-REPORT.md --patch-prompt PATCH-PROMPT.md
+npx -y @vibefoundry/vibe-shield audit-skills --report AGENT-REPORT.html
 \`\`\`
-
-That writes this file to \`.claude/skills/vibe-shield/SKILL.md\`, appends a security
-gate section to \`AGENTS.md\`, adds a \`.cursor/rules/vibe-shield.mdc\`, and installs a
-GitHub Actions workflow that fails the pull request on new high or critical
-findings. Every future task in that repository starts guarded.
 `;
 /* -------------------------------------------------------------------------- */
 /* AGENTS.md section                                                          */

package/dist/src/mcp/server.js

@@ -230,6 +230,7 @@ const toToolResult = (result, options) => {
             filesScanned: result.stats.filesScanned,
             durationMs: result.stats.durationMs,
             rootDir: result.rootDir,
+            attackSurface: result.attackSurface,
             findings: shown.map((finding) => ({
                 ruleId: finding.ruleId,
                 slug: finding.slug,
@@ -239,10 +240,12 @@ const toToolResult = (result, options) => {
                 title: finding.title,
                 message: finding.message,
                 filePath: finding.filePath,
+                file: finding.file,
                 line: finding.line,
                 column: finding.column,
                 snippet: finding.snippet,
                 cwe: finding.cwe,
+                owasp: finding.owasp,
                 remediation: finding.remediation,
                 secureExample: finding.secureExample,
                 references: finding.references,
@@ -281,6 +284,7 @@ const explainRuleResult = (rule) => {
             severity: rule.severity,
             confidence: rule.confidence,
             cwe: rule.cwe,
+            owasp: rule.owasp,
             description: rule.description,
             insecureExample: rule.insecureExample,
             secureExample: rule.secureExample,
@@ -393,7 +397,7 @@ async function handleMessage(message, options = {}) {
                 serverInfo: {
                     name: exports.SERVER_NAME,
                     title: 'vibe-shield',
-                    version: options.version ?? '1.1.0',
+                    version: options.version ?? await (0, engine_1.packageVersion)(),
                 },
                 instructions: 'vibe-shield finds security bugs that AI coding agents ship: leaked secrets, unguarded API routes, missing Postgres RLS, SQL injection, prompt injection and poisoned agent skills. Call vibe_shield_scan after writing application code and before reporting a task as done, and vibe_shield_audit_skills after touching any agent instruction or MCP config file.',
             });

package/dist/src/mcp-guard/skill-auditor.js

@@ -59,6 +59,9 @@ const path = __importStar(require("node:path"));
 const patterns_1 = require("../secrets/patterns");
 const context_1 = require("../scanner/context");
 const gitignore_1 = require("../scanner/gitignore");
+const attack_surface_1 = require("../scanner/attack-surface");
+const version_1 = require("../scanner/version");
+const redact_1 = require("../scanner/redact");
 const helpers_1 = require("../scanner/rules/helpers");
 const shared_1 = require("../scanner/rules/shared");
 const types_1 = require("../scanner/types");
@@ -1031,6 +1034,7 @@ async function auditSkills(rootDir, options = {}) {
     // auditor's own discovery rules so `audit-skills .claude` works as expected.
     const files = options.paths?.length ? await resolveAuditPaths(rootDir, options.paths) : await discoverAgentFiles(rootDir);
     const findings = [];
+    const attackSurface = (0, attack_surface_1.emptyAttackSurface)();
     const scanned = [];
     let bytesScanned = 0;
     for (const absolutePath of files) {
@@ -1042,6 +1046,7 @@ async function auditSkills(rootDir, options = {}) {
             continue;
         }
         const ctx = (0, context_1.createFileContext)(absolutePath, rootDir, content, project);
+        (0, attack_surface_1.inventoryFile)(ctx, attackSurface);
         if (ctx.flags.isLockfile || ctx.flags.isGenerated)
             continue;
         scanned.push(ctx.relativePath);
@@ -1069,12 +1074,14 @@ async function auditSkills(rootDir, options = {}) {
                     severity: hit.severity ?? rule.severity,
                     confidence: hit.confidence ?? rule.confidence,
                     cwe: rule.cwe,
+                    owasp: rule.owasp,
                     filePath: ctx.relativePath,
+                    file: ctx.relativePath,
                     absolutePath: ctx.absolutePath,
                     line: located.line,
                     column: located.column,
-                    snippet: ctx.lineText(located.line).trim().slice(0, 200),
-                    matched: hit.matched ?? ctx.lineText(located.line).trim().slice(0, 200),
+                    snippet: (0, redact_1.redactReportText)(ctx.lineText(located.line).trim()).slice(0, 200),
+                    matched: (0, redact_1.redactReportText)(hit.matched ?? ctx.lineText(located.line).trim()).slice(0, 200),
                     message: hit.message ?? rule.description,
                     remediation: rule.remediate ? rule.remediate(ctx, hit) : rule.remediation,
                     insecureExample: rule.insecureExample,
@@ -1101,6 +1108,7 @@ async function auditSkills(rootDir, options = {}) {
     return {
         rootDir,
         command: 'audit-skills',
+        attackSurface,
         findings: unique,
         score: scoreFindings(unique),
         stats: {
@@ -1118,7 +1126,7 @@ async function auditSkills(rootDir, options = {}) {
         scannedPaths: scanned,
         startedAt,
         finishedAt: new Date(finished).toISOString(),
-        version: options.version ?? process.env.npm_package_version ?? '1.0.0',
+        version: options.version ?? await (0, version_1.packageVersion)(),
         ruleCount: rules.length,
         suppressedCount: 0,
         notices: scanned.length ? [] : ['No agent instruction or MCP configuration files were found.'],

package/dist/src/reporter/console-reporter.js

@@ -235,6 +235,20 @@ function renderConsoleReport(result, options = {}) {
         lines.push(...bars);
     }
     lines.push(...renderCategories(result, color));
+    if (result.attackSurface) {
+        const surface = result.attackSurface;
+        lines.push('', color.bold('Attack surface (static signals; review required)'));
+        for (const route of surface.routes)
+            lines.push(`  route ${route.method} ${route.path} — ${route.file}:${route.line} (${route.auth})`);
+        for (const table of surface.tables)
+            lines.push(`  table ${table.table} — ${table.file}:${table.line} (${table.rls})`);
+        for (const ai of surface.aiEntrypoints)
+            lines.push(`  AI entrypoint ${ai.file}:${ai.line}`);
+        for (const agent of surface.agentFiles)
+            lines.push(`  ${agent.kind} ${agent.name ?? ''} — ${agent.file}`);
+        if (!surface.routes.length && !surface.tables.length && !surface.aiEntrypoints.length && !surface.agentFiles.length)
+            lines.push('  No inventory signals observed.');
+    }
     if (result.findings.length) {
         lines.push('');
         lines.push(color.bold('Findings'));

package/dist/src/reporter/executive.d.ts

@@ -0,0 +1,4 @@
+import { type ScanResult } from '../scanner/types';
+export declare function formatMarkdown(result: ScanResult): string;
+/** All project content is escaped. The only script is a fixed local filter. */
+export declare function formatHtml(result: ScanResult): string;

package/dist/src/reporter/executive.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatMarkdown = formatMarkdown;
+exports.formatHtml = formatHtml;
+const mappings_1 = require("../scanner/mappings");
+const engine_1 = require("../scanner/engine");
+const types_1 = require("../scanner/types");
+const clean = (s) => s.replace(/[\r\n]+/g, ' ').replace(/\|/g, '\\|');
+const fence = (s) => {
+    const marker = '`'.repeat(Math.max(3, ...Array.from(s.matchAll(/`+/g), m => m[0].length + 1)));
+    return `${marker}\n${s}\n${marker}`;
+};
+// The CWE mapping is based on OWASP's published 2025 category lists.
+function mappings(ruleId, cwe) {
+    const mapping = (0, mappings_1.owaspMappings)(ruleId, cwe);
+    const web = mapping.web ? `${mapping.web.id} ${mapping.web.name} (${mapping.web.basis})` : 'not mapped';
+    const llm = mapping.llm.length ? mapping.llm.map(m => `${m.id} ${m.name} (contextual)`).join(', ') : 'not applicable or not assigned';
+    return `OWASP Top 10 2025: ${web}; OWASP LLM Top 10 2025: ${llm}. Validate applicability in context.`;
+}
+function formatMarkdown(result) {
+    const lines = ['# Executive Security Report', '', `**Score: ${result.score.score}/100 (${result.score.grade})** · ${result.stats.filesScanned} files scanned · ${result.command}`, '',
+        'Static signals require manual validation. A clean score is not proof of security. Ignored, unavailable, and unscanned files are outside this report.', '',
+        '## Category scorecard', '', '| Vector | Score | Findings |', '| --- | --- | ---: |'];
+    for (const category of types_1.RULE_CATEGORIES) {
+        const subset = result.findings.filter(f => f.category === category);
+        const applicable = result.command === 'audit-skills' ? category === 'agent-integrity' : category !== 'agent-integrity';
+        lines.push(`| ${types_1.CATEGORY_TITLES[category]} | ${applicable ? `${(0, engine_1.scoreFindings)(subset).score}/100` : 'Not assessed'} | ${subset.length} |`);
+    }
+    lines.push('', '## Attack-surface inventory', '', 'Observed signals only; guard and RLS signals do not prove enforcement. Absence of a guard signal is not proof a route is unguarded.', '', '| Type | Location | Detail | Signal |', '| --- | --- | --- | --- |');
+    const surface = result.attackSurface;
+    if (surface) {
+        for (const r of surface.routes)
+            lines.push(`| Route | ${clean(r.file)}:${r.line} | ${clean(r.method)} ${clean(r.path)} | ${r.auth} |`);
+        for (const t of surface.tables)
+            lines.push(`| Table | ${clean(t.file)}:${t.line} | ${clean(t.table)} | ${t.rls} |`);
+        for (const a of surface.aiEntrypoints)
+            lines.push(`| AI entrypoint | ${clean(a.file)}:${a.line} | LLM reference | review |`);
+        for (const a of surface.agentFiles)
+            lines.push(`| Agent | ${clean(a.file)} | ${a.kind}${a.name ? ': ' + clean(a.name) : ''} | review |`);
+    }
+    else
+        lines.push('| — | — | Inventory not available for this command | — |');
+    lines.push('', '## Prioritized findings', '');
+    const rank = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+    for (const f of [...result.findings].sort((a, b) => (rank[a.severity] ?? 5) - (rank[b.severity] ?? 5))) {
+        lines.push(`### ${clean(f.severity.toUpperCase())}: ${clean(f.title)}`, '', `**${f.ruleId} · ${clean(f.filePath)}:${f.line}:${f.column} · ${f.cwe.id} · confidence ${f.confidence}**`, '', f.message, '', mappings(f.ruleId, f.cwe.id), '', '**Observed code**', '', fence(f.snippet), '', '**Suggested remediation**', '', ...f.remediation.map(x => `- ${x}`), '', '**Illustrative before / after (adapt and validate; not an automatic patch)**', '', fence(f.insecureExample), '', fence(f.secureExample), '');
+    }
+    if (!result.findings.length)
+        lines.push('No findings reported for the selected rules and files.', '');
+    return lines.join('\n') + '\n';
+}
+const escapeHtml = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+/** All project content is escaped. The only script is a fixed local filter. */
+function formatHtml(result) {
+    const md = formatMarkdown(result);
+    const entries = result.findings.map(f => `<article data-severity="${escapeHtml(f.severity)}"><h3>${escapeHtml(f.severity.toUpperCase() + ': ' + f.title)}</h3><p>${escapeHtml(`${f.filePath}:${f.line}:${f.column} · ${f.ruleId} · ${f.cwe.id}`)}</p><pre>${escapeHtml(f.snippet)}</pre><p>${escapeHtml(f.message)}</p><ul>${f.remediation.map(s => `<li>${escapeHtml(s)}</li>`).join('')}</ul></article>`).join('\n');
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Executive Security Report</title><style>body{background:#101722;color:#e8effa;font:16px system-ui;max-width:1000px;margin:auto;padding:2rem}pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#1b2738;padding:1rem;border-radius:6px}article{border:1px solid #34455b;padding:1rem;margin:1rem 0;border-radius:8px}select{background:#1b2738;color:white;padding:.5rem}</style></head><body><h1>Executive Security Report</h1><label>Filter findings by severity <select id="severity"><option value="all">All</option><option>critical</option><option>high</option><option>medium</option><option>low</option><option>info</option></select></label><section>${entries}</section><details open><summary>Full report</summary><pre>${escapeHtml(md)}</pre></details><script>document.getElementById('severity').addEventListener('change',function(){document.querySelectorAll('article[data-severity]').forEach(function(e){e.hidden=this.value!=='all'&&e.dataset.severity!==this.value},this)})</script></body></html>\n`;
+}

package/dist/src/reporter/formatters.d.ts

@@ -11,7 +11,7 @@
  *  - `github`   GitHub Actions workflow commands (annotations in the diff)
  */
 import type { Finding, ScanResult } from '../scanner/types';
-export declare const OUTPUT_FORMATS: readonly ["console", "compact", "summary", "json", "sarif", "github"];
+export declare const OUTPUT_FORMATS: readonly ["console", "compact", "summary", "json", "sarif", "github", "markdown", "html"];
 export type OutputFormat = (typeof OUTPUT_FORMATS)[number];
 export declare const isOutputFormat: (value: unknown) => value is OutputFormat;
 /** Bump when the JSON shape changes in a breaking way. */

package/dist/src/reporter/formatters.js

@@ -20,7 +20,9 @@ exports.formatGithub = formatGithub;
 exports.formatSarif = formatSarif;
 exports.formatResult = formatResult;
 exports.groupByFile = groupByFile;
-exports.OUTPUT_FORMATS = ['console', 'compact', 'summary', 'json', 'sarif', 'github'];
+const node_url_1 = require("node:url");
+const executive_1 = require("./executive");
+exports.OUTPUT_FORMATS = ['console', 'compact', 'summary', 'json', 'sarif', 'github', 'markdown', 'html'];
 const isOutputFormat = (value) => typeof value === 'string' && exports.OUTPUT_FORMATS.includes(value);
 exports.isOutputFormat = isOutputFormat;
 /** Bump when the JSON shape changes in a breaking way. */
@@ -193,7 +195,7 @@ function formatSarif(result) {
                     },
                 ],
                 originalUriBaseIds: {
-                    '%SRCROOT%': { uri: `${result.rootDir.split('\\').join('/')}/` },
+                    '%SRCROOT%': { uri: (0, node_url_1.pathToFileURL)(result.rootDir.endsWith('/') ? result.rootDir : result.rootDir + '/').href },
                 },
                 results: result.findings.map((finding) => ({
                     ruleId: finding.ruleId,
@@ -203,7 +205,7 @@ function formatSarif(result) {
                     locations: [
                         {
                             physicalLocation: {
-                                artifactLocation: { uri: finding.filePath, uriBaseId: '%SRCROOT%' },
+                                artifactLocation: { uri: finding.filePath.split('/').map(encodeURIComponent).join('/'), uriBaseId: '%SRCROOT%' },
                                 region: {
                                     startLine: finding.line,
                                     startColumn: finding.column,
@@ -221,6 +223,7 @@ function formatSarif(result) {
                         severity: finding.severity,
                         confidence: finding.confidence,
                         cwe: finding.cwe.id,
+                        owasp: finding.owasp,
                         remediation: finding.remediation,
                         secureExample: finding.secureExample,
                     },
@@ -236,6 +239,10 @@ function formatSarif(result) {
 /** Render `result` in the requested format. */
 function formatResult(result, format) {
     switch (format) {
+        case 'markdown':
+            return (0, executive_1.formatMarkdown)(result);
+        case 'html':
+            return (0, executive_1.formatHtml)(result);
         case 'json':
             return formatJson(result);
         case 'summary':

package/dist/src/reporter/patch-prompt-writer.js

@@ -87,12 +87,12 @@ function buildPatchPrompt(result, options = {}) {
     lines.push('# Security patch prompt');
     lines.push('');
     lines.push('> Generated by [vibe-shield](https://github.com/avivgerz-hue/vibe-shield). Hand this file to your coding agent (Claude Code, Codex, Cursor, Windsurf).');
-    lines.push('> Every finding below was detected statically and cites the exact line that must change.');
+    lines.push('> Findings are static signals with source locations; validate each in context before making changes.');
     lines.push('');
     lines.push('## Mission');
     lines.push('');
     lines.push(`Fix the ${selected.length} security finding${selected.length === 1 ? '' : 's'} listed below in the repository at \`${result.rootDir}\`. ` +
-        'Apply every remediation exactly as written, then re-run the scanner to prove the finding is gone.');
+        'Review each finding, adapt the guidance to the project, then re-run the scanner and relevant tests.');
     lines.push('');
     lines.push('## Scanner verdict');
     lines.push('');
@@ -175,7 +175,7 @@ function buildPatchPrompt(result, options = {}) {
                     lines.push(`${stepIndex + 1}. ${step}`);
                 });
                 lines.push('');
-                lines.push('**Target shape after the fix**');
+                lines.push('**Illustrative remediation example (adapt to the project)**');
                 lines.push('');
                 lines.push(...fence(finding.secureExample, languageFor(filePath)));
                 lines.push('');

package/dist/src/scanner/attack-surface.d.ts

@@ -0,0 +1,4 @@
+import type { AttackSurface, FileContext, ProjectContext } from './types';
+export declare const emptyAttackSurface: () => AttackSurface;
+export declare function inventoryFile(ctx: FileContext, surface: AttackSurface): void;
+export declare function inventoryTables(surface: AttackSurface, project: ProjectContext, scannedPaths: Set<string>): void;

package/dist/src/scanner/attack-surface.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emptyAttackSurface = void 0;
+exports.inventoryFile = inventoryFile;
+exports.inventoryTables = inventoryTables;
+/** Heuristic inventory of observed surface, not evidence of effective protection. */
+const lexicon_1 = require("./lexicon");
+const emptyAttackSurface = () => ({ routes: [], tables: [], aiEntrypoints: [], agentFiles: [] });
+exports.emptyAttackSurface = emptyAttackSurface;
+function inventoryFile(ctx, surface) {
+    const { relativePath: file, code } = ctx;
+    if (ctx.flags.isMcpConfig) {
+        try {
+            const config = JSON.parse(ctx.content);
+            const servers = Object.keys(config.mcpServers ?? {});
+            if (servers.length)
+                for (const name of servers)
+                    surface.agentFiles.push({ file, kind: 'mcp', name });
+            else
+                surface.agentFiles.push({ file, kind: 'mcp' });
+        }
+        catch {
+            surface.agentFiles.push({ file, kind: 'mcp' });
+        }
+    }
+    else if (ctx.flags.isAgentInstructionFile)
+        surface.agentFiles.push({ file, kind: 'skill' });
+    if (ctx.flags.mentionsLlm && (ctx.flags.isAppRouterRoute || ctx.flags.isPagesApiRoute || ctx.flags.isServerFrameworkFile)) {
+        surface.aiEntrypoints.push({ file, line: 1 });
+    }
+    const auth = lexicon_1.AUTH_VERIFICATION_REGEX.test(code) ? 'guard-signal' : 'unknown';
+    const add = (method, route, offset) => {
+        surface.routes.push({ file, line: ctx.locate(offset).line, method: method.toUpperCase(), path: route, auth });
+    };
+    if (ctx.flags.isAppRouterRoute) {
+        const route = '/' + file.replace(/^.*?app\//, '').replace(/\/route\.[^.]+$/, '').replace(/\([^/]+\)\/?/g, '');
+        for (const match of code.matchAll(/\bexport\s+(?:async\s+function|const|function)\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g))
+            add(match[1], route.replace(/\/$/, '') || '/', match.index);
+    }
+    else if (ctx.flags.isPagesApiRoute) {
+        add('ANY', '/' + file.replace(/^.*?pages\//, '').replace(/\.[^.]+$/, '').replace(/\/index$/, ''), 0);
+    }
+    for (const match of code.matchAll(/\b(?:app|router|server|fastify)\.(get|post|put|patch|delete|all)\s*\(\s*['"]([^'"]+)['"]/gi))
+        add(match[1], match[2], match.index);
+}
+function inventoryTables(surface, project, scannedPaths) {
+    surface.tables = project.sqlTables.filter(t => scannedPaths.has(t.file) && !t.internal).map(t => ({
+        file: t.file, line: t.line, table: t.table, rls: t.rlsEnabled ? 'enabled-signal' : 'not-observed',
+    }));
+}

package/dist/src/scanner/engine.d.ts

@@ -107,7 +107,7 @@ export declare function applySuppressions(findings: readonly Finding[], parsed:
 /** Turn a finding list into a 0-100 score with an A+ → F grade. */
 export declare function scoreFindings(findings: readonly Finding[]): SecurityScore;
 export declare const CACHE_FILE_NAME = ".vibe-shield-cache.json";
-export declare const CACHE_VERSION = 1;
+export declare const CACHE_VERSION = 2;
 /** Content hash used as the cache key for one file. */
 export declare const contentHash: (content: string) => string;
 /**
@@ -115,8 +115,7 @@ export declare const contentHash: (content: string) => string;
  * Exported because the MCP auditor reuses it: two scanners, one rule contract.
  */
 export declare function runRulesOnFile(ctx: FileContext, rules: readonly Rule[]): RuleHit[];
-/** Package version, resolved once from the nearest package.json. */
-export declare function packageVersion(): Promise<string>;
+export { packageVersion } from './version';
 /**
  * Scan a project. This is the one function the CLI, the tests and any embedding
  * application call; everything else in this module is an implementation detail.