@vibefoundry/vibe-shield 1.1.1 → 2.0.0

package/dist/src/scanner/types.js

@@ -1,4 +1,6 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRuleCategory = exports.isSeverity = exports.meetsSeverity = exports.severityRank = exports.emptySeverityCounts = exports.emptyProjectContext = exports.LANGUAGE_EXTENSIONS = exports.GRADE_THRESHOLDS = exports.GRADES = exports.SEVERITY_SCORE_CEILING = exports.SEVERITY_SCORE_PENALTY = exports.SEVERITY_WEIGHT = exports.CATEGORY_TITLES = exports.RULE_CATEGORIES = exports.CONFIDENCES = exports.SEVERITIES = void 0;
 /**
  * vibe-shield :: scanner type system
  * ----------------------------------
@@ -7,8 +9,6 @@
  * `ScanResult` can be cached to disk, emitted as SARIF, or handed to an agent
  * as a patch prompt without any transformation.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isRuleCategory = exports.isSeverity = exports.meetsSeverity = exports.severityRank = exports.emptySeverityCounts = exports.emptyProjectContext = exports.LANGUAGE_EXTENSIONS = exports.GRADE_THRESHOLDS = exports.GRADES = exports.SEVERITY_SCORE_CEILING = exports.SEVERITY_SCORE_PENALTY = exports.SEVERITY_WEIGHT = exports.CATEGORY_TITLES = exports.RULE_CATEGORIES = exports.CONFIDENCES = exports.SEVERITIES = void 0;
 /** Ordered list of severities, most severe first. */
 exports.SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
 /** Detection confidence reported alongside every finding. */
@@ -23,6 +23,8 @@ exports.RULE_CATEGORIES = [
     'database-exposure',
     'ai-vulnerabilities',
     'secret-entropy',
+    'infrastructure',
+    'dependencies',
     'agent-integrity',
 ];
 exports.CATEGORY_TITLES = {
@@ -31,6 +33,8 @@ exports.CATEGORY_TITLES = {
     'database-exposure': 'Database exposure (RLS, SQLi, service role)',
     'ai-vulnerabilities': 'AI / LLM & classic web vulnerabilities',
     'secret-entropy': 'Hardcoded credentials & high-entropy secrets',
+    infrastructure: 'Infrastructure, headers & containers',
+    dependencies: 'Supply-chain & dependency hygiene',
     'agent-integrity': 'Agent skill & MCP poisoning',
 };
 /** Relative severity weight used by the scoring model. */

package/dist/src/scanner/version.d.ts

@@ -0,0 +1,2 @@
+/** Package version, resolved once from the nearest package.json. */
+export declare function packageVersion(): Promise<string>;

package/dist/src/scanner/version.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageVersion = packageVersion;
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const VERSION = process.env.npm_package_version ?? '1.0.0';
+let cachedVersion = null;
+/** Package version, resolved once from the nearest package.json. */
+async function packageVersion() {
+    if (cachedVersion)
+        return cachedVersion;
+    let dir = __dirname;
+    for (let depth = 0; depth < 6; depth += 1) {
+        try {
+            const raw = await node_fs_1.promises.readFile(path.join(dir, 'package.json'), 'utf8');
+            const parsed = JSON.parse(raw);
+            // Match the scoped name *or* the legacy bare one, so an install made
+            // before the package was published under `@vibefoundry/` still resolves
+            // its own version instead of reporting the fallback.
+            const isThisPackage = parsed.name === '@vibefoundry/vibe-shield' || parsed.name === 'vibe-shield';
+            if (isThisPackage && parsed.version) {
+                cachedVersion = parsed.version;
+                return cachedVersion;
+            }
+        }
+        catch {
+            // Keep walking up.
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    cachedVersion = VERSION;
+    return cachedVersion;
+}

package/dist/src/secrets/patterns.js

@@ -234,6 +234,46 @@ exports.SECRET_PATTERNS = [
         minEntropy: 3,
         note: 'Datadog API/application key.',
     },
+    {
+        id: 'gitlab-token', vendor: 'GitLab', family: 'saas', severity: 'high',
+        regex: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, minEntropy: 3,
+        note: 'GitLab personal access token.',
+    },
+    {
+        id: 'digitalocean-token', vendor: 'DigitalOcean', family: 'saas', severity: 'high',
+        regex: /\bdop_v1_[a-f0-9]{64}\b/g, minEntropy: 3,
+        note: 'DigitalOcean API token.',
+    },
+    {
+        id: 'linear-token', vendor: 'Linear', family: 'saas', severity: 'high',
+        regex: /\blin_api_[A-Za-z0-9]{40}\b/g, minEntropy: 3,
+        note: 'Linear API token.',
+    },
+    {
+        id: 'cloudflare-token', vendor: 'Cloudflare', family: 'saas', severity: 'high',
+        regex: /\bCLOUDFLARE_API_TOKEN\b["']?\s*[:=]\s*["']([A-Za-z0-9_-]{40})["']/gi, minEntropy: 3,
+        note: 'A value assigned to a Cloudflare API token variable.',
+    },
+    {
+        id: 'cohere-token', vendor: 'Cohere', family: 'saas', severity: 'high',
+        regex: /\bCOHERE_API_KEY\b["']?\s*[:=]\s*["']([A-Za-z0-9_-]{20,})["']/gi, minEntropy: 3,
+        note: 'A value assigned to a Cohere API key variable.',
+    },
+    {
+        id: 'mistral-token', vendor: 'Mistral', family: 'saas', severity: 'high',
+        regex: /\bMISTRAL_API_KEY\b["']?\s*[:=]\s*["']([A-Za-z0-9_-]{20,})["']/gi, minEntropy: 3,
+        note: 'A value assigned to a Mistral API key variable.',
+    },
+    {
+        id: 'groq-token', vendor: 'Groq', family: 'saas', severity: 'high',
+        regex: /\bgsk_[A-Za-z0-9]{30,}\b/g, minEntropy: 3,
+        note: 'Groq API key.',
+    },
+    {
+        id: 'together-token', vendor: 'Together AI', family: 'saas', severity: 'high',
+        regex: /\bTOGETHER_API_KEY\b["']?\s*[:=]\s*["']([A-Za-z0-9_-]{20,})["']/gi, minEntropy: 3,
+        note: 'A value assigned to a Together AI API key variable.',
+    },
     {
         id: 'jwt',
         vendor: 'JSON Web Token',

package/package.json

@@ -1,99 +1,99 @@
-{
-  "name": "@vibefoundry/vibe-shield",
-  "version": "1.1.1",
-  "description": "High-speed static security analyzer and MCP/agent-skill guard for AI-generated codebases. Catches the vulnerabilities autonomous coding agents ship: leaked secrets, unguarded mutation routes, missing Postgres RLS, unverified webhooks, prompt injection sinks and XSS.",
-  "keywords": [
-    "mcp",
-    "mcp-server",
-    "model-context-protocol",
-    "mcp-tools",
-    "mcp-security",
-    "mcp-client",
-    "json-rpc",
-    "claude-code",
-    "claude-desktop",
-    "codex",
-    "cursor",
-    "windsurf",
-    "ai-agents",
-    "agent-skills",
-    "agents-md",
-    "ai-security",
-    "ai-generated-code",
-    "vibe-coding",
-    "security-scanner",
-    "vulnerability-scanner",
-    "static-analysis",
-    "sast",
-    "appsec",
-    "cybersecurity",
-    "devsecops",
-    "owasp",
-    "cwe",
-    "sarif",
-    "prompt-injection",
-    "secret-scanner",
-    "secrets-detection",
-    "security-audit",
-    "supabase-rls",
-    "nextjs-security",
-    "row-level-security",
-    "sql-injection",
-    "agent-skill-audit",
-    "github-actions",
-    "code-scanning",
-    "ci-security-gate",
-    "npx",
-    "typescript",
-    "zero-dependencies"
-  ],
-  "license": "MIT",
-  "author": "VibeFoundry",
-  "homepage": "https://github.com/avivgerz-hue/vibe-shield#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/avivgerz-hue/vibe-shield.git"
-  },
-  "bugs": {
-    "url": "https://github.com/avivgerz-hue/vibe-shield/issues"
-  },
-  "main": "./dist/src/index.js",
-  "types": "./dist/src/index.d.ts",
-  "bin": {
-    "vibe-shield": "dist/bin/vibe-shield.js"
-  },
-  "files": [
-    "dist/bin",
-    "dist/src",
-    "SKILL.md",
-    "README.md",
-    "SECURITY.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=18.17.0"
-  },
-  "scripts": {
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/postbuild.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "coverage": "vitest run --coverage",
-    "scan:self": "node dist/bin/vibe-shield.js scan",
-    "audit:self": "node dist/bin/vibe-shield.js audit-skills",
-    "verify": "npm run typecheck && npm run build && npm test && npm run scan:self && npm run audit:self",
-    "prepare": "node scripts/prepare.mjs",
-    "prepublishOnly": "npm run verify"
-  },
-  "dependencies": {},
-  "devDependencies": {
-    "@types/node": "^22.20.5",
-    "@vitest/coverage-v8": "^5.1.0",
-    "typescript": "^5.9.3",
-    "vitest": "^5.1.0"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@vibefoundry/vibe-shield",
+  "version": "2.0.0",
+  "description": "High-speed static security analyzer and MCP/agent-skill guard for AI-generated codebases. Catches the vulnerabilities autonomous coding agents ship: leaked secrets, unguarded mutation routes, missing Postgres RLS, unverified webhooks, prompt injection sinks and XSS.",
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "mcp-tools",
+    "mcp-security",
+    "mcp-client",
+    "json-rpc",
+    "claude-code",
+    "claude-desktop",
+    "codex",
+    "cursor",
+    "windsurf",
+    "ai-agents",
+    "agent-skills",
+    "agents-md",
+    "ai-security",
+    "ai-generated-code",
+    "vibe-coding",
+    "security-scanner",
+    "vulnerability-scanner",
+    "static-analysis",
+    "sast",
+    "appsec",
+    "cybersecurity",
+    "devsecops",
+    "owasp",
+    "cwe",
+    "sarif",
+    "prompt-injection",
+    "secret-scanner",
+    "secrets-detection",
+    "security-audit",
+    "supabase-rls",
+    "nextjs-security",
+    "row-level-security",
+    "sql-injection",
+    "agent-skill-audit",
+    "github-actions",
+    "code-scanning",
+    "ci-security-gate",
+    "npx",
+    "typescript",
+    "zero-dependencies"
+  ],
+  "license": "MIT",
+  "author": "VibeFoundry",
+  "homepage": "https://github.com/avivgerz-hue/vibe-shield#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/avivgerz-hue/vibe-shield.git"
+  },
+  "bugs": {
+    "url": "https://github.com/avivgerz-hue/vibe-shield/issues"
+  },
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
+  "bin": {
+    "vibe-shield": "dist/bin/vibe-shield.js"
+  },
+  "files": [
+    "dist/bin",
+    "dist/src",
+    "SKILL.md",
+    "README.md",
+    "SECURITY.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.17.0"
+  },
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/postbuild.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
+    "scan:self": "node dist/bin/vibe-shield.js scan",
+    "audit:self": "node dist/bin/vibe-shield.js audit-skills",
+    "verify": "npm run typecheck && npm run build && npm test && npm run scan:self && npm run audit:self",
+    "prepare": "node scripts/prepare.mjs",
+    "prepublishOnly": "npm run verify"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "@vitest/coverage-v8": "^5.1.0",
+    "typescript": "^5.9.3",
+    "vitest": "^5.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}