arnav-audit 1.0.0 → 1.0.2

package/bin/cli.js

@@ -57,6 +57,8 @@ const options = {
   prompts: false,
   securityOnly: false,
   leakageOnly: false,
+  verbose: false,
+  files: false,
   help: false,
   version: false,
 };
@@ -65,6 +67,8 @@ for (let i = 0; i < args.length; i++) {
   const arg = args[i];
   if (arg === '--help' || arg === '-h') options.help = true;
   else if (arg === '--version' || arg === '-v') options.version = true;
+  else if (arg === '--verbose') options.verbose = true;
+  else if (arg === '--files' || arg === '--list') options.files = true;
   else if (arg === '--json') options.json = true;
   else if (arg === '--prompts' || arg === '--fix') options.prompts = true;
   else if (arg === '--security' || arg === '--security-only') options.securityOnly = true;
@@ -73,7 +77,7 @@ for (let i = 0; i < args.length; i++) {
 }
 
 if (options.version) {
-  console.log('arnav-audit v1.0.0');
+  console.log('arnav-audit v1.0.2');
   process.exit(0);
 }
 
@@ -88,6 +92,8 @@ ${C.bold}TARGETS:${C.reset}
   [https://url]      Live website URL to run headless CDP telemetry & 200 checks
 
 ${C.bold}OPTIONS:${C.reset}
+  --files, --list    List every single scanned file path with inspection status
+  --verbose          Display detailed scan logs and file-by-file verification
   --prompts, --fix   Generate copy-paste AI fix prompts for Cursor & Claude Code
   --security-only    Scan exclusively for exposed credentials, secrets & XSS vectors
   --leakage-only     Scan exclusively for memory, event listeners & viewport leaks
@@ -97,6 +103,7 @@ ${C.bold}OPTIONS:${C.reset}
 
 ${C.bold}EXAMPLES:${C.reset}
   $ npx arnav-audit .
+  $ npx arnav-audit . --files
   $ npx arnav-audit https://mejor-iota.vercel.app
   $ npx arnav-audit . --prompts
   $ npx arnav-audit . --json > audit-report.json
@@ -112,18 +119,31 @@ const IGNORED_DIRS = new Set([
   '.git',
   '.next',
   '.vercel',
+  '.kilo',
+  '.pytest_cache',
+  'artifacts',
+  'test-results',
+  'playwright-report',
   'dist',
   'build',
   'coverage',
   '.cache',
   'venv',
   '.venv',
+  'env',
   '__pycache__',
 ]);
 
-const ALLOWED_EXTS = new Set([
-  '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
-  '.css', '.scss', '.html', '.json', '.env', '.yaml', '.yml'
+const BINARY_EXTS = new Set([
+  '.png', '.jpg', '.jpeg', '.gif', '.ico', '.webp', '.avif', '.svgz',
+  '.mp4', '.webm', '.ogg', '.mp3', '.wav', '.flac',
+  '.woff', '.woff2', '.ttf', '.eot', '.otf',
+  '.zip', '.tar', '.gz', '.tgz', '.rar', '.7z',
+  '.exe', '.dll', '.so', '.dylib', '.bin',
+  '.pyc', '.pyo', '.pyd',
+  '.db', '.sqlite', '.sqlite3',
+  '.pdf', '.doc', '.docx', '.xls', '.xlsx',
+  '.tsbuildinfo'
 ]);
 
 function walkDir(dir, fileList = []) {
@@ -135,13 +155,18 @@ function walkDir(dir, fileList = []) {
       try {
         const stat = fs.statSync(fullPath);
         if (stat.isDirectory()) {
+          // Allow .github workflow directory while ignoring other hidden dot-folders
+          if (file.startsWith('.') && file !== '.github') continue;
+          if (file.includes('worktree')) continue;
           walkDir(fullPath, fileList);
         } else {
-          // Skip the scanner's own implementation file so its rule regexes are not self-flagged
+          // Skip the scanner's own CLI script so its rule definitions are not self-flagged
           if (file === 'cli.js' && fullPath.includes('arnav-audit')) continue;
+          // Skip OS metadata
+          if (file === '.DS_Store' || file === 'Thumbs.db') continue;
 
-          const ext = path.extname(file);
-          if (ALLOWED_EXTS.has(ext) || file.startsWith('.env')) {
+          const ext = path.extname(file).toLowerCase();
+          if (!BINARY_EXTS.has(ext)) {
             fileList.push(fullPath);
           }
         }
@@ -153,7 +178,7 @@ function walkDir(dir, fileList = []) {
 
 // Pattern rules for security, leakage, and UI defects
 const RULES = [
-  // 1. SECURITY & CREDENTIAL LEAKAGE
+  // 1. SECURITY & CREDENTIAL LEAKAGE (UNIVERSAL)
   {
     id: 'SEC-AWS-KEY',
     category: 'Security',
@@ -196,15 +221,18 @@ const RULES = [
     tier: 'CRITICAL',
     title: 'Unencrypted Private Key Block in Code',
     desc: 'RSA/EC/SSH private key found directly committed.',
-    regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+    regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----\s*[\r\n]+[A-Za-z0-9+/=]{20,}/g,
     remedy: 'Remove private key file from version control immediately; load via secure KMS/vault.'
   },
+
+  // JAVASCRIPT & WEB CODE INJECTION
   {
     id: 'SEC-DANGEROUS-HTML',
     category: 'Security',
     tier: 'MAJOR',
     title: 'Unsanitized dangerouslySetInnerHTML Injection',
     desc: 'Direct usage of dangerouslySetInnerHTML without DOMPurify allows stored or reflected XSS.',
+    appliesTo: ['.js', '.jsx', '.ts', '.tsx', '.html'],
     regex: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:\s*(?!DOMPurify|sanitize)[a-zA-Z0-9_.]+/g,
     remedy: 'Wrap raw HTML payload with DOMPurify.sanitize(dirtyHtml) before rendering.'
   },
@@ -214,17 +242,41 @@ const RULES = [
     tier: 'CRITICAL',
     title: 'Dangerous eval() or new Function() Execution',
     desc: 'Dynamic code execution opens remote arbitrary code execution vectors.',
-    regex: /\beval\s*\(|\bnew\s+Function\s*\(/g,
+    appliesTo: ['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs'],
+    regex: /(?<![.\w])eval\s*\(|\bnew\s+Function\s*\(/g,
     remedy: 'Refactor dynamic evaluation to structured JSON.parse() or typed lookups.'
   },
 
-  // 2. MEMORY & RESOURCE LEAKAGE
+  // PYTHON BACKEND SECURITY
+  {
+    id: 'SEC-PY-SQL-INJECTION',
+    category: 'Security',
+    tier: 'CRITICAL',
+    title: 'Python SQL Query String Formatting Injection',
+    desc: 'Raw f-string or % formatting directly inside SQL query execution.',
+    appliesTo: ['.py'],
+    regex: /cursor\.execute\(\s*f["']|execute\(\s*f["']SELECT/gi,
+    remedy: 'Use parameterized queries: execute("SELECT ... WHERE id = :id", {"id": val}).'
+  },
+  {
+    id: 'SEC-PY-SHELL-TRUE',
+    category: 'Security',
+    tier: 'CRITICAL',
+    title: 'Python Subprocess shell=True Command Injection',
+    desc: 'Running shell commands with shell=True allows arbitrary remote command execution.',
+    appliesTo: ['.py'],
+    regex: /subprocess\.(?:run|call|Popen)\([^)]*shell\s*=\s*True/g,
+    remedy: 'Pass command arguments as an array ["cmd", "arg1"] with shell=False.'
+  },
+
+  // 2. MEMORY & RESOURCE LEAKAGE (FRONTEND JS/TS)
   {
     id: 'LEAK-EVENT-LISTENER',
     category: 'Memory Leakage',
     tier: 'MAJOR',
     title: 'Dangling EventListener in Hook (Missing Clean-up)',
     desc: 'addEventListener called inside useEffect without a corresponding removeEventListener in return cleanup.',
+    appliesTo: ['.js', '.jsx', '.ts', '.tsx'],
     customCheck: (content) => {
       if (!content.includes('addEventListener')) return null;
       if (content.includes('useEffect') && !content.includes('removeEventListener')) {
@@ -240,6 +292,7 @@ const RULES = [
     tier: 'MAJOR',
     title: 'Uncleaned setInterval / setTimeout Timer Leak',
     desc: 'setInterval called in lifecycle without clearInterval unmount teardown, continuing to run in background.',
+    appliesTo: ['.js', '.jsx', '.ts', '.tsx'],
     customCheck: (content) => {
       if (!content.includes('setInterval')) return null;
       if (content.includes('useEffect') && !content.includes('clearInterval')) {
@@ -255,7 +308,8 @@ const RULES = [
     tier: 'MINOR',
     title: 'Global Window Scope Object Pollution',
     desc: 'Assigning arbitrary variables to global window object prevents garbage collection.',
-    regex: /window\.[a-zA-Z0-9_$]+\s*=\s*(?!addEventListener|removeEventListener|location|scrollTo)[a-zA-Z0-9_$]+/g,
+    appliesTo: ['.js', '.jsx', '.ts', '.tsx'],
+    regex: /window\.(?!__)[a-zA-Z0-9_$]+\s*=\s*(?!addEventListener|removeEventListener|location|scrollTo)[a-zA-Z0-9_$]+/g,
     remedy: 'Encapsulate module state in React context, closures, or scoped module instances.'
   },
   {
@@ -264,6 +318,7 @@ const RULES = [
     tier: 'SUGGESTION',
     title: 'Residual Debug Console Logging',
     desc: 'Found console.log statements that can leak internal state and data payloads to browser devtools.',
+    appliesTo: ['.js', '.jsx', '.ts', '.tsx'],
     regex: /console\.log\s*\(/g,
     remedy: 'Remove console.log statements or strip via build compiler (e.g. babel-plugin-transform-remove-console).'
   },
@@ -275,6 +330,7 @@ const RULES = [
     tier: 'CRITICAL',
     title: 'Mobile iOS Safari Input Auto-Zoom Trap',
     desc: 'Text input font-size configured under 16px triggers mandatory Safari viewport zoom on focus.',
+    appliesTo: ['.css', '.scss', '.html', '.jsx', '.tsx'],
     regex: /(?:input|textarea)[^{]*\{[^}]*font-size\s*:\s*(?:1[0-5]|[89])px/gi,
     remedy: 'Enforce font-size: 16px minimum on mobile viewports for all form inputs (@media max-width: 768px).'
   },
@@ -284,8 +340,9 @@ const RULES = [
     tier: 'MAJOR',
     title: '300ms Mobile Tap Delay Latency',
     desc: 'Clickable elements missing touch-action: manipulation incur 300ms double-tap delay.',
-    customCheck: (content, ext) => {
-      if (ext === '.css' && content.includes('cursor: pointer') && !content.includes('touch-action: manipulation')) {
+    appliesTo: ['.css', '.scss'],
+    customCheck: (content) => {
+      if (content.includes('cursor: pointer') && !content.includes('touch-action: manipulation')) {
         return 'cursor: pointer declared on touch buttons without touch-action: manipulation.';
       }
       return null;
@@ -298,6 +355,7 @@ const RULES = [
     tier: 'MAJOR',
     title: 'Obliterated Keyboard Focus Ring',
     desc: 'outline: none or outline: 0 destroys accessibility keyboard indicator (WCAG 2.4.7 violation).',
+    appliesTo: ['.css', '.scss', '.html'],
     regex: /(?:button|a|\.btn)[^{]*\{[^}]*outline\s*:\s*(?:none|0)\b(?!.*focus-visible)/gi,
     remedy: 'Replace outline: none with button:focus-visible { outline: 2px solid #00f5a0; outline-offset: 2px; }.'
   },
@@ -307,6 +365,7 @@ const RULES = [
     tier: 'MAJOR',
     title: 'Flexbox SVG Icon Geometry Distortion',
     desc: 'SVG icons placed directly inside flex containers collapse when sibling text wraps or grows.',
+    appliesTo: ['.jsx', '.tsx', '.html'],
     customCheck: (content) => {
       if (content.includes('display: flex') && content.includes('<svg') && !content.includes('flex-shrink: 0')) {
         return 'Flex container contains SVG icons without flex-shrink: 0 declaration.';
@@ -321,7 +380,8 @@ const RULES = [
     tier: 'MAJOR',
     title: 'Horizontal Viewport Bleed (100vw Scrollbar Trap)',
     desc: 'Using width: 100vw includes the scrollbar gutter width, triggering unwanted horizontal overflow.',
-    regex: /width\s*:\s*100vw/gi,
+    appliesTo: ['.css', '.scss', '.html', '.jsx', '.tsx'],
+    regex: /(?<!max-|min-)width\s*:\s*100vw/gi,
     remedy: 'Replace width: 100vw with width: 100% or use max-w-full to prevent horizontal layout thrashing.'
   },
   {
@@ -330,6 +390,7 @@ const RULES = [
     tier: 'MAJOR',
     title: 'Unannounced Icon-Only Button',
     desc: 'Buttons containing only an SVG or icon without text or aria-label are completely invisible to screen readers.',
+    appliesTo: ['.jsx', '.tsx', '.html'],
     regex: /<button[^>]*>\s*<(?:svg|LucideIcon|[A-Z][a-zA-Z]+Icon)[^>]*\/>\s*<\/button>/g,
     remedy: 'Add aria-label="Action Name" or title attribute to all icon-only buttons.'
   }
@@ -344,10 +405,20 @@ function runLocalAudit(targetDir) {
 
   const files = walkDir(root);
   const issues = [];
+  const scannedFiles = [];
+  const extCounts = {};
+  const dirCounts = {};
 
   for (const filePath of files) {
     const relPath = path.relative(root, filePath);
-    const ext = path.extname(filePath);
+    const ext = path.extname(filePath).toLowerCase();
+    scannedFiles.push(relPath);
+
+    const extKey = ext || '[config]';
+    extCounts[extKey] = (extCounts[extKey] || 0) + 1;
+
+    const topFolder = relPath.split(path.sep)[0] || '.';
+    dirCounts[topFolder] = (dirCounts[topFolder] || 0) + 1;
 
     let content = '';
     try {
@@ -356,24 +427,39 @@ function runLocalAudit(targetDir) {
       continue;
     }
 
-    // Check .env in git
-    if (filePath.endsWith('.env') || filePath.endsWith('.env.local')) {
-      issues.push({
-        id: 'SEC-ENV-EXPOSED',
-        category: 'Security',
-        tier: 'CRITICAL',
-        title: 'Environment Config File Committed to Source',
-        file: relPath,
-        line: 1,
-        snippet: 'Sensitive configuration file present in directory tree.',
-        remedy: 'Add .env* to .gitignore and remove from git index using git rm --cached.'
-      });
+    // Check raw un-scoped .env files that are missing from .gitignore
+    if (path.basename(filePath) === '.env') {
+      const gitignorePath = path.join(root, '.gitignore');
+      let isGitIgnored = false;
+      if (fs.existsSync(gitignorePath)) {
+        try {
+          const giContent = fs.readFileSync(gitignorePath, 'utf8');
+          if (giContent.includes('.env')) isGitIgnored = true;
+        } catch (e) {}
+      }
+      if (!isGitIgnored) {
+        issues.push({
+          id: 'SEC-ENV-EXPOSED',
+          category: 'Security',
+          tier: 'CRITICAL',
+          title: 'Environment Config File Committed to Source',
+          file: relPath,
+          line: 1,
+          snippet: 'Sensitive configuration file present in directory tree without .gitignore protection.',
+          remedy: 'Add .env* to .gitignore and remove from git index using git rm --cached.'
+        });
+      }
     }
 
     for (const rule of RULES) {
       if (options.securityOnly && rule.category !== 'Security') continue;
       if (options.leakageOnly && !rule.category.includes('Leakage')) continue;
 
+      // Filter by language/file extension if rule specifies appliesTo
+      if (rule.appliesTo && !rule.appliesTo.includes(ext)) {
+        continue;
+      }
+
       if (rule.regex) {
         rule.regex.lastIndex = 0;
         let match;
@@ -416,7 +502,7 @@ function runLocalAudit(targetDir) {
     }
   }
 
-  return { root, totalFiles: files.length, issues };
+  return { root, totalFiles: files.length, scannedFiles, extCounts, dirCounts, issues };
 }
 
 // -------------------------------------------------------------
@@ -518,6 +604,7 @@ async function main() {
     console.log(JSON.stringify({
       target: audit.root,
       totalFiles: audit.totalFiles,
+      scannedFiles: audit.scannedFiles,
       score,
       grade,
       counts: {
@@ -532,18 +619,54 @@ async function main() {
     return;
   }
 
+  // Print all scanned files if --files or --verbose requested
+  if (options.files || options.verbose) {
+    console.log(`${C.bold}VERIFIED CODEBASE FILES (${audit.totalFiles} files inspected):${C.reset}`);
+    audit.scannedFiles.forEach((file, idx) => {
+      const fileIssues = audit.issues.filter(i => i.file === file);
+      const numStr = String(idx + 1).padStart(3, ' ');
+      if (fileIssues.length === 0) {
+        console.log(`  ${C.gray}[${numStr}/${audit.totalFiles}]${C.reset} ${C.emerald}✓${C.reset} ${file}`);
+      } else {
+        console.log(`  ${C.gray}[${numStr}/${audit.totalFiles}]${C.reset} ${C.rose}✗${C.reset} ${file} ${C.rose}(${fileIssues.length} issues)${C.reset}`);
+      }
+    });
+    console.log('');
+  }
+
   // Formatted Terminal Dashboard
   console.log(`${C.dim}————————————————————————————————————————————————————————————————————${C.reset}`);
-  console.log(`  ${C.bold}AUDIT REPORT OVERVIEW${C.reset}  •  Scanned ${C.bold}${audit.totalFiles}${C.reset} files`);
+  console.log(`  ${C.bold}AUDIT REPORT OVERVIEW${C.reset}  •  Scanned ${C.bold}${audit.totalFiles}${C.reset} files across entire codebase`);
   console.log(`${C.dim}————————————————————————————————————————————————————————————————————${C.reset}`);
   
   const gradeColor = grade.startsWith('A') ? C.emerald : grade === 'B' ? C.cyan : grade === 'C' ? C.amber : C.rose;
   console.log(`  Overall Score:  ${gradeColor}${C.bold}${score}/100${C.reset} (Grade ${gradeColor}${C.bold}${grade}${C.reset})`);
   console.log(`  Findings:       ${C.rose}${critical.length} Critical${C.reset}  |  ${C.amber}${major.length} Major${C.reset}  |  ${C.cyan}${minor.length} Minor${C.reset}  |  ${C.gray}${suggestions.length} Suggestions${C.reset}\n`);
 
+  console.log(`  ${C.bold}Full Codebase Coverage Breakdown:${C.reset}`);
+  const sortedExts = Object.entries(audit.extCounts).sort((a, b) => b[1] - a[1]);
+  sortedExts.forEach(([ext, count]) => {
+    let name = 'Source / Script';
+    if (ext === '.py') name = 'Python (FastAPI, Worker, Checks, Tests)';
+    else if (ext === '.ts') name = 'TypeScript (Backend, Core, API routes)';
+    else if (ext === '.tsx') name = 'React / Next.js Components';
+    else if (ext === '.js') name = 'JavaScript Modules & Configs';
+    else if (ext === '.json') name = 'JSON Manifests & Data schemas';
+    else if (ext === '.yml' || ext === '.yaml') name = 'GitHub CI & Docker Compose';
+    else if (ext === '.css' || ext === '.scss') name = 'Vanilla & Tailwind Styles';
+    else if (ext === '.html') name = 'HTML Templates & Fixtures';
+    else if (ext === '.md') name = 'Documentation & Blueprints';
+    else if (ext === '[config]') name = 'Dockerfiles, .env, .gitignore';
+    console.log(`   • ${C.cyan}${name.padEnd(42, ' ')}${C.reset} ${C.bold}${count}${C.reset} files (${ext})`);
+  });
+  console.log('');
+
   if (audit.issues.length === 0) {
-    console.log(`  ${C.emerald}✓ Zero internal security, leakage, or interface defects detected!${C.reset}\n`);
-    console.log(`  Your codebase meets enterprise production standards.`);
+    console.log(`  ${C.emerald}✓ Zero internal security, leakage, or interface defects detected!${C.reset}`);
+    console.log(`  Every file in the codebase was verified. Meets enterprise standards.\n`);
+    if (!options.files) {
+      console.log(`  ${C.dim}Tip: Run with ${C.white}--files${C.dim} to display each individual file path in the terminal.${C.reset}`);
+    }
     console.log(`${C.dim}————————————————————————————————————————————————————————————————————${C.reset}\n`);
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arnav-audit",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Comprehensive internal security, memory leakage, and invisible UI/UX interface auditor by Arnav.",
   "bin": {
     "arnav-audit": "bin/cli.js"