arnav-audit 1.0.2 → 1.0.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Arnav
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,46 +1,100 @@
 # arnav-audit
 
-> Autonomous Internal Security, Memory Leakage & Invisible UI/UX Interface Auditor by Arnav.
+> Autonomous Internal Security, Memory Leakage & Invisible UI/UX Interface Auditor
 
-[![Vibe Audit](https://mejor-iota.vercel.app/api/v1/badges/mejor-iota.vercel.app.svg)](https://mejor-iota.vercel.app)
+[![npm version](https://img.shields.io/npm/v/arnav-audit.svg?color=00f5a0)](https://www.npmjs.com/package/arnav-audit)
+[![GitHub Repository](https://img.shields.io/badge/GitHub-arnnnnaaavvvvv%2FMEJOR-00f5a0.svg?logo=github)](https://github.com/arnnnnaaavvvvv/MEJOR)
 [![License: MIT](https://img.shields.io/badge/License-MIT-emerald.svg)](https://opensource.org/licenses/MIT)
+[![Node.js: >=16](https://img.shields.io/badge/node-%3E%3D16.0.0-blue.svg)](https://nodejs.org/)
 
-Run deep internal security, memory leak, and invisible frontend defect audits across your code repositories and live websites directly from your terminal.
+`arnav-audit` is a high-speed, zero-dependency command-line interface and package designed to audit local codebases for critical security credential leaks, React/JS memory leaks, and invisible frontend UI/UX interface defects.
 
 ---
 
-## Quickstart
+## 🚀 Quickstart: Installation to Final Execution Pipeline
 
-Run directly via `npx` with zero installation:
+Follow this 4-step workflow to install, verify, and run audits across your projects:
 
+### Step 1: Install Globally
+Choose any method to install or run the CLI:
+
+```bash
+# Method A: Install globally via npm
+npm install -g arnav-audit
+
+# Method B: Direct install from GitHub (works for anyone without npm login)
+npm install -g github:arnnnnaaavvvvv/MEJOR
+
+# Method C: If working inside this cloned repository
+npm install -g . --force
+```
+
+*(Alternatively, run instantly with zero installation: `npx github:arnnnnaaavvvvv/MEJOR .` or `npx arnav-audit .`)*
+
+---
+
+### Step 2: Verify the CLI Binary
+Confirm that `arnav-audit` is globally registered in your terminal:
+```bash
+arnav-audit --version
+# Output: arnav-audit v1.0.4
+
+arnav-audit --help
+# Displays available flags, rules, and example commands
+```
+
+---
+
+### Step 3: Run the Codebase Audit
+Navigate to any project directory and run the audit:
 ```bash
-# Audit current local project repository
-npx arnav-audit
+# Audit the current project directory
+arnav-audit .
+
+# Audit a specific subdirectory or file
+arnav-audit ./src
+
+# List every single file inspected
+arnav-audit . --files
+
+# Scan exclusively for credentials & secrets
+arnav-audit . --security-only
+
+# Scan exclusively for memory & event listener leaks
+arnav-audit . --leakage-only
+```
+
+---
 
-# Audit specific directory
-npx arnav-audit ./apps/web
+### Step 4: Generate Automated AI Fix Prompts (Final Step)
+Generate ready-to-paste prompts formatted specifically for Cursor, Claude Code, or Antigravity:
+```bash
+arnav-audit . --prompts
+```
 
-# Audit live deployed URL (queries headless CDP telemetry engine)
-npx arnav-audit https://mejor-iota.vercel.app
+Or pipe machine-readable JSON into CI/CD quality gates:
+```bash
+arnav-audit . --json > audit-report.json
 ```
 
 ---
 
-## What `arnav-audit` Detects
+## 🛡️ Detection Capabilities
 
 ### 1. Internal Security & Credential Leakage
 - **Hardcoded Secret Keys**: Scans for exposed AWS access keys (`AKIA...`), OpenAI API keys (`sk-...`), GitHub personal access tokens (`ghp_...`), Stripe live secret keys (`sk_live_...`), and private key blocks (`-----BEGIN RSA PRIVATE KEY-----`).
-- **Exposed Configuration**: Detects committed `.env` and `.env.local` files in git trees.
+- **Exposed Configuration**: Detects committed `.env` and `.env.local` files in git trees missing `.gitignore` coverage.
 - **XSS & Code Injection Vectors**: Unsanitized `dangerouslySetInnerHTML`, `eval()`, and `new Function()` invocations.
+- **Backend Injection Patterns**: Flags raw string interpolations in SQL queries and unsafe `subprocess(..., shell=True)` execution.
 
-### 2. Major & Minor Memory Leakage
+### 2. Major & Minor Memory & Resource Leakage
 - **Hook Listener Leaks**: `addEventListener` inside React `useEffect` hooks missing clean-up `removeEventListener` callbacks.
-- **Timer Leaks**: `setInterval` and `setTimeout` without unmount `clearInterval` teardowns.
-- **Global Scope Pollution**: Accidental state assignments to the global `window` object.
+- **Timer Leaks**: `setInterval` and `setTimeout` initialized without unmount `clearInterval` teardowns.
+- **Global Scope Pollution**: Accidental state assignments to the global `window` object preventing garbage collection.
 - **Residual Logging**: Production `console.log` statements leaking internal state and data payloads.
 
 ### 3. Invisible Interface & UI/UX Traps
-- **iOS Safari Auto-Zoom Trap (`UX-IOS-AUTOZOOM`)**: Form inputs with `font-size < 16px` triggering mandatory mobile viewport zooming.
+- **iOS Safari Auto-Zoom Trap (`UX-IOS-AUTOZOOM`)**: Form inputs with `font-size < 16px` triggering mandatory mobile viewport zooming on focus.
 - **300ms Touch Latency (`UX-TAP-LATENCY`)**: Interactive elements missing `touch-action: manipulation`.
 - **Obliterated Focus Rings (`A11Y-FOCUS-OBLITERATED`)**: `outline: none` removing keyboard accessibility indicators (WCAG 2.4.7).
 - **Flexbox Icon Collapse (`UI-FLEX-SQUISH`)**: Distorted SVG icons inside flex containers missing `flex-shrink: 0`.
@@ -49,30 +103,28 @@ npx arnav-audit https://mejor-iota.vercel.app
 
 ---
 
-## Options & Flags
-
-```bash
-# Generate ready-to-paste AI fix prompts for Cursor & Claude Code
-npx arnav-audit --prompts
-
-# Scan exclusively for security credentials and XSS vulnerabilities
-npx arnav-audit --security-only
-
-# Scan exclusively for memory & event listener leaks
-npx arnav-audit --leakage-only
+## 🛠️ CLI Reference & Flags
 
-# Output machine-readable JSON for CI/CD pipelines
-npx arnav-audit --json > audit-results.json
-```
+| Flag | Shorthand | Description |
+|---|---|---|
+| `[directory]` | — | Target path to audit (defaults to `.`) |
+| `--files` | `--list` | List every scanned file with inspection status |
+| `--verbose` | — | Display detailed scan logs and file-by-file verification |
+| `--prompts` | `--fix` | Pre-compile copy-paste AI fix prompts for Cursor / Claude Code |
+| `--security-only`| `--security` | Scan exclusively for credentials, secrets & injection vectors |
+| `--leakage-only` | `--leakage` | Scan exclusively for event listeners, timers & window leaks |
+| `--json` | — | Output raw machine-readable JSON for CI/CD pipelines |
+| `--version` | `-v` | Display CLI version |
+| `--help` | `-h` | Display help screen |
 
 ---
 
-## GitHub Actions CI/CD Integration
+## 🚀 GitHub Actions CI/CD Quality Gate
 
-Fail your CI build if critical security or memory leaks are detected:
+Add `arnav-audit` to your `.github/workflows/audit.yml` to automatically prevent credential leakage or broken mobile viewports from merging into production:
 
 ```yaml
-name: Internal Quality & Security Audit
+name: Codebase Quality & Security Gate
 on: [push, pull_request]
 
 jobs:
@@ -89,7 +141,21 @@ jobs:
 
 ---
 
-## Online Interactive Dashboard
+## 🧪 Local Development & Testing
+
+```bash
+# Run unit tests
+npm test
+
+# Run audit locally
+node bin/cli.js .
+
+# Check help output
+node bin/cli.js --help
+```
+
+---
+
+## 📄 License
 
-View synchronized Before vs. After split-view preview and live in-browser CSS patches at:  
-👉 [**https://mejor-iota.vercel.app**](https://mejor-iota.vercel.app)
+MIT © [Arnav](https://github.com/arnav)

package/bin/cli.js

@@ -3,13 +3,10 @@
 /**
  * arnav-audit - Automated Internal Security, Memory Leakage & UI/UX Interface Auditor
  * Author: Arnav
- * Website: https://mejor-iota.vercel.app
  */
 
 const fs = require('fs');
 const path = require('path');
-const https = require('https');
-const http = require('http');
 
 // Terminal ANSI styling
 const C = {
@@ -46,7 +43,7 @@ ${C.emerald}${C.bold}   _    ____  _   _    ___     __     _   _   _ ____ ___ __
 / ___ \\|  _ <| |\\  |/ ___ \\ V /    / ___ \\ |_| | |_| | |  | |  
 /_/   \\_\\_| \\_\\_| \\_/_/   \\_\\_/    /_/   \\_\\___/|____/___| |_|  ${C.reset}
 ${C.dim}Autonomous Security, Memory Leakage & Invisible UI/UX Auditor${C.reset}
-${C.gray}Engine by Arnav • https://mejor-iota.vercel.app${C.reset}
+${C.gray}Engine by Arnav • Codebase & Interface Quality Gate${C.reset}
 `;
 
 // Parse CLI arguments
@@ -77,7 +74,13 @@ for (let i = 0; i < args.length; i++) {
 }
 
 if (options.version) {
-  console.log('arnav-audit v1.0.2');
+  const pkgPath = path.join(__dirname, '..', 'package.json');
+  let ver = '1.0.3';
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    ver = pkg.version || ver;
+  } catch (e) {}
+  console.log(`arnav-audit v${ver}`);
   process.exit(0);
 }
 
@@ -88,8 +91,7 @@ ${C.bold}USAGE:${C.reset}
   npx arnav-audit [target] [options]
 
 ${C.bold}TARGETS:${C.reset}
-  [directory]        Path to local project root (defaults to current directory ".")
-  [https://url]      Live website URL to run headless CDP telemetry & 200 checks
+  [directory]        Path to local project root or directory (defaults to current directory ".")
 
 ${C.bold}OPTIONS:${C.reset}
   --files, --list    List every single scanned file path with inspection status
@@ -103,9 +105,10 @@ ${C.bold}OPTIONS:${C.reset}
 
 ${C.bold}EXAMPLES:${C.reset}
   $ npx arnav-audit .
+  $ npx arnav-audit ./src
   $ npx arnav-audit . --files
-  $ npx arnav-audit https://mejor-iota.vercel.app
   $ npx arnav-audit . --prompts
+  $ npx arnav-audit . --security-only
   $ npx arnav-audit . --json > audit-report.json
 `);
   process.exit(0);
@@ -148,20 +151,29 @@ const BINARY_EXTS = new Set([
 
 function walkDir(dir, fileList = []) {
   try {
+    const stat = fs.statSync(dir);
+    if (!stat.isDirectory()) {
+      const ext = path.extname(dir).toLowerCase();
+      if (!BINARY_EXTS.has(ext)) {
+        fileList.push(dir);
+      }
+      return fileList;
+    }
+
     const files = fs.readdirSync(dir);
     for (const file of files) {
       if (IGNORED_DIRS.has(file)) continue;
       const fullPath = path.join(dir, file);
       try {
-        const stat = fs.statSync(fullPath);
-        if (stat.isDirectory()) {
+        const fileStat = fs.statSync(fullPath);
+        if (fileStat.isDirectory()) {
           // Allow .github workflow directory while ignoring other hidden dot-folders
           if (file.startsWith('.') && file !== '.github') continue;
           if (file.includes('worktree')) continue;
           walkDir(fullPath, fileList);
         } else {
           // Skip the scanner's own CLI script so its rule definitions are not self-flagged
-          if (file === 'cli.js' && fullPath.includes('arnav-audit')) continue;
+          if (file === 'cli.js' && fullPath.includes('bin')) continue;
           // Skip OS metadata
           if (file === '.DS_Store' || file === 'Thumbs.db') continue;
 
@@ -319,6 +331,7 @@ const RULES = [
     title: 'Residual Debug Console Logging',
     desc: 'Found console.log statements that can leak internal state and data payloads to browser devtools.',
     appliesTo: ['.js', '.jsx', '.ts', '.tsx'],
+    ignoreInTests: true,
     regex: /console\.log\s*\(/g,
     remedy: 'Remove console.log statements or strip via build compiler (e.g. babel-plugin-transform-remove-console).'
   },
@@ -410,7 +423,7 @@ function runLocalAudit(targetDir) {
   const dirCounts = {};
 
   for (const filePath of files) {
-    const relPath = path.relative(root, filePath);
+    const relPath = path.relative(root, filePath) || path.basename(filePath);
     const ext = path.extname(filePath).toLowerCase();
     scannedFiles.push(relPath);
 
@@ -454,6 +467,7 @@ function runLocalAudit(targetDir) {
     for (const rule of RULES) {
       if (options.securityOnly && rule.category !== 'Security') continue;
       if (options.leakageOnly && !rule.category.includes('Leakage')) continue;
+      if (rule.ignoreInTests && (relPath.toLowerCase().includes('test') || relPath.toLowerCase().includes('spec'))) continue;
 
       // Filter by language/file extension if rule specifies appliesTo
       if (rule.appliesTo && !rule.appliesTo.includes(ext)) {
@@ -466,7 +480,6 @@ function runLocalAudit(targetDir) {
         while ((match = rule.regex.exec(content)) !== null) {
           const linesUpToMatch = content.slice(0, match.index).split('\n');
           const lineNum = linesUpToMatch.length;
-          const lineContent = linesUpToMatch[linesUpToMatch.length - 1].trim();
 
           issues.push({
             id: rule.id,
@@ -505,81 +518,18 @@ function runLocalAudit(targetDir) {
   return { root, totalFiles: files.length, scannedFiles, extCounts, dirCounts, issues };
 }
 
-// -------------------------------------------------------------
-// LIVE URL AUDIT ENGINE (Connects to https://mejor-iota.vercel.app)
-// -------------------------------------------------------------
-async function runUrlAudit(url) {
-  let targetUrl = url.trim();
-  if (!targetUrl.match(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//)) {
-    targetUrl = 'https://' + targetUrl;
-  }
-
-  const endpoint = `https://mejor-iota.vercel.app/api/v1/scans`;
-  
-  return new Promise((resolve, reject) => {
-    const postData = JSON.stringify({ url: targetUrl, mode: 'quick' });
-    const parsed = new URL(endpoint);
-
-    const req = https.request({
-      hostname: parsed.hostname,
-      port: 443,
-      path: parsed.pathname,
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Content-Length': Buffer.byteLength(postData),
-        'User-Agent': 'arnav-audit-cli/1.0',
-      },
-      timeout: 10000,
-    }, (res) => {
-      let data = '';
-      res.on('data', chunk => data += chunk);
-      res.on('end', () => {
-        try {
-          const parsedRes = JSON.parse(data);
-          resolve({ targetUrl, scanId: parsedRes.id, reportUrl: `https://mejor-iota.vercel.app/scans/${parsedRes.id}` });
-        } catch (e) {
-          resolve({ targetUrl, offline: true });
-        }
-      });
-    });
-
-    req.on('error', () => {
-      resolve({ targetUrl, offline: true });
-    });
-
-    req.write(postData);
-    req.end();
-  });
-}
-
 // -------------------------------------------------------------
 // MAIN EXECUTION
 // -------------------------------------------------------------
 async function main() {
-  const isUrl = options.target.startsWith('http://') || options.target.startsWith('https://') || options.target.includes('.vercel.app') || options.target.includes('.com') || options.target.includes('.dev');
+  // Reject URL targets clearly
+  const isUrl = /^https?:\/\//i.test(options.target) || options.target.includes('.vercel.app');
 
   if (isUrl) {
-    if (!options.json) {
-      console.log(BANNER);
-      console.log(`${C.cyan}▸ Dispatching live browser CDP telemetry scan for:${C.reset} ${C.bold}${options.target}${C.reset}\n`);
-    }
-
-    const result = await runUrlAudit(options.target);
-
-    if (options.json) {
-      console.log(JSON.stringify(result, null, 2));
-      return;
-    }
-
-    console.log(`${C.emerald}✓ Audit Engine Dispatched Successfully!${C.reset}`);
-    console.log(`${C.white}• Target:       ${C.bold}${result.targetUrl}${C.reset}`);
-    if (result.scanId) {
-      console.log(`${C.white}• Scan ID:      ${C.gray}${result.scanId}${C.reset}`);
-      console.log(`${C.white}• Live Report:  ${C.emerald}${C.underline}${result.reportUrl}${C.reset}\n`);
-      console.log(`${C.dim}Tip: Open the link above to view synchronized Before/After split-view and copy Cursor AI fix prompts.${C.reset}\n`);
-    }
-    return;
+    console.error(`\n${C.rose}${C.bold}Error:${C.reset} ${C.white}URL scanning is not supported in this version of arnav-audit.${C.reset}`);
+    console.error(`${C.dim}arnav-audit is a dedicated local codebase auditor for internal security, memory leaks, and UI defects.${C.reset}`);
+    console.error(`${C.dim}Please provide a local project directory path instead (e.g. ${C.white}arnav-audit .${C.dim} or ${C.white}arnav-audit ./src${C.dim}).${C.reset}\n`);
+    process.exit(1);
   }
 
   // Local Project Directory Scan
@@ -636,7 +586,7 @@ async function main() {
 
   // Formatted Terminal Dashboard
   console.log(`${C.dim}————————————————————————————————————————————————————————————————————${C.reset}`);
-  console.log(`  ${C.bold}AUDIT REPORT OVERVIEW${C.reset}  •  Scanned ${C.bold}${audit.totalFiles}${C.reset} files across entire codebase`);
+  console.log(`  ${C.bold}AUDIT REPORT OVERVIEW${C.reset}  •  Scanned ${C.bold}${audit.totalFiles}${C.reset} files across codebase`);
   console.log(`${C.dim}————————————————————————————————————————————————————————————————————${C.reset}`);
   
   const gradeColor = grade.startsWith('A') ? C.emerald : grade === 'B' ? C.cyan : grade === 'C' ? C.amber : C.rose;
@@ -647,16 +597,16 @@ async function main() {
   const sortedExts = Object.entries(audit.extCounts).sort((a, b) => b[1] - a[1]);
   sortedExts.forEach(([ext, count]) => {
     let name = 'Source / Script';
-    if (ext === '.py') name = 'Python (FastAPI, Worker, Checks, Tests)';
-    else if (ext === '.ts') name = 'TypeScript (Backend, Core, API routes)';
+    if (ext === '.py') name = 'Python (Backend, Scripts, Tests)';
+    else if (ext === '.ts') name = 'TypeScript (Backend, Core, API)';
     else if (ext === '.tsx') name = 'React / Next.js Components';
     else if (ext === '.js') name = 'JavaScript Modules & Configs';
     else if (ext === '.json') name = 'JSON Manifests & Data schemas';
-    else if (ext === '.yml' || ext === '.yaml') name = 'GitHub CI & Docker Compose';
-    else if (ext === '.css' || ext === '.scss') name = 'Vanilla & Tailwind Styles';
+    else if (ext === '.yml' || ext === '.yaml') name = 'GitHub CI & YAML Configs';
+    else if (ext === '.css' || ext === '.scss') name = 'CSS & Styling Stylesheets';
     else if (ext === '.html') name = 'HTML Templates & Fixtures';
-    else if (ext === '.md') name = 'Documentation & Blueprints';
-    else if (ext === '[config]') name = 'Dockerfiles, .env, .gitignore';
+    else if (ext === '.md') name = 'Documentation & Readmes';
+    else if (ext === '[config]') name = 'Config & Dotfiles';
     console.log(`   • ${C.cyan}${name.padEnd(42, ' ')}${C.reset} ${C.bold}${count}${C.reset} files (${ext})`);
   });
   console.log('');
@@ -673,7 +623,7 @@ async function main() {
 
   console.log(`${C.bold}DETECTED INTERNAL ISSUES:${C.reset}\n`);
 
-  audit.issues.forEach((issue, index) => {
+  audit.issues.forEach((issue) => {
     const badge = issue.tier === 'CRITICAL'
       ? `${C.bgRose}${C.white}${C.bold} CRITICAL ${C.reset}`
       : issue.tier === 'MAJOR'
@@ -709,8 +659,7 @@ async function main() {
     console.log(`3. Ensure zero credentials remain in codebase.`);
     console.log(`${C.reset}`);
   } else {
-    console.log(`${C.dim}Tip: Run ${C.white}npx arnav-audit --prompts${C.dim} to output ready-to-paste AI copilot fix prompts.${C.reset}`);
-    console.log(`${C.dim}Interactive Web Dashboard: ${C.emerald}https://mejor-iota.vercel.app${C.reset}\n`);
+    console.log(`${C.dim}Tip: Run ${C.white}npx arnav-audit --prompts${C.dim} to output ready-to-paste AI copilot fix prompts.${C.reset}\n`);
   }
 
   console.log(`${C.dim}————————————————————————————————————————————————————————————————————${C.reset}\n`);

package/package.json

@@ -1,21 +1,40 @@
 {
   "name": "arnav-audit",
-  "version": "1.0.2",
-  "description": "Comprehensive internal security, memory leakage, and invisible UI/UX interface auditor by Arnav.",
+  "version": "1.0.4",
+  "description": "Autonomous internal security, memory leakage, and invisible UI/UX interface auditor.",
+  "main": "bin/cli.js",
   "bin": {
     "arnav-audit": "bin/cli.js"
   },
-  "main": "bin/cli.js",
   "files": [
     "bin",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
     "start": "node ./bin/cli.js",
-    "test": "node ./bin/cli.js --help"
+    "test": "node ./test/cli.test.js",
+    "audit": "node ./bin/cli.js .",
+    "audit:files": "node ./bin/cli.js . --files",
+    "audit:verbose": "node ./bin/cli.js . --verbose",
+    "audit:fix": "node ./bin/cli.js . --prompts",
+    "audit:security": "node ./bin/cli.js . --security-only",
+    "audit:leakage": "node ./bin/cli.js . --leakage-only"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/arnnnnaaavvvvv/MEJOR.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/arnnnnaaavvvvv/MEJOR#readme",
+  "bugs": {
+    "url": "https://github.com/arnnnnaaavvvvv/MEJOR/issues"
   },
   "keywords": [
     "audit",
+    "cli",
     "security",
     "leakage",
     "memory-leak",
@@ -24,6 +43,7 @@
     "cursor",
     "claude-code",
     "antigravity",
+    "quality-gate",
     "arnav"
   ],
   "author": "Arnav",