codevet-cli 1.1.0

package/dist/index.js

@@ -0,0 +1,354 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import chalk from "chalk";
+import { resolve, join, dirname } from "node:path";
+import { existsSync } from "node:fs";
+import { detectStack } from "./detectors/detectStack.js";
+import { runGitleaksScan, GitleaksBinaryMissingError } from "./scanners/gitleaksScanner.js";
+import { runNpmAuditScan, NpmAuditScanFailedError, WrongPackageManagerError } from "./scanners/npmAuditScanner.js";
+import { runHygieneScan } from "./scanners/hygieneScanner.js";
+import { runBearerScan, BearerBinaryMissingError, BearerScanFailedError } from "./scanners/bearerScanner.js";
+import { runPipAuditScan, PipAuditNotInstalledError, PipAuditScanFailedError } from "./scanners/pipAuditScanner.js";
+import { resolveTarget, cleanupTarget, persistTarget, readProvenanceMarker, removeFolder } from "./resolveTarget.js";
+import { loadConfig, saveConfig } from "./config.js";
+import { promptConfirm } from "./promptConfirm.js";
+import { printReport, hasFindings, hasHighRiskFindings } from "./report.js";
+import { runFix, removeDependency } from "./scanners/npmFixActions.js";
+const program = new Command();
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// Read the real version from package.json rather than hardcoding it —
+// confirmed as a real bug: a hardcoded "0.0.1" had silently drifted out
+// of sync with the actual published version.
+const packageJson = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));
+program
+    .name("codevet")
+    .description("Vet your code before it ships — free, open-source security scanning")
+    .version(packageJson.version);
+program
+    .command("scan")
+    .description("Scan a project for security issues. Defaults to the current directory. Accepts a local path or a git/GitHub URL (which gets shallow-cloned to a temp folder first, so you can review it before deciding to keep it).")
+    .argument("[path...]", "project path or git URL to scan (defaults to the current directory)")
+    .option("--no-secrets", "skip the secret-scanning check for this run only")
+    .option("--no-dependencies", "skip the dependency-vulnerability check for this run only")
+    .option("--no-hygiene", "skip the missing-middleware check for this run only")
+    .option("--no-data-flow", "skip the personal-data-flow check for this run only")
+    .option("--json <path>", "also write a machine-readable JSON report to this path (for CI/tooling)")
+    .option("--fail-on-high-risk", "exit with a non-zero code if any secret or high/critical dependency finding is present")
+    .action(async (pathArgs, options) => {
+    const target = await resolveTarget(pathArgs, process.cwd());
+    if (target.rejoinedFromSplitArgs) {
+        console.log(chalk.yellow(`Note: your path contains spaces and wasn't quoted, so I rejoined it as: "${target.path}". If that's wrong, wrap the path in quotes.`));
+    }
+    try {
+        // A path that doesn't exist must be a hard error, never a silent
+        // "clean" result — confirmed as a real risk: gitleaks, npm audit,
+        // and the hygiene scanner all previously proceeded on a nonexistent
+        // path and reported "no findings," which is indistinguishable from
+        // a genuine clean scan. Bearer already validates this internally
+        // (confirmed it correctly errors on its own); this check makes the
+        // other three scanners fail the same safe way.
+        if (!existsSync(target.path)) {
+            console.log(chalk.red(`✖ ${target.path} does not exist — nothing was scanned.`));
+            process.exitCode = 1;
+            return;
+        }
+        console.log(chalk.bold("\nCodeVet — scanning " + target.path + "\n"));
+        const stacks = detectStack(target.path);
+        if (stacks.length === 0) {
+            console.log(chalk.yellow("No recognized stack found (looked for package.json, requirements.txt, build.gradle, Podfile)."));
+        }
+        else {
+            console.log(chalk.dim("Detected: " + stacks.map((s) => `${s.stack} (${s.matchedOn})`).join(", ")));
+        }
+        // Untrusted clones ALWAYS run the full scan, regardless of any
+        // .codevet/config.json the repo itself might contain — otherwise a
+        // malicious repo could just ship a config that disables every check
+        // and sail through review undetected.
+        const config = target.isUntrustedClone
+            ? { secrets: true, dependencies: true, hygiene: true, dataFlow: true }
+            : await loadConfig(target.path);
+        const runSecrets = options.secrets !== false && config.secrets;
+        const runDependencies = options.dependencies !== false && config.dependencies;
+        const runHygiene = options.hygiene !== false && config.hygiene;
+        const runDataFlow = options.dataFlow !== false && config.dataFlow;
+        console.log(chalk.dim("\nChecking for exposed secrets...\n"));
+        const secrets = runSecrets ? await runGitleaksScan(target.path) : [];
+        // Wrapped exactly like the bearer scanner below — confirmed as a
+        // real crash risk in testing: npm audit's own lockfile-generation
+        // step can fail (e.g. an npm internal error on a specific
+        // package.json), and left uncaught this took down the ENTIRE scan
+        // command, hiding secrets/hygiene/data-flow results that had
+        // nothing to do with the failure. Never let one scanner's failure
+        // silence the others.
+        let dependencies = [];
+        let dependenciesUnavailableReason;
+        let dependenciesFailed = false;
+        if (runDependencies) {
+            try {
+                dependencies = await runNpmAuditScan(target.path);
+            }
+            catch (err) {
+                if (err instanceof NpmAuditScanFailedError) {
+                    dependenciesUnavailableReason = err.message;
+                    dependenciesFailed = true;
+                }
+                else if (err instanceof WrongPackageManagerError) {
+                    // A deliberate, understood decision not to run — not an
+                    // unexpected failure — so this stays a calm skip, not a
+                    // red warning. Confirmed the underlying npm crash is real
+                    // by directly reproducing it against a pnpm-managed project.
+                    dependenciesUnavailableReason = err.message;
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        let dataFlow = [];
+        let dataFlowUnavailableReason;
+        let dataFlowFailed = false;
+        if (runDataFlow) {
+            try {
+                dataFlow = await runBearerScan(target.path);
+            }
+            catch (err) {
+                if (err instanceof BearerBinaryMissingError) {
+                    dataFlowUnavailableReason = err.message;
+                }
+                else if (err instanceof BearerScanFailedError) {
+                    dataFlowUnavailableReason = err.message;
+                    dataFlowFailed = true;
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        // Gated by the same toggle as npm audit — conceptually both are
+        // "dependency scanning," just for a different ecosystem, so one
+        // config field covers both rather than adding a Python-specific one.
+        // Applicability now also covers pyproject.toml, not just
+        // requirements.txt — closing a gap explicitly flagged as missing
+        // in an earlier, less capable version of this scanner.
+        let pythonDependencies = [];
+        let pythonDependenciesUnavailableReason;
+        let pythonDependenciesFailed = false;
+        const pythonDependenciesApplicable = runDependencies &&
+            (existsSync(join(target.path, "requirements.txt")) ||
+                existsSync(join(target.path, "pyproject.toml")));
+        if (pythonDependenciesApplicable) {
+            try {
+                pythonDependencies = await runPipAuditScan(target.path);
+            }
+            catch (err) {
+                if (err instanceof PipAuditNotInstalledError) {
+                    pythonDependenciesUnavailableReason = err.message;
+                }
+                else if (err instanceof PipAuditScanFailedError) {
+                    pythonDependenciesUnavailableReason = err.message;
+                    pythonDependenciesFailed = true;
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        let hygiene = [];
+        if (runHygiene) {
+            hygiene = await runHygieneScan(target.path);
+        }
+        const report = {
+            secrets,
+            dependencies,
+            hygiene,
+            dataFlow,
+            pythonDependencies,
+            pythonDependenciesApplicable,
+            pythonDependenciesFailed,
+            pythonDependenciesUnavailableReason,
+            secretsScanSkipped: !runSecrets,
+            dependenciesScanSkipped: !runDependencies || (Boolean(dependenciesUnavailableReason) && !dependenciesFailed),
+            dependenciesScanFailed: dependenciesFailed,
+            dependenciesUnavailableReason,
+            dataFlowScanSkipped: !runDataFlow || (Boolean(dataFlowUnavailableReason) && !dataFlowFailed),
+            dataFlowScanFailed: dataFlowFailed,
+            dataFlowUnavailableReason,
+        };
+        printReport(report);
+        if (options.json) {
+            const { writeFile } = await import("node:fs/promises");
+            await writeFile(options.json, JSON.stringify(report, null, 2));
+            console.log(chalk.dim(`\nJSON report written to ${options.json}`));
+        }
+        if (target.isUntrustedClone) {
+            await handleUntrustedCloneDecision(target, report);
+        }
+        if (options.failOnHighRisk && hasHighRiskFindings(report)) {
+            process.exitCode = 1;
+        }
+    }
+    catch (err) {
+        if (err instanceof GitleaksBinaryMissingError) {
+            console.log(chalk.red("✖ " + err.message));
+        }
+        else {
+            throw err;
+        }
+    }
+    finally {
+        if (!target.isUntrustedClone) {
+            await cleanupTarget(target);
+        }
+        // Untrusted-clone cleanup/persistence is handled inside
+        // handleUntrustedCloneDecision instead — it decides whether to keep
+        // or delete based on the user's answer.
+    }
+});
+async function handleUntrustedCloneDecision(target, report) {
+    if (!hasFindings(report)) {
+        const destination = await persistTarget(target, process.cwd());
+        console.log(chalk.green(`\n✔ No issues found — kept at ${destination}`));
+        return;
+    }
+    const serious = hasHighRiskFindings(report);
+    const proceed = await promptConfirm(chalk.yellow(`\n${serious ? "⚠ Serious issues" : "Some issues"} were found above. Do you still want to keep this repository?`));
+    if (proceed) {
+        const destination = await persistTarget(target, process.cwd());
+        console.log(chalk.yellow(`Kept at ${destination} despite the issues above — review them before running this code.`));
+    }
+    else {
+        await cleanupTarget(target);
+        console.log(chalk.dim("Discarded — nothing was kept."));
+    }
+}
+const configCmd = program
+    .command("config")
+    .description("Enable or disable specific scanners for this project (stored in .codevet/config.json)");
+configCmd
+    .command("status")
+    .argument("[path]", "project path", ".")
+    .action(async (path) => {
+    const config = await loadConfig(path === "." ? process.cwd() : path);
+    console.log(chalk.bold("\nCodeVet scanner status:\n"));
+    console.log(`  secrets:      ${config.secrets ? chalk.green("enabled") : chalk.red("disabled")}`);
+    console.log(`  dependencies: ${config.dependencies ? chalk.green("enabled") : chalk.red("disabled")}`);
+    console.log(`  hygiene:      ${config.hygiene ? chalk.green("enabled") : chalk.red("disabled")}`);
+    console.log(`  data-flow:    ${config.dataFlow ? chalk.green("enabled") : chalk.red("disabled")}`);
+});
+for (const action of ["enable", "disable"]) {
+    configCmd
+        .command(action)
+        .argument("<scanner>", "'secrets', 'dependencies', 'hygiene', 'data-flow', or 'all'")
+        .argument("[path]", "project path", ".")
+        .description(`${action === "enable" ? "Enable" : "Disable"} a scanner for this project`)
+        .action(async (scanner, path) => {
+        const projectRoot = path === "." ? process.cwd() : path;
+        const config = await loadConfig(projectRoot);
+        const value = action === "enable";
+        if (scanner === "all") {
+            config.secrets = value;
+            config.dependencies = value;
+            config.hygiene = value;
+            config.dataFlow = value;
+        }
+        else if (scanner === "data-flow") {
+            config.dataFlow = value;
+        }
+        else if (scanner === "secrets" || scanner === "dependencies" || scanner === "hygiene") {
+            config[scanner] = value;
+        }
+        else {
+            console.log(chalk.red(`Unknown scanner "${scanner}" — expected 'secrets', 'dependencies', 'hygiene', 'data-flow', or 'all'.`));
+            return;
+        }
+        await saveConfig(projectRoot, config);
+        console.log(chalk.green(`✔ ${scanner} scanner${scanner === "all" ? "s" : ""} ${action}d for this project.`));
+    });
+}
+program
+    .command("clean")
+    .description("Remove a repository that CodeVet previously cloned and kept")
+    .argument("<path>", "path to the folder to remove")
+    .option("--yes", "skip the confirmation prompt")
+    .action(async (path, options) => {
+    const target = resolve(path);
+    if (!existsSync(target)) {
+        console.log(chalk.red(`✖ ${target} doesn't exist.`));
+        return;
+    }
+    const marker = await readProvenanceMarker(target);
+    if (marker) {
+        console.log(chalk.dim(`This was cloned from ${marker.sourceUrl} on ${new Date(marker.clonedAt).toLocaleString()}.`));
+    }
+    else {
+        console.log(chalk.yellow("This folder doesn't have a CodeVet clone marker — it may not have been created by 'codevet scan <url>'. Double-check the path before continuing."));
+    }
+    const proceed = options.yes || (await promptConfirm(`Remove ${target}?`));
+    if (!proceed) {
+        console.log(chalk.dim("Cancelled — nothing was removed."));
+        return;
+    }
+    try {
+        await removeFolder(target);
+        console.log(chalk.green(`✔ Removed ${target}`));
+    }
+    catch (err) {
+        console.log(chalk.red("✖ " + (err instanceof Error ? err.message : String(err))));
+    }
+});
+program
+    .command("fix")
+    .description("Upgrade flagged dependencies to a safe version (runs 'npm audit fix' — does not change major-version constraints unless --force is passed).")
+    .argument("[path]", "project path", ".")
+    .option("--force", "allow major-version upgrades that may include breaking changes")
+    .action(async (path, options) => {
+    const projectRoot = path === "." ? process.cwd() : path;
+    if (options.force) {
+        console.log(chalk.yellow("⚠ Running with --force: this can upgrade packages across major versions, which may break your code. Review the diff before committing."));
+    }
+    console.log(chalk.dim("\nRunning npm audit fix...\n"));
+    const result = await runFix(projectRoot, options.force);
+    const beforeCount = result.before.length;
+    const afterCount = result.after.length;
+    const fixedCount = beforeCount - afterCount;
+    if (fixedCount > 0) {
+        console.log(chalk.green(`✔ Fixed ${fixedCount} of ${beforeCount} flagged package(s).`));
+    }
+    else {
+        console.log(chalk.yellow("No packages were auto-fixable."));
+    }
+    if (afterCount > 0) {
+        console.log(chalk.yellow(`${afterCount} package(s) still flagged — these likely need a major-version bump. Run 'codevet fix --force' to attempt those, or 'codevet remove-dependency <name>' if a flagged package isn't actually needed.`));
+        for (const d of result.after) {
+            console.log(chalk.dim(`  - ${d.packageName} (${d.severity})`));
+        }
+    }
+});
+program
+    .command("remove-dependency")
+    .description("Explicitly uninstall a flagged package. WARNING: this is different from 'fix' — if your code actually imports this package, removing it will break your app. Only use this for packages you're sure are unused.")
+    .argument("<package>", "the package name to remove")
+    .argument("[path]", "project path", ".")
+    .option("--yes", "skip the confirmation prompt")
+    .action(async (packageName, path, options) => {
+    const projectRoot = path === "." ? process.cwd() : path;
+    console.log(chalk.yellow(`⚠ This will run 'npm uninstall ${packageName}'. If your code imports this package, your app will break until you either restore it or remove those imports.`));
+    const proceed = options.yes || (await promptConfirm(`Remove ${packageName}?`));
+    if (!proceed) {
+        console.log(chalk.dim("Cancelled — nothing was removed."));
+        return;
+    }
+    const result = await removeDependency(projectRoot, packageName);
+    if (!result.wasPresent) {
+        console.log(chalk.yellow(`${packageName} wasn't found in package.json — nothing to remove.`));
+    }
+    else if (result.removed) {
+        console.log(chalk.green(`✔ Removed ${packageName}.`));
+    }
+    else {
+        console.log(chalk.red(`✖ Failed to remove ${packageName}: ${result.error}`));
+    }
+});
+program.parse();

package/dist/promptConfirm.js

@@ -0,0 +1,12 @@
+import { createInterface } from "node:readline/promises";
+export async function promptConfirm(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await rl.question(`${question} (y/N): `);
+        const normalized = answer.trim().toLowerCase();
+        return normalized === "y" || normalized === "yes";
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/report.js

@@ -0,0 +1,155 @@
+import chalk from "chalk";
+/**
+ * One consistent High/Moderate/Low(/Critical) label used everywhere in the
+ * report — this is the direct signal for "what do I actually need to fix
+ * before shipping" vs "what can wait." Critical/High mean real,
+ * meaningfully exploitable risk; Moderate is real but rarely the sole
+ * cause of an incident on its own; Low is worth doing but not urgent.
+ */
+export function hygieneSeverityLabel(severity) {
+    switch (severity) {
+        case "critical":
+            return chalk.bgRed.white.bold(" CRITICAL ");
+        case "high":
+            return chalk.red.bold("✖ HIGH");
+        case "moderate":
+            return chalk.yellow.bold("○ MODERATE");
+        case "low":
+            return chalk.dim("○ LOW");
+    }
+}
+export function hasFindings(report) {
+    return (report.secrets.length > 0 ||
+        report.dependencies.length > 0 ||
+        report.hygiene.length > 0 ||
+        report.dataFlow.length > 0 ||
+        report.pythonDependencies.length > 0 ||
+        Boolean(report.dataFlowScanFailed) ||
+        Boolean(report.dependenciesScanFailed) ||
+        Boolean(report.pythonDependenciesFailed));
+}
+export function hasHighRiskFindings(report) {
+    const hasCriticalOrHighDep = report.dependencies.some((d) => d.severity === "critical" || d.severity === "high");
+    const hasCriticalOrHighDataFlow = report.dataFlow.some((d) => d.severity === "critical" || d.severity === "high");
+    const hasCriticalOrHighHygiene = report.hygiene.some((h) => h.severity === "critical" || h.severity === "high");
+    // A scan that was attempted but genuinely failed (e.g. bearer's rule
+    // download hit a rate limit) must never be treated as equivalent to a
+    // clean result — confirmed as a real risk in testing, where forcing a
+    // success exit code masked exactly this failure mode.
+    //
+    // pythonDependencies is deliberately NOT included here — pip-audit's
+    // JSON output has no severity field at all (confirmed in testing,
+    // unlike npm audit which does), so treating every Python CVE as
+    // high-risk would fabricate a confidence level we don't actually have.
+    // These findings are still always shown in the report, just not used
+    // to gate CI.
+    return (report.secrets.length > 0 ||
+        hasCriticalOrHighDep ||
+        hasCriticalOrHighDataFlow ||
+        hasCriticalOrHighHygiene ||
+        Boolean(report.dataFlowScanFailed) ||
+        Boolean(report.dependenciesScanFailed) ||
+        Boolean(report.pythonDependenciesFailed));
+}
+export function printReport(report) {
+    if (report.secretsScanSkipped) {
+        console.log(chalk.dim("○ Secret scan skipped."));
+    }
+    else if (report.secrets.length === 0) {
+        console.log(chalk.green("✔ No exposed secrets found."));
+    }
+    else {
+        console.log(chalk.red(`✖ ${report.secrets.length} exposed secret(s) found:\n`));
+        for (const s of report.secrets) {
+            console.log(chalk.bold(`  ${s.file}:${s.line}`));
+            console.log(`  ${s.description}`);
+            console.log(chalk.dim("  Why it matters: this file is likely tracked by git — anyone with repo access (or anyone who forks a public repo) can read this credential directly.\n"));
+        }
+    }
+    console.log(chalk.dim("\nChecking dependencies for known vulnerabilities...\n"));
+    if (report.dependenciesScanFailed) {
+        console.log(chalk.red(`⚠ Dependency scan FAILED — this is not a clean result: ${report.dependenciesUnavailableReason}`));
+    }
+    else if (report.dependenciesScanSkipped) {
+        console.log(chalk.dim(report.dependenciesUnavailableReason
+            ? `○ Dependency scan skipped — ${report.dependenciesUnavailableReason}`
+            : "○ Dependency scan skipped."));
+    }
+    else if (report.dependencies.length === 0) {
+        console.log(chalk.green("✔ No known-vulnerable dependencies found."));
+    }
+    else {
+        console.log(chalk.red(`✖ ${report.dependencies.length} package(s) with known vulnerabilities:\n`));
+        for (const d of report.dependencies) {
+            const severityColor = d.severity === "critical" || d.severity === "high" ? chalk.red : chalk.yellow;
+            console.log(severityColor.bold(`  ${d.packageName} — ${d.severity.toUpperCase()}`) +
+                chalk.dim(d.isDirect ? "" : " (transitive dependency)"));
+            console.log(`  ${d.advisories[0].title}`);
+            if (d.advisories.length > 1) {
+                console.log(chalk.dim(`  + ${d.advisories.length - 1} more advisor${d.advisories.length - 1 === 1 ? "y" : "ies"} for this package`));
+            }
+            console.log(chalk.dim(`  Fix: ${d.fixAvailable ? d.fixAvailable : "no automatic fix published yet — check the advisory"}\n`));
+        }
+    }
+    if (report.pythonDependenciesApplicable) {
+        console.log(chalk.dim("\nChecking Python dependencies for known vulnerabilities (via pip-audit)...\n"));
+        if (report.pythonDependenciesFailed) {
+            console.log(chalk.red(`⚠ Python dependency scan FAILED — this is not a clean result: ${report.pythonDependenciesUnavailableReason}`));
+        }
+        else if (report.pythonDependenciesUnavailableReason) {
+            console.log(chalk.dim(`○ ${report.pythonDependenciesUnavailableReason}`));
+        }
+        else if (report.pythonDependencies.length === 0) {
+            console.log(chalk.green("✔ No known-vulnerable Python dependencies found."));
+        }
+        else {
+            console.log(chalk.yellow(`○ ${report.pythonDependencies.length} package(s) with known CVEs — pip-audit does not provide severity ratings, so these are listed unranked. Prioritize by whether a fix version exists:\n`));
+            for (const p of report.pythonDependencies) {
+                console.log(chalk.bold(`  ${p.packageName}@${p.installedVersion}`));
+                for (const advisory of p.advisories) {
+                    console.log(`    ${advisory.id}: ${advisory.description}`);
+                    console.log(chalk.dim(`    Fix: ${advisory.fixVersions.length > 0 ? `upgrade to ${advisory.fixVersions[advisory.fixVersions.length - 1]}` : "no fix published yet — check the advisory"}`));
+                }
+                console.log("");
+            }
+        }
+    }
+    console.log(chalk.dim("\nChecking for missing security middleware...\n"));
+    if (report.hygiene.length === 0) {
+        console.log(chalk.green("✔ No missing middleware patterns detected."));
+    }
+    else {
+        for (const h of report.hygiene) {
+            const label = hygieneSeverityLabel(h.severity);
+            console.log(`${label} ${chalk.bold(h.title)}`);
+            console.log(`  ${h.description}`);
+            if (h.verifyNote) {
+                console.log(chalk.dim(`  Verify: ${h.verifyNote}`));
+            }
+            console.log(chalk.dim(`  Suggested fix — ${h.fix.title}:`));
+            console.log(chalk.dim(h.fix.code.split("\n").map((l) => "    " + l).join("\n")));
+            console.log("");
+        }
+    }
+    console.log(chalk.dim("\nChecking personal data flow (via bearer)...\n"));
+    if (report.dataFlowScanFailed) {
+        console.log(chalk.red(`⚠ Data flow scan FAILED — this is not a clean result: ${report.dataFlowUnavailableReason}`));
+    }
+    else if (report.dataFlowScanSkipped) {
+        console.log(chalk.dim(report.dataFlowUnavailableReason
+            ? `○ Data flow scan skipped — ${report.dataFlowUnavailableReason}`
+            : "○ Data flow scan skipped."));
+    }
+    else if (report.dataFlow.length === 0) {
+        console.log(chalk.green("✔ No personal-data-flow risks found."));
+    }
+    else {
+        console.log(chalk.red(`✖ ${report.dataFlow.length} data-flow finding(s):\n`));
+        for (const d of report.dataFlow) {
+            const severityColor = d.severity === "critical" || d.severity === "high" ? chalk.red : chalk.yellow;
+            console.log(severityColor.bold(`  ${d.title} — ${d.severity.toUpperCase()}`));
+            console.log(`  ${d.file}:${d.line}`);
+            console.log(chalk.dim(`  ${d.description}\n`));
+        }
+    }
+}

package/dist/resolveTarget.js

@@ -0,0 +1,119 @@
+import { execa } from "execa";
+import { mkdtemp, rm, rename, cp, mkdir, writeFile, readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, basename, resolve } from "node:path";
+const URL_PATTERN = /^(https?:\/\/|git@|git:\/\/|file:\/\/)/i;
+/**
+ * Commander hands us `args` as whatever positional tokens the shell passed
+ * through. If someone runs `codevet scan D:\Some Folder\project` without
+ * quotes, PowerShell/cmd/bash all split that into 3 separate tokens before
+ * our program ever sees it — confirmed in real testing on Windows. We can't
+ * recover the original spacing with certainty, but rejoining with a single
+ * space is correct for the overwhelmingly common case (a real folder name
+ * with spaces) and far more useful than just erroring.
+ */
+export async function resolveTarget(args, cwd) {
+    const rejoinedFromSplitArgs = args.length > 1;
+    const raw = args.length === 0 ? "." : args.join(" ");
+    if (URL_PATTERN.test(raw)) {
+        const dir = await mkdtemp(join(tmpdir(), "codevet-clone-"));
+        await execa("git", ["clone", "--depth", "1", raw, dir]);
+        return {
+            path: dir,
+            cleanupDir: dir,
+            isUntrustedClone: true,
+            rejoinedFromSplitArgs: false,
+            sourceUrl: raw,
+        };
+    }
+    const path = raw === "." ? cwd : raw;
+    return { path, isUntrustedClone: false, rejoinedFromSplitArgs };
+}
+export async function cleanupTarget(target) {
+    if (target.cleanupDir) {
+        await rm(target.cleanupDir, { recursive: true, force: true }).catch(() => { });
+    }
+}
+function deriveRepoName(url) {
+    const cleaned = url.replace(/\.git$/, "").replace(/\/+$/, "");
+    const name = basename(cleaned) || "codevet-clone";
+    return name.replace(/[^a-zA-Z0-9._-]/g, "-");
+}
+/**
+ * Moves a cloned target from its temp directory to a permanent destination
+ * next to where the user ran the command. Only call this after the user
+ * has actually agreed to keep it (or the scan came back clean).
+ */
+export async function persistTarget(target, destinationParent) {
+    if (!target.cleanupDir || !target.sourceUrl) {
+        throw new Error("persistTarget called on a target that wasn't cloned from a URL");
+    }
+    let destination = join(destinationParent, deriveRepoName(target.sourceUrl));
+    let suffix = 2;
+    while (existsSync(destination)) {
+        destination = join(destinationParent, `${deriveRepoName(target.sourceUrl)}-${suffix}`);
+        suffix += 1;
+    }
+    await moveAcrossDevices(target.cleanupDir, destination);
+    await writeProvenanceMarker(destination, target.sourceUrl);
+    return destination;
+}
+function markerPath(dir) {
+    return join(dir, ".codevet", "clone-origin.json");
+}
+async function writeProvenanceMarker(dir, sourceUrl) {
+    const marker = { sourceUrl, clonedAt: new Date().toISOString() };
+    await mkdir(join(dir, ".codevet"), { recursive: true });
+    await writeFile(markerPath(dir), JSON.stringify(marker, null, 2));
+}
+/**
+ * Checks whether a folder was actually persisted by `codevet scan <url>`,
+ * so the `clean` command can refuse (or clearly warn) before deleting
+ * something it didn't create — instead of just trusting any path a user
+ * happens to type.
+ */
+export async function readProvenanceMarker(dir) {
+    try {
+        const raw = await readFile(markerPath(dir), "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Deletes a folder, but only ever a folder actually inside/under the
+ * current working directory tree or an absolute path the user explicitly
+ * gave — this is a thin, explicit wrapper so `clean` never silently
+ * resolves to something unexpected like the filesystem root.
+ */
+export async function removeFolder(targetPath) {
+    const resolved = resolve(targetPath);
+    if (resolved === resolve("/") || resolved === resolve(process.env.HOME ?? "/")) {
+        throw new Error(`Refusing to remove ${resolved} — this looks like a root or home directory, not a scanned clone.`);
+    }
+    await rm(resolved, { recursive: true, force: true });
+}
+/**
+ * fs.rename is fast (just a filesystem pointer update) but fails with
+ * EXDEV when source and destination are on different drives/filesystems —
+ * e.g. a Windows temp folder on C:\ being moved to a project on E:\.
+ * Confirmed with a real cross-filesystem mount in testing, matching a
+ * real user's exact error. Falls back to copy-then-delete, which works
+ * across any boundary at the cost of being slower for large repos.
+ */
+async function moveAcrossDevices(source, destination) {
+    try {
+        await rename(source, destination);
+    }
+    catch (err) {
+        if (err instanceof Error && "code" in err && err.code === "EXDEV") {
+            await cp(source, destination, { recursive: true });
+            await rm(source, { recursive: true, force: true });
+        }
+        else {
+            throw err;
+        }
+    }
+}