codevet-cli 1.1.0

package/dist/scanners/pipAuditScanner.js

@@ -0,0 +1,73 @@
+import { execa } from "execa";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+export class PipAuditScanFailedError extends Error {
+    constructor(reason) {
+        super(`pip-audit did not actually run: ${reason}. This is being reported as a failure rather than "no vulnerabilities" — a scan that never ran is not the same as a clean result.`);
+        this.name = "PipAuditScanFailedError";
+    }
+}
+export class PipAuditNotInstalledError extends Error {
+    constructor() {
+        super("pip-audit isn't installed on this machine, so the Python dependency check couldn't run. Install it with 'pip install pip-audit' — secrets, hygiene, and other checks are unaffected.");
+        this.name = "PipAuditNotInstalledError";
+    }
+}
+function findRequirementsFile(projectRoot) {
+    for (const name of ["requirements.txt", "pyproject.toml"]) {
+        const path = join(projectRoot, name);
+        if (existsSync(path))
+            return path;
+    }
+    return null;
+}
+/**
+ * Runs real pip-audit against requirements.txt or pyproject.toml, checking
+ * PyPA's published advisory database (known, disclosed CVEs) — same
+ * "known issues only, not a malware/zero-day scanner" honesty as the npm
+ * audit wrapper. Returns [] (not an error) if no Python project is
+ * detected — that's a real "nothing to check" case, not a failure.
+ */
+export async function runPipAuditScan(projectRoot) {
+    const reqFile = findRequirementsFile(projectRoot);
+    if (!reqFile)
+        return [];
+    const isRequirementsTxt = reqFile.endsWith("requirements.txt");
+    const args = isRequirementsTxt
+        ? ["-r", reqFile, "-f", "json"]
+        : [projectRoot, "-f", "json"]; // pyproject.toml: pip-audit reads the project dir directly
+    const result = await execa("pip-audit", args, { cwd: projectRoot, reject: false });
+    if (result.failed && result.exitCode === undefined) {
+        // execa couldn't even spawn the process — pip-audit isn't installed.
+        throw new PipAuditNotInstalledError();
+    }
+    let report;
+    try {
+        report = JSON.parse(result.stdout);
+    }
+    catch {
+        // Confirmed in testing: a genuine pip-audit failure (e.g. an
+        // unresolvable requirement) produces NO valid JSON on stdout and
+        // writes errors to stderr instead — unlike npm audit, there's no
+        // ambiguous "valid JSON shaped like an error" case here, so any
+        // parse failure means the scan genuinely didn't complete.
+        throw new PipAuditScanFailedError(result.stderr.split("\n").find((l) => l.trim().length > 0) || "no readable output produced");
+    }
+    if (!report.dependencies)
+        return [];
+    const findings = [];
+    for (const dep of report.dependencies) {
+        if (dep.vulns.length === 0)
+            continue;
+        findings.push({
+            packageName: dep.name,
+            installedVersion: dep.version,
+            advisories: dep.vulns.map((v) => ({
+                id: v.id,
+                description: v.description.split("\n")[0].slice(0, 200),
+                fixVersions: v.fix_versions,
+            })),
+        });
+    }
+    return findings;
+}

package/dist/scanners/pythonAuditScanner.js

@@ -0,0 +1,66 @@
+import { execa } from "execa";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+export class PipAuditNotAvailableError extends Error {
+    constructor() {
+        super("pip-audit isn't installed, so Python dependency scanning is unavailable for this project. Install it with 'pip install pip-audit' and re-run — secrets and hygiene checks are unaffected.");
+        this.name = "PipAuditNotAvailableError";
+    }
+}
+/**
+ * pip-audit can be invoked directly (if on PATH) or via `python3 -m
+ * pip_audit` / `python -m pip_audit` (more portable — works whenever the
+ * package is pip-installed regardless of PATH setup, especially common
+ * on Windows). Tries each in order, returns null if none work.
+ */
+async function findPipAuditInvocation() {
+    const candidates = [["pip-audit"], ["python3", "-m", "pip_audit"], ["python", "-m", "pip_audit"]];
+    for (const candidate of candidates) {
+        const [cmd, ...args] = candidate;
+        const check = await execa(cmd, [...args, "--version"], { reject: false }).catch(() => null);
+        if (check?.exitCode === 0)
+            return candidate;
+    }
+    return null;
+}
+/**
+ * Only requirements.txt is supported for now — pip-audit's pyproject.toml
+ * support requires resolving against an actual environment/lockfile,
+ * which is a meaningfully different (and heavier) integration than the
+ * requirements.txt case. Documented as a known gap rather than attempted
+ * partially and silently missing edge cases.
+ */
+export async function runPythonAuditScan(projectRoot) {
+    const requirementsPath = join(projectRoot, "requirements.txt");
+    if (!existsSync(requirementsPath))
+        return [];
+    const invocation = await findPipAuditInvocation();
+    if (!invocation) {
+        throw new PipAuditNotAvailableError();
+    }
+    const [cmd, ...baseArgs] = invocation;
+    const result = await execa(cmd, [...baseArgs, "-r", requirementsPath, "--format", "json", "--progress-spinner", "off"], { reject: false });
+    // pip-audit exits non-zero both when vulnerabilities are found AND on a
+    // genuine internal failure — distinguish by whether stdout is valid
+    // JSON, same pattern as the bearer scan-failure fix.
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error(`pip-audit did not produce a valid report: ${result.stderr || result.stdout || "no output"}`);
+    }
+    const findings = [];
+    for (const dep of parsed.dependencies ?? []) {
+        for (const vuln of dep.vulns ?? []) {
+            findings.push({
+                packageName: dep.name,
+                version: dep.version,
+                vulnerabilityId: vuln.id,
+                fixVersions: vuln.fix_versions,
+                description: vuln.description.split("\n")[0].slice(0, 200),
+            });
+        }
+    }
+    return findings;
+}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "codevet-cli",
+  "version": "1.1.0",
+  "description": "Vet your code before it ships \u2014 a free, open-source security co-pilot that checks for leaked secrets, vulnerable dependencies, missing security middleware, and personal data flow, with real working fixes shown inline.",
+  "scripts": {
+    "build": "tsc",
+    "postinstall": "node scripts/postinstall.mjs",
+    "dev": "tsx src/index.ts",
+    "test": "npm run build && node scripts/runTests.mjs",
+    "generate-templates": "node scripts/generateTemplates.mjs"
+  },
+  "keywords": [
+    "security",
+    "security-scanner",
+    "secrets",
+    "vulnerability-scanner",
+    "sast",
+    "gitleaks",
+    "dependency-audit",
+    "cli",
+    "devsecops"
+  ],
+  "author": "Anurag Aryan",
+  "license": "MIT",
+  "dependencies": {
+    "chalk": "^6.0.0",
+    "commander": "^15.0.0",
+    "execa": "^9.6.1",
+    "fast-glob": "^3.3.3"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "tsx": "^4.23.12",
+    "typescript": "^7.0.2"
+  },
+  "type": "module",
+  "bin": {
+    "codevet": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    ".gitleaks.toml",
+    "scripts"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/i-akb25/codevet.git"
+  },
+  "homepage": "https://github.com/i-akb25/codevet#readme",
+  "bugs": {
+    "url": "https://github.com/i-akb25/codevet/issues"
+  },
+  "engines": {
+    "node": "^18.19.0 || >=20.5.0"
+  },
+  "main": "dist/index.js"
+}

package/scripts/generateTemplates.mjs

@@ -0,0 +1,48 @@
+// Regenerates the human-browsable templates/ folder from
+// src/fixLibrary/templates.ts — the single source of truth. Run via
+// `npm run generate-templates`. Never hand-edit files under templates/
+// directly; edit templates.ts and regenerate.
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  HELMET_CONFIG,
+  CORS_CONFIG,
+  RATE_LIMITER,
+  ACCOUNT_BACKOFF,
+  ERROR_HANDLER,
+  HASH_PASSWORD,
+  JWT_TOKEN,
+  VALIDATION_SCHEMA,
+  ENV_EXAMPLE,
+  SECURITY_CHECK_WORKFLOW,
+  PRE_COMMIT_HOOK,
+  FILE_UPLOAD,
+  RLS_ENABLE,
+} from "../dist/fixLibrary/templates.js";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = join(__dirname, "..", "templates");
+
+const FILES = [
+  ["security/helmet.config.js", HELMET_CONFIG],
+  ["security/cors.config.js", CORS_CONFIG],
+  ["security/rateLimiter.middleware.js", RATE_LIMITER],
+  ["security/accountBackoff.js", ACCOUNT_BACKOFF],
+  ["security/errorHandler.middleware.js", ERROR_HANDLER],
+  ["security/auth/hashPassword.js", HASH_PASSWORD],
+  ["security/auth/generateToken.js", JWT_TOKEN],
+  ["security/validation/authSchemas.js", VALIDATION_SCHEMA],
+  [".env.example", ENV_EXAMPLE],
+  [".github/workflows/security-check.yml", SECURITY_CHECK_WORKFLOW],
+  [".husky/pre-commit", PRE_COMMIT_HOOK],
+  ["security/fileUpload.middleware.js", FILE_UPLOAD],
+  ["enable-rls.sql", RLS_ENABLE],
+];
+
+for (const [relativePath, content] of FILES) {
+  const fullPath = join(ROOT, relativePath);
+  await mkdir(dirname(fullPath), { recursive: true });
+  await writeFile(fullPath, content);
+  console.log(`wrote templates/${relativePath}`);
+}

package/scripts/postPrComment.mjs

@@ -0,0 +1,113 @@
+// Runs inside GitHub Actions after `codevet scan --json`. Formats the
+// report as a Markdown comment and posts it to the PR via the GitHub REST
+// API using fetch() — no @actions/github or @actions/core dependency,
+// since this only needs one API call and pulling in the full toolkit
+// isn't justified for that (matches the "every dependency must justify
+// itself" rule).
+//
+// Required env vars (all provided automatically inside a GitHub Actions
+// PR-triggered workflow, except CODEVET_REPORT_PATH which the workflow sets):
+//   GITHUB_TOKEN          - auto-provided by Actions
+//   GITHUB_REPOSITORY     - "owner/repo", auto-provided
+//   GITHUB_EVENT_PATH     - path to the event payload JSON, auto-provided
+//   CODEVET_REPORT_PATH   - path to the JSON report written by `codevet scan --json`
+
+import { readFile } from "node:fs/promises";
+
+function severityEmoji(severity) {
+  if (severity === "critical" || severity === "high") return "🔴";
+  if (severity === "moderate") return "🟠";
+  return "🟡";
+}
+
+function formatComment(report) {
+  const lines = ["## CodeVet security scan", ""];
+
+  if (report.secrets.length === 0 && report.dependencies.length === 0 && report.hygiene.length === 0) {
+    lines.push("✔ No issues found by CodeVet's current checks.");
+    return lines.join("\n");
+  }
+
+  if (report.secrets.length > 0) {
+    lines.push(`### 🔴 ${report.secrets.length} exposed secret(s)`, "");
+    for (const s of report.secrets) {
+      lines.push(`- **${s.file}:${s.line}** — ${s.description}`);
+    }
+    lines.push("");
+  }
+
+  if (report.dependencies.length > 0) {
+    lines.push(`### Dependency vulnerabilities`, "");
+    for (const d of report.dependencies) {
+      lines.push(
+        `- ${severityEmoji(d.severity)} **${d.packageName}** (${d.severity}${d.isDirect ? "" : ", transitive"}) — ${d.advisories[0].title}`,
+      );
+    }
+    lines.push("");
+  }
+
+  if (report.hygiene.length > 0) {
+    lines.push(`### Missing security middleware`, "");
+    for (const h of report.hygiene) {
+      const marker = h.confidence === "high" ? "🔴" : "🟡 (advisory)";
+      lines.push(`- ${marker} **${h.title}** — ${h.description}`);
+    }
+    lines.push("");
+  }
+
+  lines.push(
+    "---",
+    "_Run `npx codevet scan` locally for full details and suggested fix code. This comment is generated automatically on every push to this PR — see [CodeVet](https://github.com/codevet/codevet)._",
+  );
+
+  return lines.join("\n");
+}
+
+async function main() {
+  const token = process.env.GITHUB_TOKEN;
+  const repo = process.env.GITHUB_REPOSITORY;
+  const eventPath = process.env.GITHUB_EVENT_PATH;
+  const reportPath = process.env.CODEVET_REPORT_PATH;
+
+  if (!token || !repo || !eventPath || !reportPath) {
+    console.error(
+      "[codevet-pr-comment] Missing required env var(s) — this script is meant to run inside a GitHub Actions PR workflow.",
+    );
+    process.exit(1);
+  }
+
+  const event = JSON.parse(await readFile(eventPath, "utf-8"));
+  const prNumber = event.pull_request?.number ?? event.number;
+  if (!prNumber) {
+    console.log("[codevet-pr-comment] Not a pull request event — skipping comment.");
+    return;
+  }
+
+  const report = JSON.parse(await readFile(reportPath, "utf-8"));
+  const body = formatComment(report);
+
+  const response = await fetch(
+    `https://api.github.com/repos/${repo}/issues/${prNumber}/comments`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ body }),
+    },
+  );
+
+  if (!response.ok) {
+    console.error(`[codevet-pr-comment] Failed to post comment: ${response.status} ${await response.text()}`);
+    process.exit(1);
+  }
+
+  console.log("[codevet-pr-comment] Comment posted successfully.");
+}
+
+main().catch((err) => {
+  console.error("[codevet-pr-comment] Error:", err);
+  process.exit(1);
+});

package/scripts/postinstall.mjs

@@ -0,0 +1,20 @@
+// Best-effort eager download at install time — NOT the only safety net
+// anymore. Each scanner now calls ensureBinary() itself at runtime and
+// self-heals if this never ran or was blocked (confirmed real: npm's
+// "allowScripts" feature silently blocks this exact script by default on
+// many machines). This means postinstall failing, being skipped, or
+// simply not existing yet (e.g. a contributor's fresh clone before their
+// first `npm run build`) is no longer a hard failure for the tool overall.
+try {
+  const { ensureBinary } = await import("../dist/scanners/ensureBinary.js");
+  await ensureBinary("gitleaks");
+  await ensureBinary("bearer");
+} catch (err) {
+  // dist/ may not exist yet (fresh clone, pre-build) or the download may
+  // have failed/been blocked — either way, this is fine. The real
+  // guarantee now lives in ensureBinary() being called again at the
+  // moment a scan actually needs the binary.
+  console.log(
+    "[codevet] Skipped eager binary download at install time (this is fine — binaries download automatically on first use instead).",
+  );
+}

package/scripts/runTests.mjs

@@ -0,0 +1,39 @@
+// Runs the test suite by explicitly enumerating *.test.ts files via
+// Node's fs module, then passing that explicit file list to `node --test`.
+//
+// Why this exists: `node --test tests/*.test.ts` relies on the SHELL to
+// expand the glob before node ever sees it. bash does this automatically
+// (confirmed working in CI on ubuntu/macos), but PowerShell/cmd.exe do
+// NOT expand globs for arguments passed to a child process — Windows CI
+// failed with "Could not find 'tests/*.test.ts'" because node received
+// the literal, unexpanded string. Node's own --test directory-scanning
+// was tried as an alternative and confirmed NOT to reliably discover
+// .test.ts files under the tsx loader either (found 1 instead of the
+// real 17 test cases). Enumerating via fs.readdirSync sidesteps both
+// problems — it's just JavaScript, identical behavior on every OS.
+import { readdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const testsDir = join(__dirname, "..", "tests");
+
+const testFiles = readdirSync(testsDir)
+  .filter((f) => f.endsWith(".test.ts"))
+  .map((f) => join(testsDir, f));
+
+if (testFiles.length === 0) {
+  console.error("[codevet] no *.test.ts files found in tests/ — something is wrong.");
+  process.exit(1);
+}
+
+const child = spawn(
+  process.execPath,
+  ["--import", "tsx", "--test", ...testFiles],
+  { stdio: "inherit" },
+);
+
+child.on("exit", (code) => {
+  process.exit(code ?? 1);
+});