coverme-scanner 1.0.0

package/src/cli/init.ts

@@ -0,0 +1,611 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+
+interface InitOptions {
+  global?: boolean;
+}
+
+const SLASH_COMMAND = `# CoverMe - Ultimate AI Security Scanner
+
+The most comprehensive AI-powered code scanner. 10 specialized agents + 3 validators + deep analysis.
+
+$ARGUMENTS
+
+## IMPORTANT: Execute ALL phases automatically. Do NOT stop until the HTML report is open.
+
+---
+
+## Phase 1: Discovery (10 parallel agents)
+
+Launch ALL 10 agents IN PARALLEL using the Task tool with subagent_type="Explore":
+
+### Agent 1: Security Scanner (Core)
+\`\`\`
+Scan for OWASP Top 10 and common vulnerabilities:
+
+INJECTION:
+- SQL injection (string concatenation in queries, raw queries)
+- NoSQL injection (MongoDB $where, $regex with user input)
+- Command injection (exec, spawn, system with user input)
+- LDAP injection, XPath injection
+- Template injection (SSTI in Jinja2, EJS, Handlebars)
+- Header injection (CRLF in headers)
+- Log injection (unescaped user input in logs)
+
+XSS:
+- Reflected XSS (user input in response without encoding)
+- Stored XSS (database content rendered without escaping)
+- DOM XSS (innerHTML, document.write, eval with user data)
+- dangerouslySetInnerHTML in React without sanitization
+
+AUTHENTICATION:
+- Hardcoded credentials (check git ls-files first!)
+- Weak password policies (no complexity, short length)
+- Missing rate limiting on login/register
+- Session fixation (session ID not rotated after login)
+- JWT issues (none algorithm, weak secret, no expiry)
+- Missing MFA on sensitive operations
+
+AUTHORIZATION:
+- IDOR (direct object references without ownership check)
+- Missing authorization checks on endpoints
+- Privilege escalation paths
+- Horizontal access (user A accessing user B's data)
+- Vertical access (user accessing admin functions)
+
+CRYPTOGRAPHY:
+- MD5/SHA1 for passwords (use bcrypt/argon2)
+- Math.random() for security (use crypto.randomBytes)
+- Hardcoded encryption keys/IVs
+- ECB mode usage
+- Missing HTTPS enforcement
+
+Output JSON: [{id: "SEC-XXX", title, severity, category: "security", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 2: Auth & Session Scanner
+\`\`\`
+Deep dive into authentication and session management:
+
+SSO/OAUTH:
+- Open redirect in return_url/redirect_uri (CRITICAL!)
+- State parameter missing or predictable
+- PKCE not implemented for public clients
+- Token stored in localStorage (XSS vulnerable)
+- Refresh token rotation missing
+- ID token validation incomplete
+
+SESSION:
+- Session ID in URL
+- Session not invalidated on logout
+- Session timeout too long (>24h)
+- Same session across devices without tracking
+- Session data not encrypted
+
+COOKIES:
+- Missing Secure flag
+- Missing HttpOnly flag
+- Missing SameSite attribute
+- Overly broad domain/path
+- Sensitive data in cookies
+
+PASSWORD RESET:
+- Predictable reset tokens
+- Token not expiring
+- No rate limiting on reset requests
+- User enumeration via reset flow
+- Reset link not single-use
+
+Output JSON: [{id: "AUTH-XXX", title, severity, category: "security", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 3: API Security Scanner
+\`\`\`
+Scan API endpoints for security issues:
+
+INPUT VALIDATION:
+- Missing input validation on request body
+- Type coercion attacks (string vs number)
+- Array/object pollution
+- Prototype pollution
+- Mass assignment vulnerabilities
+- GraphQL introspection enabled in production
+- GraphQL depth/complexity limits missing
+
+RATE LIMITING:
+- No rate limiting on expensive operations
+- Rate limit bypass via headers (X-Forwarded-For)
+- Missing rate limiting on auth endpoints
+- No account lockout after failed attempts
+
+API DESIGN:
+- Verbose error messages leaking internals
+- Stack traces in production
+- Version information exposed
+- Debug endpoints accessible
+- CORS misconfiguration (wildcard origin with credentials)
+- Missing security headers (CSP, HSTS, X-Frame-Options)
+
+WEBHOOKS:
+- Webhook signature not verified
+- SSRF via webhook URLs
+- No webhook replay protection
+- Webhook secrets logged
+
+Output JSON: [{id: "API-XXX", title, severity, category: "security", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 4: Infrastructure Scanner
+\`\`\`
+Scan infrastructure and deployment configs:
+
+DOCKER:
+- Running as root user
+- Secrets in Dockerfile or build args
+- Latest tag usage (unpinned versions)
+- Sensitive ports exposed
+- Missing health checks
+- No resource limits
+- Privileged mode enabled
+- Writable root filesystem
+
+KUBERNETES/HELM:
+- No resource limits/requests
+- Running as root
+- Privileged containers
+- Host network/PID enabled
+- Missing network policies
+- Secrets not encrypted at rest
+- No pod security policies/standards
+- Service account auto-mount enabled
+
+CI/CD:
+- Secrets in CI config files
+- Credentials in environment variables logged
+- Missing secret scanning in pipeline
+- Deploy keys with write access
+- No branch protection
+- Missing SAST/DAST in pipeline
+
+CLOUD:
+- S3 buckets public or misconfigured
+- IAM roles too permissive
+- Security groups too open
+- Logging not enabled
+- Encryption at rest disabled
+
+Output JSON: [{id: "INFRA-XXX", title, severity, category: "infrastructure", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 5: Data & Privacy Scanner
+\`\`\`
+Scan for data protection and privacy issues:
+
+PII HANDLING:
+- PII logged (emails, names, IPs, phone numbers)
+- PII in URLs/query strings
+- PII in error messages
+- PII not encrypted at rest
+- PII not masked in UI/logs
+
+GDPR/PRIVACY:
+- Missing data retention policy implementation
+- No data deletion mechanism (right to erasure)
+- No data export mechanism (data portability)
+- Consent not tracked properly
+- Third-party data sharing without consent
+- Cross-border data transfer issues
+
+DATABASE:
+- Sensitive data not encrypted (column-level)
+- No audit logging for sensitive operations
+- Backup not encrypted
+- Connection strings with credentials in code
+
+SECRETS:
+- API keys in code (check git ls-files!)
+- Secrets in environment files committed
+- Secrets logged
+- Secrets in client-side code
+- Hardcoded tokens/passwords
+- .env files not in .gitignore
+
+Output JSON: [{id: "DATA-XXX", title, severity, category: "privacy", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 6: AI/LLM Security Scanner
+\`\`\`
+Scan for AI/LLM specific vulnerabilities:
+
+PROMPT INJECTION:
+- User input directly in prompts without sanitization
+- System prompts exposed to users
+- Prompt leakage via error messages
+- No input length limits on prompts
+- Missing output validation from LLM
+- Jailbreak vulnerabilities
+
+DATA LEAKAGE:
+- Training data in responses
+- PII in AI context
+- Conversation history not cleared
+- AI accessing unauthorized data
+- Model output not sanitized
+
+SUPPLY CHAIN:
+- CDN imports without Subresource Integrity (SRI)
+- Unpinned AI model versions
+- External AI APIs without TLS verification
+- Model files from untrusted sources
+
+RESOURCE:
+- No token limits on AI calls
+- Missing rate limiting on AI endpoints
+- Cost explosion attacks (large inputs)
+- Denial of service via AI
+
+BUSINESS LOGIC:
+- AI bypassing business rules
+- AI making unauthorized decisions
+- Content filter bypasses
+- AI output directly executed (code injection)
+
+Output JSON: [{id: "AI-XXX", title, severity, category: "ai-security", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 7: Performance & DoS Scanner
+\`\`\`
+Scan for performance issues and DoS vectors:
+
+DATABASE:
+- N+1 query patterns
+- Missing indexes on filtered/sorted columns
+- Full table scans
+- Unbounded queries (no LIMIT)
+- Connection pool exhaustion
+- Long-running transactions
+
+MEMORY:
+- Memory leaks (event listeners not removed)
+- Unbounded caches
+- Large object accumulation
+- Buffer handling issues
+- Stream not properly closed
+- SSE/WebSocket buffer accumulation
+
+CPU:
+- ReDoS (Regular Expression DoS)
+- Algorithmic complexity attacks
+- Synchronous crypto operations
+- JSON parsing of large payloads
+- XML parsing without limits (billion laughs)
+
+NETWORK:
+- No timeout on external calls
+- Missing circuit breakers
+- Retry storms
+- No backpressure handling
+- Connection leaks
+
+RESOURCE EXHAUSTION:
+- File upload without size limits
+- Zip bomb potential
+- Unbounded pagination
+- Missing request size limits
+- Too many concurrent connections
+
+Output JSON: [{id: "PERF-XXX", title, severity, category: "performance", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 8: Business Logic Scanner
+\`\`\`
+Scan for business logic vulnerabilities:
+
+RACE CONDITIONS:
+- TOCTOU (time-of-check-time-of-use)
+- Double-spend in transactions
+- Inventory overselling
+- Concurrent booking conflicts
+- Non-atomic read-modify-write
+
+WORKFLOW:
+- Step skipping in multi-step processes
+- State manipulation attacks
+- Order of operations bypass
+- Workflow replay attacks
+
+FINANCIAL:
+- Rounding errors in calculations
+- Currency handling issues
+- Negative amount bypass
+- Discount stacking exploits
+- Price manipulation
+
+ACCESS CONTROL:
+- Role hierarchy bypass
+- Feature flag manipulation
+- Subscription level bypass
+- Time-based access bypass
+
+DATA INTEGRITY:
+- Missing referential integrity
+- Orphaned records possible
+- Data inconsistency between services
+- Missing transaction boundaries
+
+Output JSON: [{id: "BIZ-XXX", title, severity, category: "business-logic", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 9: Code Quality Scanner
+\`\`\`
+Scan for code quality and maintainability issues:
+
+COMPLEXITY:
+- Cyclomatic complexity > 10
+- Functions > 50 lines
+- Files > 500 lines
+- Deep nesting (> 4 levels)
+- Too many parameters (> 5)
+
+DRY VIOLATIONS:
+- Duplicated code blocks (> 10 lines)
+- Copy-paste code with minor changes
+- Similar functions that should be unified
+
+ANTI-PATTERNS:
+- God objects/classes
+- Callback hell
+- Magic numbers/strings
+- Dead code
+- Unused imports/variables
+- Any type overuse (TypeScript)
+- Console.log in production
+- TODO/FIXME comments in production
+
+ERROR HANDLING:
+- Empty catch blocks
+- Generic error swallowing
+- Missing error boundaries (React)
+- Unhandled promise rejections
+- Missing finally blocks for cleanup
+
+NAMING:
+- Inconsistent naming conventions
+- Misleading names
+- Single letter variables (except i,j,k)
+- Abbreviations without context
+
+Output JSON: [{id: "QUAL-XXX", title, severity, category: "quality", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+### Agent 10: Testing & Reliability Scanner
+\`\`\`
+Scan for testing gaps and reliability issues:
+
+TEST COVERAGE:
+- Critical paths without tests (auth, payments, data access)
+- Error handlers not tested
+- Edge cases not covered
+- No integration tests
+- No E2E tests for main flows
+
+TEST QUALITY:
+- Tests without assertions
+- Mocked security checks (dangerous!)
+- Flaky tests (time-dependent)
+- Tests with hardcoded data that can expire
+- Missing negative tests (what should fail)
+
+RELIABILITY:
+- Missing health checks
+- No graceful shutdown
+- Missing readiness/liveness probes
+- No circuit breakers for external calls
+- Missing retry logic with backoff
+- No fallback mechanisms
+
+OBSERVABILITY:
+- Missing structured logging
+- No correlation IDs
+- Missing metrics collection
+- No distributed tracing
+- Errors not properly categorized
+
+DEPLOYMENT:
+- No feature flags for risky changes
+- Missing rollback mechanism
+- No canary/blue-green deployment
+- Database migrations not reversible
+
+Output JSON: [{id: "TEST-XXX", title, severity, category: "testing", file, line, code, description, recommendation, confidence}]
+\`\`\`
+
+---
+
+## Phase 2: Cross-Validation (3 parallel validators)
+
+After ALL Phase 1 agents complete, launch 3 validators IN PARALLEL:
+
+### Validator A: False Positive Hunter
+\`\`\`
+Review ALL findings from Phase 1. For each finding:
+1. Read the actual code file
+2. Check if there are mitigating controls elsewhere
+3. For secrets: run "git ls-files <file>" - if not tracked, mark FALSE POSITIVE
+4. Check if code is actually reachable in production
+5. Verify the context (is it test code? example code? disabled feature?)
+
+Output: { confirmed: ["SEC-001",...], falsePositives: [{id, reason},...] }
+\`\`\`
+
+### Validator B: Evidence Challenger
+\`\`\`
+Challenge every HIGH and CRITICAL finding:
+1. Read the actual code with 20 lines of context
+2. Trace data flow from source to sink
+3. Check for sanitization/validation in between
+4. Verify the exploit scenario is realistic
+5. Consider the deployment environment
+6. Check if it's actually exploitable in production
+
+Output: { confirmed: ["SEC-001",...], falsePositives: [{id, reason},...] }
+\`\`\`
+
+### Validator C: Missing Issues Hunter
+\`\`\`
+Look for issues that Phase 1 agents MISSED:
+- Race conditions in critical operations
+- Business logic flaws specific to this application
+- Edge cases (empty input, null, undefined, max length)
+- Integration point vulnerabilities
+- Configuration issues for specific environment
+- Combination attacks (multiple low issues = high)
+
+Output: { missedIssues: [{id, title, severity, file, line, description, recommendation},...] }
+\`\`\`
+
+---
+
+## Phase 3: Build Consensus
+
+Combine all results:
+1. Calculate confidence: (confirmations / validators) * 100
+2. Remove findings with confidence < 50%
+3. Add missed issues from Validator C
+4. Identify positive observations (good patterns found)
+
+---
+
+## Phase 4: Generate Report
+
+Create a JSON file named \`coverme-scan.json\` with this EXACT structure:
+
+\`\`\`json
+{
+  "projectName": "<name from package.json or folder name>",
+  "scanDate": "<today's date formatted nicely>",
+  "findings": [
+    {
+      "id": "SEC-001",
+      "title": "Issue title",
+      "severity": "critical|high|medium|low|info",
+      "category": "security|auth|api|infrastructure|privacy|ai-security|performance|business-logic|quality|testing",
+      "file": "path/to/file.ts",
+      "line": 123,
+      "description": "Clear description of the issue",
+      "code": "the problematic code snippet (include 5+ lines of context)",
+      "recommendation": "Specific fix with code example if possible",
+      "confidence": 95,
+      "cwe": "CWE-XXX if applicable"
+    }
+  ],
+  "falsePositives": [
+    {
+      "id": "SEC-002",
+      "title": "What was originally flagged",
+      "file": "path/to/file.ts",
+      "reason": "Why it was rejected"
+    }
+  ],
+  "positiveObservations": [
+    "Uses parameterized queries for all database access",
+    "Implements proper rate limiting on authentication endpoints",
+    "PKCE implemented for OAuth flow",
+    "Proper secret management with environment variables",
+    "Comprehensive error handling with proper logging",
+    "Input validation using Zod/Joi schemas"
+  ],
+  "scanDuration": 300000,
+  "agentCount": 13
+}
+\`\`\`
+
+Use the Write tool to save this JSON to \`coverme-scan.json\`.
+
+---
+
+## Phase 5: Generate HTML Report
+
+1. Create the .coverme directory and save the JSON:
+\`\`\`bash
+mkdir -p .coverme
+\`\`\`
+
+2. Use the Write tool to save the JSON to \`coverme-scan.json\`
+
+3. Generate the HTML report and open it:
+\`\`\`bash
+TIMESTAMP=$(date +%Y-%m-%d_%H-%M-%S)
+npx coverme report coverme-scan.json -f html -o ".coverme/report_$TIMESTAMP.html"
+mv coverme-scan.json ".coverme/scan_$TIMESTAMP.json"
+open ".coverme/report_$TIMESTAMP.html"
+\`\`\`
+
+---
+
+## DONE
+
+Tell the user: "Scan complete! Report saved to .coverme/ and opened in browser. Found X issues across Y categories. All scan history is in .coverme/ folder."
+`;
+
+export async function init(options: InitOptions): Promise<void> {
+  const targetDir = options.global
+    ? path.join(os.homedir(), '.claude', 'commands')
+    : path.join(process.cwd(), '.claude', 'commands');
+
+  console.log(`Installing vibecode commands to: ${targetDir}`);
+
+  // Create directory if needed
+  if (!fs.existsSync(targetDir)) {
+    fs.mkdirSync(targetDir, { recursive: true });
+    console.log(`Created directory: ${targetDir}`);
+  }
+
+  // Write the slash command
+  const commandPath = path.join(targetDir, 'coverme.md');
+  fs.writeFileSync(commandPath, SLASH_COMMAND);
+  console.log(`Created: ${commandPath}`);
+
+  // Create .coverme directory for reports
+  const covermeDir = path.join(process.cwd(), '.coverme');
+  if (!fs.existsSync(covermeDir)) {
+    fs.mkdirSync(covermeDir, { recursive: true });
+    console.log(`Created: ${covermeDir}/`);
+  }
+
+  // Add .coverme to .gitignore if not already there
+  const gitignorePath = path.join(process.cwd(), '.gitignore');
+  const covermeIgnore = '\n# CoverMe scan reports\n.coverme/\n';
+
+  if (fs.existsSync(gitignorePath)) {
+    const gitignoreContent = fs.readFileSync(gitignorePath, 'utf-8');
+    if (!gitignoreContent.includes('.coverme')) {
+      fs.appendFileSync(gitignorePath, covermeIgnore);
+      console.log(`Added .coverme/ to .gitignore`);
+    }
+  } else {
+    fs.writeFileSync(gitignorePath, covermeIgnore.trim() + '\n');
+    console.log(`Created .gitignore with .coverme/`);
+  }
+
+  console.log(`
+================================================================================
+                           COVERME INSTALLED
+================================================================================
+
+Usage:
+  1. Open Claude Code in your project
+  2. Type /coverme and press Enter
+  3. Wait for the scan to complete
+  4. Report opens automatically in your browser
+
+Reports saved to: .coverme/
+  - report_YYYY-MM-DD_HH-MM-SS.html
+  - scan_YYYY-MM-DD_HH-MM-SS.json
+
+The .coverme/ folder is automatically added to .gitignore
+
+================================================================================
+`);
+}