easyvibegate 0.4.4

package/dist/engine/report.js

@@ -0,0 +1,219 @@
+import { SEVERITY_ORDER } from './types.js';
+import { color } from './util/color.js';
+import { t } from './i18n.js';
+import { VERSION } from './version.js';
+const WEIGHTS = { critical: 25, warning: 8, info: 2, advisory: 0 };
+const EMOJI = { critical: '🔴', warning: '🟡', info: '🔵', advisory: '⚪' };
+export function coverage(runs) {
+    const c = { completed: 0, partial: 0, failed: 0, skipped: 0, unsupported: 0 };
+    for (const r of runs)
+        c[r.status]++;
+    return {
+        ...c,
+        total: runs.length,
+        incomplete: c.failed > 0 || c.partial > 0 || c.unsupported > 0,
+        nothingVerified: c.completed + c.partial === 0,
+    };
+}
+export function summarize(findings, runs = []) {
+    const counts = { critical: 0, warning: 0, info: 0, advisory: 0 };
+    let score = 100;
+    for (const f of findings) {
+        counts[f.severity]++;
+        score -= WEIGHTS[f.severity];
+    }
+    const cov = coverage(runs);
+    const gate = counts.critical > 0 ? 'fail'
+        : cov.incomplete || cov.nothingVerified ? 'incomplete'
+            : counts.warning > 0 ? 'warn'
+                : 'pass';
+    return { score: Math.max(0, score), gate, counts, coverage: cov };
+}
+/** CI exit code from the same policy: 2 critical, 1 warning, 3 incomplete, 0 clean. */
+export function exitCodeFor(summary) {
+    switch (summary.gate) {
+        case 'fail': return 2;
+        case 'incomplete': return 3;
+        case 'warn': return 1;
+        default: return 0;
+    }
+}
+export function whereOf(f) {
+    if (f.endpoint)
+        return f.endpoint;
+    if (f.file && f.line)
+        return `${f.file}:${f.line}`;
+    if (f.file)
+        return f.file;
+    return '—';
+}
+export function sortFindings(findings) {
+    const rank = (s) => SEVERITY_ORDER.indexOf(s);
+    return [...findings].sort((a, b) => rank(a.severity) - rank(b.severity) ||
+        (a.file ?? '').localeCompare(b.file ?? '') ||
+        (a.line ?? 0) - (b.line ?? 0));
+}
+/** Badge reflects the gate, never a bare score: an incomplete run is never green. */
+export function badgeMarkdown(summary) {
+    if (summary.gate === 'fail')
+        return `![EasyVibeGate](https://img.shields.io/badge/EasyVibeGate-${summary.score}%2F100-red)`;
+    if (summary.gate === 'incomplete')
+        return '![EasyVibeGate](https://img.shields.io/badge/EasyVibeGate-incomplete-yellow)';
+    if (summary.gate === 'warn')
+        return `![EasyVibeGate](https://img.shields.io/badge/EasyVibeGate-${summary.score}%2F100-yellow)`;
+    const c = summary.score >= 90 ? 'brightgreen' : summary.score >= 60 ? 'yellow' : 'orange';
+    return `![EasyVibeGate](https://img.shields.io/badge/EasyVibeGate-${summary.score}%2F100-${c})`;
+}
+function stackLine(result) {
+    const d = result.detection;
+    const parts = [];
+    if (d.frameworks.length)
+        parts.push(d.frameworks.join(', '));
+    if (d.backends.length)
+        parts.push(`backend: ${d.backends.join(', ')}`);
+    if (d.languages.length)
+        parts.push(d.languages.join(', '));
+    return parts.join(' · ') || 'unknown stack';
+}
+function gateLabel(summary) {
+    if (summary.gate === 'fail')
+        return color.red(color.bold('FAIL'));
+    if (summary.gate === 'incomplete')
+        return color.yellow(color.bold('INCOMPLETE'));
+    if (summary.gate === 'warn')
+        return color.yellow(color.bold('WARN'));
+    return color.green(color.bold('PASS'));
+}
+export function renderConsole(result, summary, lang = 'en') {
+    const lines = [];
+    lines.push('');
+    lines.push(`${color.bold('🛡  EasyVibeGate')} ${color.gray(`· ${t(lang, 'console.filesLine', { n: result.fileCount })} · ${stackLine(result)}`)}`);
+    lines.push('');
+    const shown = sortFindings(result.findings);
+    if (shown.length === 0)
+        lines.push(color.green(`  ${t(lang, 'console.none')}`));
+    for (const f of shown) {
+        lines.push(`  ${EMOJI[f.severity]} ${color.bold(f.title)} ${color.gray(whereOf(f))}`);
+        lines.push(`     ${color.dim(f.detail)}`);
+        if (f.evidence)
+            lines.push(`     ${color.gray(`${t(lang, 'console.evidence')}: ${f.evidence}`)}`);
+        lines.push(`     ${color.cyan(`${t(lang, 'console.fix')}: ${f.fix}`)}`);
+    }
+    lines.push('');
+    const c = summary.counts;
+    lines.push(`  ${color.bold(t(lang, 'console.score'))} ${scoreColor(summary)} ${color.gray('/100')}   ${color.bold(t(lang, 'console.gate'))} ${gateLabel(summary)}`);
+    lines.push(`  ${EMOJI.critical} ${c.critical}  ${EMOJI.warning} ${c.warning}  ${EMOJI.info} ${c.info}  ${EMOJI.advisory} ${c.advisory}`);
+    const cov = summary.coverage;
+    const covLine = t(lang, 'cov.line', { ok: cov.completed, failed: cov.failed + cov.partial + cov.unsupported, skipped: cov.skipped });
+    lines.push(`  ${cov.incomplete ? color.yellow(covLine) : color.gray(covLine)}`);
+    lines.push('');
+    return lines.join('\n');
+}
+function scoreColor(summary) {
+    const s = String(summary.score);
+    if (summary.gate === 'fail')
+        return color.red(s);
+    if (summary.gate === 'incomplete' || summary.gate === 'warn')
+        return color.yellow(s);
+    return color.green(s);
+}
+/** One plain-language line a non-technical user understands. */
+export function renderVerdict(summary, lang = 'en') {
+    const c = summary.counts;
+    if (summary.gate === 'fail')
+        return color.red(color.bold(`  ${t(lang, 'verdict.fail', { crit: c.critical })}`));
+    if (summary.gate === 'incomplete') {
+        const key = summary.coverage.nothingVerified ? 'verdict.nocov' : 'verdict.incompleteGate';
+        return color.yellow(color.bold(`  ${t(lang, key, { n: summary.coverage.failed + summary.coverage.partial + summary.coverage.unsupported })}`));
+    }
+    if (c.warning > 0)
+        return color.yellow(color.bold(`  ${t(lang, 'verdict.warn', { warn: c.warning })}`));
+    return color.green(color.bold(`  ${t(lang, 'verdict.clean')}`));
+}
+/** The beginner-facing "what do I do now" block, with an AI-agent handoff. */
+export function renderNextSteps(summary, reportDir, lang = 'en') {
+    const lines = [];
+    lines.push(color.bold(`  ${t(lang, 'next.title')}`));
+    if (summary.counts.critical === 0 && summary.counts.warning === 0) {
+        lines.push(`  ${summary.gate === 'incomplete' ? color.yellow(t(lang, 'next.incompleteClean')) : t(lang, 'next.clean')}`);
+        lines.push('');
+        return lines.join('\n');
+    }
+    lines.push(`  ${t(lang, 'next.step1', { path: color.cyan(`${reportDir}/ai-fix-prompt.md`) })}`);
+    lines.push(`  ${t(lang, 'next.step2a')}`);
+    lines.push(`  ${t(lang, 'next.step2b')}`);
+    lines.push(color.gray(`  ${t(lang, 'next.model1')}`));
+    lines.push(color.gray(`  ${t(lang, 'next.model2')}`));
+    let n = 3;
+    if (summary.counts.critical > 0) {
+        lines.push(`  ${t(lang, 'next.rotate', { n })}`);
+        n++;
+    }
+    lines.push(`  ${t(lang, 'next.rerun', { n })}`);
+    if (summary.gate === 'incomplete')
+        lines.push(color.yellow(`  ${t(lang, 'next.incompleteClean')}`));
+    lines.push('');
+    return lines.join('\n');
+}
+export function renderMarkdown(result, summary, lang = 'en') {
+    const lines = [];
+    lines.push('# 🛡 EasyVibeGate Report');
+    lines.push('');
+    lines.push(t(lang, 'md.summary', { score: summary.score, gate: summary.gate.toUpperCase(), files: result.fileCount }));
+    lines.push('');
+    lines.push(t(lang, 'md.stack', { stack: stackLine(result) }));
+    lines.push('');
+    lines.push(`\`${result.root}\` · EasyVibeGate ${VERSION} · ${new Date().toISOString()}`);
+    lines.push('');
+    lines.push(badgeMarkdown(summary));
+    lines.push('');
+    // Coverage — make failed/partial/skipped/unsupported checks visible.
+    const notDone = result.runs.filter((r) => r.status !== 'completed');
+    if (notDone.length > 0) {
+        lines.push(`## ${t(lang, 'md.checks')}`);
+        lines.push('');
+        for (const r of notDone)
+            lines.push(`- \`${r.id}\` — **${r.status}**${r.note ? ` (${r.note})` : ''}`);
+        lines.push('');
+    }
+    const shown = sortFindings(result.findings);
+    if (shown.length === 0) {
+        lines.push(t(lang, 'md.none'));
+        lines.push('');
+        return lines.join('\n');
+    }
+    for (const sev of SEVERITY_ORDER) {
+        const group = shown.filter((f) => f.severity === sev);
+        if (group.length === 0)
+            continue;
+        lines.push(`## ${EMOJI[sev]} ${t(lang, `sev.${sev}`)} (${group.length})`);
+        lines.push('');
+        for (const f of group) {
+            lines.push(`- **${f.title}** — ${f.detail}`);
+            lines.push(`  - ${t(lang, 'md.where')}: \`${whereOf(f)}\``);
+            if (f.evidence)
+                lines.push(`  - ${t(lang, 'md.evidence')}: \`${f.evidence}\``);
+            lines.push(`  - ${t(lang, 'md.fix')}: ${f.fix}`);
+        }
+        lines.push('');
+    }
+    lines.push('---');
+    lines.push(t(lang, 'md.generated'));
+    lines.push('');
+    return lines.join('\n');
+}
+export function renderJson(result, summary) {
+    return JSON.stringify({
+        projectRoot: result.root,
+        scannedAt: new Date().toISOString(),
+        version: VERSION,
+        score: summary.score,
+        gate: summary.gate,
+        counts: summary.counts,
+        coverage: summary.coverage,
+        fileCount: result.fileCount,
+        detection: result.detection,
+        runs: result.runs,
+        findings: sortFindings(result.findings),
+    }, null, 2);
+}

package/dist/engine/scan.js

@@ -0,0 +1,53 @@
+import { walk } from './walk.js';
+import { detect } from './detect.js';
+import { staticCheckers } from './checkers/index.js';
+import { applyIgnores, loadConfig } from './config.js';
+/** Run all Level 0 (static, read-only) checkers over a project directory. */
+export async function scanStatic(root, opts = {}) {
+    const { files, skippedOversized, skippedUnreadable } = walk(root);
+    const detection = detect(root, files);
+    const ctx = { root, files, detection };
+    let findings = [];
+    const runs = [];
+    // Zero scannable files means nothing was actually reviewed — record it as a
+    // failed precondition, and mark the static checkers as skipped (they had no
+    // input), so the result is never shown as a clean, well-covered 100/100.
+    if (files.length === 0) {
+        runs.push({ id: 'walk', level: 0, status: 'failed', note: 'no scannable files found at this path' });
+        for (const checker of staticCheckers) {
+            runs.push({ id: `static:${checker.id}`, level: 0, status: 'skipped', note: 'no files to check' });
+        }
+        return { root, detection, findings, fileCount: 0, files, runs };
+    }
+    // Files we could not read are missing coverage, not a clean result.
+    const lost = skippedOversized + skippedUnreadable;
+    if (lost > 0) {
+        const parts = [];
+        if (skippedOversized)
+            parts.push(`${skippedOversized} over the 1 MB limit`);
+        if (skippedUnreadable)
+            parts.push(`${skippedUnreadable} unreadable`);
+        runs.push({ id: 'walk', level: 0, status: 'partial', note: `${lost} file(s) not scanned (${parts.join(', ')})` });
+    }
+    for (const checker of staticCheckers) {
+        try {
+            findings.push(...(await checker.run(ctx)));
+            runs.push({ id: `static:${checker.id}`, level: 0, status: 'completed' });
+        }
+        catch (err) {
+            // A broken checker is a failed check, not a clean pass.
+            runs.push({
+                id: `static:${checker.id}`,
+                level: 0,
+                status: 'failed',
+                note: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    const config = loadConfig(root, opts.configPath);
+    if (config.problem) {
+        runs.push({ id: 'config', level: 0, status: 'failed', note: `${config.problem} — suppression rules were NOT applied` });
+    }
+    findings = applyIgnores(findings, config, files);
+    return { root, detection, findings, fileCount: files.length, files, runs };
+}

package/dist/engine/types.js

@@ -0,0 +1 @@
+export const SEVERITY_ORDER = ['critical', 'warning', 'info', 'advisory'];

package/dist/engine/util/color.js

@@ -0,0 +1,17 @@
+const enabled = !!process.stdout.isTTY &&
+    process.env['NO_COLOR'] === undefined &&
+    process.env['TERM'] !== 'dumb';
+function wrap(code) {
+    return (s) => (enabled ? `\x1b[${code}m${s}\x1b[0m` : s);
+}
+export const color = {
+    enabled,
+    red: wrap(31),
+    green: wrap(32),
+    yellow: wrap(33),
+    blue: wrap(34),
+    cyan: wrap(36),
+    gray: wrap(90),
+    bold: wrap(1),
+    dim: wrap(2),
+};

package/dist/engine/util/mask.js

@@ -0,0 +1,66 @@
+/**
+ * Blank out comments (and, optionally, quoted strings) while preserving length
+ * and newlines, so match offsets and line numbers stay correct. Used so that a
+ * comment like `// never use eval()` is not reported as a finding.
+ */
+export function maskCode(src, opts = {}) {
+    const out = src.split('');
+    const n = src.length;
+    const blank = (from, to) => {
+        for (let k = from; k < to && k < n; k++)
+            if (out[k] !== '\n')
+                out[k] = ' ';
+    };
+    let i = 0;
+    while (i < n) {
+        const ch = src[i];
+        const next = src[i + 1];
+        if (ch === '/' && next === '/') {
+            let j = i;
+            while (j < n && src[j] !== '\n')
+                j++;
+            blank(i, j);
+            i = j;
+            continue;
+        }
+        if (ch === '#' && src[i - 1] !== '$') {
+            let j = i;
+            while (j < n && src[j] !== '\n')
+                j++;
+            blank(i, j);
+            i = j;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            const c = src.indexOf('*/', i + 2);
+            const end = c === -1 ? n : c + 2;
+            blank(i, end);
+            i = end;
+            continue;
+        }
+        if (opts.strings && (ch === '"' || ch === "'")) {
+            let j = i + 1;
+            while (j < n && src[j] !== ch) {
+                if (src[j] === '\\')
+                    j++;
+                if (src[j] === '\n')
+                    break;
+                j++;
+            }
+            const end = Math.min(j + 1, n);
+            blank(i, end);
+            i = end;
+            continue;
+        }
+        i++;
+    }
+    return out.join('');
+}
+/** Minified/bundled output is not source a human wrote — reviewing it is noise. */
+export function looksMinified(rel, content) {
+    if (/\.min\.(js|css|mjs|cjs)$/i.test(rel) || /(^|\/)(dist|build|vendor|bundle)\//.test(rel))
+        return true;
+    const lines = content.split('\n');
+    const longest = lines.reduce((m, l) => Math.max(m, l.length), 0);
+    return longest > 800 && lines.length < content.length / 200;
+}

package/dist/engine/util/text.js

@@ -0,0 +1,50 @@
+/** Shannon entropy (bits per char) of a string. High for real secrets. */
+export function shannonEntropy(s) {
+    if (!s)
+        return 0;
+    const freq = {};
+    for (const ch of s)
+        freq[ch] = (freq[ch] ?? 0) + 1;
+    let e = 0;
+    for (const count of Object.values(freq)) {
+        const p = count / s.length;
+        e -= p * Math.log2(p);
+    }
+    return e;
+}
+/** Mask a sensitive value so it is safe to print in a report. */
+export function redact(s) {
+    const t = s.trim();
+    if (t.length <= 8)
+        return '***';
+    return `${t.slice(0, 4)}…${t.slice(-3)}`;
+}
+/** 1-based line number of a character offset inside `content`. */
+export function lineAt(content, index) {
+    let line = 1;
+    const stop = Math.min(index, content.length);
+    for (let i = 0; i < stop; i++) {
+        if (content.charCodeAt(i) === 10)
+            line++;
+    }
+    return line;
+}
+const PLACEHOLDER = /(x{3,}|your[_-]?|<[^>]+>|\$\{|process\.env|import\.meta\.env|example|placeholder|changeme|dummy|test[_-]?key|xxxxx|\.\.\.)/i;
+/** True if a captured value looks like a template/placeholder, not a real secret. */
+export function looksLikePlaceholder(value) {
+    return PLACEHOLDER.test(value);
+}
+/** Decode a JWT payload without verifying the signature. Returns null on failure. */
+export function decodeJwtPayload(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        const json = Buffer.from(parts[1], 'base64url').toString('utf8');
+        const obj = JSON.parse(json);
+        return typeof obj === 'object' && obj !== null ? obj : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/engine/version.js

@@ -0,0 +1,12 @@
+import { readFileSync } from 'node:fs';
+/** Single source of truth for the version, read from package.json. */
+export function readVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+export const VERSION = readVersion();

package/dist/engine/walk.js

@@ -0,0 +1,86 @@
+import { readdirSync, statSync, readFileSync } from 'node:fs';
+import { join, relative, extname, sep } from 'node:path';
+const SKIP_DIRS = new Set([
+    '.git', 'node_modules', '.next', 'dist', 'build', 'out', '.venv', 'venv',
+    '__pycache__', 'coverage', '.turbo', '.cache', 'vendor', '.svelte-kit',
+    '.nuxt', '.output', 'target', '.idea', '.vscode', 'easyvibegate-report',
+]);
+const TEXT_EXT = new Set([
+    '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.vue', '.svelte',
+    '.py', '.rb', '.php', '.go', '.rs', '.java', '.kt', '.cs',
+    '.html', '.css', '.scss', '.json', '.yml', '.yaml', '.toml',
+    '.env', '.sh', '.sql', '.md', '.txt', '.ini', '.conf', '.tf',
+    '.pem', '.key', '.crt', '.cert', '.pkcs8',
+    '.astro', '.properties', '.plist', '.swift', '.dart', '.ipynb', '.bash', '.zsh', '.mdx',
+]);
+const ALWAYS_NAMES = new Set([
+    'Dockerfile', 'Gemfile', 'Procfile', 'Makefile', '.gitignore',
+    '.npmrc', '.netrc', '.yarnrc', '.dockerignore', 'env.local', 'credentials',
+]);
+const MAX_SIZE = 1024 * 1024; // 1 MB
+function isScannable(name) {
+    if (name.startsWith('.env'))
+        return true;
+    if (name.startsWith('docker-compose'))
+        return true;
+    if (ALWAYS_NAMES.has(name))
+        return true;
+    return TEXT_EXT.has(extname(name).toLowerCase());
+}
+/** Recursively collect scannable text files under `root`, skipping noise. */
+export function walk(root) {
+    const out = [];
+    let skippedOversized = 0;
+    let skippedUnreadable = 0;
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const ent of entries) {
+            if (ent.isSymbolicLink())
+                continue;
+            const full = join(dir, ent.name);
+            if (ent.isDirectory()) {
+                if (!SKIP_DIRS.has(ent.name))
+                    stack.push(full);
+                continue;
+            }
+            if (!ent.isFile() || !isScannable(ent.name))
+                continue;
+            let st;
+            try {
+                st = statSync(full);
+            }
+            catch {
+                skippedUnreadable++;
+                continue;
+            }
+            if (st.size > MAX_SIZE) {
+                skippedOversized++;
+                continue;
+            }
+            let content;
+            try {
+                content = readFileSync(full, 'utf8');
+            }
+            catch {
+                skippedUnreadable++;
+                continue;
+            }
+            out.push({
+                abs: full,
+                rel: relative(root, full).split(sep).join('/'),
+                content,
+                ext: extname(ent.name).toLowerCase(),
+                size: st.size,
+            });
+        }
+    }
+    return { files: out, skippedOversized, skippedUnreadable };
+}

package/dist/orchestrator/flow.js

@@ -0,0 +1,116 @@
+import { scanStatic } from '../engine/scan.js';
+import { collectEndpoints } from '../engine/endpoints.js';
+import { applyIgnores, loadConfig } from '../engine/config.js';
+import { auditDeps } from '../engine/checkers/deep/deps.js';
+import { classifyKey, discoverSupabase, probeSupabase } from '../engine/checkers/backend/supabase.js';
+import { discoverFirebase, probeFirebase } from '../engine/checkers/backend/firebase.js';
+import { checkLiveSite } from '../engine/checkers/live/http-checks.js';
+import { probeEndpointsUnauth } from '../engine/checkers/live/endpoint-probe.js';
+import { idorDifferential } from '../engine/checkers/live/idor.js';
+/**
+ * Tiered orchestrator shared by the CLI wizard and the skill. Every check that
+ * runs records a status (completed/partial/failed/skipped/unsupported) so a
+ * failed or not-run check is never mistaken for a clean result.
+ */
+export async function runFlow(opts) {
+    const log = opts.log ?? (() => { });
+    const result = opts.precomputedStatic ?? (await scanStatic(opts.root, { configPath: opts.configPath }));
+    const findings = [...result.findings];
+    const runs = [...result.runs];
+    // Files used for backend discovery / endpoint enumeration honor ignorePaths,
+    // so an ignored path (e.g. tests/, fixtures/) does not feed the live probes.
+    const config = loadConfig(opts.root, opts.configPath);
+    const visible = result.files.filter((f) => !config.ignorePaths.some((sub) => f.rel.includes(sub)));
+    // Level 1 — dependency audit.
+    if (opts.runDeps) {
+        log('Level 1: dependency audit…');
+        const deps = await auditDeps(opts.root, result.detection.packageManagers);
+        findings.push(...deps.findings);
+        runs.push(deps.run);
+    }
+    // Level 2 — Supabase active probe (read-only).
+    const sbCreds = opts.supabaseUrl && opts.supabaseKey
+        ? { url: opts.supabaseUrl, anonKey: opts.supabaseKey, keyKind: classifyKey(opts.supabaseKey) === 'publishable' ? 'publishable' : 'jwt-anon' }
+        : discoverSupabase(visible);
+    if (sbCreds) {
+        const ok = await opts.consent({
+            kind: 'supabase',
+            target: sbCreds.url,
+            detail: 'read tables, buckets and RPC using the public key (read-only)',
+        });
+        if (ok === true) {
+            log(`Level 2: probing Supabase ${sbCreds.url}…`);
+            const r = await probeSupabase({ creds: sbCreds, log });
+            findings.push(...r.findings);
+            runs.push(r.run);
+        }
+        else {
+            runs.push({ id: 'supabase-probe', level: 2, status: 'skipped', note: 'declined' });
+        }
+    }
+    // Level 2 — Firebase active probe.
+    const fbCreds = discoverFirebase(visible);
+    if (fbCreds) {
+        const ok = await opts.consent({
+            kind: 'firebase',
+            target: fbCreds.projectId,
+            detail: 'anonymous reads of RTDB, Firestore and Storage',
+        });
+        if (ok === true) {
+            log(`Level 2: probing Firebase ${fbCreds.projectId}…`);
+            const r = await probeFirebase({ creds: fbCreds, log });
+            findings.push(...r.findings);
+            runs.push(r.run);
+        }
+        else {
+            runs.push({ id: 'firebase-probe', level: 2, status: 'skipped', note: 'declined' });
+        }
+    }
+    // Level 2 — live site + endpoint probe + IDOR.
+    if (opts.appUrl) {
+        const ok = await opts.consent({
+            kind: 'live',
+            target: opts.appUrl,
+            detail: 'passive checks (headers, exposed files) + unauthenticated endpoint probe',
+        });
+        if (ok === true) {
+            log(`Level 2: live checks on ${opts.appUrl}…`);
+            const site = await checkLiveSite(opts.appUrl);
+            findings.push(...site.findings);
+            runs.push(site.run);
+            const endpoints = collectEndpoints(visible);
+            const ep = await probeEndpointsUnauth(opts.appUrl, endpoints);
+            findings.push(...ep.findings);
+            runs.push(ep.run);
+            if (opts.idorTokens) {
+                const idorOk = await opts.consent({
+                    kind: 'idor',
+                    target: opts.appUrl,
+                    detail: 'replay object-scoped endpoints with two accounts (IDOR test)',
+                });
+                if (idorOk === true) {
+                    const r = await idorDifferential(opts.appUrl, endpoints, opts.idorTokens[0], opts.idorTokens[1]);
+                    findings.push(...r.findings);
+                    runs.push(r.run);
+                }
+                else {
+                    runs.push({ id: 'idor', level: 2, status: 'skipped', note: 'declined' });
+                }
+            }
+        }
+        else {
+            // A URL only reaches here because the caller explicitly asked for it, so
+            // this is a check that was REQUESTED and did not run. That is missing
+            // coverage, not a clean result: `unsupported` makes the gate incomplete,
+            // where `skipped` would have let a never-run live check exit 0 as PASS.
+            const note = 'requested but not authorized — ownership was not confirmed';
+            runs.push({ id: 'live-site', level: 2, status: 'unsupported', note });
+            runs.push({ id: 'endpoint-probe', level: 2, status: 'unsupported', note });
+            if (opts.idorTokens)
+                runs.push({ id: 'idor', level: 2, status: 'unsupported', note });
+        }
+    }
+    // Apply config-based suppressions to the full finding set (Level 1/2 too).
+    const filtered = applyIgnores(findings, config, result.files);
+    return { ...result, findings: filtered, runs };
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "easyvibegate",
+  "version": "0.4.4",
+  "description": "Interactive security scanner for vibe-coded apps (focus: Next.js + Supabase). Checks common risks and shows evidence where it can.",
+  "type": "module",
+  "bin": {
+    "easyvibegate": "dist/cli/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "node tests/run.mjs",
+    "prepare": "tsc",
+    "prepublishOnly": "tsc",
+    "easyvibegate": "node dist/cli/index.js"
+  },
+  "author": "valedol190387 (https://github.com/valedol190387)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/valedol190387/easyvibegate.git"
+  },
+  "homepage": "https://github.com/valedol190387/easyvibegate#readme",
+  "bugs": {
+    "url": "https://github.com/valedol190387/easyvibegate/issues"
+  },
+  "keywords": [
+    "security",
+    "vibe-coding",
+    "scanner",
+    "supabase",
+    "rls",
+    "secrets",
+    "audit"
+  ],
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^22.7.0",
+    "typescript": "^5.6.3"
+  }
+}