fchek 1.0.0

package/lib/vuln.js

@@ -0,0 +1,253 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+const { output, ok, fail } = require('./output');
+
+const HELP = `
+fchek vuln [dir]
+
+Scan project dependencies for vulnerabilities and typosquatting.
+Automatically detects package.json, requirements.txt, and Cargo.toml.
+Run npm audit / pip-audit / cargo audit, and runs a typosquatting check.
+`.trim();
+
+const POPULAR_PACKAGES = {
+  npm: [
+    'react', 'react-dom', 'lodash', 'express', 'chalk', 'commander', 'tslib',
+    'axios', 'moment', 'uuid', 'dotenv', 'fs-extra', 'async', 'prop-types',
+    'classnames', 'jquery', 'glob', 'webpack', 'typescript', 'request',
+    'cheerio', 'minimist', 'debug', 'bluebird', 'rxjs', 'vue', 'angular'
+  ],
+  pip: [
+    'requests', 'numpy', 'pandas', 'flask', 'django', 'urllib3', 'six',
+    'cryptography', 'jinja2', 'scipy', 'matplotlib', 'pytest', 'boto3',
+    'click', 'pyyaml', 'black', 'ruff', 'pip', 'setuptools', 'wheel'
+  ],
+  cargo: [
+    'serde', 'tokio', 'rand', 'reqwest', 'clap', 'syn', 'quote', 'log',
+    'lazy_static', 'anyhow', 'futures', 'libc', 'hyper', 'regex', 'cargo'
+  ]
+};
+
+function levenshtein(a, b) {
+  const tmp = [];
+  for (let i = 0; i <= a.length; i++) {
+    tmp[i] = [i];
+  }
+  for (let j = 0; j <= b.length; j++) {
+    tmp[0][j] = j;
+  }
+  for (let i = 1; i <= a.length; i++) {
+    for (let j = 1; j <= b.length; j++) {
+      if (a[i - 1] === b[j - 1]) {
+        tmp[i][j] = tmp[i - 1][j - 1];
+      } else {
+        tmp[i][j] = Math.min(
+          tmp[i - 1][j - 1] + 1, // substitution
+          tmp[i][j - 1] + 1,     // insertion
+          tmp[i - 1][j] + 1      // deletion
+        );
+      }
+    }
+  }
+  return tmp[a.length][b.length];
+}
+
+function checkTyposquatting(name, type) {
+  const popular = POPULAR_PACKAGES[type] || [];
+  const lowerName = name.toLowerCase();
+  
+  // If exact match, it's fine
+  if (popular.includes(lowerName)) return null;
+
+  for (const pop of popular) {
+    const dist = levenshtein(lowerName, pop);
+    // If name is very close (distance 1 or 2) but not identical, warn
+    if (dist > 0 && dist <= 2 && Math.abs(lowerName.length - pop.length) <= 2) {
+      return {
+        package: name,
+        type,
+        suspectedTyposquatOf: pop,
+        distance: dist
+      };
+    }
+  }
+  return null;
+}
+
+async function run(args) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(HELP);
+    return;
+  }
+
+  const targetDir = args.find(a => !a.startsWith('-')) || '.';
+  const resolvedDir = path.resolve(targetDir);
+
+  if (!fs.existsSync(resolvedDir)) {
+    output(fail(`Directory does not exist: ${targetDir}`, 'vuln'));
+    return;
+  }
+
+  const results = {
+    packages_checked: 0,
+    vulnerabilities: [],
+    typosquatting_warnings: [],
+    audit_ran: []
+  };
+
+  // Node (package.json)
+  const pkgPath = path.join(resolvedDir, 'package.json');
+  if (fs.existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+      
+      for (const name of Object.keys(deps)) {
+        results.packages_checked++;
+        const warn = checkTyposquatting(name, 'npm');
+        if (warn) results.typosquatting_warnings.push(warn);
+      }
+
+      // Try running npm audit
+      try {
+        const auditOut = execSync('npm audit --json', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], cwd: resolvedDir });
+        const auditJson = JSON.parse(auditOut);
+        results.audit_ran.push('npm');
+        if (auditJson.vulnerabilities) {
+          for (const [name, vuln] of Object.entries(auditJson.vulnerabilities)) {
+            results.vulnerabilities.push({
+              package: name,
+              severity: vuln.severity,
+              via: vuln.via,
+              effects: vuln.effects
+            });
+          }
+        }
+      } catch (auditErr) {
+        // npm audit exits with non-zero if vulnerabilities are found
+        results.audit_ran.push('npm');
+        try {
+          const auditJson = JSON.parse(auditErr.stdout);
+          if (auditJson.vulnerabilities) {
+            for (const [name, vuln] of Object.entries(auditJson.vulnerabilities)) {
+              results.vulnerabilities.push({
+                package: name,
+                severity: vuln.severity,
+                via: vuln.via,
+                effects: vuln.effects
+              });
+            }
+          }
+        } catch {
+          // If JSON parse failed, it was a real execution error or npm not installed
+        }
+      }
+    } catch (err) {
+      // Ignore parse/read errors
+    }
+  }
+
+  // Python (requirements.txt)
+  const reqPath = path.join(resolvedDir, 'requirements.txt');
+  if (fs.existsSync(reqPath)) {
+    try {
+      const content = fs.readFileSync(reqPath, 'utf8');
+      const lines = content.split('\n');
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) continue;
+        // Match package name (before ==, >=, etc.)
+        const match = trimmed.match(/^([a-zA-Z0-9_\-]+)/);
+        if (match) {
+          const name = match[1];
+          results.packages_checked++;
+          const warn = checkTyposquatting(name, 'pip');
+          if (warn) results.typosquatting_warnings.push(warn);
+        }
+      }
+
+      // Try running pip-audit if installed
+      try {
+        const auditOut = execSync('pip-audit --format json', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], cwd: resolvedDir });
+        const auditJson = JSON.parse(auditOut);
+        results.audit_ran.push('pip');
+        if (auditJson.dependencies) {
+          for (const dep of auditJson.dependencies) {
+            if (dep.vulns && dep.vulns.length > 0) {
+              for (const v of dep.vulns) {
+                results.vulnerabilities.push({
+                  package: dep.name,
+                  id: v.id,
+                  severity: 'unknown',
+                  description: v.description
+                });
+              }
+            }
+          }
+        }
+      } catch {
+        // pip-audit not installed or failed
+      }
+    } catch (err) {
+      // Ignore
+    }
+  }
+
+  // Rust (Cargo.toml)
+  const cargoPath = path.join(resolvedDir, 'Cargo.toml');
+  if (fs.existsSync(cargoPath)) {
+    try {
+      const content = fs.readFileSync(cargoPath, 'utf8');
+      // Simple parser for dependencies block
+      const lines = content.split('\n');
+      let inDeps = false;
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith('[dependencies]') || trimmed.startsWith('[dev-dependencies]')) {
+          inDeps = true;
+          continue;
+        } else if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+          inDeps = false;
+        }
+
+        if (inDeps && trimmed && !trimmed.startsWith('#')) {
+          const eqIdx = trimmed.indexOf('=');
+          if (eqIdx !== -1) {
+            const name = trimmed.slice(0, eqIdx).trim();
+            results.packages_checked++;
+            const warn = checkTyposquatting(name, 'cargo');
+            if (warn) results.typosquatting_warnings.push(warn);
+          }
+        }
+      }
+
+      // Try running cargo audit if available
+      try {
+        const auditOut = execSync('cargo audit --json', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], cwd: resolvedDir });
+        const auditJson = JSON.parse(auditOut);
+        results.audit_ran.push('cargo');
+        if (auditJson.vulnerabilities && auditJson.vulnerabilities.list) {
+          for (const v of auditJson.vulnerabilities.list) {
+            results.vulnerabilities.push({
+              package: v.package.name,
+              id: v.advisory.id,
+              severity: 'unknown',
+              description: v.advisory.description
+            });
+          }
+        }
+      } catch {
+        // cargo-audit not available
+      }
+    } catch (err) {
+      // Ignore
+    }
+  }
+
+  output(ok(results, 'vuln'));
+}
+
+module.exports = { run };

package/lib/watch.js

@@ -0,0 +1,240 @@
+'use strict';
+
+/**
+ * watch.js — watch files and auto-rebuild/restart on changes
+ *
+ * Solves WPF/C# pain: change XAML → app auto-rebuilds → re-launches.
+ * No manual rebuild steps.
+ *
+ * Uses Node.js fs.watch (built-in, no external deps).
+ * On change: runs build command, then optionally restarts app.
+ */
+
+const fs   = require('fs');
+const path = require('path');
+const { spawnSync, spawn } = require('child_process');
+const { output, ok, fail } = require('./output');
+
+const HELP = `
+fchek watch <dir> [--cmd=<build_cmd>] [--ext=cs,xaml] [--launch=<exe>] [--debounce=1000]
+
+Watch files for changes and auto-rebuild. For WPF: change XAML → rebuilds → relaunches.
+
+Options:
+  --cmd=<command>    Build command to run on change (default: dotnet build)
+  --ext=cs,xaml      File extensions to watch (default: cs,xaml,js,ts,py,rs)
+  --launch=<exe>     Re-launch this exe after successful build
+  --debounce=1000    Wait Nms after last change before rebuilding (default: 1000)
+  --once             Build once and exit (no watch loop)
+
+Examples:
+  fchek watch .
+  fchek watch . --ext=cs,xaml --cmd="dotnet build"
+  fchek watch . --cmd="dotnet build" --launch=bin/Debug/net8.0-windows/Vertex.exe
+  fchek watch src/ --ext=py --cmd="python -m pytest" --debounce=500
+`.trim();
+
+function runCommand(cmd, cwd) {
+  const parts = cmd.split(/\s+/);
+  const res   = spawnSync(parts[0], parts.slice(1), {
+    encoding: 'utf8',
+    cwd:      cwd || process.cwd(),
+    timeout:  120000,
+    windowsHide: true,
+  });
+  return {
+    success:   res.status === 0,
+    exit_code: res.status,
+    stdout:    (res.stdout || '').slice(-2000),
+    stderr:    (res.stderr || '').slice(-1000),
+    error:     res.error?.message || null,
+  };
+}
+
+function killProcess(name) {
+  if (process.platform !== 'win32') return;
+  spawnSync('powershell', [
+    '-NoProfile', '-NonInteractive', '-Command',
+    `Get-Process -Name "${name}" -ErrorAction SilentlyContinue | Stop-Process -Force`,
+  ], { timeout: 5000, windowsHide: true });
+}
+
+function launchProcess(exe) {
+  const abs = path.resolve(exe);
+  if (!fs.existsSync(abs)) return { error: `Executable not found: ${abs}` };
+  const child = spawn(abs, [], {
+    detached:   true,
+    stdio:      'ignore',
+    windowsHide: false,
+  });
+  child.unref();
+  return { pid: child.pid };
+}
+
+async function run(args) {
+  if (args.length === 0 || args[0] === '--help') { console.log(HELP); return; }
+
+  const dir       = args.find(a => !a.startsWith('--')) || '.';
+  const cmd       = (args.find(a => a.startsWith('--cmd='))      || '').replace('--cmd=', '')      || autoDetectCmd(dir);
+  const extArg    = (args.find(a => a.startsWith('--ext='))      || '--ext=cs,xaml,js,ts,py,rs,go,cpp,c').replace('--ext=', '');
+  const launchExe = (args.find(a => a.startsWith('--launch='))   || '').replace('--launch=', '')   || null;
+  const debounce  = parseInt((args.find(a => a.startsWith('--debounce=')) || '--debounce=1000').replace('--debounce=', ''), 10);
+  const once      = args.includes('--once');
+
+  if (!fs.existsSync(dir)) {
+    return output(fail(`Directory not found: ${dir}`));
+  }
+
+  const exts = extArg.split(',').map(e => `.${e.replace(/^\./, '')}`);
+  const absDir = path.resolve(dir);
+
+  if (!cmd) {
+    return output(fail(
+      'No build command detected. Use --cmd="dotnet build" or --cmd="npm run build"'
+    ));
+  }
+
+  // Run once and exit
+  if (once) {
+    console.error(`[fchek watch] Building: ${cmd}`);
+    const result = runCommand(cmd, absDir);
+    output(ok({
+      mode:    'once',
+      dir:     absDir,
+      cmd,
+      ...result,
+      built_at: new Date().toISOString(),
+    }));
+    return;
+  }
+
+  // Watch mode — output status line per rebuild, then stay running
+  console.error(`[fchek watch] Watching: ${absDir}`);
+  console.error(`[fchek watch] Extensions: ${exts.join(', ')}`);
+  console.error(`[fchek watch] Command: ${cmd}`);
+  if (launchExe) console.error(`[fchek watch] Launch: ${launchExe}`);
+  console.error(`[fchek watch] Debounce: ${debounce}ms\n`);
+
+  let debounceTimer = null;
+  let building      = false;
+  let buildCount    = 0;
+
+  const doBuild = () => {
+    if (building) return;
+    building = true;
+    buildCount++;
+
+    const ts = new Date().toLocaleTimeString();
+    console.error(`[${ts}] Change detected — building...`);
+
+    const result = runCommand(cmd, absDir);
+
+    if (result.success) {
+      console.error(`[${ts}] ✓ Build #${buildCount} succeeded`);
+
+      if (launchExe) {
+        const exeName = path.basename(launchExe, path.extname(launchExe));
+        killProcess(exeName);
+        const launched = launchProcess(launchExe);
+        if (launched.error) {
+          console.error(`[${ts}] ✗ Launch failed: ${launched.error}`);
+        } else {
+          console.error(`[${ts}] ✓ Launched PID ${launched.pid}`);
+        }
+      }
+
+      // Output JSON for agent to read
+      console.log(JSON.stringify({
+        status:  'ok',
+        command: 'watch',
+        data: {
+          build:     buildCount,
+          success:   true,
+          cmd,
+          built_at:  new Date().toISOString(),
+          stdout:    result.stdout,
+          launched:  launchExe ? true : null,
+        },
+      }));
+    } else {
+      console.error(`[${ts}] ✗ Build #${buildCount} failed (exit ${result.exit_code})`);
+      if (result.stderr) console.error(result.stderr.slice(0, 500));
+
+      console.log(JSON.stringify({
+        status:  'ok',
+        command: 'watch',
+        data: {
+          build:     buildCount,
+          success:   false,
+          cmd,
+          exit_code: result.exit_code,
+          stderr:    result.stderr,
+          built_at:  new Date().toISOString(),
+        },
+      }));
+    }
+
+    building = false;
+  };
+
+  // Initial build
+  doBuild();
+
+  // Watch for changes
+  const watchedDirs = new Set([absDir]);
+
+  // Also watch subdirs (fs.watch is not recursive on all platforms)
+  function addWatchers(d, depth = 0) {
+    if (depth > 5) return;
+    try {
+      for (const name of fs.readdirSync(d)) {
+        if (['node_modules', '.git', 'bin', 'obj', 'dist', 'target', '__pycache__'].includes(name)) continue;
+        const full = path.join(d, name);
+        try {
+          if (fs.statSync(full).isDirectory() && !watchedDirs.has(full)) {
+            watchedDirs.add(full);
+            addWatchers(full, depth + 1);
+          }
+        } catch {}
+      }
+    } catch {}
+  }
+  addWatchers(absDir);
+
+  for (const watchDir of watchedDirs) {
+    try {
+      fs.watch(watchDir, (eventType, filename) => {
+        if (!filename) return;
+        const ext = path.extname(filename).toLowerCase();
+        if (!exts.includes(ext)) return;
+
+        clearTimeout(debounceTimer);
+        debounceTimer = setTimeout(doBuild, debounce);
+      });
+    } catch {}
+  }
+
+  console.error('[fchek watch] Press Ctrl+C to stop.\n');
+
+  // Keep process alive
+  process.on('SIGINT', () => {
+    console.error('\n[fchek watch] Stopped.');
+    process.exit(0);
+  });
+
+  await new Promise(() => {}); // Never resolves — keeps running
+}
+
+function autoDetectCmd(dir) {
+  const abs = path.resolve(dir);
+  const files = (() => { try { return fs.readdirSync(abs); } catch { return []; } })();
+
+  if (files.some(f => f.endsWith('.csproj') || f.endsWith('.sln'))) return 'dotnet build';
+  if (files.includes('Cargo.toml'))   return 'cargo build';
+  if (files.includes('package.json')) return 'npm run build';
+  if (files.includes('go.mod'))       return 'go build ./...';
+  if (files.some(f => f.endsWith('.py'))) return 'python -m py_compile *.py';
+  return null;
+}
+
+module.exports = { run };

package/lib/winlog.js

@@ -0,0 +1,123 @@
+'use strict';
+
+/**
+ * winlog.js — read Windows Event Viewer via PowerShell
+ *
+ * Reads Application, System, or custom event logs.
+ * Filters by source name, level (Error/Warning/Info), time range.
+ * Agent uses this to see runtime crashes, silent failures, startup errors.
+ */
+
+const { spawnSync } = require('child_process');
+const { output, ok, fail } = require('./output');
+
+const HELP = `
+fchek winlog [--source=Application|System|Security] [--filter=<name>] [--last=50] [--level=Error|Warning|Info] [--since=<minutes>]
+
+Read Windows Event Viewer logs. Find crashes and silent failures your app generates.
+
+Options:
+  --source=Application   Log source (default: Application)
+  --filter=<name>        Filter by source/provider name (e.g. "Vertex", ".NET Runtime")
+  --last=50              Number of recent events (default: 50)
+  --level=Error          Filter by level: Error, Warning, Information, Critical
+  --since=60             Events from last N minutes
+
+Examples:
+  fchek winlog
+  fchek winlog --source=Application --filter=Vertex
+  fchek winlog --level=Error --since=30
+  fchek winlog --source=System --level=Critical
+`.trim();
+
+function runPowerShell(script, timeoutMs = 30000) {
+  return spawnSync('powershell', [
+    '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script,
+  ], { encoding: 'utf8', timeout: timeoutMs, windowsHide: true });
+}
+
+async function run(args) {
+  if (args[0] === '--help') { console.log(HELP); return; }
+
+  if (process.platform !== 'win32') {
+    return output(fail('fchek winlog is Windows-only.'));
+  }
+
+  const source  = (args.find(a => a.startsWith('--source='))  || '--source=Application').replace('--source=', '');
+  const filter  = (args.find(a => a.startsWith('--filter='))  || '').replace('--filter=', '') || null;
+  const last    = parseInt((args.find(a => a.startsWith('--last=')) || '--last=50').replace('--last=', ''), 10);
+  const level   = (args.find(a => a.startsWith('--level='))   || '').replace('--level=', '') || null;
+  const sinceMin = parseInt((args.find(a => a.startsWith('--since=')) || '--since=0').replace('--since=', ''), 10) || null;
+
+  // Build where clause
+  const whereParts = [];
+  if (filter)  whereParts.push(`$_.ProviderName -match ${JSON.stringify(filter)}`);
+  if (level)   whereParts.push(`$_.LevelDisplayName -eq ${JSON.stringify(level)}`);
+  if (sinceMin) whereParts.push(`$_.TimeCreated -ge (Get-Date).AddMinutes(-${sinceMin})`);
+
+  const whereClause = whereParts.length > 0
+    ? `| Where-Object { ${whereParts.join(' -and ')} }`
+    : '';
+
+  const script = `
+$ErrorActionPreference = 'SilentlyContinue'
+try {
+    $events = Get-WinEvent -LogName ${JSON.stringify(source)} -MaxEvents ${last * 3} ${whereClause} -ErrorAction SilentlyContinue |
+        Select-Object -First ${last} |
+        ForEach-Object {
+            @{
+                time     = $_.TimeCreated.ToString("yyyy-MM-dd HH:mm:ss")
+                level    = $_.LevelDisplayName
+                provider = $_.ProviderName
+                id       = $_.Id
+                message  = ($_.Message -replace '"', "'") -replace "[\\r\\n]+", " " | ForEach-Object { $_.Substring(0, [Math]::Min($_.Length, 300)) }
+            }
+        }
+
+    $json = $events | ConvertTo-Json -Depth 3 -Compress
+    if ($null -eq $json) { $json = "[]" }
+    Write-Output $json
+} catch {
+    Write-Output ('{"error":"' + $_.Exception.Message.Replace('"',"'") + '"}')
+}
+`;
+
+  const res = runPowerShell(script);
+
+  if (res.error) {
+    return output(fail(`PowerShell error: ${res.error.message}`));
+  }
+
+  const raw = (res.stdout || '').trim();
+  if (!raw) {
+    return output(ok({ source, filter, events: [], count: 0, note: 'No events found or log empty.' }));
+  }
+
+  let events;
+  try {
+    const parsed = JSON.parse(raw);
+    // ConvertTo-Json wraps single item as object, multiple as array
+    events = Array.isArray(parsed) ? parsed : (parsed.error ? null : [parsed]);
+    if (!events) return output(fail(parsed.error));
+  } catch {
+    return output(fail(`Parse error: ${raw.slice(0, 300)}`));
+  }
+
+  // Categorize
+  const errors   = events.filter(e => e.level === 'Error' || e.level === 'Critical');
+  const warnings = events.filter(e => e.level === 'Warning');
+
+  output(ok({
+    source,
+    filter:    filter || null,
+    level:     level  || null,
+    since_min: sinceMin || null,
+    count:     events.length,
+    errors:    errors.length,
+    warnings:  warnings.length,
+    events,
+    verdict: errors.length > 0 ? 'errors_found' : warnings.length > 0 ? 'warnings_found' : 'clean',
+  }));
+}
+
+module.exports = { run };

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "fchek",
+  "version": "1.0.0",
+  "description": "CLI tool for developers and AI agents: profiling, sanitizers, LSP, coverage, fuzzing and more",
+  "bin": {
+    "fchek": "./bin/fchek.js"
+  },
+  "main": "./bin/fchek.js",
+  "scripts": {
+    "start": "node bin/fchek.js",
+    "build": "npx @yao-pkg/pkg . --target node22-win-x64 --output dist/fchek.exe --compress GZip",
+    "build:linux": "npx @yao-pkg/pkg . --target node22-linux-x64 --output dist/fchek --compress GZip",
+    "install-global": "npm install -g ."
+  },
+  "pkg": {
+    "targets": ["node22-win-x64"],
+    "scripts": [
+      "bin/**/*.js",
+      "lib/**/*.js"
+    ],
+    "outputPath": "dist"
+  },
+  "keywords": ["cli", "profiler", "sanitizer", "lsp", "ai-tools"],
+  "license": "MIT",
+  "files": ["bin/", "lib/", "skills/", "README.md"],
+  "engines": { "node": ">=18" }
+}