getdoorman 1.0.4 → 1.0.6

package/bin/doorman.js

@@ -3,13 +3,19 @@
 import { Command } from 'commander';
 import { check } from '../src/index.js';
 import { generateReport } from '../src/compliance.js';
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
 
 const program = new Command();
 
 program
-  .name('doorman')
+  .name('getdoorman')
   .description('Find security issues. Tell your AI to fix them.')
-  .version('1.0.0');
+  .version(pkg.version);
 
 program
   .command('check')
@@ -53,7 +59,7 @@ program
 
       // After first scan: add CLAUDE.md, offer hooks, collect email
       if (!options.ci && !options.quiet && !options.json && !options.sarif && !options.html && !options.silent) {
-        const { isFirstScan, installClaudeMd, installAgentsMd, installCursorRules, installClaudeHook, installGitHook } = await import('../src/hooks.js');
+        const { isFirstScan, installClaudeMd, installAgentsMd, installCursorRules, installClaudeHook } = await import('../src/hooks.js');
         const { loadAuth, saveAuth } = await import('../src/auth.js');
         const { resolve } = await import('path');
         const resolvedPath = resolve(path);
@@ -61,19 +67,20 @@ program
         if (isFirstScan(resolvedPath)) {
           const chalk = (await import('chalk')).default;
 
-          // Add to all AI tool config files (viral growth)
+          // Add Doorman instructions to AI config files (only appends, never overwrites)
           const claudeMd = installClaudeMd(resolvedPath);
           const agentsMd = installAgentsMd(resolvedPath);
           const cursorRules = installCursorRules(resolvedPath);
-          if (claudeMd) console.log(chalk.green('  ✓ Added to CLAUDE.md (Claude will suggest Doorman)'));
-          if (agentsMd) console.log(chalk.green('  ✓ Added to AGENTS.md (Codex will suggest Doorman)'));
-          if (cursorRules) console.log(chalk.green('  ✓ Added to .cursorrules (Cursor will suggest Doorman)'));
+          if (claudeMd) console.log(chalk.dim('  Added Doorman to CLAUDE.md'));
+          if (agentsMd) console.log(chalk.dim('  Added Doorman to AGENTS.md'));
+          if (cursorRules) console.log(chalk.dim('  Added Doorman to .cursorrules'));
 
-          // Install hooks
+          // Auto-run hook for Claude Code (non-blocking, just a scan)
           const hookInstalled = installClaudeHook(resolvedPath);
-          if (hookInstalled) console.log(chalk.green('  ✓ Auto-run enabled — scans after every file edit'));
-          const gitInstalled = installGitHook(resolvedPath);
-          if (gitInstalled) console.log(chalk.green('  ✓ Pre-commit hook installed'));
+          if (hookInstalled) console.log(chalk.dim('  Auto-run enabled for Claude Code'));
+
+          // NOTE: No pre-commit hook on first scan — too aggressive.
+          // Users can opt in with: npx getdoorman init
 
           // Collect email
           const auth = loadAuth();

package/bin/getdoorman.js

@@ -3,13 +3,19 @@
 import { Command } from 'commander';
 import { check } from '../src/index.js';
 import { generateReport } from '../src/compliance.js';
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
 
 const program = new Command();
 
 program
-  .name('doorman')
+  .name('getdoorman')
   .description('Find security issues. Tell your AI to fix them.')
-  .version('1.0.0');
+  .version(pkg.version);
 
 program
   .command('check')
@@ -53,7 +59,7 @@ program
 
       // After first scan: add CLAUDE.md, offer hooks, collect email
       if (!options.ci && !options.quiet && !options.json && !options.sarif && !options.html && !options.silent) {
-        const { isFirstScan, installClaudeMd, installAgentsMd, installCursorRules, installClaudeHook, installGitHook } = await import('../src/hooks.js');
+        const { isFirstScan, installClaudeMd, installAgentsMd, installCursorRules, installClaudeHook } = await import('../src/hooks.js');
         const { loadAuth, saveAuth } = await import('../src/auth.js');
         const { resolve } = await import('path');
         const resolvedPath = resolve(path);
@@ -61,19 +67,20 @@ program
         if (isFirstScan(resolvedPath)) {
           const chalk = (await import('chalk')).default;
 
-          // Add to all AI tool config files (viral growth)
+          // Add Doorman instructions to AI config files (only appends, never overwrites)
           const claudeMd = installClaudeMd(resolvedPath);
           const agentsMd = installAgentsMd(resolvedPath);
           const cursorRules = installCursorRules(resolvedPath);
-          if (claudeMd) console.log(chalk.green('  ✓ Added to CLAUDE.md (Claude will suggest Doorman)'));
-          if (agentsMd) console.log(chalk.green('  ✓ Added to AGENTS.md (Codex will suggest Doorman)'));
-          if (cursorRules) console.log(chalk.green('  ✓ Added to .cursorrules (Cursor will suggest Doorman)'));
+          if (claudeMd) console.log(chalk.dim('  Added Doorman to CLAUDE.md'));
+          if (agentsMd) console.log(chalk.dim('  Added Doorman to AGENTS.md'));
+          if (cursorRules) console.log(chalk.dim('  Added Doorman to .cursorrules'));
 
-          // Install hooks
+          // Auto-run hook for Claude Code (non-blocking, just a scan)
           const hookInstalled = installClaudeHook(resolvedPath);
-          if (hookInstalled) console.log(chalk.green('  ✓ Auto-run enabled — scans after every file edit'));
-          const gitInstalled = installGitHook(resolvedPath);
-          if (gitInstalled) console.log(chalk.green('  ✓ Pre-commit hook installed'));
+          if (hookInstalled) console.log(chalk.dim('  Auto-run enabled for Claude Code'));
+
+          // NOTE: No pre-commit hook on first scan — too aggressive.
+          // Users can opt in with: npx getdoorman init
 
           // Collect email
           const auth = loadAuth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getdoorman",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Zero-config security scanner for AI-assisted development. 2000+ rules, 11 languages, 4 detection engines.",
   "main": "src/index.js",
   "exports": {
@@ -36,11 +36,11 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/tiago520/VoiceAI.git"
+    "url": "https://doorman.sh"
   },
-  "homepage": "https://github.com/tiago520/VoiceAI#readme",
+  "homepage": "https://doorman.sh",
   "bugs": {
-    "url": "https://github.com/tiago520/VoiceAI/issues"
+    "url": "https://doorman.sh"
   },
   "files": [
     "src/",

package/src/auth.js

@@ -12,12 +12,12 @@ const PLANS = {
     categories: ['security', 'bugs'],
   },
   pro: {
-    name: 'Pro', price: '$20/mo', maxScans: Infinity,
+    name: 'Pro', price: 'coming soon', maxScans: Infinity,
     categories: ['security', 'bugs', 'performance', 'reliability', 'cost', 'data', 'quality'],
     dashboard: true, autoRun: true, cicd: true,
   },
   enterprise: {
-    name: 'Enterprise', price: '$100/mo', maxScans: Infinity,
+    name: 'Enterprise', price: 'coming soon', maxScans: Infinity,
     categories: 'all',
     dashboard: true, autoRun: true, cicd: true,
     compliance: true, teamDashboard: true, prComments: true, slack: true, customRules: true,

package/src/compliance.js

@@ -1,3 +1,4 @@
+import { VERSION } from './version.js';
 import { writeFileSync } from 'fs';
 import { resolve } from 'path';
 
@@ -421,7 +422,7 @@ export function generateReport(scanResult, options = {}) {
     <tr><td>Project</td><td>${escapeHtml(projectName)}</td></tr>
     <tr><td>Detected Stack</td><td>${escapeHtml(stackLabel)}</td></tr>
     <tr><td>Total Findings</td><td>${findings.length}</td></tr>
-    <tr><td>Doorman Version</td><td>v1.0.0</td></tr>
+    <tr><td>Doorman Version</td><td>v${VERSION}</td></tr>
   </table>
 
   <div class="section">
@@ -486,7 +487,7 @@ export function generateReport(scanResult, options = {}) {
 
   <div class="attestation">
     <strong>Attestation</strong><br>
-    This report was generated by Doorman v1.0.0 on ${escapeHtml(reportTime)}. The findings
+    This report was generated by Doorman v${VERSION} on ${escapeHtml(reportTime)}. The findings
     reflect an automated analysis of the project source code at the time of the scan. This report
     is intended to support compliance efforts and should be reviewed by a qualified auditor before
     being used as evidence for certification or regulatory purposes.

package/src/hooks.js

@@ -90,23 +90,15 @@ npx getdoorman check --quiet --ci
  */
 export function installClaudeMd(targetPath) {
   const claudeMdPath = join(targetPath, 'CLAUDE.md');
-  const doormanBlock = `
-## Doorman — Code Safety
-
-Before shipping or when asked to check code safety, run:
-\`\`\`bash
-npx getdoorman check
-\`\`\`
-
-To fix issues, run \`npx getdoorman fix critical\` and follow the instructions.
-`;
+  const doormanLine = '\n# Run `npx getdoorman check` before shipping to find security issues.\n';
 
   if (existsSync(claudeMdPath)) {
     const content = readFileSync(claudeMdPath, 'utf-8');
     if (content.includes('doorman') || content.includes('getdoorman')) return false;
-    writeFileSync(claudeMdPath, content + '\n' + doormanBlock);
+    // Append one line — don't overwrite existing content
+    writeFileSync(claudeMdPath, content + doormanLine);
   } else {
-    writeFileSync(claudeMdPath, doormanBlock.trimStart());
+    writeFileSync(claudeMdPath, doormanLine.trimStart());
   }
   return true;
 }
@@ -116,23 +108,14 @@ To fix issues, run \`npx getdoorman fix critical\` and follow the instructions.
  */
 export function installAgentsMd(targetPath) {
   const agentsMdPath = join(targetPath, 'AGENTS.md');
-  const doormanBlock = `
-## Doorman — Code Safety
-
-Before shipping or when asked to check code safety, run:
-\`\`\`bash
-npx getdoorman check
-\`\`\`
-
-To fix issues, run \`npx getdoorman fix critical\` and follow the instructions.
-`;
+  const doormanLine = '\n# Run `npx getdoorman check` before shipping to find security issues.\n';
 
   if (existsSync(agentsMdPath)) {
     const content = readFileSync(agentsMdPath, 'utf-8');
     if (content.includes('doorman') || content.includes('getdoorman')) return false;
-    writeFileSync(agentsMdPath, content + '\n' + doormanBlock);
+    writeFileSync(agentsMdPath, content + doormanLine);
   } else {
-    writeFileSync(agentsMdPath, doormanBlock.trimStart());
+    writeFileSync(agentsMdPath, doormanLine.trimStart());
   }
   return true;
 }
@@ -142,18 +125,15 @@ To fix issues, run \`npx getdoorman fix critical\` and follow the instructions.
  */
 export function installCursorRules(targetPath) {
   const cursorPath = join(targetPath, '.cursorrules');
-  const doormanBlock = `
-# Doorman — Code Safety
-Before shipping or when asked to check code safety, run: npx getdoorman check
-To fix issues, run: npx getdoorman fix critical
-`;
+  const doormanLine = '\n# Run `npx getdoorman check` before shipping to find security issues.\n';
 
   if (existsSync(cursorPath)) {
     const content = readFileSync(cursorPath, 'utf-8');
     if (content.includes('doorman') || content.includes('getdoorman')) return false;
-    writeFileSync(cursorPath, content + '\n' + doormanBlock);
+    writeFileSync(cursorPath, content + doormanLine);
   } else {
-    writeFileSync(cursorPath, doormanBlock.trimStart());
+    // Don't create .cursorrules if it doesn't exist — too invasive
+    return false;
   }
   return true;
 }

package/src/reporter.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import { writeFileSync } from 'fs';
+import { VERSION } from './version.js';
 
 const SEVERITY_COLORS = {
   critical: chalk.bgRed.white.bold,
@@ -406,7 +407,7 @@ export function printReport(findings, stack, score, options = {}) {
 
   console.log('');
   console.log(chalk.bold.cyan('\u2501'.repeat(60)));
-  console.log(chalk.bold.cyan('  Doorman v1.0.0 \u2014 Scan Results'));
+  console.log(chalk.bold.cyan(`  Doorman v 2014 Scan Results`));
   console.log(chalk.bold.cyan('\u2501'.repeat(60)));
   console.log('');
 
@@ -556,7 +557,7 @@ function printVibeCoderReport(visible, score, hiddenCategoryCount = 0, proUnlock
   // --- Upsell ---
   if (proUnlockCount > 0) {
     console.log(chalk.cyan(`  🔒 ${proUnlockCount} more issues in performance, cost, reliability, data...`));
-    console.log(chalk.gray('     Upgrade to Pro ($20/mo) to see all categories + unlimited fixes.'));
+    console.log(chalk.gray('     Upgrade to Pro to see all categories. Coming soon at doorman.sh.'));
     console.log('');
   }
   if (enterpriseUnlockCount > 0 && proUnlockCount === 0) {
@@ -575,7 +576,7 @@ export function generateJSON(findings, stack, score, metadata = {}) {
   const categoryCounts = countByCategory(findings);
 
   return {
-    version: '1.0.0',
+    version: VERSION,
     timestamp: new Date().toISOString(),
     score,
     summary: {
@@ -695,8 +696,8 @@ export function generateSARIF(findings, stack, score, metadata = {}) {
         tool: {
           driver: {
             name: 'Doorman',
-            version: '1.0.0',
-            informationUri: 'https://github.com/tiago520/VoiceAI',
+            version: VERSION,
+            informationUri: 'https://doorman.sh',
             rules,
           },
         },
@@ -886,7 +887,7 @@ export function generateHTML(findings, stack, score, metadata = {}) {
     </table>
   </div>
 
-  <p class="meta">Generated by Doorman v1.0.0</p>
+  <p class="meta">Generated by Doorman v</p>
 </div>
 
 <script>

package/src/rules/bugs/nextjs-bugs.js

@@ -20,7 +20,9 @@ const rules = [
         if (hasUseClient) continue;
         const lines = content.split('\n');
         for (let i = 0; i < lines.length; i++) {
-          if (/\b(window|document|localStorage|sessionStorage|navigator|location\.href|addEventListener)\b/.test(lines[i]) && !/typeof\s+(window|document)/.test(lines[i]) && !/\/\//.test(lines[i].split(/window|document/)[0])) {
+          // Skip API route files — request.signal, addEventListener are valid server-side
+          if (/\/api\//.test(fp) || /route\.(ts|js)$/.test(fp)) continue;
+          if (/\b(window|document|localStorage|sessionStorage|navigator)\b/.test(lines[i]) && !/typeof\s+(window|document)/.test(lines[i]) && !/\/\//.test(lines[i].split(/window|document/)[0]) && !/request\.signal|AbortSignal|abortController/i.test(lines[i])) {
             findings.push({
               ruleId: 'BUG-NEXT-001', category: 'bugs', severity: 'high',
               title: 'Browser API used in server component — will crash at build time',

package/src/rules/scope-rules.js

@@ -596,7 +596,7 @@ const rules = [
         for (let i = 0; i < lines.length; i++) {
           const lineNum = i + 1;
           if (scope.isInsideComment(lineNum) || scope.isInsideString(lineNum)) continue;
-          if (/\b(eval|Function)\s*\(/.test(lines[i]) || /\bexec\s*\(/.test(lines[i])) {
+          if (/\b(eval|Function)\s*\(/.test(lines[i]) || /\b(child_process\.|execSync|execFileSync)\s*\(/.test(lines[i]) || /(?<!\w\.)\bexec\s*\(/.test(lines[i]) && !/\.exec\s*\(/.test(lines[i])) {
             if (!hasSandbox) {
               findings.push({
                 ruleId: this.id, category: this.category, severity: this.severity,

package/src/rules/security/injection.js

@@ -1295,13 +1295,16 @@ rules.push({
   title: 'SQL Injection via template literal in query string',
   check({ files }) {
     const findings = [];
-    const p = /['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE|CREATE|DROP|ALTER)\s[^'"`]*\$\{/i;
+    // Must have SQL keyword + SQL clause keyword (FROM/INTO/SET/WHERE/VALUES/TABLE) + ${interpolation}
+    const p = /`\s*(?:SELECT\s.*\sFROM|INSERT\s.*\sINTO|UPDATE\s.*\sSET|DELETE\s.*\sFROM|CREATE\s.*\sTABLE|DROP\s.*\sTABLE|ALTER\s.*\sTABLE)[^`]*\$\{/i;
     for (const [path, content] of files) {
       if (SKIP_PATH.test(path) || !isJS(path)) continue;
       const lines = content.split('\n');
       for (let i = 0; i < lines.length; i++) {
         if (COMMENT_LINE.test(lines[i])) continue;
-        if (p.test(lines[i])) findings.push({ ruleId: 'SEC-INJ-041', category: 'security', severity: 'critical', title: 'SQL built with template literal — injection risk', description: 'Template literals in SQL strings allow injection when they contain user input. Use parameterized queries.', file: path, line: i + 1, fix: null });
+        // Check current line + next 2 lines (SQL queries often span multiple lines)
+        const block = lines.slice(i, i + 3).join(' ');
+        if (p.test(block)) findings.push({ ruleId: 'SEC-INJ-041', category: 'security', severity: 'critical', title: 'SQL built with template literal — injection risk', description: 'Template literals in SQL strings allow injection when they contain user input. Use parameterized queries.', file: path, line: i + 1, fix: null });
       }
     }
     return findings;

package/src/rules/security/mcp-server.js

@@ -47,7 +47,7 @@ const rules = [
   { id: 'SEC-MCP-028', category: 'security', severity: 'low', confidence: 'suggestion', title: 'MCP description leaks impl', check({ files }) { return checkAll(this, files, /description:\s*['"].*(?:database|internal|private)/i); } },
   { id: 'SEC-MCP-029', category: 'security', severity: 'medium', confidence: 'likely', title: 'MCP cross-tool data leak', check({ files }) { return checkAll(this, files, /(?:global|globalThis)\.\w+.*=.*(?:params|args)\./); } },
   { id: 'SEC-MCP-030', category: 'security', severity: 'medium', confidence: 'suggestion', title: 'MCP debug mode enabled', check({ files }) { return checkAll(this, files, /(?:debug|verbose)\s*[:=]\s*true/); } },
-  { id: 'SEC-MCP-031', category: 'security', severity: 'critical', confidence: 'likely', title: 'MCP shell injection', check({ files }) { return checkAll(this, files, /exec\(\s*`[^`]*\$\{(?:params|args|input)\./); } },
+  { id: 'SEC-MCP-031', category: 'security', severity: 'critical', confidence: 'likely', title: 'MCP shell injection', check({ files }) { return checkAll(this, files, /(?:child_process\.|execSync|execFile)\s*\(\s*`[^`]*\$\{(?:params|args|input)\./); } },
   { id: 'SEC-MCP-032', category: 'security', severity: 'critical', confidence: 'likely', title: 'MCP template injection', check({ files }) { return checkAll(this, files, /(?:render|compile|template)\(\s*(?:params|args|input)\./); } },
   { id: 'SEC-MCP-033', category: 'security', severity: 'high', confidence: 'likely', title: 'MCP LDAP injection', check({ files }) { return checkAll(this, files, /(?:ldap|LDAP).*(?:search|bind).*(?:params|args)\./); } },
   { id: 'SEC-MCP-034', category: 'security', severity: 'high', confidence: 'likely', title: 'MCP XML injection', check({ files }) { return checkAll(this, files, /[<].*\$\{(?:params|args|input)\./); } },

package/src/rules/security/ssrf.js

@@ -49,10 +49,20 @@ const rules = [
     check({ files }) {
       const findings = [];
       const pattern = /(?:fetch|axios\.get|axios\.post|axios\.put|axios\.delete|axios\.request|axios\(|http\.get|http\.request|https\.get|https\.request|got\(|got\.get|request\(|needle\(|superagent\.get)\s*\(\s*(?:req\.body|req\.query|req\.params|userUrl|url|targetUrl|input)\b/;
+      const validationContext = /validateUrl|isValidUrl|allowedDomains|urlAllowlist|safeUrl|URL\.parse|new URL\(|protocol\s*[!=]==|hostname\s*[!=]==|startsWith\s*\(\s*['"]https/i;
       for (const [path, content] of files) {
         if (SKIP_PATH.test(path)) continue;
         if (isJS(path)) {
-          findings.push(...scanLines(content, pattern, path, this));
+          const lines = content.split('\n');
+          for (let i = 0; i < lines.length; i++) {
+            if (pattern.test(lines[i])) {
+              // Check surrounding 10 lines for URL validation
+              const context = lines.slice(Math.max(0, i - 10), i + 5).join('\n');
+              if (!validationContext.test(context)) {
+                findings.push({ ruleId: this.id, category: this.category, severity: this.severity, title: this.title, description: this.description, confidence: this.confidence, file: path, line: i + 1, fix: this.fix });
+              }
+            }
+          }
         }
       }
       return findings;
@@ -95,10 +105,16 @@ const rules = [
     check({ files }) {
       const findings = [];
       const pattern = /169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com/;
+      const blocklistContext = /block|deny|forbidden|not.?allowed|invalid|reject|blacklist|safelist|denylist|disallow|banned|BLOCKED/i;
       for (const [path, content] of files) {
         if (SKIP_PATH.test(path)) continue;
         if (isJS(path)) {
-          findings.push(...scanLines(content, pattern, path, this));
+          const lines = content.split('\n');
+          for (let i = 0; i < lines.length; i++) {
+            if (pattern.test(lines[i]) && !blocklistContext.test(lines[i])) {
+              findings.push({ ruleId: this.id, category: this.category, severity: this.severity, title: this.title, description: this.description, confidence: this.confidence, file: path, line: i + 1, fix: this.fix });
+            }
+          }
         }
       }
       return findings;

package/src/scanner.js

@@ -8,8 +8,7 @@ import { Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
 import { join, relative, dirname } from 'path';
 import { loadIgnorePatterns } from './ignore.js';
-
-const DOORMAN_VERSION = '1.0.0';
+import { VERSION as DOORMAN_VERSION } from './version.js';
 
 const SOURCE_PATTERNS = [
   '**/*.js',

package/src/telemetry.js

@@ -29,6 +29,7 @@
 // ---------------------------------------------------------------------------
 
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
+import { VERSION } from './version.js';
 import { join } from 'path';
 import { createHash } from 'crypto';
 import { execSync } from 'child_process';
@@ -88,7 +89,7 @@ export function getAnonymousId(targetPath) {
  */
 export function buildPayload(scanResult, stack) {
   return {
-    version: '1.0.0',
+    version: VERSION,
     timestamp: new Date().toISOString(),
     // What stack (generic, not specific project)
     stack: {

package/src/version.js

@@ -0,0 +1,8 @@
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
+
+export const VERSION = pkg.version;