guardvibe 1.3.3 → 1.5.0

package/build/tools/taint-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-analysis.d.ts","sourceRoot":"","sources":["../../src/tools/taint-analysis.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAqGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAsE3E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAyCjG"}

package/build/tools/taint-analysis.js

@@ -0,0 +1,183 @@
+// guardvibe-ignore — this file defines taint analysis patterns, not vulnerable code
+/**
+ * Basic taint analysis — tracks user input flowing into dangerous sinks.
+ * Not a full AST/CFG analysis, but follows variable assignments through lines.
+ */
+// User input sources (tainted data entry points)
+const TAINT_SOURCES = [
+    { pattern: /(?:req|request)\.(?:body|query|params|headers|cookies)\b/g, type: "http-input" },
+    { pattern: /(?:formData|searchParams)\.get\s*\(/g, type: "form-input" },
+    { pattern: /(?:params|searchParams)\s*[\.\[]/g, type: "url-params" },
+    { pattern: /(?:await\s+)?(?:request|req)\.(?:json|text|formData)\s*\(\)/g, type: "request-body" },
+    { pattern: /new\s+URL\s*\([\s\S]*?(?:req|request)/g, type: "url-input" },
+    { pattern: /(?:event|e)\.(?:target|currentTarget)\.(?:value|textContent|innerHTML)/g, type: "dom-input" },
+];
+// Dangerous sinks (where tainted data causes damage)
+const TAINT_SINKS = [
+    { pattern: /\beval\s*\(/g, type: "code-injection", severity: "critical",
+        description: "User input flows into eval(), enabling arbitrary code execution.",
+        fix: "Never use eval() with user input. Use JSON.parse() for data or a sandboxed interpreter." },
+    { pattern: /\.(?:query|execute|raw)\s*\(\s*`/g, type: "sql-injection", severity: "critical",
+        description: "User input interpolated into SQL query template literal, enabling SQL injection.",
+        fix: "Use parameterized queries: db.query('SELECT * FROM t WHERE id = $1', [id])" },
+    { pattern: /\.(?:query|execute|raw)\s*\(\s*["'][\s\S]*?\$\{/g, type: "sql-injection", severity: "critical",
+        description: "User input interpolated into SQL query string, enabling SQL injection.",
+        fix: "Use parameterized queries with placeholder values, never string interpolation." },
+    { pattern: /\.(?:query|execute)\s*\(\s*(?:["'][\s\S]*?\+|[\w]+\s*\+)/g, type: "sql-injection", severity: "critical",
+        description: "User input concatenated into SQL query, enabling SQL injection.",
+        fix: "Use parameterized queries. Never concatenate user input into SQL strings." },
+    { pattern: /redirect\s*\(/g, type: "open-redirect", severity: "medium",
+        description: "User input flows into redirect target, enabling phishing via open redirect.",
+        fix: "Validate redirect URLs against an allowlist of trusted domains." },
+    { pattern: /\.(?:innerHTML|outerHTML)\s*=/g, type: "xss", severity: "high",
+        description: "User input assigned to innerHTML, enabling cross-site scripting.",
+        fix: "Use textContent instead of innerHTML, or sanitize with DOMPurify." },
+    { pattern: /new\s+Function\s*\(/g, type: "code-injection", severity: "critical",
+        description: "User input flows into Function constructor, enabling arbitrary code execution.",
+        fix: "Never construct functions from user input. Use a safe evaluator or predefined functions." },
+    { pattern: /writeFileSync?\s*\(/g, type: "path-traversal", severity: "high",
+        description: "User input flows into file write path, enabling arbitrary file overwrite.",
+        fix: "Validate and sanitize file paths. Use path.resolve() and verify the result is within allowed directories." },
+    { pattern: /readFileSync?\s*\(/g, type: "path-traversal", severity: "high",
+        description: "User input flows into file read path, enabling directory traversal and sensitive file access.",
+        fix: "Validate file paths against an allowlist. Use path.resolve() and check prefix." },
+];
+function extractAssignments(lines) {
+    const assignments = [];
+    const assignPattern = /(?:const|let|var)\s+([\w]+)\s*=\s*(.*)/;
+    for (let i = 0; i < lines.length; i++) {
+        const match = assignPattern.exec(lines[i]);
+        if (!match)
+            continue;
+        const varName = match[1];
+        const value = match[2];
+        let tainted = false;
+        let sourceType;
+        for (const source of TAINT_SOURCES) {
+            source.pattern.lastIndex = 0;
+            if (source.pattern.test(value)) {
+                tainted = true;
+                sourceType = source.type;
+                break;
+            }
+        }
+        assignments.push({ name: varName, line: i + 1, tainted, sourceType });
+    }
+    return assignments;
+}
+function propagateTaint(assignments, lines) {
+    let changed = true;
+    let iterations = 0;
+    while (changed && iterations < 10) {
+        changed = false;
+        iterations++;
+        const taintedNames = new Set(assignments.filter(a => a.tainted).map(a => a.name));
+        for (const assignment of assignments) {
+            if (assignment.tainted)
+                continue;
+            const lineContent = lines[assignment.line - 1] ?? "";
+            for (const name of taintedNames) {
+                if (lineContent.includes(name) && name !== assignment.name) {
+                    assignment.tainted = true;
+                    assignment.sourceType = "propagated";
+                    changed = true;
+                    break;
+                }
+            }
+        }
+    }
+}
+export function analyzeTaint(code, language) {
+    if (!["javascript", "typescript"].includes(language))
+        return [];
+    const lines = code.split("\n");
+    const findings = [];
+    const assignments = extractAssignments(lines);
+    propagateTaint(assignments, lines);
+    const taintedVars = assignments.filter(a => a.tainted);
+    // Check if tainted variables reach sinks
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const sink of TAINT_SINKS) {
+            sink.pattern.lastIndex = 0;
+            if (!sink.pattern.test(line))
+                continue;
+            for (const tVar of taintedVars) {
+                if (line.includes(tVar.name)) {
+                    const chain = [];
+                    chain.push(`[SOURCE] ${tVar.sourceType} -> ${tVar.name} (line ${tVar.line})`);
+                    const intermediates = assignments.filter(a => a.tainted && a.sourceType === "propagated" &&
+                        a.line > tVar.line && a.line <= i + 1);
+                    for (const inter of intermediates) {
+                        if (line.includes(inter.name)) {
+                            chain.push(`[PROP] -> ${inter.name} (line ${inter.line})`);
+                        }
+                    }
+                    chain.push(`[SINK] ${sink.type} (line ${i + 1})`);
+                    findings.push({
+                        source: { type: tVar.sourceType, line: tVar.line, variable: tVar.name },
+                        sink: { type: sink.type, line: i + 1, code: line.trim().substring(0, 100) },
+                        chain, severity: sink.severity,
+                        description: sink.description, fix: sink.fix,
+                    });
+                }
+            }
+        }
+    }
+    // Detect direct inline taint (source directly in sink line)
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const sink of TAINT_SINKS) {
+            sink.pattern.lastIndex = 0;
+            if (!sink.pattern.test(line))
+                continue;
+            for (const source of TAINT_SOURCES) {
+                source.pattern.lastIndex = 0;
+                if (source.pattern.test(line)) {
+                    const alreadyReported = findings.some(f => f.sink.line === i + 1 && f.sink.type === sink.type);
+                    if (alreadyReported)
+                        continue;
+                    findings.push({
+                        source: { type: source.type, line: i + 1, variable: "(inline)" },
+                        sink: { type: sink.type, line: i + 1, code: line.trim().substring(0, 100) },
+                        chain: [`[SOURCE->SINK] ${source.type} -> ${sink.type} (line ${i + 1})`],
+                        severity: sink.severity,
+                        description: sink.description, fix: sink.fix,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+export function formatTaintFindings(findings, format) {
+    if (format === "json") {
+        return JSON.stringify({
+            summary: {
+                total: findings.length,
+                critical: findings.filter(f => f.severity === "critical").length,
+                high: findings.filter(f => f.severity === "high").length,
+                medium: findings.filter(f => f.severity === "medium").length,
+            },
+            findings: findings.map(f => ({
+                severity: f.severity, source: f.source, sink: f.sink,
+                chain: f.chain, description: f.description, fix: f.fix,
+            })),
+        });
+    }
+    if (findings.length === 0)
+        return "";
+    const lines = [
+        `## Dataflow Analysis`,
+        ``,
+        `Found ${findings.length} tainted data flow(s):`,
+        ``,
+    ];
+    const severityOrder = { critical: 0, high: 1, medium: 2 };
+    findings.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+    for (const f of findings) {
+        lines.push(`### [${f.severity.toUpperCase()}] ${f.sink.type}`, `**Flow:** ${f.source.type} (line ${f.source.line}) -> ${f.sink.type} (line ${f.sink.line})`, `**Variable:** \`${f.source.variable}\``, `**Sink code:** \`${f.sink.code}\``, `${f.description}`, `**Fix:** ${f.fix}`, ``);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=taint-analysis.js.map

package/build/tools/taint-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-analysis.js","sourceRoot":"","sources":["../../src/tools/taint-analysis.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF;;;GAGG;AAWH,iDAAiD;AACjD,MAAM,aAAa,GAAG;IACpB,EAAE,OAAO,EAAE,2DAA2D,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5F,EAAE,OAAO,EAAE,sCAAsC,EAAE,IAAI,EAAE,YAAY,EAAE;IACvE,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,YAAY,EAAE;IACpE,EAAE,OAAO,EAAE,8DAA8D,EAAE,IAAI,EAAE,cAAc,EAAE;IACjG,EAAE,OAAO,EAAE,wCAAwC,EAAE,IAAI,EAAE,WAAW,EAAE;IACxE,EAAE,OAAO,EAAE,yEAAyE,EAAE,IAAI,EAAE,WAAW,EAAE;CAC1G,CAAC;AAEF,qDAAqD;AACrD,MAAM,WAAW,GAAG;IAClB,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAmB;QAC9E,WAAW,EAAE,kEAAkE;QAC/E,GAAG,EAAE,yFAAyF,EAAE;IAClG,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAmB;QAClG,WAAW,EAAE,kFAAkF;QAC/F,GAAG,EAAE,4EAA4E,EAAE;IACrF,EAAE,OAAO,EAAE,kDAAkD,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAmB;QACjH,WAAW,EAAE,wEAAwE;QACrF,GAAG,EAAE,gFAAgF,EAAE;IACzF,EAAE,OAAO,EAAE,2DAA2D,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAmB;QAC1H,WAAW,EAAE,iEAAiE;QAC9E,GAAG,EAAE,2EAA2E,EAAE;IACpF,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAiB;QAC7E,WAAW,EAAE,6EAA6E;QAC1F,GAAG,EAAE,iEAAiE,EAAE;IAC1E,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAe;QACjF,WAAW,EAAE,kEAAkE;QAC/E,GAAG,EAAE,mEAAmE,EAAE;IAC5E,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAmB;QACtF,WAAW,EAAE,gFAAgF;QAC7F,GAAG,EAAE,0FAA0F,EAAE;IACnG,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAe;QAClF,WAAW,EAAE,2EAA2E;QACxF,GAAG,EAAE,2GAA2G,EAAE;IACpH,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAe;QACjF,WAAW,EAAE,+FAA+F;QAC5G,GAAG,EAAE,gFAAgF,EAAE;CAC1F,CAAC;AASF,SAAS,kBAAkB,CAAC,KAAe;IACzC,MAAM,WAAW,GAAyB,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,wCAAwC,CAAC;IAE/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEvB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,UAA8B,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAC7B,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,GAAG,IAAI,CAAC;gBACf,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM;YACR,CAAC;QACH,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,WAAiC,EAAE,KAAe;IACxE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,OAAO,OAAO,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC;QAChB,UAAU,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAElF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,UAAU,CAAC,OAAO;gBAAE,SAAS;YACjC,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACrD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;oBAC3D,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;oBAC1B,UAAU,CAAC,UAAU,GAAG,YAAY,CAAC;oBACrC,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEnC,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEvD,yCAAyC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEvC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;oBAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,OAAO,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;oBAE9E,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY;wBAC1C,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CACtC,CAAC;oBACF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;wBAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC9B,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;wBAC7D,CAAC;oBACH,CAAC;oBACD,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAElD,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;wBACxE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBAC3E,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBAC9B,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG;qBAC7C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEvC,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC7B,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/F,IAAI,eAAe;wBAAE,SAAS;oBAE9B,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE;wBAChE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBAC3E,KAAK,EAAE,CAAC,kBAAkB,MAAM,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;wBACxE,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG;qBAC7C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAwB,EAAE,MAA2B;IACvF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE;gBACP,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;gBAChE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;gBACxD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;aAC7D;YACD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;gBACpD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG;aACvD,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG;QACZ,sBAAsB;QACtB,EAAE;QACF,SAAS,QAAQ,CAAC,MAAM,wBAAwB;QAChD,EAAE;KACH,CAAC;IAEF,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAClF,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAClD,aAAa,CAAC,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAC5F,mBAAmB,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EACxC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EACnC,GAAG,CAAC,CAAC,WAAW,EAAE,EAClB,YAAY,CAAC,CAAC,GAAG,EAAE,EACnB,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/utils/config.d.ts

@@ -1,3 +1,16 @@
+export interface PolicyException {
+    ruleId: string;
+    reason: string;
+    approvedBy?: string;
+    expiresAt?: string;
+    files?: string[];
+}
+export interface CompliancePolicy {
+    frameworks: string[];
+    failOn: "critical" | "high" | "medium" | "low";
+    exceptions: PolicyException[];
+    requiredControls?: string[];
+}
 export interface GuardVibeConfig {
     rules: {
         disable: string[];
@@ -8,6 +21,7 @@ export interface GuardVibeConfig {
         maxFileSize: number;
     };
     plugins: string[];
+    compliance?: CompliancePolicy;
 }
 export declare function loadConfig(dir?: string): GuardVibeConfig;
 export declare function resetConfigCache(): void;

package/build/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAkBD,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe,CA6BxD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC/C,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAmBD,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe,CAmCxD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/build/utils/config.js

@@ -4,6 +4,7 @@ const DEFAULT_CONFIG = {
     rules: { disable: [], severity: {} },
     scan: { exclude: [], maxFileSize: 500 * 1024 },
     plugins: [],
+    compliance: undefined,
 };
 const configCache = new Map();
 function cloneDefaultConfig() {
@@ -35,6 +36,12 @@ export function loadConfig(dir) {
                     ? parsed.scan.maxFileSize : DEFAULT_CONFIG.scan.maxFileSize,
             },
             plugins: Array.isArray(parsed.plugins) ? parsed.plugins : [],
+            compliance: parsed.compliance ? {
+                frameworks: Array.isArray(parsed.compliance.frameworks) ? parsed.compliance.frameworks : [],
+                failOn: parsed.compliance.failOn ?? "high",
+                exceptions: Array.isArray(parsed.compliance.exceptions) ? parsed.compliance.exceptions : [],
+                requiredControls: Array.isArray(parsed.compliance.requiredControls) ? parsed.compliance.requiredControls : undefined,
+            } : undefined,
         };
     }
     catch { }

package/build/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAcrC,MAAM,cAAc,GAAoB;IACtC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACpC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE;IAC9C,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEvD,SAAS,kBAAkB;IACzB,OAAO;QACL,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE;QACrG,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE;QACjG,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,cAAc,GAAG,kBAAkB,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,cAAc,GAAG;YACf,KAAK,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACzE,QAAQ,EAAE,OAAO,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI;oBACpF,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;aAC/B;YACD,IAAI,EAAE;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACvE,WAAW,EAAE,OAAO,MAAM,CAAC,IAAI,EAAE,WAAW,KAAK,QAAQ;oBACvD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW;aAC9D;YACD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC3C,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA8BrC,MAAM,cAAc,GAAoB;IACtC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACpC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE;IAC9C,OAAO,EAAE,EAAE;IACX,UAAU,EAAE,SAAS;CACtB,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEvD,SAAS,kBAAkB;IACzB,OAAO;QACL,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE;QACrG,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE;QACjG,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,cAAc,GAAG,kBAAkB,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,cAAc,GAAG;YACf,KAAK,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACzE,QAAQ,EAAE,OAAO,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI;oBACpF,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;aAC/B;YACD,IAAI,EAAE;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACvE,WAAW,EAAE,OAAO,MAAM,CAAC,IAAI,EAAE,WAAW,KAAK,QAAQ;oBACvD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW;aAC9D;YACD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC5D,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9B,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;gBAC3F,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,MAAM;gBAC1C,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;gBAC3F,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;aACrH,CAAC,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC3C,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "guardvibe",
-  "version": "1.3.3",
-  "description": "Security MCP for vibe coding. 239 rules for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
+  "version": "1.5.0",
+  "description": "Security MCP for vibe coding. 239 rules, 14 tools for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",
   "bin": {
     "guardvibe": "build/index.js",