guardvibe 1.4.0 → 1.5.0

package/build/tools/policy-check.js

@@ -0,0 +1,208 @@
+import { readdirSync, readFileSync, statSync } from "fs";
+import { join, extname, basename, resolve } from "path";
+import { analyzeCode } from "./check-code.js";
+import { loadConfig } from "../utils/config.js";
+const EXTENSION_MAP = {
+    ".js": "javascript", ".jsx": "javascript", ".mjs": "javascript", ".cjs": "javascript",
+    ".ts": "typescript", ".tsx": "typescript", ".mts": "typescript", ".cts": "typescript",
+    ".py": "python", ".go": "go", ".html": "html",
+    ".sql": "sql", ".sh": "shell", ".bash": "shell",
+    ".yml": "yaml", ".yaml": "yaml", ".tf": "terraform",
+    ".toml": "toml", ".json": "json",
+};
+const CONFIG_FILE_MAP = {
+    "vercel.json": "vercel-config",
+    "next.config.js": "nextjs-config", "next.config.mjs": "nextjs-config", "next.config.ts": "nextjs-config",
+    "docker-compose.yml": "docker-compose", "docker-compose.yaml": "docker-compose",
+};
+const DEFAULT_EXCLUDES = new Set([
+    "node_modules", ".git", "build", "dist", "vendor", "__pycache__",
+    ".next", ".nuxt", "coverage", ".turbo",
+]);
+function walkDir(dir, excludes, results) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (excludes.has(entry.name))
+            continue;
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory())
+            walkDir(fullPath, excludes, results);
+        else if (entry.isFile()) {
+            const ext = extname(entry.name).toLowerCase();
+            if (EXTENSION_MAP[ext] || entry.name.startsWith("Dockerfile") || CONFIG_FILE_MAP[entry.name]) {
+                results.push(fullPath);
+            }
+        }
+    }
+}
+function isExcepted(ruleId, filePath, exceptions) {
+    for (const exc of exceptions) {
+        if (exc.ruleId !== ruleId && exc.ruleId !== "*")
+            continue;
+        // Check expiration
+        if (exc.expiresAt) {
+            const expiry = new Date(exc.expiresAt);
+            if (expiry < new Date())
+                continue; // expired
+        }
+        // Check file scope
+        if (exc.files && exc.files.length > 0) {
+            const matches = exc.files.some(pattern => {
+                if (pattern.includes("*")) {
+                    const regex = new RegExp(pattern.replace(/\*/g, ".*"));
+                    return regex.test(filePath);
+                }
+                return filePath.includes(pattern);
+            });
+            if (!matches)
+                continue;
+        }
+        return exc;
+    }
+    return null;
+}
+function getControlsForRule(rule, frameworks) {
+    if (!rule.compliance)
+        return [];
+    return rule.compliance.filter(c => {
+        const prefix = c.split(":")[0].toUpperCase();
+        return frameworks.some(f => f.toUpperCase() === prefix || f.toUpperCase() === "ALL");
+    });
+}
+export function policyCheck(path, format = "markdown", rules) {
+    const scanRoot = resolve(path);
+    const config = loadConfig(scanRoot);
+    const policy = config.compliance;
+    if (!policy) {
+        const msg = "No compliance policy defined. Add a `compliance` section to .guardviberc.";
+        if (format === "json")
+            return JSON.stringify({ error: msg });
+        return `# GuardVibe Policy Check\n\n${msg}\n\nExample:\n\`\`\`json\n{\n  "compliance": {\n    "frameworks": ["SOC2", "GDPR"],\n    "failOn": "high",\n    "exceptions": [],\n    "requiredControls": ["SOC2:CC6.1"]\n  }\n}\n\`\`\``;
+    }
+    const excludes = new Set([...DEFAULT_EXCLUDES, ...config.scan.exclude]);
+    const filePaths = [];
+    walkDir(scanRoot, excludes, filePaths);
+    const policyFindings = [];
+    const severityOrder = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+    const failLevel = severityOrder[policy.failOn] ?? 1;
+    for (const filePath of filePaths) {
+        try {
+            const stat = statSync(filePath);
+            if (stat.size > config.scan.maxFileSize)
+                continue;
+            const content = readFileSync(filePath, "utf-8");
+            const ext = extname(filePath).toLowerCase();
+            let language = EXTENSION_MAP[ext];
+            if (!language && basename(filePath).startsWith("Dockerfile"))
+                language = "dockerfile";
+            if (!language)
+                language = CONFIG_FILE_MAP[basename(filePath)];
+            if (!language)
+                continue;
+            const findings = analyzeCode(content, language, undefined, filePath, scanRoot, rules);
+            for (const f of findings) {
+                const controls = getControlsForRule(f.rule, policy.frameworks);
+                if (controls.length === 0)
+                    continue;
+                const exception = isExcepted(f.rule.id, filePath, policy.exceptions);
+                policyFindings.push({
+                    rule: f.rule, match: f.match, line: f.line, filePath,
+                    controls,
+                    excepted: !!exception,
+                    exceptionReason: exception?.reason,
+                });
+            }
+        }
+        catch { /* skip */ }
+    }
+    const activeFindings = policyFindings.filter(f => !f.excepted);
+    const exceptedFindings = policyFindings.filter(f => f.excepted);
+    const blockingFindings = activeFindings.filter(f => (severityOrder[f.rule.severity] ?? 4) <= failLevel);
+    // Required controls check
+    const controlStatus = {};
+    if (policy.requiredControls) {
+        for (const ctrl of policy.requiredControls) {
+            const violations = activeFindings.filter(f => f.controls.includes(ctrl));
+            controlStatus[ctrl] = violations.length === 0 ? "pass" : "fail";
+        }
+    }
+    const pass = blockingFindings.length === 0 && !Object.values(controlStatus).includes("fail");
+    const result = {
+        pass,
+        findings: activeFindings,
+        exceptions: exceptedFindings,
+        summary: {
+            total: policyFindings.length,
+            excepted: exceptedFindings.length,
+            blocking: blockingFindings.length,
+            frameworks: policy.frameworks,
+            failOn: policy.failOn,
+            requiredControlsStatus: controlStatus,
+        },
+    };
+    if (format === "json") {
+        return JSON.stringify({
+            pass: result.pass,
+            summary: result.summary,
+            findings: result.findings.map(f => ({
+                id: f.rule.id, name: f.rule.name, severity: f.rule.severity,
+                file: f.filePath, line: f.line, controls: f.controls,
+                fix: f.rule.fix,
+            })),
+            exceptions: result.exceptions.map(f => ({
+                id: f.rule.id, name: f.rule.name, severity: f.rule.severity,
+                file: f.filePath, line: f.line, reason: f.exceptionReason,
+            })),
+        });
+    }
+    // Markdown
+    const lines = [
+        `# GuardVibe Policy Check`,
+        ``,
+        `**Result:** ${pass ? "PASS" : "FAIL"}`,
+        `**Frameworks:** ${policy.frameworks.join(", ")}`,
+        `**Fail threshold:** ${policy.failOn}`,
+        `**Directory:** ${scanRoot}`,
+        ``,
+        `| Metric | Count |`,
+        `|--------|-------|`,
+        `| Total compliance findings | ${policyFindings.length} |`,
+        `| Excepted (accepted risk) | ${exceptedFindings.length} |`,
+        `| Blocking (above threshold) | ${blockingFindings.length} |`,
+        ``,
+    ];
+    // Required controls
+    if (Object.keys(controlStatus).length > 0) {
+        lines.push(`## Required Controls`, ``, `| Control | Status |`, `|---------|--------|`);
+        for (const [ctrl, status] of Object.entries(controlStatus)) {
+            lines.push(`| ${ctrl} | ${status === "pass" ? "PASS" : "**FAIL**"} |`);
+        }
+        lines.push(``);
+    }
+    // Blocking findings
+    if (blockingFindings.length > 0) {
+        lines.push(`## Blocking Findings`, ``);
+        for (const f of blockingFindings) {
+            lines.push(`- **[${f.rule.severity.toUpperCase()}]** ${f.rule.name} (${f.rule.id}) in \`${f.filePath}\`:${f.line}`, `  Controls: ${f.controls.join(", ")} | Fix: ${f.rule.fix}`, ``);
+        }
+    }
+    // Exceptions
+    if (exceptedFindings.length > 0) {
+        lines.push(`## Accepted Exceptions`, ``);
+        for (const f of exceptedFindings) {
+            lines.push(`- ~~${f.rule.name} (${f.rule.id})~~ in \`${f.filePath}\`:${f.line} — *${f.exceptionReason}*`);
+        }
+        lines.push(``);
+    }
+    if (pass && blockingFindings.length === 0) {
+        lines.push(`All compliance checks passed.`);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=policy-check.js.map

package/build/tools/policy-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-check.js","sourceRoot":"","sources":["../../src/tools/policy-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,EAAE,WAAW,EAAgB,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAA+C,MAAM,oBAAoB,CAAC;AAG7F,MAAM,aAAa,GAA2B;IAC5C,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY;IACrF,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY;IACrF,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM;IAC7C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;IAC/C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW;IACnD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CACjC,CAAC;AAEF,MAAM,eAAe,GAA2B;IAC9C,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe;IACxG,oBAAoB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB;CAChF,CAAC;AAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;IAChE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ;CACvC,CAAC,CAAC;AA0BH,SAAS,OAAO,CAAC,GAAW,EAAE,QAAqB,EAAE,OAAiB;IACpE,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IAC9E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;aACzD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7F,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,QAAgB,EAAE,UAA6B;IACjF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,SAAS;QAE1D,mBAAmB;QACnB,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM,GAAG,IAAI,IAAI,EAAE;gBAAE,SAAS,CAAC,UAAU;QAC/C,CAAC;QAED,mBAAmB;QACnB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;oBACvD,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,SAAS;QACzB,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAkB,EAAE,UAAoB;IAClE,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,SAA8B,UAAU,EACxC,KAAsB;IAEtB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;IAEjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,2EAA2E,CAAC;QACxF,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,+BAA+B,GAAG,2LAA2L,CAAC;IACvO,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,gBAAgB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEvC,MAAM,cAAc,GAAoB,EAAE,CAAC;IAC3C,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACnG,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEpD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW;gBAAE,SAAS;YAClD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,QAAQ,GAAG,YAAY,CAAC;YACtF,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEpC,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACrE,cAAc,CAAC,IAAI,CAAC;oBAClB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ;oBACpD,QAAQ;oBACR,QAAQ,EAAE,CAAC,CAAC,SAAS;oBACrB,eAAe,EAAE,SAAS,EAAE,MAAM;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IAExG,0BAA0B;IAC1B,MAAM,aAAa,GAAoC,EAAE,CAAC;IAC1D,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACzE,aAAa,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7F,MAAM,MAAM,GAAiB;QAC3B,IAAI;QACJ,QAAQ,EAAE,cAAc;QACxB,UAAU,EAAE,gBAAgB;QAC5B,OAAO,EAAE;YACP,KAAK,EAAE,cAAc,CAAC,MAAM;YAC5B,QAAQ,EAAE,gBAAgB,CAAC,MAAM;YACjC,QAAQ,EAAE,gBAAgB,CAAC,MAAM;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,sBAAsB,EAAE,aAAa;SACtC;KACF,CAAC;IAEF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;gBAC3D,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpD,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG;aAChB,CAAC,CAAC;YACH,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;gBAC3D,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,eAAe;aAC1D,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED,WAAW;IACX,MAAM,KAAK,GAAa;QACtB,0BAA0B;QAC1B,EAAE;QACF,eAAe,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;QACvC,mBAAmB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjD,uBAAuB,MAAM,CAAC,MAAM,EAAE;QACtC,kBAAkB,QAAQ,EAAE;QAC5B,EAAE;QACF,oBAAoB;QACpB,oBAAoB;QACpB,iCAAiC,cAAc,CAAC,MAAM,IAAI;QAC1D,gCAAgC,gBAAgB,CAAC,MAAM,IAAI;QAC3D,kCAAkC,gBAAgB,CAAC,MAAM,IAAI;QAC7D,EAAE;KACH,CAAC;IAEF,oBAAoB;IACpB,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;QACvF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,oBAAoB;IACpB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,EACvG,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAC3D,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,eAAe,GAAG,CAC9F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,IAAI,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/tools/review-pr.d.ts

@@ -0,0 +1,3 @@
+import type { SecurityRule } from "../data/rules/types.js";
+export declare function reviewPr(cwd?: string, base?: string, format?: "markdown" | "json" | "annotations", diffOnly?: boolean, failOn?: "critical" | "high" | "medium" | "low" | "none", rules?: SecurityRule[]): string;
+//# sourceMappingURL=review-pr.d.ts.map

package/build/tools/review-pr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-pr.d.ts","sourceRoot":"","sources":["../../src/tools/review-pr.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AA0F3D,wBAAgB,QAAQ,CACtB,GAAG,GAAE,MAAsB,EAC3B,IAAI,GAAE,MAAe,EACrB,MAAM,GAAE,UAAU,GAAG,MAAM,GAAG,aAA0B,EACxD,QAAQ,GAAE,OAAc,EACxB,MAAM,GAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAe,EAChE,KAAK,CAAC,EAAE,YAAY,EAAE,GACrB,MAAM,CA8HR"}

package/build/tools/review-pr.js

@@ -0,0 +1,179 @@
+import { execFileSync } from "child_process";
+import { extname, basename } from "path";
+import { analyzeCode } from "./check-code.js";
+const EXTENSION_MAP = {
+    ".js": "javascript", ".jsx": "javascript", ".mjs": "javascript", ".cjs": "javascript",
+    ".ts": "typescript", ".tsx": "typescript", ".mts": "typescript", ".cts": "typescript",
+    ".py": "python", ".go": "go", ".html": "html",
+    ".sql": "sql", ".sh": "shell", ".bash": "shell",
+    ".yml": "yaml", ".yaml": "yaml", ".tf": "terraform",
+    ".toml": "toml", ".json": "json",
+};
+const CONFIG_FILE_MAP = {
+    "vercel.json": "vercel-config",
+    "next.config.js": "nextjs-config", "next.config.mjs": "nextjs-config", "next.config.ts": "nextjs-config",
+    "docker-compose.yml": "docker-compose", "docker-compose.yaml": "docker-compose",
+};
+function execGit(args, cwd) {
+    try {
+        return execFileSync("git", args, { cwd, encoding: "utf-8", timeout: 15000 });
+    }
+    catch {
+        return "";
+    }
+}
+function getChangedFiles(cwd, base) {
+    const output = execGit(["diff", "--name-only", base], cwd);
+    return output.trim().split("\n").filter(Boolean);
+}
+function getDiffHunks(cwd, base, file) {
+    const output = execGit(["diff", "-U0", base, "--", file], cwd);
+    const hunks = [];
+    const hunkPattern = /@@\s+-\d+(?:,\d+)?\s+\+(\d+)(?:,(\d+))?\s+@@/g;
+    let match;
+    while ((match = hunkPattern.exec(output)) !== null) {
+        const start = parseInt(match[1], 10);
+        const count = match[2] ? parseInt(match[2], 10) : 1;
+        hunks.push({ startLine: start, lineCount: count });
+    }
+    return hunks;
+}
+function getFileContent(cwd, file) {
+    try {
+        return execFileSync("git", ["show", `HEAD:${file}`], { cwd, encoding: "utf-8", timeout: 10000 });
+    }
+    catch {
+        return null;
+    }
+}
+function isLineInDiff(line, hunks) {
+    return hunks.some(h => line >= h.startLine && line < h.startLine + h.lineCount);
+}
+function detectLanguage(filePath) {
+    const ext = extname(filePath).toLowerCase();
+    if (EXTENSION_MAP[ext])
+        return EXTENSION_MAP[ext];
+    if (basename(filePath).startsWith("Dockerfile") || ext === ".dockerfile")
+        return "dockerfile";
+    return CONFIG_FILE_MAP[basename(filePath)] ?? null;
+}
+function severityToLevel(severity) {
+    if (severity === "critical" || severity === "high")
+        return "failure";
+    if (severity === "medium")
+        return "warning";
+    return "notice";
+}
+export function reviewPr(cwd = process.cwd(), base = "main", format = "markdown", diffOnly = true, failOn = "high", rules) {
+    const changedFiles = getChangedFiles(cwd, base);
+    if (changedFiles.length === 0) {
+        if (format === "json")
+            return JSON.stringify({ summary: { total: 0, files: 0 }, findings: [] });
+        if (format === "annotations")
+            return JSON.stringify([]);
+        return "# GuardVibe PR Review\n\nNo changed files found.";
+    }
+    const allFindings = [];
+    const scannedFiles = [];
+    for (const file of changedFiles) {
+        const language = detectLanguage(file);
+        if (!language)
+            continue;
+        const content = getFileContent(cwd, file);
+        if (!content)
+            continue;
+        scannedFiles.push(file);
+        const hunks = getDiffHunks(cwd, base, file);
+        const findings = analyzeCode(content, language, undefined, file, cwd, rules);
+        for (const f of findings) {
+            const inDiff = isLineInDiff(f.line, hunks);
+            allFindings.push({ rule: f.rule, match: f.match, line: f.line, file, inDiff });
+        }
+    }
+    const reportFindings = diffOnly ? allFindings.filter(f => f.inDiff) : allFindings;
+    const critical = reportFindings.filter(f => f.rule.severity === "critical").length;
+    const high = reportFindings.filter(f => f.rule.severity === "high").length;
+    const medium = reportFindings.filter(f => f.rule.severity === "medium").length;
+    const total = reportFindings.length;
+    const failThresholds = { critical: 0, high: 1, medium: 2, low: 3 };
+    const failLevel = failThresholds[failOn] ?? -1;
+    const severityOrder = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+    const blocked = failLevel >= 0 && reportFindings.some(f => (severityOrder[f.rule.severity] ?? 4) <= failLevel);
+    // --- ANNOTATIONS FORMAT (for GitHub Check Runs) ---
+    if (format === "annotations") {
+        const annotations = reportFindings.map(f => ({
+            path: f.file,
+            start_line: f.line,
+            end_line: f.line,
+            annotation_level: severityToLevel(f.rule.severity),
+            message: `${f.rule.description}\n\nFix: ${f.rule.fix}${f.rule.fixCode ? "\n\n" + f.rule.fixCode : ""}`,
+            title: `[${f.rule.severity.toUpperCase()}] ${f.rule.name} (${f.rule.id})`,
+        }));
+        return JSON.stringify(annotations);
+    }
+    // --- JSON FORMAT ---
+    if (format === "json") {
+        return JSON.stringify({
+            summary: {
+                total, critical, high, medium,
+                files: scannedFiles.length, changedFiles: changedFiles.length,
+                diffOnly, blocked, failOn, base,
+            },
+            findings: reportFindings.map(f => ({
+                id: f.rule.id, name: f.rule.name, severity: f.rule.severity,
+                owasp: f.rule.owasp, file: f.file, line: f.line, match: f.match,
+                inDiff: f.inDiff, fix: f.rule.fix, fixCode: f.rule.fixCode,
+                compliance: f.rule.compliance,
+            })),
+        });
+    }
+    // --- MARKDOWN FORMAT (for PR comment) ---
+    const existingFindings = diffOnly ? allFindings.filter(f => !f.inDiff) : [];
+    const lines = [
+        `## GuardVibe PR Security Review`,
+        ``,
+        `**Base:** ${base} | **Files changed:** ${changedFiles.length} | **Scanned:** ${scannedFiles.length}`,
+        `**Mode:** ${diffOnly ? "diff-only (new code)" : "full file"}`,
+        ``,
+    ];
+    if (blocked) {
+        lines.push(`> **BLOCKED** — ${failOn}-severity or above findings detected.`, ``);
+    }
+    if (total === 0) {
+        lines.push(`**No security issues in ${diffOnly ? "changed lines" : "changed files"}.** All clear!`);
+        if (existingFindings.length > 0) {
+            lines.push(``, `*Note: ${existingFindings.length} pre-existing issue(s) in unchanged code.*`);
+        }
+        return lines.join("\n");
+    }
+    lines.push(`| Severity | Count |`, `|----------|-------|`);
+    if (critical > 0)
+        lines.push(`| Critical | ${critical} |`);
+    if (high > 0)
+        lines.push(`| High | ${high} |`);
+    if (medium > 0)
+        lines.push(`| Medium | ${medium} |`);
+    lines.push(``);
+    const byFile = new Map();
+    for (const f of reportFindings) {
+        const existing = byFile.get(f.file) ?? [];
+        existing.push(f);
+        byFile.set(f.file, existing);
+    }
+    for (const [file, findings] of byFile) {
+        lines.push(`### \`${file}\``, ``);
+        for (const f of findings) {
+            const badge = f.rule.severity.toUpperCase();
+            lines.push(`- **[${badge}]** ${f.rule.name} (${f.rule.id}) — line ${f.line}`, `  ${f.rule.fix}`);
+            if (f.rule.fixCode) {
+                lines.push(`  \`\`\``, `  ${f.rule.fixCode.split("\n")[0]}`, `  \`\`\``);
+            }
+            lines.push(``);
+        }
+    }
+    if (existingFindings.length > 0) {
+        lines.push(`---`, ``, `*${existingFindings.length} pre-existing issue(s) in unchanged code (not shown).*`);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=review-pr.js.map

package/build/tools/review-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-pr.js","sourceRoot":"","sources":["../../src/tools/review-pr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,WAAW,EAAgB,MAAM,iBAAiB,CAAC;AAG5D,MAAM,aAAa,GAA2B;IAC5C,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY;IACrF,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY;IACrF,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM;IAC7C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;IAC/C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW;IACnD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CACjC,CAAC;AAEF,MAAM,eAAe,GAA2B;IAC9C,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe;IACxG,oBAAoB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB;CAChF,CAAC;AAwBF,SAAS,OAAO,CAAC,IAAc,EAAE,GAAW;IAC1C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,IAAY;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,+CAA+C,CAAC;IACpE,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY;IAC/C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAiB;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,YAAY,CAAC;IAC9F,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAAe,MAAM,EACrB,SAA8C,UAAU,EACxD,WAAoB,IAAI,EACxB,SAA0D,MAAM,EAChE,KAAsB;IAEtB,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,IAAI,MAAM,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,kDAAkD,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAgB,EAAE,CAAC;IACpC,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAE7E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAElF,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IACnF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC3E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC;IAEpC,MAAM,cAAc,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3F,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACnG,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IAE/G,qDAAqD;IACrD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAuB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/D,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;YAChB,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClD,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACtG,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG;SAC1E,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE;gBACP,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM;gBAC7B,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,MAAM;gBAC7D,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI;aAChC;YACD,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;gBAC3D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;gBAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;gBAC1D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU;aAC9B,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,MAAM,KAAK,GAAa;QACtB,iCAAiC;QACjC,EAAE;QACF,aAAa,IAAI,yBAAyB,YAAY,CAAC,MAAM,mBAAmB,YAAY,CAAC,MAAM,EAAE;QACrG,aAAa,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW,EAAE;QAC9D,EAAE;KACH,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,uCAAuC,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,gBAAgB,CAAC,CAAC;QACpG,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,gBAAgB,CAAC,MAAM,4CAA4C,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;IAC3D,IAAI,QAAQ,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,IAAI,CAAC,CAAC;IAC3D,IAAI,IAAI,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,IAAI,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CACR,QAAQ,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,EACjE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAClB,CAAC;YACF,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAC3E,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,gBAAgB,CAAC,MAAM,wDAAwD,CAAC,CAAC;IAC7G,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/tools/scan-secrets-history.d.ts

@@ -0,0 +1,9 @@
+import { type SecretFinding } from "./scan-secrets.js";
+export interface HistorySecretFinding extends SecretFinding {
+    commit: string;
+    commitDate: string;
+    author: string;
+    status: "active" | "removed";
+}
+export declare function scanSecretsHistory(path: string, maxCommits?: number, format?: "markdown" | "json"): string;
+//# sourceMappingURL=scan-secrets-history.d.ts.map

package/build/tools/scan-secrets-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-secrets-history.d.ts","sourceRoot":"","sources":["../../src/tools/scan-secrets-history.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAsDD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAY,EACxB,MAAM,GAAE,UAAU,GAAG,MAAmB,GACvC,MAAM,CAoHR"}

package/build/tools/scan-secrets-history.js

@@ -0,0 +1,142 @@
+import { execFileSync } from "child_process";
+import { resolve } from "path";
+import { scanContent } from "./scan-secrets.js";
+function execGit(args, cwd) {
+    try {
+        return execFileSync("git", args, { cwd, encoding: "utf-8", timeout: 30000 });
+    }
+    catch {
+        return "";
+    }
+}
+function getCommitList(cwd, maxCommits) {
+    const output = execGit(["log", `--max-count=${maxCommits}`, "--format=%H|||%aI|||%an", "--all"], cwd);
+    return output.trim().split("\n").filter(Boolean).map(line => {
+        const [hash, date, author] = line.split("|||");
+        return { hash, date, author };
+    });
+}
+function getCommitDiff(cwd, commitHash) {
+    return execGit(["diff-tree", "--no-commit-id", "-r", "--diff-filter=ACMR", "--name-only", commitHash], cwd);
+}
+function getFileAtCommit(cwd, commitHash, filePath) {
+    try {
+        return execFileSync("git", ["show", `${commitHash}:${filePath}`], {
+            cwd, encoding: "utf-8", timeout: 10000,
+        });
+    }
+    catch {
+        return null;
+    }
+}
+function fileExistsAtHead(cwd, filePath) {
+    const result = execGit(["cat-file", "-e", `HEAD:${filePath}`], cwd);
+    // cat-file -e returns empty on success, error message on failure
+    return result === "";
+}
+function getFileAtHead(cwd, filePath) {
+    try {
+        return execFileSync("git", ["show", `HEAD:${filePath}`], {
+            cwd, encoding: "utf-8", timeout: 10000,
+        });
+    }
+    catch {
+        return null;
+    }
+}
+export function scanSecretsHistory(path, maxCommits = 100, format = "markdown") {
+    const cwd = resolve(path);
+    const commits = getCommitList(cwd, maxCommits);
+    if (commits.length === 0) {
+        if (format === "json")
+            return JSON.stringify({ summary: { total: 0, commits: 0 }, findings: [] });
+        return "# GuardVibe Git History Secret Scan\n\nNo git history found.";
+    }
+    const allFindings = [];
+    const seenKeys = new Set();
+    // Scan secrets introduced in each commit's changed files
+    for (const commit of commits) {
+        const changedFiles = getCommitDiff(cwd, commit.hash).trim().split("\n").filter(Boolean);
+        for (const file of changedFiles) {
+            // Only scan files likely to contain secrets
+            if (/\.(png|jpg|gif|ico|woff|ttf|eot|svg|mp4|webm|zip|tar|gz|lock)$/i.test(file))
+                continue;
+            const content = getFileAtCommit(cwd, commit.hash, file);
+            if (!content || content.length > 500_000)
+                continue;
+            const findings = scanContent(content, file);
+            for (const f of findings) {
+                const key = `${f.provider}:${file}:${f.match}`;
+                if (seenKeys.has(key))
+                    continue;
+                seenKeys.add(key);
+                // Check if this secret still exists at HEAD
+                const headContent = getFileAtHead(cwd, file);
+                const stillPresent = headContent ? headContent.includes(f.match.replace("...", "")) : false;
+                allFindings.push({
+                    ...f,
+                    commit: commit.hash.substring(0, 8),
+                    commitDate: commit.date,
+                    author: commit.author,
+                    status: stillPresent ? "active" : "removed",
+                });
+            }
+        }
+    }
+    // Sort: active first, then by severity
+    const severityOrder = { critical: 0, high: 1, medium: 2 };
+    allFindings.sort((a, b) => {
+        if (a.status !== b.status)
+            return a.status === "active" ? -1 : 1;
+        return (severityOrder[a.severity] ?? 3) - (severityOrder[b.severity] ?? 3);
+    });
+    const activeCount = allFindings.filter(f => f.status === "active").length;
+    const removedCount = allFindings.filter(f => f.status === "removed").length;
+    if (format === "json") {
+        return JSON.stringify({
+            summary: {
+                total: allFindings.length,
+                active: activeCount,
+                removed: removedCount,
+                commitsScanned: commits.length,
+                critical: allFindings.filter(f => f.severity === "critical").length,
+                high: allFindings.filter(f => f.severity === "high").length,
+            },
+            findings: allFindings.map(f => ({
+                provider: f.provider, severity: f.severity, file: f.file,
+                line: f.line, match: f.match, fix: f.fix,
+                commit: f.commit, commitDate: f.commitDate, author: f.author,
+                status: f.status,
+            })),
+        });
+    }
+    const lines = [
+        `# GuardVibe Git History Secret Scan`,
+        ``,
+        `Commits scanned: ${commits.length}`,
+        `Secrets found: ${allFindings.length}`,
+        `Active (still in code): ${activeCount}`,
+        `Removed (in git history only): ${removedCount}`,
+        ``,
+    ];
+    if (allFindings.length === 0) {
+        lines.push(`No secrets found in git history. Clean!`);
+        return lines.join("\n");
+    }
+    if (activeCount > 0) {
+        lines.push(`## Active Secrets (URGENT — still in codebase)`, ``);
+        for (const f of allFindings.filter(f => f.status === "active")) {
+            lines.push(`### [${f.severity.toUpperCase()}] ${f.provider}`, `**File:** ${f.file}:${f.line}`, `**Match:** \`${f.match}\``, `**Introduced:** ${f.commit} (${f.commitDate.split("T")[0]}) by ${f.author}`, `**Fix:** ${f.fix}`, ``);
+        }
+    }
+    if (removedCount > 0) {
+        lines.push(`## Removed Secrets (still in git history — rotate these!)`, ``);
+        lines.push(`> These secrets were removed from the codebase but remain in git history.`);
+        lines.push(`> Anyone with repo access can find them. **Rotate all of these immediately.**`, ``);
+        for (const f of allFindings.filter(f => f.status === "removed")) {
+            lines.push(`- **[${f.severity.toUpperCase()}] ${f.provider}** in \`${f.file}\` — commit ${f.commit} (${f.commitDate.split("T")[0]})`, `  Match: \`${f.match}\` | Fix: ${f.fix}`, ``);
+        }
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=scan-secrets-history.js.map

package/build/tools/scan-secrets-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-secrets-history.js","sourceRoot":"","sources":["../../src/tools/scan-secrets-history.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAsB,MAAM,mBAAmB,CAAC;AAepE,SAAS,OAAO,CAAC,IAAc,EAAE,GAAW;IAC1C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,UAAkB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,EAAE,eAAe,UAAU,EAAE,EAAE,yBAAyB,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC1D,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,UAAkB;IACpD,OAAO,OAAO,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,oBAAoB,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,UAAkB,EAAE,QAAgB;IACxE,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,EAAE;YAChE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,QAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,iEAAiE;IACjE,OAAO,MAAM,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,QAAgB;IAClD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE;YACvD,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,aAAqB,GAAG,EACxB,SAA8B,UAAU;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAClG,OAAO,8DAA8D,CAAC;IACxE,CAAC;IAED,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,yDAAyD;IACzD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAExF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,4CAA4C;YAC5C,IAAI,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAE3F,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO;gBAAE,SAAS;YAEnD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC/C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAElB,4CAA4C;gBAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAE5F,WAAW,CAAC,IAAI,CAAC;oBACf,GAAG,CAAC;oBACJ,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;oBACnC,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAClF,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC1E,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAE5E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW,CAAC,MAAM;gBACzB,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,YAAY;gBACrB,cAAc,EAAE,OAAO,CAAC,MAAM;gBAC9B,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;gBACnE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;aAC5D;YACD,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;gBACxD,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG;gBACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;gBAC5D,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,qCAAqC;QACrC,EAAE;QACF,oBAAoB,OAAO,CAAC,MAAM,EAAE;QACpC,kBAAkB,WAAW,CAAC,MAAM,EAAE;QACtC,2BAA2B,WAAW,EAAE;QACxC,kCAAkC,YAAY,EAAE;QAChD,EAAE;KACH,CAAC;IAEF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,gDAAgD,EAAE,EAAE,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,EACjD,aAAa,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,EAC/B,gBAAgB,CAAC,CAAC,KAAK,IAAI,EAC3B,mBAAmB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAC5E,YAAY,CAAC,CAAC,GAAG,EAAE,EACnB,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,CAAC,CAAC;QAC5E,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,+EAA+E,EAAE,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YAChE,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EACzH,cAAc,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,GAAG,EAAE,EACzC,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/tools/taint-analysis.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Basic taint analysis — tracks user input flowing into dangerous sinks.
+ * Not a full AST/CFG analysis, but follows variable assignments through lines.
+ */
+export interface TaintFinding {
+    source: {
+        type: string;
+        line: number;
+        variable: string;
+    };
+    sink: {
+        type: string;
+        line: number;
+        code: string;
+    };
+    chain: string[];
+    severity: "critical" | "high" | "medium";
+    description: string;
+    fix: string;
+}
+export declare function analyzeTaint(code: string, language: string): TaintFinding[];
+export declare function formatTaintFindings(findings: TaintFinding[], format: "markdown" | "json"): string;
+//# sourceMappingURL=taint-analysis.d.ts.map

package/build/tools/taint-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-analysis.d.ts","sourceRoot":"","sources":["../../src/tools/taint-analysis.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAqGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAsE3E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAyCjG"}