guardvibe 1.9.3 → 1.9.4

package/build/cli.js

@@ -110,6 +110,22 @@ function setupClaudeHooksAndGuide() {
         writeFileSync(claudeMdPath, `# Project Guidelines\n${guardvibeBlock}`, "utf-8");
         console.log(`  [OK] Created CLAUDE.md with GuardVibe guidance`);
     }
+    // Add generated files to .gitignore so they don't get committed
+    addToGitignore([".claude.json", ".claude/", "CLAUDE.md"]);
+}
+function addToGitignore(entries) {
+    const gitignorePath = join(process.cwd(), ".gitignore");
+    let content = "";
+    try {
+        content = readFileSync(gitignorePath, "utf-8");
+    }
+    catch { /* no .gitignore yet */ }
+    const missing = entries.filter(e => !content.split("\n").some(line => line.trim() === e));
+    if (missing.length === 0)
+        return;
+    const block = `\n# GuardVibe / Claude Code (auto-added by guardvibe init)\n${missing.join("\n")}\n`;
+    writeFileSync(gitignorePath, content.trimEnd() + block, "utf-8");
+    console.log(`  [OK] Added ${missing.join(", ")} to .gitignore`);
 }
 // ── Pre-commit hook ──────────────────────────────────────────────────
 const HOOK_SCRIPT = `#!/bin/sh
@@ -245,6 +261,36 @@ if (SCAN_SCRIPT_DETECTED) {
 else {
     main();
 }
+/**
+ * Check if scan results should cause a non-zero exit based on --fail-on flag.
+ * Default: "critical" — only exit 1 on critical findings.
+ * Options: "critical", "high", "medium", "low", "none"
+ */
+function shouldFail(result, failOn) {
+    if (failOn === "none")
+        return false;
+    const levels = {
+        low: ["critical", "high", "medium", "low"],
+        medium: ["critical", "high", "medium"],
+        high: ["critical", "high"],
+        critical: ["critical"],
+    };
+    const failLevels = levels[failOn] || levels.critical;
+    // Try JSON format first
+    try {
+        const parsed = JSON.parse(result);
+        if (parsed.summary) {
+            return failLevels.some(level => (parsed.summary[level] ?? 0) > 0);
+        }
+        if (parsed.findings) {
+            return parsed.findings.some((f) => failLevels.includes(f.severity));
+        }
+    }
+    catch { /* not JSON, try markdown tags */ }
+    // Markdown format: check for [SEVERITY] tags
+    const tags = failLevels.map(l => `[${l.toUpperCase()}]`);
+    return tags.some(tag => result.includes(tag));
+}
 function parseArgs(args) {
     const flags = {};
     const positional = [];
@@ -288,8 +334,8 @@ async function runScan() {
         console.log(result);
     }
     if (format !== "sarif") {
-        const hasBlocking = result.includes("[CRITICAL]") || result.includes("[HIGH]");
-        if (hasBlocking)
+        const failOn = flags["fail-on"] ?? "high";
+        if (shouldFail(result, failOn))
             process.exit(1);
     }
 }
@@ -325,8 +371,8 @@ async function runDirectoryScan(targetPath, flags) {
         console.log(`  [OK] Baseline saved to ${baselineFile}`);
     }
     if (format !== "sarif") {
-        const hasBlocking = result.includes("[CRITICAL]") || result.includes("[HIGH]");
-        if (hasBlocking)
+        const failOn = flags["fail-on"] ?? "critical";
+        if (shouldFail(result, failOn))
             process.exit(1);
     }
 }
@@ -405,9 +451,18 @@ async function runDiffScan(base, flags) {
     else {
         console.log(result);
     }
-    const hasBlocking = allFindings.some(f => f.severity === "critical" || f.severity === "high");
-    if (hasBlocking)
-        process.exit(1);
+    const failOn = flags["fail-on"] ?? "critical";
+    if (failOn !== "none") {
+        const failLevels = {
+            low: ["critical", "high", "medium", "low"],
+            medium: ["critical", "high", "medium"],
+            high: ["critical", "high"],
+            critical: ["critical"],
+        };
+        const levels = failLevels[failOn] || failLevels.critical;
+        if (allFindings.some(f => levels.includes(f.severity)))
+            process.exit(1);
+    }
 }
 async function runFileCheck(filePath, flags) {
     const { checkCode } = await import("./tools/check-code.js");
@@ -443,8 +498,8 @@ async function runFileCheck(filePath, flags) {
     else {
         console.log(result);
     }
-    const hasBlocking = result.includes("[CRITICAL]") || result.includes("[HIGH]");
-    if (hasBlocking)
+    const failOn = flags["fail-on"] ?? "critical";
+    if (shouldFail(result, failOn))
         process.exit(1);
 }
 // ── Main CLI ─────────────────────────────────────────────────────────
@@ -468,6 +523,8 @@ function printUsage() {
   Options:
     --format <type>       Output format: markdown (default), json, sarif
     --output <file>       Write results to file instead of stdout
+    --fail-on <level>     Exit 1 when findings at this level exist
+                          Options: critical (default), high, medium, low, none
     --baseline <file>     Compare against a previous scan JSON for fix tracking
     --save-baseline       Save current scan as baseline (.guardvibe-baseline.json)
     --version, -V         Print version and exit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "1.9.3",
+  "version": "1.9.4",
   "description": "Security MCP for vibe coding. 277 rules, 24 tools for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",
   "bin": {