guardvibe 1.9.3 → 1.9.5

package/build/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "module";
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSync, statSync } from "fs";
 import { join, dirname } from "path";
 import { homedir } from "os";
 const require = createRequire(import.meta.url);
@@ -110,6 +110,22 @@ function setupClaudeHooksAndGuide() {
         writeFileSync(claudeMdPath, `# Project Guidelines\n${guardvibeBlock}`, "utf-8");
         console.log(`  [OK] Created CLAUDE.md with GuardVibe guidance`);
     }
+    // Add generated files to .gitignore so they don't get committed
+    addToGitignore([".claude.json", ".claude/", "CLAUDE.md"]);
+}
+function addToGitignore(entries) {
+    const gitignorePath = join(process.cwd(), ".gitignore");
+    let content = "";
+    try {
+        content = readFileSync(gitignorePath, "utf-8");
+    }
+    catch { /* no .gitignore yet */ }
+    const missing = entries.filter(e => !content.split("\n").some(line => line.trim() === e));
+    if (missing.length === 0)
+        return;
+    const block = `\n# GuardVibe / Claude Code (auto-added by guardvibe init)\n${missing.join("\n")}\n`;
+    writeFileSync(gitignorePath, content.trimEnd() + block, "utf-8");
+    console.log(`  [OK] Added ${missing.join(", ")} to .gitignore`);
 }
 // ── Pre-commit hook ──────────────────────────────────────────────────
 const HOOK_SCRIPT = `#!/bin/sh
@@ -245,6 +261,36 @@ if (SCAN_SCRIPT_DETECTED) {
 else {
     main();
 }
+/**
+ * Check if scan results should cause a non-zero exit based on --fail-on flag.
+ * Default: "critical" — only exit 1 on critical findings.
+ * Options: "critical", "high", "medium", "low", "none"
+ */
+function shouldFail(result, failOn) {
+    if (failOn === "none")
+        return false;
+    const levels = {
+        low: ["critical", "high", "medium", "low"],
+        medium: ["critical", "high", "medium"],
+        high: ["critical", "high"],
+        critical: ["critical"],
+    };
+    const failLevels = levels[failOn] || levels.critical;
+    // Try JSON format first
+    try {
+        const parsed = JSON.parse(result);
+        if (parsed.summary) {
+            return failLevels.some(level => (parsed.summary[level] ?? 0) > 0);
+        }
+        if (parsed.findings) {
+            return parsed.findings.some((f) => failLevels.includes(f.severity));
+        }
+    }
+    catch { /* not JSON, try markdown tags */ }
+    // Markdown format: check for [SEVERITY] tags
+    const tags = failLevels.map(l => `[${l.toUpperCase()}]`);
+    return tags.some(tag => result.includes(tag));
+}
 function parseArgs(args) {
     const flags = {};
     const positional = [];
@@ -288,8 +334,8 @@ async function runScan() {
         console.log(result);
     }
     if (format !== "sarif") {
-        const hasBlocking = result.includes("[CRITICAL]") || result.includes("[HIGH]");
-        if (hasBlocking)
+        const failOn = flags["fail-on"] ?? "high";
+        if (shouldFail(result, failOn))
             process.exit(1);
     }
 }
@@ -325,8 +371,8 @@ async function runDirectoryScan(targetPath, flags) {
         console.log(`  [OK] Baseline saved to ${baselineFile}`);
     }
     if (format !== "sarif") {
-        const hasBlocking = result.includes("[CRITICAL]") || result.includes("[HIGH]");
-        if (hasBlocking)
+        const failOn = flags["fail-on"] ?? "critical";
+        if (shouldFail(result, failOn))
             process.exit(1);
     }
 }
@@ -405,9 +451,18 @@ async function runDiffScan(base, flags) {
     else {
         console.log(result);
     }
-    const hasBlocking = allFindings.some(f => f.severity === "critical" || f.severity === "high");
-    if (hasBlocking)
-        process.exit(1);
+    const failOn = flags["fail-on"] ?? "critical";
+    if (failOn !== "none") {
+        const failLevels = {
+            low: ["critical", "high", "medium", "low"],
+            medium: ["critical", "high", "medium"],
+            high: ["critical", "high"],
+            critical: ["critical"],
+        };
+        const levels = failLevels[failOn] || failLevels.critical;
+        if (allFindings.some(f => levels.includes(f.severity)))
+            process.exit(1);
+    }
 }
 async function runFileCheck(filePath, flags) {
     const { checkCode } = await import("./tools/check-code.js");
@@ -443,8 +498,8 @@ async function runFileCheck(filePath, flags) {
     else {
         console.log(result);
     }
-    const hasBlocking = result.includes("[CRITICAL]") || result.includes("[HIGH]");
-    if (hasBlocking)
+    const failOn = flags["fail-on"] ?? "critical";
+    if (shouldFail(result, failOn))
         process.exit(1);
 }
 // ── Main CLI ─────────────────────────────────────────────────────────
@@ -468,6 +523,8 @@ function printUsage() {
   Options:
     --format <type>       Output format: markdown (default), json, sarif
     --output <file>       Write results to file instead of stdout
+    --fail-on <level>     Exit 1 when findings at this level or above exist
+                          critical (default) | high | medium | low | none
     --baseline <file>     Compare against a previous scan JSON for fix tracking
     --save-baseline       Save current scan as baseline (.guardvibe-baseline.json)
     --version, -V         Print version and exit
@@ -561,7 +618,14 @@ async function main() {
         const cliArgs = args.slice(1);
         const { flags, positional } = parseArgs(cliArgs);
         const targetPath = positional[0] ?? ".";
-        await runDirectoryScan(targetPath, flags);
+        // If target is a file (not directory), auto-redirect to check mode
+        if (targetPath !== "." && existsSync(targetPath) && !statSync(targetPath).isDirectory()) {
+            console.log(`  [INFO] "${targetPath}" is a file. Running: guardvibe check ${targetPath}\n`);
+            await runFileCheck(targetPath, flags);
+        }
+        else {
+            await runDirectoryScan(targetPath, flags);
+        }
     }
     else if (command === "diff") {
         const cliArgs = args.slice(1);

package/build/tools/check-code.js

@@ -163,6 +163,10 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         const rateLimitRuleIds = new Set(["VG956", "VG030"]);
         if (isCronRoute && rateLimitRuleIds.has(rule.id))
             continue;
+        // Context-aware: skip rate limiting rules for webhook routes
+        // Webhooks are called by external services, not users — rate limiting is irrelevant
+        if (isWebhookRoute && rateLimitRuleIds.has(rule.id))
+            continue;
         // Context-aware: skip rate limiting rules for admin routes that have admin auth
         const isAdminRoute = filePath && /\/admin\//i.test(filePath);
         const hasAdminAuth = isAdminRoute && /(?:requireAdmin|adminOnly|orgRole|org:admin|isAdmin|checkRole|requireRole)/i.test(code);

package/build/tools/check-project.js

@@ -126,7 +126,7 @@ export function checkProject(files, format = "markdown", rules) {
             actionItems.forEach((item, i) => {
                 const fileCount = item.files.size;
                 const fileLabel = fileCount === 1 ? "1 file" : `${fileCount} files`;
-                lines.push(`${i + 1}. **[${item.rule.severity.toUpperCase()}] ${item.rule.name}** (${item.rule.id}) — ${item.count} occurrences in ${fileLabel}`, `   ${item.rule.fix}`, ``);
+                lines.push(`${i + 1}. **[${item.rule.severity.toUpperCase()}] ${item.rule.name}** (${item.rule.id}) — ${item.count} ${item.count === 1 ? "occurrence" : "occurrences"} in ${fileLabel}`, `   ${item.rule.fix}`, ``);
             });
         }
         lines.push(`---`, ``);

package/build/tools/scan-directory.js

@@ -220,7 +220,7 @@ export function scanDirectory(path, recursive = true, exclude = [], format = "ma
         actionItems.forEach((item, i) => {
             const fileCount = item.files.size;
             const fileLabel = fileCount === 1 ? "1 file" : `${fileCount} files`;
-            lines.push(`${i + 1}. **[${item.rule.severity.toUpperCase()}] ${item.rule.name}** (${item.rule.id}) — ${item.count} occurrences in ${fileLabel}`, `   ${item.rule.fix}`, ``);
+            lines.push(`${i + 1}. **[${item.rule.severity.toUpperCase()}] ${item.rule.name}** (${item.rule.id}) — ${item.count} ${item.count === 1 ? "occurrence" : "occurrences"} in ${fileLabel}`, `   ${item.rule.fix}`, ``);
         });
         lines.push(`---`, ``);
         for (const result of scanResults) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "1.9.3",
+  "version": "1.9.5",
   "description": "Security MCP for vibe coding. 277 rules, 24 tools for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",
   "bin": {