guardvibe 1.9.4 → 1.9.6

package/build/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "module";
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSync, statSync } from "fs";
 import { join, dirname } from "path";
 import { homedir } from "os";
 const require = createRequire(import.meta.url);
@@ -50,6 +50,9 @@ function setupPlatform(name) {
         }
         if (existing.mcpServers["guardvibe"]) {
             console.log(`  [OK] GuardVibe already configured in ${platform.description}`);
+            // Still ensure CLAUDE.md and .gitignore are set up
+            if (name === "claude")
+                setupClaudeHooksAndGuide();
             return true;
         }
         existing.mcpServers["guardvibe"] = GUARDVIBE_MCP_CONFIG;
@@ -225,9 +228,6 @@ jobs:
         with:
           node-version: "22"
 
-      - name: Install dependencies
-        run: npm ci
-
       - name: Run GuardVibe security scan
         run: npx -y guardvibe-scan --format sarif --output guardvibe-results.sarif
 
@@ -523,8 +523,8 @@ function printUsage() {
   Options:
     --format <type>       Output format: markdown (default), json, sarif
     --output <file>       Write results to file instead of stdout
-    --fail-on <level>     Exit 1 when findings at this level exist
-                          Options: critical (default), high, medium, low, none
+    --fail-on <level>     Exit 1 when findings at this level or above exist
+                          critical (default) | high | medium | low | none
     --baseline <file>     Compare against a previous scan JSON for fix tracking
     --save-baseline       Save current scan as baseline (.guardvibe-baseline.json)
     --version, -V         Print version and exit
@@ -618,7 +618,14 @@ async function main() {
         const cliArgs = args.slice(1);
         const { flags, positional } = parseArgs(cliArgs);
         const targetPath = positional[0] ?? ".";
-        await runDirectoryScan(targetPath, flags);
+        // If target is a file (not directory), auto-redirect to check mode
+        if (targetPath !== "." && existsSync(targetPath) && !statSync(targetPath).isDirectory()) {
+            console.log(`  [INFO] "${targetPath}" is a file. Running: guardvibe check ${targetPath}\n`);
+            await runFileCheck(targetPath, flags);
+        }
+        else {
+            await runDirectoryScan(targetPath, flags);
+        }
     }
     else if (command === "diff") {
         const cliArgs = args.slice(1);

package/build/tools/check-code.js

@@ -163,6 +163,10 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         const rateLimitRuleIds = new Set(["VG956", "VG030"]);
         if (isCronRoute && rateLimitRuleIds.has(rule.id))
             continue;
+        // Context-aware: skip rate limiting rules for webhook routes
+        // Webhooks are called by external services, not users — rate limiting is irrelevant
+        if (isWebhookRoute && rateLimitRuleIds.has(rule.id))
+            continue;
         // Context-aware: skip rate limiting rules for admin routes that have admin auth
         const isAdminRoute = filePath && /\/admin\//i.test(filePath);
         const hasAdminAuth = isAdminRoute && /(?:requireAdmin|adminOnly|orgRole|org:admin|isAdmin|checkRole|requireRole)/i.test(code);
@@ -340,6 +344,7 @@ export function formatFindingsJson(findings, extra) {
     return JSON.stringify({
         summary: {
             total: findings.length, critical, high, medium, low,
+            // blocked: true when critical or high findings exist (would fail --fail-on high)
             blocked: critical > 0 || high > 0,
             ...extra,
         },
@@ -362,19 +367,68 @@ export function checkCode(code, language, framework, filePath, configDir, format
 }
 function formatCleanReport(language, framework) {
     const ctx = framework ? ` (${framework})` : "";
+    const tips = getLanguageTips(language, framework);
     return [
         `# GuardVibe Security Report`,
         ``,
         `**Language:** ${language}${ctx}`,
         `**Status:** No security issues detected`,
         ``,
-        `The code looks clean! Here are some general tips:`,
-        `- Keep dependencies updated (\`npm audit\`)`,
-        `- Validate all user input with schemas (zod, joi)`,
-        `- Use environment variables for secrets`,
-        `- Add rate limiting to API endpoints`,
+        `Tips for ${language}${ctx}:`,
+        ...tips.map(t => `- ${t}`),
     ].join("\n");
 }
+function getLanguageTips(language, framework) {
+    if (framework === "nextjs" || framework === "next")
+        return [
+            "Use `server-only` imports in files with secrets or DB access",
+            "Validate Server Action inputs with zod schemas",
+            "Set `serverActions.allowedOrigins` in next.config",
+            "Add security headers via `headers()` in next.config",
+        ];
+    if (framework === "express" || framework === "fastify" || framework === "hono")
+        return [
+            "Add rate limiting middleware to auth and write endpoints",
+            "Use helmet() for security headers",
+            "Validate request body with zod or joi before processing",
+            "Never reflect user input in error responses",
+        ];
+    if (language === "python")
+        return [
+            "Use parameterized queries — never f-strings in SQL",
+            "Add `Depends(get_current_user)` to protected routes",
+            "Pin dependency versions in requirements.txt",
+            "Use `secrets.compare_digest()` for token comparison",
+        ];
+    if (language === "sql")
+        return [
+            "Use `SECURITY INVOKER` on views to respect RLS",
+            "Avoid `GRANT ALL` — use least-privilege permissions",
+            "Add `IF EXISTS` to destructive DDL for safety",
+            "Use parameterized queries in application code",
+        ];
+    if (language === "dockerfile")
+        return [
+            "Use specific image tags, never `latest`",
+            "Run as non-root user with `USER` directive",
+            "Use multi-stage builds to minimize attack surface",
+            "Don't copy `.env` or secrets into the image",
+        ];
+    if (language === "yaml" || language === "terraform")
+        return [
+            "Never hardcode secrets in config — use env vars or secrets manager",
+            "Pin action/provider versions to specific SHA or tag",
+            "Use least-privilege IAM policies",
+            "Enable audit logging for infrastructure changes",
+        ];
+    // Default for JS/TS
+    return [
+        "Keep dependencies updated (`npm audit`)",
+        "Validate all user input with schemas (zod, joi)",
+        "Use environment variables for secrets",
+        "Use `textContent` instead of `innerHTML` for user data",
+    ];
+}
 function formatReport(findings, language, framework) {
     const ctx = framework ? ` (${framework})` : "";
     // Severity ordering

package/build/tools/check-project.js

@@ -126,7 +126,7 @@ export function checkProject(files, format = "markdown", rules) {
             actionItems.forEach((item, i) => {
                 const fileCount = item.files.size;
                 const fileLabel = fileCount === 1 ? "1 file" : `${fileCount} files`;
-                lines.push(`${i + 1}. **[${item.rule.severity.toUpperCase()}] ${item.rule.name}** (${item.rule.id}) — ${item.count} occurrences in ${fileLabel}`, `   ${item.rule.fix}`, ``);
+                lines.push(`${i + 1}. **[${item.rule.severity.toUpperCase()}] ${item.rule.name}** (${item.rule.id}) — ${item.count} ${item.count === 1 ? "occurrence" : "occurrences"} in ${fileLabel}`, `   ${item.rule.fix}`, ``);
             });
         }
         lines.push(`---`, ``);

package/build/tools/scan-directory.js

@@ -220,7 +220,7 @@ export function scanDirectory(path, recursive = true, exclude = [], format = "ma
         actionItems.forEach((item, i) => {
             const fileCount = item.files.size;
             const fileLabel = fileCount === 1 ? "1 file" : `${fileCount} files`;
-            lines.push(`${i + 1}. **[${item.rule.severity.toUpperCase()}] ${item.rule.name}** (${item.rule.id}) — ${item.count} occurrences in ${fileLabel}`, `   ${item.rule.fix}`, ``);
+            lines.push(`${i + 1}. **[${item.rule.severity.toUpperCase()}] ${item.rule.name}** (${item.rule.id}) — ${item.count} ${item.count === 1 ? "occurrence" : "occurrences"} in ${fileLabel}`, `   ${item.rule.fix}`, ``);
         });
         lines.push(`---`, ``);
         for (const result of scanResults) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "1.9.4",
+  "version": "1.9.6",
   "description": "Security MCP for vibe coding. 277 rules, 24 tools for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",
   "bin": {