guardvibe 2.9.5 → 2.9.6

package/build/index.js

@@ -133,10 +133,14 @@ server.tool("check_dependencies", "Check npm, PyPI, or Go packages for known sec
         return val;
     }, z.array(packageSchema)).describe("List of packages to check: [{name, version, ecosystem}]"),
 }, async ({ packages }) => {
-    const results = await checkDependencies(packages);
-    return {
-        content: [{ type: "text", text: results }],
-    };
+    try {
+        const results = await checkDependencies(packages);
+        return { content: [{ type: "text", text: results }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { content: [{ type: "text", text: `⚠️ Dependency check failed: ${msg}\n\nThis may be a network issue reaching the OSV database. Try again or check your internet connection.` }] };
+    }
 });
 // Tool 5: Scan directory for security vulnerabilities (filesystem-native)
 server.tool("scan_directory", "Scan an entire project directory for security vulnerabilities. Reads files directly from the filesystem — no need to pass file contents. Returns a security score (A-F) and detailed findings. Includes scan metadata (ID, timestamp, duration, file hashes) for audit trails. Use baseline to compare with a previous scan.", {
@@ -170,7 +174,7 @@ server.tool("scan_directory", "Scan an entire project directory for security vul
     return { content: [{ type: "text", text: results + summary }] };
 });
 // Tool 6: Scan manifest/lockfile for dependency vulnerabilities
-server.tool("scan_dependencies", "Parse a lockfile or manifest (package.json, package-lock.json, requirements.txt, go.mod) and check all dependencies for known CVEs via the OSV database. Reads the file directly.", {
+server.tool("scan_dependencies", "Parse a lockfile or manifest (package.json, package-lock.json, requirements.txt, go.mod) and check all dependencies for known CVEs via the OSV database. Reads the file directly. Use this after installing dependencies, during CI, or when auditing existing projects for vulnerable packages.", {
     manifest_path: z.string().describe("Path to manifest file (e.g. 'package.json', 'requirements.txt', 'go.mod')"),
     format: z.enum(["markdown", "json"]).default("markdown").describe("Output format: markdown (human) or json (machine-readable for agents)"),
 }, async ({ manifest_path, format }) => {
@@ -258,8 +262,14 @@ server.tool("check_package_health", "Check npm packages for typosquat risk, main
     packages: z.array(z.string()).describe("List of package names to check (e.g. ['lodash', 'expres', 'react-qeury'])"),
     format: z.enum(["markdown", "json"]).default("markdown").describe("Output format: markdown (human) or json (machine-readable for agents)"),
 }, async ({ packages, format }) => {
-    const results = await checkPackageHealth(packages, format);
-    return { content: [{ type: "text", text: results }] };
+    try {
+        const results = await checkPackageHealth(packages, format);
+        return { content: [{ type: "text", text: results }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { content: [{ type: "text", text: `⚠️ Package health check failed: ${msg}\n\nThis may be a network issue reaching the npm registry. Try again or check your internet connection.` }] };
+    }
 });
 // Tool 12: Auto-fix security vulnerabilities
 server.tool("fix_code", "Analyze code for security vulnerabilities and return fix suggestions with concrete patches. The AI agent can apply these patches to automatically fix issues. Returns structured fix data including before/after code, severity, and line numbers.", {
@@ -325,7 +335,7 @@ server.tool("scan_secrets_history", "Scan git history for leaked secrets. Finds
     return { content: [{ type: "text", text: results }] };
 });
 // Tool 17: Compliance Policy Check
-server.tool("policy_check", "Check project against compliance policies defined in .guardviberc. Validates custom framework requirements, severity thresholds, required controls, and risk exceptions. Returns pass/fail status with detailed findings per control.", {
+server.tool("policy_check", "Check project against compliance policies defined in .guardviberc. Use this in CI/CD pipelines to enforce security gates, or before releases to verify compliance requirements are met. Validates custom framework requirements, severity thresholds, required controls, and risk exceptions. Returns pass/fail status with detailed findings per control.", {
     path: z.string().describe("Project root directory"),
     format: z.enum(["markdown", "json"]).default("markdown").describe("Output format"),
 }, async ({ path, format }) => {

package/build/tools/check-code.js

@@ -173,6 +173,13 @@ function hasRoleCheckPattern(code) {
     // Destructured role check: const { role } = ...; if (role !== "admin")
     if (/\brole\b[\s\S]{0,100}?(?:!==|===)\s*["']/i.test(code))
         return true;
+    // Import + call of admin/role guard function (requireAdmin, requireRole, checkAdmin, etc.)
+    if (/import\s+.*(?:requireAdmin|requireRole|checkAdmin|isAdmin|verifyAdmin|assertAdmin)\b/i.test(code) &&
+        /(?:requireAdmin|requireRole|checkAdmin|isAdmin|verifyAdmin|assertAdmin)\s*\(/i.test(code))
+        return true;
+    // await requireAdmin() with error check pattern (naming-agnostic admin guard)
+    if (/await\s+(?:\w+\.)*\w*(?:Admin|admin)\w*\s*\([^)]*\)\s*;?\s*\n\s*if\s*\(/i.test(code))
+        return true;
     return false;
 }
 /**
@@ -327,18 +334,47 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         // Skip open redirect rules when redirect URL validation is present
         if (codeHasRedirectValidation && ["VG425", "VG409", "VG660"].includes(rule.id))
             continue;
-        // Skip VG131 (state-changing GET) when only read operations are present
-        if (rule.id === "VG131") {
-            // If code only has read operations (findMany, findFirst, count, aggregate, select)
-            // and no actual mutations, skip this rule
-            const hasMutation = /(?:\.create\s*\(|\.update\s*\(|\.delete\s*\(|\.destroy\s*\(|\.remove\s*\(|\.insert\s*\(|DELETE\s+FROM|UPDATE\s+\w|INSERT\s+INTO)/i.test(code);
-            const onlyInComments = !hasMutation;
-            if (onlyInComments)
+        // Skip VG678 (Missing X-Content-Type-Options) in client components —
+        // client-side code calling getPublicUrl() can't set response headers.
+        // Also skip when code only uses Supabase getPublicUrl/getSignedUrl to generate
+        // URL strings (not actually serving file content via response stream).
+        if (rule.id === "VG678") {
+            const isClientComponent = /^['"]use client['"]/.test(code.trimStart()) ||
+                (filePath && /Client\.\w+$/.test(filePath));
+            if (isClientComponent)
                 continue;
+            const hasOnlyUrlGeneration = /(?:getPublicUrl|getSignedUrl)\s*\(/i.test(code) &&
+                !/(?:createReadStream|sendFile|res\.download|\.pipe\s*\()/i.test(code);
+            if (hasOnlyUrlGeneration)
+                continue;
+        }
+        // Skip VG131 (state-changing GET) when the GET function body has no mutations.
+        // Must check per-GET-function, not the whole file — files with GET+POST would false-positive.
+        if (rule.id === "VG131") {
+            const getMatch = /export\s+(?:async\s+)?function\s+GET\s*\([^)]*\)\s*\{/.exec(code);
+            if (getMatch) {
+                const getStart = getMatch.index + getMatch[0].length;
+                let depth = 1, pos = getStart;
+                while (depth > 0 && pos < code.length) {
+                    if (code[pos] === "{")
+                        depth++;
+                    else if (code[pos] === "}")
+                        depth--;
+                    pos++;
+                }
+                const getBody = code.substring(getStart, pos);
+                const hasMutationInGet = /(?:\.create\s*\(|\.update\s*\(|\.delete\s*\(|\.destroy\s*\(|\.remove\s*\(|\.insert\s*\(|\.upsert\s*\(|DELETE\s+FROM|UPDATE\s+\w|INSERT\s+INTO)/i.test(getBody);
+                if (!hasMutationInGet)
+                    continue;
+            }
         }
         // Skip CVE version rules in peerDependencies (ranges, not actual versions)
         if (isPeerDeps && rule.id === "VG903")
             continue;
+        // Skip VG020 (wildcard dependency version) in lock files — engine constraints
+        // like "node": ">=6" are not dependency versions
+        if (rule.id === "VG020" && filePath && /(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json)$/.test(filePath))
+            continue;
         // VG872/VG873 legitimate package filtering is handled at match level below
         // Skip server-only import rule (VG964) for files that are inherently server-only:
         // Route Handlers (app/api/), middleware, instrumentation, next.config,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "2.9.5",
+  "version": "2.9.6",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 334 rules, 31 tools, CLI + doctor. Host security: CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, MCP config audit, AI host hardening. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",