guardvibe 3.0.28 → 3.0.30

package/build/cli/hook.js

@@ -11,7 +11,7 @@ const HOOK_SCRIPT = `#!/bin/sh
 echo "🔒 GuardVibe: scanning staged files..."
 
 # Run guardvibe scan on staged files
-RESULT=$(npx -y guardvibe scan --staged 2>&1)
+RESULT=$(npx -y guardvibe@latest scan --staged 2>&1)
 EXIT_CODE=$?
 
 if [ $EXIT_CODE -ne 0 ]; then

package/build/cli/init.js

@@ -7,7 +7,7 @@ import { join, dirname } from "path";
 import { homedir } from "os";
 const GUARDVIBE_MCP_CONFIG = {
     command: "npx",
-    args: ["-y", "guardvibe"],
+    args: ["-y", "guardvibe@latest"],
 };
 const platforms = {
     claude: {
@@ -98,7 +98,7 @@ function setupClaudeGuide() {
                 matcher: "Edit|Write",
                 hooks: [{
                         type: "command",
-                        command: "jq -r '.tool_input.file_path' | xargs npx -y guardvibe check --format buddy 2>/dev/null || true"
+                        command: "jq -r '.tool_input.file_path' | xargs npx -y guardvibe@latest check --format buddy 2>/dev/null || true"
                     }]
             }
         ];

package/build/data/rules/core.js

@@ -31,7 +31,7 @@ export const coreRules = [
         severity: "high",
         owasp: "A01:2025 Broken Access Control",
         description: "API route handler without authentication middleware or auth check.",
-        pattern: /(?:app|router)\.(get|post|put|delete|patch)\s*\(\s*['"](?!(?:\/(?:api\/)?)?(?:health|status|ping|ready|live|metrics|public|favicon|robots|sitemap)\b)[^'"]*['"]\s*,\s*(?:async\s+)?\(?(?:req|request)/gi,
+        pattern: /(?:app|router)\.(get|post|put|delete|patch)\s*\(\s*['"](?!(?:\/(?:api\/)?)?(?:health|status|ping|ready|live|metrics|public|favicon|robots|sitemap)\b)[^'"]*['"]\s*,\s*(?:async\s+)?\(?\b(?:req|request)\b/gi,
         languages: ["javascript", "typescript"],
         fix: "Add authentication middleware before route handlers: app.get('/api/data', authMiddleware, handler). Use frameworks like Passport.js, Clerk, or Auth0.",
         fixCode: "// Add auth middleware before handler\napp.get('/api/data', authMiddleware, async (req, res) => {\n  // handler code\n});",

package/build/tools/check-code.js

@@ -162,6 +162,16 @@ function hasAuthGuardPattern(code) {
     if (/await\s+(?:\w+\.)*\w*(?:auth|Auth|session|Session|permission|Permission|guard|Guard|verify|Verify|protect|Protect|check|Check|ensure|Ensure|require|Require|assert|Assert|authorize|Authorize)\w*\s*\(/i.test(code)) {
         return true;
     }
+    // Pattern 4: Express-style middleware function with auth-related name (sync, takes req/res/next).
+    // e.g. `function requireAuth(req, res, next)` or `const authMiddleware = (req, res, next) => {`
+    if (/(?:function\s+(?:require|auth|protect|verify|guard|ensure|check|assert|authorize)\w*\s*\(\s*req\b|(?:const|let)\s+(?:require|auth|protect|verify|guard|ensure|check|assert|authorize)\w*\s*=\s*(?:async\s+)?\(\s*req\b)/i.test(code)) {
+        return true;
+    }
+    // Pattern 5: middleware passed inline to express route registration.
+    // e.g. `app.get('/x', requireAuth, handler)` or `router.post('/y', authMiddleware, ...)`.
+    if (/(?:app|router)\.(?:get|post|put|delete|patch|all|use)\s*\([^,)]+,\s*(?:require|auth|protect|verify|guard|ensure|check|assert|authorize|isAuthenticated|isLoggedIn|hasPermission)\w*\s*[,\)]/i.test(code)) {
+        return true;
+    }
     return false;
 }
 /**
@@ -580,6 +590,17 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (pkgMatch && isLegitimatePackage(pkgMatch[1]))
                     continue;
             }
+            // Skip VG863 for non-publishable apps. Signals that this is an application, not a library:
+            // no publishing fields (bin/exports/module/types), main does not point at a build dir,
+            // and start script runs a runtime/framework directly.
+            if (rule.id === "VG863") {
+                const hasPublishingFields = /"(?:bin|exports|module|types|typings)"\s*:/i.test(code);
+                const mainPointsToBuild = /"main"\s*:\s*"(?:dist|build|lib|out)\//i.test(code);
+                const runtimeNames = "node|nodemon|tsx|ts-node|next|nest|vite|remix|astro";
+                const startsAsApp = new RegExp('"start"\\s*:\\s*"(?:' + runtimeNames + ')\\b', "i").test(code);
+                if (!hasPublishingFields && !mainPointsToBuild && startsAsApp)
+                    continue;
+            }
             // Skip VG106 for non-secret variable names (TokenCount, tokenBalance, hashMap, etc.)
             if (rule.id === "VG106") {
                 const varName = match[0].split(/\s*(?:===|!==|==|!=)/)[0].trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.28",
+  "version": "3.0.30",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",