guardvibe 3.0.30 → 3.0.32

package/build/cli/init.js

@@ -2,12 +2,17 @@
  * CLI: guardvibe init <platform>
  * Sets up MCP server configuration for AI coding hosts.
  */
+import { createRequire } from "module";
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
 import { join, dirname } from "path";
 import { homedir } from "os";
+const require = createRequire(import.meta.url);
+const pkg = require("../../package.json");
+// Pin to the version that ran `init` for fast, deterministic startup.
+// Users upgrade by re-running init. Avoids slow npx-cache misses on each session start.
 const GUARDVIBE_MCP_CONFIG = {
     command: "npx",
-    args: ["-y", "guardvibe@latest"],
+    args: ["-y", `guardvibe@${pkg.version}`],
 };
 const platforms = {
     claude: {

package/build/tools/check-code.js

@@ -335,6 +335,15 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
         const isWebhookRoute = filePath && /webhook/i.test(filePath);
         const isCronRoute = filePath && /(?:cron|scheduled|jobs?)\//i.test(filePath);
         const isAdminRoute = filePath && /\/admin\//i.test(filePath);
+        // Skip rate-limit rules when the file installs a global rate limiter via app.use().
+        // Covers `app.use(rateLimit({...}))`, `app.use(limiter)`, `app.use('/api', rateLimit({...}))`,
+        // and named middleware vars matching limiter naming conventions.
+        if (rateLimitRuleIds.has(rule.id)) {
+            const hasGlobalRateLimit = /(?:app|router)\.use\s*\(\s*(?:[^,)]*,\s*)?(?:rateLimit|slowDown|expressRateLimit|expressSlowDown|RateLimit|Throttle|throttle)\s*\(/i.test(code) ||
+                /(?:app|router)\.use\s*\(\s*(?:[^,)]*,\s*)?\w*(?:[Ll]imiter|[Tt]hrottle|[Rr]ate[Ll]imit|[Ss]low[Dd]own|[Bb]rute)\w*\s*\)/.test(code);
+            if (hasGlobalRateLimit)
+                continue;
+        }
         // Skip auth rules when code has any auth guard pattern (naming-agnostic)
         if (codeHasAuthGuard && authRuleIds.has(rule.id))
             continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.30",
+  "version": "3.0.32",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",