guardvibe 3.0.48 → 3.0.49

package/build/cli/audit.js

@@ -16,11 +16,12 @@ export async function runAudit(args) {
     const failOn = getStringFlag(flags, "fail-on") ?? "critical";
     const skipDeps = flags["skip-deps"] === true;
     const skipSecrets = flags["skip-secrets"] === true;
+    const full = flags["full"] === true;
     setRules(builtinRules);
     // Terminal format by default when outputting to TTY, unless --format is specified
     const isTerminal = !outputFile && process.stdout.isTTY && !flags["format"];
     const format = isTerminal ? "terminal" : rawFormat;
-    const result = await runFullAudit(targetPath, { skipDeps, skipSecrets });
+    const result = await runFullAudit(targetPath, { skipDeps, skipSecrets, full });
     const output = formatAuditResult(result, format);
     // For shouldFail, always use JSON-parseable format
     const failCheckOutput = formatAuditResult(result, "json");

package/build/cli/scan.js

@@ -46,6 +46,7 @@ export async function runDirectoryScan(targetPath, flags) {
     const outputFile = getOutputPath(flags);
     const baselinePath = getStringFlag(flags, "baseline");
     const saveBaseline = flags["save-baseline"] === true || typeof flags["save-baseline"] === "string";
+    const full = flags["full"] === true;
     const scanPath = resolve(targetPath);
     let result;
     if (format === "sarif") {
@@ -53,7 +54,7 @@ export async function runDirectoryScan(targetPath, flags) {
         result = exportSarif(scanPath);
     }
     else {
-        result = scanDirectory(scanPath, true, [], format === "json" ? "json" : "markdown", undefined, baselinePath ?? undefined);
+        result = scanDirectory(scanPath, true, [], format === "json" ? "json" : "markdown", undefined, baselinePath ?? undefined, full);
     }
     if (outputFile) {
         safeWriteOutput(outputFile, result);

package/build/tools/full-audit.d.ts

@@ -89,6 +89,7 @@ export declare function computeResultHash(findings: FindingRef[]): string;
 export declare function runFullAudit(path: string, options?: {
     skipDeps?: boolean;
     skipSecrets?: boolean;
+    full?: boolean;
 }): Promise<AuditResult>;
 /**
  * Format audit result as markdown, JSON, or terminal-friendly output.

package/build/tools/full-audit.js

@@ -72,6 +72,7 @@ function collectJsFiles(dir, maxFiles = 200) {
         "node_modules", ".git", ".next", "build", "dist", ".turbo", "coverage",
         ...config.scan.exclude,
     ]);
+    // `maxFiles = Infinity` is the contract for full mode (CLI --full flag): scan everything.
     function walk(d) {
         if (files.length >= maxFiles)
             return;
@@ -124,19 +125,20 @@ export async function runFullAudit(path, options) {
     const rules = getRules();
     const allFindings = [];
     const sections = [];
+    const full = options?.full === true;
     let filesScanned = 0;
     let filesSkipped = 0;
     let score = 100;
     let grade = "A";
-    // Truncation tracking
+    // Truncation tracking — `full` mode (CLI --full flag) bypasses caps for local debugging.
     let scanTruncated = false;
     let scanTotalFindings = 0;
-    let scanMaxFindings = 50; // MAX_JSON_FINDINGS from scan-directory
+    let scanMaxFindings = full ? Number.POSITIVE_INFINITY : 50;
     let taintFilesProcessed = 0;
-    const taintFileCap = 200;
+    const taintFileCap = full ? Number.POSITIVE_INFINITY : 200;
     // --- Section 1: Code scan ---
     try {
-        const codeJson = scanDirectory(projectRoot, true, [], "json", rules.length > 0 ? rules : undefined);
+        const codeJson = scanDirectory(projectRoot, true, [], "json", rules.length > 0 ? rules : undefined, undefined, full);
         const parsed = safeJsonParse(codeJson);
         if (parsed) {
             const counts = parseSectionCounts(parsed);
@@ -296,7 +298,7 @@ export async function runFullAudit(path, options) {
     }
     // --- Section 5: Taint analysis ---
     try {
-        const jsFiles = collectJsFiles(projectRoot);
+        const jsFiles = collectJsFiles(projectRoot, taintFileCap);
         taintFilesProcessed = jsFiles.length;
         if (jsFiles.length > 0) {
             const { crossFileFindings, perFileFindings } = analyzeCrossFileTaint(jsFiles);
@@ -340,7 +342,7 @@ export async function runFullAudit(path, options) {
     }
     // --- Section 6: Auth coverage ---
     try {
-        const jsFiles = collectJsFiles(projectRoot);
+        const jsFiles = collectJsFiles(projectRoot, taintFileCap);
         const routeFiles = jsFiles.filter(f => /\/(route|page)\.(ts|tsx|js|jsx)$/.test(f.path));
         const layoutFiles = jsFiles.filter(f => /\/layout\.(ts|tsx|js|jsx)$/.test(f.path));
         if (routeFiles.length > 0) {

package/build/tools/scan-directory.d.ts

@@ -1,2 +1,2 @@
 import type { SecurityRule } from "../data/rules/types.js";
-export declare function scanDirectory(path: string, recursive?: boolean, exclude?: string[], format?: "markdown" | "json", rules?: SecurityRule[], baselinePath?: string): string;
+export declare function scanDirectory(path: string, recursive?: boolean, exclude?: string[], format?: "markdown" | "json", rules?: SecurityRule[], baselinePath?: string, full?: boolean): string;

package/build/tools/scan-directory.js

@@ -41,7 +41,7 @@ function computeBaselineDiff(current, previous) {
         unchanged: current.filter(e => prevSet.has(currKey(e))),
     };
 }
-export function scanDirectory(path, recursive = true, exclude = [], format = "markdown", rules, baselinePath) {
+export function scanDirectory(path, recursive = true, exclude = [], format = "markdown", rules, baselinePath, full = false) {
     const startTime = performance.now();
     const scanId = randomUUID();
     const scanRoot = resolve(path);
@@ -141,8 +141,10 @@ export function scanDirectory(path, recursive = true, exclude = [], format = "ma
     }
     // MCP output size limit — large projects can produce 300K+ characters which
     // exceeds Claude Code's max allowed tokens for tool results.
-    const MAX_JSON_FINDINGS = 50;
-    const MAX_MD_FINDINGS = 30;
+    // `full=true` (CLI --full flag) bypasses these caps for local debugging where
+    // size budget doesn't apply.
+    const MAX_JSON_FINDINGS = full ? Number.POSITIVE_INFINITY : 50;
+    const MAX_MD_FINDINGS = full ? Number.POSITIVE_INFINITY : 30;
     if (format === "json") {
         const findingsWithFiles = scanResults.flatMap(r => r.findings.map(f => ({ ...f, rule: f.rule, file: r.path })));
         // Sort by severity: critical first, then high, then medium

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.48",
+  "version": "3.0.49",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",