guardvibe 3.0.6 → 3.0.7

package/build/cli/auth-coverage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CLI: guardvibe auth-coverage [path]
+ * Analyze authentication coverage across Next.js App Router routes.
+ */
+export declare function runAuthCoverage(args: string[]): Promise<void>;

package/build/cli/auth-coverage.js

@@ -0,0 +1,74 @@
+/**
+ * CLI: guardvibe auth-coverage [path]
+ * Analyze authentication coverage across Next.js App Router routes.
+ */
+import { readdirSync, readFileSync, statSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { resolve, dirname } from "path";
+import { parseArgs, validateFormat, getOutputPath } from "./args.js";
+import { analyzeAuthCoverage, formatAuthCoverage } from "../tools/auth-coverage.js";
+export async function runAuthCoverage(args) {
+    const { flags, positional } = parseArgs(args);
+    const targetPath = resolve(positional[0] ?? ".");
+    const format = validateFormat(flags);
+    const outputFile = getOutputPath(flags);
+    // Walk directory to discover route/page/layout/middleware files
+    const jsFiles = [];
+    const skip = new Set(["node_modules", ".git", ".next", "build", "dist", ".turbo", "coverage"]);
+    function walk(d) {
+        if (jsFiles.length >= 500)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (jsFiles.length >= 500)
+                return;
+            if (skip.has(entry))
+                continue;
+            const full = resolve(d, entry);
+            let stat;
+            try {
+                stat = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isDirectory()) {
+                walk(full);
+                continue;
+            }
+            if (!/\.(ts|tsx|js|jsx)$/.test(entry))
+                continue;
+            if (stat.size > 100_000)
+                continue;
+            try {
+                const content = readFileSync(full, "utf-8");
+                const relPath = full.replace(targetPath + "/", "");
+                jsFiles.push({ path: relPath, content });
+            }
+            catch { /* skip unreadable */ }
+        }
+    }
+    walk(targetPath);
+    const routeFiles = jsFiles.filter(f => /\/(route|page)\.(ts|tsx|js|jsx)$/.test(f.path));
+    const layoutFiles = jsFiles.filter(f => /\/layout\.(ts|tsx|js|jsx)$/.test(f.path));
+    const middlewareFile = jsFiles.find(f => /middleware\.(ts|js)$/.test(f.path));
+    const report = analyzeAuthCoverage(routeFiles, middlewareFile?.content ?? "", layoutFiles);
+    const formatArg = format === "json" ? "json" : "markdown";
+    const result = formatAuthCoverage(report, formatArg);
+    if (outputFile) {
+        const dir = dirname(outputFile);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        writeFileSync(outputFile, result, "utf-8");
+        console.log(`  [OK] Results written to ${outputFile}`);
+    }
+    else {
+        console.log(result);
+    }
+}

package/build/cli/compliance.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CLI: guardvibe compliance [path] --framework SOC2
+ * Generate compliance report mapping findings to framework controls.
+ */
+export declare function runCompliance(args: string[]): Promise<void>;

package/build/cli/compliance.js

@@ -0,0 +1,33 @@
+/**
+ * CLI: guardvibe compliance [path] --framework SOC2
+ * Generate compliance report mapping findings to framework controls.
+ */
+import { writeFileSync, existsSync, mkdirSync } from "fs";
+import { resolve, dirname } from "path";
+import { parseArgs, validateFormat, getOutputPath, getStringFlag } from "./args.js";
+import { complianceReport } from "../tools/compliance-report.js";
+const VALID_FRAMEWORKS = new Set(["SOC2", "PCI-DSS", "HIPAA", "GDPR", "ISO27001", "EUAIACT"]);
+export async function runCompliance(args) {
+    const { flags, positional } = parseArgs(args);
+    const targetPath = resolve(positional[0] ?? ".");
+    const framework = getStringFlag(flags, "framework") ?? "SOC2";
+    const format = validateFormat(flags);
+    const outputFile = getOutputPath(flags);
+    if (!VALID_FRAMEWORKS.has(framework)) {
+        console.error(`  [ERR] Invalid framework "${framework}". Use: ${[...VALID_FRAMEWORKS].join(", ")}`);
+        process.exit(1);
+    }
+    const formatArg = format === "json" ? "json" : "markdown";
+    const result = complianceReport(targetPath, framework, formatArg);
+    if (outputFile) {
+        const dir = dirname(outputFile);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        writeFileSync(outputFile, result, "utf-8");
+        console.log(`  [OK] Results written to ${outputFile}`);
+    }
+    else {
+        console.log(result);
+    }
+}

package/build/cli.js

@@ -26,6 +26,8 @@ function printUsage() {
     npx guardvibe explain <ruleId>   Get detailed remediation guidance for a rule
     npx guardvibe fix <file>         Get security fix suggestions for a file
     npx guardvibe check-cmd "<cmd>"  Check if a shell command is safe to execute
+    npx guardvibe auth-coverage [path]  Auth coverage analysis (Next.js routes)
+    npx guardvibe compliance [path]     Compliance report (--framework SOC2|GDPR|...)
     npx guardvibe init <platform>    Setup MCP server configuration
     npx guardvibe hook install       Install pre-commit security hook
     npx guardvibe hook uninstall     Remove pre-commit security hook
@@ -142,6 +144,14 @@ async function main() {
         const { runCheckCmd } = await import("./cli/check-cmd.js");
         await runCheckCmd(subArgs);
     }
+    else if (command === "auth-coverage") {
+        const { runAuthCoverage } = await import("./cli/auth-coverage.js");
+        await runAuthCoverage(subArgs);
+    }
+    else if (command === "compliance") {
+        const { runCompliance } = await import("./cli/compliance.js");
+        await runCompliance(subArgs);
+    }
     else {
         console.error(`  Unknown command: ${command}`);
         printUsage();

package/build/tools/check-code.js

@@ -276,6 +276,7 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
     const codeHasFilenameSanitization = /(?:\.replace\s*\(\s*\/\[?\^?[a-z0-9\\-_\]]*\]?\/?[gi]*\s*,|sanitize(?:File|Name|Path)|safeName|cleanName)/i.test(code) ||
         /(?:Date\.now\(\)|timestamp|uuid|nanoid|crypto\.randomUUID)[\s\S]{0,80}?\.\s*(?:ext|split|pop)/i.test(code);
     const isPeerDeps = /["']peerDependencies["']/i.test(code);
+    const codeHasAuthSession = /(?:supabase\.auth\.getUser|supabase\.auth\.getSession|getServerSession|auth\(\)|getSession\(\)|currentUser\(\))/i.test(code);
     // Config: check custom auth function names from .guardviberc
     if (!codeHasAuthGuard && config.authFunctions && config.authFunctions.length > 0) {
         const customPattern = new RegExp(`(?:${config.authFunctions.join("|")})\\s*\\(`, "i");
@@ -544,6 +545,23 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (/(?:Count|Length|Balance|Map|List|Array|Index|Size|Total|Num|Id|Type|Name|Status|Data|Info|Error|Result|Response|Config|Option|Url|Path|Provider|Model|Limit|Quota|Rate|Max|Min)/i.test(varName))
                     continue;
             }
+            // Skip VG1005 (.or() filter injection) when all interpolated variables are
+            // server-verified auth IDs (user.id, session.user.id, auth.uid, currentUser.id)
+            if (rule.id === "VG1005" && codeHasAuthSession) {
+                // The regex match ends at `${` — grab the full template literal from code
+                const orStart = match.index;
+                const backtickIdx = code.indexOf('`', orStart);
+                if (backtickIdx !== -1) {
+                    const closingBacktick = code.indexOf('`', backtickIdx + 1);
+                    if (closingBacktick !== -1) {
+                        const fullTemplate = code.substring(backtickIdx, closingBacktick + 1);
+                        const interpolations = [...fullTemplate.matchAll(/\$\{([^}]+)\}/g)].map(m => m[1].trim());
+                        const safeAuthPattern = /^(?:user\.id|user\?\.id|session\.user\.id|session\.user\?\.id|currentUser\.id|currentUser\?\.id|auth\.uid|auth\?\.uid|session\.uid|session\?\.uid)$/;
+                        if (interpolations.length > 0 && interpolations.every(v => safeAuthPattern.test(v)))
+                            continue;
+                    }
+                }
+            }
             // Skip VG903 React version in peerDependencies sections
             if (rule.id === "VG903") {
                 const beforeText = code.substring(0, match.index);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.6",
+  "version": "3.0.7",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 334 rules, 34 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",