guardvibe 3.0.6 → 3.0.8

package/build/cli/audit.js

@@ -9,13 +9,18 @@ import { runFullAudit, formatAuditResult } from "../tools/full-audit.js";
 export async function runAudit(args) {
     const { flags, positional } = parseArgs(args);
     const targetPath = resolve(positional[0] ?? ".");
-    const format = validateFormat(flags);
+    const rawFormat = validateFormat(flags);
     const outputFile = getOutputPath(flags);
     const failOn = getStringFlag(flags, "fail-on") ?? "critical";
     const skipDeps = flags["skip-deps"] === true;
     const skipSecrets = flags["skip-secrets"] === true;
+    // Terminal format by default when outputting to TTY, unless --format is specified
+    const isTerminal = !outputFile && process.stdout.isTTY && !flags["format"];
+    const format = isTerminal ? "terminal" : rawFormat;
     const result = await runFullAudit(targetPath, { skipDeps, skipSecrets });
     const output = formatAuditResult(result, format);
+    // For shouldFail, always use JSON-parseable format
+    const failCheckOutput = formatAuditResult(result, "json");
     if (outputFile) {
         const dir = dirname(outputFile);
         if (!existsSync(dir)) {
@@ -29,6 +34,6 @@ export async function runAudit(args) {
     }
     // Print result hash to stderr for CI piping
     console.error(`result-hash: ${result.resultHash}`);
-    if (shouldFail(output, failOn))
+    if (shouldFail(failCheckOutput, failOn))
         process.exit(1);
 }

package/build/cli/auth-coverage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CLI: guardvibe auth-coverage [path]
+ * Analyze authentication coverage across Next.js App Router routes.
+ */
+export declare function runAuthCoverage(args: string[]): Promise<void>;

package/build/cli/auth-coverage.js

@@ -0,0 +1,74 @@
+/**
+ * CLI: guardvibe auth-coverage [path]
+ * Analyze authentication coverage across Next.js App Router routes.
+ */
+import { readdirSync, readFileSync, statSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { resolve, dirname } from "path";
+import { parseArgs, validateFormat, getOutputPath } from "./args.js";
+import { analyzeAuthCoverage, formatAuthCoverage } from "../tools/auth-coverage.js";
+export async function runAuthCoverage(args) {
+    const { flags, positional } = parseArgs(args);
+    const targetPath = resolve(positional[0] ?? ".");
+    const format = validateFormat(flags);
+    const outputFile = getOutputPath(flags);
+    // Walk directory to discover route/page/layout/middleware files
+    const jsFiles = [];
+    const skip = new Set(["node_modules", ".git", ".next", "build", "dist", ".turbo", "coverage"]);
+    function walk(d) {
+        if (jsFiles.length >= 500)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (jsFiles.length >= 500)
+                return;
+            if (skip.has(entry))
+                continue;
+            const full = resolve(d, entry);
+            let stat;
+            try {
+                stat = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isDirectory()) {
+                walk(full);
+                continue;
+            }
+            if (!/\.(ts|tsx|js|jsx)$/.test(entry))
+                continue;
+            if (stat.size > 100_000)
+                continue;
+            try {
+                const content = readFileSync(full, "utf-8");
+                const relPath = full.replace(targetPath + "/", "");
+                jsFiles.push({ path: relPath, content });
+            }
+            catch { /* skip unreadable */ }
+        }
+    }
+    walk(targetPath);
+    const routeFiles = jsFiles.filter(f => /\/(route|page)\.(ts|tsx|js|jsx)$/.test(f.path));
+    const layoutFiles = jsFiles.filter(f => /\/layout\.(ts|tsx|js|jsx)$/.test(f.path));
+    const middlewareFile = jsFiles.find(f => /middleware\.(ts|js)$/.test(f.path));
+    const report = analyzeAuthCoverage(routeFiles, middlewareFile?.content ?? "", layoutFiles);
+    const formatArg = format === "json" ? "json" : "markdown";
+    const result = formatAuthCoverage(report, formatArg);
+    if (outputFile) {
+        const dir = dirname(outputFile);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        writeFileSync(outputFile, result, "utf-8");
+        console.log(`  [OK] Results written to ${outputFile}`);
+    }
+    else {
+        console.log(result);
+    }
+}

package/build/cli/compliance.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CLI: guardvibe compliance [path] --framework SOC2
+ * Generate compliance report mapping findings to framework controls.
+ */
+export declare function runCompliance(args: string[]): Promise<void>;

package/build/cli/compliance.js

@@ -0,0 +1,33 @@
+/**
+ * CLI: guardvibe compliance [path] --framework SOC2
+ * Generate compliance report mapping findings to framework controls.
+ */
+import { writeFileSync, existsSync, mkdirSync } from "fs";
+import { resolve, dirname } from "path";
+import { parseArgs, validateFormat, getOutputPath, getStringFlag } from "./args.js";
+import { complianceReport } from "../tools/compliance-report.js";
+const VALID_FRAMEWORKS = new Set(["SOC2", "PCI-DSS", "HIPAA", "GDPR", "ISO27001", "EUAIACT"]);
+export async function runCompliance(args) {
+    const { flags, positional } = parseArgs(args);
+    const targetPath = resolve(positional[0] ?? ".");
+    const framework = getStringFlag(flags, "framework") ?? "SOC2";
+    const format = validateFormat(flags);
+    const outputFile = getOutputPath(flags);
+    if (!VALID_FRAMEWORKS.has(framework)) {
+        console.error(`  [ERR] Invalid framework "${framework}". Use: ${[...VALID_FRAMEWORKS].join(", ")}`);
+        process.exit(1);
+    }
+    const formatArg = format === "json" ? "json" : "markdown";
+    const result = complianceReport(targetPath, framework, formatArg);
+    if (outputFile) {
+        const dir = dirname(outputFile);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        writeFileSync(outputFile, result, "utf-8");
+        console.log(`  [OK] Results written to ${outputFile}`);
+    }
+    else {
+        console.log(result);
+    }
+}

package/build/cli.js

@@ -26,6 +26,8 @@ function printUsage() {
     npx guardvibe explain <ruleId>   Get detailed remediation guidance for a rule
     npx guardvibe fix <file>         Get security fix suggestions for a file
     npx guardvibe check-cmd "<cmd>"  Check if a shell command is safe to execute
+    npx guardvibe auth-coverage [path]  Auth coverage analysis (Next.js routes)
+    npx guardvibe compliance [path]     Compliance report (--framework SOC2|GDPR|...)
     npx guardvibe init <platform>    Setup MCP server configuration
     npx guardvibe hook install       Install pre-commit security hook
     npx guardvibe hook uninstall     Remove pre-commit security hook
@@ -142,6 +144,14 @@ async function main() {
         const { runCheckCmd } = await import("./cli/check-cmd.js");
         await runCheckCmd(subArgs);
     }
+    else if (command === "auth-coverage") {
+        const { runAuthCoverage } = await import("./cli/auth-coverage.js");
+        await runAuthCoverage(subArgs);
+    }
+    else if (command === "compliance") {
+        const { runCompliance } = await import("./cli/compliance.js");
+        await runCompliance(subArgs);
+    }
     else {
         console.error(`  Unknown command: ${command}`);
         printUsage();

package/build/tools/check-code.js

@@ -276,6 +276,7 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
     const codeHasFilenameSanitization = /(?:\.replace\s*\(\s*\/\[?\^?[a-z0-9\\-_\]]*\]?\/?[gi]*\s*,|sanitize(?:File|Name|Path)|safeName|cleanName)/i.test(code) ||
         /(?:Date\.now\(\)|timestamp|uuid|nanoid|crypto\.randomUUID)[\s\S]{0,80}?\.\s*(?:ext|split|pop)/i.test(code);
     const isPeerDeps = /["']peerDependencies["']/i.test(code);
+    const codeHasAuthSession = /(?:supabase\.auth\.getUser|supabase\.auth\.getSession|getServerSession|auth\(\)|getSession\(\)|currentUser\(\))/i.test(code);
     // Config: check custom auth function names from .guardviberc
     if (!codeHasAuthGuard && config.authFunctions && config.authFunctions.length > 0) {
         const customPattern = new RegExp(`(?:${config.authFunctions.join("|")})\\s*\\(`, "i");
@@ -544,6 +545,23 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
                 if (/(?:Count|Length|Balance|Map|List|Array|Index|Size|Total|Num|Id|Type|Name|Status|Data|Info|Error|Result|Response|Config|Option|Url|Path|Provider|Model|Limit|Quota|Rate|Max|Min)/i.test(varName))
                     continue;
             }
+            // Skip VG1005 (.or() filter injection) when all interpolated variables are
+            // server-verified auth IDs (user.id, session.user.id, auth.uid, currentUser.id)
+            if (rule.id === "VG1005" && codeHasAuthSession) {
+                // The regex match ends at `${` — grab the full template literal from code
+                const orStart = match.index;
+                const backtickIdx = code.indexOf('`', orStart);
+                if (backtickIdx !== -1) {
+                    const closingBacktick = code.indexOf('`', backtickIdx + 1);
+                    if (closingBacktick !== -1) {
+                        const fullTemplate = code.substring(backtickIdx, closingBacktick + 1);
+                        const interpolations = [...fullTemplate.matchAll(/\$\{([^}]+)\}/g)].map(m => m[1].trim());
+                        const safeAuthPattern = /^(?:user\.id|user\?\.id|session\.user\.id|session\.user\?\.id|currentUser\.id|currentUser\?\.id|auth\.uid|auth\?\.uid|session\.uid|session\?\.uid)$/;
+                        if (interpolations.length > 0 && interpolations.every(v => safeAuthPattern.test(v)))
+                            continue;
+                    }
+                }
+            }
             // Skip VG903 React version in peerDependencies sections
             if (rule.id === "VG903") {
                 const beforeText = code.substring(0, match.index);

package/build/tools/full-audit.d.ts

@@ -76,6 +76,6 @@ export declare function runFullAudit(path: string, options?: {
     skipSecrets?: boolean;
 }): Promise<AuditResult>;
 /**
- * Format audit result as markdown or JSON.
+ * Format audit result as markdown, JSON, or terminal-friendly output.
  */
-export declare function formatAuditResult(result: AuditResult, format: "markdown" | "json"): string;
+export declare function formatAuditResult(result: AuditResult, format: "markdown" | "json" | "terminal"): string;

package/build/tools/full-audit.js

@@ -293,12 +293,15 @@ export async function runFullAudit(path, options) {
 }
 // --- Formatter ---
 /**
- * Format audit result as markdown or JSON.
+ * Format audit result as markdown, JSON, or terminal-friendly output.
  */
 export function formatAuditResult(result, format) {
     if (format === "json") {
         return JSON.stringify(result);
     }
+    if (format === "terminal") {
+        return formatTerminal(result);
+    }
     const verdictLabel = {
         PASS: "PASS — Project verified secure",
         WARN: "WARN — High severity issues found",
@@ -363,3 +366,54 @@ export function formatAuditResult(result, format) {
     lines.push(`Result hash: \`${result.resultHash}\` (same code + same GuardVibe version = same hash)`);
     return lines.join("\n");
 }
+// --- Terminal-friendly formatter ---
+function formatTerminal(result) {
+    const R = "\x1b[31m"; // red
+    const G = "\x1b[32m"; // green
+    const Y = "\x1b[33m"; // yellow
+    const B = "\x1b[1m"; // bold
+    const D = "\x1b[2m"; // dim
+    const X = "\x1b[0m"; // reset
+    const verdictColor = result.verdict === "PASS" ? G : result.verdict === "WARN" ? Y : R;
+    const scoreBar = (() => {
+        const width = 20;
+        const filled = Math.round((result.score / 100) * width);
+        const bar = "\u2588".repeat(filled) + "\u2591".repeat(width - filled);
+        const color = result.score >= 75 ? G : result.score >= 50 ? Y : R;
+        return `${color}${bar}${X}`;
+    })();
+    const lines = [
+        ``,
+        `  ${B}GuardVibe Full Audit Report${X}`,
+        ``,
+        `  ${verdictColor}${B}${result.verdict}${X}  ${verdictColor}${result.verdict === "PASS" ? "Project verified secure" : result.verdict === "WARN" ? "High severity issues found" : "Critical security issues detected"}${X}`,
+        ``,
+        `  Score  ${scoreBar}  ${B}${result.grade}${X} ${D}(${result.score}/100)${X}`,
+        ``,
+        `  ${B}Findings${X}`,
+        `  ${R}${B}${result.summary.critical}${X} critical  ${Y}${B}${result.summary.high}${X} high  ${D}${result.summary.medium} medium${X}  ${D}(${result.summary.totalFindings} total)${X}`,
+        ``,
+        `  ${B}Sections${X}`,
+    ];
+    const sectionIcon = { ok: `${G}\u2714${X}`, error: `${R}\u2718${X}`, skipped: `${D}\u2500${X}` };
+    for (const s of result.sections) {
+        const icon = sectionIcon[s.status] ?? s.status;
+        const count = s.findings > 0 ? `${s.findings}` : `${D}0${X}`;
+        lines.push(`  ${icon} ${s.name.padEnd(14)} ${count.padStart(4)}  ${D}${s.details}${X}`);
+    }
+    lines.push(``);
+    lines.push(`  ${B}Coverage${X}`);
+    lines.push(`  ${result.coverage.filesScanned} files scanned  ${D}${result.coverage.coveragePercent}% coverage  ${result.coverage.rulesApplied} rules${X}`);
+    if (result.actionItems.length > 0) {
+        lines.push(``);
+        lines.push(`  ${B}Action Items${X}`);
+        for (const item of result.actionItems) {
+            const color = item.includes("critical") ? R : item.includes("high") ? Y : D;
+            lines.push(`  ${color}\u25B8${X} ${item}`);
+        }
+    }
+    lines.push(``);
+    lines.push(`  ${D}Hash: ${result.resultHash}  |  ${result.timestamp.slice(0, 19)}${X}`);
+    lines.push(``);
+    return lines.join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.6",
+  "version": "3.0.8",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 334 rules, 34 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",