guardvibe 3.0.7 → 3.0.8

package/build/cli/audit.js

@@ -9,13 +9,18 @@ import { runFullAudit, formatAuditResult } from "../tools/full-audit.js";
 export async function runAudit(args) {
     const { flags, positional } = parseArgs(args);
     const targetPath = resolve(positional[0] ?? ".");
-    const format = validateFormat(flags);
+    const rawFormat = validateFormat(flags);
     const outputFile = getOutputPath(flags);
     const failOn = getStringFlag(flags, "fail-on") ?? "critical";
     const skipDeps = flags["skip-deps"] === true;
     const skipSecrets = flags["skip-secrets"] === true;
+    // Terminal format by default when outputting to TTY, unless --format is specified
+    const isTerminal = !outputFile && process.stdout.isTTY && !flags["format"];
+    const format = isTerminal ? "terminal" : rawFormat;
     const result = await runFullAudit(targetPath, { skipDeps, skipSecrets });
     const output = formatAuditResult(result, format);
+    // For shouldFail, always use JSON-parseable format
+    const failCheckOutput = formatAuditResult(result, "json");
     if (outputFile) {
         const dir = dirname(outputFile);
         if (!existsSync(dir)) {
@@ -29,6 +34,6 @@ export async function runAudit(args) {
     }
     // Print result hash to stderr for CI piping
     console.error(`result-hash: ${result.resultHash}`);
-    if (shouldFail(output, failOn))
+    if (shouldFail(failCheckOutput, failOn))
         process.exit(1);
 }

package/build/tools/full-audit.d.ts

@@ -76,6 +76,6 @@ export declare function runFullAudit(path: string, options?: {
     skipSecrets?: boolean;
 }): Promise<AuditResult>;
 /**
- * Format audit result as markdown or JSON.
+ * Format audit result as markdown, JSON, or terminal-friendly output.
  */
-export declare function formatAuditResult(result: AuditResult, format: "markdown" | "json"): string;
+export declare function formatAuditResult(result: AuditResult, format: "markdown" | "json" | "terminal"): string;

package/build/tools/full-audit.js

@@ -293,12 +293,15 @@ export async function runFullAudit(path, options) {
 }
 // --- Formatter ---
 /**
- * Format audit result as markdown or JSON.
+ * Format audit result as markdown, JSON, or terminal-friendly output.
  */
 export function formatAuditResult(result, format) {
     if (format === "json") {
         return JSON.stringify(result);
     }
+    if (format === "terminal") {
+        return formatTerminal(result);
+    }
     const verdictLabel = {
         PASS: "PASS — Project verified secure",
         WARN: "WARN — High severity issues found",
@@ -363,3 +366,54 @@ export function formatAuditResult(result, format) {
     lines.push(`Result hash: \`${result.resultHash}\` (same code + same GuardVibe version = same hash)`);
     return lines.join("\n");
 }
+// --- Terminal-friendly formatter ---
+function formatTerminal(result) {
+    const R = "\x1b[31m"; // red
+    const G = "\x1b[32m"; // green
+    const Y = "\x1b[33m"; // yellow
+    const B = "\x1b[1m"; // bold
+    const D = "\x1b[2m"; // dim
+    const X = "\x1b[0m"; // reset
+    const verdictColor = result.verdict === "PASS" ? G : result.verdict === "WARN" ? Y : R;
+    const scoreBar = (() => {
+        const width = 20;
+        const filled = Math.round((result.score / 100) * width);
+        const bar = "\u2588".repeat(filled) + "\u2591".repeat(width - filled);
+        const color = result.score >= 75 ? G : result.score >= 50 ? Y : R;
+        return `${color}${bar}${X}`;
+    })();
+    const lines = [
+        ``,
+        `  ${B}GuardVibe Full Audit Report${X}`,
+        ``,
+        `  ${verdictColor}${B}${result.verdict}${X}  ${verdictColor}${result.verdict === "PASS" ? "Project verified secure" : result.verdict === "WARN" ? "High severity issues found" : "Critical security issues detected"}${X}`,
+        ``,
+        `  Score  ${scoreBar}  ${B}${result.grade}${X} ${D}(${result.score}/100)${X}`,
+        ``,
+        `  ${B}Findings${X}`,
+        `  ${R}${B}${result.summary.critical}${X} critical  ${Y}${B}${result.summary.high}${X} high  ${D}${result.summary.medium} medium${X}  ${D}(${result.summary.totalFindings} total)${X}`,
+        ``,
+        `  ${B}Sections${X}`,
+    ];
+    const sectionIcon = { ok: `${G}\u2714${X}`, error: `${R}\u2718${X}`, skipped: `${D}\u2500${X}` };
+    for (const s of result.sections) {
+        const icon = sectionIcon[s.status] ?? s.status;
+        const count = s.findings > 0 ? `${s.findings}` : `${D}0${X}`;
+        lines.push(`  ${icon} ${s.name.padEnd(14)} ${count.padStart(4)}  ${D}${s.details}${X}`);
+    }
+    lines.push(``);
+    lines.push(`  ${B}Coverage${X}`);
+    lines.push(`  ${result.coverage.filesScanned} files scanned  ${D}${result.coverage.coveragePercent}% coverage  ${result.coverage.rulesApplied} rules${X}`);
+    if (result.actionItems.length > 0) {
+        lines.push(``);
+        lines.push(`  ${B}Action Items${X}`);
+        for (const item of result.actionItems) {
+            const color = item.includes("critical") ? R : item.includes("high") ? Y : D;
+            lines.push(`  ${color}\u25B8${X} ${item}`);
+        }
+    }
+    lines.push(``);
+    lines.push(`  ${D}Hash: ${result.resultHash}  |  ${result.timestamp.slice(0, 19)}${X}`);
+    lines.push(``);
+    return lines.join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.7",
+  "version": "3.0.8",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 334 rules, 34 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",