guardvibe 3.1.8 → 3.1.9

package/build/tools/auth-coverage.js

@@ -9,9 +9,13 @@ const HTTP_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"
  * route groups, and file name.
  */
 function filePathToUrlPath(filePath) {
-    let p = filePath
-        .replace(/^src\/app\//, "")
-        .replace(/^app\//, "");
+    // Strip everything up to and including the Next.js app directory.
+    // Covers: app/..., src/app/..., apps/<workspace>/app/..., apps/<workspace>/src/app/...,
+    // packages/<name>/app/... — common monorepo (Turborepo/pnpm) layouts where the
+    // route file lives under a workspace prefix that is not part of the URL.
+    let p = filePath.replace(/^.*?\/(?:src\/)?app\//, "");
+    // Fallback for simple non-monorepo paths.
+    p = p.replace(/^src\/app\//, "").replace(/^app\//, "");
     // Remove file name (route.ts, page.tsx, layout.tsx)
     p = p.replace(/\/(route|page|layout)\.(ts|tsx|js|jsx)$/, "");
     // Remove route groups: (groupName)
@@ -80,7 +84,12 @@ export function enumerateRoutes(files) {
  */
 export function parseMiddlewareMatchers(content) {
     // Normalize literal escape sequences that AI assistants may pass
-    const normalized = content.replace(/\\n/g, "\n").replace(/\\t/g, "\t");
+    let normalized = content.replace(/\\n/g, "\n").replace(/\\t/g, "\t");
+    // Strip block + line comments before pulling the matcher array. Real-world
+    // middleware files carry JSDoc-style notes inline (dub's matcher block has
+    // four bullet points); split-on-comma was swallowing those bullets into the
+    // matcher list, breaking every downstream regex test.
+    normalized = normalized.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "");
     const stringMatch = /matcher\s*:\s*"([^"]+)"/.exec(normalized);
     if (stringMatch)
         return [stringMatch[1]];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.8",
+  "version": "3.1.9",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",