periderm-cli 0.1.0

package/dist/report/terminal.js

@@ -0,0 +1,53 @@
+import chalk from "chalk";
+const ember = chalk.hex("#FF4D00");
+const dim = chalk.hex("#9CA3AF");
+const hairline = dim("─".repeat(72));
+export function printTerminal(r) {
+    const verdictLabel = r.verdict === "launch_ready"
+        ? chalk.bgGreen.black.bold(" LAUNCH READY ")
+        : r.verdict === "hold"
+            ? chalk.bgYellow.black.bold(" HOLD ")
+            : chalk.bgHex("#FF4D00").white.bold(" DO NOT LAUNCH ");
+    console.info("");
+    console.info(hairline);
+    console.info("");
+    console.info(chalk.bold("Periderm CLI Verdict"));
+    console.info(`Launch Confidence:     ${score(r.scores.confidence)}/100`);
+    console.info(`Reality Score:         ${score(r.scores.reality)}/100`);
+    console.info(`Perceived Performance: ${score(r.scores.perceived)}/100`);
+    console.info("");
+    console.info(hairline);
+    console.info("");
+    console.info(`Recommendation: ${verdictLabel}`);
+    console.info(dim("Top embarrassment risks:"));
+    const seenMessages = new Set();
+    const top = [...r.findings]
+        .sort((a, b) => rank(b.severity) - rank(a.severity))
+        .filter((f) => {
+        if (seenMessages.has(f.message))
+            return false;
+        seenMessages.add(f.message);
+        return true;
+    })
+        .slice(0, 8);
+    top.forEach((f, i) => {
+        console.info(`${dim(String(i + 1) + ".")} ${f.message}`);
+    });
+    const total = r.counts.critical + r.counts.high + r.counts.medium + r.counts.low;
+    console.info("");
+    console.info(hairline);
+    console.info("");
+    console.info(`${ember("▸")} ${total} findings · full report: ${dim(".periderm/last-report.md")}`);
+    console.info(`${ember("$")}`);
+    console.info("");
+}
+function rank(s) {
+    return s === "critical" ? 4 : s === "high" ? 3 : s === "medium" ? 2 : 1;
+}
+function score(n) {
+    if (n >= 85)
+        return chalk.green(String(n));
+    if (n >= 65)
+        return chalk.yellow(String(n));
+    return ember(String(n));
+}

package/dist/report/verdict.js

@@ -0,0 +1,42 @@
+/** Category tags used by checks that contribute to Reality / Perceived scores. */
+const REALITY_CATEGORIES = new Set([
+    "Reality & Resilience",
+    "Data Integrity",
+    "Routing & Navigation",
+]);
+const PERCEIVED_CATEGORIES = new Set([
+    "Loading & Transitions",
+    "Error Experience",
+    "Accessibility",
+]);
+export function computeScores(findings) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+    for (const f of findings)
+        counts[f.severity]++;
+    const confidence = clamp(100 - (counts.critical * 15 + counts.high * 6 + counts.medium * 2 + counts.low));
+    const reality = clamp(100 - weightedSubset(findings, (f) => REALITY_CATEGORIES.has(f.category)));
+    const perceived = clamp(100 - weightedSubset(findings, (f) => PERCEIVED_CATEGORIES.has(f.category)));
+    return { confidence, reality, perceived };
+}
+export function computeVerdict(c, confidence) {
+    const verdict = c.critical > 0 ? "blocked"
+        : confidence < 75 ? "hold"
+            : "launch_ready";
+    return { score: confidence, verdict };
+}
+function clamp(n) {
+    return Math.max(0, Math.min(100, Math.round(n)));
+}
+function weightedSubset(findings, pred) {
+    let pen = 0;
+    for (const f of findings) {
+        if (!pred(f))
+            continue;
+        pen +=
+            f.severity === "critical" ? 20
+                : f.severity === "high" ? 10
+                    : f.severity === "medium" ? 4
+                        : 1;
+    }
+    return pen;
+}

package/dist/review/deep.js

@@ -0,0 +1,170 @@
+/**
+ * Deep AI review — Scale/Unlimited only.
+ * Uses Groq with structured JSON tool calls (no native function calling required).
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import fg from "fast-glob";
+const MAX_ITERATIONS = 8;
+const MAX_FILE_CHARS = 12_000;
+const MODEL = "llama-3.3-70b-versatile";
+function stripCodeFences(text) {
+    const m = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+    return (m?.[1] ?? text).trim();
+}
+async function groqJson(apiKey, system, user) {
+    const res = await fetch("https://api.groq.com/openai/v1/chat/completions", {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${apiKey}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            model: MODEL,
+            temperature: 0.2,
+            response_format: { type: "json_object" },
+            messages: [
+                { role: "system", content: system },
+                { role: "user", content: user },
+            ],
+        }),
+    });
+    if (!res.ok)
+        throw new Error(`Groq API error ${res.status}: ${(await res.text()).slice(0, 200)}`);
+    const data = (await res.json());
+    return data.choices?.[0]?.message?.content ?? "{}";
+}
+async function readFileSafe(root, rel) {
+    const safe = rel.replace(/^(\.\/|\.\.\/)+/, "").replace(/\.\./g, "");
+    const abs = path.join(root, safe);
+    if (!abs.startsWith(root))
+        return "Error: path outside project root";
+    try {
+        const content = await fs.readFile(abs, "utf8");
+        return content.length > MAX_FILE_CHARS
+            ? content.slice(0, MAX_FILE_CHARS) + "\n…[truncated]"
+            : content;
+    }
+    catch {
+        return "Error: file not found or unreadable";
+    }
+}
+async function searchFiles(root, query) {
+    const files = await fg(["**/*.{ts,tsx,js,jsx,md,html}"], {
+        cwd: root,
+        absolute: false,
+        ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"],
+    });
+    const q = query.toLowerCase();
+    const hits = [];
+    for (const f of files.slice(0, 400)) {
+        if (f.toLowerCase().includes(q))
+            hits.push(f);
+        if (hits.length >= 15)
+            break;
+    }
+    if (hits.length === 0) {
+        for (const f of files.slice(0, 200)) {
+            try {
+                const content = await fs.readFile(path.join(root, f), "utf8");
+                if (content.toLowerCase().includes(q))
+                    hits.push(f);
+                if (hits.length >= 10)
+                    break;
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    return hits.length ? hits.join("\n") : "No matches.";
+}
+function parseAction(raw) {
+    try {
+        return JSON.parse(stripCodeFences(raw));
+    }
+    catch {
+        return null;
+    }
+}
+export async function runDeepReview(root, scan, apiKey, onStatus) {
+    const system = `You are Periderm's deep launch reviewer. Respond with JSON only.
+
+Existing static scan found ${scan.findings.length} issues. Your job: find ADDITIONAL nuanced launch risks the deterministic scanner missed — legal/UX/business logic edge cases, contradictions, deceptive flows, subtle security gaps.
+
+Tools (respond with {"action":"tool",...}):
+- read_file: {"action":"tool","tool":"read_file","path":"src/routes/privacy.tsx"}
+- search_files: {"action":"tool","tool":"search_files","query":"gtag"}
+
+When finished: {"action":"done","summary":"...","findings":[{"message":"...","severity":"high|medium|low|critical","file":"path","why":"...","fix":"..."}]}
+
+Rules: max 5 new findings, be specific, cite files, no hallucinated files.`;
+    const context = {
+        project: scan.projectName,
+        verdict: scan.verdict,
+        scores: scan.scores,
+        existingFindings: scan.findings.slice(0, 40).map((f) => ({
+            id: f.id,
+            severity: f.severity,
+            message: f.message,
+            file: f.file,
+        })),
+    };
+    let transcript = `Project context:\n${JSON.stringify(context, null, 2)}\n\nBegin investigation. Use tools before concluding.`;
+    const toolLog = [];
+    for (let i = 0; i < MAX_ITERATIONS; i++) {
+        onStatus?.(`Deep review · pass ${i + 1}/${MAX_ITERATIONS}…`);
+        const raw = await groqJson(apiKey, system, transcript);
+        const action = parseAction(raw);
+        if (!action) {
+            transcript += `\n\nInvalid JSON. Respond with valid JSON only.\n`;
+            continue;
+        }
+        if (action.action === "done") {
+            const findings = (action.findings ?? []).slice(0, 8).map((f, idx) => ({
+                id: `deep-review-${idx + 1}`,
+                category: "Deep Review (AI)",
+                severity: (["critical", "high", "medium", "low"].includes(f.severity)
+                    ? f.severity
+                    : "medium"),
+                file: f.file ?? "project",
+                line: 1,
+                message: f.message,
+                why: f.why,
+                fix: f.fix,
+                aiPrompt: f.fix,
+            }));
+            const md = [
+                "## Deep review (AI agent)",
+                "",
+                action.summary,
+                "",
+                ...(findings.length
+                    ? findings.map((f) => `### ${f.severity.toUpperCase()} — ${f.message}\n\n- **File:** \`${f.file}\`\n- **Why:** ${f.why}\n- **Fix:** ${f.fix}\n`)
+                    : ["No additional findings beyond the static scan."]),
+                "",
+                `_Agent tools used: ${toolLog.length ? toolLog.join(", ") : "none"}_`,
+            ].join("\n");
+            return { markdown: md, findings };
+        }
+        if (action.action === "tool" && action.tool === "read_file" && action.path) {
+            onStatus?.(`Reading ${action.path}…`);
+            const content = await readFileSafe(root, action.path);
+            toolLog.push(`read:${action.path}`);
+            transcript += `\n\nTool result (read_file ${action.path}):\n\`\`\`\n${content}\n\`\`\`\n`;
+            continue;
+        }
+        if (action.action === "tool" && action.tool === "search_files" && action.query) {
+            onStatus?.(`Searching for "${action.query}"…`);
+            const hits = await searchFiles(root, action.query);
+            toolLog.push(`search:${action.query}`);
+            transcript += `\n\nTool result (search_files "${action.query}"):\n${hits}\n`;
+            continue;
+        }
+        transcript += `\n\nUnknown action. Use read_file, search_files, or done.\n`;
+    }
+    return {
+        markdown: "## Deep review (AI agent)\n\nAgent reached iteration limit without finishing. Re-run or narrow scope.",
+        findings: [],
+    };
+}

package/dist/scanner/ast.js

@@ -0,0 +1,22 @@
+import { parse } from "@babel/parser";
+export function parseSource(source, filename) {
+    try {
+        return parse(source, {
+            sourceType: "module",
+            sourceFilename: filename,
+            allowImportExportEverywhere: true,
+            allowReturnOutsideFunction: true,
+            errorRecovery: true,
+            plugins: [
+                "typescript",
+                "jsx",
+                "decorators-legacy",
+                "topLevelAwait",
+                "importMeta",
+            ],
+        });
+    }
+    catch {
+        return null;
+    }
+}