securevibe 0.1.0

package/dist/engine/fix/session.js

@@ -0,0 +1,333 @@
+/**
+ * Fix session orchestrator (doc 05). Scans, routes each finding to a
+ * deterministic or LLM fixer, then VERIFIES every candidate rewrite by
+ * re-running the exact same detectors on the new content before accepting it.
+ *
+ * Honesty note baked into the design: "accepted" means our detector no longer
+ * flags the issue AND no new issue was introduced AND the file still parses —
+ * it does NOT mean the app is proven secure. Default is dry-run; --apply always
+ * backs up originals first (there is no git here to fall back on).
+ */
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { scan } from "../scan.js";
+import { detectFile } from "../scan.js";
+import { computeScore } from "../score.js";
+import { parse, langForExtension } from "../parser.js";
+import { hasError } from "../ast.js";
+import { SEVERITY_ORDER } from "../types.js";
+import { deterministicFix } from "./deterministic.js";
+import { llmFix, llmAvailability, LLM_DETECTORS } from "./llm.js";
+import { loadDepDb } from "../deps/db.js";
+const MEDIUM = SEVERITY_ORDER["medium"];
+export async function runFix(root, options = {}) {
+    const start = Date.now();
+    const progress = options.onProgress ?? (() => { });
+    const absRoot = path.resolve(root);
+    const llm = llmAvailability(!!options.noLlm);
+    const depDb = await loadDepDb();
+    progress("Scanning…");
+    const before = await scan(absRoot);
+    const byFile = groupByFile(before.findings);
+    const outcomes = [];
+    const patches = [];
+    const sideEffects = [];
+    // relPath → findings, used to recompute the projected score.
+    const projected = new Map(byFile);
+    for (const [relPath, fileFindings] of byFile) {
+        progress(`Fixing ${relPath}…`);
+        const abs = path.join(absRoot, ...relPath.split("/"));
+        let original;
+        try {
+            original = await fs.readFile(abs, "utf8");
+        }
+        catch {
+            for (const f of fileFindings)
+                outcomes.push(manual(f, "Could not read the file to fix it."));
+            continue;
+        }
+        // 1) Deterministic pass (rewrites all its patterns at once).
+        const det = await deterministicFix({
+            relPath,
+            code: original,
+            inventory: before.inventory,
+            findings: fileFindings,
+            depDb,
+        });
+        sideEffects.push(...det.sideEffects);
+        for (const [id, note] of det.manual) {
+            const f = fileFindings.find((x) => x.id === id);
+            if (f)
+                outcomes.push({ finding: f, status: "manual", strategy: "deterministic", note });
+        }
+        // 2) LLM pass for the findings no deterministic fixer claimed.
+        const handled = new Set([...det.attempted, ...det.manual.keys()]);
+        const llmTargets = fileFindings.filter((f) => !handled.has(f.id) && LLM_DETECTORS.has(f.detector));
+        const lang = langForExtension(path.extname(relPath));
+        let candidate = det.code;
+        const llmAttempted = new Set();
+        if (llm.available && llmTargets.length > 0 && lang) {
+            const rewritten = await llmFix({ relPath, lang, code: candidate, findings: llmTargets });
+            if (rewritten && rewritten !== candidate) {
+                candidate = rewritten;
+                for (const f of llmTargets)
+                    llmAttempted.add(f.id);
+            }
+        }
+        // 3) Verify + accept/reject the combined candidate.
+        const targeted = fileFindings.filter((f) => det.attempted.has(f.id) || llmAttempted.has(f.id));
+        if (candidate !== original && targeted.length > 0) {
+            const verdict = await verify(relPath, original, candidate, fileFindings);
+            if (verdict.accepted) {
+                patches.push({ relPath, before: original, after: candidate, targeted, accepted: true });
+                projected.set(relPath, verdict.newFindings);
+                assignOutcomes(targeted, verdict, det, llmAttempted, outcomes);
+            }
+            else {
+                // Rejected → every targeted finding falls back to a manual instruction.
+                for (const f of targeted) {
+                    outcomes.push(manual(f, `Automatic fix rejected (${verdict.reason}). Apply manually: ${oneLine(f.fix)}`, det.attempted.has(f.id) ? "deterministic" : "llm"));
+                }
+            }
+        }
+        // 4) Findings with no fix attempt → manual (unfixable here, or LLM unavailable).
+        for (const f of fileFindings) {
+            if (det.attempted.has(f.id) || llmAttempted.has(f.id) || det.manual.has(f.id))
+                continue;
+            if (outcomes.some((o) => o.finding.id === f.id))
+                continue;
+            const note = LLM_DETECTORS.has(f.detector) && !llm.available
+                ? `Needs an AI-assisted fix — set ANTHROPIC_API_KEY to auto-fix (currently ${llm.reason}). Manual: ${oneLine(f.fix)}`
+                : `No safe automatic fix for this class yet. Manual: ${oneLine(f.fix)}`;
+            outcomes.push(manual(f, note));
+        }
+    }
+    const dedupedSideEffects = dedupeSideEffects(sideEffects);
+    // Approval gate (only on an --apply run with a confirm callback). Declined
+    // patches are restored in the projected score and reported `skipped`.
+    let finalPatches = patches;
+    let finalEffects = dedupedSideEffects;
+    if (options.apply && options.confirm) {
+        const approval = await runApprovals(patches, dedupedSideEffects, options.confirm);
+        finalPatches = approval.patches;
+        finalEffects = approval.effects;
+        for (const p of patches) {
+            if (finalPatches.includes(p))
+                continue;
+            projected.set(p.relPath, byFile.get(p.relPath) ?? []);
+            for (const f of p.targeted) {
+                const o = outcomes.find((x) => x.finding.id === f.id && x.status === "fixed");
+                if (o) {
+                    o.status = "skipped";
+                    o.note = "You declined this change; left unfixed.";
+                }
+            }
+        }
+    }
+    // Projected score from re-detected findings, AFTER approval adjustments.
+    const projectedFindings = [...projected.values()].flat();
+    const scoreAfter = computeScore(projectedFindings);
+    // Apply to disk only when asked; always back up first.
+    let backupDir = null;
+    if (options.apply && (finalPatches.length > 0 || finalEffects.length > 0)) {
+        backupDir = await applyToDisk(absRoot, finalPatches, finalEffects, progress);
+    }
+    return {
+        root: absRoot,
+        apply: !!options.apply,
+        llmAvailable: llm.available,
+        scoreBefore: before.score,
+        scoreAfter,
+        outcomes: sortOutcomes(outcomes),
+        patches: finalPatches,
+        sideEffects: finalEffects,
+        backupDir,
+        durationMs: Date.now() - start,
+    };
+}
+/** Walk accepted patches through the confirm gate; return the approved subset. */
+async function runApprovals(patches, effects, confirm) {
+    const approvedPatches = [];
+    let all = false;
+    let quit = false;
+    for (let i = 0; i < patches.length; i++) {
+        const ans = all ? "yes" : await confirm({ kind: "patch", patch: patches[i], index: i, total: patches.length });
+        if (ans === "all") {
+            all = true;
+            approvedPatches.push(patches[i]);
+        }
+        else if (ans === "yes") {
+            approvedPatches.push(patches[i]);
+        }
+        else if (ans === "quit") {
+            quit = true;
+            break;
+        }
+        // "no" → skip this patch
+    }
+    let approvedEffects = [];
+    if (!quit && effects.length > 0) {
+        const ans = await confirm({ kind: "side-effects", effects });
+        if (ans === "yes" || ans === "all")
+            approvedEffects = effects;
+    }
+    return { patches: approvedPatches, effects: approvedEffects };
+}
+/** Re-detect on the candidate and decide whether to accept the rewrite. */
+async function verify(relPath, _original, candidate, fileFindings) {
+    const lang = langForExtension(path.extname(relPath));
+    if (lang) {
+        try {
+            const { root } = await parse(candidate, lang);
+            if (hasError(root))
+                return reject("the rewrite no longer parses");
+        }
+        catch {
+            return reject("the rewrite no longer parses");
+        }
+    }
+    const newFindings = await detectFile(relPath, candidate, { depDb: await loadDepDb() });
+    const beforeBy = countByDetector(fileFindings);
+    const afterBy = countByDetector(newFindings);
+    // Regression: a new finding of medium+ severity that wasn't there before.
+    for (const [det, after] of afterBy) {
+        const beforeN = beforeBy.get(det)?.length ?? 0;
+        if (after.length > beforeN && after.some((f) => SEVERITY_ORDER[f.severity] >= MEDIUM)) {
+            return { accepted: false, reason: "it introduced a new issue", newFindings, resolvedBudget: new Map() };
+        }
+    }
+    const resolvedBudget = new Map();
+    for (const [det, arr] of beforeBy) {
+        const afterN = afterBy.get(det)?.length ?? 0;
+        resolvedBudget.set(det, Math.max(0, arr.length - afterN));
+    }
+    const anyResolved = [...resolvedBudget.values()].some((v) => v > 0);
+    if (!anyResolved)
+        return { accepted: false, reason: "it did not resolve the finding", newFindings, resolvedBudget };
+    return { accepted: true, reason: "verified", newFindings, resolvedBudget };
+}
+function reject(reason) {
+    return { accepted: false, reason, newFindings: [], resolvedBudget: new Map() };
+}
+/** Map each targeted finding to fixed (within the resolve budget) or manual. */
+function assignOutcomes(targeted, verdict, det, llmAttempted, outcomes) {
+    const budget = new Map(verdict.resolvedBudget);
+    for (const f of targeted) {
+        const strategy = det.attempted.has(f.id) ? "deterministic" : "llm";
+        const left = budget.get(f.detector) ?? 0;
+        if (left > 0) {
+            budget.set(f.detector, left - 1);
+            outcomes.push({
+                finding: f,
+                status: "fixed",
+                strategy,
+                note: strategy === "deterministic"
+                    ? "Rewritten by a deterministic transform; detector no longer flags it."
+                    : "Rewritten by Claude; detector no longer flags it.",
+            });
+        }
+        else {
+            outcomes.push(manual(f, `Change applied but not confirmed resolved. Verify manually: ${oneLine(f.fix)}`, strategy));
+        }
+    }
+}
+async function applyToDisk(absRoot, patches, sideEffects, progress) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const backupDir = path.join(absRoot, ".securevibe-backup", stamp);
+    await fs.mkdir(backupDir, { recursive: true });
+    const backup = async (relPath) => {
+        const src = path.join(absRoot, ...relPath.split("/"));
+        try {
+            const content = await fs.readFile(src);
+            const dest = path.join(backupDir, ...relPath.split("/"));
+            await fs.mkdir(path.dirname(dest), { recursive: true });
+            await fs.writeFile(dest, content);
+        }
+        catch {
+            /* file may not exist yet (write-if-absent side effect) — nothing to back up */
+        }
+    };
+    for (const p of patches) {
+        await backup(p.relPath);
+        const dest = path.join(absRoot, ...p.relPath.split("/"));
+        await fs.writeFile(dest, p.after, "utf8");
+        progress(`Wrote ${p.relPath}`);
+    }
+    for (const fx of sideEffects) {
+        const dest = path.join(absRoot, ...fx.relPath.split("/"));
+        if (fx.kind === "write-if-absent") {
+            try {
+                await fs.access(dest);
+            }
+            catch {
+                await fs.mkdir(path.dirname(dest), { recursive: true });
+                await fs.writeFile(dest, fx.content, "utf8");
+                progress(`Wrote ${fx.relPath}`);
+            }
+        }
+        else if (fx.kind === "ensure-line") {
+            await backup(fx.relPath);
+            let existing = "";
+            try {
+                existing = await fs.readFile(dest, "utf8");
+            }
+            catch {
+                /* create fresh */
+            }
+            const lines = existing.split(/\r?\n/).map((l) => l.trim());
+            if (!lines.includes(fx.content.trim())) {
+                const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+                await fs.mkdir(path.dirname(dest), { recursive: true });
+                await fs.writeFile(dest, existing + sep + fx.content + "\n", "utf8");
+                progress(`Updated ${fx.relPath}`);
+            }
+        }
+    }
+    return backupDir;
+}
+// ── helpers ─────────────────────────────────────────────────────────────────
+function groupByFile(findings) {
+    const m = new Map();
+    for (const f of findings) {
+        const arr = m.get(f.file) ?? [];
+        arr.push(f);
+        m.set(f.file, arr);
+    }
+    return m;
+}
+function countByDetector(findings) {
+    const m = new Map();
+    for (const f of findings) {
+        const arr = m.get(f.detector) ?? [];
+        arr.push(f);
+        m.set(f.detector, arr);
+    }
+    return m;
+}
+function dedupeSideEffects(effects) {
+    const seen = new Set();
+    const out = [];
+    for (const e of effects) {
+        const key = `${e.kind}:${e.relPath}:${e.content}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(e);
+    }
+    return out;
+}
+function manual(finding, note, strategy) {
+    return { finding, status: "manual", strategy, note };
+}
+function oneLine(s) {
+    return s.replace(/\s+/g, " ").trim();
+}
+const STATUS_ORDER = { fixed: 0, manual: 1, rejected: 2, skipped: 3 };
+function sortOutcomes(outcomes) {
+    return outcomes.sort((a, b) => {
+        const s = (STATUS_ORDER[a.status] ?? 9) - (STATUS_ORDER[b.status] ?? 9);
+        if (s !== 0)
+            return s;
+        return SEVERITY_ORDER[b.finding.severity] - SEVERITY_ORDER[a.finding.severity];
+    });
+}

package/dist/engine/fix/types.js

@@ -0,0 +1 @@
+export {};

package/dist/engine/git.js

@@ -0,0 +1,58 @@
+/**
+ * Minimal git helpers for the workflow-integration features (doc 12). Used by
+ * the `--staged` pre-commit guard and `init`. All calls are read-only and fail
+ * soft: if git isn't present or this isn't a repo, callers fall back gracefully.
+ */
+import { execFileSync } from "node:child_process";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+function git(root, args) {
+    try {
+        return execFileSync("git", args, {
+            cwd: root,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/** True if `root` is inside a git working tree. */
+export function isGitRepo(root) {
+    const out = git(root, ["rev-parse", "--is-inside-work-tree"]);
+    return out?.trim() === "true";
+}
+/** Absolute path to the repo's .git directory, or null. */
+export function gitDir(root) {
+    const out = git(root, ["rev-parse", "--git-dir"]);
+    if (!out)
+        return null;
+    const dir = out.trim();
+    return path.isAbsolute(dir) ? dir : path.join(root, dir);
+}
+/**
+ * Staged files (added/copied/modified) as absolute paths, filtered to those
+ * that exist on disk. Returns null if not a git repo / git unavailable.
+ */
+export async function listStagedFiles(root) {
+    if (!isGitRepo(root))
+        return null;
+    const out = git(root, ["diff", "--cached", "--name-only", "--diff-filter=ACM", "-z"]);
+    if (out == null)
+        return null;
+    const rels = out.split("\0").filter((s) => s.length > 0);
+    const abs = [];
+    for (const rel of rels) {
+        const p = path.join(root, rel);
+        try {
+            const st = await fs.stat(p);
+            if (st.isFile())
+                abs.push(p);
+        }
+        catch {
+            /* staged-but-removed or unreadable — skip */
+        }
+    }
+    return abs;
+}

package/dist/engine/init.js

@@ -0,0 +1,161 @@
+/**
+ * `securevibe init` (doc 12) — make SecureVibe always-on in a project with one
+ * command. Installs a git pre-commit guard (blocks commits that introduce a
+ * BLOCK-level issue, including committed secrets), a GitHub Actions workflow
+ * (PR scan + SARIF upload to code scanning), gitignores `.env` and backups, and
+ * drops a minimal config. Idempotent: existing files are left alone unless
+ * `--force`. Everything runs locally — no account, no upload, no API key.
+ */
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { isGitRepo, gitDir } from "./git.js";
+const GITIGNORE_LINES = [".env", ".env.local", ".env.*.local", ".securevibe-backup/"];
+const CONFIG = `{
+  "failOn": "block",
+  "ignore": []
+}
+`;
+const PRE_COMMIT_HOOK = `#!/bin/sh
+# SecureVibe pre-commit guard — blocks commits that introduce a blocking security
+# issue (incl. committed secrets). Managed by \`securevibe init\`. Delete to remove.
+if command -v securevibe >/dev/null 2>&1; then
+  RUN="securevibe"
+elif [ -x "node_modules/.bin/securevibe" ]; then
+  RUN="node_modules/.bin/securevibe"
+else
+  echo "securevibe not found — skipping guard (install: npm i -D securevibe)"
+  exit 0
+fi
+"$RUN" scan --staged --ci
+if [ "$?" -eq 2 ]; then
+  echo ""
+  echo "✗ SecureVibe blocked this commit: a blocking issue is in your staged changes."
+  echo "  Review above, then run \\\`securevibe fix --apply\\\` and re-stage, or fix by hand."
+  exit 1
+fi
+exit 0
+`;
+const WORKFLOW = `# SecureVibe — scan every PR and upload findings to GitHub code scanning.
+# Managed by \`securevibe init\`.
+name: SecureVibe
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+permissions:
+  contents: read
+  security-events: write
+jobs:
+  securevibe:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Install SecureVibe
+        run: npm install -g securevibe
+      - name: Scan (SARIF)
+        run: securevibe scan . --sarif > securevibe.sarif
+      - name: Upload SARIF
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: securevibe.sarif
+      - name: Gate the build on deployment readiness
+        run: securevibe scan . --ci
+`;
+export async function runInit(root, opts = {}) {
+    const absRoot = path.resolve(root);
+    const repo = isGitRepo(absRoot);
+    const actions = [];
+    // 1) .gitignore — append any missing protective entries (always safe).
+    actions.push(await ensureGitignore(absRoot));
+    // 2) securevibe.config.json — write if absent.
+    actions.push(await writeIfAbsent(absRoot, "securevibe.config.json", CONFIG, opts.force, "scan policy"));
+    // 3) Pre-commit hook — only meaningful in a git repo.
+    if (repo) {
+        actions.push(await installHook(absRoot, opts.force));
+    }
+    else {
+        actions.push({
+            status: "skipped",
+            target: ".git/hooks/pre-commit",
+            note: "not a git repo — run `git init` then `securevibe init` again to install the guard",
+        });
+    }
+    // 4) GitHub Actions workflow.
+    actions.push(await writeIfAbsent(absRoot, ".github/workflows/securevibe.yml", WORKFLOW, opts.force, "PR scan + SARIF upload"));
+    return { root: absRoot, isGitRepo: repo, actions };
+}
+async function ensureGitignore(root) {
+    const target = ".gitignore";
+    const dest = path.join(root, target);
+    let existing = "";
+    let existed = false;
+    try {
+        existing = await fs.readFile(dest, "utf8");
+        existed = true;
+    }
+    catch {
+        /* will create */
+    }
+    const present = new Set(existing.split(/\r?\n/).map((l) => l.trim()));
+    const missing = GITIGNORE_LINES.filter((l) => !present.has(l));
+    if (missing.length === 0) {
+        return { status: "skipped", target, note: "already ignores .env and backups" };
+    }
+    const header = existed ? "" : "# Managed by SecureVibe\n";
+    const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    await fs.writeFile(dest, existing + sep + header + missing.join("\n") + "\n", "utf8");
+    return {
+        status: existed ? "updated" : "created",
+        target,
+        note: `ignore ${missing.join(", ")}`,
+    };
+}
+async function installHook(root, force) {
+    const gd = gitDir(root);
+    const target = ".git/hooks/pre-commit";
+    if (!gd)
+        return { status: "skipped", target, note: "could not resolve .git directory" };
+    const hooksDir = path.join(gd, "hooks");
+    const dest = path.join(hooksDir, "pre-commit");
+    let exists = false;
+    try {
+        await fs.access(dest);
+        exists = true;
+    }
+    catch {
+        /* absent */
+    }
+    if (exists && !force) {
+        return { status: "skipped", target, note: "hook exists — re-run with --force to replace" };
+    }
+    await fs.mkdir(hooksDir, { recursive: true });
+    await fs.writeFile(dest, PRE_COMMIT_HOOK, "utf8");
+    try {
+        await fs.chmod(dest, 0o755);
+    }
+    catch {
+        /* Windows: exec bit is a no-op; Git for Windows runs the hook via sh anyway */
+    }
+    return { status: exists ? "updated" : "created", target, note: "blocks commits with blocking issues" };
+}
+async function writeIfAbsent(root, rel, content, force, note) {
+    const dest = path.join(root, ...rel.split("/"));
+    let exists = false;
+    try {
+        await fs.access(dest);
+        exists = true;
+    }
+    catch {
+        /* absent */
+    }
+    if (exists && !force) {
+        return { status: "skipped", target: rel, note: "exists — re-run with --force to replace" };
+    }
+    await fs.mkdir(path.dirname(dest), { recursive: true });
+    await fs.writeFile(dest, content, "utf8");
+    return { status: exists ? "updated" : "created", target: rel, note };
+}

package/dist/engine/parser.js

@@ -0,0 +1,61 @@
+/**
+ * tree-sitter parsing layer (doc 02). Loads WASM grammars lazily and parses
+ * source into an AST. JS/TS/TSX + Python today; new grammars are additive.
+ */
+import { Parser, Language } from "web-tree-sitter";
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+const GRAMMAR_WASM = {
+    javascript: "tree-sitter-wasms/out/tree-sitter-javascript.wasm",
+    typescript: "tree-sitter-wasms/out/tree-sitter-typescript.wasm",
+    tsx: "tree-sitter-wasms/out/tree-sitter-tsx.wasm",
+    python: "tree-sitter-wasms/out/tree-sitter-python.wasm",
+};
+let initialized = false;
+const languageCache = new Map();
+async function ensureInit() {
+    if (!initialized) {
+        await Parser.init();
+        initialized = true;
+    }
+}
+async function loadLanguage(lang) {
+    const cached = languageCache.get(lang);
+    if (cached)
+        return cached;
+    const wasmPath = require.resolve(GRAMMAR_WASM[lang]);
+    const language = await Language.load(wasmPath);
+    languageCache.set(lang, language);
+    return language;
+}
+/** Parse a source string for the given language into an AST. */
+export async function parse(code, lang) {
+    await ensureInit();
+    const language = await loadLanguage(lang);
+    const parser = new Parser();
+    parser.setLanguage(language);
+    const tree = parser.parse(code);
+    if (!tree)
+        throw new Error(`failed to parse ${lang} source`);
+    return { root: tree.rootNode };
+}
+/** Map a file extension to a parseable language, or null if unsupported. */
+export function langForExtension(ext) {
+    switch (ext.toLowerCase()) {
+        case ".js":
+        case ".jsx":
+        case ".mjs":
+        case ".cjs":
+            return "javascript";
+        case ".ts":
+        case ".mts":
+        case ".cts":
+            return "typescript";
+        case ".tsx":
+            return "tsx";
+        case ".py":
+            return "python";
+        default:
+            return null;
+    }
+}