securevibe 0.1.0

package/dist/index.js

@@ -0,0 +1,258 @@
+#!/usr/bin/env node
+/**
+ * SecureVibe CLI (doc 12). Local-first: analysis runs on your machine.
+ *   securevibe scan [path]        full scan → findings + score
+ *   securevibe ai-audit [path]    focus on the AI-agent attack surface (doc 04)
+ *   securevibe protect [path]     remediation-first view of the fixes
+ *   securevibe attack-map [path]  exploit paths from reachable findings (doc 06)
+ *   securevibe score [path]       just the security score + readiness verdict
+ */
+import { Command } from "commander";
+import { scan } from "./engine/scan.js";
+import { toJson, toSarif } from "./ui/emit.js";
+const program = new Command();
+program
+    .name("securevibe")
+    .description("Autonomous AI security engineer for AI-generated applications")
+    .version("0.1.0");
+function addCommon(cmd) {
+    return cmd
+        .option("--json", "output machine-readable JSON")
+        .option("--sarif", "output SARIF 2.1.0 (for CI / GitHub code scanning)")
+        .option("--no-color", "disable coloured output")
+        .option("--staged", "scan only git-staged files (for pre-commit guards)")
+        .option("--ci", "CI mode: exit non-zero based on deployment readiness");
+}
+/**
+ * Free beta metering: one use per analysis command against the daily quota.
+ * The --staged commit guard is exempt — a quota must never block a commit.
+ */
+async function meter(opts = {}) {
+    if (opts.staged)
+        return;
+    const { recordUse, limitMessage } = await import("./usage.js");
+    const r = await recordUse();
+    if (!r.allowed) {
+        process.stderr.write(limitMessage() + "\n");
+        process.exit(1);
+    }
+}
+/** Run a scan with stderr progress; honour --json/--sarif/--no-color. */
+async function runScan(pathArg, opts, scanOpts = {}) {
+    if (opts.color === false)
+        process.env.NO_COLOR = "1";
+    await meter(opts);
+    const target = pathArg ?? ".";
+    const quiet = opts.json || opts.sarif;
+    // --staged: analyze only what's about to be committed (the pre-commit guard).
+    if (opts.staged) {
+        const path = await import("node:path");
+        const { listStagedFiles } = await import("./engine/git.js");
+        const absRoot = path.resolve(target);
+        const staged = await listStagedFiles(absRoot);
+        if (staged === null) {
+            if (!quiet)
+                process.stderr.write("  · not a git repo — scanning the whole tree\n");
+        }
+        else {
+            scanOpts = { ...scanOpts, files: staged };
+        }
+    }
+    const result = await scan(target, {
+        ...scanOpts,
+        onProgress: quiet ? undefined : (m) => process.stderr.write(`  · ${m}\n`),
+    });
+    return result;
+}
+/** Emit machine output if requested; returns true if it handled output. */
+function emitMachine(result, opts) {
+    if (opts.sarif) {
+        process.stdout.write(toSarif(result) + "\n");
+        return true;
+    }
+    if (opts.json) {
+        process.stdout.write(toJson(result) + "\n");
+        return true;
+    }
+    return false;
+}
+/** Exit code policy for CI gating (doc 08/12). */
+function ciExit(result, opts) {
+    if (!opts.ci)
+        return;
+    const r = result.score.readiness;
+    if (r === "block")
+        process.exit(2);
+    if (r === "warn")
+        process.exit(1);
+    process.exit(0);
+}
+/** After a human-readable scan, nudge toward `fix` if anything is blocking. */
+function fixHint(result, opts) {
+    if (opts.json || opts.sarif)
+        return;
+    if (result.score.readiness === "ship")
+        return;
+    process.stdout.write(`  → run \`securevibe fix\` to auto-harden the blocking issues (dry run by default)\n\n`);
+}
+addCommon(program
+    .command("scan", { isDefault: true })
+    .description("Scan a repository for vulnerabilities and AI-agent risks")
+    .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
+    const result = await runScan(pathArg, opts);
+    if (!emitMachine(result, opts)) {
+        const { renderReport } = await import("./ui/report.js");
+        process.stdout.write(renderReport(result) + "\n");
+        fixHint(result, opts);
+    }
+    ciExit(result, opts);
+});
+program
+    .command("init")
+    .description("Wire SecureVibe into this project: pre-commit guard + CI + gitignore (doc 12)")
+    .argument("[path]", "path to the repository", ".")
+    .option("--force", "overwrite an existing hook / workflow / config")
+    .option("--no-color", "disable coloured output")
+    .action(async (pathArg, opts) => {
+    if (opts.color === false)
+        process.env.NO_COLOR = "1";
+    const { runInit } = await import("./engine/init.js");
+    const { renderInit } = await import("./ui/init.js");
+    const result = await runInit(pathArg ?? ".", { force: opts.force });
+    process.stdout.write(renderInit(result) + "\n");
+});
+program
+    .command("fix")
+    .description("Autonomously fix findings, then re-scan to verify (doc 05)")
+    .argument("[path]", "path to the repository", ".")
+    .option("--apply", "write the fixes to disk (asks before each change unless --yes)")
+    .option("--yes", "apply every verified fix without prompting (for CI / scripts)")
+    .option("--no-llm", "disable the optional Claude-powered fixer")
+    .option("--json", "output machine-readable JSON")
+    .option("--no-color", "disable coloured output")
+    .action(async (pathArg, opts) => {
+    if (opts.color === false)
+        process.env.NO_COLOR = "1";
+    await meter();
+    const { runFix } = await import("./engine/fix/session.js");
+    const { isInteractive, decideApply, makeFixConfirm } = await import("./ui/prompt.js");
+    const { renderFixSession, fixToJson, renderApprovalRequest } = await import("./ui/fix.js");
+    const decision = decideApply(opts, isInteractive());
+    const result = await runFix(pathArg ?? ".", {
+        apply: decision.apply,
+        noLlm: opts.llm === false,
+        confirm: decision.prompt ? makeFixConfirm(renderApprovalRequest) : undefined,
+        onProgress: opts.json ? undefined : (m) => process.stderr.write(`  · ${m}\n`),
+    });
+    if (opts.json)
+        process.stdout.write(fixToJson(result) + "\n");
+    else
+        process.stdout.write(renderFixSession(result) + "\n");
+    if (decision.notice) {
+        process.stderr.write("  Not applied: no interactive terminal. Re-run with --yes to apply non-interactively.\n");
+    }
+});
+addCommon(program
+    .command("ai-audit")
+    .description("Focus on the AI-application / agent attack surface (doc 04)")
+    .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
+    const result = await runScan(pathArg, opts, { aiOnly: true });
+    if (!emitMachine(result, opts)) {
+        const { renderReport } = await import("./ui/report.js");
+        process.stdout.write(renderReport(result, { aiFocus: true }) + "\n");
+    }
+    ciExit(result, opts);
+});
+addCommon(program
+    .command("protect")
+    .description("Remediation-first view: the fixes for every finding")
+    .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
+    const result = await runScan(pathArg, opts);
+    if (!emitMachine(result, opts)) {
+        const { renderRemediations } = await import("./ui/protect.js");
+        process.stdout.write(renderRemediations(result) + "\n");
+    }
+    ciExit(result, opts);
+});
+addCommon(program
+    .command("attack-map")
+    .description("Show exploit paths from reachable findings (doc 06)")
+    .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
+    const result = await runScan(pathArg, opts);
+    if (!emitMachine(result, opts)) {
+        const { renderAttackMap } = await import("./ui/attackmap.js");
+        process.stdout.write(renderAttackMap(result) + "\n");
+    }
+    ciExit(result, opts);
+});
+addCommon(program
+    .command("score")
+    .description("Print the security score and deployment-readiness verdict")
+    .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
+    const result = await runScan(pathArg, opts);
+    if (!emitMachine(result, opts)) {
+        const { renderScoreOnly } = await import("./ui/protect.js");
+        process.stdout.write(renderScoreOnly(result) + "\n");
+    }
+    ciExit(result, opts);
+});
+addCommon(program
+    .command("deps")
+    .description("Audit dependencies for known CVEs (SCA, offline against the local OSV db)")
+    .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
+    const result = await runScan(pathArg, opts);
+    if (!emitMachine(result, opts)) {
+        const { renderDeps } = await import("./ui/deps.js");
+        process.stdout.write(renderDeps(result) + "\n");
+    }
+    ciExit(result, opts);
+});
+addCommon(program
+    .command("ready")
+    .description("Launch-readiness scorecard: pass/fail gates + a go/no-go verdict")
+    .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
+    const result = await runScan(pathArg, opts);
+    if (!emitMachine(result, opts)) {
+        const { renderScorecard } = await import("./ui/readiness.js");
+        process.stdout.write(renderScorecard(result) + "\n");
+    }
+    ciExit(result, opts);
+});
+program
+    .command("db")
+    .description("Manage the local OSV vulnerability database (the only networked command)")
+    .argument("<action>", "update | status")
+    .option("--no-color", "disable coloured output")
+    .action(async (action, opts) => {
+    if (opts.color === false)
+        process.env.NO_COLOR = "1";
+    if (action === "status") {
+        const { loadDepDb, userDbDir } = await import("./engine/deps/db.js");
+        const db = await loadDepDb();
+        const ecos = Object.entries(db.ecosystems)
+            .map(([e, pkgs]) => `${e}: ${Object.keys(pkgs).length} packages`)
+            .join(", ");
+        process.stdout.write(`  SecureVibe OSV database\n  date:   ${db.date ?? "(bundled seed only)"}\n` +
+            `  cache:  ${userDbDir()}\n  loaded: ${ecos || "(empty)"}\n`);
+        return;
+    }
+    if (action === "update") {
+        const { updateDb } = await import("./engine/deps/osv.js");
+        process.stderr.write("  · fetching OSV dumps (npm, PyPI)…\n");
+        try {
+            const r = await updateDb();
+            process.stdout.write(`  Updated local OSV db (${r.date}): ${r.count} packages → ${r.destDir}\n`);
+        }
+        catch (err) {
+            process.stderr.write(`  db update failed: ${err?.message ?? err}\n`);
+            process.exit(1);
+        }
+        return;
+    }
+    process.stderr.write(`  unknown db action: ${action} (use: update | status)\n`);
+    process.exit(64);
+});
+program.parseAsync(process.argv).catch((err) => {
+    process.stderr.write(`securevibe: ${err?.message ?? err}\n`);
+    process.exit(70);
+});

package/dist/ui/attackmap.js

@@ -0,0 +1,66 @@
+/**
+ * `attack-map` view (doc 06, MVP). Renders exploit paths from reachable
+ * findings: external entrypoint → exploited weakness → asset/impact. The full
+ * platform builds a weighted graph in Neo4j and computes choke points; this MVP
+ * surfaces the reachable critical/high chains in text.
+ */
+import pc from "picocolors";
+import { renderBanner } from "./banner.js";
+function impactOf(f) {
+    switch (f.detector) {
+        case "sql-injection":
+            return "database read/write/exfiltration";
+        case "code-execution":
+            return "arbitrary code / OS command execution";
+        case "broken-access-control":
+            return "other users' data (IDOR)";
+        case "ai-tool-hijack":
+            return "agent performs attacker-chosen privileged actions";
+        case "ai-overprivileged-tool":
+            return "filesystem / shell / DB via the model";
+        case "hardcoded-secret":
+            return "credential reuse → downstream systems";
+        case "xss":
+            return "victim session / browser compromise";
+        default:
+            return "compromise of " + f.file;
+    }
+}
+export function renderAttackMap(result) {
+    const lines = [];
+    lines.push(renderBanner({ subtitle: "attack map · exploit paths" }));
+    lines.push("");
+    const chains = result.findings.filter((f) => f.reachable && (f.severity === "critical" || f.severity === "high"));
+    if (chains.length === 0) {
+        lines.push(pc.green("  ✓ No reachable critical/high exploit paths found."));
+        lines.push("");
+        return lines.join("\n");
+    }
+    lines.push(pc.dim(`  ${chains.length} reachable exploit path(s), highest impact first:`));
+    lines.push("");
+    for (const f of chains) {
+        const entry = f.category === "ai" ? "untrusted prompt / input" : "external request";
+        const node = (s) => pc.bold(s);
+        lines.push("  " +
+            pc.red("●") +
+            " " +
+            node(entry) +
+            pc.dim("  ──▶  ") +
+            node(f.title) +
+            pc.dim("  ──▶  ") +
+            pc.red(node(impactOf(f))));
+        lines.push(`      ${pc.dim(`${f.file}:${f.line} · ${f.owasp ?? f.cwe ?? ""} · ${f.mitre ?? ""}`)}`);
+        lines.push("");
+    }
+    // Crude "choke point": the file implicated in the most chains.
+    const byFile = new Map();
+    for (const f of chains)
+        byFile.set(f.file, (byFile.get(f.file) ?? 0) + 1);
+    const top = [...byFile.entries()].sort((a, b) => b[1] - a[1])[0];
+    if (top && top[1] > 1) {
+        lines.push(pc.dim("  ─────────────────────────────────────────────────"));
+        lines.push(`  ${pc.yellow("◆ choke point:")} ${pc.cyan(top[0])} appears in ${top[1]} paths — fix it first.`);
+        lines.push("");
+    }
+    return lines.join("\n");
+}

package/dist/ui/banner.js

@@ -0,0 +1,68 @@
+// packages/cli/src/ui/banner.ts
+/**
+ * The SecureVibe wordmark banner shown atop human-readable command output.
+ * ANSI-Shadow block art with a cyan→magenta truecolor gradient (the brand
+ * colors). Degrades cleanly: NO_COLOR drops the gradient, and a terminal too
+ * narrow for the art falls back to a one-line header. Suppressed entirely for
+ * machine output (--json / --sarif / --ci) by the caller.
+ *
+ * Colour is handled with raw escapes (not picocolors) so it honours NO_COLOR at
+ * call time — picocolors locks colour support at import, before the CLI sets
+ * NO_COLOR for --no-color.
+ */
+const ART = [
+    "███████╗███████╗ ██████╗██╗   ██╗██████╗ ███████╗██╗   ██╗██╗██████╗ ███████╗",
+    "██╔════╝██╔════╝██╔════╝██║   ██║██╔══██╗██╔════╝██║   ██║██║██╔══██╗██╔════╝",
+    "███████╗█████╗  ██║     ██║   ██║██████╔╝█████╗  ██║   ██║██║██████╔╝█████╗  ",
+    "╚════██║██╔══╝  ██║     ██║   ██║██╔══██╗██╔══╝  ╚██╗ ██╔╝██║██╔══██╗██╔══╝  ",
+    "███████║███████╗╚██████╗╚██████╔╝██║  ██║███████╗ ╚████╔╝ ██║██████╔╝███████╗",
+    "╚══════╝╚══════╝ ╚═════╝ ╚═════╝ ╚═╝  ╚═╝╚══════╝  ╚═══╝  ╚═╝╚═════╝ ╚══════╝",
+];
+const TAGLINE = "autonomous AI security engineer";
+const ART_WIDTH = Math.max(...ART.map((l) => l.length));
+/** cyan (0,255,255) → magenta (255,0,255): r ramps up, g ramps down, b held. */
+function gradientColor(t) {
+    return [Math.round(255 * t), Math.round(255 * (1 - t)), 255];
+}
+/** Colour each non-space cell of a line by its column position. */
+function gradientLine(line) {
+    const n = Math.max(ART_WIDTH - 1, 1);
+    let out = "";
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === " ") {
+            out += " ";
+            continue;
+        }
+        const [r, g, b] = gradientColor(i / n);
+        out += `\x1b[38;2;${r};${g};${b}m${ch}`;
+    }
+    return out + "\x1b[0m";
+}
+/** A short gradient of plain text (used by the compact fallback header). */
+function gradientText(text) {
+    const n = Math.max(text.length - 1, 1);
+    let out = "";
+    for (let i = 0; i < text.length; i++) {
+        const [r, g, b] = gradientColor(i / n);
+        out += `\x1b[38;2;${r};${g};${b}m${text[i]}`;
+    }
+    return out + "\x1b[0m";
+}
+const dim = (s) => `\x1b[2m${s}\x1b[22m`;
+/** Render the banner block (no trailing newline). */
+export function renderBanner(opts = {}) {
+    const noColor = !!process.env.NO_COLOR;
+    const cols = opts.columns ?? process.stdout.columns ?? 80;
+    const tag = TAGLINE + (opts.subtitle ? `  ·  ${opts.subtitle}` : "");
+    // Too narrow for the art → a single tasteful header line.
+    if (cols < ART_WIDTH + 2) {
+        const mark = noColor ? "SecureVibe" : gradientText("SecureVibe");
+        return `\n  ◇ ${mark}  ${noColor ? tag : dim(tag)}`;
+    }
+    const L = [""];
+    for (const line of ART)
+        L.push("  " + (noColor ? line : gradientLine(line)));
+    L.push("  " + (noColor ? tag : dim(tag)));
+    return L.join("\n");
+}

package/dist/ui/deps.js

@@ -0,0 +1,54 @@
+// packages/cli/src/ui/deps.ts
+/**
+ * Dependency (SCA) view. The dependency dimension is reported separately from
+ * the code score — counts of known CVEs with the database date, honest framing:
+ * "no known advisories as of <db date>" is not a proof of safety.
+ */
+import pc from "picocolors";
+import { renderBanner } from "./banner.js";
+const SEV_COLOR = {
+    critical: (s) => pc.bgRed(pc.white(pc.bold(` ${s} `))),
+    high: (s) => pc.red(pc.bold(s)),
+    medium: (s) => pc.yellow(s),
+    low: (s) => pc.blue(s),
+    info: (s) => pc.dim(s),
+};
+export function dependencyLine(result) {
+    const d = result.dependencies;
+    if (!d)
+        return "";
+    const date = d.dbDate ? `db ${d.dbDate}` : "db: run `securevibe db update`";
+    if (d.total === 0)
+        return pc.dim(`no known advisories as of ${d.dbDate ?? "(no db)"}`);
+    const parts = ["critical", "high", "medium", "low"]
+        .filter((s) => d.bySeverity[s] > 0)
+        .map((s) => `${d.bySeverity[s]} ${s}`);
+    return `${d.total} known ${d.total === 1 ? "CVE" : "CVEs"} (${parts.join(", ")}) · ${date}`;
+}
+export function renderDeps(result) {
+    const lines = [];
+    const deps = result.findings.filter((f) => f.detector === "vulnerable-dependency");
+    lines.push(renderBanner({ subtitle: "dependency audit (SCA)" }));
+    lines.push(pc.dim(`  ${result.root}`));
+    lines.push("");
+    lines.push("  " + (deps.length === 0 ? pc.green("✓ ") : "") + dependencyLine(result));
+    lines.push("");
+    for (const f of deps)
+        lines.push(...renderDepFinding(f));
+    if (deps.length > 0) {
+        lines.push(pc.dim("  ─────────────────────────────────────────────────"));
+        lines.push("  " + pc.bold("Next:") + pc.dim(" run ") + pc.cyan("securevibe fix") + pc.dim(" to bump vulnerable packages (review + test the diff)."));
+    }
+    lines.push(pc.dim("  A clean result means no known advisories in the local database, not proof of safety."));
+    lines.push("");
+    return lines.join("\n");
+}
+function renderDepFinding(f) {
+    return [
+        `  ${SEV_COLOR[f.severity](f.severity.toUpperCase())} ${pc.bold(f.title)}`,
+        `     ${pc.dim("↳")} ${pc.cyan(`${f.file}:${f.line}`)}  ${pc.dim([f.cwe, f.owasp].filter(Boolean).join(" · "))}`,
+        `     ${pc.dim("why:")} ${f.why}`,
+        `     ${pc.green("fix:")} ${f.fix}`,
+        "",
+    ];
+}

package/dist/ui/emit.js

@@ -0,0 +1,62 @@
+export function toJson(result) {
+    return JSON.stringify(result, null, 2);
+}
+function sarifLevel(sev) {
+    if (sev === "critical" || sev === "high")
+        return "error";
+    if (sev === "medium")
+        return "warning";
+    return "note";
+}
+/** SARIF 2.1.0 — uploadable to GitHub code scanning and other tools. */
+export function toSarif(result) {
+    const ruleIds = new Map();
+    for (const f of result.findings)
+        if (!ruleIds.has(f.detector))
+            ruleIds.set(f.detector, f);
+    const rules = [...ruleIds.values()].map((f) => ({
+        id: f.detector,
+        name: f.detector,
+        shortDescription: { text: f.title },
+        properties: { tags: [f.category, f.owasp, f.cwe].filter(Boolean) },
+    }));
+    const results = result.findings.map((f) => ({
+        ruleId: f.detector,
+        level: sarifLevel(f.severity),
+        message: { text: `${f.title}. ${f.why} Fix: ${f.fix}` },
+        locations: [
+            {
+                physicalLocation: {
+                    artifactLocation: { uri: f.file },
+                    region: { startLine: f.line, startColumn: f.column },
+                },
+            },
+        ],
+        properties: {
+            severity: f.severity,
+            confidence: f.confidence,
+            reachable: f.reachable,
+            cwe: f.cwe,
+            owasp: f.owasp,
+            mitre: f.mitre,
+        },
+    }));
+    const sarif = {
+        $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "SecureVibe",
+                        informationUri: "https://securevibe.dev",
+                        version: "0.1.0",
+                        rules,
+                    },
+                },
+                results,
+            },
+        ],
+    };
+    return JSON.stringify(sarif, null, 2);
+}