securevibe 0.1.7 → 0.1.8

package/README.md

@@ -34,6 +34,8 @@ midnight). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE
 | `securevibe protect [path]` | Remediation-first view: the fix for every finding (doc 05) |
 | `securevibe attack-map [path]` | Exploit paths from reachable findings + choke point (doc 06) |
 | `securevibe score [path]` | Just the score + deployment-readiness verdict (doc 08) |
+| `securevibe config <show\|set-key\|unset-key>` | Manage local Groq/Anthropic keys for the AI-powered fixer |
+| `securevibe repl [path]` | Interactive session — run `scan`/`fix`/etc without re-invoking the CLI each time |
 
 Flags: `--json`, `--sarif` (GitHub code-scanning / CI interop), `--no-color`,
 `--ci` (exit `2` on BLOCK, `1` on WARN, `0` on SHIP — for build gates),

package/dist/index-support.js

@@ -0,0 +1,32 @@
+/**
+ * Shared helpers used by both the one-shot CLI commands (index.ts) and the
+ * interactive REPL (repl.ts), so the two entry points never duplicate logic.
+ */
+/**
+ * If `fix` is about to run with no AI-fixer provider key available (and we're
+ * in an interactive terminal), offer to set one up on the spot — a free Groq
+ * key takes under a minute. Never prompts under --json/non-TTY/--no-llm, and
+ * never touches process.env if the user declines or a key is already set.
+ */
+export async function maybeOfferAiFixerSetup() {
+    if (process.env.GROQ_API_KEY || process.env.ANTHROPIC_API_KEY)
+        return;
+    const { isInteractive, askLine } = await import("./ui/prompt.js");
+    if (!isInteractive())
+        return;
+    process.stderr.write("\n  AI auto-fix (RCE, AI tool-hijack, IDOR, complex SQLi) needs a provider key — you don't have one set.\n");
+    const ans = (await askLine("  Enable it now with a free Groq key? [y/N]: ")).trim().toLowerCase();
+    if (ans !== "y" && ans !== "yes") {
+        process.stderr.write("  Skipping — those findings will show as manual review. Run `securevibe config set-key groq` anytime.\n\n");
+        return;
+    }
+    const key = (await askLine("  Paste your Groq key (get one free at console.groq.com/keys): ")).trim();
+    if (!key) {
+        process.stderr.write("  No key entered — skipping.\n\n");
+        return;
+    }
+    const { setKey, configFilePath } = await import("./config.js");
+    await setKey("groq", key);
+    process.env.GROQ_API_KEY = key;
+    process.stderr.write(`  Saved to ${configFilePath()}. This run will use it.\n\n`);
+}

package/dist/index.js

@@ -92,34 +92,6 @@ async function maybeNotifyUpdate(opts) {
     if (latest)
         process.stderr.write("\n" + updateNotice(VERSION, latest) + "\n");
 }
-/**
- * If `fix` is about to run with no AI-fixer provider key available (and we're
- * in an interactive terminal), offer to set one up on the spot — a free Groq
- * key takes under a minute. Never prompts under --json/non-TTY/--no-llm, and
- * never touches process.env if the user declines or a key is already set.
- */
-async function maybeOfferAiFixerSetup() {
-    if (process.env.GROQ_API_KEY || process.env.ANTHROPIC_API_KEY)
-        return;
-    const { isInteractive, askLine } = await import("./ui/prompt.js");
-    if (!isInteractive())
-        return;
-    process.stderr.write("\n  AI auto-fix (RCE, AI tool-hijack, IDOR, complex SQLi) needs a provider key — you don't have one set.\n");
-    const ans = (await askLine("  Enable it now with a free Groq key? [y/N]: ")).trim().toLowerCase();
-    if (ans !== "y" && ans !== "yes") {
-        process.stderr.write("  Skipping — those findings will show as manual review. Run `securevibe config set-key groq` anytime.\n\n");
-        return;
-    }
-    const key = (await askLine("  Paste your Groq key (get one free at console.groq.com/keys): ")).trim();
-    if (!key) {
-        process.stderr.write("  No key entered — skipping.\n\n");
-        return;
-    }
-    const { setKey, configFilePath } = await import("./config.js");
-    await setKey("groq", key);
-    process.env.GROQ_API_KEY = key;
-    process.stderr.write(`  Saved to ${configFilePath()}. This run will use it.\n\n`);
-}
 /** Exit code policy for CI gating (doc 08/12). */
 function ciExit(result, opts) {
     if (!opts.ci)
@@ -175,8 +147,10 @@ program
     const decision = decideApply(opts, isInteractive());
     // Only worth asking on a run that will actually write something — a dry-run
     // preview has no use for a key yet, and asking anyway reads as nagging.
-    if (opts.llm !== false && !opts.json && decision.apply)
+    if (opts.llm !== false && !opts.json && decision.apply) {
+        const { maybeOfferAiFixerSetup } = await import("./index-support.js");
         await maybeOfferAiFixerSetup();
+    }
     const usage = await meter();
     const { runFix } = await import("./engine/fix/session.js");
     const { renderFixSession, fixToJson, renderApprovalRequest } = await import("./ui/fix.js");
@@ -352,6 +326,14 @@ program
     process.stderr.write(`  unknown config action: ${action} (use: show | set-key | unset-key)\n`);
     process.exit(64);
 });
+program
+    .command("repl")
+    .description("Interactive session: run scan/fix/etc without re-invoking the CLI each time")
+    .argument("[path]", "path to the repository", ".")
+    .action(async (pathArg) => {
+    const { runRepl } = await import("./repl.js");
+    await runRepl(pathArg ?? ".");
+});
 program.parseAsync(process.argv).catch((err) => {
     process.stderr.write(`securevibe: ${err?.message ?? err}\n`);
     process.exit(70);

package/dist/repl.js

@@ -0,0 +1,252 @@
+/**
+ * Interactive REPL (`securevibe repl`). A persistent session that holds the
+ * last scan result in memory and reuses the exact same underlying functions
+ * the one-shot commands use (scan(), runFix(), the ui/* renderers) — never
+ * the commander actions, since several of those call process.exit() on
+ * error/limit paths, which would tear down the whole session, not just the
+ * failed command.
+ *
+ * Only ever one readline interface alive at a time (via askLine, which opens
+ * and closes its own per call): the REPL's own prompt and any nested
+ * interactive flow (fix --apply confirmations, config set-key) are always
+ * sequential, never concurrent, so there's no stdin contention.
+ *
+ * Streams are injectable (runReplSession) so the whole loop — including
+ * fix --apply's confirm prompts — is unit-testable without a real TTY; the
+ * public runRepl() just wraps it with the real stdio + the TTY gate.
+ */
+import path from "node:path";
+import { askLine, isInteractive, decideApply, makeFixConfirm } from "./ui/prompt.js";
+function tokenize(line) {
+    const out = [];
+    const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    let m;
+    while ((m = re.exec(line)))
+        out.push(m[1] ?? m[2] ?? m[3]);
+    return out;
+}
+function hasFlag(tokens, ...names) {
+    return tokens.some((t) => names.includes(t));
+}
+function write(io, text) {
+    io.output.write(text);
+}
+async function meterOrPrint(io) {
+    const { recordUse, limitMessage } = await import("./usage.js");
+    const r = await recordUse();
+    if (!r.allowed) {
+        write(io, limitMessage() + "\n");
+        return undefined;
+    }
+    return r;
+}
+const HELP = [
+    "  Commands:",
+    "    scan [--json]                 full scan",
+    "    fix [--apply] [--yes] [--no-llm] [--json]   fix findings",
+    "    ai-audit | protect | attack-map | score | deps | ready   [--json]",
+    "    init [--force]                 wire up the pre-commit guard + CI",
+    "    config show | set-key <groq|anthropic> | unset-key <groq|anthropic>",
+    "    db update | status             manage the local OSV database",
+    "    cd <path>                      change the scan target",
+    "    pwd                            show the current scan target",
+    "    help                           this message",
+    "    exit | quit                    leave the session",
+].join("\n");
+/** Public entry point: real stdio, refuses to start without a TTY. */
+export async function runRepl(initialPath) {
+    if (!isInteractive()) {
+        process.stderr.write("  repl needs an interactive terminal.\n");
+        process.exitCode = 64;
+        return;
+    }
+    await runReplSession(initialPath, { input: process.stdin, output: process.stdout });
+}
+/** The actual session loop, over injectable streams — testable without a TTY. */
+export async function runReplSession(initialPath, io) {
+    const { applyStoredKeysToEnv } = await import("./config.js");
+    await applyStoredKeysToEnv();
+    const state = { root: path.resolve(initialPath) };
+    const { renderBanner } = await import("./ui/banner.js");
+    write(io, renderBanner({ subtitle: "interactive session — type `help`" }) + "\n\n");
+    write(io, `  target: ${state.root}\n\n`);
+    while (true) {
+        const raw = await askLine(`securevibe (${path.basename(state.root)})> `, io.input, io.output);
+        const line = raw.trim();
+        if (!line)
+            continue;
+        const tokens = tokenize(line);
+        const cmd = tokens[0];
+        const rest = tokens.slice(1);
+        try {
+            if (cmd === "exit" || cmd === "quit" || cmd === "q")
+                break;
+            if (cmd === "help" || cmd === "?") {
+                write(io, HELP + "\n\n");
+                continue;
+            }
+            if (cmd === "pwd") {
+                write(io, `  ${state.root}\n\n`);
+                continue;
+            }
+            if (cmd === "cd") {
+                if (!rest[0]) {
+                    write(io, "  usage: cd <path>\n\n");
+                    continue;
+                }
+                state.root = path.resolve(state.root, rest[0]);
+                write(io, `  target: ${state.root}\n\n`);
+                continue;
+            }
+            await dispatch(cmd, rest, state, io);
+        }
+        catch (err) {
+            write(io, `  error: ${err?.message ?? err}\n\n`);
+        }
+    }
+}
+async function dispatch(cmd, tokens, state, io) {
+    const asJson = hasFlag(tokens, "--json");
+    if (["scan", "ai-audit", "protect", "attack-map", "score", "deps", "ready"].includes(cmd)) {
+        const { scan } = await import("./engine/scan.js");
+        const usage = await meterOrPrint(io);
+        const result = await scan(state.root, {
+            aiOnly: cmd === "ai-audit",
+            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+        });
+        state.lastResult = result;
+        if (asJson) {
+            const { toJson } = await import("./ui/emit.js");
+            write(io, toJson(result) + "\n\n");
+            return;
+        }
+        write(io, (await renderFor(cmd, result, usage)) + "\n");
+        return;
+    }
+    if (cmd === "fix") {
+        const { runFix } = await import("./engine/fix/session.js");
+        const { renderFixSession, fixToJson, renderApprovalRequest } = await import("./ui/fix.js");
+        const opts = { apply: hasFlag(tokens, "--apply"), yes: hasFlag(tokens, "--yes"), json: asJson };
+        const decision = decideApply(opts, true);
+        if (decision.apply && !hasFlag(tokens, "--no-llm")) {
+            const { maybeOfferAiFixerSetup } = await import("./index-support.js");
+            await maybeOfferAiFixerSetup();
+        }
+        const usage = await meterOrPrint(io);
+        const result = await runFix(state.root, {
+            apply: decision.apply,
+            noLlm: hasFlag(tokens, "--no-llm"),
+            confirm: decision.prompt ? makeFixConfirm(renderApprovalRequest, io.input, io.output) : undefined,
+            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+        });
+        if (asJson) {
+            write(io, fixToJson(result) + "\n\n");
+            return;
+        }
+        write(io, renderFixSession(result, usage) + "\n");
+        if (decision.notice) {
+            write(io, "  Not applied: re-run with `fix --apply --yes` to apply non-interactively.\n\n");
+        }
+        return;
+    }
+    if (cmd === "init") {
+        const { runInit } = await import("./engine/init.js");
+        const { renderInit } = await import("./ui/init.js");
+        const result = await runInit(state.root, { force: hasFlag(tokens, "--force") });
+        write(io, renderInit(result) + "\n");
+        return;
+    }
+    if (cmd === "config") {
+        await handleConfig(tokens, io);
+        return;
+    }
+    if (cmd === "db") {
+        await handleDb(tokens, io);
+        return;
+    }
+    write(io, `  unknown command: ${cmd} (type \`help\`)\n\n`);
+}
+async function renderFor(cmd, result, usage) {
+    if (cmd === "scan" || cmd === "ai-audit") {
+        const { renderReport } = await import("./ui/report.js");
+        return renderReport(result, { aiFocus: cmd === "ai-audit", usage });
+    }
+    if (cmd === "protect") {
+        const { renderRemediations } = await import("./ui/protect.js");
+        return renderRemediations(result, usage);
+    }
+    if (cmd === "attack-map") {
+        const { renderAttackMap } = await import("./ui/attackmap.js");
+        return renderAttackMap(result, usage);
+    }
+    if (cmd === "score") {
+        const { renderScoreOnly } = await import("./ui/protect.js");
+        return renderScoreOnly(result, usage);
+    }
+    if (cmd === "deps") {
+        const { renderDeps } = await import("./ui/deps.js");
+        return renderDeps(result, usage);
+    }
+    const { renderScorecard } = await import("./ui/readiness.js");
+    return renderScorecard(result, usage);
+}
+async function handleConfig(tokens, io) {
+    const [action, provider] = tokens;
+    const { readConfig, setKey, unsetKey, maskKey, configFilePath, ENV_VAR } = await import("./config.js");
+    if (action === "show" || !action) {
+        const cfg = await readConfig();
+        const line = (label, stored, envSet) => `  ${label}:`.padEnd(13) + (stored ? maskKey(stored) : "not set") + (envSet ? "  (env var active)" : "");
+        write(io, "  SecureVibe AI-fixer keys\n");
+        write(io, `  file: ${configFilePath()}\n`);
+        write(io, line("groq", cfg.groqApiKey, !!process.env.GROQ_API_KEY) + "\n");
+        write(io, line("anthropic", cfg.anthropicApiKey, !!process.env.ANTHROPIC_API_KEY) + "\n\n");
+        return;
+    }
+    if ((action === "set-key" || action === "unset-key") && provider !== "groq" && provider !== "anthropic") {
+        write(io, `  usage: config ${action} <groq|anthropic>\n\n`);
+        return;
+    }
+    if (action === "set-key") {
+        const hint = provider === "groq" ? " (free — console.groq.com/keys)" : " (console.anthropic.com)";
+        const key = (await askLine(`  Paste your ${provider} API key${hint}: `, io.input, io.output)).trim();
+        if (!key) {
+            write(io, "  No key entered — nothing saved.\n\n");
+            return;
+        }
+        await setKey(provider, key);
+        process.env[ENV_VAR[provider]] = key;
+        write(io, `  Saved to ${configFilePath()}. This session will use it.\n\n`);
+        return;
+    }
+    if (action === "unset-key") {
+        await unsetKey(provider);
+        write(io, `  Removed the stored ${provider} key.\n\n`);
+        return;
+    }
+    write(io, "  usage: config show | set-key <groq|anthropic> | unset-key <groq|anthropic>\n\n");
+}
+async function handleDb(tokens, io) {
+    const [action] = tokens;
+    if (action === "status") {
+        const { loadDepDb, userDbDir } = await import("./engine/deps/db.js");
+        const db = await loadDepDb();
+        const ecos = Object.entries(db.ecosystems)
+            .map(([e, pkgs]) => `${e}: ${Object.keys(pkgs).length} packages`)
+            .join(", ");
+        write(io, `  SecureVibe OSV database\n  date:   ${db.date ?? "(bundled seed only)"}\n  cache:  ${userDbDir()}\n  loaded: ${ecos || "(empty)"}\n\n`);
+        return;
+    }
+    if (action === "update") {
+        const { updateDb } = await import("./engine/deps/osv.js");
+        write(io, "  · fetching OSV dumps (npm, PyPI)…\n");
+        try {
+            const r = await updateDb();
+            write(io, `  Updated local OSV db (${r.date}): ${r.count} packages → ${r.destDir}\n\n`);
+        }
+        catch (err) {
+            write(io, `  db update failed: ${err?.message ?? err}\n\n`);
+        }
+        return;
+    }
+    write(io, "  usage: db update | status\n\n");
+}

package/dist/version.js

@@ -2,4 +2,4 @@
 // Single source of truth for the CLI's own version, so it can't drift from
 // what commander reports and what the update-check compares against.
 // Kept in sync with the "version" field in package.json by hand at release time.
-export const VERSION = "0.1.7";
+export const VERSION = "0.1.8";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securevibe",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",