vettcode-cli 1.0.0

package/dist/ignore-patterns.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEXT_EXTENSIONS = exports.IGNORED_EXTENSIONS = exports.IGNORED_FILE_NAMES = exports.IGNORED_DIR_NAMES = void 0;
+exports.shouldIgnorePath = shouldIgnorePath;
+/** Directory and file patterns excluded from vetting (deps, build output, VCS, etc.) */
+exports.IGNORED_DIR_NAMES = new Set([
+    "node_modules",
+    ".git",
+    ".github",
+    ".svn",
+    ".hg",
+    "dist",
+    "build",
+    "out",
+    ".next",
+    ".nuxt",
+    ".output",
+    "coverage",
+    ".cache",
+    ".turbo",
+    "vendor",
+    "bower_components",
+    "__pycache__",
+    ".pytest_cache",
+    ".mypy_cache",
+    ".venv",
+    "venv",
+    "env",
+    ".env",
+    "target",
+    "obj",
+    ".gradle",
+    ".idea",
+    ".vscode",
+    "Pods",
+    "DerivedData",
+    ".parcel-cache",
+    ".svelte-kit",
+    "storybook-static",
+    ".vercel",
+    "pkg",
+    "deps",
+    "_build",
+    "elm-stuff",
+    ".stack-work",
+    "zig-cache",
+    "zig-out",
+    "test", // Test directories
+    "tests", // Test directories
+    "__tests__", // Jest test directories
+    "spec", // Spec directories
+    "specs", // Spec directories
+    "e2e", // End-to-end test directories
+    "cypress", // Cypress test directories
+    "playwright", // Playwright test directories
+    ".jest", // Jest config directories
+    ".mocha", // Mocha config directories
+]);
+exports.IGNORED_FILE_NAMES = new Set([
+    ".DS_Store",
+    "Thumbs.db",
+    "package-lock.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+    "Cargo.lock",
+    "composer.lock",
+    "Gemfile.lock",
+    "poetry.lock",
+    "README.md",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "LICENSE.md",
+    "CODE_OF_CONDUCT.md",
+]);
+exports.IGNORED_EXTENSIONS = new Set([
+    ".png",
+    ".jpg",
+    ".jpeg",
+    ".gif",
+    ".webp",
+    ".ico",
+    ".svg",
+    ".woff",
+    ".woff2",
+    ".ttf",
+    ".eot",
+    ".mp4",
+    ".mp3",
+    ".wav",
+    ".zip",
+    ".tar",
+    ".gz",
+    ".rar",
+    ".7z",
+    ".pdf",
+    ".exe",
+    ".dll",
+    ".so",
+    ".dylib",
+    ".wasm",
+    ".map",
+    ".min.js",
+    ".min.css",
+    ".lock",
+    ".pyc",
+    ".class",
+    ".jar",
+    ".o",
+    ".a",
+    ".md", // Markdown files - documentation only
+    ".mdx", // MDX files - documentation only
+]);
+exports.TEXT_EXTENSIONS = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".json",
+    ".jsonc",
+    ".vue",
+    ".svelte",
+    ".py",
+    ".rb",
+    ".go",
+    ".rs",
+    ".java",
+    ".kt",
+    ".kts",
+    ".scala",
+    ".php",
+    ".cs",
+    ".cpp",
+    ".c",
+    ".h",
+    ".hpp",
+    ".swift",
+    ".dart",
+    ".lua",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".ps1",
+    ".sql",
+    ".graphql",
+    ".gql",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".xml",
+    ".html",
+    ".htm",
+    ".css",
+    ".scss",
+    ".sass",
+    ".less",
+    ".env.example",
+    ".prisma",
+    ".proto",
+    ".tf",
+    ".hcl",
+    ".dockerfile",
+    ".gradle",
+    ".properties",
+    ".ini",
+    ".cfg",
+    ".conf",
+    ".env.local.example",
+]);
+function shouldIgnorePath(relativePath) {
+    const normalized = relativePath.replace(/\\/g, "/").toLowerCase();
+    const parts = normalized.split("/");
+    for (const part of parts) {
+        if (exports.IGNORED_DIR_NAMES.has(part))
+            return true;
+        if (part.startsWith(".") && part !== ".env.example" && part !== ".gitignore") {
+            if ([".github", ".gitlab", ".circleci"].includes(part))
+                continue;
+            if (part.length > 1 && !part.includes("env"))
+                return true;
+        }
+    }
+    const fileName = parts[parts.length - 1] ?? "";
+    if (exports.IGNORED_FILE_NAMES.has(fileName))
+        return true;
+    // Ignore test files by pattern
+    const testPatterns = [
+        /\.test\.(ts|tsx|js|jsx)$/, // file.test.ts
+        /\.spec\.(ts|tsx|js|jsx)$/, // file.spec.ts
+        /\.test\.(py|rb|go|java|php)$/, // file.test.py
+        /\.spec\.(py|rb|go|java|php)$/, // file.spec.py
+        /_test\.(ts|tsx|js|jsx|py|go)$/, // file_test.go
+        /_spec\.(ts|tsx|js|jsx|py|rb)$/, // file_spec.rb
+        /test_.*\.(py|rb)$/, // test_file.py
+        /.*\.e2e\.(ts|tsx|js|jsx)$/, // file.e2e.ts
+        /.*\.integration\.(ts|tsx|js|jsx)$/, // file.integration.ts
+    ];
+    for (const pattern of testPatterns) {
+        if (pattern.test(fileName))
+            return true;
+    }
+    const dot = fileName.lastIndexOf(".");
+    const ext = dot >= 0 ? fileName.slice(dot).toLowerCase() : "";
+    if (ext && exports.IGNORED_EXTENSIONS.has(ext))
+        return true;
+    if (!ext && !fileName.includes(".")) {
+        const noExtAllowed = new Set([
+            "dockerfile",
+            "makefile",
+            "gemfile",
+            "rakefile",
+            "procfile",
+            "vagrantfile",
+        ]);
+        if (!noExtAllowed.has(fileName.toLowerCase())) {
+            return false;
+        }
+    }
+    if (ext && !exports.TEXT_EXTENSIONS.has(ext)) {
+        if (!fileName.endsWith(".d.ts"))
+            return true;
+    }
+    return false;
+}

package/dist/openrouter.js

@@ -0,0 +1,311 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getApiKeys = getApiKeys;
+exports.getModels = getModels;
+exports.nextApiKey = nextApiKey;
+exports.keyForIndex = keyForIndex;
+exports.chatCompletion = chatCompletion;
+exports.parseJsonFromModel = parseJsonFromModel;
+const OPENROUTER_URL = "https://openrouter.ai/api/v1/chat/completions";
+let keyIndex = 0;
+function getApiKeys() {
+    const keys = [];
+    const combined = process.env.OPENROUTER_API_KEYS;
+    if (combined) {
+        keys.push(...combined
+            .split(",")
+            .map((k) => k.trim())
+            .filter(Boolean));
+    }
+    for (let i = 1; i <= 3; i++) {
+        const k = process.env[`OPENROUTER_API_KEY_${i}`];
+        if (k?.trim())
+            keys.push(k.trim());
+    }
+    // Security: Never log API keys or their partial values
+    if (keys.length === 0) {
+        console.error('[OpenRouter] No API keys found! Check environment variables.');
+        // Don't log which specific env vars are set/unset as this could leak information
+    }
+    else {
+        const nodeEnv = process.env.NODE_ENV?.trim() || 'production';
+        if (nodeEnv === 'development') {
+            console.log(`[OpenRouter] Found ${keys.length} API key(s) configured`);
+        }
+    }
+    return [...new Set(keys)];
+}
+function getModels() {
+    const raw = process.env.OPENROUTER_MODELS ??
+        "openrouter/free,deepseek/deepseek-chat-v3-0324:free,qwen/qwen-2.5-coder-32b-instruct:free";
+    const models = raw
+        .split(",")
+        .map((m) => m.trim())
+        .filter(Boolean);
+    // OpenRouter allows max 3 models in fallback array
+    return models.slice(0, 3);
+}
+// Rate limiting per API key to prevent exhaustion
+const keyUsageMap = new Map();
+const RATE_LIMIT_WINDOW = 60000; // 1 minute window
+const MAX_REQUESTS_PER_KEY = 50; // Reduced from 100 to be more conservative
+const LOCK_DURATION = 120000; // 2 minutes lock after exceeding limit
+function nextApiKey() {
+    const keys = getApiKeys();
+    if (keys.length === 0) {
+        throw new Error("No OpenRouter API keys configured. Set OPENROUTER_API_KEY_1, _2, _3 or OPENROUTER_API_KEYS.");
+    }
+    const now = Date.now();
+    // Try to find a key that hasn't exceeded rate limit and isn't locked
+    for (let i = 0; i < keys.length; i++) {
+        const key = keys[(keyIndex + i) % keys.length];
+        const usage = keyUsageMap.get(key);
+        // Check if key is locked
+        if (usage?.lockUntil && now < usage.lockUntil) {
+            continue; // Skip locked keys
+        }
+        // Reset usage if window has expired
+        if (usage && now - usage.resetTime > RATE_LIMIT_WINDOW) {
+            keyUsageMap.set(key, { count: 1, resetTime: now });
+            keyIndex = (keyIndex + i + 1) % keys.length;
+            return key;
+        }
+        // Check if key is under rate limit
+        if (!usage) {
+            keyUsageMap.set(key, { count: 1, resetTime: now });
+            keyIndex = (keyIndex + i + 1) % keys.length;
+            return key;
+        }
+        if (usage.count < MAX_REQUESTS_PER_KEY) {
+            keyUsageMap.set(key, { ...usage, count: usage.count + 1 });
+            keyIndex = (keyIndex + i + 1) % keys.length;
+            return key;
+        }
+        // Lock the key if it exceeded the limit
+        if (!usage.lockUntil) {
+            console.warn(`[OpenRouter] API key ${i + 1} exceeded rate limit, locking for 2 minutes`);
+            keyUsageMap.set(key, { ...usage, lockUntil: now + LOCK_DURATION });
+        }
+    }
+    // All keys are rate limited or locked
+    const unlockTime = Math.min(...Array.from(keyUsageMap.values()).map(u => u.lockUntil || u.resetTime + RATE_LIMIT_WINDOW));
+    const waitTime = Math.ceil((unlockTime - now) / 1000);
+    throw new Error(`All API keys are rate limited. Please wait ${waitTime} seconds before retrying.`);
+}
+function keyForIndex(index) {
+    const keys = getApiKeys();
+    if (keys.length === 0)
+        throw new Error("No OpenRouter API keys configured.");
+    return keys[index % keys.length];
+}
+async function chatCompletion(messages, keyOverride, retries = 2) {
+    // Input validation to prevent prompt injection
+    if (!Array.isArray(messages) || messages.length === 0) {
+        throw new Error('Messages must be a non-empty array');
+    }
+    // Validate each message structure
+    for (const msg of messages) {
+        if (!msg || typeof msg !== 'object') {
+            throw new Error('Invalid message structure');
+        }
+        if (!['system', 'user', 'assistant'].includes(msg.role)) {
+            throw new Error(`Invalid message role: ${msg.role}`);
+        }
+        if (typeof msg.content !== 'string') {
+            throw new Error('Message content must be a string');
+        }
+        // Limit message length to prevent abuse
+        if (msg.content.length > 1000000) { // 1MB limit
+            throw new Error('Message content exceeds maximum length');
+        }
+        // Check for suspicious patterns that might indicate prompt injection
+        const suspiciousPatterns = [
+            /ignore\s+(?:all\s+)?previous\s+(?:instructions?|prompts?)/gi,
+            /disregard\s+(?:all\s+)?(?:previous|prior)\s+(?:instructions?|commands?)/gi,
+            /forget\s+(?:everything|all)\s+(?:before|above)/gi,
+            /new\s+instructions?:/gi,
+        ];
+        for (const pattern of suspiciousPatterns) {
+            if (pattern.test(msg.content)) {
+                console.warn('[Security] Suspicious prompt injection pattern detected');
+                // Don't block, but log for monitoring
+            }
+        }
+    }
+    const apiKey = keyOverride ?? nextApiKey();
+    const models = getModels();
+    // Validate and construct site URL
+    const vercelUrl = process.env.VERCEL_URL?.trim();
+    const publicUrl = process.env.NEXT_PUBLIC_SITE_URL?.trim();
+    const siteUrl = publicUrl || (vercelUrl ? `https://${vercelUrl}` : "http://localhost:3000");
+    const body = {
+        models,
+        messages,
+        temperature: 0.15, // Slightly higher for more nuanced analysis
+        max_tokens: 6000, // Increased for detailed findings
+    };
+    if (models.length === 1) {
+        body.model = models[0];
+        delete body.models;
+    }
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            const nodeEnv = process.env.NODE_ENV?.trim() || 'production';
+            if (nodeEnv === 'development') {
+                console.log(`[OpenRouter] Attempt ${attempt + 1}/${retries + 1} - Calling ${OPENROUTER_URL}`);
+                console.log(`[OpenRouter] Models: ${JSON.stringify(models)}`);
+                console.log(`[OpenRouter] Message count: ${messages.length}, Total chars: ${messages.reduce((sum, m) => sum + m.content.length, 0)}`);
+            }
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), 60000); // 60 second timeout
+            const res = await fetch(OPENROUTER_URL, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${apiKey}`,
+                    "Content-Type": "application/json",
+                    "HTTP-Referer": siteUrl,
+                    "X-Title": "Vettcode Engine",
+                },
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+            clearTimeout(timeoutId);
+            if (nodeEnv === 'development') {
+                console.log(`[OpenRouter] Response status: ${res.status}`);
+            }
+            if (!res.ok) {
+                const errText = await res.text();
+                console.error(`[OpenRouter] Error response:`, errText.slice(0, 500));
+                // Check for rate limit or temporary errors
+                if (res.status === 429 || res.status === 503) {
+                    if (attempt < retries) {
+                        console.warn(`[OpenRouter] Rate limited or service unavailable, retrying in ${2000 * (attempt + 1)}ms...`);
+                        await new Promise(resolve => setTimeout(resolve, 2000 * (attempt + 1)));
+                        continue;
+                    }
+                }
+                throw new Error(`OpenRouter ${res.status}: ${errText.slice(0, 500)}`);
+            }
+            const data = (await res.json());
+            const content = data.choices?.[0]?.message?.content?.trim();
+            if (nodeEnv === 'development') {
+                console.log(`[OpenRouter] Response model: ${data.model || 'unknown'}`);
+                console.log(`[OpenRouter] Content length: ${content?.length || 0} chars`);
+            }
+            if (!content) {
+                if (attempt < retries) {
+                    console.warn(`[OpenRouter] Empty response, retrying (${attempt + 1}/${retries})...`);
+                    await new Promise(resolve => setTimeout(resolve, 1000));
+                    continue;
+                }
+                throw new Error("Empty response from OpenRouter after retries");
+            }
+            if (nodeEnv === 'development') {
+                console.log(`[OpenRouter] ✓ Success on attempt ${attempt + 1}`);
+            }
+            return { content, model: data.model ?? models[0] };
+        }
+        catch (error) {
+            // Log error for debugging
+            if (error instanceof Error) {
+                console.error(`[OpenRouter] Request error: ${error.message}`);
+            }
+            if (attempt === retries) {
+                console.error(`[OpenRouter] ✗ All attempts failed:`, error);
+                // Return a graceful fallback instead of throwing
+                throw new Error(`API request failed after ${retries + 1} attempts: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            }
+            console.warn(`[OpenRouter] Attempt ${attempt + 1} failed, retrying...`, error);
+            await new Promise(resolve => setTimeout(resolve, 1000));
+        }
+    }
+    throw new Error("Failed after all retries");
+}
+function parseJsonFromModel(raw) {
+    const trimmed = raw.trim();
+    // Validate input is a string and not empty
+    if (typeof trimmed !== 'string' || trimmed.length === 0) {
+        throw new Error('Invalid input: empty or non-string value');
+    }
+    // Check for potentially malicious patterns
+    const dangerousPatterns = [
+        /<script/i,
+        /javascript:/i,
+        /on\w+\s*=/i,
+        /eval\s*\(/i,
+        /Function\s*\(/i,
+    ];
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(trimmed)) {
+            throw new Error('Potentially malicious content detected in JSON');
+        }
+    }
+    // Try to extract JSON from markdown code blocks
+    const fenceMatch = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/);
+    let jsonStr = fenceMatch ? fenceMatch[1].trim() : trimmed;
+    // Remove any leading/trailing text that's not JSON
+    const jsonStart = jsonStr.indexOf('{');
+    const jsonEnd = jsonStr.lastIndexOf('}');
+    if (jsonStart !== -1 && jsonEnd !== -1 && jsonEnd > jsonStart) {
+        jsonStr = jsonStr.substring(jsonStart, jsonEnd + 1);
+    }
+    try {
+        const parsed = JSON.parse(jsonStr);
+        // Validate parsed object is not a function or contains functions
+        if (typeof parsed === 'function') {
+            throw new Error('Invalid JSON: function detected');
+        }
+        // Recursively check for functions in objects
+        const checkForFunctions = (obj) => {
+            if (typeof obj === 'function') {
+                throw new Error('Invalid JSON: function detected in object');
+            }
+            if (obj && typeof obj === 'object') {
+                for (const key in obj) {
+                    if (obj.hasOwnProperty(key)) {
+                        checkForFunctions(obj[key]);
+                    }
+                }
+            }
+        };
+        checkForFunctions(parsed);
+        return parsed;
+    }
+    catch (error) {
+        // Log initial parse error
+        if (error instanceof Error) {
+            console.error(`[JSON Parse] Initial parse failed: ${error.message}`);
+        }
+        // Try to fix common JSON issues
+        try {
+            // Fix unescaped quotes in strings
+            const fixed = jsonStr
+                .replace(/([^\\])"([^"]*)":/g, '$1\\"$2":') // Fix keys
+                .replace(/: "([^"]*)"([^,}\]])/g, ': "$1\\"$2'); // Fix values
+            const parsed = JSON.parse(fixed);
+            // Validate parsed object
+            if (typeof parsed === 'function') {
+                throw new Error('Invalid JSON: function detected');
+            }
+            const checkForFunctions = (obj) => {
+                if (typeof obj === 'function') {
+                    throw new Error('Invalid JSON: function detected in object');
+                }
+                if (obj && typeof obj === 'object') {
+                    for (const key in obj) {
+                        if (obj.hasOwnProperty(key)) {
+                            checkForFunctions(obj[key]);
+                        }
+                    }
+                }
+            };
+            checkForFunctions(parsed);
+            return parsed;
+        }
+        catch (fixError) {
+            console.error('[JSON Parse] Failed to parse JSON:', jsonStr.substring(0, 500));
+            console.error('[JSON Parse] Fix attempt also failed:', fixError);
+            throw new Error(`Invalid JSON response from AI: ${error instanceof Error ? error.message : 'Parse error'}`);
+        }
+    }
+}