vettcode-cli 1.0.0

package/dist/patterns.js

@@ -0,0 +1,248 @@
+"use strict";
+/**
+ * Security Patterns - Comprehensive vulnerability detection patterns
+ * Adapted from Vettcode-engine for CLI use
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_PATTERNS = exports.SECURITY_HEADER_PATTERNS = exports.ERROR_HANDLING_PATTERNS = exports.DATABASE_PATTERNS = exports.CRYPTO_PATTERNS = exports.REACT_PATTERNS = exports.AUTH_PATTERNS = exports.PATH_TRAVERSAL_PATTERNS = exports.COMMAND_INJECTION_PATTERNS = exports.XSS_PATTERNS = exports.SQL_INJECTION_PATTERNS = void 0;
+// SQL Injection Patterns
+exports.SQL_INJECTION_PATTERNS = [
+    {
+        id: "sql-injection-template-literal",
+        regex: /(?:execute|query|raw)\s*\(\s*`[^`]*\$\{[^}]+\}[^`]*`/gi,
+        severity: "critical",
+        category: "security",
+        title: "SQL Injection via Template Literal",
+        description: "SQL query uses template literal with user input",
+        confidence: "high",
+    },
+    {
+        id: "sql-injection-string-concat-plus",
+        regex: /(?:execute|query|raw)\s*\(\s*['"][^'"]*['"]\s*\+\s*(?:req\.|params\.|query\.|body\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "SQL Injection via String Concatenation",
+        description: "SQL query concatenates user input directly",
+        confidence: "high",
+    },
+    {
+        id: "sql-injection-where-clause",
+        regex: /WHERE\s+[^=]+\s*=\s*['"]?\$\{|WHERE\s+[^=]+\s*=\s*['"]\s*\+/gi,
+        severity: "critical",
+        category: "security",
+        title: "SQL Injection in WHERE Clause",
+        description: "WHERE clause uses unsanitized user input",
+        confidence: "high",
+    },
+];
+// XSS Patterns
+exports.XSS_PATTERNS = [
+    {
+        id: "xss-react-dangerously-set-html",
+        regex: /dangerouslySetInnerHTML\s*=\s*\{\s*\{?\s*__html\s*:\s*(?!DOMPurify)/gi,
+        severity: "high",
+        category: "security",
+        title: "XSS via dangerouslySetInnerHTML Without Sanitization",
+        description: "React component uses dangerouslySetInnerHTML without DOMPurify",
+        confidence: "high",
+    },
+    {
+        id: "xss-dom-innerhtml",
+        regex: /\.innerHTML\s*=\s*(?!['"`]|DOMPurify)/gi,
+        severity: "high",
+        category: "security",
+        title: "XSS via innerHTML Assignment",
+        description: "Direct innerHTML assignment without sanitization",
+        confidence: "medium",
+    },
+];
+// Command Injection Patterns
+exports.COMMAND_INJECTION_PATTERNS = [
+    {
+        id: "command-injection-exec",
+        regex: /(?:exec|execSync|spawn|spawnSync)\s*\(\s*[`'"]?[^`'"]*\$\{/gi,
+        severity: "critical",
+        category: "security",
+        title: "Command Injection via exec/spawn",
+        description: "Shell command execution with user input",
+        confidence: "high",
+    },
+    {
+        id: "command-injection-eval",
+        regex: /eval\s*\(\s*(?:req\.|params\.|query\.|body\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Code Injection via eval",
+        description: "eval() called with user input",
+        confidence: "high",
+    },
+];
+// Path Traversal Patterns
+exports.PATH_TRAVERSAL_PATTERNS = [
+    {
+        id: "path-traversal-fs-read",
+        regex: /fs\.(?:readFile|readFileSync|createReadStream)\s*\([^)]*(?:req\.|params\.|query\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Path Traversal in File Read",
+        description: "File read operation with unsanitized user input",
+        confidence: "high",
+    },
+    {
+        id: "path-traversal-fs-write",
+        regex: /fs\.(?:writeFile|writeFileSync|createWriteStream)\s*\([^)]*(?:req\.|params\.|query\.)/gi,
+        severity: "critical",
+        category: "security",
+        title: "Path Traversal in File Write",
+        description: "File write operation with unsanitized user input",
+        confidence: "high",
+    },
+];
+// Authentication Patterns
+exports.AUTH_PATTERNS = [
+    {
+        id: "weak-jwt-secret",
+        regex: /jwt\.sign\s*\([^)]*,\s*['"](?:secret|password|123|test)['"]/gi,
+        severity: "critical",
+        category: "security",
+        title: "Weak JWT Secret",
+        description: "JWT signed with weak or hardcoded secret",
+        confidence: "high",
+    },
+    {
+        id: "bcrypt-low-rounds",
+        regex: /bcrypt\.hash\w*\s*\([^)]*,\s*([1-9]|10)\s*\)/gi,
+        severity: "high",
+        category: "security",
+        title: "Weak bcrypt Rounds",
+        description: "bcrypt rounds < 10 is too weak",
+        confidence: "high",
+    },
+];
+// React Patterns
+exports.REACT_PATTERNS = [
+    {
+        id: "react-useeffect-missing-deps",
+        regex: /useEffect\s*\([^)]*\)\s*,\s*\[\s*\]/gi,
+        severity: "medium",
+        category: "react",
+        title: "useEffect with Empty Dependency Array",
+        description: "useEffect may have missing dependencies",
+        confidence: "low",
+    },
+    {
+        id: "react-key-index",
+        regex: /key\s*=\s*\{\s*(?:index|i|idx)\s*\}/gi,
+        severity: "low",
+        category: "react",
+        title: "Using Array Index as React Key",
+        description: "Array index as key can cause rendering issues",
+        confidence: "medium",
+    },
+];
+// Cryptography Patterns
+exports.CRYPTO_PATTERNS = [
+    {
+        id: "crypto-weak-algorithm-md5",
+        regex: /crypto\.createHash\s*\(\s*['"]md5['"]\s*\)/gi,
+        severity: "high",
+        category: "security",
+        title: "Weak Cryptographic Algorithm: MD5",
+        description: "MD5 is cryptographically broken",
+        confidence: "high",
+    },
+    {
+        id: "crypto-weak-algorithm-sha1",
+        regex: /crypto\.createHash\s*\(\s*['"]sha1['"]\s*\)/gi,
+        severity: "high",
+        category: "security",
+        title: "Weak Cryptographic Algorithm: SHA1",
+        description: "SHA1 is deprecated and insecure",
+        confidence: "high",
+    },
+    {
+        id: "crypto-weak-random",
+        regex: /Math\.random\s*\(\s*\)/gi,
+        severity: "medium",
+        category: "security",
+        title: "Weak Random Number Generation",
+        description: "Math.random() is not cryptographically secure",
+        confidence: "low",
+    },
+];
+// Database Patterns
+exports.DATABASE_PATTERNS = [
+    {
+        id: "db-query-no-limit",
+        regex: /\.find\s*\(\s*\{[^}]*\}\s*\)(?![\s\S]{0,100}\.limit)/gi,
+        severity: "high",
+        category: "performance",
+        title: "Database Query Without Limit",
+        description: "Query can return unlimited results causing OOM",
+        confidence: "medium",
+    },
+    {
+        id: "db-n-plus-one",
+        regex: /for\s*\([^)]*\)\s*\{[^}]*(?:find|findOne|query)\s*\(/gi,
+        severity: "high",
+        category: "performance",
+        title: "Potential N+1 Query Problem",
+        description: "Database query inside loop causes N+1 problem",
+        confidence: "low",
+    },
+];
+// Error Handling Patterns
+exports.ERROR_HANDLING_PATTERNS = [
+    {
+        id: "empty-catch-block",
+        regex: /catch\s*\([^)]*\)\s*\{\s*\}/gi,
+        severity: "medium",
+        category: "production",
+        title: "Empty Catch Block",
+        description: "Error caught but not handled",
+        confidence: "high",
+    },
+    {
+        id: "throw-string",
+        regex: /throw\s+['"][^'"]+['"]/gi,
+        severity: "low",
+        category: "code-quality",
+        title: "Throwing String Instead of Error",
+        description: "Should throw Error objects, not strings",
+        confidence: "high",
+    },
+];
+// Security Header Patterns
+exports.SECURITY_HEADER_PATTERNS = [
+    {
+        id: "missing-helmet",
+        regex: /express\s*\(\s*\)(?![\s\S]{0,500}helmet)/gi,
+        severity: "high",
+        category: "security",
+        title: "Express App Without Helmet",
+        description: "Missing security headers middleware",
+        confidence: "medium",
+    },
+    {
+        id: "cors-allow-all",
+        regex: /Access-Control-Allow-Origin['"]?\s*:\s*['"]?\*/gi,
+        severity: "high",
+        category: "security",
+        title: "CORS Allows All Origins",
+        description: "Wildcard CORS policy is insecure",
+        confidence: "high",
+    },
+];
+// Export all patterns combined
+exports.ALL_PATTERNS = [
+    ...exports.SQL_INJECTION_PATTERNS,
+    ...exports.XSS_PATTERNS,
+    ...exports.COMMAND_INJECTION_PATTERNS,
+    ...exports.PATH_TRAVERSAL_PATTERNS,
+    ...exports.AUTH_PATTERNS,
+    ...exports.REACT_PATTERNS,
+    ...exports.CRYPTO_PATTERNS,
+    ...exports.DATABASE_PATTERNS,
+    ...exports.ERROR_HANDLING_PATTERNS,
+    ...exports.SECURITY_HEADER_PATTERNS,
+];

package/dist/prompts.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SYNTHESIS_SYSTEM_PROMPT = exports.BATCH_SYSTEM_PROMPT = void 0;
+exports.buildSmartBatchUserPrompt = buildSmartBatchUserPrompt;
+exports.buildSynthesisUserPrompt = buildSynthesisUserPrompt;
+exports.getAnalysisPrompt = getAnalysisPrompt;
+exports.BATCH_SYSTEM_PROMPT = `You are Vettcode Engine — a ruthless, expert application security and production-readiness auditor.
+
+You receive:
+1. HIGH-RISK CODE SECTIONS extracted via AST analysis (not full files)
+2. STATIC ANALYSIS FINDINGS that need verification
+
+Your job:
+- Verify static findings (confirm if they're real vulnerabilities or false positives)
+- Analyze the high-risk code sections for additional issues
+- Report REAL issues only. Do not invent problems.
+- Be harsh but accurate.
+
+Detect and report:
+- Security vulnerabilities (injection, XSS, CSRF, auth bypass, secrets in code, insecure crypto, SSRF, path traversal, IDOR, etc.)
+- Production failures waiting to happen (missing error handling, unhandled promises, race conditions, memory leaks, missing timeouts, bad retries)
+- Type/logic errors and wrong assumptions that can crash the app or corrupt data
+- Database risks (SQL injection, N+1, missing transactions, connection leaks, migration hazards, missing indexes on hot paths)
+- Misconfiguration (debug in prod, open CORS, weak session settings)
+- Reliability and scalability issues
+
+For static findings:
+- If the code shows proper mitigation (parameterized queries, sanitization, auth middleware), mark as FALSE POSITIVE
+- If the vulnerability is real, CONFIRM it and provide detailed evidence
+- Add context the static analyzer couldn't see
+
+Respond with ONLY valid JSON (no markdown fences):
+{
+  "findings": [
+    {
+      "id": "unique-kebab-id",
+      "severity": "critical|high|medium|low|info",
+      "category": "security|production|typing|logic|database|performance|reliability|configuration|other",
+      "title": "short title",
+      "description": "detailed explanation",
+      "file": "relative/path",
+      "line": 0,
+      "evidence": "code snippet or behavior",
+      "mitigation": "how to fix now",
+      "prevention": "how to stop recurrence",
+      "confidence": "high|medium|low",
+      "source": "static-verified|static-rejected|ai-discovered"
+    }
+  ],
+  "notes": "brief batch-level observations",
+  "partialScore": 0
+}
+
+partialScore is 0-100 for THIS batch only, strict.`;
+exports.SYNTHESIS_SYSTEM_PROMPT = `You are Vettcode Engine synthesizing a final audit report.
+
+You receive:
+1. HIGH-CONFIDENCE static analysis findings (already verified)
+2. AI-analyzed findings (verified static + newly discovered)
+
+Rules:
+- Merge duplicate findings; keep the strongest severity
+- Prioritize high-confidence findings
+- The overall score (0-100) must be STRICT and HONEST. No sugar-coating.
+  - Critical blockers: 0-25
+  - Major issues: 25-50
+  - Moderate issues: 50-70
+  - Minor issues: 70-85
+  - Excellent: 85-95
+  - Perfect (rare): 95-100
+- grade: letter A+ through F matching the score harshly
+- executiveVerdict: 2-4 blunt sentences a CTO would read
+- criticalBlockers: issues that MUST be fixed before any production deploy
+
+Respond with ONLY valid JSON (no markdown):
+{
+  "score": 0,
+  "grade": "F",
+  "summary": "overview",
+  "executiveVerdict": "blunt verdict",
+  "findings": [... same finding schema ...],
+  "strengths": ["only genuine strengths"],
+  "criticalBlockers": ["..."],
+  "methodology": {
+    "staticAnalysisFindings": 0,
+    "aiVerifiedFindings": 0,
+    "aiDiscoveredFindings": 0,
+    "falsePositivesRejected": 0
+  }
+}`;
+function buildSmartBatchUserPrompt(projectName, batchIndex, totalBatches, smartContext, staticFindings) {
+    let prompt = `Project: ${projectName}
+Batch: ${batchIndex + 1} of ${totalBatches}
+
+=== STATIC ANALYSIS FINDINGS TO VERIFY ===
+${staticFindings.length > 0 ? JSON.stringify(staticFindings, null, 2) : "None in this batch"}
+
+=== HIGH-RISK CODE SECTIONS (AST-EXTRACTED) ===
+${smartContext}
+
+INSTRUCTIONS:
+1. Verify each static finding - check if the vulnerability is real or mitigated
+2. Analyze the high-risk code sections for additional issues
+3. Report only confirmed, real vulnerabilities`;
+    return prompt;
+}
+function buildSynthesisUserPrompt(projectName, stats, staticFindings, batchResults) {
+    return `Project: ${projectName}
+
+=== SCAN STATISTICS ===
+Files scanned: ${stats.files}
+Total lines: ${stats.lines}
+High-risk lines extracted: ${stats.extractedLines} (${stats.compressionRatio}% compression)
+Paths ignored (deps/build): ${stats.ignored}
+
+=== HIGH-CONFIDENCE STATIC FINDINGS ===
+${JSON.stringify(staticFindings, null, 2)}
+
+=== AI BATCH ANALYSIS RESULTS ===
+${batchResults}
+
+Produce the final merged Vettcode report with strict 0-100 score.`;
+}
+function getAnalysisPrompt(projectName, batch, batchIndex) {
+    let prompt = `Project: ${projectName}
+Batch: ${batchIndex + 1}
+
+=== STATIC ANALYSIS FINDINGS TO VERIFY ===
+${batch.staticFindings.length > 0 ? JSON.stringify(batch.staticFindings, null, 2) : "None in this batch"}
+
+=== HIGH-RISK CODE SECTIONS (AST-EXTRACTED) ===
+`;
+    for (const extracted of batch.sections) {
+        prompt += `\n--- ${extracted.file} ---\n`;
+        for (const section of extracted.sections) {
+            prompt += `\nLine ${section.startLine}-${section.endLine} (Type: ${section.type}):\n${section.code}\n`;
+        }
+    }
+    prompt += `\nINSTRUCTIONS:
+1. Verify each static finding - check if the vulnerability is real or mitigated
+2. Analyze the high-risk code sections for additional issues
+3. Report only confirmed, real vulnerabilities`;
+    return prompt;
+}