vibecheck-ai 2.0.1 → 5.0.0

package/bin/runners/lib/env-resolver.js

@@ -0,0 +1,417 @@
+/**
+ * Env Resolver v2
+ * 
+ * Resolves environment variables for client calls, handles baseURL,
+ * and generates .env.template from usage.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+// =============================================================================
+// ENV VAR PATTERNS
+// =============================================================================
+
+const ENV_PATTERNS = {
+  // Standard Node.js
+  processEnv: /process\.env\.(\w+)/g,
+  processEnvBracket: /process\.env\[['"](\w+)['"]\]/g,
+  
+  // Vite
+  importMetaEnv: /import\.meta\.env\.(\w+)/g,
+  
+  // Template literals
+  templateEnv: /\$\{process\.env\.(\w+)\}/g,
+  
+  // Next.js public
+  nextPublic: /NEXT_PUBLIC_(\w+)/g,
+};
+
+const BASE_URL_VARS = [
+  "NEXT_PUBLIC_API_URL",
+  "NEXT_PUBLIC_BASE_URL",
+  "NEXT_PUBLIC_APP_URL",
+  "VITE_API_URL",
+  "VITE_BASE_URL",
+  "API_URL",
+  "API_BASE_URL",
+  "BASE_URL",
+  "APP_URL",
+  "BACKEND_URL",
+];
+
+const SENSITIVE_PATTERNS = [
+  /SECRET/i,
+  /KEY/i,
+  /TOKEN/i,
+  /PASSWORD/i,
+  /PRIVATE/i,
+  /CREDENTIAL/i,
+  /AUTH/i,
+];
+
+// =============================================================================
+// BASE URL RESOLUTION
+// =============================================================================
+
+/**
+ * Resolve base URL from env vars
+ */
+function resolveBaseUrl(options = {}) {
+  const { envVars = {}, defaultUrl = "" } = options;
+
+  // Try each known base URL var
+  for (const varName of BASE_URL_VARS) {
+    if (envVars[varName]) {
+      return normalizeBaseUrl(envVars[varName]);
+    }
+  }
+
+  // Try to get from process.env (at runtime)
+  for (const varName of BASE_URL_VARS) {
+    if (process.env[varName]) {
+      return normalizeBaseUrl(process.env[varName]);
+    }
+  }
+
+  return defaultUrl;
+}
+
+/**
+ * Normalize base URL (remove trailing slash)
+ */
+function normalizeBaseUrl(url) {
+  if (!url) return "";
+  return url.replace(/\/+$/, "");
+}
+
+/**
+ * Resolve URL with base
+ */
+function resolveUrlWithBase(urlTemplate, baseUrl) {
+  if (!urlTemplate) return urlTemplate;
+
+  // Already absolute
+  if (urlTemplate.startsWith("http://") || urlTemplate.startsWith("https://")) {
+    return urlTemplate;
+  }
+
+  // Ensure path starts with /
+  const path = urlTemplate.startsWith("/") ? urlTemplate : `/${urlTemplate}`;
+
+  if (baseUrl) {
+    return `${normalizeBaseUrl(baseUrl)}${path}`;
+  }
+
+  return path;
+}
+
+/**
+ * Extract env var references from URL template
+ */
+function extractEnvVarsFromUrl(urlTemplate) {
+  const vars = [];
+
+  if (!urlTemplate) return vars;
+
+  // Check for env var patterns
+  let match;
+  
+  for (const [name, pattern] of Object.entries(ENV_PATTERNS)) {
+    const regex = new RegExp(pattern.source, "g");
+    while ((match = regex.exec(urlTemplate)) !== null) {
+      vars.push({
+        name: match[1],
+        pattern: name,
+        fullMatch: match[0],
+      });
+    }
+  }
+
+  return vars;
+}
+
+/**
+ * Substitute env vars in URL template
+ */
+function substituteEnvVars(urlTemplate, envVars = {}) {
+  if (!urlTemplate) return urlTemplate;
+
+  let result = urlTemplate;
+
+  // Substitute process.env.VAR
+  result = result.replace(/process\.env\.(\w+)/g, (_, name) => {
+    return envVars[name] || process.env[name] || `\${${name}}`;
+  });
+
+  // Substitute process.env["VAR"]
+  result = result.replace(/process\.env\[['"](\w+)['"]\]/g, (_, name) => {
+    return envVars[name] || process.env[name] || `\${${name}}`;
+  });
+
+  // Substitute import.meta.env.VAR
+  result = result.replace(/import\.meta\.env\.(\w+)/g, (_, name) => {
+    return envVars[name] || process.env[name] || `\${${name}}`;
+  });
+
+  // Substitute ${VAR}
+  result = result.replace(/\$\{(\w+)\}/g, (_, name) => {
+    return envVars[name] || process.env[name] || `\${${name}}`;
+  });
+
+  return result;
+}
+
+// =============================================================================
+// CLIENT CALL BASE URL RESOLUTION
+// =============================================================================
+
+/**
+ * Resolve base URL for client calls
+ */
+function resolveClientCallUrls(clientCalls, options = {}) {
+  const { baseUrl = "", envVars = {} } = options;
+
+  const resolvedBaseUrl = baseUrl || resolveBaseUrl({ envVars });
+
+  return clientCalls.map(call => {
+    // Extract env vars from URL
+    const envRefs = extractEnvVarsFromUrl(call.urlTemplate);
+
+    // Substitute env vars
+    const substituted = substituteEnvVars(call.urlTemplate, envVars);
+
+    // Resolve with base URL
+    const resolved = resolveUrlWithBase(substituted, resolvedBaseUrl);
+
+    return {
+      ...call,
+      urlResolved: resolved,
+      envRefs,
+      baseUrlUsed: resolvedBaseUrl || null,
+    };
+  });
+}
+
+// =============================================================================
+// ENV TEMPLATE GENERATION
+// =============================================================================
+
+/**
+ * Generate .env.template from truthpack
+ */
+function generateEnvTemplate(truthpack, options = {}) {
+  const { includeExamples = true, groupByPrefix = true } = options;
+
+  const env = truthpack?.env || {};
+  const vars = env.vars || [];
+  const declared = new Set(env.declared || []);
+
+  // Group vars
+  const groups = {
+    next_public: [],
+    vite: [],
+    api: [],
+    auth: [],
+    database: [],
+    stripe: [],
+    other: [],
+  };
+
+  for (const v of vars) {
+    const name = v.name;
+    
+    if (name.startsWith("NEXT_PUBLIC_")) {
+      groups.next_public.push(v);
+    } else if (name.startsWith("VITE_")) {
+      groups.vite.push(v);
+    } else if (name.includes("API") || name.includes("URL")) {
+      groups.api.push(v);
+    } else if (name.includes("AUTH") || name.includes("SESSION") || name.includes("JWT")) {
+      groups.auth.push(v);
+    } else if (name.includes("DATABASE") || name.includes("DB_") || name.includes("POSTGRES") || name.includes("MYSQL")) {
+      groups.database.push(v);
+    } else if (name.includes("STRIPE")) {
+      groups.stripe.push(v);
+    } else {
+      groups.other.push(v);
+    }
+  }
+
+  // Generate template
+  const lines = [];
+  lines.push("# Environment Variables Template");
+  lines.push("# Generated by Vibecheck - https://github.com/guardiavault-oss/Vibecheck");
+  lines.push(`# Generated at: ${new Date().toISOString()}`);
+  lines.push("");
+
+  const groupLabels = {
+    next_public: "# Next.js Public Variables (exposed to browser)",
+    vite: "# Vite Public Variables",
+    api: "# API Configuration",
+    auth: "# Authentication",
+    database: "# Database",
+    stripe: "# Stripe",
+    other: "# Other",
+  };
+
+  for (const [group, groupVars] of Object.entries(groups)) {
+    if (groupVars.length === 0) continue;
+
+    if (groupByPrefix) {
+      lines.push(groupLabels[group] || `# ${group}`);
+    }
+
+    for (const v of groupVars) {
+      const isSensitive = SENSITIVE_PATTERNS.some(p => p.test(v.name));
+      const example = includeExamples ? getExampleValue(v.name, isSensitive) : "";
+      const required = v.required || v.usageCount > 1 ? " # required" : "";
+      
+      lines.push(`${v.name}=${example}${required}`);
+    }
+
+    lines.push("");
+  }
+
+  return lines.join("\n");
+}
+
+/**
+ * Get example value for env var
+ */
+function getExampleValue(name, isSensitive = false) {
+  if (isSensitive) {
+    return "your-secret-here";
+  }
+
+  // Common patterns
+  if (name.includes("URL") || name.includes("HOST")) {
+    if (name.includes("API")) return "http://localhost:3001";
+    if (name.includes("DATABASE") || name.includes("DB")) return "postgresql://user:pass@localhost:5432/db";
+    return "http://localhost:3000";
+  }
+
+  if (name.includes("PORT")) return "3000";
+  if (name.includes("NODE_ENV")) return "development";
+  if (name.includes("DEBUG")) return "false";
+  if (name.includes("LOG_LEVEL")) return "info";
+
+  return "";
+}
+
+/**
+ * Write .env.template to disk
+ */
+function writeEnvTemplate(repoRoot, template) {
+  const templatePath = path.join(repoRoot, ".env.template");
+  fs.writeFileSync(templatePath, template);
+  return templatePath;
+}
+
+/**
+ * Compare .env.template with current usage
+ */
+function compareEnvTemplate(repoRoot, truthpack) {
+  const templatePath = path.join(repoRoot, ".env.template");
+  const examplePath = path.join(repoRoot, ".env.example");
+  
+  // Try both common names
+  let existingPath = null;
+  if (fs.existsSync(templatePath)) {
+    existingPath = templatePath;
+  } else if (fs.existsSync(examplePath)) {
+    existingPath = examplePath;
+  }
+
+  if (!existingPath) {
+    return { exists: false, missing: [], extra: [] };
+  }
+
+  const existingContent = fs.readFileSync(existingPath, "utf8");
+  const existingVars = new Set();
+
+  // Parse existing template
+  for (const line of existingContent.split("\n")) {
+    const match = line.match(/^([A-Z][A-Z0-9_]*)=/);
+    if (match) {
+      existingVars.add(match[1]);
+    }
+  }
+
+  // Compare with truthpack
+  const usedVars = new Set((truthpack?.env?.vars || []).map(v => v.name));
+  
+  const missing = [...usedVars].filter(v => !existingVars.has(v));
+  const extra = [...existingVars].filter(v => !usedVars.has(v));
+
+  return {
+    exists: true,
+    path: existingPath,
+    missing,
+    extra,
+    upToDate: missing.length === 0,
+  };
+}
+
+// =============================================================================
+// ENV GAP DETECTION
+// =============================================================================
+
+/**
+ * Find env gaps - required vars not declared
+ */
+function findEnvGaps(truthpack) {
+  const env = truthpack?.env || {};
+  const vars = env.vars || [];
+  const declared = new Set(env.declared || []);
+
+  const gaps = [];
+
+  for (const v of vars) {
+    const isRequired = v.required || v.usageCount > 1;
+    
+    if (isRequired && !declared.has(v.name)) {
+      gaps.push({
+        name: v.name,
+        usageCount: v.usageCount || 1,
+        files: v.files || [],
+        severity: SENSITIVE_PATTERNS.some(p => p.test(v.name)) ? "BLOCK" : "WARN",
+      });
+    }
+  }
+
+  return gaps;
+}
+
+// =============================================================================
+// EXPORTS
+// =============================================================================
+
+module.exports = {
+  // Patterns
+  ENV_PATTERNS,
+  BASE_URL_VARS,
+  SENSITIVE_PATTERNS,
+
+  // Base URL
+  resolveBaseUrl,
+  normalizeBaseUrl,
+  resolveUrlWithBase,
+
+  // Env var extraction
+  extractEnvVarsFromUrl,
+  substituteEnvVars,
+
+  // Client call resolution
+  resolveClientCallUrls,
+
+  // Template generation
+  generateEnvTemplate,
+  writeEnvTemplate,
+  compareEnvTemplate,
+
+  // Gap detection
+  findEnvGaps,
+};

package/bin/runners/lib/env-template.js

@@ -0,0 +1,66 @@
+// bin/runners/lib/env-template.js
+const fs = require("fs");
+const path = require("path");
+
+function ensureDir(p) {
+  fs.mkdirSync(p, { recursive: true });
+}
+
+function pickEnvTemplatePath(root) {
+  const candidates = [".env.template", ".env.example", ".env.sample"];
+  for (const c of candidates) {
+    const abs = path.join(root, c);
+    if (fs.existsSync(abs)) return c;
+  }
+  return ".env.template";
+}
+
+function normalizeEnvName(n) {
+  return String(n || "").trim();
+}
+
+function parseDeclaredEnvFromText(text) {
+  const declared = new Set();
+  const lines = String(text || "").split(/\r?\n/);
+  for (const l of lines) {
+    if (!l || l.trim().startsWith("#")) continue;
+    const m = l.match(/^([A-Z0-9_]+)\s*=/);
+    if (m) declared.add(m[1]);
+  }
+  return declared;
+}
+
+function writeEnvTemplateFromTruthpack(root, truthpack) {
+  const outRel = pickEnvTemplatePath(root);
+  const outAbs = path.join(root, outRel);
+
+  const used = new Set((truthpack?.env?.vars || []).map(normalizeEnvName).filter(Boolean));
+
+  let existingText = "";
+  if (fs.existsSync(outAbs)) existingText = fs.readFileSync(outAbs, "utf8");
+
+  const declared = parseDeclaredEnvFromText(existingText);
+  const missing = Array.from(used).filter((x) => !declared.has(x)).sort();
+
+  if (!missing.length && fs.existsSync(outAbs)) {
+    return { outRel, wrote: false, added: [] };
+  }
+
+  const header =
+`# vibecheck env template
+# This file is generated/extended from REAL env usage found in your code.
+# Fill values in your real .env (never commit secrets).
+
+`;
+
+  const additions = missing.map((k) => `${k}=\n`).join("");
+
+  const nextText = (existingText.trim().length ? existingText.trimEnd() + "\n\n" : header) + additions;
+
+  ensureDir(path.dirname(outAbs));
+  fs.writeFileSync(outAbs, nextText, "utf8");
+
+  return { outRel, wrote: true, added: missing };
+}
+
+module.exports = { writeEnvTemplateFromTruthpack };

package/bin/runners/lib/env.js

@@ -0,0 +1,189 @@
+// bin/runners/lib/env.js
+const fg = require("fast-glob");
+const fs = require("fs");
+const path = require("path");
+const parser = require("@babel/parser");
+const traverse = require("@babel/traverse").default;
+const t = require("@babel/types");
+const crypto = require("crypto");
+
+function sha256(text) {
+  return "sha256:" + crypto.createHash("sha256").update(text).digest("hex");
+}
+
+function parseFile(code) {
+  return parser.parse(code, { sourceType: "unambiguous", plugins: ["typescript", "jsx"] });
+}
+
+function safeRead(fileAbs) {
+  return fs.readFileSync(fileAbs, "utf8");
+}
+
+function evidenceFromLoc({ fileAbs, fileRel, loc, reason }) {
+  if (!loc) return null;
+  const lines = safeRead(fileAbs).split(/\r?\n/);
+  const start = Math.max(1, loc.start?.line || 1);
+  const end = Math.max(start, loc.end?.line || start);
+  const snippet = lines.slice(start - 1, end).join("\n");
+  return {
+    id: `ev_${crypto.randomBytes(4).toString("hex")}`,
+    file: fileRel,
+    lines: `${start}-${end}`,
+    snippetHash: sha256(snippet),
+    reason
+  };
+}
+
+function mergeEvidenceMap(map, name, ev) {
+  map[name] = map[name] || { name, references: [], signals: { hasDefault: false } };
+  if (ev) map[name].references.push(ev);
+}
+
+function isEnvName(s) {
+  return typeof s === "string" && /^[A-Z0-9_]+$/.test(s);
+}
+
+function extractEnvFromMemberExpr(node) {
+  if (!t.isMemberExpression(node)) return null;
+
+  // process.env.NAME
+  if (t.isMemberExpression(node.object) &&
+      t.isIdentifier(node.object.object, { name: "process" }) &&
+      t.isIdentifier(node.object.property, { name: "env" }) &&
+      t.isIdentifier(node.property)) {
+    return node.property.name;
+  }
+
+  // process.env["NAME"]
+  if (t.isMemberExpression(node.object) &&
+      t.isIdentifier(node.object.object, { name: "process" }) &&
+      t.isIdentifier(node.object.property, { name: "env" }) &&
+      t.isStringLiteral(node.property)) {
+    return node.property.value;
+  }
+
+  // import.meta.env.NAME
+  if (t.isMemberExpression(node.object) &&
+      t.isMemberExpression(node.object.object) &&
+      t.isIdentifier(node.object.object.object, { name: "import" }) &&
+      t.isIdentifier(node.object.object.property, { name: "meta" }) &&
+      t.isIdentifier(node.object.property, { name: "env" }) &&
+      t.isIdentifier(node.property)) {
+    return node.property.name;
+  }
+
+  return null;
+}
+
+function detectDefaultSignals(parentPath) {
+  const p = parentPath?.parentPath;
+  if (!p) return { hasDefault: false };
+
+  if (p.isLogicalExpression() && (p.node.operator === "||" || p.node.operator === "??")) {
+    return { hasDefault: true };
+  }
+  if (p.isConditionalExpression()) return { hasDefault: true };
+  if (p.isAssignmentExpression() && p.node.operator === "||=") return { hasDefault: true };
+  return { hasDefault: false };
+}
+
+async function resolveEnvUsage(repoRoot) {
+  const files = await fg(["**/*.{ts,tsx,js,jsx}"], {
+    cwd: repoRoot,
+    absolute: true,
+    ignore: ["**/node_modules/**","**/.next/**","**/dist/**","**/build/**"]
+  });
+
+  const usageMap = {};
+
+  for (const fileAbs of files) {
+    const fileRel = path.relative(repoRoot, fileAbs).replace(/\\/g, "/");
+    const code = safeRead(fileAbs);
+
+    let ast;
+    try { ast = parseFile(code); } catch { continue; }
+
+    traverse(ast, {
+      MemberExpression(p) {
+        const name = extractEnvFromMemberExpr(p.node);
+        if (!name || !isEnvName(name)) return;
+
+        const ev = evidenceFromLoc({
+          fileAbs,
+          fileRel,
+          loc: p.node.loc,
+          reason: `Env usage: ${name}` 
+        });
+
+        mergeEvidenceMap(usageMap, name, ev);
+
+        const sig = detectDefaultSignals(p);
+        if (sig.hasDefault) usageMap[name].signals.hasDefault = true;
+      }
+    });
+  }
+
+  return usageMap;
+}
+
+function parseDotEnvLike(content) {
+  const out = new Set();
+  const lines = content.split(/\r?\n/);
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const l = line.startsWith("export ") ? line.slice(7).trim() : line;
+    const eq = l.indexOf("=");
+    if (eq <= 0) continue;
+    const key = l.slice(0, eq).trim();
+    if (isEnvName(key)) out.add(key);
+  }
+  return out;
+}
+
+async function resolveEnvDeclared(repoRoot) {
+  const candidates = [
+    ".env.example", ".env.template", ".env.sample",
+    ".env.local.example", ".env.development.example",
+    ".env"
+  ];
+
+  const declared = new Set();
+  const sources = [];
+
+  for (const rel of candidates) {
+    const abs = path.join(repoRoot, rel);
+    if (!fs.existsSync(abs)) continue;
+
+    const content = safeRead(abs);
+    const keys = parseDotEnvLike(content);
+    if (keys.size) {
+      for (const k of keys) declared.add(k);
+      sources.push(rel);
+    }
+  }
+
+  return { declared: Array.from(declared).sort(), sources };
+}
+
+async function buildEnvTruth(repoRoot) {
+  const usageMap = await resolveEnvUsage(repoRoot);
+  const declared = await resolveEnvDeclared(repoRoot);
+
+  const used = Object.values(usageMap).sort((a, b) => a.name.localeCompare(b.name));
+
+  const vars = used.map(u => ({
+    name: u.name,
+    required: !u.signals?.hasDefault,
+    references: u.references || [],
+    notes: u.signals?.hasDefault ? "Has default/fallback usage signal" : ""
+  }));
+
+  return {
+    vars,
+    declared: declared.declared,
+    declaredSources: declared.sources
+  };
+}
+
+module.exports = { buildEnvTruth };