vibecheck-ai 2.0.1 → 5.0.0

package/README.md

@@ -1,491 +0,0 @@
-<p align="center">
-  <img src="https://vibecheckai.dev/logo.png" alt="VibeCheck Logo" width="100" />
-</p>
-
-<h1 align="center">VibeCheck</h1>
-
-<h3 align="center">
-  <strong>Stop AI Hallucinations. Ship Real Features.</strong>
-</h3>
-
-<p align="center">
-  The security layer for AI-assisted development.<br/>
-  Catches fake features, phantom APIs, and silent failures before they hit production.
-</p>
-
-<p align="center">
-  <a href="https://www.npmjs.com/package/vibecheck-ai"><img src="https://img.shields.io/npm/v/vibecheck-ai.svg?style=flat-square&color=E040FB" alt="npm version" /></a>
-  <a href="https://www.npmjs.com/package/vibecheck-ai"><img src="https://img.shields.io/npm/dm/vibecheck-ai.svg?style=flat-square&color=00E676" alt="npm downloads" /></a>
-  <a href="https://github.com/vibecheckai/vibecheck"><img src="https://img.shields.io/github/stars/vibecheckai/vibecheck?style=flat-square&color=FFD54F" alt="github stars" /></a>
-  <a href="https://github.com/vibecheckai/vibecheck/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square" alt="license" /></a>
-</p>
-
-<p align="center">
-  <a href="https://vibecheckai.dev">Website</a> •
-  <a href="https://vibecheckai.dev/docs">Docs</a> •
-  <a href="https://vibecheckai.dev/discord">Discord</a> •
-  <a href="https://twitter.com/vibecheckai">Twitter</a>
-</p>
-
----
-
-## The Problem
-
-AI coding assistants are incredible. They're also **professional liars**.
-
-```typescript
-// Cursor/Copilot generated this. TypeScript happy. Linter passes. Code review: LGTM.
-
-async function getUser(id: string): Promise<User> {
-  return await fetch(`/api/v2/users/${id}`);  // ❌ This endpoint doesn't exist
-}
-
-async function chargeCustomer(order: Order) {
-  try {
-    await stripe.charges.create(order);  // ❌ Deprecated API since Stripe v3
-  } catch (e) {
-    // TODO: handle this later  // ❌ Payment failures silently swallowed
-  }
-}
-
-function getDashboardStats(): DashboardStats {
-  return { users: 1247, revenue: 84350 };  // ❌ Hardcoded. This is fake data.
-}
-```
-
-This code **compiles**. It **passes CI**. It gets **deployed**.
-
-Then your customers discover the payments don't work.
-
----
-
-## The Solution
-
-**VibeCheck catches what linters can't.**
-
-```bash
-$ vibecheck ship
-
-🔍 Running pre-ship checks...
-
-⛔ FAKE FEATURE: src/api/users.ts:4
-   Endpoint /api/v2/users/{id} does not exist in your routes
-   └─ AI generated a plausible URL that will 404 at runtime
-
-⚠️  DEPRECATED API: src/payments.ts:8
-   stripe.charges.create() was deprecated in Stripe SDK v3
-   └─ Use stripe.paymentIntents.create() instead
-
-⛔ SILENT FAILURE: src/payments.ts:11
-   Empty catch block in payment flow
-   └─ chargeCustomer() errors will be swallowed silently
-
-⚠️  MOCK DATA: src/dashboard.ts:16
-   getDashboardStats() returns hardcoded values
-   └─ This will never reflect actual database data
-
-Ship Status: BLOCKED (4 issues found)
-```
-
-**Before it ships. Not after the Slack message at 3am.**
-
----
-
-## Quick Start
-
-```bash
-# Install globally
-npm install -g vibecheck-ai
-
-# Or run with npx (no install)
-npx vibecheck-ai
-
-# Initialize in your project
-cd your-project
-vibecheck link
-
-# Run pre-ship checks
-vibecheck ship
-```
-
-That's it. Issues appear immediately.
-
----
-
-## Features
-
-### 🚀 Ship Command — Pre-Deployment Security Gate
-
-Run 10+ checks before every deployment:
-
-```bash
-vibecheck ship              # Full pre-deployment analysis
-vibecheck ship --fix        # Auto-fix issues automatically
-vibecheck ship --force      # Ship anyway (not recommended)
-```
-
-**Checks include:**
-- Truthpack validation (routes, env vars, auth)
-- Hallucination detection (fake APIs, deprecated methods)
-- Secret scanning (API keys, tokens, credentials)
-- Silent failure detection (empty catches, swallowed errors)
-- Mock data finder (hardcoded values in production code)
-- Drift detection (changes from verified baseline)
-- 80+ security patterns
-
----
-
-### 🎯 Reality Mode — Actually Run Your Code
-
-Static analysis can't catch everything. Reality Mode uses Playwright to **actually execute your code**:
-
-```bash
-vibecheck reality run       # Run scenarios and generate proof
-vibecheck reality report    # View detailed proof report
-```
-
-- Spins up real test environments
-- Makes actual API calls
-- Validates responses match expectations
-- Catches lies that static analysis misses
-- Generates cryptographic proof bundles
-
----
-
-### 🛡️ Truthpack — Your Project's Source of Truth
-
-VibeCheck extracts verified facts about your codebase:
-
-```bash
-vibecheck scan              # Generate truthpack
-vibecheck audit --mode validate file.ts  # Validate files vs truthpack
-```
-
-**What gets extracted:**
-- **Routes** — API endpoints with methods, paths, handlers
-- **Environment** — Required env vars with types and defaults
-- **Auth** — Authentication strategies and protected routes
-- **Database** — Schema definitions and relationships
-- **Dependencies** — Package versions and compatibility
-
-AI assistants reference this to stay grounded in reality.
-
----
-
-### 🔒 Code Firewall — Lock Critical Files
-
-Protect sensitive files from AI modifications:
-
-```javascript
-// vibecheck.config.mjs
-export default {
-  firewall: {
-    locked: ['.env*', 'src/core/**', 'credentials.json'],
-    warn: ['package.json', 'tsconfig.json'],
-  }
-};
-```
-
----
-
-### 📊 Enterprise Reports
-
-Generate beautiful HTML/PDF reports for compliance:
-
-```bash
-vibecheck report            # Generate HTML report
-vibecheck report --pdf      # Generate PDF report
-vibecheck report --json     # Machine-readable output
-```
-
----
-
-## All Commands
-
-| Command | Aliases | Description |
-|---------|---------|-------------|
-| `vibecheck link` | init, setup, configure | **Link project** — Initialize VibeCheck and create config |
-| `vibecheck audit` | check, validate | **Full audit** — Validate files vs truthpack + hallucination/drift detection |
-| `vibecheck scan` | — | Scan codebase and generate truthpack (.vibecheck/truthpack) |
-| `vibecheck ship` | — | **Pre-deployment security checks** |
-| `vibecheck quickstart` | start | Interactive setup wizard for new users |
-| `vibecheck certify` | verify | Full certification: Reality + Chaos → Badge |
-| `vibecheck status` | — | Show active modules and last run info |
-| `vibecheck reality run` | — | Run Reality Mode with proof generation |
-| `vibecheck missions` | — | View fix missions grouped by category |
-| `vibecheck fix` | — | Apply auto-fixes for detected issues |
-| `vibecheck forge` | — | Generate AI context rules for Cursor/Windsurf |
-| `vibecheck trace` | — | Trace data flow from sources to sinks |
-| `vibecheck github` | — | Set up GitHub Action for CI gate |
-| `vibecheck report` | — | Generate enterprise-grade reports |
-| `vibecheck badge` | — | Generate Ship Score badges for README |
-| `vibecheck config` | — | View or edit configuration |
-| `vibecheck doctor` | — | Validate system dependencies |
-| `vibecheck menu` | — | Open interactive menu |
-
----
-
-## Security Scanner
-
-Industry-leading detection with **80+ patterns**:
-
-<details>
-<summary><strong>🔑 Credentials (click to expand)</strong></summary>
-
-- AWS Access Keys & Secrets
-- GitHub Tokens (PAT, OAuth, App)
-- Stripe API Keys (Live & Test)
-- OpenAI & Anthropic API Keys
-- Google Cloud Service Accounts
-- Azure Connection Strings
-- npm Tokens & Registry Auth
-- Database Passwords & URIs
-- JWT Secrets & Private Keys
-- SendGrid, Twilio, Mailgun Keys
-
-</details>
-
-<details>
-<summary><strong>🛡️ Security Vulnerabilities</strong></summary>
-
-- SQL Injection patterns
-- Cross-Site Scripting (XSS)
-- Command Injection
-- Server-Side Request Forgery (SSRF)
-- Path Traversal attacks
-- Open Redirect vulnerabilities
-- CORS misconfigurations
-- Missing Content Security Policy
-- Insecure cookie settings
-- Timing attack vectors
-
-</details>
-
-<details>
-<summary><strong>🤖 AI Hallucinations</strong></summary>
-
-- Non-existent npm packages
-- Deprecated React 18 patterns
-- Phantom API endpoints
-- Fake environment variables
-- Made-up method names
-- Placeholder URLs (localhost, example.com)
-- Outdated library versions
-- Incorrect TypeScript types
-
-</details>
-
-<details>
-<summary><strong>⚛️ Framework-Specific</strong></summary>
-
-- Next.js server action issues
-- React hooks violations
-- Express without Helmet
-- Missing auth middleware
-- Unsafe trust-proxy settings
-- setState in render patterns
-- Missing error boundaries
-
-</details>
-
----
-
-## CI/CD Integration
-
-### GitHub Actions
-
-```yaml
-name: VibeCheck
-on: [push, pull_request]
-
-jobs:
-  vibecheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-      - run: npm install -g vibecheck-ai
-      - run: vibecheck ship --ci
-        env:
-          VIBECHECK_API_KEY: ${{ secrets.VIBECHECK_API_KEY }}
-```
-
-### Pre-commit Hook
-
-```json
-{
-  "husky": {
-    "hooks": {
-      "pre-commit": "vibecheck audit"
-    }
-  }
-}
-```
-
-### GitLab CI
-
-```yaml
-vibecheck:
-  stage: test
-  script:
-    - npm install -g vibecheck-ai
-    - vibecheck ship --ci
-```
-
----
-
-## IDE Integration
-
-### Cursor (MCP Server)
-
-```bash
-npm install -g @vibecheckai/mcp-server
-```
-
-```json
-// .cursor/mcp.json
-{
-  "mcpServers": {
-    "vibecheck": {
-      "command": "vibecheck-mcp"
-    }
-  }
-}
-```
-
-### VS Code Extension
-
-Install the [VibeCheck Extension](https://marketplace.visualstudio.com/items?itemName=vibecheckai.vibecheck) for:
-- Inline hallucination detection
-- Truthpack browser
-- Real-time firewall
-- One-click auto-fix
-
----
-
-## Configuration
-
-Create `vibecheck.config.mjs` in your project root:
-
-```javascript
-/** @type {import('vibecheck-ai').VibeCheckConfig} */
-export default {
-  // Project metadata
-  project: {
-    name: 'my-app',
-    type: 'nextjs', // 'nextjs' | 'react' | 'express' | 'fastify' | 'generic'
-  },
-
-  // What to analyze
-  include: ['src/**/*.ts', 'src/**/*.tsx'],
-  exclude: ['**/*.test.ts', '**/node_modules/**'],
-
-  // Analysis settings
-  analysis: {
-    strictness: 'standard', // 'relaxed' | 'standard' | 'paranoid'
-    checkDependencies: true,
-    checkEnvVars: true,
-    checkRoutes: true,
-  },
-
-  // File protection
-  firewall: {
-    locked: ['.env*', 'src/core/**'],
-    warn: ['package.json'],
-  },
-
-  // Reality Mode
-  reality: {
-    scenarios: ['auth', 'api', 'forms'],
-    timeout: 30000,
-  },
-};
-```
-
----
-
-## Pricing
-
-| Feature | Free | Pro ($19/mo) |
-|---------|------|--------------|
-| CLI Commands | ✅ All | ✅ All |
-| Local Scans | ✅ Unlimited | ✅ Unlimited |
-| Security Patterns | ✅ 80+ | ✅ 80+ |
-| Projects | 3 | Unlimited |
-| Scan History | 7 days | 90 days |
-| Cloud Dashboard | ❌ | ✅ |
-| Team Collaboration | ❌ | ✅ |
-| API Access | ❌ | ✅ |
-| Verified Badges | ❌ | ✅ |
-| Priority Support | ❌ | ✅ |
-
-**All CLI commands are free forever.** Pro unlocks cloud features and team collaboration.
-
----
-
-## Why VibeCheck?
-
-| Without VibeCheck | With VibeCheck |
-|-------------------|----------------|
-| AI invents fake APIs | References verified truthpack |
-| Runtime 404 errors | Compile-time detection |
-| Silent payment failures | Catches empty catch blocks |
-| Mock data in production | Detects hardcoded values |
-| Manual AI output review | Automated validation |
-| "Works on my machine" | Consistent team truth |
-
----
-
-## Requirements
-
-- **Node.js** 18.0.0 or higher
-- **OS**: Windows, macOS, Linux
-
-**Optional for Reality Mode:**
-- Playwright (auto-installed on first use)
-
----
-
-## Community
-
-- 💬 **Discord** — [Join our community](https://vibecheckai.dev/discord)
-- 🐦 **Twitter** — [@vibecheckai](https://twitter.com/vibecheckai)
-- 📦 **GitHub** — [vibecheckai/vibecheck](https://github.com/vibecheckai/vibecheck)
-- 📖 **Docs** — [vibecheckai.dev/docs](https://vibecheckai.dev/docs)
-
----
-
-## Contributing
-
-We welcome contributions! See [CONTRIBUTING.md](https://github.com/vibecheckai/vibecheck/blob/main/CONTRIBUTING.md).
-
-```bash
-# Clone the repo
-git clone https://github.com/vibecheckai/vibecheck.git
-
-# Install dependencies
-pnpm install
-
-# Run locally
-pnpm dev
-```
-
----
-
-## License
-
-MIT © [VibeCheck AI](https://vibecheckai.dev)
-
----
-
-<p align="center">
-  <strong>Your AI writes the code. VibeCheck makes sure it works.</strong>
-</p>
-
-<p align="center">
-  <a href="https://vibecheckai.dev">
-    <img src="https://img.shields.io/badge/Get%20Started-E040FB?style=for-the-badge&logoColor=white" alt="Get Started" />
-  </a>
-</p>