vibecheck-ai 2.0.1 → 5.0.0

package/bin/runners/lib/agent-firewall/interceptor/base.js

@@ -0,0 +1,308 @@
+/**
+ * Base Interceptor
+ * 
+ * Common logic for all IDE interceptors.
+ */
+
+"use strict";
+
+const path = require("path");
+const fs = require("fs");
+const { extractClaims } = require("../claims/extractor");
+const { resolveEvidence } = require("../evidence/resolver");
+const { evaluatePolicy } = require("../policy/engine");
+const { buildChangePacket, buildMultiFileChangePacket } = require("../change-packet/builder");
+const { storePacket } = require("../change-packet/store");
+const { generateUnblockPlan } = require("../unblock/planner");
+const { loadPolicy } = require("../policy/loader");
+
+/**
+ * Intercept a file write attempt
+ * @param {object} params
+ * @param {string} params.projectRoot - Project root directory
+ * @param {string} params.agentId - Agent identifier
+ * @param {string} params.intent - Agent intent message
+ * @param {string} params.filePath - File path (relative to project root)
+ * @param {string} params.content - New file content
+ * @param {string} params.oldContent - Old file content (optional)
+ * @returns {object} Interception result
+ */
+async function interceptFileWrite({
+  projectRoot,
+  agentId,
+  intent,
+  filePath,
+  content,
+  oldContent = null
+}) {
+  // Load policy
+  const policy = loadPolicy(projectRoot);
+  
+  // Generate diff
+  const diff = generateDiff(oldContent, content);
+  
+  // Extract claims - write content to temp file if file doesn't exist
+  const fileAbs = path.join(projectRoot, filePath);
+  let tempFile = null;
+  
+  if (!fs.existsSync(fileAbs) && content) {
+    // Write content to temp file for extraction
+    const tempDir = path.join(projectRoot, ".vibecheck", "temp");
+    if (!fs.existsSync(tempDir)) {
+      fs.mkdirSync(tempDir, { recursive: true });
+    }
+    tempFile = path.join(tempDir, path.basename(filePath));
+    fs.writeFileSync(tempFile, content, "utf8");
+  }
+  
+  const fileToExtract = fs.existsSync(fileAbs) ? fileAbs : (tempFile || fileAbs);
+  const { claims } = extractClaims({
+    repoRoot: projectRoot,
+    changedFilesAbs: [fileToExtract]
+  });
+  
+  // Clean up temp file
+  if (tempFile && fs.existsSync(tempFile)) {
+    fs.unlinkSync(tempFile);
+  }
+  
+  // Resolve evidence
+  const evidence = resolveEvidence(projectRoot, claims);
+  
+  // Build file info
+  const files = [{
+    path: filePath,
+    linesChanged: calculateLinesChanged(diff),
+    domain: classifyFileDomain(filePath)
+  }];
+  
+  // Evaluate policy
+  const verdict = await evaluatePolicy({
+    policy,
+    claims,
+    evidence,
+    files,
+    intent
+  });
+  
+  // Generate unblock plan if blocked
+  let unblockPlan = null;
+  if (verdict.decision === "BLOCK") {
+    unblockPlan = generateUnblockPlan({
+      violations: verdict.violations,
+      claims,
+      projectRoot
+    });
+  }
+  
+  // Build change packet
+  const packet = buildChangePacket({
+    agentId,
+    intent,
+    diff,
+    filePath,
+    claims,
+    evidence,
+    verdict,
+    unblockPlan,
+    policy
+  });
+  
+  // Store packet if policy requires it
+  if (policy.output?.write_change_packets !== false) {
+    storePacket(projectRoot, packet);
+  }
+  
+  // Return interception result
+  // In observe mode, always allow but still report violations
+  const isObserveMode = policy.mode === "observe";
+  return {
+    allowed: isObserveMode || verdict.decision === "ALLOW",
+    verdict: isObserveMode && verdict.decision !== "ALLOW" ? "ALLOW" : verdict.decision,
+    violations: verdict.violations,
+    unblockPlan,
+    packetId: packet.id,
+    message: isObserveMode && verdict.violations?.length > 0 
+      ? `[OBSERVE MODE] Would have blocked: ${verdict.message}` 
+      : verdict.message
+  };
+}
+
+/**
+ * Intercept multiple file writes
+ */
+async function interceptMultiFileWrite({
+  projectRoot,
+  agentId,
+  intent,
+  changes
+}) {
+  // Load policy
+  const policy = loadPolicy(projectRoot);
+  
+  // Extract claims from all files
+  const allClaims = [];
+  const allFiles = [];
+  
+  for (const change of changes) {
+    const fileAbs = path.join(projectRoot, change.filePath);
+    const { claims } = extractClaims({
+      repoRoot: projectRoot,
+      changedFilesAbs: [fileAbs]
+    });
+    
+    allClaims.push(...claims.map(c => ({ ...c, file: change.filePath })));
+    allFiles.push({
+      path: change.filePath,
+      linesChanged: calculateLinesChanged(change.diff),
+      domain: classifyFileDomain(change.filePath)
+    });
+  }
+  
+  // Resolve evidence
+  const evidence = resolveEvidence(projectRoot, allClaims);
+  
+  // Evaluate policy
+  const verdict = await evaluatePolicy({
+    policy,
+    claims: allClaims,
+    evidence,
+    files: allFiles,
+    intent
+  });
+  
+  // Generate unblock plan if blocked
+  let unblockPlan = null;
+  if (verdict.decision === "BLOCK") {
+    unblockPlan = generateUnblockPlan({
+      violations: verdict.violations,
+      claims: allClaims,
+      projectRoot
+    });
+  }
+  
+  // Build change packet
+  const packet = buildMultiFileChangePacket({
+    agentId,
+    intent,
+    changes: changes.map(c => ({
+      filePath: c.filePath,
+      diff: c.diff,
+      claims: allClaims.filter(cl => cl.file === c.filePath)
+    })),
+    evidence,
+    verdict,
+    unblockPlan,
+    policy
+  });
+  
+  // Store packet if policy requires it
+  if (policy.output?.write_change_packets !== false) {
+    storePacket(projectRoot, packet);
+  }
+  
+  // Return interception result
+  return {
+    allowed: verdict.decision === "ALLOW",
+    verdict: verdict.decision,
+    violations: verdict.violations,
+    unblockPlan,
+    packetId: packet.id,
+    message: verdict.message
+  };
+}
+
+/**
+ * Generate unified diff
+ */
+function generateDiff(oldContent, newContent) {
+  if (!oldContent) {
+    return {
+      before: "",
+      after: newContent,
+      unified: generateUnifiedDiff("", newContent)
+    };
+  }
+  
+  return {
+    before: oldContent,
+    after: newContent,
+    unified: generateUnifiedDiff(oldContent, newContent)
+  };
+}
+
+/**
+ * Generate unified diff format
+ */
+function generateUnifiedDiff(oldContent, newContent) {
+  const oldLines = oldContent.split(/\r?\n/);
+  const newLines = newContent.split(/\r?\n/);
+  
+  const diff = [];
+  let i = 0, j = 0;
+  
+  while (i < oldLines.length || j < newLines.length) {
+    if (i >= oldLines.length) {
+      diff.push(`+${newLines[j]}`);
+      j++;
+    } else if (j >= newLines.length) {
+      diff.push(`-${oldLines[i]}`);
+      i++;
+    } else if (oldLines[i] === newLines[j]) {
+      diff.push(` ${oldLines[i]}`);
+      i++;
+      j++;
+    } else {
+      // Try to find matching line ahead
+      let found = false;
+      for (let k = j + 1; k < Math.min(j + 10, newLines.length); k++) {
+        if (oldLines[i] === newLines[k]) {
+          // Add new lines
+          for (let l = j; l < k; l++) {
+            diff.push(`+${newLines[l]}`);
+          }
+          j = k;
+          found = true;
+          break;
+        }
+      }
+      
+      if (!found) {
+        diff.push(`-${oldLines[i]}`);
+        diff.push(`+${newLines[j]}`);
+        i++;
+        j++;
+      }
+    }
+  }
+  
+  return diff.join("\n");
+}
+
+/**
+ * Calculate lines changed from diff
+ */
+function calculateLinesChanged(diff) {
+  if (!diff || !diff.unified) return 0;
+  return diff.unified.split('\n').filter(line => 
+    line.startsWith('+') || line.startsWith('-')
+  ).length;
+}
+
+/**
+ * Classify file domain
+ */
+function classifyFileDomain(filePath) {
+  const s = filePath.toLowerCase();
+  if (s.includes("auth")) return "auth";
+  if (s.includes("stripe") || s.includes("payment")) return "payments";
+  if (s.includes("routes") || s.includes("router") || s.includes("api")) return "routes";
+  if (s.includes("schema") || s.includes("contract") || s.includes("openapi")) return "contracts";
+  if (s.includes("ui") || s.includes("components") || s.includes("pages")) return "ui";
+  return "general";
+}
+
+module.exports = {
+  interceptFileWrite,
+  interceptMultiFileWrite
+};

package/bin/runners/lib/agent-firewall/interceptor/cursor.js

@@ -0,0 +1,35 @@
+/**
+ * Cursor IDE Interceptor
+ * 
+ * Cursor-specific integration for agent firewall.
+ * Hooks into Cursor's file write events.
+ */
+
+"use strict";
+
+const { interceptFileWrite } = require("./base");
+
+/**
+ * Intercept file write in Cursor
+ * This would be called by Cursor's extension/plugin system
+ */
+async function interceptCursorWrite({
+  projectRoot,
+  filePath,
+  content,
+  oldContent,
+  agentId = "cursor"
+}) {
+  return await interceptFileWrite({
+    projectRoot,
+    agentId,
+    intent: "Cursor AI edit",
+    filePath,
+    content,
+    oldContent
+  });
+}
+
+module.exports = {
+  interceptCursorWrite
+};

package/bin/runners/lib/agent-firewall/interceptor/vscode.js

@@ -0,0 +1,35 @@
+/**
+ * VS Code LSP Interceptor
+ * 
+ * VS Code LSP integration for agent firewall.
+ * Generic LSP hook for file writes.
+ */
+
+"use strict";
+
+const { interceptFileWrite } = require("./base");
+
+/**
+ * Intercept file write via LSP
+ * This would be called by VS Code's LSP server
+ */
+async function interceptVSCodeWrite({
+  projectRoot,
+  filePath,
+  content,
+  oldContent,
+  agentId = "vscode"
+}) {
+  return await interceptFileWrite({
+    projectRoot,
+    agentId,
+    intent: "VS Code AI edit",
+    filePath,
+    content,
+    oldContent
+  });
+}
+
+module.exports = {
+  interceptVSCodeWrite
+};

package/bin/runners/lib/agent-firewall/interceptor/windsurf.js

@@ -0,0 +1,34 @@
+/**
+ * Windsurf IDE Interceptor
+ * 
+ * Windsurf-specific integration for agent firewall.
+ */
+
+"use strict";
+
+const { interceptFileWrite } = require("./base");
+
+/**
+ * Intercept file write in Windsurf
+ * This would be called by Windsurf's extension/plugin system
+ */
+async function interceptWindsurfWrite({
+  projectRoot,
+  filePath,
+  content,
+  oldContent,
+  agentId = "windsurf"
+}) {
+  return await interceptFileWrite({
+    projectRoot,
+    agentId,
+    intent: "Windsurf AI edit",
+    filePath,
+    content,
+    oldContent
+  });
+}
+
+module.exports = {
+  interceptWindsurfWrite
+};