vibecheck-ai 2.0.1 → 5.0.0

package/bin/runners/lib/agent-firewall/policy/engine.js

@@ -0,0 +1,103 @@
+/**
+ * Policy Engine
+ * 
+ * Main policy engine that evaluates all rules deterministically.
+ * Uses AI to reduce false positives when enabled.
+ */
+
+"use strict";
+
+const ghostRoute = require("./rules/ghost-route");
+const ghostEnv = require("./rules/ghost-env");
+const authDrift = require("./rules/auth-drift");
+const contractDrift = require("./rules/contract-drift");
+const fakeSuccess = require("./rules/fake-success");
+const scope = require("./rules/scope");
+const unsafeSideEffect = require("./rules/unsafe-side-effect");
+const { generateVerdict } = require("./verdict");
+const { analyzeFalsePositive } = require("../ai/false-positive-analyzer");
+
+/**
+ * Evaluate policy against change packet
+ * @param {object} params
+ * @param {object} params.policy - Policy configuration
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {array} params.files - Changed files
+ * @param {string} params.intent - Agent intent message
+ * @returns {Promise<object>} Verdict object
+ */
+async function evaluatePolicy({ policy, claims, evidence, files, intent }) {
+  const violations = [];
+  
+  // Evaluate all rules
+  const ruleEvaluators = [
+    ghostRoute,
+    ghostEnv,
+    authDrift,
+    contractDrift,
+    fakeSuccess,
+    unsafeSideEffect
+  ];
+  
+  // Evaluate claim-based rules
+  for (const evaluator of ruleEvaluators) {
+    try {
+      const violation = evaluator.evaluate({ claims, evidence, policy });
+      if (violation) {
+        // Use AI to check if this is a false positive
+        const claim = claims.find(c => 
+          c.type === violation.claim?.type && 
+          c.value === violation.claim?.value
+        );
+        
+        if (claim && policy.rules?.ai_false_positive_detection?.enabled) {
+          try {
+            const aiAnalysis = await analyzeFalsePositive({
+              violation,
+              claim,
+              filePath: claim.file || violation.claim?.file || "unknown",
+              projectRoot: process.cwd(),
+              policy
+            });
+            
+            // If AI determines it's a false positive with high confidence, skip it
+            if (aiAnalysis.isFalsePositive && aiAnalysis.confidence >= 0.8) {
+              // Log but don't add to violations
+              if (policy.rules?.ai_false_positive_detection?.logSkipped) {
+                console.log(`[AI] Skipping false positive: ${violation.message} (confidence: ${aiAnalysis.confidence}, reason: ${aiAnalysis.reason})`);
+              }
+              continue;
+            }
+          } catch (aiError) {
+            // If AI analysis fails, proceed with the violation
+            console.warn(`[AI] False positive analysis failed: ${aiError.message}`);
+          }
+        }
+        
+        violations.push(violation);
+      }
+    } catch (error) {
+      console.warn(`Rule evaluation error: ${error.message}`);
+    }
+  }
+  
+  // Evaluate scope rule (file-based)
+  try {
+    const violation = scope.evaluate({ files, intent, policy });
+    if (violation) {
+      violations.push(violation);
+    }
+  } catch (error) {
+    console.warn(`Scope rule evaluation error: ${error.message}`);
+  }
+  
+  // Generate final verdict
+  const verdict = generateVerdict(violations);
+  
+  return verdict;
+}
+
+module.exports = {
+  evaluatePolicy
+};

package/bin/runners/lib/agent-firewall/policy/loader.js

@@ -0,0 +1,451 @@
+/**
+ * Policy Loader
+ * 
+ * Loads and validates agent firewall policy from:
+ * - .vibecheck/policy.json (JSON policy)
+ * - .vibecheck/rules.yaml (YAML rule DSL)
+ * - .vibecheckrc (legacy)
+ * 
+ * Falls back to default policy if not found.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const Ajv = require("ajv").default || require("ajv");
+
+// Try to load YAML parser
+let yaml = null;
+try {
+  yaml = require("js-yaml");
+} catch {
+  // js-yaml not available, YAML support disabled
+}
+
+// Load schema
+const schemaPath = path.join(__dirname, "schema.json");
+const schema = JSON.parse(fs.readFileSync(schemaPath, "utf8"));
+
+// Load default policy
+const defaultPolicyPath = path.join(__dirname, "default-policy.json");
+const defaultPolicy = JSON.parse(fs.readFileSync(defaultPolicyPath, "utf8"));
+
+/**
+ * Load YAML rules file
+ * @param {string} rulesPath - Path to rules.yaml
+ * @returns {Array} Parsed rules array
+ */
+function loadYamlRules(rulesPath) {
+  if (!yaml) {
+    console.warn("js-yaml not installed, YAML rules not loaded");
+    return [];
+  }
+  
+  try {
+    const content = fs.readFileSync(rulesPath, "utf8");
+    const parsed = yaml.load(content);
+    
+    if (!parsed || !parsed.rules) {
+      return [];
+    }
+    
+    return normalizeYamlRules(parsed.rules);
+  } catch (error) {
+    console.warn(`Failed to load YAML rules: ${error.message}`);
+    return [];
+  }
+}
+
+/**
+ * Normalize YAML rules to policy format
+ * @param {Array} rules - Raw YAML rules
+ * @returns {Array} Normalized rules
+ */
+function normalizeYamlRules(rules) {
+  return rules.map(rule => {
+    // Map YAML DSL actions to policy severity
+    const severityMap = {
+      block: "block",
+      warn: "warn",
+      allow: "allow",
+      require_confirmation: "warn",
+    };
+    
+    return {
+      id: rule.id,
+      description: rule.description || "",
+      severity: severityMap[rule.action] || "warn",
+      enabled: rule.enabled !== false,
+      match: rule.match || {},
+      action: rule.action || "warn",
+      message: rule.message || rule.description || "",
+      // Custom rule evaluator info
+      custom: rule.custom || null,
+      block_if_domain: rule.block_if_domain || [],
+    };
+  });
+}
+
+/**
+ * Merge YAML rules into policy
+ * @param {object} policy - Policy object
+ * @param {Array} yamlRules - Normalized YAML rules
+ * @returns {object} Policy with merged rules
+ */
+function mergeYamlRulesIntoPolicy(policy, yamlRules) {
+  if (!yamlRules || yamlRules.length === 0) {
+    return policy;
+  }
+  
+  const merged = { ...policy };
+  merged.rules = merged.rules || {};
+  merged.customRules = merged.customRules || [];
+  
+  for (const rule of yamlRules) {
+    // Add to custom rules array
+    merged.customRules.push(rule);
+    
+    // Also add to rules object for backward compatibility
+    if (rule.id) {
+      merged.rules[rule.id] = {
+        severity: rule.severity,
+        enabled: rule.enabled,
+        block_if_domain: rule.block_if_domain,
+      };
+    }
+  }
+  
+  return merged;
+}
+
+/**
+ * Load policy from project root
+ * @param {string} projectRoot - Project root directory
+ * @param {object} overrides - Optional policy overrides
+ * @returns {object} Loaded and validated policy
+ */
+function loadPolicy(projectRoot, overrides = {}) {
+  const policyPath = path.join(projectRoot, ".vibecheck", "policy.json");
+  const yamlRulesPath = path.join(projectRoot, ".vibecheck", "rules.yaml");
+  const legacyRcPath = path.join(projectRoot, ".vibecheckrc");
+  
+  let policy;
+  
+  // Try to load project policy (JSON)
+  if (fs.existsSync(policyPath)) {
+    try {
+      policy = JSON.parse(fs.readFileSync(policyPath, "utf8"));
+    } catch (error) {
+      throw new Error(`Failed to parse policy file: ${error.message}`);
+    }
+  } else if (fs.existsSync(legacyRcPath)) {
+    // Try legacy .vibecheckrc
+    try {
+      policy = JSON.parse(fs.readFileSync(legacyRcPath, "utf8"));
+    } catch (error) {
+      // Might be YAML format
+      if (yaml) {
+        try {
+          policy = yaml.load(fs.readFileSync(legacyRcPath, "utf8"));
+        } catch {
+          throw new Error(`Failed to parse .vibecheckrc: ${error.message}`);
+        }
+      } else {
+        throw new Error(`Failed to parse .vibecheckrc: ${error.message}`);
+      }
+    }
+  } else {
+    // Use default policy
+    policy = JSON.parse(JSON.stringify(defaultPolicy));
+  }
+  
+  // Load and merge YAML rules if present
+  if (fs.existsSync(yamlRulesPath)) {
+    const yamlRules = loadYamlRules(yamlRulesPath);
+    policy = mergeYamlRulesIntoPolicy(policy, yamlRules);
+  }
+  
+  // Apply overrides (deep merge)
+  if (Object.keys(overrides).length > 0) {
+    policy = deepMerge(policy, overrides);
+  }
+  
+  // Validate against schema
+  const ajv = new Ajv({ allErrors: true, strict: false });
+  const validate = ajv.compile(schema);
+  const valid = validate(policy);
+  
+  if (!valid) {
+    const errors = validate.errors.map(e => 
+      `${e.instancePath || 'root'} ${e.message}`
+    ).join(', ');
+    throw new Error(`Policy validation failed: ${errors}`);
+  }
+  
+  return policy;
+}
+
+/**
+ * Deep merge two objects
+ * @param {object} target - Target object
+ * @param {object} source - Source object to merge
+ * @returns {object} Merged object
+ */
+function deepMerge(target, source) {
+  const output = Object.assign({}, target);
+  
+  if (isObject(target) && isObject(source)) {
+    Object.keys(source).forEach(key => {
+      if (isObject(source[key])) {
+        if (!(key in target)) {
+          Object.assign(output, { [key]: source[key] });
+        } else {
+          output[key] = deepMerge(target[key], source[key]);
+        }
+      } else {
+        Object.assign(output, { [key]: source[key] });
+      }
+    });
+  }
+  
+  return output;
+}
+
+/**
+ * Check if value is a plain object
+ * @param {*} item - Value to check
+ * @returns {boolean}
+ */
+function isObject(item) {
+  return item && typeof item === 'object' && !Array.isArray(item);
+}
+
+/**
+ * Get default policy
+ * @returns {object} Default policy
+ */
+function getDefaultPolicy() {
+  return JSON.parse(JSON.stringify(defaultPolicy));
+}
+
+/**
+ * Save policy to project root
+ * @param {string} projectRoot - Project root directory
+ * @param {object} policy - Policy to save
+ */
+function savePolicy(projectRoot, policy) {
+  const vibecheckDir = path.join(projectRoot, ".vibecheck");
+  const policyPath = path.join(vibecheckDir, "policy.json");
+  
+  // Ensure .vibecheck directory exists
+  if (!fs.existsSync(vibecheckDir)) {
+    fs.mkdirSync(vibecheckDir, { recursive: true });
+  }
+  
+  // Validate before saving
+  const ajv = new Ajv({ allErrors: true, strict: false });
+  const validate = ajv.compile(schema);
+  const valid = validate(policy);
+  
+  if (!valid) {
+    const errors = validate.errors.map(e => 
+      `${e.instancePath || 'root'} ${e.message}`
+    ).join(', ');
+    throw new Error(`Policy validation failed: ${errors}`);
+  }
+  
+  fs.writeFileSync(policyPath, JSON.stringify(policy, null, 2));
+}
+
+/**
+ * Save YAML rules to project root
+ * @param {string} projectRoot - Project root directory
+ * @param {Array} rules - Rules array
+ */
+function saveYamlRules(projectRoot, rules) {
+  if (!yaml) {
+    throw new Error("js-yaml not installed, cannot save YAML rules");
+  }
+  
+  const vibecheckDir = path.join(projectRoot, ".vibecheck");
+  const rulesPath = path.join(vibecheckDir, "rules.yaml");
+  
+  // Ensure .vibecheck directory exists
+  if (!fs.existsSync(vibecheckDir)) {
+    fs.mkdirSync(vibecheckDir, { recursive: true });
+  }
+  
+  const content = yaml.dump({ rules }, {
+    lineWidth: 120,
+    quotingType: '"',
+    forceQuotes: false,
+  });
+  
+  fs.writeFileSync(rulesPath, content);
+}
+
+/**
+ * Create default YAML rules file
+ * @param {string} projectRoot - Project root directory
+ */
+function createDefaultYamlRules(projectRoot) {
+  const defaultRules = [
+    {
+      id: "no-phantom-env",
+      description: "Block undeclared environment variables",
+      match: { type: "env", exists: false },
+      action: "block",
+      message: "Env vars must be declared before use",
+    },
+    {
+      id: "no-ghost-routes",
+      description: "Block routes that reference unregistered paths",
+      match: { type: "route", registered: false },
+      action: "block",
+      message: "Routes must be registered in the router",
+    },
+    {
+      id: "core-folder-protection",
+      description: "Require confirmation for changes to core code",
+      match: { path: "^src/core/" },
+      action: "require_confirmation",
+      message: "Changes to core require explicit confirmation",
+    },
+    {
+      id: "no-silent-deletes",
+      description: "Require confirmation for file deletions",
+      match: { operation: "delete" },
+      action: "require_confirmation",
+      message: "File deletions require explicit confirmation",
+    },
+    {
+      id: "auth-changes-high-risk",
+      description: "Flag authentication changes as high risk",
+      match: { tags: ["auth", "security"] },
+      action: "warn",
+      block_if_domain: ["payments"],
+      message: "Auth changes require careful review",
+    },
+    {
+      id: "max-files-per-change",
+      description: "Limit number of files in a single change",
+      match: { files_count: { gt: 10 } },
+      action: "require_confirmation",
+      message: "Large changes (>10 files) require confirmation",
+    },
+  ];
+  
+  saveYamlRules(projectRoot, defaultRules);
+}
+
+/**
+ * Get custom rules from policy
+ * @param {object} policy - Policy object
+ * @returns {Array} Custom rules
+ */
+function getCustomRules(policy) {
+  return policy.customRules || [];
+}
+
+/**
+ * Evaluate a custom YAML rule against a change
+ * @param {object} rule - Rule definition
+ * @param {object} context - Change context
+ * @returns {object|null} Violation if rule triggered, null otherwise
+ */
+function evaluateCustomRule(rule, context) {
+  if (!rule.enabled) return null;
+  
+  const match = rule.match || {};
+  let triggered = false;
+  
+  // Match by type
+  if (match.type) {
+    const claims = context.claims || [];
+    const typeClaims = claims.filter(c => c.type === match.type);
+    
+    if (typeClaims.length > 0) {
+      if (match.exists === false) {
+        // Check if any claim doesn't exist
+        triggered = typeClaims.some(c => !c.exists);
+      } else if (match.registered === false) {
+        triggered = typeClaims.some(c => !c.registered);
+      } else {
+        triggered = true;
+      }
+    }
+  }
+  
+  // Match by path pattern
+  if (match.path) {
+    const files = context.files || [];
+    const regex = new RegExp(match.path);
+    triggered = triggered || files.some(f => regex.test(f.path || f));
+  }
+  
+  // Match by operation
+  if (match.operation) {
+    const operations = context.operations || [];
+    triggered = triggered || operations.some(op => op.type === match.operation);
+  }
+  
+  // Match by file count
+  if (match.files_count) {
+    const fileCount = (context.files || []).length;
+    if (match.files_count.gt && fileCount > match.files_count.gt) {
+      triggered = true;
+    }
+    if (match.files_count.lt && fileCount < match.files_count.lt) {
+      triggered = true;
+    }
+  }
+  
+  // Match by tags
+  if (match.tags && Array.isArray(match.tags)) {
+    const domains = context.domains || [];
+    triggered = triggered || match.tags.some(tag => domains.includes(tag));
+  }
+  
+  if (!triggered) return null;
+  
+  // Check block_if_domain upgrade
+  let severity = rule.severity || rule.action;
+  if (rule.block_if_domain && rule.block_if_domain.length > 0) {
+    const domains = context.domains || [];
+    if (rule.block_if_domain.some(d => domains.includes(d))) {
+      severity = "block";
+    }
+  }
+  
+  return {
+    rule: rule.id,
+    type: "custom_rule",
+    severity,
+    message: rule.message || rule.description || `Rule ${rule.id} triggered`,
+  };
+}
+
+/**
+ * Check if YAML support is available
+ * @returns {boolean} YAML support available
+ */
+function hasYamlSupport() {
+  return yaml !== null;
+}
+
+module.exports = {
+  loadPolicy,
+  getDefaultPolicy,
+  savePolicy,
+  loadYamlRules,
+  saveYamlRules,
+  createDefaultYamlRules,
+  getCustomRules,
+  evaluateCustomRule,
+  mergeYamlRulesIntoPolicy,
+  normalizeYamlRules,
+  hasYamlSupport,
+  schema,
+  defaultPolicy
+};

package/bin/runners/lib/agent-firewall/policy/rules/auth-drift.js

@@ -0,0 +1,50 @@
+/**
+ * Auth Drift Rule
+ * 
+ * Blocks if auth restriction claimed but not enforced.
+ */
+
+"use strict";
+
+const { CLAIM_TYPES } = require("../../claims/claim-types");
+
+/**
+ * Evaluate auth drift rule
+ * @param {object} params
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {object} params.policy - Policy configuration
+ * @returns {object|null} Violation or null
+ */
+function evaluate({ claims, evidence, policy }) {
+  const ruleConfig = policy.rules?.auth_drift;
+  
+  if (!ruleConfig || !ruleConfig.enabled) {
+    return null;
+  }
+  
+  // Find auth claims with CONTRADICTS evidence
+  for (let i = 0; i < claims.length; i++) {
+    const claim = claims[i];
+    
+    if (claim.type === CLAIM_TYPES.AUTH) {
+      const ev = evidence.find(e => e.claimId === `claim_${i}`);
+      
+      if (ev && ev.result === "CONTRADICTS") {
+        return {
+          rule: "auth_drift",
+          severity: ruleConfig.severity || "block",
+          message: `Auth drift: ${claim.value} claims auth restriction but route is not protected`,
+          claimId: `claim_${i}`,
+          claim
+        };
+      }
+    }
+  }
+  
+  return null;
+}
+
+module.exports = {
+  evaluate
+};

package/bin/runners/lib/agent-firewall/policy/rules/contract-drift.js

@@ -0,0 +1,50 @@
+/**
+ * Contract Drift Rule
+ * 
+ * Blocks if API contract mismatch.
+ */
+
+"use strict";
+
+const { CLAIM_TYPES } = require("../../claims/claim-types");
+
+/**
+ * Evaluate contract drift rule
+ * @param {object} params
+ * @param {array} params.claims - Extracted claims
+ * @param {array} params.evidence - Evidence resolution results
+ * @param {object} params.policy - Policy configuration
+ * @returns {object|null} Violation or null
+ */
+function evaluate({ claims, evidence, policy }) {
+  const ruleConfig = policy.rules?.contract_drift;
+  
+  if (!ruleConfig || !ruleConfig.enabled) {
+    return null;
+  }
+  
+  // Find contract claims with CONTRADICTS evidence
+  for (let i = 0; i < claims.length; i++) {
+    const claim = claims[i];
+    
+    if (claim.type === CLAIM_TYPES.CONTRACT) {
+      const ev = evidence.find(e => e.claimId === `claim_${i}`);
+      
+      if (ev && ev.result === "CONTRADICTS") {
+        return {
+          rule: "contract_drift",
+          severity: ruleConfig.severity || "block",
+          message: `Contract drift: ${claim.value} API contract mismatch`,
+          claimId: `claim_${i}`,
+          claim
+        };
+      }
+    }
+  }
+  
+  return null;
+}
+
+module.exports = {
+  evaluate
+};