vibecheck-ai 2.0.2 → 5.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (456) hide show
  1. package/bin/.generated +25 -0
  2. package/bin/_deprecations.js +463 -0
  3. package/bin/_router.js +46 -0
  4. package/bin/cli-hygiene.js +241 -0
  5. package/bin/dev/run-v2-torture.js +30 -0
  6. package/bin/registry.js +656 -0
  7. package/bin/runners/CLI_REFACTOR_SUMMARY.md +229 -0
  8. package/bin/runners/ENHANCEMENT_GUIDE.md +121 -0
  9. package/bin/runners/REPORT_AUDIT.md +64 -0
  10. package/bin/runners/cli-utils.js +1070 -0
  11. package/bin/runners/context/ai-task-decomposer.js +337 -0
  12. package/bin/runners/context/analyzer.js +513 -0
  13. package/bin/runners/context/api-contracts.js +427 -0
  14. package/bin/runners/context/context-diff.js +342 -0
  15. package/bin/runners/context/context-pruner.js +291 -0
  16. package/bin/runners/context/dependency-graph.js +414 -0
  17. package/bin/runners/context/generators/claude.js +107 -0
  18. package/bin/runners/context/generators/codex.js +108 -0
  19. package/bin/runners/context/generators/copilot.js +119 -0
  20. package/bin/runners/context/generators/cursor-enhanced.js +2525 -0
  21. package/bin/runners/context/generators/cursor.js +514 -0
  22. package/bin/runners/context/generators/mcp.js +169 -0
  23. package/bin/runners/context/generators/windsurf.js +180 -0
  24. package/bin/runners/context/git-context.js +304 -0
  25. package/bin/runners/context/index.js +1110 -0
  26. package/bin/runners/context/insights.js +173 -0
  27. package/bin/runners/context/mcp-server/generate-rules.js +337 -0
  28. package/bin/runners/context/mcp-server/index.js +1176 -0
  29. package/bin/runners/context/mcp-server/package.json +24 -0
  30. package/bin/runners/context/memory.js +200 -0
  31. package/bin/runners/context/monorepo.js +215 -0
  32. package/bin/runners/context/multi-repo-federation.js +404 -0
  33. package/bin/runners/context/patterns.js +253 -0
  34. package/bin/runners/context/proof-context.js +1264 -0
  35. package/bin/runners/context/security-scanner.js +541 -0
  36. package/bin/runners/context/semantic-search.js +350 -0
  37. package/bin/runners/context/shared.js +264 -0
  38. package/bin/runners/context/team-conventions.js +336 -0
  39. package/bin/runners/lib/__tests__/entitlements-v2.test.js +295 -0
  40. package/bin/runners/lib/agent-firewall/ai/false-positive-analyzer.js +474 -0
  41. package/bin/runners/lib/agent-firewall/change-packet/builder.js +488 -0
  42. package/bin/runners/lib/agent-firewall/change-packet/schema.json +228 -0
  43. package/bin/runners/lib/agent-firewall/change-packet/store.js +200 -0
  44. package/bin/runners/lib/agent-firewall/claims/claim-types.js +21 -0
  45. package/bin/runners/lib/agent-firewall/claims/extractor.js +303 -0
  46. package/bin/runners/lib/agent-firewall/claims/patterns.js +24 -0
  47. package/bin/runners/lib/agent-firewall/critic/index.js +151 -0
  48. package/bin/runners/lib/agent-firewall/critic/judge.js +432 -0
  49. package/bin/runners/lib/agent-firewall/critic/prompts.js +305 -0
  50. package/bin/runners/lib/agent-firewall/enforcement/gateway.js +1059 -0
  51. package/bin/runners/lib/agent-firewall/enforcement/index.js +98 -0
  52. package/bin/runners/lib/agent-firewall/enforcement/mode.js +318 -0
  53. package/bin/runners/lib/agent-firewall/enforcement/orchestrator.js +484 -0
  54. package/bin/runners/lib/agent-firewall/enforcement/proof-artifact.js +418 -0
  55. package/bin/runners/lib/agent-firewall/enforcement/schemas/change-event.schema.json +173 -0
  56. package/bin/runners/lib/agent-firewall/enforcement/schemas/intent.schema.json +181 -0
  57. package/bin/runners/lib/agent-firewall/enforcement/schemas/verdict.schema.json +222 -0
  58. package/bin/runners/lib/agent-firewall/enforcement/verdict-v2.js +333 -0
  59. package/bin/runners/lib/agent-firewall/evidence/auth-evidence.js +88 -0
  60. package/bin/runners/lib/agent-firewall/evidence/contract-evidence.js +75 -0
  61. package/bin/runners/lib/agent-firewall/evidence/env-evidence.js +127 -0
  62. package/bin/runners/lib/agent-firewall/evidence/resolver.js +102 -0
  63. package/bin/runners/lib/agent-firewall/evidence/route-evidence.js +213 -0
  64. package/bin/runners/lib/agent-firewall/evidence/side-effect-evidence.js +145 -0
  65. package/bin/runners/lib/agent-firewall/fs-hook/daemon.js +19 -0
  66. package/bin/runners/lib/agent-firewall/fs-hook/installer.js +87 -0
  67. package/bin/runners/lib/agent-firewall/fs-hook/watcher.js +184 -0
  68. package/bin/runners/lib/agent-firewall/git-hook/pre-commit.js +163 -0
  69. package/bin/runners/lib/agent-firewall/ide-extension/cursor.js +107 -0
  70. package/bin/runners/lib/agent-firewall/ide-extension/vscode.js +68 -0
  71. package/bin/runners/lib/agent-firewall/ide-extension/windsurf.js +66 -0
  72. package/bin/runners/lib/agent-firewall/index.js +200 -0
  73. package/bin/runners/lib/agent-firewall/integration/index.js +20 -0
  74. package/bin/runners/lib/agent-firewall/integration/ship-gate.js +437 -0
  75. package/bin/runners/lib/agent-firewall/intent/alignment-engine.js +634 -0
  76. package/bin/runners/lib/agent-firewall/intent/auto-detect.js +426 -0
  77. package/bin/runners/lib/agent-firewall/intent/index.js +102 -0
  78. package/bin/runners/lib/agent-firewall/intent/schema.js +352 -0
  79. package/bin/runners/lib/agent-firewall/intent/store.js +283 -0
  80. package/bin/runners/lib/agent-firewall/interception/fs-interceptor.js +502 -0
  81. package/bin/runners/lib/agent-firewall/interception/index.js +23 -0
  82. package/bin/runners/lib/agent-firewall/interceptor/base.js +308 -0
  83. package/bin/runners/lib/agent-firewall/interceptor/cursor.js +35 -0
  84. package/bin/runners/lib/agent-firewall/interceptor/vscode.js +35 -0
  85. package/bin/runners/lib/agent-firewall/interceptor/windsurf.js +34 -0
  86. package/bin/runners/lib/agent-firewall/lawbook/distributor.js +465 -0
  87. package/bin/runners/lib/agent-firewall/lawbook/evaluator.js +604 -0
  88. package/bin/runners/lib/agent-firewall/lawbook/index.js +304 -0
  89. package/bin/runners/lib/agent-firewall/lawbook/registry.js +514 -0
  90. package/bin/runners/lib/agent-firewall/lawbook/schema.js +420 -0
  91. package/bin/runners/lib/agent-firewall/logger.js +141 -0
  92. package/bin/runners/lib/agent-firewall/policy/default-policy.json +90 -0
  93. package/bin/runners/lib/agent-firewall/policy/engine.js +103 -0
  94. package/bin/runners/lib/agent-firewall/policy/loader.js +451 -0
  95. package/bin/runners/lib/agent-firewall/policy/rules/auth-drift.js +50 -0
  96. package/bin/runners/lib/agent-firewall/policy/rules/contract-drift.js +50 -0
  97. package/bin/runners/lib/agent-firewall/policy/rules/fake-success.js +79 -0
  98. package/bin/runners/lib/agent-firewall/policy/rules/ghost-env.js +227 -0
  99. package/bin/runners/lib/agent-firewall/policy/rules/ghost-route.js +191 -0
  100. package/bin/runners/lib/agent-firewall/policy/rules/scope.js +93 -0
  101. package/bin/runners/lib/agent-firewall/policy/rules/unsafe-side-effect.js +57 -0
  102. package/bin/runners/lib/agent-firewall/policy/schema.json +183 -0
  103. package/bin/runners/lib/agent-firewall/policy/verdict.js +54 -0
  104. package/bin/runners/lib/agent-firewall/proposal/extractor.js +394 -0
  105. package/bin/runners/lib/agent-firewall/proposal/index.js +212 -0
  106. package/bin/runners/lib/agent-firewall/proposal/schema.js +251 -0
  107. package/bin/runners/lib/agent-firewall/proposal/validator.js +386 -0
  108. package/bin/runners/lib/agent-firewall/reality/index.js +332 -0
  109. package/bin/runners/lib/agent-firewall/reality/state.js +625 -0
  110. package/bin/runners/lib/agent-firewall/reality/watcher.js +322 -0
  111. package/bin/runners/lib/agent-firewall/risk/index.js +173 -0
  112. package/bin/runners/lib/agent-firewall/risk/scorer.js +328 -0
  113. package/bin/runners/lib/agent-firewall/risk/thresholds.js +322 -0
  114. package/bin/runners/lib/agent-firewall/risk/vectors.js +421 -0
  115. package/bin/runners/lib/agent-firewall/session/collector.js +451 -0
  116. package/bin/runners/lib/agent-firewall/session/index.js +26 -0
  117. package/bin/runners/lib/agent-firewall/simulator/diff-simulator.js +472 -0
  118. package/bin/runners/lib/agent-firewall/simulator/import-resolver.js +346 -0
  119. package/bin/runners/lib/agent-firewall/simulator/index.js +181 -0
  120. package/bin/runners/lib/agent-firewall/simulator/route-validator.js +380 -0
  121. package/bin/runners/lib/agent-firewall/time-machine/incident-correlator.js +661 -0
  122. package/bin/runners/lib/agent-firewall/time-machine/index.js +267 -0
  123. package/bin/runners/lib/agent-firewall/time-machine/replay-engine.js +436 -0
  124. package/bin/runners/lib/agent-firewall/time-machine/state-reconstructor.js +490 -0
  125. package/bin/runners/lib/agent-firewall/time-machine/timeline-builder.js +530 -0
  126. package/bin/runners/lib/agent-firewall/truthpack/index.js +67 -0
  127. package/bin/runners/lib/agent-firewall/truthpack/loader.js +137 -0
  128. package/bin/runners/lib/agent-firewall/unblock/planner.js +337 -0
  129. package/bin/runners/lib/agent-firewall/utils/ignore-checker.js +118 -0
  130. package/bin/runners/lib/ai-bridge.js +416 -0
  131. package/bin/runners/lib/analysis-core.js +309 -0
  132. package/bin/runners/lib/analyzers.js +2500 -0
  133. package/bin/runners/lib/api-client.js +269 -0
  134. package/bin/runners/lib/approve-output.js +235 -0
  135. package/bin/runners/lib/artifact-envelope.js +540 -0
  136. package/bin/runners/lib/assets/vibecheck-logo.png +0 -0
  137. package/bin/runners/lib/audit-bridge.js +391 -0
  138. package/bin/runners/lib/auth-shared.js +977 -0
  139. package/bin/runners/lib/auth-truth.js +193 -0
  140. package/bin/runners/lib/auth.js +215 -0
  141. package/bin/runners/lib/authority-badge.js +425 -0
  142. package/bin/runners/lib/backup.js +62 -0
  143. package/bin/runners/lib/billing.js +107 -0
  144. package/bin/runners/lib/checkpoint.js +941 -0
  145. package/bin/runners/lib/claims.js +118 -0
  146. package/bin/runners/lib/classify-output.js +204 -0
  147. package/bin/runners/lib/cleanup/engine.js +571 -0
  148. package/bin/runners/lib/cleanup/index.js +53 -0
  149. package/bin/runners/lib/cleanup/output.js +375 -0
  150. package/bin/runners/lib/cleanup/rules.js +1060 -0
  151. package/bin/runners/lib/cli-output.js +400 -0
  152. package/bin/runners/lib/cli-ui.js +540 -0
  153. package/bin/runners/lib/compliance-bridge-new.js +0 -0
  154. package/bin/runners/lib/compliance-bridge.js +165 -0
  155. package/bin/runners/lib/contracts/auth-contract.js +202 -0
  156. package/bin/runners/lib/contracts/env-contract.js +181 -0
  157. package/bin/runners/lib/contracts/external-contract.js +206 -0
  158. package/bin/runners/lib/contracts/guard.js +168 -0
  159. package/bin/runners/lib/contracts/index.js +89 -0
  160. package/bin/runners/lib/contracts/plan-validator.js +311 -0
  161. package/bin/runners/lib/contracts/route-contract.js +199 -0
  162. package/bin/runners/lib/contracts.js +804 -0
  163. package/bin/runners/lib/default-config.js +127 -0
  164. package/bin/runners/lib/detect.js +89 -0
  165. package/bin/runners/lib/detectors-v2.js +622 -0
  166. package/bin/runners/lib/doctor/autofix.js +254 -0
  167. package/bin/runners/lib/doctor/diagnosis-receipt.js +454 -0
  168. package/bin/runners/lib/doctor/failure-signatures.js +526 -0
  169. package/bin/runners/lib/doctor/fix-script.js +336 -0
  170. package/bin/runners/lib/doctor/index.js +37 -0
  171. package/bin/runners/lib/doctor/modules/build-tools.js +453 -0
  172. package/bin/runners/lib/doctor/modules/dependencies.js +325 -0
  173. package/bin/runners/lib/doctor/modules/index.js +105 -0
  174. package/bin/runners/lib/doctor/modules/network.js +250 -0
  175. package/bin/runners/lib/doctor/modules/os-quirks.js +706 -0
  176. package/bin/runners/lib/doctor/modules/project.js +312 -0
  177. package/bin/runners/lib/doctor/modules/repo-integrity.js +485 -0
  178. package/bin/runners/lib/doctor/modules/runtime.js +224 -0
  179. package/bin/runners/lib/doctor/modules/security.js +350 -0
  180. package/bin/runners/lib/doctor/modules/system.js +213 -0
  181. package/bin/runners/lib/doctor/modules/vibecheck.js +394 -0
  182. package/bin/runners/lib/doctor/reporter.js +262 -0
  183. package/bin/runners/lib/doctor/safe-repair.js +384 -0
  184. package/bin/runners/lib/doctor/service.js +262 -0
  185. package/bin/runners/lib/doctor/types.js +113 -0
  186. package/bin/runners/lib/doctor/ui.js +263 -0
  187. package/bin/runners/lib/doctor-enhanced.js +233 -0
  188. package/bin/runners/lib/doctor-output.js +226 -0
  189. package/bin/runners/lib/doctor-v2.js +608 -0
  190. package/bin/runners/lib/drift.js +425 -0
  191. package/bin/runners/lib/enforcement.js +72 -0
  192. package/bin/runners/lib/engine/ast-cache.js +210 -0
  193. package/bin/runners/lib/engine/auth-extractor.js +211 -0
  194. package/bin/runners/lib/engine/billing-extractor.js +112 -0
  195. package/bin/runners/lib/engine/enforcement-extractor.js +100 -0
  196. package/bin/runners/lib/engine/env-extractor.js +207 -0
  197. package/bin/runners/lib/engine/express-extractor.js +208 -0
  198. package/bin/runners/lib/engine/extractors.js +849 -0
  199. package/bin/runners/lib/engine/index.js +207 -0
  200. package/bin/runners/lib/engine/repo-index.js +514 -0
  201. package/bin/runners/lib/engine/types.js +124 -0
  202. package/bin/runners/lib/engines/accessibility-engine.js +190 -0
  203. package/bin/runners/lib/engines/api-consistency-engine.js +162 -0
  204. package/bin/runners/lib/engines/ast-cache.js +99 -0
  205. package/bin/runners/lib/engines/attack-detector.js +1192 -0
  206. package/bin/runners/lib/engines/code-quality-engine.js +255 -0
  207. package/bin/runners/lib/engines/console-logs-engine.js +115 -0
  208. package/bin/runners/lib/engines/cross-file-analysis-engine.js +268 -0
  209. package/bin/runners/lib/engines/dead-code-engine.js +198 -0
  210. package/bin/runners/lib/engines/deprecated-api-engine.js +226 -0
  211. package/bin/runners/lib/engines/empty-catch-engine.js +150 -0
  212. package/bin/runners/lib/engines/file-filter.js +131 -0
  213. package/bin/runners/lib/engines/hardcoded-secrets-engine.js +251 -0
  214. package/bin/runners/lib/engines/mock-data-engine.js +272 -0
  215. package/bin/runners/lib/engines/parallel-processor.js +71 -0
  216. package/bin/runners/lib/engines/performance-issues-engine.js +265 -0
  217. package/bin/runners/lib/engines/security-vulnerabilities-engine.js +243 -0
  218. package/bin/runners/lib/engines/todo-fixme-engine.js +115 -0
  219. package/bin/runners/lib/engines/type-aware-engine.js +152 -0
  220. package/bin/runners/lib/engines/unsafe-regex-engine.js +225 -0
  221. package/bin/runners/lib/engines/vibecheck-engines/README.md +53 -0
  222. package/bin/runners/lib/engines/vibecheck-engines/index.js +15 -0
  223. package/bin/runners/lib/engines/vibecheck-engines/lib/ast-cache.js +164 -0
  224. package/bin/runners/lib/engines/vibecheck-engines/lib/code-quality-engine.js +291 -0
  225. package/bin/runners/lib/engines/vibecheck-engines/lib/console-logs-engine.js +83 -0
  226. package/bin/runners/lib/engines/vibecheck-engines/lib/dead-code-engine.js +198 -0
  227. package/bin/runners/lib/engines/vibecheck-engines/lib/deprecated-api-engine.js +275 -0
  228. package/bin/runners/lib/engines/vibecheck-engines/lib/empty-catch-engine.js +167 -0
  229. package/bin/runners/lib/engines/vibecheck-engines/lib/file-filter.js +217 -0
  230. package/bin/runners/lib/engines/vibecheck-engines/lib/hardcoded-secrets-engine.js +139 -0
  231. package/bin/runners/lib/engines/vibecheck-engines/lib/mock-data-engine.js +140 -0
  232. package/bin/runners/lib/engines/vibecheck-engines/lib/parallel-processor.js +164 -0
  233. package/bin/runners/lib/engines/vibecheck-engines/lib/performance-issues-engine.js +234 -0
  234. package/bin/runners/lib/engines/vibecheck-engines/lib/type-aware-engine.js +217 -0
  235. package/bin/runners/lib/engines/vibecheck-engines/lib/unsafe-regex-engine.js +78 -0
  236. package/bin/runners/lib/engines/vibecheck-engines/package.json +13 -0
  237. package/bin/runners/lib/enterprise-detect.js +603 -0
  238. package/bin/runners/lib/enterprise-init.js +942 -0
  239. package/bin/runners/lib/entitlements-v2.js +265 -0
  240. package/bin/runners/lib/entitlements.generated.js +0 -0
  241. package/bin/runners/lib/entitlements.js +340 -0
  242. package/bin/runners/lib/env-resolver.js +417 -0
  243. package/bin/runners/lib/env-template.js +66 -0
  244. package/bin/runners/lib/env.js +189 -0
  245. package/bin/runners/lib/error-handler.js +368 -0
  246. package/bin/runners/lib/error-messages.js +289 -0
  247. package/bin/runners/lib/evidence-pack.js +684 -0
  248. package/bin/runners/lib/exit-codes.js +275 -0
  249. package/bin/runners/lib/extractors/client-calls.js +990 -0
  250. package/bin/runners/lib/extractors/fastify-route-dump.js +573 -0
  251. package/bin/runners/lib/extractors/fastify-routes.js +426 -0
  252. package/bin/runners/lib/extractors/index.js +363 -0
  253. package/bin/runners/lib/extractors/next-routes.js +524 -0
  254. package/bin/runners/lib/extractors/proof-graph.js +431 -0
  255. package/bin/runners/lib/extractors/route-matcher.js +451 -0
  256. package/bin/runners/lib/extractors/truthpack-v2.js +377 -0
  257. package/bin/runners/lib/extractors/ui-bindings.js +547 -0
  258. package/bin/runners/lib/finding-id.js +69 -0
  259. package/bin/runners/lib/finding-sorter.js +89 -0
  260. package/bin/runners/lib/findings-schema.js +281 -0
  261. package/bin/runners/lib/fingerprint.js +377 -0
  262. package/bin/runners/lib/firewall-prompt.js +50 -0
  263. package/bin/runners/lib/fix-output.js +228 -0
  264. package/bin/runners/lib/global-flags.js +250 -0
  265. package/bin/runners/lib/graph/graph-builder.js +265 -0
  266. package/bin/runners/lib/graph/html-renderer.js +413 -0
  267. package/bin/runners/lib/graph/index.js +32 -0
  268. package/bin/runners/lib/graph/runtime-collector.js +215 -0
  269. package/bin/runners/lib/graph/static-extractor.js +518 -0
  270. package/bin/runners/lib/help-formatter.js +413 -0
  271. package/bin/runners/lib/html-proof-report.js +913 -0
  272. package/bin/runners/lib/html-report.js +650 -0
  273. package/bin/runners/lib/init-wizard.js +601 -0
  274. package/bin/runners/lib/interactive-menu.js +1496 -0
  275. package/bin/runners/lib/json-output.js +76 -0
  276. package/bin/runners/lib/llm.js +75 -0
  277. package/bin/runners/lib/logger.js +38 -0
  278. package/bin/runners/lib/meter.js +61 -0
  279. package/bin/runners/lib/missions/briefing.js +427 -0
  280. package/bin/runners/lib/missions/checkpoint.js +753 -0
  281. package/bin/runners/lib/missions/evidence.js +126 -0
  282. package/bin/runners/lib/missions/hardening.js +851 -0
  283. package/bin/runners/lib/missions/plan.js +648 -0
  284. package/bin/runners/lib/missions/safety-gates.js +645 -0
  285. package/bin/runners/lib/missions/schema.js +478 -0
  286. package/bin/runners/lib/missions/templates.js +317 -0
  287. package/bin/runners/lib/next-action.js +560 -0
  288. package/bin/runners/lib/packs/bundle.js +675 -0
  289. package/bin/runners/lib/packs/evidence-pack.js +671 -0
  290. package/bin/runners/lib/packs/pack-factory.js +837 -0
  291. package/bin/runners/lib/packs/permissions-pack.js +686 -0
  292. package/bin/runners/lib/packs/proof-graph-pack.js +779 -0
  293. package/bin/runners/lib/patch.js +40 -0
  294. package/bin/runners/lib/permissions/auth-model.js +213 -0
  295. package/bin/runners/lib/permissions/idor-prover.js +205 -0
  296. package/bin/runners/lib/permissions/index.js +45 -0
  297. package/bin/runners/lib/permissions/matrix-builder.js +198 -0
  298. package/bin/runners/lib/pkgjson.js +28 -0
  299. package/bin/runners/lib/policy.js +295 -0
  300. package/bin/runners/lib/polish/accessibility.js +62 -0
  301. package/bin/runners/lib/polish/analyzer.js +93 -0
  302. package/bin/runners/lib/polish/backend.js +87 -0
  303. package/bin/runners/lib/polish/configuration.js +83 -0
  304. package/bin/runners/lib/polish/documentation.js +83 -0
  305. package/bin/runners/lib/polish/frontend.js +817 -0
  306. package/bin/runners/lib/polish/index.js +27 -0
  307. package/bin/runners/lib/polish/infrastructure.js +80 -0
  308. package/bin/runners/lib/polish/internationalization.js +85 -0
  309. package/bin/runners/lib/polish/libraries.js +180 -0
  310. package/bin/runners/lib/polish/observability.js +75 -0
  311. package/bin/runners/lib/polish/performance.js +64 -0
  312. package/bin/runners/lib/polish/privacy.js +110 -0
  313. package/bin/runners/lib/polish/resilience.js +92 -0
  314. package/bin/runners/lib/polish/security.js +78 -0
  315. package/bin/runners/lib/polish/seo.js +71 -0
  316. package/bin/runners/lib/polish/styles.js +62 -0
  317. package/bin/runners/lib/polish/utils.js +104 -0
  318. package/bin/runners/lib/preflight.js +142 -0
  319. package/bin/runners/lib/prerequisites.js +149 -0
  320. package/bin/runners/lib/prove-output.js +220 -0
  321. package/bin/runners/lib/reality/correlation-detectors.js +359 -0
  322. package/bin/runners/lib/reality/index.js +318 -0
  323. package/bin/runners/lib/reality/request-hashing.js +416 -0
  324. package/bin/runners/lib/reality/request-mapper.js +453 -0
  325. package/bin/runners/lib/reality/safety-rails.js +463 -0
  326. package/bin/runners/lib/reality/semantic-snapshot.js +408 -0
  327. package/bin/runners/lib/reality/toast-detector.js +393 -0
  328. package/bin/runners/lib/reality-findings.js +84 -0
  329. package/bin/runners/lib/reality-output.js +231 -0
  330. package/bin/runners/lib/receipts.js +179 -0
  331. package/bin/runners/lib/redact.js +29 -0
  332. package/bin/runners/lib/replay/capsule-manager.js +154 -0
  333. package/bin/runners/lib/replay/index.js +263 -0
  334. package/bin/runners/lib/replay/player.js +348 -0
  335. package/bin/runners/lib/replay/recorder.js +331 -0
  336. package/bin/runners/lib/report-engine.js +626 -0
  337. package/bin/runners/lib/report-html.js +1233 -0
  338. package/bin/runners/lib/report-output.js +366 -0
  339. package/bin/runners/lib/report-templates.js +967 -0
  340. package/bin/runners/lib/report.js +135 -0
  341. package/bin/runners/lib/route-detection.js +1209 -0
  342. package/bin/runners/lib/route-truth.js +1322 -0
  343. package/bin/runners/lib/safelist/index.js +96 -0
  344. package/bin/runners/lib/safelist/integration.js +334 -0
  345. package/bin/runners/lib/safelist/matcher.js +696 -0
  346. package/bin/runners/lib/safelist/schema.js +948 -0
  347. package/bin/runners/lib/safelist/store.js +438 -0
  348. package/bin/runners/lib/sandbox/index.js +59 -0
  349. package/bin/runners/lib/sandbox/proof-chain.js +399 -0
  350. package/bin/runners/lib/sandbox/sandbox-runner.js +205 -0
  351. package/bin/runners/lib/sandbox/worktree.js +174 -0
  352. package/bin/runners/lib/scan-cache.js +330 -0
  353. package/bin/runners/lib/scan-output-schema.js +344 -0
  354. package/bin/runners/lib/scan-output.js +631 -0
  355. package/bin/runners/lib/scan-runner.js +135 -0
  356. package/bin/runners/lib/schema-validator.js +350 -0
  357. package/bin/runners/lib/schemas/ajv-validator.js +464 -0
  358. package/bin/runners/lib/schemas/contracts.schema.json +160 -0
  359. package/bin/runners/lib/schemas/error-envelope.schema.json +105 -0
  360. package/bin/runners/lib/schemas/finding-v3.schema.json +151 -0
  361. package/bin/runners/lib/schemas/finding.schema.json +100 -0
  362. package/bin/runners/lib/schemas/mission-pack.schema.json +206 -0
  363. package/bin/runners/lib/schemas/proof-graph.schema.json +176 -0
  364. package/bin/runners/lib/schemas/reality-report.schema.json +162 -0
  365. package/bin/runners/lib/schemas/report-artifact.schema.json +120 -0
  366. package/bin/runners/lib/schemas/run-request.schema.json +108 -0
  367. package/bin/runners/lib/schemas/share-pack.schema.json +180 -0
  368. package/bin/runners/lib/schemas/ship-manifest.schema.json +251 -0
  369. package/bin/runners/lib/schemas/ship-report.schema.json +117 -0
  370. package/bin/runners/lib/schemas/truthpack-v2.schema.json +303 -0
  371. package/bin/runners/lib/schemas/validator.js +465 -0
  372. package/bin/runners/lib/schemas/verdict.schema.json +140 -0
  373. package/bin/runners/lib/score-history.js +282 -0
  374. package/bin/runners/lib/security-bridge.js +249 -0
  375. package/bin/runners/lib/server-usage.js +513 -0
  376. package/bin/runners/lib/share-pack.js +239 -0
  377. package/bin/runners/lib/ship-gate.js +832 -0
  378. package/bin/runners/lib/ship-manifest.js +1153 -0
  379. package/bin/runners/lib/ship-output-enterprise.js +239 -0
  380. package/bin/runners/lib/ship-output.js +1128 -0
  381. package/bin/runners/lib/snippets.js +67 -0
  382. package/bin/runners/lib/status-output.js +340 -0
  383. package/bin/runners/lib/terminal-ui.js +356 -0
  384. package/bin/runners/lib/truth.js +1691 -0
  385. package/bin/runners/lib/ui.js +562 -0
  386. package/bin/runners/lib/unified-cli-output.js +947 -0
  387. package/bin/runners/lib/unified-output.js +197 -0
  388. package/bin/runners/lib/upsell.js +410 -0
  389. package/bin/runners/lib/usage.js +153 -0
  390. package/bin/runners/lib/validate-patch.js +156 -0
  391. package/bin/runners/lib/verdict-engine.js +628 -0
  392. package/bin/runners/lib/verification.js +345 -0
  393. package/bin/runners/lib/why-tree.js +650 -0
  394. package/bin/runners/reality/engine.js +917 -0
  395. package/bin/runners/reality/flows.js +122 -0
  396. package/bin/runners/reality/report.js +378 -0
  397. package/bin/runners/reality/session.js +193 -0
  398. package/bin/runners/runAIAgent.js +229 -0
  399. package/bin/runners/runAgent.d.ts +5 -0
  400. package/bin/runners/runAgent.js +161 -0
  401. package/bin/runners/runAllowlist.js +418 -0
  402. package/bin/runners/runApprove.js +320 -0
  403. package/bin/runners/runAudit.js +692 -0
  404. package/bin/runners/runAuth.js +731 -0
  405. package/bin/runners/runCI.js +353 -0
  406. package/bin/runners/runCheckpoint.js +530 -0
  407. package/bin/runners/runClassify.js +928 -0
  408. package/bin/runners/runCleanup.js +343 -0
  409. package/bin/runners/runContext.d.ts +4 -0
  410. package/bin/runners/runContext.js +175 -0
  411. package/bin/runners/runDoctor.js +877 -0
  412. package/bin/runners/runEvidencePack.js +362 -0
  413. package/bin/runners/runFirewall.d.ts +5 -0
  414. package/bin/runners/runFirewall.js +134 -0
  415. package/bin/runners/runFirewallHook.d.ts +5 -0
  416. package/bin/runners/runFirewallHook.js +56 -0
  417. package/bin/runners/runFix.js +1355 -0
  418. package/bin/runners/runForge.js +451 -0
  419. package/bin/runners/runGuard.js +262 -0
  420. package/bin/runners/runInit.js +1927 -0
  421. package/bin/runners/runIntent.js +906 -0
  422. package/bin/runners/runKickoff.js +878 -0
  423. package/bin/runners/runLabs.js +424 -0
  424. package/bin/runners/runLaunch.js +2000 -0
  425. package/bin/runners/runLink.js +785 -0
  426. package/bin/runners/runMcp.js +1875 -0
  427. package/bin/runners/runPacks.js +2089 -0
  428. package/bin/runners/runPolish.d.ts +4 -0
  429. package/bin/runners/runPolish.js +390 -0
  430. package/bin/runners/runPromptFirewall.js +211 -0
  431. package/bin/runners/runProve.js +1411 -0
  432. package/bin/runners/runQuickstart.js +531 -0
  433. package/bin/runners/runReality.js +2260 -0
  434. package/bin/runners/runReport.js +726 -0
  435. package/bin/runners/runRuntime.js +110 -0
  436. package/bin/runners/runSafelist.js +1190 -0
  437. package/bin/runners/runScan.js +688 -0
  438. package/bin/runners/runShield.js +1282 -0
  439. package/bin/runners/runShip.js +1660 -0
  440. package/bin/runners/runTruth.d.ts +5 -0
  441. package/bin/runners/runTruth.js +101 -0
  442. package/bin/runners/runValidate.js +179 -0
  443. package/bin/runners/runWatch.js +478 -0
  444. package/bin/runners/utils.js +360 -0
  445. package/bin/scan.js +617 -0
  446. package/bin/vibecheck.js +1617 -0
  447. package/dist/guardrail/index.d.ts +2405 -0
  448. package/dist/guardrail/index.js +9747 -0
  449. package/dist/guardrail/index.js.map +1 -0
  450. package/dist/scanner/index.d.ts +282 -0
  451. package/dist/scanner/index.js +3395 -0
  452. package/dist/scanner/index.js.map +1 -0
  453. package/package.json +123 -104
  454. package/README.md +0 -491
  455. package/dist/index.js +0 -99711
  456. package/dist/index.js.map +0 -1
package/bin/runners/lib/report-templates.js ADDED
@@ -0,0 +1,967 @@
1
+ /**
2
+ * Report Templates - Executive & Compliance Reports
3
+ *
4
+ * Purpose-built reports for different audiences:
5
+ * - Executive: C-suite friendly, minimal technical detail
6
+ * - Compliance: SOC2/HIPAA/PCI-DSS ready language
7
+ */
8
+
9
+ /**
10
+ * Generate Executive Report (C-Suite / Stakeholders)
11
+ *
12
+ * Features:
13
+ * - Single-page summary
14
+ * - No code snippets or file paths
15
+ * - Risk-focused language
16
+ * - Clear action items
17
+ * - Print-ready layout
18
+ */
19
+ function generateEnhancedExecutiveReport(data, opts = {}) {
20
+ const { projectName, generatedAt, score, verdict, findings, categoryScores } = data;
21
+ const company = opts.company || "";
22
+ const logo = opts.logo || "";
23
+
24
+ // Calculate metrics
25
+ const criticalCount = findings?.filter(f => ["BLOCK", "critical"].includes(f.severity)).length || 0;
26
+ const highCount = findings?.filter(f => f.severity === "high").length || 0;
27
+ const totalIssues = findings?.length || 0;
28
+
29
+ // Risk level
30
+ const riskLevel = score >= 80 ? "Low" : score >= 60 ? "Medium" : "High";
31
+ const riskColor = score >= 80 ? "#10b981" : score >= 60 ? "#f59e0b" : "#ef4444";
32
+
33
+ // Verdict config
34
+ const verdictMap = {
35
+ SHIP: { text: "Ready for Production", color: "#10b981", icon: "✓" },
36
+ WARN: { text: "Requires Attention", color: "#f59e0b", icon: "!" },
37
+ BLOCK: { text: "Not Recommended", color: "#ef4444", icon: "✕" },
38
+ };
39
+ const v = verdictMap[verdict] || verdictMap.WARN;
40
+
41
+ return `<!DOCTYPE html>
42
+ <html lang="en">
43
+ <head>
44
+ <meta charset="UTF-8">
45
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
46
+ <title>Executive Summary - ${projectName}</title>
47
+ <style>
48
+ @page { size: letter; margin: 0.75in; }
49
+
50
+ * { box-sizing: border-box; margin: 0; padding: 0; }
51
+
52
+ body {
53
+ font-family: -apple-system, BlinkMacSystemFont, 'SF Pro Text', 'Segoe UI', system-ui, sans-serif;
54
+ background: #ffffff;
55
+ color: #1a1a2e;
56
+ line-height: 1.6;
57
+ max-width: 850px;
58
+ margin: 0 auto;
59
+ padding: 48px;
60
+ }
61
+
62
+ .header {
63
+ display: flex;
64
+ justify-content: space-between;
65
+ align-items: flex-start;
66
+ border-bottom: 2px solid #e5e7eb;
67
+ padding-bottom: 24px;
68
+ margin-bottom: 32px;
69
+ }
70
+
71
+ .header-left h1 {
72
+ font-size: 28px;
73
+ font-weight: 700;
74
+ color: #111827;
75
+ letter-spacing: -0.5px;
76
+ }
77
+
78
+ .header-left .subtitle {
79
+ font-size: 14px;
80
+ color: #6b7280;
81
+ margin-top: 4px;
82
+ }
83
+
84
+ .header-right {
85
+ text-align: right;
86
+ }
87
+
88
+ .logo {
89
+ height: 36px;
90
+ margin-bottom: 8px;
91
+ }
92
+
93
+ .brand {
94
+ font-size: 12px;
95
+ color: #9ca3af;
96
+ text-transform: uppercase;
97
+ letter-spacing: 0.1em;
98
+ }
99
+
100
+ .hero {
101
+ display: grid;
102
+ grid-template-columns: 200px 1fr;
103
+ gap: 40px;
104
+ margin-bottom: 40px;
105
+ padding: 32px;
106
+ background: linear-gradient(135deg, #f8fafc 0%, #f1f5f9 100%);
107
+ border-radius: 16px;
108
+ border: 1px solid #e2e8f0;
109
+ }
110
+
111
+ .score-display {
112
+ display: flex;
113
+ flex-direction: column;
114
+ align-items: center;
115
+ justify-content: center;
116
+ }
117
+
118
+ .score-circle {
119
+ width: 140px;
120
+ height: 140px;
121
+ border-radius: 50%;
122
+ background: conic-gradient(
123
+ ${riskColor} 0deg,
124
+ ${riskColor} ${score * 3.6}deg,
125
+ #e5e7eb ${score * 3.6}deg,
126
+ #e5e7eb 360deg
127
+ );
128
+ display: flex;
129
+ align-items: center;
130
+ justify-content: center;
131
+ position: relative;
132
+ }
133
+
134
+ .score-circle::before {
135
+ content: '';
136
+ position: absolute;
137
+ width: 110px;
138
+ height: 110px;
139
+ border-radius: 50%;
140
+ background: white;
141
+ }
142
+
143
+ .score-value {
144
+ position: relative;
145
+ font-size: 40px;
146
+ font-weight: 800;
147
+ color: ${riskColor};
148
+ }
149
+
150
+ .score-label {
151
+ font-size: 12px;
152
+ color: #6b7280;
153
+ text-transform: uppercase;
154
+ letter-spacing: 0.1em;
155
+ margin-top: 12px;
156
+ }
157
+
158
+ .verdict-section {
159
+ display: flex;
160
+ flex-direction: column;
161
+ justify-content: center;
162
+ }
163
+
164
+ .verdict-badge {
165
+ display: inline-flex;
166
+ align-items: center;
167
+ gap: 10px;
168
+ padding: 10px 20px;
169
+ background: ${v.color}15;
170
+ border: 1px solid ${v.color}30;
171
+ border-radius: 50px;
172
+ width: fit-content;
173
+ margin-bottom: 16px;
174
+ }
175
+
176
+ .verdict-icon {
177
+ width: 24px;
178
+ height: 24px;
179
+ border-radius: 50%;
180
+ background: ${v.color};
181
+ color: white;
182
+ display: flex;
183
+ align-items: center;
184
+ justify-content: center;
185
+ font-weight: 700;
186
+ font-size: 14px;
187
+ }
188
+
189
+ .verdict-text {
190
+ font-weight: 700;
191
+ font-size: 15px;
192
+ color: ${v.color};
193
+ }
194
+
195
+ .verdict-summary {
196
+ font-size: 15px;
197
+ color: #374151;
198
+ line-height: 1.7;
199
+ }
200
+
201
+ .section {
202
+ margin-bottom: 32px;
203
+ }
204
+
205
+ .section-title {
206
+ font-size: 18px;
207
+ font-weight: 600;
208
+ color: #111827;
209
+ margin-bottom: 16px;
210
+ padding-bottom: 8px;
211
+ border-bottom: 1px solid #e5e7eb;
212
+ }
213
+
214
+ .metrics-grid {
215
+ display: grid;
216
+ grid-template-columns: repeat(4, 1fr);
217
+ gap: 16px;
218
+ }
219
+
220
+ .metric-card {
221
+ background: #f9fafb;
222
+ border: 1px solid #e5e7eb;
223
+ border-radius: 12px;
224
+ padding: 20px;
225
+ text-align: center;
226
+ }
227
+
228
+ .metric-value {
229
+ font-size: 32px;
230
+ font-weight: 700;
231
+ }
232
+
233
+ .metric-value.critical { color: #ef4444; }
234
+ .metric-value.high { color: #f97316; }
235
+ .metric-value.medium { color: #f59e0b; }
236
+ .metric-value.low { color: #3b82f6; }
237
+ .metric-value.neutral { color: #6b7280; }
238
+
239
+ .metric-label {
240
+ font-size: 12px;
241
+ color: #6b7280;
242
+ text-transform: uppercase;
243
+ letter-spacing: 0.05em;
244
+ margin-top: 4px;
245
+ }
246
+
247
+ .risk-table {
248
+ width: 100%;
249
+ border-collapse: collapse;
250
+ }
251
+
252
+ .risk-table th {
253
+ text-align: left;
254
+ font-size: 12px;
255
+ color: #6b7280;
256
+ text-transform: uppercase;
257
+ letter-spacing: 0.05em;
258
+ padding: 12px 16px;
259
+ background: #f9fafb;
260
+ border-bottom: 1px solid #e5e7eb;
261
+ }
262
+
263
+ .risk-table td {
264
+ padding: 16px;
265
+ border-bottom: 1px solid #e5e7eb;
266
+ font-size: 14px;
267
+ }
268
+
269
+ .risk-table .category {
270
+ font-weight: 600;
271
+ color: #111827;
272
+ }
273
+
274
+ .status-badge {
275
+ display: inline-block;
276
+ padding: 4px 12px;
277
+ border-radius: 50px;
278
+ font-size: 12px;
279
+ font-weight: 600;
280
+ }
281
+
282
+ .status-badge.pass { background: #d1fae5; color: #065f46; }
283
+ .status-badge.attention { background: #fef3c7; color: #92400e; }
284
+ .status-badge.fail { background: #fee2e2; color: #991b1b; }
285
+
286
+ .recommendation-box {
287
+ background: #fffbeb;
288
+ border: 1px solid #fcd34d;
289
+ border-radius: 12px;
290
+ padding: 20px;
291
+ }
292
+
293
+ .recommendation-title {
294
+ font-weight: 600;
295
+ color: #92400e;
296
+ margin-bottom: 8px;
297
+ }
298
+
299
+ .recommendation-text {
300
+ font-size: 14px;
301
+ color: #78350f;
302
+ line-height: 1.6;
303
+ }
304
+
305
+ .action-list {
306
+ list-style: none;
307
+ margin-top: 12px;
308
+ }
309
+
310
+ .action-list li {
311
+ padding: 8px 0 8px 24px;
312
+ position: relative;
313
+ font-size: 14px;
314
+ color: #78350f;
315
+ }
316
+
317
+ .action-list li::before {
318
+ content: '→';
319
+ position: absolute;
320
+ left: 0;
321
+ color: #f59e0b;
322
+ font-weight: bold;
323
+ }
324
+
325
+ .footer {
326
+ margin-top: 48px;
327
+ padding-top: 24px;
328
+ border-top: 1px solid #e5e7eb;
329
+ display: flex;
330
+ justify-content: space-between;
331
+ align-items: center;
332
+ font-size: 12px;
333
+ color: #9ca3af;
334
+ }
335
+
336
+ .footer a {
337
+ color: #6b7280;
338
+ text-decoration: none;
339
+ }
340
+
341
+ @media print {
342
+ body { padding: 0; max-width: none; }
343
+ .hero { break-inside: avoid; }
344
+ .section { break-inside: avoid; }
345
+ }
346
+ </style>
347
+ </head>
348
+ <body>
349
+ <header class="header">
350
+ <div class="header-left">
351
+ <h1>Security Assessment</h1>
352
+ <div class="subtitle">${projectName} · ${new Date(generatedAt).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' })}</div>
353
+ </div>
354
+ <div class="header-right">
355
+ ${logo ? `<img src="${logo}" alt="Logo" class="logo">` : ''}
356
+ <div class="brand">${company || 'VibeCheck Report'}</div>
357
+ </div>
358
+ </header>
359
+
360
+ <section class="hero">
361
+ <div class="score-display">
362
+ <div class="score-circle">
363
+ <span class="score-value">${score}</span>
364
+ </div>
365
+ <div class="score-label">Security Score</div>
366
+ </div>
367
+ <div class="verdict-section">
368
+ <div class="verdict-badge">
369
+ <span class="verdict-icon">${v.icon}</span>
370
+ <span class="verdict-text">${v.text}</span>
371
+ </div>
372
+ <p class="verdict-summary">${getExecutiveSummary(verdict, criticalCount, highCount, score)}</p>
373
+ </div>
374
+ </section>
375
+
376
+ <section class="section">
377
+ <h2 class="section-title">Risk Overview</h2>
378
+ <div class="metrics-grid">
379
+ <div class="metric-card">
380
+ <div class="metric-value critical">${criticalCount}</div>
381
+ <div class="metric-label">Critical Risk</div>
382
+ </div>
383
+ <div class="metric-card">
384
+ <div class="metric-value high">${highCount}</div>
385
+ <div class="metric-label">High Risk</div>
386
+ </div>
387
+ <div class="metric-card">
388
+ <div class="metric-value neutral">${totalIssues}</div>
389
+ <div class="metric-label">Total Issues</div>
390
+ </div>
391
+ <div class="metric-card">
392
+ <div class="metric-value" style="color: ${riskColor}">${riskLevel}</div>
393
+ <div class="metric-label">Risk Level</div>
394
+ </div>
395
+ </div>
396
+ </section>
397
+
398
+ ${categoryScores && Object.keys(categoryScores).length > 0 ? `
399
+ <section class="section">
400
+ <h2 class="section-title">Security Categories</h2>
401
+ <table class="risk-table">
402
+ <thead>
403
+ <tr>
404
+ <th>Category</th>
405
+ <th>Score</th>
406
+ <th>Status</th>
407
+ </tr>
408
+ </thead>
409
+ <tbody>
410
+ ${Object.entries(categoryScores).map(([cat, catScore]) => {
411
+ const status = catScore >= 80 ? 'pass' : catScore >= 60 ? 'attention' : 'fail';
412
+ const statusText = catScore >= 80 ? 'Passing' : catScore >= 60 ? 'Needs Review' : 'At Risk';
413
+ return `
414
+ <tr>
415
+ <td class="category">${formatCategoryName(cat)}</td>
416
+ <td>${catScore}%</td>
417
+ <td><span class="status-badge ${status}">${statusText}</span></td>
418
+ </tr>
419
+ `;
420
+ }).join('')}
421
+ </tbody>
422
+ </table>
423
+ </section>
424
+ ` : ''}
425
+
426
+ <section class="section">
427
+ <h2 class="section-title">Recommended Actions</h2>
428
+ <div class="recommendation-box">
429
+ <div class="recommendation-title">${getRecommendationTitle(verdict)}</div>
430
+ <p class="recommendation-text">${getRecommendationText(verdict, criticalCount, highCount)}</p>
431
+ <ul class="action-list">
432
+ ${getActionItems(verdict, criticalCount, highCount).map(item => `<li>${item}</li>`).join('')}
433
+ </ul>
434
+ </div>
435
+ </section>
436
+
437
+ <footer class="footer">
438
+ <span>Generated by VibeCheck · <a href="https://vibecheck.dev">vibecheck.dev</a></span>
439
+ <span>Report ID: ${data.reportId || 'VC-' + Date.now().toString(36).toUpperCase()}</span>
440
+ </footer>
441
+ </body>
442
+ </html>`;
443
+ }
444
+
445
+ /**
446
+ * Generate Compliance Report (SOC2/HIPAA/PCI-DSS ready)
447
+ */
448
+ function generateEnhancedComplianceReport(data, opts = {}) {
449
+ const { projectName, generatedAt, score, verdict, findings, categoryScores } = data;
450
+ const company = opts.company || "Organization";
451
+ const framework = opts.framework || "SOC2";
452
+
453
+ // Map findings to compliance controls
454
+ const complianceMapping = mapToComplianceControls(findings || [], framework);
455
+
456
+ return `<!DOCTYPE html>
457
+ <html lang="en">
458
+ <head>
459
+ <meta charset="UTF-8">
460
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
461
+ <title>${framework} Compliance Report - ${projectName}</title>
462
+ <style>
463
+ @page { size: letter; margin: 0.75in; }
464
+
465
+ * { box-sizing: border-box; margin: 0; padding: 0; }
466
+
467
+ body {
468
+ font-family: 'Times New Roman', Georgia, serif;
469
+ background: #ffffff;
470
+ color: #1a1a1a;
471
+ line-height: 1.7;
472
+ max-width: 850px;
473
+ margin: 0 auto;
474
+ padding: 48px;
475
+ font-size: 12pt;
476
+ }
477
+
478
+ .cover {
479
+ text-align: center;
480
+ padding: 80px 0;
481
+ border-bottom: 3px double #1a1a1a;
482
+ margin-bottom: 40px;
483
+ }
484
+
485
+ .cover h1 {
486
+ font-size: 28pt;
487
+ font-weight: normal;
488
+ text-transform: uppercase;
489
+ letter-spacing: 0.1em;
490
+ margin-bottom: 16px;
491
+ }
492
+
493
+ .cover .subtitle {
494
+ font-size: 14pt;
495
+ color: #666;
496
+ margin-bottom: 40px;
497
+ }
498
+
499
+ .cover .meta {
500
+ font-size: 11pt;
501
+ color: #666;
502
+ }
503
+
504
+ .cover .meta p {
505
+ margin: 4px 0;
506
+ }
507
+
508
+ .toc {
509
+ margin-bottom: 40px;
510
+ page-break-after: always;
511
+ }
512
+
513
+ .toc h2 {
514
+ font-size: 14pt;
515
+ text-transform: uppercase;
516
+ letter-spacing: 0.1em;
517
+ border-bottom: 1px solid #1a1a1a;
518
+ padding-bottom: 8px;
519
+ margin-bottom: 16px;
520
+ }
521
+
522
+ .toc-item {
523
+ display: flex;
524
+ justify-content: space-between;
525
+ padding: 8px 0;
526
+ border-bottom: 1px dotted #ccc;
527
+ }
528
+
529
+ .section {
530
+ margin-bottom: 32px;
531
+ }
532
+
533
+ .section h2 {
534
+ font-size: 14pt;
535
+ text-transform: uppercase;
536
+ letter-spacing: 0.1em;
537
+ border-bottom: 1px solid #1a1a1a;
538
+ padding-bottom: 8px;
539
+ margin-bottom: 16px;
540
+ }
541
+
542
+ .section h3 {
543
+ font-size: 12pt;
544
+ font-weight: bold;
545
+ margin: 16px 0 8px;
546
+ }
547
+
548
+ p {
549
+ margin-bottom: 12px;
550
+ text-align: justify;
551
+ }
552
+
553
+ .attestation-box {
554
+ border: 2px solid #1a1a1a;
555
+ padding: 24px;
556
+ margin: 24px 0;
557
+ background: #fafafa;
558
+ }
559
+
560
+ .attestation-box h3 {
561
+ text-transform: uppercase;
562
+ letter-spacing: 0.1em;
563
+ font-size: 11pt;
564
+ margin-bottom: 12px;
565
+ }
566
+
567
+ .control-table {
568
+ width: 100%;
569
+ border-collapse: collapse;
570
+ margin: 16px 0;
571
+ font-size: 10pt;
572
+ }
573
+
574
+ .control-table th {
575
+ text-align: left;
576
+ background: #f0f0f0;
577
+ padding: 12px;
578
+ border: 1px solid #ccc;
579
+ font-weight: bold;
580
+ }
581
+
582
+ .control-table td {
583
+ padding: 12px;
584
+ border: 1px solid #ccc;
585
+ vertical-align: top;
586
+ }
587
+
588
+ .control-id {
589
+ font-family: 'Courier New', monospace;
590
+ font-weight: bold;
591
+ }
592
+
593
+ .status-compliant {
594
+ color: #065f46;
595
+ font-weight: bold;
596
+ }
597
+
598
+ .status-partial {
599
+ color: #92400e;
600
+ font-weight: bold;
601
+ }
602
+
603
+ .status-gap {
604
+ color: #991b1b;
605
+ font-weight: bold;
606
+ }
607
+
608
+ .finding-ref {
609
+ font-family: 'Courier New', monospace;
610
+ font-size: 9pt;
611
+ color: #666;
612
+ }
613
+
614
+ .signature-section {
615
+ margin-top: 60px;
616
+ padding-top: 24px;
617
+ border-top: 1px solid #1a1a1a;
618
+ }
619
+
620
+ .signature-line {
621
+ display: grid;
622
+ grid-template-columns: 1fr 1fr;
623
+ gap: 40px;
624
+ margin-top: 40px;
625
+ }
626
+
627
+ .signature-block {
628
+ border-top: 1px solid #1a1a1a;
629
+ padding-top: 8px;
630
+ }
631
+
632
+ .signature-label {
633
+ font-size: 10pt;
634
+ color: #666;
635
+ }
636
+
637
+ .footer {
638
+ margin-top: 40px;
639
+ padding-top: 16px;
640
+ border-top: 1px solid #ccc;
641
+ font-size: 10pt;
642
+ color: #666;
643
+ text-align: center;
644
+ }
645
+
646
+ @media print {
647
+ body { padding: 0; max-width: none; }
648
+ .section { break-inside: avoid; }
649
+ .control-table { break-inside: avoid; }
650
+ }
651
+ </style>
652
+ </head>
653
+ <body>
654
+ <div class="cover">
655
+ <h1>${framework} Type II</h1>
656
+ <div class="subtitle">Security Assessment Report</div>
657
+ <p style="font-size: 18pt; margin-bottom: 40px;">${company}</p>
658
+ <div class="meta">
659
+ <p><strong>Application:</strong> ${projectName}</p>
660
+ <p><strong>Assessment Date:</strong> ${new Date(generatedAt).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' })}</p>
661
+ <p><strong>Report Period:</strong> Point-in-Time Assessment</p>
662
+ <p><strong>Overall Score:</strong> ${score}/100</p>
663
+ </div>
664
+ </div>
665
+
666
+ <div class="toc">
667
+ <h2>Table of Contents</h2>
668
+ <div class="toc-item"><span>1. Executive Summary</span><span>2</span></div>
669
+ <div class="toc-item"><span>2. Scope of Assessment</span><span>3</span></div>
670
+ <div class="toc-item"><span>3. Control Assessment Results</span><span>4</span></div>
671
+ <div class="toc-item"><span>4. Findings and Recommendations</span><span>5</span></div>
672
+ <div class="toc-item"><span>5. Management Attestation</span><span>6</span></div>
673
+ </div>
674
+
675
+ <section class="section">
676
+ <h2>1. Executive Summary</h2>
677
+ <p>This report presents the results of a ${framework} security assessment conducted on ${projectName} as of ${new Date(generatedAt).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' })}. The assessment was performed using automated security scanning tools to evaluate the application's adherence to ${framework} Trust Services Criteria.</p>
678
+
679
+ <div class="attestation-box">
680
+ <h3>Assessment Summary</h3>
681
+ <p><strong>Overall Compliance Score:</strong> ${score}/100</p>
682
+ <p><strong>Assessment Result:</strong> ${getComplianceVerdict(score)}</p>
683
+ <p><strong>Critical Findings:</strong> ${findings?.filter(f => f.severity === 'critical' || f.severity === 'BLOCK').length || 0}</p>
684
+ <p><strong>Total Findings:</strong> ${findings?.length || 0}</p>
685
+ </div>
686
+
687
+ <p>${getComplianceSummaryText(score, findings?.length || 0)}</p>
688
+ </section>
689
+
690
+ <section class="section">
691
+ <h2>2. Scope of Assessment</h2>
692
+ <p>The assessment covered the following areas of the ${projectName} application:</p>
693
+ <ul style="margin-left: 24px; margin-bottom: 16px;">
694
+ <li>Source code security analysis</li>
695
+ <li>Authentication and authorization controls</li>
696
+ <li>Data protection mechanisms</li>
697
+ <li>Configuration management</li>
698
+ <li>Error handling and logging</li>
699
+ <li>Third-party dependency analysis</li>
700
+ </ul>
701
+ <p>The assessment was conducted using VibeCheck automated security scanning, which evaluates code against industry-standard security controls and best practices.</p>
702
+ </section>
703
+
704
+ <section class="section">
705
+ <h2>3. Control Assessment Results</h2>
706
+ <p>The following table summarizes the assessment results mapped to ${framework} Trust Services Criteria:</p>
707
+
708
+ <table class="control-table">
709
+ <thead>
710
+ <tr>
711
+ <th style="width: 100px;">Control ID</th>
712
+ <th style="width: 200px;">Control Description</th>
713
+ <th style="width: 80px;">Status</th>
714
+ <th>Findings</th>
715
+ </tr>
716
+ </thead>
717
+ <tbody>
718
+ ${complianceMapping.map(control => `
719
+ <tr>
720
+ <td class="control-id">${control.id}</td>
721
+ <td>${control.description}</td>
722
+ <td class="${control.statusClass}">${control.status}</td>
723
+ <td>${control.findings.length > 0
724
+ ? control.findings.map(f => `<span class="finding-ref">${f}</span>`).join(', ')
725
+ : 'No findings'}</td>
726
+ </tr>
727
+ `).join('')}
728
+ </tbody>
729
+ </table>
730
+ </section>
731
+
732
+ <section class="section">
733
+ <h2>4. Findings and Recommendations</h2>
734
+ ${findings && findings.length > 0 ? `
735
+ <p>The following findings were identified during the assessment and require remediation:</p>
736
+
737
+ ${findings.filter(f => f.severity === 'critical' || f.severity === 'BLOCK' || f.severity === 'high').slice(0, 10).map((f, i) => `
738
+ <h3>Finding ${i + 1}: ${sanitizeHtml(f.title || f.message)}</h3>
739
+ <p><strong>Severity:</strong> ${(f.severity || 'medium').toUpperCase()}</p>
740
+ <p><strong>Impact:</strong> ${getComplianceImpact(f.severity)}</p>
741
+ <p><strong>Recommendation:</strong> ${sanitizeHtml(f.fix) || 'Implement appropriate controls to address this finding.'}</p>
742
+ `).join('')}
743
+ ` : `
744
+ <p>No significant findings were identified during this assessment. The application demonstrates strong adherence to ${framework} security controls.</p>
745
+ `}
746
+ </section>
747
+
748
+ <section class="section">
749
+ <h2>5. Management Attestation</h2>
750
+ <p>This security assessment report has been prepared in accordance with ${framework} Trust Services Criteria. The assessment represents a point-in-time evaluation of the security controls implemented within the ${projectName} application.</p>
751
+
752
+ <div class="attestation-box">
753
+ <p>Management of ${company} is responsible for the design, implementation, and maintenance of effective internal controls relevant to the security, availability, processing integrity, confidentiality, and privacy of the ${projectName} application.</p>
754
+ </div>
755
+
756
+ <div class="signature-section">
757
+ <p>Authorized Signatures:</p>
758
+ <div class="signature-line">
759
+ <div class="signature-block">
760
+ <div class="signature-label">Security Officer / Date</div>
761
+ </div>
762
+ <div class="signature-block">
763
+ <div class="signature-label">Engineering Lead / Date</div>
764
+ </div>
765
+ </div>
766
+ </div>
767
+ </section>
768
+
769
+ <footer class="footer">
770
+ <p>This report was generated by VibeCheck Security Assessment Tool · vibecheck.dev</p>
771
+ <p>Report ID: ${data.reportId || 'VC-' + Date.now().toString(36).toUpperCase()}</p>
772
+ </footer>
773
+ </body>
774
+ </html>`;
775
+ }
776
+
777
+ // ============================================================================
778
+ // HELPER FUNCTIONS
779
+ // ============================================================================
780
+
781
+ function formatCategoryName(cat) {
782
+ const names = {
783
+ security: "Security Controls",
784
+ auth: "Authentication & Access",
785
+ billing: "Payment Security",
786
+ routes: "API Security",
787
+ env: "Configuration Management",
788
+ quality: "Code Quality",
789
+ mock: "Data Integrity",
790
+ error: "Error Handling",
791
+ };
792
+ return names[cat] || cat.charAt(0).toUpperCase() + cat.slice(1).replace(/_/g, " ");
793
+ }
794
+
795
+ function getExecutiveSummary(verdict, critical, high, score) {
796
+ if (verdict === "SHIP") {
797
+ return "The application has successfully passed all critical security checks. No blocking vulnerabilities were identified, and the security posture meets production deployment requirements.";
798
+ } else if (verdict === "WARN") {
799
+ return `The application requires attention before production deployment. ${critical > 0 ? `${critical} critical` : `${high} high priority`} security issue${(critical + high) > 1 ? 's were' : ' was'} identified that should be addressed to reduce organizational risk.`;
800
+ } else {
801
+ return `The application is not recommended for production deployment in its current state. ${critical} critical security vulnerabilit${critical > 1 ? 'ies were' : 'y was'} identified that pose significant risk to the organization.`;
802
+ }
803
+ }
804
+
805
+ function getRecommendationTitle(verdict) {
806
+ if (verdict === "SHIP") return "Proceed with Deployment";
807
+ if (verdict === "WARN") return "Address Issues Before Deployment";
808
+ return "Halt Deployment - Remediation Required";
809
+ }
810
+
811
+ function getRecommendationText(verdict, critical, high) {
812
+ if (verdict === "SHIP") {
813
+ return "The security assessment indicates the application is ready for production. Maintain security hygiene through regular assessments.";
814
+ } else if (verdict === "WARN") {
815
+ return `Based on the assessment findings, we recommend addressing the identified issues before proceeding to production. Estimated remediation effort: ${(critical * 2 + high)}–${(critical * 4 + high * 2)} hours.`;
816
+ } else {
817
+ return `Immediate remediation is required before this application should be considered for production deployment. The identified vulnerabilities represent unacceptable risk to the organization.`;
818
+ }
819
+ }
820
+
821
+ function getActionItems(verdict, critical, high) {
822
+ if (verdict === "SHIP") {
823
+ return [
824
+ "Schedule regular security assessments (recommended: quarterly)",
825
+ "Monitor for newly discovered vulnerabilities in dependencies",
826
+ "Maintain security documentation for compliance purposes",
827
+ ];
828
+ } else if (verdict === "WARN") {
829
+ return [
830
+ critical > 0 ? `Resolve ${critical} critical finding${critical > 1 ? 's' : ''} immediately` : `Address ${high} high priority finding${high > 1 ? 's' : ''}`,
831
+ "Conduct security review with engineering team",
832
+ "Re-run assessment after remediation before deployment",
833
+ ];
834
+ } else {
835
+ return [
836
+ `Immediately address all ${critical} critical vulnerabilities`,
837
+ "Implement security review process before any code changes",
838
+ "Consider engaging security consultant for remediation guidance",
839
+ "Do not deploy to production until all critical issues are resolved",
840
+ ];
841
+ }
842
+ }
843
+
844
+ function mapToComplianceControls(findings, framework) {
845
+ // SOC2 Trust Services Criteria mapping
846
+ const controls = [
847
+ { id: "CC6.1", description: "Logical Access Security", category: ["auth", "secret"] },
848
+ { id: "CC6.2", description: "Access Provisioning", category: ["auth"] },
849
+ { id: "CC6.6", description: "Data Transmission Protection", category: ["security", "config"] },
850
+ { id: "CC6.7", description: "Data Destruction", category: ["quality"] },
851
+ { id: "CC7.1", description: "Configuration Management", category: ["config", "env"] },
852
+ { id: "CC7.2", description: "Security Monitoring", category: ["error", "quality"] },
853
+ { id: "CC8.1", description: "Change Management", category: ["quality", "mock"] },
854
+ { id: "CC9.1", description: "Business Continuity", category: ["error"] },
855
+ { id: "PI1.1", description: "Input Validation", category: ["injection", "xss", "security"] },
856
+ { id: "A1.2", description: "System Availability", category: ["error", "route"] },
857
+ ];
858
+
859
+ return controls.map(control => {
860
+ const relatedFindings = findings.filter(f =>
861
+ control.category.includes(f.type) || control.category.includes(f.category)
862
+ );
863
+
864
+ const criticalCount = relatedFindings.filter(f =>
865
+ f.severity === "critical" || f.severity === "BLOCK"
866
+ ).length;
867
+
868
+ const highCount = relatedFindings.filter(f => f.severity === "high").length;
869
+
870
+ let status, statusClass;
871
+ if (criticalCount > 0) {
872
+ status = "Gap";
873
+ statusClass = "status-gap";
874
+ } else if (highCount > 0 || relatedFindings.length > 2) {
875
+ status = "Partial";
876
+ statusClass = "status-partial";
877
+ } else {
878
+ status = "Compliant";
879
+ statusClass = "status-compliant";
880
+ }
881
+
882
+ return {
883
+ ...control,
884
+ status,
885
+ statusClass,
886
+ findings: relatedFindings.slice(0, 3).map(f => f.id),
887
+ };
888
+ });
889
+ }
890
+
891
+ function getComplianceVerdict(score) {
892
+ if (score >= 80) return "Meets Requirements";
893
+ if (score >= 60) return "Partially Meets Requirements";
894
+ return "Does Not Meet Requirements";
895
+ }
896
+
897
+ function getComplianceSummaryText(score, findingCount) {
898
+ if (score >= 80) {
899
+ return `The assessment indicates that ${findingCount > 0 ? 'while minor findings were identified, ' : ''}the application substantially meets the security requirements outlined in the Trust Services Criteria. Continued monitoring and periodic assessments are recommended to maintain compliance.`;
900
+ } else if (score >= 60) {
901
+ return `The assessment identified several areas where the application's security controls require enhancement to fully meet Trust Services Criteria requirements. Remediation of the identified findings is recommended before the next audit period.`;
902
+ } else {
903
+ return `The assessment identified significant gaps in the application's security controls relative to Trust Services Criteria requirements. Management should prioritize remediation of critical and high-severity findings before considering the application compliant.`;
904
+ }
905
+ }
906
+
907
+ function getComplianceImpact(severity) {
908
+ const impacts = {
909
+ critical: "This finding represents a significant risk that could result in unauthorized access, data breach, or system compromise.",
910
+ BLOCK: "This finding represents a significant risk that could result in unauthorized access, data breach, or system compromise.",
911
+ high: "This finding could potentially lead to security incidents if exploited.",
912
+ medium: "This finding represents a moderate risk that should be addressed to maintain security posture.",
913
+ low: "This finding represents a minor risk with limited potential impact.",
914
+ };
915
+ return impacts[severity] || impacts.medium;
916
+ }
917
+
918
+ function sanitizeHtml(str) {
919
+ if (!str) return '';
920
+ return String(str)
921
+ .replace(/&/g, '&amp;')
922
+ .replace(/</g, '&lt;')
923
+ .replace(/>/g, '&gt;')
924
+ .replace(/"/g, '&quot;');
925
+ }
926
+
927
+ /**
928
+ * Generate Technical Report (for developers/CTOs)
929
+ */
930
+ function generateEnhancedTechnicalReport(data, opts = {}) {
931
+ // For technical reports, we use the main HTML generator
932
+ // This is a passthrough - the report-html.js handles technical reports
933
+ const reportHtml = require("./report-html");
934
+
935
+ // Build report data if needed
936
+ const reportData = {
937
+ meta: {
938
+ projectName: data.projectName,
939
+ generatedAt: data.generatedAt,
940
+ version: "2.0.0",
941
+ reportId: data.reportId || 'VC-' + Date.now().toString(36).toUpperCase(),
942
+ },
943
+ summary: {
944
+ score: data.score,
945
+ verdict: data.verdict,
946
+ totalFindings: data.findings?.length || 0,
947
+ severityCounts: {
948
+ critical: data.findings?.filter(f => f.severity === "BLOCK" || f.severity === "critical").length || 0,
949
+ high: data.findings?.filter(f => f.severity === "high").length || 0,
950
+ medium: data.findings?.filter(f => f.severity === "WARN" || f.severity === "medium").length || 0,
951
+ low: data.findings?.filter(f => f.severity === "INFO" || f.severity === "low").length || 0,
952
+ },
953
+ categoryScores: data.categoryScores || {},
954
+ },
955
+ findings: data.findings || [],
956
+ fixEstimates: { humanReadable: "~2h" },
957
+ reality: data.reality || null,
958
+ };
959
+
960
+ return reportHtml.generateWorldClassHTML(reportData, opts);
961
+ }
962
+
963
+ module.exports = {
964
+ generateEnhancedExecutiveReport,
965
+ generateEnhancedComplianceReport,
966
+ generateEnhancedTechnicalReport,
967
+ };