vibecop 0.1.2 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +133 -28
  2. package/dist/cli.js +1188 -700
  3. package/package.json +1 -1
package/README.md CHANGED
@@ -4,11 +4,16 @@
4
4
  [![TypeScript](https://img.shields.io/badge/TypeScript-5.8-blue)](https://www.typescriptlang.org/)
5
5
  [![Node.js](https://img.shields.io/badge/Node.js-%3E%3D20-green)](https://nodejs.org/)
6
6
  [![CI](https://github.com/bhvbhushan/vibecop/actions/workflows/ci.yml/badge.svg)](https://github.com/bhvbhushan/vibecop/actions/workflows/ci.yml)
7
+ [![Playground](https://img.shields.io/badge/Try-Playground-orange)](https://vibecop-pg.bhvbhushan7.com/)
7
8
 
8
- AI code quality toolkit — deterministic linter for the AI coding era. Catches the bugs that AI agents introduce: god functions, N+1 queries, fire-and-forget DB calls, leftover debug logging, and 18 more patterns. Like `eslint` for structural quality, but focused on the antipatterns AI generates.
9
+ AI code quality toolkit — deterministic linter for the AI coding era. 28 detectors catch the bugs AI agents introduce: god functions, N+1 queries, unsafe shell exec, unpinned LLM models, and more. Runs automatically inside Claude Code, Cursor, Codex, Aider, and 3 other AI tools via `vibecop init`.
9
10
 
10
11
  Built on [ast-grep](https://ast-grep.github.io/) for fast, tree-sitter-based AST analysis. No LLM required — every finding is deterministic and reproducible.
11
12
 
13
+ ## Try it Online
14
+
15
+ **[Playground](https://vibecop-pg.bhvbhushan7.com/)** — paste code and scan instantly in your browser.
16
+
12
17
  ## Install
13
18
 
14
19
  ```bash
@@ -40,24 +45,115 @@ vibecop scan . --format text
40
45
  vibecop scan . --config .vibecop.yml
41
46
  ```
42
47
 
48
+ ## Agent Integration
49
+
50
+ vibecop runs automatically inside your AI coding agent. Every time the agent edits a file, vibecop scans the change and blocks on findings — the agent reads the output and fixes the issue before proceeding.
51
+
52
+ ### Auto-setup (recommended)
53
+
54
+ ```bash
55
+ npx vibecop init
56
+ ```
57
+
58
+ Detects which tools you have installed and generates the right config files:
59
+
60
+ ```
61
+ vibecop — agent integration setup
62
+
63
+ Detected tools:
64
+ ✓ Claude Code (.claude/ directory found)
65
+ ✓ Cursor (.cursor/ directory found)
66
+ ✓ Aider (aider installed)
67
+ ✗ Codex CLI (not found)
68
+
69
+ Generated:
70
+ .claude/settings.json — PostToolUse hook (blocks on findings)
71
+ .cursor/hooks.json — afterFileEdit hook
72
+ .cursor/rules/vibecop.md — always-on lint rule
73
+ .aider.conf.yml — lint-cmd per language
74
+
75
+ Done! vibecop will now run automatically in your agent workflow.
76
+ ```
77
+
78
+ ### Supported tools
79
+
80
+ | Tool | Integration | How it works |
81
+ |------|-------------|--------------|
82
+ | **Claude Code** | PostToolUse hook | Runs after every Edit/Write, exit 1 blocks and forces fix |
83
+ | **Cursor** | afterFileEdit hook + rules | Hook runs scan, rules file tells agent to fix findings |
84
+ | **Codex CLI** | PostToolUse hook | Same pattern as Claude Code |
85
+ | **Aider** | Native `--lint-cmd` | Built-in lint integration, runs after every edit |
86
+ | **GitHub Copilot** | Custom instructions | Instructions file tells agent to run vibecop |
87
+ | **Windsurf** | Rules file | `trigger: always_on` rule |
88
+ | **Cline/Roo Code** | `.clinerules` | Rules file tells agent to run vibecop |
89
+
90
+ ### Manual setup (Claude Code example)
91
+
92
+ Add to `.claude/settings.json`:
93
+
94
+ ```json
95
+ {
96
+ "hooks": {
97
+ "PostToolUse": [{
98
+ "matcher": "Edit|Write|MultiEdit",
99
+ "hooks": [{
100
+ "type": "command",
101
+ "command": "npx vibecop scan --diff HEAD --format agent"
102
+ }]
103
+ }]
104
+ }
105
+ }
106
+ ```
107
+
108
+ ### How the loop works
109
+
110
+ ```
111
+ Agent writes code
112
+ → vibecop hook fires automatically
113
+ → Findings? Exit 1 → agent reads output, fixes code
114
+ → No findings? Exit 0 → agent continues
115
+ ```
116
+
117
+ The `--format agent` output is token-efficient (one finding per line, ~30 tokens each):
118
+
119
+ ```
120
+ src/api.ts:42:1 error unsafe-shell-exec: execSync() with template literal. Use execFile() with argument array instead.
121
+ src/llm.ts:18:5 warning llm-unpinned-model: Unpinned model alias "gpt-4o". Pin to a dated version like "gpt-4o-2024-08-06".
122
+ ```
123
+
124
+ See [docs/agent-integration.md](docs/agent-integration.md) for full setup instructions and troubleshooting.
125
+
43
126
  ## Benchmarks
44
127
 
45
- Tested against 10 popular open-source vibe-coded projects (April 2026). These are real results, not synthetic:
128
+ ### Vibe-coded vs established: finding density comparison
129
+
130
+ All numbers below are real — run `vibecop scan` on any of these repos yourself to reproduce. Finding density = findings per 1,000 lines of code.
131
+
132
+ **Established projects (professionally maintained):**
133
+
134
+ | Project | Stars | Files | LOC | Findings | Density |
135
+ |---------|:-----:|:-----:|----:|:--------:|--------:|
136
+ | [**fastify**](https://github.com/fastify/fastify) | 65K | 275 | 74,428 | 124 | 1.7/kLOC |
137
+ | [**date-fns**](https://github.com/date-fns/date-fns) | 35K | 1,543 | 99,859 | 308 | 3.1/kLOC |
138
+ | [**TanStack/query**](https://github.com/TanStack/query) | 43K | 997 | 148,492 | 652 | 4.4/kLOC |
139
+ | [**express**](https://github.com/expressjs/express) | 66K | 141 | 21,346 | 123 | 5.8/kLOC |
140
+ | [**zod**](https://github.com/colinhacks/zod) | 35K | 356 | 70,886 | 964 | 13.6/kLOC |
141
+
142
+ **Vibe-coded projects (AI-generated/assisted):**
143
+
144
+ | Project | Stars | Files | LOC | Findings | Density |
145
+ |---------|:-----:|:-----:|----:|:--------:|--------:|
146
+ | [**dyad**](https://github.com/dyad-sh/dyad) | 20K | 956 | 147,284 | 1,179 | 8.0/kLOC |
147
+ | [**bolt.diy**](https://github.com/stackblitz-labs/bolt.diy) | 19.2K | 392 | 71,639 | 977 | 13.6/kLOC |
148
+ | [**code-review-graph**](https://github.com/tirth8205/code-review-graph) | 3.9K | 95 | 27,119 | 361 | 13.3/kLOC |
149
+ | [**context7**](https://github.com/upstash/context7) | 51.3K | 71 | 9,201 | 129 | 14.0/kLOC |
150
+ | [**vibe-check-mcp**](https://github.com/PV-Bhat/vibe-check-mcp-server) | 480 | 55 | 5,964 | 119 | 20.0/kLOC |
151
+ | [**magic-mcp**](https://github.com/21st-dev/magic-mcp) | 4.6K | 14 | 1,096 | 28 | 25.5/kLOC |
152
+ | [**browser-tools-mcp**](https://github.com/AgentDeskAI/browser-tools-mcp) | 7.2K | 12 | 8,346 | 414 | 49.6/kLOC |
46
153
 
47
- | Project | Stars | Files | Findings | Key Issues Found |
48
- |---------|:-----:|:-----:|:--------:|------------------|
49
- | [**context7**](https://github.com/upstash/context7) | 51.3K | 68 | 118 | 71 console.logs, 21 god functions, 3 N+1 queries |
50
- | [**dyad**](https://github.com/dyad-sh/dyad) | 20K | 970 | 1,104 | 402 god functions, 47 unchecked DB results, 12 placeholder values |
51
- | [**bolt.diy**](https://github.com/stackblitz-labs/bolt.diy) | 19.2K | 398 | 949 | 294 `any` types, 9 `dangerouslySetInnerHTML`, 24 N+1 queries |
52
- | [**screenpipe**](https://github.com/screenpipe/screenpipe) | 17.9K | 362 | 1,340 | 387 `any` types, 236 empty error handlers, 3 dead code paths |
53
- | [**browser-tools-mcp**](https://github.com/AgentDeskAI/browser-tools-mcp) | 7.2K | 12 | 420 | 319 console.logs, 49 `any` types, 15 empty error handlers |
54
- | [**magic-mcp**](https://github.com/21st-dev/magic-mcp) | 4.6K | 14 | 28 | 22 console.logs, 3 empty error handlers, 3 god functions |
55
- | [**code-review-graph**](https://github.com/tirth8205/code-review-graph) | 3.9K | 94 | 410 | 139 unchecked DB results, 71 N+1 queries, 6 SQL injections |
56
- | [**vibe-check-mcp**](https://github.com/PV-Bhat/vibe-check-mcp-server) | 480 | 53 | 113 | 74 console.logs, 18 `any` types, 9 god functions |
57
- | [**codeledger**](https://github.com/bhvbhushan/codeledger) | 3 | 54 | 30 | 13 god functions, 6 SQL injections, 5 `any` types |
58
- | [**mcptest**](https://github.com/bhvbhushan/mcptest) | — | 37 | 1 | 1 god function |
154
+ **Median density: established 4.4/kLOC vs vibe-coded 14.0/kLOC (3.2x higher).** Vibe-coded projects consistently trigger more findings per line of code. The v0.2 detectors found **157 additional issues** across vibe-coded repos that v0.1 missed: 63 unsafe shell executions, 53 unpinned LLM models, 39 missing system messages.
59
155
 
60
- **4,513 findings** across **2,062 files** in 10 vibe-coded projects. Most common antipatterns: god functions (38%), excessive `any` (21%), leftover `console.log` (26%).
156
+ > **Note:** Some established repos show higher-than-expected density for valid reasons — zod uses `any` deliberately for type gymnastics (634 of its 964 findings), date-fns has extensive JSDoc (218 comment-ratio findings). vibecop detects patterns, not intent. Use `.vibecop.yml` to tune or disable detectors for your codebase.
61
157
 
62
158
  ### Example Output
63
159
 
@@ -82,9 +178,9 @@ src/utils/api.ts
82
178
  ✖ 9 problems (3 errors, 5 warnings, 1 info)
83
179
  ```
84
180
 
85
- ## Detectors (22 total)
181
+ ## Detectors (28 total)
86
182
 
87
- ### Quality (12 detectors)
183
+ ### Quality (16 detectors)
88
184
 
89
185
  | ID | Detector | Description | Severity |
90
186
  |----|----------|-------------|----------|
@@ -100,8 +196,12 @@ src/utils/api.ts
100
196
  | `empty-error-handler` | Empty Error Handler | Catch/except blocks that silently swallow errors | warning |
101
197
  | `excessive-comment-ratio` | Excessive Comment Ratio | Files with >50% comment lines | info |
102
198
  | `over-defensive-coding` | Over-Defensive Coding | Redundant null checks on values that can't be null | info |
199
+ | `llm-call-no-timeout` | LLM Call No Timeout | `new OpenAI()`/`new Anthropic()` without timeout, `.create()` without max_tokens | warning |
200
+ | `llm-unpinned-model` | LLM Unpinned Model | Moving model aliases like `"gpt-4o"` that silently change behavior | warning |
201
+ | `llm-temperature-not-set` | LLM Temperature Not Set | LLM `.create()` calls without explicit `temperature` parameter | info |
202
+ | `llm-no-system-message` | LLM No System Message | Chat API calls without a `role: "system"` message | info |
103
203
 
104
- ### Security (5 detectors)
204
+ ### Security (7 detectors)
105
205
 
106
206
  | ID | Detector | Description | Severity |
107
207
  |----|----------|-------------|----------|
@@ -110,14 +210,17 @@ src/utils/api.ts
110
210
  | `token-in-localstorage` | Token in localStorage | Auth/JWT tokens stored in XSS-accessible storage | error |
111
211
  | `placeholder-in-production` | Placeholder in Production | `yourdomain.com`, `changeme`, `xxx` left in config | error |
112
212
  | `insecure-defaults` | Insecure Defaults | `eval()`, `rejectUnauthorized: false`, hardcoded credentials | error |
213
+ | `unsafe-shell-exec` | Unsafe Shell Exec | `exec()`/`execSync()` with dynamic args, `subprocess` with `shell=True` | error |
214
+ | `dynamic-code-exec` | Dynamic Code Exec | `eval(variable)`, `new Function(variable)` with non-literal arguments | error |
113
215
 
114
- ### Correctness (3 detectors)
216
+ ### Correctness (4 detectors)
115
217
 
116
218
  | ID | Detector | Description | Severity |
117
219
  |----|----------|-------------|----------|
118
220
  | `unchecked-db-result` | Unchecked DB Result | Fire-and-forget database mutations (insert/update/delete) | warning |
119
221
  | `undeclared-import` | Undeclared Import | Imports not declared in package.json/requirements.txt | error |
120
222
  | `mixed-concerns` | Mixed Concerns | Files importing both UI frameworks and database/server libraries | warning |
223
+ | `hallucinated-package` | Hallucinated Package | Dependencies not in top-5K npm allowlist (potential AI hallucination) | info |
121
224
 
122
225
  ### Testing (2 detectors)
123
226
 
@@ -198,7 +301,7 @@ pr-gate:
198
301
 
199
302
  | Flag | Description | Default |
200
303
  |------|-------------|---------|
201
- | `--format` | Output format: `text`, `json`, `html`, `sarif`, `github` | `text` |
304
+ | `--format` | Output format: `text`, `json`, `html`, `sarif`, `github`, `agent` | `text` |
202
305
  | `--config` | Path to config file | `.vibecop.yml` |
203
306
  | `--no-config` | Ignore config file | |
204
307
  | `--max-findings` | Maximum findings to report | `100` |
@@ -208,18 +311,19 @@ pr-gate:
208
311
 
209
312
  | Language | Extensions | Detectors |
210
313
  |----------|-----------|-----------|
211
- | TypeScript | `.ts`, `.tsx` | All 22 |
212
- | JavaScript | `.js`, `.jsx`, `.mjs`, `.cjs` | 18 (excludes TS-specific) |
213
- | Python | `.py` | 10 (correctness, quality, security) |
314
+ | TypeScript | `.ts`, `.tsx` | All 28 |
315
+ | JavaScript | `.js`, `.jsx`, `.mjs`, `.cjs` | 24 (excludes TS-specific) |
316
+ | Python | `.py` | 14 (correctness, quality, security) |
214
317
 
215
318
  ## Architecture
216
319
 
217
320
  ```
218
321
  vibecop CLI (Commander)
219
- +-- Scan Engine -- discovers files, loads AST, runs detectors, collects findings
322
+ +-- Scan Engine -- discovers files, loads AST, runs detectors, dedup by priority
323
+ +-- Init Wizard -- auto-detects AI tools, generates hook/rule configs
220
324
  +-- Config Loader (Zod) -- validates .vibecop.yml, merges defaults, per-rule config
221
- +-- Detectors (22) -- AST pattern matching via ast-grep (@ast-grep/napi)
222
- +-- Formatters (5) -- text, json, csv, html, sarif output
325
+ +-- Detectors (28) -- AST pattern matching via ast-grep (@ast-grep/napi)
326
+ +-- Formatters (6) -- text, json, html, sarif, github, agent output
223
327
  +-- Project Analyzer -- parses package.json, requirements.txt, lockfiles
224
328
  +-- GitHub Action -- diff parser, finding filter, PR review poster
225
329
  ```
@@ -236,8 +340,9 @@ vibecop follows [Semantic Versioning](https://semver.org/):
236
340
  ## Roadmap
237
341
 
238
342
  - [x] **Phase 1**: Core scanner with 7 detectors, 5 output formats, `.vibecop.yml` config
239
- - [x] **Phase 2**: PR Gate GitHub Action, 15 new detectors (7 → 22), monorepo support, real-world validation
240
- - [ ] **Phase 3**: Cross-file analysis (duplicate code detection, repeated constants), npm publish
343
+ - [x] **Phase 2**: PR Gate GitHub Action, 15 new detectors (7 → 22), real-world validation
344
+ - [x] **Phase 2.5**: Agent integration (7 tools), 6 LLM/agent detectors (22 → 28), `vibecop init`, `--format agent`
345
+ - [ ] **Phase 3**: MCP server, VS Code extension, cross-file analysis
241
346
  - [ ] **Phase 4**: LLM-powered deep review mode (separation of concerns, semantic duplication)
242
347
 
243
348
  ## Contributing