wolverine-ai 4.6.0 → 4.6.1

package/bin/wolverine.js

@@ -70,7 +70,20 @@ if (args.includes("--init")) {
   console.log(chalk.gray(`     Database: ${ctx.database.type || "none"}${ctx.database.tables.length > 0 ? ` (${ctx.database.tables.length} tables)` : ""}`));
   console.log(chalk.gray(`     Env vars: ${ctx.envVars.length}`));
   console.log(chalk.gray(`     Files: ${ctx.structure.length}`));
-  console.log(chalk.gray(`     Saved to: .wolverine/server-context.json\n`));
+  console.log(chalk.gray(`     Saved to: .wolverine/server-context.json`));
+  if (ctx.warnings && ctx.warnings.length > 0) {
+    console.log(chalk.yellow(`\n  ⚠️  Security warnings (${ctx.warnings.length}):`));
+    const seen = new Set();
+    for (const w of ctx.warnings) {
+      const key = `${w.file}:${w.type}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      console.log(chalk.yellow(`     ${w.file}: ${w.label}`));
+    }
+  } else {
+    console.log(chalk.green(`     No security warnings`));
+  }
+  console.log("");
   process.exit(0);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolverine-ai",
-  "version": "4.6.0",
+  "version": "4.6.1",
   "description": "Self-healing Node.js server framework powered by AI. Catches crashes, diagnoses errors, generates fixes, verifies, and restarts — automatically.",
   "main": "src/index.js",
   "bin": {

package/src/core/runner.js

@@ -213,11 +213,13 @@ class WolverineRunner {
 
     // Scan server context (routes, DB, config, deps) for agent knowledge
     try {
-      const { scan, load } = require("./server-context");
+      const { scan } = require("./server-context");
       const ctx = scan(this.cwd);
       if (ctx) {
         const routes = ctx.routes.reduce((s, r) => s + r.endpoints.length, 0);
+        const warns = (ctx.warnings || []).length;
         console.log(chalk.gray(`  🗺️  Server context: ${routes} routes, ${ctx.structure.length} files, ${ctx.envVars.length} env vars`));
+        if (warns > 0) console.log(chalk.yellow(`  ⚠️  ${warns} security warning(s) — run wolverine --init for details`));
       }
     } catch {}
 

package/src/core/server-context.js

@@ -168,12 +168,60 @@ function scan(cwd) {
   scanForEnv(serverDir);
   context.envVars = [...envVars].sort();
 
+  // 8. Security scan — detect dangerous patterns in server code
+  context.warnings = [];
+  const scanForDangers = (dir) => {
+    if (!fs.existsSync(dir)) return;
+    for (const file of _listFiles(dir, ".js")) {
+      try {
+        const code = fs.readFileSync(file, "utf-8");
+        const rel = path.relative(cwd, file);
+        // Hardcoded secrets
+        if (/['"][a-zA-Z0-9_-]{20,}['"]/.test(code)) {
+          const secretPatterns = [
+            { regex: /sk-[a-zA-Z0-9]{20,}/g, label: "OpenAI API key" },
+            { regex: /sk-ant-[a-zA-Z0-9_-]{20,}/g, label: "Anthropic API key" },
+            { regex: /ghp_[a-zA-Z0-9]{36,}/g, label: "GitHub token" },
+            { regex: /AKIA[0-9A-Z]{16}/g, label: "AWS access key" },
+            { regex: /['"](?:password|secret|token|api_key|apikey|auth)\s*['"]?\s*[:=]\s*['"][^'"]{8,}['"]/gi, label: "Hardcoded credential" },
+            { regex: /mongodb\+srv:\/\/[^\s'"]+/g, label: "MongoDB connection string" },
+            { regex: /postgres:\/\/[^\s'"]+/g, label: "PostgreSQL connection string" },
+            { regex: /redis:\/\/[^\s'"]+/g, label: "Redis connection string" },
+          ];
+          for (const p of secretPatterns) {
+            if (p.regex.test(code)) {
+              context.warnings.push({ file: rel, type: "hardcoded_secret", label: p.label });
+              p.regex.lastIndex = 0;
+            }
+          }
+        }
+        // eval / Function constructor
+        if (/\beval\s*\(/.test(code)) context.warnings.push({ file: rel, type: "eval_usage", label: "eval() call" });
+        if (/new\s+Function\s*\(/.test(code)) context.warnings.push({ file: rel, type: "function_constructor", label: "new Function() call" });
+        // SQL injection risk (string concat in queries)
+        if (/\.(query|exec|prepare)\s*\(\s*['"`].*\$\{/.test(code) || /\.(query|exec)\s*\(\s*.*\+\s*(?:req|args|params|body)/i.test(code)) {
+          context.warnings.push({ file: rel, type: "sql_injection_risk", label: "String concatenation in SQL query" });
+        }
+        // Unvalidated redirect
+        if (/res\.redirect\s*\(\s*(?:req\.|args\.|params\.)/.test(code)) {
+          context.warnings.push({ file: rel, type: "open_redirect", label: "Unvalidated redirect from user input" });
+        }
+      } catch {}
+    }
+  };
+  scanForDangers(serverDir);
+
+  // Sanitize: strip any actual secret values that might have leaked into context
+  const contextStr = JSON.stringify(context);
+  const { redact } = require("../security/secret-redactor");
+  const sanitized = JSON.parse(redact(contextStr));
+
   // Save
   const outPath = path.join(cwd, CONTEXT_PATH);
   fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, JSON.stringify(context, null, 2), "utf-8");
+  fs.writeFileSync(outPath, JSON.stringify(sanitized, null, 2), "utf-8");
 
-  return context;
+  return sanitized;
 }
 
 /**