xploitscan 1.1.11 → 1.2.1

package/dist/index.js

@@ -7,6 +7,7 @@ import {
   clearProRulesCache,
   clearToken,
   detectFramework,
+  detectPlatform,
   downloadProRulesBundle,
   filterFalsePositives,
   getStoredToken,
@@ -18,22 +19,73 @@ import {
   storeToken,
   syncUser,
   uploadScanResults
-} from "./chunk-HYXMH2H6.js";
+} from "./chunk-4OFR3SIS.js";
 
 // src/index.ts
 import { Command } from "commander";
 
 // src/commands/scan.ts
-import { resolve as resolve2, join as join5 } from "path";
-import { watch as fsWatch } from "fs";
+import { resolve as resolve2, join as join6 } from "path";
+import { watch as fsWatch, existsSync as existsSync5 } from "fs";
 import ora from "ora";
 import chalk2 from "chalk";
 
 // src/utils/files.ts
 import fg from "fast-glob";
+import ignore2 from "ignore";
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
+import { join as join2, resolve } from "path";
+
+// src/utils/ignore-rules.ts
 import ignore from "ignore";
 import { readFileSync, existsSync } from "fs";
-import { join, resolve } from "path";
+import { join } from "path";
+var RULE_TOKEN = "(?:VC\\d+|scanner)";
+var RULE_SCOPED_RE = new RegExp(
+  `^\\s*([^#].*?\\S)\\s+(${RULE_TOKEN}(?:\\s*,\\s*${RULE_TOKEN})*)\\s*$`,
+  "i"
+);
+function isRuleScopedLine(line) {
+  return RULE_SCOPED_RE.test(line);
+}
+function parseRuleIgnores(content) {
+  const entries = [];
+  for (const line of content.split("\n")) {
+    const m = line.match(RULE_SCOPED_RE);
+    if (!m) continue;
+    const glob = m[1].trim();
+    const rules = new Set(
+      m[2].split(",").map((r) => r.trim().toUpperCase())
+    );
+    entries.push({ matcher: ignore.default().add(glob), rules, raw: line.trim() });
+  }
+  return entries;
+}
+function loadRuleIgnores(dir) {
+  const p = join(dir, ".xploitscanignore");
+  if (!existsSync(p)) return [];
+  try {
+    return parseRuleIgnores(readFileSync(p, "utf-8"));
+  } catch {
+    return [];
+  }
+}
+function applyRuleIgnores(findings, entries) {
+  if (entries.length === 0) return { kept: findings, suppressed: [] };
+  const kept = [];
+  const suppressed = [];
+  for (const f of findings) {
+    const rule = (f.rule ?? "").toUpperCase();
+    const hit = entries.some(
+      (e) => e.matcher.ignores(f.file) && (e.rules.has("SCANNER") || e.rules.has(rule))
+    );
+    if (hit) suppressed.push(f);
+    else kept.push(f);
+  }
+  return { kept, suppressed };
+}
+
+// src/utils/files.ts
 var SOURCE_EXTENSIONS = [
   "js",
   "jsx",
@@ -165,15 +217,15 @@ var ALWAYS_IGNORE = [
   "vulnerable-samples/**"
 ];
 async function collectFiles(directory) {
-  const ig = ignore.default();
-  const gitignorePath = join(directory, ".gitignore");
-  if (existsSync(gitignorePath)) {
-    const gitignoreContent = readFileSync(gitignorePath, "utf-8");
+  const ig = ignore2.default();
+  const gitignorePath = join2(directory, ".gitignore");
+  if (existsSync2(gitignorePath)) {
+    const gitignoreContent = readFileSync2(gitignorePath, "utf-8");
     ig.add(gitignoreContent);
   }
-  const xploitscanIgnorePath = join(directory, ".xploitscanignore");
-  if (existsSync(xploitscanIgnorePath)) {
-    const xploitscanIgnoreContent = readFileSync(xploitscanIgnorePath, "utf-8");
+  const xploitscanIgnorePath = join2(directory, ".xploitscanignore");
+  if (existsSync2(xploitscanIgnorePath)) {
+    const xploitscanIgnoreContent = readFileSync2(xploitscanIgnorePath, "utf-8").split("\n").filter((line) => !isRuleScopedLine(line)).join("\n");
     ig.add(xploitscanIgnoreContent);
   }
   ig.add(ALWAYS_IGNORE);
@@ -193,11 +245,11 @@ async function collectFiles(directory) {
 }
 function readFileContents(directory, filePath) {
   try {
-    const fullPath = resolve(join(directory, filePath));
+    const fullPath = resolve(join2(directory, filePath));
     if (!fullPath.startsWith(resolve(directory))) {
       throw new Error("Path traversal detected");
     }
-    return readFileSync(fullPath, "utf-8");
+    return readFileSync2(fullPath, "utf-8");
   } catch {
     return null;
   }
@@ -215,8 +267,8 @@ function getSnippet(content, line, contextLines = 2) {
 
 // src/utils/config.ts
 import { cosmiconfig } from "cosmiconfig";
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
 var defaults = {
   exclude: [],
   ai: true,
@@ -225,8 +277,8 @@ var defaults = {
 };
 function loadXploitscanRc(directory) {
   try {
-    const rcPath = join2(directory, ".xploitscanrc");
-    const content = readFileSync2(rcPath, "utf-8");
+    const rcPath = join3(directory, ".xploitscanrc");
+    const content = readFileSync3(rcPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -297,9 +349,9 @@ async function loadConfig(directory) {
 
 // src/scanners/semgrep.ts
 import { execFile } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { readFile, mkdtemp, rm } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { tmpdir } from "os";
 var SEVERITY_MAP = {
   error: "high",
@@ -323,8 +375,8 @@ async function runSemgrep(directory, customRulesDir) {
     return { findings: [], available: false };
   }
   const findings = [];
-  const tmpDir = await mkdtemp(join3(tmpdir(), "xploitscan-semgrep-"));
-  const sarifPath = join3(tmpDir, "results.sarif");
+  const tmpDir = await mkdtemp(join4(tmpdir(), "xploitscan-semgrep-"));
+  const sarifPath = join4(tmpDir, "results.sarif");
   try {
     const args = [
       "scan",
@@ -340,7 +392,7 @@ async function runSemgrep(directory, customRulesDir) {
       "1000000"
     ];
     args.push("--config", "auto");
-    if (customRulesDir && existsSync2(customRulesDir)) {
+    if (customRulesDir && existsSync3(customRulesDir)) {
       args.push("--config", customRulesDir);
     }
     args.push(directory);
@@ -358,7 +410,7 @@ async function runSemgrep(directory, customRulesDir) {
         }
       );
     });
-    if (!existsSync2(sarifPath)) return { findings, available: true };
+    if (!existsSync3(sarifPath)) return { findings, available: true };
     const sarifContent = await readFile(sarifPath, "utf-8");
     const sarif = JSON.parse(sarifContent);
     for (const run of sarif.runs ?? []) {
@@ -416,8 +468,8 @@ function truncate(str, max) {
 // src/scanners/gitleaks.ts
 import { execFile as execFile2 } from "child_process";
 import { readFile as readFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
-import { existsSync as existsSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { join as join5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 var RULE_SEVERITY = {
   "aws-access-token": "critical",
@@ -451,8 +503,8 @@ async function runGitleaks(directory) {
     return { findings: [], available: false };
   }
   const findings = [];
-  const tmpDir = await mkdtemp2(join4(tmpdir2(), "xploitscan-gitleaks-"));
-  const reportPath = join4(tmpDir, "results.json");
+  const tmpDir = await mkdtemp2(join5(tmpdir2(), "xploitscan-gitleaks-"));
+  const reportPath = join5(tmpDir, "results.json");
   try {
     const args = [
       "detect",
@@ -482,7 +534,7 @@ async function runGitleaks(directory) {
         }
       );
     });
-    if (!existsSync3(reportPath)) return { findings, available: true };
+    if (!existsSync4(reportPath)) return { findings, available: true };
     const reportContent = await readFile2(reportPath, "utf-8");
     if (!reportContent.trim()) return { findings, available: true };
     const results = JSON.parse(reportContent);
@@ -1718,6 +1770,21 @@ function renderTerminalReport(result, files) {
     if (frameworks.length > 0 && frameworks[0] !== "unknown") {
       console.log(chalk.gray("  Frameworks: ") + chalk.white(frameworks.join(", ")));
     }
+    const platforms = detectPlatform(files);
+    if (platforms.length > 0) {
+      const PLATFORM_LABELS = {
+        lovable: "Lovable",
+        bolt: "Bolt",
+        replit: "Replit",
+        cursor: "Cursor",
+        v0: "v0",
+        "claude-code": "Claude Code"
+      };
+      const labels = platforms.map((p) => PLATFORM_LABELS[p] ?? p);
+      console.log(
+        chalk.gray("  Detected: ") + chalk.cyan(labels.join(" + ") + " project") + chalk.gray(" \u2014 rules tuned for what these tools ship by default")
+      );
+    }
   }
   const GRADE_PERCENTILES = { "A+": 98, "A": 90, "B": 70, "C": 45, "D": 20, "F": 5 };
   const { grade, score, summary } = calculateGrade(findings, filesScanned);
@@ -2163,8 +2230,8 @@ ${isMonthlyCap ? "Monthly" : "Daily"} scan limit reached.`));
   }
   spinner.text = "Running external scanners...";
   spinner.color = "yellow";
-  const rulesDir = resolve2(join5(import.meta.dirname, "../../rules"));
-  const fallbackRulesDir = resolve2(join5(dir, "../rules"));
+  const rulesDir = resolve2(join6(import.meta.dirname, "../../rules"));
+  const fallbackRulesDir = resolve2(join6(dir, "../rules"));
   const [semgrepResult, gitleaksResult] = await Promise.allSettled([
     runSemgrep(dir, rulesDir).catch(() => runSemgrep(dir, fallbackRulesDir)).catch(() => ({ findings: [], available: false })),
     runGitleaks(dir).catch(() => ({ findings: [], available: false }))
@@ -2252,12 +2319,23 @@ ${isMonthlyCap ? "Monthly" : "Daily"} scan limit reached.`));
   }
   spinner.stop();
   const seen = /* @__PURE__ */ new Set();
-  const dedupedFindings = allFindings.filter((f) => {
+  const afterDedup = allFindings.filter((f) => {
     const ruleKey = f.source === "gitleaks" ? `secret:${f.file}:${f.line}` : `${f.rule}:${f.file}:${f.line}`;
     if (seen.has(ruleKey)) return false;
     seen.add(ruleKey);
     return true;
   });
+  const { kept: dedupedFindings, suppressed: ruleSuppressed } = applyRuleIgnores(
+    afterDedup,
+    loadRuleIgnores(dir)
+  );
+  if (verbose && ruleSuppressed.length > 0 && !isSilent) {
+    console.log(
+      chalk2.gray(
+        `  .xploitscanignore suppressed ${ruleSuppressed.length} finding${ruleSuppressed.length === 1 ? "" : "s"} by rule scope`
+      )
+    );
+  }
   const result = {
     findings: dedupedFindings,
     filesScanned: files.length,
@@ -2265,6 +2343,17 @@ ${isMonthlyCap ? "Monthly" : "Daily"} scan limit reached.`));
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     directory: dir
   };
+  const PLATFORM_MARKERS = [
+    ".cursorrules",
+    ".cursor/",
+    ".replit",
+    "replit.nix",
+    ".bolt/",
+    ".stackblitzrc",
+    "CLAUDE.md",
+    ".claude/"
+  ];
+  const platformMarkerFiles = PLATFORM_MARKERS.filter((m) => existsSync5(join6(dir, m.replace(/\/$/, "")))).map((m) => ({ path: m, content: "" }));
   switch (format) {
     case "json":
       renderJsonReport(result);
@@ -2282,7 +2371,7 @@ ${isMonthlyCap ? "Monthly" : "Daily"} scan limit reached.`));
       renderDatadogReport(result);
       break;
     default:
-      renderTerminalReport(result, fileContentsForAnalysis);
+      renderTerminalReport(result, [...fileContentsForAnalysis, ...platformMarkerFiles]);
       break;
   }
   if (aiReviewed && !isSilent) {
@@ -2511,13 +2600,13 @@ Open this URL in your browser to log in:`));
 // src/commands/hook.ts
 import { execSync } from "child_process";
 import {
-  existsSync as existsSync4,
-  readFileSync as readFileSync3,
+  existsSync as existsSync6,
+  readFileSync as readFileSync4,
   writeFileSync,
   chmodSync,
   unlinkSync
 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import chalk4 from "chalk";
 var HOOK_START_MARKER = "# xploitscan-hook-start";
 var HOOK_END_MARKER = "# xploitscan-hook-end";
@@ -2570,12 +2659,12 @@ async function installHookCommand(options) {
     console.log(chalk4.gray("  Run this command from inside a git repo."));
     process.exit(1);
   }
-  const hooksDir = join6(gitRoot, ".git", "hooks");
-  const hookPath = join6(hooksDir, "pre-commit");
+  const hooksDir = join7(gitRoot, ".git", "hooks");
+  const hookPath = join7(hooksDir, "pre-commit");
   let existingContent = "";
   let hadExisting = false;
-  if (existsSync4(hookPath)) {
-    existingContent = readFileSync3(hookPath, "utf-8");
+  if (existsSync6(hookPath)) {
+    existingContent = readFileSync4(hookPath, "utf-8");
     hadExisting = true;
     const alreadyInstalled = existingContent.includes(HOOK_START_MARKER) && existingContent.includes(HOOK_END_MARKER);
     if (alreadyInstalled && !options.force) {
@@ -2620,12 +2709,12 @@ async function uninstallHookCommand() {
     console.log(chalk4.gray("  Run this command from inside a git repo."));
     process.exit(1);
   }
-  const hookPath = join6(gitRoot, ".git", "hooks", "pre-commit");
-  if (!existsSync4(hookPath)) {
+  const hookPath = join7(gitRoot, ".git", "hooks", "pre-commit");
+  if (!existsSync6(hookPath)) {
     console.log(chalk4.yellow("\u26A0  No pre-commit hook found. Nothing to uninstall."));
     return;
   }
-  const content = readFileSync3(hookPath, "utf-8");
+  const content = readFileSync4(hookPath, "utf-8");
   if (!content.includes(HOOK_START_MARKER)) {
     console.log(chalk4.yellow("\u26A0  XploitScan hook not found in pre-commit file."));
     console.log(chalk4.gray("  Nothing to remove."));
@@ -2651,28 +2740,28 @@ async function uninstallHookCommand() {
 
 // src/commands/cursor.ts
 import chalk5 from "chalk";
-import { mkdirSync, existsSync as existsSync5, writeFileSync as writeFileSync2, readFileSync as readFileSync4 } from "fs";
-import { join as join7, dirname } from "path";
+import { mkdirSync, existsSync as existsSync7, writeFileSync as writeFileSync2, readFileSync as readFileSync5 } from "fs";
+import { join as join8, dirname } from "path";
 import { fileURLToPath } from "url";
 async function cursorInstallCommand(opts = {}) {
   const cwd = process.cwd();
   const here = dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    join7(here, "templates"),
-    join7(here, "..", "templates"),
-    join7(here, "..", "src", "templates")
+    join8(here, "templates"),
+    join8(here, "..", "templates"),
+    join8(here, "..", "src", "templates")
   ];
-  const templatesDir = candidates.find((p) => existsSync5(join7(p, "cursor-security.mdc")));
+  const templatesDir = candidates.find((p) => existsSync7(join8(p, "cursor-security.mdc")));
   if (!templatesDir) {
     console.error(chalk5.red("Could not locate XploitScan rule templates. Try reinstalling: npm i -g xploitscan@latest"));
     process.exit(1);
   }
-  const mdcSrc = readFileSync4(join7(templatesDir, "cursor-security.mdc"), "utf-8");
-  const legacySrc = readFileSync4(join7(templatesDir, "cursorrules-legacy.txt"), "utf-8");
+  const mdcSrc = readFileSync5(join8(templatesDir, "cursor-security.mdc"), "utf-8");
+  const legacySrc = readFileSync5(join8(templatesDir, "cursorrules-legacy.txt"), "utf-8");
   if (!opts.legacyOnly) {
-    const mdcDir = join7(cwd, ".cursor", "rules");
-    const mdcPath = join7(mdcDir, "xploitscan-security.mdc");
-    if (existsSync5(mdcPath) && !opts.force) {
+    const mdcDir = join8(cwd, ".cursor", "rules");
+    const mdcPath = join8(mdcDir, "xploitscan-security.mdc");
+    if (existsSync7(mdcPath) && !opts.force) {
       console.log(chalk5.yellow(`Skipping ${mdcPath} (already exists, use --force to overwrite)`));
     } else {
       mkdirSync(mdcDir, { recursive: true });
@@ -2680,8 +2769,8 @@ async function cursorInstallCommand(opts = {}) {
       console.log(chalk5.green(`Installed ${mdcPath}`));
     }
   }
-  const legacyPath = join7(cwd, ".cursorrules");
-  if (existsSync5(legacyPath) && !opts.force) {
+  const legacyPath = join8(cwd, ".cursorrules");
+  if (existsSync7(legacyPath) && !opts.force) {
     console.log(chalk5.yellow(`Skipping ${legacyPath} (already exists, use --force to overwrite)`));
   } else {
     writeFileSync2(legacyPath, legacySrc);
@@ -2696,7 +2785,7 @@ async function cursorInstallCommand(opts = {}) {
 var program = new Command();
 program.name("xploitscan").description(
   "AI security scanner for vibe-coded apps. Find vulnerabilities before attackers do."
-).version("1.1.11");
+).version("1.2.1");
 program.command("scan").description("Scan a directory for security vulnerabilities").argument("[directory]", "Directory to scan", ".").option("--no-ai", "Skip AI-powered analysis").option(
   "-f, --format <format>",
   "Output format: terminal, json, sarif, splunk-hec, elastic-ecs, datadog-logs",
@@ -2725,7 +2814,7 @@ cursor.command("install").description("Drop XploitScan security rules into .curs
   await cursorInstallCommand({ force: opts.force, legacyOnly: opts.legacyOnly });
 });
 program.command("upgrade").description("Upgrade to XploitScan Pro for unlimited scans").action(async () => {
-  const { getStoredToken: getStoredToken2, getCheckoutUrl } = await import("./api-GHG3FCFB.js");
+  const { getStoredToken: getStoredToken2, getCheckoutUrl } = await import("./api-MFCSQQ2Y.js");
   const chalk6 = (await import("chalk")).default;
   const token = getStoredToken2();
   if (!token) {