vibexray 0.1.0__tar.gz

vibexray-0.1.0/.agents/plugins/marketplace.json

@@ -0,0 +1,11 @@
+{
+  "name": "vibexray",
+  "plugins": [
+    {
+      "name": "vibexray",
+      "source": { "source": "local", "path": "./" },
+      "policy": { "installation": "AVAILABLE", "authentication": "ON_INSTALL" },
+      "category": "Productivity"
+    }
+  ]
+}

vibexray-0.1.0/.claude-plugin/marketplace.json

@@ -0,0 +1,12 @@
+{
+  "name": "vibexray",
+  "description": "Marketplace for the vibexray plugin",
+  "owner": { "name": "Xavier Puspus" },
+  "plugins": [
+    {
+      "name": "vibexray",
+      "source": "./",
+      "description": "X-ray a prototype built with AI and write a PM report and an engineer handoff"
+    }
+  ]
+}

vibexray-0.1.0/.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "vibexray",
+  "version": "0.1.0",
+  "description": "X-ray a prototype built with AI: what is real, what is fake, what can break, and what the PM must decide",
+  "author": { "name": "Xavier Puspus" },
+  "repository": "https://github.com/xmpuspus/vibexray",
+  "license": "MIT",
+  "keywords": ["prototype", "handoff", "vibe-coding", "product-management", "agent-skills"]
+}

vibexray-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,70 @@
+name: Bug report
+description: Report a wrong finding, a crash, or a broken report
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened
+      description: Describe the problem. For a wrong finding, give the rule ID or the review entry.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to repeat
+      description: The command or prompt you ran, in order.
+      placeholder: |
+        1. Run `vibexray scan ./my-prototype --no-run`
+        2. Open `vibexray-report/report.html`
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_actual
+    attributes:
+      label: Expected and actual result
+      description: What you expected, and what you got.
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Output of `vibexray --version`
+      placeholder: "vibexray 0.1.0"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: host
+    attributes:
+      label: Host
+      options:
+        - Claude Code
+        - Codex
+        - Command line only
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - macOS
+        - Linux
+        - Windows
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or screenshots
+      description: Paste the terminal output. Remove any secret before you paste.
+    validations:
+      required: false

vibexray-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/xmpuspus/vibexray/security/advisories/new
+    about: Report a vulnerability in a private advisory. Do not open a public issue.

vibexray-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,27 @@
+name: Feature request
+description: Suggest a new rule, a report change, or a new host
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What you want
+      description: Describe the feature.
+    validations:
+      required: true
+
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Problem it solves
+      description: What does the PM or the engineer miss today? For a new rule, link a public repo that shows the pattern.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed_solution
+    attributes:
+      label: Proposed behavior
+      description: The finding, flag, or report section you have in mind.
+    validations:
+      required: false

vibexray-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+## Summary
+
+<!-- What does this PR change, and why? -->
+
+## Changes
+
+- [ ] <!-- one change -->
+
+## Checks
+
+- [ ] `make lint` passes
+- [ ] `make test` passes
+- [ ] `make bundle` ran after any change in `src/`
+- [ ] A new rule has a test on real code from a public prototype repo
+
+## Related issues
+
+<!-- Closes #N, or N/A -->

vibexray-0.1.0/.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+    groups:
+      python-deps:
+        patterns: ["*"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    labels:
+      - "ci"
+    groups:
+      actions:
+        patterns: ["*"]

vibexray-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: ${{ matrix.python-version }}
+      - name: Install
+        run: uv sync --extra dev
+      - name: Ruff check
+        run: uv run ruff check .
+      - name: Ruff format check
+        run: uv run ruff format --check .
+      - name: Test
+        run: uv run pytest -q -m "not corpus and not browser"

vibexray-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,67 @@
+name: Publish
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Install
+        run: uv sync --extra dev
+      - name: Test
+        run: uv run pytest -q -m "not corpus and not browser"
+      - name: Build
+        run: uv build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  smoke:
+    name: Fresh-venv install and CLI smoke
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install the wheel in a clean venv
+        run: |
+          python -m venv /tmp/smoke-venv
+          /tmp/smoke-venv/bin/pip install dist/*.whl
+      - name: Run every command
+        run: |
+          mkdir -p /tmp/tiny-app
+          printf 'print("hello")\n' > /tmp/tiny-app/app.py
+          /tmp/smoke-venv/bin/vibexray --version
+          /tmp/smoke-venv/bin/vibexray rules
+          /tmp/smoke-venv/bin/vibexray scan /tmp/tiny-app --out /tmp/tiny-out --no-run --no-history
+          test -f /tmp/tiny-out/report.html
+          test -f /tmp/tiny-out/handoff.md
+          test -f /tmp/tiny-out/vibexray.json
+
+  # Trusted publishing needs a PyPI publisher for this repo, workflow, and the pypi
+  # environment. Set the repo variable PYPI_TRUSTED_PUBLISHER to true after you add it.
+  publish:
+    needs: smoke
+    if: vars.PYPI_TRUSTED_PUBLISHER == 'true'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

vibexray-0.1.0/.gitignore

@@ -0,0 +1,20 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.venv/
+venv/
+.env
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+.DS_Store
+.idea/
+.vscode/
+.claude-wt/
+.claude/
+.cache/
+tmp/
+vibexray-report/

vibexray-0.1.0/.gitleaksignore

@@ -0,0 +1,5 @@
+# Fake keys that the redaction tests use as input. None is a real credential.
+7de76c024c16121768a41dc7f7c3b5bda6d8ad8b:tests/test_no_key_leaks.py:generic-api-key:17
+7de76c024c16121768a41dc7f7c3b5bda6d8ad8b:tests/test_no_key_leaks.py:generic-api-key:48
+a9a89c1369867b294d34e5544e428b5720132bc4:tests/test_redact.py:generic-api-key:25
+a9a89c1369867b294d34e5544e428b5720132bc4:tests/test_redact.py:stripe-access-token:26

vibexray-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,21 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.0
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+        exclude: ^tests/fixtures/
+      - id: end-of-file-fixer
+        exclude: ^tests/fixtures/
+      - id: check-yaml
+      - id: check-added-large-files
+        args: [--maxkb=2500]
+      - id: check-merge-conflict
+      - id: detect-private-key
+        exclude: ^tests/fixtures/

vibexray-0.1.0/AGENTS.md

@@ -0,0 +1,42 @@
+# vibexray repository guide
+
+## Scope
+
+vibexray reads an AI-built prototype and writes a handoff. The PM reads `report.html`. The engineer and the coding agent read `handoff.md`. Tools read `vibexray.json`.
+
+## Layout
+
+- `src/vibexray/` holds the package. `cli.py` runs the stages in order.
+- `src/vibexray/rules/` holds the detection rules. Each rule returns findings with a file and a line.
+- `src/vibexray/report/` makes the HTML report, the markdown handoff, and the JSON output.
+- `skills/vibexray/` holds the Agent Skill for Claude Code and Codex.
+- `tests/` holds unit tests, CLI tests, corpus tests, and browser tests.
+- `tests/corpus/` holds the pinned list of real prototype repos and their hand labels.
+- `scripts/` holds the corpus fetch, skill bundle, and demo recording scripts.
+- `docs/` holds the GIFs, the logo, and their recipes.
+
+## Setup
+
+```bash
+uv venv && uv pip install -e ".[dev]"
+uv run playwright install chromium
+make corpus
+```
+
+## Checks
+
+```bash
+make lint
+make test
+make e2e
+```
+
+## Contracts
+
+- Every finding names a file and a line from the scanned repo. A rule never guesses.
+- Tests use real code from public prototype repos. Never write mock or made-up fixtures.
+- The hand labels in `tests/corpus/labels/` are the answer key. Never edit a label to make a test pass.
+- The scan runs no third-party code unless the user asks for an app run. An app run installs with `--ignore-scripts` and a clean environment.
+- The report never shows a secret value. `rules/base.py` hides key-shaped strings.
+- Every report section shows explicit text when it has no data. A blank panel is a bug.
+- The skill folder carries a copy of the package. Run `make bundle` after any change in `src/`. A test fails if the copy is stale.

vibexray-0.1.0/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to this project are in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The project follows [Semantic Versioning](https://semver.org/).
+
+## [0.1.0] - 2026-10-04
+
+First release.
+
+### Added
+
+- The `vibexray` command line tool with the `scan`, `review`, and `rules` commands.
+- 72 pattern rules for fake data, fake actions, open access, database rules, secrets, and AI tools.
+- The app run. It starts the prototype in a temporary copy, visits up to 8 pages, and saves screenshots.
+- The build-chat reader for Claude Code and Codex sessions of the scanned folder.
+- The PM report (`report.html`), the engineer handoff (`handoff.md`), and `vibexray.json`.
+- The AI review step. `vibexray review` keeps a host finding only if its quote is on the cited line.
+- The Agent Skill in `skills/vibexray/`, with a bundled copy of the package and a launcher.
+- Plugin manifests for Claude Code and Codex.
+
+[0.1.0]: https://github.com/xmpuspus/vibexray/releases/tag/v0.1.0

vibexray-0.1.0/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

vibexray-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,27 @@
+# Code of conduct
+
+## Our pledge
+
+We want this project to be open and welcoming. We ask every participant to treat others with respect.
+
+## Expected behavior
+
+- Be kind and patient with other people.
+- Accept feedback on your work in good faith.
+- Focus on what helps the project and its users.
+
+## Unacceptable behavior
+
+- Harassment, insults, or personal attacks.
+- Public or private threats.
+- Publishing the private information of others.
+
+## Enforcement
+
+Maintainers remove comments, commits, and issues that break this code. They can block repeat offenders.
+
+Report a problem by opening a private security advisory on the [GitHub repository](https://github.com/xmpuspus/vibexray/security/advisories/new). Maintainers review every report and keep the reporter private.
+
+## Attribution
+
+This code adapts the [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/), version 2.1.

vibexray-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,29 @@
+# Contributing
+
+## Set up
+
+```bash
+uv venv && uv pip install -e ".[dev]"
+```
+
+## Check your change
+
+Run these commands before you open a pull request.
+
+```bash
+make lint
+make test
+```
+
+## Rules
+
+- Run `make bundle` after any change in `src/`. A test fails if the bundled copy is stale.
+- Write tests against real code from public prototype repos. Do not write made-up fixtures.
+- Never edit a hand label in `tests/corpus/labels/` to make a test pass.
+- Every finding must name a file and a line from the scanned repo.
+- Write prose in short sentences. Use the active voice.
+
+## Commits
+
+- Write one plain sentence as the subject.
+- Give the cause, the fix, and the proof in the body.

vibexray-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Xavier Puspus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vibexray-0.1.0/Makefile

@@ -0,0 +1,59 @@
+.PHONY: install lint fmt test e2e browser corpus bundle check demo gif feature-gifs cli-gif clean
+
+PY ?= uv run
+
+install:
+	uv venv
+	uv pip install -e ".[dev]"
+	$(PY) playwright install chromium
+
+lint:
+	$(PY) ruff check .
+	$(PY) ruff format --check .
+
+fmt:
+	$(PY) ruff check --fix .
+	$(PY) ruff format .
+
+test:
+	$(PY) pytest -q -m "not corpus and not browser"
+
+corpus:
+	$(PY) python scripts/fetch_corpus.py
+
+e2e:
+	$(PY) pytest -q -m "corpus or browser"
+
+bundle:
+	$(PY) python scripts/bundle_skill.py
+
+check: lint test e2e
+	claude plugin validate .
+
+# Real recordings only. See the header of docs/hero.tape before you record.
+demo:
+	scripts/bootstrap-demo.sh
+	vhs docs/hero.tape
+	$(PY) python scripts/video_to_gif.py tmp/hero/hero.mp4 docs/media/hero.gif --trim-tail --seconds 35 --hold 10 --width 1100
+
+# The report GIF uses a fresh scan plus the review.json that the hero session wrote.
+gif:
+	$(PY) vibexray scan /tmp/vibexray-demo/support-bot --out tmp/hero/report
+	$(PY) vibexray review tmp/hero/report --input /tmp/vibexray-demo/support-bot/vibexray-report/review.json
+	$(PY) python scripts/record_report.py tmp/hero/report/report.html docs/media/report.gif
+
+# One GIF per report section, from the same report as `make gif`.
+feature-gifs:
+	for s in decisions parts fake risks app; do \
+		$(PY) python scripts/record_report.py tmp/hero/report/report.html docs/media/$$s.gif --section $$s; \
+	done
+
+# The command line demo scans a fresh copy of the pinned support-bot prototype.
+cli-gif:
+	rm -rf /tmp/vibexray-demo-cli && mkdir -p /tmp/vibexray-demo-cli/support-bot tmp/cli
+	git -C .cache/corpus/ai-customer-support-agent archive HEAD | tar -x -C /tmp/vibexray-demo-cli/support-bot
+	vhs docs/cli.tape
+	$(PY) python scripts/video_to_gif.py tmp/cli/cli.mp4 docs/media/cli.gif --hold 3 --width 1100
+
+clean:
+	rm -rf dist build .pytest_cache .ruff_cache vibexray-report tmp