Skip to content

Commit fa943a0

Browse files
slowcoder360cursoragent
slowcoder360
and
cursoragent
committed
Integrate V1 foundation: tests, scanner fixes, CI, AI opt-in (1.4.0)
Merge pod/v1c-ci-fixtures with v1-d cherry-pick, version sync, and orchestration docs. Adds vitest scanner tests, CVE severity fallback, four scanner correctness fixes, honest CI, and --ai-suggestions opt-in. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 301c968 commit fa943a0

24 files changed

Lines changed: 815 additions & 229 deletions

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ build/
1919
*.md
2020
!README.md
2121
!CONTRIBUTING.md
22+
!plan/**
23+
!agent-control/**
24+
!slices/README.md
25+
!slices/**/SPEC.md
2226

2327
# Python
2428
__pycache__/

‎agent-control/human-queue.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# human-queue — VibeSafe
2+
3+
| id | item | blocked_slice | status |
4+
|----|------|---------------|--------|
5+
| — | (empty) | — | — |
6+
7+
Operator items: npm publish approval, merge to master.

‎agent-control/slice-status.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# slice-status — VibeSafe V1
2+
3+
| slice | phase | depends_on | branch | status | notes |
4+
|-------|-------|------------|--------|--------|-------|
5+
| v1-a | build | — | pod/v1a-scanner-tests | merged | integrate/v1-foundation → master |
6+
| v1-b | build | — | pod/v1b-version-cleanup | merged | version sync, reporting cleanup |
7+
| v1-f | build | v1-a | pod/v1f-cve-severity | merged | OSV severity fallback |
8+
| v1-h | build | v1-a | pod/v1h-scanner-fixes | merged | scanner correctness |
9+
| v1-c | build | v1-a | pod/v1c-ci-fixtures | merged | CI test + local dist scan |
10+
| v1-d | build | v1-b | pod/v1d-ai-opt-in | merged | --ai-suggestions opt-in |
11+
| v1-i | build | v1-c | pod/v1i-exit-code | pending | exit 1 on High/Critical default |
12+
| v1-g | build | v1-a,v1-f | pod/v1g-multi-manifest | pending | nested package.json discovery |
13+
| v1-e | build | v1-f,v1-g | pod/v1e-lockfile-cves | pending | optional — lockfile CVE parse |

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "vibesafe",
3-
"version": "1.3.5",
3+
"version": "1.4.0",
44
"description": "A CLI tool to scan your codebase for security vibes.",
55
"main": "dist/index.js",
66
"bin": {

‎plan/CONTEXT.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# CONTEXT — VibeSafe
2+
3+
Shared language for orchestrator and slice workers. No brainstorm paths — this repo is self-contained.
4+
5+
---
6+
7+
## Product identity
8+
9+
- **What:** npm CLI (`vibesafe`) for deterministic security heuristics on local codebases.
10+
- **What it is NOT:** Arthor product, hosted GitHub app, or AI swarm red-team platform (future fork only).
11+
- **Distribution:** npm package `vibesafe` (~1k downloads). Keep package name unless Justin explicitly approves rename.
12+
13+
---
14+
15+
## Commands
16+
17+
| Command | Purpose |
18+
|---------|---------|
19+
| `vibesafe scan [dir]` | Run all scanners on a directory |
20+
| `vibesafe scan -o file.json` | JSON output |
21+
| `vibesafe scan -r [file.md]` | Markdown report |
22+
| `vibesafe scan --high-only` | Filter to High/Critical |
23+
| `vibesafe install <pkg>` | Pre-install trust heuristics |
24+
25+
---
26+
27+
## Source layout
28+
29+
```text
30+
src/
31+
index.ts # CLI entry (commander)
32+
frameworkDetection.ts
33+
scanners/ # One file per scanner domain
34+
reporting/ # markdown + aiSuggestions
35+
installer/ # vibesafe install
36+
utils/fileTraversal.ts
37+
test-data/ # Fixture projects for manual/CI scan — becomes test oracle source
38+
dist/ # tsc output (published)
39+
```
40+
41+
---
42+
43+
## Scanners (current)
44+
45+
| Scanner | File | Notes |
46+
|---------|------|-------|
47+
| Secrets | `scanners/secrets.ts` | AWS, JWT, SSH, high-entropy, `.env` |
48+
| Dependencies | `scanners/dependencies.ts` | OSV.dev; direct deps only (lockfile gap) |
49+
| Configuration | `scanners/configuration.ts` | DEBUG, CORS, devMode flags |
50+
| HTTP client | `scanners/httpClient.ts` | Missing timeouts/abort |
51+
| Uploads | `scanners/uploads.ts` | multer, formidable, etc. |
52+
| Endpoints | `scanners/endpoints.ts` | `/admin`, Next.js API routes |
53+
| Rate limiting | `scanners/rateLimiting.ts` | Heuristic: API routes without limit pkg |
54+
| Logging | `scanners/logging.ts` | Sensitive data in logs |
55+
56+
---
57+
58+
## Invariants (do not break without Justin)
59+
60+
1. **Deterministic by default** — `scan` must not call LLM APIs unless user passes explicit AI flag (see Wave 1 slice).
61+
2. **Offline-capable** — core scan works without network except OSV CVE lookup for deps.
62+
3. **npm publish surface** — only `dist/`, README, LICENSE, package.json in `"files"`.
63+
4. **No scope creep** — FastAPI backend, Semgrep/Nuclei integration, GitHub PR comments = **STOP, ask Justin**.
64+
65+
---
66+
67+
## Known gaps (pre-audit)
68+
69+
- `npm test` exits 1 — no unit tests
70+
- `reporting/*.js` duplicates alongside `.ts`
71+
- CLI `--version` (0.0.1) ≠ `package.json` version (1.3.5)
72+
- CI runs self-scan only; does not assert fixture findings
73+
- Lockfile CVE support advertised as "coming soon" in README
74+
75+
---
76+
77+
## External references (operator only)
78+
79+
- Adam fundamentals placement: Module 07 (secrets), Module 09 (verify what AI built)
80+
- BuilderOS skills (if worker has disk access): `~/builder-os/skills/tests-first/SKILL.md`, `security-audit/SKILL.md`

‎plan/HANDOFF-VIBESAFE-AUDIT.md‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
# HANDOFF — V0 read-only audit
2+
3+
> **Wave:** V0 (read-only). **Branch:** none — no code changes. **Blocks:** Wave 1 slices.
4+
5+
---
6+
7+
## Goal
8+
9+
Produce `plan/VIBESAFE-AUDIT.md`: structured inventory of code health, scanner coverage, false-positive risk, and a prioritized improvement backlog for Wave 1–2.
10+
11+
**No implementation in V0.** Audit only.
12+
13+
---
14+
15+
## Read first
16+
17+
1. `plan/CONTEXT.md`
18+
2. `README.md`
19+
3. `src/index.ts` — CLI wiring, default flags, AI report path
20+
4. Every file under `src/scanners/`
21+
5. `src/reporting/` — note `.js` vs `.ts` duplication
22+
6. `test-data/` — list fixtures; note which scanners each exercises
23+
7. `.github/workflows/ci.yml`
24+
8. `package.json` — scripts, deps, version
25+
26+
---
27+
28+
## Audit sections (required in output)
29+
30+
Write all sections to **`plan/VIBESAFE-AUDIT.md`**:
31+
32+
### 1. Executive summary
33+
34+
- 5–10 bullets: ship-readiness, biggest risks, top 3 wins for Wave 1
35+
36+
### 2. Scanner matrix
37+
38+
| Scanner | Inputs | Severity rules | Network? | Test fixture exists? | Gaps |
39+
|---------|--------|----------------|----------|----------------------|------|
40+
41+
### 3. Code health
42+
43+
- TypeScript quality issues (any `any`, dead code, duplicate `.js` artifacts)
44+
- Version drift (`index.ts` vs `package.json`)
45+
- Dependency audit (outdated, unnecessary deps)
46+
- Error handling on file I/O and OSV API failures
47+
48+
### 4. CI / release
49+
50+
- What CI actually proves today
51+
- Gap vs "green = safe to publish minor bump"
52+
53+
### 5. AI / deterministic boundary
54+
55+
- Where OpenAI is invoked today
56+
- Recommendation: default-off flag name + behavior (do not implement in V0)
57+
58+
### 6. False positive / noise review
59+
60+
- Run `npm run build && node dist/index.js scan test-data/ --high-only` locally
61+
- Sample 3 fixtures per scanner category; note noisy rules
62+
63+
### 7. Wave 1 slice backlog (proposed)
64+
65+
Ordered table:
66+
67+
| ID | Title | Effort | Risk | Depends |
68+
|----|-------|--------|------|---------|
69+
70+
Minimum slices to propose:
71+
72+
- **V1-A** — vitest + fixture tests per scanner
73+
- **V1-B** — fix version drift + remove duplicate `.js` in reporting
74+
- **V1-C** — CI runs `npm test` + fixture suite
75+
- **V1-D** — AI suggestions opt-in (`--ai-suggestions`), default off
76+
- **V1-E** — lockfile CVE support (package-lock / yarn.lock / pnpm-lock)
77+
78+
### 8. Out of scope (explicit)
79+
80+
List anything that looks like swarm/GitHub-app/hosted platform — deferred.
81+
82+
### 9. Course integration notes (brief)
83+
84+
- Which fundamentals modules (07, 09) get a `vibesafe scan` teach hook
85+
- No curriculum files in this repo in V0
86+
87+
---
88+
89+
## Done when
90+
91+
1. `plan/VIBESAFE-AUDIT.md` exists with all 9 sections filled
92+
2. `plan/ORCHESTRATOR.md` slice table updated: V0 = **done**
93+
3. No other files modified (read-only wave)
94+
4. Report tip: if any secrets found in repo during audit, note severity only — do not paste values
95+
96+
---
97+
98+
## STOP — ask Justin
99+
100+
- Recommending npm package rename
101+
- Recommending merge into arthor-* repo
102+
- Any hosted-service or GitHub App architecture
103+
- Deleting scanners without replacement plan

‎plan/HANDOFF-VIBESAFE-WAVE-1.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# HANDOFF — V1 foundation hardening
2+
3+
> **Wave:** V1. **Gate:** V0 audit complete (`plan/VIBESAFE-AUDIT.md` reviewed). **Do not start until V0 = done.**
4+
5+
---
6+
7+
## Goal
8+
9+
Make VibeSafe testable, CI-honest, and deterministic-by-default. Ship-quality minor bump (target 1.4.0).
10+
11+
---
12+
13+
## Slice queue
14+
15+
| ID | Branch | Scope | Done when |
16+
|----|--------|-------|-----------|
17+
| V1-A | `pod/v1a-scanner-tests` | vitest + per-scanner fixture tests from `test-data/` | `npm test` green; ≥1 assertion per scanner |
18+
| V1-B | `pod/v1b-version-cleanup` | Sync CLI version to package.json; remove stray `reporting/*.js` if superseded by `.ts` | build clean; single source per module |
19+
| V1-C | `pod/v1c-ci-fixtures` | CI: build + test + scan self with `--high-only` | `.github/workflows/ci.yml` fails on test fail |
20+
| V1-D | `pod/v1d-ai-opt-in` | LLM report only with `--ai-suggestions`; update README | default scan never calls OpenAI |
21+
| V1-E | `pod/v1e-lockfile-cves` | Parse lockfile for transitive CVE lookup | README lockfile caveat removed or updated |
22+
23+
**Order:** V1-B can run parallel with V1-A. V1-C after V1-A. V1-D after V1-B. V1-E last (or skip if audit marks high effort — ask Justin).
24+
25+
---
26+
27+
## V1-A — tests-first (priority)
28+
29+
1. Add `vitest` devDependency
30+
2. `package.json` script: `"test": "vitest run"`
31+
3. For each scanner, at least one test:
32+
33+
```text
34+
tests/scanners/secrets.test.ts → test-data/aws-secrets-tests.txt, safe-file.txt
35+
tests/scanners/endpoints.test.ts → test-data/endpoint-test.js, nextjs-endpoint-tests/
36+
tests/scanners/rateLimiting.test.ts → rate-limit-missing.js vs rate-limit-present.js
37+
tests/scanners/httpClient.test.ts → http-client-unsafe.js vs safe
38+
... etc per audit matrix
39+
```
40+
41+
4. Tests import scanner functions directly — do not shell out to CLI unless e2e slice added later
42+
5. Commit + push `pod/v1a-scanner-tests`; do not merge `main` without Justin
43+
44+
---
45+
46+
## V1-D — deterministic default
47+
48+
- Today: `-r` / `--report` may trigger OpenAI without clear opt-in
49+
- Target: `--ai-suggestions` required for any LLM call; `-r` alone = markdown without AI section
50+
- `.env` / `OPENAI_API_KEY` only read when flag set
51+
52+
---
53+
54+
## Done when (wave)
55+
56+
1. All dispatched V1 slices green on pod branches
57+
2. `plan/ORCHESTRATOR.md` updated with SHAs
58+
3. Justin reviews for npm publish
59+
60+
---
61+
62+
## Out of scope
63+
64+
- New scanners (SAST, Semgrep, etc.)
65+
- `vibesafe install` redesign
66+
- Fundamentals markdown (brainstorm repo)

‎plan/ORCHESTRATOR.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# ORCHESTRATOR — VibeSafe
2+
3+
**Status 2026-07-07:** Wave **V1 foundation** **merged** to `master` via `integrate/v1-foundation` (1.4.0). V1-i/g/e pending.
4+
5+
**Authority:** `plan/HANDOFF-VIBESAFE-AUDIT.md` (V0) → `plan/HANDOFF-VIBESAFE-WAVE-1.md` (V1)
6+
7+
**Brainstorm tracker (optional):** `~/arthor-brainstorm/roadmap/orchestrator-prompt-vibesafe-refresh.md`
8+
9+
---
10+
11+
## Slice queue
12+
13+
| ID | Wave | HANDOFF | Branch | Status |
14+
|----|------|---------|--------|--------|
15+
| V0 | Audit | `HANDOFF-VIBESAFE-AUDIT.md` | — (read-only) | **done** 2026-07-06 |
16+
| V1-A | Foundation | `HANDOFF-VIBESAFE-WAVE-1.md` § V1-A | `pod/v1a-scanner-tests` | **merged** 2026-07-07 |
17+
| V1-B | Foundation | same § V1-B | `pod/v1b-version-cleanup` | **merged** 2026-07-07 |
18+
| V1-C | Foundation | same § V1-C | `pod/v1c-ci-fixtures` | **merged** 2026-07-07 |
19+
| V1-D | Foundation | same § V1-D | `pod/v1d-ai-opt-in` | **merged** 2026-07-07 |
20+
| V1-E | Foundation | same § V1-E | `pod/v1e-lockfile-cves` | pending (v1-f,v1-g) |
21+
22+
**V0 order:** read HANDOFF → fill `plan/VIBESAFE-AUDIT.md` → update this table → stop.
23+
24+
**V1 order (after Justin OK):** V1-A ∥ V1-B → V1-C → V1-D → V1-E (V1-E optional per audit)
25+
26+
---
27+
28+
## Operating rules
29+
30+
1. Read `plan/CONTEXT.md` before any slice.
31+
2. **V0 is read-only** — output is `plan/VIBESAFE-AUDIT.md` only.
32+
3. Tests-first for V1 (`vitest` + `test-data/` fixtures).
33+
4. Branch naming: `pod/<slug>`; push when green; **no merge to `master` without Justin**.
34+
5. Deterministic scanners are P0; LLM calls require explicit `--ai-suggestions` (V1-D).
35+
6. **STOP** on: package rename, arthor repo merge, FastAPI/swarm/GitHub App scope.
36+
37+
---
38+
39+
## Git
40+
41+
- Default branch: `master` (per CI workflow)
42+
- Publish: `npm publish` — Justin only
43+
44+
---
45+
46+
## Meta prompt (paste this entire block)
47+
48+
```
49+
You are the Tier-1 orchestrator for ~/VibeSafe (npm CLI security scanner).
50+
51+
Read FIRST (in order):
52+
1. plan/ORCHESTRATOR.md
53+
2. plan/CONTEXT.md
54+
3. plan/HANDOFF-VIBESAFE-AUDIT.md
55+
56+
You are on Wave V0 — READ-ONLY AUDIT. Do not edit src/, package.json, or CI unless Justin explicitly overrides.
57+
58+
Your deliverable: plan/VIBESAFE-AUDIT.md with all 9 sections from the HANDOFF.
59+
60+
Steps:
61+
1. Read every scanner under src/scanners/ and CLI wiring in src/index.ts
62+
2. Inventory test-data/ fixtures vs scanner coverage
63+
3. Run: npm ci && npm run build && node dist/index.js scan test-data/ --high-only
64+
4. Write plan/VIBESAFE-AUDIT.md (executive summary, scanner matrix, code health, CI gap, AI boundary, noise review, Wave 1 backlog, out-of-scope, course notes)
65+
5. Update plan/ORCHESTRATOR.md — mark V0 done with date
66+
6. Stop. Do not start V1 slices until Justin approves the audit.
67+
68+
Closed decisions (do not re-litigate):
69+
- Keep npm package name "vibesafe"
70+
- Not an Arthor product; no Neon/schema integration
71+
- Swarm/red-team platform is out of scope for this wave
72+
- Deterministic scan is default; AI is opt-in (recommend in audit, implement in V1-D)
73+
74+
If plan/HANDOFF-VIBESAFE-AUDIT.md is missing, say so — it should exist at repo root plan/.
75+
76+
Start: V0 audit now.
77+
```

0 commit comments

Comments
 (0)