{"_id":"@bddiudiu/vibeguard","name":"@bddiudiu/vibeguard","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@bddiudiu/vibeguard","version":"0.1.0","description":"AI 代码生成的语义安检门，在 git commit 前自动拦截幻觉错误与安全隐患","repository":{"type":"git","url":"git+https://github.com/bddiudiu/vibeguard.git"},"type":"module","main":"dist/cli.js","bin":{"vibeguard":"dist/cli.js"},"scripts":{"build":"tsc","dev":"tsc --watch","lint":"eslint src/","test":"vitest run","test:watch":"vitest","vibeguard:scan":"node dist/cli.js scan","prepare":"husky"},"keywords":["ai","code-review","git-hook","hallucination","security","ollama","openai","lint","pre-commit"],"author":"","license":"MIT","dependencies":{"chalk":"^5.3.0","commander":"^12.1.0","js-yaml":"^4.1.0","openai":"^4.52.0","better-sqlite3":"^11.1.2"},"devDependencies":{"@types/better-sqlite3":"^7.6.11","@types/js-yaml":"^4.0.9","@types/node":"^20.14.10","husky":"^9.1.1","typescript":"^5.5.3","vitest":"^2.0.5"},"engines":{"node":">=18.0.0"},"_id":"@bddiudiu/vibeguard@0.1.0","gitHead":"48f70b76f4057df83afb253ac466dfeddafa0add","types":"./dist/cli.d.ts","bugs":{"url":"https://github.com/bddiudiu/vibeguard/issues"},"homepage":"https://github.com/bddiudiu/vibeguard#readme","_nodeVersion":"20.20.2","_npmVersion":"10.8.2","dist":{"integrity":"sha512-DNQzmzXcxeEVEHrP3Ld+Y4RKm2zysjHx/ZpRNJzAiBu3JPBmvv5SO8yO6W3OCK6AO+lDU4LkA4DwSMzuDz/B+A==","shasum":"f31dbba32a16bffe24afc859db749bf9c0148de9","tarball":"https://registry.npmjs.org/@bddiudiu/vibeguard/-/vibeguard-0.1.0.tgz","fileCount":56,"unpackedSize":59795,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@bddiudiu%2fvibeguard@0.1.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIAoQDyURx+6yJUkjFuGviBe3JAtqCAKLfITaTMjSoIXZAiEA1OVfDbq/cedlrWvuHY8XsyhrQScUKlh64AQLkVNtolE="}]},"_npmUser":{"name":"bddiudiu","email":"bddiudiu@gmail.com"},"directories":{},"maintainers":[{"name":"bddiudiu","email":"bddiudiu@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/vibeguard_0.1.0_1778551809640_0.36460099792033573"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-12T02:10:09.514Z","0.1.0":"2026-05-12T02:10:09.847Z","modified":"2026-05-12T02:10:10.284Z"},"maintainers":[{"name":"bddiudiu","email":"bddiudiu@gmail.com"}],"description":"AI 代码生成的语义安检门，在 git commit 前自动拦截幻觉错误与安全隐患","homepage":"https://github.com/bddiudiu/vibeguard#readme","keywords":["ai","code-review","git-hook","hallucination","security","ollama","openai","lint","pre-commit"],"repository":{"type":"git","url":"git+https://github.com/bddiudiu/vibeguard.git"},"bugs":{"url":"https://github.com/bddiudiu/vibeguard/issues"},"license":"MIT","readme":"# VibeGuard\n\n**AI 代码生成的\"语义安检门\"**\n\n> 你是否曾因为信任 AI 而直接合入了带有虚构 API 的代码？\n> 你是否曾在 commit 里意外夹带了测试用的 Secret？\n> **VibeGuard 在你按下 commit 键的一瞬，自动为你守住代码底线。**\n\n## 核心特性\n\n- **拦截幻觉** — 自动识别 AI 编造的函数、虚假 API 和逻辑矛盾\n- **泄漏防护** — 语义识别硬编码的 API Key、Token 和敏感信息\n- **零配置启动** — `npm install -g vibeguard && vibeguard init`\n- **100% 本地隐私** — 完美适配 Ollama，让代码审计不出本地\n\n## 工作原理\n\n```\ngit commit → VibeGuard 提取 diff → AI 语义扫描 → 发现风险 → 拦截提交\n```\n\nVibeGuard 不查语法（那是 ESLint 的事），它只查\"语义对不对\"。它通过 Git Hook 介入你的开发流程，在 `git commit` 时自动扫描暂存区变更，利用 LLM（云端或本地 Ollama）进行语义分析，发现高危幻觉或安全风险时强制拦截 commit。\n\n## 快速开始\n\n### 安装\n\n```bash\nnpm install -g vibeguard\n```\n\n### 初始化项目\n\n```bash\ncd your-project\nvibeguard init\n```\n\n这会在你的项目中安装 pre-commit hook，之后每次 `git commit` 都会自动扫描。\n\n### 手动扫描\n\n```bash\nvibeguard scan\n```\n\n### 跳过扫描\n\n```bash\ngit commit --no-verify -m \"skip vibeguard\"\n```\n\n## 配置\n\n在项目根目录创建 `.vibeguard.yaml`：\n\n```yaml\nmodel:\n  # 选择 AI 提供商: openai | ollama\n  provider: ollama\n\n  ollama:\n    model: llama3\n    baseUrl: http://localhost:11434\n\n  openai:\n    model: gpt-4o-mini\n  # API Key 通过环境变量 OPENAI_API_KEY 设置\n\nscan:\n  maxDiffChars: 12000   # 最大扫描字符数\n  hallucinationDetection: true\n  securityScan: true\n  timeout: 30           # 超时时间(秒)\n\nrules:\n  bannedImports:\n    - lodash.get\n    - request\n  bannedPatterns:\n    - \"eval(\"\n    - \"new Function(\"\n  ignorePaths:\n    - \"dist/**\"\n    - \"*.min.js\"\n```\n\n### 使用本地模型 (推荐)\n\n1. 安装 [Ollama](https://ollama.ai)\n2. 拉取模型: `ollama pull llama3`\n3. 在 `.vibeguard.yaml` 中设置 `provider: ollama`\n\n## 检测能力\n\n### 幻觉检测\n\n- 虚假 API 调用（如 `requests.get_with_auto_retry()`）\n- 虚构的库引用（不存在的 npm 包或模块）\n- 逻辑矛盾与类型不匹配\n- 未实现的占位代码\n- 架构禁令违规\n\n### 安全扫描\n\n- 硬编码密钥（API Key、Token、密码）\n- 注入风险（SQL 注入、命令注入、XSS）\n- 不安全的加密算法（MD5、SHA1）\n- 危险函数调用（eval、new Function）\n- 敏感信息泄露\n\n## CLI 命令\n\n| 命令 | 说明 |\n|------|------|\n| `vibeguard scan` | 扫描暂存区变更 |\n| `vibeguard init` | 安装 pre-commit hook |\n| `vibeguard uninstall` | 卸载 pre-commit hook |\n| `vibeguard config` | 显示当前生效配置 |\n| `vibeguard --help` | 查看帮助 |\n\n## 工程架构\n\n```\nvibeguard/\n├── src/\n│   ├── cli.ts            # CLI 入口\n│   ├── core/\n│   │   ├── audit.ts      # 扫描调度器\n│   │   ├── analyzer.ts   # AI 分析与结果解析\n│   │   ├── config.ts     # 配置加载\n│   │   └── git.ts        # Git diff 提取与 Hook 管理\n│   ├── connectors/\n│   │   ├── openai.ts     # OpenAI 适配器\n│   │   └── ollama.ts     # Ollama 适配器\n│   └── rules/\n│       ├── index.ts      # Prompt 构建器\n│       ├── hallucination.ts  # 幻觉检测 Prompt\n│       └── security.ts       # 安全扫描 Prompt\n├── tests/\n├── .vibeguard.yaml       # 默认规则配置\n├── package.json\n└── README.md\n```\n\n## 风险与规避\n\n| 风险 | 规避方案 |\n|------|----------|\n| 语义分析误伤正常代码 | 支持 `--no-verify` 跳过，本地白名单配置 |\n| LLM 调用延迟 | 只扫描 diff 变更行及上下文，非全文件扫描 |\n| 云端 API 成本 | 默认适配 Ollama 本地模型，零成本审计 |\n\n## 开发\n\n```bash\n# 克隆项目\ngit clone https://github.com/your-org/vibeguard.git\ncd vibeguard\n\n# 安装依赖\nnpm install\n\n# 开发模式 (监听编译)\nnpm run dev\n\n# 运行测试\nnpm test\n\n# 构建\nnpm run build\n```\n\n## 发布\n\n发布通过 GitHub Actions 自动完成，只需两步：\n\n1. 在 GitHub 仓库 Settings → Secrets 中添加 `NPM_TOKEN`（npm Access Token）\n2. 在 GitHub 创建 Release，填写 tag（如 `v0.1.0`）并发布\n\nActions 会自动完成：构建 → 测试 → 发布到 npm。\n\n```bash\n# 也可以通过 git tag 触发\ngit tag v0.1.0\ngit push origin v0.1.0\n# 然后在 GitHub 上基于该 tag 创建 Release\n```\n\n## 路线图\n\n- [x] CLI 核心与 Git diff 提取\n- [x] OpenAI API 集成（含第三方兼容 API）\n- [x] Ollama 本地模型支持\n- [x] pre-commit hook 自动安装\n- [x] 终端风险等级可视化\n- [x] 大型 Diff 切片处理\n- [x] NPM 发布（GitHub Actions 自动化）\n- [ ] IDE 插件 (VS Code / Cursor)\n\n## License\n\nMIT\n","readmeFilename":"README.md","_rev":"1-18d339c7b164f6d19a396b6e02b982d0"}