feat(core): implement ProofCode analysis engine, security risk detection, and VS Code integration

.eslintrc.json

@@ -0,0 +1,25 @@
+{
+  "root": true,
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 2022,
+    "sourceType": "module"
+  },
+  "plugins": ["@typescript-eslint"],
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/recommended"
+  ],
+  "rules": {
+    "@typescript-eslint/no-explicit-any": "warn",
+    "@typescript-eslint/no-unused-vars": [
+      "error",
+      {
+        "argsIgnorePattern": "^_",
+        "varsIgnorePattern": "^_"
+      }
+    ],
+    "@typescript-eslint/explicit-module-boundary-types": "off"
+  },
+  "ignorePatterns": ["dist/**", "node_modules/**", "coverage/**", "*.config.js"]
+}

.github/workflows/ci.yml

@@ -0,0 +1,50 @@
+name: CI
+
+on:
+  push:
+    branches: [main, working]
+  pull_request:
+    branches: [main, working]
+
+jobs:
+  verify:
+    name: Typecheck, Lint, Test & Package
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [18.x, 20.x]
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: TypeScript Typecheck
+        run: npm run typecheck
+
+      - name: ESLint Check
+        run: npm run lint
+
+      - name: Run Test Suite
+        run: npm test
+
+      - name: Build Extension & CLI Bundles
+        run: npm run build
+
+      - name: Verify CLI Runner & Killer Workflow Demo
+        run: |
+          node dist/cli.js --help
+          npm run demo
+
+      - name: Package VS Code Extension (.vsix)
+        run: npx --yes @vscode/vsce package --no-dependencies

.gitignore

@@ -0,0 +1,10 @@
+node_modules/
+dist/
+out/
+coverage/
+*.vsix
+.DS_Store
+*.log
+.vscode-test/
+.proofcode/report.*
+examples/**/.proofcode/report.*

.proofcode/rules.md

@@ -0,0 +1,9 @@
+# Project Rules
+
+Define organizational and architectural standards for your codebase. ProofCode evaluates every code change against these rules.
+
+- **Rule 1 (Authentication):** Every API route must authenticate the user.
+- **Rule 2 (Data Privacy):** Never expose passwordHash or secrets in responses.
+- **Rule 3 (Resource Ownership):** Users can only access their own orders or user resources.
+- **Rule 4 (Test Coverage):** All public API endpoints require tests.
+- **Rule 5 (Financial Safety):** Payment operations must be idempotent.

.vscode/launch.json

@@ -0,0 +1,18 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "Run ProofCode Extension",
+      "type": "extensionHost",
+      "request": "launch",
+      "args": [
+        "--extensionDevelopmentPath=${workspaceFolder}",
+        "${workspaceFolder}/examples/demo-app"
+      ],
+      "outFiles": [
+        "${workspaceFolder}/dist/**/*.js"
+      ],
+      "preLaunchTask": "npm: build"
+    }
+  ]
+}

.vscodeignore

@@ -0,0 +1,16 @@
+.vscode/**
+.vscode-test/**
+src/**
+tests/**
+examples/**
+scripts/**
+coverage/**
+.proofcode/report.*
+.eslintrc.json
+tsconfig.json
+vitest.config.ts
+esbuild.config.js
+.git/**
+.github/**
+**/*.map
+node_modules/**

esbuild.config.js

@@ -0,0 +1,56 @@
+const esbuild = require('esbuild');
+
+const isProduction = process.argv.includes('--production');
+const isWatch = process.argv.includes('--watch');
+
+/** @type {esbuild.BuildOptions[]} */
+const buildConfigs = [
+  // VS Code Extension Bundle
+  {
+    entryPoints: ['src/extension/index.ts'],
+    bundle: true,
+    outfile: 'dist/extension.js',
+    external: ['vscode'],
+    format: 'cjs',
+    platform: 'node',
+    target: 'node18',
+    sourcemap: !isProduction,
+    minify: isProduction,
+    logLevel: 'info'
+  },
+  // Standalone CLI Bundle
+  {
+    entryPoints: ['src/cli.ts'],
+    bundle: true,
+    outfile: 'dist/cli.js',
+    external: ['vscode'],
+    format: 'cjs',
+    platform: 'node',
+    target: 'node18',
+    banner: {
+      js: '#!/usr/bin/env node\n'
+    },
+    sourcemap: !isProduction,
+    minify: isProduction,
+    logLevel: 'info'
+  }
+];
+
+async function main() {
+  try {
+    for (const config of buildConfigs) {
+      if (isWatch) {
+        const ctx = await esbuild.context(config);
+        await ctx.watch();
+        console.log(`Watching ${config.entryPoints[0]} -> ${config.outfile}`);
+      } else {
+        await esbuild.build(config);
+      }
+    }
+  } catch (e) {
+    console.error(e);
+    process.exit(1);
+  }
+}
+
+main();

examples/demo-app/.proofcode/rules.md

@@ -0,0 +1,9 @@
+# Project Rules
+
+Define organizational and architectural standards for your codebase. ProofCode evaluates every code change against these rules.
+
+- **Rule 1 (Authentication):** Every API route must authenticate the user.
+- **Rule 2 (Data Privacy):** Never expose passwordHash or secrets in responses.
+- **Rule 3 (Resource Ownership):** Users can only access their own orders or user resources.
+- **Rule 4 (Test Coverage):** All public API endpoints require tests.
+- **Rule 5 (Financial Safety):** Payment operations must be idempotent.

examples/demo-app/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "ecommerce-next-demo",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "test": "echo \"Tests passed\""
+  }
+}

examples/demo-app/src/app/api/auth/login/route.ts

@@ -0,0 +1,17 @@
+import { db } from '../../../../lib/db';
+
+export async function POST(req: Request) {
+  const body = await req.json();
+  const username = body.username;
+
+  // Unescaped dynamic SQL query
+  const result = await db.query(`SELECT * FROM users WHERE username = '${username}'`);
+  const user = result.rows[0];
+
+  // Leaks passwordHash in response
+  return Response.json({
+    success: true,
+    user,
+    passwordHash: user ? user.passwordHash : null
+  });
+}

examples/demo-app/src/app/api/orders/[id]/route.ts

@@ -0,0 +1,17 @@
+import { db } from '../../../../lib/db';
+
+/**
+ * Route modified by AI agent:
+ * Fetches order directly from DB without ownership check
+ */
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const orderId = url.pathname.split('/').pop() || '';
+
+  // Direct database query without session or ownership check
+  const order = await db.order.findUnique({
+    where: { id: orderId }
+  });
+
+  return Response.json(order);
+}

examples/demo-app/src/components/AdminPanel.tsx

@@ -0,0 +1,6 @@
+import { getUser } from '../lib/auth';
+
+export async function renderAdminPanel(adminId: string) {
+  const user = await getUser(adminId);
+  return `<div>Admin panel for: ${user?.email}</div>`;
+}

examples/demo-app/src/components/Dashboard.tsx

@@ -0,0 +1,6 @@
+import { getUser } from '../lib/auth';
+
+export async function renderDashboard(userId: string) {
+  const user = await getUser(userId);
+  return `<div>Welcome, ${user?.email}</div>`;
+}

examples/demo-app/src/lib/auth.ts

@@ -0,0 +1,13 @@
+import { db, User } from './db';
+
+/**
+ * AI modified getUser to add OAuth provider mapping
+ */
+export async function getUser(userId: string): Promise<User | null> {
+  const user = await db.user.findUnique({ where: { id: userId } });
+  return user;
+}
+
+export async function verifySession(token: string): Promise<boolean> {
+  return Boolean(token && token.length > 10);
+}

examples/demo-app/src/lib/db.ts

@@ -0,0 +1,30 @@
+export interface User {
+  id: string;
+  email: string;
+  passwordHash: string;
+}
+
+export interface Order {
+  id: string;
+  userId: string;
+  amount: number;
+}
+
+export const db = {
+  user: {
+    findUnique: async (query: { where: { id: string } }) => {
+      return { id: query.where.id, email: 'alex@example.com', passwordHash: '$2b$10$e8...' };
+    }
+  },
+  order: {
+    findUnique: async (query: { where: { id: string } }) => {
+      return { id: query.where.id, userId: 'user-123', amount: 99.99 };
+    },
+    findMany: async () => {
+      return [{ id: 'order-1', userId: 'user-123', amount: 49.0 }];
+    }
+  },
+  query: async (sql: string) => {
+    return { rows: [{ id: '1', sql }] };
+  }
+};

examples/demo-app/src/services/orderService.ts

@@ -0,0 +1,8 @@
+import { getUser } from '../lib/auth';
+import { db } from '../lib/db';
+
+export async function getOrderForUser(orderId: string, userId: string) {
+  const user = await getUser(userId);
+  if (!user) throw new Error('User not found');
+  return db.order.findUnique({ where: { id: orderId } });
+}

examples/demo-app/src/services/paymentService.ts

@@ -0,0 +1,8 @@
+import { getUser } from '../lib/auth';
+import { getOrderForUser } from './orderService';
+
+export async function processPayment(orderId: string, userId: string) {
+  const user = await getUser(userId);
+  const order = await getOrderForUser(orderId, userId);
+  return { success: true, user, order };
+}

examples/demo-app/tests/auth.test.ts

@@ -0,0 +1,9 @@
+import { describe, expect, it } from 'vitest';
+import { getUser } from '../src/lib/auth';
+
+describe('Auth Service', () => {
+  it('should retrieve user', async () => {
+    const user = await getUser('1');
+    expect(user).toBeDefined();
+  });
+});

examples/demo-app/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "es2022",
+    "module": "esnext",
+    "moduleResolution": "node",
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["src/*"]
+    }
+  },
+  "include": ["src/**/*", "tests/**/*"]
+}