AI-powered analysis

# Enable AI analysis
vibrant . --ai

# Use specific provider
vibrant . --ai --provider openrouter

// From apps/cli/src/ai/summarizer.ts
export function summarizeFile(
  filePath: string,
  content: string
): CodeSummary {
  const lines = content.split("\n");
  const suspicious: Array<{ line: number; code: string; type: string }> = [];
  const functions: Array<{ line: number; signature: string }> = [];
  
  // Detect suspicious patterns
  for (let i = 0; i < lines.length; i++) {
    const line = lines[i];
    if (hasVibecodingPattern(line)) {
      suspicious.push({
        line: i + 1,
        code: line.trim(),
        type: getPatternType(line)
      });
    }
  }
  
  // Extract function signatures using TypeScript AST
  const sourceFile = ts.createSourceFile(filePath, content, ...);
  // ... extract functions, classes, methods
  
  return buildSmartSummary(filePath, lines.length, suspicious, functions);
}

### src/api.ts
Lines: 245

Suspicious:
L24|const API_KEY = "sk-abc";  // secret
L45|console.log("debug");      // console
L89|} catch (e) {}             // empty-catch

Functions:
L10|async fn fetchData(url: string)
L60|fn processResult(data: any)
L120|class ApiClient
L145|async handleRequest(req, res)

// From apps/cli/src/ai/summarizer.ts
function hasVibecodingPattern(line: string): boolean {
  const patterns = [
    /console\.(log|error|warn|debug|info)/,
    /debugger\b/,
    /\/\/\s*(TODO|FIXME|HACK|XXX|BUG)/i,
    /throw\s+new\s+Error\s*\(\s*["'].*(?:not implemented|todo|fix)/i,
    /:\s*any\b/,
    /@ts-ignore/,
    /(api[_-]?key|apikey|secret|password|token)\s*[=:]/i,
    /(["'])(?:sk-[a-zA-Z0-9]{20,}|xox[baprs]-[a-zA-Z0-9-]{10,})\1/,
    /\b(?:data|result|item|temp|value|obj|arr)\s*[=:]/i,
    /catch\s*\([^)]*\)\s*\{\s*\}/,
  ];
  return patterns.some(p => p.test(line));
}

// From apps/cli/src/commands/lint.ts
const { analyze, detectProvider } = await import("../ai/index.js");
const config = detectProvider(aiProvider);

const result = await analyze(config, filesToAnalyze, { 
  useSummarizer: true, 
  verbose: false,
  maxChunkTokens: 1500,
  isSingleFile,
});

// From apps/cli/src/ai/prompts.ts
export const SYSTEM_PROMPT = `You are Vibrant, a security-focused code reviewer 
specializing in detecting "vibecoding" (AI-generated code that wasn't properly reviewed).

CRITICAL: Extract EXACT line numbers from "L123|code" format (123 = line number).
CRITICAL: Always respond with valid JSON only - no markdown, no explanations.

IMPORTANT DISTINCTIONS:
- console.log in CLI tools, scripts, or test files is CORRECT
- Regex patterns inside strings are NOT issues
- Focus on REAL problems that cause bugs or security issues
- Be selective - not every minor issue deserves reporting`;

// From apps/cli/src/commands/lint.ts
const result = await analyze(config, filesToAnalyze, options);

// result.summary - Overall code health
// result.highlights - Most important issues
// result.recommendations - Actionable next steps

🔍 Issues Found

  ✕ src/api.ts:24:5
    └─ hardcoded-credentials
       API key hardcoded in source code
       
       24|const API_KEY = "sk-abc123";
       
       → Use environment variables instead

📊 Diagnosis

  The codebase shows several security concerns. Hardcoded credentials
  and unhandled errors could lead to data exposure and silent failures.

⚡ Key Findings

  • Hardcoded API key in src/api.ts could expose credentials
  • 3 empty catch blocks swallow errors without logging
  • Multiple console.log statements in production code

💡 Recommendations

  → Move all credentials to environment variables
  → Add proper error handling with logging
  → Replace console.log with structured logger

// From apps/cli/src/ai/auto-cache.ts
export async function getModifiedFiles(
  files: AIFileContent[]
): Promise<CacheResult> {
  const cache = await loadCache();
  const modified: AIFileContent[] = [];
  const cached: AIFileContent[] = [];
  
  for (const file of files) {
    const hash = hashContent(file.content);
    const cached = cache[file.path];
    
    if (cached?.hash === hash) {
      cached.push(file);
    } else {
      modified.push(file);
    }
  }
  
  return {
    modified,
    cached,
    stats: {
      total: files.length,
      modified: modified.length,
      cached: cached.length
    }
  };
}

# Basic AI analysis
vibrant . --ai

# With specific provider
vibrant . --ai --provider openrouter

# With caching enabled
vibrant . --ai --cache

# Single file deep analysis
vibrant src/api.ts --ai