package.json

{
  "name": "deepsec-security",
  "displayName": "DeepSec",
  "description": "DeepSec Shield and Spear security auditing for AI-generated code.",
  "version": "0.2.0",
  "publisher": "unclecheng",
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "https://github.com/Unclecheng-li/DeepSec.git"
  },
  "private": true,
  "type": "commonjs",
  "icon": "media/deepsec-icon.png",
  "main": "./dist/extension.js",
  "bin": {
    "deepsec-vscode": "./dist/cli.js",
    "deepsec-lsp": "./dist/lspServer.js"
  },
  "engines": {
    "vscode": "^1.92.0"
  },
  "categories": [
    "Linters",
    "Programming Languages",
    "Other"
  ],
  "extensionKind": [
    "workspace"
  ],
  "activationEvents": [
    "onStartupFinished",
    "onCommand:deepsec.scanCurrentFile",
    "onCommand:deepsec.scanWorkspace",
    "onCommand:deepsec.scanWithAi",
    "onCommand:deepsec.spearRun",
    "onCommand:deepsec.syncPackageCache",
    "onCommand:deepsec.exportDashboard",
    "onCommand:deepsec.setLlmApiKey",
    "onCommand:deepsec.deleteLlmApiKey",
    "onCommand:deepsec.showLlmStatus",
    "onCommand:deepsec.showSubscriptionStatus",
    "onCommand:deepsec.applyFix",
    "onCommand:deepsec.applyFindingFix",
    "onCommand:deepsec.applyAllSafeFixes",
    "onCommand:deepsec.applyAllProFixes",
    "onView:deepsecFindings",
    "onView:deepsecL3Panel"
  ],
  "contributes": {
    "commands": [
      {
        "command": "deepsec.scanCurrentFile",
        "title": "DeepSec: Scan Current File"
      },
      {
        "command": "deepsec.scanWorkspace",
        "title": "DeepSec: Scan Workspace"
      },
      {
        "command": "deepsec.scanWithAi",
        "title": "DeepSec: Scan with AI",
        "icon": "$(sparkle)"
      },
      {
        "command": "deepsec.spearRun",
        "title": "DeepSec: Run Spear",
        "icon": "$(beaker)"
      },
      {
        "command": "deepsec.clearFindings",
        "title": "DeepSec: Clear Findings"
      },
      {
        "command": "deepsec.openReport",
        "title": "DeepSec: Open Findings Report"
      },
      {
        "command": "deepsec.exportDashboard",
        "title": "DeepSec: Export Findings Dashboard"
      },
      {
        "command": "deepsec.openIgnoreRules",
        "title": "DeepSec: Open Ignore Rules"
      },
      {
        "command": "deepsec.syncPackageCache",
        "title": "DeepSec: Sync Package Cache"
      },
      {
        "command": "deepsec.setLlmApiKey",
        "title": "DeepSec: Set LLM API Key"
      },
      {
        "command": "deepsec.deleteLlmApiKey",
        "title": "DeepSec: Delete LLM API Key"
      },
      {
        "command": "deepsec.showLlmStatus",
        "title": "DeepSec: Show LLM Status"
      },
      {
        "command": "deepsec.showSubscriptionStatus",
        "title": "DeepSec: Show Pro Subscription Status"
      },
      {
        "command": "deepsec.ignoreFinding",
        "title": "DeepSec: Ignore This Finding"
      },
      {
        "command": "deepsec.ignoreRuleInFile",
        "title": "DeepSec: Ignore Rule in This File"
      },
      {
        "command": "deepsec.ignoreRuleGlobally",
        "title": "DeepSec: Ignore Rule Globally"
      },
      {
        "command": "deepsec.ignorePackage",
        "title": "DeepSec: Ignore Package"
      },
      {
        "command": "deepsec.applyFix",
        "title": "DeepSec: Apply Fix"
      },
      {
        "command": "deepsec.applyFindingFix",
        "title": "DeepSec: Apply Finding Fix"
      },
      {
        "command": "deepsec.applyAllSafeFixes",
        "title": "DeepSec: Apply All Safe Fixes in Current File"
      },
      {
        "command": "deepsec.applyAllProFixes",
        "title": "DeepSec: Review and Apply All Pro Fixes in Current File"
      }
    ],
    "menus": {
      "view/item/context": [
        {
          "command": "deepsec.applyFindingFix",
          "when": "view == deepsecFindings && viewItem == deepsecFindingFixable",
          "group": "inline@1"
        },
        {
          "command": "deepsec.ignoreFinding",
          "when": "view == deepsecFindings && (viewItem == deepsecFinding || viewItem == deepsecFindingFixable)",
          "group": "inline"
        },
        {
          "command": "deepsec.ignoreRuleInFile",
          "when": "view == deepsecFindings && (viewItem == deepsecFinding || viewItem == deepsecFindingFixable)",
          "group": "navigation"
        },
        {
          "command": "deepsec.ignoreRuleGlobally",
          "when": "view == deepsecFindings && (viewItem == deepsecFinding || viewItem == deepsecFindingFixable)",
          "group": "navigation"
        },
        {
          "command": "deepsec.ignorePackage",
          "when": "view == deepsecFindings && (viewItem == deepsecFinding || viewItem == deepsecFindingFixable)",
          "group": "navigation"
        }
      ]
    },
    "configuration": {
      "title": "DeepSec",
      "properties": {
        "deepsec.enabled": {
          "type": "boolean",
          "default": true,
          "description": "Enable DeepSec security scanning."
        },
        "deepsec.scanOnChange": {
          "type": "boolean",
          "default": true,
          "description": "Scan supported documents shortly after edits."
        },
        "deepsec.scanOnSave": {
          "type": "boolean",
          "default": true,
          "description": "Scan supported documents when they are saved."
        },
        "deepsec.packageVerification": {
          "type": "string",
          "enum": [
            "seed",
            "remote",
            "off"
          ],
          "default": "remote",
          "description": "How VSCode verifies package names. Remote mode keeps edit-time diagnostics non-blocking by checking the local seed/index first, then verifies unknown packages against npm, PyPI, Cargo, Go modules, and Maven Central."
        },
        "deepsec.configPath": {
          "type": "string",
          "default": "",
          "description": "Path to config.json. Defaults to ~/.vibeguard/config.json."
        },
        "deepsec.deepsecPythonPath": {
          "type": "string",
          "default": "",
          "description": "Optional Python interpreter for DeepSec Shield scanning. When empty, the bundled DeepSec TypeScript engine remains active."
        },
        "deepsec.autoSyncPackageCache": {
          "type": "boolean",
          "default": true,
          "description": "Automatically sync the local package-name cache in the background when VSCode starts."
        },
        "deepsec.packageCacheLanguages": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "npm",
              "pypi",
              "cargo",
              "gomod",
              "maven"
            ]
          },
          "default": [
            "npm",
            "pypi"
          ],
          "description": "Package registries to keep in the local package-name cache. Explicit VSCode settings override config.json package_cache.languages."
        },
        "deepsec.packageCacheUpdateInterval": {
          "type": "string",
          "enum": [
            "daily",
            "weekly"
          ],
          "default": "daily",
          "description": "How often VSCode background sync refreshes package-name indexes."
        },
        "deepsec.packageCacheLightweightMode": {
          "type": "boolean",
          "default": true,
          "description": "Use lightweight partial package-name indexes for faster cold starts."
        },
        "deepsec.packageCacheBackgroundFullSync": {
          "type": "boolean",
          "default": true,
          "description": "After the quick package-name index is ready, continue refreshing a full index in the background. Disable to keep lightweight partial indexes only."
        },
        "deepsec.enableL2": {
          "type": "boolean",
          "default": true,
          "description": "Enable lightweight asynchronous SAST rules for SQL injection, XSS, SSRF, path traversal, unsafe deserialization, and command injection."
        },
        "deepsec.l2DebounceMs": {
          "type": "number",
          "default": 500,
          "minimum": 0,
          "maximum": 30000,
          "description": "Delay in milliseconds before VSCode runs L2 SAST analysis after edits. L1 diagnostics still run immediately."
        },
        "deepsec.enableL3": {
          "type": "boolean",
          "default": false,
          "description": "Enable L3 semantic security checks. When an LLM provider and credential are available, DeepSec uses them; otherwise it falls back to local endpoint heuristics."
        },
        "deepsec.l3DebounceMs": {
          "type": "number",
          "default": 2000,
          "minimum": 0,
          "maximum": 30000,
          "description": "Delay in milliseconds before VSCode runs L3 semantic analysis after edits. Saves and manual scans run L3 immediately."
        },
        "deepsec.llmProvider": {
          "type": "string",
          "enum": [
            "deepseek",
            "claude",
            "openai",
            "local",
            "vibeguard"
          ],
          "default": "deepseek",
          "description": "LLM provider for DeepSec L3 semantic analysis. API keys are stored with VSCode SecretStorage or read from environment variables."
        },
        "deepsec.llmModel": {
          "type": "string",
          "default": "",
          "description": "Optional model override for L3 semantic analysis."
        },
        "deepsec.llmBaseUrl": {
          "type": "string",
          "default": "",
          "description": "Optional provider base URL override for L3 semantic analysis. Remote endpoints must use HTTPS; HTTP is allowed only for loopback local development hosts."
        },
        "deepsec.dedupWithExistingTools": {
          "type": "boolean",
          "default": true,
          "description": "Dismiss duplicate L2 findings when nearby SonarQube, Snyk, Semgrep, or CodeQL annotations already cover the same issue."
        },
        "deepsec.storeFindings": {
          "type": "boolean",
          "default": true,
          "description": "Store scan runs and findings in a local SQLite database."
        },
        "deepsec.findingsDbPath": {
          "type": "string",
          "default": "",
          "description": "Path to findings.db. Defaults to ~/.vibeguard/findings.db."
        },
        "deepsec.ignoredFindings": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "default": [],
          "description": "Exact finding IDs to dismiss in addition to config.json ignored_findings."
        },
        "deepsec.customRules": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "default": [],
          "description": "Paths to custom DeepSec YAML rule files. Relative paths resolve from the workspace folder."
        },
        "deepsec.showCriticalPopups": {
          "type": "boolean",
          "default": true,
          "description": "Show warning popups for newly detected critical findings."
        },
        "deepsec.ignoreRulesPath": {
          "type": "string",
          "default": "",
          "description": "Path to ignore-rules.yml. Defaults to ~/.vibeguard/ignore-rules.yml."
        },
        "vibeguard.enabled": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.enabled] Enable DeepSec security scanning."
        },
        "vibeguard.scanOnChange": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.scanOnChange] Scan supported documents shortly after edits."
        },
        "vibeguard.scanOnSave": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.scanOnSave] Scan supported documents when they are saved."
        },
        "vibeguard.packageVerification": {
          "type": "string",
          "enum": [
            "seed",
            "remote",
            "off"
          ],
          "default": "remote",
          "description": "[Deprecated; use deepsec.packageVerification] How VSCode verifies package names. Remote mode keeps edit-time diagnostics non-blocking by checking the local seed/index first, then verifies unknown packages against npm, PyPI, Cargo, Go modules, and Maven Central."
        },
        "vibeguard.configPath": {
          "type": "string",
          "default": "",
          "description": "[Deprecated; use deepsec.configPath] Path to config.json. Defaults to ~/.vibeguard/config.json."
        },
        "vibeguard.deepsecPythonPath": {
          "type": "string",
          "default": "",
          "description": "[Deprecated; use deepsec.deepsecPythonPath] Optional Python interpreter for DeepSec Shield scanning. When empty, the bundled DeepSec TypeScript engine remains active."
        },
        "vibeguard.autoSyncPackageCache": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.autoSyncPackageCache] Automatically sync the local package-name cache in the background when VSCode starts."
        },
        "vibeguard.packageCacheLanguages": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "npm",
              "pypi",
              "cargo",
              "gomod",
              "maven"
            ]
          },
          "default": [
            "npm",
            "pypi"
          ],
          "description": "[Deprecated; use deepsec.packageCacheLanguages] Package registries to keep in the local package-name cache. Explicit VSCode settings override config.json package_cache.languages."
        },
        "vibeguard.packageCacheUpdateInterval": {
          "type": "string",
          "enum": [
            "daily",
            "weekly"
          ],
          "default": "daily",
          "description": "[Deprecated; use deepsec.packageCacheUpdateInterval] How often VSCode background sync refreshes package-name indexes."
        },
        "vibeguard.packageCacheLightweightMode": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.packageCacheLightweightMode] Use lightweight partial package-name indexes for faster cold starts."
        },
        "vibeguard.packageCacheBackgroundFullSync": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.packageCacheBackgroundFullSync] After the quick package-name index is ready, continue refreshing a full index in the background. Disable to keep lightweight partial indexes only."
        },
        "vibeguard.enableL2": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.enableL2] Enable lightweight asynchronous SAST rules for SQL injection, XSS, SSRF, path traversal, unsafe deserialization, and command injection."
        },
        "vibeguard.l2DebounceMs": {
          "type": "number",
          "default": 500,
          "minimum": 0,
          "maximum": 30000,
          "description": "[Deprecated; use deepsec.l2DebounceMs] Delay in milliseconds before VSCode runs L2 SAST analysis after edits. L1 diagnostics still run immediately."
        },
        "vibeguard.enableL3": {
          "type": "boolean",
          "default": false,
          "description": "[Deprecated; use deepsec.enableL3] Enable L3 semantic security checks. When an LLM provider and credential are available, DeepSec uses them; otherwise it falls back to local endpoint heuristics."
        },
        "vibeguard.l3DebounceMs": {
          "type": "number",
          "default": 2000,
          "minimum": 0,
          "maximum": 30000,
          "description": "[Deprecated; use deepsec.l3DebounceMs] Delay in milliseconds before VSCode runs L3 semantic analysis after edits. Saves and manual scans run L3 immediately."
        },
        "vibeguard.llmProvider": {
          "type": "string",
          "enum": [
            "deepseek",
            "claude",
            "openai",
            "local",
            "vibeguard"
          ],
          "default": "deepseek",
          "description": "[Deprecated; use deepsec.llmProvider] LLM provider for DeepSec L3 semantic analysis. API keys are stored with VSCode SecretStorage or read from environment variables."
        },
        "vibeguard.llmModel": {
          "type": "string",
          "default": "",
          "description": "[Deprecated; use deepsec.llmModel] Optional model override for L3 semantic analysis."
        },
        "vibeguard.llmBaseUrl": {
          "type": "string",
          "default": "",
          "description": "[Deprecated; use deepsec.llmBaseUrl] Optional provider base URL override for L3 semantic analysis. Remote endpoints must use HTTPS; HTTP is allowed only for loopback local development hosts."
        },
        "vibeguard.dedupWithExistingTools": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.dedupWithExistingTools] Dismiss duplicate L2 findings when nearby SonarQube, Snyk, Semgrep, or CodeQL annotations already cover the same issue."
        },
        "vibeguard.storeFindings": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.storeFindings] Store scan runs and findings in a local SQLite database."
        },
        "vibeguard.findingsDbPath": {
          "type": "string",
          "default": "",
          "description": "[Deprecated; use deepsec.findingsDbPath] Path to findings.db. Defaults to ~/.vibeguard/findings.db."
        },
        "vibeguard.ignoredFindings": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "default": [],
          "description": "[Deprecated; use deepsec.ignoredFindings] Exact finding IDs to dismiss in addition to config.json ignored_findings."
        },
        "vibeguard.customRules": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "default": [],
          "description": "[Deprecated; use deepsec.customRules] Paths to custom DeepSec YAML rule files. Relative paths resolve from the workspace folder."
        },
        "vibeguard.showCriticalPopups": {
          "type": "boolean",
          "default": true,
          "description": "[Deprecated; use deepsec.showCriticalPopups] Show warning popups for newly detected critical findings."
        },
        "vibeguard.ignoreRulesPath": {
          "type": "string",
          "default": "",
          "description": "[Deprecated; use deepsec.ignoreRulesPath] Path to ignore-rules.yml. Defaults to ~/.vibeguard/ignore-rules.yml."
        }
      }
    },
    "viewsContainers": {
      "activitybar": [
        {
          "id": "deepsec",
          "title": "DeepSec",
          "icon": "$(shield)"
        }
      ]
    },
    "views": {
      "deepsec": [
        {
          "id": "deepsecFindings",
          "name": "Findings"
        },
        {
          "id": "deepsecL3Panel",
          "name": "AI Deep Scan",
          "type": "webview"
        }
      ]
    }
  },
  "scripts": {
    "compile": "tsc -p ./",
    "build": "node scripts/build.js",
    "watch": "tsc -watch -p ./",
    "test": "node scripts/assert-node-lts.js && npm run compile && node --test \"out/tests/**/*.test.js\"",
    "lint": "tsc --noEmit -p ./",
    "benchmark:cold-start": "npm run build && node scripts/benchmark-cold-start.js",
    "vscode:prepublish": "npm run build",
    "package:vsix": "node scripts/package-vsix.js"
  },
  "devDependencies": {
    "@types/node": "^24.0.0",
    "@types/vscode": "^1.92.0",
    "@vscode/vsce": "^3.9.2",
    "esbuild": "^0.28.1",
    "typescript": "^5.5.4"
  },
  "dependencies": {
    "minimatch": "^10.2.5",
    "tree-sitter-wasms": "^0.1.13",
    "vscode-languageserver": "^10.1.0",
    "vscode-languageserver-textdocument": "^1.0.12",
    "web-tree-sitter": "^0.20.8",
    "yaml": "^2.9.0"
  }
}