FixGuard

A verifiable, local-first CLI system for safe code evolution.

Features

• 🔍 Multi-language support - TypeScript, JavaScript, Python, and more
• 🛡️ Security hardening - OWASP-compliant checks and fixes
• ⏪ Rollback support - Every change can be undone
• 📊 Comprehensive reporting - Markdown, JSON, and SARIF formats
• 🔒 Safe by design - Tools and tests are the judges, never AI

Installation

# Clone the repository
git clone https://github.com/your-org/fixguard.git
cd fixguard

# Install Node.js dependencies
npm install

# Install Python dependencies
cd python && pip install -e ".[dev]" && cd ..

# Build TypeScript
npm run build

# Link globally (optional)
npm link

Usage

Scan (Read-only Analysis)

fixguard scan .

Scan with Auto-fix (Low-risk fixes only)

fixguard scan . --auto-fix

Guided Refactor (Proposals require approval)

fixguard scan . --mode=guided-refactor

CI Mode (Strict, non-interactive)

fixguard scan . --ci

Generate Reports

fixguard report .
fixguard report . --format=json
fixguard report . --format=sarif

Rollback Changes

fixguard rollback <run-id>
fixguard rollback <run-id> --dry-run

Execution Modes

| Mode | Description | Auto-fix | Refactor | Interactive | |------|-------------|----------|----------|-------------| | observe | Read-only analysis (default) | ❌ | ❌ | ✅ | | safe-fix | Low-risk fixes only | ✅ | ❌ | ✅ | | guided-refactor | Proposals + approval | ✅ | ✅ | ✅ | | ci | Strict, non-interactive | ❌ | ❌ | ❌ |

Core Principles

1. AI has zero authority - Tools and tests decide
2. Every change is verifiable - Backed by tests
3. Every change is reversible - Snapshot and rollback
4. Every action is logged - Immutable run logs
5. If uncertain → report, don't guess

Architecture

┌─────────────────────────────────────────────────────┐
│                 TypeScript Layer                     │
│         (Orchestration - "What Happens")            │
├─────────────────────────────────────────────────────┤
│  CLI  │  Detection  │  Decision  │  Snapshots      │
│       │             │  Engine    │  & Rollback     │
└────────────────────────┬────────────────────────────┘
                         │ JSON Bridge
┌────────────────────────▼────────────────────────────┐
│                   Python Layer                       │
│          (Transformation - "How Code Changes")       │
├─────────────────────────────────────────────────────┤
│  Analyzers  │  Fixers  │  Security  │  Testing     │
│  (ESLint,   │  (Rule-  │  Hardening │  (Test Gen)  │
│   Ruff...)  │  based)  │  (OWASP)   │              │
└─────────────────────────────────────────────────────┘

Security Hardening

FixGuard checks and hardens:

• Rate limiting on public endpoints
• Input validation and sanitization
• Secret handling (no hardcoded keys)
• SQL injection prevention
• XSS prevention

All security fixes follow OWASP Top 10 best practices.

License

MIT