rail_verdict 1.0.0

data/lib/rail_verdict/rails_context/resolvers/association_extractor.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module RailsContext
+    module Resolvers
+      module AssociationExtractor
+        MACROS = %w[belongs_to has_one has_many has_and_belongs_to_many].freeze
+
+        def self.extract(repository_root:, path:)
+          full = File.join(repository_root, path)
+          return [] unless File.file?(full)
+          return [] if File.size(full) > Limits::MAX_FILE_BYTES rescue nil
+
+          text = File.binread(full)
+          return [] if text.bytesize > Limits::MAX_FILE_BYTES
+
+          text.force_encoding(Encoding::UTF_8)
+          return [] unless text.valid_encoding?
+          return [] if text.include?("\x00")
+
+          results = []
+          text.each_line do |line|
+            stripped = line.strip
+            next if stripped.start_with?("#")
+
+            MACROS.each do |macro|
+              match = stripped.match(/\A#{Regexp.escape(macro)}\s+[:"]?([a-z_][a-z0-9_]*)["']?/)
+              next unless match
+
+              after = stripped[match[0].length..].to_s.strip
+              next if after.start_with?("->") || after.include?("proc") || after.include?("lambda")
+
+              name = match[1].to_s
+              next if name.empty?
+
+              results << { "name" => name, "macro" => macro, "confidence" => "exact", "provenance" => "literal:#{macro} :#{name}" }
+              break if results.length >= Limits::MAX_ASSOCIATIONS
+            end
+            break if results.length >= Limits::MAX_ASSOCIATIONS
+          end
+          results
+        rescue StandardError
+          []
+        end
+      end
+    end
+  end
+end

data/lib/rail_verdict/rails_context/resolvers/policy_resolver.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module RailsContext
+    module Resolvers
+      module PolicyResolver
+        def self.for(repository_root:, kind:, path:, constant:)
+          return [] unless %w[model controller].include?(kind)
+          return [] if constant.nil? || constant.empty?
+
+          base_name = constant.split("::").last.to_s
+          snake = underscore(base_name)
+          dir_parts = constant.split("::")[0...-1].map { |part| underscore(part) }
+          relative_dir = dir_parts.empty? ? "" : "#{dir_parts.join('/')}/"
+          repo_relative = "app/policies/#{relative_dir}#{snake}_policy.rb"
+          full = File.join(repository_root, repo_relative)
+          return [] unless safe_exists?(repository_root, full)
+
+          [{ "path" => repo_relative, "relationship" => "policy", "confidence" => "conventional", "provenance" => "file_exists:#{repo_relative}" }]
+        rescue StandardError
+          []
+        end
+
+        def self.underscore(camel)
+          word = camel.to_s.dup
+          word.gsub!(/([A-Z\d]+)([A-Z][a-z])/, '\1_\2')
+          word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
+          word.downcase
+        end
+        private_class_method :underscore
+
+        def self.safe_exists?(root, full)
+          return false unless File.file?(full)
+
+          real = File.realpath(full) rescue full
+          real_root = File.realpath(root) rescue root
+          real.start_with?(real_root)
+        rescue StandardError
+          false
+        end
+        private_class_method :safe_exists?
+      end
+    end
+  end
+end

data/lib/rail_verdict/rails_context/resolvers/route_resolver.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module RailsContext
+    module Resolvers
+      module RouteResolver
+        def self.for(repository_root:, kind:, constant:)
+          routes_path = File.join(repository_root, "config/routes.rb")
+          return [] unless File.file?(routes_path)
+
+          real = File.realpath(routes_path) rescue routes_path
+          real_root = File.realpath(repository_root) rescue repository_root
+          return [] unless real.start_with?(real_root)
+
+          base = [{ "path" => "config/routes.rb", "relationship" => "routes", "confidence" => "exact", "provenance" => "file_exists:config/routes.rb" }]
+
+          return base unless kind == "controller" && constant
+
+          controller_key = underscore(constant.delete_suffix("Controller"))
+          scan = RouteScanner.scan(repository_root: repository_root)
+          matching = scan[:declarations].select { |decl| decl["controller"] == controller_key || decl["controller"] == controller_key.split("/").last }
+
+          matching.first(Limits::MAX_RELATED).map do |decl|
+            { "path" => "config/routes.rb", "relationship" => "route_declaration:#{decl['controller']}", "confidence" => "exact", "provenance" => "literal:#{decl['declaration'][0, 120]}" }
+          end.then { |extra| (base + extra).first(Limits::MAX_RELATED) }
+        rescue StandardError
+          []
+        end
+
+        def self.underscore(camel)
+          word = camel.to_s.dup
+          word.gsub!(/([A-Z\d]+)([A-Z][a-z])/, '\1_\2')
+          word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
+          word.downcase
+        end
+        private_class_method :underscore
+      end
+    end
+  end
+end

data/lib/rail_verdict/rails_context/resolvers/route_scanner.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module RailsContext
+    module Resolvers
+      module RouteScanner
+        def self.scan(repository_root:)
+          path = File.join(repository_root, "config/routes.rb")
+          return { declarations: [], unresolved: false } unless File.file?(path)
+          return { declarations: [], unresolved: false } if File.size(path) > Limits::ROUTES_MAX_BYTES rescue nil
+
+          text = File.binread(path)
+          return { declarations: [], unresolved: false } if text.bytesize > Limits::ROUTES_MAX_BYTES
+
+          text.force_encoding(Encoding::UTF_8)
+          return { declarations: [], unresolved: false } unless text.valid_encoding?
+          return { declarations: [], unresolved: true } if text.include?("\x00")
+
+          declarations = []
+          unresolved = false
+
+          text.each_line do |line|
+            stripped = line.strip
+            next if stripped.empty? || stripped.start_with?("#")
+
+            if stripped.match?(/\b(draw|mount|concern|constraints)\b/)
+              unresolved = true
+              next
+            end
+
+            if (match = stripped.match(/\bresources\s*:\s*(\w+)/))
+              declarations << { "controller" => match[1], "declaration" => stripped, "confidence" => "exact" }
+              next
+            end
+            if (match = stripped.match(/\bresource\s*:\s*(\w+)/))
+              declarations << { "controller" => match[1], "declaration" => stripped, "confidence" => "exact" }
+              next
+            end
+            if (match = stripped.match(/\b(?:get|post|put|patch|delete)\s+['\"][^'\"]*['\"]\s*,\s*to:\s*['\"](\w+)#/))
+              declarations << { "controller" => match[1], "declaration" => stripped, "confidence" => "exact" }
+              next
+            end
+            if stripped.match?(/\bresources\b/) && stripped.include?("do")
+              unresolved = true
+            end
+          end
+
+          { declarations: declarations.first(Limits::MAX_RELATED), unresolved: unresolved }
+        rescue StandardError
+          { declarations: [], unresolved: false }
+        end
+      end
+    end
+  end
+end

data/lib/rail_verdict/rails_context/resolvers/schema_resolver.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module RailsContext
+    module Resolvers
+      module SchemaResolver
+        def self.for(repository_root:, kind:, constant:, path:)
+          return [] unless kind == "model"
+          return [] if constant.nil? || constant.empty?
+
+          table = inferred_table(constant)
+          custom = custom_table_name(repository_root, path)
+          if custom
+            if custom[:literal]
+              return [{ "path" => "db/schema.rb", "relationship" => "schema_table:#{custom[:table]}", "confidence" => "exact", "provenance" => "literal:self.table_name=\"#{custom[:table]}\"" }]
+            else
+              return [{ "path" => "db/schema.rb", "relationship" => "schema_table", "confidence" => "unresolved", "provenance" => "dynamic_table_name" }]
+            end
+          end
+
+          schema = SchemaParser.parse(repository_root: repository_root)
+          has_structure_sql = File.file?(File.join(repository_root, "db/structure.sql"))
+
+          if schema.key?(table)
+            return [{ "path" => "db/schema.rb", "relationship" => "schema_table:#{table}", "confidence" => "conventional", "provenance" => "schema_table:#{table}" }]
+          end
+
+          if has_structure_sql
+            return [{ "path" => "db/structure.sql", "relationship" => "schema_table", "confidence" => "unresolved", "provenance" => "structure_sql_not_parsed" }]
+          end
+
+          if table
+            return [{ "path" => "db/schema.rb", "relationship" => "schema_table:#{table}", "confidence" => "inferred", "provenance" => "inferred_table:#{table}" }]
+          end
+
+          []
+        rescue StandardError
+          []
+        end
+
+        def self.inferred_table(constant)
+          base = constant.split("::").last.to_s
+          snake = underscore(base)
+          naive_pluralize(snake)
+        end
+        private_class_method :inferred_table
+
+        def self.custom_table_name(root, path)
+          full = File.join(root, path)
+          return nil unless File.file?(full)
+          return nil if File.size(full) > Limits::MAX_FILE_BYTES rescue nil
+
+          text = File.binread(full)
+          return nil if text.bytesize > Limits::MAX_FILE_BYTES
+
+          text.force_encoding(Encoding::UTF_8)
+          return nil unless text.valid_encoding?
+          return nil if text.include?("\x00")
+
+          literal = text.match(/self\.table_name\s*=\s*["']([^"']+)["']/)
+          return { literal: true, table: literal[1] } if literal
+
+          dynamic = text.match(/self\.table_name\s*=/)
+          return { literal: false, table: nil } if dynamic
+
+          nil
+        rescue StandardError
+          nil
+        end
+        private_class_method :custom_table_name
+
+        def self.underscore(camel)
+          word = camel.to_s.dup
+          word.gsub!(/([A-Z\d]+)([A-Z][a-z])/, '\1_\2')
+          word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
+          word.downcase
+        end
+        private_class_method :underscore
+
+        def self.naive_pluralize(word)
+          return "#{word}s" if word.empty?
+          return "#{word}es" if word.end_with?("s", "x", "z", "ch", "sh")
+
+          "#{word}s"
+        end
+        private_class_method :naive_pluralize
+      end
+    end
+  end
+end

data/lib/rail_verdict/rails_context/resolvers/test_candidates.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module RailsContext
+    module Resolvers
+      module TestCandidates
+        def self.for(repository_root:, kind:, path:)
+          basename = File.basename(path, ".rb")
+          dir = File.dirname(path)
+          candidates = []
+
+          case kind
+          when "model"
+            relative = dir.delete_prefix("app/models").delete_prefix("/")
+            candidates << candidate_path(repository_root, "test", "models", relative, basename)
+            candidates << candidate_path(repository_root, "spec", "models", relative, basename)
+          when "controller"
+            clean = basename.delete_suffix("_controller")
+            relative = dir.delete_prefix("app/controllers").delete_prefix("/")
+            candidates << candidate_path(repository_root, "test", "controllers", relative, basename)
+            candidates << candidate_path(repository_root, "spec", "requests", relative, clean)
+            candidates << candidate_path(repository_root, "spec", "controllers", relative, basename)
+          when "job"
+            relative = dir.delete_prefix("app/jobs").delete_prefix("/")
+            candidates << candidate_path(repository_root, "test", "jobs", relative, basename)
+            candidates << candidate_path(repository_root, "spec", "jobs", relative, basename)
+          when "mailer"
+            relative = dir.delete_prefix("app/mailers").delete_prefix("/")
+            candidates << candidate_path(repository_root, "test", "mailers", relative, basename)
+            candidates << candidate_path(repository_root, "spec", "mailers", relative, basename)
+          when "helper"
+            relative = dir.delete_prefix("app/helpers").delete_prefix("/")
+            candidates << candidate_path(repository_root, "test", "helpers", relative, basename)
+            candidates << candidate_path(repository_root, "spec", "helpers", relative, basename)
+          when "service"
+            relative = dir.delete_prefix("app/services").delete_prefix("/")
+            candidates << candidate_path(repository_root, "test", "services", relative, basename)
+            candidates << candidate_path(repository_root, "spec", "services", relative, basename)
+          else
+            return []
+          end
+
+          candidates.compact.select { |entry| entry[:exists] }.first(2).map do |entry|
+            { "path" => entry[:path], "relationship" => "related_test", "confidence" => "conventional", "provenance" => "file_exists:#{entry[:path]}" }
+          end
+        end
+
+        def self.candidate_path(root, framework, kind_dir, relative, basename)
+          rel = relative.empty? ? "" : "#{relative}/"
+          filename = framework == "test" ? "#{basename}_test.rb" : "#{basename}_spec.rb"
+          repo_relative = "#{framework}/#{kind_dir}/#{rel}#{filename}".gsub(%r{//+}, "/")
+          full = File.join(root, repo_relative)
+          exists = safe_exists?(root, full)
+          return nil unless exists
+
+          { path: repo_relative, exists: true }
+        rescue StandardError
+          nil
+        end
+        private_class_method :candidate_path
+
+        def self.safe_exists?(root, full)
+          return false unless File.file?(full)
+
+          real = File.realpath(full) rescue full
+          real_root = File.realpath(root) rescue root
+          real.start_with?(real_root)
+        rescue StandardError
+          false
+        end
+        private_class_method :safe_exists?
+      end
+    end
+  end
+end

data/lib/rail_verdict/rails_context/resolvers/view_resolver.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module RailsContext
+    module Resolvers
+      module ViewResolver
+        ALLOWED_EXTENSIONS = %w[.html.erb .turbo_stream.erb .json.jbuilder .html.haml .erb .jbuilder].freeze
+
+        def self.for(repository_root:, kind:, path:, constant:)
+          return [] unless kind == "controller"
+          return [] if constant.nil? || constant.empty?
+
+          base = constant.delete_suffix("Controller")
+          parts = base.split("::").map { |part| underscore(part) }
+          view_dir = File.join(repository_root, "app/views", *parts)
+          return [] unless File.directory?(view_dir)
+
+          real = File.realpath(view_dir) rescue view_dir
+          real_root = File.realpath(repository_root) rescue repository_root
+          return [] unless real.start_with?(real_root)
+
+          entries = Dir.children(view_dir).sort.first(Limits::MAX_RELATED)
+          entries.filter_map do |name|
+            full = File.join(view_dir, name)
+            next unless File.file?(full)
+            next unless ALLOWED_EXTENSIONS.any? { |ext| name.end_with?(ext) }
+
+            repo_relative = "app/views/#{parts.join('/')}/#{name}"
+            { "path" => repo_relative, "relationship" => "view", "confidence" => "conventional", "provenance" => "dir_exists:app/views/#{parts.join('/')}" }
+          end
+        rescue StandardError
+          []
+        end
+
+        def self.underscore(camel)
+          word = camel.to_s.dup
+          word.gsub!(/([A-Z\d]+)([A-Z][a-z])/, '\1_\2')
+          word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
+          word.downcase
+        end
+        private_class_method :underscore
+      end
+    end
+  end
+end

data/lib/rail_verdict/rails_context/schema_parser.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module RailsContext
+    module SchemaParser
+      def self.parse(repository_root:)
+        path = File.join(repository_root, "db/schema.rb")
+        return {} unless File.file?(path)
+        return {} if File.size(path) > Limits::MAX_FILE_BYTES rescue nil
+
+        text = File.binread(path)
+        return {} if text.bytesize > Limits::MAX_FILE_BYTES
+
+        text.force_encoding(Encoding::UTF_8)
+        return {} unless text.valid_encoding?
+
+        tables = {}
+        text.scan(/create_table\s+["']([^"']+)["']/) do |match|
+          table = match[0].to_s.strip
+          next if table.empty?
+          next if tables.key?(table)
+
+          break if tables.length >= Limits::MAX_SCHEMA_TABLES
+
+          snippet = extract_table_snippet(text, table)
+          tables[table] = snippet
+        end
+        tables
+      rescue StandardError
+        {}
+      end
+
+      def self.extract_table_snippet(text, table)
+        pattern = /create_table\s+["']#{Regexp.escape(table)}["'].*?\n(.*?)end/m
+        match = text.match(pattern)
+        return { "columns" => [] } unless match
+
+        block_text = match[1].to_s
+        columns = []
+        block_text.scan(/t\.\w+\s+["']([^"']+)["']/) do |col_match|
+          break if columns.length >= Limits::MAX_COLUMNS_PER_TABLE
+
+          columns << { "name" => col_match[0], "type" => "unknown" }
+        end
+        { "columns" => columns }
+      end
+      private_class_method :extract_table_snippet
+    end
+  end
+end

data/lib/rail_verdict/rails_context.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require_relative "rails_context/limits"
+require_relative "rails_context/confidence"
+require_relative "rails_context/classifier"
+require_relative "rails_context/constant_inferencer"
+require_relative "rails_context/detector"
+require_relative "rails_context/schema_parser"
+require_relative "rails_context/resolvers/test_candidates"
+require_relative "rails_context/resolvers/policy_resolver"
+require_relative "rails_context/resolvers/view_resolver"
+require_relative "rails_context/resolvers/route_scanner"
+require_relative "rails_context/resolvers/route_resolver"
+require_relative "rails_context/resolvers/schema_resolver"
+require_relative "rails_context/resolvers/association_extractor"
+require_relative "rails_context/context"
+
+module RailVerdict
+  module RailsContext
+  end
+end

data/lib/rail_verdict/repair/boundary.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module RailVerdict
+  module Repair
+    module Boundary
+      def self.snapshot(repository_root:, configuration:, outcome:)
+        config_digest = configuration&.digest
+        baseline_path = configuration ? Baseline.resolve_path(repository_root: repository_root, configuration: configuration) : nil
+        waiver_path = configuration ? WaiverStore.resolve_path(repository_root: repository_root, configuration: configuration) : nil
+        baseline_digest = file_digest(baseline_path)
+        waivers_digest = file_digest(waiver_path)
+        source_revision = outcome&.context&.revision
+        base_revision = outcome&.context&.git_context&.base rescue nil
+        base_revision ||= outcome&.result&.git&.fetch("base", nil) rescue nil
+        {
+          "configuration_digest" => config_digest || Digest::SHA256.hexdigest(""),
+          "baseline_digest" => baseline_digest,
+          "waivers_digest" => waivers_digest,
+          "base_revision" => base_revision,
+          "source_revision" => source_revision
+        }
+      end
+
+      def self.file_digest(path)
+        return nil unless path && File.file?(path)
+
+        Digest::SHA256.hexdigest(File.binread(path))
+      rescue StandardError
+        nil
+      end
+      private_class_method :file_digest
+    end
+  end
+end

data/lib/rail_verdict/repair/command.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+require "tempfile"
+
+module RailVerdict
+  module Repair
+    class Command
+      def self.execute(repository_root:, config_path:, finding_ref:, format: "console", output_path: nil, changed: false, base: nil, baseline_override: nil, waiver_override: nil, stdout: $stdout, stderr: $stderr)
+        outcome, interrupted = run_check(repository_root: repository_root, config_path: config_path, changed: changed, base: base, baseline_override: baseline_override, waiver_override: waiver_override)
+        return [130, nil] if interrupted || outcome.result.completion_status == "interrupted"
+
+        begin
+          packet = ContextAssembler.build(outcome: outcome, finding_ref: finding_ref, repository_root: repository_root)
+        rescue ContextAssembler::StaleFindingError => e
+          stderr.puts "railverdict repair: #{e.message}"
+          return [2, nil]
+        rescue ArgumentError => e
+          stderr.puts "railverdict repair: #{e.message}"
+          return [2, nil]
+        end
+
+        hash = packet.to_h
+
+        if output_path
+          write_atomic(output_path, hash, stderr)
+          return [2, nil] unless File.file?(output_path)
+        end
+
+        if format == "json"
+          stdout.write(JSON.generate(hash) + "\n")
+        else
+          stdout.write(render_console(hash))
+        end
+        [0, packet]
+      end
+
+      def self.run_check(repository_root:, config_path:, changed:, base:, baseline_override:, waiver_override:)
+        interrupted = false
+        previous = Signal.trap("INT") do
+          interrupted = true
+          RailVerdict::ProcessRunner.registry.terminate_all
+        end
+        opts = { repository_root: repository_root, config_path: config_path, interrupted: -> { interrupted } }
+        opts[:changed] = changed if changed
+        opts[:base] = base if base
+        opts[:baseline_path_override] = baseline_override if baseline_override
+        opts[:waiver_path_override] = waiver_override if waiver_override
+        outcome = Check.execute(**opts)
+        [outcome, interrupted]
+      ensure
+        Signal.trap("INT", previous) if previous
+      end
+      private_class_method :run_check
+
+      def self.write_atomic(path, hash, stderr)
+        dir = File.dirname(File.expand_path(path))
+        FileUtils.mkdir_p(dir)
+        tmp = "#{path}.tmp.#{Process.pid}.#{SecureRandom.hex(4)}"
+        File.write(tmp, JSON.generate(hash) + "\n")
+        File.chmod(0o600, tmp) rescue nil
+        File.rename(tmp, path)
+      rescue StandardError => e
+        stderr.puts "railverdict repair: failed to write #{path}: #{e.message}"
+      ensure
+        File.unlink(tmp) rescue nil
+      end
+      private_class_method :write_atomic
+
+      def self.render_console(hash)
+        lines = []
+        lines << "RepairPacket #{hash['packet_id']}"
+        lines << "Target: #{hash.dig('target','finding','id')} #{hash.dig('target','finding','location','path')}:#{hash.dig('target','finding','location','start_line')}"
+        lines << "Severity: #{hash.dig('target','severity')} Blocking: #{hash.dig('target','blocking')}"
+        lines << "Gate: #{hash.dig('verification','gate')} Policy: #{hash.dig('verification','mode')}"
+        lines << "Reason: #{hash.dig('verification','decision_reasons',0,'message')}"
+        plan = hash.dig("verification_plan","required",0,"display") || "bundle exec railverdict check"
+        lines << "Verify: #{plan}"
+        lines << "Constraints: do not update baseline/waiver/policy; require verification"
+        if hash["ai_analysis"]
+          lines << "AI: #{hash.dig('ai_analysis','summary')&.slice(0, 80)}"
+        end
+        lines.join("\n") + "\n"
+      end
+      private_class_method :render_console
+    end
+  end
+end

data/lib/rail_verdict/repair/constraints.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Repair
+    module Constraints
+      DEFAULT = {
+        "forbid_baseline_update" => true,
+        "forbid_waiver_creation" => true,
+        "forbid_policy_relaxation" => true,
+        "require_verification" => true
+      }.freeze
+
+      INSTRUCTIONS = [
+        "Do not modify baseline files (.railverdict-baseline.json).",
+        "Do not create waiver files (.railverdict-waivers.json).",
+        "Do not weaken verification policy (mode strict/no_new_debt/advisory).",
+        "Do not disable analyzers or make required analyzers optional.",
+        "Preserve unrelated behavior; fix root cause, do not suppress the rule.",
+        "Run required verification after modification."
+      ].freeze
+
+      def self.default
+        DEFAULT.dup
+      end
+
+      def self.instructions
+        INSTRUCTIONS.dup
+      end
+    end
+  end
+end