rail_verdict 1.0.0

data/lib/rail_verdict/git/diff_parser.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Git
+    module DiffParser
+      module_function
+
+      def parse_name_status_nul(raw)
+        return [] if raw.nil? || raw.empty?
+
+        parts = raw.split("\0")
+        parts.pop if parts.last == ""
+        files = []
+        index = 0
+        while index < parts.length
+          entry = parts[index]
+          break if entry.nil? || entry.empty?
+
+          status_char = entry[0]
+          case status_char
+          when "R", "C"
+            old_path = parts[index + 1]
+            new_path = parts[index + 2]
+            if old_path.nil? || new_path.nil?
+              raise Git::Error, "malformed git name-status output (rename requires two paths)"
+            end
+            score = entry[1..].to_i
+            files << ChangedFile.new(status: status_char == "R" ? :renamed : :copied, path: normalize_path(new_path), old_path: normalize_path(old_path), new_path: normalize_path(new_path), score: score, binary: false)
+            index += 3
+          when "A"
+            path = parts[index + 1]
+            raise Git::Error, "malformed git name-status output (added requires path)" if path.nil?
+
+            files << ChangedFile.new(status: :added, path: normalize_path(path), old_path: nil, new_path: normalize_path(path), score: nil, binary: false)
+            index += 2
+          when "D"
+            path = parts[index + 1]
+            raise Git::Error, "malformed git name-status output (deleted requires path)" if path.nil?
+
+            files << ChangedFile.new(status: :deleted, path: nil, old_path: normalize_path(path), new_path: nil, score: nil, binary: false)
+            index += 2
+          when "M", "T"
+            path = parts[index + 1]
+            raise Git::Error, "malformed git name-status output (modified requires path)" if path.nil?
+
+            mapped = status_char == "T" ? :typechange : :modified
+            files << ChangedFile.new(status: mapped, path: normalize_path(path), old_path: normalize_path(path), new_path: normalize_path(path), score: nil, binary: false)
+            index += 2
+          else
+            raise Git::Error, "unexpected git name-status entry: #{entry.inspect}"
+          end
+        end
+        files.sort_by { |file| (file.path || file.old_path || "").to_s }
+      end
+
+      def parse_numstat_nul(raw)
+        return {} if raw.nil? || raw.empty?
+
+        parts = raw.split("\0")
+        parts.pop if parts.last == ""
+        result = {}
+        parts.each do |entry|
+          next if entry.empty?
+
+          fields = entry.split("\t")
+          next unless fields.length == 3
+
+          added, deleted, path = fields
+          binary = added == "-" || deleted == "-"
+          result[normalize_path(path)] = { added: binary ? nil : added.to_i, deleted: binary ? nil : deleted.to_i, binary: binary }
+        end
+        result
+      end
+
+      def parse_numstat_rename_nul(raw)
+        return {} if raw.nil? || raw.empty?
+
+        parts = raw.split("\0")
+        parts.pop if parts.last == ""
+        result = {}
+        parts.each do |entry|
+          next if entry.empty?
+
+          fields = entry.split("\t")
+          next unless fields.length >= 3
+
+          added, deleted = fields[0], fields[1]
+          binary = added == "-" || deleted == "-"
+          path = fields.length == 4 ? fields[3] : fields[2]
+          key = normalize_path(path)
+          result[key] = { added: binary ? nil : added.to_i, deleted: binary ? nil : deleted.to_i, binary: binary }
+        end
+        result
+      end
+
+      def parse_changed_lines_unified(raw, changed_paths)
+        return {} if raw.nil? || raw.empty?
+
+        return {} if changed_paths.nil? || changed_paths.empty?
+
+        binary_set = Set.new
+        changed_paths.each do |file|
+          binary_set.add(file[:path]) if file[:binary]
+          binary_set.add(file[:new_path]) if file[:binary] && file[:new_path]
+        end
+
+        segments = split_unified_by_nul(raw)
+        line_set = {}
+        segments.each do |segment|
+          path, diff_text = segment
+          normalized = normalize_path(path.to_s)
+          next if binary_set.include?(normalized)
+          next if diff_text.nil? || diff_text.empty?
+
+          lines = parse_unified_hunks(diff_text)
+          line_set[normalized] = lines.sort.freeze unless lines.empty?
+        end
+        line_set
+      end
+
+      def split_unified_by_nul(raw)
+        raw_text = raw.dup.force_encoding(Encoding::UTF_8).scrub("?")
+        if raw_text.include?("\0")
+          parts = raw_text.split("\0")
+          parts.pop if parts.last == ""
+          segments = []
+          parts.each_slice(2) do |path, diff_text|
+            next if path.nil?
+
+            segments << [path, diff_text || ""]
+          end
+          segments
+        else
+          split_unified_without_nul(raw_text)
+        end
+      end
+
+      def split_unified_without_nul(raw_text)
+        segments = []
+        current_path = nil
+        current_lines = []
+        raw_text.each_line do |line|
+          if line.start_with?("diff --git ")
+            if current_path
+              segments << [current_path, current_lines.join]
+            end
+            match = line.match(%r{\Adiff --git a/.+ b/(.+)\n?\z})
+            current_path = match ? match[1].strip : "unknown"
+            current_lines = []
+          elsif current_path
+            current_lines << line
+          end
+        end
+        segments << [current_path, current_lines.join] if current_path
+        segments
+      end
+      private_class_method :split_unified_without_nul
+
+      def parse_unified_hunks(diff_text)
+        lines = []
+        new_line = nil
+        diff_text.each_line do |raw_line|
+          if raw_line.start_with?("@@ ")
+            match = raw_line.match(/\A@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/)
+            new_line = match ? match[1].to_i : nil
+            next
+          end
+          next if new_line.nil?
+          next if raw_line.start_with?("diff --git") || raw_line.start_with?("index ") || raw_line.start_with?("--- ") || raw_line.start_with?("+++ ")
+
+          if raw_line.start_with?("+")
+            next if raw_line.start_with?("+++ ")
+
+            lines << new_line
+            new_line += 1
+          elsif raw_line.start_with?("-")
+            next
+          elsif raw_line.start_with?(" ") || raw_line.start_with?("\\")
+            new_line += 1 if raw_line.start_with?(" ")
+          elsif raw_line.strip.empty?
+            next
+          else
+            next
+          end
+        end
+        lines
+      end
+      private_class_method :parse_unified_hunks
+
+      def normalize_path(path)
+        raw = path.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").strip
+        raw = raw.delete_prefix("./")
+        raw = raw.delete_prefix("/")
+        raw = raw.unicode_normalize(:nfc) if raw.respond_to?(:unicode_normalize)
+        raw
+      end
+      private_class_method :normalize_path
+    end
+  end
+end

data/lib/rail_verdict/git/errors.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Git
+    class Error < RailVerdict::Error; end
+
+    class NotARepository < Error; end
+    class Unavailable < Error; end
+    class InvalidRevision < Error; end
+    class BaseUnresolvable < Error; end
+    class MergeBaseFailure < Error; end
+    class DiffFailure < Error; end
+    class Timeout < Error; end
+    class Truncated < Error; end
+  end
+end

data/lib/rail_verdict/init.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "pathname"
+
+module RailVerdict
+  module Init
+    CONFIGURATION = <<~YAML
+      version: 1
+      mode: no_new_debt
+      analyzers:
+        rubocop:
+          enabled: true
+          required: true
+    YAML
+
+    module_function
+
+    def write(root:, config_path:, force: false)
+      path = Pathname.new(config_path.to_s)
+      path = Pathname.new(File.expand_path(path.to_s, root)) unless path.absolute?
+      if path.exist? && !force
+        return [2, "configuration already exists: #{relative_path(path.to_s, root)}; use --force to overwrite"]
+      end
+      parent = path.dirname
+      return [2, "configuration directory does not exist: #{relative_path(parent.to_s, root)}"] unless parent.directory?
+
+      File.write(path, CONFIGURATION)
+      [0, "initialized #{relative_path(path.to_s, root)}"]
+    rescue SystemCallError => error
+      [2, "could not write configuration: #{error.message}"]
+    end
+
+    def relative_path(path, root)
+      Pathname.new(path).relative_path_from(Pathname.new(root)).to_s
+    end
+    private_class_method :relative_path
+  end
+end

data/lib/rail_verdict/intelligence/ai_analysis.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Intelligence
+    class AIAnalysis
+      SCHEMA_VERSION = "1.0"
+      ASSESSMENTS = %w[likely_cause needs_investigation uncertain].freeze
+      CONFIDENCES = %w[low medium high].freeze
+
+      attr_reader :finding_id, :fingerprint, :assessment, :confidence, :summary,
+                  :root_cause, :suggested_fix, :recommended_tests, :evidence_notes, :provenance
+
+      def initialize(finding_id:, fingerprint:, assessment:, confidence:, summary:, provenance:,
+                     root_cause: nil, suggested_fix: nil, recommended_tests: [], evidence_notes: [])
+        @finding_id = finding_id.dup.freeze
+        @fingerprint = fingerprint.dup.freeze
+        @assessment = assessment.dup.freeze
+        @confidence = confidence.dup.freeze
+        @summary = summary.dup.freeze
+        @root_cause = root_cause&.dup&.freeze
+        @suggested_fix = suggested_fix&.dup&.freeze
+        @recommended_tests = (recommended_tests || []).map { |v| v.dup.freeze }.freeze
+        @evidence_notes = (evidence_notes || []).map { |v| v.dup.freeze }.freeze
+        @provenance = deep_freeze(provenance.dup)
+        validate!
+        freeze
+      end
+
+      def to_h
+        h = {
+          "schema_version" => SCHEMA_VERSION,
+          "finding_id" => finding_id,
+          "fingerprint" => fingerprint,
+          "assessment" => assessment,
+          "confidence" => confidence,
+          "summary" => summary,
+          "provenance" => provenance
+        }
+        h["root_cause"] = root_cause if root_cause
+        h["suggested_fix"] = suggested_fix if suggested_fix
+        h["recommended_tests"] = recommended_tests unless recommended_tests.empty?
+        h["evidence_notes"] = evidence_notes unless evidence_notes.empty?
+        h
+      end
+
+      def self.from_hash(hash)
+        errors = SchemaValidator.validate_ai_analysis(hash)
+        raise ArgumentError, errors.join("; ") unless errors.empty?
+
+        new(
+          finding_id: hash.fetch("finding_id"),
+          fingerprint: hash.fetch("fingerprint"),
+          assessment: hash.fetch("assessment"),
+          confidence: hash.fetch("confidence"),
+          summary: hash.fetch("summary"),
+          root_cause: hash["root_cause"],
+          suggested_fix: hash["suggested_fix"],
+          recommended_tests: hash["recommended_tests"] || [],
+          evidence_notes: hash["evidence_notes"] || [],
+          provenance: hash.fetch("provenance")
+        )
+      end
+
+      private
+
+      def validate!
+        raise ArgumentError, "assessment must be one of #{ASSESSMENTS.join(', ')}" unless ASSESSMENTS.include?(assessment)
+        raise ArgumentError, "confidence must be one of #{CONFIDENCES.join(', ')}" unless CONFIDENCES.include?(confidence)
+        raise ArgumentError, "fingerprint invalid" unless fingerprint.match?(/\Asha256:[0-9a-f]{64}\z/)
+      end
+
+      def deep_freeze(value)
+        case value
+        when Hash then value.each { |k, v| k.freeze if k.is_a?(String); deep_freeze(v) }; value.freeze
+        when Array then value.each { |v| deep_freeze(v) }; value.freeze
+        when String then value.freeze
+        else value
+        end
+      end
+    end
+  end
+end

data/lib/rail_verdict/intelligence/ai_failure.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Intelligence
+    class AIFailure
+      CODES = %w[
+        disabled
+        provider_unavailable
+        authentication_failed
+        rate_limited
+        timed_out
+        budget_exhausted
+        context_rejected
+        secret_detected
+        response_invalid
+        schema_invalid
+        context_too_large
+        manifest_invalid
+      ].freeze
+
+      attr_reader :code, :message
+
+      def initialize(code:, message:)
+        raise ArgumentError, "invalid code" unless CODES.include?(code.to_s)
+
+        @code = code.to_s.freeze
+        @message = sanitize(message.to_s).freeze
+        freeze
+      end
+
+      def to_h
+        { "code" => code, "message" => message }
+      end
+
+      private
+
+      def sanitize(text)
+        cleaned = text.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?")
+        cleaned = cleaned.gsub(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/, "?")
+        cleaned.strip[0, 1024]
+      end
+    end
+  end
+end

data/lib/rail_verdict/intelligence/budget.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Intelligence
+    class Budget
+      DEFAULTS = {
+        max_findings: 3,
+        max_requests: 3,
+        max_context_bytes: 64 * 1024
+      }.freeze
+
+      attr_reader :max_findings, :max_requests, :max_context_bytes
+
+      def initialize(config_budgets = {})
+        @max_findings = (config_budgets["max_findings"] || DEFAULTS[:max_findings]).to_i
+        @max_requests = (config_budgets["max_requests"] || DEFAULTS[:max_requests]).to_i
+        @max_context_bytes = (config_budgets["max_context_bytes"] || DEFAULTS[:max_context_bytes]).to_i
+      end
+
+      def enforce!(manifest)
+        if manifest.total_bytes > max_context_bytes
+          raise AIFailure.new(code: "budget_exhausted", message: "context exceeds max_context_bytes #{max_context_bytes}")
+        end
+      end
+
+      def self.select_findings(findings, limit:)
+        severity_rank = { "critical" => 0, "high" => 1, "medium" => 2, "low" => 3, "info" => 4 }
+        findings.sort_by do |f|
+          blocking = f.respond_to?(:state) ? (f.state == "introduced" ? 0 : 1) : 1
+          sev = severity_rank[f.severity] || 5
+          [blocking, sev, f.sort_key]
+        end.first(limit)
+      end
+    end
+  end
+end

data/lib/rail_verdict/intelligence/cache.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "tempfile"
+require "fileutils"
+
+module RailVerdict
+  module Intelligence
+    class Cache
+      MAX_TOTAL_BYTES = 10 * 1024 * 1024
+
+      def initialize(root:, enabled: false)
+        @root = root.to_s
+        @enabled = enabled
+        @dir = File.join(@root, ".railverdict", "cache", "ai")
+      end
+
+      def enabled?
+        @enabled
+      end
+
+      def key_for(fingerprint:, context_hash:, provider:, model:, prompt_version:, schema_version:)
+        Digest::SHA256.hexdigest([fingerprint, context_hash, provider, model, prompt_version, schema_version].join("|"))
+      end
+
+      def read(key)
+        return nil unless @enabled
+
+        path = File.join(@dir, "#{key}.json")
+        return nil unless File.file?(path)
+
+        data = JSON.parse(File.read(path))
+        AIAnalysis.from_hash(data)
+      rescue StandardError
+        nil
+      end
+
+      def write(key, analysis)
+        return unless @enabled
+
+        FileUtils.mkdir_p(@dir)
+        path = File.join(@dir, "#{key}.json")
+        tmp = Tempfile.new(["ai-cache", ".json"], @dir)
+        begin
+          tmp.write(JSON.generate(analysis.to_h))
+          tmp.flush
+          tmp.fsync
+          File.chmod(0o600, tmp.path)
+          File.rename(tmp.path, path)
+          File.chmod(0o600, path) rescue nil
+          enforce_size_limit
+        ensure
+          tmp.close rescue nil
+          File.unlink(tmp.path) rescue nil
+        end
+      end
+
+      private
+
+      def enforce_size_limit
+        files = Dir.glob(File.join(@dir, "*.json")).map { |p| [p, File.size(p)] }.sort_by { |_, s| s }
+        total = files.sum { |_, s| s }
+        files.each do |path, _|
+          break if total <= MAX_TOTAL_BYTES
+
+          size = File.size(path) rescue 0
+          File.unlink(path) rescue nil
+          total -= size
+        end
+      end
+    end
+  end
+end

data/lib/rail_verdict/intelligence/context_builder.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Intelligence
+    module ContextBuilder
+      MAX_FILES = 3
+      MAX_CONTEXT_BYTES = 64 * 1024
+
+      def self.build(outcome:, finding_ref:, repository_root: nil)
+        root = repository_root || outcome.context&.repository_root || Dir.pwd
+        findings = outcome.findings || []
+        target = findings.find { |f| f.id == finding_ref || f.fingerprint == finding_ref }
+        raise ArgumentError, "finding not found: #{finding_ref}" unless target
+
+        location = target.location || {}
+        path = location["path"] || location[:path]
+        line = location["start_line"] || location[:start_line]
+
+        snippets = []
+        if path
+          snippet = SourceReader.read_snippet(repository_root: root, path: path, target_line: line)
+          snippets << snippet if snippet
+        end
+        snippets = snippets.first(MAX_FILES)
+
+        rails_facts = extract_rails_facts(outcome, path)
+        git_slice = extract_git_slice(outcome)
+        comparison_slice = extract_comparison(outcome)
+        policy_reason = outcome.result&.decision_reasons&.first&.fetch("message", nil) rescue nil
+
+        manifest = Manifest.new(
+          finding_id: target.id,
+          fingerprint: target.fingerprint,
+          finding: target.to_schema_h,
+          snippets: snippets.map { |s| { "path" => s[:path], "content" => sanitize(s[:content]), "truncated" => s[:truncated] } },
+          rails_facts: rails_facts,
+          git_slice: git_slice,
+          comparison_slice: comparison_slice,
+          policy_reason: policy_reason
+        )
+
+        if manifest.total_bytes > MAX_CONTEXT_BYTES
+          trimmed = Manifest.new(
+            finding_id: manifest.finding_id,
+            fingerprint: manifest.fingerprint,
+            finding: manifest.finding,
+            snippets: manifest.snippets.first(1).map { |s| s.merge("content" => s["content"].byteslice(0, 16 * 1024).to_s) },
+            rails_facts: rails_facts.is_a?(Array) ? rails_facts.first(1) : rails_facts,
+            git_slice: git_slice,
+            comparison_slice: comparison_slice,
+            policy_reason: policy_reason
+          )
+          return trimmed
+        end
+
+        manifest
+      end
+
+      def self.extract_rails_facts(outcome, path)
+        rc = outcome.result&.instance_variable_get(:@rails_context) rescue nil
+        rc ||= outcome.result&.to_schema_h&.fetch("rails_context", nil) rescue nil
+        return [] unless rc
+
+        entries = rc["entries"] || rc[:entries] || []
+        return entries unless path
+
+        entries.select { |e| (e["source_path"] || e[:source_path]) == path }.first(1)
+      end
+
+      def self.extract_git_slice(outcome)
+        git = outcome.result&.instance_variable_get(:@git) rescue nil
+        return {} unless git
+
+        { "head" => git["head"], "base" => git["base"], "merge_base" => git["merge_base"] }
+      end
+
+      def self.extract_comparison(outcome)
+        comp = outcome.result&.instance_variable_get(:@comparison) rescue nil
+        return {} unless comp
+
+        { "counts" => comp["counts"] }
+      end
+
+      def self.sanitize(text)
+        t = text.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?")
+        t = t.gsub(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/, "?")
+        t
+      end
+      private_class_method :sanitize
+    end
+  end
+end

data/lib/rail_verdict/intelligence/manifest.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+
+module RailVerdict
+  module Intelligence
+    class Manifest
+      attr_reader :finding_id, :fingerprint, :finding, :snippets, :rails_facts,
+                  :git_slice, :comparison_slice, :policy_reason
+
+      def initialize(finding_id:, fingerprint:, finding:, snippets:, rails_facts:, git_slice:, comparison_slice:, policy_reason:)
+        @finding_id = finding_id.dup.freeze
+        @fingerprint = fingerprint.dup.freeze
+        @finding = deep_freeze(finding.dup)
+        @snippets = deep_freeze(snippets.map(&:dup))
+        @rails_facts = deep_freeze(rails_facts)
+        @git_slice = deep_freeze(git_slice)
+        @comparison_slice = deep_freeze(comparison_slice)
+        @policy_reason = policy_reason&.dup&.freeze
+        freeze
+      end
+
+      def to_h
+        {
+          finding_id: finding_id,
+          fingerprint: fingerprint,
+          finding: finding,
+          snippets: snippets,
+          rails_facts: rails_facts,
+          git_slice: git_slice,
+          comparison_slice: comparison_slice,
+          policy_reason: policy_reason
+        }
+      end
+
+      def to_json_hash
+        {
+          "finding_id" => finding_id,
+          "fingerprint" => fingerprint,
+          "finding" => finding,
+          "snippets" => snippets,
+          "rails_facts" => rails_facts,
+          "git_slice" => git_slice,
+          "comparison_slice" => comparison_slice,
+          "policy_reason" => policy_reason
+        }
+      end
+
+      def context_hash
+        Digest::SHA256.hexdigest(JSON.generate(to_json_hash.sort.to_h))
+      end
+
+      def total_bytes
+        JSON.generate(to_json_hash).bytesize
+      end
+
+      private
+
+      def deep_freeze(value)
+        case value
+        when Hash then value.each { |k, v| k.freeze if k.is_a?(String); deep_freeze(v) }; value.freeze
+        when Array then value.each { |v| deep_freeze(v) }; value.freeze
+        when String then value.freeze
+        else value
+        end
+      end
+    end
+  end
+end