spurline-core 0.3.0

data/lib/spurline/cartographer/analyzers/entry_points.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+require "json"
+require "set"
+
+module Spurline
+  module Cartographer
+    module Analyzers
+      class EntryPoints < Analyzer
+        def analyze
+          grouped = {
+            web: Set.new,
+            background: Set.new,
+            console: Set.new,
+            test: Set.new,
+            lint: Set.new,
+            deploy: Set.new,
+          }
+
+          collect_executables(grouped)
+          collect_procfile(grouped)
+          collect_makefile(grouped)
+          collect_package_scripts(grouped)
+          collect_rakefile(grouped)
+
+          @findings = {
+            entry_points: grouped.transform_values { |commands| commands.to_a.sort },
+          }
+        end
+
+        def confidence
+          commands = findings[:entry_points].values.flatten
+          commands.empty? ? 0.5 : 0.9
+        end
+
+        private
+
+        def collect_executables(grouped)
+          (glob("bin/*") + glob("exe/*")).uniq.each do |path|
+            next unless File.file?(path)
+
+            command = "./#{relative_path(path)}"
+            classify_command(grouped, File.basename(path), command)
+          end
+        end
+
+        def collect_procfile(grouped)
+          content = read_file("Procfile")
+          return unless content
+
+          content.each_line do |line|
+            stripped = line.strip
+            next if stripped.empty? || stripped.start_with?("#")
+
+            type, command = stripped.split(":", 2)
+            next unless type && command
+
+            normalized = command.strip
+            case type.strip
+            when "web"
+              grouped[:web] << normalized
+            when "worker", "jobs", "queue"
+              grouped[:background] << normalized
+            when "console"
+              grouped[:console] << normalized
+            when "test"
+              grouped[:test] << normalized
+            end
+          end
+        end
+
+        def collect_makefile(grouped)
+          content = read_file("Makefile")
+          return unless content
+
+          content.each_line do |line|
+            match = line.match(/^([A-Za-z0-9_.-]+):(?:\s|$)/)
+            next unless match
+
+            target = match[1]
+            next if target.start_with?(".") || target.include?("%")
+
+            command = "make #{target}"
+            classify_command(grouped, target, command)
+          end
+        end
+
+        def collect_package_scripts(grouped)
+          content = read_file("package.json")
+          return unless content
+
+          package = JSON.parse(content)
+          scripts = package["scripts"]
+          return unless scripts.is_a?(Hash)
+
+          scripts.each do |name, script|
+            command = script.to_s.strip
+            next if command.empty?
+
+            classify_command(grouped, name, command)
+          end
+        rescue JSON::ParserError
+          nil
+        end
+
+        def collect_rakefile(grouped)
+          content = read_file("Rakefile")
+          return unless content
+
+          grouped[:test] << "bundle exec rake spec" if content.match?(/RSpec::Core::RakeTask|task\s+:spec/)
+          grouped[:console] << "bundle exec rake -T"
+        end
+
+        def classify_command(grouped, name, command)
+          token = name.to_s.downcase
+          lower_command = command.downcase
+
+          if token.match?(/web|server|start|puma|rails/) || lower_command.match?(/\b(puma|rails server|rackup|npm start|node\s+)/)
+            grouped[:web] << command
+          end
+
+          if token.match?(/worker|job|queue|sidekiq|resque/) || lower_command.match?(/\b(sidekiq|resque|worker)\b/)
+            grouped[:background] << command
+          end
+
+          if token.match?(/console|repl|irb|pry/) || lower_command.match?(/\b(rails console|irb|pry)\b/)
+            grouped[:console] << command
+          end
+
+          if token.match?(/test|spec|rspec|jest|pytest/) || lower_command.match?(/\b(rspec|jest|pytest|minitest|go test|cargo test|npm test|bundle exec rspec)\b/)
+            grouped[:test] << command
+          end
+
+          if token.match?(/lint|rubocop|eslint|prettier/) || lower_command.match?(/\b(rubocop|eslint|prettier|lint)\b/)
+            grouped[:lint] << command
+          end
+
+          if token.match?(/deploy|release/) || lower_command.match?(/\b(deploy|kubectl|helm|cap\s)\b/)
+            grouped[:deploy] << command
+          end
+        end
+      end
+    end
+  end
+end

data/lib/spurline/cartographer/analyzers/file_signatures.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Spurline
+  module Cartographer
+    module Analyzers
+      class FileSignatures < Analyzer
+        LANGUAGE_SENTINELS = {
+          ruby: %w[Gemfile Gemfile.lock .ruby-version Rakefile],
+          javascript: %w[package.json .node-version .nvmrc],
+          python: %w[pyproject.toml .python-version requirements.txt],
+          go: %w[go.mod],
+          rust: %w[Cargo.toml],
+          java: %w[pom.xml],
+        }.freeze
+
+        TOOLCHAIN_SENTINELS = %w[Makefile docker-compose.yml Dockerfile].freeze
+        PRIORITY = %i[ruby javascript python go rust java].freeze
+
+        def analyze
+          language_scores = {}
+          detected = {}
+
+          LANGUAGE_SENTINELS.each do |language, files|
+            present = files.select { |file| file_exists?(file) }
+            next if present.empty?
+
+            language_scores[language] = present.length
+            detected[language] = present
+          end
+
+          ordered_languages = language_scores.keys.sort_by do |language|
+            [-language_scores[language], PRIORITY.index(language) || PRIORITY.length]
+          end
+
+          @findings = {
+            languages: {
+              primary: ordered_languages.first,
+              secondary: ordered_languages.drop(1),
+            },
+            metadata: {
+              file_signatures: {
+                detected: detected,
+                toolchain: TOOLCHAIN_SENTINELS.select { |file| file_exists?(file) },
+              },
+            },
+          }
+        end
+
+        def confidence
+          findings.dig(:languages, :primary).nil? ? 0.85 : 1.0
+        end
+      end
+    end
+  end
+end

data/lib/spurline/cartographer/analyzers/manifests.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Spurline
+  module Cartographer
+    module Analyzers
+      class Manifests < Analyzer
+        WEB_FRAMEWORKS = {
+          rails: "rails",
+          sinatra: "sinatra",
+          express: "express",
+          django: "django",
+        }.freeze
+
+        TEST_FRAMEWORKS = {
+          rspec: %w[rspec rspec-rails],
+          minitest: %w[minitest],
+          jest: %w[jest],
+          pytest: %w[pytest],
+        }.freeze
+
+        LINTERS = {
+          rubocop: "rubocop",
+          eslint: "eslint",
+          prettier: "prettier",
+        }.freeze
+
+        def analyze
+          gemfile = read_file("Gemfile")
+          gemfile_lock = read_file("Gemfile.lock")
+          package = parse_json_file("package.json")
+          pyproject = read_file("pyproject.toml")
+
+          frameworks = {}
+
+          web_name, web_version = detect_web_framework(
+            gemfile: gemfile,
+            gemfile_lock: gemfile_lock,
+            package: package,
+            pyproject: pyproject
+          )
+          frameworks[:web] = { name: web_name, version: web_version } if web_name
+
+          test_framework = detect_test_framework(
+            gemfile: gemfile,
+            gemfile_lock: gemfile_lock,
+            package: package,
+            pyproject: pyproject
+          )
+          frameworks[:test] = test_framework if test_framework
+
+          linters = detect_linters(
+            gemfile: gemfile,
+            gemfile_lock: gemfile_lock,
+            package: package,
+            pyproject: pyproject
+          )
+          frameworks[:linter] = linters.length == 1 ? linters.first : linters unless linters.empty?
+
+          ruby_version = detect_ruby_version(gemfile)
+          node_version = detect_node_version(package)
+
+          parsed_files = []
+          parsed_files << "Gemfile" if gemfile
+          parsed_files << "Gemfile.lock" if gemfile_lock
+          parsed_files << "package.json" if package
+          parsed_files << "pyproject.toml" if pyproject
+          parsed_files << ".ruby-version" if file_exists?(".ruby-version")
+          parsed_files << ".node-version" if file_exists?(".node-version")
+          parsed_files << ".python-version" if file_exists?(".python-version")
+
+          result = {
+            frameworks: frameworks,
+            metadata: {
+              manifests: {
+                parsed_files: parsed_files,
+              },
+            },
+          }
+          result[:ruby_version] = ruby_version if ruby_version
+          result[:node_version] = node_version if node_version
+
+          @findings = result
+        end
+
+        def confidence
+          parsed_count = findings.dig(:metadata, :manifests, :parsed_files)&.length.to_i
+          parsed_count.zero? ? 0.6 : 0.95
+        end
+
+        private
+
+        def detect_web_framework(gemfile:, gemfile_lock:, package:, pyproject:)
+          return [:rails, gem_version("rails", gemfile, gemfile_lock, package)] if dependency_present?("rails", gemfile, gemfile_lock, package, pyproject)
+          return [:sinatra, gem_version("sinatra", gemfile, gemfile_lock, package)] if dependency_present?("sinatra", gemfile, gemfile_lock, package, pyproject)
+          return [:express, package_version("express", package)] if dependency_present?("express", gemfile, gemfile_lock, package, pyproject)
+          return [:django, python_version("django", pyproject)] if dependency_present?("django", gemfile, gemfile_lock, package, pyproject)
+
+          [nil, nil]
+        end
+
+        def detect_test_framework(gemfile:, gemfile_lock:, package:, pyproject:)
+          TEST_FRAMEWORKS.each do |key, package_names|
+            return key if package_names.any? { |name| dependency_present?(name, gemfile, gemfile_lock, package, pyproject) }
+          end
+
+          nil
+        end
+
+        def detect_linters(gemfile:, gemfile_lock:, package:, pyproject:)
+          LINTERS.each_with_object([]) do |(key, package_name), list|
+            list << key if dependency_present?(package_name, gemfile, gemfile_lock, package, pyproject)
+          end
+        end
+
+        def detect_ruby_version(gemfile)
+          version_file = read_file(".ruby-version")&.strip
+          return version_file unless version_file.to_s.empty?
+
+          gemfile&.match(/^\s*ruby\s+["']([^"']+)["']/)&.captures&.first
+        end
+
+        def detect_node_version(package)
+          version_file = read_file(".node-version")&.strip
+          return version_file unless version_file.to_s.empty?
+
+          nvmrc_version = read_file(".nvmrc")&.strip
+          return nvmrc_version unless nvmrc_version.to_s.empty?
+
+          package&.dig("engines", "node")
+        end
+
+        def dependency_present?(name, gemfile, gemfile_lock, package, pyproject)
+          gem_declared?(name, gemfile) ||
+            gem_locked?(name, gemfile_lock) ||
+            package_dependency?(name, package) ||
+            python_dependency?(name, pyproject)
+        end
+
+        def gem_declared?(name, gemfile)
+          return false unless gemfile
+
+          gemfile.match?(/^\s*gem\s+["']#{Regexp.escape(name)}["']/)
+        end
+
+        def gem_locked?(name, gemfile_lock)
+          return false unless gemfile_lock
+
+          gemfile_lock.match?(/^\s{4}#{Regexp.escape(name)}\s+\(/)
+        end
+
+        def gem_version(name, gemfile, gemfile_lock, package)
+          version = gemfile_lock&.match(/^\s{4}#{Regexp.escape(name)}\s+\(([^)]+)\)/)&.captures&.first
+          return version if version
+
+          declared = gem_declared_version(name, gemfile)
+          return declared if declared
+
+          package_version(name, package)
+        end
+
+        def gem_declared_version(name, gemfile)
+          return nil unless gemfile
+
+          line = gemfile.each_line.find { |text| text.match?(/^\s*gem\s+["']#{Regexp.escape(name)}["']/) }
+          return nil unless line
+
+          match = line.match(/^\s*gem\s+["']#{Regexp.escape(name)}["']\s*,\s*["']([^"']+)["']/)
+          return nil unless match
+
+          normalize_version_requirement(match[1])
+        end
+
+        def normalize_version_requirement(value)
+          token = value.to_s.split(",").first.to_s.strip
+          token = token.sub(/\A[~><=\s]*/, "")
+          token.empty? ? nil : token
+        end
+
+        def package_dependency?(name, package)
+          return false unless package.is_a?(Hash)
+
+          package.key?("dependencies") && package["dependencies"].is_a?(Hash) && package["dependencies"].key?(name) ||
+            package.key?("devDependencies") && package["devDependencies"].is_a?(Hash) && package["devDependencies"].key?(name)
+        end
+
+        def package_version(name, package)
+          return nil unless package.is_a?(Hash)
+
+          package.dig("dependencies", name) || package.dig("devDependencies", name)
+        end
+
+        def python_dependency?(name, pyproject)
+          return false unless pyproject
+
+          pyproject.match?(/#{Regexp.escape(name)}\s*(?:[<>=~!]|$)/i)
+        end
+
+        def python_version(name, pyproject)
+          return nil unless pyproject
+
+          pyproject.match(/#{Regexp.escape(name)}\s*([<>=~!].+?)?(?:\n|$)/i)&.captures&.first&.strip
+        end
+
+        def parse_json_file(relative_path)
+          content = read_file(relative_path)
+          return nil unless content
+
+          JSON.parse(content)
+        rescue JSON::ParserError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/spurline/cartographer/analyzers/security_scan.rb

@@ -0,0 +1,223 @@
+# frozen_string_literal: true
+
+require "find"
+require "json"
+
+module Spurline
+  module Cartographer
+    module Analyzers
+      class SecurityScan < Analyzer
+        SECRET_PATTERNS = {
+          openai_key: /\bsk-[A-Za-z0-9]{20,}\b/,
+          aws_access_key_id: /\bAKIA[0-9A-Z]{16}\b/,
+          github_token: /\bghp_[A-Za-z0-9]{36}\b/,
+        }.freeze
+        GENERIC_ASSIGNMENT_PATTERN = /\b(api[_-]?key|token|password|secret)\b\s*[:=]\s*["']([^"']{16,})["']/i.freeze
+
+        CURATED_SUSPICIOUS_DEPENDENCIES = %w[
+          pymafka
+          requests-darwin
+          osxroot
+          colourfool
+        ].freeze
+
+        MAX_SCAN_BYTES = 512_000
+
+        def analyze
+          findings = []
+          findings.concat(scan_sensitive_filenames)
+          findings.concat(scan_secret_patterns)
+          findings.concat(scan_suspicious_dependencies)
+
+          @findings = {
+            security_findings: findings,
+          }
+        end
+
+        def confidence
+          0.9
+        end
+
+        private
+
+        def scan_sensitive_filenames
+          each_candidate_file.each_with_object([]) do |(path, rel_path), findings|
+            basename = File.basename(path)
+
+            if rel_path == ".env" || rel_path.end_with?("/.env")
+              findings << finding(
+                type: :sensitive_file,
+                severity: :high,
+                file: rel_path,
+                detail: "Environment file is committed."
+              )
+            end
+
+            if rel_path == "config/credentials.yml" || rel_path == "credentials.yml"
+              findings << finding(
+                type: :sensitive_file,
+                severity: :high,
+                file: rel_path,
+                detail: "Credentials file is committed."
+              )
+            end
+
+            if basename.match?(/\.(pem|key)\z/i)
+              findings << finding(
+                type: :sensitive_file,
+                severity: :high,
+                file: rel_path,
+                detail: "Private key material appears committed (#{basename})."
+              )
+            end
+          end
+        end
+
+        def scan_secret_patterns
+          each_candidate_file.each_with_object([]) do |(path, rel_path), findings|
+            next if binary_file?(path)
+
+            content = read_limited(path)
+            next if content.nil? || content.empty?
+
+            SECRET_PATTERNS.each do |name, pattern|
+              next unless content.match?(pattern)
+
+              findings << finding(
+                type: :hardcoded_secret,
+                severity: :high,
+                file: rel_path,
+                detail: "Matched #{name} pattern."
+              )
+            end
+
+            generic_secret_assignment_details(content).each do |detail|
+              findings << finding(
+                type: :hardcoded_secret,
+                severity: :high,
+                file: rel_path,
+                detail: detail
+              )
+            end
+          end
+        end
+
+        def scan_suspicious_dependencies
+          findings = []
+
+          package = parse_json_file("package.json")
+          if package
+            deps = [package["dependencies"], package["devDependencies"]].compact
+                      .select { |value| value.is_a?(Hash) }
+                      .flat_map(&:keys)
+                      .uniq
+
+            deps.each do |dependency|
+              next unless CURATED_SUSPICIOUS_DEPENDENCIES.include?(dependency)
+
+              findings << finding(
+                type: :suspicious_dependency,
+                severity: :medium,
+                file: "package.json",
+                detail: "Dependency '#{dependency}' is in the curated suspicious list."
+              )
+            end
+          end
+
+          gemfile = read_file("Gemfile")
+          if gemfile
+            gemfile.scan(/^\s*gem\s+["']([^"']+)["']/).flatten.each do |dependency|
+              next unless CURATED_SUSPICIOUS_DEPENDENCIES.include?(dependency)
+
+              findings << finding(
+                type: :suspicious_dependency,
+                severity: :medium,
+                file: "Gemfile",
+                detail: "Gem '#{dependency}' is in the curated suspicious list."
+              )
+            end
+          end
+
+          findings
+        end
+
+        def each_candidate_file
+          files = []
+
+          Find.find(repo_path) do |path|
+            rel_path = relative_path(path)
+            rel_path = "." if rel_path.empty?
+
+            if File.directory?(path)
+              if rel_path != "." && excluded_relative_path?(rel_path)
+                Find.prune
+              else
+                next
+              end
+            end
+
+            next if excluded_relative_path?(rel_path)
+            next unless File.file?(path)
+
+            files << [path, rel_path]
+          end
+
+          files
+        end
+
+        def parse_json_file(relative_path)
+          content = read_file(relative_path)
+          return nil unless content
+
+          JSON.parse(content)
+        rescue JSON::ParserError
+          nil
+        end
+
+        def read_limited(path)
+          File.open(path, "rb") { |file| file.read(MAX_SCAN_BYTES) }
+              &.force_encoding(Encoding::UTF_8)
+              &.scrub
+        rescue Errno::ENOENT, ArgumentError
+          nil
+        end
+
+        def binary_file?(path)
+          sample = File.open(path, "rb") { |file| file.read(1024) }
+          return false unless sample
+
+          sample.include?("\x00")
+        rescue Errno::ENOENT
+          false
+        end
+
+        def finding(type:, severity:, file:, detail:)
+          {
+            type: type,
+            severity: severity,
+            file: file,
+            detail: detail,
+          }
+        end
+
+        def generic_secret_assignment_details(content)
+          content.scan(GENERIC_ASSIGNMENT_PATTERN).filter_map do |(name, value)|
+            next if benign_secret_value?(value)
+
+            "Matched generic_secret_assignment pattern for #{name.downcase}."
+          end.uniq
+        end
+
+        def benign_secret_value?(value)
+          normalized = value.to_s.strip
+          return true if normalized.empty?
+          return true if normalized.match?(/\A\[REDACTED/i)
+          return true if normalized.match?(/\A(redacted|test|example|dummy|fake|placeholder|changeme|replace_me)/i)
+          return true if normalized.include?("user@example.com")
+
+          false
+        end
+      end
+    end
+  end
+end