@alex-dbs/coderuler 0.0.0-stage → 1.3.0

package/dist/adapter/github/comments.js

@@ -0,0 +1,235 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstat, readFile, realpath } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { isolatedGitEnvironment } from '../git/environment.js';
+import { createGithubApi, mapping } from './api.js';
+import { originRepository, pullNumber, repositoryName } from './pull-request.js';
+async function git(root, args, env) {
+    return await new Promise((resolve, reject) => {
+        const child = spawn('git', [...args], { cwd: root, env, stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => { stdout += chunk; });
+        child.stderr.resume();
+        child.on('error', () => reject(new Error('Cannot run Git to resolve the GitHub pull request.')));
+        child.on('close', code => {
+            if (code === 0)
+                resolve(stdout.trim());
+            else
+                reject(new Error(`Git ${args[0]} failed; check the origin remote and current branch (detached HEAD is unsupported).`));
+        });
+    });
+}
+async function actionsPullRequest(env) {
+    const ref = /^refs\/pull\/(\d+)\/(?:merge|head)$/.exec(env.GITHUB_REF ?? '');
+    if (ref)
+        return { repository: repositoryName(env.GITHUB_REPOSITORY), number: pullNumber(Number(ref[1])) };
+    if (!env.GITHUB_EVENT_PATH)
+        return undefined;
+    let event;
+    try {
+        event = JSON.parse(await readFile(env.GITHUB_EVENT_PATH, 'utf8'));
+    }
+    catch {
+        throw new Error('Cannot read the GitHub pull request event at GITHUB_EVENT_PATH; check that it is readable JSON.');
+    }
+    const pull = mapping(mapping(event)?.pull_request);
+    const base = mapping(mapping(pull?.base)?.repo);
+    if (!pull || !base)
+        throw new Error('GitHub event does not identify a pull request and its base repository.');
+    return { repository: repositoryName(base.full_name), number: pullNumber(pull.number) };
+}
+function rightRuns(patch) {
+    const runs = [];
+    let hunk;
+    const finish = () => {
+        if (hunk?.valid && hunk.oldRead === hunk.oldCount && hunk.rightRead === hunk.rightCount)
+            runs.push(...hunk.runs);
+    };
+    const lines = patch.split('\n');
+    for (let index = 0; index < lines.length; index++) {
+        const text = lines[index];
+        const header = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?:.*)$/.exec(text);
+        if (header) {
+            finish();
+            const old = Number(header[1]);
+            const right = Number(header[3]);
+            const oldCount = Number(header[2] ?? 1);
+            const rightCount = Number(header[4] ?? 1);
+            hunk = { old, right, oldCount, rightCount, oldRead: 0, rightRead: 0, runs: [],
+                valid: [old, right, oldCount, rightCount, old + oldCount, right + rightCount].every(Number.isSafeInteger)
+                    && (oldCount === 0 || old > 0) && (rightCount === 0 || right > 0) };
+            continue;
+        }
+        if (!hunk || text === '\' || (index === lines.length - 1 && text === ''))
+            continue;
+        const prefix = text[0];
+        if (prefix !== ' ' && prefix !== '+' && prefix !== '-') {
+            hunk.valid = false;
+            continue;
+        }
+        if (prefix !== '+')
+            hunk.oldRead++;
+        if (prefix !== '-') {
+            const line = hunk.right + hunk.rightRead++;
+            const added = prefix === '+';
+            const previous = hunk.runs.at(-1);
+            if (previous && previous.added === added && previous.end + 1 === line)
+                previous.end = line;
+            else
+                hunk.runs.push({ start: line, end: line, added });
+        }
+        if (hunk.oldRead > hunk.oldCount || hunk.rightRead > hunk.rightCount)
+            hunk.valid = false;
+    }
+    finish();
+    return runs;
+}
+async function repositoryPaths(root, env) {
+    try {
+        const invocation = await realpath(root);
+        const repository = await realpath(await git(invocation, ['rev-parse', '--show-toplevel'], env));
+        const prefix = relative(repository, invocation);
+        if (prefix === '..' || prefix.startsWith(`..${sep}`) || isAbsolute(prefix))
+            return undefined;
+        return { root: repository, invocation };
+    }
+    catch {
+        return undefined;
+    }
+}
+async function matchingFile(repository, filepath, files, env) {
+    if (!filepath || isAbsolute(filepath))
+        return undefined;
+    const absolute = resolve(repository.invocation, filepath);
+    const local = relative(repository.root, absolute);
+    if (!local || local === '..' || local.startsWith(`..${sep}`) || isAbsolute(local))
+        return undefined;
+    const path = local.split(sep).join('/');
+    const file = files.get(path);
+    if (!file || file.status === 'removed' || !file.patch)
+        return undefined;
+    try {
+        // Symlinks and paths escaping through a symlink cannot identify this Git blob.
+        if (!(await lstat(absolute)).isFile() || await realpath(absolute) !== absolute)
+            return undefined;
+        await git(repository.root, ['--literal-pathspecs', 'ls-files', '--error-unmatch', '--', path], env);
+        const bytes = await readFile(absolute);
+        const sha = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');
+        return sha === file.sha ? file : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createGithubCommenter(env) {
+    return async (root, comments, pullRequest) => {
+        if (comments.length === 0)
+            return;
+        const token = env.GITHUB_TOKEN?.trim();
+        if (!token)
+            throw new Error('GITHUB_TOKEN is required to comment on a GitHub pull request.');
+        const { request, json } = createGithubApi(token);
+        const gitEnv = pullRequest === undefined ? undefined : isolatedGitEnvironment(env);
+        let pull = pullRequest ?? await actionsPullRequest(env);
+        if (!pull) {
+            const repository = originRepository(await git(root, ['remote', 'get-url', 'origin']));
+            const branch = await git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+            if (!branch)
+                throw new Error('Cannot resolve the current branch; detached HEAD is unsupported.');
+            const owner = repository.split('/')[0];
+            const pulls = await json(`/repos/${repository}/pulls?state=open&head=${encodeURIComponent(`${owner}:${branch}`)}&per_page=2`);
+            if (!Array.isArray(pulls))
+                throw new Error('GitHub API returned an invalid pull request discovery response.');
+            if (pulls.length === 0)
+                throw new Error('No open pull request found for the current branch on GitHub.');
+            if (pulls.length !== 1)
+                throw new Error('Multiple open pull requests match the current branch; refusing an ambiguous comment target.');
+            pull = { repository, number: pullNumber(mapping(pulls[0])?.number) };
+        }
+        const path = `/repos/${pull.repository}/pulls/${pull.number}`;
+        const readHead = async () => {
+            const sha = mapping(mapping(await json(path))?.head)?.sha;
+            if (typeof sha !== 'string' || !/^[a-f0-9]{40}$/.test(sha))
+                throw new Error('GitHub API returned an invalid pull request head response.');
+            return sha;
+        };
+        const head = await readHead();
+        if (pull.head !== undefined && head !== pull.head) {
+            throw new Error('GitHub pull request head changed since analysis; refusing stale findings.');
+        }
+        const files = new Map();
+        for (let page = 1; page <= 30; page++) {
+            const entries = await json(`${path}/files?per_page=100&page=${page}`);
+            if (!Array.isArray(entries) || entries.length > 100)
+                throw new Error('GitHub API returned an invalid pull request files response.');
+            for (const entry of entries) {
+                const file = mapping(entry);
+                if (!file || typeof file.filename !== 'string' || typeof file.status !== 'string' || typeof file.sha !== 'string'
+                    || !/^[a-f0-9]{40}$/.test(file.sha))
+                    throw new Error('GitHub API returned an invalid pull request files response.');
+                files.set(file.filename, { filename: file.filename, status: file.status, sha: file.sha,
+                    ...(typeof file.patch === 'string' ? { patch: file.patch } : {}) });
+            }
+            if (entries.length < 100)
+                break;
+        }
+        const repository = comments.some(comment => comment.locations.length > 0) ? await repositoryPaths(root, gitEnv) : undefined;
+        const matched = new Map();
+        const patches = new Map();
+        const inline = [];
+        const fallback = [];
+        for (const finding of comments) {
+            const anchors = new Set();
+            for (const location of finding.locations) {
+                if (!repository || !Number.isSafeInteger(location.lines.start) || !Number.isSafeInteger(location.lines.end)
+                    || location.lines.start <= 0 || location.lines.end < location.lines.start)
+                    continue;
+                let match = matched.get(location.filepath);
+                if (!match) {
+                    match = matchingFile(repository, location.filepath, files, gitEnv);
+                    matched.set(location.filepath, match);
+                }
+                const file = await match;
+                if (!file?.patch)
+                    continue;
+                let runs = patches.get(file.filename);
+                if (!runs) {
+                    runs = rightRuns(file.patch);
+                    patches.set(file.filename, runs);
+                }
+                const run = runs.find(run => run.added && run.start <= location.lines.end && run.end >= location.lines.start)
+                    ?? runs.find(run => !run.added && run.start <= location.lines.end && run.end >= location.lines.start);
+                if (!run)
+                    continue;
+                const start = Math.max(run.start, location.lines.start);
+                const end = Math.min(run.end, location.lines.end);
+                const key = JSON.stringify([file.filename, start, end]);
+                if (anchors.has(key))
+                    continue;
+                anchors.add(key);
+                inline.push({ path: file.filename, body: finding.body, line: end, side: 'RIGHT',
+                    ...(start < end ? { start_line: start, start_side: 'RIGHT' } : {}) });
+            }
+            if (anchors.size === 0)
+                fallback.push(finding.body);
+        }
+        if (await readHead() !== head)
+            throw new Error('GitHub pull request head changed during comment planning; refusing stale findings.');
+        if (inline.length > 0) {
+            for (let index = 0; index < inline.length; index += 100) {
+                const response = await request(`${path}/reviews`, 'POST', {
+                    commit_id: head, event: 'COMMENT', body: 'CodeRuler violations', comments: inline.slice(index, index + 100),
+                });
+                await response.body?.cancel().catch(() => undefined);
+            }
+        }
+        if (fallback.length > 0) {
+            const response = await request(`/repos/${pull.repository}/issues/${pull.number}/comments`, 'POST', {
+                body: `## CodeRuler violations\n\n${fallback.join('\n\n')}\n`,
+            });
+            await response.body?.cancel().catch(() => undefined);
+        }
+    };
+}

package/dist/adapter/github/pull-request.d.ts

@@ -0,0 +1,16 @@
+export interface PullRequest {
+    readonly repository: string;
+    readonly number: number;
+    readonly head?: string;
+}
+export interface PullRequestCheckout {
+    readonly root: string;
+    readonly rulesRoot: string;
+    readonly changedFiles: ReadonlySet<string>;
+    readonly pullRequest: PullRequest;
+    cleanup(): Promise<void>;
+}
+export declare function repositoryName(value: unknown): string;
+export declare function pullNumber(value: unknown): number;
+export declare function originRepository(origin: string): string;
+export declare function createPullRequestCheckout(cwd: string, env: Readonly<Record<string, string | undefined>>): (selector: string, baseBranch?: string) => Promise<PullRequestCheckout>;

package/dist/adapter/github/pull-request.js

@@ -0,0 +1,139 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, realpath, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { changedFiles } from '../git/changes.js';
+import { isolatedGitEnvironment } from '../git/environment.js';
+import { createGithubApi, mapping } from './api.js';
+export function repositoryName(value) {
+    if (typeof value !== 'string' || !/^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/.test(value)
+        || value.split('/').some(part => part === '.' || part === '..')) {
+        throw new Error('Cannot determine the GitHub repository: expected owner/repository.');
+    }
+    return value;
+}
+export function pullNumber(value) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
+        throw new Error('Cannot determine a valid GitHub pull request number.');
+    }
+    return value;
+}
+export function originRepository(origin) {
+    let path;
+    const scp = /^git@github\.com:(.+)$/i.exec(origin);
+    if (scp) {
+        path = scp[1];
+    }
+    else {
+        let url;
+        try {
+            url = new URL(origin);
+        }
+        catch {
+            throw new Error('Git origin must be an HTTPS or SSH repository on github.com.');
+        }
+        if (url.hostname.toLowerCase() !== 'github.com' || !['https:', 'ssh:'].includes(url.protocol)
+            || (url.port !== '' && !(url.protocol === 'ssh:' && url.port === '22')) || url.search || url.hash) {
+            throw new Error('Git origin must be an HTTPS or SSH repository on github.com.');
+        }
+        path = url.pathname.slice(1);
+    }
+    return repositoryName(path.replace(/\/$/, '').replace(/\.git$/, ''));
+}
+function selectorIdentity(selector) {
+    const invalid = '--pr must be a positive pull request number or a GitHub pull request URL.';
+    if (/^[0-9]+$/.test(selector)) {
+        try {
+            return { number: pullNumber(Number(selector)) };
+        }
+        catch {
+            throw new Error(invalid);
+        }
+    }
+    const match = /^https:\/\/github\.com(?::443)?\/([a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+)\/pull\/([0-9]+)\/?(?:[?#][\s\S]*)?$/i.exec(selector);
+    if (!match)
+        throw new Error(invalid);
+    try {
+        return { repository: repositoryName(match[1]), number: pullNumber(Number(match[2])) };
+    }
+    catch {
+        throw new Error(invalid);
+    }
+}
+export function createPullRequestCheckout(cwd, env) {
+    const isolatedEnv = isolatedGitEnvironment(env);
+    const api = createGithubApi(env.GITHUB_TOKEN?.trim() || undefined);
+    const runGit = (root, args, allowedExitCodes = [0]) => {
+        const { promise, resolve, reject } = Promise.withResolvers();
+        const child = spawn('git', [...args], {
+            cwd: root,
+            env: isolatedEnv,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => { stdout += chunk; });
+        child.stderr.on('data', (chunk) => { stderr += chunk; });
+        child.on('error', error => reject(new Error(`Cannot run Git: ${error.message}`, {
+            cause: error,
+        })));
+        child.on('close', (code, signal) => {
+            if (code !== null && allowedExitCodes.includes(code))
+                resolve({ stdout, code });
+            else
+                reject(new Error(`Git ${args[0]} failed: ${stderr.trim() || signal || `exit ${code}`}`));
+        });
+        return promise;
+    };
+    const assertNoWorktreeOverride = async (root) => {
+        const result = await runGit(root, ['config', '--null', '--get-all', 'core.worktree'], [0, 1]);
+        if (result.code === 0) {
+            throw new Error('PR checkout requires Git core.worktree to be unset; remove the inherited repository-location override.');
+        }
+    };
+    return async (selector, baseBranch) => {
+        const identity = selectorIdentity(selector);
+        await assertNoWorktreeOverride(cwd);
+        const transport = identity.repository === undefined
+            ? (await runGit(cwd, ['remote', 'get-url', 'origin'])).stdout.trim()
+            : `https://github.com/${identity.repository}.git`;
+        const pullRequest = {
+            repository: identity.repository ?? originRepository(transport),
+            number: identity.number,
+        };
+        const response = await api.json(`/repos/${pullRequest.repository}/pulls/${pullRequest.number}`);
+        const defaultBranch = mapping(mapping(response)?.base)?.ref;
+        if (baseBranch === undefined && (typeof defaultBranch !== 'string' || defaultBranch.trim() === '')) {
+            throw new Error('GitHub API returned an invalid pull request response: expected a base branch.');
+        }
+        const branch = baseBranch ?? defaultBranch;
+        const workspace = await mkdtemp(join(await realpath(tmpdir()), 'coderuler-pr-'));
+        const root = join(workspace, 'head');
+        const rulesRoot = join(workspace, 'base');
+        const cleanup = () => rm(workspace, { recursive: true, force: true });
+        try {
+            await runGit(cwd, ['init', root]);
+            await assertNoWorktreeOverride(root);
+            await runGit(root, ['remote', 'add', 'origin', transport]);
+            await runGit(root, ['check-ref-format', `refs/heads/${branch}`]);
+            await runGit(root, [
+                'fetch', '--no-tags', 'origin',
+                `+refs/heads/${branch}:refs/coderuler/base`,
+                `+refs/pull/${pullRequest.number}/head:refs/coderuler/head`,
+            ]);
+            await runGit(root, ['checkout', '--detach', 'refs/coderuler/head']);
+            const head = (await runGit(root, ['rev-parse', 'HEAD'])).stdout.trim();
+            await runGit(root, ['worktree', 'add', '--detach', rulesRoot, 'refs/coderuler/base']);
+            const mergeBase = (await runGit(root, ['merge-base', 'refs/coderuler/base', 'refs/coderuler/head'])).stdout.trim();
+            const files = await changedFiles(root, mergeBase, isolatedEnv);
+            await assertNoWorktreeOverride(rulesRoot);
+            return { root, rulesRoot, changedFiles: files, pullRequest: { ...pullRequest, head }, cleanup };
+        }
+        catch (error) {
+            await cleanup();
+            throw error;
+        }
+    };
+}

package/dist/adapter/scope/astgrep-languages.d.ts

@@ -0,0 +1,5 @@
+import { parse, type DynamicLangRegistrations } from '@ast-grep/napi';
+type NativeLanguage = Parameters<typeof parse>[0];
+export declare function createAstGrepLanguageRegistrations(): DynamicLangRegistrations;
+export declare function resolveAstGrepLanguage(language: string): NativeLanguage;
+export {};

package/dist/adapter/scope/astgrep-languages.js

@@ -0,0 +1,119 @@
+import { parse, registerDynamicLanguage } from '@ast-grep/napi';
+import { createRequire } from 'node:module';
+const BUILTIN_LANGUAGES = {
+    css: true,
+    html: true,
+    javascript: true,
+    tsx: true,
+    typescript: true,
+};
+const DYNAMIC_LANGUAGES = {
+    angular: true,
+    bash: true,
+    bicep: true,
+    c: true,
+    cpp: true,
+    csharp: true,
+    dart: true,
+    elixir: true,
+    'glimmer-javascript': true,
+    'glimmer-typescript': true,
+    go: true,
+    haskell: true,
+    java: true,
+    json: true,
+    kotlin: true,
+    lua: true,
+    markdown: true,
+    php: true,
+    python: true,
+    ruby: true,
+    rust: true,
+    scala: true,
+    sql: true,
+    swift: true,
+    toml: true,
+    yaml: true,
+};
+const LANGUAGE_ALIASES = {
+    cc: 'cpp',
+    'c++': 'cpp',
+    cxx: 'cpp',
+    cs: 'csharp',
+    ex: 'elixir',
+    golang: 'go',
+    hs: 'haskell',
+    kt: 'kotlin',
+    md: 'markdown',
+    py: 'python',
+    rb: 'ruby',
+    rs: 'rust',
+    yml: 'yaml',
+    js: 'javascript',
+    jsx: 'javascript',
+    ts: 'typescript',
+};
+const loadCommonJs = createRequire(import.meta.url);
+let bundledRegistrationAttempted = false;
+let bundledGrammarsActive = false;
+let bundledRegistrationError = null;
+function isParseable(language) {
+    try {
+        parse(language, '');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function canonicalLanguage(language) {
+    const folded = language.toLowerCase();
+    const alias = Object.hasOwn(LANGUAGE_ALIASES, folded) ? LANGUAGE_ALIASES[folded] : undefined;
+    if (alias !== undefined)
+        return alias;
+    const known = BUILTIN_LANGUAGES[folded] === true || DYNAMIC_LANGUAGES[folded] === true;
+    return known ? folded : language;
+}
+function registerBundledGrammars() {
+    if (bundledRegistrationAttempted)
+        return;
+    bundledRegistrationAttempted = true;
+    try {
+        registerDynamicLanguage(createAstGrepLanguageRegistrations());
+    }
+    catch (cause) {
+        const message = cause instanceof Error ? cause.message : String(cause);
+        const error = new Error(`ast-grep could not register its bundled grammars: ${message}`, { cause });
+        bundledRegistrationError = error;
+        throw error;
+    }
+}
+export function createAstGrepLanguageRegistrations() {
+    const registrations = {};
+    for (const language of Object.keys(DYNAMIC_LANGUAGES)) {
+        registrations[language] = loadCommonJs(`@ast-grep/lang-${language}`);
+    }
+    return registrations;
+}
+export function resolveAstGrepLanguage(language) {
+    const canonical = canonicalLanguage(language);
+    if (BUILTIN_LANGUAGES[canonical] === true)
+        return canonical;
+    if (DYNAMIC_LANGUAGES[canonical] !== true)
+        return canonical;
+    if (bundledGrammarsActive)
+        return canonical;
+    if (isParseable(canonical))
+        return canonical;
+    registerBundledGrammars();
+    if (isParseable(canonical)) {
+        bundledGrammarsActive = true;
+        return canonical;
+    }
+    if (bundledRegistrationError !== null)
+        throw bundledRegistrationError;
+    throw new Error(`ast-grep language '${canonical}' is not registered: registerDynamicLanguage had already been called ` +
+        `earlier in this process (by the host or another library), and ast-grep honours only the first such ` +
+        `call, so the bundled grammars could not be added. Call registerDynamicLanguage exactly once yourself, ` +
+        `merging createAstGrepLanguageRegistrations() with your own grammars, and include '${canonical}'.`);
+}

package/dist/adapter/scope/astgrep.d.ts

@@ -0,0 +1,14 @@
+import { type NapiConfig } from '@ast-grep/napi';
+import type { ScopeSelector } from '../../app/rule.js';
+export interface AstGrepScopeOptions {
+    readonly language: string;
+    readonly rule: NapiConfig['rule'];
+    readonly constraints?: NapiConfig['constraints'];
+    readonly utils?: NapiConfig['utils'];
+    readonly tsx?: {
+        readonly rule: NapiConfig['rule'];
+        readonly constraints?: NapiConfig['constraints'];
+        readonly utils?: NapiConfig['utils'];
+    };
+}
+export declare function astGrep(options: AstGrepScopeOptions): ScopeSelector;