@cencori/scan 0.4.4 → 0.4.6

package/dist/cli.mjs

@@ -4,7 +4,7 @@
 import { program } from "commander";
 import chalk from "chalk";
 import ora from "ora";
-import { confirm, password } from "@inquirer/prompts";
+import { confirm, password, select } from "@inquirer/prompts";
 
 // src/scanner/index.ts
 import * as fs from "fs";
@@ -833,17 +833,29 @@ async function generateFixes(issues, fileContents) {
           "Authorization": `Bearer ${apiKey}`
         },
         body: JSON.stringify({
-          model: "meta-llama/llama-4-scout-17b-16e-instruct",
+          model: "gpt-4o-mini",
+          // Use reliable model
           messages: [
             {
               role: "system",
-              content: `You are a security engineer. Generate secure code fixes. For secrets, use environment variables. For XSS, use sanitization. Respond in JSON: {"fixedCode": "the fixed code snippet", "explanation": "what was changed"}`
+              content: `You are a security engineer fixing code vulnerabilities. Generate secure code fixes.
+
+IMPORTANT: Respond ONLY with valid JSON in this exact format:
+{"fixedCode": "the complete fixed code snippet", "explanation": "brief explanation of what was changed"}
+
+Rules:
+- For hardcoded secrets: Replace with environment variables (process.env.VAR_NAME)
+- For XSS vulnerabilities: Add proper escaping/sanitization
+- For SQL injection: Use parameterized queries
+- For exposed routes: Add authentication middleware
+- Keep the same code structure, only fix the security issue`
             },
             {
               role: "user",
               content: `Fix this security issue:
 Type: ${issue.type}
 Name: ${issue.name}
+Severity: ${issue.severity}
 File: ${issue.file}:${issue.line}
 
 Code to fix:
@@ -851,56 +863,87 @@ Code to fix:
 ${codeSnippet}
 \`\`\`
 
-Generate a secure fix.`
+Respond with JSON only.`
             }
           ],
           temperature: 0,
-          max_tokens: 500
+          max_tokens: 1e3
         })
       });
       if (!response.ok) {
-        throw new Error(`API error: ${response.status}`);
+        const errorText = await response.text();
+        console.error(`[AI] API error for ${issue.file}:${issue.line}: ${response.status} - ${errorText}`);
+        results.push({
+          issue,
+          originalCode: codeSnippet,
+          fixedCode: codeSnippet,
+          // Same as original = no fix
+          explanation: `API error: ${response.status}`,
+          applied: false
+        });
+        continue;
       }
       const data = await response.json();
-      const content_response = data.choices[0]?.message?.content || "{}";
-      const parsed = JSON.parse(content_response);
-      results.push({
-        issue,
-        originalCode: codeSnippet,
-        fixedCode: parsed.fixedCode || codeSnippet,
-        explanation: parsed.explanation || "No explanation provided",
-        applied: false
-      });
-    } catch {
+      if (data.error) {
+        console.error(`[AI] API returned error: ${data.error.message}`);
+        results.push({
+          issue,
+          originalCode: codeSnippet,
+          fixedCode: codeSnippet,
+          explanation: `AI error: ${data.error.message}`,
+          applied: false
+        });
+        continue;
+      }
+      const content_response = data.choices[0]?.message?.content || "";
+      let jsonStr = content_response;
+      const jsonMatch = content_response.match(/```(?:json)?\s*([\s\S]*?)```/);
+      if (jsonMatch) {
+        jsonStr = jsonMatch[1].trim();
+      }
+      try {
+        const parsed = JSON.parse(jsonStr);
+        const fixedCode = parsed.fixedCode || parsed.fixed_code || "";
+        if (fixedCode && fixedCode !== codeSnippet) {
+          results.push({
+            issue,
+            originalCode: codeSnippet,
+            fixedCode,
+            explanation: parsed.explanation || "Security fix applied",
+            applied: false
+          });
+        } else {
+          results.push({
+            issue,
+            originalCode: codeSnippet,
+            fixedCode: codeSnippet,
+            explanation: "AI could not generate a fix for this issue",
+            applied: false
+          });
+        }
+      } catch (parseError) {
+        console.error(`[AI] JSON parse error for ${issue.file}:${issue.line}:`, parseError);
+        results.push({
+          issue,
+          originalCode: codeSnippet,
+          fixedCode: codeSnippet,
+          explanation: "Failed to parse AI response",
+          applied: false
+        });
+      }
+    } catch (error) {
+      console.error(`[AI] Request failed for ${issue.file}:${issue.line}:`, error);
       results.push({
         issue,
         originalCode: codeSnippet,
         fixedCode: codeSnippet,
-        explanation: "Unable to generate fix - manual review required",
+        explanation: `Request failed: ${error instanceof Error ? error.message : "Unknown error"}`,
         applied: false
       });
     }
   }
   return results;
 }
-async function applyFixes(fixes, fileContents) {
-  for (const fix of fixes) {
-    if (fix.fixedCode === fix.originalCode) {
-      continue;
-    }
-    const content = fileContents.get(fix.issue.file);
-    if (!content) {
-      continue;
-    }
-    const newContent = content.replace(fix.originalCode, fix.fixedCode);
-    if (newContent !== content) {
-      const filePath = path2.resolve(fix.issue.file);
-      fs2.writeFileSync(filePath, newContent, "utf-8");
-      fix.applied = true;
-    }
-  }
-  return fixes;
-}
 
 // src/telemetry.ts
 var TELEMETRY_URL = "https://api.cencori.com/v1/telemetry/scan";
@@ -1153,7 +1196,7 @@ No commits found in the specified period.
 // src/cli.ts
 import * as fs3 from "fs";
 import * as path3 from "path";
-var VERSION = "0.4.4";
+var VERSION = "0.4.6";
 var scoreStyles = {
   A: { color: chalk.green },
   B: { color: chalk.blue },
@@ -1388,57 +1431,137 @@ async function handleAutoFix(result, targetPath) {
       fileContents
     );
     fixSpinner.succeed(`Generated ${fixes.length} fixes`);
-    const applySpinner = ora({
-      text: "Applying fixes...",
-      color: "cyan"
-    }).start();
-    const appliedFixes = await applyFixes(fixes, fileContents);
-    const appliedCount = appliedFixes.filter((f) => f.applied).length;
-    applySpinner.succeed(`Applied ${appliedCount}/${fixes.length} fixes`);
     console.log();
-    const applied = appliedFixes.filter((f) => f.applied);
-    const notApplied = appliedFixes.filter((f) => !f.applied);
-    if (applied.length > 0) {
-      console.log(`  ${chalk.bold.green("\u2714 Applied fixes:")}`);
-      for (const fix of applied) {
-        console.log(chalk.green(`    \u2714 ${fix.issue.file}:${fix.issue.line}`));
-        console.log(chalk.gray(`      ${fix.explanation}`));
-      }
+    const actualFixes = fixes.filter((f) => f.fixedCode !== f.originalCode);
+    const failedFixes = fixes.filter((f) => f.fixedCode === f.originalCode);
+    if (failedFixes.length > 0) {
+      console.log(chalk.gray(`  Note: ${failedFixes.length} issues could not be auto-fixed (saved for manual review)`));
       console.log();
     }
-    if (notApplied.length > 0) {
-      console.log(`  ${chalk.bold.yellow("\u26A0 Suggested fixes (require manual review):")}`);
+    if (actualFixes.length === 0) {
+      console.log(chalk.yellow("  No fixes could be generated by AI."));
+      console.log(chalk.gray("  This may be due to API issues or complex code patterns."));
+      const fixesFile = ".cencori-fixes.json";
+      const fixesData = {
+        generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        total_fixes: failedFixes.length,
+        note: "AI could not generate automatic fixes for these issues",
+        fixes: failedFixes.map((f) => ({
+          file: f.issue.file,
+          line: f.issue.line,
+          issue_type: f.issue.type,
+          issue_name: f.issue.name,
+          severity: f.issue.severity,
+          original_code: f.originalCode,
+          explanation: f.explanation
+        }))
+      };
+      fs3.writeFileSync(fixesFile, JSON.stringify(fixesData, null, 2));
+      console.log(chalk.cyan(`  Issues saved to ${chalk.bold(fixesFile)} for manual review.`));
+      console.log();
+      return;
+    }
+    const acceptedFixes = [];
+    const skippedFixes = [];
+    let applyAll = false;
+    let skipRest = false;
+    for (let i = 0; i < actualFixes.length; i++) {
+      const fix = actualFixes[i];
+      if (skipRest) {
+        skippedFixes.push(fix);
+        continue;
+      }
+      if (applyAll) {
+        acceptedFixes.push(fix);
+        continue;
+      }
+      console.log(chalk.cyan(`  \u2500\u2500\u2500 Fix ${i + 1}/${fixes.length}: ${fix.issue.file}:${fix.issue.line} \u2500\u2500\u2500`));
+      console.log(chalk.gray(`  Issue: ${fix.issue.name} (${fix.issue.severity})`));
+      console.log();
+      const origLines = fix.originalCode.split("\n");
+      console.log(chalk.red("  - Original:"));
+      origLines.slice(0, 8).forEach((line) => console.log(chalk.red(`    ${line}`)));
+      if (origLines.length > 8) {
+        console.log(chalk.gray(`    ... (${origLines.length - 8} more lines)`));
+      }
       console.log();
-      for (let i = 0; i < Math.min(notApplied.length, 5); i++) {
-        const fix = notApplied[i];
-        console.log(chalk.cyan(`  \u2500\u2500\u2500 ${fix.issue.file}:${fix.issue.line} \u2500\u2500\u2500`));
-        console.log(chalk.gray(`  Issue: ${fix.issue.name}`));
-        console.log();
-        const origLines = fix.originalCode.split("\n").slice(0, 5);
-        console.log(chalk.red("  - Original:"));
-        origLines.forEach((line) => console.log(chalk.red(`    ${line}`)));
-        if (fix.originalCode.split("\n").length > 5) {
-          console.log(chalk.gray("    ... (truncated)"));
+      const fixLines = fix.fixedCode.split("\n");
+      console.log(chalk.green("  + Suggested fix:"));
+      fixLines.slice(0, 8).forEach((line) => console.log(chalk.green(`    ${line}`)));
+      if (fixLines.length > 8) {
+        console.log(chalk.gray(`    ... (${fixLines.length - 8} more lines)`));
+      }
+      console.log();
+      console.log(chalk.gray(`  Explanation: ${fix.explanation}`));
+      console.log();
+      const action = await select({
+        message: "Apply this fix?",
+        choices: [
+          { name: "Yes - apply this fix", value: "y" },
+          { name: "No - skip this fix", value: "n" },
+          { name: "All - apply all remaining fixes", value: "a" },
+          { name: "Skip rest - save remaining to file", value: "s" },
+          { name: "Quit - stop reviewing", value: "q" }
+        ]
+      });
+      if (action === "y") {
+        acceptedFixes.push(fix);
+        console.log(chalk.green("  \u2714 Fix accepted"));
+      } else if (action === "n") {
+        skippedFixes.push(fix);
+        console.log(chalk.yellow("  \u2298 Fix skipped"));
+      } else if (action === "a") {
+        applyAll = true;
+        acceptedFixes.push(fix);
+        for (let j = i + 1; j < actualFixes.length; j++) {
+          acceptedFixes.push(actualFixes[j]);
         }
-        console.log();
-        const fixLines = fix.fixedCode.split("\n").slice(0, 5);
-        console.log(chalk.green("  + Suggested fix:"));
-        fixLines.forEach((line) => console.log(chalk.green(`    ${line}`)));
-        if (fix.fixedCode.split("\n").length > 5) {
-          console.log(chalk.gray("    ... (truncated)"));
+        console.log(chalk.green(`  \u2714 Applying all ${actualFixes.length - i} remaining fixes`));
+        break;
+      } else if (action === "s") {
+        skipRest = true;
+        skippedFixes.push(fix);
+        for (let j = i + 1; j < actualFixes.length; j++) {
+          skippedFixes.push(actualFixes[j]);
         }
-        console.log(chalk.gray(`  Explanation: ${fix.explanation}`));
-        console.log();
+        console.log(chalk.yellow(`  \u2298 Skipping ${actualFixes.length - i} remaining fixes`));
+        break;
+      } else if (action === "q") {
+        skippedFixes.push(fix);
+        for (let j = i + 1; j < actualFixes.length; j++) {
+          skippedFixes.push(actualFixes[j]);
+        }
+        console.log(chalk.gray("  Stopped reviewing"));
+        break;
       }
-      if (notApplied.length > 5) {
-        console.log(chalk.gray(`  ... and ${notApplied.length - 5} more fixes`));
-        console.log();
+      console.log();
+    }
+    if (acceptedFixes.length > 0) {
+      console.log();
+      const applySpinner = ora({
+        text: `Applying ${acceptedFixes.length} fixes...`,
+        color: "cyan"
+      }).start();
+      let appliedCount = 0;
+      for (const fix of acceptedFixes) {
+        const content = fileContents.get(fix.issue.file);
+        if (!content) continue;
+        const newContent = content.replace(fix.originalCode, fix.fixedCode);
+        if (newContent !== content) {
+          const filePath = path3.resolve(targetPath, fix.issue.file);
+          fs3.writeFileSync(filePath, newContent, "utf-8");
+          fileContents.set(fix.issue.file, newContent);
+          appliedCount++;
+        }
       }
+      applySpinner.succeed(`Applied ${appliedCount}/${acceptedFixes.length} fixes to your codebase`);
+    }
+    if (skippedFixes.length > 0) {
       const fixesFile = ".cencori-fixes.json";
       const fixesData = {
         generated_at: (/* @__PURE__ */ new Date()).toISOString(),
-        total_fixes: notApplied.length,
-        fixes: notApplied.map((f) => ({
+        total_fixes: skippedFixes.length,
+        fixes: skippedFixes.map((f) => ({
           file: f.issue.file,
           line: f.issue.line,
           issue_type: f.issue.type,
@@ -1450,16 +1573,22 @@ async function handleAutoFix(result, targetPath) {
         }))
       };
       fs3.writeFileSync(fixesFile, JSON.stringify(fixesData, null, 2));
-      console.log(chalk.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-      console.log();
-      console.log(`  ${chalk.bold("Next steps:")}`);
-      console.log(chalk.cyan(`    1. Review fixes in ${chalk.bold(fixesFile)}`));
-      console.log(chalk.cyan(`    2. Apply fixes manually to your codebase`));
-      console.log(chalk.cyan(`    3. Run ${chalk.bold("npx @cencori/scan")} again to verify`));
       console.log();
+      console.log(chalk.yellow(`  ${skippedFixes.length} skipped fixes saved to ${chalk.bold(fixesFile)}`));
+    }
+    console.log();
+    console.log(chalk.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log();
+    console.log(`  ${chalk.bold("Summary:")}`);
+    if (acceptedFixes.length > 0) {
+      console.log(chalk.green(`    \u2714 ${acceptedFixes.length} fixes applied`));
     }
-    if (applied.length === 0 && notApplied.length === 0) {
-      console.log(chalk.green("  No fixes needed!"));
+    if (skippedFixes.length > 0) {
+      console.log(chalk.yellow(`    \u2298 ${skippedFixes.length} fixes skipped (saved to .cencori-fixes.json)`));
+    }
+    if (acceptedFixes.length > 0) {
+      console.log();
+      console.log(chalk.cyan(`  Run ${chalk.bold("npx @cencori/scan")} again to verify your fixes!`));
     }
     console.log();
   } catch (error) {