@cencori/scan 0.4.5 → 0.4.7

package/dist/cli.mjs

@@ -833,17 +833,29 @@ async function generateFixes(issues, fileContents) {
           "Authorization": `Bearer ${apiKey}`
         },
         body: JSON.stringify({
-          model: "meta-llama/llama-4-scout-17b-16e-instruct",
+          model: "gemini-2.5-flash",
+          // Use Gemini (free tier available)
           messages: [
             {
               role: "system",
-              content: `You are a security engineer. Generate secure code fixes. For secrets, use environment variables. For XSS, use sanitization. Respond in JSON: {"fixedCode": "the fixed code snippet", "explanation": "what was changed"}`
+              content: `You are a security engineer fixing code vulnerabilities. Generate secure code fixes.
+
+IMPORTANT: Respond ONLY with valid JSON in this exact format:
+{"fixedCode": "the complete fixed code snippet", "explanation": "brief explanation of what was changed"}
+
+Rules:
+- For hardcoded secrets: Replace with environment variables (process.env.VAR_NAME)
+- For XSS vulnerabilities: Add proper escaping/sanitization
+- For SQL injection: Use parameterized queries
+- For exposed routes: Add authentication middleware
+- Keep the same code structure, only fix the security issue`
             },
             {
               role: "user",
               content: `Fix this security issue:
 Type: ${issue.type}
 Name: ${issue.name}
+Severity: ${issue.severity}
 File: ${issue.file}:${issue.line}
 
 Code to fix:
@@ -851,32 +863,81 @@ Code to fix:
 ${codeSnippet}
 \`\`\`
 
-Generate a secure fix.`
+Respond with JSON only.`
             }
           ],
           temperature: 0,
-          max_tokens: 500
+          max_tokens: 1e3
         })
       });
       if (!response.ok) {
-        throw new Error(`API error: ${response.status}`);
+        const errorText = await response.text();
+        console.error(`[AI] API error for ${issue.file}:${issue.line}: ${response.status} - ${errorText}`);
+        results.push({
+          issue,
+          originalCode: codeSnippet,
+          fixedCode: codeSnippet,
+          // Same as original = no fix
+          explanation: `API error: ${response.status}`,
+          applied: false
+        });
+        continue;
       }
       const data = await response.json();
-      const content_response = data.choices[0]?.message?.content || "{}";
-      const parsed = JSON.parse(content_response);
-      results.push({
-        issue,
-        originalCode: codeSnippet,
-        fixedCode: parsed.fixedCode || codeSnippet,
-        explanation: parsed.explanation || "No explanation provided",
-        applied: false
-      });
-    } catch {
+      if (data.error) {
+        console.error(`[AI] API returned error: ${data.error.message}`);
+        results.push({
+          issue,
+          originalCode: codeSnippet,
+          fixedCode: codeSnippet,
+          explanation: `AI error: ${data.error.message}`,
+          applied: false
+        });
+        continue;
+      }
+      const content_response = data.choices[0]?.message?.content || "";
+      let jsonStr = content_response;
+      const jsonMatch = content_response.match(/```(?:json)?\s*([\s\S]*?)```/);
+      if (jsonMatch) {
+        jsonStr = jsonMatch[1].trim();
+      }
+      try {
+        const parsed = JSON.parse(jsonStr);
+        const fixedCode = parsed.fixedCode || parsed.fixed_code || "";
+        if (fixedCode && fixedCode !== codeSnippet) {
+          results.push({
+            issue,
+            originalCode: codeSnippet,
+            fixedCode,
+            explanation: parsed.explanation || "Security fix applied",
+            applied: false
+          });
+        } else {
+          results.push({
+            issue,
+            originalCode: codeSnippet,
+            fixedCode: codeSnippet,
+            explanation: "AI could not generate a fix for this issue",
+            applied: false
+          });
+        }
+      } catch (parseError) {
+        console.error(`[AI] JSON parse error for ${issue.file}:${issue.line}:`, parseError);
+        results.push({
+          issue,
+          originalCode: codeSnippet,
+          fixedCode: codeSnippet,
+          explanation: "Failed to parse AI response",
+          applied: false
+        });
+      }
+    } catch (error) {
+      console.error(`[AI] Request failed for ${issue.file}:${issue.line}:`, error);
       results.push({
         issue,
         originalCode: codeSnippet,
         fixedCode: codeSnippet,
-        explanation: "Unable to generate fix - manual review required",
+        explanation: `Request failed: ${error instanceof Error ? error.message : "Unknown error"}`,
         applied: false
       });
     }
@@ -1135,7 +1196,7 @@ No commits found in the specified period.
 // src/cli.ts
 import * as fs3 from "fs";
 import * as path3 from "path";
-var VERSION = "0.4.5";
+var VERSION = "0.4.7";
 var scoreStyles = {
   A: { color: chalk.green },
   B: { color: chalk.blue },
@@ -1371,12 +1432,41 @@ async function handleAutoFix(result, targetPath) {
     );
     fixSpinner.succeed(`Generated ${fixes.length} fixes`);
     console.log();
+    const actualFixes = fixes.filter((f) => f.fixedCode !== f.originalCode);
+    const failedFixes = fixes.filter((f) => f.fixedCode === f.originalCode);
+    if (failedFixes.length > 0) {
+      console.log(chalk.gray(`  Note: ${failedFixes.length} issues could not be auto-fixed (saved for manual review)`));
+      console.log();
+    }
+    if (actualFixes.length === 0) {
+      console.log(chalk.yellow("  No fixes could be generated by AI."));
+      console.log(chalk.gray("  This may be due to API issues or complex code patterns."));
+      const fixesFile = ".cencori-fixes.json";
+      const fixesData = {
+        generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        total_fixes: failedFixes.length,
+        note: "AI could not generate automatic fixes for these issues",
+        fixes: failedFixes.map((f) => ({
+          file: f.issue.file,
+          line: f.issue.line,
+          issue_type: f.issue.type,
+          issue_name: f.issue.name,
+          severity: f.issue.severity,
+          original_code: f.originalCode,
+          explanation: f.explanation
+        }))
+      };
+      fs3.writeFileSync(fixesFile, JSON.stringify(fixesData, null, 2));
+      console.log(chalk.cyan(`  Issues saved to ${chalk.bold(fixesFile)} for manual review.`));
+      console.log();
+      return;
+    }
     const acceptedFixes = [];
     const skippedFixes = [];
     let applyAll = false;
     let skipRest = false;
-    for (let i = 0; i < fixes.length; i++) {
-      const fix = fixes[i];
+    for (let i = 0; i < actualFixes.length; i++) {
+      const fix = actualFixes[i];
       if (skipRest) {
         skippedFixes.push(fix);
         continue;
@@ -1423,23 +1513,23 @@ async function handleAutoFix(result, targetPath) {
       } else if (action === "a") {
         applyAll = true;
         acceptedFixes.push(fix);
-        for (let j = i + 1; j < fixes.length; j++) {
-          acceptedFixes.push(fixes[j]);
+        for (let j = i + 1; j < actualFixes.length; j++) {
+          acceptedFixes.push(actualFixes[j]);
         }
-        console.log(chalk.green(`  \u2714 Applying all ${fixes.length - i} remaining fixes`));
+        console.log(chalk.green(`  \u2714 Applying all ${actualFixes.length - i} remaining fixes`));
         break;
       } else if (action === "s") {
         skipRest = true;
         skippedFixes.push(fix);
-        for (let j = i + 1; j < fixes.length; j++) {
-          skippedFixes.push(fixes[j]);
+        for (let j = i + 1; j < actualFixes.length; j++) {
+          skippedFixes.push(actualFixes[j]);
         }
-        console.log(chalk.yellow(`  \u2298 Skipping ${fixes.length - i} remaining fixes`));
+        console.log(chalk.yellow(`  \u2298 Skipping ${actualFixes.length - i} remaining fixes`));
         break;
       } else if (action === "q") {
         skippedFixes.push(fix);
-        for (let j = i + 1; j < fixes.length; j++) {
-          skippedFixes.push(fixes[j]);
+        for (let j = i + 1; j < actualFixes.length; j++) {
+          skippedFixes.push(actualFixes[j]);
         }
         console.log(chalk.gray("  Stopped reviewing"));
         break;