@cleartrip/frontguard 0.2.1 → 0.2.2

package/dist/cli.js

@@ -2425,6 +2425,8 @@ export default defineConfig({
   //       { minLines: 500, severity: 'info', message: 'Consider splitting (\${lines} lines)' },
   //     ],
   //   },
+  //   // AI strict: only // @frontguard-ai:start \u2026 :end (or // written by AI: start \u2026 :end) in PR files
+  //   // aiAssistedReview: { strictScanMode: 'decorator' },
   //   cycles: { enabled: true },
   //   deadCode: { enabled: true, gate: 'info' },
   //   // LLM: cloud keys in CI, or local Ollama (no API key) on dev/self-hosted runners:
@@ -2789,6 +2791,7 @@ var defaultConfig = {
     aiAssistedReview: {
       enabled: true,
       gate: "warn",
+      strictScanMode: "both",
       escalate: {
         secretFindingsToBlock: true,
         tsAnyDeltaToBlock: true
@@ -5010,6 +5013,115 @@ async function runCustomRules(cwd, config, restrictToFiles) {
     durationMs: Math.round(performance.now() - t0)
   };
 }
+
+// src/lib/ai-decorators.ts
+var FILE_SCAN_HEAD_LINES = 40;
+function commentInner(line) {
+  const t3 = line.trim();
+  const mLine = /^\/\/\s*(.*)$/.exec(t3);
+  if (mLine) return mLine[1]?.trim() ?? "";
+  const mBlock = /^\/\*\s*(.*?)\s*\*\/\s*$/.exec(t3);
+  if (mBlock) return mBlock[1]?.trim() ?? "";
+  return null;
+}
+function lineMarkerKind(line) {
+  const inner = commentInner(line);
+  if (!inner) return null;
+  if (/@(?:frontguard-ai|ai-written)\s*:\s*file\b/i.test(inner) || /^written\s+by\s+ai\s*:?\s*file\b/i.test(inner))
+    return "file";
+  if (/@(?:frontguard-ai|ai-written)\s*:\s*start\b/i.test(inner) || /^written\s+by\s+ai\s*:?\s*start\b/i.test(inner))
+    return "start";
+  if (/@(?:frontguard-ai|ai-written)\s*:\s*end\b/i.test(inner) || /^written\s+by\s+ai\s*:?\s*end\b/i.test(inner))
+    return "end";
+  return null;
+}
+function isAiFileDirectiveLine(line) {
+  return lineMarkerKind(line) === "file";
+}
+function parseAiMarkedRegions(source, fileHint) {
+  const lines = source.split(/\r?\n/);
+  const parseWarnings = [];
+  const regions = [];
+  let headNonEmpty = 0;
+  for (let i3 = 0; i3 < lines.length && headNonEmpty < FILE_SCAN_HEAD_LINES; i3++) {
+    if (!lines[i3]?.trim()) continue;
+    headNonEmpty++;
+    if (isAiFileDirectiveLine(lines[i3] ?? "")) {
+      const bodyLines = lines.filter((_4, idx) => idx !== i3);
+      regions.push({
+        startLine: 1,
+        endLine: lines.length,
+        text: bodyLines.join("\n")
+      });
+      return { regions, parseWarnings };
+    }
+  }
+  let open = false;
+  let contentStart = null;
+  const buf = [];
+  for (let i3 = 0; i3 < lines.length; i3++) {
+    const line = lines[i3] ?? "";
+    const kind = lineMarkerKind(line);
+    if (kind === "file") {
+      parseWarnings.push(`${fileHint}:${i3 + 1}: @file directive ignored (only honored in first ${FILE_SCAN_HEAD_LINES} non-empty lines)`);
+      if (open) buf.push(line);
+      continue;
+    }
+    if (kind === "start") {
+      if (open) {
+        parseWarnings.push(`${fileHint}:${i3 + 1}: nested AI:start ignored (flatten your regions)`);
+        buf.push(line);
+        continue;
+      }
+      open = true;
+      contentStart = i3 + 2;
+      buf.length = 0;
+      continue;
+    }
+    if (kind === "end") {
+      if (!open) {
+        parseWarnings.push(`${fileHint}:${i3 + 1}: stray AI:end`);
+        continue;
+      }
+      open = false;
+      if (contentStart !== null) {
+        regions.push({
+          startLine: contentStart,
+          endLine: i3,
+          text: buf.join("\n")
+        });
+      }
+      contentStart = null;
+      buf.length = 0;
+      continue;
+    }
+    if (open) buf.push(line);
+  }
+  if (open && contentStart !== null) {
+    parseWarnings.push(`${fileHint}: unclosed AI:start \u2014 treating region as ending at EOF`);
+    regions.push({
+      startLine: contentStart,
+      endLine: lines.length,
+      text: buf.join("\n")
+    });
+  }
+  return { regions, parseWarnings };
+}
+function matchLineNumbersInRegion(regionText, regionStartLine, re) {
+  const flags = re.flags.includes("g") ? re.flags : `${re.flags}g`;
+  const g4 = new RegExp(re.source, flags);
+  const out = [];
+  let m3;
+  const text = regionText;
+  while ((m3 = g4.exec(text)) !== null) {
+    const lineInRegion = text.slice(0, m3.index).split("\n").length;
+    out.push(regionStartLine + lineInRegion - 1);
+    if (m3.index === g4.lastIndex) g4.lastIndex++;
+  }
+  return out;
+}
+
+// src/checks/ai-assisted-strict.ts
 function sev(gate) {
   return gate === "block" ? "block" : gate === "info" ? "info" : "warn";
 }
@@ -5073,6 +5185,20 @@ var PATTERNS2 = [
     message: "Possible dynamic SQL/string \u2014 ensure parameterization, not string concat."
   }
 ];
+function scanRegion(rel, regionText, regionStartLine, gate, tag, findings) {
+  for (const { id, re, message, forceBlock } of PATTERNS2) {
+    const lines = matchLineNumbersInRegion(regionText, regionStartLine, re);
+    for (const line of lines) {
+      findings.push({
+        id,
+        severity: forceBlock ? "block" : sev(gate),
+        message: `${tag} ${message}`,
+        file: rel,
+        detail: `line ${line}`
+      });
+    }
+  }
+}
 async function runAiAssistedStrict(cwd, config, pr) {
   const t0 = performance.now();
   const cfg = config.checks.aiAssistedReview;
@@ -5092,35 +5218,62 @@ async function runAiAssistedStrict(cwd, config, pr) {
       skipped: "no PR context (Bitbucket PR pipeline + BITBUCKET_PR_ID required)"
     };
   }
-  if (!pr.aiAssisted) {
+  const mode = cfg.strictScanMode ?? "both";
+  const gate = cfg.gate;
+  const files = (pr.files ?? []).filter((f4) => CODE_EXT.test(f4)).slice(0, 150);
+  const byRel = /* @__PURE__ */ new Map();
+  let anyDecoratorInPr = false;
+  for (const rel of files) {
+    const full = path5.join(cwd, rel);
+    try {
+      const content = await fs.readFile(full, "utf8");
+      if (content.length > 5e5) continue;
+      const parsed = parseAiMarkedRegions(content, rel);
+      byRel.set(rel, { content, parsed });
+      if (parsed.regions.length > 0) anyDecoratorInPr = true;
+    } catch {
+      continue;
+    }
+  }
+  if (mode === "decorator" && !anyDecoratorInPr) {
     return {
       checkId: "ai-assisted-strict",
       findings: [],
       durationMs: Math.round(performance.now() - t0),
-      skipped: "PR does not indicate AI-assisted code"
+      skipped: "strictScanMode=decorator \u2014 no `@frontguard-ai:start` / `written by AI: start` regions in PR files"
     };
   }
-  const files = (pr.files ?? []).filter((f4) => CODE_EXT.test(f4)).slice(0, 150);
-  const gate = cfg.gate;
+  if (mode === "pr-disclosure" && !pr.aiAssisted) {
+    return {
+      checkId: "ai-assisted-strict",
+      findings: [],
+      durationMs: Math.round(performance.now() - t0),
+      skipped: "strictScanMode=pr-disclosure \u2014 PR does not indicate AI-assisted code"
+    };
+  }
+  const useWholeFileFallback = (mode === "pr-disclosure" || mode === "both") && Boolean(pr.aiAssisted);
   const findings = [];
   for (const rel of files) {
-    const full = path5.join(cwd, rel);
-    let content;
-    try {
-      content = await fs.readFile(full, "utf8");
-    } catch {
-      continue;
-    }
-    if (content.length > 5e5) continue;
-    for (const { id, re, message, forceBlock } of PATTERNS2) {
-      if (!re.test(content)) continue;
+    const entry = byRel.get(rel);
+    if (!entry) continue;
+    const { content, parsed } = entry;
+    for (const w3 of parsed.parseWarnings) {
       findings.push({
-        id,
-        severity: forceBlock ? "block" : sev(gate),
-        message: `[AI-assisted strict] ${message}`,
+        id: "ai-decorator-parse",
+        severity: "info",
+        message: `[AI markers] ${w3}`,
         file: rel
       });
     }
+    if (parsed.regions.length > 0) {
+      for (const r4 of parsed.regions) {
+        scanRegion(rel, r4.text, r4.startLine, gate, "[AI-marked code]", findings);
+      }
+      continue;
+    }
+    if (useWholeFileFallback) {
+      scanRegion(rel, content, 1, gate, "[AI-assisted strict]", findings);
+    }
   }
   return {
     checkId: "ai-assisted-strict",
@@ -5132,7 +5285,7 @@ function dedupe(f4) {
   const s3 = /* @__PURE__ */ new Set();
   const out = [];
   for (const x3 of f4) {
-    const k3 = `${x3.id}:${x3.file ?? ""}`;
+    const k3 = `${x3.id}:${x3.file ?? ""}:${x3.detail ?? ""}`;
     if (s3.has(k3)) continue;
     s3.add(k3);
     out.push(x3);