@codacy/verity-cli 0.35.0-experimental.2d2f4df → 0.35.0-experimental.ce90a7b

package/bin/verity.js

@@ -16931,8 +16931,156 @@ function terminalUrl(value) {
   return /^https?:\/\/\S+$/.test(clean2) ? clean2 : "";
 }
 
+// src/lib/standard-content.ts
+var MAX_STANDARD_BYTES = 256 * 1024;
+var MAX_DEPTH = 12;
+var MAX_ID_LENGTH = 120;
+var MAX_STRING_LENGTH = 8 * 1024;
+var MAX_VERITYIGNORE_BYTES = 64 * 1024;
+var TOP_KEYS = /* @__PURE__ */ new Set([
+  "knowledge_spec",
+  "quality_dimensions",
+  "security_patterns",
+  "custom_patterns",
+  "process_constraints",
+  "tool_configuration",
+  "created_by",
+  "version",
+  "verityignore"
+]);
+var KNOWLEDGE_SPEC_KEYS = /* @__PURE__ */ new Set([
+  "project_name",
+  "languages",
+  "frameworks",
+  "architecture",
+  "test_framework",
+  "build_system",
+  "git_remote",
+  "runtime_notes"
+]);
+var PATTERN_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "severity",
+  "description",
+  "rationale",
+  "enforced_by",
+  "cwe",
+  "paths",
+  "signal",
+  "note",
+  "notes",
+  "file_exclusions"
+]);
+var DIMENSION_KEYS = /* @__PURE__ */ new Set(["id", "description", "signals"]);
+var SEVERITIES = /* @__PURE__ */ new Set(["critical", "high", "medium", "med", "low"]);
+var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var PRINTABLE = /^[^\u0000-\u001f\u007f]+$/;
+var CONTROL_EXCEPT_WHITESPACE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+var fail = (error) => ({ ok: false, error });
+function checkValues(v, path, depth) {
+  if (depth > MAX_DEPTH) return fail(`content is nested deeper than ${MAX_DEPTH} levels (at ${path})`);
+  if (typeof v === "string") {
+    if (path === "verityignore") return { ok: true };
+    if (v.length > MAX_STRING_LENGTH) return fail(`${path} is longer than ${MAX_STRING_LENGTH} characters`);
+    if (CONTROL_EXCEPT_WHITESPACE.test(v)) return fail(`${path} contains a control character`);
+    return { ok: true };
+  }
+  if (Array.isArray(v)) {
+    for (const [i2, x] of v.entries()) {
+      const r = checkValues(x, `${path}[${i2}]`, depth + 1);
+      if (!r.ok) return r;
+    }
+    return { ok: true };
+  }
+  if (isPlainObject(v)) {
+    for (const [k, x] of Object.entries(v)) {
+      if (k.length > MAX_ID_LENGTH || !PRINTABLE.test(k)) return fail(`${path} has a key that is not printable text of 1 to ${MAX_ID_LENGTH} characters`);
+      const r = checkValues(x, path ? `${path}.${k}` : k, depth + 1);
+      if (!r.ok) return r;
+    }
+  }
+  return { ok: true };
+}
+function unknownKey(obj, allowed, where2) {
+  const extra = Object.keys(obj).find((k) => !allowed.has(k));
+  return extra === void 0 ? null : fail(`${where2}.${extra} is not a known field`);
+}
+function checkEntries(list2, section, allowed, withSeverity) {
+  for (const [i2, entry] of list2.entries()) {
+    const at = `${section}[${i2}]`;
+    if (!isPlainObject(entry)) return fail(`${at} must be an object`);
+    const extra = unknownKey(entry, allowed, at);
+    if (extra) return extra;
+    const id = entry.id;
+    if (typeof id !== "string" || id.length === 0 || id.length > MAX_ID_LENGTH || !PRINTABLE.test(id)) {
+      return fail(`${at}.id must be printable text of 1 to ${MAX_ID_LENGTH} characters`);
+    }
+    if (withSeverity && "severity" in entry && !SEVERITIES.has(String(entry.severity))) {
+      return fail(`${at}.severity must be one of critical, high, medium, low`);
+    }
+    for (const key of ["enforced_by", "cwe", "paths", "file_exclusions"]) {
+      if (key in entry && !Array.isArray(entry[key])) return fail(`${at}.${key} must be an array`);
+    }
+  }
+  return { ok: true };
+}
+function validateStandardContent(content, opts = {}) {
+  const requireAll = opts.requireAll ?? true;
+  if (!isPlainObject(content)) return fail("content is required and must be an object");
+  const size = new TextEncoder().encode(JSON.stringify(content)).length;
+  if (size > MAX_STANDARD_BYTES) return fail(`content is ${size} bytes; the limit is ${MAX_STANDARD_BYTES}`);
+  const values = checkValues(content, "", 0);
+  if (!values.ok) return values;
+  const missing = ["knowledge_spec", "quality_dimensions", "security_patterns", "process_constraints"].filter((k) => !(k in content));
+  if (requireAll && missing.length > 0) return fail(`content is missing required keys: ${missing.join(", ")}`);
+  const extraTop = unknownKey(content, TOP_KEYS, "content");
+  if (extraTop) return extraTop;
+  if ("knowledge_spec" in content) {
+    if (!isPlainObject(content.knowledge_spec)) return fail("knowledge_spec must be an object");
+    const extraSpec = unknownKey(content.knowledge_spec, KNOWLEDGE_SPEC_KEYS, "knowledge_spec");
+    if (extraSpec) return extraSpec;
+  }
+  if ("process_constraints" in content && !isPlainObject(content.process_constraints)) return fail("process_constraints must be an object");
+  if ("tool_configuration" in content && !isPlainObject(content.tool_configuration)) {
+    return fail("tool_configuration must be an object");
+  }
+  if ("quality_dimensions" in content) {
+    if (!Array.isArray(content.quality_dimensions)) return fail("quality_dimensions must be an array");
+    const dims = checkEntries(content.quality_dimensions, "quality_dimensions", DIMENSION_KEYS, false);
+    if (!dims.ok) return dims;
+  }
+  if ("security_patterns" in content) {
+    if (!Array.isArray(content.security_patterns)) return fail("security_patterns must be an array");
+    const sec = checkEntries(content.security_patterns, "security_patterns", PATTERN_KEYS, true);
+    if (!sec.ok) return sec;
+  }
+  if ("custom_patterns" in content) {
+    if (!Array.isArray(content.custom_patterns)) return fail("custom_patterns must be an array");
+    const custom = checkEntries(content.custom_patterns, "custom_patterns", PATTERN_KEYS, true);
+    if (!custom.ok) return custom;
+  }
+  for (const key of ["created_by", "version"]) {
+    if (key in content && content[key] !== null && typeof content[key] !== "string") return fail(`${key} must be a string`);
+  }
+  if ("verityignore" in content) {
+    const v = content.verityignore;
+    if (typeof v !== "string") return fail("verityignore must be a string");
+    if (new TextEncoder().encode(v).length > MAX_VERITYIGNORE_BYTES) {
+      return fail(`verityignore is larger than ${MAX_VERITYIGNORE_BYTES} bytes`);
+    }
+    if (CONTROL_EXCEPT_WHITESPACE.test(v)) return fail("verityignore contains a control character");
+  }
+  return { ok: true };
+}
+
 // src/lib/remote-config.ts
 var IGNORE_RIDER = "verityignore";
+function identifiableStandard(content) {
+  const spec = content.knowledge_spec;
+  const name2 = spec && typeof spec === "object" && !Array.isArray(spec) ? spec.project_name : void 0;
+  const hasList = ["security_patterns", "quality_dimensions", "custom_patterns"].some((k) => Array.isArray(content[k]));
+  return typeof name2 === "string" && name2.trim().length > 0 && hasList;
+}
 async function fetchRemoteSetup(opts) {
   const standard = await apiRequest({
     method: "GET",
@@ -16945,19 +17093,32 @@ async function fetchRemoteSetup(opts) {
     const missing = standard.http_status === 404 && standard.error.startsWith("STANDARD_NOT_FOUND");
     return missing ? { status: "none" } : { status: "unavailable", reason: standard.error };
   }
+  const d = standard.data;
+  const content = d?.content;
+  if (!d || typeof d.version !== "number" || !Number.isSafeInteger(d.version) || d.version < 1 || typeof content !== "object" || content === null || Array.isArray(content)) {
+    return { status: "unavailable", reason: "the service answered without a Standard" };
+  }
+  const valid = validateStandardContent(content, { requireAll: false });
+  if (!valid.ok) return { status: "unavailable", reason: `the team's Standard on the service is not valid here (${terminalText(valid.error, 200)})` };
+  if (!identifiableStandard(content)) {
+    return { status: "unavailable", reason: "the service answered with a Standard that names no project or holds no rules" };
+  }
   return {
     status: "found",
     standard: {
-      version: standard.data.version,
-      content: standard.data.content ?? {},
-      createdBy: standard.data.created_by,
-      createdAt: standard.data.created_at
+      version: d.version,
+      content,
+      createdBy: typeof d.created_by === "string" ? d.created_by : null,
+      createdAt: typeof d.created_at === "string" ? d.created_at : ""
     }
   };
 }
 async function adoptRemoteSetup(found, opts) {
   const written = [];
   const notes = [];
+  const valid = validateStandardContent(found.standard.content, { requireAll: false });
+  if (!valid.ok) throw new Error(`the team's Standard on the service is not valid here (${terminalText(valid.error, 200)}), so nothing was written`);
+  if (!identifiableStandard(found.standard.content)) throw new Error("the team's Standard on the service names no project or holds no rules, so nothing was written");
   const content = { ...found.standard.content };
   const rider = typeof content[IGNORE_RIDER] === "string" ? content[IGNORE_RIDER] : null;
   delete content[IGNORE_RIDER];
@@ -17179,7 +17340,7 @@ async function shareLocalStandard(globals) {
 }
 var MAX_WAIT_SECONDS = 600;
 async function finishSplitLogin(opts) {
-  function fail(status, error, clear) {
+  function fail2(status, error, clear) {
     if (clear) clearPendingLogin();
     printError(`Login failed: ${error}`);
     printJson({ status, error });
@@ -17187,15 +17348,15 @@ async function finishSplitLogin(opts) {
   }
   const wait = Number(String(opts.waitSeconds ?? "100").trim());
   if (!Number.isInteger(wait) || wait < 0 || wait > MAX_WAIT_SECONDS) {
-    fail("invalid", `--wait must be a whole number of seconds from 0 to ${MAX_WAIT_SECONDS}`, false);
+    fail2("invalid", `--wait must be a whole number of seconds from 0 to ${MAX_WAIT_SECONDS}`, false);
   }
   const read2 = readPendingLogin();
-  if (read2.status === "none") fail("no_pending", 'no sign-in is pending \u2014 run "verity login --start" first', false);
-  if (read2.status === "invalid") fail("invalid", `the pending sign-in is unusable (${read2.reason}) \u2014 run "verity login --start" again`, true);
-  if (read2.status === "expired") fail("expired", 'the code expired before it was approved \u2014 run "verity login --start" again', true);
+  if (read2.status === "none") fail2("no_pending", 'no sign-in is pending \u2014 run "verity login --start" first', false);
+  if (read2.status === "invalid") fail2("invalid", `the pending sign-in is unusable (${read2.reason}) \u2014 run "verity login --start" again`, true);
+  if (read2.status === "expired") fail2("expired", 'the code expired before it was approved \u2014 run "verity login --start" again', true);
   const pending = read2.record;
   if (pending.service_url !== opts.serviceUrl) {
-    fail(
+    fail2(
       "service_changed",
       `the sign-in was started for ${pending.service_url}, but this machine now resolves ${opts.serviceUrl} \u2014 run "verity login --start" again`,
       true
@@ -17216,7 +17377,7 @@ async function finishSplitLogin(opts) {
       });
       process.exit(2);
     }
-    fail(polled.reason, polled.error, true);
+    fail2(polled.reason, polled.error, true);
   }
   clearPendingLogin();
   const result = await loginOnce({
@@ -17225,7 +17386,7 @@ async function finishSplitLogin(opts) {
     verbose: opts.verbose,
     providerToken: polled.data
   });
-  if (!result.ok) fail("failed", result.error, false);
+  if (!result.ok) fail2("failed", result.error, false);
   const data = result.data;
   await reportLoginOutcome(data, { remote: opts.remote || void 0, verbose: opts.verbose });
   const shared = await shareLocalStandard({ serviceUrl: opts.serviceUrl, verbose: opts.verbose });
@@ -24555,7 +24716,7 @@ function fitDoc(text2, budget) {
 }
 var normal = (line2) => line2.trim().toLowerCase().replace(/\s+/g, " ");
 function docs(root, files) {
-  const nested = files.filter((f) => NESTED_DOC.test(f) && !NOT_THE_TEAMS.test(f)).sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b));
+  const nested = files.filter((f) => NESTED_DOC.test(f) && !NOT_THE_TEAMS.test(f) && safePath(f) !== null).sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b));
   const plan = [
     ...ROOT_DOCS.map((n2) => [n2, LIMITS.docBytes]),
     ...nested.map((n2) => [n2, LIMITS.nestedDocBytes]),
@@ -24650,13 +24811,16 @@ function rulesFrom(content, before) {
   });
 }
 async function generateStandard(opts) {
+  if (opts.replaces !== void 0 && (!Number.isSafeInteger(opts.replaces) || opts.replaces < 1)) {
+    return { status: "failed", reason: "the version to replace is not a valid Standard version" };
+  }
   const upload = buildStandardUpload(opts.base, readVerityIgnoreRaw());
   const res = await apiRequest({
     method: "POST",
     path: "/standards/generate",
     serviceUrl: opts.serviceUrl,
     token: opts.token,
-    body: { profile: opts.profile, base: upload.content, ...opts.replaces ? { replaces: opts.replaces } : {} },
+    body: { profile: opts.profile, base: upload.content, ...opts.replaces !== void 0 ? { replaces: opts.replaces } : {} },
     verbose: opts.verbose,
     timeout: GENERATE_TIMEOUT_MS,
     cmd: "standard_generate"
@@ -24664,12 +24828,17 @@ async function generateStandard(opts) {
   if (!res.ok) {
     if (res.http_status === 409 && res.error.startsWith("STANDARD_EXISTS")) return { status: "exists" };
     if (res.http_status === 403 && res.error.startsWith("FEATURE_DISABLED")) return { status: "disabled" };
+    if (res.http_status === 404 && /Unknown route/.test(res.error)) return { status: "unsupported" };
     return { status: "failed", reason: terminalText(res.error, 300) };
   }
   const { version, content } = res.data;
-  if (typeof version !== "number" || !content || typeof content !== "object") {
+  if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1 || !content || typeof content !== "object" || Array.isArray(content)) {
     return { status: "failed", reason: "the service answered without a Standard" };
   }
+  const valid = validateStandardContent(content);
+  if (!valid.ok) {
+    return { status: "failed", reason: `the service answered with a Standard this machine will not write (${terminalText(valid.error, 200)})` };
+  }
   const before = new Set(
     (Array.isArray(opts.base.custom_patterns) ? opts.base.custom_patterns : []).map((p) => String(p.id))
   );
@@ -24932,6 +25101,10 @@ async function runGenerate(globals, opts) {
     spinner.warn("Rule generation is not switched on for this project yet. The built-in rules apply.");
     return;
   }
+  if (outcome.status === "unsupported") {
+    spinner.warn("This Verity service does not write project rules yet: it is older than this CLI. The built-in rules apply.");
+    return;
+  }
   spinner.warn(`The rules could not be written: ${outcome.reason}`);
   process.exit(1);
 }
@@ -28071,7 +28244,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.35.0-experimental.2d2f4df" : "dev";
+    return true ? "0.35.0-experimental.ce90a7b" : "dev";
   } catch {
     return "dev";
   }
@@ -34671,7 +34844,7 @@ var LIMITS2 = {
   abstracts: 32,
   int: 1e9
 };
-function isPlainObject(v) {
+function isPlainObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v) && Object.getPrototypeOf(v) === Object.prototype;
 }
 function str2(v, max) {
@@ -34703,7 +34876,7 @@ function parseHeader(obj) {
   if (!model || !Array.isArray(obj.abstracts) || obj.abstracts.length > LIMITS2.abstracts) return null;
   const abstracts = [];
   for (const a of obj.abstracts) {
-    if (!isPlainObject(a)) return null;
+    if (!isPlainObject2(a)) return null;
     const file = repoPath2(a.file);
     const symbol = str2(a.symbol, LIMITS2.symbol);
     const sha = a.sha256 === void 0 ? "" : str2(a.sha256, 80);
@@ -34775,7 +34948,7 @@ function parseVerityLines(stdout) {
       out2.malformed++;
       continue;
     }
-    if (!isPlainObject(obj)) {
+    if (!isPlainObject2(obj)) {
       out2.malformed++;
       continue;
     }
@@ -41560,7 +41733,7 @@ async function generate(ui, globals, profile, replaces) {
   const reverts = profile.history.commits.filter((c) => /^revert\b/i.test(c.subject)).length;
   rail.active("Writing review rules");
   await rail.counted(([c, f, r]) => `${s.green}\u2713${s.reset} Read ${c} commits ${s.gray}\xB7${s.reset} ${f} fixes ${s.gray}\xB7${s.reset} ${r} reverts`, [commits, fixes, reverts]);
-  if (profile.docs.length) rail.ticked(`Read ${profile.docs.map((d) => d.name).join(" and ")}`);
+  if (profile.docs.length) rail.ticked(`Read ${profile.docs.map((d) => terminalText(d.name, 120)).join(" and ")}`);
   if (ui.term.screen && !ui.term.motion) rail.line("Writing rules for this repository\u2026");
   const started = Date.now();
   const base = buildStandard({ detected: detectProject() }, loadCatalog());
@@ -41580,9 +41753,14 @@ async function generate(ui, globals, profile, replaces) {
     rail.gap();
     return { status: "fallback" };
   }
+  if (outcome.status === "unsupported") {
+    rail.line(`This Verity service (${terminalText(url.data, 200)}) does not write project rules yet: it is older than this CLI. The built-in rules apply.`);
+    rail.gap();
+    return { status: "fallback" };
+  }
   if (outcome.status === "failed") {
     rail.warn("The rules could not be written this time");
-    rail.line(outcome.reason);
+    rail.line(terminalText(outcome.reason, 300));
     rail.line("The built-in rules apply. Try again later: verity standard generate");
     rail.gap();
     return { status: "fallback" };
@@ -41602,7 +41780,7 @@ async function generate(ui, globals, profile, replaces) {
   rail.gap();
   rail.done(`Standard v${outcome.version} saved`);
   rail.line(`Your team gets the same rules. Edit them in ${STANDARD_FILE}`);
-  if (outcome.warning) rail.line(outcome.warning, "warn");
+  if (outcome.warning) rail.line(terminalText(outcome.warning, 600), "warn");
   return { status: "created", version: outcome.version };
 }
 
@@ -41915,7 +42093,7 @@ async function runInit(program2, opts) {
         // The effective answer: the next run starts from this record.
         moments: plan.momentIds,
         ...telemetry ? { telemetry } : {},
-        init: { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.0-experimental.2d2f4df" : "dev" }
+        init: { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.0-experimental.ce90a7b" : "dev" }
       });
     } catch (err2) {
       rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -42752,7 +42930,7 @@ function registerMemoryCommand(program2) {
   memory2.command("pull").description("Download this repo's knowledge graph into .verity/memory/ (the session-start hook runs it)").option("--force", "Fetch every node even if nothing changed since the last pull").option("--quiet", "Print nothing and always exit 0 (for the session-start hook)").action(async (opts) => {
     const globals = program2.opts();
     const quiet = !!opts.quiet;
-    const fail = (message) => {
+    const fail2 = (message) => {
       if (!quiet) printError(message);
       process.exit(quiet ? 0 : 1);
     };
@@ -42761,9 +42939,9 @@ function registerMemoryCommand(program2) {
     } catch {
     }
     const tokenResult = await resolveToken(globals.token);
-    if (!tokenResult.ok) return fail(tokenResult.error);
+    if (!tokenResult.ok) return fail2(tokenResult.error);
     const urlResult = await resolveServiceUrl(globals.serviceUrl);
-    if (!urlResult.ok) return fail(urlResult.error);
+    if (!urlResult.ok) return fail2(urlResult.error);
     let result;
     try {
       result = await pullRepoMemory({
@@ -42773,10 +42951,10 @@ function registerMemoryCommand(program2) {
         force: !!opts.force
       });
     } catch (err2) {
-      return fail(`Could not pull the knowledge graph: ${err2.message}`);
+      return fail2(`Could not pull the knowledge graph: ${err2.message}`);
     }
     logEvent("memory_pull", result.ok ? { status: result.status, received: result.received, written: result.written } : { status: "failed", category: result.category ?? null });
-    if (!result.ok) return fail(`Could not pull the knowledge graph: ${result.error}`);
+    if (!result.ok) return fail2(`Could not pull the knowledge graph: ${result.error}`);
     if (!quiet) {
       printInfo(result.status === "unchanged" ? "Knowledge graph is up to date." : result.status === "tracked" ? "Skipped: .verity/memory/ is tracked by git here, and the pull never rewrites tracked files. Run `verity memory untrack` to make the graph machine-local." : `Pulled ${result.received} node(s); ${result.written} new or updated file(s) written to .verity/memory/.`);
     }
@@ -43745,8 +43923,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.35.0-experimental.2d2f4df").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.0-experimental.2d2f4df");
+program.name("verity").description("CLI for Verity quality gate service").version("0.35.0-experimental.ce90a7b").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.0-experimental.ce90a7b");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.35.0-experimental.2d2f4df",
+  "version": "0.35.0-experimental.ce90a7b",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",