@complior/engine 0.9.0

package/src/domain/scanner/external/modelscan-runner.ts

@@ -0,0 +1,101 @@
+import type { ExternalRunner, ExternalRunnerDeps, ExternalRunnerResult, RawExternalFinding } from './runner-port.js';
+import { normalizeFilePath } from './path-utils.js';
+
+const MODEL_EXTENSIONS = new Set(['.pkl', '.pickle', '.pt', '.pth', '.h5', '.hdf5', '.safetensors', '.onnx', '.pb', '.tflite']);
+
+const EXCLUDED_DIRS = ['node_modules/', 'dist/', '.complior/'];
+
+interface ModelScanResult {
+  readonly summary?: {
+    readonly total_issues_by_severity?: Record<string, number>;
+  };
+  readonly issues?: readonly ModelScanIssue[];
+}
+
+interface ModelScanIssue {
+  readonly severity: string;
+  readonly description: string;
+  readonly source: string;
+  readonly scanner: string;
+}
+
+export const createModelScanRunner = (): ExternalRunner => Object.freeze({
+  name: 'modelscan',
+  run: async (deps: ExternalRunnerDeps): Promise<ExternalRunnerResult> => {
+    // Only run if model files exist outside excluded dirs
+    const isExcluded = (path: string) => EXCLUDED_DIRS.some(d => path.includes(d));
+    const hasModels = deps.files.some((f) => MODEL_EXTENSIONS.has(f.extension) && !isExcluded(f.relativePath));
+    if (!hasModels) {
+      return {
+        tool: 'modelscan',
+        version: '',
+        rawFindings: [],
+        duration: 0,
+        exitCode: 0,
+      };
+    }
+
+    const startTime = Date.now();
+    const toolCmd = deps.toolPath ?? 'modelscan';
+
+    const result = await deps.runProcess(toolCmd, [
+      'scan',
+      '-p', deps.projectPath,
+      '-r', 'json',
+      '-l', 'ERROR',
+    ], { timeout: 180_000 });
+
+    const duration = Date.now() - startTime;
+
+    if (result.exitCode !== 0 && result.exitCode !== 1) {
+      return {
+        tool: 'modelscan',
+        version: '',
+        rawFindings: [],
+        duration,
+        exitCode: result.exitCode,
+        error: result.stderr.slice(0, 500),
+      };
+    }
+
+    const rawFindings = parseModelScanOutput(result.stdout, deps.projectPath);
+    return {
+      tool: 'modelscan',
+      version: '',
+      rawFindings,
+      duration,
+      exitCode: result.exitCode,
+    };
+  },
+});
+
+export const parseModelScanOutput = (stdout: string, projectPath: string): RawExternalFinding[] => {
+  if (!stdout.trim()) return [];
+
+  // ModelScan mixes info messages with JSON in stdout and word-wraps
+  // long strings with literal newlines inside JSON values (invalid JSON).
+  // Extract JSON by finding the first '{', then sanitize embedded newlines.
+  const jsonStart = stdout.indexOf('{');
+  if (jsonStart === -1) return [];
+
+  const sanitized = stdout.slice(jsonStart).replace(/\n/g, ' ');
+
+  let parsed: ModelScanResult;
+  try {
+    parsed = JSON.parse(sanitized) as ModelScanResult;
+  } catch {
+    return [];
+  }
+
+  if (!parsed.issues) return [];
+
+  return parsed.issues
+    .filter((issue) => !EXCLUDED_DIRS.some(d => issue.source.includes(d)))
+    .map((issue): RawExternalFinding => ({
+      ruleId: `modelscan-${issue.scanner}`,
+      message: issue.description,
+      severity: issue.severity,
+      file: normalizeFilePath(issue.source, projectPath),
+      category: 'model-safety',
+    }));
+};

package/src/domain/scanner/external/path-utils.ts

@@ -0,0 +1,8 @@
+/** Normalize a file path from an external tool output relative to projectPath. */
+export const normalizeFilePath = (filePath: string, projectPath: string): string => {
+  if (filePath.startsWith(projectPath + '/')) {
+    return filePath.slice(projectPath.length + 1);
+  }
+  if (filePath === projectPath) return '.';
+  return filePath;
+};

package/src/domain/scanner/external/runner-port.ts

@@ -0,0 +1,45 @@
+import type { ExternalToolName } from '../../../types/common.types.js';
+import type { ProcessRunner } from '../../../ports/process.port.js';
+
+/** Raw finding from an external tool before mapping to Complior Finding. */
+export interface RawExternalFinding {
+  readonly ruleId: string;
+  readonly message: string;
+  readonly severity: string;
+  readonly file: string;
+  readonly line?: number;
+  readonly column?: number;
+  readonly category?: string;
+}
+
+/** Result returned from a single external runner. */
+export interface ExternalRunnerResult {
+  readonly tool: ExternalToolName;
+  readonly version: string;
+  readonly rawFindings: readonly RawExternalFinding[];
+  readonly duration: number;
+  readonly exitCode: number;
+  readonly error?: string;
+}
+
+/** Dependencies injected into each external runner. */
+export interface ExternalRunnerDeps {
+  readonly projectPath: string;
+  readonly runProcess: ProcessRunner;
+  readonly toolPath?: string;
+  readonly files: readonly { readonly relativePath: string; readonly extension: string }[];
+}
+
+/** Interface all external tool runners implement. */
+export interface ExternalRunner {
+  readonly name: ExternalToolName;
+  readonly run: (deps: ExternalRunnerDeps) => Promise<ExternalRunnerResult>;
+}
+
+/** Aggregated runners passed to scanner. */
+export interface ExternalRunners {
+  readonly semgrep: ExternalRunner;
+  readonly bandit: ExternalRunner;
+  readonly modelscan: ExternalRunner;
+  readonly detectSecrets: ExternalRunner;
+}

package/src/domain/scanner/external/semgrep-runner.test.ts

@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest';
+import { parseSemgrepOutput } from './semgrep-runner.js';
+
+describe('parseSemgrepOutput', () => {
+  it('parses valid Semgrep JSON output', () => {
+    const output = JSON.stringify({
+      results: [
+        {
+          check_id: 'complior.bare-call',
+          path: '/project/src/ai.ts',
+          start: { line: 42, col: 5 },
+          end: { line: 42, col: 30 },
+          extra: {
+            message: 'Bare LLM API call without compliance wrapper',
+            severity: 'ERROR',
+          },
+        },
+        {
+          check_id: 'complior.unsafe-deser',
+          path: '/project/loader.py',
+          start: { line: 10, col: 1 },
+          end: { line: 10, col: 50 },
+          extra: {
+            message: 'Unsafe deserialization detected',
+            severity: 'ERROR',
+          },
+        },
+      ],
+    });
+
+    const findings = parseSemgrepOutput(output, '/project');
+    expect(findings).toHaveLength(2);
+    expect(findings[0]!.ruleId).toBe('complior.bare-call');
+    expect(findings[0]!.file).toBe('src/ai.ts');
+    expect(findings[0]!.line).toBe(42);
+    expect(findings[0]!.severity).toBe('ERROR');
+    expect(findings[1]!.ruleId).toBe('complior.unsafe-deser');
+    expect(findings[1]!.file).toBe('loader.py');
+  });
+
+  it('returns empty array for empty output', () => {
+    expect(parseSemgrepOutput('', '/project')).toEqual([]);
+  });
+
+  it('returns empty array for invalid JSON', () => {
+    expect(parseSemgrepOutput('not json', '/project')).toEqual([]);
+  });
+
+  it('returns empty array when no results key', () => {
+    expect(parseSemgrepOutput('{}', '/project')).toEqual([]);
+  });
+});

package/src/domain/scanner/external/semgrep-runner.ts

@@ -0,0 +1,94 @@
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import type { ExternalRunner, ExternalRunnerDeps, ExternalRunnerResult, RawExternalFinding } from './runner-port.js';
+import { normalizeFilePath } from './path-utils.js';
+
+const RULES_DIR = resolve(
+  fileURLToPath(import.meta.url), '..', '..', '..', '..', '..', 'data', 'semgrep-rules',
+);
+
+interface SemgrepResult {
+  readonly results?: readonly SemgrepFinding[];
+  readonly errors?: readonly unknown[];
+}
+
+interface SemgrepFinding {
+  readonly check_id: string;
+  readonly path: string;
+  readonly start: { readonly line: number; readonly col: number };
+  readonly end: { readonly line: number; readonly col: number };
+  readonly extra: {
+    readonly message: string;
+    readonly severity: string;
+    readonly metadata?: Record<string, unknown>;
+  };
+}
+
+export const createSemgrepRunner = (): ExternalRunner => Object.freeze({
+  name: 'semgrep',
+  run: async (deps: ExternalRunnerDeps): Promise<ExternalRunnerResult> => {
+    const startTime = Date.now();
+    const toolCmd = deps.toolPath ?? 'semgrep';
+
+    const result = await deps.runProcess(toolCmd, [
+      'scan',
+      '--config', RULES_DIR,
+      '--json',
+      '--quiet',
+      '--no-git-ignore',
+      '--exclude', '.complior',
+      '--exclude', 'node_modules',
+      '--exclude', 'dist',
+      deps.projectPath,
+    ], { timeout: 120_000 });
+
+    const duration = Date.now() - startTime;
+
+    if (result.exitCode !== 0 && result.exitCode !== 1) {
+      // exitCode 1 = findings found (expected), others = real error
+      return {
+        tool: 'semgrep',
+        version: '',
+        rawFindings: [],
+        duration,
+        exitCode: result.exitCode,
+        error: result.stderr.slice(0, 500),
+      };
+    }
+
+    const rawFindings = parseSemgrepOutput(result.stdout, deps.projectPath);
+    return {
+      tool: 'semgrep',
+      version: '',
+      rawFindings,
+      duration,
+      exitCode: result.exitCode,
+    };
+  },
+});
+
+export const parseSemgrepOutput = (stdout: string, projectPath: string): RawExternalFinding[] => {
+  if (!stdout.trim()) return [];
+
+  let parsed: SemgrepResult;
+  try {
+    parsed = JSON.parse(stdout) as SemgrepResult;
+  } catch {
+    return [];
+  }
+
+  if (!parsed.results) return [];
+
+  return parsed.results.map((r): RawExternalFinding => ({
+    // Semgrep prefixes rule IDs with the config path (e.g. "data.semgrep-rules.complior.bare-call")
+    // Normalize to just the last dotted segment that starts with "complior."
+    ruleId: r.check_id.includes('complior.')
+      ? 'complior.' + r.check_id.split('complior.').pop()!
+      : r.check_id,
+    message: r.extra.message,
+    severity: r.extra.severity,
+    file: normalizeFilePath(r.path, projectPath),
+    line: r.start.line,
+    column: r.start.col,
+  }));
+};

package/src/domain/scanner/external/types.ts

@@ -0,0 +1,32 @@
+export type ExternalCheckStatus = 'PASS' | 'FAIL' | 'PARTIAL' | 'N_A';
+
+export type ExternalScanLevel = 'L1' | 'L2' | 'L3';
+
+export interface ExternalCheck {
+  readonly name: string;
+  readonly status: ExternalCheckStatus;
+  readonly obligation: string;
+  readonly article: string;
+  readonly evidence: string;
+  readonly confidence: number;
+}
+
+export interface ExternalScanResult {
+  readonly url: string;
+  readonly scanLevel: ExternalScanLevel;
+  readonly score: number;
+  readonly checks: readonly ExternalCheck[];
+  readonly screenshots: readonly string[];
+  readonly duration: number;
+  readonly timestamp: string;
+}
+
+export interface ExternalScanConfig {
+  readonly url: string;
+  readonly level?: ExternalScanLevel;
+  readonly timeout?: number;
+  readonly screenshotsDir?: string;
+}
+
+// Re-export from ports for backward compatibility
+export type { PageData } from '../../../ports/browser.port.js';