@delegance/claude-autopilot 5.0.1 → 5.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/src/cli/index.js +39 -1
- package/dist/src/cli/preflight.js +17 -4
- package/package.json +4 -3
- package/dist/presets/go/rules/go-sql-injection.d.ts.map +0 -1
- package/dist/presets/go/rules/go-sql-injection.js.map +0 -1
- package/dist/presets/nextjs-supabase/rules/supabase-rls-bypass.d.ts.map +0 -1
- package/dist/presets/nextjs-supabase/rules/supabase-rls-bypass.js.map +0 -1
- package/dist/presets/python-fastapi/rules/fastapi-missing-auth.d.ts.map +0 -1
- package/dist/presets/python-fastapi/rules/fastapi-missing-auth.js.map +0 -1
- package/dist/presets/rails-postgres/rules/rails-sql-injection.d.ts.map +0 -1
- package/dist/presets/rails-postgres/rules/rails-sql-injection.js.map +0 -1
- package/dist/presets/t3/rules/t3-server-only.d.ts.map +0 -1
- package/dist/presets/t3/rules/t3-server-only.js.map +0 -1
- package/dist/src/adapters/base.d.ts.map +0 -1
- package/dist/src/adapters/base.js.map +0 -1
- package/dist/src/adapters/council/claude.d.ts.map +0 -1
- package/dist/src/adapters/council/claude.js.map +0 -1
- package/dist/src/adapters/council/openai.d.ts.map +0 -1
- package/dist/src/adapters/council/openai.js.map +0 -1
- package/dist/src/adapters/council/types.d.ts.map +0 -1
- package/dist/src/adapters/council/types.js.map +0 -1
- package/dist/src/adapters/loader.d.ts.map +0 -1
- package/dist/src/adapters/loader.js.map +0 -1
- package/dist/src/adapters/migration-runner/supabase.d.ts.map +0 -1
- package/dist/src/adapters/migration-runner/supabase.js.map +0 -1
- package/dist/src/adapters/migration-runner/types.d.ts.map +0 -1
- package/dist/src/adapters/migration-runner/types.js.map +0 -1
- package/dist/src/adapters/review-bot-parser/cursor.d.ts.map +0 -1
- package/dist/src/adapters/review-bot-parser/cursor.js.map +0 -1
- package/dist/src/adapters/review-bot-parser/declarative-base.d.ts.map +0 -1
- package/dist/src/adapters/review-bot-parser/declarative-base.js.map +0 -1
- package/dist/src/adapters/review-bot-parser/types.d.ts.map +0 -1
- package/dist/src/adapters/review-bot-parser/types.js.map +0 -1
- package/dist/src/adapters/review-engine/auto.d.ts.map +0 -1
- package/dist/src/adapters/review-engine/auto.js.map +0 -1
- package/dist/src/adapters/review-engine/claude.d.ts.map +0 -1
- package/dist/src/adapters/review-engine/claude.js.map +0 -1
- package/dist/src/adapters/review-engine/codex.d.ts.map +0 -1
- package/dist/src/adapters/review-engine/codex.js.map +0 -1
- package/dist/src/adapters/review-engine/gemini.d.ts.map +0 -1
- package/dist/src/adapters/review-engine/gemini.js.map +0 -1
- package/dist/src/adapters/review-engine/openai-compatible.d.ts.map +0 -1
- package/dist/src/adapters/review-engine/openai-compatible.js.map +0 -1
- package/dist/src/adapters/review-engine/parse-output.d.ts.map +0 -1
- package/dist/src/adapters/review-engine/parse-output.js.map +0 -1
- package/dist/src/adapters/review-engine/prompt-builder.d.ts.map +0 -1
- package/dist/src/adapters/review-engine/prompt-builder.js.map +0 -1
- package/dist/src/adapters/review-engine/types.d.ts.map +0 -1
- package/dist/src/adapters/review-engine/types.js.map +0 -1
- package/dist/src/adapters/vcs-host/commit-status.d.ts.map +0 -1
- package/dist/src/adapters/vcs-host/commit-status.js.map +0 -1
- package/dist/src/adapters/vcs-host/github.d.ts.map +0 -1
- package/dist/src/adapters/vcs-host/github.js.map +0 -1
- package/dist/src/adapters/vcs-host/types.d.ts.map +0 -1
- package/dist/src/adapters/vcs-host/types.js.map +0 -1
- package/dist/src/cli/_pkg-root.d.ts.map +0 -1
- package/dist/src/cli/_pkg-root.js.map +0 -1
- package/dist/src/cli/autoregress-bridge.d.ts.map +0 -1
- package/dist/src/cli/autoregress-bridge.js.map +0 -1
- package/dist/src/cli/baseline.d.ts.map +0 -1
- package/dist/src/cli/baseline.js.map +0 -1
- package/dist/src/cli/ci.d.ts.map +0 -1
- package/dist/src/cli/ci.js.map +0 -1
- package/dist/src/cli/costs.d.ts.map +0 -1
- package/dist/src/cli/costs.js.map +0 -1
- package/dist/src/cli/council.d.ts.map +0 -1
- package/dist/src/cli/council.js.map +0 -1
- package/dist/src/cli/detector.d.ts.map +0 -1
- package/dist/src/cli/detector.js.map +0 -1
- package/dist/src/cli/explain.d.ts.map +0 -1
- package/dist/src/cli/explain.js.map +0 -1
- package/dist/src/cli/fix.d.ts.map +0 -1
- package/dist/src/cli/fix.js.map +0 -1
- package/dist/src/cli/hook.d.ts.map +0 -1
- package/dist/src/cli/hook.js.map +0 -1
- package/dist/src/cli/ignore-helper.d.ts.map +0 -1
- package/dist/src/cli/ignore-helper.js.map +0 -1
- package/dist/src/cli/index.d.ts.map +0 -1
- package/dist/src/cli/index.js.map +0 -1
- package/dist/src/cli/lsp.d.ts.map +0 -1
- package/dist/src/cli/lsp.js.map +0 -1
- package/dist/src/cli/mcp.d.ts.map +0 -1
- package/dist/src/cli/mcp.js.map +0 -1
- package/dist/src/cli/migrate-v4.d.ts.map +0 -1
- package/dist/src/cli/migrate-v4.js.map +0 -1
- package/dist/src/cli/pr-comment.d.ts.map +0 -1
- package/dist/src/cli/pr-comment.js.map +0 -1
- package/dist/src/cli/pr-desc.d.ts.map +0 -1
- package/dist/src/cli/pr-desc.js.map +0 -1
- package/dist/src/cli/pr-review-comments.d.ts.map +0 -1
- package/dist/src/cli/pr-review-comments.js.map +0 -1
- package/dist/src/cli/pr.d.ts.map +0 -1
- package/dist/src/cli/pr.js.map +0 -1
- package/dist/src/cli/preflight.d.ts.map +0 -1
- package/dist/src/cli/preflight.js.map +0 -1
- package/dist/src/cli/report.d.ts.map +0 -1
- package/dist/src/cli/report.js.map +0 -1
- package/dist/src/cli/run.d.ts.map +0 -1
- package/dist/src/cli/run.js.map +0 -1
- package/dist/src/cli/scan.d.ts.map +0 -1
- package/dist/src/cli/scan.js.map +0 -1
- package/dist/src/cli/setup.d.ts.map +0 -1
- package/dist/src/cli/setup.js.map +0 -1
- package/dist/src/cli/test-gen.d.ts.map +0 -1
- package/dist/src/cli/test-gen.js.map +0 -1
- package/dist/src/cli/triage.d.ts.map +0 -1
- package/dist/src/cli/triage.js.map +0 -1
- package/dist/src/cli/watch.d.ts.map +0 -1
- package/dist/src/cli/watch.js.map +0 -1
- package/dist/src/cli/worker.d.ts.map +0 -1
- package/dist/src/cli/worker.js.map +0 -1
- package/dist/src/core/cache/cached-engine.d.ts.map +0 -1
- package/dist/src/core/cache/cached-engine.js.map +0 -1
- package/dist/src/core/cache/review-cache.d.ts.map +0 -1
- package/dist/src/core/cache/review-cache.js.map +0 -1
- package/dist/src/core/chunking/index.d.ts.map +0 -1
- package/dist/src/core/chunking/index.js.map +0 -1
- package/dist/src/core/chunking/risk-ranker.d.ts.map +0 -1
- package/dist/src/core/chunking/risk-ranker.js.map +0 -1
- package/dist/src/core/config/loader.d.ts.map +0 -1
- package/dist/src/core/config/loader.js.map +0 -1
- package/dist/src/core/config/preset-resolver.d.ts.map +0 -1
- package/dist/src/core/config/preset-resolver.js.map +0 -1
- package/dist/src/core/config/schema.d.ts.map +0 -1
- package/dist/src/core/config/schema.js.map +0 -1
- package/dist/src/core/config/types.d.ts.map +0 -1
- package/dist/src/core/config/types.js.map +0 -1
- package/dist/src/core/council/config.d.ts.map +0 -1
- package/dist/src/core/council/config.js.map +0 -1
- package/dist/src/core/council/context.d.ts.map +0 -1
- package/dist/src/core/council/context.js.map +0 -1
- package/dist/src/core/council/runner.d.ts.map +0 -1
- package/dist/src/core/council/runner.js.map +0 -1
- package/dist/src/core/council/types.d.ts.map +0 -1
- package/dist/src/core/council/types.js.map +0 -1
- package/dist/src/core/detect/git-context.d.ts.map +0 -1
- package/dist/src/core/detect/git-context.js.map +0 -1
- package/dist/src/core/detect/llm-key.d.ts.map +0 -1
- package/dist/src/core/detect/llm-key.js.map +0 -1
- package/dist/src/core/detect/protected-paths.d.ts.map +0 -1
- package/dist/src/core/detect/protected-paths.js.map +0 -1
- package/dist/src/core/detect/provider-usage.d.ts.map +0 -1
- package/dist/src/core/detect/provider-usage.js.map +0 -1
- package/dist/src/core/detect/stack.d.ts.map +0 -1
- package/dist/src/core/detect/stack.js.map +0 -1
- package/dist/src/core/detect/workspaces.d.ts.map +0 -1
- package/dist/src/core/detect/workspaces.js.map +0 -1
- package/dist/src/core/errors.d.ts.map +0 -1
- package/dist/src/core/errors.js.map +0 -1
- package/dist/src/core/findings/dedup.d.ts.map +0 -1
- package/dist/src/core/findings/dedup.js.map +0 -1
- package/dist/src/core/findings/types.d.ts.map +0 -1
- package/dist/src/core/findings/types.js.map +0 -1
- package/dist/src/core/fix/generator.d.ts.map +0 -1
- package/dist/src/core/fix/generator.js.map +0 -1
- package/dist/src/core/git/diff-hunks.d.ts.map +0 -1
- package/dist/src/core/git/diff-hunks.js.map +0 -1
- package/dist/src/core/git/touched-files.d.ts.map +0 -1
- package/dist/src/core/git/touched-files.js.map +0 -1
- package/dist/src/core/ignore/index.d.ts.map +0 -1
- package/dist/src/core/ignore/index.js.map +0 -1
- package/dist/src/core/index.d.ts.map +0 -1
- package/dist/src/core/index.js.map +0 -1
- package/dist/src/core/logging/ndjson-writer.d.ts.map +0 -1
- package/dist/src/core/logging/ndjson-writer.js.map +0 -1
- package/dist/src/core/logging/redaction.d.ts.map +0 -1
- package/dist/src/core/logging/redaction.js.map +0 -1
- package/dist/src/core/mcp/concurrency.d.ts.map +0 -1
- package/dist/src/core/mcp/concurrency.js.map +0 -1
- package/dist/src/core/mcp/handlers/fix-finding.d.ts.map +0 -1
- package/dist/src/core/mcp/handlers/fix-finding.js.map +0 -1
- package/dist/src/core/mcp/handlers/get-capabilities.d.ts.map +0 -1
- package/dist/src/core/mcp/handlers/get-capabilities.js.map +0 -1
- package/dist/src/core/mcp/handlers/get-findings.d.ts.map +0 -1
- package/dist/src/core/mcp/handlers/get-findings.js.map +0 -1
- package/dist/src/core/mcp/handlers/review-diff.d.ts.map +0 -1
- package/dist/src/core/mcp/handlers/review-diff.js.map +0 -1
- package/dist/src/core/mcp/handlers/scan-files.d.ts.map +0 -1
- package/dist/src/core/mcp/handlers/scan-files.js.map +0 -1
- package/dist/src/core/mcp/handlers/validate-fix.d.ts.map +0 -1
- package/dist/src/core/mcp/handlers/validate-fix.js.map +0 -1
- package/dist/src/core/mcp/run-store.d.ts.map +0 -1
- package/dist/src/core/mcp/run-store.js.map +0 -1
- package/dist/src/core/mcp/workspace.d.ts.map +0 -1
- package/dist/src/core/mcp/workspace.js.map +0 -1
- package/dist/src/core/persist/baseline.d.ts.map +0 -1
- package/dist/src/core/persist/baseline.js.map +0 -1
- package/dist/src/core/persist/cost-log.d.ts.map +0 -1
- package/dist/src/core/persist/cost-log.js.map +0 -1
- package/dist/src/core/persist/findings-cache.d.ts.map +0 -1
- package/dist/src/core/persist/findings-cache.js.map +0 -1
- package/dist/src/core/persist/triage.d.ts.map +0 -1
- package/dist/src/core/persist/triage.js.map +0 -1
- package/dist/src/core/phases/static-rules.d.ts.map +0 -1
- package/dist/src/core/phases/static-rules.js.map +0 -1
- package/dist/src/core/phases/tests.d.ts.map +0 -1
- package/dist/src/core/phases/tests.js.map +0 -1
- package/dist/src/core/pipeline/review-phase.d.ts.map +0 -1
- package/dist/src/core/pipeline/review-phase.js.map +0 -1
- package/dist/src/core/pipeline/run.d.ts.map +0 -1
- package/dist/src/core/pipeline/run.js.map +0 -1
- package/dist/src/core/runtime/idempotency.d.ts.map +0 -1
- package/dist/src/core/runtime/idempotency.js.map +0 -1
- package/dist/src/core/runtime/lock.d.ts.map +0 -1
- package/dist/src/core/runtime/lock.js.map +0 -1
- package/dist/src/core/runtime/state.d.ts.map +0 -1
- package/dist/src/core/runtime/state.js.map +0 -1
- package/dist/src/core/schema-alignment/detector.d.ts.map +0 -1
- package/dist/src/core/schema-alignment/detector.js.map +0 -1
- package/dist/src/core/schema-alignment/extractor/index.d.ts.map +0 -1
- package/dist/src/core/schema-alignment/extractor/index.js.map +0 -1
- package/dist/src/core/schema-alignment/extractor/prisma.d.ts.map +0 -1
- package/dist/src/core/schema-alignment/extractor/prisma.js.map +0 -1
- package/dist/src/core/schema-alignment/extractor/sql.d.ts.map +0 -1
- package/dist/src/core/schema-alignment/extractor/sql.js.map +0 -1
- package/dist/src/core/schema-alignment/llm-check.d.ts.map +0 -1
- package/dist/src/core/schema-alignment/llm-check.js.map +0 -1
- package/dist/src/core/schema-alignment/scanner.d.ts.map +0 -1
- package/dist/src/core/schema-alignment/scanner.js.map +0 -1
- package/dist/src/core/schema-alignment/types.d.ts.map +0 -1
- package/dist/src/core/schema-alignment/types.js.map +0 -1
- package/dist/src/core/shell.d.ts.map +0 -1
- package/dist/src/core/shell.js.map +0 -1
- package/dist/src/core/static-rules/registry.d.ts.map +0 -1
- package/dist/src/core/static-rules/registry.js.map +0 -1
- package/dist/src/core/static-rules/rules/brand-tokens.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/brand-tokens.js.map +0 -1
- package/dist/src/core/static-rules/rules/console-log.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/console-log.js.map +0 -1
- package/dist/src/core/static-rules/rules/hardcoded-secrets.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/hardcoded-secrets.js.map +0 -1
- package/dist/src/core/static-rules/rules/insecure-redirect.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/insecure-redirect.js.map +0 -1
- package/dist/src/core/static-rules/rules/large-file.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/large-file.js.map +0 -1
- package/dist/src/core/static-rules/rules/missing-auth.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/missing-auth.js.map +0 -1
- package/dist/src/core/static-rules/rules/missing-tests.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/missing-tests.js.map +0 -1
- package/dist/src/core/static-rules/rules/npm-audit.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/npm-audit.js.map +0 -1
- package/dist/src/core/static-rules/rules/package-lock-sync.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/package-lock-sync.js.map +0 -1
- package/dist/src/core/static-rules/rules/schema-alignment.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/schema-alignment.js.map +0 -1
- package/dist/src/core/static-rules/rules/sql-injection.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/sql-injection.js.map +0 -1
- package/dist/src/core/static-rules/rules/ssrf.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/ssrf.js.map +0 -1
- package/dist/src/core/static-rules/rules/todo-fixme.d.ts.map +0 -1
- package/dist/src/core/static-rules/rules/todo-fixme.js.map +0 -1
- package/dist/src/core/static-rules/tailwind-extractor.d.ts.map +0 -1
- package/dist/src/core/static-rules/tailwind-extractor.js.map +0 -1
- package/dist/src/core/test-gen/coverage-analyzer.d.ts.map +0 -1
- package/dist/src/core/test-gen/coverage-analyzer.js.map +0 -1
- package/dist/src/core/test-gen/framework-detector.d.ts.map +0 -1
- package/dist/src/core/test-gen/framework-detector.js.map +0 -1
- package/dist/src/core/test-gen/test-writer.d.ts.map +0 -1
- package/dist/src/core/test-gen/test-writer.js.map +0 -1
- package/dist/src/core/ui/design-context-loader.d.ts.map +0 -1
- package/dist/src/core/ui/design-context-loader.js.map +0 -1
- package/dist/src/core/worker/client.d.ts.map +0 -1
- package/dist/src/core/worker/client.js.map +0 -1
- package/dist/src/core/worker/lockfile.d.ts.map +0 -1
- package/dist/src/core/worker/lockfile.js.map +0 -1
- package/dist/src/core/worker/server.d.ts.map +0 -1
- package/dist/src/core/worker/server.js.map +0 -1
- package/dist/src/formatters/github-annotations.d.ts.map +0 -1
- package/dist/src/formatters/github-annotations.js.map +0 -1
- package/dist/src/formatters/index.d.ts.map +0 -1
- package/dist/src/formatters/index.js.map +0 -1
- package/dist/src/formatters/junit.d.ts.map +0 -1
- package/dist/src/formatters/junit.js.map +0 -1
- package/dist/src/formatters/sarif.d.ts.map +0 -1
- package/dist/src/formatters/sarif.js.map +0 -1
- package/dist/src/index.d.ts.map +0 -1
- package/dist/src/index.js.map +0 -1
- package/src/adapters/base.ts +0 -19
- package/src/adapters/council/claude.ts +0 -41
- package/src/adapters/council/openai.ts +0 -40
- package/src/adapters/council/types.ts +0 -7
- package/src/adapters/loader.ts +0 -108
- package/src/adapters/migration-runner/supabase.ts +0 -56
- package/src/adapters/migration-runner/types.ts +0 -36
- package/src/adapters/review-bot-parser/cursor.ts +0 -13
- package/src/adapters/review-bot-parser/declarative-base.ts +0 -64
- package/src/adapters/review-bot-parser/types.ts +0 -9
- package/src/adapters/review-engine/auto.ts +0 -94
- package/src/adapters/review-engine/claude.ts +0 -100
- package/src/adapters/review-engine/codex.ts +0 -82
- package/src/adapters/review-engine/gemini.ts +0 -105
- package/src/adapters/review-engine/openai-compatible.ts +0 -100
- package/src/adapters/review-engine/parse-output.ts +0 -74
- package/src/adapters/review-engine/prompt-builder.ts +0 -19
- package/src/adapters/review-engine/types.ts +0 -19
- package/src/adapters/vcs-host/commit-status.ts +0 -39
- package/src/adapters/vcs-host/github.ts +0 -77
- package/src/adapters/vcs-host/types.ts +0 -44
- package/src/cli/_pkg-root.ts +0 -85
- package/src/cli/autoregress-bridge.ts +0 -30
- package/src/cli/baseline.ts +0 -125
- package/src/cli/ci.ts +0 -45
- package/src/cli/costs.ts +0 -80
- package/src/cli/council.ts +0 -96
- package/src/cli/detector.ts +0 -92
- package/src/cli/explain.ts +0 -197
- package/src/cli/fix.ts +0 -249
- package/src/cli/hook.ts +0 -124
- package/src/cli/ignore-helper.ts +0 -116
- package/src/cli/index.ts +0 -612
- package/src/cli/lsp.ts +0 -200
- package/src/cli/mcp.ts +0 -206
- package/src/cli/migrate-v4.ts +0 -388
- package/src/cli/pr-comment.ts +0 -139
- package/src/cli/pr-desc.ts +0 -168
- package/src/cli/pr-review-comments.ts +0 -92
- package/src/cli/pr.ts +0 -76
- package/src/cli/preflight.ts +0 -235
- package/src/cli/report.ts +0 -186
- package/src/cli/run.ts +0 -425
- package/src/cli/scan.ts +0 -233
- package/src/cli/setup.ts +0 -191
- package/src/cli/test-gen.ts +0 -125
- package/src/cli/triage.ts +0 -137
- package/src/cli/watch.ts +0 -190
- package/src/cli/worker.ts +0 -109
- package/src/core/.gitkeep +0 -0
- package/src/core/cache/cached-engine.ts +0 -32
- package/src/core/cache/review-cache.ts +0 -70
- package/src/core/chunking/index.ts +0 -113
- package/src/core/chunking/risk-ranker.ts +0 -56
- package/src/core/config/loader.ts +0 -53
- package/src/core/config/preset-resolver.ts +0 -46
- package/src/core/config/schema.ts +0 -181
- package/src/core/config/types.ts +0 -98
- package/src/core/council/config.ts +0 -71
- package/src/core/council/context.ts +0 -17
- package/src/core/council/runner.ts +0 -83
- package/src/core/council/types.ts +0 -45
- package/src/core/detect/git-context.ts +0 -27
- package/src/core/detect/llm-key.ts +0 -89
- package/src/core/detect/protected-paths.ts +0 -63
- package/src/core/detect/provider-usage.ts +0 -74
- package/src/core/detect/stack.ts +0 -153
- package/src/core/detect/workspaces.ts +0 -103
- package/src/core/errors.ts +0 -37
- package/src/core/findings/dedup.ts +0 -14
- package/src/core/findings/types.ts +0 -39
- package/src/core/fix/generator.ts +0 -149
- package/src/core/git/diff-hunks.ts +0 -86
- package/src/core/git/touched-files.ts +0 -73
- package/src/core/ignore/index.ts +0 -54
- package/src/core/index.ts +0 -1
- package/src/core/logging/ndjson-writer.ts +0 -37
- package/src/core/logging/redaction.ts +0 -19
- package/src/core/mcp/concurrency.ts +0 -16
- package/src/core/mcp/handlers/fix-finding.ts +0 -126
- package/src/core/mcp/handlers/get-capabilities.ts +0 -62
- package/src/core/mcp/handlers/get-findings.ts +0 -36
- package/src/core/mcp/handlers/review-diff.ts +0 -65
- package/src/core/mcp/handlers/scan-files.ts +0 -65
- package/src/core/mcp/handlers/validate-fix.ts +0 -41
- package/src/core/mcp/run-store.ts +0 -85
- package/src/core/mcp/workspace.ts +0 -35
- package/src/core/persist/baseline.ts +0 -112
- package/src/core/persist/cost-log.ts +0 -30
- package/src/core/persist/findings-cache.ts +0 -43
- package/src/core/persist/triage.ts +0 -112
- package/src/core/phases/static-rules.ts +0 -93
- package/src/core/phases/tests.ts +0 -51
- package/src/core/pipeline/review-phase.ts +0 -182
- package/src/core/pipeline/run.ts +0 -116
- package/src/core/runtime/idempotency.ts +0 -6
- package/src/core/runtime/lock.ts +0 -29
- package/src/core/runtime/state.ts +0 -97
- package/src/core/schema-alignment/detector.ts +0 -59
- package/src/core/schema-alignment/extractor/index.ts +0 -24
- package/src/core/schema-alignment/extractor/prisma.ts +0 -21
- package/src/core/schema-alignment/extractor/sql.ts +0 -99
- package/src/core/schema-alignment/llm-check.ts +0 -91
- package/src/core/schema-alignment/scanner.ts +0 -107
- package/src/core/schema-alignment/types.ts +0 -43
- package/src/core/shell.ts +0 -48
- package/src/core/static-rules/registry.ts +0 -59
- package/src/core/static-rules/rules/brand-tokens.ts +0 -145
- package/src/core/static-rules/rules/console-log.ts +0 -42
- package/src/core/static-rules/rules/hardcoded-secrets.ts +0 -83
- package/src/core/static-rules/rules/insecure-redirect.ts +0 -67
- package/src/core/static-rules/rules/large-file.ts +0 -37
- package/src/core/static-rules/rules/missing-auth.ts +0 -70
- package/src/core/static-rules/rules/missing-tests.ts +0 -57
- package/src/core/static-rules/rules/npm-audit.ts +0 -38
- package/src/core/static-rules/rules/package-lock-sync.ts +0 -54
- package/src/core/static-rules/rules/schema-alignment.ts +0 -132
- package/src/core/static-rules/rules/sql-injection.ts +0 -71
- package/src/core/static-rules/rules/ssrf.ts +0 -63
- package/src/core/static-rules/rules/todo-fixme.ts +0 -40
- package/src/core/static-rules/tailwind-extractor.ts +0 -38
- package/src/core/test-gen/coverage-analyzer.ts +0 -93
- package/src/core/test-gen/framework-detector.ts +0 -21
- package/src/core/test-gen/test-writer.ts +0 -33
- package/src/core/ui/design-context-loader.ts +0 -87
- package/src/core/worker/client.ts +0 -46
- package/src/core/worker/lockfile.ts +0 -38
- package/src/core/worker/server.ts +0 -81
- package/src/formatters/github-annotations.ts +0 -36
- package/src/formatters/index.ts +0 -3
- package/src/formatters/junit.ts +0 -52
- package/src/formatters/sarif.ts +0 -103
- package/src/index.ts +0 -3
package/src/cli/worker.ts
DELETED
|
@@ -1,109 +0,0 @@
|
|
|
1
|
-
import { readLock, writeLock, deleteLock, isWorkerAlive } from '../core/worker/lockfile.ts';
|
|
2
|
-
import { stopWorker, getWorkerStatus } from '../core/worker/client.ts';
|
|
3
|
-
import { startWorkerServer } from '../core/worker/server.ts';
|
|
4
|
-
import { loadConfig } from '../core/config/loader.ts';
|
|
5
|
-
import type { ReviewEngine } from '../adapters/review-engine/types.ts';
|
|
6
|
-
import * as path from 'node:path';
|
|
7
|
-
import * as fs from 'node:fs';
|
|
8
|
-
|
|
9
|
-
const C = { reset: '\x1b[0m', green: '\x1b[32m', red: '\x1b[31m', yellow: '\x1b[33m', dim: '\x1b[2m', bold: '\x1b[1m' };
|
|
10
|
-
|
|
11
|
-
export async function runWorker(sub: string | undefined, options: { cwd?: string; configPath?: string } = {}): Promise<number> {
|
|
12
|
-
const cwd = options.cwd ?? process.cwd();
|
|
13
|
-
const configPath = options.configPath ?? path.join(cwd, 'guardrail.config.yaml');
|
|
14
|
-
|
|
15
|
-
switch (sub) {
|
|
16
|
-
case 'start':
|
|
17
|
-
return workerStart(cwd, configPath);
|
|
18
|
-
case 'stop':
|
|
19
|
-
return workerStop(cwd);
|
|
20
|
-
case 'status':
|
|
21
|
-
return workerStatus(cwd);
|
|
22
|
-
default:
|
|
23
|
-
console.error(`${C.red}[worker] Unknown subcommand: "${sub ?? ''}". Use start|stop|status${C.reset}`);
|
|
24
|
-
return 1;
|
|
25
|
-
}
|
|
26
|
-
}
|
|
27
|
-
|
|
28
|
-
async function workerStart(cwd: string, configPath: string): Promise<number> {
|
|
29
|
-
const existing = readLock(cwd);
|
|
30
|
-
if (existing && isWorkerAlive(existing)) {
|
|
31
|
-
console.log(`${C.yellow}[worker] Already running — pid ${existing.pid} port ${existing.port}${C.reset}`);
|
|
32
|
-
return 0;
|
|
33
|
-
}
|
|
34
|
-
|
|
35
|
-
let config = { configVersion: 1 as const };
|
|
36
|
-
if (fs.existsSync(configPath)) {
|
|
37
|
-
const loaded = await loadConfig(configPath);
|
|
38
|
-
if (loaded) config = loaded;
|
|
39
|
-
}
|
|
40
|
-
|
|
41
|
-
// Lazy import to avoid loading review engine at CLI startup
|
|
42
|
-
const { loadAdapter } = await import('../adapters/loader.ts');
|
|
43
|
-
const { runReviewPhase } = await import('../core/pipeline/review-phase.ts');
|
|
44
|
-
|
|
45
|
-
const engineRef = (config as { reviewEngine?: unknown }).reviewEngine;
|
|
46
|
-
const ref = typeof engineRef === 'string' ? engineRef : (engineRef as { adapter?: string })?.adapter ?? 'auto';
|
|
47
|
-
const engineOptions = typeof engineRef === 'object' && engineRef !== null
|
|
48
|
-
? (engineRef as { options?: Record<string, unknown> }).options
|
|
49
|
-
: undefined;
|
|
50
|
-
|
|
51
|
-
const engine = await loadAdapter({
|
|
52
|
-
point: 'review-engine',
|
|
53
|
-
ref,
|
|
54
|
-
options: engineOptions,
|
|
55
|
-
});
|
|
56
|
-
|
|
57
|
-
const server = await startWorkerServer({
|
|
58
|
-
cwd,
|
|
59
|
-
onReview: async (files, cfg) => {
|
|
60
|
-
const result = await runReviewPhase({ touchedFiles: files, config: cfg, engine: engine as unknown as ReviewEngine });
|
|
61
|
-
return { findings: result.findings, usage: result.costUSD !== undefined ? { costUSD: result.costUSD } : undefined };
|
|
62
|
-
},
|
|
63
|
-
});
|
|
64
|
-
|
|
65
|
-
writeLock(cwd, { pid: process.pid, port: server.port, startedAt: new Date().toISOString() });
|
|
66
|
-
|
|
67
|
-
const cleanup = () => { deleteLock(cwd); server.close().then(() => process.exit(0)); };
|
|
68
|
-
process.on('SIGTERM', cleanup);
|
|
69
|
-
process.on('SIGINT', cleanup);
|
|
70
|
-
|
|
71
|
-
console.log(`${C.green}[worker] Started — pid ${process.pid} port ${server.port}${C.reset}`);
|
|
72
|
-
console.log(`${C.dim} guardrail run --use-worker # dispatch review chunks to this worker${C.reset}`);
|
|
73
|
-
|
|
74
|
-
await new Promise(() => {}); // keep alive
|
|
75
|
-
return 0;
|
|
76
|
-
}
|
|
77
|
-
|
|
78
|
-
async function workerStop(cwd: string): Promise<number> {
|
|
79
|
-
const lock = readLock(cwd);
|
|
80
|
-
if (!lock) { console.log('[worker] No worker running'); return 0; }
|
|
81
|
-
if (!isWorkerAlive(lock)) { deleteLock(cwd); console.log('[worker] Stale lockfile removed'); return 0; }
|
|
82
|
-
await stopWorker(lock);
|
|
83
|
-
// Give it 3s to exit, then SIGTERM
|
|
84
|
-
await new Promise(r => setTimeout(r, 1000));
|
|
85
|
-
if (isWorkerAlive(lock)) {
|
|
86
|
-
try { process.kill(lock.pid, 'SIGTERM'); } catch { /* already dead */ }
|
|
87
|
-
}
|
|
88
|
-
deleteLock(cwd);
|
|
89
|
-
console.log(`${C.green}[worker] Stopped${C.reset}`);
|
|
90
|
-
return 0;
|
|
91
|
-
}
|
|
92
|
-
|
|
93
|
-
async function workerStatus(cwd: string): Promise<number> {
|
|
94
|
-
const lock = readLock(cwd);
|
|
95
|
-
if (!lock) { console.log('[worker] Not running'); return 1; }
|
|
96
|
-
if (!isWorkerAlive(lock)) { console.log(`[worker] Dead (stale lock — pid ${lock.pid})`); return 1; }
|
|
97
|
-
try {
|
|
98
|
-
const status = await getWorkerStatus(lock);
|
|
99
|
-
console.log(`[worker] Running`);
|
|
100
|
-
console.log(` pid: ${status.pid}`);
|
|
101
|
-
console.log(` port: ${status.port}`);
|
|
102
|
-
console.log(` jobs processed: ${status.jobsProcessed}`);
|
|
103
|
-
console.log(` uptime: ${Math.round(status.uptimeMs / 1000)}s`);
|
|
104
|
-
return 0;
|
|
105
|
-
} catch {
|
|
106
|
-
console.log(`[worker] Running (pid ${lock.pid} port ${lock.port}) — status endpoint unreachable`);
|
|
107
|
-
return 0;
|
|
108
|
-
}
|
|
109
|
-
}
|
package/src/core/.gitkeep
DELETED
|
File without changes
|
|
@@ -1,32 +0,0 @@
|
|
|
1
|
-
import type { ReviewEngine, ReviewInput, ReviewOutput } from '../../adapters/review-engine/types.ts';
|
|
2
|
-
import type { Capabilities } from '../../adapters/base.ts';
|
|
3
|
-
import { ReviewCache, type ReviewCacheOptions } from './review-cache.ts';
|
|
4
|
-
|
|
5
|
-
/**
|
|
6
|
-
* Wraps any ReviewEngine with file-based response caching.
|
|
7
|
-
* Cache key = SHA-256(adapterName + model + content).
|
|
8
|
-
*/
|
|
9
|
-
export function withCache(engine: ReviewEngine, options: ReviewCacheOptions = {}): ReviewEngine {
|
|
10
|
-
const cache = new ReviewCache(options);
|
|
11
|
-
const model = (engine as { model?: string }).model ?? engine.name;
|
|
12
|
-
|
|
13
|
-
return {
|
|
14
|
-
name: engine.name,
|
|
15
|
-
apiVersion: engine.apiVersion,
|
|
16
|
-
getCapabilities(): Capabilities {
|
|
17
|
-
return engine.getCapabilities();
|
|
18
|
-
},
|
|
19
|
-
estimateTokens(content: string): number {
|
|
20
|
-
return engine.estimateTokens(content);
|
|
21
|
-
},
|
|
22
|
-
async review(input: ReviewInput): Promise<ReviewOutput> {
|
|
23
|
-
const keyPayload = `${input.content}\x00${input.kind}\x00${input.context?.stack ?? ''}`;
|
|
24
|
-
const key = ReviewCache.keyFor(engine.name, model, keyPayload);
|
|
25
|
-
const cached = await cache.get(key);
|
|
26
|
-
if (cached) return { ...cached, usage: cached.usage ? { ...cached.usage, costUSD: 0 } : undefined };
|
|
27
|
-
const output = await engine.review(input);
|
|
28
|
-
await cache.set(key, output);
|
|
29
|
-
return output;
|
|
30
|
-
},
|
|
31
|
-
};
|
|
32
|
-
}
|
|
@@ -1,70 +0,0 @@
|
|
|
1
|
-
import * as fs from 'node:fs/promises';
|
|
2
|
-
import * as os from 'node:os';
|
|
3
|
-
import * as path from 'node:path';
|
|
4
|
-
import { createHash } from 'node:crypto';
|
|
5
|
-
import type { ReviewOutput } from '../../adapters/review-engine/types.ts';
|
|
6
|
-
|
|
7
|
-
export interface CacheEntry {
|
|
8
|
-
key: string;
|
|
9
|
-
output: ReviewOutput;
|
|
10
|
-
createdAt: string;
|
|
11
|
-
expiresAt: string;
|
|
12
|
-
}
|
|
13
|
-
|
|
14
|
-
export interface ReviewCacheOptions {
|
|
15
|
-
cacheDir?: string;
|
|
16
|
-
ttlMs?: number;
|
|
17
|
-
}
|
|
18
|
-
|
|
19
|
-
const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000; // 24h
|
|
20
|
-
// Prefer env override, then ~/.guardrail-cache to survive across cwd changes and container restarts
|
|
21
|
-
const DEFAULT_CACHE_DIR = process.env.AUTOPILOT_CACHE_DIR
|
|
22
|
-
? path.join(process.env.AUTOPILOT_CACHE_DIR, 'reviews')
|
|
23
|
-
: path.join(os.homedir(), '.guardrail-cache', 'reviews');
|
|
24
|
-
|
|
25
|
-
export class ReviewCache {
|
|
26
|
-
private readonly cacheDir: string;
|
|
27
|
-
private readonly ttlMs: number;
|
|
28
|
-
|
|
29
|
-
constructor(options: ReviewCacheOptions = {}) {
|
|
30
|
-
this.cacheDir = options.cacheDir ?? DEFAULT_CACHE_DIR;
|
|
31
|
-
this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
static keyFor(adapterName: string, model: string, content: string): string {
|
|
35
|
-
return createHash('sha256').update(`${adapterName}:${model}:${content}`).digest('hex');
|
|
36
|
-
}
|
|
37
|
-
|
|
38
|
-
async get(key: string): Promise<ReviewOutput | undefined> {
|
|
39
|
-
const filePath = this.entryPath(key);
|
|
40
|
-
try {
|
|
41
|
-
const raw = await fs.readFile(filePath, 'utf8');
|
|
42
|
-
const entry: CacheEntry = JSON.parse(raw);
|
|
43
|
-
if (new Date(entry.expiresAt) < new Date()) {
|
|
44
|
-
await fs.unlink(filePath).catch(() => undefined);
|
|
45
|
-
return undefined;
|
|
46
|
-
}
|
|
47
|
-
return entry.output;
|
|
48
|
-
} catch {
|
|
49
|
-
return undefined;
|
|
50
|
-
}
|
|
51
|
-
}
|
|
52
|
-
|
|
53
|
-
async set(key: string, output: ReviewOutput): Promise<void> {
|
|
54
|
-
await fs.mkdir(this.cacheDir, { recursive: true });
|
|
55
|
-
const entry: CacheEntry = {
|
|
56
|
-
key,
|
|
57
|
-
output,
|
|
58
|
-
createdAt: new Date().toISOString(),
|
|
59
|
-
expiresAt: new Date(Date.now() + this.ttlMs).toISOString(),
|
|
60
|
-
};
|
|
61
|
-
const filePath = this.entryPath(key);
|
|
62
|
-
const tmp = `${filePath}.tmp`;
|
|
63
|
-
await fs.writeFile(tmp, JSON.stringify(entry), 'utf8');
|
|
64
|
-
await fs.rename(tmp, filePath);
|
|
65
|
-
}
|
|
66
|
-
|
|
67
|
-
private entryPath(key: string): string {
|
|
68
|
-
return path.join(this.cacheDir, `${key}.json`);
|
|
69
|
-
}
|
|
70
|
-
}
|
|
@@ -1,113 +0,0 @@
|
|
|
1
|
-
import * as fs from 'node:fs/promises';
|
|
2
|
-
import * as path from 'node:path';
|
|
3
|
-
import type { ReviewEngine, ReviewInput } from '../../adapters/review-engine/types.ts';
|
|
4
|
-
import type { GuardrailConfig } from '../config/types.ts';
|
|
5
|
-
import { rankByRisk } from './risk-ranker.ts';
|
|
6
|
-
import { getFileDiffs, formatDiffContent } from '../git/diff-hunks.ts';
|
|
7
|
-
|
|
8
|
-
export interface ReviewChunk {
|
|
9
|
-
content: string;
|
|
10
|
-
kind: ReviewInput['kind'];
|
|
11
|
-
files: string[];
|
|
12
|
-
}
|
|
13
|
-
|
|
14
|
-
export interface BuildChunksInput {
|
|
15
|
-
touchedFiles: string[];
|
|
16
|
-
strategy: 'auto' | 'single-pass' | 'file-level' | 'diff' | 'auto-diff';
|
|
17
|
-
chunking?: GuardrailConfig['chunking'];
|
|
18
|
-
engine: ReviewEngine;
|
|
19
|
-
cwd?: string;
|
|
20
|
-
protectedPaths?: string[];
|
|
21
|
-
base?: string; // git base ref — required for 'diff'/'auto-diff' strategy
|
|
22
|
-
}
|
|
23
|
-
|
|
24
|
-
const DEFAULT_SMALL_TIER_TOKENS = 8000;
|
|
25
|
-
const DEFAULT_FILE_TIER_TOKENS = 60000;
|
|
26
|
-
|
|
27
|
-
export async function buildReviewChunks(input: BuildChunksInput): Promise<ReviewChunk[]> {
|
|
28
|
-
const smallMax = input.chunking?.smallTierMaxTokens ?? DEFAULT_SMALL_TIER_TOKENS;
|
|
29
|
-
const fileMax = input.chunking?.perFileMaxTokens ?? DEFAULT_FILE_TIER_TOKENS;
|
|
30
|
-
|
|
31
|
-
// Diff strategy: send unified diff hunks instead of full file contents
|
|
32
|
-
if (input.strategy === 'diff') {
|
|
33
|
-
return buildDiffChunks(input);
|
|
34
|
-
}
|
|
35
|
-
|
|
36
|
-
// auto-diff: try diff first; fall back to full-file auto if diff is empty
|
|
37
|
-
// (handles new files, initial commits, or repos with no base ref)
|
|
38
|
-
if (input.strategy === 'auto-diff') {
|
|
39
|
-
const diffChunks = buildDiffChunks(input);
|
|
40
|
-
if (diffChunks.length > 0) return diffChunks;
|
|
41
|
-
// fall through to auto with full files
|
|
42
|
-
}
|
|
43
|
-
|
|
44
|
-
const ranked = rankByRisk(input.touchedFiles, { protectedPaths: input.protectedPaths });
|
|
45
|
-
const fileContents = await readFiles(ranked, input.cwd);
|
|
46
|
-
|
|
47
|
-
if (input.strategy === 'single-pass') {
|
|
48
|
-
const combined = formatBatch(fileContents);
|
|
49
|
-
return [{ content: combined, kind: 'file-batch', files: [...fileContents.keys()] }];
|
|
50
|
-
}
|
|
51
|
-
|
|
52
|
-
if (input.strategy === 'auto') {
|
|
53
|
-
const combined = formatBatch(fileContents);
|
|
54
|
-
if (input.engine.estimateTokens(combined) <= smallMax) {
|
|
55
|
-
return [{ content: combined, kind: 'file-batch', files: [...fileContents.keys()] }];
|
|
56
|
-
}
|
|
57
|
-
// fall through to file-level
|
|
58
|
-
}
|
|
59
|
-
|
|
60
|
-
// file-level: one chunk per readable file, truncated to fileMax tokens
|
|
61
|
-
const chunks: ReviewChunk[] = [];
|
|
62
|
-
for (const [filePath, content] of fileContents) {
|
|
63
|
-
const truncated = truncateToTokens(content, fileMax, input.engine);
|
|
64
|
-
chunks.push({ content: `// File: ${filePath}\n${truncated}`, kind: 'file-batch', files: [filePath] });
|
|
65
|
-
}
|
|
66
|
-
return chunks;
|
|
67
|
-
}
|
|
68
|
-
|
|
69
|
-
function buildDiffChunks(input: BuildChunksInput): ReviewChunk[] {
|
|
70
|
-
const cwd = input.cwd ?? process.cwd();
|
|
71
|
-
const base = input.base ?? 'HEAD~1';
|
|
72
|
-
const ranked = rankByRisk(input.touchedFiles, { protectedPaths: input.protectedPaths });
|
|
73
|
-
const diffs = getFileDiffs(cwd, base, ranked);
|
|
74
|
-
|
|
75
|
-
if (diffs.length === 0) return [];
|
|
76
|
-
|
|
77
|
-
// Single chunk — diff content is already compact; truncation handled in formatDiffContent
|
|
78
|
-
const content = formatDiffContent(diffs);
|
|
79
|
-
return [{ content, kind: 'file-batch', files: diffs.map(d => d.file) }];
|
|
80
|
-
}
|
|
81
|
-
|
|
82
|
-
async function readFiles(touchedFiles: string[], cwd?: string): Promise<Map<string, string>> {
|
|
83
|
-
const result = new Map<string, string>();
|
|
84
|
-
for (const f of touchedFiles) {
|
|
85
|
-
const resolved = cwd ? path.resolve(cwd, f) : path.resolve(f);
|
|
86
|
-
try {
|
|
87
|
-
result.set(f, await fs.readFile(resolved, 'utf8'));
|
|
88
|
-
} catch {
|
|
89
|
-
// deleted or unreadable — skip silently
|
|
90
|
-
}
|
|
91
|
-
}
|
|
92
|
-
return result;
|
|
93
|
-
}
|
|
94
|
-
|
|
95
|
-
function formatBatch(fileContents: Map<string, string>): string {
|
|
96
|
-
const parts: string[] = [];
|
|
97
|
-
for (const [filePath, content] of fileContents) {
|
|
98
|
-
parts.push(`// File: ${filePath}\n${content}`);
|
|
99
|
-
}
|
|
100
|
-
return parts.join('\n\n---\n\n');
|
|
101
|
-
}
|
|
102
|
-
|
|
103
|
-
function truncateToTokens(content: string, maxTokens: number, engine: ReviewEngine): string {
|
|
104
|
-
if (engine.estimateTokens(content) <= maxTokens) return content;
|
|
105
|
-
let lo = 0;
|
|
106
|
-
let hi = content.length;
|
|
107
|
-
while (hi - lo > 128) {
|
|
108
|
-
const mid = (lo + hi) >> 1;
|
|
109
|
-
if (engine.estimateTokens(content.slice(0, mid)) <= maxTokens) lo = mid;
|
|
110
|
-
else hi = mid;
|
|
111
|
-
}
|
|
112
|
-
return content.slice(0, lo) + '\n// [truncated]';
|
|
113
|
-
}
|
|
@@ -1,56 +0,0 @@
|
|
|
1
|
-
import { minimatch } from 'minimatch';
|
|
2
|
-
|
|
3
|
-
interface RankOptions {
|
|
4
|
-
protectedPaths?: string[];
|
|
5
|
-
}
|
|
6
|
-
|
|
7
|
-
const AUTH_PATTERNS = [
|
|
8
|
-
/auth/i, /login/i, /logout/i, /session/i, /token/i, /jwt/i, /oauth/i,
|
|
9
|
-
/password/i, /credential/i, /secret/i, /permission/i, /role/i, /acl/i,
|
|
10
|
-
];
|
|
11
|
-
|
|
12
|
-
const PAYMENT_PATTERNS = [
|
|
13
|
-
/payment/i, /billing/i, /stripe/i, /checkout/i, /invoice/i, /charge/i,
|
|
14
|
-
/subscription/i, /wallet/i, /transaction/i, /refund/i,
|
|
15
|
-
];
|
|
16
|
-
|
|
17
|
-
const CORE_PATTERNS = [
|
|
18
|
-
/\/services\//i, /\/core\//i, /\/api\//i, /\/routes?\//i,
|
|
19
|
-
/\/controllers?\//i, /\/models?\//i, /\/middleware\//i, /\/handlers?\//i,
|
|
20
|
-
];
|
|
21
|
-
|
|
22
|
-
const TEST_EXT = /\.(test|spec)\.[a-z]+$/i;
|
|
23
|
-
const DOC_EXT = /\.(md|txt|rst|adoc)$/i;
|
|
24
|
-
const CONFIG_EXT = /\.(ya?ml|json|toml|ini|env)$/i;
|
|
25
|
-
const CONFIG_NAMES = /(config|settings|env|constants)\./i;
|
|
26
|
-
|
|
27
|
-
function scoreFile(file: string, protectedPaths: string[]): number {
|
|
28
|
-
const norm = file.replace(/\\/g, '/');
|
|
29
|
-
|
|
30
|
-
// Protected paths are highest risk
|
|
31
|
-
for (const pattern of protectedPaths) {
|
|
32
|
-
if (minimatch(norm, pattern, { matchBase: false }) ||
|
|
33
|
-
minimatch(norm, pattern, { matchBase: true })) {
|
|
34
|
-
return 100;
|
|
35
|
-
}
|
|
36
|
-
}
|
|
37
|
-
|
|
38
|
-
if (TEST_EXT.test(norm)) return 10;
|
|
39
|
-
if (DOC_EXT.test(norm)) return 5;
|
|
40
|
-
|
|
41
|
-
if (AUTH_PATTERNS.some(p => p.test(norm))) return 80;
|
|
42
|
-
if (PAYMENT_PATTERNS.some(p => p.test(norm))) return 70;
|
|
43
|
-
if (CORE_PATTERNS.some(p => p.test(norm))) return 50;
|
|
44
|
-
if (CONFIG_EXT.test(norm) || CONFIG_NAMES.test(norm)) return 40;
|
|
45
|
-
|
|
46
|
-
return 30;
|
|
47
|
-
}
|
|
48
|
-
|
|
49
|
-
/**
|
|
50
|
-
* Returns files sorted highest-risk first so LLM sees the most sensitive code
|
|
51
|
-
* at the start of its context window.
|
|
52
|
-
*/
|
|
53
|
-
export function rankByRisk(files: string[], options: RankOptions = {}): string[] {
|
|
54
|
-
const protectedPaths = options.protectedPaths ?? [];
|
|
55
|
-
return [...files].sort((a, b) => scoreFile(b, protectedPaths) - scoreFile(a, protectedPaths));
|
|
56
|
-
}
|
|
@@ -1,53 +0,0 @@
|
|
|
1
|
-
import * as fs from 'node:fs/promises';
|
|
2
|
-
import * as yaml from 'js-yaml';
|
|
3
|
-
import Ajv from 'ajv';
|
|
4
|
-
import { GuardrailError } from '../errors.ts';
|
|
5
|
-
import type { GuardrailConfig } from './types.ts';
|
|
6
|
-
import { GUARDRAIL_CONFIG_SCHEMA } from './schema.ts';
|
|
7
|
-
|
|
8
|
-
const ajv = new Ajv({ allErrors: true, strict: false });
|
|
9
|
-
const validate = ajv.compile(GUARDRAIL_CONFIG_SCHEMA);
|
|
10
|
-
|
|
11
|
-
export async function loadConfig(path: string): Promise<GuardrailConfig> {
|
|
12
|
-
let content: string;
|
|
13
|
-
try {
|
|
14
|
-
content = await fs.readFile(path, 'utf8');
|
|
15
|
-
} catch (err) {
|
|
16
|
-
throw new GuardrailError(`Config file not found: ${path}`, {
|
|
17
|
-
code: 'user_input',
|
|
18
|
-
details: { path, cause: err instanceof Error ? err.message : String(err) },
|
|
19
|
-
});
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
let parsed: unknown;
|
|
23
|
-
try {
|
|
24
|
-
parsed = yaml.load(content);
|
|
25
|
-
} catch (err) {
|
|
26
|
-
throw new GuardrailError(`Invalid YAML in ${path}`, {
|
|
27
|
-
code: 'invalid_config',
|
|
28
|
-
details: { path, cause: err instanceof Error ? err.message : String(err) },
|
|
29
|
-
});
|
|
30
|
-
}
|
|
31
|
-
|
|
32
|
-
if (!validate(parsed)) {
|
|
33
|
-
const errors = (validate.errors ?? []).map(e => {
|
|
34
|
-
const loc = e.instancePath ? e.instancePath.replace(/^\//, '').replace(/\//g, '.') : '<root>';
|
|
35
|
-
// enum errors: list allowed values
|
|
36
|
-
if (e.keyword === 'enum' && Array.isArray(e.params?.allowedValues)) {
|
|
37
|
-
return `${loc}: must be one of ${(e.params.allowedValues as unknown[]).map(v => JSON.stringify(v)).join(', ')}`;
|
|
38
|
-
}
|
|
39
|
-
// additionalProperties: name the unexpected key
|
|
40
|
-
if (e.keyword === 'additionalProperties' && e.params?.additionalProperty) {
|
|
41
|
-
return `${loc}: unexpected key "${e.params.additionalProperty as string}"`;
|
|
42
|
-
}
|
|
43
|
-
return `${loc}: ${e.message ?? 'invalid'}`;
|
|
44
|
-
});
|
|
45
|
-
const summary = errors.slice(0, 5).join('\n ');
|
|
46
|
-
throw new GuardrailError(
|
|
47
|
-
`guardrail.config.yaml is invalid:\n ${summary}${errors.length > 5 ? `\n …and ${errors.length - 5} more` : ''}`,
|
|
48
|
-
{ code: 'invalid_config', details: { path, errors } },
|
|
49
|
-
);
|
|
50
|
-
}
|
|
51
|
-
|
|
52
|
-
return parsed as GuardrailConfig;
|
|
53
|
-
}
|
|
@@ -1,46 +0,0 @@
|
|
|
1
|
-
import * as fs from 'node:fs/promises';
|
|
2
|
-
import * as path from 'node:path';
|
|
3
|
-
import { loadConfig } from './loader.ts';
|
|
4
|
-
import { GuardrailError } from '../errors.ts';
|
|
5
|
-
import type { GuardrailConfig } from './types.ts';
|
|
6
|
-
|
|
7
|
-
const PRESET_ROOT = path.resolve(process.cwd(), 'presets');
|
|
8
|
-
|
|
9
|
-
export interface ResolvedPreset {
|
|
10
|
-
name: string;
|
|
11
|
-
config: GuardrailConfig;
|
|
12
|
-
stack: string;
|
|
13
|
-
}
|
|
14
|
-
|
|
15
|
-
export async function resolvePreset(name: string): Promise<ResolvedPreset> {
|
|
16
|
-
const presetDir = path.join(PRESET_ROOT, name);
|
|
17
|
-
try {
|
|
18
|
-
await fs.stat(presetDir);
|
|
19
|
-
} catch {
|
|
20
|
-
throw new GuardrailError(`Preset not found: ${name}`, {
|
|
21
|
-
code: 'invalid_config',
|
|
22
|
-
details: { name, presetDir },
|
|
23
|
-
});
|
|
24
|
-
}
|
|
25
|
-
|
|
26
|
-
const config = await loadConfig(path.join(presetDir, 'guardrail.config.yaml'));
|
|
27
|
-
let stack = '';
|
|
28
|
-
try {
|
|
29
|
-
stack = await fs.readFile(path.join(presetDir, 'stack.md'), 'utf8');
|
|
30
|
-
} catch {
|
|
31
|
-
stack = config.stack ?? '';
|
|
32
|
-
}
|
|
33
|
-
return { name, config, stack };
|
|
34
|
-
}
|
|
35
|
-
|
|
36
|
-
export function mergeConfigs(preset: GuardrailConfig, user: GuardrailConfig): GuardrailConfig {
|
|
37
|
-
return {
|
|
38
|
-
...preset,
|
|
39
|
-
...user,
|
|
40
|
-
// Arrays are concatenated (preset values first) so user additions don't discard preset invariants
|
|
41
|
-
protectedPaths: [...(preset.protectedPaths ?? []), ...(user.protectedPaths ?? [])],
|
|
42
|
-
staticRules: [...(preset.staticRules ?? []), ...(user.staticRules ?? [])],
|
|
43
|
-
thresholds: { ...preset.thresholds, ...user.thresholds },
|
|
44
|
-
chunking: { ...preset.chunking, ...user.chunking },
|
|
45
|
-
};
|
|
46
|
-
}
|
|
@@ -1,181 +0,0 @@
|
|
|
1
|
-
export const GUARDRAIL_CONFIG_SCHEMA = {
|
|
2
|
-
$schema: 'http://json-schema.org/draft-07/schema#',
|
|
3
|
-
type: 'object',
|
|
4
|
-
required: ['configVersion'],
|
|
5
|
-
additionalProperties: false,
|
|
6
|
-
properties: {
|
|
7
|
-
configVersion: { const: 1 },
|
|
8
|
-
preset: { type: 'string' },
|
|
9
|
-
reviewEngine: { $ref: '#/definitions/adapterRef' },
|
|
10
|
-
vcsHost: { $ref: '#/definitions/adapterRef' },
|
|
11
|
-
migrationRunner: { $ref: '#/definitions/adapterRef' },
|
|
12
|
-
reviewBot: { $ref: '#/definitions/adapterRef' },
|
|
13
|
-
adapterAllowlist: { type: 'array', items: { type: 'string' } },
|
|
14
|
-
protectedPaths: { type: 'array', items: { type: 'string' } },
|
|
15
|
-
staticRules: {
|
|
16
|
-
type: 'array',
|
|
17
|
-
items: {
|
|
18
|
-
oneOf: [
|
|
19
|
-
{ type: 'string' },
|
|
20
|
-
{ type: 'object', required: ['adapter'], properties: { adapter: { type: 'string' }, options: { type: 'object' } } },
|
|
21
|
-
],
|
|
22
|
-
},
|
|
23
|
-
},
|
|
24
|
-
staticRulesParallel: { type: 'boolean' },
|
|
25
|
-
stack: { type: 'string' },
|
|
26
|
-
testCommand: { type: ['string', 'null'] },
|
|
27
|
-
thresholds: {
|
|
28
|
-
type: 'object',
|
|
29
|
-
properties: {
|
|
30
|
-
bugbotAutoFix: { type: 'number' },
|
|
31
|
-
bugbotProposePatch: { type: 'number' },
|
|
32
|
-
maxValidateRetries: { type: 'number' },
|
|
33
|
-
maxCodexRetries: { type: 'number' },
|
|
34
|
-
maxBugbotRounds: { type: 'number' },
|
|
35
|
-
},
|
|
36
|
-
additionalProperties: false,
|
|
37
|
-
},
|
|
38
|
-
ignore: {
|
|
39
|
-
type: 'array',
|
|
40
|
-
items: {
|
|
41
|
-
oneOf: [
|
|
42
|
-
{ type: 'string' },
|
|
43
|
-
{
|
|
44
|
-
type: 'object',
|
|
45
|
-
required: ['path'],
|
|
46
|
-
properties: {
|
|
47
|
-
rule: { type: 'string' },
|
|
48
|
-
path: { type: 'string' },
|
|
49
|
-
},
|
|
50
|
-
additionalProperties: false,
|
|
51
|
-
},
|
|
52
|
-
],
|
|
53
|
-
},
|
|
54
|
-
},
|
|
55
|
-
reviewStrategy: { enum: ['auto', 'single-pass', 'file-level', 'diff', 'auto-diff'] },
|
|
56
|
-
chunking: {
|
|
57
|
-
type: 'object',
|
|
58
|
-
properties: {
|
|
59
|
-
smallTierMaxTokens: { type: 'number' },
|
|
60
|
-
partialReviewTokens: { type: 'number' },
|
|
61
|
-
perFileMaxTokens: { type: 'number' },
|
|
62
|
-
parallelism: { type: 'number' },
|
|
63
|
-
rateLimitBackoff: { enum: ['exp', 'linear', 'none'] },
|
|
64
|
-
},
|
|
65
|
-
additionalProperties: false,
|
|
66
|
-
},
|
|
67
|
-
policy: {
|
|
68
|
-
type: 'object',
|
|
69
|
-
properties: {
|
|
70
|
-
failOn: { enum: ['critical', 'warning', 'note', 'none'] },
|
|
71
|
-
newOnly: { type: 'boolean' },
|
|
72
|
-
baselinePath: { type: 'string' },
|
|
73
|
-
},
|
|
74
|
-
additionalProperties: false,
|
|
75
|
-
},
|
|
76
|
-
pipeline: {
|
|
77
|
-
type: 'object',
|
|
78
|
-
properties: {
|
|
79
|
-
runReviewOnStaticFail: { type: 'boolean' },
|
|
80
|
-
runReviewOnTestFail: { type: 'boolean' },
|
|
81
|
-
},
|
|
82
|
-
additionalProperties: false,
|
|
83
|
-
},
|
|
84
|
-
cost: {
|
|
85
|
-
type: 'object',
|
|
86
|
-
properties: {
|
|
87
|
-
maxPerRun: { type: 'number' },
|
|
88
|
-
estimateBeforeRun: { type: 'boolean' },
|
|
89
|
-
pricing: { type: 'object' },
|
|
90
|
-
},
|
|
91
|
-
additionalProperties: false,
|
|
92
|
-
},
|
|
93
|
-
brand: {
|
|
94
|
-
type: 'object',
|
|
95
|
-
properties: {
|
|
96
|
-
colorsFrom: { type: 'string' },
|
|
97
|
-
colors: { type: 'array', items: { type: 'string' } },
|
|
98
|
-
fonts: { type: 'array', items: { type: 'string' } },
|
|
99
|
-
componentLibrary: {
|
|
100
|
-
oneOf: [
|
|
101
|
-
{ type: 'string' },
|
|
102
|
-
{
|
|
103
|
-
type: 'object',
|
|
104
|
-
properties: {
|
|
105
|
-
tokens: { type: 'string' },
|
|
106
|
-
guide: { type: 'string' },
|
|
107
|
-
},
|
|
108
|
-
additionalProperties: false,
|
|
109
|
-
},
|
|
110
|
-
],
|
|
111
|
-
},
|
|
112
|
-
},
|
|
113
|
-
additionalProperties: false,
|
|
114
|
-
},
|
|
115
|
-
'schema-alignment': {
|
|
116
|
-
type: 'object',
|
|
117
|
-
properties: {
|
|
118
|
-
enabled: { type: 'boolean' },
|
|
119
|
-
migrationGlobs: { type: 'array', items: { type: 'string', minLength: 1 } },
|
|
120
|
-
layerRoots: {
|
|
121
|
-
type: 'object',
|
|
122
|
-
properties: {
|
|
123
|
-
types: { type: 'array', items: { type: 'string' }, minItems: 1 },
|
|
124
|
-
api: { type: 'array', items: { type: 'string' }, minItems: 1 },
|
|
125
|
-
ui: { type: 'array', items: { type: 'string' }, minItems: 1 },
|
|
126
|
-
},
|
|
127
|
-
additionalProperties: false,
|
|
128
|
-
},
|
|
129
|
-
llmCheck: { type: 'boolean' },
|
|
130
|
-
severity: { enum: ['warning', 'error'] },
|
|
131
|
-
},
|
|
132
|
-
additionalProperties: false,
|
|
133
|
-
},
|
|
134
|
-
cache: { type: 'object' },
|
|
135
|
-
persistence: { type: 'object' },
|
|
136
|
-
concurrency: { type: 'object' },
|
|
137
|
-
council: {
|
|
138
|
-
type: 'object',
|
|
139
|
-
required: ['models', 'synthesizer'],
|
|
140
|
-
additionalProperties: false,
|
|
141
|
-
properties: {
|
|
142
|
-
models: {
|
|
143
|
-
type: 'array',
|
|
144
|
-
minItems: 2,
|
|
145
|
-
items: {
|
|
146
|
-
type: 'object',
|
|
147
|
-
required: ['adapter', 'model', 'label'],
|
|
148
|
-
additionalProperties: false,
|
|
149
|
-
properties: {
|
|
150
|
-
adapter: { type: 'string' },
|
|
151
|
-
model: { type: 'string' },
|
|
152
|
-
label: { type: 'string' },
|
|
153
|
-
},
|
|
154
|
-
},
|
|
155
|
-
},
|
|
156
|
-
synthesizer: {
|
|
157
|
-
type: 'object',
|
|
158
|
-
required: ['adapter', 'model', 'label'],
|
|
159
|
-
additionalProperties: false,
|
|
160
|
-
properties: {
|
|
161
|
-
adapter: { type: 'string' },
|
|
162
|
-
model: { type: 'string' },
|
|
163
|
-
label: { type: 'string' },
|
|
164
|
-
},
|
|
165
|
-
},
|
|
166
|
-
timeout_ms: { type: 'number' },
|
|
167
|
-
min_successful_responses: { type: 'number' },
|
|
168
|
-
parallel_input_max_tokens: { type: 'number' },
|
|
169
|
-
synthesis_input_max_tokens: { type: 'number' },
|
|
170
|
-
},
|
|
171
|
-
},
|
|
172
|
-
},
|
|
173
|
-
definitions: {
|
|
174
|
-
adapterRef: {
|
|
175
|
-
oneOf: [
|
|
176
|
-
{ type: 'string' },
|
|
177
|
-
{ type: 'object', required: ['adapter'], properties: { adapter: { type: 'string' }, options: { type: 'object' } } },
|
|
178
|
-
],
|
|
179
|
-
},
|
|
180
|
-
},
|
|
181
|
-
} as const;
|