@dependabit/detector 0.1.2 → 0.1.14

package/src/detector.ts

@@ -31,6 +31,8 @@ export interface DetectorOptions {
   llmProvider: LLMProvider;
   ignorePatterns?: string[];
   useGitExcludes?: boolean;
+  repoOwner?: string;
+  repoName?: string;
 }
 
 export interface DetectionResult {
@@ -46,20 +48,13 @@ export interface DetectionResult {
 
 const DEFAULT_IGNORE_PATTERNS = [
   'node_modules',
-  '.git',
-  '.github',
-  '.claude',
-  '.codex',
   'dist',
   'build',
   'target',
   'vendor',
-  '.venv',
   'venv',
   '__pycache__',
-  'coverage',
-  '.next',
-  '.nuxt'
+  'coverage'
 ];
 
 /**
@@ -69,13 +64,25 @@ export class Detector {
   private options: Required<DetectorOptions>;
   private ignoreMatcher: Ignore | null = null;
   private ignoreMatcherLoaded = false;
+  private skipUrlPatterns: RegExp[];
 
   constructor(options: DetectorOptions) {
     this.options = {
       ...options,
       ignorePatterns: options.ignorePatterns || DEFAULT_IGNORE_PATTERNS,
-      useGitExcludes: options.useGitExcludes ?? true
+      useGitExcludes: options.useGitExcludes ?? true,
+      repoOwner: options.repoOwner || '',
+      repoName: options.repoName || ''
     };
+
+    this.skipUrlPatterns = [
+      /example\.com/,
+      /example\.org/,
+      /localhost/,
+      /127\.0\.0\.1/,
+      /\[.*\]/, // template placeholders like [NUMBER]
+      /github\.com\/user\/repo/ // common placeholder in docs
+    ];
   }
 
   /**
@@ -232,6 +239,8 @@ Return as JSON with "dependencies" array.`;
     const now = new Date().toISOString();
 
     for (const [url, data] of allReferences) {
+      // Skip entries that will end up with low confidence
+      // (entries that can't be typed programmatically and LLM assigns low confidence)
       // Prepare context for potential LLM use
       const context = data.contexts
         .map((c) => `${c.file}${c.line ? `:${c.line}` : ''}: ${c.text}`)
@@ -269,6 +278,11 @@ Return as JSON with "dependencies" array.`;
         typeConfidence = 0.3;
       }
 
+      // Skip low-confidence entries
+      if (typeConfidence < 0.5) {
+        continue;
+      }
+
       // Step 5: Try programmatic access method determination
       let accessMethod: AccessMethod | null = this.determineAccessMethod(url);
 
@@ -364,6 +378,27 @@ Return as JSON: {"accessMethod": "...", "confidence": 0.0-1.0}`;
     context: { file: string; line?: number; text: string },
     detectionMethod: DetectionMethod
   ): void {
+    // Skip URLs that don't start with http:// or https://
+    if (!/^https?:\/\//.test(url)) {
+      return;
+    }
+
+    // Skip URLs matching skip patterns (placeholders, localhost, etc.)
+    if (this.skipUrlPatterns.some((pattern) => pattern.test(url))) {
+      return;
+    }
+
+    // Skip self-references (URLs pointing to the repo itself)
+    if (this.options.repoOwner && this.options.repoName) {
+      const selfPattern = new RegExp(
+        `github\\.com[/:]${this.escapeRegExp(this.options.repoOwner)}/${this.escapeRegExp(this.options.repoName)}(?:/|$|#|\\?)`,
+        'i'
+      );
+      if (selfPattern.test(url)) {
+        return;
+      }
+    }
+
     if (!map.has(url)) {
       map.set(url, {
         url,
@@ -374,6 +409,10 @@ Return as JSON: {"accessMethod": "...", "confidence": 0.0-1.0}`;
     map.get(url)!.contexts.push(context);
   }
 
+  private escapeRegExp(str: string): string {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  }
+
   /**
    * Programmatically determine access method based on URL patterns
    * Returns null if cannot be determined programmatically
@@ -526,7 +565,7 @@ Return as JSON: {"accessMethod": "...", "confidence": 0.0-1.0}`;
           files.push(fullPath);
         }
       }
-    } catch  {
+    } catch {
       // Ignore errors (permission denied, etc.)
     }
 

package/src/llm/copilot.ts

@@ -3,7 +3,7 @@
  * Integrates with GitHub Copilot via CLI commands
  */
 
-import { exec } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import type {
   LLMProvider,
@@ -15,7 +15,7 @@ import type {
 } from './client.js';
 import { SYSTEM_PROMPT } from './prompts.js';
 
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 export class GitHubCopilotProvider implements LLMProvider {
   private config: Required<LLMProviderConfig>;
@@ -44,14 +44,17 @@ export class GitHubCopilotProvider implements LLMProvider {
       // Combine system prompt and user prompt for CLI
       const fullPrompt = `${SYSTEM_PROMPT}\n\n${prompt}`;
 
-      // Escape the prompt for shell safety (basic escaping)
-      const escapedPrompt = fullPrompt.replace(/"/g, '\\"').replace(/\$/g, '\\$');
-
-      // Use gh copilot suggest command to get AI response
-      // The --yes flag auto-accepts the suggestion, --shell-out returns raw output
-      const command = `echo "${escapedPrompt}" | gh copilot suggest --yes 2>&1`;
-
-      const { stdout, stderr } = await execAsync(command, {
+      // Use execFile to avoid shell escaping issues and command injection
+      // Pass prompt directly as an argument without manual escaping
+      const args = [
+        'copilot',
+        '-p',
+        fullPrompt,
+        '--silent',
+        '--allow-all-tools'
+      ];
+
+      const { stdout, stderr } = await execFileAsync('gh', args, {
         maxBuffer: 10 * 1024 * 1024, // 10MB buffer for large responses
         timeout: 60000 // 60 second timeout
       });

package/src/llm/prompts.ts

@@ -17,11 +17,20 @@ INCLUDE these types of dependencies:
 
 EXCLUDE these (handled by dependabot):
 - NPM packages in package.json
-- Python packages in requirements.txt  
+- Python packages in requirements.txt
 - Rust crates in Cargo.toml
 - Docker images in Dockerfile
 - Any declared package manager dependencies
 
+ALSO EXCLUDE (false positives):
+- URLs that reference the repository itself (self-references)
+- Relative file paths (e.g., CONTRIBUTING.md, docs/guide.md, ./src/utils)
+- Placeholder URLs used in documentation examples (example.com, example.org, localhost)
+- Internal documentation links within the same repository
+- URLs with template variables or placeholders (e.g., issues/[NUMBER], user/repo)
+
+Only return dependencies with confidence >= 0.7.
+
 For each dependency found, provide:
 1. url: The complete URL
 2. name: A descriptive name

package/src/parsers/readme.ts

@@ -10,7 +10,7 @@ export interface ExtractedReference {
   type: 'markdown-link' | 'bare-url' | 'reference-link';
 }
 
-// Patterns to skip (package managers, CI badges, shields.io)
+// Patterns to skip (package managers, CI badges, shields.io, placeholders)
 const SKIP_PATTERNS = [
   /npmjs\.com\/package/,
   /pypi\.org\/project/,
@@ -21,7 +21,13 @@ const SKIP_PATTERNS = [
   /badge(s)?\..*\.svg/,
   /travis-ci\.(org|com)/,
   /circleci\.com/,
-  /github\.com\/.*\/actions/ // GitHub Actions badges
+  /github\.com\/.*\/actions/, // GitHub Actions badges
+  /example\.com/, // placeholder domain
+  /example\.org/, // placeholder domain
+  /localhost/, // local dev URLs
+  /127\.0\.0\.1/, // loopback address
+  /\[.*\]/, // template placeholders (e.g., issues/[NUMBER])
+  /github\.com\/user\/repo/ // common placeholder in docs
 ];
 
 /**

package/test/llm/copilot.test.ts

@@ -1,55 +1,334 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { promisify } from 'node:util';
+import { GitHubCopilotProvider } from '../../src/llm/copilot.js';
+import type { DetectedDependency } from '../../src/llm/client.js';
+
+// Mock child_process with proper execFile behavior
+vi.mock('node:child_process', () => {
+  const mockCallback = vi.fn();
+  
+  // The custom promisify implementation that mimics Node.js behavior
+  const customPromisify = vi.fn((...execArgs) => {
+    return new Promise((resolve, reject) => {
+      // Call the mock with a callback that converts to { stdout, stderr }
+      mockCallback(...execArgs, (err: Error | null, stdout: string, stderr: string) => {
+        if (err) {
+          const error = err as NodeJS.ErrnoException & { stdout?: string; stderr?: string };
+          error.stdout = stdout;
+          error.stderr = stderr;
+          reject(error);
+        } else {
+          resolve({ stdout, stderr });
+        }
+      });
+    });
+  });
+  
+  mockCallback[promisify.custom] = customPromisify;
+  
+  return {
+    execFile: mockCallback
+  };
+});
+
+import { execFile } from 'node:child_process';
+const mockExecFileCallback = vi.mocked(execFile);
 
 describe('GitHubCopilotProvider', () => {
+  let provider: GitHubCopilotProvider;
+
   beforeEach(() => {
     vi.clearAllMocks();
+    provider = new GitHubCopilotProvider();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
   });
 
-  describe('constructor', () => {
-    it('should initialize with API configuration', () => {
-      expect(true).toBe(true);
+  describe('CLI invocation', () => {
+    it('should use execFile with correct command and flags', async () => {
+      const mockResponse = JSON.stringify({ dependencies: [] });
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          // Use correct callback signature: callback(error, stdout, stderr)
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      await provider.analyze('test content', 'test prompt');
+
+      expect(mockExecFileCallback).toHaveBeenCalledWith(
+        'gh',
+        expect.arrayContaining([
+          'copilot',
+          '-p',
+          expect.any(String),
+          '--silent',
+          '--allow-all-tools'
+        ]),
+        expect.objectContaining({
+          maxBuffer: 10 * 1024 * 1024,
+          timeout: 60000
+        }),
+        expect.any(Function)
+      );
+    });
+
+    it('should pass prompt directly without shell escaping', async () => {
+      const mockResponse = JSON.stringify({ dependencies: [] });
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      const promptWithSpecialChars = 'test "quotes" $dollar `backtick`';
+      await provider.analyze('content', promptWithSpecialChars);
+
+      const callArgs = mockExecFileCallback.mock.calls[0];
+      const args = callArgs?.[1] as string[];
+      const fullPrompt = args?.[2];
+
+      // Verify prompt contains special characters unescaped
+      expect(fullPrompt).toContain('test "quotes" $dollar `backtick`');
     });
 
-    it('should use environment variable for API key', () => {
-      expect(true).toBe(true);
+    it('should handle prompts with newlines', async () => {
+      const mockResponse = JSON.stringify({ dependencies: [] });
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      const promptWithNewlines = 'line1\nline2\nline3';
+      await provider.analyze('content', promptWithNewlines);
+
+      const callArgs = mockExecFileCallback.mock.calls[0];
+      const args = callArgs?.[1] as string[];
+      const fullPrompt = args?.[2];
+
+      expect(fullPrompt).toContain('line1\nline2\nline3');
+    });
+
+    it('should handle prompts ending with backslash', async () => {
+      const mockResponse = JSON.stringify({ dependencies: [] });
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      const promptWithBackslash = 'path\\to\\file\\';
+      await provider.analyze('content', promptWithBackslash);
+
+      const callArgs = mockExecFileCallback.mock.calls[0];
+      const args = callArgs?.[1] as string[];
+      const fullPrompt = args?.[2];
+
+      expect(fullPrompt).toContain('path\\to\\file\\');
     });
   });
 
-  describe('analyze', () => {
-    it('should call Azure OpenAI API with correct parameters', async () => {
-      expect(true).toBe(true);
+  describe('response parsing', () => {
+    it('should parse JSON response correctly', async () => {
+      const mockDeps: DetectedDependency[] = [
+        {
+          name: 'test-package',
+          version: '1.0.0',
+          type: 'npm',
+          confidence: 0.9,
+          context: 'test context'
+        }
+      ];
+      const mockResponse = JSON.stringify({ dependencies: mockDeps });
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
+
+      expect(result.dependencies).toEqual(mockDeps);
     });
 
-    it('should parse LLM response into structured dependencies', async () => {
-      expect(true).toBe(true);
+    it('should parse JSON wrapped in markdown code blocks', async () => {
+      const mockDeps: DetectedDependency[] = [
+        {
+          name: 'test-package',
+          version: '1.0.0',
+          type: 'npm',
+          confidence: 0.9,
+          context: 'test context'
+        }
+      ];
+      const mockResponse = '```json\n' + JSON.stringify({ dependencies: mockDeps }) + '\n```';
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
+
+      expect(result.dependencies).toEqual(mockDeps);
     });
 
-    it('should include confidence scores for each detection', async () => {
-      expect(true).toBe(true);
+    it('should handle malformed JSON gracefully', async () => {
+      const mockResponse = 'not valid json';
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
+
+      expect(result.dependencies).toEqual([]);
     });
 
-    it('should handle API errors gracefully', async () => {
-      expect(true).toBe(true);
+    it('should return empty dependencies on empty response', async () => {
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, '', '');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
+
+      expect(result.dependencies).toEqual([]);
     });
+  });
+
+  describe('error handling', () => {
+    it('should handle CLI execution errors', async () => {
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(new Error('CLI error'), '', 'Error message');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
 
-    it('should respect rate limits', async () => {
-      expect(true).toBe(true);
+      expect(result.dependencies).toEqual([]);
+      expect(result.rawResponse).toContain('CLI error');
     });
 
-    it('should log request/response metadata', async () => {
-      expect(true).toBe(true);
+    it('should handle stderr without stdout as error', async () => {
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, '', 'Authentication failed');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
+
+      expect(result.dependencies).toEqual([]);
+    });
+
+    it('should handle timeout errors', async () => {
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          const error = new Error('Command timeout') as NodeJS.ErrnoException;
+          error.code = 'ETIMEDOUT';
+          callback(error, '', '');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
+
+      expect(result.dependencies).toEqual([]);
+    });
+
+    it('should handle buffer overflow errors', async () => {
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          const error = new Error('maxBuffer exceeded') as NodeJS.ErrnoException;
+          error.code = 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER';
+          callback(error, '', '');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
+
+      expect(result.dependencies).toEqual([]);
+    });
+  });
+
+  describe('usage metadata', () => {
+    it('should include usage metadata in response', async () => {
+      const mockResponse = JSON.stringify({ dependencies: [] });
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      const result = await provider.analyze('content', 'prompt');
+
+      expect(result.usage).toBeDefined();
+      expect(result.usage.promptTokens).toBeGreaterThan(0);
+      expect(result.usage.completionTokens).toBeGreaterThan(0);
+      expect(result.usage.totalTokens).toBeGreaterThan(0);
+      expect(result.usage.latencyMs).toBeGreaterThanOrEqual(0);
+    });
+
+    it('should use configured model in usage metadata', async () => {
+      const mockResponse = JSON.stringify({ dependencies: [] });
+      mockExecFileCallback.mockImplementation((file, args, options, callback) => {
+        if (typeof callback === 'function') {
+          callback(null, mockResponse, '');
+        }
+        return {} as any;
+      });
+
+      const customProvider = new GitHubCopilotProvider({ model: 'gpt-4-turbo' });
+      const result = await customProvider.analyze('content', 'prompt');
+
+      expect(result.usage.model).toBe('gpt-4-turbo');
     });
   });
 
   describe('getSupportedModels', () => {
-    it('should return available GPT models', () => {
-      expect(true).toBe(true);
+    it('should return list of supported models', () => {
+      const models = provider.getSupportedModels();
+
+      expect(models).toBeInstanceOf(Array);
+      expect(models.length).toBeGreaterThan(0);
+      expect(models).toContain('github-copilot');
     });
   });
 
   describe('getRateLimit', () => {
-    it('should return current rate limit status', () => {
-      expect(true).toBe(true);
+    it('should return rate limit info', async () => {
+      const rateLimit = await provider.getRateLimit();
+
+      expect(rateLimit).toBeDefined();
+      expect(rateLimit.remaining).toBe(-1);
+      expect(rateLimit.limit).toBe(-1);
+    });
+  });
+
+  describe('validateConfig', () => {
+    it('should validate configuration', () => {
+      const isValid = provider.validateConfig();
+
+      expect(typeof isValid).toBe('boolean');
     });
   });
 });