@grafema/core 0.1.0-alpha.5 → 0.2.0-beta

package/src/plugins/validation/SQLInjectionValidator.ts

@@ -104,18 +104,21 @@ export class SQLInjectionValidator extends Plugin {
       phase: 'VALIDATION',
       priority: 90, // After ValueDomainAnalyzer (65)
       creates: {
-        nodes: [],
-        edges: []
+        nodes: ['issue:security'],
+        edges: ['AFFECTS']
       }
     };
   }
 
   async execute(context: PluginContext): Promise<PluginResult> {
     const { graph } = context;
+    const logger = this.log(context);
 
-    console.log('[SQLInjectionValidator] Checking for SQL injection vulnerabilities...');
+    logger.info('Starting SQL injection vulnerability check');
 
     const issues: SQLInjectionIssue[] = [];
+    let issueNodeCount = 0;
+    let affectsEdgeCount = 0;
 
     // 1. Find all CALL nodes that look like SQL queries
     const sqlCalls: CallNode[] = [];
@@ -127,13 +130,13 @@ export class SQLInjectionValidator extends Plugin {
       }
     }
 
-    console.log(`[SQLInjectionValidator] Found ${sqlCalls.length} potential SQL calls`);
+    logger.debug('SQL calls collected', { count: sqlCalls.length });
 
     // 2. For each SQL call, analyze the query argument
     for (const call of sqlCalls) {
       const result = await this.analyzeQueryCall(call, graph);
       if (result.isVulnerable) {
-        issues.push({
+        const issue: SQLInjectionIssue = {
           type: 'SQL_INJECTION',
           severity: 'ERROR',
           message: `Potential SQL injection at ${call.file}:${call.line || '?'} - ${result.reason}`,
@@ -142,37 +145,79 @@ export class SQLInjectionValidator extends Plugin {
           line: call.line as number | undefined,
           reason: result.reason!,
           nondeterministicSources: result.sources
-        });
+        };
+        issues.push(issue);
+
+        // Persist issue to graph if reportIssue is available
+        if (context.reportIssue) {
+          await context.reportIssue({
+            category: 'security',
+            severity: 'error',
+            message: issue.message,
+            file: call.file || '',
+            line: call.line || 0,
+            column: call.column || 0,
+            targetNodeId: call.id,
+            context: {
+              type: 'SQL_INJECTION',
+              reason: result.reason,
+              nondeterministicSources: result.sources
+            }
+          });
+          issueNodeCount++;
+          affectsEdgeCount++;
+        }
       }
     }
 
     // 3. Also check via graph pattern - CALL nodes that have ARGUMENT -> PARAMETER paths
-    const patternViolations = await this.checkViaGraphPattern(graph, sqlCalls);
+    const patternViolations = await this.checkViaGraphPattern(graph, logger, sqlCalls);
     for (const violation of patternViolations) {
       // Avoid duplicates
       if (!issues.find(i => i.nodeId === violation.nodeId)) {
         issues.push(violation);
+
+        // Persist issue to graph if reportIssue is available
+        if (context.reportIssue) {
+          await context.reportIssue({
+            category: 'security',
+            severity: 'error',
+            message: violation.message,
+            file: violation.file || '',
+            line: violation.line || 0,
+            targetNodeId: violation.nodeId,
+            context: {
+              type: 'SQL_INJECTION',
+              reason: violation.reason,
+              nondeterministicSources: violation.nondeterministicSources
+            }
+          });
+          issueNodeCount++;
+          affectsEdgeCount++;
+        }
       }
     }
 
     const summary = {
       sqlCallsChecked: sqlCalls.length,
-      vulnerabilitiesFound: issues.length
+      vulnerabilitiesFound: issues.length,
+      issueNodesCreated: issueNodeCount,
+      affectsEdgesCreated: affectsEdgeCount
     };
 
-    console.log('[SQLInjectionValidator] Summary:', summary);
+    logger.info('Validation complete', summary);
 
     if (issues.length > 0) {
-      console.log('[SQLInjectionValidator] ❌ SQL injection vulnerabilities found:');
+      logger.warn('SQL injection vulnerabilities found', { count: issues.length });
       for (const issue of issues) {
-        console.log(`  🚫 ${issue.message}`);
+        logger.warn(issue.message);
       }
     } else {
-      console.log('[SQLInjectionValidator] ✅ No SQL injection vulnerabilities detected');
+      logger.info('No SQL injection vulnerabilities detected');
     }
 
     return createSuccessResult(
-      { nodes: 0, edges: 0 },
+      { nodes: issueNodeCount, edges: affectsEdgeCount },
       { summary, issues }
     );
   }
@@ -192,9 +237,7 @@ export class SQLInjectionValidator extends Plugin {
 
     // Check if this call has PASSES_ARGUMENT edges
     const outgoing = await graph.getOutgoingEdges(call.id) as unknown as EdgeRecord[];
-    const argEdges = outgoing.filter(e =>
-      (e.edgeType || e.edge_type) === 'PASSES_ARGUMENT'
-    );
+    const argEdges = outgoing.filter(e => e.type === 'PASSES_ARGUMENT');
 
     if (argEdges.length === 0) {
       // No tracked arguments - check via queryArgName attribute if available
@@ -272,8 +315,7 @@ export class SQLInjectionValidator extends Plugin {
     // Check DERIVES_FROM edges
     const outgoing = await graph.getOutgoingEdges(exprNode.id) as unknown as EdgeRecord[];
     const derivesFromEdges = outgoing.filter(e =>
-      (e.edgeType || e.edge_type) === 'DERIVES_FROM' ||
-      (e.edgeType || e.edge_type) === 'ASSIGNED_FROM'
+      e.type === 'DERIVES_FROM' || e.type === 'ASSIGNED_FROM'
     );
 
     for (const edge of derivesFromEdges) {
@@ -307,6 +349,7 @@ export class SQLInjectionValidator extends Plugin {
    */
   private async checkViaGraphPattern(
     graph: PluginContext['graph'],
+    logger: ReturnType<typeof this.log>,
     excludeCalls: CallNode[] = []
   ): Promise<SQLInjectionIssue[]> {
     const issues: SQLInjectionIssue[] = [];
@@ -316,7 +359,7 @@ export class SQLInjectionValidator extends Plugin {
     try {
       // Check if graph supports checkGuarantee
       if (!graph.checkGuarantee) {
-        console.log('[SQLInjectionValidator] Graph does not support checkGuarantee, skipping pattern-based check');
+        logger.debug('Graph does not support checkGuarantee, skipping pattern-based check');
         return issues;
       }
 
@@ -353,7 +396,7 @@ export class SQLInjectionValidator extends Plugin {
       }
     } catch (err) {
       // Datalog query might fail if backend doesn't support it
-      console.log('[SQLInjectionValidator] Datalog check skipped:', (err as Error).message);
+      logger.debug('Datalog check skipped', { error: (err as Error).message });
     }
 
     return issues;

package/src/plugins/validation/ShadowingDetector.ts

@@ -70,8 +70,9 @@ export class ShadowingDetector extends Plugin {
 
   async execute(context: PluginContext): Promise<PluginResult> {
     const { graph } = context;
+    const logger = this.log(context);
 
-    console.log('[ShadowingDetector] Checking for variable shadowing...');
+    logger.info('Starting variable shadowing detection');
 
     const issues: ShadowingIssue[] = [];
 
@@ -154,15 +155,15 @@ export class ShadowingDetector extends Plugin {
       totalIssues: issues.length
     };
 
-    console.log('[ShadowingDetector] Summary:', summary);
+    logger.info('Detection complete', { ...summary });
 
     if (issues.length > 0) {
-      console.log('[ShadowingDetector] Shadowing issues found:');
+      logger.warn('Shadowing issues found', { count: issues.length });
       for (const issue of issues) {
-        console.log(`  ${issue.type === 'CROSS_FILE_SHADOW' ? '📁' : '🔒'} ${issue.message}`);
+        logger.warn(issue.message, { type: issue.type });
       }
     } else {
-      console.log('[ShadowingDetector] No shadowing issues detected');
+      logger.info('No shadowing issues detected');
     }
 
     return createSuccessResult(

package/src/plugins/validation/TypeScriptDeadCodeValidator.ts

@@ -58,14 +58,15 @@ export class TypeScriptDeadCodeValidator extends Plugin {
 
   async execute(context: PluginContext): Promise<PluginResult> {
     const { graph } = context;
+    const logger = this.log(context);
 
-    console.log('[TypeScriptDeadCodeValidator] Checking for dead TypeScript code...');
+    logger.info('Starting TypeScript dead code analysis');
     const startTime = Date.now();
 
     const issues: DeadCodeIssue[] = [];
 
     // Collect all interfaces
-    console.log('[TypeScriptDeadCodeValidator] Collecting interfaces...');
+    logger.debug('Collecting interfaces');
     const interfaces: Map<string, { id: string; name: string; file?: string; line?: number; properties?: unknown[] }> = new Map();
 
     for await (const node of graph.queryNodes({ nodeType: 'INTERFACE' })) {
@@ -80,10 +81,10 @@ export class TypeScriptDeadCodeValidator extends Plugin {
         properties: (node as { properties?: unknown[] }).properties
       });
     }
-    console.log(`[TypeScriptDeadCodeValidator] Found ${interfaces.size} interfaces`);
+    logger.debug('Interfaces collected', { count: interfaces.size });
 
     // Find interfaces with IMPLEMENTS or EXTENDS edges
-    console.log('[TypeScriptDeadCodeValidator] Checking implementations...');
+    logger.debug('Checking implementations');
     const implementedInterfaces: Map<string, number> = new Map();
 
     // Get all edges and filter by type (no queryEdges in GraphBackend yet)
@@ -168,31 +169,31 @@ export class TypeScriptDeadCodeValidator extends Plugin {
       timeSeconds: totalTime
     };
 
-    console.log('[TypeScriptDeadCodeValidator] Summary:', summary);
+    logger.info('Analysis complete', { ...summary });
 
     // Report issues
     const warnings = issues.filter(i => i.severity === 'WARNING');
     const infos = issues.filter(i => i.severity === 'INFO');
 
     if (warnings.length > 0) {
-      console.log(`[TypeScriptDeadCodeValidator] ⚠️  ${warnings.length} warning(s):`);
+      logger.warn('Warnings found', { count: warnings.length });
       for (const issue of warnings) {
-        console.log(`  ⚠️  ${issue.message}`);
+        logger.warn(issue.message);
       }
     }
 
     if (infos.length > 0) {
-      console.log(`[TypeScriptDeadCodeValidator] ℹ️  ${infos.length} info(s):`);
+      logger.info('Info messages', { count: infos.length });
       for (const issue of infos.slice(0, 5)) { // Limit to first 5
-        console.log(`  ℹ️  ${issue.message}`);
+        logger.info(issue.message);
       }
       if (infos.length > 5) {
-        console.log(`  ... and ${infos.length - 5} more`);
+        logger.debug(`... and ${infos.length - 5} more`);
       }
     }
 
     if (issues.length === 0) {
-      console.log('[TypeScriptDeadCodeValidator] ✅ No dead TypeScript code detected');
+      logger.info('No dead TypeScript code detected');
     }
 
     return createSuccessResult(

package/src/plugins/vcs/GitPlugin.ts

@@ -7,6 +7,7 @@
 
 import { VCSPlugin, FileStatus } from './VCSPlugin.js';
 import type { VCSConfig, VCSPluginMetadata, ChangedFile, FileDiff, DiffHunk } from './VCSPlugin.js';
+import { FileAccessError } from '../../errors/GrafemaError.js';
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { join } from 'path';
@@ -113,8 +114,12 @@ export class GitPlugin extends VCSPlugin {
 
       return files;
     } catch (error) {
-      console.error('[GitPlugin] Failed to get changed files:', (error as Error).message);
-      return [];
+      throw new FileAccessError(
+        `Failed to get changed files: ${(error as Error).message}`,
+        'ERR_GIT_ACCESS_DENIED',
+        { plugin: 'GitPlugin' },
+        'Check that git is installed and this is a valid git repository'
+      );
     }
   }
 
@@ -152,8 +157,12 @@ export class GitPlugin extends VCSPlugin {
       // Парсим unified diff
       return this._parseUnifiedDiff(filePath, stdout);
     } catch (error) {
-      console.error(`[GitPlugin] Failed to get diff for ${filePath}:`, (error as Error).message);
-      return { path: filePath, hunks: [] };
+      throw new FileAccessError(
+        `Failed to get diff for ${filePath}: ${(error as Error).message}`,
+        'ERR_GIT_ACCESS_DENIED',
+        { plugin: 'GitPlugin', filePath },
+        'Ensure the file is tracked by git and the working directory is accessible'
+      );
     }
   }
 
@@ -164,8 +173,13 @@ export class GitPlugin extends VCSPlugin {
     try {
       const { stdout } = await this._exec('git rev-parse --abbrev-ref HEAD');
       return stdout.trim();
-    } catch {
-      return 'unknown';
+    } catch (error) {
+      throw new FileAccessError(
+        `Failed to get current branch: ${(error as Error).message}`,
+        'ERR_GIT_ACCESS_DENIED',
+        { plugin: 'GitPlugin' },
+        'Ensure this is a valid git repository with at least one commit'
+      );
     }
   }
 
@@ -176,8 +190,13 @@ export class GitPlugin extends VCSPlugin {
     try {
       const { stdout } = await this._exec('git rev-parse HEAD');
       return stdout.trim();
-    } catch {
-      return null;
+    } catch (error) {
+      throw new FileAccessError(
+        `Failed to get last commit hash: ${(error as Error).message}`,
+        'ERR_GIT_NOT_FOUND',
+        { plugin: 'GitPlugin' },
+        'Ensure this is a valid git repository with at least one commit'
+      );
     }
   }
 
@@ -309,8 +328,12 @@ export class GitPlugin extends VCSPlugin {
       const { stdout } = await this._exec('git ls-files');
       return stdout.trim().split('\n').filter(line => line.length > 0);
     } catch (error) {
-      console.error('[GitPlugin] Failed to get tracked files:', (error as Error).message);
-      return [];
+      throw new FileAccessError(
+        `Failed to get tracked files: ${(error as Error).message}`,
+        'ERR_GIT_ACCESS_DENIED',
+        { plugin: 'GitPlugin' },
+        'Check that git is installed and this is a valid git repository'
+      );
     }
   }
 
@@ -329,8 +352,13 @@ export class GitPlugin extends VCSPlugin {
         timestamp: parseInt(lines[3]) * 1000,
         message: lines[4]
       };
-    } catch {
-      return null;
+    } catch (error) {
+      throw new FileAccessError(
+        `Failed to get last commit info: ${(error as Error).message}`,
+        'ERR_GIT_NOT_FOUND',
+        { plugin: 'GitPlugin' },
+        'Ensure this is a valid git repository with at least one commit'
+      );
     }
   }
 

package/src/plugins/vcs/VCSPlugin.ts

@@ -12,6 +12,8 @@
  * - Perforce
  */
 
+import type { Logger } from '../../logging/Logger.js';
+
 /**
  * VCS Plugin configuration
  */
@@ -154,13 +156,13 @@ export class VCSPluginFactory {
   /**
    * Автоматически определить и создать подходящий VCS плагин
    */
-  static async detect(config: VCSConfig = {}): Promise<VCSPlugin | null> {
+  static async detect(config: VCSConfig = {}, logger?: Logger): Promise<VCSPlugin | null> {
     for (const PluginClass of this.availablePlugins) {
       const plugin = new PluginClass(config);
 
       try {
         if (await plugin.isAvailable()) {
-          console.log(`[VCS] Detected ${plugin.metadata.name}`);
+          logger?.info('VCS detected', { name: plugin.metadata.name });
           return plugin;
         }
       } catch {
@@ -168,20 +170,20 @@ export class VCSPluginFactory {
       }
     }
 
-    console.warn('[VCS] No VCS system detected');
+    logger?.warn('No VCS system detected');
     return null;
   }
 
   /**
    * Создать плагин по имени
    */
-  static create(name: string, config: VCSConfig = {}): VCSPlugin | null {
+  static create(name: string, config: VCSConfig = {}, logger?: Logger): VCSPlugin | null {
     const PluginClass = this.availablePlugins.find(
       Plugin => new Plugin(config).metadata.name === name
     );
 
     if (!PluginClass) {
-      console.error(`[VCS] Plugin "${name}" not found`);
+      logger?.error('VCS plugin not found', { name });
       return null;
     }
 

package/src/queries/README.md

@@ -0,0 +1,46 @@
+# Graph Query Utilities
+
+## Graph Structure
+
+### Function Containment
+
+```
+FUNCTION -[HAS_SCOPE]-> SCOPE (function_body)
+                        SCOPE -[CONTAINS]-> SCOPE (nested blocks: if, for, etc.)
+                        SCOPE -[CONTAINS]-> CALL (function call)
+                        SCOPE -[CONTAINS]-> METHOD_CALL (method call)
+                        SCOPE -[DECLARES]-> VARIABLE
+```
+
+**Key Points:**
+- FUNCTION nodes do NOT have CONTAINS edges directly
+- FUNCTION has exactly one HAS_SCOPE edge to its body SCOPE
+- All content (calls, variables, nested scopes) is inside SCOPEs
+- Nested functions have their own HAS_SCOPE -> SCOPE hierarchy
+- Variables are connected via DECLARES (not CONTAINS)
+
+### Call Resolution
+
+```
+CALL/METHOD_CALL -[CALLS]-> FUNCTION (target)
+```
+
+- CALLS edge exists only if target function was resolved
+- Resolved = we found the function definition in the graph
+- Unresolved = external function, dynamic call, or import issue
+
+### Backward Traversal (finding container)
+
+To find the function containing a CALL:
+
+```
+CALL <- CONTAINS <- SCOPE <- CONTAINS <- SCOPE <- HAS_SCOPE <- FUNCTION
+```
+
+To find the function containing a VARIABLE:
+
+```
+VARIABLE <- DECLARES <- SCOPE <- CONTAINS <- SCOPE <- HAS_SCOPE <- FUNCTION
+```
+
+Walk up via CONTAINS, DECLARES, and HAS_SCOPE edges.

package/src/queries/findCallsInFunction.ts

@@ -0,0 +1,206 @@
+/**
+ * Find all CALL and METHOD_CALL nodes inside a function.
+ *
+ * Graph structure:
+ * ```
+ * FUNCTION -[HAS_SCOPE]-> SCOPE -[CONTAINS]-> CALL
+ *                         SCOPE -[CONTAINS]-> METHOD_CALL
+ *                         SCOPE -[CONTAINS]-> SCOPE (nested blocks)
+ * ```
+ *
+ * Algorithm:
+ * 1. Get function's scope via HAS_SCOPE edge
+ * 2. BFS through CONTAINS edges, collecting CALL and METHOD_CALL nodes
+ * 3. Stop at nested FUNCTION/CLASS boundaries (don't enter inner functions)
+ * 4. For each call, check CALLS edge to determine if resolved
+ * 5. If transitive=true, recursively follow resolved CALLS edges
+ *
+ * Performance: O(S + C) where S = scopes, C = calls
+ * For functions with 100 calls, expect ~200 DB operations.
+ *
+ * @module queries/findCallsInFunction
+ */
+
+import type { CallInfo, FindCallsOptions } from './types.js';
+
+/**
+ * Graph backend interface (minimal surface)
+ */
+interface GraphBackend {
+  getNode(id: string): Promise<{
+    id: string;
+    type: string;
+    name: string;
+    file?: string;
+    line?: number;
+    object?: string;
+  } | null>;
+  getOutgoingEdges(
+    nodeId: string,
+    edgeTypes: string[] | null
+  ): Promise<Array<{ src: string; dst: string; type: string }>>;
+}
+
+/**
+ * Find all CALL and METHOD_CALL nodes inside a function.
+ *
+ * @param backend - Graph backend for queries
+ * @param functionId - ID of the FUNCTION node
+ * @param options - Options for traversal
+ * @returns Array of CallInfo objects
+ */
+export async function findCallsInFunction(
+  backend: GraphBackend,
+  functionId: string,
+  options: FindCallsOptions = {}
+): Promise<CallInfo[]> {
+  const {
+    maxDepth = 10,
+    transitive = false,
+    transitiveDepth = 5,
+  } = options;
+
+  const calls: CallInfo[] = [];
+  const visited = new Set<string>();
+  const seenTargets = new Set<string>(); // For deduplication in transitive mode
+
+  // Add the starting function to seenTargets to prevent cycles back to it
+  if (transitive) {
+    seenTargets.add(functionId);
+  }
+
+  // Step 1: Get function's scope via HAS_SCOPE
+  const hasScopeEdges = await backend.getOutgoingEdges(functionId, ['HAS_SCOPE']);
+
+  // BFS queue: { nodeId, currentDepth }
+  const queue: Array<{ id: string; depth: number }> = [];
+
+  for (const edge of hasScopeEdges) {
+    queue.push({ id: edge.dst, depth: 0 });
+  }
+
+  // Step 2: BFS through scopes
+  while (queue.length > 0) {
+    const { id, depth } = queue.shift()!;
+
+    if (visited.has(id) || depth > maxDepth) continue;
+    visited.add(id);
+
+    const containsEdges = await backend.getOutgoingEdges(id, ['CONTAINS']);
+
+    for (const edge of containsEdges) {
+      const child = await backend.getNode(edge.dst);
+      if (!child) continue;
+
+      // Collect CALL and METHOD_CALL nodes
+      if (child.type === 'CALL' || child.type === 'METHOD_CALL') {
+        const callInfo = await buildCallInfo(backend, child, 0);
+        calls.push(callInfo);
+
+        // Transitive: follow resolved calls
+        if (transitive && callInfo.resolved && callInfo.target) {
+          await collectTransitiveCalls(
+            backend,
+            callInfo.target.id,
+            1, // Starting at depth 1
+            transitiveDepth,
+            calls,
+            seenTargets
+          );
+        }
+      }
+
+      // Continue into nested scopes, but NOT into nested functions/classes
+      if (child.type === 'SCOPE') {
+        queue.push({ id: child.id, depth: depth + 1 });
+      }
+      // Skip FUNCTION, CLASS - they have their own scope hierarchy
+    }
+  }
+
+  return calls;
+}
+
+/**
+ * Build CallInfo from a call node
+ */
+async function buildCallInfo(
+  backend: GraphBackend,
+  callNode: { id: string; type: string; name: string; file?: string; line?: number; object?: string },
+  depth: number
+): Promise<CallInfo> {
+  // Check for CALLS edge (resolved target)
+  const callsEdges = await backend.getOutgoingEdges(callNode.id, ['CALLS']);
+  const isResolved = callsEdges.length > 0;
+
+  let target = undefined;
+  if (isResolved) {
+    const targetNode = await backend.getNode(callsEdges[0].dst);
+    if (targetNode) {
+      target = {
+        id: targetNode.id,
+        name: targetNode.name,
+        file: targetNode.file,
+        line: targetNode.line,
+      };
+    }
+  }
+
+  return {
+    id: callNode.id,
+    name: callNode.name,
+    type: callNode.type as 'CALL' | 'METHOD_CALL',
+    object: callNode.object,
+    resolved: isResolved,
+    target,
+    file: callNode.file,
+    line: callNode.line,
+    depth,
+  };
+}
+
+/**
+ * Recursively collect transitive calls
+ *
+ * Infinite loop prevention:
+ * - Track seen function IDs in seenTargets
+ * - Stop when we've seen a function before (handles recursion)
+ * - Stop at transitiveDepth limit
+ */
+async function collectTransitiveCalls(
+  backend: GraphBackend,
+  functionId: string,
+  currentDepth: number,
+  maxTransitiveDepth: number,
+  calls: CallInfo[],
+  seenTargets: Set<string>
+): Promise<void> {
+  // Prevent infinite loops and limit depth
+  if (seenTargets.has(functionId) || currentDepth > maxTransitiveDepth) {
+    return;
+  }
+  seenTargets.add(functionId);
+
+  // Find calls in this function (non-transitive to avoid recursion)
+  const innerCalls = await findCallsInFunction(backend, functionId, {
+    maxDepth: 10,
+    transitive: false,
+  });
+
+  for (const call of innerCalls) {
+    // Add with updated depth
+    calls.push({ ...call, depth: currentDepth });
+
+    // Continue transitively if resolved
+    if (call.resolved && call.target) {
+      await collectTransitiveCalls(
+        backend,
+        call.target.id,
+        currentDepth + 1,
+        maxTransitiveDepth,
+        calls,
+        seenTargets
+      );
+    }
+  }
+}