@lbroth/rothunter 1.0.0-rc.1

package/dist/reporter/markdown-reporter.js

@@ -0,0 +1,77 @@
+const SEVERITY_ORDER = { high: 3, medium: 2, low: 1 };
+export function renderMarkdownReport(findings, opts) {
+    const visible = findings.filter((f) => f.confidence >= opts.minConfidence);
+    const hidden = findings.length - visible.length;
+    visible.sort((a, b) => {
+        const sev = SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity];
+        if (sev !== 0)
+            return sev;
+        return b.confidence - a.confidence;
+    });
+    const lines = [];
+    lines.push('# RotHunter audit');
+    lines.push('');
+    lines.push(`- Workspace: \`${opts.workspaceRoot}\``);
+    lines.push(`- Generated: ${opts.generatedAt.toISOString()}`);
+    lines.push(`- Symbols scanned: ${opts.symbolCount}`);
+    lines.push(`- Duration: ${(opts.durationMs / 1000).toFixed(1)}s`);
+    lines.push(`- Findings: ${visible.length} (shown) / ${findings.length} (total)`);
+    lines.push(`- Min confidence: ${opts.minConfidence}`);
+    if (hidden > 0) {
+        lines.push(`- Hidden by confidence threshold: ${hidden}`);
+    }
+    lines.push('');
+    if (visible.length === 0) {
+        lines.push('_No findings above the confidence threshold._');
+        return lines.join('\n');
+    }
+    const byDetector = new Map();
+    for (const f of visible) {
+        const list = byDetector.get(f.detectorId) ?? [];
+        list.push(f);
+        byDetector.set(f.detectorId, list);
+    }
+    for (const [detectorId, list] of byDetector) {
+        lines.push(`## ${detectorId} (${list.length})`);
+        lines.push('');
+        for (const f of list) {
+            lines.push(`### ${severityIcon(f.severity)} ${f.title}`);
+            lines.push('');
+            lines.push(`> confidence ${f.confidence.toFixed(2)} · layer ${f.layer} · fingerprint \`${f.fingerprint}\``);
+            lines.push('');
+            lines.push(f.description);
+            lines.push('');
+            if (f.evidence.length > 0) {
+                lines.push('**Evidence:**');
+                lines.push('');
+                for (const ev of f.evidence) {
+                    lines.push(`- \`${ev.file}:${ev.range.startLine}\``);
+                    lines.push('  ```typescript');
+                    for (const line of ev.snippet.split('\n')) {
+                        lines.push(`  ${line}`);
+                    }
+                    lines.push('  ```');
+                }
+                lines.push('');
+            }
+            if (f.suggestion) {
+                lines.push(`**Suggestion:** ${f.suggestion}`);
+                lines.push('');
+            }
+            lines.push('---');
+            lines.push('');
+        }
+    }
+    return lines.join('\n');
+}
+function severityIcon(s) {
+    switch (s) {
+        case 'high':
+            return '[high]';
+        case 'medium':
+            return '[med]';
+        case 'low':
+            return '[low]';
+    }
+}
+//# sourceMappingURL=markdown-reporter.js.map

package/dist/reporter/markdown-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-reporter.js","sourceRoot":"","sources":["../../src/reporter/markdown-reporter.ts"],"names":[],"mappings":"AAUA,MAAM,cAAc,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAW,CAAC;AAE/D,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,IAAmB;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1B,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,MAAM,cAAc,QAAQ,CAAC,MAAM,UAAU,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,MAAM,UAAU,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CACR,gBAAgB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,WAAW,IAAI,CAChG,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;oBAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;oBACrD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBAC9B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAC1B,CAAC;oBACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,CAAsB;IAC1C,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/rothunter.d.ts

@@ -0,0 +1,125 @@
+import { type ParseOptions } from './parsers/typescript-parser.js';
+import type { Finding, SymbolRecord } from './types.js';
+import type { LlmClient } from './adapters/llm.js';
+export interface RotHunterRunOptions extends ParseOptions {
+    /** Drop a finding below `severity:'low'` when post-LLM confidence falls under this threshold. */
+    llmRejectionThreshold?: number;
+    /** Override the LLM client (tests, alternative model pools). Production uses the default LlmClient. */
+    llm?: LlmClient;
+    /**
+     * Optional allow-list of detector ids. When set, findings from detectors
+     * outside this list are dropped BEFORE the LLM confirmation pass — the
+     * caller will never see them in the report, so the LLM cost is wasted.
+     * Mirrors the `--detectors` CLI flag.
+     */
+    detectorsAllow?: Set<string>;
+    /** Optional deny-list of detector ids — mirrors `--no-detectors`. */
+    detectorsDeny?: Set<string>;
+    /**
+     * Number of LLM verdicts in flight at once. 1 = sequential
+     * (original behaviour, safe). 4-8 is a good default on llama.cpp run
+     * with `--parallel N -cb` (continuous batching) or on vLLM (dynamic
+     * batching is on by default).
+     *
+     * Defaults to `ROTHUNTER_LLM_CONCURRENCY` env var, then 1.
+     */
+    llmConcurrency?: number;
+    /**
+     * Confidence floor at which a negative LLM verdict routes a finding
+     * into the auto-FP bucket. Defaults to `LLM_FP_THRESHOLD` (0.6) — set
+     * lower to be more aggressive (almost every "intentional" LLM call
+     * auto-FPs) or higher (only very-confident verdicts route, the rest
+     * stay open at degraded confidence).
+     */
+    llmAutoFpThreshold?: number;
+    /**
+     * Optional callback invoked at scan checkpoints. Used by the rothunter
+     * HTTP server to stream live progress over SSE. Never throws — exceptions
+     * inside the callback are caught and logged.
+     */
+    onProgress?: (event: ScanProgressEvent) => void;
+    /**
+     * Optional cooperative cancellation. The orchestrator checks
+     * `abortSignal.aborted` between LLM verdict tasks and aborts the
+     * worker pool when the signal fires. Used by the HTTP server's
+     * /api/scans/:scanId/cancel endpoint to free the scan slot promptly
+     * instead of relying on the (lossy) "throw inside onProgress" path.
+     */
+    abortSignal?: AbortSignal;
+}
+export type ScanProgressEvent = {
+    state: 'parsing';
+    files?: number;
+    symbols?: number;
+} | {
+    state: 'detecting';
+    detector: string;
+} | {
+    state: 'llm-start';
+    total: number;
+} | {
+    state: 'llm-verdict';
+    done: number;
+    total: number;
+    detectorId: string;
+    race: boolean;
+    confidence: number;
+    reason: string;
+    latencyMs: number;
+    cluster?: string;
+} | {
+    state: 'done';
+    findings: number;
+    durationMs: number;
+};
+export interface RotHunterResult {
+    symbols: SymbolRecord[];
+    findings: Finding[];
+    durationMs: number;
+}
+export declare class RotHunter {
+    private parser;
+    private normalizer;
+    private detectors;
+    run(opts: RotHunterRunOptions): Promise<RotHunterResult>;
+    private runLlmConfirmation;
+}
+/**
+ * Apply a "cluster-style" LLM verdict to a finding. Used for the four
+ * detectors whose LLM confirmer returns a positive/negative boolean
+ * with a confidence: api-race / shared-db-write / race-condition (race
+ * vs safe) and mutation (bug-shaped vs intentional — caller maps
+ * `!intentional` to `positive`). Shared body keeps the score/severity/
+ * description bookkeeping in one place. Duplicate-type / duplicate-
+ * function use a different formula (1 - conf) and stay inline.
+ */
+export declare function applyClusterVerdict(finding: Finding, verdict: {
+    positive: boolean;
+    confidence: number;
+    reason: string;
+}, opts: {
+    threshold: number;
+    positiveLabel: string;
+    negativeLabel: string;
+    /** Auto-FP routing floor. Defaults to LLM_FP_THRESHOLD (0.6). */
+    autoFpThreshold?: number;
+}): void;
+/**
+ * Verdict-confidence floor at which a negative LLM verdict moves a
+ * finding into the auto-FP bucket. Set low (0.6) so any reasonably
+ * confident "intentional / FP" verdict routes the finding out of the
+ * open list — the operator's stated preference is "if the LLM says
+ * FP, treat it as auto FP, I'll un-mark if it's wrong". Below 0.6 the
+ * LLM is genuinely undecided and the deterministic finding stays in
+ * the open list at degraded confidence.
+ */
+export declare const LLM_FP_THRESHOLD = 0.6;
+/**
+ * Build per-detector structural context to attach to a TriageConfirmer
+ * call. The shape is free-form text — the LLM reads it alongside the
+ * primary evidence snippet — so we can evolve enrichment without
+ * version-coupling the triage schema. Returns `undefined` when no
+ * useful context is available so the prompt stays compact.
+ */
+export declare function buildTriageContext(finding: Finding, symbolById: Map<string, SymbolRecord>, workspaceRoot?: string): string | undefined;
+//# sourceMappingURL=rothunter.d.ts.map

package/dist/rothunter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rothunter.d.ts","sourceRoot":"","sources":["../src/rothunter.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAOrF,OAAO,KAAK,EAAY,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAKnD,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,iGAAiG;IACjG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uGAAuG;IACvG,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,qEAAqE;IACrE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAChD;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAGD,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACjK;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,SAAS,CAGf;IAEI,GAAG,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;YAoOhD,kBAAkB;CAsTjC;AAgMD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAClE,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACA,IAAI,CA2BN;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EACrC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAuBpB"}