@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/lib/fetch-fortify.sh

@@ -0,0 +1,321 @@
+#!/bin/bash
+#
+# fetch-fortify.sh
+# Query a Fortify SSC instance for a project version's open findings and
+# emit a normalized JSON view that Phase 4 (Review) consumes as a
+# deterministic security gate.
+#
+# Two input forms:
+#   ./fetch-fortify.sh <ssc-url>                         # parses versionId / issue from URL
+#   ./fetch-fortify.sh --version-id <id> [--issue <id>]  # explicit components
+#
+# Required configuration:
+#   prefs.global.hosts.fortify           — SSC host (e.g. ssc.example.com)
+#   prefs.global.keychainMapping.fortify — keychain key holding the API token
+#
+# Optional env:
+#   FORTIFY_TIMEOUT_SECONDS    default 25
+#   FORTIFY_HOST_OVERRIDE      forces the host (used by tests and CI dry-runs)
+#   FORTIFY_AUTH_SCHEME        auto|bearer|fortifytoken (default: auto)
+#
+# Output (stdout, single JSON object):
+#   {
+#     "fetchedAt": "<ISO8601>",
+#     "source": { "url": "<url|null>", "host": "<host>", "versionId": "...",
+#                 "versionName": "...", "projectName": "..." },
+#     "severityCounts": { "Critical": <n>, "High": <n>, "Medium": <n>, "Low": <n> },
+#     "totalOpenIssues": <n>,
+#     "findings": [
+#       { "id": "...", "issueName": "...", "severity": "Critical|High|Medium|Low",
+#         "friority": "...", "kingdom": "...", "analyzer": "...",
+#         "file": "...", "line": <n>,
+#         "description": "...", "recommendation": "...", "codeSnippet": "..."|null }
+#     ],
+#     "gateOutcome": { "blocking": <bool>, "reason": "..." }
+#   }
+#
+# Exit codes:
+#   0  success (gateOutcome may still be blocking)
+#   2  missing/expired credential (orchestrator handles the Save Flow)
+#   3  network/auth failure
+#   4  bad usage
+#   6  host not configured (prefs.global.hosts.fortify is empty)
+#
+# Phase 4 review gate contract:
+#   Critical > 0   → blocking=true, reason="critical-findings"
+#   High > 0       → blocking=false, reason="high-findings-warning"
+#   else           → blocking=false, reason="clean"
+
+set -eu
+
+URL=""
+VERSION_ID=""
+ISSUE_ID=""
+TIMEOUT="${FORTIFY_TIMEOUT_SECONDS:-25}"
+AUTH_SCHEME="${FORTIFY_AUTH_SCHEME:-auto}"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --version-id) VERSION_ID="$2"; shift 2 ;;
+    --issue)      ISSUE_ID="$2";   shift 2 ;;
+    -h|--help)
+      echo "usage: $0 <ssc-url> | $0 --version-id <id> [--issue <id>]" >&2
+      exit 4 ;;
+    *)
+      if [ -z "$URL" ]; then URL="$1"; shift; else
+        echo "ERR: unexpected arg $1" >&2; exit 4
+      fi ;;
+  esac
+done
+
+# Host comes from prefs (private config); skill templates only show <ssc-host>.
+PREFS="$HOME/.claude/multi-agent-preferences.json"
+HOST="${FORTIFY_HOST_OVERRIDE:-}"
+if [ -z "$HOST" ] && [ -f "$PREFS" ]; then
+  HOST=$(python3 -c "
+import json
+try:
+    p = json.load(open('$PREFS'))
+    print(p.get('global', {}).get('hosts', {}).get('fortify') or '')
+except Exception:
+    print('')
+")
+fi
+if [ -z "$HOST" ]; then
+  printf '%s\n' '{"status":"blocked","reason":"host-not-configured","service":"fortify","expected_pref":"global.hosts.fortify"}' >&2
+  exit 6
+fi
+HOST=${HOST%/}  # strip trailing slash if any
+
+# Parse URL components when present.
+if [ -n "$URL" ] && [ -z "$VERSION_ID" ]; then
+  PARSED=$(URL_IN="$URL" python3 - <<'PY'
+import os, re, urllib.parse as up
+url = os.environ["URL_IN"]
+p = up.urlparse(url)
+# Common Fortify SSC URL shapes — match the version id and (optionally) the
+# issue instance id from the path or fragment.
+text = p.path + ("#" + p.fragment if p.fragment else "")
+m = re.search(r"/version/(?P<ver>\d+)(?:/fix/(?P<inst>[A-Za-z0-9-]+))?", text)
+ver = m.group("ver") if m else ""
+inst = m.group("inst") if (m and m.group("inst")) else ""
+if not ver:
+    m2 = re.search(r"/projectVersions/(?P<ver>\d+)", text)
+    ver = m2.group("ver") if m2 else ""
+print(f"{ver}\t{inst}")
+PY
+)
+  VERSION_ID=$(printf '%s' "$PARSED" | cut -f1)
+  [ -z "$ISSUE_ID" ] && ISSUE_ID=$(printf '%s' "$PARSED" | cut -f2)
+fi
+
+if [ -z "$VERSION_ID" ]; then
+  echo "ERR: no Fortify version id (pass --version-id or use a URL containing /version/<id>)" >&2
+  exit 4
+fi
+
+# Token via keychain mapping.
+TOKEN_KEY=""
+if [ -f "$PREFS" ]; then
+  TOKEN_KEY=$(python3 -c "
+import json
+try:
+    p = json.load(open('$PREFS'))
+    print(p.get('global', {}).get('keychainMapping', {}).get('fortify') or '')
+except Exception:
+    print('')
+")
+fi
+[ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Fortify_Access_Token"
+
+TOKEN=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+if [ -z "$TOKEN" ]; then
+  printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"fortify","expected_key":"'"$TOKEN_KEY"'"}' >&2
+  exit 2
+fi
+
+API_BASE="https://$HOST/ssc/api/v1"
+
+# Pick auth header. Modern scoped tokens are Bearer; legacy CITRIX/Fortify
+# tokens need "FortifyToken <base64(token)>". When auto, try Bearer first and
+# fall back to FortifyToken on 401.
+auth_attempt() {
+  local scheme="$1"
+  local hdr
+  if [ "$scheme" = "bearer" ]; then
+    hdr="Authorization: Bearer $TOKEN"
+  else
+    hdr="Authorization: FortifyToken $(printf '%s' "$TOKEN" | base64 | tr -d '\n')"
+  fi
+  curl -sS --max-time "$TIMEOUT" -w "\n%{http_code}" \
+       -H "$hdr" -H "Accept: application/json" "$1"
+  return 0
+}
+
+fortify_get() {
+  # Usage: fortify_get <path-relative-to-API_BASE>
+  local path="$1"
+  local url="$API_BASE/$path"
+  local resp http schemes
+  case "$AUTH_SCHEME" in
+    bearer)       schemes="bearer" ;;
+    fortifytoken) schemes="fortifytoken" ;;
+    *)            schemes="bearer fortifytoken" ;;
+  esac
+  for s in $schemes; do
+    local hdr
+    if [ "$s" = "bearer" ]; then
+      hdr="Authorization: Bearer $TOKEN"
+    else
+      hdr="Authorization: FortifyToken $(printf '%s' "$TOKEN" | base64 | tr -d '\n')"
+    fi
+    resp=$(curl -sS --max-time "$TIMEOUT" -w "\n%{http_code}" \
+             -H "$hdr" -H "Accept: application/json" "$url" 2>/dev/null || true)
+    http=$(printf '%s' "$resp" | tail -n1)
+    if [ "$http" = "200" ]; then
+      printf '%s' "$resp" | sed '$d'
+      return 0
+    fi
+    if [ "$http" = "401" ] || [ "$http" = "403" ]; then
+      continue
+    fi
+    # Other non-200 → return whatever the server said + the code.
+    printf '%s\nHTTP_%s' "$(printf '%s' "$resp" | sed '$d')" "$http"
+    return 1
+  done
+  printf 'HTTP_AUTH_FAILED'
+  return 1
+}
+
+VERSION_JSON=$(fortify_get "projectVersions/$VERSION_ID" || true)
+case "$VERSION_JSON" in
+  HTTP_AUTH_FAILED|*HTTP_4*)
+    echo "ERR: Fortify auth failed (Bearer + FortifyToken both rejected)" >&2
+    exit 3 ;;
+esac
+
+ISSUES_JSON=""
+if [ -n "$ISSUE_ID" ]; then
+  ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?q=issueInstanceId:\"$ISSUE_ID\"&limit=20" || true)
+else
+  ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?limit=200&filter=ANALYSIS%3D%3DNotAnIssue,ANALYSIS%3D%3DFalsePositive&filterset=Critical%2CHigh" || true)
+fi
+
+# Issue details are fetched per-issue lazily — only for the first 10 to keep
+# the response size bounded.
+ISSUE_DETAILS_LIST=$(printf '%s' "$ISSUES_JSON" | python3 -c "
+import sys, json
+try:
+    r = json.load(sys.stdin)
+    items = r.get('data') or []
+    ids = []
+    for it in items[:10]:
+        if isinstance(it, dict) and it.get('id') is not None:
+            ids.append(str(it['id']))
+    print('\\n'.join(ids))
+except Exception:
+    pass
+" 2>/dev/null || true)
+
+DETAILS_JSON_LIST=""
+for id in $ISSUE_DETAILS_LIST; do
+  d=$(fortify_get "issueDetails/$id" 2>/dev/null || true)
+  if [ -n "$d" ]; then
+    DETAILS_JSON_LIST="${DETAILS_JSON_LIST}${d}"$'\n---SEP---\n'
+  fi
+done
+
+SRC_URL="$URL" SRC_HOST="$HOST" SRC_VERSION="$VERSION_ID" \
+VERSION_JSON_IN="$VERSION_JSON" ISSUES_JSON_IN="$ISSUES_JSON" \
+DETAILS_LIST_IN="$DETAILS_JSON_LIST" \
+python3 - <<'PY'
+import json, os, datetime
+
+def safe_load(s):
+    try:
+        return json.loads(s) if s else None
+    except Exception:
+        return None
+
+version = safe_load(os.environ["VERSION_JSON_IN"]) or {}
+version_data = version.get("data") or version
+issues = safe_load(os.environ["ISSUES_JSON_IN"]) or {}
+issues_data = issues.get("data") or []
+
+details_blob = os.environ.get("DETAILS_LIST_IN") or ""
+detail_map = {}
+for piece in details_blob.split("\n---SEP---\n"):
+    if not piece.strip():
+        continue
+    d = safe_load(piece)
+    if d is None:
+        continue
+    payload = d.get("data") or d
+    iid = payload.get("id") or payload.get("issueId")
+    if iid is not None:
+        detail_map[str(iid)] = payload
+
+def severity_of(item):
+    # Friority is Fortify's canonical bucket — Critical/High/Medium/Low.
+    fri = (item.get("friority") or item.get("severity") or "").capitalize()
+    if fri in ("Critical","High","Medium","Low"):
+        return fri
+    # Numeric severity fallback (1-4 → Critical→Low).
+    sev = item.get("severity")
+    try:
+        n = float(sev)
+        if n >= 3.5: return "Critical"
+        if n >= 2.5: return "High"
+        if n >= 1.5: return "Medium"
+        return "Low"
+    except Exception:
+        return "Medium"
+
+counts = {"Critical": 0, "High": 0, "Medium": 0, "Low": 0}
+findings = []
+for it in issues_data:
+    sev = severity_of(it)
+    counts[sev] = counts.get(sev, 0) + 1
+    iid = str(it.get("id") or "")
+    det = detail_map.get(iid) or {}
+    findings.append({
+        "id": iid,
+        "issueName": it.get("issueName") or it.get("name") or det.get("issueName") or "",
+        "severity": sev,
+        "friority": it.get("friority") or "",
+        "kingdom": it.get("kingdom") or det.get("kingdom") or "",
+        "analyzer": it.get("analyzer") or det.get("analyzer") or "",
+        "file": it.get("fullFileName") or it.get("primaryLocation") or det.get("fullFileName") or "",
+        "line": it.get("lineNumber") or det.get("lineNumber") or 0,
+        "description": (det.get("detail") or det.get("description") or "")[:1500],
+        "recommendation": (det.get("recommendation") or "")[:1500],
+        "codeSnippet": (det.get("brief") or det.get("codeSnippet") or None),
+    })
+
+# Sort severity-first.
+order = {"Critical": 0, "High": 1, "Medium": 2, "Low": 3}
+findings.sort(key=lambda x: order.get(x["severity"], 9))
+
+if counts["Critical"] > 0:
+    gate = {"blocking": True,  "reason": "critical-findings"}
+elif counts["High"] > 0:
+    gate = {"blocking": False, "reason": "high-findings-warning"}
+else:
+    gate = {"blocking": False, "reason": "clean"}
+
+result = {
+    "fetchedAt": datetime.datetime.utcnow().isoformat() + "Z",
+    "source": {
+        "url": os.environ.get("SRC_URL") or None,
+        "host": os.environ["SRC_HOST"],
+        "versionId": os.environ["SRC_VERSION"],
+        "versionName": version_data.get("name") or "",
+        "projectName": (version_data.get("project") or {}).get("name") or "",
+    },
+    "severityCounts": counts,
+    "totalOpenIssues": sum(counts.values()),
+    "findings": findings,
+    "gateOutcome": gate,
+}
+print(json.dumps(result, ensure_ascii=False))
+PY

package/pipeline/lib/fetch-swagger.sh

@@ -0,0 +1,270 @@
+#!/bin/bash
+#
+# fetch-swagger.sh
+# Fetch an OpenAPI / Swagger spec from a URL, return a normalized JSON view
+# of the API surface that Phase 1 (Analysis) can prepend to the agent prompt.
+#
+# The output is intentionally small (≤ ~64KB target) — full schemas are
+# truncated to one example each, descriptions are trimmed to one paragraph,
+# and only the endpoints' shape is kept. Phase 1 doesn't need the entire
+# spec, it needs to know which endpoints exist, their method/path, and
+# the rough shape of request/response.
+#
+# Usage:
+#   ./fetch-swagger.sh <url>
+#
+# Optional env:
+#   SWAGGER_TIMEOUT_SECONDS   default 15
+#   SWAGGER_MAX_BYTES         default 5_000_000 (5MB) — refuses payloads larger
+#   SWAGGER_AUTH_HEADER       optional 'Header-Name: value' line, when the spec
+#                             URL needs auth (rare; most OpenAPI specs are
+#                             served unauthenticated)
+#
+# Output (stdout, single JSON object):
+#   {
+#     "fetchedAt": "<ISO8601>",
+#     "source": { "url": "<url>", "format": "json|yaml", "bytes": <n> },
+#     "info": { "title": "...", "version": "...", "description": "..." },
+#     "servers": ["<base-url>", ...],
+#     "endpoints": [
+#       { "method": "POST", "path": "/v1/...", "summary": "...",
+#         "requestExample": { ... },
+#         "responses": { "200": { "schemaSummary": "...", "example": {...} },
+#                        "400": { "schemaSummary": "..." } } },
+#       ...
+#     ],
+#     "endpointCount": <n>
+#   }
+#
+# Exit codes:
+#   0  success
+#   2  network / HTTP error
+#   3  payload too large or malformed
+#   4  bad usage
+
+set -eu
+
+URL="${1:-}"
+[ -z "$URL" ] && { echo "usage: $0 <openapi-url>" >&2; exit 4; }
+
+TIMEOUT="${SWAGGER_TIMEOUT_SECONDS:-15}"
+MAX_BYTES="${SWAGGER_MAX_BYTES:-5000000}"
+
+TMP_RAW=$(mktemp -t swagger-raw.XXXXXX)
+trap 'rm -f "$TMP_RAW"' EXIT
+
+# Pull the spec with a size cap (curl --max-filesize doesn't exist on every
+# platform; we let curl run with --output then check the size).
+CURL_ARGS=(-sS --fail --max-time "$TIMEOUT" --location --output "$TMP_RAW" \
+           --write-out "%{http_code}\n%{content_type}\n%{size_download}\n")
+if [ -n "${SWAGGER_AUTH_HEADER:-}" ]; then
+  CURL_ARGS+=(-H "$SWAGGER_AUTH_HEADER")
+fi
+
+if ! META=$(curl "${CURL_ARGS[@]}" "$URL" 2>/dev/null); then
+  echo "ERR: swagger fetch failed for $URL" >&2
+  exit 2
+fi
+
+HTTP_CODE=$(printf '%s\n' "$META" | sed -n '1p')
+CONTENT_TYPE=$(printf '%s\n' "$META" | sed -n '2p')
+SIZE=$(printf '%s\n' "$META" | sed -n '3p')
+
+if [ "$HTTP_CODE" != "200" ]; then
+  echo "ERR: swagger HTTP $HTTP_CODE for $URL" >&2
+  exit 2
+fi
+if [ "${SIZE:-0}" -gt "$MAX_BYTES" ]; then
+  echo "ERR: swagger payload $SIZE B exceeds max $MAX_BYTES B" >&2
+  exit 3
+fi
+
+# Detect format from content-type or URL suffix; YAML→JSON conversion uses
+# python's yaml when available, falls back to "format=yaml" passthrough so
+# the agent can still read it if pyyaml is missing.
+FORMAT="json"
+LOWER_CT=$(printf '%s' "$CONTENT_TYPE" | tr '[:upper:]' '[:lower:]')
+case "$LOWER_CT" in
+  *yaml*|*yml*) FORMAT="yaml" ;;
+  *json*)       FORMAT="json" ;;
+  *)
+    case "${URL,,}" in
+      *.yaml|*.yml) FORMAT="yaml" ;;
+      *)            FORMAT="json" ;;
+    esac
+    ;;
+esac
+
+SOURCE_URL="$URL" SOURCE_FORMAT="$FORMAT" SOURCE_BYTES="$SIZE" \
+SOURCE_PATH="$TMP_RAW" \
+python3 - <<'PY'
+import json, os, re, sys, datetime
+
+src_path = os.environ["SOURCE_PATH"]
+fmt = os.environ["SOURCE_FORMAT"]
+url = os.environ["SOURCE_URL"]
+size = int(os.environ.get("SOURCE_BYTES") or 0)
+
+def load_spec():
+    with open(src_path, "rb") as f:
+        raw = f.read()
+    text = raw.decode("utf-8", errors="replace")
+    if fmt == "yaml":
+        try:
+            import yaml  # type: ignore
+            return yaml.safe_load(text)
+        except ImportError:
+            # Fall back to a minimal stub so the pipeline can still surface
+            # the URL with a "yaml-no-parser" advisory.
+            return {"info": {"title": "<unparsed yaml — install pyyaml>"}, "_unparsed": True}
+    try:
+        return json.loads(text)
+    except json.JSONDecodeError as e:
+        print(f"ERR: spec is not valid JSON: {e}", file=sys.stderr)
+        sys.exit(3)
+
+spec = load_spec()
+if not isinstance(spec, dict):
+    print("ERR: spec root is not an object", file=sys.stderr)
+    sys.exit(3)
+
+def trim(text, n=240):
+    if not text:
+        return ""
+    text = re.sub(r"\s+", " ", str(text)).strip()
+    return text[:n] + ("…" if len(text) > n else "")
+
+def example_for(schema, components, depth=0):
+    """Build a tiny example value from a JSON Schema fragment. Stops at
+    depth 4 to avoid pathological circular references."""
+    if depth > 4 or not isinstance(schema, dict):
+        return None
+    if "$ref" in schema and isinstance(schema["$ref"], str):
+        ref = schema["$ref"]
+        # Local refs: #/components/schemas/Foo
+        if ref.startswith("#/components/schemas/"):
+            name = ref.rsplit("/", 1)[-1]
+            target = (components or {}).get("schemas", {}).get(name)
+            if isinstance(target, dict):
+                return example_for(target, components, depth + 1)
+        return f"<{ref}>"
+    if "example" in schema:
+        return schema["example"]
+    if "examples" in schema and isinstance(schema["examples"], dict):
+        first = next(iter(schema["examples"].values()), None)
+        if isinstance(first, dict) and "value" in first:
+            return first["value"]
+    t = schema.get("type")
+    if t == "object" or "properties" in schema:
+        out = {}
+        for name, sub in (schema.get("properties") or {}).items():
+            out[name] = example_for(sub, components, depth + 1)
+        return out
+    if t == "array":
+        return [example_for(schema.get("items") or {}, components, depth + 1)]
+    if t == "string":
+        return schema.get("default", "<string>")
+    if t in ("number", "integer"):
+        return schema.get("default", 0)
+    if t == "boolean":
+        return schema.get("default", False)
+    return None
+
+def schema_summary(schema, components, depth=0):
+    if depth > 3 or not isinstance(schema, dict):
+        return "<unknown>"
+    if "$ref" in schema:
+        return schema["$ref"].rsplit("/", 1)[-1]
+    t = schema.get("type")
+    if t == "object" or "properties" in schema:
+        keys = list((schema.get("properties") or {}).keys())[:8]
+        return "object{" + ", ".join(keys) + ("…" if len(keys) >= 8 else "") + "}"
+    if t == "array":
+        return "array<" + schema_summary(schema.get("items") or {}, components, depth + 1) + ">"
+    return t or "<unknown>"
+
+components = spec.get("components") or {}
+
+info_raw = spec.get("info") or {}
+info = {
+    "title": trim(info_raw.get("title") or "", 120),
+    "version": trim(info_raw.get("version") or "", 40),
+    "description": trim(info_raw.get("description") or "", 400),
+}
+
+servers = []
+for s in (spec.get("servers") or []):
+    if isinstance(s, dict) and isinstance(s.get("url"), str):
+        servers.append(s["url"])
+# Swagger 2.0 fallback
+if not servers and spec.get("host"):
+    scheme = (spec.get("schemes") or ["https"])[0]
+    base = spec.get("basePath") or ""
+    servers.append(f"{scheme}://{spec['host']}{base}")
+
+endpoints = []
+paths = spec.get("paths") or {}
+for path, methods in paths.items():
+    if not isinstance(methods, dict):
+        continue
+    for method, op in methods.items():
+        if method.lower() not in {"get", "post", "put", "patch", "delete", "options", "head"}:
+            continue
+        if not isinstance(op, dict):
+            continue
+        # Request example
+        req_example = None
+        # OpenAPI 3.x
+        rb = op.get("requestBody")
+        if isinstance(rb, dict):
+            content = (rb.get("content") or {})
+            primary = content.get("application/json") or next(iter(content.values()), {})
+            if isinstance(primary, dict) and primary.get("schema"):
+                req_example = example_for(primary["schema"], components)
+        # Swagger 2.0
+        elif isinstance(op.get("parameters"), list):
+            for p in op["parameters"]:
+                if isinstance(p, dict) and p.get("in") == "body" and p.get("schema"):
+                    req_example = example_for(p["schema"], components)
+                    break
+
+        # Responses
+        responses_out = {}
+        for code, resp in (op.get("responses") or {}).items():
+            if not isinstance(resp, dict):
+                continue
+            schema = None
+            # OpenAPI 3.x
+            content = resp.get("content") or {}
+            primary = content.get("application/json") or next(iter(content.values()), None)
+            if isinstance(primary, dict) and primary.get("schema"):
+                schema = primary["schema"]
+            # Swagger 2.0
+            elif resp.get("schema"):
+                schema = resp["schema"]
+            responses_out[str(code)] = {
+                "schemaSummary": schema_summary(schema, components) if schema else "<no schema>",
+                "example": example_for(schema, components) if schema else None,
+            }
+            # Cap at the 3 most relevant codes per endpoint
+            if len(responses_out) >= 3:
+                break
+
+        endpoints.append({
+            "method": method.upper(),
+            "path": path,
+            "summary": trim(op.get("summary") or op.get("description") or "", 200),
+            "requestExample": req_example,
+            "responses": responses_out,
+        })
+
+result = {
+    "fetchedAt": datetime.datetime.utcnow().isoformat() + "Z",
+    "source": {"url": url, "format": fmt, "bytes": size},
+    "info": info,
+    "servers": servers,
+    "endpoints": endpoints,
+    "endpointCount": len(endpoints),
+}
+print(json.dumps(result, ensure_ascii=False))
+PY