@oculum/scanner 1.0.0

package/src/layer3/index.ts

@@ -0,0 +1,130 @@
+/**
+ * Layer 3: AI Semantic Analysis
+ * Deep security analysis using Claude AI and package verification
+ */
+
+import type { Vulnerability, ScanFile } from '../types'
+import { batchAnalyzeWithAI, type Layer3Context } from './anthropic'
+import { checkPackages } from './package-check'
+
+export interface Layer3Result {
+  vulnerabilities: Vulnerability[]
+  filesScanned: number
+  duration: number
+  aiAnalyzed: number
+}
+
+// File extensions that benefit most from AI analysis
+const AI_PRIORITY_EXTENSIONS = [
+  '.ts', '.tsx', '.js', '.jsx', '.mjs',
+  '.py', '.rb', '.php', '.go',
+]
+
+// Max files to send to AI (to control costs)
+const MAX_AI_FILES = 10
+
+// Max file size for AI analysis (smaller than general limit)
+const MAX_AI_FILE_SIZE = 30 * 1024 // 30KB
+
+export interface Layer3Options {
+  /** Enable AI analysis */
+  enableAI?: boolean
+  /** Maximum files to analyze with AI (overrides default) */
+  maxFiles?: number
+  /** Project context for auth-aware analysis */
+  projectContext?: Layer3Context
+}
+
+export async function runLayer3Scan(
+  files: ScanFile[],
+  options: Layer3Options = {}
+): Promise<Layer3Result> {
+  const startTime = Date.now()
+  const vulnerabilities: Vulnerability[] = []
+  let aiAnalyzedCount = 0
+  
+  // Use provided maxFiles or default
+  const maxAIFiles = options.maxFiles ?? MAX_AI_FILES
+
+  // 1. Check packages (always run, fast)
+  const packageFiles = files.filter(f => f.path.endsWith('package.json'))
+  for (const file of packageFiles) {
+    const packageFindings = await checkPackages(file.content, file.path)
+    vulnerabilities.push(...packageFindings)
+  }
+
+  // 2. AI Analysis (if enabled)
+  if (options.enableAI !== false) {
+    // Select files for AI analysis
+    const aiCandidates = files
+      .filter(f => {
+        // Must be a priority extension
+        const hasPriorityExt = AI_PRIORITY_EXTENSIONS.some(ext => f.path.endsWith(ext))
+        // Must be under size limit
+        const underSizeLimit = f.size <= MAX_AI_FILE_SIZE
+        // Skip test files
+        const isNotTest = !f.path.includes('.test.') && 
+                          !f.path.includes('.spec.') &&
+                          !f.path.includes('__tests__')
+        return hasPriorityExt && underSizeLimit && isNotTest
+      })
+      // Prioritize files that look like they handle user input
+      .sort((a, b) => {
+        const aScore = getAIPriorityScore(a)
+        const bScore = getAIPriorityScore(b)
+        return bScore - aScore
+      })
+      .slice(0, maxAIFiles)
+
+    if (aiCandidates.length > 0) {
+      console.log(`[Layer 3] Analyzing ${aiCandidates.length} files with AI...`)
+      
+      try {
+        const aiFindings = await batchAnalyzeWithAI(aiCandidates, options.projectContext)
+        vulnerabilities.push(...aiFindings)
+        aiAnalyzedCount = aiCandidates.length
+      } catch (error) {
+        console.error('[Layer 3] AI analysis failed:', error)
+      }
+    }
+  }
+
+  return {
+    vulnerabilities,
+    filesScanned: files.length,
+    duration: Date.now() - startTime,
+    aiAnalyzed: aiAnalyzedCount,
+  }
+}
+
+// Score files by likelihood of containing security-relevant code
+function getAIPriorityScore(file: ScanFile): number {
+  let score = 0
+  const content = file.content.toLowerCase()
+  const path = file.path.toLowerCase()
+
+  // Path-based scoring
+  if (path.includes('/api/') || path.includes('/routes/')) score += 10
+  if (path.includes('auth') || path.includes('login')) score += 8
+  if (path.includes('middleware')) score += 7
+  if (path.includes('controller')) score += 6
+  if (path.includes('handler')) score += 5
+  if (path.includes('service')) score += 4
+
+  // Content-based scoring (indicators of security-relevant code)
+  if (content.includes('req.query') || content.includes('req.params')) score += 5
+  if (content.includes('req.body')) score += 5
+  if (content.includes('searchparams')) score += 4
+  if (content.includes('exec(') || content.includes('eval(')) score += 10
+  if (content.includes('innerhtml') || content.includes('dangerouslysetinnerhtml')) score += 8
+  if (content.includes('sql') || content.includes('query(')) score += 6
+  if (content.includes('password') || content.includes('token')) score += 4
+  if (content.includes('authenticate') || content.includes('authorize')) score += 5
+  if (content.includes('redirect')) score += 3
+  if (content.includes('cookie') || content.includes('session')) score += 4
+
+  return score
+}
+
+export { analyzeWithAI, batchAnalyzeWithAI, type Layer3Context } from './anthropic'
+export { checkPackages } from './package-check'