@oculum/scanner 1.0.10 → 1.0.12

package/src/ai-context/manager.ts

@@ -0,0 +1,145 @@
+/**
+ * AI Context Manager
+ * Handles loading, saving, and clearing AI context files
+ */
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'fs'
+import { join } from 'path'
+
+/** AI context file name */
+export const AI_CONTEXT_FILE = 'ai-context.md'
+
+/** Directory for oculum files */
+export const OCULUM_DIR = '.oculum'
+
+/** Full path to AI context file (relative to project root) */
+export const AI_CONTEXT_PATH = `${OCULUM_DIR}/${AI_CONTEXT_FILE}`
+
+export interface AIContextManagerOptions {
+  /** Project root path */
+  projectPath: string
+}
+
+export interface SaveContextResult {
+  /** Whether the save was successful */
+  success: boolean
+  /** Path where context was saved */
+  path: string
+  /** Error message (if failed) */
+  error?: string
+}
+
+export interface LoadContextResult {
+  /** Whether a context file was found */
+  found: boolean
+  /** The context content (if found) */
+  content?: string
+  /** Error message (if failed to load) */
+  error?: string
+}
+
+export interface ClearContextResult {
+  /** Whether the clear was successful */
+  success: boolean
+  /** Whether a context file existed before clearing */
+  existed: boolean
+  /** Error message (if failed) */
+  error?: string
+}
+
+/**
+ * Manages AI context files for IDE consumption
+ */
+export class AIContextManager {
+  private projectPath: string
+  private contextPath: string
+
+  constructor(options: AIContextManagerOptions | string) {
+    // Support both old string arg and new options object
+    if (typeof options === 'string') {
+      this.projectPath = options
+    } else {
+      this.projectPath = options.projectPath
+    }
+    this.contextPath = join(this.projectPath, OCULUM_DIR, AI_CONTEXT_FILE)
+  }
+
+  /**
+   * Get the full path to the AI context file
+   */
+  getContextPath(): string {
+    return this.contextPath
+  }
+
+  /**
+   * Save AI context to .oculum/ai-context.md
+   */
+  saveContext(content: string): SaveContextResult {
+    try {
+      // Ensure .oculum directory exists
+      const oculumDir = join(this.projectPath, OCULUM_DIR)
+      if (!existsSync(oculumDir)) {
+        mkdirSync(oculumDir, { recursive: true })
+      }
+
+      // Write content to file
+      writeFileSync(this.contextPath, content)
+
+      return { success: true, path: this.contextPath }
+    } catch (err) {
+      return {
+        success: false,
+        path: this.contextPath,
+        error: `Failed to save AI context: ${err instanceof Error ? err.message : 'Unknown error'}`,
+      }
+    }
+  }
+
+  /**
+   * Load AI context from .oculum/ai-context.md
+   */
+  loadContext(): LoadContextResult {
+    if (!existsSync(this.contextPath)) {
+      return { found: false }
+    }
+
+    try {
+      const content = readFileSync(this.contextPath, 'utf-8')
+      return { found: true, content }
+    } catch (err) {
+      return {
+        found: false,
+        error: `Failed to read AI context: ${err instanceof Error ? err.message : 'Unknown error'}`,
+      }
+    }
+  }
+
+  /**
+   * Clear (delete) the AI context file
+   */
+  clearContext(): ClearContextResult {
+    const existed = existsSync(this.contextPath)
+
+    if (!existed) {
+      return { success: true, existed: false }
+    }
+
+    try {
+      unlinkSync(this.contextPath)
+      return { success: true, existed: true }
+    } catch (err) {
+      return {
+        success: false,
+        existed: true,
+        error: `Failed to clear AI context: ${err instanceof Error ? err.message : 'Unknown error'}`,
+      }
+    }
+  }
+
+  /**
+   * Check if an AI context file exists
+   */
+  hasContext(): boolean {
+    return existsSync(this.contextPath)
+  }
+}

package/src/baseline/__tests__/diff.test.ts

@@ -0,0 +1,261 @@
+/**
+ * Baseline Diff Computation Tests
+ */
+
+import { computeDiff, hasNewBlockingIssues, formatDiffSummary } from '../diff'
+import type { Vulnerability } from '../../types'
+import type { BaselineData } from '../types'
+
+describe('Baseline Diff Computation', () => {
+  // Helper to create a test vulnerability
+  const createVuln = (
+    filePath: string,
+    lineNumber: number,
+    category: string,
+    severity: 'critical' | 'high' | 'medium' | 'low' | 'info' = 'medium',
+    title: string = 'Test finding'
+  ): Vulnerability => ({
+    filePath,
+    lineNumber,
+    category: category as any,
+    severity,
+    title,
+    description: 'Test description',
+    confidence: 'high',
+    layer: 1,
+    lineContent: `Line ${lineNumber} content`,
+  })
+
+  // Helper to create a baseline
+  const createBaseline = (findings: Array<{
+    hash: string
+    filePath: string
+    lineNumber: number
+    category: string
+    severity: string
+    title: string
+  }>): BaselineData => ({
+    version: 1,
+    createdAt: '2024-01-15T10:00:00.000Z',
+    findings: findings as any,
+    stats: {
+      total: findings.length,
+      critical: findings.filter(f => f.severity === 'critical').length,
+      high: findings.filter(f => f.severity === 'high').length,
+      medium: findings.filter(f => f.severity === 'medium').length,
+      low: findings.filter(f => f.severity === 'low').length,
+      info: findings.filter(f => f.severity === 'info').length,
+    },
+  })
+
+  describe('computeDiff', () => {
+    it('should identify all findings as new when baseline is empty', () => {
+      const current = [
+        createVuln('src/a.ts', 10, 'hardcoded_secret', 'critical'),
+        createVuln('src/b.ts', 20, 'sql_injection', 'high'),
+      ]
+      const baseline = createBaseline([])
+
+      const diff = computeDiff(current, baseline)
+
+      expect(diff.new).toHaveLength(2)
+      expect(diff.fixed).toHaveLength(0)
+      expect(diff.existing).toHaveLength(0)
+      expect(diff.stats.newCount).toBe(2)
+      expect(diff.stats.fixedCount).toBe(0)
+      expect(diff.stats.existingCount).toBe(0)
+    })
+
+    it('should identify all findings as existing when current matches baseline', () => {
+      const current = [
+        createVuln('src/a.ts', 10, 'hardcoded_secret', 'critical', 'API key'),
+      ]
+
+      // Need to compute the hash that would match
+      const { computeFindingHash } = require('../../suppression/hash')
+      const hash = computeFindingHash(current[0])
+
+      const baseline = createBaseline([
+        {
+          hash,
+          filePath: 'src/a.ts',
+          lineNumber: 10,
+          category: 'hardcoded_secret',
+          severity: 'critical',
+          title: 'API key',
+        },
+      ])
+
+      const diff = computeDiff(current, baseline)
+
+      expect(diff.new).toHaveLength(0)
+      expect(diff.fixed).toHaveLength(0)
+      expect(diff.existing).toHaveLength(1)
+      expect(diff.stats.existingCount).toBe(1)
+    })
+
+    it('should identify fixed findings when they exist in baseline but not current', () => {
+      const current: Vulnerability[] = []
+      const baseline = createBaseline([
+        {
+          hash: 'fixedhash1234567',
+          filePath: 'src/fixed.ts',
+          lineNumber: 5,
+          category: 'hardcoded_secret',
+          severity: 'high',
+          title: 'Fixed finding',
+        },
+      ])
+
+      const diff = computeDiff(current, baseline)
+
+      expect(diff.new).toHaveLength(0)
+      expect(diff.fixed).toHaveLength(1)
+      expect(diff.fixed[0].title).toBe('Fixed finding')
+      expect(diff.existing).toHaveLength(0)
+      expect(diff.stats.fixedCount).toBe(1)
+    })
+
+    it('should handle mixed scenario with new, fixed, and existing findings', () => {
+      // Create a finding that will be in both current and baseline
+      const existingVuln = createVuln('src/existing.ts', 10, 'xss', 'medium', 'Existing XSS')
+      const { computeFindingHash } = require('../../suppression/hash')
+      const existingHash = computeFindingHash(existingVuln)
+
+      // Current: one existing + one new
+      const current = [
+        existingVuln,
+        createVuln('src/new.ts', 20, 'sql_injection', 'high', 'New SQL injection'),
+      ]
+
+      // Baseline: one existing + one fixed
+      const baseline = createBaseline([
+        {
+          hash: existingHash,
+          filePath: 'src/existing.ts',
+          lineNumber: 10,
+          category: 'xss',
+          severity: 'medium',
+          title: 'Existing XSS',
+        },
+        {
+          hash: 'fixedhash9999999',
+          filePath: 'src/old.ts',
+          lineNumber: 30,
+          category: 'hardcoded_secret',
+          severity: 'critical',
+          title: 'Fixed secret',
+        },
+      ])
+
+      const diff = computeDiff(current, baseline)
+
+      expect(diff.new).toHaveLength(1)
+      expect(diff.new[0].title).toBe('New SQL injection')
+      expect(diff.fixed).toHaveLength(1)
+      expect(diff.fixed[0].title).toBe('Fixed secret')
+      expect(diff.existing).toHaveLength(1)
+      expect(diff.existing[0].title).toBe('Existing XSS')
+
+      expect(diff.stats.newCount).toBe(1)
+      expect(diff.stats.fixedCount).toBe(1)
+      expect(diff.stats.existingCount).toBe(1)
+    })
+
+    it('should compute severity counts correctly', () => {
+      const current = [
+        createVuln('src/a.ts', 1, 'sql_injection', 'critical', 'Crit 1'),
+        createVuln('src/b.ts', 2, 'xss', 'high', 'High 1'),
+        createVuln('src/c.ts', 3, 'xss', 'high', 'High 2'),
+        createVuln('src/d.ts', 4, 'data_exposure', 'medium', 'Med 1'),
+      ]
+      const baseline = createBaseline([])
+
+      const diff = computeDiff(current, baseline)
+
+      expect(diff.stats.newBySeverity.critical).toBe(1)
+      expect(diff.stats.newBySeverity.high).toBe(2)
+      expect(diff.stats.newBySeverity.medium).toBe(1)
+      expect(diff.stats.newBySeverity.low).toBe(0)
+      expect(diff.stats.newBySeverity.info).toBe(0)
+    })
+  })
+
+  describe('hasNewBlockingIssues', () => {
+    it('should return true when there are new critical findings', () => {
+      const diff = computeDiff(
+        [createVuln('src/a.ts', 1, 'hardcoded_secret', 'critical')],
+        createBaseline([])
+      )
+
+      expect(hasNewBlockingIssues(diff)).toBe(true)
+    })
+
+    it('should return true when there are new high findings', () => {
+      const diff = computeDiff(
+        [createVuln('src/a.ts', 1, 'sql_injection', 'high')],
+        createBaseline([])
+      )
+
+      expect(hasNewBlockingIssues(diff)).toBe(true)
+    })
+
+    it('should return false when there are only new medium/low/info findings', () => {
+      const diff = computeDiff(
+        [
+          createVuln('src/a.ts', 1, 'xss', 'medium'),
+          createVuln('src/b.ts', 2, 'data_exposure', 'low'),
+          createVuln('src/c.ts', 3, 'ai_pattern', 'info'),
+        ],
+        createBaseline([])
+      )
+
+      expect(hasNewBlockingIssues(diff)).toBe(false)
+    })
+
+    it('should return false when there are no new findings', () => {
+      const diff = computeDiff([], createBaseline([]))
+
+      expect(hasNewBlockingIssues(diff)).toBe(false)
+    })
+  })
+
+  describe('formatDiffSummary', () => {
+    it('should format a summary with all categories', () => {
+      const diff = computeDiff(
+        [
+          createVuln('src/a.ts', 1, 'hardcoded_secret', 'critical'),
+          createVuln('src/b.ts', 2, 'xss', 'high'),
+        ],
+        createBaseline([
+          {
+            hash: 'fixedhash1234567',
+            filePath: 'src/fixed.ts',
+            lineNumber: 5,
+            category: 'sql_injection',
+            severity: 'high',
+            title: 'Fixed finding',
+          },
+        ])
+      )
+
+      const summary = formatDiffSummary(diff)
+
+      expect(summary).toContain('2 new')
+      expect(summary).toContain('1 fixed')
+    })
+
+    it('should omit zero counts', () => {
+      const diff = computeDiff(
+        [createVuln('src/a.ts', 1, 'hardcoded_secret', 'critical')],
+        createBaseline([])
+      )
+
+      const summary = formatDiffSummary(diff)
+
+      expect(summary).toContain('1 new')
+      expect(summary).not.toContain('fixed')
+      expect(summary).not.toContain('existing')
+    })
+  })
+})

package/src/baseline/__tests__/manager.test.ts

@@ -0,0 +1,225 @@
+/**
+ * Baseline Manager Tests
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'fs'
+import { join } from 'path'
+import { tmpdir } from 'os'
+import { BaselineManager } from '../manager'
+import type { ScanResult } from '../../types'
+import type { BaselineData } from '../types'
+
+describe('BaselineManager', () => {
+  let testDir: string
+  let manager: BaselineManager
+
+  beforeEach(() => {
+    // Create a unique temp directory for each test
+    testDir = join(tmpdir(), `baseline-test-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+    mkdirSync(testDir, { recursive: true })
+    manager = new BaselineManager({ projectPath: testDir })
+  })
+
+  afterEach(() => {
+    // Clean up test directory
+    try {
+      rmSync(testDir, { recursive: true, force: true })
+    } catch {
+      // Ignore cleanup errors
+    }
+  })
+
+  describe('loadBaseline', () => {
+    it('should return found: false when no baseline exists', () => {
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(false)
+      expect(result.baseline).toBeUndefined()
+      expect(result.error).toBeUndefined()
+    })
+
+    it('should load a valid baseline', () => {
+      // Create a valid baseline file
+      const baseline: BaselineData = {
+        version: 1,
+        createdAt: '2024-01-15T10:00:00.000Z',
+        commit: 'abc1234',
+        branch: 'main',
+        findings: [
+          {
+            hash: 'abcd1234abcd1234',
+            filePath: 'src/test.ts',
+            lineNumber: 10,
+            category: 'hardcoded_secret',
+            severity: 'critical',
+            title: 'Hardcoded API key',
+          },
+        ],
+        stats: {
+          total: 1,
+          critical: 1,
+          high: 0,
+          medium: 0,
+          low: 0,
+          info: 0,
+        },
+      }
+
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), JSON.stringify(baseline))
+
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(true)
+      expect(result.baseline).toEqual(baseline)
+      expect(result.error).toBeUndefined()
+    })
+
+    it('should return error for invalid JSON', () => {
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), 'not valid json')
+
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(false)
+      expect(result.error).toContain('Failed to parse baseline')
+    })
+
+    it('should return error for unsupported version', () => {
+      const baseline = {
+        version: 99,
+        createdAt: '2024-01-15T10:00:00.000Z',
+        findings: [],
+        stats: { total: 0, critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+      }
+
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), JSON.stringify(baseline))
+
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(false)
+      expect(result.error).toContain('Unsupported baseline version')
+    })
+
+    it('should return error when findings array is missing', () => {
+      const baseline = {
+        version: 1,
+        createdAt: '2024-01-15T10:00:00.000Z',
+        stats: { total: 0, critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+      }
+
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), JSON.stringify(baseline))
+
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(false)
+      expect(result.error).toContain('missing findings array')
+    })
+  })
+
+  describe('saveBaseline', () => {
+    it('should save a baseline from scan result', () => {
+      const scanResult: ScanResult = {
+        repoName: 'test/repo',
+        repoUrl: 'https://github.com/test/repo',
+        branch: 'main',
+        filesScanned: 10,
+        filesSkipped: 2,
+        vulnerabilities: [
+          {
+            filePath: 'src/test.ts',
+            lineNumber: 10,
+            category: 'hardcoded_secret',
+            severity: 'critical',
+            title: 'Hardcoded API key',
+            description: 'Test description',
+            confidence: 'high',
+            layer: 1,
+            lineContent: 'const API_KEY = "sk-1234567890"',
+          },
+        ],
+        severityCounts: { critical: 1, high: 0, medium: 0, low: 0, info: 0 },
+        categoryCounts: {},
+        hasBlockingIssues: true,
+        scanDuration: 1000,
+        timestamp: '2024-01-15T10:00:00.000Z',
+      }
+
+      const result = manager.saveBaseline(scanResult, { scanDepth: 'local' })
+
+      expect(result.success).toBe(true)
+      expect(existsSync(result.path)).toBe(true)
+
+      // Verify saved content
+      const content = readFileSync(result.path, 'utf-8')
+      const baseline = JSON.parse(content) as BaselineData
+
+      expect(baseline.version).toBe(1)
+      expect(baseline.findings).toHaveLength(1)
+      expect(baseline.findings[0].title).toBe('Hardcoded API key')
+      expect(baseline.stats.critical).toBe(1)
+      expect(baseline.scanDepth).toBe('local')
+    })
+
+    it('should create .oculum directory if it does not exist', () => {
+      const scanResult: ScanResult = {
+        repoName: 'test/repo',
+        repoUrl: 'https://github.com/test/repo',
+        branch: 'main',
+        filesScanned: 0,
+        filesSkipped: 0,
+        vulnerabilities: [],
+        severityCounts: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+        categoryCounts: {},
+        hasBlockingIssues: false,
+        scanDuration: 100,
+        timestamp: '2024-01-15T10:00:00.000Z',
+      }
+
+      expect(existsSync(join(testDir, '.oculum'))).toBe(false)
+
+      const result = manager.saveBaseline(scanResult)
+
+      expect(result.success).toBe(true)
+      expect(existsSync(join(testDir, '.oculum'))).toBe(true)
+    })
+  })
+
+  describe('clearBaseline', () => {
+    it('should return success with existed: false when no baseline exists', () => {
+      const result = manager.clearBaseline()
+      expect(result.success).toBe(true)
+      expect(result.existed).toBe(false)
+    })
+
+    it('should delete existing baseline', () => {
+      // Create baseline file
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), '{}')
+
+      expect(existsSync(join(testDir, '.oculum/baseline.json'))).toBe(true)
+
+      const result = manager.clearBaseline()
+
+      expect(result.success).toBe(true)
+      expect(result.existed).toBe(true)
+      expect(existsSync(join(testDir, '.oculum/baseline.json'))).toBe(false)
+    })
+  })
+
+  describe('hasBaseline', () => {
+    it('should return false when no baseline exists', () => {
+      expect(manager.hasBaseline()).toBe(false)
+    })
+
+    it('should return true when baseline exists', () => {
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), '{}')
+
+      expect(manager.hasBaseline()).toBe(true)
+    })
+  })
+
+  describe('getBaselinePath', () => {
+    it('should return correct path', () => {
+      expect(manager.getBaselinePath()).toBe(join(testDir, '.oculum/baseline.json'))
+    })
+  })
+})