@oculum/scanner 1.0.12 → 1.0.13

package/src/layer3/anthropic/request-builder.ts

@@ -1,150 +0,0 @@
-/**
- * Request Builders for AI Validation
- *
- * Functions for building validation requests with full file context.
- */
-
-import type { Vulnerability, ScanFile } from '../../types'
-import type { ProjectContext } from '../../utils/project-context-builder'
-import { getFileValidationContext } from '../../utils/project-context-builder'
-import { getLanguageFromPath } from './utils/path-helpers'
-
-// ============================================================================
-// Single-File Request Builder
-// ============================================================================
-
-/**
- * Build a high-context validation request with full file content
- */
-export function buildHighContextValidationRequest(
-  file: ScanFile,
-  findings: Vulnerability[],
-  projectContext: ProjectContext
-): string {
-  // Add line numbers to full file content
-  const numberedContent = file.content
-    .split('\n')
-    .map((line, i) => `${String(i + 1).padStart(4, ' ')} | ${line}`)
-    .join('\n')
-
-  // Build candidate findings list
-  const candidatesText = findings.map((f, idx) => {
-    return `### Candidate ${idx}
-- **Rule**: ${f.title}
-- **Category**: ${f.category}
-- **Original Severity**: ${f.severity}
-- **Line**: ${f.lineNumber}
-- **Detection Layer**: ${f.layer}
-- **Description**: ${f.description}
-- **Flagged Code**: \`${f.lineContent.trim()}\``
-  }).join('\n\n')
-
-  // Get file-specific context
-  const fileContext = getFileValidationContext(file, projectContext)
-
-  return `## Project Context
-${projectContext.summary}
-
-${fileContext}
-
-## Full File Content
-\`\`\`${file.language || getLanguageFromPath(file.path)}
-${numberedContent}
-\`\`\`
-
-## Candidate Findings to Validate (${findings.length} total)
-
-${candidatesText}
-
----
-
-Please validate each candidate finding. Return a JSON array with your decision for each.
-Remember: Be AGGRESSIVE in rejecting false positives. Use the full file context and project architecture to make informed decisions.`
-}
-
-// ============================================================================
-// Multi-File Request Builder (Phase 2 Optimization)
-// ============================================================================
-
-/**
- * Build a multi-file validation request (Phase 2 optimization)
- * Batches multiple files into a single API call to reduce overhead
- */
-export function buildMultiFileValidationRequest(
-  fileDataList: Array<{ file: ScanFile; findings: Vulnerability[] }>,
-  projectContext: ProjectContext
-): string {
-  const filesContent = fileDataList.map(({ file, findings }, fileIndex) => {
-    // Add line numbers to full file content
-    const numberedContent = file.content
-      .split('\n')
-      .map((line, i) => `${String(i + 1).padStart(4, ' ')} | ${line}`)
-      .join('\n')
-
-    // Build candidate findings list with file-specific indices
-    const candidatesText = findings.map((f, idx) => {
-      return `### Candidate ${idx}
-- **Rule**: ${f.title}
-- **Category**: ${f.category}
-- **Original Severity**: ${f.severity}
-- **Line**: ${f.lineNumber}
-- **Detection Layer**: ${f.layer}
-- **Description**: ${f.description}
-- **Flagged Code**: \`${f.lineContent.trim()}\``
-    }).join('\n\n')
-
-    // Get file-specific context
-    const fileContext = getFileValidationContext(file, projectContext)
-
-    return `
-================================================================================
-FILE ${fileIndex + 1}: ${file.path}
-================================================================================
-
-${fileContext}
-
-### Full File Content
-\`\`\`${file.language || getLanguageFromPath(file.path)}
-${numberedContent}
-\`\`\`
-
-### Candidate Findings to Validate (${findings.length} total)
-
-${candidatesText}`
-  }).join('\n\n')
-
-  return `## Project Context
-${projectContext.summary}
-
-${filesContent}
-
----
-
-## Response Format
-
-For EACH file, provide a JSON object with the file path and validation results.
-Return a JSON array where each element has:
-- "file": the file path (e.g., "${fileDataList[0]?.file.path || 'path/to/file.ts'}")
-- "validations": array of validation results for that file's candidates
-
-Example response format:
-\`\`\`json
-[
-  {
-    "file": "src/auth.ts",
-    "validations": [
-      { "index": 0, "keep": true, "adjustedSeverity": "medium", "notes": "Protected by middleware" },
-      { "index": 1, "keep": false }
-    ]
-  },
-  {
-    "file": "src/api.ts",
-    "validations": [
-      { "index": 0, "keep": true, "notes": "User input flows to SQL query" }
-    ]
-  }
-]
-\`\`\`
-
-Remember: Be AGGRESSIVE in rejecting false positives. Use the full file context and project architecture to make informed decisions.`
-}

package/src/layer3/index.ts

@@ -1,168 +0,0 @@
-/**
- * Layer 3: AI Semantic Analysis
- * Deep security analysis using Claude AI and package verification
- */
-
-import type { Vulnerability, ScanFile, CancellationToken } from '../types'
-import { batchAnalyzeWithAI, type Layer3Context } from './anthropic'
-import { checkPackages } from './package-check'
-import { checkPackageAdvisories } from './osv-check'
-
-export interface Layer3Result {
-  vulnerabilities: Vulnerability[]
-  filesScanned: number
-  duration: number
-  aiAnalyzed: number
-}
-
-// File extensions that benefit most from AI analysis
-const AI_PRIORITY_EXTENSIONS = [
-  '.ts', '.tsx', '.js', '.jsx', '.mjs',
-  '.py', '.rb', '.php', '.go',
-]
-
-// Max files to send to AI (to control costs)
-const MAX_AI_FILES = 10
-
-// Max file size for AI analysis (smaller than general limit)
-const MAX_AI_FILE_SIZE = 30 * 1024 // 30KB
-
-export interface Layer3Options {
-  /** Enable AI analysis */
-  enableAI?: boolean
-  /** Maximum files to analyze with AI (overrides default) */
-  maxFiles?: number
-  /** Project context for auth-aware analysis */
-  projectContext?: Layer3Context
-  /** Cancellation token for aborting scans */
-  cancellationToken?: CancellationToken
-}
-
-export async function runLayer3Scan(
-  files: ScanFile[],
-  options: Layer3Options = {}
-): Promise<Layer3Result> {
-  const startTime = Date.now()
-  const vulnerabilities: Vulnerability[] = []
-  let aiAnalyzedCount = 0
-
-  // Use provided maxFiles or default
-  const maxAIFiles = options.maxFiles ?? MAX_AI_FILES
-
-  // Check for cancellation before package check
-  if (options.cancellationToken?.cancelled) {
-    return {
-      vulnerabilities: [],
-      filesScanned: files.length,
-      duration: Date.now() - startTime,
-      aiAnalyzed: 0,
-    }
-  }
-
-  // 1. Check packages for hallucination/risk (package.json and requirements.txt)
-  const packageManifests = files.filter(f =>
-    f.path.endsWith('package.json') ||
-    f.path.endsWith('requirements.txt')
-  )
-
-  for (const file of packageManifests) {
-    // Check for cancellation in package loop
-    if (options.cancellationToken?.cancelled) break
-
-    // Run hallucination/risk check (package-check only handles package.json)
-    if (file.path.endsWith('package.json')) {
-      const packageFindings = await checkPackages(file.content, file.path)
-      vulnerabilities.push(...packageFindings)
-    }
-
-    // Run OSV advisory check (handles both npm and Python)
-    const osvFindings = await checkPackageAdvisories(file.content, file.path)
-    vulnerabilities.push(...osvFindings)
-  }
-
-  // Check for cancellation before AI analysis
-  if (options.cancellationToken?.cancelled) {
-    return {
-      vulnerabilities,
-      filesScanned: files.length,
-      duration: Date.now() - startTime,
-      aiAnalyzed: 0,
-    }
-  }
-
-  // 2. AI Analysis (if enabled)
-  if (options.enableAI !== false) {
-    // Select files for AI analysis
-    const aiCandidates = files
-      .filter(f => {
-        // Must be a priority extension
-        const hasPriorityExt = AI_PRIORITY_EXTENSIONS.some(ext => f.path.endsWith(ext))
-        // Must be under size limit
-        const underSizeLimit = f.size <= MAX_AI_FILE_SIZE
-        // Skip test files
-        const isNotTest = !f.path.includes('.test.') && 
-                          !f.path.includes('.spec.') &&
-                          !f.path.includes('__tests__')
-        return hasPriorityExt && underSizeLimit && isNotTest
-      })
-      // Prioritize files that look like they handle user input
-      .sort((a, b) => {
-        const aScore = getAIPriorityScore(a)
-        const bScore = getAIPriorityScore(b)
-        return bScore - aScore
-      })
-      .slice(0, maxAIFiles)
-
-    if (aiCandidates.length > 0) {
-      console.log(`[Layer 3] Analyzing ${aiCandidates.length} files with AI...`)
-      
-      try {
-        const aiFindings = await batchAnalyzeWithAI(aiCandidates, options.projectContext)
-        vulnerabilities.push(...aiFindings)
-        aiAnalyzedCount = aiCandidates.length
-      } catch (error) {
-        console.error('[Layer 3] AI analysis failed:', error)
-      }
-    }
-  }
-
-  return {
-    vulnerabilities,
-    filesScanned: files.length,
-    duration: Date.now() - startTime,
-    aiAnalyzed: aiAnalyzedCount,
-  }
-}
-
-// Score files by likelihood of containing security-relevant code
-function getAIPriorityScore(file: ScanFile): number {
-  let score = 0
-  const content = file.content.toLowerCase()
-  const path = file.path.toLowerCase()
-
-  // Path-based scoring
-  if (path.includes('/api/') || path.includes('/routes/')) score += 10
-  if (path.includes('auth') || path.includes('login')) score += 8
-  if (path.includes('middleware')) score += 7
-  if (path.includes('controller')) score += 6
-  if (path.includes('handler')) score += 5
-  if (path.includes('service')) score += 4
-
-  // Content-based scoring (indicators of security-relevant code)
-  if (content.includes('req.query') || content.includes('req.params')) score += 5
-  if (content.includes('req.body')) score += 5
-  if (content.includes('searchparams')) score += 4
-  if (content.includes('exec(') || content.includes('eval(')) score += 10
-  if (content.includes('innerhtml') || content.includes('dangerouslysetinnerhtml')) score += 8
-  if (content.includes('sql') || content.includes('query(')) score += 6
-  if (content.includes('password') || content.includes('token')) score += 4
-  if (content.includes('authenticate') || content.includes('authorize')) score += 5
-  if (content.includes('redirect')) score += 3
-  if (content.includes('cookie') || content.includes('session')) score += 4
-
-  return score
-}
-
-export { analyzeWithAI, batchAnalyzeWithAI, type Layer3Context } from './anthropic'
-export { checkPackages } from './package-check'
-export { checkPackageAdvisories } from './osv-check'