@oculum/scanner 1.0.5 → 1.0.7

package/src/layer3/anthropic.ts

@@ -24,6 +24,49 @@ import { buildProjectContext, getFileValidationContext, type ProjectContext } fr
 // Import tier system for tier-aware auto-dismiss
 import { getTierForCategory, type DetectorTier } from '../tiers'
 
+// ============================================================================
+// Path Normalization Helpers (for AI response path matching)
+// ============================================================================
+
+/**
+ * Normalize a file path for comparison purposes.
+ * Handles common variations: ./src/file.ts, src/file.ts, /src/file.ts
+ */
+function normalizePathForComparison(path: string): string {
+  return path
+    .replace(/^\.\//, '')  // Remove leading ./
+    .replace(/^\//, '')    // Remove leading /
+    .replace(/\\/g, '/')   // Normalize Windows backslashes
+}
+
+/**
+ * Find a matching file path from expected paths, handling path format variations.
+ * AI responses may use different path formats than what we sent.
+ */
+function findMatchingFilePath(responsePath: string, expectedPaths: string[]): string | null {
+  // Exact match first
+  if (expectedPaths.includes(responsePath)) return responsePath
+
+  // Normalized match
+  const normalized = normalizePathForComparison(responsePath)
+  for (const expected of expectedPaths) {
+    if (normalizePathForComparison(expected) === normalized) {
+      console.log(`[AI Validation] Path fuzzy matched: "${responsePath}" -> "${expected}"`)
+      return expected
+    }
+  }
+
+  // Basename match (only if unique) - handles cases like "file.ts" matching "src/api/file.ts"
+  const basename = responsePath.split('/').pop() || responsePath
+  const matches = expectedPaths.filter(p => (p.split('/').pop() || p) === basename)
+  if (matches.length === 1) {
+    console.log(`[AI Validation] Path basename matched: "${responsePath}" -> "${matches[0]}"`)
+    return matches[0]
+  }
+
+  return null
+}
+
 // ============================================================================
 // Cost Monitoring Types
 // ============================================================================
@@ -949,15 +992,14 @@ For each candidate finding, return:
 {
   "index": <number>,
   "keep": true | false,
-  "adjustedSeverity": "critical" | "high" | "medium" | "low" | "info" | null,  // Only if keep=true
-  "notes": "<concise context for developer>"  // Only if keep=true, 1-2 sentences max
+  "notes": "<concise context>" | null,
+  "adjustedSeverity": "critical" | "high" | "medium" | "low" | "info" | null
 }
 \`\`\`
 
 **CRITICAL**: To minimize costs:
-- For \`keep: false\` (rejected): ONLY include \`index\` and \`keep\` fields. NO explanation needed.
-- For \`keep: true\` (accepted): Include \`notes\` field with brief context (10-30 words). Be concise.
-- Omit \`adjustedSeverity\` if keeping original severity (null is wasteful).
+- For \`keep: false\` (rejected): Set \`notes: null\` and \`adjustedSeverity: null\`. NO explanation needed.
+- For \`keep: true\` (accepted): Include \`notes\` field with brief context (10-30 words). Set \`adjustedSeverity: null\` if keeping original severity.
 
 ## Severity Guidelines
 - **critical/high**: Realistically exploitable, should block deploys - ONLY for clear vulnerabilities
@@ -1235,9 +1277,18 @@ async function validateWithOpenAI(
                             type: 'object',
                             properties: {
                               index: { type: 'number' },
-                              keep: { type: 'boolean' }
+                              keep: { type: 'boolean' },
+                              notes: {
+                                type: ['string', 'null'],
+                                default: null
+                              },
+                              adjustedSeverity: {
+                                type: ['string', 'null'],
+                                enum: ['critical', 'high', 'medium', 'low', 'info', null],
+                                default: null
+                              }
                             },
-                            required: ['index', 'keep'],
+                            required: ['index', 'keep', 'notes', 'adjustedSeverity'],
                             additionalProperties: false
                           }
                         }
@@ -1298,9 +1349,15 @@ async function validateWithOpenAI(
       let parsedContent: any
       try {
         parsedContent = JSON.parse(content)
+        console.log(`[OpenAI Debug] Raw parsed content keys:`, Object.keys(parsedContent))
         // Unwrap the validations array if present (from structured output)
         if (parsedContent.validations && Array.isArray(parsedContent.validations)) {
+          console.log(`[OpenAI Debug] Unwrapping 'validations' array with ${parsedContent.validations.length} items`)
           parsedContent = parsedContent.validations
+        } else if (Array.isArray(parsedContent)) {
+          console.log(`[OpenAI Debug] Content is already an array with ${parsedContent.length} items`)
+        } else {
+          console.log(`[OpenAI Debug] Content structure:`, typeof parsedContent, Array.isArray(parsedContent))
         }
       } catch (e) {
         console.warn('[OpenAI] Failed to parse JSON response:', e)
@@ -1314,39 +1371,53 @@ async function validateWithOpenAI(
         expectedFiles
       )
 
+      console.log(`[OpenAI] Batch ${batchNum} parsed ${validationResultsMap.size} file results from ${fileDataList.length} files`)
+      if (validationResultsMap.size === 0) {
+        console.warn(`[OpenAI] WARNING: No file results parsed! Content type: ${typeof parsedContent}, isArray: ${Array.isArray(parsedContent)}`)
+        if (Array.isArray(parsedContent) && parsedContent.length > 0) {
+          console.log(`[OpenAI] First item structure:`, Object.keys(parsedContent[0]))
+        }
+      }
+
+      // Log any missing files from the response (these will be REJECTED)
+      if (validationResultsMap.size !== fileDataList.length) {
+        const missing = fileDataList
+          .filter(({ filePath }) => !validationResultsMap.has(filePath))
+          .map(({ filePath }) => filePath)
+        if (missing.length > 0) {
+          console.warn(`[OpenAI] Missing ${missing.length} files from response (will be REJECTED): ${missing.join(', ')}`)
+        }
+      }
+
       // Apply results per file
       for (const { filePath, findings: fileFindings } of fileDataList) {
         const fileResults = validationResultsMap.get(filePath)
+        console.log(`[OpenAI] File ${filePath}: ${fileResults?.length || 0} validation results for ${fileFindings.length} findings`)
 
         if (!fileResults || fileResults.length === 0) {
           const singleFileResults = parseValidationResponse(content)
           if (singleFileResults.length > 0 && fileDataList.length === 1) {
-            const processedFindings = applyValidationResults(fileFindings, singleFileResults)
+            const { processed: processedFindings, dismissedCount } = applyValidationResults(fileFindings, singleFileResults)
+            statsLock.validatedFindings += processedFindings.length + dismissedCount
+            statsLock.dismissedFindings += dismissedCount
             for (const processed of processedFindings) {
-              statsLock.validatedFindings++
               if (processed.validationStatus === 'confirmed') statsLock.confirmedFindings++
-              else if (processed.validationStatus === 'dismissed') statsLock.dismissedFindings++
               else if (processed.validationStatus === 'downgraded') statsLock.downgradedFindings++
               batchFindings.push(processed)
             }
           } else {
-            for (const f of fileFindings) {
-              statsLock.validatedFindings++
-              statsLock.confirmedFindings++
-              batchFindings.push({
-                ...f,
-                validatedByAI: true,
-                validationStatus: 'confirmed' as ValidationStatus,
-                validationNotes: 'Kept by default - no explicit validation result',
-              })
-            }
+            // No validation results - REJECT all findings for this file (conservative approach)
+            console.warn(`[OpenAI] No validation results for ${filePath} - REJECTING ${fileFindings.length} findings`)
+            statsLock.validatedFindings += fileFindings.length
+            statsLock.dismissedFindings += fileFindings.length
+            // Don't add to batchFindings - findings are rejected
           }
         } else {
-          const processedFindings = applyValidationResults(fileFindings, fileResults)
+          const { processed: processedFindings, dismissedCount } = applyValidationResults(fileFindings, fileResults)
+          statsLock.validatedFindings += processedFindings.length + dismissedCount
+          statsLock.dismissedFindings += dismissedCount
           for (const processed of processedFindings) {
-            statsLock.validatedFindings++
             if (processed.validationStatus === 'confirmed') statsLock.confirmedFindings++
-            else if (processed.validationStatus === 'dismissed') statsLock.dismissedFindings++
             else if (processed.validationStatus === 'downgraded') statsLock.downgradedFindings++
             batchFindings.push(processed)
           }
@@ -1647,42 +1718,32 @@ export async function validateFindingsWithAI(
 
           if (singleFileResults.length > 0 && fileDataList.length === 1) {
             // Single file in batch, use single-file parsing
-            const processedFindings = applyValidationResults(findings, singleFileResults)
+            const { processed: processedFindings, dismissedCount } = applyValidationResults(findings, singleFileResults)
+            stats.validatedFindings += processedFindings.length + dismissedCount
+            stats.dismissedFindings += dismissedCount
             for (const processed of processedFindings) {
-              stats.validatedFindings++
               if (processed.validationStatus === 'confirmed') {
                 stats.confirmedFindings++
-              } else if (processed.validationStatus === 'dismissed') {
-                stats.dismissedFindings++
               } else if (processed.validationStatus === 'downgraded') {
                 stats.downgradedFindings++
               }
               validatedFindings.push(processed)
             }
           } else {
-            // Keep findings but mark as validation failed for this file
-            console.warn(`[AI Validation] No results for ${filePath}, keeping findings unvalidated`)
-            for (const f of findings) {
-              stats.validatedFindings++
-              stats.confirmedFindings++ // Keep by default
-              validatedFindings.push({
-                ...f,
-                validatedByAI: true,
-                validationStatus: 'confirmed' as ValidationStatus,
-                validationNotes: 'Kept by default - no explicit validation result',
-              })
-            }
+            // No validation results - REJECT all findings for this file (conservative approach)
+            console.warn(`[AI Validation] No results for ${filePath} - REJECTING ${findings.length} findings`)
+            stats.validatedFindings += findings.length
+            stats.dismissedFindings += findings.length
+            // Don't add to validatedFindings - findings are rejected
           }
         } else {
           // Apply validation results for this file
-          const processedFindings = applyValidationResults(findings, fileResults)
-
+          const { processed: processedFindings, dismissedCount } = applyValidationResults(findings, fileResults)
+          stats.validatedFindings += processedFindings.length + dismissedCount
+          stats.dismissedFindings += dismissedCount
           for (const processed of processedFindings) {
-            stats.validatedFindings++
             if (processed.validationStatus === 'confirmed') {
               stats.confirmedFindings++
-            } else if (processed.validationStatus === 'dismissed') {
-              stats.dismissedFindings++
             } else if (processed.validationStatus === 'downgraded') {
               stats.downgradedFindings++
             }
@@ -1985,7 +2046,15 @@ function parseMultiFileValidationResponse(
         continue
       }
 
-      const filePath = fileResult.file
+      // Use path normalization to match AI response paths to expected paths
+      const responsePath = fileResult.file
+      const matchedPath = findMatchingFilePath(responsePath, expectedFiles)
+
+      if (!matchedPath) {
+        console.warn(`[AI Validation] Multi-file: Could not match path "${responsePath}" to any expected file`)
+        continue
+      }
+
       const validations: ValidationResult[] = fileResult.validations
         .filter((item: any) =>
           typeof item.index === 'number' &&
@@ -1994,7 +2063,7 @@ function parseMultiFileValidationResponse(
         .map((item: any) => {
           // Normalize notes field: prefer new 'notes', fallback to legacy 'reason' or 'validationNotes'
           const notes = item.notes || item.validationNotes || item.reason || undefined
-          
+
           return {
             index: item.index,
             keep: item.keep,
@@ -2006,14 +2075,13 @@ function parseMultiFileValidationResponse(
           }
         })
 
-      resultMap.set(filePath, validations)
+      resultMap.set(matchedPath, validations)
     }
 
-    // Log any files that weren't in the response
-    for (const expectedFile of expectedFiles) {
-      if (!resultMap.has(expectedFile)) {
-        console.warn(`[AI Validation] Multi-file: No results for ${expectedFile}`)
-      }
+    // Log any files that weren't in the response (these will be REJECTED by default)
+    const missingFiles = expectedFiles.filter(f => !resultMap.has(f))
+    if (missingFiles.length > 0) {
+      console.warn(`[AI Validation] Multi-file: Missing ${missingFiles.length} files from response: ${missingFiles.join(', ')}`)
     }
 
   } catch (error) {
@@ -2029,22 +2097,20 @@ function parseMultiFileValidationResponse(
 function applyValidationResults(
   findings: Vulnerability[],
   validationResults: ValidationResult[]
-): Vulnerability[] {
+): { processed: Vulnerability[]; dismissedCount: number } {
   const processed: Vulnerability[] = []
+  let dismissedCount = 0
 
   for (let i = 0; i < findings.length; i++) {
     const finding = findings[i]
     const validation = validationResults.find(v => v.index === i)
 
     if (!validation) {
-      // No validation result - keep with warning
-      processed.push({
-        ...finding,
-        validatedByAI: true,
-        validationStatus: 'confirmed' as ValidationStatus,
-        validationNotes: 'No explicit validation result - kept by default',
-      })
-      continue
+      // No validation result - REJECT by default (conservative approach)
+      // If AI doesn't explicitly validate a finding, assume it's a false positive
+      console.warn(`[AI Validation] No result for finding ${i}: ${finding.title} - REJECTING`)
+      dismissedCount++
+      continue  // Don't add to processed - finding is removed
     }
 
     if (validation.keep) {
@@ -2074,11 +2140,12 @@ function applyValidationResults(
     } else {
       // Finding was dismissed - no need to log verbose reason (cost optimization)
       console.log(`[AI Validation] Rejected: ${finding.title} at ${finding.filePath}:${finding.lineNumber}`)
+      dismissedCount++
       // Don't add to processed - finding is removed
     }
   }
 
-  return processed
+  return { processed, dismissedCount }
 }
 
 /**