@oh-my-pi/pi-coding-agent 17.1.8 → 17.2.1

package/src/security/importers/codex-security.ts

@@ -0,0 +1,387 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import type {
+	SecurityCoverage,
+	SecurityEvidence,
+	SecurityFinding,
+	SecurityLocation,
+	SecurityProducer,
+	SecurityProvenance,
+	SecurityScan,
+	SecurityScanBundle,
+	SecurityTarget,
+	SecurityUpstreamProvenance,
+} from "../contracts";
+import {
+	createSecurityEvidenceId,
+	createSecurityFindingFingerprint,
+	createSecurityFindingId,
+	createSecurityOccurrenceId,
+	createSecurityScanId,
+	encodeSecurityProjectKey,
+	parseSecurityScanBundle,
+} from "../contracts";
+
+interface CodexManifest {
+	documentType?: string;
+	schemaVersion?: string;
+	scan?: {
+		id?: string;
+		producer?: { name?: string; version?: string };
+		status?: string;
+		startedAt?: string;
+		completedAt?: string;
+		target?: Record<string, unknown>;
+		scope?: { includePaths?: unknown; excludePaths?: unknown };
+	};
+}
+
+interface CodexFinding {
+	findingId?: string;
+	occurrenceId?: string;
+	ruleId?: string;
+	identity?: { anchor?: string };
+	fingerprints?: { algorithm?: string; primary?: string };
+	title?: string;
+	summary?: string;
+	severity?: { level?: string; score?: number; scoringSystem?: string; vector?: string; rationale?: string };
+	confidence?: { level?: string; rationale?: string };
+	taxonomy?: { category?: string; cwe?: unknown };
+	locations?: Array<{ path?: string; startLine?: number; endLine?: number; role?: string }>;
+	codeEvidence?: Array<{
+		id?: string;
+		label?: string;
+		path?: string;
+		startLine?: number;
+		endLine?: number;
+		role?: string;
+		code?: string;
+		explanation?: string;
+	}>;
+	remediation?: string;
+	validation?: Record<string, unknown> | null;
+	provenance?: Record<string, unknown>;
+	extensions?: Record<string, unknown>;
+}
+
+interface CodexFindingsDocument {
+	documentType?: string;
+	schemaVersion?: string;
+	scanId?: string;
+	findings?: CodexFinding[];
+}
+
+interface CodexCoverageDocument {
+	documentType?: string;
+	schemaVersion?: string;
+	scanId?: string;
+	mode?: string;
+	completeness?: string;
+	inventoryStrategy?: string;
+	includePaths?: unknown;
+	excludePaths?: unknown;
+	surfaces?: unknown;
+	explicitExclusions?: unknown;
+	deferred?: unknown;
+	openQuestions?: unknown;
+}
+
+interface CodexFixtureProvenance {
+	repository?: string;
+	revision?: string;
+	packageVersion?: string;
+	pluginVersion?: string;
+	archiveSha256?: string;
+}
+
+export interface CodexSecurityImportOptions {
+	repositoryRoot: string;
+	createdAt?: string;
+	createScanId?: () => string;
+}
+
+async function readJson<T>(filePath: string): Promise<T> {
+	return JSON.parse(await Bun.file(filePath).text()) as T;
+}
+
+function stringArray(value: unknown): string[] {
+	return Array.isArray(value) ? value.filter((item): item is string => typeof item === "string") : [];
+}
+
+function importedLocationPath(value: string): string {
+	const normalized = value.replaceAll("\\", "/").replace(/^\.\//, "");
+	if (
+		!normalized ||
+		normalized.startsWith("/") ||
+		/^[a-zA-Z]:\//.test(normalized) ||
+		normalized.split("/").includes("..")
+	) {
+		throw new Error(`Codex Security bundle locations must be repository-relative: ${value}`);
+	}
+	return normalized;
+}
+
+function locationsForFinding(finding: CodexFinding): SecurityLocation[] {
+	const locations: SecurityLocation[] = [];
+	for (const location of finding.locations ?? []) {
+		if (typeof location.path !== "string" || typeof location.startLine !== "number") continue;
+		const normalized: SecurityLocation = {
+			path: importedLocationPath(location.path),
+			startLine: location.startLine,
+		};
+		if (location.endLine !== undefined) normalized.endLine = location.endLine;
+		if (location.role !== undefined) normalized.role = location.role;
+		locations.push(normalized);
+	}
+	return locations.length > 0 ? locations : [{ path: "unknown", startLine: 1, role: "unknown" }];
+}
+const canonicalValidationStatuses: Record<string, true> = {
+	unvalidated: true,
+	validated: true,
+	rejected: true,
+	partial: true,
+	error: true,
+};
+
+function validationStatus(
+	validation: Record<string, unknown> | null | undefined,
+): SecurityFinding["validation"]["status"] {
+	const status = validation?.status;
+	return typeof status === "string" && canonicalValidationStatuses[status] === true
+		? (status as SecurityFinding["validation"]["status"])
+		: "unvalidated";
+}
+
+function mapCoverage(document: CodexCoverageDocument): SecurityCoverage {
+	const allowedModes = new Set(["repository", "scoped_path", "diff", "working_tree", "deep_repository"]);
+	const mode = allowedModes.has(document.mode ?? "")
+		? (document.mode as SecurityCoverage["mode"])
+		: document.mode === "commit" || document.mode === "branch_diff"
+			? "diff"
+			: "imported";
+	const completeness = ["complete", "partial", "unknown"].includes(document.completeness ?? "")
+		? (document.completeness as SecurityCoverage["completeness"])
+		: "unknown";
+	const inventoryStrategy = ["repository", "scoped_path", "diff", "directory", "custom"].includes(
+		document.inventoryStrategy ?? "",
+	)
+		? (document.inventoryStrategy as SecurityCoverage["inventoryStrategy"])
+		: "imported";
+	const coverage: SecurityCoverage = {
+		mode,
+		completeness,
+		inventoryStrategy,
+		includePaths: stringArray(document.includePaths),
+		excludePaths: stringArray(document.excludePaths),
+		surfaces: Array.isArray(document.surfaces) ? (document.surfaces as SecurityCoverage["surfaces"]) : [],
+		explicitExclusions: Array.isArray(document.explicitExclusions)
+			? (document.explicitExclusions as SecurityCoverage["explicitExclusions"])
+			: [],
+		deferred: Array.isArray(document.deferred) ? (document.deferred as SecurityCoverage["deferred"]) : [],
+	};
+	if (Array.isArray(document.openQuestions)) {
+		coverage.openQuestions = document.openQuestions as SecurityCoverage["openQuestions"];
+	}
+	return coverage;
+}
+
+export async function importCodexSecurityBundle(
+	bundleDirectory: string,
+	options: CodexSecurityImportOptions,
+): Promise<SecurityScanBundle> {
+	const root = path.resolve(bundleDirectory);
+	const manifest = await readJson<CodexManifest>(path.join(root, "scan-manifest.json"));
+	const findingsDocument = await readJson<CodexFindingsDocument>(path.join(root, "findings.json"));
+	const coverageDocument = await readJson<CodexCoverageDocument>(path.join(root, "coverage.json"));
+	if (manifest.documentType !== "codex-security.scan-manifest" || manifest.schemaVersion !== "1.0") {
+		throw new Error("Unsupported Codex Security scan manifest");
+	}
+	if (findingsDocument.documentType !== "codex-security.findings" || findingsDocument.schemaVersion !== "1.0") {
+		throw new Error("Unsupported Codex Security findings document");
+	}
+	if (coverageDocument.documentType !== "codex-security.coverage" || coverageDocument.schemaVersion !== "1.0") {
+		throw new Error("Unsupported Codex Security coverage document");
+	}
+	if (
+		!manifest.scan?.id ||
+		findingsDocument.scanId !== manifest.scan.id ||
+		coverageDocument.scanId !== manifest.scan.id
+	) {
+		throw new Error("Codex Security bundle scan IDs do not agree");
+	}
+	const fixtureProvenance = await readJson<CodexFixtureProvenance>(path.join(root, "PROVENANCE.json")).catch(
+		(): CodexFixtureProvenance => ({}),
+	);
+	const scanId = options.createScanId?.() ?? createSecurityScanId();
+	const createdAt = options.createdAt ?? manifest.scan.startedAt ?? new Date().toISOString();
+	const canonicalRoot = await fs.realpath(path.resolve(options.repositoryRoot));
+	const producer: SecurityProducer = {
+		kind: "codex-security-bundle",
+		name: manifest.scan.producer?.name || "codex-security",
+		vendor: "openai",
+	};
+	if (manifest.scan.producer?.version !== undefined) producer.version = manifest.scan.producer.version;
+	if (fixtureProvenance.revision !== undefined) producer.revision = fixtureProvenance.revision;
+	if (fixtureProvenance.pluginVersion !== undefined) producer.pluginVersion = fixtureProvenance.pluginVersion;
+	const upstream: SecurityUpstreamProvenance = {};
+	if (fixtureProvenance.repository !== undefined) upstream.repository = fixtureProvenance.repository;
+	if (fixtureProvenance.revision !== undefined) upstream.revision = fixtureProvenance.revision;
+	if (fixtureProvenance.packageVersion !== undefined) upstream.packageVersion = fixtureProvenance.packageVersion;
+	if (fixtureProvenance.pluginVersion !== undefined) upstream.pluginVersion = fixtureProvenance.pluginVersion;
+	if (fixtureProvenance.archiveSha256 !== undefined) upstream.archiveSha256 = fixtureProvenance.archiveSha256;
+	const findings: SecurityFinding[] = [];
+	for (const source of findingsDocument.findings ?? []) {
+		const ruleId = source.ruleId || "codex-security.unknown";
+		const category = source.taxonomy?.category || ruleId.split(/[./-]/)[0] || "security";
+		const hasSourceLocations = (source.locations ?? []).some(
+			location => typeof location.path === "string" && typeof location.startLine === "number",
+		);
+		const locations = locationsForFinding(source);
+		const anchor =
+			source.identity?.anchor ||
+			source.fingerprints?.primary ||
+			(!hasSourceLocations ? source.findingId : undefined);
+		const fingerprint = createSecurityFindingFingerprint({
+			ruleId,
+			category,
+			anchor,
+			locations,
+		});
+		const evidence: SecurityEvidence[] = (source.codeEvidence ?? []).map((item, index) => {
+			const entry: SecurityEvidence = {
+				id: createSecurityEvidenceId(fingerprint, item.label || item.id || "code evidence", index),
+				kind: "code",
+				label: item.label || item.id || `Evidence ${index + 1}`,
+				explanation: item.explanation || "",
+			};
+			if (typeof item.path === "string" && typeof item.startLine === "number") {
+				const location: SecurityLocation = { path: importedLocationPath(item.path), startLine: item.startLine };
+				if (item.endLine !== undefined) location.endLine = item.endLine;
+				if (item.role !== undefined) location.role = item.role;
+				entry.location = location;
+			}
+			if (item.code !== undefined) entry.excerpt = item.code;
+			return entry;
+		});
+		const provenance: SecurityProvenance = {
+			producer,
+			createdAt,
+			importedAt: new Date().toISOString(),
+			sourceIds: {
+				scanId: manifest.scan.id,
+				...(source.findingId ? { findingId: source.findingId } : {}),
+				...(source.occurrenceId ? { occurrenceId: source.occurrenceId } : {}),
+			},
+			upstream,
+		};
+		if (source.fingerprints?.primary) {
+			provenance.vendorFingerprints = {
+				[source.fingerprints.algorithm || "codex-security/v1"]: source.fingerprints.primary,
+			};
+		}
+		if (source.provenance !== undefined) provenance.metadata = source.provenance;
+		const finding: SecurityFinding = {
+			id: createSecurityFindingId(fingerprint),
+			scanId,
+			fingerprint,
+			ruleId,
+			title: source.title || ruleId,
+			summary: source.summary || "",
+			severity: {
+				level: ["critical", "high", "medium", "low", "informational"].includes(source.severity?.level ?? "")
+					? (source.severity?.level as SecurityFinding["severity"]["level"])
+					: "informational",
+			},
+			confidence: {
+				level: ["high", "medium", "low"].includes(source.confidence?.level ?? "")
+					? (source.confidence?.level as SecurityFinding["confidence"]["level"])
+					: "medium",
+			},
+			taxonomy: { category, cwe: stringArray(source.taxonomy?.cwe) },
+			occurrences: [
+				{
+					id: createSecurityOccurrenceId(fingerprint, locations),
+					locations,
+					evidenceIds: evidence.map(item => item.id),
+				},
+			],
+			evidence,
+			validation: {
+				status: validationStatus(source.validation),
+				evidenceIds: [],
+			},
+			disposition: { status: "open" },
+			provenance,
+		};
+		if (anchor !== undefined) finding.anchor = anchor;
+		if (source.severity?.score !== undefined) finding.severity.score = source.severity.score;
+		if (source.severity?.scoringSystem !== undefined) finding.severity.scoringSystem = source.severity.scoringSystem;
+		if (source.severity?.vector !== undefined) finding.severity.vector = source.severity.vector;
+		if (source.severity?.rationale !== undefined) finding.severity.rationale = source.severity.rationale;
+		if (source.confidence?.rationale !== undefined) finding.confidence.rationale = source.confidence.rationale;
+		if (source.remediation !== undefined) finding.remediation = source.remediation;
+		if (source.validation) finding.validation.summary = JSON.stringify(source.validation);
+		if (source.extensions !== undefined) finding.extensions = source.extensions;
+		findings.push(finding);
+	}
+
+	const target = manifest.scan.target ?? {};
+	const sourceKind = String(target.kind ?? "");
+	const targetKind =
+		sourceKind === "git_diff" ? "ref_diff" : sourceKind === "git_worktree" ? "working_tree" : "imported";
+	const reportPath = path.join(root, "report.md");
+	const sarifPath = path.join(root, "exports", "results.sarif");
+	const report = await Bun.file(reportPath)
+		.text()
+		.catch(() => undefined);
+	const sarifText = await Bun.file(sarifPath)
+		.text()
+		.catch(() => undefined);
+	const scanProvenance: SecurityProvenance = {
+		producer,
+		createdAt,
+		importedAt: new Date().toISOString(),
+		sourceIds: { scanId: manifest.scan.id },
+		upstream,
+		metadata: { bundleDirectory: root },
+	};
+	const canonicalTarget: SecurityTarget = {
+		kind: targetKind,
+		repositoryRoot: canonicalRoot,
+		displayName: String(target.displayName ?? path.basename(canonicalRoot)),
+		includePaths: stringArray(manifest.scan.scope?.includePaths),
+		excludePaths: stringArray(manifest.scan.scope?.excludePaths),
+		treeDigest:
+			typeof target.snapshotDigest === "string"
+				? target.snapshotDigest
+				: Bun.SHA256.hash(JSON.stringify({ manifest, findingsDocument, coverageDocument }), "hex"),
+	};
+	if (typeof target.revision === "string") canonicalTarget.revision = target.revision;
+	if (typeof target.baseRevision === "string") canonicalTarget.baseRevision = target.baseRevision;
+	if (typeof target.headRevision === "string") canonicalTarget.headRevision = target.headRevision;
+	const scan: SecurityScan = {
+		documentType: "omp-security.scan",
+		schemaVersion: "1.0",
+		id: scanId,
+		projectKey: encodeSecurityProjectKey(canonicalRoot),
+		status: "completed",
+		createdAt,
+		completedAt: manifest.scan.completedAt ?? createdAt,
+		target: canonicalTarget,
+		producer,
+		provenance: scanProvenance,
+		findingIds: findings.map(finding => finding.id),
+		coverage: mapCoverage(coverageDocument),
+	};
+	if (manifest.scan.startedAt !== undefined) scan.startedAt = manifest.scan.startedAt;
+	if (scan.startedAt !== undefined) {
+		const runtimeMs = new Date(scan.completedAt ?? createdAt).getTime() - new Date(scan.startedAt).getTime();
+		if (Number.isFinite(runtimeMs) && runtimeMs >= 0) scan.metrics = { runtimeMs };
+	}
+	if (report !== undefined) scan.reportRef = "report.md";
+	if (sarifText !== undefined) scan.sarifRef = "results.sarif";
+	const bundle: SecurityScanBundle = { scan, findings };
+	if (report !== undefined) bundle.report = report;
+	if (sarifText !== undefined) bundle.sarif = JSON.parse(sarifText) as Record<string, unknown>;
+	return parseSecurityScanBundle(bundle);
+}

package/src/security/importers/index.ts

@@ -0,0 +1,2 @@
+export * from "./codex-security";
+export * from "./sarif";