@praneeth_54/agentdoctor 1.1.1 → 2.0.1

package/dist/core/secrets/scan.js

@@ -0,0 +1,172 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { readTextFile } from "../../utils/fs.js";
+import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
+const SECRET_PATTERNS = [
+    {
+        id: "aws-access-key",
+        re: /\bAKIA[0-9A-Z]{16}\b/g,
+        severity: "critical",
+        confidence: "high",
+    },
+    {
+        id: "generic-api-key",
+        re: /\b(?:api[_-]?key|secret[_-]?key|access[_-]?token)\s*[:=]\s*['"]?[A-Za-z0-9_-]{16,}['"]?/gi,
+        severity: "warning",
+        confidence: "medium",
+    },
+    {
+        id: "private-key-header",
+        re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+        severity: "critical",
+        confidence: "high",
+    },
+    {
+        id: "github-pat",
+        re: /\bghp_[A-Za-z0-9]{36}\b/g,
+        severity: "critical",
+        confidence: "high",
+    },
+];
+const SKIP_DIR = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "coverage",
+    ".agentdoctor",
+    "vendor",
+    ".next",
+]);
+const TEXT_EXT = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".json",
+    ".yml",
+    ".yaml",
+    ".md",
+    ".env",
+    ".txt",
+    ".toml",
+    ".ini",
+    ".cfg",
+    ".py",
+    ".go",
+    ".rs",
+    ".java",
+    ".kt",
+    ".php",
+    ".rb",
+    ".sh",
+]);
+function redactMatch(line, match) {
+    const idx = line.indexOf(match);
+    if (idx < 0) {
+        return "[REDACTED]";
+    }
+    const before = line.slice(0, idx).slice(-40);
+    const after = line.slice(idx + match.length).slice(0, 20);
+    return `${before}[REDACTED]${after}`.trim();
+}
+async function walkFiles(root, dir, out, limit) {
+    if (out.length >= limit)
+        return;
+    let entries;
+    try {
+        entries = await fs.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (out.length >= limit)
+            return;
+        if (entry.name.startsWith(".") && entry.name !== ".env" && entry.name !== ".env.local") {
+            if (SKIP_DIR.has(entry.name))
+                continue;
+        }
+        if (SKIP_DIR.has(entry.name))
+            continue;
+        const absolute = path.join(dir, entry.name);
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            await walkFiles(root, absolute, out, limit);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        const ext = path.extname(entry.name).toLowerCase();
+        if (!TEXT_EXT.has(ext) && !entry.name.startsWith(".env"))
+            continue;
+        out.push(absolute);
+    }
+}
+/**
+ * Opt-in content secret scan. Findings never include raw secret values.
+ */
+export async function scanSecrets(options) {
+    const root = resolveRepoRoot(options.root);
+    if (!options.enabled) {
+        return {
+            root,
+            enabled: false,
+            filesScanned: 0,
+            findings: [],
+            limitations: ["Content secret scanning disabled (pass --secrets to enable)"],
+        };
+    }
+    const maxFiles = options.maxFiles ?? 400;
+    const files = [];
+    await walkFiles(root, root, files, maxFiles);
+    const findings = [];
+    const limitations = [];
+    if (files.length >= maxFiles) {
+        limitations.push(`Scan capped at ${maxFiles} files`);
+    }
+    for (const absolute of files) {
+        // open+fstat+read via readTextFile — avoids exists/stat→read TOCTOU
+        const content = await readTextFile(absolute, 512 * 1024);
+        if (content === null)
+            continue;
+        const lines = content.split(/\r?\n/);
+        const rel = toPosixRelative(root, absolute);
+        for (let i = 0; i < lines.length; i += 1) {
+            const line = lines[i] ?? "";
+            for (const pattern of SECRET_PATTERNS) {
+                pattern.re.lastIndex = 0;
+                let match;
+                while ((match = pattern.re.exec(line)) !== null) {
+                    findings.push({
+                        file: rel,
+                        line: i + 1,
+                        ruleId: pattern.id,
+                        redactedSnippet: redactMatch(line, match[0] ?? ""),
+                        severity: pattern.severity,
+                        confidence: pattern.confidence,
+                    });
+                    if (findings.length >= 200) {
+                        limitations.push("Finding cap reached (200)");
+                        return {
+                            root,
+                            enabled: true,
+                            filesScanned: files.length,
+                            findings,
+                            limitations,
+                        };
+                    }
+                }
+            }
+        }
+    }
+    return {
+        root,
+        enabled: true,
+        filesScanned: files.length,
+        findings,
+        limitations,
+    };
+}

package/dist/coverage/cobertura.d.ts

@@ -0,0 +1,6 @@
+import { type NormalizedCoverage } from "./types.js";
+/**
+ * DOM-free Cobertura XML parser focused on class/@filename and line hits.
+ */
+export declare function parseCobertura(xml: string): NormalizedCoverage;
+export declare function isCoberturaXml(text: string): boolean;

package/dist/coverage/cobertura.js

@@ -0,0 +1,52 @@
+import { normalizeCoveragePath } from "./types.js";
+/**
+ * DOM-free Cobertura XML parser focused on class/@filename and line hits.
+ */
+export function parseCobertura(xml) {
+    const files = {};
+    const limitations = [
+        "Cobertura parser extracts class filename + line hits only (DOM-free regex)",
+        "No test→source mapping in standard Cobertura — test attribution is hybrid/heuristic",
+    ];
+    if (!xml.trim()) {
+        return { format: "cobertura", files, limitations: ["Empty Cobertura input", ...limitations] };
+    }
+    const classRe = /<class\b([^>]*)>([\s\S]*?)<\/class>/gi;
+    let classMatch;
+    while ((classMatch = classRe.exec(xml)) !== null) {
+        const attrs = classMatch[1] ?? "";
+        const body = classMatch[2] ?? "";
+        const filename = attrValue(attrs, "filename") ?? attrValue(attrs, "name") ?? "";
+        if (!filename)
+            continue;
+        const filePath = normalizeCoveragePath(filename);
+        const file = files[filePath] ?? {
+            path: filePath,
+            lines: {},
+            functions: [],
+        };
+        const lineRe = /<line\b([^>]*)\/?>/gi;
+        let lineMatch;
+        while ((lineMatch = lineRe.exec(body)) !== null) {
+            const lineAttrs = lineMatch[1] ?? "";
+            const number = Number(attrValue(lineAttrs, "number"));
+            const hits = Number(attrValue(lineAttrs, "hits") ?? "0");
+            if (!Number.isFinite(number))
+                continue;
+            file.lines[number] = Math.max(file.lines[number] ?? 0, Number.isFinite(hits) ? hits : 0);
+        }
+        files[filePath] = file;
+    }
+    return { format: "cobertura", files, limitations };
+}
+function attrValue(attrs, name) {
+    const re = new RegExp(`${name}\\s*=\\s*(["'])([\\s\\S]*?)\\1`, "i");
+    const m = attrs.match(re);
+    return m?.[2] ?? null;
+}
+export function isCoberturaXml(text) {
+    const sample = text.slice(0, 8000);
+    return (/<coverage\b/i.test(sample) ||
+        /<!DOCTYPE\s+coverage/i.test(sample) ||
+        (/<class\b/i.test(sample) && /<line\b/i.test(sample)));
+}

package/dist/coverage/istanbul.d.ts

@@ -0,0 +1,7 @@
+import { type NormalizedCoverage } from "./types.js";
+/**
+ * Istanbul / nyc / vitest coverage JSON (coverage-final.json style).
+ * Accepts a JSON string or already-parsed object.
+ * Supports optional testMap / coveredByTests when present.
+ */
+export declare function parseIstanbul(input: string | object): NormalizedCoverage;

package/dist/coverage/istanbul.js

@@ -0,0 +1,134 @@
+import { normalizeCoveragePath } from "./types.js";
+function asRecord(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+function looksLikeFileRecord(value) {
+    const rec = asRecord(value);
+    if (!rec)
+        return false;
+    return ("statementMap" in rec ||
+        "s" in rec ||
+        "fnMap" in rec ||
+        "f" in rec ||
+        typeof rec.path === "string");
+}
+function extractTests(rec) {
+    const fromMeta = rec.meta?.tests ?? rec.meta?.coveredByTests ?? [];
+    const direct = rec.coveredByTests ?? rec.tests ?? [];
+    return [...new Set([...fromMeta, ...direct].map(normalizeCoveragePath).filter(Boolean))].sort();
+}
+function collectTestMap(root) {
+    const raw = root.testMap ?? root.tests;
+    const map = asRecord(raw);
+    if (!map)
+        return undefined;
+    const out = {};
+    for (const [testPath, sources] of Object.entries(map)) {
+        if (!Array.isArray(sources))
+            continue;
+        const files = sources
+            .filter((s) => typeof s === "string")
+            .map(normalizeCoveragePath);
+        if (files.length)
+            out[normalizeCoveragePath(testPath)] = [...new Set(files)].sort();
+    }
+    return Object.keys(out).length ? out : undefined;
+}
+/**
+ * Istanbul / nyc / vitest coverage JSON (coverage-final.json style).
+ * Accepts a JSON string or already-parsed object.
+ * Supports optional testMap / coveredByTests when present.
+ */
+export function parseIstanbul(input) {
+    let root;
+    if (typeof input === "string") {
+        try {
+            root = JSON.parse(input);
+        }
+        catch (error) {
+            throw new Error(`Invalid Istanbul JSON: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    else if (input && typeof input === "object" && !Array.isArray(input)) {
+        root = input;
+    }
+    else {
+        throw new Error("Invalid Istanbul JSON: expected object or JSON string");
+    }
+    const candidate = asRecord(root.coverageMap) ?? asRecord(root.result) ?? asRecord(root.coverage) ?? root;
+    const files = {};
+    const limitations = [
+        "Istanbul statement/branch maps vary by version; line hits taken from s/statementMap when present",
+    ];
+    for (const [key, value] of Object.entries(candidate)) {
+        if (key === "testMap" || key === "tests" || key === "meta")
+            continue;
+        if (!looksLikeFileRecord(value))
+            continue;
+        const pathKey = normalizeCoveragePath(typeof value.path === "string" ? value.path : key.replace(/^.*:/, ""));
+        if (!pathKey)
+            continue;
+        const prev = files[pathKey];
+        const file = {
+            path: pathKey,
+            lines: { ...(prev?.lines ?? {}) },
+            functions: [...(prev?.functions ?? [])],
+            ...(prev?.coveredByTests ? { coveredByTests: [...prev.coveredByTests] } : {}),
+        };
+        const statementMap = value.statementMap ?? {};
+        const statements = value.s ?? {};
+        for (const [id, hits] of Object.entries(statements)) {
+            const loc = statementMap[id];
+            const line = loc?.start?.line ?? loc?.end?.line;
+            if (typeof line !== "number" || !Number.isFinite(hits))
+                continue;
+            file.lines[line] = Math.max(file.lines[line] ?? 0, Number(hits));
+        }
+        const fnMap = value.fnMap ?? {};
+        const fnHits = value.f ?? {};
+        for (const [id, hits] of Object.entries(fnHits)) {
+            const meta = fnMap[id];
+            const name = meta?.name || `fn_${id}`;
+            const line = meta?.decl?.start?.line ?? meta?.line ?? 0;
+            const existing = file.functions.find((f) => f.name === name);
+            if (existing) {
+                existing.hits = Math.max(existing.hits, Number(hits) || 0);
+                if (!existing.line && line)
+                    existing.line = line;
+            }
+            else {
+                file.functions.push({ name, line, hits: Number(hits) || 0 });
+            }
+        }
+        const tests = extractTests(value);
+        if (tests.length) {
+            file.coveredByTests = [...new Set([...(file.coveredByTests ?? []), ...tests])].sort();
+        }
+        files[pathKey] = file;
+    }
+    let testToFiles = collectTestMap(root) ?? collectTestMap(candidate);
+    for (const [source, cov] of Object.entries(files)) {
+        for (const test of cov.coveredByTests ?? []) {
+            testToFiles ??= {};
+            const list = testToFiles[test] ?? [];
+            if (!list.includes(source))
+                list.push(source);
+            testToFiles[test] = list.sort();
+        }
+    }
+    if (!testToFiles) {
+        limitations.push("Istanbul JSON had no test→source map — test attribution falls back to heuristics");
+    }
+    else {
+        limitations.push("Istanbul test→source map used where present");
+    }
+    return {
+        format: "istanbul",
+        files,
+        ...(testToFiles ? { testToFiles } : {}),
+        limitations,
+    };
+}

package/dist/coverage/lcov.d.ts

@@ -0,0 +1,7 @@
+import { type NormalizedCoverage } from "./types.js";
+/**
+ * Parse LCOV text into NormalizedCoverage.
+ * LCOV records source line/function hits only — no test→source map.
+ */
+export declare function parseLcov(text: string): NormalizedCoverage;
+export declare function isLcovText(text: string): boolean;

package/dist/coverage/lcov.js

@@ -0,0 +1,59 @@
+import { normalizeCoveragePath } from "./types.js";
+/**
+ * Parse LCOV text into NormalizedCoverage.
+ * LCOV records source line/function hits only — no test→source map.
+ */
+export function parseLcov(text) {
+    const files = {};
+    let current = null;
+    const limitations = [
+        "LCOV provides source line/function hits only — no test→source mapping",
+        "Test recommendation with LCOV uses hybrid naming/graph heuristics for test attribution",
+    ];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trimEnd();
+        if (line.startsWith("SF:")) {
+            const p = normalizeCoveragePath(line.slice(3).trim());
+            current = { path: p, lines: {}, functions: [] };
+            files[p] = current;
+        }
+        else if (line.startsWith("DA:") && current) {
+            const [ln, hits] = line.slice(3).split(",");
+            const n = Number(ln);
+            const h = Number(hits);
+            if (Number.isFinite(n) && Number.isFinite(h))
+                current.lines[n] = h;
+        }
+        else if (line.startsWith("FN:") && current) {
+            const body = line.slice(3);
+            const comma = body.indexOf(",");
+            if (comma < 0)
+                continue;
+            const n = Number(body.slice(0, comma));
+            const name = body.slice(comma + 1).trim();
+            if (Number.isFinite(n) && name) {
+                current.functions.push({ name, line: n, hits: 0 });
+            }
+        }
+        else if (line.startsWith("FNDA:") && current) {
+            const body = line.slice(5);
+            const comma = body.indexOf(",");
+            if (comma < 0)
+                continue;
+            const h = Number(body.slice(0, comma));
+            const name = body.slice(comma + 1).trim();
+            const fn = current.functions.find((f) => f.name === name);
+            if (fn && Number.isFinite(h))
+                fn.hits = h;
+        }
+        else if (line === "end_of_record") {
+            current = null;
+        }
+    }
+    return { format: "lcov", files, limitations };
+}
+export function isLcovText(text) {
+    const sample = text.slice(0, 4000);
+    return (/(^|\n)SF:/.test(sample) &&
+        (/(^|\n)DA:/.test(sample) || /(^|\n)end_of_record/.test(sample) || /(^|\n)TN:/.test(sample)));
+}

package/dist/coverage/load.d.ts

@@ -0,0 +1,9 @@
+import type { NormalizedCoverage } from "./types.js";
+export type { NormalizedCoverage, CoverageFormat, CoverageFile } from "./types.js";
+export { parseLcov } from "./lcov.js";
+export { parseIstanbul } from "./istanbul.js";
+export { parseCobertura } from "./cobertura.js";
+/**
+ * Load coverage from a file path, auto-detecting format by extension then content.
+ */
+export declare function loadCoverage(coveragePath: string): Promise<NormalizedCoverage>;

package/dist/coverage/load.js

@@ -0,0 +1,39 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { isCoberturaXml, parseCobertura } from "./cobertura.js";
+import { parseIstanbul } from "./istanbul.js";
+import { isLcovText, parseLcov } from "./lcov.js";
+export { parseLcov } from "./lcov.js";
+export { parseIstanbul } from "./istanbul.js";
+export { parseCobertura } from "./cobertura.js";
+/**
+ * Load coverage from a file path, auto-detecting format by extension then content.
+ */
+export async function loadCoverage(coveragePath) {
+    const abs = path.resolve(coveragePath);
+    let text;
+    try {
+        text = await fs.readFile(abs, "utf8");
+    }
+    catch (error) {
+        throw new Error(`Unable to read coverage file: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!text.trim()) {
+        throw new Error("Coverage file is empty");
+    }
+    const base = path.basename(abs).toLowerCase();
+    const ext = path.extname(abs).toLowerCase();
+    if (ext === ".lcov" || base === "lcov.info" || base.endsWith(".info") || isLcovText(text)) {
+        if (text.includes("SF:") || isLcovText(text))
+            return parseLcov(text);
+    }
+    if (ext === ".xml" || base.includes("cobertura") || isCoberturaXml(text)) {
+        return parseCobertura(text);
+    }
+    if (ext === ".json" || text.trimStart().startsWith("{")) {
+        return parseIstanbul(text);
+    }
+    if (text.includes("end_of_record"))
+        return parseLcov(text);
+    return parseIstanbul(text);
+}

package/dist/coverage/types.d.ts

@@ -0,0 +1,23 @@
+export type CoverageFormat = "lcov" | "istanbul" | "cobertura";
+export interface CoverageFunction {
+    name: string;
+    line: number;
+    hits: number;
+}
+export interface CoverageFile {
+    path: string;
+    lines: Record<number, number>;
+    functions: CoverageFunction[];
+    /** Optional test files known to cover this source (when format provides it). */
+    coveredByTests?: string[];
+}
+export interface NormalizedCoverage {
+    format: CoverageFormat;
+    files: Record<string, CoverageFile>;
+    /** Optional reverse map test → source files when available. */
+    testToFiles?: Record<string, string[]>;
+    limitations: string[];
+}
+export declare function normalizeCoveragePath(p: string): string;
+/** @deprecated use normalizeCoveragePath */
+export declare const normalizePath: typeof normalizeCoveragePath;

package/dist/coverage/types.js

@@ -0,0 +1,5 @@
+export function normalizeCoveragePath(p) {
+    return p.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+/** @deprecated use normalizeCoveragePath */
+export const normalizePath = normalizeCoveragePath;

package/dist/dashboard/server.d.ts

@@ -0,0 +1,24 @@
+export interface DashboardServerOptions {
+    root: string;
+    host?: string;
+    port?: number;
+    /** Read-only by default; mutating routes are never registered. */
+    readOnly?: boolean;
+    /**
+     * Unsafe opt-in to bind outside loopback. Not an enterprise security boundary.
+     * Query ?user= is a localDevIdentityHint only; role elevation requires AGENTDOCTOR_ALLOW_LOCAL_IDENTITY_HINT=1.
+     */
+    allowNonLoopback?: boolean;
+}
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Local read-only HTTP dashboard. Never applies Safe Fix or mutates the repo.
+ * Defaults to loopback binding; non-loopback requires explicit allowNonLoopback.
+ */
+export declare function startDashboardServer(options: DashboardServerOptions): Promise<{
+    host: string;
+    port: number;
+    close: () => Promise<void>;
+}>;
+/** Write a static snapshot HTML for offline viewing (optional helper). */
+export declare function writeDashboardSnapshot(rootInput: string, outputPath: string): Promise<string>;