@praneeth_54/agentdoctor 1.1.1 → 2.0.1

package/dist/enforcement/runner.js

@@ -0,0 +1,460 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createHmac } from "node:crypto";
+import { execFile, spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { realpathSync } from "node:fs";
+import { evaluateAgentAction, EVALUATE_ONLY } from "../platform/firewall/evaluate.js";
+import { resolveRepoRoot } from "../utils/path.js";
+import { PathEscapeError, assertInsideRepo } from "../security/paths.js";
+const execFileAsync = promisify(execFile);
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_BUFFER = 1024 * 1024;
+const OUTPUT_TRUNCATE = 32_768;
+const ENV_ALLOWLIST = new Set(["PATH", "NODE_ENV", "HOME", "LANG"]);
+/**
+ * Parse a command string into argv without invoking a shell.
+ * Supports simple double/single quotes; rejects unclosed quotes.
+ */
+export function parseArgv(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return [];
+    const args = [];
+    let current = "";
+    let quote = null;
+    for (let i = 0; i < trimmed.length; i += 1) {
+        const ch = trimmed[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                current += ch;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (current.length > 0) {
+                args.push(current);
+                current = "";
+            }
+            continue;
+        }
+        current += ch;
+    }
+    if (quote) {
+        throw new Error("unclosed quote in command");
+    }
+    if (current.length > 0)
+        args.push(current);
+    return args;
+}
+export function buildAllowlistedEnv(source = process.env) {
+    const env = {};
+    for (const key of ENV_ALLOWLIST) {
+        const value = source[key];
+        if (typeof value === "string")
+            env[key] = value;
+    }
+    for (const [key, value] of Object.entries(source)) {
+        if (key.startsWith("AGENTDOCTOR_") && typeof value === "string") {
+            env[key] = value;
+        }
+    }
+    return env;
+}
+/**
+ * Reject path-like args that resolve outside the repository root.
+ */
+export function assertArgsInsideRoot(args, root) {
+    for (const arg of args) {
+        if (arg.startsWith("-"))
+            continue;
+        const looksLikePath = arg.includes("..") || arg.includes("/") || arg.includes("\\") || path.isAbsolute(arg);
+        if (!looksLikePath)
+            continue;
+        try {
+            assertInsideRepo(root, arg);
+        }
+        catch (error) {
+            if (error instanceof PathEscapeError) {
+                throw new Error("path escape rejected");
+            }
+            throw new Error("path escape rejected");
+        }
+    }
+}
+function truncate(text, max = OUTPUT_TRUNCATE) {
+    if (text.length <= max)
+        return text;
+    return `${text.slice(0, max)}\n…[truncated ${text.length - max} chars]`;
+}
+function resolveRealRoot(rootInput) {
+    const resolved = resolveRepoRoot(rootInput);
+    try {
+        return realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+async function appendExecutionAudit(root, record) {
+    const auditPath = path.join(root, ".agentdoctor", "audit", "execution.jsonl");
+    await fs.mkdir(path.dirname(auditPath), { recursive: true });
+    let previousHash = null;
+    try {
+        const existing = await fs.readFile(auditPath, "utf8");
+        const lines = existing.trim().split("\n").filter(Boolean);
+        const last = lines[lines.length - 1];
+        if (last) {
+            const parsed = JSON.parse(last);
+            previousHash = typeof parsed.hash === "string" ? parsed.hash : null;
+        }
+    }
+    catch {
+        previousHash = null;
+    }
+    const { hash, payload } = appendAuditChain(previousHash, record);
+    const line = `${JSON.stringify({ hash, previousHash, record: JSON.parse(payload) })}\n`;
+    await fs.appendFile(auditPath, line, "utf8");
+}
+async function executeArgv(options) {
+    const start = Date.now();
+    const env = buildAllowlistedEnv();
+    const cwd = options.root;
+    if (options.useShell) {
+        const command = options.argv.join(" ");
+        return await new Promise((resolve) => {
+            const child = spawn(command, {
+                cwd,
+                env,
+                shell: true,
+                windowsHide: true,
+            });
+            let stdout = "";
+            let stderr = "";
+            let settled = false;
+            const timer = setTimeout(() => {
+                child.kill("SIGKILL");
+                if (!settled) {
+                    settled = true;
+                    resolve({
+                        stdout: truncate(stdout),
+                        stderr: truncate(stderr || "timeout"),
+                        exitCode: null,
+                        durationMs: Date.now() - start,
+                        failed: true,
+                        error: `timeout after ${options.timeoutMs}ms`,
+                    });
+                }
+            }, options.timeoutMs);
+            child.stdout?.on("data", (chunk) => {
+                stdout += chunk.toString("utf8");
+                if (stdout.length > options.maxBuffer) {
+                    child.kill("SIGKILL");
+                }
+            });
+            child.stderr?.on("data", (chunk) => {
+                stderr += chunk.toString("utf8");
+                if (stderr.length > options.maxBuffer) {
+                    child.kill("SIGKILL");
+                }
+            });
+            child.on("error", (err) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve({
+                    stdout: truncate(stdout),
+                    stderr: truncate(stderr),
+                    exitCode: null,
+                    durationMs: Date.now() - start,
+                    failed: true,
+                    error: err.message,
+                });
+            });
+            child.on("close", (code) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve({
+                    stdout: truncate(stdout),
+                    stderr: truncate(stderr),
+                    exitCode: code,
+                    durationMs: Date.now() - start,
+                    failed: code !== 0,
+                });
+            });
+        });
+    }
+    const [file, ...args] = options.argv;
+    if (!file) {
+        return {
+            stdout: "",
+            stderr: "empty command",
+            exitCode: null,
+            durationMs: Date.now() - start,
+            failed: true,
+            error: "empty command",
+        };
+    }
+    try {
+        const result = await execFileAsync(file, args, {
+            cwd,
+            env,
+            timeout: options.timeoutMs,
+            maxBuffer: options.maxBuffer,
+            windowsHide: true,
+            shell: false,
+        });
+        return {
+            stdout: truncate(typeof result.stdout === "string" ? result.stdout : String(result.stdout)),
+            stderr: truncate(typeof result.stderr === "string" ? result.stderr : String(result.stderr)),
+            exitCode: 0,
+            durationMs: Date.now() - start,
+            failed: false,
+        };
+    }
+    catch (error) {
+        const err = error;
+        const exitCode = typeof err.code === "number" ? err.code : null;
+        return {
+            stdout: truncate(typeof err.stdout === "string" ? err.stdout : err.stdout ? String(err.stdout) : ""),
+            stderr: truncate(typeof err.stderr === "string" ? err.stderr : err.stderr ? String(err.stderr) : ""),
+            exitCode,
+            durationMs: Date.now() - start,
+            failed: true,
+            error: err.killed
+                ? `timeout after ${options.timeoutMs}ms`
+                : (err.message ?? "execution failed"),
+        };
+    }
+}
+/**
+ * AgentDoctor-controlled command runner.
+ * Executes only when executeIfAllowed===true AND policy decision===allow.
+ * Default path uses shell:false with argv parsing (no shell metacharacters).
+ */
+export async function runControlledCommand(options) {
+    const root = resolveRealRoot(options.root);
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxBuffer = options.maxBuffer ?? DEFAULT_MAX_BUFFER;
+    const useShell = options.useShell === true;
+    let argv;
+    try {
+        argv =
+            options.argv && options.argv.length > 0 ? options.argv : parseArgv(options.command ?? "");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return buildFailedResult(root, message, "not-executed");
+    }
+    const commandStr = argv.join(" ");
+    if (!commandStr) {
+        return buildFailedResult(root, "empty command", "not-executed");
+    }
+    const action = {
+        actionId: randomUUID(),
+        agentId: "enforcement-runner",
+        timestamp: new Date().toISOString(),
+        type: "shell",
+        params: { command: commandStr },
+        repositoryRoot: root,
+    };
+    const verdict = await evaluateAgentAction(root, action, {
+        failClosed: options.failClosed === true,
+    });
+    const blocked = verdict.decision === "block" || verdict.decision === "deny-network";
+    if (blocked) {
+        const decision = toDecision(verdict, "blocked-by-enforcement");
+        await appendExecutionAudit(root, {
+            id: auditRecordId(`${commandStr}:${Date.now()}`),
+            command: commandStr,
+            argv,
+            executionStatus: "blocked-by-enforcement",
+            decision: verdict.decision,
+            reason: verdict.reason,
+            at: new Date().toISOString(),
+        });
+        return {
+            decision,
+            enforced: true,
+            notice: `Blocked by AgentDoctor-controlled runner. ${verdict.reason}`,
+        };
+    }
+    if (!options.executeIfAllowed || verdict.decision !== "allow") {
+        const decision = toDecision(verdict, "not-executed");
+        return {
+            decision,
+            enforced: false,
+            notice: verdict.decision === "allow"
+                ? `Policy allow; runner did not execute (executeIfAllowed=false). ${EVALUATE_ONLY}`
+                : `Policy ${verdict.decision}; runner did not execute. ${EVALUATE_ONLY}`,
+        };
+    }
+    if (!useShell) {
+        try {
+            assertArgsInsideRoot(argv, root);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const decision = toDecision(verdict, "execution-failed", message);
+            await appendExecutionAudit(root, {
+                id: auditRecordId(`${commandStr}:${Date.now()}`),
+                command: commandStr,
+                argv,
+                executionStatus: "execution-failed",
+                reason: message,
+                at: new Date().toISOString(),
+            });
+            return {
+                decision,
+                enforced: false,
+                notice: `Execution failed: ${message}`,
+            };
+        }
+    }
+    const execResult = await executeArgv({
+        root,
+        argv,
+        timeoutMs,
+        maxBuffer,
+        useShell,
+    });
+    const executionStatus = execResult.failed ? "execution-failed" : "executed";
+    const decision = toDecision(verdict, executionStatus, execResult.error, useShell ? "HIGH RISK: executed via shell=true (explicit --shell flag)" : undefined);
+    await appendExecutionAudit(root, {
+        id: auditRecordId(`${commandStr}:${Date.now()}`),
+        command: commandStr,
+        argv,
+        useShell,
+        executionStatus,
+        exitCode: execResult.exitCode,
+        durationMs: execResult.durationMs,
+        stdout: execResult.stdout,
+        stderr: execResult.stderr,
+        ...(execResult.error ? { error: execResult.error } : {}),
+        at: new Date().toISOString(),
+    });
+    return {
+        decision,
+        enforced: false,
+        notice: execResult.failed
+            ? `Execution failed${execResult.error ? `: ${execResult.error}` : ""}`
+            : useShell
+                ? "Executed under AgentDoctor control with shell=true (HIGH RISK)."
+                : "Executed under AgentDoctor control (shell=false).",
+        stdout: execResult.stdout,
+        stderr: execResult.stderr,
+        exitCode: execResult.exitCode,
+        durationMs: execResult.durationMs,
+    };
+}
+function toDecision(verdict, executionStatus, extraReason, riskNote) {
+    return {
+        actionId: verdict.actionId,
+        decision: verdict.decision,
+        reason: [verdict.reason, extraReason, riskNote].filter(Boolean).join(" | "),
+        ...(verdict.policyId ? { policyId: verdict.policyId } : {}),
+        policyVersion: "2.0",
+        inputClassification: "shell",
+        evidence: [{ id: "ev_policy", kind: "observed", detail: verdict.reason }],
+        riskLevel: verdict.riskLevel,
+        executionStatus,
+        approvalStatus: verdict.approvalStatus,
+        timestamp: new Date().toISOString(),
+    };
+}
+function buildFailedResult(_root, message, executionStatus) {
+    return {
+        decision: {
+            actionId: randomUUID(),
+            decision: "block",
+            reason: message,
+            policyVersion: "2.0",
+            inputClassification: "shell",
+            evidence: [{ id: "ev_parse", kind: "observed", detail: message }],
+            riskLevel: "high",
+            executionStatus,
+            approvalStatus: "not-required",
+            timestamp: new Date().toISOString(),
+        },
+        enforced: executionStatus === "blocked-by-enforcement",
+        notice: message,
+    };
+}
+/** Append-only tamper-evident audit chain (HMAC over previous hash). */
+export function appendAuditChain(previousHash, record, secret = "local-dev-audit-key") {
+    const body = JSON.stringify(record);
+    const hash = createHmac("sha256", secret)
+        .update(`${previousHash ?? "GENESIS"}:${body}`)
+        .digest("hex");
+    return { hash, payload: body };
+}
+export function auditRecordId(parts) {
+    return `audit_${createHash("sha1").update(parts).digest("hex").slice(0, 12)}`;
+}
+/**
+ * Explain what the controlled runner would do for a command (evaluate-only).
+ * Does not execute.
+ */
+export async function explainControlledRun(options) {
+    const root = resolveRealRoot(options.root);
+    let argv;
+    try {
+        argv =
+            options.argv && options.argv.length > 0 ? options.argv : parseArgv(options.command ?? "");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            command: options.command ?? "",
+            argv: [],
+            useShell: options.useShell === true,
+            decision: "block",
+            reason: message,
+            policyId: null,
+            riskLevel: "high",
+            wouldExecute: false,
+            executionResult: "not-executed",
+            notice: EVALUATE_ONLY,
+            meaning: "Command could not be parsed for controlled execution.",
+        };
+    }
+    const commandStr = argv.join(" ");
+    const action = {
+        actionId: randomUUID(),
+        agentId: "enforcement-explain",
+        timestamp: new Date().toISOString(),
+        type: "shell",
+        params: { command: commandStr },
+        repositoryRoot: root,
+    };
+    const verdict = await evaluateAgentAction(root, action, {
+        failClosed: options.failClosed === true,
+    });
+    const wouldExecute = verdict.decision === "allow";
+    return {
+        command: commandStr,
+        argv,
+        useShell: options.useShell === true,
+        decision: verdict.decision,
+        reason: verdict.reason,
+        policyId: verdict.policyId ?? null,
+        riskLevel: verdict.riskLevel,
+        wouldExecute,
+        executionResult: "not-executed",
+        notice: EVALUATE_ONLY,
+        meaning: wouldExecute
+            ? "Policy allow — `agentdoctor run` would execute under AgentDoctor control (still not claimed as enterprise interception)."
+            : "Policy would block or require approval — controlled runner will not execute.",
+    };
+}

package/dist/index.d.ts

@@ -1,7 +1,40 @@
+export { CONTRACTS_VERSION, DEFAULT_FEATURE_FLAGS } from "./contracts/index.js";
+export { buildIntelligenceGraph } from "./intelligence/graph/build.js";
+export { analyzeGitIntelligence } from "./intelligence/git/analyze.js";
+export { buildC4Views } from "./architecture/c4.js";
+export { loadArchitectureContract, checkArchitecture, checkArchitectureAtRoot, initArchitecture, explainArchitecture, DEFAULT_ARCHITECTURE_CONTRACT, } from "./architecture/contract.js";
+export type { ArchitectureContract, ArchitectureViolation, ArchitectureCheckResult, } from "./architecture/contract.js";
+export { loadCoverage, parseLcov, parseIstanbul, parseCobertura } from "./coverage/load.js";
+export type { NormalizedCoverage, CoverageFormat, CoverageFile } from "./coverage/types.js";
+export { parseSourceFile, languageAdapters, detectLanguage } from "./languages/index.js";
+export type { LanguageAdapter, ParseResult, LanguageId } from "./languages/index.js";
+export { createKnowledgeRecord, listKnowledge, transitionKnowledge, retrieveAuthoritative, } from "./knowledge/store.js";
+export { FilesystemStorageProvider, MemoryStorageProvider, tryCreateSqliteStorage, tryCreatePostgresStorage, } from "./storage/provider.js";
+export { SqliteStorageProvider } from "./storage/sqlite.js";
+export { PostgresStorageProvider } from "./storage/postgres.js";
+export { LocalIdentityProvider, OidcIdentityProvider, hasRbacPermission } from "./auth/index.js";
+export type { IdentityClaims, IdentityProvider, RbacRole, RbacPermission } from "./auth/index.js";
+export { initWorkspace, listWorkspaces, loadWorkspace, addRepositoryToWorkspace, removeWorkspace, workspaceStatus, assertWorkspacePathAccess, readFileWithinWorkspace, } from "./workspace/index.js";
+export type { WorkspaceModel } from "./workspace/index.js";
+export { composePolicy, explainComposedDecision } from "./policy/compose.js";
+export { runControlledCommand, parseArgv, assertArgsInsideRoot, explainControlledRun, } from "./enforcement/runner.js";
+export { registerLocalDevUser, authenticateLocalDev, authorize } from "./team/auth.js";
+export { runProjectInit, listProposals, reviewProposal } from "./core/brain-product/init.js";
+export { collectOpsHealth } from "./ops/health.js";
+export { listPolicyPacks, getPolicyPack } from "./policy/packs.js";
+export { listIntelligenceMcpTools, INTELLIGENCE_MCP_TOOL_NAMES, } from "./mcp/intelligence/registry.js";
 export { scan } from "./core/scanner/scan.js";
 export { verify } from "./core/verify/verify.js";
 export { compareFindings } from "./core/verify/compare.js";
 export { PACKAGE_VERSION } from "./constants.js";
+export { analyzeChange, verifyChange, inspectEvidence, verifyEvidence, explainChange, diffChange, changeStatus, deriveGraphChangeImpact, derivePackageImpact, EVIDENCE_SCHEMA_VERSION, } from "./assurance/change.js";
+export type { ChangeAssessment, EvidenceManifest, VerificationStatus } from "./assurance/change.js";
+export { buildProofFromEvidence, inspectProof, verifyProof, exportProof, explainProof, } from "./assurance/proof.js";
+export type { ChangeProof, IntegrityStatus, CorrectnessStatus, EngineeringChecksStatus, ProofVerificationState, } from "./assurance/proof.js";
+export { assertInsideRepo, resolveSafeRepoPath, safeRelPath, PathEscapeError, } from "./security/paths.js";
+export { resolveImportSpecifier, resolveImportEdges, loadTsconfigPaths, } from "./intelligence/resolve/imports.js";
+export type { ImportConfidence, ImportResolutionResult, TsconfigPathsConfig, } from "./intelligence/resolve/imports.js";
+export { graphBuild, graphUpdate, graphRebuild, graphStatus, } from "./intelligence/graph/incremental.js";
 export type { ScanOptions, ScanResult, RepositoryInfo, Finding, FindingsSummary, Scores, AgentPresence, AgentDetectionResult, AgentSecurityAnalysisMode, CliOptions, ExitCode, } from "./types/index.js";
 export type { VerifyResult, VerifyOptions } from "./core/verify/verify.js";
 export type { VerifyFindingRef, FindingCompareResult } from "./core/verify/compare.js";
@@ -12,6 +45,7 @@ export { ruleRegistry, getRuleById } from "./core/rules/registry.js";
 export { runRules } from "./core/rules/run-rules.js";
 export { buildFixPlan } from "./core/fix/plan.js";
 export { applyFixPlan } from "./core/fix/apply.js";
+export type { ApplyFixPlanOptions } from "./core/fix/apply.js";
 export { runFix } from "./core/fix/run.js";
 export { evaluatePolicy, evaluateScanPolicy, evaluateVerifyPolicy, parseFailOnRules, parseSeverityGate, } from "./core/policy/evaluate.js";
 export type { PolicyOptions, PolicyViolation, PolicyViolationCode, PolicyInput, } from "./core/policy/evaluate.js";

package/dist/index.js

@@ -1,7 +1,32 @@
+export { CONTRACTS_VERSION, DEFAULT_FEATURE_FLAGS } from "./contracts/index.js";
+export { buildIntelligenceGraph } from "./intelligence/graph/build.js";
+export { analyzeGitIntelligence } from "./intelligence/git/analyze.js";
+export { buildC4Views } from "./architecture/c4.js";
+export { loadArchitectureContract, checkArchitecture, checkArchitectureAtRoot, initArchitecture, explainArchitecture, DEFAULT_ARCHITECTURE_CONTRACT, } from "./architecture/contract.js";
+export { loadCoverage, parseLcov, parseIstanbul, parseCobertura } from "./coverage/load.js";
+export { parseSourceFile, languageAdapters, detectLanguage } from "./languages/index.js";
+export { createKnowledgeRecord, listKnowledge, transitionKnowledge, retrieveAuthoritative, } from "./knowledge/store.js";
+export { FilesystemStorageProvider, MemoryStorageProvider, tryCreateSqliteStorage, tryCreatePostgresStorage, } from "./storage/provider.js";
+export { SqliteStorageProvider } from "./storage/sqlite.js";
+export { PostgresStorageProvider } from "./storage/postgres.js";
+export { LocalIdentityProvider, OidcIdentityProvider, hasRbacPermission } from "./auth/index.js";
+export { initWorkspace, listWorkspaces, loadWorkspace, addRepositoryToWorkspace, removeWorkspace, workspaceStatus, assertWorkspacePathAccess, readFileWithinWorkspace, } from "./workspace/index.js";
+export { composePolicy, explainComposedDecision } from "./policy/compose.js";
+export { runControlledCommand, parseArgv, assertArgsInsideRoot, explainControlledRun, } from "./enforcement/runner.js";
+export { registerLocalDevUser, authenticateLocalDev, authorize } from "./team/auth.js";
+export { runProjectInit, listProposals, reviewProposal } from "./core/brain-product/init.js";
+export { collectOpsHealth } from "./ops/health.js";
+export { listPolicyPacks, getPolicyPack } from "./policy/packs.js";
+export { listIntelligenceMcpTools, INTELLIGENCE_MCP_TOOL_NAMES, } from "./mcp/intelligence/registry.js";
 export { scan } from "./core/scanner/scan.js";
 export { verify } from "./core/verify/verify.js";
 export { compareFindings } from "./core/verify/compare.js";
 export { PACKAGE_VERSION } from "./constants.js";
+export { analyzeChange, verifyChange, inspectEvidence, verifyEvidence, explainChange, diffChange, changeStatus, deriveGraphChangeImpact, derivePackageImpact, EVIDENCE_SCHEMA_VERSION, } from "./assurance/change.js";
+export { buildProofFromEvidence, inspectProof, verifyProof, exportProof, explainProof, } from "./assurance/proof.js";
+export { assertInsideRepo, resolveSafeRepoPath, safeRelPath, PathEscapeError, } from "./security/paths.js";
+export { resolveImportSpecifier, resolveImportEdges, loadTsconfigPaths, } from "./intelligence/resolve/imports.js";
+export { graphBuild, graphUpdate, graphRebuild, graphStatus, } from "./intelligence/graph/incremental.js";
 export { EXIT_CODES } from "./types/index.js";
 export { agentRegistry } from "./agents/registry.js";
 export { detectAgents } from "./agents/detect-agents.js";

package/dist/integrations/github/pr-analyze.d.ts

@@ -0,0 +1,28 @@
+export interface PrReviewFinding {
+    severity: "critical" | "warning" | "info";
+    title: string;
+    message: string;
+    file?: string;
+    line?: number;
+    confidence: "high" | "medium" | "low";
+    source: "scan" | "context-health" | "changes";
+}
+export interface PrReviewReport {
+    root: string;
+    mode: "local" | "github-dry-run";
+    baseRef: string | null;
+    headRef: string | null;
+    findings: PrReviewFinding[];
+    commentMarkdown: string;
+    limitations: string[];
+    posted: false;
+}
+/**
+ * Local PR review. Never posts to GitHub unless a future explicit command is added.
+ * GitHub token is unused; dry-run is the only supported remote mode.
+ */
+export declare function analyzePullRequest(options: {
+    root: string;
+    baseRef?: string;
+    dryRun?: boolean;
+}): Promise<PrReviewReport>;

package/dist/integrations/github/pr-analyze.js

@@ -0,0 +1,98 @@
+import { spawnSync } from "node:child_process";
+import { analyzeChanges } from "../../core/changes/analyze.js";
+import { analyzeContextHealth } from "../../core/context-health/analyze.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { scan } from "../../core/scanner/scan.js";
+function redactSecretsInText(text) {
+    return text
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]")
+        .replace(/\bghp_[A-Za-z0-9]{36}\b/g, "[REDACTED]")
+        .replace(/-----BEGIN [^-]+PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]");
+}
+function buildComment(findings) {
+    const lines = [
+        "## AgentDoctor PR review (local)",
+        "",
+        "_Generated locally. Secrets are redacted. Nothing was posted to GitHub._",
+        "",
+    ];
+    if (findings.length === 0) {
+        lines.push("No actionable findings in local analysis.");
+        return lines.join("\n");
+    }
+    for (const f of findings) {
+        const loc = f.file ? ` \`${f.file}${f.line ? `:${f.line}` : ""}\`` : "";
+        lines.push(`- **${f.severity}** (${f.confidence}) ${redactSecretsInText(f.title)}${loc}: ${redactSecretsInText(f.message)}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * Local PR review. Never posts to GitHub unless a future explicit command is added.
+ * GitHub token is unused; dry-run is the only supported remote mode.
+ */
+export async function analyzePullRequest(options) {
+    const root = resolveRepoRoot(options.root);
+    const limitations = [
+        "GitHub comment posting is disabled; use --dry-run / local mode only",
+        "Optional GitHub API integration requires explicit future invocation with a token",
+    ];
+    const baseRef = options.baseRef ?? null;
+    const changes = await analyzeChanges({
+        root,
+        ...(baseRef ? { since: baseRef } : {}),
+    });
+    const context = await analyzeContextHealth(root);
+    const scanResult = await scan({ cwd: root });
+    const findings = [];
+    for (const f of scanResult.findings.filter((x) => x.severity === "critical" || x.severity === "warning")) {
+        findings.push({
+            severity: f.severity,
+            title: f.title,
+            message: f.message,
+            ...(f.evidence?.path ? { file: f.evidence.path } : {}),
+            ...(typeof f.evidence?.line === "number" ? { line: f.evidence.line } : {}),
+            confidence: "high",
+            source: "scan",
+        });
+    }
+    for (const c of context.conflicts) {
+        findings.push({
+            severity: c.severity === "warning" ? "warning" : "info",
+            title: c.kind,
+            message: c.message,
+            ...(c.files[0] ? { file: c.files[0] } : {}),
+            confidence: "medium",
+            source: "context-health",
+        });
+    }
+    if (changes.gitAvailable && changes.files.length > 0) {
+        findings.push({
+            severity: "info",
+            title: "changed-files",
+            message: `${changes.files.length} changed file(s) in working tree / range`,
+            confidence: "high",
+            source: "changes",
+        });
+    }
+    else if (!changes.gitAvailable) {
+        limitations.push(...changes.limitations);
+    }
+    let headRef = changes.head;
+    if (!headRef) {
+        const probe = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+            cwd: root,
+            encoding: "utf8",
+        });
+        headRef = probe.status === 0 ? probe.stdout.trim() : null;
+    }
+    return {
+        root,
+        mode: options.dryRun === false ? "local" : "github-dry-run",
+        baseRef,
+        headRef,
+        findings,
+        commentMarkdown: buildComment(findings),
+        limitations,
+        posted: false,
+    };
+}