@preventive/triage 1.0.0-alpha.2 → 1.0.0-alpha.20

package/report/src/meta.js

@@ -0,0 +1,76 @@
+// Run-level meta — the fields at the top of a report describing the run
+// that produced it. Both the report view (ui/view/ingest.js) and the
+// OPFS-wide index (client/bundle-finding-index.js) project the header
+// onto the findings, so every consumer reads run meta off a finding
+// without asking whether the file was one run or a deduplicated dump.
+export const META_FIELDS = ['type', 'model', 'think', 'effort', 'exportsMode']
+
+// Each run-meta field the finding doesn't specify, filled in place from
+// the report header. Per-field, not all-or-nothing: `deduplicate` stamps
+// `model` per finding while the rest stay run-level, so a finding
+// carrying only its own `model` still needs the header's `type`. Null
+// counts as unspecified — a report is JSON, where `"type": null` can't be
+// told from an omitted key. Source-marked reports opt out wholesale:
+// each is one analyzer, and its report-level `type` is the product's
+// category rather than a run descriptor.
+export function inheritReportMeta(finding, data) {
+  if (data.source) return
+  for (const key of META_FIELDS) {
+    if (finding[key] == null && data[key] != null) finding[key] = data[key]
+  }
+}
+
+// `"repo": { "github": "owner/name" }` at the top of a native dump, the
+// repository the run covered. NOT inherited onto findings the way
+// META_FIELDS are: a finding's own `repo.github` names the upstream of
+// the file IT sits in — a dependency's repo under `node_modules/` — so
+// stamping the report's over it would mislabel every dependency finding.
+//
+// Takes the slug or a github.com URL, with or without scheme, `.git` or
+// a trailing `/tree/main`, and normalises both to the slug. Anything
+// else is null: a value the link builders would splice into a broken URL
+// is worse than none.
+const GITHUB_URL_RE = /^(?:https?:\/\/)?(?:www\.)?github\.com\/([^/?#]+)\/([^/?#]+?)(?:\.git)?(?:[/?#].*)?$/iu
+const SLUG_RE = /^[\w.-]+\/[\w.-]+$/u
+
+// Is this value that slug already? Asked wherever a report hands over
+// something that may be one: `repo.github` below, a Piolium preamble's
+// `**Target:**`, a finding's repo on its way to a link.
+export function isRepoSlug(s) {
+  return SLUG_RE.test(s)
+}
+
+export function reportRepoGithub(data) {
+  const raw = data?.repo?.github
+  if (typeof raw !== 'string') return null
+  const trimmed = raw.trim().replace(/\/+$/u, '')
+  if (!trimmed) return null
+  const url = GITHUB_URL_RE.exec(trimmed)
+  const slug = (url ? `${url[1]}/${url[2]}` : trimmed).replace(/\.git$/u, '')
+  return isRepoSlug(slug) ? slug : null
+}
+
+// `"directory": "packages/babel-core"` beside that `github` — where
+// inside the repository the tree the report describes sits, the same
+// field npm's `repository` object carries for a package in a monorepo
+// (`{ "github": "babel/babel", "directory": "packages/babel-core" }`).
+// The paths a report writes are relative to that tree, so a link is
+// the repo, then this, then the path: `babel/babel` +
+// `packages/babel-core` + `src/index.js`. Declared in both the places
+// `repo` is — the report header and a finding's own — and read off
+// whichever of the two answered for the repo, never mixed.
+//
+// Normalised to a bare relative path: no leading `./` or `/`, no
+// trailing one, no repeated separators, and `''` — same as declaring
+// none — for the repo root. `''` too for anything a link builder
+// would splice into a broken URL, the rule `reportRepoGithub` follows
+// above: a non-string, a `?` or `#` (either cuts the path short of the
+// file, and swallows the `#L42` anchor a line link puts after it), or
+// a `..` segment climbing out of the repository.
+export function repoDirectory(repo) {
+  const raw = typeof repo?.directory === 'string' ? repo.directory.trim() : ''
+  const path = raw.replace(/^(?:\.\/)+/u, '').replaceAll(/^\/+|\/+$/gu, '').replaceAll(/\/{2,}/gu, '/')
+  if (!path || path === '.') return ''
+  if (/[?#]/u.test(path) || path.split('/').includes('..')) return ''
+  return path
+}

package/report/src/parse-codex.js

@@ -0,0 +1,147 @@
+// Codex Security CSV parser. Input is a multi-scan CSV export with
+// rows like:
+//   finding_url,repository,repository_url,title,description,severity,
+//   status,detected_at,committed_at,author_email,assignee_name,
+//   assignee_email,has_patch,configured_scan_id,commit_hash,
+//   relevant_paths,resolution_reason
+// One CSV typically merges several scans (each `configured_scan_id`
+// is one scan). We split on that field and emit one report per scan.
+//
+// Display name per scan: `${repository}:${configured_scan_id stripped
+// of its `<prefix>:` head}`. Each scan must contain exactly one
+// repository — asserted, not silently merged.
+//
+// Only the first path in `relevant_paths` becomes `f.file` (some
+// findings list several, as `path1 | path2 | …`); the rest are dropped.
+
+const REQUIRED_COLUMNS = [
+  'finding_url', 'repository', 'title', 'description', 'severity',
+  'configured_scan_id', 'relevant_paths',
+]
+
+// RFC 4180-ish CSV parser: handles quoted fields containing commas,
+// embedded newlines, and `""` escaped quotes. Returns rows as arrays
+// of strings (no header / object conversion — caller picks columns by
+// index from the header row).
+function parseCsvRows(text) {
+  const rows = []
+  let row = []
+  let field = ''
+  let inQuote = false
+  const n = text.length
+  for (let i = 0; i < n; i++) {
+    const c = text[i]
+    if (inQuote) {
+      if (c === '"') {
+        if (text[i + 1] === '"') { field += '"'; i++ }
+        else { inQuote = false }
+      } else {
+        field += c
+      }
+    } else if (c === '"') {
+      inQuote = true
+    } else if (c === ',') {
+      row.push(field); field = ''
+    } else if (c === '\n' || c === '\r') {
+      row.push(field); rows.push(row); row = []; field = ''
+      if (c === '\r' && text[i + 1] === '\n') i++
+    } else {
+      field += c
+    }
+  }
+  // Trailing field / row (no final newline).
+  if (field !== '' || row.length > 0) { row.push(field); rows.push(row) }
+  // Strip purely-empty trailing rows that come from a trailing newline.
+  while (rows.length > 0 && rows.at(-1).length === 1 && rows.at(-1)[0] === '') rows.pop()
+  return rows
+}
+
+// Rows as `{ <column>: value }` records keyed by the header row, so the
+// mapping below reads columns by name; a column the file lacks reads as
+// undefined, a cell a short row lacks as ''. Null-prototype so a column
+// named `constructor` can't alias an inherited key.
+function csvRecords(header, rows) {
+  return rows.map((cells) => {
+    const record = Object.create(null)
+    header.forEach((name, i) => { record[name] = cells[i] ?? '' })
+    return record
+  })
+}
+
+// Parse + split + convert. Returns one entry per scan:
+//   { displayName, data: { type, source, findings: [...] } }
+// where `data` is the same shape ingest.js consumes from JSON.
+export function parseCodexCsvToScans(text) {
+  const rows = parseCsvRows(text)
+  if (rows.length < 2) throw new Error('Codex CSV: empty or missing header row')
+  const [header, ...body] = rows
+  for (const required of REQUIRED_COLUMNS) {
+    if (!header.includes(required)) throw new Error(`Codex CSV: missing required column "${required}"`)
+  }
+
+  // Group rows by configured_scan_id; a row without one (a blank line
+  // included) is skipped.
+  const byScan = new Map()
+  for (const record of csvRecords(header, body)) {
+    const scanId = record.configured_scan_id
+    if (!scanId) continue
+    if (!byScan.has(scanId)) byScan.set(scanId, [])
+    byScan.get(scanId).push(record)
+  }
+  if (byScan.size === 0) throw new Error('Codex CSV: no rows with a configured_scan_id')
+
+  const scans = []
+  for (const [scanId, records] of byScan) {
+    // Each scan must belong to a single repository — surface a real
+    // error if upstream ever merges scans across repos rather than
+    // silently lumping them under one display name.
+    const repos = new Set(records.map((r) => r.repository).filter(Boolean))
+    if (repos.size > 1) {
+      throw new Error(`Codex CSV: scan ${scanId} contains multiple repositories: ${[...repos].join(', ')}`)
+    }
+    const repo = [...repos][0] || 'unknown-repo'
+    // `${repo}:${suffix}`, the suffix being whatever follows the first
+    // `:` in configured_scan_id (`uuid:<github-id>`) — the
+    // human-meaningful half.
+    const displayName = `${repo}:${scanId.replace(/^[^:]+:/u, '')}`
+    scans.push({
+      displayName,
+      data: { type: 'security', source: 'codex-security', findings: records.map(rowToFinding) },
+    })
+  }
+  return scans
+}
+
+function rowToFinding(r) {
+  // First non-empty path only; the siblings of a `path1 | path2 | …`
+  // list are dropped.
+  const file = r.relevant_paths.split(' | ').map((s) => s.trim()).find(Boolean) || 'unknown'
+
+  // Title + description joined with a blank line so the table view's
+  // first-line title shows the headline and the expanded view shows
+  // the full body.
+  const description = [r.title, r.description].filter(Boolean).join('\n\n')
+
+  const finding = {
+    // finding_url is unique per upstream finding, so triage keys off it
+    // and survives a reload. The saver takes any non-numeric id, URLs
+    // included (triage.js).
+    id: r.finding_url,
+    file,
+    // Codex CSVs lack line numbers — '?' is the same placeholder
+    // markdown findings use when the source has no `#L<n>` anchor.
+    line: '?',
+    severity: (r.severity || 'medium').toLowerCase(),
+    description,
+    repo: { github: r.repository },
+    // No per-finding `type`: the CSV carries no category column, and a
+    // synthetic 'security' would print the same word on every run-meta
+    // line with nothing to tell the findings apart. An empty run-meta
+    // renders as no line at all. The report-level `type` still defaults
+    // to 'security' for document.title.
+  }
+  if (r.commit_hash) finding.commitHash = r.commit_hash
+  if (r.detected_at) finding.detectedAt = r.detected_at
+  if (r.committed_at) finding.committedAt = r.committed_at
+  return finding
+}

package/report/src/parse-deepsec.js

@@ -0,0 +1,197 @@
+// Vercel DeepSec markdown findings parser. Per-finding shape differs
+// from parse-md.js (Claude Security):
+//
+//   # Vulnerability Scan Report
+//   …project metadata table… / ## Summary …summary table…
+//
+//   ## HIGH (2)
+//
+//   ### Finding title 1
+//
+//   - **File:** `path/file.js`
+//   - **Recent committers:** … (ignored)
+//   - **Lines:** 26, 28
+//   - **Slug:** rule-slug
+//   - **Confidence:** high
+//   - **Revalidation:** confirmed       (only where the pass ran)
+//   - **Reasoning:** what it concluded  (only where the pass ran)
+//
+//   prose body…
+//
+//   **Recommendation:** recommendation text
+//
+//   ---
+//   ### Finding title 2 …  ## MEDIUM (5) …
+//
+// The writer is `packages/deepsec/src/commands/report.ts` in
+// vercel-labs/deepsec; the shape above is settled there.
+//
+// Returns `{ type, source: 'deepsec', findings }`, or null when no
+// `## SEVERITY (n)` header appears and the chain moves on.
+
+import { normalizeNewlines, splitHeadingLine } from './md-structure.js'
+
+// The `## SEVERITY (n)` header that marks a DeepSec document. Splitting
+// on it with the tier captured interleaves tiers and content:
+// [preamble, sevA, contentA, sevB, …].
+const SECTION_RE = /^## ([A-Z][A-Z_]*)\s*\(\d+\)\s*\n/mu
+
+// DeepSec's tiers onto the internal ladder. It separates vulnerabilities
+// (CRITICAL … LOW) from non-vuln defects (HIGH_BUG, BUG), and
+// `high_bug` / `bug` keep that apart so the chips count them
+// separately. Anything else falls back to medium, where a renamed or
+// new tier stays visible instead of vanishing.
+function mapSeverity(s) {
+  switch (s.toUpperCase()) {
+    case 'CRITICAL': return 'critical'
+    case 'HIGH': return 'high'
+    case 'MEDIUM': return 'medium'
+    case 'LOW': return 'low'
+    case 'HIGH_BUG': return 'high_bug'
+    case 'BUG': return 'bug'
+    case 'INFO': case 'INFORMATIONAL': return 'informational'
+    default: return 'medium'
+  }
+}
+
+// A field's value as the word it names, whatever punctuation it arrived
+// in — the writer's `~~false positive~~`, or a hand-edited document's
+// backticks and emphasis.
+const word = (s) => String(s ?? '').toLowerCase().replaceAll(/[^a-z]+/gu, '')
+
+// DeepSec's `high` / `medium` / `low` is a closed enum its schema
+// validates, and what the words MEAN is nowhere: the investigate prompt
+// asks for one of the three without saying what separates them, the docs
+// call it "the agent's self-rated confidence", and nothing in DeepSec
+// reads it back. So there is no probability to convert, only three rungs
+// to place on the app's 0—10 scale — where 0 is a claim the revalidation
+// pass withdrew, 10 the no-doubt an unscored import rides at, and a
+// fresh load opens on a floor of 6, 7 or 8 by volume, then walks down
+// through any gap that reveals nothing new (ui filters.js).
+//
+// So `high` clears every floor the tune can pick without claiming the
+// app's no-doubt 10; `medium` is the lowest of those floors, surviving a
+// small report's opening view and dropping out of a big one's; `low`
+// sits under every floor but clear of the 0 that means refuted, since
+// the agent still chose to report it. The even spacing carries as much —
+// the walk settles in the GAPS, one step under the lowest rung it keeps,
+// so a rung packed tighter leaves it nowhere to stop and a rung moved
+// without its gap puts that tier off screen at open.
+const CONFIDENCE = new Map([['high', 8], ['medium', 6], ['low', 4]])
+
+// An unknown word reads as the middle rung, for the reason an
+// unrecognized severity falls back to medium: a level DeepSec adds later
+// should neither vanish under the floor nor — as scoring it nothing
+// would — ride the unscored stand-in at 10, above every `high`. A block
+// with no `Confidence:` line rated nothing, and there that stand-in is
+// the honest answer.
+function mapConfidence(s) {
+  if (s === undefined) return undefined
+  return CONFIDENCE.get(word(s)) ?? CONFIDENCE.get('medium')
+}
+
+// The verdict of DeepSec's revalidation pass as its writer spells it —
+// `confirmed`, `~~false positive~~` struck through, `uncertain` for
+// everything else it can answer — onto the app's own outcomes
+// (finding.js REVALIDATE_KINDS).
+//
+// It belongs with the confidence question rather than beside it:
+// `Confidence:` is the INVESTIGATE pass's self-rating, written before
+// the adversarial pass looked at the finding, and `refuted` is the
+// outcome that acts on the number — the range reads a ruled-out row as
+// 0 whatever it claims. A report saying `high` on one line and
+// `~~false positive~~` on the next is not a finding to show at 8/10.
+const REVALIDATION = new Map([
+  ['confirmed', 'confirmed'],
+  ['falsepositive', 'refuted'],
+  ['uncertain', 'unknown'],
+])
+
+export function parseDeepsecFindings(content) {
+  const text = normalizeNewlines(content).trim()
+  // Format guard — without a single `## SEVERITY (n)` header this isn't
+  // a DeepSec doc; bail out so the chain moves on to
+  // parseMarkdownFindings.
+  const parts = text.split(SECTION_RE)
+  if (parts.length === 1) return null
+
+  const findings = []
+  for (let i = 1; i < parts.length; i += 2) {
+    const sev = mapSeverity(parts[i])
+    // Each finding inside a severity section starts with `### Title`.
+    for (const block of parts[i + 1].split(/^### /mu).slice(1)) {
+      const f = parseBlock(block, sev)
+      if (f) findings.push(f)
+    }
+  }
+  if (findings.length === 0) return null
+
+  // Report-level 'security' for the document.title fallback. No
+  // per-finding `type`: DeepSec categorizes by severity alone, as codex
+  // does, and ingest.js's `data.source` gate keeps the report-level one
+  // off the findings.
+  return { type: 'security', source: 'deepsec', findings }
+}
+
+function parseBlock(block, severity) {
+  // The `---` separator after each finding in a section is shed.
+  const { title, body: rawBody } = splitHeadingLine(block)
+  if (!title) return null
+  const body = rawBody.replace(/\n---\s*$/u, '').trim()
+
+  // Bullet metadata: `- **Field:** value`. Field names case-folded.
+  const fields = {}
+  for (const m of body.matchAll(/^- \*\*([^:*]+):\*\*\s*(.+)$/gmu)) {
+    fields[m[1].trim().toLowerCase()] = m[2].trim()
+  }
+
+  // A bold inline label in the body, not a `## Recommended fix` H2 as
+  // Claude Security writes — so the split is there.
+  const recMatch = /^\*\*Recommendation:\*\*\s*/mu.exec(body)
+  let prose = body
+  let recommendation = ''
+  if (recMatch) {
+    prose = body.slice(0, recMatch.index)
+    recommendation = body.slice(recMatch.index + recMatch[0].length).trim()
+  }
+
+  // Prose minus the bullet metadata, with `**bold**` stripped — the
+  // renderer escapes HTML, so the markers would print literally.
+  const description = prose
+    .split('\n')
+    .filter((line) => !/^\s*- \*\*/u.test(line))
+    .join('\n')
+    .replaceAll('**', '')
+    .trim()
+
+  // Title first, as parse-md and parse-codex write it, so the table
+  // view's first line is the headline.
+  const fullDescription = [title, description].filter(Boolean).join('\n\n')
+
+  // The path arrives backticked (`path/file.js`); the backticks are
+  // notation, not part of it.
+  const file = (fields.file || 'unknown').replace(/^`(.*)`$/u, '$1')
+  // First non-empty line only — the renderer takes a single `f.line`,
+  // and lineLink wraps it as a `#L<n>` anchor when a fileUrl is
+  // available. The siblings of a `26, 28` list are dropped.
+  const line = (fields.lines || '').split(',').map((s) => s.trim()).find(Boolean) || '?'
+
+  const finding = { file, line, severity, description: fullDescription }
+  if (recommendation) finding.recommendation = recommendation.replaceAll('**', '')
+  const confidence = mapConfidence(fields.confidence)
+  if (confidence !== undefined) finding.confidence = confidence
+  // What the pass concluded, where the report has been through it: the
+  // verdict as one of the app's outcomes, the reasoning under it as the
+  // pass's remark, DeepSec named as whose pass said so. The two are read
+  // as a pair because the document writes them as one — a `Reasoning:`
+  // line is the pass's, not the finding's. First line only, like every
+  // field here; a wrapped remainder stays in the prose where it was.
+  const revalidate = REVALIDATION.get(word(fields.revalidation))
+  if (revalidate) {
+    finding.revalidate = revalidate
+    finding.revalidateSource = 'deepsec'
+    if (fields.reasoning) finding.revalidateVerdict = fields.reasoning.replaceAll('**', '')
+  }
+  if (fields.slug) finding.slug = fields.slug
+  return finding
+}