@preventive/triage 1.0.0-alpha.27 → 1.0.0-alpha.28

package/report/src/meta.js

@@ -1,76 +0,0 @@
-// Run-level meta — the fields at the top of a report describing the run
-// that produced it. Both the report view (ui/view/ingest.js) and the
-// OPFS-wide index (client/bundle-finding-index.js) project the header
-// onto the findings, so every consumer reads run meta off a finding
-// without asking whether the file was one run or a deduplicated dump.
-export const META_FIELDS = ['type', 'model', 'think', 'effort', 'exportsMode']
-
-// Each run-meta field the finding doesn't specify, filled in place from
-// the report header. Per-field, not all-or-nothing: `deduplicate` stamps
-// `model` per finding while the rest stay run-level, so a finding
-// carrying only its own `model` still needs the header's `type`. Null
-// counts as unspecified — a report is JSON, where `"type": null` can't be
-// told from an omitted key. Source-marked reports opt out wholesale:
-// each is one analyzer, and its report-level `type` is the product's
-// category rather than a run descriptor.
-export function inheritReportMeta(finding, data) {
-  if (data.source) return
-  for (const key of META_FIELDS) {
-    if (finding[key] == null && data[key] != null) finding[key] = data[key]
-  }
-}
-
-// `"repo": { "github": "owner/name" }` at the top of a native dump, the
-// repository the run covered. NOT inherited onto findings the way
-// META_FIELDS are: a finding's own `repo.github` names the upstream of
-// the file IT sits in — a dependency's repo under `node_modules/` — so
-// stamping the report's over it would mislabel every dependency finding.
-//
-// Takes the slug or a github.com URL, with or without scheme, `.git` or
-// a trailing `/tree/main`, and normalises both to the slug. Anything
-// else is null: a value the link builders would splice into a broken URL
-// is worse than none.
-const GITHUB_URL_RE = /^(?:https?:\/\/)?(?:www\.)?github\.com\/([^/?#]+)\/([^/?#]+?)(?:\.git)?(?:[/?#].*)?$/iu
-const SLUG_RE = /^[\w.-]+\/[\w.-]+$/u
-
-// Is this value that slug already? Asked wherever a report hands over
-// something that may be one: `repo.github` below, a Piolium preamble's
-// `**Target:**`, a finding's repo on its way to a link.
-export function isRepoSlug(s) {
-  return SLUG_RE.test(s)
-}
-
-export function reportRepoGithub(data) {
-  const raw = data?.repo?.github
-  if (typeof raw !== 'string') return null
-  const trimmed = raw.trim().replace(/\/+$/u, '')
-  if (!trimmed) return null
-  const url = GITHUB_URL_RE.exec(trimmed)
-  const slug = (url ? `${url[1]}/${url[2]}` : trimmed).replace(/\.git$/u, '')
-  return isRepoSlug(slug) ? slug : null
-}
-
-// `"directory": "packages/babel-core"` beside that `github` — where
-// inside the repository the tree the report describes sits, the same
-// field npm's `repository` object carries for a package in a monorepo
-// (`{ "github": "babel/babel", "directory": "packages/babel-core" }`).
-// The paths a report writes are relative to that tree, so a link is
-// the repo, then this, then the path: `babel/babel` +
-// `packages/babel-core` + `src/index.js`. Declared in both the places
-// `repo` is — the report header and a finding's own — and read off
-// whichever of the two answered for the repo, never mixed.
-//
-// Normalised to a bare relative path: no leading `./` or `/`, no
-// trailing one, no repeated separators, and `''` — same as declaring
-// none — for the repo root. `''` too for anything a link builder
-// would splice into a broken URL, the rule `reportRepoGithub` follows
-// above: a non-string, a `?` or `#` (either cuts the path short of the
-// file, and swallows the `#L42` anchor a line link puts after it), or
-// a `..` segment climbing out of the repository.
-export function repoDirectory(repo) {
-  const raw = typeof repo?.directory === 'string' ? repo.directory.trim() : ''
-  const path = raw.replace(/^(?:\.\/)+/u, '').replaceAll(/^\/+|\/+$/gu, '').replaceAll(/\/{2,}/gu, '/')
-  if (!path || path === '.') return ''
-  if (/[?#]/u.test(path) || path.split('/').includes('..')) return ''
-  return path
-}

package/report/src/parse-codex.js

@@ -1,149 +0,0 @@
-// Codex Security CSV parser. Input is a multi-scan CSV export with
-// rows like:
-//   finding_url,repository,repository_url,title,description,severity,
-//   status,detected_at,committed_at,author_email,assignee_name,
-//   assignee_email,has_patch,configured_scan_id,commit_hash,
-//   relevant_paths,resolution_reason
-// One CSV typically merges several scans (each `configured_scan_id`
-// is one scan). We split on that field and emit one report per scan.
-//
-// Display name per scan: `${repository}:${configured_scan_id stripped
-// of its `<prefix>:` head}`. Each scan must contain exactly one
-// repository — asserted, not silently merged.
-//
-// Only the first path in `relevant_paths` becomes `f.file` (some
-// findings list several, as `path1 | path2 | …`); the rest are dropped.
-
-import { normalizeFindingSeverity } from './severity.js'
-
-const REQUIRED_COLUMNS = [
-  'finding_url', 'repository', 'title', 'description', 'severity',
-  'configured_scan_id', 'relevant_paths',
-]
-
-// RFC 4180-ish CSV parser: handles quoted fields containing commas,
-// embedded newlines, and `""` escaped quotes. Returns rows as arrays
-// of strings (no header / object conversion — caller picks columns by
-// index from the header row).
-function parseCsvRows(text) {
-  const rows = []
-  let row = []
-  let field = ''
-  let inQuote = false
-  const n = text.length
-  for (let i = 0; i < n; i++) {
-    const c = text[i]
-    if (inQuote) {
-      if (c === '"') {
-        if (text[i + 1] === '"') { field += '"'; i++ }
-        else { inQuote = false }
-      } else {
-        field += c
-      }
-    } else if (c === '"') {
-      inQuote = true
-    } else if (c === ',') {
-      row.push(field); field = ''
-    } else if (c === '\n' || c === '\r') {
-      row.push(field); rows.push(row); row = []; field = ''
-      if (c === '\r' && text[i + 1] === '\n') i++
-    } else {
-      field += c
-    }
-  }
-  // Trailing field / row (no final newline).
-  if (field !== '' || row.length > 0) { row.push(field); rows.push(row) }
-  // Strip purely-empty trailing rows that come from a trailing newline.
-  while (rows.length > 0 && rows.at(-1).length === 1 && rows.at(-1)[0] === '') rows.pop()
-  return rows
-}
-
-// Rows as `{ <column>: value }` records keyed by the header row, so the
-// mapping below reads columns by name; a column the file lacks reads as
-// undefined, a cell a short row lacks as ''. Null-prototype so a column
-// named `constructor` can't alias an inherited key.
-function csvRecords(header, rows) {
-  return rows.map((cells) => {
-    const record = Object.create(null)
-    header.forEach((name, i) => { record[name] = cells[i] ?? '' })
-    return record
-  })
-}
-
-// Parse + split + convert. Returns one entry per scan:
-//   { displayName, data: { type, source, findings: [...] } }
-// where `data` is the same shape ingest.js consumes from JSON.
-export function parseCodexCsvToScans(text) {
-  const rows = parseCsvRows(text)
-  if (rows.length < 2) throw new Error('Codex CSV: empty or missing header row')
-  const [header, ...body] = rows
-  for (const required of REQUIRED_COLUMNS) {
-    if (!header.includes(required)) throw new Error(`Codex CSV: missing required column "${required}"`)
-  }
-
-  // Group rows by configured_scan_id; a row without one (a blank line
-  // included) is skipped.
-  const byScan = new Map()
-  for (const record of csvRecords(header, body)) {
-    const scanId = record.configured_scan_id
-    if (!scanId) continue
-    if (!byScan.has(scanId)) byScan.set(scanId, [])
-    byScan.get(scanId).push(record)
-  }
-  if (byScan.size === 0) throw new Error('Codex CSV: no rows with a configured_scan_id')
-
-  const scans = []
-  for (const [scanId, records] of byScan) {
-    // Each scan must belong to a single repository — surface a real
-    // error if upstream ever merges scans across repos rather than
-    // silently lumping them under one display name.
-    const repos = new Set(records.map((r) => r.repository).filter(Boolean))
-    if (repos.size > 1) {
-      throw new Error(`Codex CSV: scan ${scanId} contains multiple repositories: ${[...repos].join(', ')}`)
-    }
-    const repo = [...repos][0] || 'unknown-repo'
-    // `${repo}:${suffix}`, the suffix being whatever follows the first
-    // `:` in configured_scan_id (`uuid:<github-id>`) — the
-    // human-meaningful half.
-    const displayName = `${repo}:${scanId.replace(/^[^:]+:/u, '')}`
-    scans.push({
-      displayName,
-      data: { type: 'security', source: 'codex-security', findings: records.map(rowToFinding) },
-    })
-  }
-  return scans
-}
-
-function rowToFinding(r) {
-  // First non-empty path only; the siblings of a `path1 | path2 | …`
-  // list are dropped.
-  const file = r.relevant_paths.split(' | ').map((s) => s.trim()).find(Boolean) || 'unknown'
-
-  // Title + description joined with a blank line so the table view's
-  // first-line title shows the headline and the expanded view shows
-  // the full body.
-  const description = [r.title, r.description].filter(Boolean).join('\n\n')
-
-  const finding = {
-    // finding_url is unique per upstream finding, so triage keys off it
-    // and survives a reload. The saver takes any non-numeric id, URLs
-    // included (triage.js).
-    id: r.finding_url,
-    file,
-    // Codex CSVs lack line numbers — '?' is the same placeholder
-    // markdown findings use when the source has no `#L<n>` anchor.
-    line: '?',
-    severity: (r.severity || 'medium').toLowerCase(),
-    description,
-    repo: { github: r.repository },
-    // No per-finding `type`: the CSV carries no category column, and a
-    // synthetic 'security' would print the same word on every run-meta
-    // line with nothing to tell the findings apart. An empty run-meta
-    // renders as no line at all. The report-level `type` still defaults
-    // to 'security' for document.title.
-  }
-  if (r.commit_hash) finding.commitHash = r.commit_hash
-  if (r.detected_at) finding.detectedAt = r.detected_at
-  if (r.committed_at) finding.committedAt = r.committed_at
-  return normalizeFindingSeverity(finding)
-}

package/report/src/parse-deepsec.js

@@ -1,199 +0,0 @@
-// Vercel DeepSec markdown findings parser. Per-finding shape differs
-// from parse-md.js (Claude Security):
-//
-//   # Vulnerability Scan Report
-//   …project metadata table… / ## Summary …summary table…
-//
-//   ## HIGH (2)
-//
-//   ### Finding title 1
-//
-//   - **File:** `path/file.js`
-//   - **Recent committers:** … (ignored)
-//   - **Lines:** 26, 28
-//   - **Slug:** rule-slug
-//   - **Confidence:** high
-//   - **Revalidation:** confirmed       (only where the pass ran)
-//   - **Reasoning:** what it concluded  (only where the pass ran)
-//
-//   prose body…
-//
-//   **Recommendation:** recommendation text
-//
-//   ---
-//   ### Finding title 2 …  ## MEDIUM (5) …
-//
-// The writer is `packages/deepsec/src/commands/report.ts` in
-// vercel-labs/deepsec; the shape above is settled there.
-//
-// Returns `{ type, source: 'deepsec', findings }`, or null when no
-// `## SEVERITY (n)` header appears and the chain moves on.
-
-import { normalizeNewlines, splitHeadingLine } from './md-structure.js'
-import { normalizeFindingSeverity } from './severity.js'
-
-// The `## SEVERITY (n)` header that marks a DeepSec document. Splitting
-// on it with the tier captured interleaves tiers and content:
-// [preamble, sevA, contentA, sevB, …].
-const SECTION_RE = /^## ([A-Z][A-Z_]*)\s*\(\d+\)\s*\n/mu
-
-// DeepSec's tiers onto the internal ladder. It separates vulnerabilities
-// (CRITICAL … LOW) from non-vuln defects (HIGH_BUG, BUG), and
-// `high_bug` / `bug` keep that apart so the chips count them
-// separately. Anything else falls back to medium, where a renamed or
-// new tier stays visible instead of vanishing.
-function mapSeverity(s) {
-  switch (s.toUpperCase()) {
-    case 'CRITICAL': return 'critical'
-    case 'HIGH': return 'high'
-    case 'MEDIUM': return 'medium'
-    case 'LOW': return 'low'
-    case 'HIGH_BUG': return 'high_bug'
-    case 'BUG': return 'bug'
-    case 'INFO': case 'INFORMATIONAL': return 'informational'
-    case 'INFORMATIVE': return 'informative'
-    default: return 'medium'
-  }
-}
-
-// A field's value as the word it names, whatever punctuation it arrived
-// in — the writer's `~~false positive~~`, or a hand-edited document's
-// backticks and emphasis.
-const word = (s) => String(s ?? '').toLowerCase().replaceAll(/[^a-z]+/gu, '')
-
-// DeepSec's `high` / `medium` / `low` is a closed enum its schema
-// validates, and what the words MEAN is nowhere: the investigate prompt
-// asks for one of the three without saying what separates them, the docs
-// call it "the agent's self-rated confidence", and nothing in DeepSec
-// reads it back. So there is no probability to convert, only three rungs
-// to place on the app's 0—10 scale — where 0 is a claim the revalidation
-// pass withdrew, 10 the no-doubt an unscored import rides at, and a
-// fresh load opens on a floor of 6, 7 or 8 by volume, then walks down
-// through any gap that reveals nothing new (ui filters.js).
-//
-// So `high` clears every floor the tune can pick without claiming the
-// app's no-doubt 10; `medium` is the lowest of those floors, surviving a
-// small report's opening view and dropping out of a big one's; `low`
-// sits under every floor but clear of the 0 that means refuted, since
-// the agent still chose to report it. The even spacing carries as much —
-// the walk settles in the GAPS, one step under the lowest rung it keeps,
-// so a rung packed tighter leaves it nowhere to stop and a rung moved
-// without its gap puts that tier off screen at open.
-const CONFIDENCE = new Map([['high', 8], ['medium', 6], ['low', 4]])
-
-// An unknown word reads as the middle rung, for the reason an
-// unrecognized severity falls back to medium: a level DeepSec adds later
-// should neither vanish under the floor nor — as scoring it nothing
-// would — ride the unscored stand-in at 10, above every `high`. A block
-// with no `Confidence:` line rated nothing, and there that stand-in is
-// the honest answer.
-function mapConfidence(s) {
-  if (s === undefined) return undefined
-  return CONFIDENCE.get(word(s)) ?? CONFIDENCE.get('medium')
-}
-
-// The verdict of DeepSec's revalidation pass as its writer spells it —
-// `confirmed`, `~~false positive~~` struck through, `uncertain` for
-// everything else it can answer — onto the app's own outcomes
-// (finding.js REVALIDATE_KINDS).
-//
-// It belongs with the confidence question rather than beside it:
-// `Confidence:` is the INVESTIGATE pass's self-rating, written before
-// the adversarial pass looked at the finding, and `refuted` is the
-// outcome that acts on the number — the range reads a ruled-out row as
-// 0 whatever it claims. A report saying `high` on one line and
-// `~~false positive~~` on the next is not a finding to show at 8/10.
-const REVALIDATION = new Map([
-  ['confirmed', 'confirmed'],
-  ['falsepositive', 'refuted'],
-  ['uncertain', 'unknown'],
-])
-
-export function parseDeepsecFindings(content) {
-  const text = normalizeNewlines(content).trim()
-  // Format guard — without a single `## SEVERITY (n)` header this isn't
-  // a DeepSec doc; bail out so the chain moves on to
-  // parseMarkdownFindings.
-  const parts = text.split(SECTION_RE)
-  if (parts.length === 1) return null
-
-  const findings = []
-  for (let i = 1; i < parts.length; i += 2) {
-    const sev = mapSeverity(parts[i])
-    // Each finding inside a severity section starts with `### Title`.
-    for (const block of parts[i + 1].split(/^### /mu).slice(1)) {
-      const f = parseBlock(block, sev)
-      if (f) findings.push(f)
-    }
-  }
-  if (findings.length === 0) return null
-
-  // Report-level 'security' for the document.title fallback. No
-  // per-finding `type`: DeepSec categorizes by severity alone, as codex
-  // does, and ingest.js's `data.source` gate keeps the report-level one
-  // off the findings.
-  return { type: 'security', source: 'deepsec', findings }
-}
-
-function parseBlock(block, severity) {
-  // The `---` separator after each finding in a section is shed.
-  const { title, body: rawBody } = splitHeadingLine(block)
-  if (!title) return null
-  const body = rawBody.replace(/\n---\s*$/u, '').trim()
-
-  // Bullet metadata: `- **Field:** value`. Field names case-folded.
-  const fields = {}
-  for (const m of body.matchAll(/^- \*\*([^:*]+):\*\*\s*(.+)$/gmu)) {
-    fields[m[1].trim().toLowerCase()] = m[2].trim()
-  }
-
-  // A bold inline label in the body, not a `## Recommended fix` H2 as
-  // Claude Security writes — so the split is there.
-  const recMatch = /^\*\*Recommendation:\*\*\s*/mu.exec(body)
-  let prose = body
-  let recommendation = ''
-  if (recMatch) {
-    prose = body.slice(0, recMatch.index)
-    recommendation = body.slice(recMatch.index + recMatch[0].length).trim()
-  }
-
-  // Prose minus the bullet metadata, with `**bold**` stripped — the
-  // renderer escapes HTML, so the markers would print literally.
-  const description = prose
-    .split('\n')
-    .filter((line) => !/^\s*- \*\*/u.test(line))
-    .join('\n')
-    .replaceAll('**', '')
-    .trim()
-
-  // Title first, as parse-md and parse-codex write it, so the table
-  // view's first line is the headline.
-  const fullDescription = [title, description].filter(Boolean).join('\n\n')
-
-  // The path arrives backticked (`path/file.js`); the backticks are
-  // notation, not part of it.
-  const file = (fields.file || 'unknown').replace(/^`(.*)`$/u, '$1')
-  // First non-empty line only — the renderer takes a single `f.line`,
-  // and lineLink wraps it as a `#L<n>` anchor when a fileUrl is
-  // available. The siblings of a `26, 28` list are dropped.
-  const line = (fields.lines || '').split(',').map((s) => s.trim()).find(Boolean) || '?'
-
-  const finding = { file, line, severity, description: fullDescription }
-  if (recommendation) finding.recommendation = recommendation.replaceAll('**', '')
-  const confidence = mapConfidence(fields.confidence)
-  if (confidence !== undefined) finding.confidence = confidence
-  // What the pass concluded, where the report has been through it: the
-  // verdict as one of the app's outcomes, the reasoning under it as the
-  // pass's remark, DeepSec named as whose pass said so. The two are read
-  // as a pair because the document writes them as one — a `Reasoning:`
-  // line is the pass's, not the finding's. First line only, like every
-  // field here; a wrapped remainder stays in the prose where it was.
-  const revalidate = REVALIDATION.get(word(fields.revalidation))
-  if (revalidate) {
-    finding.revalidate = revalidate
-    finding.revalidateSource = 'deepsec'
-    if (fields.reasoning) finding.revalidateVerdict = fields.reasoning.replaceAll('**', '')
-  }
-  if (fields.slug) finding.slug = fields.slug
-  return normalizeFindingSeverity(finding, severity === 'informative' ? 'medium' : severity)
-}