@preventive/triage 1.0.0-alpha.27 → 1.0.0-alpha.29

package/report/src/finding-id.js

@@ -1,80 +0,0 @@
-// Finding ids, stamped by the analyzer onto its JSON output and filled
-// in by the viewer for findings that arrive without one. Web Crypto is
-// the common surface — `crypto.subtle` exists in modern Node and in
-// secure browser contexts — so one implementation runs in both.
-//
-// Two reports from the same source give a finding the same id; an edit
-// to its description or its source invalidates it.
-
-import { encodeUtf8 } from './utf8.js'
-
-function toHex(bytes) {
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')
-}
-
-// The file-content hash the JSON output format uses. sha512 because the
-// id below hashes a string that already includes it, so a collision here
-// would propagate into an id collision. Padded base64 with the SRI-style
-// tag. `btoa` rather than `Uint8Array#toBase64`, still flagged in Node.
-export async function computeFileHash(source) {
-  const bytes = typeof source === 'string' ? encodeUtf8(source) : source
-  const digest = new Uint8Array(await crypto.subtle.digest('SHA-512', bytes))
-  return `sha512-${btoa(String.fromCodePoint(...digest))}`
-}
-
-// A fingerprint hashed into a v4-shaped UUID: derived, not random, but
-// the shape lets a downstream tool treat it as an opaque id.
-async function fingerprintToId(fingerprint) {
-  const bytes = encodeUtf8(JSON.stringify(fingerprint))
-  const digest = await crypto.subtle.digest('SHA-256', bytes)
-  const u = new Uint8Array(digest, 0, 16)
-  // version 4: 0100xxxx
-  u[6] = (u[6] & 0x0f) | 0x40
-  // variant 1: 10xxxxxx
-  u[8] = (u[8] & 0x3f) | 0x80
-  const hex = toHex(u)
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`
-}
-
-// Stable per-finding id from the (severity, description, fileHash) triple
-// the analyzer emits. fileHash being undefined is fine — JSON.stringify
-// drops undefined keys, so a finding with no hash keys off the pair and
-// re-runs over the same source yield the same ids.
-export function findingId(severity, description, fileHash) {
-  return fingerprintToId({ severity, description, fileHash })
-}
-
-// An id derived from a finding, on the first discriminator it carries.
-// null when `crypto.subtle` is unavailable (some `file://` setups), so
-// the caller can fall back to a session-local id — the UI still works,
-// without persistent triage on those findings.
-//
-// In order:
-//   - _idBasis  — a FROZEN fingerprint a parser stamped, used verbatim;
-//                 it exists so a change to the rendered description
-//                 can't re-key stored triage (parse-md-id.js).
-//   - fileHash  — as `findingId` above.
-//   - location  — a markdown import's url, also stable.
-//   - file/line — last resort for a JSON finding with neither: not what
-//                 the spec prescribes, but better than collapsing two
-//                 unrelated findings onto one id.
-export async function deriveFindingId(f) {
-  if (typeof crypto?.subtle?.digest !== 'function') return null
-  const fingerprint = fingerprintOf(f)
-  try {
-    return await fingerprintToId(fingerprint)
-  } catch {
-    return null
-  }
-}
-
-// The choice above as the object that gets hashed. Key order is part of
-// the id — JSON.stringify keeps insertion order — so every shape lists
-// severity and description first.
-export function fingerprintOf(f) {
-  if (f._idBasis) return f._idBasis
-  const { severity, description } = f
-  if (f.fileHash) return { severity, description, fileHash: f.fileHash }
-  if (f.location) return { severity, description, location: f.location }
-  return { severity, description, file: f.file, line: f.line }
-}

package/report/src/finding.js

@@ -1,314 +0,0 @@
-// What one finding IS, read off the parsed object: the severity it
-// displays under, the revalidation stamp it carries, the run it came
-// from, the export marker to strip, how its text splits into a name and
-// a body. The viewer and write-md.js beside it both read a parser's
-// object through these; format.js re-exports every name. Pure — no DOM,
-// no app state, nothing above `report/` — so a viewer switch arrives as
-// an argument (`displayedSeverity`, `runMetaLine`).
-
-import { fenceRanges, inFence } from './md-structure.js'
-import { SOURCE_LABELS } from './labels.js'
-import { canonicalSeverity } from './severity.js'
-
-// Severity ranking — higher = more severe. Two stacks: vulnerabilities
-// (critical → low) over bug-class findings (high_bug → bug), with
-// informational at the bottom; only DeepSec emits the bug tiers. A new
-// tier goes here, and every other list keys off SEVERITIES below.
-export const SEVERITY_ORDER = {
-  critical: 6, high: 5, medium: 4, low: 3,
-  high_bug: 2, bug: 1, informational: 0,
-}
-// Highest-to-lowest iteration order.
-export const SEVERITIES = ['critical', 'high', 'medium', 'low', 'high_bug', 'bug', 'informational']
-
-// ── Corrected severity ───────────────────────────────────────────────
-// `correctedSeverity`, with a free-text `correctedSeverityReason`, is a
-// report's own re-rating of the analyzer's `severity`, and PER-REPORT
-// where `severity` is not: the id hashes `severity`, so a dedupe keeps
-// each occurrence's corrected value on the survivor in
-// `f._correctedByReport`.
-//
-// Every display, count and sort resolves severity through the helpers
-// below; IDENTITY — the id fingerprint, dedupe keys — stays raw.
-
-// Only a known tier counts: an unrecognised one would sort to rank 0 and
-// render an uncolored badge, so the intrinsic severity stands instead.
-function validCorrected(corrected) {
-  corrected = canonicalSeverity(corrected)
-  return corrected != null && corrected in SEVERITY_ORDER ? corrected : null
-}
-
-// The finding's own effective severity. It carries its own report's
-// correction — it IS that report's finding — so no report key is needed;
-// divergence across reports comes from correctedVariants.
-export function effectiveSeverity(f) {
-  return validCorrected(f?.correctedSeverity) ?? canonicalSeverity(f?.severity)
-}
-
-// True when the finding carries a valid correction that actually changes
-// the tier — the trigger for the dual badge / reason affordance.
-export function hasSeverityCorrection(f) {
-  const c = validCorrected(f?.correctedSeverity)
-  return c != null && c !== canonicalSeverity(f?.severity)
-}
-
-// Every display, count and sort site reads severity through this with the
-// current lens (`state.severityMode`), not off `f.severity`.
-export function displayedSeverity(f, mode) {
-  return mode === 'original' ? canonicalSeverity(f?.severity) : effectiveSeverity(f)
-}
-
-// The per-report map of a deduped survivor, but only where the reports
-// disagree — the "varies across reports" hint. null otherwise.
-export function correctedVariants(f) {
-  const byReport = f?._correctedByReport
-  if (!byReport) return null
-  const tiers = new Set(Object.values(byReport).map((v) => canonicalSeverity(v?.severity)))
-  return tiers.size > 1 ? byReport : null
-}
-
-// ── Revalidation ─────────────────────────────────────────────────────
-// A second pass over a finding. `revalidate` is what it concluded —
-// `confirmed` (the finding stands), `partial` (part of it does),
-// `refuted` (it doesn't), `unreachable` (nothing can reach the code),
-// `unknown` (it couldn't tell) — with its reasoning in
-// `revalidateVerdict` and, for a refutation, `revalidateRecommendation`.
-// `revalidation` is the odd one out: the row that IS the pass rather
-// than one it judged, carrying no verdict. `revalidateSource` names
-// WHOSE pass said so, keyed like a report's `source`, and earns its keep
-// when dedup carries a stamp onto another report's finding.
-//
-// One of these words or nothing — an unrecognised value is no stamp.
-export const REVALIDATE_KINDS = ['revalidation', 'refuted', 'unreachable', 'confirmed', 'partial', 'unknown']
-const REVALIDATE_SET = new Set(REVALIDATE_KINDS)
-
-// The outcome as the DATA has it, '' when there is none; the viewer's
-// `revalidateKind` is this behind the layer switch.
-//
-// Read as written: `Refuted ` is not this field's value. A drifted
-// spelling is folded back where a person can edit one — a DOCUMENT
-// (parse-deepview-fields.js readRevalidation) — and past that boundary
-// case-folding it would say the opposite of what the analyzer wrote.
-export function revalidateKindOf(f) {
-  return REVALIDATE_SET.has(f?.revalidate) ? f.revalidate : ''
-}
-
-// Does this finding belong to the APP layer — the code as the
-// application runs it — rather than the source underneath? Another
-// product's does by construction: its producer looked at the
-// application, and a `source` in labels.js is exactly "not DeepView's own
-// dump". DeepView's own are source-layer, except the row that IS its
-// revalidation pass, which describes the run and not a line of code.
-//
-// `source` comes in separately because callers resolve it against the
-// report's marker first. The sole definition of the split; readers take
-// it off the finding as `isApp`, stamped once.
-export function isAppFinding(f, source = f?.source) {
-  return Object.hasOwn(SOURCE_LABELS, source) || revalidateKindOf(f) === 'revalidation'
-}
-
-// Security involvement is independent of the App/code layer and the displayed
-// (possibly corrected) severity. External reports use their original severity,
-// not the synthetic report-level `type: security` supplied by their parsers.
-// `security: false` opts out of the analyzer default, not the other OR rules.
-export function isSecurityFinding(f, source = f?._source ?? f?.source) {
-  const external = typeof source === 'string' && source !== '' && source !== 'deepview'
-  const analyzer = external ? source : f?.analyzer ?? f?.type ?? f?._analyzer
-  return f?.security === true
-    || ((analyzer === 'security' || analyzer === 'dependencies') && f?.security !== false)
-    || (external && ['critical', 'high', 'medium', 'low'].includes(f?.severity))
-}
-
-// ── Run meta ─────────────────────────────────────────────────────────
-export function prettyModel(model) {
-  if (!model) return model
-  return model.replace(/^[^/]+\//u, '').replace(/^claude-/u, '').replaceAll('-', ' ')
-}
-
-// The run a finding came from, as one line — analyzer type, model,
-// effort, exports mode, ` · `-joined, absent fields elided. Every
-// surface that prints it (card, table row, bundle source rows, the
-// markdown export) comes here, so the field list and separator can't
-// drift apart.
-//
-// The revalidation row names itself right after the mode it ran in
-// (`security · revalidate · opus 5 · …`) — that row only, not a verdict
-// row the pass produced. `revalidation` is whether the layer is
-// applied; off, the pass's name goes with the rest of it.
-export function runMetaLine(f, revalidation = true) {
-  const pass = revalidation && revalidateKindOf(f) === 'revalidation' ? 'revalidate' : ''
-  return [f?.type, pass, prettyModel(f?.model), f?.effort, f?.exportsMode]
-    .filter(Boolean).join(' · ')
-}
-
-// ── Export markers ───────────────────────────────────────────────────
-// Isolate mode injects `[export: <name>]` markers and a `(<name>): `
-// lead-in so a merged per-file response stays traceable to individual
-// exports (src/isolate.js). Once post-process has lifted the name into
-// `f.exportName` / `f.methodName`, the inline copy only repeats it, so a
-// marker or prefix naming either field comes off; one naming something
-// else is context ("this export affects <other>") and stays.
-//
-// In isolate mode a leading marker or `(<any>): [export: <any>] ` prefix
-// comes off whatever it names, since that can be a sibling export. That
-// pass runs FIRST, or the per-name strip could decapitate the prefix and
-// leave the `(…): ` lead-in stranded.
-export function stripExportMarker(text, f) {
-  if (!text) return text
-  let result = text
-  if (f?.exportsMode === 'isolate') {
-    // One level of nested `()` — `` (first branch of `bar()`) ``.
-    // Deeper nesting doesn't match at all, leaving the prose intact
-    // rather than over-stripping it.
-    result = result.replace(/^\((?:[^()]|\([^()]*\))*\): \[export:\s*\w+\] /u, '')
-    result = result.replace(/^\[export:\s*\w+\] /u, '')
-  }
-  const names = [f?.exportName, f?.methodName].filter(Boolean)
-    .map((name) => name.replaceAll(/[.*+?^${}()|[\]\\]/gu, '\\$&'))
-  // Every marker first, then the prefixes. The two passes are ordered,
-  // not merely grouped: a `(Foo): ` prefix can sit BEHIND a marker
-  // naming the OTHER name — `[export: bar] (Foo): …` — and the prefix
-  // strip only ever looks at the front of the text, so a per-name pass
-  // that checked the prefix before the other name's marker came off
-  // would leave it there.
-  for (const name of names) result = result.replaceAll(new RegExp(`\\[export:\\s*${name}\\]\\s*`, 'gu'), '')
-  for (const name of names) result = result.replace(new RegExp(`^\\(\`?${name}\`?\\): `, 'u'), '')
-  return result
-}
-
-// The export/method location as a label: `exportName.methodName` for a
-// class export with a specific method, one name when they agree, '' when
-// there is neither.
-export function findingDisplayName(f) {
-  const e = f?.exportName
-  const m = f?.methodName
-  if (e && m && e !== m) return `${e}.${m}`
-  return e || m || ''
-}
-
-// ── Finding title ────────────────────────────────────────────────────
-// What the finding is CALLED: the `title` field when a report has one,
-// else the description's first line — where every markdown import puts
-// the finding's heading, and where a JSON finding's one-paragraph
-// description stands in for a name. Every surface that names a finding
-// comes through here, so a report's own title reaches all of them or
-// none. The export marker comes off first, being chrome.
-export function firstLine(text) {
-  if (!text) return ''
-  for (const line of text.split('\n')) {
-    if (line.trim()) return line.trim()
-  }
-  return ''
-}
-
-// The `title` a finding carries, trimmed — '' when there is none a
-// reader can use. The three readers below all open on it.
-function ownTitle(f) {
-  return typeof f?.title === 'string' ? f.title.trim() : ''
-}
-
-export function findingTitle(f) {
-  return ownTitle(f) || firstLine(stripExportMarker(f?.description, f))
-}
-
-// Title + body for a heading-over-body layout. With a `title` field the
-// split is already made and the description is all body — except a first
-// line REPEATING the title, which would stutter under it.
-//
-// Without one, the first line is the title, but only over a non-empty
-// body: a single-line description stays whole rather than being bolded,
-// and one that OPENS on a fence keeps its first line, since lifting it
-// out would leave the block unopened and render its code as prose.
-export function splitDescription(f) {
-  const text = stripExportMarker(f?.description, f) || ''
-  const own = ownTitle(f)
-  if (own) {
-    const body = text.trim()
-    const nl = body.indexOf('\n')
-    const first = (nl < 0 ? body : body.slice(0, nl)).trim()
-    if (first !== own) return { title: own, body }
-    return { title: own, body: nl < 0 ? '' : body.slice(nl + 1).replace(/^\s+/u, '') }
-  }
-  if (!text) return { title: '', body: '' }
-  const nl = text.indexOf('\n')
-  if (nl < 0) return { title: '', body: text }
-  // A fence opening at index 0 — the same reading codeBlockSegments
-  // gives it (format.js).
-  if (fenceRanges(text)[0]?.[0] === 0) return { title: '', body: text }
-  const body = text.slice(nl + 1).replace(/^\s+/u, '')
-  if (!body) return { title: '', body: text }
-  return { title: text.slice(0, nl).trim(), body }
-}
-
-// The description with the name in front of it — the shape a format
-// without a `title` field already writes, for the surfaces that show one
-// blob per finding rather than a heading over a body.
-export function titledDescription(f) {
-  const own = ownTitle(f)
-  if (!own) return stripExportMarker(f?.description, f) || ''
-  const { body } = splitDescription(f)
-  return body ? `${own}\n\n${body}` : own
-}
-
-// ── Description sections ─────────────────────────────────────────────
-// A description body split into the sections the report wrote it in: a
-// paragraph OPENING with `**Label:**` is one. Every parser emits its
-// narrative fields that way, whatever the report called them, so keying
-// off the markup rather than a list of label words picks all of them up.
-//
-// Everything else is prose, and consecutive unlabelled paragraphs stay
-// in ONE block so their spacing survives. `[{ label, body }]` in
-// document order, `label` null for prose.
-const SECTION_LABEL_RE = /^\*\*([^*\n]+):\*\*[ \t]*/u
-
-// Blank lines, but only OUTSIDE a fence. A snippet's own blank line
-// would tear the block in two, leaving each half with one bare fence
-// marker and neither rendering as code.
-function paragraphs(text) {
-  const ranges = fenceRanges(text)
-  if (ranges.length === 0) return text.split(/\n{2,}/u)
-  const parts = []
-  let last = 0
-  for (const m of text.matchAll(/\n{2,}/gu)) {
-    if (inFence(ranges, m.index)) continue
-    parts.push(text.slice(last, m.index))
-    last = m.index + m[0].length
-  }
-  parts.push(text.slice(last))
-  return parts
-}
-
-export function descriptionSections(body) {
-  const sections = []
-  for (const para of paragraphs(body || '')) {
-    if (!para.trim()) continue
-    const m = SECTION_LABEL_RE.exec(para)
-    if (m) {
-      sections.push({ label: m[1].trim(), body: para.slice(m[0].length).trim() })
-      continue
-    }
-    const open = sections.at(-1)
-    if (open && open.label === null) open.body += `\n\n${para}`
-    else sections.push({ label: null, body: para })
-  }
-  return sections
-}
-
-// ── Locations and evidence ───────────────────────────────────────────
-// `file:line`, the line dropped when there isn't a finite one ('?' on
-// imports that carry none). Takes a finding or an evidence row — both
-// carry the pair and print it alike — and passes `line` through raw, so
-// a range (`10-20`) survives whole.
-export function locationLabel(x) {
-  return Number.isFinite(parseInt(x?.line, 10)) ? `${x.file}:${x.line}` : (x?.file ?? '')
-}
-
-// An evidence row's note: `text` is what parse-md.js writes from the
-// lines under a reference, `observation` what a JSON report may call the
-// same thing. No producer emits both, but a row carrying both reads as
-// the observation over the text rather than one silently winning.
-// Non-string values are ignored — this reads whatever JSON arrives.
-export function evidenceNote(row) {
-  const str = (v) => (typeof v === 'string' ? v : '')
-  return `${str(row?.observation)}\n${str(row?.text)}`.trim()
-}

package/report/src/labels.js

@@ -1,35 +0,0 @@
-// The words the markdown writer uses for the app's enumerations, one
-// table per dimension. The viewer's prose surfaces read them too — the
-// export dialog, the analyzer dropdown, the page header — so a filter
-// the dialog lists and the header line in the file can't disagree.
-
-import { canonicalSeverity } from './severity.js'
-
-export const SEVERITY_LABELS = {
-  critical: 'Critical', high: 'High', medium: 'Medium', low: 'Low',
-  high_bug: 'High bug', bug: 'Bug', informational: 'Informational',
-}
-
-export const TRIAGE_LABELS = {
-  inprogress: 'In progress', fixed: 'Fixed', invalid: 'Invalid',
-  deleted: 'Deleted', ignored: 'Ignored',
-}
-
-export const COLOR_LABELS = { red: 'Red', blue: 'Blue', green: 'Green', gray: 'Gray', none: 'Unmarked' }
-
-// The producer behind a report's `source` marker, one per format the
-// library reads. The analyzer's own dump carries no marker and is
-// described by its run meta instead.
-export const SOURCE_LABELS = {
-  'claude-security': 'Claude Security',
-  'codex-security': 'Codex Security',
-  'deepsec': 'DeepSec',
-  'piolium': 'Piolium',
-}
-
-// An unknown tier prints as itself rather than vanishing: a report can
-// invent one, and the reader is better served by the word than by a
-// blank.
-export function severityLabel(severity) {
-  return SEVERITY_LABELS[canonicalSeverity(severity)] ?? String(severity ?? '')
-}