@preventive/triage 1.0.0-alpha.35 → 1.0.0-alpha.36

package/client/dependency-paths.d.ts

@@ -0,0 +1,2 @@
+export function isDependencyFile(file: unknown, directory: string): boolean
+export function dependencyDirectory(reports: Iterable<{ groups?: Iterable<Iterable<{ file?: unknown }>>; tree?: unknown }>): 'node_modules' | 'vendor' | 'dependencies'

package/client/dependency-paths.js

@@ -0,0 +1,24 @@
+// Match whole path segments, using the same directory precedence as the
+// findings dependency filter. Less-specific directory names can be own source.
+export function isDependencyFile(file, directory) {
+  if (typeof file !== 'string') return false
+  const path = file.replaceAll('\\', '/')
+  return path.startsWith(`${directory}/`) || path.includes(`/${directory}/`)
+}
+
+export function dependencyDirectory(reports) {
+  let vendor = false
+  for (const report of reports) {
+    for (const group of report.groups ?? []) {
+      for (const finding of group) {
+        if (isDependencyFile(finding.file, 'node_modules')) return 'node_modules'
+        if (isDependencyFile(finding.file, 'vendor')) vendor = true
+      }
+    }
+    for (const file of Object.keys(report.tree ?? {})) {
+      if (isDependencyFile(file, 'node_modules')) return 'node_modules'
+      if (isDependencyFile(file, 'vendor')) vendor = true
+    }
+  }
+  return vendor ? 'vendor' : 'dependencies'
+}

package/common/managed/report-content.ts

@@ -1,5 +1,7 @@
 import { parseLinkedFindings } from '../../client/linked-findings.js'
-import { detectFormat, loadFindings, parseCodexCsvToScans, readReport } from '@preventive/report'
+import { dependencyDirectory, isDependencyFile } from '../../client/dependency-paths.js'
+import { detectFormat, loadFindings, parseCodexCsvToScans, readReport, reportEntries, reportRepoGithub } from '@preventive/report'
+import { commonFileDirectory } from './repository-alias.ts'
 
 // A managed blob retains one server identity even when a CSV contains several
 // scans. Keep all their findings (and upstream ids) under that identity. CSV
@@ -40,3 +42,31 @@ export function managedFindingSourcePaths(findings: unknown[]): Set<string> {
   }
   return paths
 }
+
+// The report's own findings, in either entry shape, outside the dependency
+// directory the local report view would choose: node_modules, else vendor,
+// else dependencies.
+function ownFindings(data: unknown) {
+  const objects = (reportEntries(data) ?? []).flat().filter((finding): finding is { file?: unknown } => finding != null && typeof finding === 'object')
+  const directory = dependencyDirectory([{ groups: [objects], tree: (data as { tree?: unknown } | null)?.tree }])
+  return { directory, own: objects.filter(finding => !isDependencyFile(finding.file, directory)) }
+}
+
+// Findings name the repository of their own file. Like the local report view,
+// a report without its own repository belongs to the one repository named by
+// its own findings (Claude Security and Codex exports name one on every finding).
+export function findingsRepository(data: unknown): string | null {
+  const repos = new Map<string, string>()
+  for (const finding of ownFindings(data).own) {
+    const github = reportRepoGithub(finding)
+    if (github) repos.set(github.toLowerCase(), github)
+  }
+  return repos.size === 1 ? [...repos.values()][0]! : null
+}
+
+// The directory shared by the files the report's own findings cite, for alias
+// matching. Dependency paths, including cited evidence, cannot hide it.
+export function ownFileDirectory(data: unknown): string {
+  const { directory, own } = ownFindings(data)
+  return commonFileDirectory([...managedFindingSourcePaths(own)].filter(path => !isDependencyFile(path, directory)))
+}