@quantakrypto/core 0.2.2 → 0.4.0

package/src/verify.ts

@@ -0,0 +1,82 @@
+/**
+ * Snippet-level fix verification: run the detectors over a piece of code (NOT
+ * the filesystem) and report any classical crypto that remains. This is the
+ * deterministic gate a fix must pass — the same logic the MCP `verify_fix` tool
+ * and the remediation pipeline both use, so they can never disagree on what
+ * "the finding is gone" means.
+ */
+import type { Finding } from "./types.js";
+import { detectFile, detectors } from "./scan.js";
+
+/**
+ * Map a language name (or a bare extension) to a source extension whose
+ * detectors we run. Returns null for languages the scanner does not analyze.
+ */
+export function languageToExtension(language: string): string | null {
+  const l = language.trim().toLowerCase().replace(/^\./, "");
+  const map: Record<string, string> = {
+    js: ".js",
+    javascript: ".js",
+    jsx: ".jsx",
+    ts: ".ts",
+    typescript: ".ts",
+    tsx: ".tsx",
+    mjs: ".mjs",
+    cjs: ".cjs",
+    py: ".py",
+    python: ".py",
+    go: ".go",
+    golang: ".go",
+    java: ".java",
+    kotlin: ".kt",
+    kt: ".kt",
+    cs: ".cs",
+    csharp: ".cs",
+    "c#": ".cs",
+    dotnet: ".cs",
+    rs: ".rs",
+    rust: ".rs",
+    rb: ".rb",
+    ruby: ".rb",
+    c: ".c",
+    "c++": ".cpp",
+    cpp: ".cpp",
+    cc: ".cc",
+    h: ".h",
+    hpp: ".hpp",
+  };
+  return map[l] ?? null;
+}
+
+/** Result of {@link verifyFix}: the findings that remain, and whether the
+ * language is one the scanner actually analyzes (so `findings: []` on an
+ * unsupported language is NOT a clean verification). */
+export interface VerifyResult {
+  supported: boolean;
+  findings: Finding[];
+}
+
+/**
+ * Run all detectors over `code`, selecting them by `filename` (extension) or
+ * `language`. Pure: no I/O. When neither identifies an analyzable language,
+ * `supported` is false and the empty findings list must not be read as "fixed".
+ */
+export function verifyFix(
+  code: string,
+  opts: { filename?: string; language?: string },
+): VerifyResult {
+  let name: string;
+  if (opts.filename && opts.filename.trim()) {
+    name = opts.filename.trim();
+  } else if (opts.language && opts.language.trim()) {
+    const ext = languageToExtension(opts.language);
+    if (!ext) return { supported: false, findings: [] };
+    name = `snippet${ext}`;
+  } else {
+    return { supported: false, findings: [] };
+  }
+  const dotExt = name.replace(/^.*(\.[^.]+)$/, "$1");
+  const supported = languageToExtension(dotExt) !== null;
+  const findings = detectFile(name, code, detectors, { source: true, config: true, deps: true });
+  return { supported, findings };
+}

package/src/version.ts

@@ -3,4 +3,4 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export const VERSION = "0.2.2";
+export const VERSION = "0.4.0";

package/src/walk.ts

@@ -8,6 +8,8 @@ import { readdir, stat } from "node:fs/promises";
 import type { Dirent } from "node:fs";
 import * as path from "node:path";
 
+import { isManifestFile } from "./dependencies.js";
+
 /** Directories ignored by default (can be disabled with noDefaultIgnores). */
 export const DEFAULT_IGNORES: readonly string[] = [
   "node_modules",
@@ -116,12 +118,80 @@ export function toPosix(p: string): string {
   return p.split(path.sep).join("/");
 }
 
-/** True if `rel` (a POSIX relative path) matches any pattern (substring/prefix). */
-function matchesAny(rel: string, patterns: readonly string[]): boolean {
+/** A pattern is treated as a glob when it contains one of these metacharacters. */
+function hasGlobMeta(pattern: string): boolean {
+  return /[*?[]/.test(pattern);
+}
+
+/**
+ * Translate a glob into an anchored RegExp: `*` matches within a path segment
+ * (not `/`), `**` matches across segments, a leading `**` before a slash is an
+ * optional path prefix, `?` matches a single non-`/` char, `[...]` is a
+ * character class. Other regex
+ * metacharacters are escaped.
+ */
+function globToRegExp(glob: string): RegExp {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        i++; // consume the second '*'
+        if (glob[i + 1] === "/") {
+          i++; // consume the trailing '/'
+          re += "(?:.*/)?"; // zero or more path segments
+        } else {
+          re += ".*"; // '**' spanning segments
+        }
+      } else {
+        re += "[^/]*"; // '*' within a segment
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+    } else if (c === "[") {
+      // Pass a character class through; find its closing ']'.
+      const end = glob.indexOf("]", i + 1);
+      if (end === -1) {
+        re += "\\[";
+      } else {
+        re += glob.slice(i, end + 1);
+        i = end;
+      }
+    } else if ("\\^$.|+(){}".includes(c)) {
+      re += "\\" + c;
+    } else {
+      re += c;
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+
+/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */
+const GLOB_CACHE = new Map<string, RegExp>();
+function globRegExp(pattern: string): RegExp {
+  let re = GLOB_CACHE.get(pattern);
+  if (!re) {
+    re = globToRegExp(pattern);
+    GLOB_CACHE.set(pattern, re);
+  }
+  return re;
+}
+
+/**
+ * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a
+ * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain
+ * pattern keeps the historical substring / path-prefix semantics (so `"src"`
+ * still matches `src/a.ts` and `"secrets"` matches anywhere).
+ */
+export function matchesAny(rel: string, patterns: readonly string[]): boolean {
   for (const pattern of patterns) {
     if (!pattern) continue;
     const p = toPosix(pattern).replace(/\/+$/, "");
-    // Substring match (handles "src/legacy" or "secrets")...
+    if (hasGlobMeta(p)) {
+      if (globRegExp(p).test(rel)) return true;
+      continue;
+    }
+    // Plain pattern: substring match (handles "src/legacy" or "secrets")...
     if (rel.includes(p)) return true;
     // ...and explicit path-prefix match ("foo" should match "foo/bar.ts").
     if (rel === p || rel.startsWith(`${p}/`)) return true;
@@ -232,16 +302,12 @@ interface WalkContext {
  * scanned for vulnerable dependencies instead of being silently dropped.
  */
 function passesSizeLimit(rel: string, size: number, maxFileSize: number): boolean {
-  if (isManifestPath(rel)) return true;
+  // Dependency manifests are always read (they can exceed the size cap but carry
+  // the whole dependency tree). Uses the single {@link isManifestFile} definition.
+  if (isManifestFile(rel)) return true;
   return size <= maxFileSize;
 }
 
-/** True if the path's basename is a dependency manifest we always read. */
-function isManifestPath(rel: string): boolean {
-  const base = rel.split("/").pop() ?? rel;
-  return base === "package.json" || base === "package-lock.json";
-}
-
 /** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */
 async function* walkDir(absDir: string, relDir: string, ctx: WalkContext): AsyncGenerator<string> {
   let entries: Dirent[];
@@ -274,8 +340,11 @@ async function* walkDir(absDir: string, relDir: string, ctx: WalkContext): Async
     if (!entry.isFile()) continue;
     if (isExcluded(rel, ctx.exclude)) continue;
     if (!isIncluded(rel, ctx.include)) continue;
-    if (isBinaryPath(rel)) continue;
-    if (isGeneratedPath(rel)) continue;
+    // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —
+    // they carry the dependency tree and must not be dropped as binary/generated.
+    const manifest = isManifestFile(rel);
+    if (!manifest && isBinaryPath(rel)) continue;
+    if (!manifest && isGeneratedPath(rel)) continue;
 
     try {
       const s = await stat(abs);

package/src/worktree.ts

@@ -0,0 +1,45 @@
+/**
+ * Ephemeral git worktree runner. Remediation applies candidate patches inside a
+ * throwaway `git worktree` checked out at HEAD, so the user's working tree is
+ * never touched while patches are being tried and verified. The worktree is
+ * always removed afterwards, even if the callback throws.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const exec = promisify(execFile);
+
+async function git(args: string[], cwd?: string): Promise<void> {
+  await exec("git", args, { cwd });
+}
+
+/**
+ * Create a detached worktree of `repoRoot` at HEAD, run `fn` with its path, and
+ * always tear it down. Throws if `repoRoot` is not a git repository.
+ */
+export async function withWorktree<T>(
+  repoRoot: string,
+  fn: (dir: string) => Promise<T>,
+): Promise<T> {
+  try {
+    await git(["rev-parse", "--is-inside-work-tree"], repoRoot);
+  } catch {
+    throw new Error(`withWorktree: "${repoRoot}" is not a git repository`);
+  }
+  const base = await mkdtemp(join(tmpdir(), "quantakrypto-wt-"));
+  const dir = join(base, "wt");
+  await git(["worktree", "add", "--detach", dir], repoRoot);
+  try {
+    return await fn(dir);
+  } finally {
+    try {
+      await git(["worktree", "remove", "--force", dir], repoRoot);
+    } catch {
+      // best effort — the temp dir removal below still reclaims the disk.
+    }
+    await rm(base, { recursive: true, force: true });
+  }
+}