@rmyndharis/aimhooman 0.1.7 → 0.2.0

package/src/report.mjs

@@ -1,5 +1,39 @@
 // Human-facing and JSON reporting for aimhooman findings.
 
+// HUMAN_FINDING_CAP bounds the per-invocation stderr output. A scan that fires
+// many findings of the same rule (a vendored OpenSSL corpus can produce 99) used
+// to emit hundreds of near-identical lines with no truncation marker. The cap
+// prints the first HUMAN_FINDING_CAP finding blocks, then a single summary line
+// for the rest. The JSON report (aimhooman review / --json) is never capped.
+const HUMAN_FINDING_CAP = 20;
+
+// UT-06: prefix -> provider for secret.provider-token findings. The rule packs
+// every provider into one pattern set (rules/secrets.json), so the provider
+// name is recovered from the raw matched line at report time — before the
+// redaction below runs. Only the label is ever rendered, never the token.
+// Mirrors the rule's patterns; keep the rule's alternation order.
+const TOKEN_PROVIDERS = [
+    ['ghp_', 'GitHub'], ['gho_', 'GitHub'], ['ghu_', 'GitHub'], ['ghs_', 'GitHub'],
+    ['ghr_', 'GitHub'], ['github_pat_', 'GitHub'],
+    ['glpat-', 'GitLab'],
+    ['npm_', 'npm'],
+    ['xoxb-', 'Slack'], ['xoxp-', 'Slack'], ['xoxa-', 'Slack'], ['xoxr-', 'Slack'], ['xoxs-', 'Slack'],
+    ['sk-ant-', 'Anthropic'],
+    ['sk-proj-', 'OpenAI'],
+    ['AIza', 'Google'],
+    ['sk_live_', 'Stripe'], ['rk_live_', 'Stripe'],
+    ['hf_', 'Hugging Face'],
+    ['SG.', 'SendGrid'],
+];
+
+function tokenProvider(text) {
+    if (!text) return undefined;
+    for (const [prefix, provider] of TOKEN_PROVIDERS) {
+        if (text.includes(prefix)) return provider;
+    }
+    return undefined;
+}
+
 export function human(findings, tone) {
     if (!findings.length) return '';
     let out = tone === 'professional' ? '\n' : '\nnot very hooman.\n\n';
@@ -8,20 +42,54 @@ export function human(findings, tone) {
     for (const f of findings) {
         if (f.decision === 'block') block += 1;
         else if (f.decision === 'review') review += 1;
+    }
+    // Render findings in order up to the cap, then collapse the rest into one
+    // summary line. Keeps the first findings fully visible (the actionable ones)
+    // while bounding stderr for repeated-rule scans.
+    const shown = findings.slice(0, HUMAN_FINDING_CAP);
+    const hidden = findings.length - shown.length;
+    const fixesPrinted = new Set();
+    for (const f of shown) {
         const loc = f.path
             ? `${visible(f.path)}${f.line ? `:${f.line}` : ''}`
             : (f.line ? `commit message line ${f.line}` : '');
         const related = (f.matchedRuleIds || []).filter((id) => id !== f.ruleId);
         const identity = related.length ? `${f.ruleId} (+ ${related.join(', ')})` : f.ruleId;
         const commit = f.commit ? ` [commit ${String(f.commit).slice(0, 12)}]` : '';
-        out += `${f.decision.toUpperCase().padEnd(6)} ${identity}${commit}\n       ${loc}\n       ${f.reason}\n`;
+        // UT-06: a provider-token finding used to say only "a provider access
+        // token", leaving the developer to guess which credential to revoke.
+        // Name the provider in the reason; the token itself stays redacted.
+        const provider = f.ruleId === 'secret.provider-token' ? tokenProvider(f.text) : undefined;
+        const reason = provider
+            ? f.reason.replace('provider access token', `provider access token (${provider})`)
+            : f.reason;
+        out += `${f.decision.toUpperCase().padEnd(6)} ${identity}${commit}\n       ${loc}\n       ${reason}\n`;
         if (f.text && f.text.trim()) {
             out += `       > ${isSensitive(f) ? '[redacted]' : visible(f.text.trim())}\n`;
         }
-        if (f.remediation?.length) out += `       fix: ${f.remediation[0]}\n`;
+        // Render the whole remediation array, not just the first entry. Several
+        // rules carry a second line (e.g. "rotate the key if it was ever exposed")
+        // that the previous single-index render dropped silently. UT-08: print a
+        // rule's fix once — a repeated rule (20 hits of the same secret rule)
+        // used to reprint the identical fix block for every finding.
+        const remedies = f.remediation || [];
+        if (remedies.length && fixesPrinted.has(f.ruleId)) {
+            out += `       fix: as above for ${f.ruleId}\n`;
+        } else {
+            if (remedies.length) fixesPrinted.add(f.ruleId);
+            for (const remedy of remedies) {
+                out += `       fix: ${remedy}\n`;
+            }
+        }
         out += '\n';
     }
-    out += `${findings.length} findings: ${block} block, ${review} review\n`;
+    if (hidden > 0) {
+        out += `… and ${hidden} more ${hidden === 1 ? 'finding' : 'findings'} (run 'aimhooman review' for the full list)\n\n`;
+    }
+    const findingWord = findings.length === 1 ? 'finding' : 'findings';
+    const blockWord = block === 1 ? 'block' : 'blocks';
+    const reviewWord = review === 1 ? 'review' : 'reviews';
+    out += `${findings.length} ${findingWord}: ${block} ${blockWord}, ${review} ${reviewWord}\n`;
     return out;
 }
 

package/src/scan-session.mjs

@@ -86,6 +86,11 @@ export function scanEntries(repo, engine, entries, options = {}) {
     stats.objects_read = batch.objects.size;
     for (const failure of batch.failures) increment(stats.skipped, failure.reason);
 
+    // Precompute changed-line ranges for all text candidates in ONE batched
+    // diff per (commit, parent) pair (W4 + perf). A missing path key means
+    // "scan the whole blob" (staged/snapshot/root entries, or a diff failure).
+    const lineRanges = collectLineRanges(repo, candidates);
+
     const findings = [];
     for (const entry of candidates) {
         const blob = batch.objects.get(entry.oid);
@@ -110,7 +115,9 @@ export function scanEntries(repo, engine, entries, options = {}) {
             });
         } else {
             stats.files_scanned += 1;
-            matched = engine.checkContent(entry.path, blob.toString('utf8'));
+            const ranges = lineRanges.get(entry.path);
+            matched = engine.checkContent(entry.path, blob.toString('utf8'),
+                ranges && ranges.length ? { lineRanges: ranges } : {});
         }
         stats.findings_total += matched.length;
         for (const finding of matched) {
@@ -236,3 +243,72 @@ function isBinary(buffer) {
     for (let index = 0; index < length; index++) if (buffer[index] === 0) return true;
     return false;
 }
+
+// collectLineRanges builds a Map<path, ranges[]> for all entries whose content
+// scan can be narrowed to changed hunks (W4, bug 12d-F1). It batches the work
+// into ONE `git diff --unified=0` per (commit, parent) pair rather than one diff
+// per file — a commit touching 50 files would otherwise pay ~650ms of per-file
+// git subprocess startup. Entries are grouped by their first parent; a normal
+// commit (single parent) is a single diff call covering every file.
+//
+// Entries without commit/parents (tracked snapshots, staged views, root
+// commits) are omitted from the map; the caller treats a missing key as "scan
+// the whole blob" — the safe side for a secret scanner is to scan MORE, not
+// less, so a failure to compute hunks falls back to the pre-W4 behaviour.
+function collectLineRanges(repo, entries) {
+    // Group text-candidate entries by their first parent to batch the diffs.
+    // Key by `${commit}\0${parent}` so a merge with multiple parents produces
+    // one diff per distinct (commit, parent) pair.
+    const groups = new Map();
+    for (const entry of entries) {
+        if (entry.type === 'blob' && !entry.commit) continue; // staged/snapshot: no diff
+        const parent = entry.parents?.[0];
+        if (!entry.commit || !parent) continue; // root commit or no parent: whole-blob
+        const key = `${entry.commit}\0${parent}`;
+        if (!groups.has(key)) groups.set(key, { commit: entry.commit, parent });
+    }
+    const byPath = new Map();
+    for (const { commit, parent } of groups.values()) {
+        let output;
+        try {
+            output = execFileSync('git', [
+                '-c', 'core.quotePath=false',
+                'diff', '--unified=0', '--no-color', '--no-prefix',
+                parent, commit,
+            ], {
+                cwd: repo.root,
+                env: gitEnvironment(),
+                encoding: 'utf8',
+                timeout: GIT_TIMEOUT_MS,
+                maxBuffer: 16 * 1024 * 1024,
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+        } catch {
+            continue; // diff failed → those paths stay absent → whole-blob scan
+        }
+        // Parse the multi-file diff: track the current file from the `+++ path`
+        // line, and attribute each `@@` hunk header to it. core.quotePath=false
+        // keeps spaces and non-ASCII paths literal so they match entry.path (which
+        // comes from git diff --raw -z, also unquoted). Paths containing newlines
+        // are not handled, but they fall back to a whole-blob scan (safe).
+        let currentPath = null;
+        for (const line of output.split('\n')) {
+            // With --no-prefix the +++ line is `+++ path` (no b/ prefix).
+            const plusMatch = /^\+\+\+ (.+)$/.exec(line);
+            if (plusMatch) {
+                currentPath = plusMatch[1] === '/dev/null' ? null : plusMatch[1];
+                continue;
+            }
+            const match = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+            if (!match || !currentPath) continue;
+            const start = Number(match[1]);
+            const count = match[2] === undefined ? 1 : Number(match[2]);
+            if (start === 0 || count === 0) continue; // pure deletion, no new content
+            const range = { start, end: start + count - 1 };
+            const existing = byPath.get(currentPath);
+            if (existing) existing.push(range);
+            else byPath.set(currentPath, [range]);
+        }
+    }
+    return byPath;
+}

package/src/scan.mjs

@@ -51,13 +51,35 @@ export class Engine {
     decide(base, target, rule, context = {}) {
         if (this.denyPaths.has(target) || this.denyRules.has(rule.id)) return 'block';
         if (context.transientAllowRules?.has(rule.id)) return 'allow';
-        if (this.scopedAllow.some((entry) => (
-            entry.target === target
-            && entry.ruleId === rule.id
-            && entry.transition === context.transition
-            && entry.newObjectId === context.objectId
-            && entry.newMode === context.mode
-        ))) return 'allow';
+        // W11 (F2): review binding is profile-dependent.
+        //   - strict: review binds the EXACT reviewed blob. A changed/copied/
+        //     symlinked/mode-flipped target is NOT covered — it must be re-
+        //     reviewed. This is the security property the strict lifecycle tests
+        //     pin, and strict is the profile that exits 11 on review.
+        //   - clean/compliance: review is ADVISORY (a stderr message, exit 0),
+        //     so re-surfacing it on every edit of a reviewed agent-instruction
+        //     file (CLAUDE.md, AGENTS.md) is pure friction with no security
+        //     payoff — the security boundary is secret scanning, strict blocks,
+        //     and reference-transaction. A LIVE-FILE review (newObjectId set)
+        //     therefore persists per path + rule across edits. A TOMBSTONE
+        //     review (newObjectId null — a reviewed deletion) keeps the exact
+        //     match in every profile: a deletion review must not silently cover
+        //     a later re-adding of the file.
+        const strictReview = this.profile === 'strict';
+        if (this.scopedAllow.some((entry) => {
+            if (entry.target !== target || entry.ruleId !== rule.id) return false;
+            if (entry.newObjectId === null) {
+                // Tombstone: exact match in every profile.
+                return entry.transition === context.transition
+                    && entry.newObjectId === context.objectId
+                    && entry.newMode === context.mode;
+            }
+            // Live-file review: exact in strict; path-anchored in clean/compliance.
+            return !strictReview
+                || (entry.transition === context.transition
+                    && entry.newObjectId === context.objectId
+                    && entry.newMode === context.mode);
+        })) return 'allow';
         // A rule-level allow cannot bypass the secret-category guard that the
         // path-level allow below enforces: secret rules require an explicit
         // --scope secret-path override on a specific path, never a blanket rule allow.
@@ -119,7 +141,18 @@ export class Engine {
         const categories = Array.isArray(options.categories)
             ? new Set(options.categories)
             : null;
+        // lineRanges narrows content scanning to changed hunks (W4, bug 12d-F1).
+        // When provided (an array of inclusive 1-based {start,end} ranges), only
+        // lines falling in a range are evaluated; this stops a file that contains
+        // a secret-bearing line ELSEWHERE (a PEM header inside a test string on
+        // line 200) from blocking a commit that only edited line 50. Findings
+        // keep their real line numbers because lineRecords already anchors them.
+        // Absent = scan every line (the pre-W4 behaviour).
+        const ranges = Array.isArray(options.lineRanges) && options.lineRanges.length
+            ? options.lineRanges
+            : null;
         for (const record of lineRecords(String(content))) {
+            if (ranges && !ranges.some((range) => record.line >= range.start && record.line <= range.end)) continue;
             this.#markLocalInputSkip('code', p, record.text, categories);
             const result = this.#evaluate('code', p, record.text, { categories });
             if (result) out.push(finding(result, { path: p, line: record.line, text: record.text }));