@vhite/vhite 0.1.0 → 0.8.0

package/src/{reporter.js → output/reporter.js}

@@ -1,6 +1,15 @@
 import { relative } from "node:path";
 import { explanations } from "./explanations.js";
 
+function caretFor(issue) {
+  const startColumn = issue.column ?? 1;
+  const width =
+    issue.endLine === issue.line && issue.endColumn > startColumn
+      ? issue.endColumn - startColumn
+      : Math.max(1, issue.snippet.length - startColumn + 1);
+  return " ".repeat(startColumn - 1) + "^".repeat(width);
+}
+
 export function formatReport(issues, root) {
   if (issues.length === 0) return "No issues found.";
 
@@ -17,9 +26,19 @@ export function formatReport(issues, root) {
   for (const file of sortedFiles) {
     const fileIssues = byFile.get(file);
     lines.push(relative(root, file));
-    fileIssues.sort((a, b) => a.line - b.line);
+    fileIssues.sort(
+      (a, b) => a.line - b.line || (a.column ?? 1) - (b.column ?? 1)
+    );
     for (const issue of fileIssues) {
       lines.push(`  Line ${issue.line}: ${issue.message} [${issue.rule}]`);
+
+      if (issue.snippet !== undefined && issue.endLine !== undefined) {
+        const gutter = String(issue.line);
+        const blank = " ".repeat(gutter.length);
+        lines.push(`    ${gutter} | ${issue.snippet}`);
+        lines.push(`    ${blank} | ${caretFor(issue)}`);
+      }
+
       const info = explanations[issue.rule];
       if (info) {
         lines.push(`    What happened: ${info.whatHappened}`);

package/src/{run-report.js → output/run-report.js}

@@ -7,7 +7,7 @@ import { createInterface } from "node:readline/promises";
 import {
   FIX_DIR,
   ensureGitignoreEntry,
-} from "./gitignore.js";
+} from "../fix/gitignore.js";
 
 function escapeMarkdown(value) {
   return String(value ?? "")

package/src/output/sarif.js

@@ -0,0 +1,60 @@
+import { relative, sep } from "node:path";
+import { rules } from "../../rules/index.js";
+
+const LEVELS = { error: "error", warning: "warning", info: "note" };
+
+function toPosix(path) {
+  return path.split(sep).join("/");
+}
+
+export function formatSarif({ root, issues, version }) {
+  const descriptions = new Map(rules.map((rule) => [rule.name, rule.description]));
+  const ruleIds = [...new Set(issues.map((issue) => issue.rule))].sort();
+
+  const results = issues.map((issue) => {
+    const column = issue.column ?? 1;
+    return {
+      ruleId: issue.rule,
+      level: LEVELS[issue.severity] ?? "warning",
+      message: { text: issue.message },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: toPosix(relative(root, issue.file)) },
+            region: {
+              startLine: issue.line,
+              startColumn: column,
+              endLine: issue.endLine ?? issue.line,
+              endColumn: issue.endColumn ?? column,
+            },
+          },
+        },
+      ],
+    };
+  });
+
+  return JSON.stringify(
+    {
+      $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+      version: "2.1.0",
+      runs: [
+        {
+          tool: {
+            driver: {
+              name: "vhite",
+              version,
+              informationUri: "https://github.com/Wilson-Edem/vhite",
+              rules: ruleIds.map((id) => ({
+                id,
+                shortDescription: { text: descriptions.get(id) ?? id },
+              })),
+            },
+          },
+          results,
+        },
+      ],
+    },
+    null,
+    2
+  );
+}

package/src/scan/baseline.js

@@ -0,0 +1,60 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+
+export const BASELINE_NAME = "vhite.baseline.json";
+
+function toPosix(path) {
+  return path.split(sep).join("/");
+}
+
+export function fingerprintOf(issue, root) {
+  const text = (issue.snippet ?? issue.message).trim();
+  return `${issue.rule}|${toPosix(relative(root, issue.file))}|${text}`;
+}
+
+export function buildBaseline(issues, root) {
+  const fingerprints = {};
+  for (const issue of issues) {
+    const key = fingerprintOf(issue, root);
+    fingerprints[key] = (fingerprints[key] ?? 0) + 1;
+  }
+  return { version: 1, fingerprints };
+}
+
+export async function saveBaseline(root, baseline) {
+  const path = join(root, BASELINE_NAME);
+  await writeFile(path, JSON.stringify(baseline, null, 2) + "\n", "utf8");
+  return path;
+}
+
+export async function loadBaseline(root) {
+  try {
+    const text = await readFile(join(root, BASELINE_NAME), "utf8");
+    const data = JSON.parse(text);
+    if (typeof data.fingerprints !== "object" || data.fingerprints === null) {
+      throw new Error(`${BASELINE_NAME} has no fingerprints`);
+    }
+    return data;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+export function applyBaseline(issues, baseline, root) {
+  const remaining = { ...baseline.fingerprints };
+  const fresh = [];
+  let hidden = 0;
+
+  for (const issue of issues) {
+    const key = fingerprintOf(issue, root);
+    if ((remaining[key] ?? 0) > 0) {
+      remaining[key] -= 1;
+      hidden += 1;
+    } else {
+      fresh.push(issue);
+    }
+  }
+
+  return { issues: fresh, hidden };
+}

package/src/scan/git.js

@@ -0,0 +1,28 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { resolve } from "node:path";
+
+const run = promisify(execFile);
+
+async function git(root, args) {
+  try {
+    const { stdout } = await run("git", args, { cwd: root });
+    return stdout.split(/\r?\n/).filter((line) => line.trim() !== "");
+  } catch (error) {
+    throw new Error(
+      "This option needs a Git repository with at least one commit, and Git must be installed"
+    );
+  }
+}
+
+export async function changedFiles(root, mode) {
+  let names;
+  if (mode === "staged") {
+    names = await git(root, ["diff", "--name-only", "--relative", "--cached"]);
+  } else {
+    const tracked = await git(root, ["diff", "--name-only", "--relative", "HEAD"]);
+    const untracked = await git(root, ["ls-files", "--others", "--exclude-standard"]);
+    names = [...tracked, ...untracked];
+  }
+  return new Set(names.map((name) => resolve(root, name)));
+}

package/src/scan/ignore.js

@@ -0,0 +1,68 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { normalizePath } from "../core/args.js";
+
+const DEFAULT_IGNORES = [
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  "vendor",
+  ".vhite-fix",
+];
+
+function globToRegex(glob) {
+  let source = "";
+  for (let index = 0; index < glob.length; index += 1) {
+    const char = glob[index];
+    if (char === "*" && glob[index + 1] === "*") {
+      source += ".*";
+      index += 1;
+    } else if (char === "*") {
+      source += "[^/]*";
+    } else if (char === "?") {
+      source += "[^/]";
+    } else {
+      source += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${source}$`);
+}
+
+function prefixesOf(path) {
+  const parts = path.split("/");
+  return parts.map((_, index) => parts.slice(0, index + 1).join("/"));
+}
+
+function matchesPattern(relativePath, pattern) {
+  const anchored = pattern.includes("/");
+  const clean = pattern.replace(/^\//, "").replace(/\/$/, "");
+  const regex = globToRegex(clean);
+
+  if (anchored) {
+    return prefixesOf(relativePath).some((prefix) => regex.test(prefix));
+  }
+  return relativePath.split("/").some((segment) => regex.test(segment));
+}
+
+export async function loadIgnorePatterns(root) {
+  const patterns = [...DEFAULT_IGNORES];
+  try {
+    const text = await readFile(join(root, ".gitignore"), "utf8");
+    for (const raw of text.split(/\r?\n/)) {
+      const line = raw.trim();
+      if (line === "" || line.startsWith("#") || line.startsWith("!")) continue;
+      patterns.push(line);
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  return patterns;
+}
+
+export function isIgnored(relativePath, patterns) {
+  const rel = normalizePath(relativePath);
+  return patterns.some((pattern) => matchesPattern(rel, pattern));
+}

package/src/scan/suppress.js

@@ -0,0 +1,53 @@
+import { readFile } from "node:fs/promises";
+
+const DIRECTIVE = /vhite-disable-(next-line|line)(?:\s+([A-Za-z0-9_,\- ]+))?/;
+
+function parseRules(text) {
+  if (!text || text.trim() === "") return null;
+  return new Set(
+    text
+      .split(/[, ]+/)
+      .map((name) => name.trim())
+      .filter((name) => name !== "")
+  );
+}
+
+function directivesFor(source) {
+  const lines = source.split(/\r?\n/);
+  const map = new Map();
+
+  lines.forEach((text, index) => {
+    const match = DIRECTIVE.exec(text);
+    if (!match) return;
+
+    const target = match[1] === "next-line" ? index + 2 : index + 1;
+    map.set(target, parseRules(match[2]));
+  });
+
+  return map;
+}
+
+export async function applySuppressions(issues, root) {
+  const cache = new Map();
+  const kept = [];
+  let suppressed = 0;
+
+  for (const issue of issues) {
+    if (!cache.has(issue.file)) {
+      const source = await readFile(issue.file, "utf8");
+      cache.set(issue.file, directivesFor(source));
+    }
+
+    const directives = cache.get(issue.file);
+    const entry = directives.get(issue.line);
+    const hides = entry !== undefined && (entry === null || entry.has(issue.rule));
+
+    if (hides) {
+      suppressed += 1;
+    } else {
+      kept.push(issue);
+    }
+  }
+
+  return { issues: kept, suppressed };
+}

package/src/smart/consent.js

@@ -0,0 +1,34 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
+
+const CONFIG_NAME = "vhite.config.json";
+
+async function readConfigObject(root) {
+  try {
+    return JSON.parse(await readFile(join(root, CONFIG_NAME), "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+export async function readSmartFixSetting(root) {
+  const data = await readConfigObject(root);
+  return typeof data.smartFixes === "boolean" ? data.smartFixes : undefined;
+}
+
+export async function saveSmartFixSetting(root, value) {
+  const data = await readConfigObject(root);
+  data.smartFixes = value;
+  await writeFile(join(root, CONFIG_NAME), JSON.stringify(data, null, 2) + "\n", "utf8");
+}
+
+export async function askSmartFixConsent() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question("Enable smart fixes for files with findings? (Y/n): ")).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}

package/src/smart/fixes.js

@@ -0,0 +1,143 @@
+import { readFile } from "node:fs/promises";
+import { redact } from "./notes.js";
+
+export const DEFAULT_FIX_ENDPOINT = "https://victor-edem.vercel.app/api/smart-fixes";
+const MAX_CODE_CHARS = 12000;
+const MAX_FINDINGS_PER_REQUEST = 30;
+const CONCURRENCY = 4;
+const FIXABLE = new Set(["error", "warning"]);
+
+export function groupByFile(issues) {
+  const groups = new Map();
+  for (const issue of issues) {
+    if (!FIXABLE.has(issue.severity)) continue;
+    if (!groups.has(issue.file)) groups.set(issue.file, []);
+    groups.get(issue.file).push(issue);
+  }
+  return groups;
+}
+
+export function validateEdits(edits, text, findings) {
+  const lines = text.split("\n");
+  const seen = new Set();
+  const accepted = [];
+
+  for (const edit of Array.isArray(edits) ? edits : []) {
+    if (!edit || !Number.isInteger(edit.line) || seen.has(edit.line)) continue;
+    const finding = findings.find((item) => item.line === edit.line);
+    if (!finding) continue;
+    if (lines[edit.line - 1] !== edit.original) continue;
+    if (typeof edit.replacement !== "string" || edit.replacement.includes("\n")) continue;
+    if (edit.replacement.trim() === edit.original.trim()) continue;
+    seen.add(edit.line);
+    accepted.push({ line: edit.line, original: edit.original, replacement: edit.replacement, finding });
+  }
+  return accepted;
+}
+
+export function toProposals(file, accepted) {
+  return accepted.map((edit) => ({
+    file,
+    line: edit.line,
+    rule: edit.finding.rule,
+    message: edit.finding.message,
+    lineText: edit.original.trim(),
+    original: edit.original,
+    replacement: edit.replacement,
+    smartFix: true,
+  }));
+}
+
+export function smartFixerFor(rule) {
+  return {
+    rule,
+    apply(source, issue) {
+      const lines = source.split("\n");
+      if (lines[issue.line - 1] !== issue.original) return null;
+      if (issue.replacement === "") {
+        lines.splice(issue.line - 1, 1);
+      } else {
+        lines[issue.line - 1] = issue.replacement;
+      }
+      return lines.join("\n");
+    },
+  };
+}
+
+export function smartFixersFor(proposals) {
+  const fixers = {};
+  for (const proposal of proposals) {
+    fixers[proposal.rule] = smartFixerFor(proposal.rule);
+  }
+  return fixers;
+}
+
+async function requestEdits(text, findings, { endpoint, fetchImpl }) {
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      language: "javascript",
+      code: text,
+      findings: findings.slice(0, MAX_FINDINGS_PER_REQUEST).map((item) => ({
+        line: item.line,
+        rule: item.rule,
+        message: item.message,
+      })),
+    }),
+  });
+
+  const data = await response.json().catch(() => ({}));
+  if (response.status === 429) return { limited: true, edits: [] };
+  if (!response.ok) throw new Error(data.error ?? `Smart service returned ${response.status}`);
+  return { edits: data.edits ?? [] };
+}
+
+export async function proposeSmartFixes(issues, say, { endpoint = DEFAULT_FIX_ENDPOINT, fetchImpl = fetch, skipLines = new Set() } = {}) {
+  const groups = [...groupByFile(issues).entries()];
+  const proposals = [];
+  let stopped = false;
+
+  const worker = async () => {
+    while (groups.length > 0 && !stopped) {
+      const [file, findings] = groups.shift();
+      const name = file;
+
+      let text;
+      try {
+        text = await readFile(file, "utf8");
+      } catch {
+        say(`Smart fixes skipped for ${name}: file could not be read`);
+        continue;
+      }
+
+      if (text.length > MAX_CODE_CHARS) {
+        say(`Smart fixes skipped for ${name}: file is too large to send`);
+        continue;
+      }
+      if (redact(text) !== text) {
+        say(`Smart fixes skipped for ${name}: it contains a secret-looking value`);
+        continue;
+      }
+
+      const usable = findings.filter((item) => !skipLines.has(`${file}:${item.line}`));
+      if (usable.length === 0) continue;
+
+      try {
+        const result = await requestEdits(text, usable, { endpoint, fetchImpl });
+        if (result.limited) {
+          say("Daily smart fix limit reached. Try again tomorrow.");
+          stopped = true;
+          return;
+        }
+        const accepted = validateEdits(result.edits, text, usable);
+        proposals.push(...toProposals(file, accepted));
+      } catch (error) {
+        say(`Smart fixes unavailable for ${name}: ${error.message}`);
+      }
+    }
+  };
+
+  await Promise.all(Array.from({ length: CONCURRENCY }, () => worker()));
+  return proposals;
+}

package/src/smart/notes.js

@@ -0,0 +1,73 @@
+import { readFile } from "node:fs/promises";
+
+export const DEFAULT_ENDPOINT = "https://victor-edem.vercel.app/api/smart-notes";
+const CONTEXT_LINES = 5;
+
+const SECRET_PATTERNS = [
+  /\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|password)\b\s*[:=]\s*["'`][^"'`\s]{8,}["'`]/gi,
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16})\b/g,
+];
+
+export function redact(text) {
+  let output = text;
+  for (const pattern of SECRET_PATTERNS) {
+    output = output.replace(pattern, "[REDACTED]");
+  }
+  return output;
+}
+
+export function contextFor(source, line) {
+  const lines = source.split("\n");
+  const start = Math.max(0, line - 1 - CONTEXT_LINES);
+  const end = Math.min(lines.length, line + CONTEXT_LINES);
+  return lines.slice(start, end).join("\n");
+}
+
+export async function noteIssue(issue, source, { endpoint, fetchImpl = fetch } = {}) {
+  const snippet = redact(contextFor(source, issue.line));
+    const url = endpoint || process.env.VHITE_AI_URL || "https://victor-edem.vercel.app/api/smart-notes";
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      rule: issue.rule,
+      message: issue.message,
+      snippet,
+      language: "javascript",
+    }),
+  });
+
+  const data = await response.json().catch(() => ({}));
+  if (response.status === 429) return { limited: true };
+  if (!response.ok) throw new Error(data.error ?? `Smart service returned ${response.status}`);
+  return { text: data.explanation, remaining: data.remaining };
+}
+
+export async function noteAll(issues, say, { fetchImpl = fetch, endpoint } = {}) {
+  const cache = new Map();
+  let explained = 0;
+
+  for (const issue of issues) {
+    if (!cache.has(issue.file)) {
+      cache.set(issue.file, await readFile(issue.file, "utf8"));
+    }
+
+    let result;
+    try {
+      result = await noteIssue(issue, cache.get(issue.file), { endpoint, fetchImpl });
+    } catch (error) {
+      say(`Smart notes unavailable: ${error.message}`);
+      return explained;
+    }
+
+    if (result.limited) {
+      say("Daily smart notes limit reached (20 per day). Try again tomorrow.");
+      return explained;
+    }
+
+    say(`  Smart note for line ${issue.line} [${issue.rule}]: ${result.text}`);
+    explained += 1;
+  }
+
+  return explained;
+}

package/src/config.js

@@ -1,42 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-import { rules } from "../rules/index.js";
-
-const CONFIG_NAME = "vhite.config.json";
-const knownRules = new Set(rules.map((rule) => rule.name));
-
-export async function loadConfig(root) {
-  let text;
-  try {
-    text = await readFile(join(root, CONFIG_NAME), "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return { disabledRules: new Set(), warnings: [] };
-    throw error;
-  }
-
-  let data;
-  try {
-    data = JSON.parse(text);
-  } catch (error) {
-    throw new Error(`${CONFIG_NAME} is not valid JSON: ${error.message}`);
-  }
-
-  if (typeof data !== "object" || data === null || Array.isArray(data)) {
-    throw new Error(`${CONFIG_NAME} must contain a JSON object`);
-  }
-
-  const requested = Array.isArray(data.disabledRules) ? data.disabledRules : [];
-  const disabledRules = new Set();
-  const warnings = [];
-
-  for (const name of requested) {
-    if (knownRules.has(name)) {
-      disabledRules.add(name);
-    } else {
-      warnings.push(`"${name}" is not a rule name, so it was ignored`);
-    }
-  }
-
-  return { disabledRules, warnings };
-}
-

package/src/engine.js

@@ -1,80 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { extname } from "node:path";
-import { parse } from "espree";
-import { rules } from "../rules/index.js";
-
-function parseSource(source, file) {
-  const extension = extname(file).toLowerCase();
-
-  return parse(source, {
-    ecmaVersion: "latest",
-    sourceType: extension === ".cjs" ? "commonjs" : "module",
-    ecmaFeatures: {
-      jsx: true,
-    },
-    loc: true,
-    range: true,
-    comment: true,
-    tokens: true,
-    allowHashBang: true,
-  });
-}
-
-export async function runRules(files, { disabledRules = new Set() } = {}) {
-  const issues = [];
-  const activeRules = rules.filter((rule) => !disabledRules.has(rule.name));
-
-  for (const file of files) {
-    const source = await readFile(file, "utf8");
-    const extension = extname(file).toLowerCase();
-
-    const applicableRules = activeRules.filter((rule) =>
-      rule.extensions?.includes(extension)
-    );
-
-    if (applicableRules.length === 0) {
-      continue;
-    }
-
-    const needsAst = applicableRules.some(
-      (rule) => rule.requiresAst === true
-    );
-
-    let ast;
-
-    if (needsAst) {
-      try {
-        ast = parseSource(source, file);
-      } catch (error) {
-        issues.push({
-          rule: "parser",
-          file,
-          line: error.lineNumber ?? 1,
-          message: `Unable to parse file: ${error.message}`,
-        });
-      }
-    }
-
-    for (const rule of applicableRules) {
-      if (rule.requiresAst === true && !ast) {
-        continue;
-      }
-
-      const found = rule.check({
-        file,
-        source,
-        ...(rule.requiresAst === true ? { ast } : {}),
-      });
-
-      for (const issue of found) {
-        issues.push({
-          rule: rule.name,
-          file,
-          ...issue,
-        });
-      }
-    }
-  }
-
-  return issues;
-}