@vhite/vhite 0.6.0 → 0.8.0

package/README.md

@@ -95,6 +95,8 @@ Unknown rule names are reported as warnings, and the rest of the config still ap
 
 ## Safe fixes
 
+Smart notes and smart fixes are optional. When you use them, the lines of code around each finding are sent to Google’s free service, with secrets removed first.
+
 Some problems can be fixed automatically: debugger statements, unused imports, and comments. vhite never changes a file without your approval.
 
 1. It scans the project and lists the problems it found.

package/bin/commands/scan.js

@@ -10,6 +10,9 @@ import { askYesNo, writeRunReport } from "../../src/output/run-report.js";
 import { EXIT, decideExitCode } from "../../src/core/exit-codes.js";
 import { formatJson } from "../../src/output/json-output.js";
 import { formatSarif } from "../../src/output/sarif.js";
+import { noteAll } from "../../src/smart/notes.js";
+import { proposeSmartFixes, smartFixersFor } from "../../src/smart/fixes.js";
+import { readSmartFixSetting, saveSmartFixSetting, askSmartFixConsent } from "../../src/smart/consent.js";
 import { formatReport } from "../../src/output/reporter.js";
 import { BASELINE_NAME, loadBaseline } from "../../src/scan/baseline.js";
 import { readVersion } from "../../src/core/version.js";
@@ -22,6 +25,15 @@ import {
   summaryLine,
 } from "./shared.js";
 
+async function resolveSmartFixSetting(target, interactive) {
+  const saved = await readSmartFixSetting(target);
+  if (saved !== undefined) return saved;
+  if (!interactive) return false;
+  const allowed = await askSmartFixConsent();
+  await saveSmartFixSetting(target, allowed);
+  return allowed;
+}
+
 export async function runScan(options) {
   const target = resolve(options.path ?? ".");
   const isText = options.format === "text";
@@ -88,7 +100,27 @@ export async function runScan(options) {
       say(`${first.suppressed} issue(s) skipped by vhite-disable comments`);
     }
 
-    const proposals = await proposeFixes(issues);
+    const errorFindings = issues.filter((issue) => issue.severity === "error");
+    if (showText && errorFindings.length > 0 && !options.noPrompt && !options.watching) {
+      const wantsAi =
+        options.smartNotes ||
+        (canAskQuestions() &&
+          (await askYesNo("Want smart notes for the errors?")));
+      if (wantsAi) {
+        const explained = await noteAll(errorFindings, say);
+        say(`Smart notes added: ${explained}`);
+      }
+    }
+
+    const deterministic = await proposeFixes(issues);
+    const smartSetting = options.noSmartFixes ? false : await resolveSmartFixSetting(target, interactive);
+    const handled = new Set(deterministic.map((item) => `${item.file}:${item.line}`));
+    let smartProposals = [];
+    if (smartSetting && (interactive || options.fix)) {
+      smartProposals = await proposeSmartFixes(issues, say, { skipLines: handled });
+    }
+
+    const proposals = [...deterministic, ...smartProposals];
     let chosen = [];
 
     if (proposals.length > 0) {
@@ -105,10 +137,29 @@ export async function runScan(options) {
     }
 
     if (chosen.length > 0) {
-      const result = await applyApprovedFixes(target, chosen, { disabledRules: disabled });
-      fixResults = result.results;
+      let gitignoreUpdated = false;
+      const results = [];
+
+      const plainChosen = chosen.filter((item) => !item.smartFix);
+      if (plainChosen.length > 0) {
+        const applied = await applyApprovedFixes(target, plainChosen, { disabledRules: disabled });
+        results.push(...applied.results);
+        gitignoreUpdated = gitignoreUpdated || applied.gitignoreUpdated;
+      }
+
+      const smartChosen = chosen.filter((item) => item.smartFix);
+      if (smartChosen.length > 0) {
+        const applied = await applyApprovedFixes(target, smartChosen, {
+          disabledRules: disabled,
+          fixers: smartFixersFor(smartChosen),
+        });
+        results.push(...applied.results);
+        gitignoreUpdated = gitignoreUpdated || applied.gitignoreUpdated;
+      }
+
+      fixResults = results;
 
-      if (result.gitignoreUpdated) {
+      if (gitignoreUpdated) {
         say(`Added ${FIX_DIR}/ to .gitignore`);
       }
 

package/bin/output/text.js

@@ -18,6 +18,8 @@ Options:
   --disable <name>          Turn off a rule (repeatable)
   --include <path>          Scan only files under this path (repeatable)
   --exclude <path>          Skip files under this path (repeatable)
+  --smart-notes             Add short notes for errors (asked when not given)
+  --no-smart-fixes          Skip smart fixes for this run
   --help, -h                Show this help
 
 Exit codes:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vhite/vhite",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "An AI code cleaner for front-end projects that finds and safely fixes common AI-generated problems",
   "license": "ISC",
   "author": "Victor Edem",

package/src/core/args.js

@@ -19,6 +19,8 @@ export function parseArgs(argv) {
     watch: false,
     noPrompt: false,
     force: false,
+    smartNotes: false,
+    noSmartFixes: false,
     rules: [],
     disable: [],
     include: [],
@@ -50,6 +52,10 @@ export function parseArgs(argv) {
       options.noPrompt = true;
     } else if (arg === "--watch") {
       options.watch = true;
+            } else if (arg === "--no-smart-fixes") {
+        options.noSmartFixes = true;
+            } else if (arg === "--smart-notes") {
+        options.smartNotes = true;
     } else if (arg === "--force") {
       options.force = true;
     } else if (VALUE_FLAGS.has(arg)) {

package/src/smart/consent.js

@@ -0,0 +1,34 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
+
+const CONFIG_NAME = "vhite.config.json";
+
+async function readConfigObject(root) {
+  try {
+    return JSON.parse(await readFile(join(root, CONFIG_NAME), "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+export async function readSmartFixSetting(root) {
+  const data = await readConfigObject(root);
+  return typeof data.smartFixes === "boolean" ? data.smartFixes : undefined;
+}
+
+export async function saveSmartFixSetting(root, value) {
+  const data = await readConfigObject(root);
+  data.smartFixes = value;
+  await writeFile(join(root, CONFIG_NAME), JSON.stringify(data, null, 2) + "\n", "utf8");
+}
+
+export async function askSmartFixConsent() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question("Enable smart fixes for files with findings? (Y/n): ")).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}

package/src/smart/fixes.js

@@ -0,0 +1,143 @@
+import { readFile } from "node:fs/promises";
+import { redact } from "./notes.js";
+
+export const DEFAULT_FIX_ENDPOINT = "https://victor-edem.vercel.app/api/smart-fixes";
+const MAX_CODE_CHARS = 12000;
+const MAX_FINDINGS_PER_REQUEST = 30;
+const CONCURRENCY = 4;
+const FIXABLE = new Set(["error", "warning"]);
+
+export function groupByFile(issues) {
+  const groups = new Map();
+  for (const issue of issues) {
+    if (!FIXABLE.has(issue.severity)) continue;
+    if (!groups.has(issue.file)) groups.set(issue.file, []);
+    groups.get(issue.file).push(issue);
+  }
+  return groups;
+}
+
+export function validateEdits(edits, text, findings) {
+  const lines = text.split("\n");
+  const seen = new Set();
+  const accepted = [];
+
+  for (const edit of Array.isArray(edits) ? edits : []) {
+    if (!edit || !Number.isInteger(edit.line) || seen.has(edit.line)) continue;
+    const finding = findings.find((item) => item.line === edit.line);
+    if (!finding) continue;
+    if (lines[edit.line - 1] !== edit.original) continue;
+    if (typeof edit.replacement !== "string" || edit.replacement.includes("\n")) continue;
+    if (edit.replacement.trim() === edit.original.trim()) continue;
+    seen.add(edit.line);
+    accepted.push({ line: edit.line, original: edit.original, replacement: edit.replacement, finding });
+  }
+  return accepted;
+}
+
+export function toProposals(file, accepted) {
+  return accepted.map((edit) => ({
+    file,
+    line: edit.line,
+    rule: edit.finding.rule,
+    message: edit.finding.message,
+    lineText: edit.original.trim(),
+    original: edit.original,
+    replacement: edit.replacement,
+    smartFix: true,
+  }));
+}
+
+export function smartFixerFor(rule) {
+  return {
+    rule,
+    apply(source, issue) {
+      const lines = source.split("\n");
+      if (lines[issue.line - 1] !== issue.original) return null;
+      if (issue.replacement === "") {
+        lines.splice(issue.line - 1, 1);
+      } else {
+        lines[issue.line - 1] = issue.replacement;
+      }
+      return lines.join("\n");
+    },
+  };
+}
+
+export function smartFixersFor(proposals) {
+  const fixers = {};
+  for (const proposal of proposals) {
+    fixers[proposal.rule] = smartFixerFor(proposal.rule);
+  }
+  return fixers;
+}
+
+async function requestEdits(text, findings, { endpoint, fetchImpl }) {
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      language: "javascript",
+      code: text,
+      findings: findings.slice(0, MAX_FINDINGS_PER_REQUEST).map((item) => ({
+        line: item.line,
+        rule: item.rule,
+        message: item.message,
+      })),
+    }),
+  });
+
+  const data = await response.json().catch(() => ({}));
+  if (response.status === 429) return { limited: true, edits: [] };
+  if (!response.ok) throw new Error(data.error ?? `Smart service returned ${response.status}`);
+  return { edits: data.edits ?? [] };
+}
+
+export async function proposeSmartFixes(issues, say, { endpoint = DEFAULT_FIX_ENDPOINT, fetchImpl = fetch, skipLines = new Set() } = {}) {
+  const groups = [...groupByFile(issues).entries()];
+  const proposals = [];
+  let stopped = false;
+
+  const worker = async () => {
+    while (groups.length > 0 && !stopped) {
+      const [file, findings] = groups.shift();
+      const name = file;
+
+      let text;
+      try {
+        text = await readFile(file, "utf8");
+      } catch {
+        say(`Smart fixes skipped for ${name}: file could not be read`);
+        continue;
+      }
+
+      if (text.length > MAX_CODE_CHARS) {
+        say(`Smart fixes skipped for ${name}: file is too large to send`);
+        continue;
+      }
+      if (redact(text) !== text) {
+        say(`Smart fixes skipped for ${name}: it contains a secret-looking value`);
+        continue;
+      }
+
+      const usable = findings.filter((item) => !skipLines.has(`${file}:${item.line}`));
+      if (usable.length === 0) continue;
+
+      try {
+        const result = await requestEdits(text, usable, { endpoint, fetchImpl });
+        if (result.limited) {
+          say("Daily smart fix limit reached. Try again tomorrow.");
+          stopped = true;
+          return;
+        }
+        const accepted = validateEdits(result.edits, text, usable);
+        proposals.push(...toProposals(file, accepted));
+      } catch (error) {
+        say(`Smart fixes unavailable for ${name}: ${error.message}`);
+      }
+    }
+  };
+
+  await Promise.all(Array.from({ length: CONCURRENCY }, () => worker()));
+  return proposals;
+}

package/src/smart/notes.js

@@ -0,0 +1,73 @@
+import { readFile } from "node:fs/promises";
+
+export const DEFAULT_ENDPOINT = "https://victor-edem.vercel.app/api/smart-notes";
+const CONTEXT_LINES = 5;
+
+const SECRET_PATTERNS = [
+  /\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|password)\b\s*[:=]\s*["'`][^"'`\s]{8,}["'`]/gi,
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16})\b/g,
+];
+
+export function redact(text) {
+  let output = text;
+  for (const pattern of SECRET_PATTERNS) {
+    output = output.replace(pattern, "[REDACTED]");
+  }
+  return output;
+}
+
+export function contextFor(source, line) {
+  const lines = source.split("\n");
+  const start = Math.max(0, line - 1 - CONTEXT_LINES);
+  const end = Math.min(lines.length, line + CONTEXT_LINES);
+  return lines.slice(start, end).join("\n");
+}
+
+export async function noteIssue(issue, source, { endpoint, fetchImpl = fetch } = {}) {
+  const snippet = redact(contextFor(source, issue.line));
+    const url = endpoint || process.env.VHITE_AI_URL || "https://victor-edem.vercel.app/api/smart-notes";
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      rule: issue.rule,
+      message: issue.message,
+      snippet,
+      language: "javascript",
+    }),
+  });
+
+  const data = await response.json().catch(() => ({}));
+  if (response.status === 429) return { limited: true };
+  if (!response.ok) throw new Error(data.error ?? `Smart service returned ${response.status}`);
+  return { text: data.explanation, remaining: data.remaining };
+}
+
+export async function noteAll(issues, say, { fetchImpl = fetch, endpoint } = {}) {
+  const cache = new Map();
+  let explained = 0;
+
+  for (const issue of issues) {
+    if (!cache.has(issue.file)) {
+      cache.set(issue.file, await readFile(issue.file, "utf8"));
+    }
+
+    let result;
+    try {
+      result = await noteIssue(issue, cache.get(issue.file), { endpoint, fetchImpl });
+    } catch (error) {
+      say(`Smart notes unavailable: ${error.message}`);
+      return explained;
+    }
+
+    if (result.limited) {
+      say("Daily smart notes limit reached (20 per day). Try again tomorrow.");
+      return explained;
+    }
+
+    say(`  Smart note for line ${issue.line} [${issue.rule}]: ${result.text}`);
+    explained += 1;
+  }
+
+  return explained;
+}