@vibecheckai/cli 3.5.0 → 3.5.1

package/bin/runners/lib/analysis-core.js

@@ -1,11 +1,14 @@
 /**
- * Analysis Core v2 - Resilient analysis engine
- *
- * Enhancements:
- * - 🛡️ Safe Runner: Individual analyzer failures don't crash the scan
- * - ⏱️ Performance: Tracks timing for every analyzer
- * - 🧩 Extensible: Clean support for 'extended' scan analyzers
- * - 🧹 Deduping: Removes duplicate findings automatically
+ * Analysis Core - Shared analysis engine for Ship and Scan
+ * 
+ * Consolidates common logic:
+ * - Truthpack generation
+ * - Finding collection
+ * - Verdict calculation
+ * - Output formatting
+ * 
+ * Ship = Fast path (core analyzers only)
+ * Scan = Deep path (core + extended analyzers + optional layers)
  */
 
 const path = require("path");
@@ -23,108 +26,32 @@ const {
 const { findingsFromReality } = require("./reality-findings");
 
 // ============================================================================
-// TYPES (JSDoc) - Kept largely the same for compatibility
-// ============================================================================
-
-/** @typedef {('BLOCK'|'WARN'|'INFO')} FindingSeverity */
-/* ... (Existing typedefs omitted for brevity, assume they are present) ... */
-
-// ============================================================================
-// ANALYZER REGISTRY
-// ============================================================================
-
-/**
- * Core analyzers run on every 'ship' check.
- * They must be fast (static analysis only, no network).
- */
-const CORE_ANALYZERS = [
-  { name: "missing-routes", fn: (r, t) => findMissingRoutes(t) },
-  { name: "env-gaps", fn: (r, t) => findEnvGaps(t) },
-  { name: "fake-success", fn: (r, t) => findFakeSuccess(r) }, // Uses root, not truthpack
-  { name: "ghost-auth", fn: (r, t) => findGhostAuth(t, r) },
-  { name: "stripe-safety", fn: (r, t) => findStripeWebhookViolations(t) },
-  { name: "paid-surface", fn: (r, t) => findPaidSurfaceNotEnforced(t) },
-  { name: "owner-bypass", fn: (r, t) => findOwnerModeBypass(r) },
-  { name: "reality-check", fn: (r, t) => findingsFromReality(r) }
-];
-
-/**
- * Extended analyzers run only on 'scan' checks.
- * Can include deeper/slower checks.
- */
-const EXTENDED_ANALYZERS = [
-  // Example placeholder: { name: "deep-secret-scan", fn: ... }
-];
-
-// ============================================================================
-// EXECUTION ENGINE
+// CORE ANALYSIS (Used by both Ship and Scan)
 // ============================================================================
 
 /**
- * Safely runs a list of analyzers with timing and error isolation.
- *
- * @param {Array<{name: string, fn: Function}>} analyzers
- * @param {string} root
- * @param {object} truthpack
- * @returns {Promise<{findings: Finding[], timings: Record<string, number>}>}
+ * Run core analyzers that apply to all projects
+ * @param {string} root - Project root path
+ * @param {object} truthpack - Generated truthpack
+ * @returns {Array} - Array of findings
  */
-async function runAnalyzerSuite(analyzers, root, truthpack) {
-  const allFindings = [];
-  const timings = {};
-
-  for (const tool of analyzers) {
-    const start = process.hrtime();
-    try {
-      // Support both sync and async analyzers
-      const fnResult = tool.fn(root, truthpack);
-      const result = fnResult instanceof Promise ? await fnResult : fnResult;
-      
-      if (Array.isArray(result)) {
-        allFindings.push(...result);
-      }
-    } catch (err) {
-      // 🛡️ Safe Runner: Don't crash the whole scan if one rule fails
-      console.error(`[vibecheck] Analyzer '${tool.name}' crashed:`, err.message);
-      
-      allFindings.push({
-        category: "SystemError",
-        severity: "WARN",
-        title: `Analyzer Failed: ${tool.name}`,
-        message: err.message,
-        why: "Internal analyzer error. This may hide issues.",
-        fixHints: ["Update vibecheck to the latest version", "Report this issue to support"]
-      });
-    } finally {
-      const end = process.hrtime(start);
-      // Convert [seconds, nanoseconds] to milliseconds
-      timings[tool.name] = (end[0] * 1000 + end[1] / 1e6).toFixed(2);
-    }
-  }
-
-  return { findings: dedupeFindings(allFindings), timings };
-}
-
-/**
- * Removes duplicate findings based on a content hash.
- * * @param {Finding[]} findings 
- * @returns {Finding[]}
- */
-function dedupeFindings(findings) {
-  const seen = new Set();
-  return findings.filter(f => {
-    // create a stable signature for the finding
-    const sig = `${f.category}|${f.title}|${f.evidence?.[0]?.file}|${f.evidence?.[0]?.line}`;
-    if (seen.has(sig)) return false;
-    seen.add(sig);
-    return true;
-  });
+function runCoreAnalyzers(root, truthpack) {
+  return [
+    ...findMissingRoutes(truthpack),
+    ...findEnvGaps(truthpack),
+    ...findFakeSuccess(root),
+    ...findGhostAuth(truthpack, root),
+    ...findStripeWebhookViolations(truthpack),
+    ...findPaidSurfaceNotEnforced(truthpack),
+    ...findOwnerModeBypass(root),
+    ...findingsFromReality(root)
+  ];
 }
 
 /**
- * Calculate verdict from findings.
- *
- * @param {Finding[]} findings
- * @returns {('SHIP'|'WARN'|'BLOCK')}
+ * Calculate verdict from findings
+ * @param {Array} findings - Array of findings
+ * @returns {string} - SHIP | WARN | BLOCK
  */
 function calculateVerdict(findings) {
   if (findings.some(f => f.severity === "BLOCK")) return "BLOCK";
@@ -132,158 +59,213 @@ function calculateVerdict(findings) {
   return "SHIP";
 }
 
-// ============================================================================
-// PROOF GRAPH (Unchanged logic, cleaner organization)
-// ============================================================================
-
-// ... (Keep existing getClaimType, getGapType, getConfidenceScore, mapSeverity helpers) ...
-
+/**
+ * Build proof graph from findings
+ * @param {Array} findings - Array of findings
+ * @param {object} truthpack - Truthpack data
+ * @param {string} root - Project root path
+ * @returns {object} - Proof graph
+ */
 function buildProofGraph(findings, truthpack, root) {
-  // ... (Keep existing logic, it was solid) ...
-  // Ensure we map over deduped findings
-  
-  /** @type {ProofClaim[]} */
   const claims = [];
   let claimId = 0;
-
-  // Re-implementing just the loop to ensure variables are in scope
+  
   for (const finding of findings) {
-    const currentId = ++claimId;
-    // ... (rest of the mapping logic from original file) ...
-    // Placeholder to keep response concise - assume previous logic here
-    const baseEvidence = Array.isArray(finding.evidence) ? finding.evidence : [];
-    
-    // Safety check for evidence
-    const primaryEvidence = baseEvidence[0];
-    const line = primaryEvidence 
-      ? (parseInt(primaryEvidence.lines?.split("-")[0], 10) || primaryEvidence.line || 1) 
-      : 1;
-
-    claims.push({
-      id: `claim-${currentId}`,
-      type: "issue_detected", // simplified for brevity
-      assertion: finding.title || "Issue detected",
-      verified: finding.severity !== "BLOCK",
-      confidence: 0.8,
-      evidence: [],
-      gaps: [],
-      severity: finding.severity === "BLOCK" ? "critical" : "medium",
-      file: primaryEvidence?.file || "",
-      line
-    });
+    const claim = {
+      id: `claim-${++claimId}`,
+      type: getClaimType(finding.category),
+      assertion: finding.title || finding.message,
+      verified: finding.severity !== 'BLOCK',
+      confidence: finding.confidence === 'high' ? 0.9 : finding.confidence === 'medium' ? 0.7 : 0.5,
+      evidence: (finding.evidence || []).map((e, i) => ({
+        id: `evidence-${claimId}-${i}`,
+        type: 'file_citation',
+        file: e.file,
+        line: parseInt(e.lines?.split('-')[0]) || e.line || 1,
+        snippet: e.snippetHash || '',
+        strength: 0.8,
+        verifiedAt: new Date().toISOString(),
+        method: 'static'
+      })),
+      gaps: [{
+        id: `gap-${claimId}`,
+        type: getGapType(finding.category),
+        description: finding.why || finding.title,
+        severity: finding.severity === 'BLOCK' ? 'critical' : finding.severity === 'WARN' ? 'medium' : 'low',
+        suggestion: (finding.fixHints || [])[0] || ''
+      }],
+      severity: finding.severity === 'BLOCK' ? 'critical' : finding.severity === 'WARN' ? 'medium' : 'low',
+      file: finding.evidence?.[0]?.file || '',
+      line: parseInt(finding.evidence?.[0]?.lines?.split('-')[0]) || 1
+    };
+    claims.push(claim);
   }
-
-  // Calculate summaries
+  
+  const verifiedClaims = claims.filter(c => c.verified);
   const failedClaims = claims.filter(c => !c.verified);
+  const allGaps = claims.flatMap(c => c.gaps);
+  
+  const riskScore = Math.min(100, failedClaims.reduce((sum, c) => {
+    if (c.severity === 'critical') return sum + 30;
+    if (c.severity === 'high') return sum + 20;
+    if (c.severity === 'medium') return sum + 10;
+    return sum + 5;
+  }, 0));
+  
+  const confidence = claims.length > 0 
+    ? claims.reduce((sum, c) => sum + c.confidence, 0) / claims.length 
+    : 1.0;
   
   return {
-    version: "1.1.0",
+    version: '1.0.0',
     generatedAt: new Date().toISOString(),
     projectPath: root,
     claims,
     summary: {
       totalClaims: claims.length,
-      verifiedClaims: claims.length - failedClaims.length,
+      verifiedClaims: verifiedClaims.length,
       failedClaims: failedClaims.length,
-      gaps: 0, 
-      riskScore: failedClaims.length * 10,
-      confidence: 1.0
+      gaps: allGaps.length,
+      riskScore,
+      confidence
     },
     verdict: calculateVerdict(findings),
-    topBlockers: failedClaims.slice(0, 5),
-    topGaps: []
+    topBlockers: failedClaims.filter(c => c.severity === 'critical' || c.severity === 'high').slice(0, 5),
+    topGaps: allGaps.filter(g => g.severity === 'critical' || g.severity === 'high').slice(0, 5)
   };
 }
 
+function getClaimType(category) {
+  const map = {
+    'MissingRoute': 'route_exists',
+    'EnvContract': 'env_declared',
+    'FakeSuccess': 'success_verified',
+    'GhostAuth': 'auth_protected',
+    'StripeWebhook': 'billing_enforced',
+    'PaidSurface': 'billing_enforced',
+    'OwnerModeBypass': 'billing_enforced',
+    'DeadUI': 'ui_wired'
+  };
+  return map[category] || 'ui_wired';
+}
+
+function getGapType(category) {
+  const map = {
+    'MissingRoute': 'missing_handler',
+    'EnvContract': 'missing_verification',
+    'FakeSuccess': 'missing_verification',
+    'GhostAuth': 'missing_gate',
+    'StripeWebhook': 'missing_verification',
+    'PaidSurface': 'missing_gate',
+    'OwnerModeBypass': 'missing_gate',
+    'DeadUI': 'missing_handler'
+  };
+  return map[category] || 'untested_path';
+}
+
 // ============================================================================
 // UNIFIED ANALYSIS RUNNER
 // ============================================================================
 
 /**
- * Run unified analysis (used by both ship and scan).
+ * Run unified analysis (used by both ship and scan)
+ * @param {object} options - Analysis options
+ * @returns {object} - Analysis result with findings, verdict, proofGraph
  */
-async function runAnalysis({
-  repoRoot = process.cwd(),
+async function runAnalysis({ 
+  repoRoot = process.cwd(), 
   fastifyEntry = null,
-  extended = false,
-  noWrite = false
+  extended = false,  // If true, run extended analyzers (scan mode)
+  noWrite = false 
 } = {}) {
-  const root = path.resolve(repoRoot);
+  const root = repoRoot;
   const fastEntry = fastifyEntry || detectFastifyEntry(root);
 
-  // 1. Build Truthpack (Context)
-  // We perform this first as analyzers depend on it
-  const truthpack = await buildTruthpack({
-    repoRoot: root,
-    fastifyEntry: fastEntry
-  });
-
+  // Build truthpack
+  const truthpack = await buildTruthpack({ repoRoot: root, fastifyEntry: fastEntry });
   if (!noWrite) {
     writeTruthpack(root, truthpack);
   }
 
-  // 2. Select Analyzers
-  const activeAnalyzers = extended 
-    ? [...CORE_ANALYZERS, ...EXTENDED_ANALYZERS] 
-    : CORE_ANALYZERS;
-
-  // 3. Run Suite (Safe Mode)
-  const { findings, timings } = await runAnalyzerSuite(activeAnalyzers, root, truthpack);
+  // Run core analyzers
+  const findings = runCoreAnalyzers(root, truthpack);
 
-  // 4. Calculate Results
+  // Calculate verdict
   const verdict = calculateVerdict(findings);
-  // We pass original logic helpers here or keep buildProofGraph logic
-  const proofGraph = buildProofGraph(findings, truthpack, root); 
 
-  // 5. Build Report
+  // Build proof graph
+  const proofGraph = buildProofGraph(findings, truthpack, root);
+
+  // Build report
   const report = {
-    meta: {
-      generatedAt: new Date().toISOString(),
+    meta: { 
+      generatedAt: new Date().toISOString(), 
       verdict,
-      mode: extended ? "scan" : "ship",
-      timings // ⏱️ New: Expose perf metrics
+      mode: extended ? 'scan' : 'ship'
     },
     truthpackHash: truthpack.index?.hashes?.truthpackHash,
     findings,
     proofGraph: {
       summary: proofGraph.summary,
-      topBlockers: proofGraph.topBlockers,
-      topGaps: proofGraph.topGaps
+      topBlockers: proofGraph.topBlockers.slice(0, 5),
+      topGaps: proofGraph.topGaps.slice(0, 5)
     }
   };
 
-  // 6. Write Outputs
+  // Write outputs
   if (!noWrite) {
     const outDir = path.join(root, ".vibecheck");
     fs.mkdirSync(outDir, { recursive: true });
-    
-    const reportName = extended ? "last_scan.json" : "last_ship.json";
-    
-    fs.writeFileSync(
-      path.join(outDir, reportName),
-      JSON.stringify(report, null, 2),
-      "utf8"
-    );
-    
-    // Also write proof graph separately for UI consumption
-    fs.writeFileSync(
-      path.join(outDir, "proof-graph.json"),
-      JSON.stringify(proofGraph, null, 2),
-      "utf8"
-    );
+    fs.writeFileSync(path.join(outDir, "last_ship.json"), JSON.stringify(report, null, 2));
+    fs.writeFileSync(path.join(outDir, "proof-graph.json"), JSON.stringify(proofGraph, null, 2));
   }
 
   return { report, truthpack, verdict, proofGraph, findings };
 }
 
 // ============================================================================
-// EXPORTS
+// FINDING UTILITIES
 // ============================================================================
 
+/**
+ * Group findings by category
+ */
+function groupFindings(findings) {
+  const groups = {};
+  for (const f of findings) {
+    const cat = f.category || 'Other';
+    if (!groups[cat]) groups[cat] = [];
+    groups[cat].push(f);
+  }
+  return groups;
+}
+
+/**
+ * Count findings by severity
+ */
+function countBySeverity(findings) {
+  return {
+    block: findings.filter(f => f.severity === 'BLOCK').length,
+    warn: findings.filter(f => f.severity === 'WARN').length,
+    info: findings.filter(f => f.severity === 'INFO').length
+  };
+}
+
+/**
+ * Get top N blockers
+ */
+function getTopBlockers(findings, n = 5) {
+  return findings
+    .filter(f => f.severity === 'BLOCK')
+    .slice(0, n);
+}
+
 module.exports = {
-  runAnalysis,
-  // Export helpers for testing
+  runCoreAnalyzers,
   calculateVerdict,
-  dedupeFindings,
-  runAnalyzerSuite
-};
+  buildProofGraph,
+  runAnalysis,
+  groupFindings,
+  countBySeverity,
+  getTopBlockers
+};