@vibecheckai/cli 3.5.0 → 3.5.2

package/bin/runners/lib/finding-id.js

@@ -0,0 +1,69 @@
+/**
+ * Finding ID Generation - Stable, Deterministic IDs
+ * 
+ * Generates stable finding IDs that remain consistent across rescans.
+ * Same finding should get same ID for proper tracking and deduplication.
+ */
+
+const crypto = require('crypto');
+
+/**
+ * @typedef {Object} FindingInput
+ * @property {string} rule - Rule ID (e.g., 'SEC001')
+ * @property {string} file - File path
+ * @property {number} line - Line number
+ * @property {number} [column] - Column number (optional)
+ * @property {string} message - Finding message
+ */
+
+/**
+ * Generate stable, deterministic finding ID.
+ * Same finding on rescan should get same ID.
+ * 
+ * @param {FindingInput} finding - Finding input data
+ * @returns {string} Stable finding ID (format: vbc_<16-char-hex>)
+ */
+function generateFindingId(finding) {
+  const components = [
+    finding.rule || 'UNKNOWN',
+    finding.file || '',
+    String(finding.line || 0),
+    String(finding.column || 0),
+  ];
+  
+  const hash = crypto
+    .createHash('sha256')
+    .update(components.join(':'))
+    .digest('hex')
+    .slice(0, 16);
+  
+  return `vbc_${hash}`;
+}
+
+/**
+ * Generate deduplication key for finding.
+ * Used to detect duplicate findings across scans.
+ * 
+ * Note: Line number is excluded for fuzzy matching (same issue on different lines)
+ * 
+ * @param {FindingInput} finding - Finding input data
+ * @returns {string} Deduplication key (64-char hex)
+ */
+function generateDeduplicationKey(finding) {
+  const components = [
+    finding.rule || 'UNKNOWN',
+    finding.file || '',
+    // Line number excluded for fuzzy matching
+    (finding.message || '').slice(0, 100), // First 100 chars of message
+  ];
+  
+  return crypto
+    .createHash('sha256')
+    .update(components.join(':'))
+    .digest('hex');
+}
+
+module.exports = {
+  generateFindingId,
+  generateDeduplicationKey,
+};

package/bin/runners/lib/finding-sorter.js

@@ -0,0 +1,89 @@
+/**
+ * Finding Sorter - Deterministic Ordering
+ * 
+ * Sorts findings deterministically for stable output across runs.
+ * Order: severity DESC, file ASC, line ASC, rule ASC
+ */
+
+/**
+ * @typedef {Object} Finding
+ * @property {string} severity - critical, high, medium, low, info
+ * @property {string} file - File path
+ * @property {number} line - Line number
+ * @property {string} rule - Rule ID
+ * @property {string} [category] - Category
+ * @property {string} [title] - Title
+ */
+
+/**
+ * Severity order mapping (lower number = higher priority)
+ */
+const SEVERITY_ORDER = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4,
+};
+
+/**
+ * Sort findings deterministically for stable output.
+ * Order: severity DESC, file ASC, line ASC, rule ASC
+ * 
+ * @param {Finding[]} findings - Array of findings to sort
+ * @returns {Finding[]} Sorted findings array
+ */
+function sortFindings(findings) {
+  return [...findings].sort((a, b) => {
+    // 1. Severity (critical first)
+    const sevA = SEVERITY_ORDER[a.severity?.toLowerCase()] ?? 5;
+    const sevB = SEVERITY_ORDER[b.severity?.toLowerCase()] ?? 5;
+    if (sevA !== sevB) return sevA - sevB;
+    
+    // 2. File path (alphabetical)
+    const fileA = (a.file || '').toLowerCase();
+    const fileB = (b.file || '').toLowerCase();
+    const fileCompare = fileA.localeCompare(fileB);
+    if (fileCompare !== 0) return fileCompare;
+    
+    // 3. Line number
+    const lineA = a.line || 0;
+    const lineB = b.line || 0;
+    if (lineA !== lineB) return lineA - lineB;
+    
+    // 4. Rule ID (alphabetical)
+    const ruleA = (a.rule || a.ruleId || '').toLowerCase();
+    const ruleB = (b.rule || b.ruleId || '').toLowerCase();
+    return ruleA.localeCompare(ruleB);
+  });
+}
+
+/**
+ * Generate stable JSON output (sorted keys, consistent spacing)
+ * 
+ * @param {unknown} obj - Object to stringify
+ * @returns {string} Stable JSON string
+ */
+function stableStringify(obj) {
+  if (typeof obj !== 'object' || obj === null) {
+    return JSON.stringify(obj);
+  }
+  
+  if (Array.isArray(obj)) {
+    return '[' + obj.map(stableStringify).join(',') + ']';
+  }
+  
+  // Sort keys for stable output
+  const sortedKeys = Object.keys(obj).sort();
+  const pairs = sortedKeys.map(key => {
+    const value = obj[key];
+    return JSON.stringify(key) + ':' + stableStringify(value);
+  });
+  
+  return '{' + pairs.join(',') + '}';
+}
+
+module.exports = {
+  sortFindings,
+  stableStringify,
+};