@wrongstack/core 0.313.0 → 0.316.1

package/dist/chunk-YWXT3JNM.js

@@ -0,0 +1,425 @@
+import {
+  JsonlFindingStore
+} from "./chunk-4LCZVJVF.js";
+import {
+  computeFindingFingerprint
+} from "./chunk-UJILKYES.js";
+import {
+  JsonlReportStore
+} from "./chunk-HXKZ7OBQ.js";
+
+// src/plugins/review-finding-parser.ts
+import { randomUUID } from "node:crypto";
+var SEVERITIES = /* @__PURE__ */ new Set(["critical", "high", "medium", "low"]);
+var CATEGORIES = /* @__PURE__ */ new Set([
+  "bug",
+  "security",
+  "performance",
+  "type",
+  "contract",
+  "test",
+  "other"
+]);
+var CONFIDENCES = /* @__PURE__ */ new Set(["high", "medium", "low"]);
+var FENCED_BLOCK = /```json[ \t]*\r?\n([\s\S]*?)\r?\n```/gi;
+function extractStructuredFindingsBlock(reportText) {
+  if (!reportText) return null;
+  let best = null;
+  for (const match of reportText.matchAll(FENCED_BLOCK)) {
+    const body = match[1];
+    if (!body?.trim()) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      continue;
+    }
+    if (typeof parsed !== "object" || parsed === null) continue;
+    const findings = parsed.findings;
+    if (!Array.isArray(findings)) continue;
+    const items = [];
+    for (const raw of findings) {
+      const item = normalizeStructuredItem(raw);
+      if (item) items.push(item);
+    }
+    if (findings.length > 0 && items.length === 0) continue;
+    const durationRaw = parsed.durationSeconds;
+    const durationSeconds = typeof durationRaw === "number" && Number.isFinite(durationRaw) && durationRaw > 0 ? Math.floor(durationRaw) : void 0;
+    best = { findings: items, ...durationSeconds !== void 0 ? { durationSeconds } : {} };
+  }
+  return best;
+}
+function normalizeStructuredItem(raw) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const item = raw;
+  const severity = typeof item.severity === "string" ? item.severity.toLowerCase() : "";
+  if (!SEVERITIES.has(severity)) return null;
+  const title = typeof item.title === "string" ? item.title.trim() : "";
+  if (title.length === 0) return null;
+  const file = typeof item.file === "string" && item.file.trim().length > 0 ? item.file.trim() : void 0;
+  const line = typeof item.line === "number" && Number.isInteger(item.line) && item.line >= 1 ? item.line : void 0;
+  const categoryRaw = typeof item.category === "string" ? item.category.toLowerCase() : "";
+  const category = CATEGORIES.has(categoryRaw) ? categoryRaw : void 0;
+  const confidenceRaw = typeof item.confidence === "string" ? item.confidence.toLowerCase() : "";
+  const confidence = CONFIDENCES.has(confidenceRaw) ? confidenceRaw : void 0;
+  return {
+    severity,
+    ...file ? { file } : {},
+    ...line !== void 0 ? { line } : {},
+    ...category ? { category } : {},
+    ...confidence ? { confidence } : {},
+    title,
+    ...typeof item.description === "string" && item.description.trim().length > 0 ? { description: item.description.trim() } : {},
+    ...typeof item.suggestedFix === "string" && item.suggestedFix.trim().length > 0 ? { suggestedFix: item.suggestedFix.trim() } : {}
+  };
+}
+var SUGGEST_LINE = /^\s*(?:→|->|=>)\s*(.+)$/;
+var DURATION_LINE = /^Duration:\s*(\d+)s\s*$/im;
+function parseChimeraReviewReport(reportText, context = {}) {
+  if (!reportText || reportText.trim().length === 0) {
+    return { findings: [], unparseableCount: 0 };
+  }
+  const structured = extractStructuredFindingsBlock(reportText);
+  if (structured) {
+    const reportId2 = context.reportId ?? randomUUID();
+    const findings2 = structured.findings.map(
+      (item) => buildFindingFromStructuredItem(item, { ...context, reportId: reportId2 })
+    );
+    return {
+      findings: findings2,
+      unparseableCount: 0,
+      ...structured.durationSeconds !== void 0 ? { durationSeconds: structured.durationSeconds } : {},
+      structured: true
+    };
+  }
+  const findings = [];
+  const reportId = context.reportId ?? randomUUID();
+  let unparseableCount = 0;
+  let durationSeconds;
+  let currentSeverity = null;
+  let currentLines = [];
+  const lines = reportText.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const headingMatch = line.trim().match(/^###\s+(critical|high|medium|low)\b/i);
+    if (headingMatch) {
+      flushSection();
+      currentSeverity = headingMatch[1].toLowerCase();
+      continue;
+    }
+    const durMatch = line.match(DURATION_LINE);
+    if (durMatch) {
+      durationSeconds = Number.parseInt(durMatch[1], 10);
+      continue;
+    }
+    if (currentSeverity !== null) {
+      currentLines.push(line);
+    }
+  }
+  flushSection();
+  return { findings, unparseableCount, durationSeconds };
+  function flushSection() {
+    if (currentSeverity === null || currentLines.length === 0) {
+      currentSeverity = null;
+      currentLines = [];
+      return;
+    }
+    const combined = currentLines.join("\n");
+    const segments = combined.split(/\n\s*(?=\d+\.\s)/).filter((s) => s.trim().length > 0);
+    for (const segment of segments) {
+      const finding = parseFindingSegment(segment, currentSeverity, { ...context, reportId });
+      if (finding) {
+        findings.push(finding);
+      } else {
+        unparseableCount++;
+      }
+    }
+    currentSeverity = null;
+    currentLines = [];
+  }
+}
+function parseFindingSegment(segment, severity, context) {
+  const lines = segment.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+  if (lines.length === 0) return null;
+  const first = lines[0];
+  const match = first.match(/^\d+\.\s+(.*)$/);
+  if (!match) return null;
+  const content = match[1].trim();
+  let remaining = content;
+  const tagMatch = content.match(/^\[(\w+)\]\s*/);
+  if (tagMatch) {
+    remaining = content.slice(tagMatch[0].length).trim();
+  }
+  const citationMatch = remaining.match(
+    /^(`+)([a-zA-Z_./\\:][^`]*[a-zA-Z0-9_./\\:])\1(?=\s*[—–-]|\s*$)/
+  );
+  if (citationMatch) {
+    const inner = citationMatch[2];
+    const afterCitation = remaining.slice(citationMatch[0].length);
+    remaining = `${inner}${afterCitation}`;
+  }
+  let file;
+  let line;
+  let desc = remaining;
+  const refMatch = remaining.match(
+    /^([a-zA-Z_./\\][a-zA-Z0-9_./\\-]*\.\w+)(?::(\d+))?\s+(?:[—–]|-)\s+(.+)$/
+  );
+  if (refMatch) {
+    file = refMatch[1].trim();
+    if (refMatch[2] !== void 0) {
+      line = Number.parseInt(refMatch[2], 10);
+    }
+    desc = refMatch[3].trim();
+  }
+  if (!file) {
+    const pathMatch = remaining.match(/^([a-zA-Z_./\\][a-zA-Z0-9_./\\-]*\.\w+)(?::(\d+))?/);
+    if (pathMatch) {
+      file = pathMatch[1].trim();
+      if (pathMatch[2] !== void 0) {
+        line = Number.parseInt(pathMatch[2], 10);
+      }
+      const afterFile = remaining.slice(pathMatch[0].length).trim();
+      desc = afterFile.replace(/^[—–-]\s*/, "").trim() || desc;
+    }
+  }
+  const cleanDesc = desc.replace(/^[—–-]\s*/, "").trim();
+  const suggestions = [];
+  for (let i = 1; i < lines.length; i++) {
+    const suggest = lines[i].match(SUGGEST_LINE);
+    if (suggest) {
+      suggestions.push(suggest[1].trim());
+    }
+  }
+  const title = cleanDesc.split(/\.\s/)[0].trim() || content;
+  const fullDesc = suggestions.length > 0 ? cleanDesc + "\n" + suggestions.map((s) => "  \u2192 " + s).join("\n") : cleanDesc;
+  const suggestedFix = suggestions.length > 0 ? suggestions.join("\n") : void 0;
+  return {
+    id: randomUUID(),
+    fingerprint: computeFindingFingerprint(file ?? "", line ?? null, title),
+    severity,
+    source: normalizeFindingSource(context.reviewType),
+    ...file ? { location: { file, ...line !== void 0 ? { line } : {} } } : {},
+    title,
+    description: fullDesc,
+    ...suggestedFix ? { suggestedFix } : {},
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    status: "active",
+    originReport: {
+      reportId: context.reportId ?? randomUUID(),
+      sessionId: context.sessionId ?? "",
+      agentId: context.agentId ?? "",
+      reviewerModel: context.reviewerModel ?? ""
+    }
+  };
+}
+function normalizeFindingSource(reviewType) {
+  switch (reviewType) {
+    case "auto":
+    case "chimera":
+    case "cascade":
+    case "security-scanner":
+      return reviewType;
+    default:
+      return "chimera";
+  }
+}
+function buildFindingFromStructuredItem(item, context) {
+  const file = item.file;
+  const line = item.line;
+  const title = item.title;
+  const description = item.description ?? title;
+  return {
+    id: randomUUID(),
+    fingerprint: computeFindingFingerprint(file ?? "", line ?? null, title),
+    severity: item.severity,
+    source: normalizeFindingSource(context.reviewType),
+    ...file ? { location: { file, ...line !== void 0 ? { line } : {} } } : {},
+    ...item.category ? { category: item.category } : {},
+    ...item.confidence ? { confidence: item.confidence } : {},
+    title,
+    description,
+    ...item.suggestedFix ? { suggestedFix: item.suggestedFix } : {},
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    status: "active",
+    originReport: {
+      reportId: context.reportId ?? randomUUID(),
+      sessionId: context.sessionId ?? "",
+      agentId: context.agentId ?? "",
+      reviewerModel: context.reviewerModel ?? ""
+    }
+  };
+}
+
+// src/plugins/review-finding-integration.ts
+function classifyChimeraReviewSource(bundle) {
+  const cascadeDepth = bundle.cascadeDepth ?? 0;
+  if (cascadeDepth > 0) return "cascade";
+  const cascadeOn = bundle.cascadeOn;
+  if (cascadeOn !== void 0 && cascadeOn !== "off") return "auto";
+  return "chimera";
+}
+async function integrateFindings(payload, projectDir, reportId) {
+  if ((!payload.reviewText || payload.reviewText.trim().length === 0) && !payload.parsedReport) {
+    return { created: 0, relinked: 0, reopened: 0, totalFindings: 0, unparseableCount: 0 };
+  }
+  const store = new JsonlFindingStore(projectDir);
+  const source = classifyChimeraReviewSource(payload.bundle);
+  const agentId = payload.bundle.fileProvenance?.find((entry) => entry.agentId)?.agentId ?? "chimera-review";
+  const sessionId = payload.sessionId ?? payload.cwd;
+  const model = payload.bundle.config.model;
+  const parsed = payload.parsedReport ?? parseChimeraReviewReport(payload.reviewText, {
+    sessionId,
+    agentId,
+    reviewerModel: model,
+    reviewType: source,
+    reportId
+  });
+  if (parsed.findings.length === 0) {
+    return {
+      created: 0,
+      relinked: 0,
+      reopened: 0,
+      totalFindings: 0,
+      unparseableCount: parsed.unparseableCount
+    };
+  }
+  const result = await store.upsert(parsed.findings, {
+    sessionId,
+    reportId,
+    agentId,
+    model
+  });
+  return {
+    created: result.created,
+    relinked: result.relinked,
+    reopened: result.reopened,
+    reportId,
+    totalFindings: parsed.findings.length,
+    unparseableCount: parsed.unparseableCount
+  };
+}
+
+// src/plugins/review-report-integration.ts
+async function updateReviewReportEvidence(reportId, projectDir, evidenceStatus, evidenceChecks) {
+  await new JsonlReportStore(projectDir).updateEvidence(
+    reportId,
+    evidenceStatus,
+    evidenceChecks
+  );
+}
+async function persistReviewReport(payload, reportId, projectDir) {
+  const store = new JsonlReportStore(projectDir);
+  const existed = await store.get(reportId);
+  const source = classifyChimeraReviewSource(payload.bundle);
+  const agentId = payload.bundle.fileProvenance?.find((entry) => entry.agentId)?.agentId ?? "chimera-review";
+  const sessionId = payload.sessionId ?? payload.cwd;
+  const model = payload.bundle.config.model;
+  const cascadeDepth = payload.bundle.cascadeDepth;
+  const files = payload.bundle.files.map((f) => ({
+    path: f.path,
+    status: f.status
+  }));
+  const reviewStatus = payload.status === "success" ? "success" : "failed";
+  const parsed = reviewStatus === "success" ? payload.parsedReport ?? parseChimeraReviewReport(payload.reviewText, {
+    sessionId,
+    agentId,
+    reviewerModel: model,
+    reviewType: source,
+    reportId
+  }) : { findings: [], unparseableCount: 0, durationSeconds: void 0 };
+  const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+  for (const finding of parsed.findings) {
+    counts[finding.severity]++;
+  }
+  const input = {
+    id: reportId,
+    sessionId,
+    agentId,
+    reviewerModel: model,
+    source,
+    reviewStatus,
+    files,
+    counts,
+    totalFindings: parsed.findings.length,
+    unparseableCount: parsed.unparseableCount,
+    durationSeconds: parsed.durationSeconds,
+    rawText: payload.reviewText,
+    ...cascadeDepth !== void 0 ? { cascadeDepth } : {},
+    // P0-3: carry the cascade evidence verification (status + per-check
+    // comparisons) so the persisted report is auditable. Absent on initial
+    // reviews — no cascade step produced evidence yet.
+    ...payload.bundle.evidenceStatus !== void 0 ? { evidenceStatus: payload.bundle.evidenceStatus } : {},
+    ...payload.bundle.evidenceChecks !== void 0 ? { evidenceChecks: payload.bundle.evidenceChecks } : {}
+  };
+  await store.persist(input);
+  if (reviewStatus === "success" && parsed.findings.length === 0 && parsed.unparseableCount === 0 && isExplicitAllClearReview(payload.reviewText)) {
+    await store.transition(
+      reportId,
+      "completed",
+      { id: "chimera", kind: "system" },
+      {
+        reason: "Successful Chimera review produced no actionable findings"
+      }
+    );
+  }
+  return {
+    reportId,
+    created: !existed,
+    totalFindings: parsed.findings.length
+  };
+}
+function isExplicitAllClearReview(text) {
+  const normalized = text.trim().toLowerCase();
+  return normalized.startsWith("## \u{1F982} chimera review \u2014 all clear") || normalized.includes("chimera review: all clear");
+}
+async function syncReportCompletion(reportId, projectDir, actor) {
+  const reportStore = new JsonlReportStore(projectDir);
+  const findingStore = new JsonlFindingStore(projectDir);
+  const report = await reportStore.get(reportId);
+  if (!report) {
+    return { reportId, completed: false, totalFindings: 0, remaining: 0 };
+  }
+  if (report.lifecycle === "completed" || report.lifecycle === "skipped") {
+    return { reportId, completed: false, totalFindings: 0, remaining: 0 };
+  }
+  const findings = await findingStore.list({ reportId, limit: 9999 });
+  const total = findings.length;
+  if (total === 0) {
+    return { reportId, completed: false, totalFindings: 0, remaining: 0 };
+  }
+  const remaining = findings.filter(
+    (f) => f.status !== "resolved" && f.status !== "ignored"
+  ).length;
+  if (remaining > 0) {
+    return { reportId, completed: false, totalFindings: total, remaining };
+  }
+  await reportStore.transition(reportId, "completed", actor, {
+    reason: `All ${total} finding(s) resolved or ignored`
+  });
+  return { reportId, completed: true, totalFindings: total, remaining: 0 };
+}
+async function syncReportReopen(reportId, projectDir, actor, reason) {
+  const reportStore = new JsonlReportStore(projectDir);
+  const report = await reportStore.get(reportId);
+  if (!report) {
+    return { reportId, reopened: false, previousLifecycle: "not_found" };
+  }
+  if (report.lifecycle !== "completed" && report.lifecycle !== "skipped") {
+    return { reportId, reopened: false, previousLifecycle: report.lifecycle };
+  }
+  await reportStore.transition(reportId, "open", actor, {
+    reason: reason ?? `Finding reopened \u2014 report was ${report.lifecycle}`
+  });
+  return { reportId, reopened: true, previousLifecycle: report.lifecycle };
+}
+
+export {
+  parseChimeraReviewReport,
+  classifyChimeraReviewSource,
+  integrateFindings,
+  updateReviewReportEvidence,
+  persistReviewReport,
+  syncReportCompletion,
+  syncReportReopen
+};
+//# sourceMappingURL=chunk-YWXT3JNM.js.map

package/dist/chunk-YY6APYUM.js

@@ -0,0 +1,49 @@
+// src/security/config-secrets.ts
+function decryptConfigSecrets(cfg, vault, opts) {
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
+  return walk(cfg, vault, (v, key) => {
+    try {
+      return vault.decrypt(v);
+    } catch (err) {
+      warn(
+        `[secret-vault] Failed to decrypt "${key}": ${err instanceof Error ? err.message : err}`
+      );
+      return "";
+    }
+  });
+}
+function encryptConfigSecrets(cfg, vault, _opts) {
+  return walk(cfg, vault, (v) => vault.encrypt(v));
+}
+function walk(node, vault, transform) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walk(item, vault, transform));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k)) {
+      out[k] = transform(v, k);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walk(v, vault, transform);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
+var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
+function isSecretField(name) {
+  const lc = name.toLowerCase();
+  if (NON_SECRET_OVERRIDES.has(lc)) return false;
+  return SECRET_KEY_PATTERN.test(lc);
+}
+
+export {
+  decryptConfigSecrets,
+  encryptConfigSecrets,
+  isSecretField
+};
+//# sourceMappingURL=chunk-YY6APYUM.js.map