@yasserkhanorg/impact-gate 2.0.0

package/dist/reporters/sarif.js

@@ -0,0 +1,135 @@
+"use strict";
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sarifReporter = void 0;
+const version_js_1 = require("../version.js");
+function severityToLevel(severity) {
+    switch (severity.toLowerCase()) {
+        case 'high':
+        case 'critical':
+            return 'error';
+        case 'medium':
+            return 'warning';
+        case 'low':
+        case 'info':
+            return 'note';
+        default:
+            return 'note';
+    }
+}
+function riskToLevel(risk) {
+    switch (risk.toLowerCase()) {
+        case 'high':
+            return 'warning';
+        case 'medium':
+            return 'note';
+        default:
+            return 'none';
+    }
+}
+exports.sarifReporter = {
+    name: 'sarif',
+    extension: '.sarif',
+    format(results) {
+        const rules = [];
+        const sarifResults = [];
+        const ruleIds = new Set();
+        function ensureRule(id, description, level) {
+            if (!ruleIds.has(id)) {
+                ruleIds.add(id);
+                rules.push({
+                    id,
+                    shortDescription: { text: description },
+                    defaultConfiguration: { level },
+                });
+            }
+        }
+        // Findings -> results
+        for (const finding of results.findings) {
+            const level = severityToLevel(finding.severity);
+            const ruleId = `finding/${finding.severity}`;
+            ensureRule(ruleId, `Finding (${finding.severity})`, level);
+            sarifResults.push({
+                ruleId,
+                level,
+                message: { text: `${finding.title}: ${finding.description}` },
+                properties: {
+                    severity: finding.severity,
+                },
+            });
+        }
+        // Strategy entries without matching test designs -> coverage gap results
+        const designedFlows = new Set(results.testDesigns.map((d) => d.flowName));
+        for (const entry of results.strategyEntries) {
+            if (!designedFlows.has(entry.flowName)) {
+                const ruleId = 'coverage/gap';
+                ensureRule(ruleId, 'Missing test coverage for impacted flow', 'warning');
+                sarifResults.push({
+                    ruleId,
+                    level: 'warning',
+                    message: {
+                        text: `Flow "${entry.flowName}" (${entry.flowId}) has strategy but no test design. ` +
+                            `Priority: ${entry.priority}, approach: ${entry.approach}.`,
+                    },
+                    properties: {
+                        flowId: entry.flowId,
+                        priority: entry.priority,
+                    },
+                });
+            }
+        }
+        // High-risk cross-impacts -> warning results
+        for (const impact of results.crossImpacts) {
+            const level = riskToLevel(impact.riskLevel);
+            if (level === 'none') {
+                continue;
+            }
+            const ruleId = `cross-impact/${impact.riskLevel}`;
+            ensureRule(ruleId, `Cross-impact (${impact.riskLevel} risk)`, level);
+            sarifResults.push({
+                ruleId,
+                level,
+                message: {
+                    text: `Cross-impact: "${impact.sourceFamily}" affects "${impact.affectedFamily}" ` +
+                        `with ${impact.riskLevel} risk.`,
+                },
+                properties: {
+                    sourceFamily: impact.sourceFamily,
+                    affectedFamily: impact.affectedFamily,
+                    riskLevel: impact.riskLevel,
+                },
+            });
+        }
+        const run = {
+            tool: {
+                driver: {
+                    name: 'impact-gate',
+                    version: (0, version_js_1.getVersion)(),
+                    informationUri: 'https://github.com/yasserfaraazkhan/impact-gate',
+                    rules,
+                },
+            },
+            results: sarifResults,
+            invocations: [
+                {
+                    executionSuccessful: true,
+                    properties: {
+                        workflow: results.workflow,
+                        changedFiles: results.changedFiles,
+                        impactedFlows: results.impactedFlows,
+                        cost: results.cost,
+                        tokens: results.tokens,
+                        warnings: results.warnings,
+                    },
+                },
+            ],
+        };
+        const sarif = {
+            $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json',
+            version: '2.1.0',
+            runs: [run],
+        };
+        return JSON.stringify(sarif, null, 2) + '\n';
+    },
+};

package/dist/resilience/circuit_breaker.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Circuit Breaker — protects against cascading failures from unavailable LLM providers.
+ *
+ * States:
+ * - CLOSED: normal operation, requests pass through
+ * - OPEN: provider is down, all requests short-circuit to fallback
+ * - HALF_OPEN: after cooldown, allows one test request through
+ */
+export interface CircuitBreakerConfig {
+    failureThreshold: number;
+    cooldownMs: number;
+    /** Optional predicate: only count errors where this returns true. Defaults to counting all errors. */
+    shouldCount?: (error: unknown) => boolean;
+}
+type CircuitState = 'closed' | 'open' | 'half-open';
+export declare class CircuitBreaker {
+    private state;
+    private failures;
+    private lastFailureTime;
+    private config;
+    constructor(config?: Partial<CircuitBreakerConfig>);
+    /** Returns the derived state without mutating internal state. */
+    get currentState(): CircuitState;
+    get isOpen(): boolean;
+    /**
+     * Execute a function with circuit breaker protection.
+     * If the circuit is open, the fallback is called instead.
+     */
+    call<T>(fn: () => Promise<T>, fallback: () => T): Promise<T>;
+    private onSuccess;
+    private onFailure;
+    /** Reset the circuit breaker to closed state */
+    reset(): void;
+}
+export {};
+//# sourceMappingURL=circuit_breaker.d.ts.map

package/dist/resilience/circuit_breaker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"circuit_breaker.d.ts","sourceRoot":"","sources":["../../src/resilience/circuit_breaker.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,sGAAsG;IACtG,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAOD,KAAK,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;AAEpD,qBAAa,cAAc;IACvB,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,MAAM,CAAuB;gBAEzB,MAAM,GAAE,OAAO,CAAC,oBAAoB,CAAM;IAItD,iEAAiE;IACjE,IAAI,YAAY,IAAI,YAAY,CAK/B;IAED,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED;;;OAGG;IACG,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAiClE,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,SAAS;IAQjB,gDAAgD;IAChD,KAAK,IAAI,IAAI;CAKhB"}

package/dist/resilience/circuit_breaker.js

@@ -0,0 +1,82 @@
+"use strict";
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CircuitBreaker = void 0;
+const DEFAULT_CONFIG = {
+    failureThreshold: 3,
+    cooldownMs: 60000,
+};
+class CircuitBreaker {
+    constructor(config = {}) {
+        this.state = 'closed';
+        this.failures = 0;
+        this.lastFailureTime = 0;
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /** Returns the derived state without mutating internal state. */
+    get currentState() {
+        if (this.state === 'open' && Date.now() - this.lastFailureTime >= this.config.cooldownMs) {
+            return 'half-open';
+        }
+        return this.state;
+    }
+    get isOpen() {
+        return this.currentState === 'open';
+    }
+    /**
+     * Execute a function with circuit breaker protection.
+     * If the circuit is open, the fallback is called instead.
+     */
+    async call(fn, fallback) {
+        // Transition from open to half-open if cooldown has elapsed
+        if (this.state === 'open') {
+            if (Date.now() - this.lastFailureTime >= this.config.cooldownMs) {
+                this.state = 'half-open';
+            }
+            else {
+                return fallback();
+            }
+        }
+        // At this point state is 'closed' or 'half-open'
+        const stateBeforeCall = this.state;
+        try {
+            const result = await fn();
+            this.onSuccess();
+            return result;
+        }
+        catch (error) {
+            const shouldCount = !this.config.shouldCount || this.config.shouldCount(error);
+            if (shouldCount) {
+                this.onFailure();
+            }
+            // In half-open state, a failure re-opens the circuit
+            if (stateBeforeCall === 'half-open') {
+                throw error;
+            }
+            // In closed state, if failures hit threshold the circuit opened
+            if (shouldCount && this.failures >= this.config.failureThreshold) {
+                return fallback();
+            }
+            throw error;
+        }
+    }
+    onSuccess() {
+        this.failures = 0;
+        this.state = 'closed';
+    }
+    onFailure() {
+        this.failures++;
+        this.lastFailureTime = Date.now();
+        if (this.failures >= this.config.failureThreshold) {
+            this.state = 'open';
+        }
+    }
+    /** Reset the circuit breaker to closed state */
+    reset() {
+        this.state = 'closed';
+        this.failures = 0;
+        this.lastFailureTime = 0;
+    }
+}
+exports.CircuitBreaker = CircuitBreaker;

package/dist/resilience/retry.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Retry with exponential backoff and jitter for LLM provider calls.
+ */
+export interface RetryConfig {
+    maxRetries: number;
+    baseDelayMs: number;
+    maxDelayMs: number;
+    jitter: boolean;
+}
+export declare function withRetry<T>(fn: () => Promise<T>, config?: Partial<RetryConfig>): Promise<T>;
+//# sourceMappingURL=retry.d.ts.map

package/dist/resilience/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../src/resilience/retry.ts"],"names":[],"mappings":"AAGA;;GAEG;AAEH,MAAM,WAAW,WAAW;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACnB;AAsCD,wBAAsB,SAAS,CAAC,CAAC,EAC7B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,GAClC,OAAO,CAAC,CAAC,CAAC,CAkBZ"}

package/dist/resilience/retry.js

@@ -0,0 +1,59 @@
+"use strict";
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withRetry = withRetry;
+const DEFAULT_RETRY_CONFIG = {
+    maxRetries: 2,
+    baseDelayMs: 1000,
+    maxDelayMs: 10000,
+    jitter: true,
+};
+/** Errors that should be retried (transient failures) */
+function isRetryable(error) {
+    if (!(error instanceof Error))
+        return false;
+    const msg = error.message.toLowerCase();
+    // Rate limits
+    if (msg.includes('rate limit') || msg.includes('429') || msg.includes('too many requests'))
+        return true;
+    // Server errors
+    if (msg.includes('500') || msg.includes('502') || msg.includes('503') || msg.includes('504'))
+        return true;
+    if (msg.includes('internal server error') || msg.includes('bad gateway') || msg.includes('service unavailable'))
+        return true;
+    // Network errors
+    if (msg.includes('econnreset') || msg.includes('econnrefused') || msg.includes('etimedout'))
+        return true;
+    if (msg.includes('socket hang up') || msg.includes('network error'))
+        return true;
+    // Overloaded
+    if (msg.includes('overloaded') || msg.includes('capacity'))
+        return true;
+    return false;
+}
+function computeDelay(attempt, config) {
+    const exponential = Math.min(config.baseDelayMs * Math.pow(2, attempt), config.maxDelayMs);
+    if (!config.jitter)
+        return exponential;
+    // Full jitter: random between 0 and exponential
+    return Math.floor(Math.random() * exponential);
+}
+async function withRetry(fn, config = {}) {
+    const cfg = { ...DEFAULT_RETRY_CONFIG, ...config };
+    let lastError;
+    for (let attempt = 0; attempt <= cfg.maxRetries; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt >= cfg.maxRetries || !isRetryable(error)) {
+                throw error;
+            }
+            const delay = computeDelay(attempt, cfg);
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+    }
+    throw lastError;
+}

package/dist/sanitize.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Sanitize a string by replacing detected secrets with [REDACTED].
+ */
+export declare function sanitizeSecrets(text: string): string;
+/**
+ * Check if a string contains any detectable secrets.
+ */
+export declare function containsSecrets(text: string): boolean;
+/**
+ * Deep-sanitize a JSON-serializable object.
+ * Recursively walks all string values and sanitizes them.
+ * Tracks seen objects to prevent stack overflow on circular references.
+ */
+export declare function sanitizeObject<T>(obj: T, _seen?: WeakSet<object>): T;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AA2BA;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKrD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAepE"}

package/dist/sanitize.js

@@ -0,0 +1,71 @@
+"use strict";
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeSecrets = sanitizeSecrets;
+exports.containsSecrets = containsSecrets;
+exports.sanitizeObject = sanitizeObject;
+/**
+ * Secret scanning and sanitization utilities.
+ * Prevents API keys and credentials from leaking into artifacts, logs, and output.
+ *
+ * Patterns are stored WITHOUT the global flag to avoid shared mutable lastIndex state.
+ * New RegExp instances with /g are created per call for safe concurrent usage.
+ */
+const SECRET_PATTERNS = [
+    // Anthropic API keys (must be checked before generic sk- pattern)
+    /sk-ant-[a-zA-Z0-9_-]{20,}/,
+    // OpenAI API keys (negative lookahead to avoid matching Anthropic keys)
+    /sk-(?!ant-)[a-zA-Z0-9]{20,}/,
+    // Generic API key patterns
+    /(?:api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token)['":\s=]+['"]?([a-zA-Z0-9_\-./]{20,})['"]?/i,
+    // Bearer tokens
+    /Bearer\s+[a-zA-Z0-9_\-./]{20,}/,
+    // AWS keys
+    /AKIA[0-9A-Z]{16}/,
+    // GitHub tokens
+    /gh[ps]_[a-zA-Z0-9]{36,}/,
+    /github_pat_[a-zA-Z0-9_]{22,}/,
+];
+/**
+ * Sanitize a string by replacing detected secrets with [REDACTED].
+ */
+function sanitizeSecrets(text) {
+    let result = text;
+    for (const pattern of SECRET_PATTERNS) {
+        result = result.replace(new RegExp(pattern, 'gi'), '[REDACTED]');
+    }
+    return result;
+}
+/**
+ * Check if a string contains any detectable secrets.
+ */
+function containsSecrets(text) {
+    for (const pattern of SECRET_PATTERNS) {
+        if (new RegExp(pattern, 'i').test(text))
+            return true;
+    }
+    return false;
+}
+/**
+ * Deep-sanitize a JSON-serializable object.
+ * Recursively walks all string values and sanitizes them.
+ * Tracks seen objects to prevent stack overflow on circular references.
+ */
+function sanitizeObject(obj, _seen) {
+    if (typeof obj === 'string')
+        return sanitizeSecrets(obj);
+    if (obj === null || typeof obj !== 'object')
+        return obj;
+    const seen = _seen ?? new WeakSet();
+    if (seen.has(obj))
+        return '[Circular]';
+    seen.add(obj);
+    if (Array.isArray(obj))
+        return obj.map((item) => sanitizeObject(item, seen));
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        result[key] = sanitizeObject(value, seen);
+    }
+    return result;
+}

package/dist/training/enricher.d.ts

@@ -0,0 +1,17 @@
+import type { LLMProvider } from '../provider_interface.js';
+import type { RouteFamily } from '../knowledge/route_families.js';
+import type { EnrichmentResult, ScannedFamily } from './types.js';
+export interface EnrichedEntry {
+    id: string;
+    priority?: 'P0' | 'P1' | 'P2';
+    userFlows?: string[];
+    routes?: string[];
+    pageObjects?: string[];
+    components?: string[];
+    webappPaths?: string[];
+    serverPaths?: string[];
+}
+export declare function validateEntries(parsed: unknown[]): EnrichedEntry[];
+export declare function parseEnrichResponse(response: string): EnrichedEntry[];
+export declare function enrichFamilies(families: RouteFamily[], scanned: ScannedFamily[], projectRoot: string, provider: LLMProvider, budgetUSD: number, testsRoot?: string): Promise<EnrichmentResult>;
+//# sourceMappingURL=enricher.d.ts.map

package/dist/training/enricher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enricher.d.ts","sourceRoot":"","sources":["../../src/training/enricher.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,gCAAgC,CAAC;AAGhE,OAAO,KAAK,EAAC,gBAAgB,EAAE,aAAa,EAAC,MAAM,YAAY,CAAC;AAkLhE,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAmBlE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAwBrE;AAkCD,wBAAsB,cAAc,CAChC,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,EAAE,aAAa,EAAE,EACxB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAuF3B"}