@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.3

package/dist/tools/threat-run-matcher.js

@@ -1,145 +0,0 @@
-import { z } from "zod";
-import * as fs from "node:fs/promises";
-import * as fssync from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import * as crypto from "node:crypto";
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
-import { runMatcher } from "../matcher/index.js";
-import { buildInferenceBundle } from "../matcher/inference-candidates.js";
-import { withNextSteps, withNextStepsError } from "../lib/next-steps.js";
-const execAsync = promisify(exec);
-export const THREAT_RUN_MATCHER_NAME = "zivis_threat_run_matcher";
-export const THREAT_RUN_MATCHER_DESCRIPTION = `Run the local pattern matcher against the latest repo graph artifact and emit normalized threat findings.
-
-Use this when:
-- The user asks ZIVIS to actually evaluate (not just list) which patterns fire on their code
-- After 'zivis inspect' has produced an artifact and the user wants concrete findings
-- "find security issues in my code", "check this against the threat library", "what's actually wrong here"
-
-Phase 3 v1 evaluates AST strategies for real (via @ast-grep/napi for TS/JS, plus Python and Go via dynamic language packs). INFER strategies emit a candidate the host LLM is expected to pick up via zivis_threat_get_inference_prompt and run with its own model. GRAPH / META / DEP / CONFIG strategies are surfaced as fired_strategies with match_count: 0 — visible-but-not-evaluated for now.
-
-Lane assignment per finding:
-- trusted: count of fired deterministic strategies meets the capsule's required_evidence_count
-- inferred: at least one strategy fired but the bar wasn't met (host should run inference to confirm)
-
-The output is a normalized findings array with pattern_id, lane, confidence, evidence spans, and (for inferred-lane findings) an inference_candidate the host LLM uses to run deeper analysis.`;
-export const THREAT_RUN_MATCHER_SCHEMA = {
-    artifact_path: z
-        .string()
-        .optional()
-        .describe("Path to a specific RepoGraphArtifactV1 JSON. If omitted, the most recent inspect run in the user cache is used."),
-    cwd: z
-        .string()
-        .optional()
-        .describe("Repo root for source-file walking — capsule AST strategies match against files in this directory. Defaults to server cwd."),
-};
-export function createThreatRunMatcherHandler() {
-    return async (params) => {
-        const cwd = params.cwd ?? process.cwd();
-        let artifactPath;
-        try {
-            artifactPath = await resolveArtifactPath(params.artifact_path, cwd);
-        }
-        catch (err) {
-            return withNextStepsError(`No repo graph artifact found. ${err.message}`, [
-                {
-                    id: "run_zivis_inspect",
-                    label: "Run `zivis inspect` to build the local repo graph first",
-                    tool: "zivis_inspect",
-                    why: "The matcher consumes the latest inspect artifact.",
-                },
-            ], "Run `zivis inspect` first; this tool reads from its output.");
-        }
-        const result = await runMatcher({ artifactPath, cwd });
-        const inferenceBundle = await buildInferenceBundle(result.findings);
-        const headline = result.summary.total === 0
-            ? "Matcher ran cleanly — no patterns fired against this repo."
-            : `Matcher emitted ${result.summary.total} finding(s): ${result.summary.trusted_count} trusted, ${result.summary.inferred_count} inferred. ` +
-                (inferenceBundle.inference_candidates.length > 0
-                    ? `IMPORTANT: ${inferenceBundle.inference_candidates.length} inference_candidate${inferenceBundle.inference_candidates.length === 1 ? "" : "s"} require host-side execution — see host_required_action.`
-                    : "");
-        return withNextSteps({
-            ...result,
-            host_required_action: inferenceBundle.host_required_action,
-            inference_candidates: inferenceBundle.inference_candidates,
-        }, result.summary.inferred_count > 0
-            ? [
-                {
-                    id: "get_inference_prompts",
-                    label: "Pull inference prompts for inferred-lane findings and run them in your model",
-                    tool: "zivis_threat_get_inference_prompt",
-                    why: "Each inferred finding has an inference_candidate.prompt_ref. Pass it (or the capsule_id) to retrieve the prompt bundle.",
-                },
-                {
-                    id: "review_findings",
-                    label: "Review the trusted-lane findings first; they're evidence-backed and ready for the threat model",
-                    tool: "zivis_threat_run_matcher",
-                    why: "Trusted-lane findings can land in the threat model directly. Inferred require host-LLM confirmation.",
-                },
-            ]
-            : result.summary.total === 0
-                ? [
-                    {
-                        id: "expand_pack",
-                        label: "No matches today — proprietary patterns evaluated server-side may still apply",
-                        tool: "zivis_threat_run_matcher",
-                        why: "Public pack covers a curated subset. Phase 4 sends the artifact for proprietary platform evaluation.",
-                    },
-                ]
-                : [], headline);
-    };
-}
-function userCacheRoot() {
-    const home = os.homedir();
-    if (process.platform === "darwin") {
-        return path.join(home, "Library", "Caches", "zivis");
-    }
-    if (process.platform === "win32") {
-        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
-        return path.join(localAppData, "zivis", "Cache");
-    }
-    const xdg = process.env.XDG_CACHE_HOME;
-    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
-}
-async function resolveArtifactPath(explicit, cwd) {
-    if (explicit) {
-        if (!fssync.existsSync(explicit)) {
-            throw new Error(`Artifact path does not exist: ${explicit}`);
-        }
-        return explicit;
-    }
-    const repoId = await deriveRepoId(cwd);
-    const runsDir = path.join(userCacheRoot(), "repos", repoId, "inspect", "runs");
-    if (!fssync.existsSync(runsDir)) {
-        throw new Error(`No inspect runs for this repo (looked under ${runsDir}). Run \`zivis inspect\` from this directory first.`);
-    }
-    const candidates = [];
-    for (const entry of await fs.readdir(runsDir)) {
-        if (!entry.endsWith(".json"))
-            continue;
-        const full = path.join(runsDir, entry);
-        const stat = await fs.stat(full);
-        candidates.push({ file: full, mtime: stat.mtimeMs });
-    }
-    if (candidates.length === 0) {
-        throw new Error(`No inspect runs found under ${runsDir}.`);
-    }
-    candidates.sort((a, b) => b.mtime - a.mtime);
-    return candidates[0].file;
-}
-async function deriveRepoId(cwd) {
-    try {
-        const { stdout } = await execAsync("git remote get-url origin", { cwd });
-        const remote = stdout.trim();
-        if (remote)
-            return "remote-" + sha256Short(remote);
-    }
-    catch {
-    }
-    return "path-" + sha256Short(cwd);
-}
-function sha256Short(value) {
-    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
-}