@zxyycom/vibe-check 0.0.1 → 0.0.2

package/src/package-checks/secret-detection/options.ts

@@ -0,0 +1,36 @@
+import type { FindingWaiver } from "../../finding-waivers/reconciliation.ts";
+import type { ProjectFileSelection } from "../project-files/configuration.ts";
+
+/** `secretDetection(options)` 的明确 authoring policy。 */
+export interface SecretDetectionOptions {
+  /** 必填的完整 project-file policy；只有它选中的 path 可以被读取或传给 detector。 */
+  readonly files: ProjectFileSelection;
+  /** 单个输入允许的最大 raw byte 数；超过时形成不可豁免的 coverage gap。 */
+  readonly maximumFileBytes?: number;
+  /** 一次 invocation 中允许读取和检测的累计 raw byte 数；超过时形成 coverage gap。 */
+  readonly maximumTotalBytes?: number;
+  /** 一次 invocation 中允许处理的 selected file 数；超过时形成 coverage gap。 */
+  readonly maximumFileCount?: number;
+  /** 对安全 finding identity 的精确、可审计误报豁免。 */
+  readonly findingWaivers?: readonly FindingWaiver<SecretDetectionFindingIdentity>[];
+}
+
+/** 不含 raw value、message、hash 或 location 的 secret finding 身份。 */
+export interface SecretDetectionFindingIdentity {
+  readonly ordinal: number;
+  readonly path: string;
+  readonly ruleId: "@secretlint/secretlint-rule-privatekey";
+  readonly structuralClass: "text-document";
+}
+
+/** `secretDetection` execution 消费的完整冻结 options。 */
+export interface ResolvedSecretDetectionOptions {
+  readonly files: ProjectFileSelection;
+  readonly findingWaivers: readonly FindingWaiver<SecretDetectionFindingIdentity>[];
+  readonly maximumFileBytes: number;
+  readonly maximumFileCount: number;
+  readonly maximumTotalBytes: number;
+}
+
+/** `findingWaivers` 的 public authoring alias。 */
+export type SecretDetectionFindingWaiver = FindingWaiver<SecretDetectionFindingIdentity>;

package/src/package-checks/secret-detection/records.ts

@@ -0,0 +1,77 @@
+import type { MaterializedFindingWaiver } from "../../finding-waivers/reconciliation.ts";
+import type {
+  FindingWaiverRecordAudit,
+  FindingWaiverAuditRecordData
+} from "../code-quality-findings/finding-waiver-evidence.ts";
+import { buildFindingWaiverAuditRecordData } from "../code-quality-findings/finding-waiver-evidence.ts";
+import type { SecretDetectionCoverageGapReason } from "./classification.ts";
+import type { SecretDetectionIssue } from "./secretlint/adapter.ts";
+import type { SecretDetectionFindingIdentity } from "./options.ts";
+import { resolveSecretDetectionFindingIdentity } from "./finding-waiver-identity.ts";
+
+/** An actionable or waived high-confidence secret finding. No detector value or message is retained. */
+export interface SecretDetectionFindingRecordData {
+  readonly blocking: boolean;
+  readonly kind: "secret-finding";
+  readonly location: SecretDetectionIssue["location"];
+  readonly ordinal: number;
+  readonly path: string;
+  readonly ruleId: "@secretlint/secretlint-rule-privatekey";
+  readonly structuralClass: "text-document";
+  readonly waiver?: Readonly<{ readonly reason: string }>;
+}
+
+/** A deterministic exact-input coverage gap. It is never reconciled through finding waiver policy. */
+export interface SecretDetectionCoverageGapRecordData {
+  readonly blocking: true;
+  readonly kind: "coverage-gap";
+  readonly path: string;
+  readonly reason: SecretDetectionCoverageGapReason;
+}
+
+/** Unused or overmatched safe secret finding waiver evidence. */
+export type SecretDetectionFindingWaiverAuditRecordData =
+  FindingWaiverAuditRecordData<SecretDetectionFindingIdentity>;
+
+/** `secretDetection` 发布的全部补充 Record data。 */
+export type SecretDetectionRecordData =
+  | SecretDetectionCoverageGapRecordData
+  | SecretDetectionFindingRecordData
+  | SecretDetectionFindingWaiverAuditRecordData;
+
+export function secretFindingIdentity(issue: SecretDetectionIssue): SecretDetectionFindingIdentity {
+  return Object.freeze({
+    ordinal: issue.ordinal,
+    path: issue.path,
+    ruleId: issue.ruleId,
+    structuralClass: issue.structuralClass
+  });
+}
+
+export function secretFindingRecordId(identity: SecretDetectionFindingIdentity): string {
+  return `/secret-finding/${identity.path}/${identity.ordinal}`;
+}
+
+export function secretCoverageGapRecordId(path: string): string {
+  return `/coverage-gap/${path}`;
+}
+
+export function secretDetectionWaiverAuditRecord(
+  audit: FindingWaiverRecordAudit
+): Readonly<{ readonly data: SecretDetectionFindingWaiverAuditRecordData; readonly id: string }> {
+  const identity = secretDetectionWaiverIdentity(audit.waiver);
+  return Object.freeze({
+    data: buildFindingWaiverAuditRecordData(identity, audit),
+    id: `/finding-waiver-audit/${identity.path}/${identity.ordinal}`
+  });
+}
+
+function secretDetectionWaiverIdentity(
+  waiver: MaterializedFindingWaiver
+): SecretDetectionFindingIdentity {
+  const identity = resolveSecretDetectionFindingIdentity(waiver.identity);
+  if (identity === undefined) {
+    throw new TypeError("secretDetection waiver identity must be a safe finding identity");
+  }
+  return identity;
+}

package/src/package-checks/secret-detection/secretlint/adapter.ts

@@ -0,0 +1,123 @@
+import { snapshotClosedRecord } from "../../../data-boundary/closed-values.ts";
+import { lintSource } from "@secretlint/core";
+import { creator as privateKeyRule } from "@secretlint/secretlint-rule-privatekey";
+
+import {
+  secretDetectionPrivateKeyRuleId,
+  secretDetectionTextDocumentStructuralClass
+} from "../finding-waiver-identity.ts";
+
+/** The only detector result shape allowed to leave this private adapter. */
+export interface SecretDetectionIssue {
+  readonly location: Readonly<{
+    readonly endColumn: number;
+    readonly endLine: number;
+    readonly startColumn: number;
+    readonly startLine: number;
+  }>;
+  readonly ordinal: number;
+  readonly path: string;
+  readonly ruleId: "@secretlint/secretlint-rule-privatekey";
+  readonly structuralClass: "text-document";
+}
+
+export type SecretlintDetectionResult = Readonly<
+  | { readonly issues: readonly SecretDetectionIssue[]; readonly kind: "complete" }
+  | { readonly kind: "protocol-failed" }
+  | { readonly kind: "unavailable" }
+>;
+
+/**
+ * Runs the fixed local Secretlint rule set against already-approved in-memory text.
+ * Third-party result, message text, data, error, and source content never leave this module.
+ */
+export async function detectSecretlintIssues(
+  content: string,
+  projectRelativePath: string
+): Promise<SecretlintDetectionResult> {
+  try {
+    const result = await lintSource({
+      source: { content, contentType: "text", filePath: projectRelativePath },
+      options: {
+        config: {
+          rules: [{ id: secretDetectionPrivateKeyRuleId, rule: privateKeyRule, severity: "error" }]
+        },
+        maskSecrets: true,
+        noPhysicFilePath: true
+      }
+    });
+    return adaptSecretlintMessages(result.messages, projectRelativePath);
+  } catch {
+    return Object.freeze({ kind: "unavailable" });
+  }
+}
+
+/** Converts only allowlisted Secretlint message fields to the safe Check-local issue DTO. */
+export function adaptSecretlintMessages(
+  messages: unknown,
+  projectRelativePath: string
+): SecretlintDetectionResult {
+  if (!Array.isArray(messages)) return Object.freeze({ kind: "protocol-failed" });
+
+  const issues: SecretDetectionIssue[] = [];
+  for (const message of messages) {
+    const location = safeLocation(message);
+    if (location === undefined || !isPrivateKeyMessage(message)) {
+      return Object.freeze({ kind: "protocol-failed" });
+    }
+    issues.push(
+      Object.freeze({
+        location,
+        ordinal: issues.length + 1,
+        path: projectRelativePath,
+        ruleId: secretDetectionPrivateKeyRuleId,
+        structuralClass: secretDetectionTextDocumentStructuralClass
+      })
+    );
+  }
+  return Object.freeze({ issues: Object.freeze(issues), kind: "complete" });
+}
+
+function isPrivateKeyMessage(value: unknown): boolean {
+  const message = snapshotClosedRecord(value);
+  return (
+    message !== undefined &&
+    message.type === "message" &&
+    message.ruleId === secretDetectionPrivateKeyRuleId &&
+    message.severity === "error"
+  );
+}
+
+function safeLocation(value: unknown): SecretDetectionIssue["location"] | undefined {
+  const message = snapshotClosedRecord(value);
+  if (message === undefined) return undefined;
+  const loc = snapshotClosedRecord(message.loc);
+  if (loc === undefined) return undefined;
+  const start = loc.start;
+  const end = loc.end;
+  if (!isPosition(start) || !isPosition(end)) return undefined;
+  if (end.line < start.line || (end.line === start.line && end.column < start.column)) {
+    return undefined;
+  }
+  return Object.freeze({
+    endColumn: end.column + 1,
+    endLine: end.line,
+    startColumn: start.column + 1,
+    startLine: start.line
+  });
+}
+
+function isPosition(
+  value: unknown
+): value is Readonly<{ readonly column: number; readonly line: number }> {
+  const position = snapshotClosedRecord(value);
+  return (
+    position !== undefined &&
+    typeof position.column === "number" &&
+    Number.isSafeInteger(position.column) &&
+    position.column >= 0 &&
+    typeof position.line === "number" &&
+    Number.isSafeInteger(position.line) &&
+    position.line >= 1
+  );
+}

package/src/project-definition/check-tree/authoring.ts

@@ -1,41 +1,37 @@
 import type { CheckDescriptor } from "../../check/descriptor.ts";
+import { snapshotClosedArray } from "../../data-boundary/closed-values.ts";
 import {
-  isInheritedCheckCollection,
-  snapshotInheritedCheckCollection,
-  type CheckVisibility,
-  type CheckExecution,
-  type CheckPreflight,
-  type InheritedCheckCollection
-} from "../../check/check.ts";
-import { snapshotClosedArray, snapshotClosedRecord } from "../../data-boundary/closed-values.ts";
-import { validateCheckDescriptor } from "../../check/descriptor-validation.ts";
-import { snapshotJsonObject } from "../../check/options-snapshot.ts";
-
-type TrustedDataParser = (this: void, ...parameters: never[]) => unknown;
-
-export type ParsedCheckCollection = Readonly<
-  | { readonly kind: "exact"; readonly values: readonly string[] }
-  | {
-      readonly kind: "inherit";
-      readonly add: readonly string[];
-      readonly remove: readonly string[];
-    }
->;
+  parseCheckAuthoringData,
+  parseCheckFieldPrelude,
+  parseCheckFields,
+  type CheckAuthoringData,
+  type ParsedCheckFields,
+  type ParsedCheckFieldPrelude,
+  type TrustedDataParser
+} from "./check-fields-authoring.ts";
+import { parseCheckScheduling, type ParsedCheckCollection } from "./scheduling-authoring.ts";
+import type { ResourceUnitMapping } from "../resource-unit-mapping.ts";
+
+export type { ParsedCheckCollection } from "./scheduling-authoring.ts";
 
 export interface ParsedCheck {
+  readonly admissionPriority: number | undefined;
   readonly checkId: string;
   readonly checks: readonly ParsedCheck[];
   readonly definition: CheckDescriptor | null;
   readonly dependsOn: ParsedCheckCollection | undefined;
   readonly displayName: string;
-  readonly execution: CheckExecution | null;
+  readonly enabledByFlags: ParsedCheckFieldPrelude["enabledByFlags"];
+  readonly execution: ParsedCheckFieldPrelude["execution"];
   readonly maxParallel: number | undefined;
   readonly mutex: ParsedCheckCollection | undefined;
+  readonly observes: ParsedCheckCollection | undefined;
+  readonly resourceClaims: ResourceUnitMapping | undefined;
   readonly options: object | null;
   readonly path: string;
   readonly parseData: TrustedDataParser | null;
-  readonly preflight: CheckPreflight | null;
-  readonly visibility: CheckVisibility | null;
+  readonly preflight: ParsedCheckFieldPrelude["preflight"];
+  readonly visibility: ParsedCheckFields["visibility"];
 }
 
 export interface ParsedCheckTree {
@@ -53,43 +49,6 @@ interface ParseState {
   readonly warnings: MeaninglessCheckWarning[];
 }
 
-interface CheckAuthoringData extends Readonly<Record<string, unknown>> {
-  readonly checkId: string;
-  readonly displayName: string;
-}
-
-interface ParsedCheckFields {
-  readonly definition: CheckDescriptor | null;
-  readonly execution: CheckExecution | null;
-  readonly options: object | null;
-  readonly parseData: TrustedDataParser | null;
-  readonly preflight: CheckPreflight | null;
-  readonly visibility: CheckVisibility | null;
-}
-
-const CHECK_KEYS = [
-  "checkId",
-  "checks",
-  "dependsOn",
-  "displayName",
-  "execution",
-  "maxParallel",
-  "mutex",
-  "options",
-  "parseData",
-  "preflight",
-  "visibility"
-] as const;
-
-const CONTAINER_CHECK_FIELDS: ParsedCheckFields = Object.freeze({
-  definition: null,
-  execution: null,
-  options: null,
-  parseData: null,
-  preflight: null,
-  visibility: null
-});
-
 /**
  * Parses only the closed recursive authoring grammar. Execution callbacks are
  * trusted project code, while every declarative field is copied and validated.
@@ -111,31 +70,30 @@ export function parseCheckTreeAuthoring(value: unknown): ParsedCheckTree | undef
 }
 
 function parseCheck(value: unknown, path: string, state: ParseState): ParsedCheck | undefined {
-  const data = parseCheckData(value);
+  const data = parseCheckAuthoringData(value);
   if (data === undefined) return undefined;
-  const execution = parseExecution(data);
-  if (execution === undefined) return undefined;
-  const parseData = parseDataParser(data);
-  if (parseData === undefined) return undefined;
-  const preflight = parsePreflight(data);
-  if (preflight === undefined) return undefined;
+  const prelude = parseCheckFieldPrelude(data);
+  if (prelude === undefined) return undefined;
   const checks = parseChildren(data, path, state);
   if (checks === undefined) return undefined;
-  const scheduling = parseScheduling(data);
+  const scheduling = parseCheckScheduling(data);
   if (scheduling === undefined) return undefined;
-  const fields = parseCheckFields(data, execution, parseData, preflight);
+  const fields = parseCheckFields(data, prelude);
   if (fields === undefined) return undefined;
   warnForMeaninglessCheck(data, checks, fields, path, state);
-
   return Object.freeze({
+    admissionPriority: scheduling.admissionPriority,
     checkId: data.checkId,
     checks,
     definition: fields.definition,
     dependsOn: scheduling.dependsOn,
     displayName: data.displayName,
+    enabledByFlags: fields.enabledByFlags,
     execution: fields.execution,
     maxParallel: scheduling.maxParallel,
     mutex: scheduling.mutex,
+    observes: scheduling.observes,
+    resourceClaims: scheduling.resourceClaims,
     options: fields.options,
     path,
     parseData: fields.parseData,
@@ -144,49 +102,6 @@ function parseCheck(value: unknown, path: string, state: ParseState): ParsedChec
   });
 }
 
-function parseCheckData(value: unknown): CheckAuthoringData | undefined {
-  const data = snapshotClosedRecord(value);
-  if (data === undefined) return undefined;
-  return hasValidCheckIdentity(data) ? data : undefined;
-}
-
-function hasValidCheckIdentity(
-  data: Readonly<Record<string, unknown>>
-): data is CheckAuthoringData {
-  return (
-    hasOnlyCheckKeys(data) &&
-    typeof data.checkId === "string" &&
-    data.checkId.length > 0 &&
-    typeof data.displayName === "string" &&
-    data.displayName.length > 0
-  );
-}
-
-function hasOnlyCheckKeys(data: Readonly<Record<string, unknown>>): boolean {
-  return Object.keys(data).every((key) => CHECK_KEYS.some((checkKey) => checkKey === key));
-}
-
-function parseExecution(data: CheckAuthoringData): CheckExecution | null | undefined {
-  if (!Object.hasOwn(data, "execution")) return null;
-  return isTrustedFunction<CheckExecution>(data.execution) ? data.execution : undefined;
-}
-
-function parseDataParser(data: CheckAuthoringData): TrustedDataParser | null | undefined {
-  if (!Object.hasOwn(data, "parseData") || data.parseData === undefined) return null;
-  return isTrustedFunction<TrustedDataParser>(data.parseData) ? data.parseData : undefined;
-}
-
-function parsePreflight(data: CheckAuthoringData): CheckPreflight | null | undefined {
-  if (!Object.hasOwn(data, "preflight")) return null;
-  return isTrustedFunction<CheckPreflight>(data.preflight) ? data.preflight : undefined;
-}
-
-function isTrustedFunction<FunctionType extends (...parameters: never[]) => unknown>(
-  value: unknown
-): value is FunctionType {
-  return typeof value === "function";
-}
-
 function parseChildren(
   data: CheckAuthoringData,
   path: string,
@@ -204,59 +119,6 @@ function parseChildren(
   return Object.freeze(checks);
 }
 
-function parseDefinition(data: CheckAuthoringData): CheckDescriptor | undefined {
-  const definition = validateCheckDescriptor({
-    checkId: data.checkId,
-    displayName: data.displayName
-  });
-  return definition.ok ? definition.value : undefined;
-}
-
-function parseOptions(data: CheckAuthoringData): object | undefined {
-  if (!Object.hasOwn(data, "options")) return Object.freeze({});
-  const options = snapshotClosedRecord(data.options);
-  if (options === undefined) return undefined;
-  return snapshotJsonObject(options);
-}
-
-function parseCheckFields(
-  data: CheckAuthoringData,
-  execution: CheckExecution | null,
-  parseData: TrustedDataParser | null,
-  preflight: CheckPreflight | null
-): ParsedCheckFields | undefined {
-  if (execution === null) {
-    return Object.hasOwn(data, "options") ||
-      Object.hasOwn(data, "visibility") ||
-      parseData !== null ||
-      preflight !== null
-      ? undefined
-      : CONTAINER_CHECK_FIELDS;
-  }
-  const definition = parseDefinition(data);
-  if (definition === undefined) return undefined;
-  const options = parseOptions(data);
-  if (options === undefined) return undefined;
-  const visibility = parseVisibility(data);
-  if (visibility === undefined) return undefined;
-  return Object.freeze({
-    definition,
-    execution,
-    options,
-    parseData,
-    preflight,
-    visibility
-  });
-}
-
-function parseVisibility(data: CheckAuthoringData): CheckVisibility | undefined {
-  if (!Object.hasOwn(data, "visibility")) return "always";
-  const visibility = data.visibility;
-  return visibility === undefined || visibility === "always" || visibility === "attention"
-    ? (visibility ?? "always")
-    : undefined;
-}
-
 function warnForMeaninglessCheck(
   data: CheckAuthoringData,
   checks: readonly ParsedCheck[],
@@ -267,66 +129,3 @@ function warnForMeaninglessCheck(
   if (fields.execution !== null || checks.length > 0) return;
   state.warnings.push(Object.freeze({ code: "meaningless-check", path, checkId: data.checkId }));
 }
-
-function parseScheduling(data: CheckAuthoringData):
-  | Readonly<{
-      readonly dependsOn: ParsedCheckCollection | undefined;
-      readonly maxParallel: number | undefined;
-      readonly mutex: ParsedCheckCollection | undefined;
-    }>
-  | undefined {
-  const dependsOn = parseCollection(data, "dependsOn");
-  const mutex = parseCollection(data, "mutex");
-  const maxParallel = data.maxParallel;
-  if (
-    dependsOn === null ||
-    mutex === null ||
-    (maxParallel !== undefined &&
-      (typeof maxParallel !== "number" || !Number.isSafeInteger(maxParallel) || maxParallel <= 0))
-  )
-    return undefined;
-  return Object.freeze({
-    dependsOn: dependsOn ?? undefined,
-    maxParallel,
-    mutex: mutex ?? undefined
-  });
-}
-
-function parseCollection(
-  data: CheckAuthoringData,
-  field: "dependsOn" | "mutex"
-): ParsedCheckCollection | null | undefined {
-  if (!Object.hasOwn(data, field)) return undefined;
-  const value = data[field];
-  if (isInheritedCheckCollection(value)) return parseInheritedCollection(value);
-  const values = parseCollectionItems(value);
-  return values === undefined ? null : Object.freeze({ kind: "exact", values });
-}
-
-function parseInheritedCollection(
-  value: InheritedCheckCollection<unknown>
-): ParsedCheckCollection | null {
-  const data = snapshotInheritedCheckCollection(value);
-  if (data === undefined || !hasExactInheritedKeys(data)) return null;
-  const add = data.add === undefined ? Object.freeze([]) : parseCollectionItems(data.add);
-  const remove = data.remove === undefined ? Object.freeze([]) : parseCollectionItems(data.remove);
-  if (add === undefined || remove === undefined) return null;
-  return Object.freeze({ kind: "inherit", add, remove });
-}
-
-function hasExactInheritedKeys(data: Readonly<Record<string, unknown>>): boolean {
-  const keys = Object.keys(data);
-  return keys.length > 0 && keys.every((key) => key === "add" || key === "remove");
-}
-
-function parseCollectionItems(value: unknown): readonly string[] | undefined {
-  const items = snapshotClosedArray(value);
-  if (items === undefined) return undefined;
-  const values: string[] = [];
-  for (const item of items) {
-    const valid = typeof item === "string" && item.length > 0;
-    if (!valid) return undefined;
-    if (!values.includes(item)) values.push(item);
-  }
-  return Object.freeze(values);
-}