agent-master-devsecops 0.0.0-stage → 5.1.0

package/scripts/mcp/handlers/qa_handlers.js

@@ -0,0 +1,502 @@
+/**
+ * scripts/mcp/handlers/qa_handlers.js
+ * 
+ * QA, Security & DevSecOps MCP Handlers.
+ * Despacha chamadas JSON-RPC 2.0 para auditorias de código estático (SAST),
+ * revisão de PR, qualidade/complexidade ciclomática, acessibilidade WCAG,
+ * higiene Git (Regra 11), composição de software (SCA), conformidade OpenAPI,
+ * benchmark de LLMs e autocura autônoma (OODA).
+ * 
+ * Versão: 5.1.0 Enterprise
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { createSarifReport } = require('../../core/sarif_engine.js');
+
+/**
+ * Helpers funcionais puros para construção determinística de respostas JSON-RPC 2.0 (DRY)
+ */
+function buildSuccessResponse(id, data) {
+  const textContent = typeof data === 'string' ? data : JSON.stringify(data, null, 2);
+  return {
+    jsonrpc: '2.0',
+    id,
+    result: {
+      content: [
+        {
+          type: 'text',
+          text: textContent
+        }
+      ]
+    }
+  };
+}
+
+function buildErrorResponse(id, code, message, data = null) {
+  const errObj = { code, message };
+  if (data) errObj.data = data;
+  return {
+    jsonrpc: '2.0',
+    id,
+    error: errObj
+  };
+}
+
+/**
+ * 1. Auditoria de Segurança Rápida de Snippets / Diffs (agent_audit_code / qa_gate)
+ * Inspeciona código contra CWE-94/CWE-78, CWE-798 e CWE-116/CWE-79.
+ */
+function handleAuditCode(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    let codeDiff = safeArgs.codeDiff || safeArgs.code || safeArgs.codeContent || '';
+
+    if (!codeDiff && safeArgs.filePath && typeof safeArgs.filePath === 'string') {
+      try {
+        if (fs.existsSync(safeArgs.filePath)) {
+          codeDiff = fs.readFileSync(safeArgs.filePath, 'utf8');
+        }
+      } catch (_) {}
+    }
+    codeDiff = String(codeDiff || '');
+
+    const issues = [];
+
+    if (/eval\(|new Function\(|child_process\.exec\(/i.test(codeDiff)) {
+      issues.push({
+        tipo: 'Command / Code Injection',
+        gravidade: 'CRÍTICA',
+        cwe: 'CWE-94 / CWE-78',
+        detalhe: 'Uso de funções perigosas de execução dinâmica de strings.'
+      });
+    }
+
+    if (/(["'][a-zA-Z0-9_\-]{20,}["'])/.test(codeDiff) && /token|secret|password|key/i.test(codeDiff)) {
+      issues.push({
+        tipo: 'Hardcoded Secret Exposure',
+        gravidade: 'CRÍTICA',
+        cwe: 'CWE-798',
+        detalhe: 'Possível segredo ou credencial embutida em texto plano no diff.'
+      });
+    }
+
+    if (/<[^>]+>.*<[^>]+>/i.test(codeDiff) && !/stripHtml|sanitize|recursiv/i.test(codeDiff)) {
+      issues.push({
+        tipo: 'HTML Sanitization Bypass',
+        gravidade: 'ALTA',
+        cwe: 'CWE-116 / CWE-79',
+        detalhe: 'Manipulação de strings HTML sem sanitização recursiva comprovada.'
+      });
+    }
+
+    const verdict = issues.length === 0
+      ? 'APROVADO'
+      : (issues.some(i => i.gravidade === 'CRÍTICA') ? 'REPROVADO' : 'APROVADO COM RESSALVAS');
+
+    const format = safeArgs.format || 'json';
+
+    if (format === 'sarif') {
+      const ruleMapping = {
+        'Command / Code Injection': { ruleId: 'RULE-SEC-094', severity: 'CRITICAL' },
+        'Hardcoded Secret Exposure': { ruleId: 'RULE-SEC-798', severity: 'CRITICAL' },
+        'HTML Sanitization Bypass': { ruleId: 'RULE-SEC-116', severity: 'HIGH' }
+      };
+
+      const findings = issues.map(iss => ({
+        ruleId: (ruleMapping[iss.tipo] && ruleMapping[iss.tipo].ruleId) || 'RULE-SEC-GENERIC',
+        severity: (ruleMapping[iss.tipo] && ruleMapping[iss.tipo].severity) || 'HIGH',
+        filename: safeArgs.filename || safeArgs.filePath || 'snippet.js',
+        line: 1,
+        column: 1,
+        snippet: codeDiff.slice(0, 100),
+        message: `${iss.tipo} (${iss.cwe}): ${iss.detalhe}`,
+        remediation: 'Remover funções dinâmicas perigosas, extrair credenciais para variáveis de ambiente e sanitizar saída HTML.'
+      }));
+
+      const sarifReport = createSarifReport({
+        toolName: 'agent-master-qa-gate',
+        toolVersion: '5.1.0',
+        findings,
+        properties: {
+          verdict,
+          totalIssues: issues.length,
+          auditor: 'Revisor Crítico Adversário (AGENT_QA.md)'
+        }
+      });
+      return buildSuccessResponse(id, sarifReport);
+    }
+
+    return buildSuccessResponse(id, {
+      veredito: verdict,
+      defeitosEncontrados: issues,
+      auditor: 'Revisor Crítico Adversário (AGENT_QA.md)',
+      totalIssues: issues.length
+    });
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleAuditCode: ${err.message}`);
+  }
+}
+
+/**
+ * 2. Revisor Autônomo de Pull Requests & Blast Radius (agent_review_pr / review_pr)
+ */
+function handleReviewPr(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { analyzeDiff, formatReport, PrReviewer } = require('../../auditors/pr_reviewer.js');
+    const diff = safeArgs.diff || safeArgs.codeDiff || '';
+    const files = Array.isArray(safeArgs.files) ? safeArgs.files : [];
+    const format = safeArgs.format || 'json';
+
+    if (format === 'sarif') {
+      const reviewer = new PrReviewer();
+      const sarifReport = reviewer.auditToSarif({
+        diff,
+        files,
+        branchName: safeArgs.branchName,
+        commitMessage: safeArgs.commitMessage
+      });
+      return buildSuccessResponse(id, sarifReport);
+    }
+
+    const analysis = analyzeDiff(diff, files, safeArgs);
+    const report = formatReport(analysis);
+
+    return buildSuccessResponse(id, {
+      veredito: analysis.verdict,
+      analise: analysis,
+      relatorioCanonico: report
+    });
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleReviewPr: ${err.message}`);
+  }
+}
+
+/**
+ * 3. Auditoria SAST & Varredura de Vulnerabilidades / Segredos (agent_sast_scan)
+ */
+function handleSastScan(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { SastScanner } = require('../../auditors/sast_scanner.js');
+    const scanner = new SastScanner();
+    const code = safeArgs.code;
+    const targetPath = safeArgs.filePath || safeArgs.targetPath || safeArgs.path;
+    const filename = safeArgs.filename || 'snippet.js';
+    const format = safeArgs.format || 'json';
+
+    let output;
+    if (targetPath) {
+      output = format === 'sarif'
+        ? scanner.scanToSarif(targetPath)
+        : (fs.existsSync(targetPath) && fs.statSync(targetPath).isFile() ? scanner.scanFile(targetPath) : scanner.scanDirectory(targetPath));
+    } else {
+      output = format === 'sarif'
+        ? scanner.scanCodeToSarif(code || '', filename)
+        : scanner.scanCode(code || '', filename);
+    }
+
+    return buildSuccessResponse(id, output);
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleSastScan: ${err.message}`);
+  }
+}
+
+/**
+ * 4. Auditoria de Qualidade de Código & McCabe (agent_audit_quality)
+ */
+function handleAuditQuality(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { CodeQualityAuditor } = require('../../auditors/code_quality_auditor.js');
+    const maxComplexity = Number(safeArgs.maxComplexity) || 15;
+    const auditor = new CodeQualityAuditor({ maxComplexity });
+    const format = safeArgs.format || 'json';
+
+    let code = safeArgs.code || '';
+    let filename = safeArgs.filename || 'snippet.js';
+
+    if (safeArgs.filePath && !safeArgs.code && fs.existsSync(safeArgs.filePath)) {
+      code = fs.readFileSync(safeArgs.filePath, 'utf8');
+      filename = path.basename(safeArgs.filePath);
+    }
+
+    if (format === 'sarif') {
+      const sarifOutput = auditor.auditToSarif(code, filename);
+      return buildSuccessResponse(id, sarifOutput);
+    }
+
+    const auditResult = auditor.auditCode(code, filename);
+    return buildSuccessResponse(id, auditResult);
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleAuditQuality: ${err.message}`);
+  }
+}
+
+/**
+ * 5. Auditoria de Acessibilidade Digital & WCAG 2.1 AA (agent_audit_a11y)
+ */
+function handleAuditA11y(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { A11yAuditor } = require('../../auditors/a11y_auditor.js');
+    const auditor = new A11yAuditor();
+    const code = safeArgs.code || '';
+    const filename = safeArgs.filename || 'component.tsx';
+    const format = safeArgs.format || 'json';
+
+    if (format === 'sarif') {
+      const sarifOutput = auditor.auditToSarif(code, filename);
+      return buildSuccessResponse(id, sarifOutput);
+    }
+
+    const auditResult = auditor.auditCode(code, filename);
+    const report = auditor.formatReport(auditResult);
+
+    return buildSuccessResponse(id, { ...auditResult, formattedReport: report });
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleAuditA11y: ${err.message}`);
+  }
+}
+
+/**
+ * 6. Linter de Higiene Git & Governança da Regra 11 (agent_lint_git_hygiene)
+ */
+function handleLintGitHygiene(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { GitHygieneLinter, lintCommitMessage, lintBranchName, auditGitState } = require('../../auditors/git_hygiene_linter.js');
+    const format = safeArgs.format || 'json';
+
+    if (format === 'sarif') {
+      const linter = new GitHygieneLinter();
+      const sarifOutput = linter.auditToSarif(safeArgs);
+      return buildSuccessResponse(id, sarifOutput);
+    }
+
+    const res = {};
+    if (safeArgs.commitMessage) {
+      res.commitAudit = lintCommitMessage(safeArgs.commitMessage);
+    }
+    if (safeArgs.branchName) {
+      res.branchAudit = lintBranchName(safeArgs.branchName);
+    }
+    if (safeArgs.auditState) {
+      res.gitState = auditGitState();
+    }
+    if (!safeArgs.commitMessage && !safeArgs.branchName && !safeArgs.auditState) {
+      res.gitState = auditGitState();
+    }
+
+    return buildSuccessResponse(id, res);
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleLintGitHygiene: ${err.message}`);
+  }
+}
+
+/**
+ * 7. Auditoria de Composição de Software (SCA) & Licenças (agent_audit_dependencies_sca)
+ */
+function handleAuditDependenciesSca(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { ScaDependencyAuditor } = require('../../auditors/sca_dependency_auditor.js');
+    const input = safeArgs.packageJson || safeArgs.manifest || safeArgs.path || path.join(process.cwd(), 'package.json');
+    const format = safeArgs.format || 'json';
+    const auditor = new ScaDependencyAuditor();
+
+    const res = format === 'sarif'
+      ? auditor.auditToSarif(input)
+      : auditor.audit(input);
+
+    return buildSuccessResponse(id, res);
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleAuditDependenciesSca: ${err.message}`);
+  }
+}
+
+/**
+ * 8. Validação de Contratos OpenAPI & Drift de API (agent_validate_api_contract)
+ */
+function handleValidateApiContract(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { ContractTestValidator, validateOpenApiContract } = require('../../auditors/contract_test_validator.js');
+    const spec = safeArgs.spec || {};
+    const implementedRoutes = safeArgs.implementedRoutes || [];
+    const format = safeArgs.format || 'json';
+
+    if (format === 'sarif') {
+      const validator = new ContractTestValidator();
+      const sarifOutput = validator.auditToSarif(spec, implementedRoutes);
+      return buildSuccessResponse(id, sarifOutput);
+    }
+
+    const res = validateOpenApiContract(spec, implementedRoutes);
+    return buildSuccessResponse(id, res);
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleValidateApiContract: ${err.message}`);
+  }
+}
+
+/**
+ * 9. Benchmark & Avaliação Empírica de LLMs (agent_eval_harness)
+ */
+function handleEvalHarness(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { LlmEvalHarness, evaluateResponse } = require('../../auditors/eval_harness.js');
+    const { modelName, promptSent, responseReceived, format } = safeArgs;
+
+    if (format === 'sarif') {
+      const harness = new LlmEvalHarness();
+      const sarifOutput = harness.auditToSarif(modelName, promptSent, responseReceived);
+      return buildSuccessResponse(id, sarifOutput);
+    }
+
+    const report = evaluateResponse(modelName, promptSent, responseReceived);
+    return buildSuccessResponse(id, report);
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha em handleEvalHarness: ${err.message}`);
+  }
+}
+
+/**
+ * 10. Autocura Autônoma em Ciclo OODA (agent_remediate_code)
+ */
+async function handleRemediateCode(id, args) {
+  try {
+    const safeArgs = args && typeof args === 'object' ? args : {};
+    const { AutonomousRemediationEngine } = require('../../core/autonomous_remediation_engine.js');
+    const engine = new AutonomousRemediationEngine();
+    const targetFile = safeArgs.targetFile || '';
+    const testCommand = safeArgs.testCommand || '';
+    const projectRoot = safeArgs.projectRoot || '';
+
+    const result = await engine.remediateFile({ targetFile, testCommand, projectRoot });
+    return buildSuccessResponse(id, result);
+  } catch (err) {
+    return buildErrorResponse(id, -32603, `Falha na execução da autocura autônoma: ${err.message}`);
+  }
+}
+
+/**
+ * Classe Canônica QaHandlers
+ * Fornece API orientada a objetos com suporte a métodos estáticos e de instância.
+ */
+class QaHandlers {
+  static buildSuccessResponse(id, data) {
+    return buildSuccessResponse(id, data);
+  }
+
+  static buildErrorResponse(id, code, message, data = null) {
+    return buildErrorResponse(id, code, message, data);
+  }
+
+  static handleAuditCode(id, args) {
+    return handleAuditCode(id, args);
+  }
+
+  static handleReviewPr(id, args) {
+    return handleReviewPr(id, args);
+  }
+
+  static handleSastScan(id, args) {
+    return handleSastScan(id, args);
+  }
+
+  static handleAuditQuality(id, args) {
+    return handleAuditQuality(id, args);
+  }
+
+  static handleAuditA11y(id, args) {
+    return handleAuditA11y(id, args);
+  }
+
+  static handleLintGitHygiene(id, args) {
+    return handleLintGitHygiene(id, args);
+  }
+
+  static handleAuditDependenciesSca(id, args) {
+    return handleAuditDependenciesSca(id, args);
+  }
+
+  static handleValidateApiContract(id, args) {
+    return handleValidateApiContract(id, args);
+  }
+
+  static handleEvalHarness(id, args) {
+    return handleEvalHarness(id, args);
+  }
+
+  static async handleRemediateCode(id, args) {
+    return handleRemediateCode(id, args);
+  }
+
+  buildSuccessResponse(id, data) {
+    return QaHandlers.buildSuccessResponse(id, data);
+  }
+
+  buildErrorResponse(id, code, message, data = null) {
+    return QaHandlers.buildErrorResponse(id, code, message, data);
+  }
+
+  handleAuditCode(id, args) {
+    return QaHandlers.handleAuditCode(id, args);
+  }
+
+  handleReviewPr(id, args) {
+    return QaHandlers.handleReviewPr(id, args);
+  }
+
+  handleSastScan(id, args) {
+    return QaHandlers.handleSastScan(id, args);
+  }
+
+  handleAuditQuality(id, args) {
+    return QaHandlers.handleAuditQuality(id, args);
+  }
+
+  handleAuditA11y(id, args) {
+    return QaHandlers.handleAuditA11y(id, args);
+  }
+
+  handleLintGitHygiene(id, args) {
+    return QaHandlers.handleLintGitHygiene(id, args);
+  }
+
+  handleAuditDependenciesSca(id, args) {
+    return QaHandlers.handleAuditDependenciesSca(id, args);
+  }
+
+  handleValidateApiContract(id, args) {
+    return QaHandlers.handleValidateApiContract(id, args);
+  }
+
+  handleEvalHarness(id, args) {
+    return QaHandlers.handleEvalHarness(id, args);
+  }
+
+  async handleRemediateCode(id, args) {
+    return QaHandlers.handleRemediateCode(id, args);
+  }
+}
+
+module.exports = {
+  QaHandlers,
+  buildSuccessResponse,
+  buildErrorResponse,
+  handleAuditCode,
+  handleReviewPr,
+  handleSastScan,
+  handleAuditQuality,
+  handleAuditA11y,
+  handleLintGitHygiene,
+  handleAuditDependenciesSca,
+  handleValidateApiContract,
+  handleEvalHarness,
+  handleRemediateCode
+};