agent-master-devsecops 3.9.0 → 5.1.0

package/scripts/atlassian_client.js

@@ -1,238 +0,0 @@
-#!/usr/bin/env node
-/**
- * scripts/atlassian_client.js
- * 
- * Cliente Unificado e Utilitários de Comunicação com APIs REST Atlassian (Jira e Confluence).
- * Centraliza autenticação, sanitização de domínio, introspecção de git e execução de requisições HTTPS.
- * 
- * Governança: Tríade Git + Jira + Confluence (Regra 11 e Regra 15).
- */
-
-const fs = require('node:fs');
-const path = require('node:path');
-const https = require('node:https');
-const { execSync, execFileSync } = require('node:child_process');
-
-function sanitizeDomain(domainStr) {
-  if (!domainStr) return null;
-  return domainStr.replace(/^https?:\/\//, '').replace(/\/+$/, '');
-}
-
-function resolveMcpConfig() {
-  const homeDir = process.env.USERPROFILE || process.env.HOME || '';
-  const candidatePaths = [
-    path.join(homeDir, '.gemini', 'config', 'mcp_config.json'),
-    path.join(homeDir, '.antigravity', 'config', 'mcp_config.json'),
-    path.resolve(process.cwd(), '.mcp_config.json')
-  ];
-
-  for (const p of candidatePaths) {
-    if (fs.existsSync(p)) {
-      try {
-        return JSON.parse(fs.readFileSync(p, 'utf8'));
-      } catch (_) {}
-    }
-  }
-  return null;
-}
-
-function getAtlassianCredentials(targetDir = process.cwd()) {
-  let token = process.env.ATLASSIAN_API_TOKEN || process.env.JIRA_API_TOKEN || process.env.CONFLUENCE_API_TOKEN || process.env.PAT;
-  let email = process.env.ATLASSIAN_EMAIL || process.env.JIRA_EMAIL || process.env.CONFLUENCE_EMAIL || process.env.CONFLUENCE_USERNAME;
-  let rawDomain = process.env.ATLASSIAN_DOMAIN || process.env.JIRA_DOMAIN || process.env.CONFLUENCE_DOMAIN || process.env.JIRA_BASE_URL || process.env.CONFLUENCE_BASE_URL;
-  let source = (token && email && rawDomain) ? 'environment_variables' : null;
-
-  if (!process.env.IGNORE_LOCAL_ENV && (!token || !email || !rawDomain)) {
-    const isLocalWorkspace = path.resolve(targetDir) === path.resolve(process.cwd());
-    const candidateFiles = isLocalWorkspace
-      ? [
-          path.resolve(targetDir, '.env'),
-          path.resolve(targetDir, '..', '.env'),
-          path.resolve(process.cwd(), '.env'),
-          path.resolve(process.cwd(), '.env.local')
-        ]
-      : [
-          path.resolve(targetDir, '.env'),
-          path.resolve(targetDir, '.env.local')
-        ];
-
-    for (const envPath of candidateFiles) {
-      if (fs.existsSync(envPath)) {
-        try {
-          const raw = fs.readFileSync(envPath, 'utf8');
-          const dMatch = raw.match(/(?:ATLASSIAN_DOMAIN|JIRA_DOMAIN|CONFLUENCE_DOMAIN)=(.*)/);
-          const eMatch = raw.match(/(?:ATLASSIAN_EMAIL|JIRA_EMAIL|CONFLUENCE_EMAIL)=(.*)/);
-          const tMatch = raw.match(/(?:ATLASSIAN_API_TOKEN|JIRA_API_TOKEN|CONFLUENCE_API_TOKEN)=(.*)/);
-          if (dMatch && dMatch[1] && !rawDomain) rawDomain = dMatch[1].trim();
-          if (eMatch && eMatch[1] && !email) email = eMatch[1].trim();
-          if (tMatch && tMatch[1] && !token) token = tMatch[1].trim();
-          if (rawDomain && email && token) {
-            source = source || `local_file:${path.basename(envPath)}`;
-            break;
-          }
-        } catch (_) {}
-      }
-    }
-  }
-
-  const isLocalTarget = path.resolve(targetDir) === path.resolve(process.cwd());
-  if ((!token || !email || !rawDomain) && isLocalTarget) {
-    const mcp = resolveMcpConfig();
-    if (mcp && mcp.mcpServers) {
-      if (mcp.mcpServers.jira && mcp.mcpServers.jira.env) {
-        token = token || mcp.mcpServers.jira.env.JIRA_API_TOKEN;
-        email = email || mcp.mcpServers.jira.env.JIRA_EMAIL;
-        rawDomain = rawDomain || mcp.mcpServers.jira.env.JIRA_BASE_URL;
-        if (token && email && rawDomain) source = source || 'mcp_config:jira';
-      }
-      if (mcp.mcpServers.confluence && mcp.mcpServers.confluence.env) {
-        token = token || mcp.mcpServers.confluence.env.PAT;
-        if (token) source = source || 'mcp_config:confluence';
-      }
-    }
-  }
-
-  const cleanDomain = sanitizeDomain(rawDomain);
-  const isConfigured = Boolean(token && email && cleanDomain);
-  const auth = isConfigured ? Buffer.from(`${email}:${token}`).toString('base64') : null;
-
-  return {
-    domain: cleanDomain,
-    email: email || null,
-    token: token || null,
-    auth,
-    authBase64: auth,
-    isConfigured,
-    source
-  };
-}
-
-function checkGithubAuth(options = {}) {
-  const { globalStateCache } = require('./hot_state_cache.js');
-  const cacheKey = `gh_auth_${process.env.GITHUB_TOKEN || ''}_${process.env.GH_TOKEN || ''}`;
-  if (options && options.forceFresh) {
-    globalStateCache.invalidate(cacheKey);
-  }
-
-  return globalStateCache.wrap(cacheKey, () => {
-    let token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
-    let isAuthenticated = false;
-    let user = null;
-    let details = '';
-
-    try {
-      const stdout = execFileSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
-      isAuthenticated = true;
-      details = stdout.trim();
-      const userMatch = stdout.match(/Logged in to [^\s]+ account ([^\s\(\)]+)/i) || stdout.match(/account ([^\s\(\)]+)/i);
-      if (userMatch) user = userMatch[1];
-    } catch (err) {
-      const output = (err.stdout || '') + (err.stderr || '');
-      if (/Logged in to/i.test(output)) {
-        isAuthenticated = true;
-        details = output.trim();
-        const userMatch = output.match(/account ([^\s\(\)]+)/i);
-        if (userMatch) user = userMatch[1];
-      } else if (token) {
-        isAuthenticated = true;
-        user = 'token-authenticated';
-        details = 'Autenticado via GITHUB_TOKEN.';
-      } else {
-        isAuthenticated = false;
-        details = output.trim() || 'Usuário não autenticado no GitHub CLI.';
-      }
-    }
-
-    return {
-      installed: true,
-      authenticated: isAuthenticated,
-      isAuthenticated,
-      token: token || null,
-      user,
-      details
-    };
-  }, 10000); // 10s TTL
-}
-
-function getGitRepositoryUrl() {
-  if (process.env.GITHUB_REPOSITORY) {
-    return `https://github.com/${process.env.GITHUB_REPOSITORY}`;
-  }
-
-  try {
-    const rawRemote = execFileSync('git', ['config', '--get', 'remote.origin.url'], { encoding: 'utf8' }).trim();
-    if (rawRemote.startsWith('git@github.com:')) {
-      return `https://github.com/${rawRemote.replace('git@github.com:', '').replace(/\.git$/, '')}`;
-    } else if (rawRemote.startsWith('https://github.com/')) {
-      return rawRemote.replace(/\.git$/, '');
-    }
-  } catch (_) {}
-
-  return 'https://github.com/ContalApps/agent-master-devsecops';
-}
-
-function getGitMetadata(options = {}) {
-  const { globalStateCache } = require('./hot_state_cache.js');
-  if (options && options.forceFresh) {
-    globalStateCache.invalidate('git_metadata');
-  }
-
-  return globalStateCache.wrap('git_metadata', () => {
-    let sha = '';
-    let branch = '';
-    let message = '';
-
-    try {
-      sha = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
-      branch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { encoding: 'utf8' }).trim();
-      message = execFileSync('git', ['log', '-1', '--format=%s', sha], { encoding: 'utf8' }).trim();
-    } catch (_) {}
-
-    return {
-      sha,
-      branch,
-      message,
-      repoUrl: getGitRepositoryUrl()
-    };
-  }, 5000); // 5s TTL
-}
-
-async function requestAtlassian(credentials, method, endpointPath, bodyData = null) {
-  return new Promise((resolve, reject) => {
-    const postData = bodyData ? JSON.stringify(bodyData) : null;
-    const req = https.request({
-      hostname: credentials.domain,
-      path: endpointPath,
-      method,
-      headers: {
-        'Authorization': `Basic ${credentials.auth || credentials.authBase64}`,
-        'Content-Type': 'application/json',
-        'Accept': 'application/json',
-        ...(postData ? { 'Content-Length': Buffer.byteLength(postData) } : {})
-      }
-    }, res => {
-      let data = '';
-      res.on('data', chunk => { data += chunk; });
-      res.on('end', () => {
-        try {
-          resolve({ status: res.statusCode, body: data ? JSON.parse(data) : {} });
-        } catch (_) {
-          resolve({ status: res.statusCode, body: data });
-        }
-      });
-    });
-
-    req.on('error', reject);
-    if (postData) req.write(postData);
-    req.end();
-  });
-}
-
-module.exports = {
-  sanitizeDomain,
-  getAtlassianCredentials,
-  checkGithubAuth,
-  getGitRepositoryUrl,
-  getGitMetadata,
-  requestAtlassian
-};

package/scripts/atlassian_sync_action.js

@@ -1,269 +0,0 @@
-#!/usr/bin/env node
-/**
- * scripts/atlassian_sync_action.js
- * 
- * Sincronizador Automático Git ↔ Atlassian via Actions & Local (AGDEV-23 / AGDEV-35).
- * Conecta automaticamente commits, branches e Pull Requests aos cards do Jira
- * utilizando a API oficial de Remote Links do Jira Cloud (REST API v3).
- * 
- * Blindado pela Regra 15: Imutabilidade de Requisitos & Zero Falhas Silenciosas.
- */
-
-const { execFileSync } = require('child_process');
-const path = require('path');
-const {
-  getAtlassianConfig,
-  getGitMetadata,
-  getGitRepositoryUrl,
-  validateRule15
-} = require('./credentials_guard');
-
-function getAuth() {
-  const cfg = getAtlassianConfig();
-  return cfg.authBase64;
-}
-
-function extractIssueKeys(text) {
-  if (!text) return [];
-  const matches = text.match(/\b[A-Z]{2,10}-\d+\b/g) || [];
-  return [...new Set(matches.map(k => k.toUpperCase()))];
-}
-
-function extractPrNumber(text) {
-  if (!text) return null;
-  const match = text.match(/#(\d+)\b/) || text.match(/pull request #(\d+)/i);
-  return match ? match[1] : null;
-}
-
-function formatRemoteLinkPayload(url, title, type = 'commit', globalId = null, summary = null) {
-  let iconUrl = 'https://github.githubassets.com/favicons/favicon.png';
-  let relationship = 'causes';
-
-  if (type === 'pr') {
-    relationship = 'relates to';
-  } else if (type === 'branch') {
-    relationship = 'builds';
-  }
-
-  const payload = {
-    relationship,
-    object: {
-      url,
-      title,
-      icon: {
-        url16x16: iconUrl,
-        title: `GitHub ${type.toUpperCase()}`
-      }
-    }
-  };
-
-  if (globalId) {
-    payload.globalId = globalId;
-  }
-  if (summary) {
-    payload.object.summary = summary;
-  }
-
-  return payload;
-}
-
-async function linkUrlToJira(issueKey, url, title, type = 'commit', authOverride = null, globalId = null, summary = null) {
-  const atlassian = getAtlassianConfig();
-  const auth = authOverride || atlassian.authBase64;
-  if (!auth) {
-    return { status: 'FAILED', message: 'Credenciais Atlassian não configuradas no ambiente (Regra 15).' };
-  }
-
-  const cleanDomain = atlassian.domain;
-  if (!cleanDomain) {
-    return { status: 'FAILED', message: 'Domínio Atlassian não configurado para este projeto (Regra 15).' };
-  }
-  const payload = formatRemoteLinkPayload(url, title, type, globalId, summary);
-  const endpoint = `https://${cleanDomain}/rest/api/3/issue/${issueKey}/remotelink`;
-
-  try {
-    const res = await fetch(endpoint, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Basic ${auth}`,
-        'Content-Type': 'application/json',
-        'Accept': 'application/json'
-      },
-      body: JSON.stringify(payload)
-    });
-
-    if (res.ok || res.status === 201 || res.status === 200) {
-      return { status: 'SUCCESS', issueKey, url, type, httpStatus: res.status };
-    } else {
-      const errText = await res.text();
-      return { status: 'FAILED', issueKey, error: `HTTP ${res.status}: ${errText}` };
-    }
-  } catch (err) {
-    return { status: 'ERROR', issueKey, error: err.message };
-  }
-}
-
-async function backfillHistory(limit = 30) {
-  console.log(`[Atlassian Sync] Iniciando sincronização retroativa dos últimos ${limit} commits...`);
-  const atlassian = getAtlassianConfig();
-  if (!atlassian.isConfigured) {
-    throw new Error('Credenciais Atlassian ausentes para sincronização retroativa.');
-  }
-
-  const repoUrl = getGitRepositoryUrl();
-  const repoSlug = repoUrl.replace('https://github.com/', '');
-
-  let rawLog = '';
-  try {
-    rawLog = execFileSync('git', ['log', `-${limit}`, '--format=%H|%s'], { encoding: 'utf8' });
-  } catch (err) {
-    console.error('[Atlassian Sync] Falha ao extrair histórico git:', err.message);
-    return;
-  }
-
-  const lines = rawLog.split('\n').filter(l => l.trim().length > 0);
-  const results = [];
-
-  for (const line of lines) {
-    const [sha, ...subjectParts] = line.split('|');
-    const subject = subjectParts.join('|');
-    const keys = extractIssueKeys(subject);
-    const prNumber = extractPrNumber(subject);
-
-    for (const key of keys) {
-      // 1. Link Commit
-      const commitGlobalId = `system=github&repo=${repoSlug}&type=commit&sha=${sha}`;
-      const commitRes = await linkUrlToJira(
-        key,
-        `${repoUrl}/commit/${sha}`,
-        `GitHub Commit: ${sha.slice(0, 7)} (${subject})`,
-        'commit',
-        atlassian.authBase64,
-        commitGlobalId
-      );
-      results.push({ key, type: 'commit', ref: sha.slice(0, 7), status: commitRes.status });
-
-      // 2. Link PR if present in commit title
-      if (prNumber) {
-        const prGlobalId = `system=github&repo=${repoSlug}&type=pr&id=${prNumber}`;
-        const prRes = await linkUrlToJira(
-          key,
-          `${repoUrl}/pull/${prNumber}`,
-          `GitHub Pull Request #${prNumber}`,
-          'pr',
-          atlassian.authBase64,
-          prGlobalId,
-          subject
-        );
-        results.push({ key, type: 'pr', ref: `#${prNumber}`, status: prRes.status });
-      }
-    }
-  }
-
-  const successCount = results.filter(r => r.status === 'SUCCESS').length;
-  console.log(`[Atlassian Sync] Sincronização retroativa concluída: ${successCount}/${results.length} links processados com sucesso.`);
-  return results;
-}
-
-async function runCli() {
-  const isCI = process.env.GITHUB_ACTIONS === 'true';
-
-  // Validação Compulsória de Requisitos (Regra 15)
-  // Em CI, a ausência de secrets agora é ERRO CRÍTICO para impedir perda silenciosa
-  const validation = validateRule15({ failFast: isCI, requireGitHub: false, requireAtlassian: true });
-  if (!validation.valid) {
-    console.error(`[Atlassian Sync] Falha de validação da Regra 15:\n  ${validation.missing.join(', ')}`);
-    console.error(`  Remediação: ${validation.remediation.join('\n  ')}`);
-    if (isCI) {
-      process.exit(1);
-    }
-    return;
-  }
-
-  const args = process.argv.slice(2);
-  if (args.includes('--retroactive') || args.includes('-r')) {
-    const limitIdx = args.findIndex(a => a === '--retroactive' || a === '-r');
-    const limitVal = parseInt(args[limitIdx + 1], 10) || 30;
-    await backfillHistory(limitVal);
-    return;
-  }
-
-  const atlassian = getAtlassianConfig();
-  const gitMeta = getGitMetadata();
-  const repoUrl = gitMeta.repoUrl;
-  const repoSlug = repoUrl.replace('https://github.com/', '');
-
-  const sha = gitMeta.sha;
-  const branch = gitMeta.branch;
-  const message = gitMeta.message;
-  const prNumber = process.env.PR_NUMBER || extractPrNumber(process.env.PR_TITLE || '') || extractPrNumber(message);
-
-  const combined = `${branch} ${message} ${process.env.PR_TITLE || ''}`;
-  const keys = extractIssueKeys(combined);
-
-  if (keys.length === 0) {
-    console.log('[Atlassian Sync] Nenhuma chave Jira encontrada na branch ou mensagem de commit.');
-    return;
-  }
-
-  console.log(`[Atlassian Sync] Chaves Jira identificadas: ${keys.join(', ')}`);
-
-  for (const key of keys) {
-    if (sha && repoUrl) {
-      const commitGlobalId = `system=github&repo=${repoSlug}&type=commit&sha=${sha}`;
-      const commitRes = await linkUrlToJira(
-        key,
-        `${repoUrl}/commit/${sha}`,
-        `GitHub Commit: ${sha.slice(0, 7)} (${message})`,
-        'commit',
-        atlassian.authBase64,
-        commitGlobalId
-      );
-      console.log(`[Atlassian Sync] Commit ${sha.slice(0, 7)} vinculado a ${key}: ${commitRes.status}`);
-    }
-
-    if (branch && branch !== 'main' && branch !== 'HEAD' && repoUrl) {
-      const branchGlobalId = `system=github&repo=${repoSlug}&type=branch&name=${branch}`;
-      const branchRes = await linkUrlToJira(
-        key,
-        `${repoUrl}/tree/${branch}`,
-        `GitHub Branch: ${branch}`,
-        'branch',
-        atlassian.authBase64,
-        branchGlobalId
-      );
-      console.log(`[Atlassian Sync] Branch ${branch} vinculada a ${key}: ${branchRes.status}`);
-    }
-
-    if (prNumber && repoUrl) {
-      const prGlobalId = `system=github&repo=${repoSlug}&type=pr&id=${prNumber}`;
-      const prRes = await linkUrlToJira(
-        key,
-        `${repoUrl}/pull/${prNumber}`,
-        `GitHub Pull Request #${prNumber}`,
-        'pr',
-        atlassian.authBase64,
-        prGlobalId,
-        process.env.PR_TITLE || message
-      );
-      console.log(`[Atlassian Sync] PR #${prNumber} vinculado a ${key}: ${prRes.status}`);
-    }
-  }
-}
-
-if (require.main === module) {
-  runCli().catch(err => {
-    console.error('[Atlassian Sync] Erro fatal na execução:', err);
-    process.exit(1);
-  });
-}
-
-module.exports = {
-  getAuth,
-  extractIssueKeys,
-  extractPrNumber,
-  formatRemoteLinkPayload,
-  linkUrlToJira,
-  backfillHistory,
-  runCli
-};

package/scripts/code_quality_auditor.js

@@ -1,142 +0,0 @@
-/**
- * Code Quality & Cyclomatic Complexity Auditor
- * Auditoria independente de qualidade de software, complexidade ciclomática,
- * profundidade de aninhamento e detecção de anti-patterns de código.
- * Em conformidade com a Regra 13 (Estrutura de Código) e Matriz de Severidade.
- */
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-class CodeQualityAuditor {
-  constructor(options = {}) {
-    this.maxComplexity = options.maxComplexity || 15;
-    this.maxNesting = options.maxNesting || 4;
-    this.maxFileLines = options.maxFileLines || 300;
-  }
-
-  auditCode(code, filename = 'snippet.js') {
-    const lines = code.split('\n');
-    const totalLines = lines.length;
-    let commentLines = 0;
-    let blankLines = 0;
-    let maxNestingObserved = 0;
-    let currentNesting = 0;
-    const issues = [];
-
-    // Contadores de decisão para complexidade ciclomática
-    let complexityScore = 1;
-    const decisionPatterns = [
-      /\bif\s*\(/g,
-      /\belse\s+if\s*\(/g,
-      /\bfor\s*\(/g,
-      /\bwhile\s*\(/g,
-      /\bcatch\s*\(/g,
-      /\bcase\s+[^:]+:/g,
-      /&&/g,
-      /\|\|/g,
-      /\?[^:]+:/g
-    ];
-
-    lines.forEach((line, index) => {
-      const lineNum = index + 1;
-      const trimmed = line.trim();
-
-      if (!trimmed) {
-        blankLines++;
-        return;
-      }
-
-      if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
-        commentLines++;
-        return;
-      }
-
-      // Análise de aninhamento de chaves
-      for (const char of trimmed) {
-        if (char === '{') currentNesting++;
-        if (char === '}') currentNesting = Math.max(0, currentNesting - 1);
-        if (currentNesting > maxNestingObserved) {
-          maxNestingObserved = currentNesting;
-        }
-      }
-
-      // Contagem de complexidade ciclomática
-      for (const pattern of decisionPatterns) {
-        const matches = trimmed.match(pattern);
-        if (matches) {
-          complexityScore += matches.length;
-        }
-      }
-
-      // Detecção de empty catch block (anti-pattern de engolir exceções)
-      if (/catch\s*\([^\)]*\)\s*\{\s*\}/.test(trimmed)) {
-        issues.push({
-          type: 'EMPTY_CATCH',
-          line: lineNum,
-          severity: 'HIGH',
-          message: 'Bloco catch vazio detectado: erros não devem ser suprimidos silenciosamente (Regra 5).'
-        });
-      }
-
-      // Detecção de comentários TODO ou código comentado
-      if (/\b(?:TODO|FIXME|HACK)\b/i.test(trimmed)) {
-        issues.push({
-          type: 'PENDING_TODO',
-          line: lineNum,
-          severity: 'LOW',
-          message: `Marcação pendente detectada: "${trimmed}". Código pronto não deve deixar TODOs (Regra 7).`
-        });
-      }
-    });
-
-    // Verificação de limites
-    if (totalLines > this.maxFileLines) {
-      issues.push({
-        type: 'FILE_TOO_LONG',
-        line: totalLines,
-        severity: 'MEDIUM',
-        message: `Arquivo possui ${totalLines} linhas (limite canônico recomendado: ${this.maxFileLines} linhas - Regra 13).`
-      });
-    }
-
-    if (maxNestingObserved > this.maxNesting) {
-      issues.push({
-        type: 'DEEP_NESTING',
-        line: 1,
-        severity: 'MEDIUM',
-        message: `Nível máximo de aninhamento (${maxNestingObserved}) excede o limiar tolerado (${this.maxNesting}).`
-      });
-    }
-
-    if (complexityScore > this.maxComplexity) {
-      issues.push({
-        type: 'HIGH_CYCLOMATIC_COMPLEXITY',
-        line: 1,
-        severity: 'MEDIUM',
-        message: `Complexidade ciclomática (${complexityScore}) excede o limite aceitável de ${this.maxComplexity}.`
-      });
-    }
-
-    const isClean = issues.filter(i => i.severity === 'HIGH' || i.severity === 'CRITICAL').length === 0;
-
-    return {
-      filename,
-      status: isClean ? (issues.length === 0 ? 'OPTIMAL' : 'ACCEPTABLE_WITH_NOTES') : 'REFACTOR_REQUIRED',
-      metrics: {
-        totalLines,
-        codeLines: totalLines - commentLines - blankLines,
-        commentLines,
-        blankLines,
-        cyclomaticComplexity: complexityScore,
-        maxNestingDepth: maxNestingObserved
-      },
-      qualityScore: Math.max(0, 100 - (issues.length * 10) - (complexityScore > this.maxComplexity ? 15 : 0)),
-      issues
-    };
-  }
-}
-
-module.exports = {
-  CodeQualityAuditor
-};