circle-ir-ai 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +105 -0
- package/LICENSE +15 -0
- package/README.md +336 -0
- package/dist/action-queue/aggregator.d.ts +40 -0
- package/dist/action-queue/aggregator.d.ts.map +1 -0
- package/dist/action-queue/aggregator.js +375 -0
- package/dist/action-queue/aggregator.js.map +1 -0
- package/dist/action-queue/index.d.ts +14 -0
- package/dist/action-queue/index.d.ts.map +1 -0
- package/dist/action-queue/index.js +17 -0
- package/dist/action-queue/index.js.map +1 -0
- package/dist/action-queue/queue.d.ts +74 -0
- package/dist/action-queue/queue.d.ts.map +1 -0
- package/dist/action-queue/queue.js +433 -0
- package/dist/action-queue/queue.js.map +1 -0
- package/dist/action-queue/types.d.ts +162 -0
- package/dist/action-queue/types.d.ts.map +1 -0
- package/dist/action-queue/types.js +44 -0
- package/dist/action-queue/types.js.map +1 -0
- package/dist/agents/enrichment-agent.d.ts +16 -0
- package/dist/agents/enrichment-agent.d.ts.map +1 -0
- package/dist/agents/enrichment-agent.js +102 -0
- package/dist/agents/enrichment-agent.js.map +1 -0
- package/dist/agents/index.d.ts +12 -0
- package/dist/agents/index.d.ts.map +1 -0
- package/dist/agents/index.js +15 -0
- package/dist/agents/index.js.map +1 -0
- package/dist/agents/mastra/agents.d.ts +373 -0
- package/dist/agents/mastra/agents.d.ts.map +1 -0
- package/dist/agents/mastra/agents.js +347 -0
- package/dist/agents/mastra/agents.js.map +1 -0
- package/dist/agents/mastra/index.d.ts +12 -0
- package/dist/agents/mastra/index.d.ts.map +1 -0
- package/dist/agents/mastra/index.js +17 -0
- package/dist/agents/mastra/index.js.map +1 -0
- package/dist/agents/mastra/instance.d.ts +383 -0
- package/dist/agents/mastra/instance.d.ts.map +1 -0
- package/dist/agents/mastra/instance.js +37 -0
- package/dist/agents/mastra/instance.js.map +1 -0
- package/dist/agents/mastra/steps.d.ts +300 -0
- package/dist/agents/mastra/steps.d.ts.map +1 -0
- package/dist/agents/mastra/steps.js +468 -0
- package/dist/agents/mastra/steps.js.map +1 -0
- package/dist/agents/mastra/swarm.d.ts +106 -0
- package/dist/agents/mastra/swarm.d.ts.map +1 -0
- package/dist/agents/mastra/swarm.js +501 -0
- package/dist/agents/mastra/swarm.js.map +1 -0
- package/dist/agents/mastra/workflow.d.ts +81 -0
- package/dist/agents/mastra/workflow.d.ts.map +1 -0
- package/dist/agents/mastra/workflow.js +460 -0
- package/dist/agents/mastra/workflow.js.map +1 -0
- package/dist/agents/multi/agents/security.d.ts +29 -0
- package/dist/agents/multi/agents/security.d.ts.map +1 -0
- package/dist/agents/multi/agents/security.js +830 -0
- package/dist/agents/multi/agents/security.js.map +1 -0
- package/dist/agents/multi/extractor.d.ts +21 -0
- package/dist/agents/multi/extractor.d.ts.map +1 -0
- package/dist/agents/multi/extractor.js +483 -0
- package/dist/agents/multi/extractor.js.map +1 -0
- package/dist/agents/multi/index.d.ts +32 -0
- package/dist/agents/multi/index.d.ts.map +1 -0
- package/dist/agents/multi/index.js +34 -0
- package/dist/agents/multi/index.js.map +1 -0
- package/dist/agents/multi/runner.d.ts +79 -0
- package/dist/agents/multi/runner.d.ts.map +1 -0
- package/dist/agents/multi/runner.js +323 -0
- package/dist/agents/multi/runner.js.map +1 -0
- package/dist/agents/security-agent.d.ts +16 -0
- package/dist/agents/security-agent.d.ts.map +1 -0
- package/dist/agents/security-agent.js +299 -0
- package/dist/agents/security-agent.js.map +1 -0
- package/dist/agents/types.d.ts +373 -0
- package/dist/agents/types.d.ts.map +1 -0
- package/dist/agents/types.js +14 -0
- package/dist/agents/types.js.map +1 -0
- package/dist/agents/verification-agent.d.ts +23 -0
- package/dist/agents/verification-agent.d.ts.map +1 -0
- package/dist/agents/verification-agent.js +217 -0
- package/dist/agents/verification-agent.js.map +1 -0
- package/dist/agents/workflow.d.ts +30 -0
- package/dist/agents/workflow.d.ts.map +1 -0
- package/dist/agents/workflow.js +79 -0
- package/dist/agents/workflow.js.map +1 -0
- package/dist/analysis/enriched.d.ts +16 -0
- package/dist/analysis/enriched.d.ts.map +1 -0
- package/dist/analysis/enriched.js +297 -0
- package/dist/analysis/enriched.js.map +1 -0
- package/dist/analysis/llm-correlated-predicates.d.ts +80 -0
- package/dist/analysis/llm-correlated-predicates.d.ts.map +1 -0
- package/dist/analysis/llm-correlated-predicates.js +255 -0
- package/dist/analysis/llm-correlated-predicates.js.map +1 -0
- package/dist/analysis/llm-cross-file-taint.d.ts +86 -0
- package/dist/analysis/llm-cross-file-taint.d.ts.map +1 -0
- package/dist/analysis/llm-cross-file-taint.js +264 -0
- package/dist/analysis/llm-cross-file-taint.js.map +1 -0
- package/dist/analysis/pattern-discovery.d.ts +79 -0
- package/dist/analysis/pattern-discovery.d.ts.map +1 -0
- package/dist/analysis/pattern-discovery.js +447 -0
- package/dist/analysis/pattern-discovery.js.map +1 -0
- package/dist/cache/file-cache.d.ts +89 -0
- package/dist/cache/file-cache.d.ts.map +1 -0
- package/dist/cache/file-cache.js +208 -0
- package/dist/cache/file-cache.js.map +1 -0
- package/dist/cache/index.d.ts +6 -0
- package/dist/cache/index.d.ts.map +1 -0
- package/dist/cache/index.js +5 -0
- package/dist/cache/index.js.map +1 -0
- package/dist/cli/args.d.ts +52 -0
- package/dist/cli/args.d.ts.map +1 -0
- package/dist/cli/args.js +422 -0
- package/dist/cli/args.js.map +1 -0
- package/dist/cli/colors.d.ts +31 -0
- package/dist/cli/colors.d.ts.map +1 -0
- package/dist/cli/colors.js +80 -0
- package/dist/cli/colors.js.map +1 -0
- package/dist/cli/commands/analyze-skill.d.ts +33 -0
- package/dist/cli/commands/analyze-skill.d.ts.map +1 -0
- package/dist/cli/commands/analyze-skill.js +217 -0
- package/dist/cli/commands/analyze-skill.js.map +1 -0
- package/dist/cli/commands/analyze.d.ts +18 -0
- package/dist/cli/commands/analyze.d.ts.map +1 -0
- package/dist/cli/commands/analyze.js +30 -0
- package/dist/cli/commands/analyze.js.map +1 -0
- package/dist/cli/commands/benchmark-runner.d.ts +42 -0
- package/dist/cli/commands/benchmark-runner.d.ts.map +1 -0
- package/dist/cli/commands/benchmark-runner.js +18 -0
- package/dist/cli/commands/benchmark-runner.js.map +1 -0
- package/dist/cli/commands/benchmark.d.ts +11 -0
- package/dist/cli/commands/benchmark.d.ts.map +1 -0
- package/dist/cli/commands/benchmark.js +90 -0
- package/dist/cli/commands/benchmark.js.map +1 -0
- package/dist/cli/commands/dead-code.d.ts +11 -0
- package/dist/cli/commands/dead-code.d.ts.map +1 -0
- package/dist/cli/commands/dead-code.js +65 -0
- package/dist/cli/commands/dead-code.js.map +1 -0
- package/dist/cli/commands/generate-spec.d.ts +11 -0
- package/dist/cli/commands/generate-spec.d.ts.map +1 -0
- package/dist/cli/commands/generate-spec.js +67 -0
- package/dist/cli/commands/generate-spec.js.map +1 -0
- package/dist/cli/commands/health.d.ts +11 -0
- package/dist/cli/commands/health.d.ts.map +1 -0
- package/dist/cli/commands/health.js +67 -0
- package/dist/cli/commands/health.js.map +1 -0
- package/dist/cli/commands/project.d.ts +21 -0
- package/dist/cli/commands/project.d.ts.map +1 -0
- package/dist/cli/commands/project.js +92 -0
- package/dist/cli/commands/project.js.map +1 -0
- package/dist/cli/commands/scan.d.ts +11 -0
- package/dist/cli/commands/scan.d.ts.map +1 -0
- package/dist/cli/commands/scan.js +68 -0
- package/dist/cli/commands/scan.js.map +1 -0
- package/dist/cli/commands/secrets.d.ts +11 -0
- package/dist/cli/commands/secrets.d.ts.map +1 -0
- package/dist/cli/commands/secrets.js +71 -0
- package/dist/cli/commands/secrets.js.map +1 -0
- package/dist/cli/commands/swarm.d.ts +20 -0
- package/dist/cli/commands/swarm.d.ts.map +1 -0
- package/dist/cli/commands/swarm.js +174 -0
- package/dist/cli/commands/swarm.js.map +1 -0
- package/dist/cli/config.d.ts +103 -0
- package/dist/cli/config.d.ts.map +1 -0
- package/dist/cli/config.js +307 -0
- package/dist/cli/config.js.map +1 -0
- package/dist/cli/discovery.d.ts +31 -0
- package/dist/cli/discovery.d.ts.map +1 -0
- package/dist/cli/discovery.js +212 -0
- package/dist/cli/discovery.js.map +1 -0
- package/dist/cli/formatters/index.d.ts +15 -0
- package/dist/cli/formatters/index.d.ts.map +1 -0
- package/dist/cli/formatters/index.js +51 -0
- package/dist/cli/formatters/index.js.map +1 -0
- package/dist/cli/formatters/json.d.ts +11 -0
- package/dist/cli/formatters/json.d.ts.map +1 -0
- package/dist/cli/formatters/json.js +12 -0
- package/dist/cli/formatters/json.js.map +1 -0
- package/dist/cli/formatters/project-json.d.ts +11 -0
- package/dist/cli/formatters/project-json.d.ts.map +1 -0
- package/dist/cli/formatters/project-json.js +12 -0
- package/dist/cli/formatters/project-json.js.map +1 -0
- package/dist/cli/formatters/project-sarif.d.ts +11 -0
- package/dist/cli/formatters/project-sarif.d.ts.map +1 -0
- package/dist/cli/formatters/project-sarif.js +127 -0
- package/dist/cli/formatters/project-sarif.js.map +1 -0
- package/dist/cli/formatters/project-summary.d.ts +11 -0
- package/dist/cli/formatters/project-summary.d.ts.map +1 -0
- package/dist/cli/formatters/project-summary.js +202 -0
- package/dist/cli/formatters/project-summary.js.map +1 -0
- package/dist/cli/formatters/sarif-shared.d.ts +101 -0
- package/dist/cli/formatters/sarif-shared.d.ts.map +1 -0
- package/dist/cli/formatters/sarif-shared.js +57 -0
- package/dist/cli/formatters/sarif-shared.js.map +1 -0
- package/dist/cli/formatters/sarif.d.ts +12 -0
- package/dist/cli/formatters/sarif.d.ts.map +1 -0
- package/dist/cli/formatters/sarif.js +92 -0
- package/dist/cli/formatters/sarif.js.map +1 -0
- package/dist/cli/formatters/summary.d.ts +11 -0
- package/dist/cli/formatters/summary.d.ts.map +1 -0
- package/dist/cli/formatters/summary.js +240 -0
- package/dist/cli/formatters/summary.js.map +1 -0
- package/dist/cli/formatters/two-phase-summary.d.ts +11 -0
- package/dist/cli/formatters/two-phase-summary.d.ts.map +1 -0
- package/dist/cli/formatters/two-phase-summary.js +188 -0
- package/dist/cli/formatters/two-phase-summary.js.map +1 -0
- package/dist/cli/index.d.ts +15 -0
- package/dist/cli/index.d.ts.map +1 -0
- package/dist/cli/index.js +555 -0
- package/dist/cli/index.js.map +1 -0
- package/dist/components/clustering.d.ts +60 -0
- package/dist/components/clustering.d.ts.map +1 -0
- package/dist/components/clustering.js +129 -0
- package/dist/components/clustering.js.map +1 -0
- package/dist/components/enrichment.d.ts +45 -0
- package/dist/components/enrichment.d.ts.map +1 -0
- package/dist/components/enrichment.js +193 -0
- package/dist/components/enrichment.js.map +1 -0
- package/dist/components/index.d.ts +29 -0
- package/dist/components/index.d.ts.map +1 -0
- package/dist/components/index.js +56 -0
- package/dist/components/index.js.map +1 -0
- package/dist/dead-code/detector.d.ts +200 -0
- package/dist/dead-code/detector.d.ts.map +1 -0
- package/dist/dead-code/detector.js +1003 -0
- package/dist/dead-code/detector.js.map +1 -0
- package/dist/dead-code/index.d.ts +7 -0
- package/dist/dead-code/index.d.ts.map +1 -0
- package/dist/dead-code/index.js +7 -0
- package/dist/dead-code/index.js.map +1 -0
- package/dist/extractors/index.d.ts +15 -0
- package/dist/extractors/index.d.ts.map +1 -0
- package/dist/extractors/index.js +14 -0
- package/dist/extractors/index.js.map +1 -0
- package/dist/extractors/natural-language.d.ts +46 -0
- package/dist/extractors/natural-language.d.ts.map +1 -0
- package/dist/extractors/natural-language.js +228 -0
- package/dist/extractors/natural-language.js.map +1 -0
- package/dist/extractors/tree-sitter.d.ts +33 -0
- package/dist/extractors/tree-sitter.d.ts.map +1 -0
- package/dist/extractors/tree-sitter.js +69 -0
- package/dist/extractors/tree-sitter.js.map +1 -0
- package/dist/extractors/types.d.ts +62 -0
- package/dist/extractors/types.d.ts.map +1 -0
- package/dist/extractors/types.js +54 -0
- package/dist/extractors/types.js.map +1 -0
- package/dist/health-score/calculator.d.ts +123 -0
- package/dist/health-score/calculator.d.ts.map +1 -0
- package/dist/health-score/calculator.js +444 -0
- package/dist/health-score/calculator.js.map +1 -0
- package/dist/health-score/index.d.ts +12 -0
- package/dist/health-score/index.d.ts.map +1 -0
- package/dist/health-score/index.js +14 -0
- package/dist/health-score/index.js.map +1 -0
- package/dist/health-score/metrics.d.ts +142 -0
- package/dist/health-score/metrics.d.ts.map +1 -0
- package/dist/health-score/metrics.js +332 -0
- package/dist/health-score/metrics.js.map +1 -0
- package/dist/index.d.ts +26 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +43 -0
- package/dist/index.js.map +1 -0
- package/dist/llm/ax-client.d.ts +477 -0
- package/dist/llm/ax-client.d.ts.map +1 -0
- package/dist/llm/ax-client.js +1641 -0
- package/dist/llm/ax-client.js.map +1 -0
- package/dist/llm/config.d.ts +58 -0
- package/dist/llm/config.d.ts.map +1 -0
- package/dist/llm/config.js +97 -0
- package/dist/llm/config.js.map +1 -0
- package/dist/llm/discovery.d.ts +123 -0
- package/dist/llm/discovery.d.ts.map +1 -0
- package/dist/llm/discovery.js +505 -0
- package/dist/llm/discovery.js.map +1 -0
- package/dist/llm/enrichment.d.ts +108 -0
- package/dist/llm/enrichment.d.ts.map +1 -0
- package/dist/llm/enrichment.js +312 -0
- package/dist/llm/enrichment.js.map +1 -0
- package/dist/llm/index.d.ts +13 -0
- package/dist/llm/index.d.ts.map +1 -0
- package/dist/llm/index.js +22 -0
- package/dist/llm/index.js.map +1 -0
- package/dist/llm/language-context.d.ts +64 -0
- package/dist/llm/language-context.d.ts.map +1 -0
- package/dist/llm/language-context.js +492 -0
- package/dist/llm/language-context.js.map +1 -0
- package/dist/llm/pattern-verification.d.ts +39 -0
- package/dist/llm/pattern-verification.d.ts.map +1 -0
- package/dist/llm/pattern-verification.js +127 -0
- package/dist/llm/pattern-verification.js.map +1 -0
- package/dist/llm/prompt-security.d.ts +120 -0
- package/dist/llm/prompt-security.d.ts.map +1 -0
- package/dist/llm/prompt-security.js +301 -0
- package/dist/llm/prompt-security.js.map +1 -0
- package/dist/llm/prompts/index.d.ts +31 -0
- package/dist/llm/prompts/index.d.ts.map +1 -0
- package/dist/llm/prompts/index.js +92 -0
- package/dist/llm/prompts/index.js.map +1 -0
- package/dist/llm/prompts/rust.d.ts +30 -0
- package/dist/llm/prompts/rust.d.ts.map +1 -0
- package/dist/llm/prompts/rust.js +121 -0
- package/dist/llm/prompts/rust.js.map +1 -0
- package/dist/llm/schemas.d.ts +892 -0
- package/dist/llm/schemas.d.ts.map +1 -0
- package/dist/llm/schemas.js +258 -0
- package/dist/llm/schemas.js.map +1 -0
- package/dist/llm/verification.d.ts +127 -0
- package/dist/llm/verification.d.ts.map +1 -0
- package/dist/llm/verification.js +394 -0
- package/dist/llm/verification.js.map +1 -0
- package/dist/project/analyzer.d.ts +30 -0
- package/dist/project/analyzer.d.ts.map +1 -0
- package/dist/project/analyzer.js +358 -0
- package/dist/project/analyzer.js.map +1 -0
- package/dist/project/call-graph.d.ts +22 -0
- package/dist/project/call-graph.d.ts.map +1 -0
- package/dist/project/call-graph.js +246 -0
- package/dist/project/call-graph.js.map +1 -0
- package/dist/project/index.d.ts +18 -0
- package/dist/project/index.d.ts.map +1 -0
- package/dist/project/index.js +20 -0
- package/dist/project/index.js.map +1 -0
- package/dist/project/taint-paths.d.ts +22 -0
- package/dist/project/taint-paths.d.ts.map +1 -0
- package/dist/project/taint-paths.js +265 -0
- package/dist/project/taint-paths.js.map +1 -0
- package/dist/project/two-phase-analyzer.d.ts +143 -0
- package/dist/project/two-phase-analyzer.d.ts.map +1 -0
- package/dist/project/two-phase-analyzer.js +646 -0
- package/dist/project/two-phase-analyzer.js.map +1 -0
- package/dist/project/type-hierarchy.d.ts +28 -0
- package/dist/project/type-hierarchy.d.ts.map +1 -0
- package/dist/project/type-hierarchy.js +218 -0
- package/dist/project/type-hierarchy.js.map +1 -0
- package/dist/secret-scan/index.d.ts +12 -0
- package/dist/secret-scan/index.d.ts.map +1 -0
- package/dist/secret-scan/index.js +14 -0
- package/dist/secret-scan/index.js.map +1 -0
- package/dist/secret-scan/patterns.d.ts +38 -0
- package/dist/secret-scan/patterns.d.ts.map +1 -0
- package/dist/secret-scan/patterns.js +473 -0
- package/dist/secret-scan/patterns.js.map +1 -0
- package/dist/secret-scan/scanner.d.ts +162 -0
- package/dist/secret-scan/scanner.d.ts.map +1 -0
- package/dist/secret-scan/scanner.js +511 -0
- package/dist/secret-scan/scanner.js.map +1 -0
- package/dist/security-scan/index.d.ts +12 -0
- package/dist/security-scan/index.d.ts.map +1 -0
- package/dist/security-scan/index.js +15 -0
- package/dist/security-scan/index.js.map +1 -0
- package/dist/security-scan/owasp-mapping.d.ts +29 -0
- package/dist/security-scan/owasp-mapping.d.ts.map +1 -0
- package/dist/security-scan/owasp-mapping.js +246 -0
- package/dist/security-scan/owasp-mapping.js.map +1 -0
- package/dist/security-scan/scanner.d.ts +204 -0
- package/dist/security-scan/scanner.d.ts.map +1 -0
- package/dist/security-scan/scanner.js +693 -0
- package/dist/security-scan/scanner.js.map +1 -0
- package/dist/security-scan/trend-tracker.d.ts +150 -0
- package/dist/security-scan/trend-tracker.d.ts.map +1 -0
- package/dist/security-scan/trend-tracker.js +299 -0
- package/dist/security-scan/trend-tracker.js.map +1 -0
- package/dist/skills/bundle-loader.d.ts +26 -0
- package/dist/skills/bundle-loader.d.ts.map +1 -0
- package/dist/skills/bundle-loader.js +284 -0
- package/dist/skills/bundle-loader.js.map +1 -0
- package/dist/skills/capability-mismatch.d.ts +21 -0
- package/dist/skills/capability-mismatch.d.ts.map +1 -0
- package/dist/skills/capability-mismatch.js +188 -0
- package/dist/skills/capability-mismatch.js.map +1 -0
- package/dist/skills/index.d.ts +10 -0
- package/dist/skills/index.d.ts.map +1 -0
- package/dist/skills/index.js +9 -0
- package/dist/skills/index.js.map +1 -0
- package/dist/skills/skill-analyzer.d.ts +16 -0
- package/dist/skills/skill-analyzer.d.ts.map +1 -0
- package/dist/skills/skill-analyzer.js +361 -0
- package/dist/skills/skill-analyzer.js.map +1 -0
- package/dist/skills/types.d.ts +195 -0
- package/dist/skills/types.d.ts.map +1 -0
- package/dist/skills/types.js +7 -0
- package/dist/skills/types.js.map +1 -0
- package/dist/specifica/conflict-resolver.d.ts +23 -0
- package/dist/specifica/conflict-resolver.d.ts.map +1 -0
- package/dist/specifica/conflict-resolver.js +129 -0
- package/dist/specifica/conflict-resolver.js.map +1 -0
- package/dist/specifica/evidence-aggregator.d.ts +33 -0
- package/dist/specifica/evidence-aggregator.d.ts.map +1 -0
- package/dist/specifica/evidence-aggregator.js +236 -0
- package/dist/specifica/evidence-aggregator.js.map +1 -0
- package/dist/specifica/evidence-extractor.d.ts +13 -0
- package/dist/specifica/evidence-extractor.d.ts.map +1 -0
- package/dist/specifica/evidence-extractor.js +431 -0
- package/dist/specifica/evidence-extractor.js.map +1 -0
- package/dist/specifica/feature-clustering.d.ts +19 -0
- package/dist/specifica/feature-clustering.d.ts.map +1 -0
- package/dist/specifica/feature-clustering.js +231 -0
- package/dist/specifica/feature-clustering.js.map +1 -0
- package/dist/specifica/generator.d.ts +16 -0
- package/dist/specifica/generator.d.ts.map +1 -0
- package/dist/specifica/generator.js +277 -0
- package/dist/specifica/generator.js.map +1 -0
- package/dist/specifica/index.d.ts +15 -0
- package/dist/specifica/index.d.ts.map +1 -0
- package/dist/specifica/index.js +18 -0
- package/dist/specifica/index.js.map +1 -0
- package/dist/specifica/prompts.d.ts +21 -0
- package/dist/specifica/prompts.d.ts.map +1 -0
- package/dist/specifica/prompts.js +196 -0
- package/dist/specifica/prompts.js.map +1 -0
- package/dist/specifica/spec-generator.d.ts +22 -0
- package/dist/specifica/spec-generator.d.ts.map +1 -0
- package/dist/specifica/spec-generator.js +229 -0
- package/dist/specifica/spec-generator.js.map +1 -0
- package/dist/specifica/types.d.ts +213 -0
- package/dist/specifica/types.d.ts.map +1 -0
- package/dist/specifica/types.js +7 -0
- package/dist/specifica/types.js.map +1 -0
- package/dist/utils/logger.d.ts +17 -0
- package/dist/utils/logger.d.ts.map +1 -0
- package/dist/utils/logger.js +51 -0
- package/dist/utils/logger.js.map +1 -0
- package/package.json +99 -0
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shared SARIF types and utilities
|
|
3
|
+
*
|
|
4
|
+
* Common interfaces and functions used by both sarif.ts and project-sarif.ts formatters.
|
|
5
|
+
*/
|
|
6
|
+
import { getRuleInfo as getCoreRuleInfo } from 'circle-ir';
|
|
7
|
+
/**
|
|
8
|
+
* Get rule information for a vulnerability type.
|
|
9
|
+
* Delegates to the central rules module for consistent definitions.
|
|
10
|
+
*/
|
|
11
|
+
export function getRuleInfo(type, _cwe) {
|
|
12
|
+
const coreRule = getCoreRuleInfo(type);
|
|
13
|
+
return {
|
|
14
|
+
name: coreRule.name,
|
|
15
|
+
shortDescription: coreRule.shortDescription,
|
|
16
|
+
fullDescription: coreRule.fullDescription,
|
|
17
|
+
remediation: coreRule.remediation,
|
|
18
|
+
severity: coreRule.cvssScore,
|
|
19
|
+
severityLevel: coreRule.severityLevel,
|
|
20
|
+
};
|
|
21
|
+
}
|
|
22
|
+
// ============================================================================
|
|
23
|
+
// Utility Functions
|
|
24
|
+
// ============================================================================
|
|
25
|
+
/**
|
|
26
|
+
* Convert severity level to SARIF level.
|
|
27
|
+
*/
|
|
28
|
+
export function getSarifLevel(severity) {
|
|
29
|
+
switch (severity) {
|
|
30
|
+
case 'critical':
|
|
31
|
+
case 'high':
|
|
32
|
+
return 'error';
|
|
33
|
+
case 'medium':
|
|
34
|
+
return 'warning';
|
|
35
|
+
case 'low':
|
|
36
|
+
return 'note';
|
|
37
|
+
default:
|
|
38
|
+
return 'warning';
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
/**
|
|
42
|
+
* SARIF schema URL.
|
|
43
|
+
*/
|
|
44
|
+
export const SARIF_SCHEMA = 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json';
|
|
45
|
+
/**
|
|
46
|
+
* SARIF version.
|
|
47
|
+
*/
|
|
48
|
+
export const SARIF_VERSION = '2.1.0';
|
|
49
|
+
/**
|
|
50
|
+
* Tool information.
|
|
51
|
+
*/
|
|
52
|
+
export const TOOL_INFO = {
|
|
53
|
+
name: 'circle-ir',
|
|
54
|
+
version: '1.0.0',
|
|
55
|
+
informationUri: 'https://github.com/anthropics/circle-ir',
|
|
56
|
+
};
|
|
57
|
+
//# sourceMappingURL=sarif-shared.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sarif-shared.js","sourceRoot":"","sources":["../../../src/cli/formatters/sarif-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,IAAI,eAAe,EAAiC,MAAM,WAAW,CAAC;AAiF1F;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,QAAQ,CAAC,SAAS;QAC5B,aAAa,EAAE,QAAQ,CAAC,aAAa;KACtC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,gGAAgG,CAAC;AAE7H;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;IAChB,cAAc,EAAE,yCAAyC;CAC1D,CAAC"}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SARIF Formatter
|
|
3
|
+
*
|
|
4
|
+
* Outputs analysis results in SARIF (Static Analysis Results Interchange Format).
|
|
5
|
+
* https://sarifweb.azurewebsites.net/
|
|
6
|
+
*/
|
|
7
|
+
import type { CircleIR } from 'circle-ir';
|
|
8
|
+
/**
|
|
9
|
+
* Format result as SARIF.
|
|
10
|
+
*/
|
|
11
|
+
export declare function formatSarif(result: CircleIR, filePath: string): string;
|
|
12
|
+
//# sourceMappingURL=sarif.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../../src/cli/formatters/sarif.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAa,MAAM,WAAW,CAAC;AAYrD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAqBtE"}
|
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SARIF Formatter
|
|
3
|
+
*
|
|
4
|
+
* Outputs analysis results in SARIF (Static Analysis Results Interchange Format).
|
|
5
|
+
* https://sarifweb.azurewebsites.net/
|
|
6
|
+
*/
|
|
7
|
+
import { getRuleInfo, getSarifLevel, SARIF_SCHEMA, SARIF_VERSION, TOOL_INFO, } from './sarif-shared.js';
|
|
8
|
+
/**
|
|
9
|
+
* Format result as SARIF.
|
|
10
|
+
*/
|
|
11
|
+
export function formatSarif(result, filePath) {
|
|
12
|
+
const rules = buildRules(result.taint.sinks);
|
|
13
|
+
const results = buildResults(result, filePath);
|
|
14
|
+
const sarif = {
|
|
15
|
+
$schema: SARIF_SCHEMA,
|
|
16
|
+
version: SARIF_VERSION,
|
|
17
|
+
runs: [
|
|
18
|
+
{
|
|
19
|
+
tool: {
|
|
20
|
+
driver: {
|
|
21
|
+
...TOOL_INFO,
|
|
22
|
+
rules,
|
|
23
|
+
},
|
|
24
|
+
},
|
|
25
|
+
results,
|
|
26
|
+
},
|
|
27
|
+
],
|
|
28
|
+
};
|
|
29
|
+
return JSON.stringify(sarif, null, 2);
|
|
30
|
+
}
|
|
31
|
+
/**
|
|
32
|
+
* Build SARIF rules from detected sink types.
|
|
33
|
+
*/
|
|
34
|
+
function buildRules(sinks) {
|
|
35
|
+
const ruleMap = new Map();
|
|
36
|
+
for (const sink of sinks) {
|
|
37
|
+
if (!ruleMap.has(sink.type)) {
|
|
38
|
+
ruleMap.set(sink.type, buildRule(sink));
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
return Array.from(ruleMap.values());
|
|
42
|
+
}
|
|
43
|
+
/**
|
|
44
|
+
* Build a SARIF rule from a sink type.
|
|
45
|
+
*/
|
|
46
|
+
function buildRule(sink) {
|
|
47
|
+
const ruleInfo = getRuleInfo(sink.type, sink.cwe);
|
|
48
|
+
return {
|
|
49
|
+
id: sink.cwe,
|
|
50
|
+
name: ruleInfo.name,
|
|
51
|
+
shortDescription: { text: ruleInfo.shortDescription },
|
|
52
|
+
fullDescription: { text: ruleInfo.fullDescription },
|
|
53
|
+
help: { text: ruleInfo.remediation },
|
|
54
|
+
properties: {
|
|
55
|
+
tags: ['security', sink.type],
|
|
56
|
+
security_severity: ruleInfo.severity,
|
|
57
|
+
},
|
|
58
|
+
};
|
|
59
|
+
}
|
|
60
|
+
/**
|
|
61
|
+
* Build SARIF results from analysis.
|
|
62
|
+
*/
|
|
63
|
+
function buildResults(result, filePath) {
|
|
64
|
+
const results = [];
|
|
65
|
+
// If we have sources and sinks, report potential vulnerabilities
|
|
66
|
+
if (result.taint.sources.length > 0) {
|
|
67
|
+
for (const sink of result.taint.sinks) {
|
|
68
|
+
const ruleInfo = getRuleInfo(sink.type, sink.cwe);
|
|
69
|
+
results.push({
|
|
70
|
+
ruleId: sink.cwe,
|
|
71
|
+
level: getSarifLevel(ruleInfo.severityLevel),
|
|
72
|
+
message: {
|
|
73
|
+
text: `Potential ${ruleInfo.name}: ${sink.location}. User-controlled data may reach this sink.`,
|
|
74
|
+
},
|
|
75
|
+
locations: [
|
|
76
|
+
{
|
|
77
|
+
physicalLocation: {
|
|
78
|
+
artifactLocation: {
|
|
79
|
+
uri: filePath,
|
|
80
|
+
},
|
|
81
|
+
region: {
|
|
82
|
+
startLine: sink.line,
|
|
83
|
+
},
|
|
84
|
+
},
|
|
85
|
+
},
|
|
86
|
+
],
|
|
87
|
+
});
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
return results;
|
|
91
|
+
}
|
|
92
|
+
//# sourceMappingURL=sarif.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../../src/cli/formatters/sarif.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAIL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,aAAa,EACb,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgB,EAAE,QAAgB;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAa;QACtB,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,GAAG,SAAS;wBACZ,KAAK;qBACN;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,KAAkB;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,IAAe;IAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAElD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,GAAG;QACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,gBAAgB,EAAE;QACrD,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,EAAE;QACnD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC;YAC7B,iBAAiB,EAAE,QAAQ,CAAC,QAAQ;SACrC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAAgB,EAAE,QAAgB;IACtD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,iEAAiE;IACjE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAElD,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC5C,OAAO,EAAE;oBACP,IAAI,EAAE,aAAa,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,6CAA6C;iBAChG;gBACD,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE;gCAChB,GAAG,EAAE,QAAQ;6BACd;4BACD,MAAM,EAAE;gCACN,SAAS,EAAE,IAAI,CAAC,IAAI;6BACrB;yBACF;qBACF;iBACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Summary Formatter
|
|
3
|
+
*
|
|
4
|
+
* Outputs a human-readable summary of the analysis.
|
|
5
|
+
*/
|
|
6
|
+
import type { CircleIR } from 'circle-ir';
|
|
7
|
+
/**
|
|
8
|
+
* Format result as human-readable summary.
|
|
9
|
+
*/
|
|
10
|
+
export declare function formatSummary(result: CircleIR, filePath: string): string;
|
|
11
|
+
//# sourceMappingURL=summary.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"summary.d.ts","sourceRoot":"","sources":["../../../src/cli/formatters/summary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA0B,MAAM,WAAW,CAAC;AAIlE;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA0KxE"}
|
|
@@ -0,0 +1,240 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Summary Formatter
|
|
3
|
+
*
|
|
4
|
+
* Outputs a human-readable summary of the analysis.
|
|
5
|
+
*/
|
|
6
|
+
import { globalPatternCache } from '../../analysis/pattern-discovery.js';
|
|
7
|
+
import { colors } from '../colors.js';
|
|
8
|
+
/**
|
|
9
|
+
* Format result as human-readable summary.
|
|
10
|
+
*/
|
|
11
|
+
export function formatSummary(result, filePath) {
|
|
12
|
+
const lines = [];
|
|
13
|
+
// Header
|
|
14
|
+
lines.push('');
|
|
15
|
+
lines.push(colors.cyan('═'.repeat(60)));
|
|
16
|
+
lines.push(colors.bold(' Circle-IR Analysis Report'));
|
|
17
|
+
lines.push(colors.cyan('═'.repeat(60)));
|
|
18
|
+
lines.push('');
|
|
19
|
+
// File info
|
|
20
|
+
lines.push(`File: ${filePath}`);
|
|
21
|
+
lines.push(`Language: ${result.meta.language}`);
|
|
22
|
+
lines.push(`Lines of Code: ${result.meta.loc}`);
|
|
23
|
+
lines.push('');
|
|
24
|
+
// Types summary
|
|
25
|
+
lines.push('─'.repeat(60));
|
|
26
|
+
lines.push('Types');
|
|
27
|
+
lines.push('─'.repeat(60));
|
|
28
|
+
lines.push(` Classes: ${result.types.filter(t => t.kind === 'class').length}`);
|
|
29
|
+
lines.push(` Interfaces: ${result.types.filter(t => t.kind === 'interface').length}`);
|
|
30
|
+
lines.push(` Enums: ${result.types.filter(t => t.kind === 'enum').length}`);
|
|
31
|
+
lines.push(` Methods: ${result.types.reduce((sum, t) => sum + t.methods.length, 0)}`);
|
|
32
|
+
lines.push('');
|
|
33
|
+
// Pattern Discovery Stats (if enabled)
|
|
34
|
+
const patternStats = globalPatternCache.getStats();
|
|
35
|
+
if (patternStats.sources > 0 || patternStats.sinks > 0) {
|
|
36
|
+
lines.push('─'.repeat(60));
|
|
37
|
+
lines.push('Pattern Discovery');
|
|
38
|
+
lines.push('─'.repeat(60));
|
|
39
|
+
lines.push(` Discovered Sources: ${patternStats.sources}`);
|
|
40
|
+
lines.push(` Discovered Sinks: ${patternStats.sinks}`);
|
|
41
|
+
if (patternStats.verified > 0) {
|
|
42
|
+
lines.push(` LLM Verified: ${patternStats.verified}`);
|
|
43
|
+
}
|
|
44
|
+
if (patternStats.needsVerification > 0) {
|
|
45
|
+
lines.push(` Needs Verification: ${patternStats.needsVerification}`);
|
|
46
|
+
}
|
|
47
|
+
lines.push('');
|
|
48
|
+
}
|
|
49
|
+
// Taint sources
|
|
50
|
+
lines.push('─'.repeat(60));
|
|
51
|
+
lines.push('Taint Sources');
|
|
52
|
+
lines.push('─'.repeat(60));
|
|
53
|
+
if (result.taint.sources.length === 0) {
|
|
54
|
+
lines.push(' No taint sources detected');
|
|
55
|
+
}
|
|
56
|
+
else {
|
|
57
|
+
for (const source of result.taint.sources) {
|
|
58
|
+
lines.push(formatSource(source));
|
|
59
|
+
}
|
|
60
|
+
}
|
|
61
|
+
lines.push('');
|
|
62
|
+
// Taint sinks
|
|
63
|
+
lines.push('─'.repeat(60));
|
|
64
|
+
lines.push('Taint Sinks');
|
|
65
|
+
lines.push('─'.repeat(60));
|
|
66
|
+
if (result.taint.sinks.length === 0) {
|
|
67
|
+
lines.push(' No taint sinks detected');
|
|
68
|
+
}
|
|
69
|
+
else {
|
|
70
|
+
for (const sink of result.taint.sinks) {
|
|
71
|
+
lines.push(formatSink(sink));
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
lines.push('');
|
|
75
|
+
// Sanitizers
|
|
76
|
+
if (result.taint.sanitizers && result.taint.sanitizers.length > 0) {
|
|
77
|
+
lines.push('─'.repeat(60));
|
|
78
|
+
lines.push('Sanitizers');
|
|
79
|
+
lines.push('─'.repeat(60));
|
|
80
|
+
for (const sanitizer of result.taint.sanitizers) {
|
|
81
|
+
lines.push(` Line ${sanitizer.line}: ${sanitizer.method}`);
|
|
82
|
+
}
|
|
83
|
+
lines.push('');
|
|
84
|
+
}
|
|
85
|
+
// Verified taint flows
|
|
86
|
+
if (result.taint.flows && result.taint.flows.length > 0) {
|
|
87
|
+
lines.push('─'.repeat(60));
|
|
88
|
+
lines.push('Verified Taint Flows (via Dataflow Analysis)');
|
|
89
|
+
lines.push('─'.repeat(60));
|
|
90
|
+
for (const flow of result.taint.flows.slice(0, 5)) {
|
|
91
|
+
const confidence = Math.round(flow.confidence * 100);
|
|
92
|
+
lines.push(` [${confidence}%] Line ${flow.source_line} → Line ${flow.sink_line}`);
|
|
93
|
+
lines.push(` Source: ${flow.source_type}`);
|
|
94
|
+
lines.push(` Sink: ${flow.sink_type}`);
|
|
95
|
+
if (flow.path.length > 2) {
|
|
96
|
+
lines.push(` Path: ${flow.path.map(s => s.variable).join(' → ')}`);
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
if (result.taint.flows.length > 5) {
|
|
100
|
+
lines.push(` ... and ${result.taint.flows.length - 5} more flow(s)`);
|
|
101
|
+
}
|
|
102
|
+
lines.push('');
|
|
103
|
+
}
|
|
104
|
+
// Inter-procedural taint analysis
|
|
105
|
+
if (result.taint.interprocedural && result.taint.interprocedural.tainted_methods.length > 0) {
|
|
106
|
+
lines.push('─'.repeat(60));
|
|
107
|
+
lines.push('Inter-procedural Taint Flow');
|
|
108
|
+
lines.push('─'.repeat(60));
|
|
109
|
+
lines.push(` Tainted methods: ${result.taint.interprocedural.tainted_methods.length}`);
|
|
110
|
+
if (result.taint.interprocedural.taint_bridges.length > 0) {
|
|
111
|
+
lines.push(` Taint bridges: ${result.taint.interprocedural.taint_bridges.join(', ')}`);
|
|
112
|
+
}
|
|
113
|
+
if (result.taint.interprocedural.method_flows.length > 0) {
|
|
114
|
+
lines.push(' Method call flows:');
|
|
115
|
+
for (const flow of result.taint.interprocedural.method_flows.slice(0, 5)) {
|
|
116
|
+
const arrow = flow.returns_taint ? '⇄' : '→';
|
|
117
|
+
lines.push(` ${flow.caller}() ${arrow} ${flow.callee}() at line ${flow.call_line}`);
|
|
118
|
+
}
|
|
119
|
+
if (result.taint.interprocedural.method_flows.length > 5) {
|
|
120
|
+
lines.push(` ... and ${result.taint.interprocedural.method_flows.length - 5} more`);
|
|
121
|
+
}
|
|
122
|
+
}
|
|
123
|
+
lines.push('');
|
|
124
|
+
}
|
|
125
|
+
// Potential vulnerabilities
|
|
126
|
+
lines.push('─'.repeat(60));
|
|
127
|
+
lines.push(colors.bold('Potential Vulnerabilities'));
|
|
128
|
+
lines.push('─'.repeat(60));
|
|
129
|
+
const vulnCount = countVulnerabilities(result);
|
|
130
|
+
if (vulnCount === 0) {
|
|
131
|
+
lines.push(colors.success(' ✓ No potential vulnerabilities detected'));
|
|
132
|
+
}
|
|
133
|
+
else {
|
|
134
|
+
lines.push(colors.warning(` ⚠ Found ${vulnCount} potential vulnerability path(s)`));
|
|
135
|
+
lines.push('');
|
|
136
|
+
// Group by sink type
|
|
137
|
+
const sinksByType = groupBy(result.taint.sinks, 'type');
|
|
138
|
+
for (const [type, sinks] of Object.entries(sinksByType)) {
|
|
139
|
+
const cwe = sinks[0]?.cwe || 'Unknown';
|
|
140
|
+
lines.push(colors.red(` [${cwe}] ${formatVulnType(type)}: ${sinks.length} sink(s)`));
|
|
141
|
+
for (const sink of sinks) {
|
|
142
|
+
lines.push(colors.gray(` - Line ${sink.line}: ${sink.location}`));
|
|
143
|
+
}
|
|
144
|
+
}
|
|
145
|
+
}
|
|
146
|
+
lines.push('');
|
|
147
|
+
// Unresolved items
|
|
148
|
+
if (result.unresolved.length > 0) {
|
|
149
|
+
lines.push('─'.repeat(60));
|
|
150
|
+
lines.push('Items Requiring Review');
|
|
151
|
+
lines.push('─'.repeat(60));
|
|
152
|
+
for (const item of result.unresolved.slice(0, 5)) {
|
|
153
|
+
lines.push(` [${item.type}] Line ${item.context.line}: ${item.reason}`);
|
|
154
|
+
}
|
|
155
|
+
if (result.unresolved.length > 5) {
|
|
156
|
+
lines.push(` ... and ${result.unresolved.length - 5} more`);
|
|
157
|
+
}
|
|
158
|
+
lines.push('');
|
|
159
|
+
}
|
|
160
|
+
// Summary
|
|
161
|
+
lines.push(colors.cyan('═'.repeat(60)));
|
|
162
|
+
const summaryColor = vulnCount > 0 ? colors.warning : colors.success;
|
|
163
|
+
lines.push(summaryColor(`Summary: ${result.taint.sources.length} sources, ${result.taint.sinks.length} sinks, ${vulnCount} potential vulns`));
|
|
164
|
+
lines.push(colors.cyan('═'.repeat(60)));
|
|
165
|
+
lines.push('');
|
|
166
|
+
return lines.join('\n');
|
|
167
|
+
}
|
|
168
|
+
/**
|
|
169
|
+
* Format a taint source for display.
|
|
170
|
+
*/
|
|
171
|
+
function formatSource(source) {
|
|
172
|
+
const severity = formatSeverity(source.severity);
|
|
173
|
+
return ` ${severity} Line ${source.line}: [${source.type}] ${source.location}`;
|
|
174
|
+
}
|
|
175
|
+
/**
|
|
176
|
+
* Format a taint sink for display.
|
|
177
|
+
*/
|
|
178
|
+
function formatSink(sink) {
|
|
179
|
+
return ` [${sink.cwe}] Line ${sink.line}: [${sink.type}] ${sink.location}`;
|
|
180
|
+
}
|
|
181
|
+
/**
|
|
182
|
+
* Format severity with indicator and color.
|
|
183
|
+
*/
|
|
184
|
+
function formatSeverity(severity) {
|
|
185
|
+
switch (severity) {
|
|
186
|
+
case 'critical':
|
|
187
|
+
return colors.critical('[!!!]');
|
|
188
|
+
case 'high':
|
|
189
|
+
return colors.high('[!! ]');
|
|
190
|
+
case 'medium':
|
|
191
|
+
return colors.medium('[! ]');
|
|
192
|
+
case 'low':
|
|
193
|
+
return colors.low('[ ]');
|
|
194
|
+
default:
|
|
195
|
+
return colors.gray('[ ]');
|
|
196
|
+
}
|
|
197
|
+
}
|
|
198
|
+
/**
|
|
199
|
+
* Format vulnerability type for display.
|
|
200
|
+
*/
|
|
201
|
+
function formatVulnType(type) {
|
|
202
|
+
const names = {
|
|
203
|
+
sql_injection: 'SQL Injection',
|
|
204
|
+
command_injection: 'Command Injection',
|
|
205
|
+
xss: 'Cross-Site Scripting (XSS)',
|
|
206
|
+
path_traversal: 'Path Traversal',
|
|
207
|
+
xxe: 'XML External Entity (XXE)',
|
|
208
|
+
deserialization: 'Unsafe Deserialization',
|
|
209
|
+
ldap_injection: 'LDAP Injection',
|
|
210
|
+
xpath_injection: 'XPath Injection',
|
|
211
|
+
ssrf: 'Server-Side Request Forgery (SSRF)',
|
|
212
|
+
code_injection: 'Code Injection',
|
|
213
|
+
regex_injection: 'Regular Expression Injection (ReDoS)',
|
|
214
|
+
};
|
|
215
|
+
return names[type] || type;
|
|
216
|
+
}
|
|
217
|
+
/**
|
|
218
|
+
* Count potential vulnerabilities (sources that could reach sinks).
|
|
219
|
+
*/
|
|
220
|
+
function countVulnerabilities(result) {
|
|
221
|
+
// Simple heuristic: if we have both sources and sinks, count the sinks
|
|
222
|
+
if (result.taint.sources.length > 0 && result.taint.sinks.length > 0) {
|
|
223
|
+
return result.taint.sinks.length;
|
|
224
|
+
}
|
|
225
|
+
return 0;
|
|
226
|
+
}
|
|
227
|
+
/**
|
|
228
|
+
* Group array by key.
|
|
229
|
+
*/
|
|
230
|
+
function groupBy(array, key) {
|
|
231
|
+
return array.reduce((result, item) => {
|
|
232
|
+
const k = String(item[key]);
|
|
233
|
+
if (!result[k]) {
|
|
234
|
+
result[k] = [];
|
|
235
|
+
}
|
|
236
|
+
result[k].push(item);
|
|
237
|
+
return result;
|
|
238
|
+
}, {});
|
|
239
|
+
}
|
|
240
|
+
//# sourceMappingURL=summary.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"summary.js","sourceRoot":"","sources":["../../../src/cli/formatters/summary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAAgB,EAAE,QAAgB;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS;IACT,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,YAAY;IACZ,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,uCAAuC;IACvC,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC;IACnD,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,uBAAuB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,IAAI,YAAY,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,mBAAmB,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,YAAY,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,yBAAyB,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,cAAc;IACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,aAAa;IACb,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,UAAU,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,MAAM,UAAU,WAAW,IAAI,CAAC,WAAW,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,kCAAkC;IAClC,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAExF,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACzE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,SAAS,kCAAkC,CAAC,CAAC,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,qBAAqB;QACrB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,cAAc,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC;YACtF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mBAAmB;IACnB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,UAAU;IACV,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,WAAW,SAAS,kBAAkB,CAAC,CAAC,CAAC;IAC9I,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,KAAK,QAAQ,SAAS,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,MAAM,IAAI,CAAC,GAAG,UAAU,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,MAAM;YACT,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,KAAK,KAAK;YACR,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B;YACE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAA2B;QACpC,aAAa,EAAE,eAAe;QAC9B,iBAAiB,EAAE,mBAAmB;QACtC,GAAG,EAAE,4BAA4B;QACjC,cAAc,EAAE,gBAAgB;QAChC,GAAG,EAAE,2BAA2B;QAChC,eAAe,EAAE,wBAAwB;QACzC,cAAc,EAAE,gBAAgB;QAChC,eAAe,EAAE,iBAAiB;QAClC,IAAI,EAAE,oCAAoC;QAC1C,cAAc,EAAE,gBAAgB;QAChC,eAAe,EAAE,sCAAsC;KACxD,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,MAAgB;IAC5C,uEAAuE;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAS,OAAO,CAAI,KAAU,EAAE,GAAY;IAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,EAAyB,CAAC,CAAC;AAChC,CAAC"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Two-Phase Project Summary Formatter
|
|
3
|
+
*
|
|
4
|
+
* Outputs a human-readable summary of two-phase LLM-enhanced project analysis.
|
|
5
|
+
*/
|
|
6
|
+
import type { TwoPhaseProjectAnalysis } from '../../project/index.js';
|
|
7
|
+
/**
|
|
8
|
+
* Format two-phase project analysis as human-readable summary.
|
|
9
|
+
*/
|
|
10
|
+
export declare function formatTwoPhaseProjectSummary(result: TwoPhaseProjectAnalysis): string;
|
|
11
|
+
//# sourceMappingURL=two-phase-summary.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"two-phase-summary.d.ts","sourceRoot":"","sources":["../../../src/cli/formatters/two-phase-summary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAsB,MAAM,wBAAwB,CAAC;AAG1F;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CA6JpF"}
|
|
@@ -0,0 +1,188 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Two-Phase Project Summary Formatter
|
|
3
|
+
*
|
|
4
|
+
* Outputs a human-readable summary of two-phase LLM-enhanced project analysis.
|
|
5
|
+
*/
|
|
6
|
+
import { colors } from '../colors.js';
|
|
7
|
+
/**
|
|
8
|
+
* Format two-phase project analysis as human-readable summary.
|
|
9
|
+
*/
|
|
10
|
+
export function formatTwoPhaseProjectSummary(result) {
|
|
11
|
+
const lines = [];
|
|
12
|
+
// Header
|
|
13
|
+
lines.push('');
|
|
14
|
+
lines.push(colors.cyan('═'.repeat(70)));
|
|
15
|
+
lines.push(colors.bold(' Circle-IR Two-Phase Project Analysis Report'));
|
|
16
|
+
lines.push(colors.cyan('═'.repeat(70)));
|
|
17
|
+
lines.push('');
|
|
18
|
+
// Project info
|
|
19
|
+
lines.push(`Project: ${result.meta.name}`);
|
|
20
|
+
lines.push(`Root: ${result.meta.root}`);
|
|
21
|
+
lines.push(`Language: ${result.meta.language}`);
|
|
22
|
+
if (result.meta.framework) {
|
|
23
|
+
lines.push(`Framework: ${result.meta.framework}${result.meta.framework_version ? ` ${result.meta.framework_version}` : ''}`);
|
|
24
|
+
}
|
|
25
|
+
lines.push(`Total Files: ${result.meta.total_files}`);
|
|
26
|
+
lines.push(`Total Lines: ${result.meta.total_loc}`);
|
|
27
|
+
lines.push(`Analyzed: ${result.meta.analyzed_at}`);
|
|
28
|
+
lines.push('');
|
|
29
|
+
// Timing
|
|
30
|
+
lines.push('─'.repeat(70));
|
|
31
|
+
lines.push('Analysis Timing');
|
|
32
|
+
lines.push('─'.repeat(70));
|
|
33
|
+
lines.push(` Phase 1 (per-file): ${(result.timing.phase1TotalMs / 1000).toFixed(1)}s`);
|
|
34
|
+
lines.push(` Phase 2 (cross-file): ${(result.timing.phase2TotalMs / 1000).toFixed(1)}s`);
|
|
35
|
+
lines.push(` Total: ${(result.timing.totalMs / 1000).toFixed(1)}s`);
|
|
36
|
+
lines.push('');
|
|
37
|
+
// LLM Enrichment summary
|
|
38
|
+
lines.push('─'.repeat(70));
|
|
39
|
+
lines.push('LLM Enrichment (Phase 1)');
|
|
40
|
+
lines.push('─'.repeat(70));
|
|
41
|
+
const enrichedFiles = result.enrichedFiles.filter(f => f.enrichment);
|
|
42
|
+
const totalAdditionalSources = enrichedFiles.reduce((sum, f) => sum + (f.enrichment?.additionalSources?.length || 0), 0);
|
|
43
|
+
const totalAdditionalSinks = enrichedFiles.reduce((sum, f) => sum + (f.enrichment?.additionalSinks?.length || 0), 0);
|
|
44
|
+
lines.push(` Files with LLM enrichment: ${enrichedFiles.length}`);
|
|
45
|
+
lines.push(` LLM-discovered sources: ${totalAdditionalSources}`);
|
|
46
|
+
lines.push(` LLM-discovered sinks: ${totalAdditionalSinks}`);
|
|
47
|
+
// File roles
|
|
48
|
+
const roleGroups = {};
|
|
49
|
+
for (const f of enrichedFiles) {
|
|
50
|
+
const role = f.enrichment?.role?.role || 'unknown';
|
|
51
|
+
if (!roleGroups[role])
|
|
52
|
+
roleGroups[role] = [];
|
|
53
|
+
roleGroups[role].push(f.file);
|
|
54
|
+
}
|
|
55
|
+
const rolesSorted = Object.entries(roleGroups).sort((a, b) => b[1].length - a[1].length);
|
|
56
|
+
if (rolesSorted.length > 0) {
|
|
57
|
+
lines.push(' File roles:');
|
|
58
|
+
for (const [role, files] of rolesSorted.slice(0, 5)) {
|
|
59
|
+
lines.push(` ${role}: ${files.length} file(s)`);
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
lines.push('');
|
|
63
|
+
// Cross-File Taint Flows (Phase 2)
|
|
64
|
+
lines.push('─'.repeat(70));
|
|
65
|
+
lines.push(colors.bold('Cross-File Taint Flows (Phase 2)'));
|
|
66
|
+
lines.push('─'.repeat(70));
|
|
67
|
+
if (result.crossFileFlows.length === 0) {
|
|
68
|
+
lines.push(colors.success(' No cross-file taint flows detected'));
|
|
69
|
+
}
|
|
70
|
+
else {
|
|
71
|
+
lines.push(colors.warning(` Found ${result.crossFileFlows.length} cross-file flow(s)`));
|
|
72
|
+
lines.push('');
|
|
73
|
+
for (const flow of result.crossFileFlows.slice(0, 10)) {
|
|
74
|
+
lines.push(formatCrossFileFlow(flow));
|
|
75
|
+
lines.push('');
|
|
76
|
+
}
|
|
77
|
+
if (result.crossFileFlows.length > 10) {
|
|
78
|
+
lines.push(` ... and ${result.crossFileFlows.length - 10} more flow(s)`);
|
|
79
|
+
}
|
|
80
|
+
}
|
|
81
|
+
lines.push('');
|
|
82
|
+
// Standard taint paths
|
|
83
|
+
if (result.taint_paths.length > 0) {
|
|
84
|
+
lines.push('─'.repeat(70));
|
|
85
|
+
lines.push('Static Taint Paths');
|
|
86
|
+
lines.push('─'.repeat(70));
|
|
87
|
+
lines.push(` Total paths: ${result.taint_paths.length}`);
|
|
88
|
+
for (const path of result.taint_paths.slice(0, 5)) {
|
|
89
|
+
const sanitized = path.sanitizers_in_path.length > 0 ? ' [SANITIZED]' : '';
|
|
90
|
+
const confidence = Math.round(path.confidence * 100);
|
|
91
|
+
lines.push(` [${path.sink.cwe}] ${path.source.file}:${path.source.line} → ${path.sink.file}:${path.sink.line}${sanitized} (${confidence}%)`);
|
|
92
|
+
}
|
|
93
|
+
if (result.taint_paths.length > 5) {
|
|
94
|
+
lines.push(` ... and ${result.taint_paths.length - 5} more path(s)`);
|
|
95
|
+
}
|
|
96
|
+
lines.push('');
|
|
97
|
+
}
|
|
98
|
+
// Security Findings
|
|
99
|
+
lines.push('─'.repeat(70));
|
|
100
|
+
lines.push('Security Findings');
|
|
101
|
+
lines.push('─'.repeat(70));
|
|
102
|
+
if (result.findings.length === 0) {
|
|
103
|
+
lines.push(colors.success(' No security findings'));
|
|
104
|
+
}
|
|
105
|
+
else {
|
|
106
|
+
// Group by severity
|
|
107
|
+
const bySeverity = groupBy(result.findings, f => f.severity);
|
|
108
|
+
const critical = bySeverity['critical'] || [];
|
|
109
|
+
const high = bySeverity['high'] || [];
|
|
110
|
+
const medium = bySeverity['medium'] || [];
|
|
111
|
+
const low = bySeverity['low'] || [];
|
|
112
|
+
if (critical.length > 0)
|
|
113
|
+
lines.push(colors.critical(` Critical: ${critical.length}`));
|
|
114
|
+
if (high.length > 0)
|
|
115
|
+
lines.push(colors.high(` High: ${high.length}`));
|
|
116
|
+
if (medium.length > 0)
|
|
117
|
+
lines.push(colors.medium(` Medium: ${medium.length}`));
|
|
118
|
+
if (low.length > 0)
|
|
119
|
+
lines.push(colors.low(` Low: ${low.length}`));
|
|
120
|
+
lines.push('');
|
|
121
|
+
// Show top findings
|
|
122
|
+
for (const finding of result.findings.slice(0, 10)) {
|
|
123
|
+
const severity = formatSeverity(finding.severity);
|
|
124
|
+
const exploitable = finding.exploitable ? colors.critical(' [EXPLOITABLE]') : '';
|
|
125
|
+
lines.push(` ${severity} [${finding.cwe}] ${finding.type}${exploitable}`);
|
|
126
|
+
lines.push(` Source: ${finding.source.file}:${finding.source.line}`);
|
|
127
|
+
lines.push(` Sink: ${finding.sink.file}:${finding.sink.line}`);
|
|
128
|
+
lines.push(` ${finding.explanation}`);
|
|
129
|
+
lines.push('');
|
|
130
|
+
}
|
|
131
|
+
if (result.findings.length > 10) {
|
|
132
|
+
lines.push(` ... and ${result.findings.length - 10} more finding(s)`);
|
|
133
|
+
}
|
|
134
|
+
}
|
|
135
|
+
lines.push('');
|
|
136
|
+
// Summary
|
|
137
|
+
lines.push(colors.cyan('═'.repeat(70)));
|
|
138
|
+
const vulnCount = result.findings.length + result.crossFileFlows.length;
|
|
139
|
+
const summaryColor = vulnCount > 0 ? colors.warning : colors.success;
|
|
140
|
+
lines.push(summaryColor(`Summary: ${result.meta.total_files} files, ${result.crossFileFlows.length} cross-file flows, ${result.findings.length} findings`));
|
|
141
|
+
lines.push(colors.cyan('═'.repeat(70)));
|
|
142
|
+
lines.push('');
|
|
143
|
+
return lines.join('\n');
|
|
144
|
+
}
|
|
145
|
+
/**
|
|
146
|
+
* Format a cross-file taint flow.
|
|
147
|
+
*/
|
|
148
|
+
function formatCrossFileFlow(flow) {
|
|
149
|
+
const confidencePercent = Math.round(flow.confidence * 100);
|
|
150
|
+
const lines = [];
|
|
151
|
+
lines.push(colors.warning(` [${confidencePercent}%] Cross-File Flow [${flow.sink.cwe}]`));
|
|
152
|
+
lines.push(` Source: ${flow.source.file}:${flow.source.line}`);
|
|
153
|
+
lines.push(` ${flow.source.code || flow.source.type}`);
|
|
154
|
+
lines.push(` Sink: ${flow.sink.file}:${flow.sink.line}`);
|
|
155
|
+
lines.push(` ${flow.sink.code || flow.sink.type}`);
|
|
156
|
+
return lines.join('\n');
|
|
157
|
+
}
|
|
158
|
+
/**
|
|
159
|
+
* Format severity with indicator and color.
|
|
160
|
+
*/
|
|
161
|
+
function formatSeverity(severity) {
|
|
162
|
+
switch (severity) {
|
|
163
|
+
case 'critical':
|
|
164
|
+
return colors.critical('[!!!!]');
|
|
165
|
+
case 'high':
|
|
166
|
+
return colors.high('[!!! ]');
|
|
167
|
+
case 'medium':
|
|
168
|
+
return colors.medium('[!! ]');
|
|
169
|
+
case 'low':
|
|
170
|
+
return colors.low('[! ]');
|
|
171
|
+
default:
|
|
172
|
+
return colors.gray('[ ]');
|
|
173
|
+
}
|
|
174
|
+
}
|
|
175
|
+
/**
|
|
176
|
+
* Group array by key function.
|
|
177
|
+
*/
|
|
178
|
+
function groupBy(array, keyFn) {
|
|
179
|
+
return array.reduce((result, item) => {
|
|
180
|
+
const key = keyFn(item);
|
|
181
|
+
if (!result[key]) {
|
|
182
|
+
result[key] = [];
|
|
183
|
+
}
|
|
184
|
+
result[key].push(item);
|
|
185
|
+
return result;
|
|
186
|
+
}, {});
|
|
187
|
+
}
|
|
188
|
+
//# sourceMappingURL=two-phase-summary.js.map
|