claude-crap 0.1.2 → 0.3.0

package/src/scanner/runner.ts

@@ -0,0 +1,212 @@
+/**
+ * Execute a single scanner CLI and capture its raw output.
+ *
+ * Each scanner has a fixed invocation that produces the format its
+ * adapter expects:
+ *
+ *   - ESLint  → `npx eslint -f json .`  (JSON array)
+ *   - Semgrep → `semgrep --sarif --quiet .` (SARIF 2.1.0)
+ *   - Bandit  → `bandit -f json -r . -q` (JSON object)
+ *   - Stryker → `npx stryker run` then read `reports/mutation/mutation.json`
+ *
+ * ESLint and Bandit exit non-zero when findings exist — that is
+ * expected, not an error. The runner captures stdout regardless of
+ * exit code for those scanners.
+ *
+ * Stryker is special: it writes to a file instead of stdout, so we
+ * read the output file after the process exits.
+ *
+ * @module scanner/runner
+ */
+
+import { execFile } from "node:child_process";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import type { KnownScanner } from "../adapters/common.js";
+
+// ── Types ──────────────────────────────────────────────────────────
+
+/**
+ * Result of executing a single scanner.
+ */
+export interface ScannerRunResult {
+  /** Which scanner was executed. */
+  scanner: KnownScanner;
+  /** Whether execution completed and produced parseable output. */
+  success: boolean;
+  /** The scanner's raw output (stdout or file contents). */
+  rawOutput: string;
+  /** Error message when `success` is false. */
+  error?: string;
+  /** Wall-clock execution time in milliseconds. */
+  durationMs: number;
+}
+
+// ── Scanner command definitions ────────────────────────────────────
+
+interface ScannerCommand {
+  /** Binary or npx command. */
+  command: string;
+  /** CLI arguments. */
+  args: string[];
+  /** Maximum execution time in ms. */
+  timeoutMs: number;
+  /** If true, non-zero exit is expected when findings exist. */
+  nonZeroIsNormal: boolean;
+  /** If set, read output from this file instead of stdout. */
+  outputFile?: string;
+}
+
+function getScannerCommand(
+  scanner: KnownScanner,
+  workspaceRoot: string,
+): ScannerCommand {
+  switch (scanner) {
+    case "eslint":
+      return {
+        command: "npx",
+        args: ["eslint", "-f", "json", "."],
+        timeoutMs: 120_000,
+        nonZeroIsNormal: true,
+      };
+    case "semgrep":
+      return {
+        command: "semgrep",
+        args: ["--sarif", "--quiet", "."],
+        timeoutMs: 120_000,
+        nonZeroIsNormal: false,
+      };
+    case "bandit":
+      return {
+        command: "bandit",
+        args: ["-f", "json", "-r", ".", "-q"],
+        timeoutMs: 120_000,
+        nonZeroIsNormal: true,
+      };
+    case "stryker":
+      return {
+        command: "npx",
+        args: ["stryker", "run"],
+        timeoutMs: 300_000,
+        nonZeroIsNormal: false,
+        outputFile: join(workspaceRoot, "reports", "mutation", "mutation.json"),
+      };
+  }
+}
+
+// ── Public API ──────────────────────────────────────────────────────
+
+/**
+ * Execute a scanner CLI and return its raw output.
+ *
+ * @param scanner       Which scanner to run.
+ * @param workspaceRoot Absolute path to the project root (used as cwd).
+ * @returns             A {@link ScannerRunResult} with stdout or file output.
+ */
+export function runScanner(
+  scanner: KnownScanner,
+  workspaceRoot: string,
+): Promise<ScannerRunResult> {
+  const start = Date.now();
+  const cmd = getScannerCommand(scanner, workspaceRoot);
+
+  return new Promise((resolve) => {
+    execFile(
+      cmd.command,
+      cmd.args,
+      {
+        cwd: workspaceRoot,
+        timeout: cmd.timeoutMs,
+        maxBuffer: 50 * 1024 * 1024, // 50 MB — large codebases produce verbose output
+        env: { ...process.env, FORCE_COLOR: "0" }, // suppress ANSI in output
+      },
+      (err, stdout, stderr) => {
+        const durationMs = Date.now() - start;
+
+        // For scanners where non-zero exit means "findings exist",
+        // we still have valid output in stdout.
+        if (err && !cmd.nonZeroIsNormal) {
+          // Stryker: check if the output file was written despite the error
+          if (cmd.outputFile && existsSync(cmd.outputFile)) {
+            try {
+              const fileOutput = readFileSync(cmd.outputFile, "utf-8");
+              resolve({
+                scanner,
+                success: true,
+                rawOutput: fileOutput,
+                durationMs,
+              });
+              return;
+            } catch {
+              // Fall through to error path
+            }
+          }
+
+          resolve({
+            scanner,
+            success: false,
+            rawOutput: "",
+            error: stderr || (err as Error).message,
+            durationMs,
+          });
+          return;
+        }
+
+        // For file-based output (Stryker), read from file
+        if (cmd.outputFile) {
+          if (existsSync(cmd.outputFile)) {
+            try {
+              const fileOutput = readFileSync(cmd.outputFile, "utf-8");
+              resolve({
+                scanner,
+                success: true,
+                rawOutput: fileOutput,
+                durationMs,
+              });
+              return;
+            } catch (readErr) {
+              resolve({
+                scanner,
+                success: false,
+                rawOutput: "",
+                error: `Failed to read output file: ${(readErr as Error).message}`,
+                durationMs,
+              });
+              return;
+            }
+          }
+          resolve({
+            scanner,
+            success: false,
+            rawOutput: "",
+            error: `Scanner completed but output file not found: ${cmd.outputFile}`,
+            durationMs,
+          });
+          return;
+        }
+
+        // Stdout-based output
+        const output = stdout.trim();
+        if (!output) {
+          resolve({
+            scanner,
+            success: true,
+            rawOutput: "[]", // ESLint returns empty when no files match
+            durationMs,
+          });
+          return;
+        }
+
+        resolve({
+          scanner,
+          success: true,
+          rawOutput: output,
+          durationMs,
+        });
+      },
+    );
+  });
+}
+
+// Exported for testing
+export { getScannerCommand, type ScannerCommand };

package/src/schemas/tool-schemas.ts

@@ -199,6 +199,33 @@ export const ingestScannerOutputSchema = {
  * from an external scanner, deduplicates against the internal store, and
  * normalizes the output into claude-crap's canonical format.
  */
+/**
+ * Schema for the `auto_scan` tool. Auto-detects available scanners
+ * in the workspace, runs them, and ingests findings into the SARIF store.
+ */
+/**
+ * Schema for the `bootstrap_scanner` tool. Detects project type,
+ * installs the appropriate scanner, creates config files, and runs
+ * auto_scan to verify.
+ */
+export const bootstrapScannerSchema = {
+  type: "object",
+  description:
+    "Detect the project type (JavaScript, TypeScript, Python, Java, C#), install the appropriate scanner (ESLint for JS/TS, Bandit for Python, Semgrep for Java/C#), create a minimal config file, and run auto_scan to verify. Skips installation if a scanner is already configured. Use this when auto_scan finds no scanners and quality grades are vacuously A.",
+  properties: {},
+  required: [],
+  additionalProperties: false,
+} as const;
+
+export const autoScanSchema = {
+  type: "object",
+  description:
+    "Auto-detect available scanners (ESLint, Semgrep, Bandit, Stryker) in the workspace, execute them, and ingest findings into the SARIF store. Returns detection results, per-scanner execution stats, and total findings ingested. Call this to populate findings without manual scanner invocation.",
+  properties: {},
+  required: [],
+  additionalProperties: false,
+} as const;
+
 export const ingestSarifSchema = {
   type: "object",
   description:

package/src/tests/auto-scan.test.ts

@@ -0,0 +1,137 @@
+/**
+ * Unit tests for the auto-scan orchestrator.
+ *
+ * These tests verify the orchestration logic: detection → run → ingest.
+ * They use a real (temporary) workspace with config files to trigger
+ * detection, but scanner execution will fail (binaries aren't installed
+ * in the test environment). This tests the graceful-failure path.
+ *
+ * @module tests/auto-scan.test
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import pino from "pino";
+
+import { autoScan, type AutoScanResult } from "../scanner/auto-scan.js";
+import { SarifStore } from "../sarif/sarif-store.js";
+
+const logger = pino({ level: "silent" });
+
+function makeTmpDir(): string {
+  return mkdtempSync(join(tmpdir(), "crap-autoscan-"));
+}
+
+describe("autoScan", () => {
+  it("returns empty results when no scanners are detected", async () => {
+    const dir = makeTmpDir();
+    try {
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await autoScan(dir, store, logger);
+      assert.equal(result.detected.length, 4);
+      assert.ok(result.totalDurationMs >= 0);
+      // No scanners available means no results
+      // (unless the host has scanner binaries installed)
+      assert.ok(Array.isArray(result.results));
+      assert.equal(typeof result.totalFindings, "number");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("detects scanners from config files in workspace", async () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "eslint.config.mjs"), "export default [];");
+      writeFileSync(join(dir, ".semgrep.yml"), "rules: []");
+
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await autoScan(dir, store, logger);
+
+      // ESLint and Semgrep should be detected
+      const eslintDetection = result.detected.find((d) => d.scanner === "eslint");
+      const semgrepDetection = result.detected.find((d) => d.scanner === "semgrep");
+      assert.ok(eslintDetection);
+      assert.equal(eslintDetection.available, true);
+      assert.ok(semgrepDetection);
+      assert.equal(semgrepDetection.available, true);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns correct structure even when all scanners fail", async () => {
+    const dir = makeTmpDir();
+    try {
+      // Create config files so scanners are detected but will fail to run
+      // (the temp dir isn't a real project)
+      writeFileSync(join(dir, "eslint.config.mjs"), "export default [];");
+
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await autoScan(dir, store, logger);
+
+      // Structure must be valid regardless of scanner success
+      assert.ok(Array.isArray(result.detected));
+      assert.ok(Array.isArray(result.results));
+      assert.equal(typeof result.totalFindings, "number");
+      assert.equal(typeof result.totalDurationMs, "number");
+
+      // eslint was detected, so it should appear in results
+      const eslintResult = result.results.find((r) => r.scanner === "eslint");
+      if (eslintResult) {
+        assert.equal(typeof eslintResult.success, "boolean");
+        assert.equal(typeof eslintResult.durationMs, "number");
+        assert.equal(typeof eslintResult.findingsIngested, "number");
+      }
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("totalFindings sums findings across all successful scanners", async () => {
+    const dir = makeTmpDir();
+    try {
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await autoScan(dir, store, logger);
+
+      // Sum of individual scanner findings should equal total
+      const sumFromResults = result.results
+        .filter((r) => r.success)
+        .reduce((sum, r) => sum + r.findingsIngested, 0);
+      assert.equal(result.totalFindings, sumFromResults);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("result has one ScannerDetection per known scanner", async () => {
+    const dir = makeTmpDir();
+    try {
+      const store = new SarifStore({
+        workspaceRoot: dir,
+        outputDir: join(dir, ".claude-crap/reports"),
+      });
+      const result = await autoScan(dir, store, logger);
+
+      const scannerNames = result.detected.map((d) => d.scanner).sort();
+      assert.deepEqual(scannerNames, ["bandit", "eslint", "semgrep", "stryker"]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/tests/integration/mcp-server.integration.test.ts

@@ -232,13 +232,15 @@ describe("MCP server integration", { skip: !serverBuilt }, () => {
     assert.ok(child && !child.killed, "server child should be running");
   });
 
-  it("exposes all seven tools via tools/list", async () => {
+  it("exposes all nine tools via tools/list", async () => {
     const response = await client!.request<{ result?: { tools?: Array<{ name: string }> } }>(
       "tools/list",
     );
     const names = (response.result?.tools ?? []).map((t) => t.name).sort();
     assert.deepEqual(names, [
       "analyze_file_ast",
+      "auto_scan",
+      "bootstrap_scanner",
       "compute_crap",
       "compute_tdr",
       "ingest_sarif",

package/src/tests/scanner-bootstrap.test.ts

@@ -0,0 +1,186 @@
+/**
+ * Unit tests for the scanner bootstrap module.
+ *
+ * Tests project type detection, ESLint config generation, and the
+ * bootstrap orchestrator's short-circuit and error paths.
+ *
+ * @module tests/scanner-bootstrap.test
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { detectProjectType, generateEslintConfig } from "../scanner/bootstrap.js";
+
+function makeTmpDir(): string {
+  return mkdtempSync(join(tmpdir(), "crap-bootstrap-"));
+}
+
+describe("detectProjectType", () => {
+  it("returns typescript when package.json and tsconfig.json exist", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "package.json"), "{}");
+      writeFileSync(join(dir, "tsconfig.json"), "{}");
+      assert.equal(detectProjectType(dir), "typescript");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns javascript when only package.json exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "package.json"), "{}");
+      assert.equal(detectProjectType(dir), "javascript");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns python when pyproject.toml exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "pyproject.toml"), "[project]");
+      assert.equal(detectProjectType(dir), "python");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns python when setup.py exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "setup.py"), "from setuptools import setup");
+      assert.equal(detectProjectType(dir), "python");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns python when requirements.txt exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "requirements.txt"), "flask==2.0");
+      assert.equal(detectProjectType(dir), "python");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns java when pom.xml exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "pom.xml"), "<project></project>");
+      assert.equal(detectProjectType(dir), "java");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns java when build.gradle exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "build.gradle"), "plugins {}");
+      assert.equal(detectProjectType(dir), "java");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns java when build.gradle.kts exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "build.gradle.kts"), "plugins {}");
+      assert.equal(detectProjectType(dir), "java");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns csharp when .csproj file exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "MyApp.csproj"), "<Project />");
+      assert.equal(detectProjectType(dir), "csharp");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns csharp when .sln file exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "MyApp.sln"), "");
+      assert.equal(detectProjectType(dir), "csharp");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns csharp when Directory.Build.props exists", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "Directory.Build.props"), "<Project />");
+      assert.equal(detectProjectType(dir), "csharp");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns unknown for an empty directory", () => {
+    const dir = makeTmpDir();
+    try {
+      assert.equal(detectProjectType(dir), "unknown");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("typescript wins over python when both signals present", () => {
+    const dir = makeTmpDir();
+    try {
+      writeFileSync(join(dir, "package.json"), "{}");
+      writeFileSync(join(dir, "tsconfig.json"), "{}");
+      writeFileSync(join(dir, "requirements.txt"), "flask");
+      assert.equal(detectProjectType(dir), "typescript");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("generateEslintConfig", () => {
+  it("TypeScript config includes typescript-eslint import", () => {
+    const config = generateEslintConfig(true);
+    assert.ok(config.includes('import tseslint from "typescript-eslint"'));
+    assert.ok(config.includes("tseslint.config"));
+    assert.ok(config.includes("tseslint.configs.recommended"));
+  });
+
+  it("JavaScript config uses plain array export", () => {
+    const config = generateEslintConfig(false);
+    assert.ok(config.includes("export default ["));
+    assert.ok(!config.includes("typescript-eslint"));
+  });
+
+  it("both configs include standard ignores", () => {
+    for (const isTS of [true, false]) {
+      const config = generateEslintConfig(isTS);
+      assert.ok(config.includes('"dist/"'), `${isTS ? "TS" : "JS"} should ignore dist/`);
+      assert.ok(config.includes('"node_modules/"'), `${isTS ? "TS" : "JS"} should ignore node_modules/`);
+      assert.ok(config.includes('"coverage/"'), `${isTS ? "TS" : "JS"} should ignore coverage/`);
+    }
+  });
+
+  it("both configs import @eslint/js", () => {
+    for (const isTS of [true, false]) {
+      const config = generateEslintConfig(isTS);
+      assert.ok(config.includes('import js from "@eslint/js"'));
+      assert.ok(config.includes("js.configs.recommended"));
+    }
+  });
+});