claude-crap 0.3.6 → 0.3.8

package/plugin/package-lock.json

@@ -1,16 +1,17 @@
 {
   "name": "claude-crap-plugin",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-crap-plugin",
-      "version": "0.3.6",
+      "version": "0.3.8",
       "dependencies": {
         "@fastify/static": "^8.0.3",
         "@modelcontextprotocol/sdk": "^1.0.4",
         "fastify": "^5.2.0",
+        "picomatch": "^2.3.0",
         "pino": "^9.5.0",
         "tree-sitter-wasms": "^0.1.12",
         "web-tree-sitter": "^0.24.4"
@@ -2069,6 +2070,18 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/pino": {
       "version": "9.14.0",
       "resolved": "https://registry.npmjs.org/pino/-/pino-9.14.0.tgz",

package/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-crap-plugin",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "private": true,
   "description": "Runtime dependencies for the claude-crap plugin bundle",
   "type": "module",
@@ -10,6 +10,7 @@
     "fastify": "^5.2.0",
     "pino": "^9.5.0",
     "tree-sitter-wasms": "^0.1.12",
+    "picomatch": "^2.3.0",
     "web-tree-sitter": "^0.24.4"
   },
   "engines": {

package/scripts/bundle-plugin.mjs

@@ -34,7 +34,8 @@ async function main() {
       "pino",
       "fastify",
       "@fastify/static",
-      "@modelcontextprotocol/sdk"
+      "@modelcontextprotocol/sdk",
+      "picomatch",
     ],
     banner: {
       js: "// Generated by scripts/bundle-plugin.mjs — DO NOT EDIT",

package/src/adapters/common.ts

@@ -23,7 +23,7 @@ import type { SarifLevel } from "../sarif/sarif-builder.js";
  * `ingest_scanner_output` MCP tool uses this as its `enum` constraint,
  * so keeping it narrow prevents drift.
  */
-export const KNOWN_SCANNERS = ["semgrep", "eslint", "bandit", "stryker"] as const;
+export const KNOWN_SCANNERS = ["semgrep", "eslint", "bandit", "stryker", "dart_analyze"] as const;
 
 /**
  * Union of supported scanner identifiers.

package/src/adapters/dart-analyzer.ts

@@ -0,0 +1,161 @@
+/**
+ * Adapter: `dart analyze --format=json` → SARIF 2.1.0.
+ *
+ * The Dart analyzer emits JSON with this shape:
+ *
+ *   {
+ *     "version": 1,
+ *     "diagnostics": [
+ *       {
+ *         "code": "unused_import",
+ *         "severity": "WARNING",
+ *         "type": "STATIC_WARNING",
+ *         "location": {
+ *           "file": "/absolute/path/to/file.dart",
+ *           "range": {
+ *             "start": { "offset": 7, "line": 1, "column": 8 },
+ *             "end":   { "offset": 16, "line": 1, "column": 17 }
+ *           }
+ *         },
+ *         "problemMessage": "Unused import: 'dart:io'.",
+ *         "correctionMessage": "Try removing the import directive.",
+ *         "documentation": "https://dart.dev/diagnostics/unused_import"
+ *       }
+ *     ]
+ *   }
+ *
+ * Severity mapping:
+ *   - "ERROR"   → SARIF "error"   (30 min effort)
+ *   - "WARNING" → SARIF "warning" (15 min effort)
+ *   - "INFO"    → SARIF "note"    (5 min effort)
+ *
+ * @module adapters/dart-analyzer
+ */
+
+import {
+  type AdapterResult,
+  wrapResultsInSarif,
+  estimateEffortMinutes,
+} from "./common.js";
+import type { SarifLevel } from "../sarif/sarif-builder.js";
+
+// ── Types ──────────────────────────────────────────────────────────
+
+interface DartDiagnosticLocation {
+  file: string;
+  range: {
+    start: { offset: number; line: number; column: number };
+    end: { offset: number; line: number; column: number };
+  };
+}
+
+interface DartDiagnostic {
+  code: string;
+  severity: string;
+  type: string;
+  location: DartDiagnosticLocation;
+  problemMessage: string;
+  correctionMessage?: string;
+  documentation?: string;
+}
+
+interface DartAnalyzeOutput {
+  version: number;
+  diagnostics: DartDiagnostic[];
+}
+
+// ── Severity mapping ───────────────────────────────────────────────
+
+function mapSeverity(dartSeverity: string): SarifLevel {
+  switch (dartSeverity.toUpperCase()) {
+    case "ERROR":
+      return "error";
+    case "WARNING":
+      return "warning";
+    case "INFO":
+      return "note";
+    default:
+      return "warning";
+  }
+}
+
+// ── Effort estimates per severity ──────────────────────────────────
+
+const EFFORT_BY_SEVERITY: Record<SarifLevel, number> = {
+  error: 30,
+  warning: 15,
+  note: 5,
+  none: 0,
+};
+
+// ── Public API ─────────────────────────────────────────────────────
+
+/**
+ * Convert `dart analyze --format=json` output to SARIF 2.1.0.
+ *
+ * @param rawOutput The JSON string or pre-parsed object from `dart analyze`.
+ */
+export function adaptDartAnalyzer(rawOutput: unknown): AdapterResult {
+  let parsed: DartAnalyzeOutput;
+
+  if (typeof rawOutput === "string") {
+    try {
+      parsed = JSON.parse(rawOutput) as DartAnalyzeOutput;
+    } catch {
+      throw new Error("[dart-analyzer adapter] rawOutput is not valid JSON");
+    }
+  } else if (rawOutput && typeof rawOutput === "object" && "diagnostics" in rawOutput) {
+    parsed = rawOutput as DartAnalyzeOutput;
+  } else {
+    throw new Error(
+      "[dart-analyzer adapter] rawOutput must be a JSON string or an object with a 'diagnostics' array",
+    );
+  }
+
+  if (!Array.isArray(parsed.diagnostics)) {
+    throw new Error("[dart-analyzer adapter] 'diagnostics' must be an array");
+  }
+
+  const results: object[] = [];
+  let totalEffortMinutes = 0;
+
+  for (const diag of parsed.diagnostics) {
+    const level = mapSeverity(diag.severity);
+    const effort = EFFORT_BY_SEVERITY[level] ?? estimateEffortMinutes(level);
+    totalEffortMinutes += effort;
+
+    results.push({
+      ruleId: diag.code,
+      level,
+      message: {
+        text: diag.problemMessage + (diag.correctionMessage ? ` ${diag.correctionMessage}` : ""),
+      },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: {
+              uri: diag.location.file,
+            },
+            region: {
+              startLine: diag.location.range.start.line,
+              startColumn: diag.location.range.start.column,
+              endLine: diag.location.range.end.line,
+              endColumn: diag.location.range.end.column,
+            },
+          },
+        },
+      ],
+      properties: {
+        effortMinutes: effort,
+        ...(diag.documentation ? { helpUri: diag.documentation } : {}),
+      },
+    });
+  }
+
+  return {
+    document: wrapResultsInSarif("dart_analyze", "1.0.0", results),
+    sourceTool: "dart_analyze",
+    findingCount: parsed.diagnostics.length,
+    totalEffortMinutes,
+  };
+}

package/src/adapters/index.ts

@@ -30,6 +30,7 @@ export { adaptSemgrep } from "./semgrep.js";
 export { adaptEslint } from "./eslint.js";
 export { adaptBandit } from "./bandit.js";
 export { adaptStryker } from "./stryker.js";
+export { adaptDartAnalyzer } from "./dart-analyzer.js";
 
 export {
   DEFAULT_EFFORT_BY_SEVERITY,
@@ -44,6 +45,7 @@ import { adaptSemgrep } from "./semgrep.js";
 import { adaptEslint } from "./eslint.js";
 import { adaptBandit } from "./bandit.js";
 import { adaptStryker } from "./stryker.js";
+import { adaptDartAnalyzer } from "./dart-analyzer.js";
 import type { AdapterResult, KnownScanner } from "./common.js";
 
 /**
@@ -70,6 +72,8 @@ export function adaptScannerOutput(
       return adaptBandit(rawOutput);
     case "stryker":
       return adaptStryker(rawOutput);
+    case "dart_analyze":
+      return adaptDartAnalyzer(rawOutput);
     default: {
       const exhaustive: never = scanner;
       throw new Error(`[adapters] Unknown scanner: ${String(exhaustive)}`);

package/src/crap-config.ts

@@ -81,6 +81,8 @@ export interface CrapConfig {
   readonly strictness: Strictness;
   /** Where the strictness value actually came from. Useful for diagnostics. */
   readonly strictnessSource: "env" | "file" | "default";
+  /** User-defined exclusion patterns (directories with trailing `/`, or file globs). */
+  readonly exclude: ReadonlyArray<string>;
 }
 
 /**
@@ -107,6 +109,11 @@ export interface LoadCrapConfigOptions {
  * @throws        {@link CrapConfigError} on any invalid input.
  */
 export function loadCrapConfig(options: LoadCrapConfigOptions): CrapConfig {
+  // Always read the file to extract `exclude`, even when strictness
+  // comes from the environment variable.
+  const fileResult = readFromFile(options.workspaceRoot);
+  const exclude = fileResult?.exclude ?? [];
+
   const envRaw = process.env["CLAUDE_CRAP_STRICTNESS"];
   if (typeof envRaw === "string" && envRaw.trim() !== "") {
     const normalized = envRaw.trim().toLowerCase();
@@ -116,13 +123,14 @@ export function loadCrapConfig(options: LoadCrapConfigOptions): CrapConfig {
           `Expected one of: ${STRICTNESS_VALUES.join(", ")}.`,
       );
     }
-    return { strictness: normalized, strictnessSource: "env" };
+    return { strictness: normalized, strictnessSource: "env", exclude };
   }
 
-  const fromFile = readFromFile(options.workspaceRoot);
-  if (fromFile) return { strictness: fromFile, strictnessSource: "file" };
+  if (fileResult?.strictness) {
+    return { strictness: fileResult.strictness, strictnessSource: "file", exclude };
+  }
 
-  return { strictness: DEFAULT_STRICTNESS, strictnessSource: "default" };
+  return { strictness: DEFAULT_STRICTNESS, strictnessSource: "default", exclude };
 }
 
 /**
@@ -138,7 +146,12 @@ export function loadCrapConfig(options: LoadCrapConfigOptions): CrapConfig {
  * @returns             The validated strictness, or `null` when no
  *                      file is present.
  */
-function readFromFile(workspaceRoot: string): Strictness | null {
+interface FileResult {
+  strictness: Strictness | null;
+  exclude: string[];
+}
+
+function readFromFile(workspaceRoot: string): FileResult | null {
   const filePath = join(workspaceRoot, ".claude-crap.json");
   let raw: string;
   try {
@@ -166,22 +179,46 @@ function readFromFile(workspaceRoot: string): Strictness | null {
     );
   }
   const doc = parsed as Record<string, unknown>;
-  if (!("strictness" in doc)) return null;
 
-  const value = doc["strictness"];
-  if (typeof value !== "string") {
-    throw new CrapConfigError(
-      `[crap-config] ${filePath}: 'strictness' must be a string, got ${typeof value}`,
-    );
+  // Parse strictness
+  let strictness: Strictness | null = null;
+  if ("strictness" in doc) {
+    const value = doc["strictness"];
+    if (typeof value !== "string") {
+      throw new CrapConfigError(
+        `[crap-config] ${filePath}: 'strictness' must be a string, got ${typeof value}`,
+      );
+    }
+    const normalized = value.trim().toLowerCase();
+    if (!isStrictness(normalized)) {
+      throw new CrapConfigError(
+        `[crap-config] ${filePath}: 'strictness' is "${value}"; ` +
+          `expected one of ${STRICTNESS_VALUES.join(", ")}.`,
+      );
+    }
+    strictness = normalized;
   }
-  const normalized = value.trim().toLowerCase();
-  if (!isStrictness(normalized)) {
-    throw new CrapConfigError(
-      `[crap-config] ${filePath}: 'strictness' is "${value}"; ` +
-        `expected one of ${STRICTNESS_VALUES.join(", ")}.`,
-    );
+
+  // Parse exclude
+  let exclude: string[] = [];
+  if ("exclude" in doc) {
+    const raw = doc["exclude"];
+    if (!Array.isArray(raw)) {
+      throw new CrapConfigError(
+        `[crap-config] ${filePath}: 'exclude' must be an array of strings`,
+      );
+    }
+    for (const item of raw) {
+      if (typeof item !== "string") {
+        throw new CrapConfigError(
+          `[crap-config] ${filePath}: every entry in 'exclude' must be a string, got ${typeof item}`,
+        );
+      }
+    }
+    exclude = raw as string[];
   }
-  return normalized;
+
+  return { strictness, exclude };
 }
 
 /**

package/src/dashboard/file-detail.ts

@@ -0,0 +1,195 @@
+/**
+ * File detail builder for the dashboard.
+ *
+ * Given a workspace-relative file path, this module produces a rich
+ * detail payload combining source code, per-function AST metrics, and
+ * SARIF findings filtered to that file. The dashboard uses this to
+ * render a ReportGenerator-style annotated code view.
+ *
+ * The builder is extracted into its own module (rather than inlined in
+ * `server.ts`) so that:
+ *   - The logic is unit-testable without booting the HTTP server.
+ *   - The types are importable by both the Fastify route and tests.
+ *
+ * @module dashboard/file-detail
+ */
+
+import { promises as fs } from "node:fs";
+import { resolveWithinWorkspace } from "../workspace-guard.js";
+import { detectLanguageFromPath, type SupportedLanguage } from "../ast/language-config.js";
+import type { TreeSitterEngine, FunctionMetrics } from "../ast/tree-sitter-engine.js";
+import type { SarifStore, IngestedFinding } from "../sarif/sarif-store.js";
+
+// ── Types ─────────────────────────────────────────────────────────
+
+/** Per-function entry in the detail response. */
+export interface FileDetailFunction {
+  readonly name: string;
+  readonly startLine: number;
+  readonly endLine: number;
+  readonly cyclomaticComplexity: number;
+  readonly lineCount: number;
+}
+
+/** Per-finding entry in the detail response. */
+export interface FileDetailFinding {
+  readonly ruleId: string;
+  readonly level: string;
+  readonly message: string;
+  readonly sourceTool: string;
+  readonly startLine: number;
+  readonly startColumn: number;
+  readonly endLine: number;
+  readonly endColumn: number;
+  readonly effortMinutes: number;
+}
+
+/** Summary statistics for the file. */
+export interface FileDetailSummary {
+  readonly totalFindings: number;
+  readonly errorCount: number;
+  readonly warningCount: number;
+  readonly noteCount: number;
+  readonly totalEffortMinutes: number;
+  readonly avgComplexity: number;
+  readonly maxComplexity: number;
+}
+
+/** Full response payload for the file detail endpoint. */
+export interface FileDetailResponse {
+  readonly filePath: string;
+  readonly language: SupportedLanguage | null;
+  readonly physicalLoc: number;
+  readonly logicalLoc: number;
+  readonly cyclomaticMax: number;
+  readonly sourceLines: string[];
+  readonly functions: FileDetailFunction[];
+  readonly findings: FileDetailFinding[];
+  readonly summary: FileDetailSummary;
+}
+
+/** Input accepted by {@link buildFileDetail}. */
+export interface BuildFileDetailInput {
+  readonly relativePath: string;
+  readonly workspaceRoot: string;
+  readonly astEngine?: TreeSitterEngine | undefined;
+  readonly sarifStore: SarifStore;
+  readonly cyclomaticMax: number;
+}
+
+// ── Builder ───────────────────────────────────────────────────────
+
+/**
+ * Build the file detail payload. Pure function aside from the file
+ * read and the tree-sitter analysis (both deterministic for a given
+ * file).
+ *
+ * @throws When the file does not exist or the path escapes the workspace.
+ */
+export async function buildFileDetail(
+  input: BuildFileDetailInput,
+): Promise<FileDetailResponse> {
+  const { relativePath, workspaceRoot, astEngine, sarifStore, cyclomaticMax } = input;
+
+  // 1. Guard against path traversal
+  const absolutePath = resolveWithinWorkspace(workspaceRoot, relativePath);
+
+  // 2. Read source
+  const source = await fs.readFile(absolutePath, "utf8");
+  const sourceLines = source.split(/\r?\n/);
+  // Remove trailing empty line from files ending with \n
+  if (sourceLines.length > 0 && sourceLines[sourceLines.length - 1] === "") {
+    sourceLines.pop();
+  }
+
+  const physicalLoc = sourceLines.length;
+  let logicalLoc = 0;
+  for (const line of sourceLines) {
+    if (line.trim().length > 0) logicalLoc += 1;
+  }
+
+  // 3. AST analysis (if language is supported)
+  const language = detectLanguageFromPath(relativePath);
+  let functions: FileDetailFunction[] = [];
+
+  if (language && astEngine) {
+    try {
+      const metrics = await astEngine.analyzeFile({
+        filePath: absolutePath,
+        language,
+      });
+      functions = metrics.functions.map((fn: FunctionMetrics) => ({
+        name: fn.name,
+        startLine: fn.startLine,
+        endLine: fn.endLine,
+        cyclomaticComplexity: fn.cyclomaticComplexity,
+        lineCount: fn.lineCount,
+      }));
+    } catch {
+      // Analysis failure is non-fatal — return empty functions
+    }
+  }
+
+  // 4. Filter SARIF findings for this file
+  const allFindings = sarifStore.list();
+  const fileFindings = allFindings.filter(
+    (f: IngestedFinding) => f.location.uri === relativePath,
+  );
+
+  const findings: FileDetailFinding[] = fileFindings.map((f: IngestedFinding) => ({
+    ruleId: f.ruleId,
+    level: f.level,
+    message: f.message,
+    sourceTool: f.sourceTool,
+    startLine: f.location.startLine,
+    startColumn: f.location.startColumn,
+    endLine: f.location.endLine ?? f.location.startLine,
+    endColumn: f.location.endColumn ?? 0,
+    effortMinutes:
+      typeof f.properties?.effortMinutes === "number"
+        ? f.properties.effortMinutes
+        : 0,
+  }));
+
+  // 5. Build summary
+  let errorCount = 0;
+  let warningCount = 0;
+  let noteCount = 0;
+  let totalEffortMinutes = 0;
+
+  for (const f of findings) {
+    if (f.level === "error") errorCount += 1;
+    else if (f.level === "warning") warningCount += 1;
+    else if (f.level === "note") noteCount += 1;
+    totalEffortMinutes += f.effortMinutes;
+  }
+
+  const complexities = functions.map((f) => f.cyclomaticComplexity);
+  const maxComplexity = complexities.length > 0 ? Math.max(...complexities) : 0;
+  const avgComplexity =
+    complexities.length > 0
+      ? Math.round(
+          (complexities.reduce((a, b) => a + b, 0) / complexities.length) * 100,
+        ) / 100
+      : 0;
+
+  return {
+    filePath: relativePath,
+    language,
+    physicalLoc,
+    logicalLoc,
+    cyclomaticMax,
+    sourceLines,
+    functions,
+    findings,
+    summary: {
+      totalFindings: findings.length,
+      errorCount,
+      warningCount,
+      noteCount,
+      totalEffortMinutes,
+      avgComplexity,
+      maxComplexity,
+    },
+  };
+}