code-auditor-mcp 3.6.0 → 3.8.0

package/dist/pipelineAdapters.js

@@ -21,6 +21,7 @@ import { RULE_REGISTRY } from './analyzers/ruleRegistry.js';
 import { TYPESCRIPT_EXTENSIONS, JAVASCRIPT_EXTENSIONS, getLanguageFromPath } from './utils/fileDiscovery.js';
 import { walkAST, isExported, getLineAndColumn, calculateComplexity, getFunctionBody, } from './languages/adapterBridge.js';
 import { buildImportMap, extractFunctionCalls, } from './utils/dependencyExtractor.js';
+import { resolveDependency, basenameNoExt } from './graph/importGraph.js';
 import { isReactComponent, detectComponentType, getComponentName, } from './utils/reactDetection.js';
 import { findTableReferences, checkNamingConventions, checkQueryPatterns, checkSQLInjection, getNearestTableSuggestions, } from './analyzers/universal/schema/codeAnalysis.js';
 import { passesFileGate, extractTablesFromRegistry, } from './analyzers/universal/schema/discovery.js';
@@ -125,6 +126,23 @@ export function createDocumentationVisitor() {
         category: 'style',
     };
 }
+// ── Secrets visitor ──────────────────────────────────────────────────────────
+export function createSecretsVisitor() {
+    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSecretsAnalyzer.js').then((m) => new m.UniversalSecretsAnalyzer()));
+    return {
+        name: 'secrets',
+        stage: 'visitor',
+        getRuleIds: () => getRuleIdsFor('secrets'),
+        async visit(ast, adapter, context, sourceCode) {
+            const a = await getAnalyzer();
+            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
+            return { violations, facts: {} };
+        },
+        defaultConfig: {},
+        description: 'Detects hardcoded credentials, API keys, and tokens',
+        category: 'security',
+    };
+}
 // ── Function-Index visitor (infrastructure) ──────────────────────────────────
 // Always-on Stage 2 visitor that populates the `functions` table with
 // per-file definitions so the conventions and cross-domain reducers have data
@@ -861,7 +879,7 @@ export function createConventionsReducer() {
 // ── Cross-Domain reducer (stage 4) ───────────────────────────────────────────
 /**
  * Cross-domain reducer — runs written-never-read, read-never-written,
- * transaction-boundary risk, validation-bypass, and uncovered-risk detectors.
+ * transaction-boundary risk, no-validator-reachable, and uncovered-risk detectors.
  * Uses analyzer.analyze([]) with rawDb injected.
  */
 export function createCrossDomainReducer() {
@@ -980,7 +998,7 @@ function clCollectCallees(raw) {
     walk(raw);
     return [...names];
 }
-function clMakeFunction(filePath, lang, name, line, signature, purpose, params, callees, exported, complexity) {
+function clMakeFunction(filePath, lang, name, line, signature, purpose, params, callees, exported, complexity, isMethod = false) {
     return {
         id: clEntityId(filePath, 'function', name, line),
         name,
@@ -997,9 +1015,49 @@ function clMakeFunction(filePath, lang, name, line, signature, purpose, params,
         purpose,
         context: '',
         searchTokens: [name.toLowerCase()],
-        metadata: { callees },
+        metadata: { callees, isMethod },
     };
 }
+/**
+ * Collect a file's import specifiers and whether it declares any exports.
+ *
+ * Feeds file-level reachability: an `import_statement` (TS/JS) or
+ * `import_declaration` (Go) records a dependency; an `export_statement`
+ * (TS/JS) records that the file exposes symbols to importers. Go exports are
+ * computed separately from the extracted entities (capitalized top-level
+ * names), since Go has no `export` keyword.
+ */
+function clCollectFileInfo(root, lang) {
+    const imports = new Set();
+    let hasExports = false;
+    walkAST(root, (node) => {
+        const raw = node.raw;
+        if (node.type === 'import_statement') {
+            const source = clRawField(raw, 'source');
+            if (source?.text)
+                imports.add(source.text.replace(/^['"]|['"]$/g, ''));
+        }
+        else if (node.type === 'import_declaration') {
+            for (const spec of raw?.namedChildren ?? []) {
+                if (spec.type === 'import_spec') {
+                    const p = clRawField(spec, 'path');
+                    if (p?.text)
+                        imports.add(p.text.replace(/^['"]|['"]$/g, ''));
+                }
+            }
+        }
+        else if (node.type === 'export_statement') {
+            hasExports = true;
+            // Re-exports (`export { x } from './y'`, `export * from './y'`) are import
+            // edges for reachability: a barrel re-exporting a module marks it live,
+            // not dead. The `source` field is present only on the `from` form.
+            const source = clRawField(raw, 'source');
+            if (source?.text)
+                imports.add(source.text.replace(/^['"]|['"]$/g, ''));
+        }
+    });
+    return { imports: [...imports], hasExports };
+}
 // ── TS/JS extraction ─────────────────────────────────────────────────────────
 function clExtractTSParams(raw) {
     const params = [];
@@ -1055,7 +1113,7 @@ function clExtractTSEntities(root, filePath, sourceCode, lang, out) {
                 }
             }
             const line = (raw?.startPosition?.row ?? 0) + 1;
-            out.push(clMakeFunction(filePath, lang, displayName, line, clSignatureText(raw, sourceCode) || raw?.text || '', clBodyText(raw, sourceCode), clExtractTSParams(raw), clCollectCallees(raw), isExported(node), calculateComplexity(node)));
+            out.push(clMakeFunction(filePath, lang, displayName, line, clSignatureText(raw, sourceCode) || raw?.text || '', clBodyText(raw, sourceCode), clExtractTSParams(raw), clCollectCallees(raw), isExported(node), calculateComplexity(node), node.type === 'method_definition'));
             return;
         }
         if (node.type === 'variable_declarator') {
@@ -1222,9 +1280,15 @@ export function createCrossLanguageEntityVisitor() {
             else {
                 clExtractTSEntities(root, filePath, sourceCode, lang, entities);
             }
+            const fileInfo = clCollectFileInfo(root, lang);
+            // Go has no `export` keyword — an exported symbol is a capitalized
+            // top-level name, which the entity extractor already records as public.
+            const hasExports = lang === 'go'
+                ? entities.some((e) => e.visibility === 'public')
+                : fileInfo.hasExports;
             return {
                 violations: [],
-                facts: { [filePath]: { entities } },
+                facts: { [filePath]: { entities, imports: fileInfo.imports, hasExports } },
             };
         },
         defaultConfig: {},
@@ -1244,6 +1308,86 @@ function clFlattenEntities(allFacts) {
     }
     return entities;
 }
+/** Extract per-file `{ imports, hasExports }` from the cross-language facts. */
+function clFileFacts(allFacts) {
+    const facts = allFacts['cross-language-entities'];
+    const map = new Map();
+    if (!facts)
+        return map;
+    for (const [filePath, data] of Object.entries(facts)) {
+        if (!data)
+            continue;
+        map.set(filePath, { imports: data.imports ?? [], hasExports: data.hasExports ?? false });
+    }
+    return map;
+}
+function clIsTestFile(fp) {
+    const lower = fp.toLowerCase();
+    return lower.includes('.test.') || lower.includes('.spec.') ||
+        lower.includes('__tests__') || lower.includes('/test/') || lower.includes('/tests/') ||
+        lower.endsWith('_test.go');
+}
+// Files the framework loads directly rather than via an import from sibling
+// code. Skipped when flagging unreferenced modules — a route/page/entry file
+// that nothing imports is an entry point, not dead code.
+const CL_ENTRY_BASENAMES = new Set([
+    'route', 'page', 'layout', 'loading', 'error', 'not-found', 'template', 'default',
+    'middleware', 'instrumentation', 'server', 'client', 'cli', 'main', 'app', 'index', 'worker',
+    'setup', 'seed',
+]);
+function clIsEntryPointFile(fp) {
+    const segments = fp.replace(/\\/g, '/').split('/').filter(Boolean);
+    const base = segments[segments.length - 1] ?? '';
+    const stem = base.replace(/\.[^.]+$/, '');
+    if (CL_ENTRY_BASENAMES.has(stem))
+        return true;
+    if (stem.endsWith('.config'))
+        return true; // next.config, vite.config, tailwind.config, …
+    const joined = '/' + segments.join('/') + '/';
+    if (joined.includes('/app/api/') || joined.includes('/pages/api/'))
+        return true;
+    if (joined.includes('/scripts/') || joined.includes('/bin/') || joined.includes('/cmd/'))
+        return true;
+    return false;
+}
+/**
+ * Compute file-level reachability from per-file imports.
+ *
+ * A file is a framework entry point (live → 1.0), imported by another file
+ * (live → 0.5), or referenced by nothing (dead → 0.0). The resolver mirrors
+ * importGraph.ts and handles relative paths, npm/alias basenames, and fuzzy
+ * path-segment matches.
+ */
+function clComputeReachability(fileFacts) {
+    const filePaths = new Set(fileFacts.keys());
+    const moduleToFile = new Map();
+    for (const fp of filePaths) {
+        const bn = basenameNoExt(fp);
+        if (!moduleToFile.has(bn))
+            moduleToFile.set(bn, new Set());
+        moduleToFile.get(bn).add(fp);
+    }
+    const importersOf = new Map();
+    for (const [fp, info] of fileFacts) {
+        for (const dep of info.imports) {
+            const targets = resolveDependency(dep, filePaths, moduleToFile, fp);
+            for (const t of targets) {
+                if (t === fp)
+                    continue;
+                if (!importersOf.has(t))
+                    importersOf.set(t, new Set());
+                importersOf.get(t).add(fp);
+            }
+        }
+    }
+    const reachability = new Map();
+    for (const fp of filePaths) {
+        const entry = clIsEntryPointFile(fp);
+        const imported = (importersOf.get(fp)?.size ?? 0) > 0;
+        reachability.set(fp, entry ? 1 : imported ? 0.5 : 0);
+    }
+    return { reachability, importersOf };
+}
 /**
  * Build `calls` cross-references by resolving each entity's extracted callee
  * names against the corpus entity name index. Library calls (fetch, map, …)
@@ -1407,6 +1551,30 @@ export function createDependencyGraphReducer() {
                 const idToEntity = new Map(entities.map((e) => [e.id, e]));
                 const violations = [];
                 for (const issue of health.issues) {
+                    if (issue.type === 'orphaned-nodes') {
+                        // Emit one violation per orphan so each is attributed to its own
+                        // file/line. The aggregated form anchored every orphan to the first
+                        // node's location while the message listed all of them — foreign
+                        // symbols leaked into the wrong file.
+                        for (const id of issue.affectedNodes) {
+                            const orphan = idToEntity.get(id);
+                            if (!orphan)
+                                continue;
+                            violations.push({
+                                file: orphan.file,
+                                line: orphan.startLine,
+                                severity: issue.severity,
+                                message: `Orphaned node "${orphan.name}" has no connections.`,
+                                rule: issue.type,
+                                type: issue.type, // dependency-graph rules match on field: 'type'
+                                analyzer: 'dependency-graph',
+                                category: 'cross-language-dependency',
+                                functionName: orphan.name,
+                                details: { orphanId: id },
+                            });
+                        }
+                        continue;
+                    }
                     const anchor = issue.affectedNodes.map((id) => idToEntity.get(id)).find(Boolean);
                     violations.push({
                         file: anchor?.file ?? '(unknown)',
@@ -1420,6 +1588,61 @@ export function createDependencyGraphReducer() {
                         details: issue.details,
                     });
                 }
+                // ── File-level reachability: unreferenced modules + ranking axis ──
+                const fileFacts = clFileFacts(allFacts);
+                if (fileFacts.size > 0) {
+                    const { reachability, importersOf } = clComputeReachability(fileFacts);
+                    // Persist reachability to graph_cache so the post-pipeline reorder
+                    // (auditRunner hotspot block) can rank every finding by live/dead.
+                    if (context.indexHandle?.rawDb) {
+                        try {
+                            const db = context.indexHandle.rawDb;
+                            const del = db.prepare("DELETE FROM graph_cache WHERE graph_type = 'reachability'");
+                            const ins = db.prepare("INSERT OR REPLACE INTO graph_cache (graph_type, node_key, neighbor_key, weight) VALUES ('reachability', ?, '', ?)");
+                            const tx = db.transaction(() => {
+                                del.run();
+                                for (const [fp, score] of reachability) {
+                                    ins.run(fp, score);
+                                }
+                            });
+                            tx();
+                        }
+                        catch {
+                            // Reachability persistence is advisory — ranking falls back to a
+                            // neutral default without it.
+                        }
+                    }
+                    // Flag files that export symbols yet are imported by nothing and are
+                    // not framework entry points — a dead module. This is the signal the
+                    // orphaned-nodes check missed: a whole unreferenced file whose every
+                    // internal symbol still forms a connected component.
+                    for (const [fp, info] of fileFacts) {
+                        if (!info.hasExports)
+                            continue;
+                        if (clIsTestFile(fp))
+                            continue;
+                        if (clIsEntryPointFile(fp))
+                            continue;
+                        if ((importersOf.get(fp)?.size ?? 0) > 0)
+                            continue;
+                        violations.push({
+                            file: fp,
+                            line: 1,
+                            // Promoted suggestion → warning (Spec 11 R5, one tier). The
+                            // method-dispatch fix removed the class-prefixed / isMethod false
+                            // positives, so a module that exports and is imported by nothing
+                            // is a genuine dead-module signal — a defect that should block,
+                            // not a suggestion to weigh. Validated across four corpora.
+                            severity: 'warning',
+                            message: 'Module is not imported by any other file and is not a framework entry point — dead code candidate.',
+                            rule: 'unreferenced-module',
+                            type: 'unreferenced-module',
+                            analyzer: 'dependency-graph',
+                            category: 'cross-language-dependency',
+                            details: { imports: info.imports },
+                        });
+                    }
+                }
                 for (const s of health.suggestions) {
                     violations.push({
                         file: '(multiple)',