codeant-cli 0.2.3 → 0.2.5

package/src/index.js

@@ -9,8 +9,6 @@ import SetBaseUrl from './commands/setBaseUrl.js';
 import GetBaseUrl from './commands/getBaseUrl.js';
 import Login from './commands/login.js';
 import Logout from './commands/logout.js';
-import StaticAnalysis from './commands/staticAnalysis.js';
-import SecurityAnalysis from './commands/securityAnalysis.js';
 import Review from './commands/review.js';
 import Welcome from './components/Welcome.js';
 import * as scm from './scm/index.js';
@@ -51,67 +49,39 @@ if (process.argv.length === 2) {
 program
   .command('secrets')
   .description('Scan for secrets in your code')
-  .option('--staged', 'Scan only staged files (default)')
-  .option('--all', 'Scan all changed files')
-  .option('--uncommitted', 'Scan uncommitted changes')
-  .option('--last-commit', 'Scan last commit')
-  .option('--last-n-commits <n>', 'Scan last n commits (max 5)', parseInt)
-  .option('--fail-on <level>', 'Fail only on HIGH, MEDIUM, or all (default: HIGH)', 'HIGH')
-  .option('--include <paths>', 'Comma-separated list of file paths regex to include')
-  .option('--exclude <paths>', 'Comma-separated list of file paths regex to exclude')
-  .action((options) => {
-    let scanType = 'staged-only';
-    let lastNCommits = 1;
-
-    // Check !== undefined, not truthy — passing 0 is valid and shouldn't fall through
-    if (options.lastNCommits !== undefined) {
-      scanType = 'last-n-commits';
-      lastNCommits = Math.min(Math.max(1, options.lastNCommits), 5);
-    } else if (options.all) {
-      scanType = 'branch-diff';
-    } else if (options.uncommitted) {
-      scanType = 'uncommitted';
-    } else if (options.lastCommit) {
-      scanType = 'last-commit';
-    }
-
-    const include = options.include
-      ? (Array.isArray(options.include) ? options.include : splitGlobs(options.include))
-      : [];
-
-    const exclude = options.exclude
-      ? (Array.isArray(options.exclude) ? options.exclude : splitGlobs(options.exclude))
-      : [];
-
-    const failOn = options.failOn?.toUpperCase() || 'HIGH';
-
-    render(React.createElement(Secrets, { scanType, failOn, include, exclude, lastNCommits }));
-  });
-
-program
-  .command('static-analysis')
-  .description('Run static analysis on your code')
-  .option('--staged', 'Scan only staged files (default)')
-  .option('--all', 'Scan all changed files')
-  .option('--uncommitted', 'Scan uncommitted changes')
+  .option('--all', 'Scan committed + uncommitted changes (default)')
+  .option('--committed', 'Scan only unpushed commits')
+  .option('--uncommitted', 'Scan only uncommitted changes (staged + unstaged + untracked)')
+  .option('--staged', 'Scan only staged files')
   .option('--last-commit', 'Scan last commit')
   .option('--last-n-commits <n>', 'Scan last n commits (max 5)', parseInt)
+  .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
+  .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
   .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
-  .option('--auto-fix', 'Automatically apply fixes when available')
-  .option('--include <paths>', 'Comma-separated list of file paths regex to include')
-  .option('--exclude <paths>', 'Comma-separated list of file paths regex to exclude')
+  .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
+  .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
   .action((options) => {
-    let scanType = 'staged-only';
+    let scanType = 'all';
     let lastNCommits = 1;
+    let baseBranch = null;
+    let baseCommit = null;
 
+    if (options.base) {
+      scanType = 'base-branch';
+      baseBranch = options.base;
+    } else if (options.baseCommit) {
+      scanType = 'base-commit';
+      baseCommit = options.baseCommit;
     // Check !== undefined, not truthy — passing 0 is valid and shouldn't fall through
-    if (options.lastNCommits !== undefined) {
+    } else if (options.lastNCommits !== undefined) {
       scanType = 'last-n-commits';
       lastNCommits = Math.min(Math.max(1, options.lastNCommits), 5);
-    } else if (options.all) {
-      scanType = 'branch-diff';
+    } else if (options.committed) {
+      scanType = 'committed';
     } else if (options.uncommitted) {
       scanType = 'uncommitted';
+    } else if (options.staged) {
+      scanType = 'staged-only';
     } else if (options.lastCommit) {
       scanType = 'last-commit';
     }
@@ -125,48 +95,8 @@ program
       : [];
 
     const failOn = options.failOn?.toUpperCase() || 'CRITICAL';
-    const autoFix = options.autoFix || false;
-    render(React.createElement(StaticAnalysis, {scanType, failOn, include, exclude, autoFix, lastNCommits}));
-  });
-
-program
-  .command('security-analysis')
-  .description('Run security analysis on your code')
-  .option('--staged', 'Scan only staged files (default)')
-  .option('--all', 'Scan all changed files')
-  .option('--uncommitted', 'Scan uncommitted changes')
-  .option('--last-commit', 'Scan last commit')
-  .option('--last-n-commits <n>', 'Scan last n commits (max 5)', parseInt)
-  .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
-  .option('--include <paths>', 'Comma-separated list of file paths regex to include')
-  .option('--exclude <paths>', 'Comma-separated list of file paths regex to exclude')
-  .action((options) => {
-    let scanType = 'staged-only';
-    let lastNCommits = 1;
-
-    // Check !== undefined, not truthy — passing 0 is valid and shouldn't fall through
-    if (options.lastNCommits !== undefined) {
-      scanType = 'last-n-commits';
-      lastNCommits = Math.min(Math.max(1, options.lastNCommits), 5);
-    } else if (options.all) {
-      scanType = 'branch-diff';
-    } else if (options.uncommitted) {
-      scanType = 'uncommitted';
-    } else if (options.lastCommit) {
-      scanType = 'last-commit';
-    }
-
-    const include = options.include
-      ? (Array.isArray(options.include) ? options.include : splitGlobs(options.include))
-      : [];
-
-    const exclude = options.exclude
-      ? (Array.isArray(options.exclude) ? options.exclude : splitGlobs(options.exclude))
-      : [];
-
-    const failOn = options.failOn?.toUpperCase() || 'HIGH';
 
-    render(React.createElement(SecurityAnalysis, { scanType, failOn, include, exclude, lastNCommits }));
+    render(React.createElement(Secrets, { scanType, failOn, include, exclude, lastNCommits, baseBranch, baseCommit }));
   });
 
 program

package/src/utils/secretsApiHelper.js

@@ -1,4 +1,5 @@
 import CommonApiHelper from './commonApiHelper.js';
+import path from 'path';
 import { minimatch } from 'minimatch';
 
 /**
@@ -15,6 +16,58 @@ import { minimatch } from 'minimatch';
  *   ]
  * }
  */
+
+const EXCLUDED_FILENAMES = new Set([
+  'package-lock.json',
+  'yarn.lock',
+  'pnpm-lock.yaml',
+  'composer.lock',
+  'Gemfile.lock',
+  'Cargo.lock',
+  'poetry.lock',
+  'Pipfile.lock',
+  'go.sum',
+  '.DS_Store',
+  'Thumbs.db',
+]);
+
+const EXCLUDED_EXTENSIONS = new Set([
+  // Images
+  '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.ico', '.svg', '.webp', '.avif',
+  // Fonts
+  '.woff', '.woff2', '.ttf', '.eot', '.otf',
+  // Binary / compiled
+  '.exe', '.dll', '.so', '.dylib', '.bin', '.o', '.a', '.class', '.pyc', '.pyo',
+  '.wasm', '.jar', '.war', '.ear',
+  // Archives
+  '.zip', '.tar', '.gz', '.bz2', '.7z', '.rar',
+  // Media
+  '.mp3', '.mp4', '.wav', '.avi', '.mov', '.flv', '.wmv', '.ogg', '.webm',
+  // Data / generated
+  '.min.js', '.min.css', '.map',
+  '.pb', '.proto.bin',
+  // PDF / docs
+  '.pdf', '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx',
+]);
+
+const MAX_FILE_LINES = 5000;
+
+function isScannableFile(filePath) {
+  const basename = path.basename(filePath);
+
+  if (EXCLUDED_FILENAMES.has(basename)) return false;
+
+  const ext = path.extname(basename).toLowerCase();
+  if (EXCLUDED_EXTENSIONS.has(ext)) return false;
+
+  if (basename.endsWith('.min.js') || basename.endsWith('.min.css')) return false;
+
+  // Skip markdown files
+  if (ext === '.md') return false;
+
+  return true;
+}
+
 class SecretsApiHelper extends CommonApiHelper {
   /**
    * Transform diff info array to API format
@@ -124,10 +177,65 @@ class SecretsApiHelper extends CommonApiHelper {
       files = [];
     }
 
+    const totalChanged = files.length;
+    const skipped = [];
+
+    // Filter out non-scannable files (binary, lock files, markdown, etc.)
+    files = files.filter(fileObj => {
+      const filePath = fileObj.file_path;
+
+      if (!isScannableFile(filePath)) {
+        skipped.push({ file: filePath, reason: 'binary/generated' });
+        return false;
+      }
+
+      // Skip test files — backend filters these out anyway
+      if (filePath.toLowerCase().includes('test')) {
+        skipped.push({ file: filePath, reason: 'test file' });
+        return false;
+      }
+
+      // Skip deleted files (empty code)
+      if (fileObj.code === '' || fileObj.code === undefined) {
+        skipped.push({ file: filePath, reason: 'deleted' });
+        return false;
+      }
+
+      // Skip files exceeding line limit
+      if (fileObj.code) {
+        const lineCount = fileObj.code.split('\n').length;
+        if (lineCount > MAX_FILE_LINES) {
+          skipped.push({ file: filePath, reason: `too large (${lineCount} lines, max ${MAX_FILE_LINES})` });
+          return false;
+        }
+      }
+
+      return true;
+    });
+
     // Apply include/exclude filters
+    const beforePatternFilter = files.length;
     files = this._filterFiles(files, includePatterns, excludePatterns);
 
-    return { files };
+    // Track pattern-excluded files
+    if (files.length < beforePatternFilter) {
+      // We don't have exact file names for pattern-excluded, but the count is in skipped
+      const patternExcluded = beforePatternFilter - files.length;
+      if (patternExcluded > 0) {
+        skipped.push({ file: `${patternExcluded} file(s)`, reason: 'excluded by pattern' });
+      }
+    }
+
+    const scannedFiles = files.map(f => f.file_path);
+
+    return {
+      files,
+      _meta: {
+        scanned_files: scannedFiles,
+        total_changed: totalChanged,
+        skipped,
+      },
+    };
   }
 }
 

package/src/commands/securityAnalysis.js

@@ -1,284 +0,0 @@
-import React, { useEffect, useState } from 'react';
-import { Box, Text, useApp } from 'ink';
-import { getConfigValue } from '../utils/config.js';
-import { fetchApi } from '../utils/fetchApi.js';
-import SecurityAnalysisApiHelper from '../utils/securityAnalysisApiHelper.js';
-
-export default function SecurityAnalysis({ scanType = 'staged-only', failOn = 'HIGH', include = [], exclude = [], lastNCommits = 1 }) {
-  const { exit } = useApp();
-  const [status, setStatus] = useState('initializing');
-  const [issues, setIssues] = useState([]);
-  const [error, setError] = useState(null);
-  const [fileCount, setFileCount] = useState(0);
-
-  const apiKey = getConfigValue('apiKey');
-
-  // Handle not logged in state
-  useEffect(() => {
-    if (!apiKey) {
-      const id = setTimeout(() => exit(new Error('Not logged in')), 0);
-      return () => clearTimeout(id);
-    }
-  }, [apiKey, exit]);
-
-  // Check if logged in
-  if (!apiKey) {
-    return React.createElement(
-      Box,
-      { flexDirection: 'column', padding: 1 },
-      React.createElement(Text, { color: 'red' }, '✗ Not logged in.'),
-      React.createElement(Text, { color: 'gray' }, 'Run "codeant login" to authenticate.'),
-    );
-  }
-
-  // Helper to check if an issue should cause failure based on failOn level
-  const shouldFailOn = (severity) => {
-    const score = severity?.toUpperCase();
-    if (score === 'FALSE_POSITIVE') return false;
-    if (failOn === 'CRITICAL') return score === 'CRITICAL';
-    if (failOn === 'HIGH') return score === 'HIGH' || score === 'CRITICAL';
-    if (failOn === 'MEDIUM') return score === 'HIGH' || score === 'MEDIUM';
-    return true; // 'all' - fail on any non-false-positive
-  };
-
-  useEffect(() => {
-    let cancelled = false;
-
-    async function scanForIssues() {
-      try {
-        if (cancelled) return;
-        setStatus('scanning');
-
-        // Initialize git helper and get staged files
-        const helper = new SecurityAnalysisApiHelper(process.cwd());
-        await helper.init();
-
-        if (cancelled) return;
-        const requestBody = await helper.buildSecurityAnalysisApiRequest(scanType, include, exclude, { lastNCommits });
-        if (cancelled) return;
-
-        if (requestBody.files.length === 0) {
-          if (!cancelled) setStatus('no_files');
-          return;
-        }
-
-        // Call the security analysis API
-        const response = await fetchApi(
-          '/extension/pr-review/security-analysis',
-          'POST',
-          requestBody,
-        );
-
-        if (cancelled) return;
-
-        // Transform security issues response to the expected format
-        const detectedIssues = (response.securityIssues || []).map(file => ({
-          file_path: file.file_path,
-          issues: (file.security_issues || []).map(issue => ({
-            line_number: issue.line_number,
-            end_line: issue.end_line,
-            type: issue.issue_text,
-            confidence_score: issue.false_positive ? 'FALSE_POSITIVE' : issue.severity,
-            test_id: issue.test_id,
-            confidence: issue.confidence,
-            likelihood: issue.likelihood,
-            cwe: issue.cwe,
-            owasp: issue.owasp,
-          })),
-        }));
-
-        // Filter to only include files with actual issues
-        const filesWithIssues = detectedIssues.filter(
-          file => file.issues && file.issues.length > 0,
-        );
-
-        if (!cancelled) {
-          setIssues(filesWithIssues);
-          setStatus('done');
-        }
-      } catch (err) {
-        if (!cancelled) {
-          setError(err.message);
-          setStatus('error');
-        }
-      }
-    }
-
-    scanForIssues();
-
-    return () => {
-      cancelled = true;
-    };
-  }, [scanType, include, exclude, lastNCommits]);
-
-  // Handle exit after status changes
-  useEffect(() => {
-    if (status === 'done') {
-      // Check if any issues should cause failure based on failOn level
-      const hasBlockingIssues = issues.some(file =>
-        file.issues.some(issue => issue.false_positive !== true &&shouldFailOn(issue.severity)),
-      );
-
-      if (hasBlockingIssues) {
-        setTimeout(() => {
-          process.exitCode = 1;
-          exit(new Error('Security issues detected'));
-        }, 100);
-      } else {
-        setTimeout(() => exit(), 100);
-      }
-    } else if (status === 'no_files') {
-      setTimeout(() => exit(), 100);
-    } else if (status === 'error') {
-      setTimeout(() => exit(new Error(error)), 100);
-    }
-  }, [status, issues]);
-
-  // Render: Initializing
-  if (status === 'initializing') {
-    return React.createElement(
-      Box,
-      { flexDirection: 'column', padding: 1 },
-      React.createElement(Text, { color: 'cyan' }, 'Initializing...'),
-    );
-  }
-
-  // Render: Scanning
-  if (status === 'scanning') {
-    return React.createElement(
-      Box,
-      { flexDirection: 'column', padding: 1 },
-      React.createElement(Text, { color: 'cyan' }, `Scanning ${fileCount} file(s) for security issues...`),
-    );
-  }
-
-  // Render: No files to scan
-  if (status === 'no_files') {
-    const noFilesMessages = {
-      'staged-only': 'Stage some changes first with "git add".',
-      'branch-diff': 'No changes found compared to the base branch.',
-      'uncommitted': 'No uncommitted changes found.',
-      'last-commit': 'No files found in the last commit.',
-    };
-
-    return React.createElement(
-      Box,
-      { flexDirection: 'column', padding: 1 },
-      React.createElement(Text, { color: 'yellow' }, 'No files to scan.'),
-      React.createElement(Text, { color: 'gray' }, noFilesMessages[scanType] || 'No files found.'),
-    );
-  }
-
-  // Render: Error
-  if (status === 'error') {
-    return React.createElement(
-      Box,
-      { flexDirection: 'column', padding: 1 },
-      React.createElement(Text, { color: 'red' }, '✗ Error: ', error),
-    );
-  }
-
-  // Render: Done with issues found
-  if (status === 'done' && issues.length > 0) {
-    const allIssues = issues.flatMap(file =>
-      file.issues.map(s => ({ ...s, file_path: file.file_path })),
-    );
-
-    const blockingIssues = allIssues.filter(s => s.false_positive !== true && shouldFailOn(s.severity));
-    const falsePositives = allIssues.filter(s => s.false_positive !== true && !shouldFailOn(s.severity));
-
-    const hasBlockingIssues = blockingIssues.length > 0;
-
-    // Group by file for display
-    const groupByFile = (issuesList) => {
-      const grouped = {};
-      issuesList.forEach(s => {
-        if (!grouped[s.file_path]) grouped[s.file_path] = [];
-        grouped[s.file_path].push(s);
-      });
-      return grouped;
-    };
-
-    const blockingByFile = groupByFile(blockingIssues);
-    const falsePositivesByFile = groupByFile(falsePositives);
-
-    const elements = [
-      // Header
-      React.createElement(
-        Text,
-        { key: 'header', color: hasBlockingIssues ? 'red' : 'yellow', bold: true },
-        hasBlockingIssues
-          ? `✗ ${blockingIssues.length} security issue(s) found!`
-          : `⚠ ${falsePositives.length} potential security issue(s) found (ignored)`,
-      ),
-      React.createElement(Text, { key: 'spacer1' }, ''),
-    ];
-
-    // Blocking issues
-    if (blockingIssues.length > 0) {
-      Object.entries(blockingByFile).forEach(([filePath, fileIssues]) => {
-        elements.push(
-          React.createElement(Text, { key: `file-${filePath}`, color: 'yellow', bold: true }, filePath),
-        );
-        fileIssues.forEach((issue, idx) => {
-          elements.push(
-            React.createElement(
-              Text,
-              { key: `issue-${filePath}-${idx}`, color: 'red' },
-              `  Line ${issue.line_number}: ${issue.type} (${issue.confidence_score})`,
-            ),
-          );
-        });
-      });
-    }
-
-    // False positives / ignored
-    if (falsePositives.length > 0) {
-      if (blockingIssues.length > 0) {
-        elements.push(React.createElement(Text, { key: 'spacer2' }, ''));
-      }
-      elements.push(
-        React.createElement(Text, { key: 'fp-header', color: 'gray' }, 'Ignored (false positives):'),
-      );
-      Object.entries(falsePositivesByFile).forEach(([filePath, fileIssues]) => {
-        elements.push(
-          React.createElement(Text, { key: `fp-file-${filePath}`, color: 'gray' }, `  ${filePath}`),
-        );
-        fileIssues.forEach((issue, idx) => {
-          elements.push(
-            React.createElement(
-              Text,
-              { key: `fp-issue-${filePath}-${idx}`, color: 'gray', dimColor: true },
-              `    Line ${issue.line_number}: ${issue.type} (${issue.confidence_score})`,
-            ),
-          );
-        });
-      });
-    }
-
-    elements.push(React.createElement(Text, { key: 'spacer3' }, ''));
-
-    if (hasBlockingIssues) {
-      elements.push(
-        React.createElement(Text, { key: 'footer', color: 'gray' }, 'Fix security issues before committing.'),
-      );
-    } else {
-      elements.push(
-        React.createElement(Text, { key: 'footer', color: 'green' }, '✓ Commit allowed (only false positives found)'),
-      );
-    }
-
-    return React.createElement(
-      Box,
-      { flexDirection: 'column', padding: 1 },
-      ...elements,
-    );
-  }
-
-  // Render: Done with no issues
-  return React.createElement(
-    Box,
-    { flexDirection: 'column', padding: 1 },
-    React.createElement(Text, { color: 'green' }, '✓ No security issues found'),
-  );
-}