codeant-cli 0.3.3 → 0.3.5

package/src/utils/reviewApiHelper.js

@@ -0,0 +1,291 @@
+import CommonApiHelper from './commonApiHelper.js';
+import path from 'path';
+import fs from 'fs';
+import { minimatch } from 'minimatch';
+
+const MAX_REVIEW_FILES = 10;
+const MAX_FILE_LINES = 5000;
+const MAX_FILE_SIZE_BYTES = 200 * 1024; // 200 KB
+
+const EXCLUDED_FILENAMES = new Set([
+  'package-lock.json',
+  'yarn.lock',
+  'pnpm-lock.yaml',
+  'composer.lock',
+  'Gemfile.lock',
+  'Cargo.lock',
+  'poetry.lock',
+  'Pipfile.lock',
+  'go.sum',
+  '.DS_Store',
+  'Thumbs.db',
+]);
+
+const EXCLUDED_EXTENSIONS = new Set([
+  // Images
+  '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.ico', '.svg', '.webp', '.avif',
+  // Fonts
+  '.woff', '.woff2', '.ttf', '.eot', '.otf',
+  // Binary / compiled
+  '.exe', '.dll', '.so', '.dylib', '.bin', '.o', '.a', '.class', '.pyc', '.pyo',
+  '.wasm', '.jar', '.war', '.ear',
+  // Archives
+  '.zip', '.tar', '.gz', '.bz2', '.7z', '.rar',
+  // Media
+  '.mp3', '.mp4', '.wav', '.avi', '.mov', '.flv', '.wmv', '.ogg', '.webm',
+  // Data / generated
+  '.min.js', '.min.css', '.map',
+  '.pb', '.proto.bin',
+  // PDF / docs
+  '.pdf', '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx',
+  // Data / config (often large, auto-generated)
+  '.csv', '.tsv', '.parquet', '.avro', '.ndjson',
+  // Database
+  '.sqlite', '.db',
+]);
+
+function matchesPatterns(filePath, includePatterns, excludePatterns) {
+  if (includePatterns.length > 0) {
+    const included = includePatterns.some(pattern => minimatch(filePath, pattern, { matchBase: true }));
+    if (!included) return false;
+  }
+  if (excludePatterns.length > 0) {
+    const excluded = excludePatterns.some(pattern => minimatch(filePath, pattern, { matchBase: true }));
+    if (excluded) return false;
+  }
+  return true;
+}
+
+function isReviewableFile(filePath) {
+  const basename = path.basename(filePath);
+
+  if (EXCLUDED_FILENAMES.has(basename)) return false;
+
+  const ext = path.extname(basename).toLowerCase();
+  if (EXCLUDED_EXTENSIONS.has(ext)) return false;
+
+  // Check for .min.js / .min.css (double extension)
+  if (basename.endsWith('.min.js') || basename.endsWith('.min.css')) return false;
+
+  return true;
+}
+
+/**
+ * Transforms git diff data into the format expected by the agentic review API
+ */
+class ReviewApiHelper extends CommonApiHelper {
+  /**
+   * Pass structured diffs through so buildReviewApiRequest can filter them
+   */
+  _transformDiffsToApiFormat(diffs) {
+    return diffs;
+  }
+
+  /**
+   * Build the complete request body for the agentic review API
+   */
+  async buildReviewApiRequest(type = 'staged-only', includePatterns = [], excludePatterns = [], options = {}) {
+    const diffs = await this.getFilesForType(type, options);
+
+    // diffs is either a string (from getAllDiffs) or an array of structured diff objects
+    if (typeof diffs === 'string') {
+      // Split the raw diff into per-file sections and filter out deleted files
+      const gitRoot = this.getGitRoot() || process.cwd();
+      const fileContents = {};
+      const fileSections = diffs.split(/(?=^diff --git )/m).filter(Boolean);
+      const keptSections = [];
+      const skipped = [];
+
+      for (const section of fileSections) {
+        const nameMatch = section.match(/^diff --git a\/.+ b\/(.+)$/m);
+        if (!nameMatch) continue;
+        const f = nameMatch[1];
+        if (!isReviewableFile(f)) {
+          skipped.push({ file: f, reason: 'binary/generated' });
+          continue;
+        }
+        // Apply user-specified --include/--exclude glob patterns
+        if (!matchesPatterns(f, includePatterns, excludePatterns)) {
+          skipped.push({ file: f, reason: 'excluded by pattern' });
+          continue;
+        }
+
+        // Skip deleted files — no file content to review, diff alone isn't actionable
+        if (/deleted file mode/m.test(section) || /\+\+\+ \/dev\/null/m.test(section)) {
+          skipped.push({ file: f, reason: 'deleted' });
+          continue;
+        }
+
+        // Skip files exceeding size or line limits to avoid blowing up the AI context window
+        try {
+          const fullPath = path.resolve(gitRoot, f);
+          if (fs.existsSync(fullPath)) {
+            const stats = fs.statSync(fullPath);
+            if (stats.size > MAX_FILE_SIZE_BYTES) {
+              skipped.push({ file: f, reason: `too large (${(stats.size / 1024).toFixed(0)} KB, max ${MAX_FILE_SIZE_BYTES / 1024} KB)` });
+              continue;
+            }
+            const content = fs.readFileSync(fullPath, 'utf-8');
+            const lineCount = content.split('\n').length;
+            if (lineCount > MAX_FILE_LINES) {
+              skipped.push({ file: f, reason: `too large (${lineCount} lines, max ${MAX_FILE_LINES})` });
+              continue;
+            }
+            keptSections.push(section);
+            fileContents[f] = content;
+          } else {
+            keptSections.push(section);
+          }
+        } catch {
+          // Skip files that can't be read
+        }
+      }
+
+      const reviewedFiles = Object.keys(fileContents);
+      return {
+        diff_content: keptSections.join(''),
+        file_contents: fileContents,
+        _meta: {
+          reviewed_files: reviewedFiles,
+          total_changed: fileSections.length,
+          skipped,
+          capped: false,
+          max_files: MAX_REVIEW_FILES,
+        },
+      };
+    }
+
+    // Filter and track skipped files
+    const skipped = [];
+    const allUniqueFiles = new Set(diffs.map(d => d.filename_str));
+    const reviewable = [];
+
+    for (const d of diffs) {
+      if (!isReviewableFile(d.filename_str)) {
+        skipped.push({ file: d.filename_str, reason: 'binary/generated' });
+        continue;
+      }
+      if (d.edit_type_str === 'DELETED') {
+        skipped.push({ file: d.filename_str, reason: 'deleted' });
+        continue;
+      }
+      if (!matchesPatterns(d.filename_str, includePatterns, excludePatterns)) {
+        skipped.push({ file: d.filename_str, reason: 'excluded by pattern' });
+        continue;
+      }
+      reviewable.push(d);
+    }
+
+    // Dedupe skipped entries
+    const seenSkipped = new Set();
+    const dedupedSkipped = skipped.filter(s => {
+      if (seenSkipped.has(s.file)) return false;
+      seenSkipped.add(s.file);
+      return true;
+    });
+
+    // Dedupe by filename, keeping all hunks, but limit unique files to MAX_REVIEW_FILES
+    const fileOrder = [];
+    const fileHunks = new Map();
+    let capped = false;
+    for (const d of reviewable) {
+      const f = d.filename_str;
+      if (!fileHunks.has(f)) {
+        if (fileOrder.length >= MAX_REVIEW_FILES) {
+          capped = true;
+          if (!seenSkipped.has(f)) {
+            dedupedSkipped.push({ file: f, reason: `exceeded ${MAX_REVIEW_FILES}-file limit` });
+            seenSkipped.add(f);
+          }
+          continue;
+        }
+        fileOrder.push(f);
+        fileHunks.set(f, []);
+      }
+      fileHunks.get(f).push(d);
+    }
+
+    // Reconstruct a combined diff string from the filtered hunks
+    const parts = [];
+    for (const f of fileOrder) {
+      const hunks = fileHunks.get(f);
+      // Build a file-level diff header + all hunk patches
+      const header = `diff --git a/${f} b/${f}\n--- a/${f}\n+++ b/${f}`;
+      const hunkPatches = hunks.map(h => h.patch_str).filter(Boolean);
+      if (hunkPatches.length > 0) {
+        parts.push(header + '\n' + hunkPatches.join('\n'));
+      }
+    }
+
+    // Use head_file_str from diffs so file content matches the diff version (avoids working tree mismatch for --last-commit etc.)
+    const fileContents = {};
+    const skippedLargeFiles = new Set();
+    for (const f of fileOrder) {
+      const hunks = fileHunks.get(f);
+      const content = hunks[0]?.head_file_str || '';
+      if (content) {
+        const contentSize = Buffer.byteLength(content, 'utf-8');
+        if (contentSize > MAX_FILE_SIZE_BYTES) {
+          skippedLargeFiles.add(f);
+          dedupedSkipped.push({ file: f, reason: `too large (${(contentSize / 1024).toFixed(0)} KB, max ${MAX_FILE_SIZE_BYTES / 1024} KB)` });
+          continue;
+        }
+        const lineCount = content.split('\n').length;
+        if (lineCount > MAX_FILE_LINES) {
+          skippedLargeFiles.add(f);
+          dedupedSkipped.push({ file: f, reason: `too large (${lineCount} lines, max ${MAX_FILE_LINES})` });
+          continue;
+        }
+        fileContents[f] = content;
+      }
+    }
+
+    // Remove diff sections for skipped files
+    const filteredParts = parts.filter((_, i) => !skippedLargeFiles.has(fileOrder[i]));
+
+    const reviewedFiles = fileOrder.filter(f => !skippedLargeFiles.has(f));
+    return {
+      diff_content: filteredParts.join('\n'),
+      file_contents: fileContents,
+      _meta: {
+        reviewed_files: reviewedFiles,
+        total_changed: allUniqueFiles.size,
+        skipped: dedupedSkipped,
+        capped,
+        max_files: MAX_REVIEW_FILES,
+      },
+    };
+  }
+
+  /**
+   * Split a combined review request into per-file payloads.
+   * Each payload has a single file's diff and content.
+   */
+  static splitIntoPerFileRequests(requestBody) {
+    if (!requestBody?.diff_content?.length) return [];
+
+    const fileSections = requestBody.diff_content.split(/(?=^diff --git )/m).filter(Boolean);
+    const perFileRequests = [];
+
+    for (const section of fileSections) {
+      const nameMatch = section.match(/^diff --git a\/.+ b\/(.+)$/m);
+      if (!nameMatch) continue;
+      const filename = nameMatch[1];
+
+      const fileContents = {};
+      if (requestBody.file_contents?.[filename]) {
+        fileContents[filename] = requestBody.file_contents[filename];
+      }
+
+      perFileRequests.push({
+        diff_content: section,
+        file_contents: fileContents,
+        _filename: filename,
+      });
+    }
+
+    return perFileRequests;
+  }
+}
+
+export default ReviewApiHelper;

package/src/utils/scmAuth.js

@@ -0,0 +1,136 @@
+import { execSync } from 'child_process';
+import { getConfigValue } from './config.js';
+
+/**
+ * Resolves auth tokens and base URLs for each SCM platform.
+ * Priority: env var → platform CLI → ~/.codeant/config.json → auto-detect from git origin
+ */
+
+function tryExec(cmd) {
+  try {
+    return execSync(cmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+  } catch {
+    return null;
+  }
+}
+
+// ─── Auto-detect host from git remote origin ───
+
+const PUBLIC_HOSTS = {
+  'github.com': 'github',
+  'gitlab.com': 'gitlab',
+  'bitbucket.org': 'bitbucket',
+  'dev.azure.com': 'azure',
+  'visualstudio.com': 'azure',
+};
+
+let _originInfo = undefined; // cached
+
+function getOriginInfo() {
+  if (_originInfo !== undefined) return _originInfo;
+  _originInfo = null;
+  try {
+    const origin = execSync('git remote get-url origin', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+
+    // Parse host from SSH (git@host:owner/repo) or HTTPS (https://host/owner/repo)
+    let host = null;
+    const sshMatch = origin.match(/^[^@]+@([^:]+):/);
+    const httpsMatch = origin.match(/^https?:\/\/([^/]+)/);
+    if (sshMatch) host = sshMatch[1];
+    else if (httpsMatch) host = httpsMatch[1];
+
+    if (!host) return _originInfo;
+
+    // Determine platform from host
+    let platform = null;
+    for (const [publicHost, p] of Object.entries(PUBLIC_HOSTS)) {
+      if (host === publicHost || host.endsWith('.' + publicHost)) {
+        platform = p;
+        break;
+      }
+    }
+    // Heuristic for self-hosted: check if hostname contains platform name
+    if (!platform) {
+      if (host.includes('github')) platform = 'github';
+      else if (host.includes('gitlab')) platform = 'gitlab';
+      else if (host.includes('bitbucket')) platform = 'bitbucket';
+      else if (host.includes('azure') || host.includes('visualstudio')) platform = 'azure';
+    }
+
+    const isPublic = Object.keys(PUBLIC_HOSTS).some(h => host === h);
+    const baseUrl = isPublic ? null : `https://${host}`;
+
+    _originInfo = { host, platform, baseUrl, origin };
+  } catch {}
+  return _originInfo;
+}
+
+function detectBaseUrlForPlatform(platform) {
+  const info = getOriginInfo();
+  if (info && info.platform === platform && info.baseUrl) return info.baseUrl;
+  return null;
+}
+
+// ─── Token resolvers ───
+
+export function getGitHubToken() {
+  return process.env.GITHUB_TOKEN
+    || process.env.GH_TOKEN
+    || tryExec('gh auth token')
+    || getConfigValue('githubToken')
+    || null;
+}
+
+export function getGitLabToken() {
+  return process.env.GITLAB_TOKEN
+    || tryExec('glab auth token 2>/dev/null')
+    || getConfigValue('gitlabToken')
+    || null;
+}
+
+export function getBitbucketToken() {
+  return process.env.BITBUCKET_TOKEN
+    || getConfigValue('bitbucketToken')
+    || null;
+}
+
+export function getAzureDevOpsToken() {
+  return process.env.AZURE_DEVOPS_TOKEN
+    || process.env.AZURE_DEVOPS_PAT
+    || getConfigValue('azureDevOpsToken')
+    || null;
+}
+
+export function getTokenForRemote(remote) {
+  switch (remote) {
+    case 'github': return getGitHubToken();
+    case 'gitlab': return getGitLabToken();
+    case 'bitbucket': return getBitbucketToken();
+    case 'azure': return getAzureDevOpsToken();
+    default: throw new Error(`Unknown remote: ${remote}. Use: github, gitlab, bitbucket, azure`);
+  }
+}
+
+// ─── Base URL resolvers for self-hosted instances ───
+// Priority: env var → config → auto-detect from git origin
+
+export function getGitHubBaseUrl() {
+  return process.env.GITHUB_API_URL
+    || process.env.GH_ENTERPRISE_URL
+    || getConfigValue('githubBaseUrl')
+    || detectBaseUrlForPlatform('github');
+}
+
+export function getGitLabBaseUrl() {
+  return process.env.GITLAB_URL
+    || process.env.GITLAB_HOST
+    || getConfigValue('gitlabBaseUrl')
+    || detectBaseUrlForPlatform('gitlab');
+}
+
+export function getBitbucketBaseUrl() {
+  return process.env.BITBUCKET_URL
+    || process.env.BITBUCKET_SERVER_URL
+    || getConfigValue('bitbucketBaseUrl')
+    || detectBaseUrlForPlatform('bitbucket');
+}

package/src/utils/secretsApiHelper.js

@@ -0,0 +1,252 @@
+import CommonApiHelper from './commonApiHelper.js';
+import path from 'path';
+import { minimatch } from 'minimatch';
+
+/**
+ * Transforms git diff data into the format expected by the secrets detection API
+ *
+ * API Input Format:
+ * {
+ *   "files": [
+ *     {
+ *       "file_path": str,
+ *       "code": str,
+ *       "diffs": [{ "start_line": int, "end_line": int }]
+ *     }
+ *   ]
+ * }
+ */
+
+const EXCLUDED_FILENAMES = new Set([
+  'package-lock.json',
+  'yarn.lock',
+  'pnpm-lock.yaml',
+  'composer.lock',
+  'Gemfile.lock',
+  'Cargo.lock',
+  'poetry.lock',
+  'Pipfile.lock',
+  'go.sum',
+  '.DS_Store',
+  'Thumbs.db',
+]);
+
+const EXCLUDED_EXTENSIONS = new Set([
+  // Images
+  '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.ico', '.svg', '.webp', '.avif',
+  // Fonts
+  '.woff', '.woff2', '.ttf', '.eot', '.otf',
+  // Binary / compiled
+  '.exe', '.dll', '.so', '.dylib', '.bin', '.o', '.a', '.class', '.pyc', '.pyo',
+  '.wasm', '.jar', '.war', '.ear',
+  // Archives
+  '.zip', '.tar', '.gz', '.bz2', '.7z', '.rar',
+  // Media
+  '.mp3', '.mp4', '.wav', '.avi', '.mov', '.flv', '.wmv', '.ogg', '.webm',
+  // Data / generated
+  '.min.js', '.min.css', '.map',
+  '.pb', '.proto.bin',
+  // PDF / docs
+  '.pdf', '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx',
+  // Data / config (often large, auto-generated)
+  '.parquet', '.avro',
+  // Database
+  '.sqlite', '.db',
+]);
+
+const MAX_FILE_LINES = 5000;
+const MAX_FILE_SIZE_BYTES = 200 * 1024; // 200 KB
+
+function isScannableFile(filePath) {
+  const basename = path.basename(filePath);
+
+  if (EXCLUDED_FILENAMES.has(basename)) return false;
+
+  const ext = path.extname(basename).toLowerCase();
+  if (EXCLUDED_EXTENSIONS.has(ext)) return false;
+
+  if (basename.endsWith('.min.js') || basename.endsWith('.min.css')) return false;
+
+  // Skip markdown files
+  if (ext === '.md') return false;
+
+  return true;
+}
+
+class SecretsApiHelper extends CommonApiHelper {
+  /**
+   * Transform diff info array to API format
+   * Groups by file and extracts diff ranges
+   */
+  _transformDiffsToApiFormat(diffs) {
+    // Group diffs by filename
+    const fileMap = new Map();
+
+    for (const diff of diffs) {
+      const filePath = diff.filename_str;
+
+      // Skip diffs with missing or invalid filename
+      if (!filePath) {
+        continue;
+      }
+
+      if (!fileMap.has(filePath)) {
+        fileMap.set(filePath, {
+          file_path: filePath,
+          code: diff.head_file_str || '',
+          diffs: []
+        });
+      }
+
+      // Add diff range if available
+      if (diff.start_line_str && diff.end_line_str) {
+        const startLine = parseInt(diff.start_line_str, 10);
+        const endLine = parseInt(diff.end_line_str, 10);
+
+        if (!isNaN(startLine) && !isNaN(endLine)) {
+          fileMap.get(filePath).diffs.push({
+            start_line: startLine,
+            end_line: endLine
+          });
+        }
+      }
+    }
+
+    return Array.from(fileMap.values());
+  }
+
+  /**
+   * Filter files based on include and exclude glob patterns
+   * @param {Array} files - Array of file objects with 'file_path' property
+   * @param {Array} includePatterns - Array of glob pattern strings to include
+   * @param {Array} excludePatterns - Array of glob pattern strings to exclude
+   */
+  _filterFiles(files, includePatterns = [], excludePatterns = []) {
+    return files.filter(fileObj => {
+      const filePath = fileObj.file_path;
+
+      // If include patterns are specified, file must match at least one
+      if (includePatterns.length > 0) {
+        const matchesInclude = includePatterns.some(pattern => {
+          try {
+            if (pattern instanceof RegExp) {
+              return pattern.test(filePath);
+            }
+            return minimatch(filePath, pattern, { matchBase: true });
+          } catch (e) {
+            console.warn(`Invalid include pattern: ${pattern}`, e.message);
+            return false;
+          }
+        });
+
+        if (!matchesInclude) {
+          return false;
+        }
+      }
+
+      // If exclude patterns are specified, file must not match any
+      if (excludePatterns.length > 0) {
+        const matchesExclude = excludePatterns.some(pattern => {
+          try {
+            if (pattern instanceof RegExp) {
+              return pattern.test(filePath);
+            }
+            return minimatch(filePath, pattern, { matchBase: true });
+          } catch (e) {
+            console.warn(`Invalid exclude pattern: ${pattern}`, e.message);
+            return false;
+          }
+        });
+
+        if (matchesExclude) {
+          return false;
+        }
+      }
+
+      return true;
+    });
+  }
+
+  /**
+   * Build the complete request body for the secrets API
+   * @param {string} type - Type of scan (staged-only, branch-diff, etc.)
+   * @param {Array} includePatterns - Optional array of glob patterns to include files
+   * @param {Array} excludePatterns - Optional array of glob patterns to exclude files
+   * @param {Object} options - Additional options like lastNCommits
+   */
+  async buildSecretsApiRequest(type = 'staged-only', includePatterns = [], excludePatterns = [], options = {}) {
+    let files = await this.getFilesForType(type, options);
+
+    // Handle null/undefined return
+    if (!files || !Array.isArray(files)) {
+      files = [];
+    }
+
+    const totalChanged = files.length;
+    const skipped = [];
+
+    // Filter out non-scannable files (binary, lock files, markdown, etc.)
+    files = files.filter(fileObj => {
+      const filePath = fileObj.file_path;
+
+      if (!isScannableFile(filePath)) {
+        skipped.push({ file: filePath, reason: 'binary/generated' });
+        return false;
+      }
+
+      // Skip test files — backend filters these out anyway
+      if (filePath.toLowerCase().includes('test')) {
+        skipped.push({ file: filePath, reason: 'test file' });
+        return false;
+      }
+
+      // Skip deleted files (empty code)
+      if (fileObj.code === '' || fileObj.code === undefined) {
+        skipped.push({ file: filePath, reason: 'deleted' });
+        return false;
+      }
+
+      // Skip files exceeding size or line limits
+      if (fileObj.code) {
+        const contentSize = Buffer.byteLength(fileObj.code, 'utf-8');
+        if (contentSize > MAX_FILE_SIZE_BYTES) {
+          skipped.push({ file: filePath, reason: `too large (${(contentSize / 1024).toFixed(0)} KB, max ${MAX_FILE_SIZE_BYTES / 1024} KB)` });
+          return false;
+        }
+        const lineCount = fileObj.code.split('\n').length;
+        if (lineCount > MAX_FILE_LINES) {
+          skipped.push({ file: filePath, reason: `too large (${lineCount} lines, max ${MAX_FILE_LINES})` });
+          return false;
+        }
+      }
+
+      return true;
+    });
+
+    // Apply include/exclude filters
+    const beforePatternFilter = files.length;
+    files = this._filterFiles(files, includePatterns, excludePatterns);
+
+    // Track pattern-excluded files
+    if (files.length < beforePatternFilter) {
+      // We don't have exact file names for pattern-excluded, but the count is in skipped
+      const patternExcluded = beforePatternFilter - files.length;
+      if (patternExcluded > 0) {
+        skipped.push({ file: `${patternExcluded} file(s)`, reason: 'excluded by pattern' });
+      }
+    }
+
+    const scannedFiles = files.map(f => f.file_path);
+
+    return {
+      files,
+      _meta: {
+        scanned_files: scannedFiles,
+        total_changed: totalChanged,
+        skipped,
+      },
+    };
+  }
+}
+
+export default SecretsApiHelper;