codeant-cli 0.4.6 → 0.4.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Code review CLI tool",
   "type": "module",
   "bin": {
@@ -27,7 +27,13 @@
     ".": "./src/reviewHeadless.js",
     "./review": "./src/reviewHeadless.js",
     "./push-protection": "./src/utils/installPushProtectionHook.js",
-    "./config": "./src/utils/config.js"
+    "./config": "./src/utils/config.js",
+    "./scans/connection": "./src/scans/connectionHandler.js",
+    "./scans/list-repos": "./src/scans/listRepos.js",
+    "./scans/scan-history": "./src/scans/getScanHistory.js",
+    "./scans/fetch-results": "./src/scans/fetchScanResults.js",
+    "./scans/fetch-advanced-results": "./src/scans/fetchAdvancedScanResults.js",
+    "./scans/dismissed-alerts": "./src/scans/fetchDismissedAlerts.js"
   },
   "files": [
     "src"

package/src/commands/scans/dismissed.js

@@ -0,0 +1,26 @@
+import { fetchDismissedAlerts } from '../../scans/fetchDismissedAlerts.js';
+
+/**
+ * codeant scans dismissed --repo <repo> [--analysis-type security|secrets]
+ */
+export async function runDismissed({ repo, analysisType = 'security' } = {}) {
+  if (!repo) {
+    const err = new Error('--repo is required');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  const result = await fetchDismissedAlerts(repo, analysisType);
+  if (!result.success) {
+    const err = new Error(result.error || 'Failed to fetch dismissed alerts');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  return {
+    repo,
+    analysis_type: analysisType,
+    total: result.dismissedAlerts.length,
+    dismissed_alerts: result.dismissedAlerts,
+  };
+}

package/src/commands/scans/formatters/csv.js

@@ -0,0 +1,24 @@
+const HEADERS = ['id', 'category', 'severity', 'file_path', 'line_number', 'check_id', 'check_name', 'message', 'cwe', 'cve', 'dismissed'];
+
+function csvCell(val) {
+  if (val === null || val === undefined) return '';
+  const s = String(val);
+  if (s.includes(',') || s.includes('"') || s.includes('\n')) {
+    return '"' + s.replace(/"/g, '""') + '"';
+  }
+  return s;
+}
+
+export default {
+  name: 'csv',
+  mime: 'text/csv',
+  extension: '.csv',
+  render(envelope) {
+    const { findings = [] } = envelope;
+    const rows = [HEADERS.join(',')];
+    for (const f of findings) {
+      rows.push(HEADERS.map((h) => csvCell(f[h])).join(','));
+    }
+    return rows.join('\n');
+  },
+};

package/src/commands/scans/formatters/index.js

@@ -0,0 +1,12 @@
+/**
+ * Formatter registry.
+ * Contract: { name, mime, extension, render(envelope) → string }
+ * Add a new format = drop a file in formatters/ + one line here.
+ */
+import json  from './json.js';
+import sarif from './sarif.js';
+import csv   from './csv.js';
+import md    from './md.js';
+import table from './table.js';
+
+export const FORMATTERS = { json, sarif, csv, md, table };

package/src/commands/scans/formatters/json.js

@@ -0,0 +1,8 @@
+export default {
+  name: 'json',
+  mime: 'application/json',
+  extension: '.json',
+  render(envelope) {
+    return JSON.stringify(envelope, null, 2);
+  },
+};

package/src/commands/scans/formatters/md.js

@@ -0,0 +1,63 @@
+const SEV_EMOJI = { critical: '🔴', high: '🟠', medium: '🟡', low: '🔵', info: '⚪', unknown: '⚫' };
+
+export default {
+  name: 'md',
+  mime: 'text/markdown',
+  extension: '.md',
+  render(envelope) {
+    const { findings = [], repo, scan, summary, generated_at, errors = [] } = envelope;
+    const lines = [];
+
+    lines.push(`# CodeAnt Scan Results`);
+    lines.push('');
+    lines.push(`**Repo:** \`${repo}\``);
+    if (scan) {
+      lines.push(`**Branch:** \`${scan.branch || 'unknown'}\`  `);
+      lines.push(`**Commit:** \`${scan.commit_id || 'unknown'}\`  `);
+    }
+    lines.push(`**Generated:** ${generated_at}`);
+    lines.push('');
+
+    // Summary
+    lines.push('## Summary');
+    lines.push('');
+    lines.push(`| Severity | Count |`);
+    lines.push(`|----------|-------|`);
+    for (const [sev, count] of Object.entries(summary.by_severity || {})) {
+      if (count > 0) {
+        lines.push(`| ${SEV_EMOJI[sev] || ''} ${sev} | ${count} |`);
+      }
+    }
+    lines.push('');
+
+    if (errors.length > 0) {
+      lines.push('## Errors');
+      lines.push('');
+      for (const e of errors) {
+        lines.push(`- **${e.category}**: ${e.error}`);
+      }
+      lines.push('');
+    }
+
+    if (findings.length === 0) {
+      lines.push('*No findings.*');
+      return lines.join('\n');
+    }
+
+    lines.push('## Findings');
+    lines.push('');
+    lines.push('| Severity | Category | File | Line | Check | Message |');
+    lines.push('|----------|----------|------|------|-------|---------|');
+
+    for (const f of findings) {
+      const sev = `${SEV_EMOJI[f.severity] || ''} ${f.severity}`;
+      const file = f.file_path;
+      const line = f.line_number;
+      const check = f.check_id || f.check_name || '';
+      const msg = (f.message || '').replace(/\|/g, '\\|').slice(0, 120);
+      lines.push(`| ${sev} | ${f.category} | \`${file}\` | ${line} | \`${check}\` | ${msg} |`);
+    }
+
+    return lines.join('\n');
+  },
+};

package/src/commands/scans/formatters/sarif.js

@@ -0,0 +1,105 @@
+/**
+ * SARIF 2.1.0 formatter.
+ * Spec: https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
+ */
+
+const SEV_TO_SARIF = {
+  critical: 'error',
+  high: 'error',
+  medium: 'warning',
+  low: 'note',
+  info: 'none',
+  unknown: 'none',
+};
+
+export default {
+  name: 'sarif',
+  mime: 'application/sarif+json',
+  extension: '.sarif',
+  render(envelope) {
+    const { findings = [], repo, scan, tool_version } = envelope;
+
+    // Build per-category rule sets
+    const ruleMap = new Map();
+    for (const f of findings) {
+      const key = `${f.category}/${f.check_id || f.check_name}`;
+      if (!ruleMap.has(key)) {
+        ruleMap.set(key, {
+          id: key,
+          name: f.check_name || f.check_id || 'issue',
+          shortDescription: { text: f.check_name || f.check_id || 'issue' },
+          properties: { category: f.category, severity: f.severity },
+        });
+      }
+    }
+
+    const rules = [...ruleMap.values()];
+
+    const results = findings.map((f) => {
+      const ruleId = `${f.category}/${f.check_id || f.check_name}`;
+      const result = {
+        ruleId,
+        level: SEV_TO_SARIF[f.severity] ?? 'warning',
+        message: { text: f.message || f.check_name || 'issue' },
+        locations: [
+          {
+            physicalLocation: {
+              artifactLocation: { uri: f.file_path, uriBaseId: '%SRCROOT%' },
+              region: {
+                startLine: f.line_number || 1,
+                endLine: (f.line_range && f.line_range.length > 1)
+                  ? f.line_range[f.line_range.length - 1]
+                  : f.line_number || 1,
+              },
+            },
+          },
+        ],
+        properties: {
+          findingId: f.id,
+          category: f.category,
+          severity: f.severity,
+          dismissed: f.dismissed,
+        },
+      };
+
+      if (f.cwe) result.taxa = [{ toolComponent: { name: 'CWE' }, id: f.cwe }];
+      if (f.package) result.properties.package = f.package;
+
+      return result;
+    });
+
+    const sarif = {
+      $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
+      version: '2.1.0',
+      runs: [
+        {
+          tool: {
+            driver: {
+              name: 'codeant-cli',
+              version: tool_version || '0.0.0',
+              informationUri: 'https://www.codeant.ai',
+              rules,
+            },
+          },
+          versionControlProvenance: scan
+            ? [
+                {
+                  repositoryUri: repo,
+                  revisionId: scan.commit_id,
+                  branch: scan.branch || undefined,
+                },
+              ]
+            : undefined,
+          results,
+          properties: {
+            repo,
+            generatedAt: envelope.generated_at,
+            schemaVersion: envelope.schema_version,
+          },
+        },
+      ],
+    };
+
+    return JSON.stringify(sarif, null, 2);
+  },
+};

package/src/commands/scans/formatters/table.js

@@ -0,0 +1,83 @@
+// Terminal ASCII table — no external dependencies
+
+let noColor = false;
+export function setNoColor(v) { noColor = v; }
+
+const SEV_COLOR = {
+  critical: '\x1b[35m', // magenta
+  high:     '\x1b[31m', // red
+  medium:   '\x1b[33m', // yellow
+  low:      '\x1b[34m', // blue
+  info:     '\x1b[37m', // white
+  unknown:  '\x1b[90m', // dark gray
+};
+const RESET = '\x1b[0m';
+
+function color(text, code) {
+  if (noColor || !process.stdout.isTTY) return text;
+  return `${code}${text}${RESET}`;
+}
+
+function pad(str, len) {
+  const s = String(str ?? '');
+  return s.length >= len ? s.slice(0, len) : s + ' '.repeat(len - s.length);
+}
+
+const COLS = [
+  { key: 'severity',  label: 'SEVERITY', width: 10 },
+  { key: 'category',  label: 'CATEGORY', width: 17 },
+  { key: 'file_path', label: 'FILE',     width: 40 },
+  { key: 'line_number', label: 'LINE',   width: 6  },
+  { key: 'check_id',  label: 'CHECK',    width: 20 },
+  { key: 'message',   label: 'MESSAGE',  width: 60 },
+];
+
+export default {
+  name: 'table',
+  mime: 'text/plain',
+  extension: '.txt',
+  render(envelope) {
+    const { findings = [], summary, errors = [] } = envelope;
+    const lines = [];
+
+    // Header
+    const sep = COLS.map((c) => '-'.repeat(c.width)).join('-+-');
+    const header = COLS.map((c) => pad(c.label, c.width)).join(' | ');
+    lines.push(sep);
+    lines.push(header);
+    lines.push(sep);
+
+    for (const f of findings) {
+      const sev = f.severity;
+      const cols = COLS.map((c) => {
+        let val = String(f[c.key] ?? '');
+        if (c.key === 'file_path' && val.length > c.width) {
+          val = '…' + val.slice(-(c.width - 1));
+        }
+        val = pad(val, c.width);
+        if (c.key === 'severity') {
+          val = color(val, SEV_COLOR[sev] ?? '');
+        }
+        return val;
+      });
+      lines.push(cols.join(' | '));
+    }
+
+    lines.push(sep);
+    lines.push(`Total: ${summary?.total ?? findings.length}  ` +
+      Object.entries(summary?.by_severity ?? {})
+        .filter(([, n]) => n > 0)
+        .map(([s, n]) => color(`${s}:${n}`, SEV_COLOR[s] ?? ''))
+        .join('  ')
+    );
+
+    if (errors.length > 0) {
+      lines.push('');
+      for (const e of errors) {
+        lines.push(color(`[error] ${e.category}: ${e.error}`, '\x1b[31m'));
+      }
+    }
+
+    return lines.join('\n');
+  },
+};

package/src/commands/scans/get.js

@@ -0,0 +1,64 @@
+import { resolveScan } from './lib/resolveScan.js';
+import { parseTypes } from './lib/categories.js';
+import { normalizeIssue, normalizeSeverity } from './lib/normalize.js';
+import { progress } from './lib/log.js';
+
+const SEV_KEYS = ['critical', 'high', 'medium', 'low', 'info', 'unknown'];
+
+/**
+ * codeant scans get --repo <repo> [--scan <sha>] [--branch <name>] [--types <list>]
+ * Returns metadata + summary (severity/category counts). No findings array.
+ */
+export async function runGet({ repo, scan, branch, types } = {}) {
+  if (!repo) {
+    const err = new Error('--repo is required');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  progress(`resolving scan for ${repo}…`);
+  const scanMeta = await resolveScan({ repo, scan, branch });
+
+  const categories = parseTypes(types);
+  progress(`fetching ${categories.map((c) => c.key).join(', ')}…`);
+
+  const settled = await Promise.allSettled(
+    categories.map((c) => c.fetcher(repo, scanMeta.commit_id))
+  );
+
+  const bySeverity = Object.fromEntries(SEV_KEYS.map((k) => [k, 0]));
+  const byCategory = {};
+  const errors = [];
+  let total = 0;
+
+  for (let i = 0; i < settled.length; i++) {
+    const cat = categories[i];
+    const s = settled[i];
+
+    if (s.status === 'rejected' || !s.value?.success) {
+      const msg = s.status === 'rejected' ? s.reason?.message : s.value?.error;
+      errors.push({ category: cat.key, error: msg || 'unknown error' });
+      byCategory[cat.key] = 0;
+      continue;
+    }
+
+    const issues = s.value.issues || [];
+    byCategory[cat.key] = issues.length;
+    total += issues.length;
+
+    for (const issue of issues) {
+      const normalized = normalizeIssue(issue, cat.key);
+      if (normalized) {
+        bySeverity[normalized.severity] = (bySeverity[normalized.severity] ?? 0) + 1;
+      }
+    }
+  }
+
+  return {
+    repo,
+    scan: scanMeta,
+    categories: categories.map((c) => c.key),
+    summary: { total, by_severity: bySeverity, by_category: byCategory },
+    errors,
+  };
+}

package/src/commands/scans/history.js

@@ -0,0 +1,43 @@
+import { getScanHistory } from '../../scans/getScanHistory.js';
+
+/**
+ * codeant scans history --repo <repo> [--branch <name>] [--since <iso>] [--limit <n>]
+ */
+export async function runHistory({ repo, branch, since, limit = 20 } = {}) {
+  if (!repo) {
+    const err = new Error('--repo is required');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  const result = await getScanHistory(repo);
+  if (!result.success) {
+    const err = new Error(result.error || 'Failed to fetch scan history');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  let history = [...(result.scanHistory || [])].sort(
+    (a, b) => new Date(b.timestamp) - new Date(a.timestamp)
+  );
+
+  if (branch) {
+    history = history.filter((s) => s.branch === branch);
+  }
+
+  if (since) {
+    const sinceDate = new Date(since);
+    if (isNaN(sinceDate)) {
+      const err = new Error(`Invalid --since date: ${since}`);
+      err.exitCode = 1;
+      throw err;
+    }
+    history = history.filter((s) => new Date(s.timestamp) >= sinceDate);
+  }
+
+  if (limit > 0) {
+    history = history.slice(0, limit);
+  }
+
+  return { repo, branch: branch || null, total: history.length, scans: history };
+}

package/src/commands/scans/index.js

@@ -0,0 +1,146 @@
+import { runOrgs } from './orgs.js';
+import { runRepos } from './repos.js';
+import { runHistory } from './history.js';
+import { runGet } from './get.js';
+import { runResults } from './results.js';
+import { runDismissed } from './dismissed.js';
+import { runStartScan } from './start-scan.js';
+import { setQuiet, setNoColor } from './lib/log.js';
+import { setNoColor as tableSetNoColor } from './formatters/table.js';
+
+/**
+ * Register all `codeant scans <verb>` subcommands.
+ *
+ * @param {import('commander').Command} program
+ * @param {{ runCmd: Function }} helpers
+ */
+export default function registerScansCommands(program, { runCmd }) {
+  const scans = program.command('scans').description('Fetch and explore scan results');
+
+  // ── orgs ───────────────────────────────────────────────────────────────────
+  scans
+    .command('orgs')
+    .description('List authenticated organizations')
+    .action(() => runCmd(() => runOrgs()));
+
+  // ── repos ──────────────────────────────────────────────────────────────────
+  scans
+    .command('repos')
+    .description('List repositories')
+    .option('--org <org>', 'Organization name (auto-picked when only one is authenticated)')
+    .action((opts) => runCmd(() => runRepos({ org: opts.org })));
+
+  // ── history ────────────────────────────────────────────────────────────────
+  scans
+    .command('history')
+    .description('Show scan history for a repository')
+    .requiredOption('--repo <repo>', 'Repository (owner/repo)')
+    .option('--branch <name>', 'Filter by branch name')
+    .option('--since <iso>', 'Show scans since ISO date')
+    .option('--limit <n>', 'Max results (default: 20)', parseInt, 20)
+    .action((opts) =>
+      runCmd(() => runHistory({ repo: opts.repo, branch: opts.branch, since: opts.since, limit: opts.limit }))
+    );
+
+  // ── get ────────────────────────────────────────────────────────────────────
+  scans
+    .command('get')
+    .description('Scan metadata + severity/category summary (no findings)')
+    .requiredOption('--repo <repo>', 'Repository (owner/repo)')
+    .option('--scan <sha>', 'Specific commit SHA to use')
+    .option('--branch <name>', 'Resolve latest scan on this branch')
+    .option('--types <list>', 'Comma-separated scan types (default: all)', 'all')
+    .option('--quiet', 'Suppress progress output')
+    .action((opts) => {
+      setQuiet(opts.quiet);
+      runCmd(() => runGet({ repo: opts.repo, scan: opts.scan, branch: opts.branch, types: opts.types }));
+    });
+
+  // ── results ────────────────────────────────────────────────────────────────
+  scans
+    .command('results')
+    .description('Fetch full scan findings')
+    .requiredOption('--repo <repo>', 'Repository (owner/repo)')
+    .option('--scan <sha>', 'Specific commit SHA to use')
+    .option('--branch <name>', 'Resolve latest scan on this branch')
+    .option(
+      '--types <list>',
+      'Comma-separated types: sast,sca,secrets,iac,dead_code,sbom,anti_patterns,docstring,complex_functions,all',
+      'all'
+    )
+    .option('--severity <list>', 'Filter by severity (e.g. critical,high)')
+    .option('--path <glob>', 'Filter by file path glob')
+    .option('--check <regex>', 'Filter by check ID or name (regex)')
+    .option('--include-dismissed', 'Include dismissed findings (excluded by default)')
+    .option('--format <fmt>', 'Output format: json|sarif|csv|md|table (default: json)', 'json')
+    .option('--output <path>', 'Write output to file instead of stdout')
+    .option('--fields <list>', 'Project findings to subset of fields (comma-separated)')
+    .option('--limit <n>', 'Max findings per page (default: 100)', parseInt, 100)
+    .option('--offset <n>', 'Pagination offset (default: 0)', parseInt, 0)
+    .option('--fail-fast', 'Exit 3 on first category fetch failure')
+    .option('--no-color', 'Disable ANSI color (auto-disabled when not a TTY)')
+    .option('--quiet', 'Suppress progress output on stderr')
+    .action(async (opts) => {
+      setQuiet(opts.quiet);
+      if (opts.noColor) {
+        setNoColor(true);
+        tableSetNoColor(true);
+      }
+
+      try {
+        await runResults({
+          repo: opts.repo,
+          scan: opts.scan,
+          branch: opts.branch,
+          types: opts.types,
+          severity: opts.severity,
+          path: opts.path,
+          check: opts.check,
+          includeDismissed: opts.includeDismissed || false,
+          format: opts.format,
+          output: opts.output,
+          fields: opts.fields,
+          limit: opts.limit,
+          offset: opts.offset,
+          failFast: opts.failFast || false,
+        });
+      } catch (err) {
+        process.stderr.write(JSON.stringify({ error: err.message }) + '\n');
+        process.exit(err.exitCode ?? 1);
+      }
+    });
+
+  // ── dismissed ──────────────────────────────────────────────────────────────
+  scans
+    .command('dismissed')
+    .description('List dismissed alerts for a repository')
+    .requiredOption('--repo <repo>', 'Repository (owner/repo)')
+    .option('--analysis-type <type>', 'Analysis type: security|secrets (default: security)', 'security')
+    .action((opts) =>
+      runCmd(() => runDismissed({ repo: opts.repo, analysisType: opts.analysisType }))
+    );
+
+  // ── start-scan ─────────────────────────────────────────────────────────────
+  scans
+    .command('start-scan')
+    .description('Trigger a new analysis run for a repository')
+    .option('--repo <repo>', 'Repository (owner/repo, auto-detected from git remote)')
+    .option('--branch <name>', 'Branch to scan (auto-detected from current checkout)')
+    .option('--commit <sha>', 'Commit SHA to scan (resolved from remote if omitted)')
+    .option('--include <paths>', 'Comma-separated file path glob patterns to include')
+    .option('--exclude <paths>', 'Comma-separated file path glob patterns to exclude')
+    .action(async (opts) => {
+      try {
+        await runStartScan({
+          repo: opts.repo,
+          branch: opts.branch,
+          commit: opts.commit,
+          include: opts.include,
+          exclude: opts.exclude,
+        });
+      } catch (err) {
+        process.stderr.write(JSON.stringify({ error: err.message }) + '\n');
+        process.exit(err.exitCode ?? 1);
+      }
+    });
+}

package/src/commands/scans/lib/categories.js

@@ -0,0 +1,51 @@
+import {
+  fetchSastResults,
+  fetchAntiPatternsResults,
+  fetchDocstringResults,
+  fetchComplexFunctionsResults,
+} from '../../../scans/fetchScanResults.js';
+import {
+  fetchScaResults,
+  fetchSbomResults,
+  fetchSecretsResults,
+  fetchIacResults,
+  fetchDeadCodeResults,
+} from '../../../scans/fetchAdvancedScanResults.js';
+
+/**
+ * Category registry. Add one row to support a new scan type throughout the CLI.
+ * kind: 'code' | 'package' | 'inventory' | 'secret' | 'config'
+ */
+export const CATEGORIES = {
+  sast:              { fetcher: fetchSastResults,             kind: 'code' },
+  anti_patterns:     { fetcher: fetchAntiPatternsResults,     kind: 'code' },
+  docstring:         { fetcher: fetchDocstringResults,        kind: 'code' },
+  complex_functions: { fetcher: fetchComplexFunctionsResults, kind: 'code' },
+  sca:               { fetcher: fetchScaResults,              kind: 'package' },
+  sbom:              { fetcher: fetchSbomResults,             kind: 'inventory' },
+  secrets:           { fetcher: fetchSecretsResults,          kind: 'secret' },
+  iac:               { fetcher: fetchIacResults,              kind: 'config' },
+  dead_code:         { fetcher: fetchDeadCodeResults,         kind: 'code' },
+};
+
+/**
+ * Parse comma-separated --types value. 'all' expands to every key.
+ * Returns array of { key, fetcher, kind }.
+ * Throws with exit code 1 on unknown type name.
+ */
+export function parseTypes(typesStr) {
+  const keys = Object.keys(CATEGORIES);
+  const raw = typesStr ? typesStr.split(',').map((s) => s.trim()).filter(Boolean) : ['all'];
+
+  const expanded = raw.includes('all') ? keys : raw;
+
+  const unknown = expanded.filter((k) => !CATEGORIES[k]);
+  if (unknown.length > 0) {
+    const err = new Error(`Unknown type(s): ${unknown.join(', ')}. Valid: ${keys.join(', ')}`);
+    err.exitCode = 1;
+    err.detail = { error: `Unknown type(s): ${unknown.join(', ')}`, valid: keys };
+    throw err;
+  }
+
+  return expanded.map((k) => ({ key: k, ...CATEGORIES[k] }));
+}