codeant-cli 0.4.6 → 0.4.8

package/src/commands/scans/lib/dismissMatch.js

@@ -0,0 +1,32 @@
+/**
+ * Determine if a NormalizedFinding matches any entry in dismissedAlerts.
+ *
+ * Dismiss key format: "file_path||::||context_code_block_or_line||::||test_id_or_type"
+ *
+ * @param {object} finding - NormalizedFinding
+ * @param {Array}  dismissedAlerts - from fetchDismissedAlerts()
+ * @returns {object|null} matching dismiss entry, or null
+ */
+export function findDismissMatch(finding, dismissedAlerts) {
+  if (!dismissedAlerts || dismissedAlerts.length === 0) return null;
+
+  for (const d of dismissedAlerts) {
+    // File path must match (tail-match to handle prefix stripping differences)
+    const fp = finding.file_path ?? '';
+    const dfp = d.file_path ?? '';
+    if (dfp && fp && !fp.endsWith(dfp) && !dfp.endsWith(fp) && fp !== dfp) continue;
+
+    // test_id / type must match check_id when present
+    if (d.test_id && finding.check_id && d.test_id !== finding.check_id) continue;
+
+    // Line number match when available (secrets format uses line_number as part1)
+    if (d.line_number != null && finding.line_number != null && Number(d.line_number) !== Number(finding.line_number)) continue;
+
+    return d;
+  }
+  return null;
+}
+
+export function isDismissed(finding, dismissedAlerts) {
+  return findDismissMatch(finding, dismissedAlerts) !== null;
+}

package/src/commands/scans/lib/emit.js

@@ -0,0 +1,25 @@
+import fs from 'fs';
+import path from 'path';
+
+/**
+ * Emit rendered content.
+ * - If outputPath is set: write bytes to file, print JSON envelope to stdout.
+ * - Otherwise: write to stdout.
+ *
+ * @param {string} content      - rendered string
+ * @param {string|null} outputPath
+ * @param {number} findingsCount - for the file envelope
+ */
+export function emit(content, outputPath, findingsCount = 0) {
+  if (outputPath) {
+    const resolved = path.resolve(outputPath);
+    fs.writeFileSync(resolved, content, 'utf8');
+    const bytes = Buffer.byteLength(content, 'utf8');
+    process.stdout.write(
+      JSON.stringify({ output: resolved, bytes, findings: findingsCount }, null, 2) + '\n'
+    );
+  } else {
+    process.stdout.write(content);
+    if (!content.endsWith('\n')) process.stdout.write('\n');
+  }
+}

package/src/commands/scans/lib/filters.js

@@ -0,0 +1,72 @@
+import { minimatch } from 'minimatch';
+import { isDismissed, findDismissMatch } from './dismissMatch.js';
+import { normalizeSeverity } from './normalize.js';
+
+const SEV_RANK = { critical: 5, high: 4, medium: 3, low: 2, info: 1, unknown: 0 };
+
+/**
+ * Apply all filters to findings in-place (returns new array).
+ *
+ * @param {Array} findings - NormalizedFinding[]
+ * @param {object} opts
+ * @param {string[]|null} opts.severity  - allowed severity levels (e.g. ['critical','high'])
+ * @param {string|null}   opts.pathGlob  - minimatch glob for file_path
+ * @param {string|null}   opts.checkRegex - regex applied to check_id + check_name
+ * @param {Array}         opts.dismissedAlerts - from fetchDismissedAlerts()
+ * @param {boolean}       opts.includeDismissed
+ * @returns {Array} filtered NormalizedFinding[] (dismissed field annotated)
+ */
+export function applyFilters(findings, {
+  severity = null,
+  pathGlob = null,
+  checkRegex = null,
+  dismissedAlerts = [],
+  includeDismissed = false,
+} = {}) {
+  // Pre-compile regex — strip Python/PCRE inline flag (?i) and fold into JS flag
+  let checkRe = null;
+  if (checkRegex) {
+    try {
+      let pattern = checkRegex;
+      if (pattern.startsWith('(?i)')) pattern = pattern.slice(4);
+      checkRe = new RegExp(pattern, 'i');
+    } catch {
+      const err = new Error(`Invalid --check regex: ${checkRegex}`);
+      err.exitCode = 1;
+      throw err;
+    }
+  }
+
+  // Severity set
+  const sevSet = severity && severity.length > 0
+    ? new Set(severity.map((s) => normalizeSeverity(s)))
+    : null;
+
+  const result = [];
+  for (const f of findings) {
+    // Annotate dismiss status
+    const match = findDismissMatch(f, dismissedAlerts);
+    f.dismissed = match !== null;
+    if (match) {
+      f.dismiss_info = {
+        reason: match.reason_for_dismiss || null,
+        comment: match.comment_for_dismiss || null,
+      };
+    }
+
+    // Filter dismissed
+    if (f.dismissed && !includeDismissed) continue;
+
+    // Filter by severity
+    if (sevSet && !sevSet.has(f.severity)) continue;
+
+    // Filter by path glob
+    if (pathGlob && !minimatch(f.file_path, pathGlob, { matchBase: true })) continue;
+
+    // Filter by check regex
+    if (checkRe && !checkRe.test(f.check_id) && !checkRe.test(f.check_name)) continue;
+
+    result.push(f);
+  }
+  return result;
+}

package/src/commands/scans/lib/log.js

@@ -0,0 +1,25 @@
+// stderr progress logger — respects --quiet and --no-color
+
+let quietMode = false;
+let noColorMode = false;
+
+export function setQuiet(q) { quietMode = !!q; }
+export function setNoColor(nc) { noColorMode = !!nc; }
+
+function isTTY() { return process.stderr.isTTY === true; }
+
+function dim(text) {
+  if (noColorMode || !isTTY()) return text;
+  return `\x1b[2m${text}\x1b[0m`;
+}
+
+/** Write a progress line to stderr (suppressed by --quiet). */
+export function progress(msg) {
+  if (quietMode) return;
+  process.stderr.write(dim(`[progress] ${msg}`) + '\n');
+}
+
+/** Write a JSON error object to stderr (never suppressed). */
+export function logError(obj) {
+  process.stderr.write(JSON.stringify(obj) + '\n');
+}

package/src/commands/scans/lib/normalize.js

@@ -0,0 +1,155 @@
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const pkg = require('../../../../package.json');
+
+const SEV_MAP = {
+  critical: 'critical', blocker: 'critical', p0: 'critical',
+  high: 'high', error: 'high', major: 'high',
+  medium: 'medium', warning: 'medium', moderate: 'medium', p2: 'medium',
+  low: 'low', note: 'low', minor: 'low', p3: 'low',
+  info: 'info', informational: 'info', information: 'info', p4: 'info',
+};
+
+export function normalizeSeverity(raw) {
+  if (!raw) return 'unknown';
+  return SEV_MAP[String(raw).toLowerCase()] ?? 'unknown';
+}
+
+/** Stable djb2-variant hash → 4-char hex suffix for finding IDs. */
+function shortHash(str) {
+  let h = 5381;
+  for (let i = 0; i < str.length; i++) {
+    h = (((h << 5) + h) ^ str.charCodeAt(i)) >>> 0;
+  }
+  return h.toString(16).slice(0, 4);
+}
+
+/**
+ * Build a stable finding ID: category:file_path:line:check_id:hash
+ */
+function buildId(category, filePath, lineNumber, checkId, message) {
+  const hash = shortHash(`${filePath}:${lineNumber}:${checkId}:${message}`);
+  return `${category}:${filePath}:${lineNumber}:${checkId || 'nocheck'}:${hash}`;
+}
+
+/**
+ * Normalize a raw issue (from any fetcher) into a NormalizedFinding.
+ *
+ * @param {object} issue   - raw issue from fetcher
+ * @param {string} category - category key (e.g. 'sast')
+ * @returns {object} NormalizedFinding
+ */
+export function normalizeIssue(issue, category) {
+  if (!issue) return null;
+
+  const filePath = issue.file_path || 'unknown';
+  const lineNumber = issue.line_number || issue.start_line || issue.line || 1;
+  const lineRange = issue.file_line_range || issue.line_range || [lineNumber];
+  const checkId = issue.check_id || issue.test_id || issue.rule_id || issue.vulnerability_id || issue.cve_id || '';
+  const checkName = issue.check_name || issue.issue_text || issue.message || issue.description || issue.name || '';
+  const message = issue.message || issue.issue_text || issue.description || checkName || '';
+  const severity = normalizeSeverity(issue.severity);
+
+  // Package info for sca/sbom
+  let packageInfo = null;
+  if (category === 'sca' || category === 'sbom') {
+    const name = issue.package_name || issue.name || null;
+    if (name) {
+      packageInfo = {
+        name,
+        version: issue.version || issue.package_version || null,
+        ecosystem: issue.ecosystem || issue.package_manager || null,
+      };
+    }
+  }
+
+  // CWE / CVE
+  const cwe = issue.cwe || issue.cwe_id || null;
+  const cve = issue.cve || issue.cve_id || issue.vulnerability_id || null;
+
+  // Category-specific metadata
+  const metadata = {};
+  if (category === 'iac') {
+    if (issue.guideline) metadata.guideline = issue.guideline;
+    if (issue.resource) metadata.resource = issue.resource;
+  } else if (category === 'sast' || category === 'anti_patterns') {
+    if (issue.issue_confidence) metadata.confidence = issue.issue_confidence;
+    if (issue.issue_type || issue.test_type) metadata.issue_type = issue.issue_type || issue.test_type;
+  } else if (category === 'secrets') {
+    if (issue.type || issue.secret_type) metadata.secret_type = issue.type || issue.secret_type;
+    if (issue.confidence_score) metadata.confidence_score = issue.confidence_score;
+  } else if (category === 'dead_code') {
+    if (issue.type) metadata.type = issue.type;
+    if (issue.confidence) metadata.confidence = issue.confidence;
+  } else if (category === 'complex_functions') {
+    if (issue.complexity !== undefined) metadata.complexity = issue.complexity;
+  } else if (category === 'sca') {
+    if (issue.cvss_score !== undefined) metadata.cvss_score = issue.cvss_score;
+    if (issue.fix_version) metadata.fix_version = issue.fix_version;
+  }
+
+  const id = buildId(category, filePath, lineNumber, checkId, message);
+
+  return {
+    id,
+    category,
+    severity,
+    file_path: filePath,
+    line_number: lineNumber,
+    line_range: Array.isArray(lineRange) ? lineRange : [lineNumber],
+    check_id: checkId,
+    check_name: checkName,
+    message,
+    rule_id: checkId,
+    cwe: cwe ? String(cwe) : null,
+    cve: cve ? String(cve) : null,
+    package: packageInfo,
+    metadata,
+    dismissed: false,
+    dismiss_info: null,
+  };
+}
+
+/** Build the outer envelope object. */
+export function buildEnvelope({
+  repo,
+  scan,
+  categories,
+  findings,
+  pagination,
+  filters,
+  errors,
+}) {
+  const total = pagination.total;
+  const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, info: 0, unknown: 0 };
+  const byCategory = {};
+
+  for (const f of findings) {
+    bySeverity[f.severity] = (bySeverity[f.severity] ?? 0) + 1;
+    byCategory[f.category] = (byCategory[f.category] ?? 0) + 1;
+  }
+  // summary uses all findings (pre-pagination)
+  // recalculate from pre-pagination total
+  const allSeverity = { ...bySeverity };
+  const allCategory = { ...byCategory };
+
+  return {
+    schema_version: '1.0',
+    tool: 'codeant-cli',
+    tool_version: pkg.version,
+    generated_at: new Date().toISOString(),
+    repo,
+    scan,
+    categories,
+    summary: {
+      total,
+      by_severity: allSeverity,
+      by_category: allCategory,
+    },
+    pagination,
+    filters,
+    errors,
+    findings,
+  };
+}

package/src/commands/scans/lib/paginate.js

@@ -0,0 +1,22 @@
+/**
+ * Slice findings and return pagination metadata.
+ * @param {Array} findings - full (sorted, filtered) findings array
+ * @param {{ limit?: number, offset?: number }} opts
+ * @returns {{ items: Array, pagination: object }}
+ */
+export function paginate(findings, { limit = 100, offset = 0 } = {}) {
+  const total = findings.length;
+  const safeOffset = Number.isFinite(offset) ? Math.max(0, Math.trunc(offset)) : 0;
+  const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.trunc(limit) : 100;
+  const items = findings.slice(safeOffset, safeOffset + safeLimit);
+  return {
+    items,
+    pagination: {
+      limit: safeLimit,
+      offset: safeOffset,
+      returned: items.length,
+      total,
+      has_more: safeOffset + items.length < total,
+    },
+  };
+}

package/src/commands/scans/lib/resolveScan.js

@@ -0,0 +1,50 @@
+import { getScanHistory } from '../../../scans/getScanHistory.js';
+
+function withExitCode(code, message) {
+  const err = new Error(message);
+  err.exitCode = code;
+  return err;
+}
+
+/**
+ * Resolve the scan to use.
+ * Precedence: --scan (explicit SHA) > --branch (latest on branch) > global latest.
+ *
+ * @param {{ repo: string, scan?: string, branch?: string }} opts
+ * @returns {Promise<{ commit_id, branch, timestamp, status, resolved_by }>}
+ */
+export async function resolveScan({ repo, scan, branch }) {
+  if (scan) {
+    const { success, scanHistory, error } = await getScanHistory(repo);
+    const history = success ? (scanHistory ?? []) : [];
+    const hit = history.find((s) => s.latest_commit_sha === scan);
+    return {
+      commit_id: scan,
+      branch: hit?.branch ?? branch ?? null,
+      timestamp: hit?.timestamp ?? null,
+      status: hit?.status ?? 'done',
+      resolved_by: 'explicit',
+    };
+  }
+
+  const { success, scanHistory, error } = await getScanHistory(repo);
+  if (!success) throw withExitCode(1, `scan history: ${error}`);
+
+  const sorted = [...(scanHistory ?? [])]
+    .filter((s) => s.latest_commit_sha && s.timestamp)
+    .sort((a, b) => new Date(b.timestamp) - new Date(a.timestamp));
+  const filtered = branch ? sorted.filter((s) => s.branch === branch) : sorted;
+  const pick = filtered[0];
+
+  if (!pick) {
+    throw withExitCode(2, branch ? `no scans for branch "${branch}"` : 'no scans found');
+  }
+
+  return {
+    commit_id: pick.latest_commit_sha,
+    branch: pick.branch ?? branch ?? null,
+    timestamp: pick.timestamp,
+    status: pick.status ?? 'done',
+    resolved_by: branch ? 'branch' : 'latest',
+  };
+}

package/src/commands/scans/lib/sort.js

@@ -0,0 +1,19 @@
+const SEV_RANK = { critical: 5, high: 4, medium: 3, low: 2, info: 1, unknown: 0 };
+
+/**
+ * Deterministic sort: severity desc, file_path asc, line_number asc, check_id asc, id asc.
+ * Same input always produces byte-identical output.
+ */
+export function deterministicSort(findings) {
+  return [...findings].sort((a, b) => {
+    const sd = (SEV_RANK[b.severity] ?? 0) - (SEV_RANK[a.severity] ?? 0);
+    if (sd !== 0) return sd;
+    const fp = (a.file_path ?? '').localeCompare(b.file_path ?? '', 'en', { sensitivity: 'base' });
+    if (fp !== 0) return fp;
+    const ln = (a.line_number ?? 0) - (b.line_number ?? 0);
+    if (ln !== 0) return ln;
+    const ci = (a.check_id ?? '').localeCompare(b.check_id ?? '', 'en');
+    if (ci !== 0) return ci;
+    return (a.id ?? '').localeCompare(b.id ?? '', 'en');
+  });
+}

package/src/commands/scans/orgs.js

@@ -0,0 +1,15 @@
+import { validateConnection } from '../../scans/connectionHandler.js';
+
+/**
+ * codeant scans orgs
+ * List authenticated organizations.
+ */
+export async function runOrgs() {
+  const result = await validateConnection();
+  if (!result.success) {
+    const err = new Error(result.error || 'Failed to validate connection');
+    err.exitCode = result.error?.toLowerCase().includes('network') ? 4 : 1;
+    throw err;
+  }
+  return { connections: result.connections, email: result.email };
+}

package/src/commands/scans/repos.js

@@ -0,0 +1,41 @@
+import { validateConnection } from '../../scans/connectionHandler.js';
+import { listRepos as listReposApi } from '../../scans/listRepos.js';
+
+/**
+ * codeant scans repos [--org <org>]
+ * List repositories. Auto-picks org when only one is authenticated.
+ */
+export async function runRepos({ org } = {}) {
+  let orgName = org;
+
+  if (!orgName) {
+    const conn = await validateConnection();
+    if (!conn.success) {
+      const err = new Error(conn.error || 'Failed to validate connection');
+      err.exitCode = 1;
+      throw err;
+    }
+    if (conn.connections.length === 0) {
+      const err = new Error('No authenticated organizations found');
+      err.exitCode = 1;
+      throw err;
+    }
+    if (conn.connections.length > 1) {
+      const err = new Error(
+        `Multiple orgs found. Specify one with --org. Available: ${conn.connections.map((c) => c.organizationName).join(', ')}`
+      );
+      err.exitCode = 1;
+      throw err;
+    }
+    orgName = conn.connections[0].organizationName;
+  }
+
+  const result = await listReposApi(orgName);
+  if (!result.success) {
+    const err = new Error(result.error || 'Failed to list repositories');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  return { org: orgName, repos: result.repos };
+}

package/src/commands/scans/results.js

@@ -0,0 +1,156 @@
+import { resolveScan } from './lib/resolveScan.js';
+import { parseTypes } from './lib/categories.js';
+import { normalizeIssue, buildEnvelope } from './lib/normalize.js';
+import { applyFilters } from './lib/filters.js';
+import { deterministicSort } from './lib/sort.js';
+import { paginate } from './lib/paginate.js';
+import { emit } from './lib/emit.js';
+import { progress, logError } from './lib/log.js';
+import { FORMATTERS } from './formatters/index.js';
+import { fetchDismissedAlerts } from '../../scans/fetchDismissedAlerts.js';
+
+/**
+ * codeant scans results — full orchestration.
+ *
+ * @param {object} opts
+ */
+export async function runResults(opts = {}) {
+  const {
+    repo,
+    scan,
+    branch,
+    types,
+    severity,
+    path: pathGlob,
+    check: checkRegex,
+    includeDismissed = false,
+    format = 'json',
+    output: outputPath = null,
+    fields = null,
+    limit = 100,
+    offset = 0,
+    failFast = false,
+  } = opts;
+
+  if (!repo) {
+    const err = new Error('--repo is required');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  const formatter = FORMATTERS[format];
+  if (!formatter) {
+    const err = new Error(`Unknown --format "${format}". Valid: ${Object.keys(FORMATTERS).join(', ')}`);
+    err.exitCode = 1;
+    throw err;
+  }
+
+  // 1. Resolve scan
+  progress(`resolving scan for ${repo}…`);
+  const scanMeta = await resolveScan({ repo, scan, branch });
+  progress(`using commit ${scanMeta.commit_id} (${scanMeta.resolved_by})`);
+
+  // 2. Parse types
+  const categories = parseTypes(types);
+
+  // 3. Fetch in parallel + dismissed alerts
+  progress(`fetching ${categories.map((c) => c.key).join(', ')}…`);
+  const [settled, dismissedResult] = await Promise.all([
+    Promise.allSettled(categories.map((c) => c.fetcher(repo, scanMeta.commit_id))),
+    includeDismissed
+      ? Promise.resolve({ success: true, dismissedAlerts: [] })
+      : fetchDismissedAlerts(repo, 'security'),
+  ]);
+
+  const dismissedAlerts = dismissedResult.success ? (dismissedResult.dismissedAlerts ?? []) : [];
+
+  // 4. Collect findings + errors
+  const allFindings = [];
+  const errors = [];
+
+  for (let i = 0; i < settled.length; i++) {
+    const cat = categories[i];
+    const s = settled[i];
+
+    if (s.status === 'rejected' || !s.value?.success) {
+      const msg = s.status === 'rejected' ? s.reason?.message : s.value?.error;
+      errors.push({ category: cat.key, error: msg || 'unknown error' });
+      logError({ category: cat.key, error: msg || 'unknown error' });
+      if (failFast) {
+        const err = new Error(`Category "${cat.key}" failed: ${msg}`);
+        err.exitCode = 3;
+        throw err;
+      }
+      continue;
+    }
+
+    progress(`normalizing ${cat.key} (${s.value.issues?.length ?? 0} issues)…`);
+    for (const issue of s.value.issues ?? []) {
+      const f = normalizeIssue(issue, cat.key);
+      if (f) allFindings.push(f);
+    }
+  }
+
+  // 5. Filter
+  const severityList = severity
+    ? severity.split(',').map((s) => s.trim()).filter(Boolean)
+    : null;
+
+  const filtered = applyFilters(allFindings, {
+    severity: severityList,
+    pathGlob: pathGlob || null,
+    checkRegex: checkRegex || null,
+    dismissedAlerts,
+    includeDismissed,
+  });
+
+  // 6. Sort
+  const sorted = deterministicSort(filtered);
+
+  // 7. Paginate
+  const { items: pageItems, pagination } = paginate(sorted, { limit, offset });
+
+  // 8. Build envelope (summary uses pre-pagination totals)
+  const filtersObj = {
+    severity: severityList,
+    path: pathGlob || null,
+    check: checkRegex || null,
+    include_dismissed: includeDismissed,
+  };
+
+  // Rebuild summary from all filtered (pre-page) findings
+  const summaryBySev = { critical: 0, high: 0, medium: 0, low: 0, info: 0, unknown: 0 };
+  const summaryByCat = {};
+  for (const f of sorted) {
+    summaryBySev[f.severity] = (summaryBySev[f.severity] ?? 0) + 1;
+    summaryByCat[f.category] = (summaryByCat[f.category] ?? 0) + 1;
+  }
+
+  const envelope = buildEnvelope({
+    repo,
+    scan: scanMeta,
+    categories: categories.map((c) => c.key),
+    findings: pageItems,
+    pagination,
+    filters: filtersObj,
+    errors,
+  });
+  // Override summary with pre-pagination counts
+  envelope.summary = { total: sorted.length, by_severity: summaryBySev, by_category: summaryByCat };
+
+  // 9. Project fields
+  if (fields) {
+    const fieldList = fields.split(',').map((f) => f.trim()).filter(Boolean);
+    envelope.findings = envelope.findings.map((f) => {
+      const projected = {};
+      for (const key of fieldList) {
+        if (key in f) projected[key] = f[key];
+      }
+      return projected;
+    });
+  }
+
+  // 10. Render + emit
+  const rendered = formatter.render(envelope);
+  emit(rendered, outputPath, envelope.findings.length);
+}