codegate-ai 0.8.0 → 0.9.0

package/dist/layer2-static/action/parser.js

@@ -0,0 +1,165 @@
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function asBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+function asStringRecord(value) {
+    const record = asRecord(value);
+    if (!record) {
+        return undefined;
+    }
+    const result = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (typeof entry === "string") {
+            result[key] = entry;
+        }
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function asStringArray(value) {
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    const result = value.filter((entry) => typeof entry === "string");
+    return result.length > 0 ? result : undefined;
+}
+function normalizeActionPath(value) {
+    return value.replaceAll("\\", "/");
+}
+export function isGitHubActionPath(path) {
+    return /(?:^|\/)action\.ya?ml$/iu.test(normalizeActionPath(path));
+}
+function extractStepFacts(step) {
+    const stepRecord = asRecord(step);
+    if (!stepRecord) {
+        return null;
+    }
+    const withEntries = asStringRecord(stepRecord.with);
+    const envEntries = asStringRecord(stepRecord.env);
+    const stepFacts = {
+        id: asString(stepRecord.id),
+        name: asString(stepRecord.name),
+        uses: asString(stepRecord.uses),
+        run: asString(stepRecord.run),
+        if: asString(stepRecord.if),
+        shell: asString(stepRecord.shell),
+        workingDirectory: asString(stepRecord["working-directory"]) ?? asString(stepRecord.workingDirectory),
+        with: withEntries,
+        env: envEntries,
+    };
+    if (!stepFacts.uses && !stepFacts.run) {
+        return null;
+    }
+    return stepFacts;
+}
+function extractInputs(value) {
+    const inputs = asRecord(value);
+    if (!inputs) {
+        return undefined;
+    }
+    const result = {};
+    for (const [name, inputValue] of Object.entries(inputs)) {
+        const inputRecord = asRecord(inputValue);
+        if (!inputRecord) {
+            continue;
+        }
+        const entry = {
+            description: asString(inputRecord.description),
+            required: asBoolean(inputRecord.required),
+            default: asString(inputRecord.default),
+            deprecationMessage: asString(inputRecord.deprecationMessage) ?? asString(inputRecord.deprecation_message),
+        };
+        if (entry.description !== undefined ||
+            entry.required !== undefined ||
+            entry.default !== undefined ||
+            entry.deprecationMessage !== undefined) {
+            result[name] = entry;
+        }
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function extractOutputs(value) {
+    const outputs = asRecord(value);
+    if (!outputs) {
+        return undefined;
+    }
+    const result = {};
+    for (const [name, outputValue] of Object.entries(outputs)) {
+        const outputRecord = asRecord(outputValue);
+        if (!outputRecord) {
+            continue;
+        }
+        const entry = {
+            description: asString(outputRecord.description),
+            value: asString(outputRecord.value),
+        };
+        if (entry.description !== undefined || entry.value !== undefined) {
+            result[name] = entry;
+        }
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function extractRuns(value) {
+    const runs = asRecord(value);
+    if (!runs) {
+        return undefined;
+    }
+    const stepsRaw = Array.isArray(runs.steps) ? runs.steps : [];
+    const steps = stepsRaw
+        .map((step) => extractStepFacts(step))
+        .filter((step) => step !== null);
+    const result = {
+        using: asString(runs.using),
+        main: asString(runs.main),
+        pre: asString(runs.pre),
+        post: asString(runs.post),
+        image: asString(runs.image),
+        args: asStringArray(runs.args),
+        steps: steps.length > 0 ? steps : undefined,
+    };
+    if (result.using === undefined &&
+        result.main === undefined &&
+        result.pre === undefined &&
+        result.post === undefined &&
+        result.image === undefined &&
+        result.args === undefined &&
+        result.steps === undefined) {
+        return undefined;
+    }
+    return result;
+}
+export function extractActionFacts(parsed) {
+    const root = asRecord(parsed);
+    if (!root) {
+        return null;
+    }
+    const runs = extractRuns(root.runs);
+    const inputs = extractInputs(root.inputs);
+    const outputs = extractOutputs(root.outputs);
+    const branding = asRecord(root.branding) ?? undefined;
+    if (runs === undefined &&
+        inputs === undefined &&
+        outputs === undefined &&
+        branding === undefined &&
+        asString(root.name) === undefined &&
+        asString(root.description) === undefined &&
+        asString(root.author) === undefined) {
+        return null;
+    }
+    return {
+        name: asString(root.name),
+        description: asString(root.description),
+        author: asString(root.author),
+        branding,
+        inputs,
+        outputs,
+        runs,
+    };
+}

package/dist/layer2-static/action/types.d.ts

@@ -0,0 +1,39 @@
+export interface ActionStepFacts {
+    id?: string;
+    name?: string;
+    uses?: string;
+    run?: string;
+    if?: string;
+    shell?: string;
+    workingDirectory?: string;
+    with?: Record<string, string>;
+    env?: Record<string, string>;
+}
+export interface ActionRunsFacts {
+    using?: string;
+    main?: string;
+    pre?: string;
+    post?: string;
+    image?: string;
+    args?: string[];
+    steps?: ActionStepFacts[];
+}
+export interface ActionInputFacts {
+    description?: string;
+    required?: boolean;
+    default?: string;
+    deprecationMessage?: string;
+}
+export interface ActionOutputFacts {
+    description?: string;
+    value?: string;
+}
+export interface ActionFacts {
+    name?: string;
+    description?: string;
+    author?: string;
+    branding?: Record<string, unknown>;
+    inputs?: Record<string, ActionInputFacts>;
+    outputs?: Record<string, ActionOutputFacts>;
+    runs?: ActionRunsFacts;
+}

package/dist/layer2-static/action/types.js

@@ -0,0 +1 @@
+export {};

package/dist/layer2-static/advisories/cache.d.ts

@@ -0,0 +1,6 @@
+export interface AdvisoryPayload {
+    generatedAt: number;
+    advisories: Record<string, string[]>;
+}
+export declare function loadCachedAdvisoryPayload(cacheDir: string, maxAgeMs: number, now?: number): AdvisoryPayload | null;
+export declare function saveCachedAdvisoryPayload(cacheDir: string, payload: AdvisoryPayload): void;

package/dist/layer2-static/advisories/cache.js

@@ -0,0 +1,44 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const CACHE_FILE = "gha-advisories.json";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAdvisoryPayload(value) {
+    if (!isRecord(value)) {
+        return false;
+    }
+    if (typeof value.generatedAt !== "number") {
+        return false;
+    }
+    if (!isRecord(value.advisories)) {
+        return false;
+    }
+    return Object.values(value.advisories).every((entry) => Array.isArray(entry) && entry.every((item) => typeof item === "string"));
+}
+function cachePath(cacheDir) {
+    return join(cacheDir, CACHE_FILE);
+}
+export function loadCachedAdvisoryPayload(cacheDir, maxAgeMs, now = Date.now()) {
+    const path = cachePath(cacheDir);
+    if (!existsSync(path)) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (!isAdvisoryPayload(parsed)) {
+            return null;
+        }
+        if (now - parsed.generatedAt > maxAgeMs) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveCachedAdvisoryPayload(cacheDir, payload) {
+    mkdirSync(cacheDir, { recursive: true });
+    writeFileSync(cachePath(cacheDir), JSON.stringify(payload, null, 2), "utf8");
+}

package/dist/layer2-static/advisories/cache.ts

@@ -0,0 +1,62 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface AdvisoryPayload {
+  generatedAt: number;
+  advisories: Record<string, string[]>;
+}
+
+const CACHE_FILE = "gha-advisories.json";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isAdvisoryPayload(value: unknown): value is AdvisoryPayload {
+  if (!isRecord(value)) {
+    return false;
+  }
+  if (typeof value.generatedAt !== "number") {
+    return false;
+  }
+  if (!isRecord(value.advisories)) {
+    return false;
+  }
+
+  return Object.values(value.advisories).every(
+    (entry) => Array.isArray(entry) && entry.every((item) => typeof item === "string"),
+  );
+}
+
+function cachePath(cacheDir: string): string {
+  return join(cacheDir, CACHE_FILE);
+}
+
+export function loadCachedAdvisoryPayload(
+  cacheDir: string,
+  maxAgeMs: number,
+  now = Date.now(),
+): AdvisoryPayload | null {
+  const path = cachePath(cacheDir);
+  if (!existsSync(path)) {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as unknown;
+    if (!isAdvisoryPayload(parsed)) {
+      return null;
+    }
+    if (now - parsed.generatedAt > maxAgeMs) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+export function saveCachedAdvisoryPayload(cacheDir: string, payload: AdvisoryPayload): void {
+  mkdirSync(cacheDir, { recursive: true });
+  writeFileSync(cachePath(cacheDir), JSON.stringify(payload, null, 2), "utf8");
+}

package/dist/layer2-static/advisories/gha-advisory-client.d.ts

@@ -0,0 +1,7 @@
+import type { RuntimeMode } from "../../config.js";
+import { type GithubMetadataClientOptions } from "../github/client.js";
+import type { AdvisoryPayload } from "../github/cache.js";
+export interface LoadKnownVulnerableActionsOptions extends GithubMetadataClientOptions {
+    runtimeMode?: RuntimeMode;
+}
+export declare function loadKnownVulnerableActions(options?: LoadKnownVulnerableActionsOptions): AdvisoryPayload;

package/dist/layer2-static/advisories/gha-advisory-client.js

@@ -0,0 +1,4 @@
+import { loadBundledGithubAdvisories } from "../github/client.js";
+export function loadKnownVulnerableActions(options = {}) {
+    return loadBundledGithubAdvisories(options);
+}

package/dist/layer2-static/advisories/gha-advisory-client.ts

@@ -0,0 +1,13 @@
+import type { RuntimeMode } from "../../config.js";
+import { loadBundledGithubAdvisories, type GithubMetadataClientOptions } from "../github/client.js";
+import type { AdvisoryPayload } from "../github/cache.js";
+
+export interface LoadKnownVulnerableActionsOptions extends GithubMetadataClientOptions {
+  runtimeMode?: RuntimeMode;
+}
+
+export function loadKnownVulnerableActions(
+  options: LoadKnownVulnerableActionsOptions = {},
+): AdvisoryPayload {
+  return loadBundledGithubAdvisories(options);
+}

package/dist/layer2-static/advisories/gha-known-vulnerable-actions.json

@@ -0,0 +1,4 @@
+{
+  "actions/checkout": ["v3"],
+  "tj-actions/changed-files": ["v39"]
+}

package/dist/layer2-static/audits/registry.d.ts

@@ -0,0 +1,3 @@
+import type { AuditSelectionContext, RegisteredAudit } from "./types.js";
+export declare function filterRegisteredAudits<TContext>(audits: Array<RegisteredAudit<TContext>>, context: AuditSelectionContext): Array<RegisteredAudit<TContext>>;
+export type { RegisteredAudit } from "./types.js";

package/dist/layer2-static/audits/registry.js

@@ -0,0 +1,29 @@
+const PERSONA_ORDER = {
+    regular: 0,
+    pedantic: 1,
+    auditor: 2,
+};
+function resolvePersona(input) {
+    return input.persona ?? "regular";
+}
+function isPersonaAllowed(required, current) {
+    const requiredPersona = required ?? "regular";
+    return PERSONA_ORDER[current] >= PERSONA_ORDER[requiredPersona];
+}
+function isRuntimeAllowed(onlineRequired, context) {
+    if (!onlineRequired) {
+        return true;
+    }
+    const mode = context.runtimeMode ?? "offline";
+    return mode === "online";
+}
+function isAuditDisabled(auditId, context) {
+    const disabledAuditIds = context.disabledAuditIds;
+    return (disabledAuditIds ?? []).includes(auditId);
+}
+export function filterRegisteredAudits(audits, context) {
+    const persona = resolvePersona(context);
+    return audits.filter((audit) => !isAuditDisabled(audit.id, context) &&
+        isPersonaAllowed(audit.minPersona, persona) &&
+        isRuntimeAllowed(audit.onlineRequired, context));
+}

package/dist/layer2-static/audits/types.d.ts

@@ -0,0 +1,12 @@
+import type { AuditPersona, RuntimeMode } from "../../config.js";
+import type { Finding } from "../../types/finding.js";
+export interface AuditSelectionContext {
+    persona?: AuditPersona;
+    runtimeMode?: RuntimeMode;
+}
+export interface RegisteredAudit<TContext> {
+    id: string;
+    run: (context: TContext) => Finding[] | Promise<Finding[]>;
+    minPersona?: AuditPersona;
+    onlineRequired?: boolean;
+}

package/dist/layer2-static/audits/types.js

@@ -0,0 +1 @@
+export {};

package/dist/layer2-static/dependabot/parser.d.ts

@@ -0,0 +1,3 @@
+import type { DependabotFacts } from "./types.js";
+export declare function isGitHubDependabotPath(path: string): boolean;
+export declare function extractDependabotFacts(parsed: unknown): DependabotFacts | null;

package/dist/layer2-static/dependabot/parser.js

@@ -0,0 +1,189 @@
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function asNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function asBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+function asStringArray(value) {
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    const result = value.filter((entry) => typeof entry === "string");
+    return result.length > 0 ? result : undefined;
+}
+function normalizeDependabotPath(value) {
+    return value.replaceAll("\\", "/");
+}
+export function isGitHubDependabotPath(path) {
+    return /(?:^|\/)\.github\/dependabot\.ya?ml$/iu.test(normalizeDependabotPath(path));
+}
+function extractSchedule(value) {
+    const schedule = asRecord(value);
+    if (!schedule) {
+        return undefined;
+    }
+    const result = {
+        interval: asString(schedule.interval),
+        day: asString(schedule.day),
+        time: asString(schedule.time),
+        timezone: asString(schedule.timezone),
+    };
+    return result.interval || result.day || result.time || result.timezone ? result : undefined;
+}
+function extractCooldown(value) {
+    const cooldown = asRecord(value);
+    if (!cooldown) {
+        return undefined;
+    }
+    const result = {
+        defaultDays: asNumber(cooldown["default-days"]),
+        semverMajorDays: asNumber(cooldown["semver-major-days"]),
+        semverMinorDays: asNumber(cooldown["semver-minor-days"]),
+        semverPatchDays: asNumber(cooldown["semver-patch-days"]),
+    };
+    return result.defaultDays !== undefined ||
+        result.semverMajorDays !== undefined ||
+        result.semverMinorDays !== undefined ||
+        result.semverPatchDays !== undefined
+        ? result
+        : undefined;
+}
+function extractCommitMessage(value) {
+    const commitMessage = asRecord(value);
+    if (!commitMessage) {
+        return undefined;
+    }
+    const result = {
+        prefix: asString(commitMessage.prefix),
+        prefixDevelopment: asString(commitMessage["prefix-development"]) ?? asString(commitMessage.prefixDevelopment),
+        include: asString(commitMessage.include),
+    };
+    return result.prefix || result.prefixDevelopment || result.include ? result : undefined;
+}
+function extractRuleFacts(value) {
+    const rule = asRecord(value);
+    if (!rule) {
+        return null;
+    }
+    const result = {
+        dependencyName: asString(rule["dependency-name"]) ?? asString(rule.dependencyName),
+        dependencyType: asString(rule["dependency-type"]) ?? asString(rule.dependencyType),
+        versions: asStringArray(rule.versions),
+        updateTypes: asStringArray(rule["update-types"]) ?? asStringArray(rule.updateTypes),
+        patterns: asStringArray(rule.patterns),
+    };
+    if (result.dependencyName !== undefined ||
+        result.dependencyType !== undefined ||
+        result.versions !== undefined ||
+        result.updateTypes !== undefined ||
+        result.patterns !== undefined) {
+        return result;
+    }
+    return null;
+}
+function extractGroupFacts(value) {
+    const group = asRecord(value);
+    if (!group) {
+        return null;
+    }
+    const result = {
+        dependencyType: asString(group["dependency-type"]) ?? asString(group.dependencyType),
+        updateTypes: asStringArray(group["update-types"]) ?? asStringArray(group.updateTypes),
+        patterns: asStringArray(group.patterns),
+    };
+    if (result.dependencyType !== undefined ||
+        result.updateTypes !== undefined ||
+        result.patterns !== undefined) {
+        return result;
+    }
+    return null;
+}
+function extractUpdateFacts(value) {
+    const update = asRecord(value);
+    if (!update) {
+        return null;
+    }
+    const allow = Array.isArray(update.allow)
+        ? update.allow
+            .map((entry) => extractRuleFacts(entry))
+            .filter((entry) => entry !== null)
+        : undefined;
+    const ignore = Array.isArray(update.ignore)
+        ? update.ignore
+            .map((entry) => extractRuleFacts(entry))
+            .filter((entry) => entry !== null)
+        : undefined;
+    const groupsRecord = asRecord(update.groups);
+    const groups = {};
+    if (groupsRecord) {
+        for (const [name, groupValue] of Object.entries(groupsRecord)) {
+            const groupFacts = extractGroupFacts(groupValue);
+            if (groupFacts) {
+                groups[name] = groupFacts;
+            }
+        }
+    }
+    const result = {
+        packageEcosystem: asString(update["package-ecosystem"]) ?? asString(update.packageEcosystem),
+        directory: asString(update.directory),
+        targetBranch: asString(update["target-branch"]) ?? asString(update.targetBranch),
+        openPullRequestsLimit: asNumber(update["open-pull-requests-limit"]) ?? asNumber(update.openPullRequestsLimit),
+        insecureExternalCodeExecution: asBoolean(update["insecure-external-code-execution"]) ??
+            asBoolean(update.insecureExternalCodeExecution),
+        schedule: extractSchedule(update.schedule),
+        cooldown: extractCooldown(update.cooldown),
+        labels: asStringArray(update.labels),
+        assignees: asStringArray(update.assignees),
+        reviewers: asStringArray(update.reviewers),
+        registries: asStringArray(update.registries),
+        commitMessage: extractCommitMessage(update["commit-message"] ?? update.commitMessage),
+        allow,
+        ignore,
+        groups: Object.keys(groups).length > 0 ? groups : undefined,
+    };
+    if (result.packageEcosystem !== undefined ||
+        result.directory !== undefined ||
+        result.targetBranch !== undefined ||
+        result.openPullRequestsLimit !== undefined ||
+        result.insecureExternalCodeExecution !== undefined ||
+        result.schedule !== undefined ||
+        result.cooldown !== undefined ||
+        result.labels !== undefined ||
+        result.assignees !== undefined ||
+        result.reviewers !== undefined ||
+        result.registries !== undefined ||
+        result.commitMessage !== undefined ||
+        result.allow !== undefined ||
+        result.ignore !== undefined ||
+        result.groups !== undefined) {
+        return result;
+    }
+    return null;
+}
+export function extractDependabotFacts(parsed) {
+    const root = asRecord(parsed);
+    if (!root) {
+        return null;
+    }
+    const version = asNumber(root.version);
+    const updatesRaw = Array.isArray(root.updates) ? root.updates : [];
+    const updates = updatesRaw
+        .map((entry) => extractUpdateFacts(entry))
+        .filter((entry) => entry !== null);
+    if (version === undefined && updates.length === 0) {
+        return null;
+    }
+    return {
+        version,
+        updates,
+    };
+}

package/dist/layer2-static/dependabot/types.d.ts

@@ -0,0 +1,50 @@
+export interface DependabotScheduleFacts {
+    interval?: string;
+    day?: string;
+    time?: string;
+    timezone?: string;
+}
+export interface DependabotCooldownFacts {
+    defaultDays?: number;
+    semverMajorDays?: number;
+    semverMinorDays?: number;
+    semverPatchDays?: number;
+}
+export interface DependabotCommitMessageFacts {
+    prefix?: string;
+    prefixDevelopment?: string;
+    include?: string;
+}
+export interface DependabotRuleFacts {
+    dependencyName?: string;
+    dependencyType?: string;
+    versions?: string[];
+    updateTypes?: string[];
+    patterns?: string[];
+}
+export interface DependabotGroupFacts {
+    dependencyType?: string;
+    updateTypes?: string[];
+    patterns?: string[];
+}
+export interface DependabotUpdateFacts {
+    packageEcosystem?: string;
+    directory?: string;
+    targetBranch?: string;
+    openPullRequestsLimit?: number;
+    insecureExternalCodeExecution?: boolean;
+    schedule?: DependabotScheduleFacts;
+    cooldown?: DependabotCooldownFacts;
+    labels?: string[];
+    assignees?: string[];
+    reviewers?: string[];
+    registries?: string[];
+    commitMessage?: DependabotCommitMessageFacts;
+    allow?: DependabotRuleFacts[];
+    ignore?: DependabotRuleFacts[];
+    groups?: Record<string, DependabotGroupFacts>;
+}
+export interface DependabotFacts {
+    version?: number;
+    updates: DependabotUpdateFacts[];
+}

package/dist/layer2-static/dependabot/types.js

@@ -0,0 +1 @@
+export {};

package/dist/layer2-static/detectors/dependabot-cooldown.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface DependabotCooldownInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectDependabotCooldown(input: DependabotCooldownInput): Finding[];