codehere 0.2.2 → 0.3.0-rc.1

package/dist/infrastructure/security/docker-sandbox.js

@@ -1,178 +0,0 @@
-/**
- * Infrastructure: Docker Sandbox Executor
- * Executes code in isolated Docker containers for security
- *
- * MANDATORY: All code execution must use this for security
- */
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { randomUUID } from 'crypto';
-import { writeFileSync, unlinkSync, existsSync, mkdirSync } from 'fs';
-import { join } from 'path';
-const execAsync = promisify(exec);
-export class DockerSandbox {
-    DEFAULT_TIMEOUT = 30000; // 30 seconds
-    DEFAULT_MEMORY = '512m';
-    DEFAULT_CPU = '0.5';
-    SANDBOX_IMAGE = 'node:18-alpine'; // Lightweight Node.js image
-    TEMP_DIR = '/tmp/codehere-sandbox';
-    constructor() {
-        // Ensure temp directory exists
-        if (!existsSync(this.TEMP_DIR)) {
-            mkdirSync(this.TEMP_DIR, { recursive: true });
-        }
-    }
-    /**
-     * Execute code in isolated Docker container
-     */
-    async execute(code, language = 'bash', options = {}) {
-        const startTime = Date.now();
-        const containerId = randomUUID().substring(0, 8);
-        const timeout = options.timeout || this.DEFAULT_TIMEOUT;
-        try {
-            // Create temporary file with code
-            const tempFile = join(this.TEMP_DIR, `${containerId}.${this.getFileExtension(language)}`);
-            writeFileSync(tempFile, code, 'utf-8');
-            // Build Docker run command with security restrictions
-            const dockerCommand = this.buildDockerCommand(containerId, tempFile, language, options);
-            // Execute in Docker container with timeout
-            const { stdout, stderr } = await Promise.race([
-                execAsync(dockerCommand, { timeout }),
-                this.createTimeout(timeout),
-            ]);
-            // Cleanup
-            this.cleanup(containerId, tempFile);
-            const duration = Date.now() - startTime;
-            return {
-                success: !stderr || stderr.length === 0,
-                output: stdout,
-                error: stderr || undefined,
-                exitCode: 0,
-                duration,
-            };
-        }
-        catch (error) {
-            // Cleanup on error
-            this.cleanup(containerId, join(this.TEMP_DIR, `${containerId}.${this.getFileExtension(language)}`));
-            const duration = Date.now() - startTime;
-            if (error.code === 'ETIMEDOUT' || error.signal === 'SIGTERM') {
-                return {
-                    success: false,
-                    output: '',
-                    error: `Execution timed out after ${timeout}ms`,
-                    exitCode: 124,
-                    duration,
-                };
-            }
-            return {
-                success: false,
-                output: '',
-                error: error.message || String(error),
-                exitCode: error.code || 1,
-                duration,
-            };
-        }
-    }
-    /**
-     * Execute bash command in sandbox
-     */
-    async executeBash(command, options = {}) {
-        // Use execute method with bash language
-        return await this.execute(command, 'bash', options);
-    }
-    /**
-     * Build Docker command with security restrictions
-     */
-    buildDockerCommand(containerId, codeFile, language, options) {
-        const memory = options.memoryLimit || this.DEFAULT_MEMORY;
-        const cpu = options.cpuLimit || this.DEFAULT_CPU;
-        const network = options.networkAccess ? '' : '--network none';
-        const readOnly = '--read-only';
-        const tmpfs = '--tmpfs /tmp:rw,noexec,nosuid,size=100m';
-        // Determine execution command based on language
-        let execCommand;
-        switch (language) {
-            case 'javascript':
-            case 'typescript':
-                execCommand = `node /code/${containerId}.js`;
-                break;
-            case 'python':
-                execCommand = `python /code/${containerId}.py`;
-                break;
-            case 'bash':
-            default:
-                execCommand = `sh /code/${containerId}.sh`;
-                break;
-        }
-        // Copy code file into container and execute
-        const dockerCommand = `docker run --rm \
-      --name codehere-sandbox-${containerId} \
-      --memory ${memory} \
-      --cpus ${cpu} \
-      ${network} \
-      ${readOnly} \
-      ${tmpfs} \
-      --security-opt no-new-privileges:true \
-      --cap-drop ALL \
-      --user 1000:1000 \
-      -v ${codeFile}:/code/${containerId}.${this.getFileExtension(language)}:ro \
-      ${this.SANDBOX_IMAGE} \
-      ${execCommand}`;
-        return dockerCommand;
-    }
-    /**
-     * Get file extension for language
-     */
-    getFileExtension(language) {
-        const extensions = {
-            javascript: 'js',
-            typescript: 'ts',
-            python: 'py',
-            bash: 'sh',
-        };
-        return extensions[language] || 'sh';
-    }
-    /**
-     * Create timeout promise
-     */
-    createTimeout(ms) {
-        return new Promise((_, reject) => {
-            setTimeout(() => reject(new Error('Timeout')), ms);
-        });
-    }
-    /**
-     * Cleanup container and temp files
-     */
-    async cleanup(containerId, tempFile) {
-        try {
-            // Try to stop container if still running
-            try {
-                await execAsync(`docker stop codehere-sandbox-${containerId} 2>/dev/null || true`);
-            }
-            catch {
-                // Container already stopped or doesn't exist
-            }
-            // Remove temp file
-            if (existsSync(tempFile)) {
-                unlinkSync(tempFile);
-            }
-        }
-        catch (error) {
-            // Log but don't fail on cleanup errors
-            console.warn('Sandbox cleanup warning:', error);
-        }
-    }
-    /**
-     * Check if Docker is available
-     */
-    async isAvailable() {
-        try {
-            await execAsync('docker --version');
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
-}
-//# sourceMappingURL=docker-sandbox.js.map

package/dist/infrastructure/security/enhanced-security-gate.js

@@ -1,151 +0,0 @@
-/**
- * Infrastructure: Enhanced Security Gate
- * Comprehensive security validation combining all security scanners
- *
- * Research-Driven Security:
- * - AI SAST Scanner (existing) - 45% of AI code has flaws
- * - License Scanner - 35% license contamination risk
- * - Provider Bias Detector - Vendor lock-in prevention
- * - Uncertainty Quantifier - Hallucination risk
- *
- * All checks must pass before code generation/editing
- */
-import { getSecurityScanCache } from '../cache/security-scan-cache.js';
-/**
- * Enhanced Security Gate
- * Orchestrates all security scanners
- */
-export class EnhancedSecurityGate {
-    sastScanner;
-    licenseScanner;
-    providerBiasDetector;
-    uncertaintyQuantifier;
-    scanCache = getSecurityScanCache();
-    constructor(sastScanner, licenseScanner, providerBiasDetector, uncertaintyQuantifier) {
-        this.sastScanner = sastScanner;
-        this.licenseScanner = licenseScanner;
-        this.providerBiasDetector = providerBiasDetector;
-        this.uncertaintyQuantifier = uncertaintyQuantifier;
-    }
-    /**
-     * Comprehensive security scan
-     * PERFORMANCE OPTIMIZATION: Parallelizes independent scans for ~3x speedup
-     */
-    async scan(filepath, code, instruction, context) {
-        const errors = [];
-        const warnings = [];
-        // PERFORMANCE: Check cache first (bypasses expensive scans for unchanged files)
-        const cachedResults = this.scanCache.get(filepath, code);
-        if (cachedResults) {
-            // Return cached results (skip expensive scans)
-            const passed = cachedResults.sast.passed && cachedResults.license.passed;
-            if (!cachedResults.sast.passed) {
-                errors.push(`Security vulnerabilities: ${cachedResults.sast.criticalCount} critical, ${cachedResults.sast.highCount} high`);
-            }
-            if (!cachedResults.license.passed) {
-                errors.push(`License conflicts: ${cachedResults.license.criticalCount} critical issues`);
-            }
-            if (!cachedResults.providerBias.passed) {
-                warnings.push(`Provider bias detected: ${cachedResults.providerBias.criticalCount} critical issues`);
-            }
-            // Still run uncertainty quantification if needed (it's fast and context-dependent)
-            let uncertainty;
-            if (this.uncertaintyQuantifier && context?.query && code) {
-                uncertainty = await this.uncertaintyQuantifier.quantifyUncertainty(context.query, code, { chunks: context.chunks }).catch(() => undefined);
-                if (uncertainty?.isHallucinationRisk) {
-                    warnings.push(`High epistemic uncertainty detected: Possible hallucination risk`);
-                }
-            }
-            return {
-                passed: errors.length === 0,
-                sast: cachedResults.sast,
-                license: cachedResults.license,
-                providerBias: cachedResults.providerBias,
-                uncertainty,
-                errors,
-                warnings,
-            };
-        }
-        // PERFORMANCE: Parallelize independent scans (SAST, License, Provider Bias)
-        // These scans are independent and can run concurrently
-        const scanPromises = [
-            // 1. Fast security check on instruction (if provided)
-            instruction
-                ? this.sastScanner.scanInstruction(instruction).catch(err => {
-                    console.warn(`[EnhancedSecurityGate] Instruction scan failed: ${err instanceof Error ? err.message : String(err)}`);
-                    return null;
-                })
-                : Promise.resolve(null),
-            // 2. SAST scan on code
-            this.sastScanner.scan(filepath, code).catch(err => {
-                console.warn(`[EnhancedSecurityGate] SAST scan failed: ${err instanceof Error ? err.message : String(err)}`);
-                return { passed: true, findings: [], criticalCount: 0, highCount: 0 };
-            }),
-            // 3. License scan
-            this.licenseScanner.scan(filepath, code).catch(err => {
-                console.warn(`[EnhancedSecurityGate] License scan failed: ${err instanceof Error ? err.message : String(err)}`);
-                return { passed: true, findings: [], criticalCount: 0 };
-            }),
-            // 4. Provider bias detection
-            this.providerBiasDetector.scan(filepath, code).catch(err => {
-                console.warn(`[EnhancedSecurityGate] Provider bias scan failed: ${err instanceof Error ? err.message : String(err)}`);
-                return { passed: true, findings: [], criticalCount: 0 };
-            }),
-        ];
-        // Execute all scans in parallel
-        const [instructionSast, sast, license, providerBias] = await Promise.all(scanPromises);
-        // Process results
-        if (instructionSast && !instructionSast.passed) {
-            errors.push(`Security vulnerabilities in instruction: ${instructionSast.findings.length} findings`);
-        }
-        if (!sast.passed) {
-            errors.push(`Security vulnerabilities: ${sast.criticalCount} critical, ${sast.highCount} high`);
-        }
-        if (!license.passed) {
-            errors.push(`License conflicts: ${license.criticalCount} critical issues`);
-        }
-        if (!providerBias.passed) {
-            warnings.push(`Provider bias detected: ${providerBias.criticalCount} critical issues`);
-            // Provider bias is a warning, not blocking (unless policy enforces)
-        }
-        // 5. Uncertainty quantification (runs after parallel scans, depends on context)
-        // This is independent but typically faster, so can run in parallel with scans if needed
-        let uncertainty;
-        if (this.uncertaintyQuantifier && context?.query && code) {
-            uncertainty = await this.uncertaintyQuantifier.quantifyUncertainty(context.query, code, { chunks: context.chunks }).catch(err => {
-                console.warn(`[EnhancedSecurityGate] Uncertainty quantification failed: ${err instanceof Error ? err.message : String(err)}`);
-                return undefined;
-            });
-            if (uncertainty?.isHallucinationRisk) {
-                warnings.push(`High epistemic uncertainty detected: Possible hallucination risk`);
-            }
-        }
-        const passed = errors.length === 0; // Only fail on critical errors
-        // Cache results for future use (performance optimization)
-        this.scanCache.set(filepath, code, sast, license, providerBias);
-        return {
-            passed,
-            sast,
-            license,
-            providerBias,
-            uncertainty,
-            errors,
-            warnings,
-        };
-    }
-    /**
-     * Fast pre-check on instruction (before expensive operations)
-     */
-    async fastCheck(instruction) {
-        const findings = [];
-        const sastResult = await this.sastScanner.scanInstruction(instruction);
-        if (sastResult && !sastResult.passed) {
-            findings.push(...sastResult.findings.map(f => `${f.severity}: ${f.description}`));
-        }
-        return {
-            allowed: findings.length === 0,
-            findings,
-        };
-    }
-}
-//# sourceMappingURL=enhanced-security-gate.js.map

package/dist/infrastructure/security/license-scanner.js

@@ -1,167 +0,0 @@
-/**
- * Infrastructure: License Scanner
- * Detects license contamination in AI-generated code
- *
- * Research Finding: 35% of AI-generated code contains license irregularities
- * Critical for preventing IP contamination and legal liability
- *
- * Based on research: AI Ethics for Coding Assistants
- * - GPL/MIT/Apache conflicts are common
- * - Automated detection prevents legal liability
- * - Must integrate into CI/CD pipeline
- */
-/**
- * License Compatibility Matrix
- * Based on common open-source license compatibility rules
- */
-const LICENSE_COMPATIBILITY = {
-    // GPL is incompatible with most proprietary licenses
-    'GPL-2.0': ['proprietary', 'Apache-2.0'], // GPL-2.0 incompatible with Apache-2.0
-    'GPL-3.0': ['proprietary', 'Apache-2.0'],
-    // MIT is permissive and compatible with most
-    'MIT': [], // MIT is compatible with everything
-    // Apache-2.0 is compatible with most except GPL-2.0
-    'Apache-2.0': ['GPL-2.0'],
-    // BSD is permissive
-    'BSD-2-Clause': [],
-    'BSD-3-Clause': [],
-};
-/**
- * License Scanner
- * Scans code for license headers and detects conflicts
- */
-export class LicenseScanner {
-    /**
-     * Scan code for license information
-     */
-    async scan(filepath, code) {
-        const findings = [];
-        const detectedLicenses = new Set();
-        // 1. Detect license headers in code
-        const licenseHeaders = this.detectLicenseHeaders(code);
-        // 2. Check for license conflicts
-        for (const detectedLicense of licenseHeaders) {
-            detectedLicenses.add(detectedLicense);
-            // Check compatibility with other detected licenses
-            for (const otherLicense of licenseHeaders) {
-                if (detectedLicense !== otherLicense) {
-                    const incompatibilities = LICENSE_COMPATIBILITY[detectedLicense] || [];
-                    if (incompatibilities.includes(otherLicense)) {
-                        findings.push({
-                            license: detectedLicense,
-                            filepath,
-                            conflictType: 'incompatible',
-                            description: `License conflict: ${detectedLicense} is incompatible with ${otherLicense}`,
-                            recommendation: `Remove one of the conflicting licenses or use a compatible license`,
-                            severity: 'critical',
-                        });
-                    }
-                }
-            }
-        }
-        // 3. Check for missing licenses in generated code
-        // If code appears to use open-source patterns but has no license, warn
-        if (licenseHeaders.length === 0 && this.hasOpenSourcePatterns(code)) {
-            findings.push({
-                license: 'unknown',
-                filepath,
-                conflictType: 'missing',
-                description: 'Generated code may contain open-source patterns but no license header detected',
-                recommendation: 'Add appropriate license header or clarify license status',
-                severity: 'medium',
-            });
-        }
-        // 4. Check for ambiguous license statements
-        const ambiguousLicenses = this.detectAmbiguousLicenses(code);
-        for (const ambiguous of ambiguousLicenses) {
-            findings.push({
-                license: ambiguous,
-                filepath,
-                conflictType: 'ambiguous',
-                description: `Ambiguous license statement detected: ${ambiguous}`,
-                recommendation: 'Clarify license type explicitly',
-                severity: 'low',
-            });
-        }
-        const criticalCount = findings.filter(f => f.severity === 'critical').length;
-        const licenseSummary = {};
-        detectedLicenses.forEach(license => {
-            licenseSummary[license] = (licenseSummary[license] || 0) + 1;
-        });
-        return {
-            findings,
-            totalFindings: findings.length,
-            criticalCount,
-            passed: criticalCount === 0,
-            licenseSummary,
-        };
-    }
-    /**
-     * Detect license headers in code
-     */
-    detectLicenseHeaders(code) {
-        const licenses = [];
-        const upperCode = code.toUpperCase();
-        // Common license patterns
-        const patterns = [
-            { pattern: /GPL.*?v?[23]/i, license: 'GPL-3.0' },
-            { pattern: /GNU.*?GENERAL.*?PUBLIC.*?LICENSE/i, license: 'GPL-3.0' },
-            { pattern: /MIT.*?LICENSE/i, license: 'MIT' },
-            { pattern: /THE.*?MIT.*?LICENSE/i, license: 'MIT' },
-            { pattern: /APACHE.*?LICENSE.*?v?2/i, license: 'Apache-2.0' },
-            { pattern: /BSD.*?LICENSE/i, license: 'BSD-3-Clause' },
-            { pattern: /BSD.*?2.*?CLAUSE/i, license: 'BSD-2-Clause' },
-            { pattern: /ISC.*?LICENSE/i, license: 'ISC' },
-            { pattern: /PROPRIETARY/i, license: 'proprietary' },
-        ];
-        for (const { pattern, license } of patterns) {
-            if (pattern.test(code)) {
-                licenses.push(license);
-            }
-        }
-        return [...new Set(licenses)]; // Remove duplicates
-    }
-    /**
-     * Check if code has open-source patterns (might need license)
-     */
-    hasOpenSourcePatterns(code) {
-        // Patterns that suggest open-source code
-        const patterns = [
-            /copyright/i,
-            /license/i,
-            /github\.com/i,
-            /npm/i,
-            /import.*from.*['"]/i,
-            /require\(/i,
-        ];
-        return patterns.some(pattern => pattern.test(code));
-    }
-    /**
-     * Detect ambiguous license statements
-     */
-    detectAmbiguousLicenses(code) {
-        const ambiguous = [];
-        // Ambiguous patterns
-        if (/open.*?source/i.test(code) && !this.hasExplicitLicense(code)) {
-            ambiguous.push('open-source (unclear)');
-        }
-        if (/free.*?software/i.test(code) && !this.hasExplicitLicense(code)) {
-            ambiguous.push('free software (unclear)');
-        }
-        return ambiguous;
-    }
-    /**
-     * Check if code has explicit license statement
-     */
-    hasExplicitLicense(code) {
-        const explicitPatterns = [
-            /MIT/i,
-            /GPL/i,
-            /Apache/i,
-            /BSD/i,
-            /LICENSE.*?FILE/i,
-        ];
-        return explicitPatterns.some(pattern => pattern.test(code));
-    }
-}
-//# sourceMappingURL=license-scanner.js.map

package/dist/infrastructure/security/provider-bias-detector.js

@@ -1,164 +0,0 @@
-/**
- * Infrastructure: Provider Bias Detector
- * Detects vendor-specific SDK/API usage that creates vendor lock-in
- *
- * Research Finding: LLMs systematically favor Google/Amazon services
- * This creates structural vendor lock-in and violates neutrality
- *
- * Based on research: AI Ethics for Coding Assistants
- * - Provider bias detected in LLM outputs
- * - Creates vendor lock-in risk
- * - Must audit and enforce vendor neutrality
- */
-/**
- * Provider-specific patterns
- * Maps common provider services to vendor names
- */
-const PROVIDER_PATTERNS = {
-    google: {
-        provider: 'Google Cloud',
-        services: [
-            /@google-cloud\//i,
-            /google\.cloud\./i,
-            /googleapis\.com/i,
-            /firebase/i,
-            /gcp/i,
-            /cloud\.google\.com/i,
-        ],
-    },
-    amazon: {
-        provider: 'Amazon Web Services',
-        services: [
-            /@aws-sdk\//i,
-            /aws\./i,
-            /amazonaws\.com/i,
-            /lambda/i,
-            /s3/i,
-            /dynamodb/i,
-            /@aws-amplify/i,
-        ],
-    },
-    microsoft: {
-        provider: 'Microsoft Azure',
-        services: [
-            /@azure\//i,
-            /azure\./i,
-            /azurewebsites\.net/i,
-            /blob\.core\.windows\.net/i,
-            /@microsoft\/azure/i,
-        ],
-    },
-};
-/**
- * Provider Bias Detector
- * Scans code for provider-specific dependencies and flags vendor lock-in risks
- */
-export class ProviderBiasDetector {
-    allowedProviders; // If set, only these providers are allowed
-    constructor(allowedProviders) {
-        this.allowedProviders = allowedProviders;
-    }
-    /**
-     * Scan code for provider bias
-     */
-    async scan(filepath, code) {
-        const findings = [];
-        const providerCounts = {};
-        // 1. Detect provider-specific services
-        const detectedProviders = this.detectProviders(code);
-        // 2. Count provider usage
-        for (const provider of detectedProviders) {
-            providerCounts[provider] = (providerCounts[provider] || 0) + 1;
-        }
-        // 3. Check for vendor lock-in patterns
-        if (Object.keys(providerCounts).length > 0) {
-            // Check if only one provider is used (lock-in risk)
-            const uniqueProviders = Object.keys(providerCounts);
-            if (uniqueProviders.length === 1 && !this.allowedProviders?.includes(uniqueProviders[0])) {
-                findings.push({
-                    provider: uniqueProviders[0],
-                    service: 'multiple',
-                    filepath,
-                    description: `Code exclusively uses ${uniqueProviders[0]} services, creating vendor lock-in risk`,
-                    recommendation: `Consider vendor-neutral alternatives or multi-cloud architecture to maintain flexibility`,
-                    severity: 'high',
-                });
-            }
-            // Check if provider is not in allowed list
-            if (this.allowedProviders && uniqueProviders.length > 0) {
-                for (const provider of uniqueProviders) {
-                    if (!this.allowedProviders.includes(provider)) {
-                        findings.push({
-                            provider,
-                            service: 'multiple',
-                            filepath,
-                            description: `Provider ${provider} is not in allowed providers list`,
-                            recommendation: `Use an allowed provider or update policy to allow ${provider}`,
-                            severity: 'critical',
-                        });
-                    }
-                }
-            }
-        }
-        // 4. Check for provider-specific hardcoding
-        const hardcodedServices = this.detectHardcodedServices(code);
-        for (const service of hardcodedServices) {
-            findings.push({
-                provider: service.provider,
-                service: service.name,
-                filepath,
-                description: `Hardcoded ${service.provider} service: ${service.name}`,
-                recommendation: `Use environment variables or configuration to make service provider configurable`,
-                severity: 'medium',
-            });
-        }
-        const criticalCount = findings.filter(f => f.severity === 'critical').length;
-        return {
-            findings,
-            totalFindings: findings.length,
-            criticalCount,
-            providerSummary: providerCounts,
-            passed: criticalCount === 0,
-        };
-    }
-    /**
-     * Detect provider-specific services in code
-     */
-    detectProviders(code) {
-        const providers = [];
-        for (const [key, { provider, services }] of Object.entries(PROVIDER_PATTERNS)) {
-            for (const pattern of services) {
-                if (pattern.test(code)) {
-                    providers.push(provider);
-                    break; // Found this provider, move to next
-                }
-            }
-        }
-        return [...new Set(providers)]; // Remove duplicates
-    }
-    /**
-     * Detect hardcoded service endpoints/configurations
-     */
-    detectHardcodedServices(code) {
-        const hardcoded = [];
-        // Hardcoded endpoints
-        const endpointPatterns = [
-            { pattern: /https?:\/\/.*\.amazonaws\.com/i, provider: 'Amazon Web Services', name: 'AWS endpoint' },
-            { pattern: /https?:\/\/.*\.googleapis\.com/i, provider: 'Google Cloud', name: 'Google API endpoint' },
-            { pattern: /https?:\/\/.*\.azurewebsites\.net/i, provider: 'Microsoft Azure', name: 'Azure endpoint' },
-        ];
-        for (const { pattern, provider, name } of endpointPatterns) {
-            if (pattern.test(code)) {
-                hardcoded.push({ provider, name });
-            }
-        }
-        return hardcoded;
-    }
-    /**
-     * Set allowed providers (enforces vendor neutrality policy)
-     */
-    setAllowedProviders(providers) {
-        this.allowedProviders = providers;
-    }
-}
-//# sourceMappingURL=provider-bias-detector.js.map