codehere 1.0.1 → 1.0.3

package/dist/infrastructure/security/ship-scan.js

@@ -1,195 +0,0 @@
-/**
- * Ship-readiness scan — orchestrates the installed OSS scanners (gitleaks + semgrep) and adds
- * codehere's value: PRIORITIZE by CONSEQUENCE and surface the ONE blocker that gets you hacked,
- * in plain language for a non-expert.
- *
- * Deterministic, ZERO model tokens — the detection is OSS (battle-tested, better than hand-rolled);
- * codehere is the non-expert layer on top. See docs/PRODUCT_10X.md (R1 detect via OSS, R2 prioritize).
- */
-import { spawnSync, execFileSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, existsSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, relative, isAbsolute } from 'node:path';
-import { vibeChecks } from './vibe-checks.js';
-const TIER_RANK = { critical: 0, high: 1, medium: 2 };
-function installed(tool) {
-    try {
-        execFileSync('which', [tool], { stdio: 'ignore' });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function rel(dir, file) {
-    if (!file)
-        return '';
-    return isAbsolute(file) ? relative(dir, file) : file;
-}
-/**
- * A secret parked in a gitignored file (the .env our own fix moves it to) is AT REST — it won't be
- * committed or shipped, so it's not a ship-blocker. Filter those out, otherwise the scan re-flags the
- * very file the fix created and "prove it's closed" contradicts itself. Honors full .gitignore
- * semantics via git; falls back to a literal .gitignore read for the common .env case in a non-git dir.
- */
-function filterAtRest(dir, findings) {
-    if (findings.length === 0)
-        return findings;
-    const files = [...new Set(findings.map((f) => f.file))];
-    const ignored = new Set();
-    const res = spawnSync('git', ['-C', dir, 'check-ignore', '--stdin'], { input: files.join('\n'), encoding: 'utf8' });
-    if (res.status === 0 && res.stdout) {
-        for (const p of res.stdout
-            .split('\n')
-            .map((s) => s.trim())
-            .filter(Boolean))
-            ignored.add(p);
-    }
-    else if (res.status === 128) {
-        // Not a git repo yet — minimal fallback so the fix→prove loop is honest even pre-`git init`.
-        const giPath = join(dir, '.gitignore');
-        const gi = existsSync(giPath) ? readFileSync(giPath, 'utf8') : '';
-        const patterns = gi
-            .split('\n')
-            .map((l) => l.trim())
-            .filter((l) => l && !l.startsWith('#'));
-        for (const f of files) {
-            const base = f.split('/').pop() || f;
-            if (patterns.some((p) => p === f || p === base || (p.startsWith('*') && base.endsWith(p.slice(1)))))
-                ignored.add(f);
-        }
-    }
-    return findings.filter((f) => !ignored.has(f.file));
-}
-/** gitleaks = exposed secrets/keys — the #1 way vibe-coded apps get owned. Always critical. */
-function runGitleaks(dir) {
-    const tmp = join(mkdtempSync(join(tmpdir(), 'sscan-')), 'gl.json');
-    // gitleaks exits non-zero when leaks are found — spawnSync (no throw), read the report regardless.
-    spawnSync('gitleaks', ['detect', '--no-git', '--source', dir, '-f', 'json', '-r', tmp], { stdio: 'ignore' });
-    // No report file = the run died before writing one. Zero findings here means "we don't know",
-    // not "nothing found", so ok:false — the surface must not spend it as coverage.
-    if (!existsSync(tmp))
-        return { ok: false, findings: [] };
-    let arr;
-    try {
-        arr = JSON.parse(readFileSync(tmp, 'utf8'));
-    }
-    catch {
-        return { ok: false, findings: [] };
-    }
-    const findings = (arr || []).map((f) => {
-        const ruleId = String(f.RuleID || 'secret');
-        const file = rel(dir, String(f.File || ''));
-        return {
-            tool: 'gitleaks',
-            ruleId,
-            file,
-            line: Number(f.StartLine || 0),
-            tier: 'critical',
-            what: `A live secret (${ruleId}) is hardcoded in ${file}. Anyone who can read your code — in your repo, or shipped to your users — has it, and can use it to reach whatever it unlocks: your database, your users' data, your paid APIs.`,
-        };
-    });
-    return { ok: true, findings };
-}
-/** Map a semgrep check to a consequence tier + plain-language "what happens". */
-function classifySemgrep(checkId, severity) {
-    const id = checkId.toLowerCase();
-    const danger = (kind) => (file) => `Untrusted input reaches ${kind} in ${file}. An attacker can ${{
-        command: 'run any command on your server',
-        sql: 'read or wipe your entire database',
-        code: 'run their own code in your app',
-        path: "read files outside your app (like other users' data or secrets)",
-        ssrf: 'make your server hit internal/private systems',
-        xss: "run scripts in your users' browsers (steal sessions, deface the page)",
-    }[kind] || 'do something you did not intend'}.`;
-    if (/(command|child.?process|os.?command|exec)/.test(id))
-        return { tier: 'critical', what: danger('command') };
-    if (/(sql|nosql|query.?injection)/.test(id))
-        return { tier: 'critical', what: danger('sql') };
-    if (/(eval|code.?injection|deserial)/.test(id))
-        return { tier: 'critical', what: danger('code') };
-    if (/(path.?traversal|directory.?traversal|zip.?slip)/.test(id))
-        return { tier: 'critical', what: danger('path') };
-    if (/ssrf/.test(id))
-        return { tier: 'critical', what: danger('ssrf') };
-    if (/(jwt|secret|hardcoded|api.?key|password)/.test(id))
-        return {
-            tier: 'critical',
-            what: (file) => `A secret or weak credential handling was found in ${file} — it can let an attacker into your data.`,
-        };
-    if (/xss/.test(id))
-        return { tier: 'high', what: danger('xss') };
-    const sev = String(severity || '').toUpperCase();
-    const tier = sev === 'ERROR' ? 'high' : 'medium';
-    return {
-        tier,
-        what: (file) => `A security issue (${checkId.split('.').pop()}) was found in ${file} that could be exploited before you ship.`,
-    };
-}
-function runSemgrep(dir) {
-    const tmp = join(mkdtempSync(join(tmpdir(), 'sscan-')), 'sg.json');
-    // p/default is the curated default registry ruleset; --quiet keeps output clean. It is NOT
-    // offline and NOT fast — measured 2026-08-08, `semgrep scan --config p/default` on a cold
-    // registry cache blew past 200s on a developer laptop and hit the timeout below. The earlier
-    // comment here claimed "offline-capable, fast", which is why the zero findings it returns on
-    // timeout were being read as a clean scan.
-    spawnSync('semgrep', ['scan', '--config', 'p/default', '--json', '--quiet', '--no-git-ignore', dir, '-o', tmp], {
-        stdio: 'ignore',
-        timeout: 180_000,
-    });
-    // Timeout, network failure, or crash: no report file. Zero findings is absence of evidence.
-    if (!existsSync(tmp))
-        return { ok: false, findings: [] };
-    let json;
-    try {
-        json = JSON.parse(readFileSync(tmp, 'utf8'));
-    }
-    catch {
-        return { ok: false, findings: [] };
-    }
-    const findings = (json.results || []).map((r) => {
-        const checkId = String(r.check_id || 'rule');
-        const file = rel(dir, String(r.path || ''));
-        const severity = String(r.extra?.severity || '');
-        const c = classifySemgrep(checkId, severity);
-        return {
-            tool: 'semgrep',
-            ruleId: checkId.split('.').pop() || checkId,
-            file,
-            line: Number(r.start?.line || 0),
-            tier: c.tier,
-            what: c.what(file),
-        };
-    });
-    return { ok: true, findings };
-}
-/** Run the OSS scanners on `dir`, normalize + prioritize by consequence, surface the ONE top blocker. */
-export function shipScan(dir) {
-    const hasGl = installed('gitleaks');
-    const hasSg = installed('semgrep');
-    const missing = [];
-    if (!hasGl)
-        missing.push('gitleaks');
-    if (!hasSg)
-        missing.push('semgrep');
-    const all = [];
-    const gl = hasGl ? runGitleaks(dir) : { ok: false, findings: [] };
-    const sg = hasSg ? runSemgrep(dir) : { ok: false, findings: [] };
-    all.push(...gl.findings, ...sg.findings);
-    // Installed but produced nothing readable — a coverage hole the surface has to name out loud.
-    const failed = [];
-    if (hasGl && !gl.ok)
-        failed.push('gitleaks');
-    if (hasSg && !sg.ok)
-        failed.push('semgrep');
-    // codehere's own vibe-coder-specific checks — the dangers gitleaks/semgrep miss (always runs, free).
-    all.push(...vibeChecks(dir));
-    // Drop anything that lives in a gitignored file — it's at rest, won't ship or get committed, so it's
-    // not a ship-blocker. This is what makes the fix→prove loop honest: the fix parks a secret in a
-    // gitignored .env, and the re-scan must come back clean instead of re-flagging the file it just created.
-    const findings = filterAtRest(dir, all);
-    // Prioritize: consequence tier first, then secrets (gitleaks) ahead of code patterns at the same tier.
-    findings.sort((a, b) => TIER_RANK[a.tier] - TIER_RANK[b.tier] || (a.tool === 'gitleaks' ? -1 : 1));
-    return { ran: { gitleaks: gl.ok, semgrep: sg.ok }, missing, failed, findings, top: findings[0] || null };
-}
-//# sourceMappingURL=ship-scan.js.map