codeslick-cli 1.0.0

package/src/reporters/cli-reporter.ts

@@ -0,0 +1,282 @@
+/**
+ * CLI Reporter - Terminal Output Formatting
+ *
+ * This module provides beautiful, colored terminal output for scan results.
+ * It uses chalk for colors, ora for spinners, and cli-table3 for tables.
+ *
+ * Output Features:
+ * - Color-coded severity levels
+ * - Progress spinners during scanning
+ * - Summary tables with statistics
+ * - Clickable file paths (VS Code terminal support)
+ * - JSON output mode for CI/CD
+ *
+ * @module packages/cli/src/reporters/cli-reporter
+ */
+
+import chalk from 'chalk';
+import Table from 'cli-table3';
+import type { FileScanResult } from '../scanner/local-scanner';
+import type { SecurityVulnerability } from '../../../../src/lib/analyzers/types';
+
+/**
+ * Get severity color for terminal output
+ */
+export function getSeverityColor(severity: string): (text: string) => string {
+  switch (severity.toUpperCase()) {
+    case 'CRITICAL':
+      return chalk.red.bold;
+    case 'HIGH':
+      return chalk.red;
+    case 'MEDIUM':
+      return chalk.yellow;
+    case 'LOW':
+      return chalk.blue;
+    default:
+      return chalk.gray;
+  }
+}
+
+/**
+ * Get severity symbol/emoji
+ */
+export function getSeveritySymbol(severity: string): string {
+  switch (severity.toUpperCase()) {
+    case 'CRITICAL':
+      return '✖';
+    case 'HIGH':
+      return '⚠';
+    case 'MEDIUM':
+      return '◆';
+    case 'LOW':
+      return '○';
+    default:
+      return '·';
+  }
+}
+
+/**
+ * Print scan results summary table
+ */
+export function printSummaryTable(results: FileScanResult[]): void {
+  const totalFiles = results.length;
+  const totalCritical = results.reduce((sum, r) => sum + r.critical, 0);
+  const totalHigh = results.reduce((sum, r) => sum + r.high, 0);
+  const totalMedium = results.reduce((sum, r) => sum + r.medium, 0);
+  const totalLow = results.reduce((sum, r) => sum + r.low, 0);
+  const totalVulns = totalCritical + totalHigh + totalMedium + totalLow;
+
+  const filesWithIssues = results.filter(
+    (r) => r.critical > 0 || r.high > 0 || r.medium > 0 || r.low > 0
+  ).length;
+
+  console.log('');
+  console.log(chalk.bold('Scan Summary'));
+  console.log(chalk.gray('─'.repeat(50)));
+
+  const table = new Table({
+    head: [chalk.bold('Metric'), chalk.bold('Count')],
+    colWidths: [30, 15],
+    style: {
+      head: [],
+      border: ['gray'],
+    },
+  });
+
+  table.push(
+    ['Files Scanned', chalk.white(totalFiles.toString())],
+    ['Files with Issues', filesWithIssues > 0 ? chalk.yellow(filesWithIssues.toString()) : chalk.green('0')],
+    ['Total Vulnerabilities', totalVulns > 0 ? chalk.red(totalVulns.toString()) : chalk.green('0')],
+    ['', ''],
+    [chalk.red('✖ CRITICAL'), totalCritical > 0 ? chalk.red.bold(totalCritical.toString()) : chalk.gray('0')],
+    [chalk.red('⚠ HIGH'), totalHigh > 0 ? chalk.red(totalHigh.toString()) : chalk.gray('0')],
+    [chalk.yellow('◆ MEDIUM'), totalMedium > 0 ? chalk.yellow(totalMedium.toString()) : chalk.gray('0')],
+    [chalk.blue('○ LOW'), totalLow > 0 ? chalk.blue(totalLow.toString()) : chalk.gray('0')]
+  );
+
+  console.log(table.toString());
+}
+
+/**
+ * Print detailed vulnerabilities for a file
+ */
+export function printFileVulnerabilities(result: FileScanResult): void {
+  const vulnerabilities = result.result.security?.vulnerabilities || [];
+
+  if (vulnerabilities.length === 0) {
+    return;
+  }
+
+  console.log('');
+  console.log(chalk.bold(`📄 ${result.relativePath}`) + chalk.gray(` (${result.language})`));
+
+  vulnerabilities.forEach((vuln: SecurityVulnerability, index: number) => {
+    const colorFn = getSeverityColor(vuln.severity);
+    const symbol = getSeveritySymbol(vuln.severity);
+
+    console.log('');
+    console.log(
+      `  ${colorFn(symbol)} ${colorFn(vuln.severity)}` +
+        chalk.gray(` (Line ${vuln.line})`) +
+        (vuln.cvssScore ? chalk.gray(` - CVSS ${vuln.cvssScore}`) : '')
+    );
+
+    console.log(`     ${chalk.white(vuln.message)}`);
+
+    if (vuln.suggestion) {
+      console.log(`     ${chalk.green('Fix:')} ${vuln.suggestion}`);
+    }
+
+    if (vuln.owasp) {
+      console.log(`     ${chalk.gray('OWASP:')} ${vuln.owasp}`);
+    }
+
+    if (vuln.cwe) {
+      console.log(`     ${chalk.gray('CWE:')} ${vuln.cwe}`);
+    }
+  });
+
+  console.log('');
+}
+
+/**
+ * Print all scan results with details
+ */
+export function printDetailedResults(results: FileScanResult[]): void {
+  console.log('');
+  console.log(chalk.bold.underline('Detailed Results'));
+
+  const resultsWithIssues = results.filter(
+    (r) => r.critical > 0 || r.high > 0 || r.medium > 0 || r.low > 0
+  );
+
+  if (resultsWithIssues.length === 0) {
+    console.log('');
+    console.log(chalk.green('✓ No vulnerabilities found!'));
+    console.log('');
+    return;
+  }
+
+  resultsWithIssues.forEach((result) => {
+    printFileVulnerabilities(result);
+  });
+}
+
+/**
+ * Print scan start message
+ */
+export function printScanStart(fileCount: number): void {
+  console.log('');
+  console.log(chalk.bold.cyan('🔍 CodeSlick Security Scanner'));
+  console.log(chalk.gray(`Scanning ${fileCount} file(s)...`));
+}
+
+/**
+ * Print scan completion message
+ */
+export function printScanComplete(duration: number): void {
+  console.log('');
+  console.log(chalk.gray(`Scan completed in ${duration}ms`));
+}
+
+/**
+ * Print error message
+ */
+export function printError(message: string): void {
+  console.log('');
+  console.log(chalk.red.bold('✖ Error:'), chalk.red(message));
+  console.log('');
+}
+
+/**
+ * Print warning message
+ */
+export function printWarning(message: string): void {
+  console.log('');
+  console.log(chalk.yellow.bold('⚠ Warning:'), chalk.yellow(message));
+  console.log('');
+}
+
+/**
+ * Print success message
+ */
+export function printSuccess(message: string): void {
+  console.log('');
+  console.log(chalk.green.bold('✓'), chalk.green(message));
+  console.log('');
+}
+
+/**
+ * Print commit blocked message
+ */
+export function printCommitBlocked(
+  threshold: string,
+  critical: number,
+  high: number,
+  medium: number,
+  low: number
+): void {
+  console.log('');
+  console.log(chalk.red.bold('❌ Commit Blocked'));
+  console.log('');
+  console.log(chalk.red(`Security vulnerabilities found that meet or exceed the "${threshold}" threshold.`));
+  console.log('');
+
+  if (critical > 0) {
+    console.log(chalk.red(`  ✖ ${critical} CRITICAL ${critical === 1 ? 'issue' : 'issues'}`));
+  }
+  if (high > 0) {
+    console.log(chalk.red(`  ⚠ ${high} HIGH ${high === 1 ? 'issue' : 'issues'}`));
+  }
+  if (medium > 0) {
+    console.log(chalk.yellow(`  ◆ ${medium} MEDIUM ${medium === 1 ? 'issue' : 'issues'}`));
+  }
+  if (low > 0) {
+    console.log(chalk.blue(`  ○ ${low} LOW ${low === 1 ? 'issue' : 'issues'}`));
+  }
+
+  console.log('');
+  console.log(chalk.gray('Fix the issues above or use:'));
+  console.log(chalk.gray('  git commit --no-verify'));
+  console.log('');
+}
+
+/**
+ * Print commit allowed message
+ */
+export function printCommitAllowed(): void {
+  console.log('');
+  console.log(chalk.green.bold('✓ Commit Allowed'));
+  console.log(chalk.green('No vulnerabilities meet the configured severity threshold.'));
+  console.log('');
+}
+
+/**
+ * Output results as JSON
+ */
+export function printJSONResults(results: FileScanResult[]): void {
+  const output = {
+    summary: {
+      filesScanned: results.length,
+      filesWithIssues: results.filter((r) => r.critical > 0 || r.high > 0 || r.medium > 0 || r.low > 0).length,
+      totalVulnerabilities: results.reduce((sum, r) => r.critical + r.high + r.medium + r.low + sum, 0),
+      critical: results.reduce((sum, r) => sum + r.critical, 0),
+      high: results.reduce((sum, r) => sum + r.high, 0),
+      medium: results.reduce((sum, r) => sum + r.medium, 0),
+      low: results.reduce((sum, r) => sum + r.low, 0),
+    },
+    files: results.map((r) => ({
+      path: r.relativePath,
+      language: r.language,
+      vulnerabilities: r.result.security?.vulnerabilities || [],
+      counts: {
+        critical: r.critical,
+        high: r.high,
+        medium: r.medium,
+        low: r.low,
+      },
+    })),
+  };
+
+  console.log(JSON.stringify(output, null, 2));
+}

package/src/scanner/local-scanner.ts

@@ -0,0 +1,250 @@
+/**
+ * Local Scanner - Offline Security Analysis
+ *
+ * This scanner runs security analysis locally without making API calls.
+ * It reuses the existing CodeSlick analyzers for maximum compatibility.
+ *
+ * Key Features:
+ * - No API calls required (fully offline)
+ * - Fast scanning (<3s for 10 files)
+ * - Same analysis engine as GitHub App and WebTool
+ * - Supports JavaScript, TypeScript, Python, Java
+ *
+ * @module packages/cli/src/scanner/local-scanner
+ */
+
+import { readFile } from 'fs/promises';
+import { relative } from 'path';
+import type { AnalyzerResult } from '../../../../src/lib/analyzers/types';
+
+/**
+ * Supported programming languages
+ */
+export type SupportedLanguage = 'javascript' | 'typescript' | 'python' | 'java';
+
+/**
+ * Result of scanning a single file
+ */
+export interface FileScanResult {
+  filePath: string;
+  relativePath: string;
+  language: SupportedLanguage;
+  result: AnalyzerResult;
+  critical: number;
+  high: number;
+  medium: number;
+  low: number;
+}
+
+/**
+ * Configuration for local scanner
+ */
+export interface ScannerConfig {
+  severityThreshold?: 'critical' | 'high' | 'medium' | 'low';
+  exclude?: string[];
+  autofix?: boolean;
+}
+
+/**
+ * Detect programming language from file extension
+ */
+export function detectLanguage(filePath: string): SupportedLanguage | null {
+  const ext = filePath.toLowerCase();
+
+  if (ext.endsWith('.js') || ext.endsWith('.jsx')) {
+    return 'javascript';
+  }
+
+  if (ext.endsWith('.ts') || ext.endsWith('.tsx')) {
+    return 'typescript';
+  }
+
+  if (ext.endsWith('.py')) {
+    return 'python';
+  }
+
+  if (ext.endsWith('.java')) {
+    return 'java';
+  }
+
+  return null;
+}
+
+/**
+ * Check if file should be excluded based on patterns
+ */
+export function shouldExclude(filePath: string, excludePatterns: string[]): boolean {
+  const relativePath = relative(process.cwd(), filePath);
+
+  for (const pattern of excludePatterns) {
+    // Convert glob pattern to regex
+    const regex = new RegExp(
+      pattern
+        .replace(/\./g, '\\.')
+        .replace(/\*\*/g, '.*')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\?/g, '.')
+    );
+
+    if (regex.test(relativePath)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Count vulnerabilities by severity
+ */
+export function countVulnerabilities(result: AnalyzerResult) {
+  const vulnerabilities = result.security?.vulnerabilities || [];
+
+  return {
+    critical: vulnerabilities.filter((v: any) => v.severity.toLowerCase() === 'critical').length,
+    high: vulnerabilities.filter((v: any) => v.severity.toLowerCase() === 'high').length,
+    medium: vulnerabilities.filter((v: any) => v.severity.toLowerCase() === 'medium').length,
+    low: vulnerabilities.filter((v: any) => v.severity.toLowerCase() === 'low').length,
+  };
+}
+
+/**
+ * Scan a single file for security vulnerabilities
+ *
+ * This function:
+ * 1. Reads the file content
+ * 2. Detects the programming language
+ * 3. Runs the appropriate analyzer
+ * 4. Returns the analysis result
+ *
+ * @param filePath - Absolute path to the file
+ * @param config - Scanner configuration
+ * @returns Scan result or null if file should be skipped
+ */
+export async function scanFile(
+  filePath: string,
+  config: ScannerConfig = {}
+): Promise<FileScanResult | null> {
+  try {
+    // Detect language
+    const language = detectLanguage(filePath);
+    if (!language) {
+      return null; // Unsupported file type
+    }
+
+    // Check exclusions
+    if (config.exclude && shouldExclude(filePath, config.exclude)) {
+      return null; // File excluded by pattern
+    }
+
+    // Read file content
+    const code = await readFile(filePath, 'utf-8');
+
+    // Import analyzer dynamically based on language
+    let result: AnalyzerResult;
+
+    switch (language) {
+      case 'javascript': {
+        const { JavaScriptAnalyzer } = await import(
+          '../../../../src/lib/analyzers/javascript-analyzer'
+        );
+        const analyzer = new JavaScriptAnalyzer();
+        result = await analyzer.analyze({ code, filename: filePath });
+        break;
+      }
+
+      case 'typescript': {
+        const { TypeScriptAnalyzer } = await import(
+          '../../../../src/lib/analyzers/typescript-analyzer'
+        );
+        const analyzer = new TypeScriptAnalyzer();
+        result = await analyzer.analyze({ code, filename: filePath });
+        break;
+      }
+
+      case 'python': {
+        const { PythonAnalyzer } = await import('../../../../src/lib/analyzers/python-analyzer');
+        const analyzer = new PythonAnalyzer();
+        result = await analyzer.analyze({ code, filename: filePath });
+        break;
+      }
+
+      case 'java': {
+        const { JavaAnalyzer } = await import('../../../../src/lib/analyzers/java-analyzer');
+        const analyzer = new JavaAnalyzer();
+        result = await analyzer.analyze({ code, filename: filePath });
+        break;
+      }
+
+      default:
+        return null;
+    }
+
+    // Count vulnerabilities by severity
+    const counts = countVulnerabilities(result);
+
+    return {
+      filePath,
+      relativePath: relative(process.cwd(), filePath),
+      language,
+      result,
+      ...counts,
+    };
+  } catch (error) {
+    // If file cannot be read or analyzed, skip it
+    console.error(`Error scanning ${filePath}:`, error);
+    return null;
+  }
+}
+
+/**
+ * Scan multiple files for security vulnerabilities
+ *
+ * This function scans multiple files in parallel for better performance.
+ *
+ * @param filePaths - Array of absolute file paths
+ * @param config - Scanner configuration
+ * @returns Array of scan results (excluding skipped files)
+ */
+export async function scanFiles(
+  filePaths: string[],
+  config: ScannerConfig = {}
+): Promise<FileScanResult[]> {
+  // Scan all files in parallel
+  const results = await Promise.all(filePaths.map((path) => scanFile(path, config)));
+
+  // Filter out null results (skipped files)
+  return results.filter((r): r is FileScanResult => r !== null);
+}
+
+/**
+ * Check if scan results meet severity threshold
+ *
+ * Returns true if any vulnerabilities meet or exceed the threshold.
+ *
+ * @param results - Array of scan results
+ * @param threshold - Severity threshold ('critical' | 'high' | 'medium' | 'low')
+ * @returns True if threshold is exceeded, false otherwise
+ */
+export function exceedsThreshold(
+  results: FileScanResult[],
+  threshold: 'critical' | 'high' | 'medium' | 'low'
+): boolean {
+  const totalCritical = results.reduce((sum, r) => sum + r.critical, 0);
+  const totalHigh = results.reduce((sum, r) => sum + r.high, 0);
+  const totalMedium = results.reduce((sum, r) => sum + r.medium, 0);
+  const totalLow = results.reduce((sum, r) => sum + r.low, 0);
+
+  switch (threshold) {
+    case 'critical':
+      return totalCritical > 0;
+    case 'high':
+      return totalCritical > 0 || totalHigh > 0;
+    case 'medium':
+      return totalCritical > 0 || totalHigh > 0 || totalMedium > 0;
+    case 'low':
+      return totalCritical > 0 || totalHigh > 0 || totalMedium > 0 || totalLow > 0;
+    default:
+      return totalCritical > 0;
+  }
+}

package/tsconfig.json

@@ -0,0 +1,24 @@
+{
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "../../",
+    "module": "CommonJS",
+    "moduleResolution": "node",
+    "target": "ES2020",
+    "lib": ["ES2020"],
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "strict": false,
+    "resolveJsonModule": true,
+    "types": ["node"],
+    "baseUrl": "../../",
+    "paths": {
+      "@/*": ["src/*"]
+    }
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "__tests__", "../../src/**/__tests__/**", "../../src/**/*.test.ts"]
+}