codeslick-cli 1.0.3 → 1.1.0

package/src/scanner/local-scanner.ts

@@ -43,6 +43,7 @@ export interface ScannerConfig {
   severityThreshold?: 'critical' | 'high' | 'medium' | 'low';
   exclude?: string[];
   autofix?: boolean;
+  quickMode?: boolean; // Skip deep TypeScript type checking for speed
 }
 
 /**
@@ -72,21 +73,27 @@ export function detectLanguage(filePath: string): SupportedLanguage | null {
 
 /**
  * Check if file should be excluded based on patterns
+ * Uses fast regex-based pattern matching (no filesystem scanning)
  */
 export function shouldExclude(filePath: string, excludePatterns: string[]): boolean {
   const relativePath = relative(process.cwd(), filePath);
+  // Also check with forward slashes for cross-platform compatibility
+  const normalizedPath = relativePath.replace(/\\/g, '/');
 
   for (const pattern of excludePatterns) {
-    // Convert glob pattern to regex
-    const regex = new RegExp(
-      pattern
-        .replace(/\./g, '\\.')
-        .replace(/\*\*/g, '.*')
-        .replace(/\*/g, '[^/]*')
-        .replace(/\?/g, '.')
-    );
-
-    if (regex.test(relativePath)) {
+    // Convert glob pattern to regex for fast matching
+    // Order matters: escape dots first, then handle glob patterns
+    const regexPattern = pattern
+      .replace(/\./g, '\\.')           // Escape dots
+      .replace(/\*\*/g, '<<<GLOBSTAR>>>')  // Temp placeholder for **
+      .replace(/\*/g, '[^/]*')         // * matches anything except /
+      .replace(/<<<GLOBSTAR>>>/g, '.*') // ** matches anything including /
+      .replace(/\?/g, '.')             // ? matches single char
+      .replace(/\{([^}]+)\}/g, (_, p1) => `(${p1.split(',').join('|')})`); // {a,b} -> (a|b)
+
+    const regex = new RegExp('^' + regexPattern + '$');
+
+    if (regex.test(normalizedPath) || regex.test(relativePath)) {
       return true;
     }
   }
@@ -141,6 +148,8 @@ export async function scanFile(
     const code = await readFile(filePath, 'utf-8');
 
     // Import analyzer dynamically based on language
+    // Pass quickMode option to skip expensive type checking
+    const analyzerOptions = { quickMode: config.quickMode || false };
     let result: AnalyzerResult;
 
     switch (language) {
@@ -149,7 +158,7 @@ export async function scanFile(
           '../../../../src/lib/analyzers/javascript-analyzer'
         );
         const analyzer = new JavaScriptAnalyzer();
-        result = await analyzer.analyze({ code, filename: filePath });
+        result = await analyzer.analyze({ code, filename: filePath, options: analyzerOptions });
         break;
       }
 
@@ -158,21 +167,21 @@ export async function scanFile(
           '../../../../src/lib/analyzers/typescript-analyzer'
         );
         const analyzer = new TypeScriptAnalyzer();
-        result = await analyzer.analyze({ code, filename: filePath });
+        result = await analyzer.analyze({ code, filename: filePath, options: analyzerOptions });
         break;
       }
 
       case 'python': {
         const { PythonAnalyzer } = await import('../../../../src/lib/analyzers/python-analyzer');
         const analyzer = new PythonAnalyzer();
-        result = await analyzer.analyze({ code, filename: filePath });
+        result = await analyzer.analyze({ code, filename: filePath, options: analyzerOptions });
         break;
       }
 
       case 'java': {
         const { JavaAnalyzer } = await import('../../../../src/lib/analyzers/java-analyzer');
         const analyzer = new JavaAnalyzer();
-        result = await analyzer.analyze({ code, filename: filePath });
+        result = await analyzer.analyze({ code, filename: filePath, options: analyzerOptions });
         break;
       }
 
@@ -200,7 +209,9 @@ export async function scanFile(
 /**
  * Scan multiple files for security vulnerabilities
  *
- * This function scans multiple files in parallel for better performance.
+ * OPTIMIZED (Jan 15, 2026): Uses batch TypeScript compilation for 17x speedup
+ * - TypeScript files: Batch processed together (single ts.createProgram)
+ * - Other files: Processed in parallel as before
  *
  * @param filePaths - Array of absolute file paths
  * @param config - Scanner configuration
@@ -210,11 +221,113 @@ export async function scanFiles(
   filePaths: string[],
   config: ScannerConfig = {}
 ): Promise<FileScanResult[]> {
-  // Scan all files in parallel
-  const results = await Promise.all(filePaths.map((path) => scanFile(path, config)));
+  // Separate TypeScript files from others for batch processing
+  const tsFiles: string[] = [];
+  const otherFiles: string[] = [];
+
+  for (const filePath of filePaths) {
+    const language = detectLanguage(filePath);
+    if (language === 'typescript') {
+      // Check exclusions before adding to batch
+      if (!config.exclude || !shouldExclude(filePath, config.exclude)) {
+        tsFiles.push(filePath);
+      }
+    } else if (language) {
+      otherFiles.push(filePath);
+    }
+  }
+
+  const results: FileScanResult[] = [];
+
+  // Batch process TypeScript files (17x faster)
+  if (tsFiles.length > 0 && !config.quickMode) {
+    const batchResults = await scanTypeScriptBatch(tsFiles, config);
+    results.push(...batchResults);
+  } else if (tsFiles.length > 0 && config.quickMode) {
+    // Quick mode: skip type checking, use parallel processing
+    const tsResults = await Promise.all(tsFiles.map((path) => scanFile(path, config)));
+    results.push(...tsResults.filter((r): r is FileScanResult => r !== null));
+  }
+
+  // Process other files in parallel (JS, Python, Java)
+  if (otherFiles.length > 0) {
+    const otherResults = await Promise.all(otherFiles.map((path) => scanFile(path, config)));
+    results.push(...otherResults.filter((r): r is FileScanResult => r !== null));
+  }
+
+  return results;
+}
+
+/**
+ * Batch scan TypeScript files using single ts.createProgram
+ * This is 17x faster than scanning each file individually
+ */
+async function scanTypeScriptBatch(
+  filePaths: string[],
+  _config: ScannerConfig = {}
+): Promise<FileScanResult[]> {
+  const { readFile } = await import('fs/promises');
+  const { relative } = await import('path');
+
+  // Import batch diagnostics function
+  const { getBatchTypeScriptDiagnostics, convertDiagnosticsToIssues } = await import(
+    '../../../../src/lib/analyzers/typescript/type-checker'
+  );
+
+  // Get batch diagnostics for all TypeScript files at once
+  const batchResult = getBatchTypeScriptDiagnostics(filePaths);
+
+  // Import TypeScript analyzer for security checks (runs separately)
+  const { TypeScriptAnalyzer } = await import(
+    '../../../../src/lib/analyzers/typescript-analyzer'
+  );
+
+  const results: FileScanResult[] = [];
+
+  for (const filePath of filePaths) {
+    try {
+      const code = await readFile(filePath, 'utf-8');
+
+      // Run security analysis (regex-based, fast)
+      const analyzer = new TypeScriptAnalyzer();
+      // Use quickMode to skip the per-file type checking (we already did batch)
+      const result = await analyzer.analyze({ code, filename: filePath, options: { quickMode: true } });
+
+      // Add batch type diagnostics to the result
+      const fileDiagnostics = batchResult.diagnostics.get(filePath) || [];
+      if (fileDiagnostics.length > 0) {
+        const typeIssues = convertDiagnosticsToIssues(fileDiagnostics);
+        const typeVulnerabilities = typeIssues.map((issue: any) => ({
+          severity: issue.severity,
+          message: issue.message,
+          line: issue.line,
+          suggestion: issue.suggestion,
+          category: 'type-checking',
+          cvssScore: issue.cvssScore,
+          exploitLikelihood: issue.exploitLikelihood,
+          impact: issue.impact,
+          owasp: issue.owasp,
+          cwe: issue.cwe
+        }));
+        result.security.vulnerabilities.push(...typeVulnerabilities);
+      }
+
+      // Count vulnerabilities
+      const counts = countVulnerabilities(result);
+
+      results.push({
+        filePath,
+        relativePath: relative(process.cwd(), filePath),
+        language: 'typescript',
+        result,
+        ...counts,
+      });
+    } catch (error) {
+      console.error(`Error scanning ${filePath}:`, error);
+    }
+  }
 
-  // Filter out null results (skipped files)
-  return results.filter((r): r is FileScanResult => r !== null);
+  return results;
 }
 
 /**