devassist-agent 1.0.0

package/src/modules/dev-time/arch-risk-assessor.js

@@ -0,0 +1,250 @@
+/**
+ * ArchRiskAssessor - architecture risk evaluation.
+ *
+ * Defense target: "Architecture design flaws" (20% of 88 failures).
+ *   #7 - RecoveryEngine infinite loop (347 lines to solve a rare problem, introduced 4 new bugs)
+ *   #8 - duplicate function declarations
+ *   #9 - over-engineering (347 lines for a problem that needed 20)
+ *
+ * This module:
+ * 1. Detects error-recovery loops that could become infinite
+ * 2. Measures complexity vs problem size (over-engineering detection)
+ * 3. Detects circular dependencies
+ * 4. Flags remote code injection risks
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { Logger } = require('../../core/logger');
+const log = new Logger('ArchRiskAssessor');
+
+class ArchRiskAssessor {
+  constructor(projectRoot) {
+    this.projectRoot = projectRoot;
+  }
+
+  /**
+   * Analyze a single file for architecture risks.
+   */
+  analyzeFile(filePath, content) {
+    const findings = [];
+
+    if (!content) {
+      try { content = fs.readFileSync(filePath, 'utf-8'); } catch (_) { return findings; }
+    }
+
+    const lines = content.split('\n');
+    const lineCount = lines.length;
+
+    // --- Rule 1: Over-engineering detection ---
+    // If a single function/file is very large but solves a "simple" problem,
+    // flag it. The RecoveryEngine was 347 lines for a rarely-occurring issue.
+    const functionBlocks = this._extractFunctions(content);
+    for (const fn of functionBlocks) {
+      if (fn.lineCount > 150) {
+        findings.push({
+          ruleId: 'ar-over-engineering',
+          severity: 'warn',
+          category: 'arch',
+          message: `函数 '${fn.name}' 长达 ${fn.lineCount} 行，请评估此复杂度是否合理。（RecoveryEngine 曾 347 行，引入了 4 个新 bug。）`,
+          file: filePath,
+          line: fn.startLine,
+          suggestion: `拆分为更小的函数。如果是错误恢复逻辑，请确认不会进入无限循环。`,
+          context: { functionName: fn.name, lineCount: fn.lineCount },
+        });
+      }
+    }
+
+    // --- Rule 2: Error recovery loop detection ---
+    // Detects functions that call themselves inside a catch block (direct recursion in error recovery).
+    // Only flags DIRECT self-invocation: function foo() { try {} catch(e) { foo(); } }
+
+    // Pattern 1: explicit retry/recover/restart keywords in catch blocks
+    const retryRegex = /catch\s*\([^)]*\)\s*\{[^}]*?(?:retry|recover|restart|reinit|reload)\s*\(/gi;
+    let retryMatch;
+    while ((retryMatch = retryRegex.exec(content)) !== null) {
+      const line = content.substring(0, retryMatch.index).split('\n').length;
+      findings.push({
+        ruleId: 'ar-recovery-loop',
+        severity: 'block',
+        category: 'arch',
+        message: `错误恢复模式：在 catch 块中调用了 retry/recover/restart。这导致了故障 #7（RecoveryEngine 无限循环）。`,
+        file: filePath,
+        line,
+        suggestion: `添加重试计数器或最大重试次数限制。错误恢复代码中绝不允许无限制的重试循环。`,
+        context: { match: retryMatch[0].substring(0, 100) },
+      });
+    }
+
+    // Pattern 2: direct self-recursion — function foo() { ... catch(e) { foo( ... } }
+    const funcDeclRegex = /function\s+(\w+)\s*\([^)]*\)\s*\{/g;
+    let funcMatch;
+    while ((funcMatch = funcDeclRegex.exec(content)) !== null) {
+      const fnName = funcMatch[1];
+      const fnStart = funcMatch.index + funcMatch[0].length;
+      // Find the function body by counting braces from the opening {
+      let braceCount = 1;
+      let fnEnd = fnStart;
+      for (let i = fnStart; i < content.length; i++) {
+        if (content[i] === '{') braceCount++;
+        if (content[i] === '}') braceCount--;
+        if (braceCount === 0) { fnEnd = i; break; }
+      }
+      const fnBody = content.substring(fnStart, fnEnd);
+      // Check if this function calls itself inside a catch block
+      const catchRegex = new RegExp(`catch\\s*\\([^)]*\\)\\s*\\{[^}]*?\\b${fnName}\\s*\\(`);
+      if (catchRegex.test(fnBody)) {
+        const line = content.substring(0, funcMatch.index).split('\n').length;
+        findings.push({
+          ruleId: 'ar-recovery-loop',
+          severity: 'block',
+          category: 'arch',
+          message: `错误恢复循环：函数 '${fnName}' 在 catch 块中调用自身。这导致了故障 #7（RecoveryEngine 无限循环）。`,
+          file: filePath,
+          line,
+          suggestion: `添加重试计数器或最大重试次数限制。错误恢复代码中绝不允许无限制的重试循环。`,
+          context: { functionName: fnName },
+        });
+      }
+    }
+
+    // --- Rule 3: Circular dependency detection (requires graph) ---
+    // Handled at the project level in analyzeProject()
+
+    // --- Rule 4: Remote code injection risk ---
+    const injectionPatterns = [
+      { regex: /eval\s*\(\s*[^)]*(?:req|request|body|query|params)/gi, name: 'eval 使用了请求数据' },
+      { regex: /new\s+Function\s*\(\s*[^)]*(?:req|request|body|query)/gi, name: 'Function 构造函数使用了请求数据' },
+      { regex: /setTimeout\s*\(\s*[^,)]*(?:req|request|body|query)[^,)]*\s*,/gi, name: 'setTimeout 字符串求值使用了请求数据' },
+      { regex: /innerHTML\s*=\s*[^;]*(?:req|request|body|query|response)/gi, name: 'innerHTML 使用了不可信数据（XSS 风险）' },
+    ];
+    for (const { regex, name } of injectionPatterns) {
+      let match;
+      while ((match = regex.exec(content)) !== null) {
+        const line = content.substring(0, match.index).split('\n').length;
+        findings.push({
+          ruleId: 'ar-code-injection',
+          severity: 'block',
+          category: 'arch',
+          message: `潜在代码注入：${name}`,
+          file: filePath,
+          line,
+          suggestion: `切勿将不可信输入传给 eval/Function/innerHTML。对所有外部数据进行消毒和校验。`,
+          context: { match: match[0].substring(0, 100) },
+        });
+      }
+    }
+
+    // --- Rule 5: Cyclomatic complexity estimation ---
+    const complexity = this._estimateComplexity(content);
+    if (complexity > 20) {
+      findings.push({
+        ruleId: 'ar-high-complexity',
+        severity: 'warn',
+        category: 'arch',
+        message: `圈复杂度过高（约 ${complexity}），阈值为 20。`,
+        file: filePath,
+        line: 1,
+        suggestion: `重构以降低分支复杂度。将条件提取为具名辅助函数，或使用提前返回。`,
+        context: { complexity },
+      });
+    }
+
+    return findings;
+  }
+
+  /**
+   * Analyze the entire project for circular dependencies.
+   */
+  analyzeProject(dependencyGraph) {
+    const findings = [];
+
+    if (!dependencyGraph || dependencyGraph.size === 0) {
+      return findings;
+    }
+
+    // Detect circular dependencies using DFS
+    const visited = new Set();
+    const recursionStack = new Set();
+
+    const detectCycle = (node, path) => {
+      if (recursionStack.has(node)) {
+        // Found a cycle
+        const cycleStart = path.indexOf(node);
+        const cycle = path.slice(cycleStart).concat(node);
+        findings.push({
+          ruleId: 'ar-circular-dependency',
+          severity: 'block',
+          category: 'arch',
+          message: `检测到循环依赖：${cycle.join(' → ')}`,
+          file: node,
+          suggestion: `通过将共享逻辑提取到独立模块来打破循环，或使用依赖注入。`,
+          context: { cycle },
+        });
+        return;
+      }
+      if (visited.has(node)) return;
+
+      visited.add(node);
+      recursionStack.add(node);
+
+      const node_data = dependencyGraph.get(node);
+      if (node_data && node_data.imports) {
+        for (const imp of node_data.imports) {
+          detectCycle(imp, [...path, node]);
+        }
+      }
+
+      recursionStack.delete(node);
+    };
+
+    for (const node of dependencyGraph.keys()) {
+      visited.clear();
+      recursionStack.clear();
+      detectCycle(node, []);
+    }
+
+    return findings;
+  }
+
+  _extractFunctions(content) {
+    const functions = [];
+    const regex = /(?:function\s+(\w+)|(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?(?:function|\([^)]*\)\s*=>))\s*[\({]/g;
+    let match;
+    while ((match = regex.exec(content)) !== null) {
+      const name = match[1] || match[2];
+      const startLine = content.substring(0, match.index).split('\n').length;
+
+      // Find the end of the function by counting braces
+      let braceCount = 0;
+      let started = false;
+      let endLine = startLine;
+      const lines = content.substring(match.index).split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        for (const ch of lines[i]) {
+          if (ch === '{') { braceCount++; started = true; }
+          if (ch === '}') braceCount--;
+          if (started && braceCount === 0) { endLine = startLine + i; break; }
+        }
+        if (started && braceCount === 0) break;
+      }
+      functions.push({ name, startLine, lineCount: endLine - startLine + 1 });
+    }
+    return functions;
+  }
+
+  _estimateComplexity(content) {
+    // Simplified cyclomatic complexity: count decision points
+    const decisionPoints = (content.match(/\bif\s*\(/g) || []).length
+      + (content.match(/\belse\s+if\s*\(/g) || []).length
+      + (content.match(/\bfor\s*\(/g) || []).length
+      + (content.match(/\bwhile\s*\(/g) || []).length
+      + (content.match(/\bcase\s+/g) || []).length
+      + (content.match(/&&/g) || []).length
+      + (content.match(/\|\|/g) || []).length
+      + (content.match(/\?[^:]*:/g) || []).length;
+    return decisionPoints + 1;
+  }
+}
+
+module.exports = { ArchRiskAssessor };