dravix-agent 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (208) hide show
  1. package/.claude/settings.example.json +30 -0
  2. package/ARCHITECTURE.md +410 -0
  3. package/LICENSE +21 -0
  4. package/README.md +153 -0
  5. package/ROADMAP.md +117 -0
  6. package/data/vulnkb.json +666 -0
  7. package/dist/bin/aegis.d.ts +3 -0
  8. package/dist/bin/aegis.d.ts.map +1 -0
  9. package/dist/bin/aegis.js +489 -0
  10. package/dist/bin/aegis.js.map +1 -0
  11. package/dist/cache.d.ts +9 -0
  12. package/dist/cache.d.ts.map +1 -0
  13. package/dist/cache.js +146 -0
  14. package/dist/cache.js.map +1 -0
  15. package/dist/engines/ai-sinks.d.ts +52 -0
  16. package/dist/engines/ai-sinks.d.ts.map +1 -0
  17. package/dist/engines/ai-sinks.js +204 -0
  18. package/dist/engines/ai-sinks.js.map +1 -0
  19. package/dist/engines/eslint.d.ts +9 -0
  20. package/dist/engines/eslint.d.ts.map +1 -0
  21. package/dist/engines/eslint.js +245 -0
  22. package/dist/engines/eslint.js.map +1 -0
  23. package/dist/engines/joern.d.ts +3 -0
  24. package/dist/engines/joern.d.ts.map +1 -0
  25. package/dist/engines/joern.js +98 -0
  26. package/dist/engines/joern.js.map +1 -0
  27. package/dist/engines/js-sinks.d.ts +70 -0
  28. package/dist/engines/js-sinks.d.ts.map +1 -0
  29. package/dist/engines/js-sinks.js +370 -0
  30. package/dist/engines/js-sinks.js.map +1 -0
  31. package/dist/engines/llm-critic.d.ts +130 -0
  32. package/dist/engines/llm-critic.d.ts.map +1 -0
  33. package/dist/engines/llm-critic.js +551 -0
  34. package/dist/engines/llm-critic.js.map +1 -0
  35. package/dist/engines/pragma.d.ts +20 -0
  36. package/dist/engines/pragma.d.ts.map +1 -0
  37. package/dist/engines/pragma.js +83 -0
  38. package/dist/engines/pragma.js.map +1 -0
  39. package/dist/engines/property-test.d.ts +3 -0
  40. package/dist/engines/property-test.d.ts.map +1 -0
  41. package/dist/engines/property-test.js +134 -0
  42. package/dist/engines/property-test.js.map +1 -0
  43. package/dist/engines/pyright.d.ts +10 -0
  44. package/dist/engines/pyright.d.ts.map +1 -0
  45. package/dist/engines/pyright.js +143 -0
  46. package/dist/engines/pyright.js.map +1 -0
  47. package/dist/engines/pysa.d.ts +3 -0
  48. package/dist/engines/pysa.d.ts.map +1 -0
  49. package/dist/engines/pysa.js +83 -0
  50. package/dist/engines/pysa.js.map +1 -0
  51. package/dist/engines/python-sinks.d.ts +82 -0
  52. package/dist/engines/python-sinks.d.ts.map +1 -0
  53. package/dist/engines/python-sinks.js +459 -0
  54. package/dist/engines/python-sinks.js.map +1 -0
  55. package/dist/engines/registry.d.ts +26 -0
  56. package/dist/engines/registry.d.ts.map +1 -0
  57. package/dist/engines/registry.js +70 -0
  58. package/dist/engines/registry.js.map +1 -0
  59. package/dist/engines/secret-scan.d.ts +22 -0
  60. package/dist/engines/secret-scan.d.ts.map +1 -0
  61. package/dist/engines/secret-scan.js +179 -0
  62. package/dist/engines/secret-scan.js.map +1 -0
  63. package/dist/engines/semgrep.d.ts +10 -0
  64. package/dist/engines/semgrep.d.ts.map +1 -0
  65. package/dist/engines/semgrep.js +200 -0
  66. package/dist/engines/semgrep.js.map +1 -0
  67. package/dist/engines/treesitter.d.ts +18 -0
  68. package/dist/engines/treesitter.d.ts.map +1 -0
  69. package/dist/engines/treesitter.js +135 -0
  70. package/dist/engines/treesitter.js.map +1 -0
  71. package/dist/engines/tsc.d.ts +10 -0
  72. package/dist/engines/tsc.d.ts.map +1 -0
  73. package/dist/engines/tsc.js +142 -0
  74. package/dist/engines/tsc.js.map +1 -0
  75. package/dist/engines/types.d.ts +47 -0
  76. package/dist/engines/types.d.ts.map +1 -0
  77. package/dist/engines/types.js +27 -0
  78. package/dist/engines/types.js.map +1 -0
  79. package/dist/findings.d.ts +121 -0
  80. package/dist/findings.d.ts.map +1 -0
  81. package/dist/findings.js +98 -0
  82. package/dist/findings.js.map +1 -0
  83. package/dist/hooks/claude-code.d.ts +3 -0
  84. package/dist/hooks/claude-code.d.ts.map +1 -0
  85. package/dist/hooks/claude-code.js +187 -0
  86. package/dist/hooks/claude-code.js.map +1 -0
  87. package/dist/index/context.d.ts +127 -0
  88. package/dist/index/context.d.ts.map +1 -0
  89. package/dist/index/context.js +267 -0
  90. package/dist/index/context.js.map +1 -0
  91. package/dist/index/embeddings.d.ts +68 -0
  92. package/dist/index/embeddings.d.ts.map +1 -0
  93. package/dist/index/embeddings.js +570 -0
  94. package/dist/index/embeddings.js.map +1 -0
  95. package/dist/index/graph_routing.d.ts +36 -0
  96. package/dist/index/graph_routing.d.ts.map +1 -0
  97. package/dist/index/graph_routing.js +170 -0
  98. package/dist/index/graph_routing.js.map +1 -0
  99. package/dist/index/joern.d.ts +76 -0
  100. package/dist/index/joern.d.ts.map +1 -0
  101. package/dist/index/joern.js +782 -0
  102. package/dist/index/joern.js.map +1 -0
  103. package/dist/index/property-test.d.ts +88 -0
  104. package/dist/index/property-test.d.ts.map +1 -0
  105. package/dist/index/property-test.js +466 -0
  106. package/dist/index/property-test.js.map +1 -0
  107. package/dist/index/proto/scip.proto +897 -0
  108. package/dist/index/pysa.d.ts +91 -0
  109. package/dist/index/pysa.d.ts.map +1 -0
  110. package/dist/index/pysa.js +617 -0
  111. package/dist/index/pysa.js.map +1 -0
  112. package/dist/index/scip.d.ts +76 -0
  113. package/dist/index/scip.d.ts.map +1 -0
  114. package/dist/index/scip.js +541 -0
  115. package/dist/index/scip.js.map +1 -0
  116. package/dist/index/vulrag.d.ts +86 -0
  117. package/dist/index/vulrag.d.ts.map +1 -0
  118. package/dist/index/vulrag.js +242 -0
  119. package/dist/index/vulrag.js.map +1 -0
  120. package/dist/index.d.ts +9 -0
  121. package/dist/index.d.ts.map +1 -0
  122. package/dist/index.js +8 -0
  123. package/dist/index.js.map +1 -0
  124. package/dist/install/claude-code.d.ts +31 -0
  125. package/dist/install/claude-code.d.ts.map +1 -0
  126. package/dist/install/claude-code.js +447 -0
  127. package/dist/install/claude-code.js.map +1 -0
  128. package/dist/lang.d.ts +5 -0
  129. package/dist/lang.d.ts.map +1 -0
  130. package/dist/lang.js +52 -0
  131. package/dist/lang.js.map +1 -0
  132. package/dist/learning/suppressions.d.ts +70 -0
  133. package/dist/learning/suppressions.d.ts.map +1 -0
  134. package/dist/learning/suppressions.js +179 -0
  135. package/dist/learning/suppressions.js.map +1 -0
  136. package/dist/mcp/server.d.ts +2 -0
  137. package/dist/mcp/server.d.ts.map +1 -0
  138. package/dist/mcp/server.js +187 -0
  139. package/dist/mcp/server.js.map +1 -0
  140. package/dist/mcp/tools/explain.d.ts +58 -0
  141. package/dist/mcp/tools/explain.d.ts.map +1 -0
  142. package/dist/mcp/tools/explain.js +60 -0
  143. package/dist/mcp/tools/explain.js.map +1 -0
  144. package/dist/mcp/tools/precheck.d.ts +29 -0
  145. package/dist/mcp/tools/precheck.d.ts.map +1 -0
  146. package/dist/mcp/tools/precheck.js +42 -0
  147. package/dist/mcp/tools/precheck.js.map +1 -0
  148. package/dist/mcp/tools/validate.d.ts +73 -0
  149. package/dist/mcp/tools/validate.d.ts.map +1 -0
  150. package/dist/mcp/tools/validate.js +66 -0
  151. package/dist/mcp/tools/validate.js.map +1 -0
  152. package/dist/mcp/warm.d.ts +88 -0
  153. package/dist/mcp/warm.d.ts.map +1 -0
  154. package/dist/mcp/warm.js +331 -0
  155. package/dist/mcp/warm.js.map +1 -0
  156. package/dist/orchestrator.d.ts +46 -0
  157. package/dist/orchestrator.d.ts.map +1 -0
  158. package/dist/orchestrator.js +596 -0
  159. package/dist/orchestrator.js.map +1 -0
  160. package/dist/policy.d.ts +51 -0
  161. package/dist/policy.d.ts.map +1 -0
  162. package/dist/policy.js +201 -0
  163. package/dist/policy.js.map +1 -0
  164. package/dist/risk.d.ts +31 -0
  165. package/dist/risk.d.ts.map +1 -0
  166. package/dist/risk.js +92 -0
  167. package/dist/risk.js.map +1 -0
  168. package/dist/stats.d.ts +72 -0
  169. package/dist/stats.d.ts.map +1 -0
  170. package/dist/stats.js +217 -0
  171. package/dist/stats.js.map +1 -0
  172. package/dist/telemetry/collector.d.ts +10 -0
  173. package/dist/telemetry/collector.d.ts.map +1 -0
  174. package/dist/telemetry/collector.js +75 -0
  175. package/dist/telemetry/collector.js.map +1 -0
  176. package/dist/telemetry/consent.d.ts +9 -0
  177. package/dist/telemetry/consent.d.ts.map +1 -0
  178. package/dist/telemetry/consent.js +42 -0
  179. package/dist/telemetry/consent.js.map +1 -0
  180. package/dist/telemetry/installation.d.ts +2 -0
  181. package/dist/telemetry/installation.d.ts.map +1 -0
  182. package/dist/telemetry/installation.js +32 -0
  183. package/dist/telemetry/installation.js.map +1 -0
  184. package/dist/telemetry/sanitizer.d.ts +5 -0
  185. package/dist/telemetry/sanitizer.d.ts.map +1 -0
  186. package/dist/telemetry/sanitizer.js +60 -0
  187. package/dist/telemetry/sanitizer.js.map +1 -0
  188. package/dist/telemetry/types.d.ts +39 -0
  189. package/dist/telemetry/types.d.ts.map +1 -0
  190. package/dist/telemetry/types.js +4 -0
  191. package/dist/telemetry/types.js.map +1 -0
  192. package/dist/telemetry/uploader.d.ts +12 -0
  193. package/dist/telemetry/uploader.d.ts.map +1 -0
  194. package/dist/telemetry/uploader.js +92 -0
  195. package/dist/telemetry/uploader.js.map +1 -0
  196. package/dist/util/logger.d.ts +19 -0
  197. package/dist/util/logger.d.ts.map +1 -0
  198. package/dist/util/logger.js +58 -0
  199. package/dist/util/logger.js.map +1 -0
  200. package/dist/util/safe-paths.d.ts +8 -0
  201. package/dist/util/safe-paths.d.ts.map +1 -0
  202. package/dist/util/safe-paths.js +102 -0
  203. package/dist/util/safe-paths.js.map +1 -0
  204. package/dist/util/subprocess.d.ts +32 -0
  205. package/dist/util/subprocess.d.ts.map +1 -0
  206. package/dist/util/subprocess.js +137 -0
  207. package/dist/util/subprocess.js.map +1 -0
  208. package/package.json +93 -0
@@ -0,0 +1,179 @@
1
+ import { makeFindingId } from "../findings.js";
2
+ const RULES = [
3
+ {
4
+ id: "aws-access-key-id",
5
+ name: "AWS Access Key ID",
6
+ pattern: /\b(AKIA|ASIA|AIDA|AROA|AGPA|ANPA|ANVA)[A-Z0-9]{16}\b/g,
7
+ cwe: "CWE-798",
8
+ },
9
+ {
10
+ id: "aws-secret-access-key",
11
+ name: "AWS Secret Access Key",
12
+ // Heuristic: 40-char base64-like value assigned to a name containing SECRET/AWS/KEY
13
+ pattern: /(?:aws[_-]?secret[_-]?access[_-]?key|aws[_-]?secret|secret[_-]?access[_-]?key)\s*[:=]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
14
+ cwe: "CWE-798",
15
+ },
16
+ {
17
+ id: "github-pat",
18
+ name: "GitHub Personal Access Token",
19
+ pattern: /\bghp_[A-Za-z0-9]{36,255}\b/g,
20
+ cwe: "CWE-798",
21
+ },
22
+ {
23
+ id: "github-oauth",
24
+ name: "GitHub OAuth Token",
25
+ pattern: /\bgho_[A-Za-z0-9]{36,255}\b/g,
26
+ cwe: "CWE-798",
27
+ },
28
+ {
29
+ id: "github-app",
30
+ name: "GitHub App Token",
31
+ pattern: /\bghu_[A-Za-z0-9]{36,255}\b/g,
32
+ cwe: "CWE-798",
33
+ },
34
+ {
35
+ id: "github-refresh",
36
+ name: "GitHub Refresh Token",
37
+ pattern: /\bghr_[A-Za-z0-9]{36,255}\b/g,
38
+ cwe: "CWE-798",
39
+ },
40
+ {
41
+ id: "github-server",
42
+ name: "GitHub Server Token",
43
+ pattern: /\bghs_[A-Za-z0-9]{36,255}\b/g,
44
+ cwe: "CWE-798",
45
+ },
46
+ {
47
+ id: "gitlab-pat",
48
+ name: "GitLab Personal Access Token",
49
+ pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g,
50
+ cwe: "CWE-798",
51
+ },
52
+ {
53
+ id: "slack-bot-token",
54
+ name: "Slack Bot Token",
55
+ pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
56
+ cwe: "CWE-798",
57
+ },
58
+ {
59
+ id: "stripe-live",
60
+ name: "Stripe Live API Key",
61
+ pattern: /\b(?:sk|rk)_live_[A-Za-z0-9]{24,}\b/g,
62
+ cwe: "CWE-798",
63
+ },
64
+ {
65
+ id: "openai-key",
66
+ name: "OpenAI API Key",
67
+ pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g,
68
+ cwe: "CWE-798",
69
+ },
70
+ {
71
+ id: "anthropic-key",
72
+ name: "Anthropic API Key",
73
+ pattern: /\bsk-ant-[A-Za-z0-9_-]{40,}\b/g,
74
+ cwe: "CWE-798",
75
+ },
76
+ {
77
+ id: "google-api-key",
78
+ name: "Google API Key",
79
+ pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
80
+ cwe: "CWE-798",
81
+ },
82
+ {
83
+ id: "jwt-token",
84
+ name: "JWT Token",
85
+ pattern: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
86
+ cwe: "CWE-798",
87
+ },
88
+ {
89
+ id: "private-key-block",
90
+ name: "Private Key Block",
91
+ pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |)PRIVATE KEY-----/g,
92
+ cwe: "CWE-321",
93
+ },
94
+ ];
95
+ const FALSY_VALUE = /EXAMPLE|PLACEHOLDER|REPLACE[_ ]ME|<your|xxxxxx+|fake|dummy|sample|test_/i;
96
+ function effectivelyEntropic(s) {
97
+ const unique = new Set(s.replace(/[^A-Za-z0-9]/g, "")).size;
98
+ return unique >= 10;
99
+ }
100
+ export class SecretScanEngine {
101
+ name = "secret-scan";
102
+ languages = "all";
103
+ async available() {
104
+ return true; // pure JS, always available
105
+ }
106
+ async run(input) {
107
+ const t0 = Date.now();
108
+ const findings = [];
109
+ const lines = input.content.split(/\r?\n/);
110
+ for (const rule of RULES) {
111
+ // Per-rule reset (g flag retains lastIndex across calls).
112
+ rule.pattern.lastIndex = 0;
113
+ let match;
114
+ while ((match = rule.pattern.exec(input.content)) !== null) {
115
+ const matchedText = match[0];
116
+ if (FALSY_VALUE.test(matchedText))
117
+ continue;
118
+ if (!effectivelyEntropic(matchedText))
119
+ continue;
120
+ // Locate line number
121
+ const upTo = input.content.slice(0, match.index);
122
+ const line = upTo.split(/\r?\n/).length;
123
+ const snippetLine = (lines[line - 1] ?? "").slice(0, 400);
124
+ findings.push({
125
+ id: makeFindingId({
126
+ engine: this.name,
127
+ file: input.filePath,
128
+ line,
129
+ rule_id: rule.id,
130
+ }),
131
+ engine: "secret-scan",
132
+ file: input.filePath,
133
+ line,
134
+ rule_id: rule.id,
135
+ cwe: rule.cwe,
136
+ severity: "critical",
137
+ message: `Likely ${rule.name} hardcoded in source.`,
138
+ evidence: { snippet: snippetLine.replace(matchedText, redact(matchedText)) },
139
+ confidence: 0.95,
140
+ source: "pattern",
141
+ remediation: "Move the secret to an environment variable or a secret manager. " +
142
+ "Rotate the credential immediately — it is in git history once committed.",
143
+ });
144
+ }
145
+ }
146
+ return {
147
+ engine: this.name,
148
+ findings,
149
+ unavailable: false,
150
+ durationMs: Date.now() - t0,
151
+ };
152
+ }
153
+ }
154
+ function redact(s) {
155
+ if (s.length <= 8)
156
+ return "*".repeat(s.length);
157
+ return s.slice(0, 4) + "*".repeat(s.length - 8) + s.slice(-4);
158
+ }
159
+ // Lang-typed re-export so the registry can pass the right metadata if it wants.
160
+ export const SECRET_SCAN_LANGS = [
161
+ "python",
162
+ "javascript",
163
+ "typescript",
164
+ "jsx",
165
+ "tsx",
166
+ "go",
167
+ "rust",
168
+ "java",
169
+ "ruby",
170
+ "php",
171
+ "c",
172
+ "cpp",
173
+ "csharp",
174
+ "shell",
175
+ "yaml",
176
+ "json",
177
+ "dockerfile",
178
+ ];
179
+ //# sourceMappingURL=secret-scan.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../src/engines/secret-scan.ts"],"names":[],"mappings":"AAaA,OAAO,EAAW,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAUxD,MAAM,KAAK,GAA8B;IACvC;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,uDAAuD;QAChE,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,uBAAuB;QAC7B,oFAAoF;QACpF,OAAO,EACL,0HAA0H;QAC5H,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,8BAA8B;QACvC,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,8BAA8B;QACvC,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,8BAA8B;QACvC,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,8BAA8B;QACvC,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,+BAA+B;QACxC,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mCAAmC;QAC5C,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sCAAsC;QAC/C,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,sCAAsC;QAC/C,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,gCAAgC;QACzC,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,4BAA4B;QACrC,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uEAAuE;QAChF,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,8DAA8D;QACvE,GAAG,EAAE,SAAS;KACf;CACF,CAAC;AAEF,MAAM,WAAW,GAAG,0EAA0E,CAAC;AAE/F,SAAS,mBAAmB,CAAC,CAAS;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,OAAO,MAAM,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,aAAa,CAAC;IACrB,SAAS,GAAG,KAAc,CAAC;IAEpC,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,CAAC,4BAA4B;IAC3C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAqB;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,0DAA0D;YAC1D,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3B,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC;oBAAE,SAAS;gBAC5C,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC;oBAAE,SAAS;gBAChD,qBAAqB;gBACrB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACxC,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,aAAa,CAAC;wBAChB,MAAM,EAAE,IAAI,CAAC,IAAI;wBACjB,IAAI,EAAE,KAAK,CAAC,QAAQ;wBACpB,IAAI;wBACJ,OAAO,EAAE,IAAI,CAAC,EAAE;qBACjB,CAAC;oBACF,MAAM,EAAE,aAAa;oBACrB,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,IAAI;oBACJ,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,uBAAuB;oBACnD,QAAQ,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE;oBAC5E,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,SAAS;oBACjB,WAAW,EACT,kEAAkE;wBAClE,0EAA0E;iBAC7E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,QAAQ;YACR,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;CACF;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAwB;IACpD,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,GAAG;IACH,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,YAAY;CACb,CAAC"}
@@ -0,0 +1,10 @@
1
+ import { Engine, EngineRunInput, EngineRunResult } from "./types.js";
2
+ import { Lang } from "../lang.js";
3
+ export declare class SemgrepEngine implements Engine {
4
+ readonly name = "semgrep";
5
+ readonly languages: readonly Lang[];
6
+ private _availability;
7
+ available(): Promise<boolean>;
8
+ run(input: EngineRunInput): Promise<EngineRunResult>;
9
+ }
10
+ //# sourceMappingURL=semgrep.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/engines/semgrep.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AA+ElC,qBAAa,aAAc,YAAW,MAAM;IAC1C,QAAQ,CAAC,IAAI,aAAa;IAC1B,QAAQ,CAAC,SAAS,kBAAa;IAE/B,OAAO,CAAC,aAAa,CAAwB;IAEvC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAM7B,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CA+G3D"}
@@ -0,0 +1,200 @@
1
+ /**
2
+ * Semgrep OSS adapter — subprocess to `pysemgrep` (or `semgrep`) with JSON output.
3
+ *
4
+ * Config defaults to `p/default` + `p/security-audit` — both ship in the OSS
5
+ * registry, no API key required. Override with `AEGIS_SEMGREP_CONFIG`.
6
+ *
7
+ * Filters to ERROR/WARNING severity by default; INFO findings flood the gate.
8
+ */
9
+ import { writeFile, mkdir, rm } from "node:fs/promises";
10
+ import { tmpdir } from "node:os";
11
+ import { join } from "node:path";
12
+ import { makeFindingId } from "../findings.js";
13
+ import { run, which } from "../util/subprocess.js";
14
+ import { getLogger } from "../util/logger.js";
15
+ const log = getLogger("aegis.engine.semgrep");
16
+ const SUPPORTED = [
17
+ "python",
18
+ "javascript",
19
+ "jsx",
20
+ "typescript",
21
+ "tsx",
22
+ "go",
23
+ "java",
24
+ "ruby",
25
+ "php",
26
+ "c",
27
+ "cpp",
28
+ "csharp",
29
+ ];
30
+ const KEEP_SEVERITIES = ["ERROR", "WARNING"];
31
+ function mapSeverity(s, confidence) {
32
+ const sev = (s ?? "").toUpperCase();
33
+ if (sev === "ERROR")
34
+ return confidence === "HIGH" ? "high" : "medium";
35
+ if (sev === "WARNING")
36
+ return confidence === "HIGH" ? "medium" : "low";
37
+ return "info";
38
+ }
39
+ function mapConfidence(s, conf) {
40
+ const sev = (s ?? "").toUpperCase();
41
+ const c = (conf ?? "").toUpperCase();
42
+ // Semgrep severity is rule-curator picked; map roughly to numeric confidence.
43
+ if (sev === "ERROR" && c === "HIGH")
44
+ return 0.9;
45
+ if (sev === "ERROR")
46
+ return 0.8;
47
+ if (sev === "WARNING" && c === "HIGH")
48
+ return 0.75;
49
+ if (sev === "WARNING")
50
+ return 0.65;
51
+ return 0.5;
52
+ }
53
+ function extractCwe(meta) {
54
+ if (!meta?.cwe)
55
+ return undefined;
56
+ const first = Array.isArray(meta.cwe) ? meta.cwe[0] : meta.cwe;
57
+ if (typeof first !== "string")
58
+ return undefined;
59
+ const m = first.match(/CWE-?(\d+)/i);
60
+ return m ? `CWE-${parseInt(m[1], 10)}` : undefined;
61
+ }
62
+ async function findSemgrepBinary() {
63
+ const override = process.env.AEGIS_SEMGREP_BIN;
64
+ if (override)
65
+ return override;
66
+ // Prefer `pysemgrep` (the real CLI); the `semgrep` wrapper sometimes can't find it.
67
+ return (await which("pysemgrep")) ?? (await which("semgrep"));
68
+ }
69
+ export class SemgrepEngine {
70
+ name = "semgrep";
71
+ languages = SUPPORTED;
72
+ _availability = null;
73
+ async available() {
74
+ if (this._availability !== null)
75
+ return this._availability;
76
+ this._availability = (await findSemgrepBinary()) !== null;
77
+ return this._availability;
78
+ }
79
+ async run(input) {
80
+ const t0 = Date.now();
81
+ const bin = await findSemgrepBinary();
82
+ if (!bin) {
83
+ return {
84
+ engine: this.name,
85
+ findings: [],
86
+ unavailable: true,
87
+ durationMs: Date.now() - t0,
88
+ reason: "semgrep_not_installed",
89
+ };
90
+ }
91
+ // Write the file content to a scratch dir if it doesn't physically exist
92
+ // (or to keep the gate independent of disk state). Semgrep needs a real path.
93
+ const scratch = await mkdir(join(tmpdir(), `aegis-semgrep-${process.pid}-${Date.now()}`), {
94
+ recursive: true,
95
+ });
96
+ const scratchPath = join(scratch, basename(input.filePath));
97
+ try {
98
+ await writeFile(scratchPath, input.content, "utf8");
99
+ const config = process.env.AEGIS_SEMGREP_CONFIG ?? "p/default";
100
+ const r = await run(bin, {
101
+ args: [
102
+ "scan",
103
+ "--json",
104
+ "--quiet",
105
+ "--no-git-ignore",
106
+ `--config=${config}`,
107
+ "--timeout",
108
+ "30",
109
+ scratchPath,
110
+ ],
111
+ timeoutMs: Math.min(input.timeoutMs, 30_000),
112
+ env: { SEMGREP_SEND_METRICS: "off", PYTHONUTF8: "1" },
113
+ });
114
+ if (r.timedOut) {
115
+ return {
116
+ engine: this.name,
117
+ findings: [],
118
+ unavailable: true,
119
+ durationMs: Date.now() - t0,
120
+ reason: "timeout",
121
+ };
122
+ }
123
+ if (!r.stdout.trim()) {
124
+ // exit 0 + empty = no findings
125
+ return {
126
+ engine: this.name,
127
+ findings: [],
128
+ unavailable: false,
129
+ durationMs: Date.now() - t0,
130
+ };
131
+ }
132
+ let data;
133
+ try {
134
+ data = JSON.parse(r.stdout);
135
+ }
136
+ catch (err) {
137
+ log.warn("non-JSON output", { err: String(err) });
138
+ return {
139
+ engine: this.name,
140
+ findings: [],
141
+ unavailable: true,
142
+ durationMs: Date.now() - t0,
143
+ reason: "non_json_output",
144
+ };
145
+ }
146
+ const findings = [];
147
+ for (const res of data.results ?? []) {
148
+ const sev = (res.extra?.severity ?? "").toUpperCase();
149
+ if (!KEEP_SEVERITIES.includes(sev))
150
+ continue;
151
+ const line = res.start?.line;
152
+ if (!Number.isInteger(line) || !line || line < 1)
153
+ continue;
154
+ const cwe = extractCwe(res.extra?.metadata);
155
+ const severity = mapSeverity(res.extra?.severity, res.extra?.metadata?.confidence);
156
+ const confidence = mapConfidence(res.extra?.severity, res.extra?.metadata?.confidence);
157
+ findings.push({
158
+ id: makeFindingId({
159
+ engine: this.name,
160
+ file: input.filePath,
161
+ line,
162
+ rule_id: res.check_id,
163
+ }),
164
+ engine: "semgrep",
165
+ file: input.filePath, // map back to the original path
166
+ line,
167
+ ...(res.start?.col !== undefined ? { col: res.start.col } : {}),
168
+ rule_id: res.check_id,
169
+ ...(cwe ? { cwe } : {}),
170
+ severity,
171
+ message: (res.extra?.message ?? res.check_id).slice(0, 1900),
172
+ ...(res.extra?.lines
173
+ ? { evidence: { snippet: res.extra.lines.slice(0, 3900) } }
174
+ : {}),
175
+ confidence,
176
+ source: "pattern",
177
+ });
178
+ }
179
+ return {
180
+ engine: this.name,
181
+ findings,
182
+ unavailable: false,
183
+ durationMs: Date.now() - t0,
184
+ };
185
+ }
186
+ finally {
187
+ try {
188
+ await rm(scratch, { recursive: true, force: true });
189
+ }
190
+ catch {
191
+ // best-effort cleanup
192
+ }
193
+ }
194
+ }
195
+ }
196
+ function basename(p) {
197
+ const m = p.replace(/\\/g, "/").split("/");
198
+ return m[m.length - 1] || "file.tmp";
199
+ }
200
+ //# sourceMappingURL=semgrep.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/engines/semgrep.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAW,aAAa,EAAY,MAAM,gBAAgB,CAAC;AAElE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,GAAG,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;AAE9C,MAAM,SAAS,GAAwB;IACrC,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,YAAY;IACZ,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;IACN,KAAK;IACL,GAAG;IACH,KAAK;IACL,QAAQ;CACT,CAAC;AAEF,MAAM,eAAe,GAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAyBpE,SAAS,WAAW,CAAC,CAAqB,EAAE,UAA8B;IACxE,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,CAAqB,EAAE,IAAwB;IACpE,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrC,8EAA8E;IAC9E,IAAI,GAAG,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IAChD,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAA6C;IAC/D,IAAI,CAAC,IAAI,EAAE,GAAG;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,oFAAoF;IACpF,OAAO,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,SAAS,CAAC;IACjB,SAAS,GAAG,SAAS,CAAC;IAEvB,aAAa,GAAmB,IAAI,CAAC;IAE7C,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAC3D,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,iBAAiB,EAAE,CAAC,KAAK,IAAI,CAAC;QAC1D,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAqB;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ,EAAE,EAAE;gBACZ,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC3B,MAAM,EAAE,uBAAuB;aAChC,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YACxF,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC;YAC/D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE;gBACvB,IAAI,EAAE;oBACJ,MAAM;oBACN,QAAQ;oBACR,SAAS;oBACT,iBAAiB;oBACjB,YAAY,MAAM,EAAE;oBACpB,WAAW;oBACX,IAAI;oBACJ,WAAW;iBACZ;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;gBAC5C,GAAG,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,QAAQ,EAAE,EAAE;oBACZ,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,MAAM,EAAE,SAAS;iBAClB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrB,+BAA+B;gBAC/B,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,QAAQ,EAAE,EAAE;oBACZ,WAAW,EAAE,KAAK;oBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;iBAC5B,CAAC;YACJ,CAAC;YACD,IAAI,IAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAkB,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClD,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,QAAQ,EAAE,EAAE;oBACZ,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,MAAM,EAAE,iBAAiB;iBAC1B,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACtD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC;oBAAE,SAAS;gBAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACnF,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACvF,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,aAAa,CAAC;wBAChB,MAAM,EAAE,IAAI,CAAC,IAAI;wBACjB,IAAI,EAAE,KAAK,CAAC,QAAQ;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ;qBACtB,CAAC;oBACF,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,gCAAgC;oBACtD,IAAI;oBACJ,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,OAAO,EAAE,GAAG,CAAC,QAAQ;oBACrB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvB,QAAQ;oBACR,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;oBAC5D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK;wBAClB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE;wBAC3D,CAAC,CAAC,EAAE,CAAC;oBACP,UAAU;oBACV,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ;gBACR,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;aAC5B,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,OAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC;AACvC,CAAC"}
@@ -0,0 +1,18 @@
1
+ /**
2
+ * Tree-sitter parse + syntactic sanity engine.
3
+ *
4
+ * Emits a single `parse_error` finding (severity high, confidence 0.95) if the
5
+ * file does not parse cleanly. That alone catches a surprising number of
6
+ * "AI agent wrote half a file" / "agent left placeholder text" bugs.
7
+ *
8
+ * Lazy-loads grammars on first use to keep cold start fast.
9
+ */
10
+ import { Engine, EngineRunInput, EngineRunResult } from "./types.js";
11
+ import { Lang } from "../lang.js";
12
+ export declare class TreeSitterEngine implements Engine {
13
+ readonly name = "treesitter";
14
+ readonly languages: readonly Lang[];
15
+ available(): Promise<boolean>;
16
+ run(input: EngineRunInput): Promise<EngineRunResult>;
17
+ }
18
+ //# sourceMappingURL=treesitter.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"treesitter.d.ts","sourceRoot":"","sources":["../../src/engines/treesitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAgFlC,qBAAa,gBAAiB,YAAW,MAAM;IAC7C,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,SAAS,kBAAa;IAEzB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAS7B,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CA4D3D"}
@@ -0,0 +1,135 @@
1
+ import { makeFindingId } from "../findings.js";
2
+ import { getLogger } from "../util/logger.js";
3
+ const log = getLogger("aegis.engine.treesitter");
4
+ const LOADERS = {
5
+ python: async () => (await import("tree-sitter-python")).default,
6
+ javascript: async () => (await import("tree-sitter-javascript")).default,
7
+ jsx: async () => (await import("tree-sitter-javascript")).default,
8
+ typescript: async () => (await import("tree-sitter-typescript")).default.typescript,
9
+ tsx: async () => (await import("tree-sitter-typescript")).default.tsx,
10
+ };
11
+ const SUPPORTED = ["python", "javascript", "jsx", "typescript", "tsx"];
12
+ let _ParserCtor = null;
13
+ const _grammarCache = new Map();
14
+ async function getParser(lang) {
15
+ if (!_ParserCtor) {
16
+ try {
17
+ const mod = await import("tree-sitter");
18
+ _ParserCtor = mod.default;
19
+ }
20
+ catch (err) {
21
+ log.warn("tree-sitter not installed", { err: String(err) });
22
+ return null;
23
+ }
24
+ }
25
+ const loader = LOADERS[lang];
26
+ if (!loader)
27
+ return null;
28
+ let grammar = _grammarCache.get(lang);
29
+ if (!grammar) {
30
+ try {
31
+ grammar = await loader();
32
+ _grammarCache.set(lang, grammar);
33
+ }
34
+ catch (err) {
35
+ log.warn("grammar load failed", { lang, err: String(err) });
36
+ return null;
37
+ }
38
+ }
39
+ const p = new _ParserCtor();
40
+ try {
41
+ p.setLanguage(grammar);
42
+ }
43
+ catch (err) {
44
+ log.warn("setLanguage failed", { lang, err: String(err) });
45
+ return null;
46
+ }
47
+ return p;
48
+ }
49
+ function firstErrorNode(node) {
50
+ if (node.isError || node.type === "ERROR")
51
+ return node;
52
+ if (!node.hasError)
53
+ return null;
54
+ for (let i = 0; i < node.childCount; i++) {
55
+ const c = node.child(i);
56
+ if (!c)
57
+ continue;
58
+ const e = firstErrorNode(c);
59
+ if (e)
60
+ return e;
61
+ }
62
+ return node; // root has error but no explicit ERROR child
63
+ }
64
+ export class TreeSitterEngine {
65
+ name = "treesitter";
66
+ languages = SUPPORTED;
67
+ async available() {
68
+ try {
69
+ await import("tree-sitter");
70
+ return true;
71
+ }
72
+ catch {
73
+ return false;
74
+ }
75
+ }
76
+ async run(input) {
77
+ const t0 = Date.now();
78
+ const parser = await getParser(input.lang);
79
+ if (!parser) {
80
+ return {
81
+ engine: this.name,
82
+ findings: [],
83
+ unavailable: true,
84
+ durationMs: Date.now() - t0,
85
+ reason: "parser_unavailable",
86
+ };
87
+ }
88
+ let tree;
89
+ try {
90
+ tree = parser.parse(input.content);
91
+ }
92
+ catch (err) {
93
+ return {
94
+ engine: this.name,
95
+ findings: [],
96
+ unavailable: true,
97
+ durationMs: Date.now() - t0,
98
+ reason: `parse_threw: ${String(err).slice(0, 100)}`,
99
+ };
100
+ }
101
+ const findings = [];
102
+ const errNode = firstErrorNode(tree.rootNode);
103
+ if (errNode) {
104
+ const line = errNode.startPosition.row + 1;
105
+ const col = errNode.startPosition.column + 1;
106
+ const snippet = input.content.split(/\r?\n/)[line - 1]?.slice(0, 400);
107
+ findings.push({
108
+ id: makeFindingId({
109
+ engine: this.name,
110
+ file: input.filePath,
111
+ line,
112
+ rule_id: "parse_error",
113
+ }),
114
+ engine: "treesitter",
115
+ file: input.filePath,
116
+ line,
117
+ col,
118
+ rule_id: "parse_error",
119
+ severity: "high",
120
+ message: `Syntax / parse error at line ${line}. The file does not parse cleanly with tree-sitter ${input.lang}.`,
121
+ ...(snippet !== undefined ? { evidence: { snippet } } : {}),
122
+ confidence: 0.95,
123
+ source: "pattern",
124
+ remediation: "The file has unbalanced syntax (missing bracket, half-edited block, or placeholder text the agent forgot to fill in). Open and complete it before saving.",
125
+ });
126
+ }
127
+ return {
128
+ engine: this.name,
129
+ findings,
130
+ unavailable: false,
131
+ durationMs: Date.now() - t0,
132
+ };
133
+ }
134
+ }
135
+ //# sourceMappingURL=treesitter.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"treesitter.js","sourceRoot":"","sources":["../../src/engines/treesitter.ts"],"names":[],"mappings":"AAUA,OAAO,EAAW,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,GAAG,GAAG,SAAS,CAAC,yBAAyB,CAAC,CAAC;AAKjD,MAAM,OAAO,GAA4C;IACvD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO;IAChE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO;IACxE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO;IACjE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU;IACnF,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;CACtE,CAAC;AAEF,MAAM,SAAS,GAAwB,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;AAiB5F,IAAI,WAAW,GAAkC,IAAI,CAAC;AACtD,MAAM,aAAa,GAAyB,IAAI,GAAG,EAAE,CAAC;AAEtD,KAAK,UAAU,SAAS,CAAC,IAAU;IACjC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YACxC,WAAW,GAAI,GAAG,CAAC,OAA6C,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;YACzB,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,IAAc;IACpC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,6CAA6C;AAC5D,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,YAAY,CAAC;IACpB,SAAS,GAAG,SAAS,CAAC;IAE/B,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAqB;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ,EAAE,EAAE;gBACZ,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC3B,MAAM,EAAE,oBAAoB;aAC7B,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ,EAAE,EAAE;gBACZ,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC3B,MAAM,EAAE,gBAAgB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aACpD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,aAAa,CAAC;oBAChB,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,IAAI;oBACJ,OAAO,EAAE,aAAa;iBACvB,CAAC;gBACF,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,KAAK,CAAC,QAAQ;gBACpB,IAAI;gBACJ,GAAG;gBACH,OAAO,EAAE,aAAa;gBACtB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,gCAAgC,IAAI,sDAAsD,KAAK,CAAC,IAAI,GAAG;gBAChH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,SAAS;gBACjB,WAAW,EACT,2JAA2J;aAC9J,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,QAAQ;YACR,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;CACF"}
@@ -0,0 +1,10 @@
1
+ import { Engine, EngineRunInput, EngineRunResult } from "./types.js";
2
+ import { Lang } from "../lang.js";
3
+ export declare class TscEngine implements Engine {
4
+ readonly name = "tsc";
5
+ readonly languages: readonly Lang[];
6
+ private _availability;
7
+ available(): Promise<boolean>;
8
+ run(input: EngineRunInput): Promise<EngineRunResult>;
9
+ }
10
+ //# sourceMappingURL=tsc.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"tsc.d.ts","sourceRoot":"","sources":["../../src/engines/tsc.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAmBlC,qBAAa,SAAU,YAAW,MAAM;IACtC,QAAQ,CAAC,IAAI,SAAS;IACtB,QAAQ,CAAC,SAAS,kBAAa;IAE/B,OAAO,CAAC,aAAa,CAAwB;IAEvC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAM7B,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CAsG3D"}