edsger 0.76.0 → 0.78.0

package/dist/phases/find-bugs/index.js

@@ -1,236 +0,0 @@
-/**
- * Find-bugs phase: clone the product's repo, ask Claude to audit code for
- * real bugs, and file each new finding as an issue. Subsequent runs are
- * incremental, scoped to commits since the previous successful scan.
- */
-import { query } from '@anthropic-ai/claude-agent-sdk';
-import { DEFAULT_MODEL } from '../../constants.js';
-import { logError, logInfo, logSuccess, logWarning, } from '../../utils/logger.js';
-import { cleanupIssueRepo, cloneIssueRepo, ensureWorkspaceDir, syncRepoToRef, } from '../../workspace/workspace-manager.js';
-import { detectDefaultBranch, gitRevParse, isAncestor, listChangedPaths, } from '../find-shared/git.js';
-import { createIssue, fetchOpenIssues, fetchOpenIssuesByRepo, fetchProductBasics, fetchRepositoryBasics, } from '../find-shared/mcp.js';
-import { createPromptGenerator, extractTextFromContent, tryExtractResult, } from '../pr-shared/agent-utils.js';
-import { createFindBugsSystemPrompt, createFindBugsUserPrompt, } from './prompts.js';
-import { acquireFindBugsLock, loadFindBugsState, updateFindBugsState, } from './state.js';
-import { isScanResult } from './types.js';
-const WORKSPACE_KEY = 'find-bugs';
-const DEFAULT_MAX_FILES = 200;
-/**
- * Upper bound on turns for the in-CLI Claude session.
- *
- * Reference points from neighbouring phases:
- *   - pr-review: 50 (read-only, fixed diff)
- *   - pr-resolve: 2000 (edits + commits + retries)
- *
- * Bug-detection is read-only but open-scope: the auditor has to Glob + Read +
- * Grep across many files. 200 is enough headroom for a full-repo pass on a
- * mid-size codebase while still cutting off runaway exploration.
- */
-const MAX_TURNS = 200;
-/**
- * Scan a product's repository for bugs and file each new finding as an issue.
- */
-// eslint-disable-next-line complexity
-export async function scanForBugs(options) {
-    const { productId, repoId, githubToken, owner, repo, full, maxFiles, verbose } = options;
-    // State/lock/workspace are keyed by an opaque scope id so product and repo
-    // scans never collide; repo keys are prefixed to namespace them clearly.
-    const scopeId = productId ?? `repo-${repoId}`;
-    const scopeLabel = productId
-        ? `product ${productId}`
-        : `repository ${repoId}`;
-    logInfo(`Starting bug scan for ${scopeLabel} (${owner}/${repo})`);
-    const lock = acquireFindBugsLock(scopeId);
-    if (!lock) {
-        logWarning(`Another bug scan is already in progress for ${scopeLabel}; skipping.`);
-        return {
-            status: 'error',
-            message: 'Another bug scan is already in progress for this scope',
-        };
-    }
-    let repoPath;
-    let scanSucceeded = false;
-    try {
-        updateFindBugsState(scopeId, {
-            lastAttemptedAt: new Date().toISOString(),
-        });
-        const workspaceRoot = ensureWorkspaceDir();
-        // Each run re-clones into a per-product directory and removes it on
-        // success. Incremental scope is recovered from the persisted state file
-        // (~/.edsger/find-bugs-state/<productId>.json), not from the workspace.
-        const repoKey = `${WORKSPACE_KEY}-${scopeId}`;
-        ({ repoPath } = cloneIssueRepo(workspaceRoot, repoKey, owner, repo, githubToken));
-        const branch = options.branch ?? detectDefaultBranch(repoPath);
-        logInfo(`Syncing ${owner}/${repo} to branch ${branch}`);
-        syncRepoToRef(repoPath, { branch }, githubToken);
-        const headSha = gitRevParse(repoPath, 'HEAD');
-        const state = loadFindBugsState(scopeId);
-        const baseSha = full ? undefined : state.lastScannedCommitSha;
-        let scope = 'full';
-        let changedPaths;
-        if (baseSha && baseSha !== headSha) {
-            const sameTree = isAncestor(repoPath, baseSha, headSha);
-            if (sameTree) {
-                scope = 'incremental';
-                changedPaths = listChangedPaths(repoPath, baseSha, headSha);
-                logInfo(`Incremental scan: ${changedPaths.length} files changed since ${baseSha.slice(0, 8)}`);
-                if (changedPaths.length === 0) {
-                    logSuccess('No code changes since last scan; nothing to do.');
-                    updateFindBugsState(scopeId, {
-                        lastScannedCommitSha: headSha,
-                        lastScannedAt: new Date().toISOString(),
-                        lastError: undefined,
-                    });
-                    scanSucceeded = true;
-                    return {
-                        status: 'success',
-                        message: 'No changes since last scan',
-                        scannedCommitSha: headSha,
-                        bugsFound: 0,
-                        issuesCreated: 0,
-                    };
-                }
-            }
-            else {
-                logWarning(`Last scanned sha ${baseSha.slice(0, 8)} not reachable from HEAD; falling back to full scan.`);
-            }
-        }
-        else if (baseSha === headSha) {
-            logSuccess('HEAD unchanged since last scan; nothing to do.');
-            scanSucceeded = true;
-            return {
-                status: 'success',
-                message: 'HEAD unchanged since last scan',
-                scannedCommitSha: headSha,
-                bugsFound: 0,
-                issuesCreated: 0,
-            };
-        }
-        const product = productId
-            ? await fetchProductBasics(productId)
-            : await fetchRepositoryBasics(repoId);
-        const existingIssues = productId
-            ? await fetchOpenIssues(productId)
-            : await fetchOpenIssuesByRepo(repoId);
-        logInfo(`Loaded ${existingIssues.length} existing issues for dedup context`);
-        const systemPrompt = createFindBugsSystemPrompt();
-        const userPrompt = createFindBugsUserPrompt({
-            productName: product.name,
-            productDescription: product.description,
-            scope,
-            baseSha,
-            headSha,
-            changedPaths,
-            maxFiles: maxFiles ?? DEFAULT_MAX_FILES,
-            existingIssues: existingIssues.map((i) => ({
-                id: i.id,
-                name: i.name,
-                description: i.description,
-            })),
-        });
-        let lastAssistantResponse = '';
-        let scanResult = null;
-        logInfo('Running Claude code audit...');
-        for await (const message of query({
-            prompt: createPromptGenerator(userPrompt),
-            options: {
-                systemPrompt: {
-                    type: 'preset',
-                    preset: 'claude_code',
-                    append: systemPrompt,
-                },
-                model: DEFAULT_MODEL,
-                maxTurns: MAX_TURNS,
-                permissionMode: 'bypassPermissions',
-                cwd: repoPath,
-            },
-        })) {
-            if (message.type === 'assistant') {
-                lastAssistantResponse += extractTextFromContent(message.message?.content ?? [], verbose);
-                continue;
-            }
-            if (message.type !== 'result') {
-                continue;
-            }
-            const responseText = message.subtype === 'success'
-                ? message.result || lastAssistantResponse
-                : lastAssistantResponse;
-            const parsed = tryExtractResult(responseText, 'scan_result');
-            if (isScanResult(parsed)) {
-                scanResult = parsed;
-            }
-            else if (message.subtype !== 'success') {
-                logError(`Audit incomplete: ${message.subtype}`);
-            }
-        }
-        if (!scanResult) {
-            const msg = 'Audit failed: could not parse a scan_result from the agent';
-            updateFindBugsState(scopeId, { lastError: msg });
-            return {
-                status: 'error',
-                message: msg,
-            };
-        }
-        const { summary, bugs } = scanResult;
-        logInfo(`Audit produced ${bugs.length} candidate bugs. ${summary}`);
-        let created = 0;
-        for (const bug of bugs) {
-            const issueId = await createIssueForBug({ productId, repoId }, bug);
-            if (issueId) {
-                created++;
-                logSuccess(`Filed issue ${issueId}: ${bug.title}`);
-            }
-        }
-        updateFindBugsState(scopeId, {
-            lastScannedCommitSha: headSha,
-            lastScannedAt: new Date().toISOString(),
-            lastError: undefined,
-        });
-        scanSucceeded = true;
-        return {
-            status: 'success',
-            message: `Filed ${created} of ${bugs.length} candidate bugs`,
-            scannedCommitSha: headSha,
-            bugsFound: bugs.length,
-            issuesCreated: created,
-            summary,
-        };
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        logError(`Bug scan failed: ${errorMessage}`);
-        updateFindBugsState(scopeId, { lastError: errorMessage });
-        return {
-            status: 'error',
-            message: `Bug scan failed: ${errorMessage}`,
-        };
-    }
-    finally {
-        if (scanSucceeded) {
-            cleanupIssueRepo(repoPath);
-        }
-        lock.release();
-    }
-}
-async function createIssueForBug(scope, bug) {
-    return createIssue({
-        productId: scope.productId,
-        repoId: scope.repoId,
-        title: bug.title,
-        description: formatIssueDescription(bug),
-    });
-}
-function formatIssueDescription(bug) {
-    const location = bug.line ? `${bug.file}:${bug.line}` : bug.file;
-    const lines = [
-        `**Severity**: ${bug.severity}`,
-        `**Category**: ${bug.category}`,
-        `**Location**: \`${location}\``,
-        '',
-        bug.description,
-        '',
-        '---',
-        '_Filed automatically by `edsger find-bugs`._',
-    ];
-    return lines.join('\n');
-}

package/dist/phases/find-bugs/prompts.d.ts

@@ -1,22 +0,0 @@
-/**
- * Prompts for the find-bugs phase. The agent runs with cwd=repo checkout
- * and has Read/Grep/Glob/Bash available — it explores the code itself
- * rather than receiving a pre-baked diff.
- */
-export declare function createFindBugsSystemPrompt(): string;
-export interface FindBugsUserPromptParams {
-    productName: string;
-    productDescription?: string;
-    scope: 'full' | 'incremental';
-    baseSha?: string;
-    headSha: string;
-    changedPaths?: string[];
-    existingIssues: {
-        id: string;
-        name: string;
-        description?: string;
-    }[];
-    /** Upper bound on files the auditor may Read. Keeps token cost predictable. */
-    maxFiles?: number;
-}
-export declare function createFindBugsUserPrompt(params: FindBugsUserPromptParams): string;

package/dist/phases/find-bugs/prompts.js

@@ -1,101 +0,0 @@
-/**
- * Prompts for the find-bugs phase. The agent runs with cwd=repo checkout
- * and has Read/Grep/Glob/Bash available — it explores the code itself
- * rather than receiving a pre-baked diff.
- */
-export function createFindBugsSystemPrompt() {
-    return `You are an experienced software engineer auditing a codebase for **bugs that genuinely matter**. You have read-only access to the repository via Read/Grep/Glob and you may run shallow Bash queries (e.g. \`git log\`, \`wc -l\`) to navigate.
-
-**What counts as a bug worth filing**:
-1. **Security**: injection, missing auth checks, secrets in code, unsafe deserialization, SSRF, XSS
-2. **Correctness / logic errors**: off-by-one, wrong condition, swapped arguments, mishandled null/undefined
-3. **Concurrency / race conditions**: missing locks, unawaited promises, shared mutable state
-4. **Error handling gaps**: silently swallowed errors, uncaught rejections, missing rollback
-5. **Data integrity**: lost updates, inconsistent state, missing validation at trust boundaries
-6. **Performance regressions** that are clearly wrong (N+1 queries, unbounded loops on user input)
-
-**What does NOT count** (skip these — too noisy):
-- Style / formatting / naming suggestions
-- "Could be more idiomatic" rewrites
-- Hypothetical future scaling concerns
-- Missing tests (file separately, not as bugs)
-- TODO comments that the original author already flagged
-
-**Discipline**:
-- Be concrete: cite the exact file and line. Quote the offending snippet in the description.
-- Be conservative: if you're not sure it's a real bug after re-reading, skip it.
-- Severity rubric:
-  - critical = security hole, data loss, or service outage in a hot path
-  - major = wrong behavior in a common path with no easy workaround
-  - minor = wrong behavior in an edge case, or robustness gap
-- **Deduplication**: you will be given the list of existing open issues for this product. Skip any finding that overlaps with an existing issue, even if the wording differs. Better to under-report than to spam duplicates.
-
-**CRITICAL — Output Format**:
-End your response with a single JSON code block in this exact shape:
-
-\`\`\`json
-{
-  "scan_result": {
-    "summary": "Reviewed N files in <scope>; found X bugs (Y critical, Z major).",
-    "scanned_commit_sha": "<the HEAD sha you scanned>",
-    "bugs": [
-      {
-        "title": "Short, action-oriented title (under 80 chars)",
-        "description": "## What\\nWhat the bug is, with the offending snippet quoted.\\n\\n## Why it matters\\nImpact in terms of user data / availability / correctness.\\n\\n## Suggested fix\\nA concrete change.",
-        "file": "relative/path/from/repo/root.ts",
-        "line": 42,
-        "severity": "critical",
-        "category": "security",
-        "dedup_signature": "auth-login-no-rate-limit"
-      }
-    ]
-  }
-}
-\`\`\`
-
-If you find nothing worth filing, still emit the JSON with an empty \`bugs\` array.`;
-}
-export function createFindBugsUserPrompt(params) {
-    const { productName, productDescription, scope, baseSha, headSha, changedPaths, existingIssues, maxFiles, } = params;
-    const productBlock = productDescription
-        ? `**Product**: ${productName}\n${productDescription}`
-        : `**Product**: ${productName}`;
-    const scopeBlock = scope === 'incremental' && baseSha
-        ? `**Scope**: incremental scan of changes between ${baseSha} and ${headSha}.\nUse \`git diff --name-only ${baseSha}..${headSha}\` to enumerate changed files, then Read/Grep them. Do NOT scan files outside the diff.`
-        : `**Scope**: full repository scan at ${headSha}. Use Glob to enumerate source files. Skip vendored code, build output, generated files, lockfiles, and \`node_modules\`.`;
-    const filesHint = changedPaths && changedPaths.length > 0
-        ? `\n**Changed files in this range** (${changedPaths.length}):\n${changedPaths
-            .slice(0, 200)
-            .map((p) => `- ${p}`)
-            .join('\n')}${changedPaths.length > 200 ? `\n…and ${changedPaths.length - 200} more.` : ''}`
-        : '';
-    const issuesBlock = existingIssues.length === 0
-        ? 'No existing open issues for this product — every finding is new.'
-        : `**Existing open issues** (${existingIssues.length}) — skip findings that overlap with any of these:\n${existingIssues
-            .map((i) => `- [${i.id}] ${i.name}${i.description ? `\n  ${truncate(i.description, 200)}` : ''}`)
-            .join('\n')}`;
-    const budgetBlock = typeof maxFiles === 'number' && maxFiles > 0
-        ? `\n**Budget**: Read at most ${maxFiles} files. Prioritise files likely to contain real bugs (auth, payment, data access, input parsing) over test fixtures and generated code. If the scope is larger than the budget, stop when you hit it and report that the scan was truncated in \`summary\`.`
-        : '';
-    return `${productBlock}
-
-${scopeBlock}${filesHint}${budgetBlock}
-
-${issuesBlock}
-
-## How to work
-
-1. Identify the files in scope (per the scope block above).
-2. For each file, Read it and look for the bug categories listed in the system prompt.
-3. When you suspect a bug, re-read the surrounding context to confirm — don't file on a hunch.
-4. Cross-check every candidate against the existing issues list. Drop overlaps.
-5. Produce the final JSON described in the system prompt.
-
-Begin.`;
-}
-function truncate(s, n) {
-    if (s.length <= n) {
-        return s;
-    }
-    return `${s.slice(0, n)}…`;
-}

package/dist/phases/find-bugs/state.d.ts

@@ -1,19 +0,0 @@
-/**
- * Per-product scan state for find-bugs. Storage at
- * `~/.edsger/find-bugs-state/<productId>.json`.
- *
- * Schema is bug-scan-specific (incremental commit sha tracking + failure
- * recording); the file/lock machinery is shared via createScanStateModule.
- */
-import { type LockHandle } from '../find-shared/scan-state.js';
-export type { LockHandle };
-export interface FindBugsState {
-    lastScannedCommitSha?: string;
-    lastScannedAt?: string;
-    lastAttemptedAt?: string;
-    lastError?: string;
-}
-export declare const loadFindBugsState: (productId: string) => FindBugsState;
-export declare const saveFindBugsState: (productId: string, state: FindBugsState) => void;
-export declare const updateFindBugsState: (productId: string, patch: Partial<FindBugsState>) => FindBugsState;
-export declare const acquireFindBugsLock: (productId: string, staleAfterMs?: number) => LockHandle | null;

package/dist/phases/find-bugs/state.js

@@ -1,13 +0,0 @@
-/**
- * Per-product scan state for find-bugs. Storage at
- * `~/.edsger/find-bugs-state/<productId>.json`.
- *
- * Schema is bug-scan-specific (incremental commit sha tracking + failure
- * recording); the file/lock machinery is shared via createScanStateModule.
- */
-import { createScanStateModule, } from '../find-shared/scan-state.js';
-const m = createScanStateModule({ dirName: 'find-bugs-state' });
-export const loadFindBugsState = m.load;
-export const saveFindBugsState = m.save;
-export const updateFindBugsState = m.update;
-export const acquireFindBugsLock = m.acquireLock;

package/dist/phases/find-bugs/types.d.ts

@@ -1,21 +0,0 @@
-/**
- * Types for the find-bugs phase.
- */
-export type BugSeverity = 'critical' | 'major' | 'minor';
-export type BugCategory = 'security' | 'logic' | 'error_handling' | 'concurrency' | 'performance' | 'data_integrity' | 'other';
-export interface BugFinding {
-    title: string;
-    description: string;
-    file: string;
-    line?: number;
-    severity: BugSeverity;
-    category: BugCategory;
-    /** Stable signature for log/audit; not used for storage dedup. */
-    dedup_signature?: string;
-}
-export interface ScanResult {
-    summary: string;
-    scanned_commit_sha?: string;
-    bugs: BugFinding[];
-}
-export declare function isScanResult(value: unknown): value is ScanResult;

package/dist/phases/find-bugs/types.js

@@ -1,16 +0,0 @@
-/**
- * Types for the find-bugs phase.
- */
-export function isScanResult(value) {
-    if (!value || typeof value !== 'object') {
-        return false;
-    }
-    const v = value;
-    return (typeof v.summary === 'string' &&
-        Array.isArray(v.bugs) &&
-        v.bugs.every((b) => b &&
-            typeof b === 'object' &&
-            typeof b.title === 'string' &&
-            typeof b.description === 'string' &&
-            typeof b.file === 'string'));
-}

package/dist/phases/find-features/index.d.ts

@@ -1,40 +0,0 @@
-/**
- * Find-features phase: synthesise opportunities from user feedback +
- * intelligence reports + the codebase, and file each one as an issue.
- *
- * The repo is cloned and the model runs with Read/Grep/Glob available so it
- * can **verify existing functionality before proposing a new feature**. Many
- * "obvious" feature asks ("add CSV export") turn out to be discoverability
- * issues on something already shipped — the model needs to see the code to
- * avoid those mistakes.
- *
- * Time-windowed on the PM data side (last N days of feedback) rather than
- * diff-incremental on the repo side — we don't care what changed in the
- * code, we care what exists there.
- */
-export interface FindFeaturesOptions {
-    productId: string;
-    githubToken: string;
-    owner: string;
-    repo: string;
-    /** Branch to scan; defaults to the repo's default branch. */
-    branch?: string;
-    /** Feedback lookback window — ISO duration string like "90d" or "30d". */
-    since?: string;
-    /** Min feedback mentions for a theme to count as high-confidence. */
-    minClusterSize?: number;
-    /** Max opportunities the model may surface. */
-    maxSuggestions?: number;
-    /** Narrow the run to a specific intelligence report's context. */
-    focusReportId?: string;
-    verbose?: boolean;
-}
-export interface FindFeaturesResult {
-    status: 'success' | 'error';
-    message: string;
-    opportunitiesFound?: number;
-    issuesCreated?: number;
-    summary?: string;
-}
-export declare function scanForFeatures(options: FindFeaturesOptions): Promise<FindFeaturesResult>;
-export declare function resolveSinceIso(since: string): string;