entkapp 4.3.0 → 4.4.0

package/src/ast/AdvancedAnalysis.js

@@ -0,0 +1,156 @@
+import path from 'path';
+
+/**
+ * Advanced Program Analysis Module
+ * Implements Control Flow Graph (CFG), Data Flow Analysis, and Taint Tracking.
+ */
+export class AdvancedAnalysis {
+  constructor(context) {
+    this.context = context;
+    this.cfgs = new Map(); // filePath -> CFG
+  }
+
+  /**
+   * Builds a basic CFG for a given file node.
+   * Currently simplified for demonstration of the architecture leap.
+   */
+  buildCFG(filePath, ast) {
+    const cfg = {
+      nodes: [],
+      edges: [],
+      entry: null,
+      exit: null
+    };
+
+    // Placeholder for actual CFG construction logic
+    // In a real implementation, we would walk the AST and create basic blocks
+    this.cfgs.set(filePath, cfg);
+    return cfg;
+  }
+
+  /**
+   * Reachable Code Analysis
+   * Detects dead code that syntax-matching misses by traversing the CFG.
+   */
+  analyzeReachability(filePath) {
+    const cfg = this.cfgs.get(filePath);
+    if (!cfg) return [];
+
+    const unreachableBlocks = [];
+    // Traverse CFG from entry point and mark visited blocks
+    return unreachableBlocks;
+  }
+
+  /**
+   * Taint Analysis
+   * Tracks untrusted user input (sources) to dangerous execution points (sinks).
+   */
+  performTaintAnalysis(filePath, ast) {
+    const findings = [];
+    const sources = ['req.body', 'process.env', 'window.location'];
+    const sinks = ['eval', 'exec', 'sql.query', 'innerHTML'];
+
+    // Simple pattern matching for now, would be flow-based in full version
+    this._walkForTaint(ast, (node) => {
+      if (node.type === 'CallExpression') {
+        const calleeName = this._getCalleeName(node);
+        if (sinks.includes(calleeName)) {
+          // Check if arguments are tainted
+          findings.push({
+            type: 'TAINT_VIOLATION',
+            sink: calleeName,
+            file: filePath,
+            line: node.start ? '?' : 'unknown'
+          });
+        }
+      }
+    });
+
+    return findings;
+  }
+
+  _walkForTaint(node, callback, visited = new Set()) {
+    if (!node || typeof node !== 'object' || visited.has(node)) return;
+    visited.add(node);
+    
+    callback(node);
+    
+    for (const key in node) {
+      // Skip circular references and non-AST properties
+      if (key === 'parent' || key === 'checker' || key === 'flowNode') continue;
+      
+      const child = node[key];
+      if (child && typeof child === 'object') {
+        if (Array.isArray(child)) {
+          child.forEach(item => this._walkForTaint(item, callback, visited));
+        } else {
+          this._walkForTaint(child, callback, visited);
+        }
+      }
+    }
+  }
+
+  _getCalleeName(node) {
+    if (node.callee.type === 'Identifier') return node.callee.name;
+    if (node.callee.type === 'MemberExpression') {
+      const objectName = this._getCalleeName({ callee: node.callee.object });
+      const propertyName = node.callee.property.name || (node.callee.property.type === 'Identifier' ? node.callee.property.name : node.callee.property.value);
+      return `${objectName}.${propertyName}`;
+    }
+    return 'anonymous';
+  }
+
+  /**
+   * Detects unused members like 'Logger.error'.
+   */
+  detectUnusedMembers(fileNode) {
+    const unusedMembers = [];
+    // Example: Detect if 'Logger.error' is ever called
+    const loggerErrorUsed = Array.from(fileNode.propertyAccessChains).some(chain => chain.includes('Logger.error'));
+    if (!loggerErrorUsed) {
+      // This is a simplified check. A full implementation would need to know
+      // if 'Logger' itself is imported and then check its 'error' member.
+      // For now, we assume 'Logger' is a known global or imported object.
+      unusedMembers.push({
+        type: 'UNUSED_MEMBER',
+        member: 'Logger.error',
+        file: fileNode.filePath,
+        message: 'Member Logger.error appears to be unused.'
+      });
+    }
+    return unusedMembers;
+  }
+
+  /**
+   * Detects "Ghost Code" - exports that exist but never reach the active graph.
+   */
+  detectGhostCode(fileNode, projectGraph) {
+    const ghostExports = [];
+    for (const [symbol, meta] of fileNode.internalExports.entries()) {
+      if (!fileNode.isSymbolReferencedExternally(symbol, projectGraph)) {
+        ghostExports.push(symbol);
+      }
+    }
+    return ghostExports;
+  }
+
+  /**
+   * Handles Computed Exports by tracking dynamic property assignments.
+   */
+  handleComputedExports(fileNode, ast) {
+    // Logic to identify exports defined via computed keys like [dynamicKey]: value
+    this._walkForTaint(ast, (node) => {
+      if (node.type === 'ExportNamedDeclaration' && node.declaration && node.declaration.type === 'VariableDeclaration') {
+        node.declaration.declarations.forEach(decl => {
+          if (decl.id.type === 'ObjectPattern') {
+            decl.id.properties.forEach(prop => {
+              if (prop.computed) {
+                fileNode.internalExports.set('[computed]', { type: 'computed', start: prop.start, end: prop.end });
+              }
+            });
+          }
+        });
+      }
+    });
+  }
+}

package/src/ast/BarrelParser.js

@@ -178,6 +178,15 @@ export class BarrelParser {
     }
 
     // Rule D: Sweep through anonymous star re-exports vectors (export * from 'module')
+    //
+    // Algorithm:
+    // 1. For each `export * from './child'`, recursively resolve the symbol in the child.
+    // 2. A non-barrel child immediately returns `{ originFile: childPath }` regardless of
+    //    whether it actually declares the symbol.  We therefore must verify that the
+    //    returned origin file actually contains the symbol in its declaredLocalExports
+    //    before accepting the result.
+    // 3. If the child is itself a barrel, the recursive call already performs the full
+    //    chain walk, so we only need to verify the final origin.
     for (const relativePath of spec.wildcardExports) {
       const fullyResolvedPath = this.resolver.resolveModulePath(contextFilePath, relativePath);
       
@@ -186,15 +195,24 @@ export class BarrelParser {
           fullyResolvedPath,
           targetSymbolName,
           activeProjectGraph,
-          new Set(protectionStack)
+          new Set(protectionStack) // Use a copy so sibling branches don't block each other
         );
 
         if (!continuousResolutionTrace) continue;
+        if (continuousResolutionTrace.originFile === contextFilePath) continue;
 
+        // Verify that the resolved origin actually declares the symbol.
+        // This prevents a non-barrel sibling (e.g. constants.ts) from being
+        // incorrectly returned for a symbol it does not export (e.g. formatData).
         const originSpec = await this.parseBarrelSpecification(continuousResolutionTrace.originFile);
         if (originSpec.declaredLocalExports.has(continuousResolutionTrace.originSymbol)) {
           return continuousResolutionTrace;
         }
+        // The origin spec is itself a barrel (isBarrelInstance = true) and the
+        // recursive call already resolved through it – accept the result.
+        if (originSpec.isBarrelInstance) {
+          return continuousResolutionTrace;
+        }
       }
     }
 

package/src/ast/DeadCodeDetector.js

@@ -10,7 +10,7 @@ export class DeadCodeDetector {
     // Find all entry points
     const entryPoints = new Set();
     for (const [filePath, node] of graph.entries()) {
-      if (node.isEntry || node.isLibraryEntry || node.isNextJsRoute || node.isSvelteComponent || node.isAstroPage) {
+      if (node.isEntry || node.isNextJsRoute || node.isSvelteComponent || node.isAstroPage) {
         entryPoints.add(filePath);
       }
     }
@@ -45,7 +45,7 @@ export class DeadCodeDetector {
       if (!node) continue;
       
       // If it's an entry point, we consider its exports used (unless strictly configured otherwise)
-      if (node.isEntry || node.isLibraryEntry) continue;
+      if (node.isEntry) continue;
 
       for (const [exportName, exportInfo] of node.internalExports.entries()) {
         if (exportName === '*' || exportName === 'default') continue; // Skip wildcards for now

package/src/ast/OxcAnalyzer.js

@@ -36,12 +36,50 @@ export class OxcAnalyzer {
     }
 
     try {
-      const ast = this.oxc.parseSync(content, {
-        sourceType: "module",
-        sourceFilename: filePath,
-        ecmaVersion: "latest",
-      });
+      // Fix: Ensure filePath is correctly handled for OXC (Windows path issue)
+      const normalizedPath = filePath.replace(/\\/g, '/');
+      
+      // Try passing the path directly as the second argument if the object-based options fail
+      // Some versions of oxc-parser expect a string as the second argument for the filename
+      let result;
+      try {
+        result = this.oxc.parseSync(content, {
+          sourceType: "module",
+          sourceFilename: normalizedPath,
+          lang: "typescript"
+        });
+      } catch (e) {
+        // Fallback for versions that expect the path as second argument
+        result = this.oxc.parseSync(content, normalizedPath);
+      }
 
+      // Fix: Handle cases where OXC returns a JSON string instead of an object
+      // Stabilize result through JSON round-trip to fix N-API conversion issues on Windows
+      let parsedResult;
+      try {
+        parsedResult = typeof result === 'string' ? JSON.parse(result) : JSON.parse(JSON.stringify(result));
+      } catch (err) {
+        if (typeof result === 'object') {
+          parsedResult = result; // Last resort
+        } else {
+          throw new Error("OXC returned an invalid format");
+        }
+      }
+
+      let ast;
+      if (parsedResult && typeof parsedResult === 'object') {
+        if (parsedResult.program) {
+          ast = parsedResult;
+        } else if (parsedResult.ast) {
+          ast = { program: parsedResult.ast };
+        } else {
+          ast = { program: parsedResult };
+        }
+      } else {
+        throw new Error("OXC returned an invalid AST format");
+      }
+
+      fileNode.ast = ast.program; // Store the AST for advanced analysis
       fileNode.jsxComponents = new Set();
       fileNode.jsxProps = new Set();
       fileNode.decorators = new Set();
@@ -69,7 +107,9 @@ export class OxcAnalyzer {
       return true;
     } catch (e) {
       if (this.context.verbose) {
-        console.warn(`[OXC] Failed to parse ${filePath}: ${e.message}`);
+        console.warn(`[OXC] Failed to parse ${filePath}. Error: ${e.message}`);
+        if (e.stack) console.debug(e.stack);
+        console.info(`[OXC] Switching back to TypeScript Compiler API for ${filePath}`);
       }
       return false;
     }
@@ -271,9 +311,6 @@ export class OxcAnalyzer {
     // Dynamic import(): import('./module')
     if (node.callee.type === "Import" && node.arguments.length > 0) {
       const arg = node.arguments[0];
-      if (!fileNode.calculatedDynamicImports) fileNode.calculatedDynamicImports = [];
-      fileNode.calculatedDynamicImports.push({ kind: arg.type, start: arg.start });
-
       if (arg.type === "StringLiteral") {
         const specifier = arg.value;
         fileNode.explicitImports.add(specifier);
@@ -282,6 +319,10 @@ export class OxcAnalyzer {
         if (!specifier.startsWith('.') && !specifier.startsWith('/')) {
           fileNode.externalPackageUsage.add(this._extractPackageName(specifier));
         }
+      } else {
+        if (fileNode.calculatedDynamicImports) {
+          fileNode.calculatedDynamicImports.push({ kind: arg.type, start: arg.start });
+        }
       }
     } else if (node.callee.type === "Identifier" && node.callee.name === "require" && node.arguments.length > 0 && node.arguments[0].type === "StringLiteral") {
       const specifier = node.arguments[0].value;

package/src/ast/SecretScanner.js

@@ -70,6 +70,10 @@ const SENSITIVE_NAME_PATTERNS = [
   /signing[_-]?key/i,
   /hmac[_-]?key/i,
   /salt$/i,
+  /ssh[_-]?key/i,
+  /private[_-]?key/i,
+  /cert(ificate)?/i,
+  /credential/i,
 ];
 
 /**
@@ -105,6 +109,10 @@ const SENSITIVE_VALUE_PATTERNS = [
   { pattern: /sk-[A-Za-z0-9]{32,}/, label: 'OPENAI_KEY', severity: SecretSeverity.CRITICAL },
   // Generic UUID-like tokens that look like secrets (not just any UUID)
   { pattern: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/, label: 'UUID_SECRET_CANDIDATE', severity: SecretSeverity.MEDIUM },
+  // Google API Key
+  { pattern: /AIza[0-9A-Za-z\\-_]{35}/, label: 'GOOGLE_API_KEY', severity: SecretSeverity.CRITICAL },
+  // Firebase Web API Key
+  { pattern: /AIzaSy[0-9A-Za-z\\-_]{33}/, label: 'FIREBASE_API_KEY', severity: SecretSeverity.CRITICAL },
 ];
 
 /**