fchek 1.0.0

package/lib/secrets.js

@@ -0,0 +1,257 @@
+'use strict';
+
+/**
+ * secrets.js — detect secrets and credentials in code
+ *
+ * Wrappers gitleaks and trufflehog.
+ * Falls back to built-in regex patterns if neither is installed.
+ *
+ * Run BEFORE committing code with SQL, DB connections, API calls.
+ */
+
+const { spawnSync, execSync } = require('child_process');
+const path   = require('path');
+const fs     = require('fs');
+const crypto = require('crypto');
+const { output, ok, fail } = require('./output');
+
+const HELP = `
+fchek secrets <path> [--staged] [--full-history]
+
+Scan for secrets, credentials, and API keys in code.
+Run BEFORE committing any code that touches DB, APIs, or auth.
+
+Tools used (in order of preference):
+  1. gitleaks  (apt install gitleaks / brew install gitleaks)
+  2. trufflehog (pip install trufflehog)
+  3. Built-in regex scanner (no install required, less accurate)
+
+Options:
+  --staged        Scan only git staged files (pre-commit check)
+  --full-history  Scan entire git history (slow, thorough)
+
+Examples:
+  fchek secrets .
+  fchek secrets src/auth.py
+  fchek secrets . --staged
+`.trim();
+
+function commandExists(cmd) {
+  try {
+    execSync(process.platform === 'win32' ? `where ${cmd}` : `which ${cmd}`, { stdio: 'ignore' });
+    return true;
+  } catch { return false; }
+}
+
+// ─── Built-in regex patterns (fallback) ──────────────────────────────────────
+
+const PATTERNS = [
+  { name: 'AWS Access Key',        regex: /AKIA[0-9A-Z]{16}/g,                                  severity: 'critical' },
+  { name: 'AWS Secret Key',        regex: /aws_secret_access_key\s*=\s*["']?([A-Za-z0-9/+=]{40})["']?/gi, severity: 'critical' },
+  { name: 'Generic API Key',       regex: /(?:api[_-]?key|apikey)\s*[=:]\s*["']([A-Za-z0-9_\-]{20,})["']/gi, severity: 'high' },
+  { name: 'Generic Secret',        regex: /(?:secret|password|passwd|pwd)\s*[=:]\s*["']([^"']{8,})["']/gi, severity: 'high' },
+  { name: 'Private Key Header',    regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,  severity: 'critical' },
+  { name: 'GitHub Token',          regex: /ghp_[A-Za-z0-9]{36}/g,                               severity: 'critical' },
+  { name: 'GitHub OAuth',          regex: /gho_[A-Za-z0-9]{36}/g,                               severity: 'critical' },
+  { name: 'Slack Token',           regex: /xox[baprs]-[A-Za-z0-9\-]{10,}/g,                     severity: 'high' },
+  { name: 'Stripe Key',            regex: /(?:sk|pk)_(?:live|test)_[A-Za-z0-9]{24,}/g,          severity: 'critical' },
+  { name: 'Generic Bearer Token',  regex: /bearer\s+([A-Za-z0-9+/=._\-]{20,})/gi,               severity: 'medium' },
+  { name: 'Basic Auth in URL',     regex: /https?:\/\/[^:]+:[^@]{4,}@/g,                        severity: 'high' },
+  { name: 'Database URL',          regex: /(?:postgres(?:ql)?|mysql|mongodb|redis|mssql|sqlite):\/\/[^:@\s]+:[^@\s]{3,}@/gi, severity: 'high' },
+  { name: 'Hardcoded IP+Port',     regex: /\b(?:\d{1,3}\.){3}\d{1,3}:\d{4,5}\b/g,              severity: 'low' },
+  { name: 'Hex Secret (32+ chars)',regex: /(?:secret|key|token)\s*[=:]\s*["']?[0-9a-f]{32,}["']?/gi, severity: 'medium' },
+];
+
+const IGNORED_EXTENSIONS = new Set([
+  // Images / media / fonts
+  '.png', '.jpg', '.jpeg', '.gif', '.svg', '.ico', '.webp', '.bmp',
+  '.woff', '.woff2', '.ttf', '.eot', '.otf',
+  '.mp4', '.mp3', '.wav', '.ogg', '.avi', '.mov',
+  // Archives / binaries
+  '.pdf', '.zip', '.tar', '.gz', '.bz2', '.7z', '.rar', '.xz',
+  '.exe', '.dll', '.so', '.dylib', '.lib', '.a', '.o', '.obj', '.pdb',
+  // .NET / JVM compiled artifacts
+  '.class', '.jar', '.war', '.ear', '.nupkg', '.snupkg',
+  '.pdb', '.mdb', '.ilk', '.exp',
+  // Lock files and large generated files
+  '.lock', '.sum',
+  // Database / binary data
+  '.db', '.sqlite', '.sqlite3', '.mdb', '.accdb',
+  // Misc binary
+  '.bin', '.dat', '.cache', '.pyc', '.pyo',
+]);
+
+// Directories to skip — binaries, compiled output, vendor code
+const IGNORED_DIRS = new Set([
+  'node_modules', '.git', 'dist', 'build', 'target', '__pycache__',
+  '.venv', 'vendor', 'packages', 'bin', 'obj',   // bin/obj = .NET build output
+  '.vs', '.idea', '.gradle', 'gradle',
+]);
+
+function scanFileBuiltin(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (IGNORED_EXTENSIONS.has(ext)) return [];
+
+  // Skip large files — binaries often disguise as text but are huge
+  try {
+    const stat = fs.statSync(filePath);
+    if (stat.size > 1_000_000) return []; // skip files > 1MB
+  } catch { return []; }
+
+  let content;
+  try { content = fs.readFileSync(filePath, 'utf8'); }
+  catch { return []; }
+
+  // Skip files that look binary (high ratio of non-printable chars in first 512 bytes)
+  const sample = content.slice(0, 512);
+  const nonPrintable = (sample.match(/[\x00-\x08\x0E-\x1F\x7F-\xFF]/g) || []).length;
+  if (nonPrintable / sample.length > 0.1) return [];
+
+  const findings = [];
+  const lines    = content.split('\n');
+
+  for (const pattern of PATTERNS) {
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const matches = [...line.matchAll(pattern.regex)];
+      for (const match of matches) {
+        // Redact the actual value — show first 4 chars + hash
+        const raw    = match[1] || match[0];
+        const redacted = raw.slice(0, 4) + '***' + crypto.createHash('md5').update(raw).digest('hex').slice(0, 4);
+        findings.push({
+          file:     filePath,
+          line:     i + 1,
+          pattern:  pattern.name,
+          severity: pattern.severity,
+          match_redacted: redacted,
+        });
+      }
+    }
+  }
+
+  return findings;
+}
+
+function scanDirBuiltin(dir) {
+  const findings = [];
+  function walk(d) {
+    let entries;
+    try { entries = fs.readdirSync(d); } catch { return; }
+    for (const name of entries) {
+      if (IGNORED_DIRS.has(name) || name.startsWith('.')) continue;
+      const full = path.join(d, name);
+      const stat = fs.statSync(full);
+      if (stat.isDirectory()) walk(full);
+      else if (stat.isFile())  findings.push(...scanFileBuiltin(full));
+    }
+  }
+  walk(dir);
+  return findings;
+}
+
+// ─── gitleaks ─────────────────────────────────────────────────────────────────
+
+function runGitleaks(target, staged, fullHistory) {
+  const args = ['detect', '--source', target, '--report-format', 'json', '--no-banner'];
+  if (staged)      args.push('--staged');
+  if (fullHistory) args.unshift('git-log', '--source', target);
+
+  const res = spawnSync('gitleaks', args, { encoding: 'utf8', timeout: 60_000 });
+
+  // gitleaks exits 1 when secrets found, 0 when clean
+  let findings = [];
+  try {
+    // Output may contain JSON array
+    const raw = res.stdout || res.stderr || '';
+    const jsonStart = raw.indexOf('[');
+    if (jsonStart !== -1) findings = JSON.parse(raw.slice(jsonStart));
+  } catch {}
+
+  return {
+    tool: 'gitleaks',
+    findings: findings.map(f => ({
+      file:          f.File   || f.file,
+      line:          f.StartLine || f.line,
+      rule:          f.RuleID || f.rule,
+      description:   f.Description || f.description,
+      severity:      'high',
+      match_redacted: (f.Secret || '').slice(0, 4) + '***',
+    })).slice(0, 50),
+  };
+}
+
+// ─── trufflehog ───────────────────────────────────────────────────────────────
+
+function runTrufflehog(target) {
+  const res = spawnSync('trufflehog', ['filesystem', target, '--json', '--no-verification'],
+    { encoding: 'utf8', timeout: 120_000 });
+
+  const findings = [];
+  for (const line of (res.stdout || '').split('\n')) {
+    try {
+      const obj = JSON.parse(line);
+      if (obj.DetectorName) {
+        findings.push({
+          file:        obj.SourceMetadata?.Data?.Filesystem?.file || 'unknown',
+          line:        obj.SourceMetadata?.Data?.Filesystem?.line || null,
+          rule:        obj.DetectorName,
+          description: obj.DetectorDescription || obj.DetectorName,
+          severity:    'high',
+          match_redacted: (obj.Raw || '').slice(0, 4) + '***',
+        });
+      }
+    } catch {}
+  }
+  return { tool: 'trufflehog', findings: findings.slice(0, 50) };
+}
+
+// ─── Entry point ─────────────────────────────────────────────────────────────
+
+async function run(args) {
+  if (args.length === 0 || args[0] === '--help') { console.log(HELP); return; }
+
+  const target      = args[0];
+  const staged      = args.includes('--staged');
+  const fullHistory = args.includes('--full-history');
+
+  if (!fs.existsSync(target)) {
+    return output(fail(`Not found: ${target}`));
+  }
+
+  let scanResult;
+
+  if (commandExists('gitleaks')) {
+    scanResult = runGitleaks(target, staged, fullHistory);
+  } else if (commandExists('trufflehog')) {
+    scanResult = runTrufflehog(target);
+  } else {
+    // Built-in fallback
+    const stat = fs.statSync(target);
+    const findings = stat.isDirectory()
+      ? scanDirBuiltin(target)
+      : scanFileBuiltin(target);
+    scanResult = { tool: 'built-in-regex', findings };
+  }
+
+  const critical = scanResult.findings.filter(f => f.severity === 'critical');
+  const high     = scanResult.findings.filter(f => f.severity === 'high');
+  const total    = scanResult.findings.length;
+
+  output(ok({
+    target:          path.resolve(target),
+    tool:            scanResult.tool,
+    total_findings:  total,
+    verdict:         total === 0 ? 'clean' : critical.length > 0 ? 'critical' : 'issues_found',
+    summary: {
+      critical: critical.length,
+      high:     high.length,
+      other:    total - critical.length - high.length,
+    },
+    findings: scanResult.findings,
+    note: scanResult.tool === 'built-in-regex'
+      ? 'Using built-in patterns. Install gitleaks for better coverage: https://github.com/gitleaks/gitleaks'
+      : null,
+  }));
+}
+
+module.exports = { run };

package/lib/state.js

@@ -0,0 +1,219 @@
+'use strict';
+
+/**
+ * state.js — persistent project memory across sessions.
+ *
+ * Stores data in .fcheck_state.json in the nearest project root
+ * (where package.json / Cargo.toml / .git lives), NOT in cwd blindly.
+ *
+ * Difference from repl.js:
+ *   state = disk-based memory that survives process restarts (long-term context)
+ *   repl  = in-memory live process for interactive use within one session
+ *
+ * SECURITY NOTE:
+ *   .fcheck_state.json is added to .gitignore automatically on first write.
+ *   Never store secrets (tokens, passwords) in state — use env vars for those.
+ */
+
+const path   = require('path');
+const fs     = require('fs');
+const crypto = require('crypto');
+const { output, ok, fail } = require('./output');
+
+const HELP = `
+fchek state <action> [key] [value]
+
+Persistent project memory — survives between sessions (stored on disk).
+Different from REPL: state persists across process restarts.
+
+Actions:
+  set <key> <value>   Save a value
+  get <key>           Read a value
+  list                Show entire state
+  delete <key>        Remove one key
+  clear               Wipe all state (asks for confirmation unless --yes)
+  snapshot            Save a snapshot of project file tree + hashes
+
+Examples:
+  fchek state set task "fix auth bug"
+  fchek state set branch "feature/auth"
+  fchek state get task
+  fchek state list
+  fchek state snapshot
+  fchek state clear --yes
+
+State file location: <project_root>/.fcheck_state.json
+`.trim();
+
+const STATE_FILE = '.fcheck_state.json';
+
+function findProjectRoot(startDir) {
+  const markers = ['package.json', 'Cargo.toml', 'CMakeLists.txt', '.git', 'pyproject.toml', 'go.mod'];
+  let dir = path.resolve(startDir);
+  for (let i = 0; i < 8; i++) {
+    if (markers.some(m => fs.existsSync(path.join(dir, m)))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return path.resolve(startDir); // fallback: use cwd
+}
+
+function statePath() {
+  return path.join(findProjectRoot(process.cwd()), STATE_FILE);
+}
+
+function loadState() {
+  const p = statePath();
+  if (!fs.existsSync(p)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(p, 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+function saveState(state) {
+  const p = statePath();
+  fs.writeFileSync(p, JSON.stringify(state, null, 2), 'utf8');
+  ensureGitignore(path.dirname(p));
+}
+
+function ensureGitignore(dir) {
+  const gi = path.join(dir, '.gitignore');
+  const entry = '.fcheck_state.json';
+  if (!fs.existsSync(gi)) {
+    fs.writeFileSync(gi, `${entry}\n`, 'utf8');
+    return;
+  }
+  const content = fs.readFileSync(gi, 'utf8');
+  if (!content.includes(entry)) {
+    fs.appendFileSync(gi, `\n${entry}\n`, 'utf8');
+  }
+}
+
+function fileHash(filePath) {
+  try {
+    const content = fs.readFileSync(filePath);
+    return crypto.createHash('sha256').update(content).digest('hex').slice(0, 12);
+  } catch {
+    return null;
+  }
+}
+
+function buildSnapshot(rootDir) {
+  const result = {};
+  const ignored = new Set(['node_modules', '.git', 'dist', 'build', 'target', '__pycache__']);
+
+  function walk(dir, prefix = '') {
+    let entries;
+    try { entries = fs.readdirSync(dir); } catch { return; }
+    for (const name of entries) {
+      if (ignored.has(name) || name.startsWith('.')) continue;
+      const full = path.join(dir, name);
+      const rel  = prefix ? `${prefix}/${name}` : name;
+      const stat = fs.statSync(full);
+      if (stat.isDirectory()) {
+        walk(full, rel);
+      } else if (stat.isFile()) {
+        result[rel] = { size: stat.size, hash: fileHash(full), mtime: stat.mtimeMs };
+      }
+    }
+  }
+
+  walk(rootDir);
+  return result;
+}
+
+async function run(args) {
+  if (args.length === 0 || args[0] === '--help') {
+    console.log(HELP);
+    return;
+  }
+
+  const action = args[0];
+
+  switch (action) {
+    case 'set': {
+      const key = args[1];
+      const value = args.slice(2).join(' ');
+      if (!key) return output(fail('Usage: fchek state set <key> <value>'));
+      const state = loadState();
+      state[key] = value;
+      state.__updated_at = new Date().toISOString();
+      saveState(state);
+      output(ok({ action: 'set', key, value, state_file: statePath() }));
+      break;
+    }
+
+    case 'get': {
+      const key = args[1];
+      if (!key) return output(fail('Usage: fchek state get <key>'));
+      const state = loadState();
+      if (!(key in state)) {
+        return output(fail(`Key not found: "${key}"`));
+      }
+      output(ok({ action: 'get', key, value: state[key] }));
+      break;
+    }
+
+    case 'list': {
+      const state = loadState();
+      output(ok({ action: 'list', state_file: statePath(), state }));
+      break;
+    }
+
+    case 'delete': {
+      const key = args[1];
+      if (!key) return output(fail('Usage: fchek state delete <key>'));
+      const state = loadState();
+      if (!(key in state)) return output(fail(`Key not found: "${key}"`));
+      delete state[key];
+      state.__updated_at = new Date().toISOString();
+      saveState(state);
+      output(ok({ action: 'delete', key, state_file: statePath() }));
+      break;
+    }
+
+    case 'clear': {
+      const confirmed = args.includes('--yes');
+      if (!confirmed) {
+        return output(fail(
+          'This will wipe all state. Add --yes to confirm: fchek state clear --yes'
+        ));
+      }
+      const p = statePath();
+      if (fs.existsSync(p)) fs.unlinkSync(p);
+      output(ok({ action: 'clear', state_file: p }));
+      break;
+    }
+
+    case 'snapshot': {
+      const rootDir = findProjectRoot(process.cwd());
+      const files   = buildSnapshot(rootDir);
+      const count   = Object.keys(files).length;
+      const state   = loadState();
+      state.__snapshot = {
+        created_at: new Date().toISOString(),
+        root: rootDir,
+        file_count: count,
+        files,
+      };
+      saveState(state);
+      output(ok({
+        action:     'snapshot',
+        root:       rootDir,
+        file_count: count,
+        state_file: statePath(),
+      }));
+      break;
+    }
+
+    default:
+      output(fail(
+        `Unknown action: "${action}". Valid: set, get, list, delete, clear, snapshot`
+      ));
+  }
+}
+
+module.exports = { run };