guardlink 1.4.1 → 1.4.3

package/dist/tui/commands.js

@@ -22,17 +22,18 @@
  */
 import { resolve, basename } from 'node:path';
 import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
-import { parseProject, findDanglingRefs, findUnmitigatedExposures, findAcceptedWithoutAudit, findAcceptedExposures, clearAnnotations } from '../parser/index.js';
+import { parseProject, findDanglingRefs, findUnmitigatedExposures, findAcceptedWithoutAudit, findAcceptedExposures, clearAnnotations, listFeatures, filterByFeature, getFeatureSummaries } from '../parser/index.js';
 import { initProject, detectProject, promptAgentSelection, syncAgentFiles } from '../init/index.js';
 import { generateReport } from '../report/index.js';
 import { generateDashboardHTML } from '../dashboard/index.js';
 import { computeStats, computeSeverity, computeExposures } from '../dashboard/data.js';
-import { generateThreatReport, serializeModel, listThreatReports, loadThreatReportsForDashboard, FRAMEWORK_LABELS, FRAMEWORK_PROMPTS, buildUserMessage, buildProjectContext, extractCodeSnippets } from '../analyze/index.js';
+import { generateThreatReport, serializeModel, listThreatReports, loadThreatReportsForDashboard, loadPentestData, FRAMEWORK_LABELS, FRAMEWORK_PROMPTS, buildUserMessage, buildProjectContext, extractCodeSnippets } from '../analyze/index.js';
 import { diffModels, formatDiff, parseAtRef } from '../diff/index.js';
 import { generateSarif } from '../analyzer/index.js';
+import { diagnosticIcon } from '../parser/format.js';
 import { C, severityBadge, severityText, severityTextPad, severityOrder, computeGrade, gradeColored, readCodeContext, trunc, bar, fileLink, fileLinkTrunc, cleanCliArtifacts } from './format.js';
 import { resolveLLMConfig, saveTuiConfig, loadTuiConfig } from './config.js';
-import { AGENTS, parseAgentFlag, launchAgent, launchAgentInline, copyToClipboard, buildAnnotatePrompt } from '../agents/index.js';
+import { AGENTS, parseAgentFlag, parseAnnotationModeFlag, launchAgent, launchAgentInline, copyToClipboard, buildAnnotatePrompt } from '../agents/index.js';
 import { describeConfigSource } from '../agents/config.js';
 import { getReviewableExposures, applyReviewAction, summarizeReview } from '../review/index.js';
 import { loadWorkspaceConfig, linkProject, addToWorkspace, removeFromWorkspace, mergeReports, formatMergeSummary, diffMergedReports } from '../workspace/index.js';
@@ -106,6 +107,7 @@ export function cmdHelp() {
         ['/workspace', 'Show workspace config and linked repos'],
         ['/link <repos...>', 'Link repos into a workspace (--add / --remove)'],
         ['/merge <files...>', 'Merge report JSONs into unified dashboard'],
+        ['/feature [name]', 'List all features or show detail for one'],
         ['', ''],
         ['/gal', 'GAL annotation language guide'],
         ['/help', 'This help'],
@@ -134,10 +136,12 @@ export function cmdGal() {
     console.log(H('  GAL — GuardLink Annotation Language'));
     console.log(H('  ══════════════════════════════════════════════════════════'));
     console.log('');
-    console.log(D('  Annotations live in source code comments. GuardLink parses'));
-    console.log(D('  them to build a live threat model from your codebase.'));
+    console.log(D('  Annotations live in source comments or standalone .gal files.'));
+    console.log(D('  GuardLink parses them into a live threat model for your codebase.'));
     console.log('');
     console.log(D('  Syntax:  @verb  subject  [preposition  object]  [-- "description"]'));
+    console.log(D('  Inline examples below use comment prefixes; raw .gal files use the same lines without // or #.'));
+    console.log(D('  In .gal files, use @source file:<path> line:<n> [symbol:<name>] to anchor following annotations.'));
     console.log('');
     // ── DEFINITIONS ──────────────────────────────────────────────────
     console.log(H('  ── Definitions ─────────────────────────────────────────────'));
@@ -224,6 +228,16 @@ export function cmdGal() {
     console.log(D('    Document a security assumption about an asset.'));
     console.log(EX('    // @assumes  api.gateway  -- "Upstream WAF filters malformed requests"'));
     console.log('');
+    // ── FEATURE TAGGING ──────────────────────────────────────────────
+    console.log(H('  ── Feature Tagging ─────────────────────────────────────────'));
+    console.log('');
+    console.log(`  ${V('@feature')}  ${K('"Feature Name"')}  ${D('[-- "description"]')}`);
+    console.log(D('    Tag code with a feature name for filtering reports and dashboards.'));
+    console.log(D('    A file can have multiple @feature tags. All annotations in that file'));
+    console.log(D('    are associated with the tagged features.'));
+    console.log(EX('    // @feature "SSO Login" -- "Single sign-on authentication flow"'));
+    console.log(EX('    // @feature "Payment Processing"'));
+    console.log('');
     console.log(`  ${V('@comment')}  ${D('[-- "description"]')}`);
     console.log(D('    Free-form developer security note (no structural effect).'));
     console.log(EX('    // @comment  -- "TODO — add rate limiting before v2 launch"'));
@@ -772,7 +786,9 @@ export async function cmdValidate(ctx) {
         if (allDiags.length > 0) {
             console.log('');
             for (const d of allDiags) {
-                const prefix = d.level === 'error' ? C.error('  ✗') : C.warn('  ⚠');
+                const icon = diagnosticIcon(d.level);
+                const color = d.level === 'fatal' || d.level === 'error' ? C.error : C.warn;
+                const prefix = color(`  ${icon}`);
                 const loc = d.file ? `${fileLink(d.file, d.line, ctx.root)}` : '';
                 console.log(`${prefix} ${d.message}${loc ? `  ${C.dim(loc)}` : ''}`);
             }
@@ -1292,10 +1308,15 @@ export function cmdThreatReports(ctx) {
 }
 // ─── /annotate ───────────────────────────────────────────────────────
 export async function cmdAnnotate(args, ctx) {
-    const { agent: flagAgent, cleanArgs } = parseAgentFlag(args);
+    const { mode: annotationMode, cleanArgs: argsWithoutMode, error: modeError } = parseAnnotationModeFlag(args);
+    if (modeError) {
+        console.log(C.warn(`  ${modeError}`));
+        return;
+    }
+    const { agent: flagAgent, cleanArgs } = parseAgentFlag(argsWithoutMode);
     if (!cleanArgs.trim()) {
-        console.log(C.warn('  Usage: /annotate <prompt> [--claude-code|--codex|--gemini|--cursor|--windsurf|--clipboard]'));
-        console.log(C.dim('  Example: /annotate "annotate auth endpoints for OWASP Top 10" --claude-code'));
+        console.log(C.warn('  Usage: /annotate <prompt> [--mode inline|external] [--claude-code|--codex|--gemini|--cursor|--windsurf|--clipboard]'));
+        console.log(C.dim('  Example: /annotate "annotate auth endpoints for OWASP Top 10" --mode external --claude-code'));
         return;
     }
     console.log('');
@@ -1304,7 +1325,7 @@ export async function cmdAnnotate(args, ctx) {
     if (!agent)
         return;
     // Build context prompt using shared builder
-    const prompt = buildAnnotatePrompt(cleanArgs.trim(), ctx.root, ctx.model);
+    const prompt = buildAnnotatePrompt(cleanArgs.trim(), ctx.root, ctx.model, annotationMode);
     // For terminal agents: foreground spawn (agent takes over terminal)
     if (agent.cmd) {
         const copied = copyToClipboard(prompt);
@@ -1559,7 +1580,7 @@ export async function cmdReview(args, ctx) {
             console.log(`    ${C.success('✓')} Marked for remediation — ${result.linesInserted} line(s) written\n`);
         }
         else {
-            results.push({ exposure: reviewable, action: { decision: 'skip', justification: '' }, linesInserted: 0 });
+            results.push({ exposure: reviewable, action: { decision: 'skip', justification: '' }, linesInserted: 0, targetFile: reviewable.exposure.location.file });
             console.log(`    ${C.dim('— Skipped')}\n`);
         }
     }
@@ -1602,7 +1623,8 @@ export async function cmdDashboard(ctx) {
         return;
     }
     const analyses = loadThreatReportsForDashboard(ctx.root);
-    const html = generateDashboardHTML(ctx.model, ctx.root, analyses);
+    const pentestData = loadPentestData(ctx.root);
+    const html = generateDashboardHTML(ctx.model, ctx.root, analyses, pentestData);
     const outFile = resolve(ctx.root, 'threat-dashboard.html');
     const { writeFile } = await import('node:fs/promises');
     await writeFile(outFile, html);
@@ -1643,6 +1665,70 @@ export function cmdWorkspace(ctx) {
     console.log(C.dim('  /merge to combine reports · /link --add to add a repo · /link --remove to remove'));
     console.log('');
 }
+// ─── /feature ────────────────────────────────────────────────────────
+export function cmdFeature(args, ctx) {
+    if (!ctx.model) {
+        console.log(C.warn('  No threat model. Run /parse first.'));
+        return;
+    }
+    const features = listFeatures(ctx.model);
+    if (features.length === 0) {
+        console.log('  No @feature annotations found.');
+        console.log(C.dim('  Tag code with: // @feature "Feature Name" -- "description"'));
+        console.log('');
+        return;
+    }
+    const name = args.trim();
+    if (name) {
+        // Show detail for specific feature
+        const filtered = filterByFeature(ctx.model, [name]);
+        const total = filtered.assets.length + filtered.threats.length +
+            filtered.controls.length + filtered.mitigations.length + filtered.exposures.length +
+            filtered.confirmed.length + filtered.flows.length + filtered.boundaries.length;
+        if (total === 0) {
+            console.log(C.warn(`  No annotations found for feature "${name}".`));
+            console.log(`  Available: ${features.map(f => `"${f}"`).join(', ')}`);
+            console.log('');
+            return;
+        }
+        console.log(`  Feature: ${C.bold(`"${name}"`)}`);
+        console.log('');
+        console.log(`    Assets:       ${filtered.assets.length}`);
+        console.log(`    Threats:      ${filtered.threats.length}`);
+        console.log(`    Controls:     ${filtered.controls.length}`);
+        console.log(`    Mitigations:  ${filtered.mitigations.length}`);
+        console.log(`    Exposures:    ${filtered.exposures.length}`);
+        if (filtered.confirmed.length > 0)
+            console.log(`    Confirmed:    ${filtered.confirmed.length} 🔴`);
+        console.log(`    Flows:        ${filtered.flows.length}`);
+        console.log(`    Boundaries:   ${filtered.boundaries.length}`);
+        if (filtered.exposures.length > 0) {
+            console.log('');
+            console.log(`    ${C.bold('Exposures:')}`);
+            for (const e of filtered.exposures) {
+                console.log(`      ${e.asset} → ${e.threat} ${severityBadge(e.severity || 'unset')} (${fileLink(e.location.file, e.location.line)})`);
+            }
+        }
+        console.log('');
+        return;
+    }
+    // List all features
+    const summaries = getFeatureSummaries(ctx.model);
+    console.log(`  ${C.bold('Features:')}`);
+    console.log('');
+    for (const s of summaries) {
+        const files = s.files.length === 1 ? '1 file' : `${s.files.length} files`;
+        const exposureInfo = s.exposures > 0 ? C.red(` | ${s.exposures} exposure(s)`) : '';
+        const confirmedInfo = s.confirmed > 0 ? C.red(` | ${s.confirmed} confirmed`) : '';
+        console.log(`    ${C.cyan(`"${s.name}"`)}  (${files}, ${s.annotations} annotations${exposureInfo}${confirmedInfo})`);
+        for (const f of s.files) {
+            console.log(`      → ${C.dim(f)}`);
+        }
+    }
+    console.log('');
+    console.log(C.dim(`  ${features.length} feature(s) total. Use /feature <name> for detail.`));
+    console.log('');
+}
 // ─── /link ───────────────────────────────────────────────────────────
 export async function cmdLink(args, ctx) {
     const parts = args.trim().split(/\s+/).filter(Boolean);