hex-audit 0.4.0

package/dashboard/app/api/flows/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server';
+import fs from 'node:fs';
+import path from 'node:path';
+import { getOutputDirPath } from '@/lib/data';
+
+export async function GET() {
+  const outputDir = getOutputDirPath();
+
+  try {
+    const files = fs.readdirSync(path.join(outputDir, 'diagrams'));
+    const flows: { name: string; filename: string }[] = [];
+
+    for (const file of files) {
+      if (/^flow-[\w-]+\.mmd$/.test(file)) {
+        const name = file
+          .replace(/^flow-/, '')
+          .replace(/\.mmd$/, '')
+          .replace(/-/g, ' ')
+          .replace(/\b\w/g, (c) => c.toUpperCase());
+        flows.push({ name, filename: file });
+      }
+    }
+
+    return NextResponse.json({ flows });
+  } catch {
+    return NextResponse.json({ flows: [] });
+  }
+}

package/dashboard/app/api/github-status/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from 'next/server';
+import { readJsonFile } from '@/lib/data';
+
+interface GithubSyncStatus {
+  repo: string;
+  last_synced_at: string;
+  pushed?: number;
+  updated?: number;
+  pulled?: number;
+  teammate_findings?: number;
+  duplicates_detected?: number;
+  errors?: string[];
+}
+
+export const dynamic = 'force-dynamic';
+
+export async function GET() {
+  const status = readJsonFile<GithubSyncStatus>('external/github/sync-status.json');
+  if (!status) {
+    return NextResponse.json({}, { status: 204 });
+  }
+  return NextResponse.json(status);
+}

package/dashboard/app/api/issues/[id]/move/route.ts

@@ -0,0 +1,74 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { readJsonFile, writeJsonFile } from '@/lib/data';
+
+interface TrackingEntry {
+  id: string;
+  status?: string;
+  duplicate_of?: string | null;
+  [key: string]: unknown;
+}
+
+interface TrackingFile {
+  findings: TrackingEntry[];
+}
+
+// Map a board column to the canonical tracking status it persists as.
+const COLUMN_TO_STATUS: Record<string, string> = {
+  potential: 'pending_validation',
+  verified: 'verified',
+  invalid: 'rejected',
+  duplicate: 'duplicate',
+};
+
+const STATUS_VALUES = new Set([
+  'pending_validation',
+  'unverified',
+  'verified',
+  'rejected',
+  'duplicate',
+]);
+
+export async function POST(request: NextRequest, { params }: { params: { id: string } }) {
+  const id = params.id;
+  const body = (await request.json()) as {
+    column?: string;
+    status?: string;
+    duplicate_of?: string | null;
+  };
+
+  let nextStatus: string | undefined;
+  if (body.status) {
+    if (!STATUS_VALUES.has(body.status)) {
+      return NextResponse.json({ error: `Invalid status: ${body.status}` }, { status: 400 });
+    }
+    nextStatus = body.status;
+  } else if (body.column) {
+    nextStatus = COLUMN_TO_STATUS[body.column];
+    if (!nextStatus) {
+      return NextResponse.json({ error: `Invalid column: ${body.column}` }, { status: 400 });
+    }
+  } else {
+    return NextResponse.json(
+      { error: "Body must include either 'column' or 'status'" },
+      { status: 400 },
+    );
+  }
+
+  const tracking = readJsonFile<TrackingFile>('tracking.json') ?? { findings: [] };
+  const entry = tracking.findings.find((e) => e.id === id);
+  if (!entry) {
+    return NextResponse.json({ error: `Issue ${id} not found in tracking.json` }, { status: 404 });
+  }
+
+  entry.status = nextStatus;
+  if (body.duplicate_of !== undefined) {
+    entry.duplicate_of = body.duplicate_of;
+  }
+  // Clearing duplicate_of when leaving the duplicate column reduces stale refs.
+  if (nextStatus !== 'duplicate' && entry.duplicate_of) {
+    entry.duplicate_of = null;
+  }
+
+  writeJsonFile('tracking.json', tracking);
+  return NextResponse.json({ ok: true, id, status: nextStatus });
+}

package/dashboard/app/api/issues/[id]/route.ts

@@ -0,0 +1,109 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { readJsonFile, writeJsonFile } from '@/lib/data';
+
+interface FindingsFile {
+  findings: Array<{
+    id: string;
+    title?: string;
+    severity?: string;
+    description?: string;
+    recommendation?: string;
+    resolution?: string;
+    update_from_client?: string;
+    [key: string]: unknown;
+  }>;
+}
+
+interface TrackingFile {
+  findings: Array<{
+    id: string;
+    title?: string;
+    severity?: string;
+    notes?: string;
+    [key: string]: unknown;
+  }>;
+}
+
+const EDITABLE_FIELDS = new Set([
+  'title',
+  'severity',
+  'description',
+  'recommendation',
+  'resolution',
+  'update_from_client',
+  'notes',
+]);
+
+const SEVERITY_VALUES = new Set(['Critical', 'High', 'Medium', 'Low', 'Info']);
+const RESOLUTION_VALUES = new Set([
+  'Fixed',
+  'Mitigated',
+  'Acknowledged',
+  'Not Fixed',
+  'Unresolved',
+]);
+
+export async function PATCH(request: NextRequest, { params }: { params: { id: string } }) {
+  const id = params.id;
+  const body = (await request.json()) as Record<string, unknown>;
+
+  const updates: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(body)) {
+    if (!EDITABLE_FIELDS.has(key)) continue;
+    if (key === 'severity' && typeof value === 'string' && !SEVERITY_VALUES.has(value)) {
+      return NextResponse.json({ error: `Invalid severity: ${value}` }, { status: 400 });
+    }
+    if (
+      key === 'resolution' &&
+      value != null &&
+      typeof value === 'string' &&
+      !RESOLUTION_VALUES.has(value)
+    ) {
+      return NextResponse.json({ error: `Invalid resolution: ${value}` }, { status: 400 });
+    }
+    updates[key] = value;
+  }
+
+  if (Object.keys(updates).length === 0) {
+    return NextResponse.json({ error: 'No editable fields supplied' }, { status: 400 });
+  }
+
+  // Apply to findings.json if a matching record exists; otherwise we record the
+  // edits on the tracking entry (title, severity, notes flow through; description
+  // and recommendation can't be displayed yet but we still persist them so a
+  // later /validate-issue or /write-finding can pick them up).
+  const findings = readJsonFile<FindingsFile>('findings.json') ?? { findings: [] };
+  const tracking = readJsonFile<TrackingFile>('tracking.json') ?? { findings: [] };
+
+  let findingTouched = false;
+  for (const finding of findings.findings) {
+    if (finding.id !== id) continue;
+    for (const [key, value] of Object.entries(updates)) {
+      if (key === 'notes') continue; // notes lives on tracking, not findings
+      finding[key] = value as never;
+    }
+    findingTouched = true;
+    break;
+  }
+
+  let trackingTouched = false;
+  for (const entry of tracking.findings) {
+    if (entry.id !== id) continue;
+    // Title and severity are mirrored on tracking so the board shows current
+    // values without re-reading findings.json.
+    if ('title' in updates) entry.title = updates.title as string;
+    if ('severity' in updates) entry.severity = updates.severity as string;
+    if ('notes' in updates) entry.notes = updates.notes as string;
+    trackingTouched = true;
+    break;
+  }
+
+  if (!findingTouched && !trackingTouched) {
+    return NextResponse.json({ error: `Issue ${id} not found` }, { status: 404 });
+  }
+
+  if (findingTouched) writeJsonFile('findings.json', findings);
+  if (trackingTouched) writeJsonFile('tracking.json', tracking);
+
+  return NextResponse.json({ ok: true, id, updates });
+}

package/dashboard/app/api/mermaid/route.ts

@@ -0,0 +1,25 @@
+import { NextRequest, NextResponse } from 'next/server';
+import fs from 'node:fs';
+import path from 'node:path';
+import { getOutputDirPath } from '@/lib/data';
+
+export async function GET(request: NextRequest) {
+  const filename = request.nextUrl.searchParams.get('file');
+
+  if (!filename || !/^[\w.-]+\.mmd$/.test(filename)) {
+    return NextResponse.json({ error: 'Invalid filename' }, { status: 400 });
+  }
+
+  const outputDir = getOutputDirPath();
+  const filePath = path.join(outputDir, 'diagrams', filename);
+
+  try {
+    const syntax = fs.readFileSync(filePath, 'utf-8');
+    return NextResponse.json({ syntax });
+  } catch {
+    return NextResponse.json(
+      { error: `File not found: ${filename}` },
+      { status: 404 },
+    );
+  }
+}

package/dashboard/app/api/progress/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { readJsonFile, writeJsonFile } from '@/lib/data';
+
+interface ProgressData {
+  updated_at: string;
+  reviewed_contracts: Record<string, boolean>;
+}
+
+const DEFAULT_PROGRESS: ProgressData = {
+  updated_at: new Date().toISOString(),
+  reviewed_contracts: {},
+};
+
+export async function GET() {
+  const data = readJsonFile<ProgressData>('progress.json');
+  return NextResponse.json(data ?? DEFAULT_PROGRESS);
+}
+
+export async function POST(request: NextRequest) {
+  const body = await request.json() as { reviewed_contracts: Record<string, boolean> };
+
+  if (!body.reviewed_contracts || typeof body.reviewed_contracts !== 'object') {
+    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 });
+  }
+
+  const existing = readJsonFile<ProgressData>('progress.json') ?? { ...DEFAULT_PROGRESS };
+
+  // Merge: new values override existing
+  for (const [key, value] of Object.entries(body.reviewed_contracts)) {
+    existing.reviewed_contracts[key] = value;
+  }
+  existing.updated_at = new Date().toISOString();
+
+  writeJsonFile('progress.json', existing);
+  return NextResponse.json(existing);
+}

package/dashboard/app/api/watch/route.ts

@@ -0,0 +1,52 @@
+import { initWatcher, onFileChange } from '@/lib/watcher';
+import { getOutputDirPath } from '@/lib/data';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(): Promise<Response> {
+  const outputDir = getOutputDirPath();
+  initWatcher(outputDir);
+
+  const encoder = new TextEncoder();
+  let unsubscribe: (() => void) | undefined;
+  let keepalive: ReturnType<typeof setInterval> | undefined;
+
+  const stream = new ReadableStream({
+    start(controller) {
+      // Send initial connection confirmation
+      controller.enqueue(encoder.encode(': connected\n\n'));
+
+      // Subscribe to file changes from the watcher
+      unsubscribe = onFileChange((file) => {
+        try {
+          controller.enqueue(
+            encoder.encode(`data: ${JSON.stringify({ file })}\n\n`),
+          );
+        } catch {
+          // Stream closed; cleanup will happen in cancel()
+        }
+      });
+
+      // Keepalive ping every 30 seconds to prevent connection timeout
+      keepalive = setInterval(() => {
+        try {
+          controller.enqueue(encoder.encode(': ping\n\n'));
+        } catch {
+          // Stream closed; cleanup will happen in cancel()
+        }
+      }, 30_000);
+    },
+    cancel() {
+      if (keepalive) clearInterval(keepalive);
+      if (unsubscribe) unsubscribe();
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+    },
+  });
+}

package/dashboard/app/calls/CallsClient.tsx

@@ -0,0 +1,170 @@
+'use client';
+
+import { FilterableTable, type FilterableColumn } from '@/components/FilterableTable';
+
+// ─── Types ──────────────────────────────────────────────────────────
+
+interface ConfidenceValue {
+  value: boolean | string;
+  confidence: string;
+  derived_from: string;
+  reasoning?: string;
+  warnings?: string[];
+  guard_type?: string;
+}
+
+interface ExternalCall {
+  contract: string;
+  function: string;
+  target: string;
+  method: string;
+  return_checked: ConfidenceValue;
+  inside_reentrancy_guard: ConfidenceValue;
+  call_type: string;
+  trust_level: ConfidenceValue;
+}
+
+interface CallRow {
+  contract: string;
+  fn: string;
+  call: string;
+  return_checked: boolean;
+  call_type: string;
+  trust: string;
+}
+
+// ─── Helpers ────────────────────────────────────────────────────────
+
+const TRUST_STYLES: Record<string, string> = {
+  external: 'bg-[var(--critical)]/15 text-[var(--critical)]',
+  untrusted: 'bg-[var(--critical)]/15 text-[var(--critical)]',
+  'semi-trusted': 'bg-[var(--medium)]/15 text-[var(--medium)]',
+  semi_trusted: 'bg-[var(--medium)]/15 text-[var(--medium)]',
+  trusted: 'bg-[var(--success)]/15 text-[var(--success)]',
+};
+
+function TrustBadge({ trust }: { trust: string }) {
+  const style = TRUST_STYLES[trust.toLowerCase()] ?? 'bg-[var(--neutral)]/15 text-[var(--neutral)]';
+  return (
+    <span className={`inline-flex items-center rounded-sm px-2 py-0.5 text-caption font-medium ${style}`}>
+      {trust}
+    </span>
+  );
+}
+
+function toBool(value: boolean | string): boolean {
+  return value === true || value === 'true' || value === 'yes';
+}
+
+function flattenCalls(calls: ExternalCall[]): CallRow[] {
+  return calls.map((c) => ({
+    contract: c.contract,
+    fn: c.function,
+    call: `${c.target}.${c.method}()`,
+    return_checked: toBool(c.return_checked.value),
+    call_type: c.call_type,
+    trust: String(c.trust_level.value),
+  }));
+}
+
+// ─── Columns ────────────────────────────────────────────────────────
+
+const columns: FilterableColumn<CallRow>[] = [
+  {
+    id: 'contract',
+    header: 'Contract',
+    accessorKey: 'contract',
+    enableColumnFilter: true,
+    cell: (row) => <span className="font-medium text-text-primary">{row.contract}</span>,
+  },
+  {
+    id: 'function',
+    header: 'Function',
+    accessorKey: 'fn',
+    cell: (row) => <span className="font-mono text-body text-text-secondary">{row.fn}</span>,
+  },
+  {
+    id: 'call',
+    header: 'Call',
+    accessorKey: 'call',
+    cell: (row) => <span className="font-mono text-body text-text-secondary">{row.call}</span>,
+  },
+  {
+    id: 'return_checked',
+    header: 'Return Checked',
+    accessorKey: 'return_checked',
+    cell: (row) => (
+      <span className={row.return_checked ? 'text-[var(--success)]' : 'text-[var(--critical)]'}>
+        {row.return_checked ? 'Yes' : 'No'}
+      </span>
+    ),
+  },
+  {
+    id: 'call_type',
+    header: 'Call Type',
+    accessorKey: 'call_type',
+    enableColumnFilter: true,
+    cell: (row) => (
+      <span className="inline-flex items-center rounded-sm bg-surface-3 px-2 py-0.5 text-caption text-text-secondary">
+        {row.call_type}
+      </span>
+    ),
+  },
+  {
+    id: 'trust',
+    header: 'Trust',
+    accessorKey: 'trust',
+    enableColumnFilter: true,
+    cell: (row) => <TrustBadge trust={row.trust} />,
+  },
+];
+
+// ─── Component ──────────────────────────────────────────────────────
+
+export function CallsClient({ calls }: { calls: ExternalCall[] }) {
+  const rows = flattenCalls(calls);
+
+  const trustCounts: Record<string, number> = {};
+  for (const r of rows) {
+    trustCounts[r.trust] = (trustCounts[r.trust] ?? 0) + 1;
+  }
+
+  const uncheckedReturns = rows.filter((r) => !r.return_checked).length;
+
+  return (
+    <div>
+      <h2 className="mb-sp-5 text-title font-semibold text-text-primary">External Calls</h2>
+
+      <p className="mb-sp-3 text-body text-text-secondary">
+        {rows.length} external call{rows.length !== 1 ? 's' : ''} found
+      </p>
+
+      {/* Summary cards */}
+      <div className="mb-sp-5 grid grid-cols-2 gap-sp-3 sm:grid-cols-4">
+        {Object.entries(trustCounts).map(([level, count]) => (
+          <div
+            key={level}
+            className="rounded-md border border-border-default bg-surface-2 p-sp-4"
+          >
+            <div className="text-display text-text-primary">{count}</div>
+            <div className="mt-1">
+              <TrustBadge trust={level} />
+            </div>
+          </div>
+        ))}
+        {uncheckedReturns > 0 && (
+          <div className="rounded-md border border-[var(--critical)]/30 bg-[var(--critical)]/5 p-sp-4">
+            <div className="text-display text-[var(--critical)]">{uncheckedReturns}</div>
+            <div className="mt-1 text-caption text-[var(--critical)]/70">Unchecked returns</div>
+          </div>
+        )}
+      </div>
+
+      <FilterableTable
+        columns={columns}
+        data={rows}
+        defaultOpen={true}
+      />
+    </div>
+  );
+}

package/dashboard/app/calls/page.tsx

@@ -0,0 +1,50 @@
+import { readJsonFile } from '@/lib/data';
+import { NotYetGenerated } from '@/components/NotYetGenerated';
+import { CallsClient } from './CallsClient';
+
+interface ConfidenceValue {
+  value: boolean | string;
+  confidence: string;
+  derived_from: string;
+  reasoning?: string;
+  warnings?: string[];
+  guard_type?: string;
+}
+
+interface Evidence {
+  file: string;
+  line_start: number;
+  line_end: number;
+  snippet?: string;
+}
+
+interface ExternalCall {
+  contract: string;
+  function: string;
+  evidence: Evidence;
+  target: string;
+  method: string;
+  return_checked: ConfidenceValue;
+  inside_reentrancy_guard: ConfidenceValue;
+  call_type: string;
+  trust_level: ConfidenceValue;
+}
+
+interface ExternalCalls {
+  calls: ExternalCall[];
+}
+
+export default function CallsPage() {
+  const data = readJsonFile<ExternalCalls>('external-calls.json');
+
+  if (!data) {
+    return (
+      <div>
+        <h2 className="mb-sp-5 text-title font-semibold text-text-primary">External Calls</h2>
+        <NotYetGenerated command="hex calls" />
+      </div>
+    );
+  }
+
+  return <CallsClient calls={data.calls} />;
+}