hex-audit 0.7.0 → 0.8.0

package/dashboard/app/access/ReadOnlyFunctions.tsx

@@ -1,114 +0,0 @@
-'use client';
-
-import { useState } from 'react';
-
-interface Evidence {
-  file: string;
-  line_start: number;
-  line_end: number;
-  snippet?: string;
-}
-
-interface AccessFunction {
-  contract: string;
-  function: string;
-  visibility: string;
-  state_mutability: string | null;
-  modifiers: string[];
-  evidence: Evidence;
-}
-
-const VISIBILITY_STYLES: Record<string, string> = {
-  external: 'bg-[var(--critical)]/15 text-[var(--critical)]',
-  public: 'bg-[var(--high)]/15 text-[var(--high)]',
-  internal: 'bg-[var(--low)]/15 text-[var(--low)]',
-  private: 'bg-[var(--neutral)]/15 text-[var(--neutral)]',
-};
-
-function VisibilityBadge({ visibility }: { visibility: string }) {
-  const style = VISIBILITY_STYLES[visibility] ?? 'bg-[var(--neutral)]/15 text-[var(--neutral)]';
-  return (
-    <span className={`inline-flex items-center rounded-sm px-2 py-0.5 text-caption font-medium ${style}`}>
-      {visibility}
-    </span>
-  );
-}
-
-export function ReadOnlyFunctions({
-  functions,
-  anyoneFnKeys,
-}: {
-  functions: AccessFunction[];
-  anyoneFnKeys: string[];
-}) {
-  const [expanded, setExpanded] = useState(false);
-  const anyoneSet = new Set(anyoneFnKeys);
-
-  return (
-    <div className="mb-sp-6">
-      <button
-        type="button"
-        onClick={() => setExpanded(!expanded)}
-        className="flex w-full items-center gap-2 rounded-md border border-border-default bg-surface-2 px-sp-4 py-sp-3 text-left hover:bg-surface-3"
-      >
-        <svg
-          className={`h-4 w-4 text-text-tertiary ${expanded ? 'rotate-90' : ''}`}
-          fill="none"
-          viewBox="0 0 24 24"
-          stroke="currentColor"
-          strokeWidth={2}
-        >
-          <path strokeLinecap="round" strokeLinejoin="round" d="m9 5 7 7-7 7" />
-        </svg>
-        <span className="text-body font-medium text-text-primary">
-          Read-Only Functions ({functions.length})
-        </span>
-        <span className="text-caption text-text-tertiary">view / pure</span>
-      </button>
-
-      {expanded && (
-        <div className="mt-2 overflow-x-auto rounded-md border border-border-default">
-          <table className="w-full text-left text-body">
-            <thead className="border-b border-border-default bg-surface-2 text-caption font-medium uppercase tracking-wider text-text-tertiary">
-              <tr>
-                <th className="px-sp-4 py-sp-2">Contract</th>
-                <th className="px-sp-4 py-sp-2">Function</th>
-                <th className="px-sp-4 py-sp-2">Visibility</th>
-                <th className="px-sp-4 py-sp-2">Mutability</th>
-                <th className="px-sp-4 py-sp-2">Location</th>
-              </tr>
-            </thead>
-            <tbody className="divide-y divide-border-subtle">
-              {functions.map((fn) => {
-                const key = `${fn.contract}::${fn.function}`;
-                const isAnyone = anyoneSet.has(key);
-                return (
-                  <tr
-                    key={key}
-                    className={
-                      isAnyone
-                        ? 'bg-[var(--critical)]/5 hover:bg-[var(--critical)]/10'
-                        : 'bg-surface-1 hover:bg-surface-3'
-                    }
-                  >
-                    <td className="px-sp-4 py-sp-2 font-medium text-text-primary">{fn.contract}</td>
-                    <td className="px-sp-4 py-sp-2 font-mono text-body text-text-secondary">{fn.function}</td>
-                    <td className="px-sp-4 py-sp-2">
-                      <VisibilityBadge visibility={fn.visibility} />
-                    </td>
-                    <td className="px-sp-4 py-sp-2 text-caption text-text-tertiary">
-                      {fn.state_mutability ?? '--'}
-                    </td>
-                    <td className="px-sp-4 py-sp-2 font-mono text-caption text-text-tertiary">
-                      {fn.evidence.file}:{fn.evidence.line_start}
-                    </td>
-                  </tr>
-                );
-              })}
-            </tbody>
-          </table>
-        </div>
-      )}
-    </div>
-  );
-}

package/dashboard/app/access/page.tsx

@@ -1,125 +0,0 @@
-import { readJsonFile } from '@/lib/data';
-import { NotYetGenerated } from '@/components/NotYetGenerated';
-import { AccessClient } from './AccessClient';
-
-// Read .hex/ at request time, not at build time. Without this, next build
-// prerenders this page with whatever .hex/ data was available in the build
-// environment and ships static HTML — the dashboard then renders that
-// stale (or empty) HTML for every audit project, ignoring the runtime cwd.
-export const dynamic = 'force-dynamic';
-
-
-// ─── Types ──────────────────────────────────────────────────────────
-
-interface Evidence {
-  file: string;
-  line_start: number;
-  line_end: number;
-  snippet?: string;
-}
-
-interface AccessFunction {
-  contract: string;
-  function: string;
-  visibility: string;
-  state_mutability: string | null;
-  modifiers: string[];
-  evidence: Evidence;
-}
-
-interface RoleFunctionRef {
-  contract: string;
-  function: string;
-}
-
-interface Role {
-  role: string;
-  description: string;
-  confidence: string;
-  derived_from: string;
-  reasoning: string;
-  modifier: string | null;
-  functions: RoleFunctionRef[];
-  warnings: string[];
-  kind?: 'access_control' | 'state_check' | 'guard' | 'unknown';
-  is_likely_access_control?: boolean;
-}
-
-interface AccessControl {
-  functions: AccessFunction[];
-  roles: Role[];
-}
-
-// ─── Component ──────────────────────────────────────────────────────
-
-export default function AccessPage() {
-  const data = readJsonFile<AccessControl>('access-control.json');
-
-  if (!data) {
-    return (
-      <div>
-        <h2 className="mb-sp-5 text-title font-semibold text-text-primary">Access Control</h2>
-        <NotYetGenerated command="hex access" />
-      </div>
-    );
-  }
-
-  const { functions, roles } = data;
-
-  const externalFunctions = functions.filter(
-    (fn) => fn.visibility === 'external' || fn.visibility === 'public',
-  );
-
-  const writeFunctions = externalFunctions.filter(
-    (fn) => fn.state_mutability !== 'view' && fn.state_mutability !== 'pure',
-  );
-  const readOnlyFunctions = externalFunctions.filter(
-    (fn) => fn.state_mutability === 'view' || fn.state_mutability === 'pure',
-  );
-
-  const anyoneRole = roles.find(
-    (r) => r.role.toLowerCase() === 'anyone' || r.role.toLowerCase() === 'public',
-  );
-  const otherRoles = roles.filter(
-    (r) => r.role.toLowerCase() !== 'anyone' && r.role.toLowerCase() !== 'public',
-  );
-
-  const anyoneFnKeys = anyoneRole?.functions.map((f) => `${f.contract}::${f.function}`) ?? [];
-
-  // Unprotected count: state-changing functions callable by anyone
-  const writeFnKeys = new Set(writeFunctions.map((fn) => `${fn.contract}::${fn.function}`));
-  const unprotectedCount = anyoneFnKeys.filter((k) => writeFnKeys.has(k)).length;
-
-  return (
-    <div>
-      <h2 className="mb-sp-5 text-title font-semibold text-text-primary">Access Control</h2>
-
-      {/* Summary strip */}
-      <div className="mb-sp-5 flex flex-wrap gap-sp-3">
-        <div className="flex items-center gap-2 rounded-md border border-border-default bg-surface-2 px-sp-4 py-sp-2">
-          <span className="text-heading font-semibold text-text-primary">{externalFunctions.length}</span>
-          <span className="text-caption text-text-secondary">Total</span>
-        </div>
-        <div className="flex items-center gap-2 rounded-md border border-border-default bg-surface-2 px-sp-4 py-sp-2">
-          <span className="text-heading font-semibold text-text-primary">{writeFunctions.length}</span>
-          <span className="text-caption text-text-secondary">State-Changing</span>
-        </div>
-        {unprotectedCount > 0 && (
-          <div className="flex items-center gap-2 rounded-md border border-[var(--critical)]/30 bg-[var(--critical)]/5 px-sp-4 py-sp-2">
-            <span className="text-heading font-semibold text-[var(--critical)]">{unprotectedCount}</span>
-            <span className="text-caption text-[var(--critical)]/80">Unprotected</span>
-          </div>
-        )}
-      </div>
-
-      <AccessClient
-        writeFunctions={writeFunctions}
-        readOnlyFunctions={readOnlyFunctions}
-        anyoneFnKeys={anyoneFnKeys}
-        anyoneRole={anyoneRole ?? null}
-        otherRoles={otherRoles}
-        allRoles={roles}
-      />
-    </div>
-  );
-}

package/dashboard/app/api/flows/route.ts

@@ -1,32 +0,0 @@
-import { NextResponse } from 'next/server';
-import fs from 'node:fs';
-import path from 'node:path';
-import { getOutputDirPath } from '@/lib/data';
-
-// Read .hex/diagrams/ at request time. Without this, next build prerenders the
-// route against an empty build-time .hex/ and ships a static `{"flows":[]}`.
-export const dynamic = 'force-dynamic';
-
-export async function GET() {
-  const outputDir = getOutputDirPath();
-
-  try {
-    const files = fs.readdirSync(path.join(outputDir, 'diagrams'));
-    const flows: { name: string; filename: string }[] = [];
-
-    for (const file of files) {
-      if (/^flow-[\w-]+\.mmd$/.test(file)) {
-        const name = file
-          .replace(/^flow-/, '')
-          .replace(/\.mmd$/, '')
-          .replace(/-/g, ' ')
-          .replace(/\b\w/g, (c) => c.toUpperCase());
-        flows.push({ name, filename: file });
-      }
-    }
-
-    return NextResponse.json({ flows });
-  } catch {
-    return NextResponse.json({ flows: [] });
-  }
-}

package/dashboard/app/api/mermaid/route.ts

@@ -1,25 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-import fs from 'node:fs';
-import path from 'node:path';
-import { getOutputDirPath } from '@/lib/data';
-
-export async function GET(request: NextRequest) {
-  const filename = request.nextUrl.searchParams.get('file');
-
-  if (!filename || !/^[\w.-]+\.mmd$/.test(filename)) {
-    return NextResponse.json({ error: 'Invalid filename' }, { status: 400 });
-  }
-
-  const outputDir = getOutputDirPath();
-  const filePath = path.join(outputDir, 'diagrams', filename);
-
-  try {
-    const syntax = fs.readFileSync(filePath, 'utf-8');
-    return NextResponse.json({ syntax });
-  } catch {
-    return NextResponse.json(
-      { error: `File not found: ${filename}` },
-      { status: 404 },
-    );
-  }
-}

package/dashboard/app/calls/CallsClient.tsx

@@ -1,170 +0,0 @@
-'use client';
-
-import { FilterableTable, type FilterableColumn } from '@/components/FilterableTable';
-
-// ─── Types ──────────────────────────────────────────────────────────
-
-interface ConfidenceValue {
-  value: boolean | string;
-  confidence: string;
-  derived_from: string;
-  reasoning?: string;
-  warnings?: string[];
-  guard_type?: string;
-}
-
-interface ExternalCall {
-  contract: string;
-  function: string;
-  target: string;
-  method: string;
-  return_checked: ConfidenceValue;
-  inside_reentrancy_guard: ConfidenceValue;
-  call_type: string;
-  trust_level: ConfidenceValue;
-}
-
-interface CallRow {
-  contract: string;
-  fn: string;
-  call: string;
-  return_checked: boolean;
-  call_type: string;
-  trust: string;
-}
-
-// ─── Helpers ────────────────────────────────────────────────────────
-
-const TRUST_STYLES: Record<string, string> = {
-  external: 'bg-[var(--critical)]/15 text-[var(--critical)]',
-  untrusted: 'bg-[var(--critical)]/15 text-[var(--critical)]',
-  'semi-trusted': 'bg-[var(--medium)]/15 text-[var(--medium)]',
-  semi_trusted: 'bg-[var(--medium)]/15 text-[var(--medium)]',
-  trusted: 'bg-[var(--success)]/15 text-[var(--success)]',
-};
-
-function TrustBadge({ trust }: { trust: string }) {
-  const style = TRUST_STYLES[trust.toLowerCase()] ?? 'bg-[var(--neutral)]/15 text-[var(--neutral)]';
-  return (
-    <span className={`inline-flex items-center rounded-sm px-2 py-0.5 text-caption font-medium ${style}`}>
-      {trust}
-    </span>
-  );
-}
-
-function toBool(value: boolean | string): boolean {
-  return value === true || value === 'true' || value === 'yes';
-}
-
-function flattenCalls(calls: ExternalCall[]): CallRow[] {
-  return calls.map((c) => ({
-    contract: c.contract,
-    fn: c.function,
-    call: `${c.target}.${c.method}()`,
-    return_checked: toBool(c.return_checked.value),
-    call_type: c.call_type,
-    trust: String(c.trust_level.value),
-  }));
-}
-
-// ─── Columns ────────────────────────────────────────────────────────
-
-const columns: FilterableColumn<CallRow>[] = [
-  {
-    id: 'contract',
-    header: 'Contract',
-    accessorKey: 'contract',
-    enableColumnFilter: true,
-    cell: (row) => <span className="font-medium text-text-primary">{row.contract}</span>,
-  },
-  {
-    id: 'function',
-    header: 'Function',
-    accessorKey: 'fn',
-    cell: (row) => <span className="font-mono text-body text-text-secondary">{row.fn}</span>,
-  },
-  {
-    id: 'call',
-    header: 'Call',
-    accessorKey: 'call',
-    cell: (row) => <span className="font-mono text-body text-text-secondary">{row.call}</span>,
-  },
-  {
-    id: 'return_checked',
-    header: 'Return Checked',
-    accessorKey: 'return_checked',
-    cell: (row) => (
-      <span className={row.return_checked ? 'text-[var(--success)]' : 'text-[var(--critical)]'}>
-        {row.return_checked ? 'Yes' : 'No'}
-      </span>
-    ),
-  },
-  {
-    id: 'call_type',
-    header: 'Call Type',
-    accessorKey: 'call_type',
-    enableColumnFilter: true,
-    cell: (row) => (
-      <span className="inline-flex items-center rounded-sm bg-surface-3 px-2 py-0.5 text-caption text-text-secondary">
-        {row.call_type}
-      </span>
-    ),
-  },
-  {
-    id: 'trust',
-    header: 'Trust',
-    accessorKey: 'trust',
-    enableColumnFilter: true,
-    cell: (row) => <TrustBadge trust={row.trust} />,
-  },
-];
-
-// ─── Component ──────────────────────────────────────────────────────
-
-export function CallsClient({ calls }: { calls: ExternalCall[] }) {
-  const rows = flattenCalls(calls);
-
-  const trustCounts: Record<string, number> = {};
-  for (const r of rows) {
-    trustCounts[r.trust] = (trustCounts[r.trust] ?? 0) + 1;
-  }
-
-  const uncheckedReturns = rows.filter((r) => !r.return_checked).length;
-
-  return (
-    <div>
-      <h2 className="mb-sp-5 text-title font-semibold text-text-primary">External Calls</h2>
-
-      <p className="mb-sp-3 text-body text-text-secondary">
-        {rows.length} external call{rows.length !== 1 ? 's' : ''} found
-      </p>
-
-      {/* Summary cards */}
-      <div className="mb-sp-5 grid grid-cols-2 gap-sp-3 sm:grid-cols-4">
-        {Object.entries(trustCounts).map(([level, count]) => (
-          <div
-            key={level}
-            className="rounded-md border border-border-default bg-surface-2 p-sp-4"
-          >
-            <div className="text-display text-text-primary">{count}</div>
-            <div className="mt-1">
-              <TrustBadge trust={level} />
-            </div>
-          </div>
-        ))}
-        {uncheckedReturns > 0 && (
-          <div className="rounded-md border border-[var(--critical)]/30 bg-[var(--critical)]/5 p-sp-4">
-            <div className="text-display text-[var(--critical)]">{uncheckedReturns}</div>
-            <div className="mt-1 text-caption text-[var(--critical)]/70">Unchecked returns</div>
-          </div>
-        )}
-      </div>
-
-      <FilterableTable
-        columns={columns}
-        data={rows}
-        defaultOpen={true}
-      />
-    </div>
-  );
-}

package/dashboard/app/calls/page.tsx

@@ -1,57 +0,0 @@
-import { readJsonFile } from '@/lib/data';
-import { NotYetGenerated } from '@/components/NotYetGenerated';
-import { CallsClient } from './CallsClient';
-
-// Read .hex/ at request time, not at build time. Without this, next build
-// prerenders this page with whatever .hex/ data was available in the build
-// environment and ships static HTML — the dashboard then renders that
-// stale (or empty) HTML for every audit project, ignoring the runtime cwd.
-export const dynamic = 'force-dynamic';
-
-
-interface ConfidenceValue {
-  value: boolean | string;
-  confidence: string;
-  derived_from: string;
-  reasoning?: string;
-  warnings?: string[];
-  guard_type?: string;
-}
-
-interface Evidence {
-  file: string;
-  line_start: number;
-  line_end: number;
-  snippet?: string;
-}
-
-interface ExternalCall {
-  contract: string;
-  function: string;
-  evidence: Evidence;
-  target: string;
-  method: string;
-  return_checked: ConfidenceValue;
-  inside_reentrancy_guard: ConfidenceValue;
-  call_type: string;
-  trust_level: ConfidenceValue;
-}
-
-interface ExternalCalls {
-  calls: ExternalCall[];
-}
-
-export default function CallsPage() {
-  const data = readJsonFile<ExternalCalls>('external-calls.json');
-
-  if (!data) {
-    return (
-      <div>
-        <h2 className="mb-sp-5 text-title font-semibold text-text-primary">External Calls</h2>
-        <NotYetGenerated command="hex calls" />
-      </div>
-    );
-  }
-
-  return <CallsClient calls={data.calls} />;
-}