karajan-code 2.16.0 → 2.17.1

package/src/sonar/issue-filter.js

@@ -1,110 +1,12 @@
-// KJC-TSK-0416: pre-filtro determinístico de falsos positivos Sonar.
+// @deprecated — moved to src/audit/issue-filter.js (v2.17.0). This shim
+// re-exports the generalised filter so existing imports keep working. All
+// Sonar-specific behaviour (default `tool="sonar"`, legacy
+// `// karajan-sonar-ignore: <rule>` markers) is preserved by the new module.
 //
-// Antes de que los issues Sonar lleguen al coder como feedback (sonar-role)
-// o al auditor (audit), filtramos los que sabemos que son falsos positivos
-// por reglas conocidas. Sin esto el coder quemaba tokens intentando
-// "arreglar" cosas que no están rotas.
-//
-// Dos mecanismos complementarios:
-//   1. Rules estáticas: { rule, filePattern, reason } — match por reglaId
-//      + patrón de path. Cargadas por defecto del catálogo de FALSE_POSITIVES
-//      abajo + extensibles via config.sonar.false_positives.
-//   2. Inline ignore: `// karajan-sonar-ignore: <ruleId>` en la línea del
-//      issue (o la anterior) → suprime ese hit exacto.
-
-import fs from "node:fs";
-
-// Catálogo built-in de patrones conocidos. Cada entrada:
-//   { rule: "javascript:S2699", filePattern: RegExp, reason: "..." }
-// Ampliable via config.sonar.false_positives.
-export const DEFAULT_FALSE_POSITIVES = [
-  {
-    rule: "javascript:S2699",
-    filePattern: /tests\/architecture\//,
-    reason: "Tests structurales fallan vía expect(offenders, msg).toEqual([]) — Sonar no detecta el assert con mensaje custom",
-  },
-];
-
-/**
- * Comprueba si una línea del file contiene `// karajan-sonar-ignore: <ruleId>`.
- * Acepta la línea exacta del issue o la inmediatamente anterior.
- *
- * @param {string} filePath
- * @param {number} line - 1-indexed
- * @param {string} ruleId
- * @returns {boolean}
- */
-export function hasInlineIgnore(filePath, line, ruleId) {
-  if (!filePath || !line || !ruleId) return false;
-  if (!fs.existsSync(filePath)) return false;
-  try {
-    const lines = fs.readFileSync(filePath, "utf8").split("\n");
-    const idx = line - 1;
-    const candidates = [lines[idx], lines[idx - 1]].filter(Boolean);
-    const re = new RegExp(`karajan-sonar-ignore\\s*:\\s*${escapeRegex(ruleId)}\\b`);
-    return candidates.some((l) => re.test(l));
-  } catch {
-    return false;
-  }
-}
-
-function escapeRegex(s) {
-  return String(s).replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-/**
- * Filtra issues de Sonar separando los reales de los falsos positivos.
- *
- * @param {object[]} issues - array de Sonar issues (shape: { rule, component, line, message, severity, ... })
- * @param {object} [opts]
- * @param {object[]} [opts.extraRules] - rules adicionales del config
- * @param {string} [opts.projectRoot] - para resolver component → ruta absoluta
- * @returns {{ kept: object[], suppressed: object[] }}
- */
-export function filterFalsePositives(issues, opts = {}) {
-  if (!Array.isArray(issues)) return { kept: [], suppressed: [] };
-  const rules = [...DEFAULT_FALSE_POSITIVES, ...(opts.extraRules || [])].map((r) => ({
-    ...r,
-    filePattern: r.filePattern instanceof RegExp ? r.filePattern : new RegExp(String(r.filePattern || ".*")),
-  }));
-  const projectRoot = opts.projectRoot || process.cwd();
-  const kept = [];
-  const suppressed = [];
-
-  for (const issue of issues) {
-    const path = componentToPath(issue.component);
-    let matched = null;
-
-    // 1. Rules estáticas.
-    for (const rule of rules) {
-      if (issue.rule === rule.rule && rule.filePattern.test(path)) {
-        matched = { rule: rule.rule, path, reason: rule.reason };
-        break;
-      }
-    }
-
-    // 2. Inline ignore (más caro — solo si la regla estática no matchea).
-    if (!matched && issue.rule && issue.line && path) {
-      const absPath = path.startsWith("/") ? path : `${projectRoot}/${path}`;
-      if (hasInlineIgnore(absPath, issue.line, issue.rule)) {
-        matched = { rule: issue.rule, path, reason: "inline `// karajan-sonar-ignore`" };
-      }
-    }
-
-    if (matched) {
-      suppressed.push({ ...issue, _suppressedBy: matched });
-    } else {
-      kept.push(issue);
-    }
-  }
-  return { kept, suppressed };
-}
+// New code should import from "../audit/issue-filter.js" directly.
 
-/**
- * Sonar reporta component como `<projectKey>:<relativePath>`. Extrae el path.
- */
-function componentToPath(component) {
-  if (typeof component !== "string") return "";
-  const colonIdx = component.indexOf(":");
-  return colonIdx >= 0 ? component.slice(colonIdx + 1) : component;
-}
+export {
+  filterFalsePositives,
+  hasInlineIgnore,
+  DEFAULT_FALSE_POSITIVES,
+} from "../audit/issue-filter.js";

package/src/utils/install-hints.js

@@ -0,0 +1,136 @@
+// Platform-aware install hints for external tools that `kj audit` /
+// `kj webperf` use (semgrep, osv-scanner, lighthouse).
+//
+// `kj doctor` calls these to render hint strings ("Install with:
+// pipx install semgrep") that match what's actually available on the
+// user's machine, rather than a generic "see docs" message. The same
+// metadata drives `kj install-tools` (HU2) — it decides which package
+// manager to invoke per tool.
+//
+// We probe each package manager once with `which`/`where`-style checks
+// and cache the result for the lifetime of the process.
+
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * @typedef {"pipx"|"brew"|"go"|"npm"|"pip"|"apt"|"dnf"|"choco"|"scoop"|"docker"} PackageManager
+ */
+
+/** @type {Record<PackageManager, boolean>|null} */
+let cachedAvailability = null;
+
+const PROBES = [
+  ["pipx", ["--version"]],
+  ["brew", ["--version"]],
+  ["go", ["version"]],
+  ["npm", ["--version"]],
+  ["pip", ["--version"]],
+  ["apt", ["--version"]],
+  ["dnf", ["--version"]],
+  ["choco", ["--version"]],
+  ["scoop", ["--version"]],
+  ["docker", ["--version"]],
+];
+
+async function probeOne(bin, args) {
+  try {
+    await execFileAsync(bin, args, { timeout: 3000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Detect which package managers are reachable on PATH. Cached on first
+ * call. Exported for tests; production callers go through getInstallHint.
+ */
+export async function detectPackageManagers() {
+  if (cachedAvailability) return cachedAvailability;
+  const entries = await Promise.all(
+    PROBES.map(async ([bin, args]) => [bin, await probeOne(bin, args)]),
+  );
+  cachedAvailability = Object.fromEntries(entries);
+  return cachedAvailability;
+}
+
+/** Test helper — reset the cache between unit cases. */
+export function resetPackageManagerCache() {
+  cachedAvailability = null;
+}
+
+/**
+ * Returns the install command for a tool, preferring the highest-priority
+ * package manager available on the current system.
+ *
+ * The order encodes our recommendation when multiple managers can install
+ * the same tool. We prefer isolated installs (pipx, brew) over global
+ * `pip install` so we don't pollute the user's site-packages.
+ *
+ * @param {"semgrep"|"osv-scanner"|"lighthouse"|"docker"} tool
+ * @param {Record<PackageManager, boolean>} [available] — pre-computed availability; if omitted, detects.
+ * @returns {Promise<{ command: string|null, manager: PackageManager|null, manualUrl: string }>}
+ */
+export async function getInstallHint(tool, available = null) {
+  const avail = available || (await detectPackageManagers());
+  const candidates = INSTALL_CANDIDATES[tool] || [];
+  for (const { manager, command } of candidates) {
+    if (avail[manager]) return { command, manager, manualUrl: MANUAL_URLS[tool] };
+  }
+  // Nothing matched — fall back to the first candidate's command as a
+  // suggestion, so the user at least sees a working recipe.
+  const first = candidates[0];
+  return {
+    command: first ? first.command : null,
+    manager: null,
+    manualUrl: MANUAL_URLS[tool],
+  };
+}
+
+const INSTALL_CANDIDATES = {
+  semgrep: [
+    { manager: "pipx", command: "pipx install semgrep" },
+    { manager: "brew", command: "brew install semgrep" },
+    { manager: "pip", command: "pip install semgrep" },
+  ],
+  "osv-scanner": [
+    { manager: "go", command: "go install github.com/google/osv-scanner@latest" },
+    { manager: "brew", command: "brew install osv-scanner" },
+  ],
+  lighthouse: [
+    { manager: "npm", command: "npm install -g lighthouse" },
+  ],
+  docker: [
+    // Docker Desktop / Engine cannot be installed by a package manager
+    // reliably across platforms — always point users to the official docs.
+    // Listing brew anyway as a hint for macOS users.
+    { manager: "brew", command: "brew install --cask docker" },
+  ],
+};
+
+const MANUAL_URLS = {
+  semgrep: "https://semgrep.dev/docs/getting-started",
+  "osv-scanner": "https://google.github.io/osv-scanner/installation/",
+  lighthouse: "https://github.com/GoogleChrome/lighthouse#using-the-cli",
+  docker: "https://docs.docker.com/get-docker/",
+};
+
+/**
+ * Tools whose hint depends on the project stack. lighthouse is only
+ * relevant for frontend projects; suppressing the hint elsewhere keeps
+ * `kj doctor` output free of irrelevant noise.
+ *
+ * @param {string} tool
+ * @param {Object} stack — shape returned by detectProjectStack()
+ */
+export function appliesToStack(tool, stack) {
+  if (tool === "lighthouse") {
+    if (!stack) return false;
+    return Boolean(stack.isFrontend || stack.isFullstack);
+  }
+  // semgrep, osv-scanner, docker, sonar — always relevant.
+  return true;
+}