kodingo-cli 1.0.38 → 1.1.1

package/dist/utils/graph-builder.js

@@ -0,0 +1,385 @@
+"use strict";
+/**
+ * graph-builder.ts
+ *
+ * Builds a structural relationship graph (KortexGraph) for a repository.
+ *
+ * Nodes are keyed by fingerprint (stable across renames/moves — same mechanism
+ * used for memory symbols). Edges represent "calls" relationships between symbols.
+ *
+ * Resolution has two tiers:
+ *  - Tier 1 (TypeScript/JavaScript): uses the TypeScript compiler's type checker
+ *    to resolve call expressions to their actual declaration, giving near-100%
+ *    accurate edges. Confidence = 1.0.
+ *  - Tier 2 (all other languages): heuristic name-based matching against the
+ *    repo-wide symbol table. Confidence is scored by name uniqueness.
+ *
+ * This module performs zero LLM calls. Pure static analysis.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGraph = buildGraph;
+exports.diffGraphs = diffGraphs;
+exports.saveGraph = saveGraph;
+exports.loadGraph = loadGraph;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const ts = __importStar(require("typescript"));
+const ast_parser_1 = require("./ast-parser");
+const SUPPORTED_EXTENSIONS = [
+    ".ts", ".tsx", ".js", ".jsx",
+    ".py", ".go", ".rs", ".php",
+    ".java", ".kt", ".rb", ".c", ".cpp",
+];
+const TS_JS_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx"]);
+const IGNORED_DIRS = [
+    "node_modules", ".git", ".kortex", "dist", "build",
+    "out", ".next", "coverage", "__pycache__", "vendor",
+];
+function walkFiles(dir) {
+    const results = [];
+    try {
+        const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (IGNORED_DIRS.includes(entry.name))
+                continue;
+            const fullPath = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                results.push(...walkFiles(fullPath));
+            }
+            else if (entry.isFile() && SUPPORTED_EXTENSIONS.includes(path_1.default.extname(entry.name))) {
+                results.push(fullPath);
+            }
+        }
+    }
+    catch { }
+    return results;
+}
+function languageForFile(file) {
+    const ext = path_1.default.extname(file).toLowerCase();
+    const map = {
+        ".ts": "typescript", ".tsx": "typescript",
+        ".js": "javascript", ".jsx": "javascript",
+        ".py": "python", ".go": "go", ".rs": "rust",
+        ".php": "php", ".java": "java", ".kt": "kotlin",
+        ".rb": "ruby", ".c": "c", ".cpp": "cpp",
+    };
+    return map[ext] ?? "unknown";
+}
+async function collectAllSymbols(repoRoot) {
+    const files = walkFiles(repoRoot);
+    const all = [];
+    for (const file of files) {
+        try {
+            const source = fs_1.default.readFileSync(file, "utf-8");
+            const nodes = await (0, ast_parser_1.parseFile)(file, source);
+            for (const n of nodes) {
+                all.push({ ...n, language: languageForFile(file) });
+            }
+        }
+        catch { }
+    }
+    return all;
+}
+function buildNameIndex(symbols) {
+    const index = new Map();
+    for (const sym of symbols) {
+        const shortName = sym.name.includes(".") ? sym.name.split(".").pop() : sym.name;
+        const existing = index.get(shortName) ?? [];
+        existing.push(sym.fingerprint);
+        index.set(shortName, existing);
+    }
+    return index;
+}
+function resolveTier2Edges(symbols, nameIndex) {
+    const edges = [];
+    for (const sym of symbols) {
+        if (TS_JS_EXTENSIONS.has(path_1.default.extname(sym.file)))
+            continue;
+        for (const calledName of sym.calls) {
+            const candidates = nameIndex.get(calledName);
+            if (!candidates || candidates.length === 0)
+                continue;
+            const uniqueCandidates = Array.from(new Set(candidates));
+            const confidence = uniqueCandidates.length === 1 ? 0.8 : Math.max(0.2, 0.6 / uniqueCandidates.length);
+            for (const targetFingerprint of uniqueCandidates) {
+                if (targetFingerprint === sym.fingerprint)
+                    continue;
+                edges.push({
+                    from: sym.fingerprint,
+                    to: targetFingerprint,
+                    type: "calls",
+                    confidence,
+                    file: sym.file,
+                    line: sym.startLine,
+                });
+            }
+        }
+    }
+    return edges;
+}
+function resolveTier1Edges(repoRoot, tsFiles, symbols) {
+    if (tsFiles.length === 0)
+        return [];
+    const edges = [];
+    const symbolsByFile = new Map();
+    for (const sym of symbols) {
+        if (!TS_JS_EXTENSIONS.has(path_1.default.extname(sym.file)))
+            continue;
+        const list = symbolsByFile.get(sym.file) ?? [];
+        list.push(sym);
+        symbolsByFile.set(sym.file, list);
+    }
+    function findEnclosingSymbol(file, line) {
+        const candidates = symbolsByFile.get(file);
+        if (!candidates)
+            return null;
+        let best = null;
+        for (const c of candidates) {
+            if (line >= c.startLine && line <= c.endLine) {
+                if (!best || (c.endLine - c.startLine) < (best.endLine - best.startLine)) {
+                    best = c;
+                }
+            }
+        }
+        return best;
+    }
+    let tsconfigPath;
+    try {
+        tsconfigPath = ts.findConfigFile(repoRoot, ts.sys.fileExists, "tsconfig.json") ?? undefined;
+    }
+    catch {
+        tsconfigPath = undefined;
+    }
+    let compilerOptions = {
+        allowJs: true,
+        jsx: ts.JsxEmit.Preserve,
+        module: ts.ModuleKind.CommonJS,
+        target: ts.ScriptTarget.ES2020,
+        noEmit: true,
+    };
+    if (tsconfigPath) {
+        try {
+            const configFile = ts.readConfigFile(tsconfigPath, ts.sys.readFile);
+            const parsed = ts.parseJsonConfigFileContent(configFile.config, ts.sys, path_1.default.dirname(tsconfigPath));
+            compilerOptions = { ...compilerOptions, ...parsed.options, noEmit: true };
+        }
+        catch { }
+    }
+    let program;
+    try {
+        program = ts.createProgram(tsFiles, compilerOptions);
+    }
+    catch {
+        return [];
+    }
+    const checker = program.getTypeChecker();
+    for (const sourceFile of program.getSourceFiles()) {
+        if (sourceFile.isDeclarationFile)
+            continue;
+        if (!tsFiles.includes(sourceFile.fileName))
+            continue;
+        function recordEdge(identifierNode, edgeType) {
+            try {
+                let symbol = checker.getSymbolAtLocation(identifierNode);
+                // Resolve import aliases to the real declaration — otherwise imported
+                // symbols point at the import statement itself, not the function body.
+                if (symbol && (symbol.flags & ts.SymbolFlags.Alias) !== 0) {
+                    symbol = checker.getAliasedSymbol(symbol);
+                }
+                const declarations = symbol?.getDeclarations();
+                if (!declarations || declarations.length === 0)
+                    return;
+                const decl = declarations[0];
+                const declFile = decl.getSourceFile().fileName;
+                const declLine = decl.getSourceFile().getLineAndCharacterOfPosition(decl.getStart()).line + 1;
+                const targetSymbol = findEnclosingSymbol(declFile, declLine);
+                const refLine = sourceFile.getLineAndCharacterOfPosition(identifierNode.getStart()).line + 1;
+                const callerSymbol = findEnclosingSymbol(sourceFile.fileName, refLine);
+                if (targetSymbol && callerSymbol && targetSymbol.fingerprint !== callerSymbol.fingerprint) {
+                    edges.push({
+                        from: callerSymbol.fingerprint,
+                        to: targetSymbol.fingerprint,
+                        type: edgeType,
+                        confidence: edgeType === "calls" ? 1.0 : 0.9,
+                        file: sourceFile.fileName,
+                        line: refLine,
+                    });
+                }
+            }
+            catch { }
+        }
+        function visit(node) {
+            if (ts.isCallExpression(node)) {
+                // The call target itself — e.g. authMiddleware() — direct invocation
+                recordEdge(node.expression, "calls");
+                // Arguments passed to this call that resolve to known function symbols —
+                // e.g. app.addHook("preHandler", authMiddleware) — registration/callback pattern.
+                // This is where middleware, event handlers, and hooks get missed if we only
+                // look at direct calls.
+                for (const arg of node.arguments) {
+                    if (ts.isIdentifier(arg)) {
+                        recordEdge(arg, "references");
+                    }
+                }
+            }
+            // Also catch bare identifier references outside call arguments —
+            // e.g. `export const handler = someFunction;` or object literal values
+            // like `{ preHandler: authMiddleware }`.
+            if (ts.isIdentifier(node) &&
+                !ts.isCallExpression(node.parent) &&
+                node.parent &&
+                (ts.isPropertyAssignment(node.parent) || ts.isVariableDeclaration(node.parent) || ts.isBinaryExpression(node.parent))) {
+                recordEdge(node, "references");
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+    }
+    return edges;
+}
+function computeCentrality(nodes, edges) {
+    for (const edge of edges) {
+        if (nodes[edge.to])
+            nodes[edge.to].fanIn += edge.confidence;
+        if (nodes[edge.from])
+            nodes[edge.from].fanOut += edge.confidence;
+    }
+    for (const node of Object.values(nodes)) {
+        node.centrality = node.fanIn * 2 + node.fanOut;
+    }
+}
+async function buildGraph(repoRoot) {
+    const symbols = await collectAllSymbols(repoRoot);
+    const nodes = {};
+    for (const sym of symbols) {
+        const isTsJs = TS_JS_EXTENSIONS.has(path_1.default.extname(sym.file));
+        nodes[sym.fingerprint] = {
+            fingerprint: sym.fingerprint,
+            name: sym.name,
+            file: sym.file,
+            type: sym.type,
+            startLine: sym.startLine,
+            endLine: sym.endLine,
+            language: sym.language,
+            resolutionTier: isTsJs ? 1 : 2,
+            fanIn: 0,
+            fanOut: 0,
+            centrality: 0,
+            rawCalls: sym.calls ?? [],
+        };
+    }
+    const tsFiles = symbols
+        .map(s => s.file)
+        .filter(f => TS_JS_EXTENSIONS.has(path_1.default.extname(f)))
+        .filter((f, i, arr) => arr.indexOf(f) === i);
+    const tier1Edges = resolveTier1Edges(repoRoot, tsFiles, symbols);
+    const nameIndex = buildNameIndex(symbols);
+    const tier2Edges = resolveTier2Edges(symbols, nameIndex);
+    const edges = [...tier1Edges, ...tier2Edges];
+    computeCentrality(nodes, edges);
+    return {
+        builtAt: new Date().toISOString(),
+        repoRoot,
+        nodes,
+        edges,
+    };
+}
+function edgeKey(e) {
+    return `${e.from}::${e.to}::${e.type}`;
+}
+/**
+ * Diffs the freshly built graph against the previously saved one.
+ * Nodes are compared by fingerprint. Edges are compared by (from, to, type) —
+ * this prevents re-inserting the same edge on every sync while still allowing
+ * confidence values to be refreshed via the "added" path (upsert semantics).
+ */
+function diffGraphs(previous, current) {
+    const prevNodeKeys = new Set(previous ? Object.keys(previous.nodes) : []);
+    const currNodeKeys = new Set(Object.keys(current.nodes));
+    const added = [];
+    for (const key of currNodeKeys) {
+        // Always include changed nodes — cheap to upsert, and centrality/fanIn/fanOut
+        // change frequently even when the symbol itself hasn't moved.
+        added.push(current.nodes[key]);
+    }
+    const removed = [];
+    for (const key of prevNodeKeys) {
+        if (!currNodeKeys.has(key))
+            removed.push(key);
+    }
+    const prevEdgeMap = new Map();
+    for (const e of previous?.edges ?? []) {
+        prevEdgeMap.set(edgeKey(e), e);
+    }
+    const currEdgeMap = new Map();
+    for (const e of current.edges) {
+        currEdgeMap.set(edgeKey(e), e);
+    }
+    const edgesAdded = [];
+    for (const [key, edge] of currEdgeMap) {
+        if (!prevEdgeMap.has(key))
+            edgesAdded.push(edge);
+    }
+    const edgesRemoved = [];
+    for (const [key, edge] of prevEdgeMap) {
+        if (!currEdgeMap.has(key)) {
+            edgesRemoved.push({ from: edge.from, to: edge.to, type: edge.type });
+        }
+    }
+    return { added, removed, edgesAdded, edgesRemoved };
+}
+function saveGraph(repoRoot, graph) {
+    const kortexDir = path_1.default.join(repoRoot, ".kortex");
+    if (!fs_1.default.existsSync(kortexDir)) {
+        fs_1.default.mkdirSync(kortexDir, { recursive: true });
+    }
+    const graphPath = path_1.default.join(kortexDir, "graph.json");
+    fs_1.default.writeFileSync(graphPath, JSON.stringify(graph, null, 2), "utf-8");
+}
+function loadGraph(repoRoot) {
+    const graphPath = path_1.default.join(repoRoot, ".kortex", "graph.json");
+    if (!fs_1.default.existsSync(graphPath))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(graphPath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}

package/dist/utils/security-code-analyzer.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * security-code-analyzer.ts
+ *
+ * Layer 1 orchestrator — runs entirely client-side, where the actual source
+ * code and the fully-resolved local graph both exist. Combines:
+ *  - Deterministic code pattern scanning (SQL injection, hardcoded secrets, etc)
+ *  - Missing-auth-on-route detection, using the RESOLVED local graph (more
+ *    precise than the raw_calls fallback, since resolved edges already
+ *    correctly handle object-literal patterns like { preHandler: authMiddleware })
+ *
+ * For every flagged candidate, assembles full code context (target body +
+ * 1-hop callers/callees) via context-assembler.ts, ready to send to the
+ * server for Layer 2 — an LLM judgment with full visibility, which is what
+ * actually adjudicates real risk vs false positive.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findMissingAuthCandidatesLocal = findMissingAuthCandidatesLocal;
+exports.analyzeForSecurityCandidates = analyzeForSecurityCandidates;
+const context_assembler_1 = require("./context-assembler");
+const code_pattern_scanner_1 = require("./code-pattern-scanner");
+const ROUTE_REGISTRATION_METHOD_NAMES = new Set(["get", "post", "put", "delete", "patch", "addhook", "all"]);
+const AUTH_FUNCTION_HINTS = [
+    "auth", "requireauth", "requireorg", "requireadmin", "requirelogin",
+    "verifytoken", "checkauth", "isauthenticated", "authenticate", "authorize",
+    "ensureauth", "authmiddleware", "authguard", "protect", "jwt",
+];
+const PUBLIC_ENDPOINT_HINTS = ["health", "login", "signup", "register", "public", "webhook", "ping", "status"];
+function includesRouteRegistration(names) {
+    return names.some(name => ROUTE_REGISTRATION_METHOD_NAMES.has(name.toLowerCase()));
+}
+function includesAuthHint(names) {
+    return names.some(name => {
+        const lower = name.toLowerCase();
+        return AUTH_FUNCTION_HINTS.some(hint => lower.includes(hint));
+    });
+}
+function looksLikePublicEndpoint(symbolName, file) {
+    const lower = (symbolName + " " + file).toLowerCase();
+    return PUBLIC_ENDPOINT_HINTS.some(hint => lower.includes(hint));
+}
+/**
+ * Finds route-registering functions with no resolved auth reference.
+ * Uses BOTH the resolved local graph edges (most precise — handles object-
+ * literal patterns) AND the raw call/reference list (catches library calls
+ * that never resolve as edges, like app.get itself).
+ */
+function findMissingAuthCandidatesLocal(graph, symbolsByFingerprint) {
+    const candidates = [];
+    for (const node of Object.values(graph.nodes)) {
+        if (node.type !== "function" && node.type !== "method")
+            continue;
+        const sym = symbolsByFingerprint.get(node.fingerprint);
+        const rawCallNames = sym?.calls ?? [];
+        // Names reachable via resolved graph edges (calls + references) — this
+        // correctly includes object-literal-nested identifiers like
+        // { preHandler: authMiddleware }, which raw call extraction alone misses.
+        const resolvedEdgeNames = graph.edges
+            .filter(e => e.from === node.fingerprint)
+            .map(e => graph.nodes[e.to]?.name)
+            .filter((n) => !!n);
+        const allNames = [...rawCallNames, ...resolvedEdgeNames];
+        if (!includesRouteRegistration(allNames))
+            continue;
+        if (includesAuthHint(allNames))
+            continue;
+        if (looksLikePublicEndpoint(node.name, node.file))
+            continue;
+        candidates.push({ symbol: node.name, file: node.file, fingerprint: node.fingerprint });
+    }
+    return candidates;
+}
+/**
+ * Runs both Layer 1 detectors and assembles full code context for every
+ * flagged candidate — ready to send to the server for Layer 2 LLM judgment.
+ */
+function analyzeForSecurityCandidates(repoRoot, graph, symbols) {
+    const symbolsByFingerprint = new Map(symbols.map(s => [s.fingerprint, s]));
+    const candidates = [];
+    // ── Code pattern findings ────────────────────────────────────────────────
+    const patternFindings = (0, code_pattern_scanner_1.scanAllSymbolsForPatterns)(symbols);
+    for (const finding of patternFindings) {
+        const sym = symbols.find(s => s.name === finding.symbol && s.file === finding.file);
+        const fingerprint = sym?.fingerprint ?? "";
+        const assembled = fingerprint ? (0, context_assembler_1.assembleContext)(repoRoot, graph, fingerprint) : null;
+        candidates.push({
+            kind: "code_pattern",
+            symbol: finding.symbol,
+            file: finding.file,
+            fingerprint,
+            patternType: finding.patternType,
+            severity: finding.severity,
+            snippet: finding.snippet,
+            description: finding.description,
+            context: assembled ? {
+                targetBody: assembled.targetBody,
+                callers: assembled.callers.map(c => ({ name: c.name, snippet: c.snippet })),
+                callees: assembled.callees.map(c => ({ name: c.name, snippet: c.snippet })),
+            } : null,
+        });
+    }
+    // ── Missing-auth candidates ───────────────────────────────────────────────
+    const authCandidates = findMissingAuthCandidatesLocal(graph, symbolsByFingerprint);
+    for (const cand of authCandidates) {
+        const assembled = (0, context_assembler_1.assembleContext)(repoRoot, graph, cand.fingerprint);
+        candidates.push({
+            kind: "missing_auth",
+            symbol: cand.symbol,
+            file: cand.file,
+            fingerprint: cand.fingerprint,
+            context: assembled ? {
+                targetBody: assembled.targetBody,
+                callers: assembled.callers.map(c => ({ name: c.name, snippet: c.snippet })),
+                callees: assembled.callees.map(c => ({ name: c.name, snippet: c.snippet })),
+            } : null,
+        });
+    }
+    return candidates;
+}