kodingo-cli 1.1.7 → 1.1.9

package/dist/commands/init.js

@@ -41,16 +41,13 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerInitCommand = registerInitCommand;
 const readline = __importStar(require("node:readline"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
-const open_1 = __importDefault(require("open"));
+// open is imported dynamically to avoid ESM/CJS compatibility issues on Windows
 const persistence_config_1 = require("../utils/persistence-config");
 const API_BASE = "https://kodingo-api.onrender.com";
 const APP_URL = "https://kodingo.xyz";
@@ -140,7 +137,8 @@ async function browserLogin(rl) {
     });
     // Open browser
     try {
-        await (0, open_1.default)(loginUrl);
+        const { default: open } = await Promise.resolve().then(() => __importStar(require("open")));
+        await open(loginUrl);
     }
     catch { }
     console.log("Waiting for login...");

package/dist/commands/security-scan.js

@@ -130,7 +130,15 @@ async function securityScanCommand(options = {}) {
                 }
             }
             catch { }
-            const candidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols, dynamicRules);
+            const allCandidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols, dynamicRules);
+            // Cap at 30 candidates for LLM judgment — prioritise critical and high severity
+            const SEVERITY_ORDER = { critical: 0, high: 1, moderate: 2, low: 3 };
+            const candidates = allCandidates
+                .sort((a, b) => (SEVERITY_ORDER[a.severity ?? 'low'] ?? 3) - (SEVERITY_ORDER[b.severity ?? 'low'] ?? 3))
+                .slice(0, 30);
+            if (!options.silent && allCandidates.length > 30) {
+                console.log(`  Found ${allCandidates.length} candidates — reviewing top 30 by severity\n`);
+            }
             if (candidates.length === 0) {
                 if (!options.silent)
                     console.log("  ✔ No suspicious patterns detected.");

package/dist/utils/security-code-analyzer.js

@@ -14,10 +14,16 @@
  * server for Layer 2 — an LLM judgment with full visibility, which is what
  * actually adjudicates real risk vs false positive.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findMissingAuthCandidatesLocal = findMissingAuthCandidatesLocal;
 exports.analyzeForSecurityCandidates = analyzeForSecurityCandidates;
 const context_assembler_1 = require("./context-assembler");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const code_pattern_scanner_1 = require("./code-pattern-scanner");
 const ROUTE_REGISTRATION_METHOD_NAMES = new Set(["get", "post", "put", "delete", "patch", "addhook", "all"]);
 const AUTH_FUNCTION_HINTS = [
@@ -80,6 +86,77 @@ function analyzeForSecurityCandidates(repoRoot, graph, symbols, dynamicRules = [
     const candidates = [];
     // ── Code pattern findings — static + dynamic rules ────────────────────────
     const patternFindings = (0, code_pattern_scanner_1.scanAllSymbolsForPatterns)(symbols);
+    // ── Tier 1: Fast file-level scan (no LLM, runs on all files) ─────────────
+    // Catches vulnerabilities in procedural code outside named functions.
+    // Only high-confidence patterns are included — no ambiguous matches.
+    // File selection is smart: recently changed files first, then unscanned,
+    // capped at 100 files per run to stay fast and avoid timeouts.
+    const HIGH_CONFIDENCE_PATTERNS = new Set(["sql_injection", "command_injection", "hardcoded_secret", "path_traversal"]);
+    const SUPPORTED_EXTS = new Set([".php", ".py", ".go", ".rs", ".java", ".kt", ".rb", ".c", ".cpp", ".html", ".phtml", ".js", ".ts", ".jsx", ".tsx"]);
+    const EXT_TO_LANG = {
+        ".php": "php", ".phtml": "php", ".py": "python", ".go": "go", ".rs": "rust",
+        ".java": "java", ".kt": "kotlin", ".rb": "ruby", ".c": "c", ".cpp": "cpp",
+        ".html": "html", ".js": "javascript", ".ts": "typescript", ".jsx": "javascript", ".tsx": "typescript"
+    };
+    const IGNORED_DIRS = new Set(["node_modules", ".git", "dist", "build", "vendor", "__pycache__", ".next", "out", "coverage"]);
+    // Get recently changed files from git (last 30 days) — scan these first
+    let priorityFiles = [];
+    try {
+        const gitOut = (0, child_process_1.execSync)("git log --since=30.days --name-only --pretty=format: --diff-filter=AM", { cwd: repoRoot, timeout: 5000 }).toString();
+        priorityFiles = gitOut.split("\n").filter(f => f.trim() && SUPPORTED_EXTS.has(path_1.default.extname(f)))
+            .map(f => path_1.default.join(repoRoot, f)).filter(f => fs_1.default.existsSync(f)).slice(0, 50);
+    }
+    catch { }
+    // Walk repo for remaining files — skip already-in-priority
+    const prioritySet = new Set(priorityFiles);
+    const allWalked = [];
+    const walk = (dir) => {
+        try {
+            for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+                const full = path_1.default.join(dir, entry.name);
+                if (entry.isDirectory() && !IGNORED_DIRS.has(entry.name))
+                    walk(full);
+                else if (entry.isFile() && SUPPORTED_EXTS.has(path_1.default.extname(entry.name)) && !prioritySet.has(full)) {
+                    allWalked.push(full);
+                }
+            }
+        }
+        catch { }
+    };
+    walk(repoRoot);
+    // Priority files first, then remaining up to cap of 100 total
+    const filesToScan = [...priorityFiles, ...allWalked].slice(0, 100);
+    const alreadyScannedFiles = new Set(symbols.map(s => s.file));
+    for (const filePath of filesToScan) {
+        if (alreadyScannedFiles.has(filePath))
+            continue; // already covered by symbol scan
+        try {
+            const source = fs_1.default.readFileSync(filePath, "utf-8");
+            const ext = path_1.default.extname(filePath);
+            const language = EXT_TO_LANG[ext] ?? "javascript";
+            const syntheticSymbol = {
+                name: path_1.default.basename(filePath),
+                file: filePath,
+                startLine: 1,
+                body: source.slice(0, 10000),
+                fingerprint: `file:${filePath}`,
+                calls: [],
+                routes: [],
+                imports: [],
+                language,
+                type: "function",
+                endLine: source.split("\n").length,
+            };
+            const fileFindings = (0, code_pattern_scanner_1.scanSymbolForPatterns)(syntheticSymbol, language)
+                .filter(f => HIGH_CONFIDENCE_PATTERNS.has(f.patternType)); // Tier 1: high-confidence only
+            for (const f of fileFindings) {
+                patternFindings.push(f);
+            }
+        }
+        catch {
+            continue;
+        }
+    }
     // Apply dynamic rules generated from OSV vulnerability data
     for (const sym of symbols) {
         const language = sym.language ?? "unknown";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.1.7",
+  "version": "1.1.9",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,