kodingo-cli 1.1.8 → 1.1.10

package/dist/commands/scan-repo.js

@@ -66,6 +66,9 @@ const SUPPORTED_EXTENSIONS = [
 const IGNORED_DIRS = [
     "node_modules", ".git", ".kortex", "dist", "build",
     "out", ".next", "coverage", "__pycache__", "vendor",
+    ".venv", "venv", "env", ".env", "site-packages",
+    "virtualenv", ".tox", "eggs", ".eggs", "wheels",
+    "target", ".gradle", ".idea", ".vscode", "bin", "obj",
 ];
 const MAX_SYMBOLS = 200;
 const BATCH_SIZE = 5;

package/dist/commands/security-scan.js

@@ -18,7 +18,7 @@ const graph_builder_1 = require("../utils/graph-builder");
 const security_code_analyzer_1 = require("../utils/security-code-analyzer");
 const context_assembler_1 = require("../utils/context-assembler");
 const ast_parser_1 = require("../utils/ast-parser");
-const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next"]);
+const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
 const SUPPORTED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs", ".php", ".java", ".kt", ".rb", ".c", ".cpp", ".html", ".phtml", ".twig", ".blade.php"];
 function walkFiles(dir) {
     const results = [];
@@ -130,7 +130,37 @@ async function securityScanCommand(options = {}) {
                 }
             }
             catch { }
-            const candidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols, dynamicRules);
+            const allCandidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols, dynamicRules);
+            // Fetch already-confirmed open findings so we don't re-scan them —
+            // they stay visible in the dashboard as open until fixed, but we use
+            // our 30-candidate budget on NEW issues each week.
+            let confirmedFingerprints = new Set();
+            try {
+                const existingRes = await fetch(`${apiUrl}/security/findings?repo=${encodeURIComponent(repoName)}`, {
+                    headers: { "X-Kodingo-Token": token },
+                });
+                if (existingRes.ok) {
+                    const { findings: existingFindings } = await existingRes.json();
+                    existingFindings.forEach((f) => {
+                        confirmedFingerprints.add(`${f.finding_type}:${f.endpoint ?? f.symbol ?? ""}:${f.vulnerability_id ?? ""}`);
+                    });
+                }
+            }
+            catch { }
+            // Filter out already-confirmed findings, then sort by severity and cap at 30
+            const SEVERITY_ORDER = { critical: 0, high: 1, moderate: 2, low: 3 };
+            const newCandidates = allCandidates.filter(c => {
+                const fp = `${c.patternType}:${c.symbol ?? c.file}:${c.file}`;
+                return !confirmedFingerprints.has(fp);
+            });
+            const candidates = newCandidates
+                .sort((a, b) => (SEVERITY_ORDER[a.severity ?? 'low'] ?? 3) - (SEVERITY_ORDER[b.severity ?? 'low'] ?? 3))
+                .slice(0, 30);
+            if (!options.silent) {
+                if (allCandidates.length > 0) {
+                    console.log(`  Found ${allCandidates.length} candidates (${allCandidates.length - newCandidates.length} already tracked as open) — reviewing ${Math.min(candidates.length, 30)} new ones\n`);
+                }
+            }
             if (candidates.length === 0) {
                 if (!options.silent)
                     console.log("  ✔ No suspicious patterns detected.");

package/dist/utils/dependency-parser.js

@@ -154,7 +154,7 @@ function parseComposerLock(repoRoot, filePath) {
     }
     return entries;
 }
-const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next"]);
+const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
 function findManifestFiles(repoRoot) {
     const result = { packageJson: [], packageLock: [], composerJson: [], composerLock: [] };
     function walk(dir) {

package/dist/utils/graph-builder.js

@@ -70,6 +70,8 @@ const TS_JS_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx"]);
 const IGNORED_DIRS = [
     "node_modules", ".git", ".kortex", "dist", "build",
     "out", ".next", "coverage", "__pycache__", "vendor",
+    ".venv", "venv", "env", "site-packages", "virtualenv",
+    ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj",
 ];
 function walkFiles(dir) {
     const results = [];

package/dist/utils/security-code-analyzer.js

@@ -14,10 +14,16 @@
  * server for Layer 2 — an LLM judgment with full visibility, which is what
  * actually adjudicates real risk vs false positive.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findMissingAuthCandidatesLocal = findMissingAuthCandidatesLocal;
 exports.analyzeForSecurityCandidates = analyzeForSecurityCandidates;
 const context_assembler_1 = require("./context-assembler");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const code_pattern_scanner_1 = require("./code-pattern-scanner");
 const ROUTE_REGISTRATION_METHOD_NAMES = new Set(["get", "post", "put", "delete", "patch", "addhook", "all"]);
 const AUTH_FUNCTION_HINTS = [
@@ -80,6 +86,77 @@ function analyzeForSecurityCandidates(repoRoot, graph, symbols, dynamicRules = [
     const candidates = [];
     // ── Code pattern findings — static + dynamic rules ────────────────────────
     const patternFindings = (0, code_pattern_scanner_1.scanAllSymbolsForPatterns)(symbols);
+    // ── Tier 1: Fast file-level scan (no LLM, runs on all files) ─────────────
+    // Catches vulnerabilities in procedural code outside named functions.
+    // Only high-confidence patterns are included — no ambiguous matches.
+    // File selection is smart: recently changed files first, then unscanned,
+    // capped at 100 files per run to stay fast and avoid timeouts.
+    const HIGH_CONFIDENCE_PATTERNS = new Set(["sql_injection", "command_injection", "hardcoded_secret", "path_traversal"]);
+    const SUPPORTED_EXTS = new Set([".php", ".py", ".go", ".rs", ".java", ".kt", ".rb", ".c", ".cpp", ".html", ".phtml", ".js", ".ts", ".jsx", ".tsx"]);
+    const EXT_TO_LANG = {
+        ".php": "php", ".phtml": "php", ".py": "python", ".go": "go", ".rs": "rust",
+        ".java": "java", ".kt": "kotlin", ".rb": "ruby", ".c": "c", ".cpp": "cpp",
+        ".html": "html", ".js": "javascript", ".ts": "typescript", ".jsx": "javascript", ".tsx": "typescript"
+    };
+    const IGNORED_DIRS = new Set(["node_modules", ".git", "dist", "build", "vendor", "__pycache__", ".next", "out", "coverage", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
+    // Get recently changed files from git (last 30 days) — scan these first
+    let priorityFiles = [];
+    try {
+        const gitOut = (0, child_process_1.execSync)("git log --since=30.days --name-only --pretty=format: --diff-filter=AM", { cwd: repoRoot, timeout: 5000 }).toString();
+        priorityFiles = gitOut.split("\n").filter(f => f.trim() && SUPPORTED_EXTS.has(path_1.default.extname(f)))
+            .map(f => path_1.default.join(repoRoot, f)).filter(f => fs_1.default.existsSync(f)).slice(0, 50);
+    }
+    catch { }
+    // Walk repo for remaining files — skip already-in-priority
+    const prioritySet = new Set(priorityFiles);
+    const allWalked = [];
+    const walk = (dir) => {
+        try {
+            for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+                const full = path_1.default.join(dir, entry.name);
+                if (entry.isDirectory() && !IGNORED_DIRS.has(entry.name))
+                    walk(full);
+                else if (entry.isFile() && SUPPORTED_EXTS.has(path_1.default.extname(entry.name)) && !prioritySet.has(full)) {
+                    allWalked.push(full);
+                }
+            }
+        }
+        catch { }
+    };
+    walk(repoRoot);
+    // Priority files first, then remaining up to cap of 100 total
+    const filesToScan = [...priorityFiles, ...allWalked].slice(0, 100);
+    const alreadyScannedFiles = new Set(symbols.map(s => s.file));
+    for (const filePath of filesToScan) {
+        if (alreadyScannedFiles.has(filePath))
+            continue; // already covered by symbol scan
+        try {
+            const source = fs_1.default.readFileSync(filePath, "utf-8");
+            const ext = path_1.default.extname(filePath);
+            const language = EXT_TO_LANG[ext] ?? "javascript";
+            const syntheticSymbol = {
+                name: path_1.default.basename(filePath),
+                file: filePath,
+                startLine: 1,
+                body: source.slice(0, 10000),
+                fingerprint: `file:${filePath}`,
+                calls: [],
+                routes: [],
+                imports: [],
+                language,
+                type: "function",
+                endLine: source.split("\n").length,
+            };
+            const fileFindings = (0, code_pattern_scanner_1.scanSymbolForPatterns)(syntheticSymbol, language)
+                .filter(f => HIGH_CONFIDENCE_PATTERNS.has(f.patternType)); // Tier 1: high-confidence only
+            for (const f of fileFindings) {
+                patternFindings.push(f);
+            }
+        }
+        catch {
+            continue;
+        }
+    }
     // Apply dynamic rules generated from OSV vulnerability data
     for (const sym of symbols) {
         const language = sym.language ?? "unknown";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.1.8",
+  "version": "1.1.10",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,