lean-claudient-core 0.1.0

package/src/security/secretsDetection.ts

@@ -0,0 +1,318 @@
+/**
+ * Secrets Detection Module
+ * Scans for hardcoded credentials, API keys, tokens, and other sensitive data
+ */
+
+export interface SecretFinding {
+  type: string;
+  severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+  pattern: string;
+  location?: string;
+  context?: string;
+  entropy?: number;
+  suggestion: string;
+}
+
+const PATTERNS = {
+  AWS_KEY: /AKIA[0-9A-Z]{16}/g,
+  GITHUB_PAT: /ghp_[A-Za-z0-9_]{36}/g,
+  ANTHROPIC_KEY: /sk-ant-[A-Za-z0-9_-]{48}/g,
+  OPENAI_KEY: /sk-[A-Za-z0-9]{20,}/g,
+  PRIVATE_KEY_RSA: /-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----/g,
+  PRIVATE_KEY_EC: /-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----/g,
+  PRIVATE_KEY_ED25519: /-----BEGIN PRIVATE KEY-----[\s\S]*?-----END PRIVATE KEY-----/g,
+  JWT_TOKEN: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+  PASSWORD_ASSIGNMENT: /(?:password|passwd|pwd)\s*[:=]\s*['"](.*?)['"]/gi,
+  DATABASE_URL: /(?:mongodb|mysql|postgresql|sqlite):[/\w:@.?#&=+-]*/gi,
+  SLACK_TOKEN: /xox[baprs]-[0-9a-zA-Z]{10,48}/g,
+  SLACK_WEBHOOK: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[A-Za-z0-9]+/g,
+  STRIPE_KEY: /sk_(?:live|test)_[0-9a-zA-Z]{20,}/g,
+  TWILIO_AUTH: /AC[a-zA-Z0-9]{32}/g,
+  SENDGRID_KEY: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
+};
+
+/**
+ * Calculate Shannon entropy of a string
+ * Values > 4.0 indicate potential secrets
+ */
+export function calculateEntropy(text: string): number {
+  if (!text || text.length === 0) return 0;
+
+  const freq: Record<string, number> = {};
+  for (const char of text) {
+    freq[char] = (freq[char] || 0) + 1;
+  }
+
+  let entropy = 0;
+  for (const count of Object.values(freq)) {
+    const p = count / text.length;
+    entropy -= p * Math.log2(p);
+  }
+
+  return entropy;
+}
+
+/**
+ * Detect API keys in text
+ */
+export function detectAPIKey(text: string): SecretFinding[] {
+  const findings: SecretFinding[] = [];
+
+  // AWS
+  for (const match of text.matchAll(PATTERNS.AWS_KEY)) {
+    findings.push({
+      type: 'AWS_ACCESS_KEY',
+      severity: 'CRITICAL',
+      pattern: match[0],
+      suggestion: 'Use AWS IAM roles or temporary credentials instead',
+    });
+  }
+
+  // GitHub
+  for (const match of text.matchAll(PATTERNS.GITHUB_PAT)) {
+    findings.push({
+      type: 'GITHUB_PAT',
+      severity: 'CRITICAL',
+      pattern: match[0],
+      suggestion: 'Use GitHub App or OAuth token with minimal scopes',
+    });
+  }
+
+  // Anthropic
+  for (const match of text.matchAll(PATTERNS.ANTHROPIC_KEY)) {
+    findings.push({
+      type: 'ANTHROPIC_API_KEY',
+      severity: 'CRITICAL',
+      pattern: match[0],
+      suggestion: 'Set ANTHROPIC_API_KEY as environment variable',
+    });
+  }
+
+  // OpenAI
+  for (const match of text.matchAll(PATTERNS.OPENAI_KEY)) {
+    findings.push({
+      type: 'OPENAI_API_KEY',
+      severity: 'CRITICAL',
+      pattern: match[0],
+      suggestion: 'Set OPENAI_API_KEY as environment variable',
+    });
+  }
+
+  // Slack
+  for (const match of text.matchAll(PATTERNS.SLACK_TOKEN)) {
+    findings.push({
+      type: 'SLACK_TOKEN',
+      severity: 'CRITICAL',
+      pattern: match[0],
+      suggestion: 'Use Slack token rotation and store in secrets manager',
+    });
+  }
+
+  // Stripe
+  for (const match of text.matchAll(PATTERNS.STRIPE_KEY)) {
+    findings.push({
+      type: 'STRIPE_API_KEY',
+      severity: 'CRITICAL',
+      pattern: match[0],
+      suggestion: 'Use environment variables for Stripe keys',
+    });
+  }
+
+  // Twilio
+  for (const match of text.matchAll(PATTERNS.TWILIO_AUTH)) {
+    findings.push({
+      type: 'TWILIO_AUTH_TOKEN',
+      severity: 'CRITICAL',
+      pattern: match[0],
+      suggestion: 'Store Twilio credentials in environment variables',
+    });
+  }
+
+  // SendGrid
+  for (const match of text.matchAll(PATTERNS.SENDGRID_KEY)) {
+    findings.push({
+      type: 'SENDGRID_API_KEY',
+      severity: 'CRITICAL',
+      pattern: match[0],
+      suggestion: 'Use environment variable for SendGrid API key',
+    });
+  }
+
+  return findings;
+}
+
+/**
+ * Detect private keys in text
+ */
+export function detectPrivateKey(text: string): SecretFinding[] {
+  const findings: SecretFinding[] = [];
+
+  // RSA
+  for (const match of text.matchAll(PATTERNS.PRIVATE_KEY_RSA)) {
+    findings.push({
+      type: 'RSA_PRIVATE_KEY',
+      severity: 'CRITICAL',
+      pattern: match[0].substring(0, 50) + '...',
+      suggestion: 'Move private key to separate .pem file, add to .gitignore',
+    });
+  }
+
+  // EC
+  for (const match of text.matchAll(PATTERNS.PRIVATE_KEY_EC)) {
+    findings.push({
+      type: 'EC_PRIVATE_KEY',
+      severity: 'CRITICAL',
+      pattern: match[0].substring(0, 50) + '...',
+      suggestion: 'Move private key to separate .pem file, add to .gitignore',
+    });
+  }
+
+  // Ed25519
+  for (const match of text.matchAll(PATTERNS.PRIVATE_KEY_ED25519)) {
+    findings.push({
+      type: 'ED25519_PRIVATE_KEY',
+      severity: 'CRITICAL',
+      pattern: match[0].substring(0, 50) + '...',
+      suggestion: 'Move private key to separate .pem file, add to .gitignore',
+    });
+  }
+
+  return findings;
+}
+
+/**
+ * Detect plaintext passwords in text
+ */
+export function detectPassword(text: string): SecretFinding[] {
+  const findings: SecretFinding[] = [];
+
+  for (const match of text.matchAll(PATTERNS.PASSWORD_ASSIGNMENT)) {
+    const password = match[1];
+    if (password && password.length > 0) {
+      findings.push({
+        type: 'PLAINTEXT_PASSWORD',
+        severity: 'CRITICAL',
+        pattern: password.substring(0, 20) + '...',
+        suggestion: 'Use bcrypt or similar for password hashing, store in environment variables',
+      });
+    }
+  }
+
+  // Database URLs
+  for (const match of text.matchAll(PATTERNS.DATABASE_URL)) {
+    findings.push({
+      type: 'DATABASE_URL',
+      severity: 'HIGH',
+      pattern: match[0].substring(0, 40) + '...',
+      suggestion: 'Store database URLs in environment variables',
+    });
+  }
+
+  return findings;
+}
+
+/**
+ * Detect JWT tokens in text
+ */
+export function detectJWT(text: string): SecretFinding[] {
+  const findings: SecretFinding[] = [];
+
+  for (const match of text.matchAll(PATTERNS.JWT_TOKEN)) {
+    const token = match[0];
+    try {
+      const parts = token.split('.');
+      if (parts.length === 3) {
+        const payload = JSON.parse(
+          Buffer.from(parts[1], 'base64').toString('utf-8')
+        );
+        findings.push({
+          type: 'JWT_TOKEN',
+          severity: 'HIGH',
+          pattern: token.substring(0, 30) + '...',
+          context: JSON.stringify(payload).substring(0, 100),
+          suggestion: 'Use short-lived tokens and refresh tokens, never hardcode',
+        });
+      }
+    } catch {
+      findings.push({
+        type: 'JWT_TOKEN',
+        severity: 'HIGH',
+        pattern: token.substring(0, 30) + '...',
+        suggestion: 'Never hardcode JWT tokens, use session/environment',
+      });
+    }
+  }
+
+  return findings;
+}
+
+/**
+ * Detect high-entropy strings that may be secrets
+ */
+export function detectHighEntropyStrings(text: string, minLength = 20): SecretFinding[] {
+  const findings: SecretFinding[] = [];
+  const lines = text.split('\n');
+
+  for (const line of lines) {
+    const tokens = line.split(/[\s=:"',;]/);
+    for (const token of tokens) {
+      if (token.length >= minLength && /^[a-zA-Z0-9_-]+$/.test(token)) {
+        const entropy = calculateEntropy(token);
+        if (entropy > 4.0) {
+          findings.push({
+            type: 'HIGH_ENTROPY_STRING',
+            severity: 'MEDIUM',
+            pattern: token.substring(0, 30) + '...',
+            entropy,
+            suggestion: 'Review this string - high entropy suggests it may be a secret or token',
+          });
+        }
+      }
+    }
+  }
+
+  return findings;
+}
+
+/**
+ * Main entry point: detect all secrets in text
+ */
+export function detectSecrets(text: string): SecretFinding[] {
+  if (!text || typeof text !== 'string') {
+    return [];
+  }
+
+  const findings: SecretFinding[] = [
+    ...detectPrivateKey(text),
+    ...detectAPIKey(text),
+    ...detectPassword(text),
+    ...detectJWT(text),
+    ...detectHighEntropyStrings(text),
+  ];
+
+  // Deduplicate by pattern
+  const seen = new Set<string>();
+  const unique = findings.filter((f) => {
+    if (seen.has(f.pattern)) return false;
+    seen.add(f.pattern);
+    return true;
+  });
+
+  // Sort by severity
+  const severityOrder = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3 };
+  return unique.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+}
+
+/**
+ * Scan file content for secrets
+ */
+export async function scanFileForSecrets(
+  filePath: string,
+  content: string
+): Promise<SecretFinding[]> {
+  const findings = detectSecrets(content);
+  return findings.map((f) => ({
+    ...f,
+    location: filePath,
+  }));
+}

package/src/subagents/builder.ts

@@ -0,0 +1,277 @@
+import { execSync } from 'child_process';
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { resolve } from 'path';
+
+export interface BuilderResult {
+  success: boolean;
+  filePath: string;
+  linesChanged: number;
+  testsPassed: boolean;
+  tokensUsed: number;
+  duration: number;
+  errors?: string[];
+}
+
+interface TestResult {
+  passed: boolean;
+  output: string;
+}
+
+export class BuilderSubagent {
+  private workingDir: string;
+  private readonly DEFAULT_TIMEOUT = 30 * 60 * 1000;
+  private readonly TOKEN_ESTIMATE_PER_CHAR = 0.25;
+
+  constructor(workingDir: string) {
+    this.workingDir = workingDir;
+  }
+
+  async implementFeature(
+    filePath: string,
+    task: string,
+    timeout: number = this.DEFAULT_TIMEOUT
+  ): Promise<BuilderResult> {
+    const startTime = Date.now();
+    const fullPath = resolve(this.workingDir, filePath);
+    const errors: string[] = [];
+
+    try {
+      if (!existsSync(fullPath)) {
+        throw new Error(`File not found: ${fullPath}`);
+      }
+
+      const originalContent = readFileSync(fullPath, 'utf-8');
+      const originalLineCount = originalContent.split('\n').length;
+
+      const modifiedContent = await this.executeImplementation(
+        originalContent,
+        task,
+        timeout
+      );
+
+      if (!modifiedContent || modifiedContent === originalContent) {
+        errors.push('Implementation produced no changes');
+        return this.buildResult(
+          false,
+          filePath,
+          0,
+          false,
+          0,
+          Date.now() - startTime,
+          errors
+        );
+      }
+
+      writeFileSync(fullPath, modifiedContent, 'utf-8');
+      const modifiedLineCount = modifiedContent.split('\n').length;
+      const linesChanged = Math.abs(modifiedLineCount - originalLineCount) +
+        this.countLineModifications(originalContent, modifiedContent);
+
+      const testResult = await this.runTests(filePath);
+
+      if (!testResult.passed) {
+        writeFileSync(fullPath, originalContent, 'utf-8');
+        errors.push(`Tests failed: ${testResult.output}`);
+      }
+
+      const tokensUsed = Math.ceil(
+        (originalContent.length + modifiedContent.length) *
+          this.TOKEN_ESTIMATE_PER_CHAR
+      );
+
+      return this.buildResult(
+        testResult.passed,
+        filePath,
+        linesChanged,
+        testResult.passed,
+        tokensUsed,
+        Date.now() - startTime,
+        testResult.passed ? undefined : errors
+      );
+    } catch (error) {
+      errors.push((error as Error).message);
+      return this.buildResult(
+        false,
+        filePath,
+        0,
+        false,
+        0,
+        Date.now() - startTime,
+        errors
+      );
+    }
+  }
+
+  async runTests(filePath: string): Promise<TestResult> {
+    try {
+      const testCommand = this.detectTestCommand(filePath);
+
+      if (!testCommand) {
+        return { passed: true, output: 'No tests detected' };
+      }
+
+      const output = execSync(testCommand, {
+        cwd: this.workingDir,
+        encoding: 'utf-8',
+        stdio: 'pipe',
+      });
+
+      const passed =
+        !output.toLowerCase().includes('fail') &&
+        !output.toLowerCase().includes('error');
+
+      return { passed, output };
+    } catch (error) {
+      const output = (error as any)?.stdout || (error as Error).message;
+      return { passed: false, output };
+    }
+  }
+
+  private async executeImplementation(
+    originalContent: string,
+    task: string,
+    timeout: number
+  ): Promise<string> {
+    const startTime = Date.now();
+
+    const isTypeScript = originalContent.includes('interface') ||
+      originalContent.includes('type ') ||
+      originalContent.includes(': string') ||
+      originalContent.includes(': number');
+
+    let modified = originalContent;
+
+    if (task.includes('add') || task.includes('implement')) {
+      const lastClosingBrace = originalContent.lastIndexOf('}');
+      if (lastClosingBrace > 0) {
+        const beforeLastBrace = originalContent.substring(0, lastClosingBrace);
+        const afterLastBrace = originalContent.substring(lastClosingBrace);
+
+        modified = this.injectImplementation(
+          beforeLastBrace,
+          task,
+          isTypeScript
+        );
+        modified += afterLastBrace;
+      }
+    }
+
+    if (Date.now() - startTime > timeout) {
+      throw new Error(`Implementation timeout exceeded: ${timeout}ms`);
+    }
+
+    return modified;
+  }
+
+  private injectImplementation(
+    content: string,
+    task: string,
+    isTypeScript: boolean
+  ): string {
+    const indent = '  ';
+    let implementation = '';
+
+    if (
+      task.toLowerCase().includes('function') ||
+      task.toLowerCase().includes('method')
+    ) {
+      implementation = this.generateFunctionStub(task, isTypeScript, indent);
+    } else if (task.toLowerCase().includes('class')) {
+      implementation = this.generateClassStub(task, isTypeScript, indent);
+    } else if (task.toLowerCase().includes('interface')) {
+      implementation = this.generateInterfaceStub(task, isTypeScript, indent);
+    } else {
+      implementation = this.generateGenericStub(task, indent);
+    }
+
+    return content + '\n' + implementation;
+  }
+
+  private generateFunctionStub(
+    task: string,
+    isTypeScript: boolean,
+    indent: string
+  ): string {
+    const fnName = this.extractName(task, 'function');
+    const returnType = isTypeScript ? ': unknown' : '';
+    return `${indent}${fnName}()${returnType} {\n${indent}${indent}// Implementation: ${task}\n${indent}}`;
+  }
+
+  private generateClassStub(
+    task: string,
+    isTypeScript: boolean,
+    indent: string
+  ): string {
+    const className = this.extractName(task, 'class');
+    return `${indent}class ${className} {\n${indent}${indent}constructor() {}\n${indent}}`;
+  }
+
+  private generateInterfaceStub(
+    task: string,
+    isTypeScript: boolean,
+    indent: string
+  ): string {
+    const interfaceName = this.extractName(task, 'interface');
+    return `${indent}interface ${interfaceName} {\n${indent}${indent}// Fields go here\n${indent}}`;
+  }
+
+  private generateGenericStub(task: string, indent: string): string {
+    return `${indent}// TODO: ${task}`;
+  }
+
+  private extractName(task: string, keyword: string): string {
+    const match = task.match(new RegExp(`${keyword}\\s+([a-zA-Z0-9_]+)`, 'i'));
+    if (match && match[1]) {
+      return match[1];
+    }
+    return `Generated${keyword.charAt(0).toUpperCase()}${keyword.slice(1)}`;
+  }
+
+  private countLineModifications(original: string, modified: string): number {
+    const origLines = original.split('\n');
+    const modLines = modified.split('\n');
+    let diffCount = 0;
+
+    for (let i = 0; i < Math.min(origLines.length, modLines.length); i++) {
+      if (origLines[i] !== modLines[i]) {
+        diffCount++;
+      }
+    }
+
+    return diffCount;
+  }
+
+  private detectTestCommand(filePath: string): string | null {
+    const fileName = filePath.split('/').pop() || '';
+
+    if (fileName.includes('.test.') || fileName.includes('.spec.')) {
+      return 'npm test';
+    }
+
+    if (existsSync(resolve(this.workingDir, 'package.json'))) {
+      return 'npm test';
+    }
+
+    return null;
+  }
+
+  private buildResult(
+    success: boolean,
+    filePath: string,
+    linesChanged: number,
+    testsPassed: boolean,
+    tokensUsed: number,
+    duration: number,
+    errors?: string[]
+  ): BuilderResult {
+    return {
+      success,
+      filePath,
+      linesChanged,
+      testsPassed,
+      tokensUsed,
+      duration,
+      errors,
+    };
+  }
+}