lean-claudient-core 0.1.0

package/src/subagents/investigator.ts

@@ -0,0 +1,224 @@
+import { readFileSync, readdirSync, statSync } from 'fs';
+import { resolve, join, relative, extname } from 'path';
+
+export interface GrepResult {
+  matches: Array<{
+    file: string;
+    line: number;
+    content: string;
+  }>;
+  truncated: boolean;
+  totalMatches: number;
+}
+
+export interface InvestigatorResult {
+  fileLinesMapping: Array<{
+    file: string;
+    lines: number[];
+    context: string;
+  }>;
+  dependencies: string[];
+  tokensUsed: number;
+}
+
+interface FileMapping {
+  file: string;
+  lines: number[];
+  context: string;
+}
+
+export class InvestigatorSubagent {
+  private workingDir: string;
+  private tokenEstimate = 0;
+
+  constructor(workingDir: string) {
+    this.workingDir = workingDir;
+  }
+
+  async mapCodebase(query: string): Promise<InvestigatorResult> {
+    this.tokenEstimate = 0;
+    const fileMappings: FileMapping[] = [];
+    const dependencies = new Set<string>();
+
+    const tsFiles = this.findTypeScriptFiles(this.workingDir);
+    this.tokenEstimate += tsFiles.length * 50;
+
+    for (const file of tsFiles) {
+      try {
+        const content = readFileSync(file, 'utf-8');
+        const relPath = relative(this.workingDir, file);
+        const lines = content.split('\n');
+
+        const matchingLines = this.findMatchingLines(lines, query);
+        this.tokenEstimate += lines.length * 0.25;
+
+        if (matchingLines.length > 0) {
+          const context = this.extractContext(lines, matchingLines[0]);
+          fileMappings.push({
+            file: relPath,
+            lines: matchingLines,
+            context,
+          });
+
+          const fileDeps = this.extractDependencies(content);
+          fileDeps.forEach((dep) => dependencies.add(dep));
+        }
+      } catch {
+        continue;
+      }
+    }
+
+    return {
+      fileLinesMapping: fileMappings,
+      dependencies: Array.from(dependencies),
+      tokensUsed: Math.ceil(this.tokenEstimate),
+    };
+  }
+
+  async findDependencies(filePath: string): Promise<string[]> {
+    try {
+      const content = readFileSync(filePath, 'utf-8');
+      this.tokenEstimate += content.split('\n').length * 0.25;
+      return this.extractDependencies(content);
+    } catch {
+      return [];
+    }
+  }
+
+  async grepWithBudget(
+    pattern: string,
+    maxLines: number = 120
+  ): Promise<GrepResult> {
+    const matches: Array<{ file: string; line: number; content: string }> = [];
+    let totalMatches = 0;
+    const regex = new RegExp(pattern, 'gi');
+
+    const tsFiles = this.findTypeScriptFiles(this.workingDir);
+
+    for (const file of tsFiles) {
+      if (matches.length >= maxLines) {
+        break;
+      }
+
+      try {
+        const content = readFileSync(file, 'utf-8');
+        const relPath = relative(this.workingDir, file);
+        const lines = content.split('\n');
+
+        lines.forEach((line, index) => {
+          if (regex.test(line)) {
+            totalMatches += 1;
+            if (matches.length < maxLines) {
+              matches.push({
+                file: relPath,
+                line: index + 1,
+                content: line.trimStart(),
+              });
+            }
+          }
+        });
+
+        this.tokenEstimate += lines.length * 0.1;
+      } catch {
+        continue;
+      }
+    }
+
+    return {
+      matches,
+      truncated: matches.length >= maxLines,
+      totalMatches,
+    };
+  }
+
+  private findTypeScriptFiles(dir: string): string[] {
+    const files: string[] = [];
+    const ignore = new Set(['node_modules', '.git', 'dist', '.vscode']);
+
+    const walk = (current: string) => {
+      try {
+        const entries = readdirSync(current, { withFileTypes: true });
+
+        for (const entry of entries) {
+          if (ignore.has(entry.name)) continue;
+
+          const path = join(current, entry.name);
+
+          if (entry.isDirectory()) {
+            walk(path);
+          } else if (
+            extname(entry.name) === '.ts' &&
+            !entry.name.endsWith('.test.ts')
+          ) {
+            files.push(path);
+          }
+        }
+      } catch {
+        return;
+      }
+    };
+
+    walk(dir);
+    return files;
+  }
+
+  private findMatchingLines(lines: string[], query: string): number[] {
+    const matching: number[] = [];
+    const regex = new RegExp(query, 'i');
+
+    lines.forEach((line, index) => {
+      if (regex.test(line) && matching.length < 5) {
+        matching.push(index);
+      }
+    });
+
+    return matching;
+  }
+
+  private extractContext(lines: string[], lineIndex: number): string {
+    const start = Math.max(0, lineIndex - 2);
+    const end = Math.min(lines.length, lineIndex + 3);
+    return lines.slice(start, end).join('\n');
+  }
+
+  private extractDependencies(content: string): string[] {
+    const deps = new Set<string>();
+    const importRegex =
+      /(?:import|from)\s+(?:'|")([^'"]+)(?:'|")/g;
+
+    let match;
+    while ((match = importRegex.exec(content)) !== null) {
+      const dep = match[1];
+      if (!dep.startsWith('.')) {
+        deps.add(dep.split('/')[0]);
+      }
+    }
+
+    return Array.from(deps);
+  }
+}
+
+if (require.main === module) {
+  const workingDir = process.cwd();
+  const agent = new InvestigatorSubagent(workingDir);
+
+  process.on('message', async (message: unknown) => {
+    const msg = message as Record<string, unknown>;
+
+    if (msg.type === 'mapCodebase') {
+      try {
+        const result = await agent.mapCodebase(msg.query as string);
+        process.send?.({
+          type: 'result',
+          payload: result,
+          tokensUsed: result.tokensUsed,
+        });
+      } catch (error) {
+        process.send?.({
+          type: 'error',
+          payload: (error as Error).message,
+        });
+      }
+    }
+  });
+}

package/src/subagents/orchestrator.ts

@@ -0,0 +1,212 @@
+import { fork, ChildProcess } from 'child_process';
+import { resolve } from 'path';
+
+export interface SubagentMetrics {
+  investigatorCalls: number;
+  investigatorTokens: number;
+  builderCalls: number;
+  builderTokens: number;
+  reviewerCalls: number;
+  reviewerTokens: number;
+  totalTokens: number;
+}
+
+export interface InvestigatorResult {
+  fileLinesMapping: Array<{
+    file: string;
+    lines: number[];
+    context: string;
+  }>;
+  dependencies: string[];
+  tokensUsed: number;
+}
+
+export interface BuilderResult {
+  success: boolean;
+  filesEdited: string[];
+  testsPassed: boolean;
+  tokensUsed: number;
+  duration: number;
+}
+
+export interface ReviewerResult {
+  findings: Array<{
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    file: string;
+    line: number;
+    issue: string;
+  }>;
+  tokensUsed: number;
+}
+
+interface SubagentMessage {
+  type: 'result' | 'error' | 'progress';
+  payload: unknown;
+  tokensUsed?: number;
+}
+
+export class SubagentOrchestrator {
+  private workingDir: string;
+  private metrics: SubagentMetrics = {
+    investigatorCalls: 0,
+    investigatorTokens: 0,
+    builderCalls: 0,
+    builderTokens: 0,
+    reviewerCalls: 0,
+    reviewerTokens: 0,
+    totalTokens: 0,
+  };
+  private workers: Map<string, ChildProcess> = new Map();
+  private workerCounter = 0;
+
+  constructor(workingDir: string) {
+    this.workingDir = workingDir;
+  }
+
+  async spawnInvestigator(query: string): Promise<InvestigatorResult> {
+    return new Promise((resolve, reject) => {
+      const worker = this.forkWorker('investigator.js');
+      const workerId = `investigator_${this.workerCounter++}`;
+
+      const timeout = setTimeout(() => {
+        worker.kill();
+        this.workers.delete(workerId);
+        reject(new Error('Investigator timeout after 30s'));
+      }, 30000);
+
+      worker.on('message', (message: SubagentMessage) => {
+        if (message.type === 'result') {
+          clearTimeout(timeout);
+          const result = message.payload as InvestigatorResult;
+          this.metrics.investigatorCalls += 1;
+          this.metrics.investigatorTokens += result.tokensUsed;
+          this.metrics.totalTokens += result.tokensUsed;
+          worker.kill();
+          this.workers.delete(workerId);
+          resolve(result);
+        } else if (message.type === 'error') {
+          clearTimeout(timeout);
+          worker.kill();
+          this.workers.delete(workerId);
+          reject(new Error(`Investigator error: ${message.payload}`));
+        }
+      });
+
+      worker.on('error', (error) => {
+        clearTimeout(timeout);
+        this.workers.delete(workerId);
+        reject(error);
+      });
+
+      worker.send({ type: 'mapCodebase', query, workingDir: this.workingDir });
+      this.workers.set(workerId, worker);
+    });
+  }
+
+  async spawnBuilder(filePath: string, task: string): Promise<BuilderResult> {
+    return new Promise((resolve, reject) => {
+      const worker = this.forkWorker('builder.js');
+      const workerId = `builder_${this.workerCounter++}`;
+      const startTime = Date.now();
+
+      const timeout = setTimeout(() => {
+        worker.kill();
+        this.workers.delete(workerId);
+        reject(new Error('Builder timeout after 5m'));
+      }, 300000);
+
+      worker.on('message', (message: SubagentMessage) => {
+        if (message.type === 'result') {
+          clearTimeout(timeout);
+          const result = message.payload as BuilderResult;
+          this.metrics.builderCalls += 1;
+          this.metrics.builderTokens += result.tokensUsed;
+          this.metrics.totalTokens += result.tokensUsed;
+          worker.kill();
+          this.workers.delete(workerId);
+          resolve(result);
+        } else if (message.type === 'error') {
+          clearTimeout(timeout);
+          worker.kill();
+          this.workers.delete(workerId);
+          reject(new Error(`Builder error: ${message.payload}`));
+        }
+      });
+
+      worker.on('error', (error) => {
+        clearTimeout(timeout);
+        this.workers.delete(workerId);
+        reject(error);
+      });
+
+      worker.send({
+        type: 'execute',
+        filePath,
+        task,
+        workingDir: this.workingDir,
+      });
+      this.workers.set(workerId, worker);
+    });
+  }
+
+  async spawnReviewer(diffPath: string): Promise<ReviewerResult> {
+    return new Promise((resolve, reject) => {
+      const worker = this.forkWorker('reviewer.js');
+      const workerId = `reviewer_${this.workerCounter++}`;
+
+      const timeout = setTimeout(() => {
+        worker.kill();
+        this.workers.delete(workerId);
+        reject(new Error('Reviewer timeout after 2m'));
+      }, 120000);
+
+      worker.on('message', (message: SubagentMessage) => {
+        if (message.type === 'result') {
+          clearTimeout(timeout);
+          const result = message.payload as ReviewerResult;
+          this.metrics.reviewerCalls += 1;
+          this.metrics.reviewerTokens += result.tokensUsed;
+          this.metrics.totalTokens += result.tokensUsed;
+          worker.kill();
+          this.workers.delete(workerId);
+          resolve(result);
+        } else if (message.type === 'error') {
+          clearTimeout(timeout);
+          worker.kill();
+          this.workers.delete(workerId);
+          reject(new Error(`Reviewer error: ${message.payload}`));
+        }
+      });
+
+      worker.on('error', (error) => {
+        clearTimeout(timeout);
+        this.workers.delete(workerId);
+        reject(error);
+      });
+
+      worker.send({ type: 'review', diffPath, workingDir: this.workingDir });
+      this.workers.set(workerId, worker);
+    });
+  }
+
+  getMetrics(): SubagentMetrics {
+    return { ...this.metrics };
+  }
+
+  private forkWorker(scriptName: string): ChildProcess {
+    const scriptPath = resolve(this.workingDir, 'dist', 'subagents', scriptName);
+    return fork(scriptPath, [], {
+      silent: false,
+      cwd: this.workingDir,
+    });
+  }
+
+  cleanup(): void {
+    this.workers.forEach((worker) => {
+      if (!worker.killed) {
+        worker.kill();
+      }
+    });
+    this.workers.clear();
+  }
+}

package/src/subagents/reviewer.ts

@@ -0,0 +1,215 @@
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+
+export interface OWASPFinding {
+  vulnerability: string;
+  severity: 'critical' | 'high' | 'medium' | 'low';
+  file: string;
+  line: number;
+  evidence: string;
+  remediation: string;
+}
+
+export interface SecretFinding {
+  type: string;
+  severity: 'critical' | 'high';
+  line: number;
+  pattern: string;
+}
+
+export type Finding = OWASPFinding | SecretFinding;
+
+export interface ReviewerResult {
+  findings: Finding[];
+  tokensUsed: number;
+  fileScanned: string;
+}
+
+interface PatternRule {
+  pattern: RegExp;
+  type: string;
+  severity: 'critical' | 'high' | 'medium' | 'low';
+  remediation: string;
+}
+
+export class ReviewerSubagent {
+  private workingDir: string;
+  private readonly TOKEN_ESTIMATE_PER_CHAR = 0.25;
+
+  private readonly OWASP_PATTERNS: Record<string, PatternRule> = {
+    SQL_INJECTION: {
+      pattern: /SELECT\s+.*\s+WHERE\s+(?!.*\$\d+|.*\?|.*%s)/i,
+      type: 'SQL Injection',
+      severity: 'critical',
+      remediation:
+        'Use parameterized queries with placeholders (?) or prepared statements',
+    },
+    SQL_INJECTION_CONCAT: {
+      pattern: /SELECT\s+.*WHERE\s+.*\+\s*(?:string|input|param)/i,
+      type: 'SQL Injection',
+      severity: 'critical',
+      remediation:
+        'Replace string concatenation with parameterized queries',
+    },
+    XSS_INNERHTML: {
+      pattern: /\.innerHTML\s*=\s*(?!DOMPurify|sanitize|escape)/i,
+      type: 'XSS',
+      severity: 'critical',
+      remediation:
+        'Use textContent or sanitize input with DOMPurify before setting innerHTML',
+    },
+    XSS_EVAL: {
+      pattern: /\beval\s*\(/i,
+      type: 'XSS',
+      severity: 'critical',
+      remediation: 'Never use eval(); use JSON.parse() for JSON or Function() with caution',
+    },
+    COMMAND_INJECTION: {
+      pattern: /exec(?:Sync)?\s*\(\s*["`].*\$|exec(?:Sync)?\s*\(\s*template.*\$|exec(?:Sync)?\s*\(\s*\+/i,
+      type: 'Command Injection',
+      severity: 'critical',
+      remediation:
+        'Use array-based arguments (execFile) or validate and whitelist inputs strictly',
+    },
+    HARDCODED_SECRET_API_KEY: {
+      pattern: /API_KEY\s*=\s*["`][^"`]{20,}["`]/i,
+      type: 'API_KEY',
+      severity: 'critical',
+      remediation:
+        'Store API keys in environment variables (.env file, not committed)',
+    },
+    HARDCODED_SECRET_PASSWORD: {
+      pattern: /password\s*[:=]\s*["`][^"`]{6,}["`]/i,
+      type: 'PASSWORD',
+      severity: 'critical',
+      remediation:
+        'Store passwords in environment variables or secure vault, never hardcode',
+    },
+    HARDCODED_SECRET_TOKEN: {
+      pattern: /token\s*[:=]\s*["`][a-zA-Z0-9_-]{20,}["`]/i,
+      type: 'TOKEN',
+      severity: 'critical',
+      remediation:
+        'Store tokens in environment variables or secure credential store',
+    },
+    HARDCODED_SECRET_BEARER: {
+      pattern: /Bearer\s+[a-zA-Z0-9_-]{20,}/i,
+      type: 'TOKEN',
+      severity: 'high',
+      remediation: 'Move bearer tokens to environment variables',
+    },
+    PATH_TRAVERSAL: {
+      pattern: /\.\.\s*\/|readFile(?:Sync)?\s*\(\s*path\s*\+|join\s*\(\s*__dirname\s*,\s*\.\./i,
+      type: 'Path Traversal',
+      severity: 'high',
+      remediation:
+        'Validate and normalize file paths; use path.resolve() and check boundaries',
+    },
+    INSECURE_CRYPTO: {
+      pattern: /md5|sha1|Math\.random\(\)/i,
+      type: 'Insecure Crypto',
+      severity: 'high',
+      remediation:
+        'Use SHA-256 or bcrypt for hashing; use crypto.randomBytes() for randomness',
+    },
+  };
+
+  constructor(workingDir: string) {
+    this.workingDir = workingDir;
+  }
+
+  async auditCode(filePath: string): Promise<ReviewerResult> {
+    const fullPath = resolve(this.workingDir, filePath);
+    const code = readFileSync(fullPath, 'utf-8');
+    const findings: Finding[] = [];
+
+    const owaspFindings = this.scanOWASP(code);
+    const secretFindings = this.detectSecrets(code);
+
+    findings.push(...owaspFindings);
+    findings.push(...secretFindings);
+
+    const tokensUsed = Math.ceil(code.length * this.TOKEN_ESTIMATE_PER_CHAR);
+
+    return {
+      findings: this.deduplicateFindings(findings),
+      tokensUsed,
+      fileScanned: filePath,
+    };
+  }
+
+  scanOWASP(code: string): OWASPFinding[] {
+    const findings: OWASPFinding[] = [];
+    const lines = code.split('\n');
+
+    Object.values(this.OWASP_PATTERNS).forEach((rule) => {
+      lines.forEach((line, index) => {
+        if (rule.pattern.test(line)) {
+          findings.push({
+            vulnerability: rule.type,
+            severity: rule.severity,
+            file: 'unknown',
+            line: index + 1,
+            evidence: line.trim().substring(0, 100),
+            remediation: rule.remediation,
+          });
+        }
+      });
+    });
+
+    return findings;
+  }
+
+  detectSecrets(code: string): SecretFinding[] {
+    const findings: SecretFinding[] = [];
+    const lines = code.split('\n');
+
+    const secretPatterns = [
+      { pattern: /API_KEY\s*[:=]/i, type: 'API_KEY' },
+      { pattern: /password\s*[:=]/i, type: 'PASSWORD' },
+      { pattern: /token\s*[:=]/i, type: 'TOKEN' },
+      { pattern: /BEGIN\s+RSA\s+PRIVATE\s+KEY/i, type: 'PRIVATE_KEY' },
+      { pattern: /BEGIN\s+PGP\s+PRIVATE\s+KEY/i, type: 'PGP_KEY' },
+      { pattern: /aws_access_key_id/i, type: 'AWS_KEY' },
+      { pattern: /aws_secret_access_key/i, type: 'AWS_SECRET' },
+      { pattern: /GITHUB_TOKEN|GH_TOKEN|gh_pat_/i, type: 'GITHUB_TOKEN' },
+      { pattern: /mongodb\+srv|mongodb:\/\/.*:.*@/i, type: 'MONGODB_URI' },
+      { pattern: /postgres:\/\/.*:.*@|postgresql:\/\/.*:.*@/i, type: 'DB_PASSWORD' },
+    ];
+
+    lines.forEach((line, index) => {
+      secretPatterns.forEach(({ pattern, type }) => {
+        if (pattern.test(line)) {
+          findings.push({
+            type,
+            severity: 'critical',
+            line: index + 1,
+            pattern: pattern.source,
+          });
+        }
+      });
+    });
+
+    return findings;
+  }
+
+  private deduplicateFindings(findings: Finding[]): Finding[] {
+    const seen = new Set<string>();
+    const unique: Finding[] = [];
+
+    findings.forEach((finding) => {
+      const key = `${finding.line}:${
+        'vulnerability' in finding
+          ? finding.vulnerability
+          : finding.type
+      }`;
+
+      if (!seen.has(key)) {
+        seen.add(key);
+        unique.push(finding);
+      }
+    });
+
+    return unique.sort((a, b) => a.line - b.line);
+  }
+}