onbuzz 3.3.0

package/src/analyzers/SparrowAnalyzer.js

@@ -0,0 +1,341 @@
+/**
+ * SparrowAnalyzer - Tree-sitter based SAST using sparrow-sast
+ *
+ * Provides security scanning without external dependencies.
+ * Uses Globstar-compatible YAML checker format.
+ *
+ * Supported languages: Python, JavaScript, TypeScript, Go, Java,
+ * Ruby, Rust, PHP, C#, Bash, HTML, CSS
+ */
+
+import path from 'path';
+import fs from 'fs/promises';
+
+class SparrowAnalyzer {
+  constructor(logger = null) {
+    this.logger = logger;
+    this.sparrow = null;
+    this.initialized = false;
+  }
+
+  /**
+   * Lazy-load sparrow-sast to avoid startup overhead
+   */
+  async ensureInitialized() {
+    if (this.initialized) return;
+
+    try {
+      this.sparrow = await import('sparrow-sast');
+      this.initialized = true;
+      this.logger?.debug('Sparrow SAST initialized');
+    } catch (error) {
+      this.logger?.error('Failed to initialize Sparrow SAST', { error: error.message });
+      throw new Error(`Sparrow SAST initialization failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Get supported languages
+   */
+  getSupportedLanguages() {
+    return [
+      'python', 'javascript', 'typescript', 'go', 'java',
+      'ruby', 'rust', 'php', 'csharp', 'bash', 'html', 'css'
+    ];
+  }
+
+  /**
+   * Get file extensions for supported languages
+   */
+  getSupportedExtensions() {
+    return [
+      '.py', '.js', '.jsx', '.ts', '.tsx', '.go', '.java',
+      '.rb', '.rs', '.php', '.cs', '.sh', '.bash', '.html', '.css'
+    ];
+  }
+
+  /**
+   * Check if a file is supported by Sparrow
+   */
+  isSupported(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    return this.getSupportedExtensions().includes(ext);
+  }
+
+  /**
+   * Scan a single file
+   * @param {string} filePath - Path to the file
+   * @param {Object} options - Scan options
+   * @returns {Promise<Object>} Scan results
+   */
+  async scanFile(filePath, options = {}) {
+    await this.ensureInitialized();
+
+    const startTime = Date.now();
+
+    try {
+      // Check if file exists
+      await fs.access(filePath);
+
+      // Check if file is supported
+      if (!this.isSupported(filePath)) {
+        return {
+          success: true,
+          file: filePath,
+          issues: [],
+          skipped: true,
+          reason: 'Unsupported file type',
+          executionTime: Date.now() - startTime
+        };
+      }
+
+      // Run Sparrow scan
+      const issues = await this.sparrow.scan(filePath, {
+        useBuiltinCheckers: options.useBuiltinCheckers !== false,
+        checkerDir: options.checkerDir,
+        enabledCheckers: options.enabledCheckers,
+        disabledCheckers: options.disabledCheckers,
+        excludePatterns: options.excludePatterns
+      });
+
+      // Transform issues to standard format
+      const transformedIssues = issues.map(issue => this.transformIssue(issue, filePath));
+
+      return {
+        success: true,
+        file: filePath,
+        issues: transformedIssues,
+        summary: {
+          total: transformedIssues.length,
+          critical: transformedIssues.filter(i => i.severity === 'critical').length,
+          error: transformedIssues.filter(i => i.severity === 'error').length,
+          warning: transformedIssues.filter(i => i.severity === 'warning').length,
+          info: transformedIssues.filter(i => i.severity === 'info').length
+        },
+        executionTime: Date.now() - startTime
+      };
+
+    } catch (error) {
+      this.logger?.error('Sparrow scan failed', { file: filePath, error: error.message });
+      return {
+        success: false,
+        file: filePath,
+        error: error.message,
+        issues: [],
+        executionTime: Date.now() - startTime
+      };
+    }
+  }
+
+  /**
+   * Scan a directory or project
+   * @param {string} targetPath - Path to scan
+   * @param {Object} options - Scan options
+   * @returns {Promise<Object>} Scan results
+   */
+  async scanProject(targetPath, options = {}) {
+    await this.ensureInitialized();
+
+    const startTime = Date.now();
+
+    try {
+      // Check if path exists
+      const stat = await fs.stat(targetPath);
+      const isDirectory = stat.isDirectory();
+
+      // Build exclude patterns
+      const defaultExcludes = [
+        'node_modules/**',
+        'vendor/**',
+        '.git/**',
+        'dist/**',
+        'build/**',
+        '*.min.js',
+        '*.bundle.js'
+      ];
+
+      const excludePatterns = [
+        ...defaultExcludes,
+        ...(options.excludePatterns || [])
+      ];
+
+      // Filter languages if specified
+      const languages = options.languages?.map(lang => {
+        // Map language names to Sparrow Language enum
+        const langMap = {
+          'python': this.sparrow.Language?.Python,
+          'javascript': this.sparrow.Language?.JavaScript,
+          'typescript': this.sparrow.Language?.TypeScript,
+          'go': this.sparrow.Language?.Go,
+          'java': this.sparrow.Language?.Java,
+          'ruby': this.sparrow.Language?.Ruby,
+          'rust': this.sparrow.Language?.Rust,
+          'php': this.sparrow.Language?.PHP,
+          'csharp': this.sparrow.Language?.CSharp,
+          'bash': this.sparrow.Language?.Bash,
+          'html': this.sparrow.Language?.HTML,
+          'css': this.sparrow.Language?.CSS
+        };
+        return langMap[lang.toLowerCase()];
+      }).filter(Boolean);
+
+      // Run Sparrow scan
+      const issues = await this.sparrow.scan(targetPath, {
+        useBuiltinCheckers: options.useBuiltinCheckers !== false,
+        checkerDir: options.checkerDir,
+        enabledCheckers: options.enabledCheckers,
+        disabledCheckers: options.disabledCheckers,
+        excludePatterns,
+        languages: languages?.length > 0 ? languages : undefined
+      });
+
+      // Transform and group issues by file
+      const issuesByFile = new Map();
+      for (const issue of issues) {
+        const filePath = issue.filepath;
+        if (!issuesByFile.has(filePath)) {
+          issuesByFile.set(filePath, []);
+        }
+        issuesByFile.get(filePath).push(this.transformIssue(issue, filePath));
+      }
+
+      // Build file results
+      const fileResults = [];
+      for (const [file, fileIssues] of issuesByFile) {
+        fileResults.push({
+          file,
+          issues: fileIssues,
+          summary: {
+            total: fileIssues.length,
+            critical: fileIssues.filter(i => i.severity === 'critical').length,
+            error: fileIssues.filter(i => i.severity === 'error').length,
+            warning: fileIssues.filter(i => i.severity === 'warning').length,
+            info: fileIssues.filter(i => i.severity === 'info').length
+          }
+        });
+      }
+
+      // Calculate overall summary
+      const allIssues = Array.from(issuesByFile.values()).flat();
+      const summary = {
+        totalFiles: issuesByFile.size,
+        totalIssues: allIssues.length,
+        critical: allIssues.filter(i => i.severity === 'critical').length,
+        error: allIssues.filter(i => i.severity === 'error').length,
+        warning: allIssues.filter(i => i.severity === 'warning').length,
+        info: allIssues.filter(i => i.severity === 'info').length,
+        byCategory: this.groupByCategory(allIssues),
+        byLanguage: this.groupByLanguage(fileResults)
+      };
+
+      return {
+        success: true,
+        path: targetPath,
+        isDirectory,
+        files: fileResults,
+        summary,
+        executionTime: Date.now() - startTime
+      };
+
+    } catch (error) {
+      this.logger?.error('Sparrow project scan failed', { path: targetPath, error: error.message });
+      return {
+        success: false,
+        path: targetPath,
+        error: error.message,
+        files: [],
+        summary: { totalFiles: 0, totalIssues: 0 },
+        executionTime: Date.now() - startTime
+      };
+    }
+  }
+
+  /**
+   * Transform Sparrow issue to standard format
+   */
+  transformIssue(issue, filePath) {
+    return {
+      id: issue.id,
+      file: path.relative(process.cwd(), issue.filepath || filePath),
+      fullPath: issue.filepath || filePath,
+      line: issue.range?.start?.row + 1 || 1,  // Convert to 1-based
+      column: issue.range?.start?.column + 1 || 1,
+      endLine: issue.range?.end?.row + 1 || undefined,
+      endColumn: issue.range?.end?.column + 1 || undefined,
+      severity: issue.severity || 'warning',
+      category: issue.category || 'security',
+      rule: issue.id,
+      message: issue.message,
+      source: 'sparrow',
+      fixable: false
+    };
+  }
+
+  /**
+   * Group issues by category
+   */
+  groupByCategory(issues) {
+    const groups = {};
+    for (const issue of issues) {
+      const category = issue.category || 'other';
+      groups[category] = (groups[category] || 0) + 1;
+    }
+    return groups;
+  }
+
+  /**
+   * Group files by language
+   */
+  groupByLanguage(fileResults) {
+    const groups = {};
+    for (const result of fileResults) {
+      const ext = path.extname(result.file).toLowerCase();
+      const langMap = {
+        '.py': 'python',
+        '.js': 'javascript',
+        '.jsx': 'javascript',
+        '.ts': 'typescript',
+        '.tsx': 'typescript',
+        '.go': 'go',
+        '.java': 'java',
+        '.rb': 'ruby',
+        '.rs': 'rust',
+        '.php': 'php',
+        '.cs': 'csharp',
+        '.sh': 'bash',
+        '.bash': 'bash',
+        '.html': 'html',
+        '.css': 'css'
+      };
+      const lang = langMap[ext] || 'other';
+      groups[lang] = (groups[lang] || 0) + 1;
+    }
+    return groups;
+  }
+
+  /**
+   * Get available checkers info
+   */
+  async getCheckersInfo() {
+    await this.ensureInitialized();
+
+    try {
+      const registry = this.sparrow.getRegistry?.();
+      if (registry) {
+        const analyzers = this.sparrow.getAllAnalyzers?.() || [];
+        return analyzers.map(a => ({
+          name: a.name,
+          language: a.language,
+          category: a.category,
+          severity: a.severity
+        }));
+      }
+      return [];
+    } catch (error) {
+      this.logger?.warn('Could not get checkers info', { error: error.message });
+      return [];
+    }
+  }
+}
+
+export default SparrowAnalyzer;

package/src/analyzers/TypeScriptAnalyzer.js

@@ -0,0 +1,247 @@
+/**
+ * TypeScriptAnalyzer - Analyze TypeScript files for errors using TypeScript Compiler API
+ *
+ * Purpose:
+ * - Analyze TypeScript files for syntax, type, and semantic errors
+ * - Use TypeScript Compiler API with full type checking
+ * - Provide detailed error information with line numbers
+ * - Support TSX syntax
+ */
+
+import ts from 'typescript';
+import path from 'path';
+import { STATIC_ANALYSIS } from '../utilities/constants.js';
+
+class TypeScriptAnalyzer {
+  constructor(logger = null) {
+    this.logger = logger;
+    this.compilerOptions = {
+      noEmit: true,
+      jsx: ts.JsxEmit.React,
+      target: ts.ScriptTarget.Latest,
+      module: ts.ModuleKind.ESNext,
+      moduleResolution: ts.ModuleResolutionKind.NodeJs,
+      esModuleInterop: true,
+      skipLibCheck: true,
+      strict: true, // Enable strict type checking for TypeScript
+      noImplicitAny: true,
+      strictNullChecks: true,
+      strictFunctionTypes: true,
+      allowJs: false // TypeScript only
+    };
+  }
+
+  /**
+   * Analyze TypeScript file for errors
+   * @param {string} filePath - Path to file
+   * @param {string} content - File content
+   * @param {Object} options - Analysis options
+   * @returns {Promise<Array>} Array of diagnostic errors
+   */
+  async analyze(filePath, content, options = {}) {
+    try {
+      const diagnostics = [];
+
+      // Create in-memory source file
+      const sourceFile = ts.createSourceFile(
+        filePath,
+        content,
+        ts.ScriptTarget.Latest,
+        true // setParentNodes
+      );
+
+      // Get syntactic diagnostics (syntax errors)
+      const syntacticDiagnostics = this.getSyntacticDiagnostics(sourceFile);
+      diagnostics.push(...syntacticDiagnostics);
+
+      // Get semantic diagnostics (type errors, undefined variables, etc.)
+      const semanticDiagnostics = await this.getSemanticDiagnostics(filePath, content);
+      diagnostics.push(...semanticDiagnostics);
+
+      this.logger?.debug('TypeScript analysis completed', {
+        file: filePath,
+        totalDiagnostics: diagnostics.length,
+        errors: diagnostics.filter(d => d.severity === STATIC_ANALYSIS.SEVERITY.ERROR).length,
+        warnings: diagnostics.filter(d => d.severity === STATIC_ANALYSIS.SEVERITY.WARNING).length
+      });
+
+      return diagnostics;
+
+    } catch (error) {
+      this.logger?.error('TypeScript analysis failed', {
+        file: filePath,
+        error: error.message
+      });
+
+      return [{
+        file: filePath,
+        line: 0,
+        column: 0,
+        severity: STATIC_ANALYSIS.SEVERITY.ERROR,
+        rule: 'analyzer-error',
+        message: `Analysis failed: ${error.message}`,
+        category: STATIC_ANALYSIS.CATEGORY.SYNTAX
+      }];
+    }
+  }
+
+  /**
+   * Get syntactic diagnostics (syntax errors)
+   * @private
+   */
+  getSyntacticDiagnostics(sourceFile) {
+    const diagnostics = [];
+
+    // Check for parsing errors
+    if (sourceFile.parseDiagnostics && sourceFile.parseDiagnostics.length > 0) {
+      for (const diagnostic of sourceFile.parseDiagnostics) {
+        diagnostics.push(this.formatDiagnostic(diagnostic, sourceFile));
+      }
+    }
+
+    return diagnostics;
+  }
+
+  /**
+   * Get semantic diagnostics (type errors, undefined variables)
+   * @private
+   */
+  async getSemanticDiagnostics(filePath, content) {
+    const diagnostics = [];
+
+    try {
+      // Create a minimal program for semantic analysis
+      const sourceFile = ts.createSourceFile(
+        filePath,
+        content,
+        ts.ScriptTarget.Latest,
+        true
+      );
+
+      // Create a compiler host that provides files from memory
+      const host = {
+        getSourceFile: (fileName) => {
+          if (fileName === filePath) {
+            return sourceFile;
+          }
+          // Return undefined for library files - they won't be available
+          return undefined;
+        },
+        getDefaultLibFileName: () => 'lib.d.ts',
+        writeFile: () => {},
+        getCurrentDirectory: () => path.dirname(filePath),
+        getDirectories: () => [],
+        fileExists: (fileName) => fileName === filePath,
+        readFile: (fileName) => {
+          if (fileName === filePath) {
+            return content;
+          }
+          return undefined;
+        },
+        getCanonicalFileName: (fileName) => fileName,
+        useCaseSensitiveFileNames: () => true,
+        getNewLine: () => '\n'
+      };
+
+      // Create program
+      const program = ts.createProgram({
+        rootNames: [filePath],
+        options: this.compilerOptions,
+        host
+      });
+
+      // Get all diagnostics
+      const syntactic = program.getSyntacticDiagnostics(sourceFile);
+      const semantic = program.getSemanticDiagnostics(sourceFile);
+
+      for (const diagnostic of [...syntactic, ...semantic]) {
+        diagnostics.push(this.formatDiagnostic(diagnostic, sourceFile));
+      }
+
+    } catch (error) {
+      this.logger?.debug('Semantic analysis encountered error', {
+        file: filePath,
+        error: error.message
+      });
+    }
+
+    return diagnostics;
+  }
+
+  /**
+   * Format TypeScript diagnostic to standard error format
+   * @private
+   */
+  formatDiagnostic(diagnostic, sourceFile) {
+    let line = 0;
+    let column = 0;
+
+    if (diagnostic.file && diagnostic.start !== undefined) {
+      const position = diagnostic.file.getLineAndCharacterOfPosition(diagnostic.start);
+      line = position.line + 1; // 1-indexed
+      column = position.character + 1;
+    } else if (sourceFile && diagnostic.start !== undefined) {
+      const position = sourceFile.getLineAndCharacterOfPosition(diagnostic.start);
+      line = position.line + 1;
+      column = position.character + 1;
+    }
+
+    const message = ts.flattenDiagnosticMessageText(diagnostic.messageText, '\n');
+
+    // Determine severity
+    let severity;
+    switch (diagnostic.category) {
+      case ts.DiagnosticCategory.Error:
+        severity = STATIC_ANALYSIS.SEVERITY.ERROR;
+        break;
+      case ts.DiagnosticCategory.Warning:
+        severity = STATIC_ANALYSIS.SEVERITY.WARNING;
+        break;
+      case ts.DiagnosticCategory.Message:
+      case ts.DiagnosticCategory.Suggestion:
+        severity = STATIC_ANALYSIS.SEVERITY.INFO;
+        break;
+      default:
+        severity = STATIC_ANALYSIS.SEVERITY.ERROR;
+    }
+
+    // Determine category based on error code and message
+    let category = STATIC_ANALYSIS.CATEGORY.SYNTAX;
+    const code = diagnostic.code;
+
+    // Categorize based on error code ranges
+    if (code >= 2000 && code < 3000) {
+      category = STATIC_ANALYSIS.CATEGORY.TYPE;
+    } else if (code >= 1000 && code < 2000) {
+      category = STATIC_ANALYSIS.CATEGORY.SYNTAX;
+    } else if (code >= 2300 && code < 2400) {
+      category = STATIC_ANALYSIS.CATEGORY.IMPORT;
+    }
+
+    // Check message content for more specific categorization
+    const lowerMessage = message.toLowerCase();
+    if (lowerMessage.includes('cannot find module') ||
+        lowerMessage.includes('import') ||
+        lowerMessage.includes('export')) {
+      category = STATIC_ANALYSIS.CATEGORY.IMPORT;
+    } else if (lowerMessage.includes('type') ||
+               lowerMessage.includes('interface') ||
+               lowerMessage.includes('class')) {
+      category = STATIC_ANALYSIS.CATEGORY.TYPE;
+    }
+
+    return {
+      file: diagnostic.file?.fileName || sourceFile?.fileName || 'unknown',
+      line,
+      column,
+      severity,
+      rule: `TS${code}`,
+      message,
+      category,
+      fixable: false, // TypeScript doesn't provide fix information easily
+      code: diagnostic.code
+    };
+  }
+}
+
+export default TypeScriptAnalyzer;