pi-lens 4.3.0 → 4.4.0

package/dist/clients/opengrep-client.js

@@ -1,333 +0,0 @@
-/**
- * opengrep CLI client for pi-lens — bulk/full-workspace project-diagnostics
- * extractor (#584).
- *
- * opengrep already runs as an always-on LSP auxiliary (`clients/lsp/server.ts`
- * `OpengrepServer`) for real-time per-edit feedback, and this client does NOT
- * touch that path. It exists solely so `lens_diagnostics mode=full` /
- * `lsp_diagnostics` full-workspace scans can read opengrep's findings from a
- * single project-wide CLI scan instead of one LSP touch per file.
- *
- * Why: opengrep has no `workspace/diagnostic` pull support (push-only, per
- * `docs/servercapabilities.md`), and `reopenOnResync: true`
- * (`clients/lsp/wait-policy/strategies.ts`) means every LSP touch already forces a
- * full re-scan of that one file — there's no incremental efficiency lost by
- * moving bulk scans off the per-file touch loop. On a full sweep the old path
- * instead paid opengrep's full per-file wait-tier budget serially, one file at
- * a time within its server group (#387's deliberate single-flight-per-server
- * serialization) — on a real 50-file sweep this produced 49/50 files reporting
- * "unconfirmed (timed out)".
- *
- * Lifecycle mirrors gitleaks/trivy/knip:
- *   - session_start scan (via `runTask`/`runHeavyweightTask` in
- *     runtime-session.ts), cached via `cacheManager`
- *   - `lens_diagnostics mode=full` reads the cache through the extractor
- *     registry (`project-diagnostics/extractors.ts`) — never launches a scan
- *   - per-edit LSP path (real-time feedback) is untouched
- *
- * Enablement mirrors the LSP server (`opengrepInitialization` in server.ts):
- * opengrep is structurally always-on — `resolveOpengrepConfig` only chooses
- * WHICH rules run (a local `.opengrep.yml`/`.semgrep.yml` rule file if
- * present, else the `auto` registry ruleset), not whether it runs at all.
- *
- * `// nosemgrep` / `# nosemgrep` suppression: unlike opengrep's LSP mode
- * (which does NOT honor it natively — that gap is exactly why
- * `isNosemgrepSuppressed`/`applyAuxiliarySuppressions` exist in
- * `clients/dispatch/auxiliary-lsp.ts`, #441/#586/#587), the CLI `scan --json`
- * path DOES suppress `nosemgrep`-annotated findings itself, before they ever
- * reach `--json` output — verified empirically against the real installed
- * opengrep 1.25.0 binary (see the captured raw JSON in
- * `tests/clients/opengrep-client.test.ts`: an annotated line's finding is
- * absent from `results` while an identical unannotated twin still appears).
- * So `opengrepResultToProjectDiagnostics` deliberately applies NO suppression
- * filtering of its own — doing so would be redundant at best.
- *
- * Scope note (#1562 class fix): the CLI scan is handed `--exclude` per shared
- * scratch/cache tree (`scratch-tree-policy.ts`) so a directory that isn't
- * gitignored (opengrep's own default exclusion) still doesn't reach the
- * agent as a finding — same `EXCLUDED_DIRS`-derived list gitleaks/trivy use.
- *
- * Refs: #584, #111 (opengrep adoption), #387 (workspace-sweep serialization), #1562
- */
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { mkdtempSync } from "node:fs";
-import { resolveOpengrepConfig } from "./opengrep-config.js";
-import { recordDegradationOnce } from "./degradation-ledger.js";
-import { getScratchTreeDirNames } from "./scratch-tree-policy.js";
-import { realpathOrResolve } from "./path-utils.js";
-import { safeSpawnAsync } from "./safe-spawn.js";
-import { SecurityScanClient } from "./security-scan-client.js";
-const EMPTY_RESULT = {
-    success: false,
-    findings: [],
-};
-// opengrep loads/compiles a full rule pack (1000+ rules for `auto`) before
-// scanning; generous budget for a large tree, matching trivy's CVE-DB-fetch
-// allowance rather than the lighter jscpd/gitleaks scans.
-const SCAN_TIMEOUT_MS = 180_000;
-// --- Client ---
-export class OpengrepClient extends SecurityScanClient {
-    constructor(verbose = false) {
-        super("opengrep", verbose);
-    }
-    /**
-     * Structurally always-on (mirrors `opengrepInitialization` in
-     * `clients/lsp/server.ts`) — `resolveOpengrepConfig(cwd, { enabled: true })`
-     * only resolves WHICH rules to run, not whether opengrep runs at all.
-     * Exported as a static so callers can gate/log without constructing.
-     */
-    static resolveConfig(cwd) {
-        return resolveOpengrepConfig(cwd, { enabled: true });
-    }
-    /**
-     * opengrep's top-level `--version` (no `scan` subcommand) — matches the
-     * installer's `checkArgs: ["--version"]` entry (`installer/index.ts`).
-     */
-    doEnsureAvailable() {
-        return this.ensureViaInstaller(["--version"]);
-    }
-    /**
-     * Scan a directory tree with opengrep's rule set (local config or `auto`).
-     * Re-entrancy safe: concurrent calls against the same root share a single
-     * opengrep process (mirrors `GitleaksClient`/`JscpdClient`).
-     */
-    async scan(cwd) {
-        const targetDir = realpathOrResolve(cwd);
-        const scannedAt = new Date().toISOString();
-        if (!(await this.ensureAvailable())) {
-            return {
-                ...EMPTY_RESULT,
-                scannedAt,
-                reason: "not-installed",
-                summary: "opengrep not installed",
-            };
-        }
-        return this.dedupeScan(targetDir, () => this.runScan(targetDir));
-    }
-    async runScan(cwd) {
-        const scannedAt = new Date().toISOString();
-        const bin = this.binaryPath ?? "opengrep";
-        const resolved = OpengrepClient.resolveConfig(cwd);
-        const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-opengrep-"));
-        const reportPath = path.join(outDir, "opengrep-report.json");
-        try {
-            const result = await safeSpawnAsync(bin, [
-                "scan",
-                "--config",
-                resolved.configArg ?? "auto",
-                "--json",
-                "--json-output",
-                reportPath,
-                // Never fail the scan on findings — this is a read, not a gate
-                // (matches gitleaks's `--exit-code 0` intent).
-                "--no-error",
-                "--quiet",
-                "--disable-version-check",
-                // #1562 class fix: opengrep's own `.gitignore` respect covers the
-                // common case (scratch trees are usually gitignored), but not a
-                // scratch/cache tree that ISN'T (e.g. an un-gitignored worktree
-                // cache) — `--exclude` is semgrep-compatible, so a slash-free
-                // pattern matches that directory name anywhere in the tree,
-                // independent of gitignore. Same `EXCLUDED_DIRS`-derived list
-                // gitleaks/trivy use, so the three scanners can't drift apart.
-                ...getScratchTreeDirNames().flatMap((name) => ["--exclude", name]),
-                cwd,
-            ], { cwd, timeout: SCAN_TIMEOUT_MS });
-            if (result.error) {
-                this.log(`Scan error: ${result.error.message}`);
-                const reason = `${result.failure ?? "spawn-failed"}: ${result.error.message}`;
-                this.recordRefusal(cwd, reason, result.status);
-                return {
-                    ...EMPTY_RESULT,
-                    scannedAt,
-                    reason: "spawn-failed",
-                    summary: reason.slice(0, 200),
-                };
-            }
-            if (!fs.existsSync(reportPath)) {
-                const reason = (result.stderr ?? "").trim().split("\n")[0] || "no report produced";
-                this.recordRefusal(cwd, reason, result.status);
-                return {
-                    ...EMPTY_RESULT,
-                    scannedAt,
-                    reason: "no-report",
-                    summary: reason,
-                };
-            }
-            const raw = fs.readFileSync(reportPath, "utf-8");
-            const report = readOpengrepReport(raw);
-            if (report.verdict === "refused" || result.status !== 0) {
-                const reason = report.verdict === "refused"
-                    ? report.reason
-                    : `opengrep exited with status ${result.status}`;
-                this.recordRefusal(cwd, reason, result.status);
-                return {
-                    ...EMPTY_RESULT,
-                    scannedAt,
-                    reason: "refused",
-                    summary: reason.slice(0, 200),
-                };
-            }
-            if (report.partial) {
-                recordDegradationOnce({
-                    kind: "opengrep-partial-scan",
-                    subject: cwd,
-                    reason: report.partial.reason,
-                    metadata: { status: result.status },
-                });
-            }
-            // #2154: the one opengrep site that parsed a scan of this root.
-            return {
-                success: true,
-                // A warning-level partial report with no scanned paths proves that
-                // the producer went cold. A complete empty report still proves a
-                // genuine scan, so it is still "analysed" for the render layer's
-                // analysed-and-found-nothing state (#2970) — but it carries no
-                // FILE-level authority, which `analyzedFiles: []` below is what
-                // says.
-                analyzed: !report.partial || report.scanned.length > 0,
-                // #2962: the set is ALWAYS carried, empty included. "This producer
-                // declared its coverage and it was zero files" and "this producer
-                // declares no coverage at all" are different facts; dropping the
-                // empty array collapses them into the second, and the second is
-                // what hands a zero-file scan whole-root retirement authority
-                // downstream (`runnerRetirementDecision`, tools/lens-diagnostics.ts).
-                analyzedFiles: report.scanned.map((file) => realpathOrResolve(path.resolve(cwd, file))),
-                ...(report.partial ? { partial: true } : {}),
-                ...(report.partial ? { summary: report.partial.reason } : {}),
-                ...(report.partial && report.scanned.length === 0
-                    ? { reason: "partial-no-paths" }
-                    : {}),
-                findings: report.findings,
-                scannedAt,
-            };
-        }
-        catch (err) {
-            const reason = err instanceof Error ? err.message : String(err);
-            this.recordRefusal(cwd, reason, undefined);
-            return {
-                ...EMPTY_RESULT,
-                scannedAt,
-                reason: "crashed",
-                summary: reason.slice(0, 200),
-            };
-        }
-        finally {
-            try {
-                fs.rmSync(outDir, { recursive: true, force: true });
-            }
-            catch {
-                // non-fatal
-            }
-        }
-    }
-    recordRefusal(cwd, reason, status) {
-        recordDegradationOnce({
-            kind: "opengrep-scan-refused",
-            subject: cwd,
-            reason,
-            metadata: { status },
-        });
-    }
-}
-function readOpengrepReport(raw) {
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return { verdict: "refused", reason: "unparseable opengrep report" };
-    }
-    if (!parsed || typeof parsed !== "object")
-        return { verdict: "refused", reason: "unparseable opengrep report" };
-    const report = parsed;
-    if (!Array.isArray(report.results) && !Array.isArray(report.errors))
-        return { verdict: "refused", reason: "unparseable opengrep report" };
-    const errors = (Array.isArray(report.errors) ? report.errors : []).map((error) => {
-        if (typeof error === "string")
-            return { message: error };
-        if (!error || typeof error !== "object")
-            return { message: "unrecognised opengrep error entry" };
-        const entry = error;
-        const level = typeof entry.level === "string" ? entry.level : undefined;
-        const message = typeof entry.message === "string" ? entry.message : undefined;
-        return {
-            ...(level ? { level } : {}),
-            message: message ?? level ?? "unrecognised opengrep error entry",
-        };
-    });
-    const refusal = errors.find((error) => error.level !== "warn");
-    if (refusal)
-        return { verdict: "refused", reason: refusal.message };
-    const scanned = Array.isArray(report.paths?.scanned)
-        ? report.paths.scanned.filter((file) => typeof file === "string")
-        : [];
-    return {
-        verdict: "usable",
-        ...(errors[0] ? { partial: { reason: errors[0].message } } : {}),
-        findings: parseOpengrepReport(parsed),
-        scanned,
-    };
-}
-// --- Parser ---
-/**
- * Map opengrep's `--json` report (semgrep-compatible schema: top-level
- * `results: [{ check_id, path, start:{line,col}, end:{line,col}, extra:{
- * message, severity, metadata:{cwe} } }]`) to our structured
- * `OpengrepFinding[]` shape. Exported for unit tests.
- *
- * Verified against the real installed opengrep 1.25.0 binary's own `--json`
- * output (not assumed from upstream semgrep docs — opengrep is a fork and its
- * CLI surface has drifted in places, e.g. `--files-with-matches` requires
- * `--experimental` where semgrep's doesn't).
- */
-export function parseOpengrepReport(rawOrParsed) {
-    if (typeof rawOrParsed === "string" && !rawOrParsed.trim())
-        return [];
-    let parsed = rawOrParsed;
-    if (typeof rawOrParsed === "string") {
-        try {
-            parsed = JSON.parse(rawOrParsed);
-        }
-        catch {
-            return [];
-        }
-    }
-    if (!parsed || typeof parsed !== "object")
-        return [];
-    const results = parsed.results;
-    if (!Array.isArray(results))
-        return [];
-    const findings = [];
-    for (const entry of results) {
-        if (!entry || typeof entry !== "object")
-            continue;
-        const e = entry;
-        const checkId = typeof e.check_id === "string" ? e.check_id : undefined;
-        const filePath = typeof e.path === "string" ? e.path : undefined;
-        const start = e.start;
-        const end = e.end;
-        const startLine = typeof start?.line === "number" ? start.line : undefined;
-        if (!checkId || !filePath || !Number.isFinite(startLine))
-            continue;
-        const extra = e.extra ?? {};
-        const metadata = extra.metadata ?? {};
-        const cwe = Array.isArray(metadata.cwe)
-            ? metadata.cwe.filter((c) => typeof c === "string")
-            : undefined;
-        findings.push({
-            checkId,
-            path: filePath,
-            startLine: startLine,
-            startCol: typeof start?.col === "number" ? start.col : 1,
-            endLine: typeof end?.line === "number" ? end.line : startLine,
-            endCol: typeof end?.col === "number" ? end.col : 1,
-            message: typeof extra.message === "string" ? extra.message : "opengrep finding",
-            severity: typeof extra.severity === "string" ? extra.severity : "WARNING",
-            cwe,
-        });
-    }
-    return findings;
-}

package/dist/clients/opengrep-config.js

@@ -1,76 +0,0 @@
-import * as path from "node:path";
-import { findLocalToolConfig } from "./path-utils.js";
-// Opengrep is a fork of Semgrep and natively consumes the same rule format, so
-// we discover both `.opengrep.*` (preferred) and the de-facto `.semgrep.*` rule
-// files an existing repo may already carry.
-const LOCAL_OPENGREP_CONFIG_NAMES = [
-    ".opengrep.yml",
-    ".opengrep.yaml",
-    "opengrep.yml",
-    "opengrep.yaml",
-    ".semgrep.yml",
-    ".semgrep.yaml",
-    "semgrep.yml",
-    "semgrep.yaml",
-];
-// Deliberately UNCEILINGED at $HOME (refs #2472 review round 3, F1):
-// opengrep/semgrep's own resolver reads a rule file wherever it sits, and a
-// user-level `~/.opengrep.yml` is a legitimate global config, not an
-// escaped-workspace accident.
-export function findLocalOpengrepConfig(startDir) {
-    return findLocalToolConfig(startDir, LOCAL_OPENGREP_CONFIG_NAMES);
-}
-function isRegistryOrAutoConfig(config) {
-    return (config === "auto" || config.startsWith("p/") || config.startsWith("r/"));
-}
-export function normalizeOpengrepConfigArg(config, cwd) {
-    if (!config)
-        return undefined;
-    const trimmed = config.trim();
-    if (!trimmed)
-        return undefined;
-    if (isRegistryOrAutoConfig(trimmed))
-        return trimmed;
-    return path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
-}
-/**
- * Decide whether Opengrep dispatch runs, and with which `--config`. The surface
- * is intentionally seamless — there is no persisted `.pi-lens/opengrep.json` and
- * no management command. Opengrep is enabled when EITHER:
- *
- *   - the repo carries a rule file (`.opengrep.yml`/`.semgrep.yml`, …) — the
- *     rule file IS the opt-in signal; or
- *   - `--lens-opengrep` is set — self-sufficient: with no local/explicit config
- *     it defaults to `--config auto` (Opengrep's login-free Community ruleset).
- *
- * `--lens-opengrep-config <auto|p/pack|path>` overrides the chosen config.
- */
-export function resolveOpengrepConfig(cwd, flags) {
-    const localConfig = findLocalOpengrepConfig(cwd);
-    const flagConfig = typeof flags?.config === "string" && flags.config.trim()
-        ? flags.config.trim()
-        : undefined;
-    // A non-empty --lens-opengrep-config implies --lens-opengrep (passing a
-    // config is an unambiguous opt-in).
-    if (flags?.enabled || flagConfig) {
-        // Self-sufficient flag: explicit config → local rule file → `auto`.
-        const explicit = normalizeOpengrepConfigArg(flagConfig ?? localConfig, cwd);
-        return {
-            enabled: true,
-            configArg: explicit ?? "auto",
-            source: explicit && localConfig && !flagConfig ? "local" : "flag",
-        };
-    }
-    if (localConfig) {
-        return {
-            enabled: true,
-            configArg: localConfig,
-            source: "local",
-        };
-    }
-    return {
-        enabled: false,
-        source: "disabled",
-        reason: "no local opengrep config (.opengrep.yml) and --lens-opengrep not set",
-    };
-}