project-athena 0.4.0 → 0.5.0

package/dist/{chunk-FVCDMQUQ.js → chunk-C25FDXOO.js}

@@ -1,4 +1,13 @@
 #!/usr/bin/env node
+import {
+  Coverage,
+  Finding,
+  SECRETS_ENGINE,
+  dedupeFindings,
+  fileFingerprint,
+  hitsFromMatches,
+  secretFindings
+} from "./chunk-Y6SDMZET.js";
 import {
   listRules,
   parseRules
@@ -6,7 +15,7 @@ import {
 import {
   loadScan,
   manifestDependencyNames
-} from "./chunk-MPG3IEGB.js";
+} from "./chunk-44EGCEB2.js";
 import {
   API_ROUTE_PATH,
   AUTH_PATH,
@@ -21,10 +30,10 @@ import {
   isSafeRef,
   parseNameStatusZ,
   workingChanges
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import {
   scanText
-} from "./chunk-JCGDR4UV.js";
+} from "./chunk-WWQ5NKEC.js";
 import {
   athenaDir
 } from "./chunk-2DY4PUR4.js";
@@ -40,6 +49,82 @@ import {
 // src/services/review.ts
 import { promises as fs } from "fs";
 import path from "path";
+
+// src/core/scanners/review.ts
+var REVIEW_ENGINE = "athena-review";
+var LEVEL_SEVERITY = { blocker: "high", warning: "medium", info: "info" };
+var CHECK_CONFIDENCE = { tests: "medium", api: "medium", auth: "medium", database: "medium", leftovers: "medium" };
+var CHECK_CWE = { "env-file": ["CWE-540"] };
+var CHECK_TITLE = {
+  "env-file": "Environment file in the change",
+  dependencies: "New dependencies",
+  tests: "Source changed without tests",
+  api: "API surface changed",
+  database: "Database schema or migrations changed",
+  auth: "Authentication/authorization code changed",
+  "large-files": "Large file added",
+  leftovers: "TODO/FIXME or debug statement added",
+  vulnerabilities: "Known vulnerable dependencies",
+  knowledge: "Athena knowledge out of date",
+  skipped: "Changed file not checked"
+};
+function checkFinding(check, loc, lines) {
+  const ruleId = `review/${check.check}`;
+  return {
+    fingerprint: fileFingerprint({ ruleId, file: loc?.file, key: loc ? void 0 : check.check }),
+    ruleId,
+    category: "review",
+    severity: LEVEL_SEVERITY[check.level],
+    confidence: CHECK_CONFIDENCE[check.check] ?? "high",
+    label: "DETECTED",
+    potential: false,
+    title: CHECK_TITLE[check.check] ?? check.message,
+    message: loc && lines.length > 1 ? `${check.message} (${lines.length} lines in this file)` : check.message,
+    cwe: CHECK_CWE[check.check] ?? [],
+    ...loc ? { location: { file: loc.file, ...lines[0] ? { startLine: lines[0] } : {} } } : {},
+    engine: { id: "athena" },
+    ...check.hint ? { help: { text: check.hint } } : {}
+  };
+}
+function reviewFindings(input) {
+  const out = secretFindings(input.secrets);
+  for (const { check, locations } of input.checks) {
+    if (check.check === "secrets") continue;
+    if (!locations.length) {
+      out.push(checkFinding(check, null, []));
+      continue;
+    }
+    const byFile = /* @__PURE__ */ new Map();
+    for (const l of locations) {
+      const lines = byFile.get(l.file) ?? [];
+      if (l.line) lines.push(l.line);
+      byFile.set(l.file, lines);
+    }
+    for (const [file, lines] of byFile) out.push(checkFinding(check, { file }, lines.sort((a, b) => a - b)));
+  }
+  return out;
+}
+function reviewCoverage(c) {
+  const filesSkipped = { tooLarge: c.skipped.tooLarge, unreadable: c.skipped.unreadable, binary: 0, minified: 0, unsupported: 0 };
+  const reason = c.incomplete ? `${c.skipped.tooLarge + c.skipped.unreadable} changed file(s) could not be read and were not checked` : void 0;
+  return [
+    { engine: REVIEW_ENGINE, category: "review", status: "ok", ...reason ? { reason } : {}, target: "changed files", filesScanned: c.checked, filesSkipped, network: false, durationMs: c.durationMs },
+    { engine: SECRETS_ENGINE, category: "secret", status: "ok", reason: `added lines only${reason ? `; ${reason}` : ""}`, target: "added lines", filesScanned: c.checked, filesSkipped, network: false, durationMs: 0 }
+  ];
+}
+function reviewScanner(run) {
+  return {
+    id: REVIEW_ENGINE,
+    category: "review",
+    title: "Change review checks",
+    async run(ctx) {
+      if (ctx.mode === "all") return { findings: [], coverage: [{ engine: REVIEW_ENGINE, category: "review", status: "skipped", reason: "review checks need a diff (staged, changed or base scope)", durationMs: 0 }] };
+      return run(ctx);
+    }
+  };
+}
+
+// src/services/review.ts
 var ENV_FILE = /(^|\/)\.env(\.(local|production|development|prod|dev|staging))?$/;
 var MANIFEST_FILE = /(^|\/)(package\.json|pyproject\.toml|requirements[^/]*\.txt|go\.mod|Cargo\.toml|composer\.json|Gemfile|pubspec\.yaml|pom\.xml|build\.gradle(\.kts)?)$/;
 var LARGE_ADDED_BYTES = 512 * 1024;
@@ -113,16 +198,18 @@ function addedLines(patch) {
   }
   return out;
 }
-function scanAddedLines(lines) {
+function scanAddedLinesDetailed(lines) {
   const hits = [];
   let block = [];
   const flush = () => {
     if (!block.length) return;
     const b = block;
     block = [];
-    for (const m of scanText(b.map((l) => l.text).join("\n"))) {
-      const at = b[m.line - 1] ?? b[0];
-      hits.push({ type: m.type, file: at.file, line: at.line });
+    const text = b.map((l) => l.text).join("\n");
+    for (const h of hitsFromMatches("", text, scanText(text))) {
+      const at = b[h.line - 1] ?? b[0];
+      const endAt = h.endLine ? b[h.endLine - 1] : void 0;
+      hits.push({ ...h, file: at.file, line: at.line, ...endAt ? { endLine: endAt.line } : {} });
     }
   };
   for (const l of lines) {
@@ -145,6 +232,7 @@ async function reviewChanges(root, opts = {}) {
   }
 }
 async function review(root, opts) {
+  const started = Date.now();
   const signal = opts.signal;
   signal?.throwIfAborted();
   const repoCheck = await git(root, ["rev-parse", "--is-inside-work-tree"], { signal });
@@ -248,14 +336,19 @@ async function review(root, opts) {
   };
   const findings = [];
   const paths = changedFiles.map((f) => f.path);
-  const add = (f) => findings.push(f);
+  const locations = /* @__PURE__ */ new Map();
+  const add = (f, all) => {
+    findings.push(f);
+    locations.set(f, (all ?? f.files).map((x) => typeof x === "string" ? { file: x } : x));
+  };
+  const secretDetail = scanAddedLinesDetailed(added);
   const secretHits = /* @__PURE__ */ new Map();
-  for (const hit of scanAddedLines(added)) {
+  for (const hit of secretDetail) {
     if (!secretHits.has(hit.type)) secretHits.set(hit.type, /* @__PURE__ */ new Set());
     secretHits.get(hit.type).add(`${hit.file}:${hit.line}`);
   }
-  for (const [type, locations] of secretHits) {
-    add({ level: "blocker", check: "secrets", message: `Possible ${type} added`, files: [...locations].slice(0, 10), hint: "Remove the value, use an environment variable, and rotate the credential if it was real." });
+  for (const [type, locations2] of secretHits) {
+    add({ level: "blocker", check: "secrets", message: `Possible ${type} added`, files: [...locations2].slice(0, 10), hint: "Remove the value, use an environment variable, and rotate the credential if it was real." });
   }
   const envFiles = changedFiles.filter((f) => f.status !== "deleted" && ENV_FILE.test(f.path)).map((f) => f.path);
   if (envFiles.length) add({ level: "blocker", check: "env-file", message: "Environment file included in the change", files: envFiles, hint: "Add it to .gitignore and commit a .env.example with names only." });
@@ -281,14 +374,14 @@ async function review(root, opts) {
   const changedSource = paths.filter((p) => SOURCE_FILE.test(p) && !TEST_FILE.test(p));
   const changedTests = paths.filter((p) => TEST_FILE.test(p));
   if (changedSource.length && !changedTests.length) {
-    add({ level: "warning", check: "tests", message: `${changedSource.length} source file(s) changed with no test file changes`, files: changedSource.slice(0, 10), hint: "See `.athena/testing.md` for the project test commands and layout." });
+    add({ level: "warning", check: "tests", message: `${changedSource.length} source file(s) changed with no test file changes`, files: changedSource.slice(0, 10), hint: "See `.athena/testing.md` for the project test commands and layout." }, changedSource);
   }
   const routeFiles = changedSource.filter((p) => API_ROUTE_PATH.test(p));
-  if (routeFiles.length) add({ level: "info", check: "api", message: "API surface changed", files: routeFiles.slice(0, 10), hint: "Check auth/authorization and error handling (`.athena/api.md`, `.athena/auth.md`)." });
+  if (routeFiles.length) add({ level: "info", check: "api", message: "API surface changed", files: routeFiles.slice(0, 10), hint: "Check auth/authorization and error handling (`.athena/api.md`, `.athena/auth.md`)." }, routeFiles);
   const schemaFiles = paths.filter((p) => SCHEMA_PATH.test(p));
-  if (schemaFiles.length) add({ level: "info", check: "database", message: "Database schema or migrations changed", files: schemaFiles.slice(0, 10), hint: "Check indexes, constraints and backward compatibility (`.athena/database.md`)." });
+  if (schemaFiles.length) add({ level: "info", check: "database", message: "Database schema or migrations changed", files: schemaFiles.slice(0, 10), hint: "Check indexes, constraints and backward compatibility (`.athena/database.md`)." }, schemaFiles);
   const authFiles = changedSource.filter((p) => AUTH_PATH.test(p));
-  if (authFiles.length) add({ level: "warning", check: "auth", message: "Authentication/authorization code changed", files: authFiles.slice(0, 10), hint: "Review against `.athena/auth.md` and `.athena/security.md`." });
+  if (authFiles.length) add({ level: "warning", check: "auth", message: "Authentication/authorization code changed", files: authFiles.slice(0, 10), hint: "Review against `.athena/auth.md` and `.athena/security.md`." }, authFiles);
   for (const f of changedFiles.filter((x) => x.status === "added")) {
     signal?.throwIfAborted();
     let size = null;
@@ -304,12 +397,12 @@ async function review(root, opts) {
   if (large.length) add({ level: "warning", check: "large-files", message: "Large files added", files: large, hint: "Consider whether these belong in Git." });
   const debugHits = added.filter((l) => /\b(TODO|FIXME|XXX|console\.log|debugger|print\(|binding\.pry|dd\()/.test(l.text) && SOURCE_FILE.test(l.file));
   if (debugHits.length) {
-    add({ level: "info", check: "leftovers", message: `${debugHits.length} added line(s) contain TODO/FIXME or debug statements`, files: [...new Set(debugHits.map((l) => `${l.file}:${l.line}`))].slice(0, 10) });
+    add({ level: "info", check: "leftovers", message: `${debugHits.length} added line(s) contain TODO/FIXME or debug statements`, files: [...new Set(debugHits.map((l) => `${l.file}:${l.line}`))].slice(0, 10) }, debugHits.map((l) => ({ file: l.file, line: l.line })));
   }
-  const scan = await loadScan(root);
-  if (scan) {
-    const vulnerable = scan.tools.flatMap((t) => t.findings).filter((f) => ["critical", "high"].includes(f.severity));
-    if (vulnerable.length) add({ level: "warning", check: "vulnerabilities", message: `${vulnerable.length} high/critical dependency advisor${vulnerable.length === 1 ? "y" : "ies"} from the last scan (${scan.scannedAt.slice(0, 10)})`, files: [], hint: "Run `athena security` for details." });
+  const lastScan = await loadScan(root);
+  if (lastScan) {
+    const vulnerable = lastScan.tools.flatMap((t) => t.findings).filter((f) => ["critical", "high"].includes(f.severity));
+    if (vulnerable.length) add({ level: "warning", check: "vulnerabilities", message: `${vulnerable.length} high/critical dependency advisor${vulnerable.length === 1 ? "y" : "ies"} from the last scan (${lastScan.scannedAt.slice(0, 10)})`, files: [], hint: "Run `athena security` for details." });
   }
   let knowledgeInSync = null;
   if (opts.checkSync) {
@@ -321,9 +414,25 @@ async function review(root, opts) {
   const reviewDoc = await readTextIfExists(path.join(athenaDir(root), "code-review.md"));
   const checklist = reviewDoc ? [...reviewDoc.matchAll(/^- \[ \] (.+)$/gm)].map((m) => m[1].trim()) : [];
   if (skipped.length) {
-    add({ level: "warning", check: "skipped", message: `${skipped.length} changed file${skipped.length === 1 ? " was" : "s were"} not checked`, files: skipped.map((s) => `${s.path} (${SKIP_REASON[s.reason]})`).slice(0, 10), hint: "Athena could not read these files, so their contents were not checked for secrets. Check them yourself." });
+    add({ level: "warning", check: "skipped", message: `${skipped.length} changed file${skipped.length === 1 ? " was" : "s were"} not checked`, files: skipped.map((s) => `${s.path} (${SKIP_REASON[s.reason]})`).slice(0, 10), hint: "Athena could not read these files, so their contents were not checked for secrets. Check them yourself." }, skipped.map((s) => s.path));
   }
-  return { base, mode, ...mergeBase ? { mergeBase } : {}, changedFiles, findings, rules, checklist, knowledgeInSync, stats: { added: addedCount + untrackedAdded, removed: removedCount, files: changedFiles.length }, incomplete: skipped.length > 0, skipped };
+  const durationMs = Date.now() - started;
+  const tooLarge = skipped.filter((s) => s.reason === "too-large").length;
+  const scan = {
+    schemaVersion: 1,
+    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    durationMs,
+    scope: { mode: mode === "working" ? "changed" : mode, ...opts.base !== void 0 ? { base: opts.base } : {}, files: changedFiles.length },
+    findings: dedupeFindings(reviewFindings({ checks: findings.map((check) => ({ check, locations: locations.get(check) ?? [] })), secrets: secretDetail }).map((f) => Finding.parse(f))),
+    coverage: reviewCoverage({ checked: changedFiles.filter((f) => f.status !== "deleted").length - skipped.length, skipped: { tooLarge, unreadable: skipped.length - tooLarge }, durationMs, incomplete: skipped.length > 0 }).map((c) => Coverage.parse(c))
+  };
+  return { base, mode, ...mergeBase ? { mergeBase } : {}, changedFiles, findings, rules, checklist, knowledgeInSync, stats: { added: addedCount + untrackedAdded, removed: removedCount, files: changedFiles.length }, incomplete: skipped.length > 0, skipped, scan };
+}
+function createReviewScanner(opts = {}) {
+  return reviewScanner(async (ctx) => {
+    const r = await reviewChanges(ctx.root, { ...opts, signal: ctx.signal, ...ctx.mode === "staged" ? { staged: true } : {}, ...ctx.mode === "base" ? { base: ctx.base ?? "HEAD" } : {} });
+    return { findings: r.scan.findings, coverage: r.scan.coverage };
+  });
 }
 var SKIP_REASON = {
   "outside-root": "symlink to a path outside the project",
@@ -338,6 +447,7 @@ function hasBlockers(result) {
 
 export {
   reviewChanges,
+  createReviewScanner,
   hasBlockers
 };
-//# sourceMappingURL=chunk-FVCDMQUQ.js.map
+//# sourceMappingURL=chunk-C25FDXOO.js.map

package/dist/{chunk-7DZK6WSQ.js → chunk-DH5AGULY.js}

@@ -37,7 +37,7 @@ async function confirm(question) {
 async function cleanCommand(opts) {
   const root = await requireProjectRoot(opts);
   if (!opts.yes) {
-    const memory = (await (await import("./memory-VSVNLEJC.js")).memorySummary(root))?.total ?? 0;
+    const memory = (await (await import("./memory-XBZCYQLW.js")).memorySummary(root))?.total ?? 0;
     const memoryNote = memory ? `${memory} project memory ${memory === 1 ? "entry" : "entries"} in .athena/memory/ (shared with your team)` : "";
     if (!process.stdin.isTTY) throw new AthenaError(`Refusing to delete .athena/${memory ? `, including ${memoryNote},` : ""} without confirmation.`, "Re-run with --yes in non-interactive environments.");
     line(`This removes ${c.bold(".athena/")} (including rules.md and your Developer Notes)${opts.keepAgents ? "" : " and Athena blocks/files in agent configurations"}.`);
@@ -62,4 +62,4 @@ export {
   confirm,
   cleanCommand
 };
-//# sourceMappingURL=chunk-7DZK6WSQ.js.map
+//# sourceMappingURL=chunk-DH5AGULY.js.map

package/dist/{chunk-TDNZ2RYA.js → chunk-F65QINMR.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-SVTEJYMS.js";
 import {
   scanText
-} from "./chunk-JCGDR4UV.js";
+} from "./chunk-WWQ5NKEC.js";
 import {
   parseBlocks
 } from "./chunk-673EPYYH.js";
@@ -699,4 +699,4 @@ export {
   forgetMemory,
   updateMemory
 };
-//# sourceMappingURL=chunk-TDNZ2RYA.js.map
+//# sourceMappingURL=chunk-F65QINMR.js.map

package/dist/{chunk-WVQC2EGO.js → chunk-GU3ZX2J7.js}

@@ -2,7 +2,7 @@
 import {
   SCAN_FILE,
   SecurityScan
-} from "./chunk-MPG3IEGB.js";
+} from "./chunk-44EGCEB2.js";
 import {
   GRAPH_FILE,
   ProjectGraph
@@ -163,4 +163,4 @@ export {
   projectSession,
   releaseProjectSession
 };
-//# sourceMappingURL=chunk-WVQC2EGO.js.map
+//# sourceMappingURL=chunk-GU3ZX2J7.js.map

package/dist/{chunk-UAZLPNVC.js → chunk-GYQG4Q2N.js}

@@ -5,13 +5,13 @@ import {
   listMemory,
   recall,
   selectContext
-} from "./chunk-TDNZ2RYA.js";
+} from "./chunk-F65QINMR.js";
 import {
   projectSession
-} from "./chunk-WVQC2EGO.js";
+} from "./chunk-GU3ZX2J7.js";
 import {
   analyzeProject
-} from "./chunk-MPG3IEGB.js";
+} from "./chunk-44EGCEB2.js";
 import {
   GRAPH_FILE,
   buildGraph,
@@ -105,4 +105,4 @@ export {
   getRelevantContext,
   graphSummary
 };
-//# sourceMappingURL=chunk-UAZLPNVC.js.map
+//# sourceMappingURL=chunk-GYQG4Q2N.js.map