sequant 1.11.0 → 1.13.0

package/dist/src/lib/semgrep.js

@@ -0,0 +1,406 @@
+/**
+ * Semgrep integration for static analysis
+ *
+ * Provides stack-aware ruleset mapping and execution utilities
+ * for integrating Semgrep into the /qa workflow.
+ */
+import { spawn } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
+/**
+ * Stack-to-ruleset mapping
+ *
+ * Maps detected stacks to appropriate Semgrep rulesets.
+ * Uses Semgrep's public rule registry identifiers.
+ */
+export const STACK_RULESETS = {
+    nextjs: {
+        name: "Next.js",
+        description: "TypeScript/JavaScript security and best practices for Next.js",
+        rules: [
+            "p/typescript",
+            "p/javascript",
+            "p/react",
+            "p/security-audit",
+            "p/secrets",
+        ],
+    },
+    astro: {
+        name: "Astro",
+        description: "TypeScript/JavaScript security for Astro projects",
+        rules: ["p/typescript", "p/javascript", "p/security-audit", "p/secrets"],
+    },
+    sveltekit: {
+        name: "SvelteKit",
+        description: "TypeScript/JavaScript security for SvelteKit",
+        rules: ["p/typescript", "p/javascript", "p/security-audit", "p/secrets"],
+    },
+    remix: {
+        name: "Remix",
+        description: "TypeScript/JavaScript security for Remix",
+        rules: [
+            "p/typescript",
+            "p/javascript",
+            "p/react",
+            "p/security-audit",
+            "p/secrets",
+        ],
+    },
+    nuxt: {
+        name: "Nuxt",
+        description: "TypeScript/JavaScript security for Nuxt/Vue",
+        rules: ["p/typescript", "p/javascript", "p/security-audit", "p/secrets"],
+    },
+    rust: {
+        name: "Rust",
+        description: "Rust security and best practices",
+        rules: ["p/rust", "p/security-audit", "p/secrets"],
+    },
+    python: {
+        name: "Python",
+        description: "Python security and best practices",
+        rules: ["p/python", "p/django", "p/flask", "p/security-audit", "p/secrets"],
+    },
+    go: {
+        name: "Go",
+        description: "Go security and best practices",
+        rules: ["p/golang", "p/security-audit", "p/secrets"],
+    },
+    generic: {
+        name: "Generic",
+        description: "General security rules for any codebase",
+        rules: ["p/security-audit", "p/secrets"],
+    },
+};
+/**
+ * Get the appropriate Semgrep ruleset for a detected stack
+ *
+ * @param stack - The detected stack name (e.g., "nextjs", "python")
+ * @returns The ruleset configuration for the stack
+ */
+export function getRulesForStack(stack) {
+    if (!stack) {
+        return STACK_RULESETS.generic;
+    }
+    return STACK_RULESETS[stack] || STACK_RULESETS.generic;
+}
+/**
+ * Path to custom rules file
+ */
+export const CUSTOM_RULES_PATH = ".sequant/semgrep-rules.yaml";
+/**
+ * Check if custom rules file exists
+ *
+ * @param projectRoot - Root directory of the project
+ * @returns true if custom rules file exists
+ */
+export function hasCustomRules(projectRoot = process.cwd()) {
+    return existsSync(join(projectRoot, CUSTOM_RULES_PATH));
+}
+/**
+ * Get path to custom rules file if it exists
+ *
+ * @param projectRoot - Root directory of the project
+ * @returns Path to custom rules file, or null if it doesn't exist
+ */
+export function getCustomRulesPath(projectRoot = process.cwd()) {
+    const customPath = join(projectRoot, CUSTOM_RULES_PATH);
+    return existsSync(customPath) ? customPath : null;
+}
+/**
+ * Check if Semgrep is available
+ *
+ * Checks for both 'semgrep' command and 'npx semgrep' fallback
+ *
+ * @returns Object with availability info and command to use
+ */
+export async function checkSemgrepAvailability() {
+    // First try native semgrep
+    try {
+        await executeCommand("semgrep", ["--version"]);
+        return { available: true, command: "semgrep", useNpx: false };
+    }
+    catch {
+        // Native semgrep not available, try npx
+    }
+    // Try npx semgrep
+    try {
+        await executeCommand("npx", ["semgrep", "--version"]);
+        return { available: true, command: "npx", useNpx: true };
+    }
+    catch {
+        // npx semgrep also not available
+    }
+    return { available: false, command: "", useNpx: false };
+}
+/**
+ * Execute a command and return stdout
+ *
+ * @param command - Command to execute
+ * @param args - Command arguments
+ * @returns stdout from the command
+ */
+function executeCommand(command, args) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn(command, args, {
+            stdio: ["pipe", "pipe", "pipe"],
+            shell: process.platform === "win32",
+        });
+        let stdout = "";
+        let stderr = "";
+        proc.stdout?.on("data", (data) => {
+            stdout += data.toString();
+        });
+        proc.stderr?.on("data", (data) => {
+            stderr += data.toString();
+        });
+        proc.on("close", (code) => {
+            if (code === 0) {
+                resolve(stdout);
+            }
+            else {
+                reject(new Error(stderr || `Command exited with code ${code}`));
+            }
+        });
+        proc.on("error", (err) => {
+            reject(err);
+        });
+    });
+}
+/**
+ * Parse Semgrep JSON output into findings
+ *
+ * @param output - Raw JSON output from Semgrep
+ * @returns Array of parsed findings
+ */
+export function parseSemgrepOutput(output) {
+    try {
+        const data = JSON.parse(output);
+        const results = data.results || [];
+        return results.map((result) => ({
+            path: result.path,
+            line: result.start.line,
+            column: result.start.col,
+            endLine: result.end?.line,
+            endColumn: result.end?.col,
+            message: result.extra.message,
+            ruleId: result.check_id,
+            severity: mapSeverity(result.extra.severity || "warning"),
+            category: result.extra.metadata?.category,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Map Semgrep severity to our internal severity type
+ */
+function mapSeverity(severity) {
+    const lower = severity.toLowerCase();
+    if (lower === "error" || lower === "critical" || lower === "high") {
+        return "error";
+    }
+    if (lower === "warning" || lower === "medium") {
+        return "warning";
+    }
+    return "info";
+}
+/**
+ * Count findings by severity
+ *
+ * @param findings - Array of Semgrep findings
+ * @returns Object with counts by severity
+ */
+export function countFindingsBySeverity(findings) {
+    return findings.reduce((acc, finding) => {
+        if (finding.severity === "error") {
+            acc.critical++;
+        }
+        else if (finding.severity === "warning") {
+            acc.warning++;
+        }
+        else {
+            acc.info++;
+        }
+        return acc;
+    }, { critical: 0, warning: 0, info: 0 });
+}
+/**
+ * Run Semgrep scan on specified files or directories
+ *
+ * @param options - Scan options
+ * @returns Scan result with findings
+ */
+export async function runSemgrepScan(options) {
+    const { targets, stack = null, projectRoot = process.cwd() } = options;
+    const useCustomRules = options.useCustomRules ?? true;
+    // Check availability
+    const availability = await checkSemgrepAvailability();
+    if (!availability.available) {
+        return {
+            success: true,
+            findings: [],
+            criticalCount: 0,
+            warningCount: 0,
+            infoCount: 0,
+            skipped: true,
+            skipReason: "Semgrep not installed (install with: pip install semgrep)",
+        };
+    }
+    // Build command arguments
+    const args = [];
+    // If using npx, prepend 'semgrep' to args
+    if (availability.useNpx) {
+        args.push("semgrep");
+    }
+    // Add output format
+    args.push("--json");
+    // Add rules from stack
+    const ruleset = getRulesForStack(stack);
+    for (const rule of ruleset.rules) {
+        args.push("--config", rule);
+    }
+    // Add custom rules if available
+    if (useCustomRules) {
+        const customRulesPath = getCustomRulesPath(projectRoot);
+        if (customRulesPath) {
+            args.push("--config", customRulesPath);
+        }
+    }
+    // Add targets
+    args.push(...targets);
+    try {
+        const output = await executeCommand(availability.command, args);
+        const findings = parseSemgrepOutput(output);
+        const counts = countFindingsBySeverity(findings);
+        return {
+            success: true,
+            findings,
+            criticalCount: counts.critical,
+            warningCount: counts.warning,
+            infoCount: counts.info,
+        };
+    }
+    catch (error) {
+        // Semgrep returns non-zero exit code when findings are present
+        // Try to parse the output anyway
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        // Check if this is just findings being reported (exit code 1 with JSON output)
+        try {
+            const findings = parseSemgrepOutput(errorMessage);
+            if (findings.length > 0) {
+                const counts = countFindingsBySeverity(findings);
+                return {
+                    success: true,
+                    findings,
+                    criticalCount: counts.critical,
+                    warningCount: counts.warning,
+                    infoCount: counts.info,
+                };
+            }
+        }
+        catch {
+            // Not valid JSON output, real error
+        }
+        return {
+            success: false,
+            findings: [],
+            criticalCount: 0,
+            warningCount: 0,
+            infoCount: 0,
+            error: errorMessage,
+        };
+    }
+}
+/**
+ * Format findings for display in QA output
+ *
+ * @param findings - Array of findings to format
+ * @returns Formatted markdown string
+ */
+export function formatFindingsForDisplay(findings) {
+    if (findings.length === 0) {
+        return "✅ No findings";
+    }
+    const lines = [];
+    const grouped = groupFindingsBySeverity(findings);
+    if (grouped.critical.length > 0) {
+        lines.push("### ❌ Critical Issues");
+        lines.push("");
+        for (const finding of grouped.critical) {
+            lines.push(formatSingleFinding(finding));
+        }
+        lines.push("");
+    }
+    if (grouped.warning.length > 0) {
+        lines.push("### ⚠️ Warnings");
+        lines.push("");
+        for (const finding of grouped.warning) {
+            lines.push(formatSingleFinding(finding));
+        }
+        lines.push("");
+    }
+    if (grouped.info.length > 0) {
+        lines.push("### ℹ️ Info");
+        lines.push("");
+        for (const finding of grouped.info) {
+            lines.push(formatSingleFinding(finding));
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+/**
+ * Group findings by severity
+ */
+function groupFindingsBySeverity(findings) {
+    return {
+        critical: findings.filter((f) => f.severity === "error"),
+        warning: findings.filter((f) => f.severity === "warning"),
+        info: findings.filter((f) => f.severity === "info"),
+    };
+}
+/**
+ * Format a single finding for display
+ */
+function formatSingleFinding(finding) {
+    const location = `${finding.path}:${finding.line}`;
+    return `- \`${location}\` - ${finding.message} (${finding.ruleId})`;
+}
+/**
+ * Generate QA verdict contribution from Semgrep results
+ *
+ * @param result - Semgrep scan result
+ * @returns Verdict contribution (blocking if critical findings)
+ */
+export function getSemgrepVerdictContribution(result) {
+    if (result.skipped) {
+        return {
+            blocking: false,
+            reason: `Semgrep skipped: ${result.skipReason}`,
+        };
+    }
+    if (!result.success) {
+        return {
+            blocking: false,
+            reason: `Semgrep error: ${result.error}`,
+        };
+    }
+    if (result.criticalCount > 0) {
+        return {
+            blocking: true,
+            reason: `${result.criticalCount} critical security finding(s) detected`,
+        };
+    }
+    if (result.warningCount > 0) {
+        return {
+            blocking: false,
+            reason: `${result.warningCount} warning(s) detected (review recommended)`,
+        };
+    }
+    return {
+        blocking: false,
+        reason: "No security issues detected",
+    };
+}

package/dist/src/lib/solve-comment-parser.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Solve Comment Parser
+ *
+ * Detects and parses /solve command output from GitHub issue comments.
+ * When a solve comment exists, its phase recommendations take precedence
+ * over content analysis (but not over labels).
+ *
+ * @example
+ * ```typescript
+ * import { findSolveComment, parseSolveWorkflow } from './solve-comment-parser';
+ *
+ * const comments = [
+ *   { body: "Some regular comment" },
+ *   { body: "## Solve Workflow for Issues: 123\n..." },
+ * ];
+ *
+ * const solveComment = findSolveComment(comments);
+ * if (solveComment) {
+ *   const phases = parseSolveWorkflow(solveComment.body);
+ *   // phases: { phases: ['spec', 'exec', 'test', 'qa'], qualityLoop: false }
+ * }
+ * ```
+ */
+import type { Phase } from "./workflow/types.js";
+import type { PhaseSignal } from "./phase-signal.js";
+/**
+ * Result of parsing a solve comment
+ */
+export interface SolveWorkflowResult {
+    /** Phases recommended by solve */
+    phases: Phase[];
+    /** Whether quality loop is recommended */
+    qualityLoop: boolean;
+    /** The issue numbers mentioned in the solve comment */
+    issueNumbers: number[];
+    /** Raw workflow string (e.g., "spec → exec → test → qa") */
+    workflowString?: string;
+}
+/**
+ * Comment structure (simplified from GitHub API)
+ */
+export interface IssueComment {
+    body: string;
+    author?: {
+        login: string;
+    };
+    createdAt?: string;
+}
+/**
+ * Check if a comment is a solve command output
+ *
+ * @param body - The comment body
+ * @returns True if this appears to be a solve comment
+ */
+export declare function isSolveComment(body: string): boolean;
+/**
+ * Find the most recent solve comment from a list of comments
+ *
+ * @param comments - Array of issue comments
+ * @returns The solve comment if found, null otherwise
+ */
+export declare function findSolveComment(comments: IssueComment[]): IssueComment | null;
+/**
+ * Parse a solve comment to extract workflow information
+ *
+ * @param body - The solve comment body
+ * @returns Parsed workflow result
+ */
+export declare function parseSolveWorkflow(body: string): SolveWorkflowResult;
+/**
+ * Convert solve workflow result to phase signals
+ *
+ * @param workflow - The parsed solve workflow
+ * @returns Array of phase signals with 'solve' source
+ */
+export declare function solveWorkflowToSignals(workflow: SolveWorkflowResult): PhaseSignal[];
+/**
+ * Check if solve comment covers the current issue
+ *
+ * @param workflow - The parsed solve workflow
+ * @param issueNumber - The current issue number
+ * @returns True if the solve comment includes this issue
+ */
+export declare function solveCoversIssue(workflow: SolveWorkflowResult, issueNumber: number): boolean;

package/dist/src/lib/solve-comment-parser.js

@@ -0,0 +1,200 @@
+/**
+ * Solve Comment Parser
+ *
+ * Detects and parses /solve command output from GitHub issue comments.
+ * When a solve comment exists, its phase recommendations take precedence
+ * over content analysis (but not over labels).
+ *
+ * @example
+ * ```typescript
+ * import { findSolveComment, parseSolveWorkflow } from './solve-comment-parser';
+ *
+ * const comments = [
+ *   { body: "Some regular comment" },
+ *   { body: "## Solve Workflow for Issues: 123\n..." },
+ * ];
+ *
+ * const solveComment = findSolveComment(comments);
+ * if (solveComment) {
+ *   const phases = parseSolveWorkflow(solveComment.body);
+ *   // phases: { phases: ['spec', 'exec', 'test', 'qa'], qualityLoop: false }
+ * }
+ * ```
+ */
+/**
+ * Markers that indicate a solve comment
+ */
+const SOLVE_MARKERS = [
+    "## Solve Workflow for Issues:",
+    "## Solve Workflow for Issue:",
+    "### Recommended Workflow",
+    "*📝 Generated by `/solve",
+];
+/**
+ * Pattern to extract phases from solve workflow
+ * Matches: `/spec`, `/exec`, `/test`, `/qa`, etc.
+ * Also matches without slash: `spec`, `exec`, `test`, `qa` (for arrow notation)
+ */
+const PHASE_PATTERN = /\/?(?<!\w)(spec|exec|test|qa|security-review|testgen|loop)(?!\w)/g;
+/**
+ * Pattern to detect quality loop recommendation
+ */
+const QUALITY_LOOP_PATTERNS = [
+    /quality\s*loop.*auto-enable/i,
+    /--quality-loop/i,
+    /quality\s*loop.*recommended/i,
+    /enable.*quality\s*loop/i,
+];
+/**
+ * Pattern to extract issue numbers from solve header
+ * Matches: "## Solve Workflow for Issues: 123, 456"
+ */
+const ISSUE_NUMBER_PATTERN = /#?(\d+)/g;
+/**
+ * Check if a comment is a solve command output
+ *
+ * @param body - The comment body
+ * @returns True if this appears to be a solve comment
+ */
+export function isSolveComment(body) {
+    return SOLVE_MARKERS.some((marker) => body.includes(marker));
+}
+/**
+ * Find the most recent solve comment from a list of comments
+ *
+ * @param comments - Array of issue comments
+ * @returns The solve comment if found, null otherwise
+ */
+export function findSolveComment(comments) {
+    // Search from most recent to oldest (assuming comments are in chronological order)
+    for (let i = comments.length - 1; i >= 0; i--) {
+        if (isSolveComment(comments[i].body)) {
+            return comments[i];
+        }
+    }
+    return null;
+}
+/**
+ * Parse phases from a solve workflow string
+ *
+ * @param workflowString - String like "spec → exec → test → qa"
+ * @returns Array of phases
+ */
+function parseWorkflowString(workflowString) {
+    const phases = [];
+    const matches = workflowString.matchAll(PHASE_PATTERN);
+    for (const match of matches) {
+        const phase = match[1];
+        if (!phases.includes(phase)) {
+            phases.push(phase);
+        }
+    }
+    return phases;
+}
+/**
+ * Parse a solve comment to extract workflow information
+ *
+ * @param body - The solve comment body
+ * @returns Parsed workflow result
+ */
+export function parseSolveWorkflow(body) {
+    const result = {
+        phases: [],
+        qualityLoop: false,
+        issueNumbers: [],
+    };
+    // Extract issue numbers from header
+    const headerMatch = body.match(/## Solve Workflow for Issues?:\s*([^\n]+)/i);
+    if (headerMatch) {
+        const numberMatches = headerMatch[1].matchAll(ISSUE_NUMBER_PATTERN);
+        for (const match of numberMatches) {
+            const num = parseInt(match[1], 10);
+            if (!isNaN(num) && !result.issueNumbers.includes(num)) {
+                result.issueNumbers.push(num);
+            }
+        }
+    }
+    // Find workflow lines (e.g., "/spec 152" or "spec → exec → qa")
+    const lines = body.split("\n");
+    // First pass: look for arrow notation (most reliable)
+    for (const line of lines) {
+        if (line.includes("→") || line.includes("->")) {
+            const phases = parseWorkflowString(line);
+            if (phases.length > 0) {
+                result.phases = phases;
+                result.workflowString = line.trim();
+                break;
+            }
+        }
+    }
+    // Second pass: if no arrow notation found, collect phases from multiple lines
+    if (result.phases.length === 0) {
+        const collectedPhases = [];
+        for (const line of lines) {
+            // Look for slash command patterns on individual lines
+            if (line.includes("/spec") ||
+                line.includes("/exec") ||
+                line.includes("/test") ||
+                line.includes("/qa")) {
+                const linePhases = parseWorkflowString(line);
+                for (const phase of linePhases) {
+                    if (!collectedPhases.includes(phase)) {
+                        collectedPhases.push(phase);
+                    }
+                }
+            }
+        }
+        if (collectedPhases.length > 0) {
+            result.phases = collectedPhases;
+            result.workflowString = collectedPhases.map((p) => `/${p}`).join(" → ");
+        }
+    }
+    // If no phases found from lines, try full body
+    if (result.phases.length === 0) {
+        result.phases = parseWorkflowString(body);
+    }
+    // Check for quality loop recommendation
+    for (const pattern of QUALITY_LOOP_PATTERNS) {
+        if (pattern.test(body)) {
+            result.qualityLoop = true;
+            break;
+        }
+    }
+    return result;
+}
+/**
+ * Convert solve workflow result to phase signals
+ *
+ * @param workflow - The parsed solve workflow
+ * @returns Array of phase signals with 'solve' source
+ */
+export function solveWorkflowToSignals(workflow) {
+    const signals = [];
+    for (const phase of workflow.phases) {
+        signals.push({
+            phase,
+            source: "solve",
+            confidence: "high",
+            reason: `Recommended by /solve command: ${workflow.workflowString || phase}`,
+        });
+    }
+    if (workflow.qualityLoop) {
+        signals.push({
+            phase: "quality-loop",
+            source: "solve",
+            confidence: "high",
+            reason: "Quality loop recommended by /solve command",
+        });
+    }
+    return signals;
+}
+/**
+ * Check if solve comment covers the current issue
+ *
+ * @param workflow - The parsed solve workflow
+ * @param issueNumber - The current issue number
+ * @returns True if the solve comment includes this issue
+ */
+export function solveCoversIssue(workflow, issueNumber) {
+    return workflow.issueNumbers.includes(issueNumber);
+}