thuban 0.3.0

package/packages/scanner/code-scanner.js

@@ -0,0 +1,712 @@
+/**
+ * Code Scanner
+ *
+ * @purpose Event-driven CodeScanner component
+ * @module sentinel
+ * @layer application
+ * @imports-from fs, path, events
+ * @exports-to sentinel
+ * @side-effects File system reads, Spawns child processes, Console output, Event emission
+ * @critical-for sentinel
+ */
+
+/**
+ * Sentinel Code Scanner
+ *
+ * Scans codebase for security, quality, performance, and AI-specific issues.
+ * Based on CODEX/Thuban FORGE layer specifications.
+ *
+ * Categories:
+ * - Security: Secrets, injection, auth gaps
+ * - Quality: Complexity, duplication, dead code
+ * - Performance: N+1, memory leaks, blocking
+ * - Maintainability: Docs, nesting, coupling
+ * - AI-Specific: Hallucinated imports, inconsistent patterns
+ */
+
+const fs = require('fs');
+const path = require('path');
+const EventEmitter = require('events');
+
+class CodeScanner extends EventEmitter {
+  constructor(config = {}) {
+    super();
+
+    this.config = {
+      rootPath: config.rootPath || process.cwd(),
+      ignorePatterns: config.ignorePatterns || [
+        'node_modules/**',
+        '.git/**',
+        'dist/**',
+        '.orion/snapshots/**'
+      ],
+      maxFileSize: config.maxFileSize || 1024 * 1024, // 1MB
+      complexityThreshold: config.complexityThreshold || 15,
+      nestingThreshold: config.nestingThreshold || 4,
+      ...config
+    };
+
+    // Safe patterns that should NOT trigger security warnings
+    this.safePatterns = [
+      // Environment variable names (not actual secrets)
+      /keyEnv\s*[:=]/i,
+      /envVar\s*[:=]/i,
+      /process\.env\[/,
+      /process\.env\./,
+      // Model version strings and hashes
+      /model\s*[:=]\s*['"][^'"]+['"]/i,
+      /version\s*[:=]\s*['"][^'"]+['"]/i,  // version: "hash"
+      /claude-|gpt-|gemini-|llama-|mistral-|deepseek-|grok-|sonar-/i,
+      // API endpoints (URLs, not keys)
+      /endpoint\s*[:=]/i,
+      /https?:\/\//,
+      // Common safe strings
+      /_API_KEY['"]/,  // env var names end with _API_KEY
+      /API_KEY['"]\s*\)/,  // process.env["API_KEY"]
+      // Error messages and validation
+      /errors?\.\w+\s*=/i,  // errors.password = "message"
+      /Error\s*[:=]/i,
+      /required|invalid|must be|cannot be/i,  // validation messages
+    ];
+
+    // Test file patterns (allow mock data)
+    this.testFilePatterns = [
+      /\.test\.(js|ts|jsx|tsx)$/,
+      /\.spec\.(js|ts|jsx|tsx)$/,
+      /__tests__\//,
+      /\.mock\.(js|ts)$/,
+      /test-.*\.js$/,
+    ];
+
+    // Issue patterns - security focused
+    this.securityPatterns = [
+      {
+        id: 'SEC001',
+        name: 'Hardcoded API Key',
+        // Match strings that look like actual API keys:
+        // - sk-xxx, pk-xxx (Stripe-style)
+        // - xox-xxx (Slack-style)
+        // - AKIA... (AWS-style)
+        // - Mix of numbers/letters that looks random (not readable words)
+        pattern: /['"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['"]|['"][a-zA-Z0-9]{32,}['"]/,
+        context: /(api[_-]?key|apikey|secret[_\s]*key|token|credential|bearer)/i,
+        severity: 'critical',
+        message: 'Possible hardcoded API key or secret detected',
+        skipIfSafe: true  // Skip if line matches safe patterns
+      },
+      {
+        id: 'SEC002',
+        name: 'Hardcoded Password',
+        pattern: /password\s*[:=]\s*['"][^'"]+['"]/i,
+        severity: 'critical',
+        message: 'Hardcoded password detected',
+        skipInTests: true,  // Skip in test files
+        skipIfSafe: true    // Skip error messages and validation
+      },
+      {
+        id: 'SEC003',
+        name: 'SQL Injection Risk',
+        // Only match actual SQL queries with string interpolation
+        // Requires SQL keyword as whole word (not path.join etc)
+        pattern: /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|WHERE)\b.*(\$\{|\+\s*['"]|\+\s*\w+)/i,
+        severity: 'error',
+        message: 'Potential SQL injection - use parameterized queries'
+      },
+      {
+        id: 'SEC004',
+        name: 'eval() Usage',
+        pattern: /\beval\s*\(/,
+        severity: 'error',
+        message: 'eval() is dangerous and should be avoided'
+      },
+      {
+        id: 'SEC005',
+        name: 'innerHTML Assignment',
+        pattern: /\.innerHTML\s*=/,
+        severity: 'warning',
+        message: 'innerHTML can cause XSS - consider using textContent or sanitization'
+      },
+      {
+        id: 'SEC006',
+        name: 'Disabled Security',
+        pattern: /rejectUnauthorized\s*:\s*false/,
+        severity: 'error',
+        message: 'SSL certificate validation disabled'
+      },
+      {
+        id: 'SEC007',
+        name: 'Exposed .env Reference',
+        pattern: /\.env['"]/,
+        context: /fs\.(read|write)|path\.join/i,
+        severity: 'warning',
+        message: 'Direct .env file manipulation - ensure not exposed'
+      }
+    ];
+
+    // Quality patterns
+    this.qualityPatterns = [
+      {
+        id: 'QUAL001',
+        name: 'Console.log in Production',
+        pattern: /console\.(log|debug|info)\(/,
+        severity: 'info',
+        message: 'console.log found - consider using proper logging',
+        // Only report in non-dev files - skip test files and dev utilities
+        skipInTests: true,
+        skipInDirs: ['test', 'scripts', 'tools', 'dev']
+      },
+      {
+        id: 'QUAL002',
+        name: 'TODO Comment',
+        pattern: /\/\/\s*TODO|\/\*\s*TODO|\*\s*TODO/i,
+        severity: 'info',
+        message: 'TODO comment found - track in issue system'
+      },
+      {
+        id: 'QUAL003',
+        name: 'FIXME Comment',
+        pattern: /\/\/\s*FIXME|\/\*\s*FIXME|\*\s*FIXME/i,
+        severity: 'warning',
+        message: 'FIXME comment found - needs attention'
+      },
+      {
+        id: 'QUAL004',
+        name: 'Empty Catch Block',
+        pattern: /catch\s*\([^)]*\)\s*\{\s*\}/,
+        severity: 'warning',
+        message: 'Empty catch block swallows errors'
+      },
+      {
+        id: 'QUAL005',
+        name: 'Magic Number',
+        // Only flag suspicious numbers, not common ones like ports, timeouts, dates
+        pattern: /(?<![0-9a-zA-Z_])(?!(?:1000|2000|3000|3001|4000|5000|8000|8080|9000|80|443|24|60|1024|2048|4096)\b)\d{5,}(?![0-9])/,
+        severity: 'info',
+        message: 'Magic number detected - consider using named constant',
+        skipInTests: true
+      },
+      {
+        id: 'QUAL006',
+        name: 'Callback Hell',
+        pattern: /\)\s*=>\s*\{[^}]*\)\s*=>\s*\{[^}]*\)\s*=>\s*\{/,
+        severity: 'warning',
+        message: 'Deeply nested callbacks - consider async/await'
+      }
+    ];
+
+    // Performance patterns
+    this.performancePatterns = [
+      {
+        id: 'PERF001',
+        name: 'Sync FS in Async',
+        pattern: /fs\.(readFileSync|writeFileSync|readdirSync|statSync)/,
+        severity: 'warning',
+        message: 'Synchronous file operation - may block event loop'
+      },
+      {
+        id: 'PERF002',
+        name: 'Missing Await',
+        pattern: /async\s+function[^{]*\{[^}]*(?<!await\s)new\s+Promise/,
+        severity: 'warning',
+        message: 'Promise created in async function without await'
+      },
+      {
+        id: 'PERF003',
+        name: 'Loop Database Query',
+        pattern: /for\s*\([^)]*\)\s*\{[^}]*(query|find|select|update)/i,
+        severity: 'error',
+        message: 'Possible N+1 query pattern - consider batch operation'
+      },
+      {
+        id: 'PERF004',
+        name: 'Large Array in Memory',
+        pattern: /new\s+Array\s*\(\s*\d{6,}\s*\)/,
+        severity: 'warning',
+        message: 'Large array allocation - consider streaming'
+      }
+    ];
+
+    // AI-specific patterns
+    this.aiPatterns = [
+      {
+        id: 'AI001',
+        name: 'Potentially Hallucinated Import',
+        pattern: /require\(['"](?!\.)[^'"]+['"]\)/,
+        severity: 'info',
+        message: 'External dependency - verify it exists in package.json',
+        check: (match, content, filePath) => this._checkDependencyExists(match, filePath)
+      },
+      {
+        id: 'AI002',
+        name: 'Unused Import',
+        pattern: /const\s+(\w+)\s*=\s*require\(['"][^'"]+['"]\)/,
+        severity: 'info',
+        message: 'Import may be unused - verify usage',
+        check: (match, content) => this._checkImportUsage(match, content)
+      },
+      {
+        id: 'AI003',
+        name: 'Over-Engineered Pattern',
+        pattern: /class\s+\w+Factory\s*\{|AbstractFactory|Singleton\.getInstance/,
+        severity: 'info',
+        message: 'Complex pattern detected - ensure justified by requirements'
+      }
+    ];
+  }
+
+  /**
+   * Scan all files in the codebase
+   */
+  async scanAll() {
+    console.log('[CODE-SCANNER] Starting full codebase scan...');
+    const startTime = Date.now();
+
+    const result = {
+      filesScanned: 0,
+      issues: [],
+      summary: {},
+      duration: 0
+    };
+
+    try {
+      const files = await this._discoverFiles(this.config.rootPath);
+      console.log(`[CODE-SCANNER] Found ${files.length} files to scan`);
+
+      for (const file of files) {
+        const fileIssues = await this.scanFile(file);
+        result.filesScanned++;
+        result.issues.push(...fileIssues);
+      }
+
+      result.duration = Date.now() - startTime;
+      result.summary = this._summarizeIssues(result.issues);
+
+      console.log(`[CODE-SCANNER] Scan complete: ${result.filesScanned} files, ${result.issues.length} issues`);
+      return result;
+    } catch (error) {
+      console.error('[CODE-SCANNER] Scan failed:', error.message);
+      result.error = error.message;
+      return result;
+    }
+  }
+
+  /**
+   * Scan specific files
+   */
+  async scanFiles(filePaths) {
+    const result = {
+      filesScanned: 0,
+      issues: [],
+      summary: {}
+    };
+
+    for (const filePath of filePaths) {
+      const fileIssues = await this.scanFile(filePath);
+      result.filesScanned++;
+      result.issues.push(...fileIssues);
+    }
+
+    result.summary = this._summarizeIssues(result.issues);
+    return result;
+  }
+
+  /**
+   * Scan a single file
+   */
+  async scanFile(filePath) {
+    const issues = [];
+
+    try {
+      // Check file size
+      const stats = fs.statSync(filePath);
+      if (stats.size > this.config.maxFileSize) {
+        return [{
+          file: filePath,
+          category: 'quality',
+          severity: 'info',
+          id: 'FILE001',
+          message: `File too large (${Math.round(stats.size / 1024)}KB) - skipped detailed scan`
+        }];
+      }
+
+      // Read file content
+      const content = fs.readFileSync(filePath, 'utf8');
+      const lines = content.split('\n');
+      const ext = path.extname(filePath).toLowerCase();
+
+      // Only scan JS/TS files with pattern matching
+      if (['.js', '.ts', '.jsx', '.tsx'].includes(ext)) {
+        // Security scan
+        issues.push(...this._runPatternScan(filePath, content, lines, this.securityPatterns, 'security'));
+
+        // Quality scan
+        issues.push(...this._runPatternScan(filePath, content, lines, this.qualityPatterns, 'quality'));
+
+        // Performance scan
+        issues.push(...this._runPatternScan(filePath, content, lines, this.performancePatterns, 'performance'));
+
+        // AI-specific scan
+        issues.push(...this._runPatternScan(filePath, content, lines, this.aiPatterns, 'ai'));
+
+        // Complexity analysis
+        issues.push(...this._analyzeComplexity(filePath, content, lines));
+
+        // Nesting analysis
+        issues.push(...this._analyzeNesting(filePath, content, lines));
+      }
+
+      // JSON-specific checks
+      if (ext === '.json') {
+        issues.push(...this._scanJson(filePath, content));
+      }
+
+      // Emit event for each issue found
+      for (const issue of issues) {
+        this.emit('issueFound', issue);
+      }
+
+      return issues;
+    } catch (error) {
+      return [{
+        file: filePath,
+        category: 'error',
+        severity: 'error',
+        id: 'SCAN001',
+        message: `Failed to scan file: ${error.message}`
+      }];
+    }
+  }
+
+  /**
+   * Get current scan rules
+   */
+  getRules() {
+    return {
+      security: this.securityPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
+      quality: this.qualityPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
+      performance: this.performancePatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity })),
+      ai: this.aiPatterns.map(p => ({ id: p.id, name: p.name, severity: p.severity }))
+    };
+  }
+
+  // Private methods
+
+  async _discoverFiles(dir, files = []) {
+    try {
+      const entries = fs.readdirSync(dir, { withFileTypes: true });
+
+      for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        const relativePath = path.relative(this.config.rootPath, fullPath);
+
+        // Check ignore patterns
+        if (this._shouldIgnore(relativePath)) {
+          continue;
+        }
+
+        if (entry.isDirectory()) {
+          await this._discoverFiles(fullPath, files);
+        } else if (entry.isFile()) {
+          const ext = path.extname(entry.name).toLowerCase();
+          if (['.js', '.ts', '.jsx', '.tsx', '.json'].includes(ext)) {
+            files.push(fullPath);
+          }
+        }
+      }
+    } catch (error) {
+      // Skip inaccessible directories
+    }
+
+    return files;
+  }
+
+  _shouldIgnore(relativePath) {
+    const normalized = relativePath.replace(/\\/g, '/');
+
+    // Always ignore any path containing these directories (anywhere in path)
+    const alwaysIgnore = ['node_modules', '.git', 'dist', '.vite'];
+    for (const dir of alwaysIgnore) {
+      if (normalized.includes('/' + dir + '/') ||
+          normalized.startsWith(dir + '/') ||
+          normalized === dir ||
+          normalized.endsWith('/' + dir)) {
+        return true;
+      }
+    }
+
+    for (const pattern of this.config.ignorePatterns) {
+      const normalizedPattern = pattern.replace(/\\/g, '/');
+
+      // Extract base directory from pattern (e.g., 'node_modules' from 'node_modules/**')
+      const baseDir = normalizedPattern.split('/')[0].replace(/\*/g, '');
+
+      // Check if path IS the ignored directory or starts with it
+      if (baseDir && (normalized === baseDir || normalized.startsWith(baseDir + '/'))) {
+        return true;
+      }
+
+      // Simple glob matching for more complex patterns
+      let regexPattern = normalizedPattern
+        .replace(/\./g, '\\.')
+        .replace(/\*\*/g, '.*')
+        .replace(/\*/g, '[^/]*');
+
+      if (new RegExp('^' + regexPattern).test(normalized)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  _runPatternScan(filePath, content, lines, patterns, category) {
+    const issues = [];
+
+    // Check if this is a test file
+    const isTestFile = this.testFilePatterns.some(p => p.test(filePath));
+    const relativePath = path.relative(this.config.rootPath, filePath).replace(/\\/g, '/');
+
+    for (const pattern of patterns) {
+      // Skip this pattern entirely in test files if flagged
+      if (pattern.skipInTests && isTestFile) {
+        continue;
+      }
+
+      // Skip if file is in excluded directories
+      if (pattern.skipInDirs) {
+        const inSkippedDir = pattern.skipInDirs.some(dir =>
+          relativePath.startsWith(dir + '/') || relativePath.includes('/' + dir + '/')
+        );
+        if (inSkippedDir) continue;
+      }
+
+      // Check context pattern first if it exists (file-level)
+      if (pattern.context && !pattern.lineContext && !pattern.context.test(content)) {
+        continue;
+      }
+
+      // Find all matches
+      let lineNum = 0;
+      for (const line of lines) {
+        lineNum++;
+        const match = line.match(pattern.pattern);
+
+        if (match) {
+          // Skip if line matches any safe pattern (for SEC001 type checks)
+          if (pattern.skipIfSafe) {
+            const isSafe = this.safePatterns.some(sp => sp.test(line));
+            if (isSafe) continue;
+          }
+
+          // Run additional check if defined
+          if (pattern.check) {
+            const shouldReport = pattern.check(match, content, filePath);
+            if (!shouldReport) continue;
+          }
+
+          issues.push({
+            file: filePath,
+            line: lineNum,
+            column: match.index,
+            category,
+            severity: pattern.severity,
+            id: pattern.id,
+            name: pattern.name,
+            message: pattern.message,
+            code: line.trim().substring(0, 100)
+          });
+        }
+      }
+    }
+
+    return issues;
+  }
+
+  _analyzeComplexity(filePath, content, lines) {
+    const issues = [];
+
+    // Count decision points (simplified cyclomatic complexity)
+    const decisionKeywords = /\b(if|else|for|while|switch|case|catch|&&|\|\||\?)\b/g;
+    const functionMatches = content.match(/function\s+\w+|=>\s*\{|async\s+\w+/g) || [];
+    const decisionMatches = content.match(decisionKeywords) || [];
+
+    const avgComplexity = functionMatches.length > 0
+      ? decisionMatches.length / functionMatches.length
+      : 0;
+
+    if (avgComplexity > this.config.complexityThreshold) {
+      issues.push({
+        file: filePath,
+        category: 'quality',
+        severity: 'warning',
+        id: 'CMPLX001',
+        name: 'High Complexity',
+        message: `Average cyclomatic complexity is ${avgComplexity.toFixed(1)} (threshold: ${this.config.complexityThreshold})`
+      });
+    }
+
+    // Check file length
+    if (lines.length > 500) {
+      issues.push({
+        file: filePath,
+        category: 'quality',
+        severity: 'info',
+        id: 'CMPLX002',
+        name: 'Long File',
+        message: `File has ${lines.length} lines - consider splitting`
+      });
+    }
+
+    return issues;
+  }
+
+  _analyzeNesting(filePath, content, lines) {
+    const issues = [];
+    let maxNesting = 0;
+    let currentNesting = 0;
+    let maxNestingLine = 0;
+
+    let lineNum = 0;
+    for (const line of lines) {
+      lineNum++;
+
+      // Count braces (simplified)
+      const opens = (line.match(/\{/g) || []).length;
+      const closes = (line.match(/\}/g) || []).length;
+
+      currentNesting += opens - closes;
+
+      if (currentNesting > maxNesting) {
+        maxNesting = currentNesting;
+        maxNestingLine = lineNum;
+      }
+    }
+
+    if (maxNesting > this.config.nestingThreshold) {
+      issues.push({
+        file: filePath,
+        line: maxNestingLine,
+        category: 'quality',
+        severity: 'warning',
+        id: 'NEST001',
+        name: 'Deep Nesting',
+        message: `Max nesting depth is ${maxNesting} at line ${maxNestingLine} (threshold: ${this.config.nestingThreshold})`
+      });
+    }
+
+    return issues;
+  }
+
+  _scanJson(filePath, content) {
+    const issues = [];
+
+    try {
+      JSON.parse(content);
+    } catch (error) {
+      issues.push({
+        file: filePath,
+        category: 'quality',
+        severity: 'error',
+        id: 'JSON001',
+        name: 'Invalid JSON',
+        message: `JSON parse error: ${error.message}`
+      });
+    }
+
+    // Check for sensitive data in JSON
+    if (/(password|secret|api[_-]?key|token)/i.test(content)) {
+      issues.push({
+        file: filePath,
+        category: 'security',
+        severity: 'warning',
+        id: 'JSON002',
+        name: 'Sensitive Data in JSON',
+        message: 'Possible sensitive data in JSON file - verify not committed'
+      });
+    }
+
+    return issues;
+  }
+
+  _checkDependencyExists(match, filePath) {
+    // Extract module name
+    const moduleMatch = match[0].match(/require\(['"]([^'"]+)['"]\)/);
+    if (!moduleMatch) return true;
+
+    const moduleName = moduleMatch[1];
+
+    // Skip relative imports
+    if (moduleName.startsWith('.')) return false;
+
+    // Skip Node built-ins
+    const builtins = ['fs', 'path', 'os', 'crypto', 'http', 'https', 'events', 'util', 'stream', 'child_process', 'url', 'querystring', 'buffer'];
+    if (builtins.includes(moduleName.split('/')[0])) return false;
+
+    // Check package.json
+    try {
+      let pkgPath = path.join(this.config.rootPath, 'package.json');
+
+      // Also check server/package.json for server files
+      if (filePath.includes('server')) {
+        const serverPkgPath = path.join(this.config.rootPath, 'server', 'package.json');
+        if (fs.existsSync(serverPkgPath)) {
+          pkgPath = serverPkgPath;
+        }
+      }
+
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      const allDeps = {
+        ...(pkg.dependencies || {}),
+        ...(pkg.devDependencies || {})
+      };
+
+      const baseModule = moduleName.split('/')[0];
+      return !allDeps[baseModule] && !allDeps[moduleName];
+    } catch (e) {
+      return false;
+    }
+  }
+
+  _checkImportUsage(match, content) {
+    const varName = match[1];
+    if (!varName) return false;
+
+    // Count occurrences (beyond the require line)
+    const regex = new RegExp('\\b' + varName + '\\b', 'g');
+    const occurrences = (content.match(regex) || []).length;
+
+    // If only appears once (the require), it's unused
+    return occurrences <= 1;
+  }
+
+  _summarizeIssues(issues) {
+    return {
+      total: issues.length,
+      bySeverity: {
+        critical: issues.filter(i => i.severity === 'critical').length,
+        error: issues.filter(i => i.severity === 'error').length,
+        warning: issues.filter(i => i.severity === 'warning').length,
+        info: issues.filter(i => i.severity === 'info').length
+      },
+      byCategory: issues.reduce((acc, i) => {
+        acc[i.category] = (acc[i.category] || 0) + 1;
+        return acc;
+      }, {}),
+      topFiles: this._getTopFiles(issues, 10)
+    };
+  }
+
+  _getTopFiles(issues, limit) {
+    const fileCounts = issues.reduce((acc, i) => {
+      acc[i.file] = (acc[i.file] || 0) + 1;
+      return acc;
+    }, {});
+
+    return Object.entries(fileCounts)
+      .sort((a, b) => b[1] - a[1])
+      .slice(0, limit)
+      .map(([file, count]) => ({ file: path.relative(this.config.rootPath, file), count }));
+  }
+}
+
+module.exports = CodeScanner;