thuban 0.4.7 → 0.4.9

package/packages/scanner/widget-generator.js

@@ -0,0 +1 @@
+const fs=require("fs"),path=require("path"),crypto=require("crypto"),DependencyGraph=require("./dependency-graph");function computeDna(e){const t=e.replace(/\r\n/g,"\n").split("\n").map(e=>e.replace(/\s+$/,"")).filter(e=>e.length>0).join("\n");return crypto.createHash("sha256").update(t).digest("hex").slice(0,16)}class WidgetGenerator{constructor(e={}){this.config={rootPath:e.rootPath||process.cwd(),dryRun:!1!==e.dryRun,...e},this.dependencyGraph=e.dependencyGraph||null,this.modulePatterns={sentinel:/^sentinel[\\\/]/,citadel:/^citadel[\\\/]/,forge:/^forge[\\\/]/,server:/^server[\\\/]/,"build-engine":/^build-engine[\\\/]/,autopilot:/^autopilot[\\\/]/,silverwings:/^silverwings[\\\/]/,output:/^output[\\\/]/},this.layerPatterns={presentation:/routes|api|handlers|controllers|views/i,application:/service|manager|orchestrat|core|engine/i,domain:/model|entity|domain|types/i,infrastructure:/utils|helpers|lib|data|store|memory/i},this.sideEffectPatterns=[{pattern:/fs\.(write|append|unlink|mkdir|rmdir|rename)/i,effect:"File system writes"},{pattern:/fs\.read/i,effect:"File system reads"},{pattern:/fetch\(|axios\.|http\.|https\./i,effect:"HTTP requests"},{pattern:/process\.exit/i,effect:"Process termination"},{pattern:/child_process|spawn|exec\(/i,effect:"Spawns child processes"},{pattern:/console\.(log|error|warn)/i,effect:"Console output"},{pattern:/\.emit\(|EventEmitter/i,effect:"Event emission"},{pattern:/supabase|createClient/i,effect:"Database operations"},{pattern:/twilio|sendgrid|resend/i,effect:"External API calls"}],this.purposePatterns=[{pattern:/class\s+(\w+).*extends.*Router/i,purpose:e=>`Express router for ${e[1]}`},{pattern:/class\s+(\w+).*extends.*EventEmitter/i,purpose:e=>`Event-driven ${e[1]} component`},{pattern:/class\s+(\w+)/i,purpose:e=>`${e[1]} class implementation`},{pattern:/module\.exports\s*=\s*\{([^}]+)\}/i,purpose:e=>`Exports: ${e[1].match(/\w+/g)?.slice(0,5).join(", ")}`},{pattern:/router\.(get|post|put|delete)/i,purpose:()=>"API route handlers"},{pattern:/async function\s+(\w+)/i,purpose:e=>`Provides ${e[1]} functionality`},{pattern:/function\s+(\w+)/i,purpose:e=>`Provides ${e[1]} functionality`}]}async generateAll(){console.log("[WIDGET-GENERATOR] Starting widget generation..."),this.dependencyGraph||(this.dependencyGraph=new DependencyGraph({rootPath:this.config.rootPath}),await this.dependencyGraph.build());const e=await this._discoverFiles(this.config.rootPath),t={total:e.length,generated:0,skipped:0,alreadyHasWidget:0,widgets:[]};for(const s of e){const e=fs.readFileSync(s,"utf8");if(this._hasWidget(e)){t.alreadyHasWidget++;continue}const r=await this.generateWidget(s,e);t.generated++,t.widgets.push({file:s,relativePath:path.relative(this.config.rootPath,s),widget:r}),this.config.dryRun||await this._applyWidget(s,e,r)}return console.log(`[WIDGET-GENERATOR] Generated ${t.generated} widgets (${t.alreadyHasWidget} already had widgets)`),t}async generateWidget(e,t=null){t||(t=fs.readFileSync(e,"utf8"));const s=path.relative(this.config.rootPath,e),r=path.basename(e,path.extname(e)),i={purpose:this._detectPurpose(t,r,s),module:this._detectModule(s),layer:this._detectLayer(s,t),importsFrom:this._getImportsFrom(e),exportsTo:this._getExportsTo(e),sideEffects:this._detectSideEffects(t),criticalFor:this._detectCriticalFor(e),dna:computeDna(t)};return{analysis:i,widgetString:this._buildWidgetString(i,r),fileName:r,relativePath:s}}async preview(e=20){const t=await this.generateAll();console.log("\n"+"=".repeat(70)),console.log("WIDGET GENERATION PREVIEW"),console.log("=".repeat(70)),console.log(`Total files: ${t.total}`),console.log(`Already have widgets: ${t.alreadyHasWidget}`),console.log(`Will generate: ${t.generated}`),console.log("");for(const s of t.widgets.slice(0,e))console.log("-".repeat(70)),console.log(`FILE: ${s.relativePath}`),console.log("-".repeat(70)),console.log(s.widget.widgetString),console.log("");return t.widgets.length>e&&console.log(`... and ${t.widgets.length-e} more files`),t}async apply(){this.config.dryRun=!1;const e=await this.generateAll();return console.log(`[WIDGET-GENERATOR] Applied ${e.generated} widgets to files`),e}_hasWidget(e){return/\/\*\*[\s\S]*?@(purpose|module|layer)[\s\S]*?\*\//.test(e)}_detectPurpose(e,t,s){for(const{pattern:t,purpose:s}of this.purposePatterns){const r=e.match(t);if(r)return"function"==typeof s?s(r):s}const r=t.replace(/[-_]/g," ").replace(/([A-Z])/g," $1").trim();return t.includes("route")?`Route handlers for ${r}`:t.includes("api")?`API endpoints for ${r}`:t.includes("service")?`Service layer for ${r}`:t.includes("manager")?`Manager for ${r}`:t.includes("store")?`State store for ${r}`:t.includes("util")?`Utility functions for ${r}`:t.includes("helper")?`Helper functions for ${r}`:t.includes("test")?`Tests for ${r}`:t.includes("config")?`Configuration for ${r}`:t.includes("index")?`Entry point for ${path.dirname(s).split(path.sep).pop()}`:`Provides ${r} functionality`}_detectModule(e){const t=e.replace(/\\/g,"/");for(const[e,s]of Object.entries(this.modulePatterns))if(s.test(t))return e;return t.split("/")[0]||"root"}_detectLayer(e,t){for(const[t,s]of Object.entries(this.layerPatterns))if(s.test(e))return t;return/router\.(get|post|put|delete)|app\.(get|post)/i.test(t)?"presentation":/class.*Service|class.*Manager/i.test(t)?"application":/class.*Model|schema|entity/i.test(t)?"domain":"application"}_getImportsFrom(e){if(!this.dependencyGraph)return[];const t=this.dependencyGraph.getDependencies(e),s=[];for(const e of t.slice(0,10))if(e.resolved){const t=path.relative(this.config.rootPath,e.resolved).split(path.sep),r=t[0],i=t[t.length-1];s.push(`${r}/${i}`)}else e.module.startsWith(".")||s.push(e.module);return s}_getExportsTo(e){if(!this.dependencyGraph)return[];const t=this.dependencyGraph.getDependents(e),s=[];for(const e of t.slice(0,10)){const t=path.relative(this.config.rootPath,e).split(path.sep)[0];s.push(t)}return[...new Set(s)]}_detectSideEffects(e){const t=[];for(const{pattern:s,effect:r}of this.sideEffectPatterns)s.test(e)&&t.push(r);return t.length>0?t:["None detected"]}_detectCriticalFor(e){if(!this.dependencyGraph)return[];const t=this.dependencyGraph.getImpactAnalysis(e);return"critical"===t.riskLevel?[`CRITICAL: ${t.totalImpact} files depend on this`]:"high"===t.riskLevel?[`High impact: ${t.totalImpact} files depend on this`]:t.affectedModules.length>0?t.affectedModules.slice(0,5):[]}_buildWidgetString(e,t){const s=["/**",` * ${this._toTitleCase(t)}`," *",` * @purpose ${e.purpose}`,` * @module ${e.module}`,` * @layer ${e.layer}`];return e.importsFrom.length>0&&s.push(` * @imports-from ${e.importsFrom.join(", ")}`),e.exportsTo.length>0&&s.push(` * @exports-to ${e.exportsTo.join(", ")}`),s.push(` * @side-effects ${e.sideEffects.join(", ")}`),e.criticalFor.length>0&&s.push(` * @critical-for ${e.criticalFor.join(", ")}`),e.dna&&s.push(` * @dna ${e.dna}`),s.push(" */"),s.join("\n")}_toTitleCase(e){return e.replace(/[-_]/g," ").replace(/([A-Z])/g," $1").trim().split(" ").map(e=>e.charAt(0).toUpperCase()+e.slice(1).toLowerCase()).join(" ")}async _applyWidget(e,t,s){const r=s.widgetString+"\n\n"+t;try{return fs.writeFileSync(e,r,"utf8"),!0}catch(e){return console.error("[WIDGET-GENERATOR] Failed to write widget"),!1}}async _discoverFiles(e,t=[]){const s=["node_modules",".git","dist",".vite",".orion"];try{const r=fs.readdirSync(e,{withFileTypes:!0});for(const i of r){if(s.some(e=>i.name===e||i.name.startsWith(e)))continue;const r=path.join(e,i.name);i.isDirectory()?await this._discoverFiles(r,t):i.isFile()&&i.name.endsWith(".js")&&t.push(r)}}catch(e){}return t}}module.exports=WidgetGenerator,module.exports.computeDna=computeDna;

package/dist/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Silverwings Benefits Ltd
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/README.md

@@ -1,437 +0,0 @@
-# Thuban -- Code Intelligence Scanner
-
-[![npm version](https://img.shields.io/npm/v/thuban.svg)](https://www.npmjs.com/package/thuban)
-[![license](https://img.shields.io/npm/l/thuban.svg)](LICENSE)
-[![tests](https://img.shields.io/badge/tests-746%20passing-brightgreen.svg)](#testing)
-[![coverage](https://img.shields.io/badge/coverage-91.2%25-brightgreen.svg)](#testing)
-
-AI Code Verification — Catch what AI gets wrong.
-
-Static analysis, security scanning, dead code detection, clone detection, AI-generated code scoring, dependency analysis, and mutation testing for 12 languages. One command. Zero runtime dependencies beyond `@babel/parser`.
-
----
-
-## Quick Start
-
-```bash
-npm install -g thuban
-thuban scan .
-```
-
-Or run without installing:
-
-```bash
-npx thuban scan .
-```
-
-JSON output for CI pipelines:
-
-```bash
-thuban scan . --json
-```
-
----
-
-## Feature Highlights
-
-### Security Analysis
-
-84 detection rules across multiple categories. Cross-file taint tracking follows user input from sources (`req.query`, `req.body`, `req.params`, `process.argv`, `process.env`) through assignment, concatenation, and template interpolation to dangerous SQL and XSS sinks -- across file boundaries via `require()`, `import`, destructured imports, and re-exports.
-
-```bash
-thuban scan src/ --json
-```
-
-### OWASP Top 10 & CWE Compliance
-
-All security rules (SEC001--SEC019, RUST001--RUST002) map to [OWASP Top 10 2021](https://owasp.org/Top10/) categories and [CWE](https://cwe.mitre.org/) identifiers. Every finding includes machine-readable `owasp` and `cwe` fields in JSON output, enabling direct integration with compliance dashboards and vulnerability management systems.
-
-| OWASP 2021 Category                    | Rules                                  | CWEs                              |
-|-----------------------------------------|----------------------------------------|-----------------------------------|
-| A01 Broken Access Control               | SEC005, SEC013, SEC014                 | CWE-22, CWE-942, CWE-601         |
-| A02 Cryptographic Failures              | SEC006, SEC007, SEC008, SEC016         | CWE-798, CWE-327, CWE-330, CWE-208 |
-| A03 Injection                           | SEC001, SEC002, SEC003, SEC004, SEC009, SEC011, SEC018, SEC019 | CWE-95, CWE-79, CWE-89, CWE-78, CWE-1321 |
-| A04 Insecure Design                     | SEC015                                 | CWE-209                          |
-| A05 Security Misconfiguration           | SEC017                                 | CWE-611                          |
-| A06 Vulnerable Components               | RUST001, RUST002                       | CWE-908, CWE-477                 |
-| A08 Software and Data Integrity         | SEC012                                 | CWE-502                          |
-| A10 SSRF                                | SEC010                                 | CWE-918                          |
-
-### Control Flow Graph Analysis
-
-Detects unreachable code, infinite loops, and dead branches through AST-based control flow graph construction.
-
-### Clone Detection
-
-Multi-language code clone detection with AST normalization. Finds duplicated logic across your codebase.
-
-```bash
-thuban clones src/
-```
-
-### AI-Generated Code Scoring
-
-Scores files for likelihood of AI generation based on structural patterns, naming conventions, and code smells common in LLM output.
-
-```bash
-thuban aiscore src/
-```
-
-### Dependency Analysis
-
-Maps dependency graphs, detects circular imports, and identifies unused or phantom dependencies.
-
-```bash
-thuban deps .
-```
-
-### Mutation Testing (Crucible)
-
-Built-in mutation testing engine. 515 seed files generate 1,030 mutations. Validates that your test suite catches real bugs.
-
-```bash
-thuban crucible --mode kenny    # standard mode
-thuban crucible --mode hell     # maximum mutation density
-```
-
-### Ghost Code Detection
-
-Finds dead exports, unused functions, and unreachable modules.
-
-```bash
-thuban ghosts src/
-```
-
-### Auto-Fix
-
-Automatically applies safe fixes for supported rule violations.
-
-```bash
-thuban fix src/
-```
-
-### HTML Dashboard
-
-Generates a visual HTML report with charts, trends, and drill-down by category.
-
-```bash
-thuban dashboard .
-```
-
-### Executive Reports
-
-PDF-ready executive summary with risk scores, trend data, and remediation priorities.
-
-```bash
-thuban executive .
-thuban pdf .
-```
-
-### Baseline Scanning
-
-Establish a baseline and track only new issues introduced after that point.
-
-```bash
-thuban baseline .          # save current state
-thuban scan . --baseline   # report only new issues
-thuban compare .           # compare current scan to baseline
-```
-
-### Pre-Commit Gate
-
-Block commits that introduce issues above a configurable threshold.
-
-```bash
-thuban gate .
-```
-
-### Inline Suppression
-
-Suppress specific rules on a per-line basis:
-
-```javascript
-const query = "SELECT * FROM " + input; // thuban-ignore SEC001
-```
-
-```python
-password = "admin123"  # thuban-ignore SEC005
-```
-
-Suppress all rules on a line:
-
-```javascript
-eval(code); // thuban-ignore
-```
-
----
-
-## Supported Languages
-
-| Language   | Extension(s)         | AST Engine     |
-|------------|----------------------|----------------|
-| JavaScript | `.js`, `.mjs`, `.cjs`| Babel          |
-| TypeScript | `.ts`                | Babel          |
-| JSX        | `.jsx`               | Babel          |
-| TSX        | `.tsx`               | Babel          |
-| Python     | `.py`                | Python `ast`   |
-| Go         | `.go`                | `go/parser`    |
-| Rust       | `.rs`                | Pattern-based  |
-| Ruby       | `.rb`                | Pattern-based  |
-| Java       | `.java`              | Pattern-based  |
-| C#         | `.cs`                | Pattern-based  |
-| Kotlin     | `.kt`                | Pattern-based  |
-| PHP        | `.php`               | Pattern-based  |
-
-Three AST engines provide deep analysis: Babel for JavaScript/TypeScript/JSX/TSX, Python `ast` for Python, and Go `go/parser` for Go. Remaining languages use pattern-based detection.
-
----
-
-## Detection Rules
-
-84 rules organized by category:
-
-| Category    | Rule IDs              | Description                                      |
-|-------------|-----------------------|--------------------------------------------------|
-| Security    | SEC001--SEC019        | SQL injection, XSS, hardcoded secrets, eval, command injection, path traversal, insecure crypto, SSRF, prototype pollution, and more |
-| Security    | RUST001--RUST002      | Rust-specific unsafe patterns                    |
-| Quality     | QUAL001--QUAL004      | Code quality, naming, structure                  |
-| Performance | PERF001               | Performance anti-patterns                        |
-| AST         | AST001--AST005        | Phantom imports, deprecated APIs, unused variables, hallucinated APIs, empty catch blocks |
-| AST         | AST011--AST014        | Advanced AST patterns                            |
-| Taint       | TAINT001--TAINT002    | Cross-file taint tracking for SQLi and XSS       |
-| CFG         | CFG001--CFG005        | Unreachable code, infinite loops, dead branches  |
-| Nesting     | NEST001               | Excessive nesting depth                          |
-| Complexity  | CMPLX001--CMPLX002   | Cyclomatic and cognitive complexity              |
-
----
-
-## CLI Commands
-
-28 commands grouped by function:
-
-### Core Scanning
-
-| Command       | Description                                      |
-|---------------|--------------------------------------------------|
-| `scan [path]` | Scan a codebase for issues                       |
-| `diff [path]` | Scan only git-changed files                      |
-| `deps [path]` | Map dependencies and detect circular imports     |
-| `health [path]`| Run health check on codebase                    |
-| `report [path]`| Full scan + deps + drift combined report        |
-
-### Detection
-
-| Command              | Description                                |
-|----------------------|--------------------------------------------|
-| `hallucinate [path]` | Detect AI hallucinations and phantom imports|
-| `ghosts [path]`      | Detect dead code and unused exports        |
-| `aiscore [path]`     | Score files for AI-generated code patterns |
-| `clones [path]`      | Detect code clones across the codebase     |
-| `drift [path]`       | Detect drift from Mother Code annotations  |
-| `debt [path]`        | Analyze technical debt                     |
-| `cost [path]`        | Calculate technical debt cost              |
-
-### Remediation
-
-| Command       | Description                                      |
-|---------------|--------------------------------------------------|
-| `fix [path]`  | Auto-fix supported rule violations               |
-| `inject [path]`| Inject Mother Code DNA widget into files        |
-| `gate [path]` | Pre-commit quality gate                          |
-
-### Reporting
-
-| Command            | Description                                   |
-|--------------------|-----------------------------------------------|
-| `dashboard [path]` | Generate visual HTML dashboard                |
-| `executive [path]` | Generate executive summary report             |
-| `pdf [path]`       | Generate PDF-ready report                     |
-| `passport [path]`  | Generate codebase passport                    |
-
-### Monitoring
-
-| Command          | Description                                     |
-|------------------|-------------------------------------------------|
-| `watch [path]`   | Live sentinel -- continuous file monitoring     |
-| `monitor [path]` | Recurring scans with history and alerts         |
-| `history [path]` | View recurring scan history                     |
-| `trend [path]`   | Show issue trends across scans                  |
-
-### Baseline and Comparison
-
-| Command          | Description                                     |
-|------------------|-------------------------------------------------|
-| `baseline [path]`| Save current scan state as baseline             |
-| `compare [path]` | Compare current scan against baseline           |
-
-### Licensing
-
-| Command    | Description                                          |
-|------------|------------------------------------------------------|
-| `activate` | Activate a license key                               |
-| `status`   | Show current license status                          |
-| `upgrade`  | Upgrade license tier                                 |
-
-### Mutation Testing
-
-| Command    | Description                                          |
-|------------|------------------------------------------------------|
-| `crucible` | Run the Crucible mutation testing engine             |
-
----
-
-## Configuration
-
-### `.thubanrc.json`
-
-Place a `.thubanrc.json` in your project root to configure scan behavior:
-
-```json
-{
-  "$schema": "https://thuban.dev/schema/thubanrc.json",
-  "minScore": 0,
-  "ignore": [
-    "node_modules",
-    "dist",
-    ".git",
-    "coverage"
-  ],
-  "hallucination": {
-    "enabled": true,
-    "ignore": []
-  },
-  "motherCode": {
-    "enabled": true,
-    "autoInject": false
-  },
-  "report": {
-    "format": "html",
-    "outputDir": "."
-  },
-  "ci": {
-    "failOnGrade": "F",
-    "postComment": true
-  }
-}
-```
-
-### `.thubanignore`
-
-Exclude files and directories from scanning, one glob pattern per line:
-
-```
-packages/crucible/seeds/**
-tests/regression/fixtures/**
-vendor/**
-```
-
----
-
-## JSON Output
-
-All scan commands support `--json` for machine-readable output:
-
-```bash
-thuban scan src/ --json
-```
-
-```json
-{
-  "version": "0.4.5",
-  "timestamp": "2026-07-04T12:00:00.000Z",
-  "files": 42,
-  "issues": [
-    {
-      "file": "src/api/handler.js",
-      "line": 17,
-      "rule": "SEC001",
-      "severity": "critical",
-      "category": "security",
-      "message": "Potential SQL injection: unsanitized input in query string",
-      "fix": "Use parameterized queries instead of string concatenation"
-    }
-  ],
-  "summary": {
-    "critical": 1,
-    "warning": 3,
-    "info": 5,
-    "score": 72,
-    "grade": "C"
-  }
-}
-```
-
----
-
-## Performance
-
-| Metric         | Value              |
-|----------------|--------------------|
-| Throughput     | ~23,000 lines/sec  |
-| Test suite     | 746 tests          |
-| Code coverage  | 91.2%              |
-| Dependencies   | 1 (`@babel/parser`) |
-
----
-
-## Tiers
-
-| Tier       | Limit     | Features                                          |
-|------------|-----------|---------------------------------------------------|
-| Free       | 100 files | Core scanning, all 84 rules, JSON output          |
-| Pro        | Unlimited | Recurring scans, history, trends, notifications   |
-| Team       | Unlimited | Dashboard, executive reports, baseline management |
-| Enterprise | Unlimited | Custom rules, priority support, SSO               |
-
-Activate a license:
-
-```bash
-thuban activate <license-key>
-thuban status
-```
-
----
-
-## CI Integration
-
-### GitHub Actions
-
-```yaml
-- name: Thuban Scan
-  run: npx thuban scan . --json --baseline
-  env:
-    THUBAN_LICENSE: ${{ secrets.THUBAN_LICENSE }}
-```
-
-### Pre-Commit Hook
-
-```bash
-thuban gate . --fail-on critical
-```
-
----
-
-## Requirements
-
-- Node.js >= 16.0.0
-
----
-
-## Contributing
-
-1. Fork the repository
-2. Create a feature branch (`git checkout -b feature/my-feature`)
-3. Run the test suite (`npm test`)
-4. Submit a pull request
-
-Issues and feature requests: [github.com/SilverwingsBenefitsGit/thuban/issues](https://github.com/SilverwingsBenefitsGit/thuban/issues)
-
----
-
-## License
-
-[MIT](LICENSE)
-
----
-
-[thuban.dev](https://thuban.dev)