vettcode-cli 1.0.0

package/dist/ast-extractor.js

@@ -0,0 +1,519 @@
+"use strict";
+/**
+ * AST-based Code Extraction
+ * Intelligently extracts only high-risk code sections to send to AI
+ * This reduces token usage by 70-90% while maintaining accuracy
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractHighRiskCode = extractHighRiskCode;
+exports.shouldAnalyzeFile = shouldAnalyzeFile;
+const parser = __importStar(require("@babel/parser"));
+const traverse_1 = __importDefault(require("@babel/traverse"));
+// High-risk patterns that indicate code should be analyzed by AI
+const RISK_INDICATORS = {
+    // Security-sensitive operations (cross-language)
+    userInput: [
+        // JavaScript/TypeScript
+        "req.body", "req.query", "req.params", "request.body", "params", "searchParams",
+        // Python
+        "request.form", "request.args", "request.json", "input(", "sys.argv",
+        // Java
+        "getParameter", "getInputStream", "getReader", "Scanner",
+        // PHP
+        "$_GET", "$_POST", "$_REQUEST", "$_COOKIE", "$_SERVER",
+        // Go
+        "r.FormValue", "r.PostFormValue", "r.URL.Query",
+        // Ruby
+        "params[", "request.params", "gets",
+        // C#
+        "Request.Form", "Request.QueryString", "Console.ReadLine",
+    ],
+    database: [
+        // JavaScript/TypeScript
+        "query", "execute", "findOne", "findMany", "create", "update", "delete", "raw",
+        // Python
+        "cursor.execute", "session.query", "filter", "get", "all()",
+        // Java
+        "executeQuery", "executeUpdate", "prepareStatement", "createQuery",
+        // PHP
+        "mysqli_query", "mysql_query", "PDO", "->query", "->exec",
+        // Go
+        "db.Query", "db.Exec", "db.QueryRow",
+        // Ruby
+        "ActiveRecord", ".find", ".where", ".create",
+        // C#
+        "ExecuteReader", "ExecuteNonQuery", "SqlCommand",
+    ],
+    fileSystem: [
+        // JavaScript/TypeScript
+        "readFile", "writeFile", "unlink", "rmdir", "mkdir", "createReadStream",
+        // Python
+        "open(", "os.remove", "os.rmdir", "shutil", "pathlib",
+        // Java
+        "FileReader", "FileWriter", "Files.read", "Files.write",
+        // PHP
+        "fopen", "file_get_contents", "file_put_contents", "unlink",
+        // Go
+        "os.Open", "os.Create", "ioutil.ReadFile", "os.Remove",
+        // Ruby
+        "File.open", "File.read", "File.write", "File.delete",
+        // C#
+        "File.Read", "File.Write", "File.Delete", "StreamReader",
+    ],
+    network: [
+        // JavaScript/TypeScript
+        "fetch", "axios", "http.request", "https.request",
+        // Python
+        "requests.", "urllib", "httplib", "http.client",
+        // Java
+        "HttpURLConnection", "HttpClient", "RestTemplate",
+        // PHP
+        "curl_", "file_get_contents", "fopen('http",
+        // Go
+        "http.Get", "http.Post", "http.Client",
+        // Ruby
+        "Net::HTTP", "open-uri", "RestClient",
+        // C#
+        "HttpClient", "WebRequest", "HttpWebRequest",
+    ],
+    auth: [
+        // Cross-language
+        "sign", "verify", "hash", "compare", "authenticate", "authorize", "session",
+        "password", "token", "jwt", "oauth", "login", "logout",
+        // Python
+        "hashlib", "bcrypt", "passlib",
+        // Java
+        "MessageDigest", "BCrypt", "PasswordEncoder",
+        // PHP
+        "password_hash", "password_verify", "md5", "sha1",
+        // Go
+        "bcrypt.Generate", "bcrypt.Compare",
+        // Ruby
+        "BCrypt", "Devise",
+        // C#
+        "PasswordHasher", "SignInManager",
+    ],
+    crypto: [
+        "createHash", "createCipher", "randomBytes", "pbkdf2", "encrypt", "decrypt",
+        "AES", "RSA", "crypto", "cipher",
+    ],
+    exec: [
+        // JavaScript/TypeScript
+        "exec", "spawn", "execSync", "spawnSync", "child_process",
+        // Python
+        "os.system", "subprocess", "exec(", "eval(",
+        // Java
+        "Runtime.exec", "ProcessBuilder",
+        // PHP
+        "exec(", "shell_exec", "system(", "passthru",
+        // Go
+        "exec.Command", "os.StartProcess",
+        // Ruby
+        "system(", "exec(", "`", "%x",
+        // C#
+        "Process.Start", "ProcessStartInfo",
+    ],
+    // Code quality indicators
+    complexity: ["if", "else", "switch", "for", "while", "catch"],
+    async: ["async", "await", "Promise", ".then", ".catch", "goroutine", "channel"],
+};
+function detectLanguage(filepath) {
+    // JavaScript/TypeScript
+    if (/\.tsx?$/.test(filepath))
+        return "typescript";
+    if (/\.jsx?$/.test(filepath))
+        return "javascript";
+    // Python
+    if (/\.pyw?$/.test(filepath))
+        return "python";
+    // Java
+    if (/\.java$/.test(filepath))
+        return "java";
+    // PHP
+    if (/\.php[345]?$/.test(filepath))
+        return "php";
+    // Go
+    if (/\.go$/.test(filepath))
+        return "go";
+    // Ruby
+    if (/\.(rb|rake)$/.test(filepath))
+        return "ruby";
+    // C#
+    if (/\.cs$/.test(filepath))
+        return "csharp";
+    // C/C++
+    if (/\.(c|cpp|cc|cxx|h|hpp|hxx)$/.test(filepath))
+        return "cpp";
+    // Rust
+    if (/\.rs$/.test(filepath))
+        return "rust";
+    // Kotlin
+    if (/\.kts?$/.test(filepath))
+        return "kotlin";
+    // Swift
+    if (/\.swift$/.test(filepath))
+        return "swift";
+    // Scala
+    if (/\.scala$/.test(filepath))
+        return "scala";
+    return "unknown";
+}
+function calculateRiskScore(code) {
+    const factors = [];
+    let score = 0;
+    // Check for risk indicators
+    if (RISK_INDICATORS.userInput.some(p => code.includes(p))) {
+        factors.push("handles-user-input");
+        score += 3;
+    }
+    if (RISK_INDICATORS.database.some(p => code.includes(p))) {
+        factors.push("database-operation");
+        score += 3;
+    }
+    if (RISK_INDICATORS.fileSystem.some(p => code.includes(p))) {
+        factors.push("file-system-access");
+        score += 2;
+    }
+    if (RISK_INDICATORS.auth.some(p => code.includes(p))) {
+        factors.push("authentication-logic");
+        score += 4;
+    }
+    if (RISK_INDICATORS.crypto.some(p => code.includes(p))) {
+        factors.push("cryptography");
+        score += 2;
+    }
+    if (RISK_INDICATORS.exec.some(p => code.includes(p))) {
+        factors.push("command-execution");
+        score += 4;
+    }
+    if (RISK_INDICATORS.network.some(p => code.includes(p))) {
+        factors.push("network-request");
+        score += 1;
+    }
+    // Check complexity
+    const ifCount = (code.match(/\bif\s*\(/g) || []).length;
+    const loopCount = (code.match(/\b(for|while)\s*\(/g) || []).length;
+    const tryCount = (code.match(/\btry\s*\{/g) || []).length;
+    if (ifCount > 3) {
+        factors.push("high-cyclomatic-complexity");
+        score += 1;
+    }
+    if (loopCount > 2) {
+        factors.push("nested-loops");
+        score += 1;
+    }
+    if (tryCount === 0 && RISK_INDICATORS.async.some(p => code.includes(p))) {
+        // Check if try-catch actually surrounds async operations, not just in comments/strings
+        const hasAsyncInTry = /try\s*\{[\s\S]*?(?:await|async|Promise)/.test(code);
+        if (!hasAsyncInTry && RISK_INDICATORS.async.some(p => code.includes(p))) {
+            factors.push("missing-error-handling");
+            score += 2;
+        }
+    }
+    return { score, factors };
+}
+function extractHighRiskCode(filepath, content) {
+    const language = detectLanguage(filepath);
+    // For non-JS/TS files, use simple pattern matching
+    if (language !== "javascript" && language !== "typescript") {
+        return extractWithPatterns(filepath, content, language);
+    }
+    try {
+        const sections = [];
+        const ast = parser.parse(content, {
+            sourceType: "module",
+            plugins: [
+                "typescript",
+                "jsx",
+                "decorators-legacy",
+                "classProperties",
+                "objectRestSpread",
+                "asyncGenerators",
+                "dynamicImport",
+                "optionalChaining",
+                "nullishCoalescingOperator",
+            ],
+            errorRecovery: true,
+        });
+        const lines = content.split("\n");
+        (0, traverse_1.default)(ast, {
+            // Extract functions
+            FunctionDeclaration(path) {
+                const node = path.node;
+                if (!node.loc)
+                    return;
+                const funcCode = lines.slice(node.loc.start.line - 1, node.loc.end.line).join("\n");
+                const { score, factors } = calculateRiskScore(funcCode);
+                if (score >= 2) {
+                    sections.push({
+                        type: "function",
+                        name: node.id?.name || "anonymous",
+                        code: funcCode,
+                        startLine: node.loc.start.line,
+                        endLine: node.loc.end.line,
+                        riskFactors: factors,
+                        context: `Function: ${node.id?.name || "anonymous"}`,
+                    });
+                }
+            },
+            // Extract arrow functions and methods
+            ArrowFunctionExpression(path) {
+                const node = path.node;
+                if (!node.loc)
+                    return;
+                const funcCode = lines.slice(node.loc.start.line - 1, node.loc.end.line).join("\n");
+                const { score, factors } = calculateRiskScore(funcCode);
+                if (score >= 2) {
+                    const parent = path.parent;
+                    let name = "anonymous";
+                    if (parent.type === "VariableDeclarator" && parent.id.type === "Identifier") {
+                        name = parent.id.name;
+                    }
+                    sections.push({
+                        type: "arrow-function",
+                        name,
+                        code: funcCode,
+                        startLine: node.loc.start.line,
+                        endLine: node.loc.end.line,
+                        riskFactors: factors,
+                        context: `Arrow function: ${name}`,
+                    });
+                }
+            },
+            // Extract class methods
+            ClassMethod(path) {
+                const node = path.node;
+                if (!node.loc)
+                    return;
+                const methodCode = lines.slice(node.loc.start.line - 1, node.loc.end.line).join("\n");
+                const { score, factors } = calculateRiskScore(methodCode);
+                if (score >= 2) {
+                    const className = path.parentPath.parent.type === "ClassDeclaration"
+                        ? path.parentPath.parent.id?.name
+                        : "Anonymous";
+                    const methodName = node.key.type === "Identifier" ? node.key.name : "unknown";
+                    sections.push({
+                        type: "class-method",
+                        name: `${className}.${methodName}`,
+                        code: methodCode,
+                        startLine: node.loc.start.line,
+                        endLine: node.loc.end.line,
+                        riskFactors: factors,
+                        context: `Method: ${className}.${methodName}`,
+                    });
+                }
+            },
+            // Extract API route handlers (Next.js, Express, etc.)
+            ExportNamedDeclaration(path) {
+                const node = path.node;
+                if (!node.loc || !node.declaration)
+                    return;
+                const declCode = lines.slice(node.loc.start.line - 1, node.loc.end.line).join("\n");
+                // Check if it's an API handler (GET, POST, etc.)
+                if (/export\s+(async\s+)?function\s+(GET|POST|PUT|DELETE|PATCH)/i.test(declCode)) {
+                    const { score, factors } = calculateRiskScore(declCode);
+                    factors.push("api-endpoint");
+                    sections.push({
+                        type: "api-handler",
+                        name: declCode.match(/function\s+(\w+)/)?.[1] || "handler",
+                        code: declCode,
+                        startLine: node.loc.start.line,
+                        endLine: node.loc.end.line,
+                        riskFactors: [...factors, "api-endpoint"],
+                        context: "API Route Handler",
+                    });
+                }
+            },
+        });
+        // Sort by risk score (highest first)
+        sections.sort((a, b) => b.riskFactors.length - a.riskFactors.length);
+        // Extract top 15 highest-risk sections per file (increased for better AI analysis)
+        const topSections = sections
+            .slice(0, 15)
+            .map(section => ({
+            ...section,
+            // Keep full code sections for AI analysis (removed truncation)
+            code: section.code
+        }));
+        if (topSections.length === 0)
+            return null;
+        return {
+            file: filepath,
+            language,
+            sections: topSections,
+            summary: `Extracted ${topSections.length} high-risk code sections from ${filepath}`,
+        };
+    }
+    catch (error) {
+        // If AST parsing fails, fall back to pattern matching
+        // Log error for debugging but continue with fallback
+        if (error instanceof Error) {
+            console.error(`[AST Extraction] Failed to parse ${filepath}: ${error.message}`);
+        }
+        return extractWithPatterns(filepath, content, language);
+    }
+}
+function extractWithPatterns(filepath, content, language) {
+    const sections = [];
+    const lines = content.split("\n");
+    // Pattern-based extraction for non-JS languages or when AST fails
+    const functionPatterns = [
+        /^(async\s+)?function\s+(\w+)/gm,
+        /^(export\s+)?(async\s+)?function\s+(\w+)/gm,
+        /const\s+(\w+)\s*=\s*(async\s*)?\([^)]*\)\s*=>/gm,
+        /def\s+(\w+)\s*\(/gm, // Python
+        /func\s+(\w+)\s*\(/gm, // Go
+        /public\s+\w+\s+(\w+)\s*\(/gm, // Java
+    ];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of functionPatterns) {
+            // Reset lastIndex for global regex to prevent skipping matches
+            pattern.lastIndex = 0;
+            const match = pattern.exec(line);
+            if (match) {
+                // Extract function body (next 30 lines or until next function)
+                let endLine = Math.min(i + 30, lines.length);
+                for (let j = i + 1; j < lines.length && j < i + 50; j++) {
+                    if (functionPatterns.some(p => {
+                        p.lastIndex = 0;
+                        return p.test(lines[j]);
+                    })) {
+                        endLine = j;
+                        break;
+                    }
+                }
+                const funcCode = lines.slice(i, endLine).join("\n");
+                const { score, factors } = calculateRiskScore(funcCode);
+                if (score >= 2) {
+                    sections.push({
+                        type: "function",
+                        name: match[2] || match[1] || "unknown",
+                        code: funcCode,
+                        startLine: i + 1,
+                        endLine,
+                        riskFactors: factors,
+                        context: `Function at line ${i + 1}`,
+                    });
+                }
+            }
+        }
+    }
+    if (sections.length === 0)
+        return null;
+    return {
+        file: filepath,
+        language,
+        sections: sections.slice(0, 15).map(section => ({
+            ...section,
+            // Keep full code for AI analysis
+            code: section.code
+        })),
+        summary: `Pattern-extracted ${sections.length} sections from ${filepath}`,
+    };
+}
+function shouldAnalyzeFile(filepath) {
+    // Only analyze source code files
+    const analyzePatterns = [
+        // JavaScript/TypeScript
+        /\.[jt]sx?$/,
+        // Python
+        /\.py$/,
+        /\.pyw$/,
+        // Java
+        /\.java$/,
+        // PHP
+        /\.php$/,
+        /\.php[345]?$/,
+        // Go
+        /\.go$/,
+        // Ruby
+        /\.rb$/,
+        /\.rake$/,
+        // C#
+        /\.cs$/,
+        // C/C++
+        /\.[ch]$/,
+        /\.cpp$/,
+        /\.cc$/,
+        /\.cxx$/,
+        /\.hpp$/,
+        /\.hxx$/,
+        // Rust
+        /\.rs$/,
+        // Kotlin
+        /\.kt$/,
+        /\.kts$/,
+        // Swift
+        /\.swift$/,
+        // Scala
+        /\.scala$/,
+    ];
+    // Skip test files, configs, and non-code files
+    const skipPatterns = [
+        /\.test\.[jt]sx?$/,
+        /\.spec\.[jt]sx?$/,
+        /\.stories\.[jt]sx?$/,
+        /\.d\.ts$/,
+        /\.min\.[jt]s$/,
+        /\.bundle\.[jt]s$/,
+        /\.config\.[jt]s$/,
+        /package-lock\.json$/,
+        /yarn\.lock$/,
+        /\.lock$/,
+        /\.md$/,
+        /\.txt$/,
+        /\.json$/,
+        /\.css$/,
+        /\.scss$/,
+        /\.sass$/,
+        /\.less$/,
+        /\.html$/,
+        /\.xml$/,
+        /\.svg$/,
+        /\.yml$/,
+        /\.yaml$/,
+    ];
+    // First check if it should be skipped
+    if (skipPatterns.some(pattern => pattern.test(filepath))) {
+        return false;
+    }
+    // Then check if it matches a source code pattern
+    return analyzePatterns.some(pattern => pattern.test(filepath));
+}