vettcode-cli 1.0.0

package/dist/reference-graph.js

@@ -0,0 +1,415 @@
+"use strict";
+/**
+ * Reference Graph Builder
+ *
+ * Builds a comprehensive cross-file reference map to enable intelligent
+ * context-aware validation with 97%+ accuracy.
+ *
+ * Features:
+ * - Import/Export tracking
+ * - Constant definitions (MAX_SIZE, etc.)
+ * - Function definitions and calls
+ * - Component usage tracking
+ * - Data flow analysis
+ * - Security validation tracking
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReferenceGraph = buildReferenceGraph;
+exports.hasSizeValidationInChain = hasSizeValidationInChain;
+exports.hasAuthValidationInChain = hasAuthValidationInChain;
+exports.hasInputSanitizationInChain = hasInputSanitizationInChain;
+exports.isUIWiring = isUIWiring;
+exports.getAccessibleSecurityConstants = getAccessibleSecurityConstants;
+/**
+ * Build a comprehensive reference graph from all files
+ */
+function buildReferenceGraph(files) {
+    const graph = {
+        files: new Map(),
+        constantsByName: new Map(),
+        functionsByName: new Map(),
+        componentsByName: new Map(),
+        dependencyChains: new Map(),
+    };
+    // Pass 1: Extract all exports and definitions
+    for (const file of files) {
+        const ref = analyzeFile(file.path, file.content);
+        graph.files.set(file.path, ref);
+        // Index constants
+        for (const constant of ref.securityConstants) {
+            const existing = graph.constantsByName.get(constant.name) || [];
+            existing.push(file.path);
+            graph.constantsByName.set(constant.name, existing);
+        }
+        // Index functions
+        for (const func of ref.exports.functions) {
+            const existing = graph.functionsByName.get(func) || [];
+            existing.push(file.path);
+            graph.functionsByName.set(func, existing);
+        }
+        // Index components
+        for (const comp of ref.exports.components) {
+            const existing = graph.componentsByName.get(comp) || [];
+            existing.push(file.path);
+            graph.componentsByName.set(comp, existing);
+        }
+    }
+    // Pass 2: Build import relationships and usedBy
+    for (const [filePath, ref] of graph.files) {
+        for (const imp of ref.imports) {
+            // Find the file that exports these items
+            const importedFile = resolveImport(imp.from, filePath, graph);
+            if (importedFile) {
+                const importedRef = graph.files.get(importedFile);
+                if (importedRef) {
+                    importedRef.usedBy.push(filePath);
+                }
+            }
+        }
+    }
+    // Pass 3: Build dependency chains (recursive)
+    for (const [filePath] of graph.files) {
+        graph.dependencyChains.set(filePath, buildDependencyChain(filePath, graph, new Set()));
+    }
+    return graph;
+}
+/**
+ * Analyze a single file and extract all relevant information
+ */
+function analyzeFile(path, content) {
+    const ref = {
+        path,
+        exports: {
+            functions: [],
+            constants: [],
+            components: [],
+            types: [],
+        },
+        imports: [],
+        securityConstants: [],
+        validationFunctions: [],
+        usedBy: [],
+        metadata: {
+            isComponent: /\.tsx$/.test(path) && !/\.test\./.test(path),
+            isPage: /\/pages?\/|\/app\/.*page\.tsx/.test(path),
+            isAPI: /\/api\//.test(path),
+            isUtil: /\/utils?\/|\/lib\/|\/helpers?\//.test(path),
+            isTest: /\.(test|spec)\.[jt]sx?$/.test(path),
+            isConfig: /\.(config|rc)\.[jt]s$/.test(path),
+            purpose: 'unknown',
+        },
+    };
+    // Determine file purpose
+    if (ref.metadata.isTest)
+        ref.metadata.purpose = 'test';
+    else if (ref.metadata.isConfig)
+        ref.metadata.purpose = 'config';
+    else if (ref.metadata.isAPI)
+        ref.metadata.purpose = 'api';
+    else if (ref.metadata.isPage || ref.metadata.isComponent)
+        ref.metadata.purpose = 'ui';
+    else if (ref.metadata.isUtil)
+        ref.metadata.purpose = 'util';
+    else if (/static-analyzer|ast-extractor|scanner|verification/.test(path))
+        ref.metadata.purpose = 'scanner';
+    // Extract imports
+    const importMatches = content.matchAll(/import\s+(?:{([^}]+)}|(\w+))\s+from\s+['"]([^'"]+)['"]/g);
+    for (const match of importMatches) {
+        const items = match[1]
+            ? match[1].split(',').map(s => s.trim().replace(/\s+as\s+\w+/, ''))
+            : [match[2]];
+        ref.imports.push({
+            from: match[3],
+            items: items.filter(Boolean),
+        });
+    }
+    // Extract exports
+    // Named exports: export const/function/class
+    const namedExports = content.matchAll(/export\s+(?:const|let|var|function|class)\s+(\w+)/g);
+    for (const match of namedExports) {
+        const name = match[1];
+        // Determine type
+        if (/^[A-Z]/.test(name)) {
+            if (content.includes(`function ${name}`) || content.includes(`const ${name} = (`)) {
+                ref.exports.components.push(name);
+            }
+            else {
+                ref.exports.constants.push(name);
+            }
+        }
+        else if (content.includes(`function ${name}`) || content.includes(`const ${name} = (`)) {
+            ref.exports.functions.push(name);
+        }
+        else {
+            ref.exports.constants.push(name);
+        }
+    }
+    // Default exports
+    const defaultExport = content.match(/export\s+default\s+(?:function\s+)?(\w+)/);
+    if (defaultExport) {
+        const name = defaultExport[1];
+        if (/^[A-Z]/.test(name)) {
+            ref.exports.components.push(name);
+        }
+        else {
+            ref.exports.functions.push(name);
+        }
+    }
+    // Extract security constants (size limits, timeouts, etc.)
+    const sizeConstants = content.matchAll(/const\s+(MAX_[A-Z_]*(?:SIZE|BYTES|LENGTH|LIMIT))\s*=\s*([^;]+)/gi);
+    for (const match of sizeConstants) {
+        ref.securityConstants.push({
+            name: match[1],
+            type: 'size_limit',
+            value: match[2].trim(),
+        });
+    }
+    const timeoutConstants = content.matchAll(/const\s+(.*?TIMEOUT.*?)\s*=\s*([^;]+)/gi);
+    for (const match of timeoutConstants) {
+        ref.securityConstants.push({
+            name: match[1],
+            type: 'timeout',
+            value: match[2].trim(),
+        });
+    }
+    const rateLimitConstants = content.matchAll(/const\s+(.*?(?:RATE|LIMIT|RETRY).*?)\s*=\s*([^;]+)/gi);
+    for (const match of rateLimitConstants) {
+        ref.securityConstants.push({
+            name: match[1],
+            type: 'rate_limit',
+            value: match[2].trim(),
+        });
+    }
+    // Extract validation functions
+    // Size validation
+    if (/file\.size|byteLength|contentLength/.test(content)) {
+        const sizeValidators = content.matchAll(/(?:function|const)\s+(\w*[Vv]alidate\w*[Ss]ize\w*)/g);
+        for (const match of sizeValidators) {
+            ref.validationFunctions.push({
+                name: match[1],
+                validates: 'size',
+                pattern: match[0],
+            });
+        }
+    }
+    // Auth validation
+    if (/auth|token|bearer|jwt/i.test(content)) {
+        const authValidators = content.matchAll(/(?:function|const)\s+(\w*[Aa]uth\w*|\w*[Tt]oken\w*|\w*[Vv]erify\w*)/g);
+        for (const match of authValidators) {
+            ref.validationFunctions.push({
+                name: match[1],
+                validates: 'auth',
+                pattern: match[0],
+            });
+        }
+    }
+    // Input validation
+    if (/sanitize|validate|escape|clean/i.test(content)) {
+        const inputValidators = content.matchAll(/(?:function|const)\s+(\w*[Ss]anitize\w*|\w*[Vv]alidate\w*|\w*[Ee]scape\w*|\w*[Cc]lean\w*)/g);
+        for (const match of inputValidators) {
+            ref.validationFunctions.push({
+                name: match[1],
+                validates: 'input',
+                pattern: match[0],
+            });
+        }
+    }
+    return ref;
+}
+/**
+ * Resolve an import path to an actual file path
+ */
+function resolveImport(importPath, fromFile, graph) {
+    // Skip external packages
+    if (!importPath.startsWith('.') && !importPath.startsWith('/')) {
+        return null;
+    }
+    // Relative import
+    if (importPath.startsWith('.')) {
+        const fromDir = fromFile.split('/').slice(0, -1).join('/');
+        let resolved = importPath.startsWith('./')
+            ? `${fromDir}/${importPath.slice(2)}`
+            : importPath;
+        // Try different extensions
+        const extensions = ['', '.ts', '.tsx', '.js', '.jsx', '/index.ts', '/index.tsx'];
+        for (const ext of extensions) {
+            const candidate = resolved + ext;
+            if (graph.files.has(candidate)) {
+                return candidate;
+            }
+        }
+    }
+    // Absolute import (from src/)
+    if (importPath.startsWith('@/')) {
+        const withoutAlias = importPath.replace('@/', 'src/');
+        const extensions = ['', '.ts', '.tsx', '.js', '.jsx', '/index.ts', '/index.tsx'];
+        for (const ext of extensions) {
+            const candidate = withoutAlias + ext;
+            if (graph.files.has(candidate)) {
+                return candidate;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Build recursive dependency chain for a file with depth limiting
+ */
+function buildDependencyChain(filePath, graph, visited, depth = 0, maxDepth = 50 // Prevent stack overflow
+) {
+    // Depth check to prevent infinite recursion
+    if (depth >= maxDepth) {
+        console.warn(`[Dependency Chain] Max depth ${maxDepth} reached for ${filePath}`);
+        return [];
+    }
+    if (visited.has(filePath))
+        return [];
+    visited.add(filePath);
+    const ref = graph.files.get(filePath);
+    if (!ref)
+        return [];
+    const chain = [];
+    for (const imp of ref.imports) {
+        const importedFile = resolveImport(imp.from, filePath, graph);
+        if (importedFile) {
+            chain.push(importedFile);
+            // Pass depth + 1 to track recursion level
+            chain.push(...buildDependencyChain(importedFile, graph, visited, depth + 1, maxDepth));
+        }
+    }
+    return [...new Set(chain)]; // Deduplicate
+}
+/**
+ * Check if a file or its dependencies have size validation with depth limiting
+ */
+function hasSizeValidationInChain(filePath, graph, maxDepth = 20 // Limit dependency traversal depth
+) {
+    const visited = new Set();
+    function checkWithDepth(file, depth) {
+        // Prevent excessive traversal
+        if (depth >= maxDepth || visited.has(file)) {
+            return false;
+        }
+        visited.add(file);
+        const ref = graph.files.get(file);
+        if (!ref)
+            return false;
+        // Check current file
+        if (ref.securityConstants.some(c => c.type === 'size_limit')) {
+            return true;
+        }
+        if (ref.validationFunctions.some(v => v.validates === 'size')) {
+            return true;
+        }
+        // Check dependencies with depth limit
+        const deps = graph.dependencyChains.get(file) || [];
+        // Limit number of dependencies to check per level
+        for (const dep of deps.slice(0, 50)) {
+            if (checkWithDepth(dep, depth + 1)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    return checkWithDepth(filePath, 0);
+}
+/**
+ * Check if a file or its dependencies have auth validation
+ */
+function hasAuthValidationInChain(filePath, graph) {
+    const ref = graph.files.get(filePath);
+    if (!ref)
+        return false;
+    // Check current file
+    if (ref.validationFunctions.some(v => v.validates === 'auth')) {
+        return true;
+    }
+    // Check dependencies
+    const deps = graph.dependencyChains.get(filePath) || [];
+    for (const dep of deps) {
+        const depRef = graph.files.get(dep);
+        if (!depRef)
+            continue;
+        if (depRef.validationFunctions.some(v => v.validates === 'auth')) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check if a file or its dependencies have input sanitization
+ */
+function hasInputSanitizationInChain(filePath, graph) {
+    const ref = graph.files.get(filePath);
+    if (!ref)
+        return false;
+    // Check current file
+    if (ref.validationFunctions.some(v => v.validates === 'input')) {
+        return true;
+    }
+    // Check dependencies
+    const deps = graph.dependencyChains.get(filePath) || [];
+    for (const dep of deps) {
+        const depRef = graph.files.get(dep);
+        if (!depRef)
+            continue;
+        if (depRef.validationFunctions.some(v => v.validates === 'input')) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check if a file is just UI wiring (delegates to other components)
+ */
+function isUIWiring(filePath, graph) {
+    const ref = graph.files.get(filePath);
+    if (!ref)
+        return false;
+    // Must be a UI component
+    if (!ref.metadata.isComponent && !ref.metadata.isPage) {
+        return false;
+    }
+    // Check if it imports validation/upload components
+    const importsValidationComponents = ref.imports.some(imp => /UploadZone|FileUpload|Dropzone|Upload/.test(imp.items.join(',')));
+    if (importsValidationComponents) {
+        return true; // Delegates to upload component
+    }
+    // Check if it's used by other components (intermediate layer)
+    if (ref.usedBy.length > 0 && ref.metadata.isComponent) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Get all security constants accessible to a file (including imports)
+ */
+function getAccessibleSecurityConstants(filePath, graph) {
+    const constants = [];
+    const ref = graph.files.get(filePath);
+    if (!ref)
+        return constants;
+    // Add constants from current file
+    for (const constant of ref.securityConstants) {
+        constants.push({
+            name: constant.name,
+            type: constant.type,
+            source: filePath,
+        });
+    }
+    // Add constants from dependencies
+    const deps = graph.dependencyChains.get(filePath) || [];
+    for (const dep of deps) {
+        const depRef = graph.files.get(dep);
+        if (!depRef)
+            continue;
+        for (const constant of depRef.securityConstants) {
+            constants.push({
+                name: constant.name,
+                type: constant.type,
+                source: dep,
+            });
+        }
+    }
+    return constants;
+}

package/dist/report-generator.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Report Generator - Generates security reports from findings
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateReport = generateReport;
+function generateReport(staticFindings, filesScanned, linesScanned, projectName) {
+    // Convert static findings to findings
+    const findings = staticFindings.map(f => ({
+        id: f.id,
+        severity: f.severity,
+        category: f.category,
+        title: f.title,
+        description: f.description,
+        file: f.file,
+        line: f.line,
+        evidence: f.evidence,
+        mitigation: "",
+        prevention: "",
+        source: "static",
+    }));
+    // Calculate score
+    const score = calculateScore(findings);
+    const grade = calculateGrade(score);
+    // Generate summary
+    const summary = `Analyzed ${filesScanned} files (${linesScanned} lines). Found ${findings.length} issues.`;
+    // Generate executive verdict
+    const executiveVerdict = generateExecutiveVerdict(score, findings);
+    // Extract critical blockers
+    const criticalBlockers = findings
+        .filter(f => f.severity === "critical")
+        .map(f => `${f.title} in ${f.file}:${f.line}`);
+    // Generate strengths
+    const strengths = generateStrengths(findings);
+    return {
+        score,
+        grade,
+        summary,
+        executiveVerdict,
+        findings,
+        strengths,
+        criticalBlockers,
+        metadata: {
+            projectName,
+            scannedAt: new Date().toISOString(),
+            filesScanned,
+            linesScanned,
+            ignoredPaths: 0,
+        },
+    };
+}
+function calculateScore(findings) {
+    if (findings.length === 0)
+        return 100;
+    let score = 100;
+    const severityWeights = {
+        critical: 25,
+        high: 15,
+        medium: 8,
+        low: 3,
+        info: 1,
+    };
+    for (const finding of findings) {
+        score -= severityWeights[finding.severity];
+    }
+    return Math.max(0, score);
+}
+function calculateGrade(score) {
+    if (score >= 95)
+        return "A+";
+    if (score >= 90)
+        return "A";
+    if (score >= 85)
+        return "A-";
+    if (score >= 80)
+        return "B+";
+    if (score >= 75)
+        return "B";
+    if (score >= 70)
+        return "B-";
+    if (score >= 65)
+        return "C+";
+    if (score >= 60)
+        return "C";
+    if (score >= 55)
+        return "C-";
+    if (score >= 50)
+        return "D+";
+    if (score >= 45)
+        return "D";
+    if (score >= 40)
+        return "D-";
+    return "F";
+}
+function generateExecutiveVerdict(score, findings) {
+    const criticalCount = findings.filter(f => f.severity === "critical").length;
+    const highCount = findings.filter(f => f.severity === "high").length;
+    if (criticalCount > 0) {
+        return `CRITICAL: This codebase has ${criticalCount} critical security vulnerability(ies) that must be fixed immediately before production deployment.`;
+    }
+    if (highCount > 3) {
+        return `HIGH RISK: This codebase has ${highCount} high-severity issues that should be addressed before production.`;
+    }
+    if (score >= 80) {
+        return "GOOD: This codebase has good security practices with minor issues that can be improved.";
+    }
+    if (score >= 60) {
+        return "MODERATE: This codebase has some security and quality concerns that should be addressed.";
+    }
+    return "POOR: This codebase has significant security and quality issues that require attention.";
+}
+function generateStrengths(findings) {
+    const strengths = [];
+    const categories = new Set(findings.map(f => f.category));
+    if (!categories.has("security")) {
+        strengths.push("No obvious security vulnerabilities detected");
+    }
+    if (!categories.has("production")) {
+        strengths.push("Good error handling practices");
+    }
+    if (!findings.some(f => f.severity === "critical")) {
+        strengths.push("No critical severity issues found");
+    }
+    if (strengths.length === 0) {
+        strengths.push("Codebase structure is analyzable");
+    }
+    return strengths;
+}

package/dist/scan-priority.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filePriorityScore = filePriorityScore;
+exports.selectFilesForQuickScan = selectFilesForQuickScan;
+exports.estimateScanMinutes = estimateScanMinutes;
+const ast_extractor_1 = require("./ast-extractor");
+/** Higher score = analyzed first in quick mode. */
+function filePriorityScore(filepath) {
+    const p = filepath.replace(/\\/g, "/").toLowerCase();
+    let score = 0;
+    if (/\/(api|routes|controllers|middleware|auth|security)\//.test(p))
+        score += 100;
+    if (/\/(app|src|server|backend|lib)\//.test(p))
+        score += 40;
+    if (/(route|controller|middleware|auth|login|signup|session|jwt|oauth)/i.test(p))
+        score += 60;
+    if (/(handler|resolver|service|repository|model|schema)/i.test(p))
+        score += 30;
+    if (/(config|env|settings|database|db|prisma|drizzle|sequelize)/i.test(p))
+        score += 50;
+    if (/(index|main|app|server|entry)\.[jt]sx?$/.test(p))
+        score += 45;
+    if (p.includes("package.json") || p.endsWith(".env.example"))
+        score += 35;
+    if (/\/(pages|views|components)\//.test(p))
+        score += 15;
+    if (p.includes("node_modules") || p.includes("dist/") || p.includes(".test."))
+        score -= 200;
+    return score;
+}
+const QUICK_MAX_FILES = 42;
+function selectFilesForQuickScan(files) {
+    const candidates = files.filter((f) => (0, ast_extractor_1.shouldAnalyzeFile)(f.path));
+    if (candidates.length <= QUICK_MAX_FILES)
+        return candidates;
+    return [...candidates]
+        .sort((a, b) => filePriorityScore(b.path) - filePriorityScore(a.path))
+        .slice(0, QUICK_MAX_FILES);
+}
+function estimateScanMinutes(mode, aiBatchCount) {
+    const perBatch = mode === "quick" ? 0.35 : 0.55;
+    const parallel = 3;
+    const rounds = Math.ceil(aiBatchCount / parallel);
+    const minutes = (rounds * perBatch) + (mode === "quick" ? 0.25 : 0.5);
+    return {
+        min: Math.max(1, Math.floor(minutes * 0.7)),
+        max: Math.ceil(minutes * 1.4) + 1,
+    };
+}