weavatrix 0.2.13 → 0.2.14

package/src/mcp/sync/evidence-health.mjs

@@ -0,0 +1,56 @@
+import {
+    CAPS, CATEGORIES, CONFIDENCE, SEVERITIES, checks, compare, count, graphId,
+    int, list, numericRecord, packageName, path, privacySafeText, reasons, set,
+    state, text, token, verdict,
+} from './evidence-common.mjs'
+
+function finding(value) {
+    if (!value || typeof value !== 'object') return null
+    const id = text(value.id, 64), category = token(value.category, 32), rule = token(value.rule, 64), severity = token(value.severity, 16)
+    if (!id || !/^[a-f0-9]{8,64}$/i.test(id) || !CATEGORIES.has(category) || !rule || !SEVERITIES.has(severity)) return null
+    const out = {id, category, rule, severity}
+    if (CONFIDENCE.has(value.confidence)) out.confidence = value.confidence
+    set(out, 'file', path(value.file)); set(out, 'line', Number.isFinite(value.line) && value.line >= 0 ? Math.trunc(value.line) : undefined)
+    set(out, 'symbol', privacySafeText(value.symbol)); set(out, 'package', packageName(value.package)); set(out, 'version', token(value.version, 128)); set(out, 'graphNodeId', graphId(value.graphNodeId))
+    return out
+}
+
+function hotspot(value) {
+    const id = graphId(value?.id), file = path(value?.file), severity = token(value?.severity, 16)
+    if (!id || !file || !['medium', 'high'].includes(severity)) return null
+    const out = {id, file, severity, breaches: [...new Set((value.breaches || []).map((item) => token(item, 48)).filter(Boolean))].sort(compare).slice(0, 12)}
+    set(out, 'symbol', privacySafeText(value.symbol))
+    for (const key of ['startLine', 'endLine', 'loc', 'cyclomatic', 'params']) if (Number.isFinite(value[key]) && value[key] >= 0) out[key] = Math.trunc(value[key])
+    return out
+}
+
+export function sanitizeHealth(value) {
+    const findings = list(value?.findings, CAPS.findings, finding, (a, b) => compare(a.severity, b.severity) || compare(a.id, b.id))
+    const hotspots = list(value?.complexity?.hotspots, CAPS.hotspots, hotspot, (a, b) => compare(a.severity, b.severity) || compare(a.id, b.id))
+    const truncated = findings.truncated || hotspots.truncated
+    const outState = state(value?.state)
+    return {
+        state: truncated && outState === 'COMPLETE' ? 'PARTIAL' : outState, verdict: verdict(value?.verdict),
+        completeness: {findings: count(value?.completeness?.findings, findings.total, findings.items.length), hotspots: count(value?.completeness?.hotspots, hotspots.total, hotspots.items.length), reasons: reasons(value?.completeness?.reasons)},
+        summary: {
+            bySeverity: numericRecord(value?.summary?.bySeverity, ['critical', 'high', 'medium', 'low', 'info']),
+            byCategory: numericRecord(value?.summary?.byCategory, ['unused', 'structure', 'vulnerability', 'malware']),
+            dead: numericRecord(value?.summary?.dead, ['deadSymbols', 'deadFiles', 'unusedExports']),
+            structure: numericRecord(value?.summary?.structure, ['runtimeImportEdges', 'typeOnlyImportEdges', 'compileOnlyImportEdges', 'runtimeCycles', 'compileTimeCouplings', 'largestCycle', 'largestCompileTimeCoupling', 'orphans', 'boundaryViolations']),
+        },
+        checks: checks(value?.checks), findings: findings.items,
+        complexity: {thresholds: {loc: {warning: int(value?.complexity?.thresholds?.loc?.warning), high: int(value?.complexity?.thresholds?.loc?.high)}, cyclomatic: {warning: int(value?.complexity?.thresholds?.cyclomatic?.warning), high: int(value?.complexity?.thresholds?.cyclomatic?.high)}, params: {warning: int(value?.complexity?.thresholds?.params?.warning), high: int(value?.complexity?.thresholds?.params?.high)}}, analyzed: int(value?.complexity?.analyzed), hotspots: hotspots.items},
+    }
+}
+
+function badge(value) {
+    const category = token(value?.category, 32), id = token(value?.id, 128)
+    if (!['languages', 'runtimes', 'tests', 'infra', 'deploy'].includes(category) || !id) return null
+    const out = {category, id}; set(out, 'kind', token(value.kind, 64)); set(out, 'version', token(value.version, 64)); return out
+}
+
+export function sanitizeTechnologies(value) {
+    const badges = list(value?.badges, CAPS.badges, badge, (a, b) => compare(a.category, b.category) || compare(a.id, b.id))
+    const outState = state(value?.state)
+    return {state: badges.truncated && outState === 'COMPLETE' ? 'PARTIAL' : outState, verdict: verdict(value?.verdict), completeness: {badges: count(value?.completeness?.badges, badges.total, badges.items.length), reasons: reasons(value?.completeness?.reasons)}, badges: badges.items}
+}

package/src/mcp/sync/evidence-packages.mjs

@@ -0,0 +1,95 @@
+import {
+    CAPS, PACKAGE_DEPENDENCY_KINDS, bool, checks, compare, count, int, list,
+    numericRecord, packageName, packageVersion, path, reasons, set, state, text,
+    token, verdict,
+} from './evidence-common.mjs'
+
+const PACKAGE_SOURCES = new Set(['package-lock', 'yarn-lock', 'requirements', 'venv', 'poetry-lock', 'uv-lock', 'pipfile-lock', 'go-sum', 'go-mod', 'node_modules'])
+
+function packageSource(value) {
+    const source = text(value, 512)
+    if (PACKAGE_SOURCES.has(source)) return source
+    const relative = path(source, 512)
+    return relative && /(^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.ya?ml|requirements[\w.-]*\.(?:txt|in)|poetry\.lock|uv\.lock|Pipfile\.lock|go\.(?:mod|sum))$/i.test(relative) ? relative : undefined
+}
+
+function packageFact(value) {
+    const name = packageName(value?.name), version = token(value?.version, 128), ecosystem = token(value?.ecosystem, 64), source = packageSource(value?.source)
+    return name && version && ecosystem && source ? {name, version, ecosystem, dev: bool(value.dev), source} : null
+}
+
+function usage(value) {
+    const name = packageName(value?.name), ecosystem = token(value?.ecosystem, 64)
+    if (!name || !ecosystem) return null
+    const files = [...new Set((value.files || []).map((item) => path(item)).filter(Boolean))].sort(compare)
+    return {name, ecosystem, importCount: int(value.importCount), fileCount: int(value.fileCount), files: files.slice(0, CAPS.files), filesTruncated: bool(value.filesTruncated) || files.length > CAPS.files, kinds: [...new Set((value.kinds || []).map((item) => token(item, 64)).filter(Boolean))].sort(compare).slice(0, 32)}
+}
+
+function packageGraphNode(value) {
+    const name = packageName(value?.name), version = packageVersion(value?.version), id = text(value?.id, 512)
+    if (!name || !version || !id) return null
+    const prefix = `npm:${name}@${version}:`
+    if (!id.startsWith(prefix) || !/^[a-f0-9]{12}$/i.test(id.slice(prefix.length))) return null
+    return {id, name, version, direct: bool(value.direct), dev: bool(value.dev), optional: bool(value.optional), peer: bool(value.peer)}
+}
+
+function sanitizePackageDependencyGraph(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return {
+            state: 'NOT_CHECKED', ecosystem: 'npm', root: '(root)',
+            completeness: {nodes: count(null, 0, 0), edges: count(null, 0, 0), declarations: numericRecord(null, ['total', 'resolved', 'unresolved', 'local', 'optionalMissing']), reasons: ['DEPENDENCY_GRAPH_NOT_PROVIDED']},
+            nodes: [], edges: [],
+        }
+    }
+    const nodes = list(value.nodes, CAPS.packageGraphNodes, packageGraphNode,
+        (a, b) => Number(b.direct) - Number(a.direct) || compare(a.name, b.name) || compare(a.version, b.version) || compare(a.id, b.id))
+    const nodeIds = new Set(nodes.items.map((node) => node.id))
+    const edge = (candidate) => {
+        const from = candidate?.from === '(root)' ? '(root)' : text(candidate?.from, 512)
+        const to = text(candidate?.to, 512), kind = token(candidate?.kind, 32)
+        if (!from || !to || !PACKAGE_DEPENDENCY_KINDS.has(kind) || from === to ||
+            (from !== '(root)' && !nodeIds.has(from)) || !nodeIds.has(to)) return null
+        return {from, to, kind}
+    }
+    const edges = list(value.edges, CAPS.packageGraphEdges, edge,
+        (a, b) => compare(a.from, b.from) || compare(a.to, b.to) || compare(a.kind, b.kind))
+    const lockfile = path(value.lockfile, 512)
+    const safeLockfile = lockfile && /(^|\/)(?:package-lock\.json|npm-shrinkwrap\.json)$/i.test(lockfile) ? lockfile : undefined
+    const graphState = state(value.state)
+    const truncated = nodes.truncated || edges.truncated
+    const out = {
+        state: truncated && graphState === 'COMPLETE' ? 'PARTIAL' : graphState,
+        ecosystem: 'npm', root: '(root)',
+        completeness: {
+            nodes: count(value?.completeness?.nodes, nodes.total, nodes.items.length),
+            edges: count(value?.completeness?.edges, edges.total, edges.items.length),
+            declarations: numericRecord(value?.completeness?.declarations, ['total', 'resolved', 'unresolved', 'local', 'optionalMissing']),
+            reasons: reasons(value?.completeness?.reasons),
+        },
+        nodes: nodes.items, edges: edges.items,
+    }
+    set(out, 'lockfile', safeLockfile)
+    const lockfileVersion = int(value.lockfileVersion)
+    if (lockfileVersion > 0) out.lockfileVersion = lockfileVersion
+    return out
+}
+
+export function sanitizePackages(value) {
+    const inventory = list(value?.inventory, CAPS.packages, packageFact, (a, b) => compare(a.ecosystem, b.ecosystem) || compare(a.name, b.name) || compare(a.version, b.version))
+    const directUsage = list(value?.directUsage, CAPS.usage, usage, (a, b) => compare(a.ecosystem, b.ecosystem) || compare(a.name, b.name))
+    const dependencyGraph = sanitizePackageDependencyGraph(value?.dependencyGraph)
+    const outState = state(value?.state)
+    const truncated = inventory.truncated || directUsage.truncated || (dependencyGraph.state === 'PARTIAL' && value?.dependencyGraph?.state === 'COMPLETE')
+    return {
+        state: truncated && outState === 'COMPLETE' ? 'PARTIAL' : outState,
+        verdict: verdict(value?.verdict),
+        completeness: {
+            inventory: count(value?.completeness?.inventory, inventory.total, inventory.items.length),
+            directUsage: count(value?.completeness?.directUsage, directUsage.total, directUsage.items.length),
+            dependencyGraphNodes: count(value?.completeness?.dependencyGraphNodes, dependencyGraph.completeness.nodes.total, dependencyGraph.nodes.length),
+            dependencyGraphEdges: count(value?.completeness?.dependencyGraphEdges, dependencyGraph.completeness.edges.total, dependencyGraph.edges.length),
+            reasons: reasons(value?.completeness?.reasons),
+        },
+        checks: checks(value?.checks), inventory: inventory.items, directUsage: directUsage.items, dependencyGraph,
+    }
+}

package/src/mcp/sync/payload-common.mjs

@@ -0,0 +1,97 @@
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+const ABSOLUTE_PATH_FRAGMENT = /(?:^|[\/\s"'`(=])[a-z]:[\\/]|(?:^|[\s"'`(=])(?:\\\\[^\\/\s]+(?:[\\/]|$)|file:(?:\/\/)?[\\/]|\/(?!\/)[^\s])/i;
+
+export const MAX_SYNC_BODY_BYTES = 8 * 1024 * 1024;
+export const MAX_SYNC_NODES = 25_000;
+export const MAX_SYNC_LINKS = 100_000;
+export const MAX_SYNC_EXTERNAL_IMPORTS = 50_000;
+
+export function metadataString(value, max = 4096) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max && !CONTROL_CHARS.test(value)
+        ? value : undefined;
+}
+
+export function repoRelativePathString(value, max = 4096) {
+    const path = metadataString(value, max);
+    if (!path || /^(?:[a-z][a-z0-9+.-]*:|[\\/])/i.test(path)) return undefined;
+    const segments = path.split(/[\\/]/);
+    if (segments.some((segment) => segment === '.' || segment === '..')) return undefined;
+    return path;
+}
+
+export function graphIdString(value) {
+    const id = metadataString(value);
+    if (!id) return undefined;
+    const hash = id.indexOf('#');
+    const file = hash < 0 ? id : id.slice(0, hash);
+    return repoRelativePathString(file) ? id : undefined;
+}
+
+export function privacySafeText(value, max = 4096) {
+    const text = metadataString(value, max);
+    return text && !ABSOLUTE_PATH_FRAGMENT.test(text) ? text : undefined;
+}
+
+export function repoPathV3(value, max = 4096) {
+    const path = repoRelativePathString(value, max);
+    return path ? path.replace(/\\/g, '/') : undefined;
+}
+
+export function graphIdV3(value) {
+    const id = metadataString(value);
+    if (!id) return undefined;
+    const hash = id.indexOf('#');
+    const file = hash < 0 ? id : id.slice(0, hash);
+    const safeFile = repoPathV3(file);
+    if (!safeFile) return undefined;
+    if (hash < 0) return safeFile;
+    const suffix = id.slice(hash);
+    if (suffix.length > 512 || !/^#[^\\/\s\u0000-\u001f\u007f]{1,511}$/u.test(suffix)) return undefined;
+    return `${safeFile}${suffix}`;
+}
+
+export function safeToken(value, max = 256) {
+    const token = metadataString(value, max);
+    return token && /^[\p{L}\p{N}_.:@+\-#$<>()\[\],]+$/u.test(token) ? token : undefined;
+}
+
+export function packageName(value) {
+    const name = metadataString(value, 256);
+    return name && /^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/i.test(name) ? name : undefined;
+}
+
+export function externalSpecifier(value) {
+    const spec = metadataString(value, 512);
+    if (!spec || ABSOLUTE_PATH_FRAGMENT.test(spec) || /^(?:[a-z]:[\\/]|[\\/]|\.\.?[\\/])/i.test(spec)) return undefined;
+    return /^[a-z0-9@][a-z0-9@._:/+\-]*$/i.test(spec) ? spec : undefined;
+}
+
+export function finiteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+
+export function setIf(out, key, value) {
+    if (value !== undefined) out[key] = value;
+}
+
+const COMPLEXITY_NUMBERS = [
+    'startLine', 'endLine', 'loc', 'params', 'objectFields', 'branches', 'cyclomatic',
+    'loops', 'maxLoopDepth', 'returns', 'awaits', 'callCount', 'externalCalls',
+    'asyncBoundaries', 'allocations', 'objectLiterals', 'spreadCopies', 'sorts',
+    'linearOps', 'allocationsInLoops', 'copiesInLoops', 'linearOpsInLoops',
+    'sortsInLoops', 'recursionInLoops', 'timeRank', 'timeScore', 'memoryRank', 'memoryScore',
+];
+
+export function sanitizeComplexity(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+    const out = {};
+    for (const key of COMPLEXITY_NUMBERS) setIf(out, key, finiteNumber(value[key]));
+    if (typeof value.recursion === 'boolean') out.recursion = value.recursion;
+    for (const key of ['family', 'scope', 'complexityScope', 'confidence']) setIf(out, key, metadataString(value[key], 32));
+    return Object.keys(out).length ? out : undefined;
+}
+
+export function assertArrayLimit(raw, key, limit) {
+    const count = Array.isArray(raw[key]) ? raw[key].length : 0;
+    if (count > limit) throw new Error(`${key} has ${count} entries; maximum is ${limit}`);
+}

package/src/mcp/sync/payload-v2.mjs

@@ -0,0 +1,53 @@
+import {
+    finiteNumber, graphIdString, metadataString, repoRelativePathString,
+    sanitizeComplexity, setIf,
+} from './payload-common.mjs';
+
+export function sanitizeNode(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+    const id = graphIdString(value.id);
+    if (!id) return null;
+    const out = {id};
+    setIf(out, 'label', metadataString(value.label, 1024));
+    setIf(out, 'file_type', metadataString(value.file_type, 32));
+    setIf(out, 'source_file', repoRelativePathString(value.source_file));
+    const sourceLocation = metadataString(value.source_location, 32);
+    const sourceEnd = metadataString(value.source_end, 32);
+    if (sourceLocation && /^L\d+$/.test(sourceLocation)) out.source_location = sourceLocation;
+    if (sourceEnd && /^L\d+$/.test(sourceEnd)) out.source_end = sourceEnd;
+    const community = finiteNumber(value.community);
+    if (community !== undefined && Number.isInteger(community) && community >= 0) out.community = community;
+    if (typeof value.exported === 'boolean') out.exported = value.exported;
+    if (typeof value.decorated === 'boolean') out.decorated = value.decorated;
+    setIf(out, 'complexity', sanitizeComplexity(value.complexity));
+    return out;
+}
+
+export function sanitizeLink(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+    const source = graphIdString(value.source);
+    const target = graphIdString(value.target);
+    if (!source || !target) return null;
+    const out = {source, target};
+    setIf(out, 'relation', metadataString(value.relation, 32));
+    setIf(out, 'confidence', metadataString(value.confidence, 32));
+    if (value.typeOnly === true) out.typeOnly = true;
+    if (value.compileOnly === true) out.compileOnly = true;
+    const line = finiteNumber(value.line);
+    if (line !== undefined && Number.isInteger(line) && line >= 0) out.line = line;
+    setIf(out, 'specifier', metadataString(value.specifier));
+    return out;
+}
+
+export function sanitizeExternalImport(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+    const file = repoRelativePathString(value.file);
+    if (!file) return null;
+    const out = {file};
+    for (const key of ['spec', 'target']) setIf(out, key, metadataString(value[key]));
+    for (const key of ['pkg', 'kind', 'ecosystem']) setIf(out, key, metadataString(value[key], 256));
+    const line = finiteNumber(value.line);
+    if (line !== undefined && Number.isInteger(line) && line >= 0) out.line = line;
+    for (const key of ['builtin', 'dynamic', 'unresolved']) if (typeof value[key] === 'boolean') out[key] = value[key];
+    return out;
+}

package/src/mcp/sync/payload-v3.mjs

@@ -0,0 +1,79 @@
+import {edgeProvenance} from '../../graph/edge-provenance.js';
+import {
+    externalSpecifier, graphIdV3, packageName, privacySafeText, repoPathV3,
+    safeToken, setIf,
+} from './payload-common.mjs';
+import {sanitizeExternalImport, sanitizeLink, sanitizeNode} from './payload-v2.mjs';
+
+export function sanitizeNodeV3(value) {
+    const out = sanitizeNode(value);
+    if (!out) return null;
+    const id = graphIdV3(value.id);
+    if (!id) return null;
+    const sourceFile = value.source_file == null ? undefined : repoPathV3(value.source_file);
+    if (value.source_file != null && !sourceFile) return null;
+    const hash = id.indexOf('#');
+    const idFile = hash < 0 ? id : id.slice(0, hash);
+    if (sourceFile && idFile !== sourceFile) return null;
+    out.id = id;
+    const label = privacySafeText(value.label, 1024);
+    if (label) out.label = label;
+    else delete out.label;
+    const fileType = safeToken(value.file_type, 32);
+    if (fileType) out.file_type = fileType;
+    else delete out.file_type;
+    if (sourceFile) out.source_file = sourceFile;
+    else delete out.source_file;
+    for (const key of ['symbol_kind', 'symbol_space', 'member_of', 'visibility']) setIf(out, key, safeToken(value[key], 128));
+    if (out.complexity) for (const key of ['family', 'scope', 'complexityScope', 'confidence']) {
+        const safe = safeToken(value.complexity?.[key], 32);
+        if (safe) out.complexity[key] = safe;
+        else delete out.complexity[key];
+    }
+    return out;
+}
+
+export function sanitizeLinkV3(value) {
+    const out = sanitizeLink(value);
+    if (!out) return null;
+    const source = graphIdV3(value.source);
+    const target = graphIdV3(value.target);
+    if (!source || !target) return null;
+    out.source = source;
+    out.target = target;
+    for (const key of ['relation', 'confidence']) {
+        const safe = safeToken(value[key], 32);
+        if (safe) out[key] = safe;
+        else delete out[key];
+    }
+    const provenance = edgeProvenance(value);
+    if (provenance !== 'UNKNOWN') out.provenance = provenance;
+    const specifier = privacySafeText(value.specifier, 1024);
+    if (specifier) out.specifier = specifier;
+    else delete out.specifier;
+    return out;
+}
+
+export function sanitizeExternalImportV3(value) {
+    const out = sanitizeExternalImport(value);
+    if (!out) return null;
+    const file = repoPathV3(value.file);
+    if (!file) return null;
+    out.file = file;
+    setIf(out, 'spec', externalSpecifier(value.spec));
+    if (!externalSpecifier(value.spec)) delete out.spec;
+    setIf(out, 'pkg', packageName(value.pkg));
+    if (!packageName(value.pkg)) delete out.pkg;
+    for (const key of ['kind', 'ecosystem']) {
+        const safe = safeToken(value[key], 64);
+        if (safe) out[key] = safe;
+        else delete out[key];
+    }
+    if (value.target != null) {
+        const target = repoPathV3(value.target);
+        if (target) out.target = target;
+        else delete out.target;
+    }
+    if (value.typeOnly === true) out.typeOnly = true;
+    return out;
+}