aike-code-sentinel 0.1.0__py3-none-any.whl

aike_code_sentinel-0.1.0.dist-info/METADATA

@@ -0,0 +1,6 @@
+Metadata-Version: 2.1
+Name: aike-code-sentinel
+Version: 0.1.0
+Summary: AI-driven Code Security Sentinel
+Author: aike-autonomy
+License: MIT

aike_code_sentinel-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: manual
+Root-Is-Purelib: true
+Tag: py3-none-any

code_sentinel/__init__.py

@@ -0,0 +1,30 @@
+"""
+Code Sentinel — 代码哨兵 MVP
+==============================
+基于 Genome Core 四层安全审查框架的 AST 静态分析工具。
+
+检测维度：
+  - 安全风险：eval/exec/os.system/subprocess 无过滤调用
+  - 性能问题：嵌套循环 O(n²)、大文件一次性读取
+  - 代码异味：过长函数(>50行)、过多参数(>5个)、裸 except
+  - 依赖风险：requirements.txt 中已知漏洞包
+
+集成 Genome Core 四层防灭绝：
+  1. discipline  — 纪律检查（危险模式匹配）
+  2. guard       — 格式/内容/社区三层防线
+  3. review      — 可信度评估
+  4. self_review — 语法/逻辑/沙箱/边界四层自审
+"""
+
+from .scanner import CodeScanner, SecurityIssue, PerformanceIssue, SmellIssue, DependencyIssue
+from .fixer import CodeFixer, FixResult
+from .reporter import ReportGenerator
+from .cli import main
+
+__version__ = "0.1.0"
+__all__ = [
+    "CodeScanner", "SecurityIssue", "PerformanceIssue", "SmellIssue", "DependencyIssue",
+    "CodeFixer", "FixResult",
+    "ReportGenerator",
+    "main",
+]

code_sentinel/cli.py

@@ -0,0 +1,382 @@
+"""
+命令行入口 — Code Sentinel CLI
+==============================
+支持三个子命令：
+  scan   — 扫描代码并输出问题列表
+  diff   — 扫描 git diff 变更引入的问题
+  report — 生成 HTML/Markdown/JSON 报告
+  fix    — 生成修复建议和 diff
+
+集成 Genome Core 四层安全审查：
+  discipline → guard → review → self_review
+"""
+
+import argparse
+import json
+import sys
+from pathlib import Path
+from typing import List, Optional
+
+from .scanner import CodeScanner
+from .fixer import CodeFixer
+from .reporter import ReportGenerator
+
+# ── Genome Core 集成 ──
+try:
+    from genome_core.security import (
+        verify_config, check_dangerous, full_guard, full_review, LAWS,
+    )
+    from genome_core.governance import route_to_ministry, audit_log, check_accountability
+    from genome_core.tools import timestamp
+    HAS_GENOME_CORE = True
+except ImportError:
+    HAS_GENOME_CORE = False
+
+
+def _print_banner():
+    """打印启动横幅"""
+    banner = r"""
+   ____          _ _    ____       _        _ _
+  / ___|___   __| | |  / ___|  ___| |_ _ __(_) |_ ___
+ | |   / _ \ / _` | |  \___ \ / _ \ __| '__| | __/ _ \
+ | |__| (_) | (_| | |   ___) |  __/ |_| |  | | ||  __/
+  \____\___/ \__,_|_|  |____/ \___|\__|_|  |_|\__\___|
+
+  ▸ Code Sentinel MVP — 代码哨兵静态分析工具
+  ▸ 基于 Genome Core 四层防灭绝安全框架
+"""
+    print(banner)
+
+
+def _print_genome_status():
+    """打印 Genome Core 集成状态"""
+    if HAS_GENOME_CORE:
+        print("  ✓ Genome Core 已集成 — 四层安全审查已启用")
+        print(f"  ✓ {len(LAWS)} 条法律已加载")
+        print()
+    else:
+        print("  ⚠ Genome Core 未安装 — 安全审查受限")
+        print()
+
+
+def _validate_path(path_str: str) -> Path:
+    """验证路径是否存在，不存在时输出友好错误并退出"""
+    p = Path(path_str)
+    if not p.exists():
+        print(f"❌ 错误: 路径不存在: {path_str}", file=sys.stderr)
+        print(f"   请检查路径是否正确", file=sys.stderr)
+        sys.exit(1)
+    return p
+
+
+def _print_scan_results(results: dict):
+    """打印扫描结果摘要到控制台"""
+    summary = results["summary"]
+    print(f"\n{'='*60}")
+    print(f"  扫描完成: {summary['target']}")
+    print(f"  扫描文件: {summary['scanned_files']} 个")
+    print(f"{'='*60}")
+    print(f"  总问题数: {summary['total']}")
+    print(f"  🔴 高危:   {summary['high']}")
+    print(f"  🟡 中危:   {summary['medium']}")
+    print(f"  🟢 低危:   {summary['low']}")
+    print(f"{'='*60}")
+
+    categories = [
+        ("security", "安全风险", "🔒"),
+        ("performance", "性能问题", "⚡"),
+        ("smell", "代码异味", "👃"),
+        ("dependency", "依赖风险", "📦"),
+    ]
+
+    for key, label, icon in categories:
+        issues = results.get(key, [])
+        if not issues:
+            continue
+        print(f"\n  {icon} {label} ({len(issues)} 个):")
+        for iss in issues[:10]:  # 最多显示前10个
+            file = iss.get("file", "?")
+            line = iss.get("line", 0)
+            desc = iss.get("description", "?")
+            sev = iss.get("severity", "?")
+            print(f"    [{sev}] {file}:{line} — {desc}")
+        if len(issues) > 10:
+            print(f"    ... 还有 {len(issues) - 10} 个问题（使用 --report 查看完整报告）")
+
+    if results.get("genome_core_integrated"):
+        print(f"\n  ✅ 已通过 Genome Core 安全审查验证")
+    print()
+
+
+def cmd_scan(args: argparse.Namespace):
+    """scan 子命令：扫描代码"""
+    target = _validate_path(args.path)
+    scanner = CodeScanner(str(target))
+    results = scanner.scan()
+
+    if args.json:
+        print(json.dumps(results, indent=2, ensure_ascii=False))
+    elif not args.quiet:
+        _print_scan_results(results)
+
+    if args.output:
+        output_path = Path(args.output)
+        output_path.write_text(
+            json.dumps(results, indent=2, ensure_ascii=False), encoding="utf-8"
+        )
+        if not args.quiet and not args.json:
+            print(f"  📄 扫描结果已保存: {output_path}")
+
+    # Genome Core 审计
+    if HAS_GENOME_CORE:
+        audit_log("scan", route_to_ministry("scan"),
+                  f"扫描 {target}，发现 {results['summary']['total']} 个问题")
+
+    return results
+
+
+def cmd_report(args: argparse.Namespace):
+    """report 子命令：生成报告"""
+    # 先执行扫描
+    target = _validate_path(args.path)
+    scanner = CodeScanner(str(target))
+    results = scanner.scan()
+
+    if args.json:
+        print(json.dumps(results, indent=2, ensure_ascii=False))
+        return results
+
+    output_dir = args.output_dir or "."
+    generator = ReportGenerator(results, output_dir)
+
+    formats = args.format or ["html", "md"]
+
+    generated = []
+    for fmt in formats:
+        if fmt == "html":
+            path = generator.generate_html()
+            generated.append(("HTML", path))
+        elif fmt == "md":
+            path = generator.generate_markdown()
+            generated.append(("Markdown", path))
+        elif fmt == "json":
+            path = generator.generate_json()
+            generated.append(("JSON", path))
+        elif fmt == "json-schema":
+            path = generator.generate_json_schema()
+            generated.append(("JSON Schema", path))
+
+    if not args.quiet:
+        print(f"\n  📊 报告生成完成:")
+        for name, path in generated:
+            print(f"    • {name}: {path}")
+
+    # Genome Core 审计
+    if HAS_GENOME_CORE:
+        audit_log("report", "户部",
+                  f"生成 {len(generated)} 份报告，目标: {target}")
+
+    return results
+
+
+def cmd_fix(args: argparse.Namespace):
+    """fix 子命令：生成修复建议"""
+    target = _validate_path(args.path)
+    scanner = CodeScanner(str(target))
+    results = scanner.scan()
+
+    fixer = CodeFixer()
+    fix_results = fixer.generate_fixes(results)
+
+    if args.json:
+        print(json.dumps([fr.to_dict() for fr in fix_results],
+                         indent=2, ensure_ascii=False))
+        return fix_results
+
+    if not fix_results:
+        if not args.quiet:
+            print("  ✅ 未检测到可自动修复的问题。" if args.verbose else "No fixable issues found.")
+        return
+
+    if not args.quiet:
+        print(f"\n  🔧 修复建议 ({len(fix_results)} 个):")
+        for fr in fix_results:
+            for action in fr.actions:
+                print(f"\n    ── {action.description}")
+                print(f"    文件: {action.file}:{action.line}")
+                print(f"    类别: {action.category}")
+                print(f"    可信度: {action.confidence:.0%}")
+                if args.verbose:
+                    print(f"\n    Diff:")
+                    print(f"    {'─'*40}")
+                    for line in action.to_diff().split("\n"):
+                        if line:
+                            print(f"    {line}")
+                if fr.genome_review_passed:
+                    print(f"    ✅ 已通过 Genome Core 四层自审")
+                else:
+                    print(f"    ⚠ 未通过 Genome Core 自审")
+
+    if args.output:
+        output_path = Path(args.output)
+        output_path.write_text(
+            json.dumps([fr.to_dict() for fr in fix_results],
+                       indent=2, ensure_ascii=False),
+            encoding="utf-8"
+        )
+        if not args.quiet and not args.json:
+            print(f"\n  📄 修复结果已保存: {output_path}")
+
+    # Genome Core 审计
+    if HAS_GENOME_CORE:
+        audit_log("fix", "工部",
+                  f"为 {target} 生成 {len(fix_results)} 个修复建议")
+
+    return fix_results
+
+
+def cmd_diff(args: argparse.Namespace):
+    """diff 子命令：扫描 git diff 变更引入的问题"""
+    import subprocess
+
+    try:
+        cmd = ["git", "diff"]
+        if args.staged:
+            cmd.append("--staged")
+        proc = subprocess.run(cmd, capture_output=True, text=True, check=True)
+        diff_text = proc.stdout
+    except subprocess.CalledProcessError as e:
+        print(f"❌ git diff 执行失败: {e}", file=sys.stderr)
+        sys.exit(1)
+    except FileNotFoundError:
+        print(f"❌ 未找到 git 命令，请确保已安装 git", file=sys.stderr)
+        sys.exit(1)
+
+    if not diff_text.strip():
+        if not args.quiet:
+            print("  ℹ 没有检测到变更")
+        return {}
+
+    scanner = CodeScanner(".")  # 路径无关，scan_diff 会按 diff 中的路径扫描
+    results = scanner.scan_diff(diff_text)
+
+    if args.json:
+        print(json.dumps(results, indent=2, ensure_ascii=False))
+    elif not args.quiet:
+        _print_scan_results(results)
+
+    if args.output:
+        output_path = Path(args.output)
+        output_path.write_text(
+            json.dumps(results, indent=2, ensure_ascii=False), encoding="utf-8"
+        )
+        if not args.quiet and not args.json:
+            print(f"  📄 扫描结果已保存: {output_path}")
+
+    # Genome Core 审计
+    if HAS_GENOME_CORE:
+        audit_log("diff", route_to_ministry("scan"),
+                  f"扫描 diff ({len(results.get('summary', {}))} 文件变更)")
+
+    return results
+
+
+def build_parser() -> argparse.ArgumentParser:
+    """构建 CLI 参数解析器"""
+    parser = argparse.ArgumentParser(
+        prog="code-sentinel",
+        description="Code Sentinel — 基于 Genome Core 的代码静态分析工具",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+示例:
+  code-sentinel scan ./src                        # 扫描 src 目录
+  code-sentinel scan ./src -o results.json        # 扫描并保存结果
+  code-sentinel diff --staged                     # 扫描已暂存的变更
+  code-sentinel diff                              # 扫描未暂存的变更
+  code-sentinel report ./src                      # 生成 HTML+Markdown 报告
+  code-sentinel report ./src -f html md json      # 指定格式
+  code-sentinel fix ./src                         # 生成修复建议
+  code-sentinel fix ./src --verbose               # 显示详细 diff
+        """,
+    )
+
+    subparsers = parser.add_subparsers(dest="command", help="子命令")
+
+    # scan
+    scan_parser = subparsers.add_parser("scan", help="扫描代码并输出问题列表")
+    scan_parser.add_argument("path", type=str, help="目标文件或目录路径")
+    scan_parser.add_argument("-o", "--output", type=str, help="保存扫描结果到 JSON 文件")
+    scan_parser.add_argument("--json", action="store_true", help="以 JSON 格式输出扫描结果")
+    scan_parser.add_argument("-q", "--quiet", action="store_true", help="静默模式，仅输出关键结果")
+    scan_parser.add_argument("-v", "--verbose", action="store_true", help="详细输出")
+
+    # report
+    report_parser = subparsers.add_parser("report", help="生成 HTML/Markdown/JSON 报告")
+    report_parser.add_argument("path", type=str, help="目标文件或目录路径")
+    report_parser.add_argument("-o", "--output-dir", type=str, default=".",
+                               help="报告输出目录（默认当前目录）")
+    report_parser.add_argument("-f", "--format", type=str, nargs="+",
+                               choices=["html", "md", "json", "json-schema"],
+                               default=["html", "md"], help="报告格式（默认 html md）")
+    report_parser.add_argument("--json", action="store_true", help="以 JSON 格式输出报告")
+    report_parser.add_argument("-q", "--quiet", action="store_true", help="静默模式，仅输出关键结果")
+    report_parser.add_argument("-v", "--verbose", action="store_true", help="详细输出")
+
+    # fix
+    fix_parser = subparsers.add_parser("fix", help="生成修复建议和 diff")
+    fix_parser.add_argument("path", type=str, help="目标文件或目录路径")
+    fix_parser.add_argument("-o", "--output", type=str, help="保存修复结果到 JSON 文件")
+    fix_parser.add_argument("--json", action="store_true", help="以 JSON 格式输出修复结果")
+    fix_parser.add_argument("-q", "--quiet", action="store_true", help="静默模式，仅输出关键结果")
+    fix_parser.add_argument("-v", "--verbose", action="store_true", help="显示详细 diff")
+
+    # diff
+    diff_parser = subparsers.add_parser("diff", help="扫描 git diff 变更引入的问题")
+    diff_parser.add_argument("--staged", action="store_true",
+                             help="扫描已暂存（staged）的变更（即 git diff --staged）")
+    diff_parser.add_argument("-o", "--output", type=str, help="保存扫描结果到 JSON 文件")
+    diff_parser.add_argument("--json", action="store_true", help="以 JSON 格式输出扫描结果")
+    diff_parser.add_argument("-q", "--quiet", action="store_true", help="静默模式，仅输出关键结果")
+    diff_parser.add_argument("-v", "--verbose", action="store_true", help="详细输出")
+
+    return parser
+
+
+def main():
+    """CLI 主入口"""
+    parser = build_parser()
+    args = parser.parse_args()
+
+    if not args.command:
+        parser.print_help()
+        sys.exit(1)
+
+    # 打印横幅
+    if args.verbose:
+        _print_banner()
+        _print_genome_status()
+
+    # 路由到对应子命令
+    commands = {
+        "scan": cmd_scan,
+        "diff": cmd_diff,
+        "report": cmd_report,
+        "fix": cmd_fix,
+    }
+
+    cmd_fn = commands.get(args.command)
+    if cmd_fn:
+        try:
+            cmd_fn(args)
+        except FileNotFoundError as e:
+            print(f"❌ 错误: {e}", file=sys.stderr)
+            sys.exit(1)
+        except Exception as e:
+            print(f"❌ 执行失败: {e}", file=sys.stderr)
+            if HAS_GENOME_CORE:
+                audit_log("error", "工部", f"{args.command} 失败: {e}")
+            sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()