attocode-code-intel 0.1.0__py3-none-any.whl

attocode_intel/artifacts/retrieval_pin.py

@@ -0,0 +1,159 @@
+"""Retrieval pins — make ranked-result tools deterministic across calls.
+
+A ``RetrievalPin`` is a content-addressed snapshot of the state of every
+code-intel store at a moment in time. Every ranked-result tool
+(``semantic_search``, ``fast_search``, ``repo_map``, etc.) emits one in its
+response; a caller can then pass the pin back to ``retrieve_with_pin`` to
+re-run the same query against the same state, with a loud drift error if
+the underlying stores have changed.
+
+The per-store hash is cheap: ``sha256(max(updated_at) || row_count || schema_version)``.
+That's stable under no-op reads and changes on any write.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import secrets
+import time
+from dataclasses import asdict, dataclass, field
+from typing import TYPE_CHECKING, Any
+
+from attocode_intel.artifacts.hashing import canonical_json
+
+if TYPE_CHECKING:
+    from collections.abc import Mapping
+
+PIN_SCHEMA_VERSION = 1
+DEFAULT_TTL_SECONDS = 86_400  # 24 hours
+
+
+def compute_store_hash(
+    *,
+    schema_version: str | int,
+    row_count: int,
+    max_updated_at: float | None,
+    extra: Mapping[str, Any] | None = None,
+) -> str:
+    """Compute a cheap, stable content hash for one store's current state.
+
+    Intentionally only uses three fields (schema version, row count, latest
+    ``updated_at``) so the hash can be computed with a single cheap SQL
+    aggregate query. ``extra`` is for stores that need to mix in something
+    else (e.g. active embedding model pointer) — pass a small dict, it goes
+    through canonical JSON.
+
+    Two stores on two machines with exactly the same rows should produce
+    the same hash; mutations (insert/update/delete) change it; pure reads
+    do not.
+    """
+    body = {
+        "schema": str(schema_version),
+        "rows": int(row_count),
+        "max_updated_at": float(max_updated_at or 0.0),
+        "extra": dict(extra or {}),
+    }
+    return hashlib.sha256(canonical_json(body)).hexdigest()
+
+
+def make_pin_id() -> str:
+    """Return a short, URL-safe, unguessable pin id: ``pin_<22 base32 chars>``."""
+    raw = secrets.token_bytes(16)
+    token = base64.b32encode(raw).decode("ascii").rstrip("=").lower()
+    return f"pin_{token}"
+
+
+@dataclass(frozen=True, slots=True)
+class RetrievalPin:
+    """Immutable snapshot of code-intel state.
+
+    Fields:
+      - ``pin_id``: short identifier (see :func:`make_pin_id`).
+      - ``schema_version``: for forward-compat.
+      - ``manifest_hashes``: per-store name → hex store hash.
+      - ``manifest_hash``: sha256 of the canonical JSON of ``manifest_hashes``
+        (plus overlay_id). This is the thing to compare when checking drift.
+      - ``overlay_id``: optional branch/overlay identifier (local side).
+      - ``branch_id``: optional DB branch id (server side).
+      - ``created_at``, ``expires_at``: unix seconds; 0 for no expiry.
+    """
+
+    pin_id: str
+    schema_version: int
+    manifest_hashes: dict[str, str] = field(default_factory=dict)
+    manifest_hash: str = ""
+    overlay_id: str | None = None
+    branch_id: str | None = None
+    created_at: float = 0.0
+    expires_at: float = 0.0
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        manifest_hashes: Mapping[str, str],
+        overlay_id: str | None = None,
+        branch_id: str | None = None,
+        ttl_seconds: int = DEFAULT_TTL_SECONDS,
+        pin_id: str | None = None,
+    ) -> RetrievalPin:
+        """Build a new pin from a dict of per-store hashes."""
+        manifest = {str(k): str(v) for k, v in sorted(manifest_hashes.items())}
+        manifest_hash = hashlib.sha256(
+            canonical_json({"manifest": manifest, "overlay": overlay_id, "branch": branch_id})
+        ).hexdigest()
+        now = time.time()
+        return cls(
+            pin_id=pin_id or make_pin_id(),
+            schema_version=PIN_SCHEMA_VERSION,
+            manifest_hashes=dict(manifest),
+            manifest_hash=manifest_hash,
+            overlay_id=overlay_id,
+            branch_id=branch_id,
+            created_at=now,
+            expires_at=now + ttl_seconds if ttl_seconds > 0 else 0.0,
+        )
+
+    def is_expired(self, now: float | None = None) -> bool:
+        """Whether the pin has passed its TTL. Pins with expires_at == 0 never expire."""
+        if self.expires_at <= 0:
+            return False
+        return (now if now is not None else time.time()) >= self.expires_at
+
+    def drift_from(self, current_hashes: Mapping[str, str]) -> dict[str, tuple[str, str]]:
+        """Return a map of store_name -> (pinned_hash, current_hash) for any store that
+        changed vs the pinned state. Empty dict means no drift.
+
+        Stores present in one side but not the other are reported with the
+        missing side as ``""`` — this is usually a schema change and should
+        be treated as drift.
+        """
+        drift: dict[str, tuple[str, str]] = {}
+        all_keys = set(self.manifest_hashes) | set(current_hashes)
+        for key in all_keys:
+            pinned = self.manifest_hashes.get(key, "")
+            current = current_hashes.get(key, "")
+            if pinned != current:
+                drift[key] = (pinned, current)
+        return drift
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+    def to_json(self) -> str:
+        return json.dumps(self.to_dict(), sort_keys=True, ensure_ascii=True)
+
+    @classmethod
+    def from_dict(cls, data: Mapping[str, Any]) -> RetrievalPin:
+        return cls(
+            pin_id=str(data["pin_id"]),
+            schema_version=int(data.get("schema_version", PIN_SCHEMA_VERSION)),
+            manifest_hashes=dict(data.get("manifest_hashes", {})),
+            manifest_hash=str(data.get("manifest_hash", "")),
+            overlay_id=data.get("overlay_id"),
+            branch_id=data.get("branch_id"),
+            created_at=float(data.get("created_at", 0.0)),
+            expires_at=float(data.get("expires_at", 0.0)),
+        )

attocode_intel/audit.py

@@ -0,0 +1,59 @@
+"""Audit event logging utility — writes to DB and publishes via Redis."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from sqlalchemy.ext.asyncio import AsyncSession
+
+logger = logging.getLogger(__name__)
+
+
+async def log_event(
+    session: AsyncSession,
+    org_id: uuid.UUID,
+    event_type: str,
+    *,
+    repo_id: uuid.UUID | None = None,
+    user_id: uuid.UUID | None = None,
+    detail: dict | None = None,
+) -> None:
+    """Log an audit event to DB and publish to Redis for real-time streaming.
+
+    Args:
+        session: Active DB session (caller should commit).
+        org_id: Organization ID.
+        event_type: Event type string (e.g. "org.created", "api_key.revoked").
+        repo_id: Optional repository ID.
+        user_id: Optional user ID who performed the action.
+        detail: Optional JSON-serializable detail dict.
+    """
+    from attocode_intel.db.models import AuditEvent
+
+    event = AuditEvent(
+        org_id=org_id,
+        repo_id=repo_id,
+        user_id=user_id,
+        event_type=event_type,
+        detail=detail or {},
+    )
+    session.add(event)
+
+    # Also publish to Redis for real-time WebSocket streaming
+    try:
+        from attocode_intel.pubsub import publish_event
+
+        channel_id = str(repo_id) if repo_id else str(org_id)
+        await publish_event(channel_id, f"audit.{event_type}", {
+            "org_id": str(org_id),
+            "repo_id": str(repo_id) if repo_id else None,
+            "user_id": str(user_id) if user_id else None,
+            "event_type": event_type,
+            "detail": detail or {},
+        })
+    except Exception:
+        # Don't fail the main operation if Redis publish fails
+        logger.debug("Failed to publish audit event to Redis", exc_info=True)

attocode_intel/bug_finder.py

@@ -0,0 +1,206 @@
+"""Bug finder — scans diffs for potential issues.
+
+Analyzes code changes between branches, looking for common
+bug patterns, edge cases, security issues, and performance
+problems. Reports findings with confidence levels.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from dataclasses import dataclass, field
+from enum import StrEnum
+
+from attocode_intel._internal.types.severity import Severity
+
+logger = logging.getLogger(__name__)
+
+
+class FindingCategory(StrEnum):
+    """Category of bug finding."""
+    LOGIC_ERROR = "logic_error"
+    EDGE_CASE = "edge_case"
+    SECURITY = "security"
+    PERFORMANCE = "performance"
+    ERROR_HANDLING = "error_handling"
+    TYPE_SAFETY = "type_safety"
+    CONCURRENCY = "concurrency"
+    RESOURCE_LEAK = "resource_leak"
+
+
+@dataclass(slots=True)
+class Finding:
+    """A single bug finding."""
+    file: str
+    line: int
+    severity: Severity
+    category: FindingCategory
+    confidence: float  # 0.0-1.0
+    description: str
+    suggestion: str = ""
+    code_snippet: str = ""
+
+
+@dataclass(slots=True)
+class BugReport:
+    """Complete bug report for a scan."""
+    findings: list[Finding] = field(default_factory=list)
+    files_scanned: int = 0
+    lines_analyzed: int = 0
+    scan_duration: float = 0.0
+
+    @property
+    def critical_count(self) -> int:
+        return sum(1 for f in self.findings if f.severity == Severity.CRITICAL)
+
+    @property
+    def high_count(self) -> int:
+        return sum(1 for f in self.findings if f.severity == Severity.HIGH)
+
+    def filter_by_confidence(self, min_confidence: float = 0.5) -> list[Finding]:
+        """Filter findings by minimum confidence level."""
+        return [f for f in self.findings if f.confidence >= min_confidence]
+
+    def format_report(self, *, min_confidence: float = 0.5) -> str:
+        """Format findings as a human-readable report."""
+        filtered = self.filter_by_confidence(min_confidence)
+        if not filtered:
+            return f"No findings above {min_confidence:.0%} confidence ({self.files_scanned} files scanned)."
+
+        lines = [
+            f"Bug Report: {len(filtered)} findings ({self.files_scanned} files, {self.lines_analyzed} lines)",
+            "",
+        ]
+
+        # Group by severity
+        for severity in (Severity.CRITICAL, Severity.HIGH, Severity.MEDIUM, Severity.LOW):
+            group = [f for f in filtered if f.severity == severity]
+            if not group:
+                continue
+            lines.append(f"### {severity.value.upper()} ({len(group)})")
+            for finding in group:
+                confidence_pct = f"{finding.confidence:.0%}"
+                lines.append(
+                    f"  [{confidence_pct}] {finding.file}:{finding.line} — "
+                    f"{finding.description}"
+                )
+                if finding.suggestion:
+                    lines.append(f"         Fix: {finding.suggestion}")
+            lines.append("")
+
+        return "\n".join(lines)
+
+
+# --- Static pattern-based analysis ---
+
+_PATTERNS: list[tuple[str, FindingCategory, Severity, str, float]] = [
+    # (regex, category, severity, description_template, confidence)
+    (r"except\s*:", FindingCategory.ERROR_HANDLING, Severity.MEDIUM,
+     "Bare except clause catches all exceptions including KeyboardInterrupt", 0.9),
+    (r"eval\s*\(", FindingCategory.SECURITY, Severity.HIGH,
+     "Use of eval() can execute arbitrary code", 0.85),
+    (r"exec\s*\(", FindingCategory.SECURITY, Severity.HIGH,
+     "Use of exec() can execute arbitrary code", 0.8),
+    (r"subprocess\.call\(.*shell\s*=\s*True", FindingCategory.SECURITY, Severity.HIGH,
+     "subprocess with shell=True is vulnerable to injection", 0.85),
+    (r"\.format\(.*\)\s*$", FindingCategory.SECURITY, Severity.LOW,
+     "Consider f-strings over .format() for clarity", 0.3),
+    (r"TODO|FIXME|HACK|XXX", FindingCategory.LOGIC_ERROR, Severity.INFO,
+     "Unresolved TODO/FIXME marker", 0.95),
+    (r"time\.sleep\(\d{2,}", FindingCategory.PERFORMANCE, Severity.MEDIUM,
+     "Long sleep duration may indicate polling pattern", 0.6),
+    (r"except\s+Exception\s+as\s+\w+:\s*\n\s*pass", FindingCategory.ERROR_HANDLING, Severity.MEDIUM,
+     "Exception silently swallowed", 0.75),
+]
+
+
+def scan_text(
+    text: str,
+    file_path: str = "<unknown>",
+    *,
+    line_offset: int = 0,
+) -> list[Finding]:
+    """Scan text for common bug patterns.
+
+    Args:
+        text: Source code text.
+        file_path: File path for reporting.
+        line_offset: Line offset for diff-based scanning.
+
+    Returns:
+        List of findings.
+    """
+    findings: list[Finding] = []
+    lines = text.split("\n")
+
+    for i, line in enumerate(lines, start=1 + line_offset):
+        for pattern, category, severity, desc, confidence in _PATTERNS:
+            if re.search(pattern, line):
+                findings.append(Finding(
+                    file=file_path,
+                    line=i,
+                    severity=severity,
+                    category=category,
+                    confidence=confidence,
+                    description=desc,
+                    code_snippet=line.strip()[:120],
+                ))
+
+    return findings
+
+
+_HUNK_RE = re.compile(r"^@@ -\d+(?:,\d+)? \+(\d+)")
+
+
+def _added_lines(diff_text: str) -> list[tuple[str, list[tuple[int, str]]]]:
+    """Added lines per file, numbered as they sit in the new file.
+
+    A hunk header sets the new-file line; context lines advance it, removed
+    lines do not. A diff without hunk headers numbers added lines from 1.
+    """
+    files: list[tuple[str, list[tuple[int, str]]]] = []
+    lineno = 1
+    for line in diff_text.split("\n"):
+        if line.startswith("+++ b/"):
+            files.append((line[6:], []))
+            lineno = 1
+        elif not files:
+            continue
+        elif m := _HUNK_RE.match(line):
+            lineno = int(m.group(1))
+        elif line.startswith("+") and not line.startswith("+++"):
+            files[-1][1].append((lineno, line[1:]))
+            lineno += 1
+        elif line.startswith(" ") or not line:  # context; some tools strip the space
+            lineno += 1
+    return [(path, added) for path, added in files if added]
+
+
+def parse_diff_files(diff_text: str) -> list[tuple[str, str]]:
+    """Parse a unified diff into (file_path, changed_content) pairs."""
+    return [(path, "\n".join(text for _, text in added)) for path, added in _added_lines(diff_text)]
+
+
+def scan_diff(diff_text: str) -> BugReport:
+    """Scan a unified diff for bug patterns.
+
+    Parses the diff, extracts added lines, and runs
+    pattern-based analysis on each changed file.
+    """
+    files = _added_lines(diff_text)
+    all_findings: list[Finding] = []
+    total_lines = 0
+
+    for file_path, added in files:
+        if not file_path.endswith((".py", ".js", ".ts", ".go", ".rs", ".java")):
+            continue
+        for lineno, text in added:
+            all_findings.extend(scan_text(text, file_path, line_offset=lineno - 1))
+        total_lines += len(added)
+
+    return BugReport(
+        findings=all_findings,
+        files_scanned=len(files),
+        lines_analyzed=total_lines,
+    )

attocode_intel/bundle.py

@@ -0,0 +1,80 @@
+"""Portable local artifact bundles for code-intel state."""
+
+from __future__ import annotations
+
+import json
+import tarfile
+from datetime import UTC, datetime
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from attocode_intel import __version__
+from attocode_intel.artifacts.hashing import sha256_file
+
+_SCHEMA_VERSION = 1
+_ARTIFACTS = (
+    ("artifacts/index/symbols.db", ".attocode/index/symbols.db"),
+    ("artifacts/vectors/embeddings.db", ".attocode/vectors/embeddings.db"),
+    ("artifacts/cache/memory.db", ".attocode/cache/memory.db"),
+    ("artifacts/adrs.db", ".attocode/adrs.db"),
+)
+
+
+def _metadata(project_dir: Path) -> dict[str, object]:
+    artifacts: list[dict[str, object]] = []
+    for bundle_path, rel_path in _ARTIFACTS:
+        source = project_dir / rel_path
+        present = source.exists()
+        artifacts.append({
+            "path": bundle_path,
+            "present": present,
+            "size_bytes": source.stat().st_size if present else 0,
+            "sha256": sha256_file(source) if present else None,
+        })
+
+    return {
+        "schema_version": _SCHEMA_VERSION,
+        "created_at": datetime.now(UTC).isoformat().replace("+00:00", "Z"),
+        "project_name": project_dir.name,
+        "project_root_basename": project_dir.name,
+        "attocode_version": __version__,
+        "artifacts": artifacts,
+    }
+
+
+def export_bundle(project_dir: str, output_path: str) -> Path:
+    """Export local code-intel artifacts into a tar.gz bundle."""
+    project_root = Path(project_dir).resolve()
+    destination = Path(output_path).resolve()
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    metadata = _metadata(project_root)
+
+    with TemporaryDirectory(prefix="attocode-bundle-") as tmpdir:
+        root = Path(tmpdir) / "attocode-bundle"
+        root.mkdir(parents=True, exist_ok=True)
+        metadata_path = root / "metadata.json"
+        metadata_path.write_text(json.dumps(metadata, indent=2) + "\n", encoding="utf-8")
+
+        for bundle_path, rel_path in _ARTIFACTS:
+            source = project_root / rel_path
+            if not source.exists():
+                continue
+            target = root / bundle_path
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_bytes(source.read_bytes())
+
+        with tarfile.open(destination, "w:gz") as archive:
+            archive.add(root, arcname="attocode-bundle")
+
+    return destination
+
+
+def inspect_bundle(bundle_path: str) -> dict[str, object]:
+    """Read bundle metadata without touching local project state."""
+    bundle = Path(bundle_path).resolve()
+    with tarfile.open(bundle, "r:gz") as archive:
+        metadata_member = archive.getmember("attocode-bundle/metadata.json")
+        fh = archive.extractfile(metadata_member)
+        if fh is None:
+            raise FileNotFoundError("metadata.json missing from bundle")
+        return json.loads(fh.read().decode("utf-8"))