audit-test 0.1.0__py3-none-any.whl

audit_code/__init__.py

@@ -0,0 +1,3 @@
+"""audit-code: code and test verification orchestrator."""
+
+__version__ = "0.1.0"

audit_code/__main__.py

@@ -0,0 +1,5 @@
+"""Allow `python -m audit_code`."""
+
+from audit_code.cli import main
+
+main()

audit_code/adapters/__init__.py

@@ -0,0 +1,34 @@
+"""Language adapters — one per supported language."""
+
+from pathlib import Path
+
+from audit_code.adapters.cpp.adapter import CppAdapter
+from audit_code.adapters.csharp.adapter import CsharpAdapter
+from audit_code.adapters.go.adapter import GoAdapter
+from audit_code.adapters.html.adapter import HtmlAdapter
+from audit_code.adapters.java.adapter import JavaAdapter
+from audit_code.adapters.javascript.adapter import JavaScriptAdapter
+from audit_code.adapters.python.adapter import PythonAdapter
+from audit_code.adapters.rust.adapter import RustAdapter
+from audit_code.adapters.sql.adapter import SqlAdapter
+
+ALL = [
+    PythonAdapter,
+    JavaScriptAdapter,
+    JavaAdapter,
+    GoAdapter,
+    RustAdapter,
+    CsharpAdapter,
+    CppAdapter,
+    HtmlAdapter,
+    SqlAdapter,
+]
+
+
+def discover(target_root: Path) -> list:
+    """Return the adapter classes for every language detected in the target.
+
+    Detection only — the runner decides when to run syntax checks and test
+    suites so their results land in the report.
+    """
+    return [a for a in ALL if a.detect(target_root)]

audit_code/adapters/base.py

@@ -0,0 +1,202 @@
+"""Shared machinery for language adapters.
+
+Contract (fail-closed, honest):
+  - detect()        marker file at the root OR any source file anywhere.
+  - syntax_check()  runs a REAL check. Three honest outcomes only:
+                      PASS  files were actually checked and are clean
+                      FAIL/WARN  files were checked and have findings
+                      SKIP  no files, or the needed tool is missing
+                    A missing tool is never reported as PASS.
+  - test_command()  the native test invocation for the project, or None.
+"""
+
+import os
+import shutil
+import subprocess
+import time
+from pathlib import Path
+
+from audit_code.config import ADAPTER_EXCLUDE_DIRS, TOOL_TIMEOUT
+from audit_code.models import AuditResult, AuditStatus, Finding, Severity
+
+# Per-file checkers (one subprocess per file) stop after this many files so a
+# huge repo cannot stall the audit; the result notes the truncation.
+MAX_PER_FILE_CHECKS = 400  # audit: ok
+
+
+def which(name: str) -> str | None:
+    """Locate an executable on PATH (indirection point for tests)."""
+    return shutil.which(name)
+
+
+def _load_project_excludes(root: Path) -> set[str]:
+    """Load .audit-test-ignore patterns from a project root.
+
+    Returns extra dir/file name patterns to exclude.  Patterns are exact
+    name matches (not substrings), # for comments.
+    """
+    ignore_file = root / ".audit-test-ignore"
+    if not ignore_file.exists():
+        return set()
+    extras: set[str] = set()
+    try:
+        for line in ignore_file.read_text(encoding="utf-8").splitlines():
+            line = line.strip()
+            if not line or line.startswith("#"):
+                continue
+            extras.add(line)
+    except OSError:
+        pass
+    return extras
+
+
+def run_tool(cmd: list, cwd: Path, timeout: int = TOOL_TIMEOUT) -> tuple[int, str, str]:
+    """Run an external tool; returns (rc, stdout, stderr). Never raises."""
+    try:
+        proc = subprocess.run(
+            cmd,
+            cwd=str(cwd),
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=timeout,
+        )
+        return proc.returncode, proc.stdout or "", proc.stderr or ""
+    except subprocess.TimeoutExpired:
+        return -1, "", f"[timed out after {timeout}s]"
+    except OSError as e:
+        return -2, "", f"[failed to launch: {e}]"
+
+
+def iter_source_files(
+    root: Path, extensions: tuple, extra_excludes: set[str] | None = None
+):
+    """Yield files under root (root-level included) with pruned walk."""
+    excludes = ADAPTER_EXCLUDE_DIRS
+    if extra_excludes:
+        excludes = excludes | extra_excludes
+    exts = tuple(extensions)
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in excludes]
+        for fn in filenames:
+            if fn.endswith(exts):
+                yield Path(dirpath) / fn
+
+
+class LanguageAdapter:
+    """Base adapter. Subclasses set language/extensions/markers and implement
+    check_files() with a real syntax check."""
+
+    language: str = ""
+    extensions: tuple = ()
+    marker_files: tuple = ()
+    tool_hint: str = ""  # how to install the checker, shown on SKIP
+
+    @classmethod
+    def audit_id(cls) -> str:
+        return f"{cls.language}-syntax"
+
+    @classmethod
+    def detect(cls, target_root: Path) -> bool:
+        for marker in cls.marker_files:
+            if (target_root / marker).exists():
+                return True
+        root = target_root.resolve()
+        extras = _load_project_excludes(root)
+        return next(iter_source_files(root, cls.extensions, extras), None) is not None
+
+    @classmethod
+    def collect_files(cls, target_root: Path) -> list:
+        root = target_root.resolve()
+        extras = _load_project_excludes(root)
+        return sorted(iter_source_files(root, cls.extensions, extras))
+
+    @classmethod
+    def syntax_check(cls, target_root: Path) -> AuditResult:
+        root = target_root.resolve()
+        files = cls.collect_files(root)
+        if not files:
+            return cls.skip(f"no {cls.language} source files found")
+        return cls.check_files(root, files)
+
+    @classmethod
+    def check_files(cls, root: Path, files: list) -> AuditResult:
+        raise NotImplementedError(f"{cls.__name__} must implement check_files()")
+
+    @staticmethod
+    def test_command(target_root: Path) -> list | None:
+        return None
+
+    # ── result helpers ──
+
+    @classmethod
+    def skip(cls, reason: str, tool_missing: bool = False) -> AuditResult:
+        msg = reason
+        if tool_missing and cls.tool_hint:
+            msg = f"{reason} ({cls.tool_hint})"
+        return AuditResult(
+            audit_id=cls.audit_id(),
+            status=AuditStatus.SKIP,
+            completed=True,
+            tool_missing=tool_missing,
+            stdout=msg,
+        )
+
+    @classmethod
+    def finding(
+        cls,
+        message: str,
+        file: str | None = None,
+        line: int | None = None,
+        severity: Severity = Severity.HIGH,
+    ) -> Finding:
+        return Finding(
+            rule_id=cls.audit_id(),
+            severity=severity,
+            message=message[:300],
+            file=file,
+            line=line,
+            language=cls.language,
+            source="adapter",
+        )
+
+    @classmethod
+    def result(cls, findings: list, notes: list) -> AuditResult:
+        has_high = any(f.severity == Severity.HIGH for f in findings)
+        has_med = any(f.severity == Severity.MEDIUM for f in findings)
+        status = (
+            AuditStatus.FAIL
+            if has_high
+            else (AuditStatus.WARN if has_med else AuditStatus.PASS)
+        )
+        lines = list(notes)
+        for f in findings[:50]:
+            loc = f"{f.file}:{f.line}" if f.file else ""
+            lines.append(f"  [{f.severity.value}] {loc}  {f.message}".rstrip())
+        if len(findings) > 50:
+            lines.append(f"  ... {len(findings) - 50} more finding(s)")
+        return AuditResult(
+            audit_id=cls.audit_id(),
+            status=status,
+            findings=findings,
+            completed=True,
+            stdout="\n".join(lines),
+        )
+
+
+class TimeBudget:
+    """Wall-clock budget for per-file checker loops."""
+
+    def __init__(self, seconds: int = TOOL_TIMEOUT):
+        self.deadline = time.monotonic() + seconds
+
+    def exhausted(self) -> bool:
+        return time.monotonic() > self.deadline
+
+
+def rel(path: Path, root: Path) -> str:
+    try:
+        return str(path.relative_to(root))
+    except ValueError:
+        return str(path)

audit_code/adapters/cpp/__init__.py

@@ -0,0 +1 @@
+"""Cpp adapter."""

audit_code/adapters/cpp/adapter.py

@@ -0,0 +1,114 @@
+"""C/C++ adapter — per-file `-fsyntax-only` (gcc/clang) or `/Zs` (MSVC cl).
+This genuinely parses each translation unit. Missing project headers are
+counted but not judged (they need the build system's include paths). Headers
+are not compiled standalone — most need a surrounding translation unit."""
+
+import re
+from pathlib import Path
+
+from audit_code.adapters.base import (
+    MAX_PER_FILE_CHECKS,
+    LanguageAdapter,
+    TimeBudget,
+    rel,
+    run_tool,
+    which,
+)
+
+_UNIT_EXTS = (".c", ".cc", ".cpp", ".cxx")
+_GCC_ERR = re.compile(r"^(.*?):(\d+):(?:\d+:)?\s*(?:fatal )?error:\s*(.*)$")
+_CL_ERR = re.compile(r"^(.*?)\((\d+)\):\s*(?:fatal )?error\s+C\d+:\s*(.*)$")
+_MISSING_HDR = ("No such file or directory", "file not found", "Cannot open include")
+
+
+class CppAdapter(LanguageAdapter):
+    """Language adapter for C/C++ projects."""
+
+    language = "cpp"
+    extensions = _UNIT_EXTS + (".h", ".hpp", ".hh")
+    marker_files = ("CMakeLists.txt", "Makefile", "meson.build")
+    tool_hint = "install gcc/clang (or MSVC cl.exe on PATH)"
+
+    @classmethod
+    def check_files(cls, root: Path, files: list):
+        cc_cxx = which("g++") or which("clang++")
+        cc_c = which("gcc") or which("clang") or cc_cxx
+        cl = which("cl")
+        if not cc_cxx and not cc_c and not cl:
+            return cls.skip("no C/C++ compiler found — cannot check syntax", True)
+
+        units = [f for f in files if f.suffix in _UNIT_EXTS]
+        headers = len(files) - len(units)
+        if not units:
+            return cls.skip(
+                f"{headers} header file(s) only — headers are not compiled "
+                "standalone (no translation units found)"
+            )
+
+        findings, notes = [], []
+        missing_hdrs = 0
+        budget = TimeBudget()
+        checked = 0
+        for f in units[:MAX_PER_FILE_CHECKS]:
+            if budget.exhausted():
+                notes.append(
+                    f"time budget exhausted after {checked}/{len(units)} units"
+                )
+                break
+            if cl and not cc_cxx and not cc_c:
+                cmd = [cl, "/Zs", "/nologo", str(f)]
+                err_re = _CL_ERR
+            else:
+                preferred = cc_c if f.suffix == ".c" else cc_cxx
+                fallback = cc_cxx or cc_c
+                if preferred is not None:
+                    cmd = [preferred, "-fsyntax-only", "-I", str(f.parent), str(f)]
+                elif fallback is not None:
+                    mode = "c" if f.suffix == ".c" else "c++"
+                    cmd = [
+                        fallback,
+                        "-x",
+                        mode,
+                        "-fsyntax-only",
+                        "-I",
+                        str(f.parent),
+                        str(f),
+                    ]
+                else:  # unreachable: the skip() above guarantees a compiler
+                    break
+                err_re = _GCC_ERR
+            rc, out, err = run_tool(cmd, root, timeout=60)
+            checked += 1
+            if rc == 0:
+                continue
+            for ln in (err + "\n" + out).splitlines():
+                m = err_re.match(ln.strip())
+                if not m:
+                    continue
+                msg = m.group(3)
+                if any(marker in msg for marker in _MISSING_HDR):
+                    missing_hdrs += 1
+                    continue
+                findings.append(
+                    cls.finding(msg, file=rel(f, root), line=int(m.group(2)))
+                )
+        notes.insert(
+            0,
+            f"{checked}/{len(units)} translation unit(s) parsed "
+            f"({headers} header(s) not compiled standalone)",
+        )
+        if missing_hdrs:
+            notes.append(
+                f"{missing_hdrs} missing-include error(s) not judged "
+                "(needs the build system's include paths)"
+            )
+        if len(units) > MAX_PER_FILE_CHECKS:
+            notes.append(f"capped at {MAX_PER_FILE_CHECKS} files")
+        return cls.result(findings, notes)
+
+    @staticmethod
+    def test_command(target_root: Path) -> list | None:
+        ctest = which("ctest")
+        if ctest and (target_root / "build").is_dir():
+            return [ctest, "--test-dir", "build", "--output-on-failure"]
+        return None

audit_code/adapters/csharp/__init__.py

@@ -0,0 +1 @@
+"""Csharp adapter."""

audit_code/adapters/csharp/adapter.py

@@ -0,0 +1,85 @@
+"""C# adapter — `dotnet build` is the real gate (there is no lightweight
+syntax-only checker on a normal PATH). Restore failures (offline, missing
+feed) are an honest SKIP, because the compiler never ran."""
+
+import re
+from pathlib import Path
+
+from audit_code.adapters.base import (
+    LanguageAdapter,
+    iter_source_files,
+    run_tool,
+    which,
+)
+
+# MSBuild: path(line,col): error CS1002: ; expected [proj.csproj]
+_ERR = re.compile(r"^(.*?)\((\d+),\d+\):\s*error\s+(CS\d+):\s*(.*?)(\s*\[.*\])?$")
+
+
+class CsharpAdapter(LanguageAdapter):
+    """Language adapter for C# projects."""
+
+    language = "csharp"
+    extensions = (".cs",)
+    marker_files = ()
+    tool_hint = "install the .NET SDK from dotnet.microsoft.com"
+
+    @classmethod
+    def check_files(cls, root: Path, files: list):
+        dotnet = which("dotnet")
+        if not dotnet:
+            return cls.skip("dotnet not found — cannot check syntax", True)
+        projects = list(iter_source_files(root, (".csproj", ".sln", ".slnx")))
+        if not projects:
+            return cls.skip(
+                f"{len(files)} .cs file(s) but no .csproj/.sln — "
+                "bare files cannot be built"
+            )
+
+        rc, out, err = run_tool([dotnet, "build", "--nologo", "-v:q"], root)
+        if rc == -1:
+            return cls.skip("dotnet build timed out")
+        if rc == -2:
+            return cls.skip(f"dotnet failed to launch: {err}", True)
+
+        text = out + "\n" + err
+        if rc != 0 and ("error NU" in text or "Restore failed" in text):
+            return cls.skip(
+                "NuGet restore failed — compiler never ran, cannot judge "
+                "(check network/feeds)"
+            )
+
+        findings = []
+        seen = set()
+        for ln in text.splitlines():
+            m = _ERR.match(ln.strip())
+            if m:
+                key = (m.group(1), m.group(2), m.group(3))
+                if key in seen:
+                    continue
+                seen.add(key)
+                findings.append(
+                    cls.finding(
+                        f"{m.group(3)}: {m.group(4)}",
+                        file=m.group(1),
+                        line=int(m.group(2)),
+                    )
+                )
+        if rc != 0 and not findings:
+            tail = "\n".join(text.strip().splitlines()[-5:])
+            findings.append(cls.finding(f"dotnet build failed (rc={rc}): {tail}"))
+        notes = [
+            f"{len(files)} C# file(s) across {len(projects)} project(s) "
+            "checked via dotnet build"
+        ]
+        return cls.result(findings, notes)
+
+    @staticmethod
+    def test_command(target_root: Path) -> list | None:
+        dotnet = which("dotnet")
+        if not dotnet:
+            return None
+        projects = list(iter_source_files(target_root, (".csproj", ".sln")))
+        if projects:
+            return [dotnet, "test", "--nologo"]
+        return None

audit_code/adapters/go/__init__.py

@@ -0,0 +1 @@
+"""Go adapter."""

audit_code/adapters/go/adapter.py

@@ -0,0 +1,53 @@
+"""Go adapter — `gofmt -l -e` parses every file (real syntax check); parse
+errors land on stderr as path:line:col, unformatted files on stdout."""
+
+import re
+from pathlib import Path
+
+from audit_code.adapters.base import LanguageAdapter, run_tool, which
+from audit_code.models import Severity
+
+_ERR = re.compile(r"^(.*?\.go):(\d+):(\d+):\s*(.*)$")
+
+
+class GoAdapter(LanguageAdapter):
+    """Language adapter for Go projects."""
+
+    language = "go"
+    extensions = (".go",)
+    marker_files = ("go.mod",)
+    tool_hint = "install the Go toolchain from go.dev"
+
+    @classmethod
+    def check_files(cls, root: Path, files: list):
+        gofmt = which("gofmt")
+        if not gofmt:
+            return cls.skip("gofmt not found — cannot check syntax", True)
+
+        rc, out, err = run_tool([gofmt, "-l", "-e", "."], root)
+        if rc == -2:
+            return cls.skip(f"gofmt failed to launch: {err}", True)
+
+        findings = []
+        for ln in err.splitlines():
+            m = _ERR.match(ln.strip())
+            if m:
+                findings.append(
+                    cls.finding(m.group(4), file=m.group(1), line=int(m.group(2)))
+                )
+        unformatted = [ln.strip() for ln in out.splitlines() if ln.strip()]
+        for uf in unformatted:
+            findings.append(
+                cls.finding("not gofmt-formatted", file=uf, severity=Severity.MEDIUM)
+            )
+        notes = [f"{len(files)} Go file(s) parsed via gofmt -l -e"]
+        if unformatted:
+            notes.append(f"{len(unformatted)} file(s) have formatting drift")
+        return cls.result(findings, notes)
+
+    @staticmethod
+    def test_command(target_root: Path) -> list | None:
+        go = which("go")
+        if go and (target_root / "go.mod").exists():
+            return [go, "test", "./..."]
+        return None

audit_code/adapters/html/__init__.py

@@ -0,0 +1 @@
+"""Html adapter."""

audit_code/adapters/html/adapter.py

@@ -0,0 +1,177 @@
+"""HTML/CSS adapter — self-contained structural well-formedness checks.
+
+HTML: stdlib HTMLParser drives a tag-balance check (stray closing tags,
+unclosed elements) with void-element awareness. CSS/SCSS: brace balance,
+string/comment aware. These catch genuinely broken files; they are NOT a
+full spec validator, and the result says so. Findings are MEDIUM (browsers
+tolerate malformed markup), so the audit warns rather than hard-fails.
+"""
+
+from html.parser import HTMLParser
+from pathlib import Path
+
+from audit_code.adapters.base import LanguageAdapter, rel
+from audit_code.models import Severity
+
+_VOID = {
+    "area",
+    "base",
+    "br",
+    "col",
+    "embed",
+    "hr",
+    "img",
+    "input",
+    "link",
+    "meta",
+    "param",
+    "source",
+    "track",
+    "wbr",
+}
+# Elements the HTML spec auto-closes; unclosed is legal, not a defect.
+_OPTIONAL_CLOSE = {
+    "p",
+    "li",
+    "td",
+    "tr",
+    "th",
+    "dt",
+    "dd",
+    "option",
+    "html",
+    "body",
+    "head",
+}
+
+
+class _TagBalancer(HTMLParser):
+    def __init__(self):
+        super().__init__(convert_charrefs=True)
+        self.stack: list = []  # (tag, line)
+        self.problems: list = []  # (line, message)
+
+    def handle_starttag(self, tag, attrs):
+        if tag not in _VOID:
+            self.stack.append((tag, self.getpos()[0]))
+
+    def handle_startendtag(self, tag, attrs):
+        pass  # self-closing — nothing to balance
+
+    def handle_endtag(self, tag):
+        line = self.getpos()[0]
+        if tag in _VOID:
+            return
+        open_tags = [t for t, _ in self.stack]
+        if tag not in open_tags:
+            self.problems.append((line, f"stray closing tag </{tag}>"))
+            return
+        while self.stack:
+            open_tag, open_line = self.stack.pop()
+            if open_tag == tag:
+                break
+            if open_tag not in _OPTIONAL_CLOSE:
+                self.problems.append(
+                    (
+                        open_line,
+                        f"<{open_tag}> never closed (implicitly "
+                        f"closed by </{tag}> at line {line})",
+                    )
+                )
+
+    def finish(self):
+        for open_tag, open_line in self.stack:
+            if open_tag not in _OPTIONAL_CLOSE:
+                self.problems.append((open_line, f"<{open_tag}> never closed"))
+
+
+def _check_css_braces(text: str) -> list:
+    """Return (line, message) for unbalanced braces, skipping strings/comments."""
+    problems = []
+    depth = 0
+    line = 1
+    i = 0
+    n = len(text)
+    in_str: str | None = None
+    while i < n:
+        ch = text[i]
+        if ch == "\n":
+            line += 1
+            in_str = None  # CSS strings do not span raw newlines
+        elif in_str:
+            if ch == "\\":
+                i += 1
+            elif ch == in_str:
+                in_str = None
+        elif ch in "\"'":
+            in_str = ch
+        elif ch == "/" and i + 1 < n and text[i + 1] == "*":
+            end = text.find("*/", i + 2)
+            if end == -1:
+                break
+            line += text.count("\n", i, end)
+            i = end + 1
+        elif ch == "/" and i + 1 < n and text[i + 1] == "/":
+            nl = text.find("\n", i)
+            i = (nl - 1) if nl != -1 else n
+        elif ch == "{":
+            depth += 1
+        elif ch == "}":
+            depth -= 1
+            if depth < 0:
+                problems.append((line, "unmatched closing brace '}'"))
+                depth = 0
+        i += 1
+    if depth > 0:
+        problems.append((line, f"{depth} unclosed brace(s) '{{' at end of file"))
+    return problems
+
+
+class HtmlAdapter(LanguageAdapter):
+    """Language adapter for HTML/CSS projects."""
+
+    language = "html"
+    extensions = (".html", ".htm", ".css", ".scss")
+    marker_files = ()
+
+    @classmethod
+    def check_files(cls, root: Path, files: list):
+        findings = []
+        html_n = css_n = 0
+        for f in files:
+            text = f.read_text(encoding="utf-8", errors="replace")
+            if f.suffix in (".html", ".htm"):
+                html_n += 1
+                parser = _TagBalancer()
+                try:
+                    parser.feed(text)
+                    parser.close()
+                except Exception as e:  # HTMLParser rarely raises; fail closed
+                    parser.problems.append((0, f"parser error: {e}"))
+                parser.finish()
+                for line, msg in parser.problems[:20]:
+                    findings.append(
+                        cls.finding(
+                            msg,
+                            file=rel(f, root),
+                            line=line or None,
+                            severity=Severity.MEDIUM,
+                        )
+                    )
+            else:
+                css_n += 1
+                for line, msg in _check_css_braces(text)[:20]:
+                    findings.append(
+                        cls.finding(
+                            msg,
+                            file=rel(f, root),
+                            line=line,
+                            severity=Severity.MEDIUM,
+                        )
+                    )
+        notes = [
+            f"{html_n} HTML file(s) tag-balance checked, "
+            f"{css_n} CSS/SCSS file(s) brace-balance checked "
+            "(structural check — not a full spec validator)"
+        ]
+        return cls.result(findings, notes)

audit_code/adapters/java/__init__.py

@@ -0,0 +1 @@
+"""Java adapter."""