codedd-cli 0.1.0__py3-none-any.whl

codedd_cli/auditor/vulnerability_validator.py

@@ -0,0 +1,324 @@
+"""
+Local vulnerability validation for CLI audits.
+
+Runs source-aware validation on the user's machine for flagged findings and
+returns structured conclusions compatible with the server upsert endpoint.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Callable, Optional
+
+import httpx
+
+from codedd_cli.llm.key_manager import PROVIDER_MODELS
+
+_ANTHROPIC_MESSAGES_URL = "https://api.anthropic.com/v1/messages"
+_OPENAI_CHAT_URL = "https://api.openai.com/v1/chat/completions"
+_LLM_TIMEOUT = 120.0
+_MAX_FILE_CHARS = 120_000
+_MAX_EVIDENCE_CHARS = 24_000
+
+
+@dataclass
+class ValidationCandidate:
+    file_path: str
+    local_path: str
+    hypothesis: str
+    flag_color: str
+    stored_time_to_fix_hours: Optional[float] = None
+
+
+@dataclass
+class ValidationOutcome:
+    file_path: str
+    conclusion: str
+    impact: str
+    confidence: float
+    recommended_action: str
+    revised_time_to_fix_hours: Optional[float]
+    provider_used: Optional[str] = None
+    error: Optional[str] = None
+
+    @property
+    def success(self) -> bool:
+        return self.error is None
+
+
+def _parse_line_hints(hypothesis: str) -> list[int]:
+    if not hypothesis:
+        return []
+    line_numbers: list[int] = []
+    patterns = [
+        r"\bline\s+(\d+)",
+        r"\blines?\s+(\d+)",
+        r"\b(\d+):\d+",
+    ]
+    for pattern in patterns:
+        for match in re.finditer(pattern, hypothesis, re.IGNORECASE):
+            try:
+                ln = int(match.group(1))
+            except (TypeError, ValueError):
+                continue
+            if 1 <= ln <= 200_000:
+                line_numbers.append(ln)
+    return sorted(set(line_numbers))
+
+
+def _build_evidence(content: str, line_hints: list[int]) -> str:
+    lines = content.splitlines()
+    if not lines:
+        return ""
+
+    if line_hints:
+        chunks: list[str] = []
+        for ln in line_hints[:5]:
+            start = max(1, ln - 20)
+            end = min(len(lines), ln + 20)
+            snippet = "\n".join(f"{idx}|{lines[idx - 1]}" for idx in range(start, end + 1))
+            chunks.append(f"Snippet around line {ln}:\n{snippet}")
+        evidence = "\n\n".join(chunks)
+    else:
+        # Fall back to head + tail for broad context.
+        head = "\n".join(f"{idx}|{lines[idx - 1]}" for idx in range(1, min(len(lines), 140) + 1))
+        tail_start = max(1, len(lines) - 120)
+        tail = "\n".join(f"{idx}|{lines[idx - 1]}" for idx in range(tail_start, len(lines) + 1))
+        evidence = f"Head snippet:\n{head}\n\nTail snippet:\n{tail}"
+
+    if len(evidence) > _MAX_EVIDENCE_CHARS:
+        evidence = evidence[:_MAX_EVIDENCE_CHARS]
+    return evidence
+
+
+def _extract_json(text: str) -> dict:
+    payload = text.strip()
+    try:
+        obj = json.loads(payload)
+        return obj if isinstance(obj, dict) else {}
+    except Exception:
+        pass
+    match = re.search(r"\{[\s\S]*\}", payload)
+    if not match:
+        return {}
+    try:
+        obj = json.loads(match.group(0))
+        return obj if isinstance(obj, dict) else {}
+    except Exception:
+        return {}
+
+
+class LocalVulnerabilityValidator:
+    """
+    Source-aware vulnerability validator for CLI audits.
+
+    Uses local source files + the flagged hypothesis to produce a structured
+    validation result similar to the server's vulnerability_validation output.
+    """
+
+    def __init__(
+        self,
+        anthropic_key: str | None,
+        openai_key: str | None,
+        provider_preference: str = "both",
+        system_prompt: Optional[str] = None,
+        on_debug: Optional[Callable[[str], None]] = None,
+    ) -> None:
+        self._anthropic_key = anthropic_key
+        self._openai_key = openai_key
+        self._pref = provider_preference
+        self._on_debug = on_debug
+        self._system_prompt = system_prompt or (
+            "You are a security validation agent. "
+            "Assess whether the reported vulnerability is valid based on provided source snippets. "
+            "Respond with JSON only."
+        )
+
+        self._anthropic = None
+        self._openai = None
+        if anthropic_key:
+            self._anthropic = httpx.Client(
+                base_url="https://api.anthropic.com",
+                headers={
+                    "x-api-key": anthropic_key,
+                    "anthropic-version": "2023-06-01",
+                    "content-type": "application/json",
+                },
+                timeout=_LLM_TIMEOUT,
+            )
+        if openai_key:
+            self._openai = httpx.Client(
+                base_url="https://api.openai.com",
+                headers={
+                    "Authorization": f"Bearer {openai_key}",
+                    "Content-Type": "application/json",
+                },
+                timeout=_LLM_TIMEOUT,
+            )
+
+    def close(self) -> None:
+        if self._anthropic:
+            self._anthropic.close()
+        if self._openai:
+            self._openai.close()
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_):
+        self.close()
+
+    def _debug(self, msg: str) -> None:
+        if self._on_debug:
+            self._on_debug(msg)
+
+    def _provider_order(self) -> list[str]:
+        has_a = self._anthropic is not None
+        has_o = self._openai is not None
+        if self._pref == "anthropic":
+            return [p for p in ("anthropic", "openai") if (p == "anthropic" and has_a) or (p == "openai" and has_o)]
+        if self._pref == "openai":
+            return [p for p in ("openai", "anthropic") if (p == "openai" and has_o) or (p == "anthropic" and has_a)]
+        order = []
+        if has_a:
+            order.append("anthropic")
+        if has_o:
+            order.append("openai")
+        return order
+
+    def _call_anthropic(self, user_prompt: str) -> tuple[bool, str]:
+        if not self._anthropic:
+            return False, ""
+        model = PROVIDER_MODELS.get("anthropic", "claude-sonnet-4-6")
+        payload = {
+            "model": model,
+            "max_tokens": 1800,
+            "temperature": 0.0,
+            "system": self._system_prompt,
+            "messages": [{"role": "user", "content": user_prompt}],
+        }
+        try:
+            resp = self._anthropic.post(_ANTHROPIC_MESSAGES_URL, json=payload)
+            if resp.status_code != 200:
+                return False, ""
+            body = resp.json()
+            text = (body.get("content") or [{}])[0].get("text", "")
+            return bool(text), text or ""
+        except Exception:
+            return False, ""
+
+    def _call_openai(self, combined_prompt: str) -> tuple[bool, str]:
+        if not self._openai:
+            return False, ""
+        model = PROVIDER_MODELS.get("openai", "gpt-5.2")
+        payload = {
+            "model": model,
+            "temperature": 0.0,
+            "messages": [{"role": "user", "content": combined_prompt}],
+        }
+        try:
+            resp = self._openai.post(_OPENAI_CHAT_URL, json=payload)
+            if resp.status_code != 200:
+                return False, ""
+            body = resp.json()
+            text = ((body.get("choices") or [{}])[0].get("message") or {}).get("content", "")
+            return bool(text), text or ""
+        except Exception:
+            return False, ""
+
+    def _validate_single(self, c: ValidationCandidate) -> ValidationOutcome:
+        try:
+            content = Path(c.local_path).read_text(encoding="utf-8", errors="replace")
+        except Exception as exc:
+            return ValidationOutcome(
+                file_path=c.file_path,
+                conclusion="Inconclusive",
+                impact="N/A",
+                confidence=0.0,
+                recommended_action="N/A",
+                revised_time_to_fix_hours=c.stored_time_to_fix_hours,
+                error=f"Cannot read local file: {exc}",
+            )
+
+        if len(content) > _MAX_FILE_CHARS:
+            content = content[:_MAX_FILE_CHARS]
+
+        line_hints = _parse_line_hints(c.hypothesis)
+        evidence = _build_evidence(content, line_hints)
+        schema = {
+            "conclusion": "Valid | Not Vulnerable | Inconclusive",
+            "confidence": "0.0-1.0",
+            "impact": "brief impact statement",
+            "recommended_action": "actionable remediation guidance",
+            "revised_estimate_hours": "number in hours",
+        }
+        user_prompt = (
+            f"VULNERABILITY CLAIM: {c.hypothesis}\n"
+            f"FLAG COLOR: {c.flag_color}\n"
+            f"TARGET FILE: {c.file_path}\n"
+            f"STORED TIME TO FIX (hours): {c.stored_time_to_fix_hours}\n\n"
+            f"EVIDENCE:\n{evidence}\n\n"
+            f"Return JSON only with schema: {json.dumps(schema)}"
+        )
+
+        providers = self._provider_order()
+        for provider in providers:
+            ok = False
+            text = ""
+            if provider == "anthropic":
+                ok, text = self._call_anthropic(user_prompt)
+            else:
+                combined = f"{self._system_prompt}\n\n{user_prompt}"
+                ok, text = self._call_openai(combined)
+
+            if not ok or not text:
+                continue
+
+            parsed = _extract_json(text)
+            if not parsed:
+                continue
+
+            conclusion = str(parsed.get("conclusion", "Inconclusive")).strip() or "Inconclusive"
+            impact = str(parsed.get("impact", "N/A")).strip() or "N/A"
+            action = str(parsed.get("recommended_action", "N/A")).strip() or "N/A"
+            try:
+                confidence = float(parsed.get("confidence", 0.5))
+            except (TypeError, ValueError):
+                confidence = 0.5
+            confidence = max(0.0, min(1.0, confidence))
+            revised = parsed.get("revised_estimate_hours", c.stored_time_to_fix_hours)
+            try:
+                revised = float(revised) if revised is not None else None
+            except (TypeError, ValueError):
+                revised = c.stored_time_to_fix_hours
+
+            return ValidationOutcome(
+                file_path=c.file_path,
+                conclusion=conclusion,
+                impact=impact,
+                confidence=confidence,
+                recommended_action=action,
+                revised_time_to_fix_hours=revised,
+                provider_used=provider,
+            )
+
+        return ValidationOutcome(
+            file_path=c.file_path,
+            conclusion="Inconclusive",
+            impact="Insufficient evidence for deterministic validation.",
+            confidence=0.25,
+            recommended_action="Review the flagged file manually and run targeted security tests.",
+            revised_time_to_fix_hours=c.stored_time_to_fix_hours,
+            error="LLM validation failed or unparsable response",
+        )
+
+    def validate(self, candidates: list[ValidationCandidate]) -> list[ValidationOutcome]:
+        outcomes: list[ValidationOutcome] = []
+        for c in candidates:
+            self._debug(f"Validating finding locally: {c.file_path}")
+            outcomes.append(self._validate_single(c))
+        return outcomes
+

codedd_cli/auth/__init__.py

@@ -0,0 +1,4 @@
+from codedd_cli.auth.token_manager import TokenManager
+from codedd_cli.auth.session import require_auth
+
+__all__ = ["TokenManager", "require_auth"]

codedd_cli/auth/session.py

@@ -0,0 +1,41 @@
+"""
+Session helpers for ensuring the user is authenticated before running
+commands that require a token.
+"""
+
+import functools
+from typing import Callable
+
+import typer
+from rich.console import Console
+
+from codedd_cli.auth.token_manager import TokenManager
+from codedd_cli.config.settings import ConfigManager
+
+console = Console()
+
+
+def require_auth(func: Callable) -> Callable:
+    """
+    Decorator that aborts a CLI command when the user is not authenticated.
+
+    It checks both the config file (for session metadata) and the keyring
+    (for the actual token).  If either is missing it prints a helpful
+    message and exits with code 1.
+    """
+
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        cfg = ConfigManager()
+        token = TokenManager.retrieve()
+
+        if not cfg.is_authenticated or not token:
+            console.print(
+                "[bold red]Not authenticated.[/bold red]  "
+                "Run [bold cyan]codedd auth login[/bold cyan] first."
+            )
+            raise typer.Exit(code=1)
+
+        return func(*args, **kwargs)
+
+    return wrapper

codedd_cli/auth/token_manager.py

@@ -0,0 +1,87 @@
+"""
+Secure token storage and retrieval.
+
+The CLI token is stored in the operating system's credential store via
+the ``keyring`` library (Windows Credential Locker, macOS Keychain,
+Linux Secret Service / KWallet).  A non-sensitive hint (last 4 chars)
+is kept in the TOML config file for display purposes.
+
+Falls back to the ``CODEDD_API_TOKEN`` environment variable when no
+keyring entry exists (useful for CI/CD and headless environments).
+"""
+
+import os
+from typing import Optional
+
+import keyring
+
+from codedd_cli.config.constants import (
+    CLI_TOKEN_PREFIX,
+    KEYRING_SERVICE,
+    KEYRING_TOKEN_KEY,
+)
+
+
+class TokenManager:
+    """Manage CLI token persistence in the OS keychain."""
+
+    @staticmethod
+    def store(token: str) -> None:
+        """
+        Persist a CLI token in the OS keychain.
+
+        Args:
+            token: The raw ``codedd_cli_...`` token string.
+
+        Raises:
+            keyring.errors.KeyringError: If the keychain is unavailable.
+        """
+        keyring.set_password(KEYRING_SERVICE, KEYRING_TOKEN_KEY, token)
+
+    @staticmethod
+    def retrieve() -> Optional[str]:
+        """
+        Retrieve the CLI token.
+
+        Resolution order:
+            1. ``CODEDD_API_TOKEN`` environment variable
+            2. OS keychain entry
+
+        Returns:
+            The token string, or None if not found.
+        """
+        # Environment variable takes precedence (CI/CD support)
+        env_token = os.environ.get("CODEDD_API_TOKEN")
+        if env_token and env_token.startswith(CLI_TOKEN_PREFIX):
+            return env_token
+
+        try:
+            token = keyring.get_password(KEYRING_SERVICE, KEYRING_TOKEN_KEY)
+            return token if token else None
+        except Exception:
+            return None
+
+    @staticmethod
+    def delete() -> None:
+        """
+        Remove the CLI token from the OS keychain.
+
+        Silently succeeds if no entry exists.
+        """
+        try:
+            keyring.delete_password(KEYRING_SERVICE, KEYRING_TOKEN_KEY)
+        except keyring.errors.PasswordDeleteError:
+            pass  # Already absent
+        except Exception:
+            pass
+
+    @staticmethod
+    def token_hint(token: str) -> str:
+        """
+        Derive a non-sensitive hint from a token for display.
+
+        Example: ``codedd_cli_...xYz9``
+        """
+        if len(token) > 8:
+            return f"{CLI_TOKEN_PREFIX}...{token[-4:]}"
+        return "***"

codedd_cli/cli.py

@@ -0,0 +1,69 @@
+"""
+Root CLI application.
+
+Defines the top-level ``codedd`` command group and registers sub-command
+modules for ``auth``, ``audits``, ``config``.
+"""
+
+import click
+import typer
+from typer.core import TyperGroup
+
+from codedd_cli import __version__
+from codedd_cli.utils.display import print_banner
+
+
+class _CodeDDTyperGroup(TyperGroup):
+    """
+    Custom Typer group that prints the CodeDD banner before the root help.
+    Only top-level ``codedd --help`` (or ``codedd`` with no args) shows the banner.
+    """
+
+    def format_help(self, ctx: click.Context, formatter: click.HelpFormatter) -> None:
+        if ctx.parent is None:
+            print_banner()
+        super().format_help(ctx, formatter)
+
+
+app = typer.Typer(
+    name="codedd",
+    help="CodeDD CLI — run code audits from your terminal.",
+    no_args_is_help=True,
+    add_completion=False,
+    cls=_CodeDDTyperGroup,
+)
+
+
+def _version_callback(value: bool) -> None:
+    if value:
+        typer.echo(f"codedd-cli {__version__}")
+        raise typer.Exit()
+
+
+@app.callback()
+def main(
+    version: bool = typer.Option(
+        False,
+        "--version",
+        "-v",
+        help="Show the CLI version and exit.",
+        callback=_version_callback,
+        is_eager=True,
+    ),
+) -> None:
+    """CodeDD CLI — run code audits from your terminal."""
+
+
+# ---- Register sub-command groups ----
+
+from codedd_cli.commands.auth_cmd import auth_app  # noqa: E402
+from codedd_cli.commands.audits_cmd import audits_app  # noqa: E402
+from codedd_cli.commands.config_cmd import config_app  # noqa: E402
+from codedd_cli.commands.scope_cmd import scope_app  # noqa: E402
+from codedd_cli.commands.audit_cmd import audit_app  # noqa: E402
+
+app.add_typer(auth_app, name="auth", help="Authenticate with the CodeDD platform.")
+app.add_typer(audits_app, name="audits", help="List and select audits.")
+app.add_typer(scope_app, name="scope", help="Manage local directories for the active audit.")
+app.add_typer(audit_app, name="audit", help="Start and manage audits.")
+app.add_typer(config_app, name="config", help="View and update CLI configuration.")

codedd_cli/commands/__init__.py

@@ -0,0 +1 @@
+