patchi 0.7.5__py3-none-any.whl

patchi/core/plugins/analyzers/secret_scanner.py

@@ -0,0 +1,158 @@
+"""
+Secret Scanner Analyzer — detects hardcoded secrets and credentials.
+
+This is a built-in analyzer that scans for:
+- Hardcoded passwords
+- API keys
+- Private keys
+- Connection strings
+- Tokens
+
+Example usage:
+    from patchi.core.plugins import get_registry, AnalyzerContext
+    from pathlib import Path
+
+    registry = get_registry()
+    context = AnalyzerContext(root=Path("."))
+    result = registry.run("secret-scanner", context)
+"""
+
+from __future__ import annotations
+
+import re
+
+from patchi.core.plugins.analyzer import (
+    Analyzer,
+    AnalyzerContext,
+    AnalyzerResult,
+    FileNode,
+    Finding,
+    Severity,
+    make_finding,
+)
+
+# Patterns that indicate secrets
+SECRET_PATTERNS = [
+    # Passwords
+    (r'(?i)(password|passwd|pwd)\s*[=:]\s*["\']([^"\']{8,})["\']', "hardcoded-password", Severity.CRITICAL),
+    (r'(?i)(password|passwd|pwd)\s*[=:]\s*([^\s"\'#]{8,})', "hardcoded-password", Severity.CRITICAL),
+
+    # API Keys
+    (r'(?i)(api[_-]?key|apikey)\s*[=:]\s*["\']([A-Za-z0-9_\-]{20,})["\']', "hardcoded-api-key", Severity.HIGH),
+    (r'(?i)(secret[_-]?key|client[_-]?secret)\s*[=:]\s*["\']([A-Za-z0-9_\-]{20,})["\']', "hardcoded-secret-key", Severity.HIGH),
+
+    # Private keys
+    (r'-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----', "private-key-exposure", Severity.CRITICAL),
+
+    # Connection strings
+    (r'(?i)(mysql|postgres|postgresql|mongodb|redis)://[^\s"\'<>]{20,}', "hardcoded-connection-string", Severity.HIGH),
+
+    # Tokens
+    (r'(?i)(token|access[_-]?token|auth[_-]?token)\s*[=:]\s*["\']([A-Za-z0-9_\-\.]{20,})["\']', "hardcoded-token", Severity.HIGH),
+
+    # AWS keys
+    (r'AKIA[0-9A-Z]{16}', "aws-access-key", Severity.CRITICAL),
+
+    # GitHub tokens
+    (r'ghp_[A-Za-z0-9]{36}', "github-personal-access-token", Severity.CRITICAL),
+
+    # JWT tokens
+    (r'eyJ[A-Za-z0-9_\-]*\.eyJ[A-Za-z0-9_\-]*\.[A-Za-z0-9_\-]*', "jwt-token-exposure", Severity.HIGH),
+]
+
+# Files to skip
+SKIP_PATTERNS = [
+    "*.min.js",
+    "*.min.css",
+    "*.map",
+    "*.lock",
+    "package-lock.json",
+    "yarn.lock",
+    "*.pyc",
+    "__pycache__/*",
+    "node_modules/*",
+    ".git/*",
+]
+
+
+class SecretScanner(Analyzer):
+    """Scans for hardcoded secrets and credentials."""
+
+    name = "secret-scanner"
+    version = "1.0.0"
+    description = "Detects hardcoded passwords, API keys, tokens, and other secrets"
+    priority = 10  # Run early
+    supported_file_patterns = []  # All files
+
+    def analyze(self, context: AnalyzerContext) -> AnalyzerResult:
+        findings: list[Finding] = []
+        files_scanned = 0
+
+        for file in context.files:
+            if not self.should_analyze(file):
+                continue
+
+            # Skip binary/minified files
+            if any(re.match(p.replace("*", ".*"), file.path) for p in SKIP_PATTERNS):
+                continue
+
+            files_scanned += 1
+            file_findings = self._scan_file(file)
+            findings.extend(file_findings)
+
+        return AnalyzerResult(
+            findings=findings,
+            files_analyzed=files_scanned,
+            metrics={
+                "files_scanned": files_scanned,
+                "findings_count": len(findings),
+            },
+        )
+
+    def _scan_file(self, file: FileNode) -> list[Finding]:
+        """Scan a single file for secrets."""
+        findings: list[Finding] = []
+
+        if not file.content:
+            return findings
+
+        lines = file.content.splitlines()
+
+        for line_num, line in enumerate(lines, start=1):
+            for pattern, finding_type, severity in SECRET_PATTERNS:
+                matches = re.finditer(pattern, line)
+                for match in matches:
+                    # Skip false positives
+                    if self._is_false_positive(line, match):
+                        continue
+
+                    findings.append(make_finding(
+                        file=file.path,
+                        line=line_num,
+                        type=finding_type,
+                        severity=severity,
+                        message=f"Possible {finding_type.replace('-', ' ')} detected",
+                        detail=f"Pattern matched: {match.group()[:50]}...",
+                        code_snippet=line.strip()[:200],
+                        suggestion="Move secrets to environment variables or a secrets manager",
+                        confidence=0.8,
+                    ))
+
+        return findings
+
+    def _is_false_positive(self, line: str, match: re.Match) -> bool:
+        """Check if a match is likely a false positive."""
+        # Skip comments
+        stripped = line.strip()
+        if stripped.startswith("#") or stripped.startswith("//") or stripped.startswith("*"):
+            return True
+
+        # Skip test files
+        if "test" in line.lower() or "example" in line.lower() or "mock" in line.lower():
+            return True
+
+        # Skip placeholders
+        if any(p in match.group().lower() for p in ["xxx", "yyy", "placeholder", "your-", "example"]):
+            return True
+
+        return False

patchi/core/plugins/analyzers/todo_scanner.py

@@ -0,0 +1,115 @@
+"""
+TODO Scanner Analyzer — detects TODO, FIXME, HACK, and other code comments.
+
+This is a built-in analyzer that scans for:
+- TODO comments
+- FIXME comments
+- HACK comments
+- XXX comments
+- NOTE comments
+
+Example usage:
+    from patchi.core.plugins import get_registry, AnalyzerContext
+    from pathlib import Path
+
+    registry = get_registry()
+    context = AnalyzerContext(root=Path("."))
+    result = registry.run("todo-scanner", context)
+"""
+
+from __future__ import annotations
+
+import re
+
+from patchi.core.plugins.analyzer import (
+    Analyzer,
+    AnalyzerContext,
+    AnalyzerResult,
+    FileNode,
+    Finding,
+    Severity,
+    make_finding,
+)
+
+# TODO-like patterns
+TODO_PATTERNS = [
+    (r'(?i)\bTODO\b', "todo-comment", Severity.LOW),
+    (r'(?i)\bFIXME\b', "fixme-comment", Severity.MEDIUM),
+    (r'(?i)\bHACK\b', "hack-comment", Severity.MEDIUM),
+    (r'(?i)\bXXX\b', "xxx-comment", Severity.MEDIUM),
+    (r'(?i)\bNOTE\b', "note-comment", Severity.INFO),
+    (r'(?i)\bBUG\b', "bug-comment", Severity.MEDIUM),
+    (r'(?i)\bOPTIMIZE\b', "optimize-comment", Severity.LOW),
+    (r'(?i)\bREFACTOR\b', "refactor-comment", Severity.LOW),
+]
+
+
+class TodoScanner(Analyzer):
+    """Scans for TODO, FIXME, HACK, and other code comments."""
+
+    name = "todo-scanner"
+    version = "1.0.0"
+    description = "Detects TODO, FIXME, HACK, and other code comments"
+    priority = 200  # Run last
+    supported_file_patterns = []  # All files
+
+    def analyze(self, context: AnalyzerContext) -> AnalyzerResult:
+        findings: list[Finding] = []
+        files_scanned = 0
+
+        for file in context.files:
+            if not self.should_analyze(file):
+                continue
+
+            files_scanned += 1
+            file_findings = self._scan_file(file)
+            findings.extend(file_findings)
+
+        return AnalyzerResult(
+            findings=findings,
+            files_analyzed=files_scanned,
+            metrics={
+                "files_scanned": files_scanned,
+                "findings_count": len(findings),
+            },
+        )
+
+    def _scan_file(self, file: FileNode) -> list[Finding]:
+        """Scan a single file for TODO-like comments."""
+        findings: list[Finding] = []
+
+        if not file.content:
+            return findings
+
+        lines = file.content.splitlines()
+
+        for line_num, line in enumerate(lines, start=1):
+            stripped = line.strip()
+
+            # Skip non-comment lines
+            if not any(stripped.startswith(p) for p in ["#", "//", "/*", "*", "<!--"]):
+                # Check if it's inline comment
+                if not any(p in line for p in ["#", "//", "/*", "<!--"]):
+                    continue
+
+            for pattern, finding_type, severity in TODO_PATTERNS:
+                match = re.search(pattern, line)
+                if match:
+                    # Extract the comment text
+                    comment_text = line.strip()
+                    if len(comment_text) > 200:
+                        comment_text = comment_text[:200] + "..."
+
+                    findings.append(make_finding(
+                        file=file.path,
+                        line=line_num,
+                        type=finding_type,
+                        severity=severity,
+                        message=f"Code comment: {match.group().upper()}",
+                        detail=comment_text,
+                        code_snippet=line.strip()[:200],
+                        suggestion=f"Address the {match.group().upper()} comment or remove it",
+                        confidence=1.0,
+                    ))
+
+        return findings

patchi/core/plugins/registry.py

@@ -0,0 +1,335 @@
+"""
+Plugin registry with auto-discovery for Patchi.
+
+Automatically discovers and registers analyzers from:
+  1. patchi/core/plugins/analyzers/ (built-in)
+  2. ~/.patchi/plugins/ (user plugins)
+  3. .patchi/plugins/ (project plugins)
+
+Usage:
+    from patchi.core.plugins.registry import get_registry
+
+    registry = get_registry()
+    results = registry.run_all(context)
+
+    # Or run specific analyzer
+    result = registry.run("secret-scanner", context)
+"""
+
+from __future__ import annotations
+
+import importlib
+import importlib.util
+import logging
+import sys
+import time
+from pathlib import Path
+
+from patchi.core.plugins.analyzer import (
+    Analyzer,
+    AnalyzerContext,
+    AnalyzerResult,
+    Finding,
+    Severity,
+)
+
+_log = logging.getLogger("patchi.plugins")
+
+
+class PluginRegistry:
+    """Registry for discovering and running analyzers.
+
+    Features:
+    - Auto-discovery from plugin directories
+    - Lazy loading (only import when needed)
+    - Priority-based execution order
+    - Timeout enforcement
+    - Error isolation (one plugin can't crash others)
+    """
+
+    def __init__(self) -> None:
+        self._analyzers: dict[str, Analyzer] = {}
+        self._loaded: bool = False
+        self._load_time_ms: int = 0
+
+    def discover(self, extra_dirs: list[Path] | None = None) -> list[str]:
+        """Discover and register all analyzers.
+
+        Returns list of errors (empty = success).
+        """
+        if self._loaded:
+            return []
+
+        t0 = time.monotonic()
+        errors: list[str] = []
+
+        # Plugin search paths
+        search_paths = [
+            Path(__file__).parent / "analyzers",  # built-in
+            Path.home() / ".patchi" / "plugins",  # user
+            Path.cwd() / ".patchi" / "plugins",  # project
+        ]
+        if extra_dirs:
+            search_paths.extend(extra_dirs)
+
+        for plugin_dir in search_paths:
+            if not plugin_dir.exists():
+                continue
+
+            _log.debug("Discovering plugins in %s", plugin_dir)
+
+            # Walk all Python files in the plugin directory
+            for py_file in plugin_dir.glob("**/*.py"):
+                if py_file.name.startswith("_"):
+                    continue
+
+                try:
+                    self._load_plugin_file(py_file, plugin_dir)
+                except Exception as e:
+                    errors.append(f"{py_file}: {type(e).__name__}: {e}")
+                    _log.debug("Failed to load plugin %s: %s", py_file, e)
+
+        # Also discover from AGENT_PACKAGES (existing agents)
+        try:
+            self._discover_from_agent_packages()
+        except Exception as e:
+            errors.append(f"Agent package discovery: {type(e).__name__}: {e}")
+
+        self._loaded = True
+        self._load_time_ms = int((time.monotonic() - t0) * 1000)
+
+        _log.info(
+            "Plugin discovery complete: %d analyzers in %dms",
+            len(self._analyzers),
+            self._load_time_ms,
+        )
+
+        return errors
+
+    def _load_plugin_file(self, py_file: Path, base_dir: Path) -> None:
+        """Load a single plugin file and register any Analyzer subclasses."""
+        # Compute module name relative to base_dir
+        rel = py_file.relative_to(base_dir)
+        module_name = f"patchi.plugins.{rel.stem}"
+
+        # Skip if already loaded
+        if module_name in sys.modules:
+            return
+
+        # Load the module
+        spec = importlib.util.spec_from_file_location(module_name, py_file)
+        if not spec or not spec.loader:
+            return
+
+        module = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = module
+        spec.loader.exec_module(module)
+
+        # Find and register any Analyzer subclasses
+        for attr_name in dir(module):
+            attr = getattr(module, attr_name)
+            if (
+                isinstance(attr, type)
+                and issubclass(attr, Analyzer)
+                and attr is not Analyzer
+            ):
+                self.register_analyzer(attr())
+
+    def _discover_from_agent_packages(self) -> None:
+        """Discover analyzers from existing agent packages.
+
+        This wraps existing BaseAgent subclasses as analyzers for backwards
+        compatibility.
+        """
+        try:
+            from patchi.core.agents.base import (
+                _REGISTRY,
+                discover_agent_modules,
+            )
+
+            # Discover all agents first
+            discover_agent_modules()
+
+            # Wrap each agent as an analyzer
+            for name, agent_cls in _REGISTRY.items():
+                if name not in self._analyzers:
+                    wrapper = AgentAnalyzerWrapper(agent_cls)
+                    self._analyzers[name] = wrapper
+
+        except ImportError:
+            pass
+
+    def register_analyzer(self, analyzer: Analyzer) -> None:
+        """Register an analyzer instance."""
+        if analyzer.name in self._analyzers:
+            _log.warning(
+                "Analyzer '%s' already registered, overriding",
+                analyzer.name,
+            )
+        self._analyzers[analyzer.name] = analyzer
+        _log.debug("Registered analyzer: %s v%s", analyzer.name, analyzer.version)
+
+    def get(self, name: str) -> Analyzer | None:
+        """Get an analyzer by name."""
+        if not self._loaded:
+            self.discover()
+        return self._analyzers.get(name)
+
+    def list_analyzers(self, enabled_only: bool = True) -> list[Analyzer]:
+        """List all registered analyzers."""
+        if not self._loaded:
+            self.discover()
+
+        analyzers = list(self._analyzers.values())
+        if enabled_only:
+            analyzers = [a for a in analyzers if a.enabled]
+
+        return sorted(analyzers, key=lambda a: (a.priority, a.name))
+
+    def run(self, name: str, context: AnalyzerContext) -> AnalyzerResult:
+        """Run a specific analyzer by name."""
+        analyzer = self.get(name)
+        if not analyzer:
+            return AnalyzerResult(
+                errors=[f"Analyzer '{name}' not found"],
+            )
+
+        return self._run_with_timeout(analyzer, context)
+
+    def run_all(
+        self,
+        context: AnalyzerContext,
+        analyzers: list[str] | None = None,
+    ) -> dict[str, AnalyzerResult]:
+        """Run all (or specified) analyzers and return results.
+
+        Args:
+            context: The analysis context
+            analyzers: Optional list of analyzer names to run (None = all)
+
+        Returns:
+            Dict mapping analyzer name to its result
+        """
+        if not self._loaded:
+            self.discover()
+
+        to_run = self.list_analyzers(enabled_only=True)
+        if analyzers:
+            to_run = [a for a in to_run if a.name in analyzers]
+
+        results: dict[str, AnalyzerResult] = {}
+        for analyzer in to_run:
+            try:
+                results[analyzer.name] = self._run_with_timeout(analyzer, context)
+            except Exception as e:
+                results[analyzer.name] = AnalyzerResult(
+                    errors=[f"{type(e).__name__}: {e}"],
+                )
+                _log.debug("Analyzer %s failed: %s", analyzer.name, e)
+
+        return results
+
+    def _run_with_timeout(
+        self,
+        analyzer: Analyzer,
+        context: AnalyzerContext,
+    ) -> AnalyzerResult:
+        """Run an analyzer with timeout enforcement."""
+        import concurrent.futures
+
+        t0 = time.monotonic()
+
+        try:
+            with concurrent.futures.ThreadPoolExecutor(max_workers=1) as executor:
+                future = executor.submit(analyzer.analyze, context)
+                result = future.result(timeout=analyzer.timeout)
+                result.duration_ms = int((time.monotonic() - t0) * 1000)
+
+                # Set analyzer name on all findings for stable IDs
+                for finding in result.findings:
+                    finding.extra["_analyzer"] = analyzer.name
+
+                return result
+
+        except concurrent.futures.TimeoutError:
+            return AnalyzerResult(
+                errors=[f"Analyzer '{analyzer.name}' timed out after {analyzer.timeout}s"],
+                duration_ms=int((time.monotonic() - t0) * 1000),
+            )
+        except Exception as e:
+            return AnalyzerResult(
+                errors=[f"{type(e).__name__}: {e}"],
+                duration_ms=int((time.monotonic() - t0) * 1000),
+            )
+
+
+class AgentAnalyzerWrapper(Analyzer):
+    """Wraps an existing BaseAgent as an Analyzer for backwards compatibility."""
+
+    def __init__(self, agent_cls: type) -> None:
+        self._agent_cls = agent_cls
+        self.name = getattr(agent_cls, "name", "unknown")
+        self.version = "0.0.0"
+        self.description = f"Legacy agent wrapper for {self.name}"
+        self.priority = 200  # Run after native analyzers
+        self.timeout = getattr(agent_cls, "timeout", 60)
+
+    def analyze(self, context: AnalyzerContext) -> AnalyzerResult:
+        """Wrap agent execution as analyzer."""
+        from patchi.core.agents.base import AgentInput
+
+        # Convert AnalyzerContext to AgentInput
+        agent_input = AgentInput(
+            root=context.root,
+            scope=context.scope,
+            brain={},
+            config=context.config,
+            extra=context.extra,
+        )
+
+        # Run the agent
+        agent = self._agent_cls()
+        result = agent.run(agent_input)
+
+        # Convert AgentResult to AnalyzerResult
+        findings = []
+        for f in result.findings:
+            findings.append(Finding(
+                file=f.file,
+                line=f.line,
+                type=f.type,
+                severity=Severity(f.severity.value),
+                message=f.message,
+                detail=f.detail,
+                code_snippet=f.code_snippet,
+                suggestion=f.suggestion,
+                cwe=f.cwe,
+                extra={"_legacy_agent": True},
+            ))
+
+        return AnalyzerResult(
+            findings=findings,
+            metrics=result.data,
+            errors=result.errors,
+            duration_ms=result.duration_ms,
+            files_analyzed=len(context.files),
+        )
+
+
+# ── Singleton ─────────────────────────────────────────────────────────────────
+
+_registry: PluginRegistry | None = None
+
+
+def get_registry() -> PluginRegistry:
+    """Get or create the global plugin registry."""
+    global _registry
+    if _registry is None:
+        _registry = PluginRegistry()
+    return _registry
+
+
+def list_plugins() -> list[dict]:
+    """List all registered plugins with their metadata."""
+    registry = get_registry()
+    return [a.describe() for a in registry.list_analyzers()]