patchi 0.7.5__py3-none-any.whl

patchi/core/security/auto_ticket.py

@@ -0,0 +1,53 @@
+"""
+AutoTicket §10.2.4 — File Jira/GitHub Issues for detected bugs with assignee via CODEOWNERS/blame.
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+
+_log = logging.getLogger("patchi.security.auto_ticket")
+
+def _match_owner(owners: dict, file: str) -> str:
+    """CODEOWNERS glob match (longest pattern wins), not exact lookup."""
+    import fnmatch
+
+    best, best_len = "", -1
+    for pattern, owner in owners.items():
+        if fnmatch.fnmatch(file, pattern) and len(pattern) > best_len:
+            best, best_len = owner, len(pattern)
+    return best
+
+def create_tickets(root: Path, findings: list[dict], dry_run: bool = True) -> list[dict]:
+    tickets=[]
+    # parse CODEOWNERS for assignee
+    owners={}
+    co=root/".github/CODEOWNERS"
+    if co.exists():
+        for line in co.read_text(encoding="utf-8", errors="replace").splitlines():
+            if line.strip() and not line.startswith("#"):
+                parts=line.split()
+                if len(parts)>=2:
+                    owners[parts[0]]=parts[-1].lstrip("@")
+    for f in findings[:10]:
+        assignee = _match_owner(owners, f.get("file", "")) or owners.get("*", "")
+        # blame fallback
+        if not assignee:
+            try:
+                from patchi.core.brain.git_aware import blame_line
+                info=blame_line(f.get("file",""), f.get("line",1), root)
+                if info:
+                    assignee=info.get("author","")
+            except Exception as exc:  # noqa: BLE001
+                _log.debug("blame for ticket failed: %s", exc)
+        ticket={
+            "title": f.get("message","")[:80] or f.get("type",""),
+            "file": f.get("file",""), "line": f.get("line",0),
+            "assignee": assignee, "dry_run": dry_run,
+        }
+        tickets.append(ticket)
+        if not dry_run:
+            # Real API calls would go here: GitHub Issues API / Jira REST
+            pass
+    return tickets

patchi/core/security/bandit_agent.py

@@ -0,0 +1,152 @@
+"""
+BanditAgent - Bandit security linter integration.
+
+Bandit is a Python security linter that finds common security issues.
+"""
+from __future__ import annotations
+
+import json
+import logging
+import subprocess
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from patchi.core.agents.base import (
+    AgentDomain,
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    register,
+)
+
+_log = logging.getLogger("patchi.security.agents.bandit_agent")
+
+
+@register
+class BanditAgent(BaseAgent):
+    """
+    BanditAgent - Bandit security linter integration.
+
+    Bandit is a Python security linter that finds common security issues
+    like SQL injection, XSS, hardcoded passwords, etc.
+    """
+
+    group = AgentGroup.SECURITY
+    domain = AgentDomain.CODE_QUALITY
+    name = "BanditAgent"
+    description = "Bandit security linter for Python"
+    timeout = 120
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        """Run Bandit analysis on the project."""
+        if not self._is_bandit_available():
+            result.status = AgentStatus.SKIPPED
+            result.data["error"] = "Bandit not installed"
+            return
+
+        findings = self._run_bandit(inp.root)
+
+        for finding_data in findings:
+            finding = self._create_finding(finding_data)
+            result.add_finding(finding)
+
+        result.status = AgentStatus.DONE
+        result.files_scanned = 1
+
+    def _is_bandit_available(self) -> bool:
+        """Check if Bandit is installed and available."""
+        try:
+            result = subprocess.run(["bandit", "--version"], capture_output=True, timeout=10)
+            return result.returncode == 0
+        except FileNotFoundError:
+            return False
+
+    def _run_bandit(self, root: Path) -> list[dict[str, Any]]:
+        """Run Bandit and parse JSON output."""
+        findings = []
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            output_file = Path(tmpdir) / "bandit_output.json"
+
+            try:
+                subprocess.run(
+                    ["bandit", "-r", "--format", "json", "--output", str(output_file), str(root)],
+                    capture_output=True,
+                    timeout=120,
+                    cwd=root,
+                )
+
+                if output_file.exists():
+                    with open(output_file) as f:
+                        data = json.load(f)
+                        return self._parse_bandit_output(data)
+
+            except subprocess.TimeoutExpired:
+                _log.warning("Bandit timed out")
+            except Exception as e:
+                _log.warning(f"Bandit execution failed: {e}")
+
+        return findings
+
+    def _parse_bandit_output(self, data: dict[str, Any]) -> list[dict[str, Any]]:
+        """Parse Bandit JSON output into findings (full fidelity)."""
+        findings = []
+
+        for result in data.get("results", []):
+            findings.append(
+                {
+                    "type": result.get("test_id", "bandit_finding"),
+                    "severity": result.get("severity", "MEDIUM"),
+                    "file": result.get("filename", ""),
+                    "line": result.get("line_number", 0),
+                    "message": result.get("issue_text", ""),
+                    # Bandit embeds CWE as {"id": "CWE-78"} (newer) or plain text
+                    "cwe": self._extract_cwe(result),
+                    "confidence": self._map_confidence(result.get("confidence", "MEDIUM")),
+                    "snippet": (result.get("code") or "").strip(),
+                    "more_info": result.get("more_info", ""),
+                }
+            )
+        return findings
+
+    def _extract_cwe(self, result: dict[str, Any]) -> str:
+        cwe = result.get("issue_cwe") or result.get("cwe")
+        if isinstance(cwe, dict):
+            return str(cwe.get("id", "") or "")
+        if cwe:
+            return str(cwe)
+        # Older bandit: derive from test_id via issue metadata link
+        return ""
+
+    def _map_confidence(self, confidence: str) -> float:
+        """Map Bandit confidence to float."""
+        mapping = {
+            "HIGH": 0.9,
+            "MEDIUM": 0.6,
+            "LOW": 0.3,
+        }
+        return mapping.get(confidence.upper(), 0.5)
+
+    def _create_finding(self, finding_data: dict[str, Any]):
+        """Create a Finding object from Bandit output."""
+        from patchi.core.security.tool_adapters import make_tool_finding
+
+        return make_tool_finding(
+            agent="BanditAgent",
+            ftype=finding_data.get("type", "bandit_finding"),
+            raw_severity=finding_data.get("severity", "MEDIUM"),
+            file=finding_data.get("file", ""),
+            line=finding_data.get("line", 0),
+            message=finding_data.get("message", ""),
+            cwe=finding_data.get("cwe", ""),
+            snippet=finding_data.get("snippet", ""),
+            confidence_raw=finding_data.get("confidence"),
+            extra={"more_info": finding_data.get("more_info", "")},
+        )
+
+
+# Register the agent
+register(BanditAgent)

patchi/core/security/blast_radius.py

@@ -0,0 +1,226 @@
+"""
+Blast Radius Simulation (Layer 6) — prevents cascade breakage from fixes.
+
+Three signals:
+1. Static blast radius — count references to symbol/package being changed
+2. Dependency tree dry-run — npm install --dry-run diff
+3. Behavioral diff — browser baseline → sandbox fix → re-run → diff
+
+The apply gate combines all three into auto-apply / stop-and-report.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+from pathlib import Path
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+    safe_rglob,
+)
+
+# ── Static blast radius ───────────────────────────────────────────────────────
+
+
+def patchi_blast_radius(symbol_or_package: str, root: Path) -> dict:
+    """
+    Count references to a symbol or package across the codebase.
+    Returns count + list of referencing files.
+    """
+    refs = []
+    re_pattern = re.compile(re.escape(symbol_or_package))
+
+    source_patterns = [
+        "*.py",
+        "*.pyw",
+        "*.js",
+        "*.mjs",
+        "*.cjs",
+        "*.jsx",
+        "*.ts",
+        "*.tsx",
+        "*.mts",
+        "*.java",
+        "*.cs",
+        "*.rb",
+        "*.go",
+        "*.rs",
+        "*.cpp",
+        "*.cxx",
+        "*.cc",
+        "*.c",
+        "*.h",
+        "*.hpp",
+        "*.kt",
+        "*.swift",
+        "*.dart",
+        "*.php",
+        "*.php3",
+        "*.php4",
+        "*.php5",
+        "*.phtml",
+        "*.scala",
+        "*.svelte",
+    ]
+
+    for sp in source_patterns:
+        for fpath in safe_rglob(root, sp):
+            if not fpath.is_file():
+                continue
+            try:
+                content = fpath.read_text(encoding="utf-8", errors="ignore")
+            except OSError:
+                continue
+            if re_pattern.search(content):
+                refs.append(str(fpath.relative_to(root)))
+
+    return {
+        "symbol": symbol_or_package,
+        "reference_count": len(refs),
+        "referencing_files": refs,
+        "blast_level": "low" if len(refs) <= 3 else ("medium" if len(refs) <= 10 else "high"),
+    }
+
+
+# ── Dependency tree dry-run ───────────────────────────────────────────────────
+
+
+def patchi_dependency_dry_run(root: Path) -> dict:
+    """
+    Run npm install --dry-run or pip install --dry-run and return the diff.
+    """
+    result = {"tool": "", "would_install": [], "would_remove": [], "peer_warnings": []}
+
+    # Check for package.json (npm)
+    if (root / "package.json").exists():
+        try:
+            proc = subprocess.run(
+                ["npm", "install", "--dry-run", "--json"],
+                capture_output=True,
+                text=True,
+                timeout=30,
+                cwd=str(root),
+            )
+            result["tool"] = "npm"
+            if proc.stdout.strip():
+                try:
+                    data = json.loads(proc.stdout)
+                    # Parse npm dry-run output
+                    if isinstance(data, dict):
+                        result["would_install"] = list(data.get("added", []))
+                        result["would_remove"] = list(data.get("removed", []))
+                except json.JSONDecodeError:
+                    pass
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            pass
+
+    # Check for requirements.txt (pip)
+    elif (root / "requirements.txt").exists():
+        try:
+            proc = subprocess.run(
+                ["pip", "install", "--dry-run", "-r", "requirements.txt"],
+                capture_output=True,
+                text=True,
+                timeout=30,
+                cwd=str(root),
+            )
+            result["tool"] = "pip"
+            # Parse pip dry-run output
+            for line in proc.stdout.splitlines():
+                if "Would install" in line:
+                    result["would_install"] = line.replace("Would install", "").strip().split()
+                elif "Would remove" in line:
+                    result["would_remove"] = line.replace("Would remove", "").strip().split()
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            pass
+
+    result["total_changes"] = len(result["would_install"]) + len(result["would_remove"])
+    return result
+
+
+# ── Apply gate ────────────────────────────────────────────────────────────────
+
+
+def patchi_apply_gate(static_radius: dict, dep_diff: dict) -> dict:
+    """
+    Combine signals into an auto-apply / stop-and-report decision.
+    """
+    blast_level = static_radius.get("blast_level", "low")
+    dep_changes = dep_diff.get("total_changes", 0)
+
+    if blast_level == "low" and dep_changes == 0:
+        return {
+            "decision": "auto_apply",
+            "reason": "Low blast radius, no dependency changes",
+            "blast_level": blast_level,
+            "dep_changes": dep_changes,
+        }
+    else:
+        return {
+            "decision": "require_review",
+            "reason": f"Blast radius: {blast_level}, dependency changes: {dep_changes}",
+            "blast_level": blast_level,
+            "dep_changes": dep_changes,
+            "referencing_files": static_radius.get("referencing_files", []),
+            "would_install": dep_diff.get("would_install", []),
+            "would_remove": dep_diff.get("would_remove", []),
+        }
+
+
+# ── Blast Radius Agent ───────────────────────────────────────────────────────
+
+
+@register
+class BlastRadiusAgent(BaseAgent):
+    """Computes blast radius for proposed fixes and dependency changes."""
+
+    name = "BlastRadiusAgent"
+    group = AgentGroup.GUARD
+    timeout = 60
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # Get findings that need blast radius analysis
+        findings = inp.extra.get("findings", [])
+        high_risk_findings = [f for f in findings if f.get("severity") in ("critical", "high")]
+
+        for finding in high_risk_findings[:5]:
+            fpath = finding.get("file", "")
+            if not fpath:
+                continue
+
+            # Static blast radius
+            symbol = Path(fpath).stem
+            radius = patchi_blast_radius(symbol, inp.root)
+
+            # Dependency dry-run if it's a dependency fix
+            dep_diff = {"total_changes": 0, "tool": ""}
+            if finding.get("type") in ("vulnerable_dependency", "unpinned_dependency"):
+                dep_diff = patchi_dependency_dry_run(inp.root)
+
+            gate = patchi_apply_gate(radius, dep_diff)
+
+            finding["blast_radius"] = radius
+            finding["dep_diff"] = dep_diff
+            finding["apply_gate"] = gate
+
+            if gate["decision"] == "require_review":
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="high_blast_radius",
+                        severity=Severity.HIGH,
+                        file=fpath,
+                        message=f"Fix requires review: {gate['reason']}",
+                        detail=json.dumps(gate, indent=2),
+                    )
+                )
+
+        result.data["analyzed_count"] = min(len(high_risk_findings), 5)