patchi 0.7.5__py3-none-any.whl

patchi/core/security/history.py

@@ -0,0 +1,315 @@
+"""
+Security History & Analytics (Layer 4) — scan history and findings lifecycle tracking.
+
+SQLite-backed storage for:
+- Scan history (every security scan recorded)
+- Findings lifecycle (open → fixed → verified → false_positive)
+- Trend analytics (findings over time, mean time-to-fix)
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+import time
+import uuid
+from pathlib import Path
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+)
+
+_DB_NAME = "patchi_history.db"
+
+_CREATE_TABLES = """
+CREATE TABLE IF NOT EXISTS scan_history (
+    scan_id TEXT PRIMARY KEY,
+    timestamp TEXT NOT NULL,
+    repo_path TEXT,
+    tool TEXT,
+    findings_count INTEGER DEFAULT 0,
+    severity_breakdown TEXT,
+    duration_ms INTEGER DEFAULT 0,
+    health_score INTEGER DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS findings (
+    finding_id TEXT PRIMARY KEY,
+    scan_id TEXT,
+    rule_id TEXT,
+    file TEXT,
+    line INTEGER DEFAULT 0,
+    severity TEXT,
+    status TEXT DEFAULT 'open',
+    first_seen TEXT,
+    resolved_at TEXT,
+    evidence_path TEXT
+);
+"""
+
+
+def _get_db(root: Path) -> sqlite3.Connection:
+    db_path = root / ".patchi" / _DB_NAME
+    db_path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(str(db_path))
+    conn.executescript(_CREATE_TABLES)
+    # Migrate existing DBs that don't have newer columns
+    for col_sql in [
+        "ALTER TABLE scan_history ADD COLUMN health_score INTEGER DEFAULT 0",
+        "ALTER TABLE scan_history ADD COLUMN metrics TEXT DEFAULT '{}'",
+        "ALTER TABLE scan_history ADD COLUMN agent_group TEXT DEFAULT ''",
+    ]:
+        try:
+            conn.execute(col_sql)
+            conn.commit()
+        except sqlite3.OperationalError:
+            pass  # Column already exists
+    return conn
+
+
+def patchi_record_scan(
+    root: Path,
+    tool: str,
+    findings: list[dict],
+    duration_ms: int = 0,
+    health_score: int = 0,
+    metrics: dict | None = None,
+    agent_group: str = "",
+) -> str:
+    """Record a scan. Returns scan_id."""
+    scan_id = uuid.uuid4().hex[:12]
+    now = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+    by_sev = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0}
+    for f in findings:
+        sev = f.get("severity", "info")
+        by_sev[sev] = by_sev.get(sev, 0) + 1
+
+    conn = _get_db(root)
+    try:
+        conn.execute(
+            "INSERT INTO scan_history (scan_id, timestamp, repo_path, tool, findings_count, severity_breakdown, duration_ms, health_score, metrics, agent_group) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+            (
+                scan_id,
+                now,
+                str(root),
+                tool,
+                len(findings),
+                json.dumps(by_sev),
+                duration_ms,
+                health_score,
+                json.dumps(metrics or {}),
+                agent_group,
+            ),
+        )
+        for f in findings:
+            fid = uuid.uuid4().hex
+            conn.execute(
+                "INSERT OR REPLACE INTO findings (finding_id, scan_id, rule_id, file, line, severity, status, first_seen) VALUES (?, ?, ?, ?, ?, ?, 'open', ?)",
+                (
+                    fid,
+                    scan_id,
+                    f.get("type", ""),
+                    f.get("file", ""),
+                    f.get("line", 0),
+                    f.get("severity", "info"),
+                    now,
+                ),
+            )
+        conn.commit()
+    finally:
+        conn.close()
+    return scan_id
+
+
+def patchi_verify_finding(root: Path, finding_id: str) -> None:
+    """Mark a finding as verified (fix confirmed)."""
+    conn = _get_db(root)
+    try:
+        now = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+        conn.execute(
+            "UPDATE findings SET status = 'verified', resolved_at = ? WHERE finding_id = ?",
+            (now, finding_id),
+        )
+        conn.commit()
+    finally:
+        conn.close()
+
+
+def patchi_get_history(root: Path, limit: int = 20) -> list[dict]:
+    """Get recent scan history."""
+    conn = _get_db(root)
+    try:
+        cursor = conn.execute(
+            "SELECT scan_id, timestamp, tool, findings_count, severity_breakdown, duration_ms, health_score FROM scan_history ORDER BY rowid DESC LIMIT ?",
+            (limit,),
+        )
+        return [
+            {
+                "scan_id": r[0],
+                "timestamp": r[1],
+                "tool": r[2],
+                "findings_count": r[3],
+                "severity_breakdown": json.loads(r[4] or "{}"),
+                "duration_ms": r[5],
+                "health_score": r[6] or 0,
+            }
+            for r in cursor.fetchall()
+        ]
+    finally:
+        conn.close()
+
+
+def patchi_get_severity_trends(root: Path, days: int = 90) -> dict:
+    """Severity breakdown per day — ready for trend charts.
+
+    Returns::
+        {"labels": ["2025-01-01", ...], "datasets": {"critical": [0, ...], "high": [...], ...}}
+    """
+    conn = _get_db(root)
+    try:
+        rows = conn.execute(
+            """
+            SELECT DATE(timestamp) as day, severity_breakdown
+            FROM scan_history
+            WHERE timestamp >= DATE('now', ?)
+            ORDER BY day ASC
+            """,
+            (f"-{days} days",),
+        ).fetchall()
+
+        from collections import defaultdict
+
+        daily: dict[str, dict[str, int]] = defaultdict(
+            lambda: {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0}
+        )
+        for day, sb_json in rows:
+            sb = json.loads(sb_json or "{}")
+            for sev in ("critical", "high", "medium", "low", "info"):
+                daily[day][sev] += sb.get(sev, 0)
+
+        labels = sorted(daily.keys())
+        datasets = {}
+        for sev in ("critical", "high", "medium", "low", "info"):
+            datasets[sev] = [daily[d][sev] for d in labels]
+        return {"labels": labels, "datasets": datasets}
+    finally:
+        conn.close()
+
+
+def patchi_get_health_scores(root: Path, days: int = 180) -> dict:
+    """Health score over time for trend charts."""
+    conn = _get_db(root)
+    try:
+        rows = conn.execute(
+            """
+            SELECT DATE(timestamp) as day, MAX(health_score) as score
+            FROM scan_history
+            WHERE timestamp >= DATE('now', ?)
+            GROUP BY DATE(timestamp)
+            ORDER BY day ASC
+            """,
+            (f"-{days} days",),
+        ).fetchall()
+        return {"labels": [r[0] for r in rows], "scores": [r[1] for r in rows]}
+    finally:
+        conn.close()
+
+
+def patchi_get_metrics_history(root: Path, metric_key: str, days: int = 90) -> dict:
+    """Extract a specific metric (e.g. coverage, bundle_size) over time."""
+    conn = _get_db(root)
+    try:
+        rows = conn.execute(
+            """
+            SELECT DATE(timestamp) as day, metrics
+            FROM scan_history
+            WHERE timestamp >= DATE('now', ?) AND metrics != '{}'
+            ORDER BY timestamp ASC
+            """,
+            (f"-{days} days",),
+        ).fetchall()
+        labels: list[str] = []
+        values: list[float] = []
+        for day, m_json in rows:
+            m = json.loads(m_json or "{}")
+            val = m.get(metric_key)
+            if val is not None:
+                labels.append(day)
+                values.append(float(val))
+        return {"labels": labels, "values": values}
+    finally:
+        conn.close()
+
+
+def patchi_get_analytics(root: Path) -> dict:
+    """Get trend analytics from scan history."""
+    conn = _get_db(root)
+    try:
+        # Total scans
+        total = conn.execute("SELECT COUNT(*) FROM scan_history").fetchone()[0]
+
+        # Findings by status
+        status_counts = {}
+        for row in conn.execute("SELECT status, COUNT(*) FROM findings GROUP BY status"):
+            status_counts[row[0]] = row[1]
+
+        # Most common rule violations
+        common_rules = []
+        for row in conn.execute(
+            "SELECT rule_id, COUNT(*) as cnt FROM findings WHERE rule_id != '' GROUP BY rule_id ORDER BY cnt DESC LIMIT 10"
+        ):
+            common_rules.append({"rule": row[0], "count": row[1]})
+
+        # Average findings per scan
+        avg_findings = 0
+        if total > 0:
+            total_findings = (
+                conn.execute("SELECT SUM(findings_count) FROM scan_history").fetchone()[0] or 0
+            )
+            avg_findings = round(total_findings / total, 1)
+
+        return {
+            "total_scans": total,
+            "findings_by_status": status_counts,
+            "common_rules": common_rules,
+            "avg_findings_per_scan": avg_findings,
+        }
+    finally:
+        conn.close()
+
+
+# ── History Agent ─────────────────────────────────────────────────────────────
+
+
+@register
+class HistoryAgent(BaseAgent):
+    """Records scan results to SQLite history and provides analytics."""
+
+    name = "HistoryAgent"
+    group = AgentGroup.GUARD
+    timeout = 30
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        history = patchi_get_history(inp.root, limit=5)
+        analytics = patchi_get_analytics(inp.root)
+
+        result.data["recent_scans"] = history
+        result.data["analytics"] = analytics
+
+        if analytics["total_scans"] == 0:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="no_scan_history",
+                    severity=Severity.INFO,
+                    file="",
+                    message="No previous scan history found — this is the first scan",
+                )
+            )

patchi/core/security/iac_scanner.py

@@ -0,0 +1,250 @@
+"""
+IaC & Container Security Scanner — Dockerfiles, docker-compose, K8s manifests, Terraform.
+
+Detects:
+- Dockerfiles running as root, exposed ports, outdated base images
+- docker-compose privileged containers, host network, volume mounts
+- Kubernetes missing securityContext, resource limits, network policies
+- Terraform public S3, open security groups, unencrypted storage
+"""
+
+from __future__ import annotations
+
+import re
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+    safe_rglob,
+)
+
+
+@register
+class IaCScannerAgent(BaseAgent):
+    """Scans IaC files for security misconfigurations."""
+
+    name = "IaCScannerAgent"
+    group = AgentGroup.SECURITY
+    timeout = 60
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        scanned = 0
+
+        # Dockerfiles
+        for fpath in safe_rglob(inp.root, "Dockerfile*"):
+            if fpath.is_file():
+                rel = fpath.relative_to(inp.root).as_posix()
+                try:
+                    content = fpath.read_text(encoding="utf-8", errors="ignore")
+                except OSError:
+                    continue
+                self._scan_dockerfile(content, rel, result)
+                scanned += 1
+
+        # docker-compose
+        for pattern in [
+            "docker-compose*.yml",
+            "docker-compose*.yaml",
+            "compose.yml",
+            "compose.yaml",
+        ]:
+            for fpath in safe_rglob(inp.root, pattern):
+                if fpath.is_file():
+                    rel = fpath.relative_to(inp.root).as_posix()
+                    try:
+                        content = fpath.read_text(encoding="utf-8", errors="ignore")
+                    except OSError:
+                        continue
+                    self._scan_docker_compose(content, rel, result)
+                    scanned += 1
+
+        # K8s manifests
+        for pattern in ["*.yaml", "*.yml"]:
+            for fpath in safe_rglob(inp.root, pattern):
+                if fpath.is_file():
+                    rel = fpath.relative_to(inp.root).as_posix()
+                    try:
+                        content = fpath.read_text(encoding="utf-8", errors="ignore")
+                    except OSError:
+                        continue
+                    if "apiVersion:" in content and ("kind:" in content):
+                        self._scan_k8s(content, rel, result)
+                        scanned += 1
+
+        # Terraform
+        for fpath in safe_rglob(inp.root, "*.tf"):
+            if fpath.is_file():
+                rel = fpath.relative_to(inp.root).as_posix()
+                try:
+                    content = fpath.read_text(encoding="utf-8", errors="ignore")
+                except OSError:
+                    continue
+                self._scan_terraform(content, rel, result)
+                scanned += 1
+
+        result.files_scanned = scanned
+
+    def _scan_dockerfile(self, content: str, file: str, result: AgentResult) -> None:
+        lines = content.splitlines()
+        has_user = False
+        for i, line in enumerate(lines, 1):
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            if stripped.upper().startswith("USER "):
+                has_user = True
+                if "root" in stripped.lower():
+                    result.add_finding(
+                        Finding(
+                            agent=self.name,
+                            type="container_root",
+                            severity=Severity.HIGH,
+                            file=file,
+                            line=i,
+                            message="Container runs as root",
+                            cwe="CWE-250",
+                        )
+                    )
+            if stripped.upper().startswith("EXPOSE "):
+                ports = stripped.split()[1:]
+                for p in ports:
+                    if p in ("22", "3389", "6379", "27017", "5432", "3306"):
+                        result.add_finding(
+                            Finding(
+                                agent=self.name,
+                                type="exposed_sensitive_port",
+                                severity=Severity.MEDIUM,
+                                file=file,
+                                line=i,
+                                message=f"Sensitive port exposed: {p}",
+                            )
+                        )
+            if "latest" in stripped.lower() and stripped.upper().startswith("FROM "):
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="latest_base_image",
+                        severity=Severity.LOW,
+                        file=file,
+                        line=i,
+                        message="Using 'latest' base image tag — pin to specific version",
+                    )
+                )
+        if not has_user and lines:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="no_user_directive",
+                    severity=Severity.MEDIUM,
+                    file=file,
+                    message="No USER directive — container defaults to root",
+                )
+            )
+
+    def _scan_docker_compose(self, content: str, file: str, result: AgentResult) -> None:
+        if "privileged: true" in content:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="privileged_container",
+                    severity=Severity.CRITICAL,
+                    file=file,
+                    message="Privileged container detected",
+                    cwe="CWE-250",
+                )
+            )
+        if "network_mode: host" in content:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="host_network",
+                    severity=Severity.HIGH,
+                    file=file,
+                    message="Host network mode — container shares host network stack",
+                )
+            )
+        if re.search(r'"/etc:/etc"', content) or re.search(r'"/var/run/docker.sock"', content):
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="dangerous_volume_mount",
+                    severity=Severity.CRITICAL,
+                    file=file,
+                    message="Dangerous volume mount (host system path or Docker socket)",
+                    cwe="CWE-250",
+                )
+            )
+
+    def _scan_k8s(self, content: str, file: str, result: AgentResult) -> None:
+        if "kind: Deployment" in content or "kind: StatefulSet" in content:
+            if "securityContext" not in content:
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="missing_security_context",
+                        severity=Severity.HIGH,
+                        file=file,
+                        message="K8s workload missing securityContext",
+                        cwe="CWE-250",
+                    )
+                )
+            if "resources:" not in content:
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="missing_resource_limits",
+                        severity=Severity.MEDIUM,
+                        file=file,
+                        message="K8s workload missing resource limits",
+                    )
+                )
+        if "kind: NetworkPolicy" not in content and "kind: Deployment" in content:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="no_network_policy",
+                    severity=Severity.LOW,
+                    file=file,
+                    message="No NetworkPolicy found — all pod-to-pod traffic allowed",
+                )
+            )
+
+    def _scan_terraform(self, content: str, file: str, result: AgentResult) -> None:
+        if re.search(r'acl\s*=\s*"public"', content, re.I):
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="public_s3_bucket",
+                    severity=Severity.CRITICAL,
+                    file=file,
+                    message="S3 bucket with public ACL",
+                    cwe="CWE-200",
+                )
+            )
+        if re.search(r'cidr_blocks\s*=\s*\["0\.0\.0\.0/0"\]', content):
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="open_security_group",
+                    severity=Severity.HIGH,
+                    file=file,
+                    message="Security group open to 0.0.0.0/0",
+                    cwe="CWE-284",
+                )
+            )
+        if re.search(r"encrypt\s*=\s*false", content, re.I):
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="unencrypted_storage",
+                    severity=Severity.HIGH,
+                    file=file,
+                    message="Unencrypted storage resource",
+                    cwe="CWE-311",
+                )
+            )

patchi/core/security/ignore_expiry.py

@@ -0,0 +1,111 @@
+"""
+Ignore Lists with Expiry §10.2.3 — // patchi-ignore: RULE YYYY-MM-DD
+
+Parses inline ignore comments with expiry dates, warns on expired ignores.
+Supports: //, #, <!--, /* */ styles across 11 langs.
+
+Usage:
+  findings = filter_ignores(findings, root)  # returns (kept, suppressed, expired_warnings)
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from datetime import date, datetime
+from pathlib import Path
+
+_log = logging.getLogger("patchi.security.ignore_expiry")
+
+# Matches: patchi-ignore, patchi_ignore, patchi:ignore optionally with : RULE and date YYYY-MM-DD or YYYY/MM/DD
+_RE = re.compile(
+    r"patchi[\-_:]?ignore\s*:?\s*(?P<rule>[\w\-\*]+)?\s*(?P<date>\d{4}[-/]\d{2}[-/]\d{2})?",
+    re.IGNORECASE,
+)
+
+
+def _parse_ignore_line(line: str) -> tuple[str | None, date | None] | None:
+    m = _RE.search(line)
+    if not m:
+        return None
+    rule = m.group("rule")
+    datestr = m.group("date")
+    d = None
+    if datestr:
+        try:
+            d = datetime.strptime(datestr.replace("/", "-"), "%Y-%m-%d").date()
+        except ValueError:
+            d = None
+    # If no rule and no date, still a generic ignore (no expiry)
+    if not rule and not d:
+        return ("*", None)
+    return (rule or "*", d)
+
+
+def _is_expired(d: date | None) -> bool:
+    return d is not None and d < date.today()
+
+
+def scan_file_ignores(root: Path, rel: str) -> list[dict]:
+    """Return list of {line, rule, expiry, expired} for a file."""
+    out: list[dict] = []
+    try:
+        txt = (root / rel).read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return out
+    for i, line in enumerate(txt.splitlines(), 1):
+        parsed = _parse_ignore_line(line)
+        if parsed:
+            rule, expiry = parsed
+            out.append({"line": i, "rule": rule, "expiry": expiry.isoformat() if expiry else None, "expired": _is_expired(expiry)})
+    return out
+
+
+def filter_ignores(findings: list, root: Path) -> tuple[list, list, list]:
+    """
+    Filter findings suppressed by patchi-ignore comments.
+    Returns (kept, suppressed, expired_warnings).
+
+    A finding is suppressed if its file has a patchi-ignore comment
+    on the same line, previous line, or file-header (line 1) with matching rule or "*"
+    and not expired. Expired ignores generate warnings but do NOT suppress.
+    """
+    suppressed: list = []
+    expired_warnings: list[dict] = []
+    # cache per file ignores
+    cache: dict[str, list[dict]] = {}
+
+    def get_ignores(rel: str) -> list[dict]:
+        if rel not in cache:
+            cache[rel] = scan_file_ignores(root, rel)
+        return cache[rel]
+
+    kept: list = []
+    for f in findings:
+        rel = getattr(f, "file", "") or (f.get("file", "") if isinstance(f, dict) else "")
+        line = getattr(f, "line", 0) or (f.get("line", 0) if isinstance(f, dict) else 0)
+        ftype = getattr(f, "type", "") or (f.get("type", "") if isinstance(f, dict) else "")
+        if not rel:
+            kept.append(f)
+            continue
+        ignores = get_ignores(rel)
+        matched = None
+        for ig in ignores:
+            # match rule: "*" or exact type or prefix
+            rule = ig["rule"]
+            if rule != "*" and rule.lower() not in ftype.lower() and ftype.lower() not in rule.lower():
+                continue
+            # line proximity: same line, previous line, or header
+            if ig["line"] in (line, line - 1, 1):
+                if ig["expired"]:
+                    expired_warnings.append({"file": rel, "line": ig["line"], "rule": rule, "finding_type": ftype, "message": f"Expired ignore {rule} expired {ig['expiry']}"})
+                    continue
+                matched = ig
+                break
+        if matched:
+            suppressed.append(f)
+        else:
+            kept.append(f)
+    if expired_warnings:
+        _log.warning("ignore expiry: %d expired ignores (not suppressing)", len(expired_warnings))
+    return kept, suppressed, expired_warnings