patchi 0.7.5__py3-none-any.whl

patchi/core/security/policy_engine.py

@@ -0,0 +1,272 @@
+"""
+Policy Engine — YAML/JSON policy enforcement for security compliance.
+
+Loads policy definitions from .patchi/policies/ and enforces them
+against code and findings. Supports SOC2, HIPAA, PCI-DSS, CIS packs.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+
+import yaml
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+    safe_rglob,
+)
+
+# ── Built-in policy packs ─────────────────────────────────────────────────────
+
+_BUILTIN_POLICIES: dict[str, list[dict]] = {
+    "soc2": [
+        {
+            "id": "SOC2-CC6.1",
+            "name": "Access Control",
+            "check": "no_default_credentials",
+            "severity": "critical",
+        },
+        {
+            "id": "SOC2-CC6.6",
+            "name": "Encryption in Transit",
+            "check": "no_plaintext_http",
+            "severity": "high",
+        },
+        {"id": "SOC2-CC7.1", "name": "Logging", "check": "has_logging", "severity": "medium"},
+        {
+            "id": "SOC2-CC8.1",
+            "name": "Change Management",
+            "check": "has_audit_trail",
+            "severity": "medium",
+        },
+    ],
+    "hipaa": [
+        {
+            "id": "HIPAA-164.312",
+            "name": "Access Control",
+            "check": "no_default_credentials",
+            "severity": "critical",
+        },
+        {
+            "id": "HIPAA-164.312",
+            "name": "Encryption",
+            "check": "no_weak_crypto",
+            "severity": "critical",
+        },
+        {
+            "id": "HIPAA-164.312",
+            "name": "Audit Controls",
+            "check": "has_logging",
+            "severity": "high",
+        },
+        {
+            "id": "HIPAA-164.312",
+            "name": "Data Integrity",
+            "check": "no_hardcoded_secrets",
+            "severity": "critical",
+        },
+    ],
+    "pci_dss": [
+        {
+            "id": "PCI-DSS-2.1",
+            "name": "No Default Credentials",
+            "check": "no_default_credentials",
+            "severity": "critical",
+        },
+        {
+            "id": "PCI-DSS-3.4",
+            "name": "Encryption",
+            "check": "no_weak_crypto",
+            "severity": "critical",
+        },
+        {
+            "id": "PCI-DSS-6.5",
+            "name": "Secure Development",
+            "check": "no_sql_injection",
+            "severity": "critical",
+        },
+        {
+            "id": "PCI-DSS-10.2",
+            "name": "Audit Trail",
+            "check": "has_audit_trail",
+            "severity": "high",
+        },
+    ],
+    "cis": [
+        {
+            "id": "CIS-1.1",
+            "name": "File Permissions",
+            "check": "no_world_readable",
+            "severity": "high",
+        },
+        {
+            "id": "CIS-2.1",
+            "name": "Software Updates",
+            "check": "no_outdated_deps",
+            "severity": "medium",
+        },
+        {"id": "CIS-4.1", "name": "Firewall", "check": "no_open_ports", "severity": "high"},
+        {
+            "id": "CIS-5.1",
+            "name": "Password Policy",
+            "check": "strong_passwords",
+            "severity": "medium",
+        },
+    ],
+}
+
+
+_log = logging.getLogger("patchi.security.policy_engine")
+
+
+def _check_policy(check_type: str, content: str, findings: list[Finding]) -> list[str]:
+    """Run a policy check against file content. Returns list of violation messages."""
+    violations = []
+
+    if check_type == "no_default_credentials":
+        if re.search(
+            r'(?:admin|root|password)\s*[:=]\s*["\'](?:admin|root|password|changeme)["\']',
+            content,
+            re.I,
+        ):
+            violations.append("Default credentials found")
+
+    elif check_type == "no_plaintext_http":
+        if re.search(r"http://(?!localhost|127\.0\.0\.1)", content):
+            violations.append("Plaintext HTTP URL found")
+
+    elif check_type == "has_logging":
+        if not re.search(r"(?:log|logging|logger|audit)", content, re.I):
+            violations.append("No logging implementation found")
+
+    elif check_type == "has_audit_trail":
+        if not re.search(r"(?:audit|log|track|record)", content, re.I):
+            violations.append("No audit trail found")
+
+    elif check_type == "no_weak_crypto":
+        if re.search(r"\b(?:MD5|SHA1|DES|RC4)\b", content, re.I):
+            violations.append("Weak cryptographic algorithm detected")
+
+    elif check_type == "no_hardcoded_secrets":
+        if re.search(
+            r'(?:api[_-]?key|secret|password)\s*[:=]\s*["\'][^"\']{8,}["\']', content, re.I
+        ):
+            violations.append("Hardcoded secret detected")
+
+    elif check_type == "no_sql_injection":
+        if re.search(r"(?:execute|query)\s*\([^)]*\+", content):
+            violations.append("Potential SQL injection — string concatenation in query")
+
+    elif check_type == "no_world_readable":
+        if re.search(r"chmod\s+777|chmod\s+\+r", content):
+            violations.append("World-readable file permissions")
+
+    elif check_type == "no_outdated_deps":
+        pass  # Handled by dependency scanner
+
+    elif check_type == "no_open_ports":
+        if re.search(r"EXPOSE\s+(?:22|3389)\b", content, re.I):
+            violations.append("Sensitive port exposed")
+
+    elif check_type == "strong_passwords":
+        if re.search(r'(?:password|passwd)\s*[:=]\s*["\'][^"\']{1,7}["\']', content, re.I):
+            violations.append("Weak password (less than 8 characters)")
+
+    return violations
+
+
+@register
+class PolicyEngineAgent(BaseAgent):
+    """Enforces YAML/JSON security policies against code."""
+
+    name = "PolicyEngineAgent"
+    group = AgentGroup.SECURITY
+    timeout = 60
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # Load policies from .patchi/policies/ or use built-in packs
+        policy_packs = self._load_policies(inp)
+
+        # Flatten all rules once — avoids re-iterating packs per file
+        all_rules: list[tuple[str, dict]] = []  # (pack_name, rule)
+        for pack_name, rules in policy_packs.items():
+            for rule in rules:
+                all_rules.append((pack_name, rule))
+
+        if not all_rules:
+            return
+
+        # Scan all source files — read each file ONCE, apply all rules (O(files × rules))
+        source_patterns = [
+            "*.py",
+            "*.js",
+            "*.ts",
+            "*.jsx",
+            "*.tsx",
+            "*.go",
+            "*.java",
+            "*.rb",
+            "*.php",
+        ]
+        scanned = 0
+
+        for pattern in source_patterns:
+            for fpath in safe_rglob(inp.root, pattern):
+                if not fpath.is_file():
+                    continue
+                rel = fpath.relative_to(inp.root).as_posix()
+                try:
+                    content = fpath.read_text(encoding="utf-8", errors="ignore")
+                except OSError:
+                    continue
+                scanned += 1
+
+                # Apply all rules in one pass over this file's content
+                for pack_name, rule in all_rules:
+                    violations = _check_policy(rule["check"], content, [])
+                    for v in violations:
+                        result.add_finding(
+                            Finding(
+                                agent=self.name,
+                                type="policy_violation",
+                                severity=Severity(rule["severity"]),
+                                file=rel,
+                                message=f"[{rule['id']}] {rule['name']}: {v}",
+                                cwe=rule["id"],
+                                extra={"policy_pack": pack_name},
+                            )
+                        )
+
+        result.files_scanned = scanned
+
+    def _load_policies(self, inp: AgentInput) -> dict[str, list[dict]]:
+        """Load policies from .patchi/policies/ directory, falling back to built-in."""
+        policies_dir = inp.root / ".patchi" / "policies"
+        custom_policies: dict[str, list[dict]] = {}
+
+        if policies_dir.is_dir():
+            for pf in policies_dir.glob("*.yaml"):
+                try:
+                    data = yaml.safe_load(pf.read_text(encoding="utf-8"))
+                    if isinstance(data, dict) and "rules" in data:
+                        custom_policies[pf.stem] = data["rules"]
+                except Exception as e:
+                    _log.warning("PolicyEngineAgent._load_policies failed: %s", e)
+            for pf in policies_dir.glob("*.json"):
+                try:
+                    data = json.loads(pf.read_text(encoding="utf-8"))
+                    if isinstance(data, dict) and "rules" in data:
+                        custom_policies[pf.stem] = data["rules"]
+                except Exception as e:
+                    _log.warning("PolicyEngineAgent._load_policies failed: %s", e)
+
+        # Use custom if found, otherwise built-in
+        return custom_policies if custom_policies else _BUILTIN_POLICIES

patchi/core/security/prechecks.py

@@ -0,0 +1,172 @@
+"""
+Cheap Pre-Checks (Layer 0) — instant gate before expensive scans.
+
+Pure deterministic checks that run in <1 second:
+- patchi_pattern_count: count pattern occurrences (banned APIs, refactor verification)
+- patchi_lint_check: wrap ruff/eslint for fast style/bug detection
+- patchi_diff_stat: before/after line counts on a change
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+    safe_rglob,
+)
+
+# ── Banned API patterns (zero tolerance) ──────────────────────────────────────
+
+_BANNED_APIS = [
+    (re.compile(r"\beval\s*\("), "eval() — code injection risk"),
+    (re.compile(r"\bexec\s*\("), "exec() — code injection risk"),
+    (re.compile(r"\bpickle\.loads?\s*\("), "pickle deserialization — RCE risk"),
+    (re.compile(r"\bmarshal\.loads?\s*\("), "marshal deserialization — RCE risk"),
+    (re.compile(r"\b__import__\s*\("), "dynamic import — verify necessity"),
+]
+
+
+def patchi_pattern_count(root: Path, pattern: str, path_filter: str = "*.py") -> int:
+    """Count occurrences of a regex pattern across files. Returns total count."""
+    count = 0
+    for fpath in safe_rglob(root, path_filter):
+        if not fpath.is_file():
+            continue
+        try:
+            content = fpath.read_text(encoding="utf-8", errors="ignore")
+        except OSError:
+            continue
+        count += len(re.findall(pattern, content))
+    return count
+
+
+def patchi_lint_check(root: Path, language: str = "python") -> list[dict]:
+    """Run ruff (Python) or eslint (JS/TS) and return parsed violations."""
+    violations = []
+
+    if language == "python":
+        try:
+            proc = subprocess.run(
+                ["ruff", "check", "--output-format=json", str(root)],
+                capture_output=True,
+                text=True,
+                timeout=30,
+                cwd=str(root),
+            )
+            import json
+
+            data = json.loads(proc.stdout) if proc.stdout.strip() else []
+            for item in data:
+                violations.append(
+                    {
+                        "file": item.get("filename", ""),
+                        "line": item.get("location", {}).get("row", 0),
+                        "code": item.get("code", ""),
+                        "message": item.get("message", ""),
+                    }
+                )
+        except FileNotFoundError:
+            import logging
+
+            logging.getLogger("patchi.prechecks").warning(
+                "ruff not installed — skipping Python lint check"
+            )
+        except (subprocess.TimeoutExpired, Exception):
+            pass
+
+    elif language in ("javascript", "typescript"):
+        try:
+            proc = subprocess.run(
+                ["npx", "eslint", "--format=json", str(root)],
+                capture_output=True,
+                text=True,
+                timeout=30,
+                cwd=str(root),
+            )
+            import json
+
+            data = json.loads(proc.stdout) if proc.stdout.strip() else []
+            for item in data:
+                for msg in item.get("messages", []):
+                    violations.append(
+                        {
+                            "file": item.get("filePath", ""),
+                            "line": msg.get("line", 0),
+                            "code": msg.get("ruleId", ""),
+                            "message": msg.get("message", ""),
+                        }
+                    )
+        except (subprocess.TimeoutExpired, FileNotFoundError, Exception):
+            pass
+
+    return violations
+
+
+def patchi_diff_stat(original: str, proposed: str) -> dict:
+    """Compare before/after line counts. Returns add/delete/total stats."""
+    orig_lines = original.splitlines()
+    prop_lines = proposed.splitlines()
+    orig_set = set(orig_lines)
+    prop_set = set(prop_lines)
+    added = prop_set - orig_set
+    deleted = orig_set - prop_set
+    return {
+        "orig_lines": len(orig_lines),
+        "new_lines": len(prop_lines),
+        "lines_added": len(added),
+        "lines_deleted": len(deleted),
+        "net_change": len(prop_lines) - len(orig_lines),
+    }
+
+
+# ── Pre-checks Agent ──────────────────────────────────────────────────────────
+
+
+@register
+class PreCheckAgent(BaseAgent):
+    """Layer 0: instant deterministic pre-checks before expensive scans."""
+
+    name = "PreCheckAgent"
+    group = AgentGroup.SECURITY
+    timeout = 15
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # 1. Banned API checks
+        for pattern, msg in _BANNED_APIS:
+            count = patchi_pattern_count(inp.root, pattern.pattern)
+            if count > 0:
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="banned_api",
+                        severity=Severity.CRITICAL,
+                        file="",
+                        message=f"{msg} — {count} occurrence(s) found",
+                        cwe="CWE-94",
+                    )
+                )
+
+        # 2. Quick lint check
+        violations = patchi_lint_check(inp.root, "python")
+        for v in violations[:20]:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="lint_violation",
+                    severity=Severity.LOW,
+                    file=v["file"],
+                    line=v["line"],
+                    message=f"[{v['code']}] {v['message']}",
+                )
+            )
+
+        result.files_scanned = len(list(safe_rglob(inp.root, "*.py")))

patchi/core/security/precommit_hook.py

@@ -0,0 +1,247 @@
+"""
+Pre-Commit Hook Generator - produces a POSIX sh pre-commit hook.
+
+The generated hook runs:
+  1. ruff check (fast lint gate)
+  2. p scan --changed --quiet (on-demand security scan of changed files)
+
+Both steps are non-blocking warnings by default; pass --strict to fail
+the commit on violations.
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+
+_log = logging.getLogger("patchi.security.precommit_hook")
+
+# -- Hook Script Template -----------------------------------------------------
+
+
+def generate_hook(
+    strict: bool = False,
+    with_tests: bool = False,
+    with_scan: bool = True,
+    auto_fix: bool = False,
+) -> str:
+    """Generate a pre-commit hook script.
+
+    Args:
+        strict: If True, failures block the commit (exit 1).
+        with_tests: If True, include pytest gate after ruff.
+        with_scan: If True, include p scan --changed gate.
+        auto_fix: If True, run proactive auto-fix before lint.
+
+    Returns:
+        POSIX sh script text.
+    """
+    lines = [
+        "#!/bin/sh",
+        "# Patchi pre-commit hook - generated by `p dev hook`",
+        "#",
+        "# Gates:",
+    ]
+
+    step_num = 1
+    if auto_fix:
+        lines.append(f"#   {step_num}. proactive auto-fix (charter)")
+        step_num += 1
+    lines.append(f"#   {step_num}. ruff check (lint)")
+    if with_tests:
+        step_num += 1
+        lines.append(f"#   {step_num}. pytest (tests)")
+    if with_scan:
+        step_num += 1
+        lines.append(f"#   {step_num}. p scan --changed (security)")
+
+    # NOTE: no `set -e` - each step checks $? manually so warnings
+    # are non-blocking when STRICT=0.
+    lines.append("STRICT=" + ("1" if strict else "0"))
+    lines.append("FAIL=0")
+    lines.append("AUTO_FIX=" + ("1" if auto_fix else "0"))
+    lines.append("")
+    lines.append('echo "=== Patchi pre-commit hook ==="')
+    lines.append("")
+
+    total = step_num
+    current_step = 0
+
+    # Step: Auto-fix (optional)
+    if auto_fix:
+        current_step += 1
+        lines.extend(
+            [
+                f"# -- Step {current_step}/{total}: Proactive auto-fix ---------------------",
+                f'echo "  [{current_step}/{total}] proactive auto-fix..."',
+                "python -c \"import patchi.core.security.auto_fix_proactive as afp; \
+import sys, pathlib; \
+files = [pathlib.Path(f) for f in sys.argv[1:]]; \
+result = afp.proactive_fix_path(pathlib.Path.cwd(), files[0], apply=True) if files else None; \
+print('  auto-fixed' if result else '  no changes needed')\" $GIT_PARAMS 2>/dev/null",
+                "if [ $? -ne 0 ]; then",
+                '  echo "  [WARN] auto-fix skipped (non-blocking)"',
+                "else",
+                '  echo "  [OK] auto-fix complete"',
+                "fi",
+                "",
+            ]
+        )
+
+    # Step: Ruff
+    current_step += 1
+    lines.extend(
+        [
+            f"# -- Step {current_step}/{total}: Ruff lint ----------------------------",
+            f'echo "  [{current_step}/{total}] ruff check..."',
+            "ruff check patchi/ --select E,F,W --ignore E501 --quiet 2>/dev/null",
+            "if [ $? -ne 0 ]; then",
+            '  echo "  [WARN] ruff found issues (non-blocking)"',
+            '  if [ "$STRICT" = "1" ]; then',
+            '    echo "  [BLOCKED] Commit blocked: fix ruff errors first"',
+            "    exit 1",
+            "  fi",
+            "  FAIL=1",
+            "else",
+            '  echo "  [OK] ruff clean"',
+            "fi",
+            "",
+        ]
+    )
+
+    # Step 2: Tests (optional)
+    if with_tests:
+        lines.extend(
+            [
+                f"# -- Step {current_step}/{total}: Pytest -------------------------------",
+                f'echo "  [{current_step}/{total}] pytest..."',
+                "PATCHI_OFFLINE=1 python -m pytest tests/ -x -q --timeout=30 --tb=no 2>/dev/null",
+                "if [ $? -ne 0 ]; then",
+                '  echo "  [WARN] pytest failed (non-blocking)"',
+                '  if [ "$STRICT" = "1" ]; then',
+            ]
+        )
+        if with_scan:
+            lines.append('    echo "  [BLOCKED] Commit blocked: fix failing tests first"')
+        else:
+            lines.append('    echo "  [BLOCKED] Commit blocked: fix failing tests first"')
+        lines.extend(
+            [
+                "    exit 1",
+                "  fi",
+                "  FAIL=1",
+                "else",
+                '  echo "  [OK] tests pass"',
+                "fi",
+                "",
+            ]
+        )
+
+    # Step: Scan --changed (optional)
+    if with_scan:
+        current_step += 1
+        lines.extend(
+            [
+                f"# -- Step {current_step}/{total}: On-demand security scan ----------------",
+                f'echo "  [{current_step}/{total}] p scan --changed..."',
+                "python -m patchi.cli.main scan --changed --quiet &",
+                "SCAN_PID=$!",
+                "for i in 1 2 3 4 5 6; do sleep 10; kill -0 $SCAN_PID 2>/dev/null || break; done",
+                "kill $SCAN_PID 2>/dev/null && echo '  (scan timed out)' || true",
+                "",
+            ]
+        )
+
+    # Step: Fast SAST gate on staged files (Bandit + Semgrep, synchronous)
+    if with_scan:
+        current_step += 1
+        lines.extend(
+            [
+                f"# -- Step {current_step}/{total}: Fast SAST gate (Bandit+Semgrep) ------",
+                f'echo "  [{current_step}/{total}] fast SAST gate on staged files..."',
+                'STAGED=$(git diff --cached --name-only | grep -E "\\.py$" || true)',
+                'if [ -n "$STAGED" ]; then',
+                "  python -m patchi.core.security.sast_gate $STAGED",
+                "  SAST_RC=$?",
+                '  if [ "$SAST_RC" -ne 0 ]; then',
+                '    echo "  [WARN] fast SAST gate found issues (non-blocking)"',
+                '    if [ "$STRICT" = "1" ]; then',
+                '      echo "  [BLOCKED] Commit blocked: resolve SAST findings first"',
+                "      exit 1",
+                "    fi",
+                "    FAIL=1",
+                "  else",
+                '    echo "  [OK] fast SAST gate clean"',
+                "  fi",
+                "else",
+                '  echo "  [OK] no staged Python files"',
+                "fi",
+                "",
+            ]
+        )
+
+    # Summary
+    lines.extend(
+        [
+            "# -- Summary --------------------------------------------------------",
+            'if [ "$FAIL" = "1" ]; then',
+            '  echo "[WARN] Commit succeeded with warnings. Run "p dev check" for full gate."',
+            "else",
+            '  echo "[OK] All gates passed."',
+            "fi",
+            "",
+            "exit 0",
+        ]
+    )
+
+    return "\n".join(lines) + "\n"
+
+
+def install_hook(
+    root: Path,
+    strict: bool = False,
+    with_tests: bool = False,
+    with_scan: bool = True,
+    auto_fix: bool = False,
+) -> Path:
+    """Generate and install the pre-commit hook.
+
+    Returns the path to the installed hook.
+    """
+    git_dir = root / ".git"
+    if not git_dir.exists():
+        raise FileNotFoundError(f"Not a git repository: {root}")
+
+    hook_path = git_dir / "hooks" / "pre-commit"
+    hook_path.parent.mkdir(parents=True, exist_ok=True)
+
+    script = generate_hook(
+        strict=strict, with_tests=with_tests, with_scan=with_scan, auto_fix=auto_fix
+    )
+    hook_path.write_text(script, encoding="utf-8")
+
+    try:
+        hook_path.chmod(0o755)
+    except OSError:
+        pass  # Windows
+
+    _log.info("Installed pre-commit hook at %s", hook_path)
+    return hook_path
+
+
+def read_hook_status(root: Path) -> dict:
+    """Check what the installed pre-commit hook does."""
+    hook_path = root / ".git" / "hooks" / "pre-commit"
+    if not hook_path.is_file():
+        return {"installed": False}
+
+    content = hook_path.read_text(encoding="utf-8", errors="replace")
+    return {
+        "installed": True,
+        "path": str(hook_path),
+        "has_ruff": "ruff check" in content,
+        "has_pytest": "pytest" in content,
+        "has_scan": "scan --changed" in content or "scan --quiet" in content,
+        "strict": "STRICT=1" in content,
+        "auto_fix": "AUTO_FIX=1" in content,
+    }