patchi 0.7.5__py3-none-any.whl

patchi/web/routes/findings.py

@@ -0,0 +1,330 @@
+"""Findings route — findings list with filters + chain/intent tabs, DAST screenshots, history."""
+
+from __future__ import annotations
+
+import json as _json
+import logging
+import os
+import sqlite3
+from datetime import datetime
+from pathlib import Path
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse, JSONResponse
+from fastapi.templating import Jinja2Templates
+
+_log = logging.getLogger("patchi.web.routes.findings")
+
+
+router = APIRouter()
+templates = Jinja2Templates(directory=str(Path(__file__).parent.parent / "templates"))
+
+
+def _load_chain_intent(root: Path) -> dict:
+    """Load persisted chain/intent data from the last scan."""
+    ci_path = root / ".patchi" / "chain_intent.json"
+    if ci_path.is_file():
+        try:
+            return _json.loads(ci_path.read_text(encoding="utf-8"))
+        except Exception as _exc:
+            _log.warning('_load_chain_intent failed: %s', _exc)
+    return {"chains": [], "intent_report": None}
+
+
+def _load_visual_regression(root: Path) -> dict:
+    """Load visual regression screenshots, diffs, and baselines."""
+    evidence_dir = root / ".patchi" / "evidence" / "screenshots" / "visual_regression"
+    baseline_dir = root / ".patchi" / "visual_baselines"
+
+    screenshots = []
+    if evidence_dir.is_dir():
+        for f in sorted(
+            evidence_dir.glob("*.png"), key=lambda x: x.stat().st_mtime, reverse=True
+        ):
+            try:
+                stat = f.stat()
+                is_diff = "_diff" in f.stem
+                screenshots.append(
+                    {
+                        "name": f.stem,
+                        "filename": f.name,
+                        "path": str(f.relative_to(root)),
+                        "serve_url": f"/api/live-testing/screenshot/{f.name}",
+                        "size_kb": round(stat.st_size / 1024, 1),
+                        "is_diff": is_diff,
+                        # Pair diff images with their source: "foo_diff" -> "foo"
+                        "source_name": f.stem.replace("_diff", "") if is_diff else None,
+                    }
+                )
+            except Exception as _exc:
+                _log.warning('_load_visual_regression failed: %s', _exc)
+
+    # Pair screenshots: for each diff, find its source screenshot
+    diff_map = {s["source_name"]: s for s in screenshots if s["is_diff"]}
+    pairs = []
+    seen = set()
+    for s in screenshots:
+        if s["is_diff"]:
+            continue  # handled via source pairing
+        pair = {"source": s, "diff": diff_map.get(s["name"])}
+        pairs.append(pair)
+        seen.add(s["name"])
+    # Add orphaned diffs (source missing)
+    for name, diff in diff_map.items():
+        if name not in seen:
+            pairs.append({"source": None, "diff": diff})
+
+    baseline_count = 0
+    if baseline_dir.is_dir():
+        baseline_count = len(list(baseline_dir.rglob("*.png")))
+
+    return {
+        "screenshots": screenshots,
+        "pairs": pairs,
+        "total": len([s for s in screenshots if not s["is_diff"]]),
+        "diffs": len([s for s in screenshots if s["is_diff"]]),
+        "baselines": baseline_count,
+        "total_size_kb": round(sum(s["size_kb"] for s in screenshots), 1),
+    }
+
+
+def _load_dast_evidence(root: Path) -> dict[str, dict]:
+    """Load DAST screenshot evidence from .patchi/evidence/dast/."""
+    evidence_dir = root / ".patchi" / "evidence" / "dast"
+    evidence_map: dict[str, dict] = {}
+    if not evidence_dir.is_dir():
+        return evidence_map
+    for entry in os.scandir(evidence_dir):
+        if not entry.is_file():
+            continue
+        name = entry.name
+        stem = Path(name).stem  # e.g. "dast_xss_reflected_abc123"
+        # Strip the random suffix (last _XXXXX) to get the test name
+        parts = stem.rsplit("_", 1)
+        test_name = parts[0] if len(parts) > 1 else stem
+        # Extract category from test name: "dast_xss_reflected" -> "xss"
+        cat = ""
+        if test_name.startswith("dast_"):
+            cat = test_name[5:].split("_")[0]
+        evidence_map.setdefault(cat, {}).setdefault(test_name, []).append(
+            f"/evidence/dast/{name}"
+        )
+    return evidence_map
+
+
+@router.get("/findings", response_class=HTMLResponse)
+async def findings(request: Request):
+    root = request.app.state.root
+    from patchi.core import memory as mem
+
+    mem.get_brain(root)
+    scan_results = mem.get_scan_results(root)
+
+    # Flatten findings from all agents and attach remediation
+    all_findings = []
+    try:
+        from patchi.core.security.remediation import get_remediation, get_remediation_confidence
+
+        has_remediation = True
+    except ImportError:
+        has_remediation = False
+
+    # Collect DAST-specific metadata and scan stats
+    dast_findings_count = 0
+    dast_tests_run = 0
+    dast_target = ""
+    scan_agent_count = len(scan_results)
+
+    for agent_name, data in scan_results.items():
+        # Accumulate DAST metadata from the DASTAgent result
+        if agent_name == "DASTAgent":
+            dast_findings_count = data.get("findings_count", 0)
+            dast_tests_run = data.get("tests_run", 0)
+            dast_target = data.get("target_url", "")
+
+        for f in data.get("findings", []):
+            f["agent"] = agent_name
+            # Flag DAST findings for template
+            if agent_name == "DASTAgent" or f.get("type", "").startswith("dast_"):
+                f["is_dast"] = True
+            # Attach remediation suggestion for non-chain findings
+            if has_remediation:
+                ftype = f.get("type", "")
+                rem = get_remediation(ftype)
+                if rem:
+                    f["remediation"] = {
+                        "action": rem.action,
+                        "code_pattern": rem.code_pattern,
+                        "auto_fixable": rem.auto_fixable,
+                        "playbook_id": rem.playbook_id,
+                        "confidence": round(get_remediation_confidence(ftype, root), 2),
+                    }
+            all_findings.append(f)
+
+    # Sort by severity
+    sev_order = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4}
+    all_findings.sort(key=lambda f: (0 if f.get("is_dast") else 1, sev_order.get(f.get("severity", "info"), 5)))
+
+    # Load DAST screenshot evidence
+    dast_evidence = _load_dast_evidence(root)
+
+    # Attach screenshot paths to DAST findings
+    for f in all_findings:
+        if f.get("is_dast"):
+            ftype = f.get("type", "")
+            cat = ftype.replace("dast_", "") if ftype.startswith("dast_") else ""
+            if cat in dast_evidence:
+                # Get first screenshot for this category
+                screenshots = []
+                for _test_name, paths in dast_evidence[cat].items():
+                    screenshots.extend(paths[:1])  # one per test type
+                f["screenshots"] = screenshots[:3]  # max 3 per finding
+            else:
+                f["screenshots"] = []
+
+    # Load chain/intent data with remediation suggestions
+    ci = _load_chain_intent(root)
+    chains = ci.get("chains", [])
+    intent = ci.get("intent_report")
+
+    # Attach remediation to each chain step
+    try:
+        from patchi.core.security.remediation import get_remediation_for_step
+
+        for chain in chains:
+            chain["remediations"] = [
+                get_remediation_for_step(step) for step in chain.get("steps", [])
+            ]
+    except ImportError:
+        pass
+
+    # Build chain-membership map: (file, line, type) -> list of chain indices
+    chain_members: dict[str, list[int]] = {}
+    for ci, chain in enumerate(chains):
+        for step in chain.get("steps", []):
+            key = f"{step.get('file', '')}:{step.get('line', 0)}:{step.get('type', '')}"
+            chain_members.setdefault(key, []).append(ci)
+
+    # Load charter violations
+    charter_violations: list[dict] = []
+    try:
+        from patchi.core.security.charter import check_all_violations, load_charter
+        charter = load_charter(root)
+        if charter.rules:
+            charter_violations = [v.to_dict() for v in check_all_violations(charter)]
+    except Exception as _exc:
+        _log.warning('findings failed: %s', _exc)
+
+    # Load scan history
+    scan_history = _load_scan_history(root)
+
+    # Load visual regression data
+    vr_data = _load_visual_regression(root)
+
+    return templates.TemplateResponse(
+        request,
+        "findings.html",
+        {
+            "request": request,
+            "findings": all_findings,
+            "total": len(all_findings),
+            "chains": chains,
+            "intent": intent,
+            "chain_members": chain_members,
+            "charter_violations": charter_violations,
+            "dast_findings_count": dast_findings_count,
+            "dast_tests_run": dast_tests_run,
+            "dast_target": dast_target,
+            "scan_agent_count": scan_agent_count,
+            "scan_history": scan_history,
+            "vr_pairs": vr_data["pairs"],
+            "vr_total": vr_data["total"],
+            "vr_diffs": vr_data["diffs"],
+            "vr_baselines": vr_data["baselines"],
+            "vr_size_kb": vr_data["total_size_kb"],
+        },
+    )
+
+
+@router.get("/api/chains")
+async def api_chains(request: Request):
+    """JSON endpoint for chain/intent data."""
+    root = request.app.state.root
+    return JSONResponse(_load_chain_intent(root))
+
+
+@router.get("/api/findings/dast-evidence")
+async def api_dast_evidence(request: Request):
+    """JSON endpoint for DAST screenshot evidence."""
+    root = request.app.state.root
+    return JSONResponse(_load_dast_evidence(root))
+
+
+def _load_scan_history(root: Path, limit: int = 50) -> list[dict]:
+    """Load scan history from the SQLite database."""
+    db_path = root / ".patchi" / "patchi_history.db"
+    if not db_path.is_file():
+        return []
+    try:
+        db = sqlite3.connect(str(db_path))
+        cursor = db.cursor()
+        cursor.execute(
+            "SELECT scan_id, timestamp, tool, findings_count, "
+            "severity_breakdown, duration_ms, health_score, metrics "
+            "FROM scan_history ORDER BY timestamp DESC LIMIT ?",
+            (limit,),
+        )
+        rows = cursor.fetchall()
+        db.close()
+        results = []
+        for row in rows:
+            entry = {
+                "scan_id": row[0],
+                "timestamp": row[1],
+                "tool": row[2],
+                "findings_count": row[3],
+                "severity_breakdown": _json.loads(row[4]) if row[4] else {},
+                "duration_ms": row[5],
+                "health_score": row[6],
+                "metrics": _json.loads(row[7]) if row[7] else {},
+            }
+            results.append(entry)
+        return results
+    except Exception:
+        return []
+
+
+@router.get("/api/findings/history")
+async def api_findings_history(request: Request, limit: int = 50):
+    """JSON endpoint for scan history."""
+    root = request.app.state.root
+    return JSONResponse(_load_scan_history(root, limit))
+
+
+@router.get("/api/findings/history/export")
+async def api_findings_history_export(request: Request):
+    """Export full scan history + current findings as JSON for CI/CD."""
+    root = request.app.state.root
+    history = _load_scan_history(root, limit=500)
+
+    # Also include current findings snapshot
+    from patchi.core import memory as mem
+    scan_results = mem.get_scan_results(root)
+    current_findings = []
+    for agent_name, data in scan_results.items():
+        for f in data.get("findings", []):
+            f["agent"] = agent_name
+            current_findings.append(f)
+
+    export = {
+        "exported_at": datetime.utcnow().isoformat() + "Z",
+        "project": str(root),
+        "history": history,
+        "current_findings": current_findings,
+        "summary": {
+            "total_scans": len(history),
+            "total_findings": len(current_findings),
+            "latest_health_score": history[0]["health_score"] if history else None,
+        },
+    }
+    return JSONResponse(export)

patchi/web/routes/guard.py

@@ -0,0 +1,35 @@
+"""Guard route — hosted guard monitoring."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse
+from fastapi.templating import Jinja2Templates
+
+router = APIRouter()
+templates = Jinja2Templates(directory=str(Path(__file__).parent.parent / "templates"))
+
+
+@router.get("/guard", response_class=HTMLResponse)
+async def guard(request: Request):
+    root = request.app.state.root
+    from patchi.core import config as cfg
+
+    try:
+        config = cfg.load(root)
+    except Exception:
+        config = {}
+
+    hosted = config.get("hosted", {})
+
+    return templates.TemplateResponse(
+        request,
+        "guard.html",
+        {
+            "request": request,
+            "enabled": hosted.get("enabled", False),
+            "log_path": hosted.get("log_path", ""),
+        },
+    )

patchi/web/routes/history.py

@@ -0,0 +1,126 @@
+"""History route — scan and fix history with filtering/sorting."""
+
+from __future__ import annotations
+
+import json
+import logging
+from pathlib import Path
+
+from fastapi import APIRouter, Query, Request
+from fastapi.responses import HTMLResponse, JSONResponse
+from fastapi.templating import Jinja2Templates
+
+logger = logging.getLogger("patchi.web.history")
+
+router = APIRouter()
+templates = Jinja2Templates(directory=str(Path(__file__).parent.parent / "templates"))
+
+
+@router.get("/history", response_class=HTMLResponse)
+async def history_page(request: Request):
+    root = request.app.state.root
+    from patchi.core import memory as mem
+
+    brain = mem.get_brain(root)
+    patches = mem.list_patches(root)
+
+    scan_history = []
+    try:
+        from patchi.core.security.history import patchi_get_history
+
+        scan_history = patchi_get_history(root, limit=100)
+    except Exception as e:
+        logger.warning("Failed to fetch scan history: %s", e)
+
+    # Extract unique tools for filter dropdown
+    tools = sorted({s.get("tool", "unknown") for s in scan_history})
+
+    return templates.TemplateResponse(
+        request,
+        "history.html",
+        {
+            "request": request,
+            "patches": patches,
+            "scan_history": scan_history,
+            "scan_history_json": json.dumps(scan_history),
+            "tools": tools,
+            "file_count": brain.get("file_count", 0),
+            "route_count": brain.get("route_count", 0),
+            "framework": brain.get("framework", "Unknown"),
+        },
+    )
+
+
+@router.get("/api/history/filter")
+async def filter_history(
+    request: Request,
+    date_from: str | None = Query(None, description="Start date (YYYY-MM-DD)"),
+    date_to: str | None = Query(None, description="End date (YYYY-MM-DD)"),
+    severity: str | None = Query(None, description="Comma-separated severities"),
+    tool: str | None = Query(None, description="Filter by tool name"),
+    sort_by: str = Query("timestamp", description="Sort field"),
+    sort_dir: str = Query("desc", description="Sort direction (asc/desc)"),
+    limit: int = Query(50, description="Max results"),
+):
+    """Filter and sort scan history."""
+    root = request.app.state.root
+
+    try:
+        from patchi.core.security.history import patchi_get_history
+
+        all_history = patchi_get_history(root, limit=200)
+    except Exception as e:
+        logger.warning("Failed to fetch scan history: %s", e)
+        all_history = []
+
+    # Apply filters
+    filtered = all_history
+
+    # Date range filter
+    if date_from:
+        filtered = [s for s in filtered if s.get("timestamp", "") >= date_from]
+    if date_to:
+        # Include the full end day
+        filtered = [s for s in filtered if s.get("timestamp", "") <= date_to + "T23:59:59"]
+
+    # Severity filter (check if any matching severity has count > 0)
+    if severity:
+        sev_list = [s.strip() for s in severity.split(",") if s.strip()]
+        if sev_list:
+            filtered = [
+                s for s in filtered
+                if any(
+                    s.get("severity_breakdown", {}).get(sev, 0) > 0
+                    for sev in sev_list
+                )
+            ]
+
+    # Tool filter
+    if tool and tool != "all":
+        filtered = [s for s in filtered if s.get("tool", "") == tool]
+
+    # Sorting
+    reverse = sort_dir == "desc"
+    if sort_by == "timestamp":
+        filtered.sort(key=lambda s: s.get("timestamp", ""), reverse=reverse)
+    elif sort_by == "findings":
+        filtered.sort(key=lambda s: s.get("findings_count", 0), reverse=reverse)
+    elif sort_by == "health":
+        filtered.sort(key=lambda s: s.get("health_score", 0), reverse=reverse)
+    elif sort_by == "duration":
+        filtered.sort(key=lambda s: s.get("duration_ms", 0), reverse=reverse)
+    elif sort_by == "severity":
+        # Sort by total critical+high findings
+        def _sev_score(s):
+            sb = s.get("severity_breakdown", {})
+            return sb.get("critical", 0) * 100 + sb.get("high", 0) * 10
+        filtered.sort(key=_sev_score, reverse=reverse)
+
+    # Limit
+    filtered = filtered[:limit]
+
+    return JSONResponse({
+        "total": len(all_history),
+        "filtered": len(filtered),
+        "results": filtered,
+    })

patchi/web/routes/landing.py

@@ -0,0 +1,52 @@
+"""Public marketing landing — Snyk × Linear style, standalone.
+
+Not the localhost app dashboard (/). This is the external-facing
+story: hero + 3-up + Brain + Council + Live Tests + CLI parity + freemium.
+Shares tokens with the app but is a separate band layout for marketing.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse
+from starlette.templating import Jinja2Templates
+
+router = APIRouter()
+
+templates = Jinja2Templates(directory=str(Path(__file__).parent.parent / "templates"))
+templates.env.filters["tojson"] = lambda v: json.dumps(v)
+
+
+@router.get("/landing", response_class=HTMLResponse)
+@router.get("/welcome", response_class=HTMLResponse)
+async def landing(request: Request):
+    root = request.app.state.root
+    from patchi.core import memory as mem
+    from patchi.core.health import compute as compute_health
+
+    brain = mem.get_brain(root)
+    hs = compute_health(root)
+
+    # Stats for hero proof + metrics
+    scan_results = mem.get_scan_results(root)
+    total_findings = sum(len(v.get("findings", [])) for v in scan_results.values() if isinstance(v, dict))
+
+    return templates.TemplateResponse(
+        request,
+        "landing.html",
+        {
+            "request": request,
+            "health_score": hs.total,
+            "health_grade": hs.grade,
+            "file_count": brain.get("file_count", 0),
+            "route_count": brain.get("route_count", 0),
+            "framework": brain.get("framework", "Unknown"),
+            "languages": brain.get("languages", {}),
+            "recent_findings": total_findings,
+            "active_domains": brain.get("active_security_domains", [])[:6],
+            "project_purpose": brain.get("project_purpose", "AI-powered code security & quality agent colony"),
+        },
+    )

patchi/web/routes/live_testing.py

@@ -0,0 +1,24 @@
+"""Live Testing page — browser automation, screenshots, stress tests."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Request
+from starlette.templating import Jinja2Templates
+
+router = APIRouter()
+_templates = Jinja2Templates(directory=str(Path(__file__).parent.parent / "templates"))
+
+
+@router.get("/live-tests")
+async def live_tests_page(request: Request):
+    """Render the live testing dashboard."""
+    return _templates.TemplateResponse("live_testing.html", {"request": request})
+
+
+@router.get("/live-testing")
+async def live_testing_redirect():
+    """Legacy path — forwards to the unified live tests page."""
+    from fastapi.responses import RedirectResponse
+    return RedirectResponse(url="/live-tests", status_code=307)

patchi/web/routes/review.py

@@ -0,0 +1,57 @@
+"""Review route — patch review with diffs."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse
+from fastapi.templating import Jinja2Templates
+
+router = APIRouter()
+templates = Jinja2Templates(directory=str(Path(__file__).parent.parent / "templates"))
+
+
+@router.get("/review", response_class=HTMLResponse)
+async def review(request: Request):
+    root = request.app.state.root
+    from patchi.core import memory as mem
+
+    raw_patches = mem.read("patches", root)
+
+    # Enrich each patch with diff content if available
+    patches = []
+    for p in raw_patches:
+        if isinstance(p, dict):
+            # Build a unified diff string from FileChange objects if not already present
+            if not p.get("diff") and p.get("changes"):
+                diff_lines = []
+                for change in p["changes"]:
+                    path = change.get("path", "unknown")
+                    before = change.get("before", "")
+                    proposed = change.get("proposed", "")
+                    if before or proposed:
+                        import difflib
+
+                        diff = list(
+                            difflib.unified_diff(
+                                before.splitlines(keepends=True) if before else [],
+                                proposed.splitlines(keepends=True) if proposed else [],
+                                fromfile=f"a/{path}",
+                                tofile=f"b/{path}",
+                                lineterm="",
+                            )
+                        )
+                        diff_lines.extend(diff)
+                p["diff"] = "\n".join(diff_lines) if diff_lines else ""
+            patches.append(p)
+
+    return templates.TemplateResponse(
+        request,
+        "review.html",
+        {
+            "request": request,
+            "patches": patches,
+            "total": len(patches),
+        },
+    )