patchi 0.7.5__py3-none-any.whl

patchi/cli/commands/review_cmd.py

@@ -0,0 +1,225 @@
+"""
+`p review` — Interactive patch review panel.
+
+Shows all pending patches with:
+  - Color-coded unified diff
+  - Risk score + confidence + blast radius
+  - Accept / Reject prompt per patch
+  - Bulk accept-all / reject-all
+
+After review, accepted patches are applied via PatchApplier.
+"""
+
+from __future__ import annotations
+
+import logging
+from datetime import UTC
+from pathlib import Path
+
+from rich.panel import Panel
+from rich.prompt import Confirm, Prompt
+from rich.syntax import Syntax
+
+from patchi.cli.console import con
+from patchi.core import memory as mem
+from patchi.core.config import require_project_root
+from patchi.core.fix.applier import PatchApplier
+from patchi.core.fix.patch import Patch, PatchState
+
+_log = logging.getLogger("patchi.cli.review_cmd")
+
+
+def run(root: Path | None = None) -> None:
+    """p review — show all pending patches."""
+    try:
+        r = root or require_project_root()
+    except RuntimeError as e:
+        con.print(f"[red]{e}[/red]")
+        return
+
+    patches_raw = mem.list_patches(r)
+    pending = [
+        Patch.from_dict(p) for p in patches_raw if p.get("state") == PatchState.PENDING.value
+    ]
+
+    con.print()
+
+    if not pending:
+        con.print(
+            Panel(
+                "[dim]Nothing waiting for your review. All clear.[/dim]\n",
+                title="[bold #C8621A]Review Panel[/bold #C8621A]",
+                border_style="#2A3D28",
+            )
+        )
+        con.print()
+        return
+
+    con.print(
+        f"[bold #F2EDD6]{len(pending)} patch(es) waiting for review.[/bold #F2EDD6]  "
+        f"[dim]Accept all · Reject all · Review one by one[/dim]"
+    )
+    con.print()
+
+    # Bulk actions first
+    if len(pending) > 1:
+        bulk = Prompt.ask(
+            "Bulk action",
+            choices=["all", "none", "one-by-one"],
+            default="one-by-one",
+        )
+        if bulk == "all":
+            _apply_all(pending, r)
+            return
+        elif bulk == "none":
+            _reject_all(pending, r)
+            return
+
+    # One-by-one review
+    applier = PatchApplier(r)
+    accepted = 0
+    rejected = 0
+
+    for i, patch in enumerate(pending, 1):
+        con.print(f"[dim]Patch {i} of {len(pending)}[/dim]")
+        _show_patch_card(patch)
+
+        decision = Confirm.ask(
+            f"  Apply [bold]{patch.id}[/bold]?",
+            default=False,
+        )
+
+        if decision:
+            result = applier.apply(patch)
+            if result.success:
+                con.print(
+                    f"  [#4ADE80]✓ Applied.[/#4ADE80]  "
+                    f"[dim]Tests: {'passed' if result.test_passed else 'skipped (no tests)'}[/dim]"
+                )
+                accepted += 1
+            else:
+                con.print(f"  [red]✗ Failed and rolled back.[/red]  [dim]{result.error[:80]}[/dim]")
+        else:
+            _reject_patch(patch, r)
+            con.print("  [dim]Rejected.[/dim]")
+            rejected += 1
+
+        con.print()
+
+    con.print(f"[dim]Review complete: {accepted} applied, {rejected} rejected.[/dim]")
+    con.print()
+
+
+# ── Patch card renderer ────────────────────────────────────────────────────────
+
+
+def _show_patch_card(patch: Patch) -> None:
+    """Render a single patch with diff, scores, and metadata."""
+    risk_colors = {
+        "low": "#4ADE80",
+        "medium": "#FACC15",
+        "high": "#FF4D6D",
+    }
+    risk_color = risk_colors.get(patch.risk_level, "white")
+
+    # Header
+    con.print(
+        Panel(
+            f"[bold #F2EDD6]{patch.description}[/bold #F2EDD6]\n"
+            f"[dim]Agent: {patch.agent}  ·  "
+            f"Files: {patch.file_count}  ·  "
+            f"Lines: {patch.total_lines_changed}[/dim]",
+            title=f"[bold]Patch {patch.id}[/bold]",
+            border_style=risk_color,
+            padding=(0, 1),
+        )
+    )
+
+    # Score bar
+    con.print(
+        f"  [bold {risk_color}]Risk: {patch.risk_score}/100 ({patch.risk_level.upper()})[/bold {risk_color}]"
+        f"   [dim]Confidence: {patch.confidence}%"
+        f"   Blast radius: {patch.blast_radius} file(s)[/dim]"
+    )
+
+    if patch.ai_explanation:
+        con.print(f"  [dim italic]{patch.ai_explanation[:120]}[/dim italic]")
+
+    con.print()
+
+    # Diffs
+    for change in patch.changes:
+        if not change.diff.strip():
+            continue
+        con.print(
+            f"  [bold #B8A898]{change.path}[/bold #B8A898]  "
+            f"[dim]+{change.lines_added} / -{change.lines_removed}[/dim]"
+        )
+        # Syntax-highlighted diff
+        diff_syntax = Syntax(
+            change.diff[:1500],
+            "diff",
+            theme="monokai",
+            line_numbers=False,
+            padding=1,
+        )
+        con.print(diff_syntax)
+
+
+# ── Bulk actions ───────────────────────────────────────────────────────────────
+
+
+def _apply_all(patches: list[Patch], root: Path) -> None:
+    applier = PatchApplier(root)
+    applied = 0
+    for patch in patches:
+        result = applier.apply(patch)
+        if result.success:
+            applied += 1
+            con.print(f"  [#4ADE80]✓[/#4ADE80] {patch.id} — {patch.description[:60]}")
+        else:
+            con.print(f"  [red]✗[/red] {patch.id} — rolled back. {result.error[:60]}")
+    con.print()
+    con.print(f"[dim]Applied {applied}/{len(patches)} patches.[/dim]")
+    con.print()
+
+
+def _reject_all(patches: list[Patch], root: Path) -> None:
+    for patch in patches:
+        _reject_patch(patch, root)
+    con.print(f"[dim]Rejected {len(patches)} patches.[/dim]")
+    con.print()
+
+
+def _reject_patch(patch: Patch, root: Path) -> None:
+    """Mark a patch as rejected in memory + track rejection count for learning."""
+    try:
+        from datetime import datetime
+
+        patches_raw = mem.list_patches(root)
+        for p in patches_raw:
+            if p.get("id") == patch.id:
+                p["state"] = PatchState.REJECTED.value
+                p["rejected_at"] = datetime.now(UTC).isoformat()
+                break
+        import json
+
+        from patchi.core.constants import MEMORY_FILES, MemoryCategory
+
+        mem_path = root / MEMORY_FILES[MemoryCategory.PATCHES]
+        mem_path.write_text(json.dumps(patches_raw, indent=2), encoding="utf-8")
+    except Exception as e:
+        _log.warning("_reject_patch failed: %s", e)
+
+    # Rejection learning — track count per patch type
+    try:
+        patch_type = getattr(patch, "patch_type", None)
+        if patch_type:
+            type_str = patch_type.value if hasattr(patch_type, "value") else str(patch_type)
+            count = mem.record_rejection(type_str, root)
+            if count == 3:
+                con.print(
+                    f"\n[#C8621A]ℹ You've rejected [bold]{type_str}[/bold] patches 3 times.[/#C8621A]"
+                )
+    except Exception as e:
+        _log.warning("_reject_patch failed: %s", e)

patchi/cli/commands/rules_cmd.py

@@ -0,0 +1,233 @@
+"""p rules — view and validate security rule packs.
+
+Subcommands:
+  p rules               — list all shipped rule packs with per-language sinks
+  p rules --validate    — validate all rule packs (semgrep, bandit, presence)
+  p rules --which <id>  — map a finding control id back to its rule pack
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from pathlib import Path
+
+from rich.console import Console
+from rich.table import Table
+
+_log = logging.getLogger("patchi.cli.commands.rules_cmd")
+
+
+
+def run(args) -> None:
+    con = Console()
+    root = Path.cwd()
+
+    if getattr(args, "validate", False):
+        _validate_rules(root, con)
+        return
+
+    which_id = getattr(args, "which", None)
+    if which_id:
+        _which_rule(root, con, which_id)
+        return
+
+    _list_rules(root, con)
+
+
+def _find_rules_dir(root: Path) -> Path | None:
+    """Find the rules directory (could be in patchi/ or rules/)."""
+    candidates = [
+        root / "patchi" / "core" / "security" / "rules",
+        root / "rules",
+        root / "patchi" / "rules",
+    ]
+    for c in candidates:
+        if c.is_dir():
+            return c
+    return None
+
+
+def _list_rules(root: Path, con: Console) -> None:
+    """List all rule packs."""
+    rules_dir = _find_rules_dir(root)
+    if not rules_dir:
+        con.print("[yellow]No rules directory found. Rule packs are embedded in agents.[/yellow]")
+        _list_agent_patterns(root, con)
+        return
+
+    con.print(f"\n[bold]Rule Packs[/bold] — {rules_dir}\n")
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("Pack", width=24)
+    table.add_column("Language", width=12)
+    table.add_column("Rules", justify="right", width=6)
+    table.add_column("Sinks", max_width=40)
+
+    for pack_file in sorted(rules_dir.glob("*.yaml")):
+        try:
+            import yaml
+
+            data = yaml.safe_load(pack_file.read_text(encoding="utf-8"))
+            name = data.get("name", pack_file.stem)
+            lang = data.get("language", "all")
+            rules = data.get("rules", [])
+            sinks = []
+            for rule in rules:
+                sinks.extend(rule.get("sinks", [])[:3])
+            table.add_row(
+                name,
+                lang,
+                str(len(rules)),
+                ", ".join(sinks[:5]) or "(pattern-based)",
+            )
+        except Exception:
+            table.add_row(pack_file.stem, "?", "?", "(parse error)")
+
+    con.print(table)
+
+    # Also show semgrep rules if present
+    semgrep_dir = rules_dir / "semgrep"
+    if semgrep_dir.is_dir():
+        count = len(list(semgrep_dir.glob("*.yaml")))
+        if count:
+            con.print(f"\n  [dim]Semgrep rules: {count} files in {semgrep_dir}[/dim]")
+
+    # Bandit config
+    bandit_cfg = root / ".bandit" if (root / ".bandit").exists() else None
+    if bandit_cfg:
+        con.print(f"  [dim]Bandit config: {bandit_cfg}[/dim]")
+
+
+def _list_agent_patterns(root: Path, con: Console) -> None:
+    """List pattern-based detection from agents."""
+    con.print("\n[bold]Agent Detection Patterns[/bold]\n")
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("Agent", width=24)
+    table.add_column("Group", width=12)
+    table.add_column("Detection", max_width=50)
+
+    try:
+        from patchi.core.agents.base import AgentGroup, list_agents
+
+        agents = list_agents(AgentGroup.SECURITY)
+        for agent_cls in agents:
+            table.add_row(
+                agent_cls.name,
+                "security",
+                agent_cls.description[:50] if hasattr(agent_cls, "description") else "",
+            )
+    except Exception:
+        con.print("[dim]Could not enumerate agents[/dim]")
+
+    con.print(table)
+
+
+def _validate_rules(root: Path, con: Console) -> None:
+    """Validate all rule packs."""
+    con.print("\n[bold]Validating Rule Packs[/bold]\n")
+
+    # Try the existing validator
+    validator_path = root / "tools" / "validate_rule_packs.py"
+    if validator_path.exists():
+        con.print(f"  Running: python {validator_path}")
+        import subprocess
+
+        result = subprocess.run(
+            ["python", str(validator_path)],
+            capture_output=True,
+            text=True,
+            timeout=60,
+            cwd=str(root),
+        )
+        con.print(result.stdout)
+        if result.returncode != 0:
+            con.print(f"[red]Validation failed (exit {result.returncode})[/red]")
+            if result.stderr:
+                con.print(f"[dim]{result.stderr[:500]}[/dim]")
+        else:
+            con.print("[green]All rule packs valid[/green]")
+        return
+
+    # Manual validation
+    rules_dir = _find_rules_dir(root)
+    if not rules_dir:
+        con.print("[yellow]No rules directory found.[/yellow]")
+        return
+
+    errors = 0
+    for pack_file in sorted(rules_dir.glob("*.yaml")):
+        try:
+            import yaml
+
+            data = yaml.safe_load(pack_file.read_text(encoding="utf-8"))
+            if not isinstance(data, dict):
+                con.print(f"  [red]✗ {pack_file.name}: not a dict[/red]")
+                errors += 1
+                continue
+            rules = data.get("rules", [])
+            for rule in rules:
+                if not rule.get("id"):
+                    con.print(f"  [red]✗ {pack_file.name}: rule missing 'id'[/red]")
+                    errors += 1
+        except Exception as e:
+            con.print(f"  [red]✗ {pack_file.name}: {e}[/red]")
+            errors += 1
+
+    if errors == 0:
+        con.print("[green]All rule packs valid[/green]")
+    else:
+        con.print(f"\n[red]{errors} error(s) found[/red]")
+
+
+def _which_rule(root: Path, con: Console, finding_id: str) -> None:
+    """Map a finding control id to its rule pack and keywords."""
+    con.print(f"\n[bold]Rule Lookup: {finding_id}[/bold]\n")
+
+    # Search in all YAML rule packs
+    rules_dir = _find_rules_dir(root)
+    if rules_dir:
+        for pack_file in sorted(rules_dir.rglob("*.yaml")):
+            try:
+                import yaml
+
+                data = yaml.safe_load(pack_file.read_text(encoding="utf-8"))
+                rules = data.get("rules", []) if isinstance(data, dict) else []
+                for rule in rules:
+                    rid = rule.get("id", "")
+                    if finding_id.upper() in rid.upper():
+                        con.print(f"  [green]Found in:[/green] {pack_file.name}")
+                        con.print(f"    Rule ID: {rid}")
+                        con.print(f"    Message: {rule.get('message', '')[:100]}")
+                        sinks = rule.get("sinks", [])
+                        if sinks:
+                            con.print(f"    Sinks: {', '.join(sinks[:10])}")
+                        keywords = rule.get("keywords", [])
+                        if keywords:
+                            con.print(f"    Keywords: {', '.join(keywords[:10])}")
+                        severity = rule.get("severity", "")
+                        if severity:
+                            con.print(f"    Severity: {severity}")
+                        con.print()
+            except Exception:
+                continue
+
+    # Also search in agent pattern loaders
+    try:
+        from patchi.core.security.pattern_loader import load_patterns
+
+        patterns = load_patterns()
+        for section, rules in patterns.items():
+            if isinstance(rules, list):
+                for rule in rules:
+                    if isinstance(rule, dict):
+                        rid = rule.get("id", rule.get("name", ""))
+                        if finding_id.upper() in str(rid).upper():
+                            con.print(f"  [green]Found in patterns:[/green] {section}")
+                            con.print(f"    {json.dumps(rule, indent=2)[:300]}")
+                            con.print()
+    except Exception as _exc:
+        _log.warning('_which_rule failed: %s', _exc)
+
+    con.print("[dim]Search complete.[/dim]")