patchi 0.7.5__py3-none-any.whl

patchi/core/agents/cicd_generator.py

@@ -0,0 +1,240 @@
+"""CICDGeneratorAgent — generates CI/CD configs and pre-commit hooks.
+
+Covers §10.1.1-4:
+- Pre-commit hook config (.pre-commit-config.yaml)
+- GitHub Actions workflow
+- GitLab CI template
+- Branch protection gate suggestions
+"""
+
+from __future__ import annotations
+
+from .base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Severity,
+    make_finding,
+    register,
+)
+
+_PRE_COMMIT_CONFIG = """# Auto-generated by Patchi — pre-commit hooks for instant feedback
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+      - id: check-added-large-files
+      - id: detect-private-key
+
+  - repo: local
+    hooks:
+      - id: patchi-sast
+        name: Patchi fast SAST (Bandit + Semgrep)
+        entry: python -m patchi.core.security.sast_gate
+        language: system
+        types: [python]
+        pass_filenames: true
+      - id: patchi-scan
+        name: Patchi scan
+        entry: patchi scan --staged
+        language: system
+        pass_filenames: false
+"""
+
+_GITHUB_ACTIONS_WORKFLOW = """# Auto-generated by Patchi — CI workflow with explicit SAST tools
+name: Patchi Security
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+jobs:
+  sast:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install SAST tools
+        run: pip install bandit semgrep
+
+      - name: Bandit (SARIF)
+        run: bandit -r . -f sarif -o bandit.sarif || true
+
+      - name: Semgrep (SARIF)
+        run: semgrep --sarif --config auto --output semgrep.sarif || true
+
+      - name: Patchi consensus scan
+        run: patchi scan --sarif .patchi/output.sarif || true
+
+      - name: Upload Bandit SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: bandit.sarif
+          category: bandit
+
+      - name: Upload Semgrep SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep
+
+      - name: Upload Patchi SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: .patchi/output.sarif
+          category: patchi
+
+  codeql:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+"""
+
+_GITLAB_CI_TEMPLATE = """# Auto-generated by Patchi — GitLab CI template with explicit SAST tools
+stages:
+  - analyze
+
+bandit:
+  stage: analyze
+  image: python:3.11-slim
+  before_script:
+    - pip install bandit
+  script:
+    - bandit -r . -f json -o bandit.json || true
+  artifacts:
+    reports:
+      sast: bandit.json
+
+semgrep:
+  stage: analyze
+  image: python:3.11-slim
+  before_script:
+    - pip install semgrep
+  script:
+    - semgrep --json --config auto --output semgrep.json || true
+  artifacts:
+    reports:
+      sast: semgrep.json
+
+patchi-scan:
+  stage: analyze
+  image: python:3.11-slim
+  before_script:
+    - pip install patchi
+  script:
+    - patchi scan
+  artifacts:
+    reports:
+      code_quality: .patchi/output.sarif
+"""
+
+
+@register
+class CICDGeneratorAgent(BaseAgent):
+    """Generates CI/CD configs: pre-commit hooks, GitHub Actions, GitLab CI, branch protection."""
+
+    group = AgentGroup.GUARD
+    name = "CICDGeneratorAgent"
+    description = (
+        "Generate .pre-commit-config.yaml, GitHub Actions, GitLab CI, and branch protection gates"
+    )
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        existing_precommit = inp.root / ".pre-commit-config.yaml"
+        existing_github = inp.root / ".github" / "workflows" / "patchi-ci.yml"
+        existing_gitlab = inp.root / ".gitlab-ci.yml"
+
+        result.data["generated"] = []
+
+        if not existing_precommit.exists():
+            result.data["generated"].append(".pre-commit-config.yaml")
+            result.findings.append(
+                make_finding(
+                    self.name,
+                    "precommit_config",
+                    Severity.INFO,
+                    ".pre-commit-config.yaml",
+                    "Generate pre-commit hook config for instant feedback",
+                    detail=_PRE_COMMIT_CONFIG[:200],
+                    suggestion="Run `patchi fix` to write this file",
+                )
+            )
+
+        if not existing_github.exists():
+            result.data["generated"].append(".github/workflows/patchi-ci.yml")
+            result.findings.append(
+                make_finding(
+                    self.name,
+                    "github_actions_workflow",
+                    Severity.INFO,
+                    ".github/workflows/patchi-ci.yml",
+                    "Generate GitHub Actions workflow for CI",
+                    detail=_GITHUB_ACTIONS_WORKFLOW[:200],
+                    suggestion="Run `patchi fix` to write this file",
+                )
+            )
+
+        if not existing_gitlab.exists():
+            result.data["generated"].append(".gitlab-ci.yml")
+            result.findings.append(
+                make_finding(
+                    self.name,
+                    "gitlab_ci_template",
+                    Severity.INFO,
+                    ".gitlab-ci.yml",
+                    "Generate GitLab CI template for CI",
+                    detail=_GITLAB_CI_TEMPLATE[:200],
+                    suggestion="Run `patchi fix` to write this file",
+                )
+            )
+
+        # Branch protection gates check
+        has_branch_protection = False
+        for conf in ["CODEOWNERS", ".github/CODEOWNERS", "CODEOWNERS.txt"]:
+            if (inp.root / conf).exists():
+                has_branch_protection = True
+                break
+
+        if not has_branch_protection:
+            result.findings.append(
+                make_finding(
+                    self.name,
+                    "branch_protection",
+                    Severity.MEDIUM,
+                    "",
+                    "No branch protection or CODEOWNERS detected",
+                    detail="Set up branch protection rules requiring Patchi to pass before merge",
+                    suggestion="Configure branch protection in GitHub/GitLab settings",
+                )
+            )
+
+        result.data["templates"] = {
+            "precommit": _PRE_COMMIT_CONFIG,
+            "github_actions": _GITHUB_ACTIONS_WORKFLOW,
+            "gitlab_ci": _GITLAB_CI_TEMPLATE,
+        }
+
+        result.files_scanned = 3
+        if result.status == AgentStatus.RUNNING:
+            result.status = AgentStatus.DONE

patchi/core/agents/comment_scanner.py

@@ -0,0 +1,280 @@
+"""
+CommentScanner — TODO/FIXME/HACK technical debt markers.
+
+Scans for technical debt markers in comments:
+- TODO: Planned features or improvements
+- FIXME: Known issues that need fixing
+- HACK: Workarounds that should be addressed
+- XXX: Critical issues requiring attention
+- NOSONAR: SonarQube suppression markers
+- TEMP: Temporary code that needs removal
+- KLUDGE: Crude solutions that need refinement
+- BUG: Known bug markers
+- REVIEW: Code requiring review
+- OPTIMIZE: Performance improvement opportunities
+
+Does NOT call AI.
+Does NOT write to disk.
+Does NOT touch the queue.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from ..brain.languages import DEFAULT_IGNORE_DIRS, Lang, detect_language
+from .base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Finding,
+    Severity,
+    make_finding,
+    register,
+    safe_rglob,
+    scope_allows,
+)
+
+
+@register
+class CommentScanner(BaseAgent):
+    """Scanner for technical debt markers in comments."""
+
+    group = AgentGroup.SCANNER
+    name = "CommentScanner"
+    description = "TODO/FIXME/HACK technical debt markers"
+
+    # Technical debt patterns with severity levels.
+    # Comment markers are hygiene, never vulnerabilities: capped at MEDIUM
+    # (a "BUG" comment was flagging CRITICAL and drowning the gate).
+    TECH_DEBT_PATTERNS = [
+        (r"XXX\b", "XXX", Severity.MEDIUM),
+        (r"BUG\b", "BUG", Severity.MEDIUM),
+        (r"HACK\b", "HACK", Severity.MEDIUM),
+        # Important issues
+        (r"FIXME\b", "FIXME", Severity.MEDIUM),
+        (r"TODO\b", "TODO", Severity.INFO),
+        # Less urgent but still noteworthy
+        (r"REVIEW\b", "REVIEW", Severity.LOW),
+        (r"KLUDGE\b", "KLUDGE", Severity.MEDIUM),
+        (r"TEMP\b", "TEMPORARY", Severity.LOW),
+        (r"OPTIMIZE\b", "OPTIMIZE", Severity.LOW),
+        (r"NOSONAR\b", "NOSONAR", Severity.LOW),  # SonarQube suppression
+    ]
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        """Scan for technical debt markers in comments."""
+        findings = []
+
+        # Define file patterns for all supported languages
+        patterns = [
+            "*.js",
+            "*.jsx",
+            "*.ts",
+            "*.tsx",
+            "*.py",
+            "*.java",
+            "*.php",
+            "*.rb",
+            "*.go",
+            "*.rs",
+            "*.cpp",
+            "*.cxx",
+            "*.cc",
+            "*.c",
+            "*.h",
+            "*.hpp",
+            "*.cs",
+            "*.scala",
+            "*.kt",
+            "*.swift",
+            "*.dart",
+        ]
+
+        # Search for files
+        for pattern in patterns:
+            for file_path in safe_rglob(inp.root, pattern):
+                if file_path.is_file():
+                    rel_path = file_path.relative_to(inp.root).as_posix()
+                    if not scope_allows(inp, rel_path):
+                        continue
+                    if not self._should_skip_file(rel_path, inp):
+                        findings.extend(self._scan_file_comments(file_path, rel_path))
+
+        # Add summary when technical debt markers exist
+        debt_findings = [
+            f
+            for f in findings
+            if any(marker_name in f.title for _, marker_name, _ in self.TECH_DEBT_PATTERNS)
+        ]
+        if debt_findings:
+            findings.append(
+                make_finding(
+                    severity=Severity.INFO,
+                    file="__summary__",
+                    line_start=0,
+                    title=f"Technical Debt Markers Found: {len(debt_findings)}",
+                    description=f"Discovered {len(debt_findings)} technical debt markers in project",
+                    evidence=f"Markers found in {len({f.file for f in debt_findings})} files",
+                )
+            )
+
+        by_type: dict[str, int] = {}
+        for finding in debt_findings:
+            match = re.search(r"Technical Debt Marker: (\w+)", finding.title)
+            if match:
+                marker = match.group(1)
+                by_type[marker] = by_type.get(marker, 0) + 1
+
+        result.status = AgentStatus.SUCCEEDED
+        result.findings = findings
+        result.data.update(
+            {
+                "todo_count": len(
+                    [
+                        f
+                        for f in findings
+                        if f.type == "technical_debt" and "TODO" in f.message.upper()
+                    ]
+                ),
+                "fixme_count": len(
+                    [
+                        f
+                        for f in findings
+                        if f.type == "technical_debt" and "FIXME" in f.message.upper()
+                    ]
+                ),
+                "hack_count": len(
+                    [
+                        f
+                        for f in findings
+                        if f.type == "technical_debt" and "HACK" in f.message.upper()
+                    ]
+                ),
+                "bug_count": len(
+                    [
+                        f
+                        for f in findings
+                        if f.type == "technical_debt" and "BUG" in f.message.upper()
+                    ]
+                ),
+                "total_markers": len(debt_findings),
+                "by_type": by_type,
+                "needs_ai": False,
+            }
+        )
+        return
+
+    def _should_skip_file(self, file_path: str, inp: AgentInput) -> bool:
+        """Check if file should be skipped based on restrictions."""
+        # Skip ignored directories (node_modules, .venv, etc.)
+        from pathlib import PurePosixPath
+
+        if any(p in DEFAULT_IGNORE_DIRS for p in PurePosixPath(file_path).parts):
+            return True
+
+        from pathlib import PurePosixPath
+
+        # Check restrictions
+        restrictions = inp.config.get("restrictions", [])
+        for r in restrictions:
+            if r.get("enabled", True):
+                path = r["path"]
+                if file_path.startswith(path) or PurePosixPath(file_path).match(path):
+                    if r["type"] == "NO_TOUCH":
+                        return True
+                    elif r["type"] == "SCAN_ONLY" and self.__class__.__name__ == "FixAgent":
+                        return True
+        return False
+
+    def _scan_file_comments(self, file_path: Path, rel_path: str) -> list[Finding]:
+        """Scan a file for technical debt markers in comments."""
+        findings = []
+
+        try:
+            content = file_path.read_text(encoding="utf-8")
+            lines = content.splitlines()
+
+            # Different comment patterns for different languages
+            lang = detect_language(file_path)
+            comment_patterns = self._get_comment_patterns(lang)
+
+            for line_num, line in enumerate(lines, 1):
+                # Find all comment sections in the line
+                for comment_pattern in comment_patterns:
+                    comment_matches = re.finditer(comment_pattern, line)
+                    for comment_match in comment_matches:
+                        comment_text = comment_match.group(1)  # The content of the comment
+
+                        # Look for technical debt markers in the comment
+                        for pattern, marker_name, severity in self.TECH_DEBT_PATTERNS:
+                            debt_matches = re.finditer(pattern, comment_text, re.IGNORECASE)
+                            for debt_match in debt_matches:
+                                # Extract context around the marker
+                                start_idx = max(0, debt_match.start() - 20)
+                                end_idx = min(len(comment_text), debt_match.end() + 40)
+                                context = comment_text[start_idx:end_idx]
+
+                                findings.append(
+                                    make_finding(
+                                        severity=severity,
+                                        finding_type="technical_debt",
+                                        file=rel_path,
+                                        line_start=line_num,
+                                        title=f"Technical Debt Marker: {marker_name}",
+                                        description=f"Found {marker_name} marker in comment",
+                                        evidence=f"Context: {context.strip()}",
+                                    )
+                                )
+
+        except Exception as e:
+            findings.append(
+                make_finding(
+                    severity=Severity.LOW,
+                    file=rel_path,
+                    line_start=0,
+                    title="Comment file read error",
+                    description=f"Could not read file {file_path.name} for comment scanning: {str(e)}",
+                    evidence=str(e),
+                )
+            )
+
+        return findings
+
+    def _get_comment_patterns(self, lang: Lang) -> list[str]:
+        """Get appropriate comment patterns for the language."""
+        # Use a broad set of comment capture patterns for most languages.
+        return [
+            r"#(.*)$",  # Hash-style comment
+            r"//(.*)$",  # Double-slash comment
+            r"/\*(.*?)\*/",  # C-style multi-line comment
+        ]
+
+    def _get_language_extensions(self) -> dict[str, Lang]:
+        """Map file extensions to language enums."""
+        return {
+            ".js": Lang.JAVASCRIPT,
+            ".jsx": Lang.JAVASCRIPT,
+            ".ts": Lang.TYPESCRIPT,
+            ".tsx": Lang.TYPESCRIPT,
+            ".py": Lang.PYTHON,
+            ".java": Lang.JAVA,
+            ".php": Lang.PHP,
+            ".rb": Lang.RUBY,
+            ".go": Lang.GO,
+            ".rs": Lang.RUST,
+            ".cpp": Lang.CPP,
+            ".cxx": Lang.CPP,
+            ".cc": Lang.CPP,
+            ".c": Lang.C,
+            ".h": Lang.C,
+            ".hpp": Lang.CPP,
+            ".cs": Lang.C_SHARP,
+            ".scala": Lang.SCALA,
+            ".kt": Lang.KOTLIN,
+            ".swift": Lang.SWIFT,
+            ".dart": Lang.DART,
+        }

patchi/core/agents/console_logging_agent.py

@@ -0,0 +1,156 @@
+"""ConsoleLoggingAgent §p test — background console/pageerror capture.
+
+Runs automatically when `p test` is active (Group.TEST), never under `p scan`.
+Attaches Playwright console + pageerror listeners on every discovered route
+(via shared open_page helper) and tails the app launcher log, so JS runtime
+noise is captured even on pages other testers skip. Findings are console-error
+clusters; raw traces go to result.data for brain/verify.py merging.
+"""
+
+from __future__ import annotations
+
+import logging
+from collections import Counter
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Severity,
+    make_finding,
+    register,
+)
+
+_log = logging.getLogger("patchi.agents.console_logging")
+
+
+@register
+class ConsoleLoggingAgent(BaseAgent):
+    group = AgentGroup.TEST
+    name = "ConsoleLoggingAgent"
+    description = "Background console/pageerror capture across routes + app log tail"
+    timeout = 60
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        try:
+            from playwright.sync_api import sync_playwright  # noqa: F401
+        except ImportError:
+            self.skip(result, "playwright not installed — pip install playwright")
+            return
+
+        from patchi.core.testing._browser import discover_routes, find_server, open_page
+
+        base_url = find_server(inp.root, inp.config, inp.extra)
+        if not base_url:
+            self.skip(result, "no running server found — start `p web` (default :1612)")
+            return
+
+        routes = discover_routes(inp.config, inp.extra)
+        if not routes:
+            self.skip(result, "no routes discovered")
+            return
+
+        from patchi.core.brain.trace_log import trace_agent
+
+        console_errors: list[str] = []
+        page_errors: list[str] = []
+        pages_tested = 0
+        error_pages = 0
+
+        with trace_agent(self.name, root=inp.root) as trace:
+            with sync_playwright() as pw:
+                browser = pw.chromium.launch(headless=True)
+                try:
+                    for page_path in routes[:15]:
+                        ps = open_page(browser, f"{base_url}{page_path}")
+                        try:
+                            if ps.status and ps.status >= 400:
+                                error_pages += 1
+                                continue
+                            for ce in ps.console_errors:
+                                console_errors.append(f"{page_path} :: {ce[:200]}")
+                            for pe in ps.page_errors:
+                                page_errors.append(f"{page_path} :: {pe[:200]}")
+                            pages_tested += 1
+                        finally:
+                            ps.page.close()
+                finally:
+                    browser.close()
+
+            # Tail the app launcher log for server-side noise
+            app_log_lines: list[str] = []
+            log_path = inp.root / ".patchi" / "launcher" / "app.log"
+            try:
+                if log_path.exists():
+                    text = log_path.read_text(encoding="utf-8", errors="replace")
+                    app_log_lines = [ln for ln in text.splitlines() if ln.strip()][-50:]
+            except OSError as exc:
+                _log.debug("app log tail failed: %s", exc)
+
+            trace.files_scanned = pages_tested
+
+            # Cluster console errors so one noisy library = one finding
+            clusters = Counter()
+            for entry in console_errors:
+                route, _, msg = entry.partition(" :: ")
+                key = (route, msg[:80])
+                clusters[key] += 1
+            for (route, msg), count in sorted(clusters.items(), key=lambda kv: -kv[1])[:10]:
+                text = msg[:160].strip() or "empty error text"
+                result.add_finding(
+                    make_finding(
+                        agent=self.name,
+                        finding_type="console_error",
+                        severity=Severity.LOW if count == 1 else Severity.MEDIUM,
+                        file=route,
+                        message=f"Console error ×{count} on {route}: {text}",
+                    )
+                )
+            for entry in page_errors[:10]:
+                route, _, msg = entry.partition(" :: ")
+                text = msg[:160].strip() or "empty error text"
+                result.add_finding(
+                    make_finding(
+                        agent=self.name,
+                        finding_type="page_error",
+                        severity=Severity.MEDIUM,
+                        file=route,
+                        message=f"Uncaught page error on {route}: {text}",
+                    )
+                )
+            if error_pages:
+                result.add_finding(
+                    make_finding(
+                        agent=self.name,
+                        finding_type="console_error_pages",
+                        severity=Severity.HIGH,
+                        file="(all pages)",
+                        message=f"{error_pages} page(s) HTTP ≥400 — console capture skipped",
+                    )
+                )
+            if not console_errors and not page_errors and pages_tested > 0:
+                result.add_finding(
+                    make_finding(
+                        agent=self.name,
+                        finding_type="console_summary",
+                        severity=Severity.INFO,
+                        file="(all pages)",
+                        message=f"Console clean: {pages_tested} pages, 0 console/page errors",
+                    )
+                )
+
+            result.data["suite"] = {
+                "runner": "console_logging",
+                "pages_tested": pages_tested,
+                "console_errors": console_errors[:10],
+                "page_errors": page_errors[:10],
+                "error_pages": error_pages,
+                "app_log_tail": app_log_lines[-10:],
+            }
+            result.files_scanned = pages_tested
+            trace.findings = len(result.findings)
+
+        if result.status == AgentStatus.RUNNING:
+            result.status = AgentStatus.DONE