patchi 0.7.5__py3-none-any.whl

patchi/core/agents/run_agent.py

@@ -0,0 +1,106 @@
+"""
+RunAgent — starts the target app after P-Check green, for Test/Attack.
+
+Chain: Check (Install/Build/Format) → green READY_TO_SERVE → Run (AppLauncher) → Test/Attack
+Test/Attack agents rely on Run, Run relies on Check.
+
+This agent is always run anytime a Test or Attack agent is queued.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Severity,
+    make_finding,
+    register,
+)
+
+_log = logging.getLogger("patchi.agents.run")
+
+
+@register
+class RunAgent(BaseAgent):
+    group = AgentGroup.SCANNER
+    name = "RunAgent"
+    description = "Run — start app on free port after P-Check green (test/attack dependency)"
+    timeout = 90
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # Gate: Check must be green
+        try:
+            from patchi.core.testing.gate import require_ready
+
+            ready, url, st = require_ready(inp.root)
+            if not ready:
+                from patchi.core.testing.gate import gate_message
+
+                msg = gate_message(st)
+                result.status = AgentStatus.SKIPPED
+                result.data["gate_blocked"] = True
+                result.data["gate_reason"] = msg
+                result.add_finding(
+                    make_finding(
+                        severity=Severity.INFO,
+                        file="",
+                        line_start=0,
+                        title="Run skipped — P-Check not READY_TO_SERVE",
+                        description=msg,
+                        finding_type="run_gate_blocked",
+                    )
+                )
+                return
+        except Exception as exc:  # noqa: BLE001
+            _log.debug("run gate check failed: %s", exc)
+
+        # Start app
+        try:
+            from patchi.core.testing.app_launcher import ensure_running
+
+            # Reuse if already running
+            url = ensure_running(inp.root, inp.config, inp.extra)
+            if url:
+                result.status = AgentStatus.SUCCEEDED
+                result.data["base_url"] = url
+                result.data["url"] = url
+                result.add_finding(
+                    make_finding(
+                        severity=Severity.INFO,
+                        file="",
+                        line_start=0,
+                        title=f"App running at {url}",
+                        description=f"RunAgent started target app at {url} (P-Check was green)",
+                        finding_type="app_running",
+                    )
+                )
+            else:
+                result.status = AgentStatus.FAILED
+                result.add_finding(
+                    make_finding(
+                        severity=Severity.HIGH,
+                        file="",
+                        line_start=0,
+                        title="Run failed — could not start app",
+                        description="AppLauncher ensure_running returned None — check .patchi/launcher/app.log and start command",
+                        finding_type="run_failed",
+                    )
+                )
+        except Exception as exc:  # noqa: BLE001
+            _log.warning("RunAgent failed: %s", exc)
+            result.status = AgentStatus.FAILED
+            result.add_finding(
+                make_finding(
+                    severity=Severity.HIGH,
+                    file="",
+                    line_start=0,
+                    title="Run exception",
+                    description=str(exc)[:300],
+                    finding_type="run_exception",
+                )
+            )

patchi/core/agents/rust_unwrap_agent.py

@@ -0,0 +1,100 @@
+"""
+RustUnwrapAgent §8.2.4 — clippy style unwrap/expect audit.
+
+Finds .unwrap() / .expect() without descriptive message, suggests ?, expect("msg") or pattern match.
+Optionally runs `cargo clippy -- -W clippy::unwrap_used` if cargo available.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+import shutil
+import subprocess
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Severity,
+    make_finding,
+    register,
+    safe_rglob,
+)
+
+_log = logging.getLogger("patchi.agents.rust_unwrap")
+
+_UNWRAP_RE = re.compile(r"\.unwrap\(\)")
+_EXPECT_RE = re.compile(r"\.expect\(\s*\"\"|\.expect\(\s*''|\\.expect\(\s*\)")
+
+
+@register
+class RustUnwrapAgent(BaseAgent):
+    group = AgentGroup.SCANNER
+    name = "RustUnwrapAgent"
+    description = "Rust unwrap()/expect() audit §8.2.4 — clippy unwrap_used"
+    timeout = 60
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # Try clippy
+        if shutil.which("cargo"):
+            try:
+                proc = subprocess.run(
+                    ["cargo", "clippy", "--", "-W", "clippy::unwrap_used", "-W", "clippy::expect_used"],
+                    capture_output=True,
+                    text=True,
+                    timeout=30,
+                    cwd=str(inp.root),
+                )
+                for line in (proc.stderr + proc.stdout).splitlines():
+                    if "unwrap_used" in line or "expect_used" in line:
+                        # clippy: file:line:col: warning: used `unwrap()`...
+                        m = re.match(r"([^:]+):(\d+):\d+:\s*warning:\s*(.*)", line)
+                        if m:
+                            result.add_finding(
+                                make_finding(
+                                    severity=Severity.LOW,
+                                    file=m.group(1),
+                                    line_start=int(m.group(2)),
+                                    title="clippy::unwrap_used",
+                                    description=m.group(3).strip()[:200],
+                                    finding_type="rust_unwrap",
+                                )
+                            )
+            except Exception as exc:  # noqa: BLE001
+                _log.debug("clippy failed: %s", exc)
+
+        for fp in safe_rglob(inp.root, "*.rs"):
+            rel = fp.relative_to(inp.root).as_posix()
+            try:
+                txt = fp.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            for i, line in enumerate(txt.splitlines(), 1):
+                if _UNWRAP_RE.search(line):
+                    result.add_finding(
+                        make_finding(
+                            severity=Severity.LOW,
+                            file=rel,
+                            line_start=i,
+                            title="Unsafe .unwrap() — panics on Err/None",
+                            description="Prefer `?`, `unwrap_or`, or `.expect(\"context\")` with message. Clippy: unwrap_used.",
+                            evidence=line.strip()[:120],
+                            finding_type="rust_unwrap",
+                        )
+                    )
+                elif _EXPECT_RE.search(line):
+                    result.add_finding(
+                        make_finding(
+                            severity=Severity.LOW,
+                            file=rel,
+                            line_start=i,
+                            title="Empty .expect(\"\") — no context",
+                            description="`.expect(\"\")` gives no diagnostic; use descriptive message.",
+                            evidence=line.strip()[:120],
+                            finding_type="rust_expect_empty",
+                        )
+                    )
+        result.status = AgentStatus.SUCCEEDED

patchi/core/agents/sbom_generator.py

@@ -0,0 +1,284 @@
+"""SBOMGeneratorAgent — generates CycloneDX/SPDX Software Bill of Materials.
+
+Covers §11.5:
+- Parse dependency manifests (package.json, requirements.txt, Cargo.toml, go.mod, Gemfile, etc.)
+- Generate CycloneDX 1.5-compatible JSON output
+- Write to .patchi/sbom.cdx.json
+
+Language-agnostic: supports npm, pip, cargo, go, bundler, composer ecosystems.
+"""
+from __future__ import annotations
+
+import json
+import logging
+import re
+from datetime import UTC, datetime
+from pathlib import Path
+from uuid import uuid4
+
+from .base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Severity,
+    make_finding,
+    register,
+    safe_rglob,
+)
+
+_ECOSYSTEM_MAP = {
+    "package.json": ("npm", "JavaScript"),
+    "requirements.txt": ("pypi", "Python"),
+    "pyproject.toml": ("pypi", "Python"),
+    "Pipfile": ("pypi", "Python"),
+    "poetry.lock": ("pypi", "Python"),
+    "Cargo.toml": ("crates", "Rust"),
+    "Cargo.lock": ("crates", "Rust"),
+    "go.mod": ("go", "Go"),
+    "go.sum": ("go", "Go"),
+    "Gemfile": ("gem", "Ruby"),
+    "Gemfile.lock": ("gem", "Ruby"),
+    "composer.json": ("composer", "PHP"),
+    "yarn.lock": ("npm", "JavaScript"),
+    "pnpm-lock.yaml": ("npm", "JavaScript"),
+}
+
+_COMPONENT_TYPES = {
+    "npm": "library",
+    "pypi": "library",
+    "crates": "library",
+    "go": "library",
+    "gem": "library",
+    "composer": "library",
+}
+
+
+_log = logging.getLogger("patchi.agents.sbom_generator")
+
+
+def _parse_deps(fp: Path) -> list[dict]:
+    deps: list[dict] = []
+    try:
+        content = fp.read_text(encoding="utf-8")
+    except Exception as e:
+        _log.warning("_parse_deps failed: %s", e)
+        return deps
+
+    if fp.name == "package.json":
+        try:
+            data = json.loads(content)
+            all_deps = {**data.get("dependencies", {}), **data.get("devDependencies", {})}
+            for name, ver in all_deps.items():
+                deps.append({"name": name, "version": ver.lstrip("^~>=<")})
+        except json.JSONDecodeError:
+            pass
+    elif fp.name == "requirements.txt":
+        for line in content.splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or line.startswith("-"):
+                continue
+            for sep in ["==", ">=", "<="]:
+                if sep in line:
+                    name, ver = line.split(sep, 1)
+                    deps.append({"name": name.strip(), "version": ver.strip()})
+                    break
+            else:
+                deps.append({"name": line, "version": "unknown"})
+    elif fp.name == "Cargo.toml":
+        in_deps = False
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("[dependencies]") or stripped.startswith("[dev-dependencies]"):
+                in_deps = True
+                continue
+            if stripped.startswith("[") and in_deps:
+                in_deps = False
+            if in_deps and "=" in stripped:
+                m = re.match(r"(\w[\w\-_]*)", stripped)
+                if m:
+                    name = m.group(1)
+                    ver_part = stripped[len(name) :].strip("= ").strip('"')
+                    deps.append({"name": name, "version": ver_part})
+    elif fp.name == "pyproject.toml":
+        in_deps = False
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("dependencies = ["):
+                in_deps = True
+                continue
+            if in_deps:
+                if stripped == "]":
+                    in_deps = False
+                else:
+                    m = re.match(r'["\']([^"\'>]+?)([>=<~!]+)([^"\']+)["\'],?', stripped)
+                    if m:
+                        deps.append({"name": m.group(1), "version": m.group(3)})
+    elif fp.name == "go.mod":
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("require ") or stripped.startswith("\trequire "):
+                parts = stripped.replace("require ", "").split()
+                if len(parts) >= 2:
+                    deps.append({"name": parts[0], "version": parts[1]})
+    return deps
+
+
+def _build_cyclonedx(
+    root: Path,
+    deps_by_eco: dict[str, list[dict]],
+) -> dict:
+    components: list[dict] = []
+    for eco, dep_list in deps_by_eco.items():
+        comp_type = _COMPONENT_TYPES.get(eco, "library")
+        for dep in dep_list:
+            components.append(
+                {
+                    "type": comp_type,
+                    "name": dep["name"],
+                    "version": dep["version"],
+                    "purl": f"pkg:{eco}/{dep['name']}@{dep['version']}",
+                    "bom-ref": f"pkg:{eco}/{dep['name']}@{dep['version']}",
+                }
+            )
+
+    return {
+        "bomFormat": "CycloneDX",
+        "specVersion": "1.5",
+        "serialNumber": f"urn:uuid:{uuid4().hex}",
+        "version": 1,
+        "metadata": {
+            "timestamp": datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "tools": [{"name": "Patchi", "version": "1.0"}],
+            "component": {
+                "type": "application",
+                "name": root.name,
+            },
+        },
+        "components": components,
+    }
+
+
+@register
+class SBOMGeneratorAgent(BaseAgent):
+    """Generates CycloneDX Software Bill of Materials from dependency manifests."""
+
+    group = AgentGroup.SCANNER
+    name = "SBOMGeneratorAgent"
+    description = "Generate CycloneDX SBOM from package.json, requirements.txt, Cargo.toml, go.mod, Gemfile, etc."
+
+    def _try_external(self, inp: AgentInput) -> dict | None:
+        """Try cdxgen then syft as subprocess — 20+ ecos depth, fail-open to internal parser."""
+        import shutil
+        import subprocess as _sp
+
+        # cdxgen: npx @cyclonedx/cdxgen -o /tmp/sbom.json
+        for cmd in (
+            ["npx", "--yes", "@cyclonedx/cdxgen", "-o", str(inp.root / ".patchi" / "sbom.cdxgen.json"), "--no-recurse"],
+            ["syft", str(inp.root), "-o", "cyclonedx-json"],
+        ):
+            if not shutil.which(cmd[0]):
+                continue
+            try:
+                proc = _sp.run(cmd, capture_output=True, text=True, timeout=120, cwd=str(inp.root))
+                out = proc.stdout.strip()
+                # cdxgen writes file, syft prints json
+                cand = inp.root / ".patchi" / "sbom.cdxgen.json"
+                if cand.exists():
+                    return json.loads(cand.read_text(encoding="utf-8"))
+                if out and out.startswith("{"):
+                    return json.loads(out)
+            except Exception as e:
+                _log.debug("SBOM external %s failed: %s", cmd[0], e)
+        return None
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # Try external depth first
+        ext = self._try_external(inp)
+        if ext and ext.get("components"):
+            sbom = ext
+            total = len(ext.get("components", []))
+            sbom_dir = inp.root / ".patchi"
+            sbom_dir.mkdir(parents=True, exist_ok=True)
+            sbom_path = sbom_dir / "sbom.cdx.json"
+            try:
+                sbom_path.write_text(json.dumps(sbom, indent=2), encoding="utf-8")
+                result.findings.append(
+                    make_finding(
+                        self.name, "sbom_generated", Severity.INFO, str(sbom_path.relative_to(inp.root)), f"SBOM (external) {total} components"
+                    )
+                )
+            except Exception as e:
+                result.add_error(f"Failed to write SBOM: {e}")
+            result.data["sbom_path"] = str(sbom_path)
+            result.data["total_components"] = total
+            result.data["ecosystems"] = ["external"]
+            result.data["sbom"] = sbom
+            result.data["external"] = True
+            result.status = AgentStatus.DONE
+            return
+
+        deps_by_eco: dict[str, list[dict]] = {}
+        files_scanned = 0
+
+        for manifest in _ECOSYSTEM_MAP:
+            for fp in safe_rglob(inp.root, manifest):
+                rel = fp.relative_to(inp.root).as_posix()
+                eco, _ = _ECOSYSTEM_MAP[manifest]
+                deps = _parse_deps(fp)
+                if deps:
+                    deps_by_eco.setdefault(eco, []).extend(deps)
+                    result.findings.append(
+                        make_finding(
+                            self.name,
+                            "sbom_source",
+                            Severity.INFO,
+                            rel,
+                            f"SBOM source: {rel} ({len(deps)} deps)",
+                        )
+                    )
+                    files_scanned += 1
+
+        if not deps_by_eco:
+            result.findings.append(
+                make_finding(
+                    self.name,
+                    "no_sbom_sources",
+                    Severity.INFO,
+                    "",
+                    "No dependency manifests found — cannot generate SBOM",
+                )
+            )
+            result.status = AgentStatus.DONE
+            return
+
+        sbom = _build_cyclonedx(inp.root, deps_by_eco)
+        total_deps = sum(len(d) for d in deps_by_eco.values())
+
+        # Write SBOM to .patchi/ directory
+        sbom_dir = inp.root / ".patchi"
+        sbom_dir.mkdir(parents=True, exist_ok=True)
+        sbom_path = sbom_dir / "sbom.cdx.json"
+        try:
+            sbom_path.write_text(json.dumps(sbom, indent=2), encoding="utf-8")
+            result.findings.append(
+                make_finding(
+                    self.name,
+                    "sbom_generated",
+                    Severity.INFO,
+                    str(sbom_path.relative_to(inp.root)),
+                    f"SBOM generated: {total_deps} components across {len(deps_by_eco)} ecosystems",
+                    detail=str(sbom_path),
+                )
+            )
+        except Exception as e:
+            result.add_error(f"Failed to write SBOM: {e}")
+
+        result.data["sbom_path"] = str(sbom_path)
+        result.data["total_components"] = total_deps
+        result.data["ecosystems"] = list(deps_by_eco.keys())
+        result.data["sbom"] = sbom
+        result.files_scanned = files_scanned
+        if result.status == AgentStatus.RUNNING:
+            result.status = AgentStatus.DONE

patchi/core/agents/scanners.py

@@ -0,0 +1,67 @@
+"""
+All 20 scanner agents for Patchi.
+
+This file has been split into separate modules for better maintainability:
+- core_scanner.py
+- side_file_scanner.py
+- ui_scanner.py
+- dependency_scanner.py
+- test_scanner.py
+- dead_code_scanner.py
+- env_scanner.py
+- route_graph_scanner.py
+- type_scanner.py
+- comment_scanner.py
+- duplicate_scanner.py
+
+Each agent inherits BaseAgent, implements _run(), and is registered
+via the @register decorator so the coordinator can find it by name.
+"""
+
+from __future__ import annotations
+
+from .base import register
+from .build_tool_validator import BuildToolValidatorAgent
+from .cicd_generator import CICDGeneratorAgent
+from .comment_scanner import CommentScanner
+from .core_scanner import CoreScanner
+from .coverage_prioritizer import CoveragePrioritizerAgent
+from .dead_code_hygiene import DeadCodeHygieneAgent
+from .dead_code_scanner import DeadCodeScanner
+from .dependency_scanner import DependencyScanner
+from .duplicate_scanner import DuplicateScanner
+from .env_scanner import EnvScanner
+from .license_compliance import LicenseComplianceAgent
+from .refactoring_agent import RefactoringAgent
+from .route_graph_scanner import RouteGraphScanner
+from .sbom_generator import SBOMGeneratorAgent
+from .side_file_scanner import SideFileScanner
+from .snapshot_drift_detector import SnapshotDriftDetectorAgent
+from .spa_route_inventory import SPARouteInventoryAgent
+from .test_scanner import TestScanner
+from .type_scanner import TypeScanner
+from .ui_scanner import UIScanner
+
+__all__ = [
+    "CoreScanner",
+    "SideFileScanner",
+    "UIScanner",
+    "DependencyScanner",
+    "TestScanner",
+    "DeadCodeScanner",
+    "DeadCodeHygieneAgent",
+    "RefactoringAgent",
+    "SBOMGeneratorAgent",
+    "CICDGeneratorAgent",
+    "SPARouteInventoryAgent",
+    "CoveragePrioritizerAgent",
+    "BuildToolValidatorAgent",
+    "LicenseComplianceAgent",
+    "SnapshotDriftDetectorAgent",
+    "EnvScanner",
+    "RouteGraphScanner",
+    "TypeScanner",
+    "CommentScanner",
+    "DuplicateScanner",
+    "register",
+]

patchi/core/agents/side/__init__.py

@@ -0,0 +1 @@
+"""Side agents — preflight install/build/format before app run."""

patchi/core/agents/side/build_agent.py

@@ -0,0 +1,65 @@
+"""BuildAgent §p check — npm run build / tsc --noEmit / cargo check."""
+
+from __future__ import annotations
+
+import logging
+import shutil
+import subprocess
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Severity,
+    make_finding,
+    register,
+)
+
+_log = logging.getLogger("patchi.agents.side.build")
+
+@register
+class BuildAgent(BaseAgent):
+    group = AgentGroup.SCANNER
+    name = "BuildAgent"
+    description = "Build check before app run"
+    timeout = 120
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        root = inp.root
+        findings = []
+        logs = []
+        cmds = []
+        if (root / "package.json").exists():
+            try:
+                import json
+
+                pkg = json.loads((root / "package.json").read_text(encoding="utf-8"))
+                if "build" in pkg.get("scripts", {}):
+                    cmds.append((["npm", "run", "build"], "package.json"))
+                if (root / "tsconfig.json").exists() and shutil.which("npx"):
+                    cmds.append((["npx", "tsc", "--noEmit"], "tsconfig.json"))
+            except Exception as exc:  # noqa: BLE001
+                _log.debug("build pkg read failed: %s", exc)
+        if (root / "Cargo.toml").exists() and shutil.which("cargo"):
+            cmds.append((["cargo", "check"], "Cargo.toml"))
+        for cmd, file in cmds:
+            if not shutil.which(cmd[0]):
+                continue
+            try:
+                proc = subprocess.run(cmd, capture_output=True, text=True, timeout=60, cwd=str(root))
+                logs.append(f"$ {' '.join(cmd)}\n{proc.stdout[:500]}{proc.stderr[:500]}")
+                if proc.returncode != 0:
+                    findings.append(make_finding(severity=Severity.HIGH, file=file, line_start=0, title=f"Build failed: {' '.join(cmd)}", description=(proc.stdout + proc.stderr)[:600], finding_type="build_failed"))
+            except Exception as exc:  # noqa: BLE001
+                _log.debug("build %s failed: %s", cmd, exc)
+        result.status = AgentStatus.SUCCEEDED
+        result.findings = findings
+        result.data["build_logs"] = logs[:4]
+        out = root / ".patchi" / "launcher" / "build.log"
+        out.parent.mkdir(parents=True, exist_ok=True)
+        try:
+            out.write_text("\n".join(logs)[:8000], encoding="utf-8")
+        except OSError:
+            pass

patchi/core/agents/side/format_agent.py

@@ -0,0 +1,50 @@
+"""FormatAgent §p check — ruff / eslint / prettier --check."""
+
+from __future__ import annotations
+
+import logging
+import shutil
+import subprocess
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Severity,
+    make_finding,
+    register,
+)
+
+_log = logging.getLogger("patchi.agents.side.format")
+
+@register
+class FormatAgent(BaseAgent):
+    group = AgentGroup.SCANNER
+    name = "FormatAgent"
+    description = "Format check before app run"
+    timeout = 60
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        root = inp.root
+        findings = []
+        checks = [
+            (["ruff", "check", "."], "ruff"),
+            (["npx", "eslint", ".", "--max-warnings", "0"], "eslint"),
+            (["npx", "prettier", "--check", "."], "prettier"),
+        ]
+        for cmd, name in checks:
+            if not shutil.which(cmd[0]):
+                continue
+            try:
+                proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30, cwd=str(root))
+                if proc.returncode != 0 and proc.stdout.strip():
+                    # only first 3 lines to avoid flood
+                    snippet = "\n".join(proc.stdout.splitlines()[:3])[:400]
+                    findings.append(make_finding(severity=Severity.LOW, file="", line_start=0, title=f"Format: {name} failed", description=snippet, finding_type="format_error"))
+                    break  # one format failure enough
+            except Exception as exc:  # noqa: BLE001
+                _log.debug("format %s failed: %s", name, exc)
+        result.status = AgentStatus.SUCCEEDED
+        result.findings = findings