patchi 0.7.5__py3-none-any.whl

patchi/core/brain/ast_utils/taint.py

@@ -0,0 +1,310 @@
+"""
+AST utilities — source-to-sink taint tracking.
+
+Follows data flow from untrusted SOURCES (user input, request objects, env
+vars, etc.) into dangerous SINKS (SQL execution, command execution, eval,
+HTML rendering, ...) and reports a tainted call only when the value reaches a
+sink without being sanitized.
+
+The analysis is intra-procedural and best-effort: it tracks simple local
+aliasing (`x = src; sink(x)`) and string concatenation of tainted values.
+"""
+from __future__ import annotations
+
+import ast
+import logging
+
+from patchi.core.brain.languages import Lang, get_parser
+
+from .assignments import find_assignments
+from .config import CALL_NODE_TYPES
+from .helpers import child_by_field, children, node_text
+
+# Untrusted data origins
+SOURCES = {
+    "request.args",
+    "request.form",
+    "request.json",
+    "request.data",
+    "request.GET",
+    "request.POST",
+    "request.body",
+    "request.headers",
+    "request.query_params",
+    "request.path_params",
+    "request.cookies",
+    "req.query",
+    "req.body",
+    "req.params",
+    "req.headers",
+    "input",
+    "sys.argv",
+    "os.environ",
+    "os.getenv",
+    "self.request",
+    "self.params",
+    "params",
+    "query",
+    "payload",
+    "event.target",
+    "event.data",
+    "document.location",
+    "location.search",
+}
+
+# Sanitizers that neutralize common taint categories
+SANITIZERS = {
+    "escape",
+    "sanitize",
+    "html.escape",
+    "markupsafe.escape",
+    "bleach.clean",
+    "django.utils.html.escape",
+    "parameterized",
+    "prepare",
+    "quote",
+    "urlencode",
+    "encode_for_sql",
+}
+
+
+_log = logging.getLogger("patchi.brain.taint")
+
+
+def _is_source(text: str) -> bool:
+    t = text.strip()
+    return (
+        t in SOURCES
+        or any(t.startswith(s + ".") for s in SOURCES)
+        or t
+        in (
+            "request",
+            "req",
+            "input()",
+            "event",
+            "location",
+        )
+    )
+
+
+def _is_sanitized(text: str) -> bool:
+    return any(s in text for s in SANITIZERS)
+
+
+def track_taint(content: str, lang: Lang, sinks: set[str]) -> list[dict]:
+    """
+    Track tainted data from SOURCES into `sinks`.
+
+    Returns list of dicts with keys: name, line, col, full_text, tainted_via.
+    A sink call is reported when at least one of its arguments is either a
+    direct source or an alias of a source.
+    """
+    if lang == Lang.PYTHON:
+        return _track_python(content, sinks)
+    parser = get_parser(lang)
+    if not parser:
+        return []
+    try:
+        tree = parser.parse(content.encode("utf-8"))
+    except Exception as e:
+        _log.warning("track_taint failed: %s", e)
+        return []
+    call_types = CALL_NODE_TYPES.get(lang, set())
+    results: list[dict] = []
+    aliases = _collect_aliases(content, lang)
+    _walk_taint(tree.root_node, call_types, sinks, aliases, results)
+    return results
+
+
+def _collect_aliases(content: str, lang: Lang) -> dict[str, str]:
+    """Map variable name -> source text it was assigned from (one hop)."""
+    aliases: dict[str, str] = {}
+    for asg in find_assignments(content, lang):
+        target = asg.get("target", "")
+        value = asg.get("value", "")
+        if target and value and _is_source(value):
+            aliases[target.split(".")[0]] = value
+    return aliases
+
+
+def _argument_texts(call_node: object) -> list[str]:
+    arg_nodes = (
+        child_by_field(call_node, "arguments")
+        or child_by_field(call_node, "argument_list")
+        or child_by_field(call_node, "value_arguments")
+        or child_by_field(call_node, "argument_part")
+    )
+    if arg_nodes is None:
+        return []
+    out = []
+    for c in children(arg_nodes):
+        if c.type in ("(", ")", ",", "[", "]", "{", "}"):
+            continue
+        out.append(node_text(c))
+    return out
+
+
+def _walk_taint(
+    node: object,
+    call_types: set[str],
+    sinks: set[str],
+    aliases: dict[str, str],
+    results: list[dict],
+) -> None:
+    try:
+        ntype = node.type if hasattr(node, "type") else ""
+    except Exception as e:
+        _log.warning("_walk_taint failed: %s", e)
+        return
+
+    if ntype in call_types:
+        fn = _call_name(node)
+        leaf = fn.split(".")[-1] if "." in fn else fn
+        if fn in sinks or leaf in sinks:
+            arg_texts = _argument_texts(node)
+            tainted = []
+            for arg in arg_texts:
+                base = arg.split(".")[0].split("[")[0].strip()
+                if (
+                    _is_source(arg)
+                    or base in aliases
+                    or (any(s in arg for s in aliases) and not _is_sanitized(arg))
+                ):
+                    tainted.append(arg)
+            if tainted:
+                try:
+                    line = node.start_point[0] + 1 if node.start_point else 0
+                    col = node.start_point[1] if node.start_point else 0
+                except Exception as e:
+                    _log.warning("_walk_taint failed: %s", e)
+                    line, col = 0, 0
+                results.append(
+                    {
+                        "name": fn,
+                        "line": line,
+                        "col": col,
+                        "full_text": node_text(node),
+                        "tainted_via": tainted,
+                    }
+                )
+
+    for child in children(node):
+        _walk_taint(child, call_types, sinks, aliases, results)
+
+
+def _call_name(node: object) -> str:
+    fn = child_by_field(node, "function") or child_by_field(node, "name")
+    if fn is not None:
+        return node_text(fn).split("(")[0].strip()
+    parts = []
+    for child in children(node):
+        if child.type in ("argument_list", "arguments", "value_arguments", "argument_part"):
+            break
+        txt = node_text(child)
+        if txt and txt not in ("(", ")", ".", "::"):
+            parts.append(txt)
+    return ".".join(parts) if parts else ""
+
+
+def _track_python(content: str, sinks: set[str]) -> list[dict]:
+    import ast
+
+    results: list[dict] = []
+    try:
+        tree = ast.parse(content)
+    except SyntaxError:
+        return results
+
+    aliases: dict[str, str] = {}
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Assign):
+            for t in node.targets:
+                if isinstance(t, ast.Name) and isinstance(node.value, ast.Call):
+                    call = node.value
+                    if isinstance(call.func, ast.Name) and _is_source(_py_src_expr(call.func.id)):
+                        aliases[t.id] = call.func.id
+                    elif isinstance(call.func, ast.Attribute) and _is_source(
+                        _py_src_expr(_py_attr_str(call.func))
+                    ):
+                        aliases[t.id] = _py_attr_str(call.func)
+
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Call):
+            fn_str = _py_call_str(node.func)
+            leaf = fn_str.split(".")[-1]
+            if fn_str in sinks or leaf in sinks:
+                tainted = []
+                for arg in node.args:
+                    arg_str = _py_arg_str(arg)
+                    base = arg_str.split(".")[0].split("[")[0].strip()
+                    if (
+                        _is_source(arg_str)
+                        or base in aliases
+                        or (
+                            any(a in arg_str for a in aliases.values())
+                            and not _is_sanitized(arg_str)
+                        )
+                    ):
+                        tainted.append(arg_str)
+                if tainted:
+                    results.append(
+                        {
+                            "name": fn_str,
+                            "line": getattr(node, "lineno", 0),
+                            "col": getattr(node, "col_offset", 0),
+                            "full_text": _ast_text(node, content),
+                            "tainted_via": tainted,
+                        }
+                    )
+    return results
+
+
+# ── Python helpers ─────────────────────────────────────────────────────────────
+
+
+def _py_src_expr(s: str) -> str:
+    return s
+
+
+def _py_attr_str(node: ast.AST) -> str:
+    parts = []
+    cur = node
+    while isinstance(cur, ast.Attribute):
+        parts.append(cur.attr)
+        cur = cur.value
+    if isinstance(cur, ast.Name):
+        parts.append(cur.id)
+    return ".".join(reversed(parts))
+
+
+def _py_call_str(node: ast.AST) -> str:
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return _py_attr_str(node)
+    return ""
+
+
+def _py_arg_str(node: ast.AST) -> str:
+    if isinstance(node, ast.Call):
+        return _py_call_str(node.func)
+    if isinstance(node, ast.Attribute):
+        return _py_attr_str(node)
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Constant):
+        return repr(node.value)
+    if isinstance(node, ast.Subscript):
+        return _py_arg_str(node.value)
+    return _py_call_str(node) or _py_attr_str(node)
+
+
+def _ast_text(node: ast.AST, source: str) -> str:
+    try:
+        lines = source.splitlines()
+        start = getattr(node, "lineno", 1) - 1
+        end = getattr(node, "end_lineno", start + 1) - 1
+        return "\n".join(lines[start : end + 1])
+    except Exception as e:
+        _log.debug("_ast_text failed: %s", e)
+        return ""

patchi/core/brain/audit.py

@@ -0,0 +1,379 @@
+"""
+Drift Detector + Plan-vs-Built Report Card (Dream Assistant spec, priority #2).
+
+The agent (and the developer) declare *intent* — a Plan: which layers exist,
+what the charter is, what the codebase currently looks like. Later, `p audit`
+re-scans the *actual* built state and reports the gap between Plan and Built.
+
+This is deliberately additive: it snapshots the current memory (layers, charter,
+scan results) as a Plan and diffs it against the live state.
+
+Usage:
+  p audit save [--intent "..."]   — snapshot current state as the agreed Plan
+  p audit [--no-scan]             — Plan-vs-Built report card + drift
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+from datetime import UTC, datetime
+from pathlib import Path
+
+_PLAN_FILE = ".patchi/plan.json"
+
+
+_log = logging.getLogger("patchi.brain.audit")
+
+
+def _snapshot_scope(root: Path) -> dict:
+    """
+    Capture the REAL scope of the codebase: for every source file its language,
+    exported symbols (functions/classes/exports), and a content hash. This is
+    what makes the Drift Detector a true scope diff, not just a finding-count
+    proxy.
+    """
+    from patchi.core.brain.scanner import FileScanner
+
+    try:
+        fis = FileScanner(root).scan()
+    except Exception as e:
+        _log.warning("_snapshot_scope failed: %s", e)
+        return {}
+    scope: dict[str, dict] = {}
+    for fi in fis:
+        if fi.error:
+            continue
+        try:
+            data = (Path(root) / fi.path).read_bytes()
+            h = hashlib.sha256(data).hexdigest()[:16]
+        except Exception as e:
+            _log.warning("_snapshot_scope failed: %s", e)
+            h = ""
+        syms = sorted(
+            {f.name for f in fi.functions} | {c.name for c in fi.classes} | set(fi.exports)
+        )
+        scope[fi.path] = {"lang": fi.language.value, "symbols": syms, "hash": h}
+    return scope
+
+
+def _diff_scope(plan_scope: dict, cur_scope: dict) -> dict:
+    """Real file/symbol scope diff between the agreed Plan and the built state."""
+    plan_files = set(plan_scope)
+    cur_files = set(cur_scope)
+    added = sorted(cur_files - plan_files)
+    removed = sorted(plan_files - cur_files)
+    modified = []
+    for f in sorted(plan_files & cur_files):
+        p = plan_scope[f]
+        c = cur_scope[f]
+        if p.get("hash") == c.get("hash"):
+            continue
+        added_sym = sorted(set(c.get("symbols", [])) - set(p.get("symbols", [])))
+        removed_sym = sorted(set(p.get("symbols", [])) - set(c.get("symbols", [])))
+        modified.append(
+            {
+                "file": f,
+                "symbols_added": added_sym,
+                "symbols_removed": removed_sym,
+                "symbols_unchanged": sorted(set(p.get("symbols", [])) & set(c.get("symbols", []))),
+            }
+        )
+    return {
+        "added_files": added,
+        "removed_files": removed,
+        "modified_files": modified,
+        "added_count": len(added),
+        "removed_count": len(removed),
+        "modified_count": len(modified),
+    }
+
+
+def _now() -> str:
+    return datetime.now(UTC).isoformat()
+
+
+def _count_findings(result: dict) -> int:
+    """Recursively count concrete findings inside one scanner result."""
+    if not isinstance(result, dict):
+        return 0
+    total = 0
+    for key, val in result.items():
+        if key in ("timestamp", "scanned_at", "layer", "name"):
+            continue
+        if key == "findings" and isinstance(val, list):
+            total += len([f for f in val if f])
+        elif isinstance(val, list):
+            for item in val:
+                if isinstance(item, dict) and (item.get("findings") or item.get("issues")):
+                    total += len(item.get("findings") or item.get("issues") or [])
+                elif isinstance(item, dict):
+                    total += _count_findings(item)
+        elif isinstance(val, dict):
+            total += _count_findings(val)
+    return total
+
+
+def _charter_violations(scans: dict) -> int:
+    cg = scans.get("CharterGuard", {})
+    if isinstance(cg, dict):
+        return len(cg.get("findings", []) or [])
+    return 0
+
+
+def _snapshot_state(root: Path) -> dict:
+    from patchi.core import memory as mem
+
+    charter = mem.get_charter(root) or {}
+    layers = mem.get_layers(root) or {}
+    scans = mem.get_scan_results(root) or {}
+    scan_summary = {
+        name: {
+            "finding_count": _count_findings(res),
+            "timestamp": (res.get("timestamp") if isinstance(res, dict) else None),
+        }
+        for name, res in scans.items()
+    }
+    return {
+        "layers": layers,
+        "charter": charter,
+        "scan_summary": scan_summary,
+        "charter_violations": _charter_violations(scans),
+        "total_findings": sum(v["finding_count"] for v in scan_summary.values()),
+    }
+
+
+def save_plan(root: Path, intent: str | None = None) -> dict:
+    """Snapshot the current state (including real scope) as the agreed Plan."""
+    root = Path(root)
+    state = _snapshot_state(root)
+    plan = {
+        "saved_at": _now(),
+        "intent": intent or "",
+        **state,
+        "scope": _snapshot_scope(root),
+    }
+    p = root / _PLAN_FILE
+    p.parent.mkdir(parents=True, exist_ok=True)
+    tmp = p.with_suffix(".tmp")
+    tmp.write_text(json.dumps(plan, indent=2, default=str), encoding="utf-8")
+    tmp.replace(p)
+    return plan
+
+
+def load_plan(root: Path) -> dict | None:
+    p = Path(root) / _PLAN_FILE
+    if not p.exists():
+        return None
+    try:
+        return json.loads(p.read_text(encoding="utf-8"))
+    except Exception as e:
+        _log.warning("load_plan failed: %s", e)
+        return None
+
+
+def compute_drift(root: Path, scans: dict | None = None) -> dict:
+    """
+    Diff the agreed Plan against the live built state.
+
+    scans: optional injectable current scan results (for tests).
+    """
+    root = Path(root)
+    plan = load_plan(root)
+    if not plan:
+        return {"has_plan": False}
+
+    current = _snapshot_state(root) if scans is None else _summarize(scans)
+    cur_scope = _snapshot_scope(root)
+
+    plan_layers = set((plan.get("layers") or {}).keys())
+    cur_layers = set((current.get("layers") or {}).keys())
+    added = sorted(cur_layers - plan_layers)
+    removed = sorted(plan_layers - cur_layers)
+    unchanged = sorted(plan_layers & cur_layers)
+
+    scope_diff = _diff_scope(plan.get("scope", {}) or {}, cur_scope)
+
+    drift = {
+        "has_plan": True,
+        "saved_at": plan.get("saved_at"),
+        "intent": plan.get("intent", ""),
+        "layers_added": added,
+        "layers_removed": removed,
+        "layers_unchanged": unchanged,
+        "plan_total_findings": plan.get("total_findings", 0),
+        "built_total_findings": current.get("total_findings", 0),
+        "new_findings": max(0, current.get("total_findings", 0) - plan.get("total_findings", 0)),
+        "plan_charter_violations": plan.get("charter_violations", 0),
+        "built_charter_violations": current.get("charter_violations", 0),
+        "new_charter_violations": max(
+            0, current.get("charter_violations", 0) - plan.get("charter_violations", 0)
+        ),
+        "per_scanner": _diff_scanners(
+            plan.get("scan_summary", {}), current.get("scan_summary", {})
+        ),
+        "scope_diff": scope_diff,
+    }
+    drift["clean"] = (
+        not added
+        and not removed
+        and drift["new_findings"] == 0
+        and drift["new_charter_violations"] == 0
+        and scope_diff["added_count"] == 0
+        and scope_diff["removed_count"] == 0
+        and scope_diff["modified_count"] == 0
+    )
+    return drift
+
+
+def _summarize(scans: dict) -> dict:
+    scan_summary = {
+        name: {"finding_count": _count_findings(res), "timestamp": None}
+        for name, res in scans.items()
+    }
+    return {
+        "layers": {},
+        "charter": {},
+        "scan_summary": scan_summary,
+        "charter_violations": _charter_violations(scans),
+        "total_findings": sum(v["finding_count"] for v in scan_summary.values()),
+    }
+
+
+def _diff_scanners(plan_summary: dict, cur_summary: dict) -> list[dict]:
+    rows = []
+    all_names = sorted(set(plan_summary) | set(cur_summary))
+    for name in all_names:
+        plan_c = plan_summary.get(name, {}).get("finding_count", 0)
+        cur_c = cur_summary.get(name, {}).get("finding_count", 0)
+        delta = cur_c - plan_c
+        rows.append({"scanner": name, "plan": plan_c, "built": cur_c, "delta": delta})
+    return rows
+
+
+def report_card(root: Path, run_scan: bool = True) -> dict:
+    """
+    Plan-vs-Built Report Card. Re-scans (unless --no-scan) then computes drift
+    and a plain-language summary.
+    """
+    root = Path(root)
+    if run_scan:
+        try:
+            from patchi.core.brain.brain import Brain
+
+            Brain(root).scan()
+        except Exception as e:
+            _log.warning("report_card failed: %s", e)
+    drift = compute_drift(root)
+    if not drift.get("has_plan"):
+        return {"has_plan": False, "summary": "No Plan saved. Run `p audit save` first."}
+
+    lines = [f"Plan saved at {drift['saved_at']}"]
+    if drift.get("intent"):
+        lines.append(f"Intent: {drift['intent']}")
+    if drift["layers_added"]:
+        lines.append(f"  + Layers built beyond plan: {', '.join(drift['layers_added'])}")
+    if drift["layers_removed"]:
+        lines.append(f"  - Layers in plan but missing: {', '.join(drift['layers_removed'])}")
+    sd = drift.get("scope_diff", {}) or {}
+    if sd.get("added_files"):
+        lines.append(
+            f"  + Files added beyond plan ({sd['added_count']}): "
+            f"{', '.join(f for f in sd['added_files'][:8])}"
+            + (" …" if sd["added_count"] > 8 else "")
+        )
+    if sd.get("removed_files"):
+        lines.append(
+            f"  - Files removed vs plan ({sd['removed_count']}): "
+            f"{', '.join(f for f in sd['removed_files'][:8])}"
+            + (" …" if sd["removed_count"] > 8 else "")
+        )
+    if sd.get("modified_files"):
+        lines.append(f"  ~ Files changed vs plan ({sd['modified_count']}):")
+        for m in sd["modified_files"][:8]:
+            bits = []
+            if m["symbols_added"]:
+                bits.append(f"+{len(m['symbols_added'])} sym")
+            if m["symbols_removed"]:
+                bits.append(f"-{len(m['symbols_removed'])} sym")
+            if not bits:
+                bits.append("content changed")
+            lines.append(f"      • {m['file']}  ({', '.join(bits)})")
+    lines.append(
+        f"  Findings: plan {drift['plan_total_findings']} -> built {drift['built_total_findings']} "
+        f"({drift['new_findings']} new)"
+    )
+    if drift["new_charter_violations"]:
+        lines.append(f"  Charter violations: {drift['new_charter_violations']} new")
+    for row in drift["per_scanner"]:
+        if row["delta"]:
+            lines.append(
+                f"    • {row['scanner']}: {row['plan']} -> {row['built']} ({row['delta']:+d})"
+            )
+    status = "ON PLAN ✅" if drift["clean"] else "DRIFT DETECTED ⚠️"
+    lines.insert(0, f"Plan-vs-Built: {status}")
+    drift["summary"] = "\n".join(lines)
+    return drift
+
+
+def drift_vs_plan_file(root: Path, plan_file: str | Path) -> dict:
+    """
+    Audit the built state against an externally supplied plan/spec file
+    (the `p audit --plan-file` path). The file is treated as the agreed Plan
+    and diffed against the live state.
+    """
+    root = Path(root)
+    path = Path(plan_file)
+    if not path.exists():
+        return {"has_plan": False, "error": f"Plan file not found: {path}"}
+    try:
+        plan = json.loads(path.read_text(encoding="utf-8"))
+    except Exception as e:
+        return {"has_plan": False, "error": f"Could not parse plan file: {e}"}
+
+    current = _snapshot_state(root)
+    cur_scope = _snapshot_scope(root)
+    plan_layers = set((plan.get("layers") or {}).keys())
+    cur_layers = set((current.get("layers") or {}).keys())
+    plan_total = plan.get("total_findings", 0)
+    cur_total = current.get("total_findings", 0)
+    plan_charter = plan.get("charter_violations", 0)
+    cur_charter = current.get("charter_violations", 0)
+
+    plan_summary = plan.get("scan_summary", {})
+    cur_summary = current.get("scan_summary", {})
+
+    drift = {
+        "has_plan": True,
+        "from_file": str(path),
+        "intent": plan.get("intent", ""),
+        "layers_added": sorted(cur_layers - plan_layers),
+        "layers_removed": sorted(plan_layers - cur_layers),
+        "plan_total_findings": plan_total,
+        "built_total_findings": cur_total,
+        "new_findings": max(0, cur_total - plan_total),
+        "new_charter_violations": max(0, cur_charter - plan_charter),
+        "per_scanner": _diff_scanners(plan_summary, cur_summary),
+        "scope_diff": _diff_scope(plan.get("scope", {}) or {}, cur_scope),
+    }
+    drift["clean"] = (
+        not drift["layers_added"]
+        and not drift["layers_removed"]
+        and drift["new_findings"] == 0
+        and drift["new_charter_violations"] == 0
+    )
+    status = "ON PLAN ✅" if drift["clean"] else "DRIFT DETECTED ⚠️"
+    lines = [f"Plan-vs-Built (vs {path.name}): {status}"]
+    if drift["intent"]:
+        lines.append(f"Intent: {drift['intent']}")
+    if drift["layers_added"]:
+        lines.append(f"  + Layers beyond plan: {', '.join(drift['layers_added'])}")
+    if drift["layers_removed"]:
+        lines.append(f"  - Layers missing vs plan: {', '.join(drift['layers_removed'])}")
+    lines.append(
+        f"  Findings: plan {plan_total} -> built {cur_total} ({drift['new_findings']} new)"
+    )
+    if drift["new_charter_violations"]:
+        lines.append(f"  Charter violations: {drift['new_charter_violations']} new")
+    drift["summary"] = "\n".join(lines)
+    return drift