vibe-coding-qa 0.5.0__py3-none-any.whl

vibe_coding_qa/fixes.py

@@ -0,0 +1,222 @@
+"""Automated fix engine: apply safe, reviewable fixes."""
+
+import difflib
+import os
+import re
+import shutil
+from datetime import datetime, timezone
+from pathlib import Path
+
+from . import Finding, Severity
+
+
+class FixClassification:
+    SAFE = "safe-automatic"
+    APPROVAL = "approval-required"
+    MANUAL = "manual-remediation"
+
+
+class FixEngine:
+    def __init__(self, repo: Path, dry_run: bool = True):
+        self.repo = repo
+        self.dry_run = dry_run
+        self.applied: list[dict] = []
+        self.skipped: list[dict] = []
+        self.backups: list[Path] = []
+        self.backup_dir = repo / ".vcqa-backups" / datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
+
+    def apply(self, findings: list[Finding]) -> dict:
+        for finding in findings:
+            if not finding.fixable:
+                self.skipped.append({"finding": finding.to_dict(), "reason": "not marked fixable", "classification": FixClassification.MANUAL})
+                continue
+            classification = self.classify(finding)
+            if classification == FixClassification.MANUAL:
+                self.skipped.append({"finding": finding.to_dict(), "reason": "manual remediation required", "classification": classification})
+                continue
+            if classification == FixClassification.APPROVAL:
+                self.skipped.append({"finding": finding.to_dict(), "reason": "requires explicit approval", "classification": classification})
+                continue
+            method_name = f"fix_{finding.rule.replace(':', '_').replace('-', '_')}"
+            method = getattr(self, method_name, None)
+            if method is None:
+                self.skipped.append({"finding": finding.to_dict(), "reason": "no automated fix available", "classification": classification})
+                continue
+            try:
+                method(finding)
+            except Exception as exc:
+                self.skipped.append({"finding": finding.to_dict(), "reason": str(exc), "classification": classification})
+        return {"applied": self.applied, "skipped": self.skipped, "dry_run": self.dry_run}
+
+    def classify(self, finding: Finding) -> str:
+        if finding.severity in (Severity.CRITICAL,):
+            return FixClassification.APPROVAL
+        if finding.rule in ("security:client-side-secret", "security:committed-env-file"):
+            return FixClassification.MANUAL
+        if finding.rule in ("quality:console-log-in-production", "quality:debugger-statement"):
+            return FixClassification.SAFE
+        return FixClassification.APPROVAL
+
+    def _resolve_path(self, file: Path) -> Path:
+        target = self.repo / file
+        resolved = target.resolve()
+        repo_resolved = self.repo.resolve()
+        # Prevent symlink/path traversal escape.
+        if not str(resolved).startswith(str(repo_resolved) + os.sep) and resolved != repo_resolved:
+            raise ValueError(f"Target path escapes repository: {file}")
+        return resolved
+
+    def _read(self, file: Path) -> list[str]:
+        path = self._resolve_path(file)
+        return path.read_text(encoding="utf-8", errors="ignore").splitlines()
+
+    def _backup(self, path: Path) -> Path:
+        if self.dry_run:
+            return path
+        rel = path.relative_to(self.repo.resolve())
+        backup = self.backup_dir / rel
+        backup.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(path, backup)
+        self.backups.append(backup)
+        return backup
+
+    def _write(self, file: Path, lines: list[str]) -> None:
+        path = self._resolve_path(file)
+        self._backup(path)
+        if self.dry_run:
+            return
+        path.write_text("\n".join(lines) + ("\n" if lines else ""), encoding="utf-8")
+
+    def _make_diff(self, original_lines: list[str], new_lines: list[str], file: Path) -> str:
+        return "\n".join(difflib.unified_diff(
+            original_lines,
+            new_lines,
+            fromfile=str(file),
+            tofile=str(file),
+            lineterm="",
+        ))
+
+    def fix_quality_console_log_in_production(self, finding: Finding) -> None:
+        lines = self._read(finding.file)
+        original = list(lines)
+        i = finding.line - 1
+        if i < 0 or i >= len(lines):
+            raise IndexError("line out of range")
+        line = lines[i]
+        cleaned = re.sub(r"\s*console\.(log|debug|warn)\s*\([^;]*\);?", "", line)
+        if cleaned == line or not cleaned.strip():
+            cleaned = re.sub(r"console\.(log|debug|warn)\s*\([^;]*\);?", "", line)
+        lines[i] = cleaned
+        diff = self._make_diff(original, lines, finding.file)
+        self._write(finding.file, lines)
+        self.applied.append({"finding": finding.to_dict(), "replacement": cleaned, "diff": diff, "classification": FixClassification.SAFE})
+
+    def fix_quality_debugger_statement(self, finding: Finding) -> None:
+        lines = self._read(finding.file)
+        original = list(lines)
+        i = finding.line - 1
+        if i < 0 or i >= len(lines):
+            raise IndexError("line out of range")
+        line = lines[i]
+        cleaned = re.sub(r"\s*debugger;?", "", line)
+        lines[i] = cleaned
+        diff = self._make_diff(original, lines, finding.file)
+        self._write(finding.file, lines)
+        self.applied.append({"finding": finding.to_dict(), "replacement": cleaned, "diff": diff, "classification": FixClassification.SAFE})
+
+    def fix_security_client_side_secret(self, finding: Finding) -> None:
+        raise RuntimeError("client-side secrets require moving the value to a server route; cannot auto-fix")
+
+    def fix_security_committed_env_file(self, finding: Finding) -> None:
+        raise RuntimeError("remove the file from git and rotate secrets; cannot auto-fix")
+
+    def rollback(self, backup: Path | None = None) -> list[Path]:
+        """Restore the most recent backup, or a specific backup path."""
+        if backup is None:
+            if not self.backups:
+                return []
+            backup = self.backups[-1]
+        rel = backup.relative_to(self.backup_dir)
+        target = self.repo / rel
+        shutil.copy2(backup, target)
+        return [target]
+
+    @staticmethod
+    def _finding_key(finding: "Finding | dict") -> tuple[str, str]:
+        if isinstance(finding, Finding):
+            return finding.rule, str(finding.file)
+        return str(finding["rule"]), str(finding["file"])
+
+    def verify(self, rescan_findings: list[Finding], tests: dict | None = None) -> dict:
+        """Confirm which applied fixes actually removed the detected issue.
+
+        Verification is evidence-based: a fix is only marked ``resolved`` when a
+        fresh scan of the modified repository no longer reports the rule for that
+        file. It is never inferred from the fact that a file was edited or from a
+        shifted line number. When the same rule appears more than once in a file,
+        resolutions are counted by multiplicity so a partial fix is reported as
+        ``partially_resolved`` rather than ``resolved``.
+
+        If tests were run and failed, no fix can be confirmed and every attempt is
+        reported as ``unverifiable`` so a regression is never masked.
+        """
+        before: dict[tuple[str, str], int] = {}
+        changes_by_key: dict[tuple[str, str], list[dict]] = {}
+        for change in self.applied:
+            key = self._finding_key(change["finding"])
+            before[key] = before.get(key, 0) + 1
+            changes_by_key.setdefault(key, []).append(change)
+
+        after: dict[tuple[str, str], int] = {}
+        for finding in rescan_findings:
+            key = self._finding_key(finding)
+            after[key] = after.get(key, 0) + 1
+
+        tests_failed = bool(tests and tests.get("status") == "fail")
+        report: dict = {
+            "resolved": [],
+            "partially_resolved": [],
+            "unresolved": [],
+            "unverifiable": [],
+            "tests_failed": tests_failed,
+            "verified": False,
+        }
+        for key, attempted in before.items():
+            remaining = after.get(key, 0)
+            entry = {"rule": key[0], "file": key[1], "attempted": attempted, "remaining": remaining}
+            if tests_failed:
+                status = "unverifiable"
+            elif remaining == 0:
+                status = "resolved"
+            elif remaining < attempted:
+                status = "partially_resolved"
+            else:
+                status = "unresolved"
+            entry["status"] = status
+            report[status].append(entry)
+            for change in changes_by_key[key]:
+                change["resolution"] = status
+
+        report["verified"] = (
+            not tests_failed
+            and bool(report["resolved"])
+            and not report["partially_resolved"]
+            and not report["unresolved"]
+        )
+        return report
+
+
+def suggest_fixes(findings: list[Finding]) -> list[dict]:
+    """Generate human-readable suggestions without modifying files."""
+    suggestions = []
+    for f in findings:
+        suggestions.append({
+            "file": str(f.file),
+            "line": f.line,
+            "rule": f.rule,
+            "severity": f.severity.value,
+            "message": f.message,
+            "suggestion": f.suggestion,
+            "auto_fixable": f.fixable,
+        })
+    return suggestions

vibe_coding_qa/gates.py

@@ -0,0 +1,300 @@
+"""Production-readiness scoring and release gate."""
+
+import os
+from typing import Any
+
+from . import Finding, ModuleResult, ScanResult, Severity, Status
+
+
+MODULE_WEIGHTS = {
+    "security": 1.5,
+    "database": 1.4,
+    "dependencies": 1.2,
+    "infrastructure": 1.2,
+    "quality": 1.0,
+    "compliance": 1.1,
+    "performance": 0.8,
+}
+
+SEVERITY_PENALTY = {
+    Severity.CRITICAL: 40,
+    Severity.HIGH: 20,
+    Severity.MEDIUM: 10,
+    Severity.LOW: 3,
+    Severity.INFO: 0,
+}
+
+CONFIDENCE_MULTIPLIER = {
+    "high": 1.0,
+    "medium": 0.8,
+    "low": 0.5,
+}
+
+EXPLOITABILITY_MULTIPLIER = {
+    "security": 1.5,
+    "database": 1.4,
+    "dependencies": 1.2,
+    "infrastructure": 1.2,
+    "compliance": 1.0,
+    "quality": 0.9,
+    "performance": 0.8,
+}
+
+EXPLOITABLE_RULES = {
+    "security:client-side-secret",
+    "security:generic-api-key",
+    "security:sql-injection-risk",
+    "security:unsafe-shell-execution",
+    "security:path-traversal-risk",
+    "security:ssrf-risk",
+    "security:private-key",
+    "security:aws-access-key",
+    "security:openai-key",
+    "security:stripe-key",
+    "security:supabase-service-key",
+    "security:firebase-insecure-rules",
+    "database:table-without-rls",
+    "database:editable-role-field",
+    "database:client-role-update",
+}
+
+
+def _finding_key(f: Finding) -> tuple:
+    return (f.rule, str(f.file), f.line)
+
+
+def deduplicate_findings(findings: list[Finding]) -> list[Finding]:
+    seen: set[tuple] = set()
+    unique: list[Finding] = []
+    for f in findings:
+        key = _finding_key(f)
+        if key in seen:
+            continue
+        seen.add(key)
+        unique.append(f)
+    return unique
+
+
+def _penalty_for(f: Finding) -> float:
+    base = float(SEVERITY_PENALTY.get(f.severity, 0))
+    confidence = CONFIDENCE_MULTIPLIER.get(f.confidence, 0.8)
+    exploitability = EXPLOITABILITY_MULTIPLIER.get(f.module, 1.0)
+    if f.rule in EXPLOITABLE_RULES:
+        exploitability *= 1.2
+    return round(base * confidence * exploitability, 2)
+
+
+def score_module(findings: list[Finding], max_score: float = 100.0) -> tuple[float, Status, list[dict[str, Any]]]:
+    unique = deduplicate_findings(findings)
+    if not unique:
+        return max_score, Status.PASS, []
+    deductions: list[dict[str, Any]] = []
+    penalty = 0.0
+    for f in unique:
+        p = _penalty_for(f)
+        penalty += p
+        deductions.append({
+            "rule": f.rule,
+            "file": str(f.file),
+            "line": f.line,
+            "severity": f.severity.value,
+            "confidence": f.confidence,
+            "penalty": p,
+            "reason": f"{f.severity.value} {f.rule} in {f.module}",
+        })
+    score = max(0.0, max_score - penalty)
+    if any(f.severity == Severity.CRITICAL for f in unique):
+        return score, Status.BLOCK, deductions
+    if any(f.severity == Severity.HIGH for f in unique):
+        return score, Status.FAIL, deductions
+    return score, Status.PASS, deductions
+
+
+def _determine_gate(
+    overall: float,
+    minimum_score: int,
+    critical_count: int,
+    high_count: int,
+    test_status: str | Status | None,
+    test_execution_mode: str | None,
+) -> str:
+    """
+    Determine the release gate decision.
+
+    Returns one of: "block", "fail", "pass", "not_verified"
+    """
+    # Critical findings always block
+    if critical_count > 0:
+        return "block"
+
+    # High findings fail
+    if high_count > 0:
+        return "fail"
+
+    # Below minimum score fails
+    if overall < minimum_score:
+        return "fail"
+
+    # Normalize test_status to string
+    if isinstance(test_status, Status):
+        test_status_str = test_status.value
+    else:
+        test_status_str = test_status
+
+    if test_status_str == "fail":
+        return "fail"
+    if test_status_str == "pass":
+        return "pass"
+    return "not_verified"
+
+
+def assess(result: ScanResult, minimum_score: int | None = None) -> dict:
+    if minimum_score is None:
+        minimum_score = int(os.environ.get("VCQA_MINIMUM_SCORE", "60"))
+    score_explanation: dict[str, Any] = {"deductions": [], "modules": []}
+    for module in result.modules:
+        module.findings = deduplicate_findings(module.findings)
+        module.score, module.status, deductions = score_module(module.findings)
+        score_explanation["modules"].append({
+            "module": module.module,
+            "score": module.score,
+            "status": module.status.value,
+            "deductions": deductions,
+        })
+        score_explanation["deductions"].extend(deductions)
+
+    weighted_sum = 0.0
+    total_weight = 0.0
+    for module in result.modules:
+        weight = MODULE_WEIGHTS.get(module.module, 1.0)
+        weighted_sum += module.score * weight
+        total_weight += weight
+    overall = round(weighted_sum / total_weight, 2) if total_weight else 0.0
+
+    # Get test information
+    test_status = result.tests.get("status")
+    test_execution_mode = result.tests.get("execution_mode")
+
+    gate = _determine_gate(
+        overall=overall,
+        minimum_score=minimum_score,
+        critical_count=result.critical_count,
+        high_count=result.high_count,
+        test_status=test_status,
+        test_execution_mode=test_execution_mode,
+    )
+
+    score_explanation["overall_score"] = overall
+    score_explanation["minimum_score"] = minimum_score
+    score_explanation["weights"] = MODULE_WEIGHTS
+    score_explanation["gate"] = gate
+    score_explanation["test_status"] = test_status
+    score_explanation["test_execution_mode"] = test_execution_mode
+
+    assessment = {
+        "overall_score": overall,
+        "minimum_score": minimum_score,
+        "gate": gate,
+        "weights": MODULE_WEIGHTS,
+        "score_explanation": score_explanation,
+        "criteria": {
+            "critical_blocks_release": True,
+            "high_fails_release": True,
+            "minimum_score": minimum_score,
+        },
+        # Also store at top level for easy access in release_decision
+        "test_status": test_status,
+        "test_execution_mode": test_execution_mode,
+    }
+
+    # Store authoritative assessment on the result for consistent access
+    result._assessment = assessment
+
+    return assessment
+
+
+def release_gate_label(result: ScanResult) -> str:
+    if not result._assessment:
+        assess(result)
+    return {
+        "pass": "PASS",
+        "fail": "FAIL",
+        "block": "BLOCKED",
+        "not_verified": "NOT VERIFIED",
+    }.get(result.gate, "NOT VERIFIED")
+
+
+def release_decision(result: ScanResult) -> str:
+    # Ensure every consumer reads the same authoritative assessment.
+    if not result._assessment:
+        assess(result)
+    # Use authoritative assessment if available
+    if result._assessment:
+        gate = result._assessment.get("gate", "unknown")
+        overall = result._assessment.get("overall_score", 0)
+        minimum = result._assessment.get("minimum_score", 60)
+        test_status = result._assessment.get("test_status")
+        test_mode = result._assessment.get("test_execution_mode")
+
+        # Normalize test_status to string
+        if isinstance(test_status, Status):
+            test_status_str = test_status.value
+        else:
+            test_status_str = test_status
+
+        if gate == "block":
+            return "BLOCKED: critical issues or failing tests must be resolved before release."
+        if gate == "fail":
+            if result.critical_count > 0:
+                return "BLOCKED: critical issues or failing tests must be resolved before release."
+            if result.high_count > 0:
+                return f"FAIL: high-severity findings remain; fix before release."
+            if overall < minimum:
+                return f"FAIL: overall readiness score ({overall}) is below the minimum threshold ({minimum})."
+            if test_status_str == "fail":
+                return "FAIL: test suite failed."
+        if gate == "not_verified":
+            return f"NOT VERIFIED: overall score ({overall}) meets threshold but tests were not executed ({test_mode}). Run with --explicit-permission to verify."
+        if gate == "pass":
+            return f"PASS: no critical or high issues, score ({overall}) above threshold ({minimum}), tests passed."
+    # Fallback to legacy logic
+    if result.release_blocked:
+        return "BLOCKED: critical issues or failing tests must be resolved before release."
+    if result.high_count > 0:
+        return "FAIL: high-severity findings remain; fix before release."
+    if result.overall_score < 60:
+        return "FAIL: overall readiness score is below 60."
+    return "PASS: no critical or high issues and score is above the release threshold."
+
+
+def coverage_gaps(result: ScanResult) -> list[str]:
+    gaps: list[str] = []
+    architecture = result.tests.get("architecture", {})
+    if not architecture.get("has_tests"):
+        gaps.append("No automated test runner detected; runtime behavior is unverified.")
+    if not architecture.get("lockfiles"):
+        gaps.append("No dependency lockfile found; supply-chain reproducibility is unverified.")
+    if not architecture.get("auth_providers"):
+        gaps.append("No authentication provider detected; review access-control assumptions.")
+    if not architecture.get("ci_files"):
+        gaps.append("No CI workflow detected; build and deployment processes are unaudited.")
+    if not architecture.get("has_gitignore"):
+        gaps.append("No .gitignore detected; secret leaks are more likely.")
+    if not result.modules:
+        gaps.append("No scanner modules produced results.")
+
+    # Add test execution status to gaps
+    test_status = result.tests.get("status")
+    test_mode = result.tests.get("execution_mode")
+    test_reason = result.tests.get("test_reason")
+    if test_status == "skip":
+        if test_reason in ("all_tests_skipped", "zero_tests_discovered"):
+            gaps.append(f"Tests not verified: no test executed ({test_reason}).")
+        elif test_reason == "no_recognizable_results":
+            gaps.append("Tests not verified: the runner output could not be recognized.")
+        elif test_mode == "test_infrastructure_unavailable":
+            gaps.append("Tests not verified: required dependencies are unavailable in the sandbox image.")
+        else:
+            gaps.append(f"Tests not executed: {test_mode}. Use --explicit-permission to run tests.")
+
+    return gaps