Deepsec

# Staged from the workspace root by build.mjs at bundle time so the
# `files` field in package.json picks them up at pack/publish time.
README.md
LICENSE
NOTICE

import { chmodSync, cpSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
import { dirname, resolve } from "node:path";
import { fileURLToPath } from "node:url";
import { generateDtsBundle } from "dts-bundle-generator";
import { build } from "esbuild";

const __dirname = dirname(fileURLToPath(import.meta.url));
const distDir = resolve(__dirname, "dist");
const repoRoot = resolve(__dirname, "../..");

// Externalized at runtime: native binaries, heavy SDKs, and jiti (which
// bundles its own esbuild — re-bundling it produces broken output).
const external = [
  "@anthropic-ai/claude-agent-sdk",
  "@openai/codex",
  "@openai/codex-sdk",
  "@vercel/sandbox",
  "jiti",
];

const common = {
  bundle: true,
  platform: "node",
  format: "esm",
  target: "node22",
  external,
  sourcemap: false,
  legalComments: "none",
  logLevel: "info",
};

rmSync(distDir, { recursive: true, force: true });
mkdirSync(distDir, { recursive: true });

// CJS deps bundled into ESM use `require()` for Node builtins; give them a
// real `require` via createRequire so the call resolves at runtime.
const requireShim = `
import { createRequire as __topLevelCreateRequire } from "node:module";
const require = __topLevelCreateRequire(import.meta.url);
`.trim();

await build({
  ...common,
  entryPoints: [resolve(__dirname, "src/cli.ts")],
  outfile: resolve(distDir, "cli.mjs"),
  banner: { js: `#!/usr/bin/env node\n${requireShim}` },
});
chmodSync(resolve(distDir, "cli.mjs"), 0o755);

await build({
  ...common,
  entryPoints: [resolve(__dirname, "src/config.ts")],
  outfile: resolve(distDir, "config.mjs"),
  banner: { js: requireShim },
});

// Bundle config.d.ts into a single self-contained file. The runtime side is
// already inlined by esbuild, but tsc would emit `from "@deepsec/core"`
// re-exports — broken for consumers, since those workspace packages are not
// published. dts-bundle-generator inlines all referenced types from internal
// workspace packages.
const dtsBundles = generateDtsBundle(
  [
    {
      filePath: resolve(__dirname, "src/config.ts"),
      output: { noBanner: true, exportReferencedTypes: false },
    },
  ],
  { preferredConfigPath: resolve(__dirname, "tsconfig.dts.json") },
);
writeFileSync(resolve(distDir, "config.d.ts"), dtsBundles[0]);

cpSync(resolve(repoRoot, "docs"), resolve(distDir, "docs"), { recursive: true });
cpSync(resolve(repoRoot, "samples"), resolve(distDir, "samples"), {
  recursive: true,
  filter: (src) => !/(^|\/)data(\/|$)/.test(src) && !/(^|\/)node_modules(\/|$)/.test(src),
});

// The request-proxy is a standalone .mjs that runs on the sandbox worker
// (not bundled into cli.mjs — it executes in its own node process). Ship it
// verbatim so installed-mode workers can spawn it from node_modules/deepsec/.
mkdirSync(resolve(distDir, "sandbox"), { recursive: true });
cpSync(
  resolve(__dirname, "src/sandbox/request-proxy.mjs"),
  resolve(distDir, "sandbox/request-proxy.mjs"),
);

// README.md, LICENSE, and NOTICE live at the workspace root for repo
// browsing. `files` in package.json names them at the package root, so
// stage them here.
cpSync(resolve(repoRoot, "README.md"), resolve(__dirname, "README.md"));
cpSync(resolve(repoRoot, "LICENSE"), resolve(__dirname, "LICENSE"));
cpSync(resolve(repoRoot, "NOTICE"), resolve(__dirname, "NOTICE"));

console.log("\nBundle complete:");
console.log("  dist/cli.mjs");
console.log("  dist/config.mjs");
console.log("  dist/sandbox/request-proxy.mjs");
console.log("  dist/docs/");
console.log("  dist/samples/");
console.log("  README.md");
console.log("  LICENSE");
console.log("  NOTICE");

{
  "name": "deepsec",
  "version": "2.0.12",
  "description": "AI-powered vulnerability scanner for any codebase",
  "license": "Apache-2.0",
  "repository": {
    "type": "git",
    "url": "https://github.com/vercel-labs/deepsec"
  },
  "type": "module",
  "bin": {
    "deepsec": "./dist/cli.mjs"
  },
  "exports": {
    ".": "./dist/cli.mjs",
    "./config": {
      "types": "./dist/config.d.ts",
      "import": "./dist/config.mjs"
    }
  },
  "files": [
    "dist",
    "README.md",
    "LICENSE",
    "NOTICE",
    "SKILL.md"
  ],
  "scripts": {
    "build": "tsc --noEmit",
    "bundle": "pnpm --filter @deepsec/core --filter @deepsec/scanner build && node build.mjs",
    "prepack": "pnpm bundle",
    "prepublishOnly": "pnpm -w validate && node -e \"const fs=require('node:fs');for(const f of ['dist/cli.mjs','dist/config.mjs','dist/config.d.ts','dist/sandbox/request-proxy.mjs','dist/docs/getting-started.md','dist/samples/webapp/deepsec.config.ts','SKILL.md','README.md','LICENSE','NOTICE']){if(!fs.existsSync(f)){console.error('Missing: '+f);process.exit(1)}}console.log('Pre-publish checks passed.')\""
  },
  "dependencies": {
    "@anthropic-ai/claude-agent-sdk": "^0.3.158",
    "@openai/codex": "^0.125.0",
    "@openai/codex-sdk": "^0.125.0",
    "@vercel/oidc": "^3.4.0",
    "@vercel/sandbox": "^1.9.0",
    "jiti": "^2.4.0",
    "minimatch": "^10.0.0",
    "tar": "^7.5.13"
  },
  "devDependencies": {
    "@deepsec/core": "workspace:*",
    "@deepsec/processor": "workspace:*",
    "@deepsec/scanner": "workspace:*",
    "commander": "^13.0.0",
    "dotenv": "^16.4.0",
    "dts-bundle-generator": "^9.5.1",
    "esbuild": "^0.25.12"
  }
}

import { afterEach, beforeEach, describe, expect, it } from "vitest";
import { buildSandboxEnv, resolveBrokeredCredentials } from "../sandbox/setup.js";

const TOUCHED_KEYS = [
  "ANTHROPIC_AUTH_TOKEN",
  "ANTHROPIC_BASE_URL",
  "OPENAI_API_KEY",
  "OPENAI_BASE_URL",
] as const;

describe("credential brokering", () => {
  let saved: Record<string, string | undefined> = {};

  beforeEach(() => {
    saved = {};
    for (const k of TOUCHED_KEYS) {
      saved[k] = process.env[k];
      delete process.env[k];
    }
  });

  afterEach(() => {
    for (const k of TOUCHED_KEYS) {
      if (saved[k] === undefined) delete process.env[k];
      else process.env[k] = saved[k];
    }
  });

  describe("resolveBrokeredCredentials", () => {
    it("captures ANTHROPIC_AUTH_TOKEN from the orchestrator env", () => {
      process.env.ANTHROPIC_AUTH_TOKEN = "vck_real";
      const c = resolveBrokeredCredentials("claude-agent-sdk");
      expect(c.anthropicToken).toBe("vck_real");
      expect(c.openaiToken).toBeUndefined();
    });

    it("falls back to ANTHROPIC token for OpenAI on the codex path", () => {
      process.env.ANTHROPIC_AUTH_TOKEN = "vck_real";
      const c = resolveBrokeredCredentials("codex");
      expect(c.openaiToken).toBe("vck_real");
    });

    it("does not borrow ANTHROPIC token for OpenAI off the codex path", () => {
      process.env.ANTHROPIC_AUTH_TOKEN = "vck_real";
      const c = resolveBrokeredCredentials("claude-agent-sdk");
      expect(c.openaiToken).toBeUndefined();
    });

    it("prefers an explicit OPENAI_API_KEY over the anthropic fallback", () => {
      process.env.ANTHROPIC_AUTH_TOKEN = "vck_anthropic";
      process.env.OPENAI_API_KEY = "sk-explicit";
      const c = resolveBrokeredCredentials("codex");
      expect(c.openaiToken).toBe("sk-explicit");
    });
  });

  describe("buildSandboxEnv (the env handed to Sandbox.create)", () => {
    it("never contains a real ANTHROPIC token", () => {
      process.env.ANTHROPIC_AUTH_TOKEN = "vck_supersecret_realvalue";
      process.env.ANTHROPIC_BASE_URL = "https://ai-gateway.vercel.sh";
      const credentials = resolveBrokeredCredentials("claude-agent-sdk");
      const env = buildSandboxEnv("claude-agent-sdk", credentials);

      // The placeholder is set so the SDK can construct, but the real
      // token does not appear anywhere in the env map.
      expect(env.ANTHROPIC_AUTH_TOKEN).toBeDefined();
      expect(env.ANTHROPIC_AUTH_TOKEN).not.toBe("vck_supersecret_realvalue");
      for (const v of Object.values(env)) {
        expect(v).not.toContain("vck_supersecret_realvalue");
      }
    });

    it("never contains a real OPENAI key on the codex path", () => {
      process.env.OPENAI_API_KEY = "sk-real-openai-secret";
      process.env.OPENAI_BASE_URL = "https://api.openai.com";
      const credentials = resolveBrokeredCredentials("codex");
      const env = buildSandboxEnv("codex", credentials);

      expect(env.OPENAI_API_KEY).toBeDefined();
      expect(env.OPENAI_API_KEY).not.toBe("sk-real-openai-secret");
      for (const v of Object.values(env)) {
        expect(v).not.toContain("sk-real-openai-secret");
      }
    });

    it("omits the placeholder when the orchestrator has no token to broker", () => {
      // No ANTHROPIC_AUTH_TOKEN set — SDK should fail fast at init rather
      // than 401 from upstream after a brokered placeholder gets through.
      const credentials = resolveBrokeredCredentials("claude-agent-sdk");
      const env = buildSandboxEnv("claude-agent-sdk", credentials);
      expect(env.ANTHROPIC_AUTH_TOKEN).toBeUndefined();
    });

    it("preserves routing env (base URLs) so the agent knows where to send traffic", () => {
      process.env.ANTHROPIC_AUTH_TOKEN = "vck_real";
      process.env.ANTHROPIC_BASE_URL = "https://ai-gateway.vercel.sh";
      const credentials = resolveBrokeredCredentials("claude-agent-sdk");
      const env = buildSandboxEnv("claude-agent-sdk", credentials);

      // ANTHROPIC_BASE_URL gets rewritten to the local proxy by buildSandboxEnv
      // so the agent talks to the in-VM proxy. The original is exposed as
      // ANTHROPIC_UPSTREAM_BASE_URL for the proxy to forward to.
      expect(env.ANTHROPIC_UPSTREAM_BASE_URL).toBe("https://ai-gateway.vercel.sh");
      expect(env.ANTHROPIC_BASE_URL).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/);
    });
  });
});

import { spawnSync } from "node:child_process";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { afterEach, describe, expect, it } from "vitest";
import { resolveFiles } from "../file-sources.js";

const cleanups: Array<() => void> = [];

afterEach(() => {
  for (const c of cleanups.reverse()) c();
  cleanups.length = 0;
});

function tempRepo(): string {
  const root = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-fs-"));
  cleanups.push(() => fs.rmSync(root, { recursive: true, force: true }));
  for (const args of [
    ["init", "-q"],
    ["config", "user.email", "t@t"],
    ["config", "user.name", "t"],
    ["config", "commit.gpgsign", "false"],
  ]) {
    const r = spawnSync("git", args, { cwd: root, encoding: "utf-8" });
    if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
  }
  return root;
}

function gitCommit(root: string, msg: string) {
  spawnSync("git", ["add", "-A"], { cwd: root });
  const r = spawnSync("git", ["commit", "-q", "-m", msg], { cwd: root, encoding: "utf-8" });
  if (r.status !== 0) throw new Error(`git commit: ${r.stderr}`);
}

function write(root: string, rel: string, content: string) {
  const abs = path.join(root, rel);
  fs.mkdirSync(path.dirname(abs), { recursive: true });
  fs.writeFileSync(abs, content);
}

describe("resolveFiles()", () => {
  it("rejects multiple sources", () => {
    expect(() =>
      resolveFiles({
        rootPath: process.cwd(),
        diff: "HEAD",
        files: ["x.ts"],
      }),
    ).toThrow(/Conflicting/);
  });

  it("--diff returns files changed between ref and HEAD", () => {
    const root = tempRepo();
    write(root, "src/keep.ts", "1\n");
    write(root, "src/changed.ts", "1\n");
    gitCommit(root, "init");

    write(root, "src/changed.ts", "2\n");
    write(root, "src/added.ts", "new\n");
    gitCommit(root, "second");

    const { filePaths, sourceLabel } = resolveFiles({ rootPath: root, diff: "HEAD~1" });
    expect(filePaths.sort()).toEqual(["src/added.ts", "src/changed.ts"]);
    expect(sourceLabel).toBe("git-diff:HEAD~1");
  });

  it("filters out IGNORE_DIRS by default", () => {
    const root = tempRepo();
    write(root, "src/real.ts", "1\n");
    write(root, "src/real.test.ts", "1\n");
    write(root, "dist/built.js", "1\n");
    gitCommit(root, "init");

    write(root, "src/real.ts", "2\n");
    write(root, "src/real.test.ts", "2\n");
    write(root, "dist/built.js", "2\n");
    gitCommit(root, "edit");

    const { filePaths } = resolveFiles({ rootPath: root, diff: "HEAD~1" });
    expect(filePaths).toEqual(["src/real.ts"]);
  });

  it("--no-ignore preserves test/dist paths", () => {
    const root = tempRepo();
    write(root, "src/real.test.ts", "1\n");
    gitCommit(root, "init");
    write(root, "src/real.test.ts", "2\n");
    gitCommit(root, "edit");

    const { filePaths } = resolveFiles({ rootPath: root, diff: "HEAD~1", noIgnore: true });
    expect(filePaths).toEqual(["src/real.test.ts"]);
  });

  it("filters generated deepsec data records from explicit file lists", () => {
    const root = tempRepo();
    const oldDataRoot = process.env.DEEPSEC_DATA_ROOT;
    process.env.DEEPSEC_DATA_ROOT = path.join(root, "data{prod,dev}");
    cleanups.push(() => {
      if (oldDataRoot === undefined) delete process.env.DEEPSEC_DATA_ROOT;
      else process.env.DEEPSEC_DATA_ROOT = oldDataRoot;
    });

    write(
      root,
      "data{prod,dev}/app/project.json",
      JSON.stringify({
        projectId: "app",
        rootPath: root,
        createdAt: "2026-01-01T00:00:00.000Z",
      }),
    );
    write(root, "data{prod,dev}/app/files/src/generated.ts.json", "{}");
    write(
      root,
      "data{prod,dev}/other/project.json",
      JSON.stringify({
        projectId: "other",
        rootPath: root,
        createdAt: "2026-01-01T00:00:00.000Z",
      }),
    );
    write(root, "data{prod,dev}/other/files/src/generated.ts.json", "{}");
    write(
      root,
      "data/legacy/project.json",
      JSON.stringify({
        projectId: "legacy",
        rootPath: root,
        createdAt: "2026-01-01T00:00:00.000Z",
      }),
    );
    write(root, "data/legacy/files/src/generated.ts.json", "{}");
    write(root, "data/users/project.json", JSON.stringify({ name: "app users" }));
    write(root, "data/users/files/real.ts", "1\n");

    const { filePaths } = resolveFiles({
      rootPath: root,
      files: [
        "data{prod,dev}/app/files/src/generated.ts.json",
        "data{prod,dev}/other/files/src/generated.ts.json",
        "data/legacy/files/src/generated.ts.json",
        "data/users/files/real.ts",
      ],
    });

    expect(filePaths).toEqual(["data/users/files/real.ts"]);
  });

  it("--files accepts an explicit list and drops missing entries", () => {
    const root = tempRepo();
    write(root, "real.ts", "x\n");

    const { filePaths, sourceLabel } = resolveFiles({
      rootPath: root,
      files: ["real.ts", "ghost.ts"],
    });
    expect(filePaths).toEqual(["real.ts"]);
    expect(sourceLabel).toBe("files:cli");
  });

  it("--files-from reads newline-delimited paths", () => {
    const root = tempRepo();
    write(root, "a.ts", "x\n");
    write(root, "b.ts", "x\n");

    const listPath = path.join(root, "list.txt");
    fs.writeFileSync(listPath, "a.ts\nb.ts\n\n");

    const { filePaths } = resolveFiles({ rootPath: root, filesFrom: listPath });
    expect(filePaths.sort()).toEqual(["a.ts", "b.ts"]);
  });

  it("strips leading ./ and rejects paths outside root", () => {
    const root = tempRepo();
    write(root, "real.ts", "x\n");

    const { filePaths } = resolveFiles({
      rootPath: root,
      files: ["./real.ts", "../escape.ts"],
    });
    expect(filePaths).toEqual(["real.ts"]);
  });

  it("dedupes overlapping inputs", () => {
    const root = tempRepo();
    write(root, "x.ts", "1\n");
    const { filePaths } = resolveFiles({ rootPath: root, files: ["x.ts", "x.ts", "./x.ts"] });
    expect(filePaths).toEqual(["x.ts"]);
  });
});

import type { Severity } from "@deepsec/core";
import { describe, expect, it } from "vitest";
import { formatCount, formatDuration, severityColor } from "../formatters.js";

describe("severityColor", () => {
  it("returns red for CRITICAL", () => {
    expect(severityColor("CRITICAL")).toBe("\x1b[31m");
  });

  it("returns yellow for HIGH", () => {
    expect(severityColor("HIGH")).toBe("\x1b[33m");
  });

  it("returns cyan for MEDIUM", () => {
    expect(severityColor("MEDIUM")).toBe("\x1b[36m");
  });

  it("returns magenta for HIGH_BUG", () => {
    expect(severityColor("HIGH_BUG")).toBe("\x1b[35m");
  });

  it("returns magenta for BUG", () => {
    expect(severityColor("BUG")).toBe("\x1b[35m");
  });

  it("returns a color for every severity level", () => {
    const severities: Severity[] = ["CRITICAL", "HIGH", "MEDIUM", "HIGH_BUG", "BUG"];
    for (const sev of severities) {
      expect(severityColor(sev)).toBeTruthy();
    }
  });
});

describe("formatDuration", () => {
  it("formats seconds", () => {
    expect(formatDuration(5000)).toBe("5s");
    expect(formatDuration(59000)).toBe("59s");
  });

  it("formats minutes and seconds", () => {
    expect(formatDuration(90_000)).toBe("1m 30s");
    expect(formatDuration(3_540_000)).toBe("59m 0s");
  });

  it("formats hours", () => {
    expect(formatDuration(3_661_000)).toBe("1h 1m");
  });

  it("formats zero", () => {
    expect(formatDuration(0)).toBe("0s");
  });
});

describe("formatCount", () => {
  it("pluralizes correctly", () => {
    expect(formatCount(0, "file")).toBe("0 files");
    expect(formatCount(1, "file")).toBe("1 file");
    expect(formatCount(2, "file")).toBe("2 files");
  });
});

import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import type { AnalysisEntry, FileRecord, Finding } from "@deepsec/core";
import { afterEach, beforeEach, describe, expect, it } from "vitest";
import {
  mergeAfterExtract,
  mergeFileRecord,
  snapshotFileRecords,
} from "../sandbox/merge-records.js";

function entry(runId: string, agentType: string, investigatedAt: string): AnalysisEntry {
  return {
    runId,
    investigatedAt,
    durationMs: 1000,
    agentType,
    model: agentType === "codex" ? "gpt-5.5" : "claude-opus-4-7",
    modelConfig: {},
    findingCount: 0,
  };
}

function finding(vulnSlug: string, title: string, extras: Partial<Finding> = {}): Finding {
  return {
    severity: "HIGH",
    vulnSlug,
    title,
    description: "d",
    lineNumbers: [1],
    recommendation: "r",
    confidence: "high",
    ...extras,
  };
}

function record(overrides: Partial<FileRecord> = {}): FileRecord {
  return {
    filePath: "src/foo.ts",
    projectId: "p",
    candidates: [],
    lastScannedAt: "2026-05-06T15:00:00.000Z",
    lastScannedRunId: "scan1",
    fileHash: "h",
    findings: [],
    analysisHistory: [],
    status: "pending",
    ...overrides,
  };
}

describe("mergeFileRecord", () => {
  it("unions analysisHistory by runId and sorts by investigatedAt", () => {
    const host = record({
      analysisHistory: [entry("claude-run", "claude-agent-sdk", "2026-05-06T15:54:37.000Z")],
      status: "analyzed",
    });
    const incoming = record({
      analysisHistory: [entry("codex-run", "codex", "2026-05-06T15:59:48.000Z")],
      status: "analyzed",
    });

    const merged = mergeFileRecord(host, incoming);

    expect(merged.analysisHistory.map((e) => e.runId)).toEqual(["claude-run", "codex-run"]);
    expect(merged.status).toBe("analyzed");
  });

  it("dedupes analysisHistory when both sides serialize the same runId", () => {
    const sameEntry = entry("run-x", "codex", "2026-05-06T15:59:48.000Z");
    const host = record({ analysisHistory: [sameEntry] });
    const incoming = record({
      analysisHistory: [{ ...sameEntry, findingCount: 5 }],
    });

    const merged = mergeFileRecord(host, incoming);

    expect(merged.analysisHistory).toHaveLength(1);
    expect(merged.analysisHistory[0].findingCount).toBe(5); // incoming wins
  });

  it("unions findings by vulnSlug+title signature", () => {
    const host = record({
      findings: [finding("xss", "XSS via innerHTML")],
    });
    const incoming = record({
      findings: [finding("ssrf", "SSRF in webhook handler")],
    });

    const merged = mergeFileRecord(host, incoming);

    expect(merged.findings.map((f) => f.vulnSlug).sort()).toEqual(["ssrf", "xss"]);
  });

  it("preserves revalidation/triage from either side when finding signatures match", () => {
    const hostFinding = finding("xss", "XSS", {
      revalidation: {
        verdict: "true-positive",
        reasoning: "confirmed",
        revalidatedAt: "2026-05-06T16:00:00.000Z",
        runId: "reval-run",
        model: "gpt-5.5",
      },
    });
    const incomingFinding = finding("xss", "xss", {
      triage: {
        priority: "P0",
        exploitability: "trivial",
        impact: "critical",
        reasoning: "trivial RCE",
        triagedAt: "2026-05-06T16:05:00.000Z",
        model: "claude-sonnet-4-6",
      },
    });

    const merged = mergeFileRecord(
      record({ findings: [hostFinding] }),
      record({ findings: [incomingFinding] }),
    );

    expect(merged.findings).toHaveLength(1);
    expect(merged.findings[0].revalidation?.verdict).toBe("true-positive");
    expect(merged.findings[0].triage?.priority).toBe("P0");
  });

  it("preserves gitInfo when incoming lacks it", () => {
    const host = record({
      gitInfo: {
        recentCommitters: [{ name: "alice", email: "a@x", date: "2026-05-06" }],
        enrichedAt: "2026-05-06T15:00:00.000Z",
      },
    });
    const incoming = record({ gitInfo: undefined });

    const merged = mergeFileRecord(host, incoming);

    expect(merged.gitInfo?.recentCommitters[0].name).toBe("alice");
  });

  it("status: 'analyzed' on either side wins", () => {
    expect(
      mergeFileRecord(record({ status: "analyzed" }), record({ status: "processing" })).status,
    ).toBe("analyzed");
    expect(
      mergeFileRecord(record({ status: "pending" }), record({ status: "analyzed" })).status,
    ).toBe("analyzed");
    expect(
      mergeFileRecord(record({ status: "processing" }), record({ status: "error" })).status,
    ).toBe("error");
  });

  it("reproduces the parallel-orchestrator scenario end-to-end", () => {
    // Repro: claude orchestrator finished a sandbox at 15:54:37 (host
    // gets [claudeA]). Codex orchestrator started at 15:58:21, snapshotted
    // the host (got [claudeA]), processed and is now uploading [claudeA, codexB].
    //
    // Meanwhile, ANOTHER claude sandbox started before 15:58:21 (so its
    // local snapshot was empty) finished and is uploading [claudeC]. If
    // its tarball lands AFTER codex's, the naive overwrite drops both
    // claudeA and codexB. With the merge, all three survive.
    let host = record({
      analysisHistory: [entry("claudeA", "claude-agent-sdk", "2026-05-06T15:54:37.000Z")],
      status: "analyzed",
    });

    // Codex sandbox uploads [claudeA, codexB] — extract overlays it on host
    const codexUpload = record({
      analysisHistory: [
        entry("claudeA", "claude-agent-sdk", "2026-05-06T15:54:37.000Z"),
        entry("codexB", "codex", "2026-05-06T15:59:48.000Z"),
      ],
      status: "analyzed",
    });
    host = mergeFileRecord(host, codexUpload);

    // Late-arriving claude sandbox uploads [claudeC] only (its local snapshot
    // had been empty when the run started)
    const lateClaudeUpload = record({
      analysisHistory: [entry("claudeC", "claude-agent-sdk", "2026-05-06T16:02:00.000Z")],
      status: "analyzed",
    });
    host = mergeFileRecord(host, lateClaudeUpload);

    expect(host.analysisHistory.map((e) => e.runId)).toEqual(["claudeA", "codexB", "claudeC"]);
  });
});

describe("snapshotFileRecords + mergeAfterExtract", () => {
  let dir: string;

  beforeEach(() => {
    dir = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-merge-"));
  });

  afterEach(() => {
    fs.rmSync(dir, { recursive: true, force: true });
  });

  it("returns an empty snapshot when files/ doesn't exist", () => {
    expect(snapshotFileRecords(dir).size).toBe(0);
  });

  it("walks files/ recursively and indexes records by relative path", () => {
    const inner = path.join(dir, "files", "src", "nested");
    fs.mkdirSync(inner, { recursive: true });
    fs.writeFileSync(
      path.join(inner, "deep.ts.json"),
      JSON.stringify(record({ filePath: "src/nested/deep.ts" })),
    );
    fs.writeFileSync(
      path.join(dir, "files", "shallow.ts.json"),
      JSON.stringify(record({ filePath: "shallow.ts" })),
    );

    const snap = snapshotFileRecords(dir);

    expect(snap.size).toBe(2);
    expect(snap.has(path.join("files", "src", "nested", "deep.ts.json"))).toBe(true);
    expect(snap.has(path.join("files", "shallow.ts.json"))).toBe(true);
  });

  it("rewrites only files that existed in both the host snapshot and the post-extract state", () => {
    // Pre-extraction: host has a record with claude history
    const filesDir = path.join(dir, "files", "src");
    fs.mkdirSync(filesDir, { recursive: true });
    const recPath = path.join(filesDir, "foo.ts.json");
    fs.writeFileSync(
      recPath,
      JSON.stringify(
        record({
          filePath: "src/foo.ts",
          analysisHistory: [entry("claudeA", "claude-agent-sdk", "2026-05-06T15:54:37.000Z")],
          status: "analyzed",
        }),
      ),
    );
    const snap = snapshotFileRecords(dir);

    // Simulate a tar extract overwriting that file with [codexB] only —
    // the pattern that drops history without merging.
    fs.writeFileSync(
      recPath,
      JSON.stringify(
        record({
          filePath: "src/foo.ts",
          analysisHistory: [entry("codexB", "codex", "2026-05-06T15:59:48.000Z")],
          status: "analyzed",
        }),
      ),
    );

    // A second file the host had nothing for (sandbox-only contribution)
    const newFilePath = path.join(filesDir, "bar.ts.json");
    fs.writeFileSync(
      newFilePath,
      JSON.stringify(
        record({
          filePath: "src/bar.ts",
          analysisHistory: [entry("codexB2", "codex", "2026-05-06T15:59:50.000Z")],
        }),
      ),
    );

    const merged = mergeAfterExtract(dir, snap, "p");
    expect(merged).toBe(1);

    const fooAfter = JSON.parse(fs.readFileSync(recPath, "utf-8"));
    expect(fooAfter.analysisHistory.map((e: AnalysisEntry) => e.runId)).toEqual([
      "claudeA",
      "codexB",
    ]);

    // bar.ts wasn't in the host snapshot, so it's left alone.
    const barAfter = JSON.parse(fs.readFileSync(newFilePath, "utf-8"));
    expect(barAfter.analysisHistory.map((e: AnalysisEntry) => e.runId)).toEqual(["codexB2"]);
  });

  it("skips malformed JSON in the snapshot rather than throwing", () => {
    const filesDir = path.join(dir, "files");
    fs.mkdirSync(filesDir, { recursive: true });
    fs.writeFileSync(path.join(filesDir, "broken.ts.json"), "{not valid json");
    fs.writeFileSync(path.join(filesDir, "ok.ts.json"), JSON.stringify(record()));

    const snap = snapshotFileRecords(dir);
    expect(snap.size).toBe(1);
  });
});

import { describe, expect, it } from "vitest";
import { formatCacheHitRate, formatCost, formatPct, formatTokens } from "../commands/metrics.js";

describe("formatCost", () => {
  it("renders $0 exactly", () => {
    expect(formatCost(0)).toBe("$0");
  });

  it("uses 4 decimals for sub-cent costs", () => {
    expect(formatCost(0.0023)).toBe("$0.0023");
  });

  it("uses 3 decimals for sub-dollar costs", () => {
    expect(formatCost(0.045)).toBe("$0.045");
  });

  it("uses 2 decimals between $1 and $100", () => {
    expect(formatCost(1.5)).toBe("$1.50");
    expect(formatCost(42.789)).toBe("$42.79");
  });

  it("drops decimals at $100+", () => {
    expect(formatCost(123.45)).toBe("$123");
  });
});

describe("formatTokens", () => {
  it("returns 0 for zero", () => {
    expect(formatTokens(0)).toBe("0");
  });

  it("returns the raw number under 1K", () => {
    expect(formatTokens(950)).toBe("950");
  });

  it("uses K/M/B suffixes", () => {
    expect(formatTokens(1500)).toBe("1.5K");
    expect(formatTokens(2_500_000)).toBe("2.5M");
    expect(formatTokens(3_500_000_000)).toBe("3.5B");
  });
});

describe("formatPct", () => {
  it("rounds to whole percents", () => {
    expect(formatPct(1, 3)).toBe("33%");
    expect(formatPct(2, 3)).toBe("67%");
  });

  it("returns em-dash on zero denominator (avoids NaN%)", () => {
    expect(formatPct(0, 0)).toBe("—");
  });
});

describe("formatCacheHitRate", () => {
  it("computes cacheRead / total input without double-counting", () => {
    expect(formatCacheHitRate({ input: 20, cacheRead: 80, cacheCreation: 0 })).toBe("80%");
  });

  it("counts cacheCreation as uncached input in the denominator", () => {
    // 800 cached out of 1000 total input (100 uncached + 100 creation + 800 read) → 80%.
    expect(formatCacheHitRate({ input: 100, cacheRead: 800, cacheCreation: 100 })).toBe("80%");
  });

  it("returns em-dash when there is no input", () => {
    expect(formatCacheHitRate({ input: 0, cacheRead: 0, cacheCreation: 0 })).toBe("—");
  });

  it("is 0% when nothing was read from cache", () => {
    expect(formatCacheHitRate({ input: 500, cacheRead: 0, cacheCreation: 0 })).toBe("0%");
  });
});

import type { NetworkPolicy, NetworkPolicyRule } from "@vercel/sandbox";
import { describe, expect, it } from "vitest";
import { buildWorkerNetworkPolicy } from "../sandbox/setup.js";

function policyRecord(p: NetworkPolicy): Record<string, NetworkPolicyRule[]> {
  if (typeof p === "string") throw new Error("expected custom policy, got " + p);
  const a = p.allow;
  if (!a || Array.isArray(a)) throw new Error("expected record-form allow map");
  return a;
}

function allowedHosts(p: NetworkPolicy): string[] {
  return Object.keys(policyRecord(p)).sort();
}

function bearerFor(p: NetworkPolicy, host: string): string | null {
  const rules = policyRecord(p)[host];
  if (!rules) return null;
  for (const rule of rules) {
    for (const t of rule.transform ?? []) {
      const auth = t.headers?.authorization ?? t.headers?.Authorization;
      if (auth) return auth;
    }
  }
  return null;
}

describe("buildWorkerNetworkPolicy", () => {
  it("uses ANTHROPIC_UPSTREAM_BASE_URL host on the claude path", () => {
    const policy = buildWorkerNetworkPolicy(
      { ANTHROPIC_UPSTREAM_BASE_URL: "https://ai-gateway.vercel.sh" },
      "claude-agent-sdk",
    );
    expect(allowedHosts(policy)).toEqual(["ai-gateway.vercel.sh"]);
  });

  it("uses OPENAI_BASE_URL host on the codex path", () => {
    const policy = buildWorkerNetworkPolicy(
      { OPENAI_BASE_URL: "https://ai-gateway.vercel.sh/v1" },
      "codex",
    );
    expect(allowedHosts(policy)).toEqual(["ai-gateway.vercel.sh"]);
  });

  it("ignores ANTHROPIC_UPSTREAM_BASE_URL when agentType is codex", () => {
    const policy = buildWorkerNetworkPolicy(
      {
        ANTHROPIC_UPSTREAM_BASE_URL: "https://api.anthropic.com",
        OPENAI_BASE_URL: "https://api.openai.com",
      },
      "codex",
    );
    expect(allowedHosts(policy)).toEqual(["api.openai.com"]);
  });

  it("falls back to the provider default when no upstream URL is set", () => {
    const claudePolicy = buildWorkerNetworkPolicy({}, "claude-agent-sdk");
    expect(allowedHosts(claudePolicy)).toEqual(["api.anthropic.com"]);

    const codexPolicy = buildWorkerNetworkPolicy({}, "codex");
    expect(allowedHosts(codexPolicy)).toEqual(["api.openai.com"]);
  });

  it("falls back when the URL is unparseable", () => {
    const policy = buildWorkerNetworkPolicy(
      { ANTHROPIC_UPSTREAM_BASE_URL: "not a url" },
      "claude-agent-sdk",
    );
    expect(allowedHosts(policy)).toEqual(["api.anthropic.com"]);
  });

  it("merges extraAllowedHosts with the derived host", () => {
    const policy = buildWorkerNetworkPolicy(
      { ANTHROPIC_UPSTREAM_BASE_URL: "https://ai-gateway.vercel.sh" },
      "claude-agent-sdk",
      {},
      ["telemetry.example.com"],
    );
    expect(allowedHosts(policy)).toEqual(["ai-gateway.vercel.sh", "telemetry.example.com"]);
  });

  it("dedupes when extras overlap with the derived host", () => {
    const policy = buildWorkerNetworkPolicy(
      { ANTHROPIC_UPSTREAM_BASE_URL: "https://api.anthropic.com" },
      "claude-agent-sdk",
      {},
      ["api.anthropic.com"],
    );
    expect(allowedHosts(policy)).toEqual(["api.anthropic.com"]);
  });

  describe("credential brokering", () => {
    it("injects Authorization on the claude AI host when a token is provided", () => {
      const policy = buildWorkerNetworkPolicy(
        { ANTHROPIC_UPSTREAM_BASE_URL: "https://ai-gateway.vercel.sh" },
        "claude-agent-sdk",
        { anthropicToken: "vck_realtoken" },
      );
      expect(bearerFor(policy, "ai-gateway.vercel.sh")).toBe("Bearer vck_realtoken");
    });

    it("injects Authorization on the codex AI host when an OpenAI token is provided", () => {
      const policy = buildWorkerNetworkPolicy(
        { OPENAI_BASE_URL: "https://ai-gateway.vercel.sh/v1" },
        "codex",
        { openaiToken: "vck_realtoken" },
      );
      expect(bearerFor(policy, "ai-gateway.vercel.sh")).toBe("Bearer vck_realtoken");
    });

    it("emits no transform when no matching credential is provided", () => {
      const policy = buildWorkerNetworkPolicy(
        { ANTHROPIC_UPSTREAM_BASE_URL: "https://ai-gateway.vercel.sh" },
        "claude-agent-sdk",
        {},
      );
      expect(policyRecord(policy)["ai-gateway.vercel.sh"]).toEqual([]);
    });

    it("does not inject the anthropic token when running codex without an openai token", () => {
      // The anthropic-as-openai fallback happens at resolveBrokeredCredentials,
      // not here — this layer only sees what was passed in.
      const policy = buildWorkerNetworkPolicy(
        { OPENAI_BASE_URL: "https://api.openai.com" },
        "codex",
        { anthropicToken: "vck_realtoken" },
      );
      expect(bearerFor(policy, "api.openai.com")).toBeNull();
    });

    it("does not attach the transform to extra allowed hosts", () => {
      const policy = buildWorkerNetworkPolicy(
        { ANTHROPIC_UPSTREAM_BASE_URL: "https://ai-gateway.vercel.sh" },
        "claude-agent-sdk",
        { anthropicToken: "vck_realtoken" },
        ["telemetry.example.com"],
      );
      expect(bearerFor(policy, "ai-gateway.vercel.sh")).toBe("Bearer vck_realtoken");
      expect(bearerFor(policy, "telemetry.example.com")).toBeNull();
    });
  });
});

import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { ensureProject, writeFileRecord, writeRunMeta } from "@deepsec/core";
import { afterEach, describe, expect, it } from "vitest";
import { renderPrComment } from "../pr-comment.js";

let cleanup: (() => void) | null = null;

afterEach(() => {
  cleanup?.();
  cleanup = null;
  delete process.env.DEEPSEC_DATA_ROOT;
});

function setupProject(): { projectId: string } {
  const dataRoot = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-comment-"));
  const root = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-root-"));
  process.env.DEEPSEC_DATA_ROOT = dataRoot;
  cleanup = () => {
    fs.rmSync(dataRoot, { recursive: true, force: true });
    fs.rmSync(root, { recursive: true, force: true });
  };
  const projectId = `c-${Date.now().toString(36)}`;
  ensureProject(projectId, root);
  return { projectId };
}

describe("renderPrComment()", () => {
  it("returns null when the run had no findings", () => {
    const { projectId } = setupProject();
    const md = renderPrComment({ projectId, runId: "r1" });
    expect(md).toBeNull();
  });

  it("renders only net-new findings from the specified run", () => {
    const { projectId } = setupProject();

    writeRunMeta({
      runId: "r1",
      projectId,
      rootPath: "/tmp/x",
      createdAt: new Date().toISOString(),
      type: "process",
      phase: "done",
      stats: {},
    });

    writeFileRecord({
      filePath: "src/a.ts",
      projectId,
      candidates: [],
      lastScannedAt: new Date().toISOString(),
      lastScannedRunId: "r0",
      fileHash: "x",
      findings: [
        {
          severity: "HIGH",
          vulnSlug: "sql-injection",
          title: "Concatenated query",
          description: "User-controlled input flows into a string-concatenated SQL query.",
          lineNumbers: [12],
          recommendation: "Use parameterized queries.",
          confidence: "high",
          producedByRunId: "r1", // net-new in this run
        },
        {
          severity: "LOW",
          vulnSlug: "old",
          title: "Pre-existing finding",
          description: "Carried over from an earlier run.",
          lineNumbers: [99],
          recommendation: "n/a",
          confidence: "low",
          producedByRunId: "r-old", // attributable to a prior run
        },
        {
          severity: "MEDIUM",
          vulnSlug: "legacy",
          title: "Legacy finding without producedByRunId",
          description: "Predates the producedByRunId field.",
          lineNumbers: [42],
          recommendation: "n/a",
          confidence: "medium",
          // producedByRunId intentionally omitted — must not appear.
        },
      ],
      analysisHistory: [
        {
          runId: "r1",
          investigatedAt: new Date().toISOString(),
          durationMs: 100,
          agentType: "claude-agent-sdk",
          model: "test",
          modelConfig: {},
          findingCount: 1,
        },
      ],
      status: "analyzed",
    });

    // A different file with a finding from another run — must not leak in.
    writeFileRecord({
      filePath: "src/other.ts",
      projectId,
      candidates: [],
      lastScannedAt: new Date().toISOString(),
      lastScannedRunId: "r0",
      fileHash: "y",
      findings: [
        {
          severity: "CRITICAL",
          vulnSlug: "xss",
          title: "Stale finding from older run",
          description: "Should not appear.",
          lineNumbers: [1],
          recommendation: "irrelevant",
          confidence: "high",
          producedByRunId: "r-old",
        },
      ],
      analysisHistory: [
        {
          runId: "r-old",
          investigatedAt: new Date().toISOString(),
          durationMs: 100,
          agentType: "claude-agent-sdk",
          model: "test",
          modelConfig: {},
          findingCount: 1,
        },
      ],
      status: "analyzed",
    });

    const md = renderPrComment({ projectId, runId: "r1", source: "git-diff:HEAD~1" });
    expect(md).not.toBeNull();
    expect(md!).toContain("deepsec found 1 finding");
    expect(md!).toContain("src/a.ts:L12");
    expect(md!).toContain("Concatenated query");
    // Pre-existing findings from prior runs (or with no run id) are excluded.
    expect(md!).not.toContain("Pre-existing finding");
    expect(md!).not.toContain("Legacy finding without producedByRunId");
    expect(md!).not.toContain("Stale finding from older run");
    expect(md!).toContain("git-diff:HEAD~1");
  });
});

import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

// Stub @vercel/oidc so the preflight suite is hermetic: the real
// implementation decodes VERCEL_OIDC_TOKEN as a JWT and, on failure,
// falls back to reading `.vercel/project.json` and hitting Vercel. That
// would leak the dev's local project state into the test and 401 on CI
// (and the synthetic strings we use below aren't valid JWTs). Treating
// the env var as the source of truth matches what applyAiGatewayDefaults
// relies on: a token populated by `vercel env pull`.
vi.mock("@vercel/oidc", () => ({
  getVercelOidcToken: async () => {
    const token = process.env.VERCEL_OIDC_TOKEN;
    if (!token) throw new Error("no VERCEL_OIDC_TOKEN");
    return token;
  },
}));

import {
  applyAiGatewayDefaults,
  assertAgentCredential,
  assertSandboxCredential,
} from "../preflight.js";

describe("assertAgentCredential", () => {
  let saved: Record<string, string | undefined>;
  let emptyClaudeHome: string;
  let emptyCodexHome: string;
  let emptyPathDir: string;
  beforeEach(() => {
    saved = {
      ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN,
      OPENAI_API_KEY: process.env.OPENAI_API_KEY,
      CLAUDE_HOME: process.env.CLAUDE_HOME,
      CODEX_HOME: process.env.CODEX_HOME,
      PATH: process.env.PATH,
    };
    delete process.env.ANTHROPIC_AUTH_TOKEN;
    delete process.env.OPENAI_API_KEY;
    // Point CLAUDE_HOME / CODEX_HOME and PATH at empty tmp dirs so the
    // suite is hermetic — the dev running tests may have a real
    // ~/.codex/auth.json or `claude` on $PATH, which would cause
    // "no token" tests to incorrectly pass.
    emptyClaudeHome = mkdtempSync(join(tmpdir(), "deepsec-claude-home-"));
    emptyCodexHome = mkdtempSync(join(tmpdir(), "deepsec-codex-home-"));
    emptyPathDir = mkdtempSync(join(tmpdir(), "deepsec-empty-path-"));
    process.env.CLAUDE_HOME = emptyClaudeHome;
    process.env.CODEX_HOME = emptyCodexHome;
    process.env.PATH = emptyPathDir;
  });
  afterEach(() => {
    for (const [k, v] of Object.entries(saved)) {
      if (v === undefined) delete process.env[k];
      else process.env[k] = v;
    }
    rmSync(emptyClaudeHome, { recursive: true, force: true });
    rmSync(emptyCodexHome, { recursive: true, force: true });
    rmSync(emptyPathDir, { recursive: true, force: true });
  });

  it("passes for claude-agent-sdk when ANTHROPIC_AUTH_TOKEN is set", () => {
    process.env.ANTHROPIC_AUTH_TOKEN = "x";
    expect(() => assertAgentCredential("claude-agent-sdk")).not.toThrow();
  });

  it("throws actionable message for claude-agent-sdk when no token and no claude CLI", () => {
    expect(() => assertAgentCredential("claude-agent-sdk")).toThrow(/--agent claude/);
    expect(() => assertAgentCredential("claude-agent-sdk")).toThrow(/ANTHROPIC_AUTH_TOKEN/);
    expect(() => assertAgentCredential("claude-agent-sdk")).toThrow(/AI_GATEWAY_API_KEY/);
    expect(() => assertAgentCredential("claude-agent-sdk")).toThrow(
      /https:\/\/github\.com\/vercel-labs\/deepsec\/blob\/main\/docs\/vercel-setup\.md/,
    );
  });

  it("passes for claude-agent-sdk when `claude` is on PATH (subscription mode)", () => {
    writeFileSync(join(emptyPathDir, "claude"), "#!/bin/sh\n", { mode: 0o755 });
    expect(() => assertAgentCredential("claude-agent-sdk")).not.toThrow();
  });

  it("ignores claude subscription auth in sandbox mode", () => {
    writeFileSync(join(emptyPathDir, "claude"), "#!/bin/sh\n", { mode: 0o755 });
    expect(() => assertAgentCredential("claude-agent-sdk", { inSandbox: true })).toThrow(
      /AI_GATEWAY_API_KEY/,
    );
  });

  it("passes for codex when OPENAI_API_KEY is set", () => {
    process.env.OPENAI_API_KEY = "x";
    expect(() => assertAgentCredential("codex")).not.toThrow();
  });

  it("passes for codex when only ANTHROPIC token is set (gateway fallback)", () => {
    process.env.ANTHROPIC_AUTH_TOKEN = "x";
    expect(() => assertAgentCredential("codex")).not.toThrow();
  });

  it("passes for codex when ~/.codex/auth.json exists (subscription mode)", () => {
    writeFileSync(join(emptyCodexHome, "auth.json"), "{}");
    expect(() => assertAgentCredential("codex")).not.toThrow();
  });

  it("ignores codex subscription auth in sandbox mode", () => {
    writeFileSync(join(emptyCodexHome, "auth.json"), "{}");
    // With auth.json present, non-sandbox passes — sandbox still throws.
    expect(() => assertAgentCredential("codex")).not.toThrow();
    expect(() => assertAgentCredential("codex", { inSandbox: true })).toThrow(/OPENAI_API_KEY/);
  });

  it("does not let claude subscription unlock codex", () => {
    writeFileSync(join(emptyPathDir, "claude"), "#!/bin/sh\n", { mode: 0o755 });
    // No codex auth.json → still throws.
    expect(() => assertAgentCredential("codex")).toThrow(/OPENAI_API_KEY/);
    expect(() => assertAgentCredential("codex")).toThrow(/AI_GATEWAY_API_KEY/);
  });

  it("skips the credential check for custom plugin agents", () => {
    // Tests use this so a stub agent registered via plugins[] doesn't
    // require fake ANTHROPIC_AUTH_TOKEN env vars.
    expect(() => assertAgentCredential("stub")).not.toThrow();
    expect(() => assertAgentCredential("anything-else")).not.toThrow();
  });
});

describe("assertSandboxCredential", () => {
  let saved: Record<string, string | undefined>;
  beforeEach(() => {
    saved = {
      VERCEL_OIDC_TOKEN: process.env.VERCEL_OIDC_TOKEN,
      VERCEL_TOKEN: process.env.VERCEL_TOKEN,
      VERCEL_TEAM_ID: process.env.VERCEL_TEAM_ID,
      VERCEL_PROJECT_ID: process.env.VERCEL_PROJECT_ID,
    };
    for (const k of Object.keys(saved)) delete process.env[k];
  });
  afterEach(() => {
    for (const [k, v] of Object.entries(saved)) {
      if (v === undefined) delete process.env[k];
      else process.env[k] = v;
    }
  });

  it("passes when OIDC token is set", () => {
    process.env.VERCEL_OIDC_TOKEN = "x";
    expect(() => assertSandboxCredential()).not.toThrow();
  });

  it("passes when access-token triple is set", () => {
    process.env.VERCEL_TOKEN = "x";
    process.env.VERCEL_TEAM_ID = "team_x";
    process.env.VERCEL_PROJECT_ID = "prj_x";
    expect(() => assertSandboxCredential()).not.toThrow();
  });

  it("throws actionable message when nothing is set", () => {
    expect(() => assertSandboxCredential()).toThrow(/vercel link/);
    expect(() => assertSandboxCredential()).toThrow(/VERCEL_OIDC_TOKEN/);
    expect(() => assertSandboxCredential()).toThrow(
      /https:\/\/github\.com\/vercel-labs\/deepsec\/blob\/main\/docs\/vercel-setup\.md/,
    );
  });

  it("names every missing access-token piece", () => {
    process.env.VERCEL_TOKEN = "x";
    expect(() => assertSandboxCredential()).toThrow(/VERCEL_TEAM_ID, VERCEL_PROJECT_ID/);
  });
});

describe("applyAiGatewayDefaults", () => {
  let saved: Record<string, string | undefined>;
  beforeEach(() => {
    saved = {
      AI_GATEWAY_API_KEY: process.env.AI_GATEWAY_API_KEY,
      VERCEL_OIDC_TOKEN: process.env.VERCEL_OIDC_TOKEN,
      ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN,
      OPENAI_API_KEY: process.env.OPENAI_API_KEY,
      ANTHROPIC_BASE_URL: process.env.ANTHROPIC_BASE_URL,
      OPENAI_BASE_URL: process.env.OPENAI_BASE_URL,
    };
    for (const k of Object.keys(saved)) delete process.env[k];
  });
  afterEach(() => {
    for (const [k, v] of Object.entries(saved)) {
      if (v === undefined) delete process.env[k];
      else process.env[k] = v;
    }
  });

  it("does nothing when AI_GATEWAY_API_KEY is unset", async () => {
    await applyAiGatewayDefaults();
    expect(process.env.ANTHROPIC_AUTH_TOKEN).toBeUndefined();
    expect(process.env.OPENAI_API_KEY).toBeUndefined();
    expect(process.env.ANTHROPIC_BASE_URL).toBeUndefined();
    expect(process.env.OPENAI_BASE_URL).toBeUndefined();
  });

  it("populates all four vars from AI_GATEWAY_API_KEY", async () => {
    process.env.AI_GATEWAY_API_KEY = "gw-key";
    await applyAiGatewayDefaults();
    expect(process.env.ANTHROPIC_AUTH_TOKEN).toBe("gw-key");
    expect(process.env.OPENAI_API_KEY).toBe("gw-key");
    expect(process.env.ANTHROPIC_BASE_URL).toBe("https://ai-gateway.vercel.sh");
    expect(process.env.OPENAI_BASE_URL).toBe("https://ai-gateway.vercel.sh/v1");
  });

  it("does not overwrite explicit ANTHROPIC_AUTH_TOKEN", async () => {
    process.env.AI_GATEWAY_API_KEY = "gw-key";
    process.env.ANTHROPIC_AUTH_TOKEN = "explicit-anthropic";
    await applyAiGatewayDefaults();
    expect(process.env.ANTHROPIC_AUTH_TOKEN).toBe("explicit-anthropic");
    expect(process.env.OPENAI_API_KEY).toBe("gw-key");
  });

  it("does not overwrite an explicit ANTHROPIC_BASE_URL pointing direct-to-provider", async () => {
    process.env.AI_GATEWAY_API_KEY = "gw-key";
    process.env.ANTHROPIC_BASE_URL = "https://api.anthropic.com";
    await applyAiGatewayDefaults();
    expect(process.env.ANTHROPIC_BASE_URL).toBe("https://api.anthropic.com");
    expect(process.env.OPENAI_BASE_URL).toBe("https://ai-gateway.vercel.sh/v1");
  });

  it("falls back to VERCEL_OIDC_TOKEN when AI_GATEWAY_API_KEY is unset", async () => {
    process.env.VERCEL_OIDC_TOKEN = "oidc-tok";
    await applyAiGatewayDefaults();
    expect(process.env.AI_GATEWAY_API_KEY).toBe("oidc-tok");
    expect(process.env.ANTHROPIC_AUTH_TOKEN).toBe("oidc-tok");
    expect(process.env.OPENAI_API_KEY).toBe("oidc-tok");
    expect(process.env.ANTHROPIC_BASE_URL).toBe("https://ai-gateway.vercel.sh");
    expect(process.env.OPENAI_BASE_URL).toBe("https://ai-gateway.vercel.sh/v1");
  });

  it("does not invoke @vercel/oidc when no VERCEL_OIDC_TOKEN is in env", async () => {
    // Guard against the library walking up from cwd looking for a parent
    // `.vercel/project.json`. Without VERCEL_OIDC_TOKEN as the explicit
    // opt-in, we leave AI_GATEWAY_API_KEY unset and fall through to the
    // claude/codex subscription path.
    let invoked = false;
    const oidcModule = await import("@vercel/oidc");
    const spy = vi.spyOn(oidcModule, "getVercelOidcToken").mockImplementation(async () => {
      invoked = true;
      return "should-not-be-used";
    });
    await applyAiGatewayDefaults();
    expect(invoked).toBe(false);
    expect(process.env.AI_GATEWAY_API_KEY).toBeUndefined();
    expect(process.env.ANTHROPIC_AUTH_TOKEN).toBeUndefined();
    expect(process.env.ANTHROPIC_BASE_URL).toBeUndefined();
    spy.mockRestore();
  });

  it("prefers an explicit AI_GATEWAY_API_KEY over VERCEL_OIDC_TOKEN", async () => {
    process.env.AI_GATEWAY_API_KEY = "gw-key";
    process.env.VERCEL_OIDC_TOKEN = "oidc-tok";
    await applyAiGatewayDefaults();
    expect(process.env.AI_GATEWAY_API_KEY).toBe("gw-key");
    expect(process.env.ANTHROPIC_AUTH_TOKEN).toBe("gw-key");
    expect(process.env.OPENAI_API_KEY).toBe("gw-key");
  });
});

import { defineConfig, setLoadedConfig } from "@deepsec/core";
import { afterEach, describe, expect, it } from "vitest";
import { resolveAgentType } from "../resolve-agent-type.js";

describe("resolveAgentType", () => {
  afterEach(() => {
    setLoadedConfig(defineConfig({ projects: [] }));
  });

  it("accepts the legacy claude-agent-sdk value", () => {
    setLoadedConfig(defineConfig({ projects: [], defaultAgent: "codex" }));
    expect(resolveAgentType("claude-agent-sdk")).toBe("claude-agent-sdk");
  });

  it("aliases claude to claude-agent-sdk", () => {
    expect(resolveAgentType("claude")).toBe("claude-agent-sdk");
  });

  it("aliases claude from defaultAgent config", () => {
    setLoadedConfig(defineConfig({ projects: [], defaultAgent: "claude" }));
    expect(resolveAgentType(undefined)).toBe("claude-agent-sdk");
  });

  it("falls back to defaultAgent from config when not provided", () => {
    setLoadedConfig(defineConfig({ projects: [], defaultAgent: "codex" }));
    expect(resolveAgentType(undefined)).toBe("codex");
  });

  it("falls back to codex when neither is set", () => {
    setLoadedConfig(defineConfig({ projects: [] }));
    expect(resolveAgentType(undefined)).toBe("codex");
  });
});

import { defineConfig, setLoadedConfig } from "@deepsec/core";
import { afterEach, describe, expect, it } from "vitest";
import { resolveProjectId } from "../resolve-project-id.js";

describe("resolveProjectId", () => {
  afterEach(() => {
    setLoadedConfig(defineConfig({ projects: [] }));
  });

  it("returns the user-provided id when given", () => {
    setLoadedConfig(
      defineConfig({
        projects: [
          { id: "alpha", root: "/tmp/a" },
          { id: "beta", root: "/tmp/b" },
        ],
      }),
    );
    expect(resolveProjectId("beta")).toBe("beta");
    expect(resolveProjectId("anything")).toBe("anything");
  });

  it("auto-resolves to the only project when config has exactly one", () => {
    setLoadedConfig(defineConfig({ projects: [{ id: "lone", root: "/tmp/l" }] }));
    expect(resolveProjectId(undefined)).toBe("lone");
  });

  it("throws with all ids listed when config has multiple projects", () => {
    setLoadedConfig(
      defineConfig({
        projects: [
          { id: "alpha", root: "/a" },
          { id: "beta", root: "/b" },
          { id: "gamma", root: "/g" },
        ],
      }),
    );
    expect(() => resolveProjectId(undefined)).toThrow(/alpha, beta, gamma/);
    expect(() => resolveProjectId(undefined)).toThrow(/Pass --project-id/);
  });

  it("throws with init guidance when config has no projects", () => {
    setLoadedConfig(defineConfig({ projects: [] }));
    expect(() => resolveProjectId(undefined)).toThrow(/no projects found/);
    expect(() => resolveProjectId(undefined)).toThrow(/deepsec init/);
  });
});

import { execSync } from "node:child_process";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import * as tar from "tar";
import { afterEach, beforeEach, describe, expect, it } from "vitest";
import { extractTarballLocally } from "../sandbox/download.js";
import { makeTarball } from "../sandbox/upload.js";

describe("makeTarball — symlink filtering (git branch)", () => {
  let tmp: string;
  const createdTars: string[] = [];

  beforeEach(() => {
    tmp = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-upload-"));
  });

  afterEach(() => {
    fs.rmSync(tmp, { recursive: true, force: true });
    for (const p of createdTars.splice(0)) {
      try {
        fs.unlinkSync(p);
      } catch {}
    }
  });

  it("git: skips symlinks while archiving regular files", async () => {
    // `git init` is enough to put makeTarball on the git branch.
    // No commit is required: `git ls-files --others --exclude-standard`
    // reports untracked-not-ignored files, which is what the upload
    // path actually relies on. Avoiding `git commit` also avoids
    // triggering GPG-signing prompts on dev machines that have
    // `commit.gpgsign=true` set globally.
    execSync("git init -q", { cwd: tmp });

    fs.writeFileSync(path.join(tmp, "ok.json"), '{"v":1}');
    fs.symlinkSync("/etc/passwd", path.join(tmp, "evil.link"));

    const stats = await makeTarball(tmp, []);
    createdTars.push(stats.tarPath);
    const entries = await listTarballEntriesFromFile(stats.tarPath);

    expect(entries.some((e) => e.path.endsWith("ok.json") && e.type === "File")).toBe(true);
    expect(entries.some((e) => e.path.includes("evil.link"))).toBe(false);
    expect(entries.some((e) => e.type === "SymbolicLink")).toBe(false);
  });

  it("returns bytes matching the on-disk tarball size", async () => {
    execSync("git init -q", { cwd: tmp });
    fs.writeFileSync(path.join(tmp, "a.json"), "{}");
    const stats = await makeTarball(tmp, []);
    createdTars.push(stats.tarPath);
    expect(fs.statSync(stats.tarPath).size).toBe(stats.bytes);
  });
});

describe("extractTarballLocally — strict allowlist", () => {
  let tarballDir: string;
  let destDir: string;

  beforeEach(() => {
    tarballDir = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-extract-src-"));
    destDir = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-extract-dst-"));
  });

  afterEach(() => {
    fs.rmSync(tarballDir, { recursive: true, force: true });
    fs.rmSync(destDir, { recursive: true, force: true });
  });

  it("accepts a tarball of allowed extensions in legitimate namespaces", async () => {
    const src = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-tar-good-"));
    fs.mkdirSync(path.join(src, "files"));
    fs.mkdirSync(path.join(src, "reports"));
    // Valid FileRecord — the post-extract merge validates against schema
    // and would otherwise drop the record as spoofed.
    fs.writeFileSync(
      path.join(src, "files", "record.ts.json"),
      JSON.stringify(validRecord(path.basename(destDir), "record.ts")),
    );
    fs.writeFileSync(path.join(src, "reports", "report.md"), "# r");
    const stats = await makeTarball(src, []);
    fs.rmSync(src, { recursive: true, force: true });

    const count = await extractTarballLocally(stats.tarPath, destDir);
    fs.unlinkSync(stats.tarPath);
    expect(count).toBe(2);
    expect(fs.existsSync(path.join(destDir, "files", "record.ts.json"))).toBe(true);
    expect(fs.existsSync(path.join(destDir, "reports", "report.md"))).toBe(true);
  });

  it("accepts parse-failure debug dumps under debug/*.txt", async () => {
    const src = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-tar-debug-"));
    fs.mkdirSync(path.join(src, "debug"));
    fs.writeFileSync(
      path.join(src, "debug", "parse-error-investigate-2026-01-01T00-00-00-000Z.txt"),
      "not actually json {",
    );
    const stats = await makeTarball(src, []);
    fs.rmSync(src, { recursive: true, force: true });

    const count = await extractTarballLocally(stats.tarPath, destDir);
    fs.unlinkSync(stats.tarPath);
    expect(count).toBe(1);
    expect(
      fs.existsSync(
        path.join(destDir, "debug", "parse-error-investigate-2026-01-01T00-00-00-000Z.txt"),
      ),
    ).toBe(true);
  });

  it("refuses a tarball with a disallowed extension and writes nothing", async () => {
    const src = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-tar-bad-"));
    fs.mkdirSync(path.join(src, "files"));
    fs.writeFileSync(
      path.join(src, "files", "record.ts.json"),
      JSON.stringify(validRecord(path.basename(destDir), "record.ts")),
    );
    // `.sh` is outside the allowlist (.json/.md/.csv/.txt). Plain `.txt`
    // is now allowed for parse-failure debug dumps, so we pick an
    // extension that's still rejected for the extension check itself.
    fs.writeFileSync(path.join(src, "files", "secret.sh"), "uh oh");
    const stats = await makeTarball(src, []);
    fs.rmSync(src, { recursive: true, force: true });

    await expect(extractTarballLocally(stats.tarPath, destDir)).rejects.toThrow(/extension/);
    fs.unlinkSync(stats.tarPath);
    // All-or-nothing: even the otherwise-allowed record must not land.
    expect(fs.readdirSync(destDir)).toEqual([]);
  });

  it("refuses a tarball whose entry sits outside files/ runs/ reports/", async () => {
    const src = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-tar-ns-"));
    // top-level project.json is the canonical attack — overwriting it
    // poisons rootPath for the next CLI run.
    fs.writeFileSync(path.join(src, "project.json"), '{"rootPath":"/etc"}');
    const stats = await makeTarball(src, []);
    fs.rmSync(src, { recursive: true, force: true });

    await expect(extractTarballLocally(stats.tarPath, destDir)).rejects.toThrow(
      /outside files\/, runs\/, reports\//,
    );
    fs.unlinkSync(stats.tarPath);
    expect(fs.readdirSync(destDir)).toEqual([]);
  });

  it("accepts paths with framework-special characters (Next.js dynamic routes, etc.)", async () => {
    // Repro for the path-validator bug: `[A-Za-z0-9._-]` rejected
    // `[...slug]`, `(group)`, `@modal`, parens, spaces, plus signs —
    // any path that valid Next.js / SvelteKit / Astro repos routinely
    // use. The allowed char class is now `[^/\\\0]+`, which covers
    // these while tar.strict + the explicit segment check still block
    // traversal.
    const projectId = path.basename(destDir);
    const fixtures: { rel: string; nested: string[] }[] = [
      { rel: "files/app/v4/[...slug]/route.ts.json", nested: ["app", "v4", "[...slug]"] },
      { rel: "files/app/[id]/page.tsx.json", nested: ["app", "[id]"] },
      { rel: "files/app/[[...slug]]/route.ts.json", nested: ["app", "[[...slug]]"] },
      { rel: "files/app/(public)/about/page.tsx.json", nested: ["app", "(public)", "about"] },
      { rel: "files/app/@modal/page.tsx.json", nested: ["app", "@modal"] },
    ];

    const src = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-tar-special-"));
    fs.mkdirSync(path.join(src, "files"));
    for (const f of fixtures) {
      fs.mkdirSync(path.join(src, "files", ...f.nested), { recursive: true });
      const filename = f.rel.split("/").pop()!;
      fs.writeFileSync(
        path.join(src, "files", ...f.nested, filename),
        JSON.stringify(
          validRecord(projectId, f.rel.replace(/^files\//, "").replace(/\.json$/, "")),
        ),
      );
    }
    const stats = await makeTarball(src, []);
    fs.rmSync(src, { recursive: true, force: true });

    const count = await extractTarballLocally(stats.tarPath, destDir);
    fs.unlinkSync(stats.tarPath);
    expect(count).toBe(fixtures.length);
    for (const f of fixtures) {
      expect(fs.existsSync(path.join(destDir, f.rel))).toBe(true);
    }
  });

  it("rejects entries containing '..' segments even though the char class is permissive", async () => {
    // The relaxed char class `[^/\\\0]+` would textually permit a literal
    // ".." segment. tar.strict catches it — but we also have an explicit
    // segment-level reject so this remains belt-and-suspenders if tar's
    // default strictness ever changes. We can't easily produce a tarball
    // with a `..` entry (tar refuses to write those), so we exercise the
    // path directly via the extractor by handcrafting an entry — covered
    // implicitly by the existing strict-namespace test which would also
    // catch the same shape. This test documents the intent.
    expect("files/../etc/passwd.json".split("/").includes("..")).toBe(true);
  });

  it("refuses a tarball containing a symlink entry", async () => {
    // Build a tarball directly via tar.create that intentionally
    // includes a symlink — bypassing makeTarball's own filter — so
    // we exercise the download-side strict filter in isolation.
    const src = fs.mkdtempSync(path.join(os.tmpdir(), "deepsec-tar-sym-"));
    fs.mkdirSync(path.join(src, "files"));
    fs.writeFileSync(path.join(src, "files", "record.ts.json"), '{"v":1}');
    fs.symlinkSync("/etc/passwd", path.join(src, "files", "leak.ts.json"));
    const tarPath = path.join(tarballDir, "in.tgz");
    await tar.create({ gzip: true, cwd: src, file: tarPath, portable: true }, [
      "files/record.ts.json",
      "files/leak.ts.json",
    ]);
    fs.rmSync(src, { recursive: true, force: true });

    await expect(extractTarballLocally(tarPath, destDir)).rejects.toThrow(/SymbolicLink|type/);
  });
});

async function listTarballEntriesFromFile(
  tarPath: string,
): Promise<{ path: string; type: string }[]> {
  const entries: { path: string; type: string }[] = [];
  await tar.list({
    file: tarPath,
    onentry: (e) => entries.push({ path: e.path, type: e.type as string }),
  });
  return entries;
}

function validRecord(projectId: string, filePath: string): unknown {
  return {
    filePath,
    projectId,
    candidates: [],
    lastScannedAt: "2026-05-06T00:00:00.000Z",
    lastScannedRunId: "scan1",
    fileHash: "h",
    findings: [],
    analysisHistory: [],
    status: "pending",
  };
}