keyhog 0.5.38

//! Logic for the `scan` subcommand.
//!
//! Default: build a [`ScanOrchestrator`] and run the full in-process
//! pipeline. For the simple stdin / single-file case there is also a
//! daemon fast path: when `--daemon` is set (or auto-detected via a
//! live socket), the input goes through the running `keyhog daemon`
//! over a Unix socket and skips the ~3 s `CompiledScanner::compile`
//! cold start. The daemon path is deliberately narrow - directory
//! walks, git-staged scans, archive decoding, baseline filtering,
//! merkle skip cache, and verification all still go through the
//! orchestrator. Anything outside the stdin / single-file shape
//! falls through to in-process and the `--daemon` flag is treated as
//! advisory in those cases.

use crate::args::ScanArgs;
// Daemon module is unix-only - Windows has no `tokio::net::UnixListener`
// or `std::os::unix::net::UnixStream`, so the whole `crate::daemon`
// subtree is `#[cfg(unix)]`. See `lib.rs` for the rationale. On
// Windows, the `--daemon` flag and the daemon auto-route in
// `daemon_route` short-circuit to `Forbidden` (or emit a clear
// "daemon is unix-only" error if the user explicitly passed
// `--daemon`).
#[cfg(unix)]
use crate::daemon::client;
#[cfg(unix)]
use crate::daemon::protocol::{Request, Response};
#[cfg(unix)]
use crate::daemon::server::default_socket_path;
use crate::orchestrator::ScanOrchestrator;
use anyhow::{bail, Result};
// The daemon-only result-massaging path (unwrap_scan_results,
// finalize_for_report) is the only consumer of `RawMatch` /
// `VerifiedFinding` / the dedup helpers in this file. The
// in-process orchestrator path handles its own conversion inside
// `ScanOrchestrator::run`. Cfg-gate the imports so Windows builds
// don't trip the unused-imports denial.
#[cfg(unix)]
use anyhow::Context;
#[cfg(unix)]
use keyhog_core::{
    dedup_cross_detector, dedup_matches, RawMatch, RuleSuppressor, VerificationResult,
    VerifiedFinding,
};
#[cfg(unix)]
use std::path::{Path, PathBuf};
use std::process::ExitCode;

#[cfg(unix)]
const EXIT_CREDENTIALS_FOUND: u8 = 1;

pub async fn run(args: ScanArgs) -> Result<ExitCode> {
    // On Windows, the daemon route is never available (the `crate::daemon`
    // module is cfg(unix)). If the user explicitly passed `--daemon`,
    // refuse loudly so they don't silently get the in-process path; if
    // they didn't, fall straight through to the orchestrator.
    #[cfg(not(unix))]
    {
        if args.daemon {
            bail!(
                "`--daemon` is a unix-only flag (the daemon serves scans \
                 over a Unix-domain socket). Drop the flag to run \
                 in-process, or pass `--no-daemon` to be explicit."
            );
        }
        let orchestrator = ScanOrchestrator::new(args)?;
        return orchestrator.run().await;
    }
    // Resolve the routing-relevant `.keyhog.toml` policy BEFORE deciding the
    // route. The orchestrator's `.keyhog.toml` merge runs LATER (inside
    // `ScanOrchestrator::new`) and only on the in-process path, so a policy set
    // via the config file rather than a CLI flag was invisible to
    // `daemon_route` — letting a config min_confidence floor, a config
    // `[lockdown] require = true` fail-closed guard, or a config
    // `show_secrets` be silently bypassed whenever a daemon happened to be
    // live. Merge onto a throwaway clone so the real `args` the orchestrator
    // consumes is untouched (it re-merges identically), then route on the
    // EFFECTIVE values.
    #[cfg(unix)]
    let policy = EffectivePolicy::resolve(&args);
    #[cfg(unix)]
    match daemon_route(&args, &policy) {
        DaemonRoute::Required => run_via_daemon(&args).await,
        DaemonRoute::Opportunistic => match run_via_daemon(&args).await {
            Ok(exit) => Ok(exit),
            Err(e) => {
                tracing::debug!(
                    error = %e,
                    "daemon auto-route unavailable; falling back to in-process scanner"
                );
                let orchestrator = ScanOrchestrator::new(args)?;
                orchestrator.run().await
            }
        },
        DaemonRoute::Forbidden => {
            let orchestrator = ScanOrchestrator::new(args)?;
            orchestrator.run().await
        }
    }
}

#[cfg(unix)]
enum DaemonRoute {
    Required,
    Opportunistic,
    Forbidden,
}

/// The routing-relevant policy AFTER merging `.keyhog.toml`, so the daemon
/// route decision sees config-file values (not just raw CLI flags). Built by
/// merging a throwaway clone of `ScanArgs` through the same
/// [`crate::config::apply_config_file`] the orchestrator uses, so the
/// effective floor / lockdown-require / secret-output policy is identical to
/// what the in-process path will enforce.
#[cfg(unix)]
struct EffectivePolicy {
    /// `min_confidence` after the config merge (CLI flag OR `.keyhog.toml` /
    /// `[scan]` floor). When `Some`, the daemon's floor-less finalize would
    /// surface findings the in-process path suppresses, so force in-process.
    min_confidence: Option<f64>,
    /// `show_secrets` after the merge (CLI flag OR `.keyhog.toml`). The daemon
    /// finalize redacts unconditionally, so a config-driven value would render
    /// credentials differently by route.
    show_secrets: bool,
    /// Minimum-severity filter after the merge (CLI flag OR `.keyhog.toml`).
    severity: bool,
    /// `[lockdown] require = true` from `.keyhog.toml`: a fail-closed control
    /// the daemon cannot enforce. Forces in-process so the orchestrator's
    /// `bail!` fires when `--lockdown` was not passed.
    require_lockdown: bool,
}

#[cfg(unix)]
impl EffectivePolicy {
    fn resolve(args: &ScanArgs) -> EffectivePolicy {
        let mut probe = args.clone();
        // Mirror `ScanOrchestrator::new`'s path normalization BEFORE the config
        // merge: the positional path binds to `input`, but config discovery
        // (`find_config_file`) walks up from `path`. Without promoting
        // `input` -> `path` here, `apply_config_file` would look in the CWD
        // instead of the scanned file's directory and miss the `.keyhog.toml`
        // whose policy we are trying to honour — the exact bug this resolves.
        if probe.path.is_none() {
            probe.path = probe.input.clone();
        }
        // Quiet (diagnostics-free) merge: this probe applies the config to a
        // throwaway clone only to read the resolved routing knobs. The real
        // orchestrator merge emits any read/parse warning exactly once; the loud
        // `apply_config_file` here would warn TWICE on a malformed `.keyhog.toml`
        // over the daemon route (HUNT-2).
        let outcome = crate::config::apply_config_file_quiet(&mut probe);
        EffectivePolicy {
            min_confidence: probe.min_confidence,
            show_secrets: probe.show_secrets,
            severity: probe.severity.is_some(),
            require_lockdown: outcome.require_lockdown,
        }
    }
}

#[cfg(unix)]
fn daemon_route(args: &ScanArgs, policy: &EffectivePolicy) -> DaemonRoute {
    if args.no_daemon {
        return DaemonRoute::Forbidden;
    }

    // Daemon path doesn't run verification - the daemon process
    // holds a scanner but not the verifier engine. Trying to honour
    // `--verify` over a daemon-only result set would silently drop
    // every API-call-backed live-credential check; the orchestrator
    // is the only honest answer.
    #[cfg(feature = "verify")]
    if args.verify {
        if args.daemon {
            tracing::warn!(
                "--verify forces the in-process path (daemon has no verifier); --daemon ignored"
            );
        }
        return DaemonRoute::Forbidden;
    }
    if args.baseline.is_some() {
        if args.daemon {
            tracing::warn!(
                "--baseline forces the in-process path (daemon has no CLI-side state); --daemon ignored"
            );
        }
        return DaemonRoute::Forbidden;
    }

    let is_eligible_shape = args.stdin || effective_single_file_path(args).is_some();
    if !is_eligible_shape {
        if args.daemon {
            tracing::warn!(
                "--daemon only supports --stdin or a single regular file (no directories, archives, git, http sources); falling back to in-process"
            );
        }
        return DaemonRoute::Forbidden;
    }

    // The daemon's client-side finalize (finalize_for_report) applies only
    // test-fixture suppression + dedup; it does NOT enforce the confidence floor,
    // --severity, --hide-client-safe, or the --lockdown contract (no mlock /
    // coredump block, and it would print plaintext under --show-secrets). Routing
    // a scan that requests any of those over the daemon would silently change
    // results or bypass a hard security guard — and the opportunistic route flips
    // on merely because a daemon socket exists. Force the in-process path whenever
    // such policy is in play, so behavior never depends on whether a daemon
    // happens to be running.
    //
    // Critically, the floor / lockdown-require / show_secrets / severity checks
    // read the EFFECTIVE post-`.keyhog.toml`-merge policy, not just the raw CLI
    // flags: a `.keyhog.toml` `min_confidence`, `[lockdown] require = true`, or
    // `show_secrets` set via the config file (with no matching CLI flag) must
    // forbid the daemon route too — otherwise scan RESULTS and a fail-closed
    // SECURITY GUARD would change purely on whether a daemon is live.
    // `hide_client_safe` has no config-file surface, so the CLI flag is the
    // effective value.
    if args.lockdown
        || policy.require_lockdown
        || policy.show_secrets
        || policy.severity
        || policy.min_confidence.is_some()
        || args.hide_client_safe
    {
        if args.daemon {
            tracing::warn!(
                "--daemon ignored: this scan requests filtering/lockdown/secret-output \
                 policy the daemon cannot enforce (CLI flag or .keyhog.toml); \
                 using the in-process path"
            );
        }
        return DaemonRoute::Forbidden;
    }

    if args.daemon {
        return DaemonRoute::Required;
    }

    if default_socket_path().exists() {
        DaemonRoute::Opportunistic
    } else {
        DaemonRoute::Forbidden
    }
}

#[cfg(unix)]
fn effective_single_file_path(args: &ScanArgs) -> Option<&Path> {
    let raw = args.path.as_deref().or(args.input.as_deref())?;
    let meta = std::fs::metadata(raw).ok()?;
    if !meta.is_file() {
        return None;
    }
    if raw
        .extension()
        .and_then(|e| e.to_str())
        .map(|e| e.eq_ignore_ascii_case("har"))
        .unwrap_or(false)
    {
        return None;
    }
    Some(raw)
}

#[cfg(unix)]
async fn run_via_daemon(args: &ScanArgs) -> Result<ExitCode> {
    let socket = default_socket_path();
    let mut conn = client::connect(&socket).await.with_context(|| {
        format!(
            "daemon route: connect to {} (start one with `keyhog daemon start` or pass --no-daemon)",
            socket.display()
        )
    })?;

    let matches = if args.stdin {
        let text = read_stdin_to_string()?;
        let resp = conn
            .round_trip(&Request::ScanText { path: None, text })
            .await?;
        unwrap_scan_results(resp)?
    } else if let Some(path) = effective_single_file_path(args) {
        let working_dir = std::env::current_dir()
            .ok()
            .map(|p| p.to_string_lossy().into_owned());
        let resp = conn
            .round_trip(&Request::ScanPath {
                path: path.to_string_lossy().into_owned(),
                working_dir,
            })
            .await?;
        unwrap_scan_results(resp)?
    } else {
        bail!(
            "daemon route requires either --stdin or a single file path. \
             For directory scans, pass `--no-daemon` to use the in-process scanner."
        );
    };

    let findings = finalize_for_report(matches, args);
    crate::reporting::report_findings(&findings, args)?;

    if findings.is_empty() {
        Ok(ExitCode::SUCCESS)
    } else {
        Ok(ExitCode::from(EXIT_CREDENTIALS_FOUND))
    }
}

#[cfg(unix)]
fn read_stdin_to_string() -> Result<String> {
    use std::io::Read;
    const STDIN_CAP_BYTES: usize = 10 * 1024 * 1024;
    let mut buf = Vec::with_capacity(8 * 1024);
    std::io::stdin()
        .lock()
        .take(STDIN_CAP_BYTES as u64 + 1)
        .read_to_end(&mut buf)
        .context("daemon route: reading stdin")?;
    if buf.len() > STDIN_CAP_BYTES {
        bail!(
            "daemon route: stdin exceeds {STDIN_CAP_BYTES} byte limit. \
             Drop `--daemon` to use the streaming in-process path."
        );
    }
    Ok(String::from_utf8_lossy(&buf).into_owned())
}

#[cfg(unix)]
fn unwrap_scan_results(resp: Response) -> Result<Vec<RawMatch>> {
    match resp {
        Response::ScanResults {
            matches,
            engine_example_suppressions,
            dogfood_events,
            ..
        } => {
            // Merge daemon-side telemetry into the CLI's process-local
            // counters. The reporter and `dump_dogfood_trace()` both
            // read these, so without the merge the count would stay
            // at 0 (the OnceLock cell here is distinct from the
            // daemon's). Wire v2 is what makes this field non-zero;
            // a v1 daemon returns the serde defaults and the merge
            // is a no-op.
            if engine_example_suppressions > 0 {
                keyhog_scanner::telemetry::add_example_suppressions(
                    engine_example_suppressions as usize,
                );
            }
            if !dogfood_events.is_empty() {
                keyhog_scanner::telemetry::append_events(dogfood_events);
            }
            Ok(matches)
        }
        Response::Error { message } => bail!("daemon: {message}"),
        other => bail!("daemon route: expected ScanResults, got {other:?}"),
    }
}

#[cfg(unix)]
fn finalize_for_report(matches: Vec<RawMatch>, args: &ScanArgs) -> Vec<VerifiedFinding> {
    // Test-fixture suppression mirrors the orchestrator's
    // pipeline_tests::* filter: known-public example credentials
    // (Stripe's sk_live_4eC39…, GitHub's ghp_… README sample, …) get
    // suppressed unless the user explicitly opts out with
    // --no-suppress-test-fixtures.
    let fixtures = if args.no_suppress_test_fixtures {
        crate::test_fixture_suppressions::TestFixtureSuppressions::empty()
    } else {
        crate::test_fixture_suppressions::TestFixtureSuppressions::bundled()
    };

    // The daemon process runs only the scanner: it does NOT load the
    // CLI-side `.keyhogignore` allowlist, the `.keyhogignore.toml`
    // declarative rule suppressor, or apply inline `keyhog:ignore`
    // comment directives. The in-process orchestrator applies all three
    // (`filter_and_resolve` + the rule-suppressor pass in `run.rs`).
    // Without replicating them here, routing an eligible single-file or
    // stdin scan over the daemon would silently un-suppress findings the
    // user explicitly allowlisted - results that change purely because a
    // daemon socket happens to be live. Anchor the allowlist files at the
    // same root the orchestrator uses: the scanned path's directory, or
    // "." for the stdin / bare-filename case.
    let allowlist = load_daemon_allowlist(args);

    // Mirror the in-process orchestrator's behaviour: when the
    // test-fixture filter drops a credential, bump the example-suppression
    // telemetry so the reporter's empty-findings summary distinguishes "no
    // matches at all" from "matched and suppressed as a known test
    // fixture". The daemon process runs its own scanner (with its own
    // telemetry counters that this CLI can't see), so the CLI must record
    // the suppression itself based on what came back over the wire.
    let mut matches: Vec<RawMatch> = matches
        .into_iter()
        .filter(|m| {
            if fixtures.suppresses(&m.credential) {
                keyhog_scanner::telemetry::record_example_suppression(
                    m.detector_id.as_ref(),
                    m.location.file_path.as_deref(),
                    &m.credential,
                    "test_fixture_suppression",
                );
                return false;
            }
            // `.keyhogignore` legacy line-based allowlist: path globs,
            // credential-hash entries, and whole-detector ignores. Same
            // predicates the orchestrator runs in `filter_and_resolve`.
            if let Some(path) = m.location.file_path.as_deref() {
                if allowlist.is_path_ignored(path) {
                    return false;
                }
            }
            if allowlist.is_hash_ignored(&m.credential_hash) {
                return false;
            }
            if allowlist.ignored_detectors.contains(&*m.detector_id) {
                return false;
            }
            true
        })
        .collect();

    // Inline `keyhog:ignore` / `gitleaks:allow` comment suppression. The
    // shared filter only acts on matches whose source is "filesystem"
    // (it re-opens `file_path` to read the directive line); daemon
    // `ScanPath` matches carry the daemon's own `source_type`
    // ("daemon/scan_path"), so normalise filesystem-backed matches to the
    // "filesystem" source before the call. A daemon single-file scan IS a
    // filesystem read, and `file_path` points at the real on-disk file,
    // so this is the same suppression the in-process path performs.
    // stdin/`ScanText` matches have no `file_path` and are left untouched
    // by the filter regardless of source.
    for m in &mut matches {
        if m.location.file_path.is_some() && m.location.source.as_ref() != "filesystem" {
            m.location.source = std::sync::Arc::from("filesystem");
        }
    }
    let mut matches = crate::inline_suppression::filter_inline_suppressions(matches);

    matches.sort_by_key(|m| std::cmp::Reverse(m.severity));

    let scope = args.dedup.to_core();
    let deduped = dedup_matches(matches, &scope);
    let deduped = dedup_cross_detector(deduped);

    let findings: Vec<VerifiedFinding> = deduped
        .into_iter()
        .map(|m| VerifiedFinding {
            detector_id: m.detector_id,
            detector_name: m.detector_name,
            service: m.service,
            severity: m.severity,
            credential_redacted: if args.show_secrets {
                m.credential.to_string().into()
            } else {
                keyhog_core::redact(&m.credential)
            },
            credential_hash: m.credential_hash,
            location: m.primary_location,
            verification: VerificationResult::Skipped,
            // Same offline structural evidence the in-process finalize attaches
            // (JWT alg=none anomaly + alg/iss/sub/aud/exp claims, and the
            // offline-decoded AWS account ID), so neither diverges on the
            // daemon route. One shared helper keeps every route in lockstep.
            metadata: crate::orchestrator::offline_finding_metadata(&m.credential),
            additional_locations: m.additional_locations,
            confidence: m.confidence,
        })
        .collect();

    // `.keyhogignore.toml` declarative rule suppressor (vyre rule engine).
    // The orchestrator applies this AFTER dedup on the final
    // `VerifiedFinding` set (see `orchestrator::run`), so we match that
    // ordering exactly. A missing/empty file is a no-op.
    let rule_suppressor = load_daemon_rule_suppressor(args);
    if rule_suppressor.is_empty() {
        return findings;
    }
    findings
        .into_iter()
        .filter(|f| !rule_suppressor.matches(f))
        .collect()
}

/// Resolve the directory used to discover `.keyhogignore` /
/// `.keyhogignore.toml` for a daemon-routed scan. Mirrors
/// `orchestrator::allowlist::allowlist_root`: a scanned directory is its
/// own root, a scanned file delegates to its parent, and the stdin /
/// bare-filename case falls back to ".".
#[cfg(unix)]
fn daemon_allowlist_root(args: &ScanArgs) -> PathBuf {
    let Some(path) = args.path.as_deref().or(args.input.as_deref()) else {
        return PathBuf::from(".");
    };
    if path.is_dir() {
        return path.to_path_buf();
    }
    path.parent()
        .filter(|p| !p.as_os_str().is_empty())
        .map(Path::to_path_buf)
        .unwrap_or_else(|| PathBuf::from("."))
}

/// Load the legacy line-based `.keyhogignore` allowlist for the daemon
/// route. Returns an empty allowlist when the file is missing or fails to
/// parse, matching `orchestrator::allowlist::load_allowlist`.
#[cfg(unix)]
fn load_daemon_allowlist(args: &ScanArgs) -> keyhog_core::allowlist::Allowlist {
    let ignore_path = daemon_allowlist_root(args).join(".keyhogignore");
    if ignore_path.exists() {
        keyhog_core::allowlist::Allowlist::load(&ignore_path)
            .unwrap_or_else(|_| keyhog_core::allowlist::Allowlist::empty())
    } else {
        keyhog_core::allowlist::Allowlist::empty()
    }
}

/// Load the declarative `.keyhogignore.toml` rule suppressor for the
/// daemon route. A malformed file is logged and treated as empty so a
/// bad rules file never silently blocks a scan - same posture as
/// `orchestrator::allowlist::load_rule_suppressor`.
#[cfg(unix)]
fn load_daemon_rule_suppressor(args: &ScanArgs) -> RuleSuppressor {
    let toml_path = daemon_allowlist_root(args).join(".keyhogignore.toml");
    match RuleSuppressor::load(&toml_path) {
        Ok(s) => s,
        Err(e) => {
            tracing::warn!(
                file = %toml_path.display(),
                error = %e,
                "daemon route: failed to load .keyhogignore.toml; ignoring rules. \
                 Fix: validate the TOML schema (see docs/keyhogignore-toml.md)."
            );
            RuleSuppressor::empty()
        }
    }
}