sonda 0.1.0

The first release. sonda analyzes JavaScript and TypeScript, Python, Java,
C# and C/C++ for bugs, vulnerabilities and code smells, with SonarQube's
rules as its reference, and measures complexity, duplication, coverage and
technical debt, judged by a quality gate. It runs as a CLI, locally or in
CI, and as a server that keeps analyses, tracks and triages issues across
them, and decorates GitHub pull requests. scripts/setup-server.sh starts
the server with Docker Compose; the CLI for Linux is attached to this
release. Before 1.0, minor versions may change what
docs/release-1.0.md will make stable.

Added

• sonda scan analyzes JavaScript/TypeScript, Python, Java, C/C++ and C#
  (ADR-0015) for bugs, vulnerabilities and code
  smells. docs/rules.md lists every rule, with
  noncompliant and compliant examples.

• Metrics: lines of code, comment lines, functions, cyclomatic and cognitive
  complexity, technical debt, and cross-file duplication.

• LCOV coverage import (--coverage).

• New-code detection against a git reference (--new-code), with every
  metric reported both overall and on new code.

• A configurable quality gate ([[gate.conditions]]). Exit codes: 0 when the
  gate passes, 1 when it fails, 2 on errors.

• Text, JSON and SARIF 2.1.0 reports; --only-new lists only new issues.

• Suppression comments: NOSONAR, sonda-ignore and
  sonda-ignore: rule-id, ....

• sonda rules and sonda init commands.

• -v/-vv/-vvv (or RUST_LOG) for structured logs on stderr: phase
  timings, counts, and skipped files.

• A library API in the sonda-core crate: sonda_core::run,
  sonda_core::load_config, and sonda_core::Error. The sonda crate is
  the CLI.

• Files are parsed in worker processes (ADR-0003), so a crash in a
  tree-sitter grammar costs only that file. --no-isolation parses
  in-process; --jobs N limits parallelism. Overhead measured at +6% on
  29k lines and +1% on 1M lines.

• Analysis workers sandbox themselves (ADR-0004): a seccomp allow-list on
  Linux and Seatbelt on macOS, plus no core dumps and no new file
  descriptors. --sandbox best-effort|require|off.

• Rule queries are compiled per language on first use, which made scans of
  a 29k-line JavaScript/C project 40% faster.

• Web app preview (web/): Overview, Issues and Rules screens from the
  design handoff, on a typed API contract with mock data. Supply chain: no
  package version younger than 14 days, and pnpm audit runs in CI.

• Fuzz targets for analysis in every grammar and for config parsing, run
  weekly in CI with the C grammars instrumented by AddressSanitizer.

• Report fields for tracking issues across scans (ADR-0005): each issue has
  a fingerprint, each file a sha256 of the bytes analyzed, and the JSON
  report has a report_version (1). SARIF results carry the fingerprint as
  partialFingerprints, so GitHub code scanning follows an issue when its
  line moves.

• sonda upload sends a JSON report and the source of every analyzed file
  to a sonda server, gzip-compressed (ADR-0005).

  • Refused before connecting: unsafe paths, files changed since the scan,
    and plain HTTP except to localhost.
  • The token comes from SONDA_TOKEN or --token-file.

• sonda-server, the foundation (ADR-0005):

  • A PostgreSQL schema with migrations.
  • /api/health, and serving the web app.
  • Secrets from environment variables or files.
  • A Docker image (distroless, non-root, 69 MB) and a compose.yaml that
    runs it with PostgreSQL. See docs/server.md.

• sonda-server stores uploads (POST /api/analyses) and tracks issues
  across a branch's analyses by fingerprint:

  • Issues are new, kept, fixed or reopened.
  • A human status survives moves, fixes and reopening.
  • sonda upload prints the counts the server returns.

• sonda-server browser sessions and read authorization:

  • POST /api/session exchanges the token for an HttpOnly session
    cookie.
  • Reads need the token or a session when the server isn't listening on
    loopback only.
  • GET /api/rules serves the rule catalog with live open-issue counts
    per rule on each project's main branch.

• sonda-server issues API:

  • GET /api/issues filters (severity, category, status, component,
    file, assignee, new code), paginates, and counts facets.
  • GET /api/issues/{id} adds the rule, the triage history, and the
    surrounding code with syntax highlighting.
  • PATCH /api/issues/{id} changes status or assignee and records it.

• sonda_core::highlight: a dependency-free syntax highlighter for showing
  code.

• The web app shows real data from sonda-server:

  • Sign-in: a session cookie the page cannot read.
  • Issues: filters, facets and paging done by the server; code,
    history and triage per issue.
  • Rules: read-only.

  The Overview stays on sample data under pnpm dev, and says it comes
  next when running against the server. The production build no longer
  contains any sample data.

• The Overview is built from real history (GET /api/overview):

  • KPIs with trends.
  • Ratings per ADR-0005.
  • Where to focus, issue flow, open issues by severity, and project
    health.
  • Gate history and recent analyses.

  A project's first analysis counts as its baseline. What the server
  doesn't know (teams, coverage when not uploaded, commit messages) is
  shown as such, never invented.

• Users and roles (ADR-0006):

  • Sign-in: username and password, with Argon2id hashes.
  • First admin: created from secrets/admin_password while no users
    exist.
  • Administration page: create users, change roles, disable or enable
    them, reset passwords. The last admin is protected.
  • Account page: change your own password.
  • Audit: triage history records who made each change.

  The API token now serves only machines: uploads and scripts.

• Sign-in throttling: after 5 failed sign-ins for a username in 15 minutes,
  each attempt waits longer, up to 15 minutes (429 with Retry-After).
  Unknown usernames are throttled alike, and refused before hashing.

• Overview drill-downs from real data (GET /api/drill/{metric}): each
  metric opens what's behind it, by directory and file, with each file's
  most severe issue. A file opens its issues. Owners and per-file coverage
  are left out rather than invented.

• Owners from CODEOWNERS:

  • sonda upload sends the repository's CODEOWNERS file, read
    symlink-safe from GitHub's three locations.
  • Drill-downs show each directory's majority owner, matched with
    GitHub's rules: gitignore patterns, last match wins.

• Compatibility with SonarQube rules, groundwork (ADR-0007, ADR-0008):

  • Keys: rules record the SonarQube rule keys they're equivalent to
    (sonar), and docs/rules.md and sonda rules --format json show them.
  • Compatibility table: docs/sonar-parity/ tracks which keys sonda
    covers, kept up to date by scripts/sonar_parity.py.
  • Catalog: the rule catalog is split per language.
  • Semantic layer: ADR-0008 plans scopes, control flow and data flow
    for the rules that need them.

• JavaScript/TypeScript: 28 rules equivalent to SonarQube's default-profile
  bugs and vulnerabilities, such as jumps out of finally, repeated
  conditions, comparisons with NaN, impossible typeof results, .only
  tests, disabled TLS verification and weak hashes. Each was reviewed for
  false positives on real projects and about 120 MB of third-party
  JavaScript.

• JavaScript/TypeScript: 34 rules equivalent to SonarQube's default-profile
  code smells, such as switch fall-through, empty functions and blocks,
  nested ternaries, labels, legacy octal, isNaN(), and bare
  eslint-disable comments. The JSX loading/empty/list idiom
  ({a ? <X/> : b ? <Y/> : <Z/>}) is not reported as a nested ternary.

• JavaScript/TypeScript: 42 rules equivalent to SonarQube's default-profile
  React, accessibility and test-framework rules: list keys, hook and state
  misuse, legacy React APIs, alt text and link/heading content, assertions
  that can't fail or check the wrong thing, and test-suite structure. JSX
  rules run on .js, .jsx and .tsx files.

• JavaScript/TypeScript: 34 more rules equivalent to SonarQube's
  default-profile bugs and vulnerabilities: unreachable code, infinite
  loops, unsafe optional chaining, misplaced super(), recursive accessors,
  weak TLS versions, ciphers, modes and keys, jwt with none,
  world-writable files, hard-coded passwords and secrets, insecure cookies,
  CORS for every origin, and disabled helmet protections.

• A semantic layer for JavaScript/TypeScript (ADR-0008,
  phase S1): scopes, declarations and references per file, with hoisting,
  destructuring, imports and TypeScript types. Six rules use it: unused
  local variables and functions, unused imports, reassigned constants and
  imports, redeclared names, and assignments to undeclared names.
  Declaration files (.d.ts) are skipped. A file whose model can't be built
  within the per-file timeout keeps its other findings, with a warning.

• JavaScript/TypeScript: six more rules on the semantic layer: a var used
  outside the block that declares it, collections that are only added to,
  unused private class fields, and, off by default, unused trailing
  parameters, shadowed variables, and let that could be const.

• Dependencies (ADR-0009, phase 1): sonda scan reads package-lock.json
  and npm-shrinkwrap.json (v2/v3), Cargo.lock, poetry.lock (with
  pyproject.toml for direct dependencies), uv.lock and pinned
  requirements*.txt, and lists each pinned package in the JSON report's
  dependencies with its package URL, lockfile, whether it's direct, and
  its license where recorded. sonda sbom exports them as CycloneDX 1.6...