app.py

"""SkillSpector Dashboard — Streamlit visual frontend for NVIDIA/SkillSpector CLI."""

import json, os, shutil, subprocess
import pandas as pd
import streamlit as st

st.set_page_config(page_title="SkillSpector", page_icon="🛡️", layout="wide")

# ── Environment guard ────────────────────────────────────────────────────────
def _find_cli():
    if p := shutil.which("skillspector"):          return p
    for p in ["skillspector/.venv/Scripts/skillspector.exe",
              "skillspector/.venv/bin/skillspector"]:
        if os.path.exists(p):                      return os.path.abspath(p)
    return None

CLI = _find_cli()
if not CLI:
    st.error("❌ `skillspector` not found. Run `pip install skillspector` then reload.")
    st.stop()

# ── Sidebar ──────────────────────────────────────────────────────────────────
with st.sidebar:
    st.title("🛡️ SkillSpector")
    mode   = st.radio("Source", ["Local Path", "GitHub URL"])
    label  = "Directory / file path" if mode == "Local Path" else "GitHub HTTPS URL"
    target = st.text_input(label, placeholder="e.g. skillspector/tests/fixtures/malicious_skill")
    no_llm = st.checkbox("Static only (no LLM)", value=True)
    scan   = st.button("🔍 Run Scan", use_container_width=True, type="primary")

# ── Scanner ──────────────────────────────────────────────────────────────────
def run_scan(target: str, no_llm: bool) -> dict | None:
    cmd = [CLI, "scan", target, "--format", "json"] + (["--no-llm"] if no_llm else [])
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8",
                           errors="replace", env={**os.environ, "PYTHONIOENCODING": "utf-8"})
        raw = r.stdout.strip()
        return json.loads(raw[raw.find("{") : raw.rfind("}") + 1])
    except (json.JSONDecodeError, ValueError) as e:
        st.error(f"JSON parse error: {e}"); st.code(r.stdout[:2000]); return None
    except Exception as e:
        st.error(f"Scan failed: {e}"); return None

# ── Helper: flatten issue fields from real JSON schema ───────────────────────
# Real schema: id, severity, category, location.{file, start_line}, finding, explanation, remediation
def _flat(i: dict) -> dict:
    loc = i.get("location") or {}
    msg = i.get("finding") or i.get("explanation") or "—"
    return {"Rule": i.get("id","—"), "Severity": i.get("severity","—"),
            "Category": i.get("category","—"),
            "File": loc.get("file","—"), "Line": loc.get("start_line","—"),
            "Message": msg[:120]}

if scan:
    if not target.strip():
        st.warning("Enter a path or URL in the sidebar first.")
    else:
        with st.spinner("Scanning…"):
            st.session_state["data"] = run_scan(target.strip(), no_llm)

# ── Dashboard ────────────────────────────────────────────────────────────────
if d := st.session_state.get("data"):
    ra    = d.get("risk_assessment", {})
    score = ra.get("score", 0)
    sev   = ra.get("severity", "LOW").upper()
    rec   = ra.get("recommendation", "SAFE").replace("_", " ")
    COLOR = {"CRITICAL":"🔴","HIGH":"🟠","MEDIUM":"🟡","LOW":"🟢"}.get(sev,"🟢")
    issues = d.get("issues", [])

    st.markdown(f"## {COLOR} Risk Score: **{score}/100** — {rec}")
    st.divider()

    c1, c2, c3 = st.columns(3)
    c1.metric("Severity Band",  sev)
    c2.metric("Issues Found",   len(issues))
    c3.metric("Files Scanned",  len(d.get("components", [])))

    # Severity chart
    counts = pd.Series({s: sum(1 for i in issues if i.get("severity","").upper()==s)
                        for s in ("CRITICAL","HIGH","MEDIUM","LOW")}).rename("Findings")
    st.bar_chart(counts)

    # Table + expanders
    if issues:
        st.dataframe(pd.DataFrame([_flat(i) for i in issues]),
                     use_container_width=True, hide_index=True)
        for i in issues:
            f = _flat(i)
            with st.expander(f"[{f['Severity']}] {f['Rule']} — {f['File']}  ›  {f['Message'][:60]}"):
                st.write(i.get("explanation") or i.get("finding") or "No details.")
                if i.get("remediation"):
                    st.info(i["remediation"])
    else:
        st.success("✅ No security issues detected. Skill appears safe.")
else:
    st.info("👈 Enter a target in the sidebar and click **Run Scan** to begin.")