@cosmicdrift/kumiko-guards 0.363.0 → 0.365.0

package/src/check-licenses.ts

@@ -0,0 +1,288 @@
+// Licence check over the installed third-party packages of ONE repo.
+//
+// Single-repo by design: the scanned repo is the one `cwd` sits in (the multi-repo
+// workspace scan of the private infra guard is gone). Installed packages come from
+// node_modules of the repo, its workspace members and every ancestor directory.
+// Exceptions merge the bundled dependency-license-exceptions.json with an optional file of
+// the same name in the repo root and in every ancestor whose node_modules was scanned.
+import { parseDependencyCli } from "./_lib/dependency-cli";
+import {
+  findExpiringSoon,
+  isExceptionValid,
+  loadExceptionEntries,
+  matchesPackageName,
+} from "./_lib/dependency-exceptions";
+import {
+  collectInstalledPackages,
+  type InstalledPackage,
+  installationRoots,
+} from "./_lib/installed-packages";
+
+export const LICENSES_FLAGS: readonly string[] = ["--report"];
+
+const ALLOWLIST = new Set([
+  "MIT",
+  "MIT-0",
+  "ISC",
+  "Apache-2.0",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "BSD-3-Clause-Clear",
+  "0BSD",
+  "Unlicense",
+  "CC0-1.0",
+  "BlueOak-1.0.0",
+  "Python-2.0",
+  "PostgreSQL",
+  "Zlib",
+  "WTFPL",
+  "Artistic-2.0",
+]);
+
+const GRAY_ZONE = new Set([
+  "LGPL-2.0",
+  "LGPL-2.1",
+  "LGPL-2.1-only",
+  "LGPL-2.1-or-later",
+  "LGPL-3.0",
+  "LGPL-3.0-only",
+  "LGPL-3.0-or-later",
+  "MPL-1.0",
+  "MPL-1.1",
+  "MPL-2.0",
+  "CDDL-1.0",
+  "CDDL-1.1",
+  "EPL-1.0",
+  "EPL-2.0",
+]);
+
+const DENYLIST_PATTERNS: RegExp[] = [
+  /^GPL-\d/,
+  /^AGPL-\d/,
+  /^SSPL-/,
+  /^BUSL-/,
+  /Commons[ -]Clause/i,
+  /^UNLICENSED$/i,
+];
+
+export const LICENSE_EXCEPTIONS_FILE = "dependency-license-exceptions.json";
+
+export type LicenseException = {
+  readonly package: string;
+  readonly version: string;
+  readonly license: string;
+  readonly reason: string;
+  readonly reviewedBy: string;
+  readonly expires: string;
+};
+
+type Verdict =
+  | { readonly kind: "ok"; readonly license: string }
+  | { readonly kind: "gray"; readonly license: string; readonly exception?: LicenseException }
+  | { readonly kind: "deny"; readonly license: string; readonly exception?: LicenseException }
+  | {
+      readonly kind: "unknown";
+      readonly raw: string | null;
+      readonly exception?: LicenseException;
+    };
+
+type Judged = { readonly pkg: InstalledPackage; readonly verdict: Verdict };
+
+export function loadLicenseExceptions(
+  roots: readonly string[],
+  bundledDir?: string,
+): LicenseException[] {
+  return loadExceptionEntries({
+    filename: LICENSE_EXCEPTIONS_FILE,
+    roots,
+    bundledDir,
+    parse: (field) => ({
+      package: field("package"),
+      version: field("version"),
+      license: field("license"),
+      reason: field("reason"),
+      reviewedBy: field("reviewedBy"),
+      expires: field("expires"),
+    }),
+  });
+}
+
+function findException(
+  pkg: InstalledPackage,
+  exceptions: readonly LicenseException[],
+): LicenseException | undefined {
+  return exceptions.find((e) => {
+    if (!matchesPackageName(e.package, pkg.name)) return false;
+    return e.version === "*" || e.version === pkg.version || /^[\^~]/.test(e.version);
+  });
+}
+
+function splitExpression(expr: string, operator: "OR" | "AND"): string[] {
+  const stripped = expr.replace(/[()]/g, "").trim();
+  return stripped
+    .split(new RegExp(`\\s+${operator}\\s+`, "i"))
+    .map((p) => p.trim())
+    .filter(Boolean);
+}
+
+function matchesDenylist(license: string): boolean {
+  return DENYLIST_PATTERNS.some((p) => p.test(license));
+}
+
+export function judgeLicense(
+  pkg: InstalledPackage,
+  exceptions: readonly LicenseException[],
+): Verdict {
+  const license = pkg.license;
+  const exception = findException(pkg, exceptions);
+  if (!license) return { kind: "unknown", raw: null, exception };
+
+  const andParts = splitExpression(license, "AND");
+  if (andParts.length > 1) {
+    if (andParts.every((p) => ALLOWLIST.has(p))) return { kind: "ok", license };
+    if (andParts.some(matchesDenylist)) return { kind: "deny", license, exception };
+    if (andParts.every((p) => ALLOWLIST.has(p) || GRAY_ZONE.has(p))) {
+      return { kind: "gray", license, exception };
+    }
+    return { kind: "unknown", raw: license, exception };
+  }
+
+  const orParts = splitExpression(license, "OR");
+  if (orParts.length > 1) {
+    if (orParts.some((p) => ALLOWLIST.has(p))) return { kind: "ok", license };
+    if (orParts.some((p) => GRAY_ZONE.has(p))) return { kind: "gray", license, exception };
+    if (orParts.every(matchesDenylist)) return { kind: "deny", license, exception };
+    return { kind: "unknown", raw: license, exception };
+  }
+
+  const clean = license.replace(/[()]/g, "").trim();
+  if (ALLOWLIST.has(clean)) return { kind: "ok", license: clean };
+  if (GRAY_ZONE.has(clean)) return { kind: "gray", license: clean, exception };
+  if (matchesDenylist(clean)) return { kind: "deny", license: clean, exception };
+  return { kind: "unknown", raw: clean, exception };
+}
+
+function hasValidException(verdict: Verdict, nowMs: number): boolean {
+  return (
+    "exception" in verdict &&
+    verdict.exception !== undefined &&
+    isExceptionValid(verdict.exception.expires, nowMs).valid
+  );
+}
+
+export type LicenseEvaluation = {
+  readonly judged: readonly Judged[];
+  readonly blocked: readonly Judged[];
+  readonly coveredGray: readonly Judged[];
+};
+
+export function evaluateLicenses(
+  packages: readonly InstalledPackage[],
+  exceptions: readonly LicenseException[],
+  nowMs: number = Date.now(),
+): LicenseEvaluation {
+  const judged = packages.map((pkg) => ({ pkg, verdict: judgeLicense(pkg, exceptions) }));
+  const blocked = judged.filter(
+    ({ verdict }) => verdict.kind !== "ok" && !hasValidException(verdict, nowMs),
+  );
+  const coveredGray = judged.filter(
+    ({ verdict }) => verdict.kind === "gray" && hasValidException(verdict, nowMs),
+  );
+  return { judged, blocked, coveredGray };
+}
+
+function verdictLicense(verdict: Verdict): string {
+  return verdict.kind === "unknown" ? String(verdict.raw) : verdict.license;
+}
+
+function describeBlocked({ pkg, verdict }: Judged, nowMs: number): string {
+  const kind =
+    verdict.kind === "deny"
+      ? "DENY"
+      : verdict.kind === "unknown"
+        ? "UNKNOWN"
+        : "GRAY (no valid exception)";
+  const exception = "exception" in verdict ? verdict.exception : undefined;
+  const expiredSuffix =
+    exception && isExceptionValid(exception.expires, nowMs).expired
+      ? ` (exception expired ${exception.expires})`
+      : "";
+  return `    [${kind}]  ${pkg.name}@${pkg.version}  license=${verdictLicense(verdict)}${expiredSuffix}`;
+}
+
+function describeCoveredGray({ pkg, verdict }: Judged): string {
+  const exception = "exception" in verdict ? verdict.exception : undefined;
+  return `    [GRAY/ok]  ${pkg.name}@${pkg.version}  license=${verdictLicense(verdict)}  expires=${exception?.expires ?? "?"}`;
+}
+
+function printReport(evaluation: LicenseEvaluation, nowMs: number): void {
+  const counts = { ok: 0, gray: 0, deny: 0, unknown: 0 };
+  for (const { verdict } of evaluation.judged) counts[verdict.kind]++;
+  console.log(`License check: ${evaluation.judged.length} packages scanned.`);
+  console.log(
+    `  ok: ${counts.ok}  gray: ${counts.gray}  deny: ${counts.deny}  unknown: ${counts.unknown}`,
+  );
+
+  if (evaluation.blocked.length > 0) {
+    console.error("\n  Problematic licenses:\n");
+    for (const judged of evaluation.blocked) console.error(describeBlocked(judged, nowMs));
+  }
+
+  if (evaluation.coveredGray.length > 0) {
+    console.log("\n  Gray zone (covered by exception):");
+    for (const judged of evaluation.coveredGray) console.log(describeCoveredGray(judged));
+  }
+
+  const used = evaluation.judged.flatMap(({ verdict }) =>
+    "exception" in verdict && verdict.exception ? [verdict.exception] : [],
+  );
+  const expiring = findExpiringSoon(used, 30, nowMs);
+  if (expiring.length > 0) {
+    console.log("\n  WARN: exceptions expire within 30 days — re-review:");
+    for (const exception of expiring) {
+      console.log(`    ${exception.package}  expires=${exception.expires}`);
+    }
+  }
+}
+
+export function runLicenseCheck(options: {
+  readonly repoRoot: string;
+  readonly reportOnly: boolean;
+  readonly packages?: readonly InstalledPackage[];
+  readonly exceptions?: readonly LicenseException[];
+  readonly nowMs?: number;
+}): number {
+  const nowMs = options.nowMs ?? Date.now();
+  const packages = options.packages ?? collectInstalledPackages(options.repoRoot);
+  if (packages.length === 0) {
+    console.error(
+      `  licenses: nothing scanned — no installed packages found for ${options.repoRoot} (run \`bun install\`).`,
+    );
+    return 1;
+  }
+  const exceptions =
+    options.exceptions ?? loadLicenseExceptions(installationRoots(options.repoRoot));
+  const evaluation = evaluateLicenses(packages, exceptions, nowMs);
+  printReport(evaluation, nowMs);
+  if (options.reportOnly) return 0;
+
+  if (evaluation.blocked.length > 0) {
+    console.error(
+      `\n  BLOCKED: ${evaluation.blocked.length} package(s) with a problematic license.`,
+    );
+    console.error(
+      `  Remove the dependency or add an exception to ${LICENSE_EXCEPTIONS_FILE} in the repo root.\n`,
+    );
+    return 1;
+  }
+  if (evaluation.coveredGray.length > 0) {
+    console.log(`\n  ${evaluation.coveredGray.length} gray-zone package(s) covered by exceptions.`);
+  }
+  return 0;
+}
+
+export function runLicensesCli(argv: readonly string[], cwd: string = process.cwd()): number {
+  const invocation = parseDependencyCli("licenses", argv, cwd);
+  if (!invocation.ok) return invocation.exitCode;
+  return runLicenseCheck({ repoRoot: invocation.repoRoot, reportOnly: invocation.reportOnly });
+}

package/src/check-outdated.ts

@@ -0,0 +1,234 @@
+// Deprecated-dependency check over ONE repo.
+//
+// Default: fails on any installed direct dependency whose npm registry metadata marks the
+// installed version `deprecated`. General outdated listing is Renovate's job; `--report`
+// adds deprecated transitive packages and a major-lag warning list (never blocking).
+// Single-repo by design: declared dependencies are the scanned repo's root and workspace
+// members; installed packages come from node_modules of the repo, its members and ancestors.
+import { parseDependencyCli } from "./_lib/dependency-cli";
+import {
+  collectDeclaredSpecsByName,
+  collectDirectDependencies,
+  collectRootOverrides,
+} from "./_lib/direct-dependencies";
+import { collectInstalledPackages, type InstalledPackage } from "./_lib/installed-packages";
+import {
+  createBunInfoClient,
+  findMajorLagWarning,
+  mapWithConcurrency,
+  memoizeRegistryClient,
+  type RegistryClient,
+} from "./_lib/npm-registry";
+
+const REGISTRY_CONCURRENCY = 10;
+
+type NameAndVersion = { readonly name: string; readonly version: string };
+
+export type DeprecatedPackage = NameAndVersion & { readonly message: string };
+
+export type UnresolvedPackage = NameAndVersion & { readonly reason: string };
+
+export type DeprecationScan = {
+  readonly deprecated: DeprecatedPackage[];
+  readonly unresolved: UnresolvedPackage[];
+};
+
+export async function findDeprecatedPackages(
+  packages: readonly NameAndVersion[],
+  registry: RegistryClient,
+): Promise<DeprecationScan> {
+  const unique = [...new Map(packages.map((pkg) => [`${pkg.name}@${pkg.version}`, pkg])).values()];
+  const lookups = await mapWithConcurrency(unique, REGISTRY_CONCURRENCY, async (pkg) => ({
+    pkg,
+    lookup: await registry.deprecation(pkg.name, pkg.version),
+  }));
+  const deprecated: DeprecatedPackage[] = [];
+  const unresolved: UnresolvedPackage[] = [];
+  for (const { pkg, lookup } of lookups) {
+    if (lookup.kind === "deprecated") deprecated.push({ ...pkg, message: lookup.message });
+    else if (lookup.kind === "unknown") unresolved.push({ ...pkg, reason: lookup.reason });
+  }
+  return { deprecated, unresolved };
+}
+
+function printUnresolved(
+  scope: string,
+  unresolved: readonly UnresolvedPackage[],
+  total: number,
+): void {
+  console.error(
+    `\n  WARNING: deprecation status UNKNOWN for ${unresolved.length} of ${total} ${scope} — the registry did not answer, so these were NOT checked (re-run once the registry is reachable):`,
+  );
+  for (const pkg of unresolved.slice(0, 10)) {
+    console.error(`    ${pkg.name}@${pkg.version}  — ${pkg.reason}`);
+  }
+  if (unresolved.length > 10) console.error(`    … and ${unresolved.length - 10} more`);
+}
+
+// A spec that is not a plain semver range (workspace:, catalog:, a git URL, "latest") has nothing to compare against; matching it by name alone can only over-report, never hide a deprecated package.
+function isComparableRange(spec: string): boolean {
+  return /^[\d~^><=]/.test(spec.trim());
+}
+
+export function isDeclaredInstall(installedVersion: string, declaredSpec: string): boolean {
+  if (!isComparableRange(declaredSpec)) return true;
+  return Bun.semver.satisfies(installedVersion, declaredSpec);
+}
+
+export function selectDirectInstalledPackages<T extends NameAndVersion>(
+  installed: readonly T[],
+  declaredSpecs: ReadonlyMap<string, readonly string[]>,
+  overrides: ReadonlyMap<string, string> = new Map(),
+): T[] {
+  const byName = new Map<string, T[]>();
+  for (const pkg of installed) {
+    if (!declaredSpecs.has(pkg.name)) continue;
+    const group = byName.get(pkg.name);
+    if (group) group.push(pkg);
+    else byName.set(pkg.name, [pkg]);
+  }
+
+  const keep = new Set<T>();
+  for (const [name, group] of byName) {
+    const specs = declaredSpecs.get(name) ?? [];
+    const matching = group.filter((pkg) =>
+      specs.some((spec) => isDeclaredInstall(pkg.version, spec)),
+    );
+    if (matching.length > 0) {
+      for (const pkg of matching) keep.add(pkg);
+      continue;
+    }
+    // A root `overrides` block can pin a direct dependency outside its declared range; keep the instances matching the pin, or all of them (fail-safe) if there is no pin or nothing satisfies it.
+    const override = overrides.get(name);
+    const pinned =
+      override === undefined ? [] : group.filter((pkg) => isDeclaredInstall(pkg.version, override));
+    for (const pkg of pinned.length > 0 ? pinned : group) keep.add(pkg);
+  }
+
+  return installed.filter((pkg) => keep.has(pkg));
+}
+
+async function printMajorLagReport(
+  repoRoot: string,
+  registry: RegistryClient,
+  nowMs: number,
+): Promise<void> {
+  const direct = collectDirectDependencies(repoRoot);
+  console.log(`\n  Major-lag report (${direct.length} direct dependencies):`);
+
+  const warnings = await mapWithConcurrency(direct, REGISTRY_CONCURRENCY, async (dep) => {
+    const release = await registry.latestRelease(dep.name);
+    if (!release) return null;
+    const current = dep.version.replace(/^[\^~>=<]+/, "");
+    return findMajorLagWarning(dep.name, current, release, 12, nowMs);
+  });
+
+  const hits = warnings.filter((w) => w !== null);
+  if (hits.length === 0) {
+    console.log("    No direct dependencies with major lag >12 months.");
+  } else {
+    console.log("\n  WARN: major version lag >12 months (not blocking):");
+    for (const hit of hits) {
+      console.log(
+        `    ${hit.name}  ${hit.current} → latest ${hit.latest} (since ${hit.latestPublished})`,
+      );
+    }
+  }
+}
+
+/** Prints the direct-dependency verdict; returns true when it must fail the run. */
+function reportDirectScan(scan: DeprecationScan, directChecked: number): boolean {
+  if (scan.deprecated.length > 0) {
+    console.error("\n  DEPRECATED direct dependencies (blocking):\n");
+    for (const dep of scan.deprecated) {
+      console.error(`    ${dep.name}@${dep.version}  — ${dep.message}`);
+    }
+    console.error(
+      "\n  Replace each deprecated package or upgrade to a version that is not deprecated.",
+    );
+  } else if (scan.unresolved.length === 0) {
+    console.log("  No deprecated direct dependencies found.");
+  }
+  if (scan.unresolved.length > 0) {
+    printUnresolved("direct dependencies", scan.unresolved, directChecked);
+  }
+  // Partial registry gaps stay a warning (npm answers 503 under load); a run that checked nothing must not pass.
+  const nothingChecked = directChecked > 0 && scan.unresolved.length === directChecked;
+  if (nothingChecked) {
+    console.error(
+      "  outdated: nothing checked — no direct dependency got a registry answer. Re-run once the registry is reachable.",
+    );
+  }
+  return scan.deprecated.length > 0 || nothingChecked;
+}
+
+async function printTransitiveReport(
+  installed: readonly InstalledPackage[],
+  directScan: DeprecationScan,
+  registry: RegistryClient,
+): Promise<void> {
+  const allScan = await findDeprecatedPackages(installed, registry);
+  if (allScan.unresolved.length > directScan.unresolved.length) {
+    printUnresolved("installed packages", allScan.unresolved, countUnique(installed));
+  }
+  const transitive = allScan.deprecated.filter(
+    (dep) => !directScan.deprecated.some((d) => d.name === dep.name && d.version === dep.version),
+  );
+  if (transitive.length > 0) {
+    console.log(`\n  WARN: ${transitive.length} deprecated transitive package(s) (Renovate):`);
+    for (const dep of transitive.slice(0, 15)) {
+      console.log(`    ${dep.name}@${dep.version}  — ${dep.message}`);
+    }
+    if (transitive.length > 15) console.log(`    … and ${transitive.length - 15} more`);
+  }
+}
+
+export async function runOutdatedCheck(options: {
+  readonly repoRoot: string;
+  readonly reportMode: boolean;
+  readonly installed?: readonly InstalledPackage[];
+  readonly registry?: RegistryClient;
+  readonly nowMs?: number;
+}): Promise<number> {
+  const installed = options.installed ?? collectInstalledPackages(options.repoRoot);
+  if (installed.length === 0) {
+    console.error(
+      `  outdated: nothing scanned — no installed packages found for ${options.repoRoot} (run \`bun install\`).`,
+    );
+    return 1;
+  }
+  const registry = memoizeRegistryClient(options.registry ?? createBunInfoClient(options.repoRoot));
+  const directInstalled = selectDirectInstalledPackages(
+    installed,
+    collectDeclaredSpecsByName(options.repoRoot),
+    collectRootOverrides(options.repoRoot),
+  );
+
+  console.log(
+    `Outdated check: ${directInstalled.length} direct dependencies (${installed.length} installed total).`,
+  );
+
+  const directScan = await findDeprecatedPackages(directInstalled, registry);
+  const blocking = reportDirectScan(directScan, countUnique(directInstalled));
+
+  if (options.reportMode) {
+    await printTransitiveReport(installed, directScan, registry);
+    await printMajorLagReport(options.repoRoot, registry, options.nowMs ?? Date.now());
+  }
+
+  return blocking ? 1 : 0;
+}
+
+function countUnique(packages: readonly NameAndVersion[]): number {
+  return new Set(packages.map((pkg) => `${pkg.name}@${pkg.version}`)).size;
+}
+
+export async function runOutdatedCli(
+  argv: readonly string[],
+  cwd: string = process.cwd(),
+): Promise<number> {
+  const invocation = parseDependencyCli("outdated", argv, cwd);
+  if (!invocation.ok) return invocation.exitCode;
+  // Unlike licenses/security, `--report` only adds sections: a deprecated direct dependency still exits 1.
+  return runOutdatedCheck({ repoRoot: invocation.repoRoot, reportMode: invocation.reportOnly });
+}

package/src/check-runtime-isolation.ts

@@ -221,7 +221,9 @@ if (import.meta.main) {
   if (args.includes("--write-baseline")) {
     const root = resolveRepoRoots()[0];
     if (!root) {
-      console.error("No repo root resolved — nothing to baseline.");
+      console.error(
+        "No repo root resolved — nothing to baseline. Run it from inside a repo checkout.",
+      );
       process.exit(1);
     }
     const { allViolations } = scanRoot(root);