@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-lens/clients/opaque-mutation-scan.js

@@ -2,6 +2,8 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { collectSourceFilesWithBudgetAsync } from "./source-filter.js";
 import { createHash } from "node:crypto";
+import { BoundedFifoMap } from "./bounded-cache.js";
+import { incrementDegradationCount } from "./degradation-ledger.js";
 import { normalizeMapKey } from "./path-utils.js";
 import { freshnessFromMtime } from "./freshness.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
@@ -90,27 +92,52 @@ export function diffFileContent(before, after) {
   }
   return changed;
 }
+export function opaqueBaselineSlot(scanRoot, sessionGeneration) {
+  return `${normalizeMapKey(path.resolve(scanRoot))}:${sessionGeneration}`;
+}
+export const OPAQUE_BASELINE_PENDING_CAP = 64;
 
 export class OpaqueBaselineStore {
-  byCwd = new Map;
-  evictions = 0;
-  record(cwdKey, baseline) {
-    if (this.byCwd.has(cwdKey))
-      this.evictions += 1;
-    this.byCwd.set(cwdKey, baseline);
+  pending = new BoundedFifoMap(OPAQUE_BASELINE_PENDING_CAP);
+  static keyOf(slot, callId) {
+    return callId === undefined ? slot : `${slot}#${callId}`;
   }
-  take(cwdKey) {
-    const baseline = this.byCwd.get(cwdKey);
-    this.byCwd.delete(cwdKey);
-    return baseline;
+  record(slot, callId, state, turn) {
+    for (const [staleKey, entry] of this.pending.entriesArray())
+      if (entry.turn && !entry.turn.isLive(entry.turn.key)) {
+        this.pending.delete(staleKey);
+        recordBaselineLoss("unsettled");
+      }
+    const key = OpaqueBaselineStore.keyOf(slot, callId);
+    const overwrote = this.pending.delete(key);
+    const evicted = this.pending.set(key, { state, turn });
+    if (overwrote)
+      recordBaselineLoss("overwrite");
+    if (evicted.length > 0)
+      recordBaselineLoss("cap");
   }
-  get evictionCount() {
-    return this.evictions;
+  take(slot, callId) {
+    const key = OpaqueBaselineStore.keyOf(slot, callId);
+    const entry = this.pending.get(key);
+    this.pending.delete(key);
+    return entry?.state;
   }
   takeAllForTest() {
-    this.byCwd.clear();
+    this.pending.clear();
   }
 }
+const BASELINE_LOSS_REASONS = {
+  overwrite: "a pending bash baseline was replaced before its tool_result took it; that call reports partial-recognition-no-baseline and withholds blockers (host without distinct tool-call ids, or a reused id)",
+  cap: `more than ${OPAQUE_BASELINE_PENDING_CAP} bash baselines awaited a tool_result; the oldest was dropped`,
+  unsettled: "a bash baseline outlived its turn with no tool_result (the call was blocked or aborted before it ran) and was retired; a result that still arrives reports partial-recognition-no-baseline"
+};
+function recordBaselineLoss(cause) {
+  incrementDegradationCount({
+    kind: "opaque-baseline-lost",
+    subject: cause,
+    reason: BASELINE_LOSS_REASONS[cause]
+  });
+}
 const globalStoreSymbol = Symbol.for("dm-lens:opaque-snapshot-store");
 const globalSlot = globalThis;
 export function getOpaqueBaselineStore() {

package/extensions/dm-lens/clients/opengrep-client.js

@@ -1,11 +1,11 @@
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 import { resolveOpengrepConfig } from "./opengrep-config.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
 import { getScratchTreeDirNames } from "./scratch-tree-policy.js";
 import { realpathOrResolve } from "./path-utils.js";
+import { scannerReportParentDir } from "./scanner-temp-root.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 const EMPTY_RESULT = {
@@ -41,7 +41,7 @@ export class OpengrepClient extends SecurityScanClient {
     const scannedAt = new Date().toISOString();
     const bin = this.binaryPath ?? "opengrep";
     const resolved = OpengrepClient.resolveConfig(cwd);
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "dm-lens-opengrep-"));
+    const outDir = mkdtempSync(path.join(scannerReportParentDir(), "dm-lens-opengrep-"));
     const reportPath = path.join(outDir, "opengrep-report.json");
     try {
       const result = await safeSpawnAsync(bin, [
@@ -54,7 +54,10 @@ export class OpengrepClient extends SecurityScanClient {
         "--no-error",
         "--quiet",
         "--disable-version-check",
-        ...getScratchTreeDirNames().flatMap((name) => ["--exclude", name]),
+        ...getScratchTreeDirNames().flatMap((pattern) => [
+          "--exclude",
+          pattern
+        ]),
         cwd
       ], { cwd, timeout: SCAN_TIMEOUT_MS });
       if (result.error) {

package/extensions/dm-lens/clients/package-manager.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { resolve as resolvePath } from "node:path";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
@@ -14,7 +15,10 @@ import { createAvailabilityProbeFlight } from "./availability-probe-flight.js";
 import {
   createGenerationSource
 } from "./generation-guard.js";
-import { isAtOrAboveHomeDir, walkUpDirs } from "./path-utils.js";
+import { isAtOrAboveHomeDir, isUnderDir, walkUpDirs } from "./path-utils.js";
+import { getProjectTrustState } from "./project-trust.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+import { logExtension } from "./extension-log.js";
 const PREFERENCE = [
   "npm",
   "pnpm",
@@ -271,6 +275,44 @@ export const VENV_BIN_DIRS = [
   path.join(".venv", "Scripts"),
   path.join("venv", "Scripts")
 ];
+export const PROJECT_LOCAL_BIN_DIRS = [
+  ...NODE_MODULES_BIN_DIRS,
+  ...VENDOR_BIN_DIRS,
+  ...VENV_BIN_DIRS
+];
+export function isLocalBinTrustRefusal(value) {
+  return typeof value === "object" && value !== null && value.kind === "refused-by-trust";
+}
+export function localBinPath(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function refuseLocalBin(tool, root) {
+  const trust = getProjectTrustState();
+  const resolvedRoot = resolvePath(root);
+  const subject = `project-local-binary:${resolvedRoot}:${tool}`;
+  if (recordDegradationOnce({
+    kind: "trust-refusal",
+    subject,
+    reason: `project-local binary refused: pi project trust is ${trust}`
+  })) {
+    logExtension({
+      subsystem: "project-trust",
+      level: "warn",
+      message: "project-local binary refused: mark the project trusted in pi or upgrade pi",
+      metadata: { tool, root: resolvedRoot, trust }
+    });
+  }
+  return { kind: "refused-by-trust", tool, root: resolvedRoot, trust };
+}
+export function isProjectLocalBinPath(resolvedCommand, cwd) {
+  for (const ancestor of walkUpDirs(cwd)) {
+    if (isAtOrAboveHomeDir(ancestor, os.homedir()))
+      break;
+    if (PROJECT_LOCAL_BIN_DIRS.some((binDir) => isUnderDir(resolvedCommand, path.join(ancestor, binDir))))
+      return true;
+  }
+  return false;
+}
 function expandCandidateNames(tools, windowsExt, isWindows) {
   return isWindows && windowsExt !== "" ? tools.flatMap((tool) => [`${tool}${windowsExt}`, tool]) : [...tools];
 }
@@ -299,10 +341,19 @@ function* localBinMatches(tools, startDir, options) {
   }
 }
 export function findLocalBinUpwards(tool, startDir, options = {}) {
-  return localBinMatches([tool], startDir, options).next().value;
+  const match = localBinMatches([tool], startDir, options).next().value;
+  if (match === undefined || options.ceiling === false)
+    return match;
+  if (getProjectTrustState() !== "trusted")
+    return refuseLocalBin(tool, startDir);
+  return match;
 }
 export function findLocalBinsUpwards(tools, startDir, options = {}) {
-  return [...localBinMatches(tools, startDir, options)];
+  const matches = [...localBinMatches(tools, startDir, options)];
+  if (matches.length === 0 || options.ceiling === false || getProjectTrustState() === "trusted") {
+    return matches;
+  }
+  return [refuseLocalBin(tools.join(","), startDir)];
 }
 export function findLocalBinsAt(tools, dir, options = {}) {
   const {
@@ -311,11 +362,15 @@ export function findLocalBinsAt(tools, dir, options = {}) {
     isWindows = onWindows()
   } = options;
   const names = expandCandidateNames(tools, windowsExt, isWindows);
-  return [...matchesInDir(path.resolve(dir), names, binDirs)];
+  const matches = [...matchesInDir(path.resolve(dir), names, binDirs)];
+  if (matches.length === 0 || getProjectTrustState() === "trusted")
+    return matches;
+  return [refuseLocalBin(tools.join(","), dir)];
 }
 export function findLocalBinAt(tool, dir, options = {}) {
-  return findLocalBinsAt([tool], dir, options)[0];
+  const match = findLocalBinsAt([tool], dir, options)[0];
+  return match;
 }
 export async function findNodeToolBinary(tool, cwd, windowsExt = ".cmd") {
-  return findLocalBinUpwards(tool, cwd, { windowsExt }) ?? await findGlobalBinary(tool, windowsExt);
+  return localBinPath(findLocalBinUpwards(tool, cwd, { windowsExt })) ?? await findGlobalBinary(tool, windowsExt);
 }

package/extensions/dm-lens/clients/path-utils.js

@@ -52,6 +52,13 @@ function adoptCanonicalCasing(held, canonical) {
   return changed ? heldParts.join("/") : held;
 }
 export function normalizeFilePath(filePath) {
+  if (process.platform === "win32") {
+    if (filePath === "")
+      return "";
+    if (!isFullyQualifiedWin32(filePath)) {
+      return win32.normalize(filePath).replace(/\\/g, "/");
+    }
+  }
   const normalized = filePath.replace(/\\/g, "/");
   if (process.platform !== "win32" && !isWindowsPath(normalized)) {
     const folded = normalized === "" || normalized.startsWith("//") ? normalized : path.posix.normalize(normalized);
@@ -137,8 +144,17 @@ export function toProjectRelativePath(filePath, projectRoot) {
   const p = isWindowsPath(filePath) ? win32 : path;
   if (!p.isAbsolute(filePath))
     return filePath.replace(/\\/g, "/");
-  const relative = p.relative(p.resolve(projectRoot), filePath);
-  return relative && !relative.startsWith("..") && !p.isAbsolute(relative) ? relative.replace(/\\/g, "/") : filePath.replace(/\\/g, "/");
+  const inside = (root, file) => {
+    const relative = p.relative(p.resolve(root), file);
+    return relative && relative !== ".." && !relative.startsWith(`..${p.sep}`) && !p.isAbsolute(relative) ? relative.replace(/\\/g, "/") : undefined;
+  };
+  const direct = inside(projectRoot, filePath);
+  if (direct !== undefined)
+    return direct;
+  const canonical = inside(normalizeFilePath(projectRoot), normalizeFilePath(filePath));
+  if (canonical !== undefined)
+    return canonical;
+  return filePath.replace(/\\/g, "/");
 }
 export function normalizeEphemeralMapKey(filePath) {
   if (process.platform !== "win32" && !filePath.includes("\\"))
@@ -182,16 +198,27 @@ export function findLocalToolConfig(startDir, names, options = {}) {
   }
   return;
 }
-export function isRealGitMarker(markerPath) {
+export function isRealGitMarker(markerPath, details) {
+  const detailed = details === true;
   try {
     const marker = statSync(markerPath);
-    if (marker.isDirectory())
-      return existsSync(path.join(markerPath, "HEAD"));
-    if (!marker.isFile())
+    let valid = false;
+    if (marker.isDirectory()) {
+      statSync(path.join(markerPath, "HEAD"));
+      valid = true;
+    } else if (marker.isFile()) {
+      valid = readFileSync(markerPath, "utf8").split(/\r?\n/, 1)[0].startsWith("gitdir:");
+    }
+    if (!detailed)
+      return valid;
+    return { kind: valid ? "valid" : "absent" };
+  } catch (cause) {
+    if (!detailed)
       return false;
-    return readFileSync(markerPath, "utf8").split(/\r?\n/, 1)[0].startsWith("gitdir:");
-  } catch {
-    return false;
+    if (typeof cause === "object" && cause !== null && "code" in cause && (cause.code === "ENOENT" || cause.code === "ENOTDIR")) {
+      return { kind: "absent" };
+    }
+    return { kind: "unavailable", cause };
   }
 }
 export function findNearestMarkerRoot(startDir, markers, options = {}) {
@@ -213,6 +240,27 @@ export function findNearestMarkerRoot(startDir, markers, options = {}) {
   }
   return null;
 }
+export function findNearestMarkerRootDetailed(startDir, markers, options) {
+  const homeDir = path.resolve(options.homeDir ?? os.homedir());
+  let current = path.resolve(startDir);
+  for (let depth = 0;depth < 64; depth++) {
+    if (isAtOrAboveHomeDir(current, homeDir))
+      return { kind: "not-found", reason: "home-ceiling" };
+    for (const marker of markers) {
+      const markerPath = path.join(current, marker);
+      const checked = options.markerPredicate(markerPath);
+      if (checked.kind === "unavailable")
+        return { kind: "unavailable", markerPath, cause: checked.cause };
+      if (checked.kind === "valid")
+        return { kind: "found", root: current };
+    }
+    const parent = path.dirname(current);
+    if (parent === current)
+      return { kind: "not-found", reason: "root" };
+    current = parent;
+  }
+  return { kind: "not-found", reason: "depth-limit" };
+}
 export function isAtOrAboveHomeDir(dir, homeDir = os.homedir(), pathImpl = path) {
   const rel = pathImpl.relative(pathImpl.resolve(dir), pathImpl.resolve(homeDir));
   return !rel.startsWith("..") && !pathImpl.isAbsolute(rel);
@@ -239,20 +287,26 @@ export function isUnderDir(child, parent) {
   const parentPrefix = normParent.endsWith("/") ? normParent : `${normParent}/`;
   return normChild === normParent || normChild.startsWith(parentPrefix);
 }
+export function isOutsideProjectRoot(filePath, projectRoot) {
+  return !isUnderDir(filePath, projectRoot);
+}
 const VENDOR_DIR_NAMES = new Set([
   "node_modules",
   "vendor",
   "vendors",
   "third_party",
-  "third-party"
+  "third-party",
+  ".venv",
+  "site-packages",
+  "bower_components"
 ]);
+export function isVendorPath(filePath) {
+  return normalizeFilePath(filePath).split("/").some((segment) => VENDOR_DIR_NAMES.has(segment.toLowerCase()));
+}
 export function isExternalOrVendorFile(filePath, projectRoot) {
-  if (!isUnderDir(filePath, projectRoot))
+  if (isOutsideProjectRoot(filePath, projectRoot))
     return true;
-  const normalized = normalizeFilePath(filePath);
-  const rootNorm = normalizeFilePath(projectRoot);
-  const rel = normalized.startsWith(rootNorm + "/") ? normalized.slice(rootNorm.length + 1) : normalized;
-  return rel.split("/").some((seg) => VENDOR_DIR_NAMES.has(seg));
+  return isVendorPath(filePath);
 }
 export function nameMatchesMarkerGlob(name, pattern) {
   return minimatch(name, pattern, {
@@ -361,9 +415,14 @@ function compileWorkspaceMemberPattern(pattern, dialect) {
   }
   return steps;
 }
-function matchesWorkspaceMemberSteps(steps, subject) {
+const WORKSPACE_GLOB_MEMO_CELL_CAP = 2000000;
+function matchesWorkspaceMemberSteps(steps, subject, onCap) {
   const stepCount = steps.length;
   const width = subject.length + 1;
+  if ((stepCount + 1) * width > WORKSPACE_GLOB_MEMO_CELL_CAP) {
+    onCap?.();
+    return false;
+  }
   const table = new Uint8Array((stepCount + 1) * width);
   for (let p = subject.length;p >= 0; p -= 1) {
     const atEnd = p === subject.length;
@@ -394,13 +453,13 @@ function matchesWorkspaceMemberSteps(steps, subject) {
   }
   return table[0] === 1;
 }
-export function matchesWorkspaceMemberPattern(pattern, relativePath, dialect) {
+export function matchesWorkspaceMemberPattern(pattern, relativePath, dialect, onCap) {
   const normalized = dialect.normalizePattern(pattern);
   if (dialect.globstar === "pattern-never-matches" && normalized.includes("**")) {
     return false;
   }
   const steps = compileWorkspaceMemberPattern(normalized, dialect);
-  return steps !== undefined && matchesWorkspaceMemberSteps(steps, relativePath);
+  return steps !== undefined && matchesWorkspaceMemberSteps(steps, relativePath, onCap);
 }
 const NARROW_NO_BREAK_SPACE = " ";
 const RIGHT_SINGLE_QUOTE = "’";

package/extensions/dm-lens/clients/performance-report.js

@@ -276,7 +276,7 @@ function renderScope(lines, label, scope) {
 }
 export function renderLatencyPerformanceReport(report) {
   const lines = [
-    "⏱️ PI-LENS PERFORMANCE",
+    "⏱️ DM-LENS PERFORMANCE",
     `Top ${report.topN} sustained and tail latency phases.`
   ];
   renderScope(lines, "Current process session", report.session);

package/extensions/dm-lens/clients/persist-worker-stats.js

@@ -0,0 +1,8 @@
+export async function readWorkerHeapStatistics(worker) {
+  const stats = await worker.getHeapStatistics();
+  return {
+    heapUsedBytes: stats.used_heap_size,
+    heapTotalBytes: stats.total_heap_size,
+    heapSizeLimitBytes: stats.heap_size_limit
+  };
+}

package/extensions/dm-lens/clients/persistent-reverify.js

@@ -133,8 +133,12 @@ export async function runPersistentReverify(args) {
       dropped,
       kept
     });
+    const {
+      reVerifyIncomplete: _reVerifyIncomplete,
+      ...entryWithoutIncomplete
+    } = entry;
     replacementFiles.push({
-      ...entry,
+      ...entryWithoutIncomplete,
       warnings: freshRecords,
       reVerified: true,
       generatedAt: new Date(nowMs).toISOString()