@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-lens/dist/clients/diagnostics-publish.js

@@ -0,0 +1,134 @@
+import { logBusEvent } from "./bus-events-logger.js";
+import { normalizeFilePath } from "./path-utils.js";
+import { createLiveBusEmitter, recordStaleBusFailure, resolveLiveBusEmitter } from "./live-bus-emitter.js";
+import { isBusPublishEnabled } from "./bus-publish.js";
+export const BUS_DIAGNOSTICS_EVENT = "dmlens:diagnostics";
+export const BUS_DIAGNOSTICS_VERSION = 1;
+export const MAX_DIAGNOSTICS_PER_FILE_EVENT = 12;
+const liveEmitter = createLiveBusEmitter();
+let hasLoggedFailure = false;
+let hasLoggedUnwired = false;
+let hasLoggedDisabled = false;
+let seqCounter = 0;
+const reportedDirtyPaths = new Set;
+export function wireDiagnosticsBusEmitter(emitFn) {
+  liveEmitter.wire(emitFn);
+}
+export function wireDiagnosticsBusEmitterGetter(getter) {
+  liveEmitter.wireGetter(getter);
+}
+export function _resetDiagnosticsPublishForTests() {
+  liveEmitter.reset();
+  hasLoggedFailure = false;
+  hasLoggedUnwired = false;
+  hasLoggedDisabled = false;
+  seqCounter = 0;
+  reportedDirtyPaths.clear();
+}
+function capDiagnostics(diagnostics) {
+  if (diagnostics.length <= MAX_DIAGNOSTICS_PER_FILE_EVENT) {
+    return { capped: diagnostics, truncated: false };
+  }
+  const errors = diagnostics.filter((d) => d.severity === "error");
+  const rest = diagnostics.filter((d) => d.severity !== "error");
+  if (errors.length >= MAX_DIAGNOSTICS_PER_FILE_EVENT) {
+    return {
+      capped: errors.slice(0, MAX_DIAGNOSTICS_PER_FILE_EVENT),
+      truncated: true
+    };
+  }
+  return {
+    capped: [
+      ...errors,
+      ...rest.slice(0, MAX_DIAGNOSTICS_PER_FILE_EVENT - errors.length)
+    ],
+    truncated: true
+  };
+}
+export function publishDiagnostics(args) {
+  if (args.origin === "bus")
+    return;
+  if (args.files.length === 0)
+    return;
+  if (!isBusPublishEnabled()) {
+    if (!hasLoggedDisabled) {
+      hasLoggedDisabled = true;
+      logBusEvent({
+        event: BUS_DIAGNOSTICS_EVENT,
+        outcome: "skipped_disabled",
+        cwd: normalizeFilePath(args.cwd)
+      });
+    }
+    return;
+  }
+  const resolution = resolveLiveBusEmitter(liveEmitter, () => ({
+    event: BUS_DIAGNOSTICS_EVENT,
+    cwd: normalizeFilePath(args.cwd)
+  }));
+  if (resolution.outcome === "stale-session")
+    return;
+  if (resolution.outcome === "unwired") {
+    if (!hasLoggedUnwired) {
+      hasLoggedUnwired = true;
+      logBusEvent({
+        event: BUS_DIAGNOSTICS_EVENT,
+        outcome: "skipped_unwired",
+        cwd: normalizeFilePath(args.cwd)
+      });
+    }
+    return;
+  }
+  const busEmit = resolution.emit;
+  try {
+    const fileEntries = args.files.map((f) => {
+      const normPath = normalizeFilePath(f.path);
+      const { capped, truncated } = capDiagnostics(f.diagnostics);
+      if (capped.length > 0) {
+        reportedDirtyPaths.add(normPath);
+      } else {
+        reportedDirtyPaths.delete(normPath);
+      }
+      const entry = {
+        path: normPath,
+        diagnostics: capped
+      };
+      if (truncated)
+        entry.truncated = true;
+      return entry;
+    });
+    seqCounter += 1;
+    const payload = {
+      v: BUS_DIAGNOSTICS_VERSION,
+      source: "dm-lens",
+      cwd: normalizeFilePath(args.cwd),
+      seq: seqCounter,
+      ts: Date.now(),
+      files: fileEntries
+    };
+    busEmit(BUS_DIAGNOSTICS_EVENT, payload);
+    hasLoggedFailure = false;
+    logBusEvent({
+      event: BUS_DIAGNOSTICS_EVENT,
+      outcome: "emitted",
+      cwd: payload.cwd,
+      fileCount: payload.files.length,
+      seq: payload.seq
+    });
+  } catch (err) {
+    logBusEvent({
+      event: BUS_DIAGNOSTICS_EVENT,
+      outcome: "emit_failed",
+      cwd: normalizeFilePath(args.cwd),
+      error: String(err),
+      ctxSource: resolution.ctxSource
+    });
+    if (!hasLoggedFailure) {
+      hasLoggedFailure = true;
+      recordStaleBusFailure(BUS_DIAGNOSTICS_EVENT, err);
+      args.dbg?.(`diagnostics-publish: dmlens:diagnostics emit failed (further failures suppressed): ${err}`);
+    }
+  }
+}
+export function wasPreviouslyReportedDirty(path) {
+  return reportedDirtyPaths.has(normalizeFilePath(path));
+}

package/extensions/dm-lens/dist/clients/dispatch/adopted-root-runners.js

@@ -0,0 +1,22 @@
+export const ADOPTED_ROOT_RUNNER_ALLOWLIST = [
+  "fish-indent",
+  "php-lint"
+];
+const ADMITTED = new Set(ADOPTED_ROOT_RUNNER_ALLOWLIST);
+export function isAdoptedRootRunnerAdmitted(runnerId) {
+  return ADMITTED.has(runnerId);
+}
+export function filterGroupsForAdoptedRoot(groups) {
+  const filtered = [];
+  for (const group of groups) {
+    const runnerIds = [];
+    for (const runnerId of group.runnerIds) {
+      if (isAdoptedRootRunnerAdmitted(runnerId))
+        runnerIds.push(runnerId);
+    }
+    if (runnerIds.length === 0)
+      continue;
+    filtered.push(runnerIds.length === group.runnerIds.length ? group : { ...group, runnerIds });
+  }
+  return filtered;
+}

package/extensions/dm-lens/dist/clients/dispatch/ast-grep-catalog.js

@@ -0,0 +1,16 @@
+import { getAstGrepRuleSources } from "../sgconfig.js";
+import { loadYamlRules, loadYamlRulesFresh } from "./runners/yaml-rule-parser.js";
+export function buildEffectiveAstGrepCatalog(root) {
+  const sources = [];
+  const effectiveRules = new Map;
+  for (const source of getAstGrepRuleSources(root)) {
+    const rules = source.origin === "project" ? loadYamlRulesFresh(source.dir) : loadYamlRules(source.dir);
+    sources.push({ source, rules });
+    for (const rule of rules) {
+      if (effectiveRules.has(rule.id))
+        continue;
+      effectiveRules.set(rule.id, { rule, source });
+    }
+  }
+  return { sources, effectiveRules };
+}

package/extensions/dm-lens/dist/clients/dispatch/auxiliary-lsp.js

@@ -0,0 +1,158 @@
+import { shouldDegradeAuxiliaryLsp } from "../lsp-budget.js";
+import { isSubagentSession } from "../subagent-mode.js";
+import { findLocalOpengrepConfig } from "../opengrep-config.js";
+import { findLocalTyposConfig } from "../typos-config.js";
+import { findLocalZizmorConfig } from "../zizmor-config.js";
+import { classifyDefect } from "./diagnostic-taxonomy.js";
+import { isRuleIgnoredForPath, loadRuleIgnorePatterns } from "./rule-ignores.js";
+const NOSEMGREP_RE = /(?:#|\/\/)\s*nosemgrep(?::\s*(.+))?/i;
+const NOSEMGREP_STANDALONE_RE = /^\s*(?:#|\/\/)\s*nosemgrep(?::\s*(.+))?\s*$/i;
+export function isNosemgrepSuppressed(d, content) {
+  const startLine = d.range?.start?.line;
+  if (startLine == null)
+    return false;
+  const lines = content.split(`
+`);
+  const ruleId = String(d.code ?? "");
+  const checkLine = (text, standaloneOnly) => {
+    if (!text)
+      return false;
+    const m = (standaloneOnly ? NOSEMGREP_STANDALONE_RE : NOSEMGREP_RE).exec(text);
+    if (!m)
+      return false;
+    if (m[1] === undefined)
+      return true;
+    return m[1].split(",").map((s) => s.trim()).filter(Boolean).includes(ruleId);
+  };
+  return checkLine(lines[startLine], false) || checkLine(lines[startLine - 1], true);
+}
+const ZIZMOR_IGNORE_RE = /#\s*zizmor:\s*ignore\[([^\]]+)\]/i;
+export function isZizmorIgnoreSuppressed(d, content) {
+  const startLine = d.range?.start?.line;
+  if (startLine == null)
+    return false;
+  const line = content.split(`
+`)[startLine];
+  if (!line)
+    return false;
+  const match = ZIZMOR_IGNORE_RE.exec(line);
+  if (!match)
+    return false;
+  const ruleId = String(d.code ?? "").toLowerCase();
+  return match[1].split(",").map((s) => s.trim().toLowerCase()).includes(ruleId);
+}
+const blockOnErrorWhenAllowed = (d, { blockingAllowed }) => blockingAllowed && d.severity === 1 ? "blocking" : "warning";
+export const AUXILIARY_LSP_PROFILES = [
+  {
+    serverId: "opengrep",
+    tool: "opengrep",
+    sourceMatch: /opengrep|semgrep/i,
+    killSwitchFlag: "no-opengrep",
+    enabledByDefault: true,
+    allowBlocking: (cwd) => Boolean(findLocalOpengrepConfig(cwd)),
+    semantic: blockOnErrorWhenAllowed,
+    defectClass: (d) => classifyDefect(String(d.code ?? ""), "opengrep", d.message ?? ""),
+    isSuppressed: isNosemgrepSuppressed
+  },
+  {
+    serverId: "ast-grep",
+    tool: "ast-grep",
+    sourceMatch: /ast[-_]?grep/i,
+    killSwitchFlag: "no-ast-grep",
+    enabledByDefault: true,
+    skipTestFiles: true,
+    allowBlocking: () => true,
+    semantic: blockOnErrorWhenAllowed,
+    defectClass: (d) => classifyDefect(String(d.code ?? ""), "ast-grep", d.message ?? "")
+  },
+  {
+    serverId: "zizmor",
+    tool: "zizmor",
+    sourceMatch: /zizmor/i,
+    killSwitchFlag: "no-zizmor",
+    enabledByDefault: true,
+    allowBlocking: (cwd) => Boolean(findLocalZizmorConfig(cwd)),
+    semantic: blockOnErrorWhenAllowed,
+    defectClass: (d) => classifyDefect(String(d.code ?? ""), "zizmor", d.message ?? ""),
+    isSuppressed: isZizmorIgnoreSuppressed
+  },
+  {
+    serverId: "typos",
+    tool: "typos",
+    sourceMatch: /typos/i,
+    killSwitchFlag: "no-typos",
+    enabledByDefault: true,
+    allowBlocking: (cwd) => Boolean(findLocalTyposConfig(cwd)),
+    semantic: blockOnErrorWhenAllowed,
+    defectClass: () => "style"
+  }
+];
+export function enabledAuxiliaryLspServerIds(getFlag) {
+  if (shouldDegradeAuxiliaryLsp() || isSubagentSession())
+    return [];
+  return AUXILIARY_LSP_PROFILES.flatMap((p) => p.enabledByDefault && !(p.killSwitchFlag && getFlag(p.killSwitchFlag) === true) ? [p.serverId] : []);
+}
+const profileForSourceCache = new Map;
+export function findAuxiliaryProfileForSource(source) {
+  if (!source)
+    return;
+  const cached = profileForSourceCache.get(source);
+  if (cached !== undefined || profileForSourceCache.has(source))
+    return cached;
+  const found = AUXILIARY_LSP_PROFILES.find((p) => p.sourceMatch.test(source));
+  profileForSourceCache.set(source, found);
+  return found;
+}
+export function isAuxiliaryDiagnosticSuppressed(d, content) {
+  const profile = findAuxiliaryProfileForSource(d.source);
+  return Boolean(profile?.isSuppressed?.(d, content));
+}
+export function applyAuxiliarySuppressions(diagnostics, content, opts) {
+  const { filePath, scanRoot } = opts ?? {};
+  const ruleIgnores = filePath && scanRoot ? loadRuleIgnorePatterns(scanRoot) : undefined;
+  return diagnostics.filter((d) => {
+    if (isAuxiliaryDiagnosticSuppressed(d, content))
+      return false;
+    if (opts?.fileRole === "test") {
+      const profile = findAuxiliaryProfileForSource(d.source);
+      if (profile?.skipTestFiles)
+        return false;
+    }
+    if (ruleIgnores !== undefined && findAuxiliaryProfileForSource(d.source)?.tool === "ast-grep" && isRuleIgnoredForPath(filePath, scanRoot, ruleIgnores.get(String(d.code)))) {
+      return false;
+    }
+    return true;
+  });
+}
+export function retagAuxiliaryDiagnostics(diagnostics, rawLspDiags, content, ctx) {
+  const blockingAllowedByProfile = new Map;
+  const suppressedIndices = new Set;
+  for (let i = 0;i < diagnostics.length; i++) {
+    const profile = findAuxiliaryProfileForSource(rawLspDiags[i]?.source);
+    if (!profile)
+      continue;
+    if (profile.skipTestFiles && ctx.fileRole === "test") {
+      suppressedIndices.add(i);
+      continue;
+    }
+    if (isAuxiliaryDiagnosticSuppressed(rawLspDiags[i], content)) {
+      suppressedIndices.add(i);
+      continue;
+    }
+    let blockingAllowed = blockingAllowedByProfile.get(profile);
+    if (blockingAllowed === undefined) {
+      blockingAllowed = profile.allowBlocking?.(ctx.cwd) ?? false;
+      blockingAllowedByProfile.set(profile, blockingAllowed);
+    }
+    const d = diagnostics[i];
+    d.tool = profile.tool;
+    d.semantic = profile.semantic(rawLspDiags[i], { blockingAllowed });
+    if (d.semantic !== "blocking" && d.severity === "error") {
+      d.severity = "warning";
+    }
+    const defectClass = profile.defectClass?.(rawLspDiags[i]);
+    if (defectClass)
+      d.defectClass = defectClass;
+  }
+  return suppressedIndices.size ? diagnostics.filter((_, i) => !suppressedIndices.has(i)) : diagnostics;
+}

package/extensions/dm-lens/dist/clients/dispatch/collect-later-tier.js

@@ -0,0 +1,25 @@
+import { normalizeMapKey } from "../path-utils.js";
+export const COLLECT_LATER_THRESHOLD_MS = 5000;
+const slowRunners = new Map;
+function key(projectRoot, runnerId) {
+  return `${normalizeMapKey(projectRoot)}\x00${runnerId}`;
+}
+export function classifyObservedRunner(projectRoot, runnerId) {
+  return slowRunners.has(key(projectRoot, runnerId)) ? "collect-later" : "inline";
+}
+export function observeRunnerLatency(options) {
+  const normalizedProjectRoot = normalizeMapKey(options.projectRoot);
+  const runnerKey = key(normalizedProjectRoot, options.runnerId);
+  if (options.timedOut === true || options.durationMs > COLLECT_LATER_THRESHOLD_MS) {
+    slowRunners.set(runnerKey, {
+      projectRoot: normalizedProjectRoot,
+      runnerId: options.runnerId
+    });
+    return "collect-later";
+  }
+  slowRunners.delete(runnerKey);
+  return "inline";
+}
+export function resetObservedRunnerLatency() {
+  slowRunners.clear();
+}

package/extensions/dm-lens/dist/clients/dispatch/diagnostic-taxonomy.js

@@ -0,0 +1,58 @@
+const SILENT_ERROR_HINTS = [
+  "empty-catch",
+  "no-discarded-error",
+  "unchecked-throwing-call",
+  "bare-except",
+  "empty-rescue",
+  "swallow",
+  "silent"
+];
+const INJECTION_HINTS = [
+  "sql-injection",
+  "command-injection",
+  "template-injection",
+  "xss",
+  "eval",
+  "exec",
+  "inner-html",
+  "javascript-url"
+];
+const SECRET_HINTS = [
+  "secret",
+  "token",
+  "password",
+  "api-key",
+  "hardcoded-secrets"
+];
+const ASYNC_HINTS = [
+  "await-in-loop",
+  "promise",
+  "concurrency",
+  "async",
+  "then-catch"
+];
+function hasAny(haystack, hints) {
+  return hints.some((h) => haystack.includes(h));
+}
+export function classifyDefect(rule, tool, message) {
+  const text = `${rule ?? ""} ${tool ?? ""} ${message ?? ""}`.toLowerCase();
+  if (hasAny(text, SILENT_ERROR_HINTS))
+    return "silent-error";
+  if (hasAny(text, INJECTION_HINTS))
+    return "injection";
+  if (hasAny(text, SECRET_HINTS))
+    return "secrets";
+  if (hasAny(text, ASYNC_HINTS))
+    return "async-misuse";
+  if (text.includes("no-") || text.includes("return") || text.includes("constructor")) {
+    return "correctness";
+  }
+  if (text.includes("unsafe") || text.includes("security") || text.includes("ssrf") || text.includes("path-traversal") || text.includes("deserial") || text.includes("auth-bypass") || text.includes("crypto"))
+    return "safety";
+  if (text.includes("style") || text.includes("format"))
+    return "style";
+  return "unknown";
+}
+export function classifyDiagnostic(d) {
+  return classifyDefect(d.rule, d.tool, d.message);
+}