@duckmind/dm-linux-x64 0.63.9 → 0.64.2

package/extensions/dm-lens/rules/tree-sitter-queries/typescript-disabled/hardcoded-secrets.yml

@@ -0,0 +1,66 @@
+# Hardcoded Secrets
+# Detects hardcoded API keys, passwords, tokens in code
+id: hardcoded-secrets
+name: Hardcoded Secret
+severity: error
+category: security
+defect_class: secrets
+inline_tier: blocking
+language: typescript
+
+message: "Hardcoded secret in variable assignment — use environment variables"
+
+description: |
+  Hardcoded secrets in source code are a serious security risk.
+  They can be exposed through:
+  - Git history (even if deleted)
+  - Decompiled code
+  - Public repositories
+  
+  ✅ FIX: Use environment variables
+  
+  ```typescript
+  const apiKey = process.env.API_KEY;
+  if (!apiKey) throw new Error('API_KEY not set');
+  ```
+  
+  Then add to .env file (which should be in .gitignore):
+  ```
+  API_KEY=your_secret_here
+  ```
+
+query: |
+  [
+    (lexical_declaration
+      (variable_declarator
+        name: (identifier) @VARNAME
+        value: (string)))
+    (expression_statement
+      (assignment_expression
+        left: (identifier) @VARNAME
+        right: (string)))
+  ]
+
+metavars:
+  - VARNAME
+
+tags:
+  - security
+  - secrets
+  - best-practice
+  - owasp
+
+post_filter: check_secret_pattern
+
+examples:
+  bad: |
+    const api_key = "sk-live-abc123xyz789";
+    const password = "hunter2";
+    const SECRET = "my-secret-value";
+  
+  good: |
+    const api_key = process.env.API_KEY;
+    const password = process.env.DATABASE_PASSWORD;
+    const secret = process.env.SECRET_KEY;
+
+has_fix: false

package/extensions/dm-lens/rules/tree-sitter-queries/typescript-disabled/long-parameter-list.yml

@@ -0,0 +1,64 @@
+# Long Parameter List
+# Detects functions with 6+ parameters
+id: long-parameter-list
+name: Long Parameter List
+severity: warning
+category: complexity
+defect_class: safety
+inline_tier: review
+language: typescript
+
+message: "Function has {{PARAM_COUNT}} parameters — use object pattern"
+
+description: |
+  Functions with many parameters are hard to use and maintain.
+  Use an options object instead.
+  
+  ✅ FIX: Convert to options object pattern
+
+query: |
+  (function_declaration
+    name: (identifier) @NAME
+    parameters: (formal_parameters) @PARAMS
+    body: (statement_block) @BODY)
+
+metavars:
+  - NAME
+  - PARAMS
+  - BODY
+
+# Post-filter: count parameters
+post_filter: count_params
+post_filter_params:
+  min_params: 6
+
+tags:
+  - complexity
+  - refactoring
+  - maintainability
+
+examples:
+  bad: |
+    function createUser(
+      firstName, lastName, email, 
+      password, age, role, status
+    ) {
+      // ...
+    }
+  
+  good: |
+    interface CreateUserOptions {
+      firstName: string;
+      lastName: string;
+      email: string;
+      password: string;
+      age: number;
+      role: string;
+      status: string;
+    }
+    
+    function createUser(options: CreateUserOptions) {
+      // ...
+    }
+
+has_fix: false

package/extensions/dm-lens/rules/tree-sitter-queries/typescript-disabled/nested-ternary.yml

@@ -0,0 +1,47 @@
+# Nested Ternary
+# Detects deeply nested ternary operators (readability issue)
+id: nested-ternary
+name: Nested Ternary
+severity: warning
+category: readability
+defect_class: safety
+inline_tier: review
+language: typescript
+
+message: "Nested ternary — use if/else or early returns for clarity"
+
+description: |
+  Nested ternary operators are hard to read and understand.
+  Prefer if/else statements or early returns.
+  
+  ✅ FIX: Use if/else or switch statement
+
+query: |
+  (ternary_expression
+    consequence: (ternary_expression) @NESTED)
+  (ternary_expression
+    alternative: (ternary_expression) @NESTED)
+
+metavars:
+  - NESTED
+
+tags:
+  - readability
+  - code-quality
+
+examples:
+  bad: |
+    const value = condition1 
+      ? condition2 
+        ? condition3 ? "a" : "b"
+        : "c"
+      : "d";
+  
+  good: |
+    function getValue(c1, c2, c3) {
+      if (!c1) return "d";
+      if (!c2) return "c";
+      return c3 ? "a" : "b";
+    }
+
+has_fix: false

package/extensions/dm-lens/rules/typos/_typos.toml

@@ -0,0 +1,17 @@
+# dm-lens bundled default typos allowlist (#967).
+#
+# This file is injected as `initializationOptions.config` for the `typos-lsp`
+# auxiliary server ONLY when a project has no local typos config of its own
+# (`typos.toml` / `_typos.toml` / `.typos.toml` — see clients/typos-config.ts).
+# Any project-owned config always wins outright: dm-lens injects nothing in
+# that case, so this file never merges with (and can never outrank) a team's
+# own allowlist.
+#
+# Keep this list to evidenced false positives only — exact-identifier matches
+# via `extend-identifiers`, never the looser `extend-words` (which also
+# rewrites substrings inside unrelated words). Do not bulk-import a
+# dictionary here; every entry must have a provenance comment.
+
+[default.extend-identifiers]
+dito = "dito"               # #967 — real model/vendor namespace (provider-failover normalization prefix), not a misspelling of "ditto"
+unparseable = "unparseable" # #967 — valid English spelling ("un-parseable"), not a typo of "unparsable"

package/extensions/dm-lens/scripts/lib/process-scan.mjs

@@ -0,0 +1,256 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+function runningOnWindows() {
+  return process.platform === "win32";
+}
+export const DEFAULT_SNAPSHOT_TIMEOUT_MS = 4000;
+const FIELD_COLUMNS = Object.freeze({
+  pid: { wmi: "ProcessId", ps: "pid", token: "int" },
+  ppid: { wmi: "ParentProcessId", ps: "ppid", token: "int" },
+  ageMs: { wmi: "CreationDate", ps: "etime", token: "age" },
+  rssBytes: { wmi: "WorkingSetSize", ps: null, token: "int" },
+  cpuKernel100ns: { wmi: "KernelModeTime", ps: null, token: "int" },
+  cpuUser100ns: { wmi: "UserModeTime", ps: null, token: "int" },
+  startedAt: { wmi: "CreationDate", ps: null, token: "text" },
+  command: { wmi: "CommandLine", ps: "args", token: "tail" }
+});
+const FIELD_ORDER = Object.freeze(Object.keys(FIELD_COLUMNS));
+export const ALL_PROCESS_FIELDS = Object.freeze(["pid", "ppid", "command"]);
+const FILTERABLE_COLUMNS = new Set(["ProcessId", "Name", "CommandLine"]);
+export function windowsExe(name) {
+  return path.join(process.env.SystemRoot ?? path.join("C:", "Windows"), "System32", name);
+}
+export function posixPsPath() {
+  try {
+    if (fs.existsSync("/bin/ps"))
+      return "/bin/ps";
+    if (fs.existsSync("/usr/bin/ps"))
+      return "/usr/bin/ps";
+  } catch {}
+  return "/bin/ps";
+}
+export function normalizeProcessFields(fields) {
+  const requested = new Set((fields ?? ALL_PROCESS_FIELDS).filter((field) => (field in FIELD_COLUMNS)));
+  requested.add("pid");
+  return FIELD_ORDER.filter((field) => requested.has(field));
+}
+export function escapeWqlLikeValue(value) {
+  return String(value).replaceAll("'", "''").replaceAll(/[%_]/g, (ch) => `[${ch}]`);
+}
+export function escapeWqlStringValue(value) {
+  return String(value).replaceAll("'", "''");
+}
+function assertPid(value) {
+  const pid = Number(value);
+  if (!Number.isInteger(pid) || pid <= 0) {
+    throw new Error(`process filter: invalid pid ${String(value)}`);
+  }
+  return pid;
+}
+function wqlFilterExpression(filter) {
+  const { column, op, values } = filter;
+  if (!FILTERABLE_COLUMNS.has(column)) {
+    throw new Error(`process filter: unsupported column ${String(column)}`);
+  }
+  const list = [...values];
+  if (list.length === 0) {
+    throw new Error(`process filter: ${column} filter has no values`);
+  }
+  if (column === "ProcessId") {
+    return list.map((value) => `ProcessId=${assertPid(value)}`).join(" OR ");
+  }
+  if (op === "like") {
+    return list.map((value) => `${column} LIKE '%${escapeWqlLikeValue(value)}%'`).join(" OR ");
+  }
+  return list.map((value) => `${column} = '${escapeWqlStringValue(value)}'`).join(" OR ");
+}
+export function buildProcessQuery(fields = ALL_PROCESS_FIELDS, options = {}) {
+  const layout = normalizeProcessFields(fields);
+  const filter = options.filter;
+  if (runningOnWindows()) {
+    const columns = [
+      ...new Set(layout.map((field) => FIELD_COLUMNS[field].wmi))
+    ];
+    const where = filter ? ` WHERE ${wqlFilterExpression(filter)}` : "";
+    const excludeSelf = options.excludeSelfPid ? " | Where-Object { $_.ProcessId -ne $PID }" : "";
+    const prelude = layout.includes("ageMs") ? "$age = if ($_.CreationDate -is [datetime]) { [int64]((Get-Date) - $_.CreationDate).TotalMilliseconds } else { '' }; " : "";
+    const row = layout.map((field) => field === "ageMs" ? "$age" : `$($_.${FIELD_COLUMNS[field].wmi})`).join("`t");
+    return {
+      command: windowsExe("WindowsPowerShell\\v1.0\\powershell.exe"),
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `Get-CimInstance -Query "SELECT ${columns.join(",")} FROM Win32_Process${where}"${excludeSelf} | ForEach-Object { ${prelude}"${row}" }`
+      ],
+      tabSeparated: true,
+      fields: layout,
+      serverSideFiltered: Boolean(filter)
+    };
+  }
+  const unsupported = layout.filter((field) => !FIELD_COLUMNS[field].ps);
+  if (unsupported.length > 0) {
+    throw new Error(`process query: ${unsupported.join(", ")} has no POSIX ps column`);
+  }
+  const columns = layout.map((field) => `${FIELD_COLUMNS[field].ps}=`).join(",");
+  const pidFilter = filter && filter.column === "ProcessId" && filter.op === "eq" ? [...filter.values].map((value) => assertPid(value)) : null;
+  return {
+    command: posixPsPath(),
+    args: pidFilter ? ["-p", pidFilter.join(","), "-o", columns] : ["-eo", columns],
+    tabSeparated: false,
+    fields: layout,
+    serverSideFiltered: Boolean(pidFilter)
+  };
+}
+function parseNonNegativeInt(raw) {
+  const token = String(raw ?? "").trim();
+  if (!/^\d+$/.test(token))
+    return;
+  const value = Number(token);
+  return Number.isFinite(value) ? value : undefined;
+}
+export function ageMsFromPosixEtime(raw) {
+  const token = String(raw ?? "").trim();
+  if (!/^(?:\d+-)?(?:\d+:)?\d+:\d+$/.test(token))
+    return;
+  let days = 0;
+  let rest = token;
+  const dash = rest.indexOf("-");
+  if (dash >= 0) {
+    days = Number(rest.slice(0, dash));
+    rest = rest.slice(dash + 1);
+  }
+  const parts = rest.split(":").map(Number);
+  if (parts.some((part) => !Number.isFinite(part)))
+    return;
+  const [hours, minutes, seconds] = parts.length === 3 ? parts : [0, parts[0], parts[1]];
+  return ((days * 24 + hours) * 60 * 60 + minutes * 60 + seconds) * 1000;
+}
+function posixTokenPattern(field) {
+  return FIELD_COLUMNS[field].token === "age" ? "(\\S+)" : "(\\d+)";
+}
+export function parseProcessTable(out, tabSeparated, fields = ALL_PROCESS_FIELDS) {
+  const layout = normalizeProcessFields(fields);
+  const commandIndex = layout.indexOf("command");
+  const positional = tabSeparated ? null : new RegExp(`^\\s*${layout.filter((field) => field !== "command").map((field) => posixTokenPattern(field)).join("\\s+")}${commandIndex === -1 ? "\\s*$" : "\\s+(.*)$"}`);
+  const rows = [];
+  for (const line of String(out ?? "").split(/\r?\n/)) {
+    if (!line.trim())
+      continue;
+    let parts;
+    if (tabSeparated) {
+      const split = line.split("\t");
+      if (split.length < layout.length - (commandIndex === -1 ? 0 : 1))
+        continue;
+      parts = commandIndex === -1 ? split : [
+        ...split.slice(0, commandIndex),
+        split.slice(commandIndex).join("\t")
+      ];
+    } else {
+      const match = positional?.exec(line);
+      if (!match)
+        continue;
+      parts = match.slice(1);
+    }
+    const value = (field) => {
+      const at = layout.indexOf(field);
+      return at === -1 ? undefined : parts[at];
+    };
+    const pid = Number(value("pid"));
+    if (!Number.isInteger(pid) || pid <= 0)
+      continue;
+    const ppid = Number(value("ppid"));
+    const row = {
+      pid,
+      ppid: Number.isInteger(ppid) && ppid > 0 ? ppid : 0,
+      command: value("command") ?? ""
+    };
+    for (const field of layout) {
+      if (field === "pid" || field === "ppid" || field === "command")
+        continue;
+      const raw = value(field);
+      if (field === "ageMs") {
+        row.ageMs = tabSeparated ? parseNonNegativeInt(raw) : ageMsFromPosixEtime(raw ?? "");
+      } else if (field === "startedAt") {
+        row.startedAt = String(raw ?? "").trim();
+      } else {
+        row[field] = parseNonNegativeInt(raw);
+      }
+    }
+    rows.push(row);
+  }
+  return rows;
+}
+export function snapshotProcesses(fields = ALL_PROCESS_FIELDS, timeoutMs = DEFAULT_SNAPSHOT_TIMEOUT_MS, options = {}) {
+  let query;
+  try {
+    query = buildProcessQuery(fields, options);
+  } catch {
+    return Promise.resolve({ rows: [], ok: false });
+  }
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (rows, ok) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ rows, ok });
+    };
+    let child;
+    const timer = setTimeout(() => {
+      try {
+        child?.kill();
+      } catch {}
+      finish([], false);
+    }, timeoutMs);
+    try {
+      child = spawn(query.command, query.args, {
+        shell: false,
+        windowsHide: true,
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+    } catch {
+      finish([], false);
+      return;
+    }
+    let out = "";
+    child.stdout.on("data", (chunk) => {
+      out += chunk.toString();
+    });
+    child.once("error", () => finish([], false));
+    child.once("close", (code, signal) => finish(parseProcessTable(out, query.tabSeparated, query.fields), code === 0 && !signal));
+  });
+}
+export const LSP_PROCESS_MARKERS = [
+  "typescript-language-server",
+  "ast-grep lsp",
+  "ast-grep-lsp",
+  "pyright-langserver",
+  "vscode-json-languageserver"
+];
+export function isLspServerCommand(command) {
+  const lower = command.toLowerCase();
+  return LSP_PROCESS_MARKERS.some((marker) => lower.includes(marker.toLowerCase()));
+}
+export function diffSurvivingLspProcesses(before, after) {
+  const beforePids = new Set(before.map((r) => r.pid));
+  return after.filter((row) => !beforePids.has(row.pid) && isLspServerCommand(row.command));
+}
+export function evaluateNoSurvivingLspProcesses(before, after) {
+  const id = "no-surviving-lsp-processes";
+  if (!before.ok || !after.ok) {
+    return {
+      id,
+      pass: false,
+      detail: `process listing unavailable (before.ok=${before.ok}, after.ok=${after.ok}); cannot verify no LSP process survived`
+    };
+  }
+  const surviving = diffSurvivingLspProcesses(before.rows, after.rows);
+  return {
+    id,
+    pass: surviving.length === 0,
+    detail: surviving.length === 0 ? "no new LSP-server processes survived pi's exit" : `${surviving.length} surviving process(es): ${surviving.map((p) => `pid=${p.pid} ${p.command.slice(0, 80)}`).join("; ")}`
+  };
+}

package/extensions/dm-lens/skills/pi-lens-ast-grep/SKILL.md

@@ -0,0 +1,177 @@
+---
+name: dm-lens-ast-grep
+description: Use when searching or replacing code patterns - use ast-grep instead of text search for semantic accuracy
+---
+
+# AST-Grep Code Search
+
+Use `ast_grep_search` and `ast_grep_replace` for semantic code search/replace. ast-grep understands code structure, not just text.
+
+These tools (plus `ast_grep_outline`, `ast_grep_dump`, `lsp_navigation`) are registered but inactive by default on hosts that support pi's dynamic tooling. If a call to one of them isn't recognized, activate it first: `dm_lens_activate_tools tools=["ast_grep_search", "ast_grep_replace"]`.
+
+## When to Use
+
+- Function calls, imports, class methods (structured code)
+- Safe replacements across files
+- **Use LSP first for:** definitions/references/types — then scope ast-grep to files discovered by LSP
+- **Use grep for:** partial string patterns, comments, URLs, or after one simplified ast-grep retry still returns zero matches
+
+## Golden Rules
+
+1. **Be specific** — `fetchMetrics($ARGS)` not `fetchMetrics`
+2. **Scope it** — always specify `paths` to relevant files
+3. **Retry once on zero matches** — simplify the pattern, same `paths`, then fall back to grep
+4. **Dry-run first** — `apply: false` before `apply: true`
+5. **Valid code only** — `function $NAME($$$) { $$$ }` not `function $NAME(`
+6. **Avoid `selector` unless expert** — narrows to AST node kind; does not extract metavariables
+7. **Metavariables don't work inside strings** — `from "$PATH"` matches literal `"$PATH"`, not a wildcard
+
+## Metavariables
+
+| Syntax | Matches | Named? |
+|---|---|---|
+| `$X` | single node | yes — captures the node |
+| `$$$` | zero or more nodes | no — unnamed wildcard |
+| `$$$ARGS` | zero or more nodes | yes — captures the list |
+
+Use `$$$` when you don't need the captured value; `$$$NAME` when you do.
+
+## Quick Reference
+
+### Patterns
+
+| Pattern | Matches |
+|---|---|
+| `fetchMetrics($ARGS)` | call with any single arg |
+| `fetchMetrics($$$ARGS)` | call with any number of args |
+| `function $NAME($$$) { $$$ }` | function declaration |
+| `import { $NAMES } from $PATH` | named import (no quotes on path) |
+| `const $X = $Y` | variable declaration |
+
+### Structural-intent parameters (preferred for cross-context queries)
+
+Use these instead of writing raw YAML:
+
+| Parameter | Tool | What it does |
+|---|---|---|
+| `insideKind` | both | Only match inside an ancestor of this node kind (searches ALL ancestors, `stopBy: end`) |
+| `hasKind` | both | Only match nodes whose **immediate child** has this kind (`stopBy: neighbor` — NOT recursive) |
+| `hasDescendantKind` | both | Only match nodes containing this kind **anywhere in their descendants** (`stopBy: end`) — use this instead of `hasKind` when the target isn't a direct child |
+| `follows` | both | Only match nodes preceded by a sibling matching this pattern |
+| `precedes` | both | Only match nodes followed by a sibling matching this pattern |
+
+`hasKind` and `hasDescendantKind` are mutually exclusive on both tools — combining them errors.
+
+⚠ `insideKind` searches ALL ancestors (`stopBy: end`) with no boundary of its own — on a deeply nested file it can escalate past the enclosing function you meant and match against an unrelated outer scope; scope with `paths` or a raw YAML `rule:` with its own `stopBy` boundary if that matters.
+
+```
+# console.log only inside functions
+ast_grep_search pattern="console.log($MSG)" lang="typescript" insideKind="function_declaration"
+
+# replace var with let, scoped to functions only
+ast_grep_replace pattern="var $X" rewrite="let $X" lang="javascript" insideKind="function_declaration"
+```
+
+These synthesize a YAML rule automatically. Use `rule:` for the full DSL when you need `all`/`any`/`not`, `nthChild`, `regex`, or other advanced constraints.
+
+### Raw YAML rule (`rule:` parameter)
+
+Pass a complete ast-grep YAML rule to unlock the full DSL:
+
+```
+ast_grep_search rule="id: my-rule
+language: TypeScript
+rule:
+  pattern: console.log($MSG)
+  inside:
+    kind: function_declaration
+    stopBy: end" lang="typescript"
+```
+
+### Debugging unknown node kinds — `ast_grep_dump`
+
+When a pattern returns zero matches and you don't know the correct node kind or field name, use `ast_grep_dump` to inspect a SMALL representative snippet:
+
+```
+ast_grep_dump source="function foo() { return 1; }" lang="typescript"
+```
+
+Returns the full indented AST with node kinds and positions. Then use the correct kind in your pattern or `insideKind`. `ast_grep_dump` is registered but inactive by default — call `dm_lens_activate_tools` with `tools: ["ast_grep_dump"]` first if it isn't already active.
+
+### Composite (has/inside) in raw YAML
+
+```yaml
+# console.log inside a class method
+pattern: console.log($$$)
+inside:
+  kind: method_definition
+  stopBy: end
+```
+
+Use `kind:` directly when you want to match a node type without a pattern:
+
+```yaml
+# any arrow function
+kind: arrow_function
+```
+
+## Common Gotchas
+
+```
+❌ $VAR inside quotes — matches literal "$VAR", not a metavar
+   from "$PATH"  →  use grep for wildcard path matching
+   from "./utils"  →  ✅ exact string literal works fine
+
+❌ Trailing comma in objects
+   { type: $T, }  →  use { type: $T }
+
+❌ Shorthand property mismatch
+   { runnerId: $RID }  →  won't match { runnerId }
+   use { runnerId } or { runnerId, $$$REST }
+
+❌ Unnamed $$$ when you need the value
+   foo($$$)  →  captures nothing; use foo($$$ARGS) to inspect matches
+
+❌ Multiple top-level statements — triggers "Multiple AST nodes are detected"
+   Two shapes, two fixes:
+
+   1. Sequence inside a block — wrap in braces:
+      foo(); bar();  →  { foo(); bar(); }
+
+   2. Cross-context (module-level + block-level together, e.g. an import AND a call) —
+      wrapping in {} makes the pattern invalid (imports can't live inside a block).
+      Use two searches: find files containing the import, then scope the call search
+      to those paths. Or use a YAML `inside:`/`has:` rule (see Composite section above).
+```
+
+**No matches?**
+
+1. Try `strictness: relaxed` — ignores unnamed punctuation (trailing commas, semicolons) that `smart` mode requires
+2. Use `ast_grep_dump` on a sample snippet to verify the correct node kind
+3. Simplify the pattern and retry once
+4. Fall back to `grep` or `lsp_navigation`
+
+## Agent task recipes
+
+Use these as starting points, then scope `paths` tightly.
+
+| Task | Pattern / params |
+|---|---|
+| Find object-literal function dependency by name | `pattern: { resetLSPService: $FN, $$$REST }` |
+| Find empty catches | `pattern: try { $$$BODY } catch ($ERR) { }` |
+| Find fire-and-forget async calls | `pattern: void $CALL` |
+
+For lifecycle bugs, search first, then use the returned `details.matchLocations[].readSlice` handle for bounded context.
+
+**Metavar captures** appear automatically below each match line:
+
+```
+src/foo.ts:1:1: const x = foo(a, b)
+  $VAR=x  $$$ARGS=a,b
+```
+
+Named captures (`$X`, `$$$NAME`) are shown; unnamed wildcards (`$$$`) are not.
+
+**Pagination** — use `skip: N` when results are truncated (next-page hint appears in output).
+
+Debug: <https://ast-grep.github.io/playground.html>