@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-lens/dist/clients/dispatch/rules/framework-call-noise.js

@@ -0,0 +1,31 @@
+const EXPECT_CHAIN_PREFIX = "expect(";
+const TEST_LIFECYCLE_NAMES = new Set([
+  "it",
+  "test",
+  "describe",
+  "beforeeach",
+  "aftereach",
+  "beforeall",
+  "afterall"
+]);
+const TEST_LIFECYCLE_PREFIXES = ["it.", "test.", "describe."];
+const MOCK_LIBRARY_PREFIXES = ["vi.", "jest."];
+export function isTestFrameworkNoiseCall(call) {
+  const lower = call.toLowerCase();
+  if (lower === "expect" || lower.startsWith(EXPECT_CHAIN_PREFIX))
+    return true;
+  if (TEST_LIFECYCLE_NAMES.has(lower))
+    return true;
+  if (TEST_LIFECYCLE_PREFIXES.some((p) => lower.startsWith(p)))
+    return true;
+  if (MOCK_LIBRARY_PREFIXES.some((p) => lower.startsWith(p)))
+    return true;
+  return false;
+}
+export function isTestSuiteOrganizer(calls) {
+  return calls.some((call) => {
+    const lower = call.toLowerCase();
+    const base = lower.split("(")[0].split(".")[0];
+    return base === "it" || base === "test" || base === "describe";
+  });
+}

package/extensions/dm-lens/dist/clients/dispatch/rules/high-complexity.js

@@ -0,0 +1,56 @@
+import { isTestSuiteOrganizer } from "./framework-call-noise.js";
+const DEFAULT_HIGH_COMPLEXITY_THRESHOLD = 15;
+const DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD = 6;
+let ccThreshold = DEFAULT_HIGH_COMPLEXITY_THRESHOLD;
+let depthThreshold = DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD;
+function isPositiveFiniteThreshold(value) {
+  return Number.isFinite(value) && value > 0;
+}
+export function setHighComplexityThresholds(cc, depth) {
+  if (isPositiveFiniteThreshold(cc))
+    ccThreshold = cc;
+  if (isPositiveFiniteThreshold(depth))
+    depthThreshold = depth;
+}
+export function resetHighComplexityThresholds() {
+  ccThreshold = DEFAULT_HIGH_COMPLEXITY_THRESHOLD;
+  depthThreshold = DEFAULT_HIGH_COMPLEXITY_DEPTH_THRESHOLD;
+}
+export const highComplexityRule = {
+  id: "high-complexity",
+  requires: ["file.functionSummaries"],
+  appliesTo(ctx) {
+    return /\.tsx?$/.test(ctx.filePath);
+  },
+  evaluate(ctx, store) {
+    const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
+    const diagnostics = [];
+    const configuredCcThreshold = ctx.projectConfig?.rules["high-complexity"]?.threshold;
+    const activeCcThreshold = configuredCcThreshold ?? ccThreshold;
+    for (const f of fns) {
+      if (isTestSuiteOrganizer(f.outgoingCalls))
+        continue;
+      const ccBreached = f.cyclomaticComplexity >= activeCcThreshold;
+      const depthBreached = f.maxNestingDepth >= depthThreshold;
+      if (!ccBreached && !depthBreached)
+        continue;
+      const parts = [];
+      if (ccBreached)
+        parts.push(`cyclomatic complexity ${f.cyclomaticComplexity}`);
+      if (depthBreached)
+        parts.push(`nesting depth ${f.maxNestingDepth}`);
+      diagnostics.push({
+        id: `high-complexity:${ctx.filePath}:${f.line}`,
+        tool: "fact-rules",
+        rule: "high-complexity",
+        filePath: ctx.filePath,
+        line: f.line,
+        column: f.column,
+        severity: "warning",
+        semantic: "warning",
+        message: `'${f.name}' has ${parts.join(" and ")} — consider breaking it up`
+      });
+    }
+    return diagnostics;
+  }
+};

package/extensions/dm-lens/dist/clients/dispatch/rules/high-fan-out.js

@@ -0,0 +1,45 @@
+import { isTestFrameworkNoiseCall, isTestSuiteOrganizer } from "./framework-call-noise.js";
+const DEFAULT_HIGH_FAN_OUT_THRESHOLD = 20;
+let fanOutThreshold = DEFAULT_HIGH_FAN_OUT_THRESHOLD;
+export function setHighFanOutThreshold(n) {
+  if (Number.isFinite(n) && n > 0)
+    fanOutThreshold = n;
+}
+export function resetHighFanOutThreshold() {
+  fanOutThreshold = DEFAULT_HIGH_FAN_OUT_THRESHOLD;
+}
+export const highFanOutRule = {
+  id: "high-fan-out",
+  requires: ["file.functionSummaries"],
+  appliesTo(ctx) {
+    return /\.tsx?$/.test(ctx.filePath);
+  },
+  evaluate(ctx, store) {
+    const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
+    const diagnostics = [];
+    const configuredFanOutThreshold = ctx.projectConfig?.rules["high-fan-out"]?.threshold;
+    const activeFanOutThreshold = configuredFanOutThreshold ?? fanOutThreshold;
+    for (const f of fns) {
+      if (isTestSuiteOrganizer(f.outgoingCalls))
+        continue;
+      const meaningful = f.outgoingCalls.filter((c) => {
+        const lower = c.toLowerCase();
+        return !lower.startsWith("console.") && !lower.startsWith("math.") && !lower.startsWith("json.") && !lower.startsWith("object.") && !lower.startsWith("array.") && !lower.startsWith("string(") && !lower.startsWith("number(") && !lower.startsWith("boolean(") && !lower.startsWith("error(") && c !== "resolve" && c !== "reject" && c !== "next" && c !== "done" && !isTestFrameworkNoiseCall(c);
+      });
+      if (meaningful.length < activeFanOutThreshold)
+        continue;
+      diagnostics.push({
+        id: `high-fan-out:${ctx.filePath}:${f.line}`,
+        tool: "fact-rules",
+        rule: "high-fan-out",
+        filePath: ctx.filePath,
+        line: f.line,
+        column: f.column,
+        severity: "warning",
+        semantic: "warning",
+        message: `'${f.name}' calls ${meaningful.length} distinct functions — coordination smell, consider splitting responsibilities`
+      });
+    }
+    return diagnostics;
+  }
+};

package/extensions/dm-lens/dist/clients/dispatch/rules/high-import-coupling.js

@@ -0,0 +1,31 @@
+const IMPORT_COUPLING_THRESHOLD = 15;
+const IMPORT_COUPLING_EXEMPT = /[/\\](index|integration)\.[cm]?tsx?$/;
+export const highImportCouplingRule = {
+  id: "high-import-coupling",
+  requires: ["file.imports"],
+  appliesTo(ctx) {
+    return /\.tsx?$/.test(ctx.filePath);
+  },
+  evaluate(ctx, store) {
+    if (IMPORT_COUPLING_EXEMPT.test(ctx.filePath))
+      return [];
+    const imports = store.getFileFact(ctx.filePath, "file.imports") ?? [];
+    const sources = new Set(imports.map((i) => i.source));
+    const count = sources.size;
+    if (count <= IMPORT_COUPLING_THRESHOLD)
+      return [];
+    return [
+      {
+        id: `high-import-coupling:${ctx.filePath}:1:1`,
+        tool: "fact-rules",
+        rule: "high-import-coupling",
+        filePath: ctx.filePath,
+        line: 1,
+        column: 1,
+        severity: "warning",
+        semantic: "warning",
+        message: `File imports from ${count} distinct modules (threshold: ${IMPORT_COUPLING_THRESHOLD}) — split responsibilities`
+      }
+    ];
+  }
+};

package/extensions/dm-lens/dist/clients/dispatch/rules/missing-error-propagation.js

@@ -0,0 +1,45 @@
+export const missingErrorPropagationRule = {
+  id: "missing-error-propagation",
+  requires: ["file.functionSummaries", "file.tryCatchSummaries"],
+  appliesTo(ctx) {
+    return /\.tsx?$/.test(ctx.filePath);
+  },
+  evaluate(ctx, store) {
+    const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
+    const catches = store.getFileFact(ctx.filePath, "file.tryCatchSummaries") ?? [];
+    const diagnostics = [];
+    const asyncFns = fns.filter((f) => f.isAsync && !f.isPassThroughWrapper);
+    for (const f of asyncFns) {
+      const nextFnLine = fns.filter((g) => g.line > f.line).reduce((min, g) => Math.min(min, g.line), 1 / 0);
+      const relevantCatches = catches.filter((c) => c.line >= f.line && c.line < nextFnLine);
+      for (const c of relevantCatches) {
+        if (c.isEmpty || c.hasRethrow)
+          continue;
+        if (!c.hasLogging)
+          continue;
+        if (c.catchReturnsDefault)
+          continue;
+        if (c.catchReturnsStructuredError)
+          continue;
+        if (c.isDocumentedLocalFallback)
+          continue;
+        if (c.isFilesystemExistenceProbe)
+          continue;
+        if (/\b(serverFailed|failed|error)\s*=/.test(c.bodyText))
+          continue;
+        diagnostics.push({
+          id: `missing-error-propagation:${ctx.filePath}:${c.line}`,
+          tool: "fact-rules",
+          rule: "missing-error-propagation",
+          filePath: ctx.filePath,
+          line: c.line,
+          column: c.column,
+          severity: "warning",
+          semantic: "warning",
+          message: `Catch block in async '${f.name}' logs the error but doesn't rethrow — callers receive undefined and assume success`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};

package/extensions/dm-lens/dist/clients/dispatch/rules/no-commented-credentials.js

@@ -0,0 +1,46 @@
+const CREDENTIAL_PATTERNS = [
+  /password\s*[:=]\s*["'][^"']{3,}/i,
+  /(?:api[_-]?key|secret|token)\s*[:=]\s*["'][^"']{6,}/i,
+  /(?:aws|gcp|azure)[_-]?(?:key|secret|token)\s*[:=]\s*["'][^"']{6,}/i
+];
+const CREDENTIALS_EXEMPT = /[/\\](secrets?[-_]?(scanner|detect|check)|scanner|fixture|mock)[^/\\]*\.(tsx?|ya?ml|json|env)$/i;
+function isCommentLine(line) {
+  return line.startsWith("//") || line.startsWith("#") || line.startsWith("*");
+}
+export const commentedCredentialsRule = {
+  id: "no-commented-credentials",
+  requires: ["file.content"],
+  appliesTo(ctx) {
+    return /\.(tsx?|py|go|rb|ya?ml|json|env)$/.test(ctx.filePath) && !CREDENTIALS_EXEMPT.test(ctx.filePath);
+  },
+  evaluate(ctx, store) {
+    const content = store.getFileFact(ctx.filePath, "file.content");
+    if (!content)
+      return [];
+    const diagnostics = [];
+    const lines = content.split(`
+`);
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i].trimStart();
+      if (!isCommentLine(line))
+        continue;
+      for (const p of CREDENTIAL_PATTERNS) {
+        if (p.test(line)) {
+          diagnostics.push({
+            id: `no-commented-credentials:${ctx.filePath}:${i + 1}`,
+            tool: "fact-rules",
+            rule: "no-commented-credentials",
+            filePath: ctx.filePath,
+            line: i + 1,
+            column: 1,
+            severity: "error",
+            semantic: "blocking",
+            message: "Possible credential in commented-out code — remove it and rotate the secret"
+          });
+          break;
+        }
+      }
+    }
+    return diagnostics;
+  }
+};

package/extensions/dm-lens/dist/clients/dispatch/rules/pass-through-wrappers.js

@@ -0,0 +1,38 @@
+import { isTestFile } from "../../file-utils.js";
+const ALIAS_COMMENT_RE = /\b(alias|backward\s*compat|backwards\s*compat|compatibility|shim|adapter)\b/i;
+function hasAliasCommentNear(line, comments) {
+  return comments.some((comment) => comment.line >= line - 2 && comment.line <= line && ALIAS_COMMENT_RE.test(comment.text));
+}
+export const passThroughWrappersRule = {
+  id: "pass-through-wrappers",
+  requires: ["file.functionSummaries", "file.comments"],
+  appliesTo(ctx) {
+    return /\.tsx?$/.test(ctx.filePath) && !isTestFile(ctx.filePath);
+  },
+  evaluate(ctx, store) {
+    const summaries = store.getFileFact(ctx.filePath, "file.functionSummaries");
+    const comments = store.getFileFact(ctx.filePath, "file.comments");
+    if (!summaries || !comments)
+      return [];
+    const diagnostics = [];
+    for (const fn of summaries) {
+      if (!fn.isPassThroughWrapper || fn.statementCount !== 1 || fn.isBoundaryWrapper) {
+        continue;
+      }
+      if (hasAliasCommentNear(fn.line, comments))
+        continue;
+      diagnostics.push({
+        id: `pass-through-wrapper:${ctx.filePath}:${fn.line}:${fn.column}`,
+        tool: "fact-rules",
+        filePath: ctx.filePath,
+        line: fn.line,
+        column: fn.column,
+        severity: "warning",
+        semantic: "warning",
+        rule: "pass-through-wrappers",
+        message: `Function '${fn.name}' is a trivial pass-through wrapper`
+      });
+    }
+    return diagnostics;
+  }
+};

package/extensions/dm-lens/dist/clients/dispatch/rules/placeholder-comments.js

@@ -0,0 +1,40 @@
+import { isTestFile } from "../../file-utils.js";
+const PLACEHOLDER_PATTERNS = [
+  /add\s+more\s+validation/i,
+  /handle\s+(additional|more)\s+cases?/i,
+  /can\s+be\s+extended\s+in\s+the\s+future/i,
+  /extend\s+this\s+(logic|function|method|handler|module)/i,
+  /customize\s+this\s+(logic|behavior|function|method|handler)/i,
+  /future\s+enhancement/i,
+  /implement\s+.+\s+here/i
+];
+export const placeholderCommentsRule = {
+  id: "placeholder-comments",
+  requires: ["file.comments"],
+  appliesTo(ctx) {
+    return /\.tsx?$/.test(ctx.filePath) && !isTestFile(ctx.filePath);
+  },
+  evaluate(ctx, store) {
+    const comments = store.getFileFact(ctx.filePath, "file.comments");
+    if (!comments)
+      return [];
+    const diagnostics = [];
+    for (const comment of comments) {
+      const matched = PLACEHOLDER_PATTERNS.some((pattern) => pattern.test(comment.text));
+      if (!matched)
+        continue;
+      diagnostics.push({
+        id: `placeholder-comments:${ctx.filePath}:${comment.line}:1`,
+        tool: "fact-rules",
+        filePath: ctx.filePath,
+        line: comment.line,
+        column: 1,
+        severity: "warning",
+        semantic: "warning",
+        rule: "placeholder-comments",
+        message: "Placeholder comment detected. Prefer comments that describe current behavior over future intent."
+      });
+    }
+    return diagnostics;
+  }
+};

package/extensions/dm-lens/dist/clients/dispatch/rules/unsafe-boundary.js

@@ -0,0 +1,101 @@
+const IO_NAMESPACE_PREFIXES = [
+  "db.",
+  "prisma.",
+  "knex.",
+  "mongoose.",
+  "sequelize.",
+  "http.",
+  "https.",
+  "net.",
+  "dns.",
+  "redis.",
+  "mongo.",
+  "pg.",
+  "mysql.",
+  "s3.",
+  "storage.",
+  "bucket.",
+  "fs.promises."
+];
+const IO_EXACT_CALLEES = new Set([
+  "fetch",
+  "axios",
+  "got",
+  "request",
+  "spawn",
+  "exec",
+  "execSync",
+  "spawnSync",
+  "readFile",
+  "writeFile",
+  "appendFile",
+  "readdir",
+  "mkdir",
+  "unlink",
+  "stat"
+]);
+const CC_THRESHOLD = 6;
+function callsToBoundary(outgoingCalls) {
+  for (const callee of outgoingCalls) {
+    const lower = callee.toLowerCase();
+    if (IO_EXACT_CALLEES.has(lower))
+      return callee;
+    if (IO_NAMESPACE_PREFIXES.some((p) => lower.startsWith(p)))
+      return callee;
+  }
+  return;
+}
+function hasCatchCoverage(fn, catches) {
+  if (fn.outgoingCalls.some((c) => c === "resolve" || c === "reject"))
+    return true;
+  return catches.some((c) => {
+    if (c.line < fn.line)
+      return false;
+    if (c.isEmpty)
+      return false;
+    if (c.hasRethrow || c.hasLogging || c.catchParam === null)
+      return true;
+    if (/\breturn\b/.test(c.bodyText))
+      return true;
+    if (c.catchHasFallbackAssignment)
+      return true;
+    return false;
+  });
+}
+export const unsafeBoundaryRule = {
+  id: "unsafe-boundary",
+  requires: ["file.functionSummaries", "file.tryCatchSummaries"],
+  appliesTo(ctx) {
+    return /\.tsx?$/.test(ctx.filePath);
+  },
+  evaluate(ctx, store) {
+    const fns = store.getFileFact(ctx.filePath, "file.functionSummaries") ?? [];
+    const catches = store.getFileFact(ctx.filePath, "file.tryCatchSummaries") ?? [];
+    const diagnostics = [];
+    for (const f of fns) {
+      if (!f.isAsync)
+        continue;
+      if (f.isPassThroughWrapper)
+        continue;
+      if (f.cyclomaticComplexity < CC_THRESHOLD)
+        continue;
+      const boundaryCalle = callsToBoundary(f.outgoingCalls);
+      if (!boundaryCalle)
+        continue;
+      if (hasCatchCoverage(f, catches))
+        continue;
+      diagnostics.push({
+        id: `unsafe-boundary:${ctx.filePath}:${f.line}`,
+        tool: "fact-rules",
+        rule: "unsafe-boundary",
+        filePath: ctx.filePath,
+        line: f.line,
+        column: f.column,
+        severity: "warning",
+        semantic: "warning",
+        message: `'${f.name}' is async, calls '${boundaryCalle}', has complexity ${f.cyclomaticComplexity}, but no try/catch — unhandled rejection risk`
+      });
+    }
+    return diagnostics;
+  }
+};

package/extensions/dm-lens/dist/clients/dispatch/runner-context.js

@@ -0,0 +1,46 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { normalizeMapKey } from "../path-utils.js";
+function resolveAgainstAncestors(cwd, filePath) {
+  if (path.isAbsolute(filePath)) {
+    return path.resolve(filePath);
+  }
+  const normalizedRelative = filePath.replace(/\\/g, "/");
+  const cwdBaseName = path.basename(path.resolve(cwd)).replace(/\\/g, "/");
+  if (cwdBaseName && (normalizedRelative === cwdBaseName || normalizedRelative.startsWith(`${cwdBaseName}/`))) {
+    const trimmedRelative = normalizedRelative === cwdBaseName ? "" : normalizedRelative.slice(cwdBaseName.length + 1);
+    const trimmedCandidate = trimmedRelative ? path.resolve(cwd, trimmedRelative) : path.resolve(cwd);
+    if (fs.existsSync(trimmedCandidate)) {
+      return trimmedCandidate;
+    }
+  }
+  const directCandidate = path.resolve(cwd, filePath);
+  if (fs.existsSync(directCandidate)) {
+    return directCandidate;
+  }
+  let current = path.resolve(cwd);
+  const { root } = path.parse(current);
+  while (current !== root) {
+    const parent = path.dirname(current);
+    if (parent === current)
+      break;
+    const candidate = path.resolve(parent, filePath);
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+    current = parent;
+  }
+  return directCandidate;
+}
+export function resolveRunnerPath(cwd, filePath) {
+  return normalizeMapKey(resolveAgainstAncestors(cwd, filePath));
+}
+export function toRunnerDisplayPath(cwd, filePath) {
+  const cwdKey = normalizeMapKey(path.resolve(cwd));
+  const fileKey = resolveRunnerPath(cwd, filePath);
+  const relative = path.relative(cwdKey, fileKey).replace(/\\/g, "/");
+  if (relative && relative !== "." && !relative.startsWith("../")) {
+    return relative;
+  }
+  return fileKey;
+}

package/extensions/dm-lens/dist/clients/dispatch/runners/actionlint.js

@@ -0,0 +1,98 @@
+import path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
+import { safeSpawnAsync } from "../../safe-spawn.js";
+import { resolveRunnerCwd } from "../../tool-cwd.js";
+import { PRIORITY } from "../priorities.js";
+import { createAvailabilityChecker, resolveToolCommandWithInstallFallback } from "./utils/runner-helpers.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
+const actionlint = createAvailabilityChecker("actionlint", ".exe");
+export function isGitHubWorkflowFile(filePath) {
+  const normalized = filePath.replace(/\\/g, "/");
+  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/i.test(normalized);
+}
+function toDiagnostic(issue, filePath) {
+  const line = issue.line && issue.line > 0 ? issue.line : 1;
+  const column = issue.column && issue.column > 0 ? issue.column : 1;
+  const rule = issue.kind || "actionlint";
+  const message = issue.message || "GitHub Actions workflow issue";
+  const idMessage = message.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 80);
+  return {
+    id: `actionlint-${rule}-${line}-${column}-${idMessage}`,
+    message,
+    filePath,
+    line,
+    column,
+    severity: "error",
+    semantic: "blocking",
+    tool: "actionlint",
+    rule,
+    defectClass: "correctness",
+    matchedText: issue.snippet
+  };
+}
+export function parseActionlintJson(raw, filePath, cwd) {
+  const trimmed = raw.trim();
+  if (!trimmed)
+    return [];
+  const absTarget = path.resolve(cwd, filePath);
+  const isTarget = (issue) => !issue.filepath || pathsEqual(path.resolve(cwd, issue.filepath), absTarget);
+  try {
+    const parsed = JSON.parse(trimmed);
+    const issues = Array.isArray(parsed) ? parsed : [parsed];
+    return issues.flatMap((issue) => isTarget(issue) ? [toDiagnostic(issue, filePath)] : []);
+  } catch {
+    const diagnostics = [];
+    for (const line of trimmed.split(/\r?\n/)) {
+      if (!line.trim())
+        continue;
+      try {
+        const parsed = JSON.parse(line);
+        if (!isTarget(parsed))
+          continue;
+        diagnostics.push(toDiagnostic(parsed, filePath));
+      } catch {}
+    }
+    return diagnostics;
+  }
+}
+const actionlintRunner = {
+  id: "actionlint",
+  appliesTo: ["yaml"],
+  priority: PRIORITY.YAML_LINT + 1,
+  skipTestFiles: false,
+  when(ctx) {
+    return isGitHubWorkflowFile(ctx.filePath);
+  },
+  async run(ctx) {
+    const cwd = resolveRunnerCwd(ctx, "actionlint");
+    let cmd = null;
+    if (await actionlint.isAvailableAsync(cwd)) {
+      cmd = actionlint.getCommand(cwd);
+    } else {
+      cmd = await resolveToolCommandWithInstallFallback(cwd, "actionlint");
+    }
+    if (!cmd)
+      return { status: "skipped", diagnostics: [], semantic: "none" };
+    const relativeFilePath = path.relative(cwd, ctx.filePath) || ctx.filePath;
+    const result = await safeSpawnAsync(cmd, ["-format", "{{json .}}", relativeFilePath], {
+      cwd,
+      timeout: 15000
+    });
+    const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+    const parsed = parseToolRun("actionlint", {
+      result,
+      output,
+      exitCodes: { ran: [1, 2] }
+    }, (raw) => parseActionlintJson(raw, ctx.filePath, cwd));
+    if (parsed.skipped)
+      return parsed.skipped;
+    return finishParsedRun({
+      tool: "actionlint",
+      ctx,
+      result,
+      diagnostics: parsed.diagnostics,
+      classify: () => ({ status: "failed", semantic: "blocking" })
+    });
+  }
+};
+export default actionlintRunner;