@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-lens/dist/clients/oldtext-autopatch.js

@@ -0,0 +1,100 @@
+import { normalizeForGuardMatch } from "./host-edit-normalize.js";
+export function normalizeOldTextForMatch(text) {
+  return normalizeForGuardMatch(text);
+}
+export function findUniqueMatchLineRange(matchNormalizedContent, oldText) {
+  const needle = normalizeOldTextForMatch(oldText);
+  if (!needle)
+    return;
+  const firstIdx = matchNormalizedContent.indexOf(needle);
+  if (firstIdx === -1)
+    return;
+  const secondIdx = matchNormalizedContent.indexOf(needle, firstIdx + needle.length);
+  if (secondIdx !== -1)
+    return;
+  let startLine = 1;
+  for (let i = 0;i < firstIdx; i++) {
+    if (matchNormalizedContent.charCodeAt(i) === 10)
+      startLine++;
+  }
+  let lineCount = 1;
+  for (let i = 0;i < needle.length; i++) {
+    if (needle.charCodeAt(i) === 10)
+      lineCount++;
+  }
+  return { startLine, endLine: startLine + lineCount - 1 };
+}
+function normalizeLf(value) {
+  return value.replace(/\r\n/g, `
+`);
+}
+function countOccurrences(haystack, needle) {
+  if (!needle)
+    return 0;
+  let count = 0;
+  let pos = 0;
+  while (pos < haystack.length) {
+    const idx = haystack.indexOf(needle, pos);
+    if (idx === -1)
+      break;
+    count += 1;
+    pos = idx + needle.length;
+  }
+  return count;
+}
+export function stripTrailingWhitespaceDetailed(value) {
+  const lines = normalizeLf(value).split(`
+`);
+  let removedLineTrailingWhitespace = false;
+  const strippedLines = lines.map((line) => {
+    const stripped = line.trimEnd();
+    if (stripped !== line)
+      removedLineTrailingWhitespace = true;
+    return stripped;
+  });
+  let removedTrailingEmptyLineCount = 0;
+  while (strippedLines.length > 1 && strippedLines[strippedLines.length - 1] === "") {
+    strippedLines.pop();
+    removedTrailingEmptyLineCount += 1;
+  }
+  return {
+    text: strippedLines.join(`
+`),
+    removedLineTrailingWhitespace,
+    removedTrailingEmptyLineCount
+  };
+}
+function stripEquivalentTrailingEmptyLines(value, maxCount) {
+  if (maxCount <= 0)
+    return value;
+  const lines = normalizeLf(value).split(`
+`);
+  let removed = 0;
+  while (removed < maxCount && lines.length > 1) {
+    const last = lines[lines.length - 1];
+    if (last.trim() !== "")
+      break;
+    lines.pop();
+    removed += 1;
+  }
+  return lines.join(`
+`);
+}
+export function computeTrailingWhitespaceOldTextPatch(args) {
+  const fileContentLf = normalizeLf(args.fileContent);
+  const original = normalizeLf(args.oldText);
+  const stripped = stripTrailingWhitespaceDetailed(args.oldText);
+  if (stripped.text === original)
+    return;
+  if (countOccurrences(fileContentLf, original) !== 0)
+    return;
+  if (countOccurrences(fileContentLf, stripped.text) !== 1)
+    return;
+  const patchedNewText = args.newText !== undefined && stripped.removedTrailingEmptyLineCount > 0 ? stripEquivalentTrailingEmptyLines(args.newText, stripped.removedTrailingEmptyLineCount) : args.newText;
+  return {
+    oldText: stripped.text,
+    newText: patchedNewText,
+    removedLineTrailingWhitespace: stripped.removedLineTrailingWhitespace,
+    removedTrailingEmptyLineCount: stripped.removedTrailingEmptyLineCount
+  };
+}

package/extensions/dm-lens/dist/clients/opaque-mutation-scan.js

@@ -0,0 +1,313 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { collectSourceFilesWithBudgetAsync } from "./source-filter.js";
+import { createHash } from "node:crypto";
+import { normalizeMapKey } from "./path-utils.js";
+import { freshnessFromMtime } from "./freshness.js";
+import { safeSpawnAsync } from "./safe-spawn.js";
+import { truncatedByOutputCap } from "./spawn-output-cap.js";
+const OPAQUE_HASH_BUDGET_BYTES = 8 * 1024 * 1024;
+export const OPAQUE_SCAN_MAX_FILES = 2000;
+const OPAQUE_MTIME_TOLERANCE_MS = 150;
+const MAX_GIT_STATUS_OUTPUT_BYTES = 16 * 1024 * 1024;
+export async function captureFileStatsForPaths(files, options = {}) {
+  const hashBudget = options.hashBudgetBytes ?? OPAQUE_HASH_BUDGET_BYTES;
+  const snapshot = new Map;
+  let hashBytesSpent = 0;
+  let stoppedEarly = false;
+  let first = true;
+  for (const file of files) {
+    if (!first) {
+      if (options.signal?.aborted === true) {
+        stoppedEarly = true;
+        break;
+      }
+      if (options.deadlineMs !== undefined && Date.now() >= options.deadlineMs) {
+        stoppedEarly = true;
+        break;
+      }
+    }
+    first = false;
+    try {
+      const stat = await fs.promises.stat(file);
+      if (!stat.isFile())
+        continue;
+      const entry = {
+        mtimeMs: stat.mtimeMs,
+        size: stat.size
+      };
+      if (options.withHashes && hashBytesSpent + stat.size <= hashBudget) {
+        entry.hash = createHash("sha256").update(await fs.promises.readFile(file)).digest("hex");
+        hashBytesSpent += stat.size;
+      }
+      snapshot.set(normalizeMapKey(path.resolve(file)), entry);
+    } catch {}
+  }
+  return { snapshot, stoppedEarly };
+}
+export async function captureFileStats(root, options = {}) {
+  if (options.forcedUnknownReason !== undefined) {
+    return { unknownReason: options.forcedUnknownReason, scannedCount: 0 };
+  }
+  const budgetMs = options.budgetMs ?? 50;
+  try {
+    const walk = await collectSourceFilesWithBudgetAsync(root, {
+      maxFiles: OPAQUE_SCAN_MAX_FILES + 1,
+      budgetMs
+    });
+    const files = walk.files;
+    if (walk.entryBudgetExceeded || files.length > OPAQUE_SCAN_MAX_FILES) {
+      return {
+        unknownReason: walk.entryBudgetExceeded ? "entry-budget-exceeded" : "file-cap-exceeded",
+        scannedCount: files.length
+      };
+    }
+    const { snapshot } = await captureFileStatsForPaths(files, options);
+    return { snapshot, scannedCount: snapshot.size };
+  } catch {
+    return { unknownReason: "walk-failed", scannedCount: 0 };
+  }
+}
+export function diffFileStats(before, after) {
+  const contentChanged = new Set(diffFileContent(before, after));
+  const changed = [];
+  for (const [key, stat] of after) {
+    const prev = before.get(key);
+    const contentConfirm = contentChanged.has(key);
+    if (!prev || prev.mtimeMs !== stat.mtimeMs || prev.size !== stat.size || contentConfirm) {
+      changed.push(key);
+    }
+  }
+  return changed;
+}
+export function diffFileContent(before, after) {
+  const changed = [];
+  for (const [key, stat] of after) {
+    const previous = before.get(key);
+    if (previous === undefined || previous.hash !== undefined && stat.hash !== undefined && previous.hash !== stat.hash) {
+      changed.push(key);
+    }
+  }
+  return changed;
+}
+
+export class OpaqueBaselineStore {
+  byCwd = new Map;
+  evictions = 0;
+  record(cwdKey, baseline) {
+    if (this.byCwd.has(cwdKey))
+      this.evictions += 1;
+    this.byCwd.set(cwdKey, baseline);
+  }
+  take(cwdKey) {
+    const baseline = this.byCwd.get(cwdKey);
+    this.byCwd.delete(cwdKey);
+    return baseline;
+  }
+  get evictionCount() {
+    return this.evictions;
+  }
+  takeAllForTest() {
+    this.byCwd.clear();
+  }
+}
+const globalStoreSymbol = Symbol.for("dm-lens:opaque-snapshot-store");
+const globalSlot = globalThis;
+export function getOpaqueBaselineStore() {
+  const existing = globalSlot[globalStoreSymbol]?.store;
+  if (existing)
+    return existing;
+  const created = new OpaqueBaselineStore;
+  globalSlot[globalStoreSymbol] = { store: created };
+  return created;
+}
+const gitRepoMemo = new Map;
+export function resetOpaqueMutationState() {
+  getOpaqueBaselineStore().takeAllForTest();
+  gitRepoMemo.clear();
+  gitToplevelMemo.clear();
+}
+export async function isGitWorktree(root) {
+  const key = normalizeMapKey(path.resolve(root));
+  const memo = gitRepoMemo.get(key);
+  if (memo !== undefined)
+    return memo;
+  const result = await safeSpawnAsync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root, timeout: 3000 });
+  const isRepo = !result.error && result.status === 0 && result.stdout?.trim() === "true";
+  gitRepoMemo.set(key, isRepo === true);
+  return isRepo === true;
+}
+const gitToplevelMemo = new Map;
+export async function resolveGitToplevel(root) {
+  const key = normalizeMapKey(path.resolve(root));
+  if (gitToplevelMemo.has(key))
+    return gitToplevelMemo.get(key);
+  const result = await safeSpawnAsync("git", ["rev-parse", "--show-toplevel"], {
+    cwd: root,
+    timeout: 3000
+  });
+  const toplevel = !result.error && result.status === 0 && result.stdout?.trim() ? result.stdout.trim() : undefined;
+  gitToplevelMemo.set(key, toplevel);
+  return toplevel;
+}
+const UNMERGED_PORCELAIN_STATUSES = new Set([
+  "DD",
+  "AU",
+  "UD",
+  "UA",
+  "DU",
+  "AA",
+  "UU"
+]);
+const LEGAL_ORDINARY_PORCELAIN_STATUSES = new Set([
+  " M",
+  " T",
+  " D",
+  " A",
+  " R",
+  " C",
+  "DR",
+  "DC",
+  "M ",
+  "MM",
+  "MT",
+  "MD",
+  "T ",
+  "TM",
+  "TT",
+  "TD",
+  "A ",
+  "AM",
+  "AT",
+  "AD",
+  "D ",
+  "R ",
+  "RM",
+  "RT",
+  "RD",
+  "C ",
+  "CM",
+  "CT",
+  "CD"
+]);
+function isUnmergedStatus(status) {
+  return UNMERGED_PORCELAIN_STATUSES.has(status);
+}
+function isKnownPorcelainStatus(status) {
+  return status === "??" || status === "!!" || isUnmergedStatus(status) || LEGAL_ORDINARY_PORCELAIN_STATUSES.has(status);
+}
+const PORCELAIN_STATUS_CHARS = /^[ MTADRCU?!]{2}$/;
+function isStructurallyValidStatus(status) {
+  return PORCELAIN_STATUS_CHARS.test(status) && status.trim() !== "";
+}
+export async function recoverOpaqueChangesViaGit(root, startedAt, options = {}) {
+  const result = await safeSpawnAsync("git", ["status", "--porcelain", "-z", "--untracked-files=all"], {
+    cwd: root,
+    timeout: 5000,
+    maxOutputBytes: MAX_GIT_STATUS_OUTPUT_BYTES
+  });
+  if (truncatedByOutputCap(result)) {
+    return {
+      verdict: "unknown",
+      paths: [],
+      unknownReason: "git-status-parse-failed",
+      scannedCount: 0
+    };
+  }
+  if (result.error || result.status !== 0 && result.status !== null) {
+    return {
+      verdict: "unknown",
+      paths: [],
+      unknownReason: "git-failed",
+      scannedCount: 0
+    };
+  }
+  const raw = result.stdout ?? "";
+  if (raw && !raw.endsWith("\x00")) {
+    return {
+      verdict: "unknown",
+      paths: [],
+      unknownReason: "git-status-parse-failed",
+      scannedCount: 0
+    };
+  }
+  const entries = [];
+  let unknownStatusCount = 0;
+  let skipNext = false;
+  for (const token of raw.split("\x00")) {
+    if (!token)
+      continue;
+    if (skipNext) {
+      skipNext = false;
+      continue;
+    }
+    if (token.length < 4 || token[2] !== " ") {
+      return {
+        verdict: "unknown",
+        paths: [],
+        unknownReason: "git-status-parse-failed",
+        scannedCount: 0
+      };
+    }
+    const status = token.slice(0, 2);
+    const relPath = token.slice(3);
+    if (!isStructurallyValidStatus(status) || !relPath) {
+      return {
+        verdict: "unknown",
+        paths: [],
+        unknownReason: "git-status-parse-failed",
+        scannedCount: 0
+      };
+    }
+    if (!isKnownPorcelainStatus(status))
+      unknownStatusCount += 1;
+    if (status.includes("R") || status.includes("C"))
+      skipNext = true;
+    entries.push({ status, absPath: path.resolve(root, relPath) });
+  }
+  if (skipNext) {
+    return {
+      verdict: "unknown",
+      paths: [],
+      unknownReason: "git-status-parse-failed",
+      scannedCount: 0
+    };
+  }
+  const hasUnmerged = entries.some((entry) => isUnmergedStatus(entry.status));
+  const floorMs = startedAt - OPAQUE_MTIME_TOLERANCE_MS;
+  async function isInWindow(absPath) {
+    try {
+      const stat = await fs.promises.stat(absPath);
+      return stat.isFile() && freshnessFromMtime({ mtimeMs: stat.mtimeMs, referenceMs: floorMs }).verdict === "stale";
+    } catch {
+      return false;
+    }
+  }
+  let excludedIncomingCount = 0;
+  let candidates = entries;
+  if (options.excludeIndexOnlyWhenUnmerged === true && hasUnmerged) {
+    const kept = [];
+    for (const entry of entries) {
+      const cleanIndexOnly = entry.status[1] === " " && isKnownPorcelainStatus(entry.status);
+      if (!cleanIndexOnly) {
+        kept.push(entry);
+        continue;
+      }
+      if (await isInWindow(entry.absPath))
+        excludedIncomingCount += 1;
+    }
+    candidates = kept;
+  }
+  const paths = [];
+  for (const { absPath } of candidates) {
+    if (await isInWindow(absPath))
+      paths.push(normalizeMapKey(absPath));
+  }
+  return {
+    verdict: "recovered",
+    paths,
+    scannedCount: paths.length,
+    ...excludedIncomingCount > 0 ? { excludedIncomingCount } : {},
+    ...unknownStatusCount > 0 ? { unknownStatusCount } : {}
+  };
+}

package/extensions/dm-lens/dist/clients/opengrep-client.js

@@ -0,0 +1,216 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { mkdtempSync } from "node:fs";
+import { resolveOpengrepConfig } from "./opengrep-config.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+import { getScratchTreeDirNames } from "./scratch-tree-policy.js";
+import { realpathOrResolve } from "./path-utils.js";
+import { safeSpawnAsync } from "./safe-spawn.js";
+import { SecurityScanClient } from "./security-scan-client.js";
+const EMPTY_RESULT = {
+  success: false,
+  findings: []
+};
+const SCAN_TIMEOUT_MS = 180000;
+
+export class OpengrepClient extends SecurityScanClient {
+  constructor(verbose = false) {
+    super("opengrep", verbose);
+  }
+  static resolveConfig(cwd) {
+    return resolveOpengrepConfig(cwd, { enabled: true });
+  }
+  doEnsureAvailable() {
+    return this.ensureViaInstaller(["--version"]);
+  }
+  async scan(cwd) {
+    const targetDir = realpathOrResolve(cwd);
+    const scannedAt = new Date().toISOString();
+    if (!await this.ensureAvailable()) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        reason: "not-installed",
+        summary: "opengrep not installed"
+      };
+    }
+    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
+  }
+  async runScan(cwd) {
+    const scannedAt = new Date().toISOString();
+    const bin = this.binaryPath ?? "opengrep";
+    const resolved = OpengrepClient.resolveConfig(cwd);
+    const outDir = mkdtempSync(path.join(os.tmpdir(), "dm-lens-opengrep-"));
+    const reportPath = path.join(outDir, "opengrep-report.json");
+    try {
+      const result = await safeSpawnAsync(bin, [
+        "scan",
+        "--config",
+        resolved.configArg ?? "auto",
+        "--json",
+        "--json-output",
+        reportPath,
+        "--no-error",
+        "--quiet",
+        "--disable-version-check",
+        ...getScratchTreeDirNames().flatMap((name) => ["--exclude", name]),
+        cwd
+      ], { cwd, timeout: SCAN_TIMEOUT_MS });
+      if (result.error) {
+        this.log(`Scan error: ${result.error.message}`);
+        const reason = `${result.failure ?? "spawn-failed"}: ${result.error.message}`;
+        this.recordRefusal(cwd, reason, result.status);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          reason: "spawn-failed",
+          summary: reason.slice(0, 200)
+        };
+      }
+      if (!fs.existsSync(reportPath)) {
+        const reason = (result.stderr ?? "").trim().split(`
+`)[0] || "no report produced";
+        this.recordRefusal(cwd, reason, result.status);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          reason: "no-report",
+          summary: reason
+        };
+      }
+      const raw = fs.readFileSync(reportPath, "utf-8");
+      const report = readOpengrepReport(raw);
+      if (report.verdict === "refused" || result.status !== 0) {
+        const reason = report.verdict === "refused" ? report.reason : `opengrep exited with status ${result.status}`;
+        this.recordRefusal(cwd, reason, result.status);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          reason: "refused",
+          summary: reason.slice(0, 200)
+        };
+      }
+      if (report.partial) {
+        recordDegradationOnce({
+          kind: "opengrep-partial-scan",
+          subject: cwd,
+          reason: report.partial.reason,
+          metadata: { status: result.status }
+        });
+      }
+      return {
+        success: true,
+        analyzed: !report.partial || report.scanned.length > 0,
+        analyzedFiles: report.scanned.map((file) => realpathOrResolve(path.resolve(cwd, file))),
+        ...report.partial ? { partial: true } : {},
+        ...report.partial ? { summary: report.partial.reason } : {},
+        ...report.partial && report.scanned.length === 0 ? { reason: "partial-no-paths" } : {},
+        findings: report.findings,
+        scannedAt
+      };
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      this.recordRefusal(cwd, reason, undefined);
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        reason: "crashed",
+        summary: reason.slice(0, 200)
+      };
+    } finally {
+      try {
+        fs.rmSync(outDir, { recursive: true, force: true });
+      } catch {}
+    }
+  }
+  recordRefusal(cwd, reason, status) {
+    recordDegradationOnce({
+      kind: "opengrep-scan-refused",
+      subject: cwd,
+      reason,
+      metadata: { status }
+    });
+  }
+}
+function readOpengrepReport(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  }
+  if (!parsed || typeof parsed !== "object")
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  const report = parsed;
+  if (!Array.isArray(report.results) && !Array.isArray(report.errors))
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  const errors = (Array.isArray(report.errors) ? report.errors : []).map((error) => {
+    if (typeof error === "string")
+      return { message: error };
+    if (!error || typeof error !== "object")
+      return { message: "unrecognised opengrep error entry" };
+    const entry = error;
+    const level = typeof entry.level === "string" ? entry.level : undefined;
+    const message = typeof entry.message === "string" ? entry.message : undefined;
+    return {
+      ...level ? { level } : {},
+      message: message ?? level ?? "unrecognised opengrep error entry"
+    };
+  });
+  const refusal = errors.find((error) => error.level !== "warn");
+  if (refusal)
+    return { verdict: "refused", reason: refusal.message };
+  const scanned = Array.isArray(report.paths?.scanned) ? report.paths.scanned.filter((file) => typeof file === "string") : [];
+  return {
+    verdict: "usable",
+    ...errors[0] ? { partial: { reason: errors[0].message } } : {},
+    findings: parseOpengrepReport(parsed),
+    scanned
+  };
+}
+export function parseOpengrepReport(rawOrParsed) {
+  if (typeof rawOrParsed === "string" && !rawOrParsed.trim())
+    return [];
+  let parsed = rawOrParsed;
+  if (typeof rawOrParsed === "string") {
+    try {
+      parsed = JSON.parse(rawOrParsed);
+    } catch {
+      return [];
+    }
+  }
+  if (!parsed || typeof parsed !== "object")
+    return [];
+  const results = parsed.results;
+  if (!Array.isArray(results))
+    return [];
+  const findings = [];
+  for (const entry of results) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const e = entry;
+    const checkId = typeof e.check_id === "string" ? e.check_id : undefined;
+    const filePath = typeof e.path === "string" ? e.path : undefined;
+    const start = e.start;
+    const end = e.end;
+    const startLine = typeof start?.line === "number" ? start.line : undefined;
+    if (!checkId || !filePath || !Number.isFinite(startLine))
+      continue;
+    const extra = e.extra ?? {};
+    const metadata = extra.metadata ?? {};
+    const cwe = Array.isArray(metadata.cwe) ? metadata.cwe.filter((c) => typeof c === "string") : undefined;
+    findings.push({
+      checkId,
+      path: filePath,
+      startLine,
+      startCol: typeof start?.col === "number" ? start.col : 1,
+      endLine: typeof end?.line === "number" ? end.line : startLine,
+      endCol: typeof end?.col === "number" ? end.col : 1,
+      message: typeof extra.message === "string" ? extra.message : "opengrep finding",
+      severity: typeof extra.severity === "string" ? extra.severity : "WARNING",
+      cwe
+    });
+  }
+  return findings;
+}

package/extensions/dm-lens/dist/clients/opengrep-config.js

@@ -0,0 +1,52 @@
+import * as path from "node:path";
+import { findLocalToolConfig } from "./path-utils.js";
+const LOCAL_OPENGREP_CONFIG_NAMES = [
+  ".opengrep.yml",
+  ".opengrep.yaml",
+  "opengrep.yml",
+  "opengrep.yaml",
+  ".semgrep.yml",
+  ".semgrep.yaml",
+  "semgrep.yml",
+  "semgrep.yaml"
+];
+export function findLocalOpengrepConfig(startDir) {
+  return findLocalToolConfig(startDir, LOCAL_OPENGREP_CONFIG_NAMES);
+}
+function isRegistryOrAutoConfig(config) {
+  return config === "auto" || config.startsWith("p/") || config.startsWith("r/");
+}
+export function normalizeOpengrepConfigArg(config, cwd) {
+  if (!config)
+    return;
+  const trimmed = config.trim();
+  if (!trimmed)
+    return;
+  if (isRegistryOrAutoConfig(trimmed))
+    return trimmed;
+  return path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
+}
+export function resolveOpengrepConfig(cwd, flags) {
+  const localConfig = findLocalOpengrepConfig(cwd);
+  const flagConfig = typeof flags?.config === "string" && flags.config.trim() ? flags.config.trim() : undefined;
+  if (flags?.enabled || flagConfig) {
+    const explicit = normalizeOpengrepConfigArg(flagConfig ?? localConfig, cwd);
+    return {
+      enabled: true,
+      configArg: explicit ?? "auto",
+      source: explicit && localConfig && !flagConfig ? "local" : "flag"
+    };
+  }
+  if (localConfig) {
+    return {
+      enabled: true,
+      configArg: localConfig,
+      source: "local"
+    };
+  }
+  return {
+    enabled: false,
+    source: "disabled",
+    reason: "no local opengrep config (.opengrep.yml) and --lens-opengrep not set"
+  };
+}