@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -0,0 +1,408 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
+import { getKnipIgnorePatterns } from "../file-utils.js";
+import { isAtOrAboveHomeDir, realpathOrResolve } from "../path-utils.js";
+import { isSameOrWithin } from "../lsp/server.js";
+import { incrementDegradationCount, recordDegradationOnce } from "../degradation-ledger.js";
+import { GitleaksClient } from "../gitleaks-client.js";
+import { GovulncheckClient } from "../govulncheck-client.js";
+import { isToolInstallAllowedByTrust, projectTrustDenialReason } from "../project-trust.js";
+import { TrivyClient } from "../trivy-client.js";
+import { reasonFromAvailabilityVerdict } from "./extractors.js";
+import { deadCodeResultToProjectDiagnostics } from "./runner-adapters/dead-code.js";
+import { gitleaksResultToProjectDiagnostics } from "./runner-adapters/gitleaks.js";
+import { govulncheckResultToProjectDiagnostics } from "./runner-adapters/govulncheck.js";
+import { jscpdResultToProjectDiagnostics } from "./runner-adapters/jscpd.js";
+import { knipIssuesToProjectDiagnostics } from "./runner-adapters/knip.js";
+import { circularDepsToProjectDiagnostics } from "./runner-adapters/madge.js";
+import { opengrepResultToProjectDiagnostics } from "./runner-adapters/opengrep.js";
+import { testRunnerFindingsToProjectDiagnostics } from "./runner-adapters/runner-findings.js";
+import { trivyResultToProjectDiagnostics } from "./runner-adapters/trivy.js";
+export const ANALYZER_IDS = [
+  "knip",
+  "jscpd",
+  "madge",
+  "gitleaks",
+  "govulncheck",
+  "opengrep",
+  "trivy",
+  "dead-code",
+  "test-runner"
+];
+function pushUnique(list, id) {
+  if (!list.includes(id))
+    list.push(id);
+}
+export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, options = {}) {
+  const requestedRoot = options.analysisRoot === undefined ? cwd : path.resolve(cwd, options.analysisRoot);
+  let analysisRoot;
+  let analysisRootValidation;
+  if (options.analysisRoot !== undefined) {
+    try {
+      if (!fs.statSync(requestedRoot).isDirectory()) {
+        throw new Error("is not a directory");
+      }
+      analysisRoot = fs.realpathSync(requestedRoot);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      const reason = `the explicit analysis root ${requestedRoot} is unavailable or ${detail}`;
+      analysisRootValidation = {
+        state: "undecided",
+        root: requestedRoot,
+        reason
+      };
+      incrementDegradationCount({
+        kind: "lens-diagnostics-analysis-root-rejected",
+        subject: requestedRoot,
+        reason
+      });
+      return {
+        analysisRootValidation,
+        diagnostics: [],
+        runners: [],
+        analyzed: [],
+        authoritativeCoverage: [],
+        cold: [...ANALYZER_IDS],
+        coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, reason])),
+        failed: [],
+        timings: {},
+        analysisRootError: reason
+      };
+    }
+  } else {
+    analysisRoot = realpathOrResolve(cwd);
+  }
+  const unsafeRootReason = "the analysis root resolves at or above the home directory; heavyweight analyzers refuse to walk from there (#747)";
+  const homeRoot = realpathOrResolve(options.homeDir ?? os.homedir());
+  if (options.analysisRoot !== undefined) {
+    const unsafeExplicitRoot = !isSameOrWithin(homeRoot, analysisRoot) || isSameOrWithin(analysisRoot, homeRoot);
+    analysisRootValidation = unsafeExplicitRoot ? {
+      state: "unsafe",
+      root: analysisRoot,
+      reason: "explicit analysis root must be strictly contained by the canonical home directory"
+    } : { state: "safe", root: analysisRoot };
+  } else if (isAtOrAboveHomeDir(analysisRoot, options.homeDir)) {
+    analysisRootValidation = {
+      state: "unsafe",
+      root: analysisRoot,
+      reason: unsafeRootReason
+    };
+  } else {
+    analysisRootValidation = { state: "safe", root: analysisRoot };
+  }
+  if (analysisRootValidation.state !== "safe") {
+    incrementDegradationCount({
+      kind: "lens-diagnostics-analysis-root-rejected",
+      subject: analysisRoot,
+      reason: analysisRootValidation.reason
+    });
+    return {
+      analysisRootValidation,
+      diagnostics: [],
+      runners: [],
+      analyzed: [],
+      authoritativeCoverage: [],
+      cold: [...ANALYZER_IDS],
+      coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, unsafeRootReason])),
+      failed: [],
+      timings: {},
+      unsafeRoot: analysisRootValidation.state === "unsafe"
+    };
+  }
+  const diagnostics = [];
+  const runners = [];
+  const analyzed = [];
+  const authoritativeCoverage = [];
+  const cold = [];
+  const coldReasons = {};
+  const partial = [];
+  const partialReasons = {};
+  const failed = [];
+  const timings = {};
+  const cachedAgeMs = {};
+  const settledIds = new Set;
+  let dispositionSuppressed = 0;
+  const dispositionSuppressedByLane = {};
+  function markCold(id, reason) {
+    pushUnique(cold, id);
+    coldReasons[id] = reason;
+  }
+  function markPartial(id, reason) {
+    pushUnique(partial, id);
+    partialReasons[id] = reason;
+  }
+  function record(id, adapted, elapsedMs, analysedRoot, analysis) {
+    if (analysedRoot) {
+      pushUnique(analyzed, id);
+      if (analysis?.analyzedFiles !== undefined) {
+        const root = realpathOrResolve(analysisRoot);
+        authoritativeCoverage.push({
+          runnerId: id,
+          root,
+          files: new Set(analysis.analyzedFiles.map((file) => {
+            return realpathOrResolve(file);
+          }))
+        });
+        if (analysis.analyzedFiles.length === 0) {
+          recordDegradationOnce({
+            kind: "runner-coverage-empty",
+            subject: `${id}:${root}`,
+            reason: `${id} analysed this root but declared zero scanned files, so retained ${id} findings are kept rather than retired`
+          });
+        }
+      }
+    }
+    timings[id] = (timings[id] ?? 0) + elapsedMs;
+    const kept = applyDispositionsMultiFile(adapted, analysisRoot, (d) => d.filePath);
+    const suppressedHere = adapted.length - kept.length;
+    dispositionSuppressed += suppressedHere;
+    if (suppressedHere > 0) {
+      dispositionSuppressedByLane[id] = (dispositionSuppressedByLane[id] ?? 0) + suppressedHere;
+    }
+    if (kept.length > 0) {
+      diagnostics.push(...kept);
+      pushUnique(runners, id);
+    }
+  }
+  function recordFailed(id, result) {
+    failed.push({
+      id,
+      ..."reason" in result && result.reason !== undefined ? { reason: result.reason } : {},
+      summary: "summary" in result && typeof result.summary === "string" ? result.summary : "analyzer reported an unsuccessful run"
+    });
+  }
+  function task(id, run) {
+    return run().finally(() => settledIds.add(id));
+  }
+  const tasks = [
+    task("knip", async () => {
+      const startMs = Date.now();
+      const result = await clients.knipClient.analyze(analysisRoot, getKnipIgnorePatterns());
+      if (!result.success) {
+        recordFailed("knip", result);
+        return;
+      }
+      if (result.analyzed !== true) {
+        markCold("knip", result.summary ?? "knip did not analyse this root");
+        return;
+      }
+      cacheManager.writeCache("knip", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true, result);
+    }),
+    task("jscpd", async () => {
+      if (!await clients.jscpdClient.ensureAvailable()) {
+        markCold("jscpd", reasonFromAvailabilityVerdict("jscpd", clients.jscpdClient.getAvailabilityVerdict?.()));
+        return;
+      }
+      const isTsProject = fs.existsSync(path.join(analysisRoot, "tsconfig.json"));
+      const scannerKey = isTsProject ? "jscpd-ts" : "jscpd";
+      const startMs = Date.now();
+      const result = await clients.jscpdClient.scan(analysisRoot, undefined, undefined, isTsProject);
+      if (!result.success) {
+        recordFailed("jscpd", result);
+        return;
+      }
+      if (result.analyzed !== true) {
+        markCold("jscpd", "jscpd did not analyse this root (no source files, or the scan produced no report)");
+        return;
+      }
+      cacheManager.writeCache(scannerKey, result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result);
+    }),
+    task("madge", async () => {
+      if (!await clients.depChecker.ensureAvailable()) {
+        markCold("madge", reasonFromAvailabilityVerdict("madge", clients.depChecker.getAvailabilityVerdict?.()));
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.depChecker.scanProject(analysisRoot);
+      cacheManager.writeCache("madge", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true, result);
+    }),
+    task("gitleaks", async () => {
+      if (!GitleaksClient.hasGitRepo(analysisRoot)) {
+        markCold("gitleaks", "not a git repository (no .git found)");
+        return;
+      }
+      if (!await clients.gitleaksClient.ensureAvailable()) {
+        markCold("gitleaks", reasonFromAvailabilityVerdict("gitleaks", clients.gitleaksClient.getAvailabilityVerdict?.()));
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.gitleaksClient.scan(analysisRoot, {
+        requireSignal: false
+      });
+      if (!result.success) {
+        recordFailed("gitleaks", result);
+        return;
+      }
+      cacheManager.writeCache("gitleaks", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
+    }),
+    task("govulncheck", async () => {
+      if (!GovulncheckClient.hasGoModule(analysisRoot)) {
+        markCold("govulncheck", "no go.mod found (not a Go module)");
+        return;
+      }
+      if (!await clients.govulncheckClient.ensureAvailable()) {
+        markCold("govulncheck", isToolInstallAllowedByTrust() ? reasonFromAvailabilityVerdict("govulncheck", clients.govulncheckClient.getAvailabilityVerdict?.()) : projectTrustDenialReason() ?? "govulncheck binary unavailable");
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.govulncheckClient.analyze(analysisRoot);
+      if (!result.success) {
+        recordFailed("govulncheck", result);
+        return;
+      }
+      cacheManager.writeCache("govulncheck", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
+    }),
+    task("opengrep", async () => {
+      if (!await clients.opengrepClient.ensureAvailable()) {
+        markCold("opengrep", reasonFromAvailabilityVerdict("opengrep", clients.opengrepClient.getAvailabilityVerdict?.()));
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.opengrepClient.scan(analysisRoot);
+      if (!result.success) {
+        recordFailed("opengrep", result);
+        return;
+      }
+      if (result.analyzed !== true) {
+        const reason = result.summary ?? result.reason ?? "opengrep did not analyse this root";
+        if (result.partial)
+          markPartial("opengrep", reason);
+        else
+          markCold("opengrep", reason);
+        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, false, result);
+        return;
+      }
+      if (result.partial) {
+        markPartial("opengrep", result.summary ?? result.reason ?? "opengrep scan coverage is incomplete");
+        record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result);
+        return;
+      }
+      cacheManager.writeCache("opengrep", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
+    }),
+    task("trivy", async () => {
+      if (!TrivyClient.shouldScan(analysisRoot)) {
+        markCold("trivy", "not opted in (.dm-lens.json trivy.enabled) or no dependency manifest found");
+        return;
+      }
+      if (!await clients.trivyClient.ensureAvailable()) {
+        markCold("trivy", reasonFromAvailabilityVerdict("trivy", clients.trivyClient.getAvailabilityVerdict?.()));
+        return;
+      }
+      const startMs = Date.now();
+      const result = await clients.trivyClient.scan(analysisRoot);
+      if (!result.success) {
+        recordFailed("trivy", result);
+        return;
+      }
+      cacheManager.writeCache("trivy", result, analysisRoot, {
+        scanDurationMs: Date.now() - startMs
+      });
+      record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
+    }),
+    task("dead-code", async () => {
+      const applicable = clients.deadCodeClients.filter((c) => c.detect(analysisRoot));
+      if (applicable.length === 0) {
+        markCold("dead-code", "no dead-code client detected an applicable language for this project");
+        return;
+      }
+      await Promise.all(applicable.map(async (client) => {
+        const cacheKey = `dead-code-${client.id}`;
+        const startMs = Date.now();
+        const result = await client.analyze(analysisRoot);
+        if (!result.success) {
+          recordFailed("dead-code", result);
+          return;
+        }
+        if (result.analyzed === true) {
+          cacheManager.writeCache(cacheKey, result, analysisRoot, {
+            scanDurationMs: Date.now() - startMs
+          });
+        }
+        const adapted = deadCodeResultToProjectDiagnostics(analysisRoot, result);
+        record("dead-code", adapted, Date.now() - startMs, result.analyzed === true, result);
+      }));
+    }),
+    task("test-runner", async () => {
+      const startMs = Date.now();
+      const cached = cacheManager.readCache("test-runner-findings", analysisRoot);
+      if (!cached?.data) {
+        markCold("test-runner", "no turn_end test-runner cache entry yet this session");
+        return;
+      }
+      cachedAgeMs["test-runner"] = Date.now() - new Date(cached.meta.timestamp).getTime();
+      record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs, false);
+    })
+  ];
+  const allSettled = Promise.all(tasks).then(() => "completed").catch(() => "completed");
+  const outcome = signal ? await Promise.race([
+    allSettled,
+    new Promise((resolve) => {
+      if (signal.aborted) {
+        resolve("aborted");
+        return;
+      }
+      signal.addEventListener("abort", () => resolve("aborted"), {
+        once: true
+      });
+    })
+  ]) : await allSettled;
+  if (outcome === "aborted") {
+    const abortedIds = ANALYZER_IDS.filter((id) => !settledIds.has(id));
+    for (const id of abortedIds)
+      pushUnique(cold, id);
+    return {
+      analysisRootValidation,
+      diagnostics,
+      runners,
+      analyzed,
+      authoritativeCoverage,
+      cold,
+      coldReasons,
+      partial,
+      partialReasons,
+      failed,
+      timings,
+      cachedAgeMs,
+      aborted: true,
+      abortedIds,
+      dispositionSuppressed,
+      dispositionSuppressedByLane
+    };
+  }
+  return {
+    analysisRootValidation,
+    diagnostics,
+    runners,
+    analyzed,
+    authoritativeCoverage,
+    cold,
+    coldReasons,
+    partial,
+    partialReasons,
+    failed,
+    timings,
+    cachedAgeMs,
+    dispositionSuppressed,
+    dispositionSuppressedByLane
+  };
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/call-graph-impact.js

@@ -0,0 +1,64 @@
+import * as path from "node:path";
+import { parseSymbolKey } from "../../call-graph.js";
+import { isTestRoleCollateral } from "../../collateral-test-role.js";
+function resolveImpactFile(cwd, filePath) {
+  return path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+}
+function displayName(key) {
+  return parseSymbolKey(key).symbolName ?? key;
+}
+function severityFor(severity) {
+  if (severity === "WillBreak") {
+    return {
+      severity: "warning",
+      message: "Direct caller of a symbol edited this turn — verify this call site still matches its new signature/behavior."
+    };
+  }
+  if (severity === "MayBreak") {
+    return {
+      severity: "info",
+      message: "Indirect caller (one hop) of a symbol edited this turn — worth a quick check."
+    };
+  }
+  return null;
+}
+const SEVERITY_RANK = {
+  error: 3,
+  warning: 2,
+  info: 1,
+  hint: 0
+};
+export function callGraphImpactToProjectDiagnostics(cwd, findings) {
+  const byKey = new Map;
+  for (const { calleeKey, results } of findings) {
+    const calleeName = displayName(calleeKey);
+    for (const result of results) {
+      const mapped = severityFor(result.severity);
+      if (!mapped)
+        continue;
+      const { filePath } = parseSymbolKey(result.symbolKey);
+      if (!filePath)
+        continue;
+      const resolvedFile = resolveImpactFile(cwd, filePath);
+      if (isTestRoleCollateral(resolvedFile))
+        continue;
+      const dedupeKey = `${resolvedFile}:${result.symbolKey}`;
+      const existing = byKey.get(dedupeKey);
+      if (existing && SEVERITY_RANK[existing.severity] >= SEVERITY_RANK[mapped.severity]) {
+        continue;
+      }
+      const callerName = displayName(result.symbolKey);
+      byKey.set(dedupeKey, {
+        filePath: resolvedFile,
+        severity: mapped.severity,
+        semantic: "warning",
+        tool: "call-graph",
+        runner: "call-graph",
+        rule: `call-graph:${result.severity.toLowerCase()}`,
+        message: `${mapped.message} (${callerName} calls edited symbol '${calleeName}')`,
+        source: "project-scan"
+      });
+    }
+  }
+  return [...byKey.values()];
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/dead-code.js

@@ -0,0 +1,38 @@
+import * as path from "node:path";
+function deadCodeRunnerId(language) {
+  return `dead-code-${language}`;
+}
+function deadCodeMessage(issue) {
+  if (issue.category === "unlisted")
+    return `Unlisted dependency ${issue.name}`;
+  if (issue.category === "dependency")
+    return `Unused dependency ${issue.name}`;
+  if (issue.category === "file")
+    return `Unused file ${issue.name}`;
+  return `Unused ${issue.kind} ${issue.name}`;
+}
+export function deadCodeIssueToProjectDiagnostic(cwd, issue, language) {
+  const blocking = issue.category === "unlisted";
+  return {
+    filePath: issue.file ? path.isAbsolute(issue.file) ? issue.file : path.resolve(cwd, issue.file) : cwd,
+    line: issue.line,
+    severity: blocking ? "error" : "warning",
+    semantic: blocking ? "blocking" : "warning",
+    tool: "dead-code",
+    runner: deadCodeRunnerId(language),
+    rule: `dead-code:${issue.category}`,
+    message: deadCodeMessage(issue),
+    source: "project-scan"
+  };
+}
+export function deadCodeResultToProjectDiagnostics(cwd, result) {
+  if (!result.success)
+    return [];
+  const issues = [
+    ...result.unusedExports,
+    ...result.unusedFiles,
+    ...result.unusedDeps,
+    ...result.unlistedDeps
+  ];
+  return issues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language));
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -0,0 +1,21 @@
+import * as path from "node:path";
+export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
+  const statusSuffix = finding.pathStatus ? ` [git: ${finding.pathStatus}]` : "";
+  const isBlocking = finding.pathStatus !== "scratch" && finding.pathStatus !== "ignored" && finding.pathStatus !== "nested-repository";
+  return {
+    filePath: path.isAbsolute(finding.file) ? finding.file : path.resolve(cwd, finding.file),
+    line: finding.startLine,
+    severity: isBlocking ? "error" : "info",
+    semantic: isBlocking ? "blocking" : "none",
+    tool: "gitleaks",
+    runner: "gitleaks",
+    rule: `gitleaks:${finding.ruleId}`,
+    message: `Potential secret: ${finding.description || finding.ruleId}${statusSuffix}`,
+    source: "project-scan"
+  };
+}
+export function gitleaksResultToProjectDiagnostics(cwd, result) {
+  if (!result.success || result.findings.length === 0)
+    return [];
+  return result.findings.map((finding) => gitleaksFindingToProjectDiagnostic(cwd, finding));
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/govulncheck.js

@@ -0,0 +1,23 @@
+import * as path from "node:path";
+export function govulncheckFindingToProjectDiagnostic(cwd, finding) {
+  const frame = finding.trace?.find((f) => f.filename);
+  const filePath = frame?.filename ? path.isAbsolute(frame.filename) ? frame.filename : path.resolve(cwd, frame.filename) : cwd;
+  const fix = finding.fixedVersion ? ` (fixed in ${finding.fixedVersion})` : "";
+  return {
+    filePath,
+    line: frame?.line,
+    severity: "warning",
+    semantic: "warning",
+    tool: "govulncheck",
+    runner: "govulncheck",
+    rule: `govulncheck:${finding.osv}`,
+    code: finding.packageName ?? finding.module,
+    message: `Vulnerability ${finding.osv}: ${finding.summary ?? "reachable vulnerable dependency"}${fix}`,
+    source: "project-scan"
+  };
+}
+export function govulncheckResultToProjectDiagnostics(cwd, result) {
+  if (!result.success || result.findings.length === 0)
+    return [];
+  return result.findings.map((finding) => govulncheckFindingToProjectDiagnostic(cwd, finding));
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/jscpd.js

@@ -0,0 +1,28 @@
+import * as path from "node:path";
+function resolveClonePath(cwd, file) {
+  return path.isAbsolute(file) ? file : path.resolve(cwd, file);
+}
+function jscpdCloneToProjectDiagnostics(cwd, clone) {
+  const a = resolveClonePath(cwd, clone.fileA);
+  const b = resolveClonePath(cwd, clone.fileB);
+  const make = (filePath, line, otherFile, otherLine) => ({
+    filePath,
+    line,
+    severity: "warning",
+    semantic: "warning",
+    tool: "jscpd",
+    runner: "jscpd",
+    rule: "jscpd:duplicate",
+    message: `Duplicate code (${clone.lines} lines) — also at ${path.relative(cwd, otherFile)}:${otherLine}`,
+    source: "project-scan"
+  });
+  return [
+    make(a, clone.startA, b, clone.startB),
+    make(b, clone.startB, a, clone.startA)
+  ];
+}
+export function jscpdResultToProjectDiagnostics(cwd, result) {
+  if (!result.success || result.clones.length === 0)
+    return [];
+  return result.clones.flatMap((clone) => jscpdCloneToProjectDiagnostics(cwd, clone));
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/knip.js

@@ -0,0 +1,45 @@
+import * as path from "node:path";
+function knipIssueFile(cwd, issue) {
+  if (!issue.file)
+    return cwd;
+  return path.isAbsolute(issue.file) ? issue.file : path.resolve(cwd, issue.file);
+}
+function knipIssueMessage(issue) {
+  if (issue.type === "unlisted") {
+    return `Unlisted dependency ${issue.name}`;
+  }
+  if (issue.type === "bin") {
+    return `Unlisted binary ${issue.name}`;
+  }
+  if (issue.type === "export") {
+    return `Unused export ${issue.name}`;
+  }
+  if (issue.type === "enumMember") {
+    return `Unused enum member ${issue.name}`;
+  }
+  if (issue.type === "file") {
+    return `Unused file ${issue.name}`;
+  }
+  if (issue.type === "dependency" || issue.type === "devDependency") {
+    return `Unused ${issue.type} ${issue.name}`;
+  }
+  return `${issue.type}: ${issue.name}`;
+}
+function knipIssueToProjectDiagnostic(cwd, issue) {
+  const blocking = issue.type === "unlisted" || issue.type === "bin";
+  return {
+    filePath: knipIssueFile(cwd, issue),
+    line: issue.line,
+    severity: blocking ? "error" : "warning",
+    semantic: blocking ? "blocking" : "warning",
+    tool: "knip",
+    runner: "knip",
+    rule: `knip:${issue.type}`,
+    code: issue.package,
+    message: knipIssueMessage(issue),
+    source: "project-scan"
+  };
+}
+export function knipIssuesToProjectDiagnostics(cwd, issues) {
+  return issues.map((issue) => knipIssueToProjectDiagnostic(cwd, issue));
+}

package/extensions/dm-lens/dist/clients/project-diagnostics/runner-adapters/madge.js

@@ -0,0 +1,34 @@
+import * as path from "node:path";
+import { compareOrdinal } from "../../string-utils.js";
+function resolveCyclePath(cwd, file) {
+  return path.isAbsolute(file) ? file : path.resolve(cwd, file);
+}
+function cycleMembers(dep) {
+  return dep.path.length > 0 ? dep.path : [dep.file];
+}
+function circularDepToProjectDiagnostics(cwd, dep) {
+  const members = cycleMembers(dep);
+  const rendered = `${members.map((f) => path.basename(f)).join(" → ")} → ${path.basename(members[0] ?? "")}`;
+  return members.map((file) => ({
+    filePath: resolveCyclePath(cwd, file),
+    severity: "warning",
+    semantic: "warning",
+    tool: "madge",
+    runner: "madge",
+    rule: "madge:circular",
+    message: `Part of circular dependency: ${rendered}`,
+    source: "project-scan"
+  }));
+}
+export function circularDepsToProjectDiagnostics(cwd, circular) {
+  const seen = new Set;
+  const out = [];
+  for (const dep of circular) {
+    const key = cycleMembers(dep).map((f) => resolveCyclePath(cwd, f)).sort(compareOrdinal).join("|");
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    out.push(...circularDepToProjectDiagnostics(cwd, dep));
+  }
+  return out;
+}