@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-lens/clients/mutating-tool.js

@@ -22,7 +22,7 @@ export function getBuiltinMutatingToolNames() {
 function asRecord(value) {
   return value !== null && typeof value === "object" ? value : {};
 }
-export function resolveMutationPath(input) {
+function resolveMutationPath(input) {
   for (const key of ["path", "filePath", "file_path"]) {
     const value = input[key];
     if (typeof value === "string" && value.length > 0)
@@ -33,7 +33,7 @@ export function resolveMutationPath(input) {
 export function readMutationPathField(event) {
   return resolveMutationPath(asRecord(event?.input));
 }
-export function parseHashlineAnchor(anchor) {
+function parseHashlineAnchor(anchor) {
   if (typeof anchor !== "string")
     return;
   const trimmed = anchor.trim();
@@ -44,7 +44,7 @@ export function parseHashlineAnchor(anchor) {
   const line = Number(lineText);
   return Number.isInteger(line) && line > 0 ? line : undefined;
 }
-export function combineRanges(ranges) {
+function combineRanges(ranges) {
   const starts = ranges.map(([start]) => start);
   const ends = ranges.map(([, end]) => end);
   return {

package/extensions/dm-lens/clients/mutation-attribution.js

@@ -5,12 +5,12 @@ import { recordDegradationOnce } from "./degradation-ledger.js";
 import { BoundedFifoMap } from "./bounded-cache.js";
 import { getProjectDataDir } from "./file-utils.js";
 import { getProcessSingleton } from "./process-singletons.js";
-export const MUTATION_ATTRIBUTION_FILE_VERSION = 1;
+const MUTATION_ATTRIBUTION_FILE_VERSION = 1;
 export const MUTATION_ATTRIBUTION_FILE = "observed-mutating-tools.json";
-export const PERSIST_AFTER_OBSERVATIONS = 2;
+const PERSIST_AFTER_OBSERVATIONS = 2;
 export const CLEAN_OBSERVATION_ARM_LIMIT = 2;
 export const DEATTRIBUTE_AFTER_CLEAN_OBSERVATIONS = 3;
-export const MUTATION_ATTRIBUTION_MAX_TOOLS = 64;
+const MUTATION_ATTRIBUTION_MAX_TOOLS = 64;
 const ATTRIBUTION_FAMILY = "mutation-attribution";
 const ATTRIBUTION_VERSION = 2;
 function state() {

package/extensions/dm-lens/clients/ndjson-logger.js

@@ -68,9 +68,6 @@ export function _exitFlushersForTest() {
 export function getRegisteredLogFiles() {
   return registeredLogFiles;
 }
-export function _resetRegisteredLogFilesForTest() {
-  registeredLogFiles.clear();
-}
 export function getSinkWriteFailures() {
   if (!ndjsonGlobalState)
     return [];
@@ -110,8 +107,14 @@ export function resetSinkRotations() {
     state.rotationCount = 0;
     state.rotationFailures = 0;
     state.rotationRetryAfterMs = 0;
+    state.optionConflictRecorded = false;
   }
 }
+export function getSinkOptionConflicts() {
+  if (!ndjsonGlobalState)
+    return [];
+  return [...ndjsonGlobalState.writers.values()].filter((state) => state.optionConflictRecorded).map((state) => ({ file: state.file }));
+}
 function requireCurrentGlobalState() {
   if (ndjsonGlobalState)
     return ndjsonGlobalState;
@@ -132,11 +135,6 @@ function registerWriter(state) {
 function normalizeLogPath(file) {
   return normalizeFilePath(path.resolve(file));
 }
-function assertCompatibleWriterOptions(existing, maxBytes, backupPath) {
-  if (existing.maxBytes === maxBytes && existing.backupPath === backupPath)
-    return;
-  throw new Error(`createNdjsonLogger: incompatible options for shared path ${existing.file}; ` + `the first writer's maxBytes/backupPath must be reused`);
-}
 function writeQueueItemSync(state, item) {
   if (item.kind === "truncate") {
     fs.writeFileSync(state.file, "");
@@ -179,7 +177,6 @@ function createWriterState(file, maxBytes, backupPath) {
   const globalState = requireCurrentGlobalState();
   const existing = globalState.writers.get(file);
   if (existing) {
-    assertCompatibleWriterOptions(existing, maxBytes, backupPath);
     if (!exitFlushers.has(existing.exitFlusher))
       registerWriter(existing);
     if (typeof existing.writeFailures !== "number")
@@ -194,6 +191,16 @@ function createWriterState(file, maxBytes, backupPath) {
       existing.rotationFailures = 0;
     if (typeof existing.rotationRetryAfterMs !== "number")
       existing.rotationRetryAfterMs = 0;
+    if (typeof existing.optionConflictRecorded !== "boolean")
+      existing.optionConflictRecorded = false;
+    const optionsDiffer = existing.maxBytes !== maxBytes || existing.backupPath !== backupPath;
+    if (optionsDiffer) {
+      if (existing.maxBytes === undefined && maxBytes !== undefined)
+        existing.maxBytes = maxBytes;
+      if (existing.backupPath === undefined && backupPath !== undefined)
+        existing.backupPath = backupPath;
+      existing.optionConflictRecorded = true;
+    }
     return existing;
   }
   const state = {};
@@ -213,6 +220,7 @@ function createWriterState(file, maxBytes, backupPath) {
   state.rotationCount = 0;
   state.rotationFailures = 0;
   state.rotationRetryAfterMs = 0;
+  state.optionConflictRecorded = false;
   globalState.writers.set(file, state);
   registerWriter(state);
   return state;

package/extensions/dm-lens/clients/observed-mutation.js

@@ -19,21 +19,21 @@ import { normalizeMapKey } from "./path-utils.js";
 import { getProcessSingleton } from "./process-singletons.js";
 import { bounded } from "./deadline-utils.js";
 import { lineContentHash } from "./read-guard.js";
-export const OBSERVED_CAPTURE_BUDGET_MS = 200;
+const OBSERVED_CAPTURE_BUDGET_MS = 200;
 export const OBSERVED_TURN_BUDGET_MS = 600;
-export const OBSERVED_SETTLE_DEADLINE_MS = 50;
+const OBSERVED_SETTLE_DEADLINE_MS = 50;
 export const OBSERVED_TARGET_DIR_MAX_ENTRIES = 64;
 export const OBSERVED_TRACKED_MAX_FILES = 400;
-export const OBSERVED_LEDGER_SETTLE_MS = 150;
+const OBSERVED_LEDGER_SETTLE_MS = 150;
 export const OBSERVED_HANDLED_MAX = 1000;
 export const OBSERVED_SWEEP_STAT_WINDOW = 128;
-export const OBSERVED_HASH_BUDGET_BYTES = 2 * 1024 * 1024;
+const OBSERVED_HASH_BUDGET_BYTES = 2 * 1024 * 1024;
 export const OBSERVED_SWEEP_HASH_BUDGET_BYTES = 2 * 1024 * 1024;
-export const OBSERVED_SWEEP_RANGE_BUDGET_BYTES = 1024 * 1024;
-export const OBSERVED_LINE_HASH_MAX_BYTES = 512 * 1024;
-export const OBSERVED_MAX_EDIT_RANGES = 32;
-export const OBSERVED_PENDING_MAX = 32;
-export const OBSERVED_LEDGER_MAX = 1000;
+const OBSERVED_SWEEP_RANGE_BUDGET_BYTES = 1024 * 1024;
+const OBSERVED_LINE_HASH_MAX_BYTES = 512 * 1024;
+const OBSERVED_MAX_EDIT_RANGES = 32;
+const OBSERVED_PENDING_MAX = 32;
+const OBSERVED_LEDGER_MAX = 1000;
 const OBSERVED_FAMILY = "observed-mutation-net";
 const OBSERVED_VERSION = 3;
 function state() {
@@ -344,6 +344,7 @@ export async function settleObservedMutation(args) {
     return {
       settled: false,
       changedPaths: [],
+      unverifiablePaths: [],
       replayed: 0,
       scanned: 0,
       stoppedEarly: false,
@@ -354,6 +355,7 @@ export async function settleObservedMutation(args) {
     return {
       settled: false,
       changedPaths: [],
+      unverifiablePaths: [],
       replayed: 0,
       scanned: 0,
       stoppedEarly: false,
@@ -365,6 +367,7 @@ export async function settleObservedMutation(args) {
     return {
       settled: false,
       changedPaths: [],
+      unverifiablePaths: [],
       replayed: 0,
       scanned: 0,
       stoppedEarly: false,
@@ -384,6 +387,7 @@ export async function settleObservedMutation(args) {
     return {
       settled: false,
       changedPaths: [],
+      unverifiablePaths: [],
       replayed: 0,
       scanned: 0,
       stoppedEarly: true,
@@ -392,17 +396,31 @@ export async function settleObservedMutation(args) {
   }
   const captured = capture.value;
   seedLedger(captured.snapshot);
-  const changed = diffFileStats(pending.stats, captured.snapshot).filter((candidate) => args.isRecordable?.(candidate) !== false);
+  const diff = diffObservedStats(pending.stats, captured.snapshot);
+  const changed = diff.changed.filter((candidate) => args.isRecordable?.(candidate) !== false);
+  const unverifiablePaths = diff.unverifiable.filter((candidate) => args.isRecordable?.(candidate) !== false);
   const truncated = pending.targetDirCapped || captured.stoppedEarly;
   const cutReason = pending.targetDirCapped ? "target-dir-cap-exceeded" : captured.stoppedEarly ? "capture-cut-short" : undefined;
+  if (unverifiablePaths.length > 0) {
+    noteObservedUnverifiable(args.toolName);
+    logLatency({
+      type: "phase",
+      toolName: args.toolName,
+      phase: "observed_mutation_coverage_unknown",
+      filePath: unverifiablePaths.slice(0, 5).join(","),
+      durationMs: Date.now() - started,
+      result: `unverifiable:${unverifiablePaths.length}`
+    });
+  }
   if (changed.length === 0) {
     if (truncated)
       noteObservedUnverifiable(args.toolName);
-    else
+    else if (unverifiablePaths.length === 0)
       noteObservedClean(args.toolName);
     return {
       settled: true,
       changedPaths: [],
+      unverifiablePaths,
       replayed: 0,
       scanned: captured.snapshot.size,
       stoppedEarly: truncated,
@@ -452,12 +470,25 @@ export async function settleObservedMutation(args) {
   return {
     settled: true,
     changedPaths: changed,
+    unverifiablePaths,
     replayed,
     scanned: captured.snapshot.size,
     stoppedEarly: truncated,
     reason: cutReason
   };
 }
+function diffObservedStats(before, after) {
+  const changed = new Set(diffFileStats(before, after));
+  const unverifiable = new Set;
+  for (const [key, stat] of after) {
+    const previous = before.get(key);
+    if (previous && (previous.hash === undefined || stat.hash === undefined)) {
+      changed.delete(key);
+      unverifiable.add(key);
+    }
+  }
+  return { changed: [...changed], unverifiable: [...unverifiable] };
+}
 async function readBytesSafe(filePath) {
   try {
     return await fs.promises.readFile(filePath);

package/extensions/dm-lens/clients/opaque-mutation-scan.js

@@ -6,9 +6,9 @@ import { normalizeMapKey } from "./path-utils.js";
 import { freshnessFromMtime } from "./freshness.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { truncatedByOutputCap } from "./spawn-output-cap.js";
-export const OPAQUE_HASH_BUDGET_BYTES = 8 * 1024 * 1024;
+const OPAQUE_HASH_BUDGET_BYTES = 8 * 1024 * 1024;
 export const OPAQUE_SCAN_MAX_FILES = 2000;
-export const OPAQUE_MTIME_TOLERANCE_MS = 150;
+const OPAQUE_MTIME_TOLERANCE_MS = 150;
 const MAX_GIT_STATUS_OUTPUT_BYTES = 16 * 1024 * 1024;
 export async function captureFileStatsForPaths(files, options = {}) {
   const hashBudget = options.hashBudgetBytes ?? OPAQUE_HASH_BUDGET_BYTES;
@@ -46,6 +46,9 @@ export async function captureFileStatsForPaths(files, options = {}) {
   return { snapshot, stoppedEarly };
 }
 export async function captureFileStats(root, options = {}) {
+  if (options.forcedUnknownReason !== undefined) {
+    return { unknownReason: options.forcedUnknownReason, scannedCount: 0 };
+  }
   const budgetMs = options.budgetMs ?? 50;
   try {
     const walk = await collectSourceFilesWithBudgetAsync(root, {
@@ -66,16 +69,27 @@ export async function captureFileStats(root, options = {}) {
   }
 }
 export function diffFileStats(before, after) {
+  const contentChanged = new Set(diffFileContent(before, after));
   const changed = [];
   for (const [key, stat] of after) {
     const prev = before.get(key);
-    const contentConfirm = prev?.hash !== undefined && stat.hash !== undefined && prev.hash !== stat.hash;
+    const contentConfirm = contentChanged.has(key);
     if (!prev || prev.mtimeMs !== stat.mtimeMs || prev.size !== stat.size || contentConfirm) {
       changed.push(key);
     }
   }
   return changed;
 }
+export function diffFileContent(before, after) {
+  const changed = [];
+  for (const [key, stat] of after) {
+    const previous = before.get(key);
+    if (previous === undefined || previous.hash !== undefined && stat.hash !== undefined && previous.hash !== stat.hash) {
+      changed.push(key);
+    }
+  }
+  return changed;
+}
 
 export class OpaqueBaselineStore {
   byCwd = new Map;
@@ -123,10 +137,6 @@ export async function isGitWorktree(root) {
   gitRepoMemo.set(key, isRepo === true);
   return isRepo === true;
 }
-export function _resetGitWorktreeMemoForTests() {
-  gitRepoMemo.clear();
-  gitToplevelMemo.clear();
-}
 const gitToplevelMemo = new Map;
 export async function resolveGitToplevel(root) {
   const key = normalizeMapKey(path.resolve(root));

package/extensions/dm-lens/clients/opengrep-client.js

@@ -3,7 +3,9 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { mkdtempSync } from "node:fs";
 import { resolveOpengrepConfig } from "./opengrep-config.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
 import { getScratchTreeDirNames } from "./scratch-tree-policy.js";
+import { realpathOrResolve } from "./path-utils.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 const EMPTY_RESULT = {
@@ -23,12 +25,13 @@ export class OpengrepClient extends SecurityScanClient {
     return this.ensureViaInstaller(["--version"]);
   }
   async scan(cwd) {
-    const targetDir = path.resolve(cwd);
+    const targetDir = realpathOrResolve(cwd);
     const scannedAt = new Date().toISOString();
     if (!await this.ensureAvailable()) {
       return {
         ...EMPTY_RESULT,
         scannedAt,
+        reason: "not-installed",
         summary: "opengrep not installed"
       };
     }
@@ -56,31 +59,64 @@ export class OpengrepClient extends SecurityScanClient {
       ], { cwd, timeout: SCAN_TIMEOUT_MS });
       if (result.error) {
         this.log(`Scan error: ${result.error.message}`);
+        const reason = `${result.failure ?? "spawn-failed"}: ${result.error.message}`;
+        this.recordRefusal(cwd, reason, result.status);
         return {
           ...EMPTY_RESULT,
           scannedAt,
-          summary: result.error.message.slice(0, 200)
+          reason: "spawn-failed",
+          summary: reason.slice(0, 200)
         };
       }
       if (!fs.existsSync(reportPath)) {
+        const reason = (result.stderr ?? "").trim().split(`
+`)[0] || "no report produced";
+        this.recordRefusal(cwd, reason, result.status);
         return {
           ...EMPTY_RESULT,
           scannedAt,
-          summary: (result.stderr ?? "").trim().split(`
-`)[0] || "no report produced"
+          reason: "no-report",
+          summary: reason
         };
       }
-      const findings = parseOpengrepReport(fs.readFileSync(reportPath, "utf-8"));
+      const raw = fs.readFileSync(reportPath, "utf-8");
+      const report = readOpengrepReport(raw);
+      if (report.verdict === "refused" || result.status !== 0) {
+        const reason = report.verdict === "refused" ? report.reason : `opengrep exited with status ${result.status}`;
+        this.recordRefusal(cwd, reason, result.status);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          reason: "refused",
+          summary: reason.slice(0, 200)
+        };
+      }
+      if (report.partial) {
+        recordDegradationOnce({
+          kind: "opengrep-partial-scan",
+          subject: cwd,
+          reason: report.partial.reason,
+          metadata: { status: result.status }
+        });
+      }
       return {
         success: true,
-        findings,
+        analyzed: !report.partial || report.scanned.length > 0,
+        analyzedFiles: report.scanned.map((file) => realpathOrResolve(path.resolve(cwd, file))),
+        ...report.partial ? { partial: true } : {},
+        ...report.partial ? { summary: report.partial.reason } : {},
+        ...report.partial && report.scanned.length === 0 ? { reason: "partial-no-paths" } : {},
+        findings: report.findings,
         scannedAt
       };
     } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      this.recordRefusal(cwd, reason, undefined);
       return {
         ...EMPTY_RESULT,
         scannedAt,
-        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
+        reason: "crashed",
+        summary: reason.slice(0, 200)
       };
     } finally {
       try {
@@ -88,15 +124,61 @@ export class OpengrepClient extends SecurityScanClient {
       } catch {}
     }
   }
+  recordRefusal(cwd, reason, status) {
+    recordDegradationOnce({
+      kind: "opengrep-scan-refused",
+      subject: cwd,
+      reason,
+      metadata: { status }
+    });
+  }
 }
-export function parseOpengrepReport(raw) {
-  if (!raw.trim())
-    return [];
+function readOpengrepReport(raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  }
+  if (!parsed || typeof parsed !== "object")
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  const report = parsed;
+  if (!Array.isArray(report.results) && !Array.isArray(report.errors))
+    return { verdict: "refused", reason: "unparseable opengrep report" };
+  const errors = (Array.isArray(report.errors) ? report.errors : []).map((error) => {
+    if (typeof error === "string")
+      return { message: error };
+    if (!error || typeof error !== "object")
+      return { message: "unrecognised opengrep error entry" };
+    const entry = error;
+    const level = typeof entry.level === "string" ? entry.level : undefined;
+    const message = typeof entry.message === "string" ? entry.message : undefined;
+    return {
+      ...level ? { level } : {},
+      message: message ?? level ?? "unrecognised opengrep error entry"
+    };
+  });
+  const refusal = errors.find((error) => error.level !== "warn");
+  if (refusal)
+    return { verdict: "refused", reason: refusal.message };
+  const scanned = Array.isArray(report.paths?.scanned) ? report.paths.scanned.filter((file) => typeof file === "string") : [];
+  return {
+    verdict: "usable",
+    ...errors[0] ? { partial: { reason: errors[0].message } } : {},
+    findings: parseOpengrepReport(parsed),
+    scanned
+  };
+}
+export function parseOpengrepReport(rawOrParsed) {
+  if (typeof rawOrParsed === "string" && !rawOrParsed.trim())
     return [];
+  let parsed = rawOrParsed;
+  if (typeof rawOrParsed === "string") {
+    try {
+      parsed = JSON.parse(rawOrParsed);
+    } catch {
+      return [];
+    }
   }
   if (!parsed || typeof parsed !== "object")
     return [];

package/extensions/dm-lens/clients/opengrep-config.js

@@ -1,6 +1,6 @@
 import * as path from "node:path";
 import { findLocalToolConfig } from "./path-utils.js";
-export const LOCAL_OPENGREP_CONFIG_NAMES = [
+const LOCAL_OPENGREP_CONFIG_NAMES = [
   ".opengrep.yml",
   ".opengrep.yaml",
   "opengrep.yml",

package/extensions/dm-lens/clients/package-manager.js

@@ -9,6 +9,7 @@ import {
   startHostStallSampler
 } from "./dispatch/runners/utils/availability-policy.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { probeToolAsync } from "./tool-probe.js";
 import { createAvailabilityProbeFlight } from "./availability-probe-flight.js";
 import {
   createGenerationSource
@@ -74,7 +75,7 @@ async function probeAvailability(pm) {
   let result;
   let hostStallMs;
   try {
-    result = await safeSpawnAsync(finder, [pm], { timeout: PROBE_TIMEOUT_MS });
+    result = await probeToolAsync(finder, [pm], { timeout: PROBE_TIMEOUT_MS });
   } finally {
     hostStallMs = sampler.stop();
   }