@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-lens/dist/clients/trivy-client.js

@@ -1,305 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { mkdtempSync } from "node:fs";
-import { loadDmLensProjectConfig } from "./project-lens-config.js";
-import { getScratchTreeGlobPatterns } from "./scratch-tree-policy.js";
-import { safeSpawnAsync } from "./safe-spawn.js";
-import { SecurityScanClient } from "./security-scan-client.js";
-const EMPTY_RESULT = {
-  success: false,
-  findings: [],
-  secrets: [],
-  licenses: []
-};
-const SCAN_TIMEOUT_MS = 180000;
-const DEPENDENCY_MANIFESTS = [
-  "package.json",
-  "package-lock.json",
-  "pnpm-lock.yaml",
-  "yarn.lock",
-  "bun.lockb",
-  "pyproject.toml",
-  "requirements.txt",
-  "poetry.lock",
-  "Pipfile.lock",
-  "pom.xml",
-  "build.gradle",
-  "build.gradle.kts",
-  "gradle.lockfile",
-  "go.mod",
-  "go.sum",
-  "Cargo.toml",
-  "Cargo.lock",
-  "packages.lock.json",
-  "composer.json",
-  "composer.lock",
-  "Gemfile",
-  "Gemfile.lock"
-];
-export function hasAnyDependencyManifest(cwd) {
-  for (const manifest of DEPENDENCY_MANIFESTS) {
-    try {
-      if (fs.existsSync(path.join(cwd, manifest)))
-        return true;
-    } catch {}
-  }
-  return false;
-}
-export function isTrivyEnabled(cwd) {
-  try {
-    const config = loadDmLensProjectConfig(cwd);
-    const trivy = config.raw?.trivy;
-    return trivy?.enabled === true;
-  } catch {
-    return false;
-  }
-}
-export function shouldScanTrivy(cwd) {
-  return isTrivyEnabled(cwd) && hasAnyDependencyManifest(cwd);
-}
-const SEVERITY_RANK = {
-  LOW: 0,
-  MEDIUM: 1,
-  HIGH: 2,
-  CRITICAL: 3
-};
-export function resolveSeverityFloor(cwd) {
-  let raw;
-  try {
-    const config = loadDmLensProjectConfig(cwd);
-    raw = config.raw?.trivy?.minSeverity;
-  } catch {
-    raw = undefined;
-  }
-  const requested = typeof raw === "string" ? SEVERITY_RANK[raw.toUpperCase()] : undefined;
-  const floor = Math.min(requested ?? SEVERITY_RANK.HIGH, SEVERITY_RANK.HIGH);
-  return ["LOW", "MEDIUM", "HIGH", "CRITICAL"].filter((s) => SEVERITY_RANK[s] >= floor);
-}
-
-export class TrivyClient extends SecurityScanClient {
-  constructor(verbose = false) {
-    super("trivy", verbose);
-  }
-  static hasAnyDependencyManifest(cwd) {
-    return hasAnyDependencyManifest(cwd);
-  }
-  static shouldScan(cwd) {
-    return shouldScanTrivy(cwd);
-  }
-  doEnsureAvailable() {
-    return this.ensureViaInstaller(["--version"]);
-  }
-  async scan(cwd) {
-    const targetDir = path.resolve(cwd);
-    const scannedAt = new Date().toISOString();
-    if (!shouldScanTrivy(targetDir)) {
-      return {
-        ...EMPTY_RESULT,
-        success: true,
-        scannedAt,
-        summary: hasAnyDependencyManifest(targetDir) ? "trivy not enabled (set trivy.enabled in .dm-lens.json)" : "no dependency manifest at analysis root"
-      };
-    }
-    if (!await this.ensureAvailable()) {
-      return { ...EMPTY_RESULT, scannedAt, summary: "trivy not installed" };
-    }
-    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
-  }
-  async runScan(cwd) {
-    const scannedAt = new Date().toISOString();
-    const bin = this.binaryPath ?? "trivy";
-    const severities = resolveSeverityFloor(cwd);
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "dm-lens-trivy-"));
-    const reportPath = path.join(outDir, "trivy-report.json");
-    try {
-      const result = await safeSpawnAsync(bin, [
-        "fs",
-        "--scanners",
-        "vuln,secret,license",
-        "--severity",
-        severities.join(","),
-        "--format",
-        "json",
-        "--output",
-        reportPath,
-        "--quiet",
-        "--no-progress",
-        ...getScratchTreeGlobPatterns().flatMap((glob) => [
-          "--skip-dirs",
-          glob
-        ]),
-        cwd
-      ], { cwd, timeout: SCAN_TIMEOUT_MS });
-      if (result.error) {
-        this.log(`Scan error: ${result.error.message}`);
-        return {
-          ...EMPTY_RESULT,
-          scannedAt,
-          summary: result.error.message.slice(0, 200)
-        };
-      }
-      if (!fs.existsSync(reportPath)) {
-        return {
-          ...EMPTY_RESULT,
-          success: true,
-          scannedAt,
-          summary: (result.stderr ?? "").trim().split(`
-`)[0] || "no report produced"
-        };
-      }
-      const raw = fs.readFileSync(reportPath, "utf-8");
-      const findings = parseTrivyReport(raw);
-      const secrets = parseTrivySecrets(raw);
-      const licenses = parseTrivyLicenses(raw);
-      return {
-        success: true,
-        analyzed: true,
-        findings,
-        secrets,
-        licenses,
-        scannedAt
-      };
-    } catch (err) {
-      return {
-        ...EMPTY_RESULT,
-        scannedAt,
-        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
-      };
-    } finally {
-      try {
-        fs.rmSync(outDir, { recursive: true, force: true });
-      } catch {}
-    }
-  }
-}
-function normalizeSeverity(raw) {
-  const s = typeof raw === "string" ? raw.toUpperCase() : "";
-  if (s === "CRITICAL" || s === "HIGH" || s === "MEDIUM" || s === "LOW") {
-    return s;
-  }
-  return "UNKNOWN";
-}
-export function parseTrivyReport(raw) {
-  if (!raw.trim())
-    return [];
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return [];
-  }
-  const results = parsed?.Results;
-  if (!Array.isArray(results))
-    return [];
-  const findings = [];
-  for (const resultEntry of results) {
-    if (!resultEntry || typeof resultEntry !== "object")
-      continue;
-    const r = resultEntry;
-    const target = typeof r.Target === "string" ? r.Target : undefined;
-    const vulns = r.Vulnerabilities;
-    if (!Array.isArray(vulns))
-      continue;
-    for (const vulnEntry of vulns) {
-      if (!vulnEntry || typeof vulnEntry !== "object")
-        continue;
-      const v = vulnEntry;
-      const vulnerabilityId = typeof v.VulnerabilityID === "string" ? v.VulnerabilityID : undefined;
-      const pkgName = typeof v.PkgName === "string" ? v.PkgName : undefined;
-      if (!vulnerabilityId || !pkgName)
-        continue;
-      findings.push({
-        vulnerabilityId,
-        pkgName,
-        installedVersion: typeof v.InstalledVersion === "string" ? v.InstalledVersion : undefined,
-        fixedVersion: typeof v.FixedVersion === "string" && v.FixedVersion.trim() ? v.FixedVersion : undefined,
-        severity: normalizeSeverity(v.Severity),
-        title: typeof v.Title === "string" ? v.Title : undefined,
-        primaryUrl: typeof v.PrimaryURL === "string" ? v.PrimaryURL : undefined,
-        target
-      });
-    }
-  }
-  return findings;
-}
-export function parseTrivySecrets(raw) {
-  if (!raw.trim())
-    return [];
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return [];
-  }
-  const results = parsed?.Results;
-  if (!Array.isArray(results))
-    return [];
-  const secrets = [];
-  for (const resultEntry of results) {
-    if (!resultEntry || typeof resultEntry !== "object")
-      continue;
-    const r = resultEntry;
-    const target = typeof r.Target === "string" ? r.Target : undefined;
-    const rows = r.Secrets;
-    if (!target || !Array.isArray(rows))
-      continue;
-    for (const row of rows) {
-      if (!row || typeof row !== "object")
-        continue;
-      const s = row;
-      const ruleId = typeof s.RuleID === "string" ? s.RuleID : undefined;
-      const line = typeof s.StartLine === "number" ? s.StartLine : undefined;
-      if (!ruleId || line == null)
-        continue;
-      secrets.push({
-        ruleId,
-        file: target,
-        line,
-        title: typeof s.Title === "string" ? s.Title : undefined
-      });
-    }
-  }
-  return secrets;
-}
-export function parseTrivyLicenses(raw) {
-  if (!raw.trim())
-    return [];
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return [];
-  }
-  const results = parsed?.Results;
-  if (!Array.isArray(results))
-    return [];
-  const licenses = [];
-  for (const resultEntry of results) {
-    if (!resultEntry || typeof resultEntry !== "object")
-      continue;
-    const r = resultEntry;
-    const target = typeof r.Target === "string" ? r.Target : undefined;
-    const rows = r.Licenses;
-    if (!Array.isArray(rows))
-      continue;
-    for (const row of rows) {
-      if (!row || typeof row !== "object")
-        continue;
-      const l = row;
-      const license = typeof l.Name === "string" ? l.Name : undefined;
-      if (!license)
-        continue;
-      const filePath = typeof l.FilePath === "string" && l.FilePath ? l.FilePath : target;
-      const pkgName = typeof l.PkgName === "string" && l.PkgName ? l.PkgName : filePath ?? "unknown";
-      licenses.push({
-        license,
-        pkgName,
-        severity: normalizeSeverity(l.Severity),
-        category: typeof l.Category === "string" ? l.Category : undefined,
-        filePath
-      });
-    }
-  }
-  return licenses;
-}

package/extensions/dm-lens/dist/clients/tui-fit.js

@@ -1,26 +0,0 @@
-import { truncateToWidth } from "./deps/dm-tui-compat.js";
-const ELLIPSIS_KIND = { "…": 0, "...": 1, "": 2 };
-let truncateIsNative = null;
-export function fitLine(s, maxWidth, ellipsis = "...") {
-  const w = Math.max(0, maxWidth);
-  const fn = truncateToWidth;
-  if (truncateIsNative === true) {
-    return fn(s, w, ELLIPSIS_KIND[ellipsis] ?? 1, false, 8);
-  }
-  if (truncateIsNative === false) {
-    return fn(s, w, ellipsis);
-  }
-  try {
-    const out = fn(s, w, ellipsis);
-    truncateIsNative = false;
-    return out;
-  } catch {
-    truncateIsNative = true;
-    return fn(s, w, ELLIPSIS_KIND[ellipsis] ?? 1, false, 8);
-  }
-}
-export function fitLines(lines, width) {
-  if (!Number.isFinite(width) || width <= 0)
-    return lines;
-  return lines.map((line) => fitLine(line, width));
-}

package/extensions/dm-lens/dist/clients/turn-context.js

@@ -1,48 +0,0 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-import { getProcessSingleton } from "./process-singletons.js";
-const FAMILY = "turn-context";
-const VERSION = 2;
-function state() {
-  return getProcessSingleton(FAMILY, VERSION, () => ({
-    sessions: new Map,
-    activeSession: new AsyncLocalStorage
-  }));
-}
-function sessionState(sessionId) {
-  const current = state();
-  let session = current.sessions.get(sessionId);
-  if (!session) {
-    session = { turnId: `${sessionId}:0`, turnIndex: 0 };
-    current.sessions.set(sessionId, session);
-  }
-  return session;
-}
-export function resetTurnContext(sessionId) {
-  const current = state();
-  if (sessionId === undefined)
-    return;
-  current.sessions.set(sessionId, { turnId: `${sessionId}:0`, turnIndex: 0 });
-}
-export function setTurnContextSession(sessionId) {
-  const stableSessionId = sessionId?.trim();
-  if (stableSessionId !== undefined && stableSessionId !== "")
-    sessionState(stableSessionId);
-}
-export function beginTurnContext(sessionId) {
-  const session = sessionState(sessionId);
-  session.turnIndex += 1;
-  session.turnId = `${sessionId}:${session.turnIndex}`;
-  return session.turnId;
-}
-export function runWithTurnContext(sessionId, fn) {
-  if (sessionId === undefined)
-    return fn();
-  return state().activeSession.run(sessionId, fn);
-}
-export function getTurnId() {
-  const current = state();
-  const sessionId = current.activeSession.getStore();
-  if (sessionId === undefined)
-    return "turn:0";
-  return sessionState(sessionId).turnId;
-}

package/extensions/dm-lens/dist/clients/turn-end/lane.js

@@ -1 +0,0 @@
-export {};

package/extensions/dm-lens/dist/clients/turn-end/lanes/govulncheck.js

@@ -1,54 +0,0 @@
-import { filterFindingsByDisposition } from "../../dispatch/finding-policy.js";
-import { toRunnerDisplayPath } from "../../dispatch/runner-context.js";
-import { govulncheckFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/govulncheck.js";
-import { STALE_LINE_MARKER } from "../../stale-marker.js";
-async function collect(ctx) {
-  const data = (await ctx.readScannerCache("govulncheck"))?.data;
-  return {
-    govulncheck: {
-      findings: data?.findings ?? [],
-      scannedAt: data?.scannedAt,
-      citedPath: (finding) => finding.trace.find((frame) => frame.filename)?.filename,
-      onMissing: "demote"
-    }
-  };
-}
-function gate(gates, ctx) {
-  const stale = new Set(gates.govulncheck.stale);
-  const filtered = filterFindingsByDisposition([...gates.govulncheck.live, ...gates.govulncheck.stale], ctx.cwd, (f) => govulncheckFindingToProjectDiagnostic(ctx.cwd, f));
-  return {
-    findings: filtered.kept,
-    stale,
-    suppressed: filtered.suppressed
-  };
-}
-function render(kept, ctx) {
-  const advisorySections = [];
-  if (kept.findings.length) {
-    const findings = kept.findings.slice(0, 5);
-    let report = `\uD83D\uDEE1️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:
-`;
-    for (const f of findings) {
-      const callSite = f.trace.find((t) => t.filename);
-      const stale = kept.stale.has(f);
-      const where = callSite?.filename ? `${toRunnerDisplayPath(ctx.cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}` : f.module ?? f.packageName ?? "(module)";
-      const fix = f.fixedVersion ? ` — upgrade to ${f.fixedVersion} or later` : " — no fix yet, track upstream";
-      report += `  ${f.osv} (${where})${fix}
-`;
-    }
-    if (kept.findings.length > findings.length) {
-      report += `  … and ${kept.findings.length - findings.length} more
-`;
-    }
-    advisorySections.push(report);
-  }
-  return {
-    advisoryParts: advisorySections,
-    dispositionSuppressed: { govulncheck: kept.suppressed }
-  };
-}
-export const govulncheckLane = {
-  collect,
-  gate,
-  render
-};

package/extensions/dm-lens/dist/clients/turn-end/lanes/secrets.js

@@ -1,131 +0,0 @@
-import { recordDegradationOnce } from "../../degradation-ledger.js";
-import { bounded } from "../../deadline-utils.js";
-import { filterFindingsByDisposition } from "../../dispatch/finding-policy.js";
-import { toRunnerDisplayPath } from "../../dispatch/runner-context.js";
-import { classifyAndFilterFindings } from "../../gitleaks-client.js";
-import { HOOK_WALL_BUDGET_MS } from "../../hook-budgets.js";
-import { gitleaksFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/gitleaks.js";
-import { trivySecretFindingToProjectDiagnostic } from "../../project-diagnostics/runner-adapters/trivy.js";
-import { dedupeSecretFindings, fromAstGrepWarnings, fromGitleaks, fromTrivySecrets, isSecretWarning, secretLocationKey } from "../../secret-findings.js";
-import { STALE_LINE_MARKER } from "../../stale-marker.js";
-async function blockingGitleaksFindings(data, ctx) {
-  const classification = await bounded(classifyAndFilterFindings(data?.findings ?? [], ctx.cwd), {
-    ms: HOOK_WALL_BUDGET_MS.turn_end,
-    signal: ctx.signal,
-    hook: "turn_end",
-    label: "classifyAndFilterFindings"
-  });
-  if (classification === undefined) {
-    recordDegradationOnce({
-      kind: "gitleaks_classification_timeout",
-      subject: ctx.cwd,
-      reason: "gitleaks classification exceeded the turn_end budget; retained raw findings to fail open"
-    });
-  }
-  return (classification ?? data?.findings ?? []).filter((finding) => gitleaksFindingToProjectDiagnostic(ctx.cwd, finding).semantic === "blocking");
-}
-async function collect(ctx) {
-  const [gitleaksEntry, trivyEntry] = await Promise.all([
-    ctx.readScannerCache("gitleaks"),
-    ctx.readScannerCache("trivy")
-  ]);
-  const gitleaksData = gitleaksEntry?.data;
-  const trivyData = trivyEntry?.data;
-  return {
-    gitleaks: {
-      findings: await blockingGitleaksFindings(gitleaksData, ctx),
-      citedPath: (finding) => finding.file,
-      scannedAt: gitleaksData?.scannedAt
-    },
-    "trivy-secrets": {
-      findings: trivyData?.secrets ?? [],
-      citedPath: (finding) => finding.file,
-      scannedAt: trivyData?.scannedAt
-    }
-  };
-}
-function gate(gates, ctx) {
-  const gitleaksLive = filterFindingsByDisposition(gates.gitleaks.live, ctx.cwd, (f) => gitleaksFindingToProjectDiagnostic(ctx.cwd, f));
-  const gitleaksStale = filterFindingsByDisposition(gates.gitleaks.stale, ctx.cwd, (f) => gitleaksFindingToProjectDiagnostic(ctx.cwd, f));
-  const trivyLive = filterFindingsByDisposition(gates["trivy-secrets"].live, ctx.cwd, (f) => trivySecretFindingToProjectDiagnostic(ctx.cwd, f));
-  const trivyStale = filterFindingsByDisposition(gates["trivy-secrets"].stale, ctx.cwd, (f) => trivySecretFindingToProjectDiagnostic(ctx.cwd, f));
-  return {
-    gitleaksLive: gitleaksLive.kept,
-    gitleaksStale: gitleaksStale.kept,
-    trivyLive: trivyLive.kept,
-    trivyStale: trivyStale.kept,
-    suppressed: {
-      gitleaks: gitleaksLive.suppressed + gitleaksStale.suppressed,
-      "trivy-secrets": trivyLive.suppressed + trivyStale.suppressed
-    }
-  };
-}
-function render(kept, ctx) {
-  const sessionSecrets = dedupeSecretFindings([
-    ...fromGitleaks(kept.gitleaksLive),
-    ...fromTrivySecrets(kept.trivyLive)
-  ]);
-  const deliveredLocationKeys = new Set(sessionSecrets.map((f) => secretLocationKey(f.file, f.line)));
-  const blockerSections = [];
-  if (sessionSecrets.length) {
-    const enriched = dedupeSecretFindings([
-      ...sessionSecrets,
-      ...fromAstGrepWarnings(ctx.peekActionableWarnings().filter(isSecretWarning)).filter((a) => deliveredLocationKeys.has(secretLocationKey(a.file, a.line)))
-    ]);
-    const shown = enriched.slice(0, 5);
-    let report = `\uD83D\uDD34 STOP — hardcoded secrets detected. Rotate the credentials and remove them from source:
-`;
-    for (const f of shown) {
-      const where = `${toRunnerDisplayPath(ctx.cwd, f.file)}:${f.line}`;
-      report += `  ${where} — ${f.rule} [${f.sources.join(" + ")}]${f.description ? `: ${f.description}` : ""}
-`;
-    }
-    if (enriched.length > shown.length) {
-      report += `  … and ${enriched.length - shown.length} more
-`;
-    }
-    blockerSections.push(report);
-  }
-  const staleSecretEntries = [
-    ...kept.gitleaksStale.map((f) => ({
-      file: toRunnerDisplayPath(ctx.cwd, f.file),
-      rule: f.ruleId,
-      source: "gitleaks"
-    })),
-    ...kept.trivyStale.map((f) => ({
-      file: toRunnerDisplayPath(ctx.cwd, f.file),
-      rule: f.ruleId,
-      source: "trivy"
-    }))
-  ];
-  const staleSecrets = [
-    ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values()
-  ];
-  const staleSections = [];
-  if (staleSecrets.length) {
-    const shown = staleSecrets.slice(0, 5);
-    let report = `\uD83D\uDD11 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}
-` + `The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:
-`;
-    for (const entry of shown) {
-      report += `  ${entry.file} — ${entry.rule} [${entry.source}]
-`;
-    }
-    if (staleSecrets.length > shown.length) {
-      report += `  … and ${staleSecrets.length - shown.length} more
-`;
-    }
-    staleSections.push(report);
-  }
-  return {
-    blockerParts: blockerSections,
-    staleSecretParts: staleSections,
-    dispositionSuppressed: kept.suppressed,
-    deliveredLocationKeys
-  };
-}
-export const secretsLane = {
-  collect,
-  gate,
-  render
-};

package/extensions/dm-lens/dist/clients/turn-summary-render.js

@@ -1,56 +0,0 @@
-import { fitLines } from "./tui-fit.js";
-import { formatTurnSummaryLine } from "./turn-summary.js";
-function severityColor(theme, severity) {
-  if (severity === "error")
-    return (s) => theme.fg("error", s);
-  if (severity === "warning")
-    return (s) => theme.fg("warning", s);
-  return (s) => theme.fg("dim", s);
-}
-function eventLine(theme, event) {
-  const loc = event.line !== undefined ? `:${event.line}` : "";
-  if (event.kind === "diagnostic") {
-    const color = severityColor(theme, event.severity);
-    const rule = event.ruleId ? ` ${event.ruleId}` : "";
-    const desc = event.description ? ` — ${event.description}` : "";
-    return `    ${color(`[${event.tool}${rule}]`)}${loc}${desc}`;
-  }
-  if (event.kind === "autofix") {
-    const desc = event.description ? ` — ${event.description}` : "";
-    return `    ${theme.fg("success", `[autofix:${event.tool}]`)}${loc}${desc}`;
-  }
-  return `    ${theme.fg("accent", `[format:${event.tool}]`)}`;
-}
-function buildExpandedLines(details, theme) {
-  const lines = [];
-  lines.push(theme.fg("accent", theme.bold("dm-lens turn summary")));
-  const sortedFiles = [...details.files].sort((a, b) => a.displayPath.localeCompare(b.displayPath));
-  for (const file of sortedFiles) {
-    lines.push(`  ${theme.bold(file.displayPath)}`);
-    const formats = file.events.filter((e) => e.kind === "format");
-    const autofixes = file.events.filter((e) => e.kind === "autofix");
-    const diagnostics = file.events.filter((e) => e.kind === "diagnostic");
-    for (const event of [...formats, ...autofixes, ...diagnostics]) {
-      lines.push(eventLine(theme, event));
-    }
-  }
-  return lines;
-}
-export function renderTurnSummaryMessage(message, options, theme) {
-  const details = message.details;
-  if (!details)
-    return;
-  if (!options.expanded) {
-    const line = formatTurnSummaryLine(details);
-    const text = theme.fg("accent", line);
-    return {
-      render: (width) => fitLines([text], width),
-      invalidate: () => {}
-    };
-  }
-  const lines = buildExpandedLines(details, theme);
-  return {
-    render: (width) => fitLines(lines, width),
-    invalidate: () => {}
-  };
-}