@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-lens/dist/clients/git-tracked-ignore.js

@@ -1,120 +0,0 @@
-import * as path from "node:path";
-import { isExcludedDirName } from "./file-utils.js";
-import { recordDegradationOnce } from "./degradation-ledger.js";
-import { normalizeEphemeralMapKey, normalizeMapKey } from "./path-utils.js";
-import { safeSpawnAsync } from "./safe-spawn.js";
-import { truncatedByOutputCap } from "./spawn-output-cap.js";
-function recordTruncatedLsFiles(parseSite) {
-  recordDegradationOnce({
-    kind: "git-tracked-ignore-truncated",
-    subject: `git-ls-files:${parseSite}`,
-    reason: "safeSpawnAsync capped git ls-files stdout"
-  });
-}
-const MAX_LS_FILES_OUTPUT_BYTES = 16 * 1024 * 1024;
-export function parseUntrackedIgnoredOutput(stdout, cwd) {
-  const ids = new Set;
-  for (const line of stdout.split(/\r?\n/)) {
-    const rel = line.trim();
-    if (!rel)
-      continue;
-    const dirSegments = rel.split("/").slice(0, -1);
-    if (dirSegments.some((segment) => isExcludedDirName(segment)))
-      continue;
-    ids.add(normalizeMapKey(path.join(cwd, rel)));
-  }
-  return ids;
-}
-async function fetchUntrackedIgnoredIds(cwd) {
-  try {
-    const result = await safeSpawnAsync("git", ["ls-files", "--others", "--ignored", "--exclude-standard"], {
-      cwd,
-      timeout: 1e4,
-      maxOutputBytes: MAX_LS_FILES_OUTPUT_BYTES,
-      resourceLabel: "git-tracked-ignore"
-    });
-    if (truncatedByOutputCap(result)) {
-      recordTruncatedLsFiles("untracked-ignored");
-      return;
-    }
-    if (result.error || result.status !== 0)
-      return;
-    return parseUntrackedIgnoredOutput(result.stdout, cwd);
-  } catch {
-    return;
-  }
-}
-const CACHE_TTL_MS = 30000;
-const _cache = new Map;
-export function collectUntrackedIgnoredIds(cwd) {
-  const key = normalizeMapKey(cwd);
-  const now = Date.now();
-  const cached = _cache.get(key);
-  if (cached && now - cached.fetchedAtMs < CACHE_TTL_MS)
-    return cached.promise;
-  const promise = fetchUntrackedIgnoredIds(cwd);
-  _cache.set(key, { promise, fetchedAtMs: now });
-  return promise;
-}
-export function _resetUntrackedIgnoredCacheForTests() {
-  _cache.clear();
-}
-export function parseTrackedFilesOutput(stdout, cwd) {
-  const ids = new Set;
-  const base = normalizeMapKey(cwd);
-  for (const line of stdout.split(/\r?\n/)) {
-    const rel = line.trim();
-    if (!rel)
-      continue;
-    const dirSegments = rel.split("/").slice(0, -1);
-    if (dirSegments.some((segment) => isExcludedDirName(segment)))
-      continue;
-    ids.add(normalizeEphemeralMapKey(path.join(base, rel)));
-  }
-  return ids;
-}
-async function fetchTrackedFiles(cwd) {
-  try {
-    const result = await safeSpawnAsync("git", ["ls-files"], {
-      cwd,
-      timeout: 1e4,
-      maxOutputBytes: MAX_LS_FILES_OUTPUT_BYTES,
-      resourceLabel: "git-tracked-ignore"
-    });
-    if (truncatedByOutputCap(result)) {
-      recordTruncatedLsFiles("tracked");
-      return;
-    }
-    if (result.error || result.status !== 0)
-      return;
-    return parseTrackedFilesOutput(result.stdout, cwd);
-  } catch {
-    return;
-  }
-}
-const _trackedCache = new Map;
-const _trackedSnapshot = new Map;
-export function collectTrackedFiles(cwd) {
-  const key = normalizeEphemeralMapKey(cwd);
-  const now = Date.now();
-  for (const [snapshotKey, entry] of _trackedCache) {
-    if (now - entry.fetchedAtMs >= CACHE_TTL_MS)
-      _trackedSnapshot.delete(snapshotKey);
-  }
-  const cached = _trackedCache.get(key);
-  if (cached && now - cached.fetchedAtMs < CACHE_TTL_MS)
-    return cached.promise;
-  const promise = fetchTrackedFiles(cwd).then((result) => {
-    _trackedSnapshot.set(key, result);
-    return result;
-  });
-  _trackedCache.set(key, { promise, fetchedAtMs: now });
-  return promise;
-}
-export function getTrackedFilesSnapshot(cwd) {
-  return _trackedSnapshot.get(normalizeEphemeralMapKey(cwd));
-}
-export function _resetTrackedFilesCacheForTests() {
-  _trackedCache.clear();
-  _trackedSnapshot.clear();
-}

package/extensions/dm-lens/dist/clients/gitleaks-client.js

@@ -1,282 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { mkdtempSync } from "node:fs";
-import { collectTrackedFiles, collectUntrackedIgnoredIds } from "./git-tracked-ignore.js";
-import { normalizeEphemeralMapKey, normalizeMapKey } from "./path-utils.js";
-import { safeSpawnAsync } from "./safe-spawn.js";
-import { SecurityScanClient } from "./security-scan-client.js";
-import { getSecretsLaneAllowlistPaths, isUnderSecretsLaneScratchTree } from "./scratch-tree-policy.js";
-const EMPTY_RESULT = {
-  success: false,
-  findings: []
-};
-const SCAN_TIMEOUT_MS = 120000;
-const LOCAL_GITLEAKS_CONFIG_NAMES = [
-  ".gitleaks.toml",
-  ".gitleaks.yaml",
-  ".gitleaks.yml"
-];
-function findLocalGitleaksConfig(cwd) {
-  for (const name of LOCAL_GITLEAKS_CONFIG_NAMES) {
-    const candidate = path.join(cwd, name);
-    try {
-      if (fs.existsSync(candidate))
-        return candidate;
-    } catch {}
-  }
-  return;
-}
-export const PLACEHOLDER_SECRET_REGEXES = [
-  String.raw`(?i)^(your|my|insert|replace|enter|add)[-_ ]?(the[-_ ]?)?(api[-_ ]?)?(key|token|secret|password|credential)s?$`,
-  String.raw`(?i)^<[^<>]*(api[-_ ]?key|token|secret|password|credential|key)[^<>]*>$`,
-  String.raw`(?i)^x{3,}$`,
-  String.raw`(?i)^(changeme|change[-_]me|example|placeholder|dummy|fake|redacted|xxxxxxxx)$`
-];
-export function writeScopedGitleaksConfig(outDir, cwd) {
-  const localConfig = findLocalGitleaksConfig(cwd);
-  const extendLine = localConfig ? `path = ${JSON.stringify(localConfig)}` : "useDefault = true";
-  const pathPatterns = getSecretsLaneAllowlistPaths().map((p) => `    ${JSON.stringify(p)},`).join(`
-`);
-  const regexPatterns = PLACEHOLDER_SECRET_REGEXES.map((r) => `    ${JSON.stringify(r)},`).join(`
-`);
-  const toml = `[extend]
-${extendLine}
-
-[allowlist]
-paths = [
-${pathPatterns}
-]
-regexes = [
-${regexPatterns}
-]
-`;
-  const configPath = path.join(outDir, "gitleaks-scoped-config.toml");
-  fs.writeFileSync(configPath, toml, "utf-8");
-  return configPath;
-}
-export function hasGitleaksSignal(cwd) {
-  const candidates = [...LOCAL_GITLEAKS_CONFIG_NAMES, ".gitleaksignore"];
-  for (const candidate of candidates) {
-    try {
-      if (fs.existsSync(path.join(cwd, candidate)))
-        return true;
-    } catch {}
-  }
-  const pkgJsonPath = path.join(cwd, "package.json");
-  try {
-    if (fs.existsSync(pkgJsonPath)) {
-      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
-      const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-      for (const name of Object.keys(deps)) {
-        if (name.toLowerCase().includes("gitleaks"))
-          return true;
-      }
-    }
-  } catch {}
-  const hookCandidates = [
-    path.join(cwd, ".husky", "pre-commit"),
-    path.join(cwd, ".husky", "_", "pre-commit"),
-    path.join(cwd, ".git", "hooks", "pre-commit")
-  ];
-  for (const hook of hookCandidates) {
-    try {
-      if (!fs.existsSync(hook))
-        continue;
-      const content = fs.readFileSync(hook, "utf-8");
-      if (content.includes("gitleaks"))
-        return true;
-    } catch {}
-  }
-  return false;
-}
-export function hasGitRepo(cwd) {
-  try {
-    return fs.existsSync(path.join(cwd, ".git"));
-  } catch {
-    return false;
-  }
-}
-
-export class GitleaksClient extends SecurityScanClient {
-  constructor(verbose = false) {
-    super("gitleaks", verbose);
-  }
-  static hasGitleaksSignal(cwd) {
-    return hasGitleaksSignal(cwd);
-  }
-  static hasGitRepo(cwd) {
-    return hasGitRepo(cwd);
-  }
-  doEnsureAvailable() {
-    return this.ensureViaInstaller(["version"]);
-  }
-  async scan(cwd, options) {
-    const targetDir = path.resolve(cwd);
-    const scannedAt = new Date().toISOString();
-    const requireSignal = options?.requireSignal ?? true;
-    if (requireSignal && !GitleaksClient.hasGitleaksSignal(targetDir)) {
-      return {
-        ...EMPTY_RESULT,
-        success: true,
-        scannedAt,
-        summary: "no gitleaks opt-in signal at project root"
-      };
-    }
-    if (!await this.ensureAvailable()) {
-      return {
-        ...EMPTY_RESULT,
-        scannedAt,
-        summary: "gitleaks not installed"
-      };
-    }
-    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
-  }
-  async runScan(cwd) {
-    const scannedAt = new Date().toISOString();
-    const bin = this.binaryPath ?? "gitleaks";
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "dm-lens-gitleaks-"));
-    const reportPath = path.join(outDir, "gitleaks-report.json");
-    try {
-      const configPath = writeScopedGitleaksConfig(outDir, cwd);
-      const result = await safeSpawnAsync(bin, [
-        "detect",
-        "--no-git",
-        "--source",
-        cwd,
-        "--config",
-        configPath,
-        "--report-format",
-        "json",
-        "--report-path",
-        reportPath,
-        "--exit-code",
-        "0",
-        "--no-banner"
-      ], { cwd, timeout: SCAN_TIMEOUT_MS });
-      if (result.error) {
-        this.log(`Scan error: ${result.error.message}`);
-        return {
-          ...EMPTY_RESULT,
-          scannedAt,
-          summary: result.error.message.slice(0, 200)
-        };
-      }
-      if (!fs.existsSync(reportPath)) {
-        return {
-          ...EMPTY_RESULT,
-          success: true,
-          scannedAt,
-          summary: (result.stderr ?? "").trim().split(`
-`)[0] || "no report produced"
-        };
-      }
-      const rawFindings = parseGitleaksReport(fs.readFileSync(reportPath, "utf-8"));
-      const findings = await classifyAndFilterFindings(rawFindings, cwd);
-      return {
-        success: true,
-        analyzed: true,
-        findings,
-        scannedAt
-      };
-    } catch (err) {
-      return {
-        ...EMPTY_RESULT,
-        scannedAt,
-        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
-      };
-    } finally {
-      try {
-        fs.rmSync(outDir, { recursive: true, force: true });
-      } catch {}
-    }
-  }
-}
-function isInsideNestedGitRepository(file, cwd) {
-  const root = path.resolve(cwd);
-  const absoluteFile = path.isAbsolute(file) ? path.resolve(file) : path.resolve(root, file);
-  const relative = path.relative(root, absoluteFile);
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
-    return false;
-  let directory = path.dirname(absoluteFile);
-  while (directory !== root) {
-    try {
-      if (fs.existsSync(path.join(directory, ".git")))
-        return true;
-    } catch {
-      return false;
-    }
-    const parent = path.dirname(directory);
-    if (parent === directory)
-      return false;
-    directory = parent;
-  }
-  return false;
-}
-export async function classifyAndFilterFindings(findings, cwd) {
-  if (findings.length === 0)
-    return findings;
-  const [trackedIds, untrackedIgnoredIds] = await Promise.all([
-    collectTrackedFiles(cwd),
-    collectUntrackedIgnoredIds(cwd)
-  ]);
-  const classified = [];
-  for (const finding of findings) {
-    if (isUnderSecretsLaneScratchTree(finding.file)) {
-      classified.push({ ...finding, pathStatus: "scratch" });
-      continue;
-    }
-    const absPath = path.isAbsolute(finding.file) ? finding.file : path.resolve(cwd, finding.file);
-    if (isInsideNestedGitRepository(absPath, cwd)) {
-      classified.push({ ...finding, pathStatus: "nested-repository" });
-      continue;
-    }
-    let pathStatus;
-    if (trackedIds?.has(normalizeEphemeralMapKey(absPath))) {
-      pathStatus = "tracked";
-    } else if (untrackedIgnoredIds?.has(normalizeMapKey(absPath))) {
-      pathStatus = "ignored";
-    } else if (trackedIds !== undefined || untrackedIgnoredIds !== undefined) {
-      pathStatus = "untracked";
-    }
-    classified.push(pathStatus ? { ...finding, pathStatus } : finding);
-  }
-  return classified;
-}
-export function parseGitleaksReport(raw) {
-  if (!raw.trim())
-    return [];
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return [];
-  }
-  if (!Array.isArray(parsed))
-    return [];
-  const findings = [];
-  for (const entry of parsed) {
-    if (!entry || typeof entry !== "object")
-      continue;
-    const e = entry;
-    const ruleId = typeof e.RuleID === "string" ? e.RuleID : undefined;
-    const file = typeof e.File === "string" ? e.File : undefined;
-    const startLine = typeof e.StartLine === "number" ? e.StartLine : Number.parseInt(String(e.StartLine ?? ""), 10);
-    if (!ruleId || !file || !Number.isFinite(startLine))
-      continue;
-    findings.push({
-      ruleId,
-      description: typeof e.Description === "string" ? e.Description : undefined,
-      file,
-      startLine,
-      endLine: typeof e.EndLine === "number" ? e.EndLine : Number.isFinite(Number(e.EndLine)) ? Number(e.EndLine) : undefined,
-      match: typeof e.Match === "string" ? e.Match : undefined,
-      secret: typeof e.Secret === "string" ? e.Secret : undefined,
-      tags: Array.isArray(e.Tags) ? e.Tags.filter((t) => typeof t === "string") : undefined,
-      commit: typeof e.Commit === "string" ? e.Commit : undefined,
-      author: typeof e.Author === "string" ? e.Author : undefined,
-      date: typeof e.Date === "string" ? e.Date : undefined
-    });
-  }
-  return findings;
-}

package/extensions/dm-lens/dist/clients/go-client.js

@@ -1,47 +0,0 @@
-import { createSubsystemLogger } from "./extension-log.js";
-import * as path from "node:path";
-import { createToolchainAvailability } from "./dispatch/runners/utils/toolchain-availability.js";
-const GO_WINDOWS_PATHS = [
-  "C:\\Program Files\\Go\\bin\\go.exe",
-  "C:\\Go\\bin\\go.exe",
-  "go.exe"
-];
-const PROBE_TIMEOUT_MS = 3000;
-const GO_UNIX_PATHS = [
-  "/usr/local/go/bin/go",
-  "/usr/bin/go",
-  "go"
-];
-
-export class GoClient {
-  availability;
-  log;
-  constructor(verbose = false) {
-    this.log = verbose ? createSubsystemLogger("go") : () => {};
-    this.availability = createToolchainAvailability({
-      tool: "go",
-      label: "Go",
-      windowsPaths: GO_WINDOWS_PATHS,
-      unixPaths: GO_UNIX_PATHS,
-      probeArgs: ["version"],
-      budgetMs: PROBE_TIMEOUT_MS,
-      log: (msg) => this.log(msg)
-    });
-  }
-  async findGoPathAsync() {
-    return this.availability.findPath();
-  }
-  async isGoAvailableAsync() {
-    return this.availability.isAvailable();
-  }
-  isGoFile(filePath) {
-    return path.extname(filePath).toLowerCase() === ".go";
-  }
-  resetAvailability() {
-    this.availability.reset();
-  }
-}
-export const goClient = new GoClient;
-export function resetGoAvailability() {
-  goClient.resetAvailability();
-}