@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-lens/dist/clients/govulncheck-client.js

@@ -1,411 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { safeSpawnAsync } from "./safe-spawn.js";
-import { probeToolAsync } from "./tool-probe.js";
-import { firstOutputLine, spawnFailedWithNoOutput } from "./dispatch/runners/utils/spawn-outcome.js";
-import { assertInstallAllowed } from "./project-trust.js";
-import { SecurityScanClient } from "./security-scan-client.js";
-import { classifyProbeFailure, describeProbeEvidence, INSTALL_TRANSIENT_MAX_ATTEMPTS, logAvailabilityDecision, startHostStallSampler } from "./dispatch/runners/utils/availability-policy.js";
-import { recordDegradationOnce } from "./degradation-ledger.js";
-const EMPTY_RESULT = {
-  success: false,
-  findings: []
-};
-const SCAN_TIMEOUT_MS = 120000;
-const INSTALL_TIMEOUT_MS = 60000;
-
-export class GovulncheckClient extends SecurityScanClient {
-  constructor(verbose = false) {
-    super("govulncheck", verbose);
-  }
-  static hasGoModule(cwd) {
-    try {
-      return fs.existsSync(path.join(cwd, "go.mod"));
-    } catch {
-      return false;
-    }
-  }
-  async doEnsureAvailable() {
-    if (await this.probeVersion(["-version"])) {
-      this.available = true;
-      return true;
-    }
-    if (this.probeWasTransient()) {
-      this.log("govulncheck probe timed out; retrying later (not installing)");
-      return false;
-    }
-    if (!assertInstallAllowed("govulncheck go install")) {
-      return false;
-    }
-    const goProbeStartedAt = Date.now();
-    const goSampler = startHostStallSampler();
-    let goOnPath;
-    let goHostStallMs;
-    try {
-      goOnPath = await probeToolAsync("go", ["version"], {
-        timeout: 5000
-      });
-    } finally {
-      goHostStallMs = goSampler.stop();
-    }
-    if (goOnPath.error || goOnPath.status !== 0) {
-      const { outcome, cause } = classifyProbeFailure(goOnPath, {
-        hostStallMs: goHostStallMs
-      });
-      if (outcome === "transient") {
-        this.log("`go version` probe timed out; retrying govulncheck later");
-        const retryAfterMs = this.markTransientlyUnavailable(cause);
-        logAvailabilityDecision({
-          tool: "govulncheck",
-          verdict: "unavailable",
-          outcome,
-          cause,
-          elapsedMs: Date.now() - goProbeStartedAt,
-          latched: false,
-          hostStallMs: goHostStallMs,
-          ...retryAfterMs > 0 && { retryAfterMs },
-          budgetMs: 5000,
-          classifiedBy: "probe"
-        });
-        return false;
-      }
-      this.log("go binary not on PATH — cannot auto-install govulncheck");
-      this.noteDurableAbsence({
-        ...describeProbeEvidence(goOnPath, "go"),
-        install: "not-attempted"
-      });
-      return false;
-    }
-    this.log("govulncheck not found, attempting auto-install via go install");
-    const installStartedAt = Date.now();
-    const installSampler = startHostStallSampler();
-    let install;
-    let installHostStallMs;
-    try {
-      install = await safeSpawnAsync("go", ["install", "golang.org/x/vuln/cmd/govulncheck@latest"], { timeout: INSTALL_TIMEOUT_MS });
-    } finally {
-      installHostStallMs = installSampler.stop();
-    }
-    if (install.error || install.status !== 0) {
-      this.log(`govulncheck auto-install failed: ${(install.stderr ?? "").slice(0, 200)}`);
-      const { outcome, cause } = classifyProbeFailure(install, {
-        hostStallMs: installHostStallMs
-      });
-      if (outcome === "transient") {
-        const retryAfterMs = this.markTransientlyUnavailable(cause, {
-          operationClass: "install"
-        });
-        const exhausted = retryAfterMs === 0;
-        const ceilingReason = `go install timed out ${INSTALL_TRANSIENT_MAX_ATTEMPTS} times; install retries disabled until the next session`;
-        if (exhausted) {
-          recordDegradationOnce({
-            kind: "install-retry-exhausted",
-            subject: "govulncheck",
-            reason: ceilingReason
-          });
-        }
-        logAvailabilityDecision({
-          tool: "govulncheck",
-          verdict: "unavailable",
-          outcome,
-          cause: exhausted ? this.latchedCause() ?? cause : cause,
-          elapsedMs: Date.now() - installStartedAt,
-          latched: exhausted,
-          hostStallMs: installHostStallMs,
-          ...retryAfterMs > 0 && { retryAfterMs },
-          budgetMs: INSTALL_TIMEOUT_MS,
-          classifiedBy: exhausted ? "caller" : "probe",
-          ...exhausted && {
-            evidence: {
-              ...describeProbeEvidence(install, "go install"),
-              install: "failed",
-              installReason: ceilingReason
-            }
-          }
-        });
-        return false;
-      }
-      this.noteDurableAbsence({
-        ...describeProbeEvidence(install, "go install"),
-        install: "failed"
-      }, { elapsedMs: Date.now() - installStartedAt });
-      return false;
-    }
-    const reprobeStartedAt = Date.now();
-    const reprobeSampler = startHostStallSampler();
-    let reprobe;
-    let reprobeHostStallMs;
-    try {
-      reprobe = await probeToolAsync("govulncheck", ["-version"], {
-        timeout: 5000
-      });
-    } finally {
-      reprobeHostStallMs = reprobeSampler.stop();
-    }
-    if (!reprobe.error && reprobe.status === 0) {
-      this.log("govulncheck auto-installed and found on PATH");
-      this.available = true;
-      logAvailabilityDecision({
-        tool: "govulncheck",
-        verdict: "available",
-        outcome: "success",
-        cause: "ok",
-        elapsedMs: Date.now() - reprobeStartedAt,
-        latched: true,
-        hostStallMs: reprobeHostStallMs,
-        budgetMs: 5000,
-        classifiedBy: "caller",
-        evidence: {
-          install: "succeeded",
-          binary: "govulncheck",
-          source: "go-install"
-        }
-      });
-      return true;
-    }
-    const homeDir = os.homedir();
-    const isWin = process.platform === "win32";
-    const ext = isWin ? ".exe" : "";
-    const candidates = [
-      process.env.GOBIN,
-      process.env.GOPATH ? path.join(process.env.GOPATH, "bin") : undefined,
-      path.join(homeDir, "go", "bin")
-    ].filter((d) => Boolean(d)).map((d) => path.join(d, `govulncheck${ext}`));
-    for (const candidate of candidates) {
-      try {
-        if (fs.existsSync(candidate)) {
-          this.binaryPath = candidate;
-          this.available = true;
-          this.log(`govulncheck auto-installed at ${candidate}`);
-          logAvailabilityDecision({
-            tool: "govulncheck",
-            verdict: "available",
-            outcome: "success",
-            cause: "ok",
-            elapsedMs: Date.now() - installStartedAt,
-            latched: true,
-            classifiedBy: "caller",
-            evidence: {
-              install: "succeeded",
-              binary: path.basename(candidate),
-              source: "go-install"
-            }
-          });
-          return true;
-        }
-      } catch {}
-    }
-    const { outcome, cause } = classifyProbeFailure(reprobe, {
-      hostStallMs: reprobeHostStallMs
-    });
-    if (outcome === "transient") {
-      this.log("govulncheck installed but the re-probe timed out; retrying later");
-      const retryAfterMs = this.markTransientlyUnavailable(cause);
-      logAvailabilityDecision({
-        tool: "govulncheck",
-        verdict: "unavailable",
-        outcome,
-        cause,
-        elapsedMs: Date.now() - reprobeStartedAt,
-        latched: false,
-        hostStallMs: reprobeHostStallMs,
-        ...retryAfterMs > 0 && { retryAfterMs },
-        budgetMs: 5000,
-        classifiedBy: "probe"
-      });
-      return false;
-    }
-    this.log("govulncheck auto-install succeeded but binary not locatable — check $GOBIN / $GOPATH");
-    this.noteDurableAbsence({
-      ...describeProbeEvidence(reprobe, "govulncheck"),
-      install: "succeeded",
-      installReason: "installed binary not found on PATH, $GOBIN or $GOPATH/bin"
-    }, { elapsedMs: Date.now() - reprobeStartedAt });
-    return false;
-  }
-  async analyze(cwd) {
-    const targetDir = path.resolve(cwd);
-    if (!GovulncheckClient.hasGoModule(targetDir)) {
-      return {
-        ...EMPTY_RESULT,
-        success: true,
-        scannedAt: new Date().toISOString(),
-        summary: "No go.mod found at analysis root; govulncheck skipped"
-      };
-    }
-    if (!await this.ensureAvailable()) {
-      return {
-        ...EMPTY_RESULT,
-        scannedAt: new Date().toISOString(),
-        summary: "govulncheck not installed"
-      };
-    }
-    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
-  }
-  async runScan(cwd) {
-    const scannedAt = new Date().toISOString();
-    const bin = this.binaryPath ?? "govulncheck";
-    try {
-      const result = await safeSpawnAsync(bin, ["-mode=source", "-format=json", "./..."], { cwd, timeout: SCAN_TIMEOUT_MS });
-      if (result.error) {
-        this.log(`Scan error: ${result.error.message}`);
-        return {
-          ...EMPTY_RESULT,
-          scannedAt,
-          summary: result.error.message.slice(0, 200)
-        };
-      }
-      const rawStdout = result.stdout ?? "";
-      if (result.status !== 0 && result.status !== 3) {
-        return {
-          ...EMPTY_RESULT,
-          scannedAt,
-          summary: firstOutputLine(result.stderr) || "scan failed"
-        };
-      }
-      if (!rawStdout.trim()) {
-        if (spawnFailedWithNoOutput(result, rawStdout)) {
-          this.log(`Scan failed: ${(result.stderr ?? "").slice(0, 200)}`);
-          return {
-            ...EMPTY_RESULT,
-            scannedAt,
-            summary: firstOutputLine(result.stderr) || "scan failed"
-          };
-        }
-        return {
-          ...EMPTY_RESULT,
-          success: true,
-          scannedAt,
-          summary: "govulncheck produced no output; nothing parsed"
-        };
-      }
-      const findings = parseGovulncheckJson(rawStdout);
-      return {
-        success: true,
-        analyzed: true,
-        findings,
-        scannedAt
-      };
-    } catch (err) {
-      this.log(`Scan error: ${err instanceof Error ? err.message : err}`);
-      return {
-        ...EMPTY_RESULT,
-        scannedAt,
-        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
-      };
-    }
-  }
-}
-export function parseGovulncheckJson(stream) {
-  if (!stream.trim())
-    return [];
-  const records = splitJsonStream(stream);
-  const osvMeta = new Map;
-  const findings = [];
-  for (const record of records) {
-    const asOsv = record;
-    if (asOsv.osv && typeof asOsv.osv.id === "string") {
-      const affected = asOsv.osv.affected?.[0];
-      const packageName = affected?.package?.name;
-      const fixedVersion = affected?.ranges?.flatMap((r) => r.events ?? []).find((e) => typeof e.fixed === "string")?.fixed;
-      osvMeta.set(asOsv.osv.id, {
-        module: packageName,
-        fixedVersion,
-        summary: asOsv.osv.summary ?? asOsv.osv.details,
-        url: asOsv.osv.database_specific?.url ?? affected?.database_specific?.url
-      });
-    }
-  }
-  for (const record of records) {
-    const asFinding = record;
-    const f = asFinding.finding;
-    if (!f || typeof f.osv !== "string")
-      continue;
-    const trace = (f.trace ?? []).map((t) => ({
-      module: t.module,
-      packageName: t.package,
-      functionName: t.function,
-      filename: t.position?.filename,
-      line: t.position?.line
-    }));
-    const meta = osvMeta.get(f.osv);
-    findings.push({
-      osv: f.osv,
-      module: meta?.module,
-      packageName: trace.find((t) => t.packageName)?.packageName,
-      fixedVersion: f.fixed_version ?? meta?.fixedVersion,
-      summary: meta?.summary,
-      url: meta?.url,
-      trace
-    });
-  }
-  const seen = new Set;
-  const deduped = [];
-  for (const f of findings) {
-    if (seen.has(f.osv))
-      continue;
-    seen.add(f.osv);
-    deduped.push(f);
-  }
-  return deduped;
-}
-function splitJsonStream(stream) {
-  const records = [];
-  for (const rawLine of stream.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line)
-      continue;
-    try {
-      records.push(JSON.parse(line));
-      continue;
-    } catch {}
-    for (const obj of extractBalancedObjects(line)) {
-      records.push(obj);
-    }
-  }
-  return records;
-}
-function extractBalancedObjects(input) {
-  const found = [];
-  let depth = 0;
-  let start = -1;
-  let inString = false;
-  let escape = false;
-  for (let i = 0;i < input.length; i++) {
-    const ch = input[i];
-    if (escape) {
-      escape = false;
-      continue;
-    }
-    if (inString) {
-      if (ch === "\\")
-        escape = true;
-      else if (ch === '"')
-        inString = false;
-      continue;
-    }
-    if (ch === '"') {
-      inString = true;
-      continue;
-    }
-    if (ch === "{") {
-      if (depth === 0)
-        start = i;
-      depth++;
-    } else if (ch === "}") {
-      depth--;
-      if (depth === 0 && start !== -1) {
-        const slice = input.slice(start, i + 1);
-        try {
-          found.push(JSON.parse(slice));
-        } catch {}
-        start = -1;
-      } else if (depth < 0) {
-        depth = 0;
-        start = -1;
-      }
-    }
-  }
-  return found;
-}

package/extensions/dm-lens/dist/clients/gradle-ktfmt-style.js

@@ -1,177 +0,0 @@
-import * as os from "node:os";
-import * as path from "node:path";
-import { readTextFileOrUndefined } from "./cargo-manifest.js";
-import { incrementDegradationCount } from "./degradation-ledger.js";
-import { logExtension } from "./extension-log.js";
-import { findNearestMarkerRoot } from "./path-utils.js";
-import { gradleBlockRanges, stripGradleCommentsAndStrings } from "./tool-policy.js";
-const KTFMT_GRADLE_ROOT_FILES = [
-  "build.gradle.kts",
-  "build.gradle",
-  "settings.gradle.kts",
-  "settings.gradle"
-];
-const MAX_GRADLE_ANCESTOR_HOPS = 16;
-const MAX_SPOTLESS_KTFMT_CALL_CHARS = 4096;
-const KTFMT_STYLE_CLI_FLAG = {
-  google: "--google-style",
-  kotlinlang: "--kotlinlang-style"
-};
-function styleFromKtfmtBlockBody(body) {
-  let style;
-  let lastIndex = -1;
-  for (const [call, candidate] of [
-    [/\bgoogleStyle\s*\(\s*\)/g, "google"],
-    [/\bkotlinLangStyle\s*\(\s*\)/g, "kotlinlang"]
-  ]) {
-    for (const match of body.matchAll(call)) {
-      if (match.index > lastIndex) {
-        lastIndex = match.index;
-        style = candidate;
-      }
-    }
-  }
-  return style;
-}
-function findBalancedCallEnd(source, openingParen) {
-  let depth = 0;
-  const limit = Math.min(source.length, openingParen + MAX_SPOTLESS_KTFMT_CALL_CHARS);
-  for (let index = openingParen;index < limit; index += 1) {
-    if (source[index] === "(")
-      depth += 1;
-    if (source[index] !== ")")
-      continue;
-    depth -= 1;
-    if (depth === 0)
-      return index + 1;
-  }
-  return;
-}
-function styleFromSpotlessKotlinBody(body) {
-  let style;
-  for (const call of body.matchAll(/\bktfmt\s*(?=\()/g)) {
-    const callOpenParen = call.index + call[0].length;
-    const closeParen = findBalancedCallEnd(body, callOpenParen);
-    if (closeParen === undefined)
-      continue;
-    const chain = /^\s*((?:\.\s*(?:googleStyle|kotlinlangStyle|dropboxStyle)\s*\(\s*\)\s*)+)/.exec(body.slice(closeParen));
-    if (!chain)
-      continue;
-    const chainBody = chain[1];
-    if (!chainBody)
-      continue;
-    for (const method of chainBody.matchAll(/\.\s*(googleStyle|kotlinlangStyle|dropboxStyle)\s*\(\s*\)/g)) {
-      if (method[1] === "googleStyle")
-        style = "google";
-      if (method[1] === "kotlinlangStyle")
-        style = "kotlinlang";
-      if (method[1] === "dropboxStyle")
-        style = "spotless-dropbox-unsupported";
-    }
-  }
-  return style;
-}
-const SCOPE_BY_ENCLOSING_BLOCK = {
-  subprojects: "descendants",
-  allprojects: "both"
-};
-function scopeOfGradleStyleBlock(range, ranges) {
-  const enclosing = ranges.filter((outer) => outer.start < range.start && outer.end >= range.end);
-  if (enclosing.length === 0)
-    return "own";
-  if (enclosing.length > 1)
-    return;
-  return SCOPE_BY_ENCLOSING_BLOCK[enclosing[0].name];
-}
-function styleSelectionForGradleBlock(block, source, allBlockRanges, nonSpotlessRanges) {
-  if (block.name === "ktfmt") {
-    const scope = scopeOfGradleStyleBlock(block, allBlockRanges);
-    if (!scope)
-      return;
-    const style = styleFromKtfmtBlockBody(source.slice(block.start, block.end));
-    return style ? { scope, style } : undefined;
-  }
-  if (block.name !== "kotlin")
-    return;
-  const enclosingSpotless = [];
-  for (const outer of allBlockRanges) {
-    if (outer.name === "spotless" && outer.start < block.start && outer.end >= block.end) {
-      enclosingSpotless.push(outer);
-    }
-  }
-  if (enclosingSpotless.length !== 1)
-    return;
-  const scope = scopeOfGradleStyleBlock(block, nonSpotlessRanges);
-  if (!scope)
-    return;
-  const style = styleFromSpotlessKotlinBody(source.slice(block.start, block.end));
-  return style ? { scope, style } : undefined;
-}
-function stylesFromGradleContent(content) {
-  const stripped = stripGradleCommentsAndStrings(content);
-  const blocks = gradleBlockRanges(stripped);
-  const scopeRanges = [];
-  for (const range of blocks) {
-    if (range.name !== "spotless")
-      scopeRanges.push(range);
-  }
-  const styles = {};
-  for (const range of blocks) {
-    const selection = styleSelectionForGradleBlock(range, stripped, blocks, scopeRanges);
-    if (!selection)
-      continue;
-    if (selection.scope !== "descendants")
-      styles.own = selection.style;
-    if (selection.scope !== "own")
-      styles.descendants = selection.style;
-  }
-  return styles;
-}
-async function stylesForGradleDir(gradleDir) {
-  for (const gradleFile of KTFMT_GRADLE_ROOT_FILES) {
-    const content = await readTextFileOrUndefined(path.join(gradleDir, gradleFile));
-    if (content === undefined)
-      continue;
-    const styles = stylesFromGradleContent(content);
-    if (styles.own || styles.descendants)
-      return styles;
-  }
-  return {};
-}
-export async function resolveKtfmtGradleStyle(filePath, homeDir = os.homedir()) {
-  let searchDir = path.dirname(path.resolve(filePath));
-  for (let hop = 0;hop < MAX_GRADLE_ANCESTOR_HOPS; hop += 1) {
-    const gradleDir = findNearestMarkerRoot(searchDir, KTFMT_GRADLE_ROOT_FILES, {
-      homeDir
-    });
-    if (!gradleDir)
-      return;
-    const styles = await stylesForGradleDir(gradleDir);
-    const style = hop === 0 ? styles.own : styles.descendants;
-    if (style === "spotless-dropbox-unsupported") {
-      const reason = "Spotless ktfmt dropboxStyle(): dm-lens standalone CLI cannot express " + "the style; falling back to bare ktfmt";
-      const firstOccurrence = incrementDegradationCount({
-        kind: "formatter-skip",
-        subject: "ktfmt:spotless-dropbox",
-        reason,
-        metadata: { filePath, gradleDir }
-      });
-      if (firstOccurrence) {
-        logExtension({
-          subsystem: "format",
-          level: "debug",
-          message: reason,
-          metadata: { filePath, gradleDir }
-        });
-      }
-      return;
-    }
-    if (style)
-      return KTFMT_STYLE_CLI_FLAG[style];
-    const parent = path.dirname(gradleDir);
-    if (parent === gradleDir)
-      return;
-    searchDir = parent;
-  }
-  return;
-}