@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-lens/dist/clients/oldtext-autopatch.js

@@ -1,100 +0,0 @@
-import { normalizeForGuardMatch } from "./host-edit-normalize.js";
-export function normalizeOldTextForMatch(text) {
-  return normalizeForGuardMatch(text);
-}
-export function findUniqueMatchLineRange(matchNormalizedContent, oldText) {
-  const needle = normalizeOldTextForMatch(oldText);
-  if (!needle)
-    return;
-  const firstIdx = matchNormalizedContent.indexOf(needle);
-  if (firstIdx === -1)
-    return;
-  const secondIdx = matchNormalizedContent.indexOf(needle, firstIdx + needle.length);
-  if (secondIdx !== -1)
-    return;
-  let startLine = 1;
-  for (let i = 0;i < firstIdx; i++) {
-    if (matchNormalizedContent.charCodeAt(i) === 10)
-      startLine++;
-  }
-  let lineCount = 1;
-  for (let i = 0;i < needle.length; i++) {
-    if (needle.charCodeAt(i) === 10)
-      lineCount++;
-  }
-  return { startLine, endLine: startLine + lineCount - 1 };
-}
-function normalizeLf(value) {
-  return value.replace(/\r\n/g, `
-`);
-}
-function countOccurrences(haystack, needle) {
-  if (!needle)
-    return 0;
-  let count = 0;
-  let pos = 0;
-  while (pos < haystack.length) {
-    const idx = haystack.indexOf(needle, pos);
-    if (idx === -1)
-      break;
-    count += 1;
-    pos = idx + needle.length;
-  }
-  return count;
-}
-export function stripTrailingWhitespaceDetailed(value) {
-  const lines = normalizeLf(value).split(`
-`);
-  let removedLineTrailingWhitespace = false;
-  const strippedLines = lines.map((line) => {
-    const stripped = line.trimEnd();
-    if (stripped !== line)
-      removedLineTrailingWhitespace = true;
-    return stripped;
-  });
-  let removedTrailingEmptyLineCount = 0;
-  while (strippedLines.length > 1 && strippedLines[strippedLines.length - 1] === "") {
-    strippedLines.pop();
-    removedTrailingEmptyLineCount += 1;
-  }
-  return {
-    text: strippedLines.join(`
-`),
-    removedLineTrailingWhitespace,
-    removedTrailingEmptyLineCount
-  };
-}
-function stripEquivalentTrailingEmptyLines(value, maxCount) {
-  if (maxCount <= 0)
-    return value;
-  const lines = normalizeLf(value).split(`
-`);
-  let removed = 0;
-  while (removed < maxCount && lines.length > 1) {
-    const last = lines[lines.length - 1];
-    if (last.trim() !== "")
-      break;
-    lines.pop();
-    removed += 1;
-  }
-  return lines.join(`
-`);
-}
-export function computeTrailingWhitespaceOldTextPatch(args) {
-  const fileContentLf = normalizeLf(args.fileContent);
-  const original = normalizeLf(args.oldText);
-  const stripped = stripTrailingWhitespaceDetailed(args.oldText);
-  if (stripped.text === original)
-    return;
-  if (countOccurrences(fileContentLf, original) !== 0)
-    return;
-  if (countOccurrences(fileContentLf, stripped.text) !== 1)
-    return;
-  const patchedNewText = args.newText !== undefined && stripped.removedTrailingEmptyLineCount > 0 ? stripEquivalentTrailingEmptyLines(args.newText, stripped.removedTrailingEmptyLineCount) : args.newText;
-  return {
-    oldText: stripped.text,
-    newText: patchedNewText,
-    removedLineTrailingWhitespace: stripped.removedLineTrailingWhitespace,
-    removedTrailingEmptyLineCount: stripped.removedTrailingEmptyLineCount
-  };
-}

package/extensions/dm-lens/dist/clients/opaque-mutation-scan.js

@@ -1,313 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { collectSourceFilesWithBudgetAsync } from "./source-filter.js";
-import { createHash } from "node:crypto";
-import { normalizeMapKey } from "./path-utils.js";
-import { freshnessFromMtime } from "./freshness.js";
-import { safeSpawnAsync } from "./safe-spawn.js";
-import { truncatedByOutputCap } from "./spawn-output-cap.js";
-const OPAQUE_HASH_BUDGET_BYTES = 8 * 1024 * 1024;
-export const OPAQUE_SCAN_MAX_FILES = 2000;
-const OPAQUE_MTIME_TOLERANCE_MS = 150;
-const MAX_GIT_STATUS_OUTPUT_BYTES = 16 * 1024 * 1024;
-export async function captureFileStatsForPaths(files, options = {}) {
-  const hashBudget = options.hashBudgetBytes ?? OPAQUE_HASH_BUDGET_BYTES;
-  const snapshot = new Map;
-  let hashBytesSpent = 0;
-  let stoppedEarly = false;
-  let first = true;
-  for (const file of files) {
-    if (!first) {
-      if (options.signal?.aborted === true) {
-        stoppedEarly = true;
-        break;
-      }
-      if (options.deadlineMs !== undefined && Date.now() >= options.deadlineMs) {
-        stoppedEarly = true;
-        break;
-      }
-    }
-    first = false;
-    try {
-      const stat = await fs.promises.stat(file);
-      if (!stat.isFile())
-        continue;
-      const entry = {
-        mtimeMs: stat.mtimeMs,
-        size: stat.size
-      };
-      if (options.withHashes && hashBytesSpent + stat.size <= hashBudget) {
-        entry.hash = createHash("sha256").update(await fs.promises.readFile(file)).digest("hex");
-        hashBytesSpent += stat.size;
-      }
-      snapshot.set(normalizeMapKey(path.resolve(file)), entry);
-    } catch {}
-  }
-  return { snapshot, stoppedEarly };
-}
-export async function captureFileStats(root, options = {}) {
-  if (options.forcedUnknownReason !== undefined) {
-    return { unknownReason: options.forcedUnknownReason, scannedCount: 0 };
-  }
-  const budgetMs = options.budgetMs ?? 50;
-  try {
-    const walk = await collectSourceFilesWithBudgetAsync(root, {
-      maxFiles: OPAQUE_SCAN_MAX_FILES + 1,
-      budgetMs
-    });
-    const files = walk.files;
-    if (walk.entryBudgetExceeded || files.length > OPAQUE_SCAN_MAX_FILES) {
-      return {
-        unknownReason: walk.entryBudgetExceeded ? "entry-budget-exceeded" : "file-cap-exceeded",
-        scannedCount: files.length
-      };
-    }
-    const { snapshot } = await captureFileStatsForPaths(files, options);
-    return { snapshot, scannedCount: snapshot.size };
-  } catch {
-    return { unknownReason: "walk-failed", scannedCount: 0 };
-  }
-}
-export function diffFileStats(before, after) {
-  const contentChanged = new Set(diffFileContent(before, after));
-  const changed = [];
-  for (const [key, stat] of after) {
-    const prev = before.get(key);
-    const contentConfirm = contentChanged.has(key);
-    if (!prev || prev.mtimeMs !== stat.mtimeMs || prev.size !== stat.size || contentConfirm) {
-      changed.push(key);
-    }
-  }
-  return changed;
-}
-export function diffFileContent(before, after) {
-  const changed = [];
-  for (const [key, stat] of after) {
-    const previous = before.get(key);
-    if (previous === undefined || previous.hash !== undefined && stat.hash !== undefined && previous.hash !== stat.hash) {
-      changed.push(key);
-    }
-  }
-  return changed;
-}
-
-export class OpaqueBaselineStore {
-  byCwd = new Map;
-  evictions = 0;
-  record(cwdKey, baseline) {
-    if (this.byCwd.has(cwdKey))
-      this.evictions += 1;
-    this.byCwd.set(cwdKey, baseline);
-  }
-  take(cwdKey) {
-    const baseline = this.byCwd.get(cwdKey);
-    this.byCwd.delete(cwdKey);
-    return baseline;
-  }
-  get evictionCount() {
-    return this.evictions;
-  }
-  takeAllForTest() {
-    this.byCwd.clear();
-  }
-}
-const globalStoreSymbol = Symbol.for("dm-lens:opaque-snapshot-store");
-const globalSlot = globalThis;
-export function getOpaqueBaselineStore() {
-  const existing = globalSlot[globalStoreSymbol]?.store;
-  if (existing)
-    return existing;
-  const created = new OpaqueBaselineStore;
-  globalSlot[globalStoreSymbol] = { store: created };
-  return created;
-}
-const gitRepoMemo = new Map;
-export function resetOpaqueMutationState() {
-  getOpaqueBaselineStore().takeAllForTest();
-  gitRepoMemo.clear();
-  gitToplevelMemo.clear();
-}
-export async function isGitWorktree(root) {
-  const key = normalizeMapKey(path.resolve(root));
-  const memo = gitRepoMemo.get(key);
-  if (memo !== undefined)
-    return memo;
-  const result = await safeSpawnAsync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root, timeout: 3000 });
-  const isRepo = !result.error && result.status === 0 && result.stdout?.trim() === "true";
-  gitRepoMemo.set(key, isRepo === true);
-  return isRepo === true;
-}
-const gitToplevelMemo = new Map;
-export async function resolveGitToplevel(root) {
-  const key = normalizeMapKey(path.resolve(root));
-  if (gitToplevelMemo.has(key))
-    return gitToplevelMemo.get(key);
-  const result = await safeSpawnAsync("git", ["rev-parse", "--show-toplevel"], {
-    cwd: root,
-    timeout: 3000
-  });
-  const toplevel = !result.error && result.status === 0 && result.stdout?.trim() ? result.stdout.trim() : undefined;
-  gitToplevelMemo.set(key, toplevel);
-  return toplevel;
-}
-const UNMERGED_PORCELAIN_STATUSES = new Set([
-  "DD",
-  "AU",
-  "UD",
-  "UA",
-  "DU",
-  "AA",
-  "UU"
-]);
-const LEGAL_ORDINARY_PORCELAIN_STATUSES = new Set([
-  " M",
-  " T",
-  " D",
-  " A",
-  " R",
-  " C",
-  "DR",
-  "DC",
-  "M ",
-  "MM",
-  "MT",
-  "MD",
-  "T ",
-  "TM",
-  "TT",
-  "TD",
-  "A ",
-  "AM",
-  "AT",
-  "AD",
-  "D ",
-  "R ",
-  "RM",
-  "RT",
-  "RD",
-  "C ",
-  "CM",
-  "CT",
-  "CD"
-]);
-function isUnmergedStatus(status) {
-  return UNMERGED_PORCELAIN_STATUSES.has(status);
-}
-function isKnownPorcelainStatus(status) {
-  return status === "??" || status === "!!" || isUnmergedStatus(status) || LEGAL_ORDINARY_PORCELAIN_STATUSES.has(status);
-}
-const PORCELAIN_STATUS_CHARS = /^[ MTADRCU?!]{2}$/;
-function isStructurallyValidStatus(status) {
-  return PORCELAIN_STATUS_CHARS.test(status) && status.trim() !== "";
-}
-export async function recoverOpaqueChangesViaGit(root, startedAt, options = {}) {
-  const result = await safeSpawnAsync("git", ["status", "--porcelain", "-z", "--untracked-files=all"], {
-    cwd: root,
-    timeout: 5000,
-    maxOutputBytes: MAX_GIT_STATUS_OUTPUT_BYTES
-  });
-  if (truncatedByOutputCap(result)) {
-    return {
-      verdict: "unknown",
-      paths: [],
-      unknownReason: "git-status-parse-failed",
-      scannedCount: 0
-    };
-  }
-  if (result.error || result.status !== 0 && result.status !== null) {
-    return {
-      verdict: "unknown",
-      paths: [],
-      unknownReason: "git-failed",
-      scannedCount: 0
-    };
-  }
-  const raw = result.stdout ?? "";
-  if (raw && !raw.endsWith("\x00")) {
-    return {
-      verdict: "unknown",
-      paths: [],
-      unknownReason: "git-status-parse-failed",
-      scannedCount: 0
-    };
-  }
-  const entries = [];
-  let unknownStatusCount = 0;
-  let skipNext = false;
-  for (const token of raw.split("\x00")) {
-    if (!token)
-      continue;
-    if (skipNext) {
-      skipNext = false;
-      continue;
-    }
-    if (token.length < 4 || token[2] !== " ") {
-      return {
-        verdict: "unknown",
-        paths: [],
-        unknownReason: "git-status-parse-failed",
-        scannedCount: 0
-      };
-    }
-    const status = token.slice(0, 2);
-    const relPath = token.slice(3);
-    if (!isStructurallyValidStatus(status) || !relPath) {
-      return {
-        verdict: "unknown",
-        paths: [],
-        unknownReason: "git-status-parse-failed",
-        scannedCount: 0
-      };
-    }
-    if (!isKnownPorcelainStatus(status))
-      unknownStatusCount += 1;
-    if (status.includes("R") || status.includes("C"))
-      skipNext = true;
-    entries.push({ status, absPath: path.resolve(root, relPath) });
-  }
-  if (skipNext) {
-    return {
-      verdict: "unknown",
-      paths: [],
-      unknownReason: "git-status-parse-failed",
-      scannedCount: 0
-    };
-  }
-  const hasUnmerged = entries.some((entry) => isUnmergedStatus(entry.status));
-  const floorMs = startedAt - OPAQUE_MTIME_TOLERANCE_MS;
-  async function isInWindow(absPath) {
-    try {
-      const stat = await fs.promises.stat(absPath);
-      return stat.isFile() && freshnessFromMtime({ mtimeMs: stat.mtimeMs, referenceMs: floorMs }).verdict === "stale";
-    } catch {
-      return false;
-    }
-  }
-  let excludedIncomingCount = 0;
-  let candidates = entries;
-  if (options.excludeIndexOnlyWhenUnmerged === true && hasUnmerged) {
-    const kept = [];
-    for (const entry of entries) {
-      const cleanIndexOnly = entry.status[1] === " " && isKnownPorcelainStatus(entry.status);
-      if (!cleanIndexOnly) {
-        kept.push(entry);
-        continue;
-      }
-      if (await isInWindow(entry.absPath))
-        excludedIncomingCount += 1;
-    }
-    candidates = kept;
-  }
-  const paths = [];
-  for (const { absPath } of candidates) {
-    if (await isInWindow(absPath))
-      paths.push(normalizeMapKey(absPath));
-  }
-  return {
-    verdict: "recovered",
-    paths,
-    scannedCount: paths.length,
-    ...excludedIncomingCount > 0 ? { excludedIncomingCount } : {},
-    ...unknownStatusCount > 0 ? { unknownStatusCount } : {}
-  };
-}

package/extensions/dm-lens/dist/clients/opengrep-client.js

@@ -1,216 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { mkdtempSync } from "node:fs";
-import { resolveOpengrepConfig } from "./opengrep-config.js";
-import { recordDegradationOnce } from "./degradation-ledger.js";
-import { getScratchTreeDirNames } from "./scratch-tree-policy.js";
-import { realpathOrResolve } from "./path-utils.js";
-import { safeSpawnAsync } from "./safe-spawn.js";
-import { SecurityScanClient } from "./security-scan-client.js";
-const EMPTY_RESULT = {
-  success: false,
-  findings: []
-};
-const SCAN_TIMEOUT_MS = 180000;
-
-export class OpengrepClient extends SecurityScanClient {
-  constructor(verbose = false) {
-    super("opengrep", verbose);
-  }
-  static resolveConfig(cwd) {
-    return resolveOpengrepConfig(cwd, { enabled: true });
-  }
-  doEnsureAvailable() {
-    return this.ensureViaInstaller(["--version"]);
-  }
-  async scan(cwd) {
-    const targetDir = realpathOrResolve(cwd);
-    const scannedAt = new Date().toISOString();
-    if (!await this.ensureAvailable()) {
-      return {
-        ...EMPTY_RESULT,
-        scannedAt,
-        reason: "not-installed",
-        summary: "opengrep not installed"
-      };
-    }
-    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
-  }
-  async runScan(cwd) {
-    const scannedAt = new Date().toISOString();
-    const bin = this.binaryPath ?? "opengrep";
-    const resolved = OpengrepClient.resolveConfig(cwd);
-    const outDir = mkdtempSync(path.join(os.tmpdir(), "dm-lens-opengrep-"));
-    const reportPath = path.join(outDir, "opengrep-report.json");
-    try {
-      const result = await safeSpawnAsync(bin, [
-        "scan",
-        "--config",
-        resolved.configArg ?? "auto",
-        "--json",
-        "--json-output",
-        reportPath,
-        "--no-error",
-        "--quiet",
-        "--disable-version-check",
-        ...getScratchTreeDirNames().flatMap((name) => ["--exclude", name]),
-        cwd
-      ], { cwd, timeout: SCAN_TIMEOUT_MS });
-      if (result.error) {
-        this.log(`Scan error: ${result.error.message}`);
-        const reason = `${result.failure ?? "spawn-failed"}: ${result.error.message}`;
-        this.recordRefusal(cwd, reason, result.status);
-        return {
-          ...EMPTY_RESULT,
-          scannedAt,
-          reason: "spawn-failed",
-          summary: reason.slice(0, 200)
-        };
-      }
-      if (!fs.existsSync(reportPath)) {
-        const reason = (result.stderr ?? "").trim().split(`
-`)[0] || "no report produced";
-        this.recordRefusal(cwd, reason, result.status);
-        return {
-          ...EMPTY_RESULT,
-          scannedAt,
-          reason: "no-report",
-          summary: reason
-        };
-      }
-      const raw = fs.readFileSync(reportPath, "utf-8");
-      const report = readOpengrepReport(raw);
-      if (report.verdict === "refused" || result.status !== 0) {
-        const reason = report.verdict === "refused" ? report.reason : `opengrep exited with status ${result.status}`;
-        this.recordRefusal(cwd, reason, result.status);
-        return {
-          ...EMPTY_RESULT,
-          scannedAt,
-          reason: "refused",
-          summary: reason.slice(0, 200)
-        };
-      }
-      if (report.partial) {
-        recordDegradationOnce({
-          kind: "opengrep-partial-scan",
-          subject: cwd,
-          reason: report.partial.reason,
-          metadata: { status: result.status }
-        });
-      }
-      return {
-        success: true,
-        analyzed: !report.partial || report.scanned.length > 0,
-        analyzedFiles: report.scanned.map((file) => realpathOrResolve(path.resolve(cwd, file))),
-        ...report.partial ? { partial: true } : {},
-        ...report.partial ? { summary: report.partial.reason } : {},
-        ...report.partial && report.scanned.length === 0 ? { reason: "partial-no-paths" } : {},
-        findings: report.findings,
-        scannedAt
-      };
-    } catch (err) {
-      const reason = err instanceof Error ? err.message : String(err);
-      this.recordRefusal(cwd, reason, undefined);
-      return {
-        ...EMPTY_RESULT,
-        scannedAt,
-        reason: "crashed",
-        summary: reason.slice(0, 200)
-      };
-    } finally {
-      try {
-        fs.rmSync(outDir, { recursive: true, force: true });
-      } catch {}
-    }
-  }
-  recordRefusal(cwd, reason, status) {
-    recordDegradationOnce({
-      kind: "opengrep-scan-refused",
-      subject: cwd,
-      reason,
-      metadata: { status }
-    });
-  }
-}
-function readOpengrepReport(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { verdict: "refused", reason: "unparseable opengrep report" };
-  }
-  if (!parsed || typeof parsed !== "object")
-    return { verdict: "refused", reason: "unparseable opengrep report" };
-  const report = parsed;
-  if (!Array.isArray(report.results) && !Array.isArray(report.errors))
-    return { verdict: "refused", reason: "unparseable opengrep report" };
-  const errors = (Array.isArray(report.errors) ? report.errors : []).map((error) => {
-    if (typeof error === "string")
-      return { message: error };
-    if (!error || typeof error !== "object")
-      return { message: "unrecognised opengrep error entry" };
-    const entry = error;
-    const level = typeof entry.level === "string" ? entry.level : undefined;
-    const message = typeof entry.message === "string" ? entry.message : undefined;
-    return {
-      ...level ? { level } : {},
-      message: message ?? level ?? "unrecognised opengrep error entry"
-    };
-  });
-  const refusal = errors.find((error) => error.level !== "warn");
-  if (refusal)
-    return { verdict: "refused", reason: refusal.message };
-  const scanned = Array.isArray(report.paths?.scanned) ? report.paths.scanned.filter((file) => typeof file === "string") : [];
-  return {
-    verdict: "usable",
-    ...errors[0] ? { partial: { reason: errors[0].message } } : {},
-    findings: parseOpengrepReport(parsed),
-    scanned
-  };
-}
-export function parseOpengrepReport(rawOrParsed) {
-  if (typeof rawOrParsed === "string" && !rawOrParsed.trim())
-    return [];
-  let parsed = rawOrParsed;
-  if (typeof rawOrParsed === "string") {
-    try {
-      parsed = JSON.parse(rawOrParsed);
-    } catch {
-      return [];
-    }
-  }
-  if (!parsed || typeof parsed !== "object")
-    return [];
-  const results = parsed.results;
-  if (!Array.isArray(results))
-    return [];
-  const findings = [];
-  for (const entry of results) {
-    if (!entry || typeof entry !== "object")
-      continue;
-    const e = entry;
-    const checkId = typeof e.check_id === "string" ? e.check_id : undefined;
-    const filePath = typeof e.path === "string" ? e.path : undefined;
-    const start = e.start;
-    const end = e.end;
-    const startLine = typeof start?.line === "number" ? start.line : undefined;
-    if (!checkId || !filePath || !Number.isFinite(startLine))
-      continue;
-    const extra = e.extra ?? {};
-    const metadata = extra.metadata ?? {};
-    const cwe = Array.isArray(metadata.cwe) ? metadata.cwe.filter((c) => typeof c === "string") : undefined;
-    findings.push({
-      checkId,
-      path: filePath,
-      startLine,
-      startCol: typeof start?.col === "number" ? start.col : 1,
-      endLine: typeof end?.line === "number" ? end.line : startLine,
-      endCol: typeof end?.col === "number" ? end.col : 1,
-      message: typeof extra.message === "string" ? extra.message : "opengrep finding",
-      severity: typeof extra.severity === "string" ? extra.severity : "WARNING",
-      cwe
-    });
-  }
-  return findings;
-}

package/extensions/dm-lens/dist/clients/opengrep-config.js

@@ -1,52 +0,0 @@
-import * as path from "node:path";
-import { findLocalToolConfig } from "./path-utils.js";
-const LOCAL_OPENGREP_CONFIG_NAMES = [
-  ".opengrep.yml",
-  ".opengrep.yaml",
-  "opengrep.yml",
-  "opengrep.yaml",
-  ".semgrep.yml",
-  ".semgrep.yaml",
-  "semgrep.yml",
-  "semgrep.yaml"
-];
-export function findLocalOpengrepConfig(startDir) {
-  return findLocalToolConfig(startDir, LOCAL_OPENGREP_CONFIG_NAMES);
-}
-function isRegistryOrAutoConfig(config) {
-  return config === "auto" || config.startsWith("p/") || config.startsWith("r/");
-}
-export function normalizeOpengrepConfigArg(config, cwd) {
-  if (!config)
-    return;
-  const trimmed = config.trim();
-  if (!trimmed)
-    return;
-  if (isRegistryOrAutoConfig(trimmed))
-    return trimmed;
-  return path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
-}
-export function resolveOpengrepConfig(cwd, flags) {
-  const localConfig = findLocalOpengrepConfig(cwd);
-  const flagConfig = typeof flags?.config === "string" && flags.config.trim() ? flags.config.trim() : undefined;
-  if (flags?.enabled || flagConfig) {
-    const explicit = normalizeOpengrepConfigArg(flagConfig ?? localConfig, cwd);
-    return {
-      enabled: true,
-      configArg: explicit ?? "auto",
-      source: explicit && localConfig && !flagConfig ? "local" : "flag"
-    };
-  }
-  if (localConfig) {
-    return {
-      enabled: true,
-      configArg: localConfig,
-      source: "local"
-    };
-  }
-  return {
-    enabled: false,
-    source: "disabled",
-    reason: "no local opengrep config (.opengrep.yml) and --lens-opengrep not set"
-  };
-}