@herbertgao/pi-extensions 2026.10.0 → 2026.10.2

package/node_modules/pi-lens/dist/chunk-NXPS2L6U.js

@@ -0,0 +1,466 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  SecurityScanClient
+} from "./chunk-7F72PXY2.js";
+import {
+  firstOutputLine,
+  spawnFailedWithNoOutput
+} from "./chunk-I7SPGOWI.js";
+import {
+  assertInstallAllowed
+} from "./chunk-NTUJEGDZ.js";
+import {
+  probeToolAsync
+} from "./chunk-EOKRQ3SA.js";
+import {
+  INSTALL_TRANSIENT_MAX_ATTEMPTS,
+  classifyProbeFailure,
+  describeProbeEvidence,
+  logAvailabilityDecision,
+  startHostStallSampler
+} from "./chunk-WONERJTP.js";
+import {
+  safeSpawnAsync
+} from "./chunk-VN2AXLEX.js";
+import {
+  recordDegradationOnce
+} from "./chunk-N3YQJI6O.js";
+
+// dist/clients/govulncheck-client.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+var EMPTY_RESULT = {
+  success: false,
+  findings: []
+};
+var SCAN_TIMEOUT_MS = 12e4;
+var INSTALL_TIMEOUT_MS = 6e4;
+var GovulncheckClient = class _GovulncheckClient extends SecurityScanClient {
+  constructor(verbose = false) {
+    super("govulncheck", verbose);
+  }
+  /**
+   * Detect whether the project root is a Go module. Cheap filesystem check.
+   */
+  static hasGoModule(cwd) {
+    try {
+      return fs.existsSync(path.join(cwd, "go.mod"));
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Resolve `govulncheck`: PATH probe, then auto-install via `go install`
+   * (not the GitHub-release installer the other security clients use — the
+   * toolchain is present by definition when there's a go.mod).
+   */
+  async doEnsureAvailable() {
+    if (await this.probeVersion(["-version"])) {
+      this.available = true;
+      return true;
+    }
+    if (this.probeWasTransient()) {
+      this.log("govulncheck probe timed out; retrying later (not installing)");
+      return false;
+    }
+    if (!assertInstallAllowed("govulncheck go install")) {
+      return false;
+    }
+    const goProbeStartedAt = Date.now();
+    const goSampler = startHostStallSampler();
+    let goOnPath;
+    let goHostStallMs;
+    try {
+      goOnPath = await probeToolAsync("go", ["version"], {
+        timeout: 5e3
+      });
+    } finally {
+      goHostStallMs = goSampler.stop();
+    }
+    if (goOnPath.error || goOnPath.status !== 0) {
+      const { outcome: outcome2, cause: cause2 } = classifyProbeFailure(goOnPath, {
+        hostStallMs: goHostStallMs
+      });
+      if (outcome2 === "transient") {
+        this.log("`go version` probe timed out; retrying govulncheck later");
+        const retryAfterMs = this.markTransientlyUnavailable(cause2);
+        logAvailabilityDecision({
+          tool: "govulncheck",
+          verdict: "unavailable",
+          outcome: outcome2,
+          cause: cause2,
+          elapsedMs: Date.now() - goProbeStartedAt,
+          latched: false,
+          hostStallMs: goHostStallMs,
+          ...retryAfterMs > 0 && { retryAfterMs },
+          budgetMs: 5e3,
+          classifiedBy: "probe"
+        });
+        return false;
+      }
+      this.log("go binary not on PATH \u2014 cannot auto-install govulncheck");
+      this.noteDurableAbsence({
+        ...describeProbeEvidence(goOnPath, "go"),
+        install: "not-attempted"
+      });
+      return false;
+    }
+    this.log("govulncheck not found, attempting auto-install via go install");
+    const installStartedAt = Date.now();
+    const installSampler = startHostStallSampler();
+    let install;
+    let installHostStallMs;
+    try {
+      install = await safeSpawnAsync("go", ["install", "golang.org/x/vuln/cmd/govulncheck@latest"], { timeout: INSTALL_TIMEOUT_MS });
+    } finally {
+      installHostStallMs = installSampler.stop();
+    }
+    if (install.error || install.status !== 0) {
+      this.log(`govulncheck auto-install failed: ${(install.stderr ?? "").slice(0, 200)}`);
+      const { outcome: outcome2, cause: cause2 } = classifyProbeFailure(install, {
+        hostStallMs: installHostStallMs
+      });
+      if (outcome2 === "transient") {
+        const retryAfterMs = this.markTransientlyUnavailable(cause2, {
+          operationClass: "install"
+        });
+        const exhausted = retryAfterMs === 0;
+        const ceilingReason = `go install timed out ${INSTALL_TRANSIENT_MAX_ATTEMPTS} times; install retries disabled until the next session`;
+        if (exhausted) {
+          recordDegradationOnce({
+            kind: "install-retry-exhausted",
+            subject: "govulncheck",
+            reason: ceilingReason
+          });
+        }
+        logAvailabilityDecision({
+          tool: "govulncheck",
+          verdict: "unavailable",
+          outcome: outcome2,
+          // At the ceiling the latch rewrote the cause; a row still saying
+          // `probe-timeout` would read as "cooling down" (#1497 review F5).
+          cause: exhausted ? this.latchedCause() ?? cause2 : cause2,
+          elapsedMs: Date.now() - installStartedAt,
+          latched: exhausted,
+          hostStallMs: installHostStallMs,
+          ...retryAfterMs > 0 && { retryAfterMs },
+          budgetMs: INSTALL_TIMEOUT_MS,
+          // The ceiling verdict is an ASSERTION by this call site, not a
+          // classification of one spawn, and #1534's convention is that such a
+          // row says so and carries the install facts behind it. Every retry
+          // DID run a `go install` that failed, so `install: "failed"` is
+          // earned, and the reason names the ceiling rather than the spawn.
+          // Below the ceiling, outcome/cause are fresh off `classifyProbeFailure`
+          // above, so that row is still `"probe"` (#2209).
+          classifiedBy: exhausted ? "caller" : "probe",
+          ...exhausted && {
+            evidence: {
+              ...describeProbeEvidence(install, "go install"),
+              install: "failed",
+              installReason: ceilingReason
+            }
+          }
+        });
+        return false;
+      }
+      this.noteDurableAbsence({
+        ...describeProbeEvidence(install, "go install"),
+        install: "failed"
+      }, { elapsedMs: Date.now() - installStartedAt });
+      return false;
+    }
+    const reprobeStartedAt = Date.now();
+    const reprobeSampler = startHostStallSampler();
+    let reprobe;
+    let reprobeHostStallMs;
+    try {
+      reprobe = await probeToolAsync("govulncheck", ["-version"], {
+        timeout: 5e3
+      });
+    } finally {
+      reprobeHostStallMs = reprobeSampler.stop();
+    }
+    if (!reprobe.error && reprobe.status === 0) {
+      this.log("govulncheck auto-installed and found on PATH");
+      this.available = true;
+      logAvailabilityDecision({
+        tool: "govulncheck",
+        verdict: "available",
+        outcome: "success",
+        cause: "ok",
+        elapsedMs: Date.now() - reprobeStartedAt,
+        latched: true,
+        hostStallMs: reprobeHostStallMs,
+        budgetMs: 5e3,
+        classifiedBy: "caller",
+        evidence: {
+          install: "succeeded",
+          binary: "govulncheck",
+          source: "go-install"
+        }
+      });
+      return true;
+    }
+    const homeDir = os.homedir();
+    const isWin = process.platform === "win32";
+    const ext = isWin ? ".exe" : "";
+    const candidates = [
+      process.env.GOBIN,
+      process.env.GOPATH ? path.join(process.env.GOPATH, "bin") : void 0,
+      path.join(homeDir, "go", "bin")
+    ].filter((d) => Boolean(d)).map((d) => path.join(d, `govulncheck${ext}`));
+    for (const candidate of candidates) {
+      try {
+        if (fs.existsSync(candidate)) {
+          this.binaryPath = candidate;
+          this.available = true;
+          this.log(`govulncheck auto-installed at ${candidate}`);
+          logAvailabilityDecision({
+            tool: "govulncheck",
+            verdict: "available",
+            outcome: "success",
+            cause: "ok",
+            elapsedMs: Date.now() - installStartedAt,
+            latched: true,
+            classifiedBy: "caller",
+            evidence: {
+              install: "succeeded",
+              binary: path.basename(candidate),
+              source: "go-install"
+            }
+          });
+          return true;
+        }
+      } catch {
+      }
+    }
+    const { outcome, cause } = classifyProbeFailure(reprobe, {
+      hostStallMs: reprobeHostStallMs
+    });
+    if (outcome === "transient") {
+      this.log("govulncheck installed but the re-probe timed out; retrying later");
+      const retryAfterMs = this.markTransientlyUnavailable(cause);
+      logAvailabilityDecision({
+        tool: "govulncheck",
+        verdict: "unavailable",
+        outcome,
+        cause,
+        // The re-probe's own wall time. A hard-coded 0 here was the #1474
+        // defect verbatim: a duration field that measures nothing.
+        elapsedMs: Date.now() - reprobeStartedAt,
+        latched: false,
+        hostStallMs: reprobeHostStallMs,
+        ...retryAfterMs > 0 && { retryAfterMs },
+        budgetMs: 5e3,
+        classifiedBy: "probe"
+      });
+      return false;
+    }
+    this.log("govulncheck auto-install succeeded but binary not locatable \u2014 check $GOBIN / $GOPATH");
+    this.noteDurableAbsence({
+      ...describeProbeEvidence(reprobe, "govulncheck"),
+      install: "succeeded",
+      installReason: "installed binary not found on PATH, $GOBIN or $GOPATH/bin"
+    }, { elapsedMs: Date.now() - reprobeStartedAt });
+    return false;
+  }
+  /**
+   * Scan a Go module for reachable CVEs.
+   *
+   * Re-entrancy safe: concurrent calls against the same root share a single
+   * govulncheck process. Mirrors the in-flight dedupe pattern used by
+   * KnipClient / JscpdClient.
+   */
+  async analyze(cwd) {
+    const targetDir = path.resolve(cwd);
+    if (!_GovulncheckClient.hasGoModule(targetDir)) {
+      return {
+        ...EMPTY_RESULT,
+        success: true,
+        scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: "No go.mod found at analysis root; govulncheck skipped"
+      };
+    }
+    if (!await this.ensureAvailable()) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: "govulncheck not installed"
+      };
+    }
+    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
+  }
+  async runScan(cwd) {
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const bin = this.binaryPath ?? "govulncheck";
+    try {
+      const result = await safeSpawnAsync(bin, ["-mode=source", "-format=json", "./..."], { cwd, timeout: SCAN_TIMEOUT_MS });
+      if (result.error) {
+        this.log(`Scan error: ${result.error.message}`);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          summary: result.error.message.slice(0, 200)
+        };
+      }
+      const rawStdout = result.stdout ?? "";
+      if (result.status !== 0 && result.status !== 3) {
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          summary: firstOutputLine(result.stderr) || "scan failed"
+        };
+      }
+      if (!rawStdout.trim()) {
+        if (spawnFailedWithNoOutput(result, rawStdout)) {
+          this.log(`Scan failed: ${(result.stderr ?? "").slice(0, 200)}`);
+          return {
+            ...EMPTY_RESULT,
+            scannedAt,
+            summary: firstOutputLine(result.stderr) || "scan failed"
+          };
+        }
+        return {
+          ...EMPTY_RESULT,
+          success: true,
+          scannedAt,
+          summary: "govulncheck produced no output; nothing parsed"
+        };
+      }
+      const findings = parseGovulncheckJson(rawStdout);
+      return {
+        success: true,
+        analyzed: true,
+        findings,
+        scannedAt
+      };
+    } catch (err) {
+      this.log(`Scan error: ${err instanceof Error ? err.message : err}`);
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
+      };
+    }
+  }
+};
+function parseGovulncheckJson(stream) {
+  if (!stream.trim())
+    return [];
+  const records = splitJsonStream(stream);
+  const osvMeta = /* @__PURE__ */ new Map();
+  const findings = [];
+  for (const record of records) {
+    const asOsv = record;
+    if (asOsv.osv && typeof asOsv.osv.id === "string") {
+      const affected = asOsv.osv.affected?.[0];
+      const packageName = affected?.package?.name;
+      const fixedVersion = affected?.ranges?.flatMap((r) => r.events ?? []).find((e) => typeof e.fixed === "string")?.fixed;
+      osvMeta.set(asOsv.osv.id, {
+        module: packageName,
+        fixedVersion,
+        summary: asOsv.osv.summary ?? asOsv.osv.details,
+        url: asOsv.osv.database_specific?.url ?? affected?.database_specific?.url
+      });
+    }
+  }
+  for (const record of records) {
+    const asFinding = record;
+    const f = asFinding.finding;
+    if (!f || typeof f.osv !== "string")
+      continue;
+    const trace = (f.trace ?? []).map((t) => ({
+      module: t.module,
+      packageName: t.package,
+      functionName: t.function,
+      filename: t.position?.filename,
+      line: t.position?.line
+    }));
+    const meta = osvMeta.get(f.osv);
+    findings.push({
+      osv: f.osv,
+      module: meta?.module,
+      packageName: trace.find((t) => t.packageName)?.packageName,
+      fixedVersion: f.fixed_version ?? meta?.fixedVersion,
+      summary: meta?.summary,
+      url: meta?.url,
+      trace
+    });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const f of findings) {
+    if (seen.has(f.osv))
+      continue;
+    seen.add(f.osv);
+    deduped.push(f);
+  }
+  return deduped;
+}
+function splitJsonStream(stream) {
+  const records = [];
+  for (const rawLine of stream.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line)
+      continue;
+    try {
+      records.push(JSON.parse(line));
+      continue;
+    } catch {
+    }
+    for (const obj of extractBalancedObjects(line)) {
+      records.push(obj);
+    }
+  }
+  return records;
+}
+function extractBalancedObjects(input) {
+  const found = [];
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let escape = false;
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i];
+    if (escape) {
+      escape = false;
+      continue;
+    }
+    if (inString) {
+      if (ch === "\\")
+        escape = true;
+      else if (ch === '"')
+        inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      continue;
+    }
+    if (ch === "{") {
+      if (depth === 0)
+        start = i;
+      depth++;
+    } else if (ch === "}") {
+      depth--;
+      if (depth === 0 && start !== -1) {
+        const slice = input.slice(start, i + 1);
+        try {
+          found.push(JSON.parse(slice));
+        } catch {
+        }
+        start = -1;
+      } else if (depth < 0) {
+        depth = 0;
+        start = -1;
+      }
+    }
+  }
+  return found;
+}
+
+export {
+  GovulncheckClient,
+  parseGovulncheckJson
+};

package/node_modules/pi-lens/dist/chunk-O5WILGMI.js

@@ -0,0 +1,42 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  CODE_KINDS,
+  DOTNET_CSHARP_ROOT_MARKERS,
+  DOTNET_FSHARP_ROOT_MARKERS,
+  KIND_EXTENSIONS,
+  NON_CODE_KINDS,
+  SPECIAL_FILENAMES,
+  TERRAGRUNT_FILENAMES,
+  detectFileKind,
+  getFileKindLabel,
+  getFileKindsForExtension,
+  getLanguageId,
+  isCodeKindFile,
+  isFileKind,
+  isHelmYamlTemplatePath,
+  isJstsFactFile,
+  isReadableSourceFile
+} from "./chunk-5ZEJHV35.js";
+import "./chunk-VNMT7C64.js";
+import "./chunk-5THXD6X5.js";
+import "./chunk-UK3CMEAL.js";
+import "./chunk-Q5U6FMDI.js";
+import "./chunk-NXL4FFQQ.js";
+export {
+  CODE_KINDS,
+  DOTNET_CSHARP_ROOT_MARKERS,
+  DOTNET_FSHARP_ROOT_MARKERS,
+  KIND_EXTENSIONS,
+  NON_CODE_KINDS,
+  SPECIAL_FILENAMES,
+  TERRAGRUNT_FILENAMES,
+  detectFileKind,
+  getFileKindLabel,
+  getFileKindsForExtension,
+  getLanguageId,
+  isCodeKindFile,
+  isFileKind,
+  isHelmYamlTemplatePath,
+  isJstsFactFile,
+  isReadableSourceFile
+};

package/node_modules/pi-lens/dist/chunk-O6TQT6RI.js

@@ -0,0 +1,48 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  createNdjsonLogger,
+  getGlobalPiLensLogDir,
+  getMaxLogSizeMB,
+  getTurnId,
+  isTestMode
+} from "./chunk-UK3CMEAL.js";
+
+// dist/clients/extension-log.js
+import * as path from "node:path";
+var EXTENSION_LOG_FILE = path.join(getGlobalPiLensLogDir(), "extension.log");
+var writer = createNdjsonLogger({
+  filePath: EXTENSION_LOG_FILE,
+  maxBytes: getMaxLogSizeMB() * 1024 * 1024
+});
+function logExtension(entry) {
+  if (isTestMode())
+    return;
+  writer.log({
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    pid: process.pid,
+    turnId: getTurnId(),
+    level: entry.level ?? "error",
+    subsystem: entry.subsystem,
+    message: entry.message,
+    ...entry.metadata ? { metadata: entry.metadata } : {}
+  });
+}
+function createSubsystemLogger(subsystem, defaultLevel = "debug") {
+  const at = (level) => (message, metadata) => {
+    logExtension({ subsystem, message, level, metadata });
+  };
+  const logger = at(defaultLevel);
+  logger.error = at("error");
+  logger.warn = at("warn");
+  logger.debug = at("debug");
+  return logger;
+}
+function flushExtensionLog() {
+  return writer.flush();
+}
+
+export {
+  logExtension,
+  createSubsystemLogger,
+  flushExtensionLog
+};