@minionry/minion 0.7.36

package/dist/server/services/websocket/quality-dependencies.js

@@ -0,0 +1,445 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { computeFingerprint, dependencyParts, normalizeFindingPath } from './quality-fingerprint.js';
+import { runCommand } from './quality-tools.js';
+import { ANALYZER_FINDING_BOUND } from './quality-types.js';
+export const DEPENDENCIES_CATEGORY = 'dependencies';
+export const NPM_AUDIT_ARGS = ['audit', '--json', '--package-lock-only'];
+export const NPM_LOCKFILES = ['package-lock.json', 'npm-shrinkwrap.json'];
+export const OTHER_NODE_LOCKFILES = ['yarn.lock', 'pnpm-lock.yaml', 'bun.lock', 'bun.lockb'];
+export const PIP_AUDIT_INSTALL_COMMAND = 'pip install pip-audit';
+export const PIP_AUDIT_REQUIREMENTS_FILE = 'requirements.txt';
+export const PIP_AUDIT_PROJECT_FILE = 'pyproject.toml';
+const PIP_AUDIT_COMMON_ARGS = ['-f', 'json', '--progress-spinner', 'off'];
+export const PIP_AUDIT_REQUIREMENTS_ARGS = [...PIP_AUDIT_COMMON_ARGS, '-r', PIP_AUDIT_REQUIREMENTS_FILE];
+export const PIP_AUDIT_PROJECT_ARGS = [...PIP_AUDIT_COMMON_ARGS, '.'];
+export const CARGO_AUDIT_INSTALL_COMMAND = 'cargo install cargo-audit';
+export const CARGO_LOCKFILE = 'Cargo.lock';
+export const CARGO_AUDIT_ARGS = ['audit', '--json'];
+export const AUDIT_TIMEOUT_MS = 300_000;
+export const DESCRIPTION_MAX_CHARS = 400;
+function notRun(reason) {
+    return { score: 0, available: false, issueCount: 0, findings: [], reason };
+}
+const NPM_SEVERITY_TABLE = { critical: 'critical', high: 'high', moderate: 'medium', low: 'low', info: 'low' };
+export function npmSeverity(raw) {
+    const word = typeof raw === 'string' ? raw.toLowerCase() : '';
+    const severity = NPM_SEVERITY_TABLE[word];
+    if (severity)
+        return { severity, note: `npm audit severity "${word}" → ${severity}` };
+    return {
+        severity: 'medium',
+        note: word ? `npm audit severity "${word}" is not in the severity table → medium` : 'npm audit reports no severity for this advisory → medium',
+    };
+}
+export const PIP_AUDIT_SEVERITY = { severity: 'medium', note: 'pip-audit reports no advisory severity → medium' };
+export function cvssRating(score) {
+    if (score >= 9)
+        return 'critical';
+    if (score >= 7)
+        return 'high';
+    if (score >= 4)
+        return 'medium';
+    return 'low';
+}
+const CVSS_AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+const CVSS_AC = { L: 0.77, H: 0.44 };
+const CVSS_UI = { N: 0.85, R: 0.62 };
+const CVSS_CIA = { H: 0.56, L: 0.22, N: 0 };
+const CVSS_PR_UNCHANGED = { N: 0.85, L: 0.62, H: 0.27 };
+const CVSS_PR_CHANGED = { N: 0.85, L: 0.68, H: 0.5 };
+function cvssRoundup(value) {
+    const scaled = Math.round(value * 100_000);
+    if (scaled % 10_000 === 0)
+        return scaled / 100_000;
+    return (Math.floor(scaled / 10_000) + 1) / 10;
+}
+function cvssMetrics(vector) {
+    const [prefix, ...parts] = vector.trim().split('/');
+    if (!/^CVSS:3\.[01]$/.test(prefix))
+        return null;
+    const metrics = new Map();
+    for (const part of parts) {
+        const [key, value] = part.split(':');
+        if (key && value && !metrics.has(key))
+            metrics.set(key, value);
+    }
+    return metrics;
+}
+function cvssBaseMetrics(metrics) {
+    const scope = metrics.get('S');
+    if (scope !== 'U' && scope !== 'C')
+        return null;
+    const changed = scope === 'C';
+    const values = [
+        CVSS_AV[metrics.get('AV') ?? ''],
+        CVSS_AC[metrics.get('AC') ?? ''],
+        (changed ? CVSS_PR_CHANGED : CVSS_PR_UNCHANGED)[metrics.get('PR') ?? ''],
+        CVSS_UI[metrics.get('UI') ?? ''],
+        CVSS_CIA[metrics.get('C') ?? ''],
+        CVSS_CIA[metrics.get('I') ?? ''],
+        CVSS_CIA[metrics.get('A') ?? ''],
+    ];
+    if (values.some((v) => v === undefined))
+        return null;
+    const [av, ac, pr, ui, c, i, a] = values;
+    return { changed, av, ac, pr, ui, c, i, a };
+}
+export function cvssBaseScore(vector) {
+    const metrics = cvssMetrics(vector);
+    const base = metrics && cvssBaseMetrics(metrics);
+    if (!base)
+        return null;
+    const { changed, av, ac, pr, ui, c, i, a } = base;
+    const iss = 1 - (1 - c) * (1 - i) * (1 - a);
+    const impact = changed ? 7.52 * (iss - 0.029) - 3.25 * (iss - 0.02) ** 15 : 6.42 * iss;
+    const exploitability = 8.22 * av * ac * pr * ui;
+    if (impact <= 0)
+        return 0;
+    return cvssRoundup(Math.min(changed ? 1.08 * (impact + exploitability) : impact + exploitability, 10));
+}
+export function cargoVulnerabilitySeverity(cvss) {
+    if (cvss === null)
+        return { severity: 'medium', note: 'the advisory carries no CVSS vector → medium' };
+    const score = cvssBaseScore(cvss);
+    if (score === null)
+        return { severity: 'medium', note: `the advisory's CVSS vector "${cvss}" is not a v3 base vector and could not be scored → medium` };
+    const severity = cvssRating(score);
+    return { severity, note: `CVSS base score ${score.toFixed(1)} for ${cvss} → ${severity}` };
+}
+export function cargoWarningSeverity(kind) {
+    return { severity: 'low', note: `cargo audit "${kind}" warning → low` };
+}
+const GHSA_ID = /GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}/i;
+function advisoryTitle(title, advisoryId, packageName, affected) {
+    return title ? `${title} (${advisoryId})` : `${advisoryId} in ${packageName}${affected ? ` ${affected}` : ''}`;
+}
+function asRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : null;
+}
+function asString(value) {
+    return typeof value === 'string' ? value : '';
+}
+function asStringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function npmFix(fixAvailable) {
+    const fix = asRecord(fixAvailable);
+    if (fix) {
+        const major = fix.isSemVerMajor === true ? ' (a semver-major change)' : '';
+        return `Upgrade ${asString(fix.name)} to ${asString(fix.version)}${major}.`;
+    }
+    return fixAvailable === true ? 'A fix is available — `npm audit fix`.' : 'No fix is available yet — check the advisory for mitigations.';
+}
+function npmAdvisoryId(via, url) {
+    const ghsa = GHSA_ID.exec(url)?.[0];
+    if (ghsa)
+        return ghsa;
+    return via.source === undefined ? url : String(via.source);
+}
+function npmAdvisory(pkg, via) {
+    const url = asString(via.url);
+    const advisoryId = npmAdvisoryId(via, url);
+    if (!advisoryId && !via.title)
+        return null;
+    const name = asString(via.name) || asString(pkg.name);
+    const affected = asString(via.range) || asString(pkg.range);
+    return {
+        packageName: name,
+        affected,
+        advisoryId,
+        title: advisoryTitle(asString(via.title), advisoryId, name, affected),
+        description: '',
+        aliases: [],
+        severity: npmSeverity(via.severity ?? pkg.severity),
+        fix: npmFix(pkg.fixAvailable),
+        ...(url ? { url } : {}),
+    };
+}
+function npmPackageAdvisories(pkg) {
+    const advisories = [];
+    for (const entry of Array.isArray(pkg.via) ? pkg.via : []) {
+        const via = asRecord(entry);
+        const advisory = via && npmAdvisory(pkg, via);
+        if (advisory)
+            advisories.push(advisory);
+    }
+    return advisories;
+}
+export function parseNpmAuditReport(text) {
+    const raw = asRecord(parseJson(text));
+    if (!raw)
+        return null;
+    const vulnerabilities = asRecord(raw.vulnerabilities);
+    if (vulnerabilities) {
+        const advisories = [];
+        for (const [name, value] of Object.entries(vulnerabilities)) {
+            const pkg = asRecord(value);
+            if (pkg)
+                advisories.push(...npmPackageAdvisories({ name, ...pkg }));
+        }
+        return { advisories };
+    }
+    const error = asRecord(raw.error);
+    if (error || typeof raw.message === 'string') {
+        return { error: asString(error?.summary) || asString(raw.message) || asString(error?.code) || 'npm audit reported an error without a message' };
+    }
+    return null;
+}
+export function parsePipAuditReport(text) {
+    const raw = asRecord(parseJson(text));
+    if (!raw || !Array.isArray(raw.dependencies))
+        return null;
+    const advisories = [];
+    for (const entry of raw.dependencies) {
+        const dep = asRecord(entry);
+        if (!dep || !Array.isArray(dep.vulns))
+            continue;
+        const packageName = asString(dep.name);
+        const version = asString(dep.version);
+        for (const value of dep.vulns) {
+            const vuln = asRecord(value);
+            if (!vuln || typeof vuln.id !== 'string')
+                continue;
+            const fixVersions = asStringList(vuln.fix_versions);
+            advisories.push({
+                packageName,
+                affected: version,
+                advisoryId: vuln.id,
+                title: advisoryTitle('', vuln.id, packageName, version),
+                description: asString(vuln.description),
+                aliases: asStringList(vuln.aliases),
+                severity: PIP_AUDIT_SEVERITY,
+                fix: fixVersions.length > 0 ? `Upgrade ${packageName} to ${fixVersions.join(' or ')}.` : 'No fixed version is published yet — check the advisory for mitigations.',
+            });
+        }
+    }
+    return advisories;
+}
+function cargoVersions(versions) {
+    const patched = asStringList(asRecord(versions)?.patched);
+    return patched.length > 0 ? `Upgrade to a patched version: ${patched.join(', ')}.` : 'No patched version is listed — check the advisory for mitigations.';
+}
+function cargoVulnerability(value) {
+    const entry = asRecord(value);
+    const advisory = asRecord(entry?.advisory);
+    const pkg = asRecord(entry?.package);
+    if (!entry || !advisory || typeof advisory.id !== 'string')
+        return null;
+    const url = asString(advisory.url);
+    const packageName = asString(pkg?.name) || asString(advisory.package);
+    const version = asString(pkg?.version);
+    return {
+        packageName,
+        affected: version,
+        advisoryId: advisory.id,
+        title: advisoryTitle(asString(advisory.title), advisory.id, packageName, version),
+        description: asString(advisory.description),
+        aliases: asStringList(advisory.aliases),
+        severity: cargoVulnerabilitySeverity(typeof advisory.cvss === 'string' ? advisory.cvss : null),
+        fix: cargoVersions(entry.versions),
+        ...(url ? { url } : {}),
+    };
+}
+function cargoWarning(kind, value) {
+    const entry = asRecord(value);
+    const pkg = asRecord(entry?.package);
+    if (!entry || !pkg || typeof pkg.name !== 'string')
+        return null;
+    const advisory = asRecord(entry.advisory);
+    const url = asString(advisory?.url);
+    const version = asString(pkg.version);
+    const fix = kind === 'yanked'
+        ? 'The published version was yanked from crates.io — update to a version that is still published.'
+        : 'Replace the crate or pin a maintained alternative — see the advisory.';
+    return {
+        packageName: pkg.name,
+        affected: version,
+        advisoryId: asString(advisory?.id) || kind,
+        title: advisory ? advisoryTitle(asString(advisory.title), asString(advisory.id) || kind, pkg.name, version) : `${pkg.name}${version ? ` ${version}` : ''} is ${kind}`,
+        description: asString(advisory?.description),
+        aliases: asStringList(advisory?.aliases),
+        severity: cargoWarningSeverity(kind),
+        fix,
+        ...(url ? { url } : {}),
+    };
+}
+export function parseCargoAuditReport(text) {
+    const raw = asRecord(parseJson(text));
+    const vulnerabilities = asRecord(raw?.vulnerabilities);
+    if (!raw || !vulnerabilities || !Array.isArray(vulnerabilities.list))
+        return null;
+    const advisories = vulnerabilities.list.map(cargoVulnerability).filter((a) => a !== null);
+    for (const [kind, list] of Object.entries(asRecord(raw.warnings) ?? {})) {
+        if (!Array.isArray(list))
+            continue;
+        for (const value of list) {
+            const warning = cargoWarning(kind, value);
+            if (warning)
+                advisories.push(warning);
+        }
+    }
+    return advisories;
+}
+export function summarizeAdvisory(text) {
+    const paragraph = text
+        .split(/\n\s*\n/)
+        .map((p) => p.replace(/^\s*#+\s.*$/gm, '').replace(/\s+/g, ' ').trim())
+        .find(Boolean) ?? '';
+    return paragraph.length > DESCRIPTION_MAX_CHARS ? `${paragraph.slice(0, DESCRIPTION_MAX_CHARS - 1)}…` : paragraph;
+}
+function compareStrings(a, b) {
+    if (a === b)
+        return 0;
+    return a < b ? -1 : 1;
+}
+function compareAdvisories(a, b) {
+    return compareStrings(a.packageName, b.packageName) || compareStrings(a.advisoryId, b.advisoryId);
+}
+export function advisoriesToFindings(file, advisories) {
+    const findings = new Map();
+    for (const advisory of [...advisories].sort(compareAdvisories)) {
+        const fingerprint = computeFingerprint(dependencyParts(DEPENDENCIES_CATEGORY, file, advisory.packageName, advisory.advisoryId));
+        if (findings.has(fingerprint))
+            continue;
+        const summary = summarizeAdvisory(advisory.description);
+        const affected = advisory.affected ? ` ${advisory.affected}` : '';
+        const aliases = advisory.aliases.length > 0 ? ` Also known as ${advisory.aliases.join(', ')}.` : '';
+        findings.set(fingerprint, {
+            severity: advisory.severity.severity,
+            category: DEPENDENCIES_CATEGORY,
+            file,
+            line: null,
+            title: advisory.title,
+            description: `${advisory.packageName}${affected} — ${advisory.severity.note}.${summary ? ` ${summary}` : ''}${aliases}${advisory.url ? ` ${advisory.url}` : ''}`,
+            suggestion: advisory.fix,
+            fingerprint,
+        });
+    }
+    return [...findings.values()];
+}
+function skipped(reason) {
+    return { ran: false, findings: [], reason };
+}
+const NOT_ON_PATH = /\bENOENT\b/;
+const NO_CARGO_SUBCOMMAND = /no such command/i;
+function stderrLines(stderr) {
+    return stderr
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
+}
+function firstLine(result) {
+    return stderrLines(result.stderr)[0] ?? stderrLines(result.stdout).pop() ?? '';
+}
+function lastLine(result) {
+    return stderrLines(result.stderr).pop() ?? stderrLines(result.stdout).pop() ?? '';
+}
+function timedOut(tool) {
+    return `${tool} timed out after ${AUDIT_TIMEOUT_MS / 1000} s`;
+}
+function didNotComplete(tool, exitCode, detail) {
+    return `${tool} did not complete (exit ${exitCode})${detail ? `: ${detail}` : ''}`;
+}
+async function auditNode(dirPath) {
+    const lockfile = NPM_LOCKFILES.find((name) => existsSync(join(dirPath, name)));
+    if (!lockfile) {
+        const other = OTHER_NODE_LOCKFILES.find((name) => existsSync(join(dirPath, name)));
+        return skipped(other
+            ? `npm audit needs ${NPM_LOCKFILES.join(' or ')} and this directory has ${other} instead — that package manager's audit is not run`
+            : `npm audit needs a lockfile (${NPM_LOCKFILES.join(' or ')}) and this directory has none — \`npm install --package-lock-only\` creates one`);
+    }
+    const result = await runCommand('npm', [...NPM_AUDIT_ARGS], dirPath, undefined, AUDIT_TIMEOUT_MS);
+    if (result.timedOut)
+        return skipped(timedOut('npm audit'));
+    const report = parseNpmAuditReport(result.stdout);
+    if (report === null) {
+        if (NOT_ON_PATH.test(result.stderr))
+            return skipped('npm is not on PATH — npm audit ships with npm');
+        return skipped(didNotComplete('npm audit', result.exitCode, lastLine(result).replace(/^npm (error|warn) /, '')));
+    }
+    if ('error' in report)
+        return skipped(`npm audit did not complete: ${report.error}`);
+    return { ran: true, findings: advisoriesToFindings(lockfile, report.advisories) };
+}
+async function auditPython(dirPath, installed) {
+    if (installed && !installed.has('pip-audit'))
+        return skipped(`pip-audit is not installed — ${PIP_AUDIT_INSTALL_COMMAND}`);
+    const target = existsSync(join(dirPath, PIP_AUDIT_REQUIREMENTS_FILE))
+        ? { file: PIP_AUDIT_REQUIREMENTS_FILE, args: PIP_AUDIT_REQUIREMENTS_ARGS }
+        : existsSync(join(dirPath, PIP_AUDIT_PROJECT_FILE))
+            ? { file: PIP_AUDIT_PROJECT_FILE, args: PIP_AUDIT_PROJECT_ARGS }
+            : null;
+    if (!target) {
+        return skipped(`pip-audit audits ${PIP_AUDIT_REQUIREMENTS_FILE} or ${PIP_AUDIT_PROJECT_FILE} and this directory has neither (a setup.py alone cannot be audited)`);
+    }
+    const result = await runCommand('pip-audit', [...target.args], dirPath, undefined, AUDIT_TIMEOUT_MS);
+    if (result.timedOut)
+        return skipped(timedOut('pip-audit'));
+    const report = parsePipAuditReport(result.stdout);
+    if (report === null) {
+        if (NOT_ON_PATH.test(result.stderr))
+            return skipped(`pip-audit is not installed — ${PIP_AUDIT_INSTALL_COMMAND}`);
+        return skipped(didNotComplete('pip-audit', result.exitCode, lastLine(result)));
+    }
+    return { ran: true, findings: advisoriesToFindings(target.file, report) };
+}
+async function auditRust(dirPath, installed, cargoRoot) {
+    if (installed && !installed.has('cargo-audit'))
+        return skipped(`cargo-audit is not installed — ${CARGO_AUDIT_INSTALL_COMMAND}`);
+    const lockfilePath = join(cargoRoot, CARGO_LOCKFILE);
+    const file = normalizeFindingPath(lockfilePath, dirPath);
+    if (!existsSync(lockfilePath)) {
+        return skipped(`cargo audit needs ${file} and the workspace has none — \`cargo generate-lockfile\` creates one (cargo audit would otherwise write one into the repository itself)`);
+    }
+    const result = await runCommand('cargo', [...CARGO_AUDIT_ARGS], cargoRoot, undefined, AUDIT_TIMEOUT_MS);
+    if (result.timedOut)
+        return skipped(timedOut('cargo audit'));
+    const report = parseCargoAuditReport(result.stdout);
+    if (report === null) {
+        const detail = firstLine(result);
+        if (NOT_ON_PATH.test(result.stderr))
+            return skipped('cargo is not on PATH');
+        if (NO_CARGO_SUBCOMMAND.test(detail))
+            return skipped(`cargo-audit is not installed — ${CARGO_AUDIT_INSTALL_COMMAND}`);
+        return skipped(didNotComplete('cargo audit', result.exitCode, detail));
+    }
+    return { ran: true, findings: advisoriesToFindings(file, report) };
+}
+export async function analyzeDependencies(dirPath, ecosystems, installed, cargoRoot = dirPath, scoped = false) {
+    if (scoped) {
+        return notRun('a scoped scan audits no dependencies — the audit is project-wide and asks the registry, so it runs on full scans only');
+    }
+    const outcomes = [];
+    if (ecosystems.includes('node'))
+        outcomes.push(await auditNode(dirPath));
+    if (ecosystems.includes('python'))
+        outcomes.push(await auditPython(dirPath, installed));
+    if (ecosystems.includes('rust'))
+        outcomes.push(await auditRust(dirPath, installed, cargoRoot));
+    if (outcomes.length === 0) {
+        return notRun('no package.json, requirements.txt / pyproject.toml or Cargo.toml in this directory — nothing to audit');
+    }
+    const reasons = outcomes.flatMap((o) => (o.reason === undefined ? [] : [o.reason]));
+    const ran = outcomes.filter((o) => o.ran);
+    if (ran.length === 0)
+        return notRun(reasons.join('; '));
+    const findings = ran.flatMap((o) => o.findings);
+    return {
+        score: findings.length === 0 ? 100 : 0,
+        available: true,
+        issueCount: findings.length,
+        findings: findings.slice(0, ANALYZER_FINDING_BOUND),
+        ...(reasons.length === 0 ? {} : { reason: reasons.join('; ') }),
+    };
+}

package/dist/server/services/websocket/quality-duplication.js

@@ -0,0 +1,162 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { collectedContentReader, computeFingerprint, duplicationParts, lineTextOf, normalizeFindingPath } from './quality-fingerprint.js';
+import { runCommand } from './quality-tools.js';
+import { ANALYZER_FINDING_BOUND, FUNCTION_LENGTH_THRESHOLD } from './quality-types.js';
+export const DUPLICATION_CATEGORY = 'duplication';
+export const JSCPD_MIN_LINES = 5;
+export const JSCPD_MIN_TOKENS = 50;
+export const JSCPD_THRESHOLD_SOURCE = 'https://github.com/kucherenko/jscpd';
+export const JSCPD_THRESHOLD_CITATION = `jscpd defaults: min ${JSCPD_MIN_LINES} lines / min ${JSCPD_MIN_TOKENS} tokens (${JSCPD_THRESHOLD_SOURCE})`;
+export const JSCPD_INSTALL_COMMAND = 'npm install -D jscpd';
+export const JSCPD_REPORT_FILE = 'jscpd-report.json';
+export const JSCPD_ARGS = [
+    '--no-install',
+    'jscpd',
+    '--reporters',
+    'json',
+    '--silent',
+    '--absolute',
+    '--min-lines',
+    String(JSCPD_MIN_LINES),
+    '--min-tokens',
+    String(JSCPD_MIN_TOKENS),
+];
+export const JSCPD_TIMEOUT_MS = 300_000;
+export const JSCPD_MAX_FILE_LIST_BYTES = 512 * 1024;
+function notRun(reason) {
+    return { score: 0, available: false, issueCount: 0, findings: [], reason };
+}
+function asLocation(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const raw = value;
+    const startLoc = raw.startLoc;
+    const endLoc = raw.endLoc;
+    const start = typeof raw.start === 'number' ? raw.start : startLoc?.line;
+    const end = typeof raw.end === 'number' ? raw.end : endLoc?.line;
+    if (typeof raw.name !== 'string' || typeof start !== 'number' || typeof end !== 'number')
+        return null;
+    return { name: raw.name, start, end };
+}
+function asDuplicate(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const raw = value;
+    const firstFile = asLocation(raw.firstFile);
+    const secondFile = asLocation(raw.secondFile);
+    if (!firstFile || !secondFile)
+        return null;
+    return {
+        firstFile,
+        secondFile,
+        lines: typeof raw.lines === 'number' ? raw.lines : firstFile.end - firstFile.start + 1,
+        tokens: typeof raw.tokens === 'number' ? raw.tokens : 0,
+        ...(typeof raw.kind === 'string' ? { kind: raw.kind } : {}),
+    };
+}
+export function parseJscpdReport(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return null;
+    const raw = parsed;
+    if (!Array.isArray(raw.duplicates))
+        return null;
+    const total = raw.statistics?.total;
+    return {
+        duplicates: raw.duplicates.map(asDuplicate).filter((d) => d !== null),
+        percentage: typeof total?.percentage === 'number' ? total.percentage : 0,
+    };
+}
+function orderPair(a, b) {
+    if (a.file < b.file)
+        return [a, b];
+    if (a.file > b.file)
+        return [b, a];
+    return a.start <= b.start ? [a, b] : [b, a];
+}
+function cloneSeverity(lines) {
+    if (lines >= FUNCTION_LENGTH_THRESHOLD)
+        return 'high';
+    if (lines >= JSCPD_MIN_LINES * 3)
+        return 'medium';
+    return 'low';
+}
+function describeLocation(loc) {
+    return `${loc.file}:${loc.start}–${loc.end}`;
+}
+export function jscpdReportToFindings(report, dirPath, files) {
+    const contentOf = collectedContentReader(files);
+    const findings = [];
+    for (const clone of report.duplicates) {
+        const toScan = (loc) => ({ file: normalizeFindingPath(loc.name, dirPath), start: loc.start, end: loc.end });
+        const [first, second] = orderPair(toScan(clone.firstFile), toScan(clone.secondFile));
+        const toClone = (loc) => ({ file: loc.file, lineText: lineTextOf(contentOf(loc.file), loc.start) });
+        const nearMiss = clone.kind === 'similar' ? ' (near-miss clone)' : '';
+        findings.push({
+            severity: cloneSeverity(clone.lines),
+            category: DUPLICATION_CATEGORY,
+            file: first.file,
+            line: first.start,
+            title: `Duplicated block (${clone.lines} lines, ${clone.tokens} tokens)`,
+            description: `${describeLocation(first)} duplicates ${describeLocation(second)}${nearMiss}. Threshold: ${JSCPD_THRESHOLD_CITATION}.`,
+            fingerprint: computeFingerprint(duplicationParts(DUPLICATION_CATEGORY, toClone(first), toClone(second))),
+        });
+    }
+    return findings;
+}
+function failureDetail(result) {
+    const stderr = result.stderr.split('\n').map((l) => l.trim()).find(Boolean);
+    if (stderr)
+        return stderr;
+    return result.stdout.split('\n').map((l) => l.trim()).filter(Boolean).pop() ?? '';
+}
+const NPX_MISSING_TOOL = /missing packages|could not determine executable|not found/i;
+export async function analyzeDuplication(dirPath, ecosystems, files, installed, toolOutputDir) {
+    if (!ecosystems.includes('node')) {
+        return notRun('jscpd runs through npx and is rostered for node directories only — this directory has no package.json');
+    }
+    if (installed && !installed.has('jscpd')) {
+        return notRun(`jscpd is not installed — ${JSCPD_INSTALL_COMMAND}`);
+    }
+    if (toolOutputDir === undefined) {
+        return notRun('jscpd needs a report directory under .minionry/quality/ and this scan has none (a scoped or post-session scan never writes the store)');
+    }
+    if (files.length === 0) {
+        return notRun('no source files were collected for jscpd to scan');
+    }
+    const targets = files.map((f) => f.relativePath);
+    const argvBytes = targets.reduce((sum, path) => sum + Buffer.byteLength(path) + 1, 0);
+    if (argvBytes > JSCPD_MAX_FILE_LIST_BYTES) {
+        return notRun(`${targets.length} files (${Math.round(argvBytes / 1024)} KB of arguments) exceed what one jscpd invocation can be handed, and jscpd must see every file at once to find cross-file clones`);
+    }
+    const reportPath = join(toolOutputDir, JSCPD_REPORT_FILE);
+    rmSync(reportPath, { force: true });
+    const result = await runCommand('npx', [...JSCPD_ARGS, '--output', toolOutputDir, ...targets], dirPath, undefined, JSCPD_TIMEOUT_MS);
+    if (!existsSync(reportPath)) {
+        if (result.timedOut)
+            return notRun(`jscpd timed out after ${JSCPD_TIMEOUT_MS / 1000} s`);
+        const detail = failureDetail(result);
+        if (NPX_MISSING_TOOL.test(detail))
+            return notRun(`jscpd is not installed — ${JSCPD_INSTALL_COMMAND}`);
+        return notRun(`jscpd produced no report (exit ${result.exitCode})${detail ? `: ${detail}` : ''}`);
+    }
+    const report = parseJscpdReport(readFileSync(reportPath, 'utf8'));
+    if (!report)
+        return notRun(`jscpd's report at ${reportPath} could not be parsed`);
+    const findings = jscpdReportToFindings(report, dirPath, files);
+    return {
+        score: Math.max(0, Math.min(100, Math.round(100 - report.percentage))),
+        available: true,
+        issueCount: findings.length,
+        findings: findings.slice(0, ANALYZER_FINDING_BOUND),
+    };
+}

package/dist/server/services/websocket/quality-eta.js

@@ -0,0 +1,65 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+const SCAN_PER_FILE_MS = 250;
+const SCAN_PER_KLOC_MS = 800;
+const SCAN_FIXED_MS = 8_000;
+const SCAN_MIN_MS = 5_000;
+const REVIEW_PER_FILE_MS = 1_200;
+const REVIEW_PER_KLOC_MS = 2_500;
+const REVIEW_FIXED_MS = 25_000;
+const REVIEW_MIN_MS = 30_000;
+const MAX_HISTORY_SAMPLES = 5;
+function recentDurations(history, dirPath, field) {
+    const values = [];
+    for (let i = history.length - 1; i >= 0 && values.length < MAX_HISTORY_SAMPLES; i--) {
+        const entry = history[i];
+        if (!entry.directories.some((d) => d.path === dirPath))
+            continue;
+        const v = entry[field];
+        if (typeof v === 'number' && v > 0)
+            values.push(v);
+    }
+    return values;
+}
+function weightedRecentAverage(values) {
+    if (values.length === 0)
+        return null;
+    let weightSum = 0;
+    let valueSum = 0;
+    for (let i = 0; i < values.length; i++) {
+        const w = values.length - i;
+        valueSum += values[i] * w;
+        weightSum += w;
+    }
+    return weightSum > 0 ? valueSum / weightSum : null;
+}
+export function heuristicScanMs({ files, lines }) {
+    const kloc = Math.max(0, lines) / 1_000;
+    const raw = SCAN_FIXED_MS + files * SCAN_PER_FILE_MS + kloc * SCAN_PER_KLOC_MS;
+    return Math.max(SCAN_MIN_MS, Math.round(raw));
+}
+export function heuristicReviewMs({ files, lines }) {
+    const kloc = Math.max(0, lines) / 1_000;
+    const raw = REVIEW_FIXED_MS + files * REVIEW_PER_FILE_MS + kloc * REVIEW_PER_KLOC_MS;
+    return Math.max(REVIEW_MIN_MS, Math.round(raw));
+}
+export function estimateScanMs(size, history, dirPath) {
+    const recent = recentDurations(history, dirPath, 'scanDurationMs');
+    const fromHistory = weightedRecentAverage(recent);
+    if (fromHistory !== null)
+        return Math.max(SCAN_MIN_MS, Math.round(fromHistory));
+    return heuristicScanMs(size);
+}
+export function estimateReviewMs(size, history, dirPath) {
+    const recent = recentDurations(history, dirPath, 'reviewDurationMs');
+    const fromHistory = weightedRecentAverage(recent);
+    if (fromHistory !== null)
+        return Math.max(REVIEW_MIN_MS, Math.round(fromHistory));
+    return heuristicReviewMs(size);
+}
+export async function estimateCodebaseSize(dirPath) {
+    const { collectSourceFiles } = await import('./quality-tools.js');
+    const files = await collectSourceFiles(dirPath, dirPath);
+    const lines = files.reduce((sum, f) => sum + f.lines, 0);
+    return { files: files.length, lines };
+}