@mnemonik/scanner 5.151.0 → 5.151.2

package/src/discovery.ts

@@ -1,124 +0,0 @@
-import { readFile, readdir, stat } from 'fs/promises';
-import { join, resolve } from 'path';
-
-/** Directories to skip during discovery walk */
-const SKIP_DIRS = new Set([
-  'node_modules',
-  '.git',
-  'dist',
-  'build',
-  '.next',
-  '.nuxt',
-  '.output',
-  '__pycache__',
-  '.venv',
-  'venv',
-  '.tox',
-  'target',
-  '.cache',
-  'coverage',
-  '.turbo',
-  '.vercel',
-  '.svelte-kit',
-]);
-
-export interface DiscoveredProject {
-  projectId: string;
-  path: string;
-  projectName?: string;
-}
-
-export class ProjectDiscovery {
-  private maxDepth: number;
-  private timeoutMs: number;
-
-  constructor(
-    private roots: string[],
-    options?: { maxDepth?: number; timeoutMs?: number }
-  ) {
-    this.maxDepth = options?.maxDepth ?? 3;
-    this.timeoutMs = options?.timeoutMs ?? 30_000;
-  }
-
-  /**
-   * Discover all projects with .mnemonik.json files under the configured roots.
-   * Deduplicates by projectId (same project found at multiple paths = first wins).
-   */
-  async discover(): Promise<DiscoveredProject[]> {
-    const seen = new Map<string, DiscoveredProject>();
-
-    for (const root of this.roots) {
-      const absRoot = resolve(root.replace(/^~/, process.env.HOME || ''));
-      try {
-        await this.walkWithTimeout(absRoot, 0, seen);
-      } catch (err) {
-        if (err instanceof DiscoveryTimeoutError) {
-          console.warn(`[scanner] Discovery timeout for root: ${absRoot} (>${this.timeoutMs}ms)`);
-        } else {
-          console.warn(`[scanner] Error scanning root ${absRoot}:`, (err as Error).message);
-        }
-      }
-    }
-
-    return Array.from(seen.values());
-  }
-
-  private async walkWithTimeout(
-    dir: string,
-    depth: number,
-    seen: Map<string, DiscoveredProject>
-  ): Promise<void> {
-    const deadline = Date.now() + this.timeoutMs;
-    await this.walk(dir, depth, seen, deadline);
-  }
-
-  private async walk(
-    dir: string,
-    depth: number,
-    seen: Map<string, DiscoveredProject>,
-    deadline: number
-  ): Promise<void> {
-    if (depth > this.maxDepth) return;
-    if (Date.now() > deadline) throw new DiscoveryTimeoutError();
-
-    // Check for .mnemonik.json in this directory
-    const configPath = join(dir, '.mnemonik.json');
-    try {
-      const raw = await readFile(configPath, 'utf-8');
-      const parsed = JSON.parse(raw) as Record<string, unknown>;
-      if (typeof parsed.projectId === 'string' && parsed.projectId.length > 0) {
-        if (!seen.has(parsed.projectId)) {
-          seen.set(parsed.projectId, {
-            projectId: parsed.projectId,
-            path: dir,
-            projectName: typeof parsed.projectName === 'string' ? parsed.projectName : undefined,
-          });
-        }
-      }
-      // Don't recurse into subdirectories of a project — the project owns this tree
-      return;
-    } catch {
-      // No .mnemonik.json here, continue walking
-    }
-
-    // Recurse into subdirectories
-    try {
-      const entries = await readdir(dir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        if (SKIP_DIRS.has(entry.name)) continue;
-        if (entry.name.startsWith('.') && entry.name !== '.mnemonik') continue;
-        await this.walk(join(dir, entry.name), depth + 1, seen, deadline);
-      }
-    } catch {
-      // Permission denied or inaccessible directory
-    }
-  }
-}
-
-class DiscoveryTimeoutError extends Error {
-  constructor() {
-    super('Discovery walk timed out');
-    this.name = 'DiscoveryTimeoutError';
-  }
-}

package/src/doctor.ts

@@ -1,239 +0,0 @@
-import { execFileSync } from 'child_process';
-import { existsSync, readFileSync, readdirSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-import { fileURLToPath } from 'url';
-import { pidIsScanner } from './pid.js';
-
-/**
- * `mnemonik-scanner doctor` — the guard that turns the prose upgrade procedure
- * into an executable check. It asserts the invariants that every past botched
- * reinstall violated, and prints the one blessed remediation. Any single ✗
- * exits non-zero so a wrapper (or a human) can react.
- *
- * Invariants:
- *  1. Exactly one `mnemonik-scanner` on PATH, inside the user npm prefix
- *     (a second copy under /usr is the classic PATH-shadow version skew).
- *  2. If a systemd user unit exists, it is active and its ExecStart points at
- *     that same binary.
- *  3. Exactly one live daemon, and under systemd its PID == the unit MainPID
- *     (a stray `node …/scanner/dist/index.js` is a duplicate local-build daemon).
- *  4. No leftover legacy per-project daemons.
- *  5. Installed version is not behind npm latest (warning, not failure).
- */
-
-const HOME = homedir();
-const MNEMONIK_DIR = join(HOME, '.mnemonik');
-const PID_FILE = join(MNEMONIK_DIR, 'daemon.pid');
-const LEGACY_DAEMONS_DIR = join(MNEMONIK_DIR, 'daemons');
-const UNIT_FILE = join(HOME, '.config/systemd/user/mnemonik-scanner.service');
-
-type Level = 'ok' | 'warn' | 'fail';
-interface Check {
-  level: Level;
-  label: string;
-  detail?: string;
-}
-
-function sh(cmd: string, args: string[], timeoutMs = 5000): string | null {
-  try {
-    return execFileSync(cmd, args, {
-      encoding: 'utf-8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: timeoutMs,
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-
-function pidAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-  } catch {
-    return false;
-  }
-  // Existence alone is not identity — after PID reuse the recorded number can
-  // belong to an unrelated process. A live-but-foreign PID is dead to us.
-  return pidIsScanner(pid);
-}
-
-function installedVersion(): string | null {
-  try {
-    const here = fileURLToPath(new URL('.', import.meta.url));
-    const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf-8')) as {
-      version?: string;
-    };
-    return pkg.version ?? null;
-  } catch {
-    return null;
-  }
-}
-
-export async function runDoctor(): Promise<void> {
-  const checks: Check[] = [];
-
-  // 1. Binary uniqueness + location.
-  const prefix = sh('npm', ['config', 'get', 'prefix']);
-  const whichOut = sh('which', ['-a', 'mnemonik-scanner']);
-  const binPaths = whichOut
-    ? whichOut
-        .split('\n')
-        .map((s) => s.trim())
-        .filter(Boolean)
-    : [];
-  if (binPaths.length === 0) {
-    checks.push({
-      level: 'fail',
-      label: 'binary on PATH',
-      detail: 'mnemonik-scanner not found on PATH',
-    });
-  } else if (binPaths.length > 1) {
-    checks.push({
-      level: 'fail',
-      label: 'single binary on PATH',
-      detail: `found ${binPaths.length} copies (PATH shadow → version skew):\n    ${binPaths.join('\n    ')}`,
-    });
-  } else if (prefix && !binPaths[0]!.startsWith(prefix)) {
-    checks.push({
-      level: 'warn',
-      label: 'binary in user npm prefix',
-      detail: `${binPaths[0]} is not under npm prefix ${prefix}`,
-    });
-  } else {
-    checks.push({ level: 'ok', label: 'single binary on PATH', detail: binPaths[0] });
-  }
-  const binPath = binPaths.length === 1 ? binPaths[0]! : null;
-
-  // 2. systemd unit health + ExecStart match.
-  let unitMainPid: number | null = null;
-  const hasUnit = existsSync(UNIT_FILE);
-  if (hasUnit) {
-    const show = sh('systemctl', [
-      '--user',
-      'show',
-      'mnemonik-scanner',
-      '-p',
-      'ActiveState',
-      '-p',
-      'MainPID',
-      '-p',
-      'ExecStart',
-    ]);
-    const active = /ActiveState=active/.test(show ?? '');
-    const mainPidMatch = /MainPID=(\d+)/.exec(show ?? '');
-    unitMainPid = mainPidMatch ? parseInt(mainPidMatch[1]!, 10) : null;
-    const execMatch = /path=([^\s;]+)/.exec(show ?? '');
-    const execPath = execMatch ? execMatch[1]! : null;
-
-    if (!active) {
-      checks.push({ level: 'fail', label: 'systemd unit active', detail: 'unit is not active' });
-    } else if (binPath && execPath && execPath !== binPath) {
-      checks.push({
-        level: 'fail',
-        label: 'ExecStart matches binary',
-        detail: `unit runs ${execPath} but PATH resolves ${binPath}`,
-      });
-    } else {
-      checks.push({
-        level: 'ok',
-        label: 'systemd unit active',
-        detail: `MainPID ${unitMainPid ?? '?'}`,
-      });
-    }
-  } else {
-    checks.push({
-      level: 'warn',
-      label: 'systemd unit',
-      detail: 'no user unit — daemon must be supervised another way',
-    });
-  }
-
-  // 3. Single live daemon; under systemd it must equal MainPID.
-  let filePid: number | null = null;
-  try {
-    filePid = parseInt(readFileSync(PID_FILE, 'utf-8').trim(), 10);
-    if (Number.isNaN(filePid)) filePid = null;
-  } catch {
-    filePid = null;
-  }
-  const psOut = sh('ps', ['-eo', 'pid,cmd']);
-  const daemonPids = (psOut ?? '')
-    .split('\n')
-    // Only the long-running `start` daemon counts — never a `doctor`/`status`/
-    // `log`/`stop` invocation (which also runs …/scanner/dist/index.js), and
-    // never this doctor process itself.
-    .filter((l) => /(mnemonik-scanner|scanner\/dist\/index\.js)/.test(l) && /\bstart\b/.test(l))
-    .map((l) => parseInt(l.trim().split(/\s+/)[0]!, 10))
-    .filter((n) => !Number.isNaN(n) && n !== process.pid);
-  if (daemonPids.length === 0) {
-    checks.push({ level: 'fail', label: 'daemon running', detail: 'no daemon process found' });
-  } else if (daemonPids.length > 1) {
-    checks.push({
-      level: 'fail',
-      label: 'single daemon',
-      detail: `${daemonPids.length} daemon processes (duplicate) — PIDs ${daemonPids.join(', ')}`,
-    });
-  } else if (hasUnit && unitMainPid && daemonPids[0] !== unitMainPid) {
-    checks.push({
-      level: 'fail',
-      label: 'daemon is the systemd one',
-      detail: `running PID ${daemonPids[0]} != unit MainPID ${unitMainPid} (stray local-build daemon)`,
-    });
-  } else if (filePid && !pidAlive(filePid)) {
-    checks.push({
-      level: 'warn',
-      label: 'PID file fresh',
-      detail: `stale ${PID_FILE} (PID ${filePid} dead)`,
-    });
-  } else {
-    checks.push({ level: 'ok', label: 'single daemon', detail: `PID ${daemonPids[0]}` });
-  }
-
-  // 4. Legacy per-project daemons.
-  try {
-    const legacy = readdirSync(LEGACY_DAEMONS_DIR)
-      .filter((f) => f.endsWith('.pid'))
-      .map((f) => parseInt(readFileSync(join(LEGACY_DAEMONS_DIR, f), 'utf-8').trim(), 10))
-      .filter((n) => !Number.isNaN(n) && pidAlive(n));
-    if (legacy.length > 0) {
-      checks.push({
-        level: 'fail',
-        label: 'no legacy daemons',
-        detail: `legacy per-project daemons alive: ${legacy.join(', ')}`,
-      });
-    }
-  } catch {
-    // dir absent — nothing to check
-  }
-
-  // 5. Version vs npm latest (informational).
-  const local = installedVersion();
-  const latest = sh('npm', ['view', '@mnemonik/scanner', 'version'], 15000);
-  if (local && latest && local !== latest) {
-    checks.push({
-      level: 'warn',
-      label: 'up to date',
-      detail: `installed ${local}, npm latest ${latest} — run: make scanner-deploy`,
-    });
-  } else if (local) {
-    checks.push({ level: 'ok', label: 'up to date', detail: `v${local}` });
-  }
-
-  // Report.
-  const icon = { ok: '✓', warn: '⚠', fail: '✗' } as const;
-  console.log('mnemonik-scanner doctor\n');
-  for (const c of checks) {
-    console.log(`  ${icon[c.level]} ${c.label}${c.detail ? `: ${c.detail}` : ''}`);
-  }
-  const failed = checks.filter((c) => c.level === 'fail');
-  if (failed.length > 0) {
-    console.log(
-      `\n${failed.length} problem(s). Canonical fix: \`make scanner-deploy\` (build → publish shared-first → npm i -g → systemctl restart → re-verify).\n` +
-        'Do NOT hand-copy dist/ or run `make daemon-*` on a systemd host — those are what cause this.'
-    );
-    process.exit(1);
-  }
-  console.log('\nAll invariants hold.');
-  process.exit(0);
-}

package/src/fileLog.ts

@@ -1,67 +0,0 @@
-import { appendFileSync, renameSync, statSync } from 'fs';
-
-/**
- * Append-only sink that mirrors the daemon's console output to a file the
- * `mnemonik-scanner log` command can tail. Rotates to `<file>.old` once the
- * file would pass `maxSize`, so a daemon that runs for weeks can't grow it
- * without bound. Every operation is best-effort: a logging failure must never
- * crash the daemon, so all filesystem errors are swallowed.
- */
-export function createRotatingFileSink(logFile: string, maxSize: number): (chunk: string) => void {
-  let size = 0;
-  try {
-    size = statSync(logFile).size;
-  } catch {
-    size = 0;
-  }
-
-  return (chunk: string): void => {
-    if (!chunk) return;
-    try {
-      const bytes = Buffer.byteLength(chunk);
-      if (size > 0 && size + bytes > maxSize) {
-        try {
-          renameSync(logFile, logFile + '.old');
-        } catch {
-          // Rotation failed (e.g. cross-device) — keep appending to the
-          // current file rather than losing the line.
-        }
-        size = 0;
-      }
-      appendFileSync(logFile, chunk);
-      size += bytes;
-    } catch {
-      // Never let logging break the daemon.
-    }
-  };
-}
-
-/**
- * Tee `process.stdout`/`process.stderr` into `logFile` on top of their normal
- * destination. This is what makes `mnemonik-scanner log` reflect live activity
- * regardless of how the daemon is supervised: under systemd stdout is wired to
- * the journal (a socket), under a bare shell to the terminal — either way the
- * file now receives the same lines. Call once at daemon start, before the
- * daemon writes anything worth capturing.
- */
-export function installFileLogging(logFile: string, maxSize: number): void {
-  const sink = createRotatingFileSink(logFile, maxSize);
-
-  for (const stream of [process.stdout, process.stderr]) {
-    const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;
-    stream.write = ((chunk: unknown, encoding?: unknown, cb?: unknown): boolean => {
-      try {
-        if (typeof chunk === 'string') {
-          sink(chunk);
-        } else if (Buffer.isBuffer(chunk)) {
-          const enc = typeof encoding === 'string' ? (encoding as BufferEncoding) : 'utf8';
-          sink(chunk.toString(enc));
-        }
-      } catch {
-        // ignore — mirroring is best-effort
-      }
-      // Preserve the real stream's overloads (chunk, cb) / (chunk, enc, cb).
-      return original(chunk, encoding, cb);
-    }) as typeof stream.write;
-  }
-}

package/src/git.ts

@@ -1,122 +0,0 @@
-/**
- * Git commit extraction on the scanner daemon side.
- *
- * The production server runs in ECS and cannot `git log` the user's repo —
- * the repo lives on the user's machine, next to the daemon. We run `git log`
- * here and push the parsed commits alongside scan results. Server-side
- * `GitMiner.mineCommits` consumes them without touching the filesystem.
- */
-
-import { execFile } from 'child_process';
-import { promisify } from 'util';
-import { access } from 'fs/promises';
-import { join } from 'path';
-
-const execFileAsync = promisify(execFile);
-
-export interface ParsedCommit {
-  sha: string;
-  author: string;
-  date: string;
-  message: string;
-  files: string[];
-}
-
-// Keep in sync with server-side MAX_COMMITS_PER_RUN in GitMiner.ts and the
-// `commits` array cap in scanPushSchema.
-const MAX_COMMITS = 100;
-const GIT_TIMEOUT_MS = 20_000;
-
-/**
- * True when `repoRoot/.git` exists and `git log -1` returns a commit.
- * Non-git projects, `git init` with no commits, and corrupted repos all
- * return false without throwing.
- */
-export async function probeGit(repoRoot: string): Promise<boolean> {
-  try {
-    await access(join(repoRoot, '.git'));
-  } catch {
-    return false;
-  }
-  try {
-    const { stdout } = await execFileAsync('git', ['log', '-1', '--format=%H'], {
-      cwd: repoRoot,
-      encoding: 'utf-8',
-      timeout: GIT_TIMEOUT_MS,
-    });
-    return /^[0-9a-f]{40}/m.test(stdout);
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Fetch commits between `sinceCommit` and HEAD (or the last MAX_COMMITS on
- * first run). Returns [] on failure — caller omits the field from the push.
- *
- * Uses `-z` NUL-separated output so `--name-only` file entries cannot collide
- * with commit metadata. Parser mirrors the server-side token-walking parser
- * in GitMiner.parseLogOutput.
- */
-export async function fetchCommits(
-  repoRoot: string,
-  sinceCommit: string | null
-): Promise<ParsedCommit[]> {
-  const args = [
-    'log',
-    '-z',
-    '--format=%H%n%an%n%aI%n%B',
-    '--name-only',
-    `--max-count=${MAX_COMMITS}`,
-  ];
-  if (sinceCommit) args.push(`${sinceCommit}..HEAD`);
-
-  let raw: string;
-  try {
-    const result = await execFileAsync('git', args, {
-      cwd: repoRoot,
-      encoding: 'utf-8',
-      timeout: GIT_TIMEOUT_MS,
-      maxBuffer: 50 * 1024 * 1024,
-    });
-    raw = result.stdout;
-  } catch (err) {
-    const msg = (err as Error).message;
-    // "fatal: Invalid revision range <sha>..HEAD" — the daemon's cached
-    // last_mined_commit is stale (e.g. history was rewritten or the server
-    // was reseeded). Fall back to a fresh full-history scan.
-    if (sinceCommit && /Invalid (?:revision range|symmetric difference expression)/i.test(msg)) {
-      return fetchCommits(repoRoot, null);
-    }
-    return [];
-  }
-
-  return parseLogOutput(raw);
-}
-
-export function parseLogOutput(raw: string): ParsedCommit[] {
-  const commits: ParsedCommit[] = [];
-  const tokens = raw.split('\0').filter((t) => t.length > 0);
-  let current: ParsedCommit | null = null;
-
-  for (const token of tokens) {
-    if (token.includes('\n')) {
-      if (current) commits.push(current);
-      const lines = token.split('\n');
-      const sha = lines[0]?.trim() ?? '';
-      const author = lines[1]?.trim() ?? '';
-      const date = lines[2]?.trim() ?? '';
-      const message = lines.slice(3).join('\n').trim();
-      if (!sha || !author || !date || !message) {
-        current = null;
-        continue;
-      }
-      current = { sha, author, date, message, files: [] };
-    } else if (current) {
-      const file = token.trim();
-      if (file.length > 0) current.files.push(file);
-    }
-  }
-  if (current) commits.push(current);
-  return commits;
-}