@orkastery/cli 0.5.3 → 0.6.0

package/dist/security-scan/detect.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Stack detection for `ork security-scan` and `ork init` (spec section 7). Looks at the repository root and its
+ * first-level subfolders only, skipping vendored or generated folders.
+ *
+ * Markers: JS/TS by `package.json`; Python by `pyproject.toml`, `requirements*.txt`, `uv.lock`, `poetry.lock` or
+ * `Pipfile.lock`; Go by `go.mod`. One entry per (stack, dir).
+ *
+ * Order of the result is deterministic: the root first, then subfolders in byte order of the name; within a
+ * directory, the order js, python, go.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectStacks = detectStacks;
+exports.hasStackManifest = hasStackManifest;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const IGNORED_DIRS = new Set(['node_modules', '.git', '.orkastery', 'vendor', 'dist']);
+const PYTHON_FILES = new Set(['pyproject.toml', 'uv.lock', 'poetry.lock', 'Pipfile.lock']);
+const STACK_ORDER = ['js', 'python', 'go'];
+function stacksIn(absDir) {
+    let entries;
+    try {
+        entries = fs.readdirSync(absDir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const found = new Set();
+    for (const e of entries) {
+        if (e.isDirectory())
+            continue;
+        if (e.name === 'package.json')
+            found.add('js');
+        else if (e.name === 'go.mod')
+            found.add('go');
+        else if (PYTHON_FILES.has(e.name) || /^requirements.*\.txt$/.test(e.name))
+            found.add('python');
+    }
+    return STACK_ORDER.filter((s) => found.has(s));
+}
+function detectStacks(root) {
+    const result = [];
+    for (const stack of stacksIn(root))
+        result.push({ stack, dir: '.' });
+    let subdirs = [];
+    try {
+        subdirs = fs.readdirSync(root, { withFileTypes: true })
+            .filter((e) => e.isDirectory() && !IGNORED_DIRS.has(e.name))
+            .map((e) => e.name)
+            .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    }
+    catch {
+        return result;
+    }
+    for (const name of subdirs) {
+        for (const stack of stacksIn(path.join(root, name)))
+            result.push({ stack, dir: name });
+    }
+    return result;
+}
+/** Whether `dir` (relative to `root`) holds a manifest of `stack`, by the same marker file names `detectStacks` uses. */
+function hasStackManifest(root, stack, dir) {
+    return stacksIn(path.join(root, dir)).includes(stack);
+}

package/dist/security-scan/executor.js

@@ -0,0 +1,188 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIG_FILES = void 0;
+exports.defaultProbe = defaultProbe;
+exports.chooseExecutor = chooseExecutor;
+exports.nativeVersionOf = nativeVersionOf;
+exports.defaultsDir = defaultsDir;
+exports.expand = expand;
+exports.ensureImage = ensureImage;
+exports.runDocker = runDocker;
+exports.runNative = runNative;
+/**
+ * How one catalog tool runs on this machine (spec section 5.2): its Docker image by digest when Docker answers, else
+ * the native binary when its version matches `native.versionPattern`, else `unavailable` with the reason. The run of
+ * one argv, in a hardened container or natively, is here too; the scan round that calls it is run.ts.
+ */
+const node_child_process_1 = require("node:child_process");
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const guard_1 = require("./guard");
+const PROBE_TIMEOUT_MS = 20000;
+/** The probe of this machine, through the PATH. Each answer is computed once per probe. */
+function defaultProbe() {
+    const memo = new Map();
+    const once = (key, f) => { if (!memo.has(key))
+        memo.set(key, f()); return memo.get(key); };
+    const ok = (cmd, args) => {
+        const r = (0, node_child_process_1.spawnSync)(cmd, args, { stdio: 'ignore', timeout: PROBE_TIMEOUT_MS });
+        return !r.error && r.status === 0;
+    };
+    return {
+        dockerCli: () => once('cli', () => ok('docker', ['--version'])),
+        dockerDaemon: () => once('daemon', () => ok('docker', ['info', '--format', '{{.ServerVersion}}'])),
+        nativeVersion: (bin, args) => once(`native:${bin} ${args.join(' ')}`, () => {
+            const r = (0, node_child_process_1.spawnSync)(bin, args, { encoding: 'utf8', timeout: PROBE_TIMEOUT_MS });
+            return r.error || r.status !== 0 ? null : `${r.stdout ?? ''}${r.stderr ?? ''}`;
+        }),
+    };
+}
+/**
+ * Docker → native → unavailable. Without a usable Docker, the native binary runs when its version matches
+ * `native.versionPattern`; a binary answering another version is `binary-version-mismatch`; otherwise (no native entry,
+ * or the binary absent) the reason is Docker's own, `docker-missing` or `docker-daemon-down`: Docker is the path the
+ * catalog pins. A tool whose wrapper installs pinned packages (`install`) never runs natively: nothing installs on the
+ * host. `binary-missing` stays in the type for the doctor (Task 9) and is not produced here.
+ */
+function chooseExecutor(tool, probe) {
+    const cli = probe.dockerCli();
+    if (cli && probe.dockerDaemon())
+        return { kind: 'docker' };
+    const dockerReason = cli ? 'docker-daemon-down' : 'docker-missing';
+    if (!tool.native || tool.install)
+        return { kind: 'unavailable', reason: dockerReason };
+    const out = probe.nativeVersion(tool.native.bin, tool.native.versionArgs);
+    if (out === null)
+        return { kind: 'unavailable', reason: dockerReason };
+    return new RegExp(tool.native.versionPattern, 'm').test(out) ? { kind: 'native' } : { kind: 'unavailable', reason: 'binary-version-mismatch' };
+}
+/** The version string the native binary reports (the `versionPattern` match). */
+function nativeVersionOf(tool, probe) {
+    const out = tool.native ? probe.nativeVersion(tool.native.bin, tool.native.versionArgs) : null;
+    return (out && tool.native && new RegExp(tool.native.versionPattern, 'm').exec(out)?.[0]) || tool.version;
+}
+/** Embedded tool configs (`{config}`), next to the catalog; dist/security-scan or dist-test/src/security-scan. */
+function defaultsDir() {
+    const dir = [path.join(__dirname, '..', '..', 'assets', 'security-scan', 'defaults'),
+        path.join(__dirname, '..', '..', '..', 'assets', 'security-scan', 'defaults')].find(fs.existsSync);
+    if (!dir)
+        throw Error('security-scan.catalog.unavailable');
+    return dir;
+}
+/** Config file name per tool; the project's `.ork-security/<name>` wins over the embedded default. */
+exports.CONFIG_FILES = { gitleaks: 'gitleaks.toml', eslint: 'eslint.config.mjs', ruff: 'ruff.toml', 'golangci-lint': '.golangci.yml' };
+const CONTAINER = { src: '/src', out: '/out', config: '/config' };
+const MAX_BUFFER = 512 * 1024 * 1024;
+function expand(arg, values) {
+    return arg.replace(/\{(src|out|base|config|install|stackDir)\}/g, (_, k) => values[k]);
+}
+/** {stackDir} as an argument: a directory named `-x` would read as an option, so it goes as `./-x`. */
+const stackDirArg = (dir) => (dir.startsWith('-') ? `./${dir}` : dir);
+/** uid:gid of the container user: the caller's (so the output dir it writes is the caller's), never root. */
+function containerUser() {
+    const uid = process.getuid?.() ?? 65534;
+    return uid === 0 ? '65534:65534' : `${uid}:${process.getgid?.() ?? 65534}`;
+}
+/** Image present locally, else pulled within `timeoutMs`; memoized per image by the caller. */
+function ensureImage(image, timeoutMs) {
+    if (timeoutMs <= 0)
+        return false;
+    const present = (0, node_child_process_1.spawnSync)('docker', ['image', 'inspect', image], { stdio: 'ignore', timeout: Math.min(PROBE_TIMEOUT_MS, timeoutMs) });
+    if (!present.error && present.status === 0)
+        return true;
+    const pull = (0, node_child_process_1.spawnSync)('docker', ['pull', '--quiet', image], { stdio: 'ignore', timeout: timeoutMs, killSignal: 'SIGKILL' });
+    return !pull.error && pull.status === 0;
+}
+/**
+ * Runs one argv in the tool's image: digest, `--rm`, non-root `--user`, repository at /src read-only, the output dir at
+ * /out, embedded or project config read-only, a tmpfs /tmp, `--network none` when catalogued, only the catalog `env`
+ * (nothing of the host environment), and a `--name` so a timed-out container is removed (`docker rm -f`), since killing
+ * the CLI leaves the container running.
+ */
+function runDocker(inv) {
+    const { tool } = inv;
+    const name = `ork-security-scan-${tool.name}-${crypto.randomBytes(6).toString('hex')}`;
+    const configCtr = inv.configHost ? `${CONTAINER.config}/${path.basename(inv.configHost)}` : '';
+    if (process.getuid?.() === 0)
+        fs.chmodSync(inv.outHost, 0o777);
+    const values = { src: CONTAINER.src, out: CONTAINER.out, base: inv.base, config: configCtr, install: (tool.install ?? []).join(' '), stackDir: stackDirArg(inv.stackDir) };
+    const args = ['run', '--rm', '--name', name, '--pull', 'never', '--user', containerUser(),
+        '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
+        ...(tool.network === 'none' ? ['--network', 'none'] : []),
+        '--tmpfs', '/tmp:exec,mode=1777',
+        '-v', `${inv.srcHost}:${CONTAINER.src}:ro`, '-v', `${inv.outHost}:${CONTAINER.out}`,
+        ...(inv.configHost ? ['-v', `${inv.configHost}:${configCtr}:ro`] : []),
+        ...(inv.sameMounts ?? []).flatMap(m => ['-v', `${m}:${m}:ro`]),
+        ...(tool.cacheMounts ?? []).flatMap(m => ['-v', `${m.host}:${m.container}`]),
+        '-w', CONTAINER.src,
+        ...Object.entries(tool.env ?? {}).flatMap(([k, v]) => ['-e', `${k}=${v}`]),
+        '--entrypoint', tool.containerBin ?? inv.argv[0], tool.image,
+        ...inv.argv.slice(1).map(a => expand(a, values))];
+    inv.guard?.add('containers', name);
+    const r = (0, node_child_process_1.spawnSync)('docker', args, { encoding: 'utf8', timeout: inv.timeoutMs, killSignal: 'SIGKILL', maxBuffer: MAX_BUFFER, env: process.env });
+    const timedOut = r.error?.code === 'ETIMEDOUT';
+    if (timedOut || r.error)
+        (0, node_child_process_1.spawnSync)('docker', ['rm', '-f', name], { stdio: 'ignore', timeout: PROBE_TIMEOUT_MS });
+    inv.guard?.remove('containers', name);
+    return { status: r.status, timedOut, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
+}
+/**
+ * Runs one argv with the native binary, in the scanned tree, with the host paths in the placeholders. The host
+ * environment is kept (it is the user's own binary), with the catalog `env` on top except HOME. The tool runs through
+ * the launcher of guard.ts as the leader of its own process group, so the timeout kills the whole group (an `sh`
+ * wrapper's grandchildren included), not only the direct child.
+ */
+function runNative(inv) {
+    const { tool } = inv;
+    const values = { src: inv.srcHost, out: inv.outHost, base: inv.base, config: inv.configHost ?? '', install: '', stackDir: stackDirArg(inv.stackDir) };
+    const env = { ...process.env };
+    for (const [k, v] of Object.entries(tool.env ?? {}))
+        if (k !== 'HOME')
+            env[k] = v;
+    const [bin, ...rest] = inv.argv.map(a => expand(a, values));
+    const pgidFile = inv.guard?.pgidFile() ?? path.join(inv.outHost, '.native.pgid');
+    const marker = `${pgidFile}${guard_1.LAUNCH_TIMEOUT_SUFFIX}`;
+    try {
+        const r = (0, node_child_process_1.spawnSync)(process.execPath, (0, guard_1.launcherArgs)(pgidFile, inv.timeoutMs, bin, rest), { cwd: inv.srcHost, encoding: 'utf8', timeout: inv.timeoutMs + 10000, killSignal: 'SIGKILL', maxBuffer: MAX_BUFFER, env });
+        const timedOut = fs.existsSync(marker) || r.error?.code === 'ETIMEDOUT';
+        return { status: r.status, timedOut, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
+    }
+    finally {
+        fs.rmSync(marker, { force: true });
+        fs.rmSync(pgidFile, { force: true });
+    }
+}

package/dist/security-scan/guard.js

@@ -0,0 +1,180 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LAUNCH_TIMEOUT_SUFFIX = exports.RoundGuard = void 0;
+exports.launcherArgs = launcherArgs;
+/**
+ * Cleanup of a scan round that dies on a signal, and the process-group launcher of native tools.
+ *
+ * Why not SIGTERM/SIGINT handlers in the round: `runScan` is synchronous (spawnSync), and a JS signal handler only runs
+ * on the event loop. Measured on Node 22: with a SIGTERM handler installed, a SIGTERM sent while spawnSync waits is
+ * swallowed (the handler never runs, the process does not exit and the child keeps its full timeout). Without a
+ * handler the process dies at once with 128+signal (the conventional code `ork verify`'s timeout(1) expects), but
+ * skips every `finally`. So the round keeps the default signal behaviour and the cleanup lives in a REAPER: a detached
+ * process (its own session, out of the group timeout(1) signals) started with the round, that watches the round's pid.
+ * The round records in a state file what must not outlive it (worktrees, raw output dirs, the current container, the
+ * group of the current native tool); when the round ends normally it cleans up itself and removes the state, and the
+ * reaper exits; when the round's pid disappears first, the reaper does the cleanup.
+ *
+ * Native tools run through the LAUNCHER mode of this file: the tool starts as the leader of its own process group, and
+ * the launcher kills the whole group on the timeout, on a signal to itself, and when the tool exits (no `sh` wrapper
+ * grandchild survives). It writes the group id next to the reaper state so the reaper can kill it too.
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const STATE = 'state.json';
+const POLL_MS = 200;
+/** Parent side: the state file the reaper reads, kept current by the round. */
+class RoundGuard {
+    dir;
+    state;
+    constructor(mainRoot) {
+        this.dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ork-security-scan-guard-')));
+        this.state = { mainRoot, worktrees: [], outDirs: [], containers: [] };
+        this.save();
+        const reaper = (0, node_child_process_1.spawn)(process.execPath, [__filename, 'reap', this.dir, String(process.pid)], { detached: true, stdio: 'ignore', env: process.env });
+        reaper.unref();
+    }
+    save() {
+        const tmp = path.join(this.dir, `${STATE}.tmp`);
+        fs.writeFileSync(tmp, JSON.stringify(this.state), { mode: 0o600 });
+        fs.renameSync(tmp, path.join(this.dir, STATE));
+    }
+    add(kind, value) { this.state[kind].push(value); this.save(); }
+    remove(kind, value) {
+        this.state[kind] = this.state[kind].filter(v => v !== value);
+        this.save();
+    }
+    /** File where the launcher of a native tool writes its process group id. */
+    pgidFile() { return path.join(this.dir, `native-${process.hrtime.bigint()}.pgid`); }
+    /** The round ended (normally or by an exception): everything is cleaned here, and the reaper exits on its own. */
+    close() {
+        cleanup(this.dir, this.state);
+    }
+}
+exports.RoundGuard = RoundGuard;
+function git(cwd, args) {
+    const r = (0, node_child_process_1.spawnSync)('git', args, { cwd, stdio: 'ignore', timeout: 60000 });
+    return !r.error && r.status === 0;
+}
+function cleanup(dir, state) {
+    for (const name of state.containers)
+        (0, node_child_process_1.spawnSync)('docker', ['rm', '-f', name], { stdio: 'ignore', timeout: 30000 });
+    for (const f of fs.existsSync(dir) ? fs.readdirSync(dir).filter(n => n.endsWith('.pgid')) : []) {
+        const pgid = Number(fs.readFileSync(path.join(dir, f), 'utf8'));
+        if (pgid > 1)
+            try {
+                process.kill(-pgid, 'SIGKILL');
+            }
+            catch { /* already gone */ }
+    }
+    let removeFailed = false;
+    for (const wt of state.worktrees) {
+        if (!git(state.mainRoot, ['worktree', 'remove', '--force', wt]))
+            removeFailed = true;
+        fs.rmSync(path.dirname(wt), { recursive: true, force: true });
+    }
+    // Prune only what a failed remove left registered: a blanket prune would also drop other sessions' stale entries.
+    if (removeFailed)
+        git(state.mainRoot, ['worktree', 'prune']);
+    for (const out of state.outDirs)
+        fs.rmSync(out, { recursive: true, force: true });
+    fs.rmSync(dir, { recursive: true, force: true });
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === 'EPERM';
+    }
+}
+function reap(dir, pid) {
+    const timer = setInterval(() => {
+        const file = path.join(dir, STATE);
+        if (!fs.existsSync(file)) {
+            clearInterval(timer);
+            return;
+        } // the round cleaned up itself
+        if (alive(pid))
+            return;
+        clearInterval(timer);
+        let state;
+        try {
+            state = JSON.parse(fs.readFileSync(file, 'utf8'));
+        }
+        catch {
+            return;
+        }
+        cleanup(dir, state);
+    }, POLL_MS);
+}
+/** Exit code of the launcher when it killed the tool on its timeout (the parent reads it with the marker file). */
+exports.LAUNCH_TIMEOUT_SUFFIX = '.timeout';
+function launch(pgidFile, timeoutMs, bin, args) {
+    const child = (0, node_child_process_1.spawn)(bin, args, { detached: true, stdio: 'inherit' });
+    const kill = () => { if (child.pid)
+        try {
+            process.kill(-child.pid, 'SIGKILL');
+        }
+        catch { /* gone */ } };
+    child.on('error', e => { process.stderr.write(`${e.message}\n`); process.exit(127); });
+    if (child.pid)
+        fs.writeFileSync(pgidFile, String(child.pid));
+    const timer = setTimeout(() => { fs.writeFileSync(`${pgidFile}${exports.LAUNCH_TIMEOUT_SUFFIX}`, ''); kill(); }, timeoutMs);
+    for (const s of ['SIGTERM', 'SIGINT', 'SIGHUP']) {
+        process.on(s, () => { kill(); process.exit(128 + (os.constants.signals[s] ?? 15)); });
+    }
+    child.on('exit', (code, signal) => {
+        clearTimeout(timer);
+        kill(); // background processes the tool left in its group
+        fs.rmSync(pgidFile, { force: true });
+        process.exit(code ?? 128 + (signal ? os.constants.signals[signal] ?? 9 : 9));
+    });
+}
+/** argv for the launcher of one native tool run. */
+function launcherArgs(pgidFile, timeoutMs, bin, args) {
+    return [__filename, 'launch', pgidFile, String(timeoutMs), bin, ...args];
+}
+if (require.main === module) {
+    const [mode, a, b, ...rest] = process.argv.slice(2);
+    if (mode === 'reap')
+        reap(a, Number(b));
+    else if (mode === 'launch')
+        launch(a, Number(b), rest[0], rest.slice(1));
+}

package/dist/security-scan/imagem-de-lint.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PREFIXO_DA_IMAGEM_DE_LINT = void 0;
+exports.tagDaImagemDeLint = tagDaImagemDeLint;
+exports.dockerfileDeLint = dockerfileDeLint;
+exports.garantirImagemDeLint = garantirImagemDeLint;
+exports.eslintComImagem = eslintComImagem;
+/**
+ * RM-072 (D11 da ork-check5x): a imagem de lint pre-montada do Agile Check.
+ *
+ * O `eslint` do catalogo roda na imagem do node e faz `npm install` do `eslint`, do `typescript-eslint` e do `typescript`
+ * a cada execucao, na HEAD e na base. O Agile monta uma vez a imagem local `orkastery-eslint-agil:<hash>` a partir do
+ * mesmo digest do node e do mesmo `install` do catalogo (com `--ignore-scripts`), e roda o mesmo script com o
+ * `node_modules` da imagem no lugar do `npm install`: as mesmas versoes, a mesma config e as mesmas opcoes, sem rede. O
+ * hash junta imagem, `install` e versao, entao catalogo novo gera imagem nova. Sem a imagem, o `eslint` do catalogo.
+ */
+const node_child_process_1 = require("node:child_process");
+const crypto = __importStar(require("node:crypto"));
+exports.PREFIXO_DA_IMAGEM_DE_LINT = 'orkastery-eslint-agil';
+/** O trecho do script do catalogo que a imagem substitui. */
+const INSTALACAO_DO_CATALOGO = 'npm install --prefix /tmp/lint --ignore-scripts --no-audit --no-fund --no-save {install} >&2';
+const NODE_MODULES_DA_IMAGEM = 'ln -s /opt/lint/node_modules /tmp/lint/node_modules';
+const PRAZO_DA_CONSULTA_MS = 20_000;
+/** A tag da imagem local: o hash da imagem do catalogo, do `install` e da versao. */
+function tagDaImagemDeLint(t) {
+    const hash = crypto.createHash('sha256').update(JSON.stringify({ image: t.image, install: t.install ?? [], version: t.version }))
+        .digest('hex').slice(0, 16);
+    return `${exports.PREFIXO_DA_IMAGEM_DE_LINT}:${hash}`;
+}
+/** O Dockerfile da imagem: o node do catalogo, pelo digest, com o `install` do catalogo em /opt/lint. */
+function dockerfileDeLint(t) {
+    return [`FROM ${t.image}`,
+        `RUN mkdir -p /opt/lint && npm install --prefix /opt/lint --ignore-scripts --no-audit --no-fund --no-save ${(t.install ?? []).join(' ')}`,
+        ''].join('\n');
+}
+/** A imagem local presente, ou montada agora; o motivo quando nao deu (sem rede, build que falhou, prazo). */
+function garantirImagemDeLint(t, prazoMs) {
+    const tag = tagDaImagemDeLint(t);
+    const presente = (0, node_child_process_1.spawnSync)('docker', ['image', 'inspect', tag], { stdio: 'ignore', timeout: PRAZO_DA_CONSULTA_MS });
+    if (!presente.error && presente.status === 0)
+        return { tag };
+    if (prazoMs <= 0)
+        return { motivo: 'sem prazo para montar a imagem' };
+    const build = (0, node_child_process_1.spawnSync)('docker', ['build', '--quiet', '-t', tag, '-'], { input: dockerfileDeLint(t), encoding: 'utf8', timeout: prazoMs,
+        killSignal: 'SIGKILL', maxBuffer: 16 * 1024 * 1024 });
+    if (build.error || build.status !== 0) {
+        const ultima = (build.stderr ?? '').split('\n').filter((l) => l.trim()).pop()?.trim().slice(0, 160) ?? '';
+        return { motivo: `docker build ${build.error ? build.error.code ?? build.error.message : `saiu ${build.status}`}` +
+                `${ultima ? `: ${ultima}` : ''}` };
+    }
+    return { tag };
+}
+/**
+ * O `eslint` com a imagem local: o mesmo script, com o `node_modules` da imagem no lugar do `npm install`, e sem rede.
+ * `null` quando o script do catalogo nao tem o trecho esperado (catalogo mudou): o Agile usa o do catalogo.
+ */
+function eslintComImagem(t, tag) {
+    const script = t.args[2];
+    if (t.args[0] !== 'sh' || typeof script !== 'string' || !script.includes(INSTALACAO_DO_CATALOGO))
+        return null;
+    return { ...t, image: tag, network: 'none', args: [t.args[0], t.args[1], script.replace(INSTALACAO_DO_CATALOGO, NODE_MODULES_DA_IMAGEM),
+            ...t.args.slice(3)] };
+}

package/dist/security-scan/normalize/actionlint.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionlint = actionlint;
+const util_1 = require("./util");
+/** actionlint JSON: paths are relative to the repository root (it runs from there). The snippet is its first source line (the rest is the caret ruler, which moves with the column). */
+function actionlint(output, ctx) {
+    const list = (0, util_1.parseReport)('actionlint', output);
+    return list.map(e => ({
+        tool: 'actionlint', rule: `actionlint/${e.kind ?? 'error'}`, category: 'workflow', severity: (0, util_1.mapSeverity)('actionlint', 'any'),
+        file: (0, util_1.repoPath)(e.filepath, ctx), line: e.line, message: e.message ?? '', snippet: (e.snippet ?? e.message ?? '').split('\n')[0],
+    }));
+}

package/dist/security-scan/normalize/eslint.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.eslint = eslint;
+const util_1 = require("./util");
+/** ESLint JSON: `filePath` is absolute inside the container. A message without a rule is a parse error. */
+function eslint(output, ctx) {
+    const files = (0, util_1.parseReport)('eslint', output);
+    return files.flatMap(f => (0, util_1.asArray)(f.messages).map(m => ({
+        tool: 'eslint', rule: m.ruleId ?? 'parse-error', category: 'quality', severity: (0, util_1.mapSeverity)('eslint', m.severity), stack: 'js',
+        file: (0, util_1.repoPath)(f.filePath, ctx), line: m.line, message: m.message ?? '', snippet: m.message ?? '',
+    })));
+}

package/dist/security-scan/normalize/gitleaks.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitleaks = gitleaks;
+const util_1 = require("./util");
+/** The secret value never leaves this function: the snippet is its sha256, and Match/Secret/commit data are dropped. */
+function gitleaks(output, ctx) {
+    const leaks = (0, util_1.parseReport)('gitleaks', output);
+    return leaks.map(l => ({
+        tool: 'gitleaks', rule: l.RuleID ?? 'unknown', category: 'secret', severity: (0, util_1.mapSeverity)('gitleaks', 'any'),
+        file: (0, util_1.repoPath)(l.File ?? '', ctx), line: l.StartLine, message: l.Description ?? l.RuleID ?? 'secret',
+        snippet: (0, util_1.sha256)(l.Secret ?? l.Match ?? ''),
+    }));
+}

package/dist/security-scan/normalize/golangci-lint.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.golangciLint = golangciLint;
+const util_1 = require("./util");
+/** golangci-lint JSON: runs inside the stack directory, so `Pos.Filename` is relative to it (or `../src/..` from the root mount). */
+function golangciLint(output, ctx) {
+    const report = (0, util_1.parseReport)('golangci-lint', output);
+    return (0, util_1.asArray)(report.Issues).map(i => ({
+        tool: 'golangci-lint', rule: i.FromLinter ?? 'unknown', category: 'quality', severity: (0, util_1.mapSeverity)('golangci-lint', i.FromLinter), stack: 'go',
+        file: (0, util_1.repoPath)(i.Pos?.Filename ?? '', ctx, 'stack'), line: i.Pos?.Line, message: i.Text ?? '',
+        snippet: (0, util_1.asArray)(i.SourceLines).join('\n') || (i.Text ?? ''),
+    }));
+}

package/dist/security-scan/normalize/govulncheck.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.govulncheck = govulncheck;
+const util_1 = require("./util");
+/**
+ * govulncheck `-format json` is a stream. One finding per advisory and vulnerable module; `reachable` is true when
+ * some trace of it has a function frame in the user's own module (the first SBOM module, the one without version).
+ */
+function govulncheck(output, ctx) {
+    const messages = (0, util_1.parseReport)('govulncheck', output);
+    const main = messages.find(m => m.SBOM)?.SBOM?.modules?.[0]?.path;
+    const summaries = new Map();
+    for (const m of messages)
+        if (m.osv)
+            summaries.set(m.osv.id, m.osv.summary ?? m.osv.id);
+    const byKey = new Map();
+    for (const m of messages) {
+        if (!m.finding)
+            continue;
+        const trace = (0, util_1.asArray)(m.finding.trace);
+        const module = trace[0]?.module ?? 'unknown';
+        const calledFromMain = main !== undefined && trace.some(fr => fr.module === main && fr.function !== undefined);
+        const key = `${m.finding.osv}|${module}`;
+        const known = byKey.get(key);
+        if (known) {
+            if (calledFromMain)
+                known.reachable = true;
+            continue;
+        }
+        byKey.set(key, {
+            tool: 'govulncheck', rule: m.finding.osv, category: 'dependency', severity: (0, util_1.mapSeverity)('govulncheck', 'any'), stack: 'go',
+            file: (0, util_1.stackFile)('go.mod', ctx), message: summaries.get(m.finding.osv) ?? m.finding.osv, snippet: module, reachable: calledFromMain,
+        });
+    }
+    return [...byKey.values()];
+}