@quantakrypto/core 0.3.0 → 0.4.0

package/src/walk.ts

@@ -8,6 +8,8 @@ import { readdir, stat } from "node:fs/promises";
 import type { Dirent } from "node:fs";
 import * as path from "node:path";
 
+import { isManifestFile } from "./dependencies.js";
+
 /** Directories ignored by default (can be disabled with noDefaultIgnores). */
 export const DEFAULT_IGNORES: readonly string[] = [
   "node_modules",
@@ -116,12 +118,80 @@ export function toPosix(p: string): string {
   return p.split(path.sep).join("/");
 }
 
-/** True if `rel` (a POSIX relative path) matches any pattern (substring/prefix). */
-function matchesAny(rel: string, patterns: readonly string[]): boolean {
+/** A pattern is treated as a glob when it contains one of these metacharacters. */
+function hasGlobMeta(pattern: string): boolean {
+  return /[*?[]/.test(pattern);
+}
+
+/**
+ * Translate a glob into an anchored RegExp: `*` matches within a path segment
+ * (not `/`), `**` matches across segments, a leading `**` before a slash is an
+ * optional path prefix, `?` matches a single non-`/` char, `[...]` is a
+ * character class. Other regex
+ * metacharacters are escaped.
+ */
+function globToRegExp(glob: string): RegExp {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        i++; // consume the second '*'
+        if (glob[i + 1] === "/") {
+          i++; // consume the trailing '/'
+          re += "(?:.*/)?"; // zero or more path segments
+        } else {
+          re += ".*"; // '**' spanning segments
+        }
+      } else {
+        re += "[^/]*"; // '*' within a segment
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+    } else if (c === "[") {
+      // Pass a character class through; find its closing ']'.
+      const end = glob.indexOf("]", i + 1);
+      if (end === -1) {
+        re += "\\[";
+      } else {
+        re += glob.slice(i, end + 1);
+        i = end;
+      }
+    } else if ("\\^$.|+(){}".includes(c)) {
+      re += "\\" + c;
+    } else {
+      re += c;
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+
+/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */
+const GLOB_CACHE = new Map<string, RegExp>();
+function globRegExp(pattern: string): RegExp {
+  let re = GLOB_CACHE.get(pattern);
+  if (!re) {
+    re = globToRegExp(pattern);
+    GLOB_CACHE.set(pattern, re);
+  }
+  return re;
+}
+
+/**
+ * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a
+ * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain
+ * pattern keeps the historical substring / path-prefix semantics (so `"src"`
+ * still matches `src/a.ts` and `"secrets"` matches anywhere).
+ */
+export function matchesAny(rel: string, patterns: readonly string[]): boolean {
   for (const pattern of patterns) {
     if (!pattern) continue;
     const p = toPosix(pattern).replace(/\/+$/, "");
-    // Substring match (handles "src/legacy" or "secrets")...
+    if (hasGlobMeta(p)) {
+      if (globRegExp(p).test(rel)) return true;
+      continue;
+    }
+    // Plain pattern: substring match (handles "src/legacy" or "secrets")...
     if (rel.includes(p)) return true;
     // ...and explicit path-prefix match ("foo" should match "foo/bar.ts").
     if (rel === p || rel.startsWith(`${p}/`)) return true;
@@ -232,16 +302,12 @@ interface WalkContext {
  * scanned for vulnerable dependencies instead of being silently dropped.
  */
 function passesSizeLimit(rel: string, size: number, maxFileSize: number): boolean {
-  if (isManifestPath(rel)) return true;
+  // Dependency manifests are always read (they can exceed the size cap but carry
+  // the whole dependency tree). Uses the single {@link isManifestFile} definition.
+  if (isManifestFile(rel)) return true;
   return size <= maxFileSize;
 }
 
-/** True if the path's basename is a dependency manifest we always read. */
-function isManifestPath(rel: string): boolean {
-  const base = rel.split("/").pop() ?? rel;
-  return base === "package.json" || base === "package-lock.json";
-}
-
 /** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */
 async function* walkDir(absDir: string, relDir: string, ctx: WalkContext): AsyncGenerator<string> {
   let entries: Dirent[];
@@ -274,8 +340,11 @@ async function* walkDir(absDir: string, relDir: string, ctx: WalkContext): Async
     if (!entry.isFile()) continue;
     if (isExcluded(rel, ctx.exclude)) continue;
     if (!isIncluded(rel, ctx.include)) continue;
-    if (isBinaryPath(rel)) continue;
-    if (isGeneratedPath(rel)) continue;
+    // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —
+    // they carry the dependency tree and must not be dropped as binary/generated.
+    const manifest = isManifestFile(rel);
+    if (!manifest && isBinaryPath(rel)) continue;
+    if (!manifest && isGeneratedPath(rel)) continue;
 
     try {
       const s = await stat(abs);

package/src/worktree.ts

@@ -0,0 +1,45 @@
+/**
+ * Ephemeral git worktree runner. Remediation applies candidate patches inside a
+ * throwaway `git worktree` checked out at HEAD, so the user's working tree is
+ * never touched while patches are being tried and verified. The worktree is
+ * always removed afterwards, even if the callback throws.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const exec = promisify(execFile);
+
+async function git(args: string[], cwd?: string): Promise<void> {
+  await exec("git", args, { cwd });
+}
+
+/**
+ * Create a detached worktree of `repoRoot` at HEAD, run `fn` with its path, and
+ * always tear it down. Throws if `repoRoot` is not a git repository.
+ */
+export async function withWorktree<T>(
+  repoRoot: string,
+  fn: (dir: string) => Promise<T>,
+): Promise<T> {
+  try {
+    await git(["rev-parse", "--is-inside-work-tree"], repoRoot);
+  } catch {
+    throw new Error(`withWorktree: "${repoRoot}" is not a git repository`);
+  }
+  const base = await mkdtemp(join(tmpdir(), "quantakrypto-wt-"));
+  const dir = join(base, "wt");
+  await git(["worktree", "add", "--detach", dir], repoRoot);
+  try {
+    return await fn(dir);
+  } finally {
+    try {
+      await git(["worktree", "remove", "--force", dir], repoRoot);
+    } catch {
+      // best effort — the temp dir removal below still reclaims the disk.
+    }
+    await rm(base, { recursive: true, force: true });
+  }
+}