@shrkcrft/inspector 0.1.0-alpha.1 → 0.1.0-alpha.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/adoption-state.js +1 -1
- package/dist/agent-brief.d.ts.map +1 -1
- package/dist/agent-brief.js +59 -10
- package/dist/agent-task-prep.d.ts.map +1 -1
- package/dist/agent-task-prep.js +1 -3
- package/dist/ai-readiness.d.ts +84 -9
- package/dist/ai-readiness.d.ts.map +1 -1
- package/dist/ai-readiness.js +161 -30
- package/dist/apply-dispatch-trace.d.ts +1 -2
- package/dist/apply-dispatch-trace.d.ts.map +1 -1
- package/dist/apply-dispatch-trace.js +0 -9
- package/dist/area-explore.d.ts.map +1 -1
- package/dist/area-explore.js +1 -5
- package/dist/area-map.d.ts +0 -19
- package/dist/area-map.d.ts.map +1 -1
- package/dist/area-map.js +0 -27
- package/dist/ci-permissions-fix.d.ts +1 -1
- package/dist/ci-permissions-fix.d.ts.map +1 -1
- package/dist/ci-permissions-fix.js +1 -182
- package/dist/code-intelligence-doctor.d.ts +21 -0
- package/dist/code-intelligence-doctor.d.ts.map +1 -0
- package/dist/code-intelligence-doctor.js +965 -0
- package/dist/compliance-profiles.js +1 -1
- package/dist/construct-adoption-diff.d.ts.map +1 -1
- package/dist/construct-adoption-diff.js +2 -1
- package/dist/construct-adoption.d.ts.map +1 -1
- package/dist/construct-adoption.js +10 -11
- package/dist/construct-inference.d.ts.map +1 -1
- package/dist/construct-inference.js +2 -1
- package/dist/construct-registry.d.ts.map +1 -1
- package/dist/construct-registry.js +2 -10
- package/dist/contract-template-registry.d.ts.map +1 -1
- package/dist/contract-template-registry.js +2 -10
- package/dist/convention-registry.d.ts.map +1 -1
- package/dist/convention-registry.js +2 -10
- package/dist/decision-records.d.ts.map +1 -1
- package/dist/decision-records.js +2 -9
- package/dist/demo-script.d.ts +0 -1
- package/dist/demo-script.d.ts.map +1 -1
- package/dist/demo-script.js +0 -43
- package/dist/docs-check.js +1 -1
- package/dist/drift-baseline.d.ts.map +1 -1
- package/dist/drift-baseline.js +5 -2
- package/dist/feedback-ingestion.d.ts.map +1 -1
- package/dist/feedback-ingestion.js +2 -16
- package/dist/git-helpers.d.ts +0 -12
- package/dist/git-helpers.d.ts.map +1 -1
- package/dist/git-helpers.js +0 -63
- package/dist/helper-registry.d.ts +27 -54
- package/dist/helper-registry.d.ts.map +1 -1
- package/dist/helper-registry.js +16 -517
- package/dist/impact-analysis.d.ts.map +1 -1
- package/dist/impact-analysis.js +4 -5
- package/dist/impact-render.d.ts.map +1 -1
- package/dist/impact-render.js +0 -9
- package/dist/index.d.ts +2 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -3
- package/dist/ingest-drafts.js +8 -4
- package/dist/migration-profile-registry.d.ts.map +1 -1
- package/dist/migration-profile-registry.js +2 -10
- package/dist/monorepo-onboarding.js +2 -2
- package/dist/onboarding-drafts.d.ts +0 -14
- package/dist/onboarding-drafts.d.ts.map +1 -1
- package/dist/onboarding-drafts.js +5 -39
- package/dist/onboarding-report.d.ts.map +1 -1
- package/dist/onboarding-report.js +5 -1
- package/dist/onboarding.d.ts +1 -1
- package/dist/onboarding.d.ts.map +1 -1
- package/dist/onboarding.js +5 -64
- package/dist/ownership.js +2 -10
- package/dist/pack-contributions-inventory.d.ts +0 -1
- package/dist/pack-contributions-inventory.d.ts.map +1 -1
- package/dist/pack-contributions-inventory.js +0 -24
- package/dist/pack-helper-registry.d.ts.map +1 -1
- package/dist/pack-helper-registry.js +2 -10
- package/dist/pack-release-check.d.ts.map +1 -1
- package/dist/pack-release-check.js +4 -11
- package/dist/pack-signature-status.d.ts.map +1 -1
- package/dist/pack-signature-status.js +0 -1
- package/dist/pack-symbol-compat.d.ts +4 -17
- package/dist/pack-symbol-compat.d.ts.map +1 -1
- package/dist/pack-symbol-compat.js +7 -155
- package/dist/pack-test-runner.js +2 -10
- package/dist/plan-simulation.d.ts.map +1 -1
- package/dist/plan-simulation.js +3 -20
- package/dist/playbook-registry.d.ts.map +1 -1
- package/dist/playbook-registry.js +2 -10
- package/dist/policy-engine.d.ts.map +1 -1
- package/dist/policy-engine.js +3 -11
- package/dist/policy-test.js +3 -11
- package/dist/product-coherence.js +5 -5
- package/dist/profile-registry.d.ts +0 -1
- package/dist/profile-registry.d.ts.map +1 -1
- package/dist/profile-registry.js +4 -32
- package/dist/quality-baseline.d.ts.map +1 -1
- package/dist/quality-baseline.js +3 -1
- package/dist/ranker-explainability.d.ts.map +1 -1
- package/dist/ranker-explainability.js +3 -9
- package/dist/registration-hint-registry.d.ts.map +1 -1
- package/dist/registration-hint-registry.js +2 -10
- package/dist/release-readiness.js +5 -5
- package/dist/reposet.js +1 -1
- package/dist/repository-knowledge-model.d.ts +1 -1
- package/dist/repository-knowledge-model.d.ts.map +1 -1
- package/dist/review-packet-v2.d.ts.map +1 -1
- package/dist/review-packet-v2.js +3 -13
- package/dist/rule-scaffold.d.ts.map +1 -1
- package/dist/rule-scaffold.js +12 -4
- package/dist/scaffold-patterns.js +2 -10
- package/dist/search-tuning-registry.d.ts.map +1 -1
- package/dist/search-tuning-registry.js +2 -10
- package/dist/self-config-doctor-v2.d.ts +1 -1
- package/dist/self-config-doctor-v2.d.ts.map +1 -1
- package/dist/self-config-doctor-v2.js +6 -10
- package/dist/self-config-doctor.d.ts.map +1 -1
- package/dist/self-config-doctor.js +7 -13
- package/dist/sharkcraft-inspector.d.ts.map +1 -1
- package/dist/sharkcraft-inspector.js +9 -0
- package/dist/start-here.d.ts +1 -1
- package/dist/start-here.js +1 -1
- package/dist/synthesize-from-onboarding.d.ts +68 -0
- package/dist/synthesize-from-onboarding.d.ts.map +1 -0
- package/dist/synthesize-from-onboarding.js +508 -0
- package/dist/task-packet.d.ts +13 -0
- package/dist/task-packet.d.ts.map +1 -1
- package/dist/task-packet.js +46 -5
- package/dist/task-ranker.d.ts.map +1 -1
- package/dist/task-ranker.js +1 -31
- package/dist/task-routing-hint-registry.d.ts.map +1 -1
- package/dist/task-routing-hint-registry.js +2 -10
- package/dist/test-runner.d.ts.map +1 -1
- package/dist/test-runner.js +12 -17
- package/dist/universal-search.d.ts +0 -1
- package/dist/universal-search.d.ts.map +1 -1
- package/dist/universal-search.js +0 -12
- package/dist/upgrade-advisor.js +1 -1
- package/package.json +22 -21
- package/dist/onboarding-drafts-merge.d.ts +0 -71
- package/dist/onboarding-drafts-merge.d.ts.map +0 -1
- package/dist/onboarding-drafts-merge.js +0 -174
- package/dist/plugin-lifecycle-profile-registry.d.ts +0 -52
- package/dist/plugin-lifecycle-profile-registry.d.ts.map +0 -1
- package/dist/plugin-lifecycle-profile-registry.js +0 -202
- package/dist/plugin-lifecycle.d.ts +0 -132
- package/dist/plugin-lifecycle.d.ts.map +0 -1
- package/dist/plugin-lifecycle.js +0 -477
|
@@ -15,12 +15,11 @@ export declare const APPLY_DISPATCH_TRACE_SCHEMA = "sharkcraft.apply-dispatch-tr
|
|
|
15
15
|
export declare enum DispatchKind {
|
|
16
16
|
Template = "template",
|
|
17
17
|
Helper = "helper",
|
|
18
|
-
PluginLifecycle = "plugin-lifecycle",
|
|
19
18
|
RegistrationHint = "registration-hint",
|
|
20
19
|
Synthetic = "synthetic",
|
|
21
20
|
Unknown = "unknown"
|
|
22
21
|
}
|
|
23
|
-
export type DispatchSource = 'registry/template' | 'registry/helper' | 'registry/
|
|
22
|
+
export type DispatchSource = 'registry/template' | 'registry/helper' | 'registry/registration-hint' | 'synthetic' | 'unknown';
|
|
24
23
|
export interface IDispatchFileOpCounts {
|
|
25
24
|
readonly create: number;
|
|
26
25
|
readonly update: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"apply-dispatch-trace.d.ts","sourceRoot":"","sources":["../src/apply-dispatch-trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,2BAA2B,uCAAuC,CAAC;AAEhF,oBAAY,YAAY;IACtB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,
|
|
1
|
+
{"version":3,"file":"apply-dispatch-trace.d.ts","sourceRoot":"","sources":["../src/apply-dispatch-trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,2BAA2B,uCAAuC,CAAC;AAEhF,oBAAY,YAAY;IACtB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,gBAAgB,sBAAsB;IACtC,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,cAAc,GACtB,mBAAmB,GACnB,iBAAiB,GACjB,4BAA4B,GAC5B,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EACP,WAAW,GACX,YAAY,GACZ,uBAAuB,GACvB,mBAAmB,GACnB,0BAA0B,GAC1B,eAAe,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,eAAe,CAAC;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,2BAA2B,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,uBAAuB,CAAC;IACjD,uDAAuD;IACvD,QAAQ,CAAC,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD,kEAAkE;IAClE,QAAQ,CAAC,eAAe,EACpB,aAAa,GACb,UAAU,GACV,UAAU,GACV,SAAS,CAAC;IACd,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACzD,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;IAC5D,qCAAqC;IACrC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,0BAA0B;IACzC,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;CAC5D;AAiHD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAwIrB;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CA2B/E"}
|
|
@@ -3,13 +3,11 @@ export var DispatchKind;
|
|
|
3
3
|
(function (DispatchKind) {
|
|
4
4
|
DispatchKind["Template"] = "template";
|
|
5
5
|
DispatchKind["Helper"] = "helper";
|
|
6
|
-
DispatchKind["PluginLifecycle"] = "plugin-lifecycle";
|
|
7
6
|
DispatchKind["RegistrationHint"] = "registration-hint";
|
|
8
7
|
DispatchKind["Synthetic"] = "synthetic";
|
|
9
8
|
DispatchKind["Unknown"] = "unknown";
|
|
10
9
|
})(DispatchKind || (DispatchKind = {}));
|
|
11
10
|
const TEMPLATE_PREFIX_HELPER = '__helper__';
|
|
12
|
-
const TEMPLATE_PREFIX_PLUGIN_LIFECYCLE = '__plugin-lifecycle__';
|
|
13
11
|
const TEMPLATE_PREFIX_REGISTRATION_HINT = '__registration-hint__';
|
|
14
12
|
function classifyTemplate(templateId) {
|
|
15
13
|
if (templateId.startsWith(TEMPLATE_PREFIX_HELPER)) {
|
|
@@ -19,13 +17,6 @@ function classifyTemplate(templateId) {
|
|
|
19
17
|
handler: '@shrkcrft/inspector/helper-registry + @shrkcrft/generator/synthetic-plan.evaluateSavedPlanInPlace',
|
|
20
18
|
};
|
|
21
19
|
}
|
|
22
|
-
if (templateId.startsWith(TEMPLATE_PREFIX_PLUGIN_LIFECYCLE)) {
|
|
23
|
-
return {
|
|
24
|
-
kind: DispatchKind.PluginLifecycle,
|
|
25
|
-
source: 'registry/plugin-lifecycle-profile',
|
|
26
|
-
handler: '@shrkcrft/inspector/plugin-lifecycle + @shrkcrft/generator/synthetic-plan.evaluateSavedPlanInPlace',
|
|
27
|
-
};
|
|
28
|
-
}
|
|
29
20
|
if (templateId.startsWith(TEMPLATE_PREFIX_REGISTRATION_HINT)) {
|
|
30
21
|
return {
|
|
31
22
|
kind: DispatchKind.RegistrationHint,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"area-explore.d.ts","sourceRoot":"","sources":["../src/area-explore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAgB,MAAM,eAAe,CAAC;AAEvD,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;CAC7E;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EACT,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,mBAAmB,GACnB,UAAU,CAAC;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACxD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;
|
|
1
|
+
{"version":3,"file":"area-explore.d.ts","sourceRoot":"","sources":["../src/area-explore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAgB,MAAM,eAAe,CAAC;AAEvD,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;CAC7E;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EACT,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,mBAAmB,GACnB,UAAU,CAAC;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACxD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AA6LD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,qBAAqB,CAAC;IAClC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,cAAc,CAAC,EAAE,aAAa,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,mDAAmD;IACnD,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,8CAA8C;IAC9C,eAAe,CAAC,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CA+IxE;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAoDxE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAuC5E"}
|
package/dist/area-explore.js
CHANGED
|
@@ -123,17 +123,13 @@ function describeRole(relPath, kind) {
|
|
|
123
123
|
}
|
|
124
124
|
switch (kind) {
|
|
125
125
|
case AreaKind.Core:
|
|
126
|
-
return 'Core building blocks (Result, errors, ids)
|
|
126
|
+
return 'Core building blocks (Result, errors, ids).';
|
|
127
127
|
case AreaKind.Tests:
|
|
128
128
|
return 'Tests.';
|
|
129
129
|
case AreaKind.Docs:
|
|
130
130
|
return 'Documentation.';
|
|
131
131
|
case AreaKind.Generated:
|
|
132
132
|
return 'Generated output — do not hand-edit.';
|
|
133
|
-
case AreaKind.Adapter:
|
|
134
|
-
return 'Framework / runtime adapter glue.';
|
|
135
|
-
case AreaKind.Plugin:
|
|
136
|
-
return 'Plugin / pack code.';
|
|
137
133
|
default:
|
|
138
134
|
return `${kind} area.`;
|
|
139
135
|
}
|
package/dist/area-map.d.ts
CHANGED
|
@@ -2,11 +2,6 @@ import type { ISharkcraftInspection } from './sharkcraft-inspector.js';
|
|
|
2
2
|
export declare const AREA_MAP_SCHEMA = "sharkcraft.area-map/v1";
|
|
3
3
|
export declare enum AreaKind {
|
|
4
4
|
Core = "core",
|
|
5
|
-
Common = "common",
|
|
6
|
-
Runtime = "runtime",
|
|
7
|
-
Kernel = "kernel",
|
|
8
|
-
Plugin = "plugin",
|
|
9
|
-
Adapter = "adapter",
|
|
10
5
|
Ui = "ui",
|
|
11
6
|
App = "app",
|
|
12
7
|
Api = "api",
|
|
@@ -36,21 +31,7 @@ export interface IAreaMap {
|
|
|
36
31
|
projectRoot: string;
|
|
37
32
|
areas: readonly IAreaMapEntry[];
|
|
38
33
|
unclassifiedFiles: number;
|
|
39
|
-
/**
|
|
40
|
-
* When set, `areas` was filtered to a subset of the repo's areas
|
|
41
|
-
* (e.g. only areas touched by the current diff). `areasTotal` reports
|
|
42
|
-
* the original area count so the consumer knows the map was slimmed.
|
|
43
|
-
*/
|
|
44
|
-
areasTotal?: number;
|
|
45
|
-
/** True iff areas[] is a filtered subset of the full repo area map. */
|
|
46
|
-
filtered?: boolean;
|
|
47
34
|
}
|
|
48
|
-
/**
|
|
49
|
-
* Return a copy of `map` with `areas[]` filtered to only those whose `id`
|
|
50
|
-
* is in `keepIds`. Sets `filtered: true` and preserves `areasTotal` so
|
|
51
|
-
* consumers know the map was slimmed.
|
|
52
|
-
*/
|
|
53
|
-
export declare function filterAreaMap(map: IAreaMap, keepIds: ReadonlyArray<string>): IAreaMap;
|
|
54
35
|
export declare function buildAreaMap(inspection: ISharkcraftInspection): IAreaMap;
|
|
55
36
|
export declare function renderAreaMapText(map: IAreaMap): string;
|
|
56
37
|
export declare function renderAreaMapMarkdown(map: IAreaMap): string;
|
package/dist/area-map.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"area-map.d.ts","sourceRoot":"","sources":["../src/area-map.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,oBAAY,QAAQ;IAClB,IAAI,SAAS;IACb,
|
|
1
|
+
{"version":3,"file":"area-map.d.ts","sourceRoot":"","sources":["../src/area-map.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,oBAAY,QAAQ;IAClB,IAAI,SAAS;IACb,EAAE,OAAO;IACT,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,OAAO,eAAe,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAoED,wBAAgB,YAAY,CAAC,UAAU,EAAE,qBAAqB,GAAG,QAAQ,CA4ExE;AA0BD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CASvD;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAc3D"}
|
package/dist/area-map.js
CHANGED
|
@@ -4,11 +4,6 @@ export const AREA_MAP_SCHEMA = 'sharkcraft.area-map/v1';
|
|
|
4
4
|
export var AreaKind;
|
|
5
5
|
(function (AreaKind) {
|
|
6
6
|
AreaKind["Core"] = "core";
|
|
7
|
-
AreaKind["Common"] = "common";
|
|
8
|
-
AreaKind["Runtime"] = "runtime";
|
|
9
|
-
AreaKind["Kernel"] = "kernel";
|
|
10
|
-
AreaKind["Plugin"] = "plugin";
|
|
11
|
-
AreaKind["Adapter"] = "adapter";
|
|
12
7
|
AreaKind["Ui"] = "ui";
|
|
13
8
|
AreaKind["App"] = "app";
|
|
14
9
|
AreaKind["Api"] = "api";
|
|
@@ -18,30 +13,8 @@ export var AreaKind;
|
|
|
18
13
|
AreaKind["Generated"] = "generated";
|
|
19
14
|
AreaKind["Unknown"] = "unknown";
|
|
20
15
|
})(AreaKind || (AreaKind = {}));
|
|
21
|
-
/**
|
|
22
|
-
* Return a copy of `map` with `areas[]` filtered to only those whose `id`
|
|
23
|
-
* is in `keepIds`. Sets `filtered: true` and preserves `areasTotal` so
|
|
24
|
-
* consumers know the map was slimmed.
|
|
25
|
-
*/
|
|
26
|
-
export function filterAreaMap(map, keepIds) {
|
|
27
|
-
if (keepIds.length === 0)
|
|
28
|
-
return map;
|
|
29
|
-
const keep = new Set(keepIds);
|
|
30
|
-
const filtered = map.areas.filter((a) => keep.has(a.id));
|
|
31
|
-
return {
|
|
32
|
-
...map,
|
|
33
|
-
areas: filtered,
|
|
34
|
-
areasTotal: map.areasTotal ?? map.areas.length,
|
|
35
|
-
filtered: true,
|
|
36
|
-
};
|
|
37
|
-
}
|
|
38
16
|
const AREA_PATTERNS = [
|
|
39
17
|
{ kind: AreaKind.Core, match: [/^packages\/core(\/|$)/, /^src\/core(\/|$)/], idHint: 'core' },
|
|
40
|
-
{ kind: AreaKind.Common, match: [/^packages\/(common|shared)(\/|$)/, /^src\/(common|shared)(\/|$)/], idHint: 'common' },
|
|
41
|
-
{ kind: AreaKind.Runtime, match: [/^packages\/runtime(\/|$)/, /^src\/runtime(\/|$)/], idHint: 'runtime' },
|
|
42
|
-
{ kind: AreaKind.Kernel, match: [/^packages\/kernel(\/|$)/, /^src\/kernel(\/|$)/], idHint: 'kernel' },
|
|
43
|
-
{ kind: AreaKind.Plugin, match: [/plugins?(\/|$)/, /^packages\/plugin-/], idHint: 'plugin' },
|
|
44
|
-
{ kind: AreaKind.Adapter, match: [/adapters?(\/|$)/, /^packages\/adapter-/], idHint: 'adapter' },
|
|
45
18
|
{ kind: AreaKind.Ui, match: [/^packages\/(ui|dashboard|web)(\/|$)/, /^(src|app)\/(ui|components|pages|views)(\/|$)/], idHint: 'ui' },
|
|
46
19
|
{ kind: AreaKind.App, match: [/^apps?\//, /^packages\/app(\/|$)/], idHint: 'app' },
|
|
47
20
|
{ kind: AreaKind.Api, match: [/^packages\/api(\/|$)/, /\/api\//, /\/routes\//, /\/controllers\//], idHint: 'api' },
|
|
@@ -16,7 +16,7 @@ import type { ICiPermissionsAudit, CiProviderForAudit } from './ci-permissions.j
|
|
|
16
16
|
export declare const CI_PERMISSIONS_FIX_SCHEMA = "sharkcraft.ci-permissions-fix/v1";
|
|
17
17
|
export type CiPermissionsFixFormat = 'patch' | 'markdown' | 'json';
|
|
18
18
|
export interface ICiPermissionsFixHint {
|
|
19
|
-
code: 'add-permissions-block' | 'add-pull-requests-write' | 'narrow-permissions-block' | 'remove-pull-requests-write' | 'pin-action-sha' | 'pin-image-digest' | '
|
|
19
|
+
code: 'add-permissions-block' | 'add-pull-requests-write' | 'narrow-permissions-block' | 'remove-pull-requests-write' | 'pin-action-sha' | 'pin-image-digest' | 'no-action-required';
|
|
20
20
|
severity: 'info' | 'warning' | 'error';
|
|
21
21
|
message: string;
|
|
22
22
|
explanation: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ci-permissions-fix.d.ts","sourceRoot":"","sources":["../src/ci-permissions-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAE5E,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EACA,uBAAuB,GACvB,yBAAyB,GACzB,0BAA0B,GAC1B,4BAA4B,GAC5B,gBAAgB,GAChB,kBAAkB,GAClB,
|
|
1
|
+
{"version":3,"file":"ci-permissions-fix.d.ts","sourceRoot":"","sources":["../src/ci-permissions-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAE5E,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EACA,uBAAuB,GACvB,yBAAyB,GACzB,0BAA0B,GAC1B,4BAA4B,GAC5B,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,yBAAyB,CAAC;IACzC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxC,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;CACvB;AA0DD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,wBAAwB,CAuGjG;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAoCR"}
|
|
@@ -20,24 +20,6 @@ function leastPrivilegeBlock(provider, withPullRequestsWrite) {
|
|
|
20
20
|
? 'permissions:\n contents: read\n pull-requests: write\n'
|
|
21
21
|
: 'permissions:\n contents: read\n';
|
|
22
22
|
}
|
|
23
|
-
if (provider === 'gitlab') {
|
|
24
|
-
return withPullRequestsWrite
|
|
25
|
-
? '# GitLab CI uses CI/CD variables, not file-level permissions.\n# Store a Project Access Token with `api` scope as a masked variable\n# named REVIEW_TOKEN, then reference it in the comment-posting job:\n# variables:\n# GIT_STRATEGY: clone\n# id_tokens:\n# GITLAB_OIDC_TOKEN:\n# aud: https://gitlab.example.com\n'
|
|
26
|
-
: '# GitLab CI uses CI/CD variables, not file-level permissions.\n# $CI_JOB_TOKEN is read-only for repo metadata — no extra scopes required.\n';
|
|
27
|
-
}
|
|
28
|
-
if (provider === 'bitbucket') {
|
|
29
|
-
return withPullRequestsWrite
|
|
30
|
-
? 'oidc: true # add to each step that needs write scopes — pair with a repo access token in Bitbucket settings\n'
|
|
31
|
-
: '# Bitbucket Pipelines has no top-level permissions block.\n# Use repository access tokens (Bitbucket settings → Access tokens) and store them as secured variables.\n';
|
|
32
|
-
}
|
|
33
|
-
if (provider === 'azure') {
|
|
34
|
-
return withPullRequestsWrite
|
|
35
|
-
? 'permissions:\n contents: read\n pull-requests: write # Azure Pipelines job-level permissions (recent feature)\n'
|
|
36
|
-
: 'permissions:\n contents: read\n';
|
|
37
|
-
}
|
|
38
|
-
if (provider === 'jenkins') {
|
|
39
|
-
return '// Jenkins permissions are configured in Manage Jenkins → Security → Authorization.\n// Use Matrix-based or Role-based security; the Jenkinsfile itself cannot grant or restrict scopes.\n';
|
|
40
|
-
}
|
|
41
23
|
return '# (least-privilege block — provider-specific)\n';
|
|
42
24
|
}
|
|
43
25
|
function makeAddPermissionsBlockPatch(file, body, withPullRequestsWrite) {
|
|
@@ -63,145 +45,6 @@ function makeAddPermissionsBlockPatch(file, body, withPullRequestsWrite) {
|
|
|
63
45
|
];
|
|
64
46
|
return patch.join('\n') + '\n';
|
|
65
47
|
}
|
|
66
|
-
function makeInsertAfterTopLineMatchingPatch(file, body, matcher, block) {
|
|
67
|
-
const lines = body.split(/\r?\n/);
|
|
68
|
-
let anchor = -1;
|
|
69
|
-
for (let i = 0; i < lines.length; i += 1) {
|
|
70
|
-
if (matcher.test(lines[i])) {
|
|
71
|
-
anchor = i;
|
|
72
|
-
break;
|
|
73
|
-
}
|
|
74
|
-
}
|
|
75
|
-
if (anchor < 0)
|
|
76
|
-
anchor = 0;
|
|
77
|
-
const blockLines = block.split(/\r?\n/).filter((l) => l.length > 0);
|
|
78
|
-
return [
|
|
79
|
-
`--- a/${file}`,
|
|
80
|
-
`+++ b/${file}`,
|
|
81
|
-
`@@ -${anchor + 1},1 +${anchor + 1},${1 + blockLines.length} @@`,
|
|
82
|
-
` ${lines[anchor] ?? ''}`,
|
|
83
|
-
...blockLines.map((l) => `+${l}`),
|
|
84
|
-
].join('\n') + '\n';
|
|
85
|
-
}
|
|
86
|
-
function emitGitlabHints(audit, body) {
|
|
87
|
-
const hints = [];
|
|
88
|
-
if (audit.postsComments) {
|
|
89
|
-
const block = 'id_tokens:\n GITLAB_OIDC_TOKEN:\n aud: https://gitlab.example.com # replace with your GitLab host\n';
|
|
90
|
-
// Anchor after the first `stages:` line if present, otherwise top.
|
|
91
|
-
const hasIdTokens = /\bid_tokens:\s*$/m.test(body);
|
|
92
|
-
if (hasIdTokens) {
|
|
93
|
-
hints.push({
|
|
94
|
-
code: 'requires-manual',
|
|
95
|
-
severity: 'info',
|
|
96
|
-
message: 'Pipeline already declares `id_tokens:` — confirm the `aud:` matches your GitLab instance and the consuming script trades the OIDC token for a scoped access token.',
|
|
97
|
-
explanation: 'GitLab CI has no native permissions block. Least-privilege comes from OIDC + a Project Access Token with `api` scope on the consuming job.',
|
|
98
|
-
insertion: leastPrivilegeBlock('gitlab', true),
|
|
99
|
-
});
|
|
100
|
-
}
|
|
101
|
-
else {
|
|
102
|
-
hints.push({
|
|
103
|
-
code: 'add-id-tokens-block',
|
|
104
|
-
severity: 'warning',
|
|
105
|
-
message: 'Pipeline posts MR comments without declaring an `id_tokens:` block — comment-posting will require a long-lived PRIVATE-TOKEN, which is harder to rotate.',
|
|
106
|
-
explanation: 'Use GitLab OIDC: declare `id_tokens.GITLAB_OIDC_TOKEN.aud` on the job, then exchange the token for a Project Access Token at runtime. Avoids storing long-lived secrets in CI/CD variables.',
|
|
107
|
-
patch: body ? makeInsertAfterTopLineMatchingPatch(audit.workflowFile, body, /^\s*stages:\s*$/, block) : undefined,
|
|
108
|
-
insertion: block,
|
|
109
|
-
});
|
|
110
|
-
}
|
|
111
|
-
}
|
|
112
|
-
else {
|
|
113
|
-
hints.push({
|
|
114
|
-
code: 'no-action-required',
|
|
115
|
-
severity: 'info',
|
|
116
|
-
message: 'No MR-comment-posting step detected — $CI_JOB_TOKEN is sufficient and no scoped token is required.',
|
|
117
|
-
explanation: 'GitLab CI runs each job with a read-only $CI_JOB_TOKEN by default; only enable write scopes (Project Access Tokens) on jobs that actually mutate the project.',
|
|
118
|
-
});
|
|
119
|
-
}
|
|
120
|
-
return hints;
|
|
121
|
-
}
|
|
122
|
-
function emitBitbucketHints(audit, body) {
|
|
123
|
-
const hints = [];
|
|
124
|
-
const hasOidc = /\boidc:\s*true\b/.test(body);
|
|
125
|
-
if (audit.postsComments && !hasOidc) {
|
|
126
|
-
const block = ' oidc: true # exchange for a scoped repo access token at runtime\n';
|
|
127
|
-
hints.push({
|
|
128
|
-
code: 'add-oidc-block',
|
|
129
|
-
severity: 'warning',
|
|
130
|
-
message: 'Pipeline posts PR comments without declaring `oidc: true` — pair the comment-posting step with OIDC + a repository access token instead of a long-lived secret.',
|
|
131
|
-
explanation: 'Bitbucket Pipelines has no top-level permissions block; least-privilege comes from `oidc: true` + a repo-scoped access token configured in Bitbucket settings.',
|
|
132
|
-
patch: body
|
|
133
|
-
? makeInsertAfterTopLineMatchingPatch(audit.workflowFile, body, /^\s*-\s*step:\s*$/, block)
|
|
134
|
-
: undefined,
|
|
135
|
-
insertion: block,
|
|
136
|
-
});
|
|
137
|
-
}
|
|
138
|
-
else if (!audit.postsComments) {
|
|
139
|
-
hints.push({
|
|
140
|
-
code: 'no-action-required',
|
|
141
|
-
severity: 'info',
|
|
142
|
-
message: 'No PR-comment-posting step detected — the default repository access token is read-only.',
|
|
143
|
-
explanation: 'Bitbucket Pipelines does not require explicit permissions for read-only operations. Avoid checking long-lived tokens into the file regardless.',
|
|
144
|
-
});
|
|
145
|
-
}
|
|
146
|
-
else {
|
|
147
|
-
hints.push({
|
|
148
|
-
code: 'requires-manual',
|
|
149
|
-
severity: 'info',
|
|
150
|
-
message: 'Pipeline already declares `oidc: true`. Confirm the consuming step exchanges the token for the minimum repo scope it needs.',
|
|
151
|
-
explanation: 'OIDC exchange happens at runtime — the workflow file cannot enforce the resulting token\'s scope. Audit the API calls in the step.',
|
|
152
|
-
insertion: leastPrivilegeBlock('bitbucket', true),
|
|
153
|
-
});
|
|
154
|
-
}
|
|
155
|
-
return hints;
|
|
156
|
-
}
|
|
157
|
-
function emitAzureHints(audit, body) {
|
|
158
|
-
const hints = [];
|
|
159
|
-
const hasPermissions = /^\s*permissions:\s*$/m.test(body);
|
|
160
|
-
if (audit.postsComments && !hasPermissions) {
|
|
161
|
-
const block = leastPrivilegeBlock('azure', true);
|
|
162
|
-
hints.push({
|
|
163
|
-
code: 'add-azure-permissions-block',
|
|
164
|
-
severity: 'warning',
|
|
165
|
-
message: 'Pipeline posts PR comments without declaring a job-level `permissions:` block. Azure Pipelines now supports job-level permissions — use them to scope the System.AccessToken.',
|
|
166
|
-
explanation: 'When the job-level `permissions:` feature is enabled on the project, Azure Pipelines restricts System.AccessToken to the scopes you list. Without the block, the token defaults to the project-level setting.',
|
|
167
|
-
patch: body
|
|
168
|
-
? makeInsertAfterTopLineMatchingPatch(audit.workflowFile, body, /^\s*(jobs|stages):\s*$/, block)
|
|
169
|
-
: undefined,
|
|
170
|
-
insertion: block,
|
|
171
|
-
});
|
|
172
|
-
}
|
|
173
|
-
else if (!audit.postsComments) {
|
|
174
|
-
hints.push({
|
|
175
|
-
code: 'no-action-required',
|
|
176
|
-
severity: 'info',
|
|
177
|
-
message: 'No PR-comment-posting step detected — the default Build Service token is read-only for repo metadata.',
|
|
178
|
-
explanation: 'Azure Pipelines defaults the System.AccessToken to project-scoped read; only enable write scopes when the pipeline mutates repo state.',
|
|
179
|
-
});
|
|
180
|
-
}
|
|
181
|
-
else {
|
|
182
|
-
hints.push({
|
|
183
|
-
code: 'requires-manual',
|
|
184
|
-
severity: 'info',
|
|
185
|
-
message: 'Pipeline already declares a `permissions:` block. Confirm it lists only the scopes the comment-posting job needs (typically `contents: read` + `pull-requests: write`).',
|
|
186
|
-
explanation: 'Azure Pipelines permissions blocks are additive per job — make sure broader scopes are not granted to unrelated jobs.',
|
|
187
|
-
insertion: leastPrivilegeBlock('azure', true),
|
|
188
|
-
});
|
|
189
|
-
}
|
|
190
|
-
return hints;
|
|
191
|
-
}
|
|
192
|
-
function emitJenkinsHints(audit) {
|
|
193
|
-
return [
|
|
194
|
-
{
|
|
195
|
-
code: 'requires-manual',
|
|
196
|
-
severity: audit.postsComments ? 'warning' : 'info',
|
|
197
|
-
message: audit.postsComments
|
|
198
|
-
? 'Jenkinsfile posts PR comments — declarative pipelines cannot grant permissions; this is configured in Jenkins itself.'
|
|
199
|
-
: 'Jenkinsfile detected — declarative pipelines cannot grant permissions; this is configured in Jenkins itself.',
|
|
200
|
-
explanation: 'Jenkins permissions are administered via Manage Jenkins → Security → Authorization (Matrix-based or Role-based plugin). Edit there, not in the Jenkinsfile. The pipeline\'s `withCredentials(...)` block scopes secrets to a step but does not grant repository write access on its own.',
|
|
201
|
-
insertion: leastPrivilegeBlock('jenkins', audit.postsComments),
|
|
202
|
-
},
|
|
203
|
-
];
|
|
204
|
-
}
|
|
205
48
|
function makeNarrowPermissionsPatch(file, body) {
|
|
206
49
|
// Find the broad permission lines and propose replacing each with
|
|
207
50
|
// `contents: read`.
|
|
@@ -245,27 +88,6 @@ export function buildCiPermissionsFixPreview(audit) {
|
|
|
245
88
|
catch {
|
|
246
89
|
body = '';
|
|
247
90
|
}
|
|
248
|
-
// Non-GHA providers: emit provider-specific hints and return early.
|
|
249
|
-
if (audit.provider === 'gitlab') {
|
|
250
|
-
for (const h of emitGitlabHints(audit, body))
|
|
251
|
-
hints.push(h);
|
|
252
|
-
return finalize(audit, hints);
|
|
253
|
-
}
|
|
254
|
-
if (audit.provider === 'bitbucket') {
|
|
255
|
-
for (const h of emitBitbucketHints(audit, body))
|
|
256
|
-
hints.push(h);
|
|
257
|
-
return finalize(audit, hints);
|
|
258
|
-
}
|
|
259
|
-
if (audit.provider === 'azure') {
|
|
260
|
-
for (const h of emitAzureHints(audit, body))
|
|
261
|
-
hints.push(h);
|
|
262
|
-
return finalize(audit, hints);
|
|
263
|
-
}
|
|
264
|
-
if (audit.provider === 'jenkins') {
|
|
265
|
-
for (const h of emitJenkinsHints(audit))
|
|
266
|
-
hints.push(h);
|
|
267
|
-
return finalize(audit, hints);
|
|
268
|
-
}
|
|
269
91
|
const isGha = audit.provider === 'github-actions';
|
|
270
92
|
const missingPermsBlock = audit.findings.some((f) => f.code === 'permissions-block-missing');
|
|
271
93
|
// Case 1: comment-posting requested but no permissions block (or no pull-requests: write).
|
|
@@ -301,10 +123,7 @@ export function buildCiPermissionsFixPreview(audit) {
|
|
|
301
123
|
insertion: leastPrivilegeBlock(audit.provider, false),
|
|
302
124
|
});
|
|
303
125
|
}
|
|
304
|
-
|
|
305
|
-
}
|
|
306
|
-
function finalize(audit, hints) {
|
|
307
|
-
// Supply-chain hints — provider-agnostic.
|
|
126
|
+
// Supply-chain hints.
|
|
308
127
|
if (audit.externalActions.length > 0) {
|
|
309
128
|
hints.push({
|
|
310
129
|
code: 'pin-action-sha',
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
import { type IDoctorCheck } from './doctor-result.js';
|
|
2
|
+
export interface ICodeIntelligenceDoctorOptions {
|
|
3
|
+
/**
|
|
4
|
+
* Overrides `Date.now()`. Used by tests to make age computations
|
|
5
|
+
* deterministic without touching the system clock.
|
|
6
|
+
*/
|
|
7
|
+
nowMs?: number;
|
|
8
|
+
/**
|
|
9
|
+
* Override the stale-data threshold (days). Default 7. Tests use this
|
|
10
|
+
* to flip a fresh fixture into "stale" without changing mtime.
|
|
11
|
+
*/
|
|
12
|
+
staleThresholdDays?: number;
|
|
13
|
+
}
|
|
14
|
+
/**
|
|
15
|
+
* Read every code-intelligence package's persisted state and produce a
|
|
16
|
+
* compact set of doctor findings. The function is sync (matches the
|
|
17
|
+
* rest of `runDoctor`) and silent when no state is present (e.g. the
|
|
18
|
+
* user has never run `shrk graph index`).
|
|
19
|
+
*/
|
|
20
|
+
export declare function buildCodeIntelligenceChecks(projectRoot: string, options?: ICodeIntelligenceDoctorOptions): IDoctorCheck[];
|
|
21
|
+
//# sourceMappingURL=code-intelligence-doctor.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"code-intelligence-doctor.d.ts","sourceRoot":"","sources":["../src/code-intelligence-doctor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAoKvE,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,8BAAmC,GAC3C,YAAY,EAAE,CAkBhB"}
|