@stll/oxlint-config 1.3.0 → 1.4.0

package/dist/toolchain-inputs.cjs

@@ -378,6 +378,21 @@ const cloudSetupArtifacts = {
 			binaries: { "rustup-init": "rustup-init" }
 		}
 	},
+	gitleaks: {
+		version: "8.30.1",
+		amd64: {
+			url: "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz",
+			sha256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
+			archive: "tar.gz",
+			binaries: { gitleaks: "gitleaks" }
+		},
+		arm64: {
+			url: "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_arm64.tar.gz",
+			sha256: "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+			archive: "tar.gz",
+			binaries: { gitleaks: "gitleaks" }
+		}
+	},
 	"cargo-nextest": {
 		version: "0.9.148",
 		amd64: {
@@ -445,7 +460,8 @@ const cloudSetupArtifactVersions = {
 	"rustup-init": [cloudSetupArtifacts["rustup-init"]],
 	"cargo-nextest": [cloudSetupArtifacts["cargo-nextest"]],
 	"wasm-bindgen-cli": wasmBindgenArtifactReleases,
-	uv: [cloudSetupArtifacts.uv]
+	uv: [cloudSetupArtifacts.uv],
+	gitleaks: [cloudSetupArtifacts.gitleaks]
 };
 /** A new version requires an explicit, verified catalog entry; never build from source. */
 const getCloudSetupArtifact = (tool, version) => {
@@ -500,11 +516,20 @@ const parseRust = (input) => {
 	if (!object(input) || Object.keys(input).some((key) => ![
 		"toolchain",
 		"components",
-		"targets"
-	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components and targets");
+		"targets",
+		"additionalToolchains"
+	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components, targets and additionalToolchains");
 	const toolchain = input["toolchain"];
 	if (toolchain !== void 0 && !exactPin(toolchain)) throw new Error("cloud.rust.toolchain must be an exact stable release");
+	const additional = input["additionalToolchains"];
+	if (additional !== void 0 && !Array.isArray(additional)) throw new Error("cloud.rust.additionalToolchains requires exact stable releases");
+	const additionalToolchains = additional === void 0 ? [] : Array.from(additional, (pin) => {
+		if (!exactPin(pin)) throw new Error("cloud.rust.additionalToolchains requires exact stable releases");
+		return pin;
+	});
+	if (new Set(additionalToolchains).size !== additionalToolchains.length) throw new Error("cloud.rust.additionalToolchains contains duplicates");
 	return {
+		additionalToolchains,
 		...toolchain === void 0 ? {} : { toolchain },
 		components: parseCloudRustNames(input["components"], "components"),
 		targets: parseCloudRustNames(input["targets"], "targets")
@@ -838,6 +863,11 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 		if (channel !== rust && !rustExceptions.some(({ pin }) => pin === channel)) throw new Error(`cloud Rust must use shared Rust ${rust} or a recorded rustExceptions pin`);
 		if (cloud.rust?.toolchain !== void 0 && cloud.rust.toolchain !== channel) throw new Error("cloud.rust.toolchain conflicts with root Rust toolchain");
 	}
+	const additionalToolchains = cloud.rust?.additionalToolchains ?? [];
+	for (const pin of additionalToolchains) {
+		if (pin === channel) throw new Error("cloud.rust.additionalToolchains must not repeat the primary toolchain");
+		if (pin !== rust && !rustExceptions.some(({ pin: authorized }) => authorized === pin)) throw new Error(`cloud.rust.additionalToolchains ${pin} requires an authorized rustExceptions pin`);
+	}
 	const components = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["components"], "components"), ...cloud.rust?.components ?? []])].sort();
 	const targets = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["targets"], "targets"), ...cloud.rust?.targets ?? []])].sort();
 	const resolveTool = (tool, version) => {
@@ -868,6 +898,7 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 	return {
 		rust: rustEnabled && typeof channel === "string" ? {
 			channel,
+			additionalToolchains: [...additionalToolchains].sort(),
 			components,
 			targets,
 			installer: cloudSetupArtifacts["rustup-init"]
@@ -904,7 +935,7 @@ rust_run() {
     *) fail 'Invalid Rust execution mode' ;;
   esac
 }
-rust_ready() {
+primary_rust_ready() {
   local directory
   for directory in "$RUSTUP_HOME" "$CARGO_HOME"; do
     [[ -d "$directory" && ! -L "$directory" && "$(stat -c '%u' "$directory")" == "$OUTPUT_UID" ]] || return 1
@@ -918,13 +949,19 @@ rust_ready() {
   @VERIFY_TARGETS@
   return 0
 }
+rust_ready() {
+  local additional_version
+  primary_rust_ready || return 1
+  @VERIFY_ADDITIONAL_TOOLCHAINS@
+  return 0
+}
 verify_rust() { rust_ready || fail 'Pinned Rust, components or targets are unavailable; run install'; }
 install_rust() (
   if ! command -v cc >/dev/null || ! command -v ld >/dev/null || [[ ! -f /usr/include/stdlib.h ]]; then
     apt_refresh_for build-essential
     apt_install build-essential
   fi
-  local artifact_url artifact_sha
+  local artifact_url artifact_sha additional_version
   # Subshell scope retains scratch for EXIT cleanup after a failed command.
   scratch="$(mktemp -d)"
   trap 'rm -rf -- "$scratch"' EXIT
@@ -943,9 +980,10 @@ install_rust() (
     rust_run network "$scratch/rustup-init" -y --no-modify-path --default-toolchain none --profile minimal
   fi
   rust_run local "$CARGO_HOME/bin/rustup" set auto-self-update disable
-  if ! rust_ready; then
+  if ! primary_rust_ready; then
     rust_run network "$CARGO_HOME/bin/rustup" toolchain install @RUST@ --profile minimal --no-self-update @RUST_ARGS@
   fi
+  @INSTALL_ADDITIONAL_TOOLCHAINS@
   rust_run local "$CARGO_HOME/bin/rustup" default @RUST@
   verify_rust
   for tool in rustup cargo rustc rustdoc @RUST_PROXIES@; do
@@ -956,7 +994,7 @@ install_rust() (
     fi
   done
 )
-`.replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
+`.replace("@VERIFY_ADDITIONAL_TOOLCHAINS@", rust.additionalToolchains.map((pin) => `additional_version="$(rust_run local "$CARGO_HOME/bin/rustc" +${pin} --version)" || return 1\n  [[ "$additional_version" == 'rustc ${pin} '* ]] || return 1`).join("\n  ")).replace("@INSTALL_ADDITIONAL_TOOLCHAINS@", rust.additionalToolchains.map((pin) => `if ! additional_version="$(rust_run local "$CARGO_HOME/bin/rustc" +${pin} --version)" || [[ "$additional_version" != 'rustc ${pin} '* ]]; then\n    rust_run network "$CARGO_HOME/bin/rustup" toolchain install ${pin} --profile minimal --no-self-update\n  fi`).join("\n  ")).replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
 };
 const packageToolInstall = ({ tool, release }) => {
 	const name = tool.replaceAll("-", "_");
@@ -979,7 +1017,7 @@ install_${name}() {
 const artifactToolInstall = ({ tool, release }) => {
 	const directory = `/opt/stll-cloud/tools/${tool}/${release.version}`;
 	const command = tool === "wasm-bindgen-cli" ? "wasm-bindgen" : tool;
-	const marker = `${tool === "cargo-nextest" ? "cargo-nextest" : command} ${release.version}`;
+	const marker = `${tool === "gitleaks" ? "gitleaks version" : command} ${release.version}`;
 	return {
 		name: tool.replaceAll("-", "_"),
 		text: `verify_${tool.replaceAll("-", "_")}() {
@@ -1089,7 +1127,15 @@ OUTPUT_USER="$(getent passwd "$OUTPUT_UID" | cut -d: -f1)"
 OUTPUT_HOME="$(getent passwd "$OUTPUT_UID" | cut -d: -f6)"
 [[ -n "$OUTPUT_USER" && "$OUTPUT_HOME" == /* && -d "$OUTPUT_HOME" ]] || fail 'Invoking user requires an existing home directory'
 root() { "$@"; }
-service_run() { runuser -u stll-cloud -- "$@" 9>&-; }
+# Service daemons outlive setup, so they inherit no descriptor beyond stdio: a cloud
+# runner can pass its terminal as extra descriptors and wait until every copy closes.
+service_run() (
+  for descriptor in "/proc/$BASHPID/fd/"*; do
+    descriptor="$(basename -- "$descriptor")"
+    if [[ "$descriptor" =~ ^[0-9]+$ ]] && (( descriptor > 2 )); then eval "exec $descriptor>&-"; fi
+  done
+  exec runuser -u stll-cloud -- "$@"
+)
 BUN_VERSION='@BUN@'
 NODE_VERSION='@NODE@'
 NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
@@ -1108,19 +1154,35 @@ esac
 
 @NETWORK@
 
+node_ready() {
+  local node_version npm_version npx_version
+  [[ -x "$NODE_DIR/bin/node" && -x "$NODE_DIR/bin/npm" && -x "$NODE_DIR/bin/npx" ]] || return 1
+  node_version="$("$NODE_DIR/bin/node" --version)" || return 1
+  [[ "$node_version" == "v$NODE_VERSION" ]] || return 1
+  npm_version="$("$NODE_DIR/bin/npm" --version)" || return 1
+  [[ "$npm_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
+  npx_version="$("$NODE_DIR/bin/npx" --version)" || return 1
+  [[ "$npx_version" == "$npm_version" ]] || return 1
+}
 runtime_ready() {
-  [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
+  node_ready || fail 'Pinned Node, npm or npx is unavailable; run install'
   [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
 }
-install_runtimes() {
+install_runtimes() (
+  if [[ ! -s /etc/ssl/certs/ca-certificates.crt ]]; then
+    command -v update-ca-certificates >/dev/null || fail 'System CA certificate bundle is missing; restore ca-certificates in the base image offline before install'
+    update-ca-certificates || fail 'System CA certificate bundle could not be repaired offline; restore ca-certificates in the base image before install'
+  fi
+  [[ -s /etc/ssl/certs/ca-certificates.crt ]] || fail 'System CA certificate bundle is unavailable after offline repair; restore ca-certificates in the base image before install'
   if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null || ! ldconfig -p | awk '$1 == "libatomic.so.1" { found=1 } END { exit !found }'; then
     apt_refresh_for ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
     DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
   fi
-  local scratch node_archive bun_archive bun_folder
+  local node_archive bun_archive bun_folder
+  # Subshell scope retains scratch for EXIT cleanup after a failed command.
   scratch="$(mktemp -d)"
-  trap 'rm -rf -- "$scratch"' RETURN
-  if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
+  trap 'rm -rf -- "$scratch"' EXIT
+  if ! node_ready; then
     node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
     download_file "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" "$scratch/$node_archive" 120
     download_file "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" "$scratch/node-sums" 45
@@ -1143,9 +1205,7 @@ install_runtimes() {
   ln -sfnT -- "$NODE_DIR/bin/npm" /usr/local/bin/npm
   ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
   ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
-  rm -rf -- "$scratch"
-  trap - RETURN
-}
+)
 
 dependency_install() {
   local directory download_hosts
@@ -1309,16 +1369,16 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			valkey: policy.valkey
 		})]
 	]);
-	return script.replace(/@[A-Z0-9_]+@/g, (token) => {
+	return `${script.replace(/@[A-Z0-9_]+@/g, (token) => {
 		const value = replacements.get(token);
 		if (value === void 0) throw new Error(`Missing cloud setup field: ${token}`);
 		return value;
-	});
+	}).replace(/[ \t]+$/gm, "").trimEnd()}\n`;
 };
 //#endregion
 //#region src/cloud-setup-claude.ts
 const cloudClaudeSettingsPath = ".claude/settings.json";
-const sessionStartHook = (script) => ({
+const releasedSessionStartHook = (script) => ({
 	matcher: "",
 	hooks: [{
 		type: "command",
@@ -1335,8 +1395,30 @@ const sessionStartHook = (script) => ({
 fi`
 	}]
 });
+const sessionStartHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    printf '\\n%s\\n' "$cloud_shell_exports" >> "$CLAUDE_ENV_FILE" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'
+  fi
+fi`
+	}]
+});
 const cloudSessionStartHook = sessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`);
-const previousCloudSessionStartHooks = [sessionStartHook(`bash ${cloudSetupPath}`)];
+const previousCloudSessionStartHooks = [releasedSessionStartHook(`bash ${cloudSetupPath}`), releasedSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)];
 const cloudAttribution = {
 	commit: "",
 	pr: ""
@@ -1570,6 +1652,18 @@ const javascriptDependencyLockfiles = [
 	"yarn.lock",
 	"pnpm-lock.yaml"
 ];
+const dependabotManifestEcosystems = {
+	Gemfile: "bundler",
+	"Gemfile.lock": "bundler",
+	"composer.json": "composer",
+	"composer.lock": "composer"
+};
+/** Share ecosystem inventory with snapshot selection; no dependency graph reads are needed. */
+const dependabotManifestEcosystem = (file) => {
+	if (excludedInputPath(file)) return void 0;
+	const basename = file.split("/").at(-1);
+	for (const [name, ecosystem] of Object.entries(dependabotManifestEcosystems)) if (basename === name) return ecosystem;
+};
 /** Match project, environment, local, and fragment filenames recognized by mise. */
 const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
 /** GitHub action metadata may live at the repository root or in any directory. */
@@ -1608,7 +1702,7 @@ const toolchainInputKind = (file, text = "") => {
 	if (file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
 	if (githubAutomationFileKind(file) !== void 0) return "config";
 	if (excludedInputPath(file)) return void 0;
-	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (dependabotManifestEcosystem(file) !== void 0 || pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
@@ -1642,6 +1736,12 @@ Object.defineProperty(exports, "containerDocumentImages", {
 		return containerDocumentImages;
 	}
 });
+Object.defineProperty(exports, "dependabotManifestEcosystem", {
+	enumerable: true,
+	get: function() {
+		return dependabotManifestEcosystem;
+	}
+});
 Object.defineProperty(exports, "generateCloudSetup", {
 	enumerable: true,
 	get: function() {