@stll/oxlint-config 1.3.0 → 1.4.0

package/dist/toolchain-inputs.mjs

@@ -375,6 +375,21 @@ const cloudSetupArtifacts = {
 			binaries: { "rustup-init": "rustup-init" }
 		}
 	},
+	gitleaks: {
+		version: "8.30.1",
+		amd64: {
+			url: "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz",
+			sha256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
+			archive: "tar.gz",
+			binaries: { gitleaks: "gitleaks" }
+		},
+		arm64: {
+			url: "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_arm64.tar.gz",
+			sha256: "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+			archive: "tar.gz",
+			binaries: { gitleaks: "gitleaks" }
+		}
+	},
 	"cargo-nextest": {
 		version: "0.9.148",
 		amd64: {
@@ -442,7 +457,8 @@ const cloudSetupArtifactVersions = {
 	"rustup-init": [cloudSetupArtifacts["rustup-init"]],
 	"cargo-nextest": [cloudSetupArtifacts["cargo-nextest"]],
 	"wasm-bindgen-cli": wasmBindgenArtifactReleases,
-	uv: [cloudSetupArtifacts.uv]
+	uv: [cloudSetupArtifacts.uv],
+	gitleaks: [cloudSetupArtifacts.gitleaks]
 };
 /** A new version requires an explicit, verified catalog entry; never build from source. */
 const getCloudSetupArtifact = (tool, version) => {
@@ -497,11 +513,20 @@ const parseRust = (input) => {
 	if (!object(input) || Object.keys(input).some((key) => ![
 		"toolchain",
 		"components",
-		"targets"
-	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components and targets");
+		"targets",
+		"additionalToolchains"
+	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components, targets and additionalToolchains");
 	const toolchain = input["toolchain"];
 	if (toolchain !== void 0 && !exactPin(toolchain)) throw new Error("cloud.rust.toolchain must be an exact stable release");
+	const additional = input["additionalToolchains"];
+	if (additional !== void 0 && !Array.isArray(additional)) throw new Error("cloud.rust.additionalToolchains requires exact stable releases");
+	const additionalToolchains = additional === void 0 ? [] : Array.from(additional, (pin) => {
+		if (!exactPin(pin)) throw new Error("cloud.rust.additionalToolchains requires exact stable releases");
+		return pin;
+	});
+	if (new Set(additionalToolchains).size !== additionalToolchains.length) throw new Error("cloud.rust.additionalToolchains contains duplicates");
 	return {
+		additionalToolchains,
 		...toolchain === void 0 ? {} : { toolchain },
 		components: parseCloudRustNames(input["components"], "components"),
 		targets: parseCloudRustNames(input["targets"], "targets")
@@ -835,6 +860,11 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 		if (channel !== rust && !rustExceptions.some(({ pin }) => pin === channel)) throw new Error(`cloud Rust must use shared Rust ${rust} or a recorded rustExceptions pin`);
 		if (cloud.rust?.toolchain !== void 0 && cloud.rust.toolchain !== channel) throw new Error("cloud.rust.toolchain conflicts with root Rust toolchain");
 	}
+	const additionalToolchains = cloud.rust?.additionalToolchains ?? [];
+	for (const pin of additionalToolchains) {
+		if (pin === channel) throw new Error("cloud.rust.additionalToolchains must not repeat the primary toolchain");
+		if (pin !== rust && !rustExceptions.some(({ pin: authorized }) => authorized === pin)) throw new Error(`cloud.rust.additionalToolchains ${pin} requires an authorized rustExceptions pin`);
+	}
 	const components = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["components"], "components"), ...cloud.rust?.components ?? []])].sort();
 	const targets = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["targets"], "targets"), ...cloud.rust?.targets ?? []])].sort();
 	const resolveTool = (tool, version) => {
@@ -865,6 +895,7 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 	return {
 		rust: rustEnabled && typeof channel === "string" ? {
 			channel,
+			additionalToolchains: [...additionalToolchains].sort(),
 			components,
 			targets,
 			installer: cloudSetupArtifacts["rustup-init"]
@@ -901,7 +932,7 @@ rust_run() {
     *) fail 'Invalid Rust execution mode' ;;
   esac
 }
-rust_ready() {
+primary_rust_ready() {
   local directory
   for directory in "$RUSTUP_HOME" "$CARGO_HOME"; do
     [[ -d "$directory" && ! -L "$directory" && "$(stat -c '%u' "$directory")" == "$OUTPUT_UID" ]] || return 1
@@ -915,13 +946,19 @@ rust_ready() {
   @VERIFY_TARGETS@
   return 0
 }
+rust_ready() {
+  local additional_version
+  primary_rust_ready || return 1
+  @VERIFY_ADDITIONAL_TOOLCHAINS@
+  return 0
+}
 verify_rust() { rust_ready || fail 'Pinned Rust, components or targets are unavailable; run install'; }
 install_rust() (
   if ! command -v cc >/dev/null || ! command -v ld >/dev/null || [[ ! -f /usr/include/stdlib.h ]]; then
     apt_refresh_for build-essential
     apt_install build-essential
   fi
-  local artifact_url artifact_sha
+  local artifact_url artifact_sha additional_version
   # Subshell scope retains scratch for EXIT cleanup after a failed command.
   scratch="$(mktemp -d)"
   trap 'rm -rf -- "$scratch"' EXIT
@@ -940,9 +977,10 @@ install_rust() (
     rust_run network "$scratch/rustup-init" -y --no-modify-path --default-toolchain none --profile minimal
   fi
   rust_run local "$CARGO_HOME/bin/rustup" set auto-self-update disable
-  if ! rust_ready; then
+  if ! primary_rust_ready; then
     rust_run network "$CARGO_HOME/bin/rustup" toolchain install @RUST@ --profile minimal --no-self-update @RUST_ARGS@
   fi
+  @INSTALL_ADDITIONAL_TOOLCHAINS@
   rust_run local "$CARGO_HOME/bin/rustup" default @RUST@
   verify_rust
   for tool in rustup cargo rustc rustdoc @RUST_PROXIES@; do
@@ -953,7 +991,7 @@ install_rust() (
     fi
   done
 )
-`.replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
+`.replace("@VERIFY_ADDITIONAL_TOOLCHAINS@", rust.additionalToolchains.map((pin) => `additional_version="$(rust_run local "$CARGO_HOME/bin/rustc" +${pin} --version)" || return 1\n  [[ "$additional_version" == 'rustc ${pin} '* ]] || return 1`).join("\n  ")).replace("@INSTALL_ADDITIONAL_TOOLCHAINS@", rust.additionalToolchains.map((pin) => `if ! additional_version="$(rust_run local "$CARGO_HOME/bin/rustc" +${pin} --version)" || [[ "$additional_version" != 'rustc ${pin} '* ]]; then\n    rust_run network "$CARGO_HOME/bin/rustup" toolchain install ${pin} --profile minimal --no-self-update\n  fi`).join("\n  ")).replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
 };
 const packageToolInstall = ({ tool, release }) => {
 	const name = tool.replaceAll("-", "_");
@@ -976,7 +1014,7 @@ install_${name}() {
 const artifactToolInstall = ({ tool, release }) => {
 	const directory = `/opt/stll-cloud/tools/${tool}/${release.version}`;
 	const command = tool === "wasm-bindgen-cli" ? "wasm-bindgen" : tool;
-	const marker = `${tool === "cargo-nextest" ? "cargo-nextest" : command} ${release.version}`;
+	const marker = `${tool === "gitleaks" ? "gitleaks version" : command} ${release.version}`;
 	return {
 		name: tool.replaceAll("-", "_"),
 		text: `verify_${tool.replaceAll("-", "_")}() {
@@ -1086,7 +1124,15 @@ OUTPUT_USER="$(getent passwd "$OUTPUT_UID" | cut -d: -f1)"
 OUTPUT_HOME="$(getent passwd "$OUTPUT_UID" | cut -d: -f6)"
 [[ -n "$OUTPUT_USER" && "$OUTPUT_HOME" == /* && -d "$OUTPUT_HOME" ]] || fail 'Invoking user requires an existing home directory'
 root() { "$@"; }
-service_run() { runuser -u stll-cloud -- "$@" 9>&-; }
+# Service daemons outlive setup, so they inherit no descriptor beyond stdio: a cloud
+# runner can pass its terminal as extra descriptors and wait until every copy closes.
+service_run() (
+  for descriptor in "/proc/$BASHPID/fd/"*; do
+    descriptor="$(basename -- "$descriptor")"
+    if [[ "$descriptor" =~ ^[0-9]+$ ]] && (( descriptor > 2 )); then eval "exec $descriptor>&-"; fi
+  done
+  exec runuser -u stll-cloud -- "$@"
+)
 BUN_VERSION='@BUN@'
 NODE_VERSION='@NODE@'
 NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
@@ -1105,19 +1151,35 @@ esac
 
 @NETWORK@
 
+node_ready() {
+  local node_version npm_version npx_version
+  [[ -x "$NODE_DIR/bin/node" && -x "$NODE_DIR/bin/npm" && -x "$NODE_DIR/bin/npx" ]] || return 1
+  node_version="$("$NODE_DIR/bin/node" --version)" || return 1
+  [[ "$node_version" == "v$NODE_VERSION" ]] || return 1
+  npm_version="$("$NODE_DIR/bin/npm" --version)" || return 1
+  [[ "$npm_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
+  npx_version="$("$NODE_DIR/bin/npx" --version)" || return 1
+  [[ "$npx_version" == "$npm_version" ]] || return 1
+}
 runtime_ready() {
-  [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
+  node_ready || fail 'Pinned Node, npm or npx is unavailable; run install'
   [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
 }
-install_runtimes() {
+install_runtimes() (
+  if [[ ! -s /etc/ssl/certs/ca-certificates.crt ]]; then
+    command -v update-ca-certificates >/dev/null || fail 'System CA certificate bundle is missing; restore ca-certificates in the base image offline before install'
+    update-ca-certificates || fail 'System CA certificate bundle could not be repaired offline; restore ca-certificates in the base image before install'
+  fi
+  [[ -s /etc/ssl/certs/ca-certificates.crt ]] || fail 'System CA certificate bundle is unavailable after offline repair; restore ca-certificates in the base image before install'
   if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null || ! ldconfig -p | awk '$1 == "libatomic.so.1" { found=1 } END { exit !found }'; then
     apt_refresh_for ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
     DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
   fi
-  local scratch node_archive bun_archive bun_folder
+  local node_archive bun_archive bun_folder
+  # Subshell scope retains scratch for EXIT cleanup after a failed command.
   scratch="$(mktemp -d)"
-  trap 'rm -rf -- "$scratch"' RETURN
-  if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
+  trap 'rm -rf -- "$scratch"' EXIT
+  if ! node_ready; then
     node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
     download_file "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" "$scratch/$node_archive" 120
     download_file "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" "$scratch/node-sums" 45
@@ -1140,9 +1202,7 @@ install_runtimes() {
   ln -sfnT -- "$NODE_DIR/bin/npm" /usr/local/bin/npm
   ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
   ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
-  rm -rf -- "$scratch"
-  trap - RETURN
-}
+)
 
 dependency_install() {
   local directory download_hosts
@@ -1306,16 +1366,16 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			valkey: policy.valkey
 		})]
 	]);
-	return script.replace(/@[A-Z0-9_]+@/g, (token) => {
+	return `${script.replace(/@[A-Z0-9_]+@/g, (token) => {
 		const value = replacements.get(token);
 		if (value === void 0) throw new Error(`Missing cloud setup field: ${token}`);
 		return value;
-	});
+	}).replace(/[ \t]+$/gm, "").trimEnd()}\n`;
 };
 //#endregion
 //#region src/cloud-setup-claude.ts
 const cloudClaudeSettingsPath = ".claude/settings.json";
-const sessionStartHook = (script) => ({
+const releasedSessionStartHook = (script) => ({
 	matcher: "",
 	hooks: [{
 		type: "command",
@@ -1332,8 +1392,30 @@ const sessionStartHook = (script) => ({
 fi`
 	}]
 });
+const sessionStartHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    printf '\\n%s\\n' "$cloud_shell_exports" >> "$CLAUDE_ENV_FILE" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'
+  fi
+fi`
+	}]
+});
 const cloudSessionStartHook = sessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`);
-const previousCloudSessionStartHooks = [sessionStartHook(`bash ${cloudSetupPath}`)];
+const previousCloudSessionStartHooks = [releasedSessionStartHook(`bash ${cloudSetupPath}`), releasedSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)];
 const cloudAttribution = {
 	commit: "",
 	pr: ""
@@ -1567,6 +1649,18 @@ const javascriptDependencyLockfiles = [
 	"yarn.lock",
 	"pnpm-lock.yaml"
 ];
+const dependabotManifestEcosystems = {
+	Gemfile: "bundler",
+	"Gemfile.lock": "bundler",
+	"composer.json": "composer",
+	"composer.lock": "composer"
+};
+/** Share ecosystem inventory with snapshot selection; no dependency graph reads are needed. */
+const dependabotManifestEcosystem = (file) => {
+	if (excludedInputPath(file)) return void 0;
+	const basename = file.split("/").at(-1);
+	for (const [name, ecosystem] of Object.entries(dependabotManifestEcosystems)) if (basename === name) return ecosystem;
+};
 /** Match project, environment, local, and fragment filenames recognized by mise. */
 const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
 /** GitHub action metadata may live at the repository root or in any directory. */
@@ -1605,10 +1699,10 @@ const toolchainInputKind = (file, text = "") => {
 	if (file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
 	if (githubAutomationFileKind(file) !== void 0) return "config";
 	if (excludedInputPath(file)) return void 0;
-	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (dependabotManifestEcosystem(file) !== void 0 || pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
-export { nodeSelectorMatches as C, nodePolicyValid as S, parseCloudSetup as T, hasCloudAttribution as _, isPythonDependencyManifest as a, cloudSetupPath as b, pythonDependencyManifestKind as c, isComposeDefinitionPath as d, isKubernetesDefinitionPath as f, cloudSessionStartFix as g, cloudClaudeSettingsPath as h, isMiseConfigPath as i, toolchainInputKind as l, cloudAttributionFix as m, isDependabotGithubActionsPath as n, isShellScript as o, workspaceContains as p, isDockerDefinitionPath as r, javascriptDependencyLockfiles as s, githubAutomationFileKind as t, containerDocumentImages as u, hasCloudSessionStartHook as v, nodeSupportRangeMatches as w, generateCloudSetup as x, mergeCloudClaudeSettings as y };
+export { nodePolicyValid as C, parseCloudSetup as E, generateCloudSetup as S, nodeSupportRangeMatches as T, cloudSessionStartFix as _, isMiseConfigPath as a, mergeCloudClaudeSettings as b, javascriptDependencyLockfiles as c, containerDocumentImages as d, isComposeDefinitionPath as f, cloudClaudeSettingsPath as g, cloudAttributionFix as h, isDockerDefinitionPath as i, pythonDependencyManifestKind as l, workspaceContains as m, githubAutomationFileKind as n, isPythonDependencyManifest as o, isKubernetesDefinitionPath as p, isDependabotGithubActionsPath as r, isShellScript as s, dependabotManifestEcosystem as t, toolchainInputKind as u, hasCloudAttribution as v, nodeSelectorMatches as w, cloudSetupPath as x, hasCloudSessionStartHook as y };
 
 //# sourceMappingURL=toolchain-inputs.mjs.map