deadwood-scan 0.2.0 → 0.3.0

package/dist/index.js

@@ -8,7 +8,7 @@ import ora from "ora";
 import pc2 from "picocolors";
 
 // ../core/src/index.ts
-import fs8 from "fs";
+import fs9 from "fs";
 import path11 from "path";
 import { glob as glob2 } from "tinyglobby";
 
@@ -981,6 +981,11 @@ var SIGNAL_LIST = [
   spare("static:string-dispatch", 20, "Symbol appears in a string-keyed dispatch table"),
   spare("static:script-reference", 60, "Referenced by a package.json script"),
   spare("static:config-reference", 60, "Referenced by a build/deploy config"),
+  spare(
+    "static:dev-config-reference",
+    60,
+    "Referenced by a tooling config file (eslint/babel/CI/\u2026) rather than an import"
+  ),
   spare("static:manifest-reference", 60, "Referenced by a caller manifest (cron/CI/k8s)"),
   spare("static:job-registration", 50, "File registers scheduled jobs or queue workers"),
   spare(
@@ -1926,6 +1931,126 @@ function truncate(s) {
   return s.length > 60 ? s.slice(0, 57) + "\u2026" : s;
 }
 
+// ../core/src/evidence/depConfigRefs.ts
+import fs8 from "fs";
+import { globSync } from "tinyglobby";
+var CONFIG_GLOBS = [
+  "**/.eslintrc",
+  "**/.eslintrc.{json,yml,yaml,js,cjs}",
+  "**/eslint.config.{js,cjs,mjs,ts}",
+  "**/.babelrc",
+  "**/.babelrc.{json,js,cjs}",
+  "**/babel.config.{json,js,cjs,mjs}",
+  "**/.prettierrc",
+  "**/.prettierrc.{json,yml,yaml,js,cjs}",
+  "**/prettier.config.{js,cjs,mjs}",
+  "**/.mocharc.{json,yml,yaml,js,cjs}",
+  "**/jest.config.{js,cjs,mjs,ts,json}",
+  "**/jest.setup.{js,cjs,mjs,ts}",
+  "**/vitest.config.{js,cjs,mjs,ts}",
+  "**/webpack.config.{js,cjs,mjs,ts}",
+  "**/rollup.config.{js,cjs,mjs,ts}",
+  "**/tsup.config.{js,cjs,mjs,ts}",
+  "**/playwright.config.{js,cjs,mjs,ts}",
+  "**/cypress.config.{js,cjs,mjs,ts}",
+  "**/karma.conf.{js,cjs}",
+  "**/tsconfig*.json",
+  "**/.lintstagedrc",
+  "**/.lintstagedrc.{json,yml,yaml}",
+  "**/nyc.config.js",
+  "**/.nycrc",
+  "**/.nycrc.{json,yml,yaml}",
+  "**/commitlint.config.{js,cjs,mjs}",
+  "**/.github/workflows/*.{yml,yaml}",
+  "**/.travis.yml",
+  "**/appveyor.yml",
+  "**/azure-pipelines.yml",
+  "**/.gitlab-ci.yml"
+];
+var CONFIG_PRESENCE = [
+  { dep: "typescript", file: /^tsconfig[^/]*\.json$/ },
+  { dep: "prettier", file: /^\.prettierrc|^prettier\.config\./ },
+  { dep: "eslint", file: /^\.eslintrc|^eslint\.config\./ },
+  { dep: "jest", file: /^jest\.(config|setup)\./ },
+  { dep: "vitest", file: /^vitest\.config\./ },
+  { dep: "mocha", file: /^\.mocharc/ },
+  { dep: "nyc", file: /^\.nycrc|^nyc\.config\./ },
+  { dep: "karma", file: /^karma\.conf\./ }
+];
+var IGNORE = ["**/node_modules/**", "**/dist/**", "**/.git/**"];
+var MAX_FILES = 100;
+var MAX_FILE_BYTES = 256 * 1024;
+var depConfigRefs = {
+  name: "dep-config-references",
+  provide(ctx, findings) {
+    const deps = findings.filter(
+      (f) => f.category === "unused-dependency" && f.target.kind === "dependency"
+    );
+    if (deps.length === 0) return;
+    const configs = readConfigFiles(ctx);
+    if (configs.length === 0) return;
+    for (const finding of deps) {
+      if (finding.target.kind !== "dependency") continue;
+      const name = finding.target.name;
+      const hit = configs.find((c) => referencesDep(c, name));
+      if (hit) {
+        addOnce(finding, evidenceFor("static:dev-config-reference", `Referenced in ${hit.rel}`));
+        continue;
+      }
+      const presence = CONFIG_PRESENCE.find((p) => p.dep === name);
+      const owner = presence && configs.find((c) => presence.file.test(c.base));
+      if (owner) {
+        addOnce(
+          finding,
+          evidenceFor("static:dev-config-reference", `Its config file exists: ${owner.rel}`)
+        );
+      }
+    }
+  }
+};
+function readConfigFiles(ctx) {
+  let paths;
+  try {
+    paths = globSync(CONFIG_GLOBS, { cwd: ctx.root, ignore: IGNORE, absolute: true, dot: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const p of paths.map(toPosix).sort().slice(0, MAX_FILES)) {
+    try {
+      if (fs8.statSync(p).size > MAX_FILE_BYTES) continue;
+      out.push({
+        rel: ctx.rel(p),
+        base: p.slice(p.lastIndexOf("/") + 1).toLowerCase(),
+        text: fs8.readFileSync(p, "utf8")
+      });
+    } catch {
+    }
+  }
+  return out;
+}
+function referencesDep(config, depName) {
+  if (wordMatch(config.text, depName)) return true;
+  if (config.base.includes("eslint")) {
+    const m = /^eslint-(?:plugin|config)-(.+)$/.exec(depName);
+    if (m && wordMatch(config.text, m[1])) return true;
+    const scoped = /^(@[^/]+)\/eslint-config$/.exec(depName);
+    if (scoped && wordMatch(config.text, scoped[1])) return true;
+  }
+  if (config.base.includes("babel")) {
+    const m = /^babel-(?:plugin|preset)-(.+)$/.exec(depName);
+    if (m && wordMatch(config.text, m[1])) return true;
+  }
+  return false;
+}
+function wordMatch(text, name) {
+  const re = new RegExp(`(^|[^\\w@/-])${escapeRe2(name)}($|[^\\w-])`, "m");
+  return re.test(text);
+}
+function escapeRe2(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // ../core/src/evidence/jobRegistration.ts
 import ts6 from "typescript";
 var JOB_PACKAGES = /* @__PURE__ */ new Set([
@@ -2065,6 +2190,26 @@ var DEFAULT_EXCLUDE = [
   "**/*.d.ts",
   "**/*.min.js"
 ];
+var NOISE_EXCLUDE = [
+  // Generated code — owned by a generator, not deletable by hand.
+  "**/generated/**",
+  "**/__generated__/**",
+  "**/*.generated.*",
+  "**/.prisma/**",
+  // Example/demo code — each file is its own intentional entry point.
+  "**/examples/**",
+  "**/example/**",
+  "**/samples/**",
+  "**/sample/**",
+  // Test scaffolding — referenced by test runners in ways imports don't show
+  // (jest loads __mocks__/ and setup files by convention/config string).
+  "**/fixtures/**",
+  "**/__fixtures__/**",
+  "**/__mocks__/**",
+  "**/testdata/**",
+  "**/jest.setup.*",
+  "**/vitest.setup.*"
+];
 var ALL_CATEGORIES = [
   "dead-route",
   "unused-export",
@@ -2089,6 +2234,7 @@ var PROVIDERS = [
   dynamicImports,
   stringDispatch,
   packageScripts,
+  depConfigRefs,
   jobRegistration,
   manifestReference,
   comments
@@ -2096,37 +2242,43 @@ var PROVIDERS = [
 async function scan(options) {
   const startedAt = Date.now();
   const root = absPosix(options.path);
-  if (!fs8.existsSync(root) || !fs8.statSync(root).isDirectory()) {
+  if (!fs9.existsSync(root) || !fs9.statSync(root).isDirectory()) {
     throw new ScanError("INVALID_PATH", `Not a directory: ${options.path}`);
   }
   const warnings = [];
   const { units: allUnits, warnings: wsWarnings } = await discoverWorkspaces(root);
   warnings.push(...wsWarnings);
   const units = options.workspaces && options.workspaces.length > 0 ? allUnits.filter((u, i) => i === 0 || options.workspaces.includes(u.name)) : allUnits;
-  const files = await glob2([...DEFAULT_INCLUDE, ...options.include ?? []], {
-    cwd: root,
-    ignore: [...DEFAULT_EXCLUDE, ...options.exclude ?? []],
-    absolute: true,
-    dot: true
-  });
+  const include = [...DEFAULT_INCLUDE, ...options.include ?? []];
+  const baseIgnore = [...DEFAULT_EXCLUDE, ...options.exclude ?? []];
+  const globOpts = { cwd: root, absolute: true, dot: true, followSymbolicLinks: false };
+  const files = await glob2(include, { ...globOpts, ignore: baseIgnore });
   if (files.length === 0) {
     throw new ScanError("NO_SOURCE_FILES", `No JS/TS source files found under ${options.path}`);
   }
+  const reportableFiles = options.defaultExcludes === false ? void 0 : new Set(
+    (await glob2(include, { ...globOpts, ignore: [...baseIgnore, ...NOISE_EXCLUDE] })).map(
+      toPosix
+    )
+  );
   const graph = new ModuleGraph();
   for (const file of files.map(toPosix).sort()) {
+    const source = readSourceSafe(file, warnings, (f) => relPosix(root, f));
+    if (source === void 0) continue;
     try {
-      graph.addFile(parseFile(file, fs8.readFileSync(file, "utf8")));
+      graph.addFile(parseFile(file, source));
     } catch {
       warnings.push(`Could not parse ${relPosix(root, file)}; it is excluded from analysis.`);
     }
   }
-  const scannedFiles = new Set(graph.files.keys());
-  const wsEntries = units.filter((u) => u.name !== ".").map((u) => ({ name: u.name, dir: u.dir, entryFile: guessUnitEntry(u, scannedFiles) }));
-  graph.link(new Resolver(root, wsEntries, scannedFiles, warnings));
-  const manifestCallers = await collectManifestCallers(root, scannedFiles, warnings);
+  const parsedFiles = new Set(graph.files.keys());
+  const scannedFiles = reportableFiles ? new Set([...parsedFiles].filter((f) => reportableFiles.has(f))) : parsedFiles;
+  const wsEntries = units.filter((u) => u.name !== ".").map((u) => ({ name: u.name, dir: u.dir, entryFile: guessUnitEntry(u, parsedFiles) }));
+  graph.link(new Resolver(root, wsEntries, parsedFiles, warnings));
+  const manifestCallers = await collectManifestCallers(root, parsedFiles, warnings);
   const entriesByUnit = /* @__PURE__ */ new Map();
   for (const unit of units) {
-    entriesByUnit.set(unit, discoverEntryPoints(unit, scannedFiles, warnings));
+    entriesByUnit.set(unit, discoverEntryPoints(unit, parsedFiles, warnings));
   }
   const rootUnit = units[0];
   for (const caller of manifestCallers) {
@@ -2137,7 +2289,7 @@ async function scan(options) {
     });
   }
   for (const ref of options.entries ?? []) {
-    const resolved = resolveEntryRef(root, ref, scannedFiles) ?? tryFile(path11.resolve(root, ref));
+    const resolved = resolveEntryRef(root, ref, parsedFiles) ?? tryFile(path11.resolve(root, ref));
     if (resolved) {
       pushEntry(entriesByUnit, unitForFile(units, toPosix(resolved)), {
         file: toPosix(resolved),
@@ -2151,7 +2303,7 @@ async function scan(options) {
   for (const unit of units) {
     const eps = entriesByUnit.get(unit);
     if (!eps.some((e) => e.tag !== "test" && e.reason !== "config")) {
-      const guess = guessUnitEntry(unit, scannedFiles);
+      const guess = guessUnitEntry(unit, parsedFiles);
       if (guess)
         pushEntry(entriesByUnit, unit, { file: guess, reason: "main", detail: "convention" });
     }
@@ -2223,10 +2375,28 @@ async function scan(options) {
     root,
     workspaces: units.map((u) => u.name),
     findings,
-    stats: computeStats(graph, units, findings, routesTotal, Date.now() - startedAt),
+    stats: computeStats(graph, scannedFiles, units, findings, routesTotal, Date.now() - startedAt),
     warnings: [...new Set(warnings)]
   };
 }
+var MAX_SOURCE_BYTES = 8 * 1024 * 1024;
+function readSourceSafe(file, warnings, rel) {
+  try {
+    const st = fs9.lstatSync(file);
+    if (!st.isFile()) {
+      warnings.push(`Skipped ${rel(file)}: not a regular file (symlink or special file).`);
+      return void 0;
+    }
+    if (st.size > MAX_SOURCE_BYTES) {
+      warnings.push(`Skipped ${rel(file)}: exceeds ${MAX_SOURCE_BYTES} bytes.`);
+      return void 0;
+    }
+    return fs9.readFileSync(file, "utf8");
+  } catch {
+    warnings.push(`Could not read ${rel(file)}; it is excluded from analysis.`);
+    return void 0;
+  }
+}
 function pushEntry(map, unit, entry) {
   const list = map.get(unit);
   if (!list) {
@@ -2258,7 +2428,14 @@ async function collectManifestCallers(root, scannedFiles, warnings) {
       "**/cron.d/**",
       "webpack.config.{js,cjs,mjs,ts}"
     ],
-    { cwd: root, ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"], dot: true }
+    // followSymbolicLinks:false — same untrusted-content rule as the source
+    // globs (a symlinked serverless.yml → host file must not be read).
+    {
+      cwd: root,
+      ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"],
+      dot: true,
+      followSymbolicLinks: false
+    }
   );
   for (const rel of manifestFiles.map(toPosix).sort()) {
     try {
@@ -2281,23 +2458,24 @@ async function collectManifestCallers(root, scannedFiles, warnings) {
   }
   return callers.filter((c) => scannedFiles.has(c.file));
 }
-function computeStats(graph, units, findings, routesTotal, durationMs) {
+function computeStats(graph, scannedFiles, units, findings, routesTotal, durationMs) {
   const flagged = (category) => findings.filter((f) => f.category === category && f.confidence.score >= 50).length;
   let exportsTotal = 0;
-  for (const pf of graph.files.values()) {
-    exportsTotal += new Set(pf.exports.map((e) => e.name)).size;
+  for (const file of scannedFiles) {
+    const pf = graph.files.get(file);
+    if (pf) exportsTotal += new Set(pf.exports.map((e) => e.name)).size;
   }
   let depsTotal = 0;
   for (const u of units) {
     depsTotal += Object.keys(u.packageJson.dependencies ?? {}).length + Object.keys(u.packageJson.devDependencies ?? {}).length;
   }
   return {
-    filesScanned: graph.files.size,
+    filesScanned: scannedFiles.size,
     durationMs,
     routes: { total: routesTotal, flagged: flagged("dead-route") },
     exports: { total: exportsTotal, flagged: flagged("unused-export") },
     dependencies: { total: depsTotal, flagged: flagged("unused-dependency") },
-    files: { total: graph.files.size, flagged: flagged("unreachable-file") }
+    files: { total: scannedFiles.size, flagged: flagged("unreachable-file") }
   };
 }
 
@@ -2509,7 +2687,10 @@ var CATEGORIES = [
 ];
 var LEVEL_RANK2 = { low: 0, medium: 1, high: 2 };
 var program = new Command();
-program.name("deadwood").description("Find dead code and prove it \u2014 scans a JS/TS repo and prints a shock report").version(pkg.version).argument("[path]", "directory to scan", ".").option("--json", "machine-readable ScanResult on stdout").option("--md", "markdown report (PR comments / Slack)").option("--fail-on <spec>", "CI gate: 'high', 'medium', or 'high:5' (exit 1 when tripped)").option("--include <glob...>", "extra include globs").option("--exclude <glob...>", "extra exclude globs").addOption(new Option("--category <category...>", "limit findings").choices(CATEGORIES)).option("--workspace <name...>", "limit monorepo scan to these packages").addOption(
+program.name("deadwood").description("Find dead code and prove it \u2014 scans a JS/TS repo and prints a shock report").version(pkg.version).argument("[path]", "directory to scan", ".").option("--json", "machine-readable ScanResult on stdout").option("--md", "markdown report (PR comments / Slack)").option("--fail-on <spec>", "CI gate: 'high', 'medium', or 'high:5' (exit 1 when tripped)").option("--include <glob...>", "extra include globs").option("--exclude <glob...>", "extra exclude globs").option(
+  "--no-default-excludes",
+  "also scan generated/, examples/, fixtures/, __mocks__/ (excluded by default as noise)"
+).addOption(new Option("--category <category...>", "limit findings").choices(CATEGORIES)).option("--workspace <name...>", "limit monorepo scan to these packages").addOption(
   new Option("--framework <framework...>", "force route framework detection").choices([
     "express",
     "fastify",
@@ -2550,6 +2731,7 @@ async function run(path12, opts) {
       path: path12,
       include: opts.include,
       exclude: opts.exclude,
+      defaultExcludes: opts.defaultExcludes,
       categories: opts.category,
       frameworks: opts.framework,
       entries: opts.entry,