devkit-quality 0.1.0 → 0.1.1

package/dist/discovery.js

@@ -3,58 +3,205 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GENERATED_HINTS = exports.IGNORE_DIRS = exports.SOURCE_EXTENSIONS = void 0;
+exports.IGNORE_DIRS = exports.SOURCE_EXTENSIONS = void 0;
 exports.isRelevantFile = isRelevantFile;
 exports.isTestFile = isTestFile;
 exports.isGeneratedFile = isGeneratedFile;
 exports.isGeneratedByContent = isGeneratedByContent;
 exports.filterScannedFiles = filterScannedFiles;
+exports.discoverFiles = discoverFiles;
 exports.walkDirectory = walkDirectory;
+exports.toRelative = toRelative;
 exports.readFileSafe = readFileSafe;
 exports.countLines = countLines;
+const node_child_process_1 = require("node:child_process");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const glob_1 = require("./glob");
-exports.SOURCE_EXTENSIONS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs']);
-exports.IGNORE_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.devkit', 'generated', 'vendor', '.next', '.nuxt', '.svelte-kit', '.angular', 'out']);
-exports.GENERATED_HINTS = ['generated', 'dist', 'build', '.d.ts', '.min.', 'coverage', '.next', '.nuxt', '.svelte-kit', '.angular', 'out'];
+const ignore_1 = require("./ignore");
+exports.SOURCE_EXTENSIONS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.mts', '.cts']);
+// Tool caches and framework build output: never source, wherever they appear.
+exports.IGNORE_DIRS = new Set([
+    'node_modules', '.git', '.devkit', '.next', '.nuxt', '.svelte-kit', '.angular', '.turbo', '.cache',
+    '.vercel', '.output', '.parcel-cache', '.yarn', '.pnpm-store', '__pycache__', '.venv', '.idea'
+]);
+// Build-output names that are only build output when they sit directly in a package root
+// (next to a package.json). `src/build/` or `src/commands/out/` are ordinary source folders.
+// Deliberately excludes `vendor`: vendored/checked-in third-party code is sometimes kept out of
+// lint configs, but it is still real, committed content that must stay visible to a security scan.
+const PACKAGE_OUTPUT_DIRS = new Set(['dist', 'build', 'out', 'coverage']);
+const GENERATED_DIRS = new Set(['generated', '__generated__']);
+const MAX_SOURCE_FILE_BYTES = 1_500_000;
+const MAX_TEXT_FILE_BYTES = 1_000_000;
+// Files whose contents are machine-produced noise for a secret scan.
+const NON_SCANNABLE_TEXT = /(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|composer\.lock|Gemfile\.lock|Cargo\.lock|poetry\.lock|go\.sum)$|\.(?:map|svg|snap|lock)$/i;
+const BINARY_EXTENSIONS = /\.(?:png|jpe?g|gif|webp|ico|bmp|tiff?|avif|pdf|zip|gz|tgz|bz2|xz|7z|rar|jar|war|class|exe|dll|so|dylib|o|a|wasm|woff2?|ttf|otf|eot|mp[34]|mov|avi|webm|wav|ogg|flac|psd|sketch|fig|db|sqlite3?|bin|dat|pyc)$/i;
 function isRelevantFile(filePath) {
-    const ext = node_path_1.default.extname(filePath).toLowerCase();
-    return exports.SOURCE_EXTENSIONS.has(ext);
+    return exports.SOURCE_EXTENSIONS.has(node_path_1.default.extname(filePath).toLowerCase());
 }
 function isTestFile(filePath) {
-    const lower = filePath.toLowerCase();
-    return lower.includes('.test.') || lower.includes('.spec.') || lower.includes('__tests__');
+    const lower = filePath.replace(/\\/g, '/').toLowerCase();
+    return (/\.(?:test|spec|e2e|stories)\.[cm]?[jt]sx?$/.test(lower) ||
+        /(?:^|\/)(?:__tests__|__mocks__|__fixtures__|tests?|e2e|cypress|playwright|fixtures?)\//.test(lower));
 }
 function isGeneratedFile(filePath) {
-    const lower = filePath.replace(/\\/g, '/').toLowerCase();
-    const segments = lower.split('/');
-    const generatedDirectories = new Set(['generated', 'dist', 'build', 'coverage', '.next', '.nuxt', '.svelte-kit', '.angular', 'out']);
+    const segments = filePath.replace(/\\/g, '/').toLowerCase().split('/');
     const basename = segments[segments.length - 1] ?? '';
-    return segments.some((segment) => generatedDirectories.has(segment)) || basename.endsWith('.d.ts') || basename.includes('.min.');
+    return (segments.some((segment) => exports.IGNORE_DIRS.has(segment) || GENERATED_DIRS.has(segment)) ||
+        /\.d\.[cm]?ts$/.test(basename) ||
+        /[.-]min\.[cm]?js$/.test(basename) ||
+        /\.bundle\.[cm]?js$/.test(basename));
+}
+/** The comment block (and blank lines) at the very top of a file, before any code. */
+function leadingCommentBlock(text) {
+    const header = [];
+    for (const line of text.split(/\r\n|\r|\n/, 40)) {
+        const trimmed = line.trim();
+        if (trimmed && !/^(?:\/\/|\/\*|\*|#!|'use |"use )/.test(trimmed))
+            break;
+        header.push(line);
+    }
+    return header.join('\n');
 }
+/**
+ * Only the leading comment block is inspected: a "do not edit" note inside a hand-written
+ * file must not hide that file from the scan.
+ */
 function isGeneratedByContent(text) {
-    return /(?:@generated|\bDO NOT EDIT\b|\bGENERATED FILE\b)/i.test(text) || /^\/\/[#@]\s*sourceMappingURL=/m.test(text);
+    const header = leadingCommentBlock(text);
+    // `DO NOT EDIT` is matched case-sensitively: generators emit it uppercase, while a human's
+    // "do not edit this by hand" note is not a generated-file marker.
+    if (/\bDO NOT EDIT\b/.test(header) || /@generated\b|\bauto-?generated\b|\bGENERATED FILE\b|\bThis file (?:is|was) (?:automatically )?generated\b/i.test(header)) {
+        return true;
+    }
+    if (/^\/\/[#@]\s*sourceMappingURL=/m.test(text.slice(-400)))
+        return true;
+    return looksMinified(text);
+}
+function looksMinified(text) {
+    if (text.length < 5000)
+        return false;
+    const lines = text.split('\n');
+    return text.length / lines.length > 300;
+}
+function isBinaryContent(buffer) {
+    const sample = buffer.subarray(0, 8000);
+    return sample.includes(0);
+}
+function listGitFiles(projectRoot) {
+    try {
+        const output = (0, node_child_process_1.execFileSync)('git', ['-C', projectRoot, 'ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            maxBuffer: 256 * 1024 * 1024
+        });
+        const listed = output.split('\0').filter(Boolean);
+        // An empty listing usually means the folder is itself ignored by an enclosing repository.
+        if (listed.length === 0)
+            return null;
+        return listed
+            .map((relative) => node_path_1.default.join(projectRoot, relative))
+            .filter((file) => {
+            try {
+                return node_fs_1.default.statSync(file).isFile();
+            }
+            catch {
+                return false; // tracked but deleted in the working tree
+            }
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/** Drops files inside ignored directories, including build output located in a package root. */
+function isInIgnoredDirectory(relativePath, packageRoots) {
+    const segments = relativePath.split('/');
+    for (let index = 0; index < segments.length - 1; index += 1) {
+        const segment = segments[index];
+        if (exports.IGNORE_DIRS.has(segment))
+            return true;
+        if (PACKAGE_OUTPUT_DIRS.has(segment) && packageRoots.has(segments.slice(0, index).join('/')))
+            return true;
+    }
+    return false;
+}
+function collectPackageRoots(relativeFiles) {
+    const roots = new Set(['']);
+    for (const relative of relativeFiles) {
+        if (relative === 'package.json' || relative.endsWith('/package.json')) {
+            roots.add(relative.slice(0, -'package.json'.length).replace(/\/$/, ''));
+        }
+    }
+    return roots;
 }
 function filterScannedFiles(allFiles, projectRoot, config, ignorePatterns) {
     const files = [];
     const generatedFiles = [];
+    const tooLarge = [];
     for (const file of allFiles) {
         if (!isRelevantFile(file))
             continue;
-        const relative = node_path_1.default.relative(projectRoot, file).replace(/\\/g, '/');
+        const relative = toRelative(projectRoot, file);
         if (!(0, glob_1.matchesAnyGlob)(relative, config.scan.include))
             continue;
         if ((0, glob_1.matchesAnyGlob)(relative, config.scan.exclude) || (0, glob_1.matchesAnyGlob)(relative, ignorePatterns))
             continue;
-        const text = readFileSafe(file);
-        if (isGeneratedFile(relative) || isGeneratedByContent(text)) {
+        if (fileSize(file) > MAX_SOURCE_FILE_BYTES) {
+            tooLarge.push(relative);
+            continue;
+        }
+        if (isGeneratedFile(relative) || isGeneratedByContent(readFileSafe(file))) {
             generatedFiles.push(relative);
             continue;
         }
         files.push(file);
     }
-    return { files, generatedFiles };
+    return { files, generatedFiles, tooLarge };
+}
+function discoverFiles(projectRoot, config) {
+    const gitFiles = listGitFiles(projectRoot);
+    const ignorePatterns = (0, ignore_1.loadIgnorePatterns)(projectRoot, { includeGitignore: gitFiles === null });
+    const candidates = gitFiles ?? walkDirectory(projectRoot);
+    const relativeCandidates = candidates.map((file) => toRelative(projectRoot, file));
+    const packageRoots = collectPackageRoots(relativeCandidates);
+    const allFiles = candidates
+        .filter((_, index) => !isInIgnoredDirectory(relativeCandidates[index], packageRoots))
+        .filter((file) => !(0, glob_1.matchesAnyGlob)(toRelative(projectRoot, file), ignorePatterns))
+        .sort();
+    const { files, generatedFiles, tooLarge } = filterScannedFiles(allFiles, projectRoot, config, ignorePatterns);
+    const textFiles = [];
+    let binary = 0;
+    for (const file of allFiles) {
+        if (isRelevantFile(file))
+            continue;
+        const relative = toRelative(projectRoot, file);
+        if ((0, glob_1.matchesAnyGlob)(relative, config.scan.exclude))
+            continue;
+        if (BINARY_EXTENSIONS.test(file)) {
+            binary += 1;
+            continue;
+        }
+        if (NON_SCANNABLE_TEXT.test(relative))
+            continue;
+        if (fileSize(file) > MAX_TEXT_FILE_BYTES) {
+            tooLarge.push(relative);
+            continue;
+        }
+        let buffer;
+        try {
+            buffer = node_fs_1.default.readFileSync(file);
+        }
+        catch {
+            continue;
+        }
+        if (isBinaryContent(buffer)) {
+            binary += 1;
+            continue;
+        }
+        textFiles.push(file);
+    }
+    return { allFiles, files, textFiles, generatedFiles, skipped: { tooLarge, binary }, method: gitFiles ? 'git' : 'filesystem' };
 }
 function walkDirectory(rootDir) {
     const allFiles = [];
@@ -83,6 +230,17 @@ function walkDirectory(rootDir) {
     visit(rootDir);
     return allFiles;
 }
+function toRelative(projectRoot, file) {
+    return node_path_1.default.relative(projectRoot, file).replace(/\\/g, '/');
+}
+function fileSize(filePath) {
+    try {
+        return node_fs_1.default.statSync(filePath).size;
+    }
+    catch {
+        return 0;
+    }
+}
 function readFileSafe(filePath) {
     try {
         return node_fs_1.default.readFileSync(filePath, 'utf8');

package/dist/glob.js

@@ -7,11 +7,15 @@ function globToRegExp(pattern) {
     for (let i = 0; i < pattern.length; i += 1) {
         const char = pattern[i];
         if (char === '*' && pattern[i + 1] === '*') {
-            regex += '.*';
             i += 1;
             if (pattern[i + 1] === '/') {
+                // `**/` spans zero or more whole directories, so `**/lib` must not match `mylib`.
+                regex += '(?:.*/)?';
                 i += 1;
             }
+            else {
+                regex += '.*';
+            }
             continue;
         }
         if (char === '*') {

package/dist/ignore.js

@@ -6,9 +6,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadIgnorePatterns = loadIgnorePatterns;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-function loadIgnorePatterns(projectRoot) {
+/**
+ * Converts .gitignore-style lines into globs. A pattern with a leading or inner slash is
+ * anchored to the project root (`/lib` ignores `lib/`, not `src/lib/`); a bare name matches
+ * at any depth. Negations (`!pattern`) are not supported here — when the project is a git
+ * repository, git itself applies .gitignore and this is only used for .devkitignore.
+ */
+function loadIgnorePatterns(projectRoot, options = {}) {
+    const includeGitignore = options.includeGitignore ?? true;
     const patterns = new Set();
-    for (const name of ['.gitignore', '.devkitignore']) {
+    const sources = includeGitignore ? ['.gitignore', '.devkitignore'] : ['.devkitignore'];
+    for (const name of sources) {
         const file = node_path_1.default.join(projectRoot, name);
         if (!node_fs_1.default.existsSync(file))
             continue;
@@ -16,12 +24,13 @@ function loadIgnorePatterns(projectRoot) {
             const line = rawLine.trim();
             if (!line || line.startsWith('#') || line.startsWith('!'))
                 continue;
+            const anchored = line.startsWith('/') || line.replace(/\/$/, '').includes('/');
             const normalized = line.replace(/^\//, '').replace(/\/$/, '');
             if (!normalized)
                 continue;
-            patterns.add(normalized);
-            patterns.add(`**/${normalized}`);
-            patterns.add(`**/${normalized}/**`);
+            const prefix = anchored || normalized.startsWith('**/') ? '' : '**/';
+            patterns.add(`${prefix}${normalized}`);
+            patterns.add(`${prefix}${normalized}/**`);
         }
     }
     return [...patterns];

package/dist/moduleGraph.js

@@ -12,6 +12,7 @@ const parse_1 = require("./ast/parse");
 const walk_1 = require("./ast/walk");
 const glob_1 = require("./glob");
 const moduleResolution_1 = require("./moduleResolution");
+const TOOL_CONFIG_FILE = /(?:^|\/)(?:[\w.-]+\.config|\.[\w-]+rc)\.[cm]?[jt]sx?$/;
 function extractImportsAndExports(file, projectRoot, sourceFile, fileSet, resolutionContext) {
     const imports = [];
     const exports = [];
@@ -231,7 +232,9 @@ function resolveEntryPoints(projectRoot, files, packageJson, config) {
     // Keep the parameter explicit: framework and custom entry conventions are config-dependent.
     void config;
     for (const file of files) {
-        if ((0, discovery_1.isTestFile)(file)) {
+        const relative = node_path_1.default.relative(projectRoot, file).replace(/\\/g, '/');
+        // Tests and tool config files (vite.config.ts, eslint.config.mjs, ...) are loaded by tools, not imported.
+        if ((0, discovery_1.isTestFile)(relative) || TOOL_CONFIG_FILE.test(relative)) {
             entryPoints.add(file);
         }
     }