dsh-plugin-compat-check 0.1.0 → 0.1.2

package/kernel/lib/source-graph.mjs

@@ -0,0 +1,297 @@
+import fs from "node:fs";
+import path from "node:path";
+import { localImports } from "./syntax.mjs";
+
+const sourceFile = (file) =>
+  /\.[cm]?[jt]sx?$/.test(file) && !file.endsWith(".d.ts");
+const portable = (file) => file.split(path.sep).join("/");
+const inside = (root, file) =>
+  file === root || file.startsWith(root + path.sep);
+
+function hostEntry(meta) {
+  const exp = meta.exports;
+  const value = typeof exp === "string" ? exp : exp?.["."];
+  if (typeof value === "string") return value;
+  if (value && typeof value === "object")
+    for (const key of ["import", "node", "default", "require"]) {
+      if (typeof value[key] === "string") return value[key];
+      if (value[key] && typeof value[key] === "object")
+        for (const v of Object.values(value[key]))
+          if (typeof v === "string") return v;
+    }
+  return typeof meta.main === "string" ? meta.main : "index.js";
+}
+export function clientEntry(meta) {
+  const value = meta.exports?.["./client"];
+  if (typeof value === "string") return value;
+  if (value && typeof value === "object")
+    for (const key of ["browser", "import", "default"])
+      if (typeof value[key] === "string") return value[key];
+  return null;
+}
+
+/** Package-root links (pnpm) are resolved once; descendants stay in that root. */
+export function collectPackageSources(pkg, meta, options = {}) {
+  const root = fs.realpathSync(pkg),
+    started = Date.now();
+  const diagnostics = [],
+    skipped = [],
+    files = [],
+    buckets = new Map(),
+    fileSides = {};
+  const limits = {
+    files: 2000,
+    bytes: 32 * 1024 * 1024,
+    fileBytes: 2 * 1024 * 1024,
+    directories: 10000,
+    timeMs: 5000,
+    ...options.limits,
+  };
+  const texts = new Map(),
+    resolvedFiles = new Map(),
+    moduleLinks = new Map();
+  let bytes = 0;
+  const note = (kind, file, message) => {
+    if (diagnostics.length < 100) diagnostics.push({ kind, file, message });
+  };
+  const expired = () => Date.now() - started > limits.timeMs;
+  const resolveFile = (rel, required = false) => {
+    if (typeof rel !== "string") return null;
+    const abs = path.resolve(root, rel);
+    if (!inside(root, abs)) {
+      note(
+        "path-outside-package",
+        portable(rel),
+        "Relative path leaves canonical package root",
+      );
+      return null;
+    }
+    for (const name of [
+      abs,
+      ...[
+        ".js",
+        ".mjs",
+        ".cjs",
+        ".ts",
+        ".tsx",
+        ".jsx",
+        ".mts",
+        ".cts",
+        "/index.js",
+        "/index.mjs",
+        "/index.ts",
+      ].map((e) => abs + e),
+    ]) {
+      try {
+        const canonical = fs.realpathSync(name);
+        if (!inside(root, canonical)) {
+          note(
+            "path-outside-package",
+            portable(rel),
+            "Symlink leaves canonical package root",
+          );
+          return null;
+        }
+        if (fs.statSync(canonical).isFile())
+          return portable(path.relative(root, canonical));
+      } catch {
+        /* try next supported resolution */
+      }
+    }
+    if (required)
+      note(
+        "source-unresolved",
+        portable(rel),
+        "Entry or relative import cannot be read",
+      );
+    return null;
+  };
+  const read = (rel) => {
+    if (texts.has(rel)) return texts.get(rel);
+    if (expired() || texts.size >= limits.files) {
+      note("scan-budget-exceeded", rel, "File/time limit reached");
+      return null;
+    }
+    try {
+      const stat = fs.statSync(path.join(root, rel));
+      if (stat.size > limits.fileBytes || bytes + stat.size > limits.bytes) {
+        note("scan-budget-exceeded", rel, "Source byte limit reached");
+        return null;
+      }
+      const text = fs.readFileSync(path.join(root, rel), "utf8");
+      bytes += stat.size;
+      texts.set(rel, text);
+      return text;
+    } catch (error) {
+      note("source-unreadable", rel, error.message);
+      return null;
+    }
+  };
+  const graph = (seeds) => {
+    const seen = new Set(),
+      queue = seeds.slice();
+    while (queue.length) {
+      if (expired()) {
+        note("scan-budget-exceeded", null, "Source graph time limit reached");
+        break;
+      }
+      const rel = resolveFile(queue.pop(), true);
+      if (!rel || seen.has(rel) || !sourceFile(rel)) continue;
+      seen.add(rel);
+      const text = read(rel);
+      if (text === null) continue;
+      const parsed = localImports(text, rel);
+      if (parsed.error) note("parse-error", rel, parsed.error.message);
+      for (const spec of parsed.imports) {
+        if (!moduleLinks.has(rel)) moduleLinks.set(rel, new Map());
+        moduleLinks
+          .get(rel)
+          .set(spec, resolveFile(path.join(path.dirname(rel), spec)));
+        queue.push(path.join(path.dirname(rel), spec));
+      }
+    }
+    return seen;
+  };
+  const walk = () => {
+    const out = [],
+      queue = [root],
+      visited = new Set();
+    while (queue.length) {
+      if (
+        expired() ||
+        visited.size >= limits.directories ||
+        out.length >= limits.files * 4
+      ) {
+        note("scan-budget-exceeded", null, "Directory walk limit reached");
+        break;
+      }
+      const abs = queue.pop();
+      let real;
+      try {
+        real = fs.realpathSync(abs);
+      } catch {
+        continue;
+      }
+      if (!inside(root, real)) {
+        note(
+          "path-outside-package",
+          portable(path.relative(root, abs)),
+          "Directory link leaves package",
+        );
+        continue;
+      }
+      if (visited.has(real)) continue;
+      visited.add(real);
+      let entries;
+      try {
+        entries = fs.readdirSync(real, { withFileTypes: true });
+      } catch (error) {
+        note(
+          "source-unreadable",
+          portable(path.relative(root, real)),
+          error.message,
+        );
+        continue;
+      }
+      for (const entry of entries.sort((a, b) =>
+        a.name < b.name ? -1 : a.name > b.name ? 1 : 0,
+      )) {
+        const file = path.join(real, entry.name);
+        try {
+          const resolved = fs.realpathSync(file);
+          if (!inside(root, resolved)) {
+            note(
+              "path-outside-package",
+              portable(path.relative(root, file)),
+              "File link leaves package",
+            );
+            continue;
+          }
+          const stat = fs.statSync(resolved);
+          if (stat.isDirectory()) queue.push(resolved);
+          else if (stat.isFile() && sourceFile(resolved))
+            out.push(portable(path.relative(root, resolved)));
+        } catch {
+          /* broken links have no readable source */
+        }
+      }
+    }
+    return [...new Set(out)].sort();
+  };
+  const mounted = [];
+  const patch = meta.dsh?.bundle?.patch;
+  if (typeof patch === "string") {
+    const rel = resolveFile(patch);
+    if (rel)
+      try {
+        const txt = fs.readFileSync(path.join(root, rel), "utf8");
+        for (const m of txt.matchAll(/^\s*-\s*name:\s*['"]?([^\s'"]+)/gm))
+          mounted.push(m[1].startsWith(".") ? m[1] : hostEntry(meta));
+      } catch (error) {
+        note("patch-unreadable", rel, error.message);
+      }
+  }
+  const hostSeeds = mounted.length ? mounted : [hostEntry(meta)];
+  const entryFiles = [
+    ...new Set(
+      [...hostSeeds, clientEntry(meta)]
+        .filter(Boolean)
+        .map((s) => resolveFile(s))
+        .filter(Boolean),
+    ),
+  ];
+  const host = graph(hostSeeds);
+  const fallback = host.size === 0;
+  const all = walk();
+  const add = (rel, bucket, side) => {
+    const text = read(rel);
+    if (text === null) return;
+    if (!fileSides[rel]) fileSides[rel] = [];
+    if (!fileSides[rel].includes(side)) fileSides[rel].push(side);
+    if (resolvedFiles.has(rel)) return;
+    resolvedFiles.set(rel, true);
+    files.push([rel, text]);
+    buckets.set(rel, bucket);
+  };
+  if (fallback) {
+    note(
+      "entry-fallback",
+      hostEntry(meta),
+      "No resolved host entry; candidate source coverage is uncertain",
+    );
+    for (const rel of all)
+      add(
+        rel,
+        "fallback",
+        rel.toLowerCase().includes("client") ? "client" : "host",
+      );
+  } else {
+    for (const rel of [...host].sort()) add(rel, "host-entry", "host");
+    const client = clientEntry(meta);
+    if (client)
+      for (const rel of [...graph([client])].sort())
+        add(rel, "client-entry", "client");
+    const seeds = all.filter((rel) => rel.toLowerCase().includes("client"));
+    const skip =
+      options.skipClientExtra === undefined
+        ? (rel) => rel.startsWith("src/") || rel.includes("/src/")
+        : options.skipClientExtra;
+    for (const rel of [...graph(seeds)].sort()) {
+      if (!resolvedFiles.has(rel) && skip?.(rel)) {
+        skipped.push(rel);
+        continue;
+      }
+      add(rel, "client-extra", "client");
+    }
+  }
+  return [
+    files,
+    fallback,
+    buckets,
+    skipped,
+    diagnostics,
+    fileSides,
+    entryFiles,
+    moduleLinks,
+  ];
+}

package/kernel/lib/state-store.mjs

@@ -0,0 +1,126 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createHash, randomUUID } from "node:crypto";
+import { diffAgainstBaseline, badgeFor } from "./baseline.mjs";
+import { TOOL_VERSION } from "./version.mjs";
+
+export const digest = (value) =>
+  createHash("sha256").update(JSON.stringify(value)).digest("hex");
+export function baselineIdentity(nm, mode, rules, catalog) {
+  let profileId = path.resolve(nm);
+  try {
+    profileId = fs.realpathSync(nm);
+  } catch {}
+  return {
+    profileId,
+    mode,
+    toolVersion: TOOL_VERSION,
+    rulesDigest: digest(rules),
+    catalogDigest: digest(catalog),
+  };
+}
+export function baselinePath(nm, mode = "catalogue", profile = null) {
+  const home = process.env.DSH_HOME || path.join(os.homedir(), ".dsh");
+  const parts = path.resolve(nm).split(path.sep),
+    i = parts.lastIndexOf("profiles");
+  const key = (
+    profile ||
+    (i >= 0 ? parts[i + 1] : "unknown") ||
+    "unknown"
+  ).replace(/[^\w.-]/g, "_");
+  let canonical = path.resolve(nm);
+  try {
+    canonical = fs.realpathSync(nm);
+  } catch {}
+  return path.join(
+    home,
+    "dsh-plugin-compat-check",
+    `baseline.${key}.${digest(canonical).slice(0, 12)}.${mode}.json`,
+  );
+}
+export function readBaseline(file) {
+  try {
+    if (!fs.existsSync(file))
+      return { prev: null, note: "还没有基线（这是第一次体检）" };
+    return { prev: JSON.parse(fs.readFileSync(file, "utf8")), note: null };
+  } catch {
+    return { prev: null, note: "基线读不出来，这次不做比较" };
+  }
+}
+/** Atomic replace never follows an existing output-file symlink. */
+export function writeBaseline(file, snapshot) {
+  const temporary = path.join(
+    path.dirname(file),
+    `.baseline-${randomUUID()}.tmp`,
+  );
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(temporary, JSON.stringify(snapshot, null, 2) + "\n", {
+      flag: "wx",
+      mode: 0o600,
+    });
+    fs.renameSync(temporary, file);
+    return null;
+  } catch (error) {
+    return `基线写不进去（${error.message}）`;
+  } finally {
+    try {
+      fs.rmSync(temporary, { force: true });
+    } catch {}
+  }
+}
+
+/** Serialize read/compare/replace across processes. Busy locks never overwrite newer state. */
+export function baselineTransaction(file, snapshot, { advance = true } = {}) {
+  let fd = null;
+  const lock = file + ".lock";
+  try {
+    const dir = path.dirname(file);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const stat = fs.lstatSync(dir);
+    if (
+      !stat.isDirectory() ||
+      stat.isSymbolicLink() ||
+      (typeof process.getuid === "function" && stat.uid !== process.getuid())
+    )
+      throw new Error("Unsafe baseline directory");
+    if (stat.mode & 0o077) fs.chmodSync(dir, 0o700);
+    fd = fs.openSync(
+      lock,
+      fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY,
+      0o600,
+    );
+    const { prev, note } = readBaseline(file),
+      diff = diffAgainstBaseline(prev, snapshot);
+    const out = { file, note, diff, badge: badgeFor(diff), wrote: false };
+    if (advance) {
+      const error = writeBaseline(file, snapshot);
+      if (error) out.writeError = error;
+      else out.wrote = true;
+    } else
+      out.note = [note, "本次扫描不完整或仅预览，保留上次基线"]
+        .filter(Boolean)
+        .join("；");
+    return out;
+  } catch (error) {
+    return {
+      file,
+      note: "基线不可用，本次不比较",
+      diff: null,
+      badge: badgeFor(null),
+      wrote: false,
+      writeError:
+        error.code === "EEXIST"
+          ? "另一个进程正在更新基线；本次保留上次状态"
+          : error.message,
+    };
+  } finally {
+    if (fd !== null) {
+      fs.closeSync(fd);
+      try {
+        fs.unlinkSync(lock);
+      } catch {}
+    }
+  }
+}

package/kernel/lib/syntax.mjs

@@ -0,0 +1,73 @@
+import { parse } from "@babel/parser";
+
+/** Parse data only. Never import, evaluate, or execute the inspected module. */
+export function parseSource(text, file = "") {
+  const typescript = /\.[cm]?tsx?$/.test(file);
+  try {
+    const ast = parse(text, {
+      sourceType: "unambiguous",
+      attachComment: false,
+      errorRecovery: false,
+      allowReturnOutsideFunction: true,
+      allowAwaitOutsideFunction: true,
+      allowUndeclaredExports: true,
+      createImportExpressions: true,
+      plugins: [
+        ...(typescript ? ["typescript"] : []),
+        "jsx",
+        "decorators-legacy",
+      ],
+    });
+    return { ast, error: null };
+  } catch (error) {
+    return {
+      ast: null,
+      error: {
+        kind: "parse-error",
+        file,
+        line: error.loc?.line ?? null,
+        column: error.loc?.column ?? null,
+        message: error.message,
+      },
+    };
+  }
+}
+
+export function childNodes(node) {
+  const out = [];
+  for (const [key, value] of Object.entries(node || {})) {
+    if (["loc", "extra", "tokens", "comments", "errors"].includes(key))
+      continue;
+    if (Array.isArray(value)) {
+      for (const item of value)
+        if (item && typeof item.type === "string") out.push(item);
+    } else if (value && typeof value.type === "string") out.push(value);
+  }
+  return out;
+}
+
+export function localImports(text, file) {
+  const { ast, error } = parseSource(text, file);
+  if (!ast) return { imports: [], error };
+  const imports = new Set(),
+    queue = [ast];
+  while (queue.length) {
+    const n = queue.pop();
+    const source = [
+      "ImportDeclaration",
+      "ExportNamedDeclaration",
+      "ExportAllDeclaration",
+      "ImportExpression",
+    ].includes(n.type)
+      ? n.source
+      : n.type === "CallExpression" &&
+          n.callee?.type === "Identifier" &&
+          n.callee.name === "require"
+        ? n.arguments[0]
+        : null;
+    if (source?.type === "StringLiteral" && source.value.startsWith("."))
+      imports.add(source.value);
+    queue.push(...childNodes(n));
+  }
+  return { imports: [...imports].sort(), error: null };
+}