pi-lens 4.2.1 → 4.4.0

package/dist/chunk-DFVMIKMQ.js

@@ -0,0 +1,349 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  getScratchTreeGlobPatterns
+} from "./chunk-TO6WL3GM.js";
+import {
+  SecurityScanClient
+} from "./chunk-7F72PXY2.js";
+import {
+  safeSpawnAsync
+} from "./chunk-VN2AXLEX.js";
+import {
+  loadPiLensProjectConfig
+} from "./chunk-DQ2NZ7C4.js";
+
+// dist/clients/trivy-client.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { mkdtempSync } from "node:fs";
+var EMPTY_RESULT = {
+  success: false,
+  findings: [],
+  secrets: [],
+  licenses: []
+};
+var SCAN_TIMEOUT_MS = 18e4;
+var DEPENDENCY_MANIFESTS = [
+  // JS / TS
+  "package.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "bun.lockb",
+  // Python
+  "pyproject.toml",
+  "requirements.txt",
+  "poetry.lock",
+  "Pipfile.lock",
+  // Java / JVM
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "gradle.lockfile",
+  // Go
+  "go.mod",
+  "go.sum",
+  // Rust
+  "Cargo.toml",
+  "Cargo.lock",
+  // .NET
+  "packages.lock.json",
+  // PHP
+  "composer.json",
+  "composer.lock",
+  // Ruby
+  "Gemfile",
+  "Gemfile.lock"
+];
+function hasAnyDependencyManifest(cwd) {
+  for (const manifest of DEPENDENCY_MANIFESTS) {
+    try {
+      if (fs.existsSync(path.join(cwd, manifest)))
+        return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function isTrivyEnabled(cwd) {
+  try {
+    const config = loadPiLensProjectConfig(cwd);
+    const trivy = config.raw?.trivy;
+    return trivy?.enabled === true;
+  } catch {
+    return false;
+  }
+}
+function shouldScanTrivy(cwd) {
+  return isTrivyEnabled(cwd) && hasAnyDependencyManifest(cwd);
+}
+var SEVERITY_RANK = {
+  LOW: 0,
+  MEDIUM: 1,
+  HIGH: 2,
+  CRITICAL: 3
+};
+function resolveSeverityFloor(cwd) {
+  let raw;
+  try {
+    const config = loadPiLensProjectConfig(cwd);
+    raw = config.raw?.trivy?.minSeverity;
+  } catch {
+    raw = void 0;
+  }
+  const requested = typeof raw === "string" ? SEVERITY_RANK[raw.toUpperCase()] : void 0;
+  const floor = Math.min(requested ?? SEVERITY_RANK.HIGH, SEVERITY_RANK.HIGH);
+  return ["LOW", "MEDIUM", "HIGH", "CRITICAL"].filter((s) => SEVERITY_RANK[s] >= floor);
+}
+var TrivyClient = class extends SecurityScanClient {
+  constructor(verbose = false) {
+    super("trivy", verbose);
+  }
+  /** Static gates so callers can skip before constructing. */
+  static hasAnyDependencyManifest(cwd) {
+    return hasAnyDependencyManifest(cwd);
+  }
+  /** Full opt-in gate (config opt-in AND a dependency manifest). */
+  static shouldScan(cwd) {
+    return shouldScanTrivy(cwd);
+  }
+  /**
+   * Auto-install via the GitHub-release path (registered in
+   * `clients/installer/index.ts`) when trivy isn't already on PATH.
+   */
+  doEnsureAvailable() {
+    return this.ensureViaInstaller(["--version"]);
+  }
+  /**
+   * Scan a directory tree for dependency CVEs.
+   *
+   * Skips early when the opt-in gate isn't satisfied. When trivy is
+   * unavailable, returns an empty (but successful) result rather than failing
+   * the session_start task. Re-entrancy safe: concurrent calls against the
+   * same root share a single process.
+   */
+  async scan(cwd) {
+    const targetDir = path.resolve(cwd);
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (!shouldScanTrivy(targetDir)) {
+      return {
+        ...EMPTY_RESULT,
+        success: true,
+        scannedAt,
+        summary: hasAnyDependencyManifest(targetDir) ? "trivy not enabled (set trivy.enabled in .pi-lens.json)" : "no dependency manifest at analysis root"
+      };
+    }
+    if (!await this.ensureAvailable()) {
+      return { ...EMPTY_RESULT, scannedAt, summary: "trivy not installed" };
+    }
+    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
+  }
+  async runScan(cwd) {
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const bin = this.binaryPath ?? "trivy";
+    const severities = resolveSeverityFloor(cwd);
+    const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-trivy-"));
+    const reportPath = path.join(outDir, "trivy-report.json");
+    try {
+      const result = await safeSpawnAsync(bin, [
+        "fs",
+        "--scanners",
+        "vuln,secret,license",
+        "--severity",
+        severities.join(","),
+        "--format",
+        "json",
+        "--output",
+        reportPath,
+        "--quiet",
+        "--no-progress",
+        ...getScratchTreeGlobPatterns().flatMap((glob) => [
+          "--skip-dirs",
+          glob
+        ]),
+        cwd
+      ], { cwd, timeout: SCAN_TIMEOUT_MS });
+      if (result.error) {
+        this.log(`Scan error: ${result.error.message}`);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          summary: result.error.message.slice(0, 200)
+        };
+      }
+      if (!fs.existsSync(reportPath)) {
+        return {
+          ...EMPTY_RESULT,
+          success: true,
+          scannedAt,
+          summary: (result.stderr ?? "").trim().split("\n")[0] || "no report produced"
+        };
+      }
+      const raw = fs.readFileSync(reportPath, "utf-8");
+      const findings = parseTrivyReport(raw);
+      const secrets = parseTrivySecrets(raw);
+      const licenses = parseTrivyLicenses(raw);
+      return {
+        success: true,
+        analyzed: true,
+        findings,
+        secrets,
+        licenses,
+        scannedAt
+      };
+    } catch (err) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
+      };
+    } finally {
+      try {
+        fs.rmSync(outDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+};
+function normalizeSeverity(raw) {
+  const s = typeof raw === "string" ? raw.toUpperCase() : "";
+  if (s === "CRITICAL" || s === "HIGH" || s === "MEDIUM" || s === "LOW") {
+    return s;
+  }
+  return "UNKNOWN";
+}
+function parseTrivyReport(raw) {
+  if (!raw.trim())
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const results = parsed?.Results;
+  if (!Array.isArray(results))
+    return [];
+  const findings = [];
+  for (const resultEntry of results) {
+    if (!resultEntry || typeof resultEntry !== "object")
+      continue;
+    const r = resultEntry;
+    const target = typeof r.Target === "string" ? r.Target : void 0;
+    const vulns = r.Vulnerabilities;
+    if (!Array.isArray(vulns))
+      continue;
+    for (const vulnEntry of vulns) {
+      if (!vulnEntry || typeof vulnEntry !== "object")
+        continue;
+      const v = vulnEntry;
+      const vulnerabilityId = typeof v.VulnerabilityID === "string" ? v.VulnerabilityID : void 0;
+      const pkgName = typeof v.PkgName === "string" ? v.PkgName : void 0;
+      if (!vulnerabilityId || !pkgName)
+        continue;
+      findings.push({
+        vulnerabilityId,
+        pkgName,
+        installedVersion: typeof v.InstalledVersion === "string" ? v.InstalledVersion : void 0,
+        fixedVersion: typeof v.FixedVersion === "string" && v.FixedVersion.trim() ? v.FixedVersion : void 0,
+        severity: normalizeSeverity(v.Severity),
+        title: typeof v.Title === "string" ? v.Title : void 0,
+        primaryUrl: typeof v.PrimaryURL === "string" ? v.PrimaryURL : void 0,
+        target
+      });
+    }
+  }
+  return findings;
+}
+function parseTrivySecrets(raw) {
+  if (!raw.trim())
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const results = parsed?.Results;
+  if (!Array.isArray(results))
+    return [];
+  const secrets = [];
+  for (const resultEntry of results) {
+    if (!resultEntry || typeof resultEntry !== "object")
+      continue;
+    const r = resultEntry;
+    const target = typeof r.Target === "string" ? r.Target : void 0;
+    const rows = r.Secrets;
+    if (!target || !Array.isArray(rows))
+      continue;
+    for (const row of rows) {
+      if (!row || typeof row !== "object")
+        continue;
+      const s = row;
+      const ruleId = typeof s.RuleID === "string" ? s.RuleID : void 0;
+      const line = typeof s.StartLine === "number" ? s.StartLine : void 0;
+      if (!ruleId || line == null)
+        continue;
+      secrets.push({
+        ruleId,
+        file: target,
+        line,
+        title: typeof s.Title === "string" ? s.Title : void 0
+      });
+    }
+  }
+  return secrets;
+}
+function parseTrivyLicenses(raw) {
+  if (!raw.trim())
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const results = parsed?.Results;
+  if (!Array.isArray(results))
+    return [];
+  const licenses = [];
+  for (const resultEntry of results) {
+    if (!resultEntry || typeof resultEntry !== "object")
+      continue;
+    const r = resultEntry;
+    const target = typeof r.Target === "string" ? r.Target : void 0;
+    const rows = r.Licenses;
+    if (!Array.isArray(rows))
+      continue;
+    for (const row of rows) {
+      if (!row || typeof row !== "object")
+        continue;
+      const l = row;
+      const license = typeof l.Name === "string" ? l.Name : void 0;
+      if (!license)
+        continue;
+      const filePath = typeof l.FilePath === "string" && l.FilePath ? l.FilePath : target;
+      const pkgName = typeof l.PkgName === "string" && l.PkgName ? l.PkgName : filePath ?? "unknown";
+      licenses.push({
+        license,
+        pkgName,
+        severity: normalizeSeverity(l.Severity),
+        category: typeof l.Category === "string" ? l.Category : void 0,
+        filePath
+      });
+    }
+  }
+  return licenses;
+}
+
+export {
+  hasAnyDependencyManifest,
+  isTrivyEnabled,
+  shouldScanTrivy,
+  resolveSeverityFloor,
+  TrivyClient,
+  parseTrivyReport,
+  parseTrivySecrets,
+  parseTrivyLicenses
+};

package/dist/chunk-DIULIWKU.js

@@ -0,0 +1,169 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  extractTomlTableSection,
+  hasTomlTable,
+  parseTomlStringArray
+} from "./chunk-PAK6IDME.js";
+import {
+  recordDegradationOnce
+} from "./chunk-N3YQJI6O.js";
+import {
+  UV_WORKSPACE_EXCLUDE_DIALECT,
+  UV_WORKSPACE_MEMBERS_DIALECT,
+  isAtOrAboveHomeDir,
+  matchesWorkspaceMemberPattern,
+  toPosix,
+  walkUpDirs
+} from "./chunk-Q5U6FMDI.js";
+
+// dist/clients/python-environment.js
+import { access, readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+var UV_WORKSPACE_TABLE = "tool\\.uv\\.workspace";
+async function findUvWorkspace(startDir, homeDir) {
+  const resolvedStart = path.resolve(startDir);
+  let nearestProject;
+  for (const dir of walkUpDirs(startDir)) {
+    if (isAtOrAboveHomeDir(dir, homeDir))
+      break;
+    let content;
+    try {
+      content = await readFile(path.join(dir, "pyproject.toml"), "utf8");
+    } catch {
+      continue;
+    }
+    if (!nearestProject)
+      nearestProject = dir;
+    if (hasTomlTable(content, UV_WORKSPACE_TABLE)) {
+      const workspaceTable = extractTomlTableSection(content, UV_WORKSPACE_TABLE);
+      return {
+        root: dir,
+        explicit: true,
+        projectRoot: nearestProject,
+        isStartDir: nearestProject === resolvedStart,
+        members: parseTomlStringArray(workspaceTable, "members"),
+        exclude: parseTomlStringArray(workspaceTable, "exclude")
+      };
+    }
+  }
+  return nearestProject ? {
+    root: nearestProject,
+    explicit: false,
+    projectRoot: nearestProject,
+    isStartDir: nearestProject === resolvedStart,
+    members: [],
+    exclude: []
+  } : void 0;
+}
+function isUvWorkspaceMember(workspace, projectRoot) {
+  const relative = toPosix(path.relative(workspace.root, projectRoot));
+  if (relative.length === 0 || relative === ".." || relative.startsWith("../") || path.isAbsolute(relative)) {
+    return false;
+  }
+  const matches = (dialect) => (pattern) => matchesWorkspaceMemberPattern(pattern, relative, dialect, () => recordDegradationOnce({
+    kind: "workspace-glob-cap",
+    subject: String(pattern.length),
+    reason: "workspace glob matcher exceeded its memo-table cell cap"
+  }));
+  return !workspace.exclude.some(matches(UV_WORKSPACE_EXCLUDE_DIALECT)) && workspace.members.some(matches(UV_WORKSPACE_MEMBERS_DIALECT));
+}
+var AMBIENT_ENVIRONMENT_VARIABLES = {
+  "uv-project-environment": "UV_PROJECT_ENVIRONMENT",
+  "virtual-env": "VIRTUAL_ENV",
+  conda: "CONDA_PREFIX"
+};
+function hasAmbientPythonEnvironment(env = process.env) {
+  return Object.values(AMBIENT_ENVIRONMENT_VARIABLES).some((name) => Boolean(env[name]));
+}
+async function detectPythonEnvironment(projectRoot, homeDir = os.homedir(), options = {}) {
+  const root = path.resolve(projectRoot);
+  const uvWorkspace = await findUvWorkspace(root, homeDir);
+  const isProjectRoot = uvWorkspace?.isStartDir === true;
+  const memberWorkspaceRoot = isProjectRoot && uvWorkspace.explicit && isUvWorkspaceMember(uvWorkspace, root) ? uvWorkspace.root : void 0;
+  const uvEnvironmentRoot = isProjectRoot ? memberWorkspaceRoot ?? uvWorkspace.projectRoot : void 0;
+  const uvProjectEnvironment = process.env.UV_PROJECT_ENVIRONMENT;
+  const allowAmbient = options.allowAmbient ?? true;
+  const isWithinProjectRoot = (candidateRoot) => {
+    const relative = path.relative(root, path.resolve(candidateRoot));
+    return relative !== ".." && !relative.startsWith(`..${path.sep}`) && // #3871 V1: another Windows drive has no relative path, so
+    // `path.relative` returns the absolute target: no `..`, not inside.
+    !path.isAbsolute(relative);
+  };
+  const candidates = [
+    ...uvEnvironmentRoot !== void 0 && uvProjectEnvironment ? [
+      {
+        // `path.resolve` leaves an absolute value untouched and
+        // anchors a relative one at the project's workspace root.
+        root: path.resolve(uvEnvironmentRoot, uvProjectEnvironment),
+        source: "uv-project-environment"
+      }
+    ] : [],
+    ...memberWorkspaceRoot !== void 0 ? [
+      {
+        root: path.join(memberWorkspaceRoot, ".venv"),
+        source: "uv-workspace"
+      }
+    ] : [],
+    { root: process.env.VIRTUAL_ENV, source: "virtual-env" },
+    { root: process.env.CONDA_PREFIX, source: "conda" },
+    { root: path.join(root, ".venv"), source: "project-dot-venv" },
+    { root: path.join(root, "venv"), source: "project-venv" }
+  ];
+  for (const candidate of candidates) {
+    if (!candidate.root)
+      continue;
+    if (!allowAmbient && candidate.source in AMBIENT_ENVIRONMENT_VARIABLES && !isWithinProjectRoot(candidate.root))
+      continue;
+    const binDir = path.join(candidate.root, process.platform === "win32" ? "Scripts" : "bin");
+    const pythonPath = path.join(binDir, process.platform === "win32" ? "python.exe" : "python");
+    try {
+      await access(pythonPath);
+      return {
+        root: candidate.root,
+        binDir,
+        pythonPath,
+        source: candidate.source
+      };
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function detectPythonVenv(projectRoot) {
+  return (await detectPythonEnvironment(projectRoot))?.pythonPath;
+}
+function augmentPythonEnvironment(baseEnvironment, environment) {
+  if (!environment)
+    return baseEnvironment;
+  const inheritedPath = baseEnvironment.PATH ?? baseEnvironment.Path ?? baseEnvironment.path ?? "";
+  const augmentedPath = inheritedPath ? `${environment.binDir}${path.delimiter}${inheritedPath}` : environment.binDir;
+  const childEnvironment = {
+    ...baseEnvironment,
+    PATH: augmentedPath,
+    VIRTUAL_ENV: environment.root
+  };
+  if (process.platform === "win32")
+    childEnvironment.Path = augmentedPath;
+  return childEnvironment;
+}
+function pythonEnvironmentToolCandidates(environment, command) {
+  if (!environment)
+    return [];
+  if (process.platform !== "win32") {
+    return [path.join(environment.binDir, command)];
+  }
+  return [
+    path.join(environment.binDir, `${command}.exe`),
+    path.join(environment.binDir, `${command}.cmd`),
+    path.join(environment.binDir, command)
+  ];
+}
+
+export {
+  hasAmbientPythonEnvironment,
+  detectPythonEnvironment,
+  detectPythonVenv,
+  augmentPythonEnvironment,
+  pythonEnvironmentToolCandidates
+};