pi-lens 4.3.0 → 4.4.0

package/dist/chunk-BRJKOBZP.js

@@ -0,0 +1,331 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  getSecretsLaneAllowlistPaths,
+  isUnderSecretsLaneScratchTree
+} from "./chunk-TO6WL3GM.js";
+import {
+  SecurityScanClient
+} from "./chunk-7F72PXY2.js";
+import {
+  collectTrackedFiles,
+  collectUntrackedIgnoredIds,
+  safeSpawnAsync
+} from "./chunk-VN2AXLEX.js";
+import {
+  normalizeEphemeralMapKey,
+  normalizeMapKey
+} from "./chunk-Q5U6FMDI.js";
+
+// dist/clients/gitleaks-client.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { mkdtempSync } from "node:fs";
+var EMPTY_RESULT = {
+  success: false,
+  findings: []
+};
+var SCAN_TIMEOUT_MS = 12e4;
+var LOCAL_GITLEAKS_CONFIG_NAMES = [
+  ".gitleaks.toml",
+  ".gitleaks.yaml",
+  ".gitleaks.yml"
+];
+function findLocalGitleaksConfig(cwd) {
+  for (const name of LOCAL_GITLEAKS_CONFIG_NAMES) {
+    const candidate = path.join(cwd, name);
+    try {
+      if (fs.existsSync(candidate))
+        return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+var PLACEHOLDER_SECRET_REGEXES = [
+  String.raw`(?i)^(your|my|insert|replace|enter|add)[-_ ]?(the[-_ ]?)?(api[-_ ]?)?(key|token|secret|password|credential)s?$`,
+  String.raw`(?i)^<[^<>]*(api[-_ ]?key|token|secret|password|credential|key)[^<>]*>$`,
+  String.raw`(?i)^x{3,}$`,
+  String.raw`(?i)^(changeme|change[-_]me|example|placeholder|dummy|fake|redacted|xxxxxxxx)$`
+];
+function writeScopedGitleaksConfig(outDir, cwd) {
+  const localConfig = findLocalGitleaksConfig(cwd);
+  const extendLine = localConfig ? `path = ${JSON.stringify(localConfig)}` : "useDefault = true";
+  const pathPatterns = getSecretsLaneAllowlistPaths().map((p) => `    ${JSON.stringify(p)},`).join("\n");
+  const regexPatterns = PLACEHOLDER_SECRET_REGEXES.map((r) => `    ${JSON.stringify(r)},`).join("\n");
+  const toml = `[extend]
+${extendLine}
+
+[allowlist]
+paths = [
+${pathPatterns}
+]
+regexes = [
+${regexPatterns}
+]
+`;
+  const configPath = path.join(outDir, "gitleaks-scoped-config.toml");
+  fs.writeFileSync(configPath, toml, "utf-8");
+  return configPath;
+}
+function hasGitleaksSignal(cwd) {
+  const candidates = [...LOCAL_GITLEAKS_CONFIG_NAMES, ".gitleaksignore"];
+  for (const candidate of candidates) {
+    try {
+      if (fs.existsSync(path.join(cwd, candidate)))
+        return true;
+    } catch {
+    }
+  }
+  const pkgJsonPath = path.join(cwd, "package.json");
+  try {
+    if (fs.existsSync(pkgJsonPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+      const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+      for (const name of Object.keys(deps)) {
+        if (name.toLowerCase().includes("gitleaks"))
+          return true;
+      }
+    }
+  } catch {
+  }
+  const hookCandidates = [
+    path.join(cwd, ".husky", "pre-commit"),
+    path.join(cwd, ".husky", "_", "pre-commit"),
+    path.join(cwd, ".git", "hooks", "pre-commit")
+  ];
+  for (const hook of hookCandidates) {
+    try {
+      if (!fs.existsSync(hook))
+        continue;
+      const content = fs.readFileSync(hook, "utf-8");
+      if (content.includes("gitleaks"))
+        return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function hasGitRepo(cwd) {
+  try {
+    return fs.existsSync(path.join(cwd, ".git"));
+  } catch {
+    return false;
+  }
+}
+var GitleaksClient = class _GitleaksClient extends SecurityScanClient {
+  constructor(verbose = false) {
+    super("gitleaks", verbose);
+  }
+  /**
+   * Static detection helper so callers can gate before constructing
+   * (matches `GovulncheckClient.hasGoModule` shape).
+   */
+  static hasGitleaksSignal(cwd) {
+    return hasGitleaksSignal(cwd);
+  }
+  /** Smart-default tier (#130) — see {@link hasGitRepo}'s doc comment. */
+  static hasGitRepo(cwd) {
+    return hasGitRepo(cwd);
+  }
+  /**
+   * Auto-install via the GitHub-release path (registered in
+   * `clients/installer/index.ts`) when gitleaks isn't already on PATH.
+   * gitleaks uses `version` (no leading dashes) as its CLI verb.
+   */
+  doEnsureAvailable() {
+    return this.ensureViaInstaller(["version"]);
+  }
+  /**
+   * Scan a directory tree for secrets.
+   *
+   * Skips early when the directory shows no gitleaks opt-in signal — unless
+   * `requireSignal: false` (the `mode=full` fresh-fetch path uses this to
+   * apply the looser #130 "smart-default" gate, {@link hasGitRepo}, instead;
+   * session_start and per-edit dispatch never pass this, so their behavior
+   * is unchanged). When gitleaks is unavailable, returns an empty result
+   * with an explanatory summary rather than failing the session_start task.
+   *
+   * Re-entrancy safe: concurrent calls against the same root share a
+   * single gitleaks process (mirrors `KnipClient` / `JscpdClient` /
+   * `GovulncheckClient`).
+   */
+  async scan(cwd, options) {
+    const targetDir = path.resolve(cwd);
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const requireSignal = options?.requireSignal ?? true;
+    if (requireSignal && !_GitleaksClient.hasGitleaksSignal(targetDir)) {
+      return {
+        ...EMPTY_RESULT,
+        success: true,
+        scannedAt,
+        summary: "no gitleaks opt-in signal at project root"
+      };
+    }
+    if (!await this.ensureAvailable()) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        summary: "gitleaks not installed"
+      };
+    }
+    return this.dedupeScan(targetDir, () => this.runScan(targetDir));
+  }
+  async runScan(cwd) {
+    const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const bin = this.binaryPath ?? "gitleaks";
+    const outDir = mkdtempSync(path.join(os.tmpdir(), "pi-lens-gitleaks-"));
+    const reportPath = path.join(outDir, "gitleaks-report.json");
+    try {
+      const configPath = writeScopedGitleaksConfig(outDir, cwd);
+      const result = await safeSpawnAsync(bin, [
+        "detect",
+        "--no-git",
+        "--source",
+        cwd,
+        "--config",
+        configPath,
+        "--report-format",
+        "json",
+        "--report-path",
+        reportPath,
+        "--exit-code",
+        "0",
+        "--no-banner"
+      ], { cwd, timeout: SCAN_TIMEOUT_MS });
+      if (result.error) {
+        this.log(`Scan error: ${result.error.message}`);
+        return {
+          ...EMPTY_RESULT,
+          scannedAt,
+          summary: result.error.message.slice(0, 200)
+        };
+      }
+      if (!fs.existsSync(reportPath)) {
+        return {
+          ...EMPTY_RESULT,
+          success: true,
+          scannedAt,
+          summary: (result.stderr ?? "").trim().split("\n")[0] || "no report produced"
+        };
+      }
+      const rawFindings = parseGitleaksReport(fs.readFileSync(reportPath, "utf-8"));
+      const findings = await classifyAndFilterFindings(rawFindings, cwd);
+      return {
+        success: true,
+        analyzed: true,
+        findings,
+        scannedAt
+      };
+    } catch (err) {
+      return {
+        ...EMPTY_RESULT,
+        scannedAt,
+        summary: err instanceof Error ? err.message.slice(0, 200) : String(err)
+      };
+    } finally {
+      try {
+        fs.rmSync(outDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+};
+function isInsideNestedGitRepository(file, cwd) {
+  const root = path.resolve(cwd);
+  const absoluteFile = path.isAbsolute(file) ? path.resolve(file) : path.resolve(root, file);
+  const relative2 = path.relative(root, absoluteFile);
+  if (relative2 === ".." || relative2.startsWith(`..${path.sep}`) || path.isAbsolute(relative2))
+    return false;
+  let directory = path.dirname(absoluteFile);
+  while (directory !== root) {
+    try {
+      if (fs.existsSync(path.join(directory, ".git")))
+        return true;
+    } catch {
+      return false;
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory)
+      return false;
+    directory = parent;
+  }
+  return false;
+}
+async function classifyAndFilterFindings(findings, cwd) {
+  if (findings.length === 0)
+    return findings;
+  const [trackedIds, untrackedIgnoredIds] = await Promise.all([
+    collectTrackedFiles(cwd),
+    collectUntrackedIgnoredIds(cwd)
+  ]);
+  const classified = [];
+  for (const finding of findings) {
+    if (isUnderSecretsLaneScratchTree(finding.file)) {
+      classified.push({ ...finding, pathStatus: "scratch" });
+      continue;
+    }
+    const absPath = path.isAbsolute(finding.file) ? finding.file : path.resolve(cwd, finding.file);
+    if (isInsideNestedGitRepository(absPath, cwd)) {
+      classified.push({ ...finding, pathStatus: "nested-repository" });
+      continue;
+    }
+    let pathStatus;
+    if (trackedIds?.has(normalizeEphemeralMapKey(absPath))) {
+      pathStatus = "tracked";
+    } else if (untrackedIgnoredIds?.has(normalizeMapKey(absPath))) {
+      pathStatus = "ignored";
+    } else if (trackedIds !== void 0 || untrackedIgnoredIds !== void 0) {
+      pathStatus = "untracked";
+    }
+    classified.push(pathStatus ? { ...finding, pathStatus } : finding);
+  }
+  return classified;
+}
+function parseGitleaksReport(raw) {
+  if (!raw.trim())
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed))
+    return [];
+  const findings = [];
+  for (const entry of parsed) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const e = entry;
+    const ruleId = typeof e.RuleID === "string" ? e.RuleID : void 0;
+    const file = typeof e.File === "string" ? e.File : void 0;
+    const startLine = typeof e.StartLine === "number" ? e.StartLine : Number.parseInt(String(e.StartLine ?? ""), 10);
+    if (!ruleId || !file || !Number.isFinite(startLine))
+      continue;
+    findings.push({
+      ruleId,
+      description: typeof e.Description === "string" ? e.Description : void 0,
+      file,
+      startLine,
+      endLine: typeof e.EndLine === "number" ? e.EndLine : Number.isFinite(Number(e.EndLine)) ? Number(e.EndLine) : void 0,
+      match: typeof e.Match === "string" ? e.Match : void 0,
+      secret: typeof e.Secret === "string" ? e.Secret : void 0,
+      tags: Array.isArray(e.Tags) ? e.Tags.filter((t) => typeof t === "string") : void 0,
+      commit: typeof e.Commit === "string" ? e.Commit : void 0,
+      author: typeof e.Author === "string" ? e.Author : void 0,
+      date: typeof e.Date === "string" ? e.Date : void 0
+    });
+  }
+  return findings;
+}
+
+export {
+  PLACEHOLDER_SECRET_REGEXES,
+  writeScopedGitleaksConfig,
+  hasGitleaksSignal,
+  hasGitRepo,
+  GitleaksClient,
+  classifyAndFilterFindings,
+  parseGitleaksReport
+};

package/dist/chunk-BW5KFIQC.js

@@ -0,0 +1,59 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+
+// dist/clients/single-flight.js
+function createSingleFlight(options = {}) {
+  const { generation: readGeneration, coalesceTrailing = false } = options;
+  const flights = /* @__PURE__ */ new Map();
+  const currentGeneration = () => readGeneration?.() ?? 0;
+  const release = (key, flight) => {
+    if (flights.get(key) !== flight)
+      return;
+    flights.delete(key);
+  };
+  const run = (key, fn) => {
+    const existing = flights.get(key);
+    if (existing && existing.generation === currentGeneration()) {
+      if (coalesceTrailing)
+        existing.rerunRequested = true;
+      return existing.promise;
+    }
+    let settle;
+    let fail;
+    const promise = new Promise((resolve, reject) => {
+      settle = resolve;
+      fail = reject;
+    });
+    const flight = {
+      promise,
+      generation: currentGeneration(),
+      rerunRequested: false
+    };
+    const chain = async () => {
+      let result = await fn();
+      while (flight.rerunRequested) {
+        flight.rerunRequested = false;
+        result = await fn();
+      }
+      return result;
+    };
+    flights.set(key, flight);
+    chain().then((value) => {
+      release(key, flight);
+      settle(value);
+    }, (error) => {
+      release(key, flight);
+      fail(error);
+    });
+    return flight.promise;
+  };
+  return {
+    run,
+    has: (key) => flights.has(key),
+    size: () => flights.size,
+    clear: () => flights.clear()
+  };
+}
+
+export {
+  createSingleFlight
+};

package/dist/chunk-C2AUYXQH.js

@@ -0,0 +1,149 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  assertInstallAllowed
+} from "./chunk-NTUJEGDZ.js";
+import {
+  classifyProbeFailure,
+  installRetryDelayMs
+} from "./chunk-WONERJTP.js";
+import {
+  safeSpawnAsync
+} from "./chunk-VN2AXLEX.js";
+import {
+  logExtension
+} from "./chunk-O6TQT6RI.js";
+
+// dist/clients/dispatch/runners/utils/lazy-installer.js
+var LAZY_INSTALL_SPECS = {
+  rubocop: { command: "gem", args: ["install", "rubocop", "--no-document"] },
+  "rust-clippy": { command: "rustup", args: ["component", "add", "clippy"] },
+  rustfmt: { command: "rustup", args: ["component", "add", "rustfmt"] }
+};
+var LAZY_INSTALL_IGNORES_AMBIENT_SIGNAL = true;
+var LAZY_INSTALL_TIMEOUT_MS = 18e4;
+var attempts = /* @__PURE__ */ new Map();
+function key(cwd, tool) {
+  return `${cwd}:${tool}`;
+}
+function getLazyInstallAttempt(tool, cwd) {
+  return attempts.get(key(cwd, tool))?.fact;
+}
+function resetLazyInstallAttempts() {
+  attempts.clear();
+}
+function suppressionFor(state) {
+  if (!state)
+    return null;
+  if (state.fact.outcome === "succeeded")
+    return "succeeded";
+  if (state.retryAtMs === 0)
+    return "held";
+  return Date.now() < state.retryAtMs ? "cooling" : null;
+}
+var inFlight = /* @__PURE__ */ new Map();
+async function runLazyInstall(tool, cwd, spec) {
+  const k = key(cwd, tool);
+  const running = inFlight.get(k);
+  if (running)
+    return running;
+  const previous = attempts.get(k);
+  const suppressed = suppressionFor(previous);
+  if (suppressed !== null) {
+    logExtension({
+      subsystem: "install",
+      message: `lazy-install ${tool} suppressed (${suppressed})`,
+      metadata: {
+        tool,
+        cwd,
+        suppressed,
+        outcome: previous?.fact.outcome,
+        ...previous?.fact.reason && { reason: previous.fact.reason },
+        ...suppressed === "cooling" && {
+          retryAfterMs: Math.max(0, (previous?.retryAtMs ?? 0) - Date.now())
+        }
+      }
+    });
+    return false;
+  }
+  const started = performInstall(k, tool, cwd, spec);
+  inFlight.set(k, started);
+  try {
+    return await started;
+  } finally {
+    inFlight.delete(k);
+  }
+}
+async function performInstall(k, tool, cwd, spec) {
+  let result;
+  try {
+    result = await safeSpawnAsync(spec.command, spec.args, {
+      timeout: LAZY_INSTALL_TIMEOUT_MS,
+      cwd,
+      ...LAZY_INSTALL_IGNORES_AMBIENT_SIGNAL && { ignoreAmbientSignal: true }
+    });
+  } catch (err) {
+    result = {
+      stdout: "",
+      stderr: err?.message ?? String(err),
+      status: null,
+      error: err,
+      failure: "spawn"
+    };
+  }
+  if (!result.error && result.status === 0) {
+    attempts.set(k, {
+      fact: { outcome: "succeeded" },
+      retryAtMs: 0,
+      transientAttempts: 0
+    });
+    return true;
+  }
+  const classified = classifyProbeFailure(result, {
+    command: spec.command,
+    unclassifiedFailureOutcome: "transient"
+  });
+  const durable = classified.outcome === "missing";
+  const reason = (result.error?.message ?? result.stderr ?? `exit ${result.status}`).trim().slice(0, 200);
+  const settledPrevious = attempts.get(k);
+  const transientAttempts = durable ? 0 : (settledPrevious?.transientAttempts ?? 0) + 1;
+  const cooldownMs = durable ? 0 : installRetryDelayMs(transientAttempts);
+  const retryAtMs = cooldownMs === 0 ? 0 : Date.now() + cooldownMs;
+  attempts.set(k, {
+    fact: { outcome: "failed", reason },
+    retryAtMs,
+    transientAttempts
+  });
+  logExtension({
+    subsystem: "install",
+    message: `lazy-install ${tool} failed: ${reason}`,
+    metadata: {
+      tool,
+      cwd,
+      command: spec.command,
+      cause: classified.cause,
+      durable,
+      transientAttempts,
+      held: retryAtMs === 0,
+      ...retryAtMs > 0 && { retryAfterMs: retryAtMs - Date.now() },
+      evidence: classified.evidence
+    }
+  });
+  return false;
+}
+async function tryLazyInstall(tool, cwd) {
+  if (!assertInstallAllowed(`runner lazy install: ${tool}`))
+    return false;
+  return runLazyInstall(tool, cwd, LAZY_INSTALL_SPECS[tool]);
+}
+async function tryLazyInstallForFormatter(tool, cwd) {
+  if (!assertInstallAllowed(`formatter lazy install: ${tool}`))
+    return false;
+  return runLazyInstall(tool, cwd, LAZY_INSTALL_SPECS[tool]);
+}
+
+export {
+  getLazyInstallAttempt,
+  resetLazyInstallAttempts,
+  tryLazyInstall,
+  tryLazyInstallForFormatter
+};

package/dist/chunk-CGGAIP7J.js

@@ -0,0 +1,29 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  importFactProvider,
+  importFactsApplyTo
+} from "./chunk-V5PXFSZK.js";
+import "./chunk-JOLITGCC.js";
+import "./chunk-LW6XKDZQ.js";
+import "./chunk-Z54ZSOBZ.js";
+import "./chunk-TGPXLY2J.js";
+import "./chunk-QOZXJ4NA.js";
+import "./chunk-NTUJEGDZ.js";
+import "./chunk-WONERJTP.js";
+import "./chunk-VN2AXLEX.js";
+import "./chunk-5ZEJHV35.js";
+import "./chunk-DQ2NZ7C4.js";
+import "./chunk-VNMT7C64.js";
+import "./chunk-2EECBNC5.js";
+import "./chunk-N3YQJI6O.js";
+import "./chunk-O6TQT6RI.js";
+import "./chunk-5THXD6X5.js";
+import "./chunk-UK3CMEAL.js";
+import "./chunk-LJDODBBZ.js";
+import "./chunk-ABBOA7UD.js";
+import "./chunk-Q5U6FMDI.js";
+import "./chunk-NXL4FFQQ.js";
+export {
+  importFactProvider,
+  importFactsApplyTo
+};

package/dist/chunk-D6QS3U6M.js

@@ -0,0 +1,30 @@
+import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
+import {
+  calcCyclomaticComplexity,
+  functionFactProvider
+} from "./chunk-YLF3PPT5.js";
+import "./chunk-JOLITGCC.js";
+import "./chunk-5W3R6LFT.js";
+import "./chunk-LW6XKDZQ.js";
+import "./chunk-Z54ZSOBZ.js";
+import "./chunk-TGPXLY2J.js";
+import "./chunk-QOZXJ4NA.js";
+import "./chunk-NTUJEGDZ.js";
+import "./chunk-WONERJTP.js";
+import "./chunk-VN2AXLEX.js";
+import "./chunk-5ZEJHV35.js";
+import "./chunk-DQ2NZ7C4.js";
+import "./chunk-VNMT7C64.js";
+import "./chunk-2EECBNC5.js";
+import "./chunk-N3YQJI6O.js";
+import "./chunk-O6TQT6RI.js";
+import "./chunk-5THXD6X5.js";
+import "./chunk-UK3CMEAL.js";
+import "./chunk-LJDODBBZ.js";
+import "./chunk-ABBOA7UD.js";
+import "./chunk-Q5U6FMDI.js";
+import "./chunk-NXL4FFQQ.js";
+export {
+  calcCyclomaticComplexity,
+  functionFactProvider
+};