pkg-scaffold 3.3.0 → 3.3.2

package/src/index.js

@@ -1,6 +1,6 @@
 /**
  * ============================================================================
- * 📦 pkg-scaffold v3.1.1: Unified Architectural Refactoring Orchestrator
+ * 📦 pkg-scaffold v3.3.2: Unified Architectural Refactoring Orchestrator
  * ============================================================================
  * Main execution bridge managing multi-pass compilation cycles, semantic cross-linking,
  * supply-chain validation audits, and automated git self-healing rollbacks.
@@ -19,6 +19,7 @@ import { MagicDetector } from './ast/MagicDetector.js';
 import { PathMapper } from './resolution/PathMapper.js';
 import { WorkspaceGraph } from './resolution/WorkSpaceGraph.js';
 import { DependencyResolver } from './resolution/DepencyResolver.js';
+import { CircularDetector } from './resolution/CircularDetector.js';
 import { TransactionManager } from './refractor/TransactionManager.js';
 import { ImpactAnalyzer } from './refractor/ImpactAnalyzer.js';
 import { SourceRewriter } from './refractor/SourceRewriter.js';
@@ -28,6 +29,7 @@ import { SelfHealer } from './healing/SelfHealer.js';
 import { IncrementalCacheManager } from './performance/GraphCache.js';
 import { WorkerPool } from './performance/WorkerPool.js';
 import { SupplyChainGuard } from './performance/SupplyChainGuard.js';
+import { SecretDetector } from './performance/SecretDetector.js';
 
 /**
  * Primary Refactoring Engine Core Coordination Controller
@@ -41,6 +43,7 @@ export class RefactoringEngine {
     this.pathMapper = new PathMapper(this.context);
     this.workspaceGraph = new WorkspaceGraph(this.context);
     this.resolver = new DependencyResolver(this.context, this.pathMapper, this.workspaceGraph);
+    this.circularDetector = new CircularDetector(this.context);
     
     // Stage 3: Wire official AST Syntax parsers and framework processors
     this.analyzer = new ASTAnalyzer(this.context);
@@ -55,6 +58,7 @@ export class RefactoringEngine {
     
     // Stage 5: Bind security audit utilities and performance cache rings
     this.supplyChainGuard = new SupplyChainGuard(this.context);
+    this.secretDetector = new SecretDetector(this.context);
     this.cacheManager = new IncrementalCacheManager(this.context);
     this.workerPool = new WorkerPool(this.context);
     this.gitSandbox = new GitSandbox(this.context);
@@ -68,10 +72,13 @@ export class RefactoringEngine {
     try {
       console.log(ansis.bold.green('🎯 Starting pkg-scaffold Operational Optimization Cycle...'));
       
-      const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
+      let rl;
+      if (!this.context.skipConfirm) {
+        rl = readline.createInterface({
+          input: process.stdin,
+          output: process.stdout
+        });
+      }
       
       // Pass 1: Boot environment contexts and load alias configuration maps
       await this.context.initialize();
@@ -103,37 +110,39 @@ export class RefactoringEngine {
         }
       }
 
+      // Initialize TypeScript program for AST analysis (required before processFile)
+      if (sourceCodeFilesList.length > 0) {
+        try {
+          this.analyzer.initProgram(sourceCodeFilesList);
+        } catch (e) {
+          if (this.context.verbose) {
+            console.warn('Warning: Failed to initialize TypeScript program:', e.message);
+          }
+        }
+      }
+
       // Pass 3: Process source file tokens using high-performance concurrent workers
       let parallelParseCompleted = false;
       if (sourceCodeFilesList.length > 10) {
         parallelParseCompleted = await this.workerPool.parallelAnalyzeCodebase(sourceCodeFilesList, this);
       }
 
-      // Synchronous fallback loop to parse remaining files or cache misses.
-      // IMPORTANT: The `parallelParseCompleted` flag only controls whether the *worker pool*
-      // already processed all files. It must NOT be set per-file inside this loop — doing so
-      // would cause all files after the first cache-hit to be silently skipped.
       for (const filePath of sourceCodeFilesList) {
         const node = this.context.createNode(filePath);
         const currentHash = await this.cacheManager.computeHash(filePath);
         node.contentHash = currentHash;
 
-        // Check if this individual file is already up-to-date in the cache
         const isFileCached = cacheManifest[filePath] && cacheManifest[filePath].hash === currentHash;
 
         if (isFileCached) {
           this.context.metrics.cacheHits++;
           this.hydrateNodeFromCache(node, cacheManifest[filePath]);
         } else if (!parallelParseCompleted) {
-          // Only parse if the worker pool did not already handle this file
           this.context.metrics.cacheMisses++;
           await this.analyzer.processFile(filePath, node);
         }
 
-        // Apply ecosystem overrides directly to our parsed memory maps
         this.magicDetector.injectVirtualConsumerEdges(filePath, node, activeFrameworkEcosystems);
-
-        // Aggregate used external packages for the dependency audit
         node.externalPackageUsage.forEach(pkg => this.context.usedExternalPackages.add(pkg));
       }
 
@@ -141,15 +150,31 @@ export class RefactoringEngine {
       console.log(ansis.dim('🔗 Linking graph edges and checking structural usage paths...'));
       await this.linkDependencyGraph();
 
+      // NEW: Circular Dependency Detection
+      console.log(ansis.dim('🔄 Detecting circular dependencies...'));
+      const cycles = this.circularDetector.detectCycles(this.context.graph, this.context);
+      if (cycles.length > 0) {
+        console.warn(ansis.bold.yellow(`\n⚠️  Detected ${cycles.length} circular dependencies:`));
+        this.circularDetector.formatCycles().forEach(c => console.log(ansis.dim(`    • ${c}`)));
+      }
+
+      // NEW: Secret Detection
+      console.log(ansis.dim('🔍 Scanning for hardcoded secrets...'));
+      const detectedSecrets = await this.secretDetector.scanCodebaseForSecrets(this.context);
+      const secretStats = this.secretDetector.getSecretStats();
+
       // Pass 5: Compile metrics summary and print diagnostics report
       const analysisSummary = this.context.generateSummaryReport();
+      analysisSummary.detectedSecrets = detectedSecrets;
+      analysisSummary.secretStats = secretStats;
       this.displayConsoleDiagnostics(analysisSummary);
 
       // Pass 6: Run self-healing automated transformations if --fix is set
       if (this.context.allowAutoFix) {
         const structuralModificationsStaged = 
           analysisSummary.structuralIssuesDetected.deadFiles.length > 0 || 
-          analysisSummary.structuralIssuesDetected.deadExports.length > 0;
+          analysisSummary.structuralIssuesDetected.deadExports.length > 0 ||
+          analysisSummary.structuralIssuesDetected.unusedDependencies.length > 0;
 
         if (structuralModificationsStaged) {
           console.log(ansis.bold.yellow('\n📋 Proposed Optimization Plan:'));
@@ -167,7 +192,7 @@ export class RefactoringEngine {
 
           if (analysisSummary.structuralIssuesDetected.unusedDependencies.length > 0) {
             console.log(ansis.bold(`  📦 Remove ${analysisSummary.structuralIssuesDetected.unusedDependencies.length} unused dependencies:`));
-            analysisSummary.structuralIssuesDetected.unusedDependencies.forEach(d => console.log(ansis.dim(`    • ${d.package} (in ${d.manifest})`)));
+            analysisSummary.structuralIssuesDetected.unusedDependencies.forEach(d => console.log(ansis.dim(`    • ${d.package} (${d.type} in ${d.manifest})`)));
           }
           console.log(ansis.dim('------------------------------------------------------------'));
 
@@ -179,31 +204,23 @@ export class RefactoringEngine {
 
           if (proceed) {
             await this.selfHealer.runSelfHealingLifecycle(async () => {
-              // Sub-Task A: Purge completely unreferenced dangling components
               for (const relPath of analysisSummary.structuralIssuesDetected.deadFiles) {
                 const absPath = path.resolve(this.context.cwd, relPath);
                 console.log(ansis.red(`✂️  Removing unreferenced file: ${relPath}`));
                 await this.txManager.stageDeletion(absPath);
               }
 
-              // Sub-Task B: Surgically remove unused named export blocks from active files
               for (const unusedExport of analysisSummary.structuralIssuesDetected.deadExports) {
                 const absPath = path.resolve(this.context.cwd, unusedExport.file);
                 const node = this.context.graph.get(absPath);
-                
                 if (!node) continue;
                 const meta = node.internalExports.get(unusedExport.symbol);
 
-                // Perform safety analysis to ensure the token isn't called via dynamic runtime methods
                 const safetyVerdict = await this.impactAnalyzer.verifyRefactorSafety(absPath, unusedExport.symbol, this.context.graph);
-
                 if (safetyVerdict.isSafeToPrune) {
                   console.log(ansis.yellow(`⚡ Stripping unused export [${unusedExport.symbol}] from: ${unusedExport.file}:${unusedExport.line}`));
                   const nextText = await this.sourceRewriter.stripNamedExportSignature(absPath, unusedExport.symbol, meta);
-                  
                   await this.txManager.stageWrite(absPath, nextText);
-                  
-                  // Align matching type declaration boundaries (.d.ts) to prevent compilation errors
                   await this.typeIntegrity.synchronizeDeclarationFile(absPath, unusedExport.symbol);
                 } else if (this.context.verbose) {
                   console.log(ansis.gray(`🛡️  Preserving symbol export [${unusedExport.symbol}] due to: ${safetyVerdict.blockReason}`));
@@ -216,9 +233,8 @@ export class RefactoringEngine {
         }
       }
 
-      // Pass 7: Save optimized graph footprints back to the cache directory
       await this.cacheManager.saveCacheManifest(this.context.graph);
-      rl.close();
+      if (rl) rl.close();
       console.log(ansis.bold.green('\n✨ Core optimization cycle completed smoothly. Codebase workspace is healthy.'));
 
     } catch (criticalFault) {
@@ -228,13 +244,24 @@ export class RefactoringEngine {
     }
   }
 
-  /**
-   * Links nodes and processes barrel files recursively without regular expressions.
-   */
+  async discoverSourceFiles(dir, fileList) {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const res = path.resolve(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === '.scaffold-cache') continue;
+        await this.discoverSourceFiles(res, fileList);
+      } else {
+        const ext = path.extname(entry.name);
+        if (['.js', '.jsx', '.ts', '.tsx', '.vue', '.svelte'].includes(ext) || entry.name === 'package.json') {
+          fileList.push(res);
+        }
+      }
+    }
+  }
+
   async linkDependencyGraph() {
     for (const [filePath, node] of this.context.graph.entries()) {
-      
-      // Connect standard module imports
       for (const specifier of node.explicitImports) {
         const resolvedPath = this.resolver.resolveModulePath(filePath, specifier);
         if (resolvedPath && this.context.graph.has(resolvedPath)) {
@@ -243,23 +270,14 @@ export class RefactoringEngine {
         }
       }
 
-      // Unroll re-exports and unwrap barrel file links recursively
       for (const specToken of node.importedSymbols) {
         const delimiterIndex = specToken.indexOf(':');
         if (delimiterIndex === -1) continue;
-
         const specifier = specToken.slice(0, delimiterIndex);
         const symbol = specToken.slice(delimiterIndex + 1);
-
         const resolvedPath = this.resolver.resolveModulePath(filePath, specifier);
-        
         if (resolvedPath && symbol !== '*') {
-          const traceResolution = await this.barrelParser.determineSymbolDeclarationOrigin(
-            resolvedPath, 
-            symbol, 
-            this.context.graph
-          );
-          
+          const traceResolution = await this.barrelParser.determineSymbolDeclarationOrigin(resolvedPath, symbol, this.context.graph);
           if (traceResolution && this.context.graph.has(traceResolution.originFile)) {
             this.context.graph.get(traceResolution.originFile).incomingEdges.add(filePath);
             node.outgoingEdges.add(traceResolution.originFile);
@@ -269,142 +287,95 @@ export class RefactoringEngine {
     }
   }
 
-  /**
-   * Audits package json files using token equality checks instead of fragile regex searches.
-   */
   async auditManifestSupplyChain(packageJsonPath) {
     try {
       const text = await fs.readFile(packageJsonPath, 'utf8');
       const data = JSON.parse(text);
-      
       const prodDeps = Object.keys(data.dependencies || {});
       const devDeps = Object.keys(data.devDependencies || {});
       const totalDependencies = [...prodDeps, ...devDeps];
 
-      // Register dependencies for later audit
       this.context.manifestDependencies.set(packageJsonPath, {
         dependencies: prodDeps,
-        devDependencies: devDeps
+        devDependencies: devDeps,
+        peerDependencies: Object.keys(data.peerDependencies || {}),
+        optionalDependencies: Object.keys(data.optionalDependencies || {})
       });
 
-      // Pass dependencies down to our Levenshtein string-distance guard to find typosquat targets
       const supplyChainThreats = this.supplyChainGuard.detectTyposquattingAnomalies(totalDependencies);
-      
       for (const anomaly of supplyChainThreats) {
         console.warn(ansis.bold.red(`🚨 Supply Chain Alert: Malicious package masking candidate discovered [${anomaly.maliciousCandidate}]. Mimics trusted library [${anomaly.targetMimicked}].`));
       }
-
-      // Verify lockfile hash configurations to catch poisoned manifests
       await this.supplyChainGuard.verifyIntegrityLockfileHashes(packageJsonPath);
-    } catch {
-      // Manifest unreadable or locked; skip gracefully
-    }
+    } catch {}
   }
 
-  hydrateNodeFromCache(node, cachedRecord) {
-    cachedRecord.explicitImports.forEach(i => node.explicitImports.add(i));
-    cachedRecord.dynamicImports.forEach(i => node.dynamicImports.add(i));
-    cachedRecord.importedSymbols.forEach(s => node.importedSymbols.add(s));
-    cachedRecord.rawStringReferences.forEach(r => node.rawStringReferences.add(r));
-    cachedRecord.instantiatedIdentifiers.forEach(i => node.instantiatedIdentifiers.add(i));
-    cachedRecord.propertyAccessChains.forEach(c => node.propertyAccessChains.add(c));
-    
-    if (cachedRecord.internalExports) {
-      Object.entries(cachedRecord.internalExports).forEach(([k, v]) => {
-        node.internalExports.set(k, v);
-      });
-    }
-    node.isLibraryEntry = cachedRecord.isLibraryEntry || false;
-    node.securityThreats = cachedRecord.securityThreats || [];
-    if (cachedRecord.localSuppressedRules) {
-      cachedRecord.localSuppressedRules.forEach(r => node.localSuppressedRules.add(r));
-    }
-    if (cachedRecord.symbolSourceLocations) {
-      Object.entries(cachedRecord.symbolSourceLocations).forEach(([k, v]) => {
-        node.symbolSourceLocations.set(k, v);
-      });
-    }
-    if (cachedRecord.externalPackageUsage) {
-      cachedRecord.externalPackageUsage.forEach(p => node.externalPackageUsage.add(p));
-    }
-  }
+  displayConsoleDiagnostics(summary) {
+    console.log(ansis.bold.cyan('\n📊 Operational Diagnostics Summary:'));
+    console.log(ansis.dim('------------------------------------------------------------'));
+    console.log(`⏱️  Duration             : ${summary.executionDuration}`);
+    console.log(`📁 Files Processed      : ${summary.totalFilesProcessed}`);
+    console.log(`🧠 Cache Hit Ratio      : ${summary.graphCacheOptimization.ratio}`);
+    console.log(ansis.dim('------------------------------------------------------------'));
 
-  /**
-   * Crawls project roots using precise token extension checking instead of high-risk text matching.
-   */
-  async discoverSourceFiles(currentDirectory, fileAccumulator) {
-    try {
-      const entries = await fs.readdir(currentDirectory, { withFileTypes: true });
-
-      for (const entry of entries) {
-        const absolutePath = path.join(currentDirectory, entry.name);
-
-        if (entry.isDirectory()) {
-          // Standard systemic exclusions filters
-          if (entry.name === 'node_modules' || 
-              entry.name === '.git' || 
-              entry.name === '.scaffold-cache' || 
-              entry.name === 'dist' || 
-              entry.name === 'build') {
-            continue;
-          }
-          await this.discoverSourceFiles(absolutePath, fileAccumulator);
-        } else if (entry.isFile()) {
-          const extension = path.extname(entry.name);
-          if (extension === '.js' || 
-              extension === '.ts' || 
-              extension === '.tsx' || 
-              extension === '.jsx' || 
-              entry.name === 'package.json') {
-            fileAccumulator.push(absolutePath);
-          }
-        }
-      }
-    } catch {
-      // Path unreadable or access locked; close loop gracefully
+    if (summary.structuralIssuesDetected.deadFiles.length > 0) {
+      console.log(ansis.bold.red(`\n💀 Dead Files Detected (${summary.structuralIssuesDetected.deadFiles.length}):`));
+      summary.structuralIssuesDetected.deadFiles.forEach(f => console.log(ansis.dim(`   • ${f}`)));
     }
-  }
 
-  displayConsoleDiagnostics(report) {
-    console.log(ansis.bold.green('\n📊 Codebase Structural Diagnostics Summary'));
-    console.log(ansis.dim('============================================================'));
-    console.log(`${ansis.bold('Processing Cycle Wall Duration:')} ${ansis.cyan(report.executionDuration)}`);
-    console.log(`${ansis.bold('Total Files Indexed Globally  :')} ${ansis.white(report.totalFilesProcessed)}`);
-    console.log(`${ansis.bold('Delta Cache Optimization Ratio:')} ${ansis.green(report.graphCacheOptimization.ratio)} (Hits: ${report.graphCacheOptimization.hits} / Misses: ${report.graphCacheOptimization.misses})`);
-    console.log(ansis.dim('------------------------------------------------------------'));
-    
-    if (report.structuralIssuesDetected.deadFiles.length > 0) {
-      console.log(ansis.bold.red(`\nOrphaned Files Flagged (${report.structuralIssuesDetected.deadFiles.length}):`));
-      report.structuralIssuesDetected.deadFiles.forEach(f => console.log(ansis.dim(`  • ${f}`)));
-    } else {
-      console.log(ansis.green('\n✨ No orphaned or unreferenced component files found.'));
+    if (summary.structuralIssuesDetected.deadExports.length > 0) {
+      console.log(ansis.bold.red(`\n✂️  Dead Exports Detected (${summary.structuralIssuesDetected.deadExports.length}):`));
+      summary.structuralIssuesDetected.deadExports.forEach(e => console.log(ansis.dim(`   • ${e.symbol} in ${e.file}:${e.line}`)));
     }
 
-    if (report.structuralIssuesDetected.deadExports.length > 0) {
-      console.log(ansis.bold.yellow(`\nUnused Named Symbol Exports Flagged (${report.structuralIssuesDetected.deadExports.length}):`));
-      report.structuralIssuesDetected.deadExports.forEach(e => {
-        console.log(`  • ${ansis.dim(e.file)}:${e.line}:${e.column} -> [${ansis.yellow(e.symbol)}] (Type: ${e.type})`);
-      });
-    } else {
-      console.log(ansis.green('✨ No dead or unused named symbols exported across components.'));
+    if (summary.structuralIssuesDetected.unusedDependencies.length > 0) {
+      console.log(ansis.bold.red(`\n📦 Unused Dependencies (${summary.structuralIssuesDetected.unusedDependencies.length}):`));
+      summary.structuralIssuesDetected.unusedDependencies.forEach(d => console.log(ansis.dim(`   • ${d.package} (${d.type} in ${d.manifest})`)));
     }
 
-    if (report.structuralIssuesDetected.securityThreats.length > 0) {
-      console.log(ansis.bold.red(`\n⚠️  High-Risk Variable Assignment Alerts (${report.structuralIssuesDetected.securityThreats.length}):`));
-      report.structuralIssuesDetected.securityThreats.forEach(threat => {
-        console.log(`  • ${ansis.red(threat.file)}:${threat.line} -> Variable [${ansis.bold(threat.identifier)}] contains a high-entropy secret (Shannon Score: ${threat.entropy})`);
-      });
+    if (summary.structuralIssuesDetected.securityThreats.length > 0) {
+      console.log(ansis.bold.red(`
+🛡️  Security Threats (${summary.structuralIssuesDetected.securityThreats.length}):`));
+      summary.structuralIssuesDetected.securityThreats.forEach(t => console.log(ansis.dim(`   • ${t.identifier} in ${t.file}:${t.line} (Risk: ${t.riskCode})`)));
     }
 
-    if (report.structuralIssuesDetected.unusedDependencies.length > 0) {
-      console.log(ansis.bold.red(`\nUnused External Dependencies Flagged (${report.structuralIssuesDetected.unusedDependencies.length}):`));
-      report.structuralIssuesDetected.unusedDependencies.forEach(d => {
-        console.log(`  • Package [${ansis.red(d.package)}] in ${ansis.dim(d.manifest)}`);
-      });
-    } else {
-      console.log(ansis.green('\n✨ No unused external dependencies found in manifest files.'));
+    // Display detected secrets
+    if (summary.detectedSecrets && summary.detectedSecrets.length > 0) {
+      const criticalSecrets = summary.detectedSecrets.filter(s => s.severity === 'CRITICAL');
+      const highSecrets = summary.detectedSecrets.filter(s => s.severity === 'HIGH');
+      
+      console.log(ansis.bold.red(`
+🔐 Hardcoded Secrets Detected (${summary.detectedSecrets.length}):`));
+      
+      if (criticalSecrets.length > 0) {
+        console.log(ansis.bold.red(`   CRITICAL (${criticalSecrets.length}):`));
+        criticalSecrets.forEach(s => {
+          const relPath = s.file.split(/[\\/]/).slice(-2).join('/');
+          console.log(ansis.dim(`     • ${s.type} in ${relPath}:${s.line} [${s.variable}]`));
+        });
+      }
+      
+      if (highSecrets.length > 0) {
+        console.log(ansis.bold.yellow(`   HIGH (${highSecrets.length}):`));
+        highSecrets.forEach(s => {
+          const relPath = s.file.split(/[\\/]/).slice(-2).join('/');
+          console.log(ansis.dim(`     • ${s.type} in ${relPath}:${s.line} [${s.variable}]`));
+        });
+      }
     }
 
-    console.log(ansis.dim('\n============================================================\n'));
+    console.log(ansis.dim('\n------------------------------------------------------------\n'));
+  }
+
+  hydrateNodeFromCache(node, cachedRecord) {
+    if (cachedRecord.explicitImports) cachedRecord.explicitImports.forEach(i => node.explicitImports.add(i));
+    if (cachedRecord.dynamicImports) cachedRecord.dynamicImports.forEach(i => node.dynamicImports.add(i));
+    if (cachedRecord.importedSymbols) cachedRecord.importedSymbols.forEach(s => node.importedSymbols.add(s));
+    if (cachedRecord.internalExports) {
+      Object.entries(cachedRecord.internalExports).forEach(([k, v]) => node.internalExports.set(k, v));
+    }
+    if (cachedRecord.symbolSourceLocations) {
+      Object.entries(cachedRecord.symbolSourceLocations).forEach(([k, v]) => node.symbolSourceLocations.set(k, v));
+    }
   }
 }