pkg-scaffold 3.3.0 → 3.3.3

package/src/performance/SecretDetector.js

@@ -0,0 +1,378 @@
+/**
+ * ============================================================================
+ * Secret Detection Engine for pkg-scaffold v3.3.2 (AST + REGEX Fallback)
+ * 
+ * Uses OXC parser for fast, accurate detection of hardcoded secrets.
+ * Falls back to REGEX patterns if AST parsing fails.
+ * ============================================================================
+ */
+
+import fs from 'fs/promises';
+import path from 'path';
+
+export class SecretDetector {
+  constructor(context) {
+    this.context = context;
+    this.secrets = [];
+    
+    // REGEX patterns for detecting secrets (fallback)
+    this.regexPatterns = {
+      apiKey: /['\"]?api[_-]?key['\"]?\s*[:=]\s*['\"]([a-zA-Z0-9\-_]{20,})['\"]?/gi,
+      bearerToken: /bearer\s+([a-zA-Z0-9\-_\.]{20,})/gi,
+      jwtToken: /eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*/g,
+      awsAccessKey: /AKIA[0-9A-Z]{16}/g,
+      awsSecretKey: /aws_secret_access_key\s*[:=]\s*['\"]([a-zA-Z0-9\/+]{40})['\"]?/gi,
+      databaseUrl: /(postgres|mysql|mongodb|redis):\/\/([a-zA-Z0-9_-]+):([a-zA-Z0-9_\-@!$%^&*()+=]+)@/gi,
+      dbPassword: /password\s*[:=]\s*['\"]([^'\"]{6,})['\"]?/gi,
+      githubToken: /ghp_[a-zA-Z0-9]{36}/g,
+      gitlabToken: /glpat-[a-zA-Z0-9_-]{20,}/g,
+      privateKey: /-----BEGIN (RSA|DSA|EC|PGP|OPENSSH) PRIVATE KEY-----/g,
+      slackWebhook: /https:\/\/hooks\.slack\.com\/services\/[a-zA-Z0-9\/]+/g,
+      discordWebhook: /https:\/\/discord\.com\/api\/webhooks\/[a-zA-Z0-9\/]+/g,
+      secretKey: /['\"]?secret[_-]?key['\"]?\s*[:=]\s*['\"]([a-zA-Z0-9\-_]{20,})['\"]?/gi,
+      accessToken: /['\"]?access[_-]?token['\"]?\s*[:=]\s*['\"]([a-zA-Z0-9\-_\.]{20,})['\"]?/gi,
+      stripeKey: /sk_live_[a-zA-Z0-9]{24,}/g,
+      googleApiKey: /AIza[0-9A-Za-z\-_]{35}/g,
+    };
+
+    // Secret pattern metadata
+    this.secretMetadata = {
+      apiKey: { severity: 'HIGH', keywords: ['api_key', 'apikey'] },
+      bearerToken: { severity: 'CRITICAL', keywords: ['bearer', 'token'] },
+      jwtToken: { severity: 'CRITICAL', keywords: ['jwt', 'token'] },
+      awsAccessKey: { severity: 'CRITICAL', keywords: ['aws', 'access'] },
+      awsSecretKey: { severity: 'CRITICAL', keywords: ['aws', 'secret'] },
+      databaseUrl: { severity: 'CRITICAL', keywords: ['database', 'db', 'postgres', 'mysql'] },
+      dbPassword: { severity: 'CRITICAL', keywords: ['password', 'passwd'] },
+      githubToken: { severity: 'CRITICAL', keywords: ['github', 'token'] },
+      gitlabToken: { severity: 'CRITICAL', keywords: ['gitlab', 'token'] },
+      privateKey: { severity: 'CRITICAL', keywords: ['private', 'key', 'pem'] },
+      slackWebhook: { severity: 'HIGH', keywords: ['slack', 'webhook'] },
+      discordWebhook: { severity: 'HIGH', keywords: ['discord', 'webhook'] },
+      secretKey: { severity: 'HIGH', keywords: ['secret', 'key'] },
+      accessToken: { severity: 'CRITICAL', keywords: ['access', 'token'] },
+      stripeKey: { severity: 'CRITICAL', keywords: ['stripe', 'key'] },
+      googleApiKey: { severity: 'HIGH', keywords: ['google', 'api'] },
+    };
+  }
+
+  /**
+   * Scans a file for hardcoded secrets using REGEX
+   */
+  scanFileForSecretsRegex(filePath, content) {
+    const detectedSecrets = [];
+    const lines = content.split('\n');
+
+    lines.forEach((line, lineIndex) => {
+      // Skip comments and empty lines
+      if (line.trim().startsWith('//') || line.trim().startsWith('#') || line.trim().startsWith('*') || !line.trim()) {
+        return;
+      }
+
+      // Check each pattern
+      for (const [patternName, pattern] of Object.entries(this.regexPatterns)) {
+        const matches = [...line.matchAll(pattern)];
+        
+        for (const match of matches) {
+          const metadata = this.secretMetadata[patternName] || { severity: 'MEDIUM', keywords: [] };
+          
+          detectedSecrets.push({
+            file: filePath,
+            line: lineIndex + 1,
+            column: match.index + 1,
+            type: patternName,
+            secret: match[0].substring(0, 20) + '***',
+            severity: metadata.severity,
+            variable: this.extractVariableName(line, match.index)
+          });
+        }
+      }
+    });
+
+    return detectedSecrets;
+  }
+
+  /**
+   * Extracts variable name from line
+   */
+  extractVariableName(line, matchIndex) {
+    // Look backwards for variable assignment
+    const beforeMatch = line.substring(0, matchIndex);
+    const varMatch = beforeMatch.match(/(?:const|let|var|=)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*[:=]?/);
+    if (varMatch) return varMatch[1];
+    
+    // Look for object property
+    const propMatch = beforeMatch.match(/([a-zA-Z_$][a-zA-Z0-9_$]*)\s*[:=]\s*$/);
+    if (propMatch) return propMatch[1];
+    
+    return 'unknown';
+  }
+
+  /**
+   * Scans entire codebase for secrets (reads from disk)
+   */
+  async scanCodebaseForSecrets(context) {
+    this.secrets = [];
+    this.cwd = context?.cwd || this.context.cwd;
+    const cwd = this.cwd;
+
+    try {
+      // Recursively scan all source files
+      await this.scanDirectory(cwd);
+    } catch (e) {
+      console.error('Error scanning codebase for secrets:', e.message);
+    }
+
+    return this.secrets;
+  }
+
+  /**
+   * Recursively scans directory for source files
+   */
+  async scanDirectory(dirPath) {
+    try {
+      const entries = await fs.readdir(dirPath, { withFileTypes: true });
+
+      for (const entry of entries) {
+        const fullPath = path.join(dirPath, entry.name);
+
+        // Skip node_modules, dist, build, .git
+        if (['node_modules', 'dist', 'build', '.git', '.scaffold-cache', '.next', 'out'].includes(entry.name)) {
+          continue;
+        }
+
+        if (entry.isDirectory()) {
+          await this.scanDirectory(fullPath);
+        } else if (entry.isFile()) {
+          const ext = path.extname(entry.name);
+          if (['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.env', '.env.local'].includes(ext)) {
+            await this.scanFile(fullPath);
+          }
+        }
+      }
+    } catch (e) {
+      // Silently skip directories that can't be read
+    }
+  }
+
+  /**
+   * Scans a single file for secrets
+   */
+  async scanFile(filePath) {
+    try {
+      const content = await fs.readFile(filePath, 'utf8');
+      
+      // Try AST parsing first (if available)
+      let detectedSecrets = [];
+      try {
+        detectedSecrets = this.scanFileForSecretsAST(filePath, content);
+      } catch (e) {
+        // Fall back to REGEX if AST fails
+        detectedSecrets = this.scanFileForSecretsRegex(filePath, content);
+      }
+
+      // If AST returned nothing, try REGEX as additional pass
+      if (detectedSecrets.length === 0) {
+        detectedSecrets = this.scanFileForSecretsRegex(filePath, content);
+      }
+
+      this.secrets.push(...detectedSecrets);
+    } catch (e) {
+      // Skip files that can't be read
+    }
+  }
+
+  /**
+   * Scans file using AST (with OXC if available)
+   */
+  scanFileForSecretsAST(filePath, content) {
+    const detectedSecrets = [];
+
+    try {
+      // Try to use OXC parser if available
+      let ast;
+      try {
+        const { parseSync } = require('oxc-parser');
+        ast = parseSync(content, {
+          sourceType: 'module',
+          ecmaVersion: 'latest'
+        });
+      } catch (e) {
+        // OXC not available, fall back to REGEX
+        return this.scanFileForSecretsRegex(filePath, content);
+      }
+
+      // Walk AST and find variable assignments with secret values
+      this.walkAST(ast, (node) => {
+        // Variable declarations: const API_KEY = "sk_..."
+        if (node.type === 'VariableDeclarator' && node.init) {
+          const varName = node.id?.name || '';
+          const secret = this.extractSecretValue(node.init);
+          
+          if (secret) {
+            const detectedType = this.classifySecret(varName, secret.value);
+            if (detectedType) {
+              detectedSecrets.push({
+                file: filePath,
+                line: node.loc?.start?.line || 0,
+                column: node.loc?.start?.column || 0,
+                type: detectedType.type,
+                severity: detectedType.severity,
+                variable: varName,
+                secret: secret.value.substring(0, 20) + '***'
+              });
+            }
+          }
+        }
+
+        // Object properties: { password: "...", apiKey: "..." }
+        if (node.type === 'Property' && node.value) {
+          const propName = node.key?.name || node.key?.value || '';
+          const secret = this.extractSecretValue(node.value);
+          
+          if (secret) {
+            const detectedType = this.classifySecret(propName, secret.value);
+            if (detectedType) {
+              detectedSecrets.push({
+                file: filePath,
+                line: node.loc?.start?.line || 0,
+                column: node.loc?.start?.column || 0,
+                type: detectedType.type,
+                severity: detectedType.severity,
+                variable: propName,
+                secret: secret.value.substring(0, 20) + '***'
+              });
+            }
+          }
+        }
+
+        // Assignment expressions: API_KEY = "..."
+        if (node.type === 'AssignmentExpression' && node.right) {
+          const varName = node.left?.name || '';
+          const secret = this.extractSecretValue(node.right);
+          
+          if (secret) {
+            const detectedType = this.classifySecret(varName, secret.value);
+            if (detectedType) {
+              detectedSecrets.push({
+                file: filePath,
+                line: node.loc?.start?.line || 0,
+                column: node.loc?.start?.column || 0,
+                type: detectedType.type,
+                severity: detectedType.severity,
+                variable: varName,
+                secret: secret.value.substring(0, 20) + '***'
+              });
+            }
+          }
+        }
+      });
+    } catch (e) {
+      // Return empty on error, will fall back to REGEX
+      return [];
+    }
+
+    return detectedSecrets;
+  }
+
+  /**
+   * Extracts string value from AST node
+   */
+  extractSecretValue(node) {
+    if (node.type === 'StringLiteral' || node.type === 'Literal') {
+      return { value: node.value || '' };
+    }
+    if (node.type === 'TemplateLiteral') {
+      return { value: node.quasis?.[0]?.value?.raw || '' };
+    }
+    return null;
+  }
+
+  /**
+   * Classifies a secret based on variable name and value
+   */
+  classifySecret(variableName, value) {
+    const lowerName = variableName.toLowerCase();
+
+    for (const [type, metadata] of Object.entries(this.secretMetadata)) {
+      const pattern = this.regexPatterns[type];
+      if (!pattern) continue;
+
+      // Check if variable name matches keywords
+      const nameMatches = metadata.keywords.some(kw => lowerName.includes(kw));
+      
+      // Check if value matches pattern
+      const valueMatches = pattern.test(value);
+
+      if ((nameMatches && value.length > 8) || valueMatches) {
+        return { type, severity: metadata.severity };
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Simple AST walker
+   */
+  walkAST(node, callback) {
+    if (!node || typeof node !== 'object') return;
+
+    callback(node);
+
+    for (const key in node) {
+      if (key === 'loc' || key === 'range' || key === 'start' || key === 'end') continue;
+      
+      const child = node[key];
+      if (Array.isArray(child)) {
+        child.forEach(item => this.walkAST(item, callback));
+      } else if (typeof child === 'object') {
+        this.walkAST(child, callback);
+      }
+    }
+  }
+
+  /**
+   * Formats secrets for reporting
+   */
+  formatSecretsForReport() {
+    if (this.secrets.length === 0) return [];
+
+    return this.secrets.map(secret => ({
+      file: secret.file,
+      line: secret.line,
+      column: secret.column,
+      type: secret.type,
+      severity: secret.severity,
+      variable: secret.variable,
+      redacted: secret.secret
+    }));
+  }
+
+  /**
+   * Gets secrets by severity level
+   */
+  getSecretsBySeverity(severity) {
+    return this.secrets.filter(s => s.severity === severity);
+  }
+
+  /**
+   * Gets critical secrets only
+   */
+  getCriticalSecrets() {
+    return this.getSecretsBySeverity('CRITICAL');
+  }
+
+  /**
+   * Gets count of secrets by type
+   */
+  getSecretStats() {
+    const stats = {};
+    this.secrets.forEach(secret => {
+      stats[secret.type] = (stats[secret.type] || 0) + 1;
+    });
+    return stats;
+  }
+}
+
+export default SecretDetector;

package/src/resolution/CircularDetector.js

@@ -4,9 +4,9 @@
  * 
  * Copyright (C) 2026 DreamLongYT
  * Licensed under the Apache License, Version 2.0.
- * "The original code was from the lovely DreamLong"
+ * "The Original Code was made by DreamLongYT"
  * ============================================================================
- * Implements a high-performance Tarjan-based or DFS-based algorithm to
+ * Implements a high-performance Tarjan-based algorithm to
  * detect circular dependencies in the codebase graph.
  * Addresses Knip Issue #1734.
  */
@@ -18,54 +18,105 @@ export class CircularDetector {
   }
 
   /**
-   * Detects cycles in the provided dependency graph
+   * Detects cycles in the provided dependency graph using Tarjan's SCC algorithm
    * @param {Map} graph - The codebase dependency graph
    * @returns {Array} List of detected cycles
    */
-  detectCycles(graph) {
+  detectCycles(graph, context = null) {
+    if (context) this.context = context;
+    this.cwd = context?.cwd || this.context?.cwd || process.cwd();
     this.cycles = [];
-    const visited = new Set();
-    const stack = new Set();
-    const path = [];
+    let index = 0;
+    const stack = [];
+    const indices = new Map();
+    const lowlink = new Map();
+    const onStack = new Set();
 
-    for (const filePath of graph.keys()) {
-      if (!visited.has(filePath)) {
-        this.dfs(filePath, graph, visited, stack, path);
+    const strongconnect = (v) => {
+      indices.set(v, index);
+      lowlink.set(v, index);
+      index++;
+      stack.push(v);
+      onStack.add(v);
+
+      const node = graph.get(v);
+      if (node && node.outgoingEdges) {
+        for (const w of node.outgoingEdges) {
+          if (!indices.has(w)) {
+            strongconnect(w);
+            lowlink.set(v, Math.min(lowlink.get(v), lowlink.get(w)));
+          } else if (onStack.has(w)) {
+            lowlink.set(v, Math.min(lowlink.get(v), indices.get(w)));
+          }
+        }
       }
-    }
 
-    return this.cycles;
-  }
+      if (lowlink.get(v) === indices.get(v)) {
+        const component = [];
+        let w;
+        do {
+          w = stack.pop();
+          onStack.delete(w);
+          component.push(w);
+        } while (w !== v);
 
-  dfs(node, graph, visited, stack, path) {
-    visited.add(node);
-    stack.add(node);
-    path.push(node);
+        if (component.length > 1) {
+          this.cycles.push(component.reverse());
+        } else {
+          // Check for self-loops
+          const node = graph.get(v);
+          if (node && node.outgoingEdges && node.outgoingEdges.has(v)) {
+            this.cycles.push([v]);
+          }
+        }
+      }
+    };
 
-    const edges = graph.get(node)?.outgoingEdges || [];
-    for (const neighbor of edges) {
-      if (stack.has(neighbor)) {
-        // Cycle detected
-        const cycleStartIndex = path.indexOf(neighbor);
-        const cycle = path.slice(cycleStartIndex);
-        this.cycles.push(cycle);
-      } else if (!visited.has(neighbor)) {
-        this.dfs(neighbor, graph, visited, stack, path);
+    for (const v of graph.keys()) {
+      if (!indices.has(v)) {
+        strongconnect(v);
       }
     }
 
-    stack.delete(node);
-    path.pop();
+    return this.cycles;
   }
 
   /**
-   * Formats cycles for reporting
+   * Formats cycles for reporting with file paths
    */
   formatCycles() {
     return this.cycles.map(cycle => {
-      return cycle.join(' -> ') + ' -> ' + cycle[0];
+      const paths = cycle.map(p => {
+        // Extract relative path for readability
+        let rel = p.replace(this.context.cwd, '').replace(/^\//, '');
+        // Convert absolute Windows paths
+        if (rel.includes(':\\')) {
+          rel = rel.split(':\\')[1] || rel;
+        }
+        return rel;
+      });
+      if (cycle.length === 1) return `${paths[0]} -> (self-loop)`;
+      return paths.join(' -> ') + ' -> ' + paths[0];
     });
   }
+
+  /**
+   * Gets detailed cycle information
+   */
+  getCycleDetails() {
+    return this.cycles.map((cycle, idx) => ({
+      cycleId: idx + 1,
+      files: cycle.map(p => {
+        let rel = p.replace(this.context.cwd, '').replace(/^\//, '');
+        if (rel.includes(':\\')) {
+          rel = rel.split(':\\')[1] || rel;
+        }
+        return rel;
+      }),
+      length: cycle.length,
+      isSelfLoop: cycle.length === 1
+    }));
+  }
 }
 
 export default CircularDetector;