thumbgate 1.34.3 → 1.37.1

package/scripts/find-dormant-requires.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * find-dormant-requires — report `const X = require(...)` bindings that are
+ * never referenced again in the file.
+ *
+ * Dependency-free on purpose: this repo has no eslint, no prettier and no lint
+ * script across 1,331 JS files (measured 2026-08-27 on d0bb3768), so there is
+ * no existing tool to lean on and adding one is a separate decision.
+ *
+ * Deliberately conservative — it only reports a binding when ALL of these hold,
+ * so that acting on the output is safe:
+ *   - the require is a top-level `const` with a plain identifier or a simple
+ *     destructuring pattern
+ *   - the identifier appears exactly once in the file (its own declaration)
+ *   - the file is not a test fixture and does not use `eval`
+ *
+ * It does NOT delete anything. Output is a candidate list with file:line.
+ *
+ * Usage: node scripts/find-dormant-requires.js [--json] [--dir=src]
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const argv = process.argv.slice(2);
+const asJson = argv.includes('--json');
+const dirArg = (argv.find((a) => a.startsWith('--dir=')) || '').slice(6);
+
+function tracked() {
+  // Invoking `git` by name is intentional: this detector runs inside a
+  // developer's repo where git must come from the user's own PATH. Pinning an
+  // absolute path would break on machines installing git via brew/apt/scoop/
+  // Xcode/Git-for-Windows. The command name ('git') is a hard-coded literal
+  // and args is an array, so execFileSync never goes through a shell.
+  const out = execFileSync('git', ['ls-files', '*.js'], { cwd: ROOT, encoding: 'utf8' }); // NOSONAR javascript:S4036
+  return out
+    .split('\n')
+    .filter(Boolean)
+    .filter((f) => !dirArg || f.startsWith(dirArg))
+    .filter((f) => !f.includes('node_modules/'))
+    .filter((f) => !f.endsWith('.min.js'));
+}
+
+/**
+ * Escape every RegExp metacharacter, backslash included.
+ * The first version escaped only the dollar sign, which CodeQL flagged as
+ * incomplete escaping (js/incomplete-sanitization): a backslash would survive
+ * into the constructed pattern and corrupt it.
+ */
+function escapeRegExp(text) {
+  return String(text).replace(/[.*+?^${}()|[\]\\]/g, (m) => "\\" + m);
+}
+
+// `const NAME = require(` and `const { A, B } = require(`
+const SINGLE = /^\s*const\s+([A-Za-z_$][\w$]*)\s*=\s*require\(/;
+const DESTRUCT = /^\s*const\s*\{([^}]+)\}\s*=\s*require\(/;
+
+const findings = [];
+let scanned = 0;
+
+for (const rel of tracked()) {
+  const abs = path.join(ROOT, rel);
+  let src;
+  try {
+    src = fs.readFileSync(abs, 'utf8');
+  } catch {
+    continue;
+  }
+  scanned++;
+  if (src.includes('eval(')) continue; // identifiers may be referenced dynamically
+
+  const lines = src.split('\n');
+  const names = [];
+  lines.forEach((line, i) => {
+    const s = SINGLE.exec(line);
+    if (s) {
+      names.push({ name: s[1], line: i + 1 });
+      return;
+    }
+    const d = DESTRUCT.exec(line);
+    if (d) {
+      d[1]
+        .split(',')
+        .map((p) => p.trim().split(':').pop().trim())
+        .filter((p) => /^[A-Za-z_$][\w$]*$/.test(p))
+        .forEach((n) => names.push({ name: n, line: i + 1 }));
+    }
+  });
+  if (!names.length) continue;
+
+  for (const { name, line } of names) {
+    // count whole-word occurrences across the file
+    const re = new RegExp(`\\b${escapeRegExp(name)}\\b`, 'g');
+    const hits = (src.match(re) || []).length;
+    if (hits <= 1) findings.push({ file: rel, line, name });
+  }
+}
+
+if (asJson) {
+  console.log(JSON.stringify({ scanned, findings }, null, 2));
+} else {
+  console.log(`scanned ${scanned} tracked .js files`);
+  console.log(`dormant require bindings: ${findings.length}\n`);
+  const byFile = {};
+  for (const f of findings) {
+    byFile[f.file] = byFile[f.file] || [];
+    byFile[f.file].push(f);
+  }
+  const sorted = Object.entries(byFile).sort((a, b) => b[1].length - a[1].length);
+  for (const [file, list] of sorted.slice(0, 40)) {
+    console.log(`  ${file}`);
+    for (const f of list) console.log(`      line ${String(f.line).padStart(4)}  ${f.name}`);
+  }
+  if (sorted.length > 40) console.log(`  ... and ${sorted.length - 40} more files`);
+}

package/scripts/fs-utils.js

@@ -11,6 +11,48 @@
 const fs = require('fs');
 const path = require('path');
 
+// Shared dashboard/statusline tail. Production feedback JSONL can exceed
+// V8 string limits and starve /v1/dashboard past the authenticated proof budget.
+const DEFAULT_JSONL_TAIL_BYTES = 4 * 1024 * 1024;
+const DEFAULT_JSONL_TAIL_ENTRIES = 20_000;
+
+/**
+ * Read a file, or only its newest `maxBytes` when the file is larger.
+ * Incomplete first line after a mid-file seek is dropped.
+ * @param {string} filePath
+ * @param {number} [maxBytes]
+ * @returns {{ text: string, truncated: boolean, size: number }}
+ */
+const HARD_FULL_READ_BYTES = 64 * 1024 * 1024;
+
+function readTextTail(filePath, maxBytes) {
+  const stats = fs.statSync(filePath);
+  const size = stats.size || 0;
+  if (size <= 0) return { text: '', truncated: false, size: 0 };
+  let budget = Number(maxBytes);
+  // budget<=0 historically meant "read entire file". On oversized prod logs that
+  // throws "Cannot create a string longer than 0x1fffffe8 characters".
+  // Also refuse full reads when size exceeds the hard ceiling even if the caller
+  // passed an oversized maxBytes (dashboard_data 503 / V8 string limit).
+  if (size > HARD_FULL_READ_BYTES && (!budget || budget >= size || budget > HARD_FULL_READ_BYTES)) {
+    budget = DEFAULT_JSONL_TAIL_BYTES;
+  }
+  if (!budget || size <= budget) {
+    return { text: fs.readFileSync(filePath, 'utf-8'), truncated: false, size };
+  }
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const buffer = Buffer.alloc(budget);
+    fs.readSync(fd, buffer, 0, budget, size - budget);
+    let text = buffer.toString('utf-8');
+    const firstNewline = text.indexOf('\n');
+    if (firstNewline >= 0) text = text.slice(firstNewline + 1);
+    return { text, truncated: true, size };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 /**
  * Recursively create a directory if it does not exist.
  * @param {string} dirPath
@@ -40,26 +82,50 @@ function ensureParentDir(filePath) {
  * @param {boolean} [options.tail] - Read from the end while preserving chronological order
  * @returns {object[]}
  */
+function positiveNumber(value) {
+  return Math.max(0, Number(value) || 0);
+}
+
 function readJsonl(filePath, options = {}) {
   if (!filePath || !fs.existsSync(filePath)) return [];
-  const raw = fs.readFileSync(filePath, 'utf-8').trim();
-  if (!raw) return [];
-
   const normalizedOptions = typeof options === 'number'
     ? { maxLines: options, tail: true }
     : (options || {});
+  const maxLines = positiveNumber(normalizedOptions.maxLines);
+  // Opt-in full reads only. Unbounded readFileSync blows past V8 string limits
+  // on production feedback/memory JSONL (dashboard_data 503 / 0x1fffffe8).
+  const wantFull = normalizedOptions.full === true;
+  let maxBytes = positiveNumber(normalizedOptions.maxBytes);
+  if (!wantFull && maxBytes <= 0) {
+    maxBytes = (maxLines > 0 || normalizedOptions.tail)
+      ? DEFAULT_JSONL_TAIL_BYTES
+      : DEFAULT_JSONL_TAIL_BYTES;
+  }
+  if (wantFull) {
+    maxBytes = 0; // readTextTail(0) => full file
+  }
+  let raw = '';
+  try {
+    raw = readTextTail(filePath, maxBytes).text.trim();
+  } catch {
+    return [];
+  }
+  if (!raw) return [];
   let lines = raw.split('\n');
 
-  if (normalizedOptions.tail && normalizedOptions.maxLines > 0) {
-    lines = lines.slice(-normalizedOptions.maxLines);
+  const effectiveMaxLines = maxLines > 0 ? maxLines : DEFAULT_JSONL_TAIL_ENTRIES;
+  if (!wantFull) {
+    lines = lines.slice(-effectiveMaxLines);
+  } else if (normalizedOptions.tail && maxLines > 0) {
+    lines = lines.slice(-maxLines);
   }
 
   if (normalizedOptions.reverse) {
     lines = lines.reverse();
   }
 
-  if (!normalizedOptions.tail && normalizedOptions.maxLines && normalizedOptions.maxLines > 0) {
-    lines = lines.slice(0, normalizedOptions.maxLines);
+  if (wantFull && !normalizedOptions.tail && maxLines > 0) {
+    lines = lines.slice(0, maxLines);
   }
 
   return lines
@@ -101,4 +167,14 @@ function readJsonlTail(filePath, limit) {
   return readJsonl(filePath, { maxLines: limit, tail: true });
 }
 
-module.exports = { ensureDir, ensureParentDir, readJsonl, readJsonlTail, appendJsonl, writeJson };
+module.exports = {
+  DEFAULT_JSONL_TAIL_BYTES,
+  DEFAULT_JSONL_TAIL_ENTRIES,
+  ensureDir,
+  ensureParentDir,
+  readJsonl,
+  readJsonlTail,
+  readTextTail,
+  appendJsonl,
+  writeJson,
+};

package/scripts/gate-stats.js

@@ -39,10 +39,10 @@ function calculateStats() {
   // Count total blocks/warns from occurrences in auto-promoted gates
   const totalBlocked = autoGates
     .filter((g) => g.action === 'block')
-    .reduce((sum, g) => sum + (g.occurrences || 0), 0);
+    .reduce((sum, g) => sum + (Number(g.occurrences) || 0), 0);
   const totalWarned = autoGates
     .filter((g) => g.action === 'warn')
-    .reduce((sum, g) => sum + (g.occurrences || 0), 0);
+    .reduce((sum, g) => sum + (Number(g.occurrences) || 0), 0);
 
   // Top blocked gate. A configured block rule with zero occurrences is not a
   // "top blocker"; only recorded block events should appear here.