upstreamfix 0.1.2 → 0.1.3

package/dist/core/probe.js

@@ -0,0 +1,155 @@
+import { chmod, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { newTypeScriptDiagnostics, parseTypeScriptDiagnostics } from './diagnostic-diff.js';
+import { copyProject, executeWithProcessGroup, sanitizedEnvironment } from './verify.js';
+import { validateExactVersion } from './diff-api.js';
+import { migrations } from '../migrations/index.js';
+import { registerTemporaryCleanup } from './process-cleanup.js';
+import { randomUUID } from 'node:crypto';
+import { parseManifest } from './manifest.js';
+import { dockerBindArgs } from './docker-mount.js';
+const nodeImage = 'node:24.22.0-bookworm-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5';
+function parseTarget(target) {
+    const at = target.lastIndexOf('@');
+    if (at <= 0)
+        throw new Error('Probe target must be a package with an exact version, such as stripe@23.0.0.');
+    const packageName = target.slice(0, at);
+    const version = target.slice(at + 1);
+    if (!/^(?:@[a-z0-9_][a-z0-9_.-]*\/)?[a-z0-9_][a-z0-9_.-]*$/i.test(packageName))
+        throw new Error('Invalid npm package name.');
+    validateExactVersion(version);
+    return { packageName, version };
+}
+const realExecutor = async (_phase, command, args, cwd, env, timeoutMs) => {
+    try {
+        const result = await executeWithProcessGroup(command, args, cwd, env, timeoutMs);
+        return { code: 0, output: `${result.stdout}${result.stderr}` };
+    }
+    catch (error) {
+        const cause = error;
+        return { code: 1, output: `${cause.stdout ?? ''}${cause.stderr ?? ''}\n${cause.message}` };
+    }
+};
+export async function probeProject(cwd, target, options = {}) {
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1000)) {
+        throw new Error('Probe timeout must be at least one second.');
+    }
+    const { packageName, version } = parseTarget(target);
+    const base = {
+        status: 'confirmation-required', package: packageName, targetVersion: version,
+        estimatedDownload: 'Estimated cold download: 100–500 MB for two npm installs, plus the pinned Node Docker image if absent.',
+        preexisting: [], newDiagnostics: [], manualFindings: [],
+    };
+    if (!options.confirmed)
+        return base;
+    const root = await mkdtemp(path.join(os.tmpdir(), 'upstreamfix-probe-'));
+    const unregisterCleanup = registerTemporaryCleanup(() => rm(root, { recursive: true, force: true }));
+    const project = path.join(root, 'project');
+    const home = path.join(root, 'home');
+    const execute = options.execute ?? ((phase, command, args, directory, env) => realExecutor(phase, command, args, directory, env, options.timeoutMs ?? 5 * 60 * 1000));
+    let unregisterContainerCleanup;
+    let removeContainer;
+    try {
+        await mkdir(project);
+        await mkdir(home);
+        await writeFile(path.join(home, 'npmrc.user'), '');
+        await writeFile(path.join(home, 'npmrc.global'), '');
+        await copyProject(path.resolve(cwd), project, 'probe');
+        const manifestPath = path.join(project, 'package.json');
+        const manifest = parseManifest(await readFile(manifestPath, 'utf8'));
+        const sections = ['dependencies', 'devDependencies', 'optionalDependencies'];
+        const section = sections.find((name) => typeof manifest[name]?.[packageName] === 'string');
+        if (!section)
+            return { ...base, status: 'unavailable', note: `${packageName} is not declared in the root package.json.` };
+        const lockContents = await readFile(path.join(project, 'package-lock.json'), 'utf8').catch(() => undefined);
+        if (!lockContents) {
+            return { ...base, status: 'unavailable', note: 'A root package-lock.json is required for a reproducible npm baseline.' };
+        }
+        const lock = JSON.parse(lockContents);
+        const lockedVersion = lock.packages?.[`node_modules/${packageName}`]?.version;
+        if (typeof lockedVersion !== 'string' || !/^\d+\.\d+\.\d+/.test(lockedVersion)) {
+            return { ...base, status: 'unavailable', note: `The lockfile does not contain an exact installed ${packageName} version.` };
+        }
+        const currentVersion = lockedVersion;
+        const env = sanitizedEnvironment(home);
+        const dockerEnv = { ...env };
+        for (const key of ['DOCKER_HOST', 'DOCKER_CONTEXT', 'DOCKER_TLS_VERIFY', 'DOCKER_CERT_PATH']) {
+            if (process.env[key])
+                dockerEnv[key] = process.env[key];
+        }
+        const containerName = `upstreamfix-probe-${process.pid}-${randomUUID()}`;
+        removeContainer = async () => {
+            await execute('baseline-typecheck', 'docker', ['rm', '-f', containerName], project, dockerEnv).catch(() => undefined);
+        };
+        unregisterContainerCleanup = registerTemporaryCleanup(removeContainer);
+        const run = async (phase, command, args) => {
+            const result = await execute(phase, command, args, project, command === 'docker' ? dockerEnv : env);
+            if (command === 'docker' && result.code !== 0) {
+                await execute(phase, 'docker', ['rm', '-f', containerName], project, dockerEnv).catch(() => undefined);
+            }
+            return result;
+        };
+        const baselineInstall = await run('baseline-install', 'npm', ['ci', '--ignore-scripts', '--no-audit', '--no-fund', '--prefer-offline']);
+        if (baselineInstall.code !== 0)
+            return { ...base, currentVersion, status: 'unavailable', note: `Baseline installation failed: ${baselineInstall.output.slice(-2000)}` };
+        await makeDockerReadable(project);
+        const typeArgs = [
+            'run', '--rm', '--init', '--name', containerName, '--network=none', '--read-only', '--cap-drop=ALL', '--security-opt=no-new-privileges',
+            '--memory=1536m', '--memory-swap=1536m', '--pids-limit=128', '--user=65534:65534',
+            '--tmpfs=/tmp:rw,nosuid,nodev,size=64m', ...dockerBindArgs(project, '/workspace', true), '-w', '/workspace',
+            nodeImage, 'node', '/workspace/node_modules/typescript/bin/tsc', '--noEmit', '--pretty', 'false',
+        ];
+        const before = await run('baseline-typecheck', 'docker', typeArgs);
+        const baselineDiagnostics = parseTypeScriptDiagnostics(before.output);
+        if (before.code !== 0 && baselineDiagnostics.length === 0) {
+            return { ...base, currentVersion, status: 'unavailable', note: `Baseline typecheck failed without readable diagnostics: ${before.output.slice(-2000)}` };
+        }
+        const targetInstall = await run('target-install', 'npm', ['install', `${packageName}@${version}`, '--save-exact', '--ignore-scripts', '--no-audit', '--no-fund', '--prefer-offline']);
+        if (targetInstall.code !== 0)
+            return { ...base, currentVersion, status: 'unavailable', preexisting: baselineDiagnostics, note: `Target installation failed: ${targetInstall.output.slice(-2000)}` };
+        await makeDockerReadable(project);
+        const after = await run('target-typecheck', 'docker', typeArgs);
+        const afterDiagnostics = parseTypeScriptDiagnostics(after.output);
+        if (after.code !== 0 && afterDiagnostics.length === 0) {
+            return { ...base, currentVersion, status: 'unavailable', preexisting: baselineDiagnostics, note: `Target typecheck failed without readable diagnostics: ${after.output.slice(-2000)}` };
+        }
+        const newDiagnostics = newTypeScriptDiagnostics(baselineDiagnostics, afterDiagnostics);
+        const guideUrl = migrations.find((migration) => migration.packageName === packageName && migration.toMajor === Number(version.split('.')[0]))?.guideUrl;
+        const manualFindings = newDiagnostics.map((diagnostic) => ({
+            file: diagnostic.file,
+            line: diagnostic.line,
+            message: diagnostic.message,
+            symbol: /['`"]([^'`"]+)['`"]/.exec(diagnostic.message)?.[1],
+            confidence: 'candidate',
+            ...(guideUrl ? { guideUrl } : {}),
+        }));
+        return { ...base, currentVersion, status: 'available', preexisting: baselineDiagnostics, newDiagnostics, manualFindings,
+            note: 'New compiler errors are candidates, not proof that the SDK caused them. No code was rewritten.' };
+    }
+    catch (error) {
+        return { ...base, status: 'unavailable', note: error instanceof Error ? error.message : String(error) };
+    }
+    finally {
+        if (removeContainer)
+            await removeContainer();
+        unregisterContainerCleanup?.();
+        unregisterCleanup();
+        await rm(root, { recursive: true, force: true });
+    }
+}
+async function makeDockerReadable(directory) {
+    await chmod(directory, 0o755);
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+        if (entry.name === '.git')
+            continue;
+        const absolute = path.join(directory, entry.name);
+        const info = await lstat(absolute);
+        if (info.isSymbolicLink())
+            continue;
+        if (info.isDirectory())
+            await makeDockerReadable(absolute);
+        else if (info.isFile())
+            await chmod(absolute, info.mode | 0o444);
+    }
+}

package/dist/core/project-discovery.js

@@ -0,0 +1,10 @@
+/** Shared traversal exclusions for migration, scan, verification, and benchmark discovery. */
+export const IGNORED_PROJECT_DIRECTORIES = new Set([
+    '.git', 'node_modules', 'dist', 'coverage', '.next', '.nuxt', '.turbo', '.cache',
+    '.codex', '.claude', '.venv', 'venv', '.yarn',
+]);
+/** A single-major npm declaration the migration engine can reason about safely. */
+export function isSupportedSourceMajor(range, major) {
+    const match = /^\s*[~^]?(\d+)(?:\.(?:\d+|x|\*)){0,2}\s*$/i.exec(range);
+    return match !== null && Number(match[1]) === major;
+}

package/dist/core/report.js

@@ -12,7 +12,7 @@ export function renderMarkdownReport(migration, outcome, dryRun, verification) {
     lines.push(`- Official guide: ${migration.guideUrl}`);
     lines.push('');
     if (total === 0) {
-        lines.push('No supported Firebase Admin namespace usages were found in the scanned files.');
+        lines.push(`No supported ${escapeMarkdownText(migration.title)} usages were found in the scanned files.`);
         lines.push('');
     }
     if (outcome.manual.length > 0) {
@@ -38,7 +38,7 @@ export function renderMarkdownReport(migration, outcome, dryRun, verification) {
         lines.push('- Scope: temporary project copy; the original project was not changed.');
         lines.push('- Verification commands run on this machine with a restricted environment, without copied credentials or package install scripts; project test code is still executable code and is not network-isolated.');
         if (verification.note)
-            lines.push(`- Note: ${verification.note}`);
+            lines.push(`- Note: ${escapeMarkdownText(verification.note)}`);
         if (verification.checks.length > 0) {
             lines.push('');
             lines.push('| Check | Command | Result | Duration | Output |');
@@ -84,19 +84,46 @@ export function renderMarkdownReport(migration, outcome, dryRun, verification) {
         lines.push('3. Handle the items listed under "Needs your attention".');
     }
     lines.push('');
-    const raw = lines.join('\n');
+    const raw = stripTerminalControls(lines.join('\n'));
     const sanitized = maskSecrets(raw);
     return sanitized === raw ? raw : `${sanitized}\n> Warning: possible credentials were detected in the report and redacted. Review the source before sharing this report.`;
 }
 /** Redact common provider credentials and private-key material from every report field. */
 export function maskSecrets(value) {
-    return value
-        .replace(/-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g, '[PRIVATE KEY REDACTED]')
-        .replace(/((?:"|\b)private_key(?:"|\b)\s*:\s*)(?:"(?:\\.|[^"\\])*"|'[^']*'|[^,\r\n}]+)/gi, '$1"[REDACTED]"')
+    return redactPrivateKeys(value)
+        .replace(/((?:\\?"private_key\\?"|private_key|privateKey)\s*:\s*)\\?"[^"\r\n]*\\?"/gi, '$1"[REDACTED]"')
+        .replace(/((?:"|\b)private\\?_key(?:"|\b)\s*:\s*)(?:"(?:\\.|[^"\\])*"|'[^']*'|[^,\r\n}]+)/gi, '$1"[REDACTED]"')
         .replace(/\b(?:sk|rk|pk)\\?_(?:live|test)\\?_(?:[A-Za-z0-9-]|\\?_){8,}\b/gi, '[API key redacted]')
+        .replace(/\bsk_org_[A-Za-z0-9_-]{8,}\b/g, '[API key redacted]')
+        .replace(/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, '[GitHub token redacted]')
+        .replace(/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, '[GitHub token redacted]')
+        .replace(/\bxox[bp]-[A-Za-z0-9-]{20,}\b/g, '[Slack token redacted]')
+        .replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, '[AWS key redacted]')
         .replace(/\bwhsec\\?_(?:[A-Za-z0-9-]|\\?_){8,}\b/gi, '[webhook secret redacted]')
         .replace(/\bAIza[0-9A-Za-z_-]{20,}\b/g, '[API key redacted]');
 }
+function redactPrivateKeys(value) {
+    const begin = /-----BEGIN ((?:(?:[A-Z0-9]+ )*PRIVATE KEY|PGP PRIVATE KEY BLOCK))-----/g;
+    let result = '';
+    let cursor = 0;
+    for (let match = begin.exec(value); match; match = begin.exec(value)) {
+        result += value.slice(cursor, match.index) + '[PRIVATE KEY REDACTED]';
+        const endMarker = `-----END ${match[1]}-----`;
+        const end = value.indexOf(endMarker, begin.lastIndex);
+        if (end < 0)
+            return result;
+        cursor = end + endMarker.length;
+        begin.lastIndex = cursor;
+    }
+    return result + value.slice(cursor);
+}
+/** Escape third-party command output before placing it in a public Markdown table. */
+export function escapeUntrustedMarkdownCell(value) {
+    return maskSecrets(stripTerminalControls(value))
+        .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+        .replace(/`/g, '&#96;').replace(/\[/g, '&#91;').replace(/\]/g, '&#93;')
+        .replaceAll('|', '&#124;').replace(/[\r\n\u2028\u2029]+/g, ' ').trim();
+}
 /** Keep the Markdown artifact intact while making prose readable in a terminal. */
 export function renderTerminalReport(markdown) {
     let inFence = false;
@@ -113,17 +140,50 @@ export function renderTerminalReport(markdown) {
             .replace(/&amp;/g, '&')
             .replace(/\\([\\`*_{}\[\]()#+.!])/g, '$1');
     }).join('\n');
-    return maskSecrets(readable);
+    return sanitizeTerminalText(readable);
+}
+export function sanitizeTerminalText(value) {
+    return maskSecrets(stripTerminalControls(value));
+}
+function stripTerminalControls(value) {
+    let clean = '';
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code === 0x1b) {
+            const kind = value[i + 1];
+            if (kind === '[') {
+                i += 2;
+                while (i < value.length && !(value.charCodeAt(i) >= 0x40 && value.charCodeAt(i) <= 0x7e))
+                    i++;
+            }
+            else if (kind === ']' || kind === 'P' || kind === 'X' || kind === '^' || kind === '_') {
+                i += 2;
+                while (i < value.length && value.charCodeAt(i) !== 0x07 && !(value[i] === '\x1b' && value[i + 1] === '\\'))
+                    i++;
+                if (value[i] === '\x1b')
+                    i++;
+            }
+            else
+                i++;
+            continue;
+        }
+        if ((code < 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d) || (code >= 0x7f && code <= 0x9f)
+            || (code >= 0x202a && code <= 0x202e) || (code >= 0x2066 && code <= 0x2069))
+            continue;
+        clean += value[i];
+    }
+    return clean;
 }
 function markdownCell(value) {
     return escapeMarkdownText(value).replace(/\|/g, '\\|').replace(/\r?\n/g, '<br>');
 }
 function escapeMarkdownText(value) {
-    return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-        .replace(/([\\`*_{}\[\]()#+.!])/g, '\\$1');
+    return sanitizeTerminalText(value).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+        .replace(/([\\`*_{}\[\]()#+.!])/g, '\\$1')
+        .replaceAll('\\[API key redacted\\]', '[API key redacted]');
 }
 function inlineCode(value) {
-    const normalized = value.replace(/\r?\n/g, ' ').replace(/\|/g, '\\|');
+    const normalized = sanitizeTerminalText(value).replace(/\r?\n/g, ' ').replace(/\|/g, '\\|');
     const runs = [...normalized.matchAll(/`+/g)].map(([run]) => run.length);
     const delimiter = '`'.repeat(Math.max(1, ...runs) + 1);
     const needsPadding = normalized.startsWith('`') || normalized.endsWith('`') || /^\s|\s$/.test(normalized);