vibecodedshit 0.0.0-stage → 0.3.0

package/dist/measure/p4-4.js

@@ -0,0 +1,309 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { analyzePythonDeadCode } from '../python/deadcode.js';
+import { isOutcome, knipFailed, runKnip } from '../tools/knip.js';
+import { failureReason, unavailable } from '../tools/outcome.js';
+import { createWorkCopy } from '../tools/workcopy.js';
+import { readToml } from '../util/toml.js';
+import { countExportedSymbols } from './ts/exports.js';
+import { emptyTallies, logicFiles, tallyUnits, unitId } from './units.js';
+/** methodology 4.4: vulture min-confidence 60. */
+const VULTURE_MIN_CONFIDENCE = '60';
+const VULTURE_LINE = /^(.+?):(\d+): unused (function|class|method) '(.+)' \((\d+)% confidence\)$/;
+/** Module basenames that are entry points: never reported as unused modules (methodology 4.4). */
+const ENTRY_NAMES = new Set([
+    '__main__', 'manage', 'wsgi', 'asgi', 'conftest', 'settings',
+    'models', 'admin', 'apps', 'urls', 'views', // Django conventions
+    'main', // FastAPI
+]);
+function asRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function pkgDirOf(pkg) {
+    return pkg === '.' ? '' : pkg;
+}
+function joinRel(...parts) {
+    return parts.filter((p) => p !== '').join('/');
+}
+// ---- TypeScript and JavaScript ----------------------------------------------------------
+/** Fills the TS/JS tallies. `failed` collects the units beneath a knip root whose install and knip both failed. */
+async function measureTypeScript(ctx, tallies, warnings, failed) {
+    const files = logicFiles(ctx.scope, 'typescript_javascript');
+    if (files.length === 0)
+        return null;
+    const knip = await runKnip(ctx);
+    if (!isOutcome(knip))
+        return knip;
+    warnings.push(...knip.warnings.map((w) => `4.4: ${w}`));
+    const perUnit = new Map();
+    for (const file of files) {
+        if (knipFailed(knip, file.path)) {
+            failed.add(unitId(file));
+            continue;
+        }
+        const exported = countExportedSymbols(ctx.scope.getTsSourceFile(file.path));
+        const issues = knip.files.get(file.path);
+        const unused = issues?.unusedFile ? exported : (issues?.exports ?? 0);
+        const key = unitId(file);
+        const unit = perUnit.get(key) ?? { numerator: 0, denominator: 0 };
+        unit.denominator += exported;
+        unit.numerator += unused;
+        perUnit.set(key, unit);
+    }
+    for (const [key, unit] of perUnit) {
+        const tally = tallies.get(key);
+        if (!tally)
+            continue;
+        if (unit.numerator > unit.denominator) {
+            warnings.push(`4.4: ${tally.package} (${tally.group}): knip reported ${unit.numerator} unused exports for ${unit.denominator} exported symbols, clamped`);
+            unit.numerator = unit.denominator;
+        }
+        tally.numerator += unit.numerator;
+        tally.denominator += unit.denominator;
+    }
+    return null;
+}
+function importRoots(pkg) {
+    const dir = pkgDirOf(pkg);
+    return [...new Set([dir, joinRel(dir, 'src'), ''])];
+}
+/** Module parts of `file` under import root `root`, or undefined when the file is not under it. */
+function modulePartsUnder(file, root) {
+    if (root !== '' && !file.startsWith(`${root}/`))
+        return undefined;
+    const rel = root === '' ? file : file.slice(root.length + 1);
+    const parts = rel.replace(/\.py$/, '').split('/');
+    if (parts[parts.length - 1] === '__init__')
+        parts.pop();
+    return parts;
+}
+function isDistributedPackage(repoPath, pkg, pyproject) {
+    if (pyproject && (asRecord(pyproject.project) || asRecord(asRecord(pyproject.tool)?.poetry)))
+        return true;
+    const dir = path.join(repoPath, pkgDirOf(pkg));
+    return existsSync(path.join(dir, 'setup.py')) || existsSync(path.join(dir, 'setup.cfg'));
+}
+function scriptTargets(pyproject) {
+    const targets = { modules: new Set(), objects: new Set() };
+    const add = (scripts) => {
+        for (const value of Object.values(asRecord(scripts) ?? {})) {
+            const text = typeof value === 'string' ? value : typeof asRecord(value)?.reference === 'string' ? String(asRecord(value)?.reference) : '';
+            const [modulePart, objectPart] = text.split(':');
+            const module = (modulePart ?? '').trim();
+            if (module === '')
+                continue;
+            targets.modules.add(module);
+            const object = (objectPart ?? '').trim();
+            if (object !== '')
+                targets.objects.add(`${module}:${object}`);
+        }
+    };
+    add(asRecord(pyproject?.project)?.scripts);
+    add(asRecord(asRecord(pyproject?.tool)?.poetry)?.scripts);
+    return targets;
+}
+function isEntryModule(mod, scripts) {
+    const segments = mod.file.path.replace(/\.py$/, '').split('/');
+    const base = segments[segments.length - 1] ?? '';
+    if (ENTRY_NAMES.has(base))
+        return true;
+    if (segments.slice(0, -1).includes('settings'))
+        return true;
+    return [...mod.names].some((name) => scripts.modules.has(name));
+}
+/** Imported dotted name to the files that import it. */
+function importGraph(modules, tests, pkg) {
+    const importedBy = new Map();
+    const mark = (name, importer) => {
+        if (name === '')
+            return;
+        const set = importedBy.get(name) ?? new Set();
+        set.add(importer);
+        importedBy.set(name, set);
+    };
+    const markWithParents = (parts, importer) => {
+        for (let i = 1; i <= parts.length; i += 1)
+            mark(parts.slice(0, i).join('.'), importer);
+    };
+    for (const mod of [...modules, ...tests]) {
+        for (const root of importRoots(pkg)) {
+            const own = modulePartsUnder(mod.file.path, root);
+            if (!own)
+                continue;
+            const isInit = mod.file.path.endsWith('/__init__.py') || mod.file.path === '__init__.py';
+            const ownPackage = isInit ? own : own.slice(0, -1);
+            for (const imp of mod.info.imports) {
+                const moduleParts = imp.module === '' ? [] : imp.module.split('.');
+                let base;
+                if (imp.level === 0) {
+                    base = moduleParts;
+                }
+                else {
+                    const keep = ownPackage.length - (imp.level - 1);
+                    if (keep < 0)
+                        continue;
+                    base = [...ownPackage.slice(0, keep), ...moduleParts];
+                }
+                markWithParents(base, mod.file.path);
+                if (imp.names.length > 0 && base.length > 0) {
+                    for (const name of imp.names)
+                        mark([...base, name].join('.'), mod.file.path);
+                }
+                else if (imp.names.length > 0) {
+                    for (const name of imp.names)
+                        mark(name, mod.file.path);
+                }
+            }
+        }
+    }
+    return importedBy;
+}
+/**
+ * A method vulture flags is used when it may be called through a base class (methodology 4.4): its class,
+ * directly or through base classes defined in the repository, has a base defined outside the scanned files
+ * (a framework or standard-library hook), or a base class defined in the repository has a method of the same name.
+ */
+export function isOverride(infos, file, qualname) {
+    const dot = qualname.indexOf('.');
+    if (dot === -1)
+        return false;
+    const method = qualname.slice(dot + 1);
+    const seen = new Set([`${file}\0${qualname.slice(0, dot)}`]);
+    const queue = [[file, qualname.slice(0, dot)]];
+    for (let next = queue.shift(); next; next = queue.shift()) {
+        const [classFile, className] = next;
+        const info = infos[classFile];
+        const cls = info?.ok ? info.classes[className] : undefined;
+        for (const base of cls?.bases ?? []) {
+            if (base.file === null || base.class === null)
+                return true;
+            const key = `${base.file}\0${base.class}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const baseInfo = infos[base.file];
+            if (baseInfo?.ok && baseInfo.symbols.some((s) => s.kind === 'method' && s.qualname === `${base.class}.${method}`))
+                return true;
+            queue.push([base.file, base.class]);
+        }
+    }
+    return false;
+}
+function matchSymbol(symbols, name, line) {
+    return symbols.find((s) => s.name === name && s.startLine <= line && line <= s.line);
+}
+async function measurePython(ctx, tallies, warnings) {
+    const logic = logicFiles(ctx.scope, 'python');
+    if (logic.length === 0)
+        return null;
+    const tests = ctx.scope.files.filter((f) => f.role === 'test' && f.group === 'python');
+    const vulture = await ctx.tools.resolve('vulture');
+    if (!vulture)
+        return unavailable(ctx.tools.notFoundReason('vulture'));
+    const infos = analyzePythonDeadCode(ctx.repoPath, [...logic, ...tests].map((f) => f.path));
+    let unparsed = 0;
+    for (const file of [...logic, ...tests])
+        if (infos[file.path]?.ok !== true)
+            unparsed += 1;
+    if (unparsed > 0)
+        warnings.push(`4.4: ${unparsed} Python files could not be parsed`);
+    const toModule = (file) => {
+        const info = infos[file.path];
+        if (!info || !info.ok)
+            return undefined;
+        const names = new Set();
+        for (const root of importRoots(file.package)) {
+            const parts = modulePartsUnder(file.path, root);
+            if (parts && parts.length > 0)
+                names.add(parts.join('.'));
+        }
+        return { file, info, names };
+    };
+    const packages = [...new Set(logic.map((f) => f.package))];
+    for (const pkg of packages) {
+        const unitLogic = logic.filter((f) => f.package === pkg).map(toModule).filter((m) => m !== undefined);
+        const unitTests = tests.filter((f) => f.package === pkg).map(toModule).filter((m) => m !== undefined);
+        const tally = tallies.get(unitId({ package: pkg, group: 'python' }));
+        if (!tally || unitLogic.length === 0)
+            continue;
+        const pyprojectPath = path.join(ctx.repoPath, joinRel(pkgDirOf(pkg), 'pyproject.toml'));
+        const pyproject = readToml(pyprojectPath);
+        if (pyproject === undefined && existsSync(pyprojectPath)) {
+            warnings.push(`${joinRel(pkgDirOf(pkg), 'pyproject.toml')}: invalid TOML, ignored`);
+        }
+        const distributed = isDistributedPackage(ctx.repoPath, pkg, pyproject);
+        const scripts = scriptTargets(pyproject);
+        const importedBy = importGraph(unitLogic, unitTests, pkg);
+        const unusedModules = new Set();
+        for (const mod of unitLogic) {
+            if (isEntryModule(mod, scripts))
+                continue;
+            const used = [...mod.names].some((name) => [...(importedBy.get(name) ?? [])].some((importer) => importer !== mod.file.path));
+            if (!used)
+                unusedModules.add(mod.file.path);
+        }
+        const copy = await createWorkCopy(ctx.repoPath, [...unitLogic, ...unitTests].map((m) => m.file.path));
+        let hits;
+        try {
+            const result = await ctx.tools.run(vulture, ['.', '--min-confidence', VULTURE_MIN_CONFIDENCE], { cwd: copy.dir });
+            const failure = failureReason(vulture, result, [0, 3]);
+            if (failure)
+                return unavailable(failure);
+            hits = [];
+            for (const line of result.stdout.split('\n')) {
+                const match = VULTURE_LINE.exec(line.trim());
+                if (!match)
+                    continue;
+                hits.push({
+                    file: path.posix.normalize((match[1] ?? '').split(path.sep).join('/')).replace(/^\.\//, ''),
+                    line: Number(match[2]),
+                    name: match[4] ?? '',
+                });
+            }
+        }
+        finally {
+            await copy.cleanup();
+        }
+        const hitsByFile = new Map();
+        for (const hit of hits)
+            hitsByFile.set(hit.file, [...(hitsByFile.get(hit.file) ?? []), hit]);
+        for (const mod of unitLogic) {
+            tally.denominator += mod.info.symbols.length;
+            if (unusedModules.has(mod.file.path)) {
+                tally.numerator += mod.info.symbols.length;
+                continue;
+            }
+            const counted = new Set();
+            const allNames = new Set(distributed ? (mod.info.allNames ?? []) : []);
+            for (const hit of hitsByFile.get(mod.file.path) ?? []) {
+                const symbol = matchSymbol(mod.info.symbols, hit.name, hit.line);
+                if (!symbol || symbol.decorated || allNames.has(symbol.name))
+                    continue;
+                if (symbol.kind === 'method' && isOverride(infos, mod.file.path, symbol.qualname))
+                    continue;
+                if ([...mod.names].some((name) => scripts.objects.has(`${name}:${symbol.qualname}`)))
+                    continue;
+                counted.add(symbol);
+            }
+            tally.numerator += counted.size;
+        }
+    }
+    return null;
+}
+export const p44 = {
+    id: '4.4',
+    layer: 'static',
+    async measure(ctx) {
+        const tallies = emptyTallies([...logicFiles(ctx.scope, 'typescript_javascript'), ...logicFiles(ctx.scope, 'python')]);
+        const warnings = [];
+        const failed = new Set();
+        const ts = await measureTypeScript(ctx, tallies, warnings, failed);
+        if (ts)
+            return ts;
+        const py = await measurePython(ctx, tallies, warnings);
+        if (py)
+            return py;
+        const units = tallyUnits(tallies).map((unit) => (failed.has(`${unit.package}\0${unit.group}`) ? { ...unit, raw: { kind: 'failed' } } : unit));
+        return { status: 'measured', units, warnings };
+    },
+};

package/dist/measure/p5-1.js

@@ -0,0 +1,117 @@
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import semver from 'semver';
+import { packageOf } from '../scope/packages.js';
+import { failureReason, unavailable } from '../tools/outcome.js';
+import { joinRel } from './deps/files.js';
+import { kindGroup } from './deps/lockfiles.js';
+import { parseOsvReport, severityPoints } from './deps/osv.js';
+import { unitDeps } from './deps/resolved.js';
+import { scopeUnits } from './deps/units.js';
+const OK_CODES = [0, 1, 128];
+/** One osv-scanner run on one lockfile. Flags are written from the osv-scanner v2 documentation. */
+async function scanLockfile(ctx, ref) {
+    const tool = await ctx.tools.resolve('osv-scanner');
+    if (!tool)
+        return unavailable(ctx.tools.notFoundReason('osv-scanner'));
+    const major = semver.coerce(tool.version)?.major;
+    if (major === undefined || major < 2)
+        return unavailable(`osv-scanner 2.x required, found ${tool.version}`);
+    const abs = path.join(ctx.repoPath, ref.path);
+    const lockArg = ref.kind === 'requirements' && path.posix.basename(ref.path) !== 'requirements.txt' ? `requirements.txt:${abs}` : abs;
+    const outDir = await mkdtemp(path.join(tmpdir(), 'health-osv-'));
+    try {
+        const report = path.join(outDir, 'osv.json');
+        const result = await ctx.tools.run(tool, ['scan', '-L', lockArg, '--format', 'json', '--output-file', report, '--all-packages'], { cwd: path.join(ctx.repoPath, ref.dir) });
+        const failure = failureReason(tool, result, OK_CODES);
+        if (failure)
+            return unavailable(failure);
+        let text;
+        try {
+            text = await readFile(report, 'utf8');
+        }
+        catch {
+            if (result.exitCode === 128)
+                return { ref, packages: [] };
+            return unavailable('osv-scanner wrote no report');
+        }
+        const packages = parseOsvReport(text);
+        if (!packages)
+            return unavailable('osv-scanner report has an unexpected shape');
+        return { ref, packages };
+    }
+    finally {
+        await rm(outDir, { recursive: true, force: true });
+    }
+}
+function isScanned(value) {
+    return 'ref' in value;
+}
+export const p51 = {
+    id: '5.1',
+    layer: 'static',
+    async measure(ctx) {
+        const warnings = [];
+        const lockfiles = new Map();
+        for (const unit of scopeUnits(ctx)) {
+            const deps = await unitDeps(ctx, unit.package, unit.group);
+            if (deps.lockfiles.length === 0) {
+                warnings.push(`5.1: ${unit.package} has no lockfile, its dependencies were not scanned`);
+                continue;
+            }
+            for (const { ref } of deps.lockfiles)
+                lockfiles.set(ref.path, ref);
+        }
+        const weights = new Map(scopeUnits(ctx).map((u) => [`${u.package}\0${u.group}`, u.weight]));
+        const perUnit = new Map();
+        const devAdvisories = [];
+        const productionAdvisories = [];
+        let productionPoints = 0;
+        let devPoints = 0;
+        const resolvedPackages = [];
+        for (const ref of [...lockfiles.values()].sort((a, b) => a.path.localeCompare(b.path))) {
+            const scanned = await scanLockfile(ctx, ref);
+            if (!isScanned(scanned))
+                return scanned;
+            const group = kindGroup(ref.kind);
+            const owner = packageOf(joinRel(ref.dir, 'x'), ctx.scope.packages);
+            const key = `${owner}\0${group}`;
+            const unit = perUnit.get(key) ?? { package: owner, group, points: 0 };
+            const production = scanned.packages.filter((p) => !p.dev);
+            const prod = severityPoints(production, ctx.asOf);
+            unit.points += prod.points;
+            productionPoints += prod.points;
+            for (const a of prod.advisories) {
+                productionAdvisories.push({ package: owner, name: a.name, version: a.version, id: a.id, severity: a.severity });
+            }
+            perUnit.set(key, unit);
+            const dev = severityPoints(scanned.packages.filter((p) => p.dev), ctx.asOf);
+            devPoints += dev.points;
+            for (const a of dev.advisories) {
+                devAdvisories.push({ package: owner, name: a.name, version: a.version, id: a.id, severity: a.severity });
+            }
+            for (const p of scanned.packages) {
+                resolvedPackages.push({ package: owner, group, ecosystem: p.ecosystem, name: p.name, version: p.version, dev: p.dev });
+            }
+        }
+        const units = [...perUnit.values()]
+            .sort((a, b) => a.package.localeCompare(b.package) || a.group.localeCompare(b.group))
+            .map((u) => ({
+            package: u.package,
+            group: u.group,
+            weight: weights.get(`${u.package}\0${u.group}`) ?? 0,
+            raw: { kind: 'number', value: u.points },
+        }));
+        return {
+            status: 'measured',
+            units,
+            warnings,
+            reportOnly: {
+                productionDependencyVulnerabilities: { points: productionPoints, advisories: productionAdvisories },
+                devDependencyVulnerabilities: { points: devPoints, advisories: devAdvisories },
+                resolvedPackages,
+            },
+        };
+    },
+};

package/dist/measure/p5-2.js

@@ -0,0 +1,80 @@
+import { normalizeName } from '../util/pep440.js';
+import { unavailable } from '../tools/outcome.js';
+import { resolveDirect, unitDeps } from './deps/resolved.js';
+import { CONCURRENCY, fetchRegistry, majorsBehind, RegistryError } from './deps/registry.js';
+import { scopeUnits } from './deps/units.js';
+async function inBatches(items, size, work) {
+    let next = 0;
+    const workers = Array.from({ length: Math.min(size, items.length) }, async () => {
+        while (next < items.length) {
+            const item = items[next];
+            next += 1;
+            if (item !== undefined)
+                await work(item);
+        }
+    });
+    await Promise.all(workers);
+}
+export const p52 = {
+    id: '5.2',
+    layer: 'static',
+    async measure(ctx) {
+        const warnings = [];
+        const checked = [];
+        for (const unit of scopeUnits(ctx)) {
+            const deps = await unitDeps(ctx, unit.package, unit.group);
+            if (deps.lockfiles.length === 0) {
+                warnings.push(`5.2: ${unit.package} has no lockfile, dependencies not checked`);
+                continue;
+            }
+            const seen = new Set();
+            for (const dep of resolveDirect(deps)) {
+                if (!dep.registry || dep.version === undefined)
+                    continue;
+                const key = unit.group === 'python' ? normalizeName(dep.name) : dep.name;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                checked.push({ package: unit.package, group: unit.group, name: dep.name, version: dep.version, dev: dep.dev });
+            }
+        }
+        const wanted = new Map();
+        for (const dep of checked)
+            wanted.set(`${dep.group}:${dep.group === 'python' ? normalizeName(dep.name) : dep.name}`, { group: dep.group, name: dep.name });
+        const registryData = new Map();
+        try {
+            await inBatches([...wanted], CONCURRENCY, async ([key, { group, name }]) => {
+                registryData.set(key, await fetchRegistry(ctx, group, name));
+            });
+        }
+        catch (err) {
+            if (err instanceof RegistryError)
+                return unavailable(err.message);
+            throw err;
+        }
+        for (const [key, data] of [...registryData].sort(([a], [b]) => a.localeCompare(b))) {
+            if (data === null)
+                warnings.push(`5.2: ${key.slice(key.indexOf(':') + 1)} not found on the registry`);
+        }
+        const units = scopeUnits(ctx).map((unit) => {
+            const own = checked.filter((d) => d.package === unit.package && d.group === unit.group);
+            const { numerator, denominator } = majorsBehind(own, registryData, ctx.asOf);
+            return {
+                package: unit.package,
+                group: unit.group,
+                weight: unit.weight,
+                raw: { kind: 'ratio', numerator, denominator, scale: 100 },
+            };
+        });
+        return {
+            status: 'measured',
+            units,
+            warnings,
+            reportOnly: {
+                directDependencies: checked
+                    .filter((d) => registryData.get(`${d.group}:${d.group === 'python' ? normalizeName(d.name) : d.name}`) !== null)
+                    .map((d) => ({ package: d.package, group: d.group, name: d.name, version: d.version, dev: d.dev })),
+            },
+        };
+    },
+};

package/dist/measure/p5-3.js

@@ -0,0 +1,21 @@
+import { unitDeps, lockLevel } from './deps/resolved.js';
+import { scopeUnits } from './deps/units.js';
+export const p53 = {
+    id: '5.3',
+    layer: 'static',
+    async measure(ctx) {
+        const units = [];
+        const warnings = [];
+        for (const unit of scopeUnits(ctx)) {
+            const deps = await unitDeps(ctx, unit.package, unit.group);
+            warnings.push(...(deps.manifest?.warnings ?? []), ...deps.warnings);
+            units.push({
+                package: unit.package,
+                group: unit.group,
+                weight: unit.weight,
+                raw: { kind: 'level', level: lockLevel(deps) },
+            });
+        }
+        return { status: 'measured', units, warnings: [...new Set(warnings)] };
+    },
+};