vibecodedshit 0.0.0-stage → 0.3.0

package/dist/tools/image.js

@@ -0,0 +1,180 @@
+import { spawn as nodeSpawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { existsSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { hostUser } from '../exec/docker.js';
+import { catalog } from './catalog.js';
+import { DEFAULT_TIMEOUT_MS } from './kit.js';
+function imageEntry(name) {
+    const entry = catalog[name];
+    const base = entry.kind === 'npm'
+        ? { bin: entry.pkg, versionArgs: ['--version'], versionPattern: /(\d+\.\d+\.\d+\S*)/ }
+        : { bin: entry.bin, versionArgs: entry.versionArgs, versionPattern: entry.versionPattern };
+    return {
+        ...base,
+        // osv-scanner looks advisories up on osv.dev; every other tool runs with the network off.
+        network: name === 'osv-scanner',
+        // import-linter's uv tool environment, which also holds grimp for python/graph_helper.py.
+        ...(name === 'import-linter' ? { interpreter: '/opt/uv-tools/import-linter/bin/python' } : {}),
+    };
+}
+function inside(child, parent) {
+    return child === parent || child.startsWith(parent.endsWith(path.sep) ? parent : `${parent}${path.sep}`);
+}
+/**
+ * Host directories a tool run needs, each mounted at the same path in the container so every absolute path in the
+ * argv, the reports and the working directory means the same thing on both sides. Candidates are the working
+ * directory and every absolute argument (also the part after `kind:` in `requirements.txt:/abs/path`): an existing
+ * directory is mounted itself, an existing file or a file still to be written through its directory. Nested
+ * directories collapse into the outermost one. Directories inside the scanned repository are read-only.
+ */
+export function mountsFor(args, cwd, repoPath) {
+    const candidates = [cwd];
+    for (const arg of args) {
+        if (path.isAbsolute(arg))
+            candidates.push(arg);
+        const colon = arg.indexOf(':');
+        if (colon > 0 && path.isAbsolute(arg.slice(colon + 1)))
+            candidates.push(arg.slice(colon + 1));
+    }
+    const dirs = new Set();
+    for (const candidate of candidates) {
+        const abs = path.resolve(candidate);
+        if (existsSync(abs))
+            dirs.add(statSync(abs).isDirectory() ? abs : path.dirname(abs));
+        else if (existsSync(path.dirname(abs)))
+            dirs.add(path.dirname(abs));
+    }
+    const sorted = [...dirs].sort((a, b) => a.length - b.length || a.localeCompare(b));
+    const kept = [];
+    for (const dir of sorted)
+        if (!kept.some((k) => inside(dir, k)))
+            kept.push(dir);
+    const repo = path.resolve(repoPath);
+    return kept.map((dir) => ({ dir, readOnly: inside(dir, repo) }));
+}
+/** git inside the image runs as the host uid on files it may not own; gitleaks reads history through it. */
+const GIT_SAFE_ENV = { GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: 'safe.directory', GIT_CONFIG_VALUE_0: '*' };
+/**
+ * The full-run tool kit: every static tool runs in the pinned image (`runner.image`), one `docker run` per call, as
+ * the host user with `HOME=/tmp`, bounded like an execution step, network off except for osv-scanner. Versions are
+ * the ones the image reports, so a run records what actually measured. The host needs Docker, nothing else.
+ */
+export function createImageToolKit(deps) {
+    const spawn = deps.spawn ?? nodeSpawn;
+    const user = deps.user === undefined ? hostUser() : deps.user;
+    const { runner } = deps;
+    const versions = new Map();
+    const memos = new Map();
+    const resolved = new Map();
+    function docker(argv, name, timeoutMs) {
+        return new Promise((resolve) => {
+            const child = spawn('docker', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+            let stdout = '';
+            let stderr = '';
+            let timedOut = false;
+            let settled = false;
+            const finish = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve(result);
+            };
+            const timer = setTimeout(() => {
+                timedOut = true;
+                spawn('docker', ['kill', name], { stdio: 'ignore' }).on('error', () => undefined);
+            }, timeoutMs);
+            child.stdout?.on('data', (chunk) => {
+                stdout += chunk.toString('utf8');
+            });
+            child.stderr?.on('data', (chunk) => {
+                stderr += chunk.toString('utf8');
+            });
+            child.on('error', (err) => finish({ exitCode: null, stdout, stderr, timedOut, spawnError: `docker could not start: ${err.message}` }));
+            child.on('close', (code) => {
+                // 125: docker itself failed; 126 and 127: the command is not runnable or not in the image.
+                if (!timedOut && code !== null && [125, 126, 127].includes(code)) {
+                    const detail = stderr.trim().split('\n').slice(-2).join(' | ');
+                    finish({ exitCode: code, stdout, stderr, timedOut, spawnError: `could not run in the image ${runner.image} (exit ${code})${detail ? `: ${detail}` : ''}` });
+                }
+                else
+                    finish({ exitCode: code, stdout, stderr, timedOut });
+            });
+        });
+    }
+    /** `docker run` options up to the image. Without `cwd` nothing is mounted. */
+    function containerArgs(name, network, cwd, mountArgs, env) {
+        const mounts = cwd === null ? [] : mountsFor(mountArgs, cwd, deps.repoPath);
+        return [
+            'run',
+            '--rm',
+            '--pull',
+            'never',
+            '--name',
+            name,
+            '--cpus',
+            String(runner.cpus),
+            '--memory',
+            `${runner.memory_gb}g`,
+            ...(user ? ['--user', `${user.uid}:${user.gid}`] : []),
+            '-e',
+            'HOME=/tmp',
+            ...(network ? [] : ['--network', 'none']),
+            ...Object.entries({ ...GIT_SAFE_ENV, ...env }).flatMap(([key, value]) => ['-e', `${key}=${value}`]),
+            ...mounts.flatMap((m) => ['-v', `${m.dir}:${m.dir}${m.readOnly ? ':ro' : ''}`]),
+            ...(cwd === null ? [] : ['-w', path.resolve(cwd)]),
+            runner.image,
+        ];
+    }
+    const containerName = (tool) => `health-${randomBytes(4).toString('hex')}-${tool}`;
+    async function resolveInImage(name) {
+        const entry = imageEntry(name);
+        const container = containerName(name);
+        const result = await docker([...containerArgs(container, false, null, [], {}), entry.bin, ...entry.versionArgs], container, 60_000);
+        if (result.spawnError !== undefined || result.exitCode !== 0)
+            return undefined;
+        const match = entry.versionPattern.exec(`${result.stdout}\n${result.stderr}`);
+        if (!match?.[1])
+            return undefined;
+        return { name, command: entry.bin, prefixArgs: [], version: match[1], ...(entry.interpreter ? { interpreter: entry.interpreter } : {}) };
+    }
+    const kit = {
+        resolve(name) {
+            let found = resolved.get(name);
+            if (!found) {
+                found = resolveInImage(name).then((tool) => {
+                    if (tool)
+                        versions.set(name, tool.version);
+                    return tool;
+                });
+                resolved.set(name, found);
+            }
+            return found;
+        },
+        run(tool, args, opts) {
+            const container = containerName(tool.name);
+            const argv = [...tool.prefixArgs, ...args];
+            return docker([...containerArgs(container, imageEntry(tool.name).network, opts.cwd, argv, opts.env ?? {}), tool.command, ...argv], container, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+        },
+        fetch: deps.fetch ?? globalThis.fetch,
+        recordVersion(name, version) {
+            versions.set(name, version);
+        },
+        versions() {
+            return Object.fromEntries([...versions].sort(([a], [b]) => a.localeCompare(b)));
+        },
+        memo(key, make) {
+            const cached = memos.get(key);
+            if (cached)
+                return cached;
+            const made = make();
+            memos.set(key, made);
+            return made;
+        },
+        notFoundReason(name) {
+            return `${name} is not in the image ${runner.image}, rebuild it: npm run image:build`;
+        },
+    };
+    return kit;
+}

package/dist/tools/kit.js

@@ -0,0 +1,71 @@
+import { spawn as nodeSpawn } from 'node:child_process';
+import { catalog } from './catalog.js';
+import { resolveTool } from './resolve.js';
+/** Same as the typecheck and lint timeouts in methodology.yaml. */
+export const DEFAULT_TIMEOUT_MS = 600_000;
+export function createToolKit(deps = {}) {
+    const spawn = deps.spawn ?? nodeSpawn;
+    const env = deps.env ?? process.env;
+    const versions = new Map();
+    const memos = new Map();
+    function run(tool, args, opts) {
+        return new Promise((resolve) => {
+            const child = spawn(tool.command, [...tool.prefixArgs, ...args], {
+                cwd: opts.cwd,
+                env: { ...env, ...opts.env },
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            let stdout = '';
+            let stderr = '';
+            let timedOut = false;
+            let settled = false;
+            const finish = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve(result);
+            };
+            const timer = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGKILL');
+            }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+            child.stdout?.on('data', (chunk) => {
+                stdout += chunk.toString('utf8');
+            });
+            child.stderr?.on('data', (chunk) => {
+                stderr += chunk.toString('utf8');
+            });
+            child.on('error', (err) => finish({ exitCode: null, stdout, stderr, timedOut, spawnError: err.message }));
+            child.on('close', (code) => finish({ exitCode: code, stdout, stderr, timedOut }));
+        });
+    }
+    const kit = {
+        async resolve(name) {
+            const found = await resolveTool(name, { spawn, env });
+            if (found)
+                versions.set(name, found.version);
+            return found;
+        },
+        run,
+        fetch: deps.fetch ?? globalThis.fetch,
+        recordVersion(name, version) {
+            versions.set(name, version);
+        },
+        versions() {
+            return Object.fromEntries([...versions].sort(([a], [b]) => a.localeCompare(b)));
+        },
+        memo(key, make) {
+            const cached = memos.get(key);
+            if (cached)
+                return cached;
+            const made = make();
+            memos.set(key, made);
+            return made;
+        },
+        notFoundReason(name) {
+            return `${name} not found, install: ${catalog[name].install}`;
+        },
+    };
+    return kit;
+}

package/dist/tools/knip.js

@@ -0,0 +1,169 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { isUnder } from '../exec/plan.js';
+import { failedRootOf } from '../exec/roots.js';
+import { failureReason, unavailable } from './outcome.js';
+/** Whether the package at `pkg` lies under a knip root where knip failed. */
+export function knipFailed(knip, pkg) {
+    return knip.failedRoots.some((root) => isUnder(pkg, root));
+}
+function entries(value) {
+    return Array.isArray(value) ? value : [];
+}
+function names(value) {
+    return entries(value)
+        .map((e) => e.name)
+        .filter((n) => typeof n === 'string');
+}
+/**
+ * Knip's JSON report. A config knip loads can print to stdout first (dotenv 17 prints an
+ * "injected env" banner), so when stdout is not JSON as a whole, the report is read from the last
+ * line that starts with `{` to the end.
+ */
+function parseKnipReport(stdout) {
+    try {
+        return JSON.parse(stdout);
+    }
+    catch (err) {
+        const lines = stdout.split('\n');
+        const start = lines.findLastIndex((line) => line.startsWith('{'));
+        if (start <= 0)
+            throw err;
+        return JSON.parse(lines.slice(start).join('\n'));
+    }
+}
+/** Knip roots: the repository root when it has a tracked package.json, else each shallowest directory holding one. */
+export function knipRoots(repoPath) {
+    const result = spawnSync('git', ['-C', repoPath, 'ls-files', '-z', '--', 'package.json', '**/package.json'], {
+        encoding: 'utf8',
+        maxBuffer: 256 * 1024 * 1024,
+    });
+    if (result.error || result.status !== 0)
+        return [];
+    const dirs = result.stdout
+        .split('\0')
+        .filter((p) => p !== '')
+        .map((p) => path.posix.dirname(p));
+    if (dirs.includes('.'))
+        return ['.'];
+    const sorted = [...new Set(dirs)].sort((a, b) => a.split('/').length - b.split('/').length || a.localeCompare(b));
+    const roots = [];
+    for (const dir of sorted) {
+        if (!roots.some((root) => dir === root || dir.startsWith(`${root}/`)))
+            roots.push(dir);
+    }
+    return roots;
+}
+/** Adds one knip root's report to `outcome`. Returns why the report cannot be used, or null. */
+function addReport(outcome, root, stdout) {
+    let issues;
+    try {
+        const parsed = parseKnipReport(stdout);
+        if (!Array.isArray(parsed.issues))
+            throw new Error('no issues array');
+        issues = parsed.issues;
+    }
+    catch {
+        return 'knip printed no parseable JSON report';
+    }
+    for (const issue of issues) {
+        if (typeof issue.file !== 'string')
+            return 'knip report has an unexpected shape';
+        const rel = path.posix.normalize(path.posix.join(root === '.' ? '' : root, issue.file.split(path.sep).join('/')));
+        const entry = outcome.files.get(rel) ?? {
+            exports: 0,
+            unusedFile: false,
+            dependencies: [],
+            devDependencies: [],
+            unlisted: [],
+        };
+        entry.exports += entries(issue.exports).length + entries(issue.types).length;
+        entry.unusedFile = entry.unusedFile || entries(issue.files).length > 0;
+        entry.dependencies.push(...names(issue.dependencies));
+        entry.devDependencies.push(...names(issue.devDependencies));
+        entry.unlisted.push(...names(issue.unlisted));
+        outcome.files.set(rel, entry);
+    }
+    return null;
+}
+/** Knip's exit codes for a finished run: 0 no issues, 1 issues found. */
+const KNIP_OK = [0, 1];
+/** Adds the knip steps of a full run, which ran in the image on the installed work copy, to `outcome`. Returns why one cannot be used, or null. */
+function fromExecution(exec, outcome) {
+    for (const result of exec.knip) {
+        if (result.outcome.status === 'timeout')
+            return unavailable(`knip timed out in ${result.dir}`);
+        const code = result.outcome.exitCode;
+        if (code === null || !KNIP_OK.includes(code))
+            return unavailable(`knip exited with ${String(code)} in ${result.dir}`);
+        if (result.report === null)
+            return unavailable(`knip wrote no report in ${result.dir}`);
+        const failure = addReport(outcome, result.dir, result.report);
+        if (failure)
+            return unavailable(`${failure} in ${result.dir}`);
+    }
+    return null;
+}
+/**
+ * One knip run per scan, shared by 4.4 and 5.5. The repository's own knip config is not used
+ * (an empty --config), framework plugins stay enabled. A full run reads the knip steps the execution layer ran
+ * in the image, on the installed work copy, for every knip root whose install worked, so plugins can
+ * load configs such as vitest.config.ts and native dependencies match the platform they were
+ * installed for. A knip root whose install failed is still tried through the tool kit, in the image on the
+ * execution work copy: a report is used with a warning that unused dependencies may be overcounted, and a
+ * crash, timeout or unusable report marks the root failed (`failedRoots`). A knip step failing in a root whose
+ * install worked, or knip not starting at all, is not_measured. A preview runs knip through the tool kit on
+ * the host, in the repository.
+ */
+export function runKnip(ctx) {
+    return ctx.tools.memo('knip', async () => {
+        const exec = ctx.mode === 'full' ? ctx.exec : undefined;
+        const outcome = { files: new Map(), warnings: [], failedRoots: [] };
+        const roots = knipRoots(ctx.repoPath);
+        let viaTools = roots;
+        if (exec) {
+            const stopped = fromExecution(exec, outcome);
+            if (stopped)
+                return stopped;
+            viaTools = roots.filter((root) => failedRootOf(exec, root, 'typescript_javascript') !== undefined);
+            if (viaTools.length === 0)
+                return outcome;
+        }
+        const tool = await ctx.tools.resolve('knip');
+        if (!tool)
+            return unavailable(ctx.tools.notFoundReason('knip'));
+        // A full run's tools run in the image, so they read the execution work copy, whose dependencies (if any) were
+        // installed there; the repository's own node_modules belong to the host platform.
+        const base = exec ? exec.workDir : ctx.repoPath;
+        const configDir = await mkdtemp(path.join(tmpdir(), 'health-knip-'));
+        try {
+            const configFile = path.join(configDir, 'knip.json');
+            await writeFile(configFile, '{}');
+            for (const root of viaTools) {
+                const result = await ctx.tools.run(tool, ['--reporter', 'json', '--no-progress', '--no-config-hints', '--config', configFile], { cwd: path.join(base, root), env: { DOTENV_CONFIG_QUIET: 'true' } });
+                const failure = failureReason(tool, result, KNIP_OK) ?? addReport(outcome, root, result.stdout);
+                const installRoot = exec ? failedRootOf(exec, root, 'typescript_javascript') : undefined;
+                if (failure === null) {
+                    if (installRoot) {
+                        outcome.warnings.push(`knip ran without installed dependencies because the dependency install failed in ${installRoot.dir}; unused dependencies may be overcounted`);
+                    }
+                }
+                else if (installRoot && result.spawnError === undefined) {
+                    outcome.failedRoots.push(root);
+                }
+                else {
+                    return unavailable(failure);
+                }
+            }
+        }
+        finally {
+            await rm(configDir, { recursive: true, force: true });
+        }
+        return outcome;
+    });
+}
+export function isOutcome(value) {
+    return 'files' in value && value.files instanceof Map;
+}

package/dist/tools/outcome.js

@@ -0,0 +1,21 @@
+/**
+ * A tool that is missing, crashed, exited unexpectedly, printed output we cannot parse or
+ * hit a network failure: the parameter is not_measured with the reason, in both modes, and the
+ * rest of the run still scores. A full run with any not_measured parameter is not comparable
+ * (`scan.ts`). Never a score of 0.
+ */
+export function unavailable(reason) {
+    return { status: 'not_measured', reason };
+}
+/** Why a finished run counts as a failure, or null when its exit code is one of `okCodes`. */
+export function failureReason(tool, result, okCodes) {
+    if (result.spawnError !== undefined)
+        return `${tool.name} could not start: ${result.spawnError}`;
+    if (result.timedOut)
+        return `${tool.name} timed out`;
+    if (result.exitCode === null || !okCodes.includes(result.exitCode)) {
+        const detail = result.stderr.trim().split('\n').slice(-3).join(' | ');
+        return `${tool.name} exited with ${String(result.exitCode)}${detail ? `: ${detail}` : ''}`;
+    }
+    return null;
+}

package/dist/tools/resolve.js

@@ -0,0 +1,66 @@
+import { spawnSync } from 'node:child_process';
+import { accessSync, constants, existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { catalog } from './catalog.js';
+/** Nearest `node_modules/<pkg>/package.json` above this file. */
+function findPackageJson(pkg) {
+    let dir = path.dirname(fileURLToPath(import.meta.url));
+    for (;;) {
+        const candidate = path.join(dir, 'node_modules', pkg, 'package.json');
+        if (existsSync(candidate))
+            return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+function resolveNpm(name, pkg) {
+    const pkgJsonPath = findPackageJson(pkg);
+    if (!pkgJsonPath)
+        return undefined;
+    const json = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
+    const rel = typeof json.bin === 'string' ? json.bin : json.bin?.[pkg] ?? Object.values(json.bin ?? {})[0];
+    if (!rel)
+        return undefined;
+    return {
+        name,
+        command: process.execPath,
+        prefixArgs: [path.join(path.dirname(pkgJsonPath), rel)],
+        version: json.version,
+    };
+}
+function findOnPath(bin, env) {
+    const extensions = process.platform === 'win32' ? (env.PATHEXT ?? '.EXE;.CMD').split(';') : [''];
+    for (const dir of (env.PATH ?? '').split(path.delimiter)) {
+        if (dir === '')
+            continue;
+        for (const ext of extensions) {
+            const candidate = path.join(dir, bin + ext);
+            try {
+                accessSync(candidate, constants.X_OK);
+                return candidate;
+            }
+            catch {
+                // not here
+            }
+        }
+    }
+    return undefined;
+}
+export async function resolveTool(name, deps) {
+    const entry = catalog[name];
+    if (entry.kind === 'npm')
+        return resolveNpm(name, entry.pkg);
+    const exe = findOnPath(entry.bin, deps.env);
+    if (!exe)
+        return undefined;
+    const result = spawnSync(exe, entry.versionArgs, { encoding: 'utf8', env: deps.env });
+    if (result.error || result.status !== 0)
+        return undefined;
+    const match = entry.versionPattern.exec(`${result.stdout}\n${result.stderr}`);
+    if (!match?.[1])
+        return undefined;
+    return { name, command: exe, prefixArgs: [], version: match[1] };
+}

package/dist/tools/workcopy.js

@@ -0,0 +1,27 @@
+import { existsSync } from 'node:fs';
+import { copyFile, mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+/**
+ * Copy these working-tree files (same relative paths) into a new temp directory.
+ * Tools that read their own config run there, so no repository config can change a score.
+ * A path missing from the working tree (tracked but deleted, or a broken symlink) is skipped.
+ */
+export async function createWorkCopy(repoPath, relPaths) {
+    const dir = await mkdtemp(path.join(tmpdir(), 'health-work-'));
+    try {
+        for (const rel of relPaths) {
+            const src = path.join(repoPath, rel);
+            if (!existsSync(src))
+                continue;
+            const dest = path.join(dir, rel);
+            await mkdir(path.dirname(dest), { recursive: true });
+            await copyFile(src, dest);
+        }
+    }
+    catch (err) {
+        await rm(dir, { recursive: true, force: true });
+        throw err;
+    }
+    return { dir, cleanup: () => rm(dir, { recursive: true, force: true }) };
+}

package/dist/util/ini.js

@@ -0,0 +1,37 @@
+/**
+ * Minimal INI reader for mypy's `mypy.ini`, `.mypy.ini` and `setup.cfg`: sections, `key = value`
+ * and `key: value`, `;` and `#` comment lines, indented continuation lines, no interpolation.
+ * Keys before any section go to the section "".
+ */
+export function parseIni(text) {
+    const sections = {};
+    let current = '';
+    let lastKey;
+    for (const rawLine of text.split(/\r\n|\r|\n/)) {
+        if (rawLine.trim() === '') {
+            lastKey = undefined;
+            continue;
+        }
+        if (/^\s*[;#]/.test(rawLine))
+            continue;
+        if (/^\s/.test(rawLine) && lastKey !== undefined) {
+            const section = (sections[current] ??= {});
+            section[lastKey] = `${section[lastKey] ?? ''}\n${rawLine.trim()}`;
+            continue;
+        }
+        const header = /^\s*\[([^\]]*)\]/.exec(rawLine);
+        if (header) {
+            current = (header[1] ?? '').trim();
+            sections[current] ??= {};
+            lastKey = undefined;
+            continue;
+        }
+        const pair = /^\s*([^=:]+?)\s*[=:]\s*(.*?)\s*$/.exec(rawLine);
+        if (pair?.[1] !== undefined) {
+            const section = (sections[current] ??= {});
+            lastKey = pair[1];
+            section[lastKey] = pair[2] ?? '';
+        }
+    }
+    return sections;
+}