devmap 0.2.5__tar.gz → 0.3.2__tar.gz

{devmap-0.2.5 → devmap-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devmap
-Version: 0.2.5
+Version: 0.3.2
 Summary: Map your machine's dev environment and surface issues (PATH conflicts, ghost binaries, multi-version collisions). fastfetch-for-dev-tools. This PyPI package ships the real devmap CLI (a bundled JavaScript app launched via Node.js or Bun), so `pip install devmap && devmap` works standalone.
 Author: devmap contributors
 License: MIT

{devmap-0.2.5 → devmap-0.3.2}/devmap/_devmap.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 // @bun
 
-// devmap/src/version.ts
-var VERSION = "0.2.5";
+// src/version.ts
+var VERSION = "0.3.2";
 
-// devmap/src/install.ts
+// src/install.ts
 function isIsolated(i) {
   return !i.onPath && !i.env;
 }
@@ -21,7 +21,7 @@ function locationTag(i) {
   return i.env ? `env: ${i.env}` : "off-path";
 }
 
-// devmap/src/detector/registry.ts
+// src/detector/registry.ts
 var registry = [];
 function register(d) {
   registry.push(d);
@@ -48,7 +48,7 @@ async function runDetectors(ctx, progress) {
   return { byName, allChecks };
 }
 
-// devmap/src/check/model.ts
+// src/check/model.ts
 function makeCheck(id, kind, severity, label, detail, path = [], fix) {
   const c = { ID: id, Kind: kind, Severity: severity, Label: label, Detail: detail, Path: path };
   if (fix)
@@ -56,7 +56,7 @@ function makeCheck(id, kind, severity, label, detail, path = [], fix) {
   return c;
 }
 
-// devmap/src/platform/exec.ts
+// src/platform/exec.ts
 import { spawnSync, spawn } from "node:child_process";
 import { readdirSync, statSync, lstatSync, existsSync } from "node:fs";
 import { join, basename } from "node:path";
@@ -239,8 +239,8 @@ function whichInDirs(name, dirs) {
   }
   return out;
 }
-var SEMVER_RE = /(?<![\d.])\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.]+)?(?![\d.])/;
-var LOOSE_VERSION_RE = /(?<![\d.])\d+\.\d+(?![\d.])/;
+var SEMVER_RE = /(?<![\d.])(\d+\.\d+\.\d+)(?:[-.+][0-9A-Za-z._-]+)*(?![\d.])/;
+var LOOSE_VERSION_RE = /(?<![\d.])(\d+\.\d+)(?:[-.+][0-9A-Za-z._-]+)*(?![\d.])/;
 function extractVersion(out, binPath) {
   const lines = out.split(/\r?\n/).map((l) => l.trim()).filter((l) => l && !l.startsWith("["));
   if (binPath) {
@@ -319,7 +319,7 @@ function scanBrokenSymlinks(dirs) {
   return ghosts;
 }
 
-// devmap/src/platform/shells.ts
+// src/platform/shells.ts
 function shellName(s) {
   return { current: "current", powershell: "PowerShell", gitbash: "Git Bash", wsl: "WSL" }[s];
 }
@@ -349,7 +349,7 @@ function shellPathDirs(shell) {
   return pathDirs();
 }
 
-// devmap/src/detector/conflicts.ts
+// src/detector/conflicts.ts
 function computeConflicts(groups, shells, disabled) {
   const checks = [];
   const multiVersionTools = [];
@@ -440,7 +440,220 @@ function isCheckDisabled(id, disabled) {
   return isDisabled(id, disabled);
 }
 
-// devmap/src/output/json.ts
+// src/security/runtimeAdvisories.ts
+var RUNTIME_ADVISORIES = {
+  node: {
+    eolByVersion: {
+      "16": "2023-09-11",
+      "18": "2025-04-30",
+      "20": "2026-04-30",
+      "22": "2027-04-30",
+      "24": "2028-04-30",
+      "26": "2029-04-30"
+    }
+  },
+  python: {
+    eolByVersion: {
+      "3.7": "2023-06-27",
+      "3.8": "2024-10-07",
+      "3.9": "2025-10-31",
+      "3.10": "2026-10-31",
+      "3.11": "2027-10-31",
+      "3.12": "2028-10-31",
+      "3.13": "2029-10-31"
+    }
+  },
+  go: {
+    eolByVersion: {
+      "1.20": "2024-02-06",
+      "1.21": "2024-08-13",
+      "1.22": "2025-02-11",
+      "1.23": "2025-08-12",
+      "1.24": "2026-02-11"
+    }
+  }
+};
+
+// src/security/scan.ts
+function eolKeys(version) {
+  const parts = version.split(".");
+  const maj = parts[0];
+  const min = parts[1] ?? "0";
+  return [maj, `${maj}.${min}`];
+}
+function computeSecurity(byName) {
+  const checks = [];
+  const runtimes = byName.runtimes || [];
+  const now = Date.now();
+  for (const g of runtimes) {
+    const adv = RUNTIME_ADVISORIES[g.id];
+    if (!adv)
+      continue;
+    for (const inst of g.installs) {
+      const v = inst.version;
+      if (!v)
+        continue;
+      for (const key of eolKeys(v)) {
+        const eol = adv.eolByVersion[key];
+        if (eol) {
+          const eolT = Date.parse(eol + "T00:00:00Z");
+          if (!isNaN(eolT) && eolT < now) {
+            checks.push(makeCheck(`security.eol.${g.id}`, "stale", "warn", `${g.id} ${v} is end-of-life (since ${eol})`, `${g.id} ${v} reached end-of-life on ${eol} and no longer receives security patches. Upgrade to a supported release. (${inst.path})`, [inst.path]));
+          }
+          break;
+        }
+      }
+    }
+  }
+  return checks;
+}
+
+// src/security/sca.ts
+import { spawnSync as spawnSync2 } from "child_process";
+function whichTool(name) {
+  const isWin = process.platform === "win32";
+  const r = spawnSync2(isWin ? "where" : "command", isWin ? [name] : ["-v", name], { encoding: "utf-8" });
+  if (r.error)
+    return null;
+  const out = (r.stdout || "").split(/\r?\n/).map((s) => s.trim()).filter(Boolean)[0];
+  return out || null;
+}
+function getVersion(toolId) {
+  const r = spawnSync2(toolId, ["--version"], { encoding: "utf-8", timeout: 15000 });
+  if (r.error || !r.stdout)
+    return null;
+  const m = r.stdout.match(/(\d+\.\d+\.\d+)/);
+  return m ? m[1] : null;
+}
+function toSeverity(s) {
+  const t = (s || "").toUpperCase();
+  if (t === "CRITICAL" || t === "HIGH")
+    return "error";
+  return "warn";
+}
+var SCA_TOOLS = [
+  {
+    id: "osv-scanner",
+    label: "OSV-Scanner",
+    auditArgs: ["--format", "json", "."],
+    parse: (json) => {
+      const out = [];
+      for (const res of json?.results || []) {
+        for (const v of res?.vulnerabilities || []) {
+          const pkg = v?.package || {};
+          const sev = toSeverity(v?.severity || v?.database_specific?.severity);
+          const vid = v?.id || "UNKNOWN";
+          out.push(makeCheck(`security.deps.osv.${vid}`, "vuln", sev, `${pkg.name || "?"}@${pkg.version || "?"} affected by ${vid} (${sev === "error" ? "HIGH" : "MEDIUM"})`, `${vid}: ${v?.summary || v?.details || ""}. Package ${pkg.name}@${pkg.version}.`, [pkg.name || ""]));
+        }
+      }
+      return out;
+    }
+  },
+  {
+    id: "pip-audit",
+    label: "pip-audit",
+    auditArgs: ["-f", "json"],
+    parse: (json) => {
+      const out = [];
+      for (const dep of json?.dependencies || []) {
+        for (const v of dep?.vulns || []) {
+          const sev = toSeverity(v?.severity);
+          const vid = v?.id || "UNKNOWN";
+          out.push(makeCheck(`security.deps.pipaudit.${vid}`, "vuln", sev, `${dep?.name || "?"}@${dep?.version || "?"} affected by ${vid} (${sev === "error" ? "HIGH" : "MEDIUM"})`, `${vid}: ${v?.description || ""}. Fix versions: ${(v?.fix_versions || []).join(", ") || "n/a"}.`, [dep?.name || ""]));
+        }
+      }
+      for (const v of json?.vulnerabilities || []) {
+        const sev = toSeverity(v?.severity);
+        const vid = v?.id || "UNKNOWN";
+        out.push(makeCheck(`security.deps.pipaudit.${vid}`, "vuln", sev, `${v?.name || "?"} affected by ${vid}`, `${vid}: ${v?.description || ""}.`, [v?.name || ""]));
+      }
+      return out;
+    }
+  },
+  {
+    id: "govulncheck",
+    label: "govulncheck",
+    auditArgs: ["-json", "."],
+    parse: (json) => {
+      const out = [];
+      for (const res of json?.Results || []) {
+        for (const v of res?.Vulnerabilities || []) {
+          const score = v?.Severity?.Score;
+          const sev = typeof score === "number" && score >= 9 ? "error" : "warn";
+          const vid = v?.OSV?.id || "UNKNOWN";
+          const pkg = v?.Package?.Path || v?.Package?.Name || "?";
+          out.push(makeCheck(`security.deps.govulncheck.${vid}`, "vuln", sev, `${pkg}@${v?.Version || "?"} affected by ${vid} (${sev === "error" ? "HIGH" : "MEDIUM"})`, `${vid}: ${v?.Details || ""}. Package ${pkg}@${v?.Version || "?"}.`, [pkg]));
+        }
+      }
+      return out;
+    }
+  },
+  {
+    id: "trivy",
+    label: "Trivy",
+    auditArgs: ["fs", "--format", "json", "."],
+    parse: (json) => {
+      const out = [];
+      for (const res of json?.Results || []) {
+        for (const v of res?.Vulnerabilities || []) {
+          const sev = toSeverity(v?.Severity);
+          const vid = v?.VulnerabilityID || "UNKNOWN";
+          out.push(makeCheck(`security.deps.trivy.${vid}`, "vuln", sev, `${v?.PkgName || "?"}@${v?.InstalledVersion || "?"} affected by ${vid} (${sev === "error" ? "HIGH" : "MEDIUM"})`, `${vid}: ${v?.Title || v?.Description || ""}. Fixed in ${v?.FixedVersion || "n/a"}.`, [v?.PkgName || ""]));
+        }
+      }
+      return out;
+    }
+  }
+];
+function detectScaTools() {
+  return SCA_TOOLS.map((t) => {
+    const p = whichTool(t.id);
+    return { id: t.id, label: t.label, path: p, version: p ? getVersion(t.id) : null };
+  });
+}
+function computeScaInventory() {
+  return detectScaTools().map((d) => {
+    const id = `security.scanner.${d.id}`;
+    if (d.path) {
+      return makeCheck(id, "vuln", "info", `${d.label} available (${d.version || "?"})`, `${d.label} is installed at ${d.path}. devmap can shell out to it for dependency CVE audit with --audit-deps.`, [d.path || ""]);
+    }
+    return makeCheck(id, "vuln", "info", `${d.label} not installed`, `${d.label} not found on PATH. Install it to enable dependency CVE scanning via devmap --audit-deps (it fetches vuln DBs over the network).`, []);
+  });
+}
+function runScaAudit(cwd) {
+  const present = detectScaTools().filter((d) => d.path);
+  if (present.length === 0) {
+    return [
+      makeCheck("security.deps.none", "vuln", "info", "no SCA tool installed — dependency CVE audit skipped", "Install osv-scanner / pip-audit / govulncheck / trivy to enable dependency CVE scanning via `devmap --audit-deps`.", [])
+    ];
+  }
+  const checks = [];
+  for (const d of present) {
+    const tool = SCA_TOOLS.find((t) => t.id === d.id);
+    const r = spawnSync2(d.id, tool.auditArgs, { cwd, encoding: "utf-8", timeout: 120000, maxBuffer: 16 * 1024 * 1024 });
+    if (r.error || r.status === null) {
+      checks.push(makeCheck(`security.deps.${d.id}.error`, "vuln", "info", `${d.label} audit failed to start`, `${d.label} could not be launched: ${r.error?.message || "unknown error"}.`, []));
+      continue;
+    }
+    if (r.status !== 0 && !r.stdout.trim()) {
+      checks.push(makeCheck(`security.deps.${d.id}.skip`, "vuln", "info", `${d.label} audit produced no output (exit ${r.status})`, `${d.label} returned no scannable result in ${cwd} (no project / no lockfile / no module).`, []));
+      continue;
+    }
+    try {
+      const json = JSON.parse(r.stdout);
+      const parsed = tool.parse(json, d.label);
+      checks.push(...parsed);
+      if (parsed.length === 0) {
+        checks.push(makeCheck(`security.deps.${d.id}.clean`, "vuln", "info", `${d.label} audit: no vulnerabilities found`, `${d.label} found no known vulnerabilities in ${cwd}.`, []));
+      }
+    } catch (e) {
+      checks.push(makeCheck(`security.deps.${d.id}.parse`, "vuln", "info", `${d.label} audit output not JSON`, `${d.label} returned output that could not be parsed as JSON: ${e?.message || e}.`, []));
+    }
+  }
+  return checks;
+}
+
+// src/output/json.ts
 function buildManifest(byName, conflicts, checks, environments, shells) {
   const sys = byName.system || {};
   const runtimes = byName.runtimes || [];
@@ -487,7 +700,7 @@ function buildManifest(byName, conflicts, checks, environments, shells) {
   };
 }
 
-// devmap/src/glyphs.ts
+// src/glyphs.ts
 var WIN = process.platform === "win32";
 var G = {
   spinner: WIN ? ["|", "/", "-", "\\"] : ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"],
@@ -521,7 +734,7 @@ function clean(s) {
   return out;
 }
 
-// devmap/src/progress.ts
+// src/progress.ts
 var SPINNERS = G.spinner;
 
 class ScanProgress {
@@ -609,7 +822,7 @@ class ScanProgress {
   }
 }
 
-// devmap/src/scan.ts
+// src/scan.ts
 async function runScan(shells, disabled, opts = {}) {
   const progress = opts.silent ? undefined : new ScanProgress(0, process.stderr.isTTY);
   const ctx = {
@@ -618,7 +831,8 @@ async function runScan(shells, disabled, opts = {}) {
     projectRoots: opts.projectRoots,
     progress,
     checkOutdated: opts.checkOutdated,
-    wslDeep: opts.wslDeep
+    wslDeep: opts.wslDeep,
+    auditDeps: opts.auditDeps
   };
   const { byName, allChecks } = await runDetectors(ctx, progress);
   const groups = [
@@ -627,7 +841,12 @@ async function runScan(shells, disabled, opts = {}) {
     ...byName.ides || []
   ];
   const conflicts = computeConflicts(groups, shells, disabled);
-  const collected = [...allChecks, ...conflicts.checks].filter((c) => !isCheckDisabled(c.ID, disabled));
+  const securityChecks = [
+    ...computeSecurity(byName),
+    ...computeScaInventory(),
+    ...opts.auditDeps ? runScaAudit(process.cwd()) : []
+  ];
+  const collected = [...allChecks, ...conflicts.checks, ...securityChecks].filter((c) => !isCheckDisabled(c.ID, disabled));
   const environments = {
     vcpkg: byName.vcpkg,
     pip: byName.pip,
@@ -643,7 +862,7 @@ async function runScan(shells, disabled, opts = {}) {
   return buildManifest(byName, conflicts, collected, environments, shells);
 }
 
-// devmap/src/query.ts
+// src/query.ts
 var CAT_ALIASES = {
   runtimes: "runtime",
   runtime: "runtime",
@@ -704,7 +923,7 @@ function queryManifest(m, opts) {
   return { groups, checks, conflicts };
 }
 
-// devmap/src/diff.ts
+// src/diff.ts
 var CAT_KEYS = [
   ["runtimes", "runtime"],
   ["packageManagers", "packageManager"],
@@ -777,7 +996,7 @@ function diffManifests(a, b) {
   return { tools: toolList, issues, summary };
 }
 
-// devmap/src/detector/system.ts
+// src/detector/system.ts
 import os from "node:os";
 register({
   name: "system",
@@ -796,12 +1015,12 @@ register({
   }
 });
 
-// devmap/src/detector/runtimes.ts
+// src/detector/runtimes.ts
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
 import { existsSync as existsSync2, readdirSync as readdirSync2 } from "node:fs";
 
-// devmap/src/detector/util.ts
+// src/detector/util.ts
 var CONCURRENCY = 12;
 var GENERIC_FLAGS = ["--version", "version", "-v", "-V"];
 function dedupe(paths, seen) {
@@ -868,7 +1087,7 @@ async function detectSimpleAsync(list, onProgress) {
   return out;
 }
 
-// devmap/src/detector/runtimes.ts
+// src/detector/runtimes.ts
 var HOME = homedir();
 async function condaPythonPaths() {
   const found = [];
@@ -939,7 +1158,7 @@ register({
   }
 });
 
-// devmap/src/detector/pkgmgrs.ts
+// src/detector/pkgmgrs.ts
 var TOOLS = [
   "npm",
   "pip",
@@ -968,7 +1187,7 @@ register({
   }
 });
 
-// devmap/src/detector/ides.ts
+// src/detector/ides.ts
 register({
   name: "ides",
   async scan(ctx) {
@@ -979,7 +1198,7 @@ register({
   }
 });
 
-// devmap/src/detector/vcpkg.ts
+// src/detector/vcpkg.ts
 import { join as join3 } from "node:path";
 var CANDIDATES = [
   "C:\\vcpkg\\vcpkg.exe",
@@ -1038,7 +1257,7 @@ register({
   }
 });
 
-// devmap/src/detector/piputil.ts
+// src/detector/piputil.ts
 function parseList2(raw) {
   if (!raw)
     return [];
@@ -1072,7 +1291,7 @@ async function pipPackagesAsync(pythonPath, timeout = 6000, withOutdated = false
   }
 }
 
-// devmap/src/detector/pip.ts
+// src/detector/pip.ts
 import { basename as basename2 } from "node:path";
 function shortName(pythonPath) {
   const lower = pythonPath.toLowerCase();
@@ -1126,7 +1345,7 @@ register({
   }
 });
 
-// devmap/src/detector/apt.ts
+// src/detector/apt.ts
 function parseApt(out) {
   const pkgs = [];
   for (const line of out.split(`
@@ -1156,7 +1375,7 @@ register({
   }
 });
 
-// devmap/src/detector/condaenv.ts
+// src/detector/condaenv.ts
 import { join as join4 } from "node:path";
 import { existsSync as existsSync3 } from "node:fs";
 function pythonOf(envPath) {
@@ -1201,7 +1420,7 @@ register({
   }
 });
 
-// devmap/src/detector/docker.ts
+// src/detector/docker.ts
 var DESKTOP = "C:\\Program Files\\Docker\\Docker\\resources\\bin\\docker.exe";
 function findDocker() {
   for (const p of whichInDirs("docker", pathDirs()))
@@ -1246,7 +1465,7 @@ register({
   }
 });
 
-// devmap/src/detector/wsl.ts
+// src/detector/wsl.ts
 var PROBE_SCRIPT = "echo py3=$(command -v python3); echo py=$(command -v python); echo node=$(command -v node); " + "echo go=$(command -v go); echo rustc=$(command -v rustc); echo gcc=$(command -v gcc); " + "echo git=$(command -v git); echo docker=$(command -v docker)";
 var TOOL_KEYS = ["py3", "py", "node", "go", "rustc", "gcc", "git", "docker"];
 async function probeDistro(name) {
@@ -1340,7 +1559,7 @@ register({
   }
 });
 
-// devmap/src/detector/vsshells.ts
+// src/detector/vsshells.ts
 import { readdirSync as readdirSync3, existsSync as existsSync4, statSync as statSync2 } from "node:fs";
 import { join as join5 } from "node:path";
 var VS_BASES = [
@@ -1506,7 +1725,7 @@ register({
   }
 });
 
-// devmap/src/detector/projects.ts
+// src/detector/projects.ts
 import { readdirSync as readdirSync4, existsSync as existsSync5, statSync as statSync3 } from "node:fs";
 import { join as join6, basename as basename3, dirname } from "node:path";
 function isVenv(dir) {
@@ -1580,7 +1799,7 @@ register({
   }
 });
 
-// devmap/src/cli.ts
+// src/cli.ts
 import { writeFileSync, mkdirSync, readFileSync, existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join7 } from "node:path";
@@ -1617,7 +1836,7 @@ function tokenize(argv) {
       const key = a.slice(2);
       const nxt = argv[i + 1];
       if (nxt !== undefined && !nxt.startsWith("--")) {
-        opts[key] = nxt;
+        opts[key] = opts[key] !== undefined ? `${opts[key]},${nxt}` : nxt;
         i++;
       } else
         opts[key] = true;
@@ -1671,7 +1890,8 @@ async function cmdScan(opts, pos) {
     projectRoots: roots,
     silent: opts.quiet === true,
     checkOutdated: opts.outdated === true,
-    wslDeep: opts["wsl-deep"] === true
+    wslDeep: opts["wsl-deep"] === true,
+    auditDeps: opts["audit-deps"] === true
   });
   if (opts.json) {
     emitText(JSON.stringify(manifest, null, 2), opts.bom === true);
@@ -1687,8 +1907,16 @@ async function cmdScan(opts, pos) {
       } catch {}
     }
   }
-  const hasError = (manifest.checks || []).some((c) => c.Severity === "error");
-  return opts.ci && hasError ? 1 : 0;
+  if (opts.ci) {
+    const hasError = (manifest.checks || []).some((c) => c.Severity === "error");
+    if (hasError)
+      return 1;
+    const hasWarn = (manifest.checks || []).some((c) => c.Severity === "warn");
+    if (hasWarn)
+      return 2;
+    return 0;
+  }
+  return 0;
 }
 async function cmdQuery(opts, pos) {
   const selector = pos[1];
@@ -1948,7 +2176,8 @@ scan options:
   --scan-root <dir> project-local environment scan root (comma-separated; default cwd). e.g. --scan-root C:\\src
   --outdated        check pip/conda upgradable packages online (off by default: requires PyPI access and slows the scan)
   --wsl-deep        probe inside stopped WSL distros (default probes only running ones to avoid waking distros)
-  --ci              any error-level issue → exit code 1
+  --ci              CI gate: clean → exit 0; any warn → exit 2; any error → exit 1
+  --audit-deps      dependency CVE audit via OSV-Scanner/pip-audit/govulncheck/Trivy (opt-in, uses network)
   --quiet           suppress scan progress feedback (for scripts/CI)
   --bom             prepend UTF-8 BOM for viewing in Notepad etc. (only on redirect/pipe)
   --version / --help

{devmap-0.2.5 → devmap-0.3.2}/devmap.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devmap
-Version: 0.2.5
+Version: 0.3.2
 Summary: Map your machine's dev environment and surface issues (PATH conflicts, ghost binaries, multi-version collisions). fastfetch-for-dev-tools. This PyPI package ships the real devmap CLI (a bundled JavaScript app launched via Node.js or Bun), so `pip install devmap && devmap` works standalone.
 Author: devmap contributors
 License: MIT

{devmap-0.2.5 → devmap-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "devmap"
-version = "0.2.5"
+version = "0.3.2"
 description = "Map your machine's dev environment and surface issues (PATH conflicts, ghost binaries, multi-version collisions). fastfetch-for-dev-tools. This PyPI package ships the real devmap CLI (a bundled JavaScript app launched via Node.js or Bun), so `pip install devmap && devmap` works standalone."
 readme = "README.md"
 requires-python = ">=3.8"