devmap 0.3.8__py3-none-any.whl → 0.3.9__py3-none-any.whl

devmap/_devmap.mjs

@@ -2,7 +2,7 @@
 // @bun
 
 // src/version.ts
-var VERSION = "0.3.8";
+var VERSION = "0.3.9";
 
 // src/install.ts
 function isIsolated(i) {
@@ -662,6 +662,206 @@ function runScaAudit(cwd) {
   return checks;
 }
 
+// src/security/secrets.ts
+import { existsSync as existsSync2, readFileSync, statSync as statSync2, readdirSync as readdirSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2, relative, isAbsolute } from "node:path";
+var RULES = [
+  { name: "AWS Access Key ID", re: /\b(AKIA[0-9A-Z]{16})\b/g, capture: true },
+  { name: "AWS Secret Access Key", re: /aws_secret_access_key\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi, capture: true },
+  { name: "GitHub Token", re: /\b(ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{82})\b/g, capture: true },
+  { name: "GitLab Personal Access Token", re: /\bglpat-[A-Za-z0-9_-]{20}\b/g, capture: true },
+  { name: "Slack Token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, capture: true },
+  {
+    name: "Slack Incoming Webhook",
+    re: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g,
+    capture: false,
+    mask: "https://hooks.slack.com/services/***"
+  },
+  { name: "Stripe Secret Key", re: /\bsk_live_[A-Za-z0-9]{24,}\b/g, capture: true },
+  { name: "OpenAI API Key", re: /\bsk-[A-Za-z0-9]{20,}\b/g, capture: true },
+  { name: "GCP API Key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g, capture: true },
+  { name: "Google OAuth Client Secret", re: /"client_secret"\s*:\s*"([A-Za-z0-9-_]{20,})"/g, capture: true },
+  {
+    name: "Private Key Block",
+    re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g,
+    capture: false,
+    mask: "[PRIVATE KEY BLOCK]"
+  },
+  { name: "Bearer Token", re: /\bBearer\s+([A-Za-z0-9._-]{20,})\b/g, capture: true },
+  { name: "Database URL with password", re: /(?:postgres|postgresql|mysql|mongodb(?:\+srv)?):\/\/[^:/\s]+:([^@\s]+)@/gi, capture: true },
+  { name: "npm authToken", re: /\/\/registry\.npmjs\.org\/:_authToken=([A-Za-z0-9_]{36,})/g, capture: true },
+  {
+    name: "Git URL with embedded credentials",
+    re: /[a-z]+:\/\/([^\s:@/]+):([^\s:@/]+)@/gi,
+    capture: true,
+    captureGroup: 2
+  },
+  {
+    name: "Generic Secret Assignment",
+    re: /(?:api[_-]?key|apikey|secret[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|secret|passwd|password|token)\s*[=:]\s*['"]?([A-Za-z0-9/+=_\-]{8,64})['"]?/gi,
+    capture: true,
+    generic: true
+  }
+];
+function redactText(v) {
+  if (v.length <= 4)
+    return "*".repeat(v.length);
+  return v.slice(0, 4) + "****" + (v.length > 8 ? " (len " + v.length + ")" : "");
+}
+function looksSecret(v) {
+  if (v.length >= 32)
+    return true;
+  if (v.length < 12)
+    return false;
+  let classes = 0;
+  if (/[a-z]/.test(v))
+    classes++;
+  if (/[A-Z]/.test(v))
+    classes++;
+  if (/[0-9]/.test(v))
+    classes++;
+  if (/[^A-Za-z0-9]/.test(v))
+    classes++;
+  return classes >= 3;
+}
+function slug(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function toRel(p) {
+  const home = homedir();
+  const lower = p.replace(/\\/g, "/");
+  const homeLower = home.replace(/\\/g, "/");
+  if (lower.startsWith(homeLower))
+    return "~" + lower.slice(homeLower.length);
+  try {
+    const r = relative(process.cwd(), p).replace(/\\/g, "/");
+    if (!r.startsWith("..") && !isAbsolute(r))
+      return r;
+  } catch {}
+  return p;
+}
+function discoverFiles(projectRoots, includeHome) {
+  const home = homedir();
+  const out = [];
+  const seen = new Set;
+  const add = (p) => {
+    try {
+      if (existsSync2(p) && statSync2(p).isFile()) {
+        const rp = p.replace(/\\/g, "/");
+        if (!seen.has(rp)) {
+          seen.add(rp);
+          out.push(p);
+        }
+      }
+    } catch {}
+  };
+  if (includeHome) {
+    const homeFiles = [
+      ".env",
+      ".bashrc",
+      ".zshrc",
+      ".bash_profile",
+      ".profile",
+      ".npmrc",
+      ".pypirc",
+      ".netrc",
+      ".git-credentials",
+      ".gitconfig",
+      ".docker/config.json",
+      ".kube/config",
+      ".aws/credentials",
+      ".config/gcloud/application_default_credentials.json",
+      ".azure/accessTokens.json",
+      ".ssh/id_rsa",
+      ".ssh/id_ecdsa",
+      ".ssh/id_ed25519",
+      ".ssh/id_dsa",
+      ".envrc"
+    ];
+    for (const f of homeFiles)
+      add(join2(home, f));
+    try {
+      for (const e of readdirSync2(home)) {
+        if (e.startsWith(".env") && e !== ".env")
+          add(join2(home, e));
+      }
+    } catch {}
+  }
+  const roots = [...new Set([process.cwd(), ...projectRoots])];
+  for (const root of roots) {
+    let entries = [];
+    try {
+      entries = readdirSync2(root);
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      if (e === ".env" || e.startsWith(".env.") || e === ".envrc" || e === ".npmrc" || e === ".pypirc" || e === ".netrc" || e === ".gitconfig" || e === "credentials.json" || e === "secrets.json" || e.endsWith(".pem") || e.endsWith(".key") || e.endsWith(".p12") || e.endsWith(".pfx") || /^service-?account.*\.json$/i.test(e)) {
+        add(join2(root, e));
+      }
+    }
+    add(join2(root, ".git", "config"));
+  }
+  return out;
+}
+function scanSecrets(projectRoots = [], includeHome = true) {
+  const files = discoverFiles(projectRoots, includeHome);
+  const checks = [];
+  let scanned = 0;
+  for (const f of files) {
+    let content;
+    try {
+      const st = statSync2(f);
+      if (!st.isFile() || st.size > 512 * 1024)
+        continue;
+      content = readFileSync(f, "utf8");
+    } catch {
+      continue;
+    }
+    scanned++;
+    const lines = content.split(/\r?\n/);
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i];
+      const accepted = [];
+      for (const rule of RULES) {
+        rule.re.lastIndex = 0;
+        let m;
+        while ((m = rule.re.exec(line)) !== null) {
+          if (m.index === rule.re.lastIndex)
+            rule.re.lastIndex++;
+          const start = m.index;
+          const end = start + m[0].length;
+          if (rule.generic === true) {
+            const val = (rule.captureGroup ? m[rule.captureGroup] : m[1]) || m[0];
+            if (!looksSecret(val))
+              continue;
+            if (accepted.some(([s, e]) => start < e && end > s))
+              continue;
+          }
+          const masked = redactValue(rule, m);
+          const rel = toRel(f);
+          const id = `security.secrets.${slug(rule.name)}.${checks.length + 1}`;
+          checks.push(makeCheck(id, "secret", "warn", `${rule.name} in ${rel}:${i + 1} (${masked})`, `${rule.name} detected at ${f}:${i + 1}. The value is redacted (${masked}) and never printed in full. ` + `Rotate or remove the credential and prefer a secret manager or build-time env injection.`, [f]));
+          accepted.push([start, end]);
+        }
+      }
+    }
+  }
+  if (checks.length === 0) {
+    checks.push(makeCheck("security.secrets.ok", "secret", "info", `No hardcoded secrets found in ${scanned} scanned config file(s)`, `Scanned ${scanned} credential/config file(s) under HOME and project roots (opt-in --scan-secrets). ` + `No known secret patterns matched.`, files.slice(0, 20)));
+  }
+  return checks;
+}
+function redactValue(rule, m) {
+  if (rule.capture) {
+    const g = m[rule.captureGroup ?? 1];
+    if (g)
+      return redactText(g);
+  }
+  return rule.mask ?? "[redacted]";
+}
+
 // src/health/parse.ts
 function parsePipCheck(text) {
   const lines = (text || "").split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
@@ -1092,7 +1292,8 @@ async function runScan(shells, disabled, opts = {}) {
   const securityChecks = [
     ...computeSecurity(byName),
     ...computeScaInventory(),
-    ...opts.auditDeps ? runScaAudit(process.cwd()) : []
+    ...opts.auditDeps ? runScaAudit(process.cwd()) : [],
+    ...opts.scanSecrets ? scanSecrets(opts.projectRoots) : []
   ];
   const collected = [...allChecks, ...conflicts.checks, ...securityChecks, ...healthChecks].filter((c) => !isCheckDisabled(c.ID, disabled));
   const environments = {
@@ -1171,6 +1372,169 @@ function queryManifest(m, opts) {
   return { groups, checks, conflicts };
 }
 
+// src/mcp.ts
+var ALL_SHELLS = ["current", "powershell", "gitbash", "wsl"];
+function parseShells(v) {
+  if (typeof v !== "string" || !v)
+    return ["current"];
+  const list = v.split(",").map((s) => s.trim());
+  return list.includes("all") ? ALL_SHELLS : list.length ? list : ["current"];
+}
+function parseDisable(v) {
+  if (typeof v !== "string" || !v)
+    return new Set;
+  return new Set(v.split(",").map((s) => s.trim()).filter(Boolean));
+}
+var TOOLS = [
+  {
+    name: "scan_environment",
+    description: "Run a full devmap scan of the local development environment and return the structured manifest " + "(detected tools across runtimes/pkg-managers/IDEs, PATH conflicts & ghost binaries, per-env health " + "checks, and the security posture). Use this first to understand a machine before proposing changes.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        shells: {
+          type: "string",
+          description: "Comma-separated shell views to reconstruct: current|powershell|gitbash|wsl|all (default current)"
+        },
+        disable: {
+          type: "string",
+          description: "Comma-separated check-rule prefixes to skip, e.g. 'path.duplicate,health.conda.base'"
+        },
+        auditDeps: {
+          type: "boolean",
+          description: "Opt-in dependency CVE audit via installed SCA tools (OSV-Scanner/pip-audit/govulncheck/Trivy). Uses network."
+        },
+        healthNetwork: {
+          type: "boolean",
+          description: "Also run network health probes (npm doctor / rustup check). Off by default to stay offline-fast."
+        },
+        scanSecrets: {
+          type: "boolean",
+          description: "Opt-in: scan a curated allowlist of HOME/project credential files for hardcoded secrets (offline)."
+        }
+      }
+    }
+  },
+  {
+    name: "query_tool",
+    description: "Query a scan for a specific tool, semantic category, conflict, or issue — e.g. selector 'node', " + "'runtime.node', 'pkg.npm', 'git', or 'python'. Returns matching installs plus any related findings. " + "Cheaper than a full scan when you already know what you are looking for.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        selector: {
+          type: "string",
+          description: "Tool id substring or 'category.tool' dotted form (e.g. node / runtime.node / pkg.npm)"
+        },
+        issuesOnly: { type: "boolean", description: "Only return issues (warn/error/missing) for the match" },
+        conflictsOnly: { type: "boolean", description: "Only return PATH/version/ghost conflicts for the match" },
+        offPathOnly: { type: "boolean", description: "Only return isolated off-PATH installs (version-manager envs excluded)" },
+        shells: { type: "string", description: "Shell views (see scan_environment)" },
+        disable: { type: "string", description: "Check-rule prefixes to skip (see scan_environment)" }
+      }
+    }
+  }
+];
+async function callTool(name, args) {
+  if (name === "scan_environment") {
+    const manifest = await runScan(parseShells(args.shells), parseDisable(args.disable), {
+      silent: true,
+      auditDeps: args.auditDeps === true,
+      healthNetwork: args.healthNetwork === true,
+      scanSecrets: args.scanSecrets === true
+    });
+    return { content: [{ type: "text", text: JSON.stringify(manifest, null, 2) }], isError: false };
+  }
+  if (name === "query_tool") {
+    const manifest = await runScan(parseShells(args.shells), parseDisable(args.disable), { silent: true });
+    const result = queryManifest(manifest, {
+      selector: typeof args.selector === "string" ? args.selector : undefined,
+      issues: args.issuesOnly === true,
+      conflicts: args.conflictsOnly === true,
+      offPath: args.offPathOnly === true
+    });
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }], isError: false };
+  }
+  return { content: [{ type: "text", text: `unknown tool: ${name}` }], isError: true };
+}
+async function startMcpServer() {
+  const toErr = (...a) => process.stderr.write(a.map((x) => typeof x === "string" ? x : String(x)).join(" ") + `
+`);
+  console.log = toErr;
+  console.error = toErr;
+  console.warn = toErr;
+  console.info = toErr;
+  const write = (obj) => process.stdout.write(JSON.stringify(obj) + `
+`);
+  const log = toErr;
+  let buffer = "";
+  process.stdin.setEncoding("utf8");
+  for await (const chunk of process.stdin) {
+    buffer += chunk;
+    let nl;
+    while ((nl = buffer.indexOf(`
+`)) >= 0) {
+      const line = buffer.slice(0, nl).trim();
+      buffer = buffer.slice(nl + 1);
+      if (!line)
+        continue;
+      let msg;
+      try {
+        msg = JSON.parse(line);
+      } catch {
+        log("[mcp] dropping malformed frame");
+        continue;
+      }
+      const id = msg.id;
+      const method = msg.method;
+      log("[mcp] ->", method || "?", id ?? "");
+      if (!method) {
+        if (id !== undefined)
+          write({ jsonrpc: "2.0", id, error: { code: -32600, message: "missing method" } });
+        continue;
+      }
+      switch (method) {
+        case "initialize":
+          write({
+            jsonrpc: "2.0",
+            id,
+            result: {
+              protocolVersion: msg.params?.protocolVersion || "2024-11-05",
+              capabilities: { tools: {} },
+              serverInfo: { name: "devmap", version: VERSION }
+            }
+          });
+          break;
+        case "notifications/initialized":
+        case "initialized":
+        case "notifications/cancelled":
+          break;
+        case "ping":
+          write({ jsonrpc: "2.0", id, result: {} });
+          break;
+        case "tools/list":
+          write({ jsonrpc: "2.0", id, result: { tools: TOOLS } });
+          break;
+        case "tools/call":
+          try {
+            const r = await callTool(msg.params?.name, msg.params?.arguments || {});
+            write({ jsonrpc: "2.0", id, result: r });
+          } catch (e) {
+            write({
+              jsonrpc: "2.0",
+              id,
+              result: { content: [{ type: "text", text: "error: " + (e?.message || String(e)) }], isError: true }
+            });
+          }
+          break;
+        default:
+          if (id !== undefined)
+            write({ jsonrpc: "2.0", id, error: { code: -32601, message: `method not found: ${method}` } });
+      }
+    }
+  }
+  log("[mcp] stdin closed, shutting down");
+}
+
 // src/diff.ts
 var CAT_KEYS = [
   ["runtimes", "runtime"],
@@ -1264,9 +1628,9 @@ register({
 });
 
 // src/detector/runtimes.ts
-import { homedir } from "node:os";
-import { join as join2 } from "node:path";
-import { existsSync as existsSync2, readdirSync as readdirSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+import { existsSync as existsSync3, readdirSync as readdirSync3 } from "node:fs";
 
 // src/detector/util.ts
 var CONCURRENCY = 12;
@@ -1336,27 +1700,27 @@ async function detectSimpleAsync(list, onProgress) {
 }
 
 // src/detector/runtimes.ts
-var HOME = homedir();
+var HOME = homedir2();
 async function condaPythonPaths() {
   const found = [];
   const bases = new Set;
   const ci = await runAsync("conda", ["info", "--base"], 15000);
   if (ci)
     bases.add(ci.trim());
-  bases.add(join2(HOME, "miniconda3"));
-  bases.add(join2(HOME, "anaconda3"));
+  bases.add(join3(HOME, "miniconda3"));
+  bases.add(join3(HOME, "anaconda3"));
   bases.add("E:\\Users\\Administrator\\miniconda3");
   for (const base of bases) {
-    if (!base || !existsSync2(base))
+    if (!base || !existsSync3(base))
       continue;
-    const basePy = IS_WIN ? join2(base, "python.exe") : join2(base, "bin", "python");
-    if (existsSync2(basePy))
+    const basePy = IS_WIN ? join3(base, "python.exe") : join3(base, "bin", "python");
+    if (existsSync3(basePy))
       found.push({ path: basePy, env: "base" });
-    const envsDir = join2(base, "envs");
-    if (existsSync2(envsDir)) {
-      for (const e of readdirSync2(envsDir)) {
-        const py = IS_WIN ? join2(envsDir, e, "python.exe") : join2(envsDir, e, "bin", "python");
-        if (existsSync2(py))
+    const envsDir = join3(base, "envs");
+    if (existsSync3(envsDir)) {
+      for (const e of readdirSync3(envsDir)) {
+        const py = IS_WIN ? join3(envsDir, e, "python.exe") : join3(envsDir, e, "bin", "python");
+        if (existsSync3(py))
           found.push({ path: py, env: e });
       }
     }
@@ -1369,14 +1733,14 @@ async function scanCondaPythons() {
   return paths.map((p, i) => ({ path: p.path, onPath: false, version: versions[i], env: p.env }));
 }
 async function scanNvmNodes() {
-  const cands = [join2(HOME, "AppData", "Roaming", "nvm"), join2(HOME, ".nvm", "versions", "node")];
+  const cands = [join3(HOME, "AppData", "Roaming", "nvm"), join3(HOME, ".nvm", "versions", "node")];
   const found = [];
   for (const dir of cands) {
-    if (!existsSync2(dir))
+    if (!existsSync3(dir))
       continue;
-    for (const v of readdirSync2(dir)) {
-      const bin = IS_WIN ? join2(dir, v, "node.exe") : join2(dir, v, "bin", "node");
-      if (existsSync2(bin))
+    for (const v of readdirSync3(dir)) {
+      const bin = IS_WIN ? join3(dir, v, "node.exe") : join3(dir, v, "bin", "node");
+      if (existsSync3(bin))
         found.push({ path: bin, env: v });
     }
   }
@@ -1384,7 +1748,7 @@ async function scanNvmNodes() {
   return found.map((f, i) => ({ path: f.path, onPath: false, version: versions[i], env: f.env }));
 }
 async function scanKnownBinary(cands, flags) {
-  const hits = cands.filter((c) => existsSync2(c));
+  const hits = cands.filter((c) => existsSync3(c));
   const versions = await pool(hits, 12, (c) => versionOfAsync(c, flags));
   return hits.map((c, i) => ({ path: c, onPath: false, version: versions[i] }));
 }
@@ -1399,7 +1763,7 @@ register({
       detectRuntimeAsync("rustc", "rustc", ["--version"]),
       detectRuntimeAsync("java", "java", ["-version"]),
       detectRuntimeAsync("ruby", "ruby", ["--version"]),
-      detectRuntimeAsync("bun", "bun", ["--version"], () => scanKnownBinary([join2(HOME, ".bun", "bin", "bun"), join2(HOME, ".bun", "bin", "bun.exe")], ["--version"]))
+      detectRuntimeAsync("bun", "bun", ["--version"], () => scanKnownBinary([join3(HOME, ".bun", "bin", "bun"), join3(HOME, ".bun", "bin", "bun.exe")], ["--version"]))
     ]);
     const groups = results.filter((g) => g !== null);
     return { data: groups, checks: [] };
@@ -1407,7 +1771,7 @@ register({
 });
 
 // src/detector/pkgmgrs.ts
-var TOOLS = [
+var TOOLS2 = [
   "npm",
   "pip",
   "pip3",
@@ -1428,7 +1792,7 @@ var TOOLS = [
 register({
   name: "packageManagers",
   async scan(ctx) {
-    const data = await detectSimpleAsync(TOOLS, (done, total) => {
+    const data = await detectSimpleAsync(TOOLS2, (done, total) => {
       ctx.progress?.sub(`packageManagers · ${done}/${total}`);
     });
     return { data, checks: [] };
@@ -1447,7 +1811,7 @@ register({
 });
 
 // src/detector/vcpkg.ts
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 var CANDIDATES = [
   "C:\\vcpkg\\vcpkg.exe",
   "C:\\src\\vcpkg\\vcpkg.exe",
@@ -1474,7 +1838,7 @@ async function findVcpkg() {
     if (fileExists(c))
       add(c, false);
   if (process.env.VCPKG_ROOT) {
-    const p = join3(process.env.VCPKG_ROOT, IS_WIN ? "vcpkg.exe" : "vcpkg");
+    const p = join4(process.env.VCPKG_ROOT, IS_WIN ? "vcpkg.exe" : "vcpkg");
     if (fileExists(p))
       add(p, false);
   }
@@ -1630,11 +1994,11 @@ register({
 });
 
 // src/detector/condaenv.ts
-import { join as join4 } from "node:path";
-import { existsSync as existsSync3 } from "node:fs";
+import { join as join5 } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
 function pythonOf(envPath) {
-  const py = IS_WIN ? join4(envPath, "python.exe") : join4(envPath, "bin", "python");
-  return existsSync3(py) ? py : null;
+  const py = IS_WIN ? join5(envPath, "python.exe") : join5(envPath, "bin", "python");
+  return existsSync4(py) ? py : null;
 }
 register({
   name: "condaenv",
@@ -1814,8 +2178,8 @@ register({
 });
 
 // src/detector/vsshells.ts
-import { readdirSync as readdirSync3, existsSync as existsSync4, statSync as statSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { readdirSync as readdirSync4, existsSync as existsSync5, statSync as statSync3 } from "node:fs";
+import { join as join6 } from "node:path";
 var VS_BASES = [
   "C:\\Program Files\\Microsoft Visual Studio",
   "C:\\Program Files (x86)\\Microsoft Visual Studio"
@@ -1828,20 +2192,20 @@ var EDITIONS = ["Community", "Professional", "Enterprise", "BuildTools"];
 function vsRoots() {
   const roots = [];
   for (const b of VS_BASES) {
-    if (!existsSync4(b))
+    if (!existsSync5(b))
       continue;
-    for (const v of readdirSync3(b)) {
-      const verDir = join5(b, v);
-      if (!existsSync4(verDir) || !statSync2(verDir).isDirectory())
+    for (const v of readdirSync4(b)) {
+      const verDir = join6(b, v);
+      if (!existsSync5(verDir) || !statSync3(verDir).isDirectory())
         continue;
       const hasEdition = EDITIONS.some((e) => {
-        const ed = join5(verDir, e);
-        return existsSync4(ed) && statSync2(ed).isDirectory();
+        const ed = join6(verDir, e);
+        return existsSync5(ed) && statSync3(ed).isDirectory();
       });
       if (hasEdition) {
         for (const e of EDITIONS) {
-          const ed = join5(verDir, e);
-          if (existsSync4(ed) && statSync2(ed).isDirectory())
+          const ed = join6(verDir, e);
+          if (existsSync5(ed) && statSync3(ed).isDirectory())
             roots.push(ed);
         }
       } else {
@@ -1854,37 +2218,37 @@ function vsRoots() {
 function msvcVersionsDesc(msvc) {
   let vers = [];
   try {
-    vers = readdirSync3(msvc);
+    vers = readdirSync4(msvc);
   } catch {
     return [];
   }
   return vers.sort((a, b) => b.localeCompare(a, undefined, { numeric: true }));
 }
 function vsCl(root, arch) {
-  const msvc = join5(root, "VC", "Tools", "MSVC");
-  if (!existsSync4(msvc))
+  const msvc = join6(root, "VC", "Tools", "MSVC");
+  if (!existsSync5(msvc))
     return null;
   for (const v of msvcVersionsDesc(msvc)) {
-    const p = join5(msvc, v, "bin", `Host${arch}`, arch, "cl.exe");
-    if (existsSync4(p))
+    const p = join6(msvc, v, "bin", `Host${arch}`, arch, "cl.exe");
+    if (existsSync5(p))
       return p;
   }
   return null;
 }
 function vsMsbuild(root) {
-  const base = join5(root, "MSBuild");
-  if (!existsSync4(base))
+  const base = join6(root, "MSBuild");
+  if (!existsSync5(base))
     return null;
-  const cands = [join5(base, "Current", "Bin", "MSBuild.exe")];
+  const cands = [join6(base, "Current", "Bin", "MSBuild.exe")];
   try {
-    for (const v of readdirSync3(base))
-      cands.push(join5(base, v, "Bin", "MSBuild.exe"));
+    for (const v of readdirSync4(base))
+      cands.push(join6(base, v, "Bin", "MSBuild.exe"));
   } catch {}
-  return cands.find((c) => existsSync4(c)) || null;
+  return cands.find((c) => existsSync5(c)) || null;
 }
 function vsCMake(root) {
-  const p = join5(root, "Common7", "IDE", "CommonExtensions", "Microsoft", "CMake", "CMake", "bin", "cmake.exe");
-  return existsSync4(p) ? p : null;
+  const p = join6(root, "Common7", "IDE", "CommonExtensions", "Microsoft", "CMake", "CMake", "bin", "cmake.exe");
+  return existsSync5(p) ? p : null;
 }
 function vsDotnet() {
   return whichInDirs("dotnet", pathDirs())[0] || null;
@@ -1907,19 +2271,19 @@ function scanToolchain() {
 }
 function shortcutNames() {
   const names = [];
-  const stack = [...START_MENU.filter((d) => existsSync4(d))];
+  const stack = [...START_MENU.filter((d) => existsSync5(d))];
   while (stack.length) {
     const dir = stack.pop();
     let entries = [];
     try {
-      entries = readdirSync3(dir);
+      entries = readdirSync4(dir);
     } catch {
       continue;
     }
     for (const e of entries) {
-      const full = join5(dir, e);
+      const full = join6(dir, e);
       try {
-        if (statSync2(full).isDirectory())
+        if (statSync3(full).isDirectory())
           stack.push(full);
         else if (e.toLowerCase().endsWith(".lnk") && /developer|native tools|vs 20/i.test(e))
           names.push(e.replace(/\.lnk$/i, ""));
@@ -1937,8 +2301,8 @@ function inferKindArch(name) {
 function entryRef(kind) {
   const fn = kind === "powershell" ? "Launch-VsDevShell.ps1" : "VsDevCmd.bat";
   for (const r of vsRoots()) {
-    const p = join5(r, "Common7", "Tools", fn);
-    if (existsSync4(p))
+    const p = join6(r, "Common7", "Tools", fn);
+    if (existsSync5(p))
       return p;
   }
   return null;
@@ -1980,16 +2344,16 @@ register({
 });
 
 // src/detector/projects.ts
-import { readdirSync as readdirSync4, existsSync as existsSync5, statSync as statSync3 } from "node:fs";
-import { join as join6, basename as basename3, dirname as dirname2 } from "node:path";
+import { readdirSync as readdirSync5, existsSync as existsSync6, statSync as statSync4 } from "node:fs";
+import { join as join7, basename as basename3, dirname as dirname2 } from "node:path";
 function isVenv(dir) {
-  if (!existsSync5(join6(dir, "pyvenv.cfg")))
+  if (!existsSync6(join7(dir, "pyvenv.cfg")))
     return false;
   const child = IS_WIN_PYVENV(dir);
   return child;
 }
 function IS_WIN_PYVENV(dir) {
-  return existsSync5(join6(dir, "Scripts", "activate")) || existsSync5(join6(dir, "Scripts", "activate.bat")) || existsSync5(join6(dir, "bin", "activate"));
+  return existsSync6(join7(dir, "Scripts", "activate")) || existsSync6(join7(dir, "Scripts", "activate.bat")) || existsSync6(join7(dir, "bin", "activate"));
 }
 function walk(root, maxDepth, out, seen) {
   const stack = [[root, 0]];
@@ -1997,14 +2361,14 @@ function walk(root, maxDepth, out, seen) {
     const [dir, depth] = stack.pop();
     let entries = [];
     try {
-      entries = readdirSync4(dir);
+      entries = readdirSync5(dir);
     } catch {
       continue;
     }
     for (const e of entries) {
       if (e === "node_modules" || e === ".git" || e === "target" || e === "dist" || e === ".next" || e === "out") {
         if (e === "node_modules") {
-          const p = join6(dir, e);
+          const p = join7(dir, e);
           if (!seen.has(p.toLowerCase())) {
             seen.add(p.toLowerCase());
             out.push({ project: basename3(dir), type: "node_modules", path: p });
@@ -2012,10 +2376,10 @@ function walk(root, maxDepth, out, seen) {
         }
         continue;
       }
-      const full = join6(dir, e);
+      const full = join7(dir, e);
       let st;
       try {
-        st = statSync3(full);
+        st = statSync4(full);
       } catch {
         continue;
       }
@@ -2040,7 +2404,7 @@ register({
     const envs = [];
     const seen = new Set;
     for (const r of roots) {
-      if (existsSync5(r))
+      if (existsSync6(r))
         walk(r, 4, envs, seen);
     }
     const checks = [];
@@ -2054,9 +2418,9 @@ register({
 });
 
 // src/cli.ts
-import { writeFileSync, mkdirSync, readFileSync, existsSync as existsSync6 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join7 } from "node:path";
+import { writeFileSync, mkdirSync, readFileSync as readFileSync2, existsSync as existsSync7 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join8 } from "node:path";
 import { execSync } from "node:child_process";
 if (process.platform === "win32") {
   try {
@@ -2069,8 +2433,8 @@ if (process.platform === "win32") {
   const oerr = console.error.bind(console);
   console.error = (...a) => oerr(...a.map((x) => typeof x === "string" ? clean(x) : x));
 }
-var ALL_SHELLS = ["current", "powershell", "gitbash", "wsl"];
-var DEFAULT_MANIFEST = join7(homedir2(), ".devmap", "devmap.json");
+var ALL_SHELLS2 = ["current", "powershell", "gitbash", "wsl"];
+var DEFAULT_MANIFEST = join8(homedir3(), ".devmap", "devmap.json");
 function emitText(text, withBom = false) {
   const prefix = withBom && !process.stdout.isTTY ? "\uFEFF" : "";
   process.stdout.write(prefix + text + `
@@ -2105,7 +2469,7 @@ function toShells(v) {
   if (typeof v !== "string")
     return ["current"];
   const list = v.split(",").map((s) => s.trim());
-  return list.includes("all") ? ALL_SHELLS : list.length ? list : ["current"];
+  return list.includes("all") ? ALL_SHELLS2 : list.length ? list : ["current"];
 }
 function toSet(v) {
   if (typeof v !== "string")
@@ -2119,10 +2483,10 @@ function toRoots(v) {
   return arr.length ? arr : undefined;
 }
 function readManifestFile(path) {
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     throw new Error(`manifest file not found: ${path}`);
   try {
-    const raw = readFileSync(path, "utf8").replace(/^\uFEFF/, "");
+    const raw = readFileSync2(path, "utf8").replace(/^\uFEFF/, "");
     return JSON.parse(raw);
   } catch (e) {
     throw new Error(`manifest parse failed (${path}): ${e.message}`);
@@ -2131,7 +2495,7 @@ function readManifestFile(path) {
 async function resolveManifest(explicitPath, shells, disabled, label, roots) {
   if (explicitPath)
     return { manifest: readManifestFile(explicitPath), source: explicitPath };
-  if (existsSync6(DEFAULT_MANIFEST))
+  if (existsSync7(DEFAULT_MANIFEST))
     return { manifest: readManifestFile(DEFAULT_MANIFEST), source: DEFAULT_MANIFEST };
   const manifest = await runScan(shells, disabled, { projectRoots: roots });
   return { manifest, source: label + "(live scan)" };
@@ -2146,7 +2510,8 @@ async function cmdScan(opts, pos) {
     checkOutdated: opts.outdated === true,
     wslDeep: opts["wsl-deep"] === true,
     auditDeps: opts["audit-deps"] === true,
-    healthNetwork: opts["health-network"] === true
+    healthNetwork: opts["health-network"] === true,
+    scanSecrets: opts["scan-secrets"] === true
   });
   if (opts.json) {
     emitText(JSON.stringify(manifest, null, 2), opts.bom === true);
@@ -2156,7 +2521,7 @@ async function cmdScan(opts, pos) {
     renderPrettyFromManifest(manifest);
     if (opts["no-manifest"] !== true) {
       try {
-        mkdirSync(join7(DEFAULT_MANIFEST, ".."), { recursive: true });
+        mkdirSync(join8(DEFAULT_MANIFEST, ".."), { recursive: true });
         writeFileSync(DEFAULT_MANIFEST, JSON.stringify(manifest, null, 2));
         console.log(`  ${"\x1B[2m"}manifest → ${DEFAULT_MANIFEST}${"\x1B[0m"}`);
       } catch {}
@@ -2248,7 +2613,7 @@ async function cmdDevdiff(opts, pos) {
     const before = await resolveManifest(opts.manifest, shells, disabled, "devdiff-before", toRoots(opts["scan-root"]));
     A = before.manifest;
     labelA = before.source;
-    B = await runScan(shells, disabled, { projectRoots: toRoots(opts["scan-root"]) });
+    B = await runScan(shells, disabled, { projectRoots: toRoots(opts["scan-root"]), scanSecrets: opts["scan-secrets"] === true });
     labelB = "current live scan";
   }
   const diff = diffManifests(A, B);
@@ -2515,9 +2880,11 @@ scan options:
   --wsl-deep        probe inside stopped WSL distros (default probes only running ones to avoid waking distros)
   --ci              CI gate: clean → exit 0; any warn → exit 2; any error → exit 1
   --audit-deps      dependency CVE audit via OSV-Scanner/pip-audit/govulncheck/Trivy (opt-in, uses network)
+  --scan-secrets    scan a curated allowlist of HOME/project credential files for hardcoded secrets (opt-in, offline)
   --health-network  run network health probes too (npm doctor / rustup check; off by default to stay offline-fast)
   --quiet           suppress scan progress feedback (for scripts/CI)
   --bom             prepend UTF-8 BOM for viewing in Notepad etc. (only on redirect/pipe)
+  --mcp             run as an MCP server (stdio JSON-RPC) for AI IDE agents (Cursor/Cline/Claude Desktop)
   --version / --help
 
 Phase 2 environment layer (covered by this scan):
@@ -2555,6 +2922,10 @@ async function main() {
     console.log(VERSION);
     process.exit(0);
   }
+  if (opts.mcp) {
+    await startMcpServer();
+    process.exit(0);
+  }
   const sub = pos[0] || "scan";
   let code = 0;
   try {

{devmap-0.3.8.dist-info → devmap-0.3.9.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devmap
-Version: 0.3.8
+Version: 0.3.9
 Summary: Map your machine's dev environment and surface issues (PATH conflicts, ghost binaries, multi-version collisions). fastfetch-for-dev-tools. This PyPI package ships the real devmap CLI (a bundled JavaScript app launched via Node.js or Bun), so `pip install devmap && devmap` works standalone.
 Author: devmap contributors
 License: MIT

devmap-0.3.9.dist-info/RECORD

@@ -0,0 +1,7 @@
+devmap/__init__.py,sha256=4Ek7Di0FYYl76FKnHJ8VYiJPHlUTfoqyBB_hul_pFbk,1728
+devmap/_devmap.mjs,sha256=z0vAvLmK_1dVXZkrcMGp7KSYoJTI15sTWRjQwPIANVQ,107512
+devmap-0.3.9.dist-info/METADATA,sha256=UihXpOtSC58_JLOZPRmsnNdPmPC5UeYd4sfPU7Ba9Sc,6977
+devmap-0.3.9.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+devmap-0.3.9.dist-info/entry_points.txt,sha256=FOQKZCLz0WGWemrTw0suYRqKWrUB4_XJ2Gkrw60ZEcg,39
+devmap-0.3.9.dist-info/top_level.txt,sha256=QeomiD_JKcjSd_jTZv0WJF3darUb2sUsxmocjgYJ6Qc,7
+devmap-0.3.9.dist-info/RECORD,,

devmap-0.3.8.dist-info/RECORD

@@ -1,7 +0,0 @@
-devmap/__init__.py,sha256=4Ek7Di0FYYl76FKnHJ8VYiJPHlUTfoqyBB_hul_pFbk,1728
-devmap/_devmap.mjs,sha256=yRSmxGm1Kx6viFjAPiVNoEWvRJnSSXDZ5RQEie9XFYk,93233
-devmap-0.3.8.dist-info/METADATA,sha256=MmUONHZSjGyIvbkWfsELqRr8ZcJQczH88F0Y5HumEtg,6977
-devmap-0.3.8.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
-devmap-0.3.8.dist-info/entry_points.txt,sha256=FOQKZCLz0WGWemrTw0suYRqKWrUB4_XJ2Gkrw60ZEcg,39
-devmap-0.3.8.dist-info/top_level.txt,sha256=QeomiD_JKcjSd_jTZv0WJF3darUb2sUsxmocjgYJ6Qc,7
-devmap-0.3.8.dist-info/RECORD,,