@codacy/analysis-runner 0.12.0 → 0.13.0

package/README.md

@@ -1,7 +1,9 @@
 # @codacy/analysis-runner
 
 ## Table of Contents
+
 - [Overview](#overview)
+- [Quick start](#quick-start)
 - [API](#api)
 - [Pipeline steps](#pipeline-steps)
 - [Output formats](#output-formats)
@@ -13,17 +15,90 @@
 
 Core orchestration engine for the Codacy Analysis CLI. Discovers tools, checks capabilities, calls `analyze()` on each adapter, aggregates results, and transforms output. Usable programmatically by both the CLI and IDE integrations.
 
+## Quick start
+
+Tool adapters live in a companion preset package, **`@codacy/analysis-adapters`**. A
+consumer installs both and registers the built-in adapters **once** before running
+anything tool-related — the runner's adapter registry starts empty and nothing
+auto-populates it.
+
+```ts
+import { registerBuiltinAdapters } from "@codacy/analysis-adapters";
+import { analyze, createNullLogger } from "@codacy/analysis-runner";
+
+// Register all built-in tools + cloud-only descriptors (call once at startup).
+registerBuiltinAdapters();
+
+// Run analysis. `repositoryRoot` must be a git work tree.
+const result = await analyze({
+  repositoryRoot: "/abs/path/to/repo",
+  // files: ["src/index.ts"],   // optional: scope to specific files
+  logger: createNullLogger(), // or bring your own Logger (see below)
+});
+
+// Issue paths are repo-relative; line/column are 1-based.
+for (const issue of result.issues) {
+  console.log(
+    `${issue.filePath}:${issue.line}:${issue.column}  ${issue.patternId}  ${issue.message}`,
+  );
+}
+```
+
+To register only a subset of tools, import `builtinAdapterEntries` from the preset and
+call `registerLazyAdapter(descriptor, load)` for the ones you want.
+
+### Creating a config
+
+`analyze()` reads `.codacy/codacy.config.json`. Generate one programmatically with the
+`init*` family — they build a `CodacyConfig` from the registered adapters; `writeCodacyConfig`
+persists it:
+
+```ts
+import {
+  getRegisteredAdapters,
+  initLocalConfig, // local-config detection only (offline)
+  // initDefaultConfig / initAutoConfig / initRemoteConfig also available
+  writeCodacyConfig,
+} from "@codacy/analysis-runner";
+
+const adapters = await getRegisteredAdapters();
+const { config } = await initLocalConfig(repositoryRoot, adapters);
+await writeCodacyConfig(repositoryRoot, config);
+```
+
+`initAutoConfig` additionally takes the registered descriptors (`getRegisteredDescriptors()`)
+and the preset's `loadUnsupportedPatterns` to gate stack-specific patterns; `initRemoteConfig`
+pulls the config from Codacy Cloud (pass an API token — see credential helpers below).
+
+### Custom logging & cancellation
+
+- Pass your own `Logger` (the `@codacy/tooling` contract: `debug` / `info` / `warn` / `error`)
+  to route progress into your UI, or `createNullLogger()` for silence. Do **not** use
+  `createLogger()` in an embedder — it writes to files/stderr. Drive progress UI from the
+  `onToolStart` / `onToolComplete` / `onToolProgress` callbacks on `AnalyzeOptions`.
+- Pass `signal: AbortSignal` on `AnalyzeOptions` to cancel an in-flight run; signal-honoring
+  adapters return partial results and remaining tools are marked cancelled.
+
 ## API
 
-| Export | Purpose |
-|--------|---------|
-| `analyze(options)` | Main entry point — runs the full analysis pipeline |
-| `registerAdapter(adapter)` | Register a tool adapter |
-| `clearAdapters()` | Reset adapter registry (for tests) |
-| `getRegisteredAdapters()` | List registered adapters |
-| `formatOutput(result, format)` | Transform AnalysisResult into a formatted string |
-| `buildToolConfig()` | Assemble CodacyToolConfig from CodacyConfig + local config |
-| `readCodacyConfig()` / `writeCodacyConfig()` | Read/write `.codacy/codacy.config.json` |
+| Export                                                                                  | Purpose                                                                                                                                                      |
+| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `analyze(options)`                                                                      | Main entry point — runs the full analysis pipeline. Options include `repositoryRoot`, `tools`, `files`, `logger`, `signal`, and `onTool*` progress callbacks |
+| `registerAdapter(adapter)` / `registerLazyAdapter(descriptor, load)`                    | Register a tool adapter (eager / lazy)                                                                                                                       |
+| `clearAdapters()`                                                                       | Reset adapter registry (for tests)                                                                                                                           |
+| `getRegisteredAdapters()` / `getRegisteredDescriptors()`                                | List registered adapters / descriptors                                                                                                                       |
+| `initLocalConfig()` / `initDefaultConfig()` / `initAutoConfig()` / `initRemoteConfig()` | Build a `CodacyConfig` (local, default, stack-aware, or Cloud-sourced)                                                                                       |
+| `readCodacyConfig()` / `writeCodacyConfig()`                                            | Read/write `.codacy/codacy.config.json`                                                                                                                      |
+| `buildToolConfig()`                                                                     | Assemble CodacyToolConfig from CodacyConfig + local config                                                                                                   |
+| `discover(path)`                                                                        | Scan a repo and report languages, frameworks, libraries, notable files                                                                                       |
+| `formatOutput(result, format)`                                                          | Transform AnalysisResult into a formatted string                                                                                                             |
+| `createLogger()` / `createNullLogger()`                                                 | File/stderr logger (CLI) / no-op logger (embedders)                                                                                                          |
+| `saveCredentials()` / `loadCredentials()` / `deleteCredentials()` / `resolveApiToken()` | Machine-stored API-token storage in `~/.codacy/credentials`                                                                                                  |
+| `validateApiToken()` / `configureApiToken()` / `listIgnoredFiles()`                     | Codacy Cloud API helpers                                                                                                                                     |
+
+> Adapter **registration** lives in the companion preset `@codacy/analysis-adapters`
+> (`registerBuiltinAdapters`, `builtinAdapterEntries`), not here — the runner stays
+> tool-agnostic.
 
 ## Pipeline steps
 
@@ -38,18 +113,18 @@ Core orchestration engine for the Codacy Analysis CLI. Discovers tools, checks c
 
 ## Output formats
 
-| Format | Description |
-|--------|-------------|
-| `json` | Pretty-printed AnalysisResult (default) |
-| `sarif` | SARIF v2.1.0 document |
-| `container` | One JSON object per line (Codacy Docker runners) |
-| `text` | Human-readable terminal summary with colors and grouping |
+| Format      | Description                                              |
+| ----------- | -------------------------------------------------------- |
+| `json`      | Pretty-printed AnalysisResult (default)                  |
+| `sarif`     | SARIF v2.1.0 document                                    |
+| `container` | One JSON object per line (Codacy Docker runners)         |
+| `text`      | Human-readable terminal summary with colors and grouping |
 
 ## Execution modes
 
-| Mode | Behavior |
-|------|----------|
-| `standard` | Skip unavailable tools, report them (default) |
-| `strict` | Fail if any configured tool is unavailable |
-| `auto-install` | Attempt to install missing tools before analysis |
-| `inspect` | Dry-run: report capability without running analysis |
+| Mode           | Behavior                                            |
+| -------------- | --------------------------------------------------- |
+| `standard`     | Skip unavailable tools, report them (default)       |
+| `strict`       | Fail if any configured tool is unavailable          |
+| `auto-install` | Attempt to install missing tools before analysis    |
+| `inspect`      | Dry-run: report capability without running analysis |

package/dist/index.d.ts

@@ -51,6 +51,15 @@ interface AnalyzeOptions {
     configFile?: string;
     /** Logger for pipeline progress messages (install status, etc.). Defaults to no-op. */
     logger?: Logger;
+    /**
+     * Optional caller abort signal for cancelling an in-flight analysis (e.g. an
+     * embedder like VSCode or an MCP server). When aborted, `analyze()` stops
+     * launching new tools, in-flight signal-honoring adapters return partial
+     * results, and remaining tools are marked cancelled. If the signal is already
+     * aborted when `analyze()` is called, it returns immediately without doing any
+     * work.
+     */
+    signal?: AbortSignal;
     /** Called when a tool starts executing. */
     onToolStart?: (toolId: string, displayName: string) => void;
     /** Called when a tool finishes executing. */
@@ -659,6 +668,15 @@ interface LoggerOptions {
      */
     onStderrMessage?: (text: string, level: LogLevel) => void;
 }
+/**
+ * Creates a no-op Logger that discards all messages.
+ *
+ * Intended for embedders (VSCode extension, MCP server, other library
+ * consumers) that call `analyze()` programmatically and do not want the
+ * pipeline writing to a log file or stderr. Passing this — or simply omitting
+ * `options.logger`, which defaults to it — keeps analysis completely silent.
+ */
+declare function createNullLogger(): Logger;
 /**
  * Removes old log files beyond the retention limit.
  *
@@ -677,6 +695,50 @@ declare function rotateLogFiles(logsDir: string, maxFiles: number): void;
  */
 declare function createLogger(options?: LoggerOptions): Logger;
 
+/**
+ * Credential storage — encrypts and persists API tokens to ~/.codacy/credentials,
+ * and resolves an API token from the environment or stored credentials.
+ *
+ * Lives in the runner so that any embedder (CLI, MCP server, IDE integration) can
+ * reuse credential storage. The interactive prompt stays in the CLI.
+ *
+ * Replicates the encryption scheme from codacy-cloud-cli — the byte format,
+ * algorithm, key derivation, and file location are SHARED, so credentials written
+ * by one tool are readable by the other. DO NOT change any of the following:
+ * - File location: ~/.codacy/credentials
+ * - Machine key: [hostname, username, homedir, platform].join("|")
+ * - Key derivation: PBKDF2 (100k iterations, SHA-512, 32-byte key)
+ * - Encryption: AES-256-GCM with random salt (32B) and IV (16B)
+ * - Storage: JSON with hex-encoded { salt, iv, authTag, encrypted }
+ * - File permissions: 0o600 (owner read/write only)
+ *
+ * All crypto uses Node.js built-in `crypto` — no external dependencies.
+ */
+/**
+ * Encrypts and saves an API token to ~/.codacy/credentials.
+ * Creates the ~/.codacy/ directory if it doesn't exist.
+ */
+declare function saveCredentials(token: string): Promise<void>;
+/**
+ * Reads and decrypts the stored API token from ~/.codacy/credentials.
+ * Returns null if the file is missing, corrupt, or cannot be decrypted.
+ */
+declare function loadCredentials(): Promise<string | null>;
+/**
+ * Deletes the stored credentials file.
+ * Returns true if the file existed and was deleted, false otherwise.
+ */
+declare function deleteCredentials(): Promise<boolean>;
+/**
+ * Resolves a Codacy API token from the environment or stored credentials.
+ *
+ * Resolution order:
+ * 1. CODACY_API_TOKEN environment variable
+ * 2. Encrypted credentials saved via `codacy-analysis login`
+ * 3. Throws with instructions if neither source has a token.
+ */
+declare function resolveApiToken(): Promise<string>;
+
 /**
  * Repository discovery — scans a codebase and identifies languages, file patterns,
  * notable files, frameworks, and libraries.
@@ -699,4 +761,21 @@ interface DiscoverOptions {
  */
 declare function discover(repositoryRoot: string, options?: DiscoverOptions): Promise<DiscoveryResult>;
 
-export { type AdapterFactory, type AnalyzeOptions, type AutoFilters, type CategoryFilter, type CodacyYamlConfig, type CodacyYamlEngineConfig, type ConfigOperation, type DiscoverOptions, type ExecutionMode, type IgnoredFilesResult, type InitAutoStats, type InitDefaultStats, type InitLocalStats, type InitRemoteStats, type LoggerOptions, type PatternMetadataLookup, type SeverityFilter, analyze, applyCodacyYamlExcludes, applyConfigOperation, buildToolConfig, clearAdapters, computePatternSummary, configureApiToken, createCodacyConfig, createLogger, detectLanguages, diffConfigs, discover, formatOutput, formatTextSummary, getAdapter, getRegisteredAdapters, getRegisteredDescriptors, initAutoConfig, initContainerConfig, initDefaultConfig, initLocalConfig, initRemoteConfig, intersectConfigs, listDiffFiles, listIgnoredFiles, listPrFiles, listStagedFiles, mergeConfigs, parseAutoFilters, readCodacyConfig, readCodacyYaml, registerAdapter, registerLazyAdapter, registerUnsupportedTool, resolveConfigPath, resolveEngineToAdapter, rotateLogFiles, validateApiToken, writeCodacyConfig, writeCodacyConfigFile };
+/**
+ * Discovery catalog — static knowledge base for the discover command.
+ *
+ * Contains manifest file parsers, a curated dependency classification catalog,
+ * and notable file detection rules. All parsers are pure functions that accept
+ * raw file content and return dependency name arrays. They never throw.
+ */
+
+/**
+ * Every display name discovery can emit from a dependency/file/package.json signal.
+ * This is the authoritative set a framework-mapping key must belong to (together
+ * with detected language names) for its patterns to ever gate on. The drift-guard
+ * test uses it to catch mapping keys that no signal can produce (e.g. a rename
+ * like react-intl → formatjs that updates the mapping but not the catalog).
+ */
+declare function getKnownDisplayNames(): Set<string>;
+
+export { type AdapterFactory, type AnalyzeOptions, type AutoFilters, type CategoryFilter, type CodacyYamlConfig, type CodacyYamlEngineConfig, type ConfigOperation, type DiscoverOptions, type ExecutionMode, type IgnoredFilesResult, type InitAutoStats, type InitDefaultStats, type InitLocalStats, type InitRemoteStats, type LoggerOptions, type PatternMetadataLookup, type SeverityFilter, analyze, applyCodacyYamlExcludes, applyConfigOperation, buildToolConfig, clearAdapters, computePatternSummary, configureApiToken, createCodacyConfig, createLogger, createNullLogger, deleteCredentials, detectLanguages, diffConfigs, discover, formatOutput, formatTextSummary, getAdapter, getKnownDisplayNames, getRegisteredAdapters, getRegisteredDescriptors, initAutoConfig, initContainerConfig, initDefaultConfig, initLocalConfig, initRemoteConfig, intersectConfigs, listDiffFiles, listIgnoredFiles, listPrFiles, listStagedFiles, loadCredentials, mergeConfigs, parseAutoFilters, readCodacyConfig, readCodacyYaml, registerAdapter, registerLazyAdapter, registerUnsupportedTool, resolveApiToken, resolveConfigPath, resolveEngineToAdapter, rotateLogFiles, saveCredentials, validateApiToken, writeCodacyConfig, writeCodacyConfigFile };

package/dist/index.js

@@ -39,12 +39,15 @@ __export(index_exports, {
   configureApiToken: () => configureApiToken,
   createCodacyConfig: () => createCodacyConfig,
   createLogger: () => createLogger,
+  createNullLogger: () => createNullLogger,
+  deleteCredentials: () => deleteCredentials,
   detectLanguages: () => detectLanguages,
   diffConfigs: () => diffConfigs,
   discover: () => discover,
   formatOutput: () => formatOutput,
   formatTextSummary: () => formatTextSummary,
   getAdapter: () => getAdapter,
+  getKnownDisplayNames: () => getKnownDisplayNames,
   getRegisteredAdapters: () => getRegisteredAdapters,
   getRegisteredDescriptors: () => getRegisteredDescriptors,
   initAutoConfig: () => initAutoConfig,
@@ -57,6 +60,7 @@ __export(index_exports, {
   listIgnoredFiles: () => listIgnoredFiles,
   listPrFiles: () => listPrFiles,
   listStagedFiles: () => listStagedFiles,
+  loadCredentials: () => loadCredentials,
   mergeConfigs: () => mergeConfigs,
   parseAutoFilters: () => parseAutoFilters,
   readCodacyConfig: () => readCodacyConfig,
@@ -64,9 +68,11 @@ __export(index_exports, {
   registerAdapter: () => registerAdapter,
   registerLazyAdapter: () => registerLazyAdapter,
   registerUnsupportedTool: () => registerUnsupportedTool,
+  resolveApiToken: () => resolveApiToken,
   resolveConfigPath: () => resolveConfigPath,
   resolveEngineToAdapter: () => resolveEngineToAdapter,
   rotateLogFiles: () => rotateLogFiles,
+  saveCredentials: () => saveCredentials,
   validateApiToken: () => validateApiToken,
   writeCodacyConfig: () => writeCodacyConfig,
   writeCodacyConfigFile: () => writeCodacyConfigFile
@@ -74,8 +80,8 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/analyze.ts
-var import_os = __toESM(require("os"));
-var import_path3 = __toESM(require("path"));
+var import_os2 = __toESM(require("os"));
+var import_path4 = __toESM(require("path"));
 var import_child_process3 = require("child_process");
 var import_util = require("util");
 var import_tooling3 = require("@codacy/tooling");
@@ -418,6 +424,61 @@ function detectDefaultBranch(repositoryRoot) {
 
 // src/files.ts
 var MAX_FILE_SIZE_BYTES = 150 * 1024;
+var DEPENDENCY_MANIFEST_FILES = /* @__PURE__ */ new Set([
+  // JavaScript / TypeScript
+  "package.json",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "bun.lock",
+  // Python
+  "requirements.txt",
+  "Pipfile",
+  "Pipfile.lock",
+  "poetry.lock",
+  "uv.lock",
+  // PHP
+  "composer.json",
+  "composer.lock",
+  // Ruby
+  "Gemfile.lock",
+  // Rust
+  "Cargo.toml",
+  "Cargo.lock",
+  // Go
+  "go.mod",
+  "go.sum",
+  // .NET
+  "packages.config",
+  "packages.lock.json",
+  "Directory.Packages.props",
+  "Packages.props",
+  // Java / Scala
+  "pom.xml",
+  "gradle.lockfile",
+  "build.gradle",
+  "build.gradle.kts",
+  "build.sbt.lock",
+  // Dart / Flutter
+  "pubspec.yaml",
+  "pubspec.lock",
+  // Elixir
+  "mix.lock",
+  // Swift / CocoaPods
+  "Package.resolved",
+  "Podfile.lock",
+  // C / C++ (Conan)
+  "conan.lock",
+  // Erlang
+  "rebar.lock"
+]);
+var DEPENDENCY_MANIFEST_SUFFIXES = [".deps.json"];
+function isDependencyManifest(relativePath) {
+  const base = relativePath.split("/").pop() ?? "";
+  if (DEPENDENCY_MANIFEST_FILES.has(base)) return true;
+  return DEPENDENCY_MANIFEST_SUFFIXES.some((suffix) => base.endsWith(suffix));
+}
 function listRepoFiles(repositoryRoot) {
   try {
     const tracked = (0, import_child_process2.execSync)("git ls-files", {
@@ -449,6 +510,15 @@ function filterOversizedFiles(files, repositoryRoot, logger) {
     try {
       const stat = import_fs.default.statSync(import_path2.default.join(repositoryRoot, f));
       if (stat.size > MAX_FILE_SIZE_BYTES) {
+        if (isDependencyManifest(f)) {
+          logger?.debug("Keeping oversized dependency manifest", {
+            file: f,
+            sizeKB: Math.round(stat.size / 1024),
+            limitKB: MAX_FILE_SIZE_BYTES / 1024
+          });
+          result.push(f);
+          continue;
+        }
         skipped.push({ filePath: f, sizeBytes: stat.size });
         logger?.debug("Skipping oversized file", {
           file: f,
@@ -504,7 +574,43 @@ function filterByTargetFiles(allFiles, targetPatterns) {
 // src/executor.ts
 var import_tooling2 = require("@codacy/tooling");
 var HARD_TIMEOUT_GRACE_MS = 2e3;
-async function runTool(adapter, ctx, codacyToolConfig, timeoutMs) {
+function anySignal(a, b) {
+  if (typeof AbortSignal.any === "function") return AbortSignal.any([a, b]);
+  const composite = new AbortController();
+  if (a.aborted || b.aborted) {
+    composite.abort();
+  } else {
+    const onAbort = () => composite.abort();
+    a.addEventListener("abort", onAbort, { once: true });
+    b.addEventListener("abort", onAbort, { once: true });
+  }
+  return composite.signal;
+}
+function cancelledResult(adapter) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    metadata: { startedAt: now, completedAt: now, durationMs: 0 },
+    issues: [],
+    errors: [
+      {
+        toolId: adapter.id,
+        phase: "toolInvoke",
+        kind: "Cancelled",
+        message: `Analysis cancelled by caller; ${adapter.id} was not run`,
+        level: "error"
+      }
+    ],
+    summary: {
+      toolId: adapter.id,
+      status: "skipped",
+      issueCount: 0,
+      errorCount: 1,
+      durationMs: 0,
+      filesAnalyzed: 0
+    }
+  };
+}
+async function runTool(adapter, ctx, codacyToolConfig, timeoutMs, callerSignal) {
   const startTime = Date.now();
   ctx.logger.debug("runTool started", {
     toolId: adapter.id,
@@ -512,7 +618,7 @@ async function runTool(adapter, ctx, codacyToolConfig, timeoutMs) {
     timeoutMs
   });
   const abortController = new AbortController();
-  ctx.signal = abortController.signal;
+  ctx.signal = callerSignal ? anySignal(callerSignal, abortController.signal) : abortController.signal;
   const abortTimer = setTimeout(() => abortController.abort(), timeoutMs);
   abortTimer.unref?.();
   let hardTimer;
@@ -533,8 +639,14 @@ async function runTool(adapter, ctx, codacyToolConfig, timeoutMs) {
     return result;
   } catch (err) {
     const durationMs = Date.now() - startTime;
-    const isTimeout = err instanceof Error && err.message.includes("TIMEOUT");
-    if (isTimeout) {
+    const isCancelled = callerSignal?.aborted === true;
+    const isTimeout = !isCancelled && err instanceof Error && err.message.includes("TIMEOUT");
+    if (isCancelled) {
+      ctx.logger.error("Tool cancelled by caller", {
+        toolId: adapter.id,
+        elapsedMs: durationMs
+      });
+    } else if (isTimeout) {
       ctx.logger.error("Tool timed out", { toolId: adapter.id, timeoutMs, elapsedMs: durationMs });
     } else {
       ctx.logger.error("Tool execution failed", {
@@ -544,6 +656,8 @@ async function runTool(adapter, ctx, codacyToolConfig, timeoutMs) {
       });
     }
     const now = /* @__PURE__ */ new Date();
+    const kind = isCancelled ? "Cancelled" : isTimeout ? "Timeout" : "InvocationError";
+    const message = isCancelled ? `Tool ${adapter.id} cancelled by caller` : isTimeout ? `Tool ${adapter.id} exceeded timeout of ${(0, import_tooling2.formatDuration)(timeoutMs)}` : `Tool ${adapter.id} failed: ${err instanceof Error ? err.message : String(err)}`;
     return {
       metadata: {
         startedAt: new Date(now.getTime() - durationMs).toISOString(),
@@ -555,8 +669,8 @@ async function runTool(adapter, ctx, codacyToolConfig, timeoutMs) {
         {
           toolId: adapter.id,
           phase: "toolInvoke",
-          kind: isTimeout ? "Timeout" : "InvocationError",
-          message: isTimeout ? `Tool ${adapter.id} exceeded timeout of ${(0, import_tooling2.formatDuration)(timeoutMs)}` : `Tool ${adapter.id} failed: ${err instanceof Error ? err.message : String(err)}`,
+          kind,
+          message,
           level: "error"
         }
       ],
@@ -574,15 +688,19 @@ async function runTool(adapter, ctx, codacyToolConfig, timeoutMs) {
     if (hardTimer) clearTimeout(hardTimer);
   }
 }
-async function runToolsSequential(tools, timeoutMs, callbacks) {
+async function runToolsSequential(tools, timeoutMs, callbacks, callerSignal) {
   const results = [];
   for (const { adapter, ctx, codacyToolConfig } of tools) {
+    if (callerSignal?.aborted) {
+      results.push(cancelledResult(adapter));
+      continue;
+    }
     if (callbacks?.onToolProgress) {
       const cb = callbacks.onToolProgress;
       ctx.onProgress = (message) => cb(adapter.id, adapter.displayName, message);
     }
     callbacks?.onToolStart?.(adapter.id, adapter.displayName);
-    const result = await runTool(adapter, ctx, codacyToolConfig, timeoutMs);
+    const result = await runTool(adapter, ctx, codacyToolConfig, timeoutMs, callerSignal);
     callbacks?.onToolComplete?.(
       adapter.id,
       adapter.displayName,
@@ -593,19 +711,23 @@ async function runToolsSequential(tools, timeoutMs, callbacks) {
   }
   return results;
 }
-async function runToolsParallel(tools, timeoutMs, concurrency, callbacks) {
+async function runToolsParallel(tools, timeoutMs, concurrency, callbacks, callerSignal) {
   const results = new Array(tools.length);
   let nextIndex = 0;
   async function worker() {
     while (nextIndex < tools.length) {
       const index = nextIndex++;
       const { adapter, ctx, codacyToolConfig } = tools[index];
+      if (callerSignal?.aborted) {
+        results[index] = cancelledResult(adapter);
+        continue;
+      }
       if (callbacks?.onToolProgress) {
         const cb = callbacks.onToolProgress;
         ctx.onProgress = (message) => cb(adapter.id, adapter.displayName, message);
       }
       callbacks?.onToolStart?.(adapter.id, adapter.displayName);
-      results[index] = await runTool(adapter, ctx, codacyToolConfig, timeoutMs);
+      results[index] = await runTool(adapter, ctx, codacyToolConfig, timeoutMs, callerSignal);
       callbacks?.onToolComplete?.(
         adapter.id,
         adapter.displayName,
@@ -619,6 +741,124 @@ async function runToolsParallel(tools, timeoutMs, concurrency, callbacks) {
   return results;
 }
 
+// src/logger.ts
+var import_fs2 = __toESM(require("fs"));
+var import_path3 = __toESM(require("path"));
+var import_os = __toESM(require("os"));
+var LEVEL_ORDER = {
+  debug: 0,
+  info: 1,
+  warning: 2,
+  error: 3
+};
+function createNullLogger() {
+  return {
+    debug: () => {
+    },
+    info: () => {
+    },
+    warn: () => {
+    },
+    error: () => {
+    }
+  };
+}
+function rotateLogFiles(logsDir, maxFiles) {
+  let entries2;
+  try {
+    entries2 = import_fs2.default.readdirSync(logsDir).filter((f) => f.startsWith("analysis-") && f.endsWith(".log"));
+  } catch {
+    return;
+  }
+  if (entries2.length <= maxFiles) return;
+  entries2.sort();
+  const toRemove = entries2.slice(0, entries2.length - maxFiles);
+  for (const f of toRemove) {
+    try {
+      import_fs2.default.unlinkSync(import_path3.default.join(logsDir, f));
+    } catch {
+    }
+  }
+}
+var fileSeq = 0;
+function fileTimestamp() {
+  return `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${fileSeq++}`;
+}
+function enrichMessage(message, fields) {
+  if (!fields) return message;
+  const parts = [];
+  if (fields.toolId) parts.push(String(fields.toolId));
+  if (fields.version) parts.push(`v${fields.version}`);
+  if (fields.installation) parts.push(String(fields.installation));
+  if (fields.configSource) parts.push(String(fields.configSource));
+  if (typeof fields.fileCount === "number") parts.push(`${fields.fileCount} files`);
+  if (typeof fields.issueCount === "number") parts.push(`${fields.issueCount} issues`);
+  if (typeof fields.errorCount === "number" && fields.errorCount > 0)
+    parts.push(`${fields.errorCount} errors`);
+  if (typeof fields.totalIssues === "number") parts.push(`${fields.totalIssues} issues`);
+  if (typeof fields.totalErrors === "number" && fields.totalErrors > 0)
+    parts.push(`${fields.totalErrors} errors`);
+  if (typeof fields.durationMs === "number")
+    parts.push(`${(fields.durationMs / 1e3).toFixed(1)}s`);
+  if (fields.reason) parts.push(String(fields.reason));
+  if (fields.error) parts.push(String(fields.error));
+  if (typeof fields.found === "boolean") parts.push(fields.found ? "found" : "not found");
+  if (fields.path && !fields.version) parts.push(String(fields.path));
+  if (parts.length === 0) return message;
+  return `${message} (${parts.join(", ")})`;
+}
+function createLogger(options = {}) {
+  const minLevel = LEVEL_ORDER[options.level ?? "info"];
+  const fileEnabled = options.fileEnabled ?? true;
+  const logsDir = options.logsDir ?? import_path3.default.join(import_os.default.homedir(), ".codacy", "logs");
+  const maxFileSize = options.maxFileSize ?? 10 * 1024 * 1024;
+  const maxFiles = options.maxFiles ?? 5;
+  const onStderrMessage = options.onStderrMessage;
+  let logFd = null;
+  let bytesWritten = 0;
+  if (fileEnabled) {
+    import_fs2.default.mkdirSync(logsDir, { recursive: true });
+    rotateLogFiles(logsDir, maxFiles);
+    const logFilePath = import_path3.default.join(logsDir, `analysis-${fileTimestamp()}.log`);
+    logFd = import_fs2.default.openSync(logFilePath, "a");
+  }
+  function log(level, message, fields) {
+    const numLevel = LEVEL_ORDER[level];
+    if (numLevel < minLevel) return;
+    if (fileEnabled && logFd !== null) {
+      const entry = JSON.stringify({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level,
+        message,
+        ...fields
+      });
+      const buf = Buffer.from(entry + "\n", "utf-8");
+      import_fs2.default.writeSync(logFd, buf);
+      bytesWritten += buf.length;
+      if (bytesWritten >= maxFileSize) {
+        import_fs2.default.closeSync(logFd);
+        rotateLogFiles(logsDir, maxFiles);
+        const newPath = import_path3.default.join(logsDir, `analysis-${fileTimestamp()}.log`);
+        logFd = import_fs2.default.openSync(newPath, "a");
+        bytesWritten = 0;
+      }
+    }
+    const enriched = enrichMessage(message, fields);
+    if (onStderrMessage) {
+      onStderrMessage(enriched, level);
+    } else {
+      process.stderr.write(`  ${enriched}
+`);
+    }
+  }
+  return {
+    debug: (msg, fields) => log("debug", msg, fields),
+    info: (msg, fields) => log("info", msg, fields),
+    warn: (msg, fields) => log("warning", msg, fields),
+    error: (msg, fields) => log("error", msg, fields)
+  };
+}
+
 // src/summary.ts
 var NOISY_THRESHOLD = 500;
 var SEVERITY_ORDER = ["Error", "High", "Warning", "Info"];
@@ -731,16 +971,6 @@ function computePatternSummary(issues, lookup) {
 
 // src/analyze.ts
 var execFileAsync = (0, import_util.promisify)(import_child_process3.execFile);
-var nullLogger = {
-  debug: () => {
-  },
-  info: () => {
-  },
-  warn: () => {
-  },
-  error: () => {
-  }
-};
 var CHECK_CONCURRENCY = 12;
 async function mapWithConcurrency(items, concurrency, task) {
   const results = new Array(items.length);
@@ -760,7 +990,7 @@ async function analyze(options) {
   const mode = options.mode || "standard";
   const toolTimeout = options.toolTimeout || 9e5;
   const parallelTools = options.parallelTools || 1;
-  const logger = options.logger ?? nullLogger;
+  const logger = options.logger ?? createNullLogger();
   const phaseTimings = {
     availabilityMs: 0,
     fileDiscoveryMs: 0,
@@ -773,6 +1003,26 @@ async function analyze(options) {
     unavailable: [],
     checkedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
+  if (options.signal?.aborted) {
+    logger.info("Analysis cancelled by caller before it started");
+    return buildResult(
+      startedAt,
+      options.repositoryRoot,
+      mode,
+      emptyCapability,
+      [],
+      [
+        {
+          toolId: "",
+          phase: "toolInvoke",
+          kind: "Cancelled",
+          message: "Analysis cancelled by caller before it started",
+          level: "error"
+        }
+      ],
+      []
+    );
+  }
   try {
     await execFileAsync("git", ["rev-parse", "--is-inside-work-tree"], {
       cwd: options.repositoryRoot
@@ -836,11 +1086,11 @@ async function analyze(options) {
   const requestedTools = options.tools ?? codacyConfig.tools.map((t) => t.toolId);
   const adapters = await getRegisteredAdapters(requestedTools);
   logger.info("Pipeline started", { mode, toolCount: adapters.length, parallelTools, toolTimeout });
-  const globalDir = import_path3.default.join(import_os.default.homedir(), ".codacy");
+  const globalDir = import_path4.default.join(import_os2.default.homedir(), ".codacy");
   const baseCtx = {
     repositoryRoot: options.repositoryRoot,
     globalDir,
-    platform: { os: import_os.default.platform(), arch: import_os.default.arch() },
+    platform: { os: import_os2.default.platform(), arch: import_os2.default.arch() },
     logger,
     runner: "local"
   };
@@ -1202,9 +1452,15 @@ async function analyze(options) {
   };
   let results;
   if (parallelTools > 1 && toolRuns.length > 1) {
-    results = await runToolsParallel(toolRuns, toolTimeout, parallelTools, callbacks);
+    results = await runToolsParallel(
+      toolRuns,
+      toolTimeout,
+      parallelTools,
+      callbacks,
+      options.signal
+    );
   } else {
-    results = await runToolsSequential(toolRuns, toolTimeout, callbacks);
+    results = await runToolsSequential(toolRuns, toolTimeout, callbacks, options.signal);
   }
   phaseTimings.toolExecutionMs = Date.now() - toolExecStartMs;
   const allIssues = normalizeIssues(results.flatMap((r) => r.issues));
@@ -1245,8 +1501,8 @@ function makeToolContext(base, adapter, targetFiles) {
   return {
     ...base,
     targetFiles,
-    toolInstallDir: import_path3.default.join(base.globalDir, "tools", adapter.id),
-    generatedConfigDir: import_path3.default.join(base.repositoryRoot, ".codacy", "generated", adapter.id)
+    toolInstallDir: import_path4.default.join(base.globalDir, "tools", adapter.id),
+    generatedConfigDir: import_path4.default.join(base.repositoryRoot, ".codacy", "generated", adapter.id)
   };
 }
 function normalizeIssues(issues) {
@@ -1285,7 +1541,7 @@ function buildResult(startedAt, repositoryRoot, mode, capability, issues, errors
 }
 
 // src/format.ts
-var import_path4 = __toESM(require("path"));
+var import_path5 = __toESM(require("path"));
 var import_tooling4 = require("@codacy/tooling");
 var import_ansis = __toESM(require("ansis"));
 var import_cli_table3 = __toESM(require("cli-table3"));
@@ -1711,7 +1967,7 @@ function formatFilesCell(filesRouted) {
 }
 function formatConfigCell(tool, repositoryRoot) {
   if (tool.configSource === "local" && tool.configPath) {
-    const rawPath = import_path4.default.isAbsolute(tool.configPath) ? import_path4.default.relative(repositoryRoot, tool.configPath) : tool.configPath;
+    const rawPath = import_path5.default.isAbsolute(tool.configPath) ? import_path5.default.relative(repositoryRoot, tool.configPath) : tool.configPath;
     return rawPath.startsWith("./") ? rawPath : `./${rawPath}`;
   }
   if (tool.configSource === "codacy") return "Codacy";
@@ -1973,13 +2229,13 @@ function applyConfigOperation(op, source, dest) {
 
 // src/init.ts
 var import_promises4 = __toESM(require("fs/promises"));
-var import_path7 = __toESM(require("path"));
+var import_path8 = __toESM(require("path"));
 var import_child_process4 = require("child_process");
 var import_tooling5 = require("@codacy/tooling");
 
 // src/discover.ts
 var import_promises2 = __toESM(require("fs/promises"));
-var import_path5 = __toESM(require("path"));
+var import_path6 = __toESM(require("path"));
 
 // src/discover-catalog.ts
 var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
@@ -2009,6 +2265,10 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["@hapi/hapi", { displayName: "Hapi", kind: "framework" }],
   ["hono", { displayName: "Hono", kind: "framework" }],
   ["electron", { displayName: "Electron", kind: "framework" }],
+  // AWS CDK — the v2 umbrella package `aws-cdk-lib`, the CLI package `aws-cdk`,
+  // and the v1 `@aws-cdk/*` construct packages (prefix rule below).
+  ["aws-cdk-lib", { displayName: "AWS CDK", kind: "framework" }],
+  ["aws-cdk", { displayName: "AWS CDK", kind: "framework" }],
   // --- JavaScript / TypeScript — Libraries ---
   ["lodash", { displayName: "Lodash", kind: "library" }],
   ["underscore", { displayName: "Underscore.js", kind: "library" }],
@@ -2061,9 +2321,20 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["pino", { displayName: "Pino", kind: "library" }],
   ["winston", { displayName: "Winston", kind: "library" }],
   ["i18next", { displayName: "i18next", kind: "library" }],
-  ["react-intl", { displayName: "react-intl", kind: "library" }],
+  // react-intl is the React binding of the FormatJS ecosystem; eslint-plugin-formatjs
+  // lints both, so we report the umbrella name "formatjs" (matches the mapping key).
+  ["react-intl", { displayName: "formatjs", kind: "library" }],
   ["vue-i18n", { displayName: "vue-i18n", kind: "library" }],
   ["next-intl", { displayName: "next-intl", kind: "library" }],
+  // Type checker (eslint-plugin-flowtype). Also detected via a `.flowconfig` file.
+  ["flow-bin", { displayName: "Flow", kind: "library" }],
+  // Legacy JS libraries with dedicated ESLint plugins.
+  ["backbone", { displayName: "Backbone.js", kind: "library" }],
+  ["chai", { displayName: "Chai", kind: "library" }],
+  ["codeceptjs", { displayName: "CodeceptJS", kind: "library" }],
+  ["webdriverio", { displayName: "WebdriverIO", kind: "library" }],
+  ["react-relay", { displayName: "Relay", kind: "library" }],
+  ["relay-runtime", { displayName: "Relay", kind: "library" }],
   // --- JavaScript / TypeScript — Tools ---
   ["typescript", { displayName: "TypeScript", kind: "tool" }],
   ["eslint", { displayName: "ESLint", kind: "tool" }],
@@ -2275,7 +2546,9 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["cats-core", { displayName: "Cats", kind: "library" }],
   ["circe-core", { displayName: "Circe", kind: "library" }],
   // --- Dart — Frameworks ---
-  // `flutter` and `angular` appear as plain keys in pubspec.yaml.
+  // `flutter` and `angular` appear as plain keys in pubspec.yaml. NOTE: `angular`
+  // here is Dart's AngularDart. The npm package `angular` is AngularJS (1.x) — a
+  // different framework — so package.json overrides this via MANIFEST_SCOPED_CATALOG.
   ["flutter", { displayName: "Flutter", kind: "framework" }],
   ["flutter_test", { displayName: "Flutter", kind: "framework" }],
   ["angular", { displayName: "Angular", kind: "framework" }],
@@ -2312,10 +2585,13 @@ var DEPENDENCY_PREFIX_RULES = [
     classification: { displayName: "Testing Library", kind: "library" }
   },
   { prefix: "@tanstack/", classification: { displayName: "TanStack", kind: "library" } },
+  { prefix: "@wdio/", classification: { displayName: "WebdriverIO", kind: "library" } },
+  // AWS CDK v1 construct libraries are published under the @aws-cdk/ scope.
+  { prefix: "@aws-cdk/", classification: { displayName: "AWS CDK", kind: "framework" } },
   { prefix: "@reduxjs/", classification: { displayName: "Redux", kind: "library" } },
   { prefix: "@prisma/", classification: { displayName: "Prisma", kind: "library" } },
   { prefix: "@apollo/", classification: { displayName: "Apollo", kind: "library" } },
-  { prefix: "@formatjs/", classification: { displayName: "react-intl", kind: "library" } },
+  { prefix: "@formatjs/", classification: { displayName: "formatjs", kind: "library" } },
   { prefix: "@lingui/", classification: { displayName: "Lingui", kind: "library" } },
   { prefix: "@emotion/", classification: { displayName: "Emotion", kind: "library" } },
   { prefix: "@mui/", classification: { displayName: "Material UI", kind: "library" } },
@@ -2358,7 +2634,14 @@ var DEPENDENCY_PREFIX_RULES = [
   { prefix: "MSTest.", classification: { displayName: "MSTest", kind: "library" } },
   { prefix: "Serilog", classification: { displayName: "Serilog", kind: "library" } }
 ];
-function classifyDependency(name) {
+var MANIFEST_SCOPED_CATALOG = /* @__PURE__ */ new Map([
+  ["package.json", /* @__PURE__ */ new Map([["angular", { displayName: "AngularJS", kind: "framework" }]])]
+]);
+function classifyDependency(name, manifestBasename) {
+  if (manifestBasename) {
+    const scoped = MANIFEST_SCOPED_CATALOG.get(manifestBasename)?.get(name);
+    if (scoped) return scoped;
+  }
   const exact = DEPENDENCY_CATALOG.get(name);
   if (exact) return exact;
   for (const rule of DEPENDENCY_PREFIX_RULES) {
@@ -2366,6 +2649,91 @@ function classifyDependency(name) {
   }
   return void 0;
 }
+function pathBasename(filePath) {
+  return filePath.split("/").pop() ?? filePath;
+}
+var FILE_SIGNAL_RULES = [
+  {
+    name: ".flowconfig",
+    matches: (f) => pathBasename(f) === ".flowconfig",
+    classification: { displayName: "Flow", kind: "library" }
+  },
+  {
+    name: "cdk.json",
+    matches: (f) => pathBasename(f) === "cdk.json",
+    classification: { displayName: "AWS CDK", kind: "framework" }
+  },
+  {
+    name: ".meteor/release",
+    matches: (f) => f === ".meteor/release" || f.endsWith("/.meteor/release"),
+    classification: { displayName: "Meteor", kind: "framework" }
+  },
+  {
+    name: "sfdx-project.json",
+    matches: (f) => pathBasename(f) === "sfdx-project.json",
+    classification: { displayName: "Salesforce", kind: "platform" }
+  },
+  {
+    name: "lwc.config.json",
+    matches: (f) => pathBasename(f) === "lwc.config.json",
+    classification: { displayName: "Lightning Web Components", kind: "platform" }
+  },
+  {
+    name: "suitecloud.config.js",
+    matches: (f) => pathBasename(f) === "suitecloud.config.js",
+    classification: { displayName: "SuiteScript", kind: "platform" }
+  }
+];
+function detectFileSignals(files) {
+  const result = [];
+  for (const rule of FILE_SIGNAL_RULES) {
+    const hit = files.find((f) => rule.matches(f));
+    if (!hit) continue;
+    result.push({
+      name: rule.name,
+      displayName: rule.classification.displayName,
+      kind: rule.classification.kind,
+      source: "file",
+      manifestFile: hit
+    });
+  }
+  return result;
+}
+var PACKAGE_JSON_SIGNAL_DISPLAY_NAMES = ["ESLint Plugin"];
+function isEslintPluginName(name) {
+  return /^eslint-plugin-/.test(name) || /^@[^/]+\/eslint-plugin(-.*)?$/.test(name);
+}
+function detectPackageJsonSignals(content) {
+  let pkg;
+  try {
+    pkg = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  const name = pkg && typeof pkg.name === "string" ? pkg.name : "";
+  if (name && isEslintPluginName(name)) {
+    return [
+      {
+        name,
+        displayName: "ESLint Plugin",
+        kind: "tool",
+        source: "manifest",
+        manifestFile: "package.json"
+      }
+    ];
+  }
+  return [];
+}
+function getKnownDisplayNames() {
+  const names = /* @__PURE__ */ new Set();
+  for (const { displayName } of DEPENDENCY_CATALOG.values()) names.add(displayName);
+  for (const scoped of MANIFEST_SCOPED_CATALOG.values())
+    for (const { displayName } of scoped.values()) names.add(displayName);
+  for (const rule of DEPENDENCY_PREFIX_RULES) names.add(rule.classification.displayName);
+  for (const rule of FILE_SIGNAL_RULES) names.add(rule.classification.displayName);
+  for (const name of PACKAGE_JSON_SIGNAL_DISPLAY_NAMES) names.add(name);
+  return names;
+}
 var NOTABLE_ANY_DEPTH = /* @__PURE__ */ new Set([
   "Dockerfile",
   "docker-compose.yml",
@@ -2735,7 +3103,8 @@ async function discover(repositoryRoot, options) {
   let frameworks = [];
   let libraries = [];
   if (!options?.skipDependencies) {
-    const allDeps = await extractDependencies(repositoryRoot, files);
+    const manifestDeps = await extractDependencies(repositoryRoot, files);
+    const allDeps = [...manifestDeps, ...detectFileSignals(files)];
     frameworks = deduplicateDeps(allDeps.filter((d) => d.kind === "framework"));
     libraries = deduplicateDeps(
       allDeps.filter((d) => d.kind === "library" || d.kind === "platform" || d.kind === "tool")
@@ -2748,7 +3117,7 @@ async function discover(repositoryRoot, options) {
     frameworks,
     libraries,
     metadata: {
-      repositoryRoot: import_path5.default.resolve(repositoryRoot),
+      repositoryRoot: import_path6.default.resolve(repositoryRoot),
       totalFiles: files.length,
       scannedAt: (/* @__PURE__ */ new Date()).toISOString()
     }
@@ -2757,7 +3126,7 @@ async function discover(repositoryRoot, options) {
 function extractFilePatterns(files) {
   const extensions = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const ext = import_path5.default.extname(file).toLowerCase();
+    const ext = import_path6.default.extname(file).toLowerCase();
     if (ext) {
       extensions.add(`*${ext}`);
     }
@@ -2790,13 +3159,14 @@ async function extractDependencies(repositoryRoot, files) {
     if (!parser) continue;
     let content;
     try {
-      content = await import_promises2.default.readFile(import_path5.default.join(repositoryRoot, filePath), "utf-8");
+      content = await import_promises2.default.readFile(import_path6.default.join(repositoryRoot, filePath), "utf-8");
     } catch {
       continue;
     }
+    const basename = filePath.split("/").pop() ?? filePath;
     const rawDeps = parser(content);
     for (const raw of rawDeps) {
-      const classification = classifyDependency(raw.name);
+      const classification = classifyDependency(raw.name, basename);
       if (classification) {
         allDeps.push({
           name: raw.name,
@@ -2808,6 +3178,11 @@ async function extractDependencies(repositoryRoot, files) {
         });
       }
     }
+    if (basename === "package.json") {
+      for (const signal of detectPackageJsonSignals(content)) {
+        allDeps.push({ ...signal, manifestFile: filePath });
+      }
+    }
   }
   return allDeps;
 }
@@ -2825,14 +3200,14 @@ function deduplicateDeps(deps) {
 
 // src/codacy-yaml.ts
 var import_promises3 = __toESM(require("fs/promises"));
-var import_path6 = __toESM(require("path"));
+var import_path7 = __toESM(require("path"));
 var import_yaml = require("yaml");
 async function readCodacyYaml(repositoryRoot) {
   const candidates = [".codacy.yaml", ".codacy.yml"];
   let raw = null;
   for (const filename of candidates) {
     try {
-      raw = await import_promises3.default.readFile(import_path6.default.join(repositoryRoot, filename), "utf-8");
+      raw = await import_promises3.default.readFile(import_path7.default.join(repositoryRoot, filename), "utf-8");
       break;
     } catch {
     }
@@ -3090,13 +3465,13 @@ var getQueryString = (params) => {
 };
 var getUrl = (config, options) => {
   const encoder = config.ENCODE_PATH || encodeURI;
-  const path9 = options.url.replace("{api-version}", config.VERSION).replace(/{(.*?)}/g, (substring, group) => {
+  const path10 = options.url.replace("{api-version}", config.VERSION).replace(/{(.*?)}/g, (substring, group) => {
     if (options.path?.hasOwnProperty(group)) {
       return encoder(String(options.path[group]));
     }
     return substring;
   });
-  const url = `${config.BASE}${path9}`;
+  const url = `${config.BASE}${path10}`;
   if (options.query) {
     return `${url}${getQueryString(options.query)}`;
   }
@@ -6490,8 +6865,8 @@ async function detectLanguages(repositoryRoot, precomputedFiles) {
   }
   const detected = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const basename = import_path7.default.basename(file);
-    const ext = import_path7.default.extname(file).toLowerCase();
+    const basename = import_path8.default.basename(file);
+    const ext = import_path8.default.extname(file).toLowerCase();
     for (const [lang, config] of Object.entries(import_tooling5.LANGUAGE_CONFIG)) {
       if (config.extensions.includes(ext)) {
         detected.add(lang);
@@ -6508,12 +6883,12 @@ async function detectLocalConfigFiles(repositoryRoot, adapters) {
     adapters.map(async (adapter) => {
       const result = await adapter.checkLocalConfigurationFile({
         repositoryRoot,
-        generatedConfigDir: import_path7.default.join(repositoryRoot, ".codacy", "generated"),
-        globalDir: import_path7.default.join(process.env.HOME ?? "~", ".codacy"),
-        toolInstallDir: import_path7.default.join(process.env.HOME ?? "~", ".codacy", "tools", adapter.id),
+        generatedConfigDir: import_path8.default.join(repositoryRoot, ".codacy", "generated"),
+        globalDir: import_path8.default.join(process.env.HOME ?? "~", ".codacy"),
+        toolInstallDir: import_path8.default.join(process.env.HOME ?? "~", ".codacy", "tools", adapter.id),
         targetFiles: [],
         platform: { os: process.platform, arch: process.arch },
-        logger: silentLogger,
+        logger: createNullLogger(),
         runner: "local"
       });
       return { toolId: adapter.id, result };
@@ -6526,16 +6901,6 @@ async function detectLocalConfigFiles(repositoryRoot, adapters) {
   }
   return found;
 }
-var silentLogger = {
-  debug: () => {
-  },
-  info: () => {
-  },
-  warn: () => {
-  },
-  error: () => {
-  }
-};
 async function enrichWithCodacyYaml(config, repositoryRoot, adapters) {
   const yamlConfig = await readCodacyYaml(repositoryRoot);
   if (!yamlConfig) return { config, codacyYamlApplied: false };
@@ -6714,7 +7079,7 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
   };
 }
 async function initContainerConfig(repositoryRoot, adapters) {
-  const codacyrcPath = import_path7.default.join(repositoryRoot, ".codacyrc");
+  const codacyrcPath = import_path8.default.join(repositoryRoot, ".codacyrc");
   let raw;
   try {
     raw = await import_promises4.default.readFile(codacyrcPath, "utf-8");
@@ -7045,110 +7410,68 @@ function parseAutoFilters(raw) {
   return { filters: { severities, categories }, unknown };
 }
 
-// src/logger.ts
-var import_fs2 = __toESM(require("fs"));
-var import_path8 = __toESM(require("path"));
-var import_os2 = __toESM(require("os"));
-var LEVEL_ORDER = {
-  debug: 0,
-  info: 1,
-  warning: 2,
-  error: 3
-};
-function rotateLogFiles(logsDir, maxFiles) {
-  let entries2;
+// src/credentials.ts
+var import_crypto = __toESM(require("crypto"));
+var import_promises5 = __toESM(require("fs/promises"));
+var import_os3 = __toESM(require("os"));
+var import_path9 = __toESM(require("path"));
+function credentialsPath() {
+  return import_path9.default.join(import_os3.default.homedir(), ".codacy", "credentials");
+}
+function deriveKey(salt) {
+  const info = import_os3.default.userInfo();
+  const machineKey = [import_os3.default.hostname(), info.username, import_os3.default.homedir(), import_os3.default.platform()].join("|");
+  return import_crypto.default.pbkdf2Sync(machineKey, salt, 1e5, 32, "sha512");
+}
+async function saveCredentials(token) {
+  const credentialsFile = credentialsPath();
+  const salt = import_crypto.default.randomBytes(32);
+  const iv = import_crypto.default.randomBytes(16);
+  const key = deriveKey(salt);
+  const cipher = import_crypto.default.createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(token, "utf-8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  const payload = JSON.stringify({
+    salt: salt.toString("hex"),
+    iv: iv.toString("hex"),
+    authTag: authTag.toString("hex"),
+    encrypted: encrypted.toString("hex")
+  });
+  await import_promises5.default.mkdir(import_path9.default.dirname(credentialsFile), { recursive: true });
+  await import_promises5.default.writeFile(credentialsFile, payload, { encoding: "utf-8", mode: 384 });
+}
+async function loadCredentials() {
   try {
-    entries2 = import_fs2.default.readdirSync(logsDir).filter((f) => f.startsWith("analysis-") && f.endsWith(".log"));
+    const raw = await import_promises5.default.readFile(credentialsPath(), "utf-8");
+    const data = JSON.parse(raw);
+    if (!data || typeof data !== "object" || Array.isArray(data)) return null;
+    const salt = Buffer.from(data.salt, "hex");
+    const iv = Buffer.from(data.iv, "hex");
+    const authTag = Buffer.from(data.authTag, "hex");
+    const encrypted = Buffer.from(data.encrypted, "hex");
+    const key = deriveKey(salt);
+    const decipher = import_crypto.default.createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    return decrypted.toString("utf-8");
   } catch {
-    return;
-  }
-  if (entries2.length <= maxFiles) return;
-  entries2.sort();
-  const toRemove = entries2.slice(0, entries2.length - maxFiles);
-  for (const f of toRemove) {
-    try {
-      import_fs2.default.unlinkSync(import_path8.default.join(logsDir, f));
-    } catch {
-    }
+    return null;
   }
 }
-var fileSeq = 0;
-function fileTimestamp() {
-  return `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${fileSeq++}`;
-}
-function enrichMessage(message, fields) {
-  if (!fields) return message;
-  const parts = [];
-  if (fields.toolId) parts.push(String(fields.toolId));
-  if (fields.version) parts.push(`v${fields.version}`);
-  if (fields.installation) parts.push(String(fields.installation));
-  if (fields.configSource) parts.push(String(fields.configSource));
-  if (typeof fields.fileCount === "number") parts.push(`${fields.fileCount} files`);
-  if (typeof fields.issueCount === "number") parts.push(`${fields.issueCount} issues`);
-  if (typeof fields.errorCount === "number" && fields.errorCount > 0)
-    parts.push(`${fields.errorCount} errors`);
-  if (typeof fields.totalIssues === "number") parts.push(`${fields.totalIssues} issues`);
-  if (typeof fields.totalErrors === "number" && fields.totalErrors > 0)
-    parts.push(`${fields.totalErrors} errors`);
-  if (typeof fields.durationMs === "number")
-    parts.push(`${(fields.durationMs / 1e3).toFixed(1)}s`);
-  if (fields.reason) parts.push(String(fields.reason));
-  if (fields.error) parts.push(String(fields.error));
-  if (typeof fields.found === "boolean") parts.push(fields.found ? "found" : "not found");
-  if (fields.path && !fields.version) parts.push(String(fields.path));
-  if (parts.length === 0) return message;
-  return `${message} (${parts.join(", ")})`;
-}
-function createLogger(options = {}) {
-  const minLevel = LEVEL_ORDER[options.level ?? "info"];
-  const fileEnabled = options.fileEnabled ?? true;
-  const logsDir = options.logsDir ?? import_path8.default.join(import_os2.default.homedir(), ".codacy", "logs");
-  const maxFileSize = options.maxFileSize ?? 10 * 1024 * 1024;
-  const maxFiles = options.maxFiles ?? 5;
-  const onStderrMessage = options.onStderrMessage;
-  let logFd = null;
-  let bytesWritten = 0;
-  if (fileEnabled) {
-    import_fs2.default.mkdirSync(logsDir, { recursive: true });
-    rotateLogFiles(logsDir, maxFiles);
-    const logFilePath = import_path8.default.join(logsDir, `analysis-${fileTimestamp()}.log`);
-    logFd = import_fs2.default.openSync(logFilePath, "a");
-  }
-  function log(level, message, fields) {
-    const numLevel = LEVEL_ORDER[level];
-    if (numLevel < minLevel) return;
-    if (fileEnabled && logFd !== null) {
-      const entry = JSON.stringify({
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        level,
-        message,
-        ...fields
-      });
-      const buf = Buffer.from(entry + "\n", "utf-8");
-      import_fs2.default.writeSync(logFd, buf);
-      bytesWritten += buf.length;
-      if (bytesWritten >= maxFileSize) {
-        import_fs2.default.closeSync(logFd);
-        rotateLogFiles(logsDir, maxFiles);
-        const newPath = import_path8.default.join(logsDir, `analysis-${fileTimestamp()}.log`);
-        logFd = import_fs2.default.openSync(newPath, "a");
-        bytesWritten = 0;
-      }
-    }
-    const enriched = enrichMessage(message, fields);
-    if (onStderrMessage) {
-      onStderrMessage(enriched, level);
-    } else {
-      process.stderr.write(`  ${enriched}
-`);
-    }
+async function deleteCredentials() {
+  try {
+    await import_promises5.default.unlink(credentialsPath());
+    return true;
+  } catch {
+    return false;
   }
-  return {
-    debug: (msg, fields) => log("debug", msg, fields),
-    info: (msg, fields) => log("info", msg, fields),
-    warn: (msg, fields) => log("warning", msg, fields),
-    error: (msg, fields) => log("error", msg, fields)
-  };
+}
+async function resolveApiToken() {
+  const envToken = process.env.CODACY_API_TOKEN;
+  if (envToken) return envToken;
+  const stored = await loadCredentials();
+  if (stored) return stored;
+  throw new Error("No API token found. Set CODACY_API_TOKEN or run 'codacy-analysis login'.");
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -7161,12 +7484,15 @@ function createLogger(options = {}) {
   configureApiToken,
   createCodacyConfig,
   createLogger,
+  createNullLogger,
+  deleteCredentials,
   detectLanguages,
   diffConfigs,
   discover,
   formatOutput,
   formatTextSummary,
   getAdapter,
+  getKnownDisplayNames,
   getRegisteredAdapters,
   getRegisteredDescriptors,
   initAutoConfig,
@@ -7179,6 +7505,7 @@ function createLogger(options = {}) {
   listIgnoredFiles,
   listPrFiles,
   listStagedFiles,
+  loadCredentials,
   mergeConfigs,
   parseAutoFilters,
   readCodacyConfig,
@@ -7186,9 +7513,11 @@ function createLogger(options = {}) {
   registerAdapter,
   registerLazyAdapter,
   registerUnsupportedTool,
+  resolveApiToken,
   resolveConfigPath,
   resolveEngineToAdapter,
   rotateLogFiles,
+  saveCredentials,
   validateApiToken,
   writeCodacyConfig,
   writeCodacyConfigFile

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/analysis-runner",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Core orchestration engine for Codacy analysis",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,11 +12,11 @@
     "cli-table3": "^0.6",
     "minimatch": "10.2.4",
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.12.0"
+    "@codacy/tooling": "0.13.0"
   },
   "devDependencies": {
     "@codacy/openapi-typescript-codegen": "0.0.9",
-    "@codacy/tools-dummy-1": "0.12.0"
+    "@codacy/tools-dummy-1": "0.13.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",