@codacy/analysis-runner 0.16.0 → 0.18.0

package/dist/index.d.ts

@@ -469,8 +469,31 @@ declare function listIgnoredFiles(provider: string, org: string, repo: string):
  * extensions/filenames against LANGUAGE_CONFIG. When `precomputedFiles` is
  * provided, uses that list directly instead of running `git ls-files`.
  * Returns languages sorted alphabetically for deterministic output.
+ *
+ * `exclude` (optional) drops files matching those globs before detection, so a
+ * language whose only files live in excluded paths is not reported. Every caller
+ * that turns the result into tool selection must pass the excludes `analyze`
+ * will apply — a language detected from a file `analyze` never reads produces a
+ * tool that analyzes zero files. Applied to `precomputedFiles` too (filtering is
+ * idempotent, so pre-filtered lists are safe to pass).
+ */
+declare function detectLanguages(repositoryRoot: string, precomputedFiles?: string[], exclude?: readonly string[]): Promise<Language[]>;
+/**
+ * Options shared by the init modes that derive configuration from the local
+ * repository (`local`, `default`, `auto`).
  */
-declare function detectLanguages(repositoryRoot: string, precomputedFiles?: string[]): Promise<Language[]>;
+interface InitDiscoveryOptions {
+    /**
+     * The config currently on disk, when re-generating via `update-config`.
+     *
+     * Its `exclude` (global and per-tool) is unioned with the freshly-read
+     * `.codacy.yaml` to constrain re-discovery, so excludes the user hand-wrote
+     * into `codacy.config.json` — or that arrived from Codacy Cloud's
+     * ignored-files list — don't get re-populated with tools that analyze zero
+     * files. Omit for a fresh `init`, where only `.codacy.yaml` applies.
+     */
+    existingConfig?: CodacyConfig;
+}
 /** Stats returned alongside the config from `initLocalConfig`. */
 interface InitLocalStats {
     /** Whether a .codacy.yaml file was found and its exclude paths were applied. */
@@ -482,7 +505,7 @@ interface InitLocalStats {
  * that have a local configuration file present in the repository.
  * If a .codacy.yaml file is present, its exclude paths are merged into the config.
  */
-declare function initLocalConfig(repositoryRoot: string, adapters: Readonly<ToolAdapter>[]): Promise<{
+declare function initLocalConfig(repositoryRoot: string, adapters: Readonly<ToolAdapter>[], options?: InitDiscoveryOptions): Promise<{
     config: CodacyConfig;
     stats: InitLocalStats;
 }>;
@@ -507,7 +530,7 @@ interface InitDefaultStats {
  *
  * Returns both the config and stats so the caller can report what happened.
  */
-declare function initDefaultConfig(repositoryRoot: string, adapters: Readonly<ToolAdapter>[]): Promise<{
+declare function initDefaultConfig(repositoryRoot: string, adapters: Readonly<ToolAdapter>[], options?: InitDiscoveryOptions): Promise<{
     config: CodacyConfig;
     stats: InitDefaultStats;
 }>;
@@ -586,7 +609,12 @@ interface InitAutoStats {
  *
  * Severity and category filters are ANDed across dimensions, ORed within.
  *
- * **Known limitation (v1):** When both TypeScript and JavaScript are detected,
+ * Tool-level overlap (two *different* tools that lint the same stack, e.g.
+ * ESLint and Biome) is resolved by `deduplicateToolFamilies` via each
+ * descriptor's `alternativeGroup` — only one member of a group is selected.
+ *
+ * **Known limitation (v1):** *Pattern*-level overlap within a single tool is
+ * not yet resolved — e.g. when both TypeScript and JavaScript are detected,
  * ESLint core rules and their `@typescript-eslint` equivalents may both be
  * enabled, potentially causing duplicate findings. This will be addressed in v2
  * via conflict-resolution metadata in the mapping files.
@@ -599,7 +627,7 @@ interface InitAutoStats {
  * those patterns are gated on detected frameworks exactly like supported tools;
  * tools without mappings have every committed pattern treated as universal.
  */
-declare function initAutoConfig(repositoryRoot: string, adapters: Readonly<ToolAdapter>[], descriptors: AdapterDescriptor[], filters?: AutoFilters, onDiscoveryComplete?: (result: DiscoveryResult) => void, rawFilterString?: string, loadUnsupportedPatterns?: (toolId: string) => readonly PatternEntry[]): Promise<{
+declare function initAutoConfig(repositoryRoot: string, adapters: Readonly<ToolAdapter>[], descriptors: AdapterDescriptor[], filters?: AutoFilters, onDiscoveryComplete?: (result: DiscoveryResult) => void, rawFilterString?: string, loadUnsupportedPatterns?: (toolId: string) => readonly PatternEntry[], options?: InitDiscoveryOptions): Promise<{
     config: CodacyConfig;
     stats: InitAutoStats;
 }>;
@@ -661,6 +689,41 @@ declare function resolveEngineToAdapter(engineName: string, adapters: Readonly<T
  * Returns a new config object (does not mutate the input).
  */
 declare function applyCodacyYamlExcludes(config: CodacyConfig, yamlConfig: CodacyYamlConfig, adapters: Readonly<ToolAdapter>[], logger?: Logger): CodacyConfig;
+/**
+ * The exclude patterns repository discovery must honor, resolved from every
+ * source that will also constrain `analyze`.
+ */
+interface DiscoveryExcludes {
+    /** Parsed `.codacy.yaml`, or null when the repository has none. Reused by `applyCodacyYamlExcludes` so the file is read once per init. */
+    yamlConfig: CodacyYamlConfig | null;
+    /** Global patterns — applied to every file-derived decision (languages, frameworks, tool selection). */
+    global: string[];
+    /** Per-adapter-ID patterns, applied on top of `global` when deciding whether that specific tool has files. */
+    perTool: Map<string, string[]>;
+}
+/**
+ * Resolves the exclude patterns that repository discovery must honor so that
+ * tool/language selection sees the same file set `analyze` will.
+ *
+ * Without this, discovery reads the raw `git ls-files` output while `analyze`
+ * reads that output minus `exclude` — so `init --auto` enables tools whose only
+ * evidence sits in excluded paths (e.g. language fixtures under
+ * `**\/test/fixtures/**`), and every one of them then receives zero files.
+ *
+ * Sources, unioned:
+ * - `.codacy.yaml` global `exclude_paths` → `global`
+ * - `.codacy.yaml` per-engine `exclude_paths` → `perTool` (engine names resolved
+ *   via {@link resolveEngineToAdapter}; unresolvable names are skipped)
+ * - `existingConfig.exclude` / `existingConfig.tools[].exclude` → both, for
+ *   `update-config`, so excludes the user hand-wrote into `codacy.config.json`
+ *   (or that arrived from Codacy Cloud's ignored-files list) also constrain
+ *   re-discovery
+ *
+ * `.codacy.yaml` is always re-read rather than trusted from the existing config,
+ * since it is the user-editable source of truth and may have changed since the
+ * config was generated.
+ */
+declare function resolveDiscoveryExcludes(repositoryRoot: string, adapters: Readonly<ToolAdapter>[], existingConfig?: CodacyConfig): Promise<DiscoveryExcludes>;
 
 /**
  * Computes pattern-level summary statistics for analysis results.
@@ -829,6 +892,18 @@ declare function resolveApiToken(): Promise<string>;
 interface DiscoverOptions {
     /** Skip dependency extraction from manifests (only detect files and languages). */
     skipDependencies?: boolean;
+    /**
+     * Glob patterns to exclude from the scan, on top of `.gitignore`.
+     *
+     * Callers that feed discovery into configuration decisions **must** pass the
+     * same excludes `analyze` will apply (see `resolveDiscoveryExcludes` in
+     * `./codacy-yaml`). Otherwise discovery reports languages, frameworks, and
+     * libraries that only exist in excluded paths — e.g. a tool-orchestration
+     * monorepo whose per-language sample files all live under
+     * `**\/test/fixtures/**` looks like a 20-language polyglot repo, and every
+     * tool selected from those languages then analyzes zero files.
+     */
+    exclude?: readonly string[];
 }
 /**
  * Scans a repository and returns a structured report of languages, file patterns,
@@ -897,6 +972,10 @@ declare function resolveHeadCommit(repositoryRoot: string): string;
  * Codacy patterns). We normalize either format into a flat issue list and build the
  * payload directly.
  *
+ * Issues from tools that group many findings under one pattern additionally carry
+ * `sourceId` (e.g. Trivy's CVE id), gated on the adapter descriptor's
+ * `needsSourceIdUpload` — see {@link buildPayloads}.
+ *
  * ## Where it uploads
  *
  * The **legacy v2 API** (`https://api.codacy.com/2.0`), matching the Go CLI: one
@@ -928,6 +1007,12 @@ interface NormalizedIssue {
     message: string;
     /** Codacy level string (Info/Warning/High/Error for json; Info/Warning/Error for sarif). */
     level: string;
+    /**
+     * The tool's own finding id (e.g. a CVE), when the report carries one. Only
+     * forwarded to the payload for tools whose descriptor sets
+     * `needsSourceIdUpload` — see {@link buildPayloads}.
+     */
+    sourceId?: string;
 }
 /** Authentication + routing for the upload. */
 type UploadAuth = {
@@ -990,6 +1075,8 @@ interface PayloadIssue {
             line: number;
         };
     };
+    /** Present only for tools that need it; see {@link buildPayloads}. */
+    sourceId?: string;
 }
 /**
  * Resolves the base URL for the legacy v2 results API. Defaults to Codacy SaaS;
@@ -1007,8 +1094,17 @@ declare function parseReport(fileContents: string): NormalizedIssue[];
  * Builds one v2 payload per tool, grouping issues by file. `resolveShortName` maps
  * our internal tool id to the Codacy tool short-name expected in the `tool` field
  * (which becomes an S3 key segment consumed downstream).
+ *
+ * `needsSourceId` decides, per tool, whether `sourceId` is included on each issue —
+ * mirroring the Go CLI, which gates it on the tool's `needs_source_id_upload`
+ * manifest flag. This is not cosmetic: `sourceId` is one of the four inputs to
+ * Codacy's deterministic result UUID, so sending it for a tool the cloud engine
+ * doesn't send it for would give the same finding a different UUID. Tools that
+ * don't need it omit the field entirely rather than sending an empty string.
+ * Defaults to never including it, so a caller that hasn't opted in can't change
+ * UUIDs by accident.
  */
-declare function buildPayloads(issues: NormalizedIssue[], resolveShortName: (toolId: string) => string): ToolPayload[];
+declare function buildPayloads(issues: NormalizedIssue[], resolveShortName: (toolId: string) => string, needsSourceId?: (toolId: string) => boolean): ToolPayload[];
 /**
  * Uploads an analysis report to Codacy. Reads and parses the report, resolves tool
  * short-names, POSTs one `issuesRemoteResults` per tool, then a single `resultsFinal`.
@@ -1023,4 +1119,4 @@ declare function buildPayloads(issues: NormalizedIssue[], resolveShortName: (too
  */
 declare function uploadReport(options: UploadOptions): Promise<UploadResult>;
 
-export { type AdapterFactory, type AnalyzeOptions, type AutoFilters, type CategoryFilter, type CodacyYamlConfig, type CodacyYamlEngineConfig, type ConfigOperation, type DiscoverOptions, type ExecutionMode, type IgnoredFilesResult, type InitAutoStats, type InitDefaultStats, type InitLocalStats, type InitRemoteStats, type LoggerOptions, type MergeOptions, type NormalizedIssue, type PatternMetadataLookup, type SeverityFilter, type UploadAuth, type UploadOptions, type UploadResult, analyze, applyCodacyYamlExcludes, applyConfigOperation, buildPayloads, buildToolConfig, clearAdapters, computePatternSummary, configureApiToken, createCodacyConfig, createLogger, createNullLogger, deleteCredentials, detectLanguages, diffConfigs, discover, formatOutput, formatTextSummary, getAdapter, getKnownDisplayNames, getRegisteredAdapters, getRegisteredDescriptors, initAutoConfig, initContainerConfig, initDefaultConfig, initLocalConfig, initRemoteConfig, intersectConfigs, listDiffFiles, listIgnoredFiles, listPrFiles, listStagedFiles, loadCredentials, mergeConfigs, parseAutoFilters, parseReport, pruneEmptyTools, readBaselineConfig, readCodacyConfig, readCodacyYaml, registerAdapter, registerLazyAdapter, registerUnsupportedTool, resolveApiToken, resolveBaselinePath, resolveConfigPath, resolveEngineToAdapter, resolveHeadCommit, resolveRepositoryRoot, resolveResultsApiBaseUrl, rotateLogFiles, saveCredentials, updateConfigIncremental, uploadReport, validateApiToken, writeBaselineConfig, writeCodacyConfig, writeCodacyConfigFile };
+export { type AdapterFactory, type AnalyzeOptions, type AutoFilters, type CategoryFilter, type CodacyYamlConfig, type CodacyYamlEngineConfig, type ConfigOperation, type DiscoverOptions, type DiscoveryExcludes, type ExecutionMode, type IgnoredFilesResult, type InitAutoStats, type InitDefaultStats, type InitDiscoveryOptions, type InitLocalStats, type InitRemoteStats, type LoggerOptions, type MergeOptions, type NormalizedIssue, type PatternMetadataLookup, type SeverityFilter, type UploadAuth, type UploadOptions, type UploadResult, analyze, applyCodacyYamlExcludes, applyConfigOperation, buildPayloads, buildToolConfig, clearAdapters, computePatternSummary, configureApiToken, createCodacyConfig, createLogger, createNullLogger, deleteCredentials, detectLanguages, diffConfigs, discover, formatOutput, formatTextSummary, getAdapter, getKnownDisplayNames, getRegisteredAdapters, getRegisteredDescriptors, initAutoConfig, initContainerConfig, initDefaultConfig, initLocalConfig, initRemoteConfig, intersectConfigs, listDiffFiles, listIgnoredFiles, listPrFiles, listStagedFiles, loadCredentials, mergeConfigs, parseAutoFilters, parseReport, pruneEmptyTools, readBaselineConfig, readCodacyConfig, readCodacyYaml, registerAdapter, registerLazyAdapter, registerUnsupportedTool, resolveApiToken, resolveBaselinePath, resolveConfigPath, resolveDiscoveryExcludes, resolveEngineToAdapter, resolveHeadCommit, resolveRepositoryRoot, resolveResultsApiBaseUrl, rotateLogFiles, saveCredentials, updateConfigIncremental, uploadReport, validateApiToken, writeBaselineConfig, writeCodacyConfig, writeCodacyConfigFile };

package/dist/index.js

@@ -76,6 +76,7 @@ __export(index_exports, {
   resolveApiToken: () => resolveApiToken,
   resolveBaselinePath: () => resolveBaselinePath,
   resolveConfigPath: () => resolveConfigPath,
+  resolveDiscoveryExcludes: () => resolveDiscoveryExcludes,
   resolveEngineToAdapter: () => resolveEngineToAdapter,
   resolveHeadCommit: () => resolveHeadCommit,
   resolveProxyConfig: () => import_tooling6.resolveProxyConfig,
@@ -515,7 +516,7 @@ function isDependencyManifest(relativePath) {
   if (DEPENDENCY_MANIFEST_FILES.has(base)) return true;
   return DEPENDENCY_MANIFEST_SUFFIXES.some((suffix) => base.endsWith(suffix));
 }
-function listRepoFiles(repositoryRoot) {
+function listRepoFiles(repositoryRoot, exclude) {
   try {
     const tracked = (0, import_child_process2.execSync)("git ls-files", {
       cwd: repositoryRoot,
@@ -534,7 +535,8 @@ function listRepoFiles(repositoryRoot) {
     for (const f of untracked.split("\n")) {
       if (f) files.add(f);
     }
-    return Array.from(files).sort();
+    const all = Array.from(files).sort();
+    return exclude && exclude.length > 0 ? applyExclusions(all, [...exclude], []) : all;
   } catch {
     return [];
   }
@@ -1652,6 +1654,11 @@ function formatSarif(result) {
       ruleIndex: ruleIndex.get(issue.patternId) ?? 0,
       level: mapSeverityToSarif(issue.severity),
       message: { text: issue.message },
+      // SARIF has no first-class field for a tool's own finding id, so it rides in
+      // the result property bag. `upload` reads it back from here — without it the
+      // SARIF path would silently drop `sourceId` and produce different Codacy
+      // result UUIDs than the JSON path for the same analysis.
+      ...issue.sourceId ? { properties: { sourceId: issue.sourceId } } : {},
       locations: [
         {
           physicalLocation: {
@@ -1716,7 +1723,8 @@ function formatContainer(result) {
       patternId: issue.patternId,
       line: issue.line,
       message: issue.message,
-      suggestion: issue.suggestion
+      suggestion: issue.suggestion,
+      sourceId: issue.sourceId
     })
   ).join("\n");
 }
@@ -2320,6 +2328,7 @@ function updateConfigIncremental(base, current, next) {
 
 // src/init.ts
 var import_promises4 = __toESM(require("fs/promises"));
+var import_os3 = __toESM(require("os"));
 var import_path8 = __toESM(require("path"));
 var import_child_process4 = require("child_process");
 var import_tooling5 = require("@codacy/tooling");
@@ -2401,6 +2410,8 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["graphql", { displayName: "GraphQL", kind: "library" }],
   ["@apollo/client", { displayName: "Apollo Client", kind: "library" }],
   ["socket.io", { displayName: "Socket.IO", kind: "library" }],
+  ["jquery", { displayName: "jQuery", kind: "library" }],
+  ["mongodb", { displayName: "MongoDB", kind: "library" }],
   ["three", { displayName: "Three.js", kind: "library" }],
   ["d3", { displayName: "D3.js", kind: "library" }],
   ["chart.js", { displayName: "Chart.js", kind: "library" }],
@@ -2483,6 +2494,10 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["matplotlib", { displayName: "Matplotlib", kind: "library" }],
   ["seaborn", { displayName: "Seaborn", kind: "library" }],
   ["plotly", { displayName: "Plotly", kind: "library" }],
+  // MongoDB drivers, one entry per ecosystem — they all gate the same
+  // MongoDB-specific patterns (Opengrep's `java.mongodb.`/`python.pymongo.`).
+  ["pymongo", { displayName: "MongoDB", kind: "library" }],
+  ["motor", { displayName: "MongoDB", kind: "library" }],
   // --- Python — Tools ---
   ["black", { displayName: "Black", kind: "tool" }],
   ["ruff", { displayName: "Ruff", kind: "tool" }],
@@ -2513,9 +2528,16 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["minitest", { displayName: "Minitest", kind: "library" }],
   ["factory_bot", { displayName: "FactoryBot", kind: "library" }],
   ["dry-validation", { displayName: "dry-validation", kind: "library" }],
+  // NOTE: `faker` and `rake` are Gemfile-scoped (MANIFEST_SCOPED_CATALOG), not
+  // global — they are bare words that also name npm/PyPI packages.
   // --- Ruby — Tools ---
   ["rubocop", { displayName: "RuboCop", kind: "tool" }],
   ["bundler", { displayName: "Bundler", kind: "tool" }],
+  // Sorbet ships as several gems; any of them means the project is Sorbet-typed.
+  ["sorbet", { displayName: "Sorbet", kind: "tool" }],
+  ["sorbet-runtime", { displayName: "Sorbet", kind: "tool" }],
+  ["sorbet-static", { displayName: "Sorbet", kind: "tool" }],
+  ["sorbet-static-and-runtime", { displayName: "Sorbet", kind: "tool" }],
   ["solargraph", { displayName: "Solargraph", kind: "tool" }],
   // --- Java / Kotlin — Frameworks ---
   ["spring-boot-starter", { displayName: "Spring Boot", kind: "framework" }],
@@ -2546,6 +2568,10 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["okhttp", { displayName: "OkHttp", kind: "library" }],
   ["retrofit", { displayName: "Retrofit", kind: "library" }],
   ["spock-core", { displayName: "Spock", kind: "library" }],
+  ["mongodb-driver-sync", { displayName: "MongoDB", kind: "library" }],
+  ["mongodb-driver-core", { displayName: "MongoDB", kind: "library" }],
+  ["mongodb-driver-reactivestreams", { displayName: "MongoDB", kind: "library" }],
+  ["mongo-java-driver", { displayName: "MongoDB", kind: "library" }],
   // --- Groovy — Frameworks ---
   // Grails/GORM artifact IDs vary (grails-core, grails-web, gorm-hibernate5, …);
   // the `grails-`/`gorm-` prefix rules below catch the rest.
@@ -2629,7 +2655,19 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["RxSwift", { displayName: "RxSwift", kind: "library" }],
   ["RealmSwift", { displayName: "Realm", kind: "library" }],
   // --- Scala — Frameworks ---
+  // Play is declared as an sbt *plugin*, so `group:artifact` (from
+  // `addSbtPlugin`) is the reliable signal; the library artifacts below only
+  // appear in some builds. `play-json` is deliberately absent — it is a
+  // standalone JSON library used widely outside Play.
+  ["com.typesafe.play:sbt-plugin", { displayName: "Play Framework", kind: "framework" }],
+  ["org.playframework:sbt-plugin", { displayName: "Play Framework", kind: "framework" }],
+  ["play", { displayName: "Play Framework", kind: "framework" }],
   ["play-server", { displayName: "Play Framework", kind: "framework" }],
+  ["play-ws", { displayName: "Play Framework", kind: "framework" }],
+  ["play-test", { displayName: "Play Framework", kind: "framework" }],
+  ["play-slick", { displayName: "Play Framework", kind: "framework" }],
+  ["twirl-api", { displayName: "Play Framework", kind: "framework" }],
+  ["scalatestplus-play", { displayName: "Play Framework", kind: "framework" }],
   ["akka-actor", { displayName: "Akka", kind: "framework" }],
   ["spray-can", { displayName: "Spray", kind: "framework" }],
   // --- Scala — Libraries ---
@@ -2637,6 +2675,22 @@ var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
   ["specs2-core", { displayName: "Specs2", kind: "library" }],
   ["cats-core", { displayName: "Cats", kind: "library" }],
   ["circe-core", { displayName: "Circe", kind: "library" }],
+  // Slick gates Opengrep's `scala.slick.` SQL-injection patterns.
+  ["slick", { displayName: "Slick", kind: "library" }],
+  ["slick-hikaricp", { displayName: "Slick", kind: "library" }],
+  // jwt-scala publishes one artifact per JSON backend; all gate the same
+  // hardcoded-secret patterns.
+  ["jwt-core", { displayName: "jwt-scala", kind: "library" }],
+  ["jwt-circe", { displayName: "jwt-scala", kind: "library" }],
+  ["jwt-play-json", { displayName: "jwt-scala", kind: "library" }],
+  ["jwt-json4s", { displayName: "jwt-scala", kind: "library" }],
+  ["jwt-spray-json", { displayName: "jwt-scala", kind: "library" }],
+  ["jwt-upickle", { displayName: "jwt-scala", kind: "library" }],
+  ["jwt-argonaut", { displayName: "jwt-scala", kind: "library" }],
+  ["munit", { displayName: "MUnit", kind: "library" }],
+  ["scalacheck", { displayName: "ScalaCheck", kind: "library" }],
+  ["scala-logging", { displayName: "scala-logging", kind: "library" }],
+  ["chimney", { displayName: "Chimney", kind: "library" }],
   // --- Elixir — Frameworks ---
   ["phoenix", { displayName: "Phoenix", kind: "framework" }],
   ["plug", { displayName: "Plug", kind: "framework" }],
@@ -2712,6 +2766,25 @@ var DEPENDENCY_PREFIX_RULES = [
   // Groovy — Grails/GORM artifact families (build.gradle artifactIds).
   { prefix: "grails-", classification: { displayName: "Grails", kind: "framework" } },
   { prefix: "gorm-", classification: { displayName: "GORM", kind: "library" } },
+  // Scala — artifact families published one module per feature (sbt artifactIds).
+  // Enumerating members would go stale on every release; the prefixes are
+  // distinctive enough not to collide with other ecosystems.
+  { prefix: "http4s-", classification: { displayName: "http4s", kind: "framework" } },
+  { prefix: "akka-", classification: { displayName: "Akka", kind: "framework" } },
+  { prefix: "pekko-", classification: { displayName: "Pekko", kind: "framework" } },
+  { prefix: "zio-", classification: { displayName: "ZIO", kind: "library" } },
+  // Must precede any broader `cats-` rule: cats-effect is its own project.
+  { prefix: "cats-effect", classification: { displayName: "Cats Effect", kind: "library" } },
+  { prefix: "doobie-", classification: { displayName: "Doobie", kind: "library" } },
+  { prefix: "fs2-", classification: { displayName: "FS2", kind: "library" } },
+  { prefix: "circe-", classification: { displayName: "Circe", kind: "library" } },
+  { prefix: "pureconfig", classification: { displayName: "PureConfig", kind: "library" } },
+  { prefix: "kamon-", classification: { displayName: "Kamon", kind: "library" } },
+  { prefix: "flyway-", classification: { displayName: "Flyway", kind: "library" } },
+  {
+    prefix: "testcontainers-scala",
+    classification: { displayName: "Testcontainers", kind: "library" }
+  },
   // .NET — Microsoft package families and common test/logging libraries. More
   // specific prefixes (Blazor) must precede broader ones (ASP.NET Core).
   {
@@ -2739,7 +2812,14 @@ var DEPENDENCY_PREFIX_RULES = [
   { prefix: "Serilog", classification: { displayName: "Serilog", kind: "library" } }
 ];
 var MANIFEST_SCOPED_CATALOG = /* @__PURE__ */ new Map([
-  ["package.json", /* @__PURE__ */ new Map([["angular", { displayName: "AngularJS", kind: "framework" }]])]
+  ["package.json", /* @__PURE__ */ new Map([["angular", { displayName: "AngularJS", kind: "framework" }]])],
+  [
+    "Gemfile",
+    /* @__PURE__ */ new Map([
+      ["faker", { displayName: "Faker", kind: "library" }],
+      ["rake", { displayName: "Rake", kind: "tool" }]
+    ])
+  ]
 ]);
 function classifyDependency(name, manifestBasename) {
   if (manifestBasename) {
@@ -2811,6 +2891,43 @@ var FILE_SIGNAL_RULES = [
     name: "azure-pipelines.yml",
     matches: (f) => f === "azure-pipelines.yml" || f === "azure-pipelines.yaml",
     classification: { displayName: "Azure Pipelines", kind: "framework" }
+  },
+  {
+    // Jenkins pipelines are Groovy scripts with no manifest at all — the
+    // Jenkinsfile *is* the declaration. Gates CodeNarc's `jenkins`/
+    // `jenkinspipeline` tagged patterns.
+    name: "Jenkinsfile",
+    matches: (f) => {
+      const base = pathBasename(f);
+      return base === "Jenkinsfile" || base.startsWith("Jenkinsfile.");
+    },
+    classification: { displayName: "Jenkins", kind: "tool" }
+  },
+  {
+    // A `sorbet/` directory (typically `sorbet/config` + RBI files) marks a
+    // Sorbet-typed Ruby project even when the gem is pulled in transitively.
+    name: "sorbet/config",
+    matches: (f) => f === "sorbet/config" || f.endsWith("/sorbet/config"),
+    classification: { displayName: "Sorbet", kind: "tool" }
+  },
+  {
+    name: "Rakefile",
+    matches: (f) => {
+      const base = pathBasename(f);
+      return base === "Rakefile" || base === "rakefile" || base.endsWith(".rake");
+    },
+    classification: { displayName: "Rake", kind: "tool" }
+  },
+  {
+    // Play's routes file — `conf/routes`, plus the `conf/*.routes` sub-files a
+    // multi-module app includes from it (Codacy's own website uses
+    // `app/conf/website.routes`, `modules/legacy-api/conf/api.routes`). Nothing
+    // but Play uses this layout, and it is version-independent, unlike the
+    // artifact names. Note `conf/application.conf` is NOT a signal: plain
+    // Typesafe Config uses the same filename without any Play involvement.
+    name: "conf/routes",
+    matches: (f) => /(^|\/)conf\/([^/]+\.)?routes$/.test(f),
+    classification: { displayName: "Play Framework", kind: "framework" }
   }
 ];
 function detectFileSignals(files) {
@@ -2975,18 +3092,76 @@ function parsePackageJson(content) {
     return [];
   }
 }
+function parseRequirementLine(rawLine) {
+  const line = rawLine.trim();
+  if (!line || line.startsWith("#") || line.startsWith("-")) return void 0;
+  const noComment = line.split("#")[0].trim();
+  if (!noComment) return void 0;
+  const match = noComment.match(/^([a-zA-Z0-9_.-]+(?:\[[^\]]*\])?)\s*([<>=!~@;].*)?$/);
+  if (!match) return void 0;
+  const rawName = match[1].replace(/\[.*\]$/, "");
+  return { name: rawName.toLowerCase().replace(/_/g, "-"), version: match[2]?.trim() };
+}
 function parseRequirementsTxt(content) {
   const deps = [];
   for (const rawLine of content.split("\n")) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#") || line.startsWith("-")) continue;
-    const noComment = line.split("#")[0].trim();
-    if (!noComment) continue;
-    const match = noComment.match(/^([a-zA-Z0-9_.-]+(?:\[[^\]]*\])?)\s*([<>=!~@;].*)?$/);
-    if (match) {
-      const rawName = match[1].replace(/\[.*\]$/, "");
-      const normalized = rawName.toLowerCase().replace(/_/g, "-");
-      deps.push({ name: normalized, version: match[2]?.trim() });
+    const dep = parseRequirementLine(rawLine);
+    if (dep) deps.push(dep);
+  }
+  return deps;
+}
+function sliceBalanced(content, fromIndex, open, close) {
+  const start = content.indexOf(open, fromIndex);
+  if (start === -1) return void 0;
+  let depth = 0;
+  let quote;
+  for (let i = start; i < content.length; i++) {
+    const ch = content[i];
+    if (quote) {
+      if (ch === "\\") i++;
+      else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === open) depth++;
+    else if (ch === close && --depth === 0) {
+      return { body: content.slice(start + 1, i), endIndex: i };
+    }
+  }
+  return void 0;
+}
+function parseSetupPy(content) {
+  const deps = [];
+  const collectQuoted = (block) => {
+    for (const quoted of block.matchAll(/["']([^"']+)["']/g)) {
+      const dep = parseRequirementLine(quoted[1]);
+      if (dep) deps.push(dep);
+    }
+  };
+  const valueStartOf = (key) => {
+    const match = new RegExp(`\\b${key}\\s*=\\s*`).exec(content);
+    return match ? match.index + match[0].length : -1;
+  };
+  for (const key of ["install_requires", "tests_require", "setup_requires"]) {
+    const start = valueStartOf(key);
+    if (start === -1 || content[start] !== "[") continue;
+    const list = sliceBalanced(content, start, "[", "]");
+    if (list) collectQuoted(list.body);
+  }
+  const extrasStart = valueStartOf("extras_require");
+  if (extrasStart !== -1 && content[extrasStart] === "{") {
+    const dict = sliceBalanced(content, extrasStart, "{", "}");
+    if (dict) {
+      let cursor = 0;
+      while (cursor < dict.body.length) {
+        const list = sliceBalanced(dict.body, cursor, "[", "]");
+        if (!list) break;
+        collectQuoted(list.body);
+        cursor = list.endIndex + 1;
+      }
     }
   }
   return deps;
@@ -3104,15 +3279,52 @@ function parseBuildGradle(content) {
   }
   return deps;
 }
+function parseVersionCatalogToml(content) {
+  const deps = [];
+  let inLibraries = false;
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) {
+      inLibraries = /^\[\s*libraries\s*\]/.test(line);
+      continue;
+    }
+    if (!inLibraries) continue;
+    const moduleMatch = line.match(/\bmodule\s*=\s*["'][^"':]+:([^"']+)["']/);
+    const nameMatch = line.match(/\bname\s*=\s*["']([^"']+)["']/);
+    const versionMatch = line.match(/\bversion\s*=\s*["']([^"']+)["']/);
+    if (moduleMatch || nameMatch) {
+      deps.push({
+        name: (moduleMatch?.[1] ?? nameMatch?.[1] ?? "").trim(),
+        version: versionMatch?.[1]?.trim()
+      });
+      continue;
+    }
+    const shorthand = line.match(/^[A-Za-z0-9_.-]+\s*=\s*["'][^"':]+:([^"':]+)(?::([^"']+))?["']/);
+    if (shorthand) {
+      deps.push({ name: shorthand[1].trim(), version: shorthand[2]?.trim() });
+    }
+  }
+  return deps;
+}
 function parseBuildSbt(content) {
   const deps = [];
-  const depRegex = /"([^"]+)"\s*%%?\s*"([^"]+)"\s*%\s*"([^"]+)"/g;
+  const depRegex = /"([^"]+)"\s*%%?\s*"([^"]+)"\s*%(?!%)\s*(?:"([^"]+)")?/g;
   let match;
   while ((match = depRegex.exec(content)) !== null) {
     deps.push({ name: match[2], version: match[3] });
   }
   return deps;
 }
+function parseSbtBuildDefinition(content) {
+  const deps = parseBuildSbt(content);
+  const pluginRegex = /addSbtPlugin\s*\(\s*"([^"]+)"\s*%%?\s*"([^"]+)"/g;
+  let match;
+  while ((match = pluginRegex.exec(content)) !== null) {
+    deps.push({ name: `${match[1]}:${match[2]}` });
+  }
+  return deps;
+}
 function parseCargoToml(content) {
   const deps = [];
   let inDepsSection = false;
@@ -3262,6 +3474,8 @@ var MANIFEST_PARSERS = /* @__PURE__ */ new Map([
   ["pom.xml", parsePomXml],
   ["build.gradle", parseBuildGradle],
   ["build.gradle.kts", parseBuildGradle],
+  ["libs.versions.toml", parseVersionCatalogToml],
+  ["setup.py", parseSetupPy],
   ["build.sbt", parseBuildSbt],
   ["Cargo.toml", parseCargoToml],
   ["composer.json", parseComposerJson],
@@ -3278,10 +3492,32 @@ var MANIFEST_SUFFIX_PARSERS = /* @__PURE__ */ new Map([
   [".vbproj", parseCsproj],
   [".fsproj", parseCsproj]
 ]);
+var MANIFEST_PATH_PARSERS = [
+  {
+    matches: (filePath, basename) => /^requirements[a-zA-Z0-9_.-]*\.(txt|in)$/i.test(basename) || // Any .txt/.in directly inside a `requirements/` directory: base.txt,
+    // dev.txt, prod.in — the other common split-layout convention.
+    /(^|\/)requirements\/[^/]+\.(txt|in)$/i.test(filePath),
+    parser: parseRequirementsTxt
+  },
+  {
+    // sbt build definition: `project/Dependencies.scala`, `project/plugins.sbt`
+    // and the meta-build's own `project/project/*`. Matching by directory rather
+    // than basename is what this rule exists for — the Scala file can be called
+    // anything, and `*.scala` on its own is source code, not a manifest.
+    //
+    // Case-sensitive deliberately: sbt's directory is always lowercase `project`,
+    // while `Project` is an ordinary domain-package name, and reading
+    // `…/domain/Project/Project.scala` as a manifest would be wrong.
+    matches: (filePath) => /(^|\/)project\/[^/]+\.(scala|sbt)$/.test(filePath),
+    parser: parseSbtBuildDefinition
+  }
+];
 
 // src/discover.ts
 async function discover(repositoryRoot, options) {
-  const files = listRepoFiles(repositoryRoot);
+  const unfiltered = listRepoFiles(repositoryRoot);
+  const files = applyExclusions(unfiltered, [...options?.exclude ?? []], []);
+  const excludedFiles = unfiltered.length - files.length;
   const filePatterns = extractFilePatterns(files);
   const notableFiles = findNotableFiles(files);
   const languages = await detectLanguages(repositoryRoot, files);
@@ -3304,7 +3540,10 @@ async function discover(repositoryRoot, options) {
     metadata: {
       repositoryRoot: import_path6.default.resolve(repositoryRoot),
       totalFiles: files.length,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
+      scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      // Surfaced so a scan narrowed by excludes is never mistaken for a repo
+      // that genuinely lacks those languages.
+      ...excludedFiles > 0 ? { excludedFiles } : {}
     }
   };
 }
@@ -3335,6 +3574,9 @@ function resolveManifestParser(filePath) {
   for (const [suffix, parser] of MANIFEST_SUFFIX_PARSERS) {
     if (lowerBasename.endsWith(suffix)) return parser;
   }
+  for (const rule of MANIFEST_PATH_PARSERS) {
+    if (rule.matches(filePath, basename)) return rule.parser;
+  }
   return void 0;
 }
 async function extractDependencies(repositoryRoot, files) {
@@ -3468,6 +3710,28 @@ function applyCodacyYamlExcludes(config, yamlConfig, adapters, logger) {
 function deduplicateStrings(arr) {
   return [...new Set(arr)];
 }
+async function resolveDiscoveryExcludes(repositoryRoot, adapters, existingConfig) {
+  const yamlConfig = await readCodacyYaml(repositoryRoot);
+  const global = deduplicateStrings([
+    ...existingConfig?.exclude ?? [],
+    ...yamlConfig?.excludePaths ?? []
+  ]);
+  const perTool = /* @__PURE__ */ new Map();
+  const addToolExcludes = (toolId, patterns) => {
+    if (patterns.length === 0) return;
+    perTool.set(toolId, deduplicateStrings([...perTool.get(toolId) ?? [], ...patterns]));
+  };
+  for (const tool of existingConfig?.tools ?? []) {
+    addToolExcludes(tool.toolId, tool.exclude ?? []);
+  }
+  for (const [engineName, engineConfig] of yamlConfig?.engines ?? []) {
+    if (engineConfig.excludePaths.length === 0) continue;
+    const adapterId = resolveEngineToAdapter(engineName, adapters);
+    if (!adapterId) continue;
+    addToolExcludes(adapterId, engineConfig.excludePaths);
+  }
+  return { yamlConfig, global, perTool };
+}
 
 // src/api/client/core/OpenAPI.ts
 var OpenAPI = {
@@ -7032,7 +7296,7 @@ function buildAdapterByUuid(adapters, apiTools) {
   }
   return result;
 }
-async function detectLanguages(repositoryRoot, precomputedFiles) {
+async function detectLanguages(repositoryRoot, precomputedFiles, exclude) {
   let files;
   if (precomputedFiles) {
     files = precomputedFiles;
@@ -7048,6 +7312,9 @@ async function detectLanguages(repositoryRoot, precomputedFiles) {
       return [];
     }
   }
+  if (exclude && exclude.length > 0) {
+    files = applyExclusions(files, [...exclude], []);
+  }
   const detected = /* @__PURE__ */ new Set();
   for (const file of files) {
     const basename = import_path8.default.basename(file);
@@ -7086,16 +7353,18 @@ async function detectLocalConfigFiles(repositoryRoot, adapters) {
   }
   return found;
 }
-async function enrichWithCodacyYaml(config, repositoryRoot, adapters) {
-  const yamlConfig = await readCodacyYaml(repositoryRoot);
-  if (!yamlConfig) return { config, codacyYamlApplied: false };
+function enrichWithCodacyYaml(config, adapters, excludes) {
+  if (!excludes.yamlConfig) return { config, codacyYamlApplied: false };
   return {
-    config: applyCodacyYamlExcludes(config, yamlConfig, adapters),
+    config: applyCodacyYamlExcludes(config, excludes.yamlConfig, adapters),
     codacyYamlApplied: true
   };
 }
-async function initLocalConfigBase(repositoryRoot, adapters) {
-  const languages = await detectLanguages(repositoryRoot);
+async function initLocalConfigBase(repositoryRoot, adapters, excludes) {
+  const languages = await detectLanguages(
+    repositoryRoot,
+    listRepoFiles(repositoryRoot, excludes.global)
+  );
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
   const tools = [];
   for (const [toolId, configPath] of localConfigs.entries()) {
@@ -7108,17 +7377,23 @@ async function initLocalConfigBase(repositoryRoot, adapters) {
   }
   return createCodacyConfig({ source: "local", languages, tools });
 }
-async function initLocalConfig(repositoryRoot, adapters) {
-  const baseConfig = await initLocalConfigBase(repositoryRoot, adapters);
-  const { config, codacyYamlApplied } = await enrichWithCodacyYaml(
-    baseConfig,
+async function initLocalConfig(repositoryRoot, adapters, options) {
+  const excludes = await resolveDiscoveryExcludes(
     repositoryRoot,
-    adapters
+    adapters,
+    options?.existingConfig
   );
+  const baseConfig = await initLocalConfigBase(repositoryRoot, adapters, excludes);
+  const { config, codacyYamlApplied } = enrichWithCodacyYaml(baseConfig, adapters, excludes);
   return { config, stats: { codacyYamlApplied } };
 }
-async function initDefaultConfig(repositoryRoot, adapters) {
-  const base = await initLocalConfigBase(repositoryRoot, adapters);
+async function initDefaultConfig(repositoryRoot, adapters, options) {
+  const excludes = await resolveDiscoveryExcludes(
+    repositoryRoot,
+    adapters,
+    options?.existingConfig
+  );
+  const base = await initLocalConfigBase(repositoryRoot, adapters, excludes);
   const toolsWithLocalConfig = new Set(
     base.tools.filter((t) => t.useLocalConfigurationFile).map((t) => t.toolId)
   );
@@ -7156,11 +7431,7 @@ async function initDefaultConfig(repositoryRoot, adapters) {
     languages: base.metadata.languages,
     tools: updatedTools
   });
-  const { config, codacyYamlApplied } = await enrichWithCodacyYaml(
-    baseConfig,
-    repositoryRoot,
-    adapters
-  );
+  const { config, codacyYamlApplied } = enrichWithCodacyYaml(baseConfig, adapters, excludes);
   return {
     config,
     stats: { totalApiTools: apiTools.length, addedTools, addedUnsupported, codacyYamlApplied }
@@ -7246,10 +7517,10 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
   if (ignoredFilesResult.files.length > 0) {
     baseConfig.exclude = [.../* @__PURE__ */ new Set([...baseConfig.exclude ?? [], ...ignoredFilesResult.files])];
   }
-  const { config, codacyYamlApplied } = await enrichWithCodacyYaml(
+  const { config, codacyYamlApplied } = enrichWithCodacyYaml(
     baseConfig,
-    repositoryRoot,
-    adapters
+    adapters,
+    await resolveDiscoveryExcludes(repositoryRoot, adapters)
   );
   return {
     config,
@@ -7323,8 +7594,13 @@ function hasMatchingFiles(files, filePatterns) {
   if (matcher.matchAll) return files.length > 0;
   return files.some((file) => matcher.matches(file, file.split("/").pop() ?? ""));
 }
-async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, onDiscoveryComplete, rawFilterString, loadUnsupportedPatterns) {
-  const discoveryResult = await discover(repositoryRoot);
+async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, onDiscoveryComplete, rawFilterString, loadUnsupportedPatterns, options) {
+  const excludes = await resolveDiscoveryExcludes(
+    repositoryRoot,
+    adapters,
+    options?.existingConfig
+  );
+  const discoveryResult = await discover(repositoryRoot, { exclude: excludes.global });
   onDiscoveryComplete?.(discoveryResult);
   const detectedKeys = /* @__PURE__ */ new Set();
   for (const lang of discoveryResult.languages) detectedKeys.add(lang);
@@ -7332,15 +7608,26 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
   for (const lib of discoveryResult.libraries) detectedKeys.add(lib.displayName);
   const repoLanguages = new Set(discoveryResult.languages);
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
-  const repoFiles = listRepoFiles(repositoryRoot);
+  const repoFiles = listRepoFiles(repositoryRoot, excludes.global);
   const descriptorMap = new Map(descriptors.map((d) => [d.id, d]));
+  const perToolFiles = /* @__PURE__ */ new Map();
+  const filesVisibleTo = (toolId) => {
+    const toolExclude = excludes.perTool.get(toolId);
+    if (!toolExclude || toolExclude.length === 0) return repoFiles;
+    let files = perToolFiles.get(toolId);
+    if (!files) {
+      files = applyExclusions(repoFiles, [], [...toolExclude]);
+      perToolFiles.set(toolId, files);
+    }
+    return files;
+  };
   const candidates = [];
   for (const adapter of adapters) {
     if (!adapter.languages.includes("*") && adapter.languages.length > 0 && repoLanguages.size > 0) {
       const hasOverlap = adapter.languages.some((lang) => repoLanguages.has(lang));
       if (!hasOverlap) continue;
     }
-    if (!hasMatchingFiles(repoFiles, adapter.filePatterns)) continue;
+    if (!hasMatchingFiles(filesVisibleTo(adapter.id), adapter.filePatterns)) continue;
     candidates.push(adapter);
   }
   const deduped = deduplicateToolFamilies(candidates, localConfigs);
@@ -7368,23 +7655,32 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
       filters
     );
     if (selectedPatterns.length > 0) {
-      tools.push({
+      const toolEntry = {
         toolId: adapter.id,
         patterns: selectedPatterns.map((p) => ({ patternId: p.id }))
-      });
+      };
+      tools.push(toolEntry);
+      await applyAdapterParameterSuggestions(
+        adapter,
+        toolEntry,
+        repositoryRoot,
+        filesVisibleTo(adapter.id)
+      );
     }
   }
   let selectedUnsupported = 0;
-  const selectedFamilies = new Set(tools.map((t) => toolFamily(t.toolId)));
+  const selectedFamilies = new Set(
+    tools.map((t) => toolGroupKey(t.toolId, descriptorMap.get(t.toolId)?.alternativeGroup))
+  );
   for (const desc of descriptors) {
     if (!desc.unsupported) continue;
     if (!loadUnsupportedPatterns) break;
     if (!desc.languages.includes("*") && desc.languages.length > 0 && repoLanguages.size > 0 && !desc.languages.some((lang) => repoLanguages.has(lang))) {
       continue;
     }
-    const family = toolFamily(desc.id);
+    const family = toolGroupKey(desc.id, desc.alternativeGroup);
     if (selectedFamilies.has(family)) continue;
-    if (!hasMatchingFiles(repoFiles, desc.filePatterns)) continue;
+    if (!hasMatchingFiles(filesVisibleTo(desc.id), desc.filePatterns)) continue;
     const patternsMetadata = loadUnsupportedPatterns(desc.id);
     if (patternsMetadata.length === 0) continue;
     const selectedPatterns = filterAutoPatterns(
@@ -7409,11 +7705,7 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
     tools,
     autoFilters: rawFilterString || void 0
   });
-  const { config, codacyYamlApplied } = await enrichWithCodacyYaml(
-    baseConfig,
-    repositoryRoot,
-    adapters
-  );
+  const { config, codacyYamlApplied } = enrichWithCodacyYaml(baseConfig, adapters, excludes);
   return {
     config,
     stats: {
@@ -7426,16 +7718,58 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
     }
   };
 }
+async function applyAdapterParameterSuggestions(adapter, toolEntry, repositoryRoot, repoFiles) {
+  if (!adapter.suggestParameters) return;
+  const logger = {
+    debug() {
+    },
+    info() {
+    },
+    warn(message, fields) {
+      console.error(`[init --auto] ${adapter.id}: ${message}`, fields ?? "");
+    },
+    error(message, fields) {
+      console.error(`[init --auto] ${adapter.id}: ${message}`, fields ?? "");
+    }
+  };
+  try {
+    const globalDir = import_path8.default.join(import_os3.default.homedir(), ".codacy");
+    const ctx = {
+      repositoryRoot,
+      generatedConfigDir: import_path8.default.join(repositoryRoot, ".codacy", "generated", adapter.id),
+      globalDir,
+      toolInstallDir: import_path8.default.join(globalDir, "tools", adapter.id),
+      targetFiles: routeFilesToTool(repoFiles, adapter, toolEntry),
+      platform: { os: process.platform, arch: process.arch },
+      logger,
+      runner: "local"
+    };
+    const suggestions = await adapter.suggestParameters(ctx);
+    if (!suggestions) return;
+    for (const pattern of toolEntry.patterns) {
+      const params = suggestions[pattern.patternId];
+      if (!params) continue;
+      pattern.parameters = { ...pattern.parameters, ...params };
+    }
+  } catch (err) {
+    logger.error("suggestParameters failed", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
 function toolFamily(id) {
   return id.replace(/\d+$/, "");
 }
+function toolGroupKey(id, alternativeGroup) {
+  return alternativeGroup ?? toolFamily(id);
+}
 function deduplicateToolFamilies(candidates, localConfigs) {
   const families = /* @__PURE__ */ new Map();
   for (const adapter of candidates) {
-    const family = toolFamily(adapter.id);
-    const group = families.get(family) ?? [];
+    const key = toolGroupKey(adapter.id, adapter.alternativeGroup);
+    const group = families.get(key) ?? [];
     group.push(adapter);
-    families.set(family, group);
+    families.set(key, group);
   }
   const result = [];
   for (const group of families.values()) {
@@ -7444,16 +7778,28 @@ function deduplicateToolFamilies(candidates, localConfigs) {
       continue;
     }
     const withConfig = group.filter((a) => localConfigs.has(a.id));
-    if (withConfig.length === 1) {
-      result.push(withConfig[0]);
+    const pool = withConfig.length > 0 ? withConfig : group;
+    if (pool.length === 1) {
+      result.push(pool[0]);
       continue;
     }
-    group.sort((a, b) => {
-      const majorA = parseInt(a.preferredVersion.split(".")[0], 10) || 0;
-      const majorB = parseInt(b.preferredVersion.split(".")[0], 10) || 0;
-      return majorB - majorA;
-    });
-    result.push(group[0]);
+    const preferred = pool.filter((a) => a.alternativeGroupDefault);
+    if (preferred.length === 1) {
+      result.push(preferred[0]);
+      continue;
+    }
+    const defaultFamilies = new Set(
+      group.filter((a) => a.alternativeGroupDefault).map((a) => toolFamily(a.id))
+    );
+    const defaultFamilyMembers = defaultFamilies.size === 1 ? pool.filter((a) => defaultFamilies.has(toolFamily(a.id))) : [];
+    const ranked = [...defaultFamilyMembers.length > 0 ? defaultFamilyMembers : pool].sort(
+      (a, b) => {
+        const majorA = parseInt(a.preferredVersion.split(".")[0], 10) || 0;
+        const majorB = parseInt(b.preferredVersion.split(".")[0], 10) || 0;
+        return majorB - majorA;
+      }
+    );
+    result.push(ranked[0]);
   }
   return result;
 }
@@ -7609,14 +7955,14 @@ var import_tooling6 = require("@codacy/tooling");
 // src/credentials.ts
 var import_crypto = __toESM(require("crypto"));
 var import_promises5 = __toESM(require("fs/promises"));
-var import_os3 = __toESM(require("os"));
+var import_os4 = __toESM(require("os"));
 var import_path9 = __toESM(require("path"));
 function credentialsPath() {
-  return import_path9.default.join(import_os3.default.homedir(), ".codacy", "credentials");
+  return import_path9.default.join(import_os4.default.homedir(), ".codacy", "credentials");
 }
 function deriveKey(salt) {
-  const info = import_os3.default.userInfo();
-  const machineKey = [import_os3.default.hostname(), info.username, import_os3.default.homedir(), import_os3.default.platform()].join("|");
+  const info = import_os4.default.userInfo();
+  const machineKey = [import_os4.default.hostname(), info.username, import_os4.default.homedir(), import_os4.default.platform()].join("|");
   return import_crypto.default.pbkdf2Sync(machineKey, salt, 1e5, 32, "sha512");
 }
 async function saveCredentials(token) {
@@ -7750,11 +8096,12 @@ function parseSarif(runs) {
       if (!patternId) continue;
       const level = mapSarifLevelToCodacy(result.level);
       const message = result.message?.text ?? "";
+      const sourceId = result.properties?.sourceId;
       for (const loc of result.locations ?? []) {
         const filePath = loc.physicalLocation?.artifactLocation?.uri;
         const line = loc.physicalLocation?.region?.startLine;
         if (!filePath || !line) continue;
-        issues.push({ toolId, patternId, filePath, line, message, level });
+        issues.push({ toolId, patternId, filePath, line, message, level, sourceId });
       }
     }
   }
@@ -7768,10 +8115,11 @@ function parseAnalysisResult(result) {
     line: issue.line,
     message: issue.message,
     // JSON carries the authoritative Codacy severity; pass it through unchanged.
-    level: issue.severity
+    level: issue.severity,
+    sourceId: issue.sourceId
   }));
 }
-function buildPayloads(issues, resolveShortName) {
+function buildPayloads(issues, resolveShortName, needsSourceId = () => false) {
   const byTool = /* @__PURE__ */ new Map();
   for (const issue of issues) {
     const list = byTool.get(issue.toolId);
@@ -7780,6 +8128,7 @@ function buildPayloads(issues, resolveShortName) {
   }
   const payloads = [];
   for (const [toolId, toolIssues] of byTool) {
+    const withSourceId = needsSourceId(toolId);
     const byFile = /* @__PURE__ */ new Map();
     for (const issue of toolIssues) {
       const entry = {
@@ -7788,7 +8137,8 @@ function buildPayloads(issues, resolveShortName) {
           filename: issue.filePath,
           message: { text: issue.message },
           level: issue.level,
-          location: { LineLocation: { line: issue.line } }
+          location: { LineLocation: { line: issue.line } },
+          ...withSourceId && issue.sourceId ? { sourceId: issue.sourceId } : {}
         }
       };
       const list = byFile.get(issue.filePath);
@@ -7820,6 +8170,13 @@ async function buildShortNameResolver(onProgress) {
   }
   return (toolId) => byName.get(toolId.toLowerCase()) ?? toolId.toLowerCase();
 }
+function buildSourceIdResolver() {
+  const needsIt = /* @__PURE__ */ new Set();
+  for (const descriptor of getRegisteredDescriptors()) {
+    if (descriptor.needsSourceIdUpload) needsIt.add(descriptor.id.toLowerCase());
+  }
+  return (toolId) => needsIt.has(toolId.toLowerCase());
+}
 var COORDINATE_PATTERN = /^[A-Za-z0-9._-]+$/;
 function assertValidCoordinate(kind, value) {
   if (!COORDINATE_PATTERN.test(value)) {
@@ -7859,7 +8216,7 @@ async function uploadReport(options) {
     onProgress?.("No issues found in the report; nothing to upload.");
   }
   const resolveShortName = await buildShortNameResolver(onProgress);
-  const payloads = buildPayloads(issues, resolveShortName);
+  const payloads = buildPayloads(issues, resolveShortName, buildSourceIdResolver());
   const base = resolveResultsApiBaseUrl();
   const urls = buildUrls(base, auth, commitUuid);
   const headers = { "content-type": "application/json", ...authHeader(auth) };
@@ -7960,6 +8317,7 @@ async function safeReadBody(res) {
   resolveApiToken,
   resolveBaselinePath,
   resolveConfigPath,
+  resolveDiscoveryExcludes,
   resolveEngineToAdapter,
   resolveHeadCommit,
   resolveProxyConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/analysis-runner",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Core orchestration engine for Codacy analysis",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,11 +12,11 @@
     "cli-table3": "^0.6",
     "minimatch": "10.2.4",
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.16.0"
+    "@codacy/tooling": "0.18.0"
   },
   "devDependencies": {
     "@codacy/openapi-typescript-codegen": "0.0.9",
-    "@codacy/tools-dummy-1": "0.16.0"
+    "@codacy/tools-dummy-1": "0.18.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",