@vyuhlabs/dxkit 1.5.1 → 1.6.1

package/CHANGELOG.md

@@ -7,6 +7,303 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.1] - 2026-04-21
+
+Patch release with two CLI bug fixes found while regenerating dxkit's own
+reports. No API or schema changes — drop-in upgrade from 1.6.0.
+
+### Fixed
+
+- **CLI positional paths are now resolved to absolute before analyzers run.**
+  Previously, `vyuh-dxkit health .` (or any other analyzer command invoked
+  with `.`) propagated the literal `"."` into Layer 2 child worker processes
+  (cloc, gitleaks, graphify), which run from `dist/analyzers/` rather than
+  the target repo. The `.` then resolved against the worker's cwd and cloc
+  happily scanned dxkit's own compiled `dist/*.js` output — producing
+  bogus language breakdowns like "JavaScript 90%, TypeScript 10%" on
+  TypeScript-only repos. The CLI now wraps all 6 positional-path sites
+  with `path.resolve()` at the boundary, so bare `.` / `./foo` / `../bar`
+  arguments work as users expect. Affects `health`, `vulnerabilities`,
+  `test-gaps`, `quality`, `dev-report`, and `tools`.
+- **Vulnerability report section numbers are now dynamic.** Previously,
+  empty finding categories (Secrets / Code Patterns / Config Issues /
+  Dependencies) were skipped but their hardcoded section numbers were
+  not renumbered, so a report with only secrets + dep vulns rendered as
+  `## 1.` → `## 4.` with 2 and 3 mysteriously missing. Sections are now
+  numbered with a running counter that advances only when a section
+  actually renders. Output is purely cosmetic-identical when all four
+  categories have findings; skipped categories no longer leave holes.
+
+### Internal
+
+- `chore: sync package-lock.json to 1.6.0` — the 1.6.0 release commit
+  bumped `package.json` but not the lockfile. Every `npm install` since
+  has surfaced as `M package-lock.json`. Now consistent.
+
+## [1.6.0] - 2026-04-18
+
+This release transforms dxkit from a scaffolder into an analyzer-and-scaffolder.
+Five native CLI commands run deterministic analyses against any repo — no LLM
+required, reproducible scores, agent-consumable JSON output. The scaffolding
+capability is unchanged.
+
+### Added
+
+#### Native analyzer CLI (new primary capability)
+
+- **`vyuh-dxkit health [path]`** — 6-dimension score (Testing, Code Quality,
+  Documentation, Security, Maintainability, Developer Experience) with
+  overall grade A–F. Runs in 10–20s on mid-size repos.
+- **`vyuh-dxkit vulnerabilities [path]`** — gitleaks secret scan + semgrep SAST
+  + `npm audit` / `pip-audit` / `govulncheck` / `cargo-audit` dependency
+  vulnerabilities. Findings grouped by rule with severity + CWE category.
+- **`vyuh-dxkit test-gaps [path]`** — coverage artifact import with
+  import-graph reachability fallback. Ranks untested files by risk tier
+  (CRITICAL for auth/security, HIGH for large services, etc.).
+- **`vyuh-dxkit quality [path]`** — Slop score (0–100) combining lint errors,
+  `: any` density, console statements, TODO/FIXME, duplication % (jscpd),
+  comment ratio, and hygiene markers. Ranked remediation actions.
+- **`vyuh-dxkit dev-report [path]`** — git activity: commits, contributors,
+  hot files, merge ratio, conventional-commit compliance, weekly velocity.
+- **`--detailed` flag** on all analyzers — writes paired `<name>-detailed.md`
+  + `<name>-detailed.json` with Evidence (file, line, rule, tool) and
+  `RemediationAction<M>` entries ranked by projected score delta.
+- **`--json` flag** — pure JSON on stdout, logs on stderr for clean piping.
+- **`--verbose` flag** — per-tool timing to stderr.
+- **`--no-save` flag** — skip markdown output.
+- **`--since <date>`** (dev-report only) — bound the git activity window.
+
+#### Tool registry and installer
+
+- **`vyuh-dxkit tools`** — list detection status for all tools required by
+  the detected stack. Multi-path detection (PATH → brew → npm-g → pipx →
+  cargo → go → project `node_modules` → system probes).
+- **`vyuh-dxkit tools install [--yes]`** — interactive or non-interactive
+  install of missing tools via platform-specific commands (brew on macOS,
+  user-local on Linux). No `sudo` required; tools install to `~/.local/bin`
+  or equivalent.
+- **21 tools integrated** across 6 languages:
+  - Universal: `cloc`, `gitleaks`, `semgrep`, `jscpd`, `graphify`
+  - Node/TS: `eslint`, `npm audit`, `@vitest/coverage-v8`
+  - Python: `ruff`, `pip-audit`, `coverage` (coverage.py)
+  - Go: `golangci-lint`, `govulncheck`
+  - Rust: `clippy`, `cargo-audit`, `cargo-llvm-cov`
+  - C#: `dotnet-format`
+- **`nodePackage` field** on `ToolDefinition` — detects Node packages that
+  have no CLI binary (e.g. vitest plugins) via `node_modules/<pkg>/package.json`.
+- **`runRegisteredTool()`** — sanctioned path to run any registered tool,
+  ensures all tool invocation goes through detection instead of hardcoded
+  binary paths.
+
+#### Coverage artifact import
+
+- **Istanbul** (`coverage/coverage-summary.json` + `coverage-final.json`) —
+  used by vitest, nyc, c8. Parses per-file line coverage + overall %.
+- **coverage.py** (`coverage.json`) — Python.
+- **Go coverprofile** (`coverage.out` / `cover.out`) — text format with
+  module-prefix path resolution.
+- **Cobertura XML** (`coverage.cobertura.xml`, `TestResults/<guid>/...`) —
+  C# (coverlet) and Rust (`cargo llvm-cov --cobertura`).
+- **lcov** (`lcov.info`) — Rust (`cargo llvm-cov --lcov`).
+
+#### Import-graph test matching
+
+- **TS/JS extractor** — static imports, `import(...)` dynamic, `require()`,
+  `export * from` re-exports, multi-line imports, comment-stripping.
+- **Python extractor** — `import X`, `from X import Y`, relative-dot imports.
+- **Go extractor** — single-line `import "fmt"` + multi-line `import (...)`
+  blocks with alias support. Module-based resolution via `go.mod`.
+- **Rust extractor** — `use std::io`, nested paths, block `use std::{io, fs}`.
+- **C# extractor** — `using X.Y;`, `using static`, `using Alias = X.Y;`.
+- **Resolver** — relative-path resolution with extension fallback and
+  directory-as-`index.ts` probing (TS/JS) or `__init__.py` (Python).
+  Go resolves internal module paths via `go.mod` module prefix.
+- **BFS walker** — up to 3 hops transitively, cycle-safe. External packages
+  are correctly skipped.
+
+#### Suppressions
+
+- **`.dxkit-suppressions.json`** — silence known-false positives per tool
+  without editing code. Format:
+  ```json
+  {
+    "gitleaks": [
+      { "rule": "generic-api-key", "paths": ["test/fixtures/**"], "reason": "..." }
+    ]
+  }
+  ```
+- Glob matcher supports `**`, `*`, `?`. A finding is suppressed when rule
+  matches (exact or `*`) AND at least one path glob matches.
+- Wired to gitleaks. Semgrep and slop-hook integrations follow.
+
+#### CI + hooks hardening
+
+- **CI enforces everything pre-push does, plus slop-vs-base diff.**
+  `.github/workflows/ci.yml` now runs architecture check, slop check
+  (diffing against the PR base branch via `DXKIT_SLOP_BASE`), tests with
+  coverage, and coverage-threshold enforcement. `--no-verify` can no longer
+  ship code that introduces slop.
+- **`scripts/check-coverage.sh`** — reads `coverage/coverage-summary.json`,
+  fails if line coverage below threshold (default 50%, configurable via
+  `DXKIT_COVERAGE_THRESHOLD`). Wired into `.husky/pre-push` and CI.
+- **`scripts/check-slop.sh` CI mode** — when `DXKIT_SLOP_BASE` env var is
+  set, diffs against that ref instead of `--cached`. Pre-commit behavior
+  unchanged.
+
+#### Dogfood
+
+- dxkit's own line coverage raised from ~19% to 59% in the course of
+  building these analyzers. 423 tests across 21 files, all passing.
+  Coverage threshold of 50% enforced on every push and PR.
+
+#### Language-pack rearchitecture (10d.1.6)
+
+- **`LanguageSupport` interface** — single-file-per-language architecture.
+  Each language implements: detection, tool bindings, semgrep rulesets,
+  coverage parsing, import extraction/resolution, metric gathering, and
+  lint severity mapping. `src/languages/{python,typescript,csharp,go,rust}.ts`.
+- **Registry dispatch** — `health.ts`, `tool-registry.ts`, `import-graph.ts`,
+  `gather.ts`, and `quality/gather.ts` all dispatch through
+  `detectActiveLanguages()` instead of per-language if-chains.
+- **Old scattered code deleted** — `src/analyzers/tools/{node,python,go,
+  rust,dotnet}.ts` removed (~583 LOC). Net reduction despite adding 5
+  language packs + coverage parsers + import extractors.
+- **Ruff severity mapping** — Python lint results now bucket ruff codes by
+  prefix: S→critical, F/B→high, E/C→medium, W/N/D/I→low. Previously all
+  results were counted as errors regardless of code.
+- **C# `*Tests.cs` pattern** — test-gap analyzer now recognizes the C#
+  naming convention (`FooTests.cs`, `Foo.Tests.cs`) that the old
+  `*.test.*`/`*.spec.*`-only patterns missed.
+- **`cargo-llvm-cov`** registered in TOOL_DEFS with detection + install.
+- **Contract tests** — 46 tests validate every language pack: TOOL_DEFS
+  key validity, extension format, wildcard patterns, detect() idempotency,
+  completeness (all 5 required IDs registered).
+
+#### OSV.dev severity enrichment + CVSS v4 (10d.2)
+
+- **OSV.dev integration** — `src/analyzers/tools/osv.ts` looks up
+  vulnerability IDs against `https://api.osv.dev/v1/vulns/{id}` and
+  classifies them into critical/high/medium/low tiers. Session-scoped
+  in-memory cache. 10s per-request timeout with offline fallback.
+- **Full CVSS v4.0 calculator** — `src/analyzers/tools/cvss-v4.ts` with
+  the 270-entry macrovector → base-score lookup table (BSD-2-Clause,
+  ported verbatim from FIRST.ORG's reference implementation, attributed
+  in `THIRD_PARTY_NOTICES.md`). Handles equivalence-class computation,
+  severity-distance refinement, and rounding per spec. Critical for
+  modern CVEs (2025+) that publish v4 vectors exclusively.
+- **Python pack (`pip-audit`)** — previously bucketed every finding as
+  medium. Now extracts vuln IDs and looks each up via OSV. Unknown or
+  unreachable IDs keep the legacy medium bucket. Verified on
+  CVE-2025-8869 (pip tar symlink → v4 5.9 → medium, matches NVD).
+- **Go pack (`govulncheck`)** — ndjson findings reference OSV IDs.
+  We now prefer the advisory's embedded severity (govulncheck inlines
+  the full OSV record), only falling back to the OSV.dev API when
+  severity data is missing. Unknown IDs bucket as high (govulncheck's
+  legacy default).
+
+#### Lint severity tiers across all packs
+
+Each language pack now exposes `mapLintSeverity(ruleId)` that tiers
+findings into critical/high/medium/low. `gatherMetrics` still collapses
+to the legacy `lintErrors`/`lintWarnings` fields (critical+high →
+errors, medium+low → warnings) for backcompat.
+
+- **TypeScript (ESLint)** — security plugins (`security/*`,
+  `security-node/*`) and code-injection built-ins (`no-eval`,
+  `no-new-func`, `@typescript-eslint/no-unsafe-eval`) → critical;
+  correctness bugs (`no-undef`, `no-unreachable`, `no-dupe-*`,
+  `@typescript-eslint/no-unsafe-*`, `react-hooks/rules-of-hooks`) → high;
+  best practices (`no-console`, `prefer-const`,
+  `@typescript-eslint/no-explicit-any|no-unused-vars`,
+  `react-hooks/exhaustive-deps`) → medium; style plugins
+  (`prettier/*`, `import/*`, `react/*`, `jsx-a11y/*`, `unicorn/*`) → low.
+  Unknown rules fall back to ESLint's severity floor.
+- **Go (golangci-lint)** — tier by `FromLinter`: `gosec` → critical;
+  `govet`/`staticcheck`/`typecheck`/`errorlint`/`ineffassign`/`unused`/
+  `bodyclose`/`sqlclosecheck`/`noctx` → high; `errcheck`/`gocritic`/
+  `revive`/`gocyclo`/`gosimple`/`unparam`/`gocognit` → medium; `gofmt`/
+  `goimports`/`stylecheck`/`whitespace`/`misspell`/`lll` → low.
+- **Rust (clippy)** — hand-catalogued correctness-group lints:
+  15 memory-safety / UB lints (`uninit_*`, `transmuting_null`, `cast_ref_to_mut`,
+  `invalid_atomic_ordering`, …) → critical; 35+ correctness-bug lints
+  (`panicking_unwrap`, `never_loop`, `out_of_bounds_indexing`,
+  `ifs_same_cond`, `logic_bug`, …) → high; rustc-native lints → medium;
+  all other clippy groups (style, perf, pedantic, nursery, cargo) → low.
+- **C#** — `mapLintSeverity` intentionally omitted: `dotnet-format` is
+  a formatter, not a tiered linter. Documented in pack source with a
+  TODO pointer to a future `dotnet build --verbosity quiet` integration
+  that would extract CS*/CA*/IDE* diagnostic codes.
+
+#### Dep-vuln aggregation across language packs
+
+- **`mergeMetrics` now sums `depVuln*` counts** instead of overwriting.
+  Mixed-stack repos (e.g. Node + Python) previously had whichever pack
+  ran last silently clobber earlier packs' vuln counts. Now pip-audit
+  and npm-audit findings add together. `depAuditTool` likewise joins
+  with `, ` (e.g. `"pip-audit, npm-audit"`).
+- **Meta-tool classifier fix** — `src/analyzers/security/*.ts` files
+  matched `CRITICAL_PATTERNS` by name (`/security/i`) and showed up in
+  test-gaps as critical untested code. They're analyzer modules, not
+  app security code. Added path-prefix exception (`^src/analyzers/`,
+  `^tmp/`, `^scripts/`) that downgrades these to their structural tier.
+- **C# dotnet-format violations** reclassified from `lintErrors` to
+  `lintWarnings` — they're formatting issues (indentation, spacing),
+  not correctness errors. No longer inflates the quality/slop error
+  count.
+
+#### Async language-pack contract
+
+- **`gatherMetrics` is now async** (`Promise<Partial<HealthMetrics>>`).
+  Enables network-dependent enrichment (OSV lookups). The full analyzer
+  chain — `analyzeHealth`, `analyzeQuality`, and the CLI commands —
+  threads async end-to-end. Bonus: the 5 language packs now run through
+  `Promise.all` in health.ts instead of sequentially.
+- **`timedAsync`** helper added alongside existing `timed` in
+  `src/analyzers/tools/timing.ts` for per-tool verbose timing of
+  async gatherers.
+
+### Changed
+
+- **`vitest.config.ts`** now generates Istanbul summary + JSON reporters when
+  `--coverage` is passed. Coverage output in `coverage/`.
+- **Signal precedence in `test-gaps`** — coverage artifact now *overrides*
+  filename match for files it measured. Previously all three signals OR'd
+  together, which wrongly credited files like `cli.ts` when a test had a
+  similar basename but didn't actually import the module. Now: artifact
+  authoritative where present, import-graph for files it didn't see,
+  filename-match as last resort.
+- **`.husky/pre-push`** — now runs `npm run build && vitest run --coverage &&
+  bash scripts/check-coverage.sh`. Previously ran `vitest run --changed @{u}`
+  without coverage.
+- **`--json` output** — clean JSON on stdout now. Previously the logger
+  header (`━━━ vyuh-dxkit ...`) leaked into stdout before the JSON payload.
+
+### Fixed
+
+- **`--json` stdout pollution** — `logger.header/info/success/warn/fail/dim/
+  detected` route to stderr when JSON mode is active.
+- **Filename matcher false positives** — `cli-init.test.ts` used to credit
+  `cli.ts` via basename similarity even though it doesn't import it in
+  process (uses `execFileSync`). After the precedence fix and import-graph
+  matcher, dxkit's `test-gaps` agrees with V8 on every measured file.
+- **Unused import warnings** — cleaned up six pre-existing unused imports
+  that CI's `--max-warnings 0` would now catch.
+
+### Internal / Architecture
+
+- New modules: `src/analyzers/tools/coverage.ts`, `tools/suppressions.ts`,
+  `tests/import-graph.ts`.
+- `HealthMetrics.coveragePercent` now populated from the imported artifact
+  when present; the existing Testing-dimension coverage bonus fires against
+  line-level truth instead of being null.
+- `HealthMetrics.secretSuppressed` — count of gitleaks findings filtered by
+  `.dxkit-suppressions.json`.
+- `ToolDefinition.nodePackage` — optional field for Node packages detected
+  via `node_modules/<pkg>/package.json` rather than a binary in `.bin`.
+- `vitest.integration.config.ts` — separate config for running only the
+  `test/integration/**` suite (kept for developers who want to run the slow
+  integration tests without the rest of the suite).
+
 ## [1.5.1] - 2026-04-10
 
 ### Fixed