@vyuhlabs/dxkit 1.6.1 → 2.0.1

package/dist/analyzers/tools/go.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherGoMetrics = gatherGoMetrics;
+const runner_1 = require("./runner");
+const tool_registry_1 = require("./tool-registry");
+/** Gather Go-specific metrics. */
+function gatherGoMetrics(cwd) {
+    const metrics = {
+        toolsUsed: [],
+        toolsUnavailable: [],
+    };
+    // golangci-lint
+    const lint = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['golangci-lint'], cwd);
+    if (lint.available && lint.path) {
+        const raw = (0, runner_1.run)(`${lint.path} run --out-format json ./... 2>/dev/null`, cwd, 120000);
+        if (raw) {
+            try {
+                const data = JSON.parse(raw);
+                const issues = data.Issues || [];
+                const errors = issues.filter((i) => i.Severity === 'error').length;
+                const warnings = issues.length - errors;
+                metrics.lintErrors = errors;
+                metrics.lintWarnings = warnings;
+                metrics.lintTool = 'golangci-lint';
+                metrics.toolsUsed.push('golangci-lint');
+            }
+            catch {
+                metrics.toolsUnavailable.push('golangci-lint (parse error)');
+            }
+        }
+        else {
+            // Empty = no issues
+            metrics.lintErrors = 0;
+            metrics.lintWarnings = 0;
+            metrics.lintTool = 'golangci-lint';
+            metrics.toolsUsed.push('golangci-lint');
+        }
+    }
+    else {
+        metrics.toolsUnavailable.push('golangci-lint');
+    }
+    // govulncheck
+    const vuln = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.govulncheck, cwd);
+    if (vuln.available && vuln.path) {
+        const raw = (0, runner_1.run)(`${vuln.path} -json ./... 2>/dev/null`, cwd, 120000);
+        if (raw) {
+            try {
+                // govulncheck JSON is newline-delimited JSON objects
+                let vulnCount = 0;
+                for (const line of raw.split('\n')) {
+                    if (!line.trim())
+                        continue;
+                    try {
+                        const obj = JSON.parse(line);
+                        if (obj.finding)
+                            vulnCount++;
+                    }
+                    catch {
+                        /* skip non-JSON lines */
+                    }
+                }
+                // govulncheck doesn't provide severity breakdown — count all as high
+                metrics.depVulnHigh = vulnCount;
+                metrics.depVulnCritical = 0;
+                metrics.depVulnMedium = 0;
+                metrics.depVulnLow = 0;
+                metrics.depAuditTool = 'govulncheck';
+                metrics.toolsUsed.push('govulncheck');
+            }
+            catch {
+                metrics.toolsUnavailable.push('govulncheck (parse error)');
+            }
+        }
+    }
+    else {
+        metrics.toolsUnavailable.push('govulncheck');
+    }
+    // Test framework detection
+    if ((0, runner_1.fileExists)(cwd, 'go.mod')) {
+        metrics.testFramework = 'go-test';
+    }
+    return metrics;
+}
+//# sourceMappingURL=go.js.map

package/dist/analyzers/tools/go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.js","sourceRoot":"","sources":["../../../src/analyzers/tools/go.ts"],"names":[],"mappings":";;AAkBA,0CAwEC;AArFD,qCAA2C;AAC3C,mDAAsD;AAWtD,kCAAkC;AAClC,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAA2B;QACtC,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,EAAE;KACrB,CAAC;IAEF,gBAAgB;IAChB,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,IAAI,CAAC,IAAI,0CAA0C,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACrF,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;gBACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBACxC,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC;gBAC5B,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC;gBAChC,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC;gBACnC,OAAO,CAAC,SAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oBAAoB;YACpB,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;YACvB,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;YACzB,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC;YACnC,OAAO,CAAC,SAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IAED,cAAc;IACd,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,IAAI,CAAC,IAAI,0BAA0B,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,qDAAqD;gBACrD,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;wBAAE,SAAS;oBAC3B,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBAC7B,IAAI,GAAG,CAAC,OAAO;4BAAE,SAAS,EAAE,CAAC;oBAC/B,CAAC;oBAAC,MAAM,CAAC;wBACP,yBAAyB;oBAC3B,CAAC;gBACH,CAAC;gBACD,qEAAqE;gBACrE,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;gBAChC,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC;gBAC5B,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;gBAC1B,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;gBACvB,OAAO,CAAC,YAAY,GAAG,aAAa,CAAC;gBACrC,OAAO,CAAC,SAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC;IAED,2BAA2B;IAC3B,IAAI,IAAA,mBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IACpC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/analyzers/tools/graphify.d.ts

@@ -1,4 +1,32 @@
-import { HealthMetrics } from '../types';
-/** Gather AST-derived metrics via graphify. */
-export declare function gatherGraphifyMetrics(cwd: string): Partial<HealthMetrics>;
+import type { CapabilityProvider } from '../../languages/capabilities/provider';
+import type { StructuralResult } from '../../languages/capabilities/types';
+/**
+ * Outcome union mirrors the other global wrappers (gitleaks, semgrep,
+ * jscpd). The capability provider collapses this to `StructuralResult
+ * | null`; the Layer 2 reshape in `tools/parallel.ts` reads
+ * `unavailable.reason` so `toolsUnavailable` surfaces the precise
+ * failure mode (`graphify (not installed)`, `graphify (failed to run)`,
+ * `graphify (parse error)`, …).
+ */
+export type StructuralGatherOutcome = {
+    kind: 'success';
+    envelope: StructuralResult;
+} | {
+    kind: 'unavailable';
+    reason: string;
+};
+/**
+ * Single source of truth for the graphify subprocess invocation.
+ * Consumed by `graphifyProvider` (capability dispatcher) and by the
+ * Layer 2 legacy reshape in `tools/parallel.ts` — both paths share the
+ * memoized per-cwd outcome so graphify shells out at most once per
+ * analyzer run.
+ */
+export declare function gatherGraphifyResult(cwd: string): StructuralGatherOutcome;
+/**
+ * Capability-shaped provider. Register in
+ * `src/languages/capabilities/global.ts:GLOBAL_CAPABILITIES.structural`
+ * so the dispatcher picks it up via `providersFor(STRUCTURAL)`.
+ */
+export declare const graphifyProvider: CapabilityProvider<StructuralResult>;
 //# sourceMappingURL=graphify.d.ts.map

package/dist/analyzers/tools/graphify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphify.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyIzC,+CAA+C;AAC/C,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAqDzE"}
+{"version":3,"file":"graphify.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAsI3E;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAa5C;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CAMzE;AAkDD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,kBAAkB,CAAC,gBAAgB,CAMjE,CAAC"}

package/dist/analyzers/tools/graphify.js

@@ -33,13 +33,22 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.gatherGraphifyMetrics = gatherGraphifyMetrics;
+exports.graphifyProvider = void 0;
+exports.gatherGraphifyResult = gatherGraphifyResult;
 /**
- * Graphify integration -- deterministic AST extraction via tree-sitter.
+ * Graphify integration — deterministic AST extraction via tree-sitter.
  * Layer 2 (optional): requires `pip install graphifyy`.
  *
- * Runs graphify's Python API via subprocess, parses structured JSON output.
- * All metrics are derived from EXTRACTED confidence edges only (no LLM).
+ * Exposes one gather helper — `gatherGraphifyResult(cwd)` — returning a
+ * typed outcome with either a `StructuralResult` envelope or the reason
+ * extraction was skipped. Consumed by the capability provider
+ * (`graphifyProvider`) and by the Layer 2 legacy-field reshape path in
+ * `tools/parallel.ts`. Memoized per-cwd so both callers share one
+ * invocation per analyzer run.
+ *
+ * Known flake (Phase 10f.2): `/tmp/graphify-venv` race + `/tmp`
+ * cleanup kills graphify ~50% of runs. Separate behavioral fix; this
+ * file's structure is unaffected.
  */
 const fs = __importStar(require("fs"));
 const runner_1 = require("./runner");
@@ -162,14 +171,35 @@ print(json.dumps({
 }))
 `;
 }
-/** Gather AST-derived metrics via graphify. */
-function gatherGraphifyMetrics(cwd) {
-    // findPython already verifies graphify is importable
+/**
+ * Per-cwd memoization of the graphify outcome. Graphify is the heaviest
+ * external tool dxkit shells out to (~10-60s depending on repo size);
+ * memoizing ensures the Layer 2 reshape path + the capability
+ * dispatcher's `graphifyProvider` share one invocation per analyzer run.
+ *
+ * Same constraints as the gitleaks cache: module-scoped, no automatic
+ * invalidation, safe for the one-shot CLI shape.
+ */
+const graphifyOutcomeCache = new Map();
+/**
+ * Single source of truth for the graphify subprocess invocation.
+ * Consumed by `graphifyProvider` (capability dispatcher) and by the
+ * Layer 2 legacy reshape in `tools/parallel.ts` — both paths share the
+ * memoized per-cwd outcome so graphify shells out at most once per
+ * analyzer run.
+ */
+function gatherGraphifyResult(cwd) {
+    const cached = graphifyOutcomeCache.get(cwd);
+    if (cached)
+        return cached;
+    const outcome = computeGraphifyOutcome(cwd);
+    graphifyOutcomeCache.set(cwd, outcome);
+    return outcome;
+}
+function computeGraphifyOutcome(cwd) {
     const pythonCmd = findPython(cwd);
-    if (!pythonCmd) {
-        return { toolsUnavailable: ['graphify (not installed)'] };
-    }
-    // Write script to temp file to avoid shell escaping issues
+    if (!pythonCmd)
+        return { kind: 'unavailable', reason: 'not installed' };
     const scriptPath = `/tmp/dxkit-graphify-${Date.now()}.py`;
     fs.writeFileSync(scriptPath, buildGraphifyScript(cwd));
     // Redirect stderr to suppress progress output, run from /tmp to avoid writing to target
@@ -180,40 +210,52 @@ function gatherGraphifyMetrics(cwd) {
     catch {
         /* ignore */
     }
-    if (!output) {
-        return { toolsUnavailable: ['graphify (failed to run)'] };
-    }
-    // Graphify prints progress to stdout before the JSON — extract only the JSON line
+    if (!output)
+        return { kind: 'unavailable', reason: 'failed to run' };
+    // Graphify prints progress to stdout before the JSON — extract only the JSON line.
     const jsonLine = output
         .split('\n')
         .filter((l) => l.startsWith('{'))
         .pop();
-    if (!jsonLine) {
-        return { toolsUnavailable: ['graphify (no JSON output)'] };
-    }
+    if (!jsonLine)
+        return { kind: 'unavailable', reason: 'no JSON output' };
+    let data;
     try {
-        const data = JSON.parse(jsonLine);
-        if (data.error) {
-            return { toolsUnavailable: [`graphify (${data.error})`] };
-        }
-        return {
-            functionCount: data.functionCount,
-            classCount: data.classCount,
-            maxFunctionsInFile: data.maxFunctionsInFile,
-            maxFunctionsFilePath: data.maxFunctionsFilePath,
-            godNodeCount: data.godNodeCount,
-            communityCount: data.communityCount,
-            avgCohesion: data.avgCohesion,
-            orphanModuleCount: data.orphanModuleCount,
-            deadImportCount: data.deadImportCount,
-            commentedCodeRatio: data.commentedCodeRatio,
-            toolsUsed: ['graphify'],
-        };
+        data = JSON.parse(jsonLine);
     }
     catch {
-        return { toolsUnavailable: ['graphify (parse error)'] };
+        return { kind: 'unavailable', reason: 'parse error' };
     }
+    if (data.error)
+        return { kind: 'unavailable', reason: data.error };
+    const envelope = {
+        schemaVersion: 1,
+        tool: 'graphify',
+        functionCount: data.functionCount,
+        classCount: data.classCount,
+        maxFunctionsInFile: data.maxFunctionsInFile,
+        maxFunctionsFilePath: data.maxFunctionsFilePath,
+        godNodeCount: data.godNodeCount,
+        communityCount: data.communityCount,
+        avgCohesion: data.avgCohesion,
+        orphanModuleCount: data.orphanModuleCount,
+        deadImportCount: data.deadImportCount,
+        commentedCodeRatio: data.commentedCodeRatio,
+    };
+    return { kind: 'success', envelope };
 }
+/**
+ * Capability-shaped provider. Register in
+ * `src/languages/capabilities/global.ts:GLOBAL_CAPABILITIES.structural`
+ * so the dispatcher picks it up via `providersFor(STRUCTURAL)`.
+ */
+exports.graphifyProvider = {
+    source: 'graphify',
+    async gather(cwd) {
+        const outcome = gatherGraphifyResult(cwd);
+        return outcome.kind === 'success' ? outcome.envelope : null;
+    },
+};
 /** Find a working python3 that has graphify installed. Delegates to tool-registry. */
 function findPython(cwd) {
     const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.graphify, cwd);

package/dist/analyzers/tools/graphify.js.map

@@ -1 +1 @@
-{"version":3,"file":"graphify.js","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkJA,sDAqDC;AAvMD;;;;;;GAMG;AACH,uCAAyB;AAEzB,qCAA+B;AAC/B,mDAAsD;AACtD,6CAAmD;AAgBnD,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;iBAoBQ,IAAA,gCAAmB,EAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FxC,CAAC;AACF,CAAC;AAED,+CAA+C;AAC/C,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,qDAAqD;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,gBAAgB,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,2DAA2D;IAC3D,MAAM,UAAU,GAAG,uBAAuB,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,wFAAwF;IACxF,MAAM,MAAM,GAAG,IAAA,YAAG,EAAC,cAAc,SAAS,KAAK,UAAU,MAAM,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,gBAAgB,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,kFAAkF;IAClF,MAAM,QAAQ,GAAG,MAAM;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAChC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,gBAAgB,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwC,CAAC;QACzE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,gBAAgB,EAAE,CAAC,aAAa,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,SAAS,EAAE,CAAC,UAAU,CAAC;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"graphify.js","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwLA,oDAMC;AA9LD;;;;;;;;;;;;;;GAcG;AACH,uCAAyB;AACzB,qCAA+B;AAC/B,mDAAsD;AACtD,6CAAmD;AAkBnD,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;iBAoBQ,IAAA,gCAAmB,EAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FxC,CAAC;AACF,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmC,CAAC;AAExE;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAExE,MAAM,UAAU,GAAG,uBAAuB,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,wFAAwF;IACxF,MAAM,MAAM,GAAG,IAAA,YAAG,EAAC,cAAc,SAAS,KAAK,UAAU,MAAM,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAErE,mFAAmF;IACnF,MAAM,QAAQ,GAAG,MAAM;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAChC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExE,IAAI,IAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAEnE,MAAM,QAAQ,GAAqB;QACjC,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACU,QAAA,gBAAgB,GAAyC;IACpE,MAAM,EAAE,UAAU;IAClB,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC;AAEF,sFAAsF;AACtF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC"}

package/dist/analyzers/tools/grep-secrets.d.ts

@@ -0,0 +1,6 @@
+import type { CapabilityProvider } from '../../languages/capabilities/provider';
+import type { SecretsResult } from '../../languages/capabilities/types';
+/** Scan source files for the fallback patterns. Returns null when gitleaks is installed. */
+export declare function gatherGrepSecretsResult(cwd: string): SecretsResult | null;
+export declare const grepSecretsProvider: CapabilityProvider<SecretsResult>;
+//# sourceMappingURL=grep-secrets.d.ts.map

package/dist/analyzers/tools/grep-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grep-secrets.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/grep-secrets.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,oCAAoC,CAAC;AA0BvF,4FAA4F;AAC5F,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAkDzE;AAED,eAAO,MAAM,mBAAmB,EAAE,kBAAkB,CAAC,aAAa,CAKjE,CAAC"}

package/dist/analyzers/tools/grep-secrets.js

@@ -0,0 +1,124 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.grepSecretsProvider = void 0;
+exports.gatherGrepSecretsResult = gatherGrepSecretsResult;
+/**
+ * Grep-based secret scanner — the 7-pattern fallback that runs when
+ * gitleaks is unavailable. Re-registered under `GLOBAL_CAPABILITIES.secrets`
+ * in Phase 10e.C.7.5 after `generic.ts`'s legacy Layer-0 equivalent was
+ * deleted alongside the capability-owned `HealthMetrics.secretDetails`.
+ *
+ * When gitleaks IS available, this provider returns null — gitleaks's
+ * 800+ rules are a strict superset, and running both would double-count
+ * overlapping matches (AWS keys, GitHub tokens, Anthropic keys). The
+ * SECRETS descriptor aggregate unions findings, so a null from this
+ * provider simply yields to gitleaks. That mirrors pre-C.7 behavior
+ * exactly: gitleaks dominates when installed, grep carries the signal
+ * when it isn't.
+ */
+const path = __importStar(require("path"));
+const runner_1 = require("./runner");
+const tool_registry_1 = require("./tool-registry");
+const exclusions_1 = require("./exclusions");
+const paths_1 = require("./paths");
+const suppressions_1 = require("./suppressions");
+/**
+ * Seven patterns that catch the most common hardcoded-secret shapes.
+ * Mirrors the set that lived in `generic.ts` pre-C.7, with identical
+ * rule IDs so downstream reports stay stable.
+ */
+const PATTERNS = [
+    { pattern: 'password[[:space:]]*[:=]', rule: 'hardcoded-password' },
+    { pattern: 'api[_-]?key[[:space:]]*[:=]', rule: 'hardcoded-api-key' },
+    { pattern: 'secret[[:space:]]*[:=]', rule: 'hardcoded-secret' },
+    { pattern: 'BEGIN.*PRIVATE KEY', rule: 'private-key-in-source' },
+    { pattern: 'AKIA[0-9A-Z]{16}', rule: 'aws-access-key' },
+    { pattern: 'ghp_[a-zA-Z0-9]{36}', rule: 'github-token' },
+    { pattern: 'sk-ant-[a-zA-Z0-9]', rule: 'anthropic-api-key' },
+];
+function severityFor(rule) {
+    return rule.includes('private-key') || rule.includes('password') ? 'critical' : 'high';
+}
+/** Scan source files for the fallback patterns. Returns null when gitleaks is installed. */
+function gatherGrepSecretsResult(cwd) {
+    // Yield to gitleaks — superset coverage, no point running both. When
+    // gitleaks is absent `findTool` returns `available: false` and we proceed
+    // with the fallback scan.
+    const gitleaks = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.gitleaks, cwd);
+    if (gitleaks.available)
+        return null;
+    const excludes = (0, exclusions_1.getGrepExcludeDirFlags)(cwd);
+    const includeFlags = "--include='*.ts' --include='*.tsx' --include='*.js' --include='*.py' --include='*.go'";
+    const raw = [];
+    for (const sp of PATTERNS) {
+        // Single-quoted pattern + -E for extended regex. Per the feedback memory.
+        const output = (0, runner_1.run)(`grep -rnE '${sp.pattern}' ${includeFlags} ${excludes} . 2>/dev/null | head -50`, cwd);
+        if (!output)
+            continue;
+        for (const line of output.split('\n').filter((l) => l.trim())) {
+            // Format: ./relative/path:lineno:matched-text
+            const match = line.match(/^\.\/(.+?):(\d+):/);
+            if (!match)
+                continue;
+            const file = (0, paths_1.toProjectRelative)(cwd, path.join(cwd, match[1]));
+            if ((0, exclusions_1.isExcludedPath)(cwd, file))
+                continue;
+            raw.push({
+                file,
+                line: parseInt(match[2], 10),
+                rule: sp.rule,
+                severity: severityFor(sp.rule),
+            });
+        }
+    }
+    // Apply `.dxkit-suppressions.json` under the same key gitleaks uses, so
+    // a repo's existing suppressions cover both scanners.
+    const suppressions = (0, suppressions_1.loadSuppressions)(cwd);
+    const { kept, suppressed } = (0, suppressions_1.applySuppressions)(raw, suppressions.gitleaks, (d) => d.rule, (d) => d.file);
+    return {
+        schemaVersion: 1,
+        tool: 'grep-secrets',
+        findings: kept,
+        suppressedCount: suppressed.length,
+    };
+}
+exports.grepSecretsProvider = {
+    source: 'grep-secrets',
+    async gather(cwd) {
+        return gatherGrepSecretsResult(cwd);
+    },
+};
+//# sourceMappingURL=grep-secrets.js.map

package/dist/analyzers/tools/grep-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grep-secrets.js","sourceRoot":"","sources":["../../../src/analyzers/tools/grep-secrets.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,0DAkDC;AAlGD;;;;;;;;;;;;;GAaG;AACH,2CAA6B;AAC7B,qCAA+B;AAC/B,mDAAsD;AACtD,6CAAsE;AACtE,mCAA4C;AAC5C,iDAAqE;AASrE;;;;GAIG;AACH,MAAM,QAAQ,GAAkB;IAC9B,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACnE,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACrE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC/D,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAChE,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvD,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE;IACxD,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE;CAC7D,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;AACzF,CAAC;AAED,4FAA4F;AAC5F,SAAgB,uBAAuB,CAAC,GAAW;IACjD,qEAAqE;IACrE,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,IAAA,mCAAsB,EAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,YAAY,GAChB,uFAAuF,CAAC;IAE1F,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAA,YAAG,EAChB,cAAc,EAAE,CAAC,OAAO,KAAK,YAAY,IAAI,QAAQ,2BAA2B,EAChF,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,8CAA8C;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,IAAI,GAAG,IAAA,yBAAiB,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,IAAA,2BAAc,EAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,SAAS;YACxC,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI;gBACJ,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,sDAAsD;IACtD,MAAM,YAAY,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAA,gCAAiB,EAC5C,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EACb,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,IAAI;QACd,eAAe,EAAE,UAAU,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC;AAEY,QAAA,mBAAmB,GAAsC;IACpE,MAAM,EAAE,cAAc;IACtB,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;CACF,CAAC"}

package/dist/analyzers/tools/jscpd.d.ts

@@ -0,0 +1,40 @@
+/**
+ * jscpd integration — duplicate-code detection.
+ *
+ * The `jscpdProvider` is registered in `GLOBAL_CAPABILITIES.duplication`
+ * (src/languages/capabilities/global.ts). jscpd runs once per repo with
+ * a fixed source-file pattern and respects the project's `.gitignore`
+ * via the `--gitignore` flag — crucial on large repos, jscpd without
+ * it walks into `node_modules` and OOMs.
+ *
+ * The source-file pattern is cross-language (all five packs' extensions
+ * in one glob). jscpd's tokenizer is language-aware so this is safe;
+ * keeping the pattern declared here rather than per-pack avoids five
+ * separate jscpd invocations on mixed-stack repos.
+ */
+import type { CapabilityProvider } from '../../languages/capabilities/provider';
+import type { DuplicationResult } from '../../languages/capabilities/types';
+/**
+ * Outcome union mirrors the other global wrappers (gitleaks, semgrep,
+ * graphify). Collapses to `DuplicationResult | null` at the provider
+ * level; keeping the `unavailable.reason` at this level lets internal
+ * callers distinguish install-missing from parse-failure if needed.
+ */
+export type DuplicationGatherOutcome = {
+    kind: 'success';
+    envelope: DuplicationResult;
+} | {
+    kind: 'unavailable';
+    reason: string;
+};
+/**
+ * Single source of truth for the jscpd invocation. Consumed by
+ * `jscpdProvider` (capability dispatcher).
+ */
+export declare function gatherJscpdResult(cwd: string): DuplicationGatherOutcome;
+/**
+ * Capability-shaped provider. Registered in
+ * `src/languages/capabilities/global.ts:GLOBAL_CAPABILITIES.duplication`.
+ */
+export declare const jscpdProvider: CapabilityProvider<DuplicationResult>;
+//# sourceMappingURL=jscpd.d.ts.map

package/dist/analyzers/tools/jscpd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jscpd.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/jscpd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAoB,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAsB9F;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAgC5C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAqCvE;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,kBAAkB,CAAC,iBAAiB,CAM/D,CAAC"}

package/dist/analyzers/tools/jscpd.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * jscpd integration — duplicate-code detection.
+ *
+ * The `jscpdProvider` is registered in `GLOBAL_CAPABILITIES.duplication`
+ * (src/languages/capabilities/global.ts). jscpd runs once per repo with
+ * a fixed source-file pattern and respects the project's `.gitignore`
+ * via the `--gitignore` flag — crucial on large repos, jscpd without
+ * it walks into `node_modules` and OOMs.
+ *
+ * The source-file pattern is cross-language (all five packs' extensions
+ * in one glob). jscpd's tokenizer is language-aware so this is safe;
+ * keeping the pattern declared here rather than per-pack avoids five
+ * separate jscpd invocations on mixed-stack repos.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jscpdProvider = void 0;
+exports.gatherJscpdResult = gatherJscpdResult;
+const runner_1 = require("./runner");
+const tool_registry_1 = require("./tool-registry");
+/**
+ * Union of source extensions across all language packs. A union pattern
+ * rather than per-pack invocation so mixed-stack repos (Node + Python)
+ * pay for one jscpd run, not N. Adding a language's extensions here is
+ * the one cross-cutting edit needed when registering a new pack.
+ */
+const JSCPD_PATTERN = '**/*.{ts,tsx,js,jsx,py,go,rs,cs}';
+/** Extract the top N clone pairs sorted largest-first. */
+function topClonesFrom(duplicates, limit = 15) {
+    return duplicates
+        .filter((d) => d.firstFile?.name && d.secondFile?.name && d.lines)
+        .map((d) => ({
+        lines: d.lines || 0,
+        tokens: d.tokens || 0,
+        a: {
+            file: d.firstFile.name,
+            startLine: d.firstFile.start || 0,
+            endLine: d.firstFile.end || 0,
+        },
+        b: {
+            file: d.secondFile.name,
+            startLine: d.secondFile.start || 0,
+            endLine: d.secondFile.end || 0,
+        },
+    }))
+        .sort((x, y) => y.lines - x.lines)
+        .slice(0, limit);
+}
+/**
+ * Single source of truth for the jscpd invocation. Consumed by
+ * `jscpdProvider` (capability dispatcher).
+ */
+function gatherJscpdResult(cwd) {
+    const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.jscpd, cwd);
+    if (!status.available || !status.path)
+        return { kind: 'unavailable', reason: 'not installed' };
+    const reportDir = `/tmp/dxkit-jscpd-${Date.now()}`;
+    (0, runner_1.run)(`${status.path} --reporters json --output '${reportDir}' --gitignore --pattern '${JSCPD_PATTERN}' --min-lines 5 --min-tokens 50 '${cwd}' > /dev/null 2>&1`, cwd, 300000);
+    const reportRaw = (0, runner_1.run)(`cat '${reportDir}/jscpd-report.json' 2>/dev/null`, cwd);
+    (0, runner_1.run)(`rm -rf '${reportDir}'`, cwd);
+    if (!reportRaw)
+        return { kind: 'unavailable', reason: 'no output' };
+    let data;
+    try {
+        data = JSON.parse(reportRaw);
+    }
+    catch {
+        return { kind: 'unavailable', reason: 'parse error' };
+    }
+    const t = data.statistics?.total;
+    if (!t)
+        return { kind: 'unavailable', reason: 'no total stats' };
+    const duplicates = data.duplicates || [];
+    const envelope = {
+        schemaVersion: 1,
+        tool: 'jscpd',
+        totalLines: t.lines,
+        duplicatedLines: t.duplicatedLines,
+        percentage: Math.round(t.percentage * 100) / 100,
+        cloneCount: duplicates.length,
+        topClones: topClonesFrom(duplicates),
+    };
+    return { kind: 'success', envelope };
+}
+/**
+ * Capability-shaped provider. Registered in
+ * `src/languages/capabilities/global.ts:GLOBAL_CAPABILITIES.duplication`.
+ */
+exports.jscpdProvider = {
+    source: 'jscpd',
+    async gather(cwd) {
+        const outcome = gatherJscpdResult(cwd);
+        return outcome.kind === 'success' ? outcome.envelope : null;
+    },
+};
+//# sourceMappingURL=jscpd.js.map

package/dist/analyzers/tools/jscpd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jscpd.js","sourceRoot":"","sources":["../../../src/analyzers/tools/jscpd.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAqEH,8CAqCC;AAtGD,qCAA+B;AAC/B,mDAAsD;AA8BtD;;;;;GAKG;AACH,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,0DAA0D;AAC1D,SAAS,aAAa,CAAC,UAA+B,EAAE,KAAK,GAAG,EAAE;IAChE,OAAO,UAAU;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC;QACrB,CAAC,EAAE;YACD,IAAI,EAAE,CAAC,CAAC,SAAU,CAAC,IAAK;YACxB,SAAS,EAAE,CAAC,CAAC,SAAU,CAAC,KAAK,IAAI,CAAC;YAClC,OAAO,EAAE,CAAC,CAAC,SAAU,CAAC,GAAG,IAAI,CAAC;SAC/B;QACD,CAAC,EAAE;YACD,IAAI,EAAE,CAAC,CAAC,UAAW,CAAC,IAAK;YACzB,SAAS,EAAE,CAAC,CAAC,UAAW,CAAC,KAAK,IAAI,CAAC;YACnC,OAAO,EAAE,CAAC,CAAC,UAAW,CAAC,GAAG,IAAI,CAAC;SAChC;KACF,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnD,IAAA,YAAG,EACD,GAAG,MAAM,CAAC,IAAI,+BAA+B,SAAS,4BAA4B,aAAa,oCAAoC,GAAG,oBAAoB,EAC1J,GAAG,EACH,MAAM,CACP,CAAC;IAEF,MAAM,SAAS,GAAG,IAAA,YAAG,EAAC,QAAQ,SAAS,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAC/E,IAAA,YAAG,EAAC,WAAW,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEpE,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAEjE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAsB;QAClC,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,CAAC,CAAC,KAAK;QACnB,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,GAAG;QAChD,UAAU,EAAE,UAAU,CAAC,MAAM;QAC7B,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC;KACrC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACU,QAAA,aAAa,GAA0C;IAClE,MAAM,EAAE,OAAO;IACf,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC"}

package/dist/analyzers/tools/node.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Node.js tool runner -- eslint, npm audit, test runners.
+ * Layer 1 (project tools) + Layer 2 (optional tools).
+ */
+import { HealthMetrics } from '../types';
+/** Gather Node.js-specific metrics. */
+export declare function gatherNodeMetrics(cwd: string): Partial<HealthMetrics>;
+//# sourceMappingURL=node.d.ts.map

package/dist/analyzers/tools/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiBzC,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwFrE"}