@vyuhlabs/dxkit 2.4.4 → 2.4.6

package/dist/analyzers/tools/jacoco.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseJaCoCoXml = parseJaCoCoXml;
+exports.findJaCoCoReport = findJaCoCoReport;
+exports.gatherJaCoCoCoverageResult = gatherJaCoCoCoverageResult;
+/**
+ * JaCoCo XML report parser + standard-location finder. Shared across
+ * JVM-language packs (kotlin, java) — single source of truth per
+ * CLAUDE.md rule #2 ("Each tool has ONE gather function … if another
+ * module needs that tool's output, it MUST call the existing
+ * function").
+ *
+ * Extracted from `src/languages/kotlin.ts` in 10k.1.2 (Phase 10k.1
+ * SSOT validation) — when the Java pack needed JaCoCo coverage, the
+ * parser was already generic (kotlin's own tests cover it against
+ * Java source, see test/languages-kotlin.test.ts). Forking would
+ * have been the architectural violation; relocating to a shared
+ * tool module is the correct outcome.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const coverage_1 = require("./coverage");
+/**
+ * Pure parser for JaCoCo's XML report (DTD: `report.dtd`). The structure:
+ *
+ *   <report name="...">
+ *     <package name="com/example">
+ *       <class name="com/example/Foo" sourcefilename="Foo.kt">...</class>
+ *       <sourcefile name="Foo.kt">
+ *         <line nr="N" mi="..." ci="..." mb="..." cb="..."/>
+ *         <counter type="LINE" missed="X" covered="Y"/>
+ *       </sourcefile>
+ *       <counter type="LINE" missed="X" covered="Y"/>
+ *     </package>
+ *     <counter type="LINE" missed="X" covered="Y"/>
+ *   </report>
+ *
+ * Per-file coverage comes from `<sourcefile>` blocks: their LINE counter
+ * holds the file's missed/covered totals. Project-level total comes from
+ * the top-level `<counter type="LINE">` (last in the document).
+ *
+ * Path attribution joins `<package name>` (forward-slashed, JVM-style)
+ * with `<sourcefile name>` to produce the canonical relative path the
+ * downstream consumers expect (`com/example/Foo.kt` or
+ * `com/example/Foo.java`). JVM bytecode namespacing isn't 1:1 with
+ * on-disk source paths in multi-module projects — accepted limitation
+ * (matches C#'s cobertura attribution).
+ *
+ * Returns null when no `<counter type="LINE">` exists at the top level
+ * — that's JaCoCo's "no coverage data" signal, distinct from "0%
+ * coverage" (where the counter exists with covered=0).
+ *
+ * Language-agnostic: works for Kotlin (.kt), Java (.java), and any
+ * other JVM language whose JaCoCo output respects the `<package>` /
+ * `<sourcefile>` shape — `<sourcefile name>` carries the on-disk
+ * filename verbatim so the parser doesn't need to know the language.
+ */
+function parseJaCoCoXml(raw, sourceFile, _cwd) {
+    const files = new Map();
+    // Iterate <package> blocks. Each block contains <sourcefile> children
+    // we tally and aggregate counters we can ignore (they're sums of the
+    // children, redundant given we sum the children ourselves).
+    const packageRe = /<package\s+name="([^"]+)">([\s\S]*?)<\/package>/g;
+    let pm;
+    while ((pm = packageRe.exec(raw)) !== null) {
+        const pkgPath = pm[1].replace(/\\/g, '/'); // JVM uses forward-slashes already; defensive
+        const pkgInner = pm[2];
+        // Within a <package>, <sourcefile> blocks own per-file counters.
+        const sourceFileRe = /<sourcefile\s+name="([^"]+)">([\s\S]*?)<\/sourcefile>/g;
+        let sm;
+        while ((sm = sourceFileRe.exec(pkgInner)) !== null) {
+            const fileName = sm[1];
+            const sourceInner = sm[2];
+            // The LAST <counter type="LINE"> in <sourcefile> is the
+            // file-level aggregate; earlier ones are per-method. We pick the
+            // last to get the full-file roll-up.
+            const counterRe = /<counter\s+type="LINE"\s+missed="(\d+)"\s+covered="(\d+)"\s*\/>/g;
+            let lastMissed = 0;
+            let lastCovered = 0;
+            let cm;
+            while ((cm = counterRe.exec(sourceInner)) !== null) {
+                lastMissed = parseInt(cm[1], 10);
+                lastCovered = parseInt(cm[2], 10);
+            }
+            const total = lastMissed + lastCovered;
+            const rel = pkgPath ? `${pkgPath}/${fileName}` : fileName;
+            files.set(rel, {
+                path: rel,
+                covered: lastCovered,
+                total,
+                pct: (0, coverage_1.round1)(total > 0 ? (lastCovered / total) * 100 : 0),
+            });
+        }
+    }
+    // Top-level project-wide LINE counter — JaCoCo emits it after the
+    // last </package>. Use a non-greedy match against the document tail
+    // to avoid grabbing per-package counters as project-level.
+    const tailMatch = raw.match(/<\/package>\s*<counter\s+type="LINE"\s+missed="(\d+)"\s+covered="(\d+)"\s*\/>\s*<\/report>/);
+    let totalMissed = 0;
+    let totalCovered = 0;
+    if (tailMatch) {
+        totalMissed = parseInt(tailMatch[1], 10);
+        totalCovered = parseInt(tailMatch[2], 10);
+    }
+    else {
+        // No project-level counter (degenerate report — single package, no
+        // explicit roll-up). Sum the per-file totals as the linePercent
+        // basis.
+        for (const f of files.values()) {
+            totalCovered += f.covered;
+            totalMissed += f.total - f.covered;
+        }
+    }
+    const grandTotal = totalCovered + totalMissed;
+    if (grandTotal === 0 && files.size === 0)
+        return null;
+    return {
+        source: 'jacoco',
+        sourceFile,
+        linePercent: (0, coverage_1.round1)(grandTotal > 0 ? (totalCovered / grandTotal) * 100 : 0),
+        files,
+    };
+}
+/**
+ * Standard JaCoCo report locations across JVM build tools and project
+ * layouts:
+ *
+ *   GRADLE (kotlin + java):
+ *   - app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
+ *     (Android default — `app` module, `jacocoTestReport` task)
+ *   - build/reports/jacoco/test/jacocoTestReport.xml
+ *     (plain JVM via the `jacoco` plugin's default `test` task)
+ *   - build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
+ *     (multi-module aggregate; many builds rename the task)
+ *
+ *   MAVEN (java):
+ *   - target/site/jacoco/jacoco.xml
+ *     (default Maven JaCoCo plugin — single-module Java)
+ *   - target/site/jacoco-aggregate/jacoco.xml
+ *     (Maven multi-module aggregate via jacoco-maven-plugin's
+ *     `report-aggregate` goal)
+ *
+ *   FALLBACKS:
+ *   - jacocoTestReport.xml (top-level — fixture / direct path)
+ *   - jacoco.xml (top-level — Maven fixture / direct path)
+ *
+ * Returns the first existing path, relative to cwd. Conservative
+ * priority: most specific build-tool conventions first, root
+ * fallbacks last.
+ */
+function findJaCoCoReport(cwd) {
+    const candidates = [
+        // Gradle (Android + plain JVM)
+        'app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml',
+        'build/reports/jacoco/test/jacocoTestReport.xml',
+        'build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml',
+        // Maven (single-module + multi-module aggregate)
+        'target/site/jacoco/jacoco.xml',
+        'target/site/jacoco-aggregate/jacoco.xml',
+        // Direct-path fallbacks (fixture / hand-placed)
+        'jacocoTestReport.xml',
+        'jacoco.xml',
+    ];
+    for (const rel of candidates) {
+        const abs = path.join(cwd, rel);
+        if (fs.existsSync(abs))
+            return rel;
+    }
+    return null;
+}
+/**
+ * Locate + parse the JaCoCo XML report under cwd, wrap the result in a
+ * `CoverageResult` envelope. Identical glue across JVM packs (kotlin,
+ * java) — no language-specific dispatch needed because JaCoCo's
+ * `<sourcefile name>` carries the on-disk filename verbatim and the
+ * file extension survives intact through the parser. Both packs'
+ * `coverageProvider.gather` should delegate here.
+ */
+function gatherJaCoCoCoverageResult(cwd) {
+    const reportRel = findJaCoCoReport(cwd);
+    if (!reportRel)
+        return null;
+    let raw;
+    try {
+        raw = fs.readFileSync(path.join(cwd, reportRel), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const coverage = parseJaCoCoXml(raw, reportRel, cwd);
+    if (!coverage)
+        return null;
+    return { schemaVersion: 1, tool: `coverage:${coverage.source}`, coverage };
+}
+//# sourceMappingURL=jacoco.js.map

package/dist/analyzers/tools/jacoco.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jacoco.js","sourceRoot":"","sources":["../../../src/analyzers/tools/jacoco.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,wCAmEC;AA6BD,4CAkBC;AAUD,gEAYC;AA/LD;;;;;;;;;;;;;GAaG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,yCAAsE;AAGtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,SAAgB,cAAc,CAAC,GAAW,EAAE,UAAkB,EAAE,IAAY;IAC1E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,sEAAsE;IACtE,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,kDAAkD,CAAC;IACrE,IAAI,EAA0B,CAAC;IAC/B,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,8CAA8C;QACzF,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACvB,iEAAiE;QACjE,MAAM,YAAY,GAAG,wDAAwD,CAAC;QAC9E,IAAI,EAA0B,CAAC;QAC/B,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1B,wDAAwD;YACxD,iEAAiE;YACjE,qCAAqC;YACrC,MAAM,SAAS,GAAG,kEAAkE,CAAC;YACrF,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,EAA0B,CAAC;YAC/B,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjC,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,GAAG,WAAW,CAAC;YACvC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBACb,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,WAAW;gBACpB,KAAK;gBACL,GAAG,EAAE,IAAA,iBAAM,EAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CACzB,4FAA4F,CAC7F,CAAC;IACF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,SAAS,EAAE,CAAC;QACd,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,gEAAgE;QAChE,SAAS;QACT,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/B,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC;YAC1B,WAAW,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,UAAU;QACV,WAAW,EAAE,IAAA,iBAAM,EAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG;QACjB,+BAA+B;QAC/B,gEAAgE;QAChE,gDAAgD;QAChD,4DAA4D;QAC5D,iDAAiD;QACjD,+BAA+B;QAC/B,yCAAyC;QACzC,gDAAgD;QAChD,sBAAsB;QACtB,YAAY;KACb,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,0BAA0B,CAAC,GAAW;IACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC7E,CAAC"}

package/dist/analyzers/tools/osv-scanner-deps.d.ts

@@ -0,0 +1,47 @@
+import type { DepVulnFinding, DepVulnGatherOutcome, SeverityCounts } from '../../languages/capabilities/types';
+/**
+ * Pure parser for osv-scanner v2.x JSON output, scoped to a single
+ * ecosystem. Other ecosystems are filtered out so polyglot repos
+ * don't double-count: each pack handles its own ecosystem (typescript
+ * → npm, python → PyPI, kotlin/java → Maven, ruby → RubyGems, etc.).
+ *
+ * The ecosystem parameter is matched against the OSV record's
+ * `package.ecosystem` field verbatim — use the exact strings OSV
+ * emits (`'Maven'`, `'RubyGems'`, `'PyPI'`, `'npm'`, `'Go'`, etc.).
+ *
+ * Returns counts + findings + the raw OSV vuln records for downstream
+ * CVSS resolution. Exported for unit tests.
+ */
+export declare function parseOsvScannerFindings(raw: string, ecosystem: string): {
+    counts: SeverityCounts;
+    findings: DepVulnFinding[];
+    vulnsForCvss: Array<{
+        primaryId: string;
+        embeddedCvss: number | null;
+        aliases: string[];
+    }>;
+};
+/**
+ * Single source of truth for osv-scanner-driven dep-vuln gathering.
+ * Caller supplies:
+ *   - cwd: project root
+ *   - source: pack id for envelope attribution (currently reserved —
+ *     see note at end of function)
+ *   - ecosystem: OSV ecosystem string (`'Maven'`, `'RubyGems'`, ...)
+ *   - manifestCandidates: ordered list of manifest filenames to probe.
+ *     First existing one is passed via `--lockfile`. Lockfiles
+ *     preferred over higher-level manifests (kotlin: gradle.lockfile
+ *     before pom.xml; ruby: Gemfile.lock).
+ *
+ * `scan source --lockfile <path>` is the v2.x form. JSON output to
+ * stdout. Exit code is non-zero when findings exist — we ignore the
+ * exit code and parse the JSON regardless (run() already swallows
+ * non-zero exits cleanly via execSync's catch).
+ *
+ * CVSS alias-fallback: osv-scanner ships CVSS vectors when present,
+ * but advisory data quality varies by ecosystem — some carry only
+ * `database_specific.severity` strings. resolveCvssScores looks up
+ * via CVE alias when the primary record lacks a vector.
+ */
+export declare function gatherOsvScannerDepVulnsResult(cwd: string, source: string, ecosystem: string, manifestCandidates: string[]): Promise<DepVulnGatherOutcome>;
+//# sourceMappingURL=osv-scanner-deps.d.ts.map

package/dist/analyzers/tools/osv-scanner-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-scanner-deps.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-deps.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EAEpB,cAAc,EACf,MAAM,oCAAoC,CAAC;AAiB5C;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAChB;IACD,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC5F,CAiEA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,EAAE,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA4C/B"}

package/dist/analyzers/tools/osv-scanner-deps.js

@@ -0,0 +1,175 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseOsvScannerFindings = parseOsvScannerFindings;
+exports.gatherOsvScannerDepVulnsResult = gatherOsvScannerDepVulnsResult;
+/**
+ * osv-scanner against any OSV ecosystem — shared across language packs
+ * that use osv-scanner as their canonical depVulns source. CLAUDE.md
+ * rule #2 — the gather function lives once.
+ *
+ * History: extracted from `src/languages/kotlin.ts` in 10k.1.4 (Phase
+ * 10k.1 SSOT validation), originally Maven-only. Generalized to all
+ * OSV ecosystems in 10k.2.6a (Ruby pack work) — caller passes the
+ * ecosystem string + manifest candidate list, parser filters
+ * accordingly so polyglot repos don't double-count across packs.
+ *
+ * Current consumers:
+ *   - kotlin pack — `Maven` ecosystem, gradle.lockfile + pom.xml + verification-metadata.xml
+ *   - java pack — `Maven` ecosystem (same manifest set)
+ *   - ruby pack — `RubyGems` ecosystem, Gemfile.lock
+ *
+ * osv-scanner is the established multi-ecosystem scanner; no Tier-1
+ * native equivalent exists for several of the ecosystems above
+ * (CLAUDE.md rule #5 — bundler-audit's JSON is unstable, so Ruby
+ * intentionally uses osv-scanner-only rather than dual-source).
+ * The typescript pack's `osv-scanner-fix.ts` uses the `fix`
+ * subcommand for upgrade planning — different mode, no shared logic.
+ *
+ * Manifest gating: caller supplies the candidate list. First
+ * existing candidate wins. Without any of them, returns
+ * `tool-missing` (matches python/csharp's manifest-gating pattern).
+ */
+const osv_1 = require("./osv");
+const runner_1 = require("./runner");
+const tool_registry_1 = require("./tool-registry");
+/**
+ * Pure parser for osv-scanner v2.x JSON output, scoped to a single
+ * ecosystem. Other ecosystems are filtered out so polyglot repos
+ * don't double-count: each pack handles its own ecosystem (typescript
+ * → npm, python → PyPI, kotlin/java → Maven, ruby → RubyGems, etc.).
+ *
+ * The ecosystem parameter is matched against the OSV record's
+ * `package.ecosystem` field verbatim — use the exact strings OSV
+ * emits (`'Maven'`, `'RubyGems'`, `'PyPI'`, `'npm'`, `'Go'`, etc.).
+ *
+ * Returns counts + findings + the raw OSV vuln records for downstream
+ * CVSS resolution. Exported for unit tests.
+ */
+function parseOsvScannerFindings(raw, ecosystem) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+    const findings = [];
+    const vulnsForCvss = [];
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return { counts, findings, vulnsForCvss };
+    }
+    // Dedup at the source: osv-scanner can list the same advisory twice
+    // when a transitive dep is reachable through multiple top-level deps.
+    // Same (package, version, id) → same fingerprint, so collapse here.
+    const seen = new Set();
+    for (const result of data.results ?? []) {
+        for (const pkg of result.packages ?? []) {
+            if (pkg.package?.ecosystem !== ecosystem)
+                continue;
+            const pkgName = pkg.package.name ?? 'unknown';
+            const pkgVersion = pkg.package.version;
+            for (const vuln of pkg.vulnerabilities ?? []) {
+                if (!vuln.id)
+                    continue;
+                const dedupKey = `${pkgName}\0${pkgVersion ?? ''}\0${vuln.id}`;
+                if (seen.has(dedupKey))
+                    continue;
+                seen.add(dedupKey);
+                const sev = (0, osv_1.classifyOsvSeverity)(vuln);
+                const tier = sev === 'critical' || sev === 'high' || sev === 'medium' || sev === 'low'
+                    ? sev
+                    : 'medium';
+                counts[tier]++;
+                const cvss = (0, osv_1.extractOsvCvssScore)(vuln);
+                const aliases = (vuln.aliases ?? []).filter((a) => a && a.length > 0);
+                const finding = {
+                    id: vuln.id,
+                    package: pkgName,
+                    installedVersion: pkgVersion,
+                    tool: 'osv-scanner',
+                    severity: tier,
+                };
+                if (cvss !== null)
+                    finding.cvssScore = cvss;
+                if (aliases.length > 0)
+                    finding.aliases = aliases;
+                if (vuln.summary)
+                    finding.summary = vuln.summary;
+                // OSV.dev hosts a canonical page per id — synthesize when the
+                // record's `references[]` is empty, otherwise keep the
+                // tool-supplied URLs.
+                const refUrls = (vuln.references ?? []).map((r) => r.url).filter((u) => !!u);
+                finding.references =
+                    refUrls.length > 0 ? refUrls : [`https://osv.dev/vulnerability/${vuln.id}`];
+                findings.push(finding);
+                vulnsForCvss.push({
+                    primaryId: vuln.id,
+                    embeddedCvss: cvss,
+                    aliases,
+                });
+            }
+        }
+    }
+    return { counts, findings, vulnsForCvss };
+}
+/**
+ * Single source of truth for osv-scanner-driven dep-vuln gathering.
+ * Caller supplies:
+ *   - cwd: project root
+ *   - source: pack id for envelope attribution (currently reserved —
+ *     see note at end of function)
+ *   - ecosystem: OSV ecosystem string (`'Maven'`, `'RubyGems'`, ...)
+ *   - manifestCandidates: ordered list of manifest filenames to probe.
+ *     First existing one is passed via `--lockfile`. Lockfiles
+ *     preferred over higher-level manifests (kotlin: gradle.lockfile
+ *     before pom.xml; ruby: Gemfile.lock).
+ *
+ * `scan source --lockfile <path>` is the v2.x form. JSON output to
+ * stdout. Exit code is non-zero when findings exist — we ignore the
+ * exit code and parse the JSON regardless (run() already swallows
+ * non-zero exits cleanly via execSync's catch).
+ *
+ * CVSS alias-fallback: osv-scanner ships CVSS vectors when present,
+ * but advisory data quality varies by ecosystem — some carry only
+ * `database_specific.severity` strings. resolveCvssScores looks up
+ * via CVE alias when the primary record lacks a vector.
+ */
+async function gatherOsvScannerDepVulnsResult(cwd, source, ecosystem, manifestCandidates) {
+    let manifest = null;
+    for (const rel of manifestCandidates) {
+        if ((0, runner_1.fileExists)(cwd, rel)) {
+            manifest = rel;
+            break;
+        }
+    }
+    if (!manifest)
+        return { kind: 'tool-missing' };
+    const scanner = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['osv-scanner'], cwd);
+    if (!scanner.available || !scanner.path)
+        return { kind: 'tool-missing' };
+    const raw = (0, runner_1.run)(`${scanner.path} scan source --lockfile ${manifest} --format json 2>/dev/null`, cwd, 180000);
+    if (!raw)
+        return { kind: 'no-output' };
+    const { counts, findings, vulnsForCvss } = parseOsvScannerFindings(raw, ecosystem);
+    if (findings.length > 0) {
+        const resolved = await (0, osv_1.resolveCvssScores)(vulnsForCvss);
+        for (const f of findings) {
+            const score = resolved.get(f.id);
+            if (score !== null && score !== undefined)
+                f.cvssScore = score;
+        }
+    }
+    const envelope = {
+        schemaVersion: 1,
+        tool: 'osv-scanner',
+        enrichment: 'osv.dev',
+        counts,
+        findings,
+    };
+    // Note: `source` is unused at the envelope level today — DepVulnResult
+    // carries `tool: 'osv-scanner'` as the producer attribution. Reserved
+    // for a future enhancement that distinguishes per-pack provenance
+    // (e.g., when both kotlin and java packs run on a mixed monorepo and
+    // we want to attribute findings to the originating pack).
+    void source;
+    return { kind: 'success', envelope };
+}
+//# sourceMappingURL=osv-scanner-deps.js.map

package/dist/analyzers/tools/osv-scanner-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-scanner-deps.js","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-deps.ts"],"names":[],"mappings":";;AAiEA,0DAwEC;AAwBD,wEAiDC;AAlND;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,+BAAkG;AAClG,qCAA2C;AAC3C,mDAAsD;AAuBtD;;;;;;;;;;;;GAYG;AACH,SAAgB,uBAAuB,CACrC,GAAW,EACX,SAAiB;IAMjB,MAAM,MAAM,GAAmB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,YAAY,GAIb,EAAE,CAAC;IACR,IAAI,IAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5C,CAAC;IACD,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS;gBAAE,SAAS;YACnD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,SAAS;gBACvB,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,UAAU,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAEnB,MAAM,GAAG,GAAG,IAAA,yBAAmB,EAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,IAAI,GACR,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,KAAK;oBACvE,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,QAAQ,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAEf,MAAM,IAAI,GAAG,IAAA,yBAAmB,EAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACtE,MAAM,OAAO,GAAmB;oBAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,OAAO,EAAE,OAAO;oBAChB,gBAAgB,EAAE,UAAU;oBAC5B,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,IAAI;iBACf,CAAC;gBACF,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;gBAClD,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBACjD,8DAA8D;gBAC9D,uDAAuD;gBACvD,sBAAsB;gBACtB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1F,OAAO,CAAC,UAAU;oBAChB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iCAAiC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAEvB,YAAY,CAAC,IAAI,CAAC;oBAChB,SAAS,EAAE,IAAI,CAAC,EAAE;oBAClB,YAAY,EAAE,IAAI;oBAClB,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,UAAU,8BAA8B,CAClD,GAAW,EACX,MAAc,EACd,SAAiB,EACjB,kBAA4B;IAE5B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,IAAI,IAAA,mBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACzB,QAAQ,GAAG,GAAG,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAEzE,MAAM,GAAG,GAAG,IAAA,YAAG,EACb,GAAG,OAAO,CAAC,IAAI,2BAA2B,QAAQ,4BAA4B,EAC9E,GAAG,EACH,MAAM,CACP,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAEvC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAEnF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAiB,EAAC,YAAY,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;gBAAE,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,SAAS;QACrB,MAAM;QACN,QAAQ;KACT,CAAC;IACF,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,qEAAqE;IACrE,0DAA0D;IAC1D,KAAK,MAAM,CAAC;IACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC"}

package/dist/analyzers/tools/osv-scanner-fix.d.ts

@@ -32,6 +32,26 @@ import type { DepVulnFinding, DepVulnUpgradePlan } from '../../languages/capabil
  *
  * Never throws. `gatherTsDepVulnsResult` calls this unconditionally and
  * treats the empty map as "no enrichment available".
+ *
+ * **TEMP-DIR ISOLATION (10k.1.5b fix — discovered during 2.4.5 pre-ship
+ * regression):** osv-scanner v2's `fix` subcommand invokes `npm install`
+ * internally to compute upgrade patches. That `npm install` MUTATES the
+ * cwd's node_modules — wipes it then reinstalls (often with
+ * `--legacy-peer-deps` fallback if the project's deps don't resolve
+ * cleanly). On dxkit's own repo this caused subsequent dxkit subcommand
+ * invocations to crash with `Cannot find module 'hosted-git-info'`
+ * because osv-scanner's reinstall left an incomplete tree. On
+ * vyuhlabs-platform (835MB node_modules) the reinstall happened to
+ * succeed but still mutated state silently — a 5-month-old data-mutation
+ * bug shipped since 2.4.0 / Phase 10h.6 and only caught now because
+ * 2.4.5 pre-ship regression ran reports back-to-back on dxkit's own repo
+ * and tripped the chain.
+ *
+ * Mitigation: we copy `package.json` + `package-lock.json` to a fresh
+ * temp dir, run osv-scanner there, and discard the temp dir afterward.
+ * Output JSON identifies advisories by `(package, version, id)` tuples
+ * which are independent of cwd, so the upgrade-plan map we return is
+ * unchanged. The caller's project gets read-only treatment.
  */
 export declare function gatherOsvScannerFixPlans(cwd: string): Promise<Map<string, DepVulnUpgradePlan>>;
 /**

package/dist/analyzers/tools/osv-scanner-fix.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osv-scanner-fix.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAqC7F;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CA+B1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwCrF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACrC,MAAM,CAaR;AAED;;;;;;;4BAO4B;AAC5B,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF"}
+{"version":3,"file":"osv-scanner-fix.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAsC7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAwC1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwCrF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACrC,MAAM,CAaR;AAED;;;;;;;4BAO4B;AAC5B,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF"}

package/dist/analyzers/tools/osv-scanner-fix.js

@@ -58,9 +58,10 @@ exports.gatherOsvScannerFixPlans = gatherOsvScannerFixPlans;
 exports.parseOsvScannerFixOutput = parseOsvScannerFixOutput;
 exports.enrichWithUpgradePlans = enrichWithUpgradePlans;
 exports.planKey = planKey;
-const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const runner_1 = require("./runner");
 const semver_bump_1 = require("./semver-bump");
 const tool_registry_1 = require("./tool-registry");
 /**
@@ -75,6 +76,26 @@ const tool_registry_1 = require("./tool-registry");
  *
  * Never throws. `gatherTsDepVulnsResult` calls this unconditionally and
  * treats the empty map as "no enrichment available".
+ *
+ * **TEMP-DIR ISOLATION (10k.1.5b fix — discovered during 2.4.5 pre-ship
+ * regression):** osv-scanner v2's `fix` subcommand invokes `npm install`
+ * internally to compute upgrade patches. That `npm install` MUTATES the
+ * cwd's node_modules — wipes it then reinstalls (often with
+ * `--legacy-peer-deps` fallback if the project's deps don't resolve
+ * cleanly). On dxkit's own repo this caused subsequent dxkit subcommand
+ * invocations to crash with `Cannot find module 'hosted-git-info'`
+ * because osv-scanner's reinstall left an incomplete tree. On
+ * vyuhlabs-platform (835MB node_modules) the reinstall happened to
+ * succeed but still mutated state silently — a 5-month-old data-mutation
+ * bug shipped since 2.4.0 / Phase 10h.6 and only caught now because
+ * 2.4.5 pre-ship regression ran reports back-to-back on dxkit's own repo
+ * and tripped the chain.
+ *
+ * Mitigation: we copy `package.json` + `package-lock.json` to a fresh
+ * temp dir, run osv-scanner there, and discard the temp dir afterward.
+ * Output JSON identifies advisories by `(package, version, id)` tuples
+ * which are independent of cwd, so the upgrade-plan map we return is
+ * unchanged. The caller's project gets read-only treatment.
  */
 async function gatherOsvScannerFixPlans(cwd) {
     const manifestRel = 'package.json';
@@ -87,28 +108,32 @@ async function gatherOsvScannerFixPlans(cwd) {
     const tool = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['osv-scanner'], cwd);
     if (!tool.available || !tool.path)
         return new Map();
-    // Quote paths defensively — repo paths with spaces break shell parsing
-    // otherwise, and osv-scanner's CLI is shell-parsed.
-    const cmd = `${tool.path} fix --format json --manifest ${JSON.stringify(manifestRel)} ` +
-        `--lockfile ${JSON.stringify(lockfileRel)}`;
-    let raw;
+    // Stage manifest + lockfile in a fresh temp dir. osv-scanner mutates
+    // node_modules in its working directory; staging here protects the
+    // caller's actual project tree from any side effects.
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'dxkit-osv-fix-'));
     try {
-        raw = (0, child_process_1.execSync)(cmd, {
-            cwd,
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'pipe'],
-            timeout: 120_000,
-        });
-    }
-    catch (err) {
-        // osv-scanner exits non-zero whenever it finds vulns, even though the
-        // JSON payload is complete. Capture stdout from the error and proceed.
-        const e = err;
-        if (!e.stdout)
+        fs.copyFileSync(manifestAbs, path.join(tempDir, manifestRel));
+        fs.copyFileSync(lockfileAbs, path.join(tempDir, lockfileRel));
+        // Use runDetached (10k.1.5c addition) to put osv-scanner in its own
+        // process group. osv-scanner's `fix` subcommand spawns `npm install`
+        // grandchildren that orphan if execSync's timeout merely sends
+        // SIGTERM to the immediate child (the original 10k.1.5b fix only
+        // addressed node_modules mutation; the orphan-process leak was a
+        // separate symptom of the same root cause). runDetached SIGKILLs
+        // the entire group on timeout — taking npm-install + its
+        // subprocesses with it.
+        const outcome = await (0, runner_1.runDetached)(tool.path, ['fix', '--format', 'json', '--manifest', manifestRel, '--lockfile', lockfileRel], { cwd: tempDir, timeoutMs: 120_000 });
+        // osv-scanner exits non-zero whenever it finds vulns, even though
+        // the JSON payload is complete. Always parse stdout regardless of
+        // exit code. Empty stdout (timed-out or hard-failed) → empty map.
+        if (!outcome.stdout)
             return new Map();
-        raw = typeof e.stdout === 'string' ? e.stdout : e.stdout.toString('utf8');
+        return parseOsvScannerFixOutput(outcome.stdout);
+    }
+    finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
     }
-    return parseOsvScannerFixOutput(raw);
 }
 /**
  * Parse raw `osv-scanner fix --format json` stdout into a plan-lookup map.

package/dist/analyzers/tools/osv-scanner-fix.js.map

@@ -1 +1 @@
-{"version":3,"file":"osv-scanner-fix.js","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-fix.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDH,4DAiCC;AAYD,4DAwCC;AAOD,wDAgBC;AAUD,0BAEC;AA7KD,iDAAyC;AACzC,uCAAyB;AACzB,2CAA6B;AAE7B,+CAA4C;AAC5C,mDAAsD;AAmCtD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,wBAAwB,CAC5C,GAAW;IAEX,MAAM,WAAW,GAAG,cAAc,CAAC;IACnC,MAAM,WAAW,GAAG,mBAAmB,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACpD,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,GAAG,GACP,GAAG,IAAI,CAAC,IAAI,iCAAiC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG;QAC3E,cAAc,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,wBAAQ,EAAC,GAAG,EAAE;YAClB,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,CAAC,GAAG,GAAmC,CAAC;QAC9C,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAChC,GAAG,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,wBAAwB,CAAC,GAAW;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAiB,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;QACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/C,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,oEAAoE;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,gEAAgE;QAChE,uBAAuB;QACvB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAuB;YAC/B,MAAM,EAAE,YAAY,CAAC,IAAI;YACzB,aAAa,EAAE,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC;YACvD,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,IAAA,yBAAW,EACnB,gBAAgB,CAAC,YAAY,CAAC,WAAW,CAAC,EAC1C,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,CACzC;SACF,CAAC;QACF,mEAAmE;QACnE,2BAA2B;QAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACvC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,QAA0B,EAC1B,KAAsC;IAEtC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,gBAAgB;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;YACrB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;4BAO4B;AAC5B,SAAgB,OAAO,CAAC,GAAW,EAAE,OAAe,EAAE,UAAkB;IACtE,OAAO,GAAG,GAAG,KAAK,OAAO,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;qCAGqC;AACrC,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"osv-scanner-fix.js","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-fix.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EH,4DA0CC;AAYD,4DAwCC;AAOD,wDAgBC;AAUD,0BAEC;AA3MD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,qCAAuC;AACvC,+CAA4C;AAC5C,mDAAsD;AAmCtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACI,KAAK,UAAU,wBAAwB,CAC5C,GAAW;IAEX,MAAM,WAAW,GAAG,cAAc,CAAC;IACnC,MAAM,WAAW,GAAG,mBAAmB,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAEpD,qEAAqE;IACrE,mEAAmE;IACnE,sDAAsD;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9D,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAE9D,oEAAoE;QACpE,qEAAqE;QACrE,+DAA+D;QAC/D,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,yDAAyD;QACzD,wBAAwB;QACxB,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAW,EAC/B,IAAI,CAAC,IAAI,EACT,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,EACjF,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CACrC,CAAC;QACF,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACtC,OAAO,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,wBAAwB,CAAC,GAAW;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAiB,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;QACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/C,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,oEAAoE;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,gEAAgE;QAChE,uBAAuB;QACvB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAuB;YAC/B,MAAM,EAAE,YAAY,CAAC,IAAI;YACzB,aAAa,EAAE,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC;YACvD,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,IAAA,yBAAW,EACnB,gBAAgB,CAAC,YAAY,CAAC,WAAW,CAAC,EAC1C,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,CACzC;SACF,CAAC;QACF,mEAAmE;QACnE,2BAA2B;QAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACvC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,QAA0B,EAC1B,KAAsC;IAEtC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,gBAAgB;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;YACrB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;4BAO4B;AAC5B,SAAgB,OAAO,CAAC,GAAW,EAAE,OAAe,EAAE,UAAkB;IACtE,OAAO,GAAG,GAAG,KAAK,OAAO,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;qCAGqC;AACrC,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC"}