@vyuhlabs/dxkit 2.4.6 → 2.4.7

package/dist/analyzers/tools/jscpd.js

@@ -14,10 +14,46 @@
  * driven derivation keeps adding a new language to a one-line scaffold
  * change rather than a cross-cutting edit here.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.jscpdProvider = void 0;
 exports.gatherJscpdResult = gatherJscpdResult;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const languages_1 = require("../../languages");
+const exclusions_1 = require("./exclusions");
 const runner_1 = require("./runner");
 const tool_registry_1 = require("./tool-registry");
 /**
@@ -65,18 +101,93 @@ function topClonesFrom(duplicates, limit = 15) {
 /**
  * Single source of truth for the jscpd invocation. Consumed by
  * `jscpdProvider` (capability dispatcher).
+ *
+ * Failure-mode honesty: when jscpd doesn't produce a parseable
+ * report, the returned `reason` distinguishes timeout, non-zero
+ * exit (with first stderr line), or the rare true "no output"
+ * case. Same shape as the semgrep gather — switched from execSync
+ * to spawn-with-process-group so jscpd's worker pool (it splits
+ * the scan across multiple Node workers internally) isn't killed
+ * mid-run when execSync's wall-clock timer fires.
  */
-function gatherJscpdResult(cwd) {
+async function gatherJscpdResult(cwd) {
     const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.jscpd, cwd);
     if (!status.available || !status.path)
         return { kind: 'unavailable', reason: 'not installed' };
     const reportDir = `/tmp/dxkit-jscpd-${Date.now()}`;
     const pattern = buildJscpdPattern();
-    (0, runner_1.run)(`${status.path} --reporters json --output '${reportDir}' --gitignore --pattern '${pattern}' --min-lines 5 --min-tokens 50 '${cwd}' > /dev/null 2>&1`, cwd, 300000);
-    const reportRaw = (0, runner_1.run)(`cat '${reportDir}/jscpd-report.json' 2>/dev/null`, cwd);
-    (0, runner_1.run)(`rm -rf '${reportDir}'`, cwd);
-    if (!reportRaw)
+    // jscpd's `--ignore` receives the union of:
+    //
+    //   1. dxkit's centralized exclusion set (`getJscpdIgnorePatterns`) —
+    //      the same dirs / sourcePaths / filePatterns the in-process
+    //      walkers (cloc, grep, semgrep, graphify's Python filter)
+    //      honor. Without this, committed-vendored trees that aren't
+    //      listed in the project's `.gitignore` (the `--gitignore` flag's
+    //      only input) — minified bundles, hash-versioned webpack
+    //      chunks, vendored library copies under `public/` — would
+    //      force jscpd to tokenize them, exhaust heap, and OOM-kill
+    //      before flushing its JSON report. The report would then read
+    //      "Duplication unavailable" on the densest repos.
+    //
+    //   2. Pack-declared autogen patterns (`*.Designer.cs`, WCF
+    //      `Reference.cs`, MSBuild `*.AssemblyInfo.cs`, etc.) so
+    //      duplication detection skips the same files generic.ts +
+    //      test-gaps' source walk already skip. Autogen scaffolding
+    //      duplicates verbatim by its nature; including it inflates
+    //      the duplication percentage and points "extract this" advice
+    //      at code the developer never authored.
+    //
+    // Patterns get a `**/` prefix so they match at any directory depth.
+    const exclusionIgnore = (0, exclusions_1.getJscpdIgnorePatterns)(cwd);
+    const autogenIgnore = (0, languages_1.allAutogenSourcePatterns)().map((p) => `**/${p}`);
+    const ignorePatterns = [...exclusionIgnore, ...autogenIgnore];
+    const args = ['--reporters', 'json', '--output', reportDir, '--gitignore', '--pattern', pattern];
+    if (ignorePatterns.length > 0) {
+        args.push('--ignore', ignorePatterns.join(','));
+    }
+    args.push('--min-lines', '5', '--min-tokens', '50', cwd);
+    const outcome = await (0, runner_1.runDetached)(status.path, args, { cwd, timeoutMs: 600000 });
+    // Read the report file directly. Pre-D-fix this used
+    // `run('cat <path>')` which routed through execSync with the default
+    // 1MB maxBuffer — jscpd reports on enterprise codebases routinely
+    // exceed that (dpl-studio's was 25MB / 395k lines), causing execSync
+    // to truncate the output to empty and the gather to misreport
+    // jscpd as "unavailable" even after a fully-successful run.
+    // Direct file read sidesteps the buffer entirely.
+    const reportPath = path.join(reportDir, 'jscpd-report.json');
+    let reportRaw;
+    try {
+        reportRaw = fs.readFileSync(reportPath, 'utf-8');
+    }
+    catch {
+        reportRaw = '';
+    }
+    try {
+        fs.rmSync(reportDir, { recursive: true, force: true });
+    }
+    catch {
+        /* dir already gone or never written — fine */
+    }
+    if (!reportRaw) {
+        if (outcome.timedOut) {
+            return {
+                kind: 'unavailable',
+                reason: 'timed out at 600s (try narrowing scan scope via .dxkit-ignore)',
+            };
+        }
+        const stderrFirstLine = outcome.stderr
+            .split('\n')
+            .map((l) => l.trim())
+            .find((l) => l.length > 0);
+        if (outcome.code !== 0 && outcome.code !== null) {
+            const ctx = stderrFirstLine ? ` (stderr: ${stderrFirstLine})` : '';
+            return { kind: 'unavailable', reason: `exit code ${outcome.code}${ctx}` };
+        }
+        if (stderrFirstLine) {
+            return { kind: 'unavailable', reason: `no output (stderr: ${stderrFirstLine})` };
+        }
         return { kind: 'unavailable', reason: 'no output' };
+    }
     let data;
     try {
         data = JSON.parse(reportRaw);
@@ -103,11 +214,23 @@ function gatherJscpdResult(cwd) {
  * Capability-shaped provider. Registered in
  * `src/languages/capabilities/global.ts:GLOBAL_CAPABILITIES.duplication`.
  */
+// Implements the optional `gatherOutcome` channel the dispatcher reads
+// to populate `DispatchOutcome.skipReasons`. Without it, a failed jscpd
+// run collapses to `null` at the gather boundary and the actual failure
+// reason ("not installed" / "timed out at 600s" / "exit code 137" /
+// "no output" / "parse error") is dropped — `availabilityFromOutcome`
+// in health.ts then synthesizes generic prose that conflates
+// install-missing with attempted-but-failed. Exposing the real outcome
+// here lets the report show why jscpd didn't contribute, in jscpd's
+// own words.
 exports.jscpdProvider = {
     source: 'jscpd',
     async gather(cwd) {
-        const outcome = gatherJscpdResult(cwd);
+        const outcome = await gatherJscpdResult(cwd);
         return outcome.kind === 'success' ? outcome.envelope : null;
     },
+    async gatherOutcome(cwd) {
+        return gatherJscpdResult(cwd);
+    },
 };
 //# sourceMappingURL=jscpd.js.map

package/dist/analyzers/tools/jscpd.js.map

@@ -1 +1 @@
-{"version":3,"file":"jscpd.js","sourceRoot":"","sources":["../../../src/analyzers/tools/jscpd.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAoFH,8CAsCC;AAxHD,+CAA4C;AAG5C,qCAA+B;AAC/B,mDAAsD;AA8BtD;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,qBAAS,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,SAAS,aAAa,CAAC,UAA+B,EAAE,KAAK,GAAG,EAAE;IAChE,OAAO,UAAU;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC;QACrB,CAAC,EAAE;YACD,IAAI,EAAE,CAAC,CAAC,SAAU,CAAC,IAAK;YACxB,SAAS,EAAE,CAAC,CAAC,SAAU,CAAC,KAAK,IAAI,CAAC;YAClC,OAAO,EAAE,CAAC,CAAC,SAAU,CAAC,GAAG,IAAI,CAAC;SAC/B;QACD,CAAC,EAAE;YACD,IAAI,EAAE,CAAC,CAAC,UAAW,CAAC,IAAK;YACzB,SAAS,EAAE,CAAC,CAAC,UAAW,CAAC,KAAK,IAAI,CAAC;YACnC,OAAO,EAAE,CAAC,CAAC,UAAW,CAAC,GAAG,IAAI,CAAC;SAChC;KACF,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,IAAA,YAAG,EACD,GAAG,MAAM,CAAC,IAAI,+BAA+B,SAAS,4BAA4B,OAAO,oCAAoC,GAAG,oBAAoB,EACpJ,GAAG,EACH,MAAM,CACP,CAAC;IAEF,MAAM,SAAS,GAAG,IAAA,YAAG,EAAC,QAAQ,SAAS,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAC/E,IAAA,YAAG,EAAC,WAAW,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEpE,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAEjE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAsB;QAClC,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,CAAC,CAAC,KAAK;QACnB,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,GAAG;QAChD,UAAU,EAAE,UAAU,CAAC,MAAM;QAC7B,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC;KACrC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACU,QAAA,aAAa,GAA0C;IAClE,MAAM,EAAE,OAAO;IACf,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC"}
+{"version":3,"file":"jscpd.js","sourceRoot":"","sources":["../../../src/analyzers/tools/jscpd.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+FH,8CAqGC;AAlMD,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAsE;AAGtE,6CAAsD;AACtD,qCAAuC;AACvC,mDAAsD;AA8BtD;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,qBAAS,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,SAAS,aAAa,CAAC,UAA+B,EAAE,KAAK,GAAG,EAAE;IAChE,OAAO,UAAU;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC;QACrB,CAAC,EAAE;YACD,IAAI,EAAE,CAAC,CAAC,SAAU,CAAC,IAAK;YACxB,SAAS,EAAE,CAAC,CAAC,SAAU,CAAC,KAAK,IAAI,CAAC;YAClC,OAAO,EAAE,CAAC,CAAC,SAAU,CAAC,GAAG,IAAI,CAAC;SAC/B;QACD,CAAC,EAAE;YACD,IAAI,EAAE,CAAC,CAAC,UAAW,CAAC,IAAK;YACzB,SAAS,EAAE,CAAC,CAAC,UAAW,CAAC,KAAK,IAAI,CAAC;YACnC,OAAO,EAAE,CAAC,CAAC,UAAW,CAAC,GAAG,IAAI,CAAC;SAChC;KACF,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAW;IACjD,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,4CAA4C;IAC5C,EAAE;IACF,sEAAsE;IACtE,iEAAiE;IACjE,+DAA+D;IAC/D,iEAAiE;IACjE,sEAAsE;IACtE,8DAA8D;IAC9D,+DAA+D;IAC/D,gEAAgE;IAChE,mEAAmE;IACnE,uDAAuD;IACvD,EAAE;IACF,4DAA4D;IAC5D,6DAA6D;IAC7D,+DAA+D;IAC/D,gEAAgE;IAChE,gEAAgE;IAChE,mEAAmE;IACnE,6CAA6C;IAC7C,EAAE;IACF,oEAAoE;IACpE,MAAM,eAAe,GAAG,IAAA,mCAAsB,EAAC,GAAG,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAA,oCAAwB,GAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACjG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAW,EAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjF,qDAAqD;IACrD,qEAAqE;IACrE,kEAAkE;IAClE,qEAAqE;IACrE,8DAA8D;IAC9D,4DAA4D;IAC5D,kDAAkD;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,gEAAgE;aACzE,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM;aACnC,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,aAAa,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,eAAe,GAAG,EAAE,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAEjE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAsB;QAClC,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,CAAC,CAAC,KAAK;QACnB,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,GAAG;QAChD,UAAU,EAAE,UAAU,CAAC,MAAM;QAC7B,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC;KACrC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,sEAAsE;AACtE,6DAA6D;AAC7D,uEAAuE;AACvE,oEAAoE;AACpE,aAAa;AACA,QAAA,aAAa,GAEtB;IACF,MAAM,EAAE,OAAO;IACf,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,GAAG;QACrB,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;CACF,CAAC"}

package/dist/analyzers/tools/minified-detection.d.ts

@@ -0,0 +1,9 @@
+/**
+ * True when the file at `absPath` looks like minified / bundled
+ * output by the bytes-per-line heuristic. Returns false on read
+ * errors or for files whose extension isn't in
+ * `MINIFIABLE_EXTENSIONS` — over-include is preferable to silently
+ * dropping legit source.
+ */
+export declare function isLikelyMinified(absPath: string): boolean;
+//# sourceMappingURL=minified-detection.d.ts.map

package/dist/analyzers/tools/minified-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minified-detection.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/minified-detection.ts"],"names":[],"mappings":"AAqEA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgCzD"}

package/dist/analyzers/tools/minified-detection.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLikelyMinified = isLikelyMinified;
+/**
+ * Minified / bundled source-file detection.
+ *
+ * Complements the autogen-header probe by catching another class of
+ * machine-emitted files that frequently land in customer
+ * `src/` / `public/` trees: minified or bundled JavaScript / CSS.
+ * These files are technically "source" by extension but carry no
+ * engineering signal — they're build output (webpack / vite /
+ * esbuild hash-suffixed chunks), CDN-downloaded libraries dropped
+ * into `public/`, or pre-minified vendored editors. When they slip
+ * past the standard exclusions they distort:
+ *
+ *   • `largestFileLines` + `largestFilePath` ("Largest file: 18K
+ *     lines" points at a webpack chunk, not a human-authored file)
+ *   • `filesOver500Lines` (every minified JS file is one line at
+ *     thousands of chars, so doesn't inflate this; but the BUNDLE
+ *     CHUNKS that span multiple lines do)
+ *   • `densestFile` from graphify (4,000+ functions in a single
+ *     minified file)
+ *   • Top Files by Size (the table reads as "split these" but the
+ *     files are all autogen artifacts)
+ *
+ * Detection heuristic: read the first ~4KB, count newlines, compare
+ * to byte length. If average bytes-per-line crosses a threshold the
+ * file is almost certainly minified or a hash-suffixed bundle chunk.
+ * Threshold picked at 500 bytes/line — well above typical
+ * hand-written source (~80–120 cols, ~100 bytes/line including
+ * indentation) and well below typical minified output (often
+ * 5,000–50,000 bytes per "line" in single-line minified files, or
+ * 200–800 bytes/line in webpack bundles with semicolon-split
+ * chunks).
+ *
+ * Scope: applied to `.js`, `.jsx`, `.mjs`, `.cjs`, `.css`, `.scss`,
+ * `.sass`, `.less`. NOT applied to `.ts` / `.tsx` because TS source
+ * is rarely minified in-place (the minified output lands in a
+ * separate `dist/` directory which is already excluded by the
+ * standard ignore list); checking every .ts file would burn I/O
+ * for no benefit.
+ *
+ * Repo-specific autogen that doesn't match this heuristic (e.g.
+ * vendor-tool–emitted classes with hand-typeable filenames + no
+ * autogen header) is best handled via `.dxkit-ignore` — a per-repo
+ * customization the customer maintains.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Extensions where minified content is plausibly present in the source tree. */
+const MINIFIABLE_EXTENSIONS = new Set([
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.css',
+    '.scss',
+    '.sass',
+    '.less',
+]);
+/** Bytes-per-line floor above which the file is almost certainly
+ *  minified / bundled. Calibrated to admit hand-written code at any
+ *  reasonable line length while rejecting any minifier output. */
+const MIN_BYTES_PER_LINE_FOR_MINIFIED = 500;
+/** Sample size — large enough to get reliable line statistics on
+ *  even the shortest minified chunk, small enough to keep the I/O
+ *  cost negligible vs. the existing autogen-header probe. */
+const SAMPLE_BYTES = 4096;
+/**
+ * True when the file at `absPath` looks like minified / bundled
+ * output by the bytes-per-line heuristic. Returns false on read
+ * errors or for files whose extension isn't in
+ * `MINIFIABLE_EXTENSIONS` — over-include is preferable to silently
+ * dropping legit source.
+ */
+function isLikelyMinified(absPath) {
+    const ext = path.extname(absPath).toLowerCase();
+    if (!MINIFIABLE_EXTENSIONS.has(ext))
+        return false;
+    let fd = null;
+    try {
+        fd = fs.openSync(absPath, 'r');
+        const buf = Buffer.alloc(SAMPLE_BYTES);
+        const n = fs.readSync(fd, buf, 0, SAMPLE_BYTES, 0);
+        if (n === 0)
+            return false;
+        // Count newlines in the sample. A single-line file with N bytes
+        // and zero newlines reports bytesPerLine = N (way above the
+        // floor). A normal source file with N bytes and N/100 newlines
+        // reports ~100 bytes/line.
+        let newlines = 0;
+        for (let i = 0; i < n; i++) {
+            if (buf[i] === 0x0a)
+                newlines++;
+        }
+        const linesInSample = Math.max(1, newlines);
+        const bytesPerLine = n / linesInSample;
+        return bytesPerLine >= MIN_BYTES_PER_LINE_FOR_MINIFIED;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+}
+//# sourceMappingURL=minified-detection.js.map

package/dist/analyzers/tools/minified-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minified-detection.js","sourceRoot":"","sources":["../../../src/analyzers/tools/minified-detection.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,4CAgCC;AA5GD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH;;kEAEkE;AAClE,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAE5C;;6DAE6D;AAC7D,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAElD,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1B,gEAAgE;QAChE,4DAA4D;QAC5D,+DAA+D;QAC/D,2BAA2B;QAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,QAAQ,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,CAAC,GAAG,aAAa,CAAC;QACvC,OAAO,YAAY,IAAI,+BAA+B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/analyzers/tools/nuget-package-reference.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Direct `<PackageReference>` parser — D025f (2.4.7).
+ *
+ * Extracts NuGet PackageReference entries from `.csproj` XML text
+ * without invoking `dotnet restore` or any other .NET toolchain. The
+ * output feeds an ad-hoc `packages.lock.json`-shaped file that
+ * osv-scanner ingests via `--lockfile=<path>` (the file MUST be
+ * literally named `packages.lock.json` — osv-scanner v2.x detects the
+ * NuGet ecosystem by filename, not by a prefix). This closes the D036
+ * customer-outcome gap on dpl-studio (where `dotnet list package`
+ * couldn't run from a multi-project parent directory).
+ *
+ * Lives under `src/analyzers/tools/` (alongside `osv-scanner-deps.ts`,
+ * `jacoco.ts`, `npm-registry.ts`, `cvss-v4.ts`) — CLAUDE.md rule #6
+ * keeps each language pack as a single file; ecosystem-specific tool
+ * helpers consumed by one or more packs go in `analyzers/tools/`.
+ * csharp.ts imports this module the same way it already imports
+ * `osv` and `osv-scanner-deps`.
+ *
+ * Architectural rationale:
+ *
+ *   D025c (Sprint A) routed the gather through `findTool(TOOL_DEFS
+ *   ['dotnet-format'])` so users with `~/.dotnet/dotnet` (the
+ *   Microsoft-recommended non-sudo install) got dotnet discovered.
+ *   That fix was necessary but not sufficient: `dotnet list package
+ *   --vulnerable` still requires an explicit `.csproj`/`.sln` in cwd,
+ *   and dpl-studio's `Code/Source/Dev/Core/<Module>/<Module>.csproj`
+ *   layout puts the project files 3 levels deeper than the natural
+ *   `dxkit vulnerabilities Code/Source/` cwd.
+ *
+ *   D025f sidesteps the dotnet CLI entirely. We walk every `.csproj`
+ *   reachable from cwd (depth 5, matching csharp.detect()), parse
+ *   each, and feed the union to osv-scanner via a synthetic lockfile.
+ *   Cross-platform — `net9.0-windows` targets that won't restore on
+ *   Linux/Mac still get scanned.
+ *
+ *   Trade-off: this catches DIRECT PackageReferences only. Transitive
+ *   deps (resolved by NuGet's dep graph from each direct ref's own
+ *   dependencies) are NOT visible without a populated
+ *   `project.assets.json`. Industry studies put ~80% of typical
+ *   .NET CVE surface on direct refs; the remaining ~20% (transitives)
+ *   land cleanly when `dotnet restore` is available and the
+ *   dotnet-path-resolved D025c codepath runs.
+ *
+ * Shared with D031: the licenses degraded-inventory fallback uses the
+ * same parser to produce a "133 packages identified; license info
+ * unavailable" rendering when `nuget-license` isn't installed.
+ *
+ * Pure function. No I/O. Tested via a fixture suite of representative
+ * .csproj shapes (attribute-form, element-form, Central Package
+ * Management, conditional `<ItemGroup>` blocks).
+ */
+/**
+ * Per-package entry extracted from a `.csproj`. Both fields are
+ * post-trimmed; `version` is the raw NuGet version string (which may
+ * be a single version `"9.0.1"` or a range `"[9.0.1, 10.0.0)"` —
+ * osv-scanner accepts both forms in the lockfile's `resolved` field).
+ */
+export interface PackageReferenceEntry {
+    name: string;
+    version: string;
+}
+/**
+ * Match shapes (in priority order):
+ *
+ *   1. `<PackageReference Include="Foo" Version="1.0.0" />` — most
+ *      common; attributes can appear in any order (also matched
+ *      `Version="1.0.0" Include="Foo"`).
+ *   2. `<PackageReference Include="Foo"><Version>1.0.0</Version>
+ *      </PackageReference>` — element-form, equivalent semantics;
+ *      common in repos that prefer multiline configs or use child
+ *      elements for `<PrivateAssets>`/`<IncludeAssets>` siblings.
+ *   3. `<PackageReference Include="Foo" />` WITHOUT Version — Central
+ *      Package Management (CPM): the version comes from a separate
+ *      `Directory.Packages.props` file. Skipped here; the CPM-aware
+ *      pass (a future enhancement) would resolve them.
+ *
+ * Skipped shapes:
+ *
+ *   - `<PackageReference Update="Foo" Version="..." />` — CPM
+ *     override syntax for transitive pins; NOT a direct reference.
+ *   - `<GlobalPackageReference ... />` — CPM-only; pins all projects.
+ *     Not a direct reference of this csproj.
+ *   - Comments / CDATA — best-effort; the regex is generous and
+ *     can theoretically match `<!-- <PackageReference ... -->`
+ *     comments; users with literal PackageReference strings inside
+ *     comments would get false positives. Acceptable: pathological
+ *     case, and osv-scanner won't surface advisories for non-real
+ *     packages, so the worst case is a wasted scan entry.
+ */
+export declare function parseCsprojPackageReferences(xml: string): PackageReferenceEntry[];
+/**
+ * Generate the body of an ad-hoc `packages.lock.json` that osv-scanner
+ * v2.x reads via `--lockfile=<path>` (caller MUST write this content to
+ * a file literally named `packages.lock.json` — osv-scanner detects
+ * ecosystem by filename). The schema matches NuGet's native
+ * `dotnet restore`-produced lockfile (which osv-scanner already
+ * supports natively), simplified to the minimum osv-scanner consults
+ * for vulnerability matching:
+ *
+ *   {
+ *     "version": 1,
+ *     "dependencies": {
+ *       "net0.0": {
+ *         "<Pkg>": {
+ *           "type": "Direct",
+ *           "resolved": "<Version>",
+ *           "requested": "[<Version>, )"
+ *         }
+ *       }
+ *     }
+ *   }
+ *
+ * - `"version": 1` matches `dotnet restore`'s lockfile schema version.
+ * - `"net0.0"` is a placeholder framework moniker — osv-scanner reads
+ *   the package map without validating the framework key, so any
+ *   non-empty string works. We use a non-real moniker so it can't be
+ *   confused with a real target framework in downstream debugging.
+ * - `type: "Direct"` truthfully reflects that we ONLY parsed direct
+ *   references. Transitive vulns are out of scope for this path
+ *   (covered by D025c's `dotnet list` codepath when available).
+ * - `requested` is a NuGet version range; we use a single-anchored
+ *   `[V, )` form so the lockfile is valid even though the real
+ *   `.csproj` might have been a pinned single version.
+ *
+ * Returns a JSON-stringified string suitable for writing to a temp
+ * file. Callers should clean up the temp file after osv-scanner
+ * consumes it.
+ */
+export declare function buildNugetAdhocLockfile(entries: ReadonlyArray<PackageReferenceEntry>): string;
+//# sourceMappingURL=nuget-package-reference.d.ts.map

package/dist/analyzers/tools/nuget-package-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nuget-package-reference.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/nuget-package-reference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,EAAE,CA6BjF;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAiB7F"}