@vyuhlabs/dxkit 2.4.6 → 2.4.8

package/dist/languages/csharp.js

@@ -39,14 +39,20 @@ exports.parseDotnetVulnerableOutput = parseDotnetVulnerableOutput;
 exports.parseProjectAssetsJson = parseProjectAssetsJson;
 exports.buildCsharpTopLevelDepIndex = buildCsharpTopLevelDepIndex;
 exports.findAllProjectAssetsJson = findAllProjectAssetsJson;
+exports.findAllCsprojFiles = findAllCsprojFiles;
 exports.mergeAssetParses = mergeAssetParses;
 exports.extractCsharpImportsRaw = extractCsharpImportsRaw;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const exclusions_1 = require("../analyzers/tools/exclusions");
+const nuget_package_reference_1 = require("../analyzers/tools/nuget-package-reference");
 const osv_1 = require("../analyzers/tools/osv");
+const osv_scanner_deps_1 = require("../analyzers/tools/osv-scanner-deps");
 const runner_1 = require("../analyzers/tools/runner");
+const run_tests_helper_1 = require("../analyzers/tools/run-tests-helper");
 const tool_registry_1 = require("../analyzers/tools/tool-registry");
+const walk_paths_1 = require("../analyzers/tools/walk-paths");
 function dirHasMatching(dir, regex) {
     try {
         return fs.readdirSync(dir).some((name) => regex.test(name));
@@ -55,49 +61,32 @@ function dirHasMatching(dir, regex) {
         return false;
     }
 }
-function findMatchingRecursive(cwd, regex, maxDepth = 3) {
-    function search(dir, depth) {
-        if (depth > maxDepth)
-            return null;
-        let entries;
-        try {
-            entries = fs.readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            return null;
-        }
-        for (const e of entries) {
-            if (e.name.startsWith('.') ||
-                ['node_modules', 'bin', 'obj', 'TestResults', 'packages'].includes(e.name)) {
-                continue;
-            }
-            const full = path.join(dir, e.name);
-            if (e.isFile() && regex.test(e.name))
-                return full;
-            if (e.isDirectory()) {
-                const nested = search(full, depth + 1);
-                if (nested)
-                    return nested;
-            }
-        }
-        return null;
-    }
-    return search(cwd, 0);
-}
 function findCoberturaArtifact(cwd) {
     // Common layouts:
     //   coverage/coverage.cobertura.xml        (explicit run)
     //   TestResults/<guid>/coverage.cobertura.xml  (default `dotnet test --collect`)
+    //
+    // The canonical walker rightly excludes `TestResults/` (a build-
+    // output subtree) from manifest/source discovery, but here we need
+    // to look INSIDE it. We run the walker scoped to the TestResults
+    // directory itself with `respectIgnore: false` so the bundled
+    // excludes don't fire — we're starting from inside the very subtree
+    // they were meant to prune. Depth-unlimited so future tooling that
+    // nests artifacts deeper than today's `TestResults/<guid>/` shape
+    // still finds them.
     const top = path.join(cwd, 'coverage', 'coverage.cobertura.xml');
     if (fs.existsSync(top))
         return top;
     const testResults = path.join(cwd, 'TestResults');
-    if (fs.existsSync(testResults)) {
-        const nested = findMatchingRecursive(testResults, /coverage\.cobertura\.xml$/, 4);
-        if (nested)
-            return nested;
-    }
-    return null;
+    if (!fs.existsSync(testResults))
+        return null;
+    const matches = (0, walk_paths_1.walkPaths)(testResults, {
+        extensions: ['.xml'],
+        respectIgnore: false,
+    }).filter((rel) => rel.endsWith('coverage.cobertura.xml'));
+    if (matches.length === 0)
+        return null;
+    return path.join(testResults, matches[0]);
 }
 function round1(n) {
     return Math.round(n * 10) / 10;
@@ -218,6 +207,7 @@ function parseDotnetVulnerableOutput(raw) {
                 package: pkgId,
                 installedVersion: resolvedVersion,
                 tool: 'dotnet-vulnerable',
+                packId: 'csharp',
                 severity,
             };
             if (topLevelDep && topLevelDep.length > 0)
@@ -343,43 +333,39 @@ function buildCsharpTopLevelDepIndex(parsed) {
  *
  * Exported for test coverage.
  */
-function findAllProjectAssetsJson(cwd, maxDepth = 4) {
+function findAllProjectAssetsJson(cwd) {
+    // Project-anchored discovery: every `obj/project.assets.json` sits
+    // next to a `.csproj`. Find every `.csproj` via the canonical walker
+    // (depth-unlimited, exclusion-aware), then probe each project's
+    // `obj/project.assets.json` directly. This replaces a parallel
+    // depth-capped walker that missed deep monorepos (the .NET WinForms
+    // benchmark's .csproj files sit 6–9 levels under repo root) and naturally
+    // inherits the same `.gitignore` / `.dxkit-ignore` / standard
+    // exclusion rules every other dxkit walker honors.
     const out = [];
-    function search(dir, depth) {
-        if (depth > maxDepth)
-            return;
-        let entries;
-        try {
-            entries = fs.readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        // Direct-child shortcut: if this directory is `obj`, collect the
-        // file right here before recursing siblings. Skipping recursion
-        // into `obj/` keeps the walk bounded (obj/ contains no deeper
-        // projects of its own).
-        if (path.basename(dir) === 'obj') {
-            for (const e of entries) {
-                if (e.isFile() && e.name === 'project.assets.json') {
-                    out.push(path.join(dir, e.name));
-                }
-            }
-            return;
-        }
-        for (const e of entries) {
-            if (e.name.startsWith('.') ||
-                ['node_modules', 'bin', 'TestResults', 'packages'].includes(e.name)) {
-                continue;
-            }
-            if (e.isDirectory()) {
-                search(path.join(dir, e.name), depth + 1);
-            }
-        }
+    for (const csproj of findAllCsprojFiles(cwd)) {
+        const assets = path.join(path.dirname(csproj), 'obj', 'project.assets.json');
+        if (fs.existsSync(assets))
+            out.push(assets);
     }
-    search(cwd, 0);
     return out;
 }
+/**
+ * Locate every `.csproj` reachable from cwd within `maxDepth` levels.
+ * D025f (2.4.7): the direct-parsing fallback iterates this list when
+ * `dotnet list package` can't produce output (D036: cwd is a parent
+ * of the actual project files, dotnet has no way to pick one).
+ *
+ * Skips standard non-source dirs (node_modules / bin / obj /
+ * TestResults / packages). Unlike `findAllProjectAssetsJson` (which
+ * needs `obj/`), this walk's targets sit in project root directories
+ * so the obj-skip is fine.
+ *
+ * Exported for test coverage.
+ */
+function findAllCsprojFiles(cwd) {
+    return (0, walk_paths_1.walkPaths)(cwd, { extensions: ['.csproj'] }).map((rel) => path.join(cwd, rel));
+}
 /**
  * Merge multiple `project.assets.json` parse results into a single
  * graph. `topLevels` unions across projects; `edges` unions the
@@ -434,35 +420,175 @@ function loadCsharpTopLevelDepIndex(cwd) {
     return buildCsharpTopLevelDepIndex(mergeAssetParses(parses));
 }
 /**
- * Single source of truth for the csharp pack's dep-vuln gathering.
- * Consumed by `csharpDepVulnsProvider` (capability dispatcher). Runs
- * independently of `dotnet-format` availability — historical bug where
- * projects with `dotnet` but no `dotnet-format` saw zero vuln data.
+ * D025f (2.4.7) — direct PackageReference scan via osv-scanner.
  *
- * Project-file gating: dotnet list requires a .csproj or .sln in cwd
- * to identify what to scan. Without one it'd fail with a non-JSON
- * error message. Mirrors the python pack manifest gating from 10h.3.3
- * — return null cleanly rather than scan an unrelated scope.
+ * Fallback gather path that bypasses `dotnet list package` entirely.
+ * Used when (a) dotnet isn't installed or (b) dotnet ran but produced
+ * no output (D036: cwd is a parent directory and dotnet can't pick
+ * a project file).
+ *
+ * Architecture:
+ *   1. Walk every `.csproj` under cwd (depth 5).
+ *   2. Parse each via `parseCsprojPackageReferences`.
+ *   3. Union direct PackageReferences across all .csprojs (dedup by
+ *      name@version; cross-csproj version collisions documented in
+ *      the parser-helper layer as last-write-wins at lockfile time).
+ *   4. Generate ad-hoc `packages.lock.json` schema → temp file.
+ *   5. Invoke osv-scanner via `--lockfile=NuGet:<tmp>`.
+ *   6. Parse output via the shared `parseOsvScannerFindings` (same
+ *      helper kotlin/java/ruby packs already use for their osv path).
+ *   7. Clean up temp file.
+ *
+ * Transitive coverage: NOT included. The direct-parsing path only
+ * surfaces vulnerabilities in packages explicitly listed in a .csproj's
+ * `<PackageReference>` blocks. Industry studies put ~80% of typical
+ * .NET CVE surface on direct refs; the remaining ~20% needs
+ * `project.assets.json` or `dotnet list --include-transitive` which
+ * the D025c path covers when available.
+ *
+ * Return shape: same `DepVulnGatherOutcome` as the primary gather.
+ * `unavailableReason` carries the original dotnet failure reason
+ * concatenated with the fallback's own failure (osv-scanner missing,
+ * no parseable references, etc.) so the customer can trace BOTH
+ * paths' state from a single message.
  */
-async function gatherCsharpDepVulnsResult(cwd) {
-    if (!hasCsharpProject(cwd))
-        return { kind: 'tool-missing' };
-    // `--include-transitive` (10h.4.4.c) extends the scan to indirect
-    // deps; without it NuGet would only report vulns where the
-    // vulnerable package is itself declared in .csproj. Transitive
-    // attribution lands via `project.assets.json` below.
-    const vulnRaw = (0, runner_1.run)('dotnet list package --vulnerable --include-transitive --format json 2>/dev/null', cwd, 120000);
-    if (!vulnRaw)
-        return { kind: 'no-output' };
+async function gatherDirectPackageReferenceFallback(cwd, dotnetFailureReason) {
+    const csprojs = findAllCsprojFiles(cwd);
+    if (csprojs.length === 0) {
+        // Shouldn't happen (hasCsharpProject already passed) but defensive
+        // in case the walk + the gate diverge somehow.
+        return {
+            kind: 'unavailable',
+            reason: `${dotnetFailureReason}; no .csproj files for direct-parsing fallback`,
+        };
+    }
+    const scanner = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['osv-scanner'], cwd);
+    if (!scanner.available || !scanner.path) {
+        return {
+            kind: 'unavailable',
+            reason: `${dotnetFailureReason}; osv-scanner also unavailable for D025f fallback`,
+        };
+    }
+    // Aggregate PackageReferences across every .csproj. Cross-csproj
+    // dedup at the name+version level here; package-only collisions get
+    // resolved by `buildNugetAdhocLockfile`'s last-write-wins.
+    const entries = [];
+    const seen = new Set();
+    for (const csprojPath of csprojs) {
+        let xml;
+        try {
+            xml = fs.readFileSync(csprojPath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        for (const entry of (0, nuget_package_reference_1.parseCsprojPackageReferences)(xml)) {
+            const key = `${entry.name}@${entry.version}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            entries.push(entry);
+        }
+    }
+    if (entries.length === 0) {
+        return {
+            kind: 'no-manifest',
+            reason: `${csprojs.length} .csproj files contain no parseable PackageReferences (possibly Central Package Management — Version comes from Directory.Packages.props which D025f doesn't yet resolve)`,
+        };
+    }
+    // osv-scanner v2.x detects lockfile ecosystem by FILENAME — there's
+    // no `--lockfile=NuGet:<path>` syntax (verified 2026-05-12 during
+    // D025f integration; that syntax was speculation). The NuGet
+    // extractor only fires when the file is literally named
+    // `packages.lock.json`. We create a process-unique temp DIRECTORY
+    // and write the adhoc file inside it as `packages.lock.json`; the
+    // dir wraps the file so concurrent dxkit runs don't collide on a
+    // single `/tmp/packages.lock.json` path.
+    const adhocDir = fs.mkdtempSync(path.join(os.tmpdir(), `dxkit-nuget-adhoc-${process.pid}-`));
+    const adhocPath = path.join(adhocDir, 'packages.lock.json');
+    try {
+        fs.writeFileSync(adhocPath, (0, nuget_package_reference_1.buildNugetAdhocLockfile)(entries));
+        const raw = (0, runner_1.run)(`${scanner.path} scan source --lockfile=${adhocPath} --format json 2>/dev/null`, cwd, 180000);
+        if (!raw) {
+            return {
+                kind: 'unavailable',
+                reason: `${dotnetFailureReason}; D025f fallback ran but osv-scanner produced no output on ${entries.length} parsed PackageReferences`,
+            };
+        }
+        const { counts, findings, vulnsForCvss } = (0, osv_scanner_deps_1.parseOsvScannerFindings)(raw, 'NuGet', 'csharp');
+        // Per-finding CVSS enrichment — mirrors the primary csharp gather's
+        // OSV alias-fallback path. Direct PackageReferences carry the
+        // package name + version; osv-scanner emits the advisory IDs;
+        // resolveCvssScores attaches scores via GHSA → CVE alias chain.
+        if (findings.length > 0) {
+            const resolved = await (0, osv_1.resolveCvssScores)(vulnsForCvss);
+            for (const f of findings) {
+                const score = resolved.get(f.id);
+                if (score !== null && score !== undefined)
+                    f.cvssScore = score;
+            }
+        }
+        const envelope = {
+            schemaVersion: 1,
+            tool: 'osv-scanner-nuget-direct',
+            enrichment: 'osv.dev',
+            counts,
+            findings,
+        };
+        return { kind: 'success', envelope };
+    }
+    finally {
+        // Clean up the whole adhoc directory (file + dir). Best-effort —
+        // the OS will reap `/tmp/` on next boot if we miss it.
+        try {
+            fs.unlinkSync(adhocPath);
+        }
+        catch {
+            /* best-effort */
+        }
+        try {
+            fs.rmdirSync(adhocDir);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+/**
+ * Run `dotnet list package --vulnerable --include-transitive` on cwd
+ * and return a DepVulnGatherOutcome. The "primary" half of the
+ * always-merge G_v4_9 strategy. Pulled out of
+ * `gatherCsharpDepVulnsResult` so both halves can run in parallel.
+ *
+ * Returns no-manifest for the dotnet-not-installed case (the
+ * dotnet-vulnerable path simply can't run); the fallback-half is
+ * the source of truth in that case.
+ */
+async function runDotnetVulnerablePath(cwd) {
+    const dotnet = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['dotnet-format'], cwd);
+    if (!dotnet.available || !dotnet.path) {
+        return {
+            kind: 'no-manifest',
+            reason: 'dotnet SDK not installed (osv-scanner path covers this case)',
+        };
+    }
+    const vulnRaw = (0, runner_1.run)(`${dotnet.path} list package --vulnerable --include-transitive --format json 2>/dev/null`, cwd, 120000);
+    if (!vulnRaw) {
+        // D036 case: dotnet couldn't pick a project from this cwd (e.g.
+        // cwd is the repo root, the .csproj lives in a sub-dir). Treat
+        // as no-manifest at this layer; the always-merge wrapper relies
+        // on the osv-scanner-nuget-direct half to surface vulns instead.
+        return { kind: 'no-manifest', reason: 'dotnet list package produced no output (D036)' };
+    }
     const parsed = parseDotnetVulnerableOutput(vulnRaw);
-    if (!parsed)
-        return { kind: 'parse-error' };
+    if (!parsed) {
+        return { kind: 'unavailable', reason: 'dotnet list package output failed JSON parse' };
+    }
     const { counts, findings } = parsed;
     // Attach top-level attribution to transitive findings (top-level
     // findings already carry self-attribution from the parser). Skipped
     // when project.assets.json is absent — user hasn't run
-    // `dotnet restore`, or the obj/ dir was cleaned. Findings ship with
-    // `topLevelDep` unset in that case, matching Python's no-venv path.
+    // `dotnet restore`, or the obj/ dir was cleaned.
     const transitiveNeedsAttribution = findings.some((f) => !f.topLevelDep || f.topLevelDep.length === 0);
     if (transitiveNeedsAttribution) {
         const topLevelIndex = loadCsharpTopLevelDepIndex(cwd);
@@ -476,56 +602,149 @@ async function gatherCsharpDepVulnsResult(cwd) {
             }
         }
     }
+    const envelope = {
+        schemaVersion: 1,
+        tool: 'dotnet-vulnerable',
+        enrichment: null,
+        counts,
+        findings,
+    };
+    return { kind: 'success', envelope };
+}
+/**
+ * Single source of truth for the csharp pack's dep-vuln gathering.
+ * Consumed by `csharpDepVulnsProvider` (capability dispatcher).
+ *
+ * G_v4_9 (2.4.7 Phase C1.9) always-merge strategy:
+ *
+ *   **Both tools run, results merge by fingerprint** when each is
+ *   available. The csharp pack's gather is now cwd-invariant: the
+ *   same fingerprint set is produced regardless of where cwd points
+ *   within the repo. Pre-G_v4_9 the gather was cwd-sensitive (D107):
+ *   at sub-roots with stale `obj/project.assets.json`, dotnet
+ *   returned 0 findings and the safety-net fallback didn't fire
+ *   (its condition required no project.assets.json); at repo-root,
+ *   dotnet returned no output (D036) and the fallback fired correctly,
+ *   surfacing 2 NuGet CVEs on the .NET WinForms benchmark. Different cwd, different
+ *   totals — same disease class as D086/D087/D091 at the pack-contract
+ *   layer instead of the consumer layer.
+ *
+ *   **dotnet path** (`dotnet list package --vulnerable --include-transitive`):
+ *   surfaces transitive vulns via NuGet's own resolution when
+ *   `dotnet restore` has been run.
+ *
+ *   **osv-scanner-nuget-direct path**: parses every `.csproj` for
+ *   direct PackageReferences, writes an adhoc `packages.lock.json`,
+ *   runs osv-scanner. Covers ~80% of typical .NET CVE surface
+ *   (direct refs only — no transitive resolution).
+ *
+ *   Findings union, fingerprint-deduped at (package, installedVersion,
+ *   id). Envelope counts recomputed from the merged set. Both tool
+ *   names join in the envelope's `tool` field so users see what
+ *   actually ran.
+ *
+ * Manifest gate: a `.csproj` or `.sln` must be findable within depth 5
+ * (D035 / `hasCsharpProject`). Below that, the gather doesn't even
+ * try — that's a `no-manifest` outcome.
+ */
+async function gatherCsharpDepVulnsResult(cwd) {
+    if (!hasCsharpProject(cwd)) {
+        return { kind: 'no-manifest', reason: 'no .csproj or .sln found within depth 5' };
+    }
+    // Run both tools in parallel. Each returns a DepVulnGatherOutcome;
+    // we merge whatever succeeds.
+    const [primaryOutcome, fallbackOutcome] = await Promise.all([
+        runDotnetVulnerablePath(cwd),
+        gatherDirectPackageReferenceFallback(cwd, 'G_v4_9 always-merge'),
+    ]);
+    // Pick the better outcome when both fail to succeed.
+    if (primaryOutcome.kind !== 'success' && fallbackOutcome.kind !== 'success') {
+        // Surface the more-informative reason. `unavailable` (tool ran
+        // and failed) beats `no-manifest` (tool didn't apply).
+        if (primaryOutcome.kind === 'unavailable')
+            return primaryOutcome;
+        if (fallbackOutcome.kind === 'unavailable')
+            return fallbackOutcome;
+        // Both no-manifest → genuinely nothing to scan.
+        return {
+            kind: 'no-manifest',
+            reason: 'csharp dep-vuln scan unavailable on this cwd: both dotnet and osv-scanner-nuget-direct returned no-manifest',
+        };
+    }
+    // Merge findings from whichever succeeded. Dedup at the pack layer
+    // by (package, installedVersion, id) so envelope counts are honest;
+    // downstream aggregator also fingerprints to be safe.
+    const primaryFindings = primaryOutcome.kind === 'success' ? (primaryOutcome.envelope.findings ?? []) : [];
+    const fallbackFindings = fallbackOutcome.kind === 'success' ? (fallbackOutcome.envelope.findings ?? []) : [];
+    const merged = [];
+    const seen = new Set();
+    for (const f of [...primaryFindings, ...fallbackFindings]) {
+        const key = `${f.package}\0${f.installedVersion ?? ''}\0${f.id}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        merged.push(f);
+    }
     // Alias-fallback CVSS pass: dotnet --vulnerable ships zero CVSS data
     // per advisory; the GHSA id (extracted from advisoryUrl) is the only
     // anchor. resolveCvssScores looks up via GHSA → CVE alias chain.
-    if (findings.length > 0) {
-        const cvssInputs = findings.map((f) => ({
+    // Run on the merged set so fallback findings also get enriched if
+    // dotnet's path didn't carry them.
+    if (merged.length > 0) {
+        const cvssInputs = merged.map((f) => ({
             primaryId: f.id,
             embeddedCvss: f.cvssScore ?? null,
             aliases: f.aliases ?? [],
         }));
         const resolved = await (0, osv_1.resolveCvssScores)(cvssInputs);
-        for (const f of findings) {
+        for (const f of merged) {
             const score = resolved.get(f.id);
             if (score !== null && score !== undefined)
                 f.cvssScore = score;
         }
     }
+    // Recompute counts from merged set so the envelope is internally
+    // consistent (pre-G_v4_9 each path computed its own counts; sum
+    // would double-count overlapping advisories). aggregator-ok: this
+    // builds the pack's DepVulnResult envelope from its OWN findings,
+    // which is the dispatcher input — distinct from consumer-side
+    // re-aggregation across envelopes that G_v4_8 prohibits.
+    const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+    for (const f of merged)
+        counts[f.severity]++; // aggregator-ok: pack envelope counts from own merged findings
+    // Compose envelope tool names from what actually succeeded.
+    const tools = [];
+    if (primaryOutcome.kind === 'success')
+        tools.push(primaryOutcome.envelope.tool);
+    if (fallbackOutcome.kind === 'success')
+        tools.push(fallbackOutcome.envelope.tool);
+    const enrichment = fallbackOutcome.kind === 'success' ? fallbackOutcome.envelope.enrichment : null;
     const envelope = {
         schemaVersion: 1,
-        tool: 'dotnet-vulnerable',
-        enrichment: null,
+        tool: tools.join(', '),
+        enrichment,
         counts,
-        findings,
+        findings: merged,
     };
     return { kind: 'success', envelope };
 }
-/** True if `cwd` has a .csproj or .sln file at depth 0 or 1 (workspace
- *  layouts often nest projects one level under the repo root). */
+/**
+ * True if `cwd` (or any nested directory up to depth 5) contains a
+ * `.csproj` or `.sln` file. Used as the depVulns gather preflight —
+ * `dotnet list package --vulnerable` needs a project file in scope.
+ *
+ * Depth 5 mirrors `csharp.detect()`'s recursive walk (D024 / 2.4.7):
+ * enterprise layouts like the .NET WinForms benchmark nest .csproj under
+ * `Code/Source/Dev/Core/<Module>/`. Pre-D035, this was a depth-1
+ * custom walk; symmetrical with detect()'s old depth-3 limit until
+ * D024 broke the symmetry. The Sprint A validation
+ * (2026-05-12) surfaced the inconsistency — D025c's tool-registry
+ * probe was unreachable from `Code/Source/` because this preflight
+ * rejected before reaching it. See D035 in tmp/known-defects.md.
+ */
 function hasCsharpProject(cwd) {
-    let entries;
-    try {
-        entries = fs.readdirSync(cwd, { withFileTypes: true });
-    }
-    catch {
-        return false;
-    }
-    for (const e of entries) {
-        if (e.isFile() && (e.name.endsWith('.csproj') || e.name.endsWith('.sln')))
-            return true;
-        if (e.isDirectory() && !e.name.startsWith('.') && e.name !== 'node_modules') {
-            try {
-                const sub = fs.readdirSync(path.join(cwd, e.name), { withFileTypes: true });
-                if (sub.some((s) => s.isFile() && (s.name.endsWith('.csproj') || s.name.endsWith('.sln'))))
-                    return true;
-            }
-            catch {
-                /* unreadable subdir — ignore */
-            }
-        }
-    }
-    return false;
+    return (dirHasMatching(cwd, /\.(sln|csproj)$/) ||
+        (0, walk_paths_1.walkPaths)(cwd, { extensions: ['.csproj', '.sln'] }).length > 0);
 }
 const csharpDepVulnsProvider = {
     source: 'csharp',
@@ -533,6 +752,9 @@ const csharpDepVulnsProvider = {
         const outcome = await gatherCsharpDepVulnsResult(cwd);
         return outcome.kind === 'success' ? outcome.envelope : null;
     },
+    async gatherOutcome(cwd) {
+        return gatherCsharpDepVulnsResult(cwd);
+    },
 };
 /**
  * Single source of truth for the csharp pack's lint gathering.
@@ -599,11 +821,56 @@ function gatherCsharpCoverageResult(cwd) {
         return null;
     return { schemaVersion: 1, tool: `coverage:${coverage.source}`, coverage };
 }
+/**
+ * Run `dotnet test --collect:"XPlat Code Coverage"` from cwd (D021).
+ *
+ * `dotnet test --collect` is the canonical way to materialize coverage
+ * across the whole solution. It auto-discovers test projects and writes
+ * a cobertura XML into `TestResults/<guid>/coverage.cobertura.xml`,
+ * where `<guid>` is generated per test run. The artifact param uses
+ * the function form so the helper locates the actual file post-run via
+ * the existing `findCoberturaArtifact` (which already knows the
+ * TestResults layout and the explicit `coverage/coverage.cobertura.xml`
+ * fallback).
+ *
+ * `--results-directory TestResults` pins the parent directory so
+ * `findCoberturaArtifact` doesn't have to walk arbitrary roots — the
+ * GUID-named subdirectory underneath is still non-deterministic but
+ * bounded.
+ *
+ * Preflight: require a `.csproj` or `.sln` in cwd. Without one, this
+ * isn't a .NET project root. We don't preflight `dotnet` itself — the
+ * spawn ENOENT path classifies it as `unavailable` cleanly.
+ */
+function runCsharpTestsWithCoverage(cwd) {
+    return Promise.resolve((0, run_tests_helper_1.runTestsWithCoverage)({
+        pack: 'csharp',
+        cmd: 'dotnet test --collect:"XPlat Code Coverage" --results-directory TestResults',
+        cwd,
+        artifact: (cwd) => {
+            const abs = findCoberturaArtifact(cwd);
+            if (!abs)
+                return null;
+            return path.relative(cwd, abs).split(path.sep).join('/');
+        },
+        preflight: (cwd) => {
+            const hasManifest = dirHasMatching(cwd, /\.(sln|csproj)$/i) ||
+                (0, walk_paths_1.walkPaths)(cwd, { extensions: ['.csproj', '.sln'] }).length > 0;
+            if (!hasManifest) {
+                return 'no .csproj or .sln in this directory tree — not a .NET project';
+            }
+            return null;
+        },
+    }));
+}
 const csharpCoverageProvider = {
     source: 'csharp',
     async gather(cwd) {
         return gatherCsharpCoverageResult(cwd);
     },
+    async runTests(cwd) {
+        return runCsharpTestsWithCoverage(cwd);
+    },
 };
 /**
  * Capture C# `using` directives from source text, including
@@ -669,7 +936,7 @@ const csharpImportsProvider = {
  * `.csproj` referencing these returns null.
  */
 function gatherCsharpTestFrameworkResult(cwd) {
-    const hasCsproj = (0, runner_1.fileExists)(cwd, '*.csproj') || !!findMatchingRecursive(cwd, /\.csproj$/, 3);
+    const hasCsproj = (0, runner_1.fileExists)(cwd, '*.csproj') || (0, walk_paths_1.walkPaths)(cwd, { extensions: ['.csproj'] }).length > 0;
     if (!hasCsproj)
         return null;
     const csproj = (0, runner_1.run)("find . -name '*.csproj' -exec grep -l 'xunit\\|nunit\\|MSTest' {} \\; 2>/dev/null | head -1", cwd);
@@ -690,19 +957,23 @@ const csharpTestFrameworkProvider = {
  * or null — callers skip cleanly on null.
  */
 function findCsharpLicenseInput(cwd) {
-    // .sln in root first — one pass over the whole solution.
-    let entries;
-    try {
-        entries = fs.readdirSync(cwd, { withFileTypes: true });
-    }
-    catch {
+    // Prefer a `.sln` (covers every csproj in the solution in one
+    // nuget-license pass) over a single `.csproj`. Within each kind,
+    // pick the shallowest match — closest to repo root is the most
+    // likely "primary" manifest. Depth-unlimited via the canonical
+    // walker, so deep monorepos (manifests 6–9 levels under repo root)
+    // discover them where prior hard depth caps silently missed.
+    const manifests = (0, walk_paths_1.walkPaths)(cwd, { extensions: ['.csproj', '.sln'] });
+    if (manifests.length === 0)
         return null;
-    }
-    const sln = entries.find((e) => e.isFile() && e.name.endsWith('.sln'));
-    if (sln)
-        return path.join(cwd, sln.name);
-    // Fall back to first .csproj reachable within the standard depth.
-    return findMatchingRecursive(cwd, /\.csproj$/, 3);
+    manifests.sort((a, b) => {
+        const aIsSln = a.endsWith('.sln') ? 0 : 1;
+        const bIsSln = b.endsWith('.sln') ? 0 : 1;
+        if (aIsSln !== bIsSln)
+            return aIsSln - bIsSln;
+        return a.split('/').length - b.split('/').length;
+    });
+    return path.join(cwd, manifests[0]);
 }
 /**
  * Single source of truth for the csharp pack's license gathering.
@@ -714,25 +985,116 @@ function findCsharpLicenseInput(cwd) {
  * tool, wrapped. Returns null cleanly when no .sln/.csproj is present
  * or when the tool isn't installed.
  */
+/**
+ * D031-2 (2.4.7) — degraded license inventory fallback.
+ *
+ * When `nuget-license` is unavailable but we have `.csproj` files,
+ * parse direct PackageReferences from each .csproj and emit a
+ * LicensesResult with `licenseType: 'UNKNOWN'` per package — name +
+ * version only. Reuses the D025f-1 `parseCsprojPackageReferences`
+ * helper (and `findAllCsprojFiles` walker) so this fallback shares
+ * one truth source with the depVulns direct-scan path.
+ *
+ * Customer outcome on the .NET WinForms benchmark: pre-D031 → "0 packages" (with the
+ * pack reporting `unavailable` because `nuget-license` is missing).
+ * Post-D031 → "53 packages identified; license info unavailable" via
+ * the markdown framing banner from `analyzers/licenses/index.ts`.
+ * The customer can decide remediation BEFORE installing nuget-license
+ * (e.g., "we have 53 NuGet deps; install nuget-license to see their
+ * licenses" is more actionable than "0 packages").
+ *
+ * Returns `null` when the degraded path itself can't produce data
+ * (no .csproj files at all, or every .csproj has zero parseable
+ * PackageReferences). Caller propagates the original `unavailable`
+ * outcome in those cases.
+ */
+function gatherCsharpLicensesDegradedInventory(cwd) {
+    const csprojs = findAllCsprojFiles(cwd);
+    if (csprojs.length === 0)
+        return null;
+    const entries = [];
+    const seen = new Set();
+    for (const csprojPath of csprojs) {
+        let xml;
+        try {
+            xml = fs.readFileSync(csprojPath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        for (const entry of (0, nuget_package_reference_1.parseCsprojPackageReferences)(xml)) {
+            const key = `${entry.name}@${entry.version}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            entries.push(entry);
+        }
+    }
+    if (entries.length === 0)
+        return null;
+    const findings = entries.map((e) => ({
+        package: e.name,
+        version: e.version,
+        licenseType: 'UNKNOWN',
+        // No license URL / description / supplier — the degraded path only
+        // has the manifest reference. Customer can identify what's
+        // installed; install nuget-license for the full inventory.
+    }));
+    return {
+        schemaVersion: 1,
+        tool: 'csharp-package-reference-degraded',
+        findings,
+    };
+}
 function gatherCsharpLicensesResult(cwd) {
     const input = findCsharpLicenseInput(cwd);
-    if (!input)
-        return null;
+    if (!input) {
+        return { kind: 'no-manifest', reason: 'no .csproj or .sln found within depth 3' };
+    }
     const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['nuget-license'], cwd);
-    if (!status.available || !status.path)
-        return null;
+    if (!status.available || !status.path) {
+        // D031-2: degraded-inventory fallback. nuget-license is the
+        // canonical tool but parsing direct PackageReferences gives the
+        // customer at minimum a name+version inventory while the tool
+        // is being installed. We surface this through the SUCCESS path
+        // (envelope's tool name carries the `-degraded` suffix so
+        // downstream renderers can disambiguate) so the LicensesReport's
+        // summary count reflects real data — the framing banner from
+        // `analyzers/licenses/index.ts` explains the asterisk.
+        //
+        // Path B (no .csproj or empty PackageReferences across all
+        // csprojs): degraded inventory returns null; we propagate the
+        // original `unavailable` so the report frames the gap honestly
+        // ("0 packages" with the explanatory ⚠ banner).
+        const degraded = gatherCsharpLicensesDegradedInventory(cwd);
+        if (degraded)
+            return { kind: 'success', envelope: degraded };
+        return { kind: 'unavailable', reason: 'nuget-license not installed' };
+    }
     const raw = (0, runner_1.run)(`${status.path} -i "${input}" -o JsonPretty 2>/dev/null`, cwd, 180000);
-    if (!raw)
-        return null;
+    if (!raw) {
+        // D031-2 extended (2.4.7): nuget-license commonly produces no
+        // output when `dotnet restore` hasn't been run (no
+        // `obj/project.assets.json` for it to read). Rather than tell
+        // the customer "0 packages," fall back to direct PackageReference
+        // parsing so they get a real inventory. Validated on the .NET WinForms benchmark
+        // 2026-05-13: 53 packages surface via the fallback when
+        // nuget-license itself returns empty.
+        const degraded = gatherCsharpLicensesDegradedInventory(cwd);
+        if (degraded)
+            return { kind: 'success', envelope: degraded };
+        return { kind: 'unavailable', reason: 'nuget-license produced no output' };
+    }
     let data;
     try {
         data = JSON.parse(raw);
     }
-    catch {
-        return null;
+    catch (err) {
+        return { kind: 'unavailable', reason: `nuget-license parse error: ${err.message}` };
+    }
+    if (!Array.isArray(data)) {
+        return { kind: 'unavailable', reason: 'nuget-license output was not a JSON array' };
     }
-    if (!Array.isArray(data))
-        return null;
     // Top-level attribution reuses project.assets.json via
     // loadCsharpTopLevelDepIndex. Same self-parent invariant as the
     // other packs. Missing assets-json (user hasn't run dotnet restore)
@@ -757,15 +1119,34 @@ function gatherCsharpLicensesResult(cwd) {
             isTopLevel: hasIndex ? (parents?.includes(entry.PackageId) ?? false) : undefined,
         });
     }
-    return {
+    // D031-2 extended (2.4.7): if nuget-license ran AND parsed cleanly
+    // but produced zero valid findings, the canonical scan failed
+    // silently (typically: assets.json absent → tool emits an empty
+    // array). Same customer-visibility concern as the no-output path
+    // — fall back to degraded inventory so the customer sees real
+    // packages instead of "0 packages." If the degraded path also
+    // returns null (no .csproj parseable), drop through to the
+    // empty-success path (legitimate "no licenseable deps in this
+    // pack's scope").
+    if (findings.length === 0) {
+        const degraded = gatherCsharpLicensesDegradedInventory(cwd);
+        if (degraded)
+            return { kind: 'success', envelope: degraded };
+    }
+    const envelope = {
         schemaVersion: 1,
         tool: 'nuget-license',
         findings,
     };
+    return { kind: 'success', envelope };
 }
 const csharpLicensesProvider = {
     source: 'csharp',
     async gather(cwd) {
+        const outcome = gatherCsharpLicensesResult(cwd);
+        return outcome.kind === 'success' ? outcome.envelope : null;
+    },
+    async gatherOutcome(cwd) {
         return gatherCsharpLicensesResult(cwd);
     },
 };
@@ -777,10 +1158,107 @@ exports.csharp = {
     // because gather.ts only matched *.test.*, *.spec.*, *_test.*, test_*.
     testFilePatterns: ['*Tests.cs', '*.Tests.cs'],
     extraExcludes: ['bin', 'obj', 'TestResults', 'packages'],
+    // D028 (2.4.7): auto-generated .NET source patterns. Visual Studio's
+    // WinForms designer creates `*.designer.cs` (UI scaffolding,
+    // typically hundreds of lines, repetitive). T4 templates emit
+    // `*.g.cs`. Source generators (Roslyn) emit `*.g.i.cs`. The legacy
+    // AssemblyInfo split files (`*.AssemblyInfo.cs`,
+    // `*.AssemblyAttributes.cs`) are MSBuild-generated. None of these
+    // are human-authored; counting them as "source" inflates Code
+    // Quality + Maintainability dimensions on any .NET UI codebase
+    // (the .NET WinForms benchmark is the motivating case — large
+    // WinForms enterprise app with extensive designer.cs files).
+    autogeneratedSourcePatterns: [
+        '*.designer.cs',
+        '*.Designer.cs',
+        '*.g.cs',
+        '*.g.i.cs',
+        '*.generated.cs',
+        '*.AssemblyInfo.cs',
+        '*.AssemblyAttributes.cs',
+        // WCF "Connected Services" auto-generated proxy classes
+        // (svcutil.exe / Add Service Reference). The .NET WinForms
+        // benchmark's `Reference.cs` was 42,370 lines of WCF proxy. Other tools'
+        // service-reference output (gRPC tools, OpenAPI generators)
+        // commonly also emit `Reference.cs`.
+        'Reference.cs',
+    ],
+    // D027 (2.4.7): C# uses XML-doc triple-slash comments above
+    // public APIs. Pre-D027 the generic doc-comment heuristic
+    // matched JSDoc `/**` only, so the .NET WinForms benchmark's 3,234 .cs files
+    // contributed zero to docCommentFiles even though many carry
+    // `/// <summary>` blocks. POSIX class `[[:space:]]` for cross-
+    // platform grep (BSD vs GNU).
+    docCommentPatterns: ['^[[:space:]]*///'],
+    // D034 (2.4.7): canonical .NET TLS-bypass idioms. Pre-D034 only
+    // Node-shaped (`NODE_TLS_REJECT_UNAUTHORIZED`) and Python-shaped
+    // (`VERIFY_SSL`) tokens were grep'd — every C# project reported
+    // zero TLS-bypass findings even when using
+    // `ServerCertificateValidationCallback = (s,c,ch,e) => true` (the
+    // canonical "accept any certificate" pattern). The .NET WinForms
+    // benchmark is the motivating case: WCF + enterprise integration code commonly
+    // ships permissive callbacks.
+    //
+    // Listed tokens:
+    //   - ServicePointManager.ServerCertificateValidationCallback (legacy)
+    //   - HttpClientHandler.ServerCertificateCustomValidationCallback
+    //     (HttpClient — .NET Core / 5+)
+    //   - SslStream.AuthenticateAsClient* with RemoteCertificateValidationCallback
+    //   - HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
+    //     (.NET 5+ shorthand — literally named `Dangerous*`)
+    tlsBypassPatterns: [
+        'ServerCertificateValidationCallback',
+        'ServerCertificateCustomValidationCallback',
+        'RemoteCertificateValidationCallback',
+        'DangerousAcceptAnyServerCertificateValidator',
+    ],
+    upgradeCommand(name, version) {
+        return `dotnet add package ${name} --version ${version}`;
+    },
+    // .NET spans two very different application shapes: ASP.NET MVC /
+    // Web API (controllers, endpoints) and WinForms / WPF desktop
+    // (Forms, ViewModels, UserControls). Both are first-class
+    // contributors here — a WinForms enterprise app's primary
+    // architecture IS its Forms + Services layer, not a notional
+    // controllers/ directory that doesn't exist on disk. The narrower
+    // routePaths subset stays silent on desktop-only repos so the
+    // "Add API documentation" recommendation doesn't fire there.
+    architecturalShape: {
+        primaryComponentPaths: [
+            '/Controllers/',
+            '/Services/',
+            '/Forms/',
+            '/ViewModels/',
+            '/Pages/',
+            '/Views/',
+            '/UserControls/',
+            '/Handlers/',
+        ],
+        routePaths: ['/Controllers/', '/Endpoints/'],
+        modelPaths: ['/Models/', '/Entities/', '/DTOs/', '/DataTransferObjects/', '/Domain/'],
+        vocabulary: {
+            components: 'Forms/Services',
+            models: 'models',
+            routes: 'endpoints',
+        },
+        testGapPriority: {
+            high: ['/Controllers/', '/Services/', '/Handlers/'],
+            medium: ['/Forms/', '/ViewModels/', '/Pages/', '/Views/', '/UserControls/'],
+        },
+    },
+    clocLanguageNames: ['C#'],
     detect(cwd) {
-        return (dirHasMatching(cwd, /\.(sln|csproj)$/) || findMatchingRecursive(cwd, /\.csproj$/, 3) !== null);
+        // Depth 5 covers enterprise .NET layouts like
+        // `Code/Source/Dev/Core/<Module>/<Module>.csproj` (D024).
+        // Lower limits silently miss these from the repo root.
+        return (dirHasMatching(cwd, /\.(sln|csproj)$/) ||
+            (0, walk_paths_1.walkPaths)(cwd, { extensions: ['.csproj', '.sln'] }).length > 0);
     },
-    tools: ['dotnet-format', 'nuget-license'],
+    // D025f (2.4.7): osv-scanner added — used by the direct-PackageReference
+    // fallback in gatherDirectPackageReferenceFallback when `dotnet list
+    // package` can't produce output (D036). Cross-pack tool; kotlin/java/ruby
+    // already use it via the shared osv-scanner-deps helper.
+    tools: ['dotnet-format', 'nuget-license', 'osv-scanner'],
     // p/csharp semgrep ruleset is sparse — skip until it matures.
     semgrepRulesets: [],
     capabilities: {