@vyuhlabs/dxkit 2.5.0 → 2.5.2

package/CHANGELOG.md

@@ -7,6 +7,237 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.5.2] - 2026-05-22
+
+The "scaffold UX + lifecycle skills + setup automation" release. Closes
+every defect surfaced during the 2026-05-21 guided Codespaces UX
+walkthrough (D145–D156) plus a vestigial-cleanup pass and adds three
+new CLI subcommands + three new lifecycle skills.
+
+Companion release: **`@vyuhlabs/create-dxkit@0.2.0`** ships alongside
+this version, picking up the create-dxkit shim improvements (quieter
+ERESOLVE handling, `--no-audit`, `.npmrc legacy-peer-deps` persistence).
+Tag: `create-dxkit@v0.2.0`. Run `npm init @vyuhlabs/dxkit` to get
+the new combined experience.
+
+Validated end-to-end with two cross-stack walkthroughs on 2026-05-22:
+`vyuhlabs-platform` (python + typescript) and `dpl-studio` (csharp).
+Both stacks: defect closures verified, per-pack devcontainer adapts
+correctly, doctor's new tier-3 surfaces operational gaps with
+actionable fix commands.
+
+### Added
+
+- Three new lifecycle skills under `.claude/skills/`, completing
+  the orthogonal customer-journey trio:
+  - **`dxkit-fix`** — reactive repair. Consumes
+    `vyuh-dxkit doctor --json` output and walks the customer
+    through each fixable check with per-step confirmation.
+  - **`dxkit-update`** — existing-install upgrade orchestrator.
+    Consumes `vyuh-dxkit upgrade --plan --json` and drives a
+    conversational upgrade with version-delta analysis, breaking-
+    change warnings, and per-step confirmation. Hands off to
+    `dxkit-fix` on post-upgrade doctor failures.
+  - **`dxkit-onboard`** — fresh-install orchestrator. Walks the
+    full first-time customer journey end-to-end (install → doctor
+    → fix gaps → baseline → hooks → branch protection → Codespaces
+    prebuild → final verify). Delegates to focused skills for
+    sub-decisions.
+- Three new CLI subcommands:
+  - **`vyuh-dxkit upgrade [--plan [--json] | --yes | --target=X.Y.Z |
+    --dry-run]`** — combined binary + scaffold refresh. `--plan`
+    mode emits structured `upgrade-plan.v1` JSON consumed by the
+    `dxkit-update` skill. Execution mode runs `npm install`
+    + `vyuh-dxkit update` + `vyuh-dxkit doctor` in sequence with
+    a devcontainer-rebuild reminder if applicable.
+  - **`vyuh-dxkit setup-branch-protection [--branch X]
+    [--require-reviews N] [--force]`** — wraps `gh api` to mark
+    `dxkit-guardrails` as a required status check on the default
+    branch. Idempotent merge with existing required-checks list.
+  - **`vyuh-dxkit setup-prebuild [--branch X] [--regions=R1,R2]
+    [--force]`** — wraps `gh api` to configure Codespaces
+    prebuilds. Fresh Codespaces start in ~30s instead of running
+    the full devcontainer build (~7 min after per-stack feature).
+- Doctor third tier — **Operational health**. Six runtime checks
+  (`git hooks active`, `baseline captured`, `vyuh-dxkit on PATH`,
+  `scanner toolchain healthy`, `.npmrc legacy-peer-deps
+  persistence`, `CI guardrails workflow`) each carrying structured
+  fix metadata (hint + command + skill). Plus a new `--json`
+  output mode emitting the `doctor.v1` schema for `dxkit-fix`
+  consumption.
+- `manifest.installFlags` — persists the customer's `init`
+  flag choices in `.vyuh-dxkit.json` so `vyuh-dxkit update`
+  knows exactly which surfaces to refresh. Self-migrates legacy
+  pre-2.5.2 manifests by stamping detected flags back on first
+  update run.
+- Per-pack `LanguageSupport.devcontainerExtensions?` field.
+  Each language pack contributes its VSCode editor extensions;
+  the installer unions across active packs only. Pure-Python
+  Codespaces no longer install Go / Rust / C# / Java / Kotlin /
+  Ruby editor extensions on every container start.
+- Architecture rule (`scripts/check-architecture.sh`) that catches
+  dead `IF_*` template conditions in `constants.ts`. The
+  type-correct compute-without-consumer class of dead code sat
+  for days before the rule landed; rule now blocks new
+  occurrences at pre-commit time.
+- Three new doc pages: `docs/commands/upgrade.md`,
+  `docs/commands/setup-branch-protection.md`,
+  `docs/commands/setup-prebuild.md`.
+
+### Changed
+
+- **`vyuh-dxkit update` actually refreshes everything now.**
+  Pre-this-release, update only re-ran the template generator and
+  silently passed `withDxkitAgents=false`. Customers on 2.5.1 had
+  no path to receive new dxkit-* skills, per-stack devcontainer
+  extensions, doctor pivot, or any other scaffold-side change.
+  `update` now detects which install surfaces the customer
+  originally landed (via `manifest.installFlags` or workspace
+  detection) and re-runs every relevant installer.
+- `vyuh-dxkit doctor` — three-tier framing (Reports + Agent DX +
+  Operational health, was two-tier). Tier 1 + 2 labels +
+  exit-code behavior preserved verbatim; tier 3 is additive.
+- All six existing dxkit-* skill prose files standardized on
+  `npx vyuh-dxkit X` invocations (was a mix of bare + npx forms).
+  Robust to customers whose shell PATH doesn't have dxkit
+  globally installed.
+- Python devcontainer feature switched from `installTools: true`
+  → `false`. The upstream feature's bundled installTools list
+  added ~3 min to every devcontainer build with no dxkit
+  consumer. Saves ~3 min per Codespaces rebuild on python-stack
+  projects.
+- `osv-scanner` install switched from `go install` to GitHub
+  releases binary fetch. Pre-this-release, customers on any
+  non-Go stack silently lost `osv-scanner` (the canonical
+  Tier-2 dep-vuln scanner) because the install command failed
+  without a Go toolchain.
+- `post-create.sh` always runs a global `npm install -g
+  @vyuhlabs/dxkit` in addition to whatever project-local install
+  happened. Without this, `vyuh-dxkit` wasn't on the customer's
+  shell PATH in Codespaces.
+- Init's closing summary surfaces `Next: run vyuh-dxkit
+  baseline create` as a prominent info-level call-to-action
+  immediately after `Done!`, instead of burying it in a dim
+  three-line footer.
+- `create-dxkit` shim: stderr from the first `npm install`
+  attempt is now captured (not streamed) so a peer-dep
+  `ERESOLVE` doesn't print a multi-line error wall before the
+  silent `--legacy-peer-deps` fallback succeeds. `--no-audit`
+  passed to both install attempts so the host project's
+  pre-existing vulnerability count doesn't surface mid-init.
+  Fallback choice persisted to `.npmrc` so the customer's next
+  `npm install <pkg>` doesn't re-hit the same ERESOLVE wall.
+- CI: `actions/cache@v4` on the scanner toolchain
+  (`~/.local/{pipx,bin,share/{detekt,pmd}}`). Saves ~2 min per
+  CI run.
+- Publish workflows (`publish.yml` + `publish-create-dxkit.yml`):
+  verify-shasum poll window 18s → 180s. First-publishes of
+  scoped packages commonly need 30–90s for CDN propagation;
+  the wider window prevents the "publish succeeded but workflow
+  reports failure" mode that bit both 2.5.1 publishes.
+- README, getting-started, docs/README, commands/init.md
+  refreshed to reflect: `npm init @vyuhlabs/dxkit` as canonical
+  first install, 9 lifecycle skills (was 6), postinstall
+  auto-activation of hooks, per-stack devcontainer.
+
+### Removed
+
+- Vestigial `DetectedStack.tools.{gcloud, pulumi, infisical,
+  ghCli}` field. Computed at every detect call since the 2026-
+  05-19 generator simplification removed the `.project.yaml`
+  consumers; nothing referenced them post-cleanup. Doctor's
+  pre-pivot tier-2 `gcloud` + `infisical` availability checks
+  removed alongside (no manifest field to gate on).
+- Six dead `IF_*` template conditions in `constants.ts`:
+  `IF_POSTGRES`, `IF_REDIS`, `IF_HAS_SERVICES`, `IF_DOCKER`,
+  `IF_CLAUDE_CODE`, `IF_COVERAGE_ENABLED`. Computed but no
+  template referenced them; same 2026-05-19 cleanup left them
+  behind. Arch-check rule (above) prevents new occurrences.
+
+### Fixed
+
+- Dispatcher deadline test (`test/dispatcher-deadline.test.ts`):
+  lower-bound assertion 40ms → 25ms. Test was occasionally
+  flaking on fast CI runners where `setTimeout`'s ~1-2ms
+  granularity could fire at 38-39ms.
+
+## [2.5.1] - 2026-05-20
+
+### Added
+
+- New `vyuh-dxkit hooks activate` CLI subcommand. Idempotently sets
+  `core.hooksPath = .githooks`. Wired into `init`'s scaffolded
+  `package.json` as a `postinstall` script so every clone plus
+  `npm install` activates the dxkit hooks transparently — no more
+  one-time-per-clone manual step.
+- New `--with-dxkit-agents` `init` flag (default-on under `--full`).
+  Installs six dxkit-specific skills under `.claude/skills/dxkit-*/`
+  (`learn` / `init` / `config` / `hooks` / `reports` / `action`)
+  alongside `AGENTS.md` (open-standard project context) and a small
+  `CLAUDE.md` shim. The skills wrap the `vyuh-dxkit` CLI as
+  workflow-aware surfaces that Claude Code auto-discovers via skill
+  frontmatter.
+- New optional `LanguageSupport.devcontainerFeature?` field. Each
+  language pack declares its canonical `ghcr.io/devcontainers/features`
+  entry; `installDevcontainer` renders the per-stack features block.
+  Cold devcontainer rebuilds drop from ~25 minutes (every supported
+  toolchain installed) to ~7 minutes on a pure-TypeScript repo
+  (only the toolchains the repo actually needs).
+- New optional `ToolDefinition.applicabilityGuard?` field. Tools
+  whose preconditions aren't met on the current repo
+  (e.g. `vitest-coverage` on a mocha-based codebase) now report as
+  `n/a` with an inline reason instead of inflating the
+  missing-count. `tools install` filters n/a entries from the
+  install loop.
+- New `@vyuhlabs/create-dxkit` shim package (zero dependencies; code
+  shipped under `packages/create-dxkit/`). First npm publish is a
+  manual tag-and-release step after this version lands on main.
+  Once published, `npm init @vyuhlabs/dxkit` will collapse the
+  prior two-step first install (`npm i -D @vyuhlabs/dxkit && npx
+  vyuh-dxkit init`) into one command.
+
+### Changed
+
+- The generic 73-file `.claude/` scaffold (`agents/`,
+  `agents-available/`, `commands/`, generic skills, etc.) is replaced
+  with six dxkit-specific skills plus `AGENTS.md` and the
+  `CLAUDE.md` shim. Customers upgrading keep their existing
+  `.claude/` (`init` is additive — won't overwrite without
+  `--force`). Fresh `--full` installs now land ~20 files instead of
+  ~73, focused entirely on equipping coding agents to drive the
+  dxkit CLI safely.
+- `post-create.sh` now falls back through a three-step npm install
+  chain (`npm ci` → `npm install` → `npm install --legacy-peer-deps`)
+  so brownfield Node monorepos with peer-dep tangles survive the
+  devcontainer post-create cleanly.
+- `doctor` no longer checks for the deleted generic scaffold files.
+  It now reports an `X/6 dxkit-* skills present` tally plus an
+  `AGENTS.md` presence check, giving customers a clearer signal of
+  what's missing on partially-scaffolded repos.
+
+### Fixed
+
+- Graphify's on-disk cache no longer leaks `graphify-out/cache/` into
+  consumer repos. The temp-dir redirection monkey-patch now fires
+  before the first graphify call; `graphify-out/` is also added to
+  the scaffolded `.gitignore` defensively.
+
+### Deferred to next polish release
+
+The following items rolled out of this release and will ship in
+2.5.2 (or bundle into 2.6 depending on the marketplace decision):
+
+- `vyuh-dxkit setup-branch-protection` CLI (wraps `gh api` for
+  branch-protection enforcement).
+- `vyuh-dxkit setup-prebuild` CLI (wraps `gh api` for Codespaces
+  prebuilds — cold-start cuts from ~25 minutes to ~30 seconds).
+- Full `doctor` pivot to onboarding-health checks (hooks active,
+  branch protection set, baseline current). This release partially
+  shipped the pivot — the generic-scaffold checks were dropped — but
+  the new positive checks await the two CLI subcommands above.
+- CI tool cache via `actions/cache@v4` on the scanner toolchain in
+  `dxkit-guardrails.yml`.
+
 ## [2.5.0] - 2026-05-18
 
 ### Summary

package/README.md

@@ -9,7 +9,7 @@ agent DX; one baseline turns on the guardrails.** Works across major
 language stacks, greenfield or brownfield.
 
 ```bash
-npx @vyuhlabs/dxkit@latest init --full
+npm init @vyuhlabs/dxkit
 ```
 
 <p>
@@ -45,28 +45,37 @@ the grading path.
 
 ---
 
-## What `init --full` creates
+## What `npm init @vyuhlabs/dxkit` creates
 
 ```bash
-npx @vyuhlabs/dxkit@latest init --full
+npm init @vyuhlabs/dxkit
 ```
 
-`init --full` lands a coordinated set of pieces:
+This collapses install + scaffold into a single command: it installs
+`@vyuhlabs/dxkit` as a devDep and runs `vyuh-dxkit init --full --yes`.
+The full install lands a coordinated set of pieces:
 
 ```text
-.devcontainer/        Reproducible environment — pinned language
-                      toolchains, dxkit's scanner toolchain auto-
-                      installed, install scripts for AI agent CLIs
-                      (auth stays user-owned).
-.githooks/            pre-push guardrail hook (pre-commit opt-in
-                      via --with-precommit-hook).
+.devcontainer/        Reproducible environment — per-stack pinned
+                      toolchains (only the languages your project
+                      uses), dxkit's scanner toolchain auto-installed,
+                      install scripts for AI agent CLIs (auth stays
+                      user-owned).
+.githooks/            pre-push guardrail hook (pre-commit opt-in via
+                      --with-precommit-hook). Postinstall auto-
+                      activates `core.hooksPath` so teammates who
+                      clone + `npm install` get hooks wired too.
 .github/workflows/    PR-gate workflow + post-merge baseline-refresh
                       workflow (refresh runs only after the PR-gate
                       passes — see "Safety + trust" below).
-agent scaffolding     Entry-point doc, project skills, slash commands,
-                      per-language conventions, and specialized
-                      subagents for the currently supported agent
-                      (broader agent coverage in 2.6).
+AGENTS.md             Open-standard project context file read by
+                      Claude Code, Codex, Cursor, Aider, and any
+                      AGENTS.md-compliant agent.
+CLAUDE.md             Claude Code shim that points at AGENTS.md.
+.claude/skills/       Nine dxkit-* skills covering the full lifecycle:
+                      learn / init / config / hooks / reports /
+                      action / fix / update / onboard. Claude Code
+                      auto-discovers via skill frontmatter.
 .dxkit/               reports, baselines, and (optional) policy.
 .vyuh-dxkit.json      install manifest.
 ```
@@ -74,7 +83,6 @@ agent scaffolding     Entry-point doc, project skills, slash commands,
 After install:
 
 ```bash
-git config core.hooksPath .githooks   # activate the hooks
 vyuh-dxkit baseline create            # capture today's state
 git add .dxkit/baselines/main.json .githooks .github/workflows/dxkit-*.yml
 git commit -m "chore: enable dxkit guardrails"
@@ -108,9 +116,9 @@ rm .githooks/pre-commit              # disable just pre-commit (keep pre-push)
 ## 60-second demo
 
 ```text
-$ npx @vyuhlabs/dxkit@latest init --full
-✓ Created: 73 files
-✓ Git hooks: installed 2 file(s)
+$ npm init @vyuhlabs/dxkit
+✓ Created: 11 files (AGENTS.md, CLAUDE.md, .claude/skills/dxkit-*, ...)
+✓ Git hooks: installed 1 file(s)
 ✓ Devcontainer: installed 3 file(s)
 ✓ CI guardrails workflow: installed 1 file(s)
 ✓ CI baseline-refresh workflow: installed 1 file(s)
@@ -119,8 +127,8 @@ $ vyuh-dxkit baseline create
 ✓ Wrote .dxkit/baselines/main.json — 89 findings (32s)
 ```
 
-Your AI agent has access to dxkit's reports and the bundled
-subagents that init scaffolded. A typical request to the agent:
+Your AI agent has access to dxkit's reports and the nine lifecycle
+skills that init scaffolded. A typical request to the agent:
 
 ```text
 Read the latest dxkit health report. Pick one safe quality
@@ -166,27 +174,38 @@ Summary
 ## Quickstart
 
 ```bash
-# One-shot, no install
-npx @vyuhlabs/dxkit@latest init --full
+# Canonical first install — collapses install + scaffold into one step
+npm init @vyuhlabs/dxkit
 
-# Or install + use repeatedly
+# Or install dxkit globally + scaffold manually
 npm install -g @vyuhlabs/dxkit
 vyuh-dxkit init --full
 vyuh-dxkit baseline create
 vyuh-dxkit guardrail check --changed-only
+
+# Upgrade an existing install later
+vyuh-dxkit upgrade           # plan + execute combined
 ```
 
 À la carte if you only want specific pieces:
 
 ```bash
-vyuh-dxkit init --with-hooks              # just the pre-push hook (default for hooks)
+vyuh-dxkit init --with-dxkit-agents       # just the nine dxkit-* skills + AGENTS.md
+vyuh-dxkit init --with-hooks              # just the pre-push hook
 vyuh-dxkit init --with-precommit-hook     # add the pre-commit hook (opt-in; slow on large repos)
-vyuh-dxkit init --with-devcontainer       # just the devcontainer
+vyuh-dxkit init --with-devcontainer       # just the per-stack devcontainer
 vyuh-dxkit init --with-ci                 # just the PR-gate workflow
 vyuh-dxkit init --with-baseline-refresh   # just the auto-refresh
 vyuh-dxkit init --with-pr-review          # AI PR-review workflow (opt-in, needs API key)
 ```
 
+Post-install, two more CLIs polish the safety surface:
+
+```bash
+vyuh-dxkit setup-branch-protection   # mark dxkit-guardrails as required check on default branch
+vyuh-dxkit setup-prebuild            # configure Codespaces prebuild (cold-start ~7 min → ~30s)
+```
+
 ---
 
 ## Baseline mode: greenfield to 10-year-old codebases
@@ -420,8 +439,9 @@ dxkit is local-first.
 - [x] Git hooks (pre-push default; pre-commit opt-in)
 - [x] GitHub Actions PR-gate + gated baseline-refresh workflows
 - [x] Devcontainer with pinned toolchains
-- [ ] First-class scaffolding for every major coding agent —
-      per-agent skills + entry-point file conventions (2.6)
+- [x] Nine dxkit-\* skills + AGENTS.md (open-standard, read by every
+      AGENTS.md-compliant agent — Claude Code, Codex, Cursor, Aider)
+- [ ] First-class plugin packaging for the Claude Code marketplace + MCP server for cross-agent reach (2.6, decision-pending)
 - [ ] Scoped + incremental scanning — fast pre-commit on monorepos
       (2.6)
 - [ ] Symbol-level coverage gaps across all 8 packs (2.6)
@@ -466,7 +486,7 @@ MIT. See [LICENSE](LICENSE).
 ## Try it
 
 ```bash
-npx @vyuhlabs/dxkit@latest init --full
+npm init @vyuhlabs/dxkit
 ```
 
 If dxkit helps you ship AI-assisted changes more safely, star the

package/dist/analyzers/tools/graphify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphify.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,UAAU,cAAc;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAgLD;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAa5C;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAMxF;AA6ED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAiBzF;AAED;;;;GAIG;AAOH,eAAO,MAAM,gBAAgB,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,GAAG;IACpE,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAU9D,CAAC"}
+{"version":3,"file":"graphify.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,UAAU,cAAc;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAoLD;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAa5C;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAMxF;AA6ED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAiBzF;AAED;;;;GAIG;AAOH,eAAO,MAAM,gBAAgB,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,GAAG;IACpE,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAU9D,CAAC"}

package/dist/analyzers/tools/graphify.js

@@ -80,6 +80,15 @@ except ImportError:
     print(json.dumps({"error": "graphify not installed"}))
     sys.exit(0)
 
+# Redirect graphify's on-disk cache BEFORE any graphify function runs.
+# collect_files() eagerly resolves cache_dir() during enumeration, so
+# the patch has to land before the first graphify call — not after.
+# Pre-patch, a 'graphify-out/cache/' directory was created in the
+# customer's repo every time the analyzer touched a project.
+import graphify.cache as _gc
+_gc.cache_dir = lambda root=None: _cache_dir / "cache"
+(_cache_dir / "cache").mkdir(parents=True, exist_ok=True)
+
 target = Path(sys.argv[1])
 
 # Three-axis exclusion. EXCLUDE_DIRS is basename-only (any path
@@ -145,11 +154,6 @@ if not files:
     print(json.dumps({"error": "no files found"}))
     sys.exit(0)
 
-# Monkey-patch cache to use /tmp instead of target repo
-import graphify.cache as _gc
-_gc.cache_dir = lambda root=None: _cache_dir / "cache"
-(_cache_dir / "cache").mkdir(parents=True, exist_ok=True)
-
 # Suppress progress output by redirecting stdout during extraction
 import io
 _real_stdout = sys.stdout

package/dist/analyzers/tools/graphify.js.map

@@ -1 +1 @@
-{"version":3,"file":"graphify.js","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqPA,oDAMC;AAwFD,sDAiBC;AApWD;;;;;;;;;;;;;;;;GAgBG;AACH,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,qCAAuC;AACvC,mDAAsD;AACtD,6CAAsD;AACtD,mCAA4C;AAkB5C,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,IAAA,mCAAsB,EAAC,GAAG,CAAC,CAAC;IAC1E,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BQ,OAAO;kBACN,SAAS;uBACJ,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0InC,CAAC;AACF,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmC,CAAC;AAExE;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAClD,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAW;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAExE,oEAAoE;IACpE,gEAAgE;IAChE,mEAAmE;IACnE,iCAAiC;IACjC,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,2DAA2D;IAC3D,2DAA2D;IAC3D,+DAA+D;IAC/D,6DAA6D;IAC7D,2DAA2D;IAC3D,2DAA2D;IAC3D,8DAA8D;IAC9D,+CAA+C;IAC/C,EAAE;IACF,gEAAgE;IAChE,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAW,EAAC,SAAS,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QAC9D,GAAG,EAAE,SAAS;QACd,SAAS,EAAE,MAAM,EAAE,6EAA6E;KACjG,CAAC,CAAC;IACH,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,gEAAgE;aACzE,CAAC;QACJ,CAAC;QACD,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,iDAAiD;QACjD,MAAM,eAAe,GAAG,aAAa;aAClC,KAAK,CAAC,IAAI,CAAC;aACX,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACjC,EAAE,IAAI,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,eAAe;YAC5B,CAAC,CAAC,WAAW,eAAe,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE;YACrG,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAC3C,CAAC,CAAC,yBAAyB,OAAO,CAAC,IAAI,2DAA2D;gBAClG,CAAC,CAAC,oCAAoC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAED,mFAAmF;IACnF,MAAM,QAAQ,GAAG,MAAM;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAChC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExE,IAAI,IAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAEnE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,IAAoB,EAAE,GAAW;IACrE,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC7C,CAAC,CAAC,IAAA,yBAAiB,EAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,CAAC;YACnD,CAAC,CAAC,EAAE;QACN,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,uEAAuE;AACvE,uEAAuE;AACvE,+DAA+D;AAC/D,gEAAgE;AAChE,oEAAoE;AACpE,qEAAqE;AACxD,QAAA,gBAAgB,GAEzB;IACF,MAAM,EAAE,UAAU;IAClB,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,GAAG;QACrB,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF,sFAAsF;AACtF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"graphify.js","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyPA,oDAMC;AAwFD,sDAiBC;AAxWD;;;;;;;;;;;;;;;;GAgBG;AACH,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,qCAAuC;AACvC,mDAAsD;AACtD,6CAAsD;AACtD,mCAA4C;AAkB5C,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,IAAA,mCAAsB,EAAC,GAAG,CAAC,CAAC;IAC1E,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqCQ,OAAO;kBACN,SAAS;uBACJ,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqInC,CAAC;AACF,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmC,CAAC;AAExE;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAClD,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAW;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAExE,oEAAoE;IACpE,gEAAgE;IAChE,mEAAmE;IACnE,iCAAiC;IACjC,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,2DAA2D;IAC3D,2DAA2D;IAC3D,+DAA+D;IAC/D,6DAA6D;IAC7D,2DAA2D;IAC3D,2DAA2D;IAC3D,8DAA8D;IAC9D,+CAA+C;IAC/C,EAAE;IACF,gEAAgE;IAChE,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAW,EAAC,SAAS,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QAC9D,GAAG,EAAE,SAAS;QACd,SAAS,EAAE,MAAM,EAAE,6EAA6E;KACjG,CAAC,CAAC;IACH,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,gEAAgE;aACzE,CAAC;QACJ,CAAC;QACD,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,iDAAiD;QACjD,MAAM,eAAe,GAAG,aAAa;aAClC,KAAK,CAAC,IAAI,CAAC;aACX,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACjC,EAAE,IAAI,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,eAAe;YAC5B,CAAC,CAAC,WAAW,eAAe,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE;YACrG,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAC3C,CAAC,CAAC,yBAAyB,OAAO,CAAC,IAAI,2DAA2D;gBAClG,CAAC,CAAC,oCAAoC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAED,mFAAmF;IACnF,MAAM,QAAQ,GAAG,MAAM;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAChC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExE,IAAI,IAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAEnE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,IAAoB,EAAE,GAAW;IACrE,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC7C,CAAC,CAAC,IAAA,yBAAiB,EAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,CAAC;YACnD,CAAC,CAAC,EAAE;QACN,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,uEAAuE;AACvE,uEAAuE;AACvE,+DAA+D;AAC/D,gEAAgE;AAChE,oEAAoE;AACpE,qEAAqE;AACxD,QAAA,gBAAgB,GAEzB;IACF,MAAM,EAAE,UAAU;IAClB,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,GAAG;QACrB,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF,sFAAsF;AACtF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC"}

package/dist/analyzers/tools/tool-registry.d.ts

@@ -41,14 +41,32 @@ export interface ToolDefinition extends ToolRequirement {
     };
     /** Command that prints version info (used to verify tool works). */
     versionCheck?: string;
+    /**
+     * Optional applicability gate. Returns a short human-readable reason
+     * string when the tool is NOT applicable to the project at `cwd`
+     * (e.g. `@vitest/coverage-v8` on a mocha-based repo). Returns null
+     * when the tool IS applicable — detection then proceeds normally.
+     *
+     * The gate runs BEFORE binary/probe lookup so non-applicable tools
+     * never get reported as "missing." The CLI surfaces them as "n/a"
+     * with the reason string and excludes them from missing-count math
+     * so customers don't chase a non-fixable warning.
+     */
+    applicabilityGuard?: (cwd: string) => string | null;
 }
 export interface ToolStatus {
     name: string;
     available: boolean;
     path: string | null;
     version: string | null;
-    source: 'path' | 'brew' | 'npm-g' | 'pipx' | 'cargo' | 'go' | 'probe' | 'missing';
+    source: 'path' | 'brew' | 'npm-g' | 'pipx' | 'cargo' | 'go' | 'probe' | 'missing' | 'n/a';
     requirement: ToolDefinition;
+    /**
+     * Populated when `source === 'n/a'`. Carries the reason from the
+     * applicabilityGuard so renderers can show e.g. "no vitest in this
+     * repo" alongside the n/a status.
+     */
+    notApplicableReason?: string;
 }
 /**
  * Find a tool across multiple installation methods.

package/dist/analyzers/tools/tool-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/tool-registry.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,QAA2D,CAAC;AA2BnF,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,eAAe,EAAE;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAClF,WAAW,EAAE,cAAc,CAAC;CAC7B;AA2KD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CAqGtE;AAkBD,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAO7D;AAMD,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAgepD,CAAC;AAMF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,eAAe,EAAE,CA8B3F;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAgB/F"}
+{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/tool-registry.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,QAA2D,CAAC;AA2BnF,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,eAAe,EAAE;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1F,WAAW,EAAE,cAAc,CAAC;IAC5B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2KD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CAuHtE;AAkBD,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAO7D;AAMD,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CA2fpD,CAAC;AAMF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,eAAe,EAAE,CA8B3F;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAgB/F"}

package/dist/analyzers/tools/tool-registry.js

@@ -267,6 +267,23 @@ function findGraphifyPython(cwd) {
  * Returns the first matching absolute path, or null.
  */
 function findTool(def, cwd) {
+    // Applicability gate runs first. Non-applicable tools (e.g.
+    // vitest-coverage on a mocha repo) get an explicit "n/a" status so
+    // they never inflate the missing-count.
+    if (def.applicabilityGuard) {
+        const reason = def.applicabilityGuard(cwd || process.cwd());
+        if (reason) {
+            return {
+                name: def.name,
+                available: false,
+                path: null,
+                version: null,
+                source: 'n/a',
+                requirement: def,
+                notApplicableReason: reason,
+            };
+        }
+    }
     // Special case: graphify is a Python module, not a binary
     if (def.name === 'graphify') {
         const pyPath = findGraphifyPython(cwd || process.cwd());
@@ -511,21 +528,38 @@ exports.TOOL_DEFS = {
     'osv-scanner': {
         name: 'osv-scanner',
         description: 'OSV.dev dependency scanner + fix planner — populates structured upgradePlan on dep-vuln findings (Tier-2, Node/npm pack)',
-        install: 'go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest',
+        install: 'brew install osv-scanner',
         check: 'osv-scanner --version',
         for: 'node',
         layer: 'language',
         binaries: ['osv-scanner'],
-        // Go installs to $GOBIN (→ $GOPATH/bin by default, or ~/go/bin) which
-        // is typically in $PATH on dev machines. Probe the canonical default
-        // explicitly so detection works on machines that only have `go` in
-        // PATH but not `go/bin`.
+        // ~/go/bin retained for backward-compat: machines that already
+        // installed osv-scanner via `go install` before this change get
+        // picked up without re-installing. ~/.local/bin (where the new
+        // install lands) is already in getSystemPaths(), so no explicit
+        // probe needed there.
         probePaths: [path.join(os.homedir(), 'go', 'bin')],
         versionCheck: 'osv-scanner --version 2>/dev/null',
+        // Install via GitHub releases binary (mirrors the gitleaks pattern):
+        // the prior `go install` path silently failed on every customer
+        // container without a Go toolchain (the majority of stacks — Node,
+        // Python, Ruby, .NET, JVM, etc.), leaving dep-vuln reports without
+        // osv-scanner's structured upgradePlan enrichment. GitHub release
+        // binaries are statically linked + need only curl + chmod.
+        //
+        // Version pinned here, NOT in the URL on the macOS line — Homebrew
+        // tracks its own version; we only need our own pin for the curl
+        // fallback. Bumping requires editing this line, copy-package, and
+        // dist/ rebuild.
         installCommands: {
-            macos: 'brew install osv-scanner || go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest',
-            linux: 'go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest',
-            windows: 'go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest',
+            macos: 'brew install osv-scanner || ' +
+                '(mkdir -p ~/.local/bin && ' +
+                'curl -sSfL https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_darwin_amd64 -o ~/.local/bin/osv-scanner && ' +
+                'chmod +x ~/.local/bin/osv-scanner)',
+            linux: 'mkdir -p ~/.local/bin && ' +
+                'curl -sSfL https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 -o ~/.local/bin/osv-scanner && ' +
+                'chmod +x ~/.local/bin/osv-scanner',
+            windows: 'scoop install osv-scanner',
         },
     },
     'license-checker-rseidelsohn': {
@@ -775,6 +809,14 @@ exports.TOOL_DEFS = {
         installScope: 'project-local',
         binaries: [],
         nodePackage: '@vitest/coverage-v8',
+        // Non-applicable on mocha/jest/ava-only repos: the V8 coverage
+        // provider is a peer of vitest itself, so installing it without
+        // vitest just adds dead weight and makes `tools list` report a
+        // misleading "missing" entry. Guard against that by checking for
+        // vitest in the consumer's tree first.
+        applicabilityGuard: (cwd) => fs.existsSync(path.join(cwd, 'node_modules', 'vitest', 'package.json'))
+            ? null
+            : 'no vitest in this repo',
         // Version auto-detect via `require('vitest/package.json')` assumed
         // vitest was present in the target repo. Repos using mocha/jest/ava
         // hit a MODULE_NOT_FOUND crash (pre-2.3.1 failure mode). Gate with