@vyuhlabs/dxkit 2.9.2 → 2.9.4

package/dist/attribution/attribute.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseBlamePorcelain = parseBlamePorcelain;
+exports.buildAttributionMap = buildAttributionMap;
+exports.formatAttributionCell = formatAttributionCell;
+exports.attributionProvenanceLine = attributionProvenanceLine;
+/**
+ * Finding attribution — "who to ask" about a finding, grounded in the
+ * active-owner model. The OPT-IN historical counterpart to net-new
+ * attribution (a net-new finding's introducer is the PR's own commits;
+ * that needs no blame). This module answers it for pre-existing findings
+ * via `git blame`, then routes through who is still active.
+ *
+ * Honesty: `git blame` reports who LAST TOUCHED a line, not necessarily who
+ * introduced the finding — a formatter run or a move reassigns it. The
+ * provenance line states this; the routing softens it by pointing at the
+ * current owner when the blamed author has left.
+ *
+ * Privacy: emails are the internal join key only. Rendered output is the
+ * display name + GitHub @handle, never a raw email (same posture as the
+ * ownership model).
+ *
+ * Shape mirrors `explore/finding-context.ts` so threading `--attribute`
+ * through the detailed reports is identical to `--graph-context`.
+ */
+const child_process_1 = require("child_process");
+const ownership_1 = require("../analyzers/developer/ownership");
+const gather_1 = require("../analyzers/developer/gather");
+const finding_context_1 = require("../explore/finding-context");
+/** Parse `git blame --porcelain -L n,n` output for the author + commit of a
+ *  single line. Pure — exported for tests. Returns `null` when the porcelain
+ *  has no author (empty / error). */
+function parseBlamePorcelain(out) {
+    const lines = out.split('\n');
+    const commit = lines[0]?.split(' ')[0];
+    let author = '';
+    let email = '';
+    for (const l of lines) {
+        if (l.startsWith('author '))
+            author = l.slice('author '.length).trim();
+        else if (l.startsWith('author-mail '))
+            email = l.slice('author-mail '.length).trim().replace(/^<|>$/g, '');
+    }
+    if (!commit || !author)
+        return null;
+    return { author, email, commit: commit.slice(0, 8) };
+}
+function blameLine(cwd, file, line) {
+    try {
+        const out = (0, child_process_1.execSync)(`git blame --porcelain -L ${line},${line} -- '${file.replace(/'/g, "'\\''")}'`, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        return parseBlamePorcelain(out);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build per-finding attribution for a list of locations. Fail-open: returns
+ * `undefined` when git produces nothing usable. Only locations with a `line`
+ * are blamed (a file-level finding has no single line to attribute).
+ */
+function buildAttributionMap(cwd, locations, opts = {}) {
+    const max = opts.maxFindings ?? 200;
+    const now = opts.now ?? new Date();
+    const activeEmails = (0, ownership_1.gatherActiveEmails)(cwd, opts.activeSince ?? '6 months ago');
+    const attributions = {};
+    const currentOwnerCache = new Map();
+    let blamed = 0;
+    for (const loc of locations) {
+        if (blamed >= max)
+            break;
+        const key = (0, finding_context_1.locationKey)(loc.file, loc.line);
+        if (key in attributions)
+            continue;
+        // File-level finding (no line, e.g. a test gap): attribute to the
+        // file's current active owner — "who should test/own this," not who
+        // wrote a specific line.
+        if (typeof loc.line !== 'number') {
+            if (!currentOwnerCache.has(loc.file)) {
+                currentOwnerCache.set(loc.file, topActiveOwner(cwd, loc.file, now));
+            }
+            const owner = currentOwnerCache.get(loc.file);
+            if (owner) {
+                attributions[key] = {
+                    author: owner.name,
+                    ...(owner.handle ? { handle: owner.handle } : {}),
+                    active: true,
+                    fileLevel: true,
+                };
+            }
+            continue;
+        }
+        const bl = blameLine(cwd, loc.file, loc.line);
+        blamed++;
+        if (!bl)
+            continue;
+        const active = activeEmails.has((0, gather_1.normalizeEmail)(bl.email));
+        const handle = (0, ownership_1.handleFromEmail)(bl.email);
+        let currentOwner;
+        if (!active) {
+            if (!currentOwnerCache.has(loc.file)) {
+                currentOwnerCache.set(loc.file, topActiveOwner(cwd, loc.file, now));
+            }
+            currentOwner = currentOwnerCache.get(loc.file);
+        }
+        attributions[key] = {
+            author: bl.author,
+            ...(handle ? { handle } : {}),
+            commit: bl.commit,
+            active,
+            ...(currentOwner ? { currentOwner } : {}),
+        };
+    }
+    if (Object.keys(attributions).length === 0)
+        return undefined;
+    return { attributions };
+}
+function topActiveOwner(cwd, file, now) {
+    const owners = (0, ownership_1.ownersFor)(cwd, [file], { now });
+    const top = owners.ranked.find((o) => o.active);
+    if (!top)
+        return undefined;
+    return { name: top.name, ...(top.githubHandle ? { handle: top.githubHandle } : {}) };
+}
+/** Compact cell rendering — name/@handle, never email. `—` when unresolved. */
+function formatAttributionCell(attr) {
+    if (!attr)
+        return '—';
+    const who = attr.handle ? `@${attr.handle}` : attr.author;
+    if (attr.fileLevel)
+        return `${who} (owner)`;
+    if (attr.active)
+        return `${who} (active)`;
+    if (attr.currentOwner) {
+        const owner = attr.currentOwner.handle
+            ? `@${attr.currentOwner.handle}`
+            : attr.currentOwner.name;
+        return `${who} (inactive) → ask ${owner}`;
+    }
+    return `${who} (inactive)`;
+}
+/** Provenance + honesty line printed above an attributed section. */
+function attributionProvenanceLine() {
+    return (`_"Who to ask" is the author who LAST TOUCHED the line (\`git blame\`), not ` +
+        `necessarily who introduced the finding — a formatter run or a move can reassign ` +
+        `it. An inactive author is routed to the file's current active owner. Names + ` +
+        `GitHub @handles only; never emails._`);
+}
+//# sourceMappingURL=attribute.js.map

package/dist/attribution/attribute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribute.js","sourceRoot":"","sources":["../../src/attribution/attribute.ts"],"names":[],"mappings":";;AAuEA,kDAYC;AAmBD,kDA8DC;AAcD,sDAYC;AAGD,8DAOC;AAxMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,iDAAyC;AACzC,gEAK0C;AAC1C,0DAA+D;AAC/D,gEAAyD;AAyCzD;;qCAEqC;AACrC,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;aAClE,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;YACnC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,wBAAQ,EAClB,4BAA4B,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAC9E,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC/D,CAAC;QACF,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,GAAW,EACX,SAAyD,EACzD,OAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,YAAY,GAAG,IAAA,8BAAkB,EAAC,GAAG,EAAE,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAuC,EAAE,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyD,CAAC;IAC3F,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,MAAM,IAAI,GAAG;YAAE,MAAM;QACzB,MAAM,GAAG,GAAG,IAAA,6BAAW,EAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,GAAG,IAAI,YAAY;YAAE,SAAS;QAElC,kEAAkE;QAClE,oEAAoE;QACpE,yBAAyB;QACzB,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,GAAG,CAAC,GAAG;oBAClB,MAAM,EAAE,KAAK,CAAC,IAAI;oBAClB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,EAAE,CAAC;QACT,IAAI,CAAC,EAAE;YAAE,SAAS;QAElB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAA,uBAAc,EAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,YAA2D,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAED,YAAY,CAAC,GAAG,CAAC,GAAG;YAClB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,MAAM;YACN,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CACrB,GAAW,EACX,IAAY,EACZ,GAAS;IAET,MAAM,MAAM,GAAG,IAAA,qBAAS,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,+EAA+E;AAC/E,SAAgB,qBAAqB,CAAC,IAAoC;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1D,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,GAAG,GAAG,UAAU,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,GAAG,WAAW,CAAC;IAC1C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM;YACpC,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAC3B,OAAO,GAAG,GAAG,qBAAqB,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,GAAG,aAAa,CAAC;AAC7B,CAAC;AAED,qEAAqE;AACrE,SAAgB,yBAAyB;IACvC,OAAO,CACL,6EAA6E;QAC7E,kFAAkF;QAClF,+EAA+E;QAC/E,sCAAsC,CACvC,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA6PA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqwDvD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAwRA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAizDvD"}

package/dist/cli.js

@@ -82,6 +82,19 @@ async function buildGraphContextIfRequested(enabled, cwd, locations) {
     logger.dim(`--graph-context: attached to ${enriched}/${locations.length} finding location(s).`);
     return gc;
 }
+async function buildAttributionIfRequested(enabled, cwd, locations) {
+    if (!enabled)
+        return undefined;
+    const { buildAttributionMap } = await Promise.resolve().then(() => __importStar(require('./attribution/attribute')));
+    const attr = buildAttributionMap(cwd, locations);
+    if (!attr) {
+        logger.dim('--attribute: no attributable locations (git blame produced nothing) — skipped.');
+        return undefined;
+    }
+    const n = Object.keys(attr.attributions).length;
+    logger.dim(`--attribute: "who to ask" attached to ${n}/${locations.length} finding location(s).`);
+    return attr;
+}
 /**
  * Apply `--fail-on-score` to a higher-is-better score. Exits with
  * code 1 + a logged reason when the gate fires. Skips when the user
@@ -143,6 +156,11 @@ function printUsage() {
                                  (hot-files / entry-points / file / feature / communities / api-surface / context)
     vyuh-dxkit context <query>   Slim structural slice for a query — token-efficient
                                  codebase context for LLMs (--budget / --depth / --substring / --json)
+    vyuh-dxkit reviewers [--base <ref>|--staged] [--limit N] [--json]
+                                 Suggest reviewers for the change — active-owner model
+                                 (recency-weighted git history, bots + departed devs
+                                 filtered, excludes the author) blended with CODEOWNERS,
+                                 with a bus-factor signal. Names + @handles, never emails.
     vyuh-dxkit to-xlsx <json>    Convert a dxkit JSON report to 15-col XLSX
     vyuh-dxkit tools [path]      Show required analysis tools status
     vyuh-dxkit tools install     Interactively install missing tools
@@ -235,6 +253,11 @@ function printUsage() {
     --graph-context   Vulnerabilities/test-gaps/quality: attach per-finding graph context
                       (module + blast radius) to the detailed report. Needs a graph.json
                       (run health first); fail-open — skipped silently if absent.
+    --attribute       Vulnerabilities/test-gaps/quality: attach a "who to ask" column to
+                      the detailed report (git blame → active-owner model; inactive authors
+                      routed to the current owner). Names + @handles, never emails. Opt-in;
+                      fail-open. Historical only — net-new findings are introduced by your
+                      own change.
     --xlsx            Licenses/bom: also write 15-col BOM XLSX
     --since           Dev-report: start date (YYYY-MM-DD)
     --filter          Bom: 'all' (default) or 'top-level' (keeps only root manifest deps;
@@ -334,11 +357,16 @@ async function run(argv) {
             limit: { type: 'string' },
             refresh: { type: 'boolean', default: false },
             substring: { type: 'boolean', default: false },
+            // reviewers flags
+            staged: { type: 'boolean', default: false },
+            base: { type: 'string' },
             // context flags
             budget: { type: 'string' },
             depth: { type: 'string' },
             // graph-context enrichment for detailed reports (vuln/test-gaps/quality)
             'graph-context': { type: 'boolean', default: false },
+            // attribution enrichment for detailed reports — "who to ask" (opt-in)
+            attribute: { type: 'boolean', default: false },
             // ingest flags (external SAST engines → .dxkit/external snapshots)
             sarif: { type: 'string' },
             'from-snyk': { type: 'boolean', default: false },
@@ -784,8 +812,10 @@ async function run(argv) {
                 logger.success(`Report saved to ${path.relative(targetPath, reportPath)}`);
                 // D032 (2.4.7): detailed JSON + MD always written so dashboard finds fresh inputs.
                 const { buildSecurityDetailed, formatSecurityDetailedMarkdown } = await Promise.resolve().then(() => __importStar(require('./analyzers/security/detailed')));
-                const graphContext = await buildGraphContextIfRequested(!!values['graph-context'], targetPath, report.findings.map((f) => ({ file: f.file, line: f.line })));
-                const securityDetailed = buildSecurityDetailed(report, graphContext);
+                const securityLocations = report.findings.map((f) => ({ file: f.file, line: f.line }));
+                const graphContext = await buildGraphContextIfRequested(!!values['graph-context'], targetPath, securityLocations);
+                const securityAttribution = await buildAttributionIfRequested(!!values.attribute, targetPath, securityLocations);
+                const securityDetailed = buildSecurityDetailed(report, graphContext, securityAttribution);
                 const securityDetailedJsonPath = path.join(reportDir, `vulnerability-scan-${date}-detailed.json`);
                 const securityDetailedMdPath = path.join(reportDir, `vulnerability-scan-${date}-detailed.md`);
                 fs.writeFileSync(securityDetailedJsonPath, JSON.stringify((0, report_schema_1.stampSchema)(securityDetailed, 'vulnerabilities-detailed'), null, 2));
@@ -863,7 +893,8 @@ async function run(argv) {
                 // D032 (2.4.7): detailed JSON + MD always written so dashboard finds fresh inputs.
                 const { buildTestGapsDetailed, formatTestGapsDetailedMarkdown } = await Promise.resolve().then(() => __importStar(require('./analyzers/tests/detailed')));
                 const testGapsGraphContext = await buildGraphContextIfRequested(!!values['graph-context'], targetPath, report.gaps.map((g) => ({ file: g.path })));
-                const testGapsDetailed = buildTestGapsDetailed(report, testGapsGraphContext);
+                const testGapsAttribution = await buildAttributionIfRequested(!!values.attribute, targetPath, report.gaps.map((g) => ({ file: g.path })));
+                const testGapsDetailed = buildTestGapsDetailed(report, testGapsGraphContext, testGapsAttribution);
                 const testGapsDetailedJsonPath = path.join(reportDir, `test-gaps-${date}-detailed.json`);
                 const testGapsDetailedMdPath = path.join(reportDir, `test-gaps-${date}-detailed.md`);
                 fs.writeFileSync(testGapsDetailedJsonPath, JSON.stringify((0, report_schema_1.stampSchema)(testGapsDetailed, 'test-gaps-detailed'), null, 2));
@@ -940,8 +971,13 @@ async function run(argv) {
                 logger.success(`Report saved to ${path.relative(targetPath, reportPath)}`);
                 // D032 (2.4.7): detailed JSON + MD always written so dashboard finds fresh inputs.
                 const { buildQualityDetailed, formatQualityDetailedMarkdown } = await Promise.resolve().then(() => __importStar(require('./analyzers/quality/detailed')));
-                const qualityGraphContext = await buildGraphContextIfRequested(!!values['graph-context'], targetPath, [...(report.metrics.topConsoleFiles ?? []), ...(report.metrics.topTodoFiles ?? [])].map((f) => ({ file: f.file })));
-                const qualityDetailed = buildQualityDetailed(report, qualityGraphContext);
+                const qualityLocations = [
+                    ...(report.metrics.topConsoleFiles ?? []),
+                    ...(report.metrics.topTodoFiles ?? []),
+                ].map((f) => ({ file: f.file }));
+                const qualityGraphContext = await buildGraphContextIfRequested(!!values['graph-context'], targetPath, qualityLocations);
+                const qualityAttribution = await buildAttributionIfRequested(!!values.attribute, targetPath, qualityLocations);
+                const qualityDetailed = buildQualityDetailed(report, qualityGraphContext, qualityAttribution);
                 const qualityDetailedJsonPath = path.join(reportDir, `quality-review-${date}-detailed.json`);
                 const qualityDetailedMdPath = path.join(reportDir, `quality-review-${date}-detailed.md`);
                 fs.writeFileSync(qualityDetailedJsonPath, JSON.stringify(qualityDetailed, null, 2));
@@ -1729,6 +1765,18 @@ async function run(argv) {
             });
             break;
         }
+        case 'reviewers': {
+            const { runReviewers } = await Promise.resolve().then(() => __importStar(require('./reviewers-cli')));
+            const limitRaw = values.limit;
+            const limit = limitRaw ? parseInt(limitRaw, 10) : undefined;
+            runReviewers(cwd, {
+                base: values.base,
+                staged: !!values.staged,
+                json: !!values.json,
+                ...(Number.isFinite(limit) ? { limit } : {}),
+            });
+            break;
+        }
         case 'explore': {
             const { runExplore } = await Promise.resolve().then(() => __importStar(require('./explore-cli')));
             // positionals[0] is 'explore'; positionals[1..] are the