@vyuhlabs/dxkit 2.9.3 → 2.10.0

package/CHANGELOG.md

@@ -7,6 +7,176 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.10.0] - 2026-06-13
+
+### Honest scoring under changing scanners, passive graph delivery, tool-robustness
+
+Closes a set of brownfield-install and guardrail-matcher defects (the original
+2.9.5 hardening), a class of scoring-honesty bugs (a Security score that could get
+worse on an unchanged commit, with nothing explaining why), a defensive
+tool-version-pin sweep, and the agentic-delivery redesign that finally routes the
+code graph to the agent in a real fix workflow.
+
+#### Scoring honesty
+
+A Security score could drop on an **unchanged commit** — e.g. after an upgrade
+enabled more scanners, or because a repo's own reviewed-and-accepted findings kept
+holding it at a cap. The measurement was getting more honest, but the output
+didn't explain it, and a properly-triaged repo couldn't recover its score. These
+close that gap.
+
+- **Symmetric unavailable-scanner caps.** A missing dependency-audit
+  already capped the Security score at the uncertainty tier, but missing
+  secret/code-pattern scanners silently scored as "0 findings" — so enabling
+  those scanners later read as a phantom regression. The secret and code-pattern
+  axes now get the same uncertainty cap when their scan didn't run, surfaced in
+  `metrics.toolsUnavailable` and the standalone vuln-scan report.
+- **The score respects the allowlist.** Findings reviewed-and-accepted as
+  `false-positive` / `test-fixture` are now lifted from the Security penalties and
+  caps (not just the guardrail), so a triaged repo scores honestly instead of
+  staying capped on noise it has already accepted. `accepted-risk` / `deferred` /
+  `mitigated-externally` still count — accepting a real risk can't earn an A. The
+  vulnerability report and dashboard also annotate allowlisted findings and render
+  `Subtotal N (M allowlisted)` so the raw counts are explained, not alarming.
+- **Scanner-coverage drift is disclosed.** When the active scanner set grew
+  since the last run, the vuln-scan report leads with a note: findings the new
+  scanners surface are newly **visible**, not newly **introduced**. This is the
+  root-cause explanation for a score that moved on unchanged code.
+- **Secret severity is never lowered by file path.** A hardcoded credential keeps
+  its natural severity whether it sits in production code or a test — the generic
+  matcher can't tell a throwaway fixture from a real secret leaked into a test, so
+  lowering severity by path would silently hide genuine leaks. Test-file noise is
+  managed by the allowlist score-lift above (review fixtures once with
+  `--category test-fixture`), not by hiding. The vulnerability report now flags how
+  many secret findings sit in test files and points fixtures at the allowlist; the
+  `dxkit-action` and `dxkit-allowlist` skills gain an explicit triage step
+  (confirm fixture vs. real, allowlist fakes, rotate reals) so an agent handles
+  this judgment per finding rather than blanket-ignoring the test directory.
+- **Systematic test-file detection.** Tests organized under Jest's `__tests__/`
+  directory — or named with the widespread `.unit.` / `.e2e.` / `.cy.` suffixes —
+  were classified as source, corrupting the test ratio, coverage, and test-gap
+  analysis. The cross-ecosystem test directories (`__tests__/`, `test/`, `tests/`,
+  `spec/`, `e2e/`) are now recognized in any language; the TS pack gains the
+  co-located suffix conventions.
+- **Dependency-audit cleanup on Windows (EPERM).** The osv-scanner-fix temp-dir
+  cleanup now retries with backoff and never throws out of its `finally`, so a
+  Windows handle race (npm-install grandchildren / antivirus) can no longer
+  discard the already-parsed fix plans — which had let dependency vulnerabilities
+  go silently unreported.
+
+#### Passive graph delivery (agentic value)
+
+- **Context-hook fires on the tools agents actually use.** Pre-2.10 the graph
+  context-hook fired only on the native `Grep`/`Glob` tools and only when the
+  search pattern substring-matched a symbol name — so in a real fix workflow
+  (agents search via `Bash grep` for a symptom, and read files directly) it
+  almost never engaged. It now fires on **Read/Edit** (keyed on the file touched
+  → that file's structural summary: symbols, callers, callees, module group),
+  **Bash** (parses grep/rg commands; a named source file delivers its summary,
+  else a symbol match on the pattern), and the original **Grep/Glob** path.
+  Per-session, per-file dedup keeps it cheap; the FAIL-OPEN + ADDITIVE contract is
+  preserved (any problem is a silent no-op). **Existing repos must re-run
+  `vyuh-dxkit init`** (or update `.claude/settings.json`) to pick up the broadened
+  `Read|Edit|Bash|Grep|Glob` matcher.
+
+#### Snyk sync
+
+- **`.dxkit-ignore` → `.snyk` exclude sync.** `allowlist export --snyk` now also
+  emits the paths dxkit's analyzers skip (`.dxkit-ignore`) into the `.snyk`
+  `exclude.global` block, so Snyk and dxkit agree on what's out of scope —
+  mirroring the existing allowlist → `.snyk` ignore sync. An export carrying only
+  exclusions still writes.
+
+#### Tool-robustness + matcher rename fixes
+
+Hardening pass closing a set of brownfield-install and guardrail-matcher
+defects surfaced while benchmarking on Python 3.14 and large real-world repos.
+
+#### Fixed
+
+- **graphify on Python 3.14.** Python 3.14 made `forkserver` the default
+  multiprocessing start method on Linux. graphify parallelises extraction with a
+  `ProcessPoolExecutor`, and under spawn/forkserver each worker re-imports the
+  generated script — re-running top-level extraction and crashing the run (no
+  `.dxkit/reports/graph.json` written; every graph-dependent feature silently
+  degraded). The generated script now wraps its execution body in
+  `if __name__ == '__main__'` — graphify's own documented requirement for
+  parallel extraction — so it is correct on every platform and start method
+  (Linux fork/forkserver, macOS/Windows spawn) while keeping multi-core
+  extraction. The previous forced `set_start_method('fork')` workaround is
+  removed.
+- **graphify cache redirect.** The on-disk cache is now redirected via
+  graphify's public `extract(cache_root=...)` parameter instead of
+  monkeypatching the internal `graphify.cache.cache_dir`, whose signature
+  changed in graphifyy 0.8 (`cache_dir(root)` → `cache_dir(root, kind)`) and
+  crashed the run. This also stops graphify's `atexit` stat-index flush from
+  writing a stray `graphify-out/` into the scanned repo. The temp cache lives
+  under the caller-owned script dir and is reclaimed after the process (and its
+  atexit handlers) exit. `graphifyy` is pinned to `0.8.36`.
+- **jscpd version pin.** jscpd is pinned to `4.2.5`. jscpd 5.x is a Rust
+  rewrite that dropped the `--gitignore` flag (dxkit passed it → exit 2) and
+  changed the report JSON schema dxkit parses.
+- **Guardrail matcher — whole-file rename relocation.** Renaming a source
+  file no longer reports its whole-file findings (test-gap, coverage-gap,
+  test-file-degradation, god-file, stale-file, large-file) as removed + added,
+  which falsely blocked the guardrail on a pure rename. The git-aware matcher
+  now relocates these line-less, file-anchored findings through git's rename
+  detection, keyed on `(renamed-path, kind)` so two different whole-file kinds
+  on the same renamed file never cross-pair.
+
+#### Tool-version pins
+
+- **Defensive pin sweep.** Nine more dxkit-owned, deterministic-output scanners
+  are pinned to their current releases (semgrep `1.165.0`, ruff `0.15.17`,
+  pip-audit `2.10.1`, pip-licenses `5.5.5`, coverage `7.14.1`,
+  license-checker-rseidelsohn `5.0.1`, golangci-lint `v1.64.8` — the v1 line,
+  since v2 is a breaking rewrite on a separate module path — govulncheck `v1.3.0`,
+  go-licenses `v1.6.0`), so a future breaking major can't silently change parsed
+  output or exit codes the way jscpd 5.x and graphifyy 0.8 did. Five tools stay
+  unpinned by design and are now documented as such: `eslint` + `vitest-coverage`
+  (project-local — the consumer owns the version), `snyk` (a SaaS client that
+  self-manages backend compatibility), `codeql` (a GitHub-managed bundle paired
+  with query packs), and `cloc` (non-semver npm tag, lowest-risk schema). Proper
+  schema-adaptive multi-version handling is planned for a later release.
+
+#### Internal
+
+- The version-pin guard test partitions every registry tool into pinned /
+  unpinned-by-design / package-manager-tracked, so a tool can't be added or
+  un-pinned without a deliberate decision.
+
+## [2.9.4] - 2026-06-09
+
+### Connecting findings + PRs to the people who know the code
+
+Two features on a shared **active-owner model** — recency-weighted git history
+scoped to who is still active, with bots and departed contributors filtered, the
+change author excluded, and a bus-factor signal. Output renders names + GitHub
+@handles, never raw emails (the @handle is both privacy-safe and the actionable
+identifier — it's @-mentionable and feeds `gh --reviewer`).
+
+- **`vyuh-dxkit reviewers`** suggests reviewers for a change (`--base <ref>` /
+  `--staged`). It ranks the active owners of the touched files — recency-weighted,
+  bot-free, departed-dev-aware, author-excluded — blended with `CODEOWNERS`, and
+  warns on a bus factor of 1. The differentiation over a platform's naive
+  last-touch suggestion is the activity grounding + active-only scoping. The
+  `dxkit-pr` skill consumes it for a "Suggested reviewers" block and
+  `gh pr create --reviewer`.
+- **`--attribute` "who to ask"** on the detailed vulnerability / test-gaps /
+  quality reports. For a pre-existing finding it adds a "Who to ask" column:
+  line-level findings are `git blame`d and routed through the owner model (an
+  inactive author is forwarded to the file's current owner); file-level findings
+  (test gaps) attribute to the file's current owner. Opt-in and historical only —
+  a net-new finding the guardrail just blocked was introduced by your own change,
+  so its owner is the PR author. The column is honest that blame is last-touch,
+  not necessarily who introduced the finding.
+
+### Privacy
+
+Author emails are used only as the internal identity key for clustering; they
+are never rendered in any report or PR output. Everything user-facing is a
+display name or a GitHub @handle.
+
 ## [2.9.3] - 2026-06-09
 
 ### Targetable fix loop + test generation

package/README.md

@@ -210,6 +210,15 @@ dxkit builds a deterministic code graph of your repo (its symbols, call edges, a
 
 This is an additive, fail-open layer. When the graph is missing, or a language's call edges can't be resolved, every command behaves exactly as it did before. It's reliable on TypeScript, Python, and Go. Where the call graph can't be resolved (C#), blast radius is suppressed rather than faked, so a "no callers" reading is never mistaken for "safe to change."
 
+### Connect findings and PRs to the people who know the code
+
+A finding or a PR is more actionable when you know who to ask. dxkit grounds that in an **active-owner model** — recency-weighted git history, scoped to who is still active, with bots and departed contributors filtered, the change author excluded, and a bus-factor signal.
+
+- **`vyuh-dxkit reviewers`** suggests reviewers for a change, ranked by active ownership of the touched files and blended with `CODEOWNERS` — a better signal than a platform's naive last-touch suggestion. The `dxkit-pr` skill folds it into the PR body.
+- **`--attribute`** adds a "who to ask" column to a detailed report: a pre-existing finding is traced to its current owner (an inactive author is routed to whoever owns the file now). It's opt-in and historical — a net-new finding is introduced by your own change.
+
+Output is names + GitHub @handles, never raw emails — the @handle is both privacy-safe and @-mentionable.
+
 ### Deep SAST: interprocedural findings from any engine
 
 dxkit's bundled SAST (community semgrep) is intraprocedural — it can't follow tainted data across function boundaries, so it misses the path-traversal / information-exposure / SSRF / injection class that an interprocedural engine like Snyk Code or CodeQL catches. dxkit doesn't try to re-detect that class; it **ingests** it and makes it first-class.

package/dist/allowlist/annotate.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Annotate security findings with their active-allowlist status
+ * for REPORTING (not gating).
+ *
+ * The guardrail already consults the allowlist to decide whether a
+ * net-new finding blocks a push (`src/baseline/check.ts`). But the
+ * vulnerability-scan report and dashboard rendered raw counts with no
+ * indication that some findings are reviewed-and-accepted — a repo that
+ * has correctly allowlisted, say, its unit-test fixtures still showed
+ * them as headline criticals with no visual distinction, which reads as
+ * "the score is lying."
+ *
+ * This module marks each finding whose fingerprint matches an ACTIVE
+ * (unexpired) allowlist entry so renderers can show "(N allowlisted)"
+ * beside the subtotal. It does NOT change raw counts and does NOT change
+ * the score — dxkit's raw-truth model is preserved; only the
+ * presentation gains an honesty annotation.
+ *
+ * Identity contract (CLAUDE.md Rule 9): this module never computes a
+ * fingerprint. It matches against the fingerprint the aggregator
+ * already stamped on each code/secret/config finding (plus the
+ * `absorbedFingerprints` recorded when cross-tool dedup collapsed
+ * contributors — same robust-match set the guardrail uses). Dependency
+ * findings are keyed by `(package, version, id)` through a producer and
+ * carry no inline fingerprint, so they are out of scope here.
+ */
+import { type AllowlistFile } from './file';
+import type { AllowlistCategory } from './categories';
+import type { FindingCategory } from '../analyzers/security/types';
+/**
+ * The minimal finding shape this module reads + writes. The runtime
+ * objects are richer (`CodeFinding` carries `fingerprint` +
+ * `absorbedFingerprints`); we accept the structural subset so callers
+ * pass their findings directly without a cast.
+ */
+export interface AnnotatableFinding {
+    readonly category: FindingCategory;
+    readonly fingerprint?: string;
+    readonly absorbedFingerprints?: readonly string[];
+    allowlisted?: boolean;
+    allowlistCategory?: AllowlistCategory;
+}
+/**
+ * Whether an active allowlist entry of this category should LIFT the
+ * finding from the dimension score (penalties + caps), not just from
+ * the guardrail.
+ *
+ * `false-positive` and `test-fixture` declare the finding is "not a real
+ * finding" — a misfire or throwaway test data — so a properly-triaged
+ * repo shouldn't carry a score penalty for it (the failure mode where a
+ * repo stays capped at the trust-broken tier despite having reviewed and
+ * accepted every flagged secret). `accepted-risk` and `deferred`, by
+ * contrast, accept a REAL risk: the guardrail stops blocking on them,
+ * but the score must still reflect the residual exposure — you can't
+ * `accepted-risk` your way to an A. `mitigated-externally` counts too:
+ * the risk is real, just handled outside dxkit.
+ */
+export declare function allowlistLiftsScore(category: AllowlistCategory | undefined): boolean;
+/**
+ * Mutate `findings` in place, setting `allowlisted` + `allowlistCategory`
+ * on each finding matched by an active allowlist entry. Returns the count
+ * of findings annotated, so callers can short-circuit rendering when zero.
+ *
+ * A finding matches when ANY of its candidate fingerprints (its own
+ * `fingerprint`, then any `absorbedFingerprints`) resolves to an
+ * allowlist entry whose `kind` equals the finding's kind and which is
+ * active at `now`. The kind guard rules out a cross-kind hash collision
+ * waiving the wrong finding — mirrors `allowlistSuppressionFor`.
+ */
+export declare function annotateFindingsWithAllowlist(findings: AnnotatableFinding[], allowlist: AllowlistFile | null, now?: Date): number;
+//# sourceMappingURL=annotate.d.ts.map

package/dist/allowlist/annotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotate.d.ts","sourceRoot":"","sources":["../../src/allowlist/annotate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,KAAK,aAAa,EAA4B,MAAM,QAAQ,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAoBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAEpF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,kBAAkB,EAAE,EAC9B,SAAS,EAAE,aAAa,GAAG,IAAI,EAC/B,GAAG,GAAE,IAAiB,GACrB,MAAM,CAuBR"}

package/dist/allowlist/annotate.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowlistLiftsScore = allowlistLiftsScore;
+exports.annotateFindingsWithAllowlist = annotateFindingsWithAllowlist;
+/**
+ * Annotate security findings with their active-allowlist status
+ * for REPORTING (not gating).
+ *
+ * The guardrail already consults the allowlist to decide whether a
+ * net-new finding blocks a push (`src/baseline/check.ts`). But the
+ * vulnerability-scan report and dashboard rendered raw counts with no
+ * indication that some findings are reviewed-and-accepted — a repo that
+ * has correctly allowlisted, say, its unit-test fixtures still showed
+ * them as headline criticals with no visual distinction, which reads as
+ * "the score is lying."
+ *
+ * This module marks each finding whose fingerprint matches an ACTIVE
+ * (unexpired) allowlist entry so renderers can show "(N allowlisted)"
+ * beside the subtotal. It does NOT change raw counts and does NOT change
+ * the score — dxkit's raw-truth model is preserved; only the
+ * presentation gains an honesty annotation.
+ *
+ * Identity contract (CLAUDE.md Rule 9): this module never computes a
+ * fingerprint. It matches against the fingerprint the aggregator
+ * already stamped on each code/secret/config finding (plus the
+ * `absorbedFingerprints` recorded when cross-tool dedup collapsed
+ * contributors — same robust-match set the guardrail uses). Dependency
+ * findings are keyed by `(package, version, id)` through a producer and
+ * carry no inline fingerprint, so they are out of scope here.
+ */
+const file_1 = require("./file");
+/**
+ * Map a report `FindingCategory` to the canonical `IdentityKind` used
+ * by allowlist entries. Only the three fingerprint-bearing categories
+ * resolve; `dependency` returns null (out of scope — see module doc).
+ */
+function kindForCategory(category) {
+    switch (category) {
+        case 'secret':
+            return 'secret';
+        case 'code':
+            return 'code';
+        case 'config':
+            return 'config';
+        case 'dependency':
+            return null;
+    }
+}
+/**
+ * Whether an active allowlist entry of this category should LIFT the
+ * finding from the dimension score (penalties + caps), not just from
+ * the guardrail.
+ *
+ * `false-positive` and `test-fixture` declare the finding is "not a real
+ * finding" — a misfire or throwaway test data — so a properly-triaged
+ * repo shouldn't carry a score penalty for it (the failure mode where a
+ * repo stays capped at the trust-broken tier despite having reviewed and
+ * accepted every flagged secret). `accepted-risk` and `deferred`, by
+ * contrast, accept a REAL risk: the guardrail stops blocking on them,
+ * but the score must still reflect the residual exposure — you can't
+ * `accepted-risk` your way to an A. `mitigated-externally` counts too:
+ * the risk is real, just handled outside dxkit.
+ */
+function allowlistLiftsScore(category) {
+    return category === 'false-positive' || category === 'test-fixture';
+}
+/**
+ * Mutate `findings` in place, setting `allowlisted` + `allowlistCategory`
+ * on each finding matched by an active allowlist entry. Returns the count
+ * of findings annotated, so callers can short-circuit rendering when zero.
+ *
+ * A finding matches when ANY of its candidate fingerprints (its own
+ * `fingerprint`, then any `absorbedFingerprints`) resolves to an
+ * allowlist entry whose `kind` equals the finding's kind and which is
+ * active at `now`. The kind guard rules out a cross-kind hash collision
+ * waiving the wrong finding — mirrors `allowlistSuppressionFor`.
+ */
+function annotateFindingsWithAllowlist(findings, allowlist, now = new Date()) {
+    if (!allowlist || allowlist.entries.length === 0)
+        return 0;
+    let annotated = 0;
+    for (const f of findings) {
+        const kind = kindForCategory(f.category);
+        if (!kind)
+            continue;
+        const candidates = [];
+        if (f.fingerprint)
+            candidates.push(f.fingerprint);
+        if (f.absorbedFingerprints)
+            candidates.push(...f.absorbedFingerprints);
+        for (const fp of candidates) {
+            const entry = (0, file_1.findEntry)(allowlist, fp);
+            if (!entry || entry.kind !== kind)
+                continue;
+            if (!(0, file_1.isEntryActive)(entry, now))
+                continue;
+            f.allowlisted = true;
+            f.allowlistCategory = entry.category;
+            annotated++;
+            break;
+        }
+    }
+    return annotated;
+}
+//# sourceMappingURL=annotate.js.map

package/dist/allowlist/annotate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotate.js","sourceRoot":"","sources":["../../src/allowlist/annotate.ts"],"names":[],"mappings":";;AA8EA,kDAEC;AAaD,sEA2BC;AAxHD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,iCAAsE;AAmBtE;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAyB;IAChD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,mBAAmB,CAAC,QAAuC;IACzE,OAAO,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,cAAc,CAAC;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,6BAA6B,CAC3C,QAA8B,EAC9B,SAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAE3D,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,WAAW;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,oBAAoB;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAEvE,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC5C,IAAI,CAAC,IAAA,oBAAa,EAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,SAAS;YACzC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACrC,SAAS,EAAE,CAAC;YACZ,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/allowlist/cli.d.ts

@@ -125,6 +125,12 @@ export declare function runAllowlistRemove(cwd: string, opts: AllowlistRemoveOpt
  * reason + expiry. Expired entries are skipped (they no longer
  * suppress). Only `snyk-code` findings export — native semgrep /
  * gitleaks findings have no Snyk equivalent.
+ *
+ * 2.10 also syncs the PATH-EXCLUSION half: `.dxkit-ignore` patterns
+ * (the paths dxkit's own analyzers skip) are emitted into the `.snyk`
+ * `exclude.global` block, so Snyk and dxkit agree on what's out of
+ * scope. The two halves compose into one `.snyk`; an export carrying
+ * only exclusions (no allowlisted Snyk findings yet) still writes.
  */
 export declare function runAllowlistExport(cwd: string, opts: AllowlistExportOpts): Promise<void>;
 export { DEFAULT_EXPIRY_DAYS };

package/dist/allowlist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/allowlist/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAkBH,OAAO,EAEL,mBAAmB,EAMpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAelB,KAAK,aAAa,EAEnB,MAAM,QAAQ,CAAC;AAGhB,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,wEAQxB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;4CAEwC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;kDAG8C;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;8CAC0C;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;2CAEuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE;IACJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAyDf;AAID,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxF;AAyHD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB1F;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B1F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuG5F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC5F;AAID,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B9F;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6E9F;AAoID,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/allowlist/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAuBH,OAAO,EAEL,mBAAmB,EAMpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAelB,KAAK,aAAa,EAEnB,MAAM,QAAQ,CAAC;AAGhB,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,wEAQxB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;4CAEwC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;kDAG8C;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;8CAC0C;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;2CAEuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE;IACJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAyDf;AAID,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxF;AAyHD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB1F;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B1F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuG5F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC5F;AAID,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B9F;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+F9F;AAmJD,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/allowlist/cli.js

@@ -462,23 +462,25 @@ async function runAllowlistRemove(cwd, opts) {
  * reason + expiry. Expired entries are skipped (they no longer
  * suppress). Only `snyk-code` findings export — native semgrep /
  * gitleaks findings have no Snyk equivalent.
+ *
+ * 2.10 also syncs the PATH-EXCLUSION half: `.dxkit-ignore` patterns
+ * (the paths dxkit's own analyzers skip) are emitted into the `.snyk`
+ * `exclude.global` block, so Snyk and dxkit agree on what's out of
+ * scope. The two halves compose into one `.snyk`; an export carrying
+ * only exclusions (no allowlisted Snyk findings yet) still writes.
  */
 async function runAllowlistExport(cwd, opts) {
     if (!opts.snyk) {
         logger.fail(`allowlist export currently supports only --snyk. Usage: allowlist export --snyk`);
         process.exit(1);
     }
+    // Path-exclusion half of the sync: `.dxkit-ignore` → Snyk
+    // `exclude.global`. Independent of allowlist findings, so it's read up
+    // front and can carry an export even when no Snyk findings are
+    // allowlisted (the two halves compose into one `.snyk`).
+    const excludes = readDxkitIgnoreExcludes(cwd);
     const file = (0, file_1.loadAllowlist)(cwd);
-    if (!file || file.entries.length === 0) {
-        logger.info(`No allowlist entries — nothing to export.`);
-        return;
-    }
     const snapshots = (0, snapshot_1.readAllSnapshots)(cwd).filter((f) => f.engine === 'snyk-code');
-    if (snapshots.length === 0) {
-        logger.info(`No Snyk Code findings have been ingested yet. ` +
-            `Run \`vyuh-dxkit ingest --from-snyk\` first.`);
-        return;
-    }
     // Recompute each Snyk finding's canonical fingerprint and match it to
     // an active allowlist entry. Dedup (rule, path) so several findings on
     // the same rule+path collapse to one ignore directive.
@@ -486,48 +488,79 @@ async function runAllowlistExport(cwd, opts) {
     const ignores = [];
     const seenRulePath = new Set();
     let skippedExpired = 0;
-    for (const f of snapshots) {
-        const fingerprint = (0, fingerprint_1.computeCodeFingerprint)((0, fingerprint_1.canonicalRuleFor)(f.engine, f.rule), f.file, f.line);
-        const entry = (0, file_1.findEntry)(file, fingerprint);
-        if (!entry)
-            continue;
-        if (!(0, file_1.isEntryActive)(entry)) {
-            skippedExpired++;
-            continue;
+    if (file && file.entries.length > 0) {
+        for (const f of snapshots) {
+            const fingerprint = (0, fingerprint_1.computeCodeFingerprint)((0, fingerprint_1.canonicalRuleFor)(f.engine, f.rule), f.file, f.line);
+            const entry = (0, file_1.findEntry)(file, fingerprint);
+            if (!entry)
+                continue;
+            if (!(0, file_1.isEntryActive)(entry)) {
+                skippedExpired++;
+                continue;
+            }
+            const key = `${f.rule}\0${f.file}`;
+            if (seenRulePath.has(key))
+                continue;
+            seenRulePath.add(key);
+            ignores.push({
+                ruleId: f.rule,
+                path: f.file,
+                reason: entry.reason,
+                expires: (0, snyk_policy_1.expiryToSnykDatetime)(entry.expiresAt),
+                created,
+            });
         }
-        const key = `${f.rule}\0${f.file}`;
-        if (seenRulePath.has(key))
-            continue;
-        seenRulePath.add(key);
-        ignores.push({
-            ruleId: f.rule,
-            path: f.file,
-            reason: entry.reason,
-            expires: (0, snyk_policy_1.expiryToSnykDatetime)(entry.expiresAt),
-            created,
-        });
+    }
+    // Bail only when there's nothing to act on at all: no usable allowlist
+    // context (entries + ingested snapshots to match them against) AND no
+    // path exclusions. When an allowlist+snapshots context exists we still
+    // write — an empty policy + JSON is meaningful output (preserves the
+    // pre-2.10 behavior the export tests pin).
+    const hasAllowlistContext = !!file && file.entries.length > 0 && snapshots.length > 0;
+    if (!hasAllowlistContext && excludes.length === 0) {
+        if (!file || file.entries.length === 0) {
+            logger.info(`No allowlist entries and no .dxkit-ignore exclusions — nothing to export.`);
+        }
+        else {
+            logger.info(`No Snyk Code findings have been ingested yet and no .dxkit-ignore ` +
+                `exclusions are present. Run \`vyuh-dxkit ingest --from-snyk\` first.`);
+        }
+        return;
     }
     const outPath = path.resolve(cwd, opts.out ?? '.snyk');
-    const policy = (0, snyk_policy_1.buildSnykPolicy)(ignores);
+    const policy = (0, snyk_policy_1.buildSnykPolicy)(ignores, excludes);
     fs.writeFileSync(outPath, policy, 'utf8');
     if (opts.json) {
-        process.stdout.write(JSON.stringify({ out: outPath, ignores: ignores.length, skippedExpired }, null, 2) + '\n');
+        process.stdout.write(JSON.stringify({ out: outPath, ignores: ignores.length, excludes: excludes.length, skippedExpired }, null, 2) + '\n');
         return;
     }
-    if (ignores.length === 0) {
-        logger.info(`No Snyk-originated findings are allowlisted — wrote an empty policy to ${outPath}.` +
-            (skippedExpired > 0
-                ? ` (${skippedExpired} expired entr${skippedExpired === 1 ? 'y' : 'ies'} skipped.)`
-                : ''));
-        return;
+    const parts = [];
+    parts.push(`${ignores.length} Snyk ignore${ignores.length === 1 ? '' : 's'}`);
+    if (excludes.length > 0) {
+        parts.push(`${excludes.length} path exclusion${excludes.length === 1 ? '' : 's'}`);
     }
-    logger.success(`Wrote ${ignores.length} Snyk ignore${ignores.length === 1 ? '' : 's'} to ${outPath}` +
+    logger.success(`Wrote ${parts.join(' + ')} to ${outPath}` +
         (skippedExpired > 0 ? ` (${skippedExpired} expired skipped)` : '') +
         '.');
     logger.dim('  Note: Snyk Code (SAST) honors .snyk ignores only with the "consistent ignores" ' +
         'feature enabled for your org; SCA/dependency ignores are standard.');
 }
 // ─── Internals ────────────────────────────────────────────────────────────
+/**
+ * Read `.dxkit-ignore` (if present) and convert its patterns into Snyk
+ * `exclude.global` globs. Returns [] when the file is absent or
+ * unreadable — the exclusion sync is best-effort and never blocks an
+ * allowlist export.
+ */
+function readDxkitIgnoreExcludes(cwd) {
+    try {
+        const raw = fs.readFileSync(path.join(cwd, '.dxkit-ignore'), 'utf8');
+        return (0, snyk_policy_1.dxkitIgnoreLinesToSnykExcludes)(raw.split('\n'));
+    }
+    catch {
+        return [];
+    }
+}
 function isAllowlistSubcommand(value) {
     return exports.ALLOWLIST_SUBCOMMANDS.includes(value);
 }