@vyuhlabs/dxkit 2.9.3 → 2.10.0

package/dist/reviewers-cli.js

@@ -0,0 +1,263 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCodeowners = parseCodeowners;
+exports.matchCodeowners = matchCodeowners;
+exports.buildSuggestions = buildSuggestions;
+exports.runReviewers = runReviewers;
+/**
+ * `vyuh-dxkit reviewers` — suggest reviewers for a change, grounded on the
+ * active-owner model (dev-report git history) rather than naive last-touch
+ * blame, blended with CODEOWNERS.
+ *
+ * The differentiation over a platform's built-in suggested-reviewers: the
+ * candidates are activity-weighted (recent, sustained work ranks highest),
+ * scoped to who is still active (a departed owner is never silently
+ * suggested), bot-free, exclude the change's own author, and carry a
+ * bus-factor signal. CODEOWNERS, when present, is authoritative and merged
+ * in. Output renders names + GitHub @handles — never raw emails.
+ *
+ * Pure helpers (`parseCodeowners`, `matchCodeowners`, `buildSuggestions`)
+ * are unit-tested without git; `runReviewers` is the IO entry point.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const logger = __importStar(require("./logger"));
+const ownership_1 = require("./analyzers/developer/ownership");
+const gather_1 = require("./analyzers/developer/gather");
+/**
+ * Parse a CODEOWNERS file. Each non-comment line is `<pattern> <owner>...`.
+ * Returns rules in file order; CODEOWNERS semantics are "last matching rule
+ * wins," so callers iterate in reverse.
+ */
+function parseCodeowners(content) {
+    const rules = [];
+    for (const raw of content.split(/\r?\n/)) {
+        const line = raw.replace(/#.*$/, '').trim();
+        if (!line)
+            continue;
+        const parts = line.split(/\s+/);
+        const pattern = parts[0];
+        const owners = parts.slice(1).filter(Boolean);
+        if (pattern && owners.length > 0)
+            rules.push({ pattern, owners });
+    }
+    return rules;
+}
+/** Translate a CODEOWNERS pattern to a RegExp (subset: `*`, `**`, leading
+ *  `/`, trailing `/`). Good enough for the common cases; unmatched exotic
+ *  globs simply don't match (conservative — never over-claims ownership). */
+function patternToRegExp(pattern) {
+    let p = pattern;
+    const anchored = p.startsWith('/');
+    if (anchored)
+        p = p.slice(1);
+    const dirOnly = p.endsWith('/');
+    if (dirOnly)
+        p = p.slice(0, -1);
+    // Tokenize so `**` -> `.*` and `*` -> `[^/]*` without a fragile placeholder;
+    // every other regex-special char is escaped.
+    let body = '';
+    for (let i = 0; i < p.length; i++) {
+        const c = p[i];
+        if (c === '*') {
+            if (p[i + 1] === '*') {
+                body += '.*';
+                i++;
+            }
+            else {
+                body += '[^/]*';
+            }
+        }
+        else if (/[.+^${}()|[\]\\?]/.test(c)) {
+            body += '\\' + c;
+        }
+        else {
+            body += c;
+        }
+    }
+    const full = dirOnly ? `${body}/.*` : `${body}(?:/.*)?`;
+    return new RegExp(anchored ? `^${full}$` : `(?:^|/)${full}$`);
+}
+/** Owners for one file: the LAST matching CODEOWNERS rule wins. Empty when
+ *  no rule matches. */
+function matchCodeowners(rules, file) {
+    for (let i = rules.length - 1; i >= 0; i--) {
+        if (patternToRegExp(rules[i].pattern).test(file))
+            return [...rules[i].owners];
+    }
+    return [];
+}
+/**
+ * Compose the active-owner ranking with CODEOWNERS into a ranked reviewer
+ * list. Pure. CODEOWNERS owners are authoritative (always included, flagged);
+ * active git owners follow, ranked by score; inactive owners are dropped from
+ * the suggestion list (they're surfaced only via the `note` fallback).
+ */
+function buildSuggestions(ownership, opts = {}) {
+    const limit = opts.limit ?? 3;
+    const codeowners = dedupe(opts.codeowners ?? []);
+    const out = [];
+    const seen = new Set();
+    // 1. CODEOWNERS first — authoritative.
+    for (const token of codeowners) {
+        const handle = token.startsWith('@') ? token.slice(1) : undefined;
+        const key = token.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({
+            name: token,
+            ...(handle ? { handle } : {}),
+            active: true, // CODEOWNERS is a maintained, current declaration
+            isCodeowner: true,
+            reason: 'listed in CODEOWNERS for the touched paths',
+            score: Number.POSITIVE_INFINITY,
+        });
+    }
+    // 2. Active git owners, ranked.
+    const activeOwners = ownership.ranked.filter((o) => o.active);
+    for (const o of activeOwners) {
+        const handle = o.githubHandle;
+        const key = (handle ? `@${handle}` : o.name).toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({
+            name: o.name,
+            ...(handle ? { handle } : {}),
+            active: true,
+            isCodeowner: false,
+            reason: `${o.commits} recent commit${o.commits === 1 ? '' : 's'} to the touched files (last ${o.lastTouched})`,
+            score: o.score,
+        });
+    }
+    const reviewers = out.slice(0, limit);
+    let note;
+    if (activeOwners.length === 0 && codeowners.length === 0) {
+        note =
+            ownership.ranked.length > 0
+                ? 'Every contributor who has touched these files is inactive — no current owner to suggest. Route by current team ownership.'
+                : 'No git history or CODEOWNERS for the touched files — no reviewer signal.';
+    }
+    else if (activeOwners.length === 0) {
+        note = 'Original authors are inactive — suggesting by CODEOWNERS only.';
+    }
+    return {
+        touchedFiles: [],
+        reviewers,
+        busFactor: ownership.busFactor,
+        ...(note ? { note } : {}),
+    };
+}
+function dedupe(xs) {
+    const seen = new Set();
+    const out = [];
+    for (const x of xs) {
+        const k = x.toLowerCase();
+        if (!seen.has(k)) {
+            seen.add(k);
+            out.push(x);
+        }
+    }
+    return out;
+}
+function gitOut(cmd, cwd) {
+    try {
+        return (0, child_process_1.execSync)(cmd, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+function touchedFiles(cwd, opts) {
+    if (opts.staged) {
+        return gitOut('git diff --cached --name-only', cwd).split('\n').filter(Boolean);
+    }
+    const base = opts.base || gitOut('git rev-parse --abbrev-ref origin/HEAD', cwd) || 'origin/main';
+    const out = gitOut(`git diff --name-only ${base}...HEAD`, cwd);
+    return out.split('\n').filter(Boolean);
+}
+function readCodeowners(cwd) {
+    for (const rel of ['.github/CODEOWNERS', 'CODEOWNERS', 'docs/CODEOWNERS']) {
+        const p = path.join(cwd, rel);
+        if (fs.existsSync(p))
+            return parseCodeowners(fs.readFileSync(p, 'utf8'));
+    }
+    return [];
+}
+function runReviewers(cwd, opts) {
+    const files = touchedFiles(cwd, opts);
+    if (files.length === 0) {
+        logger.info('No changed files detected (pass --base <ref> or --staged). Nothing to suggest.');
+        return;
+    }
+    // Exclude the change author from suggestions (never review your own PR).
+    const authorEmail = gitOut('git config --get user.email', cwd);
+    const excludeEmails = authorEmail ? new Set([(0, gather_1.normalizeEmail)(authorEmail)]) : undefined;
+    const ownership = (0, ownership_1.ownersFor)(cwd, files, { ...(excludeEmails ? { excludeEmails } : {}) });
+    // CODEOWNERS owners for the touched files (deduped across files).
+    const rules = readCodeowners(cwd);
+    const coOwners = [];
+    for (const f of files)
+        coOwners.push(...matchCodeowners(rules, f));
+    const result = {
+        ...buildSuggestions(ownership, {
+            ...(opts.limit !== undefined ? { limit: opts.limit } : {}),
+            codeowners: coOwners,
+        }),
+        touchedFiles: files,
+    };
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        return;
+    }
+    logger.info(`Suggested reviewers for ${files.length} changed file${files.length === 1 ? '' : 's'}:`);
+    if (result.reviewers.length === 0) {
+        logger.info('  (none)');
+    }
+    for (const r of result.reviewers) {
+        const who = r.handle ? `@${r.handle}` : r.name;
+        const tag = r.isCodeowner ? ' [CODEOWNERS]' : '';
+        logger.info(`  ${who}${tag} — ${r.reason}`);
+    }
+    if (result.busFactor === 1) {
+        logger.warn('  Bus factor 1: a single active owner covers these files — consider spreading knowledge.');
+    }
+    if (result.note)
+        logger.dim(`  ${result.note}`);
+}
+//# sourceMappingURL=reviewers-cli.js.map

package/dist/reviewers-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewers-cli.js","sourceRoot":"","sources":["../src/reviewers-cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,0CAWC;AAmCD,0CAKC;AAmCD,4CA4DC;AAiDD,oCAgDC;AArRD;;;;;;;;;;;;;;GAcG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,iDAAyC;AACzC,iDAAmC;AACnC,+DAAkF;AAClF,yDAA8D;AAS9D;;;;GAIG;AACH,SAAgB,eAAe,CAAC,OAAe;IAC7C,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;6EAE6E;AAC7E,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,GAAG,OAAO,CAAC;IAChB,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,OAAO;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,IAAI,IAAI,IAAI,CAAC;gBACb,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,OAAO,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC;IACxD,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;uBACuB;AACvB,SAAgB,eAAe,CAAC,KAAoC,EAAE,IAAY;IAChF,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AA6BD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAC9B,SAA0B,EAC1B,OAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,uCAAuC;IACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,KAAK;YACX,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,IAAI,EAAE,kDAAkD;YAChE,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,4CAA4C;YACpD,KAAK,EAAE,MAAM,CAAC,iBAAiB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC;QAC9B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,iBAAiB,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,+BAA+B,CAAC,CAAC,WAAW,GAAG;YAC9G,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEtC,IAAI,IAAwB,CAAC;IAC7B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,IAAI;YACF,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,2HAA2H;gBAC7H,CAAC,CAAC,0EAA0E,CAAC;IACnF,CAAC;SAAM,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,gEAAgE,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,EAAyB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,SAAS,MAAM,CAAC,GAAW,EAAE,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,IAAA,wBAAQ,EAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,IAAsB;IACvD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,wCAAwC,EAAE,GAAG,CAAC,IAAI,aAAa,CAAC;IACjG,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,KAAK,MAAM,GAAG,IAAI,CAAC,oBAAoB,EAAE,YAAY,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,eAAe,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,YAAY,CAAC,GAAW,EAAE,IAAsB;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,MAAM,WAAW,GAAG,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAA,uBAAc,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvF,MAAM,SAAS,GAAG,IAAA,qBAAS,EAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEzF,kEAAkE;IAClE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,MAAM,GAAoB;QAC9B,GAAG,gBAAgB,CAAC,SAAS,EAAE;YAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,UAAU,EAAE,QAAQ;SACrB,CAAC;QACF,YAAY,EAAE,KAAK;KACpB,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,MAAM,CAAC,IAAI,CACT,2BAA2B,KAAK,CAAC,MAAM,gBAAgB,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CACxF,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/scoring/dimensions/security.d.ts

@@ -78,6 +78,23 @@ export interface SecurityScoreInput {
      * Adapters MUST populate this from `DepVulnSummary.available`.
      */
     depVulnsAvailable: boolean;
+    /**
+     * Pre-2.10 the unavailability cap was asymmetric — a missing
+     * dep-vuln scan capped at the uncertainty tier while missing
+     * secret/code scanners silently scored as "0 findings". An upgrade
+     * that merely turned the secret scanners ON then read as a score
+     * drop on an unchanged commit. These two flags give
+     * every measurement axis the same honest treatment: scanner didn't
+     * run → uncertainty cap, never a confident clean score.
+     *
+     * Same attempted-and-failed semantics as `depVulnsAvailable`:
+     * false ONLY when the gather was attempted and no provider
+     * succeeded. "No active provider" stays vacuously true.
+     */
+    secretsAvailable: boolean;
+    /** See `secretsAvailable` — same contract for the semgrep /
+     *  code-patterns axis. */
+    codePatternsAvailable: boolean;
 }
 export declare const SECURITY_SCORING_SPEC: DimensionScoringSpec<SecurityScoreInput>;
 export {};

package/dist/scoring/dimensions/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/scoring/dimensions/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpD,oEAAoE;AACpE,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,YAAY,EAAE,cAAc,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,EAAE,cAAc,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAUD,eAAO,MAAM,qBAAqB,EAAE,oBAAoB,CAAC,kBAAkB,CAoF1E,CAAC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/scoring/dimensions/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpD,oEAAoE;AACpE,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,YAAY,EAAE,cAAc,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,EAAE,cAAc,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;OAYG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;8BAC0B;IAC1B,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAUD,eAAO,MAAM,qBAAqB,EAAE,oBAAoB,CAAC,kBAAkB,CAgG1E,CAAC"}

package/dist/scoring/dimensions/security.js

@@ -121,6 +121,18 @@ exports.SECURITY_SCORING_SPEC = {
             describe: () => `dependency vulnerability scan did not run`,
             applies: (i) => !i.depVulnsAvailable,
         },
+        {
+            id: 'secrets-unavailable',
+            tier: 'uncertainty',
+            describe: () => `secret scan did not run`,
+            applies: (i) => !i.secretsAvailable,
+        },
+        {
+            id: 'code-patterns-unavailable',
+            tier: 'uncertainty',
+            describe: () => `static-analysis (code-pattern) scan did not run`,
+            applies: (i) => !i.codePatternsAvailable,
+        },
         {
             id: 'high-plus-code-open',
             tier: 'fixable-finding',

package/dist/scoring/dimensions/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/scoring/dimensions/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;;;AAiDH;;;GAGG;AACH,SAAS,MAAM,CAAC,CAAS,EAAE,QAAgB,EAAE,MAAe;IAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAEY,QAAA,qBAAqB,GAA6C;IAC7E,SAAS,EAAE,UAAU;IACrB,WAAW,EAAE,gCAAgC;IAC7C,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE;QACT;YACE,EAAE,EAAE,iBAAiB;YACrB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW;YAC3E,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC;YACpC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,yBAAyB,CAAC,UAAU;YAClF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC;YACrC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;SACjB;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,iBAAiB;YACzE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC;YACnC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;SACjB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,uBAAuB,CAAC,oBAAoB;YACjF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,oBAAoB;YACxF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;YACvC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACnD;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,qBAAqB,CAAC,oBAAoB;YAC5F,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;YAC1C,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;SAChB;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC,EAAE;YACtF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC;YACvC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;SACjB;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,EAAE;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;YACnC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;IACD,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gBACd,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACnF,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACrF,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5E,OAAO,kCAAkC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC;SACrF;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,2CAA2C;YAC3D,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;SACrC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gBACd,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;gBAC5D,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,yBAAyB,CAAC,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;SACvE;KACF;CACF,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/scoring/dimensions/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;;;AAkEH;;;GAGG;AACH,SAAS,MAAM,CAAC,CAAS,EAAE,QAAgB,EAAE,MAAe;IAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAEY,QAAA,qBAAqB,GAA6C;IAC7E,SAAS,EAAE,UAAU;IACrB,WAAW,EAAE,gCAAgC;IAC7C,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE;QACT;YACE,EAAE,EAAE,iBAAiB;YACrB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW;YAC3E,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC;YACpC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,yBAAyB,CAAC,UAAU;YAClF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC;YACrC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;SACjB;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,iBAAiB;YACzE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC;YACnC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;SACjB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,uBAAuB,CAAC,oBAAoB;YACjF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,oBAAoB;YACxF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;YACvC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACnD;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,qBAAqB,CAAC,oBAAoB;YAC5F,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;YAC1C,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;SAChB;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC,EAAE;YACtF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC;YACvC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;SACjB;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,EAAE;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;YACnC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;IACD,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gBACd,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACnF,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACrF,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5E,OAAO,kCAAkC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC;SACrF;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,2CAA2C;YAC3D,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;SACrC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,yBAAyB;YACzC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB;SACpC;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,iDAAiD;YACjE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB;SACzC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gBACd,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;gBAC5D,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,yBAAyB,CAAC,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;SACvE;KACF;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vyuhlabs/dxkit",
-  "version": "2.9.3",
+  "version": "2.10.0",
   "description": "AI-native developer experience toolkit for any codebase",
   "license": "MIT",
   "author": "Vyuh Labs",

package/templates/.claude/skills/dxkit-action/SKILL.md

@@ -28,6 +28,8 @@ npx vyuh-dxkit vulnerabilities --detailed --graph-context   # or test-gaps / qua
 
 `--graph-context` adds a "Graph context" column (the module a finding lives in + its blast radius — how many files call into it) so you can plan the fix without separately discovering structure. It's a structural HINT, not ground truth — read "Graph context" below for how to use it safely.
 
+Add **`--attribute`** when you need to know *who to ask* about a pre-existing finding — it adds a "Who to ask" column from `git blame` routed through the active-owner model, so an inactive author is forwarded to the file's current owner (names + @handles, never emails). It's opt-in and **historical only**: a net-new finding the guardrail just blocked was introduced by your own change, so "who to ask" there is simply the PR author — no blame needed. Honor the honesty caveat (blame is last-touch, not necessarily who introduced it).
+
 ## Scoped fix — fix one category at a time
 
 Often the user doesn't want "fix everything" — they want to burn down **one
@@ -99,7 +101,16 @@ npx vyuh-dxkit vulnerabilities --json | jq '.summary.findings'
 
 Don't try to redact the secret in place — the git history still has it. Rotation is the only true fix.
 
-If the "secret" is actually a placeholder in test code (e.g., `"sk_test_xxxxxxxxxxxx"` with no real credential value), confirm with the developer and allowlist via `dxkit-allow:test-fixture` — see "Allowlisting (when fix is not viable)" below.
+#### Secrets in test files — TRIAGE, don't assume
+
+dxkit deliberately does **not** lower a secret's severity just because it sits in a test file: the scanner can't tell a throwaway fixture from a real credential someone pasted into an integration test, and a real leak in a test is still a leak. So test-file secrets reach you at full severity, and the report flags how many are test-located — that's your cue to triage each one, not to dismiss them:
+
+1. **Open the line and judge the value.** Obvious throwaway fixture (`'password1'`, `'changeme'`, `'sk_test_xxxx'`, low-entropy / dictionary)? Or does it look like a real credential (high-entropy token, a real-looking host/user/password, something that would actually authenticate)?
+2. **Fixture → allowlist it.** `vyuh-dxkit allowlist add <file>:<line> --category=test-fixture --reason="..."`. This is the right tool: it records *why*, and `test-fixture` (like `false-positive`) **lifts the finding from the Security score**, not just the guardrail — so a properly-triaged test file stops dragging the score down. Don't waste effort "rotating" a fake value.
+3. **Real credential → treat it as a live leak.** Rotate in the provider, remove from the file, scrub git history (`git filter-repo` / BFG). Being in a test does not make it safe.
+4. **Unsure? Ask the developer** before allowlisting — never allowlist a value you haven't confirmed is fake.
+
+Allowlisting under `test-fixture` is a deliberate per-finding judgment, not a blanket "ignore tests" — don't add a `.dxkit-ignore` for the test directory to make the noise go away (that also drops the files from coverage + test-gap analysis, and would hide a real leak the same way). See "Allowlisting (when fix is not viable)" below.
 
 ### SAST finding (semgrep)
 
@@ -164,7 +175,7 @@ If the finding is a false positive, add `// slop-ok: <reason>` on the offending
 
 ## Allowlisting (when fix is not viable)
 
-**Fix first.** The allowlist is the SECOND option, not the first. When you reach for it, choose deliberately — every allowlist entry is a future maintenance burden the customer's team will revisit.
+**Fix first.** The allowlist is the SECOND option, not the first. When you reach for it, choose deliberately — every allowlist entry is a future maintenance burden the team will revisit.
 
 Five typed categories signal WHY the suppression is in place:
 

package/templates/.claude/skills/dxkit-allowlist/SKILL.md

@@ -7,6 +7,15 @@ description: Manage the dxkit allowlist over its whole lifecycle — list, inspe
 
 The allowlist is dxkit's per-finding suppression surface: a reviewed finding that the team has categorized (`false-positive`, `test-fixture`, `mitigated-externally`, `accepted-risk`, `deferred`) with a reason, so the guardrail lets it pass on future runs. It's the single source of truth across every scanner — native semgrep/gitleaks and ingested Snyk Code / CodeQL findings alike, all keyed on one fingerprint.
 
+### Categories affect the score, not just the guardrail
+
+The category isn't just a label — it decides whether the finding still counts toward the **Security score**:
+
+- **`false-positive` / `test-fixture`** declare the finding is *not a real finding* (a scanner misfire, or throwaway test data). These are **lifted from the Security penalties and caps**, so a repo that has genuinely triaged its noise scores honestly instead of staying capped on findings it has already reviewed and accepted. This is also why test-file secrets (which dxkit never auto-downgrades by path) should be allowlisted as `test-fixture` once confirmed fake — that's what removes them from the score.
+- **`accepted-risk` / `deferred` / `mitigated-externally`** accept a *real* exposure. The guardrail stops blocking, but the score keeps counting them — accepting a real risk can't earn an A. (`accepted-risk` / `deferred` also require an expiry so the acceptance ages out.)
+
+So `false-positive`/`test-fixture` are the only categories that recover score. Reserve them for findings that genuinely aren't real — miscategorizing a real risk as `false-positive` to lift the score is exactly the self-deception the typed categories exist to prevent.
+
 This skill manages the allowlist's **lifecycle**: reviewing what's there, keeping it honest, and propagating decisions outward. For the upstream question — *should this be fixed instead of suppressed, and how do I add an entry* — that decision and the `add` path live in **dxkit-action**. Fix first; suppress second.
 
 ## The lifecycle at a glance

package/templates/.claude/skills/dxkit-onboard/SKILL.md

@@ -104,7 +104,7 @@ For each fixable signal in doctor's output, dispatch through `dxkit-fix`'s recov
 
 - `git hooks active` not active → `npx vyuh-dxkit hooks activate`
 - `baseline captured` missing → defer to step 5 (we'll handle that explicitly with the secrets warning)
-- `vyuh-dxkit on PATH` missing → `npm install -g @vyuhlabs/dxkit`
+- `vyuh-dxkit on PATH` missing → `npm install -g @vyuhlabs/dxkit` (a global install — it affects every Node project on the machine and may need elevated permissions; a project-local install or a Node version manager works too)
 - `scanner toolchain` incomplete → `npx vyuh-dxkit tools install --yes`
 
 Don't auto-execute baseline capture here — step 5 has a values-laden warning that needs explicit customer confirmation.
@@ -195,7 +195,7 @@ Local hooks are fast feedback; CI is the unbypassable enforcement. Branch protec
 
 ASK:
 
-> **Configure branch protection now?** Default yes. Adds `dxkit-guardrails` as a required status check on `<default branch>`. Requires admin permission on the GitHub repo. Without this, the CI workflow is informational — PRs can merge even on guardrail failures.
+> **Configure branch protection now?** Default yes. This **modifies your GitHub repository settings** — it adds `dxkit-guardrails` as a required status check on `<default branch>`, and so needs admin permission on the repo. Without it, the CI workflow is informational — PRs can merge even on guardrail failures.
 
 If yes:
 

package/templates/.claude/skills/dxkit-pr/SKILL.md

@@ -78,6 +78,22 @@ Put in the body:
 - **Score deltas** — only when the change targeted a dimension (e.g. "Tests
   62 → 71 after closing the auth gaps"). Don't pad with unchanged scores.
 
+### Suggested reviewers
+
+```bash
+npx vyuh-dxkit reviewers --base <base-branch> --json
+```
+
+This ranks reviewers by the **active-owner model** — recency-weighted git
+history on the touched files, with bots and departed contributors filtered, the
+PR author excluded, blended with `CODEOWNERS`. Better signal than the platform's
+naive last-touch suggestion. Surface the top few in the body with the *why*
+("@alice — owns 3/4 touched files, active"), and you can pass them to
+`gh pr create --reviewer`. Honor the output's caveats: if it returns a
+`busFactor: 1`, note the single-point-of-failure; if it returns a `note`
+(original authors inactive / no signal), say so rather than inventing a
+reviewer. Renders `@handle`s, never emails.
+
 ## [4] Draft — title, body, reviewer checklist
 
 **Title** — imperative, scoped, specific. `feat(auth): add refresh-token
@@ -100,6 +116,10 @@ rotation`, not `Updates`. Match the repo's existing PR/commit convention
 - Allowlist: <new suppressions + reason + expiry, or "no changes">
 - Scores: <dimension deltas, if the change targeted one>
 
+## Suggested reviewers
+- @alice — owns 3/4 touched files, active · @bob — CODEOWNERS
+  (or the `note` when there's no active-owner signal)
+
 ## Reviewer checklist
 - [ ] Change matches the description; scope isn't broader than stated
 - [ ] <feature>: behavior verified (how to exercise it)
@@ -120,7 +140,8 @@ Show the user the full draft (title + body) and confirm. On yes:
 
 ```bash
 git push -u origin HEAD                # if not already pushed
-gh pr create --base main --title "<title>" --body "<body>"
+gh pr create --base main --title "<title>" --body "<body>" \
+    --reviewer <handle1>,<handle2>     # the active owners from `reviewers`, if any
 ```
 
 If `gh` isn't authenticated, print the title + body for the user to paste, and