@vyuhlabs/dxkit 2.9.4 → 2.11.0

package/CHANGELOG.md

@@ -7,6 +7,242 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.11.0] - 2026-06-16
+
+### Code-graph quality, guardrail reliability on JS/TS, and a dogfooding pass
+
+dxkit was run on its own repo and on real public targets, the way a user would.
+That surfaced a cluster of graph-quality and guardrail-identity defects — several
+HIGH — that the unit suite couldn't catch because they only appear on the default
+configuration, end-to-end. This release closes them.
+
+#### Code graph
+
+- **JS/TS method extraction (via `graphifyy` 0.8.40).** Function symbols defined as
+  `this.x = () => {}` (constructor-assigned methods), `exports.x` / `module.exports.x`,
+  prototype methods, class arrow fields, and function expressions are now captured.
+  Previously only top-level declarations, `const` arrows, and class-method shorthand
+  were, so on expression-style JS and CommonJS the bulk of callable symbols — and any
+  call edges to them — were invisible. On a constructor-style DAO, a file goes from 1
+  captured symbol to all of its methods. (Fixed upstream in
+  [safishamsi/graphify#1323](https://github.com/safishamsi/graphify/pull/1323).)
+- **The code graph is restricted to source files.** graphify also parses `.md`
+  (headings → nodes) and `.json` (config + lockfile keys → nodes); on a JS repo that
+  made the graph ~92% non-code (a `package-lock.json` alone outweighed all application
+  code). A source-extension allowlist, sourced from the language registry, keeps the
+  graph to actual code — node counts, communities, hot-files, api-surface, and the
+  context-hook's file summaries all stop being diluted by docs/config.
+
+#### Guardrail + finding identity
+
+- **Dependency-vulnerability identity is now environment-independent.** The
+  fingerprint hashed `(package, installedVersion, id)`; the installed version is only
+  resolvable when the dependency tree is installed (`npm-audit` reads `node_modules`),
+  so a lockfile-only scanner — or any scan in an environment without `node_modules` —
+  omitted it, and the **same advisory forked into two identities by scan environment.**
+  Identity is now `(package, canonicalAdvisoryId)`: the version is display metadata, not
+  identity, and the advisory id is canonicalized across namespaces (GHSA → CVE → raw) so
+  different scanners agree on the same vulnerability.
+  **Migration:** dep-vuln fingerprints change. `ref-based` baselines: nothing to do.
+  `committed-full` baselines: run `vyuh-dxkit baseline create --force` once; the
+  transition run shows dep-vulns as resolved+added (non-blocking) until re-baselined.
+  Fingerprint-allowlisted dep-vulns (rare) need re-adding.
+- **Secret + code-pattern finding identity is anchored to content, not line position.**
+  A finding's durable fingerprint hashed its file plus a 3-line window, so any edit that
+  shifted a finding more than three lines re-minted its identity — which silently
+  stranded the allowlist entry pinned to it (the suppression stopped matching) and
+  churned the baseline on edits that never touched the finding. Identity now derives from
+  *what the finding is*, computed only from inputs dxkit derives itself — never a scanner's
+  captured text or an environment-derived salt: a secret from a tool-independent constant
+  plus its file plus an in-file ordinal (no captured value, no salt — so the same leak gets
+  one identity whether gitleaks or the grep fallback found it, and identically across a
+  developer's machine and CI); a code-pattern finding from its enclosing symbol (resolved
+  from the code graph, or the file when no symbol resolves) plus a hash of the matched span
+  plus an in-symbol ordinal; a config finding (`.env`-in-git) from `(rule, file)`. The line
+  number becomes display metadata. A finding keeps its identity when it moves and re-mints
+  only when the matched construct — or its enclosing function — actually changes, so
+  allowlist entries and baselines survive refactors and unrelated edits. Ingested SARIF
+  findings (Snyk Code / CodeQL) earn the same code anchor from the engine's reported
+  snippet. When no anchor is resolvable (e.g. a scanner that surfaces no matched snippet)
+  identity falls back to the previous line-window hash, so every finding still has a stable
+  id.
+  **Migration — one command:** secret/code/config and dep-vuln fingerprints change once.
+  Every artifact now records the identity scheme it was written under, and the upgrade is
+  automatic:
+
+  ```
+  npm i -D @vyuhlabs/dxkit@latest
+  vyuh-dxkit update     # detects the scheme change → migrates baseline + allowlist
+  git add .dxkit && git commit -m "chore(dxkit): adopt this release"
+  ```
+
+  `update` rewrites the allowlist's fingerprints onto the new scheme (preserving every
+  reviewed suppression — no re-reviewing, no copying fingerprints from reports) and
+  regenerates the baseline, reporting what it re-anchored and flagging any entry whose
+  finding is gone. Inline `dxkit-allow:` source annotations need nothing (they match by
+  location). If you skip `update` and run the guardrail directly, it stops with an
+  explicit "run `vyuh-dxkit update`" message instead of reporting every pre-existing
+  finding as net-new. `ref-based` repos (no committed baseline) need nothing. Manual
+  fallback if you'd rather not use `update`: `vyuh-dxkit baseline create --force` plus
+  re-adding fingerprint-based allowlist entries by hand. Refresh committed SARIF
+  snapshots (`vyuh-dxkit ingest …`) so ingested findings pick up content anchors; until
+  refreshed they ride the line-window fallback.
+- **`ref-based` guardrail is reliable on JS/TS repos.** ref-based gathers the prior side
+  from a detached `git worktree` that has no `node_modules` or coverage report, so the
+  build-artifact-dependent kinds (`duplication` via jscpd, `test-gap` via coverage)
+  under-produced on the prior side and the current side's full set read as net-new. They
+  are now excluded from both sides of a ref-based diff (symmetric), with a disclosure in
+  the console + PR-comment output; `committed-full` remains the mode that gates them.
+- **The analysis cache invalidates on `.dxkit/` input changes.** Editing
+  `.dxkit/allowlist.json` had no effect until the commit changed, because the cache
+  key tracked `.dxkit-ignore` but not the allowlist / policy / ingested-snapshot inputs
+  that live under the same `.dxkit/` prefix the dirty-check excludes. The cache key now
+  folds in a content digest of those inputs, so an allowlist edit re-scores immediately.
+
+#### Toolchain
+
+- **vitest 4.** Bumps vitest + `@vitest/coverage-v8` to v4 and clears the critical +
+  high dev-tooling advisories in the vitest → vite → esbuild chain (plus `tmp`). All
+  dev-only — none ship in `dist/`. No published-`engines` change.
+
+## [2.10.0] - 2026-06-13
+
+### Honest scoring under changing scanners, passive graph delivery, tool-robustness
+
+Closes a set of brownfield-install and guardrail-matcher defects (the original
+2.9.5 hardening), a class of scoring-honesty bugs (a Security score that could get
+worse on an unchanged commit, with nothing explaining why), a defensive
+tool-version-pin sweep, and the agentic-delivery redesign that finally routes the
+code graph to the agent in a real fix workflow.
+
+#### Scoring honesty
+
+A Security score could drop on an **unchanged commit** — e.g. after an upgrade
+enabled more scanners, or because a repo's own reviewed-and-accepted findings kept
+holding it at a cap. The measurement was getting more honest, but the output
+didn't explain it, and a properly-triaged repo couldn't recover its score. These
+close that gap.
+
+- **Symmetric unavailable-scanner caps.** A missing dependency-audit
+  already capped the Security score at the uncertainty tier, but missing
+  secret/code-pattern scanners silently scored as "0 findings" — so enabling
+  those scanners later read as a phantom regression. The secret and code-pattern
+  axes now get the same uncertainty cap when their scan didn't run, surfaced in
+  `metrics.toolsUnavailable` and the standalone vuln-scan report.
+- **The score respects the allowlist.** Findings reviewed-and-accepted as
+  `false-positive` / `test-fixture` are now lifted from the Security penalties and
+  caps (not just the guardrail), so a triaged repo scores honestly instead of
+  staying capped on noise it has already accepted. `accepted-risk` / `deferred` /
+  `mitigated-externally` still count — accepting a real risk can't earn an A. The
+  vulnerability report and dashboard also annotate allowlisted findings and render
+  `Subtotal N (M allowlisted)` so the raw counts are explained, not alarming.
+- **Scanner-coverage drift is disclosed.** When the active scanner set grew
+  since the last run, the vuln-scan report leads with a note: findings the new
+  scanners surface are newly **visible**, not newly **introduced**. This is the
+  root-cause explanation for a score that moved on unchanged code.
+- **Secret severity is never lowered by file path.** A hardcoded credential keeps
+  its natural severity whether it sits in production code or a test — the generic
+  matcher can't tell a throwaway fixture from a real secret leaked into a test, so
+  lowering severity by path would silently hide genuine leaks. Test-file noise is
+  managed by the allowlist score-lift above (review fixtures once with
+  `--category test-fixture`), not by hiding. The vulnerability report now flags how
+  many secret findings sit in test files and points fixtures at the allowlist; the
+  `dxkit-action` and `dxkit-allowlist` skills gain an explicit triage step
+  (confirm fixture vs. real, allowlist fakes, rotate reals) so an agent handles
+  this judgment per finding rather than blanket-ignoring the test directory.
+- **Systematic test-file detection.** Tests organized under Jest's `__tests__/`
+  directory — or named with the widespread `.unit.` / `.e2e.` / `.cy.` suffixes —
+  were classified as source, corrupting the test ratio, coverage, and test-gap
+  analysis. The cross-ecosystem test directories (`__tests__/`, `test/`, `tests/`,
+  `spec/`, `e2e/`) are now recognized in any language; the TS pack gains the
+  co-located suffix conventions.
+- **Dependency-audit cleanup on Windows (EPERM).** The osv-scanner-fix temp-dir
+  cleanup now retries with backoff and never throws out of its `finally`, so a
+  Windows handle race (npm-install grandchildren / antivirus) can no longer
+  discard the already-parsed fix plans — which had let dependency vulnerabilities
+  go silently unreported.
+
+#### Passive graph delivery (agentic value)
+
+- **Context-hook fires on the tools agents actually use.** Pre-2.10 the graph
+  context-hook fired only on the native `Grep`/`Glob` tools and only when the
+  search pattern substring-matched a symbol name — so in a real fix workflow
+  (agents search via `Bash grep` for a symptom, and read files directly) it
+  almost never engaged. It now fires on **Read/Edit** (keyed on the file touched
+  → that file's structural summary: symbols, callers, callees, module group),
+  **Bash** (parses grep/rg commands; a named source file delivers its summary,
+  else a symbol match on the pattern), and the original **Grep/Glob** path.
+  Per-session, per-file dedup keeps it cheap; the FAIL-OPEN + ADDITIVE contract is
+  preserved (any problem is a silent no-op). **Existing repos must re-run
+  `vyuh-dxkit init`** (or update `.claude/settings.json`) to pick up the broadened
+  `Read|Edit|Bash|Grep|Glob` matcher.
+
+#### Snyk sync
+
+- **`.dxkit-ignore` → `.snyk` exclude sync.** `allowlist export --snyk` now also
+  emits the paths dxkit's analyzers skip (`.dxkit-ignore`) into the `.snyk`
+  `exclude.global` block, so Snyk and dxkit agree on what's out of scope —
+  mirroring the existing allowlist → `.snyk` ignore sync. An export carrying only
+  exclusions still writes.
+
+#### Tool-robustness + matcher rename fixes
+
+Hardening pass closing a set of brownfield-install and guardrail-matcher
+defects surfaced while benchmarking on Python 3.14 and large real-world repos.
+
+#### Fixed
+
+- **graphify on Python 3.14.** Python 3.14 made `forkserver` the default
+  multiprocessing start method on Linux. graphify parallelises extraction with a
+  `ProcessPoolExecutor`, and under spawn/forkserver each worker re-imports the
+  generated script — re-running top-level extraction and crashing the run (no
+  `.dxkit/reports/graph.json` written; every graph-dependent feature silently
+  degraded). The generated script now wraps its execution body in
+  `if __name__ == '__main__'` — graphify's own documented requirement for
+  parallel extraction — so it is correct on every platform and start method
+  (Linux fork/forkserver, macOS/Windows spawn) while keeping multi-core
+  extraction. The previous forced `set_start_method('fork')` workaround is
+  removed.
+- **graphify cache redirect.** The on-disk cache is now redirected via
+  graphify's public `extract(cache_root=...)` parameter instead of
+  monkeypatching the internal `graphify.cache.cache_dir`, whose signature
+  changed in graphifyy 0.8 (`cache_dir(root)` → `cache_dir(root, kind)`) and
+  crashed the run. This also stops graphify's `atexit` stat-index flush from
+  writing a stray `graphify-out/` into the scanned repo. The temp cache lives
+  under the caller-owned script dir and is reclaimed after the process (and its
+  atexit handlers) exit. `graphifyy` is pinned to `0.8.36`.
+- **jscpd version pin.** jscpd is pinned to `4.2.5`. jscpd 5.x is a Rust
+  rewrite that dropped the `--gitignore` flag (dxkit passed it → exit 2) and
+  changed the report JSON schema dxkit parses.
+- **Guardrail matcher — whole-file rename relocation.** Renaming a source
+  file no longer reports its whole-file findings (test-gap, coverage-gap,
+  test-file-degradation, god-file, stale-file, large-file) as removed + added,
+  which falsely blocked the guardrail on a pure rename. The git-aware matcher
+  now relocates these line-less, file-anchored findings through git's rename
+  detection, keyed on `(renamed-path, kind)` so two different whole-file kinds
+  on the same renamed file never cross-pair.
+
+#### Tool-version pins
+
+- **Defensive pin sweep.** Nine more dxkit-owned, deterministic-output scanners
+  are pinned to their current releases (semgrep `1.165.0`, ruff `0.15.17`,
+  pip-audit `2.10.1`, pip-licenses `5.5.5`, coverage `7.14.1`,
+  license-checker-rseidelsohn `5.0.1`, golangci-lint `v1.64.8` — the v1 line,
+  since v2 is a breaking rewrite on a separate module path — govulncheck `v1.3.0`,
+  go-licenses `v1.6.0`), so a future breaking major can't silently change parsed
+  output or exit codes the way jscpd 5.x and graphifyy 0.8 did. Five tools stay
+  unpinned by design and are now documented as such: `eslint` + `vitest-coverage`
+  (project-local — the consumer owns the version), `snyk` (a SaaS client that
+  self-manages backend compatibility), `codeql` (a GitHub-managed bundle paired
+  with query packs), and `cloc` (non-semver npm tag, lowest-risk schema). Proper
+  schema-adaptive multi-version handling is planned for a later release.
+
+#### Internal
+
+- The version-pin guard test partitions every registry tool into pinned /
+  unpinned-by-design / package-manager-tracked, so a tool can't be added or
+  un-pinned without a deliberate decision.
+
 ## [2.9.4] - 2026-06-09
 
 ### Connecting findings + PRs to the people who know the code

package/dist/allowlist/annotate.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Annotate security findings with their active-allowlist status
+ * for REPORTING (not gating).
+ *
+ * The guardrail already consults the allowlist to decide whether a
+ * net-new finding blocks a push (`src/baseline/check.ts`). But the
+ * vulnerability-scan report and dashboard rendered raw counts with no
+ * indication that some findings are reviewed-and-accepted — a repo that
+ * has correctly allowlisted, say, its unit-test fixtures still showed
+ * them as headline criticals with no visual distinction, which reads as
+ * "the score is lying."
+ *
+ * This module marks each finding whose fingerprint matches an ACTIVE
+ * (unexpired) allowlist entry so renderers can show "(N allowlisted)"
+ * beside the subtotal. It does NOT change raw counts and does NOT change
+ * the score — dxkit's raw-truth model is preserved; only the
+ * presentation gains an honesty annotation.
+ *
+ * Identity contract (CLAUDE.md Rule 9): this module never computes a
+ * fingerprint. It matches against the fingerprint the aggregator
+ * already stamped on each code/secret/config finding (plus the
+ * `absorbedFingerprints` recorded when cross-tool dedup collapsed
+ * contributors — same robust-match set the guardrail uses). Dependency
+ * findings are keyed by `(package, version, id)` through a producer and
+ * carry no inline fingerprint, so they are out of scope here.
+ */
+import { type AllowlistFile } from './file';
+import type { AllowlistCategory } from './categories';
+import type { FindingCategory } from '../analyzers/security/types';
+/**
+ * The minimal finding shape this module reads + writes. The runtime
+ * objects are richer (`CodeFinding` carries `fingerprint` +
+ * `absorbedFingerprints`); we accept the structural subset so callers
+ * pass their findings directly without a cast.
+ */
+export interface AnnotatableFinding {
+    readonly category: FindingCategory;
+    readonly fingerprint?: string;
+    readonly absorbedFingerprints?: readonly string[];
+    allowlisted?: boolean;
+    allowlistCategory?: AllowlistCategory;
+}
+/**
+ * Whether an active allowlist entry of this category should LIFT the
+ * finding from the dimension score (penalties + caps), not just from
+ * the guardrail.
+ *
+ * `false-positive` and `test-fixture` declare the finding is "not a real
+ * finding" — a misfire or throwaway test data — so a properly-triaged
+ * repo shouldn't carry a score penalty for it (the failure mode where a
+ * repo stays capped at the trust-broken tier despite having reviewed and
+ * accepted every flagged secret). `accepted-risk` and `deferred`, by
+ * contrast, accept a REAL risk: the guardrail stops blocking on them,
+ * but the score must still reflect the residual exposure — you can't
+ * `accepted-risk` your way to an A. `mitigated-externally` counts too:
+ * the risk is real, just handled outside dxkit.
+ */
+export declare function allowlistLiftsScore(category: AllowlistCategory | undefined): boolean;
+/**
+ * Mutate `findings` in place, setting `allowlisted` + `allowlistCategory`
+ * on each finding matched by an active allowlist entry. Returns the count
+ * of findings annotated, so callers can short-circuit rendering when zero.
+ *
+ * A finding matches when ANY of its candidate fingerprints (its own
+ * `fingerprint`, then any `absorbedFingerprints`) resolves to an
+ * allowlist entry whose `kind` equals the finding's kind and which is
+ * active at `now`. The kind guard rules out a cross-kind hash collision
+ * waiving the wrong finding — mirrors `allowlistSuppressionFor`.
+ */
+export declare function annotateFindingsWithAllowlist(findings: AnnotatableFinding[], allowlist: AllowlistFile | null, now?: Date): number;
+//# sourceMappingURL=annotate.d.ts.map

package/dist/allowlist/annotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotate.d.ts","sourceRoot":"","sources":["../../src/allowlist/annotate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,KAAK,aAAa,EAA4B,MAAM,QAAQ,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAoBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAEpF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,kBAAkB,EAAE,EAC9B,SAAS,EAAE,aAAa,GAAG,IAAI,EAC/B,GAAG,GAAE,IAAiB,GACrB,MAAM,CAuBR"}

package/dist/allowlist/annotate.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowlistLiftsScore = allowlistLiftsScore;
+exports.annotateFindingsWithAllowlist = annotateFindingsWithAllowlist;
+/**
+ * Annotate security findings with their active-allowlist status
+ * for REPORTING (not gating).
+ *
+ * The guardrail already consults the allowlist to decide whether a
+ * net-new finding blocks a push (`src/baseline/check.ts`). But the
+ * vulnerability-scan report and dashboard rendered raw counts with no
+ * indication that some findings are reviewed-and-accepted — a repo that
+ * has correctly allowlisted, say, its unit-test fixtures still showed
+ * them as headline criticals with no visual distinction, which reads as
+ * "the score is lying."
+ *
+ * This module marks each finding whose fingerprint matches an ACTIVE
+ * (unexpired) allowlist entry so renderers can show "(N allowlisted)"
+ * beside the subtotal. It does NOT change raw counts and does NOT change
+ * the score — dxkit's raw-truth model is preserved; only the
+ * presentation gains an honesty annotation.
+ *
+ * Identity contract (CLAUDE.md Rule 9): this module never computes a
+ * fingerprint. It matches against the fingerprint the aggregator
+ * already stamped on each code/secret/config finding (plus the
+ * `absorbedFingerprints` recorded when cross-tool dedup collapsed
+ * contributors — same robust-match set the guardrail uses). Dependency
+ * findings are keyed by `(package, version, id)` through a producer and
+ * carry no inline fingerprint, so they are out of scope here.
+ */
+const file_1 = require("./file");
+/**
+ * Map a report `FindingCategory` to the canonical `IdentityKind` used
+ * by allowlist entries. Only the three fingerprint-bearing categories
+ * resolve; `dependency` returns null (out of scope — see module doc).
+ */
+function kindForCategory(category) {
+    switch (category) {
+        case 'secret':
+            return 'secret';
+        case 'code':
+            return 'code';
+        case 'config':
+            return 'config';
+        case 'dependency':
+            return null;
+    }
+}
+/**
+ * Whether an active allowlist entry of this category should LIFT the
+ * finding from the dimension score (penalties + caps), not just from
+ * the guardrail.
+ *
+ * `false-positive` and `test-fixture` declare the finding is "not a real
+ * finding" — a misfire or throwaway test data — so a properly-triaged
+ * repo shouldn't carry a score penalty for it (the failure mode where a
+ * repo stays capped at the trust-broken tier despite having reviewed and
+ * accepted every flagged secret). `accepted-risk` and `deferred`, by
+ * contrast, accept a REAL risk: the guardrail stops blocking on them,
+ * but the score must still reflect the residual exposure — you can't
+ * `accepted-risk` your way to an A. `mitigated-externally` counts too:
+ * the risk is real, just handled outside dxkit.
+ */
+function allowlistLiftsScore(category) {
+    return category === 'false-positive' || category === 'test-fixture';
+}
+/**
+ * Mutate `findings` in place, setting `allowlisted` + `allowlistCategory`
+ * on each finding matched by an active allowlist entry. Returns the count
+ * of findings annotated, so callers can short-circuit rendering when zero.
+ *
+ * A finding matches when ANY of its candidate fingerprints (its own
+ * `fingerprint`, then any `absorbedFingerprints`) resolves to an
+ * allowlist entry whose `kind` equals the finding's kind and which is
+ * active at `now`. The kind guard rules out a cross-kind hash collision
+ * waiving the wrong finding — mirrors `allowlistSuppressionFor`.
+ */
+function annotateFindingsWithAllowlist(findings, allowlist, now = new Date()) {
+    if (!allowlist || allowlist.entries.length === 0)
+        return 0;
+    let annotated = 0;
+    for (const f of findings) {
+        const kind = kindForCategory(f.category);
+        if (!kind)
+            continue;
+        const candidates = [];
+        if (f.fingerprint)
+            candidates.push(f.fingerprint);
+        if (f.absorbedFingerprints)
+            candidates.push(...f.absorbedFingerprints);
+        for (const fp of candidates) {
+            const entry = (0, file_1.findEntry)(allowlist, fp);
+            if (!entry || entry.kind !== kind)
+                continue;
+            if (!(0, file_1.isEntryActive)(entry, now))
+                continue;
+            f.allowlisted = true;
+            f.allowlistCategory = entry.category;
+            annotated++;
+            break;
+        }
+    }
+    return annotated;
+}
+//# sourceMappingURL=annotate.js.map

package/dist/allowlist/annotate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotate.js","sourceRoot":"","sources":["../../src/allowlist/annotate.ts"],"names":[],"mappings":";;AA8EA,kDAEC;AAaD,sEA2BC;AAxHD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,iCAAsE;AAmBtE;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAyB;IAChD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,mBAAmB,CAAC,QAAuC;IACzE,OAAO,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,cAAc,CAAC;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,6BAA6B,CAC3C,QAA8B,EAC9B,SAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAE3D,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,WAAW;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,oBAAoB;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAEvE,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC5C,IAAI,CAAC,IAAA,oBAAa,EAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,SAAS;YACzC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC,CAAC,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACrC,SAAS,EAAE,CAAC;YACZ,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/allowlist/cli.d.ts

@@ -4,22 +4,22 @@
  *
  * Subcommands (Sprint 1 chunk):
  *
- *   - `add <file>:<line>` — inline annotation insertion. Kind-agnostic;
- *     the annotation grammar carries category + reason only. Refuses
- *     non-inline-compatible categories (accepted-risk / deferred).
+ * - `add <file>:<line>` — inline annotation insertion. Kind-agnostic;
+ * the annotation grammar carries category + reason only. Refuses
+ * non-inline-compatible categories (accepted-risk / deferred).
  *
- *   - `add --fingerprint=<id> --kind=<kind>` — file-level allowlist
- *     entry. Persists to `.dxkit/allowlist.json` (or its sanitized
- *     mode + gitignored reasons sidecar). Required for any
- *     accepted-risk / deferred suppression OR any kind that lacks a
- *     stable single-line attachment point.
+ * - `add --fingerprint=<id> --kind=<kind>` — file-level allowlist
+ * entry. Persists to `.dxkit/allowlist.json` (or its sanitized
+ * mode + gitignored reasons sidecar). Required for any
+ * accepted-risk / deferred suppression OR any kind that lacks a
+ * stable single-line attachment point.
  *
- *   - `list` — print every entry across the file-level allowlist.
- *     Reads only; no mutation. Honors `--json` for structured output.
+ * - `list` — print every entry across the file-level allowlist.
+ * Reads only; no mutation. Honors `--json` for structured output.
  *
- *   - `show <fingerprint>` — print one entry's full detail. Falls
- *     back to a "no entry found" message when the fingerprint isn't
- *     present.
+ * - `show <fingerprint>` — print one entry's full detail. Falls
+ * back to a "no entry found" message when the fingerprint isn't
+ * present.
  *
  * Subcommands `audit` and `prune` land in a follow-up commit.
  *
@@ -39,8 +39,8 @@ export declare const ALLOWLIST_SUBCOMMANDS: readonly ["add", "list", "show", "au
 export type AllowlistSubcommand = (typeof ALLOWLIST_SUBCOMMANDS)[number];
 export interface AllowlistAddOpts {
     /** Positional target. `<file>:<line>` for inline form; absent or a
-     *  bare file path for file-level form (requires `--fingerprint`
-     *  + `--kind`). */
+     * bare file path for file-level form (requires `--fingerprint`
+     * + `--kind`). */
     readonly target?: string;
     readonly category?: string;
     readonly reason?: string;
@@ -50,8 +50,8 @@ export interface AllowlistAddOpts {
     readonly acknowledgedSeverity?: string;
     readonly addedBy?: string;
     /** Override the configured mode for this write only. Default
-     *  reads from `.dxkit/policy.json` (out of scope here; this
-     *  module accepts a flag to choose). */
+     * reads from `.dxkit/policy.json` (out of scope here; this
+     * module accepts a flag to choose). */
     readonly mode?: AllowlistMode;
 }
 export interface AllowlistShowOpts {
@@ -66,9 +66,9 @@ export interface AllowlistAuditOpts {
     /** Soon-to-expire horizon in days (default 14). */
     readonly soonToExpireDays?: number;
     /** Cross-check fingerprints against the committed baseline so the
-     *  audit can flag orphaned entries (suppress nothing in the current
-     *  finding set). Off by default — keeps `audit` a pure read of the
-     *  allowlist file unless the user opts in. */
+     * audit can flag orphaned entries (suppress nothing in the current
+     * finding set). Off by default — keeps `audit` a pure read of the
+     * allowlist file unless the user opts in. */
     readonly againstBaseline?: boolean;
     /** Named baseline to diff against (default `main`). */
     readonly baselineName?: string;
@@ -84,7 +84,7 @@ export interface AllowlistExportOpts {
     readonly out?: string;
     readonly json?: boolean;
     /** ISO datetime stamped as each ignore's `created`. Defaults to now;
-     *  injectable for deterministic tests. */
+     * injectable for deterministic tests. */
     readonly now?: string;
 }
 export interface AllowlistPruneOpts {
@@ -92,8 +92,8 @@ export interface AllowlistPruneOpts {
     /** Don't write; just print what would be removed. */
     readonly dryRun?: boolean;
     /** Skip confirmation prompt + write directly. Default behavior
-     *  in Sprint 1 (no interactive prompts in dxkit yet) — the flag
-     *  is accepted for future-proofing. */
+     * in Sprint 1 (no interactive prompts in dxkit yet) — the flag
+     * is accepted for future-proofing. */
     readonly yes?: boolean;
 }
 /**
@@ -125,6 +125,12 @@ export declare function runAllowlistRemove(cwd: string, opts: AllowlistRemoveOpt
  * reason + expiry. Expired entries are skipped (they no longer
  * suppress). Only `snyk-code` findings export — native semgrep /
  * gitleaks findings have no Snyk equivalent.
+ *
+ * 2.10 also syncs the PATH-EXCLUSION half: `.dxkit-ignore` patterns
+ * (the paths dxkit's own analyzers skip) are emitted into the `.snyk`
+ * `exclude.global` block, so Snyk and dxkit agree on what's out of
+ * scope. The two halves compose into one `.snyk`; an export carrying
+ * only exclusions (no allowlisted Snyk findings yet) still writes.
  */
 export declare function runAllowlistExport(cwd: string, opts: AllowlistExportOpts): Promise<void>;
 export { DEFAULT_EXPIRY_DAYS };

package/dist/allowlist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/allowlist/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAkBH,OAAO,EAEL,mBAAmB,EAMpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAelB,KAAK,aAAa,EAEnB,MAAM,QAAQ,CAAC;AAGhB,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,wEAQxB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;4CAEwC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;kDAG8C;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;8CAC0C;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;2CAEuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE;IACJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAyDf;AAID,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxF;AAyHD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB1F;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B1F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuG5F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC5F;AAID,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B9F;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6E9F;AAoID,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/allowlist/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA6BH,OAAO,EAEL,mBAAmB,EAMpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAelB,KAAK,aAAa,EAEnB,MAAM,QAAQ,CAAC;AAGhB,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,wEAQxB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B;;sBAEkB;IAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;2CAEuC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;iDAG6C;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;6CACyC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;0CAEsC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE;IACJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAyDf;AAID,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxF;AAyHD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB1F;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B1F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuG5F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC5F;AAID,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B9F;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmI9F;AAmJD,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,CAAC"}