audit-tools 0.30.4 → 0.30.5

package/dist/audit/extractors/analyzers/acquisitionEngine.js

@@ -0,0 +1,262 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { runTracked, } from "audit-tools/shared";
+import { normalizeGenericExternalResults, normalizeGenericExternalEdges, } from "../../adapters/normalizeExternal.js";
+/**
+ * F5 — external analyzer acquisition engine.
+ *
+ * On-demand acquisition + ephemeral execution of mature, ecosystem-native
+ * analyzers (eslint, ruff, cargo-clippy, …). Distinct from the in-tree
+ * `LanguageAnalyzer` registry (which enriches the regex floor from a resolved
+ * npm package directory): F5 *runs an external tool as a subprocess* and
+ * normalizes its native output through the EXISTING adapter seam
+ * (`normalizeExternal.ts`) into {@link ExternalAnalyzerResults}, which then
+ * re-enters the graph/risk artifacts through the shared
+ * CCU-analyzer-merge-helper-seam pair.
+ *
+ * Design invariants (all enforced here, never by host discretion):
+ *  - **No baked-in language→tool / OS→runner table.** Ecosystem is detected
+ *    deterministically from repo marker files; the runner (npx/pipx/cargo/bundle)
+ *    is capability-probed at RUNTIME (`--version`) before any tool spawn.
+ *  - **Single subprocess-SPAWN admission chokepoint** (`admitSpawn`): EVERY
+ *    non-DEFAULT candidate is gated on the per-run consent token regardless of
+ *    its `AnalyzerSetting` (auto|ephemeral|permanent) — even a `permanent`,
+ *    pre-installed tool cannot spawn without consent (CE-005). The small
+ *    value-curated DEFAULT set runs without prompting.
+ *  - **Own-vs-acquire boundary.** git-history / secret-scan are OWNED by F6 and
+ *    are rejected at registration — never acquired here.
+ *  - **Run-safety gate written once** (`runSafetyGate`): capability-probe, pin
+ *    version, read-only/sandboxed argv, degrade-to-empty.
+ *  - **Degrade-to-empty + report-skipped-never-silently.** Every candidate
+ *    yields exactly one {@link ExternalAnalyzerToolStatus}; a failure never
+ *    throws and never silently drops the candidate.
+ */
+/** Tool ids OWNED by F6 (git-history mining / secret scanning). Never acquired. */
+export const OWNED_TOOL_IDS = new Set([
+    "git-history",
+    "git-history-mining",
+    "secret-scan",
+    "secret-scanner",
+    "secrets",
+]);
+/** Marker-file ecosystem detection — deterministic, no language→tool table. */
+function hasAnyMarker(root, markers) {
+    return markers.some((m) => existsSync(join(root, m)));
+}
+export function detectNodeEcosystem(root) {
+    return hasAnyMarker(root, ["package.json"]);
+}
+export function detectPythonEcosystem(root) {
+    return hasAnyMarker(root, ["pyproject.toml", "setup.py", "setup.cfg", "requirements.txt"]);
+}
+export function detectRustEcosystem(root) {
+    return hasAnyMarker(root, ["Cargo.toml"]);
+}
+export function detectRubyEcosystem(root) {
+    return hasAnyMarker(root, ["Gemfile"]);
+}
+/**
+ * Map a runner to the capability-probe argv (`--version`) and the argv prefix
+ * used to run a pinned tool ephemerally. No OS→runner assumption is baked in:
+ * the probe is what proves the runner exists on THIS machine.
+ */
+function runnerProbeArgv(runner) {
+    switch (runner) {
+        case "npx": return ["npx", "--version"];
+        case "pipx": return ["pipx", "--version"];
+        case "cargo": return ["cargo", "--version"];
+        case "bundle": return ["bundle", "--version"];
+    }
+}
+function runnerPrefix(runner, spec) {
+    switch (runner) {
+        // `-y` so the ephemeral fetch never blocks on a prompt; pinned spec.
+        case "npx": return ["npx", "-y", spec];
+        case "pipx": return ["pipx", "run", "--spec", spec];
+        case "cargo": return ["cargo", spec];
+        case "bundle": return ["bundle", "exec", spec];
+    }
+}
+/**
+ * Single subprocess-SPAWN admission chokepoint. Returns the reason a spawn is
+ * NOT admitted, or `undefined` when admitted. The DEFAULT set is admitted
+ * without a token; EVERY other candidate — including `permanent`/`ephemeral`
+ * pre-installed tools — requires the per-run consent token (CE-005).
+ */
+export function admitSpawn(candidate, setting, consentToken) {
+    if (setting === "skip")
+        return "setting=skip";
+    if (candidate.defaultRun)
+        return undefined;
+    if (consentToken && consentToken.trim().length > 0)
+        return undefined;
+    return "non-default tool requires per-run consent token";
+}
+/**
+ * The run-safety gate, written once: capability-probe the runner, then (if the
+ * probe passes) the caller may spawn the pinned, read-only argv. Returns the
+ * probe outcome so a missing runner degrades to an empty result + a status.
+ */
+export function runSafetyGate(candidate, run, root) {
+    // Pinned version is mandatory for reproducibility — a candidate without a
+    // pinned tool spec is never executed (degrades to empty + status).
+    if (!candidate.spec || candidate.spec.trim().length === 0) {
+        return { ok: false, reason: `tool '${candidate.id}' has no pinned version spec` };
+    }
+    const probe = run(runnerProbeArgv(candidate.runner), root);
+    if (probe.error || probe.status !== 0) {
+        return {
+            ok: false,
+            reason: `runner '${candidate.runner}' not available: ${probe.error?.message ?? `exit ${probe.status}`}`,
+        };
+    }
+    return { ok: true };
+}
+function emptyResults(tool) {
+    return { tool, generated_at: new Date().toISOString(), results: [] };
+}
+function settingFor(analyzers, id) {
+    return analyzers?.[id] ?? "auto";
+}
+/**
+ * Acquire + run ONE external analyzer candidate ephemerally, normalizing its
+ * output through the adapter seam. Never throws; always returns exactly one
+ * {@link ExternalAnalyzerToolStatus} alongside the (possibly empty) results.
+ */
+export function runExternalAnalyzer(candidate, root, options = {}) {
+    if (OWNED_TOOL_IDS.has(candidate.id)) {
+        // Defence in depth — registration already rejects these.
+        return {
+            results: emptyResults(candidate.id),
+            status: {
+                tool: candidate.id,
+                resolved: false,
+                status: "skipped",
+                error: "owned by F6 (git-history/secret-scan); never acquired",
+            },
+        };
+    }
+    const run = options.run ?? ((argv, cwd) => runTracked(argv, { cwd }));
+    const log = options.log ?? (() => { });
+    const setting = settingFor(options.analyzers, candidate.id);
+    if (!candidate.detect(root)) {
+        return {
+            results: emptyResults(candidate.id),
+            status: { tool: candidate.id, resolved: false, status: "skipped", error: "ecosystem not detected" },
+        };
+    }
+    // Single spawn-admission chokepoint — consent gating before anything spawns.
+    const denied = admitSpawn(candidate, setting, options.consentToken);
+    if (denied) {
+        log("[f5] %s spawn not admitted: %s", candidate.id, denied);
+        return {
+            results: emptyResults(candidate.id),
+            status: { tool: candidate.id, resolved: false, status: "skipped", error: denied },
+        };
+    }
+    // Run-safety gate: capability-probe the runner before the real spawn.
+    const gate = runSafetyGate(candidate, run, root);
+    if (!gate.ok) {
+        log("[f5] %s safety gate failed: %s", candidate.id, gate.reason);
+        return {
+            results: emptyResults(candidate.id),
+            status: { tool: candidate.id, resolved: false, status: "not_resolved", error: gate.reason },
+        };
+    }
+    const argv = candidate.buildArgv(runnerPrefix(candidate.runner, candidate.spec), root);
+    const command = argv.join(" ");
+    let result;
+    try {
+        result = run(argv, root);
+    }
+    catch (error) {
+        return {
+            results: emptyResults(candidate.id),
+            status: {
+                tool: candidate.id,
+                command,
+                resolved: true,
+                status: "spawn_error",
+                error: error instanceof Error ? error.message : String(error),
+            },
+        };
+    }
+    if (result.error) {
+        return {
+            results: emptyResults(candidate.id),
+            status: {
+                tool: candidate.id,
+                command,
+                resolved: true,
+                status: "spawn_error",
+                exit_code: result.status,
+                error: result.error.message,
+            },
+        };
+    }
+    let items;
+    try {
+        items = candidate.parse(result.stdout);
+    }
+    catch (error) {
+        return {
+            results: emptyResults(candidate.id),
+            status: {
+                tool: candidate.id,
+                command,
+                resolved: true,
+                status: "parse_error",
+                exit_code: result.status,
+                error: error instanceof Error ? error.message : String(error),
+                output_snippet: result.stdout.slice(0, 200),
+            },
+        };
+    }
+    const normalized = normalizeGenericExternalResults(candidate.id, items);
+    const edges = normalizeGenericExternalEdges(items);
+    if (edges.length > 0)
+        normalized.graph_edges = edges;
+    return {
+        results: normalized,
+        status: {
+            tool: candidate.id,
+            command,
+            resolved: true,
+            status: normalized.results.length > 0 ? "findings" : "success",
+            exit_code: result.status,
+        },
+    };
+}
+/**
+ * Register external analyzer candidates, rejecting any whose id is OWNED by F6
+ * (git-history/secret-scan). Returns the accepted candidates; the own-vs-acquire
+ * boundary is enforced HERE so an owned tool can never enter the engine.
+ */
+export function registerExternalAnalyzers(candidates) {
+    const accepted = [];
+    for (const candidate of candidates) {
+        if (OWNED_TOOL_IDS.has(candidate.id))
+            continue;
+        accepted.push(candidate);
+    }
+    return accepted;
+}
+/**
+ * Drive the whole registered candidate set through the engine for one repo,
+ * collecting one status per candidate. Owned tools are rejected at registration;
+ * each survivor passes through the spawn-admission chokepoint and run-safety gate.
+ */
+export function runAcquisitionEngine(candidates, root, options = {}) {
+    const registered = registerExternalAnalyzers(candidates);
+    const results = [];
+    const statuses = [];
+    for (const candidate of registered) {
+        const outcome = runExternalAnalyzer(candidate, root, options);
+        statuses.push(outcome.status);
+        if (outcome.results.results.length > 0 || outcome.results.graph_edges?.length) {
+            results.push(outcome.results);
+        }
+    }
+    return { results, statuses };
+}
+//# sourceMappingURL=acquisitionEngine.js.map

package/dist/audit/extractors/analyzers/acquisitionEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquisitionEngine.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/acquisitionEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,GAGX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAM7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IAC5C,aAAa;IACb,oBAAoB;IACpB,aAAa;IACb,gBAAgB;IAChB,SAAS;CACV,CAAC,CAAC;AA6CH,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAY,EAAE,OAAiB;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAuB;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAuB,EAAE,IAAY;IACzD,QAAQ,MAAM,EAAE,CAAC;QACf,qEAAqE;QACrE,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,OAAwB,EACxB,YAAgC;IAEhC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAC9C,IAAI,SAAS,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,iDAAiD,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAoC,EACpC,GAAsB,EACtB,IAAY;IAEZ,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,8BAA8B,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW,SAAS,CAAC,MAAM,oBACjC,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,KAAK,CAAC,MAAM,EAC9C,EAAE;SACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CACjB,SAAsD,EACtD,EAAU;IAEV,OAAO,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAoC,EACpC,IAAY,EACZ,UAAoC,EAAE;IAEtC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,yDAAyD;QACzD,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,uDAAuD;aAC/D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;SACpG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;SAC5F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,+BAA+B,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC,EAAE;YAClB,OAAO;YACP,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC9D,SAAS,EAAE,MAAM,CAAC,MAAM;SACzB;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAuC;IAEvC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAuC,EACvC,IAAY,EACZ,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/audit/extractors/analyzers/registry.d.ts

@@ -9,6 +9,8 @@ import type { AnalyzerPlanEntry, LanguageAnalyzer } from "./types.js";
  */
 export declare const ANALYZER_REGISTRY: LanguageAnalyzer[];
 export declare function getAnalyzerById(id: string): LanguageAnalyzer | undefined;
+export { OWNED_TOOL_IDS, admitSpawn, runSafetyGate, runExternalAnalyzer, registerExternalAnalyzers, runAcquisitionEngine, detectNodeEcosystem, detectPythonEcosystem, detectRustEcosystem, detectRubyEcosystem, } from "./acquisitionEngine.js";
+export type { EcosystemRunner, ExternalAnalyzerCandidate, AcquisitionRunner, AcquisitionEngineOptions, AcquisitionOutcome, RunAllOutcome, } from "./acquisitionEngine.js";
 /**
  * Deterministically resolve, without installing anything, how each registered
  * analyzer would run for this repo. The conversation-first CLI uses this to

package/dist/audit/extractors/analyzers/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAOtE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,gBAAgB,EAM/C,CAAC;AAEF,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAExE;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,EACtD,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,iBAAiB,EAAE,CAyBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAEtE"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAOtE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,gBAAgB,EAM/C,CAAC;AAEF,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAExE;AAMD,OAAO,EACL,cAAc,EACd,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,aAAa,GACd,MAAM,wBAAwB,CAAC;AA2BhC;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,EACtD,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,iBAAiB,EAAE,CAyBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAEtE"}

package/dist/audit/extractors/analyzers/registry.js

@@ -21,6 +21,11 @@ export const ANALYZER_REGISTRY = [
 export function getAnalyzerById(id) {
     return ANALYZER_REGISTRY.find((analyzer) => analyzer.id === id);
 }
+// F5 external analyzer acquisition engine (on-demand ecosystem-native tools run
+// ephemerally + normalized through the adapter seam). Re-exported here so the
+// analyzer registry is the single entry point for both the in-tree
+// `LanguageAnalyzer` set and the acquired external set.
+export { OWNED_TOOL_IDS, admitSpawn, runSafetyGate, runExternalAnalyzer, registerExternalAnalyzers, runAcquisitionEngine, detectNodeEcosystem, detectPythonEcosystem, detectRustEcosystem, detectRubyEcosystem, } from "./acquisitionEngine.js";
 function settingFor(analyzers, id) {
     return analyzers?.[id] ?? "auto";
 }

package/dist/audit/extractors/analyzers/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAuB;IACnD,kBAAkB;IAClB,cAAc;IACd,YAAY;IACZ,WAAW;IACX,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CACjB,SAAsD,EACtD,EAAU;IAEV,OAAO,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAChB,QAA0B,EAC1B,OAAwB,EACxB,cAAsB,EACtB,UAA2C,EAC3C,IAAa;IAEb,MAAM,KAAK,GAAsB;QAC/B,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;QACP,UAAU;QACV,cAAc;KACf,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,SAAsD,EACtD,aAAuB,EACvB,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CACxB,CAAC,MAAM,CAAC;QAET,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACzB,4CAA4C;YAC5C,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC;AACnE,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAuB;IACnD,kBAAkB;IAClB,cAAc;IACd,YAAY;IACZ,WAAW;IACX,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,mEAAmE;AACnE,wDAAwD;AACxD,OAAO,EACL,cAAc,EACd,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAUhC,SAAS,UAAU,CACjB,SAAsD,EACtD,EAAU;IAEV,OAAO,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAChB,QAA0B,EAC1B,OAAwB,EACxB,cAAsB,EACtB,UAA2C,EAC3C,IAAa;IAEb,MAAM,KAAK,GAAsB;QAC/B,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;QACP,UAAU;QACV,cAAc;KACf,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,SAAsD,EACtD,aAAuB,EACvB,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CACxB,CAAC,MAAM,CAAC;QAET,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACzB,4CAA4C;YAC5C,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC;AACnE,CAAC"}

package/dist/audit/extractors/gitHistory.d.ts

@@ -0,0 +1,46 @@
+import type { GitHistory, GraphEdge, RiskRegister, RiskItem } from "audit-tools/shared";
+import type { RepoManifest, UnitManifest } from "../types.js";
+import type { FileDisposition } from "audit-tools/shared";
+/**
+ * F6 — git-history mining.
+ *
+ * Deterministic extractor that turns the repository's commit log into the
+ * language-neutral `git_history.json` artifact: co-change (temporal coupling),
+ * churn (change frequency), and authorship breadth (bus-factor). All mining
+ * runs through `audit-tools/shared`'s `mineGitHistory`, which itself degrades to
+ * empty when git is unavailable / the log fails — so this extractor never
+ * throws and is safe to run on any tree (including a fresh, history-less repo).
+ *
+ * Declared upstream deps: `{repo_manifest, file_disposition}`. Both are used to
+ * scope mined paths to the audited file set (excluded / non-manifest paths are
+ * dropped) so downstream consumers see only in-scope signals.
+ */
+declare const GIT_CO_CHANGE_EDGE_KIND = "git-co-change";
+/**
+ * Mine `git_history.json` for `root`, keeping only paths present (and not
+ * audit-excluded) in the manifest/disposition. Output is deterministic: the
+ * shared miner already sorts every list by a total order, and the in-scope
+ * filter preserves that order.
+ */
+export declare function mineGitHistoryArtifact(root: string, repoManifest: RepoManifest, disposition?: FileDisposition): GitHistory;
+/**
+ * Project mined co-change pairs into language-neutral, undirected graph edges
+ * suitable for merging into the graph bundle via
+ * `mergeAnalyzerGraphContribution`. Confidence scales with co-change count
+ * (more shared commits → stronger coupling) up to a cap. Degrades to an empty
+ * list when there is no co-change history.
+ */
+export declare function gitHistoryGraphEdges(history: GitHistory): GraphEdge[];
+/**
+ * Derive per-unit git-history risk signals (`change_hotspot`, `broad_authorship`)
+ * keyed by `unit_id`, suitable for merging into the risk register via
+ * `mergeAnalyzerRiskSignals`. A unit inherits a signal when ANY of its files is
+ * so flagged. These are informational signals (they widen the picture, they do
+ * not by themselves saturate risk). Degrades to empty when history is empty.
+ */
+export declare function gitHistoryRiskSignals(history: GitHistory, unitManifest: UnitManifest): Map<string, string[]>;
+export type { GitHistory } from "audit-tools/shared";
+export { GIT_CO_CHANGE_EDGE_KIND };
+export type RiskRegisterForMerge = RiskRegister;
+export type RiskItemForMerge = RiskItem;
+//# sourceMappingURL=gitHistory.d.ts.map

package/dist/audit/extractors/gitHistory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitHistory.d.ts","sourceRoot":"","sources":["../../../src/audit/extractors/gitHistory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,UAAU,EACV,SAAS,EACT,YAAY,EACZ,QAAQ,EACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAI1D;;;;;;;;;;;;;GAaG;AAEH,QAAA,MAAM,uBAAuB,kBAAkB,CAAC;AAchD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,YAAY,EAC1B,WAAW,CAAC,EAAE,eAAe,GAC5B,UAAU,CAoBZ;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,EAAE,CAcrE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,YAAY,GACzB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAuBvB;AAED,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,CAAC;AACnC,MAAM,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAChD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC"}

package/dist/audit/extractors/gitHistory.js

@@ -0,0 +1,97 @@
+import { mineGitHistory } from "audit-tools/shared";
+import { buildDispositionMap, isAuditExcludedStatus } from "./disposition.js";
+import { graphEdge, graphLookupKey } from "./graphPathUtils.js";
+/**
+ * F6 — git-history mining.
+ *
+ * Deterministic extractor that turns the repository's commit log into the
+ * language-neutral `git_history.json` artifact: co-change (temporal coupling),
+ * churn (change frequency), and authorship breadth (bus-factor). All mining
+ * runs through `audit-tools/shared`'s `mineGitHistory`, which itself degrades to
+ * empty when git is unavailable / the log fails — so this extractor never
+ * throws and is safe to run on any tree (including a fresh, history-less repo).
+ *
+ * Declared upstream deps: `{repo_manifest, file_disposition}`. Both are used to
+ * scope mined paths to the audited file set (excluded / non-manifest paths are
+ * dropped) so downstream consumers see only in-scope signals.
+ */
+const GIT_CO_CHANGE_EDGE_KIND = "git-co-change";
+/**
+ * Co-change is a soft, historical signal (files that *happened* to change
+ * together) — deliberately below the structural reference confidences so it
+ * never outweighs a resolved import/reference edge.
+ */
+const CO_CHANGE_BASE_CONFIDENCE = 0.4;
+const CO_CHANGE_CONFIDENCE_CAP = 0.75;
+/** Authorship floor at/above which a unit is flagged broadly-owned. */
+const BROAD_AUTHORSHIP_FLOOR = 4;
+/** Churn floor at/above which a unit is flagged a change hotspot. */
+const CHURN_HOTSPOT_FLOOR = 8;
+/**
+ * Mine `git_history.json` for `root`, keeping only paths present (and not
+ * audit-excluded) in the manifest/disposition. Output is deterministic: the
+ * shared miner already sorts every list by a total order, and the in-scope
+ * filter preserves that order.
+ */
+export function mineGitHistoryArtifact(root, repoManifest, disposition) {
+    const history = mineGitHistory(root);
+    const dispositionMap = buildDispositionMap(disposition);
+    const inScope = new Set();
+    for (const file of repoManifest.files) {
+        if (file.excluded)
+            continue;
+        const status = dispositionMap.get(file.path);
+        if (status && isAuditExcludedStatus(status))
+            continue;
+        inScope.add(graphLookupKey(file.path));
+    }
+    const known = (path) => inScope.has(graphLookupKey(path));
+    return {
+        co_change: history.co_change.filter((pair) => known(pair.a) && known(pair.b)),
+        churn: history.churn.filter((entry) => known(entry.path)),
+        authorship: history.authorship.filter((entry) => known(entry.path)),
+    };
+}
+/**
+ * Project mined co-change pairs into language-neutral, undirected graph edges
+ * suitable for merging into the graph bundle via
+ * `mergeAnalyzerGraphContribution`. Confidence scales with co-change count
+ * (more shared commits → stronger coupling) up to a cap. Degrades to an empty
+ * list when there is no co-change history.
+ */
+export function gitHistoryGraphEdges(history) {
+    return history.co_change.map((pair) => graphEdge({
+        from: pair.a,
+        to: pair.b,
+        kind: GIT_CO_CHANGE_EDGE_KIND,
+        direction: "undirected",
+        confidence: Math.min(CO_CHANGE_CONFIDENCE_CAP, CO_CHANGE_BASE_CONFIDENCE + 0.05 * (pair.commits - 1)),
+        reason: `Files changed together in ${pair.commits} commit(s) (temporal coupling).`,
+    }));
+}
+/**
+ * Derive per-unit git-history risk signals (`change_hotspot`, `broad_authorship`)
+ * keyed by `unit_id`, suitable for merging into the risk register via
+ * `mergeAnalyzerRiskSignals`. A unit inherits a signal when ANY of its files is
+ * so flagged. These are informational signals (they widen the picture, they do
+ * not by themselves saturate risk). Degrades to empty when history is empty.
+ */
+export function gitHistoryRiskSignals(history, unitManifest) {
+    const churnByPath = new Map(history.churn.map((e) => [e.path, e.commits]));
+    const authorsByPath = new Map(history.authorship.map((e) => [e.path, e.authors]));
+    const signalsByUnit = new Map();
+    for (const unit of unitManifest.units) {
+        const signals = [];
+        if (unit.files.some((path) => (churnByPath.get(path) ?? 0) >= CHURN_HOTSPOT_FLOOR)) {
+            signals.push("change_hotspot");
+        }
+        if (unit.files.some((path) => (authorsByPath.get(path) ?? 0) >= BROAD_AUTHORSHIP_FLOOR)) {
+            signals.push("broad_authorship");
+        }
+        if (signals.length > 0)
+            signalsByUnit.set(unit.unit_id, signals);
+    }
+    return signalsByUnit;
+}
+export { GIT_CO_CHANGE_EDGE_KIND };
+//# sourceMappingURL=gitHistory.js.map

package/dist/audit/extractors/gitHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitHistory.js","sourceRoot":"","sources":["../../../src/audit/extractors/gitHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AASpD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AAEH,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAChD;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,YAA0B,EAC1B,WAA6B;IAE7B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC;YAAE,SAAS;QACtD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3E,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CACzC;QACD,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAmB;IACtD,OAAO,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpC,SAAS,CAAC;QACR,IAAI,EAAE,IAAI,CAAC,CAAC;QACZ,EAAE,EAAE,IAAI,CAAC,CAAC;QACV,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,IAAI,CAAC,GAAG,CAClB,wBAAwB,EACxB,yBAAyB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CACtD;QACD,MAAM,EAAE,6BAA6B,IAAI,CAAC,OAAO,iCAAiC;KACnF,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAmB,EACnB,YAA0B;IAE1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CACnD,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IACE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAC9E,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjC,CAAC;QACD,IACE,IAAI,CAAC,KAAK,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,sBAAsB,CACnE,EACD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAGD,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/audit/extractors/graph.d.ts

@@ -1,5 +1,5 @@
 import type { RepoManifest } from "../types.js";
-import type { FileDisposition, GraphBundle } from "audit-tools/shared";
+import type { FileDisposition, GraphBundle, GraphEdge } from "audit-tools/shared";
 import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
 export interface BuildGraphBundleOptions {
     fileContents?: Record<string, string>;
@@ -7,5 +7,23 @@ export interface BuildGraphBundleOptions {
 }
 export declare function buildPathLookup(repoManifest: RepoManifest, dispositionMap: Map<string, FileDisposition["files"][number]["status"]>): Map<string, string>;
 export declare function buildGraphBundleFromFs(repoManifest: RepoManifest, root: string, disposition?: FileDisposition, options?: Pick<BuildGraphBundleOptions, "externalAnalyzerResults">): Promise<GraphBundle>;
+/**
+ * CCU-analyzer-merge-helper-seam (graph half).
+ *
+ * Append an analyzer's contributed edges into a graph bundle's edge categories,
+ * returning a NEW bundle (the input is never mutated). This is the single,
+ * pre-shipped seam through which any post-build analyzer contribution —
+ * git-history co-change (F6), and any later F5+ analyzer — re-enters the graph,
+ * so contributions can never drift in how they merge.
+ *
+ * Merged into `graphs.references` by default (the open-ended cross-file edge
+ * category) under one `category` key, then deduped + sorted by the same
+ * `uniqueSortedEdges` the build uses, so the result is deterministic and an edge
+ * already present (same from/to/kind) is idempotent. Degrades to the original
+ * bundle (structurally cloned) when `edges` is empty / not an array.
+ */
+export declare function mergeAnalyzerGraphContribution(bundle: GraphBundle, edges: GraphEdge[] | undefined, options?: {
+    category?: string;
+}): GraphBundle;
 export declare function buildGraphBundle(repoManifest: RepoManifest, disposition?: FileDisposition, options?: BuildGraphBundleOptions): GraphBundle;
 //# sourceMappingURL=graph.d.ts.map

package/dist/audit/extractors/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/audit/extractors/graph.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EACV,eAAe,EACf,WAAW,EAIZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAgD5E,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD;AAmED,wBAAgB,eAAe,CAC7B,YAAY,EAAE,YAAY,EAC1B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,GACtE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CASrB;AAmTD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,eAAe,EAC7B,OAAO,GAAE,IAAI,CAAC,uBAAuB,EAAE,yBAAyB,CAAM,GACrE,OAAO,CAAC,WAAW,CAAC,CA4CtB;AAsND,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,YAAY,EAC1B,WAAW,CAAC,EAAE,eAAe,EAC7B,OAAO,GAAE,uBAA4B,GACpC,WAAW,CA8Db"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/audit/extractors/graph.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EACV,eAAe,EACf,WAAW,EACX,SAAS,EAGV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAgD5E,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD;AAmED,wBAAgB,eAAe,CAC7B,YAAY,EAAE,YAAY,EAC1B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,GACtE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CASrB;AAmTD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,eAAe,EAC7B,OAAO,GAAE,IAAI,CAAC,uBAAuB,EAAE,yBAAyB,CAAM,GACrE,OAAO,CAAC,WAAW,CAAC,CA4CtB;AAsND;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,WAAW,CAeb;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,YAAY,EAC1B,WAAW,CAAC,EAAE,eAAe,EAC7B,OAAO,GAAE,uBAA4B,GACpC,WAAW,CA8Db"}

package/dist/audit/extractors/graph.js

@@ -474,6 +474,37 @@ function accumulateCrossFileEdges(acc, pathLookup, options) {
     acc.references.push(...extractPytestConftestLinks(pathLookup));
     acc.references.push(...extractBoundedSuiteEdges(pathLookup, options.fileContents ?? {}, acc.references));
 }
+/**
+ * CCU-analyzer-merge-helper-seam (graph half).
+ *
+ * Append an analyzer's contributed edges into a graph bundle's edge categories,
+ * returning a NEW bundle (the input is never mutated). This is the single,
+ * pre-shipped seam through which any post-build analyzer contribution —
+ * git-history co-change (F6), and any later F5+ analyzer — re-enters the graph,
+ * so contributions can never drift in how they merge.
+ *
+ * Merged into `graphs.references` by default (the open-ended cross-file edge
+ * category) under one `category` key, then deduped + sorted by the same
+ * `uniqueSortedEdges` the build uses, so the result is deterministic and an edge
+ * already present (same from/to/kind) is idempotent. Degrades to the original
+ * bundle (structurally cloned) when `edges` is empty / not an array.
+ */
+export function mergeAnalyzerGraphContribution(bundle, edges, options = {}) {
+    const category = options.category ?? "references";
+    const existing = bundle.graphs;
+    const existingEdges = Array.isArray(existing[category])
+        ? existing[category]
+        : [];
+    const contributed = Array.isArray(edges) ? edges : [];
+    const merged = uniqueSortedEdges([...existingEdges, ...contributed]);
+    return {
+        ...bundle,
+        graphs: {
+            ...bundle.graphs,
+            [category]: merged,
+        },
+    };
+}
 export function buildGraphBundle(repoManifest, disposition, options = {}) {
     const acc = {
         imports: [],