fix: anchor exclusion regex patterns (empty CPG on jssrc2cpg); bump Joern to v4.0.581

[Lekssays]

Summary

Fixes #23. The default cpg.exclusion_patterns were written assuming --exclude-regex is full-matched against a path. That holds for the JVM-native frontends (c2cpg, javasrc2cpg, pysrc2cpg — Scala Regex.matches against the relative path) but not for astgen frontends like jssrc2cpg, which apply the same string via plain RegExp.test() — an unanchored substring search — against the file's absolute path.

Under substring search a bare token such as \..* degenerates into "any path containing a .", so index.js (and effectively every real source file) was silently excluded, yielding a completely empty CPG that codebadger's own load-verification then flagged as broken (0 user-defined methods).

Fix

Anchor every token with a leading (?:^|.*/) boundary (start-of-string or a literal /), collapsing the old .*/X + bare-X pairs into one entry each:

# before
- ".*/\\..*"
- "\\..*"
- ".*/test.*"
- "test.*"
# after
- "(?:^|.*/)\\..*"
- "(?:^|.*/)test.*"

This matches a whole path component under both regimes. It is a no-op for the JVM frontends and additionally closes a pre-existing gap where root-level dirs (e.g. vendor/, tmp/, docs/) weren't matched because the bare .*/ prefix required a leading path segment.

Applied to both sources of the defaults: src/defaults.py (EXCLUSION_PATTERNS) and config.example.yaml (cpg.exclusion_patterns). Also aligned config.example.yaml's doc? → docs? with src/defaults.py.

The consumers (cpg_generator._escape_regex_pattern, core_tools) only validate that each pattern compiles and pass it through joined with |; (?:^|.*/) is valid regex, so it is preserved intact.

Also

• Bump JOERN_VERSION 4.0.555 → 4.0.581 in Dockerfile (image rebuilt).

Verification

Simulated both regimes (JVM fullmatch on relative paths, astgen search on absolute paths):

• Kept: index.js, src/math.js, latest.js, attestation.go, main.c, README_index.js
• Dropped (both regimes): .git/, test/, src/test/, node_modules/, vendor/, spec.js, docs/, build/out/, tmp/

Existing tests/test_cpg_generator.py (13 tests) still pass.

🤖 Generated with Claude Code