@0xcraft/powershot 1.1.4 → 1.2.0

package/dist/plan.js

@@ -92,6 +92,31 @@ export class SelectionPlan {
     keep(changed) {
         return changed.filter((c) => this.rows.get(c.path)?.disposition === 'selected');
     }
+    /**
+     * Finish the file-level selection after parsers have had one chance to load it.
+     *
+     * Review and delegation both promise to describe the same change. Keeping this
+     * transition on the plan prevents either caller from silently inventing its own
+     * meaning for a deleted, unsupported, or unavailable source file.
+     */
+    accountForGround(changed, ground) {
+        const grounded = new Set([
+            ...ground.files.map((file) => file.changed.path),
+            ...ground.foreign.map((file) => file.path),
+        ]);
+        for (const file of changed) {
+            if (file.deleted) {
+                this.waive(file.path, 'deleted file has no current source to review');
+                continue;
+            }
+            if (grounded.has(file.path))
+                continue;
+            if (packFor(file.path))
+                this.fail(file.path, 'declared language parser unavailable');
+            else
+                this.waive(file.path, 'no parser for this language');
+        }
+    }
     items() {
         return [...this.rows.values()];
     }

package/dist/reinvention.js

@@ -3,6 +3,68 @@ import { existsSync, readdirSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { Node, ts, } from 'ts-morph';
 import { insideRepo, repoPath } from './fspolicy.js';
+/**
+ * Compiler-resolved exports plus direct syntax exports.
+ *
+ * ts-morph's export map can be empty for JavaScript source even when the parser sees
+ * an `export` modifier. The syntax fallback keeps JS at the same evidence level as
+ * TypeScript without treating an unexported helper as reusable across files.
+ */
+export function exportedDeclarations(source) {
+    const out = [];
+    const seen = new Set();
+    const add = (name, node) => {
+        if (!name || !node)
+            return;
+        const key = [
+            name,
+            node.getSourceFile().getFilePath(),
+            node.getKind(),
+            node.getStart(),
+            node.getEnd(),
+        ].join('\u0000');
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        out.push({ name, node });
+    };
+    for (const [name, declarations] of source.getExportedDeclarations()) {
+        for (const declaration of declarations)
+            add(name, declaration);
+    }
+    const locals = new Map();
+    const addLocal = (name, node) => {
+        if (!name)
+            return;
+        const declarations = locals.get(name) ?? [];
+        declarations.push(node);
+        locals.set(name, declarations);
+    };
+    for (const declaration of source.getFunctions())
+        addLocal(declaration.getName(), declaration);
+    for (const declaration of source.getVariableDeclarations())
+        addLocal(declaration.getName(), declaration);
+    for (const declaration of source.getClasses())
+        addLocal(declaration.getName(), declaration);
+    for (const declaration of source.getExportDeclarations()) {
+        if (declaration.getModuleSpecifier())
+            continue;
+        for (const specifier of declaration.getNamedExports()) {
+            const exportedName = specifier.getAliasNode()?.getText() ?? specifier.getName();
+            for (const local of locals.get(specifier.getName()) ?? [])
+                add(exportedName, local);
+        }
+    }
+    for (const declaration of source.getFunctions()) {
+        if (declaration.hasExportKeyword())
+            add(declaration.getName(), declaration);
+    }
+    for (const declaration of source.getVariableDeclarations()) {
+        if (declaration.getVariableStatement()?.hasExportKeyword())
+            add(declaration.getName(), declaration);
+    }
+    return out;
+}
 const SCOPE_FILES = [
     'package.json',
     'pyproject.toml', 'setup.py', 'setup.cfg',
@@ -64,6 +126,139 @@ function callable(node) {
     const init = node.getInitializer();
     return init && (Node.isArrowFunction(init) || Node.isFunctionExpression(init)) ? init : undefined;
 }
+function identifierTexts(source) {
+    const identifiers = new Set();
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, true, ts.LanguageVariant.JSX, source);
+    let token = scanner.scan();
+    for (let count = 0; token !== ts.SyntaxKind.EndOfFileToken && count < 100_000; count++) {
+        if (token === ts.SyntaxKind.Identifier)
+            identifiers.add(scanner.getTokenText());
+        token = scanner.scan();
+    }
+    return identifiers;
+}
+/** Comments whose contents change TypeScript/JavaScript binding or compilation. */
+function semanticDirectives(source) {
+    const directives = [];
+    for (const [index, line] of source.split(/\r?\n/).entries()) {
+        const text = line.trim();
+        if (text.startsWith('#!') ||
+            /^\/\/\/\s*<reference\b/.test(text) ||
+            /^\/\/\s*@(ts-check|ts-nocheck|jsx\w*)\b/.test(text))
+            directives.push(String(index + 1) + ':' + text);
+    }
+    return directives;
+}
+function contains(container, target) {
+    return container.getSourceFile() === target.getSourceFile() &&
+        container.getStart() <= target.getStart() &&
+        container.getEnd() >= target.getEnd();
+}
+const BINDING_INDEX = new WeakMap();
+const IDENTIFIERS = new WeakMap();
+const BINDING_CONTEXT = new WeakMap();
+const TYPESCRIPT_FINGERPRINT = new WeakMap();
+function identifiersOf(node) {
+    const known = IDENTIFIERS.get(node);
+    if (known)
+        return known;
+    const identifiers = identifierTexts(node.getText());
+    IDENTIFIERS.set(node, identifiers);
+    return identifiers;
+}
+/** Build the file's binding index once, however many exported aliases inspect it. */
+function bindingIndex(source) {
+    const known = BINDING_INDEX.get(source);
+    if (known)
+        return known;
+    const imports = [];
+    const byName = new Map();
+    const add = (names, node) => {
+        const binding = { names, node };
+        for (const name of names) {
+            const bindings = byName.get(name) ?? [];
+            bindings.push(binding);
+            byName.set(name, bindings);
+        }
+    };
+    const named = (name, node) => {
+        if (name)
+            add([name], node);
+    };
+    for (const statement of source.getStatements()) {
+        if (Node.isImportDeclaration(statement) || Node.isImportEqualsDeclaration(statement)) {
+            imports.push(statement);
+        }
+        else if (Node.isFunctionDeclaration(statement) ||
+            Node.isClassDeclaration(statement) ||
+            Node.isInterfaceDeclaration(statement) ||
+            Node.isTypeAliasDeclaration(statement) ||
+            Node.isEnumDeclaration(statement) ||
+            Node.isModuleDeclaration(statement)) {
+            named(statement.getName(), statement);
+        }
+        else if (Node.isVariableStatement(statement)) {
+            for (const declaration of statement.getDeclarations()) {
+                const nameNode = declaration.getNameNode();
+                const names = Node.isIdentifier(nameNode)
+                    ? [nameNode.getText()]
+                    : nameNode.getDescendantsOfKind(ts.SyntaxKind.Identifier).map((identifier) => identifier.getText());
+                add(names, declaration);
+            }
+        }
+    }
+    const index = { imports, byName };
+    BINDING_INDEX.set(source, index);
+    return index;
+}
+function normalizedDirectory(path) {
+    return dirname(path.replaceAll('\\', '/'));
+}
+function hasRelativeModuleReference(nodes) {
+    for (const node of nodes) {
+        if (/(?:\bfrom\s*|\bimport\s*\(|\brequire\s*\()\s*["']\.\.?\//.test(node.getText()) ||
+            (Node.isImportDeclaration(node) && node.getModuleSpecifierValue().startsWith('.')))
+            return true;
+    }
+    return false;
+}
+/** Imports plus only the transitive top-level bindings named by a callable. */
+function bindingContext(target, bindingPath) {
+    const cache = BINDING_CONTEXT.get(target) ?? new Map();
+    BINDING_CONTEXT.set(target, cache);
+    const known = cache.get(bindingPath);
+    if (known !== undefined)
+        return known;
+    const index = bindingIndex(target.getSourceFile());
+    const selected = new Set(index.imports);
+    const pending = [...identifiersOf(target)];
+    const visitedNames = new Set();
+    while (pending.length > 0) {
+        const name = pending.pop();
+        if (visitedNames.has(name))
+            continue;
+        visitedNames.add(name);
+        for (const binding of index.byName.get(name) ?? []) {
+            if (selected.has(binding.node) || contains(binding.node, target))
+                continue;
+            selected.add(binding.node);
+            for (const identifier of identifiersOf(binding.node)) {
+                if (!visitedNames.has(identifier))
+                    pending.push(identifier);
+            }
+        }
+    }
+    const ordered = [...selected]
+        .sort((left, right) => left.getStart() - right.getStart());
+    const bindingDirectory = hasRelativeModuleReference([...ordered, target])
+        ? 'const __powershot_binding_directory__ = ' + JSON.stringify(normalizedDirectory(bindingPath))
+        : '';
+    const directives = semanticDirectives(target.getSourceFile().getFullText())
+        .map((directive) => 'const __powershot_directive__ = ' + JSON.stringify(directive));
+    const context = [bindingDirectory, ...directives, ...ordered.map((node) => node.getText())].join('\n');
+    cache.set(bindingPath, context);
+    return context;
+}
 /**
  * Exact program tokens for a callable, excluding its export modifier and declared
  * name. Layout and comments may differ; parameters, types, operators, callees and
@@ -71,13 +266,21 @@ function callable(node) {
  * candidate, but only equivalent executable text is deterministic evidence that a
  * helper was reimplemented.
  */
-export function typescriptImplementationFingerprint(node) {
+export function typescriptImplementationFingerprint(node, bindingPath = node.getSourceFile().getFilePath()) {
+    const cache = TYPESCRIPT_FINGERPRINT.get(node) ?? new Map();
+    TYPESCRIPT_FINGERPRINT.set(node, cache);
+    const known = cache.get(bindingPath);
+    if (known !== undefined)
+        return known ?? undefined;
     const fn = callable(node);
     const body = fn?.getBody();
-    if (!fn || !body)
+    if (!fn || !body) {
+        cache.set(bindingPath, null);
         return undefined;
+    }
     const generator = !Node.isArrowFunction(fn) && fn.isGenerator();
     const source = [
+        bindingContext(node, bindingPath),
         fn.isAsync() ? 'async' : 'sync',
         generator ? 'generator' : 'plain',
         '<' + fn.getTypeParameters().map((parameter) => parameter.getText()).join(',') + '>',
@@ -85,6 +288,12 @@ export function typescriptImplementationFingerprint(node) {
         ':' + (fn.getReturnTypeNode()?.getText() ?? ''),
         body.getText(),
     ].join('\n');
+    const fingerprint = typescriptTokenFingerprint(source);
+    cache.set(bindingPath, fingerprint ?? null);
+    return fingerprint;
+}
+/** Exact TypeScript/JavaScript program tokens, excluding layout and comments. */
+export function typescriptTokenFingerprint(source) {
     const scanner = ts.createScanner(ts.ScriptTarget.Latest, true, ts.LanguageVariant.JSX, source);
     const tokens = [];
     let token = scanner.scan();
@@ -98,6 +307,22 @@ export function typescriptImplementationFingerprint(node) {
         return undefined;
     return implementationFingerprint(tokens);
 }
+/** Program tokens plus the otherwise-comment-shaped directives a compiler consumes. */
+export function typescriptSourceFingerprint(source) {
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, true, ts.LanguageVariant.JSX, source);
+    const tokens = [];
+    let token = scanner.scan();
+    for (let count = 0; token !== ts.SyntaxKind.EndOfFileToken && count < 100_000; count++) {
+        tokens.push({ type: token, text: scanner.getTokenText() });
+        token = scanner.scan();
+    }
+    if (token !== ts.SyntaxKind.EndOfFileToken)
+        return undefined;
+    for (const directive of semanticDirectives(source)) {
+        tokens.push({ type: '__semantic_directive__', text: directive });
+    }
+    return implementationFingerprint(tokens);
+}
 /** Stable hash of compiler-visible tokens; comments and layout never enter it. */
 export function implementationFingerprint(tokens) {
     const hash = createHash('sha256');

package/dist/report/sarif.js

@@ -10,8 +10,8 @@ function level(severity) {
 const DESCRIPTIONS = {
     'phantom-api': 'Calls an API that does not exist — hallucinated method, property, or arity',
     'phantom-dep': 'Imports a package that is not a declared dependency',
-    reinvented: 'Adds a callable whose token-identical implementation already existed in the same package',
-    'dropped-guard': 'A guard present before the change is gone after it',
+    reinvented: 'Adds a cross-file declaration matching an existing declaration by implementation, package, visibility, wrapper, and binding context',
+    'dropped-guard': 'Deletes an early-exit guard while every other token in the file and changed source set remains unchanged',
     'swallowed-error': 'Error handling that discards the failure',
     'vacuous-test': 'A test that asserts nothing, or mocks the unit under test',
     'assertion-drift': 'An expected value edited to match new output',

package/dist/report/summary.js

@@ -73,6 +73,7 @@ export function summarizeRun(record) {
         filesReviewed: hasFiles
             ? record.files.filter((file) => file.disposition === 'selected').length
             : undefined,
+        filesChanged: hasFiles ? record.files.length : undefined,
         deterministicChecks: hasChecks ? new Set(record.checks.ran).size : undefined,
         scopeDetails: scopeDetails(record),
     };
@@ -88,13 +89,20 @@ export function noFindingsLabel(summary) {
 }
 export function scopeLine(summary) {
     const parts = [];
-    if (summary.filesReviewed !== undefined)
-        parts.push(plural(summary.filesReviewed, 'file') + ' reviewed');
+    if (summary.filesReviewed !== undefined) {
+        parts.push(summary.filesChanged === undefined
+            ? plural(summary.filesReviewed, 'file') + ' reviewed'
+            : summary.filesReviewed + '/' + summary.filesChanged + ' changed ' +
+                (summary.filesChanged === 1 ? 'file' : 'files') + ' reviewed');
+    }
     if (summary.deterministicChecks !== undefined) {
         parts.push(plural(summary.deterministicChecks, 'deterministic check'));
     }
-    if (summary.coverage !== undefined)
-        parts.push(summary.coverage + ' coverage');
+    if (summary.coverage !== undefined) {
+        parts.push(summary.coverage === 'full'
+            ? 'full applicable-oracle coverage'
+            : 'portable oracle coverage');
+    }
     return parts.length > 0 ? parts.join(' · ') : undefined;
 }
 export function modeNote(summary, verifyOnly = 'verify-only') {

package/dist/review.js

@@ -12,7 +12,6 @@ import { apiKey } from './judges/llm.js';
 import { enabled } from './config.js';
 import { SelectionPlan, capabilitiesOf } from './plan.js';
 import { Budget } from './budget.js';
-import { packFor } from './lang/packs.js';
 import { SEVERITIES } from './types.js';
 import { stripControl, stripPath } from './text.js';
 export function atLeast(severity, min) {
@@ -150,7 +149,7 @@ export async function review(opts) {
     const budget = opts.budget ?? new Budget();
     const manifest = opts.manifest;
     const groundDone = stage('ground');
-    const g = await buildGround(root, changed, opts.signal);
+    const g = await buildGround(root, changed, opts.signal, all);
     groundDone(g.sourceFiles.length + ' files · ' + g.symbolIndex.size + ' symbols' +
         (g.configFiles.length === 0
             ? ' · no usable relevant tsconfig, type checks disabled'
@@ -174,17 +173,10 @@ export async function review(opts) {
     // Naming a check explicitly is a request for that oracle, even under the portable
     // default. Strict policy makes the same promise for every configured verifier.
     const requireEnrichedOracles = config.coverage === 'strict' || opts.checks !== undefined;
-    // a file the change touched that no parser produced a tree for was not reviewed,
-    // whatever the summary says about the ones that were
-    const grounded = new Set([...g.files.map((f) => f.changed.path), ...g.foreign.map((f) => f.path)]);
-    for (const c of changed) {
-        if (grounded.has(c.path))
-            continue;
-        if (packFor(c.path))
-            plan.fail(c.path, 'declared language parser unavailable');
-        else
-            plan.waive(c.path, 'no parser for this language');
-    }
+    // A file the change touched that no parser produced a tree for was not reviewed,
+    // whatever the summary says about the ones that were. Delegation uses this exact
+    // transition too, so its task cannot disagree with the review it will feed.
+    plan.accountForGround(changed, g);
     // Capabilities belong to files, not runs. A typed file beside one excluded from
     // tsconfig must not make the latter look checked, and an old Ruby file must not
     // make a new Python file eligible for a before/after oracle.