@alimaandev/ripple 0.7.0 → 0.7.2

package/dist/bin.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
-import { rippleConfigSchema, DEFAULT_CONFIG, formatSchemaIssues } from './chunk-CFH4UW2E.js';
+import { rippleConfigSchema, DEFAULT_CONFIG, formatSchemaIssues } from './chunk-VSLCAPAH.js';
 import { CommanderError, Command } from 'commander';
 import { createJiti } from 'jiti';
 import path8 from 'path';
-import fs3 from 'fs/promises';
-import fs2 from 'fs';
+import fs4 from 'fs/promises';
+import fs3 from 'fs';
 import { Project, ts, SyntaxKind } from 'ts-morph';
 import chalk from 'chalk';
 import figures from 'figures';
 import treeify from 'treeify';
-import { createHash } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import fg from 'fast-glob';
 import ora from 'ora';
-import picomatch from 'picomatch';
 import { execFileSync } from 'child_process';
+import picomatch from 'picomatch';
 import { createInterface } from 'readline';
 
 // src/output/writer.ts
@@ -40,7 +40,7 @@ var ExitCode = {
 };
 async function pathExists(filePath) {
   try {
-    await fs3.access(filePath);
+    await fs4.access(filePath);
     return true;
   } catch {
     return false;
@@ -48,7 +48,7 @@ async function pathExists(filePath) {
 }
 function pathExistsSync(filePath) {
   try {
-    fs2.accessSync(filePath);
+    fs3.accessSync(filePath);
     return true;
   } catch {
     return false;
@@ -56,7 +56,7 @@ function pathExistsSync(filePath) {
 }
 async function readFileSafe(filePath) {
   try {
-    return await fs3.readFile(filePath, "utf8");
+    return await fs4.readFile(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -287,14 +287,31 @@ function computeConfidence(stats, targetInCycle) {
   if (targetInCycle) confidence *= 0.95;
   return Math.round(Math.min(1, Math.max(0, confidence)) * 100);
 }
-var SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
-var RESOLVABLE_EXTENSIONS = [...SOURCE_EXTENSIONS, ".mjs", ".cjs", ".d.ts"];
+var SOURCE_EXTENSIONS = [
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mts",
+  ".cts",
+  ".mjs",
+  ".cjs"
+];
+var RESOLVABLE_EXTENSIONS = [...SOURCE_EXTENSIONS, ".d.ts"];
 function toPosix(filePath) {
   return filePath.replace(/\\/g, "/");
 }
 function normalizeAbsolute(filePath, cwd) {
   return path8.resolve(cwd, filePath);
 }
+function realPath(filePath, cwd) {
+  const absolute = path8.resolve(cwd, filePath);
+  try {
+    return fs3.realpathSync.native(absolute);
+  } catch {
+    return absolute;
+  }
+}
 function pathKey(filePath, cwd) {
   const absolute = normalizeAbsolute(filePath, cwd);
   const posix = toPosix(absolute);
@@ -308,13 +325,22 @@ function sourceFileKind(filePath) {
 function extensionCandidates(basePath) {
   return RESOLVABLE_EXTENSIONS.map((ext) => basePath + ext);
 }
-function jsToTsCandidate(candidate) {
-  const ext = path8.extname(candidate);
-  if (ext === ".js") return candidate.slice(0, -3) + ".ts";
-  if (ext === ".jsx") return candidate.slice(0, -4) + ".tsx";
-  if (ext === ".mjs") return candidate.slice(0, -4) + ".mts";
-  if (ext === ".cjs") return candidate.slice(0, -4) + ".cts";
-  return candidate;
+function jsToTsCandidates(candidate) {
+  const ext = path8.extname(candidate).toLowerCase();
+  if (ext === "") return [];
+  const stem = candidate.slice(0, -ext.length);
+  switch (ext) {
+    case ".js":
+      return [`${stem}.ts`, `${stem}.tsx`];
+    case ".jsx":
+      return [`${stem}.tsx`];
+    case ".mjs":
+      return [`${stem}.mts`];
+    case ".cjs":
+      return [`${stem}.cts`];
+    default:
+      return [];
+  }
 }
 function displayPath(filePath, cwd) {
   const relative = path8.relative(cwd, filePath);
@@ -833,11 +859,9 @@ function impactLine(result, style) {
   if (summary.utilities > 0) parts.push(pluralize(summary.utilities, "utility"));
   return parts.length > 0 ? parts.join(" \xB7 ") : dim("none", style);
 }
-function buildAffectedTree(result, cwd, style) {
+function buildAffectedTree(result, cwd, style, limit) {
   const { affected, graph } = result;
-  const sorted = [...affected.entries()].sort(
-    ([, a], [, b]) => a.depth - b.depth || a.path.localeCompare(b.path)
-  );
+  const sorted = [...affected.entries()].sort(([, a], [, b]) => a.depth - b.depth || a.path.localeCompare(b.path)).slice(0, limit);
   const nodesByKey = /* @__PURE__ */ new Map();
   const depthByKey = /* @__PURE__ */ new Map();
   for (const [key, file] of sorted) {
@@ -911,9 +935,9 @@ function renderAnalyzeReport(result, options, writer) {
   writer.writeLine();
   if (summary.affectedFiles > 0) {
     writer.writeLine(sectionHeader(`Affected files (${summary.affectedFiles})`, style));
-    const tree = buildAffectedTree(result, options.cwd, style);
-    writer.writeLine(renderTree(tree));
     const limit = options.listLimit ?? DEFAULT_LIST_LIMIT;
+    const tree = buildAffectedTree(result, options.cwd, style, limit);
+    writer.writeLine(renderTree(tree));
     if (summary.affectedFiles > limit) {
       writer.writeLine(
         dim(`${summary.affectedFiles - limit} more\u2026 use --json for the full list`, style)
@@ -945,7 +969,7 @@ function renderAnalyzeReport(result, options, writer) {
   }
 }
 function buildAnalyzeJsonReport(result, version, cwd) {
-  const realPath = (key) => result.graph.nodes.get(key)?.path ?? key;
+  const realPath2 = (key) => result.graph.nodes.get(key)?.path ?? key;
   const affected = [...result.affected.values()].sort((a, b) => a.depth - b.depth || a.path.localeCompare(b.path)).map((file) => ({ ...file, path: displayPath(file.path, cwd) }));
   return {
     tool: "ripple",
@@ -956,8 +980,8 @@ function buildAnalyzeJsonReport(result, version, cwd) {
     summary: result.summary,
     affected,
     cycles: result.graph.cycles.map((cycle) => ({
-      members: cycle.members.map((key) => displayPath(realPath(key), cwd)),
-      path: cycle.path.map((key) => displayPath(realPath(key), cwd))
+      members: cycle.members.map((key) => displayPath(realPath2(key), cwd)),
+      path: cycle.path.map((key) => displayPath(realPath2(key), cwd))
     })),
     targetInCycle: result.targetInCycle,
     durationMs: result.durationMs
@@ -1002,7 +1026,7 @@ function renderGraphReport(input, options, writer) {
   }
 }
 function buildGraphJsonReport(input, version) {
-  const realPath = (key) => input.nodes.get(key)?.path ?? key;
+  const realPath2 = (key) => input.nodes.get(key)?.path ?? key;
   return {
     tool: "ripple",
     version,
@@ -1011,8 +1035,8 @@ function buildGraphJsonReport(input, version) {
     edgeCount: input.stats.internalEdges,
     externalEdgeCount: input.stats.externalEdges,
     cycles: input.cycles.map((cycle) => ({
-      members: cycle.members.map((key) => displayPath(realPath(key), input.cwd)),
-      path: cycle.path.map((key) => displayPath(realPath(key), input.cwd))
+      members: cycle.members.map((key) => displayPath(realPath2(key), input.cwd)),
+      path: cycle.path.map((key) => displayPath(realPath2(key), input.cwd))
     })),
     ...input.forward ? { forward: input.forward } : {},
     ...input.reverse ? { reverse: input.reverse } : {}
@@ -1038,8 +1062,8 @@ function riskToSarifLevel(level) {
       return "note";
   }
 }
-function primaryLocationHash(ruleId, uri, score) {
-  return createHash("sha256").update(`${ruleId}|${uri}|${score.toFixed(1)}`).digest("hex");
+function primaryLocationHash(ruleId, uri) {
+  return createHash("sha256").update(`${ruleId}|${uri}`).digest("hex");
 }
 var RISK_RULE = {
   id: "ripple/risk",
@@ -1055,6 +1079,7 @@ var RISK_RULE = {
 };
 function fileResult(entry, gate) {
   const { rel, result, allowed } = entry;
+  const uri = entry.repoRel ?? rel;
   const level = allowed ? "note" : riskToSarifLevel(result.risk.level);
   const blocked = LEVEL_INDEX[result.risk.level] >= GATE_INDEX[gate];
   const score = result.risk.score.toFixed(1);
@@ -1067,13 +1092,13 @@ function fileResult(entry, gate) {
     locations: [
       {
         physicalLocation: {
-          artifactLocation: { uri: rel },
+          artifactLocation: { uri },
           region: { startLine: 1 }
         }
       }
     ],
     partialFingerprints: {
-      primaryLocationLineHash: primaryLocationHash("ripple/risk", rel, result.risk.score)
+      primaryLocationLineHash: primaryLocationHash("ripple/risk", uri)
     },
     properties: {
       ripple: {
@@ -1160,7 +1185,7 @@ function buildAnalyzeSarif(options) {
               }
             ],
             partialFingerprints: {
-              primaryLocationLineHash: primaryLocationHash("ripple/risk", uri, result.risk.score)
+              primaryLocationLineHash: primaryLocationHash("ripple/risk", uri)
             },
             properties: {
               ripple: {
@@ -1343,41 +1368,80 @@ function extractSymbols(sourceFile) {
 }
 
 // src/parser/parse.ts
-function parseSourceFile(project, filePath) {
+var MAX_REPORTED_DIAGNOSTICS = 3;
+function diagnosticText(diagnostic) {
+  const message = diagnostic.getMessageText();
+  return typeof message === "string" ? message : message.getMessageText();
+}
+function formatDiagnostics(diagnostics) {
+  const parts = diagnostics.slice(0, MAX_REPORTED_DIAGNOSTICS).map((diagnostic) => {
+    const line = diagnostic.getLineNumber();
+    return `${line !== void 0 ? `line ${line}: ` : ""}${diagnosticText(diagnostic)}`;
+  });
+  const suffix = diagnostics.length > MAX_REPORTED_DIAGNOSTICS ? ` (+${diagnostics.length - MAX_REPORTED_DIAGNOSTICS} more)` : "";
+  return `${parts.join("; ")}${suffix}`;
+}
+function collectSyntacticErrors(project, filePaths) {
+  const errors = /* @__PURE__ */ new Map();
+  if (filePaths.length === 0) return errors;
+  const targets = new Set(filePaths.map((filePath) => pathKey(filePath, process.cwd())));
+  let diagnostics;
+  try {
+    diagnostics = project.getProgram().getSyntacticDiagnostics();
+  } catch {
+    return errors;
+  }
+  const byFile = /* @__PURE__ */ new Map();
+  for (const diagnostic of diagnostics) {
+    const key = pathKey(diagnostic.getSourceFile().getFilePath(), process.cwd());
+    if (!targets.has(key)) continue;
+    const list = byFile.get(key) ?? [];
+    list.push(diagnostic);
+    byFile.set(key, list);
+  }
+  for (const [key, list] of byFile) {
+    errors.set(key, formatDiagnostics(list));
+  }
+  return errors;
+}
+function emptySurface(filePath, kind, parseError) {
+  return {
+    path: filePath,
+    kind,
+    imports: [],
+    exports: { named: [], hasDefault: false, reExportedFrom: [], reExportedAll: [] },
+    symbols: { functions: [], classes: [], interfaces: [], enums: [], typeAliases: [] },
+    parseError
+  };
+}
+function parseSurface(project, filePath) {
+  const kind = sourceFileKind(filePath) ?? "ts";
   let sourceFile;
   try {
     sourceFile = project.addSourceFileAtPath(filePath);
   } catch (error) {
-    return {
-      path: filePath,
-      kind: sourceFileKind(filePath) ?? "ts",
-      imports: [],
-      exports: { named: [], hasDefault: false, reExportedFrom: [], reExportedAll: [] },
-      symbols: { functions: [], classes: [], interfaces: [], enums: [], typeAliases: [] },
-      parseError: error instanceof Error ? error.message : String(error)
-    };
+    return emptySurface(filePath, kind, error instanceof Error ? error.message : String(error));
   }
   try {
     return {
       path: filePath,
-      kind: sourceFileKind(filePath) ?? "ts",
+      kind,
       imports: extractImports(sourceFile),
       exports: extractExports(sourceFile),
       symbols: extractSymbols(sourceFile)
     };
   } catch (error) {
-    return {
-      path: filePath,
-      kind: sourceFileKind(filePath) ?? "ts",
-      imports: [],
-      exports: { named: [], hasDefault: false, reExportedFrom: [], reExportedAll: [] },
-      symbols: { functions: [], classes: [], interfaces: [], enums: [], typeAliases: [] },
-      parseError: error instanceof Error ? error.message : String(error)
-    };
+    return emptySurface(filePath, kind, error instanceof Error ? error.message : String(error));
   }
 }
 function parseMany(project, filePaths) {
-  return filePaths.map((filePath) => parseSourceFile(project, filePath));
+  const parsed = filePaths.map((filePath) => parseSurface(project, filePath));
+  const syntaxErrors = collectSyntacticErrors(project, filePaths);
+  return parsed.map((parsedFile) => {
+    if (parsedFile.parseError !== void 0) return parsedFile;
+    const error = syntaxErrors.get(pathKey(parsedFile.path, process.cwd()));
+    return error === void 0 ? parsedFile : emptySurface(parsedFile.path, parsedFile.kind, error);
+  });
 }
 
 // src/graph/cycles.ts
@@ -1478,16 +1542,15 @@ function probeCandidates(base, fileKeys, rootDir) {
     const key = pathKey(candidate, rootDir);
     if (fileKeys.has(key)) return path8.normalize(candidate);
   }
-  const jsSwapped = jsToTsCandidate(base);
-  if (jsSwapped !== base) {
-    const swappedKey = pathKey(jsSwapped, rootDir);
-    if (fileKeys.has(swappedKey)) return path8.normalize(jsSwapped);
+  for (const swapped of jsToTsCandidates(base)) {
+    const swappedKey = pathKey(swapped, rootDir);
+    if (fileKeys.has(swappedKey)) return path8.normalize(swapped);
   }
   return void 0;
 }
 function existsOnDisk(filePath) {
   try {
-    fs2.accessSync(filePath);
+    fs3.accessSync(filePath);
     return true;
   } catch {
     return false;
@@ -1511,7 +1574,7 @@ function resolveToFile(base, context) {
   if (fileKeys.has(exactKey)) return path8.normalize(base);
   const probed = probeCandidates(base, fileKeys, rootDir);
   if (probed) return probed;
-  if (existsOnDisk(base) && fs2.statSync(base).isDirectory()) {
+  if (existsOnDisk(base) && fs3.statSync(base).isDirectory()) {
     const indexProbed = probeCandidates(path8.join(base, "index"), fileKeys, rootDir);
     if (indexProbed) return indexProbed;
   }
@@ -1619,15 +1682,22 @@ function buildGraphFromParsed(parsedFiles, context) {
   mark("cycles");
   return graph;
 }
-var CACHE_SCHEMA = 2;
-var CACHE_FILE = path8.join(".ripple", "cache", "parsed-v2.json");
+
+// package.json
+var package_default = {
+  version: "0.7.2"};
+
+// src/cache/parsed.ts
+var CACHE_SCHEMA = 3;
+var CACHE_FILE = path8.join(".ripple", "cache", "parsed-v3.json");
 var cacheEnabled = () => process.env.RIPPLE_NO_CACHE !== "1";
 async function contentHash(filePath) {
-  const bytes = await fs3.readFile(filePath);
+  const bytes = await fs4.readFile(filePath);
   return createHash("sha256").update(bytes).digest("hex");
 }
 function configCacheHash(config) {
   const stable = {
+    parser: `${CACHE_SCHEMA}:${package_default.version}`,
     include: [...config.include].sort(),
     ignore: [...config.ignore].sort()
   };
@@ -1642,7 +1712,7 @@ function cachePath(rootDir) {
 async function loadParsedCache(rootDir, configHash) {
   let raw;
   try {
-    raw = await fs3.readFile(cachePath(rootDir), "utf8");
+    raw = await fs4.readFile(cachePath(rootDir), "utf8");
   } catch {
     return /* @__PURE__ */ new Map();
   }
@@ -1663,14 +1733,14 @@ async function saveParsedCache(rootDir, configHash, entries) {
     files: Object.fromEntries(entries)
   };
   const target = cachePath(rootDir);
-  const tmp = target + ".tmp";
+  const tmp = `${target}.${process.pid}.${randomUUID()}.tmp`;
   try {
-    await fs3.mkdir(path8.dirname(target), { recursive: true });
-    await fs3.writeFile(tmp, JSON.stringify(manifest), "utf8");
-    await fs3.rename(tmp, target);
+    await fs4.mkdir(path8.dirname(target), { recursive: true });
+    await fs4.writeFile(tmp, JSON.stringify(manifest), "utf8");
+    await fs4.rename(tmp, target);
   } catch {
     try {
-      await fs3.rm(tmp, { force: true });
+      await fs4.rm(tmp, { force: true });
     } catch {
     }
   }
@@ -1694,7 +1764,7 @@ async function loadParsedFiles(options) {
   const states = await Promise.all(
     filePaths.map(async (abs) => {
       try {
-        const stat = await fs3.stat(abs);
+        const stat = await fs4.stat(abs);
         return { abs, rel: relPosix(rootDir, abs), size: stat.size, mtimeMs: stat.mtimeMs };
       } catch {
         return { abs, rel: relPosix(rootDir, abs), size: -1, mtimeMs: -1 };
@@ -1702,6 +1772,8 @@ async function loadParsedFiles(options) {
     })
   );
   stage = traceAt("load-cache", stage);
+  const stateByRel = new Map(states.map((state) => [state.rel, state]));
+  const hashByRel = /* @__PURE__ */ new Map();
   const hits = /* @__PURE__ */ new Map();
   const stale = [];
   const parsed = /* @__PURE__ */ new Map();
@@ -1718,6 +1790,7 @@ async function loadParsedFiles(options) {
       hash = await contentHash(state.abs);
     } catch {
     }
+    hashByRel.set(state.rel, hash);
     if (entry !== void 0 && entry.hash === hash) {
       if (entry.mtimeMs !== state.mtimeMs || entry.size !== state.size) {
         hits.set(state.rel, { ...entry, size: state.size, mtimeMs: state.mtimeMs });
@@ -1742,17 +1815,13 @@ async function loadParsedFiles(options) {
   traceAt("freshness+parse", stage);
   if (dirty) {
     const next = new Map(hits);
-    for (const parsedFile of parsed.values()) {
-      const rel = relPosix(rootDir, parsedFile.path);
-      if (next.has(rel)) continue;
-      const state = states.find((candidate) => candidate.rel === rel);
-      let hash = "";
-      try {
-        hash = await contentHash(parsedFile.path);
-      } catch {
-      }
+    for (const stalePath of stale) {
+      const rel = relPosix(rootDir, stalePath);
+      const parsedFile = parsed.get(rel);
+      if (parsedFile === void 0) continue;
+      const state = stateByRel.get(rel);
       next.set(rel, {
-        hash,
+        hash: hashByRel.get(rel) ?? "",
         size: state?.size ?? -1,
         mtimeMs: state?.mtimeMs ?? -1,
         parsed: { ...parsedFile, path: rel }
@@ -1832,23 +1901,23 @@ async function analyzeCommand(fileArg, options, ctx2) {
   if (!await pathExists(targetPath)) {
     throw new RippleError(`File not found: ${fileArg}`, ExitCode.NotFound);
   }
-  const tracker = createStageTracker(!options.json);
+  const tracker = createStageTracker(!options.json && !options.sarif);
   tracker.next("Loading config");
   const started = Date.now();
   const context = await loadProjectContext(ctx2.cwd, options.config);
   tracker.next("Building dependency graph");
-  const { graph, entryPoints, durationMs: pipelineMs } = await runPipeline(context);
+  const { graph, entryPoints } = await runPipeline(context);
   tracker.next("Analyzing impact");
-  const completed = Date.now();
   const result = analyzeFile({
     graph,
     context,
     entryPoints,
     targetKey: requireNode(graph, targetPath, context.rootDir).key,
     targetPath,
-    durationMs: pipelineMs + (completed - started),
+    durationMs: 0,
     ...options.depth !== void 0 ? { maxDepth: options.depth } : {}
   });
+  result.durationMs = Date.now() - started;
   tracker.done();
   if (options.json) {
     const report = buildAnalyzeJsonReport(result, ctx2.version, ctx2.cwd);
@@ -2174,7 +2243,11 @@ async function doctorCommand(options, ctx2) {
     results.push({ label, state, detail });
   };
   try {
-    check("Node.js runtime", "ok", process.version);
+    check(
+      "Node.js runtime",
+      "ok",
+      options.verbose ? `${process.version} \xB7 ${process.platform}/${process.arch}` : process.version
+    );
     const packageJson = await findPackageJson(ctx2.cwd);
     if (packageJson) {
       check("package.json", "ok", path8.relative(ctx2.cwd, packageJson));
@@ -2238,6 +2311,13 @@ async function doctorCommand(options, ctx2) {
     } else {
       check("circular dependencies", "warn", `${stats.cycles} cycle group(s)`);
     }
+    if (options.verbose) {
+      check(
+        "graph",
+        "ok",
+        `${stats.files} files \xB7 ${stats.internalEdges} internal edges \xB7 ${stats.externalEdges} external \xB7 ${stats.unresolvedEdges} unresolved`
+      );
+    }
   } finally {
     spinner.stop();
   }
@@ -2263,7 +2343,7 @@ function renderResults(results, ctx2, color) {
   }
   ctx2.writer.writeLine();
 }
-var SCHEMA_REF = "./node_modules/@alimaandev/ripple/ripple.schema.json";
+var SCHEMA_REF = "https://raw.githubusercontent.com/alimaandev/ripple/main/ripple.schema.json";
 function jsonPayload(full) {
   const payload = full ? { ...DEFAULT_CONFIG } : { include: DEFAULT_CONFIG.include };
   return { ...payload, $schema: SCHEMA_REF };
@@ -2315,7 +2395,7 @@ async function initCommand(options, ctx2) {
   const fileName = options.ts ? "ripple.config.ts" : "ripple.config.json";
   const target = path8.join(ctx2.cwd, fileName);
   try {
-    await fs3.access(target);
+    await fs4.access(target);
     if (!options.force) {
       const mark = style.color ? chalk.red(icon("cross")) : icon("cross");
       ctx2.writer.writeLine(`${mark} ${fileName} already exists. Pass --force to overwrite it.`);
@@ -2326,7 +2406,7 @@ async function initCommand(options, ctx2) {
   const content = options.ts ? tsPayload(Boolean(options.full)) : `${JSON.stringify(jsonPayload(Boolean(options.full)), null, 2)}
 `;
   try {
-    await fs3.writeFile(target, content, "utf8");
+    await fs4.writeFile(target, content, "utf8");
     const mark = style.color ? chalk.green(icon("tick")) : icon("tick");
     ctx2.writer.writeLine(`${mark} Wrote ${fileName}`);
     ctx2.writer.writeLine(
@@ -2341,22 +2421,54 @@ async function initCommand(options, ctx2) {
     return ExitCode.Failure;
   }
 }
-var DEFAULT_BASES = ["origin/main", "main", "HEAD~1"];
-function git(args, cwd) {
+var DEFAULT_BASES = ["origin/HEAD", "origin/main", "origin/master", "main", "master"];
+function gitRaw(args, cwd) {
   return execFileSync("git", args, {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
-  }).trim();
+  });
+}
+function chomp(text) {
+  return text.replace(/\r?\n$/, "");
+}
+function git(args, cwd) {
+  return gitRaw(args, cwd).trim();
+}
+function repoRootFor(cwd) {
+  try {
+    const root = chomp(gitRaw(["rev-parse", "--show-toplevel"], cwd));
+    if (root) return realPath(root, cwd);
+  } catch {
+  }
+  throw new RippleError(
+    `Not a git repository: ${cwd}`,
+    ExitCode.NotFound,
+    "ripple diff needs a git repository. Run it from inside one, or pass --base only in a repo."
+  );
 }
 function refExists(ref, cwd) {
   try {
-    const out = git(["rev-parse", "--verify", ref], cwd);
+    const out = git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], cwd);
     return out.length > 0;
   } catch {
     return false;
   }
 }
+function sameCommit(left, right, cwd) {
+  try {
+    return git(["rev-parse", `${left}^{commit}`], cwd) === git(["rev-parse", `${right}^{commit}`], cwd);
+  } catch {
+    return false;
+  }
+}
+function hasUncommittedChanges(cwd) {
+  try {
+    return git(["status", "--porcelain", "--untracked-files=normal"], cwd).length > 0;
+  } catch {
+    return false;
+  }
+}
 function resolveBase(cwd, requested) {
   if (requested) {
     if (!refExists(requested, cwd)) {
@@ -2364,32 +2476,72 @@ function resolveBase(cwd, requested) {
     }
     return requested;
   }
-  for (const candidate of DEFAULT_BASES) {
-    if (refExists(candidate, cwd)) return candidate;
+  const candidates = [];
+  const githubBase = process.env.GITHUB_BASE_REF?.trim();
+  if (githubBase) {
+    candidates.push(`origin/${githubBase}`, githubBase);
+  }
+  candidates.push(...DEFAULT_BASES);
+  const seen = /* @__PURE__ */ new Set();
+  let headCandidate;
+  for (const candidate of candidates) {
+    if (seen.has(candidate)) continue;
+    seen.add(candidate);
+    if (!refExists(candidate, cwd)) continue;
+    if (sameCommit(candidate, "HEAD", cwd)) {
+      headCandidate ??= candidate;
+      continue;
+    }
+    return candidate;
+  }
+  if (headCandidate !== void 0) {
+    const detail = hasUncommittedChanges(cwd) ? "Only uncommitted changes are analyzed" : "The working tree is clean, so the change set is empty";
+    process.stderr.write(
+      `ripple: warning: base ref "${headCandidate}" resolves to HEAD. ${detail} \u2014 pass --base <ref> to compare against a branch.
+`
+    );
+    return headCandidate;
+  }
+  if (refExists("HEAD~1", cwd)) {
+    process.stderr.write(
+      "ripple: warning: no branch base found; falling back to HEAD~1. Only the last commit will be analyzed \u2014 pass --base <ref> for a full change set.\n"
+    );
+    return "HEAD~1";
   }
   throw new RippleError(
-    "No git base ref found (tried origin/main, main, HEAD~1). Pass --base <ref> explicitly.",
+    `No git base ref found (tried ${candidates.join(", ")}). Pass --base <ref> explicitly.`,
     ExitCode.NotFound
   );
 }
+function nulPaths(output) {
+  return output.split("\0").filter((entry) => entry.length > 0);
+}
+function isRippleArtifact(repoPath) {
+  return repoPath.replace(/\\/g, "/").split("/").includes(".ripple");
+}
 function changedFiles(cwd, base) {
-  const baseLabel = resolveBase(cwd, base);
+  const repoRoot = repoRootFor(cwd);
+  const baseLabel = resolveBase(repoRoot, base);
   let baseCommit = baseLabel;
   try {
-    const mergeBase = git(["merge-base", baseLabel, "HEAD"], cwd);
+    const mergeBase = git(["merge-base", baseLabel, "HEAD"], repoRoot).split(/\r?\n/)[0]?.trim();
     if (mergeBase) baseCommit = mergeBase;
   } catch {
   }
   const files = /* @__PURE__ */ new Set();
-  const tracked = git(["diff", "--name-only", "--diff-filter=ACMRT", baseCommit], cwd);
-  for (const line of tracked.split("\n")) {
-    if (line.trim()) files.add(line.trim());
+  const tracked = nulPaths(
+    gitRaw(["diff", "--name-only", "-z", "--diff-filter=ACMRT", baseCommit, "--"], repoRoot)
+  );
+  for (const file of tracked) {
+    if (!isRippleArtifact(file)) files.add(file);
   }
-  const untracked = git(["ls-files", "--others", "--exclude-standard"], cwd);
-  for (const line of untracked.split("\n")) {
-    if (line.trim()) files.add(line.trim());
+  const untracked = nulPaths(
+    gitRaw(["ls-files", "--others", "--exclude-standard", "-z"], repoRoot)
+  );
+  for (const file of untracked) {
+    if (!isRippleArtifact(file)) files.add(file);
   }
-  return { baseLabel, files: [...files].sort() };
+  return { baseLabel, repoRoot, files: [...files].sort() };
 }
 
 // src/formatter/annotations.ts
@@ -2430,9 +2582,12 @@ function buildGateAnnotation(blocked, gate, counts) {
     message: blocked ? `Gate blocked: ${atGate} at or above ${gate}` : `Gate passed: nothing at ${gate} or above`
   };
 }
-
-// src/commands/diff.ts
-var LEVEL_INDEX3 = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
+var LEVEL_INDEX3 = {
+  LOW: 0,
+  MEDIUM: 1,
+  HIGH: 2,
+  CRITICAL: 3
+};
 var GATE_INDEX3 = { medium: 1, high: 2, critical: 3 };
 var VERDICT_NOTE = {
   medium: "no MEDIUM or worse",
@@ -2462,6 +2617,52 @@ function riskySummary(counts, gate) {
   if (LEVEL_INDEX3.LOW >= gateIndex && counts.low > 0) parts.push(`${counts.low} LOW`);
   return parts.length > 0 ? parts.join(" \xB7 ") : "none";
 }
+function projectRelativePath(absPath, rootDir) {
+  const rel = toPosix(path8.relative(realPath(rootDir, rootDir), realPath(absPath, rootDir)));
+  return rel === "" ? "." : rel;
+}
+function evaluateGate(input) {
+  const { context, graph, entryPoints, changed, gate, allowPatterns, maxDepth } = input;
+  const changes = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const repoPath of changed.files) {
+    const gitPath = path8.resolve(changed.repoRoot, repoPath);
+    const file = projectRelativePath(gitPath, context.rootDir);
+    const absPath = file === "." ? context.rootDir : path8.resolve(context.rootDir, file);
+    const key = pathKey(absPath, context.rootDir);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (!graph.nodes.has(key)) {
+      changes.push({ file, repoPath, absPath, allowed: false });
+      continue;
+    }
+    const result = analyzeFile({
+      graph,
+      context,
+      entryPoints,
+      targetKey: key,
+      targetPath: absPath,
+      durationMs: 0,
+      ...maxDepth !== void 0 ? { maxDepth } : {}
+    });
+    changes.push({
+      file,
+      repoPath,
+      absPath,
+      result,
+      allowed: isAllowedByDiffAllowlist(file, allowPatterns)
+    });
+  }
+  const entries = changes.filter((change) => change.result !== void 0).sort((a, b) => b.result.risk.score - a.result.risk.score || a.file.localeCompare(b.file));
+  const skipped = changes.filter((change) => change.result === void 0);
+  const gateResults = entries.filter((entry) => !entry.allowed).map((entry) => entry.result);
+  const counts = countLevels(gateResults);
+  const allowedCount = entries.filter((entry) => entry.allowed).length;
+  const blocked = gateResults.some((result) => LEVEL_INDEX3[result.risk.level] >= GATE_INDEX3[gate]);
+  return { changes, entries, skipped, counts, allowedCount, blocked, gate };
+}
+
+// src/commands/diff.ts
 async function diffCommand(options, ctx2) {
   const format = options.format ?? (options.json ? "json" : "terminal");
   const style = { color: resolveColor(options.color) };
@@ -2474,46 +2675,30 @@ async function diffCommand(options, ctx2) {
   const changed = changedFiles(ctx2.cwd, base);
   tracker.next("Analyzing changed files");
   const { graph, entryPoints } = await runPipeline(context);
-  const byRel = /* @__PURE__ */ new Map();
-  const skipped = [];
-  for (const rel of changed.files) {
-    const abs = path8.resolve(ctx2.cwd, rel);
-    const key = pathKey(abs, context.rootDir);
-    if (!graph.nodes.has(key)) {
-      skipped.push(rel);
-      continue;
-    }
-    byRel.set(
-      rel,
-      analyzeFile({
-        graph,
-        context,
-        entryPoints,
-        targetKey: key,
-        targetPath: abs,
-        durationMs: 0,
-        ...options.depth !== void 0 ? { maxDepth: options.depth } : {}
-      })
-    );
-  }
-  tracker.done();
   const allowPatterns = [...options.allow ?? [], ...context.config.diff.allow ?? []];
-  const allowedByRel = /* @__PURE__ */ new Map();
-  for (const rel of byRel.keys()) {
-    allowedByRel.set(rel, isAllowedByDiffAllowlist(rel, allowPatterns));
-  }
-  const entries = [...byRel.entries()].map(([rel, result]) => ({ rel, result, allowed: allowedByRel.get(rel) ?? false })).sort((a, b) => b.result.risk.score - a.result.risk.score);
-  const gateResults = entries.filter((entry) => !entry.allowed).map((entry) => entry.result);
-  const counts = countLevels(gateResults);
-  const allowedCount = entries.filter((entry) => entry.allowed).length;
-  const blocked = gateResults.some((result) => LEVEL_INDEX3[result.risk.level] >= GATE_INDEX3[gate]);
+  const evaluation = evaluateGate({
+    context,
+    graph,
+    entryPoints,
+    changed,
+    gate,
+    allowPatterns,
+    ...options.depth !== void 0 ? { maxDepth: options.depth } : {}
+  });
+  tracker.done();
+  const { changes, entries, skipped, counts, allowedCount, blocked } = evaluation;
+  const byRel = new Map(entries.map((entry) => [entry.file, entry.result]));
+  const allowedByRel = new Map(
+    entries.map((entry) => [entry.file, entry.allowed])
+  );
+  const changedNames = changes.map((change) => change.file);
   const durationMs = Date.now() - started;
   if (format === "json") {
     ctx2.writer.write(
       serializeJson(
         buildDiffJsonReport(
           changed.baseLabel,
-          changed.files,
+          changedNames,
           byRel,
           allowedByRel,
           gate,
@@ -2532,7 +2717,12 @@ async function diffCommand(options, ctx2) {
       serializeJson(
         buildDiffSarif({
           baseLabel: changed.baseLabel,
-          entries,
+          entries: entries.map((entry) => ({
+            rel: entry.file,
+            repoRel: entry.repoPath,
+            result: entry.result,
+            allowed: entry.allowed
+          })),
           gate,
           counts,
           blocked,
@@ -2546,7 +2736,7 @@ async function diffCommand(options, ctx2) {
   if (format === "github") {
     const annotations = [
       ...buildFileAnnotations(
-        [...byRel.entries()].filter(([rel]) => !(allowedByRel.get(rel) ?? false)).map(([file, result]) => ({ file, result })),
+        entries.filter((entry) => !entry.allowed).map((entry) => ({ file: entry.repoPath, result: entry.result })),
         gate
       ),
       buildGateAnnotation(blocked, gate, counts)
@@ -2559,15 +2749,20 @@ async function diffCommand(options, ctx2) {
     {
       cwd: ctx2.cwd,
       baseLabel: changed.baseLabel,
-      files: changed.files,
-      entries,
-      skipped,
+      files: changedNames,
+      entries: entries.map((entry) => ({
+        rel: entry.file,
+        result: entry.result,
+        allowed: entry.allowed
+      })),
+      skipped: skipped.map((change) => change.file),
       counts,
       allowedCount,
       gate,
       blocked,
       durationMs,
-      style
+      style,
+      verbose: options.verbose
     },
     ctx2.writer
   );
@@ -2585,7 +2780,8 @@ function renderDiffReport(input, writer) {
     gate,
     blocked,
     durationMs,
-    style
+    style,
+    verbose = false
   } = input;
   writer.writeLine(brandHeader({ label: `diff vs ${baseLabel}`, style }));
   writer.writeLine();
@@ -2621,6 +2817,14 @@ function renderDiffReport(input, writer) {
     writer.writeLine(
       `${fileIconText} ${file}  ${riskBadge(result.risk.level, style)} \xB7 ${score}/100${gauge ? ` ${gauge}` : ""}${allowedTag}`
     );
+    if (verbose) {
+      writer.writeLine(
+        `  ${dim(
+          `${pluralize(result.summary.affectedFiles, "file")} affected \xB7 max depth ${result.summary.maxDepth} \xB7 confidence ${result.summary.confidence}%`,
+          style
+        )}`
+      );
+    }
   }
   for (const rel of skipped) {
     writer.writeLine(
@@ -2843,8 +3047,8 @@ function analyzeIn(project, cwd, file, maxDepth) {
   });
 }
 function relPath(targetPath, cwd) {
-  const rel = targetPath.slice(cwd.length).replace(/^[/\\]+/, "");
-  return (rel || targetPath).replace(/\\/g, "/");
+  const rel = path8.relative(cwd, targetPath);
+  return toPosix(rel || path8.basename(targetPath));
 }
 var IMPACT_SCHEMA = {
   type: "object",
@@ -2891,7 +3095,7 @@ var GATE_SCHEMA = {
   properties: {
     base: {
       type: "string",
-      description: "Git ref to diff against (default: origin/main, main, or HEAD~1)."
+      description: "Git ref to diff against (default: GitHub base, origin/main, origin/master, main, master)."
     },
     gate: {
       type: "string",
@@ -2900,7 +3104,6 @@ var GATE_SCHEMA = {
     }
   }
 };
-var LEVEL_INDEX4 = { LOW: 1, MEDIUM: 2, HIGH: 3, CRITICAL: 4 };
 function createMcpTools(deps) {
   const { cwd, loadProject, getChanged } = deps;
   return [
@@ -2940,7 +3143,7 @@ function createMcpTools(deps) {
           const file = requireString(args, "file", "dependents");
           const depth = optionalPositiveInt(args, "depth", "dependents") ?? 1;
           const project = await loadProject();
-          const result = analyzeIn(project, cwd, file);
+          const result = analyzeIn(project, cwd, file, depth);
           const dependents = [...result.affected.values()].filter((affected) => affected.depth <= depth).sort((a, b) => a.depth - b.depth || a.path.localeCompare(b.path)).map((affected) => ({
             path: relPath(affected.path, cwd),
             depth: affected.depth,
@@ -3014,39 +3217,42 @@ function createMcpTools(deps) {
               )
             );
           }
-          const changed = getChanged(base);
           const project = await loadProject();
           const resolvedGate = gate ?? project.context.config.diff.gate ?? "high";
-          const gateIndex = LEVEL_INDEX4[resolvedGate.toUpperCase()] ?? 3;
-          const files = [];
-          const counts = { low: 0, medium: 0, high: 0, critical: 0 };
-          let blocked = false;
-          for (const rel of changed.files) {
-            try {
-              const result = analyzeIn(project, cwd, rel);
-              const level = result.risk.level;
-              counts[level.toLowerCase()] += 1;
-              if ((LEVEL_INDEX4[level] ?? 1) >= gateIndex) blocked = true;
-              files.push({
-                file: rel,
-                analyzed: true,
-                level,
-                score: result.risk.score,
-                affectedFiles: result.summary.affectedFiles,
-                targetInCycle: result.targetInCycle
-              });
-            } catch {
-              files.push({ file: rel, analyzed: false });
-            }
-          }
+          const changed = getChanged(base ?? project.context.config.diff.base);
+          const evaluation = evaluateGate({
+            context: project.context,
+            graph: project.graph,
+            entryPoints: project.entryPoints,
+            changed,
+            gate: resolvedGate,
+            allowPatterns: project.context.config.diff.allow ?? []
+          });
+          const files = evaluation.changes.map((change) => {
+            if (!change.result) return { file: change.file, analyzed: false };
+            return {
+              file: change.file,
+              analyzed: true,
+              level: change.result.risk.level,
+              score: change.result.risk.score,
+              affectedFiles: change.result.summary.affectedFiles,
+              targetInCycle: change.result.targetInCycle,
+              allowed: change.allowed
+            };
+          });
           return ok(
             JSON.stringify(
               {
                 base: changed.baseLabel,
-                changedFiles: changed.files.length,
+                changedFiles: evaluation.changes.length,
                 files,
-                counts,
-                gate: { level: resolvedGate, blocked, verdict: blocked ? "block" : "pass" }
+                counts: evaluation.counts,
+                gate: {
+                  level: resolvedGate,
+                  blocked: evaluation.blocked,
+                  verdict: evaluation.blocked ? "block" : "pass",
+                  allowed: evaluation.allowedCount
+                }
               },
               null,
               2
@@ -3062,14 +3268,10 @@ function createMcpTools(deps) {
 
 // src/commands/mcp.ts
 async function mcpCommand(options, ctx2) {
-  let snapshot = null;
   const loadProject = async () => {
-    if (!snapshot) {
-      const context = await loadProjectContext(ctx2.cwd, options.config);
-      const { graph, entryPoints } = await runPipeline(context);
-      snapshot = { context, graph, entryPoints };
-    }
-    return snapshot;
+    const context = await loadProjectContext(ctx2.cwd, options.config);
+    const { graph, entryPoints } = await runPipeline(context);
+    return { context, graph, entryPoints };
   };
   const server = new McpServer({
     name: "ripple",
@@ -3163,7 +3365,10 @@ function createProgram(ctx2) {
     "-f, --format <format>",
     "output format: terminal | json | github | sarif",
     parseDiffFormat
-  ).option("-v, --verbose", "include extra sections").option("-b, --base <ref>", "git ref to diff against (default: origin/main, main, HEAD~1)").option(
+  ).option("-v, --verbose", "include extra sections").option(
+    "-b, --base <ref>",
+    "git ref to diff against (default: GitHub base, origin/HEAD, origin/main, origin/master, main, master)"
+  ).option(
     "-g, --gate <level>",
     "risk level that blocks the gate (medium | high | critical)",
     parseGateLevel
@@ -3317,10 +3522,6 @@ async function run({ argv, ctx: ctx2 }) {
   }
 }
 
-// package.json
-var package_default = {
-  version: "0.7.0"};
-
 // src/cli/bin.ts
 var ctx = {
   writer: new TerminalWriter(),