@bynlk/codeomnivis 0.0.0-bootstrap.0

package/dist/index.js

@@ -0,0 +1,2219 @@
+import {
+  AuthDetector,
+  ConsistencyChecker,
+  DataFlowTracer,
+  NPlusOneDetector,
+  OmniDatabase,
+  RSCBoundaryDetector,
+  analyzeProject,
+  computeSnapshotDigest,
+  detectProject,
+  getDbPath,
+  importJunitXml,
+  isEdgeType,
+  isIpLiteral,
+  isJsonObject,
+  isNodeType,
+  isTestFramework,
+  loadConfig,
+  parseAiChatRequest,
+  projectTestView,
+  resolveAiConfig,
+  runAnalysis,
+  sanitizeGraph,
+  validateResolvedAddresses,
+  validateUpstreamBaseUrl
+} from "./chunk-D2FE2QSJ.js";
+
+// src/index.ts
+import { pathToFileURL } from "url";
+
+// src/program.ts
+import { readFileSync } from "fs";
+import { Command } from "commander";
+
+// src/commands/analyze.ts
+import ora from "ora";
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+
+// src/utils/autoDetect.ts
+async function autoDetectProject(root, config) {
+  return detectProject(root, config);
+}
+
+// src/commands/analyze.ts
+var defaultAnalyzeDeps = {
+  openDatabase: (dbPath) => new OmniDatabase(dbPath)
+};
+async function runAnalyze(options, deps = defaultAnalyzeDeps) {
+  const report = deps.onProgress ?? (() => {
+  });
+  const projectRoot = path.resolve(options.project ?? ".");
+  report("Detecting project structure...");
+  const config = loadConfig(projectRoot);
+  const projectMeta = await autoDetectProject(projectRoot, config);
+  const dbPath = getDbPath(projectRoot);
+  const db = deps.openDatabase(dbPath);
+  try {
+    await db.ready();
+    const result = await analyzeProject({
+      projectRoot,
+      dbPath,
+      projectMeta,
+      db,
+      onProgress: (event) => {
+        if (event.filesScanned !== void 0) report(`Parsing ${event.filesScanned} files...`);
+      }
+    });
+    const graph = result.snapshot.graph;
+    if (options.json) {
+      process.stdout.write(
+        `${JSON.stringify({
+          data: result.snapshot,
+          meta: {
+            snapshotId: result.snapshot.snapshotId,
+            snapshotDigest: result.snapshot.snapshotDigest
+          }
+        })}
+`
+      );
+      return;
+    }
+    const nPlusOneDetector = new NPlusOneDetector();
+    const authDetector = new AuthDetector();
+    const rscBoundaryDetector = new RSCBoundaryDetector();
+    const allIssues = [
+      ...nPlusOneDetector.detect(graph, projectRoot),
+      ...authDetector.detect(graph, projectRoot),
+      ...rscBoundaryDetector.detect(graph, projectRoot)
+    ];
+    console.log("");
+    console.log(chalk.blue("Statistics:"));
+    console.log(`  Nodes: ${graph.nodes.length}`);
+    console.log(`  Edges: ${graph.edges.length}`);
+    console.log(`  Errors: ${result.snapshot.parseErrors.length}`);
+    const crossLayerTypes = /* @__PURE__ */ new Set(["calls_api", "handles", "calls_service", "queries_db"]);
+    if (graph.edges.some((edge) => crossLayerTypes.has(edge.type))) {
+      const countEdge = (type) => graph.edges.filter((edge) => edge.type === type).length;
+      console.log("");
+      console.log(chalk.blue("Cross-layer links:"));
+      console.log(`  calls_api:      ${countEdge("calls_api")}`);
+      console.log(`  handles:        ${countEdge("handles")}`);
+      console.log(`  calls_service:  ${countEdge("calls_service")}`);
+      console.log(`  queries_db:     ${countEdge("queries_db")}`);
+    }
+    if (allIssues.length > 0) {
+      console.log("");
+      console.log(chalk.red(`Issues Found: ${allIssues.length}`));
+      const byType = {};
+      for (const issue of allIssues) {
+        byType[issue.type] = (byType[issue.type] || 0) + 1;
+      }
+      for (const [type, count] of Object.entries(byType)) {
+        const severity = allIssues.find((i) => i.type === type)?.severity || "info";
+        const color = severity === "critical" ? chalk.red : severity === "warning" ? chalk.yellow : chalk.gray;
+        console.log(color(`  ${type}: ${count}`));
+      }
+      const criticals = allIssues.filter((i) => i.severity === "critical");
+      if (criticals.length > 0) {
+        console.log("");
+        console.log(chalk.red("Critical issues:"));
+        for (const issue of criticals.slice(0, 10)) {
+          console.log(chalk.red(`  \u26A0 ${issue.description}`));
+          if (issue.locations[0]) {
+            console.log(chalk.gray(`    at ${issue.locations[0].file}:${issue.locations[0].line}`));
+          }
+        }
+        if (criticals.length > 10) {
+          console.log(chalk.gray(`  ... and ${criticals.length - 10} more`));
+        }
+      }
+    }
+    const json = JSON.stringify(graph, null, 2);
+    if (options.output === "-") {
+      console.log(json);
+    } else {
+      fs.writeFileSync(options.output, json, "utf-8");
+      console.log(chalk.gray(`
+Graph saved to ${options.output}`));
+    }
+  } finally {
+    db.close();
+  }
+}
+function analyzeCommand(program) {
+  program.command("analyze").description("Analyze project and output graph as JSON").option("-p, --project <path>", "Project root", ".").option("-o, --output <file>", "Output file path", "codeomnivis-graph.json").option("--json", "Write the versioned snapshot envelope to stdout").action(async (options) => {
+    const spinner = ora("Analyzing project...").start();
+    try {
+      await runAnalyze(options, {
+        openDatabase: (dbPath) => new OmniDatabase(dbPath),
+        onProgress: (message) => {
+          spinner.text = message;
+        }
+      });
+      spinner.succeed(chalk.green("Analysis complete!"));
+    } catch (err) {
+      spinner.fail(chalk.red("Analysis failed"));
+      console.error(err);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/check.ts
+import ora2 from "ora";
+import chalk2 from "chalk";
+import * as path2 from "path";
+var defaultCheckDeps = {
+  openDatabase: (dbPath) => new OmniDatabase(dbPath)
+};
+async function runCheck(deps = defaultCheckDeps) {
+  const report = deps.onProgress ?? (() => {
+  });
+  const projectRoot = path2.resolve(deps.cwd ?? ".");
+  report("Detecting project structure...");
+  const config = loadConfig(projectRoot);
+  const projectMeta = await autoDetectProject(projectRoot, config);
+  const dbPath = getDbPath(projectRoot);
+  const db = deps.openDatabase(dbPath);
+  try {
+    await db.ready();
+    const result = await runAnalysis({
+      projectRoot,
+      dbPath,
+      projectMeta,
+      db,
+      onFilesCollected: (count) => report(`Parsing ${count} files...`)
+    });
+    report("Checking consistency...");
+    const graph = db.loadGraph();
+    const checker = new ConsistencyChecker();
+    const consistencyReport = checker.check(graph);
+    console.log("");
+    console.log(chalk2.blue("Statistics:"));
+    console.log(`  Nodes: ${graph.nodes.length}`);
+    console.log(`  Edges: ${graph.edges.length}`);
+    console.log(`  Errors: ${result.errors}`);
+    if (result.errors > 0) {
+      console.log("");
+      console.log(chalk2.yellow("Parse Errors:"));
+      const errors = db.getAllErrors();
+      for (const error of errors) {
+        const icon = error.severity === "error" ? "\u274C" : "\u26A0\uFE0F";
+        console.log(`  ${icon} ${error.file}: ${error.message}`);
+      }
+    }
+    if (consistencyReport.issues.length > 0) {
+      console.log("");
+      console.log(chalk2.blue("Consistency Issues:"));
+      console.log(`  Total: ${consistencyReport.summary.total}`);
+      console.log(`  Critical: ${consistencyReport.summary.critical}`);
+      console.log(`  Warning: ${consistencyReport.summary.warning}`);
+      console.log(`  Info: ${consistencyReport.summary.info}`);
+      console.log("");
+      for (const issue of consistencyReport.issues) {
+        const icon = issue.severity === "critical" ? "\u{1F534}" : issue.severity === "warning" ? "\u{1F7E1}" : "\u2139\uFE0F";
+        console.log(`  ${icon} [${issue.type}] ${issue.description}`);
+        for (const loc of issue.locations) {
+          console.log(`     at ${loc.file}:${loc.line}`);
+        }
+      }
+    } else {
+      console.log("");
+      console.log(chalk2.green("\u2705 No consistency issues found"));
+    }
+  } finally {
+    db.close();
+  }
+}
+function checkCommand(program) {
+  program.command("check").description("Check project for consistency issues").action(async () => {
+    const spinner = ora2("Checking project...").start();
+    try {
+      await runCheck({
+        openDatabase: (dbPath) => new OmniDatabase(dbPath),
+        onProgress: (message) => {
+          spinner.text = message;
+        }
+      });
+      spinner.succeed(chalk2.green("Check complete!"));
+    } catch (err) {
+      spinner.fail(chalk2.red("Check failed"));
+      console.error(err);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/init.ts
+import ora3 from "ora";
+import chalk3 from "chalk";
+function initCommand(program) {
+  program.command("init").description("Generate CodeOmniVis configuration file").action(async () => {
+    const spinner = ora3("Generating configuration...").start();
+    try {
+      const fs8 = await import("fs");
+      const path10 = await import("path");
+      const configPath = path10.join(process.cwd(), ".codeomnivis.json");
+      if (fs8.existsSync(configPath)) {
+        spinner.warn(chalk3.yellow("Configuration file already exists"));
+        return;
+      }
+      const config = {
+        $schema: "https://codeomnivis.dev/schema.json",
+        version: "0.0.1",
+        exclude: ["node_modules", "dist", ".git", ".next"],
+        parsers: {
+          prisma: {
+            enabled: true
+          },
+          nextjs: {
+            enabled: true
+          },
+          trpc: {
+            enabled: true
+          }
+        },
+        server: {
+          port: 4321,
+          host: "localhost"
+        }
+      };
+      fs8.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+      spinner.succeed(chalk3.green("Configuration file generated!"));
+      console.log(chalk3.gray(`
+Created: ${configPath}`));
+      console.log(chalk3.gray("Edit this file to customize CodeOmniVis behavior."));
+    } catch (err) {
+      spinner.fail(chalk3.red("Failed to generate configuration"));
+      console.error(err);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/mcp.ts
+import * as path3 from "path";
+var defaultDeps = {
+  start: async (projectRoot) => {
+    const { startMcpServer } = await import("./dist-YNCI4IFF.js");
+    return startMcpServer({ projectRoot });
+  },
+  once: (signal, listener) => {
+    process.once(signal, listener);
+  },
+  remove: (signal, listener) => {
+    process.removeListener(signal, listener);
+  },
+  stderr: (message) => {
+    process.stderr.write(message);
+  },
+  exit: (code) => {
+    process.exit(code);
+  },
+  setExitCode: (code) => {
+    process.exitCode = code;
+  }
+};
+async function runMcpCommand(options, deps = defaultDeps) {
+  let handle;
+  let stopRequested = false;
+  let stopping = false;
+  const stop = () => {
+    stopRequested = true;
+    if (!handle || stopping) return;
+    stopping = true;
+    void handle.close().then(() => deps.exit(0)).catch((err) => {
+      deps.stderr(`Failed to stop MCP Server: ${String(err)}
+`);
+      deps.exit(1);
+    });
+  };
+  deps.once("SIGINT", stop);
+  deps.once("SIGTERM", stop);
+  try {
+    handle = await deps.start(path3.resolve(options.project));
+    if (stopRequested) stop();
+  } catch (err) {
+    deps.remove("SIGINT", stop);
+    deps.remove("SIGTERM", stop);
+    deps.stderr(`Failed to start MCP Server: ${String(err)}
+`);
+    deps.setExitCode(1);
+  }
+}
+function mcpCommand(program) {
+  program.command("mcp").description("Start MCP Server for AI assistant integration").option("--project <path>", "Project root path", ".").action(async (options) => {
+    await runMcpCommand(options);
+  });
+}
+
+// src/commands/serve.ts
+import ora4 from "ora";
+import chalk4 from "chalk";
+import * as fs5 from "fs";
+import * as path6 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+
+// src/utils/validateProjectRoot.ts
+import * as fs2 from "fs";
+import * as path4 from "path";
+function validateProjectRoot(project) {
+  const projectRoot = path4.resolve(project);
+  if (!fs2.existsSync(projectRoot) || !fs2.statSync(projectRoot).isDirectory()) {
+    throw new Error(`Project root is not an existing directory: ${projectRoot}`);
+  }
+  return projectRoot;
+}
+
+// ../server/dist/index.mjs
+import express from "express";
+import cors from "cors";
+import path42 from "path";
+import fs3 from "fs";
+import { fileURLToPath } from "url";
+import { createServer as createHttpServer } from "http";
+import { WebSocket, WebSocketServer } from "ws";
+import { Router } from "express";
+import { Router as Router2 } from "express";
+import { EventEmitter } from "events";
+import * as path5 from "path";
+import * as fs4 from "fs";
+import chokidar from "chokidar";
+import { createHash } from "crypto";
+import { promises as dns } from "dns";
+import { isIP } from "net";
+import { Agent, buildConnector, request as undiciRequest } from "undici";
+import { createHash as createHash2, timingSafeEqual } from "crypto";
+import { randomBytes } from "crypto";
+import path32 from "path";
+import path22 from "path";
+import fs22 from "fs";
+var DETECTOR_ORDER = [
+  { id: "consistency", key: "consistency", source: "consistency" },
+  { id: "auth", key: "auth", source: "security" },
+  { id: "n_plus_one", key: "nPlusOne", source: "performance" },
+  { id: "rsc", key: "rsc", source: "framework" }
+];
+var SEVERITY_RANK = { critical: 0, warning: 1, info: 2 };
+function createDefaultDetectors() {
+  return {
+    consistency: (graph) => new ConsistencyChecker().check(graph).issues,
+    auth: (graph, projectRoot) => new AuthDetector().detect(graph, projectRoot),
+    nPlusOne: (graph, projectRoot) => new NPlusOneDetector().detect(graph, projectRoot),
+    rsc: (graph, projectRoot) => new RSCBoundaryDetector().detect(graph, projectRoot)
+  };
+}
+function compareIssues(left, right) {
+  const severity = SEVERITY_RANK[left.severity] - SEVERITY_RANK[right.severity];
+  if (severity !== 0) return severity;
+  const leftLocation = left.locations[0];
+  const rightLocation = right.locations[0];
+  const file = (leftLocation?.file ?? "").localeCompare(rightLocation?.file ?? "");
+  if (file !== 0) return file;
+  const line = (leftLocation?.line ?? 0) - (rightLocation?.line ?? 0);
+  return line !== 0 ? line : left.id.localeCompare(right.id);
+}
+function collectGraphIssues(graph, projectRoot, detectors = createDefaultDetectors()) {
+  const byId = /* @__PURE__ */ new Map();
+  const statuses = [];
+  for (const detector of DETECTOR_ORDER) {
+    try {
+      const issues2 = detectors[detector.key](graph, projectRoot);
+      for (const issue of issues2) {
+        if (!byId.has(issue.id)) {
+          byId.set(issue.id, { ...issue, source: detector.source });
+        }
+      }
+      statuses.push({ id: detector.id, status: "complete" });
+    } catch {
+      statuses.push({
+        id: detector.id,
+        status: "failed",
+        message: "Detector failed"
+      });
+    }
+  }
+  const issues = [...byId.values()].sort(compareIssues);
+  return {
+    issues,
+    summary: {
+      total: issues.length,
+      critical: issues.filter((issue) => issue.severity === "critical").length,
+      warning: issues.filter((issue) => issue.severity === "warning").length,
+      info: issues.filter((issue) => issue.severity === "info").length
+    },
+    detectors: statuses
+  };
+}
+function sendInternalError(response, logMessage, publicMessage, error) {
+  console.error(`${logMessage}:`, error);
+  response.status(500).json({
+    error: { code: "INTERNAL_ERROR", message: publicMessage }
+  });
+}
+var VALID_NODE_TYPES = /* @__PURE__ */ new Set([
+  "page",
+  "component",
+  "api_route",
+  "trpc_procedure",
+  "express_route",
+  "handler",
+  "service",
+  "db_model",
+  "module",
+  "tsrpc_service",
+  "tsrpc_api",
+  "tsrpc_msg",
+  "kotlin_class",
+  "kotlin_interface",
+  "kotlin_object",
+  "kotlin_function",
+  "kotlin_route"
+]);
+var VALID_EDGE_TYPES = /* @__PURE__ */ new Set([
+  "renders",
+  "navigates_to",
+  "calls_api",
+  "handles",
+  "calls_service",
+  "queries_db",
+  "db_relation",
+  "imports",
+  "contains",
+  "data_flows_to",
+  "sends_msg",
+  "listens_msg",
+  "kotlin_inherits",
+  "kotlin_implements",
+  "kotlin_uses"
+]);
+function createGraphRouter(db, mutatingGuard, getProjectRoot = () => process.cwd()) {
+  const router = Router();
+  const guard = mutatingGuard ?? ((_req, _res, next) => next());
+  router.get("/", (_req, res) => {
+    try {
+      const rawGraph = db.loadGraph();
+      const { graph, stats: sanitizeStats } = sanitizeGraph(rawGraph);
+      const stats = db.getStats();
+      const snapshot = db.loadSnapshot();
+      res.json({
+        data: graph,
+        meta: {
+          nodeCount: graph.nodes.length,
+          edgeCount: graph.edges.length,
+          nodesByType: stats.nodeTypeCounts,
+          edgesByType: stats.edgeTypeCounts,
+          sanitize: sanitizeStats,
+          snapshotId: snapshot?.snapshotId ?? null,
+          snapshotDigest: snapshot?.snapshotDigest ?? null
+        }
+      });
+    } catch (err) {
+      sendInternalError(res, "Failed to get graph", "Failed to load graph data", err);
+    }
+  });
+  router.get("/nodes", (req, res) => {
+    try {
+      const { type } = req.query;
+      let nodes;
+      if (type && typeof type === "string") {
+        if (!isNodeType(type)) {
+          return res.status(400).json({
+            error: {
+              code: "INVALID_TYPE",
+              message: `Invalid node type: ${type}. Valid types: ${[...VALID_NODE_TYPES].join(", ")}`
+            }
+          });
+        }
+        nodes = db.getNodesByType(type);
+      } else {
+        nodes = db.getAllNodes();
+      }
+      res.json({
+        data: nodes,
+        meta: { count: nodes.length }
+      });
+    } catch (err) {
+      sendInternalError(res, "Failed to get nodes", "Failed to load nodes", err);
+    }
+  });
+  router.get("/nodes/:id", (req, res) => {
+    try {
+      const { id } = req.params;
+      const node = db.getNode(decodeURIComponent(id));
+      if (!node) {
+        return res.status(404).json({
+          error: {
+            code: "NOT_FOUND",
+            message: `Node not found: ${id}`
+          }
+        });
+      }
+      res.json({ data: node });
+    } catch (err) {
+      sendInternalError(res, "Failed to get node", "Failed to load node", err);
+    }
+  });
+  router.get("/nodes/:id/edges", (req, res) => {
+    try {
+      const { id } = req.params;
+      const nodeId = decodeURIComponent(id);
+      const inEdges = db.getInEdges(nodeId);
+      const outEdges = db.getOutEdges(nodeId);
+      res.json({
+        data: {
+          inEdges,
+          outEdges
+        },
+        meta: {
+          inCount: inEdges.length,
+          outCount: outEdges.length
+        }
+      });
+    } catch (err) {
+      sendInternalError(res, "Failed to get node edges", "Failed to load node edges", err);
+    }
+  });
+  router.get("/edges", (req, res) => {
+    try {
+      const { type } = req.query;
+      let edges;
+      if (type && typeof type === "string") {
+        if (!isEdgeType(type)) {
+          return res.status(400).json({
+            error: {
+              code: "INVALID_TYPE",
+              message: `Invalid edge type: ${type}. Valid types: ${[...VALID_EDGE_TYPES].join(", ")}`
+            }
+          });
+        }
+        edges = db.getEdgesByType(type);
+      } else {
+        edges = db.getAllEdges();
+      }
+      res.json({
+        data: edges,
+        meta: { count: edges.length }
+      });
+    } catch (err) {
+      sendInternalError(res, "Failed to get edges", "Failed to load edges", err);
+    }
+  });
+  router.get("/stats", (_req, res) => {
+    try {
+      const stats = db.getStats();
+      res.json({ data: stats });
+    } catch (err) {
+      sendInternalError(res, "Failed to get stats", "Failed to load stats", err);
+    }
+  });
+  router.delete("/", guard, (req, res) => {
+    try {
+      if (req.headers["x-confirm"] !== "true") {
+        return res.status(400).json({
+          error: {
+            code: "CONFIRMATION_REQUIRED",
+            message: "This operation requires X-Confirm: true header"
+          }
+        });
+      }
+      db.clearGraph();
+      res.json({ data: { success: true } });
+    } catch (err) {
+      sendInternalError(res, "Failed to clear graph", "Failed to clear graph", err);
+    }
+  });
+  router.get("/errors", (_req, res) => {
+    try {
+      const errors = db.getAllErrors();
+      res.json({
+        data: errors,
+        meta: { count: errors.length }
+      });
+    } catch (err) {
+      sendInternalError(res, "Failed to get errors", "Failed to load errors", err);
+    }
+  });
+  router.get("/issues", (_req, res) => {
+    try {
+      const report = collectGraphIssues(db.loadGraph(), getProjectRoot());
+      res.json({
+        data: report.issues,
+        meta: {
+          count: report.summary.total,
+          ...report.summary,
+          detectors: report.detectors
+        }
+      });
+    } catch (err) {
+      sendInternalError(res, "Failed to get graph issues", "Failed to load graph issues", err);
+    }
+  });
+  router.get("/trace", (req, res) => {
+    try {
+      const nodeId = typeof req.query.node === "string" ? req.query.node : void 0;
+      if (!nodeId) {
+        return res.status(400).json({
+          error: { code: "MISSING_PARAM", message: 'Query param "node" is required' }
+        });
+      }
+      const graph = db.loadGraph();
+      const exists = graph.nodes.some((n) => n.id === nodeId);
+      if (!exists) {
+        return res.status(404).json({
+          error: { code: "NOT_FOUND", message: `Node not found: ${nodeId}` }
+        });
+      }
+      const tracer = new DataFlowTracer(graph);
+      const result = tracer.traceFromNode(nodeId);
+      res.json({ data: result, meta: { totalSteps: result.totalSteps } });
+    } catch (err) {
+      sendInternalError(res, "Failed to trace from node", "Failed to trace from node", err);
+    }
+  });
+  router.get("/dataflow", (req, res) => {
+    try {
+      const graph = db.loadGraph();
+      const tracer = new DataFlowTracer(graph);
+      const model = typeof req.query.model === "string" ? req.query.model : void 0;
+      if (model) {
+        const modelNode = graph.nodes.find(
+          (n) => n.type === "db_model" && (n.name === model || n.id.includes(model))
+        );
+        if (!modelNode) {
+          return res.status(404).json({
+            error: { code: "NOT_FOUND", message: `Model not found: ${model}` }
+          });
+        }
+        const path52 = tracer.traceModelFlow(modelNode);
+        res.json({
+          data: {
+            modelId: modelNode.id,
+            modelName: modelNode.name,
+            paths: [path52],
+            totalRoutes: path52.apiNodes.length,
+            totalComponents: path52.componentNodes.length
+          }
+        });
+      } else {
+        const results = tracer.traceAllModels();
+        res.json({
+          data: results,
+          meta: { count: results.length }
+        });
+      }
+    } catch (err) {
+      sendInternalError(res, "Failed to trace dataflow", "Failed to trace dataflow", err);
+    }
+  });
+  return router;
+}
+function createTestsRouter(db) {
+  const router = Router2();
+  router.get("/", (req, res) => {
+    const framework = typeof req.query.framework === "string" && isTestFramework(req.query.framework) ? req.query.framework : void 0;
+    const target = typeof req.query.target === "string" ? req.query.target : void 0;
+    const snapshot = db.loadSnapshot();
+    res.json({
+      data: projectTestView(db.loadGraph(), { framework, target }),
+      meta: {
+        snapshotId: snapshot?.snapshotId ?? null,
+        snapshotDigest: snapshot?.snapshotDigest ?? null
+      }
+    });
+  });
+  return router;
+}
+var codeomnivisEvents = new EventEmitter();
+var EVENTS = {
+  GRAPH_UPDATED: "graph:updated",
+  ANALYSIS_STARTED: "analysis:started",
+  ANALYSIS_COMPLETED: "analysis:completed",
+  STATUS_CHANGED: "status:changed"
+};
+var IGNORED_PATHS = [
+  /(^|[/\\])\../,
+  // dotfiles
+  /node_modules/,
+  /\.next/,
+  /[/\\]dist[/\\]/,
+  /[/\\]build[/\\]/,
+  /[/\\]coverage[/\\]/,
+  /\.codeomnivis/
+];
+var SOURCE_FILE_RE = /\.(ts|tsx|js|jsx|prisma)$/;
+var IncrementalAnalyzer = class {
+  watcher = null;
+  projectRoot;
+  dbPath;
+  db;
+  projectMeta;
+  debounceMs;
+  watchDirs;
+  debounceTimer = null;
+  // 新鲜度状态
+  state = "stale";
+  lastAnalyzedAt = null;
+  pendingChanges = 0;
+  isAnalyzing = false;
+  /** 分析进行中又来了新变更时置位,分析结束后补跑一次,避免丢失变更。 */
+  rerunRequested = false;
+  lastChangedFile = null;
+  /**
+   * 分析世代。每次切根 +1,用于作废切根前启动的在途/排队分析:
+   * 旧世代分析完成后不再广播结果、不再触发补跑。
+   */
+  generation = 0;
+  /** 当前在途分析的 promise(无在途时为 null),供切根时串行等待其落库完成。 */
+  analysisInFlight = null;
+  constructor(options) {
+    this.projectRoot = options.projectRoot;
+    this.dbPath = options.dbPath;
+    this.db = options.db;
+    this.projectMeta = options.projectMeta;
+    this.debounceMs = options.debounceMs ?? 1e3;
+    this.watchDirs = options.watchDirs;
+  }
+  /** 当前监听的项目根路径。 */
+  getProjectRoot() {
+    return this.projectRoot;
+  }
+  /**
+   * 运行时切换项目根目录。
+   * 停止旧监听 -> 稳定并快照旧状态 -> 分析目标 -> 成功提交或失败回滚。
+   * 调用方需先确保 newRoot 是存在的目录;此处再次防御性校验。
+   */
+  async setProjectRoot(newRoot, projectMeta) {
+    const resolved = path5.resolve(newRoot);
+    if (!fs4.existsSync(resolved) || !fs4.statSync(resolved).isDirectory()) {
+      throw new Error(`Project root is not an existing directory: ${resolved}`);
+    }
+    const wasWatching = this.watcher !== null;
+    await this.stop();
+    if (this.analysisInFlight) {
+      try {
+        await this.analysisInFlight;
+      } catch {
+      }
+    }
+    const snapshot = this.captureProjectSwitchSnapshot(wasWatching);
+    this.generation += 1;
+    try {
+      this.projectRoot = resolved;
+      this.projectMeta = resolved === snapshot.projectRoot && projectMeta === void 0 ? snapshot.projectMeta : projectMeta;
+      if (!this.db.clearGraph()) {
+        throw new Error("Failed to clear graph before project analysis");
+      }
+      this.pendingChanges = 0;
+      this.lastChangedFile = null;
+      this.lastAnalyzedAt = null;
+      this.rerunRequested = false;
+      this.setState("stale");
+      if (wasWatching) this.start();
+      await this.refresh();
+    } catch (err) {
+      this.generation += 1;
+      await this.stop();
+      const rollbackError = this.restoreProjectSwitchSnapshot(snapshot);
+      if (snapshot.wasWatching) this.start();
+      this.setState(snapshot.state);
+      const failure = err instanceof Error ? err : new Error(String(err));
+      if (rollbackError !== null) {
+        throw new AggregateError(
+          [failure, rollbackError],
+          `Project switch failed and rollback was incomplete: ${rollbackError.message}`,
+          { cause: err }
+        );
+      }
+      throw failure;
+    }
+  }
+  captureProjectSwitchSnapshot(wasWatching) {
+    return {
+      projectRoot: this.projectRoot,
+      projectMeta: this.projectMeta,
+      graph: this.db.loadGraph(),
+      errors: this.db.getAllErrors(),
+      state: this.state,
+      lastAnalyzedAt: this.lastAnalyzedAt,
+      pendingChanges: this.pendingChanges,
+      rerunRequested: this.rerunRequested,
+      lastChangedFile: this.lastChangedFile,
+      wasWatching
+    };
+  }
+  /** Restore fields even when DB restoration fails, so roots and watcher authority never stay split. */
+  restoreProjectSwitchSnapshot(snapshot) {
+    this.projectRoot = snapshot.projectRoot;
+    this.projectMeta = snapshot.projectMeta;
+    this.state = snapshot.state;
+    this.lastAnalyzedAt = snapshot.lastAnalyzedAt;
+    this.pendingChanges = snapshot.pendingChanges;
+    this.rerunRequested = snapshot.rerunRequested;
+    this.lastChangedFile = snapshot.lastChangedFile;
+    if (!this.db.clearGraph()) {
+      return new Error("Failed to clear the failed target graph during rollback");
+    }
+    const restored = this.db.saveGraph(snapshot.graph);
+    const restoredErrors = this.db.insertErrors(snapshot.errors);
+    if (restored.nodesSaved !== snapshot.graph.nodes.length || restored.edgesSaved !== snapshot.graph.edges.length || restoredErrors !== snapshot.errors.length) {
+      return new Error("Failed to restore the complete project analysis snapshot");
+    }
+    return null;
+  }
+  /** 当前新鲜度快照(供 REST / WS 读取)。 */
+  getStatus() {
+    return {
+      state: this.state,
+      lastAnalyzedAt: this.lastAnalyzedAt,
+      pendingChanges: this.pendingChanges
+    };
+  }
+  /** 切换状态并广播。 */
+  setState(next) {
+    if (this.state === next) {
+      codeomnivisEvents.emit(EVENTS.STATUS_CHANGED, this.getStatus());
+      return;
+    }
+    this.state = next;
+    codeomnivisEvents.emit(EVENTS.STATUS_CHANGED, this.getStatus());
+  }
+  /** 解析智能监听目标:显式 watchDirs(存在的)或整个 projectRoot。 */
+  resolveWatchTargets() {
+    if (this.watchDirs && this.watchDirs.length > 0) {
+      return this.watchDirs.map((dir) => path5.join(this.projectRoot, dir)).filter((dir) => fs4.existsSync(dir));
+    }
+    return fs4.existsSync(this.projectRoot) ? [this.projectRoot] : [];
+  }
+  /**
+   * 启动文件监听
+   */
+  start() {
+    const dirsToWatch = this.resolveWatchTargets();
+    if (dirsToWatch.length === 0) {
+      console.warn("[IncrementalAnalyzer] No directories to watch");
+      return;
+    }
+    this.watcher = chokidar.watch(dirsToWatch, {
+      ignored: IGNORED_PATHS,
+      persistent: true,
+      ignoreInitial: true
+    });
+    this.watcher.on("change", (filePath) => this.onFileChange(filePath));
+    this.watcher.on("add", (filePath) => this.onFileChange(filePath));
+    this.watcher.on("unlink", (filePath) => this.onFileChange(filePath));
+    console.log(`[IncrementalAnalyzer] Smart-watching ${dirsToWatch.length} target(s)`);
+  }
+  /**
+   * 文件变更处理(防抖)
+   */
+  onFileChange(filePath) {
+    if (!SOURCE_FILE_RE.test(filePath)) return;
+    console.log(`[IncrementalAnalyzer] File changed: ${path5.relative(this.projectRoot, filePath)}`);
+    this.pendingChanges += 1;
+    this.lastChangedFile = filePath;
+    if (!this.isAnalyzing) {
+      this.setState("stale");
+    }
+    if (this.debounceTimer) {
+      clearTimeout(this.debounceTimer);
+    }
+    this.debounceTimer = setTimeout(() => {
+      void this.triggerAnalysis(filePath);
+    }, this.debounceMs);
+  }
+  /**
+   * 手动触发重新分析(REST 兜底入口)。
+   * 与文件监听共用串行化逻辑;分析进行中则记为补跑请求。
+   */
+  async refresh(onFilesCollected) {
+    await this.triggerAnalysis(this.lastChangedFile, true, onFilesCollected);
+  }
+  /**
+   * 触发增量分析(串行化,不丢失分析期间到达的变更)
+   */
+  async triggerAnalysis(filePath, manual = false, onFilesCollected) {
+    if (this.isAnalyzing) {
+      console.log("[IncrementalAnalyzer] Analysis in progress, queuing rerun");
+      this.rerunRequested = true;
+      return;
+    }
+    const myGeneration = this.generation;
+    const run = this.runAnalysisCycle(filePath, myGeneration, manual, onFilesCollected);
+    this.analysisInFlight = run;
+    try {
+      await run;
+    } finally {
+      if (this.analysisInFlight === run) {
+        this.analysisInFlight = null;
+      }
+    }
+  }
+  /** 实际执行一轮分析;myGeneration 用于切根后作废过期结果。 */
+  async runAnalysisCycle(filePath, myGeneration, manual, onFilesCollected) {
+    this.isAnalyzing = true;
+    this.setState("analyzing");
+    codeomnivisEvents.emit(EVENTS.ANALYSIS_STARTED);
+    const consumed = this.pendingChanges;
+    this.pendingChanges = 0;
+    let failure = null;
+    try {
+      console.log("[IncrementalAnalyzer] Running re-analysis...");
+      await runAnalysis({
+        projectRoot: this.projectRoot,
+        dbPath: this.dbPath,
+        projectMeta: this.projectMeta,
+        onFilesCollected,
+        // 共享 server 持有的同一 DB 句柄(修复 RACE-01::memory: 下查询层才读得到结果)。
+        db: this.db
+      });
+      if (myGeneration !== this.generation) {
+        console.log("[IncrementalAnalyzer] Stale analysis (root switched), discarding result");
+        return;
+      }
+      console.log("[IncrementalAnalyzer] Re-analysis complete");
+      this.lastAnalyzedAt = Date.now();
+      codeomnivisEvents.emit(EVENTS.GRAPH_UPDATED, filePath);
+      codeomnivisEvents.emit(EVENTS.ANALYSIS_COMPLETED);
+    } catch (err) {
+      console.error("[IncrementalAnalyzer] Analysis failed:", err);
+      failure = err;
+      this.pendingChanges += consumed;
+    } finally {
+      this.isAnalyzing = false;
+      if (myGeneration !== this.generation) {
+        this.rerunRequested = false;
+      } else if (this.rerunRequested) {
+        this.rerunRequested = false;
+        const next = this.lastChangedFile;
+        await this.triggerAnalysis(next);
+      } else {
+        this.setState(failure !== null || this.pendingChanges > 0 ? "stale" : "fresh");
+      }
+    }
+    if (manual && failure !== null) {
+      throw failure instanceof Error ? failure : new Error(String(failure));
+    }
+  }
+  /**
+   * 停止文件监听
+   */
+  async stop() {
+    if (this.debounceTimer) {
+      clearTimeout(this.debounceTimer);
+      this.debounceTimer = null;
+    }
+    if (this.watcher) {
+      const watcher = this.watcher;
+      this.watcher = null;
+      await watcher.close();
+    }
+    console.log("[IncrementalAnalyzer] Stopped");
+  }
+};
+var DEFAULT_AI_LIMITS = {
+  timeoutMs: 1e4,
+  maxRequestBytes: 256 * 1024,
+  maxResponseBytes: 1024 * 1024,
+  maxConcurrentPerIdentity: 2,
+  requestsPerMinute: 20
+};
+var AiPolicyError = class extends Error {
+  constructor(code, status, message) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "AiPolicyError";
+  }
+  code;
+  status;
+};
+function isLiteralLoopback(hostname) {
+  const normalized = hostname.replace(/^\[|\]$/gu, "");
+  return normalized === "localhost" || normalized === "::1" || /^127\./u.test(normalized);
+}
+async function resolveUpstreamDestination(baseUrl, resolver, allowLoopback = true) {
+  const literalCheck = validateUpstreamBaseUrl(baseUrl);
+  if (!literalCheck.ok) {
+    throw new AiPolicyError("AI_DESTINATION_REJECTED", 400, "AI base URL is not allowed");
+  }
+  const url = new URL(baseUrl.replace(/\/+$/u, "") + "/chat/completions");
+  const hostname = url.hostname;
+  if (isLiteralLoopback(hostname) && !allowLoopback) {
+    throw new AiPolicyError("AI_DESTINATION_REJECTED", 400, "Loopback AI providers are disabled");
+  }
+  if (hostname === "localhost") return { url, hostname };
+  if (isIpLiteral(hostname)) {
+    const family2 = isIP(hostname.replace(/^\[|\]$/gu, ""));
+    return {
+      url,
+      hostname,
+      address: hostname.replace(/^\[|\]$/gu, ""),
+      family: family2 === 6 ? 6 : 4
+    };
+  }
+  let addresses;
+  try {
+    addresses = await resolver(hostname);
+  } catch {
+    throw new AiPolicyError("AI_DESTINATION_REJECTED", 400, "AI hostname could not be resolved");
+  }
+  const resolvedCheck = validateResolvedAddresses(addresses);
+  if (!resolvedCheck.ok) {
+    throw new AiPolicyError(
+      "AI_DESTINATION_REJECTED",
+      400,
+      "AI hostname resolved to a blocked address"
+    );
+  }
+  const address = addresses[0];
+  const family = isIP(address);
+  if (family !== 4 && family !== 6) {
+    throw new AiPolicyError("AI_DESTINATION_REJECTED", 400, "AI hostname resolution was invalid");
+  }
+  return { url, hostname, address, family };
+}
+async function readBoundedBody(body, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of body) {
+    total += chunk.byteLength;
+    if (total > maxBytes) {
+      throw new AiPolicyError("AI_RESPONSE_TOO_LARGE", 502, "Upstream AI response was too large");
+    }
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks, total).toString("utf8");
+}
+function matchesValidatedAddress(peerAddress, validatedAddress) {
+  return peerAddress === validatedAddress || peerAddress === `::ffff:${validatedAddress}`;
+}
+function createPinnedAgent(destination) {
+  let peerAddress;
+  if (!destination.address || !destination.family || isLiteralLoopback(destination.hostname)) {
+    return {
+      dispatcher: new Agent({ maxRedirections: 0 }),
+      getPeerAddress: () => peerAddress
+    };
+  }
+  const { address, family } = destination;
+  const connector = buildConnector({
+    // A validated destination contains exactly one pinned address; Node's
+    // multi-address family selection would request the incompatible `all` lookup shape.
+    autoSelectFamily: false,
+    lookup: (_hostname, _options, callback) => callback(null, address, family)
+  });
+  const verifiedConnector = (options, callback) => {
+    connector(options, (error, socket) => {
+      if (error) {
+        callback(error, null);
+        return;
+      }
+      peerAddress = socket.remoteAddress;
+      if (!peerAddress || !matchesValidatedAddress(peerAddress, address)) {
+        socket.destroy();
+        callback(new Error("AI upstream peer address did not match validated DNS"), null);
+        return;
+      }
+      callback(null, socket);
+    });
+  };
+  return {
+    dispatcher: new Agent({ connect: verifiedConnector, maxRedirections: 0 }),
+    getPeerAddress: () => peerAddress
+  };
+}
+var defaultAiHttpClient = async (request) => {
+  const pinnedAgent = createPinnedAgent(request.destination);
+  try {
+    const response = await undiciRequest(request.destination.url, {
+      method: "POST",
+      headers: request.headers,
+      body: request.body,
+      dispatcher: pinnedAgent.dispatcher,
+      maxRedirections: 0,
+      signal: request.signal
+    });
+    return {
+      status: response.statusCode,
+      body: response.body,
+      peerAddress: pinnedAgent.getPeerAddress(),
+      close: async () => pinnedAgent.dispatcher.close()
+    };
+  } catch (err) {
+    await pinnedAgent.dispatcher.close().catch(() => {
+    });
+    throw err;
+  }
+};
+var RequestLimiter = class {
+  constructor(options) {
+    this.options = options;
+    this.maxIdentities = options.maxIdentities ?? 1e3;
+  }
+  options;
+  states = /* @__PURE__ */ new Map();
+  maxIdentities;
+  acquire(identity, now = Date.now()) {
+    let state = this.states.get(identity);
+    if (!state) {
+      while (this.states.size >= this.maxIdentities) {
+        const oldest = this.states.keys().next().value;
+        if (typeof oldest !== "string") break;
+        this.states.delete(oldest);
+      }
+      state = { windowStartedAt: now, requests: 0, inFlight: 0 };
+      this.states.set(identity, state);
+    }
+    if (now - state.windowStartedAt >= this.options.windowMs) {
+      state.windowStartedAt = now;
+      state.requests = 0;
+    }
+    if (state.inFlight >= this.options.maxConcurrent) {
+      return { ok: false, reason: "concurrency" };
+    }
+    if (state.requests >= this.options.requestsPerWindow) {
+      return { ok: false, reason: "rate" };
+    }
+    state.requests += 1;
+    state.inFlight += 1;
+    let released = false;
+    return {
+      ok: true,
+      release: () => {
+        if (released) return;
+        released = true;
+        state.inFlight = Math.max(0, state.inFlight - 1);
+      }
+    };
+  }
+};
+var defaultResolver = async (hostname) => {
+  const records = await dns.lookup(hostname, { all: true });
+  return records.map((record) => record.address);
+};
+function readAiEnv(env) {
+  return {
+    baseUrl: env.AI_BASE_URL,
+    apiKey: env.AI_API_KEY,
+    model: env.AI_MODEL
+  };
+}
+function extractContent(payload) {
+  if (!isJsonObject(payload) || !Array.isArray(payload.choices) || payload.choices.length === 0) {
+    return null;
+  }
+  const first = payload.choices[0];
+  if (!isJsonObject(first) || !isJsonObject(first.message)) return null;
+  return typeof first.message.content === "string" ? first.message.content : null;
+}
+async function callAiChat(config, messages, options = {}) {
+  const client = options.client ?? defaultAiHttpClient;
+  const resolver = options.resolver ?? defaultResolver;
+  const limits = options.limits ?? DEFAULT_AI_LIMITS;
+  const requestBody = JSON.stringify({ model: config.model, messages });
+  if (Buffer.byteLength(requestBody, "utf8") > limits.maxRequestBytes) {
+    throw new AiPolicyError("AI_REQUEST_TOO_LARGE", 413, "AI request body was too large");
+  }
+  const destination = await resolveUpstreamDestination(
+    config.baseUrl,
+    resolver,
+    options.allowLoopback ?? true
+  );
+  const signal = AbortSignal.timeout(limits.timeoutMs);
+  let upstream;
+  try {
+    upstream = await client({
+      destination,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${config.apiKey}`
+      },
+      body: requestBody,
+      signal
+    });
+  } catch (err) {
+    if (signal.aborted) {
+      throw new AiPolicyError("AI_UPSTREAM_TIMEOUT", 504, "Upstream AI request timed out");
+    }
+    if (err instanceof AiPolicyError) throw err;
+    throw new AiPolicyError("AI_UPSTREAM_FAILED", 502, "Upstream AI request failed");
+  }
+  try {
+    if (destination.address && upstream.peerAddress && !matchesValidatedAddress(upstream.peerAddress, destination.address)) {
+      throw new AiPolicyError(
+        "AI_UPSTREAM_PEER_MISMATCH",
+        502,
+        "Upstream AI peer address was rejected"
+      );
+    }
+    if (upstream.status >= 300 && upstream.status < 400) {
+      throw new AiPolicyError("AI_UPSTREAM_REDIRECT", 502, "Upstream AI redirect was rejected");
+    }
+    if (upstream.status < 200 || upstream.status >= 300) {
+      throw new AiPolicyError("AI_UPSTREAM_FAILED", 502, "Upstream AI request failed");
+    }
+    const responseText = await readBoundedBody(upstream.body, limits.maxResponseBytes);
+    let payload;
+    try {
+      payload = JSON.parse(responseText);
+    } catch {
+      throw new AiPolicyError("AI_RESPONSE_INVALID", 502, "Upstream AI response was invalid");
+    }
+    const content = extractContent(payload);
+    if (content === null) {
+      throw new AiPolicyError("AI_RESPONSE_INVALID", 502, "Upstream AI response was invalid");
+    }
+    return content;
+  } catch (err) {
+    if (signal.aborted) {
+      throw new AiPolicyError("AI_UPSTREAM_TIMEOUT", 504, "Upstream AI request timed out");
+    }
+    throw err;
+  } finally {
+    await upstream.close().catch(() => {
+    });
+  }
+}
+function requestIdentity(req) {
+  const source = req.headers.authorization ?? req.headers.cookie ?? req.socket.remoteAddress ?? "local";
+  return createHash("sha256").update(source).digest("hex");
+}
+function sendError(res, error) {
+  res.status(error.status).json({ error: { code: error.code, message: error.message } });
+}
+async function handleChat(req, res, resolver, options) {
+  const body = req.body;
+  const parsed = parseAiChatRequest(body);
+  if (parsed === null) {
+    sendError(res, new AiPolicyError("AI_REQUEST_INVALID", 400, "Invalid AI chat request body"));
+    return;
+  }
+  const config = resolveAiConfig(parsed.config, readAiEnv(process.env));
+  if (config === null) {
+    res.status(501).json({
+      error: {
+        code: "AI_NOT_CONFIGURED",
+        message: "Connect an API key in settings to enable AI features"
+      }
+    });
+    return;
+  }
+  const acquired = options.limiter.acquire(requestIdentity(req));
+  if (!acquired.ok) {
+    const concurrency = acquired.reason === "concurrency";
+    sendError(
+      res,
+      new AiPolicyError(
+        concurrency ? "AI_CONCURRENCY_LIMIT" : "AI_RATE_LIMIT",
+        429,
+        concurrency ? "Too many concurrent AI requests" : "AI request rate limit exceeded"
+      )
+    );
+    return;
+  }
+  try {
+    const content = await callAiChat(config, parsed.messages, {
+      client: options.client,
+      resolver,
+      limits: options.limits,
+      allowLoopback: options.allowLoopback
+    });
+    res.json({ data: { content }, meta: {} });
+  } catch (err) {
+    sendError(
+      res,
+      err instanceof AiPolicyError ? err : new AiPolicyError("AI_UPSTREAM_FAILED", 502, "Upstream AI request failed")
+    );
+  } finally {
+    acquired.release();
+  }
+}
+function registerAiRoutes(app, resolver = defaultResolver, accessGuard, routeOptions = {}) {
+  const guard = accessGuard ?? ((_req, _res, next) => next());
+  const limits = { ...DEFAULT_AI_LIMITS, ...routeOptions.limits };
+  const handlerOptions = {
+    client: routeOptions.client ?? defaultAiHttpClient,
+    limits,
+    allowLoopback: routeOptions.allowLoopback ?? true,
+    limiter: new RequestLimiter({
+      maxConcurrent: limits.maxConcurrentPerIdentity,
+      requestsPerWindow: limits.requestsPerMinute,
+      windowMs: 6e4
+    })
+  };
+  app.post("/api/ai/chat", guard, (req, res) => {
+    void handleChat(req, res, resolver, handlerOptions);
+  });
+  app.post("/api/ai/explain", guard, (req, res) => {
+    void handleChat(req, res, resolver, handlerOptions);
+  });
+}
+var SESSION_COOKIE_NAME = "codeomnivis_session";
+function isLoopbackHost(host) {
+  const normalized = host.replace(/^\[|\]$/g, "").toLowerCase();
+  return normalized === "localhost" || normalized === "::1" || /^127\./u.test(normalized);
+}
+function digestToken(token) {
+  return createHash2("sha256").update(token, "utf8").digest();
+}
+function tokenMatches(provided, expected) {
+  if (!expected) return false;
+  return timingSafeEqual(digestToken(provided), expected);
+}
+function bearerToken(headers) {
+  const authorization = headers.authorization;
+  if (typeof authorization === "string") {
+    const match = /^Bearer\s+(.+)$/iu.exec(authorization.trim());
+    if (match) return match[1].trim();
+  }
+  const legacy = headers["x-access-token"];
+  if (typeof legacy === "string" && legacy.trim() !== "") return legacy.trim();
+  return void 0;
+}
+function sessionCookie(headers) {
+  const cookie = headers.cookie;
+  if (typeof cookie !== "string") return void 0;
+  for (const segment of cookie.split(";")) {
+    const separator = segment.indexOf("=");
+    if (separator < 0) continue;
+    const name = segment.slice(0, separator).trim();
+    if (name === SESSION_COOKIE_NAME) return segment.slice(separator + 1).trim();
+  }
+  return void 0;
+}
+function createAccessPolicy(options) {
+  return {
+    loopback: isLoopbackHost(options.host),
+    accessTokenDigest: options.accessToken ? digestToken(options.accessToken) : void 0,
+    sessions: options.sessions,
+    secureCookies: options.secureCookies
+  };
+}
+function authenticateHeaders(headers, policy) {
+  if (policy.loopback) return { ok: true };
+  if (!policy.accessTokenDigest) {
+    return { ok: false, status: 403, code: "AUTH_NOT_CONFIGURED" };
+  }
+  const providedToken = bearerToken(headers);
+  if (providedToken && tokenMatches(providedToken, policy.accessTokenDigest)) {
+    return { ok: true };
+  }
+  const sessionId = sessionCookie(headers);
+  if (sessionId && policy.sessions.validate(sessionId)) return { ok: true };
+  return { ok: false, status: 401, code: "UNAUTHORIZED" };
+}
+function sendAccessError(res, decision) {
+  const message = decision.code === "AUTH_NOT_CONFIGURED" ? "Remote access is disabled because no access token is configured" : "A valid access token or session is required for this operation";
+  res.status(decision.status).json({ error: { code: decision.code, message } });
+}
+function createAccessGuard(policy) {
+  return (req, res, next) => {
+    const decision = authenticateHeaders(req.headers, policy);
+    if (!decision.ok) {
+      sendAccessError(res, decision);
+      return;
+    }
+    next();
+  };
+}
+function createSessionHandler(policy) {
+  return (req, res) => {
+    if (!policy.accessTokenDigest) {
+      sendAccessError(res, { ok: false, status: 403, code: "AUTH_NOT_CONFIGURED" });
+      return;
+    }
+    const body = req.body;
+    const accessToken = isJsonObject(body) ? body.accessToken : void 0;
+    if (typeof accessToken !== "string" || !tokenMatches(accessToken, policy.accessTokenDigest)) {
+      sendAccessError(res, { ok: false, status: 401, code: "UNAUTHORIZED" });
+      return;
+    }
+    const session = policy.sessions.create();
+    const attributes = [
+      `${SESSION_COOKIE_NAME}=${session.id}`,
+      "HttpOnly",
+      "SameSite=Strict",
+      "Path=/",
+      `Max-Age=${Math.floor(policy.sessions.ttlMs / 1e3)}`
+    ];
+    if (policy.secureCookies) attributes.push("Secure");
+    res.setHeader("Set-Cookie", attributes.join("; "));
+    res.json({ data: { expiresAt: session.expiresAt }, meta: {} });
+  };
+}
+var SessionStore = class {
+  ttlMs;
+  maxSessions;
+  sessions = /* @__PURE__ */ new Map();
+  cleanupTimer;
+  constructor(options) {
+    if (!Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {
+      throw new Error("Session ttlMs must be a positive finite number");
+    }
+    if (!Number.isInteger(options.maxSessions) || options.maxSessions <= 0) {
+      throw new Error("Session maxSessions must be a positive integer");
+    }
+    this.ttlMs = options.ttlMs;
+    this.maxSessions = options.maxSessions;
+    this.cleanupTimer = setInterval(
+      () => this.removeExpired(Date.now()),
+      Math.min(this.ttlMs, 6e4)
+    );
+    this.cleanupTimer.unref();
+  }
+  create(now = Date.now()) {
+    this.removeExpired(now);
+    while (this.sessions.size >= this.maxSessions) {
+      const oldest = this.sessions.keys().next().value;
+      if (typeof oldest !== "string") break;
+      this.sessions.delete(oldest);
+    }
+    const record = {
+      id: randomBytes(32).toString("base64url"),
+      expiresAt: now + this.ttlMs
+    };
+    this.sessions.set(record.id, record.expiresAt);
+    return record;
+  }
+  validate(id, now = Date.now()) {
+    const expiresAt = this.sessions.get(id);
+    if (expiresAt === void 0) return false;
+    if (expiresAt <= now) {
+      this.sessions.delete(id);
+      return false;
+    }
+    return true;
+  }
+  revoke(id) {
+    this.sessions.delete(id);
+  }
+  clear() {
+    this.sessions.clear();
+  }
+  dispose() {
+    clearInterval(this.cleanupTimer);
+    this.clear();
+  }
+  removeExpired(now) {
+    for (const [id, expiresAt] of this.sessions) {
+      if (expiresAt <= now) this.sessions.delete(id);
+    }
+  }
+};
+function toOriginAllowlist(corsOrigin) {
+  return Array.isArray(corsOrigin) ? corsOrigin : [corsOrigin];
+}
+function isOriginAllowed(origin, allowlist) {
+  if (origin === void 0 || origin === "") return true;
+  if (allowlist.includes("*")) return true;
+  if (allowlist.includes(origin)) return true;
+  try {
+    const candidate = new URL(origin);
+    return allowlist.some((allowed) => {
+      const configured = new URL(allowed);
+      return candidate.protocol === configured.protocol && candidate.port === configured.port && isLoopbackHost(candidate.hostname) && isLoopbackHost(configured.hostname);
+    });
+  } catch {
+    return false;
+  }
+}
+function isWithin(parent, child) {
+  if (parent === child) return true;
+  const rel = path22.relative(parent, child);
+  return rel !== ".." && !rel.startsWith(`..${path22.sep}`) && !path22.isAbsolute(rel);
+}
+function realpathBestEffort(target) {
+  let current = path22.resolve(target);
+  const tail = [];
+  for (; ; ) {
+    try {
+      const real = fs22.realpathSync.native(current);
+      return tail.length === 0 ? real : path22.join(real, ...tail.reverse());
+    } catch {
+      const parent = path22.dirname(current);
+      if (parent === current) {
+        return path22.resolve(target);
+      }
+      tail.push(path22.basename(current));
+      current = parent;
+    }
+  }
+}
+function resolveWithinBoundary(boundaryRoot, input) {
+  const root = path22.resolve(boundaryRoot);
+  const resolved = path22.resolve(root, input);
+  const rel = path22.relative(root, resolved);
+  const escapes = rel === ".." || rel.startsWith(`..${path22.sep}`) || path22.isAbsolute(rel);
+  if (escapes) {
+    return { ok: false, resolved };
+  }
+  const realRoot = realpathBestEffort(root);
+  const realResolved = realpathBestEffort(resolved);
+  if (!isWithin(realRoot, realResolved)) {
+    return { ok: false, resolved };
+  }
+  return { ok: true, resolved };
+}
+function resolveProjectRootRequest(startupRoot, requestedRoot, allowArbitraryAbsolute) {
+  if (allowArbitraryAbsolute && path32.isAbsolute(requestedRoot)) {
+    return { ok: true, resolved: path32.resolve(requestedRoot) };
+  }
+  return resolveWithinBoundary(startupRoot, requestedRoot);
+}
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = path42.dirname(__filename);
+function createOmniServer(options = {}) {
+  const {
+    port = 4321,
+    host = "localhost",
+    dbPath = ":memory:",
+    projectRoot = process.cwd(),
+    projectMeta,
+    detectProjectMeta,
+    uiDistPath = path42.resolve(__dirname, "../../ui/dist"),
+    corsOrigin = `http://localhost:${port}`,
+    accessToken,
+    secureCookies,
+    sessionTtlMs = 15 * 60 * 1e3,
+    maxSessions = 128
+  } = options;
+  const app = express();
+  app.disable("x-powered-by");
+  app.use((_req, res, next) => {
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("X-DNS-Prefetch-Control", "off");
+    next();
+  });
+  app.locals.projectRoot = path42.resolve(projectRoot);
+  app.locals.dbPath = dbPath;
+  app.use(cors({ origin: corsOrigin, credentials: true }));
+  app.use(express.json());
+  const db = new OmniDatabase(dbPath);
+  const incrementalAnalyzer = new IncrementalAnalyzer({
+    projectRoot,
+    dbPath,
+    db,
+    projectMeta
+  });
+  const sessions = new SessionStore({ ttlMs: sessionTtlMs, maxSessions });
+  const accessPolicy = createAccessPolicy({
+    host,
+    accessToken,
+    sessions,
+    secureCookies: secureCookies ?? (Array.isArray(corsOrigin) ? corsOrigin.some((origin) => origin.startsWith("https://")) : corsOrigin.startsWith("https://"))
+  });
+  const accessGuard = createAccessGuard(accessPolicy);
+  const allowArbitraryAbsoluteProjectRoots = isLoopbackHost(host);
+  app.post("/api/session", createSessionHandler(accessPolicy));
+  const graphRouter = createGraphRouter(db, void 0, () => app.locals.projectRoot);
+  app.use("/api/graph", accessGuard, graphRouter);
+  app.use("/api/tests", accessGuard, createTestsRouter(db));
+  app.get("/api/health", (_req, res) => {
+    res.json({ status: "ok", timestamp: Date.now() });
+  });
+  app.get("/api/status", accessGuard, (_req, res) => {
+    res.json({ data: incrementalAnalyzer.getStatus(), meta: {} });
+  });
+  app.get("/api/project", accessGuard, (_req, res) => {
+    res.json({ data: { projectRoot: app.locals.projectRoot }, meta: {} });
+  });
+  app.post("/api/analyze", accessGuard, async (_req, res) => {
+    try {
+      await incrementalAnalyzer.refresh();
+      res.json({ data: { success: true, status: incrementalAnalyzer.getStatus() }, meta: {} });
+    } catch (err) {
+      console.error("Analysis failed:", err);
+      res.status(500).json({
+        error: {
+          code: "ANALYSIS_FAILED",
+          message: err instanceof Error ? err.message : String(err)
+        }
+      });
+    }
+  });
+  app.post("/api/project", accessGuard, async (req, res) => {
+    const body = req.body;
+    const projectRootInput = isJsonObject(body) ? body.projectRoot : void 0;
+    if (typeof projectRootInput !== "string" || projectRootInput.trim() === "") {
+      res.status(400).json({
+        error: { code: "INVALID_INPUT", message: "projectRoot must be a non-empty string" }
+      });
+      return;
+    }
+    const boundaryRoot = path42.resolve(projectRoot);
+    const { ok, resolved } = resolveProjectRootRequest(
+      boundaryRoot,
+      projectRootInput.trim(),
+      allowArbitraryAbsoluteProjectRoots
+    );
+    if (!ok) {
+      res.status(400).json({
+        error: {
+          code: "PATH_TRAVERSAL",
+          message: `projectRoot escapes the allowed boundary: ${boundaryRoot}`
+        }
+      });
+      return;
+    }
+    if (!fs3.existsSync(resolved) || !fs3.statSync(resolved).isDirectory()) {
+      res.status(400).json({
+        error: { code: "INVALID_PROJECT_ROOT", message: `Not an existing directory: ${resolved}` }
+      });
+      return;
+    }
+    let targetProjectMeta;
+    try {
+      targetProjectMeta = await detectProjectMeta?.(resolved);
+    } catch (err) {
+      console.error("Failed to detect target project metadata:", err);
+      res.status(500).json({
+        error: {
+          code: "PROJECT_DETECTION_FAILED",
+          message: "Failed to detect the target project structure"
+        }
+      });
+      return;
+    }
+    try {
+      await incrementalAnalyzer.setProjectRoot(resolved, targetProjectMeta);
+      app.locals.projectRoot = resolved;
+      res.json({
+        data: { projectRoot: resolved, status: incrementalAnalyzer.getStatus() },
+        meta: {}
+      });
+    } catch (err) {
+      console.error("Failed to switch project root:", err);
+      res.status(500).json({
+        error: {
+          code: "PROJECT_SWITCH_FAILED",
+          message: "Failed to switch project"
+        }
+      });
+    }
+  });
+  registerAiRoutes(app, void 0, accessGuard, { allowLoopback: accessPolicy.loopback });
+  app.use(express.static(uiDistPath));
+  app.get("*", (_req, res) => {
+    res.sendFile(path42.join(uiDistPath, "index.html"));
+  });
+  const server = createHttpServer(app);
+  const wsOriginAllowlist = toOriginAllowlist(corsOrigin);
+  const wss = new WebSocketServer({
+    server,
+    path: "/ws",
+    verifyClient: (info, done) => {
+      const origin = info.origin;
+      if (!isOriginAllowed(origin, wsOriginAllowlist)) {
+        console.warn(`WebSocket upgrade rejected: disallowed Origin "${origin ?? ""}"`);
+        done(false, 403, "Forbidden Origin");
+        return;
+      }
+      const decision = authenticateHeaders(info.req.headers, accessPolicy);
+      if (!decision.ok) {
+        console.warn(`WebSocket upgrade rejected: ${decision.code}`);
+        done(false, decision.status, decision.code);
+        return;
+      }
+      done(true);
+    }
+  });
+  const clients = /* @__PURE__ */ new Set();
+  wss.on("connection", (ws) => {
+    clients.add(ws);
+    console.log(`WebSocket client connected. Total: ${clients.size}`);
+    ws.on("close", () => {
+      clients.delete(ws);
+      console.log(`WebSocket client disconnected. Total: ${clients.size}`);
+    });
+    ws.on("error", (err) => {
+      console.error("WebSocket error:", err);
+      clients.delete(ws);
+    });
+  });
+  wss.on("error", (err) => {
+    console.error("WebSocketServer error:", err);
+  });
+  function broadcastGraphUpdate() {
+    try {
+      const graph = db.loadGraph();
+      const message = JSON.stringify({
+        type: "graph_updated",
+        payload: graph,
+        timestamp: Date.now()
+      });
+      for (const client of clients) {
+        if (client.readyState === WebSocket.OPEN) {
+          client.send(message);
+        }
+      }
+    } catch (err) {
+      console.error("Failed to broadcast graph update:", err);
+    }
+  }
+  const onGraphUpdated = () => {
+    broadcastGraphUpdate();
+  };
+  codeomnivisEvents.on(EVENTS.GRAPH_UPDATED, onGraphUpdated);
+  function broadcastStatus(status) {
+    const message = JSON.stringify({
+      type: "status_changed",
+      payload: status,
+      timestamp: Date.now()
+    });
+    for (const client of clients) {
+      if (client.readyState === WebSocket.OPEN) {
+        client.send(message);
+      }
+    }
+  }
+  const onStatusChanged = (status) => {
+    broadcastStatus(status);
+  };
+  codeomnivisEvents.on(EVENTS.STATUS_CHANGED, onStatusChanged);
+  let startState = "idle";
+  let tearingDown = false;
+  const handleExit = (signal) => {
+    if (tearingDown) return;
+    tearingDown = true;
+    console.log(`Received ${signal}, releasing resources...`);
+    void stop().then(() => process.exit(0)).catch((err) => {
+      console.error("Teardown failed:", err);
+      process.exit(1);
+    });
+  };
+  async function start() {
+    if (startState !== "idle") {
+      throw new Error(`server.start() cannot run in state '${startState}'`);
+    }
+    startState = "starting";
+    await db.ready();
+    incrementalAnalyzer.start();
+    process.on("SIGINT", handleExit);
+    process.on("SIGTERM", handleExit);
+    return new Promise((resolve22, reject) => {
+      const onError = (err) => {
+        server.removeListener("listening", onListening);
+        process.removeListener("SIGINT", handleExit);
+        process.removeListener("SIGTERM", handleExit);
+        startState = "stopped";
+        reject(err);
+        void incrementalAnalyzer.stop().catch(() => {
+        });
+      };
+      const onListening = () => {
+        server.removeListener("error", onError);
+        startState = "listening";
+        console.log(`CodeOmniVis server running at http://${host}:${port}`);
+        console.log(`WebSocket available at ws://${host}:${port}/ws`);
+        resolve22();
+      };
+      server.once("error", onError);
+      server.once("listening", onListening);
+      server.listen(port, host);
+    });
+  }
+  async function analyze(onFilesCollected) {
+    await incrementalAnalyzer.refresh(onFilesCollected);
+  }
+  async function stop() {
+    process.removeListener("SIGINT", handleExit);
+    process.removeListener("SIGTERM", handleExit);
+    await incrementalAnalyzer.stop();
+    for (const client of clients) {
+      client.close();
+    }
+    clients.clear();
+    await new Promise((resolve22) => {
+      wss.close(() => resolve22());
+    });
+    codeomnivisEvents.off(EVENTS.GRAPH_UPDATED, onGraphUpdated);
+    codeomnivisEvents.off(EVENTS.STATUS_CHANGED, onStatusChanged);
+    db.close();
+    sessions.dispose();
+    const wasListening = startState === "listening";
+    startState = "stopped";
+    if (!wasListening) {
+      return;
+    }
+    return new Promise((resolve22, reject) => {
+      server.close((err) => {
+        if (err) reject(err);
+        else resolve22();
+      });
+    });
+  }
+  return { app, server, db, analyze, start, stop };
+}
+
+// src/commands/serve.ts
+function resolveUiDistPath() {
+  const here = path6.dirname(fileURLToPath2(import.meta.url));
+  const bundled = path6.join(here, "ui");
+  if (fs5.existsSync(bundled)) return bundled;
+  return void 0;
+}
+function serveCommand(program) {
+  program.command("serve").description("Start CodeOmniVis server and visualize your project").option("-p, --port <port>", "Server port", "4321").option("-h, --host <host>", "Server host", "localhost").option("--project <path>", "Project root path", ".").option("--no-open", "Do not open browser automatically").option("--token <token>", "Access token required for mutating endpoints when binding to a non-loopback host").action(async (options) => {
+    const spinner = ora4("Starting CodeOmniVis server...").start();
+    try {
+      spinner.text = "Detecting project structure...";
+      const projectRoot = validateProjectRoot(options.project ?? ".");
+      const config = loadConfig(projectRoot);
+      const projectMeta = await autoDetectProject(projectRoot, config);
+      const configPath = path6.join(projectRoot, ".codeomnivis.json");
+      if (fs5.existsSync(configPath)) {
+        console.log(chalk4.gray("Configuration loaded from .codeomnivis.json"));
+      }
+      const accessToken = options.token ?? process.env.CODEOMNIVIS_TOKEN;
+      if (!isLoopbackHost(options.host) && (accessToken === void 0 || accessToken === "")) {
+        spinner.fail(chalk4.red("Refusing to bind to a non-loopback host without an access token"));
+        console.error(
+          chalk4.yellow(
+            `Host "${options.host}" is not loopback. Provide --token <token> or set CODEOMNIVIS_TOKEN to protect mutating endpoints (/api/analyze, /api/project, DELETE /api/graph).`
+          )
+        );
+        process.exit(1);
+      }
+      spinner.text = "Starting server...";
+      const dbPath = getDbPath(projectRoot);
+      const server = createOmniServer({
+        port: parseInt(options.port, 10),
+        host: options.host,
+        dbPath,
+        projectRoot,
+        projectMeta,
+        detectProjectMeta: async (root) => autoDetectProject(root, loadConfig(root)),
+        uiDistPath: resolveUiDistPath(),
+        accessToken
+      });
+      await server.start();
+      spinner.text = "Analyzing project...";
+      let filesScanned = 0;
+      await server.analyze((count) => {
+        filesScanned = count;
+        spinner.text = `Analyzing ${count} files...`;
+      });
+      console.log(chalk4.gray(`
+Scanned ${filesScanned} files.`));
+      const finalGraph = server.db.loadGraph();
+      spinner.succeed(chalk4.green(`Server running at http://${options.host}:${options.port}`));
+      console.log("");
+      console.log(chalk4.blue("Analysis results:"));
+      console.log(`  Files scanned: ${filesScanned}`);
+      console.log(`  Nodes: ${finalGraph.nodes.length}`);
+      console.log(`  Edges: ${finalGraph.edges.length}`);
+      const countEdge = (type) => finalGraph.edges.filter((edge) => edge.type === type).length;
+      const crossLayerEdges = ["calls_api", "handles", "calls_service", "queries_db"].reduce((count, type) => count + countEdge(type), 0);
+      if (crossLayerEdges > 0) {
+        console.log("");
+        console.log(chalk4.blue("Cross-layer links:"));
+        console.log(`  calls_api:      ${countEdge("calls_api")}`);
+        console.log(`  handles:        ${countEdge("handles")}`);
+        console.log(`  calls_service:  ${countEdge("calls_service")}`);
+        console.log(`  queries_db:     ${countEdge("queries_db")}`);
+      }
+      const nodesByType = finalGraph.nodes.reduce((counts, node) => {
+        counts[node.type] = (counts[node.type] ?? 0) + 1;
+        return counts;
+      }, {});
+      if (Object.keys(nodesByType).length > 0) {
+        console.log("");
+        console.log(chalk4.blue("Node types:"));
+        for (const [type, count] of Object.entries(nodesByType)) {
+          console.log(`  ${type}: ${count}`);
+        }
+      }
+      const errorCount = server.db.getAllErrors().length;
+      if (errorCount > 0) {
+        console.log(`
+  Errors: ${errorCount}`);
+      }
+      console.log("");
+      console.log(chalk4.blue("Project detected:"));
+      console.log(`  Frontend: ${projectMeta.frontendFramework}`);
+      console.log(`  Backend:  ${projectMeta.backendFramework}`);
+      console.log(`  Database: ${projectMeta.databaseType}`);
+      if (options.open) {
+        const open = (await import("open")).default;
+        await open(`http://${options.host}:${options.port}`);
+        console.log(chalk4.gray("\nBrowser opened automatically"));
+      }
+      console.log(chalk4.gray("\nPress Ctrl+C to stop the server"));
+      process.on("SIGINT", async () => {
+        console.log(chalk4.gray("\nShutting down..."));
+        await server.stop();
+        process.exit(0);
+      });
+      await new Promise(() => {
+      });
+    } catch (err) {
+      spinner.fail(chalk4.red("Failed to start server"));
+      console.error(err);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/testImport.ts
+import * as fs6 from "fs";
+import * as path7 from "path";
+import { randomUUID } from "crypto";
+import fg from "fast-glob";
+function inside(root, candidate) {
+  const relative4 = path7.relative(root, candidate);
+  return relative4 === "" || !relative4.startsWith("..") && !path7.isAbsolute(relative4);
+}
+function resolveInputs(projectRoot, pattern) {
+  const resolvedPattern = path7.resolve(projectRoot, pattern);
+  if (!inside(projectRoot, resolvedPattern))
+    throw new Error("JUnit XML inputs must be inside the project");
+  const files = fg.sync(pattern, {
+    cwd: projectRoot,
+    absolute: true,
+    onlyFiles: true,
+    followSymbolicLinks: false
+  });
+  const realRoot = fs6.realpathSync.native(projectRoot);
+  for (const file of files) {
+    if (!inside(realRoot, fs6.realpathSync.native(file)))
+      throw new Error("JUnit XML inputs must be inside the project");
+  }
+  if (files.length === 0) throw new Error("No JUnit XML files matched");
+  return files.sort();
+}
+async function runTestImport(options) {
+  const projectRoot = path7.resolve(options.project);
+  if (!fs6.statSync(projectRoot).isDirectory()) throw new Error("Project root must be a directory");
+  const files = resolveInputs(projectRoot, options.junit);
+  const db = new OmniDatabase(getDbPath(projectRoot));
+  try {
+    await db.ready();
+    const snapshot = db.loadSnapshot();
+    if (!snapshot) throw new Error("No committed project snapshot found; run analyze first");
+    const imports = files.map((file) => importJunitXml(file, snapshot));
+    const updated = {
+      ...snapshot,
+      snapshotId: randomUUID(),
+      snapshotDigest: "",
+      provenance: {
+        ...snapshot.provenance,
+        generatedAt: Date.now(),
+        testRuns: [...snapshot.provenance.testRuns ?? [], ...imports]
+      }
+    };
+    updated.snapshotDigest = computeSnapshotDigest(updated);
+    db.replaceSnapshot(updated);
+    return {
+      importedFiles: files.length,
+      cases: imports.reduce((sum, item) => sum + item.cases.length, 0),
+      unmatched: imports.reduce((sum, item) => sum + item.unmatched.length, 0)
+    };
+  } finally {
+    db.close();
+  }
+}
+function testImportCommand(program) {
+  program.command("test-import").description("Import existing JUnit XML results without running tests").requiredOption("-p, --project <path>", "Project root").requiredOption("--junit <file-or-glob>", "JUnit XML file or glob inside the project").action(async (options) => {
+    const result = await runTestImport(options);
+    process.stdout.write(
+      `Imported ${result.cases} case result(s) from ${result.importedFiles} file(s); ${result.unmatched} unmatched.
+`
+    );
+  });
+}
+
+// src/commands/testRun.ts
+import * as path9 from "path";
+
+// src/utils/testRunner.ts
+import * as fs7 from "fs";
+import * as path8 from "path";
+import { spawn } from "child_process";
+var MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
+var MIN_TIMEOUT_MS = 1e3;
+var MAX_TIMEOUT_MS = 30 * 60 * 1e3;
+function isInside(root, candidate) {
+  const relative4 = path8.relative(root, candidate);
+  return relative4 === "" || !relative4.startsWith("..") && !path8.isAbsolute(relative4);
+}
+function validateArgs(root, args) {
+  for (const argument of args) {
+    if (argument.includes("\0")) throw new Error("Runner arguments cannot contain NUL");
+    const possiblePath = argument.includes("=") ? argument.slice(argument.indexOf("=") + 1) : argument;
+    if (path8.isAbsolute(possiblePath) && !isInside(root, path8.resolve(possiblePath))) {
+      throw new Error("Runner argument path is outside the project");
+    }
+  }
+}
+function createTestRunPlan(request) {
+  const root = path8.resolve(request.projectRoot);
+  if (!fs7.statSync(root).isDirectory()) throw new Error("Project root must be a directory");
+  if (!Number.isInteger(request.timeoutMs) || request.timeoutMs < MIN_TIMEOUT_MS || request.timeoutMs > MAX_TIMEOUT_MS) {
+    throw new Error("Test timeout must be between 1000 and 1800000 milliseconds");
+  }
+  validateArgs(root, request.extraArgs);
+  let command = "pnpm";
+  let args;
+  switch (request.runner) {
+    case "vitest":
+      args = ["exec", "vitest", "--run", ...request.extraArgs];
+      break;
+    case "jest":
+      args = ["exec", "jest", "--runInBand", ...request.extraArgs];
+      break;
+    case "playwright":
+      args = ["exec", "playwright", "test", ...request.extraArgs];
+      break;
+    case "cypress":
+      args = ["exec", "cypress", "run", ...request.extraArgs];
+      break;
+    case "gradle": {
+      command = path8.join(root, process.platform === "win32" ? "gradlew.bat" : "gradlew");
+      if (!fs7.existsSync(command))
+        throw new Error("Validated Gradle wrapper was not found in the project root");
+      args = ["test", ...request.extraArgs];
+      break;
+    }
+    default:
+      throw new Error(`Unsupported test runner: ${String(request.runner)}`);
+  }
+  return { command, args, options: { cwd: root, shell: false, env: process.env } };
+}
+async function runTestRunner(request) {
+  const plan = createTestRunPlan(request);
+  return new Promise((resolve9) => {
+    const child = spawn(plan.command, plan.args, {
+      ...plan.options,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = Buffer.alloc(0);
+    let stderr = Buffer.alloc(0);
+    let truncated = false;
+    let timedOut = false;
+    let settled = false;
+    const append = (current, chunk) => {
+      if (current.length >= MAX_OUTPUT_BYTES) {
+        truncated = true;
+        return current;
+      }
+      const available = MAX_OUTPUT_BYTES - current.length;
+      if (chunk.length > available) truncated = true;
+      return Buffer.concat([current, chunk.subarray(0, available)]);
+    };
+    child.stdout.on("data", (chunk) => {
+      stdout = append(stdout, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = append(stderr, chunk);
+    });
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      const force = setTimeout(() => child.kill("SIGKILL"), 2e3);
+      force.unref();
+    }, request.timeoutMs);
+    timeout.unref();
+    const finish = (exitCode, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      resolve9({
+        exitCode,
+        signal,
+        timedOut,
+        stdout: stdout.toString("utf8"),
+        stderr: stderr.toString("utf8"),
+        truncated
+      });
+    };
+    child.once("error", (error) => {
+      stderr = append(stderr, Buffer.from(error.message));
+      finish(null, null);
+    });
+    child.once("close", finish);
+  });
+}
+
+// src/commands/testRun.ts
+var defaultDeps2 = {
+  run: runTestRunner,
+  importResults: runTestImport,
+  stdout: (value) => {
+    process.stdout.write(value);
+  },
+  stderr: (value) => {
+    process.stderr.write(value);
+  }
+};
+async function runTestCommand(runnerArgs, options, deps = defaultDeps2) {
+  const projectRoot = path9.resolve(options.project);
+  const request = {
+    projectRoot,
+    runner: options.runner,
+    timeoutMs: Number(options.timeout),
+    extraArgs: runnerArgs
+  };
+  const plan = { cwd: projectRoot, runner: options.runner, args: runnerArgs };
+  deps.stderr(`[codeomnivis] test-run ${JSON.stringify(plan)}
+`);
+  const result = await deps.run(request);
+  deps.stdout(result.stdout);
+  deps.stderr(result.stderr);
+  if (options.junit) await deps.importResults({ project: projectRoot, junit: options.junit });
+  if (result.exitCode !== 0) process.exitCode = result.exitCode ?? 1;
+}
+function testRunCommand(program) {
+  program.command("test-run").description("Explicitly run one supported test runner with resource bounds").requiredOption("-p, --project <path>", "Project root").requiredOption("--runner <runner>", "vitest, jest, playwright, cypress, or gradle").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--junit <path>", "Import this JUnit XML after the run").argument("[runnerArgs...]").allowUnknownOption().action(async (runnerArgs, options) => {
+    await runTestCommand(runnerArgs, options);
+  });
+}
+
+// src/program.ts
+function readCliVersion() {
+  try {
+    const manifest = JSON.parse(
+      readFileSync(new URL("../package.json", import.meta.url), "utf8")
+    );
+    if (isJsonObject(manifest) && typeof manifest.version === "string") {
+      return manifest.version;
+    }
+  } catch {
+  }
+  return "0.0.0";
+}
+function createCliProgram() {
+  const program = new Command();
+  program.name("codeomnivis").description("Full-stack architecture visualizer for TypeScript projects").version(readCliVersion());
+  serveCommand(program);
+  analyzeCommand(program);
+  checkCommand(program);
+  mcpCommand(program);
+  initCommand(program);
+  testImportCommand(program);
+  testRunCommand(program);
+  return program;
+}
+
+// src/index.ts
+function isCliMainModule(entry, moduleUrl) {
+  return entry !== void 0 && pathToFileURL(entry).href === moduleUrl;
+}
+async function runCli(program = createCliProgram(), runtime = process, reportError = (message) => console.error(message)) {
+  try {
+    await program.parseAsync();
+  } catch (err) {
+    reportError(err instanceof Error ? err.message : String(err));
+    runtime.exitCode = 1;
+  }
+}
+if (isCliMainModule(process.argv[1], import.meta.url)) void runCli();
+export {
+  isCliMainModule,
+  runCli
+};