@dev-tren/mapd 0.21.0

package/src/core/envFiles.js

@@ -0,0 +1,43 @@
+/**
+ * envFiles.js — .env loading and inspection, project-level and user-level.
+ *
+ * Precedence: a project's own `.env` (current working directory) always wins;
+ * a user-level `~/.env` fills in anything the project didn't set. This means
+ * a key configured once in your home directory works in every project you
+ * run mapd from, while any project can still override it with its own `.env`
+ * (e.g. a different model, or a project-specific key). Node's built-in
+ * `process.loadEnvFile` never overwrites a variable that's already set, which
+ * is what makes this precedence chain work without extra bookkeeping.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+
+export const RECOGNIZED_ENV_KEYS = [
+  "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "OPENAI_BASE_URL",
+  "KIMI_API_KEY", "KIMI_BASE_URL", "MAPD_MODEL", "MAPD_WEBHOOK_SECRET",
+];
+
+/** Loads .env files in precedence order. Call once, as early as possible. Never throws. */
+export function loadEnvFiles() {
+  try { process.loadEnvFile(); } catch { /* no project .env in cwd — fine, optional */ }
+  try { process.loadEnvFile(path.join(os.homedir(), ".env")); } catch { /* no user-level ~/.env — fine, optional */ }
+}
+
+function scanEnvFile(envPath) {
+  if (!fs.existsSync(envPath)) return { present: false, keys: [] };
+  let content;
+  try { content = fs.readFileSync(envPath, "utf8"); } catch { return { present: true, keys: [] }; }
+  const keys = RECOGNIZED_ENV_KEYS.filter((k) => new RegExp(`^\\s*${k}\\s*=`, "m").test(content));
+  return { present: true, keys };
+}
+
+/** Reports on both the project-level and user-level .env — never reads or prints values. */
+export function checkEnvFiles(rootDir) {
+  const userPath = path.join(os.homedir(), ".env");
+  return {
+    project: { path: path.join(path.resolve(rootDir), ".env"), ...scanEnvFile(path.join(path.resolve(rootDir), ".env")) },
+    user: { path: userPath, ...scanEnvFile(userPath) },
+  };
+}

package/src/core/events.js

@@ -0,0 +1,53 @@
+/**
+ * events.js — structured watch events, shared by `mapd watch`'s console
+ * output and any in-process subscriber (chat's "watch this project and tell
+ * me when X regresses"). Built on node:events — zero new dependency.
+ */
+
+import { EventEmitter } from "node:events";
+
+export function createWatchBus() {
+  return new EventEmitter();
+}
+
+/**
+ * Turns one rescan's raw inputs into a structured event payload. Kept as a
+ * pure function (not baked into the emitter) so it's independently testable.
+ */
+export function buildRescanEvent({ durationMs, parsed, prevGraph, newGraph, findings }) {
+  const newOrphans = newGraph.orphans.filter((o) => !prevGraph.orphans.includes(o));
+  const resolvedOrphans = prevGraph.orphans.filter((o) => !newGraph.orphans.includes(o));
+  const deltaConfidence = Number((newGraph.repoConfidence - prevGraph.repoConfidence).toFixed(3));
+
+  const prevWfById = new Map(prevGraph.workflows.map((w) => [w.id, w]));
+  const affectedWorkflows = newGraph.workflows
+    .filter((wf) => {
+      const prev = prevWfById.get(wf.id);
+      return !prev || prev.confidence.score !== wf.confidence.score;
+    })
+    .map((wf) => ({ id: wf.id, confidence: wf.confidence.score, previousConfidence: prevWfById.get(wf.id)?.confidence.score ?? null }));
+
+  const newFindings = findings.filter((f) => f.kind !== "workflow-added");
+  const resolvedFindings = findings.filter((f) => f.kind === "workflow-added");
+
+  return {
+    type: "remap",
+    at: new Date().toISOString(),
+    durationMs,
+    reparsedCount: parsed.parsedCount,
+    cacheHits: parsed.cacheHits,
+    repoConfidence: { from: prevGraph.repoConfidence, to: newGraph.repoConfidence, delta: deltaConfidence },
+    affectedWorkflows,
+    newFindings,
+    resolvedFindings,
+    newOrphans,
+    resolvedOrphans,
+  };
+}
+
+/** Emits the structured event plus one per-finding event (`regression` for high severity, `finding` otherwise). */
+export function emitRescanEvent(bus, payload) {
+  bus.emit("remap", payload);
+  for (const f of payload.newFindings) bus.emit(f.severity === "high" ? "regression" : "finding", f);
+  for (const f of payload.resolvedFindings) bus.emit("resolved", f);
+}

package/src/core/evidence.js

@@ -0,0 +1,212 @@
+/**
+ * evidence.js — one deterministic evidence view per review-queue item
+ * (`mapd evidence <id>`, chat /evidence, MCP get_finding_evidence).
+ *
+ * The master prompt requires that for every meaningful claim Map'd can show
+ * the file paths, workflows, gate results, and config facts that support it.
+ * Findings already CARRY that data scattered across reports, proposals, the
+ * graph, and .mapdrc annotations — this module assembles it into a single
+ * view. Everything here is read straight from those deterministic sources;
+ * nothing is inferred, and anything unknown is reported as absent, not
+ * guessed at.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { loadQueue, stateOf } from "./review.js";
+import { checkReportFreshness } from "./staleness.js";
+import { buildScoredGraph } from "./intelligence.js";
+import { priorityOf, filesOf } from "./findingScoring.js";
+import { loadConfig } from "../config/index.js";
+import { applyAnnotations } from "./reachability.js";
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch { return null; }
+}
+
+/** How the graph classifies one file's reachability — verified data only. */
+function classifyFile(graph, relFile) {
+  const node = graph.files.find((f) => f.file === relFile) ?? null;
+  const workflows = graph.workflows.filter((w) => w.files.includes(relFile)).map((w) => w.id);
+  const generated = graph.generatedFiles?.find((g) => g.file === relFile) ?? null;
+  const dynamic = graph.reachability?.dynamicallyLoaded?.find((d) => d.file === relFile) ?? null;
+  const dormant = graph.reachability?.intentionalDormant?.find((d) => d.file === relFile) ?? null;
+  const heuristic = graph.reachability?.heuristicUnverified?.find((h) => h.file === relFile) ?? null;
+  const classification =
+    generated ? "generated"
+    : dormant ? "intentional-dormant"
+    : dynamic ? "dynamically-loaded"
+    : workflows.length ? "reachable"
+    : heuristic ? "heuristic-unverified"
+    : graph.orphans?.includes(relFile) ? "orphan"
+    : "unclassified";
+  return {
+    file: relFile,
+    inMap: !!node,
+    parsed: node?.parsed ?? false,
+    parserKind: node?.parserKind ?? (node ? "ast" : null),
+    loc: node?.loc ?? null,
+    exports: node?.exports ?? [],
+    workflows,
+    classification,
+    classificationReason: generated?.reason ?? dormant?.evidence ?? dynamic?.evidence ?? heuristic?.reason ?? null,
+  };
+}
+
+/** Gate summary for one saved fix proposal — real recorded results, no re-run. */
+function summarizeProposal(prop) {
+  if (!prop) return null;
+  return {
+    status: prop.status,
+    stopReason: prop.stopReason ?? null,
+    files: Object.keys(prop.filesPatch ?? {}),
+    attempts: (prop.attempts ?? []).map((a) => ({
+      attempt: a.attempt,
+      passed: a.passed,
+      failedGates: (a.gates ?? []).filter((g) => !g.passed).map((g) => g.gate),
+    })),
+    changeIds: prop.changeIds ?? [],
+    postApplyVerification: prop.postApplyVerification
+      ? { ok: prop.postApplyVerification.ok, issues: prop.postApplyVerification.issues }
+      : null,
+  };
+}
+
+/**
+ * Assemble the full evidence view for one review-queue item. Returns null if
+ * the ID isn't in the queue. `graph` may be passed in to reuse an
+ * already-built scored graph (chat/MCP); otherwise one is built.
+ */
+export function buildFindingEvidence(rootDir, id, { graph } = {}) {
+  const abs = path.resolve(rootDir);
+  const item = loadQueue(abs).find((i) => i.id === id);
+  if (!item) return null;
+
+  const freshness = checkReportFreshness(abs);
+  const report = readJson(item.file);
+  const base = {
+    id: item.id,
+    source: item.source,
+    kind: item.kind,
+    severity: item.severity ?? null,
+    status: item.status,
+    state: stateOf(item, freshness.staleReports),
+    detail: item.detail,
+    report: {
+      path: item.file,
+      generatedAt: report?.generatedAt ?? null,
+      stale: freshness.staleReports.includes(path.basename(item.file)),
+    },
+  };
+
+  // fix proposal: the report file IS the proposal record with its gate history
+  if (item.source === "fix") {
+    return { ...base, evidenceType: "fix-proposal", proposal: summarizeProposal(report) };
+  }
+
+  // integration conflict: the report carries per-conflict AST evidence
+  if (item.source.startsWith("integrate:")) {
+    const conflict = report?.conflicts?.[item.index] ?? null;
+    return {
+      ...base,
+      evidenceType: "integration-conflict",
+      conflict: conflict && {
+        file: conflict.file,
+        classification: conflict.classification,
+        evidence: conflict.evidence ?? null,
+        proposalStatus: conflict.proposal?.status ?? null,
+        resolutionScore: conflict.proposal?.resolutionScore?.score ?? null,
+      },
+    };
+  }
+
+  // check / modernize finding: raw evidence + graph-backed file context
+  const finding = report?.findings?.[item.index] ?? null;
+  if (!finding) return { ...base, evidenceType: "finding", finding: null, files: [] };
+
+  const g = graph ?? buildScoredGraph(abs);
+  const config = loadConfig(abs);
+  const files = filesOf(finding).map((f) => classifyFile(g, f));
+  const annotations = applyAnnotations(new Set(files.map((f) => f.file)), config.project?.annotations ?? {});
+  const proposal = readJson(path.join(abs, ".mapd", "proposals", `${item.id}.json`));
+
+  return {
+    ...base,
+    evidenceType: "finding",
+    priority: Number(priorityOf(finding, item).toFixed(3)),
+    finding: {
+      detail: finding.detail,
+      suggestion: finding.suggestion ?? null,
+      rawEvidence: finding.evidence ?? null,
+    },
+    files,
+    userAnnotations: annotations, // user assertions from .mapdrc, labeled as such
+    proposal: summarizeProposal(proposal),
+    repoConfidence: g.repoConfidence,
+    callResolutionRate: g.stats.callResolutionRate,
+  };
+}
+
+/** Renders buildFindingEvidence's data as terminal text — data first, no walls. */
+export function renderFindingEvidence(data) {
+  const lines = [];
+  lines.push(`${data.id}  [${data.source}] ${data.kind}${data.severity ? ` (${data.severity})` : ""}  state: ${data.state}`);
+  lines.push(`  ${data.detail}`);
+  lines.push(`  report: ${data.report.path}${data.report.generatedAt ? `  generated ${data.report.generatedAt}` : ""}${data.report.stale ? "  ⚠ STALE — predates a newer source change; refresh before acting" : ""}`);
+
+  if (data.evidenceType === "fix-proposal" && data.proposal) {
+    lines.push(`  proposal: ${data.proposal.status}${data.proposal.stopReason ? ` (stopped: ${data.proposal.stopReason})` : ""}`);
+    lines.push(`  files: ${data.proposal.files.join(", ") || "(none)"}`);
+    for (const a of data.proposal.attempts) {
+      lines.push(`    attempt ${a.attempt}: ${a.passed ? "PASSED all gates" : `failed (${a.failedGates.join(", ")})`}`);
+    }
+    if (data.proposal.postApplyVerification) {
+      const v = data.proposal.postApplyVerification;
+      lines.push(`  post-apply verification: ${v.ok ? "passed" : `FAILED — ${v.issues.join("; ")}`}`);
+    }
+    return lines.join("\n");
+  }
+
+  if (data.evidenceType === "integration-conflict") {
+    if (data.conflict) {
+      lines.push(`  conflict file: ${data.conflict.file}  classification: ${data.conflict.classification}`);
+      if (data.conflict.evidence) lines.push(`  evidence: ${JSON.stringify(data.conflict.evidence)}`);
+      if (data.conflict.proposalStatus) lines.push(`  proposal: ${data.conflict.proposalStatus}${data.conflict.resolutionScore != null ? ` (resolution score ${data.conflict.resolutionScore})` : ""}`);
+    } else {
+      lines.push("  conflict no longer present in the report.");
+    }
+    return lines.join("\n");
+  }
+
+  if (!data.finding) {
+    lines.push("  finding no longer present in the report — re-run the source command to refresh.");
+    return lines.join("\n");
+  }
+
+  if (data.priority != null) lines.push(`  priority: ${data.priority}  repo confidence: ${data.repoConfidence}  call resolution: ${(data.callResolutionRate * 100).toFixed(1)}%`);
+  if (data.finding.suggestion) lines.push(`  suggestion: ${data.finding.suggestion}`);
+  if (data.finding.rawEvidence) lines.push(`  raw evidence: ${JSON.stringify(data.finding.rawEvidence)}`);
+
+  if (data.files.length) {
+    lines.push("  files:");
+    for (const f of data.files) {
+      const wf = f.workflows.length ? `workflows: ${f.workflows.join(", ")}` : "no workflow membership";
+      const reason = typeof f.classificationReason === "string" ? ` (${f.classificationReason})` : "";
+      lines.push(`    - ${f.file}  [${f.classification}${reason}]  ${wf}${f.loc != null ? `  ${f.loc} loc` : f.inMap ? "" : "  (not in current map)"}`);
+    }
+  } else {
+    lines.push("  files: none recorded on this finding.");
+  }
+
+  if (data.userAnnotations.length) {
+    lines.push("  user annotations (asserted in .mapdrc, not auto-detected):");
+    for (const a of data.userAnnotations) lines.push(`    - ${a.file} ← "${a.pattern}": "${a.classification}"`);
+  }
+
+  if (data.proposal) {
+    lines.push(`  fix proposal: ${data.proposal.status}${data.proposal.stopReason ? ` (stopped: ${data.proposal.stopReason})` : ""} — ${data.proposal.attempts.length} attempt(s)`);
+  } else {
+    lines.push("  fix proposal: none yet — `mapd fix <id> --propose` to generate one.");
+  }
+  return lines.join("\n");
+}

package/src/core/findingScoring.js

@@ -0,0 +1,20 @@
+/**
+ * findingScoring.js — shared scoring helpers for anything that ranks queue
+ * findings (handoff.js, solutions.js). One severity/priority scale and one
+ * files-extraction rule, so the two never silently drift apart.
+ */
+
+const SEVERITY_SCORE = { high: 1.0, medium: 0.6, low: 0.3, info: 0.1 };
+
+/** Unifies "check" findings (severity: high/medium/low) and modernize findings (a 0-1 priority) onto one scale. */
+export function priorityOf(finding, item) {
+  if (item.source === "check") return SEVERITY_SCORE[finding.severity] ?? 0;
+  return finding.operationalImpact?.priority ?? item.priority ?? 0;
+}
+
+/** Modernize findings carry `files`; check (regression) findings carry it nested under `evidence`. */
+export function filesOf(finding) {
+  if (Array.isArray(finding.files)) return finding.files;
+  if (Array.isArray(finding.evidence?.files)) return finding.evidence.files;
+  return [];
+}

package/src/core/fix.js

@@ -0,0 +1,192 @@
+/**
+ * fix.js — the full mapd fix lifecycle: load finding -> validate relevance ->
+ * gather context -> propose -> verify (isolated workspace + gates) -> retry
+ * with structured feedback -> save a verified proposal awaiting approval.
+ *
+ * Approval and real-tree application happen in review.js/changes.js — this
+ * module never writes to the real working tree.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { loadQueue } from "./review.js";
+import { buildScoredGraph } from "./intelligence.js";
+import { loadBaseline, diffGraphs } from "./regression.js";
+import { loadPkg } from "./graph.js";
+import { runFixGates } from "./gates.js";
+import { runWithRetry } from "./retry.js";
+import { createIsolatedWorkspace, applyPatchInWorkspace } from "./workspace.js";
+import { proposeFix } from "../agents/llm.js";
+import { getProvider } from "../agents/provider.js";
+
+const MAPD = ".mapd";
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch { return null; }
+}
+
+function extractWorkflowIdFromDetail(detail) {
+  const m = /Workflow (\S+)/.exec(detail ?? "");
+  return m ? m[1] : null;
+}
+
+/** Locate a finding (check or modernize sourced) by its review-queue ID. */
+export function loadFinding(rootDir, id) {
+  const abs = path.resolve(rootDir);
+  const item = loadQueue(abs).find((i) => i.id === id);
+  if (!item) return null;
+  if (item.source === "fix" || item.source.startsWith("integrate:")) return null; // fix targets findings, not existing proposals
+  const rep = readJson(item.file);
+  const finding = rep?.findings?.[item.index];
+  if (!finding) return null;
+  return { item, finding, reportPath: item.file };
+}
+
+/** Deterministic file candidates for a finding: direct evidence, then workflow lookup. */
+export function candidateFilesForFinding(finding, graph) {
+  if (Array.isArray(finding.files) && finding.files.length) return finding.files;
+  if (Array.isArray(finding.evidence?.files) && finding.evidence.files.length) return finding.evidence.files;
+  const wfId = extractWorkflowIdFromDetail(finding.detail);
+  if (wfId) {
+    const wf = graph.workflows.find((w) => w.id === wfId);
+    if (wf) return wf.files.slice(0, 5);
+  }
+  return [];
+}
+
+export function gatherRelevantSources(rootDir, finding, graph, { maxFiles = 3, maxCharsPerFile = 8000 } = {}) {
+  const abs = path.resolve(rootDir);
+  const files = candidateFilesForFinding(finding, graph).slice(0, maxFiles);
+  return files.map((file) => {
+    try { return { file, source: fs.readFileSync(path.join(abs, file), "utf8").slice(0, maxCharsPerFile) }; }
+    catch { return { file, source: null }; }
+  });
+}
+
+/**
+ * Best-effort relevance check: for check-sourced (regression) findings, does
+ * the same kind+detail still appear when diffing the current baseline against
+ * a fresh map? Modernize findings are not re-scanned here (would require a
+ * full re-run of the scan tier) — assumed still relevant, documented as such.
+ */
+export function isFindingStillRelevant(rootDir, item, finding, currentGraph) {
+  if (item.source === "check") {
+    const loaded = loadBaseline(rootDir);
+    if (!loaded || loaded.schemaMismatch) {
+      return { relevant: true, reason: "no usable baseline to re-verify against — proceeding" };
+    }
+    const stillThere = diffGraphs(loaded.graph, currentGraph)
+      .some((f) => f.kind === finding.kind && f.detail === finding.detail);
+    return {
+      relevant: stillThere,
+      reason: stillThere ? "finding reproduces against the current baseline diff" : "finding no longer reproduces",
+    };
+  }
+  return { relevant: true, reason: "modernize findings are not re-scanned for relevance (best-effort)" };
+}
+
+function proposalsDir(rootDir) { return path.join(path.resolve(rootDir), MAPD, "proposals"); }
+
+export function saveProposal(rootDir, proposalRecord) {
+  const dir = proposalsDir(rootDir);
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, `${proposalRecord.findingId}.json`);
+  fs.writeFileSync(file, JSON.stringify(proposalRecord, null, 2));
+  return file;
+}
+
+/**
+ * Full lifecycle. Returns `{ ok, reason }` on early stop, or
+ * `{ ok: true, proposalRecord, proposalPath, attempts, stopReason }` once a
+ * proposal (verified or gate-exhausted) has been saved.
+ *
+ * Never fabricates a proposal without a configured provider — mirrors the
+ * existing `--propose requires ANTHROPIC_API_KEY` behavior used everywhere
+ * else in this codebase.
+ */
+export async function runFixLifecycle(rootDir, id, config = {}, opts = {}) {
+  const abs = path.resolve(rootDir);
+  const loaded = loadFinding(abs, id);
+  if (!loaded) return { ok: false, reason: `no fixable finding with id ${id}` };
+  const { item, finding } = loaded;
+
+  const preFixGraph = buildScoredGraph(abs);
+  const relevance = isFindingStillRelevant(abs, item, finding, preFixGraph);
+  if (!relevance.relevant) {
+    return { ok: false, reason: `finding no longer reproducible: ${relevance.reason}` };
+  }
+
+  const provider = getProvider(config);
+  if (!provider.available()) {
+    return {
+      ok: false,
+      reason: "mapd fix --propose requires a configured LLM provider (ANTHROPIC_API_KEY, OPENAI_API_KEY, or KIMI_API_KEY — in .env or ~/.env); no fix was fabricated.",
+    };
+  }
+
+  const sources = gatherRelevantSources(abs, finding, preFixGraph);
+  const baselineLoaded = loadBaseline(abs);
+  const baseline = baselineLoaded && !baselineLoaded.schemaMismatch ? baselineLoaded.graph : null;
+  const pkg = loadPkg(abs);
+  const maxAttempts = opts.maxAttempts ?? config.fix?.maxAttempts ?? 2;
+  const forbiddenPaths = config.fix?.forbiddenPaths ?? [];
+
+  const workspaces = [];
+  const retryResult = await runWithRetry({
+    maxAttempts,
+    attemptFn: async ({ feedback }) => {
+      const proposal = await proposeFix(finding, sources, feedback, { provider });
+      const ws = createIsolatedWorkspace(abs);
+      workspaces.push(ws);
+
+      if (!proposal || !proposal.patch || Object.keys(proposal.patch).length === 0) {
+        return {
+          gates: [{ gate: "FIX-G1-patch-safety", passed: false, issues: [proposal?.reasoning_summary || "no patch produced"] }],
+          proposal, ws,
+        };
+      }
+      for (const [relFile, newSource] of Object.entries(proposal.patch)) {
+        applyPatchInWorkspace(ws, relFile, newSource);
+      }
+      const gates = runFixGates({
+        ws, patch: proposal.patch, forbiddenPaths,
+        maxFileSizeBytes: config.mapping?.maxFileSizeBytes,
+        pkg, cwd: ws.dir,
+        runTests: config.fix?.runTests, runLint: config.fix?.runLint, runTypecheck: config.fix?.runTypecheck,
+        preFixGraph, baseline, targetFinding: finding,
+      });
+      return { gates, proposal, ws };
+    },
+  });
+
+  const winningWs = retryResult.finalAttempt.result.ws;
+  const winningProposal = retryResult.finalAttempt.result.proposal;
+  for (const ws of workspaces) if (ws !== winningWs) ws.cleanup();
+
+  const proposalRecord = {
+    mapdSchema: 1,
+    findingId: id,
+    findingKind: finding.kind ?? finding.rule,
+    findingDetail: finding.detail,
+    filesPatch: winningProposal?.patch ?? {},
+    summary: winningProposal?.summary ?? "",
+    reasoning_summary: winningProposal?.reasoning_summary ?? "",
+    expected_effect: winningProposal?.expected_effect ?? "",
+    risks: winningProposal?.risks ?? [],
+    verification_plan: winningProposal?.verification_plan ?? [],
+    attempts: retryResult.attempts.map((a) => ({ attempt: a.attempt, passed: a.passed, gates: a.gates })),
+    stopReason: retryResult.stopReason,
+    status: retryResult.success ? "awaiting-approval" : "rejected-by-gate",
+    generatedBy: winningProposal?.generatedBy ?? null,
+    createdAt: new Date().toISOString(),
+  };
+
+  winningWs.cleanup();
+
+  if (opts.dryRun) {
+    return { ok: true, dryRun: true, proposalRecord, attempts: retryResult.attempts, stopReason: retryResult.stopReason };
+  }
+
+  const proposalPath = saveProposal(abs, proposalRecord);
+  return { ok: true, proposalRecord, proposalPath, attempts: retryResult.attempts, stopReason: retryResult.stopReason };
+}