@gmickel/gno 2.7.1 → 2.8.1

package/src/core/audit-workspace.ts

@@ -9,6 +9,7 @@ import type { DocumentRow } from "../store/types";
 import type {
   AuditCategory,
   AuditFingerprints,
+  AuditMaxFindings,
   AuditRunResult,
   AuditScope,
 } from "./audit";
@@ -26,10 +27,12 @@ import {
   AUDIT_RULE_SET_VERSION,
   canonicalAuditJson,
   hashAuditCanonical,
+  resolveAuditMaxFindings,
   runAudit,
 } from "./audit";
 import { evaluateFreshnessAudit } from "./audit-freshness";
 import { evaluateLinkAudit } from "./audit-links";
+import { markOutsideIndexLinks } from "./audit-outside-index";
 import { evaluateProvenanceAudit } from "./audit-provenance";
 import {
   extractCaptureSourceFromFrontmatter,
@@ -55,7 +58,7 @@ export interface WorkspaceAuditOptions {
   collectionFilters?: readonly string[];
   pathFilters?: readonly string[];
   tagFilters?: readonly string[];
-  maxFindings?: number;
+  maxFindings?: AuditMaxFindings;
   agePolicy?: AuditFreshnessOptions["agePolicy"];
   orphanRoots?: readonly string[];
   orphanIgnorePrefixes?: readonly string[];
@@ -347,7 +350,8 @@ const filterLinkSnapshot = (
   snapshot: AuditLinkSnapshot,
   selectedIds: ReadonlySet<number>,
   selectedDocuments: readonly DocumentRow[],
-  selectionTruncated: boolean
+  selectionTruncated: boolean,
+  scopeCollections: readonly string[]
 ): AuditLinkSnapshot => {
   const links = snapshot.links.filter(
     (link) =>
@@ -362,6 +366,9 @@ const filterLinkSnapshot = (
     // Preserve graph-wide documents as duplicate-mirror evidence while the
     // explicit id set prevents findings outside the requested audit scope.
     auditedDocumentIds: [...selectedIds],
+    ...(scopeCollections.length > 0
+      ? { scopeCollections: [...scopeCollections] }
+      : {}),
     links,
     totals: { documents: selectedDocuments.length, links: outgoingTotal },
     truncated: {
@@ -423,14 +430,20 @@ const loadWorkspaceSnapshot = async (
       ? captureAuditLinkSnapshot(options.store.getRawDb())
       : emptyLinkSnapshot();
   const selectedIds = new Set(selected.documents.map(({ id }) => id));
+  const links = filterLinkSnapshot(
+    rawLinks,
+    selectedIds,
+    selected.documents,
+    selected.truncated,
+    filters.collections
+  );
   return {
     documents: observed,
-    links: filterLinkSnapshot(
-      rawLinks,
-      selectedIds,
-      selected.documents,
-      selected.truncated
-    ),
+    links: options.categories.includes("links")
+      ? await markOutsideIndexLinks(options.store.getRawDb(), links, {
+          signal: options.signal,
+        })
+      : links,
     truncated: selected.truncated,
   };
 };
@@ -596,6 +609,12 @@ export const runWorkspaceAudit = async (
     snapshots.set(attempt, pending);
     return pending;
   };
+  // Per-family caps follow the effective report cap; runAudit rejects an
+  // invalid value before any rule runs.
+  const resolvedMaxFindings = resolveAuditMaxFindings(options.maxFindings);
+  const maxFindingsPerRule = resolvedMaxFindings.ok
+    ? resolvedMaxFindings.limit
+    : 0;
   const result = await runAudit({
     scope,
     capabilities: {
@@ -645,6 +664,7 @@ export const runWorkspaceAudit = async (
             ...evaluateLinkAudit(snapshot.links, {
               rootUris: options.orphanRoots ?? [],
               ignorePathPrefixes: options.orphanIgnorePrefixes ?? [],
+              maxFindingsPerRule,
             })
           );
           await options.onProgress?.({
@@ -657,7 +677,7 @@ export const runWorkspaceAudit = async (
           contributions.push(
             ...evaluateProvenanceAudit(
               snapshot.documents.map(({ provenance }) => provenance),
-              { truncated: snapshot.truncated }
+              { truncated: snapshot.truncated, maxFindingsPerRule }
             )
           );
           await options.onProgress?.({
@@ -674,6 +694,7 @@ export const runWorkspaceAudit = async (
                 now: options.now ?? new Date(),
                 agePolicy: options.agePolicy,
                 truncated: snapshot.truncated,
+                maxFindingsPerRule,
               }
             )
           );

package/src/core/audit.ts

@@ -6,6 +6,7 @@ import type {
   AuditFinding,
   AuditFingerprints,
   AuditForbiddenStoreMethod,
+  AuditMaxFindings,
   AuditReport,
   AuditReportStatus,
   AuditRuleContribution,
@@ -24,6 +25,9 @@ import {
   AUDIT_DEFAULT_MAX_FINDINGS,
   AUDIT_FORBIDDEN_STORE_METHODS,
   AUDIT_MAX_CODE_CHARS,
+  AUDIT_MAX_EVIDENCE_DETAIL_CHARS,
+  AUDIT_MAX_EVIDENCE_PER_FINDING,
+  AUDIT_MAX_FINDINGS_ALL,
   AUDIT_MAX_FINDINGS_LIMIT,
   AUDIT_MAX_IDENTIFIER_CHARS,
   AUDIT_MAX_MESSAGE_CHARS,
@@ -127,23 +131,61 @@ export const normalizeAuditScope = (
   };
 };
 
-const resolveMaxFindings = (
-  value: number | undefined
-): { ok: true; maxFindings: number } | { ok: false; error: string } => {
+export const AUDIT_MAX_FINDINGS_RANGE_MESSAGE = `maxFindings must be an integer between 1 and ${AUDIT_MAX_FINDINGS_LIMIT}, or "${AUDIT_MAX_FINDINGS_ALL}"`;
+
+/**
+ * Validate `maxFindings`. `limit` is the effective numeric cap (Infinity for
+ * `all`); `reported` is the value echoed in the report's truncation block.
+ */
+export const resolveAuditMaxFindings = (
+  value: AuditMaxFindings | undefined
+):
+  | { ok: true; limit: number; reported: AuditMaxFindings }
+  | { ok: false; error: string } => {
+  if (value === AUDIT_MAX_FINDINGS_ALL) {
+    return {
+      ok: true,
+      limit: Number.POSITIVE_INFINITY,
+      reported: AUDIT_MAX_FINDINGS_ALL,
+    };
+  }
   const maxFindings = value ?? AUDIT_DEFAULT_MAX_FINDINGS;
   if (
     !Number.isSafeInteger(maxFindings) ||
     maxFindings < 1 ||
     maxFindings > AUDIT_MAX_FINDINGS_LIMIT
   ) {
-    return {
-      ok: false,
-      error: `maxFindings must be an integer between 1 and ${AUDIT_MAX_FINDINGS_LIMIT}`,
-    };
+    return { ok: false, error: AUDIT_MAX_FINDINGS_RANGE_MESSAGE };
   }
-  return { ok: true, maxFindings };
+  return { ok: true, limit: maxFindings, reported: maxFindings };
 };
 
+/** Parse a CLI `--max-findings` value: a positive integer or `all`. */
+export const parseAuditMaxFindingsInput = (
+  raw: string
+): AuditMaxFindings | undefined => {
+  const value = raw.trim();
+  if (value.toLowerCase() === AUDIT_MAX_FINDINGS_ALL) {
+    return AUDIT_MAX_FINDINGS_ALL;
+  }
+  if (!/^\d+$/.test(value)) return undefined;
+  const parsed = Number(value);
+  return resolveAuditMaxFindings(parsed).ok ? parsed : undefined;
+};
+
+const draftEvidenceTruncated = (contribution: AuditRuleContribution): boolean =>
+  contribution.evidenceTruncated === true ||
+  (contribution.findings ?? []).some(
+    (draft) =>
+      draft.evidence.length > AUDIT_MAX_EVIDENCE_PER_FINDING ||
+      draft.evidence.some(
+        (item) =>
+          item.detail !== undefined &&
+          Array.from(normalizeAuditText(item.detail)).length >
+            AUDIT_MAX_EVIDENCE_DETAIL_CHARS
+      )
+  );
+
 const fingerprintsEqual = (
   left: AuditFingerprints,
   right: AuditFingerprints
@@ -184,8 +226,16 @@ const materializeRule = (
     )
     .sort(compareAuditFindings);
 
+  // Only warning/error findings fail a passing rule; info findings of an
+  // informational rule (links.outside-index) leave it passing.
   let status = contribution.status;
-  if (findings.length > 0 && status === "pass") {
+  if (
+    status === "pass" &&
+    findings.some(
+      (finding) =>
+        finding.severity === "error" || finding.severity === "warning"
+    )
+  ) {
     status = "fail";
   }
 
@@ -231,7 +281,8 @@ const buildReportFromRules = (input: {
   versions: AuditVersions;
   rules: AuditRuleResult[];
   status: AuditReportStatus;
-  maxFindings: number;
+  maxFindings: { limit: number; reported: AuditMaxFindings };
+  evidenceTruncated: boolean;
   startedAt: string;
   completedAt: string;
   snapshotMs: number;
@@ -261,9 +312,9 @@ const buildReportFromRules = (input: {
     (sum, rule) => sum + rule.findingCount,
     0
   );
-  const truncated = exactFindingCount > input.maxFindings;
+  const truncated = exactFindingCount > input.maxFindings.limit;
   const returnedFindings = truncated
-    ? uniqueFindings.slice(0, input.maxFindings)
+    ? uniqueFindings.slice(0, input.maxFindings.limit)
     : uniqueFindings;
   const returnedFindingIds = new Set(
     returnedFindings.map((finding) => finding.id)
@@ -308,7 +359,11 @@ const buildReportFromRules = (input: {
     },
     truncation: {
       findingsTruncated: truncated,
-      maxFindings: input.maxFindings,
+      maxFindings: input.maxFindings.reported,
+      snapshotTruncated: rules.some(
+        (rule) => rule.skipReason === "snapshot_truncated"
+      ),
+      evidenceTruncated: input.evidenceTruncated,
     },
     timing: {
       snapshotMs: Math.max(0, Math.round(input.snapshotMs)),
@@ -329,7 +384,7 @@ export async function runAudit(input: AuditRunInput): Promise<AuditRunResult> {
   if (!scopeResult.ok) {
     return { ok: false, exit: "invalid", error: scopeResult.error };
   }
-  const maxFindingsResult = resolveMaxFindings(input.maxFindings);
+  const maxFindingsResult = resolveAuditMaxFindings(input.maxFindings);
   if (!maxFindingsResult.ok) {
     return { ok: false, exit: "invalid", error: maxFindingsResult.error };
   }
@@ -355,6 +410,7 @@ export async function runAudit(input: AuditRunInput): Promise<AuditRunResult> {
   let snapshotMs = 0;
   let rulesMs = 0;
   let lastRules: AuditRuleResult[] = [];
+  let lastEvidenceTruncated = false;
   let lastFingerprints: AuditFingerprints | null = null;
   let snapshotChanged = false;
   let failed = false;
@@ -405,6 +461,7 @@ export async function runAudit(input: AuditRunInput): Promise<AuditRunResult> {
     try {
       const contributions = await collectContributions(input.rules, ruleCtx);
       lastRules = contributions.map(materializeRule);
+      lastEvidenceTruncated = contributions.some(draftEvidenceTruncated);
     } catch (cause) {
       if (input.signal?.aborted) {
         lastRules = [cancellationRule()];
@@ -453,6 +510,7 @@ export async function runAudit(input: AuditRunInput): Promise<AuditRunResult> {
     }
     // Discard rule results from a drifted attempt; retry with a fresh snapshot.
     lastRules = [];
+    lastEvidenceTruncated = false;
   }
 
   const completedAt = clock();
@@ -484,7 +542,8 @@ export async function runAudit(input: AuditRunInput): Promise<AuditRunResult> {
         },
       ],
       status: "failed",
-      maxFindings: maxFindingsResult.maxFindings,
+      maxFindings: maxFindingsResult,
+      evidenceTruncated: false,
       startedAt: runStartedAt.toISOString(),
       completedAt: completedAt.toISOString(),
       snapshotMs,
@@ -531,7 +590,8 @@ export async function runAudit(input: AuditRunInput): Promise<AuditRunResult> {
             rules: rulesForReport,
             snapshotChanged: false,
           }),
-    maxFindings: maxFindingsResult.maxFindings,
+    maxFindings: maxFindingsResult,
+    evidenceTruncated: lastEvidenceTruncated,
     startedAt: runStartedAt.toISOString(),
     completedAt: completedAt.toISOString(),
     snapshotMs,

package/src/core/context-compiler.ts

@@ -355,6 +355,9 @@ export const planContextEvidence = async <T, P>(
       await deps.retrieve({
         query,
         collection,
+        // The primary search is partitioned per collection; graph expansion
+        // may bridge between the requested collections, never beyond them.
+        ...(collections.length > 0 ? { graphCollections: collections } : {}),
         noExpand: true,
         queryModes,
         tagsAll: input.tagsAll,

package/src/core/context-evidence.ts

@@ -40,6 +40,7 @@ import {
 import { planContextEvidence } from "./context-compiler";
 import { projectContextEvidenceMetadata } from "./context-evidence-metadata";
 import { createEgressLineage, resolveEgressLineage } from "./egress-provenance";
+import { linkResolutionFingerprintInput } from "./link-workspace";
 import { projectRecordEvidenceMetadata } from "./record-metadata";
 import {
   extractInclusiveLines,
@@ -205,6 +206,13 @@ const canonicalIndexSnapshot = (
     ),
 });
 
+const linkResolutionEntry = (
+  rows: Parameters<typeof linkResolutionFingerprintInput>[0]
+): { linkResolution?: ReturnType<typeof linkResolutionFingerprintInput> } => {
+  const linkResolution = linkResolutionFingerprintInput(rows);
+  return linkResolution ? { linkResolution } : {};
+};
+
 /** Capture one strict, content-free index/context snapshot before or after work. */
 export const captureContextEvidenceSnapshot = async (
   store: ContextEvidenceStore,
@@ -284,6 +292,9 @@ export const captureContextEvidenceSnapshot = async (
     indexFingerprint: hashJson({
       snapshots: indexSnapshots,
       egressLineage,
+      // Link workspace membership decides graph neighbours; a membership or
+      // resolver change is index drift. Absent without any workspace.
+      ...linkResolutionEntry(collectionRows),
     }),
   };
 };

package/src/core/graph-edge-confidence.ts

@@ -17,8 +17,30 @@ export const GRAPH_EDGE_CONFIDENCE_RANK: Record<GraphEdgeConfidence, number> = {
 export function classifyResolvedGraphEdge(
   linkType: "wiki" | "markdown",
   matchRank: number | null,
-  matchCount: number | null
+  matchCount: number | null,
+  /** Workspace resolution reason; semantic, independent of legacy ranks. */
+  reason?: string
 ): { confidence: GraphEdgeConfidence; audit: GraphEdgeAudit } {
+  if (linkType === "wiki" && reason !== undefined && reason !== "title") {
+    switch (reason) {
+      case "workspace-path":
+      case "collection-path":
+        return {
+          confidence: "explicit",
+          audit: { resolution: "exact-path", matchCount: 1 },
+        };
+      case "exact-name":
+        return {
+          confidence: "explicit",
+          audit: { resolution: "exact-name", matchCount: 1 },
+        };
+      default:
+        return {
+          confidence: "inferred",
+          audit: { resolution: "tie-break", matchCount: 1 },
+        };
+    }
+  }
   if (linkType === "markdown") {
     return {
       confidence: "explicit",

package/src/core/host-paths.ts

@@ -22,6 +22,7 @@ export const OWNER_CONFIG_PATH_FIELDS: ReadonlySet<string> = new Set([
   "configPath",
   "dbPath",
   "path",
+  "workspaceRoot",
 ]);
 
 const isPlainObject = (value: object): boolean => {

package/src/core/knowledge-impact.ts

@@ -41,6 +41,12 @@ export interface KnowledgeImpactResult {
 }
 
 export interface KnowledgeImpactInput {
+  /**
+   * Collection scope: only documents in these collections are traversed or
+   * returned, and a document outside them is never used as a bridge.
+   * Omitted or empty means every indexed collection.
+   */
+  collections?: string[];
   maxDepth?: number;
   maxNodes?: number;
   maxEdges?: number;
@@ -118,8 +124,30 @@ export async function analyzeKnowledgeImpact(
       isValidation: true,
     };
   }
+  const scope = [...new Set(input.collections ?? [])].sort();
+  if (scope.length > 0) {
+    const known = await store.getCollections();
+    if (!known.ok) return { success: false, error: known.error.message };
+    const names = new Set(known.value.map((row) => row.name));
+    const missing = scope.find((name) => !names.has(name));
+    if (missing) {
+      return {
+        success: false,
+        error: `Collection not found: ${missing}`,
+        isValidation: true,
+      };
+    }
+    if (!scope.includes(resolved.doc.collection)) {
+      return {
+        success: false,
+        error: `Document is outside the requested collections: ${ref}`,
+        isValidation: true,
+      };
+    }
+  }
   const traversal = await store.queryGraphTraversal(resolved.doc.id, {
     direction: "in",
+    ...(scope.length > 0 ? { collections: scope } : {}),
     maxDepth: values.maxDepth,
     maxNodes: values.maxNodes,
     frontierLimit: values.frontierLimit,

package/src/core/link-inventory-markdown.ts

@@ -23,7 +23,7 @@ import {
   pushInventoryToken,
 } from "./link-inventory-opaque";
 import { isRelevantDestination } from "./link-relevance";
-import { parseTargetParts } from "./links";
+import { parseTargetParts, splitWikiLinkContent } from "./links";
 
 const EXTERNAL_URL_REGEX = /^[a-z][a-z0-9+.-]*:/i;
 
@@ -51,8 +51,7 @@ export function inventoryWikiLinks(
     }
 
     const content = match[1] ?? "";
-    const pipeIndex = content.indexOf("|");
-    const targetPart = pipeIndex >= 0 ? content.slice(0, pipeIndex) : content;
+    const targetPart = splitWikiLinkContent(content).target;
     const trimmedTarget = targetPart.trim();
     if (!trimmedTarget) continue;
     const leadingWs = targetPart.length - targetPart.trimStart().length;