@grafema/core 0.1.0-alpha.5 → 0.1.1-alpha

package/src/plugins/validation/SQLInjectionValidator.ts

@@ -104,18 +104,21 @@ export class SQLInjectionValidator extends Plugin {
       phase: 'VALIDATION',
       priority: 90, // After ValueDomainAnalyzer (65)
       creates: {
-        nodes: [],
-        edges: []
+        nodes: ['issue:security'],
+        edges: ['AFFECTS']
       }
     };
   }
 
   async execute(context: PluginContext): Promise<PluginResult> {
     const { graph } = context;
+    const logger = this.log(context);
 
-    console.log('[SQLInjectionValidator] Checking for SQL injection vulnerabilities...');
+    logger.info('Starting SQL injection vulnerability check');
 
     const issues: SQLInjectionIssue[] = [];
+    let issueNodeCount = 0;
+    let affectsEdgeCount = 0;
 
     // 1. Find all CALL nodes that look like SQL queries
     const sqlCalls: CallNode[] = [];
@@ -127,13 +130,13 @@ export class SQLInjectionValidator extends Plugin {
       }
     }
 
-    console.log(`[SQLInjectionValidator] Found ${sqlCalls.length} potential SQL calls`);
+    logger.debug('SQL calls collected', { count: sqlCalls.length });
 
     // 2. For each SQL call, analyze the query argument
     for (const call of sqlCalls) {
       const result = await this.analyzeQueryCall(call, graph);
       if (result.isVulnerable) {
-        issues.push({
+        const issue: SQLInjectionIssue = {
           type: 'SQL_INJECTION',
           severity: 'ERROR',
           message: `Potential SQL injection at ${call.file}:${call.line || '?'} - ${result.reason}`,
@@ -142,37 +145,79 @@ export class SQLInjectionValidator extends Plugin {
           line: call.line as number | undefined,
           reason: result.reason!,
           nondeterministicSources: result.sources
-        });
+        };
+        issues.push(issue);
+
+        // Persist issue to graph if reportIssue is available
+        if (context.reportIssue) {
+          await context.reportIssue({
+            category: 'security',
+            severity: 'error',
+            message: issue.message,
+            file: call.file || '',
+            line: call.line || 0,
+            column: call.column || 0,
+            targetNodeId: call.id,
+            context: {
+              type: 'SQL_INJECTION',
+              reason: result.reason,
+              nondeterministicSources: result.sources
+            }
+          });
+          issueNodeCount++;
+          affectsEdgeCount++;
+        }
       }
     }
 
     // 3. Also check via graph pattern - CALL nodes that have ARGUMENT -> PARAMETER paths
-    const patternViolations = await this.checkViaGraphPattern(graph, sqlCalls);
+    const patternViolations = await this.checkViaGraphPattern(graph, logger, sqlCalls);
     for (const violation of patternViolations) {
       // Avoid duplicates
       if (!issues.find(i => i.nodeId === violation.nodeId)) {
         issues.push(violation);
+
+        // Persist issue to graph if reportIssue is available
+        if (context.reportIssue) {
+          await context.reportIssue({
+            category: 'security',
+            severity: 'error',
+            message: violation.message,
+            file: violation.file || '',
+            line: violation.line || 0,
+            targetNodeId: violation.nodeId,
+            context: {
+              type: 'SQL_INJECTION',
+              reason: violation.reason,
+              nondeterministicSources: violation.nondeterministicSources
+            }
+          });
+          issueNodeCount++;
+          affectsEdgeCount++;
+        }
       }
     }
 
     const summary = {
       sqlCallsChecked: sqlCalls.length,
-      vulnerabilitiesFound: issues.length
+      vulnerabilitiesFound: issues.length,
+      issueNodesCreated: issueNodeCount,
+      affectsEdgesCreated: affectsEdgeCount
     };
 
-    console.log('[SQLInjectionValidator] Summary:', summary);
+    logger.info('Validation complete', summary);
 
     if (issues.length > 0) {
-      console.log('[SQLInjectionValidator] ❌ SQL injection vulnerabilities found:');
+      logger.warn('SQL injection vulnerabilities found', { count: issues.length });
       for (const issue of issues) {
-        console.log(`  🚫 ${issue.message}`);
+        logger.warn(issue.message);
       }
     } else {
-      console.log('[SQLInjectionValidator] ✅ No SQL injection vulnerabilities detected');
+      logger.info('No SQL injection vulnerabilities detected');
     }
 
     return createSuccessResult(
-      { nodes: 0, edges: 0 },
+      { nodes: issueNodeCount, edges: affectsEdgeCount },
       { summary, issues }
     );
   }
@@ -307,6 +352,7 @@ export class SQLInjectionValidator extends Plugin {
    */
   private async checkViaGraphPattern(
     graph: PluginContext['graph'],
+    logger: ReturnType<typeof this.log>,
     excludeCalls: CallNode[] = []
   ): Promise<SQLInjectionIssue[]> {
     const issues: SQLInjectionIssue[] = [];
@@ -316,7 +362,7 @@ export class SQLInjectionValidator extends Plugin {
     try {
       // Check if graph supports checkGuarantee
       if (!graph.checkGuarantee) {
-        console.log('[SQLInjectionValidator] Graph does not support checkGuarantee, skipping pattern-based check');
+        logger.debug('Graph does not support checkGuarantee, skipping pattern-based check');
         return issues;
       }
 
@@ -353,7 +399,7 @@ export class SQLInjectionValidator extends Plugin {
       }
     } catch (err) {
       // Datalog query might fail if backend doesn't support it
-      console.log('[SQLInjectionValidator] Datalog check skipped:', (err as Error).message);
+      logger.debug('Datalog check skipped', { error: (err as Error).message });
     }
 
     return issues;

package/src/plugins/validation/ShadowingDetector.ts

@@ -70,8 +70,9 @@ export class ShadowingDetector extends Plugin {
 
   async execute(context: PluginContext): Promise<PluginResult> {
     const { graph } = context;
+    const logger = this.log(context);
 
-    console.log('[ShadowingDetector] Checking for variable shadowing...');
+    logger.info('Starting variable shadowing detection');
 
     const issues: ShadowingIssue[] = [];
 
@@ -154,15 +155,15 @@ export class ShadowingDetector extends Plugin {
       totalIssues: issues.length
     };
 
-    console.log('[ShadowingDetector] Summary:', summary);
+    logger.info('Detection complete', { ...summary });
 
     if (issues.length > 0) {
-      console.log('[ShadowingDetector] Shadowing issues found:');
+      logger.warn('Shadowing issues found', { count: issues.length });
       for (const issue of issues) {
-        console.log(`  ${issue.type === 'CROSS_FILE_SHADOW' ? '📁' : '🔒'} ${issue.message}`);
+        logger.warn(issue.message, { type: issue.type });
       }
     } else {
-      console.log('[ShadowingDetector] No shadowing issues detected');
+      logger.info('No shadowing issues detected');
     }
 
     return createSuccessResult(

package/src/plugins/validation/TypeScriptDeadCodeValidator.ts

@@ -58,14 +58,15 @@ export class TypeScriptDeadCodeValidator extends Plugin {
 
   async execute(context: PluginContext): Promise<PluginResult> {
     const { graph } = context;
+    const logger = this.log(context);
 
-    console.log('[TypeScriptDeadCodeValidator] Checking for dead TypeScript code...');
+    logger.info('Starting TypeScript dead code analysis');
     const startTime = Date.now();
 
     const issues: DeadCodeIssue[] = [];
 
     // Collect all interfaces
-    console.log('[TypeScriptDeadCodeValidator] Collecting interfaces...');
+    logger.debug('Collecting interfaces');
     const interfaces: Map<string, { id: string; name: string; file?: string; line?: number; properties?: unknown[] }> = new Map();
 
     for await (const node of graph.queryNodes({ nodeType: 'INTERFACE' })) {
@@ -80,10 +81,10 @@ export class TypeScriptDeadCodeValidator extends Plugin {
         properties: (node as { properties?: unknown[] }).properties
       });
     }
-    console.log(`[TypeScriptDeadCodeValidator] Found ${interfaces.size} interfaces`);
+    logger.debug('Interfaces collected', { count: interfaces.size });
 
     // Find interfaces with IMPLEMENTS or EXTENDS edges
-    console.log('[TypeScriptDeadCodeValidator] Checking implementations...');
+    logger.debug('Checking implementations');
     const implementedInterfaces: Map<string, number> = new Map();
 
     // Get all edges and filter by type (no queryEdges in GraphBackend yet)
@@ -168,31 +169,31 @@ export class TypeScriptDeadCodeValidator extends Plugin {
       timeSeconds: totalTime
     };
 
-    console.log('[TypeScriptDeadCodeValidator] Summary:', summary);
+    logger.info('Analysis complete', { ...summary });
 
     // Report issues
     const warnings = issues.filter(i => i.severity === 'WARNING');
     const infos = issues.filter(i => i.severity === 'INFO');
 
     if (warnings.length > 0) {
-      console.log(`[TypeScriptDeadCodeValidator] ⚠️  ${warnings.length} warning(s):`);
+      logger.warn('Warnings found', { count: warnings.length });
       for (const issue of warnings) {
-        console.log(`  ⚠️  ${issue.message}`);
+        logger.warn(issue.message);
       }
     }
 
     if (infos.length > 0) {
-      console.log(`[TypeScriptDeadCodeValidator] ℹ️  ${infos.length} info(s):`);
+      logger.info('Info messages', { count: infos.length });
       for (const issue of infos.slice(0, 5)) { // Limit to first 5
-        console.log(`  ℹ️  ${issue.message}`);
+        logger.info(issue.message);
       }
       if (infos.length > 5) {
-        console.log(`  ... and ${infos.length - 5} more`);
+        logger.debug(`... and ${infos.length - 5} more`);
       }
     }
 
     if (issues.length === 0) {
-      console.log('[TypeScriptDeadCodeValidator] ✅ No dead TypeScript code detected');
+      logger.info('No dead TypeScript code detected');
     }
 
     return createSuccessResult(

package/src/plugins/vcs/GitPlugin.ts

@@ -7,6 +7,7 @@
 
 import { VCSPlugin, FileStatus } from './VCSPlugin.js';
 import type { VCSConfig, VCSPluginMetadata, ChangedFile, FileDiff, DiffHunk } from './VCSPlugin.js';
+import { FileAccessError } from '../../errors/GrafemaError.js';
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { join } from 'path';
@@ -113,8 +114,12 @@ export class GitPlugin extends VCSPlugin {
 
       return files;
     } catch (error) {
-      console.error('[GitPlugin] Failed to get changed files:', (error as Error).message);
-      return [];
+      throw new FileAccessError(
+        `Failed to get changed files: ${(error as Error).message}`,
+        'ERR_GIT_ACCESS_DENIED',
+        { plugin: 'GitPlugin' },
+        'Check that git is installed and this is a valid git repository'
+      );
     }
   }
 
@@ -152,8 +157,12 @@ export class GitPlugin extends VCSPlugin {
       // Парсим unified diff
       return this._parseUnifiedDiff(filePath, stdout);
     } catch (error) {
-      console.error(`[GitPlugin] Failed to get diff for ${filePath}:`, (error as Error).message);
-      return { path: filePath, hunks: [] };
+      throw new FileAccessError(
+        `Failed to get diff for ${filePath}: ${(error as Error).message}`,
+        'ERR_GIT_ACCESS_DENIED',
+        { plugin: 'GitPlugin', filePath },
+        'Ensure the file is tracked by git and the working directory is accessible'
+      );
     }
   }
 
@@ -164,8 +173,13 @@ export class GitPlugin extends VCSPlugin {
     try {
       const { stdout } = await this._exec('git rev-parse --abbrev-ref HEAD');
       return stdout.trim();
-    } catch {
-      return 'unknown';
+    } catch (error) {
+      throw new FileAccessError(
+        `Failed to get current branch: ${(error as Error).message}`,
+        'ERR_GIT_ACCESS_DENIED',
+        { plugin: 'GitPlugin' },
+        'Ensure this is a valid git repository with at least one commit'
+      );
     }
   }
 
@@ -176,8 +190,13 @@ export class GitPlugin extends VCSPlugin {
     try {
       const { stdout } = await this._exec('git rev-parse HEAD');
       return stdout.trim();
-    } catch {
-      return null;
+    } catch (error) {
+      throw new FileAccessError(
+        `Failed to get last commit hash: ${(error as Error).message}`,
+        'ERR_GIT_NOT_FOUND',
+        { plugin: 'GitPlugin' },
+        'Ensure this is a valid git repository with at least one commit'
+      );
     }
   }
 
@@ -309,8 +328,12 @@ export class GitPlugin extends VCSPlugin {
       const { stdout } = await this._exec('git ls-files');
       return stdout.trim().split('\n').filter(line => line.length > 0);
     } catch (error) {
-      console.error('[GitPlugin] Failed to get tracked files:', (error as Error).message);
-      return [];
+      throw new FileAccessError(
+        `Failed to get tracked files: ${(error as Error).message}`,
+        'ERR_GIT_ACCESS_DENIED',
+        { plugin: 'GitPlugin' },
+        'Check that git is installed and this is a valid git repository'
+      );
     }
   }
 
@@ -329,8 +352,13 @@ export class GitPlugin extends VCSPlugin {
         timestamp: parseInt(lines[3]) * 1000,
         message: lines[4]
       };
-    } catch {
-      return null;
+    } catch (error) {
+      throw new FileAccessError(
+        `Failed to get last commit info: ${(error as Error).message}`,
+        'ERR_GIT_NOT_FOUND',
+        { plugin: 'GitPlugin' },
+        'Ensure this is a valid git repository with at least one commit'
+      );
     }
   }
 

package/src/plugins/vcs/VCSPlugin.ts

@@ -12,6 +12,8 @@
  * - Perforce
  */
 
+import type { Logger } from '../../logging/Logger.js';
+
 /**
  * VCS Plugin configuration
  */
@@ -154,13 +156,13 @@ export class VCSPluginFactory {
   /**
    * Автоматически определить и создать подходящий VCS плагин
    */
-  static async detect(config: VCSConfig = {}): Promise<VCSPlugin | null> {
+  static async detect(config: VCSConfig = {}, logger?: Logger): Promise<VCSPlugin | null> {
     for (const PluginClass of this.availablePlugins) {
       const plugin = new PluginClass(config);
 
       try {
         if (await plugin.isAvailable()) {
-          console.log(`[VCS] Detected ${plugin.metadata.name}`);
+          logger?.info('VCS detected', { name: plugin.metadata.name });
           return plugin;
         }
       } catch {
@@ -168,20 +170,20 @@ export class VCSPluginFactory {
       }
     }
 
-    console.warn('[VCS] No VCS system detected');
+    logger?.warn('No VCS system detected');
     return null;
   }
 
   /**
    * Создать плагин по имени
    */
-  static create(name: string, config: VCSConfig = {}): VCSPlugin | null {
+  static create(name: string, config: VCSConfig = {}, logger?: Logger): VCSPlugin | null {
     const PluginClass = this.availablePlugins.find(
       Plugin => new Plugin(config).metadata.name === name
     );
 
     if (!PluginClass) {
-      console.error(`[VCS] Plugin "${name}" not found`);
+      logger?.error('VCS plugin not found', { name });
       return null;
     }
 

package/src/storage/backends/RFDBServerBackend.ts

@@ -27,6 +27,7 @@ import { setTimeout as sleep } from 'timers/promises';
 
 import type { WireNode, WireEdge } from '@grafema/types';
 import type { NodeType, EdgeType } from '@grafema/types';
+import type { BaseNodeRecord } from '@grafema/types';
 import type { AttrQuery, GraphStats, GraphExport } from '../../core/GraphBackend.js';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -40,19 +41,6 @@ export interface RFDBServerBackendOptions {
   dbPath?: string;
 }
 
-/**
- * Node as returned from the backend
- */
-export interface BackendNode {
-  id: string;
-  type: string;
-  nodeType: string;
-  name: string;
-  file: string;
-  exported: boolean;
-  [key: string]: unknown;
-}
-
 /**
  * Edge as returned from the backend
  */
@@ -283,20 +271,26 @@ export class RFDBServerBackend {
   }
 
   /**
-   * Close connection and stop server if we started it
+   * Close client connection. Server continues running to serve other clients.
    */
   async close(): Promise<void> {
+    // Request server flush before disconnecting
     if (this.client) {
+      try {
+        await this.client.flush();
+      } catch {
+        // Ignore flush errors on close - best effort
+      }
       await this.client.close();
       this.client = null;
     }
     this.connected = false;
 
-    // Kill server process if we started it
-    if (this.serverProcess) {
-      this.serverProcess.kill('SIGTERM');
-      this.serverProcess = null;
-    }
+    // NOTE: We intentionally do NOT kill the server process.
+    // The server continues running to serve other clients (MCP, other CLI invocations).
+    // This is by design for multi-client architecture.
+    // Server lifecycle is managed separately (system process, or manual grafema server stop).
+    this.serverProcess = null;
   }
 
   /**
@@ -371,14 +365,22 @@ export class RFDBServerBackend {
     }
 
     const wireEdges: WireEdge[] = edges.map(e => {
-      const { src, dst, type, edgeType, edge_type, etype, ...rest } = e;
+      const { src, dst, type, edgeType, edge_type, etype, metadata, ...rest } = e;
+
+      // Flatten metadata: spread both edge-level properties and nested metadata
+      const flatMetadata = {
+        _origSrc: String(src),
+        _origDst: String(dst),
+        ...rest,
+        ...(typeof metadata === 'object' && metadata !== null ? metadata : {})
+      };
 
       return {
         src: String(src),
         dst: String(dst),
         edgeType: (edgeType || edge_type || etype || type || 'UNKNOWN') as EdgeType,
-        // Store original string IDs in metadata for retrieval
-        metadata: JSON.stringify({ _origSrc: String(src), _origDst: String(dst), ...rest }),
+        // Store flattened metadata for retrieval
+        metadata: JSON.stringify(flatMetadata),
       };
     });
 
@@ -388,7 +390,7 @@ export class RFDBServerBackend {
   /**
    * Get a node by ID
    */
-  async getNode(id: string): Promise<BackendNode | null> {
+  async getNode(id: string): Promise<BaseNodeRecord | null> {
     if (!this.client) throw new Error('Not connected');
     const node = await this.client.getNode(String(id));
     if (!node) return null;
@@ -423,7 +425,7 @@ export class RFDBServerBackend {
   /**
    * Parse a node from wire format to JS format
    */
-  private _parseNode(wireNode: WireNode): BackendNode {
+  private _parseNode(wireNode: WireNode): BaseNodeRecord {
     const metadata: Record<string, unknown> = wireNode.metadata ? JSON.parse(wireNode.metadata) : {};
 
     // Parse nested JSON strings
@@ -441,7 +443,6 @@ export class RFDBServerBackend {
 
     return {
       id: humanId,
-      nodeType: wireNode.nodeType,
       type: wireNode.nodeType,
       name: wireNode.name,
       file: wireNode.file,
@@ -453,7 +454,7 @@ export class RFDBServerBackend {
   /**
    * Async generator for querying nodes
    */
-  async *queryNodes(query: NodeQuery): AsyncGenerator<BackendNode, void, unknown> {
+  async *queryNodes(query: NodeQuery): AsyncGenerator<BaseNodeRecord, void, unknown> {
     if (!this.client) throw new Error('Not connected');
 
     // Build query for server
@@ -482,8 +483,8 @@ export class RFDBServerBackend {
   /**
    * Get ALL nodes matching query (collects from queryNodes into array)
    */
-  async getAllNodes(query: NodeQuery = {}): Promise<BackendNode[]> {
-    const nodes: BackendNode[] = [];
+  async getAllNodes(query: NodeQuery = {}): Promise<BaseNodeRecord[]> {
+    const nodes: BaseNodeRecord[] = [];
     for await (const node of this.queryNodes(query)) {
       nodes.push(node);
     }
@@ -587,6 +588,19 @@ export class RFDBServerBackend {
     return this.client.dfs(startIds, maxDepth, edgeTypes);
   }
 
+  /**
+   * Reachability query - find all nodes reachable from start nodes
+   */
+  async reachability(
+    startIds: string[],
+    maxDepth: number,
+    edgeTypes: EdgeType[] = [],
+    backward: boolean = false
+  ): Promise<string[]> {
+    if (!this.client) throw new Error('Not connected');
+    return this.client.reachability(startIds, maxDepth, edgeTypes, backward);
+  }
+
   // ===========================================================================
   // Statistics
   // ===========================================================================
@@ -713,7 +727,7 @@ export class RFDBServerBackend {
   /**
    * Find nodes by predicate (for compatibility)
    */
-  async findNodes(predicate: (node: BackendNode) => boolean): Promise<BackendNode[]> {
+  async findNodes(predicate: (node: BaseNodeRecord) => boolean): Promise<BaseNodeRecord[]> {
     const allNodes = await this.getAllNodes();
     return allNodes.filter(predicate);
   }

package/src/validation/PathValidator.ts

@@ -50,7 +50,7 @@ export interface PathValidationResult {
 /**
  * Endpoint diff info
  */
-interface EndpointDiff {
+export interface EndpointDiff {
   type: string;
   name: string;
   reason: string;

package/dist/core/AnalysisWorker.d.ts

@@ -1,14 +0,0 @@
-/**
- * AnalysisWorker - worker thread for parallel AST analysis
- *
- * Each worker:
- * 1. Connects to RFDB server
- * 2. Receives file paths to analyze
- * 3. Parses AST and writes nodes/edges directly to RFDB
- *
- * Communication:
- *   Main -> Worker: { type: 'analyze', file, moduleId, moduleName }
- *   Worker -> Main: { type: 'done', file, stats } | { type: 'error', file, error }
- */
-export {};
-//# sourceMappingURL=AnalysisWorker.d.ts.map

package/dist/core/AnalysisWorker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AnalysisWorker.d.ts","sourceRoot":"","sources":["../../src/core/AnalysisWorker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}