@harness-engineering/core 0.24.0 → 0.26.0

package/dist/index.js

@@ -184,6 +184,7 @@ __export(index_exports, {
   ViolationHistorySchema: () => ViolationHistorySchema,
   ViolationSchema: () => ViolationSchema,
   ViolationSnapshotSchema: () => ViolationSnapshotSchema,
+  WHATWG_BAD_PORTS: () => WHATWG_BAD_PORTS,
   acquireCompoundLock: () => acquireCompoundLock,
   addProvenance: () => addProvenance,
   agentConfigRules: () => agentConfigRules,
@@ -209,6 +210,7 @@ __export(index_exports, {
   archiveStream: () => archiveStream,
   assembleCandidateReport: () => assembleCandidateReport,
   assembleReport: () => assembleReport,
+  assertPortUsable: () => assertPortUsable,
   assertSanitized: () => assertSanitized,
   assignFeature: () => assignFeature,
   buildDependencyGraph: () => buildDependencyGraph,
@@ -323,6 +325,7 @@ __export(index_exports, {
   goRules: () => goRules,
   injectionRules: () => injectionRules,
   insecureDefaultsRules: () => insecureDefaultsRules,
+  isBadPort: () => isBadPort,
   isDuplicateFinding: () => isDuplicateFinding,
   isRegression: () => isRegression,
   isSanitizedResult: () => isSanitizedResult,
@@ -456,6 +459,7 @@ __export(index_exports, {
   validateAgentConfigs: () => validateAgentConfigs,
   validateAgentsMap: () => validateAgentsMap,
   validateBoundaries: () => validateBoundaries,
+  validateBranchName: () => validateBranchName,
   validateCommitMessage: () => validateCommitMessage,
   validateConfig: () => validateConfig,
   validateDependencies: () => validateDependencies,
@@ -1404,6 +1408,103 @@ function getDefaultRegistry() {
   return registry;
 }
 
+// src/shared/port.ts
+var WHATWG_BAD_PORTS = Object.freeze([
+  1,
+  7,
+  9,
+  11,
+  13,
+  15,
+  17,
+  19,
+  20,
+  21,
+  22,
+  23,
+  25,
+  37,
+  42,
+  43,
+  53,
+  69,
+  77,
+  79,
+  87,
+  95,
+  101,
+  102,
+  103,
+  104,
+  109,
+  110,
+  111,
+  113,
+  115,
+  117,
+  119,
+  123,
+  135,
+  137,
+  139,
+  143,
+  161,
+  179,
+  389,
+  427,
+  465,
+  512,
+  513,
+  514,
+  515,
+  526,
+  530,
+  531,
+  532,
+  540,
+  548,
+  554,
+  556,
+  563,
+  587,
+  601,
+  636,
+  989,
+  990,
+  993,
+  995,
+  1719,
+  1720,
+  1723,
+  2049,
+  3659,
+  4045,
+  4190,
+  5060,
+  5061,
+  6e3,
+  6566,
+  6665,
+  6666,
+  6667,
+  6668,
+  6669,
+  6679,
+  6697,
+  10080
+]);
+var BAD_PORT_SET = new Set(WHATWG_BAD_PORTS);
+function isBadPort(port) {
+  return BAD_PORT_SET.has(port);
+}
+function assertPortUsable(port, label = "server") {
+  if (isBadPort(port)) {
+    throw new Error(
+      `Refusing to bind ${label} to port ${port}: this port is on the WHATWG fetch bad-ports list, so browsers and Node's fetch() will reject every connection with "bad port". Choose a different port. See https://fetch.spec.whatwg.org/#port-blocking for the full list.`
+    );
+  }
+}
+
 // src/validation/file-structure.ts
 async function validateFileStructure(projectPath, conventions) {
   const missing = [];
@@ -1779,7 +1880,7 @@ function isAgnixDisabled() {
   return v === "1" || v === "true";
 }
 function runAgnix(cwd, strict, binPath, timeoutMs = DEFAULT_AGNIX_TIMEOUT_MS, spawnFn = import_node_child_process.spawn) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const args = ["--format", "json"];
     if (strict) args.push("--strict");
     args.push(cwd);
@@ -1793,7 +1894,7 @@ function runAgnix(cwd, strict, binPath, timeoutMs = DEFAULT_AGNIX_TIMEOUT_MS, sp
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve11(outcome);
+      resolve12(outcome);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -2958,8 +3059,82 @@ function validateRoadmapMode(config, projectRoot) {
   return (0, import_types.Ok)(void 0);
 }
 
-// src/context/doc-coverage.ts
+// src/validation/branch.ts
 var import_minimatch = require("minimatch");
+var KEBAB_CASE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var TICKET_ID = /^([A-Z0-9]+-[0-9]+)-(.*)$/;
+function validateBranchName(branchName, config) {
+  for (const pattern of config.ignore) {
+    if ((0, import_minimatch.minimatch)(branchName, pattern)) {
+      return { valid: true, branchName };
+    }
+  }
+  if (config.customRegex) {
+    const regex = new RegExp(config.customRegex);
+    if (!regex.test(branchName)) {
+      return {
+        valid: false,
+        branchName,
+        message: `Branch name "${branchName}" does not match the custom regex: ${config.customRegex}`
+      };
+    }
+    return { valid: true, branchName };
+  }
+  const parts = branchName.split("/");
+  if (parts.length < 2) {
+    return {
+      valid: false,
+      branchName,
+      message: `Branch name "${branchName}" must have a prefix followed by a slash (e.g., "feat/my-feature").`,
+      suggestion: `Try renaming to "feat/${branchName}" or "fix/${branchName}".`
+    };
+  }
+  const prefix = parts[0];
+  const slug = parts.slice(1).join("/");
+  if (!config.prefixes.includes(prefix)) {
+    return {
+      valid: false,
+      branchName,
+      message: `Prefix "${prefix}" is not allowed.`,
+      suggestion: `Allowed prefixes: ${config.prefixes.join(", ")}.`
+    };
+  }
+  if (config.enforceKebabCase) {
+    for (const part of slug.split("/")) {
+      const ticketMatch = part.match(TICKET_ID);
+      if (ticketMatch) {
+        const rest = ticketMatch[2];
+        if (rest && !KEBAB_CASE.test(rest)) {
+          return {
+            valid: false,
+            branchName,
+            message: `Branch slug part "${part}" does not follow kebab-case after the ticket ID.`,
+            suggestion: `Ensure the description after "${ticketMatch[1]}" uses kebab-case (lowercase, single hyphens, no leading/trailing hyphen).`
+          };
+        }
+      } else if (!KEBAB_CASE.test(part)) {
+        return {
+          valid: false,
+          branchName,
+          message: `Branch slug part "${part}" must be in kebab-case (lowercase, single hyphens, no leading/trailing hyphen).`,
+          suggestion: `Change "${part}" to match the convention.`
+        };
+      }
+    }
+  }
+  if (typeof config.maxLength === "number" && config.maxLength > 0 && slug.length > config.maxLength) {
+    return {
+      valid: false,
+      branchName,
+      message: `Branch slug is ${slug.length} characters; max allowed is ${config.maxLength}.`,
+      suggestion: `Shorten the description after "${prefix}/" to ${config.maxLength} characters or fewer.`
+    };
+  }
+  return { valid: true, branchName };
+}
+
+// src/context/doc-coverage.ts
+var import_minimatch2 = require("minimatch");
 var import_path2 = require("path");
 function determineImportance(filePath) {
   const name = (0, import_path2.basename)(filePath).toLowerCase();
@@ -3002,7 +3177,7 @@ async function checkDocCoverage(domain, options = {}) {
     const filteredSourceFiles = sourceFiles.filter((file) => {
       const relativePath = relativePosix(sourceDir, file);
       return !excludePatterns.some((pattern) => {
-        return (0, import_minimatch.minimatch)(relativePath, pattern, { dot: true }) || (0, import_minimatch.minimatch)(file, pattern, { dot: true });
+        return (0, import_minimatch2.minimatch)(relativePath, pattern, { dot: true }) || (0, import_minimatch2.minimatch)(file, pattern, { dot: true });
       });
     });
     const docFiles = await findFiles("**/*.md", docsDir);
@@ -3536,7 +3711,7 @@ function getPhaseCategories(phase) {
 }
 
 // src/constraints/layers.ts
-var import_minimatch2 = require("minimatch");
+var import_minimatch3 = require("minimatch");
 function defineLayer(name, patterns, allowedDependencies) {
   return {
     name,
@@ -3547,7 +3722,7 @@ function defineLayer(name, patterns, allowedDependencies) {
 function resolveFileToLayer(file, layers) {
   for (const layer of layers) {
     for (const pattern of layer.patterns) {
-      if ((0, import_minimatch2.minimatch)(file, pattern)) {
+      if ((0, import_minimatch3.minimatch)(file, pattern)) {
         return layer;
       }
     }
@@ -4566,8 +4741,12 @@ function parseProtectedRegions(files) {
 }
 
 // src/entropy/snapshot.ts
+var import_graph = require("@harness-engineering/graph");
+var import_path7 = require("path");
+var import_minimatch4 = require("minimatch");
+
+// src/entropy/entry-points.ts
 var import_path6 = require("path");
-var import_minimatch3 = require("minimatch");
 function collectFieldEntries(rootDir, field) {
   if (typeof field === "string") return [(0, import_path6.resolve)(rootDir, field)];
   if (typeof field === "object" && field !== null) {
@@ -4581,47 +4760,263 @@ function extractPackageEntries(rootDir, pkg) {
   if (entries.length === 0 && typeof pkg["main"] === "string") {
     entries.push((0, import_path6.resolve)(rootDir, pkg["main"]));
   }
-  if (pkg["bin"]) {
-    entries.push(...collectFieldEntries(rootDir, pkg["bin"]));
-  }
+  if (pkg["bin"]) entries.push(...collectFieldEntries(rootDir, pkg["bin"]));
   return entries;
 }
-async function resolveEntryPoints(rootDir, explicitEntries) {
-  if (explicitEntries && explicitEntries.length > 0) {
-    return (0, import_types.Ok)(explicitEntries.map((e) => (0, import_path6.resolve)(rootDir, e)));
+var TS_HINTS = ['Add "exports" or "main" to package.json', "Create src/index.ts"];
+var TS_CONVENTIONS = ["src/index.ts", "src/main.ts", "src/index.tsx", "index.ts", "main.ts"];
+async function readPackageJsonEntries(rootDir, pkgPath) {
+  const content = await readFileContent(pkgPath);
+  if (!content.ok) return [];
+  try {
+    const pkg = JSON.parse(content.value);
+    return extractPackageEntries(rootDir, pkg);
+  } catch {
+    return [];
   }
+}
+async function resolveTypeScript(rootDir) {
   const pkgPath = (0, import_path6.join)(rootDir, "package.json");
-  if (await fileExists(pkgPath)) {
-    const pkgContent = await readFileContent(pkgPath);
-    if (pkgContent.ok) {
-      try {
-        const pkg = JSON.parse(pkgContent.value);
-        const entries = extractPackageEntries(rootDir, pkg);
-        if (entries.length > 0) return (0, import_types.Ok)(entries);
-      } catch {
-      }
+  const detected = await fileExists(pkgPath);
+  if (detected) {
+    const entries = await readPackageJsonEntries(rootDir, pkgPath);
+    if (entries.length > 0) {
+      return { language: "typescript", detected: true, entries, hints: TS_HINTS };
+    }
+  }
+  for (const conv of TS_CONVENTIONS) {
+    const p = (0, import_path6.join)(rootDir, conv);
+    if (await fileExists(p)) {
+      return { language: "typescript", detected: true, entries: [p], hints: TS_HINTS };
+    }
+  }
+  return { language: "typescript", detected, entries: [], hints: TS_HINTS };
+}
+var PYTHON_HINTS = [
+  "Add an entry to [project.scripts] in pyproject.toml",
+  "Create main.py or <package>/__main__.py"
+];
+var PYTHON_CONVENTIONS = [
+  "__main__.py",
+  "main.py",
+  "app.py",
+  "src/__main__.py",
+  "src/main.py",
+  "src/app.py"
+];
+async function detectPython(rootDir) {
+  return await fileExists((0, import_path6.join)(rootDir, "pyproject.toml")) || await fileExists((0, import_path6.join)(rootDir, "setup.py")) || await fileExists((0, import_path6.join)(rootDir, "requirements.txt"));
+}
+async function readPyProject(rootDir) {
+  const pyproject = (0, import_path6.join)(rootDir, "pyproject.toml");
+  if (!await fileExists(pyproject)) return { scriptTargets: [] };
+  const content = await readFileContent(pyproject);
+  if (!content.ok) return { scriptTargets: [] };
+  return parsePyProject(content.value);
+}
+async function resolveScriptTargetEntry(rootDir, target) {
+  const mod = target.split(":")[0];
+  if (!mod) return void 0;
+  const relPath2 = mod.replaceAll(".", "/") + ".py";
+  for (const candidate of [(0, import_path6.join)(rootDir, relPath2), (0, import_path6.join)(rootDir, "src", relPath2)]) {
+    if (await fileExists(candidate)) return candidate;
+  }
+  return void 0;
+}
+async function resolvePythonFromScripts(rootDir, targets) {
+  const entries = [];
+  for (const target of targets) {
+    const entry = await resolveScriptTargetEntry(rootDir, target);
+    if (entry) entries.push(entry);
+  }
+  return entries;
+}
+async function resolvePythonFromProjectName(rootDir, projectName) {
+  if (!projectName) return [];
+  const normalized = projectName.replaceAll("-", "_");
+  const candidates = [
+    (0, import_path6.join)(rootDir, normalized, "__init__.py"),
+    (0, import_path6.join)(rootDir, normalized, "__main__.py"),
+    (0, import_path6.join)(rootDir, "src", normalized, "__init__.py"),
+    (0, import_path6.join)(rootDir, "src", normalized, "__main__.py")
+  ];
+  const entries = [];
+  for (const c of candidates) {
+    if (await fileExists(c)) entries.push(c);
+  }
+  return entries;
+}
+async function resolvePythonConventions(rootDir) {
+  const entries = [];
+  for (const conv of PYTHON_CONVENTIONS) {
+    const p = (0, import_path6.join)(rootDir, conv);
+    if (await fileExists(p)) entries.push(p);
+  }
+  return entries;
+}
+async function findPythonTopLevelPackages(rootDir) {
+  const found = await findFiles("*/__init__.py", rootDir);
+  if (found.length > 0) return found;
+  return findFiles("src/*/__init__.py", rootDir);
+}
+async function resolvePython(rootDir) {
+  if (!await detectPython(rootDir)) {
+    return { language: "python", detected: false, entries: [], hints: PYTHON_HINTS };
+  }
+  const info = await readPyProject(rootDir);
+  const strategies = [
+    () => resolvePythonFromScripts(rootDir, info.scriptTargets),
+    () => resolvePythonFromProjectName(rootDir, info.projectName),
+    () => resolvePythonConventions(rootDir),
+    () => findPythonTopLevelPackages(rootDir)
+  ];
+  for (const strategy of strategies) {
+    const entries = await strategy();
+    if (entries.length > 0) {
+      return { language: "python", detected: true, entries, hints: PYTHON_HINTS };
     }
   }
-  const conventions = ["src/index.ts", "src/main.ts", "index.ts", "main.ts"];
-  for (const conv of conventions) {
-    const convPath = (0, import_path6.join)(rootDir, conv);
-    if (await fileExists(convPath)) {
-      return (0, import_types.Ok)([convPath]);
+  return { language: "python", detected: true, entries: [], hints: PYTHON_HINTS };
+}
+async function resolveGo(rootDir) {
+  const hints = ["Create main.go at the project root, or use the cmd/<name>/main.go layout"];
+  const detected = await fileExists((0, import_path6.join)(rootDir, "go.mod"));
+  if (!detected) return { language: "go", detected: false, entries: [], hints };
+  const entries = [];
+  const mainGo = (0, import_path6.join)(rootDir, "main.go");
+  if (await fileExists(mainGo)) entries.push(mainGo);
+  entries.push(...await findFiles("cmd/*/main.go", rootDir));
+  return { language: "go", detected: true, entries, hints };
+}
+async function resolveRust(rootDir) {
+  const hints = [
+    "Create src/main.rs or src/lib.rs",
+    "Declare [[bin]] entries with a `path` in Cargo.toml"
+  ];
+  const cargoPath = (0, import_path6.join)(rootDir, "Cargo.toml");
+  const detected = await fileExists(cargoPath);
+  if (!detected) return { language: "rust", detected: false, entries: [], hints };
+  const entries = [];
+  const content = await readFileContent(cargoPath);
+  if (content.ok) {
+    for (const bp of parseCargoBinPaths(content.value)) {
+      const abs = (0, import_path6.resolve)(rootDir, bp);
+      if (await fileExists(abs)) entries.push(abs);
     }
   }
+  if (entries.length === 0) {
+    for (const conv of ["src/main.rs", "src/lib.rs"]) {
+      const p = (0, import_path6.join)(rootDir, conv);
+      if (await fileExists(p)) entries.push(p);
+    }
+    entries.push(...await findFiles("src/bin/*.rs", rootDir));
+  }
+  return { language: "rust", detected: true, entries, hints };
+}
+async function resolveJava(rootDir) {
+  const hints = [
+    "Place an entry class at src/main/java/**/Main.java (or *Application.java for Spring Boot)"
+  ];
+  const detected = await fileExists((0, import_path6.join)(rootDir, "pom.xml")) || await fileExists((0, import_path6.join)(rootDir, "build.gradle")) || await fileExists((0, import_path6.join)(rootDir, "build.gradle.kts"));
+  if (!detected) return { language: "java", detected: false, entries: [], hints };
+  const entries = [];
+  entries.push(...await findFiles("src/main/java/**/Main.java", rootDir));
+  entries.push(...await findFiles("src/main/java/**/*Application.java", rootDir));
+  return { language: "java", detected: true, entries, hints };
+}
+function parseTomlLine(raw) {
+  const line = raw.replace(/(^|\s)#.*$/, "").trim();
+  if (!line) return {};
+  const sectionMatch = /^\[([^\]]+)\]$/.exec(line);
+  if (sectionMatch) return { section: sectionMatch[1] ?? "" };
+  const eq = line.indexOf("=");
+  if (eq <= 0) return {};
+  return {
+    key: line.slice(0, eq).trim(),
+    value: stripTomlString2(line.slice(eq + 1).trim())
+  };
+}
+function parsePyProject(content) {
+  const result = { scriptTargets: [] };
+  let section = null;
+  for (const raw of content.split(/\r?\n/)) {
+    const parsed = parseTomlLine(raw);
+    if (parsed.section !== void 0) {
+      section = parsed.section;
+      continue;
+    }
+    if (parsed.key === void 0 || parsed.value === void 0) continue;
+    if (section === "project" && parsed.key === "name") result.projectName = parsed.value;
+    else if (section === "project.scripts") result.scriptTargets.push(parsed.value);
+  }
+  return result;
+}
+function parseCargoBinPaths(content) {
+  const paths = [];
+  let inBin = false;
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    if (!line) continue;
+    if (line === "[[bin]]") {
+      inBin = true;
+      continue;
+    }
+    if (line.startsWith("[")) {
+      inBin = false;
+      continue;
+    }
+    if (!inBin) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    if (key === "path") paths.push(stripTomlString2(line.slice(eq + 1).trim()));
+  }
+  return paths;
+}
+function stripTomlString2(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+async function resolveEntryPoints(rootDir, explicitEntries) {
+  if (explicitEntries && explicitEntries.length > 0) {
+    return (0, import_types.Ok)(explicitEntries.map((e) => (0, import_path6.resolve)(rootDir, e)));
+  }
+  const resolvers = [resolveTypeScript, resolvePython, resolveGo, resolveRust, resolveJava];
+  const resolutions = [];
+  for (const resolver of resolvers) {
+    const res = await resolver(rootDir);
+    resolutions.push(res);
+    if (res.entries.length > 0) return (0, import_types.Ok)(res.entries);
+  }
+  const detectedLangs = resolutions.filter((r) => r.detected);
+  const suggestions = detectedLangs.length > 0 ? detectedLangs.flatMap((r) => r.hints) : resolutions.flatMap((r) => r.hints);
+  suggestions.push("Specify entryPoints in config");
+  const reason = detectedLangs.length > 0 ? `Detected ${detectedLangs.map((r) => r.language).join(", ")} project but found no entry points` : "No language manifest (package.json, pyproject.toml, go.mod, Cargo.toml, pom.xml) and no conventional entry files found";
   return (0, import_types.Err)(
     createEntropyError(
       "ENTRY_POINT_NOT_FOUND",
       "Could not resolve entry points",
-      { reason: "No package.json exports/main and no conventional entry files found" },
-      [
-        'Add "exports" or "main" to package.json',
-        "Create src/index.ts",
-        "Specify entryPoints in config"
-      ]
+      { reason },
+      suggestions
     )
   );
 }
+
+// src/entropy/snapshot.ts
+var DEFAULT_INCLUDE_PATTERNS = [
+  "**/*.ts",
+  "**/*.tsx",
+  "**/*.js",
+  "**/*.jsx",
+  "**/*.mjs",
+  "**/*.cjs",
+  "**/*.py",
+  "**/*.go",
+  "**/*.rs",
+  "**/*.java"
+];
 function extractCodeBlocks(content) {
   const blocks = [];
   const lines = content.split("\n");
@@ -4715,6 +5110,7 @@ function extractSymbolsFromNode(node) {
   return [];
 }
 function extractInternalSymbols(ast) {
+  if (ast.language !== "typescript" && ast.language !== "javascript") return [];
   const body = ast.body;
   if (!body?.body) return [];
   const nodes = body.body;
@@ -4725,6 +5121,7 @@ function toJSDocComment(comment) {
   return { content: comment.value, line: comment.loc?.start?.line || 0 };
 }
 function extractJSDocComments(ast) {
+  if (ast.language !== "typescript" && ast.language !== "javascript") return [];
   const body = ast.body;
   if (!body?.comments) return [];
   return body.comments.flatMap((c) => {
@@ -4783,19 +5180,16 @@ function extractAllCodeReferences(docs) {
 }
 async function buildSnapshot(config) {
   const startTime = Date.now();
-  const parser = config.parser || new TypeScriptParser();
-  const rootDir = (0, import_path6.resolve)(config.rootDir);
+  const rootDir = (0, import_path7.resolve)(config.rootDir);
   const entryPointsResult = await resolveEntryPoints(rootDir, config.entryPoints);
   if (!entryPointsResult.ok) {
     return (0, import_types.Err)(entryPointsResult.error);
   }
-  const includePatterns = config.include || ["**/*.ts", "**/*.tsx"];
-  const excludePatterns = config.exclude || [
-    "node_modules/**",
-    "dist/**",
-    "**/*.test.ts",
-    "**/*.spec.ts"
-  ];
+  const registry = getDefaultRegistry();
+  const singleParser = config.parser;
+  const parserForFile = (filePath) => singleParser ?? registry.getForFile(filePath);
+  const includePatterns = config.include || DEFAULT_INCLUDE_PATTERNS;
+  const excludePatterns = config.exclude || [...(0, import_graph.skipDirGlobs)(), "**/*.test.ts", "**/*.spec.ts"];
   let sourceFilePaths = [];
   for (const pattern of includePatterns) {
     const files2 = await findFiles(pattern, rootDir);
@@ -4803,14 +5197,16 @@ async function buildSnapshot(config) {
   }
   sourceFilePaths = sourceFilePaths.filter((f) => {
     const rel = relativePosix(rootDir, f);
-    return !excludePatterns.some((p) => (0, import_minimatch3.minimatch)(rel, p));
+    return !excludePatterns.some((p) => (0, import_minimatch4.minimatch)(rel, p));
   });
   const files = [];
   for (const filePath of sourceFilePaths) {
-    const parseResult = await parser.parseFile(filePath);
+    const fileParser = parserForFile(filePath);
+    if (!fileParser) continue;
+    const parseResult = await fileParser.parseFile(filePath);
     if (!parseResult.ok) continue;
-    const importsResult = parser.extractImports(parseResult.value);
-    const exportsResult = parser.extractExports(parseResult.value);
+    const importsResult = fileParser.extractImports(parseResult.value);
+    const exportsResult = fileParser.extractExports(parseResult.value);
     const internalSymbols = extractInternalSymbols(parseResult.value);
     const jsDocComments = extractJSDocComments(parseResult.value);
     files.push({
@@ -4822,7 +5218,7 @@ async function buildSnapshot(config) {
       jsDocComments
     });
   }
-  const graphResult = await buildDependencyGraph(sourceFilePaths, parser);
+  const graphResult = await buildDependencyGraph(sourceFilePaths, singleParser ?? registry);
   const dependencyGraph = graphResult.ok ? graphResult.value : { nodes: [], edges: [] };
   const docPatterns = config.docPaths || ["docs/**/*.md", "README.md", "**/README.md"];
   let docFilePaths = [];
@@ -4855,7 +5251,7 @@ async function buildSnapshot(config) {
 }
 
 // src/entropy/detectors/drift.ts
-var import_path7 = require("path");
+var import_path8 = require("path");
 function initLevenshteinMatrix(aLen, bLen) {
   const matrix = [];
   for (let i = 0; i <= bLen; i++) {
@@ -4967,7 +5363,7 @@ async function checkStructureDrift(snapshot, _config) {
   for (const doc of snapshot.docs) {
     const fileLinks = extractFileLinks(doc.content);
     for (const { link, line } of fileLinks) {
-      const resolvedPath = (0, import_path7.resolve)((0, import_path7.dirname)(doc.path), link);
+      const resolvedPath = (0, import_path8.resolve)((0, import_path8.dirname)(doc.path), link);
       const exists = await fileExists(resolvedPath);
       if (!exists) {
         drifts.push({
@@ -5058,7 +5454,7 @@ async function detectDocDrift(snapshot, config, graphDriftData) {
 }
 
 // src/entropy/detectors/dead-code.ts
-var import_path8 = require("path");
+var import_path9 = require("path");
 var JS_EXT_FALLBACKS2 = {
   ".js": [".ts", ".tsx", ".jsx"],
   ".jsx": [".tsx"],
@@ -5077,9 +5473,9 @@ function resolveImportToFile(importSource, fromFile, snapshot, fileIndex) {
     return null;
   }
   const hasFile = fileIndex ? (p) => fileIndex.has(p) : (p) => snapshot.files.some((f) => f.path === p);
-  const fromDir = (0, import_path8.dirname)(fromFile);
-  const resolved = (0, import_path8.resolve)(fromDir, importSource);
-  const sourceExt = (0, import_path8.extname)(resolved);
+  const fromDir = (0, import_path9.dirname)(fromFile);
+  const resolved = (0, import_path9.resolve)(fromDir, importSource);
+  const sourceExt = (0, import_path9.extname)(resolved);
   const fallbacks = JS_EXT_FALLBACKS2[sourceExt];
   if (fallbacks) {
     const base = resolved.slice(0, -sourceExt.length);
@@ -5088,7 +5484,7 @@ function resolveImportToFile(importSource, fromFile, snapshot, fileIndex) {
       if (hasFile(candidate)) return candidate;
     }
     for (const indexExt of [".ts", ".tsx", ".jsx"]) {
-      const indexPath2 = (0, import_path8.resolve)(base, "index" + indexExt);
+      const indexPath2 = (0, import_path9.resolve)(base, "index" + indexExt);
       if (hasFile(indexPath2)) return indexPath2;
     }
   }
@@ -5099,7 +5495,7 @@ function resolveImportToFile(importSource, fromFile, snapshot, fileIndex) {
       if (hasFile(candidate)) return candidate;
     }
     for (const indexExt of [".ts", ".tsx"]) {
-      const indexPath2 = (0, import_path8.resolve)(resolved, "index" + indexExt);
+      const indexPath2 = (0, import_path9.resolve)(resolved, "index" + indexExt);
       if (hasFile(indexPath2)) return indexPath2;
     }
   }
@@ -5413,10 +5809,10 @@ async function detectDeadCode(snapshot, graphDeadCodeData, protectedRegions) {
 }
 
 // src/entropy/detectors/patterns.ts
-var import_minimatch4 = require("minimatch");
+var import_minimatch5 = require("minimatch");
 function fileMatchesPattern(filePath, pattern, rootDir) {
   const relativePath = relativePosix(rootDir, filePath);
-  return (0, import_minimatch4.minimatch)(relativePath, pattern);
+  return (0, import_minimatch5.minimatch)(relativePath, pattern);
 }
 var CONVENTION_DESCRIPTIONS = {
   camelCase: "camelCase (e.g., myFunction)",
@@ -6085,6 +6481,7 @@ async function detectCouplingViolations(snapshot, config, graphData) {
 // src/entropy/detectors/size-budget.ts
 var import_node_fs12 = require("fs");
 var import_node_path12 = require("path");
+var import_graph2 = require("@harness-engineering/graph");
 function parseSize(size) {
   const match = size.trim().match(/^(\d+(?:\.\d+)?)\s*(KB|MB|GB|B)?$/i);
   if (!match) return 0;
@@ -6110,7 +6507,7 @@ function dirSize(dirPath) {
     return 0;
   }
   for (const entry of entries) {
-    if (entry === "node_modules" || entry === ".git") continue;
+    if (import_graph2.DEFAULT_SKIP_DIRS.has(entry)) continue;
     const fullPath = (0, import_node_path12.join)(dirPath, entry);
     try {
       const stat2 = (0, import_node_fs12.statSync)(fullPath);
@@ -6287,10 +6684,7 @@ var EntropyAnalyzer = class {
   snapshot;
   report;
   constructor(config) {
-    this.config = {
-      ...config,
-      parser: config.parser || new TypeScriptParser()
-    };
+    this.config = { ...config };
   }
   /**
    * Run full entropy analysis.
@@ -6520,7 +6914,7 @@ var EntropyAnalyzer = class {
 // src/entropy/fixers/safe-fixes.ts
 var fs6 = __toESM(require("fs"));
 var import_util2 = require("util");
-var import_path9 = require("path");
+var import_path10 = require("path");
 var readFile8 = (0, import_util2.promisify)(fs6.readFile);
 var writeFile3 = (0, import_util2.promisify)(fs6.writeFile);
 var unlink2 = (0, import_util2.promisify)(fs6.unlink);
@@ -6536,7 +6930,7 @@ function createDeadFileFixes(deadCodeReport) {
   return deadCodeReport.deadFiles.map((file) => ({
     type: "dead-files",
     file: file.path,
-    description: `Delete dead file (${file.reason}): ${(0, import_path9.basename)(file.path)}`,
+    description: `Delete dead file (${file.reason}): ${(0, import_path10.basename)(file.path)}`,
     action: "delete-file",
     safe: true,
     reversible: true
@@ -6637,9 +7031,9 @@ function previewFix(fix) {
   }
 }
 async function createBackup(filePath, backupDir) {
-  const backupPath = (0, import_path9.join)(backupDir, `${Date.now()}-${(0, import_path9.basename)(filePath)}`);
+  const backupPath = (0, import_path10.join)(backupDir, `${Date.now()}-${(0, import_path10.basename)(filePath)}`);
   try {
-    await mkdir2((0, import_path9.dirname)(backupPath), { recursive: true });
+    await mkdir2((0, import_path10.dirname)(backupPath), { recursive: true });
     await copyFile2(filePath, backupPath);
     return (0, import_types.Ok)(backupPath);
   } catch (e) {
@@ -7299,7 +7693,7 @@ var RegressionDetector = class {
 // src/performance/critical-path.ts
 var fs7 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
+var import_graph3 = require("@harness-engineering/graph");
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
 var FUNCTION_DECL_RE = /(?:export\s+)?(?:async\s+)?function\s+(\w+)/;
 var CONST_DECL_RE = /(?:export\s+)?(?:const|let)\s+(\w+)\s*=/;
@@ -7366,7 +7760,7 @@ var CriticalPathResolver = class {
     }
     for (const item of items) {
       if (item.isDirectory()) {
-        if (SKIP_DIRS.has(item.name)) continue;
+        if (import_graph3.DEFAULT_SKIP_DIRS.has(item.name)) continue;
         this.walkDir(path4.join(dir, item.name), entries);
       } else if (item.isFile() && SOURCE_EXTENSIONS.has(path4.extname(item.name))) {
         this.scanFile(path4.join(dir, item.name), entries);
@@ -8127,7 +8521,7 @@ async function requestMultiplePeerReviews(requests) {
 
 // src/feedback/logging/file-sink.ts
 var import_fs2 = require("fs");
-var import_path10 = require("path");
+var import_path11 = require("path");
 var FileSink = class {
   name = "file";
   filePath;
@@ -8150,7 +8544,7 @@ var FileSink = class {
   }
   ensureDirectory() {
     if (!this.initialized) {
-      const dir = (0, import_path10.dirname)(this.filePath);
+      const dir = (0, import_path11.dirname)(this.filePath);
       if (!(0, import_fs2.existsSync)(dir)) {
         (0, import_fs2.mkdirSync)(dir, { recursive: true });
       }
@@ -8688,8 +9082,9 @@ var ForbiddenImportCollector = class {
 // src/architecture/collectors/module-size.ts
 var import_promises2 = require("fs/promises");
 var import_node_path14 = require("path");
+var import_graph4 = require("@harness-engineering/graph");
 function isSkippedEntry(name) {
-  return name.startsWith(".") || name === "node_modules" || name === "dist";
+  return name.startsWith(".") || import_graph4.DEFAULT_SKIP_DIRS.has(name);
 }
 function isTsSourceFile(name) {
   if (!name.endsWith(".ts") && !name.endsWith(".tsx")) return false;
@@ -8829,6 +9224,7 @@ var ModuleSizeCollector = class {
 // src/architecture/collectors/dep-depth.ts
 var import_promises3 = require("fs/promises");
 var import_node_path15 = require("path");
+var import_graph5 = require("@harness-engineering/graph");
 function extractImportSources(content, filePath) {
   const importRegex = /(?:import|export)\s+.*?from\s+['"](\.[^'"]+)['"]/g;
   const dynamicRegex = /import\s*\(\s*['"](\.[^'"]+)['"]\s*\)/g;
@@ -8847,7 +9243,7 @@ function extractImportSources(content, filePath) {
   return sources;
 }
 function isSkippedEntry2(name) {
-  return name.startsWith(".") || name === "node_modules" || name === "dist";
+  return name.startsWith(".") || import_graph5.DEFAULT_SKIP_DIRS.has(name);
 }
 function isTsSourceFile2(name) {
   if (!name.endsWith(".ts") && !name.endsWith(".tsx")) return false;
@@ -11530,7 +11926,7 @@ function checkOverlap(newEntry, existingEntries, options) {
 var LOCK_RETRIES = 3;
 var LOCK_BACKOFFS = [50, 100, 200];
 function sleep(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 async function acquireFileLock(lockPath) {
   for (let attempt = 0; attempt < LOCK_RETRIES; attempt++) {
@@ -12743,7 +13139,7 @@ async function runMultiTurnPipeline(initialContext, turnExecutor, options) {
 
 // src/security/scanner.ts
 var fs28 = __toESM(require("fs/promises"));
-var import_minimatch5 = require("minimatch");
+var import_minimatch6 = require("minimatch");
 
 // src/security/rules/registry.ts
 var RuleRegistry = class {
@@ -12775,13 +13171,15 @@ var RuleRegistry = class {
 
 // src/security/config.ts
 var import_zod11 = require("zod");
+var import_graph7 = require("@harness-engineering/graph");
 
 // src/security/types.ts
+var import_graph6 = require("@harness-engineering/graph");
 var DEFAULT_SECURITY_CONFIG = {
   enabled: true,
   strict: false,
   rules: {},
-  exclude: ["**/node_modules/**", "**/dist/**", "**/*.test.ts", "**/fixtures/**"]
+  exclude: [...(0, import_graph6.skipDirGlobs)(), "**/*.test.ts", "**/fixtures/**"]
 };
 
 // src/security/config.ts
@@ -12790,7 +13188,7 @@ var SecurityConfigSchema = import_zod11.z.object({
   enabled: import_zod11.z.boolean().default(true),
   strict: import_zod11.z.boolean().default(false),
   rules: import_zod11.z.record(import_zod11.z.string(), RuleOverrideSchema).optional().default({}),
-  exclude: import_zod11.z.array(import_zod11.z.string()).optional().default(["**/node_modules/**", "**/dist/**", "**/*.test.ts", "**/fixtures/**"]),
+  exclude: import_zod11.z.array(import_zod11.z.string()).optional().default([...(0, import_graph7.skipDirGlobs)(), "**/*.test.ts", "**/fixtures/**"]),
   external: import_zod11.z.object({
     semgrep: import_zod11.z.object({
       enabled: import_zod11.z.union([import_zod11.z.literal("auto"), import_zod11.z.boolean()]).default("auto"),
@@ -13701,7 +14099,7 @@ var SecurityScanner = class {
     const applicableRules = this.activeRules.filter((rule) => {
       if (!rule.fileGlob) return true;
       const globs = rule.fileGlob.split(",").map((g) => g.trim());
-      return globs.some((glob6) => (0, import_minimatch5.minimatch)(filePath, glob6, { dot: true }));
+      return globs.some((glob6) => (0, import_minimatch6.minimatch)(filePath, glob6, { dot: true }));
     });
     return this.scanLinesWithRules(lines, applicableRules, filePath, startLine);
   }
@@ -14709,7 +15107,8 @@ var SecurityTimelineManager = class _SecurityTimelineManager {
 
 // src/ci/check-orchestrator.ts
 var path25 = __toESM(require("path"));
-var import_graph = require("@harness-engineering/graph");
+var import_graph8 = require("@harness-engineering/graph");
+var import_graph9 = require("@harness-engineering/graph");
 var ALL_CHECKS = [
   "validate",
   "deps",
@@ -14786,8 +15185,7 @@ async function runDocsCheck(projectRoot, config) {
     docsDir,
     sourceDir: projectRoot,
     excludePatterns: entropyConfig.excludePatterns || [
-      "**/node_modules/**",
-      "**/dist/**",
+      ...(0, import_graph8.skipDirGlobs)(),
       "**/*.test.ts",
       "**/fixtures/**"
     ]
@@ -14852,12 +15250,7 @@ async function runSecurityCheck(projectRoot, config) {
   const { glob: globFn } = await import("glob");
   const sourceFiles = await globFn("**/*.{ts,tsx,js,jsx,go,py}", {
     cwd: projectRoot,
-    ignore: securityConfig.exclude ?? [
-      "**/node_modules/**",
-      "**/dist/**",
-      "**/*.test.ts",
-      "**/fixtures/**"
-    ],
+    ignore: securityConfig.exclude ?? [...(0, import_graph8.skipDirGlobs)(), "**/*.test.ts", "**/fixtures/**"],
     absolute: true
   });
   const scanResult = await scanner.scanFiles(sourceFiles);
@@ -14966,12 +15359,12 @@ async function runTraceabilityCheck(projectRoot, config) {
   const traceConfig = config.traceability || {};
   if (traceConfig.enabled === false) return issues;
   const graphDir = path25.join(projectRoot, ".harness", "graph");
-  const store = new import_graph.GraphStore();
+  const store = new import_graph9.GraphStore();
   const loaded = await store.load(graphDir);
   if (!loaded) {
     return issues;
   }
-  const results = (0, import_graph.queryTraceability)(store);
+  const results = (0, import_graph9.queryTraceability)(store);
   if (results.length === 0) return issues;
   const minCoverage = traceConfig.minCoverage ?? 0;
   const severity = traceConfig.severity ?? "warning";
@@ -17731,7 +18124,7 @@ function parseRepoParts(repo) {
   return { owner: parts[0], repo: parts[1] };
 }
 function sleep2(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 async function fetchWithRetry(fetchFn, input, init, opts = RETRY_DEFAULTS) {
   let lastResponse;
@@ -18265,8 +18658,8 @@ var syncMutex = Promise.resolve();
 async function fullSync(roadmapPath, adapter2, config, options) {
   const previousSync = syncMutex;
   let releaseMutex;
-  syncMutex = new Promise((resolve11) => {
-    releaseMutex = resolve11;
+  syncMutex = new Promise((resolve12) => {
+    releaseMutex = resolve12;
   });
   await previousSync;
   try {
@@ -20789,9 +21182,9 @@ function paginate(items, offset, limit) {
 }
 
 // src/caching/stability.ts
-var import_graph2 = require("@harness-engineering/graph");
+var import_graph10 = require("@harness-engineering/graph");
 var STABILITY_LOOKUP = {};
-for (const [key, tier] of Object.entries(import_graph2.NODE_STABILITY)) {
+for (const [key, tier] of Object.entries(import_graph10.NODE_STABILITY)) {
   STABILITY_LOOKUP[key] = tier;
   STABILITY_LOOKUP[key.toLowerCase()] = tier;
 }
@@ -21034,7 +21427,7 @@ var POSTHOG_BATCH_URL = "https://app.posthog.com/batch";
 var MAX_ATTEMPTS = 3;
 var TIMEOUT_MS = 5e3;
 function sleep3(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 async function send(events, apiKey) {
   if (events.length === 0) return;
@@ -21946,6 +22339,7 @@ function assembleCandidateReport(input) {
   ViolationHistorySchema,
   ViolationSchema,
   ViolationSnapshotSchema,
+  WHATWG_BAD_PORTS,
   acquireCompoundLock,
   addProvenance,
   agentConfigRules,
@@ -21971,6 +22365,7 @@ function assembleCandidateReport(input) {
   archiveStream,
   assembleCandidateReport,
   assembleReport,
+  assertPortUsable,
   assertSanitized,
   assignFeature,
   buildDependencyGraph,
@@ -22085,6 +22480,7 @@ function assembleCandidateReport(input) {
   goRules,
   injectionRules,
   insecureDefaultsRules,
+  isBadPort,
   isDuplicateFinding,
   isRegression,
   isSanitizedResult,
@@ -22218,6 +22614,7 @@ function assembleCandidateReport(input) {
   validateAgentConfigs,
   validateAgentsMap,
   validateBoundaries,
+  validateBranchName,
   validateCommitMessage,
   validateConfig,
   validateDependencies,