@kaddo/cli 3.47.0 → 3.49.0

package/dist/index.js

@@ -239,6 +239,552 @@ async function runInit() {
   outro2("Kaddo initialized.");
 }
 
+// src/core/scan-signals.ts
+function emptySignals() {
+  return {
+    auth: [],
+    payments: [],
+    webhooks: [],
+    storage: [],
+    background_jobs: [],
+    email: [],
+    database: [],
+    migrations: [],
+    api_routes: [],
+    tests: [],
+    security: [],
+    infrastructure: [],
+    external_integrations: [],
+    environment: []
+  };
+}
+function sig(type, label, confidence, evidence, extra) {
+  return { type, label, confidence, evidence, ...extra };
+}
+function readDeps(dir) {
+  const pkgPath = join(dir, "package.json");
+  if (!exists(pkgPath)) return {};
+  try {
+    const pkg = JSON.parse(readFile(pkgPath));
+    return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  } catch {
+    return {};
+  }
+}
+function findFilesMatching(dir, codeDirs, pattern, maxDepth = 3) {
+  const found = [];
+  const walk = (base, rel, depth) => {
+    if (depth > maxDepth) return;
+    try {
+      const entries = readDir(join(base, rel));
+      for (const e of entries) {
+        if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build" || e === ".next") continue;
+        const fullRel = rel ? `${rel}/${e}` : e;
+        if (isDir(join(base, fullRel))) {
+          walk(base, fullRel, depth + 1);
+        } else if (pattern.test(e)) {
+          found.push(fullRel);
+        }
+      }
+    } catch {
+    }
+  };
+  for (const cd of codeDirs) {
+    walk(dir, cd, 0);
+  }
+  return found;
+}
+function findPathsContaining(dir, codeDirs, keywords, maxDepth = 3) {
+  const found = [];
+  const walk = (base, rel, depth) => {
+    if (depth > maxDepth) return;
+    try {
+      const entries = readDir(join(base, rel));
+      for (const e of entries) {
+        if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build" || e === ".next") continue;
+        const fullRel = rel ? `${rel}/${e}` : e;
+        const lower = e.toLowerCase();
+        if (keywords.some((k) => lower.includes(k))) {
+          found.push(fullRel);
+        }
+        if (isDir(join(base, fullRel))) {
+          walk(base, fullRel, depth + 1);
+        }
+      }
+    } catch {
+    }
+  };
+  for (const cd of codeDirs) {
+    walk(dir, cd, 0);
+  }
+  return found;
+}
+function detectAuth(dir, deps, codeDirs, signals) {
+  const authDeps = [
+    ["next-auth", "NextAuth"],
+    ["@auth/core", "Auth.js"],
+    ["@supabase/supabase-js", "Supabase Auth"],
+    ["@supabase/auth-helpers-nextjs", "Supabase Auth"],
+    ["@supabase/ssr", "Supabase Auth"],
+    ["@clerk/nextjs", "Clerk"],
+    ["@clerk/clerk-sdk-node", "Clerk"],
+    ["firebase", "Firebase Auth"],
+    ["firebase-admin", "Firebase Auth"],
+    ["passport", "Passport.js"],
+    ["jsonwebtoken", "JWT"],
+    ["jose", "JWT (jose)"],
+    ["bcrypt", "Password hashing (bcrypt)"],
+    ["bcryptjs", "Password hashing (bcryptjs)"],
+    ["@aws-amplify/auth", "AWS Amplify Auth"]
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [dep, label] of authDeps) {
+    if (dep in deps && !seen.has(label)) {
+      seen.add(label);
+      signals.auth.push(sig("auth", label, "high", ["package.json"]));
+    }
+  }
+  const authPaths = findPathsContaining(dir, codeDirs, ["auth", "login", "register", "signin", "signup", "session"], 3);
+  if (authPaths.length > 0 && signals.auth.length === 0) {
+    signals.auth.push(sig("auth", "Auth-related paths detected", "medium", authPaths.slice(0, 5)));
+  }
+}
+function detectPayments(dir, deps, codeDirs, signals) {
+  const payDeps = [
+    ["stripe", "Stripe"],
+    ["@stripe/stripe-js", "Stripe"],
+    ["mercadopago", "Mercado Pago"],
+    ["@paypal/checkout-server-sdk", "PayPal"],
+    ["paypal-rest-sdk", "PayPal"],
+    ["wompi", "Wompi"],
+    ["@adyen/api-library", "Adyen"],
+    ["braintree", "Braintree"],
+    ["square", "Square"]
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [dep, label] of payDeps) {
+    if (dep in deps && !seen.has(label)) {
+      seen.add(label);
+      signals.payments.push(sig("payments", label, "high", ["package.json"]));
+    }
+  }
+  const payPaths = findPathsContaining(dir, codeDirs, ["payment", "checkout", "billing", "invoice", "subscription", "pricing"], 3);
+  if (payPaths.length > 0 && signals.payments.length === 0) {
+    signals.payments.push(sig("payments", "Payment-related paths detected", "medium", payPaths.slice(0, 5)));
+  }
+}
+function detectWebhooks(dir, codeDirs, signals) {
+  const whPaths = findPathsContaining(dir, codeDirs, ["webhook", "callback"], 3);
+  if (whPaths.length > 0) {
+    signals.webhooks.push(sig("webhooks", "Webhook routes detected", "high", whPaths.slice(0, 5), {
+      recommended_review: "Verify idempotency and signature validation."
+    }));
+  }
+}
+function detectStorage(dir, deps, codeDirs, signals) {
+  const storageDeps = [
+    ["@aws-sdk/client-s3", "AWS S3"],
+    ["aws-sdk", "AWS SDK (includes S3)"],
+    ["@supabase/storage-js", "Supabase Storage"],
+    ["cloudinary", "Cloudinary"],
+    ["multer", "File upload (Multer)"],
+    ["formidable", "File upload (Formidable)"],
+    ["@google-cloud/storage", "Google Cloud Storage"],
+    ["@azure/storage-blob", "Azure Blob Storage"]
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [dep, label] of storageDeps) {
+    if (dep in deps && !seen.has(label)) {
+      seen.add(label);
+      signals.storage.push(sig("storage", label, "high", ["package.json"]));
+    }
+  }
+  const storagePaths = findPathsContaining(dir, codeDirs, ["upload", "storage", "bucket"], 3);
+  if (storagePaths.length > 0 && signals.storage.length === 0) {
+    signals.storage.push(sig("storage", "Storage-related paths detected", "medium", storagePaths.slice(0, 5)));
+  }
+}
+function detectBackgroundJobs(dir, deps, codeDirs, signals) {
+  const jobDeps = [
+    ["bullmq", "BullMQ"],
+    ["bull", "Bull"],
+    ["agenda", "Agenda"],
+    ["@aws-sdk/client-sqs", "AWS SQS"],
+    ["amqplib", "RabbitMQ (AMQP)"],
+    ["bee-queue", "Bee-Queue"],
+    ["node-cron", "Node-cron"],
+    ["cron", "Cron"]
+  ];
+  for (const [dep, label] of jobDeps) {
+    if (dep in deps) {
+      signals.background_jobs.push(sig("background_jobs", label, "high", ["package.json"]));
+    }
+  }
+  if (isDir(join(dir, "supabase", "functions"))) {
+    signals.background_jobs.push(sig("background_jobs", "Supabase Edge Functions", "high", ["supabase/functions/"]));
+  }
+  const cronMigrations = findFilesMatching(dir, ["supabase/migrations"], /pg_cron|cron/i, 2);
+  if (cronMigrations.length > 0) {
+    signals.background_jobs.push(sig("background_jobs", "pg_cron scheduled jobs", "high", cronMigrations.slice(0, 3)));
+  }
+  if (exists(join(dir, "vercel.json"))) {
+    try {
+      const vc = JSON.parse(readFile(join(dir, "vercel.json")));
+      if (vc.crons && Array.isArray(vc.crons) && vc.crons.length > 0) {
+        signals.background_jobs.push(sig("background_jobs", "Vercel Cron Jobs", "high", ["vercel.json"]));
+      }
+    } catch {
+    }
+  }
+  const jobPaths = findPathsContaining(dir, codeDirs, ["cron", "queue", "worker", "job"], 3);
+  if (jobPaths.length > 0 && signals.background_jobs.length === 0) {
+    signals.background_jobs.push(sig("background_jobs", "Job-related paths detected", "medium", jobPaths.slice(0, 5)));
+  }
+}
+function detectEmail(dir, deps, signals) {
+  const emailDeps = [
+    ["resend", "Resend"],
+    ["@sendgrid/mail", "SendGrid"],
+    ["@sendinblue/client", "Brevo (Sendinblue)"],
+    ["@getbrevo/brevo", "Brevo"],
+    ["nodemailer", "Nodemailer"],
+    ["@aws-sdk/client-ses", "AWS SES"],
+    ["postmark", "Postmark"],
+    ["mailgun-js", "Mailgun"],
+    ["@mailchimp/mailchimp_transactional", "Mailchimp Transactional"]
+  ];
+  for (const [dep, label] of emailDeps) {
+    if (dep in deps) {
+      signals.email.push(sig("email", label, "high", ["package.json"]));
+    }
+  }
+}
+function detectDatabase(dir, deps, signals) {
+  const dbDeps = [
+    ["prisma", "Prisma"],
+    ["@prisma/client", "Prisma"],
+    ["drizzle-orm", "Drizzle ORM"],
+    ["typeorm", "TypeORM"],
+    ["sequelize", "Sequelize"],
+    ["knex", "Knex.js"],
+    ["@supabase/supabase-js", "Supabase (Postgres)"],
+    ["pg", "PostgreSQL (pg)"],
+    ["mysql2", "MySQL"],
+    ["mongodb", "MongoDB"],
+    ["mongoose", "Mongoose (MongoDB)"],
+    ["better-sqlite3", "SQLite"],
+    ["@neondatabase/serverless", "Neon Postgres"],
+    ["@planetscale/database", "PlanetScale"],
+    ["@libsql/client", "Turso (LibSQL)"]
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [dep, label] of dbDeps) {
+    if (dep in deps && !seen.has(label)) {
+      seen.add(label);
+      signals.database.push(sig("database", label, "high", ["package.json"]));
+    }
+  }
+}
+function detectMigrations(dir, migrationDirs, signals) {
+  for (const md of migrationDirs) {
+    const fullPath = join(dir, md);
+    if (!isDir(fullPath)) continue;
+    let count = 0;
+    try {
+      count = readDir(fullPath).filter((f) => !f.startsWith(".")).length;
+    } catch {
+    }
+    signals.migrations.push(sig("migrations", `${md} (${count} file${count === 1 ? "" : "s"})`, "high", [md]));
+  }
+}
+function detectApiRoutes(dir, codeDirs, signals) {
+  for (const cd of codeDirs) {
+    const apiDir = join(dir, cd, "app", "api");
+    if (isDir(apiDir)) {
+      signals.api_routes.push(sig("api_routes", "Next.js API routes", "high", [`${cd}/app/api`]));
+    }
+    const pagesApi = join(dir, cd, "pages", "api");
+    if (isDir(pagesApi)) {
+      signals.api_routes.push(sig("api_routes", "Next.js Pages API routes", "high", [`${cd}/pages/api`]));
+    }
+  }
+  if (isDir(join(dir, "app", "api"))) {
+    signals.api_routes.push(sig("api_routes", "Next.js API routes", "high", ["app/api"]));
+  }
+  if (isDir(join(dir, "pages", "api"))) {
+    signals.api_routes.push(sig("api_routes", "Next.js Pages API routes", "high", ["pages/api"]));
+  }
+  if (isDir(join(dir, "routes"))) {
+    signals.api_routes.push(sig("api_routes", "Routes directory", "medium", ["routes/"]));
+  }
+}
+function detectTests(dir, testDirs, deps, signals) {
+  const testFrameworks = [
+    ["vitest", "Vitest"],
+    ["jest", "Jest"],
+    ["@playwright/test", "Playwright"],
+    ["cypress", "Cypress"],
+    ["@testing-library/react", "Testing Library"],
+    ["mocha", "Mocha"],
+    ["ava", "AVA"]
+  ];
+  for (const [dep, label] of testFrameworks) {
+    if (dep in deps) {
+      signals.tests.push(sig("tests", label, "high", ["package.json"]));
+    }
+  }
+  if (testDirs.length > 0) {
+    signals.tests.push(sig("tests", `Test directories: ${testDirs.join(", ")}`, "high", testDirs));
+  }
+  if (testDirs.length === 0 && signals.tests.length === 0) {
+    signals.tests.push(sig("tests", "No test directory detected", "high", [], {
+      recommended_review: "Confirm how this project is validated before production changes."
+    }));
+  }
+}
+function detectSecurity(dir, deps, codeDirs, envVarNames, signals) {
+  const secDeps = [
+    ["helmet", "Helmet (security headers)"],
+    ["cors", "CORS middleware"],
+    ["csurf", "CSRF protection"],
+    ["express-rate-limit", "Rate limiting"],
+    ["@upstash/ratelimit", "Upstash Rate Limiting"]
+  ];
+  for (const [dep, label] of secDeps) {
+    if (dep in deps) {
+      signals.security.push(sig("security", label, "high", ["package.json"]));
+    }
+  }
+  const middlewarePaths = findPathsContaining(dir, codeDirs, ["middleware"], 2);
+  if (middlewarePaths.length > 0) {
+    signals.security.push(sig("security", "Middleware detected", "medium", middlewarePaths.slice(0, 5)));
+  }
+  if (isFile(join(dir, "middleware.ts")) || isFile(join(dir, "middleware.js")) || isFile(join(dir, "src", "middleware.ts")) || isFile(join(dir, "src", "middleware.js"))) {
+    const evidence = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"].filter((f) => isFile(join(dir, f)));
+    if (evidence.length > 0) {
+      signals.security.push(sig("security", "Next.js middleware", "high", evidence));
+    }
+  }
+  const rlsMigrations = findFilesMatching(dir, ["supabase/migrations"], /rls|policies|policy/i, 2);
+  if (rlsMigrations.length > 0) {
+    signals.security.push(sig("security", "RLS / row-level security policies", "high", rlsMigrations.slice(0, 3)));
+  }
+  const secretVars = envVarNames.filter((v) => /secret|token|key|password|credential/i.test(v));
+  if (secretVars.length > 0) {
+    signals.security.push(sig("security", "Secret-bearing environment variables", "medium", secretVars.slice(0, 10), {
+      recommended_review: "Confirm secret rotation and endpoint protection strategy."
+    }));
+  }
+}
+function detectInfrastructure(dir, infraFiles, signals) {
+  for (const f of infraFiles) {
+    const label = inferInfraLabel(f);
+    signals.infrastructure.push(sig("infrastructure", label, "high", [f]));
+  }
+}
+function inferInfraLabel(f) {
+  const lower = f.toLowerCase();
+  if (lower.includes("docker-compose")) return "Docker Compose";
+  if (lower === "dockerfile") return "Dockerfile";
+  if (lower.includes("serverless")) return "Serverless Framework";
+  if (lower.includes("amplify")) return "AWS Amplify";
+  if (lower.includes("terraform")) return "Terraform";
+  if (lower.includes("k8s") || lower.includes("kubernetes")) return "Kubernetes";
+  if (lower.includes("helm")) return "Helm";
+  if (lower.includes(".github/workflows")) return "GitHub Actions";
+  if (lower.includes("vercel")) return "Vercel";
+  if (lower.includes("netlify")) return "Netlify";
+  return f;
+}
+function detectExternalIntegrations(deps, signals) {
+  const integrations = [
+    ["@supabase/supabase-js", "Supabase"],
+    ["@aws-sdk/client-s3", "AWS"],
+    ["aws-sdk", "AWS"],
+    ["@google-cloud/storage", "Google Cloud"],
+    ["@azure/storage-blob", "Azure"],
+    ["twilio", "Twilio"],
+    ["@slack/web-api", "Slack"],
+    ["@slack/bolt", "Slack"],
+    ["@notionhq/client", "Notion"],
+    ["@octokit/rest", "GitHub API"],
+    ["@sentry/node", "Sentry"],
+    ["@sentry/nextjs", "Sentry"],
+    ["@datadog/datadog-api-client", "Datadog"],
+    ["newrelic", "New Relic"],
+    ["@segment/analytics-node", "Segment"],
+    ["posthog-node", "PostHog"],
+    ["mixpanel", "Mixpanel"],
+    ["@amplitude/node", "Amplitude"],
+    ["firebase-admin", "Firebase"],
+    ["@google/generative-ai", "Google AI"],
+    ["openai", "OpenAI"],
+    ["@anthropic-ai/sdk", "Anthropic"],
+    ["@vercel/analytics", "Vercel Analytics"],
+    ["@vercel/kv", "Vercel KV"],
+    ["@upstash/redis", "Upstash Redis"],
+    ["ioredis", "Redis"]
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [dep, label] of integrations) {
+    if (dep in deps && !seen.has(label)) {
+      seen.add(label);
+      signals.external_integrations.push(sig("external_integrations", label, "high", ["package.json"]));
+    }
+  }
+}
+function detectEnvironment(dir) {
+  const envFiles = [".env.example", ".env.local.example", ".env.template", ".env.sample"];
+  const varNames = /* @__PURE__ */ new Set();
+  for (const ef of envFiles) {
+    const p2 = join(dir, ef);
+    if (!exists(p2)) continue;
+    try {
+      const lines = readFile(p2).split(/\r?\n/);
+      for (const line of lines) {
+        const m = line.match(/^([A-Z][A-Z0-9_]+)\s*=/);
+        if (m) varNames.add(m[1]);
+      }
+    } catch {
+    }
+  }
+  const envPath = join(dir, ".env");
+  if (exists(envPath)) {
+    try {
+      const lines = readFile(envPath).split(/\r?\n/);
+      for (const line of lines) {
+        const m = line.match(/^([A-Z][A-Z0-9_]+)\s*=/);
+        if (m) varNames.add(m[1]);
+      }
+    } catch {
+    }
+  }
+  return [...varNames].sort();
+}
+function buildScanSignals(dir, codeDirs, migrationDirs, testDirs, infraFiles) {
+  const signals = emptySignals();
+  const deps = readDeps(dir);
+  const envVarNames = detectEnvironment(dir);
+  detectAuth(dir, deps, codeDirs, signals);
+  detectPayments(dir, deps, codeDirs, signals);
+  detectWebhooks(dir, codeDirs, signals);
+  detectStorage(dir, deps, codeDirs, signals);
+  detectBackgroundJobs(dir, deps, codeDirs, signals);
+  detectEmail(dir, deps, signals);
+  detectDatabase(dir, deps, signals);
+  detectMigrations(dir, migrationDirs, signals);
+  detectApiRoutes(dir, codeDirs, signals);
+  detectTests(dir, testDirs, deps, signals);
+  detectSecurity(dir, deps, codeDirs, envVarNames, signals);
+  detectInfrastructure(dir, infraFiles, signals);
+  detectExternalIntegrations(deps, signals);
+  if (envVarNames.length > 0) {
+    signals.environment.push(sig("environment", `${envVarNames.length} environment variable(s) detected`, "high", envVarNames.slice(0, 20)));
+  }
+  return signals;
+}
+function signalCount(signals) {
+  return Object.values(signals).reduce((sum, arr) => sum + arr.length, 0);
+}
+function hasWarnings(signals) {
+  return signals.tests.some((s) => s.label.includes("No test directory"));
+}
+function renderSignalsCompact(signals) {
+  const lines = [];
+  const CATEGORIES = [
+    ["auth", "Auth"],
+    ["payments", "Payments"],
+    ["webhooks", "Webhooks"],
+    ["storage", "Storage"],
+    ["background_jobs", "Background jobs"],
+    ["email", "Email"],
+    ["database", "Database"],
+    ["migrations", "Migrations"],
+    ["api_routes", "API routes"],
+    ["tests", "Tests"],
+    ["security", "Security"],
+    ["infrastructure", "Infrastructure"],
+    ["external_integrations", "External integrations"],
+    ["environment", "Environment"]
+  ];
+  for (const [key, label] of CATEGORIES) {
+    const arr = signals[key];
+    if (arr.length === 0) continue;
+    if (arr.length === 1) {
+      lines.push(`- ${label}: ${arr[0].label}`);
+    } else {
+      lines.push(`- ${label}: ${arr.length}`);
+    }
+  }
+  return lines.length > 0 ? lines.join("\n") + "\n" : "No signals detected.\n";
+}
+function renderSignalsInventory(signals) {
+  const parts = [];
+  const CATEGORIES = [
+    ["auth", "Auth"],
+    ["payments", "Payments"],
+    ["webhooks", "Webhooks"],
+    ["storage", "Storage"],
+    ["background_jobs", "Background Jobs"],
+    ["email", "Email / Notifications"],
+    ["database", "Database"],
+    ["migrations", "Migrations"],
+    ["api_routes", "API Routes"],
+    ["tests", "Tests"],
+    ["security", "Security"],
+    ["infrastructure", "Infrastructure"],
+    ["external_integrations", "External Integrations"],
+    ["environment", "Environment"]
+  ];
+  for (const [key, label] of CATEGORIES) {
+    const arr = signals[key];
+    if (arr.length === 0) continue;
+    parts.push(`### ${label}
+`);
+    for (const s of arr) {
+      parts.push(`- ${s.label} \u2014 confidence: ${s.confidence}`);
+      if (s.evidence.length > 0) {
+        parts.push(`  - Evidence: ${s.evidence.map((e) => "`" + e + "`").join(", ")}`);
+      }
+      if (s.recommended_review) {
+        parts.push(`  - Review: ${s.recommended_review}`);
+      }
+    }
+    parts.push("");
+  }
+  return parts.join("\n");
+}
+function renderSignalsConsole(signals) {
+  const lines = [];
+  const CATEGORIES = [
+    ["auth", "Auth"],
+    ["payments", "Payments"],
+    ["webhooks", "Webhooks"],
+    ["storage", "Storage"],
+    ["background_jobs", "Background jobs"],
+    ["email", "Email"],
+    ["database", "Database"],
+    ["migrations", "Migrations"],
+    ["api_routes", "API routes"],
+    ["tests", "Tests"],
+    ["security", "Security"],
+    ["infrastructure", "Infrastructure"],
+    ["external_integrations", "Integrations"],
+    ["environment", "Environment"]
+  ];
+  for (const [key, label] of CATEGORIES) {
+    const arr = signals[key];
+    if (arr.length === 0) continue;
+    if (arr.length === 1) {
+      const warning = arr[0].label.toLowerCase().includes("no test") ? " \u26A0" : "";
+      lines.push(`  ${label}: ${arr[0].label}${warning}`);
+    } else {
+      lines.push(`  ${label}: ${arr.map((s) => s.label).join(", ")}`);
+    }
+  }
+  return lines;
+}
+
 // src/services/scanner.ts
 function detectLanguage(dir) {
   if (exists(join(dir, "tsconfig.json"))) return "typescript";
@@ -391,6 +937,7 @@ function scan(dir) {
   const testDirs = detectTestDirs(dir);
   const hasGit2 = isDir(join(dir, ".git"));
   const suggestedDomains = suggestDomains(dir, codeDirs);
+  const signals = buildScanSignals(dir, codeDirs, migrationDirs, testDirs, infraFiles);
   return {
     language,
     framework,
@@ -401,7 +948,8 @@ function scan(dir) {
     infraFiles,
     testDirs,
     hasGit: hasGit2,
-    suggestedDomains
+    suggestedDomains,
+    signals
   };
 }
 
@@ -465,6 +1013,7 @@ function buildBaseline(result, context, now = /* @__PURE__ */ new Date()) {
       infrastructureFiles: result.infraFiles,
       testDirectories: result.testDirs
     },
+    signals: result.signals,
     suggestions: {
       possibleDomains: result.suggestedDomains.map((d) => d.replace(/^#\s*/, "").trim()).filter(Boolean),
       openQuestions: buildOpenQuestions(result, context)
@@ -509,6 +1058,10 @@ function renderInventory(baseline) {
   parts.push(section("Contracts", detected.contractFiles));
   parts.push(section("Infrastructure", detected.infrastructureFiles));
   parts.push(section("Tests", detected.testDirectories.map((d) => `${d}/`)));
+  if (signalCount(baseline.signals) > 0) {
+    parts.push("## Detected Signals\n");
+    parts.push(renderSignalsInventory(baseline.signals));
+  }
   parts.push(section("Possible Domains", suggestions.possibleDomains));
   parts.push(section("Open Questions", suggestions.openQuestions));
   return parts.join("\n");
@@ -766,7 +1319,15 @@ function printResult(result) {
     console.log("No domains detected automatically.");
     console.log("You can add them manually in .kaddo/config.yml under project.domains.");
   }
-  console.log("");
+  const signalLines = renderSignalsConsole(result.signals);
+  if (signalLines.length > 0) {
+    console.log("Signals:");
+    for (const line of signalLines) console.log(line);
+    console.log("");
+  } else {
+    console.log("Signals: none detected");
+    console.log("");
+  }
 }
 function updateConfig(dir, result) {
   const configPath = join(dir, ".kaddo", "config.yml");
@@ -4641,8 +5202,8 @@ function parseBlock(block) {
 }
 function decisionCandidatesFromSignals(signals) {
   const out = [];
-  for (const sig of signals) {
-    const m = sig.match(/decision candidate\s*:?\s*(.+)$/i);
+  for (const sig2 of signals) {
+    const m = sig2.match(/decision candidate\s*:?\s*(.+)$/i);
     if (!m) continue;
     const rest = m[1].trim();
     const token = rest.match(/\b[A-Z][A-Z0-9_]{2,}\b/);
@@ -4835,6 +5396,7 @@ function buildFrontMatter(id, type, level, title, answers) {
     `domains: []`,
     `code: []`,
     `created_at: ${today2}`,
+    `source: manual`,
     `summary: "${answers.problem?.split(".")[0] ?? title}"`,
     "---"
   ];
@@ -4921,6 +5483,7 @@ function buildModuleFrontMatter(id, modType, title, answers) {
     `domains: []`,
     `code: []`,
     `created_at: ${today2}`,
+    `source: manual`,
     `summary: "${title}"`,
     ...extraLines,
     "---"
@@ -5100,6 +5663,8 @@ function buildRoadmapFrontMatter(id, type, level, title, candidate, answers) {
     // from the specific Work Item candidate it was materialized from.
     `source_roadmap_initiative: ${candidate.initiative?.id ?? "unknown"}`,
     `source_work_item_candidate: ${candidate.id}`,
+    `source_title: "${q(candidate.title)}"`,
+    `source_context: "Materialized from roadmap candidate ${candidate.id}${candidate.initiative?.id ? ` under initiative ${candidate.initiative.id}` : ""}."`,
     ...candidate.initiative?.title ? [`source_initiative_title: "${q(candidate.initiative.title)}"`] : [],
     ...candidate.domain ? [`related_domain: "${q(candidate.domain)}"`] : [],
     ...yamlList2("related_capabilities", relatedCapabilities),
@@ -5369,6 +5934,7 @@ function parseArtifact(filePath, raw) {
       initiative: String(data.initiative ?? data.source_initiative ?? ""),
       source: data.source ? String(data.source) : "",
       sourceId: String(data.source_id ?? ""),
+      rawFrontmatter: data,
       decisions: Array.isArray(data.decisions) ? data.decisions.map(String).filter(Boolean) : [],
       capsules: Array.isArray(data.capsules) ? data.capsules.map(String).filter(Boolean) : []
     };
@@ -8680,6 +9246,84 @@ function buildRoadmapQuality(dir) {
   return { initiatives, work_item_candidates };
 }
 
+// src/core/work-item-source.ts
+var VALID_SOURCES = [
+  "manual",
+  "roadmap",
+  "jira",
+  "github",
+  "notion",
+  "xlsx",
+  "csv",
+  "api",
+  "external",
+  "unknown"
+];
+function isValidSource(s) {
+  return VALID_SOURCES.includes(s);
+}
+function parseWorkItemSource(frontmatter) {
+  const raw = frontmatter.source ? String(frontmatter.source) : "";
+  if (raw && isValidSource(raw)) {
+    return {
+      type: raw,
+      id: optStr(frontmatter.source_id),
+      title: optStr(frontmatter.source_title),
+      context: optStr(frontmatter.source_context),
+      provider: optStr(frontmatter.source_provider),
+      url: optStr(frontmatter.source_url),
+      imported_at: optStr(frontmatter.source_imported_at),
+      synced_at: optStr(frontmatter.source_synced_at),
+      inferred: false
+    };
+  }
+  if (raw && !isValidSource(raw)) {
+    return {
+      type: "unknown",
+      id: optStr(frontmatter.source_id),
+      title: optStr(frontmatter.source_title),
+      context: optStr(frontmatter.source_context),
+      provider: optStr(frontmatter.source_provider),
+      url: optStr(frontmatter.source_url),
+      imported_at: optStr(frontmatter.source_imported_at),
+      synced_at: optStr(frontmatter.source_synced_at),
+      inferred: true,
+      reason: `Invalid source value: "${raw}".`
+    };
+  }
+  if (frontmatter.source_work_item_candidate || frontmatter.source_roadmap_initiative) {
+    return {
+      type: "roadmap",
+      id: optStr(frontmatter.source_id) ?? optStr(frontmatter.source_work_item_candidate),
+      title: optStr(frontmatter.source_initiative_title),
+      inferred: true,
+      reason: "Inferred from legacy roadmap fields."
+    };
+  }
+  if (frontmatter.source_id) {
+    return {
+      type: "unknown",
+      id: optStr(frontmatter.source_id),
+      inferred: true,
+      reason: "Has source_id but no source type."
+    };
+  }
+  return {
+    type: "unknown",
+    inferred: true,
+    reason: "No source metadata found."
+  };
+}
+function renderSourceCompact(source) {
+  const parts = [source.type];
+  if (source.id) parts.push(source.id);
+  return parts.join(" \xB7 ");
+}
+function optStr(v) {
+  if (typeof v === "string" && v.trim()) return v.trim();
+  return void 0;
+}
+
 // src/core/project-route.ts
 function isUseful(q) {
   return q === "useful";
@@ -8696,11 +9340,11 @@ var enableKaddo = {
 var scanRepository = {
   id: "scan-repository",
   label: "Scan repository",
-  evaluate: (ctx) => ({
-    status: ctx.hasScan ? "done" : ctx.hasConfig ? "pending" : "pending",
-    evidence: ctx.hasScan ? [".kaddo/scan.json"] : void 0,
-    command: ctx.hasScan ? void 0 : "kaddo scan"
-  })
+  evaluate: (ctx) => {
+    if (!ctx.hasScan) return { status: "pending", command: "kaddo scan" };
+    if (ctx.hasScanWarnings) return { status: "warning", evidence: [".kaddo/scan.json"], reason: "Scan has warnings (e.g. no test directory detected).", command: "kaddo scan" };
+    return { status: "done", evidence: [".kaddo/scan.json"] };
+  }
 };
 var defineBusiness = {
   id: "define-business",
@@ -8766,12 +9410,12 @@ var captureTechDecisions = {
 var createWorkSource = {
   id: "create-work-source",
   label: "Create or connect work source",
-  evaluate: (ctx) => ({
-    status: ctx.hasRoadmap || ctx.totalWorkItems > 0 ? "done" : "pending",
-    evidence: ctx.hasRoadmap ? ["knowledge/delivery/roadmap.md"] : void 0,
-    command: ctx.hasRoadmap ? void 0 : "kaddo roadmap",
-    agent: ctx.hasRoadmap ? void 0 : "roadmap-agent"
-  })
+  evaluate: (ctx) => {
+    if (!ctx.hasRoadmap && ctx.totalWorkItems === 0) return { status: "pending", command: "kaddo roadmap", agent: "roadmap-agent" };
+    if (ctx.hasUnknownSources) return { status: "warning", evidence: ["Work Items with unknown source"], reason: "Some Work Items have no source metadata." };
+    const evidence = ctx.hasRoadmap ? ["knowledge/delivery/roadmap.md"] : void 0;
+    return { status: "done", evidence };
+  }
 };
 var materializeWorkItem = {
   id: "materialize-work-item",
@@ -8987,9 +9631,22 @@ function buildRouteContext(dir) {
     totalAdrs: td.adrs,
     adaptersInstalled: adapters.length,
     hasGuardHistory: exists(join(dir, ".kaddo", "history", "guard-runs.jsonl")),
+    hasScanWarnings: hasScan ? loadScanWarnings(dir) : false,
+    hasUnknownSources: wis.some((w) => {
+      const src = parseWorkItemSource(w.rawFrontmatter);
+      return src.type === "unknown" && src.inferred;
+    }),
     nextStepId: mapNextStepId(nextStep.id)
   };
 }
+function loadScanWarnings(dir) {
+  try {
+    const parsed = JSON.parse(readFile(join(dir, ".kaddo", "scan.json")));
+    return parsed.signals ? hasWarnings(parsed.signals) : false;
+  } catch {
+    return false;
+  }
+}
 function mapNextStepId(id) {
   const MAP = {
     init: "enable-kaddo",
@@ -9136,6 +9793,16 @@ function loadScan(dir) {
     return null;
   }
 }
+function loadScanSignals(dir) {
+  const scanPath = join(dir, ".kaddo", "scan.json");
+  if (!exists(scanPath)) return null;
+  try {
+    const parsed = JSON.parse(readFile(scanPath));
+    return parsed.signals ?? null;
+  } catch {
+    return null;
+  }
+}
 function hasAgents(dir) {
   const agentsDir = join(dir, ARCH_DIR4, "agents");
   if (!exists(agentsDir)) return false;
@@ -9184,17 +9851,21 @@ function buildProjectExplanation(dir) {
     hasAgents: hasAgents(dir)
   };
   const workItemArtifacts = discoverWorkItems(dir);
-  const items = workItemArtifacts.map((a) => ({
-    id: a.id || a.title,
-    title: a.title,
-    type: a.type,
-    status: a.status,
-    lifecycle: lifecycleStateOf({ status: a.status, filePath: a.filePath }),
-    initiative: a.initiative,
-    knowledgeLevel: a.knowledgeLevel,
-    hasOwnership: a.codeGlobs.length > 0,
-    domains: a.domains
-  }));
+  const items = workItemArtifacts.map((a) => {
+    const src = parseWorkItemSource(a.rawFrontmatter);
+    return {
+      id: a.id || a.title,
+      title: a.title,
+      type: a.type,
+      status: a.status,
+      lifecycle: lifecycleStateOf({ status: a.status, filePath: a.filePath }),
+      initiative: a.initiative,
+      knowledgeLevel: a.knowledgeLevel,
+      hasOwnership: a.codeGlobs.length > 0,
+      domains: a.domains,
+      source: { type: src.type, ...src.id ? { id: src.id } : {}, inferred: src.inferred }
+    };
+  });
   const byState = lifecycleCounts(items.map((i) => i.lifecycle));
   const byType = {};
   for (const i of items) {
@@ -9307,7 +9978,8 @@ function buildProjectExplanation(dir) {
     },
     installedAssets: installedAssetsSummary(dir),
     roadmapQuality: buildRoadmapQuality(dir),
-    projectRoute: buildProjectRoute(dir)
+    projectRoute: buildProjectRoute(dir),
+    scanSignals: loadScanSignals(dir)
   };
 }
 function stateLabel(state) {
@@ -9352,6 +10024,10 @@ function renderExplanationHuman(exp) {
       lines.push(`- Infrastructure: ${exp.stack.infrastructureFiles.join(", ")}`);
     lines.push("");
   }
+  if (exp.scanSignals && signalCount(exp.scanSignals) > 0) {
+    lines.push("## Scan Signals");
+    lines.push(renderSignalsCompact(exp.scanSignals));
+  }
   const ls = (name) => exp.layers.find((l) => l.layer === name)?.status ?? "Missing";
   lines.push("## Knowledge Status");
   lines.push(`- Inventory: ${exp.knowledge.hasInventory ? "available" : "missing"}`);
@@ -9386,6 +10062,17 @@ function renderExplanationHuman(exp) {
       for (const [t, n] of typeEntries) lines.push(`- ${typeLabel(t)}: ${n}`);
       lines.push("");
     }
+    const sourceCounts = {};
+    for (const i of exp.workItems.items) {
+      const t = i.source?.type ?? "unknown";
+      sourceCounts[t] = (sourceCounts[t] ?? 0) + 1;
+    }
+    const sourceEntries = Object.entries(sourceCounts).filter(([, n]) => n > 0);
+    if (sourceEntries.length > 0) {
+      lines.push("## Work Item Sources");
+      for (const [t, n] of sourceEntries) lines.push(`- ${t.charAt(0).toUpperCase() + t.slice(1)}: ${n}`);
+      lines.push("");
+    }
     const grouped = exp.workItems.initiatives.filter(
       (g) => LIFECYCLE_STATES.some((s2) => g.states[s2] > 0)
     );
@@ -9854,7 +10541,8 @@ function toContextWorkItem(a) {
     status: a.status,
     lifecycle: lifecycleStateOf({ status: a.status, filePath: a.filePath }),
     knowledgeLevel: a.knowledgeLevel,
-    domains: a.domains
+    domains: a.domains,
+    source: parseWorkItemSource(a.rawFrontmatter)
   };
 }
 function toContextArtifact(a) {
@@ -10017,6 +10705,7 @@ function buildContextPack(dir, config, now = /* @__PURE__ */ new Date()) {
     graph: loadGraphSummary(dir),
     graphHints: loadGraphHints(dir),
     skills: discoverInstalledSkills(dir).map((s) => s.id),
+    scanSignals: scanJson?.signals ?? null,
     projectRoute: buildProjectRoute(dir),
     mappedModules,
     missing,
@@ -10131,6 +10820,10 @@ function renderContextPack(pack) {
   } else {
     parts.push("Scan baseline missing. Run `kaddo scan` for better context.\n");
   }
+  if (pack.scanSignals && signalCount(pack.scanSignals) > 0) {
+    parts.push("## Scan Signals\n");
+    parts.push(renderSignalsCompact(pack.scanSignals));
+  }
   parts.push("## Current Knowledge\n");
   parts.push((knowledge.summary || "No project knowledge summary found yet.") + "\n");
   parts.push("## Roadmap Status\n");
@@ -10190,7 +10883,10 @@ function renderContextPack(pack) {
       const level = wi.knowledgeLevel ? ` [${wi.knowledgeLevel}]` : "";
       const status = wi.lifecycle ? ` (${wi.lifecycle})` : wi.status ? ` (${wi.status})` : "";
       const domains = wi.domains.length > 0 ? ` \xB7 domains: ${wi.domains.join(", ")}` : "";
-      return `- ${wi.id || wi.title} [${wi.type}]${level}${status} \u2014 ${wi.title}${domains}`;
+      const line = `- ${wi.id || wi.title} [${wi.type}]${level}${status} \u2014 ${wi.title}${domains}`;
+      const src = wi.source && wi.source.type !== "unknown" ? `
+  - Source: ${renderSourceCompact(wi.source)}` : "";
+      return `${line}${src}`;
     });
     parts.push(lines.join("\n") + "\n");
   } else {
@@ -10500,7 +11196,11 @@ function renderUnderstand(plan) {
   if (plan.activeWorkItems && plan.activeWorkItems.length > 0) {
     parts.push("## Active Work Items\n");
     parts.push(
-      plan.activeWorkItems.map((w) => `- ${w.id} [${w.type}] ${w.lifecycle} \u2014 ${w.title}`).join("\n") + "\n"
+      plan.activeWorkItems.map((w) => {
+        const src = w.source && w.source.type !== "unknown" ? `
+  - Source: ${w.source.type}${w.source.id ? ` \xB7 ${w.source.id}` : ""}` : "";
+        return `- ${w.id} [${w.type}] ${w.lifecycle} \u2014 ${w.title}${src}`;
+      }).join("\n") + "\n"
     );
   }
   parts.push("## Context Pack\n");
@@ -10821,7 +11521,11 @@ function runUnderstand() {
     type: w.type,
     lifecycle: w.lifecycle ?? "draft",
     knowledgeLevel: w.knowledgeLevel,
-    hasOwnership: w.codeGlobs.length > 0
+    hasOwnership: w.codeGlobs.length > 0,
+    source: (() => {
+      const s = parseWorkItemSource(w.rawFrontmatter);
+      return { type: s.type, ...s.id ? { id: s.id } : {} };
+    })()
   }));
   const recommendedPaths = [];
   if (rec.agent) {
@@ -11502,7 +12206,7 @@ function findWorkItemArtifacts(dir) {
 function artifactsMissingOwnership(artifacts) {
   return artifacts.filter((a) => !a.hasOwnership);
 }
-function loadScanSignals(dir) {
+function loadScanSignals2(dir) {
   const scanPath = join(dir, SCAN_PATH);
   if (!exists(scanPath)) return null;
   try {
@@ -11680,7 +12384,7 @@ async function runOwnersSuggest() {
     }))
   });
   const artifact = missing.find((a) => a.relPath === relPath);
-  const signals = loadScanSignals(dir);
+  const signals = loadScanSignals2(dir);
   if (!signals) {
     log2.warn("No .kaddo/scan.json found \u2014 run `kaddo scan` for suggestions. You can enter globs manually.");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaddo/cli",
-  "version": "3.47.0",
+  "version": "3.49.0",
   "description": "Knowledge Driven Development toolkit",
   "license": "MIT",
   "repository": {