@kodus/kodus-graph 0.2.8 → 0.2.10

package/dist/shared/filters.js

@@ -0,0 +1,240 @@
+export const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    '.next',
+    'coverage',
+    'vendor',
+    '__pycache__',
+    '.venv',
+    'venv',
+    'target',
+    '.turbo',
+    '.cache',
+    '.output',
+    'out',
+    '.nuxt',
+    '.svelte-kit',
+    '.idea',
+    '.mypy_cache',
+    '.tox',
+    '.pytest_cache',
+    '.eggs',
+    'bower_components',
+]);
+/** File name patterns to skip during discovery (minified, bundled, vendored) */
+const SKIP_FILE_PATTERNS = [
+    /\.min\.\w+$/, // *.min.js, *.min.css
+    /[.-]bundle\.\w+$/, // *.bundle.js, *-bundle.js
+    /\.chunk\.\w+$/, // *.chunk.js (webpack)
+    /\.packed\.\w+$/, // *.packed.js
+];
+export function isSkippableFile(fileName) {
+    return SKIP_FILE_PATTERNS.some((p) => p.test(fileName));
+}
+export const NOISE = new Set([
+    // JS/TS builtins
+    'log',
+    'error',
+    'warn',
+    'info',
+    'debug',
+    'trace',
+    'push',
+    'pop',
+    'shift',
+    'unshift',
+    'splice',
+    'slice',
+    'map',
+    'filter',
+    'reduce',
+    'forEach',
+    'find',
+    'findIndex',
+    'some',
+    'every',
+    'flat',
+    'flatMap',
+    'sort',
+    'reverse',
+    'join',
+    'split',
+    'trim',
+    'replace',
+    'match',
+    'test',
+    'includes',
+    'indexOf',
+    'lastIndexOf',
+    'startsWith',
+    'endsWith',
+    'keys',
+    'values',
+    'entries',
+    'assign',
+    'freeze',
+    'create',
+    'stringify',
+    'parse',
+    'toString',
+    'toLowerCase',
+    'toUpperCase',
+    'concat',
+    'charAt',
+    'substring',
+    'parseInt',
+    'parseFloat',
+    'isNaN',
+    'isFinite',
+    'isArray',
+    'resolve',
+    'reject',
+    'all',
+    'allSettled',
+    'race',
+    'any',
+    'then',
+    'catch',
+    'finally',
+    'get',
+    'set',
+    'has',
+    'delete',
+    'clear',
+    'add',
+    'next',
+    'return',
+    'throw',
+    'setTimeout',
+    'clearTimeout',
+    'setInterval',
+    'clearInterval',
+    'require',
+    'length',
+    'call',
+    'apply',
+    'bind',
+    'createElement',
+    'useState',
+    'useEffect',
+    'useRef',
+    'useCallback',
+    'useMemo',
+    'useContext',
+    'useReducer',
+    'render',
+    // Test helpers
+    'expect',
+    'toBe',
+    'toEqual',
+    'toBeDefined',
+    'toBeNull',
+    'toBeUndefined',
+    'toBeTruthy',
+    'toBeFalsy',
+    'toContain',
+    'toHaveLength',
+    'toThrow',
+    'toHaveBeenCalled',
+    'toHaveBeenCalledWith',
+    'toMatchObject',
+    'toHaveBeenCalledTimes',
+    'toHaveProperty',
+    'describe',
+    'it',
+    'test',
+    'beforeEach',
+    'afterEach',
+    'beforeAll',
+    'afterAll',
+    'fn',
+    'spyOn',
+    'mock',
+    'mockResolvedValue',
+    'mockReturnValue',
+    'mockImplementation',
+    'mockReturnThis',
+    'now',
+    'toISOString',
+    'getTime',
+    // Globals
+    'console',
+    'Math',
+    'Date',
+    'JSON',
+    'Object',
+    'Array',
+    'String',
+    'Number',
+    'Boolean',
+    'Promise',
+    'Error',
+    'Map',
+    'Set',
+    'RegExp',
+    'Buffer',
+    'process',
+    // Python builtins
+    'print',
+    'len',
+    'range',
+    'enumerate',
+    'zip',
+    'isinstance',
+    'type',
+    'super',
+    'self',
+    'cls',
+    'None',
+    'True',
+    'False',
+    'append',
+    'extend',
+    'insert',
+    'remove',
+    'update',
+    'items',
+    'format',
+    'strip',
+    'upper',
+    'lower',
+    // Ruby builtins
+    'puts',
+    'raise',
+    'yield',
+    'each',
+    'do',
+    'end',
+    'attr_accessor',
+    'attr_reader',
+    'attr_writer',
+    'respond_to',
+    'render',
+    'redirect_to',
+    'before_action',
+    'after_action',
+    'validates',
+    'has_many',
+    'belongs_to',
+    'has_one',
+    'new',
+    'initialize',
+    // Go builtins
+    'fmt',
+    'Println',
+    'Printf',
+    'Sprintf',
+    'Errorf',
+    'make',
+    'panic',
+    'recover',
+    'defer',
+    // Java builtins
+    'System',
+    'println',
+    'equals',
+    'hashCode',
+    'getClass',
+]);

package/dist/shared/logger.d.ts

@@ -0,0 +1,6 @@
+export declare const log: {
+    info(msg: string, ctx?: Record<string, unknown>): void;
+    debug(msg: string, ctx?: Record<string, unknown>): void;
+    warn(msg: string, ctx?: Record<string, unknown>): void;
+    error(msg: string, ctx?: Record<string, unknown>): void;
+};

package/dist/shared/logger.js

@@ -0,0 +1,17 @@
+// src/shared/logger.ts
+export const log = {
+    info(msg, ctx) {
+        process.stderr.write(`[INFO] ${msg}${ctx ? ` ${JSON.stringify(ctx)}` : ''}\n`);
+    },
+    debug(msg, ctx) {
+        if (process.env.KODUS_GRAPH_DEBUG) {
+            process.stderr.write(`[DEBUG] ${msg}${ctx ? ` ${JSON.stringify(ctx)}` : ''}\n`);
+        }
+    },
+    warn(msg, ctx) {
+        process.stderr.write(`[WARN] ${msg}${ctx ? ` ${JSON.stringify(ctx)}` : ''}\n`);
+    },
+    error(msg, ctx) {
+        process.stderr.write(`[ERROR] ${msg}${ctx ? ` ${JSON.stringify(ctx)}` : ''}\n`);
+    },
+};

package/dist/shared/qualified-name.d.ts

@@ -0,0 +1 @@
+export declare function qualifiedName(filePath: string, name: string, className?: string, isTest?: boolean): string;

package/dist/shared/qualified-name.js

@@ -0,0 +1,9 @@
+export function qualifiedName(filePath, name, className, isTest) {
+    if (isTest) {
+        return `${filePath}::test:${name}`;
+    }
+    if (className) {
+        return `${filePath}::${className}.${name}`;
+    }
+    return `${filePath}::${name}`;
+}

package/dist/shared/safe-path.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Validate that a resolved path is within the repository root.
+ * Returns the validated absolute path.
+ * Throws if the path escapes the root.
+ */
+export declare function ensureWithinRoot(filePath: string, repoRoot: string): string;

package/dist/shared/safe-path.js

@@ -0,0 +1,29 @@
+import { realpathSync } from 'fs';
+import { relative, resolve } from 'path';
+/**
+ * Validate that a resolved path is within the repository root.
+ * Returns the validated absolute path.
+ * Throws if the path escapes the root.
+ */
+export function ensureWithinRoot(filePath, repoRoot) {
+    let absRoot;
+    try {
+        absRoot = realpathSync(resolve(repoRoot));
+    }
+    catch {
+        absRoot = resolve(repoRoot);
+    }
+    let absPath;
+    try {
+        absPath = realpathSync(resolve(absRoot, filePath));
+    }
+    catch {
+        // File doesn't exist yet or is unreadable — use resolve without symlink follow
+        absPath = resolve(absRoot, filePath);
+    }
+    const rel = relative(absRoot, absPath);
+    if (rel.startsWith('..') || resolve(absRoot, rel) !== absPath) {
+        throw new Error(`Path escapes repository root: ${filePath}`);
+    }
+    return absPath;
+}

package/dist/shared/schemas.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+export declare const GraphInputSchema: z.ZodObject<{
+    sha: z.ZodOptional<z.ZodString>;
+    nodes: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            Function: "Function";
+            Method: "Method";
+            Constructor: "Constructor";
+            Class: "Class";
+            Interface: "Interface";
+            Enum: "Enum";
+            Test: "Test";
+        }>;
+        name: z.ZodString;
+        qualified_name: z.ZodString;
+        file_path: z.ZodString;
+        line_start: z.ZodNumber;
+        line_end: z.ZodNumber;
+        language: z.ZodString;
+        is_test: z.ZodBoolean;
+        file_hash: z.ZodOptional<z.ZodString>;
+        content_hash: z.ZodOptional<z.ZodString>;
+        parent_name: z.ZodOptional<z.ZodString>;
+        params: z.ZodOptional<z.ZodString>;
+        return_type: z.ZodOptional<z.ZodString>;
+        modifiers: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    edges: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            CALLS: "CALLS";
+            IMPORTS: "IMPORTS";
+            INHERITS: "INHERITS";
+            IMPLEMENTS: "IMPLEMENTS";
+            TESTED_BY: "TESTED_BY";
+            CONTAINS: "CONTAINS";
+        }>;
+        source_qualified: z.ZodString;
+        target_qualified: z.ZodString;
+        file_path: z.ZodString;
+        line: z.ZodNumber;
+        confidence: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;

package/dist/shared/schemas.js

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+const GraphNodeSchema = z.object({
+    kind: z.enum(['Function', 'Method', 'Constructor', 'Class', 'Interface', 'Enum', 'Test']),
+    name: z.string(),
+    qualified_name: z.string(),
+    file_path: z.string(),
+    line_start: z.number(),
+    line_end: z.number(),
+    language: z.string(),
+    is_test: z.boolean(),
+    file_hash: z.string().optional(),
+    content_hash: z.string().optional(),
+    parent_name: z.string().optional(),
+    params: z.string().optional(),
+    return_type: z.string().optional(),
+    modifiers: z.string().optional(),
+});
+const GraphEdgeSchema = z.object({
+    kind: z.enum(['CALLS', 'IMPORTS', 'INHERITS', 'IMPLEMENTS', 'TESTED_BY', 'CONTAINS']),
+    source_qualified: z.string(),
+    target_qualified: z.string(),
+    file_path: z.string(),
+    line: z.number(),
+    confidence: z.number().optional(),
+});
+export const GraphInputSchema = z.object({
+    sha: z.string().optional(),
+    nodes: z.array(GraphNodeSchema),
+    edges: z.array(GraphEdgeSchema),
+});

package/dist/shared/temp.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Create a secure temp directory + file path.
+ * Directory is created with 0700 permissions via mkdtempSync.
+ * File name uses crypto.randomBytes for unpredictability.
+ *
+ * Caller is responsible for cleanup (rmSync(dir, { recursive: true, force: true })).
+ */
+export declare function createSecureTempFile(prefix: string): {
+    dir: string;
+    filePath: string;
+};

package/{src/shared/temp.ts → dist/shared/temp.js}

@@ -2,7 +2,6 @@ import { randomBytes } from 'crypto';
 import { mkdtempSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
-
 /**
  * Create a secure temp directory + file path.
  * Directory is created with 0700 permissions via mkdtempSync.
@@ -10,8 +9,8 @@ import { join } from 'path';
  *
  * Caller is responsible for cleanup (rmSync(dir, { recursive: true, force: true })).
  */
-export function createSecureTempFile(prefix: string): { dir: string; filePath: string } {
-  const dir = mkdtempSync(join(tmpdir(), `kodus-graph-${prefix}-`));
-  const filePath = join(dir, `${randomBytes(8).toString('hex')}.json`);
-  return { dir, filePath };
+export function createSecureTempFile(prefix) {
+    const dir = mkdtempSync(join(tmpdir(), `kodus-graph-${prefix}-`));
+    const filePath = join(dir, `${randomBytes(8).toString('hex')}.json`);
+    return { dir, filePath };
 }

package/package.json

@@ -1,13 +1,22 @@
 {
   "name": "@kodus/kodus-graph",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Code graph builder for Kodus code review — parses source code into structural graphs with nodes, edges, and analysis",
   "type": "module",
+  "main": "./dist/cli.js",
+  "types": "./dist/cli.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/cli.d.ts",
+      "import": "./dist/cli.js"
+    }
+  },
   "bin": {
-    "kodus-graph": "./src/cli.ts"
+    "kodus-graph": "./dist/cli.js"
   },
   "files": [
-    "src/**/*.ts",
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
     "README.md",
     "LICENSE"
   ],
@@ -19,7 +28,9 @@
     "format": "biome format --write src/ tests/",
     "typecheck": "tsc --noEmit",
     "check": "bun run typecheck && bun run lint && bun test",
-    "build": "bun build src/cli.ts --compile --outfile kodus-graph",
+    "build:dist": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "bun run build:dist",
+    "build": "bun build src/cli.ts --compile --outfile dist/kodus-graph",
     "build:all": "bun run build:darwin-arm64 && bun run build:darwin-x64 && bun run build:linux-x64 && bun run build:linux-arm64",
     "build:darwin-arm64": "bun build src/cli.ts --compile --target=bun-darwin-arm64 --outfile dist/kodus-graph-darwin-arm64",
     "build:darwin-x64": "bun build src/cli.ts --compile --target=bun-darwin-x64 --outfile dist/kodus-graph-darwin-x64",
@@ -39,8 +50,11 @@
     "type": "git",
     "url": "https://github.com/kodustech/kodus-graph.git"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "engines": {
-    "bun": ">=1.0.0"
+    "bun": ">=1.3.0"
   },
   "dependencies": {
     "@ast-grep/lang-csharp": "^0.0.6",
@@ -56,7 +70,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.10",
-    "@types/bun": "latest",
+    "@types/bun": "^1.3.11",
     "typescript": "^6.0.2"
   }
 }

package/src/analysis/blast-radius.ts

@@ -1,54 +0,0 @@
-import type { BlastRadiusResult, GraphData } from '../graph/types';
-
-export function computeBlastRadius(graph: GraphData, changedFiles: string[], maxDepth: number = 2): BlastRadiusResult {
-  // Build adjacency list from CALLS edges (callers of changed nodes)
-  const adj = new Map<string, Set<string>>();
-  for (const edge of graph.edges) {
-    if (edge.kind !== 'CALLS' && edge.kind !== 'IMPORTS') continue;
-    // Reverse direction: target -> source (who calls/imports this?)
-    if (!adj.has(edge.target_qualified)) adj.set(edge.target_qualified, new Set());
-    adj.get(edge.target_qualified)!.add(edge.source_qualified);
-    // Forward direction too for IMPORTS
-    if (edge.kind === 'IMPORTS') {
-      if (!adj.has(edge.source_qualified)) adj.set(edge.source_qualified, new Set());
-      adj.get(edge.source_qualified)!.add(edge.target_qualified);
-    }
-  }
-
-  // Seed: all nodes in changed files
-  const changedSet = new Set(changedFiles);
-  const seeds = graph.nodes.filter((n) => changedSet.has(n.file_path)).map((n) => n.qualified_name);
-
-  // BFS
-  const visited = new Set<string>(seeds);
-  const byDepth: Record<string, string[]> = {};
-  let frontier = seeds;
-
-  for (let depth = 1; depth <= maxDepth; depth++) {
-    const next: string[] = [];
-    for (const node of frontier) {
-      for (const neighbor of adj.get(node) || []) {
-        if (!visited.has(neighbor)) {
-          visited.add(neighbor);
-          next.push(neighbor);
-        }
-      }
-    }
-    if (next.length > 0) byDepth[String(depth)] = next;
-    frontier = next;
-  }
-
-  // Count unique files
-  const nodeIndex = new Map(graph.nodes.map((n) => [n.qualified_name, n]));
-  const impactedFiles = new Set<string>();
-  for (const q of visited) {
-    const node = nodeIndex.get(q);
-    if (node) impactedFiles.add(node.file_path);
-  }
-
-  return {
-    total_functions: visited.size,
-    total_files: impactedFiles.size,
-    by_depth: byDepth,
-  };
-}

package/src/analysis/communities.ts

@@ -1,135 +0,0 @@
-import type { IndexedGraph } from '../graph/loader';
-
-export interface CommunityOptions {
-  depth: number;
-  minSize: number;
-}
-
-export interface Community {
-  name: string;
-  files: string[];
-  node_count: number;
-  cohesion: number;
-  language: string;
-}
-
-export interface CouplingPair {
-  source: string;
-  target: string;
-  edges: number;
-  strength: 'HIGH' | 'MEDIUM' | 'LOW';
-}
-
-export interface CommunitiesResult {
-  communities: Community[];
-  coupling: CouplingPair[];
-  summary: { total_communities: number; avg_cohesion: number; high_coupling_pairs: number };
-}
-
-function getCommunityKey(filePath: string, depth: number): string {
-  const parts = filePath.split('/');
-  return parts.slice(0, depth).join('/');
-}
-
-export function detectCommunities(graph: IndexedGraph, opts: CommunityOptions): CommunitiesResult {
-  const { depth, minSize } = opts;
-
-  // Group nodes by directory
-  const groups = new Map<string, Set<string>>(); // community -> files
-  const nodeComm = new Map<string, string>(); // qualified_name -> community
-
-  for (const node of graph.nodes) {
-    const key = getCommunityKey(node.file_path, depth);
-    if (!groups.has(key)) groups.set(key, new Set());
-    groups.get(key)!.add(node.file_path);
-    nodeComm.set(node.qualified_name, key);
-  }
-
-  // Count internal and cross edges per community pair
-  const internalEdges = new Map<string, number>();
-  const crossEdges = new Map<string, number>(); // "a|b" -> count
-
-  for (const edge of graph.edges) {
-    if (edge.kind !== 'CALLS' && edge.kind !== 'IMPORTS') continue;
-    const srcComm = nodeComm.get(edge.source_qualified);
-    const tgtComm = nodeComm.get(edge.target_qualified);
-    if (!srcComm || !tgtComm) continue;
-
-    if (srcComm === tgtComm) {
-      internalEdges.set(srcComm, (internalEdges.get(srcComm) || 0) + 1);
-    } else {
-      const pairKey = [srcComm, tgtComm].sort().join('|');
-      crossEdges.set(pairKey, (crossEdges.get(pairKey) || 0) + 1);
-    }
-  }
-
-  // Build communities
-  const communities: Community[] = [];
-  for (const [name, files] of groups) {
-    const nodeCount = graph.nodes.filter((n) => getCommunityKey(n.file_path, depth) === name).length;
-    if (nodeCount < minSize) continue;
-
-    const internal = internalEdges.get(name) || 0;
-    const maxPossible = nodeCount * (nodeCount - 1);
-    const cohesion = maxPossible > 0 ? Math.round((internal / maxPossible) * 100) / 100 : 0;
-
-    const langs = new Map<string, number>();
-    for (const n of graph.nodes) {
-      if (getCommunityKey(n.file_path, depth) === name) {
-        langs.set(n.language, (langs.get(n.language) || 0) + 1);
-      }
-    }
-    let dominant = 'unknown';
-    let maxCount = 0;
-    for (const [lang, count] of langs) {
-      if (count > maxCount) {
-        dominant = lang;
-        maxCount = count;
-      }
-    }
-
-    communities.push({
-      name,
-      files: [...files].sort(),
-      node_count: nodeCount,
-      cohesion,
-      language: dominant,
-    });
-  }
-
-  communities.sort((a, b) => b.node_count - a.node_count);
-
-  // Build coupling pairs
-  const communityNames = new Set(communities.map((c) => c.name));
-  const coupling: CouplingPair[] = [];
-  for (const [pairKey, count] of crossEdges) {
-    const [src, tgt] = pairKey.split('|');
-    if (!communityNames.has(src) || !communityNames.has(tgt)) continue;
-
-    const srcTotal = graph.edges.filter((e) => {
-      const c = nodeComm.get(e.source_qualified);
-      return c === src || c === tgt;
-    }).length;
-    const ratio = srcTotal > 0 ? count / srcTotal : 0;
-    const strength = ratio > 0.3 ? 'HIGH' : ratio > 0.1 ? 'MEDIUM' : 'LOW';
-
-    coupling.push({ source: src, target: tgt, edges: count, strength });
-  }
-
-  coupling.sort((a, b) => b.edges - a.edges);
-
-  const avgCohesion =
-    communities.length > 0
-      ? Math.round((communities.reduce((s, c) => s + c.cohesion, 0) / communities.length) * 100) / 100
-      : 0;
-
-  return {
-    communities,
-    coupling,
-    summary: {
-      total_communities: communities.length,
-      avg_cohesion: avgCohesion,
-      high_coupling_pairs: coupling.filter((c) => c.strength === 'HIGH').length,
-    },
-  };
-}