@lamentis/naome 1.3.10 → 1.3.11

package/crates/naome-core/tests/architecture.rs

@@ -6,21 +6,18 @@ use std::time::{SystemTime, UNIX_EPOCH};
 
 use naome_core::{
     default_architecture_config_text, scan_architecture, validate_architecture, ArchitectureConfig,
-    ArchitectureScanOptions,
+    ArchitectureEdgeKind, ArchitectureScanOptions,
 };
 
 static FIXTURE_COUNTER: AtomicU64 = AtomicU64::new(0);
+const FORBIDDEN_DOMAIN_TO_INFRASTRUCTURE_CONFIG: &str = "layers:\n  domain:\n    paths:\n      - \"src/domain/**\"\n  infrastructure:\n    paths:\n      - \"src/infrastructure/**\"\nallowed_dependencies:\n  domain:\n  infrastructure:\n    - domain\nrules:\n  no_forbidden_layer_dependencies:\n    enabled: true\n    severity: error\n";
 
 #[test]
 fn parses_starter_architecture_config() {
     let config = ArchitectureConfig::parse(default_architecture_config_text(), "test").unwrap();
 
     assert!(config.layers.contains_key("application"));
-    assert_eq!(
-        config.rule("max_file_lines").value,
-        Some(400),
-        "starter config should seed a production file-size budget"
-    );
+    assert_eq!(config.rule("max_file_lines").value, Some(400));
     assert_eq!(
         config.ignore[0].reason,
         "Generated code is not architecture-owned."
@@ -58,7 +55,6 @@ rules:
     );
 
     let scan = scan_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
-
     assert!(scan
         .graph
         .nodes
@@ -84,6 +80,343 @@ rules:
     );
 }
 
+#[test]
+fn import_extractors_emit_file_and_external_dependency_edges() {
+    let repo = FixtureRepo::new();
+    repo.write(
+        "src/domain/event.ts",
+        "import { db } from '../infrastructure/db';\nimport React from 'react';\n",
+    );
+    repo.write("src/infrastructure/db.ts", "export const db = 1;\n");
+    repo.write(
+        "src/domain/service.py",
+        "from ..infrastructure.client import db\nimport requests\n",
+    );
+    repo.write("src/infrastructure/client.py", "db = object()\n");
+    repo.write(
+        "src/domain/lib.rs",
+        "use crate::infrastructure::db;\nextern crate serde;\n",
+    );
+    repo.write("src/infrastructure/db.rs", "pub fn connect() {}\n");
+    repo.write("cmd/server/main.go", "package main\nimport \"fmt\"\n");
+
+    let scan = scan_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+
+    assert!(scan.graph.edges.iter().any(|edge| {
+        edge.kind == ArchitectureEdgeKind::Imports
+            && edge.from == "file:src/domain/event.ts"
+            && edge.to == "file:src/infrastructure/db.ts"
+    }));
+    assert!(scan
+        .graph
+        .nodes
+        .iter()
+        .any(|node| node.id == "external:react"));
+    assert!(scan
+        .graph
+        .nodes
+        .iter()
+        .any(|node| node.id == "external:requests"));
+    assert!(scan
+        .graph
+        .nodes
+        .iter()
+        .any(|node| node.id == "external:fmt"));
+    assert!(scan.graph.edges.iter().any(|edge| {
+        edge.kind == ArchitectureEdgeKind::Imports
+            && edge.from == "file:src/domain/service.py"
+            && edge.to == "file:src/infrastructure/client.py"
+    }));
+    assert!(scan.graph.edges.iter().any(|edge| {
+        edge.kind == ArchitectureEdgeKind::Imports
+            && edge.from == "file:src/domain/lib.rs"
+            && edge.to == "file:src/infrastructure/db.rs"
+    }));
+}
+
+#[test]
+fn import_resolution_covers_common_language_forms_without_dropping_layer_edges() {
+    let repo = FixtureRepo::new();
+    repo.write("naome.arch.yaml", FORBIDDEN_DOMAIN_TO_INFRASTRUCTURE_CONFIG);
+    repo.write(
+        "src/domain/event.ts",
+        "import {\n  db\n} from '../infrastructure/db';\n",
+    );
+    repo.write("src/infrastructure/db.ts", "export const db = 1;\n");
+    repo.write(
+        "src/domain/rust_item.rs",
+        "use crate::infrastructure::pool::Pool;\n",
+    );
+    repo.write("src/infrastructure/pool.rs", "pub struct Pool;\n");
+    repo.write(
+        "src/domain/python_from_relative.py",
+        "from ..infrastructure import client\n",
+    );
+    repo.write(
+        "src/domain/python_from_absolute.py",
+        "from src.infrastructure.client import db\n",
+    );
+    repo.write(
+        "src/domain/python_import_list.py",
+        "import requests, src.infrastructure.client\n",
+    );
+    repo.write("src/infrastructure/client.py", "db = object()\n");
+
+    let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+
+    assert_eq!(report.summary.errors, 5);
+    let violation_paths = report
+        .violations
+        .iter()
+        .map(|violation| violation.path.as_deref().unwrap_or(""))
+        .collect::<Vec<_>>();
+    assert!(violation_paths.contains(&"src/domain/event.ts"));
+    assert!(violation_paths.contains(&"src/domain/rust_item.rs"));
+    assert!(violation_paths.contains(&"src/domain/python_from_relative.py"));
+    assert!(violation_paths.contains(&"src/domain/python_from_absolute.py"));
+    assert!(violation_paths.contains(&"src/domain/python_import_list.py"));
+}
+
+#[test]
+fn relative_import_resolution_prefers_source_language_extensions() {
+    let repo = FixtureRepo::new();
+    repo.write("src/domain/mod.rs", "mod db;\n");
+    repo.write("src/domain/db.ts", "export const wrong = true;\n");
+    repo.write("src/domain/db.rs", "pub fn right() {}\n");
+
+    let scan = scan_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+
+    assert!(scan.graph.edges.iter().any(|edge| {
+        edge.kind == ArchitectureEdgeKind::Imports
+            && edge.from == "file:src/domain/mod.rs"
+            && edge.to == "file:src/domain/db.rs"
+    }));
+    assert!(!scan.graph.edges.iter().any(|edge| {
+        edge.kind == ArchitectureEdgeKind::Imports
+            && edge.from == "file:src/domain/mod.rs"
+            && edge.to == "file:src/domain/db.ts"
+    }));
+}
+
+#[test]
+fn import_resolver_handles_language_specific_module_roots() {
+    let repo = FixtureRepo::new();
+    repo.write(
+        "packages/app/src/domain/event.rs",
+        "use crate::infrastructure::db::Pool;\n",
+    );
+    repo.write(
+        "packages/app/src/infrastructure/db.rs",
+        "pub struct Pool;\n",
+    );
+    repo.write(
+        "src/domain/service.rs",
+        "mod helper;\nuse self::helper::Thing;\nuse super::infra;\n",
+    );
+    repo.write("src/domain/helper.rs", "pub fn wrong() {}\n");
+    repo.write("src/domain/service/helper.rs", "pub fn right() {}\n");
+    repo.write("src/infra.rs", "pub fn wrong() {}\n");
+    repo.write("src/domain/infra.rs", "pub fn right() {}\n");
+    repo.write("go.mod", "module github.com/acme/app\n");
+    repo.write(
+        "domain/event.go",
+        "package domain\nimport \"github.com/acme/app/infrastructure/db\"\n",
+    );
+    repo.write(
+        "domain/external.go",
+        "package domain\nimport \"github.com/other/db\"\n",
+    );
+    repo.write("infrastructure/db/db.go", "package db\n");
+
+    let scan = scan_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+
+    let has = |from, to| has_import_edge(&scan, from, to);
+    assert!(has(
+        "file:packages/app/src/domain/event.rs",
+        "file:packages/app/src/infrastructure/db.rs"
+    ));
+    assert!(has("file:src/domain/service.rs", "file:src/domain/service/helper.rs"));
+    assert!(!has("file:src/domain/service.rs", "file:src/domain/helper.rs"));
+    assert!(has("file:src/domain/service.rs", "file:src/domain/infra.rs"));
+    assert!(!has("file:src/domain/service.rs", "file:src/infra.rs"));
+    assert!(has("file:domain/event.go", "file:infrastructure/db/db.go"));
+    assert!(!has("file:domain/external.go", "file:infrastructure/db/db.go"));
+}
+
+#[test]
+fn missing_layer_allowlist_is_treated_as_no_allowed_dependencies() {
+    let repo = FixtureRepo::new();
+    repo.write(
+        "naome.arch.yaml",
+        r#"
+layers:
+  domain:
+    paths:
+      - "src/domain/**"
+  infrastructure:
+    paths:
+      - "src/infrastructure/**"
+rules:
+  no_forbidden_layer_dependencies:
+    enabled: true
+    severity: error
+"#,
+    );
+    repo.write(
+        "src/domain/event.ts",
+        "import { db } from '../infrastructure/db';\n",
+    );
+    repo.write("src/infrastructure/db.ts", "export const db = 1;\n");
+
+    let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+
+    assert_eq!(report.status, "fail");
+    assert!(report.violations.iter().any(|violation| {
+        violation.id == "arch.no_forbidden_layer_dependencies"
+            && violation.path.as_deref() == Some("src/domain/event.ts")
+    }));
+}
+
+#[test]
+fn overlapping_target_layers_do_not_create_false_forbidden_dependency() {
+    let repo = FixtureRepo::new();
+    repo.write("naome.arch.yaml", "layers:\n  application:\n    paths:\n      - \"src/**\"\n  domain:\n    paths:\n      - \"src/domain/**\"\nallowed_dependencies:\n  application:\n    - domain\n  domain:\nrules:\n  no_forbidden_layer_dependencies:\n    enabled: true\n    severity: error\n");
+    repo.write("src/domain/event.ts", "import { type } from './types';\n");
+    repo.write("src/domain/types.ts", "export const type = 1;\n");
+    let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+    assert_eq!(report.status, "pass");
+}
+
+#[test]
+fn late_review_import_forms_keep_forbidden_layer_edges_visible() {
+    let repo = FixtureRepo::new();
+    repo.write("naome.arch.yaml", FORBIDDEN_DOMAIN_TO_INFRASTRUCTURE_CONFIG);
+    repo.write("src/domain/grouped.rs", "use crate::{domain::types, infrastructure::db};\n");
+    repo.write("src/domain/types.rs", "pub struct Event;\n");
+    repo.write("src/infrastructure/db.rs", "pub fn connect() {}\n");
+    repo.write("src/domain/visible.rs", "pub(crate) use crate::infrastructure::db as database;\n");
+    repo.write("src/domain/nested.rs", "use crate::{domain::types, infrastructure::{db, cache}};\n");
+    repo.write("src/infrastructure/cache.rs", "pub fn cache() {}\n");
+    repo.write("src/domain/parenthesized.py", "from src.infrastructure import (\n    client,\n)\n");
+    repo.write("src/infrastructure/client.py", "db = object()\n");
+    repo.write("src/domain/dynamic.ts", "const db = await import(\n  '../infrastructure/db_client'\n);\n");
+    repo.write("src/infrastructure/db_client.ts", "export const db = 1;\n");
+    repo.write("src/domain/export_literal.ts", "export const fixture = '../infrastructure/db_client';\n");
+    repo.write("src/domain/commented.ts", "// await import('../infrastructure/db_client')\n");
+    repo.write("go.mod", "module github.com/acme/app\n");
+    repo.write("src/domain/commented.go", "package domain\nimport (\n  // \"github.com/acme/app/src/infrastructure/dbgo\"\n)\n");
+    repo.write("src/infrastructure/dbgo/dbgo.go", "package dbgo\n");
+
+    let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+    let violation_paths = report
+        .violations
+        .iter()
+        .map(|violation| violation.path.as_deref().unwrap_or(""))
+        .collect::<Vec<_>>();
+
+    assert!(violation_paths.contains(&"src/domain/grouped.rs"));
+    assert!(violation_paths.contains(&"src/domain/visible.rs"));
+    assert!(violation_paths.contains(&"src/domain/nested.rs"));
+    assert!(violation_paths.contains(&"src/domain/parenthesized.py"));
+    assert!(violation_paths.contains(&"src/domain/dynamic.ts"));
+    assert!(!violation_paths.contains(&"src/domain/export_literal.ts"));
+    assert!(!violation_paths.contains(&"src/domain/commented.ts"));
+    assert!(!violation_paths.contains(&"src/domain/commented.go"));
+}
+
+#[test]
+fn unresolved_relative_imports_are_represented_explicitly() {
+    let repo = FixtureRepo::new();
+    repo.write("src/app.ts", "import missing from './missing';\n");
+
+    let scan = scan_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+
+    assert!(scan
+        .graph
+        .nodes
+        .iter()
+        .any(|node| node.id == "unknown-import:./missing"));
+    assert!(scan.graph.edges.iter().any(|edge| {
+        edge.kind == ArchitectureEdgeKind::Imports
+            && edge.from == "file:src/app.ts"
+            && edge.to == "unknown-import:./missing"
+    }));
+}
+
+#[test]
+fn validates_forbidden_layer_dependency_from_import_edges() {
+    let repo = FixtureRepo::new();
+    repo.write("naome.arch.yaml", FORBIDDEN_DOMAIN_TO_INFRASTRUCTURE_CONFIG);
+    repo.write(
+        "src/domain/event.ts",
+        "import { db } from '../infrastructure/db';\n",
+    );
+    repo.write("src/infrastructure/db.ts", "export const db = 1;\n");
+
+    let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+
+    assert_eq!(report.status, "fail");
+    let violation = report
+        .violations
+        .iter()
+        .find(|violation| violation.id == "arch.no_forbidden_layer_dependencies")
+        .expect("expected forbidden layer dependency violation");
+    assert_eq!(violation.path.as_deref(), Some("src/domain/event.ts"));
+    assert_eq!(violation.source_range.as_ref().unwrap().start_line, 1);
+    assert!(violation
+        .agent_instruction
+        .contains("Do not import infrastructure from domain"));
+}
+
+#[test]
+fn exact_entrypoint_layer_paths_keep_bootstrap_out_of_cli_layer() {
+    let repo = FixtureRepo::new();
+    repo.write(
+        "naome.arch.yaml",
+        r#"
+layers:
+  cli:
+    paths:
+      - "packages/naome/bin/naome.js"
+  installer:
+    paths:
+      - "packages/naome/bin/naome-node.js"
+      - "packages/naome/installer/**"
+allowed_dependencies:
+  cli:
+  installer:
+rules:
+  no_forbidden_layer_dependencies:
+    enabled: true
+    severity: error
+"#,
+    );
+    repo.write(
+        "packages/naome/bin/naome.js",
+        "console.log('native wrapper');\n",
+    );
+    repo.write(
+        "packages/naome/bin/naome-node.js",
+        "import { runNaomeNodeCli } from '../installer/main.js';\nawait runNaomeNodeCli();\n",
+    );
+    repo.write(
+        "packages/naome/installer/main.js",
+        "export async function runNaomeNodeCli() {}\n",
+    );
+
+    let report = validate_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+    let scan = scan_architecture(repo.path(), ArchitectureScanOptions::default()).unwrap();
+
+    assert_eq!(report.status, "pass");
+    assert_eq!(
+        scan.file_facts
+            .get("packages/naome/bin/naome-node.js")
+            .unwrap()
+            .layers,
+        vec!["installer"]
+    );
+}
+
 #[test]
 fn validates_file_size_budget_with_stable_json_shape() {
     let repo = FixtureRepo::new();
@@ -207,3 +540,9 @@ fn run_git(root: &Path, args: &[&str]) {
         String::from_utf8_lossy(&result.stderr)
     );
 }
+
+fn has_import_edge(scan: &naome_core::ArchitectureScanReport, from: &str, to: &str) -> bool {
+    scan.graph.edges.iter().any(|edge| {
+        edge.kind == ArchitectureEdgeKind::Imports && edge.from == from && edge.to == to
+    })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.3.10",
+  "version": "1.3.11",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "Apache-2.0",
   "type": "module",

package/templates/naome-root/.naome/manifest.json

@@ -1,5 +1,5 @@
 {
-  "harnessVersion": "1.3.10",
+  "harnessVersion": "1.3.11",
   "installedAt": null,
   "integrity": {
     ".naome/bin/check-harness-health.js": "sha256:802d7419774981a6af1826b3882270ff8f41259d516f98c52a02b4ddc184c467",
@@ -9,7 +9,7 @@
     ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
     "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",
     "docs/naome/agent-workflow.md": "sha256:0be1c29adfbcd3fd73c4f904080ffc67237692fe413871a30243538c4db38ac7",
-    "docs/naome/architecture-fitness.md": "sha256:ec2cff9f2090d9b6bfeb2464a650cff97790c4d3e626fd40a42374d5f79c7c38",
+    "docs/naome/architecture-fitness.md": "sha256:a1f08dc02eff4e4c37934cf48e3d7ed2453e34d55dac475bc24ab913e03f263d",
     "docs/naome/context-economy.md": "sha256:3ed5075815ecf4ada46a5e65438769310307c35759fcd46b13dc0b96e02bebd9",
     "docs/naome/execution.md": "sha256:bfc5d55838942ec8e3d790b59e3c634ff5bf6a2298265cef3dca9788a097eafb",
     "docs/naome/first-run.md": "sha256:1466ce8c65e19a1514885f917db14e8a772350e3f6d1c03a66326963365919e1",

package/templates/naome-root/docs/naome/architecture-fitness.md

@@ -50,6 +50,9 @@ contexts:
       - "src/billing/index.ts"
 
 rules:
+  no_forbidden_layer_dependencies:
+    enabled: true
+    severity: error
   max_file_lines:
     enabled: true
     value: 400
@@ -58,6 +61,11 @@ rules:
     enabled: true
     severity: error
 
+allowed_dependencies:
+  domain:
+  infrastructure:
+    - domain
+
 ignore:
   - path: "generated/**"
     reason: "Generated code is not architecture-owned."
@@ -69,6 +77,8 @@ ignore:
 - `arch.generated_manual_boundary` prevents changed files under explicitly
   ignored generated paths from being accepted without regeneration or a config
   change.
+- `arch.no_forbidden_layer_dependencies` rejects import edges whose source
+  layer is not allowed to depend on the imported file's layer.
 
 ## Agent Integration
 
@@ -85,13 +95,15 @@ fails only on configured error rules.
 
 ## Language Support
 
-The v1.3.10 foundation classifies TypeScript, JavaScript, Rust, Python, Go,
-Java, Kotlin, and Swift files by path extension. Import extractors, resolver
-rules, cycle detection, layer dependency rules, and manifest extraction are
-planned follow-up slices before v1.4.0.
+The v1.3.11 foundation classifies TypeScript, JavaScript, Rust, Python, Go,
+Java, Kotlin, and Swift files by path extension. It extracts import facts for
+TypeScript, JavaScript, Rust, Python, and Go, resolves relative imports and
+simple repository-absolute aliases, and represents unresolved imports
+explicitly as graph nodes instead of dropping them.
 
 ## Limitations
 
-This release intentionally starts with path extraction, graph construction,
-file budgets, generated/manual boundaries, JSON output, human output, and CLI
-integration. It does not yet resolve imports or validate cross-layer imports.
+This release intentionally validates direct file-level import edges. Manifest
+extractors, cross-context public API boundaries, cycle detection, transitive
+forbidden dependencies, SARIF output, and persistent scan caching remain planned
+follow-up slices before v1.4.0.