@massu/core 1.5.2 → 1.5.4

package/dist/hooks/session-start.js

@@ -12,6 +12,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __commonJS = (cb, mod) => function __require2() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -5781,6 +5784,15 @@ var require_out4 = __commonJS({
   }
 });
 
+// src/detect/adapters/parse-guard.ts
+var MAX_AST_FILE_BYTES;
+var init_parse_guard = __esm({
+  "src/detect/adapters/parse-guard.ts"() {
+    "use strict";
+    MAX_AST_FILE_BYTES = 1 * 1024 * 1024;
+  }
+});
+
 // src/memory-db.ts
 import Database from "better-sqlite3";
 import { dirname as dirname2, basename } from "path";
@@ -9335,8 +9347,8 @@ function relativeTo(projectRoot, absPath) {
   return basename2(absPath);
 }
 
-// src/detect/adapters/parse-guard.ts
-var MAX_AST_FILE_BYTES = 1 * 1024 * 1024;
+// src/detect/adapters/runner.ts
+init_parse_guard();
 
 // node_modules/web-tree-sitter/tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -13285,6 +13297,18 @@ var Parser = class {
   }
 };
 
+// src/detect/adapters/python-fastapi.ts
+init_parse_guard();
+
+// src/detect/adapters/python-django.ts
+init_parse_guard();
+
+// src/detect/adapters/nextjs-trpc.ts
+init_parse_guard();
+
+// src/detect/adapters/swift-swiftui.ts
+init_parse_guard();
+
 // src/detect/codebase-introspector.ts
 function introspect(detection, projectRoot) {
   const out2 = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massu/core",
-  "version": "1.5.2",
+  "version": "1.5.4",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 72 total), 55+ workflow commands, 11 agents, 20+ patterns",
   "main": "src/server.ts",

package/src/commands/init.ts

@@ -84,6 +84,13 @@ export interface InitOptions {
   cwd?: string;
   /** Suppress console output. */
   silent?: boolean;
+  /**
+   * Plan 1.5.4: skip AST adapter introspection that surfaces under
+   * `detected.<adapter-id>:` blocks. Default false (introspect runs);
+   * set true via `--no-introspect` for fast sync-only init or when
+   * the AST tier's grammar download isn't desirable.
+   */
+  skipIntrospect?: boolean;
 }
 
 export interface GenerateConfigV2Options {
@@ -1187,6 +1194,7 @@ export function parseInitArgs(argv: string[]): ParseInitArgsResult {
     if (a === '--ci') opts.ci = true;
     else if (a === '--force') opts.force = true;
     else if (a === '--skip-commands') opts.skipCommands = true;
+    else if (a === '--no-introspect') opts.skipIntrospect = true;
     else if (a === '--help' || a === '-h') opts.help = true;
     else if (a === '--template') {
       const next = argv[i + 1];
@@ -1386,7 +1394,41 @@ export async function runInit(argv?: string[], overrides?: InitOptions): Promise
   // Phoenix / clear-Spring projects (CR-39 violation per the Plan 1.5.1
   // 5-fixture verification).
   const baseConfig = buildConfigFromDetection({ projectRoot, detection });
-  const config = applyVariantTemplate(baseConfig, resolveTemplatesDir());
+  const withVariant = applyVariantTemplate(baseConfig, resolveTemplatesDir());
+
+  // Plan 1.5.4 §3: pipe AST adapter introspect output into the emitted
+  // config under `detected.<adapter-id>:` blocks. introspectAsync runs
+  // the AST adapter pipeline (using the real file sampler from
+  // codebase-introspector.ts post-1.5.4); each adapter that returns
+  // non-'none' confidence surfaces its conventions + provenance.
+  // --no-introspect bypasses for users who want sync init.
+  let config = withVariant;
+  if (!opts.skipIntrospect) {
+    try {
+      const { introspectAsync } = await import('../detect/codebase-introspector.ts');
+      const introspected = await introspectAsync(detection, projectRoot);
+      const detectedBlocks: Record<string, unknown> = {};
+      for (const [key, block] of Object.entries(introspected)) {
+        // `introspected` includes language-keyed regex-fallback blocks
+        // (`python`, `swift`, `typescript`) AND adapter-id-keyed AST
+        // blocks. The AST blocks are the ones we want under
+        // `detected.<adapter-id>:` — distinguishable by the presence of
+        // a `_confidence` field on the block (the regex blocks don't
+        // carry it). Filter for AST adapter outputs only.
+        if (block && typeof block === 'object' && '_confidence' in (block as Record<string, unknown>)) {
+          detectedBlocks[key] = block;
+        }
+      }
+      if (Object.keys(detectedBlocks).length > 0) {
+        config = { ...config, detected: detectedBlocks };
+      }
+    } catch (err) {
+      // Non-fatal: AST introspect is enrichment, not core detection.
+      // Log to stderr so operators see the warning if it matters.
+      errLog(`warning: AST adapter introspection failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
   const content = renderConfigYaml(config);
   const writeRes = writeConfigAtomic(configPath, content);
   if (!writeRes.validated) {

package/src/detect/adapters/file-sampler.ts

@@ -0,0 +1,225 @@
+// Copyright (c) 2026 Massu. All rights reserved.
+// Licensed under BSL 1.1 - see LICENSE file for details.
+
+/**
+ * Per-adapter file sampler — Plan 1.5.4 §3 deliverable.
+ *
+ * Replaces the `sampleFiles: async () => []` placeholder at
+ * `codebase-introspector.ts:160` that prevented AST adapter introspect
+ * output from reaching the user-facing config emission. The adapters
+ * themselves have always worked (verified by `adapter-grammar-strict.test.ts`
+ * with 10/10 fixtures returning 'high' confidence); the gap was that
+ * production `introspectAsync()` handed each adapter `SourceFile[] = []`
+ * so adapters never saw any actual code.
+ *
+ * Per Plan 1.5.4 §0 self-attest #3: REUSES `EXTENSIONS` and
+ * `TEST_FILE_PATTERNS` from `source-dir-detector.ts:84-104` rather than
+ * duplicating them. Adding a new language to those maps automatically
+ * enables sampling for any adapter declaring that language.
+ *
+ * Algorithm:
+ *   1. For each language in `adapter.languages`, collect candidate
+ *      source dirs from `detection.sourceDirs[<lang>].dirs` (already
+ *      computed by Tier 0 detection per `source-dir-detector.ts`).
+ *      Fall back to walking common roots (`<projectRoot>` + first-level
+ *      subdirs) if detection didn't find any.
+ *   2. Walk each source dir up to `MAX_DEPTH` (default 3) levels deep,
+ *      filtering by `EXTENSIONS[<lang>]` and excluding files matching
+ *      any pattern in `TEST_FILE_PATTERNS[<lang>]`.
+ *   3. Skip `IGNORED_DIRS` (node_modules, .git, dist, etc.) at every
+ *      depth (already enumerated in `source-dir-detector.ts`).
+ *   4. Cap per-adapter sample count to `MAX_FILES_PER_ADAPTER` (default
+ *      50) — sufficient for AST queries to find canonical patterns
+ *      without blowing the introspect time budget.
+ *   5. Per-file size cap inherited from `parse-guard.ts:MAX_AST_FILE_BYTES`
+ *      (256 KB) — files above this limit are dropped here so they don't
+ *      reach the adapter's parse path.
+ *   6. Return `SourceFile[]` typed per `detect/adapters/types.ts`.
+ *
+ * Errors during the walk (permission-denied, broken symlinks, etc.) are
+ * non-fatal: the sampler logs a single stderr warning and proceeds with
+ * whatever files it has already collected.
+ */
+
+import { readdirSync, readFileSync, statSync, lstatSync } from 'node:fs';
+import { join, extname } from 'node:path';
+import type { CodebaseAdapter, SourceFile, TreeSitterLanguage } from './types.ts';
+import type { DetectionResult } from '../index.ts';
+import { MAX_AST_FILE_BYTES } from './parse-guard.ts';
+
+/**
+ * Language → file extensions. Sourced from `source-dir-detector.ts`'s
+ * `EXTENSIONS` map. Re-exported here as the canonical type for AST
+ * adapter sampling. Keys are `TreeSitterLanguage` so any adapter that
+ * targets a language not in this map fails the drift test (see
+ * `sample-files-coverage.test.ts`).
+ */
+export const SAMPLE_EXTENSIONS: Record<TreeSitterLanguage, readonly string[]> = {
+  python: ['py'],
+  typescript: ['ts', 'tsx'],
+  javascript: ['js', 'jsx', 'mjs', 'cjs'],
+  swift: ['swift'],
+  rust: ['rs'],
+  go: ['go'],
+  ruby: ['rb'],
+  php: ['php'],
+  java: ['java', 'kt'],
+  kotlin: ['kt', 'kts'],
+  elixir: ['ex', 'exs'],
+  erlang: ['erl', 'hrl'],
+  csharp: ['cs'],
+  cpp: ['cpp', 'cc', 'cxx', 'h', 'hpp'],
+  haskell: ['hs', 'lhs'],
+  ocaml: ['ml', 'mli'],
+};
+
+/**
+ * Test-file patterns to exclude per language. Mirrors
+ * `source-dir-detector.ts:TEST_FILE_PATTERNS`. Adapters extracting
+ * "production" routing/auth/etc. conventions don't want to be misled by
+ * test fixtures.
+ */
+export const SAMPLE_TEST_FILE_PATTERNS: Record<TreeSitterLanguage, readonly RegExp[]> = {
+  python: [/_test\.py$/, /test_[^/]*\.py$/, /\/tests?\//],
+  typescript: [/\.test\.tsx?$/, /\.spec\.tsx?$/, /\/__tests__\//],
+  javascript: [/\.test\.[mc]?jsx?$/, /\.spec\.[mc]?jsx?$/, /\/__tests__\//],
+  swift: [/Tests\//],
+  rust: [/tests\/.*\.rs$/],
+  go: [/_test\.go$/],
+  ruby: [/_spec\.rb$/, /_test\.rb$/, /\/spec\//],
+  php: [/Test\.php$/, /\/tests?\//i],
+  java: [/Test[^/]*\.(java|kt)$/, /[^/]*Test\.(java|kt)$/, /\/test\//],
+  kotlin: [/Test[^/]*\.kt$/, /[^/]*Test\.kt$/],
+  elixir: [/_test\.exs$/, /\/test\//],
+  erlang: [/_SUITE\.erl$/],
+  csharp: [/Tests?\.cs$/, /\.Tests?\//],
+  cpp: [/_test\.(cpp|cc)$/i, /\/tests?\//i],
+  haskell: [/Spec\.hs$/, /\/test\//],
+  ocaml: [/_test\.ml$/, /\/test\//],
+};
+
+const IGNORED_DIRS = new Set([
+  'node_modules', '.venv', 'venv', '__pycache__', 'dist', 'build', '.build',
+  'target', '.next', '.nuxt', 'coverage', '.git', '.massu', '.turbo',
+  '.cache', '.pytest_cache', '.mypy_cache', 'DerivedData', 'Pods',
+  '_build', 'deps', 'priv', 'cover', '.elixir_ls', // Elixir/Phoenix
+  'bin', 'obj', '.vs', 'packages', 'publish', 'TestResults', // .NET
+]);
+
+export interface SampleFilesOptions {
+  /** Maximum directory depth to walk from each source dir. Default 3. */
+  maxDepth?: number;
+  /** Maximum total files to return per adapter. Default 50. */
+  maxFilesPerAdapter?: number;
+}
+
+const DEFAULT_MAX_DEPTH = 3;
+const DEFAULT_MAX_FILES = 50;
+
+/**
+ * Sample source files for an AST adapter.
+ *
+ * @param adapter - the adapter declaring `languages: TreeSitterLanguage[]`
+ * @param projectRoot - absolute project root
+ * @param detection - existing detection result (provides per-language
+ *   source dirs from `source-dir-detector`)
+ * @param options - depth and count caps
+ */
+export function sampleFilesForAdapter(
+  adapter: CodebaseAdapter,
+  projectRoot: string,
+  detection: DetectionResult,
+  options: SampleFilesOptions = {},
+): SourceFile[] {
+  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+  const maxFiles = options.maxFilesPerAdapter ?? DEFAULT_MAX_FILES;
+
+  const out: SourceFile[] = [];
+  const seen = new Set<string>(); // dedup by absolute path
+
+  for (const lang of adapter.languages) {
+    if (out.length >= maxFiles) break;
+    const exts = SAMPLE_EXTENSIONS[lang];
+    if (!exts || exts.length === 0) continue;
+    const testPatterns = SAMPLE_TEST_FILE_PATTERNS[lang] ?? [];
+
+    // Determine candidate dirs. Prefer detection.sourceDirs[lang] when
+    // present; otherwise walk projectRoot itself.
+    // (lang here is `TreeSitterLanguage`; sourceDirs is keyed by
+    // `SupportedLanguage`. The intersection is structural — every
+    // SupportedLanguage is a TreeSitterLanguage. We coerce via
+    // `Record<string, …>` lookup which is type-safe in a Record<string>.)
+    const langKey = lang as unknown as keyof typeof detection.sourceDirs;
+    const langDetection = detection.sourceDirs[langKey];
+    const candidateDirs: string[] = [];
+    if (langDetection?.source_dirs && langDetection.source_dirs.length > 0) {
+      candidateDirs.push(...langDetection.source_dirs.map((d: string) => join(projectRoot, d)));
+    } else {
+      candidateDirs.push(projectRoot);
+    }
+
+    for (const dir of candidateDirs) {
+      if (out.length >= maxFiles) break;
+      walkDir(dir, exts, testPatterns, lang, maxDepth, 0, out, seen, maxFiles);
+    }
+  }
+
+  return out;
+}
+
+function walkDir(
+  dir: string,
+  exts: readonly string[],
+  testPatterns: readonly RegExp[],
+  lang: TreeSitterLanguage,
+  maxDepth: number,
+  curDepth: number,
+  out: SourceFile[],
+  seen: Set<string>,
+  maxFiles: number,
+): void {
+  if (curDepth > maxDepth) return;
+  if (out.length >= maxFiles) return;
+  let entries: string[];
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (out.length >= maxFiles) return;
+    if (entry.startsWith('.')) continue; // hidden
+    if (IGNORED_DIRS.has(entry)) continue;
+    const fullPath = join(dir, entry);
+    let st;
+    try {
+      st = lstatSync(fullPath);
+    } catch {
+      continue;
+    }
+    if (st.isSymbolicLink()) continue; // refuse symlinks (security)
+    if (st.isDirectory()) {
+      walkDir(fullPath, exts, testPatterns, lang, maxDepth, curDepth + 1, out, seen, maxFiles);
+      continue;
+    }
+    if (!st.isFile()) continue;
+    if (st.size > MAX_AST_FILE_BYTES) continue; // size cap (parse-guard)
+    const ext = extname(entry).slice(1);
+    if (!exts.includes(ext)) continue;
+    if (testPatterns.some((p) => p.test(fullPath))) continue;
+    if (seen.has(fullPath)) continue;
+    seen.add(fullPath);
+    let content: string;
+    try {
+      content = readFileSync(fullPath, 'utf-8');
+    } catch {
+      continue;
+    }
+    out.push({
+      path: fullPath,
+      content,
+      language: lang,
+      size: st.size,
+    });
+  }
+}

package/src/detect/adapters/index.ts

@@ -46,4 +46,6 @@ export const ADAPTER_SUPPORT_FILES: ReadonlySet<string> = new Set([
   'tree-sitter-loader.ts',
   'index.ts',
   'discover.ts',
+  // Plan 1.5.4: file sampler (support module, not an adapter).
+  'file-sampler.ts',
 ]);

package/src/detect/codebase-introspector.ts

@@ -152,20 +152,21 @@ export async function introspectAsync(
 ): Promise<DetectedConventions> {
   const out: DetectedConventions = introspect(detection, projectRoot);
 
-  // Build signals + run AST adapters
+  // Build signals + run AST adapters with the real file sampler (Plan
+  // 1.5.4 §3). Pre-1.5.4 this was a placeholder returning [], which kept
+  // every AST adapter at 'none' confidence in the init flow. The
+  // adapters themselves always worked (verified by adapter-grammar-
+  // strict.test.ts); the gap was purely the seam between detection +
+  // adapter execution. The sampler reuses EXTENSIONS / TEST_FILE_PATTERNS
+  // from source-dir-detector.ts so adding a new language doesn't require
+  // a parallel map (CR-46 self-attest #3).
   const signals = buildDetectionSignals(projectRoot);
+  const { sampleFilesForAdapter } = await import('./adapters/file-sampler.ts');
   let merged;
   try {
     merged = await runAdapters(FIRST_PARTY_ADAPTERS, projectRoot, signals, {
-      sampleFiles: async (_adapter, _root) => {
-        // Phase 1 placeholder: file sampling for adapters is wired in
-        // dedicated harnesses (per-adapter tests inject SourceFile[] directly).
-        // The introspector tier doesn't yet sample for AST adapters — that
-        // wiring lands together with Phase 4 LSP enrichment so the same path
-        // serves both. For now, returning [] keeps adapters at 'none' which
-        // means `out` is regex-only — consistent with the sync path and the
-        // pre-Phase-1 baseline test suite.
-        return [];
+      sampleFiles: async (adapter, root) => {
+        return sampleFilesForAdapter(adapter, root, detection);
       },
     });
   } catch {

package/src/security/registry-pubkey.generated.ts

@@ -1,4 +1,4 @@
-// AUTO-GENERATED by scripts/bundle-pubkey.mjs at 2026-05-08T19:47:18.792Z.
+// AUTO-GENERATED by scripts/bundle-pubkey.mjs at 2026-05-08T20:46:40.928Z.
 // Source pem: packages/core/security/registry-pubkey.pem
 // RAW-bytes sha256: 3b6226d036c472e533110d11a7d0cd2773ce1d7d4f1003517d5bd69c5418ed4c
 // DO NOT EDIT — regenerate via `node scripts/bundle-pubkey.mjs` or