@mrciphersmith/keryx 0.2.9

package/dist/proxy-worker.js

@@ -0,0 +1,381 @@
+// @bun
+// src/harness/process/sandbox/proxy-worker.ts
+import { parentPort, workerData } from "worker_threads";
+
+// src/harness/process/sandbox/proxy.ts
+import http from "http";
+import https from "https";
+import net from "net";
+function normalizeHost(host) {
+  return host.toLowerCase().replace(/\.$/, "");
+}
+function matchesAllowlist(host, allowed) {
+  const h = normalizeHost(host);
+  if (h.length === 0) {
+    return false;
+  }
+  for (const pattern of allowed) {
+    const p = normalizeHost(pattern);
+    if (p.startsWith("*.")) {
+      const base = p.slice(2);
+      if (base.length > 0 && (h === base || h.endsWith(`.${base}`))) {
+        return true;
+      }
+    } else if (h === p) {
+      return true;
+    }
+  }
+  return false;
+}
+function substituteValue(value, masks) {
+  if (value === undefined)
+    return;
+  const one = (s) => {
+    let out = s;
+    for (const m of masks)
+      out = out.split(m.sentinel).join(m.realValue);
+    return out;
+  };
+  return Array.isArray(value) ? value.map(one) : one(value);
+}
+function applyMasks(headers, masks, hostname) {
+  const applicable = masks.filter((m) => matchesAllowlist(hostname, m.injectHosts));
+  if (applicable.length === 0)
+    return headers;
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = substituteValue(value, applicable);
+  }
+  return out;
+}
+function httpTarget(req) {
+  const raw = req.url ?? "";
+  try {
+    if (/^https?:\/\//i.test(raw)) {
+      const u = new URL(raw);
+      return { hostname: u.hostname, port: u.port ? Number(u.port) : 80 };
+    }
+  } catch {}
+  const hostHeader = req.headers.host;
+  if (hostHeader) {
+    const [hostname, port] = hostHeader.split(":");
+    if (hostname)
+      return { hostname, port: port ? Number(port) : 80 };
+  }
+  return;
+}
+async function createAllowlistProxy(opts) {
+  const host = opts.host ?? "127.0.0.1";
+  const allowed = opts.allowedDomains;
+  const decide = (d) => {
+    opts.onDecision?.(d);
+    return d.allowed;
+  };
+  const server = http.createServer((req, res) => {
+    const target = httpTarget(req);
+    const hostname = target?.hostname ?? "";
+    if (!target || !decide({ host: hostname, allowed: matchesAllowlist(hostname, allowed), kind: "http" })) {
+      res.writeHead(403, { "content-type": "text/plain" });
+      res.end("blocked by keryx sandbox network allowlist");
+      return;
+    }
+    const headers = applyMasks(req.headers, opts.masks ?? [], target.hostname);
+    const upstream = http.request({ host: target.hostname, port: target.port, method: req.method, path: pathFromUrl(req.url), headers }, (up) => {
+      res.writeHead(up.statusCode ?? 502, up.headers);
+      up.pipe(res);
+    });
+    upstream.on("error", () => {
+      if (!res.headersSent)
+        res.writeHead(502);
+      res.end("upstream error");
+    });
+    req.pipe(upstream);
+  });
+  const makeMitmHandler = (pinnedHost, pinnedPort) => (req, res) => {
+    const hostHeader = req.headers.host ?? "";
+    const [rawHost, rawPort] = hostHeader.split(":");
+    const hostname = rawHost ?? "";
+    const upstreamPort = rawPort ? Number(rawPort) : pinnedPort;
+    const permitted = matchesAllowlist(hostname, allowed) && normalizeHost(hostname) === pinnedHost && upstreamPort === pinnedPort;
+    if (!decide({ host: hostname, allowed: permitted, kind: "http" })) {
+      res.writeHead(403, { "content-type": "text/plain" });
+      res.end("blocked by keryx sandbox network allowlist");
+      return;
+    }
+    const headers = applyMasks(req.headers, opts.masks ?? [], hostname);
+    const upstreamReq = https.request({
+      host: hostname,
+      port: upstreamPort,
+      method: req.method,
+      path: req.url ?? "/",
+      headers,
+      servername: hostname,
+      ...opts.upstreamCa !== undefined ? { ca: opts.upstreamCa } : {}
+    }, (up) => {
+      res.writeHead(up.statusCode ?? 502, up.headers);
+      up.pipe(res);
+    });
+    upstreamReq.on("error", () => {
+      if (!res.headersSent)
+        res.writeHead(502);
+      res.end("upstream error");
+    });
+    req.pipe(upstreamReq);
+  };
+  const mitmServers = new Map;
+  const mitmPortFor = async (hostname, targetPort, ca) => {
+    const host2 = normalizeHost(hostname);
+    const key = `${host2}:${targetPort}`;
+    const hit = mitmServers.get(key);
+    if (hit)
+      return hit.port;
+    const leaf = await ca.issueLeaf(host2);
+    const server2 = https.createServer({ key: leaf.keyPem, cert: leaf.certPem }, makeMitmHandler(host2, targetPort));
+    await new Promise((resolve) => server2.listen(0, "127.0.0.1", () => resolve()));
+    const addr2 = server2.address();
+    const port2 = addr2 && typeof addr2 === "object" ? addr2.port : 0;
+    mitmServers.set(key, { server: server2, port: port2 });
+    return port2;
+  };
+  server.on("connect", (req, clientSocket, head) => {
+    const [reqHost, reqPort] = (req.url ?? "").split(":");
+    const hostname = reqHost ?? "";
+    const port2 = Number(reqPort) || 443;
+    if (!decide({ host: hostname, allowed: matchesAllowlist(hostname, allowed), kind: "connect" })) {
+      clientSocket.write(`HTTP/1.1 403 Forbidden\r
+\r
+`);
+      clientSocket.end();
+      return;
+    }
+    const ca = opts.tlsTerminate;
+    if (ca) {
+      (async () => {
+        try {
+          const terminatorPort = await mitmPortFor(hostname, port2, ca);
+          clientSocket.write(`HTTP/1.1 200 Connection Established\r
+\r
+`);
+          const internal = net.connect(terminatorPort, "127.0.0.1", () => {
+            if (head && head.length > 0)
+              internal.write(head);
+            clientSocket.pipe(internal);
+            internal.pipe(clientSocket);
+          });
+          internal.on("error", () => clientSocket.destroy());
+          clientSocket.on("error", () => internal.destroy());
+        } catch {
+          clientSocket.write(`HTTP/1.1 502 Bad Gateway\r
+\r
+`);
+          clientSocket.end();
+        }
+      })();
+      return;
+    }
+    const upstream = net.connect(port2, hostname, () => {
+      clientSocket.write(`HTTP/1.1 200 Connection Established\r
+\r
+`);
+      if (head && head.length > 0)
+        upstream.write(head);
+      upstream.pipe(clientSocket);
+      clientSocket.pipe(upstream);
+    });
+    upstream.on("error", () => {
+      clientSocket.write(`HTTP/1.1 502 Bad Gateway\r
+\r
+`);
+      clientSocket.end();
+    });
+    clientSocket.on("error", () => upstream.destroy());
+  });
+  await new Promise((resolve) => server.listen(opts.port ?? 0, host, () => resolve()));
+  const addr = server.address();
+  const port = addr && typeof addr === "object" ? addr.port : 0;
+  return {
+    host,
+    port,
+    close: async () => {
+      await new Promise((resolve) => server.close(() => resolve()));
+      await Promise.all([...mitmServers.values()].map(({ server: s }) => new Promise((resolve) => s.close(() => resolve()))));
+      mitmServers.clear();
+    }
+  };
+}
+function pathFromUrl(url) {
+  const raw = url ?? "/";
+  try {
+    if (/^https?:\/\//i.test(raw)) {
+      const u = new URL(raw);
+      return `${u.pathname}${u.search}`;
+    }
+  } catch {}
+  return raw;
+}
+
+// src/harness/process/sandbox/tls-ca.ts
+import { spawn } from "child_process";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import path from "path";
+function run(bin, args) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let out = "";
+    let err = "";
+    proc.stdout.on("data", (d) => out += d);
+    proc.stderr.on("data", (d) => err += d);
+    proc.on("error", reject);
+    proc.on("close", (code) => code === 0 ? resolve(out) : reject(new Error(`${bin} ${args[0]} failed (exit ${code}): ${err.trim()}`)));
+  });
+}
+var CA_CONFIG = `[req]
+distinguished_name = dn
+x509_extensions = v3_ca
+prompt = no
+
+[dn]
+CN = keryx sandbox run CA
+
+[v3_ca]
+basicConstraints = critical,CA:TRUE,pathlen:0
+keyUsage = critical,keyCertSign,cRLSign
+subjectKeyIdentifier = hash
+`;
+function leafConfig(host) {
+  const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+  const san = isIp ? `IP:${host}` : `DNS:${host}`;
+  return `[req]
+distinguished_name = dn
+req_extensions = v3_req
+prompt = no
+
+[dn]
+CN = ${host}
+
+[v3_req]
+basicConstraints = CA:FALSE
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = ${san}
+`;
+}
+async function createRunCa(options = {}) {
+  const openssl = options.openssl ?? "openssl";
+  const days = String(options.days ?? 1);
+  const root = await mkdtemp(path.join(options.tmpDir ?? tmpdir(), "keryx-ca-"));
+  await mkdir(root, { recursive: true, mode: 448 });
+  const caKey = path.join(root, "ca.key");
+  const caCert = path.join(root, "ca.crt");
+  const caCfg = path.join(root, "ca.cnf");
+  await writeFile(caCfg, CA_CONFIG, { mode: 384 });
+  await run(openssl, [
+    "req",
+    "-x509",
+    "-nodes",
+    "-newkey",
+    "rsa:2048",
+    "-keyout",
+    caKey,
+    "-out",
+    caCert,
+    "-days",
+    days,
+    "-config",
+    caCfg
+  ]);
+  const caCertPem = await readFile(caCert, "utf8");
+  const cache = new Map;
+  return {
+    caCertPem,
+    async issueLeaf(host) {
+      const key = host.toLowerCase();
+      const hit = cache.get(key);
+      if (hit)
+        return hit;
+      const safe = key.replace(/[^a-z0-9.-]/g, "_");
+      const leafKey = path.join(root, `${safe}.key`);
+      const leafCsr = path.join(root, `${safe}.csr`);
+      const leafCrt = path.join(root, `${safe}.crt`);
+      const leafCfg = path.join(root, `${safe}.cnf`);
+      await writeFile(leafCfg, leafConfig(key), { mode: 384 });
+      await run(openssl, [
+        "req",
+        "-new",
+        "-nodes",
+        "-newkey",
+        "rsa:2048",
+        "-keyout",
+        leafKey,
+        "-out",
+        leafCsr,
+        "-config",
+        leafCfg
+      ]);
+      await run(openssl, [
+        "x509",
+        "-req",
+        "-in",
+        leafCsr,
+        "-CA",
+        caCert,
+        "-CAkey",
+        caKey,
+        "-CAcreateserial",
+        "-out",
+        leafCrt,
+        "-days",
+        days,
+        "-extfile",
+        leafCfg,
+        "-extensions",
+        "v3_req"
+      ]);
+      const issued = {
+        certPem: await readFile(leafCrt, "utf8"),
+        keyPem: await readFile(leafKey, "utf8")
+      };
+      cache.set(key, issued);
+      return issued;
+    },
+    async dispose() {
+      cache.clear();
+      await rm(root, { recursive: true, force: true });
+    }
+  };
+}
+
+// src/harness/process/sandbox/proxy-worker.ts
+async function main() {
+  if (!parentPort) {
+    return;
+  }
+  const data = workerData ?? {};
+  let ca;
+  if (data.tlsTerminate === true) {
+    ca = await createRunCa();
+  }
+  const port = parentPort;
+  const proxy = await createAllowlistProxy({
+    allowedDomains: Array.isArray(data.allowedDomains) ? data.allowedDomains : [],
+    ...typeof data.host === "string" ? { host: data.host } : {},
+    ...Array.isArray(data.masks) ? { masks: data.masks } : {},
+    ...ca ? { tlsTerminate: ca } : {},
+    onDecision: (d) => {
+      port.postMessage({ type: "decision", host: d.host, allowed: d.allowed, kind: d.kind });
+    }
+  });
+  parentPort.postMessage({
+    type: "ready",
+    port: proxy.port,
+    host: proxy.host,
+    ...ca ? { caCertPem: ca.caCertPem } : {}
+  });
+  parentPort.on("message", (msg) => {
+    if (msg && msg.type === "close") {
+      proxy.close().then(() => ca ? ca.dispose() : undefined).then(() => process.exit(0));
+    }
+  });
+}
+main();

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@mrciphersmith/keryx",
+  "version": "0.2.9",
+  "description": "CLI-first metaproject workspace for AI agents, code graph, project memory, health reports, testing context, wiki, skills, and task flows.",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/MrCipherSmith/keryx.git"
+  },
+  "keywords": [
+    "ai-agents",
+    "agent-tooling",
+    "code-graph",
+    "project-memory",
+    "developer-tools",
+    "bun",
+    "typescript",
+    "cli",
+    "knowledge-base",
+    "multi-agent"
+  ],
+  "bin": {
+    "keryx": "./dist/cli.js"
+  },
+  "scripts": {
+    "keryx": "bun ./src/cli.ts",
+    "build": "bun build ./src/cli.ts --outdir ./dist --target bun --external @modelcontextprotocol/sdk --external web-tree-sitter --external @opentui/core && bun build ./src/harness/process/sandbox/proxy-worker.ts --outdir ./dist --target bun --external @modelcontextprotocol/sdk --external web-tree-sitter --external @opentui/core",
+    "prepare": "bun run build",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "check": "tsc --noEmit && bun test",
+    "check:doc-links": "bun scripts/check-doc-links.ts",
+    "test:guards": "bun test src/lib/config-dir.ast.test.ts src/lib/config-dir.readers.test.ts src/lib/production-graph.test.ts src/harness/policy/profiles.test.ts src/lib/serve-server.test.ts"
+  },
+  "files": [
+    "dist",
+    "src/gdgraph",
+    "src/gdskills/bundled",
+    "src/gdskills/contracts",
+    "LICENSE",
+    "README.md",
+    "package.json"
+  ],
+  "dependencies": {},
+  "optionalDependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@opentui/core": "^0.4.5",
+    "web-tree-sitter": "^0.22.0"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "bun-types": "latest",
+    "typescript": "^5"
+  },
+  "engines": {
+    "bun": ">=1.1.0"
+  }
+}

package/src/gdgraph/affected.test.ts

@@ -0,0 +1,100 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { expect, test } from "bun:test";
+import { computeAffected } from "./affected";
+import { getAffected } from "./query";
+import type { GraphData } from "./types";
+
+const FIXTURE_DIR = fileURLToPath(new URL("../../fixtures/transitive-closure/", import.meta.url));
+
+async function loadFixtureGraph(): Promise<GraphData> {
+  const raw = JSON.parse(await readFile(path.join(FIXTURE_DIR, "graph.json"), "utf8"));
+  return { nodes: raw.nodes, edges: raw.edges };
+}
+
+async function loadExpected(): Promise<any> {
+  return JSON.parse(await readFile(path.join(FIXTURE_DIR, "expected.json"), "utf8"));
+}
+
+// The pre-block default renderer, replicated verbatim so we can assert the new
+// path is byte-for-byte identical at depth 1 (AC2.2).
+function renderDefault(result: { target: string; dependencies: string[]; dependents: string[] }): string {
+  const lines: string[] = [];
+  lines.push(`# Affected context for ${result.target}`);
+  lines.push("");
+  lines.push("## Dependencies");
+  printList(lines, result.dependencies);
+  lines.push("");
+  lines.push("## Dependents");
+  printList(lines, result.dependents);
+  return lines.join("\n");
+}
+
+function printList(lines: string[], items: string[]): void {
+  if (items.length === 0) {
+    lines.push("- none");
+    return;
+  }
+  for (const item of items) {
+    lines.push(`- ${item}`);
+  }
+}
+
+test("AC2.1 — exact N-hop dependent closure per target per depth", async () => {
+  const graph = await loadFixtureGraph();
+  const expected = await loadExpected();
+
+  for (const [target, byDepth] of Object.entries(expected.closures) as [string, Record<string, string[]>][]) {
+    for (const [depthKey, expectedSet] of Object.entries(byDepth)) {
+      const result = computeAffected(graph, target, { depth: Number(depthKey) });
+      expect(result.dependents).toEqual(expectedSet);
+    }
+  }
+});
+
+test("AC2.3 — cyclic fixture terminates and is deterministic across runs", async () => {
+  const graph = await loadFixtureGraph();
+  const a = computeAffected(graph, "src/x.ts", { depth: 10 });
+  const b = computeAffected(graph, "src/x.ts", { depth: 10 });
+  expect(a.dependents).toEqual(["src/y.ts", "src/z.ts"]);
+  expect(a.dependents).toEqual(b.dependents);
+});
+
+test("AC2.2 — default / --depth 1 renderer is byte-identical to pre-block getAffected", async () => {
+  const graph = await loadFixtureGraph();
+  for (const target of ["src/a.ts", "src/b.ts", "src/e.ts", "src/x.ts"]) {
+    const legacy = getAffected(graph, target);
+    const next = computeAffected(graph, target, { depth: 1 });
+
+    // Underlying data is set-equal (dependents + dependencies).
+    expect(next.dependents).toEqual(legacy.dependents);
+    expect(next.dependencies).toEqual(legacy.dependencies);
+    // Rendered stdout is byte-for-byte identical.
+    expect(renderDefault(next)).toBe(renderDefault(legacy));
+  }
+});
+
+test("AC2.2 — no-flag default depth equals depth 1", async () => {
+  const graph = await loadFixtureGraph();
+  const noFlag = computeAffected(graph, "src/a.ts");
+  const depth1 = computeAffected(graph, "src/a.ts", { depth: 1 });
+  expect(noFlag.dependents).toEqual(depth1.dependents);
+  expect(renderDefault(noFlag)).toBe(renderDefault(depth1));
+});
+
+test("AC2.4 — ranked output ordered hop asc → fanIn desc → path asc", async () => {
+  const graph = await loadFixtureGraph();
+  const expected = await loadExpected();
+  const result = computeAffected(graph, "src/a.ts", { depth: 4, ranked: true });
+  expect(result.ranked).toEqual(expected.ranked["src/a.ts"]["4"]);
+});
+
+test("AC2.4 — dependencies are the unchanged one-hop forward set", async () => {
+  const graph = await loadFixtureGraph();
+  const expected = await loadExpected();
+  for (const [target, deps] of Object.entries(expected.dependencies) as [string, string[]][]) {
+    const result = computeAffected(graph, target, { depth: 3 });
+    expect(result.dependencies).toEqual(deps);
+  }
+});

package/src/gdgraph/affected.ts

@@ -0,0 +1,135 @@
+// Pure N-hop transitive `affected` (specification.md §8.2; T-B3, B2).
+//
+// A BFS over the REVERSE-DEPENDENT relation: an edge `from → to` means `from`
+// depends on `to`, so `to`'s dependents are all the `from`s. Given a target we
+// walk outward hop-by-hop to `depth`, collecting the exact transitive dependent
+// closure. Pure over the in-memory graph — no dep, no network, no I/O (B-3,
+// B-4, AC2.5).
+//
+// **Back-compat invariant (B-3, AC2.2):** at `depth === 1` the `dependents` set
+// equals today's `getAffected().dependents` (edges where `kind !== "unresolved"
+// && to === target`), and `dependencies` is the unchanged one-hop forward set,
+// so the default renderer output is byte-for-byte identical.
+
+import type { GraphData } from "./types";
+import { resolveGraphTarget } from "./target";
+
+export interface RankedDependent {
+  path: string;
+  // BFS distance from the target (1 = direct dependent).
+  hop: number;
+  // Number of inbound (non-unresolved) import edges — the fan-in centrality.
+  fanIn: number;
+}
+
+export interface AffectedResult {
+  target: string;
+  depth: number;
+  dependencies: string[];
+  dependents: string[];
+  // Blast-radius ranking, ordered hop asc → fanIn desc → path asc (AC2.4).
+  ranked: RankedDependent[];
+}
+
+export interface AffectedOptions {
+  depth?: number;
+  ranked?: boolean;
+}
+
+// Compute the transitive dependent closure to `depth`. Cycle-safe via a visited
+// set (AC2.3). Deterministic + sorted across repeated runs.
+export function computeAffected(
+  graph: GraphData,
+  target: string,
+  options: AffectedOptions = {},
+): AffectedResult {
+  const depth = normalizeDepth(options.depth);
+  // Exact-then-suffix, refusing an ambiguous suffix (see ./target.ts).
+  const resolvedTarget = resolveGraphTarget(graph, target);
+
+  // Reverse-dependent adjacency: to → [from, ...] over non-unresolved edges,
+  // matching today's `getAffected` dependent relation exactly at hop 1.
+  const dependentsOf = new Map<string, string[]>();
+  const fanIn = new Map<string, number>();
+  for (const edge of graph.edges) {
+    if (edge.kind === "unresolved") {
+      continue;
+    }
+    const bucket = dependentsOf.get(edge.to);
+    if (bucket) {
+      bucket.push(edge.from);
+    } else {
+      dependentsOf.set(edge.to, [edge.from]);
+    }
+    fanIn.set(edge.to, (fanIn.get(edge.to) ?? 0) + 1);
+  }
+
+  const seen = new Set<string>();
+  const hopOf = new Map<string, number>();
+  let frontier = new Set<string>([resolvedTarget]);
+
+  for (let hop = 1; hop <= depth; hop += 1) {
+    const next = new Set<string>();
+    for (const current of frontier) {
+      for (const dependent of dependentsOf.get(current) ?? []) {
+        if (dependent === resolvedTarget || seen.has(dependent)) {
+          continue;
+        }
+        next.add(dependent);
+      }
+    }
+    if (next.size === 0) {
+      break;
+    }
+    for (const dependent of next) {
+      seen.add(dependent);
+      if (!hopOf.has(dependent)) {
+        hopOf.set(dependent, hop);
+      }
+    }
+    frontier = next;
+  }
+
+  // Plain lexicographic sort (default `Array#sort`) — MUST match today's
+  // `getAffected` ordering exactly so depth-1 stdout stays byte-identical.
+  const dependents = [...seen].sort();
+
+  // One-hop forward set (dependencies) — unchanged from today.
+  const dependencies = graph.edges
+    .filter((edge) => edge.kind !== "unresolved" && edge.from === resolvedTarget)
+    .map((edge) => edge.to)
+    .sort();
+
+  const ranked: RankedDependent[] = options.ranked
+    ? dependents
+        .map((dependentPath) => ({
+          path: dependentPath,
+          hop: hopOf.get(dependentPath) ?? 0,
+          fanIn: fanIn.get(dependentPath) ?? 0,
+        }))
+        .sort(rankOrder)
+    : [];
+
+  return { target: resolvedTarget, depth, dependencies, dependents, ranked };
+}
+
+// Total, deterministic order: hop asc → fanIn desc → path asc (AC2.4).
+function rankOrder(a: RankedDependent, b: RankedDependent): number {
+  if (a.hop !== b.hop) {
+    return a.hop - b.hop;
+  }
+  if (a.fanIn !== b.fanIn) {
+    return b.fanIn - a.fanIn;
+  }
+  return a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
+}
+
+function normalizeDepth(depth: number | undefined): number {
+  if (depth === undefined || !Number.isFinite(depth)) {
+    return 1;
+  }
+  const floored = Math.floor(depth);
+  return floored < 1 ? 1 : floored;
+}
+
+// De-duplicated `dedupeDependents` uniqueness guaranteed by the visited set.