@orangepro/orangepro-mcp 0.1.0

package/dist/local/analyze/frameworks.js

@@ -0,0 +1,115 @@
+import { baseName } from "./classify.js";
+const TEST_FRAMEWORK_DEPS = {
+    ava: { layer: "unit" },
+    vitest: { layer: "unit" },
+    jest: { layer: "unit" },
+    mocha: { layer: "unit" },
+    jasmine: { layer: "unit" },
+    "@playwright/test": { layer: "e2e" },
+    playwright: { layer: "e2e" },
+    cypress: { layer: "e2e" },
+    "@testing-library/react": { layer: "component" },
+    supertest: { layer: "api" },
+    pytest: { layer: "unit" },
+    unittest: { layer: "unit" },
+    rspec: { layer: "unit" },
+    junit: { layer: "unit" }
+};
+const CONFIG_FRAMEWORK_HINTS = [
+    { match: /^vitest\.config\.[tj]s$/, name: "vitest", layer: "unit" },
+    { match: /^jest\.config\.[tj]s$/, name: "jest", layer: "unit" },
+    { match: /^playwright\.config\.[tj]s$/, name: "playwright", layer: "e2e" },
+    { match: /^cypress\.config\.[tj]s$/, name: "cypress", layer: "e2e" },
+    { match: /^pytest\.ini$/, name: "pytest", layer: "unit" },
+    { match: /^tox\.ini$/, name: "tox", layer: "unit" }
+];
+/** Detect a test framework from a config file's base name (no content read needed). */
+export function frameworkFromConfig(relPath) {
+    const base = baseName(relPath);
+    for (const hint of CONFIG_FRAMEWORK_HINTS) {
+        if (hint.match.test(base)) {
+            return { name: hint.name, category: "test", test_layer: hint.layer, evidence_ref: relPath };
+        }
+    }
+    return null;
+}
+/** Parse package.json content for the project package + test frameworks in deps. */
+export function detectFromPackageJson(relPath, content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return { pkg: null, frameworks: [] };
+    }
+    const deps = { ...(parsed.dependencies || {}), ...(parsed.devDependencies || {}) };
+    const depNames = Object.keys(deps).sort();
+    const pkg = {
+        name: parsed.name || "project",
+        ecosystem: "npm",
+        dependencies: depNames.slice(0, 100),
+        evidence_ref: relPath
+    };
+    const frameworks = [];
+    for (const dep of depNames) {
+        const hit = TEST_FRAMEWORK_DEPS[dep];
+        if (hit) {
+            frameworks.push({ name: dep.replace(/^@playwright\/test$/, "playwright"), category: "test", test_layer: hit.layer, evidence_ref: relPath });
+        }
+    }
+    return { pkg, frameworks };
+}
+/** Detect test frameworks from non-npm manifests (pyproject.toml, requirements). */
+export function detectFrameworksFromManifest(relPath, content) {
+    const base = baseName(relPath);
+    const frameworks = [];
+    const lower = content.toLowerCase();
+    const has = (re) => re.test(lower);
+    const isPython = base === "pyproject.toml" || base === "setup.cfg" || base === "tox.ini" || base.startsWith("requirements");
+    if (isPython) {
+        if (has(/\[tool\.pytest/) || has(/\bpytest\b/)) {
+            frameworks.push({ name: "pytest", category: "test", test_layer: "unit", evidence_ref: relPath });
+        }
+        if (has(/\bplaywright\b/)) {
+            frameworks.push({ name: "playwright", category: "test", test_layer: "e2e", evidence_ref: relPath });
+        }
+        if (has(/(^|\s)unittest(\s|$)/m)) {
+            frameworks.push({ name: "unittest", category: "test", test_layer: "unit", evidence_ref: relPath });
+        }
+    }
+    if (base === "pom.xml") {
+        if (has(/\bjunit-jupiter\b/) || has(/\borg\.junit\.jupiter\b/)) {
+            frameworks.push({ name: "junit5", category: "test", test_layer: "unit", evidence_ref: relPath });
+        }
+        else if (has(/<groupid>\s*junit\s*<\/groupid>|<artifactid>\s*junit\s*<\/artifactid>/)) {
+            frameworks.push({ name: "junit4", category: "test", test_layer: "unit", evidence_ref: relPath });
+        }
+    }
+    return frameworks;
+}
+/** Detect ecosystem package manifests other than package.json (name only, cheap). */
+export function detectManifestPackage(relPath, content) {
+    const base = baseName(relPath);
+    if (base === "pyproject.toml") {
+        const name = /name\s*=\s*["']([^"']+)["']/.exec(content)?.[1];
+        return { name: name || "python-project", ecosystem: "pypi", dependencies: [], evidence_ref: relPath };
+    }
+    if (base === "go.mod") {
+        const name = /^module\s+(\S+)/m.exec(content)?.[1];
+        return { name: name || "go-module", ecosystem: "go", dependencies: [], evidence_ref: relPath };
+    }
+    if (base === "cargo.toml") {
+        const name = /name\s*=\s*["']([^"']+)["']/.exec(content)?.[1];
+        return { name: name || "rust-crate", ecosystem: "cargo", dependencies: [], evidence_ref: relPath };
+    }
+    if (base === "requirements.txt") {
+        const deps = content
+            .split(/\r?\n/)
+            .map((l) => l.trim())
+            .filter((l) => l && !l.startsWith("#"))
+            .map((l) => l.split(/[=<>~!\s]/)[0])
+            .slice(0, 100);
+        return { name: "python-requirements", ecosystem: "pypi", dependencies: deps, evidence_ref: relPath };
+    }
+    return null;
+}

package/dist/local/analyze/linkage/conventions.js

@@ -0,0 +1,160 @@
+// Per-language test<->source CONVENTION linkage (PR-2 of multi-language coverage).
+//
+// For non-TS/JS languages the import-graph resolver does not run, so the only
+// test->source signal is a naming/path convention. The previous global
+// basename-stem matcher was both too coarse (Java's `FooTest.java` stem
+// `footest` never matched `Foo.java`) and too loose (any same-stem file in the
+// repo). This module replaces guessing with PREDICT-AND-VERIFY: from a test
+// file we DERIVE the exact source-sibling path its language convention implies,
+// then confirm that file was actually scanned. A wrong derivation simply finds
+// nothing — it can never invent a false link.
+//
+// These are CANDIDATE associations ("this behavior has an associated test"),
+// never structural proof. Callers emit them as `weak` MAY_RELATE_TO edges so
+// they are excluded from the TS/JS structural confirmer. Per the product bar,
+// convention linkage is the "has-a-test" tier and is NEVER blended with the
+// hard-confirmed tier.
+// Languages with a strong, unambiguous test convention. For these, a file that
+// does NOT match the convention is a test-tree helper/shadow, not a behavior
+// test — callers must under-link rather than fall back to the coarse global
+// basename-stem matcher (which resurrects cross-file false links). Keep in sync
+// with the conventionSibling() switch.
+const CONVENTION_LANGUAGES = new Set(["go", "java", "kotlin", "python"]);
+/** True when conventionSibling() authoritatively decides linkage for `language`. */
+export function isConventionLanguage(language) {
+    return CONVENTION_LANGUAGES.has(language);
+}
+const baseOf = (relPath) => relPath.split("/").pop() || relPath;
+const dirOf = (relPath) => {
+    const i = relPath.lastIndexOf("/");
+    return i >= 0 ? relPath.slice(0, i) : "";
+};
+const join = (dir, base) => (dir ? `${dir}/${base}` : base);
+/**
+ * Source sibling implied by the test file's language convention, or null when
+ * no predicted sibling was actually scanned. `codeFiles` is the set of scanned
+ * source-file relPaths (case-preserving, ignore-rules already applied), so an
+ * existence check here respects the analyzed scope.
+ *
+ * Languages without a strong, unambiguous convention (notably TS/JS, handled by
+ * the resolver + co-located stem fallback) return null so the caller's existing
+ * logic stays authoritative.
+ */
+export function conventionSibling(testRel, language, codeFiles) {
+    switch (language) {
+        case "go":
+            return goSibling(testRel, codeFiles);
+        case "java":
+        case "kotlin":
+            return jvmSibling(testRel, codeFiles);
+        case "python":
+            return pythonSibling(testRel, codeFiles);
+        default:
+            return null;
+    }
+}
+// ── Go: `foo_test.go` ↔ `foo.go` in the SAME package directory (language rule). ──
+function goSibling(testRel, codeFiles) {
+    const base = baseOf(testRel);
+    const m = /^(.+)_test\.go$/.exec(base);
+    if (!m)
+        return null;
+    const predicted = join(dirOf(testRel), `${m[1]}.go`);
+    if (predicted === testRel || !codeFiles.has(predicted))
+        return null;
+    return { relPath: predicted, confidence: 0.7, reason: `Go test sibling (${base} ↔ ${m[1]}.go, same package)` };
+}
+// ── JVM (Java/Kotlin): `FooTest`/`FooTests`/`FooIT`/`FooITCase`/`FooTestCase` ──
+//    ↔ `Foo`, in the src/test → src/main mirror or the same directory.
+//    Case is preserved (camelCase suffix), so the strip is unambiguous.
+function jvmSibling(testRel, codeFiles) {
+    const base = baseOf(testRel);
+    const m = /^(.+?)(Tests?|IT|ITCase|TestCase|Spec)\.(java|kt)$/.exec(base);
+    if (!m)
+        return null;
+    const stem = m[1];
+    const ext = m[3];
+    const srcBase = `${stem}.${ext}`;
+    if (srcBase === base)
+        return null;
+    // src/test/<lang>/<pkg>/FooTest.java -> src/main/<lang>/<pkg>/Foo.java
+    const mirrorDir = mirrorTestToMain(dirOf(testRel));
+    if (mirrorDir != null) {
+        const predicted = join(mirrorDir, srcBase);
+        if (predicted !== testRel && codeFiles.has(predicted)) {
+            return { relPath: predicted, confidence: 0.7, reason: `JVM test sibling (${base} ↔ ${srcBase}, src/test→src/main mirror)` };
+        }
+    }
+    // Co-located fallback: some projects keep the test beside the class.
+    const sameDir = join(dirOf(testRel), srcBase);
+    if (sameDir !== testRel && codeFiles.has(sameDir)) {
+        return { relPath: sameDir, confidence: 0.65, reason: `JVM test sibling (${base} ↔ ${srcBase}, same directory)` };
+    }
+    return null;
+}
+/** Replace a `src/test/...` (or `src/integration-test/`, `src/it/`) prefix segment with `src/main/...`. */
+function mirrorTestToMain(dir) {
+    const replaced = dir.replace(/(^|\/)src\/(test|integration-test|it|androidTest)(\/|$)/, "$1src/main$3");
+    return replaced !== dir ? replaced : null;
+}
+// ── Python: `test_x.py` / `x_test.py` ↔ `x.py`. ──
+//   Python test trees vary (same-dir, or `tests/<...mirror...>/test_x.py` under an
+//   unknown package root like `mealie/` or `src/`). We strip the test-root dir
+//   names, then take the LONGEST path-suffix of the remaining test directory that
+//   uniquely identifies a module file of the right basename. The suffix match
+//   absorbs the unknown source-package prefix; "unique" keeps it from guessing.
+const PY_TEST_ROOT = /^(tests?|unit_?tests?|integration_?tests?|functional_?tests?|e2e|it|specs?)$/i;
+function pythonSibling(testRel, codeFiles) {
+    const base = baseOf(testRel);
+    let stem = null;
+    let m = /^test_(.+)\.py$/.exec(base);
+    if (m)
+        stem = m[1];
+    if (!stem) {
+        m = /^(.+)_test\.py$/.exec(base);
+        if (m)
+            stem = m[1];
+    }
+    if (!stem)
+        return null;
+    const srcBase = `${stem}.py`;
+    const dir = dirOf(testRel);
+    // 1. Same directory (tests co-located with modules).
+    const sameDir = join(dir, srcBase);
+    if (sameDir !== testRel && codeFiles.has(sameDir)) {
+        return { relPath: sameDir, confidence: 0.65, reason: `Python test sibling (${base} ↔ ${srcBase}, same package)` };
+    }
+    // 2. Module mirror. Candidate source files sharing the basename:
+    const sameBase = [];
+    for (const f of codeFiles) {
+        if (f !== testRel && baseOf(f) === srcBase)
+            sameBase.push(f);
+    }
+    if (sameBase.length === 0)
+        return null;
+    // Drop test-root dir names, then longest-unique path-suffix match.
+    const meaningful = dir.split("/").filter((s) => s && !PY_TEST_ROOT.test(s));
+    let ambiguous = false;
+    for (let start = 0; start < meaningful.length; start++) {
+        const tail = meaningful.slice(start).join("/"); // e.g. "core/security/providers"
+        const exact = `${tail}/${srcBase}`;
+        const suffix = `/${exact}`;
+        const matches = sameBase.filter((f) => f === exact || f.endsWith(suffix));
+        if (matches.length === 1) {
+            const depth = tail.split("/").length;
+            return { relPath: matches[0], confidence: depth >= 2 ? 0.62 : 0.58, reason: `Python test sibling (${base} ↔ ${srcBase}, module mirror)` };
+        }
+        if (matches.length > 1) {
+            ambiguous = true; // ambiguous at the most specific depth — do not guess
+            break;
+        }
+    }
+    // 3. Flat layout (`tests/test_x.py` → `src/x.py`): the `test_`/`_test` prefix
+    //    explicitly names the module, so a UNIQUE `x.py` anywhere is a confident
+    //    match. Convention-gated (only fires for genuinely named test files), so a
+    //    non-test file like `tests/helpers.py` never reaches here.
+    if (!ambiguous && sameBase.length === 1) {
+        return { relPath: sameBase[0], confidence: 0.5, reason: `Python test sibling (${base} ↔ ${srcBase}, unique module)` };
+    }
+    return null;
+}

package/dist/local/analyze/parseCache.js

@@ -0,0 +1,164 @@
+/**
+ * Phase 5.4.2 — persistent PARSE cache.
+ *
+ * Caches ONLY pure, content-derived parse outputs (`extractSymbolsWithMeta`,
+ * `extractTestNames`) — never a trust decision that depends on graph context
+ * (resolution/confirmation/linkage live elsewhere / are recomputed).
+ *
+ * TRUST BOUNDARY (deliberately narrow — see Codex 5.4.2 round-3): this file is
+ * TRUSTED LOCAL WORKSPACE STATE, the SAME trust level as `.orangepro/graph.json`
+ * (which the kit also reads back and trusts wholesale). A process that can write
+ * `parse-cache.json` can write `graph.json` directly, so defending one and not the
+ * other is incoherent. We therefore do NOT claim tamper-resistance — a substring
+ * "membership" check was tried and removed because it was security theater (a name
+ * mentioned only in a comment passed it without being a real declaration).
+ *
+ * What the cache DOES guarantee:
+ *   - STRICT SCHEMA on load — a malformed/garbage/old-version entry is dropped
+ *     (misses, recomputes, pruned on save). Corruption never crashes or feeds
+ *     off-shape data into the graph.
+ *   - CONTENT-HASH key — a changed file (new hash) misses and re-parses; an
+ *     unchanged file hits; PARSER_VERSION bump invalidates the whole cache.
+ *   - PRUNE on save — only this-run keys persist, so a deleted file's entry
+ *     cannot linger and re-enter a future graph.
+ */
+// Bump whenever extractSymbolsWithMeta / extractTestNames change their output.
+// v2: Java/Python/Go symbol extraction moved from regex to tree-sitter (AST) — the
+// cached regex symbols for those languages must not be served on a warm run.
+// v3: tree-sitter now emits `trivial_accessor` (body-aware boilerplate exclusion).
+// A warm v2 entry lacks it, so a Java getter would stay in the denominator forever.
+// v4: TS/JS now extracts default-export subjects (`const X = …; export default X`,
+// `export default connect(...)(X)`). A warm v3 entry would omit those components.
+// v5: TS/JS now extracts class members (`Class.method` with member_of). A warm v4
+// entry would omit them.
+// v6: class-member extraction skips private/protected/#private members. A warm v5
+// entry would have included those internal methods as behaviors.
+// v7: class-member extraction requires a runtime body — abstract, ambient
+// (`declare class`), and overload signatures no longer count. A warm v6 entry
+// would still carry those declaration-only members.
+// v8: a `declare class` NODE itself is no longer emitted (ambient type, no
+// runtime impl). A warm v7 entry would still carry the ambient class symbol.
+// v9: per-file symbol extraction cap raised from 40 to 1000 so large product
+// files are no longer silently undercounted from a warm v8 truncated entry.
+// v10: tree-sitter extraction now supports Ruby/Kotlin/Rust/PHP/C#/Swift/C/C++.
+// Warm v9 entries for those languages had empty symbol sets.
+// v11: C/C++ function names are read only from the declarator; warm v10 entries
+// could include macro/namespace misparses as fake function symbols.
+// v12: C/C++ requires a real function_declarator and drops keyword names, so
+// warm v11 entries with C++ header keyword false positives must be invalidated.
+// v13: C/C++ type nodes require an actual grammar name field; warm v12 entries
+// could count anonymous enum members as class symbols.
+// v14: C/C++ type nodes require a definition body and reserved keywords are
+// dropped; warm v13 entries could count type references or `if` as symbols.
+// v15: follow-up grammar fixes add Ruby singleton methods, C# record structs,
+// Swift protocol methods, and Rust trait signatures while dropping Rust aliases.
+// v16: symbol extraction now carries source line spans for runtime coverage
+// report ingestion; warm v15 entries lack the ranges and cannot be mapped.
+export const PARSER_VERSION = 16;
+const SYMBOL_KINDS = new Set(["function", "class", "const", "method"]);
+/** Strict structural validation — persisted data is untrusted FOR SHAPE; reject anything off-shape. */
+function validSymbols(v) {
+    if (!v || typeof v !== "object")
+        return null;
+    const o = v;
+    if (typeof o.truncated !== "boolean" || !Array.isArray(o.symbols))
+        return null;
+    for (const s of o.symbols) {
+        if (!s || typeof s !== "object")
+            return null;
+        const sym = s;
+        if (typeof sym.name !== "string" || sym.name.length === 0)
+            return null;
+        if (typeof sym.symbol_kind !== "string" || !SYMBOL_KINDS.has(sym.symbol_kind))
+            return null;
+        if (sym.start_line !== undefined && (typeof sym.start_line !== "number" || !Number.isFinite(sym.start_line)))
+            return null;
+        if (sym.end_line !== undefined && (typeof sym.end_line !== "number" || !Number.isFinite(sym.end_line)))
+            return null;
+        if (sym.callable !== undefined && typeof sym.callable !== "boolean")
+            return null;
+        if (sym.trivial_accessor !== undefined && typeof sym.trivial_accessor !== "boolean")
+            return null;
+        if (sym.member_of !== undefined && typeof sym.member_of !== "string")
+            return null;
+    }
+    return o;
+}
+function validTestNames(v) {
+    if (!Array.isArray(v))
+        return null;
+    for (const x of v)
+        if (typeof x !== "string")
+            return null;
+    return v;
+}
+export class ParseCache {
+    entries;
+    seen = new Set();
+    hits = 0;
+    misses = 0;
+    constructor(data) {
+        this.entries = new Map();
+        // A version mismatch (or no data) starts empty — never trust a stale schema.
+        if (!data || data.version !== PARSER_VERSION || !data.entries || typeof data.entries !== "object")
+            return;
+        for (const [key, raw] of Object.entries(data.entries)) {
+            if (!raw || typeof raw !== "object")
+                continue;
+            const entry = {};
+            const sym = validSymbols(raw.symbols);
+            if (sym)
+                entry.symbols = sym;
+            const tn = validTestNames(raw.testNames);
+            if (tn)
+                entry.testNames = tn;
+            // Drop entries that carried nothing valid.
+            if (entry.symbols || entry.testNames)
+                this.entries.set(key, entry);
+        }
+    }
+    /** Cached symbol extraction (keyed by content hash + language). */
+    symbols(hash, language, compute) {
+        const key = `sym:${hash}:${language ?? ""}`;
+        this.seen.add(key);
+        const hit = this.entries.get(key);
+        if (hit?.symbols) {
+            this.hits++;
+            return hit.symbols;
+        }
+        this.misses++;
+        const value = compute();
+        this.entries.set(key, { ...(hit ?? {}), symbols: value });
+        return value;
+    }
+    /** Cached test-name extraction (keyed by content hash; language-agnostic). */
+    testNames(hash, compute) {
+        const key = `tn:${hash}`;
+        this.seen.add(key);
+        const hit = this.entries.get(key);
+        if (hit?.testNames) {
+            this.hits++;
+            return hit.testNames;
+        }
+        this.misses++;
+        const value = compute();
+        this.entries.set(key, { ...(hit ?? {}), testNames: value });
+        return value;
+    }
+    /** hits / (hits + misses) as a percentage (1dp); 0 when nothing was looked up. */
+    hitRate() {
+        const total = this.hits + this.misses;
+        return total === 0 ? 0 : Math.round((this.hits / total) * 1000) / 10;
+    }
+    /** Serialize for persistence — pruned to only the keys looked up THIS run (a deleted
+     *  file's entry cannot linger and re-enter a future graph). */
+    toData() {
+        const entries = {};
+        for (const key of this.seen) {
+            const e = this.entries.get(key);
+            if (e)
+                entries[key] = e;
+        }
+        return { version: PARSER_VERSION, entries };
+    }
+}

package/dist/local/analyze/selfAssert.js

@@ -0,0 +1,53 @@
+// Self-asserting framework helpers (confirmer conjunct 5, Phase 4.3).
+//
+// A self-asserting helper is a call whose invocation IS the assertion — it fails
+// the test on its own, with no separate `expect(...)`/`assert*`. The confirmer
+// (confirm.ts) lets one of these satisfy conjunct 5 ("the runtime use is
+// observed") — but ONLY for a RENDER exercise (`render(<X/>)` / `<X/>` / mount),
+// where the helper observes the rendered DOM. A plain value call whose result is
+// discarded is NOT rescued by a co-located self-assert (review: a UI observation
+// is not connected to a pure function call's return value).
+//
+// This list is STRUCTURAL and PUBLIC — a fixed set of helper-call shapes, never a
+// tunable secret threshold. It is deliberately MINIMAL and grows ONLY with a
+// committed golden fixture per addition (enforced by the meta-test in
+// tests/local/confirm.test.ts). Auto-waiting / throwing Testing-Library queries
+// (`findBy*`, `getBy*`, `queryBy*` throw or wait, so the query IS the assertion)
+// are the render-observation members. Cypress `should`/`contains` are recognized
+// (harmless) but only ever satisfy conjunct 5 in a render context; pure Cypress
+// e2e flows do not import+exercise a symbol and are not_structurally_confirmable.
+/**
+ * The allow-list. Each entry is recognized by {@link isSelfAssertingCallee} via a
+ * trailing method name, and is anchored to exactly one committed fixture.
+ */
+export const SELF_ASSERT_HELPERS = [
+    {
+        id: "testing-library-findby",
+        framework: "testing-library",
+        shape: "screen.findBy*(...) — auto-waiting query that throws when absent",
+        fixture: "P6-findby-render.test.tsx"
+    },
+    {
+        id: "testing-library-getby",
+        framework: "testing-library",
+        shape: "screen.getBy*(...) — synchronous query that throws when absent",
+        fixture: "P3-self-assert.test.tsx"
+    }
+];
+/**
+ * True when a call's resolved callee text (e.g. "screen.findByRole", "getByText",
+ * "should", "cy.contains") is a self-asserting helper. Matches on the trailing
+ * method name so a chained/destructured call is recognized regardless of base.
+ */
+export function isSelfAssertingCallee(method) {
+    if (!method)
+        return false;
+    const trailing = method.includes(".") ? method.slice(method.lastIndexOf(".") + 1) : method;
+    // Testing-Library render-observation queries (the symbol-confirmation members).
+    if (/^(find|get|query)(All)?By[A-Z]/.test(trailing))
+        return true;
+    // Cypress UI observations — recognized, but only confirm a render exercise.
+    if (trailing === "contains" || trailing === "should")
+        return true;
+    return false;
+}