npm - @orangepro/orangepro-mcp - Versions diffs - 0.2.29 → 0.2.30 - Mend

@orangepro/orangepro-mcp 0.2.29 → 0.2.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/README.md +201 -198
package/dist/local/generate/generator.js +98 -15
package/dist/local/generate/prompt.js +23 -4
package/dist/local/generate/promptV5.js +24 -1
package/package.json +1 -1

package/README.md CHANGED Viewed

@@ -1,117 +1,126 @@
-# OrangePro MCP
+<p align="center">
+  <img src="https://github.com/OrangeproAI/orangepro-mcp/raw/main/docs/logo-horizontal.svg" alt="OrangePro" width="320" />
+</p>
+<p align="center">
+  <strong>Find the behaviors your tests miss. Generate grounded tests that actually run.</strong>
+</p>
+<p align="center">
+  <a href="https://www.npmjs.com/package/@orangepro/mcp-server"><img src="https://badge.fury.io/js/@orangepro%2Fmcp-server.svg" alt="npm version" /></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="MIT License" /></a>
+  <a href="https://www.npmjs.com/package/@orangepro/mcp-server"><img src="https://img.shields.io/npm/dw/@orangepro/mcp-server.svg" alt="npm downloads" /></a>
+  <a href="https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp"><img src="https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp/badges/score.svg" alt="Glama score" /></a>
+  <a href="https://registry.modelcontextprotocol.io/?q=orangepro"><img src="https://img.shields.io/badge/MCP_Registry-orangepro-orange.svg" alt="MCP Registry" /></a>
+</p>
-[![npm version](https://badge.fury.io/js/@orangepro%2Fmcp-server.svg )](https://www.npmjs.com/package/@orangepro/mcp-server )
-[![MIT License](https://img.shields.io/badge/license-MIT-green.svg )](LICENSE)
-[![npm downloads](https://img.shields.io/npm/dw/@orangepro/mcp-server.svg )](https://www.npmjs.com/package/@orangepro/mcp-server )
-[![orangepro-mcp MCP server](https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp/badges/score.svg )](https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp )
-[![MCP Registry](https://img.shields.io/badge/MCP_Registry-ai.orangepro%2Fmcp-orange.svg )](https://registry.modelcontextprotocol.io/?q=orangepro )
-**Find the behaviors your tests miss. Generate grounded tests that actually run.**
-`opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. It runs as a CLI and a local stdio MCP server.
+---
-Once you run the mcp server against a repo, you can get behavior-coverage/html
-**<a href="https://orangeproai.github.io/orangepro-mcp/twenty-crm-behavior-coverage.html" target="_blank">→ Live example: Twenty CRM behavior coverage report</a>**
+OrangePro maps every public behavior in your codebase, scores each one by real test evidence, and shows you the structural blind spots before your users find them. Runs locally. Your code never leaves your machine.
-<img width="895" alt="OrangePro system map — entry lanes, services, evidence tiers" src="https://github.com/user-attachments/assets/1ceba779-e0ec-4ec1-99ce-001bc3589b42" />
+```bash
+npx -y @orangepro/mcp-server@latest start .
+```
-*Fig 1: System map — entry lanes (GraphQL, HTTP, Jobs) flowing into services, sized by traffic, colored by evidence tier, red-ringed by risk.*
+<!-- TODO: Replace with a terminal GIF showing the command running and report opening -->
-<img width="818" height="1284" alt="Screenshot 2026-07-30 at 4 38 35 PM" src="https://github.com/user-attachments/assets/1c41475d-be2a-4c6d-ace6-c6546573bf97" />
+---
+## Table of Contents
-*Fig 2: Priority gaps — top 20 unproven behaviors ranked by blast radius, with generated test drafts and applicable testing categories.*
+- [What you get](#what-you-get)
+- [Evidence tiers](#evidence-tiers)
+- [Quick start](#quick-start)
+- [Use with your coding agent](#use-with-your-coding-agent)
+- [How it works](#how-it-works)
+- [Language support](#language-support)
+- [Privacy](#privacy)
+- [CLI reference](#cli-reference)
+- [MCP tools](#mcp-tools-18-total)
+- [Platform](#whats-on-the-hosted-platform)
+- [Contributing](#contributing)
 ---
-Install the target repository's dependencies first, then run OrangePro from that repository:
-```bash
-cd /path/to/your/repo
-npm install # or pnpm install / bun install / the repository's package manager
+## What you get
-# Optional: enables AI candidate links, candidate flows, and test generation.
-export ANTHROPIC_API_KEY="..." # or OPENAI_API_KEY / OLLAMA_BASE_URL
+One command produces an interactive HTML report:
-npx -y @orangepro/mcp-server@latest start . --prompt-version v5
+```bash
+npx -y @orangepro/mcp-server@latest start .
 open .orangepro/behavior-coverage.html
 ```
+The report has two modes: **Simple** (integration-level blind spots, plain English) and **Expert** (full behavior list, evidence tiers, flows, system map). Toggle with the pill switch at the top.
-With no model key, the same command still performs deterministic analysis, renders the report, and dynamically proves eligible behaviors using existing tests. With a key, it also discovers AI candidate flows and drafts grounded tests for the highest-risk gaps. AI output never changes evidence tiers; only the mutation-kill oracle can mint **Dynamically Proven**.
+**<a href="https://orangeproai.github.io/orangepro-mcp/twenty-crm-behavior-coverage.html" target="_blank">→ Live example: Twenty CRM (5,237 behaviors mapped)</a>**
-The command writes:
+<img width="895" alt="OrangePro system map — entry lanes, services, evidence tiers" src="https://github.com/user-attachments/assets/1ceba779-e0ec-4ec1-99ce-001bc3589b42](https://github.com/user-attachments/assets/a4d85b98-4f19-4647-8dd9-db5911574f49" />
-```
-.orangepro/
-├── behavior-coverage.html   ← open this: system map, risks, flows, behaviors
-├── graph.json               ← deterministic evidence graph
-├── COVERAGE_REPORT.md       ← coverage and gap summary
-├── rtm.md                   ← requirements traceability matrix
-└── ai/                      ← candidate AI links/flows when a provider is configured
+*System map — entry lanes (GraphQL, HTTP, Jobs) flowing into services, sized by traffic, colored by evidence tier, red-ringed by risk.*
-orangepro_generated/         ← contained generated tests; existing source files are untouched
-```
-The report opens on a **system map** of your repo — entry lanes (GraphQL/HTTP/Jobs) flowing into the services they reach, sized by traffic, colored by evidence tier, risk-ringed — identical on every run. Each completed rerun shows a **delta banner** against the previous completed run. The report discloses when bounded path enumeration prunes additional branch expansions. Every behavior gets a plain-English description; every top risk gets a deterministic context line and a state-aware next step.
+<img width="818" alt="Priority gaps" src="https://github.com/user-attachments/assets/30a512b6-7830-48db-a00f-a616e7176ea8" />
-Run `opro export` when you want a machine-readable evidence pack.
+*Priority gaps of another open source Project HONO — top 20 unproven behaviors ranked by blast radius, with generated test drafts.*
 ---
-## Install
+## Evidence tiers
-```bash
-# No install needed: run the full local workflow in the current repository
-npx -y @orangepro/mcp-server@latest start . --prompt-version v5
+Every behavior gets exactly one tier. Nothing is labeled "tested" on faith.
-# Or global install
-npm install -g @orangepro/orangepro-mcp
-opro start . --prompt-version v5
+| Tier | Color | What it means |
+|------|-------|---------------|
+| **Dynamically Proven** | 🟢 | A real test kills a targeted mutation of this behavior |
+| **Runtime-covered** | 🟢 | Coverage tool executed this code |
+| **Statically Linked** | 🟡 | A test imports and calls this code — structural link, not proof |
+| **Unconfirmed Candidate** | ⚪ | A similar test file exists — a lead, not evidence |
+| **No Signal** | 🔴 | Nothing tests this behavior |
-# Or from source
-git clone https://github.com/OrangeproAI/orangepro-mcp.git
-cd orangepro-mcp && npm ci && npm run build && npm link
-```
+> **"Dynamically Proven 0" is normal on first run.** Proof requires running tests against targeted mutations. That's the trust model.
 ---
-## Use with your coding agent
+## Quick start
+```bash
+cd /path/to/your/repo
+npm install          # install the repo's own dependencies first
-OrangePro runs as an MCP server. Any MCP-compatible agent (Cursor, Claude Code, Codex, Copilot, OpenCode) can drive it.
+npx -y @orangepro/mcp-server@latest start .
+open .orangepro/behavior-coverage.html
+```
-### Quick agent setup
+No API key needed. The report shows your system map, evidence tiers, priority gaps, and delta since last run.
-If you already have `opro` on your PATH, print the exact config for your client:
+**Want test generation?** Add a model key (BYOK):
 ```bash
-opro agent --client codex
-opro agent --client claude-code
-opro agent --client cursor
-opro agent --client opencode
-opro agent --client generic
+export ANTHROPIC_API_KEY="..."   # or OPENAI_API_KEY / OLLAMA_BASE_URL
+npx -y @orangepro/mcp-server@latest start .
 ```
-No global install is required. These commands use the published package:
+AI output never changes evidence tiers. Only the mutation-kill oracle can mint Dynamically Proven.
-```bash
-# Codex
-npx -y @orangepro/mcp-server@latest agent --client codex
+**Output:**
-# Claude Code
-npx -y @orangepro/mcp-server@latest agent --client claude-code
+```
+.orangepro/
+├── behavior-coverage.html   ← open this
+├── graph.json               ← deterministic evidence graph
+├── COVERAGE_REPORT.md       ← coverage and gap summary
+└── ai/                      ← candidate flows (when a key is configured)
-# Cursor
-npx -y @orangepro/mcp-server@latest agent --client cursor
+orangepro_generated/         ← generated tests; your source files are never touched
+```
-# OpenCode
-npx -y @orangepro/mcp-server@latest agent --client opencode
+Each rerun shows a **delta banner**: what entered the codebase, what moved up in risk, what got resolved.
-# Generic MCP clients, including VS Code/Copilot-style MCP settings
-npx -y @orangepro/mcp-server@latest agent --client generic
-```
+---
-### Manual MCP config
+## Use with your coding agent
-Add to your client's MCP config:
+OrangePro runs as an MCP server. Add to your client's config:
 ```json
 {
@@ -124,48 +133,83 @@ Add to your client's MCP config:
 }
 ```
-| Client | Config location |
+| Client | Where to put it |
 | --- | --- |
 | Claude Code | `.mcp.json` or `~/.claude.json` |
 | Cursor | `~/.cursor/mcp.json` or Settings → MCP |
-| Codex | Config printed by `opro agent --client codex` or `npx -y @orangepro/mcp-server@latest agent --client codex` |
-| VS Code / Copilot | MCP settings; use the `generic` config if your client accepts raw MCP server JSON |
-| OpenCode | Config printed by `opro agent --client opencode` |
-### The workflow
+| VS Code / Copilot | MCP settings |
+| Codex / OpenCode | Run `npx -y @orangepro/mcp-server@latest agent --client codex` |
-Tell your agent:
+**The workflow:** Tell your agent:
 > "Use `orangepro_start`, then `orangepro_generate_tests` with base_ref=main. Write each test to its suggested_path, run it, and report pass/fail."
 The agent writes the test, runs it, calls `orangepro_prove`, and the behavior turns Dynamically Proven. One prompt, full loop.
-### MCP tools (18 total)
+---
-| Tool | What it does |
-|------|--------------|
-| `orangepro_start` | One-command setup: analyze + report + next actions |
-| `orangepro_analyze_sources` | Build/refresh the evidence graph |
-| `orangepro_generate_tests` | Generate grounded tests for gaps |
-| `orangepro_prove` | Run mutation-kill oracle on a behavior |
-| `orangepro_prove_loop` | Setup commands + dynamic proof + report refresh for one behavior |
-| `orangepro_find_test_gaps` | List behaviors with weak/missing tests, ranked by risk |
-| `orangepro_graph_score` | Graph readiness score (0–100) |
-| `orangepro_status` | Workspace state without generating anything |
-| `orangepro_doctor` | Recommend next evidence to improve quality |
-| `orangepro_rtm` | Requirements traceability matrix |
-| `orangepro_stats` | Aggregate statistics |
-| `orangepro_changed_impact` | What a diff touches (requires git + base ref) |
-| `orangepro_record_run` | Record a test run result |
-| `orangepro_explain_test` | Explain why a test was generated |
-| `orangepro_export_evidence_pack` | Export metadata-only evidence pack |
-| `orangepro_update_graph` | Incremental graph update |
-| `orangepro_ai_links` | Weak behavior→symbol suggestions (optional AI) |
-| `orangepro_ai_flows` | Candidate flow discovery (optional AI) |
+## Works with
+<p>
+  <strong>Claude Code</strong> · <strong>Cursor</strong> · <strong>GitHub Copilot</strong> · <strong>Codex</strong> · <strong>Windsurf</strong> · <strong>OpenCode</strong> · <strong>VS Code</strong>
+</p>
+Any MCP-compatible agent can drive OrangePro. No vendor lock-in.
+---
+## How it works
+```
+┌─────────────┐     ┌──────────────┐     ┌─────────────┐
+│  Your Code  │ ──► │  Knowledge   │ ──► │  Evidence   │
+│  (any lang) │     │    Graph     │     │   Tiers     │
+└─────────────┘     └──────────────┘     └─────────────┘
+                           │
+                    ┌──────┴──────┐
+                    ▼             ▼
+             ┌───────────┐  ┌──────────┐
+             │ Gap Report│  │ Generate │
+             │ + Risks   │  │  Tests   │
+             └───────────┘  └──────────┘
+```
+| Phase | What happens | Needs a model key? |
+|-------|-------------|-------------------|
+| **Analyze** | AST walk → behaviors, flows, evidence tiers | No |
+| **Score** | Graph readiness score (0–100) | No |
+| **Generate** | Grounded tests for top gaps | Yes (BYOK) |
+| **Prove** | Mutation-kill oracle confirms test breaks if behavior changes | No |
+Same code = same score. Deterministic. Always.
 ---
-## CLI reference
+## Language support
+| Language | Static mapping | Generated tests | Dynamic proof |
+|----------|:-:|:-:|:-:|
+| TypeScript / JavaScript | ✓ | ✓ Jest / Vitest / Mocha | ✓ |
+| Python | ✓ | ✓ pytest | ✓ |
+| Go | ✓ | ✓ `*_test.go` | ✓ |
+| Java | ✓ | ✓ JUnit 4/5 | ✓ |
+| Kotlin, Rust, PHP, C#, Ruby, Swift, C, C++ | ✓ | planned | planned |
+Static mapping works across many languages via tree-sitter. Dynamic proof is deliberately narrower — each language needs a runner, mutation locator, and sandbox profile.
+---
+## Privacy
+- **No stored source.** Reads code in-process. Never uploads to an OrangePro server.
+- **No existing-source mutation.** Never edits your source or test files.
+- **Your keys stay yours.** Read from env at call time, never persisted.
+- **BYOK is direct.** Code context goes to the model provider you configure. OrangePro is not in that path.
+---
+<details>
+<summary><strong>CLI reference</strong></summary>
 ```bash
 opro                          # analyze + report + agent next actions
@@ -175,39 +219,66 @@ opro score                    # graph readiness (0–100)
 opro gaps --limit 10          # top 10 untested behaviors
 opro generate --base main     # tests for PR diff
 opro generate --single        # top gap, whole repo
-opro prove                    # mutation-kill oracle (use the prove_run args returned by generate)
+opro prove                    # mutation-kill oracle
 opro rtm                      # traceability matrix
 opro export                   # metadata-only evidence pack
 opro mcp                      # run as MCP server (stdio)
 opro doctor                   # what evidence to add next
-opro doctor --proof           # explain why dynamic proof could not close
 opro coverage                 # ingest runtime coverage
 ```
 Add `--json` to any read command for machine output. Run `opro help` for the full reference.
----
+</details>
+<details>
+<summary><strong>MCP tools (18 total)</strong></summary>
+| Tool | What it does |
+|------|--------------|
+| `orangepro_start` | One-command setup: analyze + report + next actions |
+| `orangepro_analyze_sources` | Build/refresh the evidence graph |
+| `orangepro_generate_tests` | Generate grounded tests for gaps |
+| `orangepro_prove` | Run mutation-kill oracle on a behavior |
+| `orangepro_prove_loop` | Setup + dynamic proof + report refresh for one behavior |
+| `orangepro_find_test_gaps` | List behaviors with weak/missing tests, ranked by risk |
+| `orangepro_graph_score` | Graph readiness score (0–100) |
+| `orangepro_status` | Workspace state without generating anything |
+| `orangepro_doctor` | Recommend next evidence to improve quality |
+| `orangepro_rtm` | Requirements traceability matrix |
+| `orangepro_stats` | Aggregate statistics |
+| `orangepro_changed_impact` | What a diff touches (requires git + base ref) |
+| `orangepro_record_run` | Record a test run result |
+| `orangepro_explain_test` | Explain why a test was generated |
+| `orangepro_export_evidence_pack` | Export metadata-only evidence pack |
+| `orangepro_update_graph` | Incremental graph update |
+| `orangepro_ai_links` | Weak behavior→symbol suggestions (optional AI) |
+| `orangepro_ai_flows` | Candidate flow discovery (optional AI) |
+</details>
-## PR workflow
+<details>
+<summary><strong>PR workflow</strong></summary>
 ```bash
 opro generate --base main              # tests for what this branch changed
-opro generate --pr 1234                # checks out PR #1234 — mutates your working tree; needs gh + confirmation (prefer --base)
+opro generate --pr 1234                # checks out PR #1234
 opro generate --changed                # current branch diff vs main
 ```
 Each generated test includes:
 - **Grounding** — the real files, symbols, and existing tests it cites
 - **Run hints** — where to write it, how to run it
-- **Scenario bucket + technique** — what failure mode it targets and how
+- **Scenario bucket** — what failure mode it targets
-If the environment can't run tests yet (dependencies not installed, runner unconfigured), rejected drafts are kept as **Manual tests** — scenario, Given/When/Then steps, synthetic test data, and expected outcome in plain English, with the exact blocker named. Install dependencies and re-run `opro start` to turn them into runnable tests. Runnable tests always replace Manual tests for the same behavior; the two are never mixed.
+If dependencies aren't installed, tests are kept as **Manual tests** (Given/When/Then steps with the blocker named). Install dependencies and re-run to convert them to runnable tests.
----
+</details>
-## Test categories
+<details>
+<summary><strong>Test categories</strong></summary>
-Generation is evidence-gated. A category is produced only when the graph has supporting evidence — never padded with generic filler. These are the local generation buckets. The report additionally shows each risk's **applicable testing categories** (contract, boundary limits, integration flow, state lifecycle, failure recovery, …), derived deterministically from graph facts. Categories with generated drafts are highlighted as drafts; they are not coverage or proof, and remaining applicable categories stay outlined. Neither taxonomy changes evidence tiers.
+Generation is evidence-gated. A category is produced only when the graph has supporting evidence.
 | Category | What it targets |
 |----------|-----------------|
@@ -218,43 +289,10 @@ Generation is evidence-gated. A category is produced only when the graph has sup
 | Security / privacy | Auth, injection, data leakage |
 | Regression | Pinning a previously-broken behavior |
----
-## Evidence tiers
-Every behavior gets exactly one tier. Nothing is labeled "tested" on faith.
-| Tier | What it means | How you get there |
-|------|---------------|------------------|
-| **Dynamically Proven** | A real test kills a targeted mutant of this behavior | `opro prove` after writing/running a test |
-| **Runtime-covered** | Coverage tool executed this code | `opro start --generate-coverage` |
-| **Statically Linked** | A test **imports and calls** this code — a hard structural link | Automatic during analysis |
-| **Unconfirmed Candidate** | A lexically similar test file exists, but nothing links it — a lead, **not evidence** | Automatic; upgrade it by writing the linking test |
-| **No Signal** | Nothing tests this behavior yet | — |
-> **"Dynamically Proven 0" is normal on first run.** Static analysis always runs. Dynamic proof requires running tests against targeted mutations. That's the trust model — nothing is Dynamically Proven until a real test kills a real mutant.
+</details>
-When runtime coverage is available, `opro start` also compares Runtime-covered and Dynamically Proven behaviors over the same deterministic denominator. It never compares source-line coverage with behavior proof or folds off-denominator proofs into that percentage.
----
-## Language support
-OrangePro separates static mapping, generated tests, runtime coverage, and dynamic proof. Those are different confidence bars.
-| Language | Static behavior extraction | Generated tests | Runtime coverage | Dynamic proof |
-|----------|:--------------------------:|:---------------:|:----------------:|:-------------:|
-| TypeScript / JavaScript | ✓ | ✓ Jest / Vitest / Mocha / AVA-style drafts | ✓ lcov.info | ✓ Vitest / Jest / Mocha |
-| Python | ✓ | ✓ pytest | ✓ coverage.py / pytest-cov XML | ✓ pytest |
-| Go | ✓ | ✓ same-package `*_test.go` | ✓ coverprofile | ✓ `go test` |
-| Java | ✓ | ✓ JUnit 4/5 | ✓ JaCoCo XML | ✓ Maven/JUnit |
-| Kotlin, Rust, PHP, C#, Ruby, Swift, C, C++ | ✓ static behavior extraction | planned | planned where standard coverage exists | planned proof profiles |
-Static mapping works across many languages through tree-sitter and repo metadata. Dynamic proof is deliberately narrower: each language needs a runner, mutation locator, sandbox profile, and false-proof regressions before it can mint Dynamically Proven.
----
-## Model setup (BYOK)
+<details>
+<summary><strong>Model setup (BYOK)</strong></summary>
 Analysis, scoring, and proof need no model key. Generation does.
@@ -268,56 +306,20 @@ Auto-detect order: OpenAI → Ollama → Anthropic. Override with `--provider` a
 Run `opro setup` to configure interactively. Keys stay in your environment — never written to graph, config, or artifacts.
----
+</details>
-## AI candidate lanes
+<details>
+<summary><strong>AI candidate lanes</strong></summary>
-With a provider key, OrangePro can stage weak AI behavior→symbol links and AI-suggested candidate flows. These are ready for local use as review/generation worklists, but they are not evidence:
+With a provider key, OrangePro stages weak AI behavior→symbol links and AI-suggested candidate flows. These are review/generation worklists, not evidence:
 - AI links appear as `AI-linked` suggestions.
 - AI flows are stored separately from deterministic flows.
-- Neither lane changes Dynamically Proven, Runtime-covered, Statically Linked, denominator counts, or evidence tiers.
+- Neither lane changes evidence tiers or denominator counts.
-Use them when you want the agent to find likely service-boundary flows faster; ignore them when you want a deterministic-only report.
+Use them when you want the agent to find likely service-boundary flows faster; ignore them for a deterministic-only report.
----
-## How it works
-OrangePro separates **analysis** (what your code does) from **proof** (whether tests actually verify it).
-```
-┌─────────────┐     ┌──────────────┐     ┌─────────────┐
-│  Your Code  │ ──► │  Knowledge   │ ──► │  Evidence   │
-│  (any lang) │     │    Graph     │     │   Tiers     │
-└─────────────┘     └──────────────┘     └─────────────┘
-                           │
-                    ┌──────┴──────┐
-                    ▼             ▼
-             ┌───────────┐  ┌──────────┐
-             │ Gap Report│  │ Generate │
-             │ + Risks   │  │  Tests   │
-             └───────────┘  └──────────┘
-```
-| Phase | What happens | Needs a model key? |
-|-------|-------------|-------------------|
-| **Analyze** | AST walk → behaviors, flows, evidence tiers | No |
-| **Score** | Graph readiness score (0–100) with reasons | No |
-| **Generate** | Grounded tests for top gaps, per-behavior | Yes (BYOK) |
-| **Prove** | Mutation-kill oracle confirms test actually breaks if behavior changes | No |
-Reruns are cache-accelerated: unchanged files skip re-parsing, BYOK stages don't re-spend tokens on unchanged inputs, and proof certificates persist in a local ledger until the certified file changes. Upgrading the tool auto-invalidates caches.
----
-## Privacy
-- **No stored source.** Reads code in-process. Never uploads to an OrangePro server.
-- **No existing-source mutation.** Never edits existing source or test files. Writes metadata to `.orangepro/`; keyed auto-drive may write new, reviewable tests under `orangepro_generated/`.
-- **Metadata-only exports.** File paths, names, hashes, scores — not raw source.
-- **Your keys stay yours.** Read from env at call time, never persisted.
-- **BYOK is direct.** When AI lanes are enabled, grounded code context is sent directly to the model provider you configure; OrangePro's hosted service is not in that path.
+</details>
 ---
@@ -326,25 +328,26 @@ Reruns are cache-accelerated: unchanged files skip re-parsing, BYOK stages don't
 This repo is the free local tool. The [OrangePro platform](https://orangepro.ai) adds:
 - Persistent knowledge graph across PRs and repos
-- Managed dynamic proof at scale (larger budgets, CI workers, service setup profiles)
-- PR/CI policy gates over Dynamically Proven, Runtime-covered, and risk deltas
+- PR/CI policy gates over evidence tiers and risk deltas
 - Jira / Confluence / TestRail / OpenAPI enrichment
 - Cross-repo intelligence and recurring-flow memory
 - Production incident correlation and regression targeting
-- Full test lifecycle management and team dashboards
+- Team dashboards and test lifecycle management
 ---
 ## Contributing
 ```bash
-npm run build       # compile to dist/
-npm test            # vitest
-npm run typecheck   # type check without emitting
+git clone https://github.com/OrangeproAI/orangepro-mcp.git
+cd orangepro-mcp && npm ci && npm run build
+npm test
 ```
-See [docs/local-proof-kit.md](docs/local-proof-kit.md) for the full development reference.
+PRs welcome. Please open an issue first for large changes.
-## License
+---
-[MIT](LICENSE) © OrangePro
+<p align="center">
+  MIT License · <a href="https://orangepro.ai">orangepro.ai</a>
+</p>

package/dist/local/generate/generator.js CHANGED Viewed

@@ -26,7 +26,10 @@ const SYMBOL_EXCERPT_CONTEXT_LINES = 3;
 const MAX_EXCERPT_CHARS = 8000;
 const MAX_TARGET_TYPE_EXCERPT_CHARS = 5000;
 const STATIC_CHECK_TIMEOUT_MS = 3000;
-const GO_COMPILE_CHECK_TIMEOUT_MS = 20000;
+// Large Go monorepos can spend tens of seconds populating a cold module cache
+// before the target package is compiled. Keep the check authoritative instead
+// of downgrading valid generated tests while dependencies are still downloading.
+const GO_COMPILE_CHECK_TIMEOUT_MS = 120000;
 /** A source ref that names a test file (used to place a generated test next to it). */
 const TEST_REF_RE = /(\.(test|spec)\.[cm]?[jt]sx?$)|((^|\/)test\.[cm]?[jt]sx?$)|(_test\.[a-z]+$)|(_spec\.[a-z]+$)|((^|\/)test_[^/]+\.[a-z]+$)/i;
 function areaOf(relPath) {
@@ -518,6 +521,9 @@ export function gatherContext(graph, behavior, framework, fileReader) {
     // Subject imports are TS/JS lines — feeding them to a pytest/go target would
     // produce an unparseable test in the other language.
     const fwLower = framework.toLowerCase();
+    const goContext = fwLower.includes("go")
+        ? goGenerationImportContext(graph.workspace.root, [...relatedFiles, ...testFiles], fileReader)
+        : { go_import_paths: [], go_module_paths: [], go_target_package_paths: [] };
     const subjectImports = fwLower.includes("pytest") || fwLower.includes("python") || fwLower.includes("go") || fwLower.includes("junit") || fwLower.includes("java")
         ? []
         : subjectImportsFor(graph, testFiles);
@@ -561,6 +567,9 @@ export function gatherContext(graph, behavior, framework, fileReader) {
         // MISSING, never a re-derivation of a test that already exists.
         existing_tests: examples.slice(0, 10),
         subject_imports: subjectImports,
+        ...(goContext.go_import_paths.length ? { go_import_paths: goContext.go_import_paths } : {}),
+        ...(goContext.go_module_paths.length ? { go_module_paths: goContext.go_module_paths } : {}),
+        ...(goContext.go_target_package_paths.length ? { go_target_package_paths: goContext.go_target_package_paths } : {}),
         ...(flowChain ? { flow_chain: flowChain } : {})
     };
     // entity_ids are graph external_ids: the behavior plus related file paths. A
@@ -1578,10 +1587,6 @@ function goStaticIssue(body) {
     if (!/\bfunc\s+Test[A-Za-z0-9_]*\s*\(\s*t\s+\*testing\.T\s*\)/m.test(body)) {
         return "Go test is missing a func Test...(t *testing.T) entrypoint.";
     }
-    const external = imports.filter((spec) => spec.split("/")[0].includes("."));
-    if (external.length) {
-        return `Go test imports module-path package(s) ${external.join(", ")}; OrangePro cannot verify module imports resolve from the generated file. Prefer same-package or stdlib-only code.`;
-    }
     if (!commandAvailable("gofmt"))
         return "gofmt not found; cannot verify Go syntax.";
     const { dir, file } = writeTempStaticFile("go", body);
@@ -1611,26 +1616,58 @@ function findGoModuleRoot(startDir, workspaceRoot) {
     }
     return null;
 }
-function goCompileIssue(body, workspaceRoot, relatedFiles) {
+function unusedImportLineNumbers(output, tempRel) {
+    const escaped = tempRel.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const diagnostic = new RegExp(`(?:^|\\n)(?:\\./)?${escaped}:(\\d+):\\d+:\\s+[^\\n]*\\bimported\\b[^\\n]*\\bnot used\\b`, "g");
+    return new Set([...output.matchAll(diagnostic)].map((match) => Number(match[1])).filter(Number.isFinite));
+}
+function removeLines(body, lineNumbers) {
+    if (!lineNumbers.size)
+        return body;
+    return body
+        .split(/\r?\n/)
+        .filter((_line, index) => !lineNumbers.has(index + 1))
+        .join("\n");
+}
+function goCompile(body, workspaceRoot, relatedFiles) {
+    const externalImports = goImportSpecs(body).filter((spec) => spec.split("/")[0].includes("."));
+    const unverifiedImportIssue = externalImports.length
+        ? `Go test imports module-path package(s) ${externalImports.join(", ")}, but OrangePro could not run the target-package compile check to verify they resolve.`
+        : null;
     const sourceFile = relatedFiles.find((rel) => /\.go$/i.test(rel) && !TEST_REF_RE.test(rel));
     if (!sourceFile)
-        return null;
+        return { body, issue: unverifiedImportIssue };
     const packageDir = path.resolve(workspaceRoot, path.dirname(sourceFile));
     if (!existsSync(packageDir) || !findGoModuleRoot(packageDir, workspaceRoot))
-        return null;
+        return { body, issue: unverifiedImportIssue };
     if (!commandAvailable("go"))
-        return "go not found; cannot verify generated Go test compiles.";
+        return { body, issue: "go not found; cannot verify generated Go test compiles." };
     const tempRel = `orangepro_compile_${process.pid}_${shortHash(body)}_test.go`;
     const tempFile = path.join(packageDir, tempRel);
+    let checkedBody = body;
     try {
-        writeFileSync(tempFile, body);
+        writeFileSync(tempFile, checkedBody);
         execFileSync("go", ["test", "-run", "^$", "."], { cwd: packageDir, stdio: "pipe", timeout: GO_COMPILE_CHECK_TIMEOUT_MS });
-        return null;
+        return { body: checkedBody, issue: null };
     }
     catch (e) {
         const err = e;
         const output = `${err.stdout?.toString() ?? ""}${err.stderr?.toString() ?? ""}`;
-        return `Go compile check failed: ${shortStaticDiag(output || err.message || "unknown error")}`;
+        const withoutUnusedImports = removeLines(checkedBody, unusedImportLineNumbers(output, tempRel));
+        if (withoutUnusedImports !== checkedBody) {
+            checkedBody = withoutUnusedImports;
+            try {
+                writeFileSync(tempFile, checkedBody);
+                execFileSync("go", ["test", "-run", "^$", "."], { cwd: packageDir, stdio: "pipe", timeout: GO_COMPILE_CHECK_TIMEOUT_MS });
+                return { body: checkedBody, issue: null };
+            }
+            catch (retryError) {
+                const retry = retryError;
+                const retryOutput = `${retry.stdout?.toString() ?? ""}${retry.stderr?.toString() ?? ""}`;
+                return { body: checkedBody, issue: `Go compile check failed: ${shortStaticDiag(retryOutput || retry.message || "unknown error")}` };
+            }
+        }
+        return { body: checkedBody, issue: `Go compile check failed: ${shortStaticDiag(output || err.message || "unknown error")}` };
     }
     finally {
         rmSync(tempFile, { force: true });
@@ -1659,6 +1696,37 @@ function goImportSpecs(body) {
     }
     return specs;
 }
+function goGenerationImportContext(workspaceRoot, files, fileReader) {
+    const goFiles = files.filter((file) => /\.go$/i.test(file));
+    const moduleRoots = dedupe(goFiles
+        .map((file) => findGoModuleRoot(path.resolve(workspaceRoot, path.dirname(file)), workspaceRoot))
+        .filter((root) => Boolean(root)));
+    const modulePathByRoot = new Map(moduleRoots.map((root) => {
+        try {
+            return [root, readFileSync(path.join(root, "go.mod"), "utf8").match(/^\s*module\s+(\S+)/m)?.[1] ?? ""];
+        }
+        catch {
+            return [root, ""];
+        }
+    }));
+    const go_module_paths = dedupe([...modulePathByRoot.values()].filter(Boolean));
+    const go_target_package_paths = dedupe(goFiles
+        .map((file) => {
+        const sourceDir = path.resolve(workspaceRoot, path.dirname(file));
+        const moduleRoot = findGoModuleRoot(sourceDir, workspaceRoot);
+        const modulePath = moduleRoot ? modulePathByRoot.get(moduleRoot) : "";
+        if (!moduleRoot || !modulePath)
+            return "";
+        const packageDir = path.relative(moduleRoot, sourceDir).split(path.sep).join("/");
+        return packageDir && packageDir !== "." ? `${modulePath}/${packageDir}` : modulePath;
+    })
+        .filter(Boolean));
+    const targetPaths = new Set(go_target_package_paths);
+    const go_import_paths = dedupe(goFiles
+        .flatMap((file) => goImportSpecs(fileReader(file) ?? ""))
+        .filter((spec) => spec.split("/")[0].includes(".") && !targetPaths.has(spec))).slice(0, 40);
+    return { go_import_paths, go_module_paths, go_target_package_paths };
+}
 function hasBalancedBraces(body) {
     let depth = 0;
     let stringQuote = null;
@@ -2176,8 +2244,13 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                 body = applyPythonSrcLayoutImports(body, relatedFiles);
             }
             body = ensureFrameworkScaffold(body, framework);
+            let compileIssue = null;
+            if (framework.toLowerCase().includes("go")) {
+                const checked = goCompile(body, graph.workspace.root, relatedFiles);
+                body = checked.body;
+                compileIssue = checked.issue;
+            }
             const staticIssue = staticFormatIssue(body, framework);
-            const compileIssue = framework.toLowerCase().includes("go") ? goCompileIssue(body, graph.workspace.root, relatedFiles) : null;
             const runnable = hasAssertion(body, framework) && !staticIssue && !compileIssue;
             generated.push({
                 id: `${run_id}-t${generated.length + 1}`,
@@ -2433,7 +2506,12 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                     }
                 }
                 const importErrors = isResolverFramework(framework) ? unresolvedLocalImports(body, genTestAbs, graph.workspace.root, declaredDeps) : [];
-                const compileIssue = framework.toLowerCase().includes("go") ? goCompileIssue(body, graph.workspace.root, relatedFiles) : null;
+                let compileIssue = null;
+                if (framework.toLowerCase().includes("go")) {
+                    const checked = goCompile(body, graph.workspace.root, relatedFiles);
+                    body = checked.body;
+                    compileIssue = checked.issue;
+                }
                 const runnable = isRunnable(body, framework, import_provenance, importErrors) && !compileIssue;
                 if (!runnable) {
                     const reason = unresolved_reason ?? compileIssue ?? runnableFailureReason(body, framework, import_provenance, importErrors, declaredDeps);
@@ -2651,7 +2729,12 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
             // from where the test will live. A test whose own import won't load is never
             // marked runnable.
             const importErrors = isResolverFramework(framework) ? unresolvedLocalImports(body, genTestAbs, graph.workspace.root, declaredDeps) : [];
-            const compileIssue = framework.toLowerCase().includes("go") ? goCompileIssue(body, graph.workspace.root, relatedFiles) : null;
+            let compileIssue = null;
+            if (framework.toLowerCase().includes("go")) {
+                const checked = goCompile(body, graph.workspace.root, relatedFiles);
+                body = checked.body;
+                compileIssue = checked.issue;
+            }
             const runnable = isRunnable(body, framework, import_provenance, importErrors) && !compileIssue;
             if (!runnable && !unresolved_reason) {
                 unresolved_reason = compileIssue ?? runnableFailureReason(body, framework, import_provenance, importErrors, declaredDeps);

package/dist/local/generate/prompt.js CHANGED Viewed

@@ -32,8 +32,10 @@ export function buildSystemPrompt() {
         "- Framework format rules:",
         "  - pytest: output a valid Python file with pytest-style `def test_...` functions and `assert` statements.",
         "  - Go: output a same-package `_test.go` body. Include `package <same package>`, `import \"testing\"`,",
-        "    and `func Test...(t *testing.T)`. Avoid third-party or module-path imports; use stdlib-only unless",
-        "    the evidence gives an existing same-package helper.",
+        "    and `func Test...(t *testing.T)`. Do not import packages you do not use. Prefer stdlib and exact",
+        "    OBSERVED GO IMPORT PATHS; never derive or invent a package subpath from a module name.",
+        "    Do not qualify lowercase (unexported) identifiers from imported packages. Bare same-package",
+        "    identifiers may be unexported because the generated test is rewritten into the target package.",
         "  - Java/JUnit: output a complete `.java` file, not a method fragment. Include a `class <Name>Test { ... }`,",
         "    the requested JUnit version's `@Test` import, and a JUnit assertion.",
         "  - TS/JS: output valid framework code for the named framework and use complete imports.",
@@ -78,6 +80,21 @@ export function buildGroundedUserPrompt(ctx, bucket) {
         for (const imp of ctx.subject_imports)
             lines.push(imp);
     }
+    if (ctx.go_module_paths?.length) {
+        lines.push("GO MODULE IDENTITIES (module roots only — never guess package subpaths from these):");
+        for (const modulePath of ctx.go_module_paths)
+            lines.push(`- ${modulePath}`);
+    }
+    if (ctx.go_import_paths?.length) {
+        lines.push("OBSERVED GO IMPORT PATHS (exact repo-evidenced package paths; prefer these for non-stdlib imports):");
+        for (const importPath of ctx.go_import_paths)
+            lines.push(`- ${importPath}`);
+    }
+    if (ctx.go_target_package_paths?.length) {
+        lines.push("TARGET GO PACKAGE PATHS (do not import these; the test is rewritten into the same package):");
+        for (const targetPath of ctx.go_target_package_paths)
+            lines.push(`- ${targetPath}`);
+    }
     if (ctx.source_excerpts.length) {
         lines.push("SOURCE EXCERPTS:");
         lines.push("Use these for understanding only; do not copy their lines verbatim into the test body.");
@@ -97,8 +114,10 @@ export function buildGroundedUserPrompt(ctx, bucket) {
     }
     else if (fw.includes("go")) {
         lines.push("- Emit same-package Go test code only: `package ...`, `import \"testing\"`, and `func Test...(t *testing.T)`.");
-        lines.push("- Do not import third-party or module-path packages such as `github.com/...`; prefer stdlib-only tests.");
-        lines.push("- Do not use testify/assert/require unless an existing same-package helper in the evidence clearly requires it.");
+        lines.push("- Do not import packages you do not use.");
+        lines.push("- Prefer stdlib and exact OBSERVED GO IMPORT PATHS. Never invent a package path or derive a subpath from a GO MODULE IDENTITY.");
+        lines.push("- Never import a TARGET GO PACKAGE PATH; call its identifiers directly because this is a same-package test.");
+        lines.push("- Do not qualify lowercase (unexported) identifiers from imported packages; bare same-package identifiers may be unexported.");
     }
     else if (fw.includes("junit") || fw.includes("java")) {
         if (fw.includes("junit4")) {

package/dist/local/generate/promptV5.js CHANGED Viewed

@@ -33,7 +33,15 @@ export function getFrameworkRules(framework) {
         return "Python: `def test_...` with `assert`. Use `# Concern:` and `# Technique:` comments.";
     }
     if (fw.includes("go")) {
-        return "Go: same-package `_test.go`, `func Test...(t *testing.T)`. Stdlib preferred.";
+        return [
+            "Go: same-package `_test.go` file. `func Test...(t *testing.T)`.",
+            "MUST start with `package <name>` matching the package under test.",
+            "MUST import `\"testing\"`; do not import any package you do not use.",
+            "Prefer stdlib and exact OBSERVED GO IMPORT PATHS. Never invent a package path or derive a subpath from a GO MODULE IDENTITY.",
+            "Never import a TARGET GO PACKAGE PATH; call its identifiers directly because this is a same-package test.",
+            "Do not qualify lowercase (unexported) identifiers from imported packages; bare same-package identifiers may be unexported.",
+            "Prefer stdlib `testing` over testify unless testify appears in OBSERVED GO IMPORT PATHS."
+        ].join(" ");
     }
     if (fw.includes("junit4") || fw.includes("java4")) {
         return "JUnit 4: `import org.junit.Test;` + `import static org.junit.Assert.*;`. Complete .java file.";
@@ -179,6 +187,21 @@ export function buildBatchGenerationUserPromptV5(ctx) {
         lines.push(`ACTORS: ${ctx.actors.join(", ")}`);
     lines.push(`FRAMEWORK: ${ctx.framework} | LAYER: ${ctx.test_layer}`);
     lines.push(`FRAMEWORK RULES: ${getFrameworkRules(ctx.framework)}`);
+    if (ctx.go_module_paths?.length) {
+        lines.push("GO MODULE IDENTITIES (module roots only — never guess package subpaths from these):");
+        for (const modulePath of ctx.go_module_paths)
+            lines.push(`  ${modulePath}`);
+    }
+    if (ctx.go_import_paths?.length) {
+        lines.push("OBSERVED GO IMPORT PATHS (exact repo-evidenced package paths):");
+        for (const importPath of ctx.go_import_paths)
+            lines.push(`  ${importPath}`);
+    }
+    if (ctx.go_target_package_paths?.length) {
+        lines.push("TARGET GO PACKAGE PATHS (do not import; this is a same-package test):");
+        for (const targetPath of ctx.go_target_package_paths)
+            lines.push(`  ${targetPath}`);
+    }
     lines.push("");
     if (ctx.flow_chain?.length) {
         lines.push("FLOW CHAIN:");

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",