@orangepro/orangepro-mcp 0.2.3 → 0.2.5

package/dist/local/score/risk.js

@@ -93,15 +93,6 @@ function gitFirstCommitBatch(root, files) {
     }
     return out;
 }
-function countOutgoingCalls(symbolId, graph) {
-    const targets = new Set();
-    for (const e of graph.edges) {
-        if (e.relationship_type === "CALLS" && e.from_external_id === symbolId) {
-            targets.add(e.to_external_id);
-        }
-    }
-    return targets.size;
-}
 function isEntryPoint(node) {
     const file = symbolFile(node);
     const title = symbolTitle(node);
@@ -160,11 +151,8 @@ function deriveDataSensitivity(node) {
     }
     return 1;
 }
-function getFlowDepth(node, graph) {
+export function buildFlowDepthContext(graph) {
     const entryIds = new Set(graph.nodes.filter((n) => n.kind === "CodeSymbol" && isEntryPoint(n)).map((n) => n.external_id));
-    if (entryIds.has(node.external_id))
-        return 0;
-    // BFS backward over CALLS edges to find nearest entry point.
     const callers = new Map();
     for (const e of graph.edges) {
         if (e.relationship_type === "CALLS") {
@@ -173,14 +161,27 @@ function getFlowDepth(node, graph) {
             callers.set(e.to_external_id, set);
         }
     }
+    return { entryIds, callers, cache: new Map() };
+}
+function getFlowDepth(node, ctx) {
+    const cached = ctx.cache.get(node.external_id);
+    if (cached !== undefined)
+        return cached;
+    const { entryIds, callers } = ctx;
+    if (entryIds.has(node.external_id)) {
+        ctx.cache.set(node.external_id, 0);
+        return 0;
+    }
     let depth = 0;
     let frontier = new Set(callers.get(node.external_id) ?? []);
     const seen = new Set(frontier);
     while (frontier.size > 0 && depth < 6) {
         depth++;
         for (const id of frontier) {
-            if (entryIds.has(id))
+            if (entryIds.has(id)) {
+                ctx.cache.set(node.external_id, depth);
                 return depth;
+            }
         }
         const next = new Set();
         for (const id of frontier) {
@@ -193,7 +194,9 @@ function getFlowDepth(node, graph) {
         }
         frontier = next;
     }
-    return depth >= 6 ? 6 : depth;
+    const out = depth >= 6 ? 6 : depth;
+    ctx.cache.set(node.external_id, out);
+    return out;
 }
 function complexityProxy(node) {
     const start = typeof node.properties.start_line === "number" ? node.properties.start_line : 0;
@@ -213,23 +216,40 @@ function normalizeScores(values) {
 const DETECTION_MAP = {
     proven: 1,
     associated: 5,
+    // A lexical/Jaccard candidate is a lead, not evidence — detection stays hard.
+    candidate: 8,
     none: 10
 };
 const NEW_CODE_DAYS = 30;
 const NEW_CODE_SECONDS = NEW_CODE_DAYS * 24 * 60 * 60;
-function computeRawORS(node, graph, incomingRefs, gitChurn, fanOut, detectionTier, firstCommitTs, nowSec) {
+function computeRawORS(node, depthCtx, incomingRefs, gitChurn, fanOut, detectionTier, firstCommitTs, nowSec) {
     const isNew = firstCommitTs > 0 && nowSec - firstCommitTs < NEW_CODE_SECONDS;
     const complexity = complexityProxy(node);
     const rawP = gitChurn * 0.35 + fanOut * 0.3 + (isNew ? 15 : 0) + complexity * 0.2;
     const routeWeight = deriveRouteWeight(node);
-    const flowDepth = getFlowDepth(node, graph);
+    const flowDepth = getFlowDepth(node, depthCtx);
     const flowPosition = Math.max(0, 5 - flowDepth);
     const dataSensitivity = deriveDataSensitivity(node);
     const rawI = incomingRefs * 0.3 + routeWeight * 0.3 + flowPosition * 0.2 + dataSensitivity * 0.2;
     const d = DETECTION_MAP[detectionTier];
     return { p: rawP, i: rawI, d };
 }
-function associatedBehaviorIds(graph, candidateIds) {
+function staticTestLinkedIds(graph, candidateIds) {
+    const ids = new Set();
+    const kinds = new Map(graph.nodes.map((n) => [n.external_id, n.kind]));
+    for (const e of graph.edges) {
+        if (e.evidence_strength !== "hard")
+            continue;
+        if (e.relationship_type !== "TESTED_BY" && e.relationship_type !== "COVERS")
+            continue;
+        if (kinds.get(e.from_external_id) === "TestCase" && candidateIds.has(e.to_external_id))
+            ids.add(e.to_external_id);
+        if (kinds.get(e.to_external_id) === "TestCase" && candidateIds.has(e.from_external_id))
+            ids.add(e.from_external_id);
+    }
+    return ids;
+}
+function candidateSignalIds(graph, candidateIds) {
     const ids = new Set();
     for (const e of graph.candidate_edges ?? []) {
         if (e.relationship_type !== "MAY_BE_TESTED_BY" && e.relationship_type !== "MAY_COVER" && e.relationship_type !== "MAY_RELATE_TO") {
@@ -264,19 +284,58 @@ export function rankRiskGaps(graph, opts = {}) {
     const churn = gitChurn(opts.repoRoot ?? graph.workspace.root, files, opts.churnWindow ?? "180 days ago");
     const firstCommitTs = gitFirstCommitBatch(opts.repoRoot ?? graph.workspace.root, files);
     const nowSec = Math.floor(Date.now() / 1000);
+    // Method-level attribution. CALLS edges are already symbol-granular and count
+    // at full weight. IMPORTS edges are file-granular: previously every symbol in
+    // an imported file inherited the file's full import count, which made all 17
+    // methods of a hot service tie at the same "incoming refs" and saturated the
+    // ranking. Split the file's import count across its eligible symbols instead.
     const incoming = new Map();
+    const fileImports = new Map();
     for (const e of graph.edges) {
         if (e.relationship_type === "CALLS" && symbolIds.has(e.to_external_id)) {
             incoming.set(e.to_external_id, (incoming.get(e.to_external_id) ?? 0) + 1);
         }
-        else if (e.relationship_type === "IMPORTS") {
-            for (const s of symbolsByFile.get(e.to_external_id) ?? [])
-                incoming.set(s.external_id, (incoming.get(s.external_id) ?? 0) + 1);
+        else if (e.relationship_type === "IMPORTS" && symbolsByFile.has(e.to_external_id)) {
+            fileImports.set(e.to_external_id, (fileImports.get(e.to_external_id) ?? 0) + 1);
         }
     }
+    for (const [file, count] of fileImports) {
+        const syms = symbolsByFile.get(file) ?? [];
+        if (syms.length === 0)
+            continue;
+        const share = count / syms.length;
+        for (const s of syms)
+            incoming.set(s.external_id, (incoming.get(s.external_id) ?? 0) + share);
+    }
+    // Per-symbol churn share: file churn weighted by the symbol's line span so one
+    // hot file no longer awards its full churn to every method it contains.
+    const fileComplexityTotals = new Map();
+    for (const [file, syms] of symbolsByFile) {
+        fileComplexityTotals.set(file, syms.reduce((acc, s) => acc + Math.max(complexityProxy(s), 1), 0));
+    }
+    const symbolChurn = (s) => {
+        const file = symbolFile(s);
+        const fileChurn = churn.get(file) ?? 0;
+        if (fileChurn === 0)
+            return 0;
+        const total = fileComplexityTotals.get(file) ?? 1;
+        return fileChurn * (Math.max(complexityProxy(s), 1) / Math.max(total, 1));
+    };
     const entryPoint = new Map(symbols.map((s) => [s.external_id, isEntryPoint(s)]));
-    const fanOut = new Map(symbols.map((s) => [s.external_id, countOutgoingCalls(s.external_id, graph)]));
-    const associated = associatedBehaviorIds(graph, symbolIds);
+    // Single pass over edges (was one full edge scan PER symbol).
+    const fanOutTargets = new Map();
+    for (const e of graph.edges) {
+        if (e.relationship_type !== "CALLS" || !symbolIds.has(e.from_external_id))
+            continue;
+        const set = fanOutTargets.get(e.from_external_id) ?? new Set();
+        set.add(e.to_external_id);
+        fanOutTargets.set(e.from_external_id, set);
+    }
+    const fanOut = new Map(symbols.map((s) => [s.external_id, fanOutTargets.get(s.external_id)?.size ?? 0]));
+    const depthCtx = buildFlowDepthContext(graph);
+    const staticLinked = staticTestLinkedIds(graph, symbolIds);
+    const candidateLinked = candidateSignalIds(graph, symbolIds);
+    const detectionFor = (id) => staticLinked.has(id) ? "associated" : candidateLinked.has(id) ? "candidate" : "none";
     if (opts.legacy) {
         return symbols
             .map((s) => {
@@ -300,42 +359,49 @@ export function rankRiskGaps(graph, opts = {}) {
     const rawScores = symbols.map((s) => {
         const file = symbolFile(s);
         const incoming_refs = incoming.get(s.external_id) ?? 0;
-        const git_churn = churn.get(file) ?? 0;
+        const git_churn = symbolChurn(s);
         const fan_out = fanOut.get(s.external_id) ?? 0;
         const ts = firstCommitTs.get(file) ?? 0;
-        const detectionTier = associated.has(s.external_id) ? "associated" : "none";
-        return computeRawORS(s, graph, incoming_refs, git_churn, fan_out, detectionTier, ts, nowSec);
+        return computeRawORS(s, depthCtx, incoming_refs, git_churn, fan_out, detectionFor(s.external_id), ts, nowSec);
     });
     const pScores = normalizeScores(rawScores.map((r) => r.p));
     const iScores = normalizeScores(rawScores.map((r) => r.i));
-    return symbols
+    const ranked = symbols
         .map((s, idx) => {
         const file = symbolFile(s);
-        const incoming_refs = incoming.get(s.external_id) ?? 0;
-        const git_churn = churn.get(file) ?? 0;
+        const incoming_refs = Math.round((incoming.get(s.external_id) ?? 0) * 10) / 10;
+        const git_churn = Math.round(symbolChurn(s));
         const fan_out = fanOut.get(s.external_id) ?? 0;
         const isEntry = entryPoint.get(s.external_id) ?? false;
         const route_weight = deriveRouteWeight(s);
         const data_sensitivity = deriveDataSensitivity(s);
-        const flow_position = Math.max(0, 5 - getFlowDepth(s, graph));
+        const flow_position = Math.max(0, 5 - getFlowDepth(s, depthCtx));
         const complexity_proxy = complexityProxy(s);
         const firstTs = firstCommitTs.get(file) ?? 0;
         const is_new_code = firstTs > 0 && nowSec - firstTs < NEW_CODE_SECONDS;
-        const p = Math.round(pScores[idx]);
-        const i = Math.round(iScores[idx]);
+        // Score on the CONTINUOUS normalized values; rounding P and I to integers
+        // before multiplying previously collapsed whole hot files into identical
+        // P×I×D ties (seventeen ORS-100 rows from one service). Integers remain
+        // display-only in the decomposition string.
+        const pExact = pScores[idx];
+        const iExact = iScores[idx];
+        const p = Math.round(pExact);
+        const i = Math.round(iExact);
         const d = rawScores[idx].d;
-        const detectionTier = associated.has(s.external_id) ? "associated" : "none";
-        const score = p * i * d;
+        const detectionTier = detectionFor(s.external_id);
+        const score = Math.round(pExact * iExact * d * 10) / 10;
         const reasons = [
-            `ORS ${score} = P${p} × I${i} × D${d}`,
-            `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"}`,
-            `${git_churn} git churn line${git_churn === 1 ? "" : "s"} in 180 days`,
+            `ORS ${score} ≈ P${p} × I${i} × D${d}`,
+            `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"} (method-attributed)`,
+            `${git_churn} git churn line${git_churn === 1 ? "" : "s"} attributed to this symbol in 180 days`,
             `route weight ${route_weight}, data sensitivity ${data_sensitivity}, fan-out ${fan_out}`
         ];
         if (isEntry)
             reasons.push("near an API/route/handler entry point");
         if (is_new_code)
             reasons.push("new code (< 30 days)");
+        if (detectionTier === "candidate")
+            reasons.push("lexical candidate test match only — unconfirmed");
         return {
             id: s.external_id,
             title: s.title || s.external_id,
@@ -357,6 +423,31 @@ export function rankRiskGaps(graph, opts = {}) {
             integration_signal: detectionTier
         };
     })
+        .sort((a, b) => b.risk_score - a.risk_score || b.incoming_refs - a.incoming_refs || b.git_churn - a.git_churn || a.id.localeCompare(b.id));
+    // Portfolio diversity: cap how many gaps a single file contributes to the
+    // surfaced list, then backfill with the remaining highest scores if short.
+    const maxPerFile = Math.max(1, opts.maxPerFile ?? 3);
+    const perFile = new Map();
+    const surfaced = [];
+    const overflow = [];
+    for (const gap of ranked) {
+        const used = perFile.get(gap.file) ?? 0;
+        if (used < maxPerFile) {
+            perFile.set(gap.file, used + 1);
+            surfaced.push(gap);
+        }
+        else {
+            overflow.push(gap);
+        }
+        if (surfaced.length >= limit)
+            break;
+    }
+    if (surfaced.length < limit)
+        surfaced.push(...overflow.slice(0, limit - surfaced.length));
+    // Guarantee: the surfaced list is ALWAYS highest-risk-first, even when the
+    // per-file diversity backfill re-admits overflow items (which otherwise land
+    // appended after lower-scored rows).
+    return surfaced
         .sort((a, b) => b.risk_score - a.risk_score || b.incoming_refs - a.incoming_refs || b.git_churn - a.git_churn || a.id.localeCompare(b.id))
         .slice(0, limit);
 }

package/dist/local/util/walk.js

@@ -66,20 +66,21 @@ export function loadIgnore(root) {
             const line = raw.trim();
             if (!line || line.startsWith("#") || line.startsWith("!"))
                 continue;
+            const rootAnchored = line.startsWith("/");
             const cleaned = line.replace(/^\/+/, "").replace(/\/+$/, "");
             if (!cleaned)
                 continue;
-            if (!cleaned.includes("/") && !cleaned.includes("*")) {
+            if (!rootAnchored && !cleaned.includes("/") && !cleaned.includes("*")) {
                 names.add(cleaned);
             }
             else {
-                matchers.push(globToRegExp(cleaned));
+                matchers.push(globToRegExp(cleaned, rootAnchored));
             }
         }
     }
     return { names, matchers };
 }
-function globToRegExp(glob) {
+function globToRegExp(glob, rootAnchored = false) {
     // Use a plain-ASCII sentinel for `**` so the file stays text (no NUL bytes)
     // and `*` substitution does not re-match the globstar.
     const GLOBSTAR = "__ORANGEPRO_GLOBSTAR__";
@@ -90,7 +91,7 @@ function globToRegExp(glob) {
         .split(GLOBSTAR)
         .join(".*")
         .replace(/\?/g, "[^/]");
-    return new RegExp(`(^|/)${escaped}(/|$)`);
+    return new RegExp(`${rootAnchored ? "^" : "(^|/)"}${escaped}(/|$)`);
 }
 function isIgnored(relPath, baseName, rules) {
     if (rules.names.has(baseName))