@orangepro/orangepro-mcp 0.2.36 → 0.2.37

package/dist/local/score/riskConfig.js

@@ -8,6 +8,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { homedir } from "node:os";
 export const DEFAULT_RISK_CONFIG = {
     classification: { test_support_paths: [], scheduled_entry_paths: [], destructive_sinks: [], sensitivity_ignore: [], rank_exclude_paths: [] },
     tuning: { irreversibility_floor: true, silence_multiplier: true },
@@ -21,41 +22,50 @@ export function globToRegExp(glob) {
     const esc = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\u0000").replace(/\*/g, "[^/]*").replace(/\u0000/g, ".*");
     return new RegExp(`^${esc}$`);
 }
-export function loadRiskConfig(repoRoot) {
-    const warnings = [];
-    const cfg = JSON.parse(JSON.stringify(DEFAULT_RISK_CONFIG));
-    const file = join(repoRoot, ".orangepro", "config.json");
-    if (repoRoot && existsSync(file)) {
-        try {
-            const raw = JSON.parse(readFileSync(file, "utf8"));
-            const cls = (raw.classification ?? {});
-            cfg.classification.test_support_paths = asStringArray(cls.test_support_paths);
-            cfg.classification.scheduled_entry_paths = asStringArray(cls.scheduled_entry_paths);
-            cfg.classification.destructive_sinks = asStringArray(cls.destructive_sinks);
-            cfg.classification.sensitivity_ignore = asStringArray(cls.sensitivity_ignore);
-            cfg.classification.rank_exclude_paths = asStringArray(cls.rank_exclude_paths);
-            const tun = (raw.tuning ?? {});
-            if (typeof tun.irreversibility_floor === "boolean")
-                cfg.tuning.irreversibility_floor = tun.irreversibility_floor;
-            if (typeof tun.silence_multiplier === "boolean")
-                cfg.tuning.silence_multiplier = tun.silence_multiplier;
-            for (const o of Array.isArray(raw.overrides) ? raw.overrides : []) {
-                const ov = o;
-                if (typeof ov.symbol !== "string" || !["suppress", "pin", "reclassify"].includes(ov.action ?? "")) {
-                    warnings.push(`config: override ignored (needs symbol + action): ${JSON.stringify(o).slice(0, 80)}`);
-                    continue;
-                }
-                if (typeof ov.reason !== "string" || ov.reason.trim().length < 8) {
-                    warnings.push(`config: override for ${ov.symbol} ignored — a reason (≥8 chars) is required so it can be shown on the report.`);
-                    continue;
-                }
-                cfg.overrides.push({ symbol: ov.symbol, action: ov.action, sensitivity: ov.sensitivity, reason: ov.reason.trim() });
-            }
+/** User-level defaults: ~/.orangepro/config.json (override with ORANGEPRO_USER_CONFIG for tests/CI).
+ *  Applied FIRST; the analyzed repo's .orangepro/config.json wins on every key it sets.
+ *  The hash covers the merged result, so provenance still tells the truth. */
+export function userConfigPath() {
+    return process.env.ORANGEPRO_USER_CONFIG ?? join(homedir(), ".orangepro", "config.json");
+}
+function applyFile(cfg, file, warnings, label) {
+    if (!existsSync(file))
+        return;
+    try {
+        const raw = JSON.parse(readFileSync(file, "utf8"));
+        const cls = (raw.classification ?? {});
+        for (const k of ["test_support_paths", "scheduled_entry_paths", "destructive_sinks", "sensitivity_ignore", "rank_exclude_paths"]) {
+            if (Array.isArray(cls[k]))
+                cfg.classification[k] = asStringArray(cls[k]);
         }
-        catch (err) {
-            warnings.push(`config: .orangepro/config.json unreadable for risk settings (${err.message}); defaults used.`);
+        const tun = (raw.tuning ?? {});
+        if (typeof tun.irreversibility_floor === "boolean")
+            cfg.tuning.irreversibility_floor = tun.irreversibility_floor;
+        if (typeof tun.silence_multiplier === "boolean")
+            cfg.tuning.silence_multiplier = tun.silence_multiplier;
+        for (const o of Array.isArray(raw.overrides) ? raw.overrides : []) {
+            const ov = o;
+            if (typeof ov.symbol !== "string" || !["suppress", "pin", "reclassify"].includes(ov.action ?? "")) {
+                warnings.push(`config (${label}): override ignored (needs symbol + action): ${JSON.stringify(o).slice(0, 80)}`);
+                continue;
+            }
+            if (typeof ov.reason !== "string" || ov.reason.trim().length < 8) {
+                warnings.push(`config (${label}): override for ${ov.symbol} ignored — a reason (≥8 chars) is required so it can be shown on the report.`);
+                continue;
+            }
+            cfg.overrides.push({ symbol: ov.symbol, action: ov.action, sensitivity: ov.sensitivity, reason: ov.reason.trim() });
         }
     }
+    catch (err) {
+        warnings.push(`config (${label}): unreadable for risk settings (${err.message}); skipped.`);
+    }
+}
+export function loadRiskConfig(repoRoot) {
+    const warnings = [];
+    const cfg = JSON.parse(JSON.stringify(DEFAULT_RISK_CONFIG));
+    applyFile(cfg, userConfigPath(), warnings, "user defaults");
+    if (repoRoot)
+        applyFile(cfg, join(repoRoot, ".orangepro", "config.json"), warnings, "repo");
     const canonical = JSON.stringify(cfg, Object.keys(cfg).sort());
     const hash = createHash("sha256").update(JSON.stringify(cfg)).digest("hex").slice(0, 12);
     void canonical;

package/dist/local/viz/behaviorReportHtml.js

@@ -169,6 +169,19 @@ nav.tabs{display:flex;gap:2px;margin:18px 0 0;border-bottom:1px solid var(--bd)}
 /* RISKS */
 .risk-card{background:var(--s1);border:1px solid var(--bd);border-radius:9px;padding:14px 16px;margin-bottom:10px}
 .risk-tools{display:flex;align-items:center;gap:8px;margin:0 0 12px;flex-wrap:wrap}
+/* WORKLISTS — two views of one ranking */
+.wl-grid{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin:0 0 14px}
+.wl-card{background:var(--s1);border:1px solid var(--bd);border-radius:9px;padding:12px 14px}
+.wl-title{font-size:11px;font-weight:700;letter-spacing:.04em;text-transform:uppercase;margin:0 0 2px}
+.wl-title.wl-change{color:var(--amber)} .wl-title.wl-irrev{color:var(--red)}
+.wl-sub{font-size:11px;color:var(--muted);margin:0 0 8px;line-height:1.45}
+.wl-row{display:flex;justify-content:space-between;gap:8px;padding:4px 0;border-bottom:1px solid var(--bd);font-family:var(--mono);font-size:11px;cursor:pointer}
+.wl-row:last-child{border-bottom:0}
+.wl-row:hover .wl-path{color:var(--ink)}
+.wl-path{color:var(--ink2);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.wl-meta{color:var(--faint);flex-shrink:0;max-width:46%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.wl-empty{font-size:11.5px;color:var(--faint);padding:6px 0}
+@media(max-width:800px){.wl-grid{grid-template-columns:1fr}}
 .risk-filter{appearance:none;border:1px solid var(--bd);background:var(--s1);color:var(--muted);border-radius:20px;padding:5px 10px;font:inherit;font-size:12px;font-weight:600;cursor:pointer}
 .risk-filter:hover{border-color:var(--bd2);color:var(--ink2)}
 .risk-filter[aria-pressed="true"]{border-color:var(--orange);background:var(--obg);color:var(--orange)}
@@ -423,6 +436,7 @@ body[data-mode="expert"] .simple-only{display:none!important}
   <p class="bridge expert-only">This is the <b>priority-gap worklist</b>, ranked by blast radius and test weakness. It is separate from the coverage-status cards above: <b>Reachable · no test signal</b> is one strict coverage bucket, not the number of priority gaps.</p>
   <p class="bridge" id="risk-cap-note" style="font-size:12px;opacity:.75"></p>
   <div class="risk-tools" id="risk-tools"></div>
+  <div id="worklists"></div>
   <div id="risk-list"></div>
 </section>
 
@@ -1008,6 +1022,24 @@ riskTools.addEventListener("click",e=>{
 });
 renderRiskFilters();
 renderRisks();
+// ── Worklists: two views of ONE ranking. A single P×I×D top-20 cannot hold
+// "changing fast" and "irreversible but stable" together; both are shown here.
+(function(){
+  const W=D.worklists, host=$("#worklists");
+  if(!W||!host)return;
+  const topPaths=new Set(D.risks.map(r=>r.path));
+  const row=(path,meta)=>{
+    const inTop=topPaths.has(path);
+    return \`<div class="wl-row" data-path="\${esc(path).replace(/"/g,'&quot;')}" title="\${inTop?'in the ranked list below — click to jump':'ranked, but below the top-20 cut'}"><span class="wl-path">\${esc(path)}</span><span class="wl-meta">\${esc(meta)}</span></div>\`;
+  };
+  const cf=(W.changeFrontier||[]).map(r=>row(r.path,"changes "+(r.probability>=7?"a lot":r.probability>=4?"often":"some"))).join("")||'<div class="wl-empty">nothing changing fast and unproven</div>';
+  const ir=(W.irreversible||[]).map(r=>row(r.path,"→ "+(r.sink||"").split(".").pop())).join("")||'<div class="wl-empty">no unproven path reaches a delete</div>';
+  host.innerHTML=\`<div class="wl-grid">
+    <div class="wl-card"><p class="wl-title wl-change">Changing fast · unproven</p><p class="wl-sub">Where the code moves most with nothing proving it. The place a bug is most likely to have just arrived.</p>\${cf}</div>
+    <div class="wl-card"><p class="wl-title wl-irrev">Can destroy data · unproven</p><p class="wl-sub">Paths that reach a delete or purge with nothing proving they do the right thing. Rarely changing — which is why nobody looks.</p>\${ir}</div>
+  </div>\`;
+  host.addEventListener("click",e=>{const r=e.target.closest("[data-path]");if(r&&topPaths.has(r.getAttribute("data-path")))scrollToRisk(r.getAttribute("data-path"));});
+})();
 // toggle test expand
 document.addEventListener('click',e=>{
   const h=e.target.closest('.gen-test-head');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",