@orangepro/orangepro-mcp 0.2.37 → 0.2.39

package/dist/local/operations.js

@@ -1,3 +1,4 @@
+import { loadRiskConfig } from "./score/riskConfig.js";
 import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
@@ -1553,6 +1554,10 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     }, deps);
     const warnings = [...analyze.warnings];
     reportProgress("start: deterministic graph is ready", { current: 4, total: 8 });
+    // A per-repo/user risk config that fails to parse must announce itself here, not
+    // silently revert to defaults (round-three review finding #1).
+    for (const w of loadRiskConfig(scanRoot).warnings)
+        warnings.push(w);
     const staticSnapshot = writeStartStaticSnapshot(root, opts.baseRef, warnings);
     const aiProviderConfigured = deps.aiProvider !== undefined || resolveProviderConfig(providerEnv, providerOpts) !== null;
     const resolvedGenerationProvider = deps.aiProvider ?? resolveGenerationProvider(providerEnv, providerOpts);

package/dist/local/score/risk.js

@@ -337,7 +337,7 @@ function computeRawORS(node, depthCtx, incomingRefs, gitChurn, fanOut, detection
     const routeWeight = deriveRouteWeight(node);
     const flowDepth = getFlowDepth(node, depthCtx);
     const flowPosition = Math.max(0, 5 - flowDepth);
-    const dataSensitivity = signals.sensitivityIgnored ? 0 : deriveDataSensitivity(node);
+    const dataSensitivity = signals.sensitivityOverride !== undefined ? signals.sensitivityOverride : signals.sensitivityIgnored ? 0 : deriveDataSensitivity(node);
     // Irreversibility is impact: a bug on a path that reaches a delete/purge cannot be
     // rolled back. Bounded, additive, graph-derived (Fix C, signal 1).
     const rawI = incomingRefs * 0.3 + routeWeight * 0.3 + flowPosition * 0.2 + dataSensitivity * 0.2;
@@ -345,7 +345,7 @@ function computeRawORS(node, depthCtx, incomingRefs, gitChurn, fanOut, detection
     // queue fails where no request surfaces it (Fix C, signal 2). Proven stays proven.
     const silentFactor = signals.scheduledEntry && detectionTier !== "associated" ? 1.25 : 1;
     const d = DETECTION_MAP[detectionTier] * silentFactor;
-    return { p: rawP, i: rawI, d, reachesDestructiveSink: signals.reachesDestructiveSink, scheduledEntry: signals.scheduledEntry, sensitivityIgnored: signals.sensitivityIgnored };
+    return { p: rawP, i: rawI, d, reachesDestructiveSink: signals.reachesDestructiveSink, scheduledEntry: signals.scheduledEntry, sensitivityIgnored: signals.sensitivityIgnored, sensitivityOverride: signals.sensitivityOverride };
 }
 function staticTestLinkedIds(graph, candidateIds) {
     const ids = new Set();
@@ -565,7 +565,10 @@ export function rankRiskGaps(graph, opts = {}) {
         return computeRawORS(s, depthCtx, incoming_refs, git_churn, fan_out, detectionFor(s.external_id), ts, nowSec, {
             reachesDestructiveSink: cfg.tuning.irreversibility_floor && (reachesSink.get(s.external_id) ?? false),
             scheduledEntry: cfg.tuning.silence_multiplier && (isScheduledEntry(s) || (SCHEDULED_ENTRY_NAME_RE.test(s.title || "") && extraScheduled.some((re) => re.test(symbolFile(s))))),
-            sensitivityIgnored: sensitivityIgnore.some((re) => re.test(s.title || "") || re.test(s.external_id)) || overrideFor(s.external_id)?.action === "reclassify" && overrideFor(s.external_id)?.sensitivity === "none"
+            sensitivityIgnored: sensitivityIgnore.some((re) => re.test(s.title || "") || re.test(s.external_id)) || overrideFor(s.external_id)?.action === "reclassify" && overrideFor(s.external_id)?.sensitivity === "none",
+            // reclassify to a named class uses the SAME values deriveDataSensitivity assigns (payment 10, auth 9, pii 8)
+            sensitivityOverride: (() => { const o = overrideFor(s.external_id); if (!o || o.action !== "reclassify")
+                return undefined; return o.sensitivity === "payment" ? 10 : o.sensitivity === "auth" ? 9 : o.sensitivity === "pii" ? 8 : o.sensitivity === "none" ? 0 : undefined; })()
         });
     });
     const pinnedIds = new Set(symbols.filter((s) => overrideFor(s.external_id)?.action === "pin").map((s) => s.external_id));
@@ -583,7 +586,7 @@ export function rankRiskGaps(graph, opts = {}) {
         const fan_out = fanOut.get(s.external_id) ?? 0;
         const isEntry = entryPoint.get(s.external_id) ?? false;
         const route_weight = deriveRouteWeight(s);
-        const data_sensitivity = rawScores[idx].sensitivityIgnored ? 0 : deriveDataSensitivity(s);
+        const data_sensitivity = rawScores[idx].sensitivityOverride !== undefined ? rawScores[idx].sensitivityOverride : rawScores[idx].sensitivityIgnored ? 0 : deriveDataSensitivity(s);
         const flow_position = Math.max(0, 5 - getFlowDepth(s, depthCtx));
         const complexity_proxy = complexityProxy(s);
         const firstTs = firstCommitTs.get(file) ?? 0;
@@ -719,3 +722,39 @@ export function rankRiskGaps(graph, opts = {}) {
 export function rankPriorityGaps(graph, opts = {}) {
     return rankRiskGaps(graph, { ...opts, maxPerFile: 3, maxPerTitle: 1 });
 }
+/** What the per-repo config DID to this ranking — for visible disclosure in the report.
+ *  A tuned report must never pass as clean: every suppression is listed with its reason. */
+export function configDisclosureFor(graph, repoRoot) {
+    const loaded = loadRiskConfig(repoRoot);
+    const cfg = loaded.config;
+    const symbols = graph.nodes.filter((n) => n.kind === "CodeSymbol" && n.denominator_eligible === true && !n.stale);
+    const suppressed = [];
+    for (const o of cfg.overrides) {
+        if (o.action !== "suppress")
+            continue;
+        const re = globToRegExp(o.symbol);
+        for (const n of symbols)
+            if (n.external_id === o.symbol || re.test(n.external_id))
+                suppressed.push({ symbol: n.title || n.external_id, reason: o.reason });
+    }
+    const ignoreRes = cfg.classification.sensitivity_ignore.map(globToRegExp);
+    const sensitivityIgnored = ignoreRes.length
+        ? symbols.filter((n) => ignoreRes.some((re) => re.test(n.title || "") || re.test(n.external_id))).map((n) => n.title || n.external_id).slice(0, 50)
+        : [];
+    return {
+        hash: loaded.hash,
+        warnings: loaded.warnings,
+        overridesActive: cfg.overrides.length,
+        suppressed,
+        rankExcludePaths: cfg.classification.rank_exclude_paths,
+        floor: cfg.tuning.irreversibility_floor,
+        silence: cfg.tuning.silence_multiplier,
+        classification: {
+            test_support_paths: cfg.classification.test_support_paths,
+            scheduled_entry_paths: cfg.classification.scheduled_entry_paths,
+            destructive_sinks: cfg.classification.destructive_sinks,
+            sensitivity_ignore: cfg.classification.sensitivity_ignore
+        },
+        sensitivityIgnored
+    };
+}

package/dist/local/viz/behaviorReportData.js

@@ -1,4 +1,5 @@
 import { loadRiskConfig } from "../score/riskConfig.js";
+import { configDisclosureFor } from "../score/risk.js";
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { buildRtm } from "../rtm.js";
@@ -936,7 +937,9 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         .sort((a, b) => (b.probability ?? 0) - (a.probability ?? 0) || b.risk_score - a.risk_score || a.id.localeCompare(b.id))
         .slice(0, 20)
         .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, probability: r.probability ?? 0 }));
-    const irreversible = wide.filter((r) => r.sink_callee).slice(0, 20)
+    // Fix: search the FULL ranking for sinks, not the top 200 — a stable destructive path
+    // ranked 300th is exactly what this panel exists to recover.
+    const irreversible = rankRiskGaps(graph, { repoRoot, limit: Number.MAX_SAFE_INTEGER, provenIds }).filter((r) => r.sink_callee).slice(0, 20)
         .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, sink: r.sink_callee ?? "" }));
     const riskHealth = inspectRiskInputHealth(repoRoot);
     const churnAvailable = riskHealth.churnAvailable && riskGaps.every((risk) => risk.churn_available !== false);
@@ -950,7 +953,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         toolVersion: ORANGEPRO_VERSION,
         configHash: loadRiskConfig(repoRoot).hash,
         inputFingerprint: createHash("sha256")
-            .update(JSON.stringify({ root: graph.workspace.root_hash, commit: riskHealth.commit, history: riskHealth.history, churn: churnAvailable, window: riskHealth.churnWindow, version: ORANGEPRO_VERSION }))
+            .update(JSON.stringify({ root: graph.workspace.root_hash, commit: riskHealth.commit, history: riskHealth.history, churn: churnAvailable, window: riskHealth.churnWindow, version: ORANGEPRO_VERSION, config: loadRiskConfig(repoRoot).hash }))
             .digest("hex")
             .slice(0, 16),
         reason: churnAvailable ? undefined : (riskHealth.reason ?? "Git churn scan did not complete")
@@ -976,6 +979,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         candidateFlows: candidateFlows(graph),
         risks,
         worklists: { changeFrontier, irreversible },
+        configDisclosure: configDisclosureFor(graph, repoRoot),
         zeroProofExplainer: summary.proven === 0 ? { title: ZERO_PROOF_EXPLAINER.title, body: [...ZERO_PROOF_EXPLAINER.body] } : null,
         mapModel: buildSystemMapModel({ flows: flowRows, risks, behaviors: sortedBehaviors }),
         viewMeta: {

package/dist/local/viz/behaviorReportHtml.js

@@ -181,6 +181,11 @@ nav.tabs{display:flex;gap:2px;margin:18px 0 0;border-bottom:1px solid var(--bd)}
 .wl-path{color:var(--ink2);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
 .wl-meta{color:var(--faint);flex-shrink:0;max-width:46%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
 .wl-empty{font-size:11.5px;color:var(--faint);padding:6px 0}
+.cfg{margin:0 0 12px;padding:8px 12px;border:1px solid var(--bd);border-radius:7px;background:var(--s1);font:11px/1.55 var(--mono);color:var(--muted)}
+.cfg b{color:var(--ink2);font-weight:600}
+.cfg.cfg-warn{border-color:var(--rbd);background:var(--rbg);color:var(--red)}
+.cfg.cfg-tuned{border-color:var(--obd);background:var(--obg);color:var(--ink2)}
+.cfg-row{display:block;margin-top:3px}
 @media(max-width:800px){.wl-grid{grid-template-columns:1fr}}
 .risk-filter{appearance:none;border:1px solid var(--bd);background:var(--s1);color:var(--muted);border-radius:20px;padding:5px 10px;font:inherit;font-size:12px;font-weight:600;cursor:pointer}
 .risk-filter:hover{border-color:var(--bd2);color:var(--ink2)}
@@ -436,6 +441,7 @@ body[data-mode="expert"] .simple-only{display:none!important}
   <p class="bridge expert-only">This is the <b>priority-gap worklist</b>, ranked by blast radius and test weakness. It is separate from the coverage-status cards above: <b>Reachable · no test signal</b> is one strict coverage bucket, not the number of priority gaps.</p>
   <p class="bridge" id="risk-cap-note" style="font-size:12px;opacity:.75"></p>
   <div class="risk-tools" id="risk-tools"></div>
+  <div id="config-disclosure"></div>
   <div id="worklists"></div>
   <div id="risk-list"></div>
 </section>
@@ -1022,6 +1028,27 @@ riskTools.addEventListener("click",e=>{
 });
 renderRiskFilters();
 renderRisks();
+// ── Config disclosure: what the per-repo config did. Always rendered — a tuned
+// report must never pass as clean, and a broken config must announce itself.
+(function(){
+  const C=D.configDisclosure, host=$("#config-disclosure");
+  if(!C||!host)return;
+  const warn=(C.warnings||[]).length>0;
+  const K=C.classification||{};
+  const clsSet=["test_support_paths","scheduled_entry_paths","destructive_sinks","sensitivity_ignore"].filter(k=>(K[k]||[]).length>0);
+  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0;
+  const bits=["config <b>"+esc(C.hash)+"</b>","overrides active <b>"+C.overridesActive+"</b>","suppressed <b>"+(C.suppressed||[]).length+"</b>"];
+  if((C.rankExcludePaths||[]).length)bits.push("ranking excludes <b>"+esc(C.rankExcludePaths.join(", "))+"</b>");
+  if(!C.floor)bits.push("<b>irreversibility floor OFF</b>");
+  if(!C.silence)bits.push("<b>silence multiplier OFF</b>");
+  let html="<div>"+bits.join(" · ")+"</div>";
+  clsSet.forEach(k=>{html+='<span class="cfg-row">'+esc(k)+': <b>'+esc(K[k].join(", "))+'</b></span>';});
+  if((C.sensitivityIgnored||[]).length)html+='<span class="cfg-row">sensitivity ignored by config (score changed): <b>'+esc(C.sensitivityIgnored.join(", "))+'</b></span>';
+  (C.suppressed||[]).forEach(s=>{html+='<span class="cfg-row">suppressed by config: <b>'+esc(s.symbol)+'</b> — '+esc(s.reason)+'</span>';});
+  (C.warnings||[]).forEach(w=>{html+='<span class="cfg-row">⚠ '+esc(w)+'</span>';});
+  host.className="cfg"+(warn?" cfg-warn":tuned?" cfg-tuned":"");
+  host.innerHTML=html;
+})();
 // ── Worklists: two views of ONE ranking. A single P×I×D top-20 cannot hold
 // "changing fast" and "irreversible but stable" together; both are shown here.
 (function(){

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.37",
+  "version": "0.2.39",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",