@orangepro/orangepro-mcp 0.2.40 → 0.2.42

package/dist/local/analyze/analyzer.js

@@ -10,6 +10,7 @@ import { buildImportGraph } from "../resolve/importGraph.js";
 import { walkBarrel } from "../resolve/barrelWalker.js";
 import { resetResolverCaches } from "../resolve/resolver.js";
 import { resetExportIndexCache } from "../resolve/exportIndex.js";
+import { builtInRankExclusion } from "../score/rankEligibility.js";
 import { baseName, extOf, GENERATED_CODE_REASON, isGeneratedCode, isNonProductPath, NON_PRODUCT_REASON, isTestSupportPath, languageOf, manifestKindOf, roleOf } from "./classify.js";
 import { classifyTestLayer } from "./testLayer.js";
 import { detectFromPackageJson, detectFrameworksFromManifest, detectManifestPackage, frameworkFromConfig } from "./frameworks.js";
@@ -142,6 +143,59 @@ function behaviorSurfaceReason(relPath, name, memberOf) {
     return null;
 }
 const RUNTIME_SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?)$/i;
+/**
+ * Return qualified `Class.run` symbols whose class extends a CLI command base
+ * imported from a known runtime package. This is deliberately import-scoped:
+ * a local class merely named Command/SfCommand never becomes an entry point.
+ */
+function cliEntrySymbols(content) {
+    const out = new Map();
+    const sourceFile = ts.createSourceFile("cli-entry.tsx", content, ts.ScriptTarget.Latest, false, ts.ScriptKind.TSX);
+    const importedBases = new Map();
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isImportDeclaration(stmt) || !ts.isStringLiteral(stmt.moduleSpecifier) || !stmt.importClause || stmt.importClause.isTypeOnly)
+            continue;
+        const source = stmt.moduleSpecifier.text;
+        const framework = source === "@oclif/core" ? "oclif" :
+            source === "@salesforce/sf-plugins-core" ? "salesforce-cli" :
+                source === "commander" ? "commander" :
+                    undefined;
+        if (!framework)
+            continue;
+        const bindings = stmt.importClause.namedBindings;
+        if (!bindings || !ts.isNamedImports(bindings))
+            continue;
+        for (const element of bindings.elements) {
+            if (element.isTypeOnly)
+                continue;
+            const imported = element.propertyName?.text ?? element.name.text;
+            if (imported === "Command" || imported === "SfCommand")
+                importedBases.set(element.name.text, framework);
+        }
+    }
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isClassDeclaration(stmt) || !stmt.name)
+            continue;
+        let framework;
+        for (const clause of stmt.heritageClauses ?? []) {
+            if (clause.token !== ts.SyntaxKind.ExtendsKeyword)
+                continue;
+            for (const type of clause.types) {
+                if (ts.isIdentifier(type.expression))
+                    framework = importedBases.get(type.expression.text) ?? framework;
+            }
+        }
+        if (!framework)
+            continue;
+        const hasRun = stmt.members.some((member) => ts.isMethodDeclaration(member) &&
+            !!member.body &&
+            ts.isIdentifier(member.name) &&
+            member.name.text === "run");
+        if (hasRun)
+            out.set(`${stmt.name.text}.run`, framework);
+    }
+    return out;
+}
 /**
  * Resolve package-level public entry modules from package metadata and the two
  * conventional source entry paths. This gives libraries a semantic behavior
@@ -487,6 +541,20 @@ export function analyzeRepo(root, opts = {}) {
         if (set.size < 32)
             set.add(name);
     };
+    // Stronger than an unanchored receiver name: the qualifier is a runtime
+    // binding imported from a bare external module. Preserve that provenance so
+    // risk scoring can recognize replacement operations without treating every
+    // local `replace*` method as destructive.
+    const importedStaticCalleesByCaller = new Map();
+    const recordImportedStaticCallee = (callerId, name) => {
+        let set = importedStaticCalleesByCaller.get(callerId);
+        if (!set) {
+            set = new Set();
+            importedStaticCalleesByCaller.set(callerId, set);
+        }
+        if (set.size < 32)
+            set.add(name);
+    };
     // Raw (caller, callee) call pairs per TS/JS code file, resolved after the
     // import graph is built (cross-file calls need its bindings + targets).
     const rawCallsByFile = new Map();
@@ -830,6 +898,7 @@ export function analyzeRepo(root, opts = {}) {
                 const extraction = opts.parseCache
                     ? opts.parseCache.symbols(file.hash, `${language}#${extractionBackend(language)}`, () => extractFileSymbols(content, language))
                     : extractFileSymbols(content, language);
+                const cliEntries = language === "typescript" || language === "javascript" ? cliEntrySymbols(content) : new Map();
                 if (extraction.truncated)
                     symbolFilesTruncated++;
                 for (const sym of extraction.symbols) {
@@ -860,15 +929,18 @@ export function analyzeRepo(root, opts = {}) {
                     const surfaceExclusionReason = callableBehaviorCandidate
                         ? behaviorSurfaceExclusionReason(file.relPath, sym.name, sym.member_of)
                         : null;
+                    const cliFramework = cliEntries.get(sym.name);
+                    const cliDenominatorOverride = Boolean(cliFramework) && callableBehaviorCandidate;
                     const surfaceReason = nonTsClassBehavior
                         ? "Non-TS class/constructor behavior surface — countable for language proof."
                         : callableBehaviorCandidate && !surfaceExclusionReason
                             ? behaviorSurfaceReason(file.relPath, sym.name, sym.member_of)
                             : null;
                     const publicApiEntry = callableBehaviorCandidate && !surfaceExclusionReason && publicEntryFiles.has(file.relPath);
-                    const eligible = callableBehaviorCandidate && (surfaceReason !== null || publicApiEntry);
-                    const behaviorSurfaceExcluded = callableBehaviorCandidate && surfaceExclusionReason !== null;
+                    const eligible = cliDenominatorOverride || (callableBehaviorCandidate && (surfaceReason !== null || publicApiEntry));
+                    const behaviorSurfaceExcluded = callableBehaviorCandidate && surfaceExclusionReason !== null && !cliDenominatorOverride;
                     const notEntryPointAdjacent = callableBehaviorCandidate && !eligible && !behaviorSurfaceExcluded;
+                    const rankingExclusion = builtInRankExclusion(file.relPath);
                     if (isBoilerplate)
                         excludedBoilerplate++;
                     nodes.push(makeNode({
@@ -881,10 +953,27 @@ export function analyzeRepo(root, opts = {}) {
                             ...(sym.start_line ? { start_line: sym.start_line } : {}),
                             ...(sym.end_line ? { end_line: sym.end_line } : {}),
                             ...(sym.member_of ? { member_of: sym.member_of } : {}),
+                            ...(cliFramework ? { cli_entrypoint: true, entry_lane: "cli", cli_framework: cliFramework } : {}),
                             ...(sym.callable !== undefined ? { callable_const: sym.callable } : {}),
-                            ...(surfaceReason ? { behavior_surface: "entrypoint_adjacent" } : publicApiEntry ? { behavior_surface: "public_api_entry" } : {}),
+                            ...(cliDenominatorOverride
+                                ? {
+                                    behavior_surface: "cli_command_entry",
+                                    denominator_reason_code: "cli_command_entry",
+                                    ...(surfaceExclusionReason ? { denominator_override_from: surfaceExclusionReason } : {})
+                                }
+                                : surfaceReason
+                                    ? { behavior_surface: "entrypoint_adjacent" }
+                                    : publicApiEntry
+                                        ? { behavior_surface: "public_api_entry" }
+                                        : {}),
                             ...(behaviorSurfaceExcluded ? { denominator_reason_code: "infra_behavior_surface" } : {}),
-                            ...(notEntryPointAdjacent ? { denominator_reason_code: "not_entry_point_adjacent" } : {})
+                            ...(notEntryPointAdjacent ? { denominator_reason_code: "not_entry_point_adjacent" } : {}),
+                            ...(rankingExclusion
+                                ? {
+                                    ranking_exclusion_reason_code: rankingExclusion.code,
+                                    ranking_exclusion_reason: rankingExclusion.reason
+                                }
+                                : {})
                         },
                         evidence_strength: "hard",
                         review_status: "auto_detected",
@@ -900,17 +989,19 @@ export function analyzeRepo(root, opts = {}) {
                                     ? GENERATED_CODE_REASON
                                     : isBoilerplate
                                         ? BOILERPLATE_REASON
-                                        : eligible && surfaceReason
-                                            ? surfaceReason
-                                            : publicApiEntry
-                                                ? "Callable export from a package public entry module — countable library behavior surface."
-                                                : behaviorSurfaceExcluded && surfaceExclusionReason
-                                                    ? surfaceExclusionReason
-                                                    : callableBehaviorCandidate
-                                                        ? "Callable export is not API/service/route/job-adjacent — kept for grounding, excluded from the behavior denominator."
-                                                        : sym.symbol_kind === "class"
-                                                            ? "Exported class container — kept for grounding; methods/functions carry behavior in v1."
-                                                            : "Exported const (not provably callable) — excluded from the denominator in v1."
+                                        : cliDenominatorOverride
+                                            ? `Verified ${cliFramework} CLI command run() entry — countable behavior surface${surfaceExclusionReason ? `; overrides: ${surfaceExclusionReason}` : "."}`
+                                            : eligible && surfaceReason
+                                                ? surfaceReason
+                                                : publicApiEntry
+                                                    ? "Callable export from a package public entry module — countable library behavior surface."
+                                                    : behaviorSurfaceExcluded && surfaceExclusionReason
+                                                        ? surfaceExclusionReason
+                                                        : callableBehaviorCandidate
+                                                            ? "Callable export is not API/service/route/job-adjacent — kept for grounding, excluded from the behavior denominator."
+                                                            : sym.symbol_kind === "class"
+                                                                ? "Exported class container — kept for grounding; methods/functions carry behavior in v1."
+                                                                : "Exported const (not provably callable) — excluded from the denominator in v1."
                     }));
                     edges.push(makeEdge({
                         from_external_id: symId,
@@ -1075,10 +1166,18 @@ export function analyzeRepo(root, opts = {}) {
         const importBindingsByFile = new Map();
         const typeBindingsByFile = new Map();
         const namespaceBindingsByFile = new Map();
+        const externalRuntimeBindingsByFile = new Map();
         for (const e of importGraph.edges) {
+            const fromRel = relByAbs.get(path.resolve(e.from));
+            if (fromRel && e.importKind === "runtime" && e.category === "bare-external") {
+                let bindings = externalRuntimeBindingsByFile.get(fromRel);
+                if (!bindings)
+                    externalRuntimeBindingsByFile.set(fromRel, (bindings = new Set()));
+                for (const binding of e.bindings)
+                    bindings.add(binding.local);
+            }
             if (!e.resolved || e.external || !e.target)
                 continue;
-            const fromRel = relByAbs.get(path.resolve(e.from));
             const targetRel = relByAbs.get(path.resolve(e.target));
             // Skip targets outside the scanned set (ignored/generated files): no node to link.
             if (!fromRel || !targetRel || fromRel === targetRel)
@@ -1264,6 +1363,7 @@ export function analyzeRepo(root, opts = {}) {
             const imports = importBindingsByFile.get(rel);
             const typeImports = typeBindingsByFile.get(rel);
             const namespaces = namespaceBindingsByFile.get(rel);
+            const externalRuntimeBindings = externalRuntimeBindingsByFile.get(rel);
             for (const c of calls) {
                 if (!localSyms.has(c.caller))
                     continue; // caller must be an emitted symbol
@@ -1323,6 +1423,9 @@ export function analyzeRepo(root, opts = {}) {
                                 queueMay(callerId, cands[0], rel, 0.65, `Imported-binding member match: the qualifier is imported from the module defining the only *.method symbol.`);
                             }
                         }
+                        if (externalRuntimeBindings?.has(c.qualifier)) {
+                            recordImportedStaticCallee(callerId, `${c.qualifier}.${c.callee}`);
+                        }
                         // A non-imported (local/param) qualifier is NOT anchored — no edge.
                         if (!ns && !qImport)
                             recordExternalCallee(callerId, `${c.qualifier}.${c.callee}`); // round two: retain by name
@@ -1961,16 +2064,6 @@ export function analyzeRepo(root, opts = {}) {
                 }
             }
         }
-        // Fix B: persist retained callee names on their caller symbols (names only).
-        if (externalCalleesByCaller.size > 0) {
-            const byId = new Map(nodes.map((n) => [n.external_id, n]));
-            for (const [callerId, names] of externalCalleesByCaller) {
-                const n = byId.get(callerId);
-                if (!n)
-                    continue;
-                n.properties = { ...(n.properties ?? {}), external_callees: [...names].sort() };
-            }
-        }
         const seenGoProof = new Set();
         const proofVerifiedAt = scanStartMs;
         for (const [testRel, structure] of goTestStructureByFile) {
@@ -2075,6 +2168,25 @@ export function analyzeRepo(root, opts = {}) {
             }
         }
     }
+    // Persist retained callees for every language mix. This must live outside the
+    // non-TS conditional: a TypeScript-only repository still needs its unresolved
+    // external and import-anchored static calls available to risk scoring.
+    if (externalCalleesByCaller.size > 0 || importedStaticCalleesByCaller.size > 0) {
+        const byId = new Map(nodes.map((n) => [n.external_id, n]));
+        const callerIds = new Set([...externalCalleesByCaller.keys(), ...importedStaticCalleesByCaller.keys()]);
+        for (const callerId of callerIds) {
+            const n = byId.get(callerId);
+            if (!n)
+                continue;
+            const external = externalCalleesByCaller.get(callerId);
+            const importedStatic = importedStaticCalleesByCaller.get(callerId);
+            n.properties = {
+                ...(n.properties ?? {}),
+                ...(external?.size ? { external_callees: [...external].sort() } : {}),
+                ...(importedStatic?.size ? { imported_static_callees: [...importedStatic].sort() } : {})
+            };
+        }
+    }
     // ---- Static assertion candidates (Phase 4 / Gate 2): TypeChecker-derived hard edges ----
     // Upgrade resolver-derived test->source candidates to HARD TESTED_BY/COVERS
     // ONLY where the 5-conjunct confirmer proves a runtime, asserted use of a real
@@ -2157,7 +2269,7 @@ export function analyzeRepo(root, opts = {}) {
             involved.add(c.implAbs);
         }
         if (candidates.length === 0) {
-            confirmedCoverage = { confirmed_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: 0 };
+            confirmedCoverage = { confirmed_pairs: 0, associated_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: 0 };
         }
         else
             try {
@@ -2174,7 +2286,7 @@ export function analyzeRepo(root, opts = {}) {
                     })
                     : { candidates, riskSymbols: 0, involvedFiles: involved.size };
                 if (involved.size > confirmBudget && scoped.candidates.length === 0) {
-                    confirmedCoverage = { confirmed_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: involved.size };
+                    confirmedCoverage = { confirmed_pairs: 0, associated_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: involved.size };
                     warnings.push(`Static confirmation skipped: ${involved.size} files exceed the confirmer budget (${confirmBudget}), and no high-risk subset fit. Use \`--base <ref>\` for PR-scoped confirmation, or raise ORANGEPRO_MAX_CONFIRM_FILES.`);
                 }
                 else {
@@ -2195,8 +2307,28 @@ export function analyzeRepo(root, opts = {}) {
                             lastVerified: proofVerifiedAt
                         }));
                     }
+                    let associatedPairs = 0;
+                    for (const c of result.associations) {
+                        const edgeKey = `test:${c.testRel}|${c.symId}`;
+                        if (seenEdge.has(edgeKey))
+                            continue;
+                        seenEdge.add(edgeKey);
+                        associatedPairs++;
+                        edges.push(...makeProofEdges({
+                            testRel: c.testRel,
+                            symId: c.symId,
+                            provenance: prov(c.testRel, hashString(`${c.symId}:runtime-invocation`)),
+                            lastVerified: proofVerifiedAt,
+                            properties: {
+                                static_association: "runtime_invocation",
+                                assertion_observed: false,
+                                association_reason: c.reason
+                            }
+                        }));
+                    }
                     confirmedCoverage = {
                         confirmed_pairs: confirmedPairs,
+                        associated_pairs: associatedPairs,
                         attempted: result.attempted,
                         capped_downgrades: result.capped_downgrades,
                         skipped_files_budget: involved.size > confirmBudget ? involved.size : 0,
@@ -2222,7 +2354,7 @@ export function analyzeRepo(root, opts = {}) {
                 // or a TS compiler-API edge must NEVER crash analyze. Degrade to
                 // candidate-only coverage with a disclosure.
                 const msg = err instanceof Error ? err.message : String(err);
-                confirmedCoverage = { confirmed_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: 0 };
+                confirmedCoverage = { confirmed_pairs: 0, associated_pairs: 0, attempted: 0, capped_downgrades: 0, skipped_files_budget: 0 };
                 warnings.push(`Static confirmation skipped: the structural confirmer could not run on this project (${msg.slice(0, 160)}). Coverage is reported from candidate links only.`);
             }
     }
@@ -2230,6 +2362,7 @@ export function analyzeRepo(root, opts = {}) {
     if (nonTsHardProofAttempted > 0) {
         confirmedCoverage = {
             confirmed_pairs: (confirmedCoverage?.confirmed_pairs ?? 0) + goProofConfirmedPairs + javaProofConfirmedPairs + pythonProofConfirmedPairs,
+            associated_pairs: confirmedCoverage?.associated_pairs ?? 0,
             attempted: (confirmedCoverage?.attempted ?? 0) + nonTsHardProofAttempted,
             capped_downgrades: confirmedCoverage?.capped_downgrades ?? 0,
             skipped_files_budget: confirmedCoverage?.skipped_files_budget ?? 0
@@ -2412,6 +2545,7 @@ export function analyzeRepo(root, opts = {}) {
         files_scanned: filesProcessed,
         files_cap_hit: filesCapHit,
         max_files: maxFiles,
+        max_symbols: maxSymbols,
         ...(budgetStopped
             ? { not_analyzed_due_to_budget: { files_not_analyzed: filesNotAnalyzed, elapsed_ms: elapsedMs, budget_ms: budgetMs } }
             : {}),

package/dist/local/analyze/classify.js

@@ -75,10 +75,14 @@ export function languageOf(relPath) {
 export function isTestFile(relPath) {
     const p = relPath.toLowerCase();
     const file = relPath.split("/").pop() || relPath;
+    // CLI frameworks commonly use `src/commands/<topic>/test/` as a PRODUCT
+    // command namespace (for example `agent test run`), not as a test suite.
+    // Explicit test filenames and real test roots remain authoritative.
+    const cliTestCommandNamespace = /(^|\/)src\/commands\/(?:[^/]+\/)*test\//.test(p);
     return (/\.(test|spec)\.[a-z]+$/.test(p) ||
         /(^|\/)test\.[cm]?[jt]sx?$/.test(p) ||
         /(^|\/)__tests__\//.test(p) ||
-        /(^|\/)(tests?|e2e|cypress|spec)\//.test(p) ||
+        (!cliTestCommandNamespace && /(^|\/)(tests?|e2e|cypress|spec)\//.test(p)) ||
         /(^|\/)(unit|integration|functional|acceptance)tests?\//.test(p) ||
         /_test\.(py|go)$/.test(p) ||
         /test_.*\.py$/.test(p) ||

package/dist/local/analyze/confirm.js

@@ -572,6 +572,21 @@ export function confirmBehaviors(ctx, testAbsPath, implAbsPath, behaviorNames) {
         return out;
     }
     const implNorm = norm(implAbsPath);
+    const implSf = program.getSourceFile(implNorm);
+    const hasModifier = (node, kind) => ts.canHaveModifiers(node) && (ts.getModifiers(node)?.some((m) => m.kind === kind) ?? false);
+    const cliCommandClasses = new Set();
+    let defaultCliCommandClass = null;
+    for (const statement of implSf?.statements ?? []) {
+        if (!ts.isClassDeclaration(statement) || !statement.name)
+            continue;
+        const extendsCliCommand = statement.heritageClauses?.some((clause) => clause.token === ts.SyntaxKind.ExtendsKeyword &&
+            clause.types.some((t) => /(?:^|\.)(?:Sf)?Command$/.test(t.expression.getText(implSf)))) ?? false;
+        if (!extendsCliCommand || !memberTargetsByClass.has(statement.name.text))
+            continue;
+        cliCommandClasses.add(statement.name.text);
+        if (hasModifier(statement, ts.SyntaxKind.DefaultKeyword))
+            defaultCliCommandClass = statement.name.text;
+    }
     // Resolve an identifier's binding to a terminal export name in implAbsPath, or
     // null. Follows aliases (renames, re-export barrels) to the defining file.
     const resolvedTargetName = (id) => {
@@ -918,6 +933,7 @@ export function confirmBehaviors(ctx, testAbsPath, implAbsPath, behaviorNames) {
     const constructorBindings = new Map();
     const prototypeBindings = new Map();
     const mutatorAliases = new Map();
+    const loadedModuleBindings = new Map();
     const unwrapExpression = (expr) => {
         let current = expr;
         while (ts.isParenthesizedExpression(current) ||
@@ -930,6 +946,38 @@ export function confirmBehaviors(ctx, testAbsPath, implAbsPath, behaviorNames) {
         }
         return current;
     };
+    const loadedModuleFromEsmock = (expr) => {
+        const value = unwrapExpression(expr);
+        if (!ts.isCallExpression(value) ||
+            !ts.isIdentifier(value.expression) ||
+            !importedFromPkg(value.expression, ["esmock"]) ||
+            value.arguments.length === 0) {
+            return null;
+        }
+        const spec = unwrapExpression(value.arguments[0]);
+        if (!ts.isStringLiteralLike(spec))
+            return null;
+        const resolved = resolveImport(spec.text, testAbsPath);
+        if (!resolved.resolvedFileName || norm(resolved.resolvedFileName) !== implNorm)
+            return null;
+        return {
+            src: { file: implNorm, importedName: "default", typeOnly: false },
+            defaultClassName: defaultCliCommandClass
+        };
+    };
+    const loadedDefaultClassBinding = (expr) => {
+        const value = unwrapExpression(expr);
+        if (!ts.isPropertyAccessExpression(value) || value.name.text !== "default")
+            return null;
+        const receiver = unwrapExpression(value.expression);
+        if (!ts.isIdentifier(receiver))
+            return null;
+        const sym = checker.getSymbolAtLocation(receiver);
+        const loaded = sym ? loadedModuleBindings.get(sym) : undefined;
+        if (!loaded?.defaultClassName)
+            return null;
+        return { className: loaded.defaultClassName, src: loaded.src, fromNest: false };
+    };
     const numericIndex = (expr) => {
         const index = unwrapExpression(expr);
         if (ts.isNumericLiteral(index))
@@ -1159,7 +1207,13 @@ export function confirmBehaviors(ctx, testAbsPath, implAbsPath, behaviorNames) {
         if (ts.isIdentifier(receiver)) {
             const sym = checker.getSymbolAtLocation(receiver);
             const binding = sym ? instanceBindings.get(sym) : undefined;
-            return binding ?? null;
+            if (binding)
+                return binding;
+            const directClass = classNameFromToken(receiver);
+            if (directClass && cliCommandClasses.has(directClass)) {
+                return { className: directClass, src: importSourceOf(receiver), fromNest: false };
+            }
+            return null;
         }
         if (ts.isConditionalExpression(receiver)) {
             return sameClassBinding([bindingFromNestInstanceExpr(receiver.whenTrue), bindingFromNestInstanceExpr(receiver.whenFalse)]);
@@ -1824,6 +1878,9 @@ export function confirmBehaviors(ctx, testAbsPath, implAbsPath, behaviorNames) {
     };
     const classBindingFromExpr = (expr, requireNest) => {
         const value = unwrapExpression(expr);
+        const loadedDefault = loadedDefaultClassBinding(value);
+        if (loadedDefault)
+            return loadedDefault;
         if (ts.isIdentifier(value)) {
             const sym = checker.getSymbolAtLocation(value);
             const binding = sym ? instanceBindings.get(sym) : undefined;
@@ -1856,6 +1913,22 @@ export function confirmBehaviors(ctx, testAbsPath, implAbsPath, behaviorNames) {
         if (sym)
             instanceBindings.set(sym, binding);
     };
+    const maybeBindLoadedModule = (name, expr) => {
+        const loaded = loadedModuleFromEsmock(expr);
+        if (!loaded)
+            return;
+        const sym = checker.getSymbolAtLocation(name);
+        if (sym)
+            loadedModuleBindings.set(sym, loaded);
+        if (!loaded.defaultClassName)
+            return;
+        const targetName = `${loaded.defaultClassName}.run`;
+        if (!nameSet.has(targetName))
+            return;
+        const st = stateFor(targetName);
+        st.importedRuntime = true;
+        st.importSources.push(loaded.src);
+    };
     const maybeBindDerivedIdentity = (name, expr) => {
         bindMutatorAlias(name, expr);
         const sym = checker.getSymbolAtLocation(name);
@@ -2065,6 +2138,7 @@ export function confirmBehaviors(ctx, testAbsPath, implAbsPath, behaviorNames) {
             markTupleMutationSeed(node.initializer);
             if (ts.isIdentifier(node.name)) {
                 recordContainerBindings(node.name, node.initializer);
+                maybeBindLoadedModule(node.name, node.initializer);
                 maybeBindInstance(node.name, node.initializer);
                 maybeBindDerivedIdentity(node.name, node.initializer);
             }
@@ -2395,7 +2469,10 @@ export function confirmBehaviors(ctx, testAbsPath, implAbsPath, behaviorNames) {
         out.set(name, {
             verdict: "inferred",
             reason: "the behavior is exercised but no assertion consumes its result or observes its rendered effect via the real binding",
-            rejected_conjunct: 5
+            rejected_conjunct: 5,
+            ...(st.runtimeUses.some((u) => u.src != null && cleanBindingSource(u.src) && !srcMocked(u.src))
+                ? { association_signal: "runtime_invocation" }
+                : {})
         });
     }
     return out;
@@ -2546,10 +2623,11 @@ export function resolveSpecifier(spec, fromFile, repoRoot, wsPkgs) {
 export function runConfirmer(input) {
     const { candidates, symbolsByImpl, existingSymIds, anchorFile } = input;
     const confirmations = [];
+    const associations = [];
     let attempted = 0;
     let capped_downgrades = 0;
     if (candidates.length === 0)
-        return { confirmations, attempted, capped_downgrades };
+        return { confirmations, associations, attempted, capped_downgrades };
     const absFiles = new Set();
     for (const c of candidates) {
         absFiles.add(c.testAbs);
@@ -2564,7 +2642,9 @@ export function runConfirmer(input) {
         const verdicts = confirmBehaviors(ctx, c.testAbs, c.implAbs, names);
         for (const [name, v] of verdicts) {
             attempted++;
-            if (v.verdict !== "confirmed")
+            const isConfirmed = v.verdict === "confirmed";
+            const isAssociated = v.verdict === "inferred" && v.association_signal === "runtime_invocation";
+            if (!isConfirmed && !isAssociated)
                 continue;
             const symId = `sym:${c.implRel}#${name}`;
             if (!existingSymIds.has(symId)) {
@@ -2575,8 +2655,12 @@ export function runConfirmer(input) {
             if (seen.has(key))
                 continue;
             seen.add(key);
-            confirmations.push({ testRel: c.testRel, implRel: c.implRel, behaviorName: name, symId, reason: v.reason });
+            const edge = { testRel: c.testRel, implRel: c.implRel, behaviorName: name, symId, reason: v.reason };
+            if (isConfirmed)
+                confirmations.push(edge);
+            else
+                associations.push(edge);
         }
     }
-    return { confirmations, attempted, capped_downgrades };
+    return { confirmations, associations, attempted, capped_downgrades };
 }

package/dist/local/analyze/frameworks.js

@@ -30,6 +30,9 @@ const RUNTIME_HINTS = {
     "django": "Django",
     "flask": "Flask",
     "spring-boot": "Spring Boot",
+    "@oclif/core": "oclif",
+    "@salesforce/sf-plugins-core": "Salesforce CLI",
+    "commander": "Commander",
 };
 const CONFIG_FRAMEWORK_HINTS = [
     { match: /^vitest\.config\.[tj]s$/, name: "vitest", layer: "unit" },

package/dist/local/flows/flowWalker.js

@@ -24,7 +24,7 @@ export function behaviorEntries(nodes, edges) {
         n.denominator_eligible === true &&
         n.stale !== true &&
         !endpointStarts.has(n.external_id) &&
-        !incomingEligibleCalls.has(n.external_id))
+        (n.properties.cli_entrypoint === true || !incomingEligibleCalls.has(n.external_id)))
         .map((n) => ({
         external_id: n.external_id,
         kind: "Behavior",

package/dist/local/operations.js

@@ -20,7 +20,7 @@ import { enrichFromContent } from "./enrich/index.js";
 import { scoreGraph } from "./score/score.js";
 import { doctorGraph } from "./score/doctor.js";
 import { findGaps } from "./gaps/gaps.js";
-import { rankPriorityGaps, rankRiskGaps } from "./score/risk.js";
+import { inspectRiskInputHealth, rankPriorityGaps, rankRiskGaps, riskHistoryFingerprint } from "./score/risk.js";
 import { generateTests } from "./generate/generator.js";
 import { classifyGeneratedDraftBlocker } from "./generate/draftGuidance.js";
 import { autoProve, NO_KEY_MESSAGE, isEligibleProvableTarget } from "./autoProve.js";
@@ -46,6 +46,7 @@ import { prepareRuntimeCoverage } from "./analyze/coverageArtifacts.js";
 import { appendLedgerRecord, canReproveLanguage, loadLedger, ledgerStats, proofEdgesFor, reproveTarget, resolveTargetSymbol, targetFingerprint, targetLanguage } from "./ledger.js";
 import { buildRtm, provenSymbolIds, renderRtmCsv, renderRtmMarkdown } from "./rtm.js";
 import { buildProofDoctor, distillProofAttempts, loadProofAttempts, proofAttemptsFresh, writeProofAttempts } from "./proofDoctor.js";
+import { buildArtifactIdentity, PROOF_ORACLE_VERSION } from "./provenance.js";
 import { tryScopedReprove } from "./reprove/scoped.js";
 import { resolveContained, toWorkspaceRel } from "./reprove/paths.js";
 import { hashBuffer } from "./util/hash.js";
@@ -490,7 +491,7 @@ function buildGraphFromFragments(workspaceRoot, scanRoot, analyzeFragment, enric
     const sources = [...analyzeFragment.sources, ...enrichFragments.flatMap((f) => f.sources)];
     const manifest = buildManifest(analyzeFragment.file_entries, readGitInfo(gitRunner(scanRoot)), now);
     const prunedEdges = pruneDanglingEdges(nodes, edges);
-    return {
+    const graph = {
         schema_version: LOCAL_GRAPH_SCHEMA_VERSION,
         workspace: {
             name: config.workspace_name || deriveWorkspaceName(scanRoot),
@@ -516,6 +517,22 @@ function buildGraphFromFragments(workspaceRoot, scanRoot, analyzeFragment, enric
             confirmed_by_layer: confirmedCoverageByLayer({ nodes, edges: prunedEdges })
         }
     };
+    graph.artifact_identity = artifactIdentityFor(graph, scanRoot);
+    return graph;
+}
+function artifactIdentityFor(graph, repoRoot) {
+    const health = inspectRiskInputHealth(repoRoot);
+    const codeFiles = Object.entries(graph.manifest.files).filter(([, file]) => file.kind === "code").map(([file]) => file);
+    return buildArtifactIdentity(graph, {
+        configHash: loadRiskConfig(repoRoot).hash,
+        history: {
+            state: health.history,
+            churnWindow: health.churnWindow,
+            churnAvailable: health.churnAvailable,
+            commitDate: health.commitDate,
+            inputFingerprint: riskHistoryFingerprint(repoRoot, codeFiles, health.churnWindow)
+        }
+    });
 }
 // ── operations ───────────────────────────────────────────────────────
 export function opInit(root, deps = defaultDeps()) {
@@ -970,6 +987,7 @@ export function opRecordRun(root, opts, deps = defaultDeps()) {
         model: opts.model,
         prompt_version: opts.prompt_version,
         language,
+        artifact_identity: artifactIdentityFor(preGraph, preGraph.workspace.root),
         status,
         reprove_mode: reproveMode,
         reprove_reason: reproveReason,
@@ -1213,6 +1231,7 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
     const closed = dynamicProofSucceeded(oracle);
     const baselineGreen = oracle.baseline?.exitCode === 0 && oracle.baseline?.timedOut !== true;
     const mutantFailedAssertion = oracle.mutant?.assertionFailure === true && oracle.mutant?.timedOut !== true;
+    const artifactIdentity = artifactIdentityFor(graph, sourceRoot);
     const dynamicProof = {
         proof_kind: "dynamic_targeted",
         baseline_green: baselineGreen,
@@ -1223,7 +1242,9 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
         sentinel: oracle.replacementMode ?? replacementMode,
         runner: oracle.runner ?? runner,
         test_path: oracle.test ?? testRel,
-        mutant_status: oracle.status
+        mutant_status: oracle.status,
+        oracle_version: PROOF_ORACLE_VERSION,
+        run_fingerprint: artifactIdentity.run_fingerprint
     };
     const result = appendLedgerRecord(root, {
         run_id: opts.run_id,
@@ -1235,6 +1256,7 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
         evidence_ids: [],
         language,
         dynamic_proof: dynamicProof,
+        artifact_identity: artifactIdentity,
         target_fingerprint: targetFingerprint(graph, target),
         status: closed ? "reproven" : "unproven",
         reason: oracle.reason ?? (closed ? "Dynamic targeted proof closed." : "Dynamic targeted proof did not close."),
@@ -1623,7 +1645,9 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     // Auto-prove (PR 1): key-gated generate→prove for the top provable TS/JS targets.
     // Runs BEFORE the report/RTM writes below so they reflect any freshly-minted Proven.
     // Proof is minted only by opProveLoop's UNCHANGED oracle; no key ⇒ no files, no proof.
-    reportProgress("auto-prove: driving generate → prove on the top provable targets", { current: 6, total: 8 });
+    reportProgress(opts.noAuto
+        ? "auto-prove: disabled (--no-auto)"
+        : "auto-prove: driving generate → prove on the top provable targets", { current: 6, total: 8 });
     let autoProveResult;
     try {
         autoProveResult = await autoProve(root, {
@@ -2279,7 +2303,7 @@ export function opBehaviorCoverageHtml(root, outputPath = "orangepro-behavior-co
             data.delta = computeReportDelta(prev, data);
     }
     catch {
-        data.delta = null;
+        // buildBehaviorReportData already provides an explicit first_run state.
     }
     const html = renderBehaviorReport(data);
     const htmlPath = resolve(root, outputPath);
@@ -2404,6 +2428,7 @@ function incrementalMerge(root, old, changedFiles, now, maxInferredFlows, maxFil
             confirmed_by_layer: confirmedCoverageByLayer({ nodes, edges: prunedEdges })
         }
     };
+    graph.artifact_identity = artifactIdentityFor(graph, root);
     return { graph, updated_entities: updatedEntities, stale_generated_tests: staleCount, warnings: freshFragment.warnings };
 }
 const NO_DIFF_GUIDANCE = "No changed files found. Run this on a feature branch, pass base_ref, or use the test-gaps tool for baseline opportunities (CLI: opro gaps; MCP: orangepro_find_test_gaps).";