@orangepro/orangepro-mcp 0.2.41 → 0.2.43

package/dist/local/analyze/treeSitter/engine.js

@@ -8,6 +8,8 @@ import { createRequire } from "node:module";
 import { Parser, Language } from "web-tree-sitter";
 import { MAX_SYMBOLS_PER_FILE } from "../symbols.js";
 import { TS_LANG_CONFIGS } from "./languages.js";
+import { slugify } from "../../util/ids.js";
+import { shortHash } from "../../util/hash.js";
 const require = createRequire(import.meta.url);
 let initPromise = null;
 const loaded = new Map();
@@ -212,6 +214,39 @@ function symbolName(node, cfg) {
 function nodeLines(node) {
     return { start_line: node.startPosition.row + 1, end_line: node.endPosition.row + 1 };
 }
+/**
+ * Nearest lexical Python class for a function. A function boundary reached first
+ * means this is a nested local function, not a class method.
+ */
+function pythonOwnerClass(node) {
+    const owners = [];
+    let parent = node.parent;
+    while (parent) {
+        if (parent.type === "function_definition" || parent.type === "lambda")
+            return undefined;
+        if (parent.type === "class_definition") {
+            const name = parent.childForFieldName("name")?.text;
+            if (name)
+                owners.unshift(name);
+        }
+        parent = parent.parent;
+    }
+    return owners.length > 0 ? owners.join(".") : undefined;
+}
+function hasPythonFunctionAncestor(node) {
+    let parent = node.parent;
+    while (parent) {
+        if (parent.type === "function_definition" || parent.type === "lambda")
+            return true;
+        parent = parent.parent;
+    }
+    return false;
+}
+function pythonQualifiedFunctionName(node) {
+    const name = functionName(node, "python");
+    const owner = pythonOwnerClass(node);
+    return name && owner ? `${owner}.${name}` : name;
+}
 /**
  * Extract class/function/method symbol metadata (names + a trivial-accessor flag —
  * never source bodies) from a tree-sitter-supported language. Sync; returns [] when
@@ -249,16 +284,22 @@ export function extractTreeSitterSymbols(content, language) {
             kind = "method";
         else if (cfg.functionTypes.has(node.type))
             kind = "function";
-        if (kind && shouldEmitSymbol(node, language)) {
+        const pythonOwner = language === "python" && node.type === "function_definition" ? pythonOwnerClass(node) : undefined;
+        if (pythonOwner && kind === "function")
+            kind = "method";
+        const localPythonDeclaration = language === "python" && (node.type === "function_definition" || node.type === "class_definition") && hasPythonFunctionAncestor(node);
+        if (kind && !localPythonDeclaration && shouldEmitSymbol(node, language)) {
             const name = symbolName(node, cfg);
             if (name && !RESERVED_SYMBOL_NAMES.has(name)) {
                 // Go methods mint receiver-qualified names (`Recv.M`, mirroring TS/JS
                 // `Class.method` + member_of) so same-named methods on different receivers
                 // stay distinct symbols; an underivable receiver falls back to the bare name.
-                const recv = kind === "method" && language === "go" ? goReceiverBaseName(node) : undefined;
+                const recv = kind === "method" && language === "go" ? goReceiverBaseName(node) : language === "python" ? pythonOwner : undefined;
+                const pythonClassOwner = kind === "class" && language === "python" ? pythonOwnerClass(node) : undefined;
+                const emittedName = pythonClassOwner ? `${pythonClassOwner}.${name}` : name;
                 add(kind === "method"
                     ? { name: recv ? `${recv}.${name}` : name, ...(recv ? { member_of: recv } : {}), symbol_kind: kind, trivial_accessor: isTrivialAccessorBody(node, language), ...nodeLines(node) }
-                    : { name, symbol_kind: kind, ...nodeLines(node) });
+                    : { name: emittedName, symbol_kind: kind, ...nodeLines(node) });
             }
         }
         for (let i = 0; i < node.childCount; i++) {
@@ -464,6 +505,21 @@ function kotlinTopLevelSymbols(root) {
     }
     return [...out].sort();
 }
+function underPythonTypeCheckingGuard(node) {
+    let parent = node.parent;
+    while (parent) {
+        if (parent.type === "if_statement") {
+            const condition = parent.childForFieldName("condition");
+            const text = condition?.text.trim() ?? "";
+            if (text === "TYPE_CHECKING" || /^[A-Za-z_]\w*\.TYPE_CHECKING$/.test(text))
+                return true;
+        }
+        if (parent.type === "function_definition" || parent.type === "class_definition")
+            break;
+        parent = parent.parent;
+    }
+    return false;
+}
 function extractImports(root, language) {
     const imports = [];
     const add = (binding) => {
@@ -472,6 +528,9 @@ function extractImports(root, language) {
         imports.push(binding);
     };
     const walk = (node) => {
+        if (language === "python" && (node.type === "import_statement" || node.type === "import_from_statement") && underPythonTypeCheckingGuard(node)) {
+            return;
+        }
         if (language === "java" && node.type === "import_declaration") {
             const spec = namedChildren(node).find((n) => n.type.endsWith("identifier"))?.text;
             if (spec && !spec.endsWith(".*"))
@@ -1430,6 +1489,360 @@ function extractJavaProofCalls(root, imports) {
     }
     return out;
 }
+const FASTAPI_HTTP_METHODS = new Set(["get", "post", "put", "patch", "delete", "options", "head", "trace"]);
+function pythonStaticString(node) {
+    if (!node || node.type !== "string")
+        return null;
+    const contents = node.descendantsOfType("string_content").filter((n) => Boolean(n));
+    if (contents.length !== 1)
+        return null;
+    return contents[0]?.text ?? null;
+}
+function pythonDottedName(node) {
+    if (!node)
+        return null;
+    if (node.type === "identifier" || node.type === "dotted_name")
+        return node.text;
+    if (node.type !== "attribute")
+        return null;
+    const object = pythonDottedName(node.childForFieldName("object"));
+    const attribute = node.childForFieldName("attribute")?.text;
+    return object && attribute ? `${object}.${attribute}` : null;
+}
+function pythonCallArguments(call) {
+    const args = call.childForFieldName("arguments");
+    return args ? namedChildren(args).filter((n) => n.type !== "comment") : [];
+}
+function pythonKeywordArgument(call, name) {
+    for (const arg of pythonCallArguments(call)) {
+        if (arg.type !== "keyword_argument" || arg.childForFieldName("name")?.text !== name)
+            continue;
+        return arg.childForFieldName("value") ?? namedChildren(arg)[1] ?? null;
+    }
+    return null;
+}
+function pythonPositionalArguments(call) {
+    return pythonCallArguments(call).filter((n) => n.type !== "keyword_argument" && n.type !== "list_splat" && n.type !== "dictionary_splat");
+}
+function pythonStaticHttpMethods(node, fallback = ["GET"]) {
+    if (!node)
+        return fallback;
+    if (!new Set(["list", "tuple", "set"]).has(node.type))
+        return null;
+    const elements = namedChildren(node).filter((child) => child.type !== "comment");
+    if (elements.length === 0)
+        return null;
+    const methods = elements.map((element) => pythonStaticString(element));
+    if (methods.some((method) => method === null))
+        return null;
+    const normalized = methods.map((method) => method.toLowerCase());
+    return normalized.every((method) => FASTAPI_HTTP_METHODS.has(method)) ? normalized.map((method) => method.toUpperCase()) : null;
+}
+function normalizePythonRoutePath(...parts) {
+    const joined = parts.map((p) => p.trim().replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+    return joined ? `/${joined}` : "/";
+}
+function pythonImportedFromFastapi(imports, local, imported) {
+    return imports.some((b) => b.local === local && b.module === "fastapi" && b.kind === "named" && b.imported === imported);
+}
+function pythonCallIsFastapiConstructor(call, imports, imported) {
+    const parts = callParts(call, "python");
+    if (!parts)
+        return false;
+    if (!parts.qualifier)
+        return pythonImportedFromFastapi(imports, parts.callee, imported);
+    if (parts.callee !== imported)
+        return false;
+    const root = parts.qualifier.split(".")[0] ?? "";
+    return imports.some((b) => b.local === root && b.kind === "module" && b.module === "fastapi");
+}
+function pythonBindingTargetNames(target) {
+    if (!target)
+        return [];
+    if (target.type === "identifier")
+        return [target.text];
+    if (!new Set(["pattern_list", "tuple_pattern", "list_pattern", "tuple", "list"]).has(target.type))
+        return [];
+    return namedChildren(target).flatMap((child) => pythonBindingTargetNames(child));
+}
+function pythonFastapiReceivers(root, imports) {
+    const mutationCount = new Map();
+    const candidates = new Map();
+    const mutations = [];
+    for (const type of ["assignment", "annotated_assignment", "augmented_assignment", "delete_statement"]) {
+        mutations.push(...root.descendantsOfType(type).filter((node) => Boolean(node)));
+    }
+    mutations.sort((a, b) => a.startIndex - b.startIndex);
+    for (const assignment of mutations) {
+        if (!pythonDirectModuleExecution(assignment))
+            continue;
+        const left = assignment.childForFieldName("left");
+        const targets = assignment.type === "delete_statement"
+            ? namedChildren(assignment).flatMap((child) => pythonBindingTargetNames(child))
+            : pythonBindingTargetNames(left);
+        for (const target of targets)
+            mutationCount.set(target, (mutationCount.get(target) ?? 0) + 1);
+        const right = assignment.childForFieldName("right");
+        if (left?.type !== "identifier")
+            continue;
+        const kind = right?.type === "call" && pythonCallIsFastapiConstructor(right, imports, "APIRouter")
+            ? "router"
+            : right?.type === "call" && pythonCallIsFastapiConstructor(right, imports, "FastAPI")
+                ? "app"
+                : null;
+        if (!kind || right?.type !== "call")
+            continue;
+        const prefixNode = kind === "router" ? pythonKeywordArgument(right, "prefix") : null;
+        const staticPrefix = pythonStaticString(prefixNode);
+        candidates.set(left.text, {
+            kind,
+            prefix: staticPrefix ?? "",
+            prefixResolved: !prefixNode || staticPrefix !== null,
+            boundAt: assignment.startIndex
+        });
+    }
+    const out = new Map();
+    for (const [name, receiver] of candidates)
+        if (mutationCount.get(name) === 1)
+            out.set(name, receiver);
+    return out;
+}
+const PYTHON_NONDETERMINISTIC_SCOPES = new Set([
+    "function_definition", "class_definition", "if_statement", "for_statement", "while_statement",
+    "try_statement", "with_statement", "match_statement", "lambda", "list_comprehension",
+    "dictionary_comprehension", "set_comprehension", "generator_expression"
+]);
+function pythonDirectModuleExecution(node) {
+    let parent = node.parent;
+    while (parent) {
+        if (PYTHON_NONDETERMINISTIC_SCOPES.has(parent.type))
+            return false;
+        if (parent.type === "module")
+            return true;
+        parent = parent.parent;
+    }
+    return false;
+}
+function pythonRouterIncludePrefixes(root, receivers) {
+    const out = new Map();
+    for (const call of root.descendantsOfType("call")) {
+        if (!call || !pythonDirectModuleExecution(call))
+            continue;
+        const parts = callParts(call, "python");
+        const app = parts?.qualifier?.split(".")[0];
+        if (!parts || parts.callee !== "include_router" || !app || receivers.get(app)?.kind !== "app")
+            continue;
+        const router = pythonDottedName(pythonPositionalArguments(call)[0] ?? null);
+        if (!router || !receivers.has(router) || receivers.get(app).boundAt >= call.startIndex || receivers.get(router).boundAt >= call.startIndex)
+            continue;
+        const includePrefix = pythonStaticString(pythonKeywordArgument(call, "prefix"));
+        if (includePrefix === null && pythonKeywordArgument(call, "prefix"))
+            continue;
+        let prefixes = out.get(router);
+        if (!prefixes)
+            out.set(router, (prefixes = new Set()));
+        prefixes.add(includePrefix ?? "");
+    }
+    return out;
+}
+function makePythonBehaviorContract(input) {
+    const identityInput = `${input.method}|${input.path}|${input.file}|${input.handler ?? ""}`;
+    return {
+        id: `endpoint:${slugify(`${input.method}-${input.path}-${input.file}-${input.handler ?? ""}`)}-${shortHash(identityInput)}`,
+        title: `${input.method} ${input.path}`,
+        kind: "http_endpoint",
+        framework: "fastapi",
+        method: input.method,
+        path: input.path,
+        file: input.file,
+        handler: input.handler,
+        route_prefix_status: input.prefixStatus,
+        ...(input.prefix ? { route_prefix: input.prefix } : {}),
+        source: "framework"
+    };
+}
+function dedupePythonContracts(contracts) {
+    const seen = new Set();
+    return contracts.filter((contract) => {
+        const key = `${contract.method}|${contract.path}|${contract.handler ?? ""}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function pythonDirectModuleHandlers(root) {
+    const counts = new Map();
+    for (const fn of root.descendantsOfType("function_definition")) {
+        if (!fn || hasPythonFunctionAncestor(fn))
+            continue;
+        const declaration = fn.parent?.type === "decorated_definition" ? fn.parent : fn;
+        if (declaration.parent?.type !== "module")
+            continue;
+        const name = pythonQualifiedFunctionName(fn);
+        if (name)
+            counts.set(name, (counts.get(name) ?? 0) + 1);
+    }
+    for (const type of ["assignment", "annotated_assignment", "augmented_assignment", "delete_statement"]) {
+        for (const mutation of root.descendantsOfType(type)) {
+            if (!mutation || !pythonDirectModuleExecution(mutation))
+                continue;
+            const left = mutation.childForFieldName("left");
+            const targets = mutation.type === "delete_statement"
+                ? namedChildren(mutation).flatMap((child) => pythonBindingTargetNames(child))
+                : pythonBindingTargetNames(left);
+            for (const target of targets)
+                if (counts.has(target))
+                    counts.set(target, counts.get(target) + 1);
+        }
+    }
+    return new Set([...counts].filter(([, count]) => count === 1).map(([name]) => name));
+}
+function extractPythonBehaviorContracts(root, imports, file) {
+    const receivers = pythonFastapiReceivers(root, imports);
+    if (receivers.size === 0)
+        return [];
+    const directHandlers = pythonDirectModuleHandlers(root);
+    const includes = pythonRouterIncludePrefixes(root, receivers);
+    const out = [];
+    const add = (receiverName, method, routePath, registrationAt, handler) => {
+        const receiver = receivers.get(receiverName);
+        if (!receiver || receiver.boundAt >= registrationAt)
+            return;
+        const includePrefixes = receiver.kind === "app" ? new Set([""]) : includes.get(receiverName);
+        const prefixes = includePrefixes && includePrefixes.size > 0 ? [...includePrefixes] : [""];
+        const status = receiver.prefixResolved && (receiver.kind === "app" || Boolean(includePrefixes?.size)) ? "resolved" : "unresolved";
+        for (const includePrefix of prefixes) {
+            const prefix = normalizePythonRoutePath(includePrefix, receiver.prefix);
+            const normalizedPrefix = prefix === "/" ? "" : prefix;
+            out.push(makePythonBehaviorContract({
+                file,
+                method: method.toUpperCase(),
+                path: normalizePythonRoutePath(normalizedPrefix, routePath),
+                handler,
+                prefixStatus: status,
+                prefix: normalizedPrefix
+            }));
+        }
+    };
+    for (const fn of root.descendantsOfType("function_definition")) {
+        if (!fn || hasPythonFunctionAncestor(fn))
+            continue;
+        const handler = pythonQualifiedFunctionName(fn);
+        const decorated = fn.parent?.type === "decorated_definition" ? fn.parent : null;
+        if (!handler || !directHandlers.has(handler) || !decorated || decorated.parent?.type !== "module")
+            continue;
+        for (const decorator of namedChildren(decorated).filter((n) => n.type === "decorator")) {
+            const call = namedChildren(decorator).find((n) => n.type === "call");
+            const parts = call ? callParts(call, "python") : null;
+            const receiver = parts?.qualifier?.split(".")[0];
+            const route = call ? pythonStaticString(pythonPositionalArguments(call)[0] ?? null) : null;
+            if (!call || !parts || !receiver || route === null)
+                continue;
+            if (FASTAPI_HTTP_METHODS.has(parts.callee)) {
+                add(receiver, parts.callee, route, call.startIndex, handler);
+            }
+            else if (parts.callee === "api_route") {
+                const methods = pythonStaticHttpMethods(pythonKeywordArgument(call, "methods"));
+                if (!methods)
+                    continue;
+                for (const method of methods)
+                    add(receiver, method, route, call.startIndex, handler);
+            }
+        }
+    }
+    for (const call of root.descendantsOfType("call")) {
+        if (!call || !pythonDirectModuleExecution(call))
+            continue;
+        const parts = callParts(call, "python");
+        const receiver = parts?.qualifier?.split(".")[0];
+        if (!parts || parts.callee !== "add_api_route" || !receiver || !receivers.has(receiver))
+            continue;
+        const positional = pythonPositionalArguments(call);
+        const route = pythonStaticString(positional[0] ?? null);
+        const handler = pythonDottedName(positional[1] ?? null);
+        if (route === null || !handler || !directHandlers.has(handler))
+            continue;
+        const methods = pythonStaticHttpMethods(pythonKeywordArgument(call, "methods"));
+        if (!methods)
+            continue;
+        for (const method of methods)
+            add(receiver, method, route, call.startIndex, handler);
+    }
+    return dedupePythonContracts(out);
+}
+function isFastapiDependsCall(call, imports) {
+    const parts = callParts(call, "python");
+    if (!parts)
+        return false;
+    if (!parts.qualifier) {
+        return pythonImportedFromFastapi(imports, parts.callee, "Depends") || pythonImportedFromFastapi(imports, parts.callee, "Security");
+    }
+    if (parts.callee !== "Depends" && parts.callee !== "Security")
+        return false;
+    const root = parts.qualifier.split(".")[0] ?? "";
+    return imports.some((b) => b.local === root && b.kind === "module" && b.module === "fastapi");
+}
+function extractPythonDependencies(root, imports, acceptedHandlers) {
+    const out = [];
+    const seen = new Set();
+    const receivers = pythonFastapiReceivers(root, imports);
+    const directHandlers = pythonDirectModuleHandlers(root);
+    const addFromNode = (handler, node) => {
+        if (!node)
+            return;
+        const calls = [...(node.type === "call" ? [node] : []), ...node.descendantsOfType("call").filter((n) => Boolean(n))];
+        for (const call of calls) {
+            if (!isFastapiDependsCall(call, imports))
+                continue;
+            const dependency = pythonDottedName(pythonPositionalArguments(call)[0] ?? null);
+            if (!dependency)
+                continue;
+            const key = `${handler}|${dependency}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({ handler, dependency });
+        }
+    };
+    for (const fn of root.descendantsOfType("function_definition")) {
+        if (!fn || hasPythonFunctionAncestor(fn))
+            continue;
+        const handler = pythonQualifiedFunctionName(fn);
+        const params = fn.childForFieldName("parameters");
+        const declaration = fn.parent?.type === "decorated_definition" ? fn.parent : fn;
+        if (!handler || !params || !directHandlers.has(handler) || declaration.parent?.type !== "module" || !acceptedHandlers.has(handler))
+            continue;
+        addFromNode(handler, params);
+        const decorated = fn.parent?.type === "decorated_definition" ? fn.parent : null;
+        for (const decorator of decorated ? namedChildren(decorated).filter((n) => n.type === "decorator") : []) {
+            const routeCall = namedChildren(decorator).find((n) => n.type === "call");
+            const parts = routeCall ? callParts(routeCall, "python") : null;
+            const receiver = parts?.qualifier?.split(".")[0];
+            if (!routeCall || !parts || !receiver || !receivers.has(receiver) || receivers.get(receiver).boundAt >= routeCall.startIndex)
+                continue;
+            if (!FASTAPI_HTTP_METHODS.has(parts.callee) && (parts.callee !== "api_route" || !pythonStaticHttpMethods(pythonKeywordArgument(routeCall, "methods"))))
+                continue;
+            addFromNode(handler, pythonKeywordArgument(routeCall, "dependencies"));
+        }
+    }
+    for (const call of root.descendantsOfType("call")) {
+        if (!call || !pythonDirectModuleExecution(call))
+            continue;
+        const parts = callParts(call, "python");
+        const receiver = parts?.qualifier?.split(".")[0];
+        if (!parts || parts.callee !== "add_api_route" || !receiver || !receivers.has(receiver) || receivers.get(receiver).boundAt >= call.startIndex)
+            continue;
+        const positional = pythonPositionalArguments(call);
+        const route = pythonStaticString(positional[0] ?? null);
+        const handler = pythonDottedName(positional[1] ?? null);
+        const methods = pythonStaticHttpMethods(pythonKeywordArgument(call, "methods"));
+        if (route !== null && handler && methods && directHandlers.has(handler) && acceptedHandlers.has(handler)) {
+            addFromNode(handler, pythonKeywordArgument(call, "dependencies"));
+        }
+    }
+    return out;
+}
 function directPythonAssertCall(assertion) {
     const subject = namedChildren(assertion)[0];
     if (!subject)
@@ -1490,7 +1903,7 @@ function extractPythonProofCalls(root) {
     walk(root, false, null);
     return out;
 }
-export function extractTreeSitterStructure(content, language) {
+export function extractTreeSitterStructure(content, language, relPath = "") {
     const parser = parserFor(language);
     if (!parser)
         return { imports: [], calls: [] };
@@ -1530,6 +1943,9 @@ export function extractTreeSitterStructure(content, language) {
                             callerReceivers.set(name, { receiverVar: rv, receiverType: recv });
                     }
                 }
+                if (name && language === "python" && node.type === "function_definition") {
+                    name = pythonQualifiedFunctionName(node) ?? name;
+                }
                 if (name) {
                     nextCaller = name;
                     nextShadowed = localBindings(node, language);
@@ -1546,6 +1962,10 @@ export function extractTreeSitterStructure(content, language) {
     };
     visit(root, null, new Set(), false);
     const imports = extractImports(root, language);
+    const pythonBehaviorContracts = language === "python" ? extractPythonBehaviorContracts(root, imports, relPath) : undefined;
+    const pythonDependencies = language === "python"
+        ? extractPythonDependencies(root, imports, new Set((pythonBehaviorContracts ?? []).map((contract) => contract.handler).filter((handler) => Boolean(handler))))
+        : undefined;
     const result = {
         ...(language === "java" ? { packageName: javaPackage(root), javaClasses: javaClassInfos(root), javaProofCalls: extractJavaProofCalls(root, imports) } : {}),
         ...(language === "go" ? { packageName: goPackage(root), goCtorResults: extractGoCtorResults(root) } : {}),
@@ -1555,7 +1975,7 @@ export function extractTreeSitterStructure(content, language) {
         imports,
         calls,
         ...(language === "go" ? { goProofCalls: extractGoProofCalls(root, imports) } : {}),
-        ...(language === "python" ? { pythonProofCalls: extractPythonProofCalls(root) } : {})
+        ...(language === "python" ? { pythonProofCalls: extractPythonProofCalls(root), pythonBehaviorContracts, pythonDependencies } : {})
     };
     tree.delete();
     return result;

package/dist/local/flows/flowWalker.js

@@ -24,7 +24,7 @@ export function behaviorEntries(nodes, edges) {
         n.denominator_eligible === true &&
         n.stale !== true &&
         !endpointStarts.has(n.external_id) &&
-        !incomingEligibleCalls.has(n.external_id))
+        (n.properties.cli_entrypoint === true || !incomingEligibleCalls.has(n.external_id)))
         .map((n) => ({
         external_id: n.external_id,
         kind: "Behavior",

package/dist/local/graph/ontology.js

@@ -9,9 +9,9 @@
  * The graph is built directly by OrangePro; it does not depend on any
  * third-party graph product or format.
  */
-// v2: Go method symbol ids are receiver-qualified (`sym:file.go#Recv.M`) — old
-// graphs hold bare-name method ids and must force-rebuild (loadGraph hard-fails).
-export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v2";
+// v3: Python method symbol ids are owner-qualified (`sym:file.py#Class.method`) —
+// old graphs hold collision-prone bare method ids and must force-rebuild.
+export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v3";
 /** Node kinds that map to behaviors/requirements for scoring + gaps + generation. */
 export const BEHAVIOR_KINDS = new Set([
     "Requirement",

package/dist/local/operations.js

@@ -20,7 +20,7 @@ import { enrichFromContent } from "./enrich/index.js";
 import { scoreGraph } from "./score/score.js";
 import { doctorGraph } from "./score/doctor.js";
 import { findGaps } from "./gaps/gaps.js";
-import { rankPriorityGaps, rankRiskGaps } from "./score/risk.js";
+import { inspectRiskInputHealth, rankPriorityGaps, rankRiskGaps, riskHistoryFingerprint } from "./score/risk.js";
 import { generateTests } from "./generate/generator.js";
 import { classifyGeneratedDraftBlocker } from "./generate/draftGuidance.js";
 import { autoProve, NO_KEY_MESSAGE, isEligibleProvableTarget } from "./autoProve.js";
@@ -46,6 +46,7 @@ import { prepareRuntimeCoverage } from "./analyze/coverageArtifacts.js";
 import { appendLedgerRecord, canReproveLanguage, loadLedger, ledgerStats, proofEdgesFor, reproveTarget, resolveTargetSymbol, targetFingerprint, targetLanguage } from "./ledger.js";
 import { buildRtm, provenSymbolIds, renderRtmCsv, renderRtmMarkdown } from "./rtm.js";
 import { buildProofDoctor, distillProofAttempts, loadProofAttempts, proofAttemptsFresh, writeProofAttempts } from "./proofDoctor.js";
+import { buildArtifactIdentity, PROOF_ORACLE_VERSION } from "./provenance.js";
 import { tryScopedReprove } from "./reprove/scoped.js";
 import { resolveContained, toWorkspaceRel } from "./reprove/paths.js";
 import { hashBuffer } from "./util/hash.js";
@@ -490,7 +491,7 @@ function buildGraphFromFragments(workspaceRoot, scanRoot, analyzeFragment, enric
     const sources = [...analyzeFragment.sources, ...enrichFragments.flatMap((f) => f.sources)];
     const manifest = buildManifest(analyzeFragment.file_entries, readGitInfo(gitRunner(scanRoot)), now);
     const prunedEdges = pruneDanglingEdges(nodes, edges);
-    return {
+    const graph = {
         schema_version: LOCAL_GRAPH_SCHEMA_VERSION,
         workspace: {
             name: config.workspace_name || deriveWorkspaceName(scanRoot),
@@ -516,6 +517,22 @@ function buildGraphFromFragments(workspaceRoot, scanRoot, analyzeFragment, enric
             confirmed_by_layer: confirmedCoverageByLayer({ nodes, edges: prunedEdges })
         }
     };
+    graph.artifact_identity = artifactIdentityFor(graph, scanRoot);
+    return graph;
+}
+function artifactIdentityFor(graph, repoRoot) {
+    const health = inspectRiskInputHealth(repoRoot);
+    const codeFiles = Object.entries(graph.manifest.files).filter(([, file]) => file.kind === "code").map(([file]) => file);
+    return buildArtifactIdentity(graph, {
+        configHash: loadRiskConfig(repoRoot).hash,
+        history: {
+            state: health.history,
+            churnWindow: health.churnWindow,
+            churnAvailable: health.churnAvailable,
+            commitDate: health.commitDate,
+            inputFingerprint: riskHistoryFingerprint(repoRoot, codeFiles, health.churnWindow)
+        }
+    });
 }
 // ── operations ───────────────────────────────────────────────────────
 export function opInit(root, deps = defaultDeps()) {
@@ -970,6 +987,7 @@ export function opRecordRun(root, opts, deps = defaultDeps()) {
         model: opts.model,
         prompt_version: opts.prompt_version,
         language,
+        artifact_identity: artifactIdentityFor(preGraph, preGraph.workspace.root),
         status,
         reprove_mode: reproveMode,
         reprove_reason: reproveReason,
@@ -1213,6 +1231,7 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
     const closed = dynamicProofSucceeded(oracle);
     const baselineGreen = oracle.baseline?.exitCode === 0 && oracle.baseline?.timedOut !== true;
     const mutantFailedAssertion = oracle.mutant?.assertionFailure === true && oracle.mutant?.timedOut !== true;
+    const artifactIdentity = artifactIdentityFor(graph, sourceRoot);
     const dynamicProof = {
         proof_kind: "dynamic_targeted",
         baseline_green: baselineGreen,
@@ -1223,7 +1242,9 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
         sentinel: oracle.replacementMode ?? replacementMode,
         runner: oracle.runner ?? runner,
         test_path: oracle.test ?? testRel,
-        mutant_status: oracle.status
+        mutant_status: oracle.status,
+        oracle_version: PROOF_ORACLE_VERSION,
+        run_fingerprint: artifactIdentity.run_fingerprint
     };
     const result = appendLedgerRecord(root, {
         run_id: opts.run_id,
@@ -1235,6 +1256,7 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
         evidence_ids: [],
         language,
         dynamic_proof: dynamicProof,
+        artifact_identity: artifactIdentity,
         target_fingerprint: targetFingerprint(graph, target),
         status: closed ? "reproven" : "unproven",
         reason: oracle.reason ?? (closed ? "Dynamic targeted proof closed." : "Dynamic targeted proof did not close."),
@@ -1623,7 +1645,9 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     // Auto-prove (PR 1): key-gated generate→prove for the top provable TS/JS targets.
     // Runs BEFORE the report/RTM writes below so they reflect any freshly-minted Proven.
     // Proof is minted only by opProveLoop's UNCHANGED oracle; no key ⇒ no files, no proof.
-    reportProgress("auto-prove: driving generate → prove on the top provable targets", { current: 6, total: 8 });
+    reportProgress(opts.noAuto
+        ? "auto-prove: disabled (--no-auto)"
+        : "auto-prove: driving generate → prove on the top provable targets", { current: 6, total: 8 });
     let autoProveResult;
     try {
         autoProveResult = await autoProve(root, {
@@ -2279,7 +2303,7 @@ export function opBehaviorCoverageHtml(root, outputPath = "orangepro-behavior-co
             data.delta = computeReportDelta(prev, data);
     }
     catch {
-        data.delta = null;
+        // buildBehaviorReportData already provides an explicit first_run state.
     }
     const html = renderBehaviorReport(data);
     const htmlPath = resolve(root, outputPath);
@@ -2404,6 +2428,7 @@ function incrementalMerge(root, old, changedFiles, now, maxInferredFlows, maxFil
             confirmed_by_layer: confirmedCoverageByLayer({ nodes, edges: prunedEdges })
         }
     };
+    graph.artifact_identity = artifactIdentityFor(graph, root);
     return { graph, updated_entities: updatedEntities, stale_generated_tests: staleCount, warnings: freshFragment.warnings };
 }
 const NO_DIFF_GUIDANCE = "No changed files found. Run this on a feature branch, pass base_ref, or use the test-gaps tool for baseline opportunities (CLI: opro gaps; MCP: orangepro_find_test_gaps).";

package/dist/local/proofDoctor.js

@@ -104,6 +104,7 @@ export function distillProofAttempts(auto, meta) {
         graph_generated_at: manifest?.generated_at ?? null,
         git_commit: manifest?.git?.commit ?? null,
         git_dirty: manifest?.git?.dirty ?? null,
+        artifact_identity: meta.graph.artifact_identity,
         attempted: auto.attempted,
         proven: auto.proven,
         attempts: auto.attempts.map((a) => ({
@@ -128,11 +129,11 @@ export function writeProofAttempts(root, file) {
     writeFileSync(path, JSON.stringify(file, null, 2) + "\n", "utf8");
     return path;
 }
-/** True when the sidecar anchors to the CURRENT graph generation + commit. */
+/** True when the sidecar anchors to the CURRENT material run inputs. */
 export function proofAttemptsFresh(attempts, graph) {
-    const manifest = graph.manifest;
-    return (attempts.graph_generated_at === (manifest?.generated_at ?? null) &&
-        attempts.git_commit === (manifest?.git?.commit ?? null));
+    return Boolean(attempts.artifact_identity?.run_fingerprint &&
+        graph.artifact_identity?.run_fingerprint &&
+        attempts.artifact_identity.run_fingerprint === graph.artifact_identity.run_fingerprint);
 }
 export function loadProofAttempts(root) {
     const path = proofAttemptsPath(root);