@orangepro/orangepro-mcp 0.2.44 → 0.2.45

package/dist/local/viz/behaviorReportData.js

@@ -1,13 +1,16 @@
-import { loadRiskConfig } from "../score/riskConfig.js";
 import { configDisclosureFor } from "../score/risk.js";
 import path from "node:path";
 import { buildRtm } from "../rtm.js";
-import { inspectRiskInputHealth, isEntryPoint, rankPriorityGaps, rankRiskGaps, riskHistoryFingerprint } from "../score/risk.js";
+import { inspectRiskChurn, inspectRiskInputHealth, isEntryPoint, rankPriorityGaps, rankRiskGaps, riskHistoryFingerprint } from "../score/risk.js";
 import { PROOF_BLOCKER_GUIDE } from "../proofDoctor.js";
 import { classifyGeneratedDraftBlocker } from "../generate/draftGuidance.js";
 import { buildArtifactIdentity, comparisonCompatibility } from "../provenance.js";
 /** Short human phrase per R-1 needs_setup category, for the "blocked because: …" panel copy. */
 const BLOCK_CATEGORY_LABEL = {
+    environment_unavailable: "a Python test environment that could not start",
+    collection_error: "a Python test collection or import error",
+    go_package_build_failure: "a Go package that could not build for proof",
+    runner_missing: "a missing test runner in the selected package",
     module_not_found: "a missing module or dependency in the sandbox",
     tsconfig_missing: "a monorepo tsconfig the sandbox can't resolve (a parent config the package extends)",
     experimental_builtin: "an experimental Node builtin that needs a runtime flag",
@@ -137,7 +140,7 @@ const ZERO_PROOF_EXPLAINER = {
     body: [
         "OrangePro mapped behaviors, flows, and static test links without running your app. Dynamic proof requires executing tests in a sandbox and checking whether a test fails when the target behavior is mutated.",
         "The statically linked behaviors have test evidence, but they are not verified yet. Treat them as likely covered, not proven.",
-        "OrangePro tries to dynamically prove the top 5 highest-risk behaviors by default. If setup is missing, the report shows the reason, such as missing dependencies, database setup, environment variables, or unsupported test runner configuration."
+        "OrangePro uses a bounded proof pass. For Python, it can examine up to the configured attempt limit to find the configured number of green baselines; environment or collection failures are recorded without being mistaken for failed product tests."
     ]
 };
 function pipeline(graph, ledger, summary) {
@@ -183,13 +186,25 @@ function proofGuidance(ledger, summary, dyn) {
             };
         }
         const dom = dominantBlockReason(dyn.needsSetup);
+        const environmentClasses = new Set(["environment_unavailable", "collection_error"]);
+        const allEnvironmentUnavailable = dyn.attempted > 0
+            && dyn.needsSetup.length >= dyn.attempted
+            && dyn.needsSetup.every((attempt) => environmentClasses.has(attempt.category ?? ""));
+        if (allEnvironmentUnavailable) {
+            return {
+                state: "attempted",
+                title: "Proof not run: test environment could not be started (see ledger)",
+                body: "Proof not run: test environment could not be started (see ledger)",
+                action: HANDOFF_ACTION
+            };
+        }
         const allBlocked = dyn.needsSetup.length > 0 && dyn.needsSetup.length >= dyn.attempted;
         const plural = dyn.attempted === 1 ? "" : "s";
         if (allBlocked && dom) {
             return {
                 state: "attempted",
                 title: `0 Dynamically Proven — top ${dyn.attempted} attempted, all setup-blocked`,
-                body: `Dynamic proof attempted ${dyn.attempted} target${plural}; all were blocked by ${dom.label} (${dom.count}/${dom.total}). This is a sandbox setup gap, not a static-test failure — the Statically Linked signals are still shown.`,
+                body: `Dynamic proof attempted ${dyn.attempted} target${plural}; none reached a green baseline. Most common block: ${dom.label} (${dom.count}/${dom.total} actual attempts). This is a test-environment/setup gap, not a static-test failure — the Statically Linked signals are still shown.`,
                 action: nextStepFor(dom) ?? HANDOFF_ACTION
             };
         }
@@ -204,6 +219,15 @@ function proofGuidance(ledger, summary, dyn) {
     // Standalone report regen (no THIS-RUN data) → derive from the ledger only.
     const dynamicAttempts = ledger.records.filter((r) => r.dynamic_proof?.proof_kind === "dynamic_targeted");
     if (dynamicAttempts.length > 0) {
+        const unavailableClasses = new Set(["env_unavailable", "collection_error"]);
+        if (dynamicAttempts.every((attempt) => unavailableClasses.has(attempt.dynamic_proof?.failure_class ?? ""))) {
+            return {
+                state: "attempted",
+                title: "Proof not run: test environment could not be started (see ledger)",
+                body: "Proof not run: test environment could not be started (see ledger)",
+                action: HANDOFF_ACTION
+            };
+        }
         return {
             state: "attempted",
             title: "0 Dynamically Proven — dynamic proof ran, none closed yet",
@@ -242,6 +266,12 @@ function scanBlock(graph, rows) {
     const unit = tests.filter((n) => n.properties.test_layer === "unit" || n.properties.test_layer === "component").length;
     const denominator = graph.analysis?.denominator;
     const runtime = graph.analysis?.runtime_coverage;
+    const rankingExclusions = new Map();
+    for (const node of graph.nodes) {
+        const code = node.kind === "CodeSymbol" && node.denominator_eligible === true ? node.properties.ranking_exclusion_code : undefined;
+        if (typeof code === "string" && code)
+            rankingExclusions.set(code, (rankingExclusions.get(code) ?? 0) + 1);
+    }
     const excludedCount = (denominator?.excluded_boilerplate ?? 0) +
         (denominator?.excluded_infra ?? 0) +
         (denominator?.excluded_generated ?? 0) +
@@ -269,7 +299,8 @@ function scanBlock(graph, rows) {
             count: excludedCount > 0 ? String(excludedCount) : "0",
             text: "non-behavior symbols were excluded from the behavior count — generated code, framework internals, test-inferred flows, and infrastructure plumbing."
         },
-        excludedCliCommands: excludedCliCommands(graph)
+        excludedCliCommands: excludedCliCommands(graph),
+        rankingExclusions: [...rankingExclusions.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([code, count]) => ({ code, count }))
     };
 }
 function behaviorLists(rows, flowIds) {
@@ -455,7 +486,7 @@ function displayTitle(title, file) {
 }
 /** Deterministic 1–2 line behavior context from graph facts only — no LLM.
  *  Sensitivity label mirrors deriveDataSensitivity's tiers. */
-function riskContext(risk) {
+export function riskContext(risk, churnWindowDays, churnMeta) {
     const sens = (risk.data_sensitivity ?? 1) >= 10 ? "payment/billing-sensitive"
         : (risk.data_sensitivity ?? 1) >= 9 ? "auth/session-sensitive"
             : (risk.data_sensitivity ?? 1) >= 7 ? "order/transaction"
@@ -469,10 +500,11 @@ function riskContext(risk) {
             : "deep in the call graph";
     const sink = risk.sink_callee;
     const scheduled = risk.scheduled_entry === true;
-    const churnKnown = risk.churn_available !== false;
-    const churn = churnKnown
-        ? (risk.git_churn > 0 ? `${risk.git_churn} line${risk.git_churn === 1 ? "" : "s"} changed in 180 days` : "unchanged in 180 days")
-        : "change history unavailable";
+    const churn = churnMeta.state === "partial"
+        ? `${risk.git_churn} churn line${risk.git_churn === 1 ? "" : "s"} in file over partial change history (${churnMeta.commitsScanned} commits)`
+        : churnMeta.state === "complete" && risk.churn_available !== false
+            ? `${risk.git_churn} churn line${risk.git_churn === 1 ? "" : "s"} in file over ${churnWindowDays} days`
+            : "change history unavailable";
     const tier = risk.detection_tier ?? "";
     const evidence = tier === "candidate"
         ? "no test links here (a similarly-named test exists but never calls it)"
@@ -902,7 +934,7 @@ function riskTodo(risk, verb, path, generatedTests) {
     }
     return `No test signal exists. Start with one integration test that ${call} and asserts the observable outcome.${sens}`;
 }
-function riskRows(risks, graph) {
+function riskRows(risks, graph, churnWindowDays, churnMeta) {
     const maxRiskScore = risks.reduce((m, r) => Math.max(m, r.risk_score), 0);
     const riskIds = new Set(risks.map((r) => r.id));
     const firstRowForFile = new Map();
@@ -958,7 +990,7 @@ function riskRows(risks, graph) {
                     todo: riskTodo(risk, verb, path, generatedTests)
                 };
             })(),
-            context: riskContext(risk),
+            context: riskContext(risk, churnWindowDays, churnMeta),
             desc: risk.reasons.join(" · "),
             tags
         };
@@ -1010,9 +1042,11 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
     }).filter((r) => r.sink_callee).slice(0, 20)
         .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, sink: r.sink_callee ?? "" }));
     const riskHealth = inspectRiskInputHealth(repoRoot);
-    const churnAvailable = riskHealth.churnAvailable && riskGaps.every((risk) => risk.churn_available !== false);
-    const configHash = loadRiskConfig(repoRoot).hash;
     const codeFiles = Object.entries(graph.manifest.files).filter(([, file]) => file.kind === "code").map(([file]) => file);
+    const churnMeta = inspectRiskChurn(repoRoot, codeFiles, riskHealth.churnWindow);
+    const churnAvailable = churnMeta.state === "complete" && riskGaps.every((risk) => risk.churn_available !== false);
+    const configDisclosure = configDisclosureFor(graph, repoRoot);
+    const configHash = configDisclosure.hash;
     const identity = buildArtifactIdentity(graph, {
         configHash,
         history: {
@@ -1028,16 +1062,18 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         gitRoot: riskHealth.gitRoot ? path.basename(riskHealth.gitRoot) : null,
         commit: riskHealth.commit,
         history: riskHealth.history,
-        churn: churnAvailable ? "available" : "unavailable",
+        churn: churnMeta.state === "complete" ? "available" : churnMeta.state,
+        churnState: churnMeta.state,
+        commitsScanned: churnMeta.commitsScanned,
         churnWindow: riskHealth.churnWindow,
         toolVersion: identity.tool_version,
         configHash,
         identity,
         inputFingerprint: identity.run_fingerprint.replace(/^sha256:/, "").slice(0, 16),
-        reason: churnAvailable ? undefined : (riskHealth.reason ?? "Git churn scan did not complete")
+        reason: churnMeta.state === "complete" ? undefined : (churnMeta.reason ?? riskHealth.reason ?? "error: churn acquisition returned no reason")
     };
     const lists = behaviorLists(rows, flowIds);
-    const risks = riskRows(riskGaps, graph);
+    const risks = riskRows(riskGaps, graph, configDisclosure.tuning.churn_window_days, churnMeta);
     const sortedBehaviors = [...lists.behaviors].sort((a, b) => tierRank(a) - tierRank(b));
     const flowRows = flows(graph, rows, riskGaps);
     return {
@@ -1057,7 +1093,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         candidateFlows: candidateFlows(graph),
         risks,
         worklists: { changeFrontier, irreversible },
-        configDisclosure: configDisclosureFor(graph, repoRoot),
+        configDisclosure,
         zeroProofExplainer: summary.proven === 0 ? { title: ZERO_PROOF_EXPLAINER.title, body: [...ZERO_PROOF_EXPLAINER.body] } : null,
         mapModel: buildSystemMapModel({ flows: flowRows, risks, behaviors: sortedBehaviors }),
         delta: firstRunDelta(),

package/dist/local/viz/behaviorReportHtml.js

@@ -345,6 +345,7 @@ body[data-mode="expert"] .simple-only{display:none!important}
 </header>
 <div class="provenance" id="provenance"></div>
 <div class="scope-note" id="cli-exclusions" hidden></div>
+<div class="scope-note" id="ranking-exclusions" hidden></div>
 
 <section class="kpis" id="kpis"></section>
 <p class="metric-scope" id="metric-scope"></p>
@@ -694,6 +695,12 @@ if(excludedCli.length){
   note.hidden=false;
   note.textContent="CLI command entries excluded from the behavior count: "+excludedCli.map(x=>x.path+" ("+x.reason+")").join(" · ");
 }
+const rankExclusions=D.scan.rankingExclusions||[];
+if(rankExclusions.length){
+  const note=$("#ranking-exclusions");
+  note.hidden=false;
+  note.textContent="Excluded from ranking only (still counted as behaviors): "+rankExclusions.map(x=>x.code+" "+x.count).join(" · ");
+}
 $("#fw-pill").textContent=D.framework;
 
 // bridge text in codebase tab
@@ -1050,13 +1057,17 @@ renderRisks();
   if(!C||!host)return;
   const warn=(C.warnings||[]).length>0;
   const K=C.classification||{};
+  const P=C.proof||{};
+  const T=C.tuning||{};
   const clsSet=["test_support_paths","scheduled_entry_paths","destructive_sinks","sensitivity_ignore"].filter(k=>(K[k]||[]).length>0);
-  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0;
+  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0||(T.churn_window_days??180)!==180||P.python_runner!=="auto"||P.attempt_limit!==20||P.baseline_green_target!==5;
   const bits=["config <b>"+esc(C.hash)+"</b>","overrides active <b>"+C.overridesActive+"</b>","suppressed <b>"+(C.suppressed||[]).length+"</b>"];
   if((C.rankExcludePaths||[]).length)bits.push("ranking excludes <b>"+esc(C.rankExcludePaths.join(", "))+"</b>");
   if(!C.floor)bits.push("<b>irreversibility floor OFF</b>");
   if(!C.silence)bits.push("<b>silence multiplier OFF</b>");
   let html="<div>"+bits.join(" · ")+"</div>";
+  html+='<span class="cfg-row">Churn window: <b>'+esc(String(T.churn_window_days??180))+' days</b></span>';
+  html+='<span class="cfg-row">Python proof: runner <b>'+esc(P.python_runner||"auto")+'</b> · attempt limit <b>'+esc(String(P.attempt_limit??20))+'</b> · green baseline target <b>'+esc(String(P.baseline_green_target??5))+'</b></span>';
   clsSet.forEach(k=>{html+='<span class="cfg-row">'+esc(k)+': <b>'+esc(K[k].join(", "))+'</b></span>';});
   if((C.sensitivityIgnored||[]).length)html+='<span class="cfg-row">sensitivity ignored by config (score changed): <b>'+esc(C.sensitivityIgnored.join(", "))+'</b></span>';
   (C.suppressed||[]).forEach(s=>{html+='<span class="cfg-row">suppressed by config: <b>'+esc(s.symbol)+'</b> — '+esc(s.reason)+'</span>';});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.44",
+  "version": "0.2.45",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",