@orangepro/orangepro-mcp 0.2.44 → 0.2.46

package/dist/local/score/riskConfig.js

@@ -11,12 +11,18 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 export const DEFAULT_RISK_CONFIG = {
     classification: { test_support_paths: [], scheduled_entry_paths: [], destructive_sinks: [], sensitivity_ignore: [], rank_exclude_paths: [] },
-    tuning: { irreversibility_floor: true, silence_multiplier: true },
+    tuning: { irreversibility_floor: true, silence_multiplier: true, churn_window_days: 180, churn_max_commits: 20_000, churn_timeout_seconds: 300 },
+    proof: { python_runner: "auto", attempt_limit: 20, baseline_green_target: 5 },
     overrides: []
 };
 function asStringArray(v) {
     return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
 }
+function boundedInt(value, fallback, min, max) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return fallback;
+    return Math.max(min, Math.min(max, Math.floor(value)));
+}
 /** Glob → RegExp: `*` matches within a path segment, `**` matches across segments. */
 export function globToRegExp(glob) {
     const esc = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\u0000").replace(/\*/g, "[^/]*").replace(/\u0000/g, ".*");
@@ -43,6 +49,20 @@ function applyFile(cfg, file, warnings, label) {
             cfg.tuning.irreversibility_floor = tun.irreversibility_floor;
         if (typeof tun.silence_multiplier === "boolean")
             cfg.tuning.silence_multiplier = tun.silence_multiplier;
+        if (tun.churn_window_days !== undefined)
+            cfg.tuning.churn_window_days = boundedInt(tun.churn_window_days, cfg.tuning.churn_window_days, 1, 3_650);
+        if (tun.churn_max_commits !== undefined)
+            cfg.tuning.churn_max_commits = boundedInt(tun.churn_max_commits, cfg.tuning.churn_max_commits, 100, 200_000);
+        if (tun.churn_timeout_seconds !== undefined)
+            cfg.tuning.churn_timeout_seconds = boundedInt(tun.churn_timeout_seconds, cfg.tuning.churn_timeout_seconds, 10, 1_800);
+        const proof = (raw.proof ?? {});
+        if (typeof proof.python_runner === "string" && proof.python_runner.trim() !== "") {
+            cfg.proof.python_runner = proof.python_runner.trim();
+        }
+        if (proof.attempt_limit !== undefined)
+            cfg.proof.attempt_limit = boundedInt(proof.attempt_limit, cfg.proof.attempt_limit, 1, 100);
+        if (proof.baseline_green_target !== undefined)
+            cfg.proof.baseline_green_target = boundedInt(proof.baseline_green_target, cfg.proof.baseline_green_target, 1, 100);
         for (const o of Array.isArray(raw.overrides) ? raw.overrides : []) {
             const ov = o;
             if (typeof ov.symbol !== "string" || !["suppress", "pin", "reclassify"].includes(ov.action ?? "")) {

package/dist/local/viz/behaviorReportData.js

@@ -1,13 +1,16 @@
-import { loadRiskConfig } from "../score/riskConfig.js";
 import { configDisclosureFor } from "../score/risk.js";
 import path from "node:path";
 import { buildRtm } from "../rtm.js";
-import { inspectRiskInputHealth, isEntryPoint, rankPriorityGaps, rankRiskGaps, riskHistoryFingerprint } from "../score/risk.js";
+import { inspectRiskChurn, inspectRiskInputHealth, isEntryPoint, rankPriorityGaps, rankRiskGaps, riskHistoryFingerprint } from "../score/risk.js";
 import { PROOF_BLOCKER_GUIDE } from "../proofDoctor.js";
 import { classifyGeneratedDraftBlocker } from "../generate/draftGuidance.js";
 import { buildArtifactIdentity, comparisonCompatibility } from "../provenance.js";
 /** Short human phrase per R-1 needs_setup category, for the "blocked because: …" panel copy. */
 const BLOCK_CATEGORY_LABEL = {
+    environment_unavailable: "a Python test environment that could not start",
+    collection_error: "a Python test collection or import error",
+    go_package_build_failure: "a Go package that could not build for proof",
+    runner_missing: "a missing test runner in the selected package",
     module_not_found: "a missing module or dependency in the sandbox",
     tsconfig_missing: "a monorepo tsconfig the sandbox can't resolve (a parent config the package extends)",
     experimental_builtin: "an experimental Node builtin that needs a runtime flag",
@@ -137,7 +140,7 @@ const ZERO_PROOF_EXPLAINER = {
     body: [
         "OrangePro mapped behaviors, flows, and static test links without running your app. Dynamic proof requires executing tests in a sandbox and checking whether a test fails when the target behavior is mutated.",
         "The statically linked behaviors have test evidence, but they are not verified yet. Treat them as likely covered, not proven.",
-        "OrangePro tries to dynamically prove the top 5 highest-risk behaviors by default. If setup is missing, the report shows the reason, such as missing dependencies, database setup, environment variables, or unsupported test runner configuration."
+        "OrangePro uses a bounded proof pass. For Python, it can examine up to the configured attempt limit to find the configured number of green baselines; environment or collection failures are recorded without being mistaken for failed product tests."
     ]
 };
 function pipeline(graph, ledger, summary) {
@@ -175,21 +178,42 @@ function proofGuidance(ledger, summary, dyn) {
     // — behaviors, flows, Statically Linked signals — is unaffected; only the dynamic pass is small.
     if (dyn) {
         if (dyn.attempted === 0) {
+            const why = dyn.status === "disabled"
+                ? " Auto-prove was disabled for this run (--no-auto)."
+                : dyn.scopedChangedFiles !== undefined
+                    ? ` The pass was scoped to ${dyn.scopedChangedFiles.toLocaleString()} changed file${dyn.scopedChangedFiles === 1 ? "" : "s"} in the working tree, and none had a provable target with a linked test.`
+                    : dyn.status === "no-targets"
+                        ? " No provable target with a linked existing test was found."
+                        : dyn.reason
+                            ? ` ${dyn.reason}`
+                            : "";
             return {
                 state: "not_started",
                 title: "0 Dynamically Proven — dynamic proof was not attempted",
-                body: "Dynamic proof was not attempted in this run. Static behavior mapping and Statically Linked signals are still available.",
+                body: `Dynamic proof was not attempted in this run.${why} Static behavior mapping and Statically Linked signals are still available.`,
                 action: HANDOFF_ACTION
             };
         }
         const dom = dominantBlockReason(dyn.needsSetup);
+        const environmentClasses = new Set(["environment_unavailable", "collection_error"]);
+        const allEnvironmentUnavailable = dyn.attempted > 0
+            && dyn.needsSetup.length >= dyn.attempted
+            && dyn.needsSetup.every((attempt) => environmentClasses.has(attempt.category ?? ""));
+        if (allEnvironmentUnavailable) {
+            return {
+                state: "attempted",
+                title: "Proof not run: test environment could not be started (see ledger)",
+                body: "Proof not run: test environment could not be started (see ledger)",
+                action: HANDOFF_ACTION
+            };
+        }
         const allBlocked = dyn.needsSetup.length > 0 && dyn.needsSetup.length >= dyn.attempted;
         const plural = dyn.attempted === 1 ? "" : "s";
         if (allBlocked && dom) {
             return {
                 state: "attempted",
                 title: `0 Dynamically Proven — top ${dyn.attempted} attempted, all setup-blocked`,
-                body: `Dynamic proof attempted ${dyn.attempted} target${plural}; all were blocked by ${dom.label} (${dom.count}/${dom.total}). This is a sandbox setup gap, not a static-test failure — the Statically Linked signals are still shown.`,
+                body: `Dynamic proof attempted ${dyn.attempted} target${plural}; none reached a green baseline. Most common block: ${dom.label} (${dom.count}/${dom.total} actual attempts). This is a test-environment/setup gap, not a static-test failure — the Statically Linked signals are still shown.`,
                 action: nextStepFor(dom) ?? HANDOFF_ACTION
             };
         }
@@ -204,6 +228,15 @@ function proofGuidance(ledger, summary, dyn) {
     // Standalone report regen (no THIS-RUN data) → derive from the ledger only.
     const dynamicAttempts = ledger.records.filter((r) => r.dynamic_proof?.proof_kind === "dynamic_targeted");
     if (dynamicAttempts.length > 0) {
+        const unavailableClasses = new Set(["env_unavailable", "collection_error"]);
+        if (dynamicAttempts.every((attempt) => unavailableClasses.has(attempt.dynamic_proof?.failure_class ?? ""))) {
+            return {
+                state: "attempted",
+                title: "Proof not run: test environment could not be started (see ledger)",
+                body: "Proof not run: test environment could not be started (see ledger)",
+                action: HANDOFF_ACTION
+            };
+        }
         return {
             state: "attempted",
             title: "0 Dynamically Proven — dynamic proof ran, none closed yet",
@@ -242,6 +275,12 @@ function scanBlock(graph, rows) {
     const unit = tests.filter((n) => n.properties.test_layer === "unit" || n.properties.test_layer === "component").length;
     const denominator = graph.analysis?.denominator;
     const runtime = graph.analysis?.runtime_coverage;
+    const rankingExclusions = new Map();
+    for (const node of graph.nodes) {
+        const code = node.kind === "CodeSymbol" && node.denominator_eligible === true ? node.properties.ranking_exclusion_code : undefined;
+        if (typeof code === "string" && code)
+            rankingExclusions.set(code, (rankingExclusions.get(code) ?? 0) + 1);
+    }
     const excludedCount = (denominator?.excluded_boilerplate ?? 0) +
         (denominator?.excluded_infra ?? 0) +
         (denominator?.excluded_generated ?? 0) +
@@ -269,7 +308,8 @@ function scanBlock(graph, rows) {
             count: excludedCount > 0 ? String(excludedCount) : "0",
             text: "non-behavior symbols were excluded from the behavior count — generated code, framework internals, test-inferred flows, and infrastructure plumbing."
         },
-        excludedCliCommands: excludedCliCommands(graph)
+        excludedCliCommands: excludedCliCommands(graph),
+        rankingExclusions: [...rankingExclusions.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([code, count]) => ({ code, count }))
     };
 }
 function behaviorLists(rows, flowIds) {
@@ -455,7 +495,7 @@ function displayTitle(title, file) {
 }
 /** Deterministic 1–2 line behavior context from graph facts only — no LLM.
  *  Sensitivity label mirrors deriveDataSensitivity's tiers. */
-function riskContext(risk) {
+export function riskContext(risk, churnWindowDays, churnMeta, sameSinkAs) {
     const sens = (risk.data_sensitivity ?? 1) >= 10 ? "payment/billing-sensitive"
         : (risk.data_sensitivity ?? 1) >= 9 ? "auth/session-sensitive"
             : (risk.data_sensitivity ?? 1) >= 7 ? "order/transaction"
@@ -469,10 +509,11 @@ function riskContext(risk) {
             : "deep in the call graph";
     const sink = risk.sink_callee;
     const scheduled = risk.scheduled_entry === true;
-    const churnKnown = risk.churn_available !== false;
-    const churn = churnKnown
-        ? (risk.git_churn > 0 ? `${risk.git_churn} line${risk.git_churn === 1 ? "" : "s"} changed in 180 days` : "unchanged in 180 days")
-        : "change history unavailable";
+    const churn = churnMeta.state === "partial"
+        ? `${risk.git_churn} churn line${risk.git_churn === 1 ? "" : "s"} in file over partial change history (${churnMeta.commitsScanned} commits)`
+        : churnMeta.state === "complete" && risk.churn_available !== false
+            ? `${risk.git_churn} churn line${risk.git_churn === 1 ? "" : "s"} in file over ${churnWindowDays} days`
+            : "change history unavailable";
     const tier = risk.detection_tier ?? "";
     const evidence = tier === "candidate"
         ? "no test links here (a similarly-named test exists but never calls it)"
@@ -492,6 +533,7 @@ function riskContext(risk) {
     const seen = [
         pos + (sens ? ` on ${sens} paths` : ""),
         ...(sink ? [`reaches \`${sink}\` within two calls`] : []),
+        ...(sink && sameSinkAs ? [`same delete call as \`${sameSinkAs}\` (ranked higher)`] : []),
         ...(scheduled ? ["scheduled / queue-triggered"] : []),
         `${risk.fan_out ?? 0} downstream call${(risk.fan_out ?? 0) === 1 ? "" : "s"}`,
         churn,
@@ -902,13 +944,19 @@ function riskTodo(risk, verb, path, generatedTests) {
     }
     return `No test signal exists. Start with one integration test that ${call} and asserts the observable outcome.${sens}`;
 }
-function riskRows(risks, graph) {
+function riskRows(risks, graph, churnWindowDays, churnMeta) {
     const maxRiskScore = risks.reduce((m, r) => Math.max(m, r.risk_score), 0);
     const riskIds = new Set(risks.map((r) => r.id));
     const firstRowForFile = new Map();
     for (const r of risks)
         if (!firstRowForFile.has(r.file))
             firstRowForFile.set(r.file, r.id);
+    // R8.10 (display only): rows that reach the SAME destructive call site through
+    // forwarding wrappers name the higher-ranked row. Order and membership unchanged.
+    const firstRowForSink = new Map();
+    for (const r of risks)
+        if (r.sink_owner && !firstRowForSink.has(r.sink_owner))
+            firstRowForSink.set(r.sink_owner, { id: r.id, title: r.title });
     // Ambiguity-qualified display: identical titles from DIFFERENT files
     // (multi-program repos: 76 x main) get their top-level dir as a prefix.
     // Purely display; single-file titles render unchanged everywhere else.
@@ -958,7 +1006,9 @@ function riskRows(risks, graph) {
                     todo: riskTodo(risk, verb, path, generatedTests)
                 };
             })(),
-            context: riskContext(risk),
+            context: riskContext(risk, churnWindowDays, churnMeta, risk.sink_owner && firstRowForSink.get(risk.sink_owner) && firstRowForSink.get(risk.sink_owner).id !== risk.id
+                ? firstRowForSink.get(risk.sink_owner).title
+                : undefined),
             desc: risk.reasons.join(" · "),
             tags
         };
@@ -1008,11 +1058,22 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         provenIds,
         includeAssociated: true
     }).filter((r) => r.sink_callee).slice(0, 20)
-        .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, sink: r.sink_callee ?? "" }));
+        .map((r, _index, rows) => {
+        const first = rows.find((x) => x.sink_owner && x.sink_owner === r.sink_owner);
+        return {
+            path: r.title,
+            file: r.file,
+            score: r.risk_score,
+            sink: r.sink_callee ?? "",
+            ...(first && first.id !== r.id ? { sameSinkAs: first.title } : {})
+        };
+    });
     const riskHealth = inspectRiskInputHealth(repoRoot);
-    const churnAvailable = riskHealth.churnAvailable && riskGaps.every((risk) => risk.churn_available !== false);
-    const configHash = loadRiskConfig(repoRoot).hash;
     const codeFiles = Object.entries(graph.manifest.files).filter(([, file]) => file.kind === "code").map(([file]) => file);
+    const churnMeta = inspectRiskChurn(repoRoot, codeFiles, riskHealth.churnWindow);
+    const churnAvailable = churnMeta.state === "complete" && riskGaps.every((risk) => risk.churn_available !== false);
+    const configDisclosure = configDisclosureFor(graph, repoRoot);
+    const configHash = configDisclosure.hash;
     const identity = buildArtifactIdentity(graph, {
         configHash,
         history: {
@@ -1028,16 +1089,18 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         gitRoot: riskHealth.gitRoot ? path.basename(riskHealth.gitRoot) : null,
         commit: riskHealth.commit,
         history: riskHealth.history,
-        churn: churnAvailable ? "available" : "unavailable",
+        churn: churnMeta.state === "complete" ? "available" : churnMeta.state,
+        churnState: churnMeta.state,
+        commitsScanned: churnMeta.commitsScanned,
         churnWindow: riskHealth.churnWindow,
         toolVersion: identity.tool_version,
         configHash,
         identity,
         inputFingerprint: identity.run_fingerprint.replace(/^sha256:/, "").slice(0, 16),
-        reason: churnAvailable ? undefined : (riskHealth.reason ?? "Git churn scan did not complete")
+        reason: churnMeta.state === "complete" ? undefined : (churnMeta.reason ?? riskHealth.reason ?? "error: churn acquisition returned no reason")
     };
     const lists = behaviorLists(rows, flowIds);
-    const risks = riskRows(riskGaps, graph);
+    const risks = riskRows(riskGaps, graph, configDisclosure.tuning.churn_window_days, churnMeta);
     const sortedBehaviors = [...lists.behaviors].sort((a, b) => tierRank(a) - tierRank(b));
     const flowRows = flows(graph, rows, riskGaps);
     return {
@@ -1057,7 +1120,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         candidateFlows: candidateFlows(graph),
         risks,
         worklists: { changeFrontier, irreversible },
-        configDisclosure: configDisclosureFor(graph, repoRoot),
+        configDisclosure,
         zeroProofExplainer: summary.proven === 0 ? { title: ZERO_PROOF_EXPLAINER.title, body: [...ZERO_PROOF_EXPLAINER.body] } : null,
         mapModel: buildSystemMapModel({ flows: flowRows, risks, behaviors: sortedBehaviors }),
         delta: firstRunDelta(),

package/dist/local/viz/behaviorReportHtml.js

@@ -345,6 +345,7 @@ body[data-mode="expert"] .simple-only{display:none!important}
 </header>
 <div class="provenance" id="provenance"></div>
 <div class="scope-note" id="cli-exclusions" hidden></div>
+<div class="scope-note" id="ranking-exclusions" hidden></div>
 
 <section class="kpis" id="kpis"></section>
 <p class="metric-scope" id="metric-scope"></p>
@@ -694,6 +695,12 @@ if(excludedCli.length){
   note.hidden=false;
   note.textContent="CLI command entries excluded from the behavior count: "+excludedCli.map(x=>x.path+" ("+x.reason+")").join(" · ");
 }
+const rankExclusions=D.scan.rankingExclusions||[];
+if(rankExclusions.length){
+  const note=$("#ranking-exclusions");
+  note.hidden=false;
+  note.textContent="Excluded from ranking only (still counted as behaviors): "+rankExclusions.map(x=>x.code+" "+x.count).join(" · ");
+}
 $("#fw-pill").textContent=D.framework;
 
 // bridge text in codebase tab
@@ -1050,13 +1057,17 @@ renderRisks();
   if(!C||!host)return;
   const warn=(C.warnings||[]).length>0;
   const K=C.classification||{};
+  const P=C.proof||{};
+  const T=C.tuning||{};
   const clsSet=["test_support_paths","scheduled_entry_paths","destructive_sinks","sensitivity_ignore"].filter(k=>(K[k]||[]).length>0);
-  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0;
+  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0||(T.churn_window_days??180)!==180||(T.churn_max_commits??20000)!==20000||(T.churn_timeout_seconds??300)!==300||P.python_runner!=="auto"||P.attempt_limit!==20||P.baseline_green_target!==5;
   const bits=["config <b>"+esc(C.hash)+"</b>","overrides active <b>"+C.overridesActive+"</b>","suppressed <b>"+(C.suppressed||[]).length+"</b>"];
   if((C.rankExcludePaths||[]).length)bits.push("ranking excludes <b>"+esc(C.rankExcludePaths.join(", "))+"</b>");
   if(!C.floor)bits.push("<b>irreversibility floor OFF</b>");
   if(!C.silence)bits.push("<b>silence multiplier OFF</b>");
   let html="<div>"+bits.join(" · ")+"</div>";
+  html+='<span class="cfg-row">Churn window: <b>'+esc(String(T.churn_window_days??180))+' days</b> · history bound <b>'+esc(String(T.churn_max_commits??20000))+' commits / '+esc(String(T.churn_timeout_seconds??300))+' s</b></span>';
+  html+='<span class="cfg-row">Python proof: runner <b>'+esc(P.python_runner||"auto")+'</b> · attempt limit <b>'+esc(String(P.attempt_limit??20))+'</b> · green baseline target <b>'+esc(String(P.baseline_green_target??5))+'</b></span>';
   clsSet.forEach(k=>{html+='<span class="cfg-row">'+esc(k)+': <b>'+esc(K[k].join(", "))+'</b></span>';});
   if((C.sensitivityIgnored||[]).length)html+='<span class="cfg-row">sensitivity ignored by config (score changed): <b>'+esc(C.sensitivityIgnored.join(", "))+'</b></span>';
   (C.suppressed||[]).forEach(s=>{html+='<span class="cfg-row">suppressed by config: <b>'+esc(s.symbol)+'</b> — '+esc(s.reason)+'</span>';});
@@ -1075,7 +1086,7 @@ renderRisks();
     return \`<div class="wl-row" data-path="\${esc(path).replace(/"/g,'&quot;')}" title="\${inTop?'in the ranked list below — click to jump':'ranked, but below the top-20 cut'}"><span class="wl-path">\${esc(path)}</span><span class="wl-meta">\${esc(meta)}</span></div>\`;
   };
   const cf=(W.changeFrontier||[]).map(r=>row(r.path,"changes "+(r.probability>=7?"a lot":r.probability>=4?"often":"some"))).join("")||'<div class="wl-empty">nothing changing fast and unproven</div>';
-  const ir=(W.irreversible||[]).map(r=>row(r.path,"→ "+(r.sink||"").split(".").pop())).join("")||'<div class="wl-empty">no unproven path reaches a delete</div>';
+  const ir=(W.irreversible||[]).map(r=>row(r.path,"→ "+(r.sink||"").split(".").pop()+(r.sameSinkAs?" · same delete as "+r.sameSinkAs:""))).join("")||'<div class="wl-empty">no unproven path reaches a delete</div>';
   host.innerHTML=\`<div class="wl-grid">
     <div class="wl-card"><p class="wl-title wl-change">Changing fast · unproven</p><p class="wl-sub">Where the code moves most with nothing proving it. The place a bug is most likely to have just arrived.</p>\${cf}</div>
     <div class="wl-card"><p class="wl-title wl-irrev">Can destroy data · unproven</p><p class="wl-sub">Paths that reach a delete or purge with nothing proving they do the right thing. Rarely changing — which is why nobody looks.</p>\${ir}</div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.44",
+  "version": "0.2.46",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",