@orangepro/orangepro-mcp 0.2.6 → 0.2.7

package/README.md

@@ -32,7 +32,7 @@ The command writes:
 orangepro_generated/         ← contained generated tests; existing source files are untouched
 ```
 
-The report opens on a **system map** of your repo — entry lanes (GraphQL/HTTP/Jobs) flowing into the services they reach, sized by traffic, colored by evidence tier, risk-ringed — identical on every run. Each rerun shows a **delta banner**: what changed since last run, or "No changes — identical graph, identical ranking." Every one of the ~N behaviors gets a plain-English description; every top risk gets a deterministic context line and a state-aware next step.
+The report opens on a **system map** of your repo — entry lanes (GraphQL/HTTP/Jobs) flowing into the services they reach, sized by traffic, colored by evidence tier, risk-ringed — identical on every run. Each completed rerun shows a **delta banner** against the previous completed run. The report discloses when bounded path enumeration prunes additional branch expansions. Every behavior gets a plain-English description; every top risk gets a deterministic context line and a state-aware next step.
 
 Run `opro export` when you want a machine-readable evidence pack.
 <img width="895" height="960" alt="Screenshot 2026-07-08 at 1 18 01 AM" src="https://github.com/user-attachments/assets/73b8a812-2eab-43a1-8aed-4289545e630b" />
@@ -189,7 +189,7 @@ If the environment can't run tests yet (dependencies not installed, runner uncon
 
 ## Test categories
 
-Generation is evidence-gated. A category is produced only when the graph has supporting evidence — never padded with generic filler. These are the local generation buckets. The report additionally shows each risk's **applicable testing categories** (contract, boundary limits, integration flow, state lifecycle, failure recovery, …), derived deterministically from graph facts — covered categories from real attached tests render normally; the rest render locked, meaning "warranted here, generated on the platform," never "hidden tests exist." Neither taxonomy changes evidence tiers.
+Generation is evidence-gated. A category is produced only when the graph has supporting evidence — never padded with generic filler. These are the local generation buckets. The report additionally shows each risk's **applicable testing categories** (contract, boundary limits, integration flow, state lifecycle, failure recovery, …), derived deterministically from graph facts. Categories with generated drafts are highlighted as drafts; they are not coverage or proof, and remaining applicable categories stay outlined. Neither taxonomy changes evidence tiers.
 
 | Category | What it targets |
 |----------|-----------------|

package/dist/local/autoProve.js

@@ -794,7 +794,8 @@ export async function autoProve(root, opts, deps) {
         dynamicProofRunner: deps.dynamicProofRunner,
         coverageRunner: deps.coverageRunner,
         analyze: deps.analyze,
-        aiProvider: deps.aiProvider
+        aiProvider: deps.aiProvider,
+        suppressBehaviorReportRefresh: deps.suppressBehaviorReportRefresh
     };
     const graph = loadGraph(workspacePaths(root).graphPath);
     const sourceRoot = resolve(graph.workspace.root);

package/dist/local/flows/flowWalker.js

@@ -3,7 +3,7 @@ import { LOCAL_GRAPH_SCHEMA_VERSION } from "../graph/ontology.js";
 import { rankRiskGaps } from "../score/risk.js";
 import { stableId } from "../util/ids.js";
 const DEFAULT_MAX_DEPTH = 8;
-const DEFAULT_MAX_FLOWS_PER_ENTRY = 5;
+const DEFAULT_MAX_FLOWS_PER_ENTRY = 20;
 const DEFAULT_GLOBAL_CAP = 500;
 const HIGH_ROUTE_RE = /payment|refund|checkout|cart|order|auth|login|token|customer|user|tax|fulfillment|ship/i;
 const MUTATION_METHOD_RE = /^(POST|PUT|PATCH|DELETE)\b/i;

package/dist/local/operations.js

@@ -1327,11 +1327,13 @@ export function opProveLoop(root, opts, deps = defaultDeps()) {
     // Best-effort report refresh (exactly like ai-flows --apply): a render failure
     // must never fail a completed proof — the ledger/cert is already written.
     let behaviorCoveragePath;
-    try {
-        behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`).behavior_coverage_path;
-    }
-    catch {
-        // ponytail: swallow — refresh is advisory; DynamicProofResult carries no warnings channel.
+    if (!deps.suppressBehaviorReportRefresh) {
+        try {
+            behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`).behavior_coverage_path;
+        }
+        catch {
+            // ponytail: swallow — refresh is advisory; DynamicProofResult carries no warnings channel.
+        }
     }
     return { ...proof, ...(behaviorCoveragePath ? { behavior_coverage_path: behaviorCoveragePath } : {}) };
 }
@@ -1405,11 +1407,13 @@ export async function opAiFlows(root, opts = {}, deps = defaultDeps()) {
         // Best-effort: a render failure must never fail apply (graph is saved).
         const warnings = [...result.warnings];
         let behaviorCoveragePath;
-        try {
-            behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`).behavior_coverage_path;
-        }
-        catch (error) {
-            warnings.push(`behavior coverage view not written: ${error instanceof Error ? error.message : String(error)}`);
+        if (!deps.suppressBehaviorReportRefresh) {
+            try {
+                behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`).behavior_coverage_path;
+            }
+            catch (error) {
+                warnings.push(`behavior coverage view not written: ${error instanceof Error ? error.message : String(error)}`);
+            }
         }
         return { ...result, warnings, ...(behaviorCoveragePath ? { behavior_coverage_path: behaviorCoveragePath } : {}) };
     }
@@ -1471,11 +1475,7 @@ function writeStartStaticSnapshot(root, baseRef, warnings) {
     let behaviorCoveragePath;
     try {
         reportProgress("artifacts: writing static behavior view (proof still running)", { current: 4, total: 8 });
-        behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`, {
-            attempted: 0,
-            proven: 0,
-            needsSetup: []
-        }).behavior_coverage_path;
+        behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`, { attempted: 0, proven: 0, needsSetup: [] }, { persistBaseline: false }).behavior_coverage_path;
     }
     catch (error) {
         warnings.push(`static behavior view not written: ${error instanceof Error ? error.message : String(error)}`);
@@ -1493,7 +1493,9 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     const providerOpts = startProviderOverride(root, opts);
     const scanRoot = opts.source ? resolve(opts.source) : resolve(root);
     const providerEnv = loadProviderEnv([root, scanRoot], deps.env);
-    const providerDeps = { ...deps, env: providerEnv };
+    // `start` writes advisory/intermediate views before the final report. Keep
+    // those helpers from advancing report-baseline.json mid-run.
+    const providerDeps = { ...deps, env: providerEnv, suppressBehaviorReportRefresh: true };
     const scope = summarizeCorpusScope(scanRoot);
     reportProgress(`start: preflight found ${scope.files.toLocaleString()} source/doc file(s)`, { current: 1, total: 8 });
     reportProgress("start: running deterministic analysis", { current: 2, total: 8 });
@@ -1995,7 +1997,7 @@ export function opGraphHtml(root, outputPath = "orangepro-graph.html") {
     return { graph_html_path: htmlPath };
 }
 /** Write the self-contained offline behavior-coverage view (deterministic, metadata only). */
-export function opBehaviorCoverageHtml(root, outputPath = "orangepro-behavior-coverage.html", dynamicProof) {
+export function opBehaviorCoverageHtml(root, outputPath = "orangepro-behavior-coverage.html", dynamicProof, options = {}) {
     const graph = loadGraph(workspacePaths(root).graphPath);
     // Standalone regens have no this-run outcome: fall back to the persisted
     // proof-attempts sidecar ONLY when it anchors to the current graph+commit
@@ -2017,11 +2019,13 @@ export function opBehaviorCoverageHtml(root, outputPath = "orangepro-behavior-co
     const html = renderBehaviorReport(data);
     const htmlPath = resolve(root, outputPath);
     writeFileSync(htmlPath, html, "utf8");
-    try {
-        writeFileSync(baselinePath, JSON.stringify(reportBaselineOf(data, new Date().toISOString())), "utf8");
-    }
-    catch {
-        // baseline write is advisory
+    if (options.persistBaseline !== false) {
+        try {
+            writeFileSync(baselinePath, JSON.stringify(reportBaselineOf(data, new Date().toISOString())), "utf8");
+        }
+        catch {
+            // baseline write is advisory
+        }
     }
     return { behavior_coverage_path: htmlPath };
 }

package/dist/local/viz/behaviorReportData.js

@@ -737,16 +737,16 @@ function riskRows(risks, graph) {
                 const generatedTests = riskGeneratedTests(graph, risk, riskIds, firstRowForFile.get(risk.file) === risk.id);
                 const verb = methodMatch?.[1]?.toUpperCase() ?? "BEHAVIOR";
                 const path = methodMatch?.[2] ?? risk.title;
-                const coveredCategories = [...new Set([
+                const generatedCategories = [...new Set([
                         ...generatedTests.map((t) => (t.bucket ? BUCKET_TO_CONCERN[t.bucket] : undefined)),
-                        // An integration/api/e2e-layer test covers the integration_flow
-                        // category by construction — the chip and the pill must agree.
+                        // An integration/api/e2e-layer draft targets integration_flow. This
+                        // remains generation metadata until dynamic proof closes.
                         ...generatedTests.map((t) => (t.concern === "integration" || t.concern === "api" || t.concern === "e2e" ? "integration_flow" : undefined))
                     ].filter((c) => Boolean(c)))];
                 return {
                     generatedTests,
                     applicableCategories: riskApplicableConcerns(risk, verb),
-                    coveredCategories,
+                    generatedCategories,
                     verb,
                     path,
                     todo: riskTodo(risk, verb, path, generatedTests)

package/dist/local/viz/behaviorReportHtml.js

@@ -230,9 +230,8 @@ nav.tabs{display:flex;gap:2px;margin:18px 0 0;border-bottom:1px solid var(--bd)}
 .cat-strip-lbl{font-size:9.5px;color:var(--muted);font-weight:600;letter-spacing:.04em;text-transform:uppercase;margin-bottom:6px}
 .cat-pills{display:flex;flex-wrap:wrap;gap:5px}
 .cat-pill{font-size:10px;padding:3px 8px;border-radius:4px;font-weight:600;letter-spacing:.01em;display:inline-flex;align-items:center;gap:4px}
-.cat-pill.cp-shown{background:var(--gbg);border:1px solid var(--gbd);color:var(--green)}
-.cat-pill.cp-locked{background:transparent;border:1px dashed var(--bd2);color:var(--faint)}
-.cat-pill.cp-locked::after{content:"\\1F512";font-size:8px}
+.cat-pill.cp-drafted{background:var(--obg);border:1px solid var(--obd);color:var(--orange)}
+.cat-pill.cp-open{background:transparent;border:1px dashed var(--bd2);color:var(--faint)}
 /* PAYWALL CTA */
 .paywall{background:linear-gradient(135deg,rgba(240,136,62,.08),rgba(240,136,62,.02));border:1px dashed var(--obd);border-radius:9px;padding:14px 16px;margin-top:14px;text-align:center}
 .paywall-num{font-size:18px;font-weight:750;color:var(--orange);font-variant-numeric:tabular-nums}
@@ -443,7 +442,7 @@ const D=window.DATA,$=(s)=>document.querySelector(s);
     bc.innerHTML='';
     var backBtn=document.createElement("button");
     backBtn.className="sm-crumb-btn";
-    backBtn.textContent="\u2190 Back to system map";
+    backBtn.textContent="← Back to system map";
     backBtn.addEventListener("click",function(){
       if(search){search.value="";search.dispatchEvent(new Event("input"));}
       bc.remove();
@@ -453,7 +452,7 @@ const D=window.DATA,$=(s)=>document.querySelector(s);
     });
     var clearBtn=document.createElement("button");
     clearBtn.className="sm-crumb-btn";
-    clearBtn.textContent="\u2715 Clear filter \u201c"+svc+"\u201d";
+    clearBtn.textContent="✕ Clear filter “"+svc+"”";
     clearBtn.addEventListener("click",function(){
       if(search){search.value="";search.dispatchEvent(new Event("input"));}
       bc.remove();
@@ -523,7 +522,7 @@ function describeBehavior(b){
     :b.tier==="assoc"?"A real test imports and calls it, but no mutation proof exists yet."
     :b.tier==="candidate"?"Only a lexically similar test file was found — an unconfirmed lead, not evidence."
     :"No test signal of any kind was found for it.";
-  const s1="\u201c"+h.words+"\u201d"+(h.owner?" on "+h.owner:"")+" — a behavior in "+(mod||"this repo")+".";
+  const s1="“"+h.words+"”"+(h.owner?" on "+h.owner:"")+" — a behavior in "+(mod||"this repo")+".";
   const s2=reach.length?"A user or system reaches it via "+reach.join(" and ")+(reach.length>=2?" (and possibly more)":"")+".":(b.reachable?"It appears inside at least one statically traced call chain.":"No entry-anchored call chain reaches it in the static flow set.");
   return s1+" "+s2+" "+tierTxt;
 }
@@ -549,14 +548,14 @@ function renderBeh(){
   const rows=D.behaviors.filter(b=>(!activeGrp||b.group===activeGrp)&&(!activeTier||tierOf(b).cls===activeTier)&&(!searchQ||(b.sig+" "+b.file).toLowerCase().includes(searchQ)));
   if(rows.length===0){
     const parts=[];
-    if(searchQ)parts.push('search \u201c'+searchQ+'\u201d');
+    if(searchQ)parts.push('search “'+searchQ+'”');
     if(activeTier)parts.push('the selected evidence tier');
-    if(activeGrp)parts.push('package \u201c'+activeGrp+'\u201d');
+    if(activeGrp)parts.push('package “'+activeGrp+'”');
     const why=parts.length?parts.join(' + '):'the current filters';
     const box=el("div","beh-empty",
-      '<p>No behaviors match '+esc(why)+'. Filters combine \u2014 clearing one usually brings results back.</p>');
+      '<p>No behaviors match '+esc(why)+'. Filters combine — clearing one usually brings results back.</p>');
     if(searchQ){
-      const b1=el("button","sm-crumb-btn","\u2715 Clear search");
+      const b1=el("button","sm-crumb-btn","✕ Clear search");
       b1.onclick=function(){searchEl.value="";searchQ="";renderBeh();};
       box.append(b1);
     }
@@ -697,15 +696,16 @@ function riskCardHtml(r){
   // category strip: show which concern categories apply to this flow
   let catHtml='';
   if(r.applicableCategories&&r.applicableCategories.length){
-    const shownConcerns=new Set(r.coveredCategories||[]);
+    const draftedConcerns=new Set(r.generatedCategories||[]);
     const pills=r.applicableCategories.map(c=>{
-      const shown=shownConcerns.has(c);
+      const drafted=draftedConcerns.has(c);
       const label=c.replace(/_/g,' ');
-      return \`<span class="cat-pill \${shown?'cp-shown':'cp-locked'}">\${esc(label)}</span>\`;
+      const hint=drafted?'Generated draft attached; not coverage or proof':'Applicable category without a generated draft';
+      return \`<span class="cat-pill \${drafted?'cp-drafted':'cp-open'}" title="\${hint}">\${esc(label)}</span>\`;
     }).join('');
-    const shownN=r.applicableCategories.filter(c=>shownConcerns.has(c)).length;
+    const shownN=r.applicableCategories.filter(c=>draftedConcerns.has(c)).length;
     const totalN=r.applicableCategories.length;
-    catHtml=\`<div class="cat-strip"><div class="cat-strip-lbl">Applicable testing categories for this flow (\${shownN} of \${totalN} covered)</div><div class="cat-pills">\${pills}</div></div>\`;
+    catHtml=\`<div class="cat-strip"><div class="cat-strip-lbl">Generated drafts: \${shownN} of \${totalN} applicable testing categories</div><div class="cat-pills">\${pills}</div></div>\`;
   }
   let testsHtml='';
   if(r.generatedTests&&r.generatedTests.length){

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",