@orangepro/orangepro-mcp 0.2.8 → 0.2.9

package/dist/local/analyze/analyzer.js

@@ -47,7 +47,7 @@ function extractionBackend(language) {
         return "tsc"; // TS/JS compiler path (or unextracted)
     return treeSitterReady(language) ? "ts" : "rx"; // tree-sitter AST vs regex fallback
 }
-import { runConfirmer } from "./confirm.js";
+import { repoRootOf, resolveSpecifier, workspacePackages, runConfirmer } from "./confirm.js";
 const DETECTOR = "repo_analyzer";
 // Global ceiling on extracted code symbols. A SINGLE counter shared across the walk,
 // so a low value lets whichever language is walked first (e.g. a Go `server/`) eat the
@@ -1972,6 +1972,46 @@ export function analyzeRepo(root, opts = {}) {
             seenPair.add(key);
             candidates.push({ testRel, testAbs, implRel, implAbs });
         }
+        // Import-derived pairing: a test file is a candidate for every in-repo
+        // impl file it imports — an import IS the relationship; resolution
+        // (relative, tsconfig paths, npm/pnpm workspace names) decides
+        // membership. Adds PAIRS only; the assertion-aware confirmer remains
+        // the sole judge.
+        {
+            const pairRoot = repoRootOf(root);
+            const wsPkgs = workspacePackages(pairRoot);
+            const relByAbs = new Map(resolveFiles.map((f) => [f.abs, f.rel]));
+            const IMPORT_SPEC_RE = /(?:import|export)[^'"\n]*from\s*['"]([^'"]+)['"]|require\(\s*['"]([^'"]+)['"]\s*\)/g;
+            for (const tf of resolveFiles) {
+                if (tf.role !== "test")
+                    continue;
+                let srcTxt = "";
+                try {
+                    srcTxt = readFileSync(tf.abs, "utf8");
+                }
+                catch {
+                    continue;
+                }
+                let m;
+                IMPORT_SPEC_RE.lastIndex = 0;
+                while ((m = IMPORT_SPEC_RE.exec(srcTxt)) !== null) {
+                    const spec = m[1] ?? m[2];
+                    if (!spec)
+                        continue;
+                    const resolvedAbs = resolveSpecifier(spec, tf.abs, pairRoot, wsPkgs);
+                    if (!resolvedAbs)
+                        continue;
+                    const implRel = relByAbs.get(resolvedAbs);
+                    if (!implRel || !eligibleSymbolsByFile.has(implRel))
+                        continue;
+                    const key = `${tf.rel}|${implRel}`;
+                    if (seenPair.has(key))
+                        continue;
+                    seenPair.add(key);
+                    candidates.push({ testRel: tf.rel, testAbs: tf.abs, implRel, implAbs: resolvedAbs });
+                }
+            }
+        }
         const confirmBudget = Math.max(1, Number(process.env.ORANGEPRO_MAX_CONFIRM_FILES) || 1500);
         const riskSymbolLimit = Math.max(1, Number(process.env.ORANGEPRO_CONFIRM_RISK_SYMBOLS) || DEFAULT_CONFIRM_RISK_SYMBOLS);
         const involved = new Set();

package/dist/local/analyze/confirm.js

@@ -22,6 +22,7 @@
 // is the SOLE producer of hard TESTED_BY/COVERS edges.
 import ts from "typescript";
 import path from "node:path";
+import { readFileSync as fsRead, existsSync as fsExists } from "node:fs";
 import { loadTsConfigFor, resolveImport } from "../resolve/resolver.js";
 import { walkBarrel } from "../resolve/barrelWalker.js";
 import { isSelfAssertingCallee } from "./selfAssert.js";
@@ -33,10 +34,45 @@ const norm = (p) => path.resolve(p);
  * the target repo. JSX is preserved and emit/lib-checks are off — we only read
  * symbols, never compile.
  */
+export function repoRootOf(anchor) {
+    let dir = anchor;
+    for (let i = 0; i < 15; i++) {
+        try {
+            const pj = JSON.parse(fsRead(path.join(dir, "package.json"), "utf8"));
+            if (pj && pj.workspaces)
+                return dir;
+        }
+        catch { /* not here; walk up */ }
+        if (fsExists(path.join(dir, "pnpm-workspace.yaml")))
+            return dir;
+        if (fsExists(path.join(dir, ".git")) || fsExists(path.join(dir, "go.mod")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return dir;
+        dir = parent;
+    }
+    return dir;
+}
 export function buildConfirmProgram(absFiles, anchorFile) {
     const base = loadTsConfigFor(anchorFile).options;
+    // Workspace-aware resolution: synthesize compilerOptions.paths from the
+    // repo's workspaces manifest so the STANDARD compiler resolves
+    // "@scope/pkg" and "@scope/pkg/lib/x" to source. Adds no confirmation
+    // path — only lets the existing assertion-aware bar evaluate tests it
+    // previously could not resolve at all.
+    const wsRoot = repoRootOf(anchorFile);
+    const wsPaths = {};
+    for (const [name, dir] of workspacePackages(wsRoot)) {
+        wsPaths[name] = [dir + "/src/index", dir + "/index", dir + "/src"];
+        wsPaths[name + "/lib/*"] = [dir + "/src/*"];
+        wsPaths[name + "/dist/*"] = [dir + "/src/*"];
+        wsPaths[name + "/*"] = [dir + "/src/*", dir + "/*"];
+    }
     const options = {
         ...base,
+        baseUrl: base.baseUrl ?? wsRoot,
+        paths: { ...wsPaths, ...base.paths },
         noEmit: true,
         allowJs: true,
         checkJs: false,
@@ -2423,11 +2459,22 @@ function tsconfigPathsFor(fileAbs, stopDir) {
     return null;
 }
 /** Workspace member name → package dir, from the root package.json workspaces globs. */
-function workspacePackages(repoRoot) {
+export function workspacePackages(repoRoot) {
+    const pnpmGlobs = [];
+    try {
+        const y = fsRead(path.join(repoRoot, "pnpm-workspace.yaml"), "utf8");
+        for (const line of y.split("\n")) {
+            const m = /^\s*-\s*['"]?([^'"#\n]+?)['"]?\s*$/.exec(line);
+            if (m)
+                pnpmGlobs.push(m[1].trim());
+        }
+    }
+    catch { /* not a pnpm workspace */ }
     const out = new Map();
     const rootPkg = readJsonSafe(_jn(repoRoot, "package.json"));
     const ws = rootPkg?.workspaces;
-    const globs = Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : [];
+    const npmGlobs = Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : [];
+    const globs = [...npmGlobs, ...pnpmGlobs];
     const dirs = [];
     for (const g of globs) {
         if (g.endsWith("/*")) {

package/dist/local/generate/promptV5.js

@@ -159,6 +159,8 @@ export function buildBatchGenerationSystemPromptV5() {
         "- Never mock, stub, or spy on the behavior-under-test itself. The subject must execute for real. Mock only true external I/O boundaries — network calls, the system clock, third-party SDKs, outbound HTTP. If the behavior calls internal services in the same codebase, let them run (or use real test doubles at the I/O edge, never at the subject). A test that mocks the subject proves nothing and will be rejected.",
         "- Each test is complete and runnable (all imports, setup, assertions, cleanup).",
         "- Start each test with: // Concern: <concern> | Technique: <technique>",
+        "- When asserting an exact return value (string, number, constant), copy the expected value VERBATIM from the provided source code. Never invent an expected value.",
+        "- If the exact value is not visible in the provided source, assert structure instead (non-nil, error vs no-error, type, boolean outcome) — never a guessed literal.",
         "- Assert all targets listed in each scenario.",
         "- Do not copy source excerpts verbatim. Use them to understand, then write original code.",
         "- Reuse SUBJECT IMPORTS. Do not invent module paths.",

package/dist/local/score/risk.js

@@ -139,8 +139,8 @@ function deriveRouteWeight(node) {
 function deriveDataSensitivity(node) {
     const text = `${node.external_id} ${symbolFile(node)} ${symbolTitle(node)}`.toLowerCase();
     const tiers = [
-        [/payment|stripe|capture|refund|charge|billing/, 10],
-        [/auth|token|session|password|credential|jwt|oauth/, 9],
+        [/payment|stripe|refund|charge(?!r)|billing|payout|chargeback/, 10],
+        [/auth(?!or\b)|token(?!iz)|session|password|credential|jwt|oauth/, 9],
         [/order|cart|checkout|invoice|transaction/, 7],
         [/customer|user|account|profile|pii|gdpr/, 6],
         [/notification|email|sms|webhook|push/, 3]
@@ -389,7 +389,10 @@ export function rankRiskGaps(graph, opts = {}) {
         const i = Math.round(iExact);
         const d = rawScores[idx].d;
         const detectionTier = detectionFor(s.external_id);
-        const score = Math.round(pExact * iExact * d * 10) / 10;
+        let score = Math.round(pExact * iExact * d * 10) / 10;
+        const disconnected = (incoming.get(s.external_id) ?? 0) === 0 && fan_out === 0;
+        if (disconnected)
+            score = Math.round(score * 0.25 * 10) / 10;
         const reasons = [
             `ORS ${score} ≈ P${p} × I${i} × D${d}`,
             `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"} (method-attributed)`,
@@ -400,6 +403,8 @@ export function rankRiskGaps(graph, opts = {}) {
             reasons.push("near an API/route/handler entry point");
         if (is_new_code)
             reasons.push("new code (< 30 days)");
+        if (disconnected)
+            reasons.push("no callers and no callees — structurally disconnected, score dampened");
         if (detectionTier === "candidate")
             reasons.push("lexical candidate test match only — unconfirmed");
         return {
@@ -431,11 +436,18 @@ export function rankRiskGaps(graph, opts = {}) {
         return ranked.slice(0, limit);
     const maxPerFile = Math.max(1, opts.maxPerFile);
     const perFile = new Map();
+    // Multi-program repos flood identical titles (76 x main) across files; the
+    // per-FILE cap cannot see it. Same diversity principle, second axis.
+    const maxPerTitle = 2;
+    const perTitle = new Map();
     const surfaced = [];
     const overflow = [];
     for (const gap of ranked) {
         const used = perFile.get(gap.file) ?? 0;
-        if (used < maxPerFile) {
+        const tKey = (gap.title || "").split("(")[0].trim();
+        const tUsed = perTitle.get(tKey) ?? 0;
+        if (used < maxPerFile && tUsed < maxPerTitle) {
+            perTitle.set(tKey, tUsed + 1);
             perFile.set(gap.file, used + 1);
             surfaced.push(gap);
         }

package/dist/local/viz/behaviorReportData.js

@@ -409,6 +409,12 @@ function fmtRefs(n) {
         return "<1";
     return String(Math.round(n));
 }
+function displayTitle(title, file) {
+    if (title.includes("."))
+        return title;
+    const pkg = file && file.includes("/") ? file.split("/").slice(-2, -1)[0] : "";
+    return pkg ? `${pkg}.${title}` : title;
+}
 /** Deterministic 1–2 line behavior context from graph facts only — no LLM.
  *  Sensitivity label mirrors deriveDataSensitivity's tiers. */
 function riskContext(risk) {
@@ -740,13 +746,16 @@ function riskTodo(risk, verb, path, generatedTests) {
     const call = verb !== "BEHAVIOR"
         ? `issues ${verb} ${path}`
         : risk.entry_point
-            ? `invokes ${risk.title} through its entry point`
-            : `calls ${risk.title} directly`;
-    const sens = (risk.data_sensitivity ?? 1) >= 9
-        ? " Include a negative case: invalid or expired credentials must fail closed."
-        : (risk.data_sensitivity ?? 1) >= 7
-            ? " Include a failure case: a rejected transaction must leave no partial state."
-            : "";
+            ? `invokes ${displayTitle(risk.title, risk.file)} through its entry point`
+            : `calls ${displayTitle(risk.title, risk.file)} directly`;
+    const s = risk.data_sensitivity ?? 1;
+    const sens = s >= 10
+        ? " Include a failure case: a rejected transaction must leave no partial state."
+        : s >= 9
+            ? " Include a negative case: invalid or expired credentials must fail closed."
+            : s >= 7
+                ? " Include a failure case: a rejected transaction must leave no partial state."
+                : "";
     if (risk.integration_signal === "candidate") {
         return `A similarly named test exists but nothing links it. Write a test that imports and ${call}, asserting the observable outcome — that upgrades this from unconfirmed candidate to a hard link.${sens}`;
     }
@@ -790,7 +799,7 @@ function riskRows(risks, graph) {
             ...(() => {
                 const generatedTests = riskGeneratedTests(graph, risk, riskIds, firstRowForFile.get(risk.file) === risk.id);
                 const verb = methodMatch?.[1]?.toUpperCase() ?? "BEHAVIOR";
-                const path = qualify(risk, methodMatch?.[2] ?? risk.title);
+                const path = qualify(risk, methodMatch?.[2] ?? displayTitle(risk.title, risk.file));
                 const generatedCategories = [...new Set([
                         ...generatedTests.map((t) => (t.bucket ? BUCKET_TO_CONCERN[t.bucket] : undefined)),
                         // An integration/api/e2e-layer draft targets integration_flow. This
@@ -824,7 +833,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
     const flowIds = flowSymbolIds(graph);
     const summary = summaryFromRows(rows, flowIds);
     const repoRoot = opts.repoRoot ?? graph.workspace.root;
-    const riskGaps = rankRiskGaps(graph, { repoRoot, limit: opts.riskLimit ?? 20 });
+    const riskGaps = rankRiskGaps(graph, { repoRoot, limit: opts.riskLimit ?? 20, maxPerFile: 3 });
     const lists = behaviorLists(rows, flowIds);
     const risks = riskRows(riskGaps, graph);
     const sortedBehaviors = [...lists.behaviors].sort((a, b) => tierRank(a) - tierRank(b));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",