@securecode-ai/mcp 0.5.5 → 0.5.6

package/dist/project-map/blastRadius.js

@@ -0,0 +1,196 @@
+"use strict";
+/**
+ * Blast radius computation — given a set of changed files, compute which
+ * other files in the workspace are affected by those changes.
+ *
+ * Uses the Project Map's import graph (forward: what this file imports;
+ * reverse: who imports this file) to traverse the dependency graph to a
+ * depth cap. The result is a set of files that the agent scan should focus
+ * on, plus the changed files themselves.
+ *
+ * Algorithm:
+ *   1. Invert the Project Map's `imports` records once into a reverse map:
+ *      for each file F that imports module M, record F as an importer of M.
+ *   2. BFS from each changed file:
+ *      - Forward edges: files that THIS file imports (if F changes, the
+ *        files F depends on might behave differently — but they're
+ *        dependencies, not dependents. We skip forward edges for blast
+ *        radius because changing a file doesn't affect its dependencies.)
+ *      - Reverse edges: files that import THIS file (if F changes, files
+ *        that depend on F are affected — these are the blast radius.)
+ *   3. Cap depth at `maxDepth` (default 3) to avoid traversing the entire
+ *      workspace for a large change.
+ *   4. Cap total files at `maxFiles` (default 100) to keep the scope
+ *      manageable.
+ *
+ * Security:
+ *   - All file paths come from the Project Map (already workspace-confined)
+ *   - No filesystem access — pure graph computation
+ *   - Output is a list of workspace-relative paths
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeBlastRadius = computeBlastRadius;
+exports.formatBlastRadius = formatBlastRadius;
+const DEFAULT_MAX_DEPTH = 3;
+const DEFAULT_MAX_FILES = 100;
+function normalizePath(p) {
+    return p.replace(/\\/g, '/');
+}
+function buildReverseImportMap(map) {
+    const reverse = new Map();
+    for (const [fileRel, extraction] of Object.entries(map.files)) {
+        const importer = normalizePath(fileRel);
+        if (!extraction.imports)
+            continue;
+        for (const [, sourceFile] of Object.entries(extraction.imports)) {
+            if (!sourceFile)
+                continue;
+            const imported = normalizePath(sourceFile);
+            if (imported === importer)
+                continue;
+            let importers = reverse.get(imported);
+            if (!importers) {
+                importers = [];
+                reverse.set(imported, importers);
+            }
+            if (!importers.includes(importer)) {
+                importers.push(importer);
+            }
+        }
+    }
+    return reverse;
+}
+function buildReverseCallGraph(map) {
+    const reverse = new Map();
+    for (const [fileRel, extraction] of Object.entries(map.files)) {
+        const caller = normalizePath(fileRel);
+        for (const endpoint of extraction.endpoints) {
+            if (!endpoint.callGraph)
+                continue;
+            for (const node of endpoint.callGraph) {
+                if (!node.calleeFile)
+                    continue;
+                const callee = normalizePath(node.calleeFile);
+                if (callee === caller)
+                    continue;
+                let callers = reverse.get(callee);
+                if (!callers) {
+                    callers = [];
+                    reverse.set(callee, callers);
+                }
+                if (!callers.includes(caller)) {
+                    callers.push(caller);
+                }
+            }
+        }
+    }
+    return reverse;
+}
+function buildReverseMiddlewareMap(map) {
+    const reverse = new Map();
+    for (const [fileRel, extraction] of Object.entries(map.files)) {
+        const handler = normalizePath(fileRel);
+        for (const endpoint of extraction.endpoints) {
+            if (!endpoint.middleware)
+                continue;
+            for (const mw of endpoint.middleware) {
+                if (!mw.sourceFile)
+                    continue;
+                const mwFile = normalizePath(mw.sourceFile);
+                if (mwFile === handler)
+                    continue;
+                let handlers = reverse.get(mwFile);
+                if (!handlers) {
+                    handlers = [];
+                    reverse.set(mwFile, handlers);
+                }
+                if (!handlers.includes(handler)) {
+                    handlers.push(handler);
+                }
+            }
+        }
+    }
+    return reverse;
+}
+function computeBlastRadius(options) {
+    const { changedFiles, map, maxDepth = DEFAULT_MAX_DEPTH, maxFiles = DEFAULT_MAX_FILES, } = options;
+    const normalizedChanged = changedFiles
+        .map(normalizePath)
+        .filter(f => f.length > 0);
+    if (normalizedChanged.length === 0) {
+        return { files: [], changedFiles: [], affectedFiles: [], depthReached: 0, truncated: false };
+    }
+    const reverseImports = buildReverseImportMap(map);
+    const reverseCallGraph = buildReverseCallGraph(map);
+    const reverseMiddleware = buildReverseMiddlewareMap(map);
+    function getReverseDeps(file) {
+        const deps = new Set();
+        for (const dep of reverseImports.get(file) || [])
+            deps.add(dep);
+        for (const dep of reverseCallGraph.get(file) || [])
+            deps.add(dep);
+        for (const dep of reverseMiddleware.get(file) || [])
+            deps.add(dep);
+        return [...deps];
+    }
+    const visited = new Set();
+    const queue = [];
+    for (const f of normalizedChanged) {
+        if (!visited.has(f)) {
+            visited.add(f);
+            queue.push({ file: f, depth: 0 });
+        }
+    }
+    let depthReached = 0;
+    while (queue.length > 0 && visited.size < maxFiles) {
+        const { file, depth } = queue.shift();
+        if (depth >= maxDepth)
+            continue;
+        if (depth + 1 > depthReached)
+            depthReached = depth + 1;
+        const dependents = getReverseDeps(file);
+        for (const dep of dependents) {
+            if (visited.has(dep))
+                continue;
+            if (visited.size >= maxFiles)
+                break;
+            visited.add(dep);
+            queue.push({ file: dep, depth: depth + 1 });
+        }
+    }
+    const truncated = visited.size >= maxFiles && queue.length > 0;
+    const allFiles = [...visited];
+    const changedSet = new Set(normalizedChanged);
+    const affectedFiles = allFiles.filter(f => !changedSet.has(f));
+    const changedInMap = normalizedChanged.filter(f => map.files[f] !== undefined || visited.has(f));
+    return {
+        files: allFiles,
+        changedFiles: changedInMap,
+        affectedFiles,
+        depthReached,
+        truncated,
+    };
+}
+function formatBlastRadius(result) {
+    if (result.files.length === 0) {
+        return 'No blast radius — no changed files provided.';
+    }
+    const lines = [
+        `Blast radius: ${result.files.length} file(s) (changed: ${result.changedFiles.length}, affected: ${result.affectedFiles.length}, depth: ${result.depthReached})${result.truncated ? ' [truncated]' : ''}:`,
+        '',
+    ];
+    lines.push('Changed files:');
+    for (const f of result.changedFiles.slice(0, 50)) {
+        lines.push(`  [changed] ${f}`);
+    }
+    lines.push('');
+    lines.push('Affected files (importers/callers):');
+    for (const f of result.affectedFiles.slice(0, 50)) {
+        lines.push(`  [affected] ${f}`);
+    }
+    if (result.files.length > 100) {
+        lines.push(`  ... and ${result.files.length - 100} more`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=blastRadius.js.map

package/dist/project-map/blastRadius.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blastRadius.js","sourceRoot":"","sources":["../../src/project-map/blastRadius.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;AAmHH,gDAoEC;AAED,8CA0BC;AAvLD,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,SAAS,aAAa,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE5C,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,SAAS;QAElC,KAAK,MAAM,CAAC,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YAEpC,IAAI,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE5C,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAAE,SAAS;YAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC9C,IAAI,MAAM,KAAK,MAAM;oBAAE,SAAS;gBAEhC,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACjC,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE5C,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU;gBAAE,SAAS;YACnC,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACnC,IAAI,CAAC,EAAE,CAAC,UAAU;oBAAE,SAAS;gBAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;gBAC5C,IAAI,MAAM,KAAK,OAAO;oBAAE,SAAS;gBAEjC,IAAI,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACZ,QAAQ,GAAG,EAAE,CAAC;oBACd,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAClC,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAA2B;IAC1D,MAAM,EACF,YAAY,EACZ,GAAG,EACH,QAAQ,GAAG,iBAAiB,EAC5B,QAAQ,GAAG,iBAAiB,GAC/B,GAAG,OAAO,CAAC;IAEZ,MAAM,iBAAiB,GAAG,YAAY;SACjC,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjG,CAAC;IAED,MAAM,cAAc,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAEzD,SAAS,cAAc,CAAC,IAAY;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChE,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClE,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAA2C,EAAE,CAAC;IAEzD,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAEvC,IAAI,KAAK,IAAI,QAAQ;YAAE,SAAS;QAChC,IAAI,KAAK,GAAG,CAAC,GAAG,YAAY;YAAE,YAAY,GAAG,KAAK,GAAG,CAAC,CAAC;QAEvD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC/B,IAAI,OAAO,CAAC,IAAI,IAAI,QAAQ;gBAAE,MAAM;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjG,OAAO;QACH,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,YAAY;QAC1B,aAAa;QACb,YAAY;QACZ,SAAS;KACZ,CAAC;AACN,CAAC;AAED,SAAgB,iBAAiB,CAAC,MAAyB;IACvD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,8CAA8C,CAAC;IAC1D,CAAC;IAED,MAAM,KAAK,GAAa;QACpB,iBAAiB,MAAM,CAAC,KAAK,CAAC,MAAM,sBAAsB,MAAM,CAAC,YAAY,CAAC,MAAM,eAAe,MAAM,CAAC,aAAa,CAAC,MAAM,YAAY,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1M,EAAE;KACL,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/project-map/callGraphExtractor.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Call graph extractor — builds a forward + reverse call graph for a file
+ * or a specific function, using tree-sitter AST.
+ *
+ * Used by the agent scan's call_graph tool. Unlike layer1.ts's extractCallGraph
+ * (which is endpoint-handler-specific), this is a general-purpose extractor
+ * that works on any function in any parseable file.
+ *
+ * Forward graph:  what does function X call? (callees)
+ * Reverse graph:  who calls function X?      (callers)
+ * File-level:      what functions exist, and what do they call?
+ */
+export declare function getCallGraph(workspaceRoot: string, filePath: string, functionName?: string): Promise<string>;

package/dist/project-map/callGraphExtractor.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * Call graph extractor — builds a forward + reverse call graph for a file
+ * or a specific function, using tree-sitter AST.
+ *
+ * Used by the agent scan's call_graph tool. Unlike layer1.ts's extractCallGraph
+ * (which is endpoint-handler-specific), this is a general-purpose extractor
+ * that works on any function in any parseable file.
+ *
+ * Forward graph:  what does function X call? (callees)
+ * Reverse graph:  who calls function X?      (callers)
+ * File-level:      what functions exist, and what do they call?
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCallGraph = getCallGraph;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const parserLoader_1 = require("./parserLoader");
+const astHelpers_1 = require("./astHelpers");
+const files_1 = require("../utils/files");
+const FUNCTION_TYPES = new Set([
+    'function_declaration', 'function_definition', 'method_definition',
+    'async_function_declaration', 'async_function_definition',
+    'generator_function_declaration', 'generator_declaration',
+]);
+function extractFunctionList(root, source) {
+    const out = [];
+    const seen = new Set();
+    for (const n of (0, astHelpers_1.walk)(root)) {
+        if (!FUNCTION_TYPES.has(n.type))
+            continue;
+        let name = '';
+        for (const child of n.namedChildren) {
+            if ((0, astHelpers_1.isIdentifier)(child)) {
+                name = source.slice(child.startIndex, child.endIndex);
+                break;
+            }
+        }
+        if (!name && n.parent) {
+            const parent = n.parent;
+            if (parent.type === 'lexical_declaration' || parent.type === 'variable_declaration') {
+                const decl = parent.namedChildren.find(c => c.type === 'variable_declarator');
+                if (decl) {
+                    const id = decl.child(0);
+                    if (id && (0, astHelpers_1.isIdentifier)(id))
+                        name = source.slice(id.startIndex, id.endIndex);
+                }
+            }
+        }
+        if (!name)
+            continue;
+        if (seen.has(n.startIndex))
+            continue;
+        seen.add(n.startIndex);
+        out.push({
+            name,
+            startLine: n.startPosition.row + 1,
+            endLine: n.endPosition.row + 1,
+            node: n,
+        });
+    }
+    return out;
+}
+function extractCallees(funcNode, source, imports, fromFile, workspaceRoot) {
+    const out = [];
+    const seen = new Set();
+    for (const n of (0, astHelpers_1.walk)(funcNode)) {
+        if (n.type !== 'call_expression' && n.type !== 'call')
+            continue;
+        const p = (0, astHelpers_1.callParts)(n, source);
+        if (!p)
+            continue;
+        const name = p.receiver ? `${p.receiver}.${p.method}` : p.method;
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        const calleeSpec = imports.get(p.receiver || '') || imports.get(p.method) || null;
+        const resolved = calleeSpec ? (0, astHelpers_1.resolveModulePath)(calleeSpec, fromFile, workspaceRoot) : null;
+        out.push({ name, calleeFile: resolved, line: p.line + 1 });
+    }
+    return out;
+}
+function findCallers(root, source, targetName) {
+    const out = [];
+    const seen = new Set();
+    for (const n of (0, astHelpers_1.walk)(root)) {
+        if (n.type !== 'call_expression' && n.type !== 'call')
+            continue;
+        const p = (0, astHelpers_1.callParts)(n, source);
+        if (!p)
+            continue;
+        if (p.method !== targetName)
+            continue;
+        let callerName = '<anonymous>';
+        let callerStart = 0;
+        let cur = n.parent;
+        while (cur) {
+            if (FUNCTION_TYPES.has(cur.type)) {
+                const id = cur.namedChildren.find(c => (0, astHelpers_1.isIdentifier)(c));
+                if (id)
+                    callerName = source.slice(id.startIndex, id.endIndex);
+                callerStart = cur.startPosition.row + 1;
+                break;
+            }
+            cur = cur.parent;
+        }
+        const key = `${callerName}:${p.line}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ caller: callerName, line: p.line + 1, callerStart });
+    }
+    return out;
+}
+async function getCallGraph(workspaceRoot, filePath, functionName) {
+    const grammar = (0, parserLoader_1.grammarForFile)(filePath);
+    if (grammar === 'unknown') {
+        return `Cannot extract call graph: unsupported file type (${filePath}). Only JS/TS/TSX/Python can be parsed.`;
+    }
+    let content;
+    let relPath;
+    let absPath;
+    try {
+        absPath = (0, files_1.resolveWorkspacePath)(workspaceRoot, filePath);
+        content = fs.readFileSync(absPath, 'utf8');
+        relPath = path.relative(workspaceRoot, absPath).replace(/\\/g, '/');
+    }
+    catch (e) {
+        return `Error reading file "${filePath}": ${e.message || e}`;
+    }
+    const parsed = await (0, parserLoader_1.parseSource)(content, grammar);
+    if (!parsed) {
+        return `Cannot parse ${relPath}: tree-sitter parsing failed.`;
+    }
+    const { root } = parsed;
+    const imports = (0, astHelpers_1.collectImports)(root, content);
+    const functions = extractFunctionList(root, content);
+    if (functions.length === 0) {
+        return `No functions found in ${relPath}.`;
+    }
+    const lines = [`Call graph for ${relPath} (${functions.length} function(s)):`];
+    if (functionName) {
+        const target = functions.find(f => f.name === functionName);
+        if (!target) {
+            lines.push(`\nFunction "${functionName}" not found in this file.`);
+            lines.push(`\nAvailable functions:`);
+            for (const f of functions) {
+                lines.push(`  L${f.startLine}-${f.endLine}  ${f.name}`);
+            }
+            return lines.join('\n');
+        }
+        lines.push(`\nFunction: ${target.name} (L${target.startLine}-${target.endLine})`);
+        const callees = extractCallees(target.node, content, imports, absPath, workspaceRoot);
+        lines.push(`\n  Callees (${callees.length} — what ${target.name} calls):`);
+        if (callees.length === 0) {
+            lines.push('    (none)');
+        }
+        else {
+            for (const c of callees) {
+                const file = c.calleeFile ? ` → ${c.calleeFile}` : '';
+                lines.push(`    L${c.line}  ${c.name}${file}`);
+            }
+        }
+        const callers = findCallers(root, content, target.name);
+        lines.push(`\n  Callers (${callers.length} — who calls ${target.name}):`);
+        if (callers.length === 0) {
+            lines.push('    (none — this may be an entry point)');
+        }
+        else {
+            for (const c of callers) {
+                lines.push(`    L${c.line}  ${c.caller}`);
+            }
+        }
+    }
+    else {
+        lines.push('');
+        for (const f of functions) {
+            const callees = extractCallees(f.node, content, imports, absPath, workspaceRoot);
+            const calleeNames = callees.length > 0
+                ? callees.map(c => c.name).join(', ')
+                : '(no calls)';
+            lines.push(`  L${f.startLine}-${f.endLine}  ${f.name}  →  ${calleeNames}`);
+        }
+        lines.push('');
+        lines.push('Use call_graph with functionName to get forward + reverse edges for a specific function.');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=callGraphExtractor.js.map

package/dist/project-map/callGraphExtractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callGraphExtractor.js","sourceRoot":"","sources":["../../src/project-map/callGraphExtractor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4HH,oCAmFC;AA7MD,uCAAyB;AACzB,2CAA6B;AAC7B,iDAA6E;AAC7E,6CAAgG;AAChG,0CAAsD;AAkBtD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC3B,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB;IAClE,4BAA4B,EAAE,2BAA2B;IACzD,gCAAgC,EAAE,uBAAuB;CAC5D,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,IAAoB,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YAClC,IAAI,IAAA,yBAAY,EAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtD,MAAM;YACV,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBAClF,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;gBAC9E,IAAI,IAAI,EAAE,CAAC;oBACP,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACzB,IAAI,EAAE,IAAI,IAAA,yBAAY,EAAC,EAAE,CAAC;wBAAE,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAChF,CAAC;YACL,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS;QACrC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC;YACL,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;YAClC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;YAC9B,IAAI,EAAE,CAAC;SACV,CAAC,CAAC;IACP,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACnB,QAAwB,EACxB,MAAc,EACd,OAA4B,EAC5B,QAAgB,EAChB,aAAqB;IAErB,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAChE,MAAM,CAAC,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAClF,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAChB,IAAoB,EACpB,MAAc,EACd,UAAkB;IAElB,MAAM,GAAG,GAA4D,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAChE,MAAM,CAAC,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QAEtC,IAAI,UAAU,GAAG,aAAa,CAAC;QAC/B,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,GAAG,GAAsC,CAAC,CAAC,MAAM,CAAC;QACtD,OAAO,GAAG,EAAE,CAAC;YACT,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;gBACxD,IAAI,EAAE;oBAAE,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC9D,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,CAAC;gBACxC,MAAM;YACV,CAAC;YACD,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,YAAY,CAC9B,aAAqB,EACrB,QAAgB,EAChB,YAAqB;IAErB,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,qDAAqD,QAAQ,yCAAyC,CAAC;IAClH,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,OAAe,CAAC;IACpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACD,OAAO,GAAG,IAAA,4BAAoB,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACxD,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QACd,OAAO,uBAAuB,QAAQ,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,OAAO,EAAE,OAAc,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,gBAAgB,OAAO,+BAA+B,CAAC;IAClE,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,MAAM,OAAO,GAAG,IAAA,2BAAc,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,yBAAyB,OAAO,GAAG,CAAC;IAC/C,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,kBAAkB,OAAO,KAAK,SAAS,CAAC,MAAM,gBAAgB,CAAC,CAAC;IAEzF,IAAI,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,eAAe,YAAY,2BAA2B,CAAC,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QAElF,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QACtF,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACJ,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,MAAM,gBAAgB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACJ,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC;QACL,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YACjF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,CAAC,CAAC,YAAY,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,QAAQ,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;IAC3G,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/project-map/capabilityRegistry.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Capability registry — the dispatch point for tiered language support.
+ *
+ * Determines what analysis capabilities are available for each language:
+ *   - Tier 1 ('deep'):     taint, AST, call graph, guards, policy, verify
+ *   - Tier 2 ('standard'): AST, call graph, semgrep (no taint, no guard eval)
+ *   - Tier 3 ('fallback'): LLM exploration only (read_file, search_code)
+ *
+ * The confidence clamper (agentScan.ts) consults this to decide whether a
+ * finding's confidence should be penalized for not using structural tools.
+ * If a capability is unavailable for the language, the agent can't be blamed
+ * for not using it — but the confidence ceiling is lower overall.
+ *
+ * To promote a language to a higher tier, add its sinks/sources/sanitizers
+ * and move it to the appropriate set below. The rest of the system adapts
+ * automatically.
+ */
+export type CapabilityTier = 'deep' | 'standard' | 'fallback';
+export interface LanguageCapability {
+    language: string;
+    tier: CapabilityTier;
+    /** Taint tracking: trace_flow / trace_flow_cross_file */
+    taint: boolean;
+    /** Tree-sitter AST parsing available */
+    ast: boolean;
+    /** Call graph extraction available */
+    callGraph: boolean;
+    /** Guard function evaluation: check_guard */
+    guardCheck: boolean;
+    /** Endpoint policy checking: check_policy */
+    policyCheck: boolean;
+    /** Semgrep integration (Tier 2, not wired yet) */
+    semgrep: boolean;
+    /** Exploit verification via test execution: verify subagent */
+    verify: boolean;
+    /** Human-readable label for the UI */
+    tierLabel: string;
+}
+export declare function normalizeLanguage(language: string): string;
+export declare function getCapability(language: string): LanguageCapability;
+/**
+ * Evidence level tag for a finding, based on what structural tools were
+ * actually used during the investigation. The confidence clamper attaches
+ * this to each finding so the UI can show how the confidence was derived.
+ */
+export declare function evidenceLevelTag(usedTaint: boolean, usedGuard: boolean, usedPolicy: boolean, verifyVerdict: string | undefined): string;

package/dist/project-map/capabilityRegistry.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Capability registry — the dispatch point for tiered language support.
+ *
+ * Determines what analysis capabilities are available for each language:
+ *   - Tier 1 ('deep'):     taint, AST, call graph, guards, policy, verify
+ *   - Tier 2 ('standard'): AST, call graph, semgrep (no taint, no guard eval)
+ *   - Tier 3 ('fallback'): LLM exploration only (read_file, search_code)
+ *
+ * The confidence clamper (agentScan.ts) consults this to decide whether a
+ * finding's confidence should be penalized for not using structural tools.
+ * If a capability is unavailable for the language, the agent can't be blamed
+ * for not using it — but the confidence ceiling is lower overall.
+ *
+ * To promote a language to a higher tier, add its sinks/sources/sanitizers
+ * and move it to the appropriate set below. The rest of the system adapts
+ * automatically.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeLanguage = normalizeLanguage;
+exports.getCapability = getCapability;
+exports.evidenceLevelTag = evidenceLevelTag;
+const DEEP_LANGUAGES = new Set([
+    'javascript', 'typescript', 'tsx', 'python',
+]);
+const STANDARD_LANGUAGES = new Set([]);
+const TIER_LABELS = {
+    deep: 'Deep Analysis',
+    standard: 'Advanced Analysis',
+    fallback: 'Agent Analysis',
+};
+function normalizeLanguage(language) {
+    const l = (language || '').toLowerCase();
+    if (l === 'typescriptreact' || l === 'jsx')
+        return 'tsx' in DEEP_LANGUAGES || 'tsx' in STANDARD_LANGUAGES ? 'tsx' : l;
+    if (l === 'javascriptreact')
+        return 'javascript';
+    if (l === 'ts')
+        return 'typescript';
+    if (l === 'js')
+        return 'javascript';
+    if (l === 'py')
+        return 'python';
+    return l;
+}
+function getCapability(language) {
+    const lang = normalizeLanguage(language);
+    const tier = DEEP_LANGUAGES.has(lang)
+        ? 'deep'
+        : STANDARD_LANGUAGES.has(lang)
+            ? 'standard'
+            : 'fallback';
+    return {
+        language: lang,
+        tier,
+        taint: tier === 'deep',
+        ast: tier === 'deep' || tier === 'standard',
+        callGraph: tier === 'deep' || tier === 'standard',
+        guardCheck: tier === 'deep',
+        policyCheck: tier === 'deep',
+        semgrep: tier === 'standard',
+        verify: tier === 'deep',
+        tierLabel: TIER_LABELS[tier],
+    };
+}
+/**
+ * Evidence level tag for a finding, based on what structural tools were
+ * actually used during the investigation. The confidence clamper attaches
+ * this to each finding so the UI can show how the confidence was derived.
+ */
+function evidenceLevelTag(usedTaint, usedGuard, usedPolicy, verifyVerdict) {
+    const parts = [];
+    if (usedTaint)
+        parts.push('taint-traced');
+    if (usedGuard)
+        parts.push('guard-checked');
+    if (usedPolicy)
+        parts.push('policy-checked');
+    if (verifyVerdict === 'PROVEN')
+        parts.push('verified');
+    else if (verifyVerdict === 'UNPROVEN')
+        parts.push('verify-failed');
+    else if (verifyVerdict === 'INCONCLUSIVE')
+        parts.push('verify-inconclusive');
+    else if (verifyVerdict === 'SKIPPED')
+        parts.push('verify-skipped');
+    if (parts.length === 0)
+        return 'llm-only';
+    return parts.join('+');
+}
+//# sourceMappingURL=capabilityRegistry.js.map

package/dist/project-map/capabilityRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilityRegistry.js","sourceRoot":"","sources":["../../src/project-map/capabilityRegistry.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAqCH,8CAQC;AAED,sCAoBC;AAOD,4CAgBC;AAjED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC3B,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ;CAC9C,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,EAAE,CAAC,CAAC;AAE/C,MAAM,WAAW,GAAmC;IAChD,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,mBAAmB;IAC7B,QAAQ,EAAE,gBAAgB;CAC7B,CAAC;AAEF,SAAgB,iBAAiB,CAAC,QAAgB;IAC9C,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,IAAI,cAAc,IAAI,KAAK,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAChC,OAAO,CAAC,CAAC;AACb,CAAC;AAED,SAAgB,aAAa,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAmB,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAC1B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,UAAU,CAAC;IAErB,OAAO;QACH,QAAQ,EAAE,IAAI;QACd,IAAI;QACJ,KAAK,EAAE,IAAI,KAAK,MAAM;QACtB,GAAG,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU;QAC3C,SAAS,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU;QACjD,UAAU,EAAE,IAAI,KAAK,MAAM;QAC3B,WAAW,EAAE,IAAI,KAAK,MAAM;QAC5B,OAAO,EAAE,IAAI,KAAK,UAAU;QAC5B,MAAM,EAAE,IAAI,KAAK,MAAM;QACvB,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC;KAC/B,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAC5B,SAAkB,EAClB,SAAkB,EAClB,UAAmB,EACnB,aAAiC;IAEjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,aAAa,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,IAAI,aAAa,KAAK,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;SAC9D,IAAI,aAAa,KAAK,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;SACxE,IAAI,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC"}

package/dist/project-map/findTests.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Test discovery — finds test files that exercise a source file or symbol.
+ *
+ * Two strategies:
+ *   1. Naming convention: derive candidate test file paths from the source
+ *      file (src/foo.ts → tests/foo.test.ts, src/foo.test.ts, etc.)
+ *   2. Symbol reference: if a symbol name is provided, search all test files
+ *      in the workspace for references to that symbol.
+ *
+ * Returns ranked results with match type and confidence.
+ *
+ * Security:
+ *   - All paths workspace-confined via resolveWorkspacePath
+ *   - Output truncated to 16KB
+ *   - No file contents returned — only paths and matched lines
+ */
+export interface TestFinding {
+    /** Workspace-relative test file path. */
+    filePath: string;
+    /** How this test was found. */
+    matchType: 'naming' | 'symbol';
+    /** Confidence 0-1. */
+    confidence: number;
+    /** Matched line numbers (for symbol matches). */
+    matchedLines?: number[];
+    /** Preview of matched lines (for symbol matches). */
+    matchedPreviews?: string[];
+}
+export declare function findTests(workspaceRoot: string, filePath: string, symbol?: string): Promise<string>;