@tyroneross/navgator 0.2.2 → 0.10.0

package/dist/scanners/swift/code-scanner.js

@@ -11,6 +11,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { glob } from 'glob';
 import { generateComponentId, generateConnectionId, } from '../../types.js';
+import { scanSwiftUIViews } from './swiftui-scanner.js';
 // =============================================================================
 // FRAMEWORK → ENTITLEMENT MAP
 // =============================================================================
@@ -49,11 +50,15 @@ const LLM_URL_PATTERNS = [
     { pattern: /api\.fireworks\.ai/, provider: 'Fireworks AI' },
 ];
 // Swift SDK import patterns for LLMs
+// NOTE: FoundationModels is intentionally NOT here — it has its own dedicated,
+// import-gated pass (scanFoundationModelsUsage below) because a bare
+// `.respond(` or `@Generable` collides heavily with unrelated Swift APIs
+// (URLSession delegates, custom protocols) and previously false-positived
+// outside FoundationModels-importing files. See KNOWN-ISSUES.md (closed).
 const LLM_IMPORT_PATTERNS = [
     { pattern: /^import\s+OpenAI\b/, provider: 'OpenAI' },
     { pattern: /^import\s+Anthropic\b/, provider: 'Claude (Anthropic)' },
     { pattern: /^import\s+GoogleGenerativeAI\b/, provider: 'Gemini (Google)' },
-    { pattern: /^import\s+FoundationModels\b/, provider: 'Apple Intelligence' },
 ];
 // Swift SDK call patterns
 const LLM_CALL_PATTERNS = [
@@ -64,23 +69,87 @@ const LLM_CALL_PATTERNS = [
     { pattern: /\.messages\.create\(/, provider: 'Claude (Anthropic)' },
     { pattern: /GenerativeModel\(name:/, provider: 'Gemini (Google)' },
     { pattern: /\.generateContent\(/, provider: 'Gemini (Google)' },
-    { pattern: /LanguageModelSession\(\)/, provider: 'Apple Intelligence' },
-    { pattern: /\.respond\(to:/, provider: 'Apple Intelligence' },
-    { pattern: /@Generable\b/, provider: 'Apple Intelligence' },
 ];
 // =============================================================================
+// FOUNDATIONMODELS (Apple on-device) DETECTION
+// =============================================================================
+//
+// Gated on `import FoundationModels` appearing in the SAME file — required
+// anchor per T1 Apple docs (developer.apple.com symbol JSON, 2026-08-03).
+// Within a gated file, any of the following register a use case:
+//   1. A `@Generable`-annotated struct/enum (bare, `(description:)`, or
+//      `(name:description:)` — struct/enum only; the annotation may sit on
+//      the line above the declaration).
+//   2. `LanguageModelSession(` with any arguments, or the trailing-closure
+//      construction form `LanguageModelSession { ... }` — there is no
+//      zero-arg initializer, so a prior zero-arg-only pattern matched
+//      nothing real.
+//   3. `respond(to:`, `respond(generating:`, `respond(options:`,
+//      `streamResponse(`, `SystemLanguageModel`, or `@Guide(` — confirming
+//      signals only, never standalone (they collide with unrelated Swift
+//      APIs outside a FoundationModels-importing file).
+// Anchor allows leading attributes (@preconcurrency, @_exported, ...) and an
+// access-level modifier (public/internal/package/fileprivate/private/open)
+// before `import` — Swift permits both forms and a bare `^\s*import` anchor
+// silently drops real detections in files using them (fact-checker finding
+// f5, 2026-08-03). Comments and `import FoundationModelsX` still don't match:
+// `//`/`*` prefixes aren't consumed by `\s*`, and `\b` blocks partial names.
+const FOUNDATION_MODELS_IMPORT = /^\s*(?:@[A-Za-z_][A-Za-z0-9_]*\s+)*(?:public|internal|package|fileprivate|private|open)?\s*import\s+FoundationModels\b/;
+const FOUNDATION_MODELS_SESSION_CTOR = /LanguageModelSession\s*(?:\(|\{)/;
+const FOUNDATION_MODELS_CONFIRMING = [
+    /\.respond\(\s*to:/,
+    /\.respond\(\s*generating:/,
+    /\.respond\(\s*options:/,
+    /\.streamResponse\(/,
+    /\bSystemLanguageModel\b/,
+    /@Guide\(/,
+];
+const GENERABLE_ANNOTATION = /@Generable\b(?:\([^)]*\))?/;
+const STRUCT_ENUM_DECL = /^\s*(?:(?:public|private|internal|open|final)\s+)*(?:struct|enum)\s+(\w+)/;
+// =============================================================================
 // MAIN SCANNER
 // =============================================================================
-export async function scanSwiftCode(projectRoot) {
+export async function scanSwiftCode(projectRoot, walkSet) {
     const components = [];
     const connections = [];
     const warnings = [];
     const timestamp = Date.now();
     // Load all Swift files
-    const swiftFiles = await glob('**/*.swift', {
+    const allSwiftFiles = await glob('**/*.swift', {
         cwd: projectRoot,
-        ignore: ['.build/**', 'DerivedData/**', '.swiftpm/**', 'Pods/**', 'Carthage/**', '*.playground/**'],
+        ignore: [
+            '.build/**',
+            '**/.build/**',
+            '**/.navgator/**',
+            '**/.rally/**',
+            '**/.build-loop/**',
+            '**/.claude/**',
+            '**/.codex/**',
+            '**/.ibr/**',
+            'build/**',
+            '**/build/**',
+            'build-*/**',
+            '**/build-*/**',
+            'DerivedData/**',
+            '**/DerivedData/**',
+            'SourcePackages/**',
+            '**/SourcePackages/**',
+            '.swiftpm/**',
+            '**/.swiftpm/**',
+            'Pods/**',
+            '**/Pods/**',
+            'Carthage/**',
+            '**/Carthage/**',
+            'vendor/**',
+            '**/vendor/**',
+            '*.playground/**',
+            '**/*.playground/**',
+        ],
     });
+    // Walk-set restriction (incremental). Bit-identical when undefined.
+    const swiftFiles = walkSet
+        ? allSwiftFiles.filter(f => walkSet.has(f))
+        : allSwiftFiles;
     const files = [];
     for (const relPath of swiftFiles) {
         try {
@@ -94,6 +163,53 @@ export async function scanSwiftCode(projectRoot) {
     if (files.length === 0) {
         return { components, connections, warnings, projectMeta: {} };
     }
+    /**
+     * Find-or-create the `component` node for a Swift type, keyed on name+type.
+     *
+     * Every pass below that references a Swift type by name (conformance, state
+     * observation, actor isolation) must route through this. Calling
+     * `generateComponentId('component', name)` at the reference site cannot
+     * work: the generator appends a random suffix (types.ts:725-729), so the id
+     * computed at the edge never equals the id of the component that was pushed
+     * — which is why `conforms-to`, `observes` and `other` edges all dangled.
+     *
+     * Creating one component per type also keeps the scan-level dedup in
+     * scanner.ts (keyed `type|name|first-config-file`) from dropping a second
+     * same-named component and orphaning the edges that pointed at it.
+     */
+    const typeComponents = new Map();
+    const findOrCreateTypeComponent = (name, opts) => {
+        let comp = typeComponents.get(name) ?? components.find(c => c.name === name && c.type === 'component');
+        if (!comp) {
+            comp = {
+                component_id: generateComponentId('component', name),
+                name,
+                type: 'component',
+                role: { purpose: opts.purpose, layer: 'backend', critical: false },
+                source: { detection_method: 'auto', config_files: [], confidence: 0.85 },
+                connects_to: [],
+                connected_from: [],
+                status: 'active',
+                tags: ['swift', ...opts.tags],
+                metadata: { file: opts.file, line: opts.line, ...(opts.metadata ?? {}) },
+                timestamp,
+                last_updated: timestamp,
+            };
+            components.push(comp);
+        }
+        else {
+            // Merge: a type can surface in several passes (a conforming type that is
+            // also an actor). Union the tags and fill metadata gaps rather than
+            // pushing a duplicate the scan-level dedup would later drop.
+            for (const t of ['swift', ...opts.tags]) {
+                if (!comp.tags.includes(t))
+                    comp.tags.push(t);
+            }
+            comp.metadata = { file: opts.file, line: opts.line, ...(comp.metadata ?? {}), ...(opts.metadata ?? {}) };
+        }
+        typeComponents.set(name, comp);
+        return comp;
+    };
     // ---- String-keyed runtime deps ----
     const stringKeys = scanStringKeys(files);
     const fragileKeys = buildFragileKeys(stringKeys);
@@ -169,9 +285,22 @@ export async function scanSwiftCode(projectRoot) {
             last_updated: timestamp,
         });
         for (const conf of conformers) {
+            // The conforming type IS the source of this edge, so push it as a real
+            // component instead of pointing the edge at `FILE:${conf.file}`. The
+            // FILE: form only resolved when some other scanner happened to claim
+            // that file as a component, which never happens for a .swift file — so
+            // every conforms-to edge dangled (1,225 of them on the Ambient Agent
+            // repo). find-or-create keys on name+type so a type that also appears
+            // in the actor pass below merges instead of duplicating.
+            const conformerComp = findOrCreateTypeComponent(conf.typeName, {
+                purpose: `Swift type: ${conf.typeName}`,
+                file: conf.file,
+                line: conf.line,
+                tags: ['type', 'protocol-conformer'],
+            });
             connections.push({
                 connection_id: generateConnectionId('conforms-to'),
-                from: { component_id: generateComponentId('other', conf.typeName), location: { file: conf.file, line: conf.line } },
+                from: { component_id: conformerComp.component_id, location: { file: conf.file, line: conf.line } },
                 to: { component_id: compId },
                 connection_type: 'conforms-to',
                 code_reference: {
@@ -201,8 +330,27 @@ export async function scanSwiftCode(projectRoot) {
                 continue;
             connections.push({
                 connection_id: generateConnectionId('observes'),
-                from: { component_id: generateComponentId('component', con.ownerType), location: { file: con.file, line: con.line } },
-                to: { component_id: generateComponentId('component', pub.ownerType), location: { file: pub.file, line: pub.line } },
+                // Both ends resolve through find-or-create. Freshly generating the id
+                // here produced a different random suffix on each of the two calls, so
+                // neither endpoint matched any pushed component.
+                from: {
+                    component_id: findOrCreateTypeComponent(con.ownerType, {
+                        purpose: `Swift observable type: ${con.ownerType}`,
+                        file: con.file,
+                        line: con.line,
+                        tags: ['type', 'state-observation'],
+                    }).component_id,
+                    location: { file: con.file, line: con.line },
+                },
+                to: {
+                    component_id: findOrCreateTypeComponent(pub.ownerType, {
+                        purpose: `Swift observable type: ${pub.ownerType}`,
+                        file: pub.file,
+                        line: pub.line,
+                        tags: ['type', 'state-observation'],
+                    }).component_id,
+                    location: { file: pub.file, line: pub.line },
+                },
                 connection_type: 'observes',
                 code_reference: {
                     file: con.file,
@@ -219,14 +367,156 @@ export async function scanSwiftCode(projectRoot) {
             });
         }
     }
+    // ---- Actor isolation tracking ----
+    const actorHits = scanActorIsolation(files);
+    const actorComponents = new Map(); // name -> component_id
+    for (const hit of actorHits) {
+        if (hit.type === 'actor-declaration') {
+            // find-or-create, not an unconditional push: the conformance pass above
+            // may already have created this type's component. Two components with
+            // the same type+name and no config_files collide on scanner.ts's dedup
+            // key, one gets dropped, and every edge that named the dropped id is
+            // orphaned — the exact failure documented at scanner.ts's dedup block.
+            const compId = findOrCreateTypeComponent(hit.name, {
+                purpose: `Actor: ${hit.name}`,
+                file: hit.file,
+                line: hit.line,
+                tags: ['actor-isolation', 'actor-declaration'],
+                metadata: { actorType: 'actor' },
+            }).component_id;
+            actorComponents.set(hit.name, compId);
+            connections.push({
+                connection_id: generateConnectionId('other'),
+                from: { component_id: compId, location: { file: hit.file, line: hit.line } },
+                to: { component_id: compId },
+                connection_type: 'other',
+                code_reference: {
+                    file: hit.file,
+                    symbol: hit.name,
+                    symbol_type: 'class',
+                    line_start: hit.line,
+                    code_snippet: hit.snippet.slice(0, 100),
+                },
+                description: `Actor declaration: ${hit.name}`,
+                detected_from: 'swift-code-scanner',
+                confidence: 0.9,
+                timestamp,
+                last_verified: timestamp,
+            });
+        }
+        else if (hit.type === 'main-actor') {
+            // Look up by name+type (not a freshly generated id — generateComponentId()
+            // appends a random suffix, so a lookup keyed on a fresh call can never
+            // match a previously pushed component). Shared find-or-create now owns
+            // that merge for every pass in this scanner.
+            const compId = findOrCreateTypeComponent(hit.name, {
+                purpose: `@MainActor: ${hit.name}`,
+                file: hit.file,
+                line: hit.line,
+                tags: ['actor-isolation', 'main-actor'],
+                metadata: { actorType: '@MainActor' },
+            }).component_id;
+            connections.push({
+                connection_id: generateConnectionId('other'),
+                from: { component_id: compId, location: { file: hit.file, line: hit.line } },
+                to: { component_id: compId },
+                connection_type: 'other',
+                code_reference: {
+                    file: hit.file,
+                    symbol: hit.name,
+                    symbol_type: 'class',
+                    line_start: hit.line,
+                    code_snippet: hit.snippet.slice(0, 100),
+                },
+                description: `@MainActor isolation: ${hit.name}`,
+                detected_from: 'swift-code-scanner',
+                confidence: 0.9,
+                timestamp,
+                last_verified: timestamp,
+            });
+        }
+        else if (hit.type === 'nonisolated') {
+            // Was a fresh generateComponentId() — an id no component ever carried,
+            // so the self-edge below dangled on both ends.
+            const compId = findOrCreateTypeComponent(hit.name, {
+                purpose: `Swift type: ${hit.name}`,
+                file: hit.file,
+                line: hit.line,
+                tags: ['actor-isolation', 'nonisolated'],
+            }).component_id;
+            connections.push({
+                connection_id: generateConnectionId('other'),
+                from: { component_id: compId, location: { file: hit.file, line: hit.line } },
+                to: { component_id: compId },
+                connection_type: 'other',
+                code_reference: {
+                    file: hit.file,
+                    symbol: hit.name,
+                    symbol_type: 'function',
+                    line_start: hit.line,
+                    code_snippet: hit.snippet.slice(0, 100),
+                },
+                description: `nonisolated member: ${hit.name}`,
+                detected_from: 'swift-code-scanner',
+                confidence: 0.85,
+                timestamp,
+                last_verified: timestamp,
+            });
+        }
+        else if (hit.type === 'task-modifier' || hit.type === 'task-spawn') {
+            // Run 4 fix2 #2a: a Task site is not a component. Attach it to the
+            // ENCLOSING TYPE's component (recorded under metadata.spawns[]) and emit
+            // the edge from that owner; with no enclosing type, use the file node
+            // that scanner.ts (C2) synthesizes for `FILE:<path>`. Never mint a
+            // `task_spawn_<path>:<line>` component — the audit adjudicated eight of
+            // those as scanner naming bugs, not hallucinations.
+            let compId;
+            if (hit.ownerType) {
+                const owner = findOrCreateTypeComponent(hit.ownerType, {
+                    purpose: `Swift type: ${hit.ownerType}`,
+                    file: hit.file,
+                    line: hit.line,
+                    tags: ['actor-isolation', hit.type],
+                });
+                const md = (owner.metadata ??= {});
+                const spawns = (md['spawns'] ??= []);
+                spawns.push({ kind: hit.type, file: hit.file, line: hit.line, symbol: hit.name });
+                compId = owner.component_id;
+            }
+            else {
+                compId = `FILE:${hit.file}`;
+            }
+            connections.push({
+                connection_id: generateConnectionId('other'),
+                from: { component_id: compId, location: { file: hit.file, line: hit.line } },
+                to: { component_id: compId },
+                connection_type: 'other',
+                code_reference: {
+                    file: hit.file,
+                    symbol: hit.name,
+                    symbol_type: 'function',
+                    line_start: hit.line,
+                    code_snippet: hit.snippet.slice(0, 100),
+                },
+                description: `${hit.type === 'task-modifier' ? '.task modifier' : 'Task spawning'} in ${hit.name}`,
+                detected_from: 'swift-code-scanner',
+                confidence: 0.85,
+                timestamp,
+                last_verified: timestamp,
+            });
+        }
+    }
     // ---- LLM API calls ----
     const llmCalls = scanLLMCalls(files);
     for (const call of llmCalls) {
-        const compId = generateComponentId('llm', call.provider);
-        // Only add component if not already present
-        if (!components.find(c => c.name === call.provider && c.type === 'llm')) {
-            components.push({
-                component_id: compId,
+        // Reuse the existing component's id when present — generateComponentId()
+        // appends a random suffix, so recomputing it here (rather than reusing
+        // the id actually pushed to `components`) would leave every subsequent
+        // file's connection pointing at a component that was never created.
+        let llmComponent = components.find(c => c.name === call.provider && c.type === 'llm');
+        if (!llmComponent) {
+            llmComponent = {
+                component_id: generateComponentId('llm', call.provider),
                 name: call.provider,
                 type: 'llm',
                 role: { purpose: `${call.provider} LLM API`, layer: 'external', critical: true },
@@ -237,12 +527,16 @@ export async function scanSwiftCode(projectRoot) {
                 tags: ['swift', 'llm', 'external'],
                 timestamp,
                 last_updated: timestamp,
-            });
+            };
+            components.push(llmComponent);
         }
         connections.push({
             connection_id: generateConnectionId('service-call'),
-            from: { component_id: generateComponentId('other', call.file), location: { file: call.file, line: call.line } },
-            to: { component_id: compId },
+            // FILE: form (matching env-scanner.ts:469, deploy-scanner.ts:440,468) so
+            // scanner.ts:1578-1592 resolves it to the owning component instead of a
+            // random `generateComponentId('other', ...)` id that was never pushed.
+            from: { component_id: `FILE:${call.file}`, location: { file: call.file, line: call.line } },
+            to: { component_id: llmComponent.component_id },
             connection_type: 'service-call',
             code_reference: {
                 file: call.file,
@@ -258,6 +552,69 @@ export async function scanSwiftCode(projectRoot) {
             last_verified: timestamp,
         });
     }
+    // ---- FoundationModels (Apple on-device) — dedicated pass ----
+    const foundationModels = scanFoundationModelsUsage(files);
+    if (foundationModels.calls.length > 0) {
+        const allSchemas = new Set();
+        for (const schemaSet of foundationModels.schemas.values()) {
+            for (const s of schemaSet)
+                allSchemas.add(s);
+        }
+        const fmProvider = 'Apple Foundation Models';
+        let fmComponent = components.find(c => c.name === fmProvider && c.type === 'llm');
+        if (!fmComponent) {
+            fmComponent = {
+                component_id: generateComponentId('llm', fmProvider),
+                name: fmProvider,
+                type: 'llm',
+                role: { purpose: `${fmProvider} on-device API`, layer: 'external', critical: true },
+                source: { detection_method: 'auto', config_files: [], confidence: 0.9 },
+                connects_to: [],
+                connected_from: [],
+                status: 'active',
+                tags: ['swift', 'llm', 'external', 'apple-on-device'],
+                metadata: {
+                    provider: 'apple-on-device',
+                    kind: 'foundation-models',
+                    generable_schemas: [...allSchemas],
+                },
+                timestamp,
+                last_updated: timestamp,
+            };
+            components.push(fmComponent);
+        }
+        else {
+            const existingSchemas = new Set(fmComponent.metadata?.generable_schemas || []);
+            for (const s of allSchemas)
+                existingSchemas.add(s);
+            fmComponent.metadata = {
+                ...fmComponent.metadata,
+                provider: 'apple-on-device',
+                kind: 'foundation-models',
+                generable_schemas: [...existingSchemas],
+            };
+        }
+        for (const call of foundationModels.calls) {
+            connections.push({
+                connection_id: generateConnectionId('service-call'),
+                from: { component_id: `FILE:${call.file}`, location: { file: call.file, line: call.line } },
+                to: { component_id: fmComponent.component_id },
+                connection_type: 'service-call',
+                code_reference: {
+                    file: call.file,
+                    symbol: call.symbol,
+                    symbol_type: 'function',
+                    line_start: call.line,
+                    code_snippet: call.snippet.slice(0, 100),
+                },
+                description: `${fmProvider} API call in ${call.file}`,
+                detected_from: 'swift-code-scanner',
+                confidence: 0.9,
+                timestamp,
+                last_verified: timestamp,
+            });
+        }
+    }
     // ---- Entitlement requirements ----
     const frameworkImports = scanFrameworkImports(files);
     const entitlementReqs = [];
@@ -272,25 +629,56 @@ export async function scanSwiftCode(projectRoot) {
             }
         }
     }
+    // Neither endpoint was ever a real component before this fix: no
+    // `framework` component is pushed anywhere in this scanner, and no
+    // `entitlement:<key>` component was ever pushed either — both were
+    // dangling `generateComponentId(...)` ids (fact-checker finding). Push one
+    // real entitlement component per unique key (dedup, same pattern as the
+    // protocol/string-key groupings above) and use the `FILE:` form for the
+    // framework side, since the requirement is tied to the importing file, not
+    // to a framework component that doesn't exist.
+    const entitlementGroups = new Map();
     for (const req of entitlementReqs) {
-        connections.push({
-            connection_id: generateConnectionId('requires-entitlement'),
-            from: { component_id: generateComponentId('framework', req.framework), location: { file: req.file, line: req.line } },
-            to: { component_id: generateComponentId('other', `entitlement:${req.key}`) },
-            connection_type: 'requires-entitlement',
-            code_reference: {
-                file: req.file,
-                symbol: `import ${req.framework}`,
-                symbol_type: 'import',
-                line_start: req.line,
-                code_snippet: `import ${req.framework} → requires ${req.key}`,
-            },
-            description: `${req.framework} requires entitlement/plist key: ${req.key}`,
-            detected_from: 'swift-code-scanner',
-            confidence: 0.85,
+        if (!entitlementGroups.has(req.key))
+            entitlementGroups.set(req.key, []);
+        entitlementGroups.get(req.key).push(req);
+    }
+    for (const [key, reqs] of entitlementGroups) {
+        const entitlementCompId = generateComponentId('other', `entitlement:${key}`);
+        components.push({
+            component_id: entitlementCompId,
+            name: `entitlement:${key}`,
+            type: 'other',
+            role: { purpose: `Entitlement/plist key required: ${key}`, layer: 'infra', critical: false },
+            source: { detection_method: 'auto', config_files: [], confidence: 0.85 },
+            connects_to: [],
+            connected_from: [],
+            status: 'active',
+            tags: ['swift', 'entitlement'],
+            metadata: { key, frameworks: [...new Set(reqs.map(r => r.framework))] },
             timestamp,
-            last_verified: timestamp,
+            last_updated: timestamp,
         });
+        for (const req of reqs) {
+            connections.push({
+                connection_id: generateConnectionId('requires-entitlement'),
+                from: { component_id: `FILE:${req.file}`, location: { file: req.file, line: req.line } },
+                to: { component_id: entitlementCompId },
+                connection_type: 'requires-entitlement',
+                code_reference: {
+                    file: req.file,
+                    symbol: `import ${req.framework}`,
+                    symbol_type: 'import',
+                    line_start: req.line,
+                    code_snippet: `import ${req.framework} → requires ${req.key}`,
+                },
+                description: `${req.framework} requires entitlement/plist key: ${req.key}`,
+                detected_from: 'swift-code-scanner',
+                confidence: 0.85,
+                timestamp,
+                last_verified: timestamp,
+            });
+        }
     }
     // ---- Prompt patterns in Swift ----
     const prompts = scanSwiftPrompts(files);
@@ -329,6 +717,10 @@ export async function scanSwiftCode(projectRoot) {
             last_verified: timestamp,
         });
     }
+    // ---- SwiftUI view composition & navigation ----
+    const swiftuiResult = scanSwiftUIViews(files);
+    components.push(...swiftuiResult.components);
+    connections.push(...swiftuiResult.connections);
     // ---- Build project metadata ----
     const projectMeta = buildProjectMetadata(files, frameworkImports, projectRoot, fragileKeys, entitlementReqs);
     return { components, connections, warnings, projectMeta };
@@ -602,6 +994,75 @@ function scanLLMCalls(files) {
         return true;
     });
 }
+/**
+ * Dedicated FoundationModels (Apple on-device LLM) detection pass.
+ * Gated on `import FoundationModels` in the same file — see the constants
+ * block above for the full rationale and pattern list.
+ */
+function scanFoundationModelsUsage(files) {
+    const calls = [];
+    const schemas = new Map();
+    for (const file of files) {
+        // False-positive guard: nothing below runs unless this file imports
+        // FoundationModels.
+        if (!file.lines.some(l => FOUNDATION_MODELS_IMPORT.test(l)))
+            continue;
+        let fileHasSignal = false;
+        let hitLine = -1;
+        let hitSymbol = '';
+        let hitSnippet = '';
+        for (let i = 0; i < file.lines.length; i++) {
+            const line = file.lines[i];
+            const trimmed = line.trim();
+            if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*'))
+                continue;
+            // @Generable-annotated struct/enum. The annotation may be inline with
+            // the declaration or on the preceding line(s).
+            if (GENERABLE_ANNOTATION.test(line)) {
+                let name;
+                const inlineDecl = line.replace(GENERABLE_ANNOTATION, '').match(STRUCT_ENUM_DECL);
+                if (inlineDecl) {
+                    name = inlineDecl[1];
+                }
+                else {
+                    for (let j = i + 1; j < Math.min(i + 4, file.lines.length); j++) {
+                        if (file.lines[j].trim() === '')
+                            continue;
+                        const declMatch = file.lines[j].match(STRUCT_ENUM_DECL);
+                        if (declMatch)
+                            name = declMatch[1];
+                        break; // only the nearest non-blank line counts
+                    }
+                }
+                if (name) {
+                    if (!schemas.has(file.relativePath))
+                        schemas.set(file.relativePath, new Set());
+                    schemas.get(file.relativePath).add(name);
+                    if (!fileHasSignal) {
+                        fileHasSignal = true;
+                        hitLine = i + 1;
+                        hitSymbol = name;
+                        hitSnippet = trimmed;
+                    }
+                }
+            }
+            // Session construction (any-argument or trailing-closure form) or a
+            // confirming signal.
+            const isConstruction = FOUNDATION_MODELS_SESSION_CTOR.test(line);
+            const isConfirming = FOUNDATION_MODELS_CONFIRMING.some(p => p.test(line));
+            if ((isConstruction || isConfirming) && !fileHasSignal) {
+                fileHasSignal = true;
+                hitLine = i + 1;
+                hitSymbol = extractNearestSymbol(file.lines, i) || 'LanguageModelSession';
+                hitSnippet = trimmed;
+            }
+        }
+        if (fileHasSignal) {
+            calls.push({ file: file.relativePath, line: hitLine, symbol: hitSymbol, snippet: hitSnippet });
+        }
+    }
+    return { calls, schemas };
+}
 // =============================================================================
 // FRAMEWORK IMPORT SCANNING (for entitlement detection)
 // =============================================================================
@@ -626,6 +1087,84 @@ function scanFrameworkImports(files) {
     });
 }
 // =============================================================================
+// ACTOR ISOLATION DETECTION
+// =============================================================================
+function scanActorIsolation(files) {
+    const hits = [];
+    for (const file of files) {
+        for (let i = 0; i < file.lines.length; i++) {
+            const line = file.lines[i];
+            const trimmed = line.trim();
+            // Skip comments
+            if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*'))
+                continue;
+            // Match: @MainActor class/struct/func/var
+            const mainActorMatch = line.match(/@MainActor\s+(?:(?:public|private|internal|open|final|static)\s+)*(?:class|struct|func|var)\s+(\w+)/);
+            if (mainActorMatch) {
+                hits.push({
+                    type: 'main-actor',
+                    name: mainActorMatch[1],
+                    file: file.relativePath,
+                    line: i + 1,
+                    snippet: trimmed,
+                });
+            }
+            // Match: nonisolated func/var
+            const nonisolatedMatch = line.match(/nonisolated\s+(?:(?:public|private|internal|open|static)\s+)*(?:func|var)\s+(\w+)/);
+            if (nonisolatedMatch) {
+                hits.push({
+                    type: 'nonisolated',
+                    name: nonisolatedMatch[1],
+                    file: file.relativePath,
+                    line: i + 1,
+                    snippet: trimmed,
+                });
+            }
+            // Match: actor MyActor { (standalone actor declarations)
+            const actorDeclMatch = line.match(/^\s*(?:(?:public|private|internal|open|final|@\w+)\s+)*actor\s+(\w+)\s*(?:<[^>]*>)?\s*(?::\s*[^{]+)?\s*\{/);
+            if (actorDeclMatch) {
+                hits.push({
+                    type: 'actor-declaration',
+                    name: actorDeclMatch[1],
+                    file: file.relativePath,
+                    line: i + 1,
+                    snippet: trimmed,
+                });
+            }
+            // Match: .task { } (SwiftUI view modifier)
+            // Run 4 fix2 #2a: `name` is the nearest declared symbol (the edge's
+            // code_reference.symbol, which must appear in the file) or the literal
+            // `task` / `Task` token — never a `<path>:<line>` pseudo-name.
+            const taskModifierMatch = line.match(/\.task\s*\{/);
+            if (taskModifierMatch) {
+                const name = extractNearestSymbol(file.lines, i) || 'task';
+                hits.push({
+                    type: 'task-modifier',
+                    name,
+                    file: file.relativePath,
+                    line: i + 1,
+                    snippet: trimmed,
+                    ownerType: extractEnclosingType(file.lines, i),
+                });
+            }
+            // Match: Task { } or Task.detached { }
+            const taskSpawnMatch = line.match(/Task\s*(?:\.detached\s*)?\{/);
+            if (taskSpawnMatch) {
+                const name = extractNearestSymbol(file.lines, i) || 'Task';
+                hits.push({
+                    type: 'task-spawn',
+                    name,
+                    file: file.relativePath,
+                    line: i + 1,
+                    snippet: trimmed,
+                    ownerType: extractEnclosingType(file.lines, i),
+                });
+            }
+        }
+    }
+    return hits;
+}
+// =============================================================================
 // PROMPT DETECTION IN SWIFT
 // =============================================================================
 function scanSwiftPrompts(files) {
@@ -744,12 +1283,7 @@ function buildProjectMetadata(files, frameworkImports, projectRoot, fragileKeys,
         const pkgSwiftPath = path.join(projectRoot, 'Package.swift');
         if (fs.existsSync(pkgSwiftPath)) {
             const pkgContent = fs.readFileSync(pkgSwiftPath, 'utf-8');
-            const targets = [];
-            const targetMatches = pkgContent.matchAll(/\.(?:executableTarget|target|testTarget)\(\s*name:\s*"([^"]+)"/g);
-            for (const m of targetMatches) {
-                const targetType = m[0].includes('testTarget') ? 'test' : m[0].includes('executableTarget') ? 'executable' : 'library';
-                targets.push({ name: m[1], type: targetType, dependencies: [] });
-            }
+            const targets = parseSwiftPackageTargets(pkgContent);
             if (targets.length > 0) {
                 meta.targets = targets;
             }
@@ -769,6 +1303,33 @@ function buildProjectMetadata(files, frameworkImports, projectRoot, fragileKeys,
 // =============================================================================
 // HELPERS
 // =============================================================================
+/**
+ * Nearest enclosing type declaration above `lineIndex`: the closest preceding
+ * `class|struct|enum|actor|extension Name` whose brace block is still open at
+ * the hit (tracked by counting braces between the declaration and the hit).
+ * Returns undefined for file-scope Task sites.
+ */
+function extractEnclosingType(lines, lineIndex) {
+    const decl = /^\s*(?:@\w+(?:\([^)]*\))?\s+)*(?:(?:public|private|internal|fileprivate|open|final|indirect)\s+)*(?:class|struct|enum|actor|extension)\s+([A-Za-z_][\w]*)/;
+    for (let j = lineIndex - 1; j >= 0; j--) {
+        const m = lines[j].match(decl);
+        if (!m)
+            continue;
+        // Is this declaration's block still open at the hit line?
+        let depth = 0;
+        for (let k = j; k < lineIndex; k++) {
+            for (const ch of lines[k]) {
+                if (ch === '{')
+                    depth++;
+                else if (ch === '}')
+                    depth--;
+            }
+        }
+        if (depth > 0)
+            return m[1];
+    }
+    return undefined;
+}
 function extractNearestSymbol(lines, lineIndex) {
     // Look backwards for func/var/let/class/struct declaration
     for (let j = lineIndex; j >= Math.max(0, lineIndex - 5); j--) {
@@ -800,4 +1361,148 @@ function buildFragileKeys(hits) {
     }
     return fragile.length > 0 ? fragile : undefined;
 }
+/**
+ * Parse the local target graph out of a Package.swift manifest.
+ *
+ * The manifest is Swift source, not data, so this is a bounded textual parse:
+ * find each target declaration, take its argument list by balancing
+ * parentheses (skipping string literals and comments), then read the
+ * `dependencies:` array inside it. Handles the four dependency spellings SPM
+ * accepts: a bare "Name" string, .target(name:), .byName(name:), and
+ * .product(name:package:).
+ */
+export function parseSwiftPackageTargets(pkgContent) {
+    const targets = [];
+    const declRe = /\.(executableTarget|testTarget|target|macro|plugin|systemLibrary|binaryTarget)\(/g;
+    let decl;
+    while ((decl = declRe.exec(pkgContent)) !== null) {
+        const kind = decl[1];
+        const openParen = decl.index + decl[0].length - 1;
+        const body = sliceBalanced(pkgContent, openParen, '(', ')');
+        if (body === null)
+            continue;
+        const nameMatch = /name:\s*"([^"]+)"/.exec(stripComments(body));
+        if (!nameMatch)
+            continue;
+        const type = kind === 'testTarget' ? 'test' : kind === 'executableTarget' ? 'executable' : 'library';
+        targets.push({
+            name: nameMatch[1],
+            type,
+            dependencies: extractTargetDependencies(body),
+        });
+    }
+    return targets;
+}
+/**
+ * Return the text between `open` at `openIndex` and its matching `close`,
+ * exclusive. Skips over string literals and // and /* *\/ comments so that a
+ * bracket inside a string or comment cannot unbalance the scan. Returns null
+ * when the manifest is truncated or unbalanced.
+ */
+function sliceBalanced(src, openIndex, open, close) {
+    let depth = 0;
+    let i = openIndex;
+    while (i < src.length) {
+        const ch = src[i];
+        if (ch === '"') {
+            i++;
+            while (i < src.length && src[i] !== '"') {
+                if (src[i] === '\\')
+                    i++;
+                i++;
+            }
+            i++;
+            continue;
+        }
+        if (ch === '/' && src[i + 1] === '/') {
+            while (i < src.length && src[i] !== '\n')
+                i++;
+            continue;
+        }
+        if (ch === '/' && src[i + 1] === '*') {
+            i += 2;
+            while (i < src.length && !(src[i] === '*' && src[i + 1] === '/'))
+                i++;
+            i += 2;
+            continue;
+        }
+        if (ch === open)
+            depth++;
+        else if (ch === close) {
+            depth--;
+            if (depth === 0)
+                return src.slice(openIndex + 1, i);
+        }
+        i++;
+    }
+    return null;
+}
+/**
+ * Remove // and /* *\/ comments, preserving string literals so that a `//`
+ * inside a string is not mistaken for a comment.
+ */
+function stripComments(src) {
+    let out = '';
+    let i = 0;
+    while (i < src.length) {
+        const ch = src[i];
+        if (ch === '"') {
+            out += ch;
+            i++;
+            while (i < src.length && src[i] !== '"') {
+                if (src[i] === '\\') {
+                    out += src[i];
+                    i++;
+                }
+                out += src[i];
+                i++;
+            }
+            out += src[i] ?? '';
+            i++;
+            continue;
+        }
+        if (ch === '/' && src[i + 1] === '/') {
+            while (i < src.length && src[i] !== '\n')
+                i++;
+            continue;
+        }
+        if (ch === '/' && src[i + 1] === '*') {
+            i += 2;
+            while (i < src.length && !(src[i] === '*' && src[i + 1] === '/'))
+                i++;
+            i += 2;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+/** Pull dependency names out of a single target's argument list. */
+function extractTargetDependencies(targetBody) {
+    const body = stripComments(targetBody);
+    const depsKey = /(^|[,\s(])dependencies:\s*\[/.exec(body);
+    if (!depsKey)
+        return [];
+    const bracketIndex = body.indexOf('[', depsKey.index);
+    const list = sliceBalanced(body, bracketIndex, '[', ']');
+    if (list === null)
+        return [];
+    const names = [];
+    // Consume each qualified entry WHOLE — .product(name:package:) carries a
+    // second string literal that must not be read back as a dependency.
+    const qualified = /\.(?:target|byName|product)\(([^)]*)\)/g;
+    let m;
+    while ((m = qualified.exec(list)) !== null) {
+        const name = /name:\s*"([^"]+)"/.exec(m[1]);
+        if (name)
+            names.push(name[1]);
+    }
+    // Bare "Name" entries — whatever the qualified forms did not claim.
+    const withoutQualified = list.replace(qualified, '');
+    const bare = /"([^"]+)"/g;
+    while ((m = bare.exec(withoutQualified)) !== null)
+        names.push(m[1]);
+    return [...new Set(names)];
+}
 //# sourceMappingURL=code-scanner.js.map