@vohongtho.infotech/code-intel 0.6.0 → 0.8.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { createRequire } from 'module';
 import { fileURLToPath } from 'url';
-import path27 from 'path';
-import fs19, { existsSync } from 'fs';
+import path31 from 'path';
+import fs24, { existsSync } from 'fs';
 import { Parser, Language, Query } from 'web-tree-sitter';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
@@ -126,11 +126,11 @@ var init_shared = __esm({
   }
 });
 function findBundledWasmDir() {
-  const fileDir = path27.dirname(fileURLToPath(import.meta.url));
+  const fileDir = path31.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path27.join(fileDir, "wasm"),
+    path31.join(fileDir, "wasm"),
     // dist/index.js → dist/wasm/
-    path27.join(fileDir, "../wasm")
+    path31.join(fileDir, "../wasm")
     // dist/cli/main.js → dist/wasm/
   ];
   for (const candidate of candidates) {
@@ -171,7 +171,7 @@ function wasmPath(lang) {
   }
   const bundled = BUNDLED_WASM_MAP[lang];
   if (bundled) {
-    const bundledPath = path27.join(_bundledWasmDir, bundled);
+    const bundledPath = path31.join(_bundledWasmDir, bundled);
     if (existsSync(bundledPath)) return bundledPath;
   }
   return null;
@@ -184,14 +184,14 @@ async function initParser() {
 }
 async function getLanguage(lang) {
   if (languageCache.has(lang)) return languageCache.get(lang);
-  const path28 = wasmPath(lang);
-  if (!path28) {
+  const path32 = wasmPath(lang);
+  if (!path32) {
     languageCache.set(lang, null);
     return null;
   }
   try {
     await initParser();
-    const language = await Language.load(path28);
+    const language = await Language.load(path32);
     languageCache.set(lang, language);
     return language;
   } catch {
@@ -1162,7 +1162,7 @@ var init_logger = __esm({
         };
       }
       /** Global log directory: ~/.code-intel/logs */
-      static LOG_DIR = path27.join(os12.homedir(), ".code-intel", "logs");
+      static LOG_DIR = path31.join(os12.homedir(), ".code-intel", "logs");
       static getLogger() {
         if (!_Logger.instance) {
           const isProduction = process.env.NODE_ENV === "production";
@@ -1171,12 +1171,12 @@ var init_logger = __esm({
           transports.push(new winston.transports.Console());
           if (!isProduction) {
             try {
-              if (!fs19.existsSync(_Logger.LOG_DIR)) {
-                fs19.mkdirSync(_Logger.LOG_DIR, { recursive: true });
+              if (!fs24.existsSync(_Logger.LOG_DIR)) {
+                fs24.mkdirSync(_Logger.LOG_DIR, { recursive: true });
               }
               transports.push(
                 new DailyRotateFile({
-                  filename: path27.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
+                  filename: path31.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
                   datePattern: "YYYY-MM-DD",
                   maxSize: "20m",
                   maxFiles: "14d"
@@ -1961,7 +1961,7 @@ var init_parse_phase = __esm({
           const batch = filePaths.slice(i, i + CONCURRENCY);
           await Promise.all(batch.map(async (filePath) => {
             try {
-              const source = await fs19.promises.readFile(filePath, "utf-8");
+              const source = await fs24.promises.readFile(filePath, "utf-8");
               context2.fileCache.set(filePath, source);
             } catch {
             }
@@ -1974,14 +1974,14 @@ var init_parse_phase = __esm({
           const lang = detectLanguage(filePath);
           if (!lang) {
             if (context2.verbose) {
-              const relativePath2 = path27.relative(context2.workspaceRoot, filePath);
+              const relativePath2 = path31.relative(context2.workspaceRoot, filePath);
               logger_default.info(`  [parse] skipped (no parser): ${relativePath2}`);
             }
             continue;
           }
           const source = context2.fileCache.get(filePath);
           if (!source) continue;
-          const relativePath = path27.relative(context2.workspaceRoot, filePath);
+          const relativePath = path31.relative(context2.workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const fileNode = context2.graph.getNode(fileNodeId);
           if (fileNode) {
@@ -2221,11 +2221,11 @@ var init_resolve_phase = __esm({
         let heritageEdges = 0;
         const fileIndex = /* @__PURE__ */ new Map();
         for (const fp of filePaths) {
-          const rel = path27.relative(workspaceRoot, fp);
+          const rel = path31.relative(workspaceRoot, fp);
           fileIndex.set(rel, fp);
           const noExt = rel.replace(/\.\w+$/, "");
           if (!fileIndex.has(noExt)) fileIndex.set(noExt, fp);
-          const base = path27.basename(rel, path27.extname(rel));
+          const base = path31.basename(rel, path31.extname(rel));
           if (!fileIndex.has(base)) fileIndex.set(base, fp);
         }
         const symbolIndex = /* @__PURE__ */ new Map();
@@ -2256,7 +2256,7 @@ var init_resolve_phase = __esm({
         for (const filePath of filePaths) {
           const lang = detectLanguage(filePath);
           if (!lang) continue;
-          const relativePath = path27.relative(workspaceRoot, filePath);
+          const relativePath = path31.relative(workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const source = fileCache.get(filePath);
           if (!source) continue;
@@ -2269,13 +2269,13 @@ var init_resolve_phase = __esm({
             let resolvedRelPath = null;
             if (cleaned.startsWith(".")) {
               const cleanedNoJs = cleaned.replace(/\.(js|jsx)$/, "");
-              const fromDir = path27.dirname(relativePath);
+              const fromDir = path31.dirname(relativePath);
               for (const ext of ["", ".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", "/index.ts", "/index.js"]) {
-                const candidate = path27.join(fromDir, cleanedNoJs + ext);
-                const normalized = path27.normalize(candidate);
+                const candidate = path31.join(fromDir, cleanedNoJs + ext);
+                const normalized = path31.normalize(candidate);
                 if (fileIndex.has(normalized)) {
                   const absPath = fileIndex.get(normalized);
-                  resolvedRelPath = path27.relative(workspaceRoot, absPath);
+                  resolvedRelPath = path31.relative(workspaceRoot, absPath);
                   break;
                 }
               }
@@ -2589,27 +2589,27 @@ __export(group_registry_exports, {
   saveSyncResult: () => saveSyncResult
 });
 function groupFile(name) {
-  return path27.join(GROUPS_DIR, `${name}.json`);
+  return path31.join(GROUPS_DIR, `${name}.json`);
 }
 function loadGroup(name) {
   try {
-    return JSON.parse(fs19.readFileSync(groupFile(name), "utf-8"));
+    return JSON.parse(fs24.readFileSync(groupFile(name), "utf-8"));
   } catch {
     return null;
   }
 }
 function saveGroup(group) {
-  fs19.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs19.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
+  fs24.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs24.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
 }
 function listGroups() {
   const groups = [];
   try {
-    for (const file of fs19.readdirSync(GROUPS_DIR)) {
+    for (const file of fs24.readdirSync(GROUPS_DIR)) {
       if (!file.endsWith(".json") || file.endsWith(".sync.json")) continue;
       try {
         const g = JSON.parse(
-          fs19.readFileSync(path27.join(GROUPS_DIR, file), "utf-8")
+          fs24.readFileSync(path31.join(GROUPS_DIR, file), "utf-8")
         );
         groups.push(g);
       } catch {
@@ -2621,16 +2621,16 @@ function listGroups() {
 }
 function deleteGroup(name) {
   try {
-    fs19.unlinkSync(groupFile(name));
+    fs24.unlinkSync(groupFile(name));
   } catch {
   }
   try {
-    fs19.unlinkSync(path27.join(GROUPS_DIR, `${name}.sync.json`));
+    fs24.unlinkSync(path31.join(GROUPS_DIR, `${name}.sync.json`));
   } catch {
   }
 }
 function groupExists(name) {
-  return fs19.existsSync(groupFile(name));
+  return fs24.existsSync(groupFile(name));
 }
 function addMember(groupName, member) {
   const group = loadGroup(groupName);
@@ -2656,16 +2656,16 @@ function removeMember(groupName, groupPath) {
   return group;
 }
 function saveSyncResult(result) {
-  fs19.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs19.writeFileSync(
-    path27.join(GROUPS_DIR, `${result.groupName}.sync.json`),
+  fs24.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs24.writeFileSync(
+    path31.join(GROUPS_DIR, `${result.groupName}.sync.json`),
     JSON.stringify(result, null, 2) + "\n"
   );
 }
 function loadSyncResult(groupName) {
   try {
     return JSON.parse(
-      fs19.readFileSync(path27.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
+      fs24.readFileSync(path31.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
     );
   } catch {
     return null;
@@ -2674,7 +2674,7 @@ function loadSyncResult(groupName) {
 var GROUPS_DIR;
 var init_group_registry = __esm({
   "src/multi-repo/group-registry.ts"() {
-    GROUPS_DIR = path27.join(os12.homedir(), ".code-intel", "groups");
+    GROUPS_DIR = path31.join(os12.homedir(), ".code-intel", "groups");
   }
 });
 
@@ -2696,14 +2696,14 @@ function detectDeadCode(graph) {
     if (meta?.deprecated === true) continue;
     if (ENTRY_POINT_NAME_RE.test(node.name)) continue;
     if (entryPointIds.has(node.id)) continue;
-    let hasCallers = false;
+    let hasCallers2 = false;
     for (const edge of graph.findEdgesTo(node.id)) {
       if (edge.kind === "calls") {
-        hasCallers = true;
+        hasCallers2 = true;
         break;
       }
     }
-    if (hasCallers) continue;
+    if (hasCallers2) continue;
     let hasImporters = false;
     for (const edge of graph.findEdgesTo(node.id)) {
       if (edge.kind === "imports") {
@@ -3702,6 +3702,550 @@ var init_gql_executor = __esm({
   }
 });
 
+// src/analysis/deprecated-detector.ts
+var deprecated_detector_exports = {};
+__export(deprecated_detector_exports, {
+  DeprecatedDetector: () => DeprecatedDetector
+});
+var BUILTIN_DEPRECATED, DeprecatedDetector;
+var init_deprecated_detector = __esm({
+  "src/analysis/deprecated-detector.ts"() {
+    BUILTIN_DEPRECATED = [
+      { pattern: "url.parse", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "url.resolve", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "url.format", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "fs.exists", message: "deprecated \u2014 use fs.access instead" },
+      { pattern: "crypto.createCipher", message: "deprecated \u2014 use crypto.createCipheriv instead" },
+      { pattern: "crypto.createDecipher", message: "deprecated \u2014 use crypto.createDecipheriv instead" },
+      { pattern: "new Buffer()", message: "deprecated \u2014 use Buffer.from() instead" },
+      { pattern: "domain.create", message: "deprecated \u2014 the domain module is discouraged" },
+      { pattern: "process.binding", message: "deprecated internal API" }
+    ];
+    DeprecatedDetector = class {
+      tagDeprecated(graph) {
+        for (const node of graph.allNodes()) {
+          if (!node.metadata) node.metadata = {};
+          if (node.metadata["deprecated"] === true) continue;
+          let message;
+          const jsdoc = node.metadata["jsdoc"];
+          const comment = node.metadata["comment"];
+          if (jsdoc?.includes("@deprecated") || comment?.includes("@deprecated")) {
+            const src = jsdoc ?? comment ?? "";
+            const match = src.match(/@deprecated\s+(.*)/);
+            message = match?.[1]?.trim() || "deprecated";
+          }
+          if (!message && node.metadata["deprecated"] === true) {
+            message = node.metadata["deprecationMessage"] ?? "deprecated";
+          }
+          if (!message) {
+            const annotations = node.metadata["annotations"];
+            if (Array.isArray(annotations) && annotations.includes("Deprecated")) {
+              message = "marked @Deprecated";
+            }
+          }
+          if (!message) {
+            const attributes = node.metadata["attributes"];
+            if (Array.isArray(attributes) && attributes.includes("deprecated")) {
+              message = "marked #[deprecated]";
+            }
+          }
+          if (!message) {
+            for (const entry of BUILTIN_DEPRECATED) {
+              if (node.name === entry.pattern || node.name.includes(entry.pattern)) {
+                message = entry.message;
+                break;
+              }
+            }
+          }
+          if (message) {
+            node.metadata["deprecated"] = true;
+            node.metadata["deprecationMessage"] = message;
+          }
+        }
+      }
+      detect(graph, scope) {
+        const findings = [];
+        for (const node of graph.allNodes()) {
+          if (!node.metadata?.["deprecated"]) continue;
+          const callers = [];
+          for (const edge of graph.findEdgesTo(node.id)) {
+            if (edge.kind !== "calls" && edge.kind !== "deprecated_use") continue;
+            const caller = graph.getNode(edge.source);
+            if (!caller) continue;
+            if (scope && !caller.filePath.includes(scope)) continue;
+            callers.push({ name: caller.name, filePath: caller.filePath });
+            const edgeId = `dep_use_${edge.source}_${node.id}`;
+            if (!graph.getEdge(edgeId)) {
+              graph.addEdge({ id: edgeId, source: edge.source, target: node.id, kind: "deprecated_use" });
+            }
+          }
+          findings.push({
+            symbol: node.name,
+            filePath: node.filePath,
+            deprecationMessage: node.metadata?.["deprecationMessage"] ?? "deprecated",
+            callers
+          });
+        }
+        return findings;
+      }
+    };
+  }
+});
+
+// src/analysis/complexity.ts
+var complexity_exports = {};
+__export(complexity_exports, {
+  computeComplexity: () => computeComplexity
+});
+function getSeverity(cyclomatic) {
+  if (cyclomatic <= 5) return "LOW";
+  if (cyclomatic <= 10) return "MEDIUM";
+  if (cyclomatic <= 20) return "HIGH";
+  return "CRITICAL";
+}
+function computeComplexity(graph, scope) {
+  const results = [];
+  for (const node of graph.allNodes()) {
+    if (node.kind !== "function" && node.kind !== "method") continue;
+    if (scope && !node.filePath.startsWith(scope)) continue;
+    let outgoingCalls = 0;
+    for (const edge of graph.findEdgesFrom(node.id)) {
+      if (edge.kind === "calls") outgoingCalls++;
+    }
+    let cyclomatic;
+    const meta = node.metadata;
+    const metaComplexity = meta?.complexity;
+    if (typeof metaComplexity?.cyclomatic === "number") {
+      cyclomatic = metaComplexity.cyclomatic;
+    } else {
+      cyclomatic = 1 + Math.floor(outgoingCalls / 2);
+    }
+    cyclomatic = Math.min(cyclomatic, 50);
+    let cognitive;
+    if (typeof metaComplexity?.cognitive === "number") {
+      cognitive = metaComplexity.cognitive;
+    } else {
+      cognitive = Math.ceil(cyclomatic * 1.3);
+    }
+    results.push({
+      nodeId: node.id,
+      name: node.name,
+      filePath: node.filePath,
+      cyclomatic,
+      cognitive,
+      severity: getSeverity(cyclomatic)
+    });
+  }
+  return results.sort((a, b) => b.cyclomatic - a.cyclomatic);
+}
+var init_complexity = __esm({
+  "src/analysis/complexity.ts"() {
+  }
+});
+
+// src/analysis/test-coverage.ts
+var test_coverage_exports = {};
+__export(test_coverage_exports, {
+  computeCoverage: () => computeCoverage
+});
+function isTestFile(filePath) {
+  if (filePath.includes(".test.") || filePath.includes(".spec.")) return true;
+  if (filePath.includes("_test.") || filePath.endsWith("_test.go")) return true;
+  if (filePath.includes("__tests__")) return true;
+  const base = path31.basename(filePath);
+  if (base.startsWith("Test") && filePath.endsWith(".java")) return true;
+  return false;
+}
+function computeBlastRadius(graph, nodeId) {
+  const visited = /* @__PURE__ */ new Set();
+  const queue = [{ id: nodeId, depth: 0 }];
+  while (queue.length > 0) {
+    const { id, depth } = queue.shift();
+    if (visited.has(id)) continue;
+    visited.add(id);
+    if (depth >= 3) continue;
+    for (const edge of graph.findEdgesTo(id)) {
+      if (edge.kind === "calls" || edge.kind === "imports") {
+        if (!visited.has(edge.source)) {
+          queue.push({ id: edge.source, depth: depth + 1 });
+        }
+      }
+    }
+  }
+  return Math.max(0, visited.size - 1);
+}
+function getRisk(blastRadius) {
+  if (blastRadius > 20) return "HIGH";
+  if (blastRadius >= 5) return "MEDIUM";
+  return "LOW";
+}
+function computeCoverage(graph, scope) {
+  const testFilePaths = /* @__PURE__ */ new Set();
+  for (const node of graph.allNodes()) {
+    if (isTestFile(node.filePath)) testFilePaths.add(node.filePath);
+  }
+  const nodesImportedByTests = /* @__PURE__ */ new Set();
+  for (const edge of graph.findEdgesByKind("imports")) {
+    const sourceNode = graph.getNode(edge.source);
+    if (sourceNode && isTestFile(sourceNode.filePath)) {
+      nodesImportedByTests.add(edge.target);
+    }
+  }
+  const nodesWithTestedBy = /* @__PURE__ */ new Set();
+  for (const edge of graph.findEdgesByKind("tested_by")) {
+    nodesWithTestedBy.add(edge.source);
+  }
+  const baseNameToTestFiles = /* @__PURE__ */ new Map();
+  for (const testPath of testFilePaths) {
+    const base = path31.basename(testPath);
+    const stripped = base.replace(/\.test\.[^.]+$/, "").replace(/\.spec\.[^.]+$/, "").replace(/_test\.[^.]+$/, "").replace(/_test$/, "");
+    const existing = baseNameToTestFiles.get(stripped) ?? [];
+    existing.push(testPath);
+    baseNameToTestFiles.set(stripped, existing);
+  }
+  const exportedKinds = /* @__PURE__ */ new Set(["function", "method", "class"]);
+  const results = [];
+  for (const node of graph.allNodes()) {
+    if (!exportedKinds.has(node.kind)) continue;
+    if (node.exported !== true) continue;
+    if (scope && !node.filePath.startsWith(scope)) continue;
+    const testFiles = [];
+    if (nodesWithTestedBy.has(node.id)) {
+      for (const edge of graph.findEdgesFrom(node.id)) {
+        if (edge.kind === "tested_by") {
+          const testNode = graph.getNode(edge.target);
+          if (testNode && !testFiles.includes(testNode.filePath)) {
+            testFiles.push(testNode.filePath);
+          }
+        }
+      }
+    }
+    if (nodesImportedByTests.has(node.id)) {
+      for (const edge of graph.findEdgesTo(node.id)) {
+        if (edge.kind === "imports") {
+          const sourceNode = graph.getNode(edge.source);
+          if (sourceNode && isTestFile(sourceNode.filePath) && !testFiles.includes(sourceNode.filePath)) {
+            testFiles.push(sourceNode.filePath);
+          }
+        }
+      }
+    }
+    const nodeBase = path31.basename(node.filePath).replace(/\.[^.]+$/, "");
+    const matchingTestFiles = baseNameToTestFiles.get(nodeBase) ?? [];
+    for (const tf of matchingTestFiles) {
+      if (!testFiles.includes(tf)) testFiles.push(tf);
+    }
+    const tested = testFiles.length > 0;
+    const blastRadius = computeBlastRadius(graph, node.id);
+    const risk = getRisk(blastRadius);
+    results.push({
+      nodeId: node.id,
+      name: node.name,
+      filePath: node.filePath,
+      exported: true,
+      tested,
+      testFiles,
+      blastRadius,
+      risk
+    });
+  }
+  const totalExported = results.length;
+  const testedExported = results.filter((r) => r.tested).length;
+  const coveragePct = totalExported === 0 ? 100 : Math.round(testedExported / totalExported * 100);
+  const untestedByRisk = results.filter((r) => !r.tested).sort((a, b) => b.blastRadius - a.blastRadius);
+  return { totalExported, testedExported, coveragePct, untestedByRisk };
+}
+var init_test_coverage = __esm({
+  "src/analysis/test-coverage.ts"() {
+  }
+});
+
+// src/security/secret-scanner.ts
+var secret_scanner_exports = {};
+__export(secret_scanner_exports, {
+  SecretScanner: () => SecretScanner
+});
+function shannonEntropy(s) {
+  const freq = /* @__PURE__ */ new Map();
+  for (const c of s) freq.set(c, (freq.get(c) ?? 0) + 1);
+  let entropy = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function isTestFile2(filePath) {
+  return filePath.includes(".test.") || filePath.includes(".spec.") || filePath.includes("fixtures/") || filePath.includes("mocks/");
+}
+var ENV_VAR_RE, SENSITIVE_NAME_RE, VALUE_PATTERNS, SecretScanner;
+var init_secret_scanner = __esm({
+  "src/security/secret-scanner.ts"() {
+    ENV_VAR_RE = /^process\.env\./;
+    SENSITIVE_NAME_RE = /_SECRET$|_PASSWORD$|_TOKEN$|_KEY$|_API_KEY$/i;
+    VALUE_PATTERNS = [
+      [/sk-[A-Za-z0-9]{6,}/, "openai-api-key", "HIGH"],
+      [/pk_live_[A-Za-z0-9]{20,}/, "stripe-key", "HIGH"],
+      [/AKIA[0-9A-Z]{16}|aws.access.key/i, "aws-access-key", "HIGH"],
+      [/xoxb-[0-9]{11}-[0-9]{11}-[A-Za-z0-9]{24}/, "slack-token", "HIGH"],
+      [/postgres:\/\/[^@]+:[^@]+@/, "db-url-with-credentials", "HIGH"],
+      [/mysql:\/\/[^@]+:[^@]+@/, "db-url-with-credentials", "HIGH"],
+      [/-----BEGIN RSA PRIVATE KEY-----/, "rsa-private-key", "HIGH"]
+    ];
+    SecretScanner = class {
+      scan(graph, options) {
+        const findings = [];
+        const includeTests = options?.includeTestFiles ?? false;
+        const scope = options?.scope;
+        const ignorePatterns = [...options?.ignorePatterns ?? []];
+        if (options?.workspaceRoot) {
+          try {
+            const raw = fs24.readFileSync(path31.join(options.workspaceRoot, ".codeintelignore"), "utf-8");
+            for (const line of raw.split("\n")) {
+              const trimmed = line.trim();
+              if (trimmed && !trimmed.startsWith("#")) ignorePatterns.push(trimmed);
+            }
+          } catch {
+          }
+        }
+        for (const node of graph.allNodes()) {
+          const filePath = node.filePath;
+          if (scope && !filePath.startsWith(scope)) continue;
+          if (!includeTests && isTestFile2(filePath)) continue;
+          if (ignorePatterns.length > 0 && ignorePatterns.some((p) => filePath.includes(p))) continue;
+          const meta = node.metadata;
+          const rawValue = meta?.value ?? meta?.literalValue;
+          if (typeof rawValue !== "string" || rawValue.trim() === "") continue;
+          const value = rawValue.trim();
+          if (ENV_VAR_RE.test(value)) continue;
+          let matched = false;
+          for (const [re, label, severity] of VALUE_PATTERNS) {
+            if (re.test(value)) {
+              node.metadata = {
+                ...node.metadata ?? {},
+                security: { secretRisk: true, secretPattern: label }
+              };
+              findings.push({
+                file: filePath,
+                line: node.startLine,
+                symbol: node.name,
+                pattern: label,
+                severity
+              });
+              matched = true;
+              break;
+            }
+          }
+          if (matched) continue;
+          if (SENSITIVE_NAME_RE.test(node.name)) {
+            node.metadata = {
+              ...node.metadata ?? {},
+              security: { secretRisk: true, secretPattern: "sensitive-name-with-value" }
+            };
+            findings.push({
+              file: filePath,
+              line: node.startLine,
+              symbol: node.name,
+              pattern: "sensitive-name-with-value",
+              severity: "MEDIUM"
+            });
+            continue;
+          }
+          if (SENSITIVE_NAME_RE.test(node.name) && value.length > 20 && shannonEntropy(value) > 4.5) {
+            node.metadata = {
+              ...node.metadata ?? {},
+              security: { secretRisk: true, secretPattern: "high-entropy-string" }
+            };
+            findings.push({
+              file: filePath,
+              line: node.startLine,
+              symbol: node.name,
+              pattern: "high-entropy-string",
+              severity: "MEDIUM"
+            });
+          }
+        }
+        return findings;
+      }
+    };
+  }
+});
+
+// src/security/vulnerability-detector.ts
+var vulnerability_detector_exports = {};
+__export(vulnerability_detector_exports, {
+  VulnerabilityDetector: () => VulnerabilityDetector
+});
+function hasCallers(graph, nodeId) {
+  for (const edge of graph.findEdgesTo(nodeId)) {
+    if (edge.kind === "calls") return true;
+  }
+  return false;
+}
+var CWE, SQL_PATTERN, XSS_PATTERN, SSRF_PATTERN, PATH_PATTERN, CMD_PATTERN, VulnerabilityDetector;
+var init_vulnerability_detector = __esm({
+  "src/security/vulnerability-detector.ts"() {
+    CWE = {
+      SQL_INJECTION: "CWE-89",
+      XSS: "CWE-79",
+      SSRF: "CWE-918",
+      PATH_TRAVERSAL: "CWE-22",
+      COMMAND_INJECTION: "CWE-78"
+    };
+    SQL_PATTERN = /(db|database|connection|knex|sequelize|pool)\.(query|execute|raw)/i;
+    XSS_PATTERN = /innerHTML|outerHTML|document\.write|insertAdjacentHTML/i;
+    SSRF_PATTERN = /^(fetch|axios|http\.request|got)$/i;
+    PATH_PATTERN = /^(fs\.readFile|fs\.writeFile|path\.join|createReadStream)$/i;
+    CMD_PATTERN = /^(exec|execSync|spawn|eval)$/i;
+    VulnerabilityDetector = class {
+      detect(graph, options) {
+        const findings = [];
+        const scope = options?.scope;
+        const types = options?.types ? new Set(options.types) : null;
+        const want = (t) => !types || types.has(t);
+        const nodes = [...graph.allNodes()];
+        for (const node of nodes) {
+          if (node.kind === "vulnerability") continue;
+          const filePath = node.filePath;
+          if (scope && !filePath.startsWith(scope)) continue;
+          const nodeName = node.name;
+          const meta = node.metadata;
+          if (want("SQL_INJECTION") && SQL_PATTERN.test(nodeName)) {
+            const hasDynamic = meta?.hasStringConcatenation === true || hasCallers(graph, node.id);
+            if (hasDynamic) {
+              findings.push({
+                type: "SQL_INJECTION",
+                severity: "MEDIUM",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential SQL injection: ${nodeName} may execute unsanitized user input`,
+                cweId: CWE["SQL_INJECTION"]
+              });
+              this._tagNode(graph, node.id, "SQL_INJECTION");
+            }
+          }
+          if (want("XSS") && XSS_PATTERN.test(nodeName)) {
+            findings.push({
+              type: "XSS",
+              severity: "HIGH",
+              file: filePath,
+              line: node.startLine,
+              symbol: nodeName,
+              description: `Potential XSS: ${nodeName} writes to DOM sink`,
+              cweId: CWE["XSS"]
+            });
+            this._tagNode(graph, node.id, "XSS");
+          }
+          if (want("XSS")) {
+            for (const edge of graph.findEdgesFrom(node.id)) {
+              if (edge.kind === "calls") {
+                const callee = graph.getNode(edge.target);
+                if (callee && XSS_PATTERN.test(callee.name)) {
+                  findings.push({
+                    type: "XSS",
+                    severity: "HIGH",
+                    file: filePath,
+                    line: node.startLine,
+                    symbol: node.name,
+                    description: `Potential XSS: ${node.name} calls ${callee.name}`,
+                    cweId: CWE["XSS"]
+                  });
+                  this._tagNode(graph, node.id, "XSS");
+                }
+              }
+            }
+          }
+          if (want("SSRF") && SSRF_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicUrl === true;
+            if (isDynamic) {
+              findings.push({
+                type: "SSRF",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential SSRF: ${nodeName} uses a dynamic URL`,
+                cweId: CWE["SSRF"]
+              });
+              this._tagNode(graph, node.id, "SSRF");
+            }
+          }
+          if (want("PATH_TRAVERSAL") && PATH_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicPath === true;
+            if (isDynamic) {
+              findings.push({
+                type: "PATH_TRAVERSAL",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential path traversal: ${nodeName} uses a dynamic path`,
+                cweId: CWE["PATH_TRAVERSAL"]
+              });
+              this._tagNode(graph, node.id, "PATH_TRAVERSAL");
+            }
+          }
+          if (want("COMMAND_INJECTION") && CMD_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicArgs === true;
+            if (isDynamic) {
+              findings.push({
+                type: "COMMAND_INJECTION",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential command injection: ${nodeName} uses dynamic arguments`,
+                cweId: CWE["COMMAND_INJECTION"]
+              });
+              this._tagNode(graph, node.id, "COMMAND_INJECTION");
+            }
+          }
+        }
+        const seen = /* @__PURE__ */ new Set();
+        return findings.filter((f) => {
+          const key = `${f.type}:${f.file}:${f.line}:${f.symbol}`;
+          if (seen.has(key)) return false;
+          seen.add(key);
+          return true;
+        });
+      }
+      _tagNode(graph, nodeId, vulnType) {
+        const node = graph.getNode(nodeId);
+        if (!node) return;
+        const meta = node.metadata ?? {};
+        node.metadata = {
+          ...meta,
+          security: {
+            ...meta["security"] ?? {},
+            vulnerability: vulnType
+          }
+        };
+        const vulnNodeId = `vuln:${vulnType}:${nodeId}`;
+        if (!graph.getNode(vulnNodeId)) {
+          graph.addNode({
+            id: vulnNodeId,
+            kind: "vulnerability",
+            name: `${vulnType}:${node.name}`,
+            filePath: node.filePath,
+            startLine: node.startLine,
+            metadata: { cweId: CWE[vulnType], vulnType }
+          });
+        }
+        const edgeId = `has_vulnerability:${nodeId}:${vulnNodeId}`;
+        if (!graph.getEdge(edgeId)) {
+          graph.addEdge({
+            id: edgeId,
+            source: nodeId,
+            target: vulnNodeId,
+            kind: "has_vulnerability"
+          });
+        }
+      }
+    };
+  }
+});
+
 // src/errors/codes.ts
 var ErrorCodes, AppError;
 var init_codes = __esm({
@@ -3735,10 +4279,10 @@ var init_codes = __esm({
   }
 });
 function secureMkdir(dir) {
-  fs19.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  fs24.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
   if (process.platform !== "win32") {
     try {
-      fs19.chmodSync(dir, SECURE_DIR_MODE);
+      fs24.chmodSync(dir, SECURE_DIR_MODE);
     } catch {
     }
   }
@@ -3746,17 +4290,17 @@ function secureMkdir(dir) {
 function secureChmodFile(file) {
   if (process.platform === "win32") return;
   try {
-    fs19.chmodSync(file, SECURE_FILE_MODE);
+    fs24.chmodSync(file, SECURE_FILE_MODE);
   } catch {
   }
 }
 function tightenDbFiles(dir) {
   if (process.platform === "win32") return;
-  if (!fs19.existsSync(dir)) return;
-  for (const name of fs19.readdirSync(dir)) {
+  if (!fs24.existsSync(dir)) return;
+  for (const name of fs24.readdirSync(dir)) {
     if (name.endsWith(".db") || name.endsWith(".db-wal") || name.endsWith(".db-shm")) {
       try {
-        fs19.chmodSync(path27.join(dir, name), SECURE_FILE_MODE);
+        fs24.chmodSync(path31.join(dir, name), SECURE_FILE_MODE);
       } catch {
       }
     }
@@ -3770,7 +4314,7 @@ var init_fs_secure = __esm({
   }
 });
 function getUsersDBPath() {
-  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path27.join(os12.homedir(), ".code-intel", "users.db");
+  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path31.join(os12.homedir(), ".code-intel", "users.db");
 }
 function getOrCreateUsersDB() {
   if (!_usersDB) {
@@ -3786,7 +4330,7 @@ var init_users_db = __esm({
     UsersDB = class {
       db;
       constructor(dbPath) {
-        const dir = path27.dirname(dbPath);
+        const dir = path31.dirname(dbPath);
         secureMkdir(dir);
         this.db = new Database3(dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -4063,7 +4607,7 @@ function getScryptN() {
   return Number.isInteger(v) && v >= 1024 ? v : 1 << 14;
 }
 function getSecretsPath() {
-  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path27.join(os12.homedir(), ".code-intel", ".secrets");
+  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path31.join(os12.homedir(), ".code-intel", ".secrets");
 }
 function getMasterPassword() {
   const fromEnv = process.env["CODE_INTEL_SECRET_KEY"];
@@ -4094,8 +4638,8 @@ function decryptSecrets(encrypted) {
   return JSON.parse(plaintext.toString("utf8"));
 }
 function loadSecrets(secretsPath = getSecretsPath()) {
-  if (!fs19.existsSync(secretsPath)) return {};
-  const blob = fs19.readFileSync(secretsPath);
+  if (!fs24.existsSync(secretsPath)) return {};
+  const blob = fs24.readFileSync(secretsPath);
   return decryptSecrets(blob);
 }
 function getSecret(key, secretsPath = getSecretsPath()) {
@@ -4214,6 +4758,9 @@ function requireAuth(req, res, next) {
   }
   next();
 }
+function meetsRole(userRole, required) {
+  return (ROLE_RANK[userRole] ?? 0) >= (ROLE_RANK[required] ?? 0);
+}
 function requireRole(...roles) {
   return (req, res, next) => {
     if (!req.user) {
@@ -4228,7 +4775,8 @@ function requireRole(...roles) {
       });
       return;
     }
-    if (!roles.includes(req.user.role)) {
+    const allowed = roles.some((r) => meetsRole(req.user.role, r));
+    if (!allowed) {
       res.status(403).json({
         error: {
           code: ErrorCodes.FORBIDDEN,
@@ -4337,7 +4885,7 @@ function clearSessionCookie() {
 async function verifyPassword(plain, hash) {
   return bcrypt.compare(plain, hash);
 }
-var sessionStore, SESSION_COOKIE_NAME;
+var sessionStore, SESSION_COOKIE_NAME, ROLE_RANK;
 var init_middleware = __esm({
   "src/auth/middleware.ts"() {
     init_users_db();
@@ -4345,6 +4893,12 @@ var init_middleware = __esm({
     init_secret_store();
     sessionStore = /* @__PURE__ */ new Map();
     SESSION_COOKIE_NAME = "code_intel_session";
+    ROLE_RANK = {
+      viewer: 1,
+      "repo-owner": 2,
+      analyst: 3,
+      admin: 4
+    };
   }
 });
 function verifyWebSocketHandshake(req) {
@@ -4652,7 +5206,7 @@ init_shared();
 init_shared();
 init_typescript();
 function resolveRelative(rawPath, fromFile, workspace) {
-  const fromDir = path27.dirname(fromFile);
+  const fromDir = path31.dirname(fromFile);
   const cleaned = rawPath.replace(/['"]/g, "");
   const extensions = [".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.js"];
   const resolved = workspace.resolve(fromDir, cleaned);
@@ -4704,7 +5258,7 @@ var pythonModule = {
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/['"]/g, "");
     const parts = cleaned.split(".");
-    const fromDir = path27.dirname(fromFile);
+    const fromDir = path31.dirname(fromFile);
     const relPath = parts.join("/");
     for (const suffix of ["/__init__.py", ".py"]) {
       const r = workspace.resolve(fromDir, relPath + suffix);
@@ -4783,7 +5337,7 @@ var cModule = {
   inheritanceStrategy: "none",
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/[<>"']/g, "");
-    const fromDir = path27.dirname(fromFile);
+    const fromDir = path31.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(_node) {
@@ -4806,7 +5360,7 @@ var cppModule = {
   inheritanceStrategy: "depth-first",
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/[<>"']/g, "");
-    const fromDir = path27.dirname(fromFile);
+    const fromDir = path31.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(_node) {
@@ -4968,7 +5522,7 @@ var dartModule = {
       const pkg = cleaned.replace("package:", "");
       return workspace.findByPackage(pkg);
     }
-    const fromDir = path27.dirname(fromFile);
+    const fromDir = path31.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(node) {
@@ -5323,25 +5877,25 @@ function validateDAG(phases) {
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
   const phaseMap = new Map(phases.map((p) => [p.name, p]));
-  function dfs(name, path28) {
+  function dfs(name, path32) {
     if (visiting.has(name)) {
-      const cycleStart = path28.indexOf(name);
-      const cycle = path28.slice(cycleStart).concat(name);
+      const cycleStart = path32.indexOf(name);
+      const cycle = path32.slice(cycleStart).concat(name);
       errors.push({ type: "cycle", message: `Cycle detected: ${cycle.join(" \u2192 ")}` });
       return true;
     }
     if (visited.has(name)) return false;
     visiting.add(name);
-    path28.push(name);
+    path32.push(name);
     const phase = phaseMap.get(name);
     if (phase) {
       for (const dep of phase.dependencies) {
-        if (dfs(dep, path28)) return true;
+        if (dfs(dep, path32)) return true;
       }
     }
     visiting.delete(name);
     visited.add(name);
-    path28.pop();
+    path32.pop();
     return false;
   }
   for (const phase of phases) {
@@ -5554,7 +6108,7 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
 ]);
 function loadIgnorePatterns(workspaceRoot) {
   try {
-    const raw = fs19.readFileSync(path27.join(workspaceRoot, ".codeintelignore"), "utf-8");
+    const raw = fs24.readFileSync(path31.join(workspaceRoot, ".codeintelignore"), "utf-8");
     const extras = /* @__PURE__ */ new Set();
     for (const line of raw.split("\n")) {
       const trimmed = line.trim();
@@ -5578,7 +6132,7 @@ var scanPhase = {
     function walk(dir) {
       let entries;
       try {
-        entries = fs19.readdirSync(dir, { withFileTypes: true });
+        entries = fs24.readdirSync(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -5587,15 +6141,15 @@ var scanPhase = {
           if (entry.name.startsWith(".")) continue;
           if (IGNORED_DIRS.has(entry.name)) continue;
           if (extraIgnore.has(entry.name)) continue;
-          walk(path27.join(dir, entry.name));
+          walk(path31.join(dir, entry.name));
         } else if (entry.isFile()) {
           const name = entry.name;
           if (IGNORED_FILE_SUFFIXES.some((s) => name.endsWith(s))) continue;
-          const ext = path27.extname(name);
+          const ext = path31.extname(name);
           if (!extensions.has(ext)) continue;
-          const fullPath = path27.join(dir, name);
+          const fullPath = path31.join(dir, name);
           try {
-            const stat = fs19.statSync(fullPath);
+            const stat = fs24.statSync(fullPath);
             if (stat.size > MAX_FILE_SIZE_BYTES) continue;
           } catch {
             continue;
@@ -5622,20 +6176,20 @@ var structurePhase = {
     const dirs = /* @__PURE__ */ new Set();
     let structDone = 0;
     for (const filePath of context2.filePaths) {
-      const relativePath = path27.relative(context2.workspaceRoot, filePath);
+      const relativePath = path31.relative(context2.workspaceRoot, filePath);
       const lang = detectLanguage(filePath);
       context2.graph.addNode({
         id: generateNodeId("file", relativePath, relativePath),
         kind: "file",
-        name: path27.basename(filePath),
+        name: path31.basename(filePath),
         filePath: relativePath,
         metadata: lang ? { language: lang } : void 0
       });
-      let dir = path27.dirname(relativePath);
+      let dir = path31.dirname(relativePath);
       while (dir && dir !== "." && dir !== "") {
         if (dirs.has(dir)) break;
         dirs.add(dir);
-        dir = path27.dirname(dir);
+        dir = path31.dirname(dir);
       }
       structDone++;
       context2.onPhaseProgress?.("structure", structDone, context2.filePaths.length);
@@ -5644,7 +6198,7 @@ var structurePhase = {
       context2.graph.addNode({
         id: generateNodeId("directory", dir, dir),
         kind: "directory",
-        name: path27.basename(dir),
+        name: path31.basename(dir),
         filePath: dir
       });
     }
@@ -5731,9 +6285,9 @@ var flowPhase = {
     for (const node of graph.allNodes()) {
       if (!["function", "method"].includes(node.kind)) continue;
       let score = 0;
-      const hasCallers = calledNodes.has(node.id);
+      const hasCallers2 = calledNodes.has(node.id);
       const outCalls = [...graph.findEdgesFrom(node.id)].filter((e) => e.kind === "calls");
-      if (!hasCallers && outCalls.length > 0) score += 10;
+      if (!hasCallers2 && outCalls.length > 0) score += 10;
       if (node.exported) score += 5;
       if (/^(main|handle|init|start|run|execute|process|serve|listen|bootstrap)/.test(node.name)) score += 3;
       if (node.filePath.includes("test") || node.filePath.includes("spec") || node.filePath.includes("__test")) score -= 20;
@@ -5755,22 +6309,22 @@ var flowPhase = {
       const queue = [{ nodeId: ep.id, path: [ep.id] }];
       const visited = /* @__PURE__ */ new Set();
       while (queue.length > 0 && flowCount < maxFlows) {
-        const { nodeId, path: path28 } = queue.shift();
-        if (path28.length > maxDepth) continue;
+        const { nodeId, path: path32 } = queue.shift();
+        if (path32.length > maxDepth) continue;
         const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-        if (callEdges.length === 0 && path28.length >= 3) {
+        if (callEdges.length === 0 && path32.length >= 3) {
           const flowId = generateNodeId("flow", ep.filePath, `flow-${flowCount}`);
           graph.addNode({
             id: flowId,
             kind: "flow",
             name: `${ep.name} flow ${flowCount}`,
             filePath: ep.filePath,
-            metadata: { steps: path28, entryPoint: ep.name }
+            metadata: { steps: path32, entryPoint: ep.name }
           });
-          for (let i = 0; i < path28.length; i++) {
+          for (let i = 0; i < path32.length; i++) {
             graph.addEdge({
-              id: generateEdgeId(path28[i], flowId, `step_of_${i}`),
-              source: path28[i],
+              id: generateEdgeId(path32[i], flowId, `step_of_${i}`),
+              source: path32[i],
               target: flowId,
               kind: "step_of",
               weight: 1,
@@ -5783,7 +6337,7 @@ var flowPhase = {
         for (const edge of callEdges) {
           if (visited.has(edge.target)) continue;
           visited.add(edge.target);
-          queue.push({ nodeId: edge.target, path: [...path28, edge.target] });
+          queue.push({ nodeId: edge.target, path: [...path32, edge.target] });
         }
       }
     }
@@ -5801,7 +6355,7 @@ var LLMGovernanceLogger = class {
   }
   /** Path to the JSONL log file. */
   getLogPath() {
-    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path27.join(os12.homedir(), ".code-intel", "llm-governance.jsonl");
+    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path31.join(os12.homedir(), ".code-intel", "llm-governance.jsonl");
   }
   /**
    * Append an entry to the governance log.
@@ -5817,8 +6371,8 @@ var LLMGovernanceLogger = class {
         ...entry
       };
       const logPath = this.getLogPath();
-      fs19.mkdirSync(path27.dirname(logPath), { recursive: true });
-      fs19.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
+      fs24.mkdirSync(path31.dirname(logPath), { recursive: true });
+      fs24.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
     } catch {
     }
   }
@@ -5828,7 +6382,7 @@ var LLMGovernanceLogger = class {
    */
   readLog(limit = 100) {
     try {
-      const raw = fs19.readFileSync(this.getLogPath(), "utf-8");
+      const raw = fs24.readFileSync(this.getLogPath(), "utf-8");
       const lines = raw.split("\n").filter((l) => l.trim().length > 0).slice(-limit);
       return lines.map((l) => JSON.parse(l));
     } catch {
@@ -5972,17 +6526,17 @@ function traceFlow(entryId, graph, maxDepth = 10, maxBranching = 4) {
     const queue = [{ nodeId: entryId, path: [entryId] }];
     const visited = /* @__PURE__ */ new Set();
     while (queue.length > 0 && flows.length < maxFlows) {
-      const { nodeId, path: path28 } = queue.shift();
-      if (path28.length > maxDepth) continue;
+      const { nodeId, path: path32 } = queue.shift();
+      if (path32.length > maxDepth) continue;
       const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-      if (callEdges.length === 0 && path28.length >= 3) {
-        flows.push({ entryPointId: entryId, steps: [...path28] });
+      if (callEdges.length === 0 && path32.length >= 3) {
+        flows.push({ entryPointId: entryId, steps: [...path32] });
         continue;
       }
       for (const edge of callEdges) {
         if (visited.has(edge.target)) continue;
         visited.add(edge.target);
-        queue.push({ nodeId: edge.target, path: [...path28, edge.target] });
+        queue.push({ nodeId: edge.target, path: [...path32, edge.target] });
       }
     }
   }
@@ -6216,7 +6770,7 @@ init_embedder();
 async function hybridSearch(graph, query, limit, options = {}) {
   const { vectorDbPath, bm25Limit = 50, vectorLimit = 50 } = options;
   const bm25Promise = Promise.resolve(textSearch(graph, query, bm25Limit));
-  const hasVectorDb = Boolean(vectorDbPath && fs19.existsSync(vectorDbPath));
+  const hasVectorDb = Boolean(vectorDbPath && fs24.existsSync(vectorDbPath));
   if (!hasVectorDb) {
     const bm25Results2 = await bm25Promise;
     return {
@@ -6273,7 +6827,7 @@ var DbManager = class {
     this.dbPath = dbPath;
   }
   async init() {
-    fs19.mkdirSync(path27.dirname(this.dbPath), { recursive: true });
+    fs24.mkdirSync(path31.dirname(this.dbPath), { recursive: true });
     this.db = new Database(this.dbPath);
     await this.db.init();
     this.conn = new Connection(this.db);
@@ -6363,7 +6917,7 @@ function getCreateEdgeTableDDL() {
 )`];
 }
 function writeNodeCSVs(graph, outputDir) {
-  fs19.mkdirSync(outputDir, { recursive: true });
+  fs24.mkdirSync(outputDir, { recursive: true });
   const header = "id,name,file_path,start_line,end_line,exported,content,metadata\n";
   const tableBuffers = /* @__PURE__ */ new Map();
   const tableFilePaths = /* @__PURE__ */ new Map();
@@ -6371,7 +6925,7 @@ function writeNodeCSVs(graph, outputDir) {
     const table = NODE_TABLE_MAP[node.kind];
     if (!tableBuffers.has(table)) {
       tableBuffers.set(table, [header]);
-      tableFilePaths.set(table, path27.join(outputDir, `${table}.csv`));
+      tableFilePaths.set(table, path31.join(outputDir, `${table}.csv`));
     }
     tableBuffers.get(table).push(
       csvRow([
@@ -6391,12 +6945,12 @@ function writeNodeCSVs(graph, outputDir) {
     );
   }
   for (const [table, lines] of tableBuffers) {
-    fs19.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
+    fs24.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
   }
   return tableFilePaths;
 }
 function writeEdgeCSV(graph, outputDir) {
-  fs19.mkdirSync(outputDir, { recursive: true });
+  fs24.mkdirSync(outputDir, { recursive: true });
   const header = "from_id,to_id,kind,weight,label\n";
   const groups = /* @__PURE__ */ new Map();
   for (const edge of graph.allEdges()) {
@@ -6407,7 +6961,7 @@ function writeEdgeCSV(graph, outputDir) {
     const toTable = NODE_TABLE_MAP[targetNode.kind];
     const key = `${fromTable}->${toTable}`;
     if (!groups.has(key)) {
-      const filePath = path27.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
+      const filePath = path31.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
       groups.set(key, { lines: [header], from: fromTable, to: toTable, filePath });
     }
     groups.get(key).lines.push(
@@ -6422,7 +6976,7 @@ function writeEdgeCSV(graph, outputDir) {
   }
   const result = [];
   for (const group of groups.values()) {
-    fs19.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
+    fs24.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
     result.push({ fromTable: group.from, toTable: group.to, filePath: group.filePath });
   }
   return result;
@@ -6450,7 +7004,7 @@ async function loadGraphToDB(graph, dbManager) {
     } catch {
     }
   }
-  const tmpDir = fs19.mkdtempSync(path27.join(os12.tmpdir(), "code-intel-csv-"));
+  const tmpDir = fs24.mkdtempSync(path31.join(os12.tmpdir(), "code-intel-csv-"));
   try {
     const nodeTableFiles = writeNodeCSVs(graph, tmpDir);
     const edgeGroups = writeEdgeCSV(graph, tmpDir);
@@ -6469,8 +7023,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let nodeCount = 0;
     for (const [table, csvPath] of nodeTableFiles) {
-      if (!fs19.existsSync(csvPath)) continue;
-      const stat = fs19.statSync(csvPath);
+      if (!fs24.existsSync(csvPath)) continue;
+      const stat = fs24.statSync(csvPath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -6483,8 +7037,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let edgeCount = 0;
     for (const group of edgeGroups) {
-      if (!fs19.existsSync(group.filePath)) continue;
-      const stat = fs19.statSync(group.filePath);
+      if (!fs24.existsSync(group.filePath)) continue;
+      const stat = fs24.statSync(group.filePath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -6498,7 +7052,7 @@ async function loadGraphToDB(graph, dbManager) {
     return { nodeCount, edgeCount };
   } finally {
     try {
-      fs19.rmSync(tmpDir, { recursive: true, force: true });
+      fs24.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -6550,19 +7104,19 @@ function buildNodeProps(node) {
 function escCypher(s) {
   return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "");
 }
-var GLOBAL_DIR = path27.join(os12.homedir(), ".code-intel");
-var REPOS_FILE = path27.join(GLOBAL_DIR, "repos.json");
+var GLOBAL_DIR = path31.join(os12.homedir(), ".code-intel");
+var REPOS_FILE = path31.join(GLOBAL_DIR, "repos.json");
 function loadRegistry() {
   try {
-    const data = fs19.readFileSync(REPOS_FILE, "utf-8");
+    const data = fs24.readFileSync(REPOS_FILE, "utf-8");
     return JSON.parse(data);
   } catch {
     return [];
   }
 }
 function saveRegistry(entries) {
-  fs19.mkdirSync(GLOBAL_DIR, { recursive: true });
-  fs19.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
+  fs24.mkdirSync(GLOBAL_DIR, { recursive: true });
+  fs24.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
 }
 function upsertRepo(entry) {
   const entries = loadRegistry();
@@ -6579,23 +7133,23 @@ function removeRepo(repoPath) {
   saveRegistry(entries);
 }
 function saveMetadata(repoDir, metadata) {
-  const metaDir = path27.join(repoDir, ".code-intel");
-  fs19.mkdirSync(metaDir, { recursive: true });
-  fs19.writeFileSync(path27.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
+  const metaDir = path31.join(repoDir, ".code-intel");
+  fs24.mkdirSync(metaDir, { recursive: true });
+  fs24.writeFileSync(path31.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
 }
 function loadMetadata(repoDir) {
   try {
-    const data = fs19.readFileSync(path27.join(repoDir, ".code-intel", "meta.json"), "utf-8");
+    const data = fs24.readFileSync(path31.join(repoDir, ".code-intel", "meta.json"), "utf-8");
     return JSON.parse(data);
   } catch {
     return null;
   }
 }
 function getDbPath(repoDir) {
-  return path27.join(repoDir, ".code-intel", "graph.db");
+  return path31.join(repoDir, ".code-intel", "graph.db");
 }
 function getVectorDbPath(repoDir) {
-  return path27.join(repoDir, ".code-intel", "vector.db");
+  return path31.join(repoDir, ".code-intel", "vector.db");
 }
 
 // src/mcp-server/server.ts
@@ -6673,6 +7227,205 @@ async function loadGraphFromDB(graph, db) {
 
 // src/multi-repo/group-sync.ts
 init_logger();
+function scanForFiles(root, matcher, maxDepth = 2) {
+  const results = [];
+  function walk(dir, depth) {
+    if (depth > maxDepth) return;
+    let entries;
+    try {
+      entries = fs24.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path31.join(dir, entry.name);
+      if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
+        walk(full, depth + 1);
+      } else if (entry.isFile() && matcher(entry.name)) {
+        results.push(full);
+      }
+    }
+  }
+  walk(root, 0);
+  return results;
+}
+
+// src/multi-repo/schema-parsers/openapi-parser.ts
+var OPENAPI_FILENAMES = /* @__PURE__ */ new Set([
+  "openapi.yaml",
+  "openapi.json",
+  "openapi.yml",
+  "swagger.yaml",
+  "swagger.json",
+  "swagger.yml"
+]);
+var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options"];
+function tryParseFile(filePath) {
+  const ext = path31.extname(filePath).toLowerCase();
+  const content = fs24.readFileSync(filePath, "utf-8");
+  if (ext === ".json") {
+    try {
+      return JSON.parse(content);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+async function parseOpenAPIContracts(repoRoot) {
+  const files = scanForFiles(repoRoot, (name) => OPENAPI_FILENAMES.has(name));
+  const contracts = [];
+  for (const filePath of files) {
+    const spec = tryParseFile(filePath);
+    if (!spec) continue;
+    const paths = spec["paths"];
+    if (!paths || typeof paths !== "object") continue;
+    for (const [pathStr, pathItem] of Object.entries(paths)) {
+      if (!pathItem || typeof pathItem !== "object") continue;
+      const ops = pathItem;
+      for (const method of HTTP_METHODS) {
+        if (!(method in ops)) continue;
+        const operation = ops[method];
+        if (!operation) continue;
+        const requestBody = operation["requestBody"];
+        const requestSchema = requestBody?.["content"] ? requestBody["content"]["application/json"]?.["schema"] : void 0;
+        const responses = operation["responses"];
+        const ok200 = responses?.["200"];
+        const responseSchema = ok200?.["content"] ? ok200["content"]["application/json"]?.["schema"] : void 0;
+        contracts.push({
+          name: `${method.toUpperCase()} ${pathStr}`,
+          kind: "route",
+          method: method.toUpperCase(),
+          path: pathStr,
+          ...requestSchema ? { requestSchema } : {},
+          ...responseSchema ? { responseSchema } : {},
+          filePath
+        });
+      }
+    }
+  }
+  return contracts;
+}
+function extractFieldNames(block) {
+  return block.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => {
+    const m = line.match(/^(\w+)\s*[(:]/);
+    return m ? m[1] : null;
+  }).filter((f) => f !== null);
+}
+async function parseGraphQLContracts(repoRoot) {
+  const files = scanForFiles(repoRoot, (name) => name.endsWith(".graphql") || name.endsWith(".gql"));
+  const contracts = [];
+  for (const filePath of files) {
+    const content = fs24.readFileSync(filePath, "utf-8");
+    const typeRegex = /type\s+(\w+)\s*\{([^}]+)\}/g;
+    let match;
+    while ((match = typeRegex.exec(content)) !== null) {
+      const typeName = match[1];
+      const body = match[2];
+      const fields = extractFieldNames(body);
+      const lcName = typeName.toLowerCase();
+      if (lcName === "query") {
+        for (const field of fields) {
+          contracts.push({ name: `query.${field}`, kind: "graphql", operation: "query", fields, filePath });
+        }
+      } else if (lcName === "mutation") {
+        for (const field of fields) {
+          contracts.push({ name: `mutation.${field}`, kind: "graphql", operation: "mutation", fields, filePath });
+        }
+      } else if (lcName === "subscription") {
+        for (const field of fields) {
+          contracts.push({ name: `subscription.${field}`, kind: "graphql", operation: "subscription", fields, filePath });
+        }
+      } else {
+        contracts.push({ name: `type.${typeName}`, kind: "graphql", operation: "type", fields, filePath });
+      }
+    }
+  }
+  return contracts;
+}
+async function parseProtoContracts(repoRoot) {
+  const files = scanForFiles(repoRoot, (name) => name.endsWith(".proto"));
+  const contracts = [];
+  for (const filePath of files) {
+    const content = fs24.readFileSync(filePath, "utf-8");
+    const serviceRegex = /service\s+(\w+)\s*\{([^}]+)\}/g;
+    let serviceMatch;
+    while ((serviceMatch = serviceRegex.exec(content)) !== null) {
+      const serviceName = serviceMatch[1];
+      const body = serviceMatch[2];
+      const rpcRegex = /rpc\s+(\w+)\s*\((\w+)\)\s*returns\s*\((\w+)\)/g;
+      let rpcMatch;
+      while ((rpcMatch = rpcRegex.exec(body)) !== null) {
+        const rpcName = rpcMatch[1];
+        const inputType = rpcMatch[2];
+        const outputType = rpcMatch[3];
+        contracts.push({
+          name: `${serviceName}.${rpcName}`,
+          kind: "grpc",
+          serviceName,
+          rpcName,
+          inputType,
+          outputType,
+          filePath
+        });
+      }
+    }
+  }
+  return contracts;
+}
+
+// src/multi-repo/type-similarity.ts
+function normalizeType(t) {
+  return t.toLowerCase().replace(/[\[\]?<>\s]/g, "").trim();
+}
+function paramTypeSimilarity(paramsA, paramsB) {
+  if (paramsA.length === 0 && paramsB.length === 0) return 1;
+  if (paramsA.length === 0 || paramsB.length === 0) return 0;
+  const setA = new Set(paramsA.map((p) => normalizeType(p.type ?? "")).filter(Boolean));
+  const setB = new Set(paramsB.map((p) => normalizeType(p.type ?? "")).filter(Boolean));
+  if (setA.size === 0 && setB.size === 0) return 1;
+  if (setA.size === 0 || setB.size === 0) return 0;
+  const intersection = [...setA].filter((x) => setB.has(x)).length;
+  const union = (/* @__PURE__ */ new Set([...setA, ...setB])).size;
+  return intersection / union;
+}
+function returnTypeSimilarity(typeA, typeB) {
+  if (!typeA || !typeB) return 0.5;
+  const a = normalizeType(typeA);
+  const b = normalizeType(typeB);
+  if (a === b) return 1;
+  const compatible = [
+    ["string", "str"],
+    ["number", "int"],
+    ["number", "float"],
+    ["number", "double"],
+    ["boolean", "bool"],
+    ["void", "unit"],
+    ["void", "none"]
+  ];
+  for (const [x, y] of compatible) {
+    if (a === x && b === y || a === y && b === x) return 0.8;
+  }
+  return 0;
+}
+function paramCountSimilarity(countA, countB) {
+  const maxCount = Math.max(countA, countB, 1);
+  return 1 - Math.abs(countA - countB) / maxCount;
+}
+function computeContractSimilarity(a, b, nameSim) {
+  const paramsA = a.parameters ?? [];
+  const paramsB = b.parameters ?? [];
+  const ptSim = paramTypeSimilarity(paramsA, paramsB);
+  const rtSim = returnTypeSimilarity(a.returnType, b.returnType);
+  const pcSim = paramCountSimilarity(paramsA.length, paramsB.length);
+  let score = 0.4 * nameSim + 0.3 * ptSim + 0.2 * rtSim + 0.1 * pcSim;
+  if (ptSim > 0.8) {
+    score = Math.min(1, score * 1.2);
+  }
+  return score;
+}
+
+// src/multi-repo/group-sync.ts
 function extractContracts(graph, repoName, repoPath) {
   const contracts = [];
   for (const node of graph.allNodes()) {
@@ -6685,7 +7438,10 @@ function extractContracts(graph, repoName, repoPath) {
         nodeId: node.id,
         nodeKind: node.kind,
         filePath: node.filePath,
-        signature: node.content?.split("\n")[0]?.trim()
+        signature: node.content?.split("\n")[0]?.trim(),
+        parameters: node.metadata?.parameters ?? node.metadata?.params,
+        returnType: node.metadata?.returnType,
+        exported: node.exported
       });
     }
     if (node.kind === "route") {
@@ -6747,13 +7503,15 @@ function matchContracts(allContracts) {
         const consumer = consumerByName.get(provider.name);
         if (consumer) {
           const sameKind = provider.kind === consumer.kind;
+          const typedScore = computeContractSimilarity(provider, consumer, 1);
+          const confidence = sameKind ? Math.max(typedScore, 0.9) : Math.max(typedScore, 0.6);
           links.push({
             providerRepo: provider.repoName,
             providerContract: provider.name,
             consumerRepo: consumer.repoName,
             consumerContract: consumer.name,
             matchKind: provider.kind === "route" ? "route-match" : "name-match",
-            confidence: sameKind ? 0.9 : 0.6
+            confidence: Math.min(1, confidence)
           });
         } else {
           const providerLC = provider.name.toLowerCase();
@@ -6794,8 +7552,8 @@ async function syncGroup(group) {
       logger_default.warn(`  \u26A0 Registry entry "${member.registryName}" not found \u2014 skipping ${member.groupPath}`);
       continue;
     }
-    const dbPath = path27.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs19.existsSync(dbPath)) {
+    const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs24.existsSync(dbPath)) {
       logger_default.warn(`  \u26A0 No index at ${dbPath} \u2014 run \`code-intel analyze ${regEntry.path}\` first`);
       continue;
     }
@@ -6811,6 +7569,44 @@ async function syncGroup(group) {
       continue;
     }
     const contracts = extractContracts(graph, member.registryName, regEntry.path);
+    const [openapiContracts, graphqlContracts, protoContracts] = await Promise.all([
+      parseOpenAPIContracts(regEntry.path).catch(() => []),
+      parseGraphQLContracts(regEntry.path).catch(() => []),
+      parseProtoContracts(regEntry.path).catch(() => [])
+    ]);
+    for (const c of openapiContracts) {
+      contracts.push({
+        repoName: member.registryName,
+        repoPath: regEntry.path,
+        kind: "route",
+        name: c.name,
+        nodeId: `openapi:${c.method}:${c.path}`,
+        nodeKind: "route",
+        filePath: c.filePath
+      });
+    }
+    for (const c of graphqlContracts) {
+      contracts.push({
+        repoName: member.registryName,
+        repoPath: regEntry.path,
+        kind: "graphql",
+        name: c.name,
+        nodeId: `graphql:${c.name}`,
+        nodeKind: "graphql",
+        filePath: c.filePath
+      });
+    }
+    for (const c of protoContracts) {
+      contracts.push({
+        repoName: member.registryName,
+        repoPath: regEntry.path,
+        kind: "grpc",
+        name: c.name,
+        nodeId: `grpc:${c.serviceName}:${c.rpcName}`,
+        nodeKind: "grpc",
+        filePath: c.filePath
+      });
+    }
     logger_default.info(`  \u2713 ${member.registryName} (${member.groupPath}): ${contracts.length} contracts`);
     allContracts.push(...contracts);
   }
@@ -6830,8 +7626,8 @@ async function queryGroup(group, query, limit = 20) {
   for (const member of group.members) {
     const regEntry = registry.find((r) => r.name === member.registryName);
     if (!regEntry) continue;
-    const dbPath = path27.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs19.existsSync(dbPath)) continue;
+    const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs24.existsSync(dbPath)) continue;
     const graph = createKnowledgeGraph();
     const db = new DbManager(dbPath);
     try {
@@ -7331,22 +8127,22 @@ function suggestTests(graph, symbolName) {
   const callPaths = [];
   const pathQueue = [{ id: targetId, path: [symbolName], depth: 0 }];
   while (pathQueue.length > 0 && callPaths.length < 5) {
-    const { id, path: path28, depth } = pathQueue.shift();
-    let hasCallers = false;
+    const { id, path: path32, depth } = pathQueue.shift();
+    let hasCallers2 = false;
     for (const edge of graph.findEdgesTo(id)) {
       if (edge.kind !== "calls") continue;
       const callerNode = graph.getNode(edge.source);
       if (!callerNode) continue;
-      hasCallers = true;
-      const newPath = [callerNode.name, ...path28];
+      hasCallers2 = true;
+      const newPath = [callerNode.name, ...path32];
       if (depth + 1 >= 3 || callPaths.length >= 5) {
         if (callPaths.length < 5) callPaths.push(newPath);
         continue;
       }
       pathQueue.push({ id: edge.source, path: newPath, depth: depth + 1 });
     }
-    if (!hasCallers && path28.length > 1) {
-      callPaths.push(path28);
+    if (!hasCallers2 && path32.length > 1) {
+      callPaths.push(path32);
     }
   }
   if (callPaths.length === 0) {
@@ -7821,6 +8617,70 @@ function createMcpServer(graph, repoName, workspaceRoot) {
           },
           required: ["cluster"]
         }
+      },
+      {
+        name: "deprecated_usage",
+        description: "Find usages of deprecated APIs in the codebase",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Directory scope filter" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "complexity_hotspots",
+        description: "Ranked list of functions/methods by cyclomatic complexity. Useful for identifying refactoring candidates.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit to a file path prefix (optional)" },
+            limit: { type: "number", description: "Maximum number of results (default: 20)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "coverage_gaps",
+        description: "Find exported symbols with no test coverage, ranked by blast radius. Useful for prioritizing test writing.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit to a file path prefix (optional)" },
+            limit: { type: "number", description: "Maximum number of untested results to return (default: 20)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "secrets",
+        description: "Scan the knowledge graph for hardcoded secrets: API keys, passwords, tokens, private keys, high-entropy strings",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit scan to files under this path prefix" },
+            includeTestFiles: { type: "boolean", description: "Include test/spec/fixture files (default: false)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "vulnerability_scan",
+        description: "Scan the knowledge graph for OWASP vulnerabilities: SQL injection, XSS, SSRF, path traversal, command injection",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit scan to files under this path prefix" },
+            types: {
+              type: "array",
+              items: { type: "string", enum: ["SQL_INJECTION", "XSS", "SSRF", "PATH_TRAVERSAL", "COMMAND_INJECTION"] },
+              description: "Vulnerability types to detect (default: all)"
+            },
+            severity: { type: "string", description: "Minimum severity to report: HIGH|MEDIUM|LOW (default: LOW)" },
+            ..._tokenProp
+          }
+        }
       }
     ]
   }));
@@ -8244,7 +9104,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       for (const { filePath: changedFile, changedLines } of changedFiles) {
         for (const node of graph.allNodes()) {
           if (!node.filePath) continue;
-          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path27.sep, "");
+          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path31.sep, "");
           const normChanged = changedFile.replace(/^a\/|^b\//, "");
           if (!normNode.endsWith(normChanged) && !normChanged.endsWith(normNode)) continue;
           if (node.startLine !== void 0 && node.endLine !== void 0) {
@@ -8517,6 +9377,63 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       const result = summarizeCluster(graph, cluster);
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
+    case "deprecated_usage": {
+      const scope = a.scope;
+      const { DeprecatedDetector: DeprecatedDetector2 } = await Promise.resolve().then(() => (init_deprecated_detector(), deprecated_detector_exports));
+      const detector = new DeprecatedDetector2();
+      detector.tagDeprecated(graph);
+      const findings = detector.detect(graph, scope);
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
+    // ── complexity_hotspots ────────────────────────────────────────────────
+    case "complexity_hotspots": {
+      const { computeComplexity: computeComplexity2 } = await Promise.resolve().then(() => (init_complexity(), complexity_exports));
+      const scope = a.scope;
+      const limit = typeof a.limit === "number" ? a.limit : 20;
+      const hotspots = computeComplexity2(graph, scope).slice(0, limit);
+      return { content: [{ type: "text", text: JSON.stringify({ hotspots, total: hotspots.length }, null, 2) }] };
+    }
+    // ── coverage_gaps ──────────────────────────────────────────────────────
+    case "coverage_gaps": {
+      const { computeCoverage: computeCoverage2 } = await Promise.resolve().then(() => (init_test_coverage(), test_coverage_exports));
+      const scope = a.scope;
+      const limit = typeof a.limit === "number" ? a.limit : 20;
+      const summary = computeCoverage2(graph, scope);
+      const untestedByRisk = summary.untestedByRisk.slice(0, limit);
+      return {
+        content: [{
+          type: "text",
+          text: JSON.stringify({
+            untestedByRisk,
+            coveragePct: summary.coveragePct,
+            totalExported: summary.totalExported,
+            testedExported: summary.testedExported
+          }, null, 2)
+        }]
+      };
+    }
+    // ── secrets ────────────────────────────────────────────────────────────
+    case "secrets": {
+      const { SecretScanner: SecretScanner2 } = await Promise.resolve().then(() => (init_secret_scanner(), secret_scanner_exports));
+      const scanner = new SecretScanner2();
+      const scope = a.scope;
+      const includeTestFiles = a.includeTestFiles ?? false;
+      const findings = scanner.scan(graph, { scope, includeTestFiles });
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
+    // ── vulnerability_scan ─────────────────────────────────────────────────
+    case "vulnerability_scan": {
+      const { VulnerabilityDetector: VulnerabilityDetector2 } = await Promise.resolve().then(() => (init_vulnerability_detector(), vulnerability_detector_exports));
+      const detector = new VulnerabilityDetector2();
+      const scope = a.scope;
+      const types = a.types;
+      const minSev = (a.severity ?? "LOW").toUpperCase();
+      const sevRank = { HIGH: 3, MEDIUM: 2, LOW: 1 };
+      const minRank = sevRank[minSev] ?? 1;
+      let findings = detector.detect(graph, { scope, types });
+      findings = findings.filter((f) => (sevRank[f.severity] ?? 1) >= minRank);
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
     default:
       return { content: [{ type: "text", text: `Unknown tool: ${name}` }] };
   }
@@ -8610,7 +9527,7 @@ var STUCK_THRESHOLD_MINUTES = 30;
 var JobsDB = class {
   db;
   constructor(dbPath) {
-    fs19.mkdirSync(path27.dirname(dbPath), { recursive: true });
+    fs24.mkdirSync(path31.dirname(dbPath), { recursive: true });
     this.db = new Database3(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("foreign_keys = ON");
@@ -8752,7 +9669,7 @@ var JobsDB = class {
   }
 };
 function getJobsDBPath() {
-  return path27.join(os12.homedir(), ".code-intel", "jobs.db");
+  return path31.join(os12.homedir(), ".code-intel", "jobs.db");
 }
 var _jobsDB = null;
 function getOrCreateJobsDB() {
@@ -8844,7 +9761,7 @@ var BACKUP_VERSION = "1.0";
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 function getBackupDir() {
-  return path27.join(os12.homedir(), ".code-intel", "backups");
+  return path31.join(os12.homedir(), ".code-intel", "backups");
 }
 function getBackupKey() {
   const keyHex = process.env["CODE_INTEL_BACKUP_KEY"];
@@ -8875,30 +9792,30 @@ var BackupService = class {
   constructor(backupDir) {
     this.backupDir = backupDir ?? getBackupDir();
     this.key = getBackupKey();
-    fs19.mkdirSync(this.backupDir, { recursive: true });
+    fs24.mkdirSync(this.backupDir, { recursive: true });
   }
   /**
    * Create a backup for a repository.
    * Returns the backup entry.
    */
   createBackup(repoPath) {
-    const codeIntelDir = path27.join(repoPath, ".code-intel");
+    const codeIntelDir = path31.join(repoPath, ".code-intel");
     const id = v4();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
     const filesToBackup = [];
     const candidates = ["graph.db", "vector.db", "meta.json"];
     for (const f of candidates) {
-      const fp = path27.join(codeIntelDir, f);
-      if (fs19.existsSync(fp)) {
+      const fp = path31.join(codeIntelDir, f);
+      if (fs24.existsSync(fp)) {
         filesToBackup.push({ name: f, localPath: fp });
       }
     }
-    const registryPath = path27.join(os12.homedir(), ".code-intel", "registry.json");
-    if (fs19.existsSync(registryPath)) {
+    const registryPath = path31.join(os12.homedir(), ".code-intel", "registry.json");
+    if (fs24.existsSync(registryPath)) {
       filesToBackup.push({ name: "registry.json", localPath: registryPath });
     }
-    const usersDbPath = path27.join(os12.homedir(), ".code-intel", "users.db");
-    if (fs19.existsSync(usersDbPath)) {
+    const usersDbPath = path31.join(os12.homedir(), ".code-intel", "users.db");
+    if (fs24.existsSync(usersDbPath)) {
       filesToBackup.push({ name: "users.db", localPath: usersDbPath });
     }
     if (filesToBackup.length === 0) {
@@ -8909,7 +9826,7 @@ var BackupService = class {
       createdAt,
       version: BACKUP_VERSION,
       files: filesToBackup.map((f) => {
-        const data = fs19.readFileSync(f.localPath);
+        const data = fs24.readFileSync(f.localPath);
         return {
           name: f.name,
           sha256: crypto5.createHash("sha256").update(data).digest("hex"),
@@ -8923,7 +9840,7 @@ var BackupService = class {
     manifestLenBuf.writeUInt32BE(manifestBuf.length, 0);
     parts.push(manifestLenBuf, manifestBuf);
     for (const f of filesToBackup) {
-      const data = fs19.readFileSync(f.localPath);
+      const data = fs24.readFileSync(f.localPath);
       const nameBuf = Buffer.from(f.name, "utf-8");
       const nameLenBuf = Buffer.alloc(2);
       nameLenBuf.writeUInt16BE(nameBuf.length, 0);
@@ -8934,8 +9851,8 @@ var BackupService = class {
     const plaintext = Buffer.concat(parts);
     const encrypted = encryptBuffer(plaintext, this.key);
     const backupFileName = `backup-${id}.cib`;
-    const backupPath = path27.join(this.backupDir, backupFileName);
-    fs19.writeFileSync(backupPath, encrypted);
+    const backupPath = path31.join(this.backupDir, backupFileName);
+    fs24.writeFileSync(backupPath, encrypted);
     const entry = {
       id,
       createdAt,
@@ -8962,9 +9879,9 @@ var BackupService = class {
   async uploadToS3(entry) {
     const cfg = getS3Config();
     if (!cfg) throw new Error("S3 not configured. Set CODE_INTEL_BACKUP_S3_BUCKET, CODE_INTEL_BACKUP_S3_ACCESS_KEY_ID, CODE_INTEL_BACKUP_S3_SECRET_ACCESS_KEY.");
-    const fileName = path27.basename(entry.path);
+    const fileName = path31.basename(entry.path);
     const s3Key = `${cfg.prefix}${fileName}`;
-    const body = fs19.readFileSync(entry.path);
+    const body = fs24.readFileSync(entry.path);
     const result = await s3Request({ method: "PUT", cfg, key: s3Key, body });
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 upload failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
@@ -8981,8 +9898,8 @@ var BackupService = class {
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 download failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
     }
-    fs19.mkdirSync(path27.dirname(destPath), { recursive: true });
-    fs19.writeFileSync(destPath, Buffer.from(result.body, "binary"));
+    fs24.mkdirSync(path31.dirname(destPath), { recursive: true });
+    fs24.writeFileSync(destPath, Buffer.from(result.body, "binary"));
   }
   /**
    * List backup objects in S3 with the configured prefix.
@@ -9028,10 +9945,10 @@ var BackupService = class {
     if (!entry) {
       throw new Error(`Backup "${backupId}" not found.`);
     }
-    if (!fs19.existsSync(entry.path)) {
+    if (!fs24.existsSync(entry.path)) {
       throw new Error(`Backup file not found at: ${entry.path}`);
     }
-    const encrypted = fs19.readFileSync(entry.path);
+    const encrypted = fs24.readFileSync(entry.path);
     let plaintext;
     try {
       plaintext = decryptBuffer(encrypted, this.key);
@@ -9045,8 +9962,8 @@ var BackupService = class {
     offset += manifestLen;
     const manifest = JSON.parse(manifestStr);
     const restoreBase = targetRepoPath ?? entry.repoPath;
-    const codeIntelDir = path27.join(restoreBase, ".code-intel");
-    fs19.mkdirSync(codeIntelDir, { recursive: true });
+    const codeIntelDir = path31.join(restoreBase, ".code-intel");
+    fs24.mkdirSync(codeIntelDir, { recursive: true });
     for (const fileEntry of manifest.files) {
       const nameLen = plaintext.readUInt16BE(offset);
       offset += 2;
@@ -9063,18 +9980,18 @@ var BackupService = class {
       }
       let destPath;
       if (name === "registry.json" || name === "users.db") {
-        destPath = path27.join(os12.homedir(), ".code-intel", name);
+        destPath = path31.join(os12.homedir(), ".code-intel", name);
       } else {
-        destPath = path27.join(codeIntelDir, name);
+        destPath = path31.join(codeIntelDir, name);
       }
-      fs19.writeFileSync(destPath, data);
+      fs24.writeFileSync(destPath, data);
     }
   }
   /**
    * Apply retention policy: keep N daily, M weekly, L monthly backups.
    */
   applyRetention(options = { daily: 7, weekly: 4, monthly: 12 }) {
-    const entries = this._loadIndex().filter((e) => fs19.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    const entries = this._loadIndex().filter((e) => fs24.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
     const keep = /* @__PURE__ */ new Set();
     const now = /* @__PURE__ */ new Date();
     const dailyCutoff = new Date(now);
@@ -9104,7 +10021,7 @@ var BackupService = class {
     for (const e of entries) {
       if (!keep.has(e.id)) {
         try {
-          fs19.unlinkSync(e.path);
+          fs24.unlinkSync(e.path);
           deleted++;
         } catch {
         }
@@ -9116,17 +10033,17 @@ var BackupService = class {
   }
   // ── Index helpers ──────────────────────────────────────────────────────────
   _indexPath() {
-    return path27.join(this.backupDir, "index.json");
+    return path31.join(this.backupDir, "index.json");
   }
   _loadIndex() {
     try {
-      return JSON.parse(fs19.readFileSync(this._indexPath(), "utf-8"));
+      return JSON.parse(fs24.readFileSync(this._indexPath(), "utf-8"));
     } catch {
       return [];
     }
   }
   _saveIndex(entries) {
-    fs19.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
+    fs24.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
   }
   _appendIndex(entry) {
     const entries = this._loadIndex();
@@ -9785,6 +10702,30 @@ var openApiSpec = {
         }
       }
     },
+    "/groups/{name}/topology": {
+      get: {
+        tags: ["Groups"],
+        summary: "Get the topology of repos and cross-repo contract edges for a group",
+        parameters: [{ name: "name", in: "path", required: true, schema: { type: "string" } }],
+        responses: {
+          "200": {
+            description: "Repos and cross-repo edges",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    repos: { type: "array", items: { type: "object", properties: { name: { type: "string" }, groupPath: { type: "string" }, nodeCount: { type: "integer" }, edgeCount: { type: "integer" } } } },
+                    edges: { type: "array", items: { type: "object", properties: { source: { type: "string" }, target: { type: "string" }, contractName: { type: "string" }, confidence: { type: "number" }, kind: { type: "string" } } } }
+                  }
+                }
+              }
+            }
+          },
+          "404": { description: "Group not found", content: { "application/json": { schema: { "$ref": "#/components/schemas/ErrorResponse" } } } }
+        }
+      }
+    },
     "/query": {
       post: {
         tags: ["GQL"],
@@ -9895,11 +10836,11 @@ var openApiSpec = {
 };
 
 // src/http/app.ts
-var __dirname$1 = path27.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path31.dirname(fileURLToPath(import.meta.url));
 var WEB_DIST = (() => {
-  const bundled = path27.resolve(__dirname$1, "..", "web");
-  if (fs19.existsSync(bundled)) return bundled;
-  return path27.resolve(__dirname$1, "..", "..", "..", "web", "dist");
+  const bundled = path31.resolve(__dirname$1, "..", "web");
+  if (fs24.existsSync(bundled)) return bundled;
+  return path31.resolve(__dirname$1, "..", "..", "..", "web", "dist");
 })();
 function getAllowedOrigins() {
   const env = process.env["CODE_INTEL_CORS_ORIGINS"];
@@ -10430,8 +11371,8 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const registry = loadRegistry();
     const entry = registry.find((r) => r.name === requestedRepo || r.path === requestedRepo);
     if (!entry) return null;
-    const dbPath = path27.join(entry.path, ".code-intel", "graph.db");
-    if (!fs19.existsSync(dbPath)) return null;
+    const dbPath = path31.join(entry.path, ".code-intel", "graph.db");
+    if (!fs24.existsSync(dbPath)) return null;
     const repoGraph = createKnowledgeGraph();
     const db = new DbManager(dbPath);
     try {
@@ -10518,7 +11459,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       return;
     }
     try {
-      const content = fs19.readFileSync(file_path, "utf-8");
+      const content = fs24.readFileSync(file_path, "utf-8");
       res.json({ content });
     } catch {
       res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: "File not found" } });
@@ -10776,8 +11717,8 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     for (const member of group.members) {
       const regEntry = registry.find((r) => r.name === member.registryName);
       if (!regEntry) continue;
-      const dbPath = path27.join(regEntry.path, ".code-intel", "graph.db");
-      if (!fs19.existsSync(dbPath)) continue;
+      const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
+      if (!fs24.existsSync(dbPath)) continue;
       const db = new DbManager(dbPath);
       try {
         await db.init();
@@ -10789,6 +11730,45 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     }
     res.json({ nodes: [...mergedGraph.allNodes()], edges: [...mergedGraph.allEdges()] });
   });
+  app.get("/api/v1/groups/:name/topology", requireAuth, requireRole("viewer"), async (req, res) => {
+    const groupName = req.params["name"];
+    const group = loadGroup(groupName);
+    if (!group) {
+      res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: "Group not found" } });
+      return;
+    }
+    const syncResult = loadSyncResult(groupName);
+    const registry = loadRegistry();
+    const repos = await Promise.all(group.members.map(async (member) => {
+      const regEntry = registry.find((r) => r.name === member.registryName);
+      let nodeCount = 0;
+      let edgeCount = 0;
+      if (regEntry) {
+        const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
+        if (fs24.existsSync(dbPath)) {
+          try {
+            const db = new DbManager(dbPath);
+            await db.init();
+            const g = createKnowledgeGraph();
+            await loadGraphFromDB(g, db);
+            db.close();
+            nodeCount = g.size.nodes;
+            edgeCount = g.size.edges;
+          } catch {
+          }
+        }
+      }
+      return { name: member.registryName, groupPath: member.groupPath, nodeCount, edgeCount };
+    }));
+    const edges = syncResult ? syncResult.links.map((link) => ({
+      source: link.providerRepo,
+      target: link.consumerRepo,
+      contractName: link.providerContract,
+      confidence: link.confidence,
+      kind: "contract"
+    })) : [];
+    res.json({ repos, edges });
+  });
   app.get("/api/v1/source", requireAuth, requireRole("viewer"), (req, res) => {
     const { file, startLine: startLineStr, endLine: endLineStr } = req.query;
     if (!file) {
@@ -10814,14 +11794,14 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       });
       return;
     }
-    let rawResolved = path27.normalize(file);
-    if (!path27.isAbsolute(rawResolved) && workspaceRoot) {
-      rawResolved = path27.join(workspaceRoot, rawResolved);
+    let rawResolved = path31.normalize(file);
+    if (!path31.isAbsolute(rawResolved) && workspaceRoot) {
+      rawResolved = path31.join(workspaceRoot, rawResolved);
     }
-    const resolvedFile = path27.resolve(rawResolved);
+    const resolvedFile = path31.resolve(rawResolved);
     function isInsideDir(fileAbs, dir) {
-      const rel = path27.relative(path27.resolve(dir), fileAbs);
-      return !rel.startsWith("..") && !path27.isAbsolute(rel);
+      const rel = path31.relative(path31.resolve(dir), fileAbs);
+      return !rel.startsWith("..") && !path31.isAbsolute(rel);
     }
     if (workspaceRoot) {
       if (!isInsideDir(resolvedFile, workspaceRoot)) {
@@ -10858,7 +11838,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     }
     let fileContent;
     try {
-      fileContent = fs19.readFileSync(resolvedFile, "utf-8");
+      fileContent = fs24.readFileSync(resolvedFile, "utf-8");
     } catch {
       res.status(404).json({
         error: {
@@ -10889,7 +11869,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const contextStart = Math.max(1, startLine - 20);
     const contextEnd = Math.min(lines.length, endLine + 20);
     const content = lines.slice(contextStart - 1, contextEnd).join("\n");
-    const ext = path27.extname(resolvedFile).toLowerCase();
+    const ext = path31.extname(resolvedFile).toLowerCase();
     const languageMap = {
       ".ts": "typescript",
       ".tsx": "typescript",
@@ -11024,10 +12004,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       res.status(500).json({ error: { code: ErrorCodes.INTERNAL_ERROR, message: err instanceof Error ? err.message : String(err), requestId: req.requestId, timestamp: (/* @__PURE__ */ new Date()).toISOString() } });
     }
   });
-  if (fs19.existsSync(WEB_DIST)) {
+  if (fs24.existsSync(WEB_DIST)) {
     app.use(express.static(WEB_DIST));
     app.get("/{*path}", (_req, res) => {
-      res.sendFile(path27.join(WEB_DIST, "index.html"));
+      res.sendFile(path31.join(WEB_DIST, "index.html"));
     });
   }
   app.use("/admin", requireRole("admin"));