@vohongtho.infotech/code-intel 0.7.0 → 0.9.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { createRequire } from 'module';
 import { fileURLToPath } from 'url';
-import path29 from 'path';
-import fs23, { existsSync } from 'fs';
+import path31 from 'path';
+import fs24, { existsSync } from 'fs';
 import { Parser, Language, Query } from 'web-tree-sitter';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
@@ -11,7 +11,8 @@ import { SEMRESATTRS_DEPLOYMENT_ENVIRONMENT, SEMRESATTRS_SERVICE_NAME } from '@o
 import { trace, context, SpanStatusCode } from '@opentelemetry/api';
 import winston from 'winston';
 import DailyRotateFile from 'winston-daily-rotate-file';
-import os12 from 'os';
+import os13 from 'os';
+import { execSync } from 'child_process';
 import Database3 from 'better-sqlite3';
 import bcrypt from 'bcrypt';
 import crypto5 from 'crypto';
@@ -24,7 +25,6 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { Database, Connection } from '@ladybugdb/core';
-import { execSync } from 'child_process';
 import express from 'express';
 import compression from 'compression';
 import cors from 'cors';
@@ -126,11 +126,11 @@ var init_shared = __esm({
   }
 });
 function findBundledWasmDir() {
-  const fileDir = path29.dirname(fileURLToPath(import.meta.url));
+  const fileDir = path31.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path29.join(fileDir, "wasm"),
+    path31.join(fileDir, "wasm"),
     // dist/index.js → dist/wasm/
-    path29.join(fileDir, "../wasm")
+    path31.join(fileDir, "../wasm")
     // dist/cli/main.js → dist/wasm/
   ];
   for (const candidate of candidates) {
@@ -171,7 +171,7 @@ function wasmPath(lang) {
   }
   const bundled = BUNDLED_WASM_MAP[lang];
   if (bundled) {
-    const bundledPath = path29.join(_bundledWasmDir, bundled);
+    const bundledPath = path31.join(_bundledWasmDir, bundled);
     if (existsSync(bundledPath)) return bundledPath;
   }
   return null;
@@ -184,14 +184,14 @@ async function initParser() {
 }
 async function getLanguage(lang) {
   if (languageCache.has(lang)) return languageCache.get(lang);
-  const path30 = wasmPath(lang);
-  if (!path30) {
+  const path32 = wasmPath(lang);
+  if (!path32) {
     languageCache.set(lang, null);
     return null;
   }
   try {
     await initParser();
-    const language = await Language.load(path30);
+    const language = await Language.load(path32);
     languageCache.set(lang, language);
     return language;
   } catch {
@@ -1162,7 +1162,7 @@ var init_logger = __esm({
         };
       }
       /** Global log directory: ~/.code-intel/logs */
-      static LOG_DIR = path29.join(os12.homedir(), ".code-intel", "logs");
+      static LOG_DIR = path31.join(os13.homedir(), ".code-intel", "logs");
       static getLogger() {
         if (!_Logger.instance) {
           const isProduction = process.env.NODE_ENV === "production";
@@ -1171,12 +1171,12 @@ var init_logger = __esm({
           transports.push(new winston.transports.Console());
           if (!isProduction) {
             try {
-              if (!fs23.existsSync(_Logger.LOG_DIR)) {
-                fs23.mkdirSync(_Logger.LOG_DIR, { recursive: true });
+              if (!fs24.existsSync(_Logger.LOG_DIR)) {
+                fs24.mkdirSync(_Logger.LOG_DIR, { recursive: true });
               }
               transports.push(
                 new DailyRotateFile({
-                  filename: path29.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
+                  filename: path31.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
                   datePattern: "YYYY-MM-DD",
                   maxSize: "20m",
                   maxFiles: "14d"
@@ -1961,7 +1961,7 @@ var init_parse_phase = __esm({
           const batch = filePaths.slice(i, i + CONCURRENCY);
           await Promise.all(batch.map(async (filePath) => {
             try {
-              const source = await fs23.promises.readFile(filePath, "utf-8");
+              const source = await fs24.promises.readFile(filePath, "utf-8");
               context2.fileCache.set(filePath, source);
             } catch {
             }
@@ -1974,14 +1974,14 @@ var init_parse_phase = __esm({
           const lang = detectLanguage(filePath);
           if (!lang) {
             if (context2.verbose) {
-              const relativePath2 = path29.relative(context2.workspaceRoot, filePath);
+              const relativePath2 = path31.relative(context2.workspaceRoot, filePath);
               logger_default.info(`  [parse] skipped (no parser): ${relativePath2}`);
             }
             continue;
           }
           const source = context2.fileCache.get(filePath);
           if (!source) continue;
-          const relativePath = path29.relative(context2.workspaceRoot, filePath);
+          const relativePath = path31.relative(context2.workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const fileNode = context2.graph.getNode(fileNodeId);
           if (fileNode) {
@@ -2221,11 +2221,11 @@ var init_resolve_phase = __esm({
         let heritageEdges = 0;
         const fileIndex = /* @__PURE__ */ new Map();
         for (const fp of filePaths) {
-          const rel = path29.relative(workspaceRoot, fp);
+          const rel = path31.relative(workspaceRoot, fp);
           fileIndex.set(rel, fp);
           const noExt = rel.replace(/\.\w+$/, "");
           if (!fileIndex.has(noExt)) fileIndex.set(noExt, fp);
-          const base = path29.basename(rel, path29.extname(rel));
+          const base = path31.basename(rel, path31.extname(rel));
           if (!fileIndex.has(base)) fileIndex.set(base, fp);
         }
         const symbolIndex = /* @__PURE__ */ new Map();
@@ -2256,7 +2256,7 @@ var init_resolve_phase = __esm({
         for (const filePath of filePaths) {
           const lang = detectLanguage(filePath);
           if (!lang) continue;
-          const relativePath = path29.relative(workspaceRoot, filePath);
+          const relativePath = path31.relative(workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const source = fileCache.get(filePath);
           if (!source) continue;
@@ -2269,13 +2269,13 @@ var init_resolve_phase = __esm({
             let resolvedRelPath = null;
             if (cleaned.startsWith(".")) {
               const cleanedNoJs = cleaned.replace(/\.(js|jsx)$/, "");
-              const fromDir = path29.dirname(relativePath);
+              const fromDir = path31.dirname(relativePath);
               for (const ext of ["", ".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", "/index.ts", "/index.js"]) {
-                const candidate = path29.join(fromDir, cleanedNoJs + ext);
-                const normalized = path29.normalize(candidate);
+                const candidate = path31.join(fromDir, cleanedNoJs + ext);
+                const normalized = path31.normalize(candidate);
                 if (fileIndex.has(normalized)) {
                   const absPath = fileIndex.get(normalized);
-                  resolvedRelPath = path29.relative(workspaceRoot, absPath);
+                  resolvedRelPath = path31.relative(workspaceRoot, absPath);
                   break;
                 }
               }
@@ -2589,27 +2589,27 @@ __export(group_registry_exports, {
   saveSyncResult: () => saveSyncResult
 });
 function groupFile(name) {
-  return path29.join(GROUPS_DIR, `${name}.json`);
+  return path31.join(GROUPS_DIR, `${name}.json`);
 }
 function loadGroup(name) {
   try {
-    return JSON.parse(fs23.readFileSync(groupFile(name), "utf-8"));
+    return JSON.parse(fs24.readFileSync(groupFile(name), "utf-8"));
   } catch {
     return null;
   }
 }
 function saveGroup(group) {
-  fs23.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs23.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
+  fs24.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs24.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
 }
 function listGroups() {
   const groups = [];
   try {
-    for (const file of fs23.readdirSync(GROUPS_DIR)) {
+    for (const file of fs24.readdirSync(GROUPS_DIR)) {
       if (!file.endsWith(".json") || file.endsWith(".sync.json")) continue;
       try {
         const g = JSON.parse(
-          fs23.readFileSync(path29.join(GROUPS_DIR, file), "utf-8")
+          fs24.readFileSync(path31.join(GROUPS_DIR, file), "utf-8")
         );
         groups.push(g);
       } catch {
@@ -2621,16 +2621,16 @@ function listGroups() {
 }
 function deleteGroup(name) {
   try {
-    fs23.unlinkSync(groupFile(name));
+    fs24.unlinkSync(groupFile(name));
   } catch {
   }
   try {
-    fs23.unlinkSync(path29.join(GROUPS_DIR, `${name}.sync.json`));
+    fs24.unlinkSync(path31.join(GROUPS_DIR, `${name}.sync.json`));
   } catch {
   }
 }
 function groupExists(name) {
-  return fs23.existsSync(groupFile(name));
+  return fs24.existsSync(groupFile(name));
 }
 function addMember(groupName, member) {
   const group = loadGroup(groupName);
@@ -2656,16 +2656,16 @@ function removeMember(groupName, groupPath) {
   return group;
 }
 function saveSyncResult(result) {
-  fs23.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs23.writeFileSync(
-    path29.join(GROUPS_DIR, `${result.groupName}.sync.json`),
+  fs24.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs24.writeFileSync(
+    path31.join(GROUPS_DIR, `${result.groupName}.sync.json`),
     JSON.stringify(result, null, 2) + "\n"
   );
 }
 function loadSyncResult(groupName) {
   try {
     return JSON.parse(
-      fs23.readFileSync(path29.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
+      fs24.readFileSync(path31.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
     );
   } catch {
     return null;
@@ -2674,7 +2674,7 @@ function loadSyncResult(groupName) {
 var GROUPS_DIR;
 var init_group_registry = __esm({
   "src/multi-repo/group-registry.ts"() {
-    GROUPS_DIR = path29.join(os12.homedir(), ".code-intel", "groups");
+    GROUPS_DIR = path31.join(os13.homedir(), ".code-intel", "groups");
   }
 });
 
@@ -2696,14 +2696,14 @@ function detectDeadCode(graph) {
     if (meta?.deprecated === true) continue;
     if (ENTRY_POINT_NAME_RE.test(node.name)) continue;
     if (entryPointIds.has(node.id)) continue;
-    let hasCallers = false;
+    let hasCallers2 = false;
     for (const edge of graph.findEdgesTo(node.id)) {
       if (edge.kind === "calls") {
-        hasCallers = true;
+        hasCallers2 = true;
         break;
       }
     }
-    if (hasCallers) continue;
+    if (hasCallers2) continue;
     let hasImporters = false;
     for (const edge of graph.findEdgesTo(node.id)) {
       if (edge.kind === "imports") {
@@ -3702,11 +3702,554 @@ var init_gql_executor = __esm({
   }
 });
 
-// src/errors/codes.ts
+// src/analysis/deprecated-detector.ts
+var deprecated_detector_exports = {};
+__export(deprecated_detector_exports, {
+  DeprecatedDetector: () => DeprecatedDetector
+});
+var BUILTIN_DEPRECATED, DeprecatedDetector;
+var init_deprecated_detector = __esm({
+  "src/analysis/deprecated-detector.ts"() {
+    BUILTIN_DEPRECATED = [
+      { pattern: "url.parse", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "url.resolve", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "url.format", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "fs.exists", message: "deprecated \u2014 use fs.access instead" },
+      { pattern: "crypto.createCipher", message: "deprecated \u2014 use crypto.createCipheriv instead" },
+      { pattern: "crypto.createDecipher", message: "deprecated \u2014 use crypto.createDecipheriv instead" },
+      { pattern: "new Buffer()", message: "deprecated \u2014 use Buffer.from() instead" },
+      { pattern: "domain.create", message: "deprecated \u2014 the domain module is discouraged" },
+      { pattern: "process.binding", message: "deprecated internal API" }
+    ];
+    DeprecatedDetector = class {
+      tagDeprecated(graph) {
+        for (const node of graph.allNodes()) {
+          if (!node.metadata) node.metadata = {};
+          if (node.metadata["deprecated"] === true) continue;
+          let message;
+          const jsdoc = node.metadata["jsdoc"];
+          const comment = node.metadata["comment"];
+          if (jsdoc?.includes("@deprecated") || comment?.includes("@deprecated")) {
+            const src = jsdoc ?? comment ?? "";
+            const match = src.match(/@deprecated\s+(.*)/);
+            message = match?.[1]?.trim() || "deprecated";
+          }
+          if (!message && node.metadata["deprecated"] === true) {
+            message = node.metadata["deprecationMessage"] ?? "deprecated";
+          }
+          if (!message) {
+            const annotations = node.metadata["annotations"];
+            if (Array.isArray(annotations) && annotations.includes("Deprecated")) {
+              message = "marked @Deprecated";
+            }
+          }
+          if (!message) {
+            const attributes = node.metadata["attributes"];
+            if (Array.isArray(attributes) && attributes.includes("deprecated")) {
+              message = "marked #[deprecated]";
+            }
+          }
+          if (!message) {
+            for (const entry of BUILTIN_DEPRECATED) {
+              if (node.name === entry.pattern || node.name.includes(entry.pattern)) {
+                message = entry.message;
+                break;
+              }
+            }
+          }
+          if (message) {
+            node.metadata["deprecated"] = true;
+            node.metadata["deprecationMessage"] = message;
+          }
+        }
+      }
+      detect(graph, scope) {
+        const findings = [];
+        for (const node of graph.allNodes()) {
+          if (!node.metadata?.["deprecated"]) continue;
+          const callers = [];
+          for (const edge of graph.findEdgesTo(node.id)) {
+            if (edge.kind !== "calls" && edge.kind !== "deprecated_use") continue;
+            const caller = graph.getNode(edge.source);
+            if (!caller) continue;
+            if (scope && !caller.filePath.includes(scope)) continue;
+            callers.push({ name: caller.name, filePath: caller.filePath });
+            const edgeId = `dep_use_${edge.source}_${node.id}`;
+            if (!graph.getEdge(edgeId)) {
+              graph.addEdge({ id: edgeId, source: edge.source, target: node.id, kind: "deprecated_use" });
+            }
+          }
+          findings.push({
+            symbol: node.name,
+            filePath: node.filePath,
+            deprecationMessage: node.metadata?.["deprecationMessage"] ?? "deprecated",
+            callers
+          });
+        }
+        return findings;
+      }
+    };
+  }
+});
+
+// src/analysis/complexity.ts
+var complexity_exports = {};
+__export(complexity_exports, {
+  computeComplexity: () => computeComplexity
+});
+function getSeverity(cyclomatic) {
+  if (cyclomatic <= 5) return "LOW";
+  if (cyclomatic <= 10) return "MEDIUM";
+  if (cyclomatic <= 20) return "HIGH";
+  return "CRITICAL";
+}
+function computeComplexity(graph, scope) {
+  const results = [];
+  for (const node of graph.allNodes()) {
+    if (node.kind !== "function" && node.kind !== "method") continue;
+    if (scope && !node.filePath.startsWith(scope)) continue;
+    let outgoingCalls = 0;
+    for (const edge of graph.findEdgesFrom(node.id)) {
+      if (edge.kind === "calls") outgoingCalls++;
+    }
+    let cyclomatic;
+    const meta = node.metadata;
+    const metaComplexity = meta?.complexity;
+    if (typeof metaComplexity?.cyclomatic === "number") {
+      cyclomatic = metaComplexity.cyclomatic;
+    } else {
+      cyclomatic = 1 + Math.floor(outgoingCalls / 2);
+    }
+    cyclomatic = Math.min(cyclomatic, 50);
+    let cognitive;
+    if (typeof metaComplexity?.cognitive === "number") {
+      cognitive = metaComplexity.cognitive;
+    } else {
+      cognitive = Math.ceil(cyclomatic * 1.3);
+    }
+    results.push({
+      nodeId: node.id,
+      name: node.name,
+      filePath: node.filePath,
+      cyclomatic,
+      cognitive,
+      severity: getSeverity(cyclomatic)
+    });
+  }
+  return results.sort((a, b) => b.cyclomatic - a.cyclomatic);
+}
+var init_complexity = __esm({
+  "src/analysis/complexity.ts"() {
+  }
+});
+
+// src/analysis/test-coverage.ts
+var test_coverage_exports = {};
+__export(test_coverage_exports, {
+  computeCoverage: () => computeCoverage
+});
+function isTestFile(filePath) {
+  if (filePath.includes(".test.") || filePath.includes(".spec.")) return true;
+  if (filePath.includes("_test.") || filePath.endsWith("_test.go")) return true;
+  if (filePath.includes("__tests__")) return true;
+  const base = path31.basename(filePath);
+  if (base.startsWith("Test") && filePath.endsWith(".java")) return true;
+  return false;
+}
+function computeBlastRadius(graph, nodeId) {
+  const visited = /* @__PURE__ */ new Set();
+  const queue = [{ id: nodeId, depth: 0 }];
+  while (queue.length > 0) {
+    const { id, depth } = queue.shift();
+    if (visited.has(id)) continue;
+    visited.add(id);
+    if (depth >= 3) continue;
+    for (const edge of graph.findEdgesTo(id)) {
+      if (edge.kind === "calls" || edge.kind === "imports") {
+        if (!visited.has(edge.source)) {
+          queue.push({ id: edge.source, depth: depth + 1 });
+        }
+      }
+    }
+  }
+  return Math.max(0, visited.size - 1);
+}
+function getRisk(blastRadius) {
+  if (blastRadius > 20) return "HIGH";
+  if (blastRadius >= 5) return "MEDIUM";
+  return "LOW";
+}
+function computeCoverage(graph, scope) {
+  const testFilePaths = /* @__PURE__ */ new Set();
+  for (const node of graph.allNodes()) {
+    if (isTestFile(node.filePath)) testFilePaths.add(node.filePath);
+  }
+  const nodesImportedByTests = /* @__PURE__ */ new Set();
+  for (const edge of graph.findEdgesByKind("imports")) {
+    const sourceNode = graph.getNode(edge.source);
+    if (sourceNode && isTestFile(sourceNode.filePath)) {
+      nodesImportedByTests.add(edge.target);
+    }
+  }
+  const nodesWithTestedBy = /* @__PURE__ */ new Set();
+  for (const edge of graph.findEdgesByKind("tested_by")) {
+    nodesWithTestedBy.add(edge.source);
+  }
+  const baseNameToTestFiles = /* @__PURE__ */ new Map();
+  for (const testPath of testFilePaths) {
+    const base = path31.basename(testPath);
+    const stripped = base.replace(/\.test\.[^.]+$/, "").replace(/\.spec\.[^.]+$/, "").replace(/_test\.[^.]+$/, "").replace(/_test$/, "");
+    const existing = baseNameToTestFiles.get(stripped) ?? [];
+    existing.push(testPath);
+    baseNameToTestFiles.set(stripped, existing);
+  }
+  const exportedKinds = /* @__PURE__ */ new Set(["function", "method", "class"]);
+  const results = [];
+  for (const node of graph.allNodes()) {
+    if (!exportedKinds.has(node.kind)) continue;
+    if (node.exported !== true) continue;
+    if (scope && !node.filePath.startsWith(scope)) continue;
+    const testFiles = [];
+    if (nodesWithTestedBy.has(node.id)) {
+      for (const edge of graph.findEdgesFrom(node.id)) {
+        if (edge.kind === "tested_by") {
+          const testNode = graph.getNode(edge.target);
+          if (testNode && !testFiles.includes(testNode.filePath)) {
+            testFiles.push(testNode.filePath);
+          }
+        }
+      }
+    }
+    if (nodesImportedByTests.has(node.id)) {
+      for (const edge of graph.findEdgesTo(node.id)) {
+        if (edge.kind === "imports") {
+          const sourceNode = graph.getNode(edge.source);
+          if (sourceNode && isTestFile(sourceNode.filePath) && !testFiles.includes(sourceNode.filePath)) {
+            testFiles.push(sourceNode.filePath);
+          }
+        }
+      }
+    }
+    const nodeBase = path31.basename(node.filePath).replace(/\.[^.]+$/, "");
+    const matchingTestFiles = baseNameToTestFiles.get(nodeBase) ?? [];
+    for (const tf of matchingTestFiles) {
+      if (!testFiles.includes(tf)) testFiles.push(tf);
+    }
+    const tested = testFiles.length > 0;
+    const blastRadius = computeBlastRadius(graph, node.id);
+    const risk = getRisk(blastRadius);
+    results.push({
+      nodeId: node.id,
+      name: node.name,
+      filePath: node.filePath,
+      exported: true,
+      tested,
+      testFiles,
+      blastRadius,
+      risk
+    });
+  }
+  const totalExported = results.length;
+  const testedExported = results.filter((r) => r.tested).length;
+  const coveragePct = totalExported === 0 ? 100 : Math.round(testedExported / totalExported * 100);
+  const untestedByRisk = results.filter((r) => !r.tested).sort((a, b) => b.blastRadius - a.blastRadius);
+  return { totalExported, testedExported, coveragePct, untestedByRisk };
+}
+var init_test_coverage = __esm({
+  "src/analysis/test-coverage.ts"() {
+  }
+});
+
+// src/security/secret-scanner.ts
+var secret_scanner_exports = {};
+__export(secret_scanner_exports, {
+  SecretScanner: () => SecretScanner
+});
+function shannonEntropy(s) {
+  const freq = /* @__PURE__ */ new Map();
+  for (const c of s) freq.set(c, (freq.get(c) ?? 0) + 1);
+  let entropy = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function isTestFile2(filePath) {
+  return filePath.includes(".test.") || filePath.includes(".spec.") || filePath.includes("fixtures/") || filePath.includes("mocks/");
+}
+var ENV_VAR_RE, SENSITIVE_NAME_RE, VALUE_PATTERNS, SecretScanner;
+var init_secret_scanner = __esm({
+  "src/security/secret-scanner.ts"() {
+    ENV_VAR_RE = /^process\.env\./;
+    SENSITIVE_NAME_RE = /_SECRET$|_PASSWORD$|_TOKEN$|_KEY$|_API_KEY$/i;
+    VALUE_PATTERNS = [
+      [/sk-[A-Za-z0-9]{6,}/, "openai-api-key", "HIGH"],
+      [/pk_live_[A-Za-z0-9]{20,}/, "stripe-key", "HIGH"],
+      [/AKIA[0-9A-Z]{16}|aws.access.key/i, "aws-access-key", "HIGH"],
+      [/xoxb-[0-9]{11}-[0-9]{11}-[A-Za-z0-9]{24}/, "slack-token", "HIGH"],
+      [/postgres:\/\/[^@]+:[^@]+@/, "db-url-with-credentials", "HIGH"],
+      [/mysql:\/\/[^@]+:[^@]+@/, "db-url-with-credentials", "HIGH"],
+      [/-----BEGIN RSA PRIVATE KEY-----/, "rsa-private-key", "HIGH"]
+    ];
+    SecretScanner = class {
+      scan(graph, options) {
+        const findings = [];
+        const includeTests = options?.includeTestFiles ?? false;
+        const scope = options?.scope;
+        const ignorePatterns = [...options?.ignorePatterns ?? []];
+        if (options?.workspaceRoot) {
+          try {
+            const raw = fs24.readFileSync(path31.join(options.workspaceRoot, ".codeintelignore"), "utf-8");
+            for (const line of raw.split("\n")) {
+              const trimmed = line.trim();
+              if (trimmed && !trimmed.startsWith("#")) ignorePatterns.push(trimmed);
+            }
+          } catch {
+          }
+        }
+        for (const node of graph.allNodes()) {
+          const filePath = node.filePath;
+          if (scope && !filePath.startsWith(scope)) continue;
+          if (!includeTests && isTestFile2(filePath)) continue;
+          if (ignorePatterns.length > 0 && ignorePatterns.some((p) => filePath.includes(p))) continue;
+          const meta = node.metadata;
+          const rawValue = meta?.value ?? meta?.literalValue;
+          if (typeof rawValue !== "string" || rawValue.trim() === "") continue;
+          const value = rawValue.trim();
+          if (ENV_VAR_RE.test(value)) continue;
+          let matched = false;
+          for (const [re, label, severity] of VALUE_PATTERNS) {
+            if (re.test(value)) {
+              node.metadata = {
+                ...node.metadata ?? {},
+                security: { secretRisk: true, secretPattern: label }
+              };
+              findings.push({
+                file: filePath,
+                line: node.startLine,
+                symbol: node.name,
+                pattern: label,
+                severity
+              });
+              matched = true;
+              break;
+            }
+          }
+          if (matched) continue;
+          if (SENSITIVE_NAME_RE.test(node.name)) {
+            node.metadata = {
+              ...node.metadata ?? {},
+              security: { secretRisk: true, secretPattern: "sensitive-name-with-value" }
+            };
+            findings.push({
+              file: filePath,
+              line: node.startLine,
+              symbol: node.name,
+              pattern: "sensitive-name-with-value",
+              severity: "MEDIUM"
+            });
+            continue;
+          }
+          if (SENSITIVE_NAME_RE.test(node.name) && value.length > 20 && shannonEntropy(value) > 4.5) {
+            node.metadata = {
+              ...node.metadata ?? {},
+              security: { secretRisk: true, secretPattern: "high-entropy-string" }
+            };
+            findings.push({
+              file: filePath,
+              line: node.startLine,
+              symbol: node.name,
+              pattern: "high-entropy-string",
+              severity: "MEDIUM"
+            });
+          }
+        }
+        return findings;
+      }
+    };
+  }
+});
+
+// src/security/vulnerability-detector.ts
+var vulnerability_detector_exports = {};
+__export(vulnerability_detector_exports, {
+  VulnerabilityDetector: () => VulnerabilityDetector
+});
+function hasCallers(graph, nodeId) {
+  for (const edge of graph.findEdgesTo(nodeId)) {
+    if (edge.kind === "calls") return true;
+  }
+  return false;
+}
+var CWE, SQL_PATTERN, XSS_PATTERN, SSRF_PATTERN, PATH_PATTERN, CMD_PATTERN, VulnerabilityDetector;
+var init_vulnerability_detector = __esm({
+  "src/security/vulnerability-detector.ts"() {
+    CWE = {
+      SQL_INJECTION: "CWE-89",
+      XSS: "CWE-79",
+      SSRF: "CWE-918",
+      PATH_TRAVERSAL: "CWE-22",
+      COMMAND_INJECTION: "CWE-78"
+    };
+    SQL_PATTERN = /(db|database|connection|knex|sequelize|pool)\.(query|execute|raw)/i;
+    XSS_PATTERN = /innerHTML|outerHTML|document\.write|insertAdjacentHTML/i;
+    SSRF_PATTERN = /^(fetch|axios|http\.request|got)$/i;
+    PATH_PATTERN = /^(fs\.readFile|fs\.writeFile|path\.join|createReadStream)$/i;
+    CMD_PATTERN = /^(exec|execSync|spawn|eval)$/i;
+    VulnerabilityDetector = class {
+      detect(graph, options) {
+        const findings = [];
+        const scope = options?.scope;
+        const types = options?.types ? new Set(options.types) : null;
+        const want = (t) => !types || types.has(t);
+        const nodes = [...graph.allNodes()];
+        for (const node of nodes) {
+          if (node.kind === "vulnerability") continue;
+          const filePath = node.filePath;
+          if (scope && !filePath.startsWith(scope)) continue;
+          const nodeName = node.name;
+          const meta = node.metadata;
+          if (want("SQL_INJECTION") && SQL_PATTERN.test(nodeName)) {
+            const hasDynamic = meta?.hasStringConcatenation === true || hasCallers(graph, node.id);
+            if (hasDynamic) {
+              findings.push({
+                type: "SQL_INJECTION",
+                severity: "MEDIUM",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential SQL injection: ${nodeName} may execute unsanitized user input`,
+                cweId: CWE["SQL_INJECTION"]
+              });
+              this._tagNode(graph, node.id, "SQL_INJECTION");
+            }
+          }
+          if (want("XSS") && XSS_PATTERN.test(nodeName)) {
+            findings.push({
+              type: "XSS",
+              severity: "HIGH",
+              file: filePath,
+              line: node.startLine,
+              symbol: nodeName,
+              description: `Potential XSS: ${nodeName} writes to DOM sink`,
+              cweId: CWE["XSS"]
+            });
+            this._tagNode(graph, node.id, "XSS");
+          }
+          if (want("XSS")) {
+            for (const edge of graph.findEdgesFrom(node.id)) {
+              if (edge.kind === "calls") {
+                const callee = graph.getNode(edge.target);
+                if (callee && XSS_PATTERN.test(callee.name)) {
+                  findings.push({
+                    type: "XSS",
+                    severity: "HIGH",
+                    file: filePath,
+                    line: node.startLine,
+                    symbol: node.name,
+                    description: `Potential XSS: ${node.name} calls ${callee.name}`,
+                    cweId: CWE["XSS"]
+                  });
+                  this._tagNode(graph, node.id, "XSS");
+                }
+              }
+            }
+          }
+          if (want("SSRF") && SSRF_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicUrl === true;
+            if (isDynamic) {
+              findings.push({
+                type: "SSRF",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential SSRF: ${nodeName} uses a dynamic URL`,
+                cweId: CWE["SSRF"]
+              });
+              this._tagNode(graph, node.id, "SSRF");
+            }
+          }
+          if (want("PATH_TRAVERSAL") && PATH_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicPath === true;
+            if (isDynamic) {
+              findings.push({
+                type: "PATH_TRAVERSAL",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential path traversal: ${nodeName} uses a dynamic path`,
+                cweId: CWE["PATH_TRAVERSAL"]
+              });
+              this._tagNode(graph, node.id, "PATH_TRAVERSAL");
+            }
+          }
+          if (want("COMMAND_INJECTION") && CMD_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicArgs === true;
+            if (isDynamic) {
+              findings.push({
+                type: "COMMAND_INJECTION",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential command injection: ${nodeName} uses dynamic arguments`,
+                cweId: CWE["COMMAND_INJECTION"]
+              });
+              this._tagNode(graph, node.id, "COMMAND_INJECTION");
+            }
+          }
+        }
+        const seen = /* @__PURE__ */ new Set();
+        return findings.filter((f) => {
+          const key = `${f.type}:${f.file}:${f.line}:${f.symbol}`;
+          if (seen.has(key)) return false;
+          seen.add(key);
+          return true;
+        });
+      }
+      _tagNode(graph, nodeId, vulnType) {
+        const node = graph.getNode(nodeId);
+        if (!node) return;
+        const meta = node.metadata ?? {};
+        node.metadata = {
+          ...meta,
+          security: {
+            ...meta["security"] ?? {},
+            vulnerability: vulnType
+          }
+        };
+        const vulnNodeId = `vuln:${vulnType}:${nodeId}`;
+        if (!graph.getNode(vulnNodeId)) {
+          graph.addNode({
+            id: vulnNodeId,
+            kind: "vulnerability",
+            name: `${vulnType}:${node.name}`,
+            filePath: node.filePath,
+            startLine: node.startLine,
+            metadata: { cweId: CWE[vulnType], vulnType }
+          });
+        }
+        const edgeId = `has_vulnerability:${nodeId}:${vulnNodeId}`;
+        if (!graph.getEdge(edgeId)) {
+          graph.addEdge({
+            id: edgeId,
+            source: nodeId,
+            target: vulnNodeId,
+            kind: "has_vulnerability"
+          });
+        }
+      }
+    };
+  }
+});
 var ErrorCodes, AppError;
 var init_codes = __esm({
   "src/errors/codes.ts"() {
     ErrorCodes = {
+      // Auth (CI-1xxx)
       UNAUTHORIZED: "CI-1000",
       FORBIDDEN: "CI-1001",
       NOT_FOUND: "CI-1002",
@@ -3716,6 +4259,16 @@ var init_codes = __esm({
       RATE_LIMIT_EXCEEDED: "CI-1100",
       PAYLOAD_TOO_LARGE: "CI-1101",
       INVALID_REQUEST: "CI-1200",
+      // Config (CI-2xxx)
+      CONFIG_INVALID: "CI-2000",
+      CONFIG_NOT_FOUND: "CI-2001",
+      // Analysis (CI-3xxx)
+      ANALYSIS_FAILED: "CI-3000",
+      // DB (CI-4xxx)
+      DB_ERROR: "CI-4000",
+      // Network (CI-5xxx)
+      NETWORK_ERROR: "CI-5001",
+      // Internal (CI-9xxx)
       INTERNAL_ERROR: "CI-5000"
     };
     AppError = class extends Error {
@@ -3735,10 +4288,10 @@ var init_codes = __esm({
   }
 });
 function secureMkdir(dir) {
-  fs23.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  fs24.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
   if (process.platform !== "win32") {
     try {
-      fs23.chmodSync(dir, SECURE_DIR_MODE);
+      fs24.chmodSync(dir, SECURE_DIR_MODE);
     } catch {
     }
   }
@@ -3746,17 +4299,17 @@ function secureMkdir(dir) {
 function secureChmodFile(file) {
   if (process.platform === "win32") return;
   try {
-    fs23.chmodSync(file, SECURE_FILE_MODE);
+    fs24.chmodSync(file, SECURE_FILE_MODE);
   } catch {
   }
 }
 function tightenDbFiles(dir) {
   if (process.platform === "win32") return;
-  if (!fs23.existsSync(dir)) return;
-  for (const name of fs23.readdirSync(dir)) {
+  if (!fs24.existsSync(dir)) return;
+  for (const name of fs24.readdirSync(dir)) {
     if (name.endsWith(".db") || name.endsWith(".db-wal") || name.endsWith(".db-shm")) {
       try {
-        fs23.chmodSync(path29.join(dir, name), SECURE_FILE_MODE);
+        fs24.chmodSync(path31.join(dir, name), SECURE_FILE_MODE);
       } catch {
       }
     }
@@ -3770,7 +4323,7 @@ var init_fs_secure = __esm({
   }
 });
 function getUsersDBPath() {
-  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path29.join(os12.homedir(), ".code-intel", "users.db");
+  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path31.join(os13.homedir(), ".code-intel", "users.db");
 }
 function getOrCreateUsersDB() {
   if (!_usersDB) {
@@ -3786,7 +4339,7 @@ var init_users_db = __esm({
     UsersDB = class {
       db;
       constructor(dbPath) {
-        const dir = path29.dirname(dbPath);
+        const dir = path31.dirname(dbPath);
         secureMkdir(dir);
         this.db = new Database3(dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -4063,17 +4616,17 @@ function getScryptN() {
   return Number.isInteger(v) && v >= 1024 ? v : 1 << 14;
 }
 function getSecretsPath() {
-  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path29.join(os12.homedir(), ".code-intel", ".secrets");
+  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path31.join(os13.homedir(), ".code-intel", ".secrets");
 }
 function getMasterPassword() {
   const fromEnv = process.env["CODE_INTEL_SECRET_KEY"];
   if (fromEnv && fromEnv.length >= 16) return fromEnv;
   let username = "unknown";
   try {
-    username = os12.userInfo().username;
+    username = os13.userInfo().username;
   } catch {
   }
-  return `code-intel-machine:${os12.hostname()}:${username}:${os12.platform()}`;
+  return `code-intel-machine:${os13.hostname()}:${username}:${os13.platform()}`;
 }
 function deriveKey(password, salt) {
   return crypto5.scryptSync(password, salt, KEY_LEN, { N: getScryptN(), r: 8, p: 1 });
@@ -4094,8 +4647,8 @@ function decryptSecrets(encrypted) {
   return JSON.parse(plaintext.toString("utf8"));
 }
 function loadSecrets(secretsPath = getSecretsPath()) {
-  if (!fs23.existsSync(secretsPath)) return {};
-  const blob = fs23.readFileSync(secretsPath);
+  if (!fs24.existsSync(secretsPath)) return {};
+  const blob = fs24.readFileSync(secretsPath);
   return decryptSecrets(blob);
 }
 function getSecret(key, secretsPath = getSecretsPath()) {
@@ -4662,7 +5215,7 @@ init_shared();
 init_shared();
 init_typescript();
 function resolveRelative(rawPath, fromFile, workspace) {
-  const fromDir = path29.dirname(fromFile);
+  const fromDir = path31.dirname(fromFile);
   const cleaned = rawPath.replace(/['"]/g, "");
   const extensions = [".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.js"];
   const resolved = workspace.resolve(fromDir, cleaned);
@@ -4714,7 +5267,7 @@ var pythonModule = {
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/['"]/g, "");
     const parts = cleaned.split(".");
-    const fromDir = path29.dirname(fromFile);
+    const fromDir = path31.dirname(fromFile);
     const relPath = parts.join("/");
     for (const suffix of ["/__init__.py", ".py"]) {
       const r = workspace.resolve(fromDir, relPath + suffix);
@@ -4793,7 +5346,7 @@ var cModule = {
   inheritanceStrategy: "none",
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/[<>"']/g, "");
-    const fromDir = path29.dirname(fromFile);
+    const fromDir = path31.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(_node) {
@@ -4816,7 +5369,7 @@ var cppModule = {
   inheritanceStrategy: "depth-first",
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/[<>"']/g, "");
-    const fromDir = path29.dirname(fromFile);
+    const fromDir = path31.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(_node) {
@@ -4978,7 +5531,7 @@ var dartModule = {
       const pkg = cleaned.replace("package:", "");
       return workspace.findByPackage(pkg);
     }
-    const fromDir = path29.dirname(fromFile);
+    const fromDir = path31.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(node) {
@@ -5333,25 +5886,25 @@ function validateDAG(phases) {
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
   const phaseMap = new Map(phases.map((p) => [p.name, p]));
-  function dfs(name, path30) {
+  function dfs(name, path32) {
     if (visiting.has(name)) {
-      const cycleStart = path30.indexOf(name);
-      const cycle = path30.slice(cycleStart).concat(name);
+      const cycleStart = path32.indexOf(name);
+      const cycle = path32.slice(cycleStart).concat(name);
       errors.push({ type: "cycle", message: `Cycle detected: ${cycle.join(" \u2192 ")}` });
       return true;
     }
     if (visited.has(name)) return false;
     visiting.add(name);
-    path30.push(name);
+    path32.push(name);
     const phase = phaseMap.get(name);
     if (phase) {
       for (const dep of phase.dependencies) {
-        if (dfs(dep, path30)) return true;
+        if (dfs(dep, path32)) return true;
       }
     }
     visiting.delete(name);
     visited.add(name);
-    path30.pop();
+    path32.pop();
     return false;
   }
   for (const phase of phases) {
@@ -5564,7 +6117,7 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
 ]);
 function loadIgnorePatterns(workspaceRoot) {
   try {
-    const raw = fs23.readFileSync(path29.join(workspaceRoot, ".codeintelignore"), "utf-8");
+    const raw = fs24.readFileSync(path31.join(workspaceRoot, ".codeintelignore"), "utf-8");
     const extras = /* @__PURE__ */ new Set();
     for (const line of raw.split("\n")) {
       const trimmed = line.trim();
@@ -5588,7 +6141,7 @@ var scanPhase = {
     function walk(dir) {
       let entries;
       try {
-        entries = fs23.readdirSync(dir, { withFileTypes: true });
+        entries = fs24.readdirSync(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -5597,15 +6150,15 @@ var scanPhase = {
           if (entry.name.startsWith(".")) continue;
           if (IGNORED_DIRS.has(entry.name)) continue;
           if (extraIgnore.has(entry.name)) continue;
-          walk(path29.join(dir, entry.name));
+          walk(path31.join(dir, entry.name));
         } else if (entry.isFile()) {
           const name = entry.name;
           if (IGNORED_FILE_SUFFIXES.some((s) => name.endsWith(s))) continue;
-          const ext = path29.extname(name);
+          const ext = path31.extname(name);
           if (!extensions.has(ext)) continue;
-          const fullPath = path29.join(dir, name);
+          const fullPath = path31.join(dir, name);
           try {
-            const stat = fs23.statSync(fullPath);
+            const stat = fs24.statSync(fullPath);
             if (stat.size > MAX_FILE_SIZE_BYTES) continue;
           } catch {
             continue;
@@ -5632,20 +6185,20 @@ var structurePhase = {
     const dirs = /* @__PURE__ */ new Set();
     let structDone = 0;
     for (const filePath of context2.filePaths) {
-      const relativePath = path29.relative(context2.workspaceRoot, filePath);
+      const relativePath = path31.relative(context2.workspaceRoot, filePath);
       const lang = detectLanguage(filePath);
       context2.graph.addNode({
         id: generateNodeId("file", relativePath, relativePath),
         kind: "file",
-        name: path29.basename(filePath),
+        name: path31.basename(filePath),
         filePath: relativePath,
         metadata: lang ? { language: lang } : void 0
       });
-      let dir = path29.dirname(relativePath);
+      let dir = path31.dirname(relativePath);
       while (dir && dir !== "." && dir !== "") {
         if (dirs.has(dir)) break;
         dirs.add(dir);
-        dir = path29.dirname(dir);
+        dir = path31.dirname(dir);
       }
       structDone++;
       context2.onPhaseProgress?.("structure", structDone, context2.filePaths.length);
@@ -5654,7 +6207,7 @@ var structurePhase = {
       context2.graph.addNode({
         id: generateNodeId("directory", dir, dir),
         kind: "directory",
-        name: path29.basename(dir),
+        name: path31.basename(dir),
         filePath: dir
       });
     }
@@ -5741,9 +6294,9 @@ var flowPhase = {
     for (const node of graph.allNodes()) {
       if (!["function", "method"].includes(node.kind)) continue;
       let score = 0;
-      const hasCallers = calledNodes.has(node.id);
+      const hasCallers2 = calledNodes.has(node.id);
       const outCalls = [...graph.findEdgesFrom(node.id)].filter((e) => e.kind === "calls");
-      if (!hasCallers && outCalls.length > 0) score += 10;
+      if (!hasCallers2 && outCalls.length > 0) score += 10;
       if (node.exported) score += 5;
       if (/^(main|handle|init|start|run|execute|process|serve|listen|bootstrap)/.test(node.name)) score += 3;
       if (node.filePath.includes("test") || node.filePath.includes("spec") || node.filePath.includes("__test")) score -= 20;
@@ -5765,22 +6318,22 @@ var flowPhase = {
       const queue = [{ nodeId: ep.id, path: [ep.id] }];
       const visited = /* @__PURE__ */ new Set();
       while (queue.length > 0 && flowCount < maxFlows) {
-        const { nodeId, path: path30 } = queue.shift();
-        if (path30.length > maxDepth) continue;
+        const { nodeId, path: path32 } = queue.shift();
+        if (path32.length > maxDepth) continue;
         const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-        if (callEdges.length === 0 && path30.length >= 3) {
+        if (callEdges.length === 0 && path32.length >= 3) {
           const flowId = generateNodeId("flow", ep.filePath, `flow-${flowCount}`);
           graph.addNode({
             id: flowId,
             kind: "flow",
             name: `${ep.name} flow ${flowCount}`,
             filePath: ep.filePath,
-            metadata: { steps: path30, entryPoint: ep.name }
+            metadata: { steps: path32, entryPoint: ep.name }
           });
-          for (let i = 0; i < path30.length; i++) {
+          for (let i = 0; i < path32.length; i++) {
             graph.addEdge({
-              id: generateEdgeId(path30[i], flowId, `step_of_${i}`),
-              source: path30[i],
+              id: generateEdgeId(path32[i], flowId, `step_of_${i}`),
+              source: path32[i],
               target: flowId,
               kind: "step_of",
               weight: 1,
@@ -5793,7 +6346,7 @@ var flowPhase = {
         for (const edge of callEdges) {
           if (visited.has(edge.target)) continue;
           visited.add(edge.target);
-          queue.push({ nodeId: edge.target, path: [...path30, edge.target] });
+          queue.push({ nodeId: edge.target, path: [...path32, edge.target] });
         }
       }
     }
@@ -5811,7 +6364,7 @@ var LLMGovernanceLogger = class {
   }
   /** Path to the JSONL log file. */
   getLogPath() {
-    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path29.join(os12.homedir(), ".code-intel", "llm-governance.jsonl");
+    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path31.join(os13.homedir(), ".code-intel", "llm-governance.jsonl");
   }
   /**
    * Append an entry to the governance log.
@@ -5827,8 +6380,8 @@ var LLMGovernanceLogger = class {
         ...entry
       };
       const logPath = this.getLogPath();
-      fs23.mkdirSync(path29.dirname(logPath), { recursive: true });
-      fs23.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
+      fs24.mkdirSync(path31.dirname(logPath), { recursive: true });
+      fs24.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
     } catch {
     }
   }
@@ -5838,7 +6391,7 @@ var LLMGovernanceLogger = class {
    */
   readLog(limit = 100) {
     try {
-      const raw = fs23.readFileSync(this.getLogPath(), "utf-8");
+      const raw = fs24.readFileSync(this.getLogPath(), "utf-8");
       const lines = raw.split("\n").filter((l) => l.trim().length > 0).slice(-limit);
       return lines.map((l) => JSON.parse(l));
     } catch {
@@ -5982,17 +6535,17 @@ function traceFlow(entryId, graph, maxDepth = 10, maxBranching = 4) {
     const queue = [{ nodeId: entryId, path: [entryId] }];
     const visited = /* @__PURE__ */ new Set();
     while (queue.length > 0 && flows.length < maxFlows) {
-      const { nodeId, path: path30 } = queue.shift();
-      if (path30.length > maxDepth) continue;
+      const { nodeId, path: path32 } = queue.shift();
+      if (path32.length > maxDepth) continue;
       const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-      if (callEdges.length === 0 && path30.length >= 3) {
-        flows.push({ entryPointId: entryId, steps: [...path30] });
+      if (callEdges.length === 0 && path32.length >= 3) {
+        flows.push({ entryPointId: entryId, steps: [...path32] });
         continue;
       }
       for (const edge of callEdges) {
         if (visited.has(edge.target)) continue;
         visited.add(edge.target);
-        queue.push({ nodeId: edge.target, path: [...path30, edge.target] });
+        queue.push({ nodeId: edge.target, path: [...path32, edge.target] });
       }
     }
   }
@@ -6226,7 +6779,7 @@ init_embedder();
 async function hybridSearch(graph, query, limit, options = {}) {
   const { vectorDbPath, bm25Limit = 50, vectorLimit = 50 } = options;
   const bm25Promise = Promise.resolve(textSearch(graph, query, bm25Limit));
-  const hasVectorDb = Boolean(vectorDbPath && fs23.existsSync(vectorDbPath));
+  const hasVectorDb = Boolean(vectorDbPath && fs24.existsSync(vectorDbPath));
   if (!hasVectorDb) {
     const bm25Results2 = await bm25Promise;
     return {
@@ -6283,7 +6836,7 @@ var DbManager = class {
     this.dbPath = dbPath;
   }
   async init() {
-    fs23.mkdirSync(path29.dirname(this.dbPath), { recursive: true });
+    fs24.mkdirSync(path31.dirname(this.dbPath), { recursive: true });
     this.db = new Database(this.dbPath);
     await this.db.init();
     this.conn = new Connection(this.db);
@@ -6373,7 +6926,7 @@ function getCreateEdgeTableDDL() {
 )`];
 }
 function writeNodeCSVs(graph, outputDir) {
-  fs23.mkdirSync(outputDir, { recursive: true });
+  fs24.mkdirSync(outputDir, { recursive: true });
   const header = "id,name,file_path,start_line,end_line,exported,content,metadata\n";
   const tableBuffers = /* @__PURE__ */ new Map();
   const tableFilePaths = /* @__PURE__ */ new Map();
@@ -6381,7 +6934,7 @@ function writeNodeCSVs(graph, outputDir) {
     const table = NODE_TABLE_MAP[node.kind];
     if (!tableBuffers.has(table)) {
       tableBuffers.set(table, [header]);
-      tableFilePaths.set(table, path29.join(outputDir, `${table}.csv`));
+      tableFilePaths.set(table, path31.join(outputDir, `${table}.csv`));
     }
     tableBuffers.get(table).push(
       csvRow([
@@ -6401,12 +6954,12 @@ function writeNodeCSVs(graph, outputDir) {
     );
   }
   for (const [table, lines] of tableBuffers) {
-    fs23.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
+    fs24.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
   }
   return tableFilePaths;
 }
 function writeEdgeCSV(graph, outputDir) {
-  fs23.mkdirSync(outputDir, { recursive: true });
+  fs24.mkdirSync(outputDir, { recursive: true });
   const header = "from_id,to_id,kind,weight,label\n";
   const groups = /* @__PURE__ */ new Map();
   for (const edge of graph.allEdges()) {
@@ -6417,7 +6970,7 @@ function writeEdgeCSV(graph, outputDir) {
     const toTable = NODE_TABLE_MAP[targetNode.kind];
     const key = `${fromTable}->${toTable}`;
     if (!groups.has(key)) {
-      const filePath = path29.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
+      const filePath = path31.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
       groups.set(key, { lines: [header], from: fromTable, to: toTable, filePath });
     }
     groups.get(key).lines.push(
@@ -6432,7 +6985,7 @@ function writeEdgeCSV(graph, outputDir) {
   }
   const result = [];
   for (const group of groups.values()) {
-    fs23.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
+    fs24.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
     result.push({ fromTable: group.from, toTable: group.to, filePath: group.filePath });
   }
   return result;
@@ -6460,7 +7013,7 @@ async function loadGraphToDB(graph, dbManager) {
     } catch {
     }
   }
-  const tmpDir = fs23.mkdtempSync(path29.join(os12.tmpdir(), "code-intel-csv-"));
+  const tmpDir = fs24.mkdtempSync(path31.join(os13.tmpdir(), "code-intel-csv-"));
   try {
     const nodeTableFiles = writeNodeCSVs(graph, tmpDir);
     const edgeGroups = writeEdgeCSV(graph, tmpDir);
@@ -6479,8 +7032,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let nodeCount = 0;
     for (const [table, csvPath] of nodeTableFiles) {
-      if (!fs23.existsSync(csvPath)) continue;
-      const stat = fs23.statSync(csvPath);
+      if (!fs24.existsSync(csvPath)) continue;
+      const stat = fs24.statSync(csvPath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -6493,8 +7046,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let edgeCount = 0;
     for (const group of edgeGroups) {
-      if (!fs23.existsSync(group.filePath)) continue;
-      const stat = fs23.statSync(group.filePath);
+      if (!fs24.existsSync(group.filePath)) continue;
+      const stat = fs24.statSync(group.filePath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -6508,7 +7061,7 @@ async function loadGraphToDB(graph, dbManager) {
     return { nodeCount, edgeCount };
   } finally {
     try {
-      fs23.rmSync(tmpDir, { recursive: true, force: true });
+      fs24.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -6560,19 +7113,19 @@ function buildNodeProps(node) {
 function escCypher(s) {
   return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "");
 }
-var GLOBAL_DIR = path29.join(os12.homedir(), ".code-intel");
-var REPOS_FILE = path29.join(GLOBAL_DIR, "repos.json");
+var GLOBAL_DIR = path31.join(os13.homedir(), ".code-intel");
+var REPOS_FILE = path31.join(GLOBAL_DIR, "repos.json");
 function loadRegistry() {
   try {
-    const data = fs23.readFileSync(REPOS_FILE, "utf-8");
+    const data = fs24.readFileSync(REPOS_FILE, "utf-8");
     return JSON.parse(data);
   } catch {
     return [];
   }
 }
 function saveRegistry(entries) {
-  fs23.mkdirSync(GLOBAL_DIR, { recursive: true });
-  fs23.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
+  fs24.mkdirSync(GLOBAL_DIR, { recursive: true });
+  fs24.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
 }
 function upsertRepo(entry) {
   const entries = loadRegistry();
@@ -6589,23 +7142,23 @@ function removeRepo(repoPath) {
   saveRegistry(entries);
 }
 function saveMetadata(repoDir, metadata) {
-  const metaDir = path29.join(repoDir, ".code-intel");
-  fs23.mkdirSync(metaDir, { recursive: true });
-  fs23.writeFileSync(path29.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
+  const metaDir = path31.join(repoDir, ".code-intel");
+  fs24.mkdirSync(metaDir, { recursive: true });
+  fs24.writeFileSync(path31.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
 }
 function loadMetadata(repoDir) {
   try {
-    const data = fs23.readFileSync(path29.join(repoDir, ".code-intel", "meta.json"), "utf-8");
+    const data = fs24.readFileSync(path31.join(repoDir, ".code-intel", "meta.json"), "utf-8");
     return JSON.parse(data);
   } catch {
     return null;
   }
 }
 function getDbPath(repoDir) {
-  return path29.join(repoDir, ".code-intel", "graph.db");
+  return path31.join(repoDir, ".code-intel", "graph.db");
 }
 function getVectorDbPath(repoDir) {
-  return path29.join(repoDir, ".code-intel", "vector.db");
+  return path31.join(repoDir, ".code-intel", "vector.db");
 }
 
 // src/mcp-server/server.ts
@@ -6689,12 +7242,12 @@ function scanForFiles(root, matcher, maxDepth = 2) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs23.readdirSync(dir, { withFileTypes: true });
+      entries = fs24.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = path29.join(dir, entry.name);
+      const full = path31.join(dir, entry.name);
       if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
         walk(full, depth + 1);
       } else if (entry.isFile() && matcher(entry.name)) {
@@ -6717,8 +7270,8 @@ var OPENAPI_FILENAMES = /* @__PURE__ */ new Set([
 ]);
 var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options"];
 function tryParseFile(filePath) {
-  const ext = path29.extname(filePath).toLowerCase();
-  const content = fs23.readFileSync(filePath, "utf-8");
+  const ext = path31.extname(filePath).toLowerCase();
+  const content = fs24.readFileSync(filePath, "utf-8");
   if (ext === ".json") {
     try {
       return JSON.parse(content);
@@ -6772,7 +7325,7 @@ async function parseGraphQLContracts(repoRoot) {
   const files = scanForFiles(repoRoot, (name) => name.endsWith(".graphql") || name.endsWith(".gql"));
   const contracts = [];
   for (const filePath of files) {
-    const content = fs23.readFileSync(filePath, "utf-8");
+    const content = fs24.readFileSync(filePath, "utf-8");
     const typeRegex = /type\s+(\w+)\s*\{([^}]+)\}/g;
     let match;
     while ((match = typeRegex.exec(content)) !== null) {
@@ -6803,7 +7356,7 @@ async function parseProtoContracts(repoRoot) {
   const files = scanForFiles(repoRoot, (name) => name.endsWith(".proto"));
   const contracts = [];
   for (const filePath of files) {
-    const content = fs23.readFileSync(filePath, "utf-8");
+    const content = fs24.readFileSync(filePath, "utf-8");
     const serviceRegex = /service\s+(\w+)\s*\{([^}]+)\}/g;
     let serviceMatch;
     while ((serviceMatch = serviceRegex.exec(content)) !== null) {
@@ -7008,8 +7561,8 @@ async function syncGroup(group) {
       logger_default.warn(`  \u26A0 Registry entry "${member.registryName}" not found \u2014 skipping ${member.groupPath}`);
       continue;
     }
-    const dbPath = path29.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs23.existsSync(dbPath)) {
+    const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs24.existsSync(dbPath)) {
       logger_default.warn(`  \u26A0 No index at ${dbPath} \u2014 run \`code-intel analyze ${regEntry.path}\` first`);
       continue;
     }
@@ -7082,8 +7635,8 @@ async function queryGroup(group, query, limit = 20) {
   for (const member of group.members) {
     const regEntry = registry.find((r) => r.name === member.registryName);
     if (!regEntry) continue;
-    const dbPath = path29.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs23.existsSync(dbPath)) continue;
+    const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs24.existsSync(dbPath)) continue;
     const graph = createKnowledgeGraph();
     const db = new DbManager(dbPath);
     try {
@@ -7583,22 +8136,22 @@ function suggestTests(graph, symbolName) {
   const callPaths = [];
   const pathQueue = [{ id: targetId, path: [symbolName], depth: 0 }];
   while (pathQueue.length > 0 && callPaths.length < 5) {
-    const { id, path: path30, depth } = pathQueue.shift();
-    let hasCallers = false;
+    const { id, path: path32, depth } = pathQueue.shift();
+    let hasCallers2 = false;
     for (const edge of graph.findEdgesTo(id)) {
       if (edge.kind !== "calls") continue;
       const callerNode = graph.getNode(edge.source);
       if (!callerNode) continue;
-      hasCallers = true;
-      const newPath = [callerNode.name, ...path30];
+      hasCallers2 = true;
+      const newPath = [callerNode.name, ...path32];
       if (depth + 1 >= 3 || callPaths.length >= 5) {
         if (callPaths.length < 5) callPaths.push(newPath);
         continue;
       }
       pathQueue.push({ id: edge.source, path: newPath, depth: depth + 1 });
     }
-    if (!hasCallers && path30.length > 1) {
-      callPaths.push(path30);
+    if (!hasCallers2 && path32.length > 1) {
+      callPaths.push(path32);
     }
   }
   if (callPaths.length === 0) {
@@ -8073,6 +8626,70 @@ function createMcpServer(graph, repoName, workspaceRoot) {
           },
           required: ["cluster"]
         }
+      },
+      {
+        name: "deprecated_usage",
+        description: "Find usages of deprecated APIs in the codebase",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Directory scope filter" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "complexity_hotspots",
+        description: "Ranked list of functions/methods by cyclomatic complexity. Useful for identifying refactoring candidates.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit to a file path prefix (optional)" },
+            limit: { type: "number", description: "Maximum number of results (default: 20)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "coverage_gaps",
+        description: "Find exported symbols with no test coverage, ranked by blast radius. Useful for prioritizing test writing.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit to a file path prefix (optional)" },
+            limit: { type: "number", description: "Maximum number of untested results to return (default: 20)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "secrets",
+        description: "Scan the knowledge graph for hardcoded secrets: API keys, passwords, tokens, private keys, high-entropy strings",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit scan to files under this path prefix" },
+            includeTestFiles: { type: "boolean", description: "Include test/spec/fixture files (default: false)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "vulnerability_scan",
+        description: "Scan the knowledge graph for OWASP vulnerabilities: SQL injection, XSS, SSRF, path traversal, command injection",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit scan to files under this path prefix" },
+            types: {
+              type: "array",
+              items: { type: "string", enum: ["SQL_INJECTION", "XSS", "SSRF", "PATH_TRAVERSAL", "COMMAND_INJECTION"] },
+              description: "Vulnerability types to detect (default: all)"
+            },
+            severity: { type: "string", description: "Minimum severity to report: HIGH|MEDIUM|LOW (default: LOW)" },
+            ..._tokenProp
+          }
+        }
       }
     ]
   }));
@@ -8496,7 +9113,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       for (const { filePath: changedFile, changedLines } of changedFiles) {
         for (const node of graph.allNodes()) {
           if (!node.filePath) continue;
-          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path29.sep, "");
+          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path31.sep, "");
           const normChanged = changedFile.replace(/^a\/|^b\//, "");
           if (!normNode.endsWith(normChanged) && !normChanged.endsWith(normNode)) continue;
           if (node.startLine !== void 0 && node.endLine !== void 0) {
@@ -8769,6 +9386,63 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       const result = summarizeCluster(graph, cluster);
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
+    case "deprecated_usage": {
+      const scope = a.scope;
+      const { DeprecatedDetector: DeprecatedDetector2 } = await Promise.resolve().then(() => (init_deprecated_detector(), deprecated_detector_exports));
+      const detector = new DeprecatedDetector2();
+      detector.tagDeprecated(graph);
+      const findings = detector.detect(graph, scope);
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
+    // ── complexity_hotspots ────────────────────────────────────────────────
+    case "complexity_hotspots": {
+      const { computeComplexity: computeComplexity2 } = await Promise.resolve().then(() => (init_complexity(), complexity_exports));
+      const scope = a.scope;
+      const limit = typeof a.limit === "number" ? a.limit : 20;
+      const hotspots = computeComplexity2(graph, scope).slice(0, limit);
+      return { content: [{ type: "text", text: JSON.stringify({ hotspots, total: hotspots.length }, null, 2) }] };
+    }
+    // ── coverage_gaps ──────────────────────────────────────────────────────
+    case "coverage_gaps": {
+      const { computeCoverage: computeCoverage2 } = await Promise.resolve().then(() => (init_test_coverage(), test_coverage_exports));
+      const scope = a.scope;
+      const limit = typeof a.limit === "number" ? a.limit : 20;
+      const summary = computeCoverage2(graph, scope);
+      const untestedByRisk = summary.untestedByRisk.slice(0, limit);
+      return {
+        content: [{
+          type: "text",
+          text: JSON.stringify({
+            untestedByRisk,
+            coveragePct: summary.coveragePct,
+            totalExported: summary.totalExported,
+            testedExported: summary.testedExported
+          }, null, 2)
+        }]
+      };
+    }
+    // ── secrets ────────────────────────────────────────────────────────────
+    case "secrets": {
+      const { SecretScanner: SecretScanner2 } = await Promise.resolve().then(() => (init_secret_scanner(), secret_scanner_exports));
+      const scanner = new SecretScanner2();
+      const scope = a.scope;
+      const includeTestFiles = a.includeTestFiles ?? false;
+      const findings = scanner.scan(graph, { scope, includeTestFiles });
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
+    // ── vulnerability_scan ─────────────────────────────────────────────────
+    case "vulnerability_scan": {
+      const { VulnerabilityDetector: VulnerabilityDetector2 } = await Promise.resolve().then(() => (init_vulnerability_detector(), vulnerability_detector_exports));
+      const detector = new VulnerabilityDetector2();
+      const scope = a.scope;
+      const types = a.types;
+      const minSev = (a.severity ?? "LOW").toUpperCase();
+      const sevRank = { HIGH: 3, MEDIUM: 2, LOW: 1 };
+      const minRank = sevRank[minSev] ?? 1;
+      let findings = detector.detect(graph, { scope, types });
+      findings = findings.filter((f) => (sevRank[f.severity] ?? 1) >= minRank);
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
     default:
       return { content: [{ type: "text", text: `Unknown tool: ${name}` }] };
   }
@@ -8862,7 +9536,7 @@ var STUCK_THRESHOLD_MINUTES = 30;
 var JobsDB = class {
   db;
   constructor(dbPath) {
-    fs23.mkdirSync(path29.dirname(dbPath), { recursive: true });
+    fs24.mkdirSync(path31.dirname(dbPath), { recursive: true });
     this.db = new Database3(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("foreign_keys = ON");
@@ -9004,7 +9678,7 @@ var JobsDB = class {
   }
 };
 function getJobsDBPath() {
-  return path29.join(os12.homedir(), ".code-intel", "jobs.db");
+  return path31.join(os13.homedir(), ".code-intel", "jobs.db");
 }
 var _jobsDB = null;
 function getOrCreateJobsDB() {
@@ -9096,14 +9770,14 @@ var BACKUP_VERSION = "1.0";
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 function getBackupDir() {
-  return path29.join(os12.homedir(), ".code-intel", "backups");
+  return path31.join(os13.homedir(), ".code-intel", "backups");
 }
 function getBackupKey() {
   const keyHex = process.env["CODE_INTEL_BACKUP_KEY"];
   if (keyHex && keyHex.length >= 64) {
     return Buffer.from(keyHex.slice(0, 64), "hex");
   }
-  const seed = `code-intel-backup-${os12.hostname()}-${os12.homedir()}`;
+  const seed = `code-intel-backup-${os13.hostname()}-${os13.homedir()}`;
   return crypto5.createHash("sha256").update(seed).digest();
 }
 function encryptBuffer(data, key) {
@@ -9127,30 +9801,30 @@ var BackupService = class {
   constructor(backupDir) {
     this.backupDir = backupDir ?? getBackupDir();
     this.key = getBackupKey();
-    fs23.mkdirSync(this.backupDir, { recursive: true });
+    fs24.mkdirSync(this.backupDir, { recursive: true });
   }
   /**
    * Create a backup for a repository.
    * Returns the backup entry.
    */
   createBackup(repoPath) {
-    const codeIntelDir = path29.join(repoPath, ".code-intel");
+    const codeIntelDir = path31.join(repoPath, ".code-intel");
     const id = v4();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
     const filesToBackup = [];
     const candidates = ["graph.db", "vector.db", "meta.json"];
     for (const f of candidates) {
-      const fp = path29.join(codeIntelDir, f);
-      if (fs23.existsSync(fp)) {
+      const fp = path31.join(codeIntelDir, f);
+      if (fs24.existsSync(fp)) {
         filesToBackup.push({ name: f, localPath: fp });
       }
     }
-    const registryPath = path29.join(os12.homedir(), ".code-intel", "registry.json");
-    if (fs23.existsSync(registryPath)) {
+    const registryPath = path31.join(os13.homedir(), ".code-intel", "registry.json");
+    if (fs24.existsSync(registryPath)) {
       filesToBackup.push({ name: "registry.json", localPath: registryPath });
     }
-    const usersDbPath = path29.join(os12.homedir(), ".code-intel", "users.db");
-    if (fs23.existsSync(usersDbPath)) {
+    const usersDbPath = path31.join(os13.homedir(), ".code-intel", "users.db");
+    if (fs24.existsSync(usersDbPath)) {
       filesToBackup.push({ name: "users.db", localPath: usersDbPath });
     }
     if (filesToBackup.length === 0) {
@@ -9161,7 +9835,7 @@ var BackupService = class {
       createdAt,
       version: BACKUP_VERSION,
       files: filesToBackup.map((f) => {
-        const data = fs23.readFileSync(f.localPath);
+        const data = fs24.readFileSync(f.localPath);
         return {
           name: f.name,
           sha256: crypto5.createHash("sha256").update(data).digest("hex"),
@@ -9175,7 +9849,7 @@ var BackupService = class {
     manifestLenBuf.writeUInt32BE(manifestBuf.length, 0);
     parts.push(manifestLenBuf, manifestBuf);
     for (const f of filesToBackup) {
-      const data = fs23.readFileSync(f.localPath);
+      const data = fs24.readFileSync(f.localPath);
       const nameBuf = Buffer.from(f.name, "utf-8");
       const nameLenBuf = Buffer.alloc(2);
       nameLenBuf.writeUInt16BE(nameBuf.length, 0);
@@ -9186,8 +9860,8 @@ var BackupService = class {
     const plaintext = Buffer.concat(parts);
     const encrypted = encryptBuffer(plaintext, this.key);
     const backupFileName = `backup-${id}.cib`;
-    const backupPath = path29.join(this.backupDir, backupFileName);
-    fs23.writeFileSync(backupPath, encrypted);
+    const backupPath = path31.join(this.backupDir, backupFileName);
+    fs24.writeFileSync(backupPath, encrypted);
     const entry = {
       id,
       createdAt,
@@ -9214,9 +9888,9 @@ var BackupService = class {
   async uploadToS3(entry) {
     const cfg = getS3Config();
     if (!cfg) throw new Error("S3 not configured. Set CODE_INTEL_BACKUP_S3_BUCKET, CODE_INTEL_BACKUP_S3_ACCESS_KEY_ID, CODE_INTEL_BACKUP_S3_SECRET_ACCESS_KEY.");
-    const fileName = path29.basename(entry.path);
+    const fileName = path31.basename(entry.path);
     const s3Key = `${cfg.prefix}${fileName}`;
-    const body = fs23.readFileSync(entry.path);
+    const body = fs24.readFileSync(entry.path);
     const result = await s3Request({ method: "PUT", cfg, key: s3Key, body });
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 upload failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
@@ -9233,8 +9907,8 @@ var BackupService = class {
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 download failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
     }
-    fs23.mkdirSync(path29.dirname(destPath), { recursive: true });
-    fs23.writeFileSync(destPath, Buffer.from(result.body, "binary"));
+    fs24.mkdirSync(path31.dirname(destPath), { recursive: true });
+    fs24.writeFileSync(destPath, Buffer.from(result.body, "binary"));
   }
   /**
    * List backup objects in S3 with the configured prefix.
@@ -9280,10 +9954,10 @@ var BackupService = class {
     if (!entry) {
       throw new Error(`Backup "${backupId}" not found.`);
     }
-    if (!fs23.existsSync(entry.path)) {
+    if (!fs24.existsSync(entry.path)) {
       throw new Error(`Backup file not found at: ${entry.path}`);
     }
-    const encrypted = fs23.readFileSync(entry.path);
+    const encrypted = fs24.readFileSync(entry.path);
     let plaintext;
     try {
       plaintext = decryptBuffer(encrypted, this.key);
@@ -9297,8 +9971,8 @@ var BackupService = class {
     offset += manifestLen;
     const manifest = JSON.parse(manifestStr);
     const restoreBase = targetRepoPath ?? entry.repoPath;
-    const codeIntelDir = path29.join(restoreBase, ".code-intel");
-    fs23.mkdirSync(codeIntelDir, { recursive: true });
+    const codeIntelDir = path31.join(restoreBase, ".code-intel");
+    fs24.mkdirSync(codeIntelDir, { recursive: true });
     for (const fileEntry of manifest.files) {
       const nameLen = plaintext.readUInt16BE(offset);
       offset += 2;
@@ -9315,18 +9989,18 @@ var BackupService = class {
       }
       let destPath;
       if (name === "registry.json" || name === "users.db") {
-        destPath = path29.join(os12.homedir(), ".code-intel", name);
+        destPath = path31.join(os13.homedir(), ".code-intel", name);
       } else {
-        destPath = path29.join(codeIntelDir, name);
+        destPath = path31.join(codeIntelDir, name);
       }
-      fs23.writeFileSync(destPath, data);
+      fs24.writeFileSync(destPath, data);
     }
   }
   /**
    * Apply retention policy: keep N daily, M weekly, L monthly backups.
    */
   applyRetention(options = { daily: 7, weekly: 4, monthly: 12 }) {
-    const entries = this._loadIndex().filter((e) => fs23.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    const entries = this._loadIndex().filter((e) => fs24.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
     const keep = /* @__PURE__ */ new Set();
     const now = /* @__PURE__ */ new Date();
     const dailyCutoff = new Date(now);
@@ -9356,7 +10030,7 @@ var BackupService = class {
     for (const e of entries) {
       if (!keep.has(e.id)) {
         try {
-          fs23.unlinkSync(e.path);
+          fs24.unlinkSync(e.path);
           deleted++;
         } catch {
         }
@@ -9368,17 +10042,17 @@ var BackupService = class {
   }
   // ── Index helpers ──────────────────────────────────────────────────────────
   _indexPath() {
-    return path29.join(this.backupDir, "index.json");
+    return path31.join(this.backupDir, "index.json");
   }
   _loadIndex() {
     try {
-      return JSON.parse(fs23.readFileSync(this._indexPath(), "utf-8"));
+      return JSON.parse(fs24.readFileSync(this._indexPath(), "utf-8"));
     } catch {
       return [];
     }
   }
   _saveIndex(entries) {
-    fs23.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
+    fs24.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
   }
   _appendIndex(entry) {
     const entries = this._loadIndex();
@@ -10171,11 +10845,11 @@ var openApiSpec = {
 };
 
 // src/http/app.ts
-var __dirname$1 = path29.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path31.dirname(fileURLToPath(import.meta.url));
 var WEB_DIST = (() => {
-  const bundled = path29.resolve(__dirname$1, "..", "web");
-  if (fs23.existsSync(bundled)) return bundled;
-  return path29.resolve(__dirname$1, "..", "..", "..", "web", "dist");
+  const bundled = path31.resolve(__dirname$1, "..", "web");
+  if (fs24.existsSync(bundled)) return bundled;
+  return path31.resolve(__dirname$1, "..", "..", "..", "web", "dist");
 })();
 function getAllowedOrigins() {
   const env = process.env["CODE_INTEL_CORS_ORIGINS"];
@@ -10706,8 +11380,8 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const registry = loadRegistry();
     const entry = registry.find((r) => r.name === requestedRepo || r.path === requestedRepo);
     if (!entry) return null;
-    const dbPath = path29.join(entry.path, ".code-intel", "graph.db");
-    if (!fs23.existsSync(dbPath)) return null;
+    const dbPath = path31.join(entry.path, ".code-intel", "graph.db");
+    if (!fs24.existsSync(dbPath)) return null;
     const repoGraph = createKnowledgeGraph();
     const db = new DbManager(dbPath);
     try {
@@ -10794,7 +11468,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       return;
     }
     try {
-      const content = fs23.readFileSync(file_path, "utf-8");
+      const content = fs24.readFileSync(file_path, "utf-8");
       res.json({ content });
     } catch {
       res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: "File not found" } });
@@ -11052,8 +11726,8 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     for (const member of group.members) {
       const regEntry = registry.find((r) => r.name === member.registryName);
       if (!regEntry) continue;
-      const dbPath = path29.join(regEntry.path, ".code-intel", "graph.db");
-      if (!fs23.existsSync(dbPath)) continue;
+      const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
+      if (!fs24.existsSync(dbPath)) continue;
       const db = new DbManager(dbPath);
       try {
         await db.init();
@@ -11079,8 +11753,8 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       let nodeCount = 0;
       let edgeCount = 0;
       if (regEntry) {
-        const dbPath = path29.join(regEntry.path, ".code-intel", "graph.db");
-        if (fs23.existsSync(dbPath)) {
+        const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
+        if (fs24.existsSync(dbPath)) {
           try {
             const db = new DbManager(dbPath);
             await db.init();
@@ -11129,14 +11803,14 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       });
       return;
     }
-    let rawResolved = path29.normalize(file);
-    if (!path29.isAbsolute(rawResolved) && workspaceRoot) {
-      rawResolved = path29.join(workspaceRoot, rawResolved);
+    let rawResolved = path31.normalize(file);
+    if (!path31.isAbsolute(rawResolved) && workspaceRoot) {
+      rawResolved = path31.join(workspaceRoot, rawResolved);
     }
-    const resolvedFile = path29.resolve(rawResolved);
+    const resolvedFile = path31.resolve(rawResolved);
     function isInsideDir(fileAbs, dir) {
-      const rel = path29.relative(path29.resolve(dir), fileAbs);
-      return !rel.startsWith("..") && !path29.isAbsolute(rel);
+      const rel = path31.relative(path31.resolve(dir), fileAbs);
+      return !rel.startsWith("..") && !path31.isAbsolute(rel);
     }
     if (workspaceRoot) {
       if (!isInsideDir(resolvedFile, workspaceRoot)) {
@@ -11173,7 +11847,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     }
     let fileContent;
     try {
-      fileContent = fs23.readFileSync(resolvedFile, "utf-8");
+      fileContent = fs24.readFileSync(resolvedFile, "utf-8");
     } catch {
       res.status(404).json({
         error: {
@@ -11204,7 +11878,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const contextStart = Math.max(1, startLine - 20);
     const contextEnd = Math.min(lines.length, endLine + 20);
     const content = lines.slice(contextStart - 1, contextEnd).join("\n");
-    const ext = path29.extname(resolvedFile).toLowerCase();
+    const ext = path31.extname(resolvedFile).toLowerCase();
     const languageMap = {
       ".ts": "typescript",
       ".tsx": "typescript",
@@ -11339,10 +12013,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       res.status(500).json({ error: { code: ErrorCodes.INTERNAL_ERROR, message: err instanceof Error ? err.message : String(err), requestId: req.requestId, timestamp: (/* @__PURE__ */ new Date()).toISOString() } });
     }
   });
-  if (fs23.existsSync(WEB_DIST)) {
+  if (fs24.existsSync(WEB_DIST)) {
     app.use(express.static(WEB_DIST));
     app.get("/{*path}", (_req, res) => {
-      res.sendFile(path29.join(WEB_DIST, "index.html"));
+      res.sendFile(path31.join(WEB_DIST, "index.html"));
     });
   }
   app.use("/admin", requireRole("admin"));