agenttwin 0.3.10 → 0.3.11

package/README.md

@@ -154,3 +154,9 @@ A run receipt's **Fix & retest** tab exports an evidence-based task for your cod
 The website’s Settings page saves workspace name, default execution limit (1–300 seconds for new templates), automatic refresh, compact lists and reduced motion in this browser. Existing reviewed bundles retain their limits. The account section supports token visibility, connection status, manual workspace refresh and disconnect; tokens are never persisted with preferences.
 
 Top-right initials open account actions. The sidebar closes into a full-width layout. See `docs-site/src/dashboard.mdx` for the complete guide. The website/API UI has received additional fixes after npm 0.2.2; the published package remains 0.2.2.
+
+### Workflow discovery boundaries
+
+Discovery identifies individual request branches in Fetch/Bun-style URL dispatch, Express-style callbacks, queue workers and exported provider operations. It follows direct local function calls and relative named imports, including aliases, and recognizes provider hosts in literal HTTP calls. Each candidate retains its source entrypoint and evidence. Router containers and pure exported helpers are not treated as complete workflows.
+
+These are possible static code paths, not executed or verified business workflows. Dynamic dispatch, computed destinations, external packages, re-exports and runtime-only integrations can remain unresolved. Prepare inputs, operation coverage and correctness checks before running a candidate. Refresh discovery and sync it to update an already-connected dashboard.

package/dist/cli.js

@@ -1929,7 +1929,7 @@ import { join as join34 } from "path";
 // package.json
 var package_default = {
   name: "agenttwin",
-  version: "0.3.10",
+  version: "0.3.11",
   description: "Give your agent a test world before it touches the real one.",
   keywords: [
     "agent",
@@ -6720,15 +6720,15 @@ function factoryProviderBindings(source) {
       constructors.set(specifier.local.name, provider.id);
     }
   }
-  const walk = (node, visit, skipFunctions = false) => {
+  const walk2 = (node, visit, skipFunctions = false) => {
     if (!node || typeof node !== "object") return;
     const value = node;
     if (skipFunctions && ["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(value.type)) return;
     visit(value);
     for (const [key, child] of Object.entries(value)) {
       if (["loc", "start", "end", "comments"].includes(key)) continue;
-      if (Array.isArray(child)) child.forEach((item) => walk(item, visit, skipFunctions));
-      else if (child && typeof child === "object") walk(child, visit, skipFunctions);
+      if (Array.isArray(child)) child.forEach((item) => walk2(item, visit, skipFunctions));
+      else if (child && typeof child === "object") walk2(child, visit, skipFunctions);
     }
   };
   const factories = /* @__PURE__ */ new Map();
@@ -6737,7 +6737,7 @@ function factoryProviderBindings(source) {
     if (node?.type !== "FunctionDeclaration" || !node.id || node.async || node.generator || node.params.length) continue;
     const providers = /* @__PURE__ */ new Set();
     let unknown = false;
-    walk(node.body, (child) => {
+    walk2(node.body, (child) => {
       if (child.type !== "ReturnStatement") return;
       const argument = child.argument;
       if (argument?.type === "NullLiteral") return;
@@ -6749,18 +6749,18 @@ function factoryProviderBindings(source) {
   }
   const declarations = /* @__PURE__ */ new Map();
   const count = (name) => declarations.set(name, (declarations.get(name) ?? 0) + 1);
-  walk(ast.program, (node) => {
+  walk2(ast.program, (node) => {
     if (["FunctionDeclaration", "ClassDeclaration"].includes(node.type) && node.id?.name) count(node.id.name);
     if (node.type === "VariableDeclarator" && node.id.type === "Identifier") count(node.id.name);
     if (["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(node.type)) {
-      for (const parameter of node.params ?? []) walk(parameter, (part) => {
+      for (const parameter of node.params ?? []) walk2(parameter, (part) => {
         if (part.type === "Identifier") count(part.name);
       });
     }
   });
   for (const name of factories.keys()) if ((declarations.get(name) ?? 0) > 1) factories.delete(name);
   const ambiguous = /* @__PURE__ */ new Set();
-  walk(ast.program, (node) => {
+  walk2(ast.program, (node) => {
     if (node.type !== "VariableDeclarator" || node.id.type !== "Identifier" || node.init?.type !== "CallExpression" || node.init.callee.type !== "Identifier") return;
     const provider = factories.get(node.init.callee.name);
     if (!provider) return;
@@ -6776,6 +6776,195 @@ function factoryProviderBindings(source) {
 init_entrypoints();
 import { createHash as createHash12 } from "crypto";
 
+// src/inventory/workflow-graph.ts
+init_catalog();
+import { parse as parse3 } from "@babel/parser";
+import { posix } from "path";
+function walk(node, visit, skipFunctions = false) {
+  if (!node || typeof node !== "object") return;
+  if (skipFunctions && /^(FunctionDeclaration|FunctionExpression|ArrowFunctionExpression)$/.test(node.type)) return;
+  visit(node);
+  for (const [key, child] of Object.entries(node)) {
+    if (["loc", "start", "end", "comments", "tokens"].includes(key)) continue;
+    if (Array.isArray(child)) child.forEach((item) => walk(item, visit, skipFunctions));
+    else if (child && typeof child === "object") walk(child, visit, skipFunctions);
+  }
+}
+function workflowGraph(sources, operations, tools) {
+  const modules = /* @__PURE__ */ new Map();
+  const gaps = [];
+  const resolve19 = (path2, specifier) => {
+    const base = posix.normalize(posix.join(posix.dirname(path2), specifier));
+    return [base, ...[".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].map((ext) => base + ext), base.replace(/\.js$/, ".ts"), ...[".ts", ".js"].map((ext) => base + "/index" + ext)].find((candidate) => sources.has(candidate));
+  };
+  for (const [path2, source] of sources) {
+    if (!/\.[cm]?[jt]sx?$/.test(path2)) continue;
+    let ast;
+    try {
+      ast = parse3(source, { sourceType: "unambiguous", plugins: ["typescript", "jsx"] });
+    } catch {
+      gaps.push(`Workflow syntax could not be parsed: ${path2}`);
+      continue;
+    }
+    const mod = { functions: /* @__PURE__ */ new Map(), imports: /* @__PURE__ */ new Map(), routes: [], ast };
+    modules.set(path2, mod);
+    const unit = (name, node, exported, trigger = false) => ({ path: path2, name, node, exported, trigger, startLine: node.loc.start.line, endLine: node.loc.end.line });
+    for (const item of ast.program.body) {
+      if (item.type === "ImportDeclaration" && item.importKind !== "type" && item.source.value.startsWith(".")) {
+        const target = resolve19(path2, item.source.value);
+        if (target) for (const spec of item.specifiers) {
+          if (spec.type === "ImportSpecifier" && spec.importKind !== "type") mod.imports.set(spec.local.name, { path: target, name: spec.imported.name ?? spec.imported.value });
+          if (spec.type === "ImportDefaultSpecifier") mod.imports.set(spec.local.name, { path: target, name: "default" });
+        }
+      }
+      const exported = item.type === "ExportNamedDeclaration" || item.type === "ExportDefaultDeclaration";
+      const declaration = exported ? item.declaration : item;
+      if (declaration?.type === "FunctionDeclaration") {
+        const name = declaration.id?.name ?? "default";
+        mod.functions.set(name, { ...unit(name, declaration.body, exported), parameters: declaration.params });
+        if (item.type === "ExportDefaultDeclaration") mod.functions.set("default", mod.functions.get(name));
+      }
+      if (declaration?.type === "VariableDeclaration") for (const variable of declaration.declarations) {
+        if (variable.id.type !== "Identifier") continue;
+        const fn = variable.init;
+        if (fn && ["ArrowFunctionExpression", "FunctionExpression"].includes(fn.type)) mod.functions.set(variable.id.name, { ...unit(variable.id.name, fn.body, exported), parameters: fn.params });
+      }
+    }
+    walk(ast.program, (fn) => {
+      if (!["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(fn.type) || fn.body?.type !== "BlockStatement") return;
+      const paths = /* @__PURE__ */ new Set();
+      const patterns = /* @__PURE__ */ new Map();
+      walk(fn.body, (node) => {
+        if (node.type !== "VariableDeclarator" || node.id.type !== "Identifier") return;
+        if (node.init?.type === "MemberExpression" && node.init.property.name === "pathname") paths.add(node.id.name);
+        const call = node.init;
+        if (call?.type === "CallExpression" && call.callee.type === "MemberExpression" && paths.has(call.callee.object.name) && call.callee.property.name === "match" && call.arguments[0]?.type === "RegExpLiteral") patterns.set(node.id.name, "/" + call.arguments[0].pattern + "/");
+      }, true);
+      if (paths.size === 0) return;
+      walk(fn.body, (node) => {
+        if (node.type !== "IfStatement") return;
+        const routes = /* @__PURE__ */ new Set();
+        const methods = /* @__PURE__ */ new Set();
+        walk(node.test, (test) => {
+          if (test.type === "Identifier" && patterns.has(test.name)) routes.add(patterns.get(test.name));
+          if (test.type !== "BinaryExpression" || !["===", "=="].includes(test.operator)) return;
+          for (const [left, right] of [[test.left, test.right], [test.right, test.left]]) {
+            if (right.type !== "StringLiteral") continue;
+            if (left.type === "Identifier" && paths.has(left.name) && right.value.startsWith("/")) routes.add(right.value);
+            if (left.type === "MemberExpression" && left.property.name === "method" && /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/.test(right.value)) methods.add(right.value);
+          }
+        });
+        let handlesRequest = false;
+        walk(node.consequent, (part) => {
+          if (part.type === "CallExpression" || part.type === "NewExpression" || part.type === "ReturnStatement" && part.argument && part.argument.type !== "NullLiteral") handlesRequest = true;
+        }, true);
+        if (!handlesRequest) return;
+        for (const route of routes) {
+          const method = methods.size === 1 ? [...methods][0] : "HTTP";
+          mod.routes.push({ ...unit(`route:${method}:${route}@${node.loc.start.line}`, node.consequent, false, true), parameters: fn.params });
+        }
+      }, true);
+    });
+    walk(ast.program, (node) => {
+      if (node.type !== "CallExpression" || node.callee.type !== "Identifier" || node.callee.name !== "fetch") return;
+      const url = node.arguments[0];
+      const value = url?.type === "StringLiteral" ? url.value : url?.type === "TemplateLiteral" ? url.quasis[0]?.value.cooked : void 0;
+      if (!value || !/^https?:\/\//.test(value)) return;
+      let host;
+      try {
+        host = new URL(value).hostname;
+      } catch {
+        return;
+      }
+      const provider = PROVIDERS.find((p) => p.signatures.hosts?.some((h2) => host === h2 || host.endsWith("." + h2)));
+      const toolId = provider && tools.get(provider.id);
+      if (!toolId) return;
+      const methodNode = node.arguments[1]?.properties?.find((p) => p.key?.name === "method" || p.key?.value === "method")?.value;
+      const method = methodNode ? methodNode.type === "StringLiteral" ? methodNode.value.toUpperCase() : "UNKNOWN" : "GET";
+      const line = node.loc.start.line;
+      operations.push({ path: path2, line, toolId, kind: method === "GET" || method === "HEAD" ? "reads" : "writes", label: `HTTP ${method} ${host}`, resource: provider.id, ref: `${path2}:${line}` });
+    });
+  }
+  const adjacency = /* @__PURE__ */ new Map();
+  const resolveCalls = (entry) => {
+    const cached = adjacency.get(entry);
+    if (cached) return cached;
+    const found = /* @__PURE__ */ new Set();
+    const boundNames = (nodes) => {
+      const names = /* @__PURE__ */ new Set();
+      for (const node of nodes) walk(node, (part) => {
+        if (part.type === "Identifier") names.add(part.name);
+      });
+      return names;
+    };
+    const scan = (node, shadowed) => {
+      if (!node || typeof node !== "object") return;
+      if (node.type === "FunctionDeclaration") return;
+      if (["ArrowFunctionExpression", "FunctionExpression"].includes(node.type)) {
+        scan(node.body, /* @__PURE__ */ new Set([...shadowed, ...boundNames(node.params)]));
+        return;
+      }
+      if (node.type === "BlockStatement") {
+        shadowed = new Set(shadowed);
+        for (const statement of node.body) {
+          if (statement.type === "VariableDeclaration") for (const declaration of statement.declarations) for (const name of boundNames([declaration.id])) shadowed.add(name);
+          if (statement.type === "FunctionDeclaration" && statement.id) shadowed.add(statement.id.name);
+        }
+      }
+      if (node.type === "CallExpression" && node.callee.type === "Identifier" && !shadowed.has(node.callee.name)) {
+        const mod = modules.get(entry.path);
+        const local = mod.functions.get(node.callee.name);
+        const imported = mod.imports.get(node.callee.name);
+        const target = local ?? (imported ? modules.get(imported.path)?.functions.get(imported.name) : void 0);
+        if (target && (local || target.exported)) found.add(target);
+      }
+      for (const [key, child] of Object.entries(node)) {
+        if (["loc", "start", "end", "comments", "tokens"].includes(key)) continue;
+        if (Array.isArray(child)) child.forEach((item) => scan(item, shadowed));
+        else if (child && typeof child === "object") scan(child, shadowed);
+      }
+    };
+    scan(entry.node, boundNames(entry.parameters ?? []));
+    const result = [...found];
+    adjacency.set(entry, result);
+    return result;
+  };
+  const byPath = /* @__PURE__ */ new Map();
+  for (const operation of operations) {
+    const list2 = byPath.get(operation.path) ?? [];
+    list2.push(operation);
+    byPath.set(operation.path, list2);
+  }
+  const directEffects = /* @__PURE__ */ new Map();
+  const effects = (unit) => {
+    let result = directEffects.get(unit);
+    if (!result) {
+      result = (byPath.get(unit.path) ?? []).filter((op) => op.line >= unit.startLine && op.line <= unit.endLine);
+      directEffects.set(unit, result);
+    }
+    return result;
+  };
+  const entries = [];
+  for (const mod of modules.values()) {
+    for (const entry of [...new Set(mod.functions.values()), ...mod.routes]) {
+      if (!entry.exported && !entry.trigger) continue;
+      if (!entry.trigger && mod.routes.some((route) => route.startLine >= entry.startLine && route.endLine <= entry.endLine)) continue;
+      const visited = /* @__PURE__ */ new Set();
+      const pending = [entry];
+      while (pending.length) {
+        const current = pending.pop();
+        if (visited.has(current)) continue;
+        visited.add(current);
+        pending.push(...resolveCalls(current));
+      }
+      const calls = [...new Set([...visited].flatMap(effects))];
+      if (!entry.trigger && !calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
+      entries.push({ ...entry, calls, evidence: [...visited].map((u) => ({ source: "static", ref: `${u.path}:${u.startLine}` })) });
+    }
+  }
+  return { entries, gaps };
+}
+
 // src/inventory/operations.ts
 var WRITE_VERBS = /* @__PURE__ */ new Set([
   "create",
@@ -7194,32 +7383,47 @@ async function buildRelationships(apps, tools, files, decisions) {
       verified: false
     });
   }
-  for (const [path2, text] of sourceText) {
+  const allowedCalls = entrypointCalls.filter((call) => decidedRecords.some((record2) => record2.toolId === call.toolId && record2.kind === call.kind && record2.evidence.some((e) => e.ref === call.ref)));
+  const graph = workflowGraph(sourceText, allowedCalls, new Map(providerTools.map((t) => [t.providerId, t.id])));
+  gaps.push(...graph.gaps);
+  const entries = graph.entries.map((entry) => ({ ...entry, evidence: entry.evidence }));
+  for (const [path2, text] of sourceText) for (const entry of exportedEntrypoints(text)) {
+    if (!/^(route|job):/.test(entry.name)) continue;
+    entries.push({
+      ...entry,
+      path: path2,
+      node: {},
+      exported: false,
+      trigger: true,
+      calls: allowedCalls.filter((call) => call.path === path2 && call.line >= entry.startLine && call.line <= entry.endLine),
+      evidence: [{ source: "static", ref: `${path2}:${entry.startLine}` }]
+    });
+  }
+  for (const entry of entries) {
+    const { path: path2 } = entry;
     const app = appForPath(apps, path2);
-    for (const entry of exportedEntrypoints(text)) {
-      const calls = entrypointCalls.filter((call) => call.path === path2 && call.line >= entry.startLine && call.line <= entry.endLine && decidedRecords.some((record2) => record2.toolId === call.toolId && record2.kind === call.kind && record2.evidence.some((e) => e.ref === call.ref)));
-      if (!calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
-      const dependencies = [...new Set(calls.map((call) => call.toolId))];
-      const evidence = [...new Set(calls.map((call) => call.ref))].map((ref) => ({ source: "static", ref }));
-      workflows.push({
-        id: "entry:" + createHash12("sha256").update(path2 + ":" + entry.name).digest("hex").slice(0, 20),
-        title: entry.name,
-        entrypoint: path2 + "#" + entry.name,
-        apps: [app.id],
-        tools: dependencies,
-        steps: dependencies.map((tool2) => ({ app: app.id, tool: tool2, operations: [...new Set(calls.filter((c) => c.toolId === tool2).map((c) => c.label))], evidence })),
-        sharedEntities: [...new Set(calls.map((call) => singularize(call.resource)))],
-        evidence,
-        confidence: "medium",
-        risk: "high",
-        rank: 0,
-        supported: false,
-        hypothesis: true,
-        linkingSignals: ["callable export or route/job handler containing binding-resolved side effects; invocation and correctness require review"],
-        scopeUncertain: true,
-        verified: false
-      });
-    }
+    const calls = entry.calls.filter((call) => !rejected.has(opRelId(appForPath(apps, call.path).id, call.toolId, call.kind)));
+    if (!entry.trigger && !calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
+    const dependencies = [...new Set(calls.map((call) => call.toolId))];
+    const evidence = [...new Map([...entry.evidence, ...calls.map((call) => ({ source: "static", ref: call.ref }))].map((ref) => [ref.ref, ref])).values()];
+    workflows.push({
+      id: "entry:" + createHash12("sha256").update(path2 + ":" + entry.name).digest("hex").slice(0, 20),
+      title: entry.name,
+      entrypoint: path2 + "#" + entry.name.replace(/\\/g, "%5C"),
+      apps: [app.id],
+      tools: dependencies,
+      steps: dependencies.map((tool2) => ({ app: app.id, tool: tool2, operations: [...new Set(calls.filter((c) => c.toolId === tool2).map((c) => c.label))], evidence })),
+      sharedEntities: [...new Set(calls.map((call) => singularize(call.resource)))],
+      evidence,
+      confidence: "medium",
+      risk: "high",
+      rank: 0,
+      supported: false,
+      hypothesis: true,
+      linkingSignals: [entry.trigger ? "explicit request or background-job trigger" : "exported operation with statically linked provider effects", "local helper call chains are possible paths, not proof of runtime execution; invocation and correctness require review"],
+      scopeUncertain: true,
+      verified: false
+    });
   }
   if (sourceFiles.length === MAX_FILES3) gaps.push("Source scan is limited to 2500 files; split large repositories into explicit roots. Not every workflow can be proven by static discovery.");
   const finalWorkflows = workflows.filter((w) => !rejected.has(w.id)).map(
@@ -7878,6 +8082,10 @@ function scenariosFor(kind) {
   return [...new Set(list2)];
 }
 function assertionsFor(candidate) {
+  if (candidate.entrypoint) return [
+    `define the expected response/output for ${candidate.entrypoint}`,
+    "review required final state and forbidden effects; discovery does not infer business correctness"
+  ];
   const entity = candidate.sharedEntities[0] ?? "record";
   return [
     `exactly one ${entity} write is applied (no duplicates)`,
@@ -7900,7 +8108,7 @@ function buildWorkflowPlans(candidates, _tools) {
       ),
       sharedEntities: candidate.sharedEntities,
       permissions: permissionsFor(kind, candidate.sharedEntities),
-      asyncEvents: eventsFor(kind, candidate.sharedEntities),
+      asyncEvents: candidate.entrypoint ? [] : eventsFor(kind, candidate.sharedEntities),
       failureScenarios: scenariosFor(kind),
       outcomeAssertions: assertionsFor(candidate),
       unknowns: [