candor-ts 0.8.10 → 0.8.13

package/lsp.mjs

@@ -352,6 +352,9 @@ function runFix(a) {
     if (r.cleanHoist) {
       lines.push(`hoist ${a.effect} to: ${r.hoistTo.join(", ")}`);
       lines.push(`then pure (thread the value): ${r.deniedSpan.join(", ")}`);
+      if (r.hoistHigher?.length) {
+        lines.push(`or hoist higher (up to ${r.hoistHigher.slice(0, 4).join(", ")}): keeps the frontier pure too, threads through more signatures`);
+      }
     } else {
       lines.push("no clean hoist — introduce a port (inject the effect from an allowed layer), or relax the boundary");
     }

package/mcp.mjs

@@ -191,7 +191,11 @@ const TOOLS = {
         if (!cfg) throw new Error("no policy: pass `policy`, or check one into the repo's .candor/config (spec §3.4) — the fix is defined relative to the boundary it crosses");
         text = confinedPolicyRead(cfg.policyPath, p, cfg.repoRoot);
       }
-      const r = Q.fix(Q.loadCallgraph(p), Q.loadReport(p), a.fn, a.effect, parsePolicy(text), scopeMatches);
+      const cg = Q.loadCallgraph(p);
+      // The sidecar is the only graph a candor-ts report carries — fail loud (tool error) when it's absent,
+      // never a degenerate empty-graph remedy. (/code-review.)
+      if (!cg || Object.keys(cg).length === 0) throw new Error(`no call-graph sidecar for the report — fix needs it (re-scan with --out)`);
+      const r = Q.fix(cg, Q.loadReport(p), a.fn, a.effect, parsePolicy(text), scopeMatches);
       if (r === null) throw new Error(`no function matching \`${clip(a.fn)}\` in the call graph`);
       return r;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.8.10",
+  "version": "0.8.13",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.8)",
   "type": "module",
   "dependencies": {

package/query-core.mjs

@@ -527,7 +527,9 @@ function computeRemedy(start, eff, layer, cg, rev, byName, policyParsed, scopeMa
     const cur = up.shift();
     for (const caller of rev.get(cur) ?? []) {
       const ce = byName.get(caller);
-      if (ce && !(ce.inferred ?? []).includes(eff)) continue; // doesn't route the effect
+      // skip a caller that doesn't route the effect — INCLUDING one absent from the report (a pure
+      // callgraph-only node never carries the effect). Matches candor-swift. (/code-review — was `ce && !…`.)
+      if (!ce || !(ce.inferred ?? []).includes(eff)) continue;
       if (deniedLayer(caller, eff, policyParsed, scopeMatches) !== null) {
         if (!deniedSpan.has(caller)) { deniedSpan.add(caller); up.push(caller); }
       } else {
@@ -535,12 +537,37 @@ function computeRemedy(start, eff, layer, cg, rev, byName, policyParsed, scopeMa
       }
     }
   }
+  // higher hoist options: allowed-layer transitive callers of the minimal frontier that also route the
+  // effect — hoisting higher keeps the frontier pure too, at the cost of threading through more signatures
+  // (FIX-SPEC: the trade-off, disclosed not hidden).
+  // The SANDWICHED-layer check (/code-review): a hoist is CLEAN only if no forbidden fn sits ABOVE the
+  // frontier. If a denied fn calls into a hoist target, hoisting the effect there leaves that caller
+  // violating. Detected in the same climb that gathers `hoistHigher` (the allowed ancestors).
+  const hoistHigher = new Set();
+  let sandwiched = false;
+  const hseen = new Set(hoistTo);
+  const hq = [...hoistTo];
+  while (hq.length) {
+    const cur = hq.shift();
+    for (const caller of rev.get(cur) ?? []) {
+      const ce = byName.get(caller);
+      if (!ce || !(ce.inferred ?? []).includes(eff)) continue;
+      if (deniedLayer(caller, eff, policyParsed, scopeMatches) !== null) {
+        sandwiched = true;
+      } else if (!hseen.has(caller)) {
+        hseen.add(caller);
+        hoistHigher.add(caller);
+        hq.push(caller);
+      }
+    }
+  }
   return {
     fn: start, effect: eff, layer,
-    cleanHoist: hoistTo.size > 0,
+    cleanHoist: hoistTo.size > 0 && !sandwiched,
     site: [...sites].sort(),
     deniedSpan: [...deniedSpan].sort(),
     hoistTo: [...hoistTo].sort(),
+    hoistHigher: [...hoistHigher].sort(),
     policyAlternative: layer ? `allow ${eff} ${layer}` : `allow ${eff}`,
   };
 }
@@ -548,10 +575,14 @@ function computeRemedy(start, eff, layer, cg, rev, byName, policyParsed, scopeMa
 // fix: the boundary remedy for ONE function (the remedial inverse of whatif). Returns null if the function
 // isn't in the graph; `{ crossing:false, reason }` if it performs the effect but no policy forbids it there
 // (or it doesn't perform it) — a no-op the caller reports plainly; else the full remedy (`crossing:true`).
+// NOTE: `cg` (the callgraph sidecar) is REQUIRED — unlike candor-query/java/swift, a candor-ts report does not
+// embed inline `calls`, so the sidecar is the only graph; the CLI/MCP callers fail loud when it's absent
+// rather than compute a degenerate empty-graph remedy. (/code-review.)
 export function fix(cg, fns, target, eff, policyParsed, scopeMatches) {
-  const names = new Set(Object.keys(cg));
-  for (const e of fns) names.add(e.fn);
-  const m = matches([...names], target);
+  // Resolve against REPORT function names only (not callgraph nodes, which include pure fns absent from the
+  // report) — so `fix <pure-fn>` is a uniform "no such fn" across engines, not a TS-only crossing:false.
+  // (/code-review — candor-query/java/swift all match report fns only.)
+  const m = matches(fns.map((e) => e.fn), target);
   if (m.length === 0) return null;
   const byName = indexFns(fns);
   // prefer a match that actually performs the effect, so a bare leaf resolves to the violating function
@@ -573,8 +604,10 @@ export function fixGate(cg, fns, policyParsed, scopeMatches) {
   const byName = indexFns(fns);
   const rev = reverseGraph(cg);
   const plans = new Map();
-  for (const e of fns) {
-    for (const eff of (e.inferred ?? [])) {
+  // Iterate functions in sorted-name order so the first-writer-wins `fn` representative of a collapsed
+  // remedy is deterministic across engines (candor-query/java/swift all iterate a sorted key set).
+  for (const e of [...fns].sort((a, b) => (a.fn < b.fn ? -1 : a.fn > b.fn ? 1 : 0))) {
+    for (const eff of [...(e.inferred ?? [])].sort()) {
       const layer = deniedLayer(e.fn, eff, policyParsed, scopeMatches);
       if (layer !== null) {
         const p = computeRemedy(e.fn, eff, layer, cg, rev, byName, policyParsed, scopeMatches);
@@ -583,6 +616,7 @@ export function fixGate(cg, fns, policyParsed, scopeMatches) {
       }
     }
   }
-  const remedies = [...plans.values()];
+  // Emit remedies in dedup-key order (candor-query BTreeMap / java TreeMap / swift sorted-keys all do).
+  const remedies = [...plans.keys()].sort().map((k) => plans.get(k));
   return { ok: remedies.length === 0, remedies };
 }

package/query.mjs

@@ -263,7 +263,11 @@ switch (cmd) {
     let ptext;
     try { ptext = fs.readFileSync(policyFile, "utf8"); }
     catch { console.error(`candor: policy ${policyFile} could not be read — no fix computed`); process.exit(2); }
-    const r = coreFix(loadCallgraph(prefix), loadReport(prefix), target, eff, parsePolicy(ptext), scopeMatches);
+    const cg = loadCallgraph(prefix);
+    // The sidecar is the ONLY graph a candor-ts report carries (it embeds no inline `calls`). Fail LOUD when
+    // it's absent — never compute a degenerate empty-graph remedy that reads as a false "no clean hoist".
+    if (!cg || Object.keys(cg).length === 0) { console.error(`candor: no call-graph sidecar for '${prefix}' — fix needs it (re-run: candor-ts <src> --out ${prefix})`); process.exit(2); }
+    const r = coreFix(cg, loadReport(prefix), target, eff, parsePolicy(ptext), scopeMatches);
     if (r === null) { console.error(`candor: no function matching \`${target}\` in the call graph`); process.exit(2); }
     emit(r);
     break;
@@ -275,7 +279,9 @@ switch (cmd) {
     let ptext;
     try { ptext = fs.readFileSync(policyFile, "utf8"); }
     catch { console.error(`candor: policy ${policyFile} could not be read — no fix computed`); process.exit(2); }
-    emit(coreFixGate(loadCallgraph(prefix), loadReport(prefix), parsePolicy(ptext), scopeMatches));
+    const cg = loadCallgraph(prefix);
+    if (!cg || Object.keys(cg).length === 0) { console.error(`candor: no call-graph sidecar for '${prefix}' — fix-gate needs it (re-run: candor-ts <src> --out ${prefix})`); process.exit(2); }
+    emit(coreFixGate(cg, loadReport(prefix), parsePolicy(ptext), scopeMatches));
     break;
   }
   default: