candor-ts 0.9.0 → 0.9.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.9)",
   "type": "module",
   "dependencies": {

package/scan-core.mjs

@@ -123,6 +123,18 @@ export const KAPPA_RULES = [
   [/^open$/, /^(open|openApp)$/, "Exec"],
   [/^(fs-extra|graceful-fs|rimraf|glob|chokidar)$/, null, "Fs"],
   [/^dotenv$/, null, "Env"],
+  // CLI-tool packages surfaced by the 0.9 dogfood on `zx` (read `invisible` before — a κ-coverage gap, not
+  // a cardinal sin; modeled against each package's SOURCE, not its name):
+  // - `which`: resolves an executable by stat-ing PATH candidates (via `isexe`) — Fs. Both the async default
+  //   `which(cmd)` and `which.sync(cmd)` hit the filesystem; no pure member → whole-module Fs.
+  [/^which$/, null, "Fs"],
+  // - `@webpod/ps`: process listing/kill — kill/lookup/lookupSync/tree/treeSync ALL spawn the OS via
+  //   `exec({...})` (zurk/spawn) — verified in ps.js. Uniform process surface, no pure member → Exec.
+  [/^@webpod\/ps$/, null, "Exec"],
+  // - `envapi` (a dotenv variant): MIXED — `parse`/`stringify` are pure string transforms; `load`/`loadSafe`/
+  //   `config` READ the .env file (`fs.readFileSync`). Member-precise so `parse` never fabricates Fs (the
+  //   argon2 curated-κ lesson: model the effectful member, never blanket-grant a mixed package).
+  [/^envapi$/, /^(load|loadSafe|config)$/, "Fs"],
   [/^(winston|pino|bunyan|npmlog)$/, null, "Log"],
   // nest-winston wraps winston; the injected logger's level verbs are the Log boundary (the
   // WinstonModule.createLogger/forRoot config is inert).

package/scan.mjs

@@ -273,14 +273,25 @@ if (!wantJson) fs.mkdirSync(path.dirname(path.resolve(outPrefix)), { recursive:
 // would "succeed" with a near-total-Unknown report a fresh user could ship (CTA-dogfood finding).
 // Warn LOUDLY; the report is still written (it is sound), but the cause must be visible.
 {
-  const pkg = path.join(rootDir, "package.json");
-  if (fs.existsSync(pkg) && !fs.existsSync(path.join(rootDir, "node_modules"))) {
+  // Find the nearest package.json AT OR ABOVE the scan root: scanning a `src/` subdirectory must still see
+  // the project manifest one level up, else the warning stays silent and a deps-less scan reads as a
+  // codebase full of spurious `Unknown`s (the exact trap a 0.9 dogfood fell into — scanning `zx/src`).
+  let projDir = null;
+  for (let d = rootDir; ; d = path.dirname(d)) {
+    if (fs.existsSync(path.join(d, "package.json"))) { projDir = d; break; }
+    if (path.dirname(d) === d) break;                       // filesystem root
+  }
+  if (projDir && !fs.existsSync(path.join(projDir, "node_modules"))) {
     try {
-      const deps = JSON.parse(fs.readFileSync(pkg, "utf8")).dependencies ?? {};
+      // BOTH dependency kinds: `npm install` installs devDependencies too, and a project can import a
+      // dev/vendored package in its source (zx imports `chalk` as a devDependency) — a `dependencies`-only
+      // check left exactly that case unwarned.
+      const pj = JSON.parse(fs.readFileSync(path.join(projDir, "package.json"), "utf8"));
+      const deps = { ...(pj.dependencies ?? {}), ...(pj.devDependencies ?? {}) };
       if (Object.keys(deps).length > 0)
-        console.error("candor-ts: WARNING — the target declares dependencies but has no node_modules; " +
-                      "imports won't resolve, so calls into those packages read pure/invisible (not Unknown) " +
-                      "and effects through them are silently dropped. Run `npm install` in the target first.");
+        console.error("candor-ts: WARNING — the project declares dependencies but has no node_modules; " +
+                      "imports won't resolve, so calls into those packages can't be analyzed (they read " +
+                      "`Unknown`, and their types don't resolve). Run `npm install` in the project first.");
     } catch {}
   }
   // Prisma's client types are GENERATED — a project with the prisma dependency but no generated