crewforth 3.2.0-rc.1 → 3.2.0-rc.3

package/kit/eval/lib/crew-map/scan.mjs

@@ -24,15 +24,15 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { openProject, loadSecretPatterns, makeHostFilter, sortEv, bearsValues, risky, spawned, isTestPath } from './project.mjs';
-import { scanStacks } from './stacks.mjs';
-import { externals, configuration, codeUrls, endpoints, containers } from './surface.mjs';
+import { openProject, loadSecretPatterns, makeHostFilter, sortEv, bearsValues, risky, spawned, isTestPath, ev } from './project.mjs';
+import { scanStacks, applyTech } from './stacks.mjs';
+import { externals, configuration, codeUrls, servedCalls, endpoints, containers } from './surface.mjs';
 import { detect } from './detect.mjs';
 import { stamp, write, serialize, validate, OUT_DIR } from '../findings/findings.mjs';
 import { carry, strip, validate as validateNarrative } from './narrative.mjs';
 
 // Languages with source the scanner has no reader for, by extension.
-const UNREAD = { dart: 'Dart', swift: 'Swift', rb: 'Ruby', php: 'PHP', rs: 'Rust', scala: 'Scala', ex: 'Elixir', exs: 'Elixir',
+const UNREAD = { swift: 'Swift', rb: 'Ruby', php: 'PHP', rs: 'Rust', scala: 'Scala', ex: 'Elixir', exs: 'Elixir',
   c: 'C', cc: 'C++', cpp: 'C++', m: 'Objective-C', mm: 'Objective-C', lua: 'Lua', clj: 'Clojure', hs: 'Haskell', erl: 'Erlang' };
 
 const SELF = fileURLToPath(import.meta.url);
@@ -43,6 +43,50 @@ const MAX_EV = 5;
 const load = (f) => JSON.parse(fs.readFileSync(path.join(HERE, 'rules', f), 'utf8'));
 const cmp = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 
+/**
+ * What is inside a module, for a reader who has not opened it: its folders and how many source files each holds.
+ * A folder holding nearly everything (lib/ of a Flutter app, src/ of a package) is opened one level, at most twice,
+ * so the rows say lib/data and lib/features and not just lib. Tests are counted apart. Twelve rows at most.
+ */
+const MAX_ROWS = 12;
+
+/**
+ * What a module says about itself: the first line of prose in its own README (a heading, a badge, an image, an
+ * HTML tag or a code fence is not prose). Kept apart from the evidence, which is cut at five lines, so a
+ * description always has a line to rest on that says what the module is for. Measured on a real project: four of
+ * ten modules were left undescribed because the only line the scan cited for them was the manifest's name.
+ */
+function aboutOf(pj, m) {
+  const base = m.dir === '.' ? '' : `${m.dir}/`;
+  const f = pj.files.find((x) => x.startsWith(base) && /^readme(\.(md|markdown|txt|rst))?$/i.test(x.slice(base.length)));
+  const src = f && pj.read(f); if (!src) return null;
+  let fence = false;
+  for (const [i, raw] of src.lines.entries()) {
+    const l = raw.trim();
+    if (/^(```|~~~)/.test(l)) { fence = !fence; continue; }
+    if (fence || !l || /^(#|=+$|-+$|\[!|!\[|<|\||>\s*\[!)/.test(l)) continue;
+    return { evidence: [ev(f, i + 1, l.slice(0, 60))] };
+  }
+  return null;
+}
+function structure(m) {
+  const base = m.dir === '.' ? '' : `${m.dir}/`;
+  let rel = m.files.filter((f) => !isTestPath(f)).map((f) => f.slice(base.length));
+  const tests = m.files.length - rel.length;
+  let at = '';
+  const group = (list) => { const g = new Map(); for (const r of list) { const k = r.includes('/') ? r.split('/')[0] : ''; g.set(k, (g.get(k) ?? 0) + 1); } return g; };
+  for (let d = 0; d < 2 && rel.length; d++) {
+    const [top, n] = [...group(rel)].sort((a, b) => b[1] - a[1] || cmp(a[0], b[0]))[0];
+    if (!top || n / rel.length < 0.8 || !rel.some((r) => r.startsWith(`${top}/`) && r.split('/').length > 2)) break;
+    at += `${top}/`; rel = rel.filter((r) => r.startsWith(`${top}/`)).map((r) => r.slice(top.length + 1));
+  }
+  const rows = [...group(rel)].map(([k, n]) => ({ folder: k ? `${at}${k}` : (at.replace(/\/$/, '') || '.'), files: n }))
+    .sort((a, b) => b.files - a.files || cmp(a.folder, b.folder));
+  const shown = rows.slice(0, MAX_ROWS);
+  const rest = rows.slice(MAX_ROWS).reduce((s, r) => s + r.files, 0);
+  return { folders: shown, ...(rest ? { otherFiles: rest } : {}), testFiles: tests };
+}
+
 // opts.hostFilter replaces the masking: ONLY the gate's must-fail twin uses it. No command-line flag reaches it.
 export function scan(root = '.', opts = {}) {
   const pj = openProject(root);
@@ -51,10 +95,12 @@ export function scan(root = '.', opts = {}) {
   const rules = load('packages.json'); const names = load('names.json');
   const stdlib = new Set(load('python-stdlib.json').modules);
   const st = scanStacks(pj);
+  applyTech(st, pj, load('tech.json'));
   const out = { edges: [], notMeasured: st.notMeasured, configUrls: [], codeHosts: new Set(), patterns };
   const ex = externals(pj, st, rules, hostOf, out);
   const cfg = configuration(pj, st, rules, hostOf, ex, out);
   codeUrls(pj, st, hostOf, ex, out);
+  servedCalls(pj, st, ex, out);
   const eps = endpoints(pj, st, out);
   const services = containers(pj, st, rules, hostOf, ex, cfg, out);
   const findings = detect({ st, cfg, eps, names, stdlib, notMeasured: out.notMeasured, configUrls: out.configUrls, codeHosts: out.codeHosts });
@@ -73,6 +119,9 @@ export function scan(root = '.', opts = {}) {
     const lang = UNREAD[/\.([a-z]+)$/i.exec(f)?.[1]?.toLowerCase()];
     if (lang && !isTestPath(f)) unread.set(lang, (unread.get(lang) ?? 0) + 1);
   }
+  // Dart is read through its pubspec.yaml: a .dart file no package owns has no module to be drawn in, so it is said.
+  const loose = pj.files.filter((f) => /\.dart$/.test(f) && !isTestPath(f) && !st.modules.some((m) => m.stack === 'dart' && m.files.includes(f))).length;
+  if (loose) out.notMeasured.push({ what: `Dart source outside any pubspec.yaml (${loose} file${loose === 1 ? '' : 's'})`, reason: 'no package owns it: it is not on the map' });
   for (const [lang, n] of unread) out.notMeasured.push({ what: `${lang} source (${n} file${n === 1 ? '' : 's'})`, reason: 'no reader for this language: its modules, dependencies and endpoints are not on the map' });
 
   // ---- one edge per (from, to, kind, confidence), its evidence merged ----
@@ -94,6 +143,8 @@ export function scan(root = '.', opts = {}) {
       // line to cite: the entry is then the file, and it says so.
       ...(m.entry ? { entryPoint: m.entryEv ? { evidence: [m.entryEv] } : { file: m.entryFile, evidence: [] } } : {}),
       dependencies: m.deps.length,
+      structure: structure(m),
+      ...((() => { const a = aboutOf(pj, m); return a ? { about: a } : {}; })()),
       ...capped(m.evidence), narrative: null })),
     ...services.map((s) => ({ id: s.id, kind: 'service', name: s.name, ...(s.image ? { image: s.image } : {}), ...capped(s.evidence), narrative: null })),
     ...[...ex.ext.values()].map((n) => ({ id: n.id, kind: 'external', resource: n.resource, label: n.label, hosts: [...n.hosts].sort(), ...capped(n.evidence), narrative: null })),
@@ -122,6 +173,7 @@ export function scan(root = '.', opts = {}) {
     findings,
     notMeasured: [...nm.values()].sort((a, b) => cmp(`${a.what}\u0000${a.reason}`, `${b.what}\u0000${b.reason}`)),
     overview: null,
+    tour: null,
   };
   // The last net, whatever cited it: a quote is cut before anything that looks like a credential, and a line that
   // carries values (by its file, or by what is on it) is never hashed.

package/kit/eval/lib/crew-map/stacks.mjs

@@ -1,5 +1,5 @@
 // stacks.mjs — modules, their declared dependencies, their imports and their references to each other, for the
-// five stacks. Every fact carries the line it was read from; what cannot be read is returned as notMeasured.
+// six stacks. Every fact carries the line it was read from; what cannot be read is returned as notMeasured.
 //
 // A module is { id, name, stack, dir, manifest, tech[], evidence[], deps[], refs[], imports[], entry, entryEv,
 //              aliases[], selfNames[], files[] }.
@@ -10,7 +10,7 @@
 // (a namespace prefix, a Gradle line read by pattern).
 
 import path from 'node:path';
-import { parseJsonc, parseToml, parseXml, xKids, xKid, xText, xLine, xFind, Unsupported } from './parse.mjs';
+import { parseJsonc, parseToml, parseXml, parseYaml, yGet, xKids, xKid, xText, xLine, xFind, Unsupported } from './parse.mjs';
 import { ev, evFirst, lineOf, isTestPath } from './project.mjs';
 
 const P = path.posix;
@@ -20,7 +20,7 @@ const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 const isComment = (l) => /^\s*(\/\/|#|\*|\/\*|<!--)/.test(l);
 
 export const SOURCE_EXT = {
-  node: /\.(m?[jt]sx?|cjs|cts|mts)$/, python: /\.py$/, go: /\.go$/, dotnet: /\.cs$/, java: /\.(java|kt)$/,
+  node: /\.(m?[jt]sx?|cjs|cts|mts)$/, python: /\.py$/, go: /\.go$/, dotnet: /\.cs$/, java: /\.(java|kt)$/, dart: /\.dart$/,
 };
 
 function mod(stack, name, manifest, dir) {
@@ -28,6 +28,22 @@ function mod(stack, name, manifest, dir) {
     imports: [], entry: false, entryEv: null, aliases: [], selfNames: [name], files: [] };
 }
 
+/**
+ * What each module is built with, from rules/tech.json: a package its manifest declares, or a file at its root.
+ * Labels are words a newcomer reads (Hono, Cloudflare Workers, Flutter), not versions; frameworks before tools, in
+ * the order of the rules. Before, only nine npm frameworks were named and a Node module read as "node".
+ */
+export function applyTech(st, pj, rules) {
+  const has = new Set(pj.files);
+  for (const m of st.modules) {
+    const deps = new Set(m.deps.map((d) => `${d.eco}\t${d.name}`));
+    for (const [eco, list] of Object.entries(rules?.packages ?? {})) for (const [name, label] of list) if (deps.has(`${eco}\t${name}`)) m.tech.add(label);
+    const base = m.dir === '.' ? '' : `${m.dir}/`;
+    for (const [file, label] of rules?.files ?? []) if (has.has(`${base}${file}`)) m.tech.add(label);
+    if (m.stack === 'node' && !m.tech.has('TypeScript') && m.files.some((f) => /\.(ts|tsx|mts|cts)$/.test(f))) m.tech.add('TypeScript');
+  }
+}
+
 // A version the map may show. A dependency can be declared by URL (git+https://token@host/repo.git#v1), and a URL
 // is never copied out: it reads as 'url', which no detector compares.
 export function cleanVersion(v) {
@@ -48,7 +64,7 @@ function runnable(m) {
 
 // Hand each source file to the deepest module of its stack whose directory holds it.
 // A file under a sample project's own manifest (left out of discovery) belongs to that sample, so to nobody here.
-const MANIFEST = /(^|\/)(package\.json|pyproject\.toml|setup\.cfg|requirements[^/]*\.txt|go\.mod|[^/]+\.(cs|fs|vb)proj|pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?)$/;
+const MANIFEST = /(^|\/)(package\.json|pyproject\.toml|setup\.cfg|requirements[^/]*\.txt|go\.mod|[^/]+\.(cs|fs|vb)proj|pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|pubspec\.yaml)$/;
 function own(modules, files, stack) {
   const mine = modules.filter((m) => m.stack === stack).sort((a, b) => b.dir.length - a.dir.length);
   const samples = files.filter((f) => MANIFEST.test(f) && isTestPath(f)).map(dirOf);
@@ -76,9 +92,6 @@ function nodeStack(pj, out) {
       if (!v[sect] || typeof v[sect] !== 'object') continue;
       for (const [dn, ver] of Object.entries(v[sect])) m.deps.push({ eco: 'npm', name: dn, version: cleanVersion(ver), dev, peer: sect === 'peerDependencies', ev: ev(f, L([sect, dn]), dn) });
     }
-    for (const fw of ['next', 'react', 'vue', 'svelte', '@angular/core', 'express', 'fastify', '@nestjs/core', 'vite']) {
-      const d = m.deps.find((x) => x.name === fw && x.version !== 'url'); if (d) m.tech.add(`${fw}@${d.version.replace(/^[\^~>=<\s]+/, '')}`);
-    }
     if (v.bin) { m.entry = true; m.entryEv = ev(f, L(['bin']), 'bin'); }
     else if (v.scripts && (v.scripts.start || v.scripts.dev)) { const k = v.scripts.start ? 'start' : 'dev'; m.entry = true; m.entryEv = ev(f, L(['scripts', k]), k); }
     else if (v.workspaces) { m.entry = true; m.entryEv = ev(f, L(['workspaces']), 'workspaces'); }
@@ -265,6 +278,98 @@ function goStack(pj, out) {
   }
 }
 
+// ---- Dart / Flutter -------------------------------------------------------------------------------------------
+// One module per pubspec.yaml. A `path:` dependency names another module of this repository (a reference); a
+// `sdk: flutter` dependency makes it a Flutter module. Its .dart files import `package:<name>/…`: another module's
+// name is a reference, anything else a package it uses; `dart:` is the SDK. lib/main.dart or bin/ is an entry, and
+// so is a tool/ script with a main() (`dart run tool/x.dart` is how a package's own command is run).
+// Before this reader, a Flutter repository's app and its packages were not on the map at all (measured on a real
+// project: 5 Dart modules, 949 .dart files, none drawn).
+function dartStack(pj, out) {
+  const made = [];
+  for (const f of pj.manifests.filter((x) => P.basename(x) === 'pubspec.yaml')) {
+    const src = pj.read(f); if (!src) continue;
+    let y; try { y = parseYaml(src.text); } catch (e) { out.notMeasured.push({ what: f, reason: `pubspec.yaml outside the subset this scanner reads: ${e.message}` }); continue; }
+    const nm = yGet(y, 'name');
+    if (!nm || nm.v.t !== 'str' || !nm.v.v) { out.notMeasured.push({ what: f, reason: 'pubspec.yaml has no name' }); continue; }
+    const m = mod('dart', nm.v.v, f, dirOf(f));
+    m.evidence.push(ev(f, nm.line, nm.v.v));
+    const paths = [];
+    for (const [key, dev] of [['dependencies', false], ['dev_dependencies', true]]) {
+      const block = yGet(y, key); if (!block || block.v.t !== 'map') continue;
+      for (const d of block.v.e) {
+        const e = ev(f, d.line, d.k);
+        if (d.v.t === 'map') {
+          const sdk = yGet(d.v, 'sdk'); const pth = yGet(d.v, 'path');
+          if (sdk && sdk.v.t === 'str') { if (sdk.v.v === 'flutter' && d.k === 'flutter') m.tech.add('Flutter'); continue; }
+          if (pth && pth.v.t === 'str') { paths.push({ to: P.normalize(P.join(m.dir === '.' ? '' : m.dir, pth.v.v)), name: d.k, ev: e }); continue; }
+          const v = yGet(d.v, 'version'); m.deps.push({ eco: 'pub', name: d.k, version: v && v.v.t === 'str' ? cleanVersion(v.v.v) : '', dev, ev: e });
+        } else {
+          m.deps.push({ eco: 'pub', name: d.k, version: d.v.t === 'str' ? cleanVersion(d.v.v) : '', dev, ev: e });
+        }
+      }
+    }
+    if (yGet(y, 'flutter')) m.tech.add('Flutter');
+    m._paths = paths;
+    out.modules.push(m); made.push(m);
+  }
+  if (!made.length) return;
+  own(out.modules, pj.files, 'dart');
+  const byName = new Map(made.map((m) => [m.name, m]));
+  for (const m of made) {
+    for (const p of m._paths) {
+      const t = made.find((o) => o.dir === p.to) ?? byName.get(p.name);
+      if (t && t !== m) m.refs.push({ to: t.id, toMod: t, ev: p.ev, confidence: 'evidence' });
+    }
+    delete m._paths;
+    for (const f of m.files) {
+      if (/(^|\/)(lib\/main\.dart|bin\/[^/]+\.dart)$/.test(f.slice(m.dir === '.' ? 0 : m.dir.length + 1)) && !m.entry) {
+        m.entry = true; m.entryEv = evFirst(f, pj.read(f)?.lines ?? []);
+      }
+      if (!m.entry && /^tool\/[^/]+\.dart$/.test(f.slice(m.dir === '.' ? 0 : m.dir.length + 1))) {
+        const i = (pj.read(f)?.lines ?? []).findIndex((l) => /^\s*(?:Future<void>|void)\s+main\s*\(/.test(l));
+        if (i >= 0) { m.entry = true; m.entryEv = ev(f, i + 1, 'main'); }
+      }
+      const src = pj.read(f); if (!src) continue;
+      src.lines.forEach((l, i) => {
+        const x = /^\s*(?:import|export)\s+['"]package:([A-Za-z0-9_]+)\/[^'"]*['"]/.exec(l);
+        if (!x) return;
+        const t = byName.get(x[1]);
+        if (t) { if (t !== m && !m.refs.some((r) => r.toMod === t)) m.refs.push({ to: t.id, toMod: t, ev: ev(f, i + 1, x[1]), confidence: 'evidence' }); return; }
+        if (x[1] === m.name) return;
+        m.imports.push({ spec: x[1], root: x[1], ev: ev(f, i + 1, x[1]), file: f });
+      });
+    }
+  }
+  // Flutter declares packages nothing imports (cupertino_icons is a font, flutter_lints a lint set, build_runner a
+  // command), so an unused-package rule would mostly be wrong here: it is not run, and that is said.
+  if (out.modules.some((m) => m.stack === 'dart')) out.notMeasured.push({ what: 'Dart package usage (dep-unused, dep-undeclared)', reason: 'Flutter declares packages that no file imports (fonts, lint sets, code generators), so a declared package is not proven unused' });
+}
+
+// A Flutter app holds its platforms as folders of their own: android/ is a Gradle project, ios/ an Xcode one. They
+// are how the app is built for each platform, not modules of the repository, so they are folded into the app: its
+// tech says Android / iOS, and the Gradle modules under it are not drawn on their own (measured on a real project:
+// two "unplaced" Gradle modules beside a Flutter app the map did not show).
+function foldPlatforms(pj, out) {
+  const apps = out.modules.filter((m) => m.stack === 'dart' && m.tech.has('Flutter'));
+  if (!apps.length) return;
+  const drop = new Set();
+  for (const a of apps) {
+    const base = a.dir === '.' ? '' : `${a.dir}/`;
+    for (const m of out.modules) {
+      if (m === a || m.stack !== 'java') continue;
+      if (m.dir === `${base}android` || m.dir.startsWith(`${base}android/`)) { drop.add(m); a.tech.add('Android'); }
+    }
+    if (pj.files.some((f) => f.startsWith(`${base}ios/`))) a.tech.add('iOS');
+  }
+  if (!drop.size) return;
+  out.modules = out.modules.filter((m) => !drop.has(m));
+  for (const m of out.modules) m.refs = m.refs.filter((r) => !drop.has(r.toMod));
+  // The Gradle notes were about those folders; with no Java module left on the map they speak of nothing.
+  if (!out.modules.some((m) => m.stack === 'java')) out.notMeasured = out.notMeasured.filter((x) => !JAVA_NOTES.has(x.what));
+}
+const JAVA_NOTES = new Set(['Gradle build logic', 'Java/Kotlin package usage (dep-unused, dep-undeclared)']);
+
 // ---- .NET ---------------------------------------------------------------------------------------------------
 function dotnetStack(pj, out) {
   const central = new Map();
@@ -425,12 +530,13 @@ export function scanStacks(pj0) {
   // Its source files still belong to the module that holds them (a test imports that module's dependencies).
   const pj = { ...pj0, manifests: pj0.files.filter((f) => !isTestPath(f)) };
   const out = { modules: [], notMeasured: [], globalAliases: [] };
-  for (const fn of [nodeStack, pythonStack, goStack, dotnetStack, javaStack]) {
+  for (const fn of [nodeStack, pythonStack, goStack, dartStack, dotnetStack, javaStack]) {
     try { fn(pj, out); } catch (e) {
       if (!(e instanceof Unsupported)) throw e;
       out.notMeasured.push({ what: fn.name, reason: e.message });
     }
   }
+  foldPlatforms(pj, out);
   // Two manifests with one name (a copy, a fork in a subdirectory) would share an id: the directory tells them apart.
   const count = new Map();
   for (const m of out.modules) count.set(m.id, (count.get(m.id) || 0) + 1);

package/kit/eval/lib/crew-map/surface.mjs

@@ -117,7 +117,7 @@ export function configuration(pj, st, rules, hostOf, ex, out) {
       src.lines.forEach((l, i) => {
         const m = /^\s*(ENV|ARG)\s+([A-Za-z_][A-Za-z0-9_]*)/i.exec(l); if (m) def(m[2], f, i + 1, 'dockerfile');
         const from = /^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)/i.exec(l);
-        if (from) { const o = ownerOf(st.modules, f); if (o) o.tech.add(`image:${from[1]}`); }
+        if (from) { const o = ownerOf(st.modules, f); if (o) o.tech.add('Docker'); }   // the image itself is the line's evidence
       });
     }
   }
@@ -186,6 +186,52 @@ export function codeUrls(pj, st, hostOf, ex, out) {
   }
 }
 
+// ---- one module calling another at the address it is served on -----------------------------------------------
+// A module says where it is served in its own deployment file: wrangler routes and custom domains (Cloudflare
+// Workers), the app of fly.toml (<app>.fly.dev). Another module that writes that host, quoted on its own or as the
+// host of a URL, calls it: an app that builds Uri(host: 'api.x.app') never spells a URL, and before this a call
+// to the project's own server was drawn as an external API, or not at all.
+const SERVED_FILES = /(^|\/)(wrangler\.toml|wrangler\.jsonc?|fly\.toml)$/;
+export function servedCalls(pj, st, ex, out) {
+  const served = new Map();   // host -> module
+  for (const m of st.modules) {
+    for (const f of pj.files.filter((x) => SERVED_FILES.test(x) && dirOf(x) === m.dir)) {
+      const src = pj.read(f); if (!src) continue;
+      src.lines.forEach((l, i) => {
+        if (isComment(l)) return;
+        const hosts = [];
+        for (const x of l.matchAll(/["']?(?:pattern|route)["']?\s*[=:]\s*["']([^"']+)["']/g)) hosts.push(x[1]);
+        if (/fly\.toml$/.test(f)) { const a = /^\s*app\s*=\s*["']([a-z0-9-]+)["']/.exec(l); if (a) hosts.push(`${a[1]}.fly.dev`); }
+        for (const raw of hosts) {
+          const h = raw.replace(/^https?:\/\//, '').replace(/^\*\.?/, '').split('/')[0].toLowerCase();
+          if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(h) || isLocalHost(h) || served.has(h)) continue;
+          served.set(h, m); m.evidence.push(ev(f, i + 1, raw));
+        }
+      });
+    }
+  }
+  out.served = served;
+  if (!served.size) return;
+  for (const [h, to] of served) {
+    const q = h.replace(/[.]/g, '\\.');
+    const re = new RegExp(`(["'\`])${q}\\1|://${q}(?=[/:"'\`]|$)`);
+    for (const m of st.modules) {
+      if (m === to) continue;
+      for (const f of m.files) {
+        if (isTestPath(f)) continue;
+        const src = pj.read(f); if (!src) continue;
+        src.lines.forEach((l, i) => { if (!isComment(l) && re.test(l)) out.edges.push({ from: m.id, to: to.id, kind: 'calls', confidence: 'evidence', via: 'code', evidence: [ev(f, i + 1, h)] }); });
+      }
+    }
+    // The host was read as an external API: it is the project's own module, so its edges go there and the node goes.
+    const id = `ext:http-api:${h}`;
+    if (!ex.ext.has(id)) continue;
+    for (const e of out.edges) if (e.to === id) { e.to = to.id; e.kind = 'calls'; }
+    out.edges = out.edges.filter((e) => e.from !== e.to);
+    ex.ext.delete(id);
+  }
+}
+
 // ---- endpoints ----------------------------------------------------------------------------------------------
 // A path is compared in one spelling: lower case, one leading slash, no trailing slash, every parameter ({id},
 // :id, ${id}, <int:id>, {id:int}) as {}. A path whose start was built at run time (a variable before the first
@@ -322,6 +368,21 @@ export function endpoints(pj, st, out) {
           if (axa && axa.s && !/^https?:/.test(axa.s)) add(consumes, m, ax[2], axa.s, f, axa.at, axa.s);
         });
       }
+      // Dart consumers: a Dio client's relative path, and a full URL (http.get(Uri.parse(…)), Uri.https(host, path))
+      // only when its host is one this project serves; any other host is someone else's API. `$id` is a parameter.
+      if (/\.dart$/.test(f)) {
+        const ours = (h) => out.served?.has(h.toLowerCase());
+        const dp = (s) => s.replace(/\$\{[^}]*\}|\$\w+/g, '{x}');
+        L.forEach((l, i) => {
+          if (isComment(l)) return;
+          const dio = /\b(\w*[dD]io\w*|_?client|_?api)\.(get|post|put|patch|delete)(?:<[^()]*?>)?\(\s*(['"])(\/[^'"]*)\3/.exec(l);
+          if (dio) add(consumes, m, dio[2], dp(dio[4]), f, i, dio[4]);
+          const hp = /\.(get|post|put|patch|delete)\(\s*Uri\.parse\(\s*(['"])https?:\/\/([^/'"$]+)(\/[^'"]*)\2/.exec(l);
+          if (hp && ours(hp[3])) add(consumes, m, hp[1], dp(hp[4]), f, i, hp[4]);
+          const uh = /\bUri\.https?\(\s*(['"])([^'"$]+)\1\s*,\s*(['"])(\/[^'"]*)\3/.exec(l);
+          if (uh && ours(uh[2])) add(consumes, m, 'GET', dp(uh[4]), f, i, uh[4]);
+        });
+      }
       // Python: FastAPI / Flask / Django providers; requests / httpx consumers
       if (/\.py$/.test(f)) {
         const pre = new Map();

package/kit/eval/lib/gate-log.sh

@@ -0,0 +1,52 @@
+# Sourced, not run. The ONE rule for where the gate log is, for the gates that write it and everything that reads it
+# (the status line, gate-report, doctor). Studio's reader (server/lib/kit-telemetry.js) follows the same order.
+#
+#   1. CREW_GATE_LOG, when set: used as given (/dev/null turns recording off).
+#   2. .claude/gate-log.tsv, outside a git repository or where git ignores it (a full install ignores .claude/).
+#   3. Otherwise <git dir>/crewforth-gate-log.tsv: inside the repository's own .git, which is never committed.
+#      Before 3.2.0 the log was simply not written there, so a project that tracks .claude/ had no record of a
+#      refusal, no 🛡 on its status line and no note of a model the gate lowered (seen on a real project).
+#
+# Builtins only on the reading side, which the status line runs every few seconds. The writing side asks git
+# (one or two processes), and only when a decision is being logged.
+
+# The repository's git directory, from the project root up, without a process: _CREW_GD, or rc 1.
+crew_git_dir(){
+  local d="${1:-.}" n=0 l
+  _CREW_GD=""
+  while [ "$n" -lt 12 ]; do
+    if [ -d "$d/.git" ]; then _CREW_GD="$d/.git"; return 0; fi
+    if [ -f "$d/.git" ]; then
+      IFS= read -r l < "$d/.git" 2>/dev/null || l=""
+      case "$l" in "gitdir: "*) l="${l#gitdir: }"; l="${l%$'\r'}"
+        case "$l" in /*|[A-Za-z]:*) ;; *) l="$d/$l" ;; esac
+        [ -d "$l" ] && { _CREW_GD="$l"; return 0; } ;; esac
+      return 1
+    fi
+    [ "$d" = / ] && return 1
+    d="$d/.."; n=$((n+1))
+  done
+  return 1
+}
+
+# Where a gate writes: _CREW_GL ("" = nowhere). Run from the project root.
+crew_gate_log_write(){
+  _CREW_GL=""
+  if [ -n "${CREW_GATE_LOG:-}" ]; then _CREW_GL="$CREW_GATE_LOG"; return 0; fi
+  [ -d .claude ] || return 0
+  if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1 || git check-ignore -q .claude/gate-log.tsv 2>/dev/null; then
+    _CREW_GL=.claude/gate-log.tsv; return 0
+  fi
+  local g; g="$(git rev-parse --absolute-git-dir 2>/dev/null)" || g=""
+  [ -n "$g" ] && [ -d "$g" ] && _CREW_GL="$g/crewforth-gate-log.tsv"
+  return 0
+}
+
+# Where a reader finds it: _CREW_GL ("" = none yet). No process.
+crew_gate_log_read(){
+  _CREW_GL=""
+  if [ -n "${CREW_GATE_LOG:-}" ]; then _CREW_GL="$CREW_GATE_LOG"; return 0; fi
+  if [ -f .claude/gate-log.tsv ]; then _CREW_GL=.claude/gate-log.tsv; return 0; fi
+  crew_git_dir . && [ -f "$_CREW_GD/crewforth-gate-log.tsv" ] && _CREW_GL="$_CREW_GD/crewforth-gate-log.tsv"
+  return 0
+}

package/kit/eval/lib/json-string.awk

@@ -0,0 +1,27 @@
+# json-string.awk — the text on stdin as the inside of a JSON string, printed with no quotes around it and no newline
+# after it. One escaper for every hook that puts dynamic text into its JSON (board-sync.sh, session-rehydrate.sh).
+#
+#   printf '%s\n' "$MSG" | LC_ALL=C awk -f json-string.awk
+#
+# jq-identical, measured on 15 inputs (quote, backslash, tab, CR, C0 controls, DEL, UTF-8, leading/trailing
+# newlines, 5000 chars): 15/15 equal to `jq -cn --arg m`. The one it replaced escaped only the quote, the backslash
+# and the newline, so a tab in a board item produced JSON the CLI cannot parse (jq rc=5) and the board silently
+# vanished from the session. The trailing newline the caller prints closes the last record, so a value ending in a
+# newline keeps it. A CR that ENDS a line is dropped on purpose: it is a CRLF line ending, not content, and MSYS gawk
+# already drops it on read (text mode) while BSD awk keeps it, measured on Windows; stripping it here makes every OS
+# emit the same bytes. A CR inside a line is still escaped as \r.
+BEGIN { ORS = ""
+  for (i = 1; i < 32; i++) ctl[i] = sprintf("%c", i)
+  nm[8] = "\\b"; nm[9] = "\\t"; nm[12] = "\\f"; nm[13] = "\\r" }
+NR > 1 { print "\\n" }
+{ s = $0; sub(/\r$/, "", s)
+  gsub(/\\/, "\\\\", s); gsub(/"/, "\\\"", s)
+  for (i = 1; i < 32; i++) {
+    if (i == 10 || !index(s, ctl[i])) continue
+    r = (i in nm) ? nm[i] : sprintf("\\u%04x", i)
+    out = ""; while ((p = index(s, ctl[i])) > 0) { out = out substr(s, 1, p - 1) r; s = substr(s, p + 1) }
+    s = out s
+  }
+  d = sprintf("%c", 127)
+  if (index(s, d)) { out = ""; while ((p = index(s, d)) > 0) { out = out substr(s, 1, p - 1) "\\u007f"; s = substr(s, p + 1) }; s = out s }
+  print s }

package/kit/eval/lib/preset.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# preset.sh — an organisation's settings for Crewforth in one file, applied to a project.
+#
+#   bash preset.sh --apply <name|file.json>    from the project root; a name is one of eval/lib/presets/
+#   bash preset.sh --check <name|file.json>    is it a valid preset? Nothing is written (the installers ask first)
+#   bash preset.sh --show                      the preset in force here, or "none"
+#   bash preset.sh --list                      the presets that ship
+#
+# A preset is plain JSON (see presets/default.json for every key):
+#   critical.add / critical.remove   paths made critical, or not (globs, as `+ glob` / `- glob`)
+#   floors                           [agent, change, risk, model]: a model a class of work runs on at least
+#   verify                           commands the gate may run as a verify command
+#   lang                             en | tr, the language of what Crewforth says (only when the project has none)
+#
+# Where it goes: .claude/crew-model-rules, the file every reader of these rules already reads (the model gate,
+# agent-outcome's scan, doctor, Studio), as one marked block at the top. The project's own lines stay below it, so
+# the rule is the file's own: for a critical path the last line that matches wins, so a project's `- glob` undoes a
+# preset's `+ glob`; a floor only ever raises, so a preset's floor is a minimum a project can raise and not lower.
+# Applying again replaces the block and nothing else; the same preset twice gives the same bytes.
+#
+# rc 0 = applied (or shown) · 1 = the preset is not valid, or names nothing; nothing was written · 2 = usage
+# Every JSON read is Crewforth's own reader (settings-json.awk): no jq, no python.
+set -u
+_here="${BASH_SOURCE%[/\\]*}"; [ "$_here" = "${BASH_SOURCE}" ] && _here=.
+SJ="$_here/settings-json.awk"; DIR="$_here/presets"
+RULES=.claude/crew-model-rules; CONF=.claude/kit.conf
+BEGIN_MARK='# ---- preset:'; END_MARK='# ---- end of preset (lines below are this project'"'"'s own and win over it, see preset.sh) ----'
+
+die(){ echo "preset: $*" >&2; exit 1; }
+jget(){ awk -v op=get -v path="$1" -f "$SJ" "$2" 2>/dev/null; }
+jstrings(){ awk -v op=strings -v path="$1" -f "$SJ" "$2" 2>/dev/null; }
+jlen(){ local n; n="$(awk -v op=len -v path="$1" -f "$SJ" "$2" 2>/dev/null)"; printf '%s' "${n:-0}"; }
+
+case "${1:-}" in
+  --list) for f in "$DIR"/*.json; do [ -f "$f" ] || continue; n="${f##*/}"; printf '%s\n' "${n%.json}"; done; exit 0 ;;
+  --show)
+    [ -f "$RULES" ] || { echo none; exit 0; }
+    while IFS= read -r l || [ -n "$l" ]; do case "$l" in "$BEGIN_MARK "*) l="${l#"$BEGIN_MARK "}"; echo "${l%% *}"; exit 0 ;; esac; done < "$RULES"
+    echo none; exit 0 ;;
+  --apply|--check) [ -n "${2:-}" ] || { echo "usage: preset.sh --apply|--check <name|file.json> | --show | --list" >&2; exit 2; } ;;
+  *) echo "usage: preset.sh --apply|--check <name|file.json> | --show | --list" >&2; exit 2 ;;
+esac
+MODE="$1"
+[ "$MODE" = --check ] || [ -d .claude ] || die "no .claude/ here: run it from the root of a project Crewforth is installed in"
+
+# ---- which file ----
+P="$2"
+case "$P" in *.json|*/*) ;; *) P="$DIR/$P.json" ;; esac
+[ -f "$P" ] || die "no preset at $P (the ones that ship: $(bash "$0" --list 2>/dev/null | tr '\n' ' '))"
+awk -v op=validate -f "$SJ" "$P" 2>/dev/null || die "$P is not a JSON object"
+NAME="$(jget name "$P")"; NAME="${NAME#\"}"; NAME="${NAME%\"}"
+case "$NAME" in ''|*[!a-z0-9-]*) die "$P: name must be lower case letters, digits and -" ;; esac
+
+# ---- what it says, checked before anything is written ----
+LINES=()
+for k in add remove; do
+  sign='+'; [ "$k" = remove ] && sign='-'
+  while IFS= read -r g; do
+    [ -n "$g" ] || continue
+    case "$g" in *[[:space:]\#]*) die "$P: critical.$k holds '$g', which has a space or a #" ;; esac
+    LINES+=("$sign $g")
+  done < <(jstrings "critical.$k" "$P")
+done
+nf="$(jlen floors "$P")"; i=0
+while [ "$i" -lt "$nf" ]; do
+  f=(); while IFS= read -r w; do f+=("$w"); done < <(jstrings "floors.$i" "$P")
+  [ "${#f[@]}" = 4 ] || die "$P: floors[$i] is not [agent, change, risk, model]"
+  case "${f[3]}" in haiku|sonnet|opus) ;; *) die "$P: floors[$i] names the model '${f[3]}', not haiku, sonnet or opus" ;; esac
+  for w in "${f[@]}"; do case "$w" in ''|*[[:space:]\#]*) die "$P: floors[$i] has an empty word, a space or a #" ;; esac; done
+  LINES+=("floor ${f[0]} ${f[1]} ${f[2]} ${f[3]}"); i=$((i+1))
+done
+while IFS= read -r c; do
+  [ -n "$c" ] || continue
+  case "$c" in *[\;\&\|\<\>\`\$\#]*) die "$P: verify '$c' has a shell operator or a #; the gate runs a verify command as one command" ;; esac
+  LINES+=("verify $c")
+done < <(jstrings verify "$P")
+LANGV="$(jget lang "$P")"; LANGV="${LANGV#\"}"; LANGV="${LANGV%\"}"
+case "$LANGV" in ''|null|en|tr) ;; *) die "$P: lang is '$LANGV', not en or tr" ;; esac
+for k in $(awk -v op=keys -f "$SJ" "$P" 2>/dev/null); do
+  case "$k" in about|name|critical|floors|verify|lang) ;; *) die "$P: unknown key '$k' (about, name, critical, floors, verify, lang)" ;; esac
+done
+
+[ "$MODE" = --check ] && { echo "preset: $NAME is valid — ${#LINES[@]} line(s)"; exit 0; }
+
+# ---- the block, at the top of the rules file; the project's own lines kept below it ----
+OWN=""
+if [ -f "$RULES" ]; then
+  skip=0
+  while IFS= read -r l || [ -n "$l" ]; do
+    case "$l" in "$BEGIN_MARK "*) skip=1; continue ;; "$END_MARK") skip=0; continue ;; esac
+    [ "$skip" = 1 ] || OWN+="$l"$'\n'
+  done < "$RULES"
+fi
+T="$RULES.preset.$$"
+{
+  printf '%s %s (written by preset.sh; apply again to change it, edit your own lines below) ----\n' "$BEGIN_MARK" "$NAME"
+  for l in ${LINES[@]+"${LINES[@]}"}; do printf '%s\n' "$l"; done
+  printf '%s\n' "$END_MARK"
+  printf '%s' "$OWN"
+} > "$T" && mv -f "$T" "$RULES" || { rm -f "$T"; die "could not write $RULES"; }
+
+# ---- kit.conf: the preset's language, only where the project has none. Which preset is in force is said once, by
+# the block's own first line (--show reads it): kit.conf is rewritten by every update, the rules file is not.
+if [ -f "$CONF" ] && case "$LANGV" in en|tr) true ;; *) false ;; esac; then
+  hadlang=0; while IFS= read -r l || [ -n "$l" ]; do case "$l" in lang=*) hadlang=1 ;; esac; done < "$CONF"
+  [ "$hadlang" = 0 ] && printf 'lang=%s\n' "$LANGV" >> "$CONF"
+fi
+echo "preset: $NAME applied — ${#LINES[@]} line(s) in $RULES; your own lines below the block were kept"
+exit 0

package/kit/eval/lib/presets/default.json

@@ -0,0 +1,7 @@
+{
+  "about": "Crewforth as it ships: no line of its own. Every key a preset may hold is here, empty. critical.add and critical.remove are globs made critical or not (a critical path runs on opus and only an agent on opus writes there); floors are [agent, change, risk, model] with * for any, a model a class of work runs on at least; verify are commands the model gate may run as a card's verify command; lang (en or tr) is used only where the project has no language yet.",
+  "name": "default",
+  "critical": { "add": [], "remove": [] },
+  "floors": [],
+  "verify": []
+}

package/kit/eval/lib/presets/solo.json

@@ -0,0 +1,7 @@
+{
+  "about": "For one person on their own project: the common test commands may run as a card's verify command, so cheap work can be checked and run on haiku; no path is added.",
+  "name": "solo",
+  "critical": { "add": [], "remove": [] },
+  "floors": [],
+  "verify": ["npm test", "pnpm test", "yarn test", "pytest", "go test ./...", "cargo test", "dotnet test", "flutter test"]
+}

package/kit/eval/lib/presets/strict.json

@@ -0,0 +1,11 @@
+{
+  "about": "For a team that ships to production from this repository: what deploys it is critical too, and the referees of the work run on opus whatever the risk.",
+  "name": "strict",
+  "critical": { "add": ["infra", "deploy", "terraform", "k8s", "helm", ".github/workflows"], "remove": [] },
+  "floors": [
+    ["crew-review-agent", "*", "*", "opus"],
+    ["*", "test-write", "*", "opus"],
+    ["*", "audit", "*", "opus"]
+  ],
+  "verify": []
+}