ctxloom-pro 1.5.2 → 1.5.4

package/README.md

@@ -47,7 +47,7 @@ The full first-run flow is **one install + one trial + one init per project.** E
 npm install -g ctxloom-pro
 ```
 
-> **For local trial / dev use the unpinned command above is fine.** For unattended CI usage, pin to the exact version (`ctxloom-pro@1.5.2`) so future CLI releases don't silently desync your agent-spec coverage — see the workflow example below.
+> **For local trial / dev use the unpinned command above is fine.** For unattended CI usage, pin to the exact version (`ctxloom-pro@1.5.3`) so future CLI releases don't silently desync your agent-spec coverage — see the workflow example below.
 
 ### 2 — Start your free trial (once per email)
 
@@ -361,7 +361,7 @@ jobs:
       # Exact pin (not `@^1`) so future CLI releases that add/remove MCP
       # tools don't silently desync your reviewer-agent specs. Bump on
       # every release; see CHANGELOG.md for the live version table.
-      - run: npm install -g ctxloom-pro@1.5.2
+      - run: npm install -g ctxloom-pro@1.5.3
       - run: ctxloom index
       - run: ctxloom rules check --json
 ```

package/apps/dashboard/dist/server/index.js

@@ -676,6 +676,47 @@ var ASTParser = class {
           processedIds.add(node.id);
           return;
         }
+        // ─── CommonJS require() calls ────────────────────────────────────
+        // ES6 import_statement above handles `import X from './foo'`. But
+        // pure CommonJS projects — express, most pre-2020 Node libs — use
+        // `require('./foo')` instead and never emit an import_statement
+        // node. Without this case, those projects produce a dependency
+        // graph with 0 edges and the blast-radius tool collapses to
+        // "just the seed file" because there's nothing to traverse.
+        //
+        // Mirrors the Ruby require pattern below (see the `case 'call'`
+        // branch later in the walker). Only literal-string arguments are
+        // resolvable; dynamic `require(varName)` is statically invisible
+        // and intentionally skipped.
+        //
+        // Patterns matched:
+        //   require('./path')
+        //   require('../path')
+        //   require('./path.json')       — JSON files emit edges too
+        // Patterns NOT matched:
+        //   require(varName)             — dynamic, can't resolve
+        //   require.resolve('./path')    — returns path string, not a load
+        //   import('./path')             — dynamic ESM, separate concern
+        case "call_expression": {
+          const fnNode = node.childForFieldName?.("function") ?? node.children.find((c) => c?.type === "identifier");
+          if (fnNode?.text === "require") {
+            const argsNode = node.childForFieldName?.("arguments") ?? node.children.find((c) => c?.type === "arguments");
+            const firstArg = argsNode?.children.find((c) => c?.type === "string");
+            if (firstArg) {
+              const spec = firstArg.text.replace(/^['"`]|['"`]$/g, "");
+              if (spec.length > 0) {
+                nodes.push({
+                  type: "import",
+                  name: spec,
+                  source: spec,
+                  startLine: node.startPosition.row + 1,
+                  endLine: node.endPosition.row + 1
+                });
+              }
+            }
+          }
+          break;
+        }
         // ─── Export statements (export function, export default) ────────
         case "export_statement": {
           const hasDefault = node.children.some((c) => c?.type === "default");
@@ -804,6 +845,8 @@ var ASTParser = class {
                   startLine: declarator.startPosition.row + 1,
                   endLine: declarator.endPosition.row + 1
                 });
+              } else if (valueNode.type === "call_expression") {
+                walk(valueNode);
               }
             }
           }
@@ -1956,29 +1999,54 @@ function resolveImport(fromAbs, raw, rootDir) {
 }
 function extractPythonImports(content) {
   const results = [];
-  const relFrom = /^from\s+(\.+[\w.]*)\s+import/gm;
   let m;
+  const relFrom = /^from\s+(\.+[\w.]*)\s+import/gm;
   while ((m = relFrom.exec(content)) !== null) {
     results.push({ specifier: m[1], isRelative: true });
   }
+  const absFrom = /^from\s+([A-Za-z_][\w.]*)\s+import/gm;
+  while ((m = absFrom.exec(content)) !== null) {
+    results.push({ specifier: m[1], isRelative: false });
+  }
+  const directImport = /^import\s+([A-Za-z_][\w.]*)/gm;
+  while ((m = directImport.exec(content)) !== null) {
+    results.push({ specifier: m[1], isRelative: false });
+  }
   return results;
 }
 function resolvePythonImport(fromAbs, fromDir, raw, rootDir) {
   const dotsMatch = raw.specifier.match(/^(\.+)/);
-  const dots = dotsMatch?.[1] ?? ".";
-  const modulePart = raw.specifier.slice(dots.length);
-  let baseDir = fromDir;
-  for (let i = 1; i < dots.length; i++) {
-    baseDir = path5.dirname(baseDir);
-  }
-  const modulePath = modulePart.replace(/\./g, path5.sep);
-  const candidates = modulePath ? [
-    path5.join(baseDir, modulePath + ".py"),
-    path5.join(baseDir, modulePath, "__init__.py")
-  ] : [
-    path5.join(fromDir, "__init__.py"),
-    fromAbs
-    // self — skip below
+  if (dotsMatch) {
+    const dots = dotsMatch[1];
+    const modulePart = raw.specifier.slice(dots.length);
+    let baseDir = fromDir;
+    for (let i = 1; i < dots.length; i++) {
+      baseDir = path5.dirname(baseDir);
+    }
+    const modulePath2 = modulePart.replace(/\./g, path5.sep);
+    const candidates2 = modulePath2 ? [
+      path5.join(baseDir, modulePath2 + ".py"),
+      path5.join(baseDir, modulePath2, "__init__.py")
+    ] : [
+      path5.join(fromDir, "__init__.py"),
+      fromAbs
+      // self — skip below
+    ];
+    for (const c of candidates2) {
+      if (c !== fromAbs && fs5.existsSync(c)) {
+        return path5.relative(rootDir, c);
+      }
+    }
+    return null;
+  }
+  const modulePath = raw.specifier.replace(/\./g, path5.sep);
+  const candidates = [
+    // <repoRoot>/<package>/foo.py  or  <repoRoot>/<package>/foo/__init__.py
+    path5.join(rootDir, modulePath + ".py"),
+    path5.join(rootDir, modulePath, "__init__.py"),
+    // src/ layout (common for Python apps that follow PEP 518 src-layout)
+    path5.join(rootDir, "src", modulePath + ".py"),
+    path5.join(rootDir, "src", modulePath, "__init__.py")
   ];
   for (const c of candidates) {
     if (c !== fromAbs && fs5.existsSync(c)) {
@@ -2913,10 +2981,28 @@ var DependencyGraph = class {
   }
   resolveImport(fromAbs, specifier, rootDir) {
     const dir = path7.dirname(fromAbs);
-    for (const ext of ["", ".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.js"]) {
+    const extensions = [
+      "",
+      ".ts",
+      ".tsx",
+      ".js",
+      ".jsx",
+      ".mjs",
+      ".cjs",
+      "/index.ts",
+      "/index.tsx",
+      "/index.js",
+      "/index.jsx",
+      "/index.mjs",
+      "/index.cjs"
+    ];
+    for (const ext of extensions) {
       const candidate = path7.resolve(dir, specifier.replace(/\.js$/, "") + ext);
-      if (fs7.existsSync(candidate)) {
-        return path7.relative(rootDir, candidate);
+      try {
+        if (fs7.statSync(candidate).isFile()) {
+          return path7.relative(rootDir, candidate);
+        }
+      } catch {
       }
     }
     return null;
@@ -11506,10 +11592,10 @@ function resolveTelemetryLevel() {
 }
 var TELEMETRY_LEVEL = resolveTelemetryLevel();
 var TELEMETRY_DISABLED = TELEMETRY_LEVEL === "off";
-var CTXLOOM_VERSION = "1.5.2".length > 0 ? "1.5.2" : "dev";
+var CTXLOOM_VERSION = "1.5.4".length > 0 ? "1.5.4" : "dev";
 var POSTHOG_HOST = "https://eu.i.posthog.com";
 var POSTHOG_KEY = process.env["POSTHOG_API_KEY"] ?? (true ? "phc_CiDkmFLcZ2K6uCpcoSUQLmFrnnUvsyXGhSxopX5TVKE6" : "");
-var SENTRY_DSN = process.env["SENTRY_DSN"] ?? (true ? "https://81c94a0f04a8e242dee493ac1e17f733@o4508531702497280.ingest.de.sentry.io/4511256875368528" : "");
+var SENTRY_DSN = process.env["SENTRY_DSN"] ?? (true ? "https://81c94a0f04a8e242dee493ac1e17f733@o4508531702497280.ingest.de.sentry.io/4511256875368528\u2028" : "");
 var cachedDistinctId = null;
 function resolveDistinctId() {
   if (cachedDistinctId) return cachedDistinctId;

package/dist/{chunk-SMI35T32.js → chunk-4ZXFJSDG.js}

@@ -522,6 +522,47 @@ var ASTParser = class {
           processedIds.add(node.id);
           return;
         }
+        // ─── CommonJS require() calls ────────────────────────────────────
+        // ES6 import_statement above handles `import X from './foo'`. But
+        // pure CommonJS projects — express, most pre-2020 Node libs — use
+        // `require('./foo')` instead and never emit an import_statement
+        // node. Without this case, those projects produce a dependency
+        // graph with 0 edges and the blast-radius tool collapses to
+        // "just the seed file" because there's nothing to traverse.
+        //
+        // Mirrors the Ruby require pattern below (see the `case 'call'`
+        // branch later in the walker). Only literal-string arguments are
+        // resolvable; dynamic `require(varName)` is statically invisible
+        // and intentionally skipped.
+        //
+        // Patterns matched:
+        //   require('./path')
+        //   require('../path')
+        //   require('./path.json')       — JSON files emit edges too
+        // Patterns NOT matched:
+        //   require(varName)             — dynamic, can't resolve
+        //   require.resolve('./path')    — returns path string, not a load
+        //   import('./path')             — dynamic ESM, separate concern
+        case "call_expression": {
+          const fnNode = node.childForFieldName?.("function") ?? node.children.find((c) => c?.type === "identifier");
+          if (fnNode?.text === "require") {
+            const argsNode = node.childForFieldName?.("arguments") ?? node.children.find((c) => c?.type === "arguments");
+            const firstArg = argsNode?.children.find((c) => c?.type === "string");
+            if (firstArg) {
+              const spec = firstArg.text.replace(/^['"`]|['"`]$/g, "");
+              if (spec.length > 0) {
+                nodes.push({
+                  type: "import",
+                  name: spec,
+                  source: spec,
+                  startLine: node.startPosition.row + 1,
+                  endLine: node.endPosition.row + 1
+                });
+              }
+            }
+          }
+          break;
+        }
         // ─── Export statements (export function, export default) ────────
         case "export_statement": {
           const hasDefault = node.children.some((c) => c?.type === "default");
@@ -650,6 +691,8 @@ var ASTParser = class {
                   startLine: declarator.startPosition.row + 1,
                   endLine: declarator.endPosition.row + 1
                 });
+              } else if (valueNode.type === "call_expression") {
+                walk(valueNode);
               }
             }
           }
@@ -1798,29 +1841,54 @@ function resolveImport(fromAbs, raw, rootDir) {
 }
 function extractPythonImports(content) {
   const results = [];
-  const relFrom = /^from\s+(\.+[\w.]*)\s+import/gm;
   let m;
+  const relFrom = /^from\s+(\.+[\w.]*)\s+import/gm;
   while ((m = relFrom.exec(content)) !== null) {
     results.push({ specifier: m[1], isRelative: true });
   }
+  const absFrom = /^from\s+([A-Za-z_][\w.]*)\s+import/gm;
+  while ((m = absFrom.exec(content)) !== null) {
+    results.push({ specifier: m[1], isRelative: false });
+  }
+  const directImport = /^import\s+([A-Za-z_][\w.]*)/gm;
+  while ((m = directImport.exec(content)) !== null) {
+    results.push({ specifier: m[1], isRelative: false });
+  }
   return results;
 }
 function resolvePythonImport(fromAbs, fromDir, raw, rootDir) {
   const dotsMatch = raw.specifier.match(/^(\.+)/);
-  const dots = dotsMatch?.[1] ?? ".";
-  const modulePart = raw.specifier.slice(dots.length);
-  let baseDir = fromDir;
-  for (let i = 1; i < dots.length; i++) {
-    baseDir = path4.dirname(baseDir);
-  }
-  const modulePath = modulePart.replace(/\./g, path4.sep);
-  const candidates = modulePath ? [
-    path4.join(baseDir, modulePath + ".py"),
-    path4.join(baseDir, modulePath, "__init__.py")
-  ] : [
-    path4.join(fromDir, "__init__.py"),
-    fromAbs
-    // self — skip below
+  if (dotsMatch) {
+    const dots = dotsMatch[1];
+    const modulePart = raw.specifier.slice(dots.length);
+    let baseDir = fromDir;
+    for (let i = 1; i < dots.length; i++) {
+      baseDir = path4.dirname(baseDir);
+    }
+    const modulePath2 = modulePart.replace(/\./g, path4.sep);
+    const candidates2 = modulePath2 ? [
+      path4.join(baseDir, modulePath2 + ".py"),
+      path4.join(baseDir, modulePath2, "__init__.py")
+    ] : [
+      path4.join(fromDir, "__init__.py"),
+      fromAbs
+      // self — skip below
+    ];
+    for (const c of candidates2) {
+      if (c !== fromAbs && fs4.existsSync(c)) {
+        return path4.relative(rootDir, c);
+      }
+    }
+    return null;
+  }
+  const modulePath = raw.specifier.replace(/\./g, path4.sep);
+  const candidates = [
+    // <repoRoot>/<package>/foo.py  or  <repoRoot>/<package>/foo/__init__.py
+    path4.join(rootDir, modulePath + ".py"),
+    path4.join(rootDir, modulePath, "__init__.py"),
+    // src/ layout (common for Python apps that follow PEP 518 src-layout)
+    path4.join(rootDir, "src", modulePath + ".py"),
+    path4.join(rootDir, "src", modulePath, "__init__.py")
   ];
   for (const c of candidates) {
     if (c !== fromAbs && fs4.existsSync(c)) {
@@ -2755,10 +2823,28 @@ var DependencyGraph = class {
   }
   resolveImport(fromAbs, specifier, rootDir) {
     const dir = path6.dirname(fromAbs);
-    for (const ext of ["", ".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.js"]) {
+    const extensions = [
+      "",
+      ".ts",
+      ".tsx",
+      ".js",
+      ".jsx",
+      ".mjs",
+      ".cjs",
+      "/index.ts",
+      "/index.tsx",
+      "/index.js",
+      "/index.jsx",
+      "/index.mjs",
+      "/index.cjs"
+    ];
+    for (const ext of extensions) {
       const candidate = path6.resolve(dir, specifier.replace(/\.js$/, "") + ext);
-      if (fs6.existsSync(candidate)) {
-        return path6.relative(rootDir, candidate);
+      try {
+        if (fs6.statSync(candidate).isFile()) {
+          return path6.relative(rootDir, candidate);
+        }
+      } catch {
       }
     }
     return null;
@@ -10205,10 +10291,10 @@ var TELEMETRY_DISABLED = TELEMETRY_LEVEL === "off";
 function getTelemetryLevel() {
   return TELEMETRY_LEVEL;
 }
-var CTXLOOM_VERSION = "1.5.2".length > 0 ? "1.5.2" : "dev";
+var CTXLOOM_VERSION = "1.5.4".length > 0 ? "1.5.4" : "dev";
 var POSTHOG_HOST = "https://eu.i.posthog.com";
 var POSTHOG_KEY = process.env["POSTHOG_API_KEY"] ?? (true ? "phc_CiDkmFLcZ2K6uCpcoSUQLmFrnnUvsyXGhSxopX5TVKE6" : "");
-var SENTRY_DSN = process.env["SENTRY_DSN"] ?? (true ? "https://81c94a0f04a8e242dee493ac1e17f733@o4508531702497280.ingest.de.sentry.io/4511256875368528" : "");
+var SENTRY_DSN = process.env["SENTRY_DSN"] ?? (true ? "https://81c94a0f04a8e242dee493ac1e17f733@o4508531702497280.ingest.de.sentry.io/4511256875368528\u2028" : "");
 var cachedDistinctId = null;
 function resolveDistinctId() {
   if (cachedDistinctId) return cachedDistinctId;
@@ -11803,4 +11889,4 @@ export {
   skillFilePath,
   installHarness
 };
-//# sourceMappingURL=chunk-SMI35T32.js.map
+//# sourceMappingURL=chunk-4ZXFJSDG.js.map

package/dist/index.js

@@ -45,7 +45,7 @@ import {
   validateDefaultRoot,
   wrapWithIndexingEnvelope,
   writeCODEOWNERS
-} from "./chunk-SMI35T32.js";
+} from "./chunk-4ZXFJSDG.js";
 import {
   addCtxloomToConfig,
   detectInstalledClients
@@ -1020,7 +1020,7 @@ try {
 } catch {
 }
 var args = process.argv.slice(2);
-var ctxloomVersion = "1.5.2".length > 0 ? "1.5.2" : "dev";
+var ctxloomVersion = "1.5.4".length > 0 ? "1.5.4" : "dev";
 if (args.includes("--version") || args.includes("-v")) {
   process.stdout.write(`ctxloom ${ctxloomVersion}
 `);
@@ -1093,7 +1093,7 @@ async function checkLicense() {
   if (command !== void 0 && LICENSE_GATE_BYPASS_COMMANDS.has(command)) return;
   const ciKey = process.env["CTXLOOM_LICENSE_KEY"];
   if (ciKey) {
-    const { ApiClient } = await import("./src-AHIZ4UNS.js");
+    const { ApiClient } = await import("./src-AN6JHJMC.js");
     const client = new ApiClient(process.env["CTXLOOM_API_BASE"]);
     try {
       const result = await client.validate(ciKey, "ci-ephemeral");
@@ -1471,7 +1471,7 @@ async function main() {
         }
         if (!skipHarness) {
           process.stdout.write("\n");
-          const { installHarness } = await import("./src-AHIZ4UNS.js");
+          const { installHarness } = await import("./src-AN6JHJMC.js");
           const h = installHarness({ cwd: initRoot, dryRun, force, extraHosts });
           const harnessFiles = [
             h.claudeMd,
@@ -1534,7 +1534,7 @@ async function main() {
         process.exit(1);
       }
       if (alias !== void 0) {
-        const { validateAlias } = await import("./src-AHIZ4UNS.js");
+        const { validateAlias } = await import("./src-AN6JHJMC.js");
         const v = validateAlias(alias);
         if (!v.ok) {
           console.error(`[ctxloom] Invalid alias: ${v.reason}`);
@@ -1798,7 +1798,7 @@ Suggested reviewers for ${files.length} file(s):`);
         process.stderr.write("[ctxloom] --limit must be a non-negative integer (0 for unlimited)\n");
         process.exit(2);
       }
-      const { loadRulesConfig, RulesChecker, formatText, formatJson, RulesConfigError } = await import("./src-AHIZ4UNS.js");
+      const { loadRulesConfig, RulesChecker, formatText, formatJson, RulesConfigError } = await import("./src-AN6JHJMC.js");
       let config;
       try {
         config = await loadRulesConfig(root);
@@ -1822,7 +1822,7 @@ Suggested reviewers for ${files.length} file(s):`);
       }
       let graph;
       if (useSnapshot) {
-        const { DependencyGraph: DG } = await import("./src-AHIZ4UNS.js");
+        const { DependencyGraph: DG } = await import("./src-AN6JHJMC.js");
         graph = new DG();
         const loaded = await graph.loadSnapshotOnly(root);
         if (!loaded) {
@@ -1831,7 +1831,7 @@ Suggested reviewers for ${files.length} file(s):`);
         }
       } else {
         process.stderr.write("[ctxloom] Building dependency graph...\n");
-        const { ASTParser: ASTParser2, DependencyGraph: DependencyGraph2 } = await import("./src-AHIZ4UNS.js");
+        const { ASTParser: ASTParser2, DependencyGraph: DependencyGraph2 } = await import("./src-AN6JHJMC.js");
         let parser;
         try {
           parser = new ASTParser2();

package/dist/{src-AHIZ4UNS.js → src-AN6JHJMC.js}

@@ -129,7 +129,7 @@ import {
   wrapBlock,
   wrapWithIndexingEnvelope,
   writeCODEOWNERS
-} from "./chunk-SMI35T32.js";
+} from "./chunk-4ZXFJSDG.js";
 import {
   VectorStore
 } from "./chunk-DVI2RWJR.js";
@@ -294,4 +294,4 @@ export {
   wrapWithIndexingEnvelope,
   writeCODEOWNERS
 };
-//# sourceMappingURL=src-AHIZ4UNS.js.map
+//# sourceMappingURL=src-AN6JHJMC.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ctxloom-pro",
-  "version": "1.5.2",
+  "version": "1.5.4",
   "description": "ctxloom — The Universal Code Context Engine. A local-first MCP server providing intelligent code context via hybrid Vector + AST + Graph search with Skeletonization (92% token reduction).",
   "type": "module",
   "main": "dist/index.js",
@@ -43,6 +43,8 @@
     "lint": "tsc --noEmit",
     "postinstall": "node dist/setup/postinstall.js || true",
     "bench:repos": "tsx benchmarks/benchmark-public-repos.ts",
+    "bench:spike": "tsx scripts/bench/eval.ts spike",
+    "bench:full": "tsx scripts/bench/eval.ts full",
     "e2e:corpus": "node e2e-corpus/run.mjs"
   },
   "keywords": [