entkapp 5.3.0 → 5.4.0

package/src/ast/OxcAnalyzer.js

@@ -2,13 +2,18 @@ import path from 'path';
 
 /**
  * Production-Grade Native Rust AST Parser Bridge (OXC)
- * Fixed for Windows environments to prevent path-based "Unexpected token" errors.
+ * Optimized for Monorepos and Windows environments.
+ * Implements the same semantic logic as ASTAnalyzer but using the high-performance OXC parser.
  */
 export class OxcAnalyzer {
   constructor(context) {
     this.context = context;
     this.oxc = null;
     this.isAvailable = false;
+    this.scopeStack = [];
+    this.currentScope = null;
+    this.scopeCounter = 0;
+    this.pass = 1;
   }
 
   async init() {
@@ -35,7 +40,6 @@ export class OxcAnalyzer {
 
   /**
    * WINDOWS FIX: Robust path normalization for OXC.
-   * Replaces backslashes with forward slashes to prevent escape sequence errors.
    */
   normalizePath(filePath) {
     if (!filePath) return filePath;
@@ -64,13 +68,10 @@ export class OxcAnalyzer {
           lang: "typescript"
         });
       } catch (e) {
-        // Fallback with normalized path if the options object fails
         try {
           result = this.oxc.parseSync(normalizedPath, cleanContent);
         } catch (innerErr) {
-          if (this.context.verbose) {
-            console.error(`[OXC-ERROR] Native parse failed for: ${normalizedPath}`);
-          }
+          if (this.context.verbose) console.error(`[OXC-ERROR] Native parse failed for: ${normalizedPath}`);
           return false;
         }
       }
@@ -79,11 +80,8 @@ export class OxcAnalyzer {
       try {
         parsedResult = typeof result === 'string' ? JSON.parse(result) : JSON.parse(JSON.stringify(result));
       } catch (err) {
-        if (result && typeof result === 'object') {
-          parsedResult = result;
-        } else {
-          return false;
-        }
+        if (result && typeof result === 'object') parsedResult = result;
+        else return false;
       }
 
       let programRoot = null;
@@ -93,24 +91,35 @@ export class OxcAnalyzer {
         else if (parsedResult.type === 'Program' || parsedResult.body) programRoot = parsedResult;
       }
 
-      // --- VALIDATION CHECK ---
-      // If the file has content but OXC returns an empty body, it's a silent failure.
       if (cleanContent.trim().length > 0 && (!programRoot || !programRoot.body || programRoot.body.length === 0)) {
-        if (this.context.verbose) {
-          console.warn(`[OXC-WARNING] Silent failure detected for ${normalizedPath}. Body is empty despite content. Triggering Fallback...`);
-        }
-        return false; // This triggers the fallback to TypeScript in the engine
-      }
-
-      if (!programRoot || !programRoot.body) {
+        if (this.context.verbose) console.warn(`[OXC-WARNING] Silent failure detected for ${normalizedPath}. Triggering Fallback...`);
         return false;
       }
 
-      fileNode.ast = programRoot; 
-      fileNode.symbolTable = new Map(); 
+      if (!programRoot || !programRoot.body) return false;
+
+      fileNode.ast = programRoot;
+      fileNode.symbolTable = new Map();
+
+      // --- TWO-PASS ANALYSIS ---
       
-      this.walkOxcAst(programRoot, fileNode, cleanContent, 1);
-      this.walkOxcAst(programRoot, fileNode, cleanContent, 2);
+      // Pass 1: Declarations
+      this.currentScope = { symbols: new Map(), parent: null, children: [] };
+      this.scopeStack = [this.currentScope];
+      this.scopeCounter = 0;
+      this.pass = 1;
+      this.walkOxcAst(programRoot, fileNode, cleanContent);
+
+      // Pass 2: References
+      if (this.scopeStack.length > 0) {
+        this.currentScope = this.scopeStack[0];
+        this.scopeCounter = 0;
+        this.pass = 2;
+        this.walkOxcAst(programRoot, fileNode, cleanContent);
+      }
+
+      this.scopeStack = [];
+      this.currentScope = null;
       
       return true;
     } catch (e) {
@@ -118,9 +127,163 @@ export class OxcAnalyzer {
     }
   }
 
-  // ... (walkOxcAst and other methods remain the same as in original)
-  walkOxcAst(node, fileNode, content, pass) {
+  pushScope() {
+    if (this.pass === 1) {
+      const newScope = { symbols: new Map(), parent: this.currentScope, children: [] };
+      if (this.currentScope) this.currentScope.children.push(newScope);
+      this.scopeStack.push(newScope);
+      this.currentScope = newScope;
+    } else {
+      if (this.currentScope && this.currentScope.children) {
+        const nextScope = this.currentScope.children[this.scopeCounter++];
+        if (nextScope) {
+          this.scopeStack.push(nextScope);
+          this.currentScope = nextScope;
+        }
+      }
+    }
+  }
+
+  popScope() {
+    this.scopeStack.pop();
+    this.currentScope = this.scopeStack[this.scopeStack.length - 1];
+  }
+
+  walkOxcAst(node, fileNode, content) {
     if (!node) return;
-    // (Implementation omitted for brevity, should be copied from original OxcAnalyzer.js)
+
+    const isScopeNode = node.type === 'BlockStatement' || node.type === 'FunctionDeclaration' || 
+                        node.type === 'ClassDeclaration' || node.type === 'ArrowFunctionExpression';
+
+    let previousCounter = 0;
+    if (isScopeNode) {
+      if (this.pass === 2) previousCounter = this.scopeCounter;
+      this.scopeCounter = 0;
+      this.pushScope();
+    }
+
+    if (this.pass === 1) {
+      this.handleNodePass1(node, fileNode, content);
+    } else {
+      this.handleNodePass2(node, fileNode, content);
+    }
+
+    // Traverse children
+    for (const key in node) {
+      const child = node[key];
+      if (Array.isArray(child)) {
+        child.forEach(c => this.walkOxcAst(c, fileNode, content));
+      } else if (child && typeof child === 'object' && child.type) {
+        this.walkOxcAst(child, fileNode, content);
+      }
+    }
+
+    if (isScopeNode) {
+      this.popScope();
+      if (this.pass === 2) this.scopeCounter = previousCounter + 1;
+    }
+  }
+
+  handleNodePass1(node, fileNode, content) {
+    switch (node.type) {
+      case 'ImportDeclaration':
+        this.handleImport(node, fileNode);
+        break;
+      case 'ExportNamedDeclaration':
+        this.handleExportNamed(node, fileNode);
+        break;
+      case 'ExportDefaultDeclaration':
+        fileNode.internalExports.set('default', { type: 'default', start: node.start, end: node.end });
+        break;
+      case 'ExportAllDeclaration':
+        if (node.source) {
+          const specifier = node.source.value;
+          fileNode.explicitImports.add(specifier);
+          fileNode.internalExports.set('*', { type: 're-export-all', source: specifier });
+        }
+        break;
+    }
+  }
+
+  handleNodePass2(node, fileNode, content) {
+    switch (node.type) {
+      case 'Identifier':
+        if (!this.isLocalShadowing(node.name)) {
+          fileNode.instantiatedIdentifiers.add(node.name);
+        }
+        break;
+      case 'CallExpression':
+        this.handleCall(node, fileNode);
+        break;
+      case 'MemberExpression':
+        if (node.property && node.property.name) {
+          fileNode.instantiatedIdentifiers.add(node.property.name);
+        }
+        break;
+    }
+  }
+
+  handleImport(node, fileNode) {
+    if (!node.source) return;
+    const specifier = node.source.value;
+    fileNode.explicitImports.add(specifier);
+    
+    if (!specifier.startsWith('.') && !specifier.startsWith('/')) {
+      const pkgName = this._extractPackageName(specifier);
+      let isInternal = false;
+      if (this.context.pathMapper?.isTsconfigAlias?.(specifier)) isInternal = true;
+      if (!isInternal && this.context.workspaceGraph?.isLocalWorkspaceSpecifier?.(specifier)) isInternal = true;
+      if (!isInternal) fileNode.externalPackageUsage.add(pkgName);
+    }
+  }
+
+  handleExportNamed(node, fileNode) {
+    if (node.declaration) {
+      const decl = node.declaration;
+      const name = decl.id?.name || (decl.declarations?.[0]?.id?.name);
+      if (name) {
+        fileNode.internalExports.set(name, { type: 'export', start: node.start, end: node.end });
+      }
+    } else if (node.specifiers) {
+      node.specifiers.forEach(spec => {
+        const name = spec.exported.name || spec.exported.value;
+        fileNode.internalExports.set(name, { type: 'export', start: spec.start, end: spec.end });
+      });
+    }
+  }
+
+  handleCall(node, fileNode) {
+    const callee = node.callee;
+    if (callee.type === 'Identifier' && callee.name === 'require') {
+      const arg = node.arguments[0];
+      if (arg && (arg.type === 'StringLiteral' || arg.type === 'Literal')) {
+        const specifier = arg.value;
+        fileNode.explicitImports.add(specifier);
+      }
+    } else if (callee.type === 'Import') {
+      const arg = node.arguments[0];
+      if (arg && (arg.type === 'StringLiteral' || arg.type === 'Literal')) {
+        const specifier = arg.value;
+        fileNode.explicitImports.add(specifier);
+        fileNode.dynamicImports.add(specifier);
+      }
+    }
+  }
+
+  isLocalShadowing(name) {
+    let scope = this.currentScope;
+    while (scope) {
+      if (scope.symbols.has(name)) return scope.parent !== null;
+      scope = scope.parent;
+    }
+    return false;
+  }
+
+  _extractPackageName(specifier) {
+    if (specifier.startsWith('@')) {
+      const parts = specifier.split('/');
+      return parts.length >= 2 ? `${parts[0]}/${parts[1]}` : specifier;
+    }
+    return specifier.split('/')[0];
   }
 }

package/src/ast/SecretScanner.js

@@ -35,45 +35,89 @@ const SENSITIVE_NAME_PATTERNS = [
   /private[_-]?key/i,
   /client[_-]?secret/i,
   /app[_-]?secret/i,
+  /security[_-]?token/i,
+  /master[_-]?key/i,
+  /root[_-]?password/i,
+
   // Database credentials
   /db[_-]?pass(word)?/i,
   /database[_-]?pass(word)?/i,
   /db[_-]?url/i,
   /database[_-]?url/i,
   /connection[_-]?string/i,
-  // Passwords
+  /postgres(ql)?[_-]?url/i,
+  /mongo(db)?[_-]?url/i,
+  /redis[_-]?url/i,
+
+  // Passwords & Pins
   /^password$/i,
   /^passwd$/i,
   /^pwd$/i,
   /[_-]password$/i,
-  // Tokens
+  /[_-]pass$/i,
+  /pass(phrase|code)/i,
+  /admin[_-]?pass/i,
+  /pin[_-]?number/i,
+
+  // Tokens & Sessions
   /[_-]token$/i,
   /^token$/i,
-  /jwt[_-]?secret/i,
-  /session[_-]?secret/i,
+  /jwt[_-]?(secret|token)/i,
+  /session[_-]?(secret|token|id)/i,
   /cookie[_-]?secret/i,
-  // Cloud provider keys
-  /aws[_-]?(access[_-]?key|secret|session[_-]?token)/i,
-  /gcp[_-]?key/i,
-  /azure[_-]?(key|secret|connection)/i,
-  // Service-specific
-  /stripe[_-]?(key|secret)/i,
-  /twilio[_-]?(auth|token|sid)/i,
-  /sendgrid[_-]?key/i,
-  /github[_-]?token/i,
-  /slack[_-]?(token|webhook)/i,
-  /discord[_-]?(token|secret)/i,
-  /openai[_-]?(key|token)/i,
+  /oauth[_-]?(token|secret|client)/i,
+  /refresh[_-]?token/i,
+  /csrf[_-]?token/i,
+
+  // Cloud Provider Keys (AWS, GCP, Azure)
+  /aws[_-]?(access[_-]?key|secret|session[_-]?token|key[_-]?id)/i,
+  /gcp[_-]?(key|secret|token|sa[_-]?key)/i,
+  /google[_-]?(api[_-]?key|credentials|client[_-]?secret)/i,
+  /azure[_-]?(key|secret|connection|token|tenant[_-]?id)/i,
+
+  // AI & Machine Learning Platforms
+  /openai[_-]?(key|token|secret)/i,
   /anthropic[_-]?key/i,
-  /webhook[_-]?(url|secret)/i,
-  /encryption[_-]?key/i,
+  /cohere[_-]?key/i,
+  /huggingface[_-]?token/i,
+  /replicate[_-]?api/i,
+  /langchain[_-]?api/i,
+  /pinecone[_-]?api/i,
+  /gemini[_-]?key/i,
+
+  // Service-Specific (CI/CD, Dev Tools, Payment, Comms)
+  /stripe[_-]?(key|secret|webhook)/i,
+  /twilio[_-]?(auth|token|sid)/i,
+  /sendgrid[_-]?(key|api)/i,
+  /github[_-]?(token|pat|secret|app[_-]?id)/i,
+  /gitlab[_-]?(token|pat|secret)/i,
+  /slack[_-]?(token|webhook|secret)/i,
+  /discord[_-]?(token|secret|webhook)/i,
+  /pagerduty[_-]?(token|key)/i,
+  /datadog[_-]?(api[_-]?key|app[_-]?key)/i,
+  /sentry[_-]?(dsn|auth[_-]?token)/i,
+  /heroku[_-]?(api[_-]?key|oauth)/i,
+  /atlassian[_-]?(token|secret)/i,
+  /jira[_-]?(token|password)/i,
+  /npm[_-]?auth[_-]?token/i,
+  /jfrog[_-]?(token|password|api)/i,
+  /firebase[_-]?(key|secret|token)/i,
+  /supabase[_-]?(key|secret|service[_-]?role)/i,
+
+  // Webhooks, Crypto, and Infrastructure
+  /webhook[_-]?(url|secret|token)/i,
+  /encryption[_-]?(key|secret|iv)/i,
   /signing[_-]?key/i,
-  /hmac[_-]?key/i,
+  /hmac[_-]?(key|secret)/i,
   /salt$/i,
-  /ssh[_-]?key/i,
-  /private[_-]?key/i,
-  /cert(ificate)?/i,
-  /credential/i,
+  /ssh[_-]?(key|private|public)/i,
+  /cert(ificate)?(s)?/i,
+  /credential(s)?/i,
+  /tls[_-]?(key|cert)/i,
+  /ssl[_-]?(key|cert)/i,
+  /kube(config)?[_-]?(token|secret)/i,
+  /vault[_-]?(token|secret|key)/i,
+  /bitcoind?[_-]?(rpc)?password/i,
 ];
 
 /**
@@ -84,37 +128,55 @@ const SENSITIVE_VALUE_PATTERNS = [
   // AWS Access Key IDs
   { pattern: /AKIA[0-9A-Z]{16}/, label: 'AWS_ACCESS_KEY_ID', severity: SecretSeverity.CRITICAL },
   // AWS Secret Access Keys (40-char base64-ish)
-  { pattern: /[A-Za-z0-9/+=]{40}/, label: 'AWS_SECRET_KEY_CANDIDATE', severity: SecretSeverity.MEDIUM },
-  // Generic high-entropy hex strings (32+ chars)
-  { pattern: /^[0-9a-f]{32,}$/i, label: 'HEX_SECRET', severity: SecretSeverity.HIGH },
-  // Generic high-entropy base64 strings (32+ chars)
-  { pattern: /^[A-Za-z0-9+/]{32,}={0,2}$/, label: 'BASE64_SECRET', severity: SecretSeverity.MEDIUM },
+  { pattern: /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/, label: 'AWS_SECRET_KEY_CANDIDATE', severity: SecretSeverity.MEDIUM },
+  
+  // Generic high-entropy hex strings (32+ chars) - Added word boundaries to reduce false positives
+  { pattern: /\b[0-9a-f]{32,}\b/i, label: 'HEX_SECRET', severity: SecretSeverity.HIGH },
+  // Generic high-entropy base64 strings (32+ chars) - Replaced rigid anchors with lookarounds
+  { pattern: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{32,}={0,2}(?![A-Za-z0-9+/])/, label: 'BASE64_SECRET', severity: SecretSeverity.MEDIUM },
+  
   // JWT tokens
-  { pattern: /^ey[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, label: 'JWT_TOKEN', severity: SecretSeverity.CRITICAL },
-  // GitHub personal access tokens
-  { pattern: /ghp_[A-Za-z0-9]{36}/, label: 'GITHUB_PAT', severity: SecretSeverity.CRITICAL },
-  { pattern: /github_pat_[A-Za-z0-9_]{82}/, label: 'GITHUB_PAT_FINE', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bey[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/, label: 'JWT_TOKEN', severity: SecretSeverity.CRITICAL },
+  
+  // GitHub access tokens (Updated for all token formats: ghp, gho, ghu, ghs, ghr, fine-grained)
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{36}\b/, label: 'GITHUB_TOKEN_CLASSIC', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{82}\b/, label: 'GITHUB_PAT_FINE', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bghs_[A-Za-z0-9\.\-_]{36,}\b/, label: 'GITHUB_APP_STATELESS_TOKEN', severity: SecretSeverity.CRITICAL }, // Supports the modern 2026 ghs_ JWT format
+
   // Stripe keys
-  { pattern: /sk_(live|test)_[A-Za-z0-9]{24,}/, label: 'STRIPE_SECRET_KEY', severity: SecretSeverity.CRITICAL },
-  { pattern: /pk_(live|test)_[A-Za-z0-9]{24,}/, label: 'STRIPE_PUBLIC_KEY', severity: SecretSeverity.HIGH },
-  // Slack tokens
-  { pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/, label: 'SLACK_TOKEN', severity: SecretSeverity.CRITICAL },
-  // Discord tokens
-  { pattern: /[MN][A-Za-z0-9]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}/, label: 'DISCORD_TOKEN', severity: SecretSeverity.CRITICAL },
-  // Twilio SID
-  { pattern: /AC[a-f0-9]{32}/, label: 'TWILIO_SID', severity: SecretSeverity.HIGH },
+  { pattern: /\bsk_(live|test)_[A-Za-z0-9]{24,}\b/, label: 'STRIPE_SECRET_KEY', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bpk_(live|test)_[A-Za-z0-9]{24,}\b/, label: 'STRIPE_PUBLIC_KEY', severity: SecretSeverity.HIGH },
+  
+  // Slack tokens & Webhooks
+  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, label: 'SLACK_TOKEN', severity: SecretSeverity.CRITICAL },
+  { pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9_]{8}\/B[A-Z0-9_]{8}\/[A-Za-z0-9_]{24}/, label: 'SLACK_WEBHOOK', severity: SecretSeverity.CRITICAL },
+
+  // Discord tokens & Webhooks
+  { pattern: /\b[MN][A-Za-z0-9]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}\b/, label: 'DISCORD_TOKEN', severity: SecretSeverity.CRITICAL },
+  { pattern: /https:\/\/discord\.com\/api\/webhooks\/[0-9]{18,20}\/[A-Za-z0-9_-]{68,}/, label: 'DISCORD_WEBHOOK', severity: SecretSeverity.CRITICAL },
+
+  // Twilio SID & Auth Token
+  { pattern: /\bAC[a-f0-9]{32}\b/, label: 'TWILIO_SID', severity: SecretSeverity.HIGH },
+  { pattern: /\b[a-f0-9]{32}\b/, label: 'TWILIO_AUTH_TOKEN_CANDIDATE', severity: SecretSeverity.MEDIUM }, // Twilio tokens are raw 32-char hex strings often found near SIDs
+
   // SendGrid API key
-  { pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/, label: 'SENDGRID_KEY', severity: SecretSeverity.CRITICAL },
-  // OpenAI API key
-  { pattern: /sk-[A-Za-z0-9]{32,}/, label: 'OPENAI_KEY', severity: SecretSeverity.CRITICAL },
-  // Generic UUID-like tokens that look like secrets (not just any UUID)
-  { pattern: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/, label: 'UUID_SECRET_CANDIDATE', severity: SecretSeverity.MEDIUM },
-  // Google API Key
-  { pattern: /AIza[0-9A-Za-z\\-_]{35}/, label: 'GOOGLE_API_KEY', severity: SecretSeverity.CRITICAL },
-  // Firebase Web API Key
-  { pattern: /AIzaSy[0-9A-Za-z\\-_]{33}/, label: 'FIREBASE_API_KEY', severity: SecretSeverity.CRITICAL },
-];
+  { pattern: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/, label: 'SENDGRID_KEY', severity: SecretSeverity.CRITICAL },
+  
+  // OpenAI & Anthropic API keys (Updated for Legacy, Project, and Claude token formats)
+  { pattern: /\bsk-[A-Za-z0-9]{32,}\b/, label: 'OPENAI_KEY_LEGACY', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bsk-proj-[A-Za-z0-9-_]{40,}\b/, label: 'OPENAI_PROJECT_KEY', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bsk-ant-sid01-[A-Za-z0-9-_]{93}\b/, label: 'ANTHROPIC_CLAUDE_KEY', severity: SecretSeverity.CRITICAL },
 
+  // Generic UUID-like tokens
+  { pattern: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i, label: 'UUID_SECRET_CANDIDATE', severity: SecretSeverity.MEDIUM },
+  
+  // Google & Firebase Key
+  { pattern: /\bAIza[0-9A-Za-z\\-_]{35}\b/, label: 'GOOGLE_API_KEY', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bAIzaSy[0-9A-Za-z\\-_]{33}\b/, label: 'FIREBASE_API_KEY', severity: SecretSeverity.CRITICAL },
+
+  // Private Key Files (Detects multi-line PEM blocks often found inside JSON/Env variables)
+  { pattern: /-----BEGIN [A-Z ]+ PRIVATE KEY-----/, label: 'PRIVATE_KEY_BLOCK', severity: SecretSeverity.CRITICAL },
+];
 /**
  * Minimum length a string value must have to be considered a potential secret.
  * Short strings like "test", "dev", "localhost" are excluded.

package/src/index.js

@@ -113,22 +113,81 @@ export class RefactoringEngine {
       
       // Pass 1: Boot environment contexts and load alias configuration maps
       await this.oxcAnalyzer.init();
+      // UPGRADE: Wire pathMapper onto context so ASTAnalyzer alias-filtering works in all code paths
+      this.context.pathMapper = this.pathMapper;
       await this.pathMapper.loadMappings(this.context.tsconfigFilename);
       
       // Always attempt workspace mesh initialization
       console.log(ansis.dim('🌐 Probing for monorepo workspace configuration...'));
       await this.workspaceGraph.initializeWorkspaceMesh();
+      // UPGRADE: Always expose workspaceGraph on context (not only when workspace is enabled)
+      this.context.workspaceGraph = this.workspaceGraph;
+      
+      // UPGRADE: Scan all discovered framework configs across the workspace EARLY
+      const discoveredConfigs = await this.workspaceGraph.findFrameworkConfigs();
+      if (discoveredConfigs.length > 0) {
+        console.log(ansis.dim(`⚙️  Detected ${discoveredConfigs.length} framework configurations...`));
+        const { FrameworkConfigParser } = await import('./resolution/FrameworkConfigParser.js');
+        const parser = new FrameworkConfigParser(this.context);
+        
+        for (const configPath of discoveredConfigs) {
+          try {
+            const content = await fs.readFile(configPath, 'utf8');
+            
+            // 1. Core Parsing (Aliases)
+            const { aliases } = parser.parse(content, configPath);
+            for (const [key, target] of aliases.entries()) {
+              this.pathMapper.addAlias(key, target);
+            }
+            
+            // 2. Plugin-based Entry Detection
+            const detectedEntries = await this.magicDetector.detectEntryPointsFromPlugins(content, configPath);
+            for (const entry of detectedEntries) {
+              const absEntry = path.resolve(path.dirname(configPath), entry).replace(/\\/g, '/');
+              if (!this.context.entryPoints.includes(absEntry)) {
+                this.context.entryPoints.push(absEntry);
+              }
+            }
+            
+            // 3. Register config file itself as entry
+            if (!this.context.entryPoints.includes(configPath)) {
+              this.context.entryPoints.push(configPath);
+            }
+          } catch (e) {}
+        }
+      }
+
       if (this.context.isWorkspaceEnabled) {
         console.log(ansis.dim('🌐 Monorepo workspace detected – mapping package mesh layers...'));
-        // Expose workspaceGraph on context for WorkspaceDiagnostic and other components
-        this.context.workspaceGraph = this.workspaceGraph;
+        
+        // NEW: Register all workspace package entry points
+        for (const [dir, manifest] of this.workspaceGraph.packageManifests.entries()) {
+          if (manifest.entryPoints && manifest.entryPoints.length > 0) {
+            for (const ep of manifest.entryPoints) {
+              if (!this.context.entryPoints.includes(ep)) {
+                this.context.entryPoints.push(ep);
+              }
+            }
+          }
+        }
+
         // Reload PathMapper aliases now that workspace roots are known
         await this.pathMapper.loadMappings(this.context.tsconfigFilename);
         if (this.context.verbose) {
-          console.log(`[Workspace] Found ${this.workspaceGraph.packageManifests.size} workspace packages:`);
+          const wsSummary = this.workspaceGraph.getSummary();
+          console.log(`[Workspace] Found ${wsSummary.packages} workspace packages:`);
           for (const [dir, manifest] of this.workspaceGraph.packageManifests.entries()) {
             console.log(ansis.dim(`  • ${manifest.name || dir}`));
           }
+          if (wsSummary.tsconfigsLoaded > 0) {
+            console.log(ansis.dim(`[Workspace] Loaded ${wsSummary.tsconfigsLoaded} tsconfig.json file(s) from workspace packages`));
+          }
+          if (wsSummary.configFilesLoaded > 0) {
+            console.log(ansis.dim(`[Workspace] Loaded ${wsSummary.configFilesLoaded} *.config.ts/js file(s) from workspace packages`));
+          }
+          if (wsSummary.monorepoConfigs && wsSummary.monorepoConfigs.length > 0) {
+            console.log(ansis.dim(`[Workspace] Detected global configs: ${wsSummary.monorepoConfigs.join(', ')}`));
+          }
         }
       }
 
@@ -200,6 +259,14 @@ export class RefactoringEngine {
       for (const filePath of sourceCodeFilesList) {
         const absFilePath = slashifyInternal(filePath);
         const node = this.context.getOrCreateNode(absFilePath);
+
+        // Config data is now handled early in the workspace mesh initialization phase.
+        // We still mark the rawCode for plugin analysis.
+        if (absFilePath.includes('.config.')) {
+          try {
+            node.rawCode = await fs.readFile(absFilePath, 'utf8');
+          } catch (e) {}
+        }
         const currentHash = await this.cacheManager.computeHash(absFilePath);
         node.contentHash = currentHash;
 
@@ -227,6 +294,7 @@ export class RefactoringEngine {
         } else if (!parallelParseCompleted) {
           this.context.metrics.cacheMisses++;
           const fileContent = await fs.readFile(filePath, 'utf8');
+          node.rawCode = fileContent; // UPGRADE: Store raw code for plugin analysis
           
           let success = false;
           if (this.oxcAnalyzer.isAvailable) {
@@ -248,6 +316,10 @@ export class RefactoringEngine {
           if (!success || (oxcFailedToFindDependencies && (hasImportExportKeywords || hasCommonJSKeywords))) {
             await this.analyzer.parseFile(filePath, fileContent, node);
           }
+
+          // UPGRADE 5.3.0: Run plugin-specific content analysis
+          await this.magicDetector.runPluginContentAnalysis(node, absFilePath);
+
           // Secret scan on freshly parsed content
           const secretFindings = this.secretScanner.scanFileContent(filePath, fileContent);
           if (secretFindings.length > 0) {
@@ -562,6 +634,17 @@ export class RefactoringEngine {
                   const nodeBuiltins = ['assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console', 'constants', 'crypto', 'dgram', 'dns', 'domain', 'events', 'fs', 'http', 'http2', 'https', 'inspector', 'module', 'net', 'os', 'path', 'perf_hooks', 'process', 'punycode', 'querystring', 'readline', 'repl', 'stream', 'string_decoder', 'timers', 'tls', 'trace_events', 'tty', 'url', 'util', 'v8', 'vm', 'worker_threads', 'zlib'];
                   if (nodeBuiltins.includes(basePkg) || nodeBuiltins.includes(basePkg.replace('node:', ''))) return;
 
+                  // UPGRADE: Skip tsconfig path aliases (e.g. @shared/*, @idk/*, ~/*)
+                  // Check full specifier AND basePkg against alias patterns
+                  if (this.pathMapper && typeof this.pathMapper.isTsconfigAlias === 'function') {
+                    if (this.pathMapper.isTsconfigAlias(specifier) || this.pathMapper.isTsconfigAlias(basePkg)) return;
+                  }
+
+                  // UPGRADE: Skip workspace packages detected via pnpm-workspace.yaml / package.json workspaces
+                  if (this.workspaceGraph && typeof this.workspaceGraph.isLocalWorkspaceSpecifier === 'function') {
+                    if (this.workspaceGraph.isLocalWorkspaceSpecifier(specifier) || this.workspaceGraph.isLocalWorkspaceSpecifier(basePkg)) return;
+                  }
+
                   if (!localDeps.has(basePkg)) {
                     const alreadyFlagged = this.context.unlistedDependencies.some(u => u.package === basePkg && u.file === filePath);
                     if (!alreadyFlagged) {
@@ -574,7 +657,7 @@ export class RefactoringEngine {
                   }
                 });
               } catch (error) {
-                if (this.context.options.verbose) {
+                if (this.context.options.verbose && error.code !== 'ENOENT') {
                   console.error(ansis.red(`      ❌ Manifest Parsing Exception: ${error.message}`));
                 }
               }

package/src/performance/GraphCache.js

@@ -59,6 +59,33 @@ export class IncrementalCacheManager {
     }
   }
 
+  /**
+   * UPGRADE 5.4.3: Affected-Only Analysis
+   * Identifies which files need re-analysis based on Git changes or cache misses.
+   */
+  async getAffectedFiles(allFiles) {
+    const manifest = await this.loadCacheManifest();
+    const affected = [];
+    const unchanged = [];
+
+    for (const file of allFiles) {
+      const cached = manifest[file];
+      if (!cached) {
+        affected.push(file);
+        continue;
+      }
+
+      const currentHash = await this.computeHash(file);
+      if (currentHash !== cached.hash) {
+        affected.push(file);
+      } else {
+        unchanged.push({ path: file, data: cached });
+      }
+    }
+
+    return { affected, unchanged };
+  }
+
   /**
    * Serializes the current active dependency graph, translating Maps and Sets into JSON schemas.
    * @param {Map<string, Object>} currentGraphState - In-memory structural project state map