llmnav 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -6,6 +6,17 @@ The npm package follows Semantic Versioning. The `llmnav/N` source protocol is v
 
 ## [Unreleased]
 
+## [0.6.1] — 2026-08-10
+
+### Added
+
+* Added compact `audit --summary` output and repository-contained `audit --output <path>` reports.
+* Added nested workspace package entrypoint discovery and Rust/Tauri command, module, and platform-lifecycle signals.
+
+### Fixed
+
+* Excluded Bun and pnpm package-manager caches from default source discovery.
+
 ## [0.6.0] — 2026-08-10
 
 ### Added

package/README.md

@@ -169,7 +169,7 @@ Line-comment cards require an explicit terminator and work with `//`, `#`, and `
 | Command | Purpose |
 | --- | --- |
 | `llmnav init` | Create configuration, registry, schemas, agent instructions, and the initial cache |
-| `llmnav audit` | Rank unannotated architectural boundary candidates without modifying source |
+| `llmnav audit` | Rank unannotated architectural boundary candidates, with compact or file-backed output |
 | `llmnav check` | Validate cards, relations, coverage rules, and registry state |
 | `llmnav format` | Rewrite safe cards into canonical order and spacing |
 | `llmnav generate` | Incrementally compile and transactionally commit generated artifacts |
@@ -250,7 +250,7 @@ Do not annotate trivial getters, generated files, obvious wrappers, every test f
 
 ## Current implementation boundary
 
-Version 0.6 adds a deterministic coverage audit that prioritizes public entrypoints, structural boundaries, and high fan-in modules while suppressing declaration files, test support code, simple barrels, and broad utilities. It suggests narrow coverage rules but never writes cards or invents semantic roles.
+Version 0.6 adds a deterministic coverage audit that prioritizes root and nested-package entrypoints, structural boundaries, Rust/Tauri runtime signals, and high fan-in modules while suppressing declaration files, dependency caches, test support code, simple barrels, and broad utilities. It suggests narrow coverage rules but never writes cards or invents semantic roles. Use `llmnav audit --summary --json` for a compact automation result or `llmnav audit --json --output .llmnav/audit.json` to keep the full candidate report out of captured stdout.
 
 LLMNav does not discover sibling repositories automatically and does not ship an MCP server, embedding database, hosted service, SCIP generator, or complete language-aware call graph. External tools may export the documented compact graph-input schema. Generated structure never writes derived edges into source cards.
 

package/docs/cli.md

@@ -32,14 +32,14 @@ Creates project configuration, schema, registry, lexicon, evaluation file, agent
 ## `llmnav audit`
 
 ```sh
-llmnav audit [--fail-on none|high|medium|low] [--json]
+llmnav audit [--summary] [--output path] [--fail-on none|high|medium|low] [--json]
 ```
 
-Reads the selected source set and ranks files that lack file or module cards. Signals include package entrypoints, public re-exports, generated command/route/schema/migration/event boundaries, import fan-in, exported declarations, and source size. Declaration files are omitted; test support code, broad utilities, and pure re-export barrels receive penalties. Candidates whose penalties reduce their score to zero are omitted.
+Reads the selected source set and ranks files that lack file or module cards. Signals include root and nested-package entrypoints, public re-exports, generated command/route/schema/migration/event boundaries, Rust/Tauri runtime boundaries, import fan-in, exported declarations, and source size. Declaration files are omitted; dependency caches, test support code, broad utilities, and pure re-export barrels are excluded or penalized. Candidates whose penalties reduce their score to zero are omitted.
 
 The command never modifies source, configuration, registries, or generated caches. Its output is advisory and exits with status 0 by default. `--fail-on high` fails only for high candidates; `medium` fails for high or medium; `low` fails for any candidate. Invalid thresholds exit with status 2.
 
-JSON output uses schemaVersion 1, repository-relative paths, deterministic ordering, explainable `reasons` and `signals`, and a path-specific `suggestedCoverageRule` for high and medium candidates. Suggestions require human or agent review: LLMNav cannot infer a durable role, ownership boundary, invariant, or semantic ID from structure alone.
+JSON output uses schemaVersion 1, repository-relative paths, deterministic ordering, explainable `reasons` and `signals`, and a path-specific `suggestedCoverageRule` for high and medium candidates. `--summary` omits candidate details. `--output <path>` writes the selected report inside the repository and emits only a compact confirmation envelope to stdout; escaping paths and symbolic-link traversal are rejected. Suggestions require human or agent review: LLMNav cannot infer a durable role, ownership boundary, invariant, or semantic ID from structure alone.
 
 ## `llmnav check`
 

package/docs/configuration.md

@@ -71,7 +71,7 @@ Every source root must remain inside the repository and cannot be a symbolic lin
 
 `includeExtensions` is an allowlist. LLMNav does not scan Markdown or YAML by default because documentation examples routinely contain card syntax.
 
-`excludeDirectories` matches directory names at any depth. `excludeFiles` uses repository-relative globs with `*`, `?`, and `**`.
+`excludeDirectories` matches directory names at any depth. Defaults exclude dependency and tool output including `node_modules`, `.bun-cache`, `.pnpm-store`, `.cache`, build directories, and language targets. `excludeFiles` uses repository-relative globs with `*`, `?`, and `**`.
 
 ## Coverage rules
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llmnav",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "A deterministic semantic navigation layer for LLM coding agents.",
   "type": "module",
   "bin": {

package/src/audit.js

@@ -47,8 +47,7 @@ export async function auditProject(root) {
     for (const target of unique) importedBy.get(target)?.add(file);
   }
 
-  const packageJson = await readJsonSafe(path.join(root, "package.json"), {});
-  const entrypoints = collectPackageEntrypoints(packageJson, fileByPath);
+  const entrypoints = await collectWorkspacePackageEntrypoints(root, fileByPath);
   const publicApiPaths = collectPublicApiPaths(entrypoints, fileByPath);
   const candidates = [];
 
@@ -58,6 +57,7 @@ export async function auditProject(root) {
     const boundaries = detectBoundaries({
       relativePath: file,
       card: { effect: [], risk: [] },
+      source: record.source ?? "",
     }).map((boundary) => boundary.kind);
     const exportedDeclarations = countExportedDeclarations(record.source ?? "", file);
     const entrypoint = entrypoints.has(file);
@@ -174,14 +174,34 @@ function buildCoverageSuggestion(file) {
   };
 }
 
-function collectPackageEntrypoints(packageJson, fileByPath) {
+async function collectWorkspacePackageEntrypoints(root, fileByPath) {
+  const packageDirectories = new Set([""]);
+  for (const file of fileByPath.keys()) {
+    let directory = path.posix.dirname(file);
+    while (directory !== "." && directory !== "") {
+      packageDirectories.add(directory);
+      const parent = path.posix.dirname(directory);
+      if (parent === directory || parent === ".") break;
+      directory = parent;
+    }
+  }
+  const entrypoints = new Set();
+  for (const directory of [...packageDirectories].sort(compareText)) {
+    const packageJson = await readJsonSafe(path.join(root, directory, "package.json"), null);
+    if (!packageJson || typeof packageJson !== "object") continue;
+    for (const entrypoint of collectPackageEntrypoints(packageJson, fileByPath, directory)) entrypoints.add(entrypoint);
+  }
+  return entrypoints;
+}
+
+function collectPackageEntrypoints(packageJson, fileByPath, packageDirectory = "") {
   const raw = [packageJson?.main, packageJson?.module, ...collectStringLeaves(packageJson?.bin), ...collectStringLeaves(packageJson?.exports)];
   const entrypoints = new Set();
   for (const value of raw) {
     if (typeof value !== "string" || /\.d\.[cm]?ts$/u.test(value)) continue;
     const normalized = normalizePackagePath(value);
     if (!normalized) continue;
-    const resolved = resolveProjectPath(normalized, fileByPath);
+    const resolved = resolveProjectPath(path.posix.join(packageDirectory, normalized), fileByPath);
     if (resolved) entrypoints.add(resolved);
   }
   return entrypoints;
@@ -237,12 +257,52 @@ function isReexportBarrel(source, file) {
 }
 
 function resolveLocalSpecifier(fromFile, specifier, fileByPath) {
+  if (/\.rs$/u.test(fromFile)) return resolveRustSpecifier(fromFile, specifier, fileByPath);
   if (!specifier.startsWith(".")) return null;
   const base = path.posix.normalize(path.posix.join(path.posix.dirname(fromFile), toPosix(specifier)));
   if (base.startsWith("../") || base === "..") return null;
   return resolveProjectPath(base, fileByPath);
 }
 
+function resolveRustSpecifier(fromFile, specifier, fileByPath) {
+  const normalized = specifier
+    .replace(/\s+as\s+.+$/u, "")
+    .replace(/::\{[\s\S]*$/u, "")
+    .replace(/::\*$/u, "")
+    .trim();
+  if (!normalized || /[{}(),]/u.test(normalized)) return null;
+  const parts = normalized.split("::").filter(Boolean);
+  const sourceIndex = fromFile.split("/").lastIndexOf("src");
+  const crateSource = sourceIndex >= 0 ? fromFile.split("/").slice(0, sourceIndex + 1).join("/") : path.posix.dirname(fromFile);
+  let base;
+  if (parts[0] === "crate") {
+    parts.shift();
+    base = crateSource;
+  } else if (parts[0] === "self") {
+    parts.shift();
+    base = rustModuleDirectory(fromFile);
+  } else if (parts[0] === "super") {
+    while (parts[0] === "super") {
+      parts.shift();
+      base = path.posix.dirname(base ?? rustModuleDirectory(fromFile));
+    }
+  } else {
+    base = rustModuleDirectory(fromFile);
+  }
+  if (parts.length === 0) return null;
+  const candidate = path.posix.join(base, ...parts);
+  return [
+    `${candidate}.rs`,
+    `${candidate}/mod.rs`,
+  ].find((value) => fileByPath.has(value)) ?? null;
+}
+
+function rustModuleDirectory(fromFile) {
+  const basename = path.posix.basename(fromFile);
+  if (basename === "lib.rs" || basename === "main.rs" || basename === "mod.rs") return path.posix.dirname(fromFile);
+  return path.posix.join(path.posix.dirname(fromFile), path.posix.basename(fromFile, ".rs"));
+}
+
 function resolveProjectPath(candidate, fileByPath) {
   const values = [candidate];
   const extension = path.posix.extname(candidate);

package/src/boundaries.js

@@ -11,13 +11,14 @@ stability=architecture
 import path from "node:path";
 import { compareText, toPosix } from "./util.js";
 
-export const BOUNDARY_KINDS = Object.freeze(["command", "event", "migration", "route", "schema"]);
+export const BOUNDARY_KINDS = Object.freeze(["command", "event", "migration", "route", "runtime", "schema"]);
 
 export function detectBoundaries(record) {
   const relativePath = toPosix(record.relativePath).toLowerCase();
   const basename = path.posix.basename(relativePath);
   const effects = record.card.effect ?? [];
   const risks = record.card.risk ?? [];
+  const source = record.source ?? "";
   const boundaries = new Map();
   const add = (kind, confidence, evidence) => {
     const current = boundaries.get(kind);
@@ -45,6 +46,14 @@ export function detectBoundaries(record) {
   if (/(?:^|\/)(?:commands?|cli|bin)(?:\/|$)/u.test(relativePath) || /(?:command|cmd)\.[^.]+$/u.test(basename)) {
     add("command", "high", "path");
   }
+  if (/\.rs$/u.test(relativePath) && /#\[tauri::command\]|tauri::generate_handler!/u.test(source)) {
+    add("command", "high", "tauri-command");
+  }
+  if (/\.rs$/u.test(relativePath) &&
+      /#\[cfg\((?:windows|unix|target_(?:os|family))/u.test(source) &&
+      /\b(?:Drop|shutdown|terminate|kill|process_group|job_object)\b/iu.test(source)) {
+    add("runtime", "medium", "platform-lifecycle");
+  }
 
   return [...boundaries.values()].sort((left, right) => compareText(left.kind, right.kind));
 }

package/src/cli.js

@@ -31,7 +31,7 @@ import {
   SPEC_VERSION,
   STABILITIES,
 } from "./spec.js";
-import { parseInteger } from "./util.js";
+import { assertNoSymlinkTraversal, atomicWrite, parseInteger, relativePosix } from "./util.js";
 import { diagnosticsToSarif } from "./sarif.js";
 import { loadGraphInputs } from "./graph-input.js";
 import { renderGraphNode } from "./graph.js";
@@ -40,7 +40,7 @@ import { loadPromptPrefixBundle } from "./prompt-bundle.js";
 import { diagnosticsToEditor, getEditorIntegration } from "./editor.js";
 import { AUDIT_PRIORITIES, auditHasFindings, auditProject } from "./audit.js";
 
-const VALUE_OPTIONS = new Set(["--root", "--format", "--top", "--depth", "--budget", "--max-edges", "--agents", "--file", "--fail-on"]);
+const VALUE_OPTIONS = new Set(["--root", "--format", "--top", "--depth", "--budget", "--max-edges", "--agents", "--file", "--fail-on", "--output"]);
 
 const COMMAND_OPTIONS = Object.freeze({
   init: new Set(["--agents", "--package-scripts", "--force", "--root", "--json"]),
@@ -53,7 +53,7 @@ const COMMAND_OPTIONS = Object.freeze({
   context: new Set(["--depth", "--budget", "--max-edges", "--root", "--json"]),
   eval: new Set(["--file", "--top", "--root", "--json"]),
   doctor: new Set(["--root", "--json"]),
-  audit: new Set(["--root", "--json", "--fail-on"]),
+  audit: new Set(["--root", "--json", "--summary", "--fail-on", "--output"]),
   spec: new Set(["--root", "--json"]),
   tools: new Set(["--json"]),
   bundle: new Set(["--root", "--json"]),
@@ -300,10 +300,27 @@ async function runAudit(root, args, json) {
   if (failOn !== "none" && !AUDIT_PRIORITIES.includes(failOn)) {
     throw usageError(`audit --fail-on must be one of none, ${AUDIT_PRIORITIES.join(", ")}.`);
   }
+  const outputOption = getOption(args, "--output");
+  const outputPath = outputOption ? path.resolve(root, outputOption) : null;
+  if (outputPath) {
+    try {
+      await assertNoSymlinkTraversal(root, outputPath, "audit output file");
+    } catch (error) {
+      throw usageError(error instanceof Error ? error.message : String(error));
+    }
+  }
   const result = await auditProject(root);
   const report = { ...result, failOn };
+  const selectedReport = hasFlag(args, "--summary")
+    ? { schemaVersion: result.schemaVersion, repositoryId: result.repositoryId, summary: result.summary, failOn }
+    : report;
+  if (outputPath) {
+    await atomicWrite(outputPath, `${JSON.stringify(selectedReport, null, 2)}\n`);
+  }
   if (json) {
-    console.log(JSON.stringify(report, null, 2));
+    console.log(JSON.stringify(outputPath
+      ? { schemaVersion: result.schemaVersion, repositoryId: result.repositoryId, summary: result.summary, failOn, output: relativePosix(root, outputPath) }
+      : selectedReport, null, 2));
   } else {
     const { summary } = result;
     console.log(
@@ -314,6 +331,7 @@ async function runAudit(root, args, json) {
       console.log(`${candidate.priority} ${candidate.path} score=${candidate.score} ${candidate.reasons.join(",")}`);
     }
     if (summary.low > 0) console.log(`${summary.low} low-priority candidate(s) are available in --json output.`);
+    if (outputPath) console.log(`wrote ${relativePosix(root, outputPath)}`);
   }
   return auditHasFindings(result, failOn) ? 1 : 0;
 }
@@ -474,7 +492,7 @@ Usage
   llmnav context <semantic-id> [--depth 1] [--budget 2500] [--max-edges 24]
   llmnav eval [--file path] [--top 5]
   llmnav doctor
-  llmnav audit [--fail-on none|high|medium|low]
+  llmnav audit [--summary] [--output path] [--fail-on none|high|medium|low]
   llmnav spec
   llmnav tools [--json]
   llmnav bundle [--json]

package/src/spec.js

@@ -10,7 +10,7 @@ rel=workflow>llmnav.rules.validate
 stability=contract
 */
 
-export const PACKAGE_VERSION = "0.6.0";
+export const PACKAGE_VERSION = "0.6.1";
 export const SPEC_VERSION = "1";
 
 export const SCOPES = Object.freeze(["file", "module", "symbol"]);
@@ -163,6 +163,8 @@ export const DEFAULT_EXCLUDED_DIRECTORIES = Object.freeze([
   ".astro",
   ".turbo",
   ".cache",
+  ".bun-cache",
+  ".pnpm-store",
   "target",
   "bin",
   "obj",