projscan 0.9.2 → 0.11.0

package/README.md

@@ -20,7 +20,7 @@
 
 AI coding agents are becoming the primary interface to code. Today, when you ask your agent *"which files implement auth?"* or *"what breaks if I bump React from 18 to 19?"* - it either guesses from names, or it shells out to grep and reads raw output not built for it.
 
-**projscan is the first code-intelligence tool built for agents, not for humans.** Your agent gets a fast, AST-accurate, context-budget-aware view of your codebase through 13 structured MCP tools. It can query the import graph, find symbol definitions, preview upgrades, rank hotspots - without loading the file tree into its context.
+**projscan is the first code-intelligence tool built for agents, not for humans.** Your agent gets a fast, AST-accurate, context-budget-aware view of your codebase through 17 structured MCP tools. It can query the import graph, find symbol definitions, preview upgrades, rank hotspots, diff structural changes between refs, and surface coupling/cycle hotspots - without loading the file tree into its context.
 
 Humans get the same thing through the CLI.
 
@@ -190,10 +190,34 @@ This outputs a [shields.io](https://shields.io) badge URL and markdown snippet y
 
 ## What It Detects
 
-**Languages**: TypeScript, JavaScript, Python, Go, Rust, Java, Ruby, C/C++, PHP, Swift, Kotlin, and 20+ more
+**Languages**: TypeScript, JavaScript, Python, and Go (full AST analysis for all four), plus file-level detection for Rust, Java, Ruby, C/C++, PHP, Swift, Kotlin, and 20+ more.
 
 **Frameworks**: React, Next.js, Vue, Nuxt, Svelte, Angular, Express, Fastify, NestJS, Vite, Tailwind CSS, Prisma, and more
 
+### Python (0.10)
+
+Python repos now get the same treatment JS/TS has had since 0.6:
+
+- **AST-accurate import graph.** `from pkg.mod import x`, relative imports, `__init__.py` packages, `__all__`. Parsed via tree-sitter-python (wasm, offline).
+- **Python-aware analyzers.** Missing pytest / ruff / black config. Deprecated packages (nose, simplejson, pycrypto). Unused `pyproject.toml` / `requirements.txt` deps. Missing lockfile.
+- **Code search.** BM25 and semantic modes work on `.py` files out of the box.
+- **Hotspots + dead code.** Same scoring as JS/TS, with `__init__.py` and pytest test-file conventions understood.
+- **MCP tools work unchanged.** `projscan_graph`, `projscan_search`, `projscan_doctor`, `projscan_hotspots`, etc. all accept Python projects. Agents can ask "which files import `pkg.core`?" and get an answer in milliseconds.
+
+`projscan_upgrade` remains Node-only for now - a Python equivalent (reading pip / poetry metadata) is on the roadmap.
+
+### Bundle (0.11)
+
+0.11.0 is a multi-theme bundle. Five releases of work shipped under one version:
+
+- **Signal Quality (was 0.11)** - the hotspot risk score now uses AST-derived **cyclomatic complexity** instead of a line-count proxy. Per-file CC is exposed via `projscan_file` and the new `projscan_coupling` tool. Coupling metrics (fan-in / fan-out / instability) and **circular-import detection** (Tarjan SCC) ship as a first-class `projscan coupling` command and MCP tool.
+- **PR Native (was 0.12)** - new `projscan_pr_diff` tool returns the **structural** diff between two refs: exports added/removed, imports added/removed, call sites added/removed, ΔCC, Δfan-in. Stands up a temporary git worktree at the base ref to get a clean second graph. What an agent reviewing a PR actually wants to know.
+- **Monorepo (was 0.13)** - workspace detection for npm/yarn workspaces, pnpm-workspace.yaml, and Nx/Turbo/Lerna fallback. New `projscan workspaces` command lists every package; `--package <name>` (and the `package` MCP arg) scope `hotspots` and `coupling` to a single workspace.
+- **Observability (was 0.14)** - **opt-in**, privacy-preserving telemetry. Records only tool name, duration, success, version, timestamp; never source content, paths, or arguments. Off by default; enable via `.projscanrc` `telemetry.enabled` or `PROJSCAN_TELEMETRY=1`. Sink is a local JSONL file you control. New `projscan_telemetry` tool surfaces effective state.
+- **Second Language (was 0.15)** - **Go** via tree-sitter-go. Go files now flow through the same graph / hotspot / coupling / pr-diff pipeline as JS/TS and Python. `go.mod` parsed for module-path resolution; capitalization rule applied for export visibility.
+
+Cache version bumped 2 → 3 (CC stored per file). Existing v2 caches are discarded on first 0.11 run and rebuilt automatically.
+
 **Issues**:
 - Missing linting (ESLint) and formatting (Prettier) configuration
 - Missing test framework
@@ -210,7 +234,7 @@ This outputs a [shields.io](https://shields.io) badge URL and markdown snippet y
 - **5,000 files** analyzed in under 1.5 seconds
 - **20,000 files** analyzed in under 3 seconds
 - **Zero network requests** - everything runs locally
-- **4 runtime dependencies** - minimal footprint
+- **9 runtime dependencies** - still minimal (the three tree-sitter packages bring ~850 KB of vendored wasm: web-tree-sitter ~190 KB, tree-sitter-python ~450 KB, tree-sitter-go ~210 KB)
 
 ## CI/CD Integration
 
@@ -417,17 +441,19 @@ claude mcp add projscan -- npx projscan mcp
 - *"What breaks if I bump chalk to 6?"* → `projscan_upgrade { package: "chalk" }`
 - *"Where should I refactor first?"* → `projscan_hotspots`
 
-### The 13 MCP tools
+### The 17 MCP tools
 
-**Structural (0.6.0 - new, agent-native):**
+**Structural (0.6.0 / 0.11 — agent-native):**
 - **`projscan_graph`** - query the AST-based code graph. Directions: `imports`, `exports`, `importers`, `symbol_defs`, `package_importers`. Millisecond responses on a warm cache.
 - **`projscan_search`** - fast search across `symbols` (exported names), `files` (path substring), or `content` (source substring with line + excerpt). Replaces the temptation to shell out to grep.
+- **`projscan_coupling`** *(0.11)* - per-file fan-in / fan-out / instability + circular-import cycles (Tarjan SCC). Filter by `direction: cycles_only | high_fan_in | high_fan_out`.
+- **`projscan_pr_diff`** *(0.11)* - structural diff between two git refs. Returns added/removed/modified files with explicit lists of exports, imports, and call sites that changed, plus ΔCC and Δfan-in.
 
 **Analysis:**
 - `projscan_analyze` - full project report
 - `projscan_doctor` - health score + issues
-- `projscan_hotspots` - risk-ranked files (churn × complexity × issues × ownership × coverage)
-- `projscan_file` - per-file risk + ownership + related issues
+- `projscan_hotspots` - risk-ranked files (churn × **AST cyclomatic complexity** × issues × ownership × coverage; falls back to LOC for non-AST languages)
+- `projscan_file` - per-file risk + ownership + related issues + CC + fan-in/fan-out
 - `projscan_explain` - per-file purpose, imports, exports, smells
 - `projscan_structure` - directory tree
 - `projscan_coverage` - scariest untested files (coverage × hotspots)
@@ -438,6 +464,10 @@ claude mcp add projscan -- npx projscan mcp
 - `projscan_audit` - normalized `npm audit`
 - `projscan_upgrade` - upgrade preview (CHANGELOG + importers, offline)
 
+**Workspace + observability (0.11):**
+- `projscan_workspaces` - list monorepo packages (npm/yarn/pnpm/Nx/Turbo/Lerna). Use the `name` as the `package` arg on `projscan_hotspots` / `projscan_coupling` to scope.
+- `projscan_telemetry` - inspect opt-in telemetry state (enabled?, sink path, env override).
+
 ### Context-window budgeting
 
 **Every MCP tool accepts an optional `max_tokens` argument.** Set it and projscan serializes the result, and - if over budget - truncates the largest array field record-by-record until it fits. Responses include a `_budget` sidecar when truncated so your agent knows it got a partial view.

package/dist/analyzers/deadCodeCheck.d.ts

@@ -1,18 +1,16 @@
 import type { FileEntry, Issue } from '../types.js';
 /**
- * Flag exports that are never imported anywhere in the project. This catches:
- * - dead named exports left over from refactors
- * - utilities that are implemented but never hooked up
+ * Flag source files whose exports nothing imports. Language-agnostic: uses the
+ * code graph directly, so JS/TS/Python all get the same correctness guarantees.
  *
- * Does NOT flag:
- * - files listed as the package's public entry points (main, exports, types, bin)
- * - default exports (too many false positives - framework conventions)
- * - test files (they're not supposed to export)
- * - index files (barrels re-export for public use)
+ * Skipped:
+ *   - public package entries (main/exports/bin/types in package.json)
+ *   - test files (JS conventions + pytest `test_*.py` / `*_test.py` / `tests/`)
+ *   - barrel files (`index.*` for JS, `__init__.py` for Python)
+ *   - default-only exports (too many framework false positives)
  *
- * False-positive guard: if a file is the target of at least one import, we treat
- * all its exports as "possibly used" - the regex-based graph can't tell which
- * named export is imported via `import { ... } from './barrel'`. This keeps
- * noise low at the cost of missing some dead exports that live in used files.
+ * False-positive guard: if any import resolves to this file, we treat ALL its
+ * exports as possibly used - the graph can't always tell which named export
+ * got picked up from a barrel.
  */
 export declare function check(rootPath: string, files: FileEntry[]): Promise<Issue[]>;

package/dist/analyzers/deadCodeCheck.js

@@ -1,47 +1,36 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { buildImportGraph } from '../core/importGraph.js';
-import { extractExports } from '../core/fileInspector.js';
-const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts']);
-// Never flag these - they're public API by definition
+import { buildCodeGraph } from '../core/codeGraph.js';
+import { getAdapterFor } from '../core/languages/registry.js';
+const SOURCE_EXTENSIONS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts',
+    '.py', '.pyw',
+]);
+// Never flag these - they're public API by definition (JS convention).
 const PUBLIC_PATH_PREFIXES = ['src/index', 'index.'];
+// Names (sans extension) that are barrel-equivalents and should never be
+// flagged as dead. `index` for JS/TS, `__init__` for Python packages.
+const BARREL_BASENAMES = new Set(['index', '__init__']);
 /**
- * Flag exports that are never imported anywhere in the project. This catches:
- * - dead named exports left over from refactors
- * - utilities that are implemented but never hooked up
+ * Flag source files whose exports nothing imports. Language-agnostic: uses the
+ * code graph directly, so JS/TS/Python all get the same correctness guarantees.
  *
- * Does NOT flag:
- * - files listed as the package's public entry points (main, exports, types, bin)
- * - default exports (too many false positives - framework conventions)
- * - test files (they're not supposed to export)
- * - index files (barrels re-export for public use)
+ * Skipped:
+ *   - public package entries (main/exports/bin/types in package.json)
+ *   - test files (JS conventions + pytest `test_*.py` / `*_test.py` / `tests/`)
+ *   - barrel files (`index.*` for JS, `__init__.py` for Python)
+ *   - default-only exports (too many framework false positives)
  *
- * False-positive guard: if a file is the target of at least one import, we treat
- * all its exports as "possibly used" - the regex-based graph can't tell which
- * named export is imported via `import { ... } from './barrel'`. This keeps
- * noise low at the cost of missing some dead exports that live in used files.
+ * False-positive guard: if any import resolves to this file, we treat ALL its
+ * exports as possibly used - the graph can't always tell which named export
+ * got picked up from a barrel.
  */
 export async function check(rootPath, files) {
     const sourceFiles = files.filter((f) => SOURCE_EXTENSIONS.has(f.extension));
     if (sourceFiles.length === 0)
         return [];
     const publicEntries = await loadPublicEntries(rootPath);
-    const graph = await buildImportGraph(rootPath, sourceFiles);
-    // Build a set of files that are the target of at least one relative import.
-    // A relative import specifier is resolved against its importing file's dir,
-    // so we convert each relative specifier into a candidate target path.
-    const importedTargets = new Set();
-    for (const [importingFile, specifiers] of graph.byFile) {
-        const importingDir = path.posix.dirname(importingFile);
-        for (const spec of specifiers) {
-            if (!spec.startsWith('.'))
-                continue;
-            const resolved = path.posix.normalize(path.posix.join(importingDir, spec));
-            for (const candidate of resolutionCandidates(resolved)) {
-                importedTargets.add(candidate);
-            }
-        }
-    }
+    const graph = await buildCodeGraph(rootPath, sourceFiles);
     const issues = [];
     for (const file of sourceFiles) {
         if (isTestFile(file.relativePath))
@@ -50,27 +39,25 @@ export async function check(rootPath, files) {
             continue;
         if (isPublicEntry(file.relativePath, publicEntries))
             continue;
-        if (importedTargets.has(file.relativePath))
+        // Any importer → file is used.
+        if ((graph.localImporters.get(file.relativePath)?.size ?? 0) > 0)
             continue;
-        if (importedTargets.has(stripExtension(file.relativePath)))
+        const graphFile = graph.files.get(file.relativePath);
+        if (!graphFile || !graphFile.parseOk)
             continue;
-        let content;
-        try {
-            content = await fs.readFile(file.absolutePath, 'utf-8');
-        }
-        catch {
-            continue;
-        }
-        const exports = extractExports(content).filter((e) => e.type !== 'default' && e.name !== 'default');
-        if (exports.length === 0)
+        const namedExports = graphFile.exports.filter((e) => e.name !== 'default' && e.kind !== 'default');
+        if (namedExports.length === 0)
             continue;
+        const adapter = getAdapterFor(file.relativePath);
+        const languageLabel = adapter?.id ?? 'file';
+        const kindLabel = languageLabel === 'python' ? 'name' : 'export';
         issues.push({
             id: `unused-exports-${file.relativePath}`,
-            title: `Unused exports in ${file.relativePath}`,
-            description: `${exports.length} named export${exports.length === 1 ? '' : 's'} (${exports
+            title: `Unused ${kindLabel}s in ${file.relativePath}`,
+            description: `${namedExports.length} named ${kindLabel}${namedExports.length === 1 ? '' : 's'} (${namedExports
                 .slice(0, 5)
                 .map((e) => e.name)
-                .join(', ')}${exports.length > 5 ? `, … +${exports.length - 5}` : ''}) but nothing in the project imports this file. Dead code or awaiting wiring?`,
+                .join(', ')}${namedExports.length > 5 ? `, … +${namedExports.length - 5}` : ''}) but nothing in the project imports this file. Dead code or awaiting wiring?`,
             severity: 'info',
             category: 'architecture',
             fixAvailable: false,
@@ -80,14 +67,19 @@ export async function check(rootPath, files) {
     return issues;
 }
 function isTestFile(relativePath) {
+    const base = path.basename(relativePath);
     return (relativePath.includes('.test.') ||
         relativePath.includes('.spec.') ||
         relativePath.includes('__tests__') ||
-        relativePath.startsWith('tests/'));
+        relativePath.startsWith('tests/') ||
+        relativePath.includes('/tests/') ||
+        // pytest conventions
+        /^test_.+\.py$/.test(base) ||
+        /^.+_test\.py$/.test(base));
 }
 function isBarrelFile(relativePath) {
     const base = path.basename(relativePath, path.extname(relativePath));
-    return base === 'index';
+    return BARREL_BASENAMES.has(base);
 }
 function isPublicEntry(relativePath, publicEntries) {
     if (publicEntries.has(relativePath))
@@ -104,26 +96,6 @@ function stripExtension(p) {
     const ext = path.extname(p);
     return ext ? p.slice(0, -ext.length) : p;
 }
-/**
- * Return the set of possible resolution targets for a relative import
- * specifier (already joined+normalized). For './foo' we yield:
- *   foo, foo.ts, foo.tsx, foo.js, foo.jsx, foo.mjs, foo.cjs,
- *   foo/index.ts, foo/index.tsx, foo/index.js, ...
- */
-function resolutionCandidates(base) {
-    const exts = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts'];
-    const out = [base];
-    for (const ext of exts) {
-        out.push(base + ext);
-        out.push(base + '/index' + ext);
-    }
-    // Handle imports written with an explicit ".js" that actually resolve to a .ts file (ESM+NodeNext)
-    if (base.endsWith('.js')) {
-        const noJs = base.slice(0, -3);
-        out.push(noJs + '.ts', noJs + '.tsx');
-    }
-    return out;
-}
 async function loadPublicEntries(rootPath) {
     const entries = new Set();
     const pkgPath = path.join(rootPath, 'package.json');
@@ -143,7 +115,7 @@ async function loadPublicEntries(rootPath) {
         collectExports(pkg.exports, entries);
     }
     catch {
-        // package.json missing/unreadable - don't guard, every file is a candidate
+        // package.json missing - nothing to guard
     }
     return entries;
 }

package/dist/analyzers/deadCodeCheck.js.map

@@ -1 +1 @@
-{"version":3,"file":"deadCodeCheck.js","sourceRoot":"","sources":["../../src/analyzers/deadCodeCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAElG,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAWrD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAE5D,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,KAAK,MAAM,SAAS,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5C,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC;YAAE,SAAS;QAC9D,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QACrD,IAAI,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAE,SAAS;QAErE,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACpG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,kBAAkB,IAAI,CAAC,YAAY,EAAE;YACzC,KAAK,EAAE,qBAAqB,IAAI,CAAC,YAAY,EAAE;YAC/C,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO;iBACtF,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,+EAA+E;YACrJ,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB;IACtC,OAAO,CACL,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,YAAoB;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,aAA0B;IACrE,IAAI,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC1C,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;aAC5D,IAAI,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,KAAa;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,YAAqB,EAAE,GAAgB;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,YAAuC,CAAC,EAAE,CAAC;QAC3E,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}
+{"version":3,"file":"deadCodeCheck.js","sourceRoot":"","sources":["../../src/analyzers/deadCodeCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5D,KAAK,EAAE,MAAM;CACd,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAErD,yEAAyE;AACzE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAUxD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5C,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC;YAAE,SAAS;QAE9D,+BAA+B;QAC/B,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,SAAS;QAE3E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,SAAS;QAE/C,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CACpD,CAAC;QACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAExC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,OAAO,EAAE,EAAE,IAAI,MAAM,CAAC;QAC5C,MAAM,SAAS,GAAG,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEjE,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,kBAAkB,IAAI,CAAC,YAAY,EAAE;YACzC,KAAK,EAAE,UAAU,SAAS,QAAQ,IAAI,CAAC,YAAY,EAAE;YACrD,WAAW,EAAE,GAAG,YAAY,CAAC,MAAM,UAAU,SAAS,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,YAAY;iBAC3G,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,+EAA+E;YAC/J,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,CACL,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC;QACjC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;QAChC,qBAAqB;QACrB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,YAAoB;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,aAA0B;IACrE,IAAI,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC1C,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;aAC5D,IAAI,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,KAAa;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,YAAqB,EAAE,GAAgB;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,YAAuC,CAAC,EAAE,CAAC;QAC3E,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/dist/analyzers/pythonDependencyRiskCheck.d.ts

@@ -0,0 +1,2 @@
+import type { FileEntry, Issue } from '../types.js';
+export declare function check(rootPath: string, files: FileEntry[]): Promise<Issue[]>;

package/dist/analyzers/pythonDependencyRiskCheck.js

@@ -0,0 +1,114 @@
+import { detectPythonProject } from '../core/languages/pythonManifests.js';
+// Small, conservative seed lists. Easy to extend later.
+const DEPRECATED_WARNING = new Set([
+    'nose',
+    'simplejson',
+    'pycrypto',
+    'mysql-python',
+]);
+const DEPRECATED_INFO = new Set([
+    'python-dateutil',
+]);
+const HEAVY_INFO = new Set([
+    'pandas',
+    'numpy',
+    'torch',
+    'tensorflow',
+]);
+const DEPRECATION_REASONS = {
+    nose: 'nose is retired. Use pytest instead.',
+    simplejson: 'simplejson is no longer needed; the stdlib json module is equivalent for most use cases.',
+    pycrypto: 'pycrypto is unmaintained. Use pycryptodome as a drop-in replacement.',
+    'mysql-python': 'mysql-python is Python 2 only. Use mysqlclient or PyMySQL.',
+    'python-dateutil': 'python-dateutil is heavy. Many use cases are now covered by stdlib datetime.',
+};
+const HEAVY_REASONS = {
+    pandas: 'pandas is a heavy dependency (~30MB). Reach for it only if you actually need dataframes.',
+    numpy: 'numpy is a heavy dependency (~15MB). Only pull it if you need numerical arrays.',
+    torch: 'torch is a very heavy dependency. Consider torch-cpu if GPU is not needed.',
+    tensorflow: 'tensorflow is a very heavy dependency. Consider tensorflow-cpu for inference-only use.',
+};
+export async function check(rootPath, files) {
+    const info = await detectPythonProject(rootPath, files);
+    if (!info)
+        return [];
+    const issues = [];
+    const seen = new Set();
+    for (const dep of info.declared) {
+        const id = `dep-risk-${dep.name}`;
+        if (seen.has(id))
+            continue;
+        if (DEPRECATED_WARNING.has(dep.name)) {
+            seen.add(id);
+            issues.push({
+                id,
+                title: `Deprecated Python package: ${dep.name}`,
+                description: DEPRECATION_REASONS[dep.name] ?? `${dep.name} is deprecated.`,
+                severity: 'error',
+                category: 'dependencies',
+                fixAvailable: false,
+                locations: [{ file: dep.source, line: dep.line }],
+            });
+            continue;
+        }
+        if (DEPRECATED_INFO.has(dep.name)) {
+            seen.add(id);
+            issues.push({
+                id,
+                title: `Consider alternatives to ${dep.name}`,
+                description: DEPRECATION_REASONS[dep.name] ?? `${dep.name} may be avoidable.`,
+                severity: 'info',
+                category: 'dependencies',
+                fixAvailable: false,
+                locations: [{ file: dep.source, line: dep.line }],
+            });
+            continue;
+        }
+        if (HEAVY_INFO.has(dep.name)) {
+            seen.add(id);
+            issues.push({
+                id,
+                title: `Heavy Python dependency: ${dep.name}`,
+                description: HEAVY_REASONS[dep.name] ?? `${dep.name} is a heavy dependency.`,
+                severity: 'info',
+                category: 'dependencies',
+                fixAvailable: false,
+                locations: [{ file: dep.source, line: dep.line }],
+            });
+            continue;
+        }
+        // Wildcard / unpinned: only flag entries that came from a requirements file
+        // (pyproject.toml dependency strings without a version spec are common and
+        // not a smell). An empty versionSpec from requirements.txt IS a smell.
+        if (dep.source.endsWith('.txt') &&
+            (dep.versionSpec === '' || dep.versionSpec === '*')) {
+            seen.add(id);
+            issues.push({
+                id,
+                title: `Unpinned Python dependency: ${dep.name}`,
+                description: `\`${dep.name}\` in ${dep.source} has no version constraint. Pin to a specific version (==X.Y.Z) for reproducible builds.`,
+                severity: 'error',
+                category: 'dependencies',
+                fixAvailable: false,
+                locations: [{ file: dep.source, line: dep.line }],
+            });
+        }
+    }
+    // No-lockfile: only emit if there ARE declared deps AND no lockfile-like
+    // thing exists. pyproject-only projects without a lockfile are fine for
+    // library-style packages, so this is a warning not an error.
+    if (!info.hasLockfile && info.declared.length > 0) {
+        const severity = 'warning';
+        issues.push({
+            id: 'dep-risk-no-python-lockfile',
+            title: 'No Python lockfile detected',
+            description: 'No lockfile (poetry.lock / Pipfile.lock / pdm.lock / uv.lock / conda-lock.yml) or pinned requirements.txt found. Builds may resolve different versions over time.',
+            severity,
+            category: 'dependencies',
+            fixAvailable: false,
+            locations: [{ file: info.manifestFiles[0] ?? 'pyproject.toml' }],
+        });
+    }
+    return issues;
+}
+//# sourceMappingURL=pythonDependencyRiskCheck.js.map

package/dist/analyzers/pythonDependencyRiskCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pythonDependencyRiskCheck.js","sourceRoot":"","sources":["../../src/analyzers/pythonDependencyRiskCheck.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,wDAAwD;AACxD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,MAAM;IACN,YAAY;IACZ,UAAU;IACV,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,sCAAsC;IAC5C,UAAU,EAAE,0FAA0F;IACtG,QAAQ,EAAE,sEAAsE;IAChF,cAAc,EAAE,4DAA4D;IAC5E,iBAAiB,EAAE,8EAA8E;CAClG,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,0FAA0F;IAClG,KAAK,EAAE,iFAAiF;IACxF,KAAK,EAAE,4EAA4E;IACnF,UAAU,EAAE,wFAAwF;CACrG,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,YAAY,GAAG,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAE3B,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE;gBACF,KAAK,EAAE,8BAA8B,GAAG,CAAC,IAAI,EAAE;gBAC/C,WAAW,EAAE,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,iBAAiB;gBAC1E,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,cAAc;gBACxB,YAAY,EAAE,KAAK;gBACnB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAClD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE;gBACF,KAAK,EAAE,4BAA4B,GAAG,CAAC,IAAI,EAAE;gBAC7C,WAAW,EAAE,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,oBAAoB;gBAC7E,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,cAAc;gBACxB,YAAY,EAAE,KAAK;gBACnB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAClD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE;gBACF,KAAK,EAAE,4BAA4B,GAAG,CAAC,IAAI,EAAE;gBAC7C,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,yBAAyB;gBAC5E,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,cAAc;gBACxB,YAAY,EAAE,KAAK;gBACnB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAClD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,IACE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3B,CAAC,GAAG,CAAC,WAAW,KAAK,EAAE,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,EACnD,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE;gBACF,KAAK,EAAE,+BAA+B,GAAG,CAAC,IAAI,EAAE;gBAChD,WAAW,EAAE,KAAK,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,MAAM,0FAA0F;gBACvI,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,cAAc;gBACxB,YAAY,EAAE,KAAK;gBACnB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,6DAA6D;IAC7D,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAkB,SAAS,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,6BAA6B;YACjC,KAAK,EAAE,6BAA6B;YACpC,WAAW,EACT,mKAAmK;YACrK,QAAQ;YACR,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analyzers/pythonLinterCheck.d.ts

@@ -0,0 +1,2 @@
+import type { FileEntry, Issue } from '../types.js';
+export declare function check(rootPath: string, files: FileEntry[]): Promise<Issue[]>;

package/dist/analyzers/pythonLinterCheck.js

@@ -0,0 +1,119 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+const LINTER_CONFIG_FILES = [
+    'ruff.toml',
+    '.ruff.toml',
+    '.flake8',
+    '.pylintrc',
+    'pylintrc',
+];
+const FORMATTER_CONFIG_FILES = [
+    '.autopep8',
+    '.yapfrc',
+    'yapf.ini',
+];
+async function tryRead(absolutePath) {
+    try {
+        return await fs.readFile(absolutePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+export async function check(rootPath, files) {
+    const hasPython = files.some((f) => f.extension === '.py' || f.extension === '.pyw');
+    if (!hasPython)
+        return [];
+    const rootBasenames = new Set(files
+        .filter((f) => !f.directory || f.directory === '.')
+        .map((f) => path.basename(f.relativePath)));
+    const pyproject = await tryRead(path.join(rootPath, 'pyproject.toml'));
+    const setupCfg = await tryRead(path.join(rootPath, 'setup.cfg'));
+    const reqRels = files
+        .filter((f) => (!f.directory || f.directory === '.') &&
+        /^requirements(-.*)?\.txt$/i.test(path.basename(f.relativePath)))
+        .map((f) => f.relativePath);
+    let requirementsBlob = '';
+    for (const rel of reqRels) {
+        const content = await tryRead(path.join(rootPath, rel));
+        if (content)
+            requirementsBlob += content + '\n';
+    }
+    const manifestHaystack = [pyproject ?? '', setupCfg ?? '', requirementsBlob].join('\n');
+    // ── Linter detection ──
+    let hasLinter = false;
+    for (const f of LINTER_CONFIG_FILES) {
+        if (rootBasenames.has(f)) {
+            hasLinter = true;
+            break;
+        }
+    }
+    if (!hasLinter && pyproject) {
+        if (/\[tool\.ruff\]|\[tool\.flake8\]|\[tool\.pylint\]|\[tool\.pylint\./.test(pyproject)) {
+            hasLinter = true;
+        }
+    }
+    if (!hasLinter && setupCfg) {
+        if (/\[flake8\]|\[pylint\]/.test(setupCfg))
+            hasLinter = true;
+    }
+    if (!hasLinter) {
+        for (const name of ['ruff', 'flake8', 'pylint', 'pyflakes']) {
+            const re = new RegExp(`(^|[\\s"'\`\\[\\],={}><~^!;])${name}(\\b|[^a-zA-Z0-9_.-])`, 'im');
+            if (re.test(manifestHaystack)) {
+                hasLinter = true;
+                break;
+            }
+        }
+    }
+    // ── Formatter detection ──
+    // ruff also formats (ruff format), so if linter is ruff that satisfies formatter.
+    let hasFormatter = false;
+    for (const f of FORMATTER_CONFIG_FILES) {
+        if (rootBasenames.has(f)) {
+            hasFormatter = true;
+            break;
+        }
+    }
+    if (!hasFormatter && pyproject) {
+        if (/\[tool\.black\]|\[tool\.autopep8\]|\[tool\.yapf\]|\[tool\.ruff\.format\]|\[tool\.ruff\]/.test(pyproject)) {
+            hasFormatter = true;
+        }
+    }
+    if (!hasFormatter && setupCfg) {
+        if (/\[yapf\]/.test(setupCfg))
+            hasFormatter = true;
+    }
+    if (!hasFormatter) {
+        for (const name of ['black', 'ruff', 'autopep8', 'yapf']) {
+            const re = new RegExp(`(^|[\\s"'\`\\[\\],={}><~^!;])${name}(\\b|[^a-zA-Z0-9_.-])`, 'im');
+            if (re.test(manifestHaystack)) {
+                hasFormatter = true;
+                break;
+            }
+        }
+    }
+    const issues = [];
+    if (!hasLinter) {
+        issues.push({
+            id: 'missing-python-linter',
+            title: 'No Python linter configured',
+            description: 'No ruff / flake8 / pylint configuration or dependency found. A linter catches bugs and enforces style.',
+            severity: 'warning',
+            category: 'linting',
+            fixAvailable: false,
+        });
+    }
+    if (!hasFormatter) {
+        issues.push({
+            id: 'missing-python-formatter',
+            title: 'No Python formatter configured',
+            description: 'No black / ruff-format / autopep8 / yapf configuration or dependency found. A formatter ensures consistent code style.',
+            severity: 'warning',
+            category: 'formatting',
+            fixAvailable: false,
+        });
+    }
+    return issues;
+}
+//# sourceMappingURL=pythonLinterCheck.js.map

package/dist/analyzers/pythonLinterCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pythonLinterCheck.js","sourceRoot":"","sources":["../../src/analyzers/pythonLinterCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,mBAAmB,GAAG;IAC1B,WAAW;IACX,YAAY;IACZ,SAAS;IACT,WAAW;IACX,UAAU;CACX,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC;AAEF,KAAK,UAAU,OAAO,CAAC,YAAoB;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAE1B,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;SAClD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAC7C,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;QACrC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CACnE;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC9B,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO;YAAE,gBAAgB,IAAI,OAAO,GAAG,IAAI,CAAC;IAClD,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAExF,yBAAyB;IACzB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACpC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,mEAAmE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxF,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,gCAAgC,IAAI,uBAAuB,EAC3D,IAAI,CACL,CAAC;YACF,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,kFAAkF;IAClF,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,yFAAyF,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9G,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,gCAAgC,IAAI,uBAAuB,EAC3D,IAAI,CACL,CAAC;YACF,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC9B,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,6BAA6B;YACpC,WAAW,EACT,wGAAwG;YAC1G,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;YACnB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,0BAA0B;YAC9B,KAAK,EAAE,gCAAgC;YACvC,WAAW,EACT,wHAAwH;YAC1H,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analyzers/pythonTestCheck.d.ts

@@ -0,0 +1,2 @@
+import type { FileEntry, Issue } from '../types.js';
+export declare function check(rootPath: string, files: FileEntry[]): Promise<Issue[]>;