projscan 1.5.0 → 1.6.1

package/README.md

@@ -20,7 +20,7 @@
 
 AI coding agents are becoming the primary interface to code. Today, when you ask your agent *"which files implement auth?"* or *"what breaks if I bump React from 18 to 19?"* - it either guesses from names, or it shells out to grep and reads raw output not built for it.
 
-**projscan is the first code-intelligence tool built for agents, not for humans.** Your agent gets a fast, AST-accurate, context-budget-aware view of your codebase through 22 structured MCP tools. It can query the import graph, find symbol definitions, preview upgrades, rank hotspots, diff structural changes between refs, surface coupling/cycle hotspots, get a one-call PR review, request structured fix-action prompts for any open issue, ask "what breaks if I change this?" via transitive blast-radius analysis, share a durable session across multiple agent invocations, and learn from how you use it — quieting accumulated noise on this specific repo over time without ever phoning home.
+**projscan is the first code-intelligence tool built for agents, not for humans.** Your agent gets a fast, AST-accurate, context-budget-aware view of your codebase through 25 structured MCP tools. It can query the import graph, find symbol definitions, preview upgrades, rank hotspots, diff structural changes between refs, surface coupling/cycle hotspots, get a one-call PR review (now with new-taint-flow detection that *blocks* unsafe merges), request structured fix-action prompts for any open issue and **mechanically apply** the safe ones with rollback, ask "what breaks if I change this?" via transitive blast-radius analysis (across registered sibling repos too), surface source-to-sink taint flows, share a durable session across multiple agent invocations, and learn from how you use it — quieting accumulated noise on this specific repo over time without ever phoning home.
 
 Humans get the same thing through the CLI.
 
@@ -99,8 +99,13 @@ For a comprehensive walkthrough, see the **[Full Guide](docs/GUIDE.md)**.
 | `projscan outdated` | Declared-vs-installed drift check (offline) |
 | `projscan audit` | `npm audit`-powered vulnerability report - SARIF-ready for Code Scanning |
 | `projscan upgrade <pkg>` | Preview upgrade impact - local CHANGELOG + importer list, offline |
-| `projscan coverage` | **Coverage × hotspots - rank the scariest untested files** |
+| `projscan coverage` | **Coverage × hotspots - rank the scariest untested files** (`--changed-only` for diff mode) |
 | `projscan badge` | Generate a health score badge for your README |
+| `projscan init` | *(1.6)* Scaffold `.projscanrc.json` with sensible defaults |
+| `projscan install-hook` | *(1.6)* Install a `pre-commit` hook running `projscan ci --changed-only` |
+| `projscan workspace` | *(1.6)* Register sibling repos for cross-repo intelligence (`add` / `list` / `remove`) |
+| `projscan apply-fix <id>` | *(1.6)* Mechanically execute the safe fix templates with rollback (default dry-run) |
+| `projscan taint` | *(1.6)* Source-to-sink reachability over the call graph |
 | `projscan mcp` | Run as an MCP server for AI coding agents (Claude Code, Cursor, …) |
 
 To see all commands and options, run:
@@ -622,7 +627,7 @@ Capability is advertised under `experimental.fileChanged` on `initialize` so cli
 - *"What breaks if I bump chalk to 6?"* → `projscan_upgrade { package: "chalk" }`
 - *"Where should I refactor first?"* → `projscan_hotspots`
 
-### The 22 MCP tools
+### The 25 MCP tools
 
 **Structural (0.6.0 / 0.11 / 0.13 / 0.14 / 0.15 - agent-native):**
 - **`projscan_graph`** - query the AST-based code graph. Directions: `imports`, `exports`, `importers`, `symbol_defs`, `package_importers`. Millisecond responses on a warm cache.
@@ -658,6 +663,11 @@ Capability is advertised under `experimental.fileChanged` on `initialize` so cli
 **Memory (1.5):**
 - **`projscan_memory`** *(1.5)* - durable, local-only feedback loop. Records, per analyzer rule id, how many runs surfaced it and how many fixed it. Subactions: `current` (aggregate counts), `stable` (rules surfaced across ≥ 3 runs over ≥ 7 days without ever being fixed — paired with a ready-to-paste `.projscanrc.json disableRules` snippet), `runs` (every tracked rule with full history), `forget` (drop a single rule). Stored at `.projscan-memory/memory.json`; never leaves the machine. Lets an agent ask "what is this project tolerating?" and propose quieting it.
 
+**Operator (1.6):**
+- **`projscan_workspace_graph`** *(1.6)* - cross-repo intelligence over sibling repos registered with `projscan workspace add`. Subactions: `list` (registered repos + parsed-file + export counts), `graph` (every symbol exported by ≥ 2 repos — the candidate refactor / API contract surface), `file_importers` (given a file in one repo, every other repo whose graph imports it). Read-only.
+- **`projscan_apply_fix`** *(1.6)* - mechanically execute the safe fix templates. Default is dry-run; pass `confirm: true` to write. Atomic writes, per-apply rollback record at `.projscan-cache/rollbacks/<id>.json`. Reverse with `action: "rollback", rollback_id: ...`. Six templates supported at this release: `unused-dependency-*`, `missing-test-framework`, `missing-eslint`, `missing-prettier`, `missing-editorconfig`, `missing-readme`.
+- **`projscan_taint`** *(1.6)* - source-to-sink reachability over the per-function call graph. Built-in defaults cover common JS / Python sources (`process.env`, `req.body`, etc.) and sinks (`exec`, `eval`, `db.query`, etc.). Project-specific names go in `.projscanrc.json` `taint`. `projscan_review` automatically diffs taint flows between base and head and **blocks any PR that introduces a new flow**.
+
 ### Context-window budgeting
 
 **Every MCP tool accepts an optional `max_tokens` argument.** Set it and projscan serializes the result, and - if over budget - truncates the largest array field record-by-record until it fits. Responses include a `_budget` sidecar when truncated so your agent knows it got a partial view.

package/dist/cli/commands/applyFix.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `projscan apply-fix <issue_id>` (1.6+) — execute the mechanical fix
+ * for an issue. Default is dry-run; pass --confirm to write to disk.
+ *
+ * `projscan apply-fix --rollback <id>` — reverse a prior apply.
+ */
+export declare function registerApplyFix(): void;

package/dist/cli/commands/applyFix.js

@@ -0,0 +1,113 @@
+import chalk from 'chalk';
+import { program, getRootPath, getFormat, setupLogLevel, maybeCompactBanner } from '../_shared.js';
+import { scanRepository } from '../../core/repositoryScanner.js';
+import { collectIssues } from '../../core/issueEngine.js';
+import { findIssue, buildApplyPlanForIssue } from '../../core/fixSuggest.js';
+import { executePlan, rollback } from '../../core/applyFix.js';
+/**
+ * `projscan apply-fix <issue_id>` (1.6+) — execute the mechanical fix
+ * for an issue. Default is dry-run; pass --confirm to write to disk.
+ *
+ * `projscan apply-fix --rollback <id>` — reverse a prior apply.
+ */
+export function registerApplyFix() {
+    program
+        .command('apply-fix [issueId]')
+        .description('Apply a mechanical fix for an open issue (dry-run by default; --confirm to write)')
+        .option('--confirm', 'actually write to disk (default is dry-run)')
+        .option('--rollback <id>', 'reverse a previous apply by rollback id')
+        .action(async (issueId, opts) => {
+        setupLogLevel();
+        maybeCompactBanner();
+        const rootPath = getRootPath();
+        const format = getFormat();
+        try {
+            if (opts.rollback) {
+                const result = await rollback(rootPath, opts.rollback);
+                renderResult(result, format, true);
+                if (!result.ok)
+                    process.exit(1);
+                return;
+            }
+            if (!issueId) {
+                console.error(chalk.red('apply-fix needs an issue id (e.g. `projscan apply-fix unused-dependency-foo`).'));
+                console.error(chalk.dim('  Get one from `projscan doctor` or `projscan analyze`.'));
+                process.exit(1);
+                return;
+            }
+            const scan = await scanRepository(rootPath);
+            const issues = await collectIssues(rootPath, scan.files);
+            const issue = findIssue(issues, issueId);
+            if (!issue) {
+                console.error(chalk.red(`No open issue with id "${issueId}".`));
+                console.error(chalk.dim('  The issue may have been resolved or the id may be stale.'));
+                process.exit(1);
+                return;
+            }
+            const plan = await buildApplyPlanForIssue(issue, rootPath);
+            if (!plan) {
+                console.error(chalk.yellow(`Issue "${issueId}" does not have apply support yet — only mechanical templates can be auto-applied.`));
+                console.error(chalk.dim(`  Try \`projscan fix-suggest ${issueId}\` for the structured guidance.`));
+                process.exit(1);
+                return;
+            }
+            const dryRun = opts.confirm !== true;
+            const result = await executePlan(rootPath, plan, { dryRun });
+            if (format === 'json') {
+                console.log(JSON.stringify({ ...result, summary: plan.summary }, null, 2));
+            }
+            else {
+                renderApplyResult(result, plan.summary, dryRun);
+            }
+            if (!result.ok)
+                process.exit(1);
+        }
+        catch (error) {
+            console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+            process.exit(1);
+        }
+    });
+}
+function renderApplyResult(result, summary, dryRun) {
+    console.log('');
+    console.log(chalk.bold(dryRun ? 'Apply (dry-run)' : 'Apply'));
+    console.log(chalk.dim('────────────────────────────────────────'));
+    console.log(`  ${chalk.bold('Plan:')} ${summary}`);
+    console.log('');
+    if (!result.ok) {
+        console.log(`  ${chalk.red('✗')} ${result.reason ?? 'apply failed'}`);
+        return;
+    }
+    for (const c of result.changes) {
+        const opTag = c.op === 'create' ? chalk.green('+') : c.op === 'delete' ? chalk.red('-') : chalk.yellow('~');
+        console.log(`  ${opTag} ${c.op.padEnd(7)} ${c.path}`);
+    }
+    console.log('');
+    if (dryRun) {
+        console.log(chalk.dim('  Dry-run only. Re-run with --confirm to write.'));
+    }
+    else {
+        console.log(chalk.green(`  ✓ Applied. Rollback id: ${result.rollbackId}`));
+        console.log(chalk.dim('  Reverse with `projscan apply-fix --rollback ' + result.rollbackId + '`.'));
+    }
+}
+function renderResult(result, format, isRollback) {
+    if (format === 'json') {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log('');
+    console.log(chalk.bold(isRollback ? 'Rollback' : 'Apply'));
+    console.log(chalk.dim('────────────────────────────────────────'));
+    if (!result.ok) {
+        console.log(`  ${chalk.red('✗')} ${result.reason ?? 'failed'}`);
+        return;
+    }
+    for (const c of result.changes) {
+        const opTag = c.op === 'create' ? chalk.green('+') : c.op === 'delete' ? chalk.red('-') : chalk.yellow('~');
+        console.log(`  ${opTag} ${c.op.padEnd(7)} ${c.path}`);
+    }
+    console.log('');
+    console.log(chalk.green(`  ✓ ${isRollback ? 'Rolled back.' : 'Applied.'}`));
+}
+//# sourceMappingURL=applyFix.js.map

package/dist/cli/commands/applyFix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyFix.js","sourceRoot":"","sources":["../../../src/cli/commands/applyFix.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAoB,MAAM,wBAAwB,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO;SACJ,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,WAAW,EAAE,6CAA6C,CAAC;SAClE,MAAM,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,IAA8C,EAAE,EAAE;QAC5F,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvD,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,gFAAgF,CACjF,CACF,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC,CAAC;gBACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,OAAO,IAAI,CAAC,CAAC,CAAC;gBAChE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC,CAAC;gBACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CACV,UAAU,OAAO,oFAAoF,CACtG,CACF,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,gCAAgC,OAAO,iCAAiC,CAAC,CACpF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAmB,EAAE,OAAe,EAAE,MAAe;IAC9E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GACT,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gDAAgD,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB,EAAE,MAAc,EAAE,UAAmB;IAC5E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GACT,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cli/commands/coverage.js

@@ -7,6 +7,7 @@ import { analyzeHotspots } from '../../core/hotspotAnalyzer.js';
 import { parseCoverage, coverageMap } from '../../core/coverageParser.js';
 import { joinCoverageWithHotspots } from '../../core/coverageJoin.js';
 import { detectWorkspaces, filterFilesByPackage } from '../../core/monorepo.js';
+import { getChangedFiles } from '../../utils/changedFiles.js';
 import { reportCoverage } from '../../reporters/consoleReporter.js';
 import { reportCoverageJson } from '../../reporters/jsonReporter.js';
 import { reportCoverageMarkdown } from '../../reporters/markdownReporter.js';
@@ -17,6 +18,8 @@ export function registerCoverage() {
         .description('Join test coverage with hotspots - surface the scariest untested files')
         .option('--limit <n>', 'limit number of entries shown', '30')
         .option('--package <name>', 'monorepo: scope to a single workspace package')
+        .option('--changed-only', '1.6+: scope to files changed vs base ref (auto-detected; override with --base-ref)')
+        .option('--base-ref <ref>', 'git base ref for --changed-only')
         .action(async (cmdOpts) => {
         setupLogLevel();
         maybeCompactBanner();
@@ -40,6 +43,16 @@ export function registerCoverage() {
                 const allowed = new Set(filterFilesByPackage(ws, cmdOpts.package, joined.entries.map((e) => e.relativePath)));
                 joined.entries = joined.entries.filter((e) => allowed.has(e.relativePath));
             }
+            if (cmdOpts.changedOnly && joined.available) {
+                const changed = await getChangedFiles(rootPath, cmdOpts.baseRef);
+                if (changed.available) {
+                    const allowed = new Set(changed.files);
+                    joined.entries = joined.entries.filter((e) => allowed.has(e.relativePath));
+                }
+                else if (spinner) {
+                    spinner.warn(`--changed-only ignored: ${changed.reason}`);
+                }
+            }
             if (spinner)
                 spinner.stop();
             switch (format) {

package/dist/cli/commands/coverage.js.map

@@ -1 +1 @@
-{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../../src/cli/commands/coverage.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,UAAU,gBAAgB;IAC9B,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,aAAa,EAAE,+BAA+B,EAAE,IAAI,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,+CAA+C,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE;gBACnE,KAAK;gBACL,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC5D,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC9G,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAC7E,CAAC;YAED,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAE5B,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,MAAM;oBACT,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC3B,MAAM;gBACR,KAAK,UAAU;oBACb,sBAAsB,CAAC,MAAM,CAAC,CAAC;oBAC/B,MAAM;gBACR,KAAK,MAAM;oBACT,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC3B,MAAM;gBACR;oBACE,cAAc,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../../src/cli/commands/coverage.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,UAAU,gBAAgB;IAC9B,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,aAAa,EAAE,+BAA+B,EAAE,IAAI,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,+CAA+C,CAAC;SAC3E,MAAM,CACL,gBAAgB,EAChB,oFAAoF,CACrF;SACA,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE;gBACnE,KAAK;gBACL,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC5D,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC9G,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACjE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oBACtB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBACvC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,IAAI,OAAO,EAAE,CAAC;oBACnB,OAAO,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;YAED,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAE5B,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,MAAM;oBACT,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC3B,MAAM;gBACR,KAAK,UAAU;oBACb,sBAAsB,CAAC,MAAM,CAAC,CAAC;oBAC/B,MAAM;gBACR,KAAK,MAAM;oBACT,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC3B,MAAM;gBACR;oBACE,cAAc,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/impact.js

@@ -5,6 +5,7 @@ import { scanRepository } from '../../core/repositoryScanner.js';
 import { buildCodeGraph } from '../../core/codeGraph.js';
 import { loadCachedGraph, saveCachedGraph } from '../../core/indexCache.js';
 import { computeImpact } from '../../core/impact.js';
+import { loadWorkspace } from '../../core/workspace.js';
 import { reportImpact } from '../../reporters/consoleReporter.js';
 import { reportImpactJson } from '../../reporters/jsonReporter.js';
 import { reportImpactMarkdown } from '../../reporters/markdownReporter.js';
@@ -15,6 +16,7 @@ export function registerImpact() {
         .description('Transitive blast radius for a file (repo path) or symbol (--symbol). Cycle-safe; depth-bounded.')
         .option('--symbol', 'treat <target> as a symbol (export) name instead of a file path')
         .option('--max-distance <n>', 'BFS depth limit (default 10)', (v) => parseInt(v, 10))
+        .option('--cross-repo', '1.6+: also include callers in sibling repos registered via `projscan workspace add` (symbol mode only)')
         .action(async (target, cmdOpts) => {
         setupLogLevel();
         maybeCompactBanner();
@@ -29,7 +31,13 @@ export function registerImpact() {
             const t = cmdOpts.symbol
                 ? { kind: 'symbol', value: target }
                 : { kind: 'file', value: target };
-            const report = computeImpact(graph, t, cmdOpts.maxDistance ? { maxDistance: cmdOpts.maxDistance } : {});
+            const crossRepoGraphs = cmdOpts.crossRepo
+                ? await buildCrossRepoGraphs(rootPath)
+                : undefined;
+            const report = computeImpact(graph, t, {
+                ...(cmdOpts.maxDistance ? { maxDistance: cmdOpts.maxDistance } : {}),
+                ...(crossRepoGraphs ? { crossRepoGraphs } : {}),
+            });
             if (spinner)
                 spinner.stop();
             switch (format) {
@@ -56,4 +64,20 @@ export function registerImpact() {
         }
     });
 }
+async function buildCrossRepoGraphs(rootPath) {
+    const out = new Map();
+    const workspace = await loadWorkspace(rootPath);
+    if (!workspace || workspace.repos.length === 0)
+        return out;
+    for (const repo of workspace.repos) {
+        try {
+            const scan = await scanRepository(repo.path);
+            out.set(repo.name, await buildCodeGraph(repo.path, scan.files));
+        }
+        catch {
+            // skip
+        }
+    }
+    return out;
+}
 //# sourceMappingURL=impact.js.map

package/dist/cli/commands/impact.js.map

@@ -1 +1 @@
-{"version":3,"file":"impact.js","sourceRoot":"","sources":["../../../src/cli/commands/impact.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,MAAM,UAAU,cAAc;IAC5B,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,iGAAiG,CAAC;SAC9G,MAAM,CAAC,UAAU,EAAE,iEAAiE,CAAC;SACrF,MAAM,CAAC,oBAAoB,EAAE,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACpF,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,OAAmD,EAAE,EAAE;QACpF,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAEvC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM;gBACtB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;gBAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAExG,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAE5B,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,MAAM;oBACT,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACzB,MAAM;gBACR,KAAK,UAAU;oBACb,oBAAoB,CAAC,MAAM,CAAC,CAAC;oBAC7B,MAAM;gBACR,KAAK,MAAM;oBACT,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACzB,MAAM;gBACR;oBACE,YAAY,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"impact.js","sourceRoot":"","sources":["../../../src/cli/commands/impact.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAkB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,MAAM,UAAU,cAAc;IAC5B,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,iGAAiG,CAAC;SAC9G,MAAM,CAAC,UAAU,EAAE,iEAAiE,CAAC;SACrF,MAAM,CAAC,oBAAoB,EAAE,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACpF,MAAM,CACL,cAAc,EACd,wGAAwG,CACzG;SACA,MAAM,CACL,KAAK,EACH,MAAc,EACd,OAAwE,EACxE,EAAE;QACJ,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAEvC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM;gBACtB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;gBAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7C,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS;gBACvC,CAAC,CAAC,MAAM,oBAAoB,CAAC,QAAQ,CAAC;gBACtC,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE;gBACrC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;YAEH,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAE5B,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,MAAM;oBACT,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACzB,MAAM;gBACR,KAAK,UAAU;oBACb,oBAAoB,CAAC,MAAM,CAAC,CAAC;oBAC7B,MAAM;gBACR,KAAK,MAAM;oBACT,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACzB,MAAM;gBACR;oBACE,YAAY,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli/commands/init.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `projscan init` (1.6+) — scaffold `.projscanrc.json` for new
+ * adopters. Idempotent: if the config already exists, prints a diff
+ * against the suggested defaults instead of overwriting.
+ */
+export declare function registerInit(): void;

package/dist/cli/commands/init.js

@@ -0,0 +1,70 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import chalk from 'chalk';
+import { program, getRootPath, setupLogLevel, maybeCompactBanner } from '../_shared.js';
+/**
+ * `projscan init` (1.6+) — scaffold `.projscanrc.json` for new
+ * adopters. Idempotent: if the config already exists, prints a diff
+ * against the suggested defaults instead of overwriting.
+ */
+export function registerInit() {
+    program
+        .command('init')
+        .description('Scaffold .projscanrc.json with sensible defaults (1.6+)')
+        .option('--force', 'overwrite an existing .projscanrc.json (default: refuse)')
+        .action(async (opts) => {
+        setupLogLevel();
+        maybeCompactBanner();
+        const rootPath = getRootPath();
+        try {
+            await runInit(rootPath, opts.force === true);
+        }
+        catch (error) {
+            console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+            process.exit(1);
+        }
+    });
+}
+const DEFAULT_CONFIG = {
+    minScore: 70,
+    hotspots: { limit: 10 },
+    ignore: [],
+    disableRules: [],
+};
+async function runInit(rootPath, force) {
+    const target = path.join(rootPath, '.projscanrc.json');
+    let exists = false;
+    try {
+        await fs.access(target);
+        exists = true;
+    }
+    catch {
+        // not present
+    }
+    if (exists && !force) {
+        console.log('');
+        console.log(chalk.yellow('⚠ .projscanrc.json already exists. Refusing to overwrite.'));
+        console.log(chalk.dim('  Pass --force to overwrite, or merge manually with the defaults below:'));
+        console.log('');
+        console.log(prefixIndent(JSON.stringify(DEFAULT_CONFIG, null, 2), '  '));
+        console.log('');
+        console.log(chalk.dim('  See https://github.com/abhiyoheswaran1/projscan#projscanrc for the field reference.'));
+        return;
+    }
+    const content = JSON.stringify(DEFAULT_CONFIG, null, 2) + '\n';
+    await fs.writeFile(target, content, 'utf-8');
+    console.log('');
+    console.log(chalk.green('✓ Created .projscanrc.json'));
+    console.log('');
+    console.log(prefixIndent(content.trimEnd(), '  '));
+    console.log('');
+    console.log(chalk.dim('  Tune the score threshold, ignore globs, or disabled rules as needed.'));
+    console.log(chalk.dim('  Then run `projscan ci --min-score 70` (or whatever you set).'));
+}
+function prefixIndent(text, indent) {
+    return text
+        .split('\n')
+        .map((l) => indent + l)
+        .join('\n');
+}
+//# sourceMappingURL=init.js.map

package/dist/cli/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,SAAS,EAAE,0DAA0D,CAAC;SAC7E,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IACvB,MAAM,EAAE,EAAE;IACV,YAAY,EAAE,EAAE;CACjB,CAAC;AAEF,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,KAAc;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACvD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC,CAAC;QAClG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,uFAAuF,CAAC,CACnG,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACtB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/cli/commands/installHook.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `projscan install-hook` (1.6+) — write `.git/hooks/pre-commit`
+ * that runs `projscan ci --changed-only --min-score <threshold>`.
+ *
+ * Skipped if the cwd is not a git repository. Refuses to overwrite
+ * an existing hook unless --force is passed; prints the new content
+ * for manual merging if there's a conflict.
+ */
+export declare function registerInstallHook(): void;

package/dist/cli/commands/installHook.js

@@ -0,0 +1,90 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import chalk from 'chalk';
+import { program, getRootPath, setupLogLevel, maybeCompactBanner } from '../_shared.js';
+/**
+ * `projscan install-hook` (1.6+) — write `.git/hooks/pre-commit`
+ * that runs `projscan ci --changed-only --min-score <threshold>`.
+ *
+ * Skipped if the cwd is not a git repository. Refuses to overwrite
+ * an existing hook unless --force is passed; prints the new content
+ * for manual merging if there's a conflict.
+ */
+export function registerInstallHook() {
+    program
+        .command('install-hook')
+        .description('Install a pre-commit git hook running projscan ci --changed-only (1.6+)')
+        .option('--threshold <n>', 'min-score threshold for the hook (default 70)', (v) => parseInt(v, 10))
+        .option('--force', "overwrite an existing pre-commit hook (default: refuse)")
+        .action(async (opts) => {
+        setupLogLevel();
+        maybeCompactBanner();
+        const rootPath = getRootPath();
+        try {
+            await runInstallHook(rootPath, opts.threshold ?? 70, opts.force === true);
+        }
+        catch (error) {
+            console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+            process.exit(1);
+        }
+    });
+}
+async function runInstallHook(rootPath, threshold, force) {
+    const gitDir = path.join(rootPath, '.git');
+    try {
+        const stat = await fs.stat(gitDir);
+        if (!stat.isDirectory())
+            throw new Error('not a git repo');
+    }
+    catch {
+        console.error(chalk.red('✗ Not a git repository (no .git/ directory at the project root).'));
+        process.exit(1);
+        return;
+    }
+    const hooksDir = path.join(gitDir, 'hooks');
+    await fs.mkdir(hooksDir, { recursive: true });
+    const hookPath = path.join(hooksDir, 'pre-commit');
+    const content = buildHookScript(threshold);
+    let exists = false;
+    try {
+        await fs.access(hookPath);
+        exists = true;
+    }
+    catch {
+        // not present
+    }
+    if (exists && !force) {
+        console.log('');
+        console.log(chalk.yellow('⚠ .git/hooks/pre-commit already exists. Refusing to overwrite.'));
+        console.log(chalk.dim('  Pass --force to overwrite, or merge manually with the script below:'));
+        console.log('');
+        console.log(prefixIndent(content, '  '));
+        return;
+    }
+    await fs.writeFile(hookPath, content, 'utf-8');
+    await fs.chmod(hookPath, 0o755);
+    console.log('');
+    console.log(chalk.green('✓ Installed .git/hooks/pre-commit'));
+    console.log(chalk.dim(`  Threshold: ${threshold}/100. Runs \`projscan ci --changed-only\` on every commit.`));
+    console.log(chalk.dim('  Skip the hook for one commit with `git commit --no-verify` (use sparingly).'));
+}
+function buildHookScript(threshold) {
+    return [
+        '#!/bin/sh',
+        '# Installed by `projscan install-hook` (1.6+).',
+        '# Runs projscan ci --changed-only on staged files. Fails the commit',
+        '# when the project health score drops below the threshold.',
+        `# Threshold: ${threshold}/100.`,
+        '',
+        'set -e',
+        `npx projscan ci --changed-only --min-score ${threshold}`,
+        '',
+    ].join('\n');
+}
+function prefixIndent(text, indent) {
+    return text
+        .split('\n')
+        .map((l) => indent + l)
+        .join('\n');
+}
+//# sourceMappingURL=installHook.js.map

package/dist/cli/commands/installHook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installHook.js","sourceRoot":"","sources":["../../../src/cli/commands/installHook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExF;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAClG,MAAM,CAAC,SAAS,EAAE,yDAAyD,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,IAA6C,EAAE,EAAE;QAC9D,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB,EAAE,KAAc;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,SAAS,4DAA4D,CAAC,CAAC,CAAC;IAC9G,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO;QACL,WAAW;QACX,gDAAgD;QAChD,qEAAqE;QACrE,4DAA4D;QAC5D,gBAAgB,SAAS,OAAO;QAChC,EAAE;QACF,QAAQ;QACR,8CAA8C,SAAS,EAAE;QACzD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACtB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/cli/commands/taint.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `projscan taint` (1.6+) — surface source-to-sink reachability flows.
+ * Mirrors `projscan_taint` MCP tool. Default output is human-readable;
+ * `--format json` returns the raw TaintReport.
+ */
+export declare function registerTaint(): void;

package/dist/cli/commands/taint.js

@@ -0,0 +1,74 @@
+import chalk from 'chalk';
+import { program, getFormat, getRootPath, loadProjectConfig, setupLogLevel, maybeCompactBanner, } from '../_shared.js';
+import { scanRepository } from '../../core/repositoryScanner.js';
+import { buildCodeGraph } from '../../core/codeGraph.js';
+import { computeTaint } from '../../core/taint.js';
+/**
+ * `projscan taint` (1.6+) — surface source-to-sink reachability flows.
+ * Mirrors `projscan_taint` MCP tool. Default output is human-readable;
+ * `--format json` returns the raw TaintReport.
+ */
+export function registerTaint() {
+    program
+        .command('taint')
+        .description('Source-to-sink reachability over the call graph (1.6+)')
+        .option('--source <name...>', 'add a custom source name (repeatable)')
+        .option('--sink <name...>', 'add a custom sink name (repeatable)')
+        .option('--limit <n>', 'cap flows shown', '50')
+        .action(async (opts) => {
+        setupLogLevel();
+        maybeCompactBanner();
+        const rootPath = getRootPath();
+        const format = getFormat();
+        try {
+            const config = await loadProjectConfig();
+            const scan = await scanRepository(rootPath, { ignore: config.ignore });
+            const graph = await buildCodeGraph(rootPath, scan.files);
+            const sources = [...(config.taint?.sources ?? []), ...(opts.source ?? [])];
+            const sinks = [...(config.taint?.sinks ?? []), ...(opts.sink ?? [])];
+            const limit = Math.max(1, Math.min(500, parseInt(opts.limit ?? '50', 10) || 50));
+            const report = computeTaint(graph, { sources, sinks });
+            if (format === 'json') {
+                console.log(JSON.stringify({
+                    ...report,
+                    flows: report.flows.slice(0, limit),
+                    truncated: report.flows.length > limit,
+                }, null, 2));
+                return;
+            }
+            renderTaint(report, limit);
+        }
+        catch (error) {
+            console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+            process.exit(1);
+        }
+    });
+}
+function renderTaint(report, limit) {
+    console.log('');
+    console.log(chalk.bold('Taint flows'));
+    console.log(chalk.dim('────────────────────────────────────────'));
+    if (!report.available) {
+        console.log(`  ${chalk.yellow('!')} ${report.reason ?? 'unavailable'}`);
+        return;
+    }
+    if (report.flowCount === 0) {
+        console.log('  No source-to-sink flows detected.');
+        console.log(chalk.dim(`  Effective sources: ${report.effectiveSources.length}; sinks: ${report.effectiveSinks.length}.`));
+        return;
+    }
+    console.log(`  ${chalk.bold(report.flowCount)} flow(s) detected:`);
+    console.log('');
+    const shown = report.flows.slice(0, limit);
+    for (const flow of shown) {
+        const arrow = flow.path.length === 1 ? '(direct)' : flow.path.join(' → ');
+        console.log(`  ${chalk.red('●')} ${chalk.bold(flow.source)} → ${chalk.bold(flow.sink)}`);
+        console.log(`    ${chalk.dim('path:')} ${arrow}`);
+        console.log(`    ${chalk.dim('files:')} ${flow.files.join(', ')}`);
+        console.log('');
+    }
+    if (report.flowCount > limit) {
+        console.log(chalk.dim(`  …and ${report.flowCount - limit} more (raise --limit to see them).`));
+    }
+}
+//# sourceMappingURL=taint.js.map

package/dist/cli/commands/taint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint.js","sourceRoot":"","sources":["../../../src/cli/commands/taint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAoB,MAAM,qBAAqB,CAAC;AAErE;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,oBAAoB,EAAE,uCAAuC,CAAC;SACrE,MAAM,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,CAAC;SAC9C,MAAM,CAAC,KAAK,EAAE,IAA4D,EAAE,EAAE;QAC7E,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3E,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAEvD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;oBACE,GAAG,MAAM;oBACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;oBACnC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK;iBACvC,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB,EAAE,KAAa;IACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,wBAAwB,MAAM,CAAC,gBAAgB,CAAC,MAAM,YAAY,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAClG,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,KAAK,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,SAAS,GAAG,KAAK,oCAAoC,CAAC,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/cli/commands/workspace.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `projscan workspace` (1.6+) — register and inspect cross-repo
+ * sibling repos. Distinct from `projscan workspaces` (plural) which
+ * lists intra-repo monorepo packages (npm/yarn/pnpm/Lerna/Nx).
+ *
+ *   projscan workspace                  — list registered repos (default)
+ *   projscan workspace add <path> [--name <n>]
+ *   projscan workspace remove <path|name>
+ *   projscan workspace list
+ */
+export declare function registerWorkspace(): void;