projscan 4.3.0 → 4.4.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "projscan",
   "mcpName": "io.github.abhiyoheswaran1/projscan",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "description": "Agent-first code intelligence. MCP server (2025-03-26) with 11 AST adapters covering 12 named languages: JavaScript, TypeScript, Python, Go, Java, Ruby, Rust, PHP, C#, Kotlin, Swift, and C++; repo understanding maps (projscan_understand), stable v3 semantic graph (projscan_semantic_graph), dataflow risk engine with bridge-helper detection (projscan_dataflow), code graph, file + per-function AST cyclomatic complexity, per-function fan-in + fan-out, coupling + cycle detection, structural PR diff with HTML reporter, coverage report with HTML reporter, intent-grounded one-call PR review (projscan_review with optional `intent` arg, new taint flows, contract changes, and newDataflowRisks) and long-running PR-watch mode with structured per-bucket deltas (projscan_review_watch), first-60-seconds workflow orientation (projscan_start), agent workplans (projscan_workplan), bug-hunt queues (projscan_bug_hunt), product-line planning (projscan_release_train), evidence packs (projscan_evidence_pack), regression planning (projscan_regression_plan), agent briefs (projscan_agent_brief), quality scorecards (projscan_quality_scorecard), and preflight with supply-chain IOC evidence, rule-driven fix suggestions + mechanical apply layer with rollback (projscan_apply_fix, projscan_fix_suggest, projscan_explain_issue), source-to-sink taint analysis (projscan_taint) with truncation reporting, transitive blast-radius analysis with cross-repo mode (projscan_impact for files and symbols), cross-repo workspace registration + intelligence (projscan_workspace_graph), per-function semantic search chunks (sub-file embeddings), per-rule confidence + severity drift + cost-summary analytics with live streaming (projscan_cost_summary), stable local analyzer + reporter plugin API (projscan_plugin, CLI --reporter, opt-in via PROJSCAN_PLUGINS_PREVIEW=1), monorepo workspace awareness with cross-package import policy + per-package dependencies / outdated / audit, BM25 + optional semantic search, cursor pagination, progress notifications, context-budgeted output, and a stable-surface CI guard. CLI on the side.",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,11 +18,16 @@
     "docs/PLUGIN-GALLERY.md",
     "docs/ROADMAP.md",
     "docs/demos/projscan-4-1-demo.html",
+    "docs/demos/projscan-mission-control.tape",
+    "docs/demos/projscan-mission-proof.tape",
     "docs/plugin.schema.json",
     "docs/projscan-mission-control.png",
+    "docs/projscan-mission-control.gif",
     "docs/projscan-proof-router.png",
+    "docs/projscan-mission-proof.gif",
     "docs/examples/plugins",
     "scripts/capture-readme-assets.mjs",
+    "scripts/capture-vhs-demos.mjs",
     "public/brand/baseframe-labs",
     "public/.well-known/security.txt",
     "CONTRIBUTING.md",
@@ -37,13 +42,17 @@
   "scripts": {
     "build": "tsc && node scripts/copy-wasm.mjs && node scripts/generate-tool-manifest.mjs",
     "dev": "tsc --watch",
-    "test": "vitest run --test-timeout 60000 --hook-timeout 60000 --maxWorkers 4",
-    "test:watch": "vitest --test-timeout 60000 --hook-timeout 60000",
+    "typecheck": "tsc --noEmit",
+    "typecheck:public-types": "tsc -p tsconfig.public-types.json",
+    "test": "vitest run --exclude '.worktrees/**' --test-timeout 60000 --hook-timeout 60000 --maxWorkers 4",
+    "test:watch": "vitest --exclude '.worktrees/**' --test-timeout 60000 --hook-timeout 60000",
     "lint": "eslint src/",
     "format": "prettier --write .",
     "bench": "node scripts/bench.mjs",
     "bench:references": "node scripts/bench-references.mjs",
     "docs:screenshots": "node scripts/capture-readme-assets.mjs",
+    "docs:demos": "npm run build && node scripts/capture-vhs-demos.mjs",
+    "docs:assets": "npm run docs:screenshots && npm run docs:demos",
     "smoke:packed-install": "node scripts/packed-install-smoke.mjs",
     "check:stability": "node scripts/check-stability.mjs",
     "release:check": "node scripts/release-check.mjs",
@@ -51,7 +60,7 @@
     "sbom:generate": "node scripts/generate-sbom.mjs",
     "prepare": "npm run build",
     "check:graph-corpus": "node scripts/check-graph-corpus.mjs",
-    "test:trust-smoke": "vitest run tests/cli/privacyCheck.test.ts tests/cli/start.test.ts tests/cli/preflight.test.ts tests/mcp/start.test.ts tests/mcp/preflight.test.ts tests/mcp/fileChangedNotifications.test.ts tests/core/repositoryScanner.gitignore.test.ts tests/core/issueEngine.trustConfig.test.ts tests/utils/changedFiles.test.ts tests/core/auditRunner.offline.test.ts tests/core/upgradePreview.checkRegistry.test.ts tests/core/telemetry.test.ts tests/analyzers/securityCheck.test.ts --test-timeout 60000 --hook-timeout 60000"
+    "test:trust-smoke": "vitest run --exclude '.worktrees/**' tests/cli/privacyCheck.test.ts tests/cli/start.test.ts tests/cli/preflight.test.ts tests/mcp/start.test.ts tests/mcp/preflight.test.ts tests/mcp/fileChangedNotifications.test.ts tests/core/repositoryScanner.gitignore.test.ts tests/core/issueEngine.trustConfig.test.ts tests/utils/changedFiles.test.ts tests/core/auditRunner.offline.test.ts tests/core/upgradePreview.checkRegistry.test.ts tests/core/telemetry.test.ts tests/analyzers/securityCheck.test.ts --test-timeout 60000 --hook-timeout 60000"
   },
   "keywords": [
     "cli",
@@ -111,14 +120,17 @@
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.0.0",
     "@xenova/transformers": "^2.17.0",
+    "agentflight": "^0.4.1",
+    "agentloopkit": "^0.33.0",
     "eslint": "^10.0.3",
+    "prettier": "^3.8.4",
     "tree-sitter-cli": "^0.26.8",
     "tree-sitter-cpp": "^0.23.4",
     "tree-sitter-kotlin": "^0.3.8",
     "tree-sitter-swift": "^0.7.1",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.57.0",
-    "vite": "^6.4.2",
+    "vite": "^8.0.16",
     "vitest": "^4.1.8"
   },
   "overrides": {

package/scripts/capture-vhs-demos.mjs

@@ -0,0 +1,80 @@
+import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const cliPath = path.join(repoRoot, 'dist', 'cli', 'index.js');
+const vhsBinDir = path.join(repoRoot, '.projscan', 'vhs-bin');
+const vhsShimPath = path.join(vhsBinDir, 'projscan');
+const vhsMissionDir = path.join(repoRoot, '.projscan', 'vhs-mission');
+
+const tapes = [
+  {
+    name: 'Mission Control terminal demo',
+    tape: path.join(repoRoot, 'docs', 'demos', 'projscan-mission-control.tape'),
+    output: path.join(repoRoot, 'docs', 'projscan-mission-control.gif'),
+  },
+  {
+    name: 'Mission Proof terminal demo',
+    tape: path.join(repoRoot, 'docs', 'demos', 'projscan-mission-proof.tape'),
+    output: path.join(repoRoot, 'docs', 'projscan-mission-proof.gif'),
+  },
+];
+
+const quoteForShell = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
+
+const fail = (message, status = 1) => {
+  console.error(message);
+  process.exit(status);
+};
+
+if (!existsSync(cliPath)) {
+  fail('Missing dist/cli/index.js. Run `npm run build` before capturing VHS demos.');
+}
+
+const vhsVersion = spawnSync('vhs', ['--version'], { cwd: repoRoot, encoding: 'utf8' });
+if (vhsVersion.status !== 0) {
+  fail('Missing `vhs`. Install it with `brew install vhs`, then run `npm run docs:demos`.');
+}
+
+for (const tape of tapes) {
+  if (!existsSync(tape.tape)) {
+    fail(`Missing VHS tape: ${path.relative(repoRoot, tape.tape)}`);
+  }
+}
+
+mkdirSync(vhsBinDir, { recursive: true });
+writeFileSync(vhsShimPath, `#!/usr/bin/env sh\nexec node ${quoteForShell(cliPath)} "$@"\n`);
+chmodSync(vhsShimPath, 0o755);
+
+const env = {
+  ...process.env,
+  PATH: `${vhsBinDir}${path.delimiter}${process.env.PATH ?? ''}`,
+};
+
+try {
+  rmSync(vhsMissionDir, { recursive: true, force: true });
+
+  for (const tape of tapes) {
+    console.log(`Capturing ${tape.name} -> ${path.relative(repoRoot, tape.output)}`);
+    const result = spawnSync('vhs', [path.relative(repoRoot, tape.tape)], {
+      cwd: repoRoot,
+      env,
+      stdio: 'inherit',
+    });
+
+    if (result.status !== 0) {
+      fail(`VHS capture failed for ${path.relative(repoRoot, tape.tape)}`, result.status ?? 1);
+    }
+
+    if (!existsSync(tape.output)) {
+      fail(`VHS did not write expected output: ${path.relative(repoRoot, tape.output)}`);
+    }
+  }
+} finally {
+  rmSync(vhsMissionDir, { recursive: true, force: true });
+  rmSync(vhsBinDir, { recursive: true, force: true });
+}
+
+console.log('VHS demos captured.');