projscan 4.5.0 → 4.6.0

package/dist/utils/configReportPolicies.js

@@ -0,0 +1,32 @@
+export function applyReportPolicies(obj, out) {
+    if (!obj.reportPolicies ||
+        typeof obj.reportPolicies !== 'object' ||
+        Array.isArray(obj.reportPolicies)) {
+        return;
+    }
+    const raw = obj.reportPolicies;
+    const policies = {};
+    for (const [rawName, rawPolicy] of Object.entries(raw)) {
+        const name = rawName.trim();
+        const policy = name ? normalizeReportPolicy(rawPolicy) : null;
+        if (policy)
+            policies[name] = policy;
+    }
+    if (Object.keys(policies).length > 0)
+        out.reportPolicies = policies;
+}
+function normalizeReportPolicy(rawPolicy) {
+    if (!rawPolicy || typeof rawPolicy !== 'object' || Array.isArray(rawPolicy))
+        return null;
+    const entry = rawPolicy;
+    const policy = {};
+    if (Array.isArray(entry.reportScope)) {
+        const scopes = entry.reportScope.filter((v) => typeof v === 'string' && v.length > 0);
+        if (scopes.length > 0)
+            policy.reportScope = scopes;
+    }
+    if (typeof entry.redactPaths === 'boolean')
+        policy.redactPaths = entry.redactPaths;
+    return Object.keys(policy).length > 0 ? policy : null;
+}
+//# sourceMappingURL=configReportPolicies.js.map

package/dist/utils/configReportPolicies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configReportPolicies.js","sourceRoot":"","sources":["../../src/utils/configReportPolicies.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CAAC,GAA4B,EAAE,GAAmB;IACnF,IACE,CAAC,GAAG,CAAC,cAAc;QACnB,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QACtC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EACjC,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,cAAyC,CAAC;IAC1D,MAAM,QAAQ,GAAuC,EAAE,CAAC;IAExD,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACtC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC;AACtE,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAkB;IAC/C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CACrC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACnF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/dist/utils/configScan.d.ts

@@ -0,0 +1,2 @@
+import type { ProjscanConfig } from '../types/config.js';
+export declare function applyScan(obj: Record<string, unknown>, out: ProjscanConfig): void;

package/dist/utils/configScan.js

@@ -0,0 +1,15 @@
+export function applyScan(obj, out) {
+    if (!obj.scan || typeof obj.scan !== 'object')
+        return;
+    const raw = obj.scan;
+    const scan = {};
+    if (typeof raw.includeIgnored === 'boolean')
+        scan.includeIgnored = raw.includeIgnored;
+    if (typeof raw.scanEnvValues === 'boolean')
+        scan.scanEnvValues = raw.scanEnvValues;
+    if (typeof raw.offline === 'boolean')
+        scan.offline = raw.offline;
+    if (Object.keys(scan).length)
+        out.scan = scan;
+}
+//# sourceMappingURL=configScan.js.map

package/dist/utils/configScan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configScan.js","sourceRoot":"","sources":["../../src/utils/configScan.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,SAAS,CAAC,GAA4B,EAAE,GAAmB;IACzE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,IAA+B,CAAC;IAChD,MAAM,IAAI,GAAwC,EAAE,CAAC;IACrD,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;IACtF,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IACnF,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IACjE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAChD,CAAC"}

package/dist/utils/configSeverity.d.ts

@@ -0,0 +1,2 @@
+import type { ProjscanConfig } from '../types/config.js';
+export declare function applySeverityOverrides(obj: Record<string, unknown>, out: ProjscanConfig): void;

package/dist/utils/configSeverity.js

@@ -0,0 +1,15 @@
+const VALID_SEVERITIES = ['info', 'warning', 'error'];
+export function applySeverityOverrides(obj, out) {
+    if (!obj.severityOverrides || typeof obj.severityOverrides !== 'object')
+        return;
+    const raw = obj.severityOverrides;
+    const overrides = {};
+    for (const [key, val] of Object.entries(raw)) {
+        if (typeof val === 'string' && VALID_SEVERITIES.includes(val)) {
+            overrides[key] = val;
+        }
+    }
+    if (Object.keys(overrides).length)
+        out.severityOverrides = overrides;
+}
+//# sourceMappingURL=configSeverity.js.map

package/dist/utils/configSeverity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configSeverity.js","sourceRoot":"","sources":["../../src/utils/configSeverity.ts"],"names":[],"mappings":"AAGA,MAAM,gBAAgB,GAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAEvE,MAAM,UAAU,sBAAsB,CACpC,GAA4B,EAC5B,GAAmB;IAEnB,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QAAE,OAAO;IAChF,MAAM,GAAG,GAAG,GAAG,CAAC,iBAA4C,CAAC;IAC7D,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAK,gBAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,SAAS,CAAC,GAAG,CAAC,GAAG,GAAoB,CAAC;QACxC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,iBAAiB,GAAG,SAAS,CAAC;AACvE,CAAC"}

package/dist/utils/configSources.d.ts

@@ -0,0 +1,5 @@
+export interface ConfigSource {
+    value: unknown;
+    source: string;
+}
+export declare function loadConfigSource(rootPath: string, explicitPath?: string): Promise<ConfigSource | null>;

package/dist/utils/configSources.js

@@ -0,0 +1,55 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+const CONFIG_CANDIDATES = ['.projscanrc.json', '.projscanrc'];
+const PKG_KEY = 'projscan';
+export async function loadConfigSource(rootPath, explicitPath) {
+    if (explicitPath)
+        return await loadExplicitConfigSource(rootPath, explicitPath);
+    const candidateSource = await loadCandidateConfigSource(rootPath);
+    if (candidateSource)
+        return candidateSource;
+    return await loadPackageConfigSource(rootPath);
+}
+async function loadExplicitConfigSource(rootPath, explicitPath) {
+    const resolved = path.isAbsolute(explicitPath) ? explicitPath : path.join(rootPath, explicitPath);
+    return { value: safeParse(await fs.readFile(resolved, 'utf-8'), resolved), source: resolved };
+}
+async function loadCandidateConfigSource(rootPath) {
+    for (const name of CONFIG_CANDIDATES) {
+        const candidate = path.join(rootPath, name);
+        let raw;
+        try {
+            raw = await fs.readFile(candidate, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        return { value: safeParse(raw, candidate), source: candidate };
+    }
+    return null;
+}
+async function loadPackageConfigSource(rootPath) {
+    const pkgPath = path.join(rootPath, 'package.json');
+    try {
+        const raw = await fs.readFile(pkgPath, 'utf-8');
+        const pkg = JSON.parse(raw);
+        const embedded = pkg[PKG_KEY];
+        if (embedded && typeof embedded === 'object') {
+            return { value: embedded, source: `${pkgPath}#${PKG_KEY}` };
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+function safeParse(raw, filePath) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid JSON in ${filePath}: ${msg}`, { cause: err });
+    }
+}
+//# sourceMappingURL=configSources.js.map

package/dist/utils/configSources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configSources.js","sourceRoot":"","sources":["../../src/utils/configSources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,iBAAiB,GAAG,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAC9D,MAAM,OAAO,GAAG,UAAU,CAAC;AAO3B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAqB;IAErB,IAAI,YAAY;QAAE,OAAO,MAAM,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEhF,MAAM,eAAe,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,OAAO,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,QAAgB,EAChB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClG,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,QAAgB;IACvD,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,QAAgB;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC"}

package/dist/utils/configTaint.d.ts

@@ -0,0 +1,2 @@
+import type { ProjscanConfig } from '../types/config.js';
+export declare function applyTaint(obj: Record<string, unknown>, out: ProjscanConfig): void;

package/dist/utils/configTaint.js

@@ -0,0 +1,15 @@
+export function applyTaint(obj, out) {
+    if (!obj.taint || typeof obj.taint !== 'object')
+        return;
+    const t = obj.taint;
+    const taint = {};
+    if (Array.isArray(t.sources)) {
+        taint.sources = t.sources.filter((v) => typeof v === 'string' && v.length > 0);
+    }
+    if (Array.isArray(t.sinks)) {
+        taint.sinks = t.sinks.filter((v) => typeof v === 'string' && v.length > 0);
+    }
+    if (Object.keys(taint).length)
+        out.taint = taint;
+}
+//# sourceMappingURL=configTaint.js.map

package/dist/utils/configTaint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configTaint.js","sourceRoot":"","sources":["../../src/utils/configTaint.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,UAAU,CAAC,GAA4B,EAAE,GAAmB;IAC1E,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO;IACxD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAgC,CAAC;IAC/C,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;AACnD,CAAC"}

package/docs/GUIDE.md

@@ -187,7 +187,7 @@ When the agent first opens a repo, or before starting a refactor, the question i
   For branch-diff, PR-size, and commit-message questions, such as `projscan start --intent "what did I change since main?"`, `projscan start --intent "is this PR too large?"`, `projscan start --intent "how big is this change?"`, `projscan start --intent "write a commit message for these changes"`, or `projscan start --intent "summarize my changes for a commit"`, it routes to `projscan_pr_diff` so changed exports, imports, call sites, complexity, and fan-in are reviewed before full review.
   For branch freshness and comparison questions, such as `projscan start --intent "is my branch stale?"` or `projscan start --intent "compare my branch with main"`, it also routes to `projscan_pr_diff` so the developer checks the structural diff before rebasing or asking for review. For rebase and merge-conflict recovery, such as `projscan start --intent "rebase went wrong"` or `projscan start --intent "resolve merge conflicts"`, it routes to `projscan_preflight --mode before_merge`; post-conflict test-plan wording such as `projscan start --intent "what should I test after resolving conflicts?"` stays on `projscan_regression_plan`.
   For resume questions, such as `projscan start --intent "where did I leave off?"`, `projscan start --intent "what changed while I was away?"`, `projscan start --intent "what changed while I was offline?"`, `projscan start --intent "what changed while I was asleep?"`, `projscan start --intent "what did the last agent touch?"`, or `projscan start --intent "what did the last agent do?"`, it routes to `projscan_session { action: "touched" }` so remembered touched files are reviewed before live preflight evidence gates the next edit.
-  For parallel-agent coordination questions, such as `projscan start --intent "show coordination status for parallel agents"`, `projscan start --intent "who else is working on this?"`, `projscan start --intent "am I going to collide with another agent?"`, or `projscan start --intent "what worktrees are active?"`, it routes to `projscan_coordinate` so collisions, claims, and merge order are reviewed through one readiness verdict before editing continues. For merge-order wording, such as `projscan start --intent "what should merge first?"`, it routes to `projscan_merge_risk`; for overlap wording, such as `projscan start --intent "show me overlapping changes"`, it routes to `projscan_collision`.
+  For parallel-agent coordination questions, such as `projscan start --intent "show coordination status for parallel agents"`, `projscan start --intent "who else is working on this?"`, `projscan start --intent "am I going to collide with another agent?"`, or `projscan start --intent "what worktrees are active?"`, it routes to `projscan_coordinate` so collisions, claims, merge order, and the current-worktree-versus-remembered-session evidence boundary are reviewed through one readiness verdict before editing continues. For merge-order wording, such as `projscan start --intent "what should merge first?"`, it routes to `projscan_merge_risk`; for overlap wording, such as `projscan start --intent "show me overlapping changes"`, it routes to `projscan_collision`.
   For active-claim questions, such as `projscan start --intent "show active claims"`, it routes to `projscan_claim { action: "list" }` so owners, leases, and contention warnings are reviewed before parallel work continues.
   For file-claim requests, such as `projscan start --intent "claim src/core/start.ts for me"`, it routes to `projscan_claim`, lists active claims first, then adds the requested target only after a real agent name replaces `Needs Input`.
   For architecture-coupling questions, such as `projscan start --intent "show circular dependencies"` or `projscan start --intent "find dependency cycles"`, it routes to `projscan_coupling` with `direction: "cycles_only"` / `projscan coupling --cycles-only --format json`; broader wording such as `projscan start --intent "what modules are tightly coupled"` routes to the full fan-in, fan-out, instability, cross-package-edge, and cycle report.
@@ -204,7 +204,7 @@ When the agent first opens a repo, or before starting a refactor, the question i
 - **`projscan_preflight` / `projscan preflight`** — agent safety gate. Returns `proceed`, `caution`, or `block` with health, changed-file, review, remembered session, hotspot, plugin-policy, supply-chain, and release-scale evidence. `evidence.riskSources.currentWorktree` is current Git/worktree evidence; `evidence.riskSources.sessionMemory` is remembered handoff context. Use `--mode before_edit` at the start of work and `--mode before_commit` / `--mode before_merge` before handing off or merging; scale-only commit blocks are cautions, while merge gates still require manual release sign-off.
 - **`projscan_hotspots` / `projscan hotspots`** — files ranked by `git churn × AST cyclomatic complexity × open issues × ownership × coverage`. Pass `view: "functions"` for top-N risky individual functions across the repo (0.13+).
 - **`projscan_semantic_graph` / `projscan semantic-graph`** — stable v3 graph contract with file, function, package, and symbol nodes plus imports, exports, definitions, and calls edges. Use it when an agent needs one normalized graph shape instead of several targeted queries.
-- **`projscan_dataflow` / `projscan dataflow`** — direct, propagated, and bridge source-to-sink dataflow risks. Use it for a focused safety pass before touching command execution, raw SQL, filesystem writes, or DOM sinks.
+- **`projscan_dataflow` / `projscan dataflow`** — direct, propagated, and bridge source-to-sink dataflow risks, including framework-aware Next.js route request body and URL sources. Use it for a focused safety pass before touching command execution, raw SQL, filesystem writes, or DOM sinks.
 - **`projscan_coupling` / `projscan coupling`** — per-file fan-in / fan-out / instability plus circular-import cycles (Tarjan SCC). Use `direction: cycles_only` or `projscan coupling --cycles-only` to surface architectural debt directly.
 - **`projscan_analyze` / `projscan analyze`** — the everything report; useful at session start but verbose.
 
@@ -435,7 +435,11 @@ and a sink wrapper is surfaced even when legacy taint reachability cannot see a
 downstream call path from source to sink. By default, dataflow suppresses test-file paths,
 broad readFile/writeFile-style noise, and JavaScript RegExp.exec false positives.
 Framework request-source detection covers narrow tested patterns for Next.js, Hono,
-Express, Fastify, and Koa handlers while keeping lookalike helpers quiet.
+Express, Fastify, and Koa handlers, including Hono validator output,
+Express/Fastify/Koa request IP metadata, Fastify host/hostname and raw
+URL/header evidence, and Express/Koa header accessors plus Express
+`req.param(...)` and `req.originalUrl`, while
+keeping lookalike helpers quiet.
 
 For release hardening, `npm run check:graph-corpus` compares bundled fixture metrics against `docs/graph-corpus-baseline.json`. The gate fails only when graph coverage drops below the baseline or dataflow risks rise above it.
 
@@ -698,8 +702,8 @@ Preview the impact of upgrading a package. The default path is fully offline; pa
 - Breaking-change markers found in the CHANGELOG: scans for `BREAKING CHANGE`, `deprecated`, `removed support`, `no longer supported`, and section headers containing "breaking"
 - CHANGELOG excerpt sliced to the relevant version range (read from `node_modules/<pkg>/CHANGELOG.md`)
 - Importer list - every file in your source tree that imports the package (direct or sub-path)
-- Python manifest evidence for packages declared in `pyproject.toml`, `setup.cfg`, `setup.py`, or root `requirements*.txt`
-- Python current-version evidence from `poetry.lock` package blocks or pinned root `requirements*.txt` entries
+- Python manifest evidence for packages declared in `pyproject.toml` (including PEP 735 `dependency-groups`, Poetry dependency groups, and legacy `tool.poetry.dev-dependencies`), `setup.cfg`, `setup.py`, or root `requirements*.txt`. Root Python manifests are sufficient local evidence even before `.py` files exist.
+- Python current-version evidence from `poetry.lock` / `uv.lock` / `pdm.lock` package blocks, `conda-lock.yml` / `conda-lock.yaml` package entries, `Pipfile.lock` exact versions, pinned root `requirements*.txt`, or pinned root `constraints*.txt` entries
 
 **Example:**
 
@@ -721,7 +725,7 @@ $ projscan upgrade react --format markdown
 
 - Reads the CHANGELOG that npm already placed in `node_modules/`. If the package author doesn't ship one, you'll see "No local CHANGELOG found."
 - Without `--check-registry`, works with what's **installed** and reports `latestSource: "installed"`. With `--check-registry`, npm registry lookup is attempted and failures fall back to the installed version with `registryError`.
-- Python previews stay offline. They do not query PyPI; current-version evidence comes from supported local lockfiles or pinned root requirements.
+- Python previews stay offline. They do not query PyPI; current-version evidence comes from supported local lockfiles, pinned root requirements, or pinned root constraints.
 
 ### coverage
 
@@ -909,6 +913,10 @@ projscan doctor --format html > HEALTH.html
 ```
 
 Supported on `analyze`, `doctor`, `hotspots`, `coupling`, `pr-diff`, `review`, `impact`, and `coverage`.
+For `analyze` and `doctor`, scoped/redacted report controls also appear as a
+path-safe controls card when active.
+Path redaction keeps HTTP(S) documentation links readable while redacting
+standalone file-like path tokens from issue text.
 
 ### SARIF
 
@@ -929,9 +937,11 @@ Supported on `analyze`, `audit`, `ci`, `doctor`, and `outdated`. Each issue is e
 For shareable evidence artifacts, `analyze`, `doctor`, and `ci` accept
 `--report-policy <name>`, `--report-scope <paths>`, and `--redact-paths`. Scope
 is comma-separated and repo-relative. Redaction replaces file paths with stable
-labels while preserving correlation across issues and files in the same report.
-Direct `--report-scope` and `--redact-paths` flags override the selected preset
-for a single run.
+labels while preserving correlation across issues and files in the same report,
+including file-like path tokens in issue text that has no location anchor.
+JSON/SARIF include path-safe `reportControls` metadata, and Markdown/HTML print
+path-safe controls banners. Direct `--report-scope` and `--redact-paths` flags
+override the selected preset for a single run.
 - `properties.fixAvailable` - whether `projscan fix` can remediate it
 
 When uploaded to GitHub Code Scanning, findings appear in the **Security → Code scanning** tab and (for PRs) as inline annotations on changed lines.
@@ -1622,7 +1632,8 @@ src/
 │   ├── markdownReporter.ts      # Markdown output
 │   └── sarifReporter.ts         # SARIF 2.1.0 output
 ├── mcp/
-│   ├── server.ts                # JSON-RPC 2.0 dispatcher, stdio transport, negotiation
+│   ├── server.ts                # MCP server factory and JSON-RPC request orchestration
+│   ├── serverStdio.ts           # stdio transport loop for the CLI entry point
 │   ├── tools.ts                 # 41 MCP tools (barrel; per-tool files under tools/)
 │   ├── tokenBudget.ts           # Record-aware response truncator
 │   ├── pagination.ts            # Cursor-based pagination (opaque base64 + checksum)

package/docs/ROADMAP.md

@@ -79,8 +79,8 @@ Success signals: teams copy the adoption examples into real reviews, scoped/reda
 - Roadmap and release-train planning now default to the current post-4.4 product lines instead of stale shipped work.
 - Adoption examples cover agent orchestration, package ownership, custom policy plugins, swarm coordination, and scoped evidence exports.
 - `analyze`, `doctor`, and `ci` can scope and redact shareable evidence with direct flags or named `reportPolicies` presets.
-- `projscan upgrade` and MCP `projscan_upgrade` support offline Python previews from manifests, Poetry lockfiles, pinned requirements, and Python importers.
-- Dataflow detects narrow Fastify and Koa request-source patterns while suppressing lookalike helpers and Koa response-body writes.
+- `projscan upgrade` and MCP `projscan_upgrade` support offline Python previews from manifests, Poetry/Pipfile/uv/PDM/Conda lockfiles, pinned requirements/constraints, and Python importers.
+- Dataflow detects narrow Fastify and Koa request-source patterns, including Fastify raw URL/header and Koa IP evidence, while suppressing lookalike helpers and Koa response-body writes.
 - Start next-action assembly and taint function identity were tightened during release readiness cleanup.
 
 ### Recently Completed — 4.4.0 (2026)

package/docs/examples/adoption-workflows.md

@@ -50,8 +50,8 @@ projscan agent-brief --intent "handoff package ownership for fastapi" --format j
 For Node packages, `upgrade` reads local `package.json`, `node_modules`, local
 CHANGELOG files, and importer evidence. For Python packages, it reads
 `pyproject.toml`, `setup.cfg`, `setup.py`, root `requirements*.txt` files,
-Poetry lockfiles, and pinned root requirements, then returns declared scope,
-current-version source, drift, and Python importers.
+Poetry/Pipfile/uv/PDM/Conda lockfiles, and pinned root requirements/constraints, then
+returns declared scope, current-version source, drift, and Python importers.
 
 Decision loop:
 

package/docs/examples/swarm-coordination.md

@@ -51,6 +51,17 @@ Read the outputs this way:
 | `coordinate` | Is the current swarm clear, cautious, or conflicted? | Use this as the one-line status in handoffs. |
 | `agent-brief` | What should the next agent know? | Include coordination hints in the next-agent packet. |
 
+The JSON reports for `collisions` and `coordinate` include an `evidence` block
+with the active command path, current worktree state, local-only source signals,
+the validation workflow above, and a reminder that session memory is separate
+from current Git/worktree evidence. The default `coordinate` console view prints
+the same session-boundary reminder inside its `Evidence` section.
+When multiple worktrees are present, `agent-brief` also carries a
+`context.coordinationHints` entry even for a clear swarm, so the next agent knows
+to validate locally with `projscan coordinate --format json`,
+`projscan coordinate --watch --interval 5 --format json`, and
+`projscan agent-brief --format json` before continuing parallel edits.
+
 For MCP clients that support long-running notifications, use the watch tool:
 
 ```text

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "projscan",
   "mcpName": "io.github.abhiyoheswaran1/projscan",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Agent-first code intelligence. MCP server (2025-03-26) with 11 AST adapters covering 12 named languages: JavaScript, TypeScript, Python, Go, Java, Ruby, Rust, PHP, C#, Kotlin, Swift, and C++; repo understanding maps (projscan_understand), stable v3 semantic graph (projscan_semantic_graph), dataflow risk engine with bridge-helper detection (projscan_dataflow), code graph, file + per-function AST cyclomatic complexity, per-function fan-in + fan-out, coupling + cycle detection, structural PR diff with HTML reporter, coverage report with HTML reporter, intent-grounded one-call PR review (projscan_review with optional `intent` arg, new taint flows, contract changes, and newDataflowRisks) and long-running PR-watch mode with structured per-bucket deltas (projscan_review_watch), first-60-seconds workflow orientation (projscan_start), agent workplans (projscan_workplan), bug-hunt queues (projscan_bug_hunt), product-line planning (projscan_release_train), evidence packs (projscan_evidence_pack), regression planning (projscan_regression_plan), agent briefs (projscan_agent_brief), quality scorecards (projscan_quality_scorecard), and preflight with supply-chain IOC evidence, rule-driven fix suggestions + mechanical apply layer with rollback (projscan_apply_fix, projscan_fix_suggest, projscan_explain_issue), source-to-sink taint analysis (projscan_taint) with truncation reporting, transitive blast-radius analysis with cross-repo mode (projscan_impact for files and symbols), cross-repo workspace registration + intelligence (projscan_workspace_graph), per-function semantic search chunks (sub-file embeddings), per-rule confidence + severity drift + cost-summary analytics with live streaming (projscan_cost_summary), stable local analyzer + reporter plugin API (projscan_plugin, CLI --reporter, opt-in via PROJSCAN_PLUGINS_PREVIEW=1), monorepo workspace awareness with cross-package import policy + per-package dependencies / outdated / audit, BM25 + optional semantic search, cursor pagination, progress notifications, context-budgeted output, and a stable-surface CI guard. CLI on the side.",
   "type": "module",
   "main": "./dist/index.js",