readfirst 0.7.0 → 0.8.0

package/README.md

@@ -50,6 +50,18 @@ npx readfirst hook --install
 adds a hook to `.claude/settings.json`. Before each Edit or Write, Claude Code gets the rules, risks and checks for that
 file as context, once per file per session. Nothing to remember, and the edit is never blocked.
 
+Want the checks enforced, not just suggested?
+
+```sh
+npx readfirst hook --install --verify
+```
+
+also adds a Stop hook: before Claude Code finishes its turn, it runs the map's checks for the files it edited in that
+session. If one fails, Claude Code cannot finish yet and gets the failure to fix. It gets one try per turn, so a check
+it cannot fix never traps the session. It runs only check commands that the map on your main branch already lists: a
+command someone's branch adds or changes is named, not run, until it is merged (`npx readfirst verify` runs it when you
+choose to).
+
 ### See the map
 
 ```sh
@@ -121,10 +133,29 @@ lists what `npx readfirst fix` would change.
 | `fail-on-map-problems` | `true` | `false` reports map problems without failing |
 | `strict` | `false` | `true` also fails on new files that are only placed by their neighbours |
 | `comment` | `true` | `false` writes only the job summary |
+| `auto-fix` | `false` | `true` commits what `readfirst fix` settles (new files placed by their neighbours) to the PR branch |
 | `limit` | `30` | most tests and users listed per section |
 
 On a PR from a fork, the token is read-only. The list then goes to the job summary instead of a comment.
 
+### Keep the map in step without thinking about it
+
+```yaml
+permissions:
+  contents: write        # for auto-fix
+  pull-requests: write
+# ...
+      - uses: jeonghun917/readfirst@v0
+        with:
+          auto-fix: true
+```
+
+With `auto-fix`, when a PR adds files next to ones the map already places, the Action writes them into the map and
+commits that to the PR branch. That is the mechanical part `npx readfirst fix` does, nothing else: new risks and
+rules stay for a person. It skips PRs from forks, and it skips the commit if the branch's map changed since the run
+started, so a push is never overwritten. A commit made with the default `GITHUB_TOKEN` does not start new workflow
+runs. If your branch protection requires checks, pass a GitHub App or personal token as `token`.
+
 ## The map
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "readfirst",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "mcpName": "io.github.jeonghun917/readfirst",
   "description": "What to read and check before you (or your AI agent) change a file: project rules, risks and tests tied to code.",
   "type": "module",

package/src/action.mjs

@@ -30,12 +30,14 @@ async function pages(fetchImpl, env, path) {
   return all;
 }
 
-export function commentBody({ list, problems, removed, commit, fixes = [], settled = [] }) {
+export function commentBody({ list, problems, removed, commit, fixes = [], settled = [], committed = null }) {
   const parts = [MARKER, '## readfirst', ''];
   if (problems.length) {
     parts.push(`> [!WARNING]\n> \`${MAP_PATH}\` no longer matches the code (${problems.length} problem${problems.length > 1 ? 's' : ''}). Run \`npx readfirst check\` and fix the map in this PR.`, '');
     parts.push(...problems.slice(0, 20).map((p) => `- ${p}`), ...(problems.length > 20 ? [`- …and ${problems.length - 20} more`] : []), '');
     if (fixes.length) parts.push('`npx readfirst fix` would make these changes:', ...fixes.slice(0, 10).map((f) => `- ${f}`), ...(fixes.length > 10 ? [`- …and ${fixes.length - 10} more`] : []), '');
+  } else if (committed) {
+    parts.push(`<details><summary>readfirst placed ${settled.length} new file(s) in the map and committed it to this branch (${committed.slice(0, 7)})</summary>`, '', ...settled.slice(0, 20).map((f) => `- ${f}`), ...(settled.length > 20 ? [`- …and ${settled.length - 20} more`] : []), '', 'Pull before your next push.', '</details>', '');
   } else if (settled.length) {
     parts.push(`<details><summary>New files placed by their neighbours (${settled.length})</summary>`, '', ...settled.slice(0, 20).map((f) => `- ${f}`), ...(settled.length > 20 ? [`- …and ${settled.length - 20} more`] : []), '', '`npx readfirst fix` writes this into the map; nothing to do for this PR.', '</details>', '');
   }
@@ -72,13 +74,16 @@ export async function runAction({ env = process.env, fetchImpl = fetch, root = e
   }
   const repo = env.GITHUB_REPOSITORY;
   const changed = await pages(fetchImpl, env, `/repos/${repo}/pulls/${pr.number}/files`);
+  const committed = (env['INPUT_AUTO-FIX'] ?? env.INPUT_AUTO_FIX ?? 'false') === 'true' && settled.length
+    ? await commitFix({ fetchImpl, env, repo, pr, raw, fixed: map, settled, log })
+    : null;
   const removed = changed.filter((f) => f.status === 'removed').map((f) => f.filename);
   const targets = changed.filter((f) => f.status !== 'removed').map((f) => f.filename);
   // A broken map still gets a comment (the problems), but no read list from it.
   const list = targets.length && !problems.length
     ? readList({ map, files, imports: importEdges(files, readText(root)), targets, commit: pr.head?.sha ?? null, limit: Number(env.INPUT_LIMIT || 30) })
     : null;
-  const body = commentBody({ list, problems, removed, commit: pr.head?.sha ?? null, fixes, settled });
+  const body = commentBody({ list, problems, removed, commit: pr.head?.sha ?? null, fixes, settled, committed });
   summary(body);
 
   if ((env.INPUT_COMMENT ?? 'true') !== 'false') {
@@ -95,7 +100,39 @@ export async function runAction({ env = process.env, fetchImpl = fetch, root = e
     }
   }
   if (problems.length) log(`${MAP_PATH} has ${problems.length} problem(s):\n- ${problems.join('\n- ')}`);
-  return { ok: !(problems.length && failOnProblems), problems, list, body };
+  return { ok: !(problems.length && failOnProblems), problems, list, body, committed };
+}
+
+// auto-fix: write what `readfirst fix` settles (new files placed by their neighbours, patterns for deleted files) into
+// the map on the PR's branch, as one commit through the contents API. Only the mechanical part, never anything a person
+// has to decide; only on a branch of this repository; only when the branch's map is the one this run read, so a push in
+// between is never overwritten. Returns the new commit's sha, or null with a warning.
+async function commitFix({ fetchImpl, env, repo, pr, raw, fixed, settled, log }) {
+  if (pr.head?.repo?.full_name !== repo || !pr.head?.ref) {
+    log('::warning::readfirst auto-fix: this PR comes from a fork, so the map update stays a suggestion in the comment.');
+    return null;
+  }
+  const path = MAP_PATH.split('/').map(encodeURIComponent).join('/');
+  try {
+    const now = await api(fetchImpl, env, 'GET', `/repos/${repo}/contents/${path}?ref=${encodeURIComponent(pr.head.ref)}`);
+    let onBranch = null;
+    try { onBranch = JSON.parse(Buffer.from(now.content ?? '', 'base64').toString('utf8')); } catch { onBranch = null; }
+    if (JSON.stringify(onBranch) !== JSON.stringify(raw)) {
+      log('::warning::readfirst auto-fix: the map on the branch differs from the one this run read (a newer push, or the base changed it); nothing committed.');
+      return null;
+    }
+    const res = await api(fetchImpl, env, 'PUT', `/repos/${repo}/contents/${path}`, {
+      message: `readfirst fix: place ${settled.length} new file(s) in the map`,
+      content: Buffer.from(`${JSON.stringify(fixed, null, 2)}\n`, 'utf8').toString('base64'),
+      sha: now.sha,
+      branch: pr.head.ref,
+    });
+    log(`readfirst auto-fix: committed the map update to ${pr.head.ref}`);
+    return res?.commit?.sha ?? 'committed';
+  } catch (e) {
+    log(`::warning::readfirst auto-fix could not commit (${/: 403 /u.test(e.message) ? 'the token needs contents: write' : e.message.slice(0, 200)}); the comment says what \`npx readfirst fix\` would change.`);
+    return null;
+  }
 }
 
 if (process.argv[1]?.endsWith('/src/action.mjs')) {

package/src/cli.mjs

@@ -8,6 +8,7 @@
 //   readfirst diff [--base <ref>]  the read list for the files changed since <ref> (default: origin/main, else main)
 //   readfirst verify [--base <ref>] run the checks the read list names for the changed files; exit 1 if one fails
 //   readfirst hook [--install]     a Claude Code PreToolUse hook: the read list for the file an Edit or Write is about to change
+//                                  (--install --verify also adds a Stop hook, `hook --stop`, that runs verify before Claude Code finishes)
 //   readfirst mcp                  an MCP server on stdio: read_list, changed_read_list and check_map as tools for any agent
 //   readfirst view [--out <file>]  the map as a city in one HTML page (default .readfirst/local/view.html)
 // Options: --root <dir> (default: the current git repository), --json, --limit <n>.
@@ -33,7 +34,8 @@ const HELP = `readfirst — what to read and check before changing a file
   readfirst read <file>...       read list for files you are about to change
   readfirst diff [--base <ref>]  read list for files changed since <ref>
   readfirst verify [--base <ref>]  run the checks for the files changed since <ref> (--dry-run lists them)
-  readfirst hook [--install]     Claude Code hook: the read list before each edit (--install adds it to .claude/settings.json)
+  readfirst hook [--install]     Claude Code hook: the read list before each edit (--install adds it to .claude/settings.json;
+                                 --install --verify also runs the checks for edited files before Claude Code finishes)
   readfirst view [--out <file>]  the map as a city in one HTML page
   readfirst mcp                  MCP server on stdio for Cursor, Codex, Windsurf and other agents
   readfirst prompt --labels <lang>  brief for your agent to write personal labels for the view (e.g. ko, en)
@@ -51,6 +53,8 @@ function parse(argv) {
     else if (a === '--install') args.install = true;
     else if (a === '--dry-run') args.dryRun = true;
     else if (a === '--strict') args.strict = true;
+    else if (a === '--verify') args.verify = true;
+    else if (a === '--stop') args.stop = true;
     else if (a === '-h' || a === '--help') args.help = true;
     else if (a.startsWith('--')) { const v = argv[++i]; if (v === undefined) throw new Error(`${a} needs a value`); args[a.slice(2)] = v; }
     else args._.push(a);
@@ -164,6 +168,9 @@ export function brief(list) {
   return lines;
 }
 
+// Which files the PreToolUse hook has seen in a session: the Stop hook verifies those.
+const seenFile = (stateDir, session) => join(stateDir, `readfirst-hook-${String(session ?? 'none').replace(/[^\w-]/gu, '')}.json`);
+
 // Claude Code PreToolUse hook. Reads the hook's JSON on stdin; for an Edit, Write or MultiEdit of a file the map covers,
 // prints the read list as additionalContext, once per file per session. Never blocks the edit: any problem means no output.
 export function runHook(input, { now = Date.now(), stateDir = tmpdir() } = {}) {
@@ -175,7 +182,7 @@ export function runHook(input, { now = Date.now(), stateDir = tmpdir() } = {}) {
     const root = git(cwd, 'rev-parse', '--show-toplevel').trim();
     const path = (isAbsolute(file) ? relative(root, file) : file).replace(/\\/gu, '/');
     if (path.startsWith('..') || path === MAP_PATH || !existsSync(join(root, MAP_PATH))) return null;
-    const seenAt = join(stateDir, `readfirst-hook-${String(event.session_id ?? 'none').replace(/[^\w-]/gu, '')}.json`);
+    const seenAt = seenFile(stateDir, event.session_id);
     let seen = {};
     try { seen = JSON.parse(readFileSync(seenAt, 'utf8')); } catch { seen = {}; }
     if (seen[path] && now - seen[path] < 6 * 3600_000) return null;
@@ -195,17 +202,78 @@ export function runHook(input, { now = Date.now(), stateDir = tmpdir() } = {}) {
   }
 }
 
+// The check commands of the map as the base branch has it. The Stop hook runs a command without anyone asking, so it
+// runs only these: a command a branch adds or changes in the map is repository content nobody has merged yet.
+function trustedRuns(root) {
+  try {
+    const { ref } = changedFiles(root);
+    const since = git(root, 'merge-base', ref, 'HEAD').trim();
+    const map = JSON.parse(git(root, 'show', `${since}:${MAP_PATH}`));
+    return new Set([...(map.groups ?? []), ...(map.rules ?? [])].flatMap((x) => (x.checks ?? []).map((c) => c.run)));
+  } catch {
+    return new Set();
+  }
+}
+
+// Claude Code Stop hook (opt-in, `hook --install --verify`): before Claude Code ends its turn, run the map's checks for the
+// files it edited in this session that are still changed. A failing check blocks the stop once, with the failure as the
+// reason, so the agent fixes it; on the second stop of the same turn it lets go, so a check it cannot fix never traps
+// the session. Only commands the base branch's map already lists run; others are named for `readfirst verify`, which
+// someone runs on purpose. Nothing edited, nothing changed or no checks: no output.
+export function runStopHook(input, { stateDir = tmpdir(), timeout = 600 } = {}) {
+  let event;
+  try { event = JSON.parse(input); } catch { return null; }
+  if (event.stop_hook_active) return null;
+  try {
+    const root = git(event.cwd ?? process.cwd(), 'rev-parse', '--show-toplevel').trim();
+    if (!existsSync(join(root, MAP_PATH))) return null;
+    let seen = {};
+    try { seen = JSON.parse(readFileSync(seenFile(stateDir, event.session_id), 'utf8')); } catch { return null; }
+    const dirty = new Set(git(root, 'status', '--porcelain', '-z', '--untracked-files=all').split('\0').filter(Boolean).map((l) => l.slice(3)));
+    let changed = [];
+    try { changed = changedFiles(root).files; } catch { /* no base branch: the working tree is enough */ }
+    const targets = Object.keys(seen).filter((f) => dirty.has(f) || changed.includes(f)).sort();
+    if (!targets.length) return null;
+    const files = repoFiles(root);
+    const map = readMapFile(root);
+    if (mapProblems(map, files, { placement: false }).length) return null;
+    const list = readList({ map, files, imports: importEdges(files, readText(root)), targets, limit: 1 });
+    if (!list.checks.length) return null;
+    const trusted = trustedRuns(root);
+    const skipped = list.checks.filter((c) => !trusted.has(c.run)).map((c) => c.run);
+    const result = verifyChecks(root, list.checks.filter((c) => trusted.has(c.run)), { timeout });
+    const failed = result.filter((c) => c.status !== 'pass');
+    const notRun = skipped.length ? ` Not run, because the base branch's map does not list them yet: ${skipped.map((r) => `\`${r}\``).join(', ')}; run \`npx readfirst verify\` to run them on purpose.` : '';
+    if (!failed.length) return JSON.stringify({ systemMessage: `readfirst verify: ${result.length} check(s) passed for ${targets.length} edited file(s).${notRun}` });
+    const reason = [
+      `readfirst verify: ${failed.length} of ${result.length} check(s) the map lists for the files you edited failed. Fix them before you finish.${notRun}`,
+      ...failed.map((c) => `\n--- ${c.run} (${c.status}${c.code != null ? `, exit ${c.code}` : ''})${c.why ? ` covers ${c.why}` : ''}; last lines:\n${c.output ?? ''}`),
+    ].join('\n');
+    return JSON.stringify({ decision: 'block', reason });
+  } catch {
+    return null;
+  }
+}
+
 export const HOOK_COMMAND = 'npx --yes readfirst hook';
-// Adds the hook to the project's .claude/settings.json, keeping everything already there.
-export function installHook(root) {
+export const STOP_HOOK_COMMAND = 'npx --yes readfirst hook --stop';
+// Adds the hook to the project's .claude/settings.json, keeping everything already there. With verify, also the Stop
+// hook that runs the checks before Claude Code finishes.
+export function installHook(root, { verify = false } = {}) {
   const at = join(root, '.claude', 'settings.json');
   let settings = {};
   if (existsSync(at)) {
     try { settings = JSON.parse(readFileSync(at, 'utf8')); } catch { throw new Error('.claude/settings.json is not valid JSON; fix it first'); }
   }
   const pre = ((settings.hooks ??= {}).PreToolUse ??= []);
-  if (pre.some((m) => (m.hooks ?? []).some((h) => /readfirst hook/u.test(h.command ?? '')))) return false;
-  pre.push({ matcher: 'Edit|Write|MultiEdit', hooks: [{ type: 'command', command: HOOK_COMMAND, timeout: 15 }] });
+  const has = (list) => list.some((m) => (m.hooks ?? []).some((h) => /readfirst hook/u.test(h.command ?? '')));
+  let added = false;
+  if (!has(pre)) { pre.push({ matcher: 'Edit|Write|MultiEdit', hooks: [{ type: 'command', command: HOOK_COMMAND, timeout: 15 }] }); added = true; }
+  if (verify) {
+    const stop = (settings.hooks.Stop ??= []);
+    if (!has(stop)) { stop.push({ hooks: [{ type: 'command', command: STOP_HOOK_COMMAND, timeout: 1800 }] }); added = true; }
+  }
+  if (!added) return false;
   mkdirSync(join(root, '.claude'), { recursive: true });
   writeFileSync(at, `${JSON.stringify(settings, null, 2)}\n`);
   return true;
@@ -216,7 +284,7 @@ export function main(argv, io = { out: (s) => process.stdout.write(s), err: (s)
   const [cmd, ...rest] = args._;
   if (args.help || !cmd) { io.out(`${HELP}\n`); return cmd || args.help ? 0 : 2; }
   if (cmd === 'hook' && !args.install) {
-    const out = runHook(stdin());
+    const out = args.stop ? runStopHook(stdin()) : runHook(stdin());
     if (out) io.out(`${out}\n`);
     return 0;
   }
@@ -294,7 +362,9 @@ export function main(argv, io = { out: (s) => process.stdout.write(s), err: (s)
     return problems.length ? 1 : 0;
   }
   if (cmd === 'hook') {
-    io.out(installHook(root) ? 'added the readfirst hook to .claude/settings.json: Claude Code now sees the read list before each edit.\n' : '.claude/settings.json already has the readfirst hook.\n');
+    io.out(installHook(root, { verify: args.verify })
+      ? `added the readfirst hook to .claude/settings.json: Claude Code now sees the read list before each edit${args.verify ? ', and cannot finish while a check for a file it edited fails (it gets one try to fix it)' : ''}.\n`
+      : '.claude/settings.json already has the readfirst hook.\n');
     return 0;
   }
   if (cmd === 'fix') {

package/src/imports.mjs

@@ -1,7 +1,8 @@
-// Which tracked file imports which, read from the code. Only imports that resolve to a tracked file count: packages and
-// unresolved specifiers are left out. JavaScript/TypeScript (import, export from, import(), require) and Python
-// (import a.b, from a.b import c, relative from . imports) are read here; Go, Rust, Elixir, C#, Java/Kotlin, Ruby and
-// PHP in langs.mjs.
+// Which tracked file imports which, read from the code. Only imports that resolve to a tracked file count: packages from
+// outside the repository and unresolved specifiers are left out. JavaScript/TypeScript (import, export from, import(),
+// require; relative paths, the repository's own workspace packages and tsconfig/jsconfig "paths" aliases) and Python
+// (import a.b, from a.b import c, relative from . imports, and "a.b.c" strings that name a module of the repository,
+// as hooks and settings do) are read here; Go, Rust, Elixir, C#, Java/Kotlin, Ruby and PHP in langs.mjs.
 import { posix } from 'node:path';
 import { moreEdges } from './langs.mjs';
 
@@ -13,6 +14,87 @@ const PY_IMPORT = /^[ \t]*(?:from[ \t]+(\.*[\w.]*)[ \t]+import[ \t]+(\([^)]*\)|[
 const JS_EXT = ['', '.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.mts', '.vue', '.svelte', '/index.js', '/index.ts', '/index.tsx', '/index.mjs'];
 
 const lineAt = (body, index) => body.slice(0, index).split('\n').length;
+const dirOf = (f) => (posix.dirname(f) === '.' ? '' : posix.dirname(f));
+const within = (dir, file) => dir === '' || file.startsWith(`${dir}/`);
+
+// tsconfig.json allows comments and trailing commas.
+export function parseJsonc(text) {
+  if (text === null || text === undefined) return null;
+  let out = '';
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"') {
+      const end = text.slice(i).match(/^"(?:[^"\\\n]|\\.)*"/u);
+      if (!end) return null;
+      out += end[0]; i += end[0].length - 1;
+    } else if (c === '/' && text[i + 1] === '/') {
+      while (i < text.length && text[i] !== '\n') i++;
+      out += '\n';
+    } else if (c === '/' && text[i + 1] === '*') {
+      const close = text.indexOf('*/', i + 2);
+      if (close < 0) return null;
+      i = close + 1;
+    } else out += c;
+  }
+  try { return JSON.parse(out.replace(/,(\s*[}\]])/gu, '$1')); } catch { return null; }
+}
+
+// Bare specifiers that point back into the repository: a workspace package by the name in its package.json
+// ("@acme/db", "@acme/db/schema"), or a "paths" alias from the tsconfig/jsconfig that covers the importing file ("@/lib/x").
+function jsResolver(files, tracked, read) {
+  const jsCandidates = (base) => [...JS_EXT.map((e) => base + e), base.replace(/\.(m|c)?js$/u, '.$1ts'), base.replace(/\.js$/u, '.tsx')];
+  const firstTracked = (bases) => {
+    for (const b of bases) {
+      const hit = jsCandidates(posix.normalize(b)).find((c) => tracked.has(c));
+      if (hit) return hit;
+    }
+    return undefined;
+  };
+  const pkgs = [];
+  for (const f of files) {
+    if (!/(?:^|\/)package\.json$/u.test(f) || f.includes('node_modules/')) continue;
+    let j;
+    try { j = JSON.parse(read(f) ?? ''); } catch { continue; }
+    if (typeof j?.name !== 'string' || !j.name || dirOf(f) === '') continue;
+    const dot = typeof j.exports === 'string' ? j.exports : j.exports?.['.'];
+    const exp = typeof dot === 'string' ? [dot] : dot && typeof dot === 'object' ? ['types', 'import', 'default', 'require'].map((k) => dot[k]).filter((v) => typeof v === 'string') : [];
+    // An entry pointing at build output (dist/index.js) is read as the source next to it (src/index.ts).
+    const entries = [j.source, ...exp, j.types, j.typings, j.module, j.main].filter((v) => typeof v === 'string')
+      .flatMap((e) => [e, e.replace(/^\.?\/?(?:dist|build|lib|out)\//u, 'src/').replace(/\.d\.ts$/u, '.ts')]);
+    pkgs.push({ name: j.name, dir: dirOf(f), entries: [...entries, 'src/index', 'index'] });
+  }
+  pkgs.sort((a, b) => b.name.length - a.name.length);
+  const aliases = [];
+  for (const f of files) {
+    if (!/(?:^|\/)(?:tsconfig|jsconfig)(?:\.[\w-]+)?\.json$/u.test(f) || f.includes('node_modules/')) continue;
+    const opts = parseJsonc(read(f))?.compilerOptions;
+    if (!opts?.paths || typeof opts.paths !== 'object') continue;
+    const base = posix.join(dirOf(f), opts.baseUrl ?? '.');
+    for (const [pattern, targets] of Object.entries(opts.paths)) {
+      if (Array.isArray(targets)) aliases.push({ scope: dirOf(f), pattern, targets: targets.filter((t) => typeof t === 'string').map((t) => posix.join(base, t)) });
+    }
+  }
+  // The nearest config wins, as it would for the compiler.
+  aliases.sort((a, b) => b.scope.length - a.scope.length);
+  return (from, spec) => {
+    for (const a of aliases) {
+      if (!within(a.scope, from)) continue;
+      const star = a.pattern.indexOf('*');
+      let rest = null;
+      if (star < 0) rest = spec === a.pattern ? '' : null;
+      else if (spec.startsWith(a.pattern.slice(0, star)) && spec.endsWith(a.pattern.slice(star + 1))) rest = spec.slice(star, spec.length - (a.pattern.length - star - 1));
+      if (rest === null) continue;
+      const hit = firstTracked(a.targets.map((t) => t.replace('*', rest)));
+      if (hit) return hit;
+    }
+    const pkg = pkgs.find((p) => spec === p.name || spec.startsWith(`${p.name}/`));
+    if (!pkg) return undefined;
+    const sub = spec.slice(pkg.name.length + 1);
+    return sub
+      ? firstTracked([posix.join(pkg.dir, sub), posix.join(pkg.dir, 'src', sub)])
+      : firstTracked(pkg.entries.map((e) => posix.join(pkg.dir, e.replace(/\.(?:m|c)?js$|\.tsx?$/u, ''))));
+  };
+}
 
 export function importEdges(files, read) {
   const tracked = new Set(files);
@@ -27,13 +109,19 @@ export function importEdges(files, read) {
     const base = posix.join(baseDir, ...dotted.split('.').filter(Boolean));
     return [`${base}.py`, `${base}/__init__.py`].find((c) => tracked.has(c));
   };
+  let bare = null;
   for (const from of [...files].sort()) {
     if (JS.test(from)) {
       const body = read(from);
       if (body === null) continue;
       for (const m of body.matchAll(JS_IMPORT)) {
         const spec = (m[1] ?? m[2] ?? m[3]).split('?')[0];
-        if (!spec.startsWith('.')) continue;
+        if (!spec.startsWith('.')) {
+          if (spec.startsWith('node:') || /^[a-z]+:/u.test(spec)) continue;
+          bare ??= jsResolver(files, tracked, read);
+          add(from, bare(from, spec), lineAt(body, m.index));
+          continue;
+        }
         const base = posix.normalize(posix.join(posix.dirname(from), spec));
         // TypeScript sources import "./x.js" for the file "./x.ts".
         const candidates = [...JS_EXT.map((e) => base + e), base.replace(/\.(m|c)?js$/u, '.$1ts'), base.replace(/\.js$/u, '.tsx')];
@@ -64,6 +152,33 @@ export function importEdges(files, read) {
       }
     }
   }
+  dottedEdges(files, tracked, read, pyModule, add);
   moreEdges([...files].sort(), read, add);
   return out;
 }
+
+// Python projects name code by dotted path in strings: Frappe hooks.py ("app.module.function"), frappe.call from
+// JavaScript, Django settings and urls, Celery task names. A string counts when its first part is a top-level Python
+// package of the repository and the longest leading part names one of its modules.
+function dottedEdges(files, tracked, read, pyModule, add) {
+  const top = new Map();
+  for (const f of files) {
+    const m = f.match(/^(?:(src)\/)?([A-Za-z_]\w*)\/__init__\.py$/u);
+    if (m) top.set(m[2], m[1] ?? '');
+  }
+  if (!top.size) return;
+  const DOTTED = /["'`]([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+)["'`]/gu;
+  for (const from of files) {
+    if (!/\.(?:py|m?js|tsx?|json)$/u.test(from) || from.includes('node_modules/')) continue;
+    const body = read(from);
+    if (body === null || body.length > 2_000_000) continue;
+    for (const m of body.matchAll(DOTTED)) {
+      const parts = m[1].split('.');
+      if (!top.has(parts[0])) continue;
+      for (let n = parts.length; n >= 2; n--) {
+        const to = pyModule(parts.slice(0, n).join('.'), top.get(parts[0]));
+        if (to) { add(from, to, lineAt(body, m.index)); break; }
+      }
+    }
+  }
+}