swarmdo 1.18.0 → 1.27.0

package/v3/@swarmdo/cli/dist/src/commands/testreport.js

@@ -0,0 +1,120 @@
+/**
+ * `swarmdo testreport` — parse JUnit-XML / TAP results into a failure digest.
+ *
+ *   swarmdo testreport junit.xml           # human digest
+ *   swarmdo testreport ./reports           # scan a dir for *.xml/*.tap
+ *   vitest --reporter=junit | swarmdo testreport   # from stdin
+ *   swarmdo testreport junit.xml --format json     # machine output
+ *   swarmdo testreport junit.xml --ci              # exit 1 if any failed
+ *
+ * The front-half of the test→fix loop: turn raw results into exact failing
+ * test + file:line + message, then hand it to `repair`. Engine
+ * (../testreport/testreport.ts) is pure + tested; this reads files.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { output } from '../output.js';
+import { parseTestReport, detectFormat, mergeSummaries, formatSummary, } from '../testreport/testreport.js';
+function readStdin() {
+    return new Promise((resolve) => {
+        const chunks = [];
+        process.stdin.on('data', (c) => chunks.push(Buffer.from(c)));
+        process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        process.stdin.on('error', () => resolve(Buffer.concat(chunks).toString('utf8')));
+    });
+}
+/** Expand path args into a list of result files (dirs → their *.xml/*.tap). */
+function collectFiles(root, args) {
+    const files = [];
+    for (const a of args) {
+        const abs = path.resolve(root, a);
+        let st;
+        try {
+            st = fs.statSync(abs);
+        }
+        catch {
+            continue;
+        }
+        if (st.isDirectory()) {
+            for (const entry of fs.readdirSync(abs)) {
+                if (/\.(xml|tap)$/i.test(entry))
+                    files.push(path.join(abs, entry));
+            }
+        }
+        else {
+            files.push(abs);
+        }
+    }
+    return files;
+}
+function numFlag(v, def) {
+    const n = typeof v === 'number' ? v : typeof v === 'string' ? parseInt(v, 10) : NaN;
+    return Number.isFinite(n) ? n : def;
+}
+async function run(ctx) {
+    const root = ctx.cwd || process.cwd();
+    const asJson = ctx.flags.format === 'json';
+    const ci = ctx.flags.ci === true;
+    const top = numFlag(ctx.flags.top, 0);
+    // NB: --type, not --format (global --format is choices-validated to text|json|table).
+    const typeOverride = typeof ctx.flags.type === 'string' ? ctx.flags.type : undefined;
+    if (typeOverride && typeOverride !== 'junit' && typeOverride !== 'tap') {
+        output.printError(`unknown --type '${typeOverride}' (use junit|tap)`);
+        return { success: false, exitCode: 1 };
+    }
+    let summary;
+    if (ctx.args.length === 0) {
+        if (process.stdin.isTTY) {
+            output.writeln(output.error('Usage: swarmdo testreport <file|dir>   OR   <runner> | swarmdo testreport'));
+            return { success: false, exitCode: 1 };
+        }
+        const content = await readStdin();
+        const fmt = typeOverride ?? detectFormat(content);
+        summary = parseTestReport(content, fmt);
+    }
+    else {
+        const files = collectFiles(root, ctx.args);
+        if (files.length === 0) {
+            output.printError('no test-result files found (looked for *.xml / *.tap)');
+            return { success: false, exitCode: 1 };
+        }
+        const summaries = [];
+        for (const f of files) {
+            let content;
+            try {
+                content = fs.readFileSync(f, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            const fmt = typeOverride ?? detectFormat(content, f);
+            summaries.push(parseTestReport(content, fmt));
+        }
+        summary = mergeSummaries(summaries);
+    }
+    if (asJson) {
+        process.stdout.write(JSON.stringify(summary, null, 2) + '\n');
+    }
+    else {
+        output.writeln(formatSummary(summary, { top: top > 0 ? top : undefined }));
+    }
+    // A bail-out aborts the suite → results are incomplete → treat as failure in CI.
+    const code = ci && (summary.failed > 0 || summary.bailedOut) ? 1 : 0;
+    return { success: code === 0, exitCode: code };
+}
+export const testreportCommand = {
+    name: 'testreport',
+    description: 'Parse JUnit-XML / TAP test results into a compact failure digest (test name + file:line + message) — the front-half of the test→fix loop',
+    options: [
+        { name: 'type', description: 'force input format: junit|tap (default: auto-detect)', type: 'string' },
+        { name: 'top', description: 'show only the first N failures', type: 'string' },
+        { name: 'ci', description: 'exit 1 if any test failed', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo testreport junit.xml', description: 'Digest a JUnit report' },
+        { command: 'vitest --reporter=junit | swarmdo testreport --ci', description: 'Parse from stdin, fail on any failure' },
+    ],
+    action: run,
+};
+export default testreportCommand;
+//# sourceMappingURL=testreport.js.map

package/v3/@swarmdo/cli/dist/src/cycles/cycles.d.ts

@@ -12,8 +12,18 @@
  * The index load lives in ../commands/cycles.ts, so this is fixture-testable.
  */
 import type { CodeIndex } from '../codegraph/codegraph.js';
+export interface CycleOptions {
+    /**
+     * Include TypeScript `import type`/`export type` edges. They erase at compile
+     * time so a type-only "cycle" causes none of the runtime bugs this detector
+     * exists to catch — excluded by DEFAULT to avoid false positives. Set true for
+     * a strict structural view. An edge counts as a runtime edge if ANY import
+     * between the two files is a value import (mixed imports keep the edge).
+     */
+    includeTypeOnly?: boolean;
+}
 /** Build file → sorted list of internal (resolved) imports. Pure. */
-export declare function buildAdjacency(index: CodeIndex): Map<string, string[]>;
+export declare function buildAdjacency(index: CodeIndex, opts?: CycleOptions): Map<string, string[]>;
 /**
  * Tarjan's SCC. Returns every strongly-connected component as a member list.
  * Iterative (no recursion) so deep graphs don't overflow the stack. Deterministic:
@@ -31,7 +41,7 @@ export interface CycleResult {
  * it has ≥2 files (mutual reachability) or a single file with a self-edge.
  * Deterministic: groups sorted by size desc then first member.
  */
-export declare function findCycles(index: CodeIndex): CycleResult;
+export declare function findCycles(index: CodeIndex, opts?: CycleOptions): CycleResult;
 /** Human-readable summary. Pure. */
 export declare function formatCycles(res: CycleResult): string;
 //# sourceMappingURL=cycles.d.ts.map

package/v3/@swarmdo/cli/dist/src/cycles/cycles.js

@@ -12,7 +12,7 @@
  * The index load lives in ../commands/cycles.ts, so this is fixture-testable.
  */
 /** Build file → sorted list of internal (resolved) imports. Pure. */
-export function buildAdjacency(index) {
+export function buildAdjacency(index, opts = {}) {
     const adj = new Map();
     const ensure = (f) => {
         let l = adj.get(f);
@@ -25,6 +25,8 @@ export function buildAdjacency(index) {
     for (const e of index.imports) {
         if (!e.resolved)
             continue; // external — not part of internal cycles
+        if (e.isTypeOnly && !opts.includeTypeOnly)
+            continue; // type-only → no runtime edge
         const l = ensure(e.from);
         if (!l.includes(e.resolved))
             l.push(e.resolved);
@@ -101,8 +103,8 @@ export function stronglyConnectedComponents(adj) {
  * it has ≥2 files (mutual reachability) or a single file with a self-edge.
  * Deterministic: groups sorted by size desc then first member.
  */
-export function findCycles(index) {
-    const adj = buildAdjacency(index);
+export function findCycles(index, opts = {}) {
+    const adj = buildAdjacency(index, opts);
     const selfLoops = [];
     for (const [from, tos] of adj)
         if (tos.includes(from))

package/v3/@swarmdo/cli/dist/src/env/env.d.ts

@@ -29,8 +29,11 @@ export interface EnvReport {
 export declare function extractEnvRefs(source: string, file: string): EnvRef[];
 /**
  * Parse a `.env` file into an ordered list of declared keys. Handles `KEY=val`,
- * `export KEY=val`, quoted values, `# comments`, and blank lines. Values are
- * ignored — we only reconcile key presence. Pure.
+ * `export KEY=val`, quoted values, `# comments`, and blank lines. The key
+ * charset + `:` separator mirror the reference `dotenv` package's grammar
+ * (`[\w.-]+` with `=` or `: ` as separator), so dotted/hyphenated keys like
+ * `APP.NAME` aren't silently dropped. Values are ignored — we only reconcile
+ * key presence. Pure.
  */
 export declare function parseDotenv(text: string): string[];
 export interface ReconcileInput {

package/v3/@swarmdo/cli/dist/src/env/env.js

@@ -28,6 +28,8 @@ const REF_PATTERNS = [
     /os\.environ\.get\(\s*['"]([^'"]+)['"]\s*\)/g,
     /os\.getenv\(\s*['"]([^'"]+)['"]\s*\)/g,
 ];
+/** `const { A, B } = process.env` — the brace body (group 1) holds one or more refs. */
+const DESTRUCTURE_RE = /\{\s*([^}]+)\}\s*=\s*process\.env\b(?![.[])/g;
 /** Non-secret prefixes on `import.meta.env` that are Vite builtins, not user vars. */
 const VITE_BUILTINS = new Set(['MODE', 'BASE_URL', 'PROD', 'DEV', 'SSR']);
 /** Extract env-var references from one source file. Pure. */
@@ -48,13 +50,32 @@ export function extractEnvRefs(source, file) {
                 out.push({ key, file, line: i + 1 });
             }
         }
+        // Destructuring reads: `const { PORT, DB_URL } = process.env` (each property
+        // key is an env-var reference). The `(?![.[])` guard keeps it to the bare
+        // `process.env` object, not `= process.env.FOO`. Single-line, like the rest.
+        DESTRUCTURE_RE.lastIndex = 0;
+        let dm;
+        while ((dm = DESTRUCTURE_RE.exec(line)) !== null) {
+            for (const part of dm[1].split(',')) {
+                // The env-var name is the property key — left of a rename `:` or default `=`.
+                const key = part.trim().split(/[:=]/)[0].trim();
+                if (!/^[A-Za-z_$][\w$]*$/.test(key))
+                    continue; // skip `...rest`, empties
+                if (VITE_BUILTINS.has(key))
+                    continue;
+                out.push({ key, file, line: i + 1 });
+            }
+        }
     }
     return out;
 }
 /**
  * Parse a `.env` file into an ordered list of declared keys. Handles `KEY=val`,
- * `export KEY=val`, quoted values, `# comments`, and blank lines. Values are
- * ignored — we only reconcile key presence. Pure.
+ * `export KEY=val`, quoted values, `# comments`, and blank lines. The key
+ * charset + `:` separator mirror the reference `dotenv` package's grammar
+ * (`[\w.-]+` with `=` or `: ` as separator), so dotted/hyphenated keys like
+ * `APP.NAME` aren't silently dropped. Values are ignored — we only reconcile
+ * key presence. Pure.
  */
 export function parseDotenv(text) {
     const keys = [];
@@ -63,7 +84,7 @@ export function parseDotenv(text) {
         const line = raw.trim();
         if (!line || line.startsWith('#'))
             continue;
-        const m = line.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        const m = line.match(/^(?:export\s+)?([\w.-]+)(?:\s*=|:\s)/);
         if (!m)
             continue;
         if (seen.has(m[1]))

package/v3/@swarmdo/cli/dist/src/hotspots/hotspots.d.ts

@@ -45,6 +45,21 @@ export interface HotspotOptions {
     /** keep only the top N after sorting (default: all) */
     top?: number;
 }
+/**
+ * Resolve git's rename/copy numstat notation to the file's CURRENT (new) path.
+ *
+ * When rename/copy detection fires (git's default for merges, and often
+ * otherwise), `--numstat` doesn't emit a plain path. It emits either the
+ * compact braces form with a shared prefix/suffix around the changed run:
+ *   `src/{old => new}/file.ts`   ·   `{old => new}/file.ts`   ·   `dir/{old => }/f`
+ * or, when there's no shared prefix/suffix, the full form:
+ *   `old/path.ts => new/path.ts`
+ *
+ * We attribute churn to the file's current identity (the NEW path) so a renamed
+ * file's history folds into one entry instead of splitting across two phantom
+ * names. Plain paths pass through untouched. Pure — no git call.
+ */
+export declare function resolveRenamePath(raw: string): string;
 /** Parse a control-char-delimited `git log --numstat` dump into commits. Pure. */
 export declare function parseGitLog(raw: string): Commit[];
 /** Aggregate commits into per-file hotspots, scored and ranked. Pure. */

package/v3/@swarmdo/cli/dist/src/hotspots/hotspots.js

@@ -17,6 +17,38 @@
  */
 const SOH = '\x01'; // start-of-commit marker (git --format=format:%x01...)
 const US = '\x1f'; // field separator (%x1f)
+/**
+ * Resolve git's rename/copy numstat notation to the file's CURRENT (new) path.
+ *
+ * When rename/copy detection fires (git's default for merges, and often
+ * otherwise), `--numstat` doesn't emit a plain path. It emits either the
+ * compact braces form with a shared prefix/suffix around the changed run:
+ *   `src/{old => new}/file.ts`   ·   `{old => new}/file.ts`   ·   `dir/{old => }/f`
+ * or, when there's no shared prefix/suffix, the full form:
+ *   `old/path.ts => new/path.ts`
+ *
+ * We attribute churn to the file's current identity (the NEW path) so a renamed
+ * file's history folds into one entry instead of splitting across two phantom
+ * names. Plain paths pass through untouched. Pure — no git call.
+ */
+export function resolveRenamePath(raw) {
+    const open = raw.indexOf('{');
+    if (open >= 0) {
+        const arrow = raw.indexOf(' => ', open);
+        const close = arrow >= 0 ? raw.indexOf('}', arrow) : -1;
+        if (arrow >= 0 && close >= 0) {
+            const prefix = raw.slice(0, open);
+            const newPart = raw.slice(arrow + 4, close);
+            const suffix = raw.slice(close + 1);
+            // Collapse the empty-side double slash (e.g. `dir/{old => }/f` → `dir/f`).
+            return (prefix + newPart + suffix).replace(/\/{2,}/g, '/');
+        }
+    }
+    const arrow = raw.indexOf(' => ');
+    if (arrow >= 0)
+        return raw.slice(arrow + 4);
+    return raw;
+}
 /** Parse a control-char-delimited `git log --numstat` dump into commits. Pure. */
 export function parseGitLog(raw) {
     const commits = [];
@@ -40,7 +72,7 @@ export function parseGitLog(raw) {
             continue;
         const a = line.slice(0, tab1);
         const d = line.slice(tab1 + 1, tab2);
-        const path = line.slice(tab2 + 1);
+        const path = resolveRenamePath(line.slice(tab2 + 1));
         if (!path)
             continue;
         cur.files.push({ path, added: a === '-' ? 0 : parseInt(a, 10) || 0, deleted: d === '-' ? 0 : parseInt(d, 10) || 0 });

package/v3/@swarmdo/cli/dist/src/license/license.d.ts

@@ -38,7 +38,8 @@ export interface LicenseReport {
 /**
  * Normalize a package.json `license`/`licenses` field to an SPDX string.
  * Handles the modern string, the legacy `{type}` object, and the legacy
- * `licenses: [{type}]` array (→ `A OR B`). Missing → 'UNKNOWN'.
+ * `licenses: [{type}]` array (→ `A OR B`). npm special values and a missing
+ * field → 'UNKNOWN'.
  */
 export declare function classifyLicense(pkg: {
     license?: unknown;
@@ -46,7 +47,35 @@ export declare function classifyLicense(pkg: {
 }): string;
 /** Split an SPDX expression into its atomic license ids (strips OR/AND/WITH/parens/+). */
 export declare function spdxComponents(expr: string): string[];
-/** Evaluate one dep against the policy; null if it passes. Pure. */
+/**
+ * Parse an SPDX license expression into DISJUNCTIVE NORMAL FORM: a list of
+ * conjunctive terms, each a set of license ids. `A OR (B AND C)` →
+ * `[['A'], ['B','C']]`. Precedence per the SPDX spec (Annex D): `WITH` binds
+ * tighter than `AND`, `AND` tighter than `OR`; parentheses override.
+ *
+ * Each DNF term is a set of licenses that ALL apply simultaneously (the AND
+ * conjunction); the terms are the mutually-exclusive CHOICES (the OR). A policy
+ * is satisfied iff SOME term is acceptable — the semantics `evaluateDep` needs.
+ * `A WITH B` contributes the base license `A` (exceptions aren't standalone
+ * licenses in allow/deny lists). Trailing `+` is stripped. Pure.
+ */
+export declare function parseSpdxDnf(expr: string): string[][];
+/**
+ * Expand a license id to the set of ids it should match for policy comparison.
+ * A DEPRECATED bare GNU id is ambiguous (only? or-later?), so it matches either
+ * suffixed form; the suffixed forms stay exact, so `-only` and `-or-later` never
+ * match each other directly. Trailing `+` is treated as `-or-later`. Pure.
+ */
+export declare function expandLicenseId(id: string): string[];
+/**
+ * Evaluate one dep against the policy; null if it passes. Pure.
+ *
+ * SPDX-aware: a dep is acceptable iff SOME DNF term (a lawful realization of the
+ * license) violates nothing — every license in that term is un-denied and (under
+ * an allowlist) allowed. So `(MIT OR GPL-3.0)` with `deny:[GPL-3.0]` PASSES (take
+ * MIT), while `MIT AND GPL-3.0` under `allow:[MIT]` FAILS (GPL-3.0 also applies).
+ * Deprecated bare GNU ids (`GPL-2.0`) match either suffixed policy form.
+ */
 export declare function evaluateDep(dep: DepLicense, policy: LicensePolicy): Violation | null;
 /** Audit a dependency set against a policy. Pure. */
 export declare function auditLicenses(deps: DepLicense[], policy?: LicensePolicy): LicenseReport;

package/v3/@swarmdo/cli/dist/src/license/license.js

@@ -8,17 +8,32 @@
  * {name, version, license} plus a policy and returns violations. The fs walk
  * over node_modules lives in ../commands/license.ts.
  */
+/**
+ * npm's documented non-SPDX license sentinels → 'UNKNOWN' (needs human review).
+ * `SEE LICENSE IN <file>` (custom license) and `UNLICENSED` (proprietary) are
+ * NOT SPDX ids; left as-is they'd be tokenized by parseSpdxDnf into a garbage
+ * atom (`"SEE"`), giving a misleading policy verdict. Pure.
+ */
+function normalizeNpmLicense(s) {
+    const t = s.trim();
+    if (!t)
+        return 'UNKNOWN';
+    if (/^SEE LICENSE IN\b/i.test(t) || /^UNLICENSED$/i.test(t))
+        return 'UNKNOWN';
+    return t;
+}
 /**
  * Normalize a package.json `license`/`licenses` field to an SPDX string.
  * Handles the modern string, the legacy `{type}` object, and the legacy
- * `licenses: [{type}]` array (→ `A OR B`). Missing → 'UNKNOWN'.
+ * `licenses: [{type}]` array (→ `A OR B`). npm special values and a missing
+ * field → 'UNKNOWN'.
  */
 export function classifyLicense(pkg) {
     const l = pkg.license;
     if (typeof l === 'string' && l.trim())
-        return l.trim();
+        return normalizeNpmLicense(l);
     if (l && typeof l === 'object' && typeof l.type === 'string') {
-        return l.type.trim() || 'UNKNOWN';
+        return normalizeNpmLicense(l.type);
     }
     const arr = pkg.licenses;
     if (Array.isArray(arr) && arr.length) {
@@ -38,22 +53,129 @@ export function spdxComponents(expr) {
         .map((s) => s.trim().replace(/\+$/, ''))
         .filter(Boolean);
 }
-/** Evaluate one dep against the policy; null if it passes. Pure. */
+/**
+ * Parse an SPDX license expression into DISJUNCTIVE NORMAL FORM: a list of
+ * conjunctive terms, each a set of license ids. `A OR (B AND C)` →
+ * `[['A'], ['B','C']]`. Precedence per the SPDX spec (Annex D): `WITH` binds
+ * tighter than `AND`, `AND` tighter than `OR`; parentheses override.
+ *
+ * Each DNF term is a set of licenses that ALL apply simultaneously (the AND
+ * conjunction); the terms are the mutually-exclusive CHOICES (the OR). A policy
+ * is satisfied iff SOME term is acceptable — the semantics `evaluateDep` needs.
+ * `A WITH B` contributes the base license `A` (exceptions aren't standalone
+ * licenses in allow/deny lists). Trailing `+` is stripped. Pure.
+ */
+export function parseSpdxDnf(expr) {
+    const tokens = expr.replace(/([()])/g, ' $1 ').split(/\s+/).filter(Boolean);
+    let pos = 0;
+    const peek = () => tokens[pos];
+    const isOp = (t, op) => !!t && t.toUpperCase() === op;
+    // expr := term (OR term)*  → concatenate the alternatives
+    const parseExpr = () => {
+        let terms = parseTerm();
+        while (isOp(peek(), 'OR')) {
+            pos++;
+            terms = terms.concat(parseTerm());
+        }
+        return terms;
+    };
+    // term := factor (AND factor)*  → cartesian union of the conjuncts
+    const parseTerm = () => {
+        let left = parseFactor();
+        while (isOp(peek(), 'AND')) {
+            pos++;
+            const right = parseFactor();
+            const merged = [];
+            for (const a of left)
+                for (const b of right)
+                    merged.push([...new Set([...a, ...b])]);
+            left = merged;
+        }
+        return left;
+    };
+    // factor := '(' expr ')' | license [WITH exception]
+    const parseFactor = () => {
+        if (peek() === '(') {
+            pos++;
+            const inner = parseExpr();
+            if (peek() === ')')
+                pos++;
+            return inner;
+        }
+        const lic = (tokens[pos++] ?? '').replace(/\+$/, '');
+        if (isOp(peek(), 'WITH')) {
+            pos++;
+            pos++;
+        } // consume `WITH <exception>` — base license only
+        return lic ? [[lic]] : [[]];
+    };
+    const dnf = parseExpr();
+    // Fall back to treating the whole string as one atomic license if parse yielded nothing.
+    return dnf.length && dnf.some((t) => t.length) ? dnf : [[expr.trim()]];
+}
+/**
+ * SPDX 3.0 deprecated the bare GNU-family ids in favor of explicit `-only` /
+ * `-or-later` variants, but npm packages still declare the bare form en masse.
+ */
+const DEPRECATED_GNU_BARE = new Set([
+    'GPL-1.0', 'GPL-2.0', 'GPL-3.0',
+    'LGPL-2.0', 'LGPL-2.1', 'LGPL-3.0',
+    'AGPL-1.0', 'AGPL-3.0',
+    'GFDL-1.1', 'GFDL-1.2', 'GFDL-1.3',
+]);
+/**
+ * Expand a license id to the set of ids it should match for policy comparison.
+ * A DEPRECATED bare GNU id is ambiguous (only? or-later?), so it matches either
+ * suffixed form; the suffixed forms stay exact, so `-only` and `-or-later` never
+ * match each other directly. Trailing `+` is treated as `-or-later`. Pure.
+ */
+export function expandLicenseId(id) {
+    if (DEPRECATED_GNU_BARE.has(id))
+        return [id, `${id}-only`, `${id}-or-later`];
+    const plus = id.replace(/\+$/, '');
+    if (id.endsWith('+') && DEPRECATED_GNU_BARE.has(plus))
+        return [id, `${plus}-or-later`];
+    return [id];
+}
+/** Membership test aware of deprecated-bare-id aliases (both sides expanded). */
+function inPolicySet(c, expandedPolicy) {
+    return expandLicenseId(c).some((e) => expandedPolicy.has(e));
+}
+function expandPolicy(ids) {
+    const out = new Set();
+    for (const id of ids ?? [])
+        for (const e of expandLicenseId(id))
+            out.add(e);
+    return out;
+}
+/**
+ * Evaluate one dep against the policy; null if it passes. Pure.
+ *
+ * SPDX-aware: a dep is acceptable iff SOME DNF term (a lawful realization of the
+ * license) violates nothing — every license in that term is un-denied and (under
+ * an allowlist) allowed. So `(MIT OR GPL-3.0)` with `deny:[GPL-3.0]` PASSES (take
+ * MIT), while `MIT AND GPL-3.0` under `allow:[MIT]` FAILS (GPL-3.0 also applies).
+ * Deprecated bare GNU ids (`GPL-2.0`) match either suffixed policy form.
+ */
 export function evaluateDep(dep, policy) {
-    const allow = new Set(policy.allow ?? []);
-    const deny = new Set(policy.deny ?? []);
+    const allow = expandPolicy(policy.allow);
+    const deny = expandPolicy(policy.deny);
     const isUnknown = dep.license === 'UNKNOWN' || !dep.license;
-    const components = isUnknown ? [] : spdxComponents(dep.license);
-    if (components.some((c) => deny.has(c))) {
-        return { name: dep.name, version: dep.version, license: dep.license, reason: 'denied' };
-    }
     if (isUnknown) {
         if (allow.size > 0 && !policy.allowUnknown) {
             return { name: dep.name, version: dep.version, license: 'UNKNOWN', reason: 'unknown' };
         }
         return null;
     }
-    if (allow.size > 0 && !components.some((c) => allow.has(c))) {
+    const terms = parseSpdxDnf(dep.license);
+    // Terms that avoid every denied license (a realization the consumer may choose).
+    const undenied = terms.filter((t) => !t.some((c) => inPolicySet(c, deny)));
+    if (undenied.length === 0) {
+        // No lawful realization avoids a denied license → genuinely denied.
+        return { name: dep.name, version: dep.version, license: dep.license, reason: 'denied' };
+    }
+    if (allow.size > 0 && !undenied.some((t) => t.every((c) => inPolicySet(c, allow)))) {
+        // A denylist is satisfiable, but no un-denied realization is fully allowed.
         return { name: dep.name, version: dep.version, license: dep.license, reason: 'not-allowed' };
     }
     return null;

package/v3/@swarmdo/cli/dist/src/mcp-client.js

@@ -27,6 +27,7 @@ import { applyTools } from './mcp-tools/apply-tools.js';
 import { hotspotsTools } from './mcp-tools/hotspots-tools.js';
 import { affectedTools } from './mcp-tools/affected-tools.js';
 import { cyclesTools } from './mcp-tools/cycles-tools.js';
+import { testreportTools } from './mcp-tools/testreport-tools.js';
 import { progressTools } from './mcp-tools/progress-tools.js';
 import { embeddingsTools } from './mcp-tools/embeddings-tools.js';
 import { claimsTools } from './mcp-tools/claims-tools.js';
@@ -118,6 +119,7 @@ const TOOL_GROUPS = {
     hotspots: () => hotspotsTools,
     affected: () => affectedTools,
     cycles: () => cyclesTools,
+    testreport: () => testreportTools,
     progress: () => progressTools,
     embeddings: () => embeddingsTools,
     claims: () => claimsTools,

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.d.ts

@@ -23,6 +23,7 @@ export { applyTools } from './apply-tools.js';
 export { hotspotsTools } from './hotspots-tools.js';
 export { affectedTools } from './affected-tools.js';
 export { cyclesTools } from './cycles-tools.js';
+export { testreportTools } from './testreport-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.js

@@ -22,6 +22,7 @@ export { applyTools } from './apply-tools.js';
 export { hotspotsTools } from './hotspots-tools.js';
 export { affectedTools } from './affected-tools.js';
 export { cyclesTools } from './cycles-tools.js';
+export { testreportTools } from './testreport-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/profiles.js

@@ -29,6 +29,7 @@ const LEAN_GROUPS = [
     'hotspots', // hotspots — git-history change-risk ranking ("where's the debt?")
     'affected', // affected — impacted files/tests from a change via the import graph
     'cycles', // cycles — circular-import detection via the import graph
+    'testreport', // testreport — JUnit/TAP → structured failure digest (pairs w/ repair)
 ];
 /** Balanced = lean + orchestration/session/system the average user reaches for. */
 const BALANCED_EXTRA = [

package/v3/@swarmdo/cli/dist/src/mcp-tools/testreport-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Testreport MCP Tool
+ *
+ * Let an agent turn raw JUnit/TAP test output into a structured failure digest —
+ * exact failing test + file:line + message — instead of re-reading hundreds of
+ * log lines. The front-half of the test→fix loop: pair with `repair`. Shares the
+ * pure parser in ../testreport/testreport.ts with the CLI; string-in/JSON-out.
+ */
+import type { MCPTool } from './types.js';
+export declare const testreportTools: MCPTool[];
+//# sourceMappingURL=testreport-tools.d.ts.map

package/v3/@swarmdo/cli/dist/src/mcp-tools/testreport-tools.js

@@ -0,0 +1,33 @@
+/**
+ * Testreport MCP Tool
+ *
+ * Let an agent turn raw JUnit/TAP test output into a structured failure digest —
+ * exact failing test + file:line + message — instead of re-reading hundreds of
+ * log lines. The front-half of the test→fix loop: pair with `repair`. Shares the
+ * pure parser in ../testreport/testreport.ts with the CLI; string-in/JSON-out.
+ */
+import { parseTestReport, detectFormat } from '../testreport/testreport.js';
+const testreportTool = {
+    name: 'testreport',
+    description: 'Parse JUnit-XML or TAP test output into a structured summary: {passed, failed, skipped, total, durationMs, failures:[{suite,name,file,line,message}]}. Call this on a results file/string to get the exact failing tests + file:line instead of scanning logs; feed the failures into `repair`. Deterministic; auto-detects the format.',
+    category: 'testreport',
+    tags: ['tests', 'junit', 'tap', 'ci', 'failures'],
+    inputSchema: {
+        type: 'object',
+        properties: {
+            content: { type: 'string', description: 'the raw JUnit XML or TAP text' },
+            format: { type: 'string', enum: ['junit', 'tap'], description: 'force the input format (default: auto-detect)' },
+        },
+        required: ['content'],
+    },
+    handler: async (params) => {
+        if (typeof params.content !== 'string')
+            return { error: true, message: 'content (string) is required' };
+        const fmt = params.format === 'junit' || params.format === 'tap'
+            ? params.format
+            : detectFormat(params.content);
+        return { format: fmt, ...parseTestReport(params.content, fmt) };
+    },
+};
+export const testreportTools = [testreportTool];
+//# sourceMappingURL=testreport-tools.js.map

package/v3/@swarmdo/cli/dist/src/pack/pack.d.ts

@@ -51,9 +51,8 @@ export declare function buildTree(paths: string[]): string;
 export declare function packFiles(input: PackFile[], opts?: PackOptions): PackResult;
 /**
  * Minimal .gitignore-style matcher. Handles the common cases — plain names,
- * `dir/`, `*.ext` globs, leading `/` anchors, and `!` negation — not the full
- * spec (no `**` depth semantics beyond substring, no nested ignore files).
- * Good enough to keep obvious noise out; full semantics is a follow-up.
+ * `dir/`, `*.ext` globs, `**` depth globs (gitignore(5) semantics), leading `/`
+ * anchors, and `!` negation. Not the full spec (no nested ignore files).
  */
 export declare function makeIgnoreMatcher(patterns: string[]): (relPath: string) => boolean;
 //# sourceMappingURL=pack.d.ts.map