weavatrix 0.1.0 → 0.1.2

package/src/analysis/duplicates.run.js

@@ -1,51 +1,52 @@
-// duplicates.run.js — the repos:duplicates entry point (split from duplicates.js): worker-thread
-// offload with in-process fallback, cached per (repo, graph.json mtime).
-import { existsSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { Worker } from "node:worker_threads";
-import { graphOutDirForRepo } from "../graph/layout.js";
-import { computeDuplicates } from "./duplicates.compute.js";
-
-function computeInWorker(repoPath, graphJsonPath) {
-  return new Promise((resolve, reject) => {
-    let worker;
-    try {
-      worker = new Worker(new URL("./duplicates-worker.js", import.meta.url), { workerData: { repoPath, graphJsonPath } });
-    } catch (e) {
-      reject(Object.assign(e, { workerStartFailed: true }));
-      return;
-    }
-    let settled = false;
-    const done = (fn, v) => { if (!settled) { settled = true; fn(v); } };
-    worker.once("message", (msg) => done(resolve, msg));
-    worker.once("error", (e) => done(reject, Object.assign(e, { workerStartFailed: true })));
-    worker.once("exit", (code) => { if (code !== 0) done(reject, Object.assign(new Error(`duplicates worker exited with code ${code}`), { workerStartFailed: true })); });
-  });
-}
-
-// repos:duplicates entry — cached per (repo, graph.json mtime): re-running with an unchanged graph is
-// free. `force` (the UI's ↻ rescan) bypasses the cache: fragment BODIES are read from live source, so a
-// source edit that didn't rebuild the graph (same mtime) must still be re-scanned on demand.
-const _cache = new Map();
-export async function runDuplicates(repoPath, force = false) {
-  const repo = String(repoPath || "");
-  if (!repo || !existsSync(repo)) return { ok: false, error: "Repo path not found" };
-  const graphJsonPath = join(graphOutDirForRepo(repo), "graph.json");
-  if (!existsSync(graphJsonPath)) {
-    return { ok: false, needsGraph: true, error: "No graph yet — build the Relations graph first (↻ on the Relations tab)" };
-  }
-  let mtime = 0;
-  try { mtime = statSync(graphJsonPath).mtimeMs; } catch { /* treat as uncached */ }
-  const cached = _cache.get(repo);
-  if (!force && cached && cached.mtime === mtime) return cached.result;
-  let result;
-  try {
-    result = await computeInWorker(repo, graphJsonPath);
-  } catch (e) {
-    if (!e || !e.workerStartFailed) return { ok: false, error: e.message || String(e) };
-    try { result = computeDuplicates(repo, graphJsonPath); } // in-process fallback (exotic packaging)
-    catch (e2) { return { ok: false, error: e2.message || String(e2) }; }
-  }
-  if (result && result.ok) _cache.set(repo, { mtime, result });
-  return result;
-}
+// duplicates.run.js — the repos:duplicates entry point (split from duplicates.js): worker-thread
+// offload with in-process fallback, cached per (repo, graph.json mtime).
+import { existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { Worker } from "node:worker_threads";
+import { childProcessEnv } from "../child-env.js";
+import { graphOutDirForRepo } from "../graph/layout.js";
+import { computeDuplicates } from "./duplicates.compute.js";
+
+function computeInWorker(repoPath, graphJsonPath) {
+  return new Promise((resolve, reject) => {
+    let worker;
+    try {
+      worker = new Worker(new URL("./duplicates-worker.js", import.meta.url), { workerData: { repoPath, graphJsonPath }, env: childProcessEnv() });
+    } catch (e) {
+      reject(Object.assign(e, { workerStartFailed: true }));
+      return;
+    }
+    let settled = false;
+    const done = (fn, v) => { if (!settled) { settled = true; fn(v); } };
+    worker.once("message", (msg) => done(resolve, msg));
+    worker.once("error", (e) => done(reject, Object.assign(e, { workerStartFailed: true })));
+    worker.once("exit", (code) => { if (code !== 0) done(reject, Object.assign(new Error(`duplicates worker exited with code ${code}`), { workerStartFailed: true })); });
+  });
+}
+
+// repos:duplicates entry — cached per (repo, graph.json mtime): re-running with an unchanged graph is
+// free. `force` (the UI's ↻ rescan) bypasses the cache: fragment BODIES are read from live source, so a
+// source edit that didn't rebuild the graph (same mtime) must still be re-scanned on demand.
+const _cache = new Map();
+export async function runDuplicates(repoPath, force = false) {
+  const repo = String(repoPath || "");
+  if (!repo || !existsSync(repo)) return { ok: false, error: "Repo path not found" };
+  const graphJsonPath = join(graphOutDirForRepo(repo), "graph.json");
+  if (!existsSync(graphJsonPath)) {
+    return { ok: false, needsGraph: true, error: "No graph yet — build the Relations graph first (↻ on the Relations tab)" };
+  }
+  let mtime = 0;
+  try { mtime = statSync(graphJsonPath).mtimeMs; } catch { /* treat as uncached */ }
+  const cached = _cache.get(repo);
+  if (!force && cached && cached.mtime === mtime) return cached.result;
+  let result;
+  try {
+    result = await computeInWorker(repo, graphJsonPath);
+  } catch (e) {
+    if (!e || !e.workerStartFailed) return { ok: false, error: e.message || String(e) };
+    try { result = computeDuplicates(repo, graphJsonPath); } // in-process fallback (exotic packaging)
+    catch (e2) { return { ok: false, error: e2.message || String(e2) }; }
+  }
+  if (result && result.ok) _cache.set(repo, { mtime, result });
+  return result;
+}

package/src/analysis/duplicates.tokenize.js

@@ -1,182 +1,182 @@
-// duplicates.tokenize.js — lexical layer of the clone detector (split from duplicates.js): comment &
-// string stripping, body-end detection, strict/renamed tokenization, and winnowing fingerprints.
-
-const K = 8;               // k-gram length (tokens)
-const W = 4;               // winnowing window → guaranteed detection of matches ≥ K+W-1 tokens
-const STRLIT = String.fromCharCode(0); // opaque-literal sentinel for every string/regex body: a NUL
-                           // its own class (never an identifier "I" nor a number "N"), so a literal can
-                           // never masquerade as code in either mode
-
-const KEYWORDS = new Set(("if else for while do switch case break continue return function const let var new class extends async await try catch finally throw import from export default typeof instanceof in of delete void yield static get set this super null undefined true false def elif except lambda pass raise with as is not and or None True False func go defer chan map range struct interface type package nil err string int bool byte float64 public private protected final void long double boolean").split(" "));
-
-// A leading `/` is a REGEX literal (not division) when the previous significant char is one of these
-// or the fragment start; after a word char / ) / ] it is division. Covers .match(/…/), = /…/, (/…/),
-// and arrow `x => /…/`. NOTE: `+` and `-` are deliberately EXCLUDED — a regex never legitimately
-// follows them, but `i++ / 2` and `a - b / c` do, and including them mis-scanned the division as a
-// regex and ate the rest of the line.
-const REGEX_PREV = new Set("(,=:[!&|?{};~*%^<>".split(""));
-
-// Replace comments with nothing and string/regex BODIES with the sentinel, so their contents never
-// count as code. Handles Python triple-quoted docstrings (embedded quotes no longer desync the scan)
-// and JS regex literals (a quote inside /['"]/ no longer opens a phantom string).
-export function stripNonCode(text, py) {
-  let out = "", i = 0, prevSig = "";
-  const s = String(text || "");
-  const push = (c) => { out += c; const t = c.trim(); if (t) prevSig = t[t.length - 1]; };
-  while (i < s.length) {
-    const ch = s[i], two = s.slice(i, i + 2), three = s.slice(i, i + 3);
-    if (py && ch === "#") { while (i < s.length && s[i] !== "\n") i++; continue; }
-    if (py && (three === "'''" || three === '"""')) {
-      i += 3;
-      while (i < s.length && s.slice(i, i + 3) !== three) i++;
-      i += 3; push(` ${STRLIT} `); continue;
-    }
-    if (!py && two === "//") { while (i < s.length && s[i] !== "\n") i++; continue; }
-    if (!py && two === "/*") { i += 2; while (i < s.length && s.slice(i, i + 2) !== "*/") i++; i += 2; continue; }
-    if (!py && ch === "/" && REGEX_PREV.has(prevSig)) {
-      i++; let inClass = false; // '/' inside a [...] char class is literal, not the terminator
-      while (i < s.length && s[i] !== "\n") {
-        const c = s[i];
-        if (c === "\\") { i += 2; continue; }
-        if (c === "[") inClass = true;
-        else if (c === "]") inClass = false;
-        else if (c === "/" && !inClass) { i++; break; }
-        i++;
-      }
-      while (i < s.length && /[a-z]/i.test(s[i])) i++; // regex flags (gimsuy)
-      push(` ${STRLIT} `); continue;
-    }
-    if (ch === '"' || ch === "'" || ch === "`") {
-      const q = ch; i++;
-      while (i < s.length && s[i] !== q) { if (s[i] === "\\") i++; i++; }
-      i++; push(` ${STRLIT} `); continue;
-    }
-    push(ch); i++;
-  }
-  return out;
-}
-
-// Where a symbol's body ends — so the LAST symbol in a file doesn't swallow trailing module-level code
-// (module.exports tables, main() calls, handler registrations) up to EOF and dilute/misattribute
-// clones. Brace/bracket depth for brace langs (body ends when {}()[] balance after first opening);
-// indentation for Python. Returns a 1-based line count within bodyLines (≤ its length; = its length
-// when the construct never closes, so the caller's cap stands).
-export function bodyEndLineCount(bodyLines, py) {
-  if (py) {
-    const base = bodyLines[0].match(/^[ \t]*/)[0].length;
-    let last = 1;
-    for (let k = 1; k < bodyLines.length; k++) {
-      const ln = bodyLines[k];
-      if (!ln.trim()) continue; // blank lines never end a block
-      if (ln.match(/^[ \t]*/)[0].length <= base) return last; // dedent to ≤ the def → body ended above
-      last = k + 1;
-    }
-    return bodyLines.length;
-  }
-  const text = bodyLines.join("\n");
-  let depth = 0, opened = false, i = 0, line = 1, prevSig = "";
-  while (i < text.length) {
-    const ch = text[i], two = text.slice(i, i + 2);
-    if (ch === "\n") { line++; i++; continue; }
-    if (two === "//") { while (i < text.length && text[i] !== "\n") i++; continue; }
-    if (two === "/*") { i += 2; while (i < text.length && text.slice(i, i + 2) !== "*/") { if (text[i] === "\n") line++; i++; } i += 2; continue; }
-    if (ch === "/" && REGEX_PREV.has(prevSig)) {
-      i++; let inClass = false;
-      while (i < text.length && text[i] !== "\n") { const c = text[i]; if (c === "\\") { i += 2; continue; } if (c === "[") inClass = true; else if (c === "]") inClass = false; else if (c === "/" && !inClass) { i++; break; } i++; }
-      prevSig = "/"; continue;
-    }
-    if (ch === '"' || ch === "'" || ch === "`") { const q = ch; i++; while (i < text.length && text[i] !== q) { if (text[i] === "\\") i++; else if (text[i] === "\n") line++; i++; } i++; prevSig = q; continue; }
-    // depth tracks all brackets, but only a { or [ opens the BODY — a bare (param list) returning to
-    // depth 0 must not be read as the construct closing on line 1
-    if (ch === "{" || ch === "(" || ch === "[") { depth++; if (ch === "{" || ch === "[") opened = true; }
-    else if (ch === "}" || ch === ")" || ch === "]") { depth--; if (opened && depth <= 0) return line; }
-    if (ch.trim()) prevSig = ch;
-    i++;
-  }
-  return bodyLines.length;
-}
-
-// Large multi-line string literals — the OPPOSITE selection to stripNonCode: everything the code
-// scan throws away. Embedded DSLs (inline C#/SQL/PowerShell templates) are invisible to the normal
-// clone pass because their bodies are stripped; this extractor feeds them back in as their own
-// fragments when the caller opts in (find_duplicates include_strings). Comment/regex handling
-// mirrors stripNonCode so a quote inside a comment never opens a phantom literal.
-export function extractLargeStrings(text, { py = false, cs = false, minLines = 6 } = {}) {
-  const s = String(text || "");
-  const out = [];
-  let i = 0, line = 1, prevSig = "";
-  const capture = (from, to, startLine) => {
-    const content = s.slice(from, to);
-    const nl = (content.match(/\n/g) || []).length;
-    if (nl + 1 >= minLines) out.push({ start: startLine, end: startLine + nl, content });
-  };
-  while (i < s.length) {
-    const ch = s[i], two = s.slice(i, i + 2), three = s.slice(i, i + 3);
-    if (ch === "\n") { line++; i++; continue; }
-    if (py && ch === "#") { while (i < s.length && s[i] !== "\n") i++; continue; }
-    if (py && (three === "'''" || three === '"""')) {
-      const startLine = line; i += 3; const from = i;
-      while (i < s.length && s.slice(i, i + 3) !== three) { if (s[i] === "\n") line++; i++; }
-      capture(from, i, startLine); i += 3; continue;
-    }
-    if (!py && two === "//") { while (i < s.length && s[i] !== "\n") i++; continue; }
-    if (!py && two === "/*") { i += 2; while (i < s.length && s.slice(i, i + 2) !== "*/") { if (s[i] === "\n") line++; i++; } i += 2; continue; }
-    if (!py && ch === "/" && REGEX_PREV.has(prevSig)) {
-      i++; let inClass = false;
-      while (i < s.length && s[i] !== "\n") { const c = s[i]; if (c === "\\") { i += 2; continue; } if (c === "[") inClass = true; else if (c === "]") inClass = false; else if (c === "/" && !inClass) { i++; break; } i++; }
-      prevSig = "/"; continue;
-    }
-    if (cs && two === '@"') { // C# verbatim string; "" is the escaped quote
-      const startLine = line; i += 2; const from = i;
-      while (i < s.length) { if (s.slice(i, i + 2) === '""') { i += 2; continue; } if (s[i] === '"') break; if (s[i] === "\n") line++; i++; }
-      capture(from, i, startLine); i++; continue;
-    }
-    if (!py && ch === "`") { // JS/TS template literal — the main multi-line carrier
-      const startLine = line; i++; const from = i;
-      while (i < s.length && s[i] !== "`") { if (s[i] === "\\") { i++; if (s[i] === "\n") line++; i++; continue; } if (s[i] === "\n") line++; i++; }
-      capture(from, i, startLine); i++; continue;
-    }
-    if (ch === '"' || ch === "'") { // single-line strings can't span minLines — just skip past
-      const q = ch; i++;
-      while (i < s.length && s[i] !== q && s[i] !== "\n") { if (s[i] === "\\") i++; i++; }
-      if (s[i] === q) i++; continue;
-    }
-    if (ch.trim()) prevSig = ch;
-    i++;
-  }
-  return out;
-}
-
-// one raw token stream; the two modes differ only in identifier canonicalization
-export function tokenize(text) {
-  const raw = text.match(/[A-Za-z_$][\w$]*|\d+(?:\.\d+)?|[^\s\w]/g) || [];
-  const strict = [];
-  const renamed = [];
-  for (const t of raw) {
-    if (/^\d/.test(t)) { strict.push("N"); renamed.push("N"); continue; }
-    if (/^[A-Za-z_$]/.test(t) && !KEYWORDS.has(t)) { strict.push(t); renamed.push("I"); continue; }
-    strict.push(t); renamed.push(t);
-  }
-  return { strict, renamed };
-}
-
-export function fingerprints(toks) {
-  if (toks.length < K + W - 1) return new Set();
-  const hashes = [];
-  for (let i = 0; i + K <= toks.length; i++) {
-    let h = 0;
-    for (let j = i; j < i + K; j++) {
-      const s = toks[j];
-      for (let c = 0; c < s.length; c++) h = (h * 31 + s.charCodeAt(c)) | 0;
-      h = (h * 131) | 0;
-    }
-    hashes.push(h >>> 0);
-  }
-  const fp = new Set();
-  for (let i = 0; i + W <= hashes.length + 1; i++) {
-    let min = Infinity;
-    for (let j = i; j < Math.min(i + W, hashes.length); j++) if (hashes[j] < min) min = hashes[j];
-    fp.add(min);
-  }
-  return fp;
-}
+// duplicates.tokenize.js — lexical layer of the clone detector (split from duplicates.js): comment &
+// string stripping, body-end detection, strict/renamed tokenization, and winnowing fingerprints.
+
+const K = 8;               // k-gram length (tokens)
+const W = 4;               // winnowing window → guaranteed detection of matches ≥ K+W-1 tokens
+const STRLIT = String.fromCharCode(0); // opaque-literal sentinel for every string/regex body: a NUL
+                           // its own class (never an identifier "I" nor a number "N"), so a literal can
+                           // never masquerade as code in either mode
+
+const KEYWORDS = new Set(("if else for while do switch case break continue return function const let var new class extends async await try catch finally throw import from export default typeof instanceof in of delete void yield static get set this super null undefined true false def elif except lambda pass raise with as is not and or None True False func go defer chan map range struct interface type package nil err string int bool byte float64 public private protected final void long double boolean").split(" "));
+
+// A leading `/` is a REGEX literal (not division) when the previous significant char is one of these
+// or the fragment start; after a word char / ) / ] it is division. Covers .match(/…/), = /…/, (/…/),
+// and arrow `x => /…/`. NOTE: `+` and `-` are deliberately EXCLUDED — a regex never legitimately
+// follows them, but `i++ / 2` and `a - b / c` do, and including them mis-scanned the division as a
+// regex and ate the rest of the line.
+const REGEX_PREV = new Set("(,=:[!&|?{};~*%^<>".split(""));
+
+// Replace comments with nothing and string/regex BODIES with the sentinel, so their contents never
+// count as code. Handles Python triple-quoted docstrings (embedded quotes no longer desync the scan)
+// and JS regex literals (a quote inside /['"]/ no longer opens a phantom string).
+export function stripNonCode(text, py) {
+  let out = "", i = 0, prevSig = "";
+  const s = String(text || "");
+  const push = (c) => { out += c; const t = c.trim(); if (t) prevSig = t[t.length - 1]; };
+  while (i < s.length) {
+    const ch = s[i], two = s.slice(i, i + 2), three = s.slice(i, i + 3);
+    if (py && ch === "#") { while (i < s.length && s[i] !== "\n") i++; continue; }
+    if (py && (three === "'''" || three === '"""')) {
+      i += 3;
+      while (i < s.length && s.slice(i, i + 3) !== three) i++;
+      i += 3; push(` ${STRLIT} `); continue;
+    }
+    if (!py && two === "//") { while (i < s.length && s[i] !== "\n") i++; continue; }
+    if (!py && two === "/*") { i += 2; while (i < s.length && s.slice(i, i + 2) !== "*/") i++; i += 2; continue; }
+    if (!py && ch === "/" && REGEX_PREV.has(prevSig)) {
+      i++; let inClass = false; // '/' inside a [...] char class is literal, not the terminator
+      while (i < s.length && s[i] !== "\n") {
+        const c = s[i];
+        if (c === "\\") { i += 2; continue; }
+        if (c === "[") inClass = true;
+        else if (c === "]") inClass = false;
+        else if (c === "/" && !inClass) { i++; break; }
+        i++;
+      }
+      while (i < s.length && /[a-z]/i.test(s[i])) i++; // regex flags (gimsuy)
+      push(` ${STRLIT} `); continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const q = ch; i++;
+      while (i < s.length && s[i] !== q) { if (s[i] === "\\") i++; i++; }
+      i++; push(` ${STRLIT} `); continue;
+    }
+    push(ch); i++;
+  }
+  return out;
+}
+
+// Where a symbol's body ends — so the LAST symbol in a file doesn't swallow trailing module-level code
+// (module.exports tables, main() calls, handler registrations) up to EOF and dilute/misattribute
+// clones. Brace/bracket depth for brace langs (body ends when {}()[] balance after first opening);
+// indentation for Python. Returns a 1-based line count within bodyLines (≤ its length; = its length
+// when the construct never closes, so the caller's cap stands).
+export function bodyEndLineCount(bodyLines, py) {
+  if (py) {
+    const base = bodyLines[0].match(/^[ \t]*/)[0].length;
+    let last = 1;
+    for (let k = 1; k < bodyLines.length; k++) {
+      const ln = bodyLines[k];
+      if (!ln.trim()) continue; // blank lines never end a block
+      if (ln.match(/^[ \t]*/)[0].length <= base) return last; // dedent to ≤ the def → body ended above
+      last = k + 1;
+    }
+    return bodyLines.length;
+  }
+  const text = bodyLines.join("\n");
+  let depth = 0, opened = false, i = 0, line = 1, prevSig = "";
+  while (i < text.length) {
+    const ch = text[i], two = text.slice(i, i + 2);
+    if (ch === "\n") { line++; i++; continue; }
+    if (two === "//") { while (i < text.length && text[i] !== "\n") i++; continue; }
+    if (two === "/*") { i += 2; while (i < text.length && text.slice(i, i + 2) !== "*/") { if (text[i] === "\n") line++; i++; } i += 2; continue; }
+    if (ch === "/" && REGEX_PREV.has(prevSig)) {
+      i++; let inClass = false;
+      while (i < text.length && text[i] !== "\n") { const c = text[i]; if (c === "\\") { i += 2; continue; } if (c === "[") inClass = true; else if (c === "]") inClass = false; else if (c === "/" && !inClass) { i++; break; } i++; }
+      prevSig = "/"; continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") { const q = ch; i++; while (i < text.length && text[i] !== q) { if (text[i] === "\\") i++; else if (text[i] === "\n") line++; i++; } i++; prevSig = q; continue; }
+    // depth tracks all brackets, but only a { or [ opens the BODY — a bare (param list) returning to
+    // depth 0 must not be read as the construct closing on line 1
+    if (ch === "{" || ch === "(" || ch === "[") { depth++; if (ch === "{" || ch === "[") opened = true; }
+    else if (ch === "}" || ch === ")" || ch === "]") { depth--; if (opened && depth <= 0) return line; }
+    if (ch.trim()) prevSig = ch;
+    i++;
+  }
+  return bodyLines.length;
+}
+
+// Large multi-line string literals — the OPPOSITE selection to stripNonCode: everything the code
+// scan throws away. Embedded DSLs (inline C#/SQL/PowerShell templates) are invisible to the normal
+// clone pass because their bodies are stripped; this extractor feeds them back in as their own
+// fragments when the caller opts in (find_duplicates include_strings). Comment/regex handling
+// mirrors stripNonCode so a quote inside a comment never opens a phantom literal.
+export function extractLargeStrings(text, { py = false, cs = false, minLines = 6 } = {}) {
+  const s = String(text || "");
+  const out = [];
+  let i = 0, line = 1, prevSig = "";
+  const capture = (from, to, startLine) => {
+    const content = s.slice(from, to);
+    const nl = (content.match(/\n/g) || []).length;
+    if (nl + 1 >= minLines) out.push({ start: startLine, end: startLine + nl, content });
+  };
+  while (i < s.length) {
+    const ch = s[i], two = s.slice(i, i + 2), three = s.slice(i, i + 3);
+    if (ch === "\n") { line++; i++; continue; }
+    if (py && ch === "#") { while (i < s.length && s[i] !== "\n") i++; continue; }
+    if (py && (three === "'''" || three === '"""')) {
+      const startLine = line; i += 3; const from = i;
+      while (i < s.length && s.slice(i, i + 3) !== three) { if (s[i] === "\n") line++; i++; }
+      capture(from, i, startLine); i += 3; continue;
+    }
+    if (!py && two === "//") { while (i < s.length && s[i] !== "\n") i++; continue; }
+    if (!py && two === "/*") { i += 2; while (i < s.length && s.slice(i, i + 2) !== "*/") { if (s[i] === "\n") line++; i++; } i += 2; continue; }
+    if (!py && ch === "/" && REGEX_PREV.has(prevSig)) {
+      i++; let inClass = false;
+      while (i < s.length && s[i] !== "\n") { const c = s[i]; if (c === "\\") { i += 2; continue; } if (c === "[") inClass = true; else if (c === "]") inClass = false; else if (c === "/" && !inClass) { i++; break; } i++; }
+      prevSig = "/"; continue;
+    }
+    if (cs && two === '@"') { // C# verbatim string; "" is the escaped quote
+      const startLine = line; i += 2; const from = i;
+      while (i < s.length) { if (s.slice(i, i + 2) === '""') { i += 2; continue; } if (s[i] === '"') break; if (s[i] === "\n") line++; i++; }
+      capture(from, i, startLine); i++; continue;
+    }
+    if (!py && ch === "`") { // JS/TS template literal — the main multi-line carrier
+      const startLine = line; i++; const from = i;
+      while (i < s.length && s[i] !== "`") { if (s[i] === "\\") { i++; if (s[i] === "\n") line++; i++; continue; } if (s[i] === "\n") line++; i++; }
+      capture(from, i, startLine); i++; continue;
+    }
+    if (ch === '"' || ch === "'") { // single-line strings can't span minLines — just skip past
+      const q = ch; i++;
+      while (i < s.length && s[i] !== q && s[i] !== "\n") { if (s[i] === "\\") i++; i++; }
+      if (s[i] === q) i++; continue;
+    }
+    if (ch.trim()) prevSig = ch;
+    i++;
+  }
+  return out;
+}
+
+// one raw token stream; the two modes differ only in identifier canonicalization
+export function tokenize(text) {
+  const raw = text.match(/[A-Za-z_$][\w$]*|\d+(?:\.\d+)?|[^\s\w]/g) || [];
+  const strict = [];
+  const renamed = [];
+  for (const t of raw) {
+    if (/^\d/.test(t)) { strict.push("N"); renamed.push("N"); continue; }
+    if (/^[A-Za-z_$]/.test(t) && !KEYWORDS.has(t)) { strict.push(t); renamed.push("I"); continue; }
+    strict.push(t); renamed.push(t);
+  }
+  return { strict, renamed };
+}
+
+export function fingerprints(toks) {
+  if (toks.length < K + W - 1) return new Set();
+  const hashes = [];
+  for (let i = 0; i + K <= toks.length; i++) {
+    let h = 0;
+    for (let j = i; j < i + K; j++) {
+      const s = toks[j];
+      for (let c = 0; c < s.length; c++) h = (h * 31 + s.charCodeAt(c)) | 0;
+      h = (h * 131) | 0;
+    }
+    hashes.push(h >>> 0);
+  }
+  const fp = new Set();
+  for (let i = 0; i + W <= hashes.length + 1; i++) {
+    let min = Infinity;
+    for (let j = i; j < Math.min(i + W, hashes.length); j++) if (hashes[j] < min) min = hashes[j];
+    fp.add(min);
+  }
+  return fp;
+}

package/src/analysis/endpoints.js

@@ -6,8 +6,8 @@
 //   • method-call routes (Express/Fastify/Koa/Hono/gin/echo):  app.get("/path", handler)
 //   • decorators (FastAPI/Flask/NestJS):   @app.get("/path")  /  @Get("/path")
 //   • Go net/http:                          mux.HandleFunc("/path", handler)
-import { join } from "node:path";
 import { safeRead } from "../util.js";
+import { createRepoBoundary } from "../repo-path.js";
 
 const MAX_FILES = 3000;
 const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ALL", "ANY"]);
@@ -125,11 +125,13 @@ const normParamKey = (p) => String(p).replace(/\{([^/}]+)\}/g, ":$1");
 export function detectEndpoints(repoPath, codeFiles) {
   const files = (codeFiles || []).slice(0, MAX_FILES);
   const byKey = new Map();
+  const boundary = createRepoBoundary(repoPath);
   for (const f of files) {
     const rel = f.path || f;
-    const full = f.full || join(repoPath, rel);
     if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go)$/i.test(rel)) continue;
-    const text = safeRead(full);
+    const resolved = boundary.resolve(rel);
+    if (!resolved.ok) continue;
+    const text = safeRead(resolved.path);
     if (!text || !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)/i.test(text)) continue;
     for (const e of extractEndpointsFromText(text, rel.replace(/\\/g, "/"))) {
       const key = `${e.method} ${normParamKey(e.path)}`;

package/src/analysis/graph-analysis.aggregate.js

@@ -5,6 +5,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { normalizeRepoParts, readCoverageForRepo, pctFromCounts } from "./coverage-reports.js";
 import { bareSymbolName, countLocalRefsOutsideOwnRange, computeSymbolExternalRefs } from "./graph-analysis.refs.js";
+import { createRepoBoundary } from "../repo-path.js";
 
 // Aggregate a built graph.json into the file- and module-level view the UI needs:
 //   - graph-builder nodes are FILES *and* their symbols (functions/methods), linked file→symbol by the
@@ -175,11 +176,14 @@ export function aggregateGraph(graph, repoRoot) {
   const fileLoc = new Map();
   const fileText = new Map();
   if (repoRoot) {
+    const boundary = createRepoBoundary(repoRoot);
     folderLoc = {};
     for (const [sourceFile, mod] of fileModule) {
       let loc = 0;
       try {
-        const txt = readFileSync(join(repoRoot, sourceFile), "utf8");
+        const resolved = boundary.resolve(sourceFile);
+        if (!resolved.ok) throw new Error("source path is outside the repository");
+        const txt = readFileSync(resolved.path, "utf8");
         loc = txt ? txt.split("\n").length : 0;
         fileText.set(sourceFile, txt || "");
       } catch {

package/src/analysis/internal-audit.collect.js

@@ -3,9 +3,18 @@
 import { readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps } from "./manifests.js";
+import { createRepoBoundary } from "../repo-path.js";
 
 export const readText = (p) => { try { return readFileSync(p, "utf8"); } catch { return null; } };
 export const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
+export const readRepoText = (boundary, relativePath) => {
+  const resolved = boundary.resolve(relativePath);
+  return resolved.ok ? readText(resolved.path) : null;
+};
+export const readRepoJson = (boundary, relativePath) => {
+  const resolved = boundary.resolve(relativePath);
+  return resolved.ok ? readJson(resolved.path) : null;
+};
 const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?|py|go|vue|svelte)$/i;
 const SOURCE_SKIP_DIRS = new Set([
   ".git", ".hg", ".svn", "node_modules", "vendor", "dist", "build", "coverage", ".next", "out",
@@ -15,10 +24,13 @@ const SOURCE_SKIP_DIRS = new Set([
 
 export function collectSourceTexts(repoRoot, graph) {
   const sources = new Map();
+  const boundary = createRepoBoundary(repoRoot);
   const add = (rel) => {
     const file = String(rel || "").replace(/\\/g, "/");
     if (!file || sources.has(file)) return;
-    const text = readText(join(repoRoot, file));
+    const resolved = boundary.resolve(file);
+    if (!resolved.ok) return;
+    const text = readText(resolved.path);
     if (text != null) sources.set(file, text);
   };
 
@@ -63,11 +75,14 @@ const CONFIG_FILES = [
 
 export function collectConfigTexts(repoRoot) {
   const map = new Map();
-  for (const f of CONFIG_FILES) { const t = readText(join(repoRoot, f)); if (t != null) map.set(f, t); }
+  const boundary = createRepoBoundary(repoRoot);
+  for (const f of CONFIG_FILES) { const t = readRepoText(boundary, f); if (t != null) map.set(f, t); }
   try {
-    for (const wf of readdirSync(join(repoRoot, ".github", "workflows"))) {
+    const workflows = boundary.resolve(".github/workflows");
+    if (!workflows.ok) throw new Error("workflows directory is outside the repository");
+    for (const wf of readdirSync(workflows.path)) {
       if (!/\.ya?ml$/i.test(wf)) continue;
-      const t = readText(join(repoRoot, ".github", "workflows", wf));
+      const t = readRepoText(boundary, `.github/workflows/${wf}`);
       if (t != null) map.set(`.github/workflows/${wf}`, t);
     }
   } catch { /* no workflows */ }
@@ -78,14 +93,21 @@ export function collectConfigTexts(repoRoot) {
 // Those are importable without being declared — never "missing" deps.
 export function workspacePkgNames(repoRoot, pkg) {
   const names = new Set();
+  const boundary = createRepoBoundary(repoRoot);
   const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : (pkg.workspaces && pkg.workspaces.packages) || [];
   for (const g of globs) {
     const base = String(g).replace(/\/?\*+.*$/, "");
     let dirs = [];
-    if (/\*/.test(String(g))) { try { dirs = readdirSync(join(repoRoot, base)).map((d) => join(base, d)); } catch { continue; } }
+    if (/\*/.test(String(g))) {
+      try {
+        const resolvedBase = boundary.resolve(base || ".");
+        if (!resolvedBase.ok) continue;
+        dirs = readdirSync(resolvedBase.path).map((d) => join(base, d));
+      } catch { continue; }
+    }
     else dirs = [String(g)];
     for (const d of dirs) {
-      const p = readJson(join(repoRoot, d, "package.json"));
+      const p = readRepoJson(boundary, join(d, "package.json"));
       if (p && p.name) names.add(p.name);
     }
   }
@@ -100,18 +122,22 @@ export function collectPyManifest(repoRoot) {
   const deps = [];
   let present = false;
   let names = [];
-  try { names = readdirSync(repoRoot).filter((n) => /^requirements[\w.-]*\.(txt|in)$/i.test(n)); } catch { /* unreadable root */ }
-  try { names.push(...readdirSync(join(repoRoot, "requirements")).filter((n) => /\.(txt|in)$/i.test(n)).map((n) => `requirements/${n}`)); } catch { /* no requirements dir */ }
+  const boundary = createRepoBoundary(repoRoot);
+  try { names = readdirSync(boundary.root).filter((n) => /^requirements[\w.-]*\.(txt|in)$/i.test(n)); } catch { /* unreadable root */ }
+  try {
+    const requirements = boundary.resolve("requirements");
+    if (requirements.ok) names.push(...readdirSync(requirements.path).filter((n) => /\.(txt|in)$/i.test(n)).map((n) => `requirements/${n}`));
+  } catch { /* no requirements dir */ }
   for (const n of names) {
-    const t = readText(join(repoRoot, n));
+    const t = readRepoText(boundary, n);
     if (t == null) continue;
     present = true;
     const dev = /dev|test|lint|doc|ci/i.test(n.replace(/^requirements[/\\]?/i, ""));
     for (const d of parseRequirementsNames(t)) deps.push({ ...d, dev });
   }
-  const pp = readText(join(repoRoot, "pyproject.toml"));
+  const pp = readRepoText(boundary, "pyproject.toml");
   if (pp != null) { const r = parsePyprojectDeps(pp); if (r.present) { present = true; deps.push(...r.deps); } }
-  const pf = readText(join(repoRoot, "Pipfile"));
+  const pf = readRepoText(boundary, "Pipfile");
   if (pf != null) { const r = parsePipfileDeps(pf); if (r.present) { present = true; deps.push(...r.deps); } }
   return { present, deps };
 }