weavatrix 0.1.0

package/src/scan/search.rg.js

@@ -0,0 +1,145 @@
+// ripgrep engine for the cross-repo search: resolve a usable rg binary (bundled / VS Code / Cursor /
+// PATH) and run the ripgrep-backed filename + content search. Split out of search.js.
+import { existsSync, readdirSync } from "node:fs";
+import { join, sep } from "node:path";
+import { runCommand } from "../process.js";
+import { repoBaseName } from "./discover.js";
+
+// ---- ripgrep resolution (no bare `rg` — a packaged app's PATH usually lacks it) -----------------
+function rgInInstall(base) {
+  return [
+    join(base, "resources", "app", "node_modules", "@vscode", "ripgrep", "bin", "rg.exe"),
+    join(base, "resources", "app", "node_modules", "@vscode", "ripgrep-universal", "bin", "win32-x64", "rg.exe")
+  ];
+}
+function editorRgCandidates() {
+  const local = process.env.LOCALAPPDATA || "";
+  const pf = process.env.PROGRAMFILES || "";
+  const roots = [local && join(local, "Programs", "Microsoft VS Code"), local && join(local, "Programs", "cursor"), pf && join(pf, "Microsoft VS Code")].filter(Boolean);
+  const out = [];
+  for (const root of roots) {
+    if (!existsSync(root)) continue;
+    out.push(...rgInInstall(root)); // non-versioned install
+    try {
+      for (const d of readdirSync(root, { withFileTypes: true })) if (d.isDirectory()) out.push(...rgInInstall(join(root, d.name))); // version-hashed dir
+    } catch {
+      /* ignore */
+    }
+  }
+  return out;
+}
+function extensionRgCandidates() {
+  const home = process.env.USERPROFILE || process.env.HOME || "";
+  const roots = [".vscode", ".vscode-insiders", ".cursor"].map((d) => home && join(home, d, "extensions")).filter(Boolean);
+  const out = [];
+  const walk = (dir, depth = 0) => {
+    if (!dir || depth > 5 || out.length >= 20 || !existsSync(dir)) return;
+    let entries = [];
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const ent of entries) {
+      if (out.length >= 20) break;
+      const full = join(dir, ent.name);
+      if (ent.isFile() && /^rg(\.exe)?$/i.test(ent.name)) out.push(full);
+      else if (ent.isDirectory()) walk(full, depth + 1);
+    }
+  };
+  for (const root of roots) walk(root);
+  return out;
+}
+async function whereRg() {
+  if (process.platform !== "win32") return [];
+  try {
+    const r = await runCommand("where.exe", ["rg"], { timeoutMs: 4000 });
+    return String(r.stdout || "").split(/\r?\n/).map((l) => l.trim()).filter((l) => /\.exe$/i.test(l));
+  } catch {
+    return [];
+  }
+}
+// engine (settings.searchEngine): "auto" (default — custom path → env → editor-bundled rg → PATH →
+// git grep → Node), "system" (ONLY the system-installed rg from PATH, then Node), "git" (git grep /
+// git ls-files, then Node), "node" (skip native tools entirely, pure-Node scanner).
+const _rgCache = new Map(); // engine|rgPath -> { info, at }
+// exported: the malware scanner (security/malware-heuristics.js) reuses the same rg resolution
+export async function resolveRgInfo(engine = "auto", rgPath = "") {
+  if (engine === "node" || engine === "git") return null;
+  const key = `${engine}|${rgPath}`;
+  const hit = _rgCache.get(key);
+  if (hit && Date.now() - hit.at < 60000) return hit.info;
+  const env = process.env.WEAVATRIX_RG_CMD && process.env.WEAVATRIX_RG_CMD.replace(/^"|"$/g, "");
+  const pathCands = (await whereRg()).map((path) => ({ path, source: "PATH" }));
+  const cands = [
+    rgPath && { path: rgPath, source: "custom path" },
+    engine === "auto" && env && { path: env, source: "WEAVATRIX_RG_CMD" },
+    ...editorRgCandidates().map((path) => ({ path, source: "VS Code/Cursor bundle" })),
+    ...extensionRgCandidates().map((path) => ({ path, source: "editor extension" })),
+    ...pathCands,
+    process.platform === "win32" ? null : { path: "rg", source: "PATH" },
+  ].filter(Boolean);
+  let info = null;
+  for (const c of cands) {
+    if (c.path === "rg" || existsSync(c.path)) {
+      info = { path: c.path, source: c.source, detail: `${c.source}: ${c.path}` };
+      break;
+    }
+  }
+  _rgCache.set(key, { info, at: Date.now() });
+  return info;
+}
+
+export async function resolveRg(engine = "auto", rgPath = "") {
+  return (await resolveRgInfo(engine, rgPath))?.path || null;
+}
+
+function repoOfPath(roots, p) {
+  const m = roots.find((r) => p === r || p.startsWith(r + sep) || p.startsWith(r + "/"));
+  return m ? repoBaseName(m) : "";
+}
+
+// ---- ripgrep search -----------------------------------------------------------------------------
+export async function rgSearch(rg, roots, query, mode, cap) {
+  if (mode === "filename") {
+    const term = query.replace(/[[\]{}]/g, ""); // keep it a plain substring glob
+    const args = ["--files", "--hidden", "-g", "!.git", "-g", "!node_modules", "-g", `*${term}*`, "--", ...roots];
+    const r = await runCommand(rg, args, { timeoutMs: 15000 });
+    if (r.exitCode === 2 && !r.stdout) return { ok: false, error: (r.stderr || "ripgrep error").slice(0, 300) };
+    const lines = String(r.stdout || "").split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    const results = [];
+    for (const p of lines) {
+      if (results.length >= cap) break;
+      results.push({ repo: repoOfPath(roots, p), path: p, line: 0, column: 0, preview: p.split(/[\\/]/).pop() });
+    }
+    return { ok: true, engine: "ripgrep", truncated: lines.length > cap, results };
+  }
+  // content (literal/fixed-string smart-case)
+  const args = ["--json", "-F", "--smart-case", "--max-count", "40", "--max-columns", "400", "--max-columns-preview", "--threads", "0", "-g", "!.git", "-g", "!node_modules", "-e", query, "--", ...roots];
+  const r = await runCommand(rg, args, { timeoutMs: 20000 });
+  if (r.exitCode === 2 && !r.stdout) return { ok: false, error: (r.stderr || "ripgrep error").slice(0, 300) };
+  const results = [];
+  let truncated = false;
+  for (const line of String(r.stdout || "").split(/\r?\n/)) {
+    if (!line) continue;
+    if (results.length >= cap) {
+      truncated = true;
+      break;
+    }
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (obj.type !== "match") continue;
+    const d = obj.data || {};
+    const path = d.path?.text || "";
+    if (!path) continue;
+    const sub = (d.submatches || [])[0];
+    results.push({
+      repo: repoOfPath(roots, path),
+      path,
+      line: d.line_number || 0,
+      column: sub ? sub.start : 0,
+      preview: String(d.lines?.text || "").replace(/\r?\n$/, "").slice(0, 400)
+    });
+  }
+  return { ok: true, engine: "ripgrep", truncated, results };
+}

package/src/security/advisory-store.js

@@ -0,0 +1,177 @@
+// Local advisory cache for supply-chain scanning. SCANS are 100% offline (read this store only);
+// REFRESH is an explicit, user-triggered online call to OSV.dev (it necessarily sends the installed
+// package names+versions — surfaced in the UI, never automatic). OSV is the single source: CVE/GHSA
+// vulnerabilities AND OSSF malicious-package records (MAL-*) come through one schema/one matcher.
+//
+// Storage is a JSON file, not SQLite — deliberate P4 deviation from the plan: we cache advisories for
+// THIS machine's installed packages (hundreds of records), not the full npm snapshot (that's what
+// needed SQLite), and better-sqlite3 here is built for Electron's ABI so plain-node tests couldn't
+// load it. Same API surface; swap to SQLite if/when a full baked snapshot ships (P6).
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+import { uniqueBy } from "../util.js";
+
+export const DEFAULT_STORE = join(homedir(), ".weavatrix", "advisories.json");
+const OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
+const OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
+const DEFAULT_FETCH_TIMEOUT_MS = Number(process.env.WEAVATRIX_OSV_TIMEOUT_MS || 20000);
+export const OSV_SUPPORTED_ECOSYSTEMS = new Set(["npm", "PyPI", "Go"]);
+
+const keyOf = (ecosystem, name) => `${ecosystem}|${ecosystem === "PyPI" ? String(name).toLowerCase().replace(/[-_.]+/g, "-") : name}`;
+
+const uniquePackages = (pkgs) => uniqueBy(pkgs, (p) => `${p.ecosystem}|${p.name}|${p.version}`);
+
+async function fetchJson(fetcher, url, options, timeoutMs) {
+  const timeout = Math.max(50, Number(timeoutMs) || DEFAULT_FETCH_TIMEOUT_MS);
+  const ctrl = typeof AbortController === "function" ? new AbortController() : null;
+  let timer;
+  try {
+    const request = fetcher(url, ctrl ? { ...options, signal: ctrl.signal } : options);
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        try { ctrl?.abort(); } catch { /* ignore */ }
+        reject(new Error(`OSV request timed out after ${Math.round(timeout / 1000)}s`));
+      }, timeout);
+    });
+    const res = await Promise.race([request, timeoutPromise]);
+    if (!res || typeof res.json !== "function") throw new Error("invalid response from OSV");
+    if (res.ok === false) throw new Error(`HTTP ${res.status || "error"} from OSV`);
+    return await res.json();
+  } catch (error) {
+    if (error?.name === "AbortError") throw new Error(`OSV request timed out after ${Math.round(timeout / 1000)}s`);
+    throw error;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+export function loadStore(storePath = DEFAULT_STORE) {
+  try {
+    const s = JSON.parse(readFileSync(storePath, "utf8"));
+    if (s && typeof s === "object" && s.records) return s;
+  } catch { /* missing/corrupt → empty */ }
+  return { meta: { fetched_at: null }, records: {} };
+}
+
+export function queryStore(store, ecosystem, name) {
+  return (store && store.records && store.records[keyOf(ecosystem, name)]) || [];
+}
+
+export function storeMeta(storePath = DEFAULT_STORE) {
+  const s = loadStore(storePath);
+  return { fetchedAt: s.meta?.fetched_at || null, advisoryCount: Object.values(s.records || {}).reduce((n, l) => n + l.length, 0) };
+}
+
+// GHSA-style labels + CVSS score → our severity scale. MAL-* records are always critical.
+function severityOf(rec) {
+  if (String(rec.id || "").startsWith("MAL-")) return "critical";
+  const label = String(rec.database_specific?.severity || "").toLowerCase();
+  if (label === "critical") return "critical";
+  if (label === "high") return "high";
+  if (label === "moderate" || label === "medium") return "medium";
+  if (label === "low") return "low";
+  let best = 0;
+  for (const s of rec.severity || []) {
+    const m = String(s.score || "").match(/CVSS:[\d.]+\/.*?\bA[VC]?:/i) ? null : String(s.score || "").match(/^(\d+(\.\d+)?)$/);
+    if (m) best = Math.max(best, Number(m[1]));
+  }
+  if (best >= 9) return "critical";
+  if (best >= 7) return "high";
+  if (best >= 4) return "medium";
+  return "medium"; // unknown → medium, never silently info
+}
+
+// One normalized row per (record × matching affected entry): everything the matcher/UI needs, nothing else.
+function normalizeRecord(rec, ecosystem, name) {
+  const affected = (rec.affected || []).find((a) => a?.package && a.package.ecosystem === ecosystem && keyOf(ecosystem, a.package.name) === keyOf(ecosystem, name));
+  if (!affected) return null;
+  const fixed = [];
+  for (const r of affected.ranges || []) for (const e of r.events || []) if (e.fixed) fixed.push(e.fixed);
+  return {
+    id: rec.id,
+    kind: String(rec.id || "").startsWith("MAL-") ? "malicious" : "vuln",
+    severity: severityOf(rec),
+    summary: String(rec.summary || rec.details || "").slice(0, 300),
+    url: `https://osv.dev/vulnerability/${rec.id}`,
+    modified: rec.modified || "",
+    aliases: (rec.aliases || []).slice(0, 6),
+    fixedIn: [...new Set(fixed)].slice(0, 4),
+    affected: { versions: affected.versions || [], ranges: affected.ranges || [] },
+  };
+}
+
+// Refresh the cache from OSV for the given installed set. fetcher is injectable for tests.
+// Returns { queried, vulnerable, fetched, saved, errors }.
+export async function refreshAdvisories({ installed = [], storePath = DEFAULT_STORE, fetcher = globalThis.fetch, batchSize = 100, repoKey = "", repoKeys = [], timeoutMs = DEFAULT_FETCH_TIMEOUT_MS } = {}) {
+  if (typeof fetcher !== "function") return { ok: false, error: "no fetch available" };
+  const withVersions = installed.filter((p) => p && p.ecosystem && p.name && p.version);
+  const unsupported = withVersions.filter((p) => !OSV_SUPPORTED_ECOSYSTEMS.has(p.ecosystem)).length;
+  const pkgs = uniquePackages(withVersions.filter((p) => OSV_SUPPORTED_ECOSYSTEMS.has(p.ecosystem)));
+  if (!pkgs.length) {
+    return {
+      ok: false,
+      queried: 0,
+      unsupported,
+      error: "No OSV-supported pinned package versions found to check. weavatrix currently queries OSV for npm, PyPI, and Go packages with concrete versions.",
+    };
+  }
+  const store = loadStore(storePath);
+  const idsByPkg = new Map(); // pkgIndex -> [vuln ids]
+  const errors = [];
+
+  for (let i = 0; i < pkgs.length; i += batchSize) {
+    const batch = pkgs.slice(i, i + batchSize);
+    try {
+      const json = await fetchJson(fetcher, OSV_BATCH_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ queries: batch.map((p) => ({ package: { ecosystem: p.ecosystem, name: p.name }, version: p.version })) }),
+      }, timeoutMs);
+      (json.results || []).forEach((r, j) => { if (r && Array.isArray(r.vulns) && r.vulns.length) idsByPkg.set(i + j, r.vulns.map((v) => v.id)); });
+    } catch (error) {
+      errors.push(`querybatch ${Math.floor(i / batchSize) + 1}/${Math.ceil(pkgs.length / batchSize)}: ${error.message}`);
+    }
+  }
+
+  const wanted = new Map(); // id -> [pkg,...] (an id can hit several packages)
+  for (const [pi, ids] of idsByPkg) for (const id of ids) (wanted.get(id) || wanted.set(id, []).get(id)).push(pkgs[pi]);
+
+  let fetched = 0;
+  for (const [id, pkgList] of wanted) {
+    try {
+      const rec = await fetchJson(fetcher, OSV_VULN_URL + encodeURIComponent(id), {}, timeoutMs);
+      if (!rec || !rec.id) continue;
+      fetched++;
+      for (const p of pkgList) {
+        const row = normalizeRecord(rec, p.ecosystem, p.name);
+        if (!row) continue;
+        const key = keyOf(p.ecosystem, p.name);
+        const list = store.records[key] || (store.records[key] = []);
+        const at = list.findIndex((x) => x.id === row.id);
+        if (at >= 0) list[at] = row; else list.push(row);
+      }
+    } catch (error) {
+      errors.push(`${id}: ${error.message}`);
+    }
+  }
+
+  // A refresh where NOTHING was fetched but errors occurred (offline, OSV blocked) must NOT stamp
+  // fetched_at — that would turn an empty cache into "No known vulnerabilities as of <today>".
+  if (errors.length && fetched === 0 && (idsByPkg.size === 0 || wanted.size > 0)) {
+    return { ok: false, queried: pkgs.length, unsupported, error: `advisory refresh failed: ${errors[0]}${errors.length > 1 ? ` (+${errors.length - 1} more)` : ""}`, errors };
+  }
+  store.meta.fetched_at = new Date().toISOString();
+  // per-repo stamp: the cache only covers packages that were QUERIED — a repo that never refreshed must
+  // show "fetch advisories", not "0 vulnerabilities as of <someone else's date>" (false assurance).
+  // repoKeys[] lets one online pass (a "refresh all repos") stamp every repo whose packages it covered.
+  const stampRepos = [...new Set([repoKey, ...repoKeys].filter(Boolean))];
+  if (stampRepos.length) { store.meta.repos = store.meta.repos || {}; for (const k of stampRepos) store.meta.repos[k] = store.meta.fetched_at; }
+  try {
+    mkdirSync(dirname(storePath), { recursive: true });
+    writeFileSync(storePath, JSON.stringify(store), "utf8");
+  } catch (error) {
+    return { ok: false, error: `store write failed: ${error.message}`, errors };
+  }
+  return { ok: true, queried: pkgs.length, unsupported, vulnerable: wanted.size, fetched, saved: existsSync(storePath), errors };
+}

package/src/security/installed.js

@@ -0,0 +1,247 @@
+// Installed-package enumeration for supply-chain scanning: EXACT versions from lockfiles first
+// (package-lock v1/v2/v3, basic yarn.lock, requirements.txt ==pins, go.sum), plus a top-level
+// node_modules walk — which also yields the lockfile-DRIFT signal (installed ≠ locked → tampering or
+// stale install). Parsers are pure + exported for tests; collectInstalled is the thin fs wrapper.
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { parseGoMod } from "../analysis/manifests.js";
+import { uniqueBy } from "../util.js";
+
+const pep503 = (name) => String(name).toLowerCase().replace(/[-_.]+/g, "-"); // PyPI canonical name
+
+const dedupe = (list) => uniqueBy(list, (p) => `${p.ecosystem}|${p.name}|${p.version}`);
+
+export function parsePackageLock(json) {
+  const out = [];
+  const lockTracksScripts = Number(json?.lockfileVersion || 0) >= 2;
+  if (json && json.packages && typeof json.packages === "object") { // v2/v3
+    for (const [key, v] of Object.entries(json.packages)) {
+      if (!key.startsWith("node_modules/") || !v || !v.version) continue;
+      const name = key.slice(key.lastIndexOf("node_modules/") + "node_modules/".length); // nested a/node_modules/b → b
+      if (!name || name.startsWith(".")) continue;
+      const depth = key.split("node_modules/").length - 1; // 1 = hoisted top-level, 2+ = nested duplicate
+      out.push({ ecosystem: "npm", name, version: v.version, dev: !!v.dev, integrity: v.integrity || "", resolved: v.resolved || "", source: "package-lock", depth, hasInstallScript: lockTracksScripts ? !!v.hasInstallScript : undefined });
+    }
+  } else if (json && json.dependencies) { // v1 recursive tree
+    const walk = (deps, depth) => {
+      for (const [name, v] of Object.entries(deps || {})) {
+        if (v && v.version) out.push({ ecosystem: "npm", name, version: v.version, dev: !!v.dev, integrity: v.integrity || "", source: "package-lock", depth });
+        if (v && v.dependencies) walk(v.dependencies, depth + 1);
+      }
+    };
+    walk(json.dependencies, 1);
+  }
+  return dedupe(out);
+}
+
+// yarn.lock selector → the REAL package name. Handles classic `name@range`, `@scope/name@range`, the
+// `@npm:` protocol (`name@npm:range`), AND aliases (`react-is-18@npm:react-is@18.3.1` → react-is) —
+// yarn installs aliased majors in `react-is-18/` dirs whose package.json name is still "react-is", so
+// the lockfile must resolve to that real name or drift/vuln checks miss the aliased versions.
+export function yarnSelectorName(sel) {
+  const s = String(sel || "").trim().replace(/^"|"$/g, "");
+  const npm = s.indexOf("@npm:");
+  if (npm >= 0) {
+    const after = s.slice(npm + 5); // text after "@npm:" — either "realname@range" (alias) or just "range"
+    if (/^[a-z@]/i.test(after)) { // starts with a letter/scope → it's the real package name
+      const at = after.startsWith("@") ? after.indexOf("@", 1) : after.indexOf("@");
+      return at > 0 ? after.slice(0, at) : after;
+    }
+    return s.slice(0, npm); // "range" only → the real name is before @npm:
+  }
+  const at = s.lastIndexOf("@"); // classic name@range ; leading @ of a scope is index 0, ignored
+  return at > 0 ? s.slice(0, at) : "";
+}
+
+// yarn.lock (classic v1 format): `"name@^1.0.0", "name@~1.2":\n  version "1.2.3"`
+export function parseYarnLock(text) {
+  const out = [];
+  const re = /^((?:"[^\n]*")|(?:[^\s#"][^\n]*?)):\r?\n\s+version\s+"([^"]+)"/gm; // greedy quote span — selector lists like "a@^1", "a@~2": keep the full line
+  for (const m of String(text || "").matchAll(re)) {
+    const name = yarnSelectorName(m[1].split(",")[0]);
+    if (name) out.push({ ecosystem: "npm", name, version: m[2], dev: false, integrity: "", source: "yarn-lock" });
+  }
+  return dedupe(out);
+}
+
+// requirements.txt: pins that carry a concrete version — exact `==`/`===` AND compatible-release `~=`
+// (`~=1.26.8` floors at 1.26.8 within the 1.26.* series, a solid check target). Loose `>=`/`>`/`<`
+// have no single version, so they're skipped (unknown-installed, not a false pin).
+export function parseRequirements(text) {
+  const out = [];
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    if (!line || line.startsWith("-")) continue;
+    const m = line.match(/^([A-Za-z0-9][\w.-]*)\s*(===?|~=)\s*([\w.!+*-]+)/);
+    if (m) out.push({ ecosystem: "PyPI", name: pep503(m[1]), version: String(m[3]).replace(/\.\*$/, ""), dev: false, integrity: "", source: "requirements" });
+  }
+  return dedupe(out);
+}
+
+// A repo's virtualenv site-packages *.dist-info = the ACTUALLY-installed Python versions (the PyPI
+// equivalent of node_modules). Directory names are "<name>-<version>.dist-info". Windows Lib\ + posix lib\pythonX\.
+export function collectVenvPackages(repoPath, { readdir = readdirSync } = {}) {
+  const out = [];
+  for (const venv of [".venv", "venv", "env"]) {
+    const roots = [join(repoPath, venv, "Lib", "site-packages")]; // Windows layout
+    try { for (const d of readdir(join(repoPath, venv, "lib"))) if (/^python/i.test(String(d))) roots.push(join(repoPath, venv, "lib", String(d), "site-packages")); } catch { /* posix layout absent */ }
+    for (const sp of roots) {
+      let entries;
+      try { entries = readdir(sp); } catch { continue; }
+      for (const e of entries) {
+        const m = String(e).match(/^(.+?)-(\d[\w.!+-]*)\.dist-info$/);
+        if (m) out.push({ ecosystem: "PyPI", name: pep503(m[1]), version: m[2], dev: false, integrity: "", source: "venv" });
+      }
+    }
+  }
+  return dedupe(out);
+}
+
+// poetry.lock / uv.lock — same TOML shape: [[package]] blocks with name/version lines
+export function parseTomlLockPackages(text, source) {
+  const out = [];
+  let name = "", inPkg = false;
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (/^\[\[package\]\]$/.test(line)) { inPkg = true; name = ""; continue; }
+    if (/^\[/.test(line)) { inPkg = false; continue; } // any other table ends the package header block
+    if (!inPkg) continue;
+    let m = line.match(/^name\s*=\s*"([^"]+)"/);
+    if (m) { name = m[1]; continue; }
+    m = line.match(/^version\s*=\s*"([^"]+)"/);
+    if (m && name) { out.push({ ecosystem: "PyPI", name: pep503(name), version: m[1], dev: false, integrity: "", source }); name = ""; }
+  }
+  return dedupe(out);
+}
+
+// Pipfile.lock: JSON { default: { name: {version:"==1.2.3"} }, develop: {…} }
+export function parsePipfileLock(json) {
+  const out = [];
+  for (const [section, dev] of [["default", false], ["develop", true]]) {
+    for (const [name, v] of Object.entries((json && json[section]) || {})) {
+      const ver = String((v && v.version) || "").replace(/^==/, "");
+      if (ver) out.push({ ecosystem: "PyPI", name: pep503(name), version: ver, dev, integrity: "", source: "pipfile-lock" });
+    }
+  }
+  return dedupe(out);
+}
+
+// go.sum: "module v1.2.3 h1:hash" (skip /go.mod hash lines). OSV Go versions have no leading v.
+export function parseGoSum(text) {
+  const out = [];
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const m = raw.trim().match(/^(\S+)\s+v([\w.+-]+?)(\/go\.mod)?\s+h1:/);
+    if (m && !m[3]) out.push({ ecosystem: "Go", name: m[1], version: m[2], dev: false, integrity: "", source: "go-sum" });
+  }
+  return dedupe(out);
+}
+
+// go.mod require versions — the fallback when there is no go.sum (fresh checkout / `go mod download`
+// not run). Pseudo-versions (v0.0.0-<ts>-<commit>) won't match OSV cleanly, but exact tags do; go.sum
+// (when present) supersedes these via dedupe. Leading `v` stripped to match OSV's Go versions.
+export function parseGoModPackages(text) {
+  return dedupe(parseGoMod(text).requires.map((r) => ({ ecosystem: "Go", name: r.path, version: String(r.version).replace(/^v/, ""), dev: !!r.indirect, integrity: "", source: "go-mod" })));
+}
+
+// Top-level node_modules walk (incl. @scopes): the ground truth of what is REALLY on disk.
+function walkNodeModules(repoPath) {
+  const out = [];
+  const nm = join(repoPath, "node_modules");
+  const readPkg = (dir, name) => {
+    try {
+      const pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      if (pj && pj.version) out.push({ ecosystem: "npm", name: pj.name || name, version: pj.version, dev: false, integrity: "", source: "node_modules" });
+    } catch { /* not a package dir */ }
+  };
+  let entries;
+  try { entries = readdirSync(nm); } catch { return out; }
+  for (const e of entries) {
+    if (e.startsWith(".")) continue;
+    if (e.startsWith("@")) {
+      let scoped; try { scoped = readdirSync(join(nm, e)); } catch { continue; }
+      for (const s of scoped) readPkg(join(nm, e, s), `${e}/${s}`);
+    } else readPkg(join(nm, e), e);
+  }
+  return out;
+}
+
+const readText = (p) => { try { return readFileSync(p, "utf8"); } catch { return null; } };
+const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
+
+const SUBPROJECT_SKIP = new Set([".git", ".idea", ".vscode", ".venv", "venv", "env", "node_modules", "vendor", "dist", "build", "coverage", "__pycache__", ".tox", "testdata"]);
+
+function projectDirs(repoPath) {
+  const dirs = [repoPath];
+  let entries = [];
+  try { entries = readdirSync(repoPath, { withFileTypes: true }); } catch { return dirs; }
+  for (const e of entries) {
+    if (!e.isDirectory() || e.name.startsWith(".") || SUBPROJECT_SKIP.has(e.name)) continue;
+    dirs.push(join(repoPath, e.name));
+    if (dirs.length >= 101) break;
+  }
+  return dirs;
+}
+
+function collectReqFiles(dir) {
+  const reqFiles = [];
+  try { for (const n of readdirSync(dir)) if (/^requirements[\w.-]*\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, n)); } catch { /* unreadable root */ }
+  try { for (const n of readdirSync(join(dir, "requirements"))) if (/\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, "requirements", n)); } catch { /* no requirements/ dir */ }
+  return reqFiles;
+}
+
+// → { installed: [{ecosystem,name,version,dev,source}], drift: [{name, locked, installed}] }
+export function collectInstalled(repoPath) {
+  const dirs = projectDirs(repoPath);
+  const lock = [];
+  const yarn = [];
+  const disk = [];
+  for (const dir of dirs) {
+    const lockHere = parsePackageLock(readJson(join(dir, "package-lock.json")) || {});
+    lock.push(...lockHere);
+    if (!lockHere.length) yarn.push(...parseYarnLock(readText(join(dir, "yarn.lock")) || ""));
+    disk.push(...walkNodeModules(dir));
+  }
+  // Python: venv site-packages = the ground truth (exact installed versions); requirements*.txt (root +
+  // a requirements/ dir) and poetry/uv/Pipfile locks fill in when there's no venv. venv wins per name.
+  const venvPy = dirs.flatMap((dir) => collectVenvPackages(dir));
+  const reqFiles = dirs.flatMap((dir) => collectReqFiles(dir));
+  const venvNames = new Set(venvPy.map((p) => p.name));
+  const pyDeclared = [
+    ...reqFiles.flatMap((f) => parseRequirements(readText(f) || "")),
+    ...dirs.flatMap((dir) => parseTomlLockPackages(readText(join(dir, "poetry.lock")) || "", "poetry-lock")),
+    ...dirs.flatMap((dir) => parseTomlLockPackages(readText(join(dir, "uv.lock")) || "", "uv-lock")),
+    ...dirs.flatMap((dir) => parsePipfileLock(readJson(join(dir, "Pipfile.lock")) || null)),
+  ].filter((p) => !venvNames.has(p.name)); // installed version supersedes the declared pin
+  const py = [...venvPy, ...pyDeclared];
+  // Go: go.sum (exact, hashed) first, then go.mod require versions as a fallback. Walk the repo root
+  // AND its immediate subdirectories so a Go MONOREPO (per-folder modules, no root go.mod — e.g. gpro)
+  // still scans; dedupe() collapses the go.sum/go.mod overlap and cross-module shared deps.
+  const goFromDir = (dir) => [...parseGoSum(readText(join(dir, "go.sum")) || ""), ...parseGoModPackages(readText(join(dir, "go.mod")) || "")];
+  const go = [...goFromDir(repoPath)];
+  if (!go.length || existsSync(join(repoPath, "go.work"))) {
+    let subs = [];
+    try { subs = readdirSync(repoPath, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !["node_modules", "vendor", "dist", "build", "testdata"].includes(e.name)); } catch { /* unreadable root */ }
+    for (const s of subs.slice(0, 100)) go.push(...goFromDir(join(repoPath, s.name)));
+  }
+
+  // lockfile wins as the version source; disk fills gaps + powers the drift signal. A package
+  // legitimately appears at SEVERAL versions in a lockfile (yarn/npm nest transitive duplicates), so
+  // track the FULL SET of locked versions per name. "Drift" = the installed version matches NONE of
+  // them — the old code compared against ONE arbitrarily-picked entry, which faked drift (a top-level
+  // @babel/code-frame@7.29.7 flagged against a nested 8.0.0 that is ALSO legitimately locked+installed).
+  const locked = new Map();       // name -> representative entry (hoisted/lowest-depth) = the version source
+  const lockedVers = new Map();   // name -> Set(every locked version)
+  for (const p of [...yarn, ...lock]) {
+    const prev = locked.get(p.name);
+    if (!prev || (p.depth || 1) < (prev.depth || 1)) locked.set(p.name, p); // strictly-lower depth = hoisted
+    (lockedVers.get(p.name) || lockedVers.set(p.name, new Set()).get(p.name)).add(p.version);
+  }
+  const merged = [...locked.values()];
+  const drift = [];
+  for (const d of disk) {
+    const vers = lockedVers.get(d.name);
+    if (!vers) merged.push(d);
+    else if (!vers.has(d.version)) drift.push({ name: d.name, locked: locked.get(d.name).version, installed: d.version });
+  }
+  return { installed: dedupe([...merged, ...py, ...go]), drift };
+}