weavatrix 0.1.0

package/src/analysis/duplicates.compute.js

@@ -0,0 +1,215 @@
+// duplicates.compute.js — fragment extraction, inverted-index pairing, and the computeDuplicates
+// pipeline (split from duplicates.js; see the facade there for the full algorithm overview).
+import { readFileSync, readdirSync } from "node:fs";
+import { join, extname } from "node:path";
+import { isTestPath } from "../graph/graph-filter.js";
+import { stripNonCode, bodyEndLineCount, tokenize, fingerprints, extractLargeStrings } from "./duplicates.tokenize.js";
+
+const FLOOR_TOKENS = 30;   // fragments below this never enter the index (UI slider min)
+const FLOOR_SIM = 0.5;     // pairs below this are not reported (UI slider min)
+const MAX_BODY_LINES = 400;
+// File types with no code SYMBOLS to fragment (stylesheets, markup, docs, single-file components). The
+// user still wants them clone-checked ("check the frontend / md too"), so each is sliced into fixed line
+// WINDOWS and each window is fingerprinted like a function body — a duplicated CSS rule block / HTML
+// section / doc passage then clones the same way.
+const WINDOW_EXTS = /\.(css|scss|sass|less|styl|html?|md|markdown|mdx|vue|svelte|astro)$/i;
+const WINDOW_LINES = 24;   // non-overlapping block size for windowed files
+// Asset files are DEDUP-ONLY — they are NOT put in the code graph (that would score md/css as fake
+// "methods" in Health and clutter the GUI board), so the clone scanner finds them by walking the repo.
+const WALK_SKIP = new Set(["node_modules", ".git", "dist", "build", "coverage", "vendor", "weavatrix-graphs", ".next", "out", "__pycache__", ".venv", "venv", "site-packages"]);
+const MAX_ASSET_FILES = 4000;
+function walkAssets(root, dir, acc, depth) {
+  if (depth > 40 || acc.length >= MAX_ASSET_FILES) return acc;
+  let entries; try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return acc; }
+  for (const e of entries) {
+    if (acc.length >= MAX_ASSET_FILES) break;
+    if (e.name.startsWith(".") || WALK_SKIP.has(e.name)) continue;
+    const full = join(dir, e.name);
+    if (e.isDirectory()) walkAssets(root, full, acc, depth + 1);
+    else if (WINDOW_EXTS.test(e.name)) acc.push(full.slice(root.length + 1).replace(/\\/g, "/"));
+  }
+  return acc;
+}
+// Fingerprints shared by MORE than this many fragments are ubiquitous boilerplate and are excluded
+// from BOTH the shared count AND the union (so jaccard stays honest — see pairsForMode). Set well
+// above realistic clone multiplicity: N byte-identical copies each put all their fingerprints in
+// buckets of size N, so the cap must exceed N or the whole clone family is invisible. 120 covers all
+// but pathological mass-duplication; the O(n²) pair work per bucket stays bounded by it.
+const BUCKET_CAP = 120;
+// A clone must share at least this many DISTINCT (non-ubiquitous) fingerprints. Winnowing collapses a
+// UNIFORM repetitive body (a constant table where every line is `KEY: 'VALUE',` → renamed `I: <str>`) to a
+// handful of fingerprints, so two UNRELATED such tables hit 100% renamed Jaccard on ~3-6 shared fingerprints
+// — "same shape, zero shared content". Requiring real shared evidence drops those false positives while a
+// genuine clone (which shares dozens of fingerprints) is untouched.
+const MIN_SHARED_FP = 8;
+
+// Same-name symbols across DIFFERENT files — the semantic complement to token clones. A token clone
+// says "same body"; a name twin with LOW similarity says "same name, different behavior" — the
+// drift-hazard class of duplicate (three divergent uniqueStrings() implementations) that jaccard
+// ranks too low to surface. OOP-generic lifecycle names are stoplisted; interface implementations
+// still appear, so the caller's report keeps neutral wording.
+const TWIN_STOP = new Set(["constructor", "tostring", "valueof", "dispose", "close", "render", "setup", "teardown", "initialize", "destroy", "connect", "disconnect", "update", "reset", "clear", "create", "handle", "execute", "invoke", "main", "start", "stop", "build", "parse", "value", "index"]);
+function computeNameTwins(frags) {
+  const byName = new Map();
+  frags.forEach((f, i) => {
+    if (f.kind === "string") return;
+    const name = String(f.label || "").trim().replace(/\(\)$/, "");
+    if (name.length < 5 || !/^[A-Za-z_$][\w$]*$/.test(name) || TWIN_STOP.has(name.toLowerCase())) return;
+    const key = name.toLowerCase();
+    let a = byName.get(key); if (!a) byName.set(key, (a = []));
+    a.push(i);
+  });
+  const jac = (A, B) => { let inter = 0; for (const h of A) if (B.has(h)) inter++; const u = A.size + B.size - inter; return u ? inter / u : 0; };
+  const out = [];
+  for (const idxs of byName.values()) {
+    const files = new Set(idxs.map((i) => frags[i].file));
+    if (files.size < 2 || idxs.length > 12) continue; // single-file overloads / framework-name explosions
+    let simMin = 1, simMax = 0;
+    for (let a = 0; a < idxs.length; a++) for (let b = a + 1; b < idxs.length; b++) {
+      if (frags[idxs[a]].file === frags[idxs[b]].file) continue;
+      const s = jac(frags[idxs[a]].fp.renamed, frags[idxs[b]].fp.renamed);
+      if (s < simMin) simMin = s;
+      if (s > simMax) simMax = s;
+    }
+    out.push({
+      label: String(frags[idxs[0]].label || "").replace(/\(\)$/, ""), members: idxs, files: files.size,
+      simMin: Math.round(simMin * 100), simMax: Math.round(simMax * 100),
+      tokens: idxs.reduce((n, i) => n + frags[i].n, 0),
+    });
+  }
+  return out.sort((x, y) => y.tokens - x.tokens).slice(0, 200);
+}
+
+function pairsForMode(frags, mode) {
+  const index = new Map();
+  frags.forEach((f, i) => { for (const h of f.fp[mode]) { let a = index.get(h); if (!a) index.set(h, (a = [])); a.push(i); } });
+  // eff[i] = count of i's fingerprints that sit in NON-ubiquitous buckets. Jaccard's numerator (shared)
+  // and denominator (union) are BOTH computed over this same restricted set, so excluding a boilerplate
+  // fingerprint never deflates similarity — two real clones sharing a widely-repeated preamble still
+  // pair at 100% on their unique bodies, and the sim is a true jaccard, not an under-count.
+  const eff = new Array(frags.length).fill(0);
+  const shared = new Map();
+  for (const arr of index.values()) {
+    if (arr.length > BUCKET_CAP) continue; // ubiquitous k-gram → excluded from count AND size (both sides)
+    for (const idx of arr) eff[idx]++;
+    for (let a = 0; a < arr.length; a++) for (let b = a + 1; b < arr.length; b++) {
+      const key = arr[a] * 1000000 + arr[b]; // frag count is bounded way below 1e6
+      shared.set(key, (shared.get(key) || 0) + 1);
+    }
+  }
+  const pairs = [];
+  for (const [key, count] of shared) {
+    const i = Math.floor(key / 1000000), j = key % 1000000;
+    const union = eff[i] + eff[j] - count;
+    const sim = union > 0 ? count / union : 0;
+    if (sim >= FLOOR_SIM && count >= MIN_SHARED_FP) pairs.push([i, j, Math.round(sim * 100)]);
+  }
+  return pairs;
+}
+
+// Parse "L<line>" graph symbol locations into per-file ordered symbol lists.
+function symbolRanges(graph) {
+  const byFile = new Map();
+  for (const n of graph.nodes || []) {
+    if (!n.source_file || !String(n.id || "").includes("#")) continue;
+    const line = Number((String(n.source_location || "").match(/L(\d+)/) || [])[1] || 0);
+    if (!line) continue;
+    let arr = byFile.get(n.source_file);
+    if (!arr) byFile.set(n.source_file, (arr = []));
+    arr.push({ id: n.id, label: n.label || n.id, line });
+  }
+  for (const arr of byFile.values()) arr.sort((a, b) => a.line - b.line);
+  return byFile;
+}
+
+export function computeDuplicates(repoPath, graphJsonPath, opts = {}) {
+  const includeStrings = !!opts.includeStrings;
+  const graph = JSON.parse(readFileSync(graphJsonPath, "utf8"));
+  const byFile = symbolRanges(graph);
+  // total symbol nodes in the graph — 0 means a file-only graph (built by an older builder before
+  // symbol extraction, or a stale graph): clone detection has nothing to work with, and the UI must
+  // say "rebuild the graph" instead of the misleading "no clones at these thresholds".
+  let graphSymbols = 0;
+  for (const arr of byFile.values()) graphSymbols += arr.length;
+  const frags = [];
+  for (const [file, syms] of byFile) {
+    const full = join(repoPath, file);
+    let lines;
+    try { lines = readFileSync(full, "utf8").split(/\r?\n/); } catch { continue; }
+    const py = /\.py$/i.test(file);
+    for (let i = 0; i < syms.length; i++) {
+      const start = syms[i].line;
+      // hard cap first (next symbol, or EOF, whichever comes first, ≤ MAX_BODY_LINES) …
+      const hardEnd = Math.min(i + 1 < syms.length ? syms[i + 1].line - 1 : lines.length, start + MAX_BODY_LINES);
+      if (hardEnd - start < 2) continue; // one-liners can't be meaningful clones
+      // … then shrink to where the construct actually closes, so the last symbol doesn't absorb
+      // trailing module-level code (module.exports tables, main() calls) up to EOF.
+      const bodyLines = lines.slice(start - 1, hardEnd);
+      const body = bodyLines.slice(0, bodyEndLineCount(bodyLines, py));
+      const end = start + body.length - 1;
+      if (end - start < 2) continue;
+      const toks = tokenize(stripNonCode(body.join("\n"), py));
+      if (toks.strict.length < FLOOR_TOKENS) continue;
+      frags.push({
+        id: syms[i].id, label: syms[i].label, file, start, end,
+        n: toks.strict.length,
+        test: isTestPath(file),
+        fp: { strict: fingerprints(toks.strict), renamed: fingerprints(toks.renamed) },
+      });
+    }
+    // ---- opt-in: large multi-line string literals as their own fragments. The code pass above strips
+    // string bodies (correctly — content isn't code), which makes embedded DSL templates (inline
+    // C#/SQL/PowerShell) invisible to clone detection. Tokenized RAW: the content IS the payload.
+    if (includeStrings) {
+      const base = file.split("/").pop();
+      const pushStr = (startLine, endLine, content) => {
+        const toks = tokenize(content);
+        if (toks.strict.length < FLOOR_TOKENS) return;
+        frags.push({
+          id: `${file}#str@${startLine}`, label: `${base}:${startLine} ~${endLine - startLine + 1}-line string`,
+          file, start: startLine, end: endLine, n: toks.strict.length, test: isTestPath(file), kind: "string",
+          fp: { strict: fingerprints(toks.strict), renamed: fingerprints(toks.renamed) },
+        });
+      };
+      for (const str of extractLargeStrings(lines.join("\n"), { py, cs: /\.cs$/i.test(file) })) {
+        const strLines = str.content.split(/\r?\n/).slice(0, MAX_BODY_LINES);
+        // A SECTION shared between two big templates dilutes below the similarity floor when the whole
+        // literals are compared (70 shared lines inside 220- and 107-line strings ≈ 27% jaccard). Big
+        // literals therefore get the same WINDOW treatment as CSS/HTML files; small ones stay whole.
+        if (strLines.length <= WINDOW_LINES * 2) {
+          pushStr(str.start, str.start + strLines.length - 1, strLines.join("\n"));
+        } else {
+          for (let off = 0; off < strLines.length; off += WINDOW_LINES) {
+            const chunk = strLines.slice(off, off + WINDOW_LINES);
+            if (chunk.length < 3) break;
+            pushStr(str.start + off, str.start + off + chunk.length - 1, chunk.join("\n"));
+          }
+        }
+      }
+    }
+  }
+  // ---- windowed fragments for symbol-less file types (CSS/HTML/MD/…), found by walking the repo (NOT the
+  // graph — assets are dedup-only). Each file is sliced into WINDOW_LINES blocks and fingerprinted.
+  const symFiles = new Set(byFile.keys());
+  for (const file of walkAssets(repoPath, repoPath, [], 0)) {
+    if (symFiles.has(file)) continue;
+    let lines;
+    try { lines = readFileSync(join(repoPath, file), "utf8").split(/\r?\n/); } catch { continue; }
+    for (let start = 1; start <= lines.length; start += WINDOW_LINES) {
+      const end = Math.min(start + WINDOW_LINES - 1, lines.length);
+      if (end - start < 2) continue;
+      const toks = tokenize(stripNonCode(lines.slice(start - 1, end).join("\n"), false));
+      if (toks.strict.length < FLOOR_TOKENS) continue;
+      frags.push({
+        id: `${file}#win@${start}`, label: `${file.split("/").pop()}:${start}-${end}`, file, start, end,
+        n: toks.strict.length, test: isTestPath(file),
+        fp: { strict: fingerprints(toks.strict), renamed: fingerprints(toks.renamed) },
+      });
+    }
+  }
+  const modes = { strict: pairsForMode(frags, "strict"), renamed: pairsForMode(frags, "renamed") };
+  const nameTwins = opts.nameTwins ? computeNameTwins(frags) : null;
+  // fp sets are worker-internal — strip them from the payload that crosses the thread boundary
+  const slim = frags.map(({ fp, ...rest }) => rest);
+  return { ok: true, frags: slim, modes, ...(nameTwins ? { nameTwins } : {}), graphSymbols, floors: { tokens: FLOOR_TOKENS, sim: FLOOR_SIM * 100 } };
+}

package/src/analysis/duplicates.js

@@ -0,0 +1,15 @@
+// duplicates.js — content-based clone detection over the repo's OWN graph.json symbols (the Health
+// tab's engine). MOSS-style pipeline: symbol bodies (line ranges from the graph) → strip comments &
+// string bodies → tokenize → k-gram rolling hashes → winnowing fingerprints → inverted index (no
+// O(n²) all-pairs) → jaccard similarity. BOTH normalization modes are computed in one pass so every
+// UI knob (similarity %, min size, strict/renamed) filters instantly on the renderer side:
+//   strict  — identifiers kept: only literal copy-paste (Type-1 clones)
+//   renamed — identifiers canonicalized to "I": catches copy-paste-then-rename (Type-2 clones)
+// Pairs are reported down to the FLOOR values; the renderer slices from there upward.
+//
+// Facade: the implementation lives in the sibling modules —
+//   duplicates.tokenize.js — stripping, body-end detection, tokenization, winnowing fingerprints
+//   duplicates.compute.js  — fragment extraction, inverted-index pairing, computeDuplicates
+//   duplicates.run.js      — worker offload + mtime cache (runDuplicates entry)
+export { computeDuplicates } from "./duplicates.compute.js";
+export { runDuplicates } from "./duplicates.run.js";

package/src/analysis/duplicates.run.js

@@ -0,0 +1,51 @@
+// duplicates.run.js — the repos:duplicates entry point (split from duplicates.js): worker-thread
+// offload with in-process fallback, cached per (repo, graph.json mtime).
+import { existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { Worker } from "node:worker_threads";
+import { graphOutDirForRepo } from "../graph/layout.js";
+import { computeDuplicates } from "./duplicates.compute.js";
+
+function computeInWorker(repoPath, graphJsonPath) {
+  return new Promise((resolve, reject) => {
+    let worker;
+    try {
+      worker = new Worker(new URL("./duplicates-worker.js", import.meta.url), { workerData: { repoPath, graphJsonPath } });
+    } catch (e) {
+      reject(Object.assign(e, { workerStartFailed: true }));
+      return;
+    }
+    let settled = false;
+    const done = (fn, v) => { if (!settled) { settled = true; fn(v); } };
+    worker.once("message", (msg) => done(resolve, msg));
+    worker.once("error", (e) => done(reject, Object.assign(e, { workerStartFailed: true })));
+    worker.once("exit", (code) => { if (code !== 0) done(reject, Object.assign(new Error(`duplicates worker exited with code ${code}`), { workerStartFailed: true })); });
+  });
+}
+
+// repos:duplicates entry — cached per (repo, graph.json mtime): re-running with an unchanged graph is
+// free. `force` (the UI's ↻ rescan) bypasses the cache: fragment BODIES are read from live source, so a
+// source edit that didn't rebuild the graph (same mtime) must still be re-scanned on demand.
+const _cache = new Map();
+export async function runDuplicates(repoPath, force = false) {
+  const repo = String(repoPath || "");
+  if (!repo || !existsSync(repo)) return { ok: false, error: "Repo path not found" };
+  const graphJsonPath = join(graphOutDirForRepo(repo), "graph.json");
+  if (!existsSync(graphJsonPath)) {
+    return { ok: false, needsGraph: true, error: "No graph yet — build the Relations graph first (↻ on the Relations tab)" };
+  }
+  let mtime = 0;
+  try { mtime = statSync(graphJsonPath).mtimeMs; } catch { /* treat as uncached */ }
+  const cached = _cache.get(repo);
+  if (!force && cached && cached.mtime === mtime) return cached.result;
+  let result;
+  try {
+    result = await computeInWorker(repo, graphJsonPath);
+  } catch (e) {
+    if (!e || !e.workerStartFailed) return { ok: false, error: e.message || String(e) };
+    try { result = computeDuplicates(repo, graphJsonPath); } // in-process fallback (exotic packaging)
+    catch (e2) { return { ok: false, error: e2.message || String(e2) }; }
+  }
+  if (result && result.ok) _cache.set(repo, { mtime, result });
+  return result;
+}

package/src/analysis/duplicates.tokenize.js

@@ -0,0 +1,182 @@
+// duplicates.tokenize.js — lexical layer of the clone detector (split from duplicates.js): comment &
+// string stripping, body-end detection, strict/renamed tokenization, and winnowing fingerprints.
+
+const K = 8;               // k-gram length (tokens)
+const W = 4;               // winnowing window → guaranteed detection of matches ≥ K+W-1 tokens
+const STRLIT = String.fromCharCode(0); // opaque-literal sentinel for every string/regex body: a NUL
+                           // its own class (never an identifier "I" nor a number "N"), so a literal can
+                           // never masquerade as code in either mode
+
+const KEYWORDS = new Set(("if else for while do switch case break continue return function const let var new class extends async await try catch finally throw import from export default typeof instanceof in of delete void yield static get set this super null undefined true false def elif except lambda pass raise with as is not and or None True False func go defer chan map range struct interface type package nil err string int bool byte float64 public private protected final void long double boolean").split(" "));
+
+// A leading `/` is a REGEX literal (not division) when the previous significant char is one of these
+// or the fragment start; after a word char / ) / ] it is division. Covers .match(/…/), = /…/, (/…/),
+// and arrow `x => /…/`. NOTE: `+` and `-` are deliberately EXCLUDED — a regex never legitimately
+// follows them, but `i++ / 2` and `a - b / c` do, and including them mis-scanned the division as a
+// regex and ate the rest of the line.
+const REGEX_PREV = new Set("(,=:[!&|?{};~*%^<>".split(""));
+
+// Replace comments with nothing and string/regex BODIES with the sentinel, so their contents never
+// count as code. Handles Python triple-quoted docstrings (embedded quotes no longer desync the scan)
+// and JS regex literals (a quote inside /['"]/ no longer opens a phantom string).
+export function stripNonCode(text, py) {
+  let out = "", i = 0, prevSig = "";
+  const s = String(text || "");
+  const push = (c) => { out += c; const t = c.trim(); if (t) prevSig = t[t.length - 1]; };
+  while (i < s.length) {
+    const ch = s[i], two = s.slice(i, i + 2), three = s.slice(i, i + 3);
+    if (py && ch === "#") { while (i < s.length && s[i] !== "\n") i++; continue; }
+    if (py && (three === "'''" || three === '"""')) {
+      i += 3;
+      while (i < s.length && s.slice(i, i + 3) !== three) i++;
+      i += 3; push(` ${STRLIT} `); continue;
+    }
+    if (!py && two === "//") { while (i < s.length && s[i] !== "\n") i++; continue; }
+    if (!py && two === "/*") { i += 2; while (i < s.length && s.slice(i, i + 2) !== "*/") i++; i += 2; continue; }
+    if (!py && ch === "/" && REGEX_PREV.has(prevSig)) {
+      i++; let inClass = false; // '/' inside a [...] char class is literal, not the terminator
+      while (i < s.length && s[i] !== "\n") {
+        const c = s[i];
+        if (c === "\\") { i += 2; continue; }
+        if (c === "[") inClass = true;
+        else if (c === "]") inClass = false;
+        else if (c === "/" && !inClass) { i++; break; }
+        i++;
+      }
+      while (i < s.length && /[a-z]/i.test(s[i])) i++; // regex flags (gimsuy)
+      push(` ${STRLIT} `); continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const q = ch; i++;
+      while (i < s.length && s[i] !== q) { if (s[i] === "\\") i++; i++; }
+      i++; push(` ${STRLIT} `); continue;
+    }
+    push(ch); i++;
+  }
+  return out;
+}
+
+// Where a symbol's body ends — so the LAST symbol in a file doesn't swallow trailing module-level code
+// (module.exports tables, main() calls, handler registrations) up to EOF and dilute/misattribute
+// clones. Brace/bracket depth for brace langs (body ends when {}()[] balance after first opening);
+// indentation for Python. Returns a 1-based line count within bodyLines (≤ its length; = its length
+// when the construct never closes, so the caller's cap stands).
+export function bodyEndLineCount(bodyLines, py) {
+  if (py) {
+    const base = bodyLines[0].match(/^[ \t]*/)[0].length;
+    let last = 1;
+    for (let k = 1; k < bodyLines.length; k++) {
+      const ln = bodyLines[k];
+      if (!ln.trim()) continue; // blank lines never end a block
+      if (ln.match(/^[ \t]*/)[0].length <= base) return last; // dedent to ≤ the def → body ended above
+      last = k + 1;
+    }
+    return bodyLines.length;
+  }
+  const text = bodyLines.join("\n");
+  let depth = 0, opened = false, i = 0, line = 1, prevSig = "";
+  while (i < text.length) {
+    const ch = text[i], two = text.slice(i, i + 2);
+    if (ch === "\n") { line++; i++; continue; }
+    if (two === "//") { while (i < text.length && text[i] !== "\n") i++; continue; }
+    if (two === "/*") { i += 2; while (i < text.length && text.slice(i, i + 2) !== "*/") { if (text[i] === "\n") line++; i++; } i += 2; continue; }
+    if (ch === "/" && REGEX_PREV.has(prevSig)) {
+      i++; let inClass = false;
+      while (i < text.length && text[i] !== "\n") { const c = text[i]; if (c === "\\") { i += 2; continue; } if (c === "[") inClass = true; else if (c === "]") inClass = false; else if (c === "/" && !inClass) { i++; break; } i++; }
+      prevSig = "/"; continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") { const q = ch; i++; while (i < text.length && text[i] !== q) { if (text[i] === "\\") i++; else if (text[i] === "\n") line++; i++; } i++; prevSig = q; continue; }
+    // depth tracks all brackets, but only a { or [ opens the BODY — a bare (param list) returning to
+    // depth 0 must not be read as the construct closing on line 1
+    if (ch === "{" || ch === "(" || ch === "[") { depth++; if (ch === "{" || ch === "[") opened = true; }
+    else if (ch === "}" || ch === ")" || ch === "]") { depth--; if (opened && depth <= 0) return line; }
+    if (ch.trim()) prevSig = ch;
+    i++;
+  }
+  return bodyLines.length;
+}
+
+// Large multi-line string literals — the OPPOSITE selection to stripNonCode: everything the code
+// scan throws away. Embedded DSLs (inline C#/SQL/PowerShell templates) are invisible to the normal
+// clone pass because their bodies are stripped; this extractor feeds them back in as their own
+// fragments when the caller opts in (find_duplicates include_strings). Comment/regex handling
+// mirrors stripNonCode so a quote inside a comment never opens a phantom literal.
+export function extractLargeStrings(text, { py = false, cs = false, minLines = 6 } = {}) {
+  const s = String(text || "");
+  const out = [];
+  let i = 0, line = 1, prevSig = "";
+  const capture = (from, to, startLine) => {
+    const content = s.slice(from, to);
+    const nl = (content.match(/\n/g) || []).length;
+    if (nl + 1 >= minLines) out.push({ start: startLine, end: startLine + nl, content });
+  };
+  while (i < s.length) {
+    const ch = s[i], two = s.slice(i, i + 2), three = s.slice(i, i + 3);
+    if (ch === "\n") { line++; i++; continue; }
+    if (py && ch === "#") { while (i < s.length && s[i] !== "\n") i++; continue; }
+    if (py && (three === "'''" || three === '"""')) {
+      const startLine = line; i += 3; const from = i;
+      while (i < s.length && s.slice(i, i + 3) !== three) { if (s[i] === "\n") line++; i++; }
+      capture(from, i, startLine); i += 3; continue;
+    }
+    if (!py && two === "//") { while (i < s.length && s[i] !== "\n") i++; continue; }
+    if (!py && two === "/*") { i += 2; while (i < s.length && s.slice(i, i + 2) !== "*/") { if (s[i] === "\n") line++; i++; } i += 2; continue; }
+    if (!py && ch === "/" && REGEX_PREV.has(prevSig)) {
+      i++; let inClass = false;
+      while (i < s.length && s[i] !== "\n") { const c = s[i]; if (c === "\\") { i += 2; continue; } if (c === "[") inClass = true; else if (c === "]") inClass = false; else if (c === "/" && !inClass) { i++; break; } i++; }
+      prevSig = "/"; continue;
+    }
+    if (cs && two === '@"') { // C# verbatim string; "" is the escaped quote
+      const startLine = line; i += 2; const from = i;
+      while (i < s.length) { if (s.slice(i, i + 2) === '""') { i += 2; continue; } if (s[i] === '"') break; if (s[i] === "\n") line++; i++; }
+      capture(from, i, startLine); i++; continue;
+    }
+    if (!py && ch === "`") { // JS/TS template literal — the main multi-line carrier
+      const startLine = line; i++; const from = i;
+      while (i < s.length && s[i] !== "`") { if (s[i] === "\\") { i++; if (s[i] === "\n") line++; i++; continue; } if (s[i] === "\n") line++; i++; }
+      capture(from, i, startLine); i++; continue;
+    }
+    if (ch === '"' || ch === "'") { // single-line strings can't span minLines — just skip past
+      const q = ch; i++;
+      while (i < s.length && s[i] !== q && s[i] !== "\n") { if (s[i] === "\\") i++; i++; }
+      if (s[i] === q) i++; continue;
+    }
+    if (ch.trim()) prevSig = ch;
+    i++;
+  }
+  return out;
+}
+
+// one raw token stream; the two modes differ only in identifier canonicalization
+export function tokenize(text) {
+  const raw = text.match(/[A-Za-z_$][\w$]*|\d+(?:\.\d+)?|[^\s\w]/g) || [];
+  const strict = [];
+  const renamed = [];
+  for (const t of raw) {
+    if (/^\d/.test(t)) { strict.push("N"); renamed.push("N"); continue; }
+    if (/^[A-Za-z_$]/.test(t) && !KEYWORDS.has(t)) { strict.push(t); renamed.push("I"); continue; }
+    strict.push(t); renamed.push(t);
+  }
+  return { strict, renamed };
+}
+
+export function fingerprints(toks) {
+  if (toks.length < K + W - 1) return new Set();
+  const hashes = [];
+  for (let i = 0; i + K <= toks.length; i++) {
+    let h = 0;
+    for (let j = i; j < i + K; j++) {
+      const s = toks[j];
+      for (let c = 0; c < s.length; c++) h = (h * 31 + s.charCodeAt(c)) | 0;
+      h = (h * 131) | 0;
+    }
+    hashes.push(h >>> 0);
+  }
+  const fp = new Set();
+  for (let i = 0; i + W <= hashes.length + 1; i++) {
+    let min = Infinity;
+    for (let j = i; j < Math.min(i + W, hashes.length); j++) if (hashes[j] < min) min = hashes[j];
+    fp.add(min);
+  }
+  return fp;
+}

package/src/analysis/endpoints.js

@@ -0,0 +1,156 @@
+// endpoints.js — detect the repo's OWN HTTP API surface (routes it EXPOSES), so the Health tab can
+// surface endpoints the way infra towers surface the services a repo TALKS TO. Each endpoint carries a
+// best-effort handler NAME so the UI can join it to that method's health (O(n) complexity, criticality,
+// coverage). Covers the common shapes across JS/TS, Python and Go:
+//   • object routes (Bun.serve / custom):  "/path": { GET: handler, POST: fn }   |   "/path": handler
+//   • method-call routes (Express/Fastify/Koa/Hono/gin/echo):  app.get("/path", handler)
+//   • decorators (FastAPI/Flask/NestJS):   @app.get("/path")  /  @Get("/path")
+//   • Go net/http:                          mux.HandleFunc("/path", handler)
+import { join } from "node:path";
+import { safeRead } from "../util.js";
+
+const MAX_FILES = 3000;
+const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ALL", "ANY"]);
+// UNAMBIGUOUS HTTP CLIENTS (make requests) vs servers (define routes) — reject `axios.get("/x")`-style client
+// calls in frontend code. Ambiguous names (api/client/service — could be a server router) are NOT listed;
+// they're filtered by the handler requirement instead (a client call has no handler / a config object arg).
+const HTTP_CLIENT_CALLER = /^(axios|https?|fetch|ky|got|superagent|needle|undici|xhr|\$http|http[Cc]lient|api[Cc]lient|rest[Cc]lient)$/;
+
+
+// 1-based line of a string index
+function lineAt(text, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < text.length; i++) if (text[i] === "\n") line++;
+  return line;
+}
+
+// best-effort bare handler name from a value expression: the LAST identifier, unwrapping wrappers like
+// executionRoute(queryHandlers.executeQuery) → executeQuery, asyncHandler(fn) → fn, a.b.c → c.
+// An INLINE handler (arrow / function literal) has no named method to join to, so it returns "" (the
+// UI then shows "inline") — grabbing an identifier out of an arrow body only invents garbage names.
+function handlerName(expr) {
+  const s = String(expr || "").trim();
+  if (!s) return "";
+  if (/=>/.test(s) || /^\s*(async\s+)?function\b/.test(s)) return "";
+  const ids = s.match(/[A-Za-z_$][\w$]*/g);
+  if (!ids) return "";
+  const SKIP = new Set(["async", "function", "await", "req", "res", "ctx", "request", "response", "next", "return"]);
+  for (let i = ids.length - 1; i >= 0; i--) if (!SKIP.has(ids[i])) return ids[i];
+  return "";
+}
+
+// An OpenAPI / Swagger spec object (e.g. `*.openapi.js` `paths`) documents routes rather than serving
+// them — its "handlers" are operation()/spec objects, so treating it as a route table produced fake
+// endpoints (handler "operation", {id} params). These keys never appear in a real route/handler table.
+const OPENAPI_BLOCK = /\boperationId\b|\bresponses\s*:|\brequestBody\b|\bschemaRef\b|\boperation\s*\(|\bsummary\s*:/;
+
+const looksLikePath = (p) => typeof p === "string" && /^\/[\w\-./:{}*$]*$/.test(p) && !p.includes("://");
+const cleanPath = (p) => String(p || "").replace(/\/+$/, "") || "/";
+
+export function extractEndpointsFromText(text, file) {
+  const out = [];
+  const py = /\.py$/i.test(file);
+  const add = (method, path, expr, idx) => {
+    const p = cleanPath(path);
+    if (!looksLikePath(p)) return;
+    const m = String(method || "ANY").toUpperCase();
+    if (!HTTP_METHODS.has(m)) return;
+    out.push({ method: m, path: p, handler: handlerName(expr), file, line: lineAt(text, idx) });
+  };
+
+  // ---- object routes: "/path": { GET: fn, POST: fn2 }  or  "/path": handler --------------------
+  // find each  "…": {  or  "…": expr,  where the key looks like a path
+  const objKeyRe = /(["'`])(\/[^"'`]*)\1\s*:\s*(\{)?/g;
+  let m;
+  while ((m = objKeyRe.exec(text))) {
+    const path = m[2], keyIdx = m.index;
+    if (m[3]) {
+      // object of METHOD: handler — scan to the matching close brace (routes objects are shallow)
+      let i = objKeyRe.lastIndex, depth = 1;
+      const start = i;
+      while (i < text.length && depth > 0) { const c = text[i]; if (c === "{") depth++; else if (c === "}") depth--; i++; }
+      const body = text.slice(start, i - 1);
+      objKeyRe.lastIndex = i;
+      if (OPENAPI_BLOCK.test(body)) continue; // documentation, not a route table
+      const methodRe = /\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b\s*:\s*([^,\n}]+)/gi;
+      let mm;
+      while ((mm = methodRe.exec(body))) add(mm[1], path, mm[2], keyIdx);
+    } else {
+      // "/path": handlerExpr — a direct handler (any method); grab up to the next , or }
+      const tail = text.slice(objKeyRe.lastIndex, objKeyRe.lastIndex + 200);
+      const em = /^([^,\n}]+)/.exec(tail);
+      if (em && !/^\s*\{/.test(em[1])) add("ANY", path, em[1], keyIdx);
+    }
+  }
+
+  // ---- method-call routes: app.get("/path", handler) / router.post(...) / r.GET(...) ------------
+  // (?<!@) so a DECORATOR like @router.get("/x") isn't also caught here (handler-less); decorators are
+  // handled separately below where the handler is the following def. The CALLER is captured so we can reject
+  // CLIENT HTTP calls (axios.get("/api/users"), http.get(url), apiClient.post(...)) — those are requests in
+  // FRONTEND code, not server routes. A server route also REQUIRES a handler arg (an identifier/function),
+  // so a bare `client.get("/x")` or one whose 2nd arg is a config object literal `{…}` is skipped.
+  const callRe = /(?<!@)\b([\w$]+)\s*\.\s*(get|post|put|patch|delete|head|options|all)\s*\(\s*(["'`])(\/[^"'`]*)\3\s*(?:,\s*([\s\S]{0,160}?))?\)/gi;
+  while ((m = callRe.exec(text))) {
+    const caller = m[1], arg2 = String(m[5] || "").trim();
+    if (HTTP_CLIENT_CALLER.test(caller)) continue;          // axios/http/fetch/apiClient… → a client request
+    if (!arg2 || arg2[0] === "{") continue;                 // no handler, or a config object → not a route def
+    add(m[2], m[4], m[5] || "", m.index);
+  }
+
+  // ---- Go net/http: mux.HandleFunc("/path", handler) / http.Handle("/path", h) ------------------
+  const goRe = /\.\s*(?:HandleFunc|Handle)\s*\(\s*(["'`])(\/[^"'`]*)\1\s*,\s*([\s\S]{0,120}?)\)/g;
+  while ((m = goRe.exec(text))) add("ANY", m[2], m[3], m.index);
+
+  // ---- decorators: @app.get("/path") / @router.post("/path") / @Get("/path") -------------------
+  if (py || /\.(ts|js|tsx|jsx|cjs|mjs)$/i.test(file)) {
+    const decoRe = /@[\w$]*\.?\s*(get|post|put|patch|delete|head|options)\s*\(\s*(["'`])(\/[^"'`]*)\2/gi;
+    while ((m = decoRe.exec(text))) {
+      // the handler is the def/function on a following line — best-effort: next def name
+      const after = text.slice(decoRe.lastIndex, decoRe.lastIndex + 200);
+      const fn = /\b(?:def|async\s+def|function|const|export\s+function)\s+([A-Za-z_$][\w$]*)/.exec(after);
+      add(m[1], m[3], fn ? fn[1] : "", m.index);
+    }
+  }
+
+  return out;
+}
+
+// `{id}` (OpenAPI) and `:id` (JS routers) are the SAME route — normalize for dedup so a real handler
+// route isn't listed twice alongside its doc counterpart.
+const normParamKey = (p) => String(p).replace(/\{([^/}]+)\}/g, ":$1");
+
+// Detect endpoints across the repo's code files (from the graph's file nodes, or a caller-supplied list
+// of {path, full}). Deduped by method+normalized-path; on a collision the entry with a resolvable
+// handler (and `:param` display) wins. Capped. Returns [{method, path, handler, file, line}].
+export function detectEndpoints(repoPath, codeFiles) {
+  const files = (codeFiles || []).slice(0, MAX_FILES);
+  const byKey = new Map();
+  for (const f of files) {
+    const rel = f.path || f;
+    const full = f.full || join(repoPath, rel);
+    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go)$/i.test(rel)) continue;
+    const text = safeRead(full);
+    if (!text || !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)/i.test(text)) continue;
+    for (const e of extractEndpointsFromText(text, rel.replace(/\\/g, "/"))) {
+      const key = `${e.method} ${normParamKey(e.path)}`;
+      const prev = byKey.get(key);
+      if (!prev) { byKey.set(key, e); }
+      else if (preferEndpoint(e, prev)) { byKey.set(key, e); }
+      if (byKey.size >= 500) return [...byKey.values()].sort(sortEndpoints);
+    }
+  }
+  return [...byKey.values()].sort(sortEndpoints);
+}
+
+// true when candidate `a` is a better representative of a route than the already-kept `b`:
+// a resolvable handler beats none; failing that, a `:param` path beats a `{param}` one.
+function preferEndpoint(a, b) {
+  const ha = a.handler ? 1 : 0, hb = b.handler ? 1 : 0;
+  if (ha !== hb) return ha > hb;
+  const ca = a.path.includes("{") ? 1 : 0, cb = b.path.includes("{") ? 1 : 0;
+  return ca < cb;
+}
+
+function sortEndpoints(a, b) {
+  return a.path.localeCompare(b.path) || a.method.localeCompare(b.method);
+}