weavatrix 0.1.0

package/src/analysis/internal-audit.js

@@ -0,0 +1,9 @@
+// internal-audit.js — façade over the internal analyzers: loads a repo's graph.json + package.json,
+// runs dead-check (files) + computeUnusedExports + dep-check, and emits the unified findings envelope
+// (DEPS_SECURITY_PLAN.md §2.2-2.3). ALL filesystem access lives here; the analyzers stay pure.
+// P2 will add dep-rules (cycles/orphans/boundary); the security/ analyzers join in P4-P5.
+// Split: fs collection helpers live in internal-audit.collect.js, reachability in
+// internal-audit.reach.js, and the audit runner in internal-audit.run.js — this file
+// re-exports the public surface so external import paths keep working unchanged.
+export { collectSourceTexts } from "./internal-audit.collect.js";
+export { runInternalAudit } from "./internal-audit.run.js";

package/src/analysis/internal-audit.reach.js

@@ -0,0 +1,47 @@
+// internal-audit.reach.js — entry-point discovery + file-level reachability BFS for the internal
+// audit. Split from internal-audit.js.
+import { ENTRY_FILE } from "./dead-check.js";
+import { TEST_FILE_RE } from "./internal-audit.collect.js";
+
+const isFileNode = (n) => !String(n.id).includes("#");
+
+// Entry set for reachability: conventional entry names + package.json main/module/browser/bin/exports +
+// html pages (they root classic-script apps) + test files (the runner enters them) + root config files +
+// dynamic-import targets. Anything reachable from here is "used"; the rest corroborates unused-file.
+export function entryFiles(graph, pkg, dynamicTargets) {
+  const entries = new Set();
+  const pkgEntries = [];
+  for (const k of ["main", "module", "browser"]) if (typeof pkg[k] === "string") pkgEntries.push(pkg[k]);
+  if (pkg.bin) pkgEntries.push(...(typeof pkg.bin === "string" ? [pkg.bin] : Object.values(pkg.bin)));
+  (function walkExports(e) {
+    if (typeof e === "string") pkgEntries.push(e);
+    else if (e && typeof e === "object") Object.values(e).forEach(walkExports);
+  })(pkg.exports);
+  const pe = new Set(pkgEntries.map((p) => String(p).replace(/^\.\//, "").replace(/\\/g, "/")));
+  for (const n of graph.nodes || []) {
+    if (!isFileNode(n)) continue;
+    const f = n.source_file;
+    if (ENTRY_FILE.test(f) || TEST_FILE_RE.test(f) || /\.html?$/i.test(f) || pe.has(f) || /(^|\/)[^/]*\.config\.[a-z]+$/i.test(f)) entries.add(f);
+  }
+  for (const t of dynamicTargets) entries.add(t);
+  return entries;
+}
+
+// File-level BFS over every non-contains link (symbol endpoints collapse to their file via the id prefix).
+export function computeReachability(graph, entries) {
+  const fileOf = (v) => { const s = String(v && typeof v === "object" ? v.id : v); const h = s.indexOf("#"); return h < 0 ? s : s.slice(0, h); };
+  const adj = new Map();
+  for (const l of graph.links || []) {
+    if (l.relation === "contains") continue;
+    const a = fileOf(l.source), b = fileOf(l.target);
+    if (!a || !b || a === b) continue;
+    (adj.get(a) || adj.set(a, new Set()).get(a)).add(b);
+  }
+  const reached = new Set(entries);
+  const queue = [...entries];
+  while (queue.length) {
+    const cur = queue.pop();
+    for (const nxt of adj.get(cur) || []) if (!reached.has(nxt)) { reached.add(nxt); queue.push(nxt); }
+  }
+  return reached;
+}

package/src/analysis/internal-audit.run.js

@@ -0,0 +1,189 @@
+// internal-audit.run.js — the audit runner: loads a repo's graph.json + package.json, runs
+// dead-check (files) + computeUnusedExports + dep-check, and emits the unified findings envelope
+// (DEPS_SECURITY_PLAN.md §2.2-2.3). Split from internal-audit.js.
+import { existsSync } from "node:fs";
+import { join, basename } from "node:path";
+import { computeDead, computeUnusedExports } from "./dead-check.js";
+import { computeDepFindings, computeGoDepFindings, computePyDepFindings } from "./dep-check.js";
+import { parseGoMod } from "./manifests.js";
+import { computeStructureFindings } from "./dep-rules.js";
+import { makeFinding, summarizeFindings, sortFindings } from "./findings.js";
+import { graphOutDirForRepo } from "../graph/layout.js";
+import { collectInstalled } from "../security/installed.js";
+import { loadStore, queryStore } from "../security/advisory-store.js";
+import { matchAdvisories } from "../security/match.js";
+import { scanMalware } from "../security/malware-heuristics.js";
+import { classifyTyposquat } from "../security/typosquat.js";
+import {
+  readText, readJson, collectSourceTexts, collectConfigTexts, workspacePkgNames,
+  collectPyManifest, TEST_FILE_RE,
+} from "./internal-audit.collect.js";
+import { entryFiles, computeReachability } from "./internal-audit.reach.js";
+
+// Run the internal audit. graph is optional (loaded from the repo's central graph.json when absent);
+// advisoryStorePath overrides the default ~/.weavatrix/advisories.json (tests use a scratch path).
+// async because the malware sweep shells out to ripgrep.
+export async function runInternalAudit(repoPath, { graph, advisoryStorePath, skipMalwareScan = false, malwareExclusions = {}, rgPath = "" } = {}) {
+  if (!existsSync(repoPath)) return { ok: false, error: "Repo path not found" };
+  if (!graph) {
+    graph = readJson(join(graphOutDirForRepo(repoPath), "graph.json"));
+    if (!graph) return { ok: false, error: "Build the graph first (no graph.json)" };
+  }
+  const pkg = readJson(join(repoPath, "package.json")) || {};
+  const externalImports = graph.externalImports || [];
+  const dynamicTargets = new Set(externalImports.filter((e) => e.dynamic && e.target).map((e) => e.target));
+
+  // Graphs can be stale or miss a helper file; text fallbacks must scan the real repo tree too.
+  const sources = collectSourceTexts(repoPath, graph);
+
+  const dead = computeDead(graph, sources);
+  const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets });
+  const entries = entryFiles(graph, pkg, dynamicTargets);
+  const reachable = computeReachability(graph, entries);
+  const configTexts = collectConfigTexts(repoPath);
+  const dep = computeDepFindings({ externalImports, pkg, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts });
+  // non-npm ecosystems: Go (go.mod) + Python (requirements/pyproject/Pipfile) — same findings shape
+  const goModText = readText(join(repoPath, "go.mod"));
+  const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null });
+  const pyDep = computePyDepFindings({ externalImports, pyManifest: collectPyManifest(repoPath), configTexts });
+
+  // structure: cycles / orphans / boundary rules. Rules come from the repo's optional .weavatrix-deps.json
+  // (the depcruise-config analogue); no bundled default rules — cycles+orphans are always on.
+  const rules = readJson(join(repoPath, ".weavatrix-deps.json")) || {};
+  const externalImportFiles = new Set(externalImports.filter((e) => e.pkg && !e.builtin).map((e) => e.file));
+  const structure = computeStructureFindings(graph, { rules, entrySet: entries, externalImportFiles });
+
+  const findings = [...dep.findings, ...goDep.findings, ...pyDep.findings];
+  // orphan ∩ dead-file → one finding: keep the stronger unused-file, drop the duplicate orphan
+  const deadFileSet = new Set(dead.deadFiles.map((f) => f.file));
+  for (const f of structure.findings) if (!(f.rule === "orphan-file" && deadFileSet.has(f.file))) findings.push(f);
+  for (const f of dead.deadFiles) {
+    if (dynamicTargets.has(f.file) || TEST_FILE_RE.test(f.file)) continue;
+    findings.push(makeFinding({
+      category: "unused",
+      rule: "unused-file",
+      severity: "low",
+      confidence: reachable.has(f.file) ? "medium" : "high", // unreachable from every entry = strong corroboration
+      title: `Unused file: ${f.file}`,
+      detail: `${f.reason}${reachable.has(f.file) ? "" : "; also unreachable from every entry point"}. Dynamic loading and framework conventions can't be fully ruled out — review before deleting.`,
+      file: f.file,
+      graphNodeId: f.file,
+      source: "internal",
+      fixHint: "review, then delete the file",
+    }));
+  }
+  for (const s of unusedExports) {
+    if (s.test) continue; // exports from test files are runner-visible noise
+    if (/(^|\/)[^/]*\.config\.[a-z0-9]+$|(^|\/)\.[^/]+rc(\.[a-z]+)?$/i.test(s.file)) continue; // config exports are consumed by their tool
+    findings.push(makeFinding({
+      category: "unused",
+      rule: "unused-export",
+      severity: "info",
+      confidence: "medium",
+      title: `Unused export: ${s.label.replace(/\(\)$/, "")} — ${s.file}`,
+      detail: `${s.reason}. Either remove the export keyword (if used only internally) or delete the symbol.`,
+      file: s.file,
+      symbol: s.label,
+      graphNodeId: s.id,
+      source: "internal",
+    }));
+  }
+
+  // ---- supply-chain: installed packages × cached OSV advisories. 100% OFFLINE here — the cache is
+  // refreshed only by the explicit repos:advisory-refresh action. Never blocks the rest of the audit.
+  let advisoryDbDate = null;
+  let installedCount = 0;
+  let inst = { installed: [], drift: [] };
+  try {
+    inst = collectInstalled(repoPath);
+    installedCount = inst.installed.length;
+    const store = advisoryStorePath ? loadStore(advisoryStorePath) : loadStore();
+    // per-repo date when the store tracks it (cache only covers QUERIED packages); legacy stores
+    // without the repos map keep the old global-date behavior
+    advisoryDbDate = store.meta?.repos ? store.meta.repos[repoPath] || null : store.meta?.fetched_at || null;
+    if (advisoryDbDate) {
+      for (const h of matchAdvisories(inst.installed, (eco, name) => queryStore(store, eco, name))) {
+        const mal = h.adv.kind === "malicious";
+        findings.push(makeFinding({
+          category: mal ? "malware" : "vulnerability",
+          rule: mal ? "malicious-package" : "known-vuln",
+          severity: mal ? "critical" : h.adv.severity,
+          confidence: h.confidence,
+          title: `${mal ? "Known-malicious package" : `Known vulnerability (${h.adv.id})`}: ${h.pkg.name}@${h.pkg.version}`,
+          detail: `${h.adv.summary || h.adv.id}${h.adv.fixedIn.length ? ` Fixed in: ${h.adv.fixedIn.join(", ")}.` : mal ? " Remove this package immediately and rotate any secrets it could reach." : ""} (matched by ${h.matchedBy}${h.adv.aliases.length ? `; aliases ${h.adv.aliases.join(", ")}` : ""})`,
+          package: h.pkg.name,
+          version: h.pkg.version,
+          evidence: [{ file: h.adv.url, line: 0, snippet: `installed via ${h.pkg.source}${h.pkg.dev ? " (dev)" : ""}` }],
+          source: "osv",
+          fixHint: mal ? `npm uninstall ${h.pkg.name} + audit what it touched` : h.adv.fixedIn.length ? `upgrade ${h.pkg.name} to ${h.adv.fixedIn[h.adv.fixedIn.length - 1]}+` : "no fixed version published — consider replacing the package",
+        }));
+      }
+    }
+    // direct-dependency typosquat (dev-chosen names, small set → low FP): surface quietly even alone.
+    for (const name of Object.keys({ ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) })) {
+      const sq = classifyTyposquat(name);
+      if (!sq) continue;
+      findings.push(makeFinding({
+        category: "malware",
+        rule: "typosquat",
+        severity: "medium",
+        confidence: "low",
+        title: `Possible typosquat: ${name} (looks like "${sq.nearest}")`,
+        detail: `Direct dependency "${name}" is edit-distance ${sq.distance} from the popular package "${sq.nearest}". Confirm you meant "${name}" and not "${sq.nearest}" — name-confusion is a common supply-chain lure.`,
+        package: name,
+        source: "internal",
+        fixHint: `verify "${name}" is the intended package (not a typo of "${sq.nearest}")`,
+      }));
+    }
+    for (const d of inst.drift.slice(0, 20)) {
+      findings.push(makeFinding({
+        category: "malware",
+        rule: "lockfile-drift",
+        severity: "low",
+        confidence: "medium",
+        title: `Lockfile drift: ${d.name} (locked ${d.locked}, installed ${d.installed})`,
+        detail: "The version on disk differs from the lockfile — a stale install, a manual edit, or (worst case) tampering. Reinstall from the lockfile to realign.",
+        package: d.name,
+        version: d.installed,
+        source: "internal",
+        fixHint: "npm ci (clean install from the lockfile)",
+      }));
+    }
+  } catch { /* supply-chain layer is best-effort */ }
+
+  // ---- malware heuristics: install-script beacons / miners / exfil / obfuscation across installed libs.
+  // Local + offline (ripgrep or a bounded Node fallback). Scans node_modules, Python venvs, Go vendor/cache.
+  let malwareScan = null;
+  if (!skipMalwareScan) {
+    try {
+      const importedPkgs = new Set(externalImports.filter((e) => e.pkg && !e.builtin).map((e) => e.pkg));
+      const scan = await scanMalware(repoPath, { installed: inst.installed, importedPkgs, malwareExclusions, rgPath });
+      findings.push(...scan.findings);
+      malwareScan = { scanMode: scan.scanMode, packagesScanned: scan.packagesScanned, findings: scan.findings.length, excludedSignals: scan.excludedSignals || 0 };
+    } catch { /* heuristic scan is best-effort */ }
+  }
+
+  const sorted = sortFindings(findings);
+  return {
+    ok: true,
+    engine: "internal",
+    repo: basename(repoPath),
+    path: repoPath,
+    savedAt: new Date().toISOString(),
+    scanned: {
+      files: dead.stats.files,
+      symbols: dead.stats.symbols,
+      manifestDeps: dep.declared.size + goDep.declared.size + pyDep.declared.size,
+      externalImports: externalImports.length,
+      nodeModulesPresent: existsSync(join(repoPath, "node_modules")),
+      installedPackages: installedCount,
+      advisoryDbDate,
+      malwareScanMode: malwareScan?.scanMode || "skipped",
+    },
+    summary: summarizeFindings(sorted),
+    findings: sorted,
+    deadReport: { deadSymbols: dead.deadSymbols.length, deadFiles: dead.deadFiles.length, unusedExports: unusedExports.length },
+    structureReport: structure.stats,
+    malwareScan,
+  };
+}

package/src/analysis/manifests.js

@@ -0,0 +1,169 @@
+// Pure manifest parsers for the non-npm ecosystems (Go + Python) — text in, declared deps out.
+// NO filesystem here (internal-audit.js is the fs wrapper; internal-builder reads go.mod for resolvers).
+// Philosophy matches dep-check.js: tolerate real-world files, bias to FALSE-NEGATIVES on weird syntax.
+
+// pep503(name) — PyPI canonical form: lowercase, runs of -_. collapse to "-" (same as security/installed.js).
+export const pep503 = (name) => String(name || "").toLowerCase().replace(/[-_.]+/g, "-");
+
+// ---- go.mod → { module, requires: [{path, version, indirect}], replaces: [{from, to}] } ----
+// Handles single-line `require path v1` and `require ( … )` blocks; `// indirect` marks transitive
+// requires (never flagged unused — Go owns them via `go mod tidy`).
+export function parseGoMod(text) {
+  const src = String(text || "");
+  const out = { module: "", requires: [], replaces: [] };
+  const m = src.match(/^\s*module\s+(\S+)/m);
+  if (m) out.module = m[1].replace(/^"|"$/g, "");
+  const addReq = (line) => {
+    const r = line.match(/^\s*([^\s()=>]+)\s+(v[\w.+-]+)\s*(\/\/.*)?$/);
+    if (r) out.requires.push({ path: r[1].replace(/^"|"$/g, ""), version: r[2], indirect: /\/\/\s*indirect/.test(line) });
+  };
+  const addRepl = (line) => {
+    const r = line.match(/^\s*([^\s()=>]+)(?:\s+v[\w.+-]+)?\s*=>\s*(\S+)(?:\s+v[\w.+-]+)?\s*(\/\/.*)?$/);
+    if (r) out.replaces.push({ from: r[1].replace(/^"|"$/g, ""), to: r[2].replace(/^"|"$/g, "") });
+  };
+  for (const dir of ["require", "replace"]) {
+    const add = dir === "require" ? addReq : addRepl;
+    for (const blk of src.matchAll(new RegExp(`^\\s*${dir}\\s*\\(([\\s\\S]*?)^\\s*\\)`, "gm"))) for (const line of blk[1].split(/\r?\n/)) add(line);
+    for (const one of src.matchAll(new RegExp(`^\\s*${dir}\\s+([^(\\r\\n]+)$`, "gm"))) add(one[1]);
+  }
+  return out;
+}
+
+// ---- PEP 508 requirement line → dist name (extras/specifiers/markers stripped), or null ----
+// "-r other.txt", bare options, paths and URLs are skipped; VCS urls keep their #egg= name if present.
+export function requirementName(rawLine) {
+  const line = String(rawLine || "").replace(/(^|\s)#.*$/, "").trim();
+  if (!line) return null;
+  const egg = line.match(/#egg=([A-Za-z0-9][\w.-]*)/i);
+  if (egg) return egg[1];
+  if (line.startsWith("-") || /^(git\+|hg\+|svn\+|bzr\+|https?:|file:)/i.test(line) || /^\.{0,2}[\\/]/.test(line) || line === ".") return null;
+  const m = line.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
+  return m ? m[1] : null;
+}
+
+// requirements.txt (or *.in) text → [{name}] (unique by canonical name)
+export function parseRequirementsNames(text) {
+  const seen = new Set();
+  const out = [];
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const name = requirementName(raw);
+    if (!name || seen.has(pep503(name))) continue;
+    seen.add(pep503(name));
+    out.push({ name });
+  }
+  return out;
+}
+
+// ---- pyproject.toml → { present, deps: [{name, dev, buildSystem}] } ----
+// Line-based section scanner (no TOML dependency): covers PEP 621 [project] dependencies /
+// optional-dependencies, Poetry [tool.poetry.*dependencies] tables, PEP 735 [dependency-groups],
+// and [build-system] requires (declared-but-implicit → suppresses "missing", never checked "unused").
+export function parsePyprojectDeps(text) {
+  const src = String(text || "");
+  const deps = [];
+  const seen = new Set();
+  const add = (name, dev, buildSystem = false) => {
+    if (!name || name.toLowerCase() === "python" || seen.has(pep503(name))) return;
+    seen.add(pep503(name));
+    deps.push({ name, dev: !!dev, buildSystem });
+  };
+  let section = "";
+  let present = false;
+  let arr = null; // { dev, buildSystem } while inside a dependencies = [ … ] array
+  // bracket balance OUTSIDE string literals — "requests[security]" must not close the array
+  const bracketDelta = (s) => { const t = String(s).replace(/"[^"]*"|'[^']*'/g, ""); return ((t.match(/\[/g) || []).length) - ((t.match(/\]/g) || []).length); };
+  for (const raw of src.split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trimEnd();
+    const sec = line.match(/^\s*\[+([^\]]+)\]+\s*$/);
+    if (!arr && sec) { section = sec[1].trim(); continue; }
+    if (arr) { // inside a multi-line array: pull every string literal
+      for (const s of line.matchAll(/["']([^"']+)["']/g)) add(requirementName(s[1]), arr.dev, arr.buildSystem);
+      if (bracketDelta(line) < 0) arr = null;
+      continue;
+    }
+    const kv = line.match(/^\s*([\w."'-]+)\s*=\s*(.*)$/);
+    if (!kv) continue;
+    const key = kv[1].replace(/^["']|["']$/g, "");
+    const val = kv[2].trim();
+    const startArray = (dev, buildSystem = false) => {
+      present = true;
+      for (const s of val.matchAll(/["']([^"']+)["']/g)) add(requirementName(s[1]), dev, buildSystem);
+      if (bracketDelta(val) > 0) arr = { dev, buildSystem };
+    };
+    if (section === "project" && key === "dependencies") startArray(false);
+    else if (section === "project.optional-dependencies" || section === "dependency-groups") startArray(true);
+    else if (section === "build-system" && key === "requires") startArray(true, true);
+    else if (section === "tool.poetry.dependencies") { present = true; add(key, false); }
+    else if (section === "tool.poetry.dev-dependencies" || /^tool\.poetry\.group\.[^.]+\.dependencies$/.test(section)) { present = true; add(key, true); }
+  }
+  return { present, deps };
+}
+
+// ---- poetry.lock → [{name, version, deps}] — [[package]] blocks + their [package.dependencies] keys ----
+export function parsePoetryLockDeps(text) {
+  const out = [];
+  let cur = null, inDeps = false;
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "[[package]]") { cur = { name: "", version: "", deps: [] }; out.push(cur); inDeps = false; continue; }
+    if (line.startsWith("[")) { inDeps = cur != null && line === "[package.dependencies]"; if (line.startsWith("[[")) cur = null; continue; }
+    if (!cur) continue;
+    if (inDeps) { const m = line.match(/^["']?([A-Za-z0-9][\w.-]*)["']?\s*=/); if (m) cur.deps.push(m[1]); continue; }
+    let m = line.match(/^name\s*=\s*"([^"]+)"/); if (m && !cur.name) { cur.name = m[1]; continue; }
+    m = line.match(/^version\s*=\s*"([^"]+)"/); if (m && !cur.version) cur.version = m[1];
+  }
+  return out.filter((p) => p.name);
+}
+
+// ---- uv.lock → [{name, version, deps}] — [[package]] blocks with dependencies = [{ name = "x" }, …] ----
+export function parseUvLockDeps(text) {
+  const out = [];
+  let cur = null, inArr = false;
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "[[package]]") { cur = { name: "", version: "", deps: [] }; out.push(cur); inArr = false; continue; }
+    if (line.startsWith("[") && !inArr) { if (line.startsWith("[[")) cur = null; continue; }
+    if (!cur) continue;
+    if (inArr) { for (const m of line.matchAll(/name\s*=\s*"([^"]+)"/g)) cur.deps.push(m[1]); if (/\]\s*$/.test(line)) inArr = false; continue; }
+    if (/^dependencies\s*=\s*\[/.test(line)) { for (const m of line.matchAll(/name\s*=\s*"([^"]+)"/g)) cur.deps.push(m[1]); inArr = !/\]\s*$/.test(line); continue; }
+    let m = line.match(/^name\s*=\s*"([^"]+)"/); if (m && !cur.name) { cur.name = m[1]; continue; }
+    m = line.match(/^version\s*=\s*"([^"]+)"/); if (m && !cur.version) cur.version = m[1];
+  }
+  return out.filter((p) => p.name);
+}
+
+// ---- installed dist-info METADATA → { name, version, deps, repository } (headers until the first blank
+// line; Requires-Dist entries gated behind `extra ==` markers are optional extras — skipped) ----
+export function parseDistMetadata(text) {
+  const out = { name: "", version: "", deps: [], repository: "" };
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    if (raw.trim() === "") break;
+    let m = raw.match(/^Name:\s*(.+)$/i); if (m) { out.name = m[1].trim(); continue; }
+    m = raw.match(/^Version:\s*(.+)$/i); if (m) { out.version = m[1].trim(); continue; }
+    m = raw.match(/^Requires-Dist:\s*([A-Za-z0-9][\w.-]*)(.*)$/i);
+    if (m) { if (!/extra\s*==/.test(m[2])) out.deps.push(m[1]); continue; }
+    m = raw.match(/^(?:Home-page:\s*|Project-URL:\s*(?:Source|Repository|Homepage|Home|Code)[^,]*,\s*)(https?:\/\/\S+)/i);
+    if (m && !out.repository) out.repository = m[1];
+  }
+  return out;
+}
+
+// ---- Pipfile → { present, deps: [{name, dev}] } — [packages] / [dev-packages] table keys ----
+export function parsePipfileDeps(text) {
+  const deps = [];
+  const seen = new Set();
+  let section = "";
+  let present = false;
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    const sec = line.match(/^\[([^\]]+)\]$/);
+    if (sec) { section = sec[1].trim().toLowerCase(); continue; }
+    if (section !== "packages" && section !== "dev-packages") continue;
+    const kv = line.match(/^["']?([A-Za-z0-9][\w.-]*)["']?\s*=/);
+    if (!kv || seen.has(pep503(kv[1]))) continue;
+    present = true;
+    seen.add(pep503(kv[1]));
+    deps.push({ name: kv[1], dev: section === "dev-packages" });
+  }
+  return { present, deps };
+}

package/src/analysis/source-complexity.ast.js

@@ -0,0 +1,97 @@
+// Tree-sitter node helpers shared by the source-complexity analysis modules.
+
+import { IO_PREFIXES } from "./source-complexity.constants.js";
+
+export function field(node, name) {
+  try { return node?.childForFieldName ? node.childForFieldName(name) : null; }
+  catch { return null; }
+}
+
+export function children(node) {
+  try { return Array.isArray(node?.namedChildren) ? node.namedChildren : []; }
+  catch { return []; }
+}
+
+export function allChildren(node) {
+  try { return Array.isArray(node?.children) ? node.children : children(node); }
+  catch { return children(node); }
+}
+
+export function sameNode(left, right) {
+  if (!left || !right) return false;
+  if (left === right) return true;
+  if (left.id != null && right.id != null) return left.id === right.id;
+  return left.type === right.type && left.startIndex === right.startIndex && left.endIndex === right.endIndex;
+}
+
+export function normalizedName(value) {
+  return String(value || "").replace(/[^A-Za-z0-9_$]+/g, "").toLowerCase();
+}
+
+export function looksLikeIoCall(value) {
+  const raw = String(value || "");
+  const lower = raw.toLowerCase();
+  return IO_PREFIXES.some((prefix) => {
+    if (!lower.startsWith(prefix)) return false;
+    const boundary = raw[prefix.length];
+    return boundary == null || /[A-Z_$]/.test(boundary);
+  });
+}
+
+export function callName(node) {
+  const callee = field(node, "function") || field(node, "name") || field(node, "constructor");
+  if (!callee) return "";
+  const member = field(callee, "property") || field(callee, "field") || field(callee, "attribute") || field(callee, "name");
+  return String((member || callee).text || "").replace(/\?$/, "");
+}
+
+export function logicalBranch(node) {
+  if (!/binary_expression|boolean_operator/.test(String(node?.type || ""))) return false;
+  return allChildren(node).some((child) => ["&&", "||", "??", "and", "or"].includes(String(child?.type || child?.text || "")));
+}
+
+export function isDefaultCase(node) {
+  const text = String(node?.text || "").trimStart();
+  return /^(default\b|case\s+default\b)/i.test(text);
+}
+
+export function directParameterCount(paramNode, family) {
+  if (!paramNode) return 0;
+  if (!/parameters|parameter_list|formal_parameters/.test(String(paramNode.type || ""))) {
+    return /^(self|cls)$/.test(String(paramNode.text || "").trim()) ? 0 : 1;
+  }
+  let count = 0;
+  for (const part of children(paramNode)) {
+    const type = String(part.type || "");
+    if (/comment|type_parameter|type_parameters/.test(type)) continue;
+    if (family === "go" && /parameter_declaration|variadic_parameter_declaration/.test(type)) {
+      const ids = children(part).filter((child) => /^(identifier|field_identifier)$/.test(String(child.type || "")));
+      count += Math.max(1, ids.length);
+      continue;
+    }
+    if (/^(self|cls)(\s*[:=].*)?$/.test(String(part.text || "").trim())) continue;
+    count++;
+  }
+  return count;
+}
+
+export function countObjectPatternFields(paramNode) {
+  if (!paramNode) return 0;
+  let total = 0;
+  const visit = (node, depth) => {
+    if (!node || depth > 5) return;
+    if (node.type === "object_pattern") {
+      total += children(node).filter((child) => !/type_annotation|comment/.test(String(child.type || ""))).length;
+      return;
+    }
+    for (const child of children(node)) visit(child, depth + 1);
+  };
+  visit(paramNode, 0);
+  return total;
+}
+
+export function sourceRange(node) {
+  const startLine = node?.startPosition ? node.startPosition.row + 1 : 0;
+  const endLine = node?.endPosition ? node.endPosition.row + 1 : startLine;
+  return { startLine, endLine, loc: startLine ? Math.max(1, endLine - startLine + 1) : 0 };
+}

package/src/analysis/source-complexity.constants.js

@@ -0,0 +1,55 @@
+// Syntax node-type and call-name tables for the source-complexity analysis.
+
+export const LOOP_NODES = new Set([
+  "for_statement", "for_in_statement", "for_each_statement", "enhanced_for_statement",
+  "while_statement", "do_statement", "for_in_clause"
+]);
+export const CALL_NODES = new Set(["call", "call_expression", "method_invocation", "object_creation_expression"]);
+export const RETURN_NODES = new Set(["return_statement"]);
+export const AWAIT_NODES = new Set(["await_expression"]);
+export const OBJECT_NODES = new Set(["object", "dictionary", "map", "record_literal"]);
+export const FIXED_ALLOCATION_NODES = new Set([
+  ...OBJECT_NODES,
+  "array", "list", "set", "tuple", "composite_literal", "new_expression",
+  "object_creation_expression", "array_creation_expression", "make_expression",
+  "list_comprehension", "set_comprehension", "dictionary_comprehension"
+]);
+export const VARIABLE_ALLOCATION_NODES = new Set(["list_comprehension", "set_comprehension", "dictionary_comprehension"]);
+export const SPREAD_NODES = new Set([
+  "spread_element", "list_splat", "dictionary_splat", "set_splat", "spread_expression"
+]);
+export const DECLARATION_BOUNDARIES = new Set([
+  "function_declaration", "generator_function_declaration", "function_definition",
+  "method_definition", "method_declaration", "constructor_declaration",
+  "class_declaration", "class_definition", "interface_declaration", "enum_declaration"
+]);
+export const EXPRESSION_CALLABLES = new Set([
+  "arrow_function", "function_expression", "generator_function", "lambda", "lambda_expression"
+]);
+export const ARGUMENT_NODES = new Set(["arguments", "argument_list"]);
+export const ITERATOR_CALLS = new Set([
+  "foreach", "map", "flatmap", "filter", "reduce", "reduceright", "some", "every",
+  "find", "findindex", "findlast", "findlastindex", "collect", "select"
+]);
+export const PRODUCER_CALLS = new Set([
+  "map", "flatmap", "filter", "slice", "concat", "split", "toarray", "tolist",
+  "keys", "values", "entries", "fromentries", "from", "copy", "clone", "collect", "make",
+  "all", "allsettled", "stringify", "parse"
+]);
+export const LINEAR_CALLS = new Set([
+  ...ITERATOR_CALLS,
+  ...PRODUCER_CALLS,
+  "includes", "indexof", "lastindexof", "join", "reverse", "stringify", "parse",
+  "all", "allsettled", "any", "race"
+]);
+export const SORT_CALLS = new Set(["sort", "sorted", "sortby", "orderby", "order_by"]);
+export const IO_PREFIXES = [
+  "fetch", "request", "query", "execute", "insert", "update", "delete", "save", "read",
+  "write", "send", "publish", "consume", "find", "load", "download", "upload", "connect", "transaction"
+];
+
+export const BRANCH_NODES = new Set([
+  "if_statement", "elif_clause", "catch_clause", "except_clause", "conditional_expression",
+  "ternary_expression", "switch_case", "case_statement", "expression_case", "type_case",
+  "communication_case", "match_case"
+]);

package/src/analysis/source-complexity.js

@@ -0,0 +1,14 @@
+// AST-backed, language-aware source complexity summary.
+//
+// This intentionally reports LOCAL algorithmic work separately from calls/I/O. A method with no loop
+// can be O(1) locally while its end-to-end latency remains callee-bound; object/array spreads are linear
+// shallow copies even without an explicit loop. Reports are plain JSON and are persisted on graph nodes,
+// so the renderer never needs a second implementation of the algorithm.
+//
+// Implementation lives in the sibling modules:
+//   source-complexity.constants.js — node-type and call-name tables
+//   source-complexity.ast.js       — tree-sitter node helpers
+//   source-complexity.report.js    — rank/label/evidence builders
+//   source-complexity.walk.js      — the syntax walk and summary assembly
+
+export { analyzeSyntaxComplexity } from "./source-complexity.walk.js";