weavatrix 0.1.1 → 0.1.3

package/src/analysis/graph-analysis.aggregate.js

@@ -5,6 +5,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { normalizeRepoParts, readCoverageForRepo, pctFromCounts } from "./coverage-reports.js";
 import { bareSymbolName, countLocalRefsOutsideOwnRange, computeSymbolExternalRefs } from "./graph-analysis.refs.js";
+import { createRepoBoundary } from "../repo-path.js";
 
 // Aggregate a built graph.json into the file- and module-level view the UI needs:
 //   - graph-builder nodes are FILES *and* their symbols (functions/methods), linked file→symbol by the
@@ -99,21 +100,25 @@ export function aggregateGraph(graph, repoRoot) {
   for (const node of nodes) if (node.source_file) id2file.set(node.id, fileIdOf(node));
   const fileEdges = new Map(); // key → { count, rels:{relation→n} } so we can emit the DOMINANT relation (call/import/inherit)
   const moduleEdges = new Map();
+  const typeOnlyFileEdges = new Map();
+  const typeOnlyModuleEdges = new Map();
   for (const link of links) {
     if (link.relation === "contains") continue;
     const fromFile = id2file.get(endpoint(link.source));
     const toFile = id2file.get(endpoint(link.target));
     if (fromFile && toFile && fromFile !== toFile) {
       const key = `${fromFile} ${toFile}`;
-      let fe = fileEdges.get(key);
-      if (!fe) fileEdges.set(key, (fe = { count: 0, rels: {} }));
+      const targetFileEdges = link.typeOnly === true ? typeOnlyFileEdges : fileEdges;
+      let fe = targetFileEdges.get(key);
+      if (!fe) targetFileEdges.set(key, (fe = { count: 0, rels: {} }));
       fe.count++;
       if (link.relation) fe.rels[link.relation] = (fe.rels[link.relation] || 0) + 1;
       const fromMod = fileModule.get(fromFile);
       const toMod = fileModule.get(toFile);
       if (fromMod && toMod && fromMod !== toMod) {
         const mkey = `${fromMod} ${toMod}`;
-        moduleEdges.set(mkey, (moduleEdges.get(mkey) || 0) + 1);
+        const targetModuleEdges = link.typeOnly === true ? typeOnlyModuleEdges : moduleEdges;
+        targetModuleEdges.set(mkey, (targetModuleEdges.get(mkey) || 0) + 1);
       }
     }
   }
@@ -175,11 +180,14 @@ export function aggregateGraph(graph, repoRoot) {
   const fileLoc = new Map();
   const fileText = new Map();
   if (repoRoot) {
+    const boundary = createRepoBoundary(repoRoot);
     folderLoc = {};
     for (const [sourceFile, mod] of fileModule) {
       let loc = 0;
       try {
-        const txt = readFileSync(join(repoRoot, sourceFile), "utf8");
+        const resolved = boundary.resolve(sourceFile);
+        if (!resolved.ok) throw new Error("source path is outside the repository");
+        const txt = readFileSync(resolved.path, "utf8");
         loc = txt ? txt.split("\n").length : 0;
         fileText.set(sourceFile, txt || "");
       } catch {
@@ -259,7 +267,9 @@ export function aggregateGraph(graph, repoRoot) {
       }))
       .sort((a, b) => b.fileCount - a.fileCount),
     moduleEdges: edgeList(moduleEdges),
+    typeOnlyModuleEdges: edgeList(typeOnlyModuleEdges),
     fileEdges: edgeList(fileEdges),
+    typeOnlyFileEdges: edgeList(typeOnlyFileEdges),
     symbols,
     symbolEdges,
     symbolRefs: [...new Set([...symbolLocalRefs.keys(), ...symbolExternalRefs.keys()])].map((id) => {
@@ -272,7 +282,9 @@ export function aggregateGraph(graph, repoRoot) {
       files: fileModule.size,
       nodes: nodes.filter((n) => n.file_type === "code").length,
       fileEdges: fileEdges.size,
+      typeOnlyFileEdges: typeOnlyFileEdges.size,
       moduleEdges: moduleEdges.size,
+      typeOnlyModuleEdges: typeOnlyModuleEdges.size,
       symbols: symbols.length,
       symbolEdges: symbolEdges.length
     }

package/src/analysis/internal-audit.collect.js

@@ -1,42 +1,70 @@
 // internal-audit.collect.js — filesystem collection helpers for the internal audit: source/config
 // text gathering, workspace package names, and the Python manifest reader. Split from internal-audit.js.
 import { readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { spawnSync } from "node:child_process";
 import { parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps } from "./manifests.js";
+import { createRepoBoundary } from "../repo-path.js";
+import { childProcessEnv } from "../child-env.js";
 
 export const readText = (p) => { try { return readFileSync(p, "utf8"); } catch { return null; } };
 export const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
+export const readRepoText = (boundary, relativePath) => {
+  const resolved = boundary.resolve(relativePath);
+  return resolved.ok ? readText(resolved.path) : null;
+};
+export const readRepoJson = (boundary, relativePath) => {
+  const resolved = boundary.resolve(relativePath);
+  return resolved.ok ? readJson(resolved.path) : null;
+};
 const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?|py|go|vue|svelte)$/i;
 const SOURCE_SKIP_DIRS = new Set([
   ".git", ".hg", ".svn", "node_modules", "vendor", "dist", "build", "coverage", ".next", "out",
-  "weavatrix-graphs", "weavatrix-graphs", "__pycache__", ".venv", "venv", "env", ".tox", "site-packages",
+  "release", "weavatrix-graphs", "__pycache__", ".venv", "venv", "env", ".tox", "site-packages",
   ".mypy_cache", ".pytest_cache",
 ]);
 
-export function collectSourceTexts(repoRoot, graph) {
-  const sources = new Map();
-  const add = (rel) => {
-    const file = String(rel || "").replace(/\\/g, "/");
-    if (!file || sources.has(file)) return;
-    const text = readText(join(repoRoot, file));
-    if (text != null) sources.set(file, text);
-  };
-
-  for (const n of graph.nodes || []) add(n.source_file);
+// One file universe for every filesystem-backed audit. In Git repos this exactly matches tracked files
+// plus untracked/non-ignored work, so release bundles and other .gitignore outputs cannot re-enter through
+// text/config/manifest fallback collectors after the graph builder correctly omitted them.
+export function listRepoFiles(repoRoot) {
+  try {
+    const r = spawnSync("git", ["-C", repoRoot, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
+      encoding: "utf8", windowsHide: true, timeout: 15_000, maxBuffer: 32 * 1024 * 1024,
+      env: childProcessEnv(),
+    });
+    if (r.status === 0) return String(r.stdout || "").split("\0").filter(Boolean).map((f) => f.replace(/\\/g, "/"));
+  } catch { /* non-Git repo or git unavailable: use the bounded walker below */ }
 
+  const files = [];
   const walk = (abs, parts = []) => {
     let entries = [];
     try { entries = readdirSync(abs, { withFileTypes: true }); } catch { return; }
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (!SOURCE_SKIP_DIRS.has(entry.name)) walk(join(abs, entry.name), [...parts, entry.name]);
-        continue;
-      }
-      if (!entry.isFile() || !SOURCE_EXT_RE.test(entry.name)) continue;
-      add([...parts, entry.name].join("/"));
+      } else if (entry.isFile()) files.push([...parts, entry.name].join("/"));
     }
   };
   walk(repoRoot);
+  return files;
+}
+
+export function collectSourceTexts(repoRoot, graph) {
+  const sources = new Map();
+  const boundary = createRepoBoundary(repoRoot);
+  const add = (rel) => {
+    const file = String(rel || "").replace(/\\/g, "/");
+    if (!file || sources.has(file)) return;
+    const resolved = boundary.resolve(file);
+    if (!resolved.ok) return;
+    const text = readText(resolved.path);
+    if (text != null) sources.set(file, text);
+  };
+
+  for (const n of graph.nodes || []) add(n.source_file);
+
+  for (const file of listRepoFiles(repoRoot)) if (SOURCE_EXT_RE.test(file)) add(file);
   return sources;
 }
 
@@ -50,7 +78,8 @@ const CONFIG_FILES = [
   "jest.config.js", "jest.config.ts", "jest.config.cjs", "jest.config.mjs",
   "vite.config.js", "vite.config.ts", "vite.config.mjs", "vitest.config.js", "vitest.config.ts",
   "webpack.config.js", "rollup.config.js", "esbuild.config.js",
-  "postcss.config.js", "postcss.config.cjs", "tailwind.config.js", "tailwind.config.ts",
+  "postcss.config.js", "postcss.config.cjs", "postcss.config.mjs", "postcss.config.ts",
+  "tailwind.config.js", "tailwind.config.cjs", "tailwind.config.mjs", "tailwind.config.ts",
   ".prettierrc", ".prettierrc.json", "prettier.config.js",
   "playwright.config.js", "playwright.config.ts", "cypress.config.js", "cypress.config.ts",
   "next.config.js", "next.config.mjs", "nuxt.config.ts", "svelte.config.js", "astro.config.mjs",
@@ -63,32 +92,122 @@ const CONFIG_FILES = [
 
 export function collectConfigTexts(repoRoot) {
   const map = new Map();
-  for (const f of CONFIG_FILES) { const t = readText(join(repoRoot, f)); if (t != null) map.set(f, t); }
+  const boundary = createRepoBoundary(repoRoot);
+  const names = new Set(CONFIG_FILES.map((f) => f.toLowerCase()));
+  for (const f of listRepoFiles(repoRoot)) {
+    const base = f.slice(f.lastIndexOf("/") + 1).toLowerCase();
+    if (!names.has(base) && !/^\.github\/workflows\/.*\.ya?ml$/i.test(f)) continue;
+    const t = readRepoText(boundary, f);
+    if (t != null) map.set(f, t);
+  }
+  return map;
+}
+
+function readJsonc(text) {
+  if (text == null) return null;
   try {
-    for (const wf of readdirSync(join(repoRoot, ".github", "workflows"))) {
-      if (!/\.ya?ml$/i.test(wf)) continue;
-      const t = readText(join(repoRoot, ".github", "workflows", wf));
-      if (t != null) map.set(`.github/workflows/${wf}`, t);
+    const input = String(text).replace(/^\uFEFF/, "");
+    let clean = "", inString = false, escaped = false;
+    for (let i = 0; i < input.length; i++) {
+      const ch = input[i], next = input[i + 1];
+      if (inString) {
+        clean += ch;
+        if (escaped) escaped = false;
+        else if (ch === "\\") escaped = true;
+        else if (ch === '"') inString = false;
+        continue;
+      }
+      if (ch === '"') { inString = true; clean += ch; continue; }
+      if (ch === "/" && next === "/") {
+        while (i < input.length && input[i] !== "\n") i++;
+        clean += "\n";
+        continue;
+      }
+      if (ch === "/" && next === "*") {
+        i += 2;
+        while (i < input.length && !(input[i] === "*" && input[i + 1] === "/")) i++;
+        i++;
+        continue;
+      }
+      clean += ch;
     }
-  } catch { /* no workflows */ }
-  return map;
+    clean = clean.replace(/,\s*([}\]])/g, "$1");
+    return JSON.parse(clean);
+  } catch { return null; }
+}
+
+const normRoot = (root) => {
+  const value = String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+  return value === "." ? "" : value;
+};
+const inScope = (file, root) => !root || file === root || file.startsWith(`${root}/`);
+
+function aliasesForScope(repoRoot, root, files, boundary, scopeRoots) {
+  const ownerOf = (file) => scopeRoots.find((candidate) => inScope(file, candidate)) ?? "";
+  const configs = files
+    .filter((f) => ownerOf(f) === root && /(^|\/)(?:tsconfig|jsconfig)(?:\.[^/]+)?\.json$/i.test(f))
+    .filter((f) => normRoot(dirname(f)) === root)
+    .sort((a, b) => Number(!/(^|\/)(?:tsconfig|jsconfig)\.json$/i.test(a)) - Number(!/(^|\/)(?:tsconfig|jsconfig)\.json$/i.test(b)) || a.localeCompare(b));
+  const aliases = new Map();
+  for (const config of configs) {
+    const cfg = readJsonc(readRepoText(boundary, config));
+    const paths = cfg?.compilerOptions?.paths || {};
+    for (const key of Object.keys(paths)) if (!aliases.has(key)) aliases.set(key, {
+      key,
+      prefix: String(key).replace(/\*.*$/, ""),
+      suffix: String(key).includes("*") ? String(key).slice(String(key).indexOf("*") + 1) : "",
+      config,
+    });
+  }
+  return [...aliases.values()];
+}
+
+// Every package.json defines a dependency scope. The nearest ancestor manifest owns an import, matching
+// npm workspace/package semantics. Aliases are collected from that scope's tsconfig/jsconfig so `@/*`
+// remains local rather than becoming a phantom npm package.
+export function collectPackageScopes(repoRoot, rootPkg = null) {
+  const boundary = createRepoBoundary(repoRoot);
+  const files = listRepoFiles(repoRoot);
+  const manifests = files.filter((f) => /(^|\/)package\.json$/i.test(f));
+  if (!manifests.includes("package.json") && rootPkg) manifests.unshift("package.json");
+  const uniqueManifests = [...new Set(manifests)];
+  const scopeRoots = uniqueManifests
+    .map((manifest) => manifest === "package.json" ? "" : normRoot(dirname(manifest)))
+    .sort((a, b) => b.length - a.length);
+  const scopes = [];
+  for (const manifest of uniqueManifests) {
+    const root = manifest === "package.json" ? "" : normRoot(dirname(manifest));
+    const pkg = manifest === "package.json" && rootPkg ? rootPkg : readRepoJson(boundary, manifest);
+    if (!pkg || typeof pkg !== "object") continue;
+    scopes.push({ root, manifest, pkg, aliases: aliasesForScope(repoRoot, root, files, boundary, scopeRoots) });
+  }
+  if (!scopes.some((s) => !s.root)) scopes.push({ root: "", manifest: "package.json", pkg: rootPkg || {}, aliases: aliasesForScope(repoRoot, "", files, boundary, [...scopeRoots, ""]) });
+  return scopes.sort((a, b) => b.root.length - a.root.length);
 }
 
 // Monorepo-local package names: "packages/*"-style workspace globs → each child's package.json name.
 // Those are importable without being declared — never "missing" deps.
 export function workspacePkgNames(repoRoot, pkg) {
   const names = new Set();
+  const boundary = createRepoBoundary(repoRoot);
   const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : (pkg.workspaces && pkg.workspaces.packages) || [];
   for (const g of globs) {
     const base = String(g).replace(/\/?\*+.*$/, "");
     let dirs = [];
-    if (/\*/.test(String(g))) { try { dirs = readdirSync(join(repoRoot, base)).map((d) => join(base, d)); } catch { continue; } }
+    if (/\*/.test(String(g))) {
+      try {
+        const resolvedBase = boundary.resolve(base || ".");
+        if (!resolvedBase.ok) continue;
+        dirs = readdirSync(resolvedBase.path).map((d) => join(base, d));
+      } catch { continue; }
+    }
     else dirs = [String(g)];
     for (const d of dirs) {
-      const p = readJson(join(repoRoot, d, "package.json"));
+      const p = readRepoJson(boundary, join(d, "package.json"));
       if (p && p.name) names.add(p.name);
     }
   }
+  for (const scope of collectPackageScopes(repoRoot, pkg)) if (scope.pkg?.name) names.add(scope.pkg.name);
   return names;
 }
 
@@ -100,18 +219,22 @@ export function collectPyManifest(repoRoot) {
   const deps = [];
   let present = false;
   let names = [];
-  try { names = readdirSync(repoRoot).filter((n) => /^requirements[\w.-]*\.(txt|in)$/i.test(n)); } catch { /* unreadable root */ }
-  try { names.push(...readdirSync(join(repoRoot, "requirements")).filter((n) => /\.(txt|in)$/i.test(n)).map((n) => `requirements/${n}`)); } catch { /* no requirements dir */ }
+  const boundary = createRepoBoundary(repoRoot);
+  try { names = readdirSync(boundary.root).filter((n) => /^requirements[\w.-]*\.(txt|in)$/i.test(n)); } catch { /* unreadable root */ }
+  try {
+    const requirements = boundary.resolve("requirements");
+    if (requirements.ok) names.push(...readdirSync(requirements.path).filter((n) => /\.(txt|in)$/i.test(n)).map((n) => `requirements/${n}`));
+  } catch { /* no requirements dir */ }
   for (const n of names) {
-    const t = readText(join(repoRoot, n));
+    const t = readRepoText(boundary, n);
     if (t == null) continue;
     present = true;
     const dev = /dev|test|lint|doc|ci/i.test(n.replace(/^requirements[/\\]?/i, ""));
     for (const d of parseRequirementsNames(t)) deps.push({ ...d, dev });
   }
-  const pp = readText(join(repoRoot, "pyproject.toml"));
+  const pp = readRepoText(boundary, "pyproject.toml");
   if (pp != null) { const r = parsePyprojectDeps(pp); if (r.present) { present = true; deps.push(...r.deps); } }
-  const pf = readText(join(repoRoot, "Pipfile"));
+  const pf = readRepoText(boundary, "Pipfile");
   if (pf != null) { const r = parsePipfileDeps(pf); if (r.present) { present = true; deps.push(...r.deps); } }
   return { present, deps };
 }

package/src/analysis/internal-audit.reach.js

@@ -1,6 +1,7 @@
 // internal-audit.reach.js — entry-point discovery + file-level reachability BFS for the internal
 // audit. Split from internal-audit.js.
-import { ENTRY_FILE } from "./dead-check.js";
+import { posix } from "node:path";
+import { ENTRY_FILE, isFrameworkEntryFile } from "./dead-check.js";
 import { TEST_FILE_RE } from "./internal-audit.collect.js";
 
 const isFileNode = (n) => !String(n.id).includes("#");
@@ -8,20 +9,60 @@ const isFileNode = (n) => !String(n.id).includes("#");
 // Entry set for reachability: conventional entry names + package.json main/module/browser/bin/exports +
 // html pages (they root classic-script apps) + test files (the runner enters them) + root config files +
 // dynamic-import targets. Anything reachable from here is "used"; the rest corroborates unused-file.
-export function entryFiles(graph, pkg, dynamicTargets) {
+export function entryFiles(graph, pkgOrScopes, dynamicTargets = new Set(), { declaredEntries = [], sources = new Map() } = {}) {
   const entries = new Set();
-  const pkgEntries = [];
-  for (const k of ["main", "module", "browser"]) if (typeof pkg[k] === "string") pkgEntries.push(pkg[k]);
-  if (pkg.bin) pkgEntries.push(...(typeof pkg.bin === "string" ? [pkg.bin] : Object.values(pkg.bin)));
-  (function walkExports(e) {
-    if (typeof e === "string") pkgEntries.push(e);
-    else if (e && typeof e === "object") Object.values(e).forEach(walkExports);
-  })(pkg.exports);
-  const pe = new Set(pkgEntries.map((p) => String(p).replace(/^\.\//, "").replace(/\\/g, "/")));
+  const scopes = Array.isArray(pkgOrScopes)
+    ? pkgOrScopes
+    : [{ root: "", manifest: "package.json", pkg: pkgOrScopes || {} }];
+  const fileSet = new Set((graph.nodes || []).filter(isFileNode).map((n) => String(n.source_file || n.id).replace(/\\/g, "/")));
+  const pe = new Set();
+  const resolveEntry = (root, raw) => {
+    let p = String(raw || "").trim().replace(/^['"]|['"]$/g, "").replace(/^file:/, "").replace(/\\/g, "/");
+    if (!p || p.startsWith("-") || /^https?:/.test(p)) return "";
+    p = p.replace(/^\.\//, "");
+    const joined = posix.normalize(root ? posix.join(root, p) : p).replace(/^\.\//, "");
+    if (fileSet.has(joined)) return joined;
+    for (const ext of [".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx", ".py"]) if (fileSet.has(joined + ext)) return joined + ext;
+    return joined;
+  };
+  for (const scope of scopes) {
+    const pkg = scope.pkg || {};
+    const root = String(scope.root || "").replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+    const pkgEntries = [];
+    for (const k of ["main", "module", "browser"]) if (typeof pkg[k] === "string") pkgEntries.push(pkg[k]);
+    if (pkg.bin) pkgEntries.push(...(typeof pkg.bin === "string" ? [pkg.bin] : Object.values(pkg.bin)));
+    (function walkExports(e) {
+      if (typeof e === "string") pkgEntries.push(e);
+      else if (e && typeof e === "object") Object.values(e).forEach(walkExports);
+    })(pkg.exports);
+    // Script commands are external entry surfaces. Extract only path-shaped source tokens; package names,
+    // flags and shell operators are intentionally ignored.
+    for (const script of Object.values(pkg.scripts || {})) {
+      const re = /(?:^|[\s'"=])((?:\.?\.?\/)?[\w@./-]+\.(?:[cm]?[jt]sx?|py|go))(?=$|[\s'";,)&|])/gi;
+      let m;
+      while ((m = re.exec(String(script)))) pkgEntries.push(m[1]);
+      const runner = /\b(?:node|bun|deno|tsx|ts-node|python\d*|electron)\s+(?!-)([\w@./\\-]+)/gi;
+      while ((m = runner.exec(String(script)))) if (/[./\\]/.test(m[1])) pkgEntries.push(m[1]);
+    }
+    for (const p of pkgEntries) pe.add(resolveEntry(root, p));
+  }
   for (const n of graph.nodes || []) {
     if (!isFileNode(n)) continue;
     const f = n.source_file;
-    if (ENTRY_FILE.test(f) || TEST_FILE_RE.test(f) || /\.html?$/i.test(f) || pe.has(f) || /(^|\/)[^/]*\.config\.[a-z]+$/i.test(f)) entries.add(f);
+    if (ENTRY_FILE.test(f) || isFrameworkEntryFile(f) || /\.d\.[cm]?ts$/i.test(f) || TEST_FILE_RE.test(f) || /\.html?$/i.test(f) || pe.has(f) || /(^|\/)[^/]*\.config\.[a-z]+$/i.test(f)) entries.add(f);
+  }
+  for (const raw of Array.isArray(declaredEntries) ? declaredEntries : [declaredEntries]) {
+    const resolved = resolveEntry("", raw);
+    if (resolved && fileSet.has(resolved)) entries.add(resolved);
+  }
+  // Bundled helper programs are often launched by filename (`resolveResource("worker.py")`) rather than
+  // imported. A quoted basename reference from another source file is enough to establish that a code file
+  // under resources/ is a runtime entry, without treating arbitrary prose/config files as roots.
+  for (const file of fileSet) {
+    if (!/(^|\/)resources\/.*\.(?:py|[cm]?[jt]s)$/i.test(file)) continue;
+    const base = posix.basename(file).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const quoted = new RegExp(`["'\x60]${base}["'\x60]`);
+    if ([...sources].some(([other, text]) => other !== file && quoted.test(String(text || "")))) entries.add(file);
   }
   for (const t of dynamicTargets) entries.add(t);
   return entries;

package/src/analysis/internal-audit.run.js

@@ -4,52 +4,73 @@
 import { existsSync } from "node:fs";
 import { join, basename } from "node:path";
 import { computeDead, computeUnusedExports } from "./dead-check.js";
-import { computeDepFindings, computeGoDepFindings, computePyDepFindings } from "./dep-check.js";
+import { computeScopedDepFindings, computeGoDepFindings, computePyDepFindings } from "./dep-check.js";
 import { parseGoMod } from "./manifests.js";
 import { computeStructureFindings } from "./dep-rules.js";
 import { makeFinding, summarizeFindings, sortFindings } from "./findings.js";
 import { graphOutDirForRepo } from "../graph/layout.js";
 import { collectInstalled } from "../security/installed.js";
-import { loadStore, queryStore } from "../security/advisory-store.js";
+import { loadStore, queryStore, advisoryQueryFingerprint } from "../security/advisory-store.js";
 import { matchAdvisories } from "../security/match.js";
 import { scanMalware } from "../security/malware-heuristics.js";
 import { classifyTyposquat } from "../security/typosquat.js";
 import {
-  readText, readJson, collectSourceTexts, collectConfigTexts, workspacePkgNames,
-  collectPyManifest, TEST_FILE_RE,
+  readJson, readRepoText, readRepoJson, collectSourceTexts, collectConfigTexts, workspacePkgNames,
+  collectPackageScopes, collectPyManifest, TEST_FILE_RE,
 } from "./internal-audit.collect.js";
 import { entryFiles, computeReachability } from "./internal-audit.reach.js";
+import { createRepoBoundary } from "../repo-path.js";
 
 // Run the internal audit. graph is optional (loaded from the repo's central graph.json when absent);
 // advisoryStorePath overrides the default ~/.weavatrix/advisories.json (tests use a scratch path).
 // async because the malware sweep shells out to ripgrep.
 export async function runInternalAudit(repoPath, { graph, advisoryStorePath, skipMalwareScan = false, malwareExclusions = {}, rgPath = "" } = {}) {
   if (!existsSync(repoPath)) return { ok: false, error: "Repo path not found" };
+  const boundary = createRepoBoundary(repoPath);
+  if (!boundary.root) return { ok: false, error: "Repository path is unreadable" };
   if (!graph) {
     graph = readJson(join(graphOutDirForRepo(repoPath), "graph.json"));
     if (!graph) return { ok: false, error: "Build the graph first (no graph.json)" };
   }
-  const pkg = readJson(join(repoPath, "package.json")) || {};
+  const pkg = readRepoJson(boundary, "package.json") || {};
+  const packageScopes = collectPackageScopes(repoPath, pkg);
   const externalImports = graph.externalImports || [];
   const dynamicTargets = new Set(externalImports.filter((e) => e.dynamic && e.target).map((e) => e.target));
+  const rules = readRepoJson(boundary, ".weavatrix-deps.json") || {};
 
   // Graphs can be stale or miss a helper file; text fallbacks must scan the real repo tree too.
   const sources = collectSourceTexts(repoPath, graph);
 
-  const dead = computeDead(graph, sources);
-  const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets });
-  const entries = entryFiles(graph, pkg, dynamicTargets);
+  const entries = entryFiles(graph, packageScopes, dynamicTargets, {
+    declaredEntries: rules.entrypoints || rules.entries || [],
+    sources,
+  });
+  const dead = computeDead(graph, sources, { entrySet: entries });
+  const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets, entrySet: entries });
   const reachable = computeReachability(graph, entries);
   const configTexts = collectConfigTexts(repoPath);
-  const dep = computeDepFindings({ externalImports, pkg, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts });
+  const dep = computeScopedDepFindings({ externalImports, packageScopes, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts });
   // non-npm ecosystems: Go (go.mod) + Python (requirements/pyproject/Pipfile) — same findings shape
-  const goModText = readText(join(repoPath, "go.mod"));
+  const goModText = readRepoText(boundary, "go.mod");
   const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null });
-  const pyDep = computePyDepFindings({ externalImports, pyManifest: collectPyManifest(repoPath), configTexts });
+  const asList = (v) => Array.isArray(v) ? v : typeof v === "string" ? [v] : [];
+  const pyRules = rules.python || {};
+  const depRules = rules.dependencies || {};
+  const managedPython = [...new Set([
+    ...asList(rules.managedPythonDependencies), ...asList(pyRules.managed), ...asList(pyRules.managedDependencies),
+    ...asList(depRules.managedPython),
+  ])];
+  const ignoredPython = [...new Set([
+    ...asList(rules.ignorePythonDependencies), ...asList(pyRules.ignore), ...asList(pyRules.ignoreDependencies),
+    ...asList(depRules.ignorePython),
+  ])];
+  const pyDep = computePyDepFindings({
+    externalImports, pyManifest: collectPyManifest(repoPath), configTexts,
+    managedDependencies: managedPython, ignoredDependencies: ignoredPython,
+  });
 
   // structure: cycles / orphans / boundary rules. Rules come from the repo's optional .weavatrix-deps.json
   // (the depcruise-config analogue); no bundled default rules — cycles+orphans are always on.
-  const rules = readJson(join(repoPath, ".weavatrix-deps.json")) || {};
   const externalImportFiles = new Set(externalImports.filter((e) => e.pkg && !e.builtin).map((e) => e.file));
   const structure = computeStructureFindings(graph, { rules, entrySet: entries, externalImportFiles });
 
@@ -58,7 +79,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   const deadFileSet = new Set(dead.deadFiles.map((f) => f.file));
   for (const f of structure.findings) if (!(f.rule === "orphan-file" && deadFileSet.has(f.file))) findings.push(f);
   for (const f of dead.deadFiles) {
-    if (dynamicTargets.has(f.file) || TEST_FILE_RE.test(f.file)) continue;
+    if (entries.has(f.file) || dynamicTargets.has(f.file) || TEST_FILE_RE.test(f.file)) continue;
     findings.push(makeFinding({
       category: "unused",
       rule: "unused-file",
@@ -72,6 +93,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       fixHint: "review, then delete the file",
     }));
   }
+  let unusedExportCount = 0;
   for (const s of unusedExports) {
     if (s.test) continue; // exports from test files are runner-visible noise
     if (/(^|\/)[^/]*\.config\.[a-z0-9]+$|(^|\/)\.[^/]+rc(\.[a-z]+)?$/i.test(s.file)) continue; // config exports are consumed by their tool
@@ -87,6 +109,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       graphNodeId: s.id,
       source: "internal",
     }));
+    unusedExportCount++;
   }
 
   // ---- supply-chain: installed packages × cached OSV advisories. 100% OFFLINE here — the cache is
@@ -94,14 +117,31 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   let advisoryDbDate = null;
   let installedCount = 0;
   let inst = { installed: [], drift: [] };
+  const checks = {
+    osv: { status: "NOT_CHECKED", detail: "Advisory cache was never refreshed for this repository. The refresh_advisories tool belongs to the optional online capability group: enable that group in the MCP registration, then call the tool explicitly to opt in to sending pinned package names and versions to OSV.dev." },
+    malware: { status: skipMalwareScan ? "NOT_CHECKED" : "PENDING", detail: skipMalwareScan ? "Installed-package malware scan is opt-in and was not requested." : "" },
+  };
   try {
     inst = collectInstalled(repoPath);
     installedCount = inst.installed.length;
     const store = advisoryStorePath ? loadStore(advisoryStorePath) : loadStore();
-    // per-repo date when the store tracks it (cache only covers QUERIED packages); legacy stores
-    // without the repos map keep the old global-date behavior
-    advisoryDbDate = store.meta?.repos ? store.meta.repos[repoPath] || null : store.meta?.fetched_at || null;
+    // Only a per-repo stamp proves that this repository's installed versions were queried. A legacy
+    // global fetched_at may belong to another repo and must never certify this one as clean.
+    const repoStamp = store.meta?.repos?.[repoPath] || null;
+    advisoryDbDate = typeof repoStamp === "string" ? repoStamp : repoStamp?.fetched_at || null;
     if (advisoryDbDate) {
+      let status = typeof repoStamp === "object" && ["OK", "PARTIAL", "ERROR"].includes(repoStamp.status) ? repoStamp.status : "PARTIAL";
+      const fingerprintMatches = typeof repoStamp === "object" && repoStamp.query_fingerprint === advisoryQueryFingerprint(inst.installed);
+      if (!fingerprintMatches && status === "OK") status = "PARTIAL";
+      const coverage = typeof repoStamp === "object" && Number.isFinite(repoStamp.queried)
+        ? ` (${repoStamp.queried_ok ?? repoStamp.queried}/${repoStamp.queried} package versions queried successfully)`
+        : "";
+      const drift = fingerprintMatches ? "" : " Dependency versions changed, or this is a legacy stamp without a package fingerprint; enable the optional online capability group and call refresh_advisories for complete coverage.";
+      checks.osv = {
+        status,
+        detail: `${status === "PARTIAL" ? "Partially matched" : "Matched"} installed packages against the cached OSV snapshot from ${advisoryDbDate}${coverage}.${drift}`,
+        checkedAt: advisoryDbDate,
+      };
       for (const h of matchAdvisories(inst.installed, (eco, name) => queryStore(store, eco, name))) {
         const mal = h.adv.kind === "malicious";
         findings.push(makeFinding({
@@ -120,7 +160,8 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       }
     }
     // direct-dependency typosquat (dev-chosen names, small set → low FP): surface quietly even alone.
-    for (const name of Object.keys({ ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) })) {
+    const directDependencyNames = new Set(packageScopes.flatMap((s) => Object.keys({ ...(s.pkg?.dependencies || {}), ...(s.pkg?.devDependencies || {}) })));
+    for (const name of directDependencyNames) {
       const sq = classifyTyposquat(name);
       if (!sq) continue;
       findings.push(makeFinding({
@@ -149,7 +190,9 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
         fixHint: "npm ci (clean install from the lockfile)",
       }));
     }
-  } catch { /* supply-chain layer is best-effort */ }
+  } catch (error) {
+    checks.osv = { status: "ERROR", detail: `Offline advisory matching failed: ${error instanceof Error ? error.message : String(error)}` };
+  }
 
   // ---- malware heuristics: install-script beacons / miners / exfil / obfuscation across installed libs.
   // Local + offline (ripgrep or a bounded Node fallback). Scans node_modules, Python venvs, Go vendor/cache.
@@ -160,7 +203,10 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       const scan = await scanMalware(repoPath, { installed: inst.installed, importedPkgs, malwareExclusions, rgPath });
       findings.push(...scan.findings);
       malwareScan = { scanMode: scan.scanMode, packagesScanned: scan.packagesScanned, findings: scan.findings.length, excludedSignals: scan.excludedSignals || 0 };
-    } catch { /* heuristic scan is best-effort */ }
+      checks.malware = { status: "OK", detail: `Scanned ${scan.packagesScanned} installed package(s) using ${scan.scanMode}.` };
+    } catch (error) {
+      checks.malware = { status: "ERROR", detail: `Installed-package malware scan failed: ${error instanceof Error ? error.message : String(error)}` };
+    }
   }
 
   const sorted = sortFindings(findings);
@@ -175,15 +221,20 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       symbols: dead.stats.symbols,
       manifestDeps: dep.declared.size + goDep.declared.size + pyDep.declared.size,
       externalImports: externalImports.length,
-      nodeModulesPresent: existsSync(join(repoPath, "node_modules")),
+      nodeModulesPresent: boundary.resolve("node_modules").ok,
       installedPackages: installedCount,
       advisoryDbDate,
+      advisoryStatus: checks.osv.status,
       malwareScanMode: malwareScan?.scanMode || "skipped",
+      malwareStatus: checks.malware.status,
+      packageScopes: packageScopes.length,
+      managedPythonDependencies: managedPython.length,
     },
     summary: summarizeFindings(sorted),
     findings: sorted,
-    deadReport: { deadSymbols: dead.deadSymbols.length, deadFiles: dead.deadFiles.length, unusedExports: unusedExports.length },
+    deadReport: { deadSymbols: dead.deadSymbols.length, deadFiles: dead.deadFiles.length, unusedExports: unusedExportCount },
     structureReport: structure.stats,
+    checks,
     malwareScan,
   };
 }

package/src/build-graph.js

@@ -9,6 +9,7 @@
 import { existsSync, writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { Worker } from "node:worker_threads";
+import { childProcessEnv } from "./child-env.js";
 import { graphOutDirForRepo, repoTopFolders, summarizeCommunities, summarizeHotspots, filterGraphForMode, filterGraphByScope } from "./graph/layout.js";
 
 // The worker path deadlocks web-tree-sitter's WASM in Electron's worker threads (fine in plain Node) — off
@@ -25,7 +26,7 @@ function buildGraphInWorker(payload) {
   return new Promise((resolve, reject) => {
     let worker;
     try {
-      worker = new Worker(new URL("./graph/build-worker.js", import.meta.url), { workerData: payload });
+      worker = new Worker(new URL("./graph/build-worker.js", import.meta.url), { workerData: payload, env: childProcessEnv() });
     } catch (e) {
       reject(Object.assign(e, { workerStartFailed: true }));
       return;

package/src/child-env.js

@@ -0,0 +1,7 @@
+// Child processes and worker threads do not need the hosted-sync bearer token.
+// Keep it in the MCP process so only sync_graph can attach it to an HTTP request.
+export function childProcessEnv(overrides = {}) {
+  const env = { ...process.env, ...overrides };
+  delete env.WEAVATRIX_SYNC_TOKEN;
+  return env;
+}