weavatrix 0.1.2 → 0.1.3

package/src/analysis/internal-audit.run.js

@@ -4,19 +4,19 @@
 import { existsSync } from "node:fs";
 import { join, basename } from "node:path";
 import { computeDead, computeUnusedExports } from "./dead-check.js";
-import { computeDepFindings, computeGoDepFindings, computePyDepFindings } from "./dep-check.js";
+import { computeScopedDepFindings, computeGoDepFindings, computePyDepFindings } from "./dep-check.js";
 import { parseGoMod } from "./manifests.js";
 import { computeStructureFindings } from "./dep-rules.js";
 import { makeFinding, summarizeFindings, sortFindings } from "./findings.js";
 import { graphOutDirForRepo } from "../graph/layout.js";
 import { collectInstalled } from "../security/installed.js";
-import { loadStore, queryStore } from "../security/advisory-store.js";
+import { loadStore, queryStore, advisoryQueryFingerprint } from "../security/advisory-store.js";
 import { matchAdvisories } from "../security/match.js";
 import { scanMalware } from "../security/malware-heuristics.js";
 import { classifyTyposquat } from "../security/typosquat.js";
 import {
   readJson, readRepoText, readRepoJson, collectSourceTexts, collectConfigTexts, workspacePkgNames,
-  collectPyManifest, TEST_FILE_RE,
+  collectPackageScopes, collectPyManifest, TEST_FILE_RE,
 } from "./internal-audit.collect.js";
 import { entryFiles, computeReachability } from "./internal-audit.reach.js";
 import { createRepoBoundary } from "../repo-path.js";
@@ -33,26 +33,44 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
     if (!graph) return { ok: false, error: "Build the graph first (no graph.json)" };
   }
   const pkg = readRepoJson(boundary, "package.json") || {};
+  const packageScopes = collectPackageScopes(repoPath, pkg);
   const externalImports = graph.externalImports || [];
   const dynamicTargets = new Set(externalImports.filter((e) => e.dynamic && e.target).map((e) => e.target));
+  const rules = readRepoJson(boundary, ".weavatrix-deps.json") || {};
 
   // Graphs can be stale or miss a helper file; text fallbacks must scan the real repo tree too.
   const sources = collectSourceTexts(repoPath, graph);
 
-  const dead = computeDead(graph, sources);
-  const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets });
-  const entries = entryFiles(graph, pkg, dynamicTargets);
+  const entries = entryFiles(graph, packageScopes, dynamicTargets, {
+    declaredEntries: rules.entrypoints || rules.entries || [],
+    sources,
+  });
+  const dead = computeDead(graph, sources, { entrySet: entries });
+  const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets, entrySet: entries });
   const reachable = computeReachability(graph, entries);
   const configTexts = collectConfigTexts(repoPath);
-  const dep = computeDepFindings({ externalImports, pkg, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts });
+  const dep = computeScopedDepFindings({ externalImports, packageScopes, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts });
   // non-npm ecosystems: Go (go.mod) + Python (requirements/pyproject/Pipfile) — same findings shape
   const goModText = readRepoText(boundary, "go.mod");
   const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null });
-  const pyDep = computePyDepFindings({ externalImports, pyManifest: collectPyManifest(repoPath), configTexts });
+  const asList = (v) => Array.isArray(v) ? v : typeof v === "string" ? [v] : [];
+  const pyRules = rules.python || {};
+  const depRules = rules.dependencies || {};
+  const managedPython = [...new Set([
+    ...asList(rules.managedPythonDependencies), ...asList(pyRules.managed), ...asList(pyRules.managedDependencies),
+    ...asList(depRules.managedPython),
+  ])];
+  const ignoredPython = [...new Set([
+    ...asList(rules.ignorePythonDependencies), ...asList(pyRules.ignore), ...asList(pyRules.ignoreDependencies),
+    ...asList(depRules.ignorePython),
+  ])];
+  const pyDep = computePyDepFindings({
+    externalImports, pyManifest: collectPyManifest(repoPath), configTexts,
+    managedDependencies: managedPython, ignoredDependencies: ignoredPython,
+  });
 
   // structure: cycles / orphans / boundary rules. Rules come from the repo's optional .weavatrix-deps.json
   // (the depcruise-config analogue); no bundled default rules — cycles+orphans are always on.
-  const rules = readRepoJson(boundary, ".weavatrix-deps.json") || {};
   const externalImportFiles = new Set(externalImports.filter((e) => e.pkg && !e.builtin).map((e) => e.file));
   const structure = computeStructureFindings(graph, { rules, entrySet: entries, externalImportFiles });
 
@@ -61,7 +79,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   const deadFileSet = new Set(dead.deadFiles.map((f) => f.file));
   for (const f of structure.findings) if (!(f.rule === "orphan-file" && deadFileSet.has(f.file))) findings.push(f);
   for (const f of dead.deadFiles) {
-    if (dynamicTargets.has(f.file) || TEST_FILE_RE.test(f.file)) continue;
+    if (entries.has(f.file) || dynamicTargets.has(f.file) || TEST_FILE_RE.test(f.file)) continue;
     findings.push(makeFinding({
       category: "unused",
       rule: "unused-file",
@@ -75,6 +93,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       fixHint: "review, then delete the file",
     }));
   }
+  let unusedExportCount = 0;
   for (const s of unusedExports) {
     if (s.test) continue; // exports from test files are runner-visible noise
     if (/(^|\/)[^/]*\.config\.[a-z0-9]+$|(^|\/)\.[^/]+rc(\.[a-z]+)?$/i.test(s.file)) continue; // config exports are consumed by their tool
@@ -90,6 +109,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       graphNodeId: s.id,
       source: "internal",
     }));
+    unusedExportCount++;
   }
 
   // ---- supply-chain: installed packages × cached OSV advisories. 100% OFFLINE here — the cache is
@@ -97,14 +117,31 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   let advisoryDbDate = null;
   let installedCount = 0;
   let inst = { installed: [], drift: [] };
+  const checks = {
+    osv: { status: "NOT_CHECKED", detail: "Advisory cache was never refreshed for this repository. The refresh_advisories tool belongs to the optional online capability group: enable that group in the MCP registration, then call the tool explicitly to opt in to sending pinned package names and versions to OSV.dev." },
+    malware: { status: skipMalwareScan ? "NOT_CHECKED" : "PENDING", detail: skipMalwareScan ? "Installed-package malware scan is opt-in and was not requested." : "" },
+  };
   try {
     inst = collectInstalled(repoPath);
     installedCount = inst.installed.length;
     const store = advisoryStorePath ? loadStore(advisoryStorePath) : loadStore();
-    // per-repo date when the store tracks it (cache only covers QUERIED packages); legacy stores
-    // without the repos map keep the old global-date behavior
-    advisoryDbDate = store.meta?.repos ? store.meta.repos[repoPath] || null : store.meta?.fetched_at || null;
+    // Only a per-repo stamp proves that this repository's installed versions were queried. A legacy
+    // global fetched_at may belong to another repo and must never certify this one as clean.
+    const repoStamp = store.meta?.repos?.[repoPath] || null;
+    advisoryDbDate = typeof repoStamp === "string" ? repoStamp : repoStamp?.fetched_at || null;
     if (advisoryDbDate) {
+      let status = typeof repoStamp === "object" && ["OK", "PARTIAL", "ERROR"].includes(repoStamp.status) ? repoStamp.status : "PARTIAL";
+      const fingerprintMatches = typeof repoStamp === "object" && repoStamp.query_fingerprint === advisoryQueryFingerprint(inst.installed);
+      if (!fingerprintMatches && status === "OK") status = "PARTIAL";
+      const coverage = typeof repoStamp === "object" && Number.isFinite(repoStamp.queried)
+        ? ` (${repoStamp.queried_ok ?? repoStamp.queried}/${repoStamp.queried} package versions queried successfully)`
+        : "";
+      const drift = fingerprintMatches ? "" : " Dependency versions changed, or this is a legacy stamp without a package fingerprint; enable the optional online capability group and call refresh_advisories for complete coverage.";
+      checks.osv = {
+        status,
+        detail: `${status === "PARTIAL" ? "Partially matched" : "Matched"} installed packages against the cached OSV snapshot from ${advisoryDbDate}${coverage}.${drift}`,
+        checkedAt: advisoryDbDate,
+      };
       for (const h of matchAdvisories(inst.installed, (eco, name) => queryStore(store, eco, name))) {
         const mal = h.adv.kind === "malicious";
         findings.push(makeFinding({
@@ -123,7 +160,8 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       }
     }
     // direct-dependency typosquat (dev-chosen names, small set → low FP): surface quietly even alone.
-    for (const name of Object.keys({ ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) })) {
+    const directDependencyNames = new Set(packageScopes.flatMap((s) => Object.keys({ ...(s.pkg?.dependencies || {}), ...(s.pkg?.devDependencies || {}) })));
+    for (const name of directDependencyNames) {
       const sq = classifyTyposquat(name);
       if (!sq) continue;
       findings.push(makeFinding({
@@ -152,7 +190,9 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
         fixHint: "npm ci (clean install from the lockfile)",
       }));
     }
-  } catch { /* supply-chain layer is best-effort */ }
+  } catch (error) {
+    checks.osv = { status: "ERROR", detail: `Offline advisory matching failed: ${error instanceof Error ? error.message : String(error)}` };
+  }
 
   // ---- malware heuristics: install-script beacons / miners / exfil / obfuscation across installed libs.
   // Local + offline (ripgrep or a bounded Node fallback). Scans node_modules, Python venvs, Go vendor/cache.
@@ -163,7 +203,10 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       const scan = await scanMalware(repoPath, { installed: inst.installed, importedPkgs, malwareExclusions, rgPath });
       findings.push(...scan.findings);
       malwareScan = { scanMode: scan.scanMode, packagesScanned: scan.packagesScanned, findings: scan.findings.length, excludedSignals: scan.excludedSignals || 0 };
-    } catch { /* heuristic scan is best-effort */ }
+      checks.malware = { status: "OK", detail: `Scanned ${scan.packagesScanned} installed package(s) using ${scan.scanMode}.` };
+    } catch (error) {
+      checks.malware = { status: "ERROR", detail: `Installed-package malware scan failed: ${error instanceof Error ? error.message : String(error)}` };
+    }
   }
 
   const sorted = sortFindings(findings);
@@ -181,12 +224,17 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       nodeModulesPresent: boundary.resolve("node_modules").ok,
       installedPackages: installedCount,
       advisoryDbDate,
+      advisoryStatus: checks.osv.status,
       malwareScanMode: malwareScan?.scanMode || "skipped",
+      malwareStatus: checks.malware.status,
+      packageScopes: packageScopes.length,
+      managedPythonDependencies: managedPython.length,
     },
     summary: summarizeFindings(sorted),
     findings: sorted,
-    deadReport: { deadSymbols: dead.deadSymbols.length, deadFiles: dead.deadFiles.length, unusedExports: unusedExports.length },
+    deadReport: { deadSymbols: dead.deadSymbols.length, deadFiles: dead.deadFiles.length, unusedExports: unusedExportCount },
     structureReport: structure.stats,
+    checks,
     malwareScan,
   };
 }

package/src/graph/builder/lang-js.js

@@ -32,37 +32,56 @@ export default {
     // on deeply-nested / minified / bundled JS (regression). An export_statement is always a NEAR ancestor of
     // the declaration head (≤ ~5 hops), and hitting a statement_block means we're nested inside a function →
     // not a module-level export → bail immediately. See [[graph-builder-internalization]].
-    // early-out on statement_block (we're nested inside a function → not a module-level export) keeps this
-    // O(1) for nested symbols; program is the top; the hop cap is the backstop. A method of an EXPORTED class
-    // is only ~4 hops to its export_statement (method → class_body → class_declaration → export_statement),
-    // so we do NOT bail at class_body — that preserves the exported flag for such methods.
+    // Early-out for nested scopes keeps this O(1); class members are intentionally never module exports even
+    // when their owner class is exported. The hop cap remains a backstop for malformed/deep syntax trees.
     const isExportedDecl = (node) => {
       let p = node.parent;
       for (let hops = 0; p && hops < 6; hops++) {
         if (p.type === "export_statement") return true;
-        if (p.type === "program" || p.type === "statement_block") return false;
+        if (p.type === "program" || p.type === "statement_block" || p.type === "class_body") return false;
+        p = p.parent;
+      }
+      return false;
+    };
+    const isModuleDeclaration = (node) => {
+      let p = node.parent;
+      for (let hops = 0; p && hops < 8; hops++) {
+        if (p.type === "program") return true;
+        if (p.type === "statement_block" || p.type === "class_body") return false;
         p = p.parent;
       }
       return false;
     };
     // a bare (package) specifier = non-relative AND not a path alias; alias-that-missed is a broken local, not a dep
-    const isBareSpec = (spec) => !!spec && !spec.startsWith(".") && resolveAlias(spec) == null;
+    const isBareSpec = (spec) => !!spec && !spec.startsWith(".") && resolveAlias(fileRel, spec) == null;
     // broken local import (relative or alias path resolving to no file) — recorded for the "unresolved-import"
     // finding. Asset imports (svg/css-modules-adjacent/fonts/…) and ?query-suffixed specs that resolve once
     // the query is stripped (Vite ?raw/?url/?worker) are NOT code-graph concerns.
     const ASSET_RE = /\.(svg|png|jpe?g|gif|webp|avif|ico|bmp|woff2?|ttf|eot|otf|mp[34]|webm|wasm|pdf|txt|md|html?)$/i;
-    const recordUnresolved = (rawSpec, kind, line) => {
+    const recordUnresolved = (rawSpec, kind, line, typeOnly = false) => {
       const clean = String(rawSpec || "").split("?")[0];
       if (!clean || ASSET_RE.test(clean)) return;
       if (clean !== rawSpec && resolveJsImport(fileRel, clean)) return; // only the ?query broke resolution
-      addExternalImport({ spec: rawSpec, kind, line, unresolved: true });
+      addExternalImport({ spec: rawSpec, kind, line, unresolved: true, typeOnly });
     };
 
     // ---- symbols (export flag captured at declaration time) ----
+    const methodMetadata = (nameNode) => {
+      let method = nameNode.parent;
+      while (method && method.type !== "method_definition") method = method.parent;
+      let owner = method?.parent;
+      while (owner && !["class_declaration", "class"].includes(owner.type)) owner = owner.parent;
+      const ownerName = owner && field(owner, "name")?.text;
+      const visibility = /^\s*private\b/.test(method?.text || "") ? "private"
+        : /^\s*protected\b/.test(method?.text || "") ? "protected" : "public";
+      return { symbolKind: "method", ...(ownerName ? { memberOf: ownerName } : {}), visibility };
+    };
     for (const cap of caps(grammar, FUNCS, tree.rootNode)) {
+      const isMethod = cap.name === "method";
       addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name !== "class", {
         sourceNode: cap.node.parent,
-        ...(isExportedDecl(cap.node) ? { exported: true } : {})
+        ...(!isMethod && isExportedDecl(cap.node) ? { exported: true } : {}),
+        ...(isMethod ? methodMetadata(cap.node) : { symbolKind: cap.name === "class" ? "class" : "function", moduleDeclaration: isModuleDeclaration(cap.node) })
       });
     }
     for (const cap of caps(grammar, TOPVARS, tree.rootNode)) {
@@ -70,26 +89,47 @@ export default {
       const val = field(cap.node, "value");
       addSym(nameNode.text, nameNode.startPosition.row + 1, !!(val && CALLABLE.test(val.type)), {
         sourceNode: val || cap.node,
-        ...(isExportedDecl(cap.node) ? { exported: true } : {})
+        ...(isExportedDecl(cap.node) ? { exported: true } : {}),
+        symbolKind: "variable",
+        moduleDeclaration: true
       });
     }
 
+    const importTypeOnly = (node) => {
+      if (/^\s*import\s+type\b/.test(node.text)) return true;
+      const clause = node.namedChildren.find((c) => c.type === "import_clause");
+      if (!clause) return false; // side-effect import executes the target module
+      const parts = clause.namedChildren;
+      if (parts.some((c) => c.type === "identifier" || c.type === "namespace_import")) return false;
+      const named = parts.find((c) => c.type === "named_imports");
+      const specs = named?.namedChildren.filter((c) => c.type === "import_specifier") || [];
+      return specs.length > 0 && specs.every((s) => /^\s*type\b/.test(s.text));
+    };
+    const reexportTypeOnly = (node) => {
+      if (/^\s*export\s+type\b/.test(node.text)) return true;
+      const clause = node.namedChildren.find((c) => c.type === "export_clause");
+      const specs = clause?.namedChildren.filter((c) => c.type === "export_specifier") || [];
+      return specs.length > 0 && specs.every((s) => /^\s*type\b/.test(s.text));
+    };
+
     // ---- ESM imports ----
     for (const cap of caps(grammar, `(import_statement) @imp`, tree.rootNode)) {
       const node = cap.node; const srcNode = field(node, "source");
       const rawSpec = srcNode ? srcNode.text.replace(/^['"`]|['"`]$/g, "") : "";
+      const line = node.startPosition.row + 1;
+      const typeOnly = importTypeOnly(node);
       const tgt = resolveJsImport(fileRel, rawSpec);
       if (!tgt) {
-        if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "esm", line: node.startPosition.row + 1 });
-        else if (rawSpec) recordUnresolved(rawSpec, "esm", node.startPosition.row + 1);
+        if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "esm", line, typeOnly });
+        else if (rawSpec) recordUnresolved(rawSpec, "esm", line, typeOnly);
         continue;
       }
-      addImportEdge(tgt);
+      addImportEdge(tgt, { typeOnly, line, specifier: rawSpec });
       const clause = node.namedChildren.find((c) => c.type === "import_clause"); if (!clause) continue;
       for (const c of clause.namedChildren) {
-        if (c.type === "identifier") imports.set(c.text, { imported: "default", targetFile: tgt });
-        else if (c.type === "namespace_import") { const id = c.namedChildren.find((x) => x.type === "identifier"); if (id) imports.set(id.text, { imported: "*", targetFile: tgt }); }
-        else if (c.type === "named_imports") for (const s of c.namedChildren) { if (s.type !== "import_specifier") continue; const nm = field(s, "name"), al = field(s, "alias"); if (nm) imports.set((al || nm).text, { imported: nm.text, targetFile: tgt }); }
+        if (c.type === "identifier") imports.set(c.text, { imported: "default", targetFile: tgt, typeOnly });
+        else if (c.type === "namespace_import") { const id = c.namedChildren.find((x) => x.type === "identifier"); if (id) imports.set(id.text, { imported: "*", targetFile: tgt, typeOnly }); }
+        else if (c.type === "named_imports") for (const s of c.namedChildren) { if (s.type !== "import_specifier") continue; const nm = field(s, "name"), al = field(s, "alias"); if (nm) imports.set((al || nm).text, { imported: nm.text, targetFile: tgt, typeOnly: typeOnly || /^\s*type\b/.test(s.text) }); }
       }
     }
 
@@ -98,7 +138,7 @@ export default {
       if (cap.name !== "src") continue;
       let dv = cap.node; while (dv && dv.type !== "variable_declarator") dv = dv.parent;
       const tgt = resolveJsImport(fileRel, cap.node.text); if (!tgt) continue;
-      addImportEdge(tgt);
+      addImportEdge(tgt, { typeOnly: false, line: cap.node.startPosition.row + 1, specifier: cap.node.text });
       const lhs = dv && field(dv, "name");
       if (lhs && lhs.type === "identifier") imports.set(lhs.text, { imported: "*", targetFile: tgt });
       else if (lhs && lhs.type === "object_pattern") for (const p of lhs.namedChildren) { const key = field(p, "key") || (p.type === "shorthand_property_identifier_pattern" ? p : null); const val = field(p, "value"); const local = (val && val.type === "identifier") ? val : key; if (key && local) imports.set(local.text, { imported: key.text, targetFile: tgt }); }
@@ -139,13 +179,16 @@ export default {
     }
 
     // ---- re-exports (barrel/index files): edge so the real target isn't falsely DEAD; bare source → external ----
-    for (const cap of caps(grammar, `(export_statement source: (string (string_fragment) @src))`, tree.rootNode)) {
-      if (cap.name !== "src") continue;
-      const rawSpec = cap.node.text;
+    for (const cap of caps(grammar, `(export_statement) @exp`, tree.rootNode)) {
+      const node = cap.node; const srcNode = field(node, "source");
+      if (!srcNode) continue;
+      const rawSpec = srcNode.text.replace(/^['"`]|['"`]$/g, "");
+      const line = node.startPosition.row + 1;
+      const typeOnly = reexportTypeOnly(node);
       const tgt = resolveJsImport(fileRel, rawSpec);
-      if (tgt) addImportEdge(tgt);
-      else if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "reexport", line: cap.node.startPosition.row + 1 });
-      else if (rawSpec) recordUnresolved(rawSpec, "reexport", cap.node.startPosition.row + 1);
+      if (tgt) addImportEdge(tgt, { relation: "re_exports", typeOnly, line, specifier: rawSpec });
+      else if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "reexport", line, typeOnly });
+      else if (rawSpec) recordUnresolved(rawSpec, "reexport", line, typeOnly);
     }
 
     // ---- export markers beyond declarations: `export { a, b }`, `export default X`, CJS module.exports ----

package/src/graph/internal-builder.build.js

@@ -53,7 +53,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
     const parser = new Parser(); parser.setLanguage(langs[grammar]);
     let tree; try { tree = parser.parse(code); } catch { continue; }
 
-    const syms = []; const nameToId = new Map();
+    const syms = []; const nameToId = new Map(); const moduleNameToId = new Map();
     const addSym = (name, line, callable, extra) => {
       if (!name || !/^[A-Za-z_$][\w$]*$/.test(name)) return;
       const id = `${fileRel}#${name}@${line}`; if (nodeIds.has(id)) return;
@@ -73,28 +73,44 @@ export async function buildInternalGraph(repoDir, opts = {}) {
         ...(endLine >= line ? { source_end: `L${endLine}` } : {}),
         ...(complexity ? { complexity } : {}),
         ...(extra && extra.exported ? { exported: true } : {}),
-        ...(extra && extra.decorated ? { decorated: true } : {})
+        ...(extra && extra.decorated ? { decorated: true } : {}),
+        ...(extra && extra.symbolKind ? { symbol_kind: extra.symbolKind } : {}),
+        ...(extra && extra.memberOf ? { member_of: extra.memberOf } : {}),
+        ...(extra && extra.visibility ? { visibility: extra.visibility } : {})
       });
       links.push({ source: fileRel, target: id, relation: "contains", confidence: "EXTRACTED" });
-      syms.push({ id, name, start: line, end: endLine >= line ? endLine : 0 }); if (!nameToId.has(name)) nameToId.set(name, id);
+      syms.push({ id, name, start: line, end: endLine >= line ? endLine : 0 });
+      if (!nameToId.has(name)) nameToId.set(name, id);
+      if (extra?.moduleDeclaration && !moduleNameToId.has(name)) moduleNameToId.set(name, id);
     };
     const imports = new Map(); importedLocals.set(fileRel, imports);
-    const addImportEdge = (tgt) => { if (tgt && tgt !== fileRel) links.push({ source: fileRel, target: tgt, relation: "imports", confidence: "EXTRACTED" }); };
+    const addImportEdge = (tgt, meta = {}) => {
+      if (!tgt || tgt === fileRel) return;
+      links.push({
+        source: fileRel,
+        target: tgt,
+        relation: meta.relation || "imports",
+        confidence: "EXTRACTED",
+        ...(typeof meta.typeOnly === "boolean" ? { typeOnly: meta.typeOnly } : {}),
+        ...(meta.line ? { line: meta.line } : {}),
+        ...(meta.specifier ? { specifier: meta.specifier } : {}),
+      });
+    };
     // rec: {spec, kind, line} bare-pkg import · {dynamic:true, spec?, target?} dynamic import marker
     // (target = internally-resolved dynamic import; suppresses false "unused file" in dep analysis) ·
     // {unresolved:true, spec} broken local import (relative or alias path that resolves to no file).
     const addExternalImport = (rec) => {
       if (!rec) return;
-      if (rec.dynamic) { externalImports.push({ file: fileRel, spec: rec.spec || null, kind: rec.kind || "dynamic", dynamic: true, line: rec.line || 0, ...(rec.target ? { target: rec.target } : {}) }); return; }
-      if (rec.unresolved) { externalImports.push({ file: fileRel, spec: rec.spec, kind: rec.kind || "esm", unresolved: true, line: rec.line || 0 }); return; }
+      if (rec.dynamic) { externalImports.push({ file: fileRel, spec: rec.spec || null, kind: rec.kind || "dynamic", dynamic: true, line: rec.line || 0, ...(rec.target ? { target: rec.target } : {}), ...(rec.typeOnly ? { typeOnly: true } : {}) }); return; }
+      if (rec.unresolved) { externalImports.push({ file: fileRel, spec: rec.spec, kind: rec.kind || "esm", unresolved: true, line: rec.line || 0, ...(rec.typeOnly ? { typeOnly: true } : {}) }); return; }
       // non-npm extractors (go/python) classify their own specs and pass pkg/builtin/ecosystem precomputed
-      if (rec.pkg) { externalImports.push({ file: fileRel, spec: rec.spec, pkg: rec.pkg, builtin: !!rec.builtin, kind: rec.kind || "import", line: rec.line || 0, ...(rec.ecosystem ? { ecosystem: rec.ecosystem } : {}) }); return; }
+      if (rec.pkg) { externalImports.push({ file: fileRel, spec: rec.spec, pkg: rec.pkg, builtin: !!rec.builtin, kind: rec.kind || "import", line: rec.line || 0, ...(rec.ecosystem ? { ecosystem: rec.ecosystem } : {}), ...(rec.typeOnly ? { typeOnly: true } : {}) }); return; }
       const r = specToPkg(rec.spec);
       if (!r) return;
-      externalImports.push({ file: fileRel, spec: rec.spec, pkg: r.pkg, builtin: !!r.builtin, kind: rec.kind || "esm", line: rec.line || 0 });
+      externalImports.push({ file: fileRel, spec: rec.spec, pkg: r.pkg, builtin: !!r.builtin, kind: rec.kind || "esm", line: rec.line || 0, ...(rec.typeOnly ? { typeOnly: true } : {}) });
     };
     // Post-hoc export flag (export {a}, export default X, CJS module.exports) — declarations are flagged at addSym time.
-    const markExported = (name) => { const id = nameToId.get(name); const n = id && nodeById.get(id); if (n) n.exported = true; };
+    const markExported = (name) => { const id = moduleNameToId.get(name); const n = id && nodeById.get(id); if (n) n.exported = true; };
 
     try { lang.pass1({ grammar, tree, fileRel, code, caps, field, addSym, addNode, links, nodeIds, syms, nameToId, imports, addImportEdge, addExternalImport, markExported, fileSet, ...resolvers }); }
     catch (e) { /* one bad file never sinks the whole build */ void e; }
@@ -164,6 +180,28 @@ export async function buildInternalGraph(repoDir, opts = {}) {
       const target = resolveCall(cap.node.text, fileRel);
       if (target && target !== cls.id) links.push({ source: cls.id, target, relation: "inherits", confidence: "INFERRED" });
     }
+    // JSX is a real symbol use even though it is not a call_expression. Resolve imported components to their
+    // declaration so component fan-in and unused-export checks do not claim `<SettingsView />` is unreferenced.
+    if (FAMILY[grammar] === "js") {
+      for (const cap of caps(grammar, `[
+        (jsx_opening_element name: (_) @jsx)
+        (jsx_self_closing_element name: (_) @jsx)
+      ]`, tree.rootNode)) {
+        const jsxName = cap.node.text;
+        const parts = jsxName.split(".");
+        const localName = parts[0];
+        if (parts.length === 1 && !/^[A-Z_$]/.test(localName)) continue; // undotted lowercase tags are platform/intrinsic elements
+        const imp = importedLocals.get(fileRel)?.get(localName);
+        if (!imp || !imp.targetFile || imp.typeOnly) continue;
+        const targetSymbols = symByFileName.get(imp.targetFile);
+        if (!targetSymbols) continue;
+        const importedName = imp.imported === "*" && parts.length > 1 ? parts[parts.length - 1] : imp.imported;
+        const target = targetSymbols.get(importedName) || targetSymbols.get(localName);
+        if (!target) continue;
+        const owner = enclosing(fileRel, cap.node.startPosition.row + 1);
+        links.push({ source: owner?.id || fileRel, target, relation: "references", confidence: "INFERRED", usage: "jsx", line: cap.node.startPosition.row + 1 });
+      }
+    }
     // Go value references: a top-level const/var/type/func used BY NAME (bare `X`, or cross-package `pkg.X`) in
     // another file/scope → a `references` edge, so used-but-never-called symbols (message-type consts, etc.) are
     // not falsely DEAD. (Same-file usage is already covered by graph-builder-analysis localRefs.) Go-only for now.
@@ -206,7 +244,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
 
   // extImportsV: bump when the externalImports schema/coverage changes (v2 = go/python ecosystems) —
   // deps-engine rebuilds in memory when a saved graph is older than this.
-  return { nodes, links, externalImports, extImportsV: 2, complexityV: 1, repoBoundaryV: 1 };
+  return { nodes, links, externalImports, extImportsV: 2, edgeTypesV: 1, complexityV: 1, repoBoundaryV: 1 };
 }
 
 // Build + write graph.json to outPath (creating the dir). Returns { ok, nodes, links, graphJson }.

package/src/graph/internal-builder.langs.js

@@ -5,8 +5,10 @@
 // build works — and Electron main runs Node, so this needs no external runtime.
 import { readdirSync, statSync, realpathSync } from "node:fs";
 import { join, extname, dirname } from "node:path";
+import { execFileSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { isPathInside } from "../repo-path.js";
+import { childProcessEnv } from "../child-env.js";
 import LANG_JS from "./builder/lang-js.js";
 import LANG_PY from "./builder/lang-python.js";
 import LANG_GO from "./builder/lang-go.js";
@@ -68,7 +70,7 @@ async function ensureParser(opts = {}, wanted = null) {
 // Cycle-safe directory walk. statSync FOLLOWS symlinks/junctions, so a link pointing at an ancestor would
 // otherwise recurse forever (a/b/link/b/link/…). We dedupe by REAL path (a visited dir is never re-entered)
 // and cap depth as a backstop, so a symlink loop can't wedge the build.
-function walk(dir, acc = [], seen = new Set(), depth = 0, rootReal = null) {
+function walkFallback(dir, acc = [], seen = new Set(), depth = 0, rootReal = null) {
   if (depth > 40) return acc;
   let real; try { real = realpathSync.native(dir); } catch { return acc; }
   if (rootReal == null) rootReal = real;
@@ -86,7 +88,7 @@ function walk(dir, acc = [], seen = new Set(), depth = 0, rootReal = null) {
     let entryReal; try { entryReal = realpathSync.native(full); } catch { continue; }
     if (!isPathInside(rootReal, entryReal)) continue;
     let st; try { st = statSync(full); } catch { continue; }
-    if (st.isDirectory()) walk(full, acc, seen, depth + 1, rootReal);
+    if (st.isDirectory()) walkFallback(full, acc, seen, depth + 1, rootReal);
     // include by KNOWN extension, not by loaded grammar — grammars now load lazily AFTER the walk
     // (the parse passes skip files whose grammar failed to load, so the guarantee is unchanged)
     else { const e = extname(name); if (EXT_LANG[e] || isDataFile(name) || isDocFile(name)) acc.push(full); }
@@ -94,4 +96,43 @@ function walk(dir, acc = [], seen = new Set(), depth = 0, rootReal = null) {
   return acc;
 }
 
+// Git already owns the repository's file-universe rules. Asking it for tracked files plus untracked,
+// non-ignored files prevents generated outputs (Electron release/, custom cache dirs, ignored agent files,
+// etc.) from contaminating graph/duplicate/audit results while still indexing new source before it is staged.
+// A repository may be opened without Git (or Git may be unavailable), so failure is deliberately a signal to
+// use the boundary-safe walker above rather than a build failure.
+function gitFileUniverse(dir) {
+  let raw;
+  try {
+    raw = execFileSync("git", ["-C", dir, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
+      encoding: "utf8",
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15_000,
+      maxBuffer: 64 * 1024 * 1024,
+      env: childProcessEnv(),
+    });
+  } catch { return null; }
+
+  let rootReal;
+  try { rootReal = realpathSync.native(dir); } catch { return null; }
+  const files = [];
+  for (const rel of raw.split("\0")) {
+    if (!rel) continue;
+    const full = join(dir, rel);
+    let real; try { real = realpathSync.native(full); } catch { continue; } // deleted index entry
+    if (!isPathInside(rootReal, real)) continue; // tracked symlink/junction escaping the repo
+    let st; try { st = statSync(full); } catch { continue; }
+    if (!st.isFile()) continue; // includes neither submodule dirs nor directory-like junctions
+    const name = rel.split(/[\\/]/).pop() || "";
+    const ext = extname(name);
+    if (EXT_LANG[ext] || isDataFile(name) || isDocFile(name)) files.push(full);
+  }
+  return files;
+}
+
+function walk(dir) {
+  return gitFileUniverse(dir) ?? walkFallback(dir);
+}
+
 export { Parser, Query, GRAMMARS, LANGS, EXT_LANG, FAMILY, isDataFile, isDocFile, MAX_PARSE_BYTES, ensureParser, walk };