weavatrix 0.1.3 → 0.2.0

package/src/analysis/endpoints-java.js

@@ -0,0 +1,186 @@
+// Spring MVC/WebFlux endpoint extraction. This stays source-only and deliberately resolves only
+// literal annotation paths: inventing values for constants would make an architecture inventory look
+// more complete than the evidence permits.
+import { maskJavaNonCode } from "./java-source.js";
+
+const SPRING_MAPPING = /@(?:org\.springframework\.web\.bind\.annotation\.)?(RequestMapping|GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping)\b/g;
+const REQUEST_METHOD = /\bRequestMethod\s*\.\s*(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE)\b/g;
+
+const lineAt = (text, index) => {
+  let line = 1;
+  for (let i = 0; i < index && i < text.length; i++) if (text[i] === "\n") line++;
+  return line;
+};
+
+function skipTrivia(text, start) {
+  let i = start;
+  while (i < text.length) {
+    if (/\s/.test(text[i])) { i++; continue; }
+    if (text.startsWith("//", i)) {
+      const nl = text.indexOf("\n", i + 2);
+      i = nl < 0 ? text.length : nl + 1;
+      continue;
+    }
+    if (text.startsWith("/*", i)) {
+      const end = text.indexOf("*/", i + 2);
+      i = end < 0 ? text.length : end + 2;
+      continue;
+    }
+    break;
+  }
+  return i;
+}
+
+function balancedEnd(text, start, open = "(", close = ")") {
+  if (text[start] !== open) return start;
+  let depth = 0;
+  let quote = "";
+  let escaped = false;
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") { quote = ch; continue; }
+    if (ch === open) depth++;
+    else if (ch === close && --depth === 0) return i + 1;
+  }
+  return text.length;
+}
+
+function annotationInvocation(text, nameEnd) {
+  const start = skipTrivia(text, nameEnd);
+  if (text[start] !== "(") return { args: "", end: start };
+  const end = balancedEnd(text, start);
+  return { args: text.slice(start + 1, Math.max(start + 1, end - 1)), end };
+}
+
+function skipAnnotations(text, start) {
+  let i = skipTrivia(text, start);
+  while (text[i] === "@") {
+    const name = /^@[A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*)*/.exec(text.slice(i));
+    if (!name) break;
+    i += name[0].length;
+    i = annotationInvocation(text, i).end;
+    i = skipTrivia(text, i);
+  }
+  return i;
+}
+
+function stringLiterals(value) {
+  const out = [];
+  const re = /"((?:\\.|[^"\\])*)"/g;
+  let match;
+  while ((match = re.exec(String(value || "")))) {
+    out.push(match[1].replace(/\\"/g, '"').replace(/\\\\/g, "\\"));
+  }
+  return out;
+}
+
+function initializer(args, equalsAt) {
+  let i = skipTrivia(args, equalsAt + 1);
+  if (args[i] === "{") {
+    const end = balancedEnd(args, i, "{", "}");
+    return args.slice(i, end);
+  }
+  if (args[i] === '"') {
+    let escaped = false;
+    for (let end = i + 1; end < args.length; end++) {
+      if (escaped) escaped = false;
+      else if (args[end] === "\\") escaped = true;
+      else if (args[end] === '"') return args.slice(i, end + 1);
+    }
+  }
+  const comma = args.indexOf(",", i);
+  return args.slice(i, comma < 0 ? args.length : comma);
+}
+
+function mappingPaths(args) {
+  const source = String(args || "");
+  const named = /\b(?:path|value)\s*=/g.exec(source);
+  if (named) return stringLiterals(initializer(source, source.indexOf("=", named.index)));
+  const leading = source.trimStart();
+  if (!leading) return [""];
+  if (leading[0] === '"' || leading[0] === "{") return stringLiterals(leading);
+  // `method=`, `produces=` and friends do not specify a path, so they map the class/method root.
+  if (/^(?:method|produces|consumes|headers|params|name)\s*=/.test(leading)) return [""];
+  return []; // unresolved positional constant: do not invent a root route
+}
+
+function mappingMethods(name, args) {
+  if (name !== "RequestMapping") return [name.replace(/Mapping$/, "").toUpperCase()];
+  const methods = [];
+  let match;
+  REQUEST_METHOD.lastIndex = 0;
+  while ((match = REQUEST_METHOD.exec(args))) if (!methods.includes(match[1])) methods.push(match[1]);
+  return methods.length ? methods : ["ANY"];
+}
+
+function joinPaths(prefix, path) {
+  const left = String(prefix || "").trim().replace(/^\/+|\/+$/g, "");
+  const right = String(path || "").trim().replace(/^\/+|\/+$/g, "");
+  return `/${[left, right].filter(Boolean).join("/")}`.replace(/\/{2,}/g, "/");
+}
+
+function declarationAfter(text, start) {
+  const declarationStart = skipAnnotations(text, start);
+  const bounded = text.slice(declarationStart, declarationStart + 2_500);
+  const terminators = [bounded.indexOf("{"), bounded.indexOf(";")].filter((i) => i >= 0);
+  const end = terminators.length ? Math.min(...terminators) : bounded.length;
+  const head = bounded.slice(0, end);
+  const classMatch = /\b(class|interface|record|enum)\s+([A-Za-z_$][\w$]*)/.exec(head);
+  if (classMatch) {
+    const open = bounded.indexOf("{");
+    const bodyOpen = open < 0 ? -1 : declarationStart + open;
+    return { kind: "class", name: classMatch[2], bodyOpen, bodyClose: bodyOpen < 0 ? text.length : balancedEnd(text, bodyOpen, "{", "}") };
+  }
+  const methodMatch = /\b([A-Za-z_$][\w$]*)\s*\(/.exec(head);
+  return methodMatch ? { kind: "method", name: methodMatch[1] } : { kind: "unknown", name: "" };
+}
+
+export function extractSpringEndpoints(text, file) {
+  if (!/\.java$/i.test(file)) return [];
+  const code = maskJavaNonCode(text);
+  if (!/@(?:[\w$]+\.)*(?:Request|Get|Post|Put|Patch|Delete)Mapping\b/.test(code)) return [];
+  const mappings = [];
+  let match;
+  SPRING_MAPPING.lastIndex = 0;
+  while ((match = SPRING_MAPPING.exec(code))) {
+    const invocation = annotationInvocation(text, SPRING_MAPPING.lastIndex);
+    const declaration = declarationAfter(code, invocation.end);
+    mappings.push({
+      annotation: match[1],
+      args: invocation.args,
+      index: match.index,
+      line: lineAt(text, match.index),
+      declaration,
+    });
+    SPRING_MAPPING.lastIndex = Math.max(SPRING_MAPPING.lastIndex, invocation.end);
+  }
+
+  const classMappings = mappings
+    .filter((item) => item.declaration.kind === "class")
+    .map((item) => ({ ...item, paths: mappingPaths(item.args) }));
+  const out = [];
+  for (const item of mappings) {
+    if (item.declaration.kind !== "method") continue;
+    const owner = classMappings
+      .filter((candidate) => candidate.declaration.bodyOpen >= 0
+        && item.index > candidate.declaration.bodyOpen
+        && item.index < candidate.declaration.bodyClose)
+      .sort((a, b) => b.declaration.bodyOpen - a.declaration.bodyOpen)[0];
+    if (owner && !owner.paths.length) continue; // unresolved class prefix makes the full route unknowable
+    const prefixes = owner?.paths?.length ? owner.paths : [""];
+    const paths = mappingPaths(item.args);
+    if (!paths.length) continue; // literal path was requested but could not be resolved
+    for (const method of mappingMethods(item.annotation, item.args)) {
+      for (const prefix of prefixes) for (const path of paths) {
+        out.push({ method, path: joinPaths(prefix, path), handler: item.declaration.name, file, line: item.line });
+      }
+    }
+  }
+  return out;
+}

package/src/analysis/endpoints-rust.js

@@ -0,0 +1,124 @@
+const RUST_ROUTE_METHOD = "get|post|put|patch|delete|head|options|trace|connect|any";
+
+// Find a call's closing parenthesis without mistaking parens inside strings for syntax. This is deliberately
+// small (not a Rust parser), but keeps route-handler expressions bounded instead of using a cross-statement
+// regex that could turn an unrelated function call into a route.
+function closingParen(text, openAt) {
+  let depth = 0, quote = "", escaped = false, blockComment = 0;
+  for (let i = openAt; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (blockComment) {
+      if (ch === "/" && text[i + 1] === "*") { blockComment++; i++; }
+      else if (ch === "*" && text[i + 1] === "/") { blockComment--; i++; }
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      const newline = text.indexOf("\n", i + 2);
+      if (newline < 0) return -1;
+      i = newline;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") { blockComment = 1; i++; continue; }
+    if (ch === '"') { quote = ch; continue; }
+    if (ch === "'") {
+      // Skip a Rust character literal, but do not mistake a lifetime (`'a`) for an unterminated string.
+      const char = /^'(?:\\.|[^\\'\r\n])'/.exec(text.slice(i));
+      if (char) { i += char[0].length - 1; continue; }
+    }
+    if (ch === "(") depth++;
+    else if (ch === ")" && --depth === 0) return i;
+  }
+  return -1;
+}
+
+// Parse axum's MethodRouter expression, including direct method chains:
+//   get(list).post(create) / axum::routing::get(show).delete(remove)
+// Calls inside a handler closure are not scanned and therefore cannot become fake endpoint methods.
+function axumRoutes(expr) {
+  const found = [];
+  let rest = String(expr || ""), offset = 0;
+  const firstRe = new RegExp(`^\\s*(?:(?:axum\\s*::\\s*)?routing\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(`, "i");
+  let match = firstRe.exec(rest);
+  if (!match) return found;
+
+  while (match) {
+    const openAt = offset + match.index + match[0].lastIndexOf("(");
+    const closeAt = closingParen(expr, openAt);
+    if (closeAt < 0) break;
+    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: openAt });
+    offset = closeAt + 1;
+    rest = expr.slice(offset);
+    match = new RegExp(`^\\s*\\.\\s*(${RUST_ROUTE_METHOD})\\s*\\(`, "i").exec(rest);
+  }
+  return found;
+}
+
+// Actix's builder form is structurally distinct from axum and from HTTP clients:
+//   web::get().to(handler) / actix_web::web::post().to(handler)
+function actixRoutes(expr) {
+  const found = [];
+  const re = new RegExp(`(?:actix_web\\s*::\\s*)?web\\s*::\\s*(${RUST_ROUTE_METHOD})\\s*\\(\\s*\\)\\s*\\.\\s*to\\s*\\(`, "gi");
+  let match;
+  while ((match = re.exec(expr))) {
+    const openAt = re.lastIndex - 1;
+    const closeAt = closingParen(expr, openAt);
+    if (closeAt < 0) continue;
+    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: match.index });
+    re.lastIndex = closeAt + 1;
+  }
+  return found;
+}
+
+export function extractRustEndpoints(text, add) {
+  let match;
+
+  // Axum and actix both expose a path-first `.route(path, ...)` builder. Requiring either an axum
+  // MethodRouter or actix's web::<method>().to(...) avoids treating arbitrary Rust APIs named `route` as HTTP.
+  const routeRe = /\.\s*route\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*,/g;
+  while ((match = routeRe.exec(text))) {
+    const openAt = text.indexOf("(", match.index);
+    const closeAt = closingParen(text, openAt);
+    if (closeAt < 0) continue;
+    const exprStart = routeRe.lastIndex;
+    const expr = text.slice(exprStart, closeAt);
+    const routes = [...axumRoutes(expr), ...actixRoutes(expr)];
+    for (const route of routes) add(route.method, match[1], route.handler, exprStart + route.index);
+    routeRe.lastIndex = closeAt + 1;
+  }
+
+  // actix `web::resource(path)` associates several method routes with one path.
+  const resourceRe = /(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*\)/g;
+  while ((match = resourceRe.exec(text))) {
+    const tail = text.slice(resourceRe.lastIndex);
+    const nextResource = tail.search(/(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(/);
+    const semicolon = text.indexOf(";", resourceRe.lastIndex);
+    let end = Math.min(text.length, resourceRe.lastIndex + 4000);
+    if (nextResource >= 0) end = Math.min(end, resourceRe.lastIndex + nextResource);
+    if (semicolon >= 0) end = Math.min(end, semicolon);
+    const chain = text.slice(resourceRe.lastIndex, end);
+    for (const route of actixRoutes(chain)) add(route.method, match[1], route.handler, resourceRe.lastIndex + route.index);
+  }
+
+  // Actix attribute macros. The route macro can declare more than one method for the same handler.
+  const macroRe = new RegExp(`#\\s*\\[\\s*(?:(?:actix_web|actix)\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(\\s*"(\\/(?:\\\\.|[^"\\\\])*)"(?:\\s*,[^\\]]*)?\\s*\\)\\s*\\]`, "gi");
+  while ((match = macroRe.exec(text))) {
+    const after = text.slice(macroRe.lastIndex, macroRe.lastIndex + 600);
+    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
+    add(match[1], match[2], fn ? fn[1] : "", match.index);
+  }
+
+  const multiMacroRe = /#\s*\[\s*(?:(?:actix_web|actix)\s*::\s*)?route\s*\(\s*"(\/(?:\\.|[^"\\])*)"([\s\S]*?)\)\s*\]/gi;
+  while ((match = multiMacroRe.exec(text))) {
+    const after = text.slice(multiMacroRe.lastIndex, multiMacroRe.lastIndex + 600);
+    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
+    const methodRe = /\bmethod\s*=\s*"(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT)"/gi;
+    let method;
+    while ((method = methodRe.exec(match[2]))) add(method[1], match[1], fn ? fn[1] : "", match.index);
+  }
+}

package/src/analysis/endpoints.js

@@ -1,16 +1,19 @@
 // endpoints.js — detect the repo's OWN HTTP API surface (routes it EXPOSES), so the Health tab can
 // surface endpoints the way infra towers surface the services a repo TALKS TO. Each endpoint carries a
 // best-effort handler NAME so the UI can join it to that method's health (O(n) complexity, criticality,
-// coverage). Covers the common shapes across JS/TS, Python and Go:
+// coverage). Covers the common shapes across JS/TS, Python, Go and Rust:
 //   • object routes (Bun.serve / custom):  "/path": { GET: handler, POST: fn }   |   "/path": handler
 //   • method-call routes (Express/Fastify/Koa/Hono/gin/echo):  app.get("/path", handler)
 //   • decorators (FastAPI/Flask/NestJS):   @app.get("/path")  /  @Get("/path")
 //   • Go net/http:                          mux.HandleFunc("/path", handler)
+//   • Rust axum/actix-web:                  .route("/path", get(handler)) / #[get("/path")]
 import { safeRead } from "../util.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { extractRustEndpoints } from "./endpoints-rust.js";
+import { extractSpringEndpoints } from "./endpoints-java.js";
 
 const MAX_FILES = 3000;
-const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ALL", "ANY"]);
+const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE", "CONNECT", "ALL", "ANY"]);
 // UNAMBIGUOUS HTTP CLIENTS (make requests) vs servers (define routes) — reject `axios.get("/x")`-style client
 // calls in frontend code. Ambiguous names (api/client/service — could be a server router) are NOT listed;
 // they're filtered by the handler requirement instead (a client call has no handler / a config object arg).
@@ -31,7 +34,9 @@ function lineAt(text, index) {
 function handlerName(expr) {
   const s = String(expr || "").trim();
   if (!s) return "";
-  if (/=>/.test(s) || /^\s*(async\s+)?function\b/.test(s)) return "";
+  if (/=>/.test(s) || /^\s*(async\s+)?function\b/.test(s) || /^\s*(?:async\s+)?(?:move\s+)?\|[^|]*\|/.test(s)) return "";
+  const turbofish = /(?:^|::)([A-Za-z_][\w]*)\s*::<[\s\S]*>\s*$/.exec(s);
+  if (turbofish) return turbofish[1];
   const ids = s.match(/[A-Za-z_$][\w$]*/g);
   if (!ids) return "";
   const SKIP = new Set(["async", "function", "await", "req", "res", "ctx", "request", "response", "next", "return"]);
@@ -68,6 +73,8 @@ export function nextRoutePath(file) {
 export function extractEndpointsFromText(text, file) {
   const out = [];
   const py = /\.py$/i.test(file);
+  const rust = /\.rs$/i.test(file);
+  const java = /\.java$/i.test(file);
   const add = (method, path, expr, idx) => {
     const p = cleanPath(path);
     if (!looksLikePath(p)) return;
@@ -101,6 +108,12 @@ export function extractEndpointsFromText(text, file) {
     }
   }
 
+  if (rust) extractRustEndpoints(text, add);
+  if (java) {
+    out.push(...extractSpringEndpoints(text, file));
+    return out; // generic JS-style method calls would turn Java HTTP clients into fake server routes
+  }
+
   // ---- object routes: "/path": { GET: fn, POST: fn2 }  or  "/path": handler --------------------
   // find each  "…": {  or  "…": expr,  where the key looks like a path
   const objKeyRe = /(["'`])(\/[^"'`]*)\1\s*:\s*(\{)?/g;
@@ -171,11 +184,11 @@ export function detectEndpoints(repoPath, codeFiles) {
   const boundary = createRepoBoundary(repoPath);
   for (const f of files) {
     const rel = f.path || f;
-    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go)$/i.test(rel)) continue;
+    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go|rs|java)$/i.test(rel)) continue;
     const resolved = boundary.resolve(rel);
     if (!resolved.ok) continue;
     const text = safeRead(resolved.path);
-    if (!text || (!nextRoutePath(rel) && !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)/i.test(text))) continue;
+    if (!text || (!nextRoutePath(rel) && !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)|@(?:[\w$]+\.)*(?:Request|Get|Post|Put|Patch|Delete)Mapping\b/i.test(text))) continue;
     for (const e of extractEndpointsFromText(text, rel.replace(/\\/g, "/"))) {
       const key = `${e.method} ${normParamKey(e.path)}`;
       const prev = byKey.get(key);

package/src/analysis/findings.js

@@ -8,8 +8,14 @@ export const FINDING_CATEGORIES = ["unused", "structure", "vulnerability", "malw
 
 // Stable id: survives re-runs so the UI can persist expand/dismiss state per finding.
 export function makeFinding(f) {
+  const cycleIdentity = Array.isArray(f.cycleMembers)
+    ? [...new Set(f.cycleMembers.map(String))].sort().join("\0")
+    : "";
   const id = createHash("sha1")
-    .update([f.category, f.rule, f.file || "", f.package || "", f.symbol || "", f.title || ""].join("|"))
+    .update([
+      f.category, f.rule, f.file || "", f.manifest || "", f.scope || "",
+      f.package || "", f.symbol || "", cycleIdentity, f.title || "",
+    ].join("|"))
     .digest("hex")
     .slice(0, 16);
   return {
@@ -18,6 +24,7 @@ export function makeFinding(f) {
     confidence: "medium",
     title: "",
     detail: "",
+    reason: "",
     file: "",
     line: 0,
     symbol: "",