weavatrix 0.2.12 → 0.2.14

package/src/analysis/internal-audit.run.js

@@ -1,34 +1,39 @@
-// internal-audit.run.js — the audit runner: loads a repo's graph.json + package.json, runs
-// dead-check (files) + computeUnusedExports + dep-check, and emits the unified findings envelope
-// (DEPS_SECURITY_PLAN.md §2.2-2.3). Split from internal-audit.js.
 import { existsSync } from "node:fs";
-import { join, basename } from "node:path";
+import { basename, join } from "node:path";
 import { computeDead, computeUnusedExports } from "./dead-check.js";
-import { computeScopedDepFindings, computeGoDepFindings, computePyDepFindings } from "./dep-check.js";
-import { parseGoMod } from "./manifests.js";
+import { computeGoDepFindings, computePyDepFindings, computeScopedDepFindings } from "./dep-check.js";
 import { computeStructureFindings } from "./dep-rules.js";
-import { makeFinding, summarizeFindings, sortFindings } from "./findings.js";
+import { makeFinding, sortFindings, summarizeFindings } from "./findings.js";
 import { graphOutDirForRepo } from "../graph/layout.js";
-import { collectInstalled } from "../security/installed.js";
-import { loadStore, queryStore, advisoryQueryFingerprint } from "../security/advisory-store.js";
-import { matchAdvisories } from "../security/match.js";
-import { scanMalware } from "../security/malware-heuristics.js";
-import { classifyTyposquat } from "../security/typosquat.js";
 import {
-  readJson, readRepoText, readRepoJson, collectSourceTexts, collectConfigTexts, workspacePkgNames,
-  collectPackageScopes, collectPyManifest, collectNonRuntimeRoots, TEST_FILE_RE,
+  TEST_FILE_RE,
+  collectConfigTexts,
+  collectNonRuntimeRoots,
+  collectPackageScopes,
+  collectPyManifest,
+  collectSourceTexts,
+  listRepoFiles,
+  readJson,
+  readRepoJson,
+  readRepoText,
+  workspacePkgNames,
 } from "./internal-audit.collect.js";
-import { entryFiles, computeReachability } from "./internal-audit.reach.js";
-import { createRepoBoundary } from "../repo-path.js";
+import { computeReachability, entryFiles } from "./internal-audit.reach.js";
+import { parseGoMod } from "./manifests.js";
 import { PATH_CLASS_NAMES, createPathClassifier, hasPathClass } from "../path-classification.js";
-import { packageReachability } from "./package-reachability.js";
-
-const LOWER_SEVERITY = { critical: "high", high: "medium", medium: "low", low: "info", info: "info" };
+import { createRepoBoundary } from "../repo-path.js";
+import { analyzeSourceCorrectness } from "./source-correctness.js";
+import { collectJvmDependencyEvidence } from "./jvm-dependency-evidence.js";
+import { buildDependencyHealth } from "./internal-audit/dependency-health.js";
+import { runSupplyChainChecks } from "./internal-audit/supply-chain.js";
 
-// Run the internal audit. graph is optional (loaded from the repo's central graph.json when absent);
-// advisoryStorePath overrides the default ~/.weavatrix/advisories.json (tests use a scratch path).
-// async because the malware sweep shells out to ripgrep.
-export async function runInternalAudit(repoPath, { graph, advisoryStorePath, skipMalwareScan = false, malwareExclusions = {}, rgPath = "" } = {}) {
+export async function runInternalAudit(repoPath, {
+  graph,
+  advisoryStorePath,
+  skipMalwareScan = false,
+  malwareExclusions = {},
+  rgPath = "",
+} = {}) {
   if (!existsSync(repoPath)) return { ok: false, error: "Repo path not found" };
   const boundary = createRepoBoundary(repoPath);
   if (!boundary.root) return { ok: false, error: "Repository path is unreadable" };
@@ -39,12 +44,12 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   const pkg = readRepoJson(boundary, "package.json") || {};
   const packageScopes = collectPackageScopes(repoPath, pkg);
   const externalImports = graph.externalImports || [];
-  const dynamicTargets = new Set(externalImports.filter((e) => e.dynamic && e.target).map((e) => e.target));
+  const dynamicTargets = new Set(externalImports.filter((entry) => entry.dynamic && entry.target).map((entry) => entry.target));
   const rules = readRepoJson(boundary, ".weavatrix-deps.json") || {};
-
-  // Graphs can be stale or miss a helper file; text fallbacks must scan the real repo tree too.
+  const repoFiles = listRepoFiles(repoPath);
   const sources = collectSourceTexts(repoPath, graph);
   const nonRuntimeRoots = collectNonRuntimeRoots(repoPath, rules);
+
   const pathClassifier = createPathClassifier(repoPath);
   const pathClassifications = new Map();
   const classifyPath = (file) => {
@@ -73,68 +78,77 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets, entrySet: entries });
   const reachable = computeReachability(graph, entries);
   const configTexts = collectConfigTexts(repoPath);
+  const npmDependencyImports = externalImports.filter((entry) => entry.ecosystem
+    ? entry.ecosystem === "npm"
+    : !/\.(?:java|go|py)$/i.test(entry.file || ""));
   const dep = computeScopedDepFindings({
-    externalImports, packageScopes, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts,
-    nonRuntimeRoots, sourceFiles: [...sources.keys()],
+    externalImports: npmDependencyImports,
+    packageScopes,
+    workspacePkgNames: workspacePkgNames(repoPath, pkg),
+    configTexts,
+    nonRuntimeRoots,
+    sourceFiles: [...sources.keys()],
   });
-  // non-npm ecosystems: Go (go.mod) + Python (requirements/pyproject/Pipfile) — same findings shape
   const goModText = readRepoText(boundary, "go.mod");
   const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null, nonRuntimeRoots });
-  const asList = (v) => Array.isArray(v) ? v : typeof v === "string" ? [v] : [];
-  const pyRules = rules.python || {};
-  const depRules = rules.dependencies || {};
+  const asList = (value) => Array.isArray(value) ? value : typeof value === "string" ? [value] : [];
+  const pyRules = rules.python || {}, depRules = rules.dependencies || {};
   const managedPython = [...new Set([
-    ...asList(rules.managedPythonDependencies), ...asList(pyRules.managed), ...asList(pyRules.managedDependencies),
-    ...asList(depRules.managedPython),
+    ...asList(rules.managedPythonDependencies), ...asList(pyRules.managed), ...asList(pyRules.managedDependencies), ...asList(depRules.managedPython),
   ])];
   const ignoredPython = [...new Set([
-    ...asList(rules.ignorePythonDependencies), ...asList(pyRules.ignore), ...asList(pyRules.ignoreDependencies),
-    ...asList(depRules.ignorePython),
+    ...asList(rules.ignorePythonDependencies), ...asList(pyRules.ignore), ...asList(pyRules.ignoreDependencies), ...asList(depRules.ignorePython),
   ])];
+  const pyManifest = collectPyManifest(repoPath);
   const pyDep = computePyDepFindings({
-    externalImports, pyManifest: collectPyManifest(repoPath), configTexts,
-    managedDependencies: managedPython, ignoredDependencies: ignoredPython, nonRuntimeRoots,
+    externalImports,
+    pyManifest,
+    configTexts,
+    managedDependencies: managedPython,
+    ignoredDependencies: ignoredPython,
+    nonRuntimeRoots,
   });
+  const jvmDependencies = collectJvmDependencyEvidence(repoPath, { files: repoFiles });
 
-  // structure: cycles / orphans / boundary rules. Rules come from the repo's optional .weavatrix-deps.json
-  // (the depcruise-config analogue); no bundled default rules — cycles+orphans are always on.
-  const externalImportFiles = new Set(externalImports.filter((e) => e.pkg && !e.builtin).map((e) => e.file));
+  const externalImportFiles = new Set(externalImports.filter((entry) => entry.pkg && !entry.builtin).map((entry) => entry.file));
   const structure = computeStructureFindings(graph, { rules, entrySet: entries, externalImportFiles });
+  const correctness = analyzeSourceCorrectness(sources, { isNonProductPath });
+  const findings = [...dep.findings, ...goDep.findings, ...pyDep.findings, ...correctness.findings];
+  const deadFileSet = new Set(dead.deadFiles.map((finding) => finding.file));
+  for (const finding of structure.findings) {
+    if (!(finding.rule === "orphan-file" && deadFileSet.has(finding.file))) findings.push(finding);
+  }
 
-  const findings = [...dep.findings, ...goDep.findings, ...pyDep.findings];
-  // orphan ∩ dead-file → one finding: keep the stronger unused-file, drop the duplicate orphan
-  const deadFileSet = new Set(dead.deadFiles.map((f) => f.file));
-  for (const f of structure.findings) if (!(f.rule === "orphan-file" && deadFileSet.has(f.file))) findings.push(f);
-  const actionableDeadFiles = dead.deadFiles.filter((f) => !isNonProductPath(f.file));
-  for (const f of actionableDeadFiles) {
-    if (entries.has(f.file) || dynamicTargets.has(f.file) || TEST_FILE_RE.test(f.file)) continue;
+  const actionableDeadFiles = dead.deadFiles.filter((finding) => !isNonProductPath(finding.file));
+  for (const finding of actionableDeadFiles) {
+    if (entries.has(finding.file) || dynamicTargets.has(finding.file) || TEST_FILE_RE.test(finding.file)) continue;
     findings.push(makeFinding({
       category: "unused",
       rule: "unused-file",
       severity: "low",
-      confidence: reachable.has(f.file) ? "medium" : "high", // unreachable from every entry = strong corroboration
-      title: `Unused file: ${f.file}`,
-      detail: `${f.reason}${reachable.has(f.file) ? "" : "; also unreachable from every entry point"}. Dynamic loading and framework conventions can't be fully ruled out — review before deleting.`,
-      file: f.file,
-      graphNodeId: f.file,
+      confidence: reachable.has(finding.file) ? "medium" : "high",
+      title: `Unused file: ${finding.file}`,
+      detail: `${finding.reason}${reachable.has(finding.file) ? "" : "; also unreachable from every entry point"}. Dynamic loading and framework conventions can't be fully ruled out — review before deleting.`,
+      file: finding.file,
+      graphNodeId: finding.file,
       source: "internal",
       fixHint: "review, then delete the file",
     }));
   }
   let unusedExportCount = 0;
-  for (const s of unusedExports) {
-    if (s.test || isNonProductPath(s.file)) continue; // convention/generated surfaces are externally consumed or non-product noise
-    if (/(^|\/)[^/]*\.config\.[a-z0-9]+$|(^|\/)\.[^/]+rc(\.[a-z]+)?$/i.test(s.file)) continue; // config exports are consumed by their tool
+  for (const symbol of unusedExports) {
+    if (symbol.test || isNonProductPath(symbol.file)) continue;
+    if (/(^|\/)[^/]*\.config\.[a-z0-9]+$|(^|\/)\.[^/]+rc(\.[a-z]+)?$/i.test(symbol.file)) continue;
     findings.push(makeFinding({
       category: "unused",
       rule: "unused-export",
       severity: "info",
       confidence: "medium",
-      title: `Unused export: ${s.label.replace(/\(\)$/, "")} — ${s.file}`,
-      detail: `${s.reason}. Either remove the export keyword (if used only internally) or delete the symbol.`,
-      file: s.file,
-      symbol: s.label,
-      graphNodeId: s.id,
+      title: `Unused export: ${symbol.label.replace(/\(\)$/, "")} — ${symbol.file}`,
+      detail: `${symbol.reason}. Either remove the export keyword (if used only internally) or delete the symbol.`,
+      file: symbol.file,
+      symbol: symbol.label,
+      graphNodeId: symbol.id,
       source: "internal",
     }));
     unusedExportCount++;
@@ -155,120 +169,34 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
     }));
   }
 
-  // ---- supply-chain: installed packages × cached OSV advisories. 100% OFFLINE here — the cache is
-  // refreshed only by the explicit repos:advisory-refresh action. Never blocks the rest of the audit.
-  let advisoryDbDate = null;
-  let installedCount = 0;
-  let inst = { installed: [], drift: [] };
-  const checks = {
-    osv: { status: "NOT_CHECKED", detail: "Advisory cache was never refreshed for this repository. Enable the osv profile (or advisories capability), then call refresh_advisories explicitly to opt in to sending pinned package names and versions to OSV.dev." },
-    malware: { status: skipMalwareScan ? "NOT_CHECKED" : "PENDING", detail: skipMalwareScan ? "Installed-package malware scan is opt-in and was not requested." : "" },
-  };
-  try {
-    inst = collectInstalled(repoPath);
-    installedCount = inst.installed.length;
-    const store = advisoryStorePath ? loadStore(advisoryStorePath) : loadStore();
-    // Only a per-repo stamp proves that this repository's installed versions were queried. A legacy
-    // global fetched_at may belong to another repo and must never certify this one as clean.
-    const repoStamp = store.meta?.repos?.[repoPath] || null;
-    advisoryDbDate = typeof repoStamp === "string" ? repoStamp : repoStamp?.fetched_at || null;
-    if (advisoryDbDate) {
-      let status = typeof repoStamp === "object" && ["OK", "PARTIAL", "ERROR"].includes(repoStamp.status) ? repoStamp.status : "PARTIAL";
-      const fingerprintMatches = typeof repoStamp === "object" && repoStamp.query_fingerprint === advisoryQueryFingerprint(inst.installed);
-      if (!fingerprintMatches && status === "OK") status = "PARTIAL";
-      const coverage = typeof repoStamp === "object" && Number.isFinite(repoStamp.queried)
-        ? ` (${repoStamp.queried_ok ?? repoStamp.queried}/${repoStamp.queried} package versions queried successfully)`
-        : "";
-      const drift = fingerprintMatches ? "" : " Dependency versions changed, or this is a legacy stamp without a package fingerprint; enable the osv profile (or advisories capability) and call refresh_advisories for complete coverage.";
-      checks.osv = {
-        status,
-        detail: `${status === "PARTIAL" ? "Partially matched" : "Matched"} installed packages against the cached OSV snapshot from ${advisoryDbDate}${coverage}.${drift}`,
-        checkedAt: advisoryDbDate,
-      };
-      for (const h of matchAdvisories(inst.installed, (eco, name) => queryStore(store, eco, name))) {
-        const mal = h.adv.kind === "malicious";
-        const reachability = packageReachability(externalImports, h.pkg.name, { isNonProductPath });
-        const observedInProduct = reachability.state === "DIRECT_RUNTIME_IMPORT";
-        const reachabilityDetail = observedInProduct
-          ? ` Graph reachability: directly imported by product code in ${reachability.directRuntimeImports} callsite(s) across ${reachability.files.length} file(s).`
-          : ` Graph reachability: ${reachability.state}; ${reachability.note}`;
-        findings.push(makeFinding({
-          category: mal ? "malware" : "vulnerability",
-          rule: mal ? "malicious-package" : "known-vuln",
-          severity: mal || observedInProduct ? (mal ? "critical" : h.adv.severity) : LOWER_SEVERITY[h.adv.severity] || h.adv.severity,
-          confidence: mal || observedInProduct ? h.confidence : "low",
-          title: `${mal ? "Known-malicious package" : `Known vulnerability (${h.adv.id})`}: ${h.pkg.name}@${h.pkg.version}`,
-          detail: `${h.adv.summary || h.adv.id}${h.adv.fixedIn.length ? ` Fixed in: ${h.adv.fixedIn.join(", ")}.` : mal ? " Remove this package immediately and rotate any secrets it could reach." : ""} (matched by ${h.matchedBy}${h.adv.aliases.length ? `; aliases ${h.adv.aliases.join(", ")}` : ""}).${reachabilityDetail}`,
-          package: h.pkg.name,
-          version: h.pkg.version,
-          reachability,
-          evidence: [
-            { file: h.adv.url, line: 0, snippet: `installed via ${h.pkg.source}${h.pkg.dev ? " (dev)" : ""}` },
-            ...reachability.evidence.slice(0, 5).map((item) => ({file: item.file, line: item.line, snippet: `${item.typeOnly ? "type-only " : ""}${item.kind}`})),
-          ],
-          source: "osv",
-          fixHint: mal ? `npm uninstall ${h.pkg.name} + audit what it touched` : h.adv.fixedIn.length ? `upgrade ${h.pkg.name} to ${h.adv.fixedIn[h.adv.fixedIn.length - 1]}+` : "no fixed version published — consider replacing the package",
-        }));
-      }
-    }
-    // direct-dependency typosquat (dev-chosen names, small set → low FP): surface quietly even alone.
-    const directDependencyNames = new Set(packageScopes.flatMap((s) => Object.keys({ ...(s.pkg?.dependencies || {}), ...(s.pkg?.devDependencies || {}) })));
-    for (const name of directDependencyNames) {
-      const sq = classifyTyposquat(name);
-      if (!sq) continue;
-      findings.push(makeFinding({
-        category: "malware",
-        rule: "typosquat",
-        severity: "medium",
-        confidence: "low",
-        title: `Possible typosquat: ${name} (looks like "${sq.nearest}")`,
-        detail: `Direct dependency "${name}" is edit-distance ${sq.distance} from the popular package "${sq.nearest}". Confirm you meant "${name}" and not "${sq.nearest}" — name-confusion is a common supply-chain lure.`,
-        package: name,
-        source: "internal",
-        fixHint: `verify "${name}" is the intended package (not a typo of "${sq.nearest}")`,
-      }));
-    }
-    for (const d of inst.drift.slice(0, 20)) {
-      findings.push(makeFinding({
-        category: "malware",
-        rule: "lockfile-drift",
-        severity: "low",
-        confidence: "medium",
-        title: `Lockfile drift: ${d.name} (locked ${d.locked}, installed ${d.installed})`,
-        detail: "The version on disk differs from the lockfile — a stale install, a manual edit, or (worst case) tampering. Reinstall from the lockfile to realign.",
-        package: d.name,
-        version: d.installed,
-        source: "internal",
-        fixHint: "npm ci (clean install from the lockfile)",
-      }));
-    }
-  } catch (error) {
-    checks.osv = { status: "ERROR", detail: `Offline advisory matching failed: ${error instanceof Error ? error.message : String(error)}` };
-  }
-
-  // ---- malware heuristics: install-script beacons / miners / exfil / obfuscation across installed libs.
-  // Local + offline (ripgrep or a bounded Node fallback). Scans node_modules, Python venvs, Go vendor/cache.
-  let malwareScan = null;
-  if (!skipMalwareScan) {
-    try {
-      const importedPkgs = new Set(externalImports.filter((e) => e.pkg && !e.builtin).map((e) => e.pkg));
-      const scan = await scanMalware(repoPath, { installed: inst.installed, importedPkgs, malwareExclusions, rgPath });
-      findings.push(...scan.findings);
-      malwareScan = { scanMode: scan.scanMode, packagesScanned: scan.packagesScanned, findings: scan.findings.length, excludedSignals: scan.excludedSignals || 0 };
-      checks.malware = { status: "OK", detail: `Scanned ${scan.packagesScanned} installed package(s) using ${scan.scanMode}.` };
-    } catch (error) {
-      checks.malware = { status: "ERROR", detail: `Installed-package malware scan failed: ${error instanceof Error ? error.message : String(error)}` };
-    }
-  }
-
+  const supplyChain = await runSupplyChainChecks(repoPath, {
+    externalImports,
+    packageScopes,
+    isNonProductPath,
+    advisoryStorePath,
+    skipMalwareScan,
+    malwareExclusions,
+    rgPath,
+  });
+  findings.push(...supplyChain.findings);
   const sorted = sortFindings(findings);
-  const dependencyFindings = sorted.filter((finding) => ["unused-dep", "missing-dep", "duplicate-dep"].includes(finding.rule));
-  const dependencyStatus = (graph.graphBuildMode && graph.graphBuildMode !== "full") || graph.graphBuildScope
-    ? "PARTIAL"
-    : "COMPLETE";
-  const importedPackages = new Set(externalImports
-    .filter((entry) => entry?.pkg && !entry.builtin && !entry.unresolved)
-    .map((entry) => `${entry.ecosystem || "npm"}:${entry.pkg}`));
+  const dependencyHealth = buildDependencyHealth({
+    repoPath,
+    graph,
+    repoFiles,
+    pyManifest,
+    dep,
+    goDep,
+    pyDep,
+    jvmDependencies,
+    externalImports,
+    findings: sorted,
+    packageScopes,
+    sourceFiles: [...sources.keys()],
+    correctnessCoverage: correctness.coverage,
+    checks: supplyChain.checks,
+  });
+
   return {
     ok: true,
     engine: "internal",
@@ -278,14 +206,14 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
     scanned: {
       files: dead.stats.files,
       symbols: dead.stats.symbols,
-      manifestDeps: dep.declared.size + goDep.declared.size + pyDep.declared.size,
+      manifestDeps: dependencyHealth.manifestDeps,
       externalImports: externalImports.length,
       nodeModulesPresent: boundary.resolve("node_modules").ok,
-      installedPackages: installedCount,
-      advisoryDbDate,
-      advisoryStatus: checks.osv.status,
-      malwareScanMode: malwareScan?.scanMode || "skipped",
-      malwareStatus: checks.malware.status,
+      installedPackages: supplyChain.installedCount,
+      advisoryDbDate: supplyChain.advisoryDbDate,
+      advisoryStatus: supplyChain.checks.osv.status,
+      malwareScanMode: supplyChain.malwareScan?.scanMode || "skipped",
+      malwareStatus: supplyChain.checks.malware.status,
       packageScopes: packageScopes.length,
       managedPythonDependencies: managedPython.length,
       nonRuntimeRoots,
@@ -298,24 +226,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
     },
     summary: summarizeFindings(sorted),
     findings: sorted,
-    dependencyReport: {
-      status: dependencyStatus,
-      evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
-      perFindingVerification: true,
-      verificationCoverage: { npm: "COMPLETE_FOR_GRAPH_SCOPE", go: "SUMMARY_ONLY", python: "SUMMARY_ONLY" },
-      declared: dep.declared.size + goDep.declared.size + pyDep.declared.size,
-      importedPackages: importedPackages.size,
-      importRecords: externalImports.length,
-      unused: dependencyFindings.filter((finding) => finding.rule === "unused-dep").length,
-      missing: dependencyFindings.filter((finding) => finding.rule === "missing-dep").length,
-      duplicateDeclarations: dependencyFindings.filter((finding) => finding.rule === "duplicate-dep").length,
-      unusedRequiringReview: dependencyFindings.filter((finding) => finding.rule === "unused-dep" && finding.verification?.decision === "REVIEW_REQUIRED").length,
-      missingWithSourceEvidence: dependencyFindings.filter((finding) => finding.rule === "missing-dep" && finding.verification?.indexedSourceImports?.status === "FOUND").length,
-      packageScopes: packageScopes.length,
-      reason: dependencyStatus === "COMPLETE"
-        ? "All discovered dependency manifests were compared with the complete indexed import set; every npm unused/missing/duplicate finding carries manifest and source/config verification state."
-        : "The dependency result is scoped to a partial graph and is not a repository-wide clean bill.",
-    },
+    dependencyReport: dependencyHealth.dependencyReport,
     deadReport: {
       deadSymbols: dead.deadSymbols.filter((symbol) => !isNonProductPath(symbol.file)).length,
       deadFiles: actionableDeadFiles.length,
@@ -328,7 +239,9 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       truncated: conventionEvidence.length > 100,
     },
     structureReport: structure.stats,
-    checks,
-    malwareScan,
+    sourceCorrectnessReport: correctness.coverage,
+    healthCapabilities: dependencyHealth.healthCapabilities,
+    checks: supplyChain.checks,
+    malwareScan: supplyChain.malwareScan,
   };
 }

package/src/analysis/jvm-dependency-evidence.js

@@ -0,0 +1,69 @@
+// Maven/Gradle manifest presence and bounded declaration counts. We intentionally do not map Java
+// imports to artifacts: package-to-artifact resolution needs a real build model and claiming 0/0 from
+// source regexes would be worse than an explicit NOT_SUPPORTED/PARTIAL state.
+import { createRepoBoundary } from "../repo-path.js";
+import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
+
+function mavenDeclarations(text) {
+  const source = String(text || "")
+    .replace(/<!--[\s\S]*?-->/g, " ")
+    .replace(/<dependencyManagement\b[\s\S]*?<\/dependencyManagement>/gi, " ");
+  const identities = [];
+  const re = /<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi;
+  let match;
+  while ((match = re.exec(source))) {
+    const group = /<groupId>\s*([^<]+?)\s*<\/groupId>/i.exec(match[1])?.[1]?.trim() || "";
+    const artifact = /<artifactId>\s*([^<]+?)\s*<\/artifactId>/i.exec(match[1])?.[1]?.trim() || "";
+    if (artifact) identities.push(group ? `${group}:${artifact}` : artifact);
+  }
+  return identities;
+}
+
+function gradleDeclarations(text) {
+  const source = String(text || "")
+    .replace(/\/\*[\s\S]*?\*\//g, " ")
+    .replace(/(^|\s)\/\/.*$/gm, "$1");
+  const declarations = [];
+  const configurations = "api|implementation|compileOnly|runtimeOnly|annotationProcessor|kapt|testImplementation|testCompileOnly|testRuntimeOnly|androidTestImplementation";
+  const line = new RegExp(`^\\s*(?:${configurations})\\s*(?:\\(\\s*)?([^\\r\\n]+)`, "gmi");
+  let match;
+  while ((match = line.exec(source))) {
+    const expression = match[1].trim().replace(/[),;]+\s*$/, "");
+    const coordinate = /["']([^"']+:[^"']+)["']/.exec(expression)?.[1] || "";
+    const catalog = /\blibs(?:\.[A-Za-z_]\w*)+/.exec(expression)?.[0] || "";
+    declarations.push(coordinate || catalog || "unresolved-declaration");
+  }
+  return declarations;
+}
+
+export function collectJvmDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot) } = {}) {
+  const boundary = createRepoBoundary(repoRoot);
+  const mavenFiles = files.filter((file) => /(^|\/)pom\.xml$/i.test(file));
+  const gradleFiles = files.filter((file) => /(^|\/)build\.gradle(?:\.kts)?$/i.test(file));
+  const maven = mavenFiles.flatMap((file) => mavenDeclarations(readRepoText(boundary, file)).map((identity) => ({ file, identity })));
+  const gradle = gradleFiles.flatMap((file) => gradleDeclarations(readRepoText(boundary, file)).map((identity) => ({ file, identity })));
+  return {
+    maven: {
+      present: mavenFiles.length > 0,
+      status: mavenFiles.length ? "NOT_SUPPORTED" : "NOT_PRESENT",
+      completeness: mavenFiles.length ? "PARTIAL" : "NOT_APPLICABLE",
+      manifests: mavenFiles,
+      declared: maven.length,
+      sample: maven.slice(0, 20),
+      reason: mavenFiles.length
+        ? "Maven manifests and declaration counts were detected, but Java package imports were not mapped to Maven artifacts; unused/missing dependency verdicts are not supported."
+        : "No pom.xml was discovered.",
+    },
+    gradle: {
+      present: gradleFiles.length > 0,
+      status: gradleFiles.length ? "NOT_SUPPORTED" : "NOT_PRESENT",
+      completeness: gradleFiles.length ? "PARTIAL" : "NOT_APPLICABLE",
+      manifests: gradleFiles,
+      declared: gradle.length,
+      sample: gradle.slice(0, 20),
+      reason: gradleFiles.length
+        ? "Gradle manifests and bounded dependency declarations were detected, but version catalogs/build logic and Java package-to-artifact mapping were not resolved; unused/missing dependency verdicts are not supported."
+        : "No build.gradle/build.gradle.kts was discovered.",
+    },
+  };
+}

package/src/analysis/source-correctness/retry-patterns.js

@@ -0,0 +1,93 @@
+import {makeFinding} from '../findings.js'
+
+const RETRY_SIGNAL = /\b(?:retry|retries|retrying|reconnect|backoff|attempts?)\b/i
+const WAIT_SIGNAL = /\b(?:sleep|delay)\s*\(/i
+const FAILURE_SIGNAL = /\b(?:catch|isError|error|exception|failed?|healthCheck)\b/i
+const TERMINATION_POLICY = /\b(?:max(?:imum)?(?:Retries|Attempts)|retryLimit|attemptLimit|deadline|timeout|isInterrupted)\b|\bcontext\s*\.\s*Done\b|\bsignal\s*\.\s*aborted\b|\battempts?\s*(?:>=|>)\s*\w+|\bbreak\s*;/i
+
+const lineAt = (text, index) => {
+    let line = 1
+    for (let i = 0; i < index && i < text.length; i++) if (text[i] === '\n') line++
+    return line
+}
+
+const lineText = (text, index) => {
+    const start = text.lastIndexOf('\n', Math.max(0, index - 1)) + 1
+    const end = text.indexOf('\n', index)
+    return text.slice(start, end < 0 ? text.length : end).trim().slice(0, 300)
+}
+
+function balancedEnd(text, openAt) {
+    if (text[openAt] !== '{') return -1
+    let depth = 0
+    for (let i = openAt; i < text.length; i++) {
+        if (text[i] === '{') depth++
+        else if (text[i] === '}' && --depth === 0) return i + 1
+    }
+    return -1
+}
+
+function retryFinding(text, file, index) {
+    return makeFinding({
+        category: 'structure',
+        rule: 'unbounded-retry-loop',
+        severity: 'low',
+        confidence: 'medium',
+        title: 'Retry/poll loop has no visible attempt, deadline, or cancellation bound',
+        detail: 'A repeating loop contains retry/failure plus wait behavior but no local maximum-attempt, deadline, cancellation, interrupt, or explicit break policy was recognized. This is a review signal, not proof of an infinite loop; success or a called helper may terminate it.',
+        file,
+        line: lineAt(text, index),
+        evidence: [{file, line: lineAt(text, index), snippet: lineText(text, index)}],
+        fixHint: 'confirm and document the retry termination/cancellation policy',
+    })
+}
+
+function retryBehavior(source) {
+    return RETRY_SIGNAL.test(source) || (WAIT_SIGNAL.test(source) && FAILURE_SIGNAL.test(source))
+}
+
+function bracedRetryFindings(text, masked, file) {
+    const findings = []
+    const re = /\bwhile\s*\(([^)]*)\)\s*\{|\bfor\s*\(\s*;\s*;\s*\)\s*\{|\bfor\s*\{|\bdo\s*\{/g
+    let match
+    while ((match = re.exec(masked))) {
+        const open = re.lastIndex - 1
+        const end = balancedEnd(masked, open)
+        if (end < 0) continue
+        const body = masked.slice(open + 1, end - 1)
+        const context = masked.slice(Math.max(0, match.index - 250), match.index)
+        let condition = match[1] || '', tailLength = 0
+        if (/^do\b/.test(match[0])) {
+            const tail = /^\s*while\s*\(([^)]*)\)\s*;/.exec(masked.slice(end))
+            condition = tail?.[1] || ''
+            tailLength = tail?.[0]?.length || 0
+        }
+        const evidence = `${context}\n${condition}\n${body}`
+        if (retryBehavior(evidence) && !TERMINATION_POLICY.test(`${condition}\n${body}`)) {
+            findings.push(retryFinding(text, file, match.index))
+        }
+        re.lastIndex = end + tailLength
+    }
+    return findings
+}
+
+function pythonRetryFindings(text, masked, file) {
+    const findings = [], lines = masked.split(/\r?\n/)
+    for (let i = 0; i < lines.length; i++) {
+        const match = /^(\s*)while\s+True\s*:/.exec(lines[i])
+        if (!match) continue
+        const indent = match[1].length
+        let end = i + 1
+        while (end < lines.length && (!lines[end].trim() || /^\s*/.exec(lines[end])[0].length > indent)) end++
+        const body = lines.slice(i + 1, end).join('\n')
+        const context = lines.slice(Math.max(0, i - 8), i).join('\n')
+        if (retryBehavior(`${context}\n${body}`) && !TERMINATION_POLICY.test(body)) {
+            findings.push(retryFinding(text, file, text.split(/\r?\n/).slice(0, i).join('\n').length + (i ? 1 : 0)))
+        }
+    }
+    return findings
+}
+
+export function retryFindings(text, masked, file, {python = false} = {}) {
+    return python ? pythonRetryFindings(text, masked, file) : bracedRetryFindings(text, masked, file)
+}