weavatrix 0.2.14 → 0.2.16

package/README.md

@@ -117,10 +117,20 @@ Every dead-code, orphan, dependency and duplicate item remains review evidence.
 conventions and source use before editing; Weavatrix does not auto-delete or merge findings.
 
 `run_audit` also returns an explicit capability matrix. `STRUCTURE CHECKED` and a supported package
-ecosystem do not imply `RUNTIME_CORRECTNESS` or `CONCURRENCY` is complete. Maven/Gradle manifests are
-reported `NOT_SUPPORTED`/`PARTIAL` for import-to-artifact verification rather than as a false clean
-`0 declared / 0 external`; bounded Go/Java correctness checks disclose that they are neither compiler
-proof nor a race detector.
+ecosystem do not imply `RUNTIME_CORRECTNESS` or `CONCURRENCY` is complete. npm, nested Python and Go
+modules, Maven properties, common Gradle declarations/version catalogs, and Cargo workspace/renamed
+packages are compared with indexed imports. JVM reflection/generated/runtime-only use, Cargo
+features/proc macros and unresolved build logic remain review evidence; bounded Go/Java checks are
+neither compiler proof nor a race detector.
+
+### Where this saves agent context — and where it does not
+
+The largest saving comes from graph operations that replace repeated discovery: one
+`change_impact`, `get_dependents`, `context_bundle`, contract trace or dependency audit can collapse
+many search/read hops into a bounded evidence set. `read_source` is mainly a convenient exact window
+and is not inherently cheaper than a client's native offset read. Database queries, runtime state,
+disk forensics and background workflow investigation remain outside a static repository graph.
+Typecheck, tests and runtime checks remain the release authority.
 
 ### Trace an event, queue, worker, cron or CLI flow
 
@@ -259,8 +269,9 @@ and builds a missing graph automatically. A normal
 probes without building and refuses a legacy graph. Retargeting is offline but intentionally changes
 the filesystem boundary for subsequent tools; select `pinned` when that boundary must not move.
 
-An agent skill with recipes ships in [skill/SKILL.md](skill/SKILL.md) — install as
-`~/.claude/skills/weavatrix/SKILL.md`.
+An agent skill with recipes ships in [skill/SKILL.md](skill/SKILL.md) — install it as
+`~/.claude/skills/weavatrix/SKILL.md` for Claude Code or
+`~/.codex/skills/weavatrix/SKILL.md` for Codex.
 
 ## Tools
 
@@ -281,6 +292,13 @@ disabled and only static evidence is active. Java and Rust language-server provi
 their edges never become `EXACT_LSP`, even when a mixed repository reports a complete
 TypeScript/JavaScript overlay.
 
+Configured TypeScript plugins (including Next.js) are recorded but suppressed; repository-local
+plugin code is never loaded. The broad overlay is deliberately budgeted, so `PARTIAL` can mean the
+candidate cap was reached. `get_dependents` then spends a bounded point query on the requested JS/TS
+symbol and replaces direct heuristic references only when exact absence/presence is proven.
+`change_impact` batches the same exact query for changed symbols. Further transitive hops remain
+graph-backed and are labelled as such.
+
 The bounded JS/TS provider is enabled by default for new graphs. Set `WEAVATRIX_PRECISION=off`
 before starting the MCP server for parser-only operation from the first build, or pass
 `precision:"off"` to `rebuild_graph` / `open_repo`. The MCPB installer exposes the same `lsp` / `off`
@@ -302,8 +320,8 @@ functions, methods, and symbols, with evidence tiers, completed/remaining verifi
 public/framework/dynamic caveats),
 `run_audit` (an explicit capability matrix plus unused files/exports/dependencies with per-finding manifest/indexed-source/script/config verification;
 `category:dependencies` isolates missing/unused/duplicate declarations, unresolved imports and lockfile drift,
-missing npm/Go/Python deps, honest Maven/Gradle `NOT_SUPPORTED`/`PARTIAL` import verification, bounded
-Go/Java correctness candidates, runtime
+missing npm/Go/Python/Maven/Gradle/Cargo deps, bounded import-to-artifact/crate verification, concrete
+npm/PyPI/Go/Maven/crates.io advisory pins, Go/Java correctness candidates, runtime
 cycles, type-only/compile-only coupling, orphans, boundary rules, offline OSV vulnerabilities + typosquat +
 lockfile drift; accepts an immutable `base_ref`, `changed_files`, and `debt: new|existing|all` for
 review-scoped results; production paths are the default and `include_classified:true` opts into
@@ -392,6 +410,37 @@ metrics are not persisted or transmitted by Weavatrix. If a source checkout's pa
 while an old daemon remains alive, `initialize`, `tools/list`, and tool calls fail loudly with
 `STALE_RUNTIME` until the client reconnects; the opt-out is reserved for deliberate development.
 
+### 0.2.16 exact dependents, multi-ecosystem dependencies and transport contracts
+
+- Safe TypeScript project plugins no longer disable semantic precision. Plugin loading remains
+  suppressed, while `get_dependents` and `change_impact` can obtain exact direct JS/TS references on
+  demand and identify graph-backed transitive hops separately.
+- Dependency evidence covers nested npm/Python/Go scopes, Maven properties, Gradle catalogs/locks,
+  and Cargo workspace inheritance/renames/locks. Explicit OSV refresh accepts npm, PyPI, Go, Maven
+  and crates.io pins.
+- Cross-repository tracing adds static GraphQL, gRPC and event-topic joins alongside HTTP and keeps
+  runtime configuration, reflection and other dynamic targets explicitly `UNKNOWN`.
+- npm/MCPB metadata now calls out Codex/OpenAI Codex workflows, and Hosted distinguishes aggregate
+  folder-boundary feedback from proven file-level runtime cycles.
+
+Full patch notes: [docs/releases/v0.2.16.md](docs/releases/v0.2.16.md).
+
+### 0.2.15 self-audit precision patch
+
+- Dependency review now scopes nested manifests correctly, recognizes framework peer packages and
+  package references assembled from bounded dynamic path fragments, and avoids misclassifying
+  dependency-owned source as an unused root declaration.
+- Reachability follows source-owned HTML asset references, so maintained browser entry scripts and
+  styles remain part of the production surface instead of appearing as dead files.
+- Malware heuristics distinguish inert placeholders, comments, documentation URLs, and ordinary
+  Unicode text from executable registry or download behavior while retaining explicit review
+  evidence for actionable patterns.
+- Duplicate review ignores policy-like numeric tables and stable ordered-member declarations where
+  repetition is intentional, and the remaining reverse-reach, Git-output, member-order, path-term,
+  and retrieval logic now uses shared owners instead of drifting copies.
+
+Full patch notes: [docs/releases/v0.2.15.md](docs/releases/v0.2.15.md).
+
 ### 0.2.14 typed flows, honest Health, and architecture bootstrap
 
 - Go call resolution now follows receiver types through parameters, locals, constructor returns,
@@ -642,13 +691,19 @@ Java graphs:
   agent review queue. Public/exported methods, framework entries, decorators, dynamic loading and
   reflection lower confidence; the result always says `REVIEW_REQUIRED` and `autoDelete:false`.
 
-### HTTP clients and wrappers
+### Cross-repository transports
 
 `trace_api_contract` recognizes built-in object clients such as `axios.get(...)`, explicit bare or
 object/member wrappers, and simple auto-discovered functions that forward a URL parameter directly
 to a known HTTP client. Auto-discovered wrappers are restricted to their bounded reverse-import
 scope; ambiguous same-name definitions are skipped and reported as incomplete evidence.
 
+The same tool can select GraphQL, gRPC or event evidence. It joins static GraphQL schema fields and
+operations, proto service methods and typed stub calls, and static Kafka/event-bus topic producers
+and consumers across registered repositories. Computed URLs, runtime configuration, dynamic
+GraphQL documents/topics, reflection and dynamic stubs remain `UNKNOWN`; they are not converted into
+an absence claim.
+
 Persistent per-client-repository configuration lives in `.weavatrix.json`:
 
 ```json
@@ -810,16 +865,17 @@ loader) behind the thin stdio entry `src/mcp-server.mjs`.
   cross-repository wrapper/liveness fixture, framework/convention fixture, full MCP lifecycle gate
   and a portable real-repository runner. Six source-free 0.2.1 real-repository baselines are
   recorded; edge provenance is gated end-to-end and the strict six-repository release command passes.
-- **Wrapper-aware API contracts** shipped in 0.2.2: persistent/ad-hoc configuration,
-  conservative discovery, cross-repository handler liveness and explicit unknown states. The next
-  hosted increment joins privacy-safe contract identities across separately synced services.
+- **Cross-transport contracts** cover bounded HTTP wrappers plus static GraphQL, gRPC and event-bus
+  identities across registered local repositories, with explicit runtime/dynamic unknown states.
 - **Hosted architecture workbench** at
   [app.weavatrix.com](https://app.weavatrix.com) is an access-controlled preview for
   owner-authenticated source-free evidence and revision history. Its UI and backend evolve
   independently from the public MCP release; local use remains fully optional.
 - **Semantic precision bridge** shipped for TypeScript/JavaScript in 0.2.4: a bounded, revision-bound
   local overlay validates references with the bundled language server while the parser graph remains
-  the fallback. Java and Rust providers are not bundled yet and stay explicitly `UNAVAILABLE`.
+  the fallback. 0.2.16 adds safe configured-plugin suppression plus exact on-demand point and changed-
+  symbol batch queries. Java and Rust language-server providers are not bundled and stay explicitly
+  unavailable as semantic providers; their parser/dependency evidence is still active.
 - **Git-native architecture history** — bounded tag/ref timelines and branch
   reports built outside the worktree; graph artifacts stay out of Git.
 - **Cross-repository company evidence** — endpoints, events and internal

package/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported |
 |---|---|
-| `0.2.14.x` | Yes |
-| `0.2.13` and older | Upgrade to the latest release |
+| `0.2.15.x` | Yes |
+| `0.2.14` and older | Upgrade to the latest release |
 
 Security fixes are provided for the latest published version of Weavatrix. Upgrade before reporting
 an issue that may already be resolved.

package/docs/releases/v0.2.16.md

@@ -0,0 +1,53 @@
+# Weavatrix 0.2.16
+
+0.2.16 is a semantic-precision, dependency-coverage, and cross-transport contract release. It keeps
+the 38-tool MCP surface and local-first defaults while fixing the critical case where a safe
+TypeScript project plugin could disable every exact reference edge.
+
+## Exact dependents for real TypeScript projects
+
+- TypeScript project plugins such as Next.js are recorded and suppressed instead of making the
+  semantic overlay unavailable. Repository-local plugin code is never loaded.
+- `get_dependents` performs a bounded exact point query for JS/TS symbols by default. A complete LSP
+  result replaces heuristic direct references; an incomplete result retains graph evidence and says
+  why.
+- `change_impact` batches exact direct-reference queries for changed JS/TS symbols. Transitive hops
+  remain explicitly graph-backed instead of being presented as LSP proof.
+- Real-repository validation moved an affected Next.js repository from `UNAVAILABLE / 0 EXACT_LSP`
+  to a bounded partial overlay with 154 exact edges; a point query outside the initial budget found
+  16 exact direct references and then served the same result from cache.
+
+## Multi-ecosystem dependency and advisory evidence
+
+- Python checks nested requirements, pyproject/Poetry/Pipfile scopes; Go resolves nested modules,
+  direct/indirect requirements and replacements; both compare declarations with indexed imports.
+- Maven resolves properties and dependency declarations; Gradle resolves common Groovy/Kotlin
+  declarations, version catalogs and lock evidence. Import-to-artifact mapping uses bounded group
+  prefixes and artifact tokens and keeps reflection/generated/runtime-only cases review-only.
+- Cargo resolves workspace inheritance, renamed packages and lockfile pins, compares crate paths to
+  the nearest manifest, and reports feature/proc-macro uncertainty rather than claiming compiler
+  proof.
+- Explicit advisory refresh now includes concrete Maven and crates.io pins in addition to npm,
+  PyPI and Go. It remains opt-in and sends only package identities and versions to OSV.
+
+## Contracts beyond static HTTP
+
+- `trace_api_contract` can select HTTP, GraphQL, gRPC or event contracts. Static GraphQL
+  operations/schema fields, proto service methods/stub calls and Kafka/event topics join across
+  registered local repositories.
+- Runtime-computed URLs, operations/topics, reflection and dynamic stubs remain `UNKNOWN` with
+  bounded evidence. Runtime configuration is never converted into a false clean result.
+
+## Agent and Hosted fixes
+
+- Package metadata now names Codex/OpenAI Codex alongside other MCP and coding-agent workflows.
+- The Hosted Flow view distinguishes an aggregate folder-boundary feedback loop from a proven
+  file-level runtime import cycle. Current Weavatrix evidence has zero file-level runtime cycles.
+- The release checklist includes a fresh preview-confirmed private graph sync, so public demo history
+  and authenticated repository maps cannot silently drift apart.
+
+## Verification
+
+The release is gated by the full Node suite, six-language fixture benchmark, real-repository
+semantic checks, exact LSP dogfooding, release-manifest verification, packed npm and MCPB stdio
+checks, npm audit, Hosted tests/build/lint, explicit private sync, and live browser verification.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -26,7 +26,7 @@
     "skill",
     "scripts/run-agent-task-benchmark.mjs",
     "docs/agent-task-benchmark.md",
-    "docs/releases/v0.2.14.md",
+    "docs/releases/v0.2.16.md",
     "README.md",
     "SECURITY.md",
     "LICENSE"
@@ -39,6 +39,7 @@
     "benchmark:real:release": "node scripts/run-real-benchmark.mjs --require-all",
     "benchmark:agent": "node scripts/run-agent-task-benchmark.mjs",
     "benchmark:agent:release": "node scripts/run-agent-task-benchmark.mjs --require-independent",
+    "sync:private": "node scripts/sync-private.mjs",
     "build:mcpb": "node scripts/build-mcpb.mjs",
     "verify:release": "node scripts/verify-release.mjs"
   },
@@ -56,6 +57,9 @@
     "dependency-graph",
     "tree-sitter",
     "claude",
+    "codex",
+    "openai-codex",
+    "coding-agents",
     "ai-agents"
   ],
   "dependencies": {

package/src/analysis/cargo-dependency-evidence.js

@@ -0,0 +1,111 @@
+import { dirname } from "node:path";
+import { createRepoBoundary } from "../repo-path.js";
+import { cargoName, parseCargoToml } from "./cargo-manifests.js";
+import { dependencyVerification, makeFinding } from "./findings.js";
+import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
+
+const rootOf = (file) => {
+  const root = dirname(String(file || "").replace(/\\/g, "/"));
+  return root === "." ? "" : root;
+};
+const owns = (root, file) => !root || file === root || String(file || "").replace(/\\/g, "/").startsWith(`${root}/`);
+
+export function collectCargoDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [] } = {}) {
+  const boundary = createRepoBoundary(repoRoot);
+  const manifests = files.filter((file) => /(^|\/)Cargo\.toml$/i.test(file));
+  const scopes = manifests.map((file) => ({ file, root: rootOf(file), ...parseCargoToml(readRepoText(boundary, file)) }))
+    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
+  const workspaceDeps = new Map();
+  for (const scope of scopes) for (const dependency of scope.workspaceDependencies) workspaceDeps.set(cargoName(dependency.alias), dependency);
+  const issues = [];
+  for (const scope of scopes) {
+    scope.dependencies = scope.dependencies.map((dependency) => {
+      if (!dependency.inherited) return dependency;
+      const inherited = workspaceDeps.get(cargoName(dependency.alias));
+      if (!inherited) { issues.push(`${scope.file}: workspace dependency ${dependency.alias} is unresolved`); return dependency; }
+      return { ...dependency, name: inherited.name, version: inherited.version, inherited: true };
+    });
+  }
+  const importsByScope = new Map(scopes.map((scope) => [scope, []]));
+  for (const entry of externalImports) {
+    if (entry.ecosystem !== "crates.io" || !entry.pkg || entry.builtin || entry.unresolved) continue;
+    const owner = scopes.find((scope) => owns(scope.root, entry.file));
+    if (owner) importsByScope.get(owner).push(entry);
+  }
+  const findings = [], declared = new Set();
+  let mappedImports = 0, unmappedImports = 0;
+  if (!scopes.length) {
+    const missing = new Map();
+    for (const entry of externalImports.filter((item) => item.ecosystem === "crates.io" && item.pkg && !item.builtin && !item.unresolved)) {
+      if (!missing.has(cargoName(entry.pkg))) missing.set(cargoName(entry.pkg), entry);
+    }
+    for (const [name, entry] of missing) findings.push(makeFinding({
+      category: "unused", rule: "missing-dep", severity: "low", confidence: "high",
+      title: `Rust crate path without Cargo.toml: ${name}`,
+      reason: "An indexed external Rust crate path exists, but no Cargo.toml was discovered.",
+      detail: `"${entry.spec || name}" is used by ${entry.file}, but no Cargo manifest owns the file.`,
+      package: name, file: entry.file, line: entry.line || 0, source: "internal",
+      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_PRESENT" }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Cargo crate name normalization" },
+      fixHint: "initialize or restore the owning Cargo manifest",
+    }));
+  }
+  for (const scope of scopes) {
+    const imports = importsByScope.get(scope);
+    const used = new Map(), missingSeen = new Set();
+    for (const entry of imports) {
+      const imported = cargoName(entry.pkg);
+      const dependency = scope.dependencies.find((item) => cargoName(item.alias) === imported || cargoName(item.name) === imported);
+      if (dependency) {
+        const evidence = used.get(dependency.alias) || [];
+        evidence.push(entry); used.set(dependency.alias, evidence); mappedImports++;
+        continue;
+      }
+      unmappedImports++;
+      if (missingSeen.has(imported)) continue;
+      missingSeen.add(imported);
+      findings.push(makeFinding({
+        category: "unused", rule: "missing-dep", severity: "medium", confidence: "high",
+        title: `Missing Cargo dependency: ${entry.pkg}`,
+        reason: "An indexed external Rust crate path has no matching dependency alias or package name in the nearest Cargo.toml.",
+        detail: `"${entry.spec || entry.pkg}" is used by ${entry.file}, but ${scope.file} does not declare crate "${entry.pkg}" (including workspace inheritance and renamed packages).`,
+        package: entry.pkg, file: entry.file, line: entry.line || 0, manifest: scope.file,
+        evidence: [{ file: entry.file, line: entry.line || 0, snippet: entry.spec || "" }], source: "internal",
+        verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", file: scope.file }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Cargo alias/package normalization" },
+        fixHint: `cargo add ${entry.pkg}`,
+      }));
+    }
+    for (const dependency of scope.dependencies) {
+      const identity = cargoName(dependency.name);
+      if (!identity) continue;
+      declared.add(`${scope.root || "."}:${identity}`);
+      const evidence = used.get(dependency.alias) || [];
+      if (evidence.length || dependency.optional || dependency.build) continue;
+      findings.push(makeFinding({
+        category: "unused", rule: "unused-dep", severity: dependency.dev ? "info" : "low", confidence: "low",
+        title: `Unused Cargo dependency: ${dependency.name}`,
+        reason: "No indexed Rust use/path/extern-crate evidence maps to this dependency; feature-only, proc-macro, generated and reflective registration remain possible.",
+        detail: `"${dependency.name}" (${dependency.alias}) is declared in ${scope.file}, but no indexed .rs file in that Cargo scope references its crate path. Confirm with cargo check/test and feature combinations before removal.`,
+        package: dependency.name, version: dependency.version, manifest: scope.file, source: "internal",
+        verification: dependencyVerification(scope.file, [], "REVIEW_REQUIRED", "Cargo alias/package normalization"),
+        fixHint: `cargo remove ${dependency.alias} after checking all features and targets`,
+      }));
+    }
+  }
+  const present = manifests.length > 0;
+  return {
+    present,
+    status: present ? "CHECKED" : "NOT_PRESENT",
+    completeness: present ? (issues.length ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
+    manifests,
+    declared,
+    mappedImports,
+    unmappedImports,
+    findings,
+    reasons: issues,
+    reason: !present
+      ? "No Cargo.toml was discovered."
+      : issues.length
+        ? `Cargo declarations and indexed crate paths were checked, but ${issues.length} workspace inheritance reference(s) remain unresolved.`
+        : `Cargo declarations from ${manifests.length} scope(s), workspace inheritance, renamed packages and every indexed external crate path were compared.`,
+  };
+}

package/src/analysis/cargo-manifests.js

@@ -0,0 +1,74 @@
+const clean = (value) => String(value || "").trim().replace(/^['"]|['"]$/g, "");
+export const cargoName = (value) => clean(value).toLowerCase().replace(/_/g, "-");
+
+function inlineTable(value) {
+  const fields = new Map();
+  for (const match of String(value || "").matchAll(/([A-Za-z][\w.-]*)\s*=\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|true|false)/g)) {
+    fields.set(match[1], clean(match[2]));
+  }
+  return fields;
+}
+
+// Bounded Cargo.toml parser for package/workspace dependency tables. It intentionally owns
+// dependency identity, aliases and concrete versions; feature activation is not treated as usage.
+export function parseCargoToml(text) {
+  const source = String(text || "");
+  const dependencies = [];
+  const workspaceDependencies = [];
+  let section = "", packageName = "", workspace = false;
+  for (const raw of source.split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    if (!line) continue;
+    const header = /^\[([^\]]+)]$/.exec(line);
+    if (header) { section = header[1].trim(); workspace ||= section === "workspace"; continue; }
+    const kv = /^([A-Za-z0-9_-]+)\s*=\s*(.+)$/.exec(line);
+    if (!kv) continue;
+    if (section === "package" && kv[1] === "name") { packageName = clean(kv[2]); continue; }
+    const dependencyTable = /^(?:target\..+\.)?(dependencies|dev-dependencies|build-dependencies)$/.exec(section);
+    const workspaceTable = section === "workspace.dependencies";
+    if (!dependencyTable && !workspaceTable) continue;
+    const alias = kv[1], value = kv[2].trim();
+    const table = value.startsWith("{") ? inlineTable(value) : new Map();
+    const version = value.startsWith("{") ? clean(table.get("version")) : clean(value);
+    const name = clean(table.get("package")) || alias;
+    const record = {
+      alias,
+      name,
+      version: /^\d/.test(version) || /^=?\s*\d/.test(version) ? version.replace(/^=\s*/, "") : "",
+      dev: dependencyTable?.[1] === "dev-dependencies",
+      build: dependencyTable?.[1] === "build-dependencies",
+      optional: table.get("optional") === "true",
+      inherited: table.get("workspace") === "true",
+    };
+    (workspaceTable ? workspaceDependencies : dependencies).push(record);
+  }
+  return { packageName, workspace, dependencies, workspaceDependencies };
+}
+
+// Cargo.lock v3/v4 [[package]] records. Registry packages are exact installed crates; workspace
+// and git packages are excluded because OSV crates.io versions must not be inferred for them.
+export function parseCargoLockPackages(text) {
+  const packages = [];
+  let current = null;
+  const flush = () => {
+    if (current?.name && current.version && /^registry\+https:\/\/github\.com\/rust-lang\/crates\.io-index|^registry\+https:\/\/index\.crates\.io\//.test(current.source)) {
+      packages.push({ ecosystem: "crates.io", name: current.name, version: current.version, dev: false, integrity: current.checksum || "", source: "cargo-lock" });
+    }
+  };
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "[[package]]") { flush(); current = { name: "", version: "", source: "", checksum: "" }; continue; }
+    if (!current) continue;
+    if (/^\[/.test(line)) { flush(); current = null; continue; }
+    const match = /^(name|version|source|checksum)\s*=\s*"([^"]+)"/.exec(line);
+    if (match) current[match[1]] = match[2];
+  }
+  flush();
+  const seen = new Set();
+  return packages.filter((pkg) => {
+    const key = `${pkg.name}@${pkg.version}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}

package/src/analysis/dep-check-ecosystems.js

@@ -194,6 +194,9 @@ export function computePyDepFindings(options = {}) {
     findings.push(...result.findings.map((finding) => ({
       ...finding,
       ...(scope.manifests?.length ? {manifest: scope.manifests[0]} : {}),
+      verification: finding.rule === "missing-dep"
+        ? { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: scope.present ? "NOT_FOUND" : "NOT_PRESENT", files: scope.manifests || [] }, indexedSourceImports: { status: "FOUND", count: finding.evidence?.length || 1, files: (finding.evidence || []).map((item) => item.file) }, mapping: "PEP 503 plus bounded import-to-distribution aliases" }
+        : { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "REVIEW_REQUIRED", manifestDeclaration: { status: "FOUND", files: scope.manifests || [] }, indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] }, mapping: "PEP 503 plus bounded import-to-distribution aliases" },
     })));
     for (const name of result.declared) declared.add(`${scope.root || "."}:${name}`);
     for (const name of result.managed) managed.add(name);

package/src/analysis/dep-check.js

@@ -7,7 +7,9 @@
 // script/config-text mention scanning + a config-ecosystem prefix rule, and we NEVER say "safe to
 // auto-remove", only "review".
 import { makeFinding } from "./findings.js";
+import {FRAMEWORK_RUNTIME_PEERS, IMPLICIT_STYLE_COMPILERS} from './dependency/conventions.js'
 import {createScopedDepFindings} from './dependency/scoped-dependencies.js'
+import {createPackageSourceMatcher} from './dependency/source-references.js'
 
 // Packages referenced by config CONVENTION, not imports (eslint extends "airbnb" → eslint-config-airbnb).
 // Flagged only at low confidence when nothing mentions them anywhere.
@@ -21,22 +23,6 @@ const BIN_PKG = {
   "electron-rebuild": "@electron/rebuild", playwright: "@playwright/test",
 };
 
-// Required peers consumed inside a framework/build tool rather than imported by application source.
-// These contracts are package-scope local and deliberately narrow; declaring the provider is required
-// for suppression, so an unrelated app still gets the normal unused-dependency finding.
-const FRAMEWORK_RUNTIME_PEERS = new Map([
-  ["next", ["react-dom"]], ["vinext", ["@vitejs/plugin-react", "@vitejs/plugin-rsc", "react-server-dom-webpack", "vite"]],
-  ["electron-vite", ["vite"]], ["@cloudflare/vite-plugin", ["vite", "wrangler"]],
-]);
-
-// Style preprocessors are compiler inputs rather than JavaScript imports. Their presence is proven by
-// source extensions in the same package scope, so do not report them as unused merely because Vite,
-// webpack, etc. load them internally. Keep this list to exact compiler/package contracts.
-const IMPLICIT_STYLE_COMPILERS = new Map([
-  ["sass", /\.(?:scss|sass)$/i], ["sass-embedded", /\.(?:scss|sass)$/i],
-  ["less", /\.less$/i], ["stylus", /\.styl(?:us)?$/i],
-]);
-
 const isStylesheetSpecifier = (spec) => /\.(?:css|scss|sass|less|styl(?:us)?)(?:[?#].*)?$/i.test(String(spec || ""));
 const escRe = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 // word-ish mention: the name not embedded inside a longer identifier/path segment
@@ -47,9 +33,10 @@ const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\
 //   pkg             — parsed package.json ({} for non-JS repos → no dep findings)
 //   workspacePkgNames — Set of monorepo-local package names (never "missing")
 //   configTexts     — Map<fileName, text> of root config files + CI workflows (mention scanning)
+//   sourceTexts     — Map<fileName, text> for narrow dynamic/package-path literal evidence
 export function computeDepFindings({
   externalImports = [], pkg = {}, workspacePkgNames = new Set(), configTexts = new Map(),
-  aliases = [], scope = "", manifest = "package.json", nonRuntimeRoots = [], sourceFiles = [],
+  sourceTexts = new Map(), aliases = [], scope = "", manifest = "package.json", nonRuntimeRoots = [], sourceFiles = [],
 } = {}) {
   const findings = [];
   const meta = { scope: scope || ".", manifest };
@@ -137,12 +124,13 @@ export function computeDepFindings({
     return false;
   };
   const typesBase = (name) => (name.startsWith("@types/") ? name.slice(7).replace(/^(.+?)__(.+)$/, "@$1/$2") : null); // @types/babel__core → @babel/core
+  const sourceReferenced = createPackageSourceMatcher(sourceTexts);
 
   // ---- unused dependencies (per section; prod vs dev differ in severity/confidence) ----
   for (const [section, deps] of Object.entries(sections)) {
     if (section === "peerDependencies") continue; // peers are consumer-facing contracts, not usage
     for (const name of Object.keys(deps)) {
-      if (name === selfName || usedPackages.has(name) || frameworkRuntime.has(name) || implicitCompilerUsage.has(name)) continue;
+      if (name === selfName || usedPackages.has(name) || frameworkRuntime.has(name) || implicitCompilerUsage.has(name) || sourceReferenced(name)) continue;
       const tb = typesBase(name);
       if (tb) { // @types/x is used iff x is used (or it types the Node builtins)
         if (tb === "node" ? builtinUsed : usedPackages.has(tb) || frameworkRuntime.has(tb) || mentioned(configBlob, tb)) continue;
@@ -159,7 +147,9 @@ export function computeDepFindings({
         title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,
         reason: "No indexed package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
         detail: `"${name}" is declared in ${section}, but no usage was found in the indexed source scope, package scripts, or ${configTexts.size} known config file(s). Dynamic/plugin/config-convention usage is not proven absent — review before removing.`,
+        file: manifest,
         package: name,
+        evidence: [{ file: manifest, line: 0, snippet: `declared in ${section}` }],
         source: "internal",
         actionability: "MANIFEST_REVIEW_REQUIRED",
         autoRemove: false,

package/src/analysis/dependency/conventions.js

@@ -0,0 +1,16 @@
+// Exact package contracts consumed by frameworks/build tools without a source
+// import. Keep them package-scope local; these are not repo-wide allowlists.
+export const FRAMEWORK_RUNTIME_PEERS = new Map([
+    ['next', ['react-dom']],
+    ['vinext', ['@vitejs/plugin-react', '@vitejs/plugin-rsc', 'react-server-dom-webpack', 'vite']],
+    ['electron-vite', ['vite']],
+    ['@cloudflare/vite-plugin', ['vite', 'wrangler']],
+])
+
+// Style preprocessors are compiler inputs proven by source extensions.
+export const IMPLICIT_STYLE_COMPILERS = new Map([
+    ['sass', /\.(?:scss|sass)$/i],
+    ['sass-embedded', /\.(?:scss|sass)$/i],
+    ['less', /\.less$/i],
+    ['stylus', /\.styl(?:us)?$/i],
+])

package/src/analysis/dependency/scoped-dependencies.js

@@ -5,13 +5,14 @@ const ownsFile = (scope, file) => !scope || file === scope || String(file || '')
 export function createScopedDepFindings(computeDepFindings) {
     return function computeScopedDepFindings({
         externalImports = [], packageScopes = [], workspacePkgNames = new Set(), configTexts = new Map(),
-        nonRuntimeRoots = [], sourceFiles = [],
+        sourceTexts = new Map(), nonRuntimeRoots = [], sourceFiles = [],
     } = {}) {
         const scopes = packageScopes.length
             ? packageScopes.map((scope) => ({...scope, root: normalizeScope(scope.root)})).sort((a, b) => b.root.length - a.root.length)
             : [{root: '', manifest: 'package.json', pkg: {}, aliases: []}]
         const importsByScope = new Map(scopes.map((scope) => [scope, []]))
         const sourceFilesByScope = new Map(scopes.map((scope) => [scope, []]))
+        const sourceTextsByScope = new Map(scopes.map((scope) => [scope, new Map()]))
         for (const item of externalImports) {
             const owner = scopes.find((scope) => ownsFile(scope.root, item.file)) || scopes[scopes.length - 1]
             importsByScope.get(owner).push(item)
@@ -20,6 +21,10 @@ export function createScopedDepFindings(computeDepFindings) {
             const owner = scopes.find((scope) => ownsFile(scope.root, file)) || scopes[scopes.length - 1]
             sourceFilesByScope.get(owner).push(file)
         }
+        for (const [file, text] of sourceTexts) {
+            const owner = scopes.find((scope) => ownsFile(scope.root, file)) || scopes[scopes.length - 1]
+            sourceTextsByScope.get(owner).set(file, text)
+        }
         const configOwner = new Map()
         for (const [file] of configTexts) configOwner.set(file, scopes.find((scope) => ownsFile(scope.root, file)) || scopes[scopes.length - 1])
         const findings = [], usedPackages = new Map(), declared = new Set()
@@ -27,7 +32,7 @@ export function createScopedDepFindings(computeDepFindings) {
             const scopeConfig = new Map([...configTexts].filter(([file]) => configOwner.get(file) === scope))
             const result = computeDepFindings({
                 externalImports: importsByScope.get(scope), pkg: scope.pkg || {}, workspacePkgNames,
-                configTexts: scopeConfig, aliases: scope.aliases || [], scope: scope.root,
+                configTexts: scopeConfig, sourceTexts: sourceTextsByScope.get(scope), aliases: scope.aliases || [], scope: scope.root,
                 manifest: scope.manifest || (scope.root ? `${scope.root}/package.json` : 'package.json'),
                 nonRuntimeRoots, sourceFiles: sourceFilesByScope.get(scope),
             })

package/src/analysis/dependency/source-references.js

@@ -0,0 +1,21 @@
+// Dynamic package loaders often construct a node_modules path instead of using
+// import/require, so they never become graph externalImports. Restrict this
+// fallback to executable npm source: manifests merely declare every dependency
+// and must never count as usage evidence.
+const NPM_SOURCE_RE = /\.(?:[cm]?[jt]sx?|vue|svelte)$/i
+const escRe = (value) => String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\w.-])`).test(blob)
+
+export function createPackageSourceMatcher(sourceTexts = new Map()) {
+    const blob = [...sourceTexts]
+        .filter(([file]) => NPM_SOURCE_RE.test(String(file || '')))
+        .map(([, text]) => String(text || ''))
+        .join('\n')
+    return (name) => {
+        if (mentioned(blob, name)) return true
+        if (!name.startsWith('@') || !name.includes('/')) return false
+        const [namespace, base] = name.split('/', 2)
+        // join(root, "node_modules", "@scope", "package", ...)
+        return new RegExp(`["'\x60]${escRe(namespace)}["'\x60][\\s\\S]{0,96}?["'\x60]${escRe(base)}["'\x60]`).test(blob)
+    }
+}

package/src/analysis/duplicates.tokenize.js

@@ -149,11 +149,17 @@ export function extractLargeStrings(text, { py = false, cs = false, minLines = 6
 
 // one raw token stream; the two modes differ only in identifier canonicalization
 export function tokenize(text) {
-  const raw = text.match(/[A-Za-z_$][\w$]*|\d+(?:\.\d+)?|[^\s\w]/g) || [];
+  const raw = text.match(/[A-Za-z_$][\w$]*|(?:0[xX][\dA-Fa-f_]+|0[bB][01_]+|0[oO][0-7_]+|\d[\d_]*(?:\.\d[\d_]*)?(?:[eE][+-]?\d[\d_]*)?)n?|[^\s\w]/g) || [];
   const strict = [];
   const renamed = [];
   for (const t of raw) {
-    if (/^\d/.test(t)) { strict.push("N"); renamed.push("N"); continue; }
+    if (/^\d/.test(t)) {
+      // Numeric constants are behavior, not renameable identifiers. Preserve
+      // their value so same-shape limit/config tables with different numbers do
+      // not become perfect clones; a small constant edit still leaves the rest
+      // of a genuine copied body highly similar.
+      strict.push(`N:${t}`); renamed.push(`N:${t}`); continue;
+    }
     if (/^[A-Za-z_$]/.test(t) && !KEYWORDS.has(t)) { strict.push(t); renamed.push("I"); continue; }
     strict.push(t); renamed.push(t);
   }
@@ -178,5 +184,9 @@ export function fingerprints(toks) {
     for (let j = i; j < Math.min(i + W, hashes.length); j++) if (hashes[j] < min) min = hashes[j];
     fp.add(min);
   }
+  // Winnowing can skip every changed literal in a repetitive policy table.
+  // Exact numeric anchors keep behavior-defining limits in the similarity
+  // denominator while leaving ordinary copied bodies tolerant of a small edit.
+  for (const token of toks) if (token.startsWith("N:")) fp.add(`numeric:${token}`);
   return fp;
 }

package/src/analysis/endpoints-java.js

@@ -2,16 +2,13 @@
 // literal annotation paths: inventing values for constants would make an architecture inventory look
 // more complete than the evidence permits.
 import { maskJavaNonCode } from "./java-source.js";
+import { lineNumberAt } from "../util.js";
 
 const SPRING_MAPPING = /@(?:org\.springframework\.web\.bind\.annotation\.)?(RequestMapping|GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping)\b/g;
 const SPRING_CONDITION = /@(?:org\.springframework\.boot\.autoconfigure\.condition\.)?(ConditionalOnExpression|ConditionalOnProperty)\b/g;
 const REQUEST_METHOD = /\bRequestMethod\s*\.\s*(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE)\b/g;
 
-const lineAt = (text, index) => {
-  let line = 1;
-  for (let i = 0; i < index && i < text.length; i++) if (text[i] === "\n") line++;
-  return line;
-};
+const lineAt = lineNumberAt;
 
 function skipTrivia(text, start) {
   let i = start;