weavatrix 0.2.14 → 0.2.16

package/src/mcp/tools-impact.mjs

@@ -2,53 +2,16 @@
 // last rebuild (graph_diff), and the blast radius of the current change set (change_impact).
 // Hot-reloadable (re-imported by catalog.mjs on change).
 import {readFileSync} from 'node:fs'
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
 import {
     isSymbol, degreeOf, labelOf, resolveNodeInfo, ambiguityNote,
     rawGraph, prevGraphPathFor, edgeEndpoint, diffGraphs, formatGraphDiff,
 } from './graph-context.mjs'
-import {readCoverageForRepo} from '../analysis/coverage-reports.js'
-import {isStructuralRelation} from '../graph/relations.js'
+import {querySymbolPrecision} from '../precision/symbol-query.js'
+import {graphWithExactDirectReferences, refineChangeImpact} from './tools-impact-precision.mjs'
+import {reverseReach} from './graph/reverse-reach.mjs'
 import {tChangeImpactV2} from './tools-impact-change.mjs'
 import {buildGraphAtGitRef} from '../analysis/git-ref-graph.js'
 
-function reverseReach(g, seeds, maxDepth) {
-    const states = new Map([...seeds].map((id) => [String(id), {
-        runtimeDepth: 0, runtimeRelation: null, compileDepth: null, compileRelation: null,
-    }]))
-    const frontier = [...seeds].map((id) => ({id: String(id), depth: 0, compileOnly: false}))
-    for (let cursor = 0; cursor < frontier.length; cursor++) {
-        const current = frontier[cursor]
-        if (current.depth >= maxDepth) continue
-        for (const e of g.inn.get(current.id) || []) {
-            if (isStructuralRelation(e.relation) || e.barrelProxy === true) continue
-            const id = String(e.id)
-            const compileOnly = current.compileOnly || e.typeOnly === true || e.compileOnly === true
-            const depth = current.depth + 1
-            const entry = states.get(id) || {
-                runtimeDepth: null, runtimeRelation: null, compileDepth: null, compileRelation: null,
-            }
-            const depthKey = compileOnly ? 'compileDepth' : 'runtimeDepth'
-            const relationKey = compileOnly ? 'compileRelation' : 'runtimeRelation'
-            const provenanceKey = compileOnly ? 'compileProvenance' : 'runtimeProvenance'
-            if (entry[depthKey] != null && entry[depthKey] <= depth) continue
-            entry[depthKey] = depth
-            entry[relationKey] = e.relation || 'rel'
-            entry[provenanceKey] = e.provenance || 'UNKNOWN'
-            states.set(id, entry)
-            frontier.push({id, depth, compileOnly})
-        }
-    }
-    return new Map([...states].map(([id, entry]) => [id, {
-        ...entry,
-        depth: entry.runtimeDepth ?? entry.compileDepth ?? 0,
-        compileOnly: entry.runtimeDepth == null,
-        relation: entry.runtimeDepth != null ? entry.runtimeRelation : entry.compileRelation,
-        provenance: entry.runtimeDepth != null ? entry.runtimeProvenance : entry.compileProvenance,
-    }]))
-}
-
 const impactKind = (entry) => {
     if (entry?.runtimeDepth != null) {
         return entry.compileDepth != null ? `runtime + compile-time(d${entry.compileDepth})` : 'runtime'
@@ -59,7 +22,7 @@ const impactKind = (entry) => {
 // Transitive blast-radius: who is affected if this node changes. Walks REVERSE dependency edges
 // (calls/imports/inherits — not structural `contains`) out to `depth`. For a symbol, also seeds its
 // containing file, because importers depend on the file rather than the individual symbol.
-export function tGetDependents(g, {label, depth = 3, max_nodes = 40, include_container_importers = false} = {}) {
+function getDependentsFromGraph(g, {label, depth = 3, max_nodes = 40, include_container_importers = false} = {}, precisionNote = null) {
     const info = resolveNodeInfo(g, label)
     const n = info.node
     if (!n) return `No node found matching "${label}".`
@@ -81,18 +44,64 @@ export function tGetDependents(g, {label, depth = 3, max_nodes = 40, include_con
         .filter(([nid]) => !seeds.has(nid))
         .map(([nid, entry]) => ({id: nid, d: entry.depth, entry, deg: degreeOf(g, nid)}))
         .sort((a, b) => a.d - b.d || Number(a.entry.compileOnly) - Number(b.entry.compileOnly) || b.deg - a.deg)
-    if (!ranked.length) return [note, `No dependents found for ${n.label ?? id} within depth ${maxDepth} — nothing in the graph calls, imports, or inherits it.`].filter(Boolean).join('\n')
+    if (!ranked.length) return [note, precisionNote, `No dependents found for ${n.label ?? id} within depth ${maxDepth} — nothing in the graph calls, imports, or inherits it.`].filter(Boolean).join('\n')
     const shown = ranked.slice(0, cap)
     const runtimeCount = ranked.filter((entry) => !entry.entry.compileOnly).length
     const compileCount = ranked.length - runtimeCount
     return [
         note,
+        precisionNote,
         `Dependents of ${n.label ?? id} (reverse calls/imports/inherits, depth ≤${maxDepth}): ${ranked.length} found (${runtimeCount} runtime, ${compileCount} compile-time-only), showing ${shown.length} by proximity + connectivity.`,
         containingFile ? `Includes importers of its containing file ${labelOf(g, containingFile)} by explicit request.` : null,
         ...shown.map((r) => `  [d${r.d} ${impactKind(r.entry)}] ${r.entry.relation || 'rel'} [${r.entry.provenance || 'UNKNOWN'}]  ${labelOf(g, r.id)}  (deg ${r.deg})  [${r.id}]`),
     ].filter(Boolean).join('\n')
 }
 
+export function tGetDependents(g, args = {}, ctx = {}) {
+    const info = resolveNodeInfo(g, args.label)
+    const id = String(info.node?.id || '')
+    const requested = ['auto', 'graph', 'lsp'].includes(args.precision) ? args.precision : 'auto'
+    const canQuery = isSymbol(id) && ctx.repoRoot && ctx.graphPath
+        && (requested === 'lsp' || (requested === 'auto' && g.graphPrecisionMode !== 'off'))
+    if (!canQuery) {
+        const note = isSymbol(id) && requested !== 'graph'
+            ? 'Semantic precision: graph-only; an exact point query was unavailable or disabled.' : null
+        return getDependentsFromGraph(g, args, note)
+    }
+    return (async () => {
+        try {
+            const result = await querySymbolPrecision({
+                repoRoot: ctx.repoRoot,
+                graphPath: ctx.graphPath,
+                targetId: id,
+                maxReferences: Math.max(100, Math.min(5_000, Number(args.max_references) || 1_000)),
+                timeoutMs: Math.max(1_000, Math.min(60_000, Number(args.timeout_ms) || 30_000)),
+                clientFactory: ctx.precisionClientFactory,
+            })
+            const exactGraph = graphWithExactDirectReferences(g, id, result.overlay)
+            if (exactGraph) {
+                const count = (result.overlay.links || []).filter((link) => String(link?.target || '') === id).length
+                return getDependentsFromGraph(
+                    exactGraph,
+                    args,
+                    `Semantic precision: EXACT_LSP point query${result.cached ? ' (cache hit)' : ''}; ${count} classified direct reference edge(s).`,
+                )
+            }
+            return getDependentsFromGraph(
+                g,
+                args,
+                `Semantic precision: ${result.overlay?.state || 'UNAVAILABLE'}; exact absence was not proven, so graph edges are retained (${result.overlay?.reason || 'incomplete project coverage'}).`,
+            )
+        } catch (error) {
+            return getDependentsFromGraph(
+                g,
+                args,
+                `Semantic precision: UNAVAILABLE; graph evidence retained (${error?.message || 'point query failed'}).`,
+            )
+        }
+    })()
+}
+
 // Re-query the last rebuild's before/after pair (graph.prev.json vs graph.json), optionally scoped.
 export async function tGraphDiff(g, args, ctx) {
     const current = rawGraph(ctx)
@@ -141,104 +150,12 @@ export async function tGraphDiff(g, args, ctx) {
 }
 
 // ---- change impact -------------------------------------------------------------------------------
-function gitLines(repoRoot, args) {
-    const res = spawnSync('git', ['-C', repoRoot, ...args], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
-    if (res.status !== 0) return null
-    return String(res.stdout || '').split(/\r?\n/).map((s) => s.trim()).filter(Boolean)
-}
-
-function resolveImpactBase(repoRoot, requested) {
-    const candidates = requested ? [requested] : ['origin/HEAD', 'origin/main', 'origin/master', 'main', 'master']
-    for (const ref of candidates) {
-        const ok = spawnSync('git', ['-C', repoRoot, 'rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
-        if (ok.status === 0) return ref
-    }
-    return null
-}
-
 // Blast radius of a change, without any GitHub API: diff the CURRENT change (branch
 // commits since the merge-base + staged/unstaged + untracked) against a base ref, map the changed
 // files and their symbols onto the graph, and walk REVERSE dependency edges — everything the change
 // can break, ranked by proximity + connectivity, with file-level test coverage attached so the
 // untested part of the blast radius stands out. The pre-PR review, in one call.
 export function tChangeImpact(g, args, ctx) {
-    return tChangeImpactV2(g, args, ctx)
-}
-
-// Kept private during the v2 rollout so the surrounding get_dependents/graph_diff implementation is
-// untouched; focused tests exercise the exported symbol-aware path above.
-function tChangeImpactLegacy(g, args, ctx) {
-    if (!ctx.repoRoot) return 'change_impact needs the repo root (not provided to this server).'
-    // Explicit file list (e.g. a PR's changed files) skips the local git diff entirely — this is how
-    // a NOT-checked-out PR gets its impact assessed.
-    const explicit = Array.isArray(args.files)
-        ? [...new Set(args.files.map((f) => String(f).replace(/\\/g, '/').trim()).filter(Boolean))]
-        : null
-    let changed
-    let sourceLabel
-    if (explicit) {
-        if (!explicit.length) return 'files was provided but empty — pass repo-relative paths, or omit it to diff the local change.'
-        changed = explicit
-        sourceLabel = `for ${changed.length} provided file(s)`
-    } else {
-        const base = resolveImpactBase(ctx.repoRoot, args.base ? String(args.base).trim() : '')
-        if (!base) return `Could not resolve a base ref${args.base ? ` ("${args.base}")` : ''} — pass base explicitly (e.g. origin/main or HEAD~1).`
-        const committed = gitLines(ctx.repoRoot, ['diff', '--name-only', `${base}...HEAD`])
-        if (committed === null) return `git diff against ${base} failed — is ${ctx.repoRoot} a git repository?`
-        const uncommitted = gitLines(ctx.repoRoot, ['diff', '--name-only', 'HEAD']) || []
-        const untracked = gitLines(ctx.repoRoot, ['ls-files', '--others', '--exclude-standard']) || []
-        changed = [...new Set([...committed, ...uncommitted, ...untracked])]
-        sourceLabel = `vs ${base}`
-        if (!changed.length) return `No changes vs ${base} — working tree clean and no branch commits.`
-    }
-
-    const changedSet = new Set(changed)
-    const seeds = new Set()
-    const unmapped = []
-    for (const file of changed) {
-        if (!g.byId.has(file)) { unmapped.push(file); continue }
-        seeds.add(file)
-        for (const e of g.out.get(file) || []) if (e.relation === 'contains') seeds.add(String(e.id))
-    }
-    if (!seeds.size) {
-        return [
-            `${changed.length} changed file(s) ${sourceLabel}, but none are in the graph — new files or non-code.`,
-            `Run rebuild_graph and retry for the full picture.`,
-            `Changed: ${changed.slice(0, 20).join(', ')}${changed.length > 20 ? ', …' : ''}`,
-        ].join('\n')
-    }
-
-    const maxDepth = Math.max(1, Math.min(4, Number(args.depth) || 2))
-    const cap = Math.max(5, Math.min(120, Number(args.max_nodes) || 40))
-    const reached = reverseReach(g, seeds, maxDepth)
-    const fileOfNode = (id) => { const s = String(id); const h = s.indexOf('#'); return h < 0 ? s : s.slice(0, h) }
-    const impacted = [...reached.entries()]
-        .filter(([nid]) => !seeds.has(nid) && !changedSet.has(fileOfNode(nid)))
-        .map(([nid, entry]) => ({id: nid, d: entry.depth, entry, deg: degreeOf(g, nid), file: fileOfNode(nid)}))
-        .sort((a, b) => a.d - b.d || Number(a.entry.compileOnly) - Number(b.entry.compileOnly) || b.deg - a.deg)
-
-    // coverage overlay from EXISTING reports (fractions 0..1) — see coverage_map for details
-    const knownFiles = (rawGraph(ctx).nodes || []).filter((n) => !String(n.id).includes('#') && n.source_file).map((n) => n.source_file)
-    const coverage = readCoverageForRepo(ctx.repoRoot, knownFiles)
-    const covOf = (file) => coverage.get(String(file).replace(/\\/g, '/'))?.pct ?? null
-    const pctStr = (v) => (v == null ? 'cov n/a' : `cov ${Math.round(v * 100)}%`)
-    const hasCoverage = coverage.size > 0
-
-    const shown = impacted.slice(0, cap)
-    const runtimeImpacted = impacted.filter((entry) => !entry.entry.compileOnly).length
-    const compileImpacted = impacted.length - runtimeImpacted
-    const untestedHotspots = shown.filter((n) => { const c = covOf(n.file); return c != null && c < 0.5 && n.deg >= 5 })
-    return [
-        `Change impact ${sourceLabel}: ${changed.length} changed file(s) → ${seeds.size} graph seed(s) incl. their symbols${unmapped.length ? `; ${unmapped.length} file(s) not in the graph (new/non-code — rebuild_graph refreshes)` : ''}.`,
-        impacted.length
-            ? `${impacted.length} impacted node(s) within ${maxDepth} reverse hop(s) (${runtimeImpacted} runtime, ${compileImpacted} compile-time-only), showing ${shown.length}:`
-            : `Nothing else in the graph depends on the changed code within ${maxDepth} hop(s).`,
-        hasCoverage ? `Coverage: existing report mapped where available.` : `Coverage: unavailable (no supported report found); per-node coverage labels omitted.`,
-        ...shown.map((n) => `  [d${n.d} ${impactKind(n.entry)}] ${n.entry.relation || 'rel'}  ${labelOf(g, n.id)}  (deg ${n.deg}${hasCoverage ? `, ${pctStr(covOf(n.file))}` : ''})  [${n.id}]`),
-        untestedHotspots.length ? `` : null,
-        untestedHotspots.length ? `Untested hotspots in the blast radius (<50% coverage, deg ≥5) — cover these before shipping:` : null,
-        ...untestedHotspots.slice(0, 10).map((n) => `  ${labelOf(g, n.id)}  (${pctStr(covOf(n.file))}, deg ${n.deg})  ${n.file}`),
-        ``,
-        `Drill into any node with get_dependents / read_source; per-symbol coverage via coverage_map.`,
-    ].filter((x) => x != null).join('\n')
+    const baseline = tChangeImpactV2(g, args, ctx)
+    return refineChangeImpact(g, args, ctx, baseline, tChangeImpactV2)
 }

package/src/path-classification.js

@@ -5,6 +5,20 @@ import { openSync, closeSync, readSync, readFileSync, statSync } from "node:fs";
 import { createRepoBoundary } from "./repo-path.js";
 
 export const PATH_CLASS_NAMES = Object.freeze(["test", "e2e", "generated", "mock", "story", "docs", "benchmark", "temp"]);
+export const PATH_CLASS_QUERY_TERMS = Object.freeze({
+  test: Object.freeze(["test", "tests", "testing", "unit"]),
+  e2e: Object.freeze(["e2e", "playwright", "cypress"]),
+  generated: Object.freeze(["generated", "autogenerated", "dist"]),
+  mock: Object.freeze(["mock", "mocks", "fixture", "fixtures", "fake"]),
+  story: Object.freeze(["story", "stories", "storybook"]),
+  docs: Object.freeze(["doc", "docs", "documentation", "readme", "guide"]),
+  benchmark: Object.freeze(["benchmark", "benchmarks", "bench"]),
+  temp: Object.freeze(["temp", "temporary", "tmp"]),
+});
+export const PATH_CLASS_TASK_QUERY_TERMS = Object.freeze({
+  ...PATH_CLASS_QUERY_TERMS,
+  test: Object.freeze([...PATH_CLASS_QUERY_TERMS.test, "spec", "coverage", "verify"]),
+});
 const PATH_CLASS_SET = new Set(PATH_CLASS_NAMES);
 const MAX_CONFIG_BYTES = 64 * 1024;
 const MAX_RULES_PER_CLASS = 64;

package/src/precision/lsp-overlay/build.js

@@ -51,8 +51,14 @@ function completedOverlay(session) {
       language: 'typescript/javascript',
       capability: 'textDocument/references',
       status: state,
+      configuredPluginsSuppressed: session.semanticInputs.pluginsSuppressed || 0,
+      repoLocalPluginLoads: false,
     }],
     semanticInputFingerprint: session.semanticInputs.fingerprint,
+    pluginPolicy: {
+      configuredPluginsSuppressed: session.semanticInputs.pluginsSuppressed || 0,
+      repoLocalPluginLoads: false,
+    },
     coverage: coverage(session),
     links: session.links,
     referenceEvidence: session.referenceEvidence,
@@ -181,6 +187,10 @@ export async function buildLspPrecisionOverlay({
     return persist(session, baseOverlay(graph, 'COMPLETE', {
       request: session.request,
       semanticInputFingerprint: session.semanticInputs.fingerprint,
+      pluginPolicy: {
+        configuredPluginsSuppressed: session.semanticInputs.pluginsSuppressed || 0,
+        repoLocalPluginLoads: false,
+      },
       reason: 'no eligible JavaScript/TypeScript semantic targets',
     }))
   }

package/src/precision/lsp-overlay/contract.js

@@ -1,6 +1,6 @@
 import {typeScriptLspContract} from '../typescript-lsp-provider.js'
 
-export const PRECISION_OVERLAY_V = 3
+export const PRECISION_OVERLAY_V = 4
 export const PRECISION_FILE = 'precision.json'
 export const JS_TS_FILE = /\.(?:[cm]?[jt]sx?)$/i
 export const endpoint = (value) => String(value && typeof value === 'object' ? value.id : value)

package/src/precision/symbol-query.js

@@ -182,3 +182,42 @@ export async function querySymbolPrecision({
         inFlight.delete(flightKey)
     }
 }
+
+export async function querySymbolsPrecision({
+    repoRoot,
+    graphPath,
+    targetIds,
+    maxReferences = 5_000,
+    timeoutMs = 45_000,
+    clientFactory,
+} = {}) {
+    if (!repoRoot || !graphPath || !Array.isArray(targetIds) || !targetIds.length) {
+        throw new Error('batch symbol precision requires repoRoot, graphPath, and targetIds')
+    }
+    const ids = [...new Set(targetIds.map(String).filter(Boolean))].slice(0, 16)
+    const boundedReferences = boundedInteger(maxReferences, 5_000, 1, 16_384)
+    const boundedTimeout = boundedInteger(timeoutMs, 45_000, 1_000, 60_000)
+    const rawGraph = loadRawGraph(graphPath)
+    const graph = rawGraph.graphPrecisionMode === 'off' ? {...rawGraph, graphPrecisionMode: 'lsp'} : rawGraph
+    const nodes = new Map((graph.nodes || []).map((node) => [String(node?.id || ''), node]))
+    for (const id of ids) {
+        const target = nodes.get(id)
+        if (!target) throw new Error(`precision target is absent from the active graph: ${id}`)
+        if (!target.selection_start || !/\.(?:[cm]?[jt]sx?)$/i.test(String(target.source_file || ''))) {
+            throw new Error(`exact batch precision does not support target: ${id}`)
+        }
+    }
+    const startedAt = Date.now()
+    const overlay = await buildLspPrecisionOverlay({
+        repoRoot,
+        graph,
+        mode: 'lsp',
+        maxSymbols: ids.length,
+        maxReferences: boundedReferences,
+        maxLinks: boundedReferences,
+        timeoutMs: boundedTimeout,
+        targetIds: ids,
+        clientFactory,
+    })
+    return {overlay, targetIds: ids, elapsedMs: Date.now() - startedAt}
+}

package/src/precision/typescript-provider/client.js

@@ -6,11 +6,13 @@ import {
     typeScriptLanguageId,
     typeScriptLspContract,
 } from './discovery.js'
+import {isolateTypeScriptRuntime} from './isolated-runtime.js'
 
 /** Starts Weavatrix's bundled TypeScript server without executing repository configuration. */
 export async function createTypeScriptLspClient({repoRoot, timeoutMs = 10_000} = {}) {
     const discovered = discoverTypeScriptProvider()
     const absoluteRepoRoot = resolve(repoRoot)
+    const isolated = isolateTypeScriptRuntime(discovered.tsserverPath)
     let client
     let reportedTypeScript = null
     try {
@@ -41,11 +43,16 @@ export async function createTypeScriptLspClient({repoRoot, timeoutMs = 10_000} =
             initializationOptions: {
                 hostInfo: 'weavatrix',
                 disableAutomaticTypingAcquisition: true,
-                tsserver: {path: discovered.tsserverPath},
+                tsserver: {path: isolated.tsserverPath},
+                // An explicit empty list keeps the language-server plugin manager
+                // from adding --globalPlugins or --pluginProbeLocations. tsserver's
+                // local-plugin loading remains disabled by default as well.
+                plugins: [],
             },
         })
     } catch (error) {
         client?.kill(error)
+        isolated.cleanup()
         throw error
     }
     return Object.freeze({
@@ -63,7 +70,13 @@ export async function createTypeScriptLspClient({repoRoot, timeoutMs = 10_000} =
         },
         definition(relPath, position) { return client.definition({filePath: relPath, position}) },
         closeDocument(relPath) { return client.closeDocument(relPath) },
-        close(shutdownTimeoutMs = timeoutMs) { return client.shutdown({timeoutMs: shutdownTimeoutMs}) },
-        kill() { client.kill() },
+        async close(shutdownTimeoutMs = timeoutMs) {
+            try { return await client.shutdown({timeoutMs: shutdownTimeoutMs}) }
+            finally { isolated.cleanup() }
+        },
+        kill() {
+            try { client.kill() }
+            finally { isolated.cleanup() }
+        },
     })
 }

package/src/precision/typescript-provider/discovery.js

@@ -4,7 +4,7 @@ import {createRequire} from 'node:module'
 
 const requireFromWeavatrix = createRequire(import.meta.url)
 export const PROVIDER = 'typescript-language-server'
-export const TYPESCRIPT_LSP_CAPABILITY_CONTRACT = 'typescript-references-v3'
+export const TYPESCRIPT_LSP_CAPABILITY_CONTRACT = 'typescript-references-v4-plugin-suppression'
 let discoveredProvider = null
 
 function resolveOwn(specifier) {

package/src/precision/typescript-provider/isolated-runtime.js

@@ -0,0 +1,39 @@
+import {copyFileSync, linkSync, mkdirSync, mkdtempSync, readdirSync, rmSync} from 'node:fs'
+import {tmpdir} from 'node:os'
+import {basename, dirname, join} from 'node:path'
+
+const RUNTIME_FILES = new Set([
+    'tsserver.js', '_tsserver.js', 'typescript.js',
+    'typingsInstaller.js', '_typingsInstaller.js', 'typesMap.json', 'watchGuard.js',
+])
+
+function materialize(source, target) {
+    try { linkSync(source, target) }
+    catch { copyFileSync(source, target) }
+}
+
+export function isolateTypeScriptRuntime(tsserverPath) {
+    const sourceLib = dirname(tsserverPath)
+    const sourceRoot = dirname(sourceLib)
+    const root = mkdtempSync(join(tmpdir(), 'weavatrix-tsserver-'))
+    const lib = join(root, 'lib')
+    mkdirSync(lib, {recursive: true, mode: 0o700})
+    try {
+        materialize(join(sourceRoot, 'package.json'), join(root, 'package.json'))
+        const files = readdirSync(sourceLib).filter((name) =>
+            RUNTIME_FILES.has(name) || /^lib(?:\..+)?\.d\.ts$/i.test(name))
+        for (const name of files) materialize(join(sourceLib, name), join(lib, basename(name)))
+        let cleaned = false
+        return {
+            tsserverPath: join(lib, 'tsserver.js'),
+            cleanup() {
+                if (cleaned) return
+                cleaned = true
+                try { rmSync(root, {recursive: true, force: true}) } catch { /* process cleanup fallback */ }
+            },
+        }
+    } catch (error) {
+        try { rmSync(root, {recursive: true, force: true}) } catch { /* best effort */ }
+        throw error
+    }
+}

package/src/precision/typescript-provider/project-host.js

@@ -154,7 +154,7 @@ export function parseRepoConfig(context, configPath, budget) {
     const state = {
         outsideAccess: false,
         limitExceeded: false,
-        configuredPlugins: false,
+        configuredPlugins: new Set(),
         bytes: 0,
         records: new Map(),
     }
@@ -197,8 +197,9 @@ export function parseRepoConfig(context, configPath, budget) {
             }
             try {
                 const raw = ts.parseConfigFileTextToJson(path, body.toString('utf8')).config
-                if (Array.isArray(raw?.compilerOptions?.plugins) && raw.compilerOptions.plugins.length) {
-                    state.configuredPlugins = true
+                for (const plugin of raw?.compilerOptions?.plugins || []) {
+                    const name = typeof plugin?.name === 'string' ? plugin.name.trim() : ''
+                    if (name) state.configuredPlugins.add(name.slice(0, 256))
                 }
             } catch { /* parser diagnostics below decide safety */ }
             return body.toString('utf8')
@@ -213,8 +214,9 @@ export function parseRepoConfig(context, configPath, budget) {
     try { parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, host) }
     catch { return {complete: false, reason: 'CONFIG_PARSE_FAILED'} }
     const errors = [...diagnostics, ...(parsed?.errors || [])]
-    if (state.configuredPlugins || (Array.isArray(parsed?.options?.plugins) && parsed.options.plugins.length)) {
-        return {complete: false, reason: 'CONFIGURED_TSSERVER_PLUGINS'}
+    for (const plugin of parsed?.options?.plugins || []) {
+        const name = typeof plugin?.name === 'string' ? plugin.name.trim() : ''
+        if (name) state.configuredPlugins.add(name.slice(0, 256))
     }
     if (budget.reason) return {complete: false, reason: budget.reason}
     if (!parsed || state.outsideAccess || state.limitExceeded
@@ -244,6 +246,9 @@ export function parseRepoConfig(context, configPath, budget) {
         projectFiles,
         projectKeys,
         configRecords: state.records,
-        plugins: [],
+        // The bundled provider runs an isolated tsserver copy whose plugin search
+        // root contains only TypeScript runtime files. Keep configured plugin names
+        // as evidence, but never execute them from the inspected repository/bundle.
+        plugins: [...state.configuredPlugins].sort(),
     }
 }

package/src/precision/typescript-provider/project-safety.js

@@ -57,6 +57,7 @@ export function typeScriptProjectSafety(repoRoot, relFiles = [], options = {}) {
 
     const configRecords = new Map()
     const projectFiles = new Set()
+    const configuredPlugins = new Set()
     const projects = {}
     for (let cursor = 0; cursor < queue.length; cursor++) {
         if (Date.now() >= budget.deadline) return {safe: false, reason: 'SAFETY_DEADLINE', fingerprint: null}
@@ -68,7 +69,9 @@ export function typeScriptProjectSafety(repoRoot, relFiles = [], options = {}) {
         projects[configRel] = {
             projectFiles: parsed.projectFiles,
             configFiles: [...parsed.configRecords.keys()].sort(),
+            configuredPlugins: parsed.plugins,
         }
+        for (const plugin of parsed.plugins || []) configuredPlugins.add(plugin)
         for (const [file, digest] of parsed.configRecords) {
             configRecords.set(file, digest)
             if (configRecords.size > MAX_CONFIG_FILES) {
@@ -133,6 +136,8 @@ export function typeScriptProjectSafety(repoRoot, relFiles = [], options = {}) {
         projectFiles: [...projectFiles].sort(),
         fileConfigs,
         projects,
+        configuredPlugins: [...configuredPlugins].sort(),
+        pluginsSuppressed: configuredPlugins.size,
     }
 }
 

package/src/security/advisory-store.js

@@ -17,7 +17,7 @@ export const DEFAULT_STORE = join(homedir(), ".weavatrix", "advisories.json");
 const OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
 const OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
 const DEFAULT_FETCH_TIMEOUT_MS = Number(process.env.WEAVATRIX_OSV_TIMEOUT_MS || 20000);
-export const OSV_SUPPORTED_ECOSYSTEMS = new Set(["npm", "PyPI", "Go"]);
+export const OSV_SUPPORTED_ECOSYSTEMS = new Set(["npm", "PyPI", "Go", "Maven", "crates.io"]);
 
 const keyOf = (ecosystem, name) => `${ecosystem}|${ecosystem === "PyPI" ? String(name).toLowerCase().replace(/[-_.]+/g, "-") : name}`;
 
@@ -121,7 +121,7 @@ export async function refreshAdvisories({ installed = [], storePath = DEFAULT_ST
       ok: false,
       queried: 0,
       unsupported,
-      error: "No OSV-supported pinned package versions found to check. weavatrix currently queries OSV for npm, PyPI, and Go packages with concrete versions.",
+      error: "No OSV-supported pinned package versions found to check. Weavatrix queries OSV for npm, PyPI, Go, Maven/Gradle, and crates.io packages with concrete versions.",
     };
   }
   const store = loadStore(storePath);

package/src/security/installed-jvm-rust.js

@@ -0,0 +1,46 @@
+import { createRepoBoundary } from "../repo-path.js";
+import { listRepoFiles, readRepoText } from "../analysis/internal-audit/repo-files.js";
+import { parseCargoLockPackages } from "../analysis/cargo-manifests.js";
+import { parseGradleDependencies, parseGradleLockPackages, parseGradleVersionCatalog, parseMavenPom } from "../analysis/jvm-manifests.js";
+
+const dedupe = (items) => {
+  const seen = new Set();
+  return items.filter((item) => {
+    const key = `${item.ecosystem}|${item.name}|${item.version}`;
+    if (!item.name || !item.version || seen.has(key)) return false;
+    seen.add(key); return true;
+  });
+};
+const concreteVersion = (value) => !!value && !/[\[\](),${}*+]/.test(String(value));
+
+export function collectJvmRustInstalled(repoPath) {
+  const boundary = createRepoBoundary(repoPath);
+  if (!boundary.root) return [];
+  const files = listRepoFiles(repoPath);
+  const installed = [];
+  for (const file of files.filter((name) => /(^|\/)Cargo\.lock$/i.test(name))) {
+    installed.push(...parseCargoLockPackages(readRepoText(boundary, file)));
+  }
+  for (const file of files.filter((name) => /(^|\/)pom\.xml$/i.test(name))) {
+    const parsed = parseMavenPom(readRepoText(boundary, file));
+    installed.push(...parsed.dependencies.filter((item) => concreteVersion(item.version)).map((item) => ({
+      ecosystem: "Maven", name: item.name, version: item.version, dev: item.scope === "test",
+      integrity: "", source: "pom",
+    })));
+  }
+  const catalog = new Map();
+  for (const file of files.filter((name) => /(^|\/)libs\.versions\.toml$/i.test(name))) {
+    for (const [alias, entry] of parseGradleVersionCatalog(readRepoText(boundary, file))) catalog.set(alias, entry);
+  }
+  for (const file of files.filter((name) => /(^|\/)(?:build|settings|[^/]+)\.gradle(?:\.kts)?$/i.test(name))) {
+    const dependencies = parseGradleDependencies(readRepoText(boundary, file), catalog);
+    installed.push(...dependencies.filter((item) => concreteVersion(item.version)).map((item) => ({
+      ecosystem: "Maven", name: item.name, version: item.version,
+      dev: /test/i.test(item.scope || ""), integrity: "", source: "gradle-manifest",
+    })));
+  }
+  for (const file of files.filter((name) => /(^|\/)(?:gradle\.lockfile|dependency-locks\/[^/]+\.lockfile)$/i.test(name))) {
+    installed.push(...parseGradleLockPackages(readRepoText(boundary, file)));
+  }
+  return dedupe(installed);
+}

package/src/security/installed.js

@@ -7,6 +7,8 @@ import { join, relative } from "node:path";
 import { parseGoMod } from "../analysis/manifests.js";
 import { uniqueBy } from "../util.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { collectJvmRustInstalled } from "./installed-jvm-rust.js";
+import { listRepoFiles, readRepoText } from "../analysis/internal-audit/repo-files.js";
 
 const pep503 = (name) => String(name).toLowerCase().replace(/[-_.]+/g, "-"); // PyPI canonical name
 
@@ -256,5 +258,23 @@ export function collectInstalled(repoPath) {
     if (!vers) merged.push(d);
     else if (!vers.has(d.version)) drift.push({ name: d.name, locked: locked.get(d.name).version, installed: d.version });
   }
-  return { installed: dedupe([...merged, ...py, ...go]), drift };
+  const jvmRust = collectJvmRustInstalled(repoPath);
+  // The earlier fast path covers roots and immediate services. Complete the tracked repository
+  // universe so deeply nested Python/Go services are not silently omitted from advisory coverage.
+  const repositoryFiles = listRepoFiles(repoPath);
+  const allPython = repositoryFiles.flatMap((file) => {
+    const text = readRepoText(boundary, file);
+    if (/(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(file) || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(file)) return parseRequirements(text || "");
+    if (/(^|\/)poetry\.lock$/i.test(file)) return parseTomlLockPackages(text || "", "poetry-lock");
+    if (/(^|\/)uv\.lock$/i.test(file)) return parseTomlLockPackages(text || "", "uv-lock");
+    if (/(^|\/)Pipfile\.lock$/i.test(file)) { try { return parsePipfileLock(JSON.parse(text)); } catch { return []; } }
+    return [];
+  });
+  const allGo = repositoryFiles.flatMap((file) => {
+    const text = readRepoText(boundary, file) || "";
+    if (/(^|\/)go\.sum$/i.test(file)) return parseGoSum(text);
+    if (/(^|\/)go\.mod$/i.test(file)) return parseGoModPackages(text);
+    return [];
+  });
+  return { installed: dedupe([...merged, ...py, ...go, ...allPython, ...allGo, ...jvmRust]), drift };
 }

package/src/security/malware-heuristics.sweep.js

@@ -74,7 +74,7 @@ export async function rgSweep(rg, contentRoots, timeoutMs) {
         const lineText = String(obj.data?.lines?.text || "");
         const subText = String(obj.data?.submatches?.[0]?.match?.text || "");
         for (const at of matchRuleOffsets(rule, lineText, subText)) {
-          const text = (lineText ? lineText.slice(Math.max(0, at - 60), at + 180) : subText).trim().slice(0, 240);
+          const text = (lineText ? lineText.slice(Math.max(0, at - 160), at + 180) : subText).trim().slice(0, 340);
           hits.push({ pkg, file, line: obj.data?.line_number || 0, text, rule });
         }
       }

package/src/security/registry-sig.classify.js

@@ -88,6 +88,7 @@ const BENIGN_URL_HOSTS = [
   "apache.org", "opensource.org", "gnu.org", "creativecommons.org", "choosealicense.com",
   "mozilla.org", "nodejs.org", "npmjs.com", "npmjs.org", "yarnpkg.com", "python.org", "pypi.org",
   "golang.org", "go.dev", "godoc.org", "readthedocs.io", "readthedocs.org", "editorconfig.org",
+  "aka.ms", "example.com", "example.org", "example.net",
 ];
 const DOC_URL_PATH_RE = /\/(docs?|documentation|wiki|issues?|pull|blob|tree|releases|licenses?|rfc\d*|help|manual|guide|spec|schemas?)([/#?.]|$)/i;
 const URL_TOKEN_RE = /https?:\/\/[^\s'"`)\\<>]+/gi;
@@ -109,7 +110,7 @@ export function isBenignUrlContext(text) {
   const s = String(text || "");
   const urls = [...s.matchAll(URL_TOKEN_RE)];
   if (!urls.length) return false;
-  if (COMMENT_MARKER_RE.test(s.slice(Math.max(0, urls[0].index - 80), urls[0].index))) return true;
+  if (COMMENT_MARKER_RE.test(s.slice(0, urls[0].index))) return true;
   return urls.every((m) => {
     const pre = s.slice(Math.max(0, m.index - 80), m.index);
     const post = s.slice(m.index + m[0].length, m.index + m[0].length + 48);