weavatrix 0.2.15 → 0.2.16

package/src/precision/typescript-provider/project-safety.js

@@ -57,6 +57,7 @@ export function typeScriptProjectSafety(repoRoot, relFiles = [], options = {}) {
 
     const configRecords = new Map()
     const projectFiles = new Set()
+    const configuredPlugins = new Set()
     const projects = {}
     for (let cursor = 0; cursor < queue.length; cursor++) {
         if (Date.now() >= budget.deadline) return {safe: false, reason: 'SAFETY_DEADLINE', fingerprint: null}
@@ -68,7 +69,9 @@ export function typeScriptProjectSafety(repoRoot, relFiles = [], options = {}) {
         projects[configRel] = {
             projectFiles: parsed.projectFiles,
             configFiles: [...parsed.configRecords.keys()].sort(),
+            configuredPlugins: parsed.plugins,
         }
+        for (const plugin of parsed.plugins || []) configuredPlugins.add(plugin)
         for (const [file, digest] of parsed.configRecords) {
             configRecords.set(file, digest)
             if (configRecords.size > MAX_CONFIG_FILES) {
@@ -133,6 +136,8 @@ export function typeScriptProjectSafety(repoRoot, relFiles = [], options = {}) {
         projectFiles: [...projectFiles].sort(),
         fileConfigs,
         projects,
+        configuredPlugins: [...configuredPlugins].sort(),
+        pluginsSuppressed: configuredPlugins.size,
     }
 }
 

package/src/security/advisory-store.js

@@ -17,7 +17,7 @@ export const DEFAULT_STORE = join(homedir(), ".weavatrix", "advisories.json");
 const OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
 const OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
 const DEFAULT_FETCH_TIMEOUT_MS = Number(process.env.WEAVATRIX_OSV_TIMEOUT_MS || 20000);
-export const OSV_SUPPORTED_ECOSYSTEMS = new Set(["npm", "PyPI", "Go"]);
+export const OSV_SUPPORTED_ECOSYSTEMS = new Set(["npm", "PyPI", "Go", "Maven", "crates.io"]);
 
 const keyOf = (ecosystem, name) => `${ecosystem}|${ecosystem === "PyPI" ? String(name).toLowerCase().replace(/[-_.]+/g, "-") : name}`;
 
@@ -121,7 +121,7 @@ export async function refreshAdvisories({ installed = [], storePath = DEFAULT_ST
       ok: false,
       queried: 0,
       unsupported,
-      error: "No OSV-supported pinned package versions found to check. weavatrix currently queries OSV for npm, PyPI, and Go packages with concrete versions.",
+      error: "No OSV-supported pinned package versions found to check. Weavatrix queries OSV for npm, PyPI, Go, Maven/Gradle, and crates.io packages with concrete versions.",
     };
   }
   const store = loadStore(storePath);

package/src/security/installed-jvm-rust.js

@@ -0,0 +1,46 @@
+import { createRepoBoundary } from "../repo-path.js";
+import { listRepoFiles, readRepoText } from "../analysis/internal-audit/repo-files.js";
+import { parseCargoLockPackages } from "../analysis/cargo-manifests.js";
+import { parseGradleDependencies, parseGradleLockPackages, parseGradleVersionCatalog, parseMavenPom } from "../analysis/jvm-manifests.js";
+
+const dedupe = (items) => {
+  const seen = new Set();
+  return items.filter((item) => {
+    const key = `${item.ecosystem}|${item.name}|${item.version}`;
+    if (!item.name || !item.version || seen.has(key)) return false;
+    seen.add(key); return true;
+  });
+};
+const concreteVersion = (value) => !!value && !/[\[\](),${}*+]/.test(String(value));
+
+export function collectJvmRustInstalled(repoPath) {
+  const boundary = createRepoBoundary(repoPath);
+  if (!boundary.root) return [];
+  const files = listRepoFiles(repoPath);
+  const installed = [];
+  for (const file of files.filter((name) => /(^|\/)Cargo\.lock$/i.test(name))) {
+    installed.push(...parseCargoLockPackages(readRepoText(boundary, file)));
+  }
+  for (const file of files.filter((name) => /(^|\/)pom\.xml$/i.test(name))) {
+    const parsed = parseMavenPom(readRepoText(boundary, file));
+    installed.push(...parsed.dependencies.filter((item) => concreteVersion(item.version)).map((item) => ({
+      ecosystem: "Maven", name: item.name, version: item.version, dev: item.scope === "test",
+      integrity: "", source: "pom",
+    })));
+  }
+  const catalog = new Map();
+  for (const file of files.filter((name) => /(^|\/)libs\.versions\.toml$/i.test(name))) {
+    for (const [alias, entry] of parseGradleVersionCatalog(readRepoText(boundary, file))) catalog.set(alias, entry);
+  }
+  for (const file of files.filter((name) => /(^|\/)(?:build|settings|[^/]+)\.gradle(?:\.kts)?$/i.test(name))) {
+    const dependencies = parseGradleDependencies(readRepoText(boundary, file), catalog);
+    installed.push(...dependencies.filter((item) => concreteVersion(item.version)).map((item) => ({
+      ecosystem: "Maven", name: item.name, version: item.version,
+      dev: /test/i.test(item.scope || ""), integrity: "", source: "gradle-manifest",
+    })));
+  }
+  for (const file of files.filter((name) => /(^|\/)(?:gradle\.lockfile|dependency-locks\/[^/]+\.lockfile)$/i.test(name))) {
+    installed.push(...parseGradleLockPackages(readRepoText(boundary, file)));
+  }
+  return dedupe(installed);
+}

package/src/security/installed.js

@@ -7,6 +7,8 @@ import { join, relative } from "node:path";
 import { parseGoMod } from "../analysis/manifests.js";
 import { uniqueBy } from "../util.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { collectJvmRustInstalled } from "./installed-jvm-rust.js";
+import { listRepoFiles, readRepoText } from "../analysis/internal-audit/repo-files.js";
 
 const pep503 = (name) => String(name).toLowerCase().replace(/[-_.]+/g, "-"); // PyPI canonical name
 
@@ -256,5 +258,23 @@ export function collectInstalled(repoPath) {
     if (!vers) merged.push(d);
     else if (!vers.has(d.version)) drift.push({ name: d.name, locked: locked.get(d.name).version, installed: d.version });
   }
-  return { installed: dedupe([...merged, ...py, ...go]), drift };
+  const jvmRust = collectJvmRustInstalled(repoPath);
+  // The earlier fast path covers roots and immediate services. Complete the tracked repository
+  // universe so deeply nested Python/Go services are not silently omitted from advisory coverage.
+  const repositoryFiles = listRepoFiles(repoPath);
+  const allPython = repositoryFiles.flatMap((file) => {
+    const text = readRepoText(boundary, file);
+    if (/(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(file) || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(file)) return parseRequirements(text || "");
+    if (/(^|\/)poetry\.lock$/i.test(file)) return parseTomlLockPackages(text || "", "poetry-lock");
+    if (/(^|\/)uv\.lock$/i.test(file)) return parseTomlLockPackages(text || "", "uv-lock");
+    if (/(^|\/)Pipfile\.lock$/i.test(file)) { try { return parsePipfileLock(JSON.parse(text)); } catch { return []; } }
+    return [];
+  });
+  const allGo = repositoryFiles.flatMap((file) => {
+    const text = readRepoText(boundary, file) || "";
+    if (/(^|\/)go\.sum$/i.test(file)) return parseGoSum(text);
+    if (/(^|\/)go\.mod$/i.test(file)) return parseGoModPackages(text);
+    return [];
+  });
+  return { installed: dedupe([...merged, ...py, ...go, ...allPython, ...allGo, ...jvmRust]), drift };
 }

package/src/util.js

@@ -16,6 +16,14 @@ export function uniqueBy(list, keyFn) {
   });
 }
 
+export function lineNumberAt(text, index) {
+  let line = 1;
+  for (let offset = 0; offset < index && offset < text.length; offset++) {
+    if (text[offset] === "\n") line++;
+  }
+  return line;
+}
+
 export function safeRead(path) {
   try {
     const st = statSync(path);

package/docs/releases/v0.2.15.md

@@ -1,37 +0,0 @@
-# Weavatrix 0.2.15
-
-0.2.15 is a focused self-audit precision release. It keeps the 38-tool MCP surface and all wire and
-security boundaries stable while removing false-positive dependency, dead-code, malware, and
-duplicate findings discovered by running Weavatrix against its own repository.
-
-## Dependency and reachability precision
-
-- Dependency verification now respects the owning nested manifest before deciding whether an import
-  is missing or a declaration is unused.
-- Framework peer dependencies and bounded package paths assembled from static string fragments are
-  recognized without treating arbitrary runtime values as proof.
-- Source-owned HTML asset references participate in reachability, protecting maintained browser
-  scripts and styles from false dead-file findings.
-
-## Safer review queues
-
-- Malware scanning distinguishes placeholders, comments, documentation URLs, and ordinary Unicode
-  text from executable registry/download behavior. Static heuristic evidence remains review-only and
-  does not claim execution or compromise.
-- Duplicate detection suppresses policy-like numeric tables and stable ordered declarations where
-  repeated structure carries meaning, while preserving clone evidence for executable code.
-- Reverse reachability, Git output parsing, ordered-member comparison, path terminology, task
-  retrieval, and duplicate evidence now share focused owners instead of maintaining divergent copies.
-
-## Compatibility and security
-
-- There are no MCP tool-schema, capability-profile, Hosted payload, sync-consent, or architecture
-  contract changes in this release.
-- The default profile remains offline and local-first. Advisory and Hosted network capabilities
-  remain explicit opt-ins.
-
-## Verification
-
-The release is gated by the full Node suite, six-language fixture benchmark, six-repository semantic
-regression gate, release-manifest verification, packed npm and MCPB stdio checks, and npm audit. The
-exact counts and artifacts are recorded by the immutable GitHub release workflow.