weavatrix 0.2.15 → 0.2.18

package/src/security/installed.js

@@ -7,6 +7,8 @@ import { join, relative } from "node:path";
 import { parseGoMod } from "../analysis/manifests.js";
 import { uniqueBy } from "../util.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { collectJvmRustInstalled } from "./installed-jvm-rust.js";
+import { listRepoFiles, readRepoText } from "../analysis/internal-audit/repo-files.js";
 
 const pep503 = (name) => String(name).toLowerCase().replace(/[-_.]+/g, "-"); // PyPI canonical name
 
@@ -256,5 +258,23 @@ export function collectInstalled(repoPath) {
     if (!vers) merged.push(d);
     else if (!vers.has(d.version)) drift.push({ name: d.name, locked: locked.get(d.name).version, installed: d.version });
   }
-  return { installed: dedupe([...merged, ...py, ...go]), drift };
+  const jvmRust = collectJvmRustInstalled(repoPath);
+  // The earlier fast path covers roots and immediate services. Complete the tracked repository
+  // universe so deeply nested Python/Go services are not silently omitted from advisory coverage.
+  const repositoryFiles = listRepoFiles(repoPath);
+  const allPython = repositoryFiles.flatMap((file) => {
+    const text = readRepoText(boundary, file);
+    if (/(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(file) || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(file)) return parseRequirements(text || "");
+    if (/(^|\/)poetry\.lock$/i.test(file)) return parseTomlLockPackages(text || "", "poetry-lock");
+    if (/(^|\/)uv\.lock$/i.test(file)) return parseTomlLockPackages(text || "", "uv-lock");
+    if (/(^|\/)Pipfile\.lock$/i.test(file)) { try { return parsePipfileLock(JSON.parse(text)); } catch { return []; } }
+    return [];
+  });
+  const allGo = repositoryFiles.flatMap((file) => {
+    const text = readRepoText(boundary, file) || "";
+    if (/(^|\/)go\.sum$/i.test(file)) return parseGoSum(text);
+    if (/(^|\/)go\.mod$/i.test(file)) return parseGoModPackages(text);
+    return [];
+  });
+  return { installed: dedupe([...merged, ...py, ...go, ...allPython, ...allGo, ...jvmRust]), drift };
 }

package/src/security/typosquat.js

@@ -31,7 +31,9 @@ const KNOWN_LEGIT = new Set([
   "markdown-it", "babel-loader", "css-loader", "style-loader", "query-string",
 ]);
 
-const norm = (name) => String(name || "").toLowerCase().replace(/^@[^/]+\//, ""); // drop scope for the compare
+const rawName = (name) => String(name || "").trim().toLowerCase();
+const isScoped = (name) => /^@[^/]+\/.+/.test(name);
+const unscopedTail = (name) => name.replace(/^@[^/]+\//, "");
 
 // Damerau-Levenshtein (optimal string alignment) — includes adjacent transposition.
 export function damerau(a, b) {
@@ -56,12 +58,19 @@ export function damerau(a, b) {
 // Threshold: distance 1 always; distance 2 only for names ≥8 chars (short names collide too easily).
 // Skip: exact popular names, known-legit pairs, names <4 chars.
 export function classifyTyposquat(name) {
-  const raw = String(name || "");
-  const n = norm(raw);
-  if (n.length < 4 || TOP_PACKAGES.has(raw) || TOP_PACKAGES.has(n) || KNOWN_LEGIT.has(raw) || KNOWN_LEGIT.has(n)) return null;
+  const raw = rawName(name);
+  const scoped = isScoped(raw);
+  const tail = unscopedTail(raw);
+  // A package scope is an ownership boundary, not punctuation to discard.
+  // Comparing every scoped basename with unscoped popular names made the
+  // official @playwright/test package look like a one-edit misspelling of jest.
+  if (tail.length < 4 || TOP_PACKAGES.has(raw) || TOP_PACKAGES.has(tail)
+    || KNOWN_LEGIT.has(raw) || KNOWN_LEGIT.has(tail)) return null;
+  const candidates = [...TOP_PACKAGES].filter((top) => isScoped(top) === scoped);
+  const n = scoped ? raw : tail;
   let best = null;
-  for (const top of TOP_PACKAGES) {
-    const t = norm(top);
+  for (const top of candidates) {
+    const t = rawName(top);
     if (t === n) return null; // scope-only difference of a popular name → not a squat
     const dist = damerau(n, t);
     if (dist === 0) return null;

package/src/util.js

@@ -16,6 +16,19 @@ export function uniqueBy(list, keyFn) {
   });
 }
 
+export function lineNumberAt(text, index) {
+  let line = 1;
+  for (let offset = 0; offset < index && offset < text.length; offset++) {
+    if (text[offset] === "\n") line++;
+  }
+  return line;
+}
+
+export function boundedInteger(value, fallback, min, max) {
+  const number = Number(value);
+  return Number.isInteger(number) ? Math.max(min, Math.min(max, number)) : fallback;
+}
+
 export function safeRead(path) {
   try {
     const st = statSync(path);

package/docs/releases/v0.2.15.md

@@ -1,37 +0,0 @@
-# Weavatrix 0.2.15
-
-0.2.15 is a focused self-audit precision release. It keeps the 38-tool MCP surface and all wire and
-security boundaries stable while removing false-positive dependency, dead-code, malware, and
-duplicate findings discovered by running Weavatrix against its own repository.
-
-## Dependency and reachability precision
-
-- Dependency verification now respects the owning nested manifest before deciding whether an import
-  is missing or a declaration is unused.
-- Framework peer dependencies and bounded package paths assembled from static string fragments are
-  recognized without treating arbitrary runtime values as proof.
-- Source-owned HTML asset references participate in reachability, protecting maintained browser
-  scripts and styles from false dead-file findings.
-
-## Safer review queues
-
-- Malware scanning distinguishes placeholders, comments, documentation URLs, and ordinary Unicode
-  text from executable registry/download behavior. Static heuristic evidence remains review-only and
-  does not claim execution or compromise.
-- Duplicate detection suppresses policy-like numeric tables and stable ordered declarations where
-  repeated structure carries meaning, while preserving clone evidence for executable code.
-- Reverse reachability, Git output parsing, ordered-member comparison, path terminology, task
-  retrieval, and duplicate evidence now share focused owners instead of maintaining divergent copies.
-
-## Compatibility and security
-
-- There are no MCP tool-schema, capability-profile, Hosted payload, sync-consent, or architecture
-  contract changes in this release.
-- The default profile remains offline and local-first. Advisory and Hosted network capabilities
-  remain explicit opt-ins.
-
-## Verification
-
-The release is gated by the full Node suite, six-language fixture benchmark, six-repository semantic
-regression gate, release-manifest verification, packed npm and MCPB stdio checks, and npm audit. The
-exact counts and artifacts are recorded by the immutable GitHub release workflow.