weavatrix 0.2.5 → 0.2.7

package/src/analysis/allowed-test-runner.js

@@ -0,0 +1,59 @@
+import {existsSync, readFileSync} from 'node:fs'
+import {join} from 'node:path'
+import {createRepoBoundary} from '../repo-path.js'
+import {runCommand} from '../process.js'
+
+const SAFE_SCRIPT = /^(?:test(?::|$)|(?:check|verify)(?::|$)|[^:]+:(?:test|check|verify)(?::|$))/i
+const UNSAFE_SHELL_ARG = /[\0\r\n&|<>^%!`\"]/
+const tail = (value, limit = 8000) => String(value || '').slice(-limit)
+
+function manifestAt(repoRoot) {
+  const resolved = createRepoBoundary(repoRoot).resolve('package.json')
+  if (!resolved.ok) return null
+  try { return JSON.parse(readFileSync(resolved.path, 'utf8')) } catch { return null }
+}
+
+function packageManager(repoRoot) {
+  if (existsSync(join(repoRoot, 'pnpm-lock.yaml'))) return 'pnpm'
+  if (existsSync(join(repoRoot, 'yarn.lock'))) return 'yarn'
+  return 'npm'
+}
+
+export function validateTestRequests(repoRoot, requests = []) {
+  const manifest = manifestAt(repoRoot)
+  if (!manifest) return {ok: false, reason: 'package.json is missing or unreadable', tests: []}
+  const tests = []
+  for (const request of requests.slice(0, 5)) {
+    const script = String(request?.script || '')
+    const args = Array.isArray(request?.args) ? request.args.slice(0, 40).map(String) : []
+    if (!SAFE_SCRIPT.test(script)) return {ok: false, reason: `script ${script || '(missing)'} is outside the test/check/verify allowlist`, tests}
+    if (!Object.hasOwn(manifest.scripts || {}, script)) return {ok: false, reason: `package.json has no script named ${script}`, tests}
+    if (args.some((arg) => arg.length > 300 || UNSAFE_SHELL_ARG.test(arg))) return {ok: false, reason: `script ${script} has an invalid or shell-sensitive argument`, tests}
+    tests.push({script, args})
+  }
+  return {ok: true, tests, packageManager: packageManager(repoRoot)}
+}
+
+export async function runAllowedTests(repoRoot, requests = [], {enabled = false, timeoutMs = 60_000} = {}) {
+  const checked = validateTestRequests(repoRoot, requests)
+  if (!checked.ok) return {state: 'BLOCKED', reason: checked.reason, results: []}
+  if (!checked.tests.length) return {state: 'NOT_REQUESTED', reason: 'no package scripts were requested', results: []}
+  if (!enabled || process.env.WEAVATRIX_ALLOW_TEST_RUNS !== '1') return {
+    state: 'DISABLED', reason: 'set WEAVATRIX_ALLOW_TEST_RUNS=1 and pass run_tests:true to execute allowlisted package scripts',
+    plan: checked.tests, results: [],
+  }
+  const results = []
+  const timeout = Math.max(1000, Math.min(300_000, Number(timeoutMs) || 60_000))
+  for (const test of checked.tests) {
+    const start = Date.now()
+    const separator = checked.packageManager === 'yarn' ? [] : ['--']
+    try {
+      const run = await runCommand(checked.packageManager, ['run', test.script, ...separator, ...test.args], {cwd: repoRoot, timeoutMs: timeout})
+      results.push({script: test.script, status: run.exitCode === 0 ? 'PASS' : 'FAIL', exitCode: run.exitCode, durationMs: Date.now() - start, stdoutTail: tail(run.stdout), stderrTail: tail(run.stderr)})
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error)
+      results.push({script: test.script, status: /timed out/i.test(message) ? 'TIMEOUT' : 'FAIL', exitCode: null, durationMs: Date.now() - start, stdoutTail: '', stderrTail: tail(message)})
+    }
+  }
+  return {state: results.every((result) => result.status === 'PASS') ? 'PASS' : 'FAIL', packageManager: checked.packageManager, results}
+}

package/src/analysis/data-flow-evidence.js

@@ -0,0 +1,114 @@
+import {readFileSync} from 'node:fs'
+import {extname} from 'node:path'
+import ts from 'typescript'
+import {createRepoBoundary} from '../repo-path.js'
+
+const lineOfNode = (node) => Number(String(node?.source_location || '').match(/^L(\d+)/i)?.[1] || String(node?.id || '').match(/@(\d+)$/)?.[1] || 0)
+const fileOfNode = (node) => String(node?.source_file || String(node?.id || '').split('#')[0]).replace(/\\/g, '/')
+const cleanName = (value) => String(value || '').replace(/\(\)$/, '').split('.').pop()
+const callName = (node) => node.expression?.name?.text || node.expression?.text || node.expression?.escapedText || ''
+
+function scriptKind(file) {
+  const ext = extname(file).toLowerCase()
+  if (ext === '.tsx') return ts.ScriptKind.TSX
+  if (ext === '.jsx') return ts.ScriptKind.JSX
+  if (ext === '.ts' || ext === '.mts' || ext === '.cts') return ts.ScriptKind.TS
+  return ts.ScriptKind.JS
+}
+
+function parse(cache, boundary, file) {
+  if (cache.has(file)) return cache.get(file)
+  if (!/\.[cm]?[jt]sx?$/i.test(file)) return null
+  const resolved = boundary.resolve(file)
+  if (!resolved.ok) return null
+  try {
+    const source = ts.createSourceFile(file, readFileSync(resolved.path, 'utf8'), ts.ScriptTarget.Latest, true, scriptKind(file))
+    cache.set(file, source)
+    return source
+  } catch { return null }
+}
+
+function parametersFor(source, target) {
+  const expected = cleanName(target?.label)
+  const expectedLine = lineOfNode(target)
+  const choices = []
+  const visit = (node) => {
+    if (Array.isArray(node.parameters) && node.name) {
+      const name = cleanName(node.name.text || node.name.getText?.(source))
+      if (!expected || name === expected) {
+        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
+        choices.push({line, parameters: node.parameters.map((item) => item.name.getText(source).slice(0, 80))})
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(source)
+  choices.sort((a, b) => Math.abs(a.line - expectedLine) - Math.abs(b.line - expectedLine))
+  return choices[0]?.parameters || []
+}
+
+function callsAt(source, line, expectedName) {
+  const found = []
+  const visit = (node) => {
+    if (ts.isCallExpression(node)) {
+      const at = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
+      if ((!line || at === line) && (!expectedName || cleanName(callName(node)) === expectedName)) found.push({node, line: at})
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(source)
+  return found
+}
+
+// Bounded interprocedural evidence: maps arguments at graph callsites to the callee's declared
+// parameters. This is not a control-flow graph, value propagation, or taint-analysis claim.
+export function extractCallArgumentEvidence({graph, repoRoot, seedIds = [], depth = 2, maxEdges = 40} = {}) {
+  const boundary = createRepoBoundary(repoRoot)
+  const cache = new Map()
+  const queue = (seedIds || []).map((id) => ({id: String(id), hop: 0}))
+  const visited = new Set()
+  const seenCalls = new Set()
+  const edges = []
+  let unsupported = 0
+  while (queue.length && edges.length < maxEdges) {
+    const current = queue.shift()
+    if (visited.has(current.id) || current.hop >= depth) continue
+    visited.add(current.id)
+    const calls = [
+      ...(graph.out.get(current.id) || []).filter((edge) => edge.relation === 'calls')
+        .map((edge) => ({fromId: current.id, toId: String(edge.id), line: Number(edge.line) || 0, nextId: String(edge.id)})),
+      ...(graph.inn.get(current.id) || []).filter((edge) => edge.relation === 'calls')
+        .map((edge) => ({fromId: String(edge.id), toId: current.id, line: Number(edge.line) || 0, nextId: String(edge.id)})),
+    ]
+    for (const callEdge of calls) {
+      const callKey = `${callEdge.fromId}\0${callEdge.toId}\0${callEdge.line}`
+      if (seenCalls.has(callKey)) continue
+      seenCalls.add(callKey)
+      const from = graph.byId.get(callEdge.fromId)
+      const to = graph.byId.get(callEdge.toId)
+      const callerSource = parse(cache, boundary, fileOfNode(from))
+      const targetSource = parse(cache, boundary, fileOfNode(to))
+      if (!from || !to || !callerSource || !targetSource) { unsupported++; continue }
+      const params = parametersFor(targetSource, to)
+      const callsites = callsAt(callerSource, callEdge.line, cleanName(to.label))
+      if (!callsites.length) { unsupported++; continue }
+      for (const call of callsites.slice(0, 3)) {
+        edges.push({
+          from: callEdge.fromId, to: callEdge.toId, hop: current.hop + 1,
+          file: fileOfNode(from), line: call.line,
+          arguments: call.node.arguments.slice(0, 12).map((argument, index) => ({
+            index, expression: argument.getText(callerSource).slice(0, 160), parameter: params[index] || null,
+          })),
+          state: 'EXTRACTED',
+        })
+        if (edges.length >= maxEdges) break
+      }
+      if (current.hop + 1 < depth) queue.push({id: callEdge.nextId, hop: current.hop + 1})
+    }
+  }
+  return {
+    model: 'bounded call-argument-to-parameter evidence (not CFG or taint analysis)',
+    status: edges.length ? (unsupported ? 'PARTIAL' : 'COMPLETE') : 'UNAVAILABLE',
+    edges, unsupportedEdges: unsupported, capped: edges.length >= maxEdges,
+  }
+}

package/src/analysis/dead-code-review.js

@@ -84,6 +84,18 @@ function symbolCandidate(item, node, context) {
     caveats.push("Reflection is present and may invoke names without a resolvable static edge.");
   }
 
+  const evidenceTier = confidence === "high" && exactNoReference
+    ? "STRONG_STATIC_EVIDENCE"
+    : confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE";
+  const remainingChecks = [
+    ...(!exactNoReference ? ["Run an exact language-server reference query for this declaration."] : []),
+    ...(publicSurface ? ["Check downstream/external consumers of the public API."] : []),
+    ...(externalEntry || framework ? ["Inspect framework registration and externally entered call paths."] : []),
+    ...(dynamicFile ? ["Resolve dynamic import/require targets and name-based dispatch."] : []),
+    ...(reflectionFile || (publicSurface && context.repoSignals.reflection) ? ["Inspect reflection/annotation/configuration consumers."] : []),
+    "Run targeted tests after any removal.",
+  ];
+
   return {
     id: String(item.id),
     kind,
@@ -95,6 +107,8 @@ function symbolCandidate(item, node, context) {
     symbolKind: node?.symbol_kind || null,
     visibility: node?.visibility || (node?.exported ? "exported" : "internal"),
     confidence,
+    evidenceTier,
+    actionability: evidenceTier === "STRONG_STATIC_EVIDENCE" ? "PRIORITY_MANUAL_REVIEW" : "MANUAL_REVIEW",
     reason: item.reason,
     evidence: [
       ...(testOnly ? [{kind: item.evidence || "graph", fact: `Only test/e2e consumers were found${item.testConsumerFiles?.length ? `: ${item.testConsumerFiles.join(", ")}` : "."}`}]
@@ -106,6 +120,18 @@ function symbolCandidate(item, node, context) {
     externallyEnteredFile: externalEntry,
     pathClasses: pathInfo.classes || [],
     matchedPathRule: pathInfo.matchedRule || null,
+    verification: {
+      graphInboundRuntimeEdge: "NOT_FOUND",
+      indexedSecondOccurrence: testOnly ? "TEST_ONLY" : "NOT_FOUND",
+      exactLanguageServerReferences: exactNoReference ? "ZERO_CONFIRMED" : "NOT_CHECKED_OR_INCOMPLETE",
+      recognizedEntryPoint: externalEntry ? "FOUND" : "NOT_FOUND",
+      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED_IN_DECLARING_FILE",
+      reflectionRisk: reflectionFile || (publicSurface && context.repoSignals.reflection) ? "PRESENT" : "NOT_OBSERVED",
+      publicApi: publicSurface ? "YES" : "NO",
+      decision: "MANUAL_REVIEW_REQUIRED",
+    },
+    remainingChecks,
+    autoDelete: false,
     reviewAction: testOnly
       ? "Confirm that no production/config/framework consumer exists; decide whether the declaration is intentional test support or removable with its tests. Never auto-delete."
       : "Confirm with read_source, get_dependents, exact search, framework/config inspection and tests; never auto-delete.",
@@ -135,6 +161,13 @@ function fileCandidate(item, symbols, context) {
     confidence = "low";
     caveats.push("Reflection is present in this file.");
   }
+  const remainingChecks = [
+    "Inspect package scripts, manifests, framework/plugin discovery and deployment configuration.",
+    "Check external launchers and consumers outside the indexed repository.",
+    ...(dynamicFile ? ["Resolve dynamic import/require targets."] : []),
+    ...(reflectionFile ? ["Inspect reflection/name-based consumers."] : []),
+    "Run targeted tests after any removal.",
+  ];
   return {
     id: `file:${file}`,
     kind: "file",
@@ -146,6 +179,8 @@ function fileCandidate(item, symbols, context) {
     symbolKind: null,
     visibility: null,
     confidence,
+    evidenceTier: confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE",
+    actionability: "MANUAL_REVIEW",
     reason: item.reason,
     evidence: [
       { kind: "graph", fact: "No indexed module imports this file." },
@@ -156,6 +191,17 @@ function fileCandidate(item, symbols, context) {
     externallyEnteredFile: false,
     pathClasses: pathInfo.classes || [],
     matchedPathRule: pathInfo.matchedRule || null,
+    verification: {
+      graphInboundModuleEdge: "NOT_FOUND",
+      indexedSymbolsReferenced: "NONE",
+      recognizedEntryPoint: "NOT_FOUND",
+      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED",
+      reflectionRisk: reflectionFile ? "PRESENT" : "NOT_OBSERVED",
+      externalConsumerCheck: "NOT_POSSIBLE_FROM_REPOSITORY_GRAPH",
+      decision: "MANUAL_REVIEW_REQUIRED",
+    },
+    remainingChecks,
+    autoDelete: false,
     reviewAction: "Verify package scripts, manifests, framework discovery, dynamic loading and external consumers; never auto-delete.",
   };
 }
@@ -247,6 +293,11 @@ export function computeDeadCodeReview(graph, sources, options = {}) {
         medium: candidates.filter((candidate) => candidate.confidence === "medium").length,
         low: candidates.filter((candidate) => candidate.confidence === "low").length,
       },
+      byEvidenceTier: {
+        strongStatic: candidates.filter((candidate) => candidate.evidenceTier === "STRONG_STATIC_EVIDENCE").length,
+        boundedStatic: candidates.filter((candidate) => candidate.evidenceTier === "BOUNDED_STATIC_EVIDENCE").length,
+        highUncertainty: candidates.filter((candidate) => candidate.evidenceTier === "HIGH_UNCERTAINTY").length,
+      },
     },
     policy: {
       verdict: "REVIEW_REQUIRED",

package/src/analysis/dep-check.js

@@ -167,11 +167,24 @@ export function computeDepFindings({
         severity: dev ? "info" : "low",
         confidence: dev || ecosystem ? "low" : "medium",
         title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,
-        reason: "No recorded package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
-        detail: `"${name}" is declared in ${section} but never imported in source, never referenced by a script, and not mentioned in any known config file. Dynamic/config-convention usage can't be fully ruled out — review before removing.`,
+        reason: "No indexed package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
+        detail: `"${name}" is declared in ${section}, but no usage was found in the indexed source scope, package scripts, or ${configTexts.size} known config file(s). Dynamic/plugin/config-convention usage is not proven absent — review before removing.`,
         package: name,
         source: "internal",
-        fixHint: `npm uninstall ${name} (after confirming no config/CLI usage)`,
+        actionability: "MANIFEST_REVIEW_REQUIRED",
+        autoRemove: false,
+        verification: {
+          evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+          manifestDeclaration: { status: "FOUND", file: manifest, section, version: String(deps[name] || "") },
+          indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0 },
+          packageScripts: { status: "CHECKED", matched: false },
+          knownConfigs: { status: "CHECKED", filesScanned: configTexts.size, matched: false },
+          frameworkPeerContract: "NOT_FOUND",
+          implicitCompilerInput: "NOT_FOUND",
+          dynamicOrPluginUsage: "NOT_PROVEN_ABSENT",
+          decision: "REVIEW_REQUIRED",
+        },
+        fixHint: `Review manifest/config/plugin usage; if confirmed unused, remove ${name} with the package manager and run targeted tests`,
         ...meta,
       }));
     }
@@ -202,6 +215,25 @@ export function computeDepFindings({
       line: use.lines.get(files[0]) || 0,
       evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),
       source: "internal",
+      actionability: "STRONG_MANIFEST_MISMATCH",
+      autoInstall: false,
+      verification: {
+        evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+        manifestDeclaration: { status: "NOT_FOUND", file: manifest, checkedSections: Object.keys(sections) },
+        indexedSourceImports: {
+          status: "FOUND",
+          completeness: "COMPLETE_FOR_GRAPH_SCOPE",
+          count: files.length,
+          files: files.slice(0, 20),
+          truncated: files.length > 20,
+          typeOnly: use.typeOnly,
+          stylesheetOnly,
+          testOnly,
+        },
+        packageScope: meta.scope,
+        transitiveResolutionRisk: "PRESENT",
+        decision: "DECLARE_AFTER_SCOPE_REVIEW",
+      },
       fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,
       ...meta,
     }));
@@ -223,6 +255,13 @@ export function computeDepFindings({
       detail: `"${name}" is declared in ${ss.join(" + ")} — npm resolves one of them; keep a single section.`,
       package: name,
       source: "internal",
+      actionability: "MANIFEST_REVIEW_REQUIRED",
+      autoRemove: false,
+      verification: {
+        evidenceModel: "MANIFEST_ONLY",
+        manifestDeclaration: { status: "DUPLICATE", file: manifest, sections: ss },
+        decision: "REVIEW_REQUIRED",
+      },
       ...meta,
     }));
   }

package/src/analysis/duplicate-groups.js

@@ -0,0 +1,84 @@
+import {createHash} from 'node:crypto'
+import {writeFileSync} from 'node:fs'
+import {join} from 'node:path'
+import {computeDuplicates} from './duplicates.js'
+import {withGitRefCheckout} from './git-ref-graph.js'
+import {buildInternalGraph} from '../graph/internal-builder.js'
+import {filterGraphForMode} from '../graph/graph-filter.js'
+
+const NON_PRODUCT = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const eligible = (fragment, settings) => {
+  const classes = new Set(fragment.classes || [])
+  if (fragment.n < settings.tokMin) return false
+  if (settings.skipTests && (fragment.test || classes.has('test') || classes.has('e2e'))) return false
+  return settings.includeClassified || !(fragment.excluded || [...classes].some((name) => NON_PRODUCT.has(name)))
+}
+
+function groupPairs(data, settings) {
+  const fragments = data.frags || []
+  const pairs = (data.modes?.[settings.mode] || []).filter(([a, b, similarity]) => similarity >= settings.simMin && eligible(fragments[a], settings) && eligible(fragments[b], settings))
+  const parent = new Map()
+  const find = (value) => { let root = value; while (parent.get(root) !== root) root = parent.get(root); return root }
+  for (const [a, b] of pairs) {
+    if (!parent.has(a)) parent.set(a, a)
+    if (!parent.has(b)) parent.set(b, b)
+    parent.set(find(a), find(b))
+  }
+  const groups = new Map()
+  for (const [a, b, similarity] of pairs) {
+    const root = find(a)
+    if (!groups.has(root)) groups.set(root, {members: new Set(), maxSim: 0})
+    const group = groups.get(root)
+    group.members.add(a); group.members.add(b); group.maxSim = Math.max(group.maxSim, similarity)
+  }
+  return [...groups.values()].map((group) => {
+    const members = [...group.members].map((index) => fragments[index]).sort((a, b) => b.n - a.n)
+    return {members, maxSim: group.maxSim, tokens: members.reduce((sum, item) => sum + item.n, 0)}
+  }).sort((a, b) => b.tokens - a.tokens)
+}
+
+export function analyzeDuplicateGroups(repoRoot, graphPath, args = {}) {
+  const settings = {
+    simMin: Math.min(100, Math.max(50, Number(args.min_similarity) || 80)),
+    tokMin: Math.min(400, Math.max(12, Number(args.min_tokens) || 50)),
+    mode: args.mode === 'strict' ? 'strict' : 'renamed',
+    skipTests: args.include_tests !== true,
+    includeClassified: args.include_classified === true || args.include_non_product === true,
+  }
+  const data = computeDuplicates(repoRoot, graphPath, {includeStrings: args.include_strings === true, minTokens: settings.tokMin})
+  const groups = groupPairs(data, settings)
+  const suppressed = (data.frags || []).filter((fragment) => !eligible(fragment, settings)).length
+  return {settings, groups, suppressed}
+}
+
+const digest = (value) => createHash('sha256').update(value).digest('hex').slice(0, 20)
+function groupKey(group, mode) {
+  const members = group.members.map((fragment) => {
+    const fingerprints = Array.isArray(fragment.fp?.[mode]) ? [...fragment.fp[mode]].sort() : []
+    return `${String(fragment.file).replace(/\\/g, '/')}\0${fragment.label || ''}\0${digest(JSON.stringify(fingerprints))}`
+  }).sort()
+  return digest(members.join('\n'))
+}
+
+export async function compareDuplicateGroups({repoRoot, graphPath, currentGraph, baseRef, changedFiles = [], args = {}}) {
+  const current = analyzeDuplicateGroups(repoRoot, graphPath, args)
+  const mode = ['full', 'no-tests', 'tests-only'].includes(currentGraph?.graphBuildMode) ? currentGraph.graphBuildMode : 'full'
+  const baseline = await withGitRefCheckout(repoRoot, baseRef, async (checkout) => {
+    let graph = await buildInternalGraph(checkout)
+    if (mode !== 'full') graph = filterGraphForMode(graph, mode, {repoRoot: checkout})
+    graph.graphBuildMode = mode
+    const baselineGraphPath = join(checkout, '.weavatrix-verified-graph.json')
+    writeFileSync(baselineGraphPath, JSON.stringify(graph))
+    return analyzeDuplicateGroups(checkout, baselineGraphPath, args)
+  })
+  if (!baseline.ok) return {state: 'UNKNOWN', reason: baseline.error, currentGroups: current.groups.length}
+  const baselineKeys = new Set(baseline.value.groups.map((group) => groupKey(group, current.settings.mode)))
+  const changed = new Set(changedFiles.map((file) => String(file).replace(/\\/g, '/')))
+  const added = current.groups.filter((group) => !baselineKeys.has(groupKey(group, current.settings.mode)))
+  const scoped = added.filter((group) => group.members.some((member) => changed.has(String(member.file).replace(/\\/g, '/'))))
+  return {
+    state: scoped.length ? 'BLOCKED' : 'PASS', baseline: {ref: baseline.ref, commit: baseline.commit},
+    currentGroups: current.groups.length, baselineGroups: baseline.value.groups.length, newGroups: added.length,
+    scopedNewGroups: scoped.slice(0, 20).map((group) => ({similarity: group.maxSim, tokens: group.tokens, members: group.members.slice(0, 8).map((item) => ({file: item.file, start: item.start, end: item.end, label: item.label}))})),
+  }
+}

package/src/analysis/graph-analysis.aggregate.js

@@ -63,7 +63,9 @@ export function aggregateGraph(graph, repoRoot) {
         line: String(node.source_location || "").replace(/^L/, ""),
         endLine: String(node.source_end || "").replace(/^L/, ""),
         ...(node.complexity ? { complexity: node.complexity } : {}),
-        ...(node.decorated ? { decorated: true } : {})
+        ...(node.decorated ? { decorated: true } : {}),
+        ...(node.symbol_kind ? {symbolKind: node.symbol_kind} : {}),
+        ...(node.symbol_space ? {symbolSpace: node.symbol_space} : {})
       });
       fileSymbols.set(fid, list);
     }

package/src/analysis/graph-analysis.refs.js

@@ -63,7 +63,7 @@ function importCandidates(fromFile, spec) {
 function stripModuleStatements(text) {
   return String(text || "")
     .replace(/\bimport\s+[\s\S]*?\s+from\s*['"][^'"]+['"]\s*;?/g, "")
-    .replace(/\bexport\s+\{[\s\S]*?\}\s+from\s*['"][^'"]+['"]\s*;?/g, "")
+    .replace(/\bexport\s+(?:type\s+)?\{[\s\S]*?\}\s+from\s*['"][^'"]+['"]\s*;?/g, "")
     .replace(/\b(?:const|let|var)\s+\{[\s\S]*?\}\s*=\s*require\(\s*['"][^'"]+['"]\s*\)\s*;?/g, "");
 }
 
@@ -73,8 +73,10 @@ function parseNamedSpecifiers(raw) {
     .map((part) => part.trim())
     .filter(Boolean)
     .map((part) => {
-      const m = part.match(/^([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
-      return m ? { imported: m[1], local: m[2] || m[1] } : null;
+      const typeOnly = /^type\s+/.test(part);
+      const clean = part.replace(/^type\s+/, "").trim();
+      const m = clean.match(/^([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
+      return m ? { imported: m[1], local: m[2] || m[1], typeOnly } : null;
     })
     .filter(Boolean);
 }
@@ -93,17 +95,20 @@ export function computeSymbolExternalRefs(filePath, fileSymbols, fileText) {
       const name = bareSymbolName(sym.label);
       if (!isIdentifierName(name)) continue;
       const ids = byName.get(name) || [];
-      ids.push(sym.id);
+      ids.push({id: sym.id, space: sym.symbolSpace || "value"});
       byName.set(name, ids);
     }
     symbolIdsByFileAndName.set(fid, byName);
   }
 
   const symbolExternalRefs = new Map();
-  const addExternalRefs = (targetFid, importedName, refs) => {
+  const addExternalRefs = (targetFid, importedName, refs, typeOnly = false) => {
     if (!targetFid || refs <= 0 || !isIdentifierName(importedName)) return;
     const ids = symbolIdsByFileAndName.get(targetFid)?.get(importedName) || [];
-    for (const id of ids) symbolExternalRefs.set(id, (symbolExternalRefs.get(id) || 0) + refs);
+    for (const entry of ids) {
+      const matches = entry.space === "both" || (typeOnly ? entry.space === "type" : entry.space !== "type");
+      if (matches) symbolExternalRefs.set(entry.id, (symbolExternalRefs.get(entry.id) || 0) + refs);
+    }
   };
   const resolveImportedFid = (fromPath, spec) => {
     for (const candidate of importCandidates(fromPath, spec)) {
@@ -123,18 +128,21 @@ export function computeSymbolExternalRefs(filePath, fileSymbols, fileText) {
       if (!targetFid) continue;
       const named = String(m[1] || "").match(/\{([\s\S]*?)\}/);
       if (named) {
-        for (const spec of parseNamedSpecifiers(named[1])) addExternalRefs(targetFid, spec.imported, countIdentifierInText(scrubbed, spec.local));
+        const statementTypeOnly = /^\s*type\b/.test(String(m[1] || ""));
+        for (const spec of parseNamedSpecifiers(named[1])) addExternalRefs(targetFid, spec.imported, countIdentifierInText(scrubbed, spec.local), statementTypeOnly || spec.typeOnly);
       }
       const ns = String(m[1] || "").match(/\*\s+as\s+([A-Za-z_$][\w$]*)/);
       if (ns) {
         const byName = symbolIdsByFileAndName.get(targetFid) || new Map();
-        for (const name of byName.keys()) addExternalRefs(targetFid, name, countMemberAccess(scrubbed, ns[1], name));
+        const statementTypeOnly = /^\s*type\b/.test(String(m[1] || ""));
+        for (const name of byName.keys()) addExternalRefs(targetFid, name, countMemberAccess(scrubbed, ns[1], name), statementTypeOnly);
       }
     }
-    for (const m of String(txt).matchAll(/\bexport\s+\{([\s\S]*?)\}\s+from\s*['"]([^'"]+)['"]\s*;?/g)) {
-      const targetFid = resolveImportedFid(importerPath, m[2]);
+    for (const m of String(txt).matchAll(/\bexport\s+(type\s+)?\{([\s\S]*?)\}\s+from\s*['"]([^'"]+)['"]\s*;?/g)) {
+      const targetFid = resolveImportedFid(importerPath, m[3]);
       if (!targetFid) continue;
-      for (const spec of parseNamedSpecifiers(m[1])) addExternalRefs(targetFid, spec.imported, 1);
+      const statementTypeOnly = Boolean(m[1]);
+      for (const spec of parseNamedSpecifiers(m[2])) addExternalRefs(targetFid, spec.imported, 1, statementTypeOnly || spec.typeOnly);
     }
     for (const m of String(txt).matchAll(/\b(?:const|let|var)\s+\{([\s\S]*?)\}\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)\s*;?/g)) {
       const targetFid = resolveImportedFid(importerPath, m[2]);

package/src/analysis/hot-path-review.js

@@ -109,8 +109,9 @@ export function computeHotPathReview(graph, options = {}) {
         calls: boundedInt(options.callThreshold, 12, 1, 10000),
         loopDepth: boundedInt(options.loopDepthThreshold, 2, 1, 10),
         timeRank: boundedInt(options.timeRankThreshold, 2, 0, 5),
-        minScore: boundedInt(options.minScore, 0, 0, 100),
+        minScore: boundedInt(options.minScore, 85, 0, 100),
     }
+    const defaultFocus = options.minScore == null
     const topN = boundedInt(options.topN, 20, 1, 100)
     const classifier = createPathClassifier(options.repoRoot || null)
     const knownFiles = [...new Set((graph?.nodes || []).map((node) => normalize(node?.source_file)).filter(Boolean))]
@@ -152,8 +153,19 @@ export function computeHotPathReview(graph, options = {}) {
         const nearest = staticByFile.get(file)?.nearestTests?.[0] || null
         const coverageRisk = actualCoverage == null ? 0 : (1 - actualCoverage) * 100
         const score = round(clamp(syntaxScore * 0.72 + graphScore * 0.2 + coverageRisk * 0.08))
-        if (score < thresholds.minScore) continue
         const directHotEvidence = Array.isArray(complexity.hotEvidence) ? complexity.hotEvidence.slice(0, 12) : []
+        // The default queue is intentionally narrow. A small, locally expensive function can still be
+        // important even with little graph fan-in, so retain only a bounded strong-local fallback. An
+        // explicit minScore disables this fallback and gives the caller a strict numeric gate.
+        const bodyLines = startLine > 0 && endLine >= startLine ? endLine - startLine + 1 : Number.POSITIVE_INFINITY
+        const strongLocalEvidence = defaultFocus && directHotEvidence.length > 0 && bodyLines <= 80 && (
+            Number(complexity.recursionInLoops || 0) > 0
+            || (bodyLines <= 40 && (
+                Number(complexity.sortsInLoops || 0) > 0
+                || (Number(complexity.timeRank || 0) >= 4 && Number(complexity.maxLoopDepth || 0) >= 2)
+            ))
+        )
+        if (score < thresholds.minScore && !strongLocalEvidence) continue
         const confidence = directHotEvidence.length ? 'HIGH' : complexity.recursion ? 'LOW' : 'MEDIUM'
         candidates.push({
             id: String(node.id),
@@ -164,6 +176,7 @@ export function computeHotPathReview(graph, options = {}) {
             endLine,
             classification: entry.classification,
             score,
+            selection: score >= thresholds.minScore ? 'SCORE_THRESHOLD' : 'STRONG_LOCAL_EVIDENCE',
             confidence,
             localSyntax: {
                 score: syntaxScore,
@@ -207,6 +220,11 @@ export function computeHotPathReview(graph, options = {}) {
             includeClassified: options.includeClassified === true,
         },
         thresholds,
+        selectionPolicy: {
+            mode: defaultFocus ? 'FOCUSED_DEFAULT' : 'EXPLICIT_SCORE_THRESHOLD',
+            strongLocalFallback: defaultFocus,
+            broadenWith: 'Set min_score lower (0 restores the full diagnostic candidate set).',
+        },
         analyzedSymbols: eligible.length,
         candidateSymbols: candidates.length,
         coverage: measuredCoverage.size

package/src/analysis/internal-audit.run.js

@@ -300,15 +300,20 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
     findings: sorted,
     dependencyReport: {
       status: dependencyStatus,
+      evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+      perFindingVerification: true,
+      verificationCoverage: { npm: "COMPLETE_FOR_GRAPH_SCOPE", go: "SUMMARY_ONLY", python: "SUMMARY_ONLY" },
       declared: dep.declared.size + goDep.declared.size + pyDep.declared.size,
       importedPackages: importedPackages.size,
       importRecords: externalImports.length,
       unused: dependencyFindings.filter((finding) => finding.rule === "unused-dep").length,
       missing: dependencyFindings.filter((finding) => finding.rule === "missing-dep").length,
       duplicateDeclarations: dependencyFindings.filter((finding) => finding.rule === "duplicate-dep").length,
+      unusedRequiringReview: dependencyFindings.filter((finding) => finding.rule === "unused-dep" && finding.verification?.decision === "REVIEW_REQUIRED").length,
+      missingWithSourceEvidence: dependencyFindings.filter((finding) => finding.rule === "missing-dep" && finding.verification?.indexedSourceImports?.status === "FOUND").length,
       packageScopes: packageScopes.length,
       reason: dependencyStatus === "COMPLETE"
-        ? "All discovered dependency manifests were compared with the complete indexed import set."
+        ? "All discovered dependency manifests were compared with the complete indexed import set; every npm unused/missing/duplicate finding carries manifest and source/config verification state."
         : "The dependency result is scoped to a partial graph and is not a repository-wide clean bill.",
     },
     deadReport: {