weavatrix 0.2.6 → 0.2.7

package/src/analysis/data-flow-evidence.js

@@ -0,0 +1,114 @@
+import {readFileSync} from 'node:fs'
+import {extname} from 'node:path'
+import ts from 'typescript'
+import {createRepoBoundary} from '../repo-path.js'
+
+const lineOfNode = (node) => Number(String(node?.source_location || '').match(/^L(\d+)/i)?.[1] || String(node?.id || '').match(/@(\d+)$/)?.[1] || 0)
+const fileOfNode = (node) => String(node?.source_file || String(node?.id || '').split('#')[0]).replace(/\\/g, '/')
+const cleanName = (value) => String(value || '').replace(/\(\)$/, '').split('.').pop()
+const callName = (node) => node.expression?.name?.text || node.expression?.text || node.expression?.escapedText || ''
+
+function scriptKind(file) {
+  const ext = extname(file).toLowerCase()
+  if (ext === '.tsx') return ts.ScriptKind.TSX
+  if (ext === '.jsx') return ts.ScriptKind.JSX
+  if (ext === '.ts' || ext === '.mts' || ext === '.cts') return ts.ScriptKind.TS
+  return ts.ScriptKind.JS
+}
+
+function parse(cache, boundary, file) {
+  if (cache.has(file)) return cache.get(file)
+  if (!/\.[cm]?[jt]sx?$/i.test(file)) return null
+  const resolved = boundary.resolve(file)
+  if (!resolved.ok) return null
+  try {
+    const source = ts.createSourceFile(file, readFileSync(resolved.path, 'utf8'), ts.ScriptTarget.Latest, true, scriptKind(file))
+    cache.set(file, source)
+    return source
+  } catch { return null }
+}
+
+function parametersFor(source, target) {
+  const expected = cleanName(target?.label)
+  const expectedLine = lineOfNode(target)
+  const choices = []
+  const visit = (node) => {
+    if (Array.isArray(node.parameters) && node.name) {
+      const name = cleanName(node.name.text || node.name.getText?.(source))
+      if (!expected || name === expected) {
+        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
+        choices.push({line, parameters: node.parameters.map((item) => item.name.getText(source).slice(0, 80))})
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(source)
+  choices.sort((a, b) => Math.abs(a.line - expectedLine) - Math.abs(b.line - expectedLine))
+  return choices[0]?.parameters || []
+}
+
+function callsAt(source, line, expectedName) {
+  const found = []
+  const visit = (node) => {
+    if (ts.isCallExpression(node)) {
+      const at = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
+      if ((!line || at === line) && (!expectedName || cleanName(callName(node)) === expectedName)) found.push({node, line: at})
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(source)
+  return found
+}
+
+// Bounded interprocedural evidence: maps arguments at graph callsites to the callee's declared
+// parameters. This is not a control-flow graph, value propagation, or taint-analysis claim.
+export function extractCallArgumentEvidence({graph, repoRoot, seedIds = [], depth = 2, maxEdges = 40} = {}) {
+  const boundary = createRepoBoundary(repoRoot)
+  const cache = new Map()
+  const queue = (seedIds || []).map((id) => ({id: String(id), hop: 0}))
+  const visited = new Set()
+  const seenCalls = new Set()
+  const edges = []
+  let unsupported = 0
+  while (queue.length && edges.length < maxEdges) {
+    const current = queue.shift()
+    if (visited.has(current.id) || current.hop >= depth) continue
+    visited.add(current.id)
+    const calls = [
+      ...(graph.out.get(current.id) || []).filter((edge) => edge.relation === 'calls')
+        .map((edge) => ({fromId: current.id, toId: String(edge.id), line: Number(edge.line) || 0, nextId: String(edge.id)})),
+      ...(graph.inn.get(current.id) || []).filter((edge) => edge.relation === 'calls')
+        .map((edge) => ({fromId: String(edge.id), toId: current.id, line: Number(edge.line) || 0, nextId: String(edge.id)})),
+    ]
+    for (const callEdge of calls) {
+      const callKey = `${callEdge.fromId}\0${callEdge.toId}\0${callEdge.line}`
+      if (seenCalls.has(callKey)) continue
+      seenCalls.add(callKey)
+      const from = graph.byId.get(callEdge.fromId)
+      const to = graph.byId.get(callEdge.toId)
+      const callerSource = parse(cache, boundary, fileOfNode(from))
+      const targetSource = parse(cache, boundary, fileOfNode(to))
+      if (!from || !to || !callerSource || !targetSource) { unsupported++; continue }
+      const params = parametersFor(targetSource, to)
+      const callsites = callsAt(callerSource, callEdge.line, cleanName(to.label))
+      if (!callsites.length) { unsupported++; continue }
+      for (const call of callsites.slice(0, 3)) {
+        edges.push({
+          from: callEdge.fromId, to: callEdge.toId, hop: current.hop + 1,
+          file: fileOfNode(from), line: call.line,
+          arguments: call.node.arguments.slice(0, 12).map((argument, index) => ({
+            index, expression: argument.getText(callerSource).slice(0, 160), parameter: params[index] || null,
+          })),
+          state: 'EXTRACTED',
+        })
+        if (edges.length >= maxEdges) break
+      }
+      if (current.hop + 1 < depth) queue.push({id: callEdge.nextId, hop: current.hop + 1})
+    }
+  }
+  return {
+    model: 'bounded call-argument-to-parameter evidence (not CFG or taint analysis)',
+    status: edges.length ? (unsupported ? 'PARTIAL' : 'COMPLETE') : 'UNAVAILABLE',
+    edges, unsupportedEdges: unsupported, capped: edges.length >= maxEdges,
+  }
+}

package/src/analysis/dead-code-review.js

@@ -84,6 +84,18 @@ function symbolCandidate(item, node, context) {
     caveats.push("Reflection is present and may invoke names without a resolvable static edge.");
   }
 
+  const evidenceTier = confidence === "high" && exactNoReference
+    ? "STRONG_STATIC_EVIDENCE"
+    : confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE";
+  const remainingChecks = [
+    ...(!exactNoReference ? ["Run an exact language-server reference query for this declaration."] : []),
+    ...(publicSurface ? ["Check downstream/external consumers of the public API."] : []),
+    ...(externalEntry || framework ? ["Inspect framework registration and externally entered call paths."] : []),
+    ...(dynamicFile ? ["Resolve dynamic import/require targets and name-based dispatch."] : []),
+    ...(reflectionFile || (publicSurface && context.repoSignals.reflection) ? ["Inspect reflection/annotation/configuration consumers."] : []),
+    "Run targeted tests after any removal.",
+  ];
+
   return {
     id: String(item.id),
     kind,
@@ -95,6 +107,8 @@ function symbolCandidate(item, node, context) {
     symbolKind: node?.symbol_kind || null,
     visibility: node?.visibility || (node?.exported ? "exported" : "internal"),
     confidence,
+    evidenceTier,
+    actionability: evidenceTier === "STRONG_STATIC_EVIDENCE" ? "PRIORITY_MANUAL_REVIEW" : "MANUAL_REVIEW",
     reason: item.reason,
     evidence: [
       ...(testOnly ? [{kind: item.evidence || "graph", fact: `Only test/e2e consumers were found${item.testConsumerFiles?.length ? `: ${item.testConsumerFiles.join(", ")}` : "."}`}]
@@ -106,6 +120,18 @@ function symbolCandidate(item, node, context) {
     externallyEnteredFile: externalEntry,
     pathClasses: pathInfo.classes || [],
     matchedPathRule: pathInfo.matchedRule || null,
+    verification: {
+      graphInboundRuntimeEdge: "NOT_FOUND",
+      indexedSecondOccurrence: testOnly ? "TEST_ONLY" : "NOT_FOUND",
+      exactLanguageServerReferences: exactNoReference ? "ZERO_CONFIRMED" : "NOT_CHECKED_OR_INCOMPLETE",
+      recognizedEntryPoint: externalEntry ? "FOUND" : "NOT_FOUND",
+      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED_IN_DECLARING_FILE",
+      reflectionRisk: reflectionFile || (publicSurface && context.repoSignals.reflection) ? "PRESENT" : "NOT_OBSERVED",
+      publicApi: publicSurface ? "YES" : "NO",
+      decision: "MANUAL_REVIEW_REQUIRED",
+    },
+    remainingChecks,
+    autoDelete: false,
     reviewAction: testOnly
       ? "Confirm that no production/config/framework consumer exists; decide whether the declaration is intentional test support or removable with its tests. Never auto-delete."
       : "Confirm with read_source, get_dependents, exact search, framework/config inspection and tests; never auto-delete.",
@@ -135,6 +161,13 @@ function fileCandidate(item, symbols, context) {
     confidence = "low";
     caveats.push("Reflection is present in this file.");
   }
+  const remainingChecks = [
+    "Inspect package scripts, manifests, framework/plugin discovery and deployment configuration.",
+    "Check external launchers and consumers outside the indexed repository.",
+    ...(dynamicFile ? ["Resolve dynamic import/require targets."] : []),
+    ...(reflectionFile ? ["Inspect reflection/name-based consumers."] : []),
+    "Run targeted tests after any removal.",
+  ];
   return {
     id: `file:${file}`,
     kind: "file",
@@ -146,6 +179,8 @@ function fileCandidate(item, symbols, context) {
     symbolKind: null,
     visibility: null,
     confidence,
+    evidenceTier: confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE",
+    actionability: "MANUAL_REVIEW",
     reason: item.reason,
     evidence: [
       { kind: "graph", fact: "No indexed module imports this file." },
@@ -156,6 +191,17 @@ function fileCandidate(item, symbols, context) {
     externallyEnteredFile: false,
     pathClasses: pathInfo.classes || [],
     matchedPathRule: pathInfo.matchedRule || null,
+    verification: {
+      graphInboundModuleEdge: "NOT_FOUND",
+      indexedSymbolsReferenced: "NONE",
+      recognizedEntryPoint: "NOT_FOUND",
+      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED",
+      reflectionRisk: reflectionFile ? "PRESENT" : "NOT_OBSERVED",
+      externalConsumerCheck: "NOT_POSSIBLE_FROM_REPOSITORY_GRAPH",
+      decision: "MANUAL_REVIEW_REQUIRED",
+    },
+    remainingChecks,
+    autoDelete: false,
     reviewAction: "Verify package scripts, manifests, framework discovery, dynamic loading and external consumers; never auto-delete.",
   };
 }
@@ -247,6 +293,11 @@ export function computeDeadCodeReview(graph, sources, options = {}) {
         medium: candidates.filter((candidate) => candidate.confidence === "medium").length,
         low: candidates.filter((candidate) => candidate.confidence === "low").length,
       },
+      byEvidenceTier: {
+        strongStatic: candidates.filter((candidate) => candidate.evidenceTier === "STRONG_STATIC_EVIDENCE").length,
+        boundedStatic: candidates.filter((candidate) => candidate.evidenceTier === "BOUNDED_STATIC_EVIDENCE").length,
+        highUncertainty: candidates.filter((candidate) => candidate.evidenceTier === "HIGH_UNCERTAINTY").length,
+      },
     },
     policy: {
       verdict: "REVIEW_REQUIRED",

package/src/analysis/dep-check.js

@@ -167,11 +167,24 @@ export function computeDepFindings({
         severity: dev ? "info" : "low",
         confidence: dev || ecosystem ? "low" : "medium",
         title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,
-        reason: "No recorded package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
-        detail: `"${name}" is declared in ${section} but never imported in source, never referenced by a script, and not mentioned in any known config file. Dynamic/config-convention usage can't be fully ruled out — review before removing.`,
+        reason: "No indexed package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
+        detail: `"${name}" is declared in ${section}, but no usage was found in the indexed source scope, package scripts, or ${configTexts.size} known config file(s). Dynamic/plugin/config-convention usage is not proven absent — review before removing.`,
         package: name,
         source: "internal",
-        fixHint: `npm uninstall ${name} (after confirming no config/CLI usage)`,
+        actionability: "MANIFEST_REVIEW_REQUIRED",
+        autoRemove: false,
+        verification: {
+          evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+          manifestDeclaration: { status: "FOUND", file: manifest, section, version: String(deps[name] || "") },
+          indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0 },
+          packageScripts: { status: "CHECKED", matched: false },
+          knownConfigs: { status: "CHECKED", filesScanned: configTexts.size, matched: false },
+          frameworkPeerContract: "NOT_FOUND",
+          implicitCompilerInput: "NOT_FOUND",
+          dynamicOrPluginUsage: "NOT_PROVEN_ABSENT",
+          decision: "REVIEW_REQUIRED",
+        },
+        fixHint: `Review manifest/config/plugin usage; if confirmed unused, remove ${name} with the package manager and run targeted tests`,
         ...meta,
       }));
     }
@@ -202,6 +215,25 @@ export function computeDepFindings({
       line: use.lines.get(files[0]) || 0,
       evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),
       source: "internal",
+      actionability: "STRONG_MANIFEST_MISMATCH",
+      autoInstall: false,
+      verification: {
+        evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+        manifestDeclaration: { status: "NOT_FOUND", file: manifest, checkedSections: Object.keys(sections) },
+        indexedSourceImports: {
+          status: "FOUND",
+          completeness: "COMPLETE_FOR_GRAPH_SCOPE",
+          count: files.length,
+          files: files.slice(0, 20),
+          truncated: files.length > 20,
+          typeOnly: use.typeOnly,
+          stylesheetOnly,
+          testOnly,
+        },
+        packageScope: meta.scope,
+        transitiveResolutionRisk: "PRESENT",
+        decision: "DECLARE_AFTER_SCOPE_REVIEW",
+      },
       fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,
       ...meta,
     }));
@@ -223,6 +255,13 @@ export function computeDepFindings({
       detail: `"${name}" is declared in ${ss.join(" + ")} — npm resolves one of them; keep a single section.`,
       package: name,
       source: "internal",
+      actionability: "MANIFEST_REVIEW_REQUIRED",
+      autoRemove: false,
+      verification: {
+        evidenceModel: "MANIFEST_ONLY",
+        manifestDeclaration: { status: "DUPLICATE", file: manifest, sections: ss },
+        decision: "REVIEW_REQUIRED",
+      },
       ...meta,
     }));
   }

package/src/analysis/duplicate-groups.js

@@ -0,0 +1,84 @@
+import {createHash} from 'node:crypto'
+import {writeFileSync} from 'node:fs'
+import {join} from 'node:path'
+import {computeDuplicates} from './duplicates.js'
+import {withGitRefCheckout} from './git-ref-graph.js'
+import {buildInternalGraph} from '../graph/internal-builder.js'
+import {filterGraphForMode} from '../graph/graph-filter.js'
+
+const NON_PRODUCT = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const eligible = (fragment, settings) => {
+  const classes = new Set(fragment.classes || [])
+  if (fragment.n < settings.tokMin) return false
+  if (settings.skipTests && (fragment.test || classes.has('test') || classes.has('e2e'))) return false
+  return settings.includeClassified || !(fragment.excluded || [...classes].some((name) => NON_PRODUCT.has(name)))
+}
+
+function groupPairs(data, settings) {
+  const fragments = data.frags || []
+  const pairs = (data.modes?.[settings.mode] || []).filter(([a, b, similarity]) => similarity >= settings.simMin && eligible(fragments[a], settings) && eligible(fragments[b], settings))
+  const parent = new Map()
+  const find = (value) => { let root = value; while (parent.get(root) !== root) root = parent.get(root); return root }
+  for (const [a, b] of pairs) {
+    if (!parent.has(a)) parent.set(a, a)
+    if (!parent.has(b)) parent.set(b, b)
+    parent.set(find(a), find(b))
+  }
+  const groups = new Map()
+  for (const [a, b, similarity] of pairs) {
+    const root = find(a)
+    if (!groups.has(root)) groups.set(root, {members: new Set(), maxSim: 0})
+    const group = groups.get(root)
+    group.members.add(a); group.members.add(b); group.maxSim = Math.max(group.maxSim, similarity)
+  }
+  return [...groups.values()].map((group) => {
+    const members = [...group.members].map((index) => fragments[index]).sort((a, b) => b.n - a.n)
+    return {members, maxSim: group.maxSim, tokens: members.reduce((sum, item) => sum + item.n, 0)}
+  }).sort((a, b) => b.tokens - a.tokens)
+}
+
+export function analyzeDuplicateGroups(repoRoot, graphPath, args = {}) {
+  const settings = {
+    simMin: Math.min(100, Math.max(50, Number(args.min_similarity) || 80)),
+    tokMin: Math.min(400, Math.max(12, Number(args.min_tokens) || 50)),
+    mode: args.mode === 'strict' ? 'strict' : 'renamed',
+    skipTests: args.include_tests !== true,
+    includeClassified: args.include_classified === true || args.include_non_product === true,
+  }
+  const data = computeDuplicates(repoRoot, graphPath, {includeStrings: args.include_strings === true, minTokens: settings.tokMin})
+  const groups = groupPairs(data, settings)
+  const suppressed = (data.frags || []).filter((fragment) => !eligible(fragment, settings)).length
+  return {settings, groups, suppressed}
+}
+
+const digest = (value) => createHash('sha256').update(value).digest('hex').slice(0, 20)
+function groupKey(group, mode) {
+  const members = group.members.map((fragment) => {
+    const fingerprints = Array.isArray(fragment.fp?.[mode]) ? [...fragment.fp[mode]].sort() : []
+    return `${String(fragment.file).replace(/\\/g, '/')}\0${fragment.label || ''}\0${digest(JSON.stringify(fingerprints))}`
+  }).sort()
+  return digest(members.join('\n'))
+}
+
+export async function compareDuplicateGroups({repoRoot, graphPath, currentGraph, baseRef, changedFiles = [], args = {}}) {
+  const current = analyzeDuplicateGroups(repoRoot, graphPath, args)
+  const mode = ['full', 'no-tests', 'tests-only'].includes(currentGraph?.graphBuildMode) ? currentGraph.graphBuildMode : 'full'
+  const baseline = await withGitRefCheckout(repoRoot, baseRef, async (checkout) => {
+    let graph = await buildInternalGraph(checkout)
+    if (mode !== 'full') graph = filterGraphForMode(graph, mode, {repoRoot: checkout})
+    graph.graphBuildMode = mode
+    const baselineGraphPath = join(checkout, '.weavatrix-verified-graph.json')
+    writeFileSync(baselineGraphPath, JSON.stringify(graph))
+    return analyzeDuplicateGroups(checkout, baselineGraphPath, args)
+  })
+  if (!baseline.ok) return {state: 'UNKNOWN', reason: baseline.error, currentGroups: current.groups.length}
+  const baselineKeys = new Set(baseline.value.groups.map((group) => groupKey(group, current.settings.mode)))
+  const changed = new Set(changedFiles.map((file) => String(file).replace(/\\/g, '/')))
+  const added = current.groups.filter((group) => !baselineKeys.has(groupKey(group, current.settings.mode)))
+  const scoped = added.filter((group) => group.members.some((member) => changed.has(String(member.file).replace(/\\/g, '/'))))
+  return {
+    state: scoped.length ? 'BLOCKED' : 'PASS', baseline: {ref: baseline.ref, commit: baseline.commit},
+    currentGroups: current.groups.length, baselineGroups: baseline.value.groups.length, newGroups: added.length,
+    scopedNewGroups: scoped.slice(0, 20).map((group) => ({similarity: group.maxSim, tokens: group.tokens, members: group.members.slice(0, 8).map((item) => ({file: item.file, start: item.start, end: item.end, label: item.label}))})),
+  }
+}

package/src/analysis/hot-path-review.js

@@ -109,8 +109,9 @@ export function computeHotPathReview(graph, options = {}) {
         calls: boundedInt(options.callThreshold, 12, 1, 10000),
         loopDepth: boundedInt(options.loopDepthThreshold, 2, 1, 10),
         timeRank: boundedInt(options.timeRankThreshold, 2, 0, 5),
-        minScore: boundedInt(options.minScore, 0, 0, 100),
+        minScore: boundedInt(options.minScore, 85, 0, 100),
     }
+    const defaultFocus = options.minScore == null
     const topN = boundedInt(options.topN, 20, 1, 100)
     const classifier = createPathClassifier(options.repoRoot || null)
     const knownFiles = [...new Set((graph?.nodes || []).map((node) => normalize(node?.source_file)).filter(Boolean))]
@@ -152,8 +153,19 @@ export function computeHotPathReview(graph, options = {}) {
         const nearest = staticByFile.get(file)?.nearestTests?.[0] || null
         const coverageRisk = actualCoverage == null ? 0 : (1 - actualCoverage) * 100
         const score = round(clamp(syntaxScore * 0.72 + graphScore * 0.2 + coverageRisk * 0.08))
-        if (score < thresholds.minScore) continue
         const directHotEvidence = Array.isArray(complexity.hotEvidence) ? complexity.hotEvidence.slice(0, 12) : []
+        // The default queue is intentionally narrow. A small, locally expensive function can still be
+        // important even with little graph fan-in, so retain only a bounded strong-local fallback. An
+        // explicit minScore disables this fallback and gives the caller a strict numeric gate.
+        const bodyLines = startLine > 0 && endLine >= startLine ? endLine - startLine + 1 : Number.POSITIVE_INFINITY
+        const strongLocalEvidence = defaultFocus && directHotEvidence.length > 0 && bodyLines <= 80 && (
+            Number(complexity.recursionInLoops || 0) > 0
+            || (bodyLines <= 40 && (
+                Number(complexity.sortsInLoops || 0) > 0
+                || (Number(complexity.timeRank || 0) >= 4 && Number(complexity.maxLoopDepth || 0) >= 2)
+            ))
+        )
+        if (score < thresholds.minScore && !strongLocalEvidence) continue
         const confidence = directHotEvidence.length ? 'HIGH' : complexity.recursion ? 'LOW' : 'MEDIUM'
         candidates.push({
             id: String(node.id),
@@ -164,6 +176,7 @@ export function computeHotPathReview(graph, options = {}) {
             endLine,
             classification: entry.classification,
             score,
+            selection: score >= thresholds.minScore ? 'SCORE_THRESHOLD' : 'STRONG_LOCAL_EVIDENCE',
             confidence,
             localSyntax: {
                 score: syntaxScore,
@@ -207,6 +220,11 @@ export function computeHotPathReview(graph, options = {}) {
             includeClassified: options.includeClassified === true,
         },
         thresholds,
+        selectionPolicy: {
+            mode: defaultFocus ? 'FOCUSED_DEFAULT' : 'EXPLICIT_SCORE_THRESHOLD',
+            strongLocalFallback: defaultFocus,
+            broadenWith: 'Set min_score lower (0 restores the full diagnostic candidate set).',
+        },
         analyzedSymbols: eligible.length,
         candidateSymbols: candidates.length,
         coverage: measuredCoverage.size

package/src/analysis/internal-audit.run.js

@@ -300,15 +300,20 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
     findings: sorted,
     dependencyReport: {
       status: dependencyStatus,
+      evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+      perFindingVerification: true,
+      verificationCoverage: { npm: "COMPLETE_FOR_GRAPH_SCOPE", go: "SUMMARY_ONLY", python: "SUMMARY_ONLY" },
       declared: dep.declared.size + goDep.declared.size + pyDep.declared.size,
       importedPackages: importedPackages.size,
       importRecords: externalImports.length,
       unused: dependencyFindings.filter((finding) => finding.rule === "unused-dep").length,
       missing: dependencyFindings.filter((finding) => finding.rule === "missing-dep").length,
       duplicateDeclarations: dependencyFindings.filter((finding) => finding.rule === "duplicate-dep").length,
+      unusedRequiringReview: dependencyFindings.filter((finding) => finding.rule === "unused-dep" && finding.verification?.decision === "REVIEW_REQUIRED").length,
+      missingWithSourceEvidence: dependencyFindings.filter((finding) => finding.rule === "missing-dep" && finding.verification?.indexedSourceImports?.status === "FOUND").length,
       packageScopes: packageScopes.length,
       reason: dependencyStatus === "COMPLETE"
-        ? "All discovered dependency manifests were compared with the complete indexed import set."
+        ? "All discovered dependency manifests were compared with the complete indexed import set; every npm unused/missing/duplicate finding carries manifest and source/config verification state."
         : "The dependency result is scoped to a partial graph and is not a repository-wide clean bill.",
     },
     deadReport: {

package/src/analysis/task-retrieval.js

@@ -0,0 +1,116 @@
+import {createPathClassifier, hasPathClass} from '../path-classification.js'
+
+const words = (value) => new Set(String(value || '').toLowerCase().match(/[\p{L}_$][\p{L}\p{N}_$-]{2,}/gu) || [])
+const fileOf = (node) => String(node?.source_file || (String(node?.id || '').includes('#') ? String(node.id).split('#')[0] : node?.id || '')).replace(/\\/g, '/')
+const isSymbol = (id) => String(id || '').includes('#')
+const NON_PRODUCT_CLASSES = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const CLASS_TERMS = Object.freeze({
+  test: ['test', 'tests', 'testing', 'spec', 'coverage', 'verify'],
+  e2e: ['e2e', 'playwright', 'cypress'],
+  generated: ['generated', 'autogenerated', 'dist'],
+  mock: ['mock', 'mocks', 'fixture', 'fixtures', 'fake'],
+  story: ['story', 'stories', 'storybook'],
+  docs: ['doc', 'docs', 'documentation', 'readme', 'guide'],
+  benchmark: ['benchmark', 'benchmarks', 'bench'],
+  temp: ['temp', 'temporary', 'tmp'],
+})
+
+const INTENT_TRANSLATIONS = [
+  [/авториз|аутентиф|логин|сесси|токен/iu, 'auth authentication login session token'],
+  [/маршрут|роут|эндпоинт|апи|http/iu, 'route router endpoint api http'],
+  [/тест|покрыти/iu, 'test spec coverage verify'],
+  [/к[эе]ш|хранилищ/iu, 'cache store storage'],
+  [/баз[аы]|запрос|sql/iu, 'database query sql'],
+  [/конфиг|настройк/iu, 'config settings configuration'],
+  [/безопас|вредонос|секрет/iu, 'security malware secret'],
+  [/зависим|импорт/iu, 'dependency import module'],
+  [/дублик|клон/iu, 'duplicate clone'],
+]
+
+export function expandTaskQuery(task) {
+  const text = String(task || '')
+  const expansions = INTENT_TRANSLATIONS.filter(([pattern]) => pattern.test(text)).map(([, value]) => value)
+  return [...new Set([text, ...expansions])].join(' ')
+}
+
+function overlapScore(taskWords, node) {
+  const haystack = words(`${node?.label || ''} ${node?.id || ''} ${node?.symbol_kind || ''}`)
+  let score = 0
+  for (const word of taskWords) if (haystack.has(word)) score += 8
+  return score
+}
+
+function addCandidate(map, node, score, reason) {
+  if (!node?.id) return
+  const id = String(node.id)
+  const current = map.get(id) || {node, score: 0, reasons: new Set()}
+  current.score += score
+  current.reasons.add(reason)
+  map.set(id, current)
+}
+
+function containedSymbols(g, node) {
+  if (isSymbol(node?.id)) return [node]
+  return (g.out.get(String(node?.id)) || [])
+    .filter((edge) => edge.relation === 'contains')
+    .map((edge) => g.byId.get(String(edge.id)))
+    .filter(Boolean)
+}
+
+// Combines intent-expanded search seeds with exact changed symbols. The result deliberately stays
+// deterministic and source-free; exact LSP/source evidence is collected by context_bundle later.
+export function retrieveTaskContext(g, {
+  task, semanticSeeds = [], changedSeedIds = [], maxSymbols = 3, repoRoot = null, includeClassified = false,
+} = {}) {
+  const expandedTask = expandTaskQuery(task)
+  const taskWords = words(expandedTask)
+  const requestedClasses = new Set(Object.entries(CLASS_TERMS)
+    .filter(([, terms]) => terms.some((term) => taskWords.has(term)))
+    .map(([name]) => name))
+  if (requestedClasses.has('test')) requestedClasses.add('e2e')
+  if (requestedClasses.has('e2e')) requestedClasses.add('test')
+  const classifier = createPathClassifier(repoRoot)
+  const classificationCache = new Map()
+  const changedFiles = new Set((changedSeedIds || []).map((id) => fileOf(g.byId.get(String(id)) || {id})))
+  const pathAllowed = (node) => {
+    const file = fileOf(node)
+    if (!file || changedFiles.has(file) || includeClassified === true) return true
+    if (!classificationCache.has(file)) classificationCache.set(file, classifier.explain(file, {content: ''}))
+    const info = classificationCache.get(file)
+    const classes = NON_PRODUCT_CLASSES.filter((name) => hasPathClass(info, name))
+    if (!info?.excluded && !classes.length) return true
+    return classes.some((name) => requestedClasses.has(name))
+  }
+  const candidates = new Map()
+  for (const id of changedSeedIds || []) {
+    const node = g.byId.get(String(id))
+    if (node) addCandidate(candidates, node, 100 + overlapScore(taskWords, node), 'changed-symbol')
+  }
+  for (const seed of semanticSeeds || []) addCandidate(candidates, seed, 45 + overlapScore(taskWords, seed), 'task-intent')
+
+  for (const candidate of [...candidates.values()]) {
+    for (const symbol of containedSymbols(g, candidate.node)) {
+      const degree = (g.out.get(String(symbol.id)) || []).length + (g.inn.get(String(symbol.id)) || []).length
+      addCandidate(candidates, symbol, 22 + overlapScore(taskWords, symbol) + Math.min(12, degree), `symbol-in:${fileOf(candidate.node)}`)
+    }
+  }
+
+  const symbolCandidates = [...candidates.values()].filter((item) => isSymbol(item.node.id))
+  const ranked = symbolCandidates
+    .filter((item) => pathAllowed(item.node))
+    .sort((left, right) => right.score - left.score || String(left.node.id).localeCompare(String(right.node.id)))
+  const limit = Math.max(1, Math.min(5, Number(maxSymbols) || 3))
+  return {
+    method: 'intent-expanded graph retrieval + exact changed-symbol seeds',
+    status: ranked.length ? 'COMPLETE' : 'NO_SYMBOLS',
+    selected: ranked.slice(0, limit).map((item) => ({
+      id: String(item.node.id), label: item.node.label || String(item.node.id), file: fileOf(item.node),
+      kind: item.node.symbol_kind || null, score: item.score, reasons: [...item.reasons].sort(),
+    })),
+    candidateCount: ranked.length,
+    suppressedClassified: symbolCandidates.length - ranked.length,
+    pathPolicy: includeClassified === true
+      ? {mode: 'ALL_CLASSIFIED'}
+      : {mode: 'PRODUCTION_FIRST', requestedClasses: [...requestedClasses].sort(), changedFilesPinned: changedFiles.size},
+  }
+}