weavatrix 0.2.6 → 0.2.8

package/src/analysis/data-flow-evidence.js

@@ -0,0 +1,114 @@
+import {readFileSync} from 'node:fs'
+import {extname} from 'node:path'
+import ts from 'typescript'
+import {createRepoBoundary} from '../repo-path.js'
+
+const lineOfNode = (node) => Number(String(node?.source_location || '').match(/^L(\d+)/i)?.[1] || String(node?.id || '').match(/@(\d+)$/)?.[1] || 0)
+const fileOfNode = (node) => String(node?.source_file || String(node?.id || '').split('#')[0]).replace(/\\/g, '/')
+const cleanName = (value) => String(value || '').replace(/\(\)$/, '').split('.').pop()
+const callName = (node) => node.expression?.name?.text || node.expression?.text || node.expression?.escapedText || ''
+
+function scriptKind(file) {
+  const ext = extname(file).toLowerCase()
+  if (ext === '.tsx') return ts.ScriptKind.TSX
+  if (ext === '.jsx') return ts.ScriptKind.JSX
+  if (ext === '.ts' || ext === '.mts' || ext === '.cts') return ts.ScriptKind.TS
+  return ts.ScriptKind.JS
+}
+
+function parse(cache, boundary, file) {
+  if (cache.has(file)) return cache.get(file)
+  if (!/\.[cm]?[jt]sx?$/i.test(file)) return null
+  const resolved = boundary.resolve(file)
+  if (!resolved.ok) return null
+  try {
+    const source = ts.createSourceFile(file, readFileSync(resolved.path, 'utf8'), ts.ScriptTarget.Latest, true, scriptKind(file))
+    cache.set(file, source)
+    return source
+  } catch { return null }
+}
+
+function parametersFor(source, target) {
+  const expected = cleanName(target?.label)
+  const expectedLine = lineOfNode(target)
+  const choices = []
+  const visit = (node) => {
+    if (Array.isArray(node.parameters) && node.name) {
+      const name = cleanName(node.name.text || node.name.getText?.(source))
+      if (!expected || name === expected) {
+        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
+        choices.push({line, parameters: node.parameters.map((item) => item.name.getText(source).slice(0, 80))})
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(source)
+  choices.sort((a, b) => Math.abs(a.line - expectedLine) - Math.abs(b.line - expectedLine))
+  return choices[0]?.parameters || []
+}
+
+function callsAt(source, line, expectedName) {
+  const found = []
+  const visit = (node) => {
+    if (ts.isCallExpression(node)) {
+      const at = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
+      if ((!line || at === line) && (!expectedName || cleanName(callName(node)) === expectedName)) found.push({node, line: at})
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(source)
+  return found
+}
+
+// Bounded interprocedural evidence: maps arguments at graph callsites to the callee's declared
+// parameters. This is not a control-flow graph, value propagation, or taint-analysis claim.
+export function extractCallArgumentEvidence({graph, repoRoot, seedIds = [], depth = 2, maxEdges = 40} = {}) {
+  const boundary = createRepoBoundary(repoRoot)
+  const cache = new Map()
+  const queue = (seedIds || []).map((id) => ({id: String(id), hop: 0}))
+  const visited = new Set()
+  const seenCalls = new Set()
+  const edges = []
+  let unsupported = 0
+  while (queue.length && edges.length < maxEdges) {
+    const current = queue.shift()
+    if (visited.has(current.id) || current.hop >= depth) continue
+    visited.add(current.id)
+    const calls = [
+      ...(graph.out.get(current.id) || []).filter((edge) => edge.relation === 'calls')
+        .map((edge) => ({fromId: current.id, toId: String(edge.id), line: Number(edge.line) || 0, nextId: String(edge.id)})),
+      ...(graph.inn.get(current.id) || []).filter((edge) => edge.relation === 'calls')
+        .map((edge) => ({fromId: String(edge.id), toId: current.id, line: Number(edge.line) || 0, nextId: String(edge.id)})),
+    ]
+    for (const callEdge of calls) {
+      const callKey = `${callEdge.fromId}\0${callEdge.toId}\0${callEdge.line}`
+      if (seenCalls.has(callKey)) continue
+      seenCalls.add(callKey)
+      const from = graph.byId.get(callEdge.fromId)
+      const to = graph.byId.get(callEdge.toId)
+      const callerSource = parse(cache, boundary, fileOfNode(from))
+      const targetSource = parse(cache, boundary, fileOfNode(to))
+      if (!from || !to || !callerSource || !targetSource) { unsupported++; continue }
+      const params = parametersFor(targetSource, to)
+      const callsites = callsAt(callerSource, callEdge.line, cleanName(to.label))
+      if (!callsites.length) { unsupported++; continue }
+      for (const call of callsites.slice(0, 3)) {
+        edges.push({
+          from: callEdge.fromId, to: callEdge.toId, hop: current.hop + 1,
+          file: fileOfNode(from), line: call.line,
+          arguments: call.node.arguments.slice(0, 12).map((argument, index) => ({
+            index, expression: argument.getText(callerSource).slice(0, 160), parameter: params[index] || null,
+          })),
+          state: 'EXTRACTED',
+        })
+        if (edges.length >= maxEdges) break
+      }
+      if (current.hop + 1 < depth) queue.push({id: callEdge.nextId, hop: current.hop + 1})
+    }
+  }
+  return {
+    model: 'bounded call-argument-to-parameter evidence (not CFG or taint analysis)',
+    status: edges.length ? (unsupported ? 'PARTIAL' : 'COMPLETE') : 'UNAVAILABLE',
+    edges, unsupportedEdges: unsupported, capped: edges.length >= maxEdges,
+  }
+}

package/src/analysis/dead-check.js

@@ -126,14 +126,29 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
 
   const symbolNames = new Set([...symById.values()].map((node) => bareName(node.label)).filter(Boolean));
   const occurrenceFiles = new Map();
+  const occurrenceCounts = new Map();
   for (const [file, text] of sources) for (const match of String(text || "").matchAll(IDENT_RE)) {
     const name = match[0];
     if (!symbolNames.has(name)) continue;
     const files = occurrenceFiles.get(name) || new Set();
     files.add(file);
     occurrenceFiles.set(name, files);
+    const counts = occurrenceCounts.get(name) || new Map();
+    counts.set(file, (counts.get(file) || 0) + 1);
+    occurrenceCounts.set(name, counts);
   }
 
+  const declarationCounts = new Map();
+  for (const node of symById.values()) {
+    const name = bareName(node.label);
+    if (!name) continue;
+    const key = `${node.source_file}\0${name}`;
+    declarationCounts.set(key, (declarationCounts.get(key) || 0) + 1);
+  }
+  const exactReferenceIds = new Set(graph.precisionReferenceSymbols || []);
+  const exactProductionReferenceIds = new Set(graph.precisionProductionReferenceSymbols || []);
+  const exactTestReferenceIds = new Set(graph.precisionTestReferenceSymbols || []);
+
   // decorated defs (@app.route/@app.event/@pytest.fixture…) are entered by the framework: trust the
   // builder's flag when present, else walk the source line(s) above the definition (graph-builder graphs).
   const lineCache = new Map();
@@ -155,6 +170,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
 
   const isReferenced = (n) => {
     if (inbound.has(n.id)) return true;                          // a real graph edge targets it
+    if (exactReferenceIds.has(String(n.id))) return true;        // revision-bound point-query evidence found a caller
     const name = bareName(n.label);
     if (!name || !/^[A-Za-z_$]/.test(name)) return true;         // selectors/odd labels → don't flag
     if (/^__\w+__$/.test(name)) return true;                     // dunders are invoked implicitly (with/str/==/iter…), never spelled
@@ -182,8 +198,14 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
     const name = bareName(n.label);
     const occurrenceSet = occurrenceFiles.get(name) || new Set();
     const externalOccurrences = [...occurrenceSet].filter((file) => file !== n.source_file);
+    const localOccurrences = occurrenceCounts.get(name)?.get(n.source_file) || 0;
+    const localDeclarations = declarationCounts.get(`${n.source_file}\0${name}`) || 0;
+    const hasLocalProductionUse = localOccurrences > localDeclarations;
     const lexicalTestOnly = externalOccurrences.length > 0 && externalOccurrences.every((file) => isTestFile(file));
-    if (hasProductionInbound || (!hasTestInbound && !lexicalTestOnly)) continue;
+    const hasExactProductionInbound = exactProductionReferenceIds.has(String(n.id));
+    const hasExactTestInbound = exactTestReferenceIds.has(String(n.id));
+    if (hasProductionInbound || hasExactProductionInbound || hasLocalProductionUse
+      || (!hasTestInbound && !hasExactTestInbound && !lexicalTestOnly)) continue;
     testOnlySymbols.push({
       id: n.id,
       file: n.source_file,
@@ -191,7 +213,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
       test: false,
       reason: "referenced only from test/e2e code; no production consumer was found",
       testConsumerFiles: [...new Set(sourceFiles.filter((file) => file && isTestFile(file)))].sort(),
-      evidence: hasTestInbound ? "graph" : "lexical",
+      evidence: hasTestInbound ? "graph" : hasExactTestInbound ? "exact-semantic" : "lexical",
       publicApi: n.exported === true || ["public", "protected"].includes(String(n.visibility || "").toLowerCase()),
     });
   }

package/src/analysis/dead-code-review.js

@@ -84,6 +84,18 @@ function symbolCandidate(item, node, context) {
     caveats.push("Reflection is present and may invoke names without a resolvable static edge.");
   }
 
+  const evidenceTier = confidence === "high" && exactNoReference
+    ? "STRONG_STATIC_EVIDENCE"
+    : confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE";
+  const remainingChecks = [
+    ...(!exactNoReference ? ["Run an exact language-server reference query for this declaration."] : []),
+    ...(publicSurface ? ["Check downstream/external consumers of the public API."] : []),
+    ...(externalEntry || framework ? ["Inspect framework registration and externally entered call paths."] : []),
+    ...(dynamicFile ? ["Resolve dynamic import/require targets and name-based dispatch."] : []),
+    ...(reflectionFile || (publicSurface && context.repoSignals.reflection) ? ["Inspect reflection/annotation/configuration consumers."] : []),
+    "Run targeted tests after any removal.",
+  ];
+
   return {
     id: String(item.id),
     kind,
@@ -95,6 +107,8 @@ function symbolCandidate(item, node, context) {
     symbolKind: node?.symbol_kind || null,
     visibility: node?.visibility || (node?.exported ? "exported" : "internal"),
     confidence,
+    evidenceTier,
+    actionability: evidenceTier === "STRONG_STATIC_EVIDENCE" ? "PRIORITY_MANUAL_REVIEW" : "MANUAL_REVIEW",
     reason: item.reason,
     evidence: [
       ...(testOnly ? [{kind: item.evidence || "graph", fact: `Only test/e2e consumers were found${item.testConsumerFiles?.length ? `: ${item.testConsumerFiles.join(", ")}` : "."}`}]
@@ -106,6 +120,18 @@ function symbolCandidate(item, node, context) {
     externallyEnteredFile: externalEntry,
     pathClasses: pathInfo.classes || [],
     matchedPathRule: pathInfo.matchedRule || null,
+    verification: {
+      graphInboundRuntimeEdge: "NOT_FOUND",
+      indexedSecondOccurrence: testOnly ? "TEST_ONLY" : "NOT_FOUND",
+      exactLanguageServerReferences: exactNoReference ? "ZERO_CONFIRMED" : "NOT_CHECKED_OR_INCOMPLETE",
+      recognizedEntryPoint: externalEntry ? "FOUND" : "NOT_FOUND",
+      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED_IN_DECLARING_FILE",
+      reflectionRisk: reflectionFile || (publicSurface && context.repoSignals.reflection) ? "PRESENT" : "NOT_OBSERVED",
+      publicApi: publicSurface ? "YES" : "NO",
+      decision: "MANUAL_REVIEW_REQUIRED",
+    },
+    remainingChecks,
+    autoDelete: false,
     reviewAction: testOnly
       ? "Confirm that no production/config/framework consumer exists; decide whether the declaration is intentional test support or removable with its tests. Never auto-delete."
       : "Confirm with read_source, get_dependents, exact search, framework/config inspection and tests; never auto-delete.",
@@ -135,6 +161,13 @@ function fileCandidate(item, symbols, context) {
     confidence = "low";
     caveats.push("Reflection is present in this file.");
   }
+  const remainingChecks = [
+    "Inspect package scripts, manifests, framework/plugin discovery and deployment configuration.",
+    "Check external launchers and consumers outside the indexed repository.",
+    ...(dynamicFile ? ["Resolve dynamic import/require targets."] : []),
+    ...(reflectionFile ? ["Inspect reflection/name-based consumers."] : []),
+    "Run targeted tests after any removal.",
+  ];
   return {
     id: `file:${file}`,
     kind: "file",
@@ -146,6 +179,8 @@ function fileCandidate(item, symbols, context) {
     symbolKind: null,
     visibility: null,
     confidence,
+    evidenceTier: confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE",
+    actionability: "MANUAL_REVIEW",
     reason: item.reason,
     evidence: [
       { kind: "graph", fact: "No indexed module imports this file." },
@@ -156,6 +191,17 @@ function fileCandidate(item, symbols, context) {
     externallyEnteredFile: false,
     pathClasses: pathInfo.classes || [],
     matchedPathRule: pathInfo.matchedRule || null,
+    verification: {
+      graphInboundModuleEdge: "NOT_FOUND",
+      indexedSymbolsReferenced: "NONE",
+      recognizedEntryPoint: "NOT_FOUND",
+      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED",
+      reflectionRisk: reflectionFile ? "PRESENT" : "NOT_OBSERVED",
+      externalConsumerCheck: "NOT_POSSIBLE_FROM_REPOSITORY_GRAPH",
+      decision: "MANUAL_REVIEW_REQUIRED",
+    },
+    remainingChecks,
+    autoDelete: false,
     reviewAction: "Verify package scripts, manifests, framework discovery, dynamic loading and external consumers; never auto-delete.",
   };
 }
@@ -247,6 +293,11 @@ export function computeDeadCodeReview(graph, sources, options = {}) {
         medium: candidates.filter((candidate) => candidate.confidence === "medium").length,
         low: candidates.filter((candidate) => candidate.confidence === "low").length,
       },
+      byEvidenceTier: {
+        strongStatic: candidates.filter((candidate) => candidate.evidenceTier === "STRONG_STATIC_EVIDENCE").length,
+        boundedStatic: candidates.filter((candidate) => candidate.evidenceTier === "BOUNDED_STATIC_EVIDENCE").length,
+        highUncertainty: candidates.filter((candidate) => candidate.evidenceTier === "HIGH_UNCERTAINTY").length,
+      },
     },
     policy: {
       verdict: "REVIEW_REQUIRED",

package/src/analysis/dep-check-ecosystems.js

@@ -1,6 +1,6 @@
 import { makeFinding } from "./findings.js";
 
-const TEST_PATH_RE = /(^|[/\\])(test|tests|__tests__|spec|e2e|__mocks__)([/\\]|$)|[._-](test|spec)\.[a-z0-9]+$|_test\.go$/i;
+const TEST_PATH_RE = /(^|[/\\])(test|tests|__tests__|spec|e2e|__mocks__)([/\\]|$)|[._-](test|spec)\.[a-z0-9]+$|_test\.go$|(^|[/\\])test(?:_[^/\\]*)?\.py$/i;
 const escRe = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\w.-])`).test(blob);
 
@@ -79,7 +79,7 @@ const PY_TOOL_DISTS = new Set(("pytest tox nox black ruff flake8 pylint mypy pyr
   "pip-tools uv virtualenv pipenv gunicorn uwsgi supervisor ipython jupyter jupyterlab notebook ipykernel codecov autopep8 yapf commitizen detect-secrets safety pip-audit hatchling flit flit-core pdm").split(" "));
 const pyNorm = (n) => String(n || "").toLowerCase().replace(/[-_.]+/g, "-");
 
-export function computePyDepFindings({
+function computePyDepFindingsFlat({
   externalImports = [], pyManifest = null, configTexts = new Map(),
   managedDependencies = [], ignoredDependencies = [], nonRuntimeRoots = [],
 } = {}) {
@@ -161,3 +161,42 @@ export function computePyDepFindings({
   }
   return { findings, declared, managed };
 }
+
+const normPyScope = (root) => String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+const pyScopeOwns = (root, file) => !root || file === root || String(file || "").replace(/\\/g, "/").startsWith(`${root}/`);
+
+export function computePyDepFindings(options = {}) {
+  const scopes = Array.isArray(options.pyManifest?.scopes) ? options.pyManifest.scopes : [];
+  if (!scopes.length) return computePyDepFindingsFlat(options);
+  const normalized = scopes.map((scope) => ({ ...scope, root: normPyScope(scope.root) }))
+    .sort((left, right) => right.root.length - left.root.length);
+  if (!normalized.some((scope) => !scope.root)) normalized.push({ root: "", present: false, deps: [], manifests: [] });
+  const importsByScope = new Map(normalized.map((scope) => [scope, []]));
+  const configByScope = new Map(normalized.map((scope) => [scope, new Map()]));
+  for (const entry of options.externalImports || []) {
+    const owner = normalized.find((scope) => pyScopeOwns(scope.root, entry.file)) || normalized.at(-1);
+    importsByScope.get(owner).push(entry);
+  }
+  for (const [file, text] of options.configTexts || new Map()) {
+    const owner = normalized.find((scope) => pyScopeOwns(scope.root, file)) || normalized.at(-1);
+    configByScope.get(owner).set(file, text);
+  }
+  const findings = [];
+  const declared = new Set();
+  const managed = new Set();
+  for (const scope of normalized) {
+    const result = computePyDepFindingsFlat({
+      ...options,
+      externalImports: importsByScope.get(scope),
+      configTexts: configByScope.get(scope),
+      pyManifest: {present: scope.present, deps: scope.deps || []},
+    });
+    findings.push(...result.findings.map((finding) => ({
+      ...finding,
+      ...(scope.manifests?.length ? {manifest: scope.manifests[0]} : {}),
+    })));
+    for (const name of result.declared) declared.add(`${scope.root || "."}:${name}`);
+    for (const name of result.managed) managed.add(name);
+  }
+  return { findings, declared, managed };
+}

package/src/analysis/dep-check.js

@@ -167,11 +167,24 @@ export function computeDepFindings({
         severity: dev ? "info" : "low",
         confidence: dev || ecosystem ? "low" : "medium",
         title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,
-        reason: "No recorded package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
-        detail: `"${name}" is declared in ${section} but never imported in source, never referenced by a script, and not mentioned in any known config file. Dynamic/config-convention usage can't be fully ruled out — review before removing.`,
+        reason: "No indexed package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
+        detail: `"${name}" is declared in ${section}, but no usage was found in the indexed source scope, package scripts, or ${configTexts.size} known config file(s). Dynamic/plugin/config-convention usage is not proven absent — review before removing.`,
         package: name,
         source: "internal",
-        fixHint: `npm uninstall ${name} (after confirming no config/CLI usage)`,
+        actionability: "MANIFEST_REVIEW_REQUIRED",
+        autoRemove: false,
+        verification: {
+          evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+          manifestDeclaration: { status: "FOUND", file: manifest, section, version: String(deps[name] || "") },
+          indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0 },
+          packageScripts: { status: "CHECKED", matched: false },
+          knownConfigs: { status: "CHECKED", filesScanned: configTexts.size, matched: false },
+          frameworkPeerContract: "NOT_FOUND",
+          implicitCompilerInput: "NOT_FOUND",
+          dynamicOrPluginUsage: "NOT_PROVEN_ABSENT",
+          decision: "REVIEW_REQUIRED",
+        },
+        fixHint: `Review manifest/config/plugin usage; if confirmed unused, remove ${name} with the package manager and run targeted tests`,
         ...meta,
       }));
     }
@@ -202,6 +215,25 @@ export function computeDepFindings({
       line: use.lines.get(files[0]) || 0,
       evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),
       source: "internal",
+      actionability: "STRONG_MANIFEST_MISMATCH",
+      autoInstall: false,
+      verification: {
+        evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+        manifestDeclaration: { status: "NOT_FOUND", file: manifest, checkedSections: Object.keys(sections) },
+        indexedSourceImports: {
+          status: "FOUND",
+          completeness: "COMPLETE_FOR_GRAPH_SCOPE",
+          count: files.length,
+          files: files.slice(0, 20),
+          truncated: files.length > 20,
+          typeOnly: use.typeOnly,
+          stylesheetOnly,
+          testOnly,
+        },
+        packageScope: meta.scope,
+        transitiveResolutionRisk: "PRESENT",
+        decision: "DECLARE_AFTER_SCOPE_REVIEW",
+      },
       fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,
       ...meta,
     }));
@@ -223,6 +255,13 @@ export function computeDepFindings({
       detail: `"${name}" is declared in ${ss.join(" + ")} — npm resolves one of them; keep a single section.`,
       package: name,
       source: "internal",
+      actionability: "MANIFEST_REVIEW_REQUIRED",
+      autoRemove: false,
+      verification: {
+        evidenceModel: "MANIFEST_ONLY",
+        manifestDeclaration: { status: "DUPLICATE", file: manifest, sections: ss },
+        decision: "REVIEW_REQUIRED",
+      },
       ...meta,
     }));
   }

package/src/analysis/duplicate-groups.js

@@ -0,0 +1,84 @@
+import {createHash} from 'node:crypto'
+import {writeFileSync} from 'node:fs'
+import {join} from 'node:path'
+import {computeDuplicates} from './duplicates.js'
+import {withGitRefCheckout} from './git-ref-graph.js'
+import {buildInternalGraph} from '../graph/internal-builder.js'
+import {filterGraphForMode} from '../graph/graph-filter.js'
+
+const NON_PRODUCT = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const eligible = (fragment, settings) => {
+  const classes = new Set(fragment.classes || [])
+  if (fragment.n < settings.tokMin) return false
+  if (settings.skipTests && (fragment.test || classes.has('test') || classes.has('e2e'))) return false
+  return settings.includeClassified || !(fragment.excluded || [...classes].some((name) => NON_PRODUCT.has(name)))
+}
+
+function groupPairs(data, settings) {
+  const fragments = data.frags || []
+  const pairs = (data.modes?.[settings.mode] || []).filter(([a, b, similarity]) => similarity >= settings.simMin && eligible(fragments[a], settings) && eligible(fragments[b], settings))
+  const parent = new Map()
+  const find = (value) => { let root = value; while (parent.get(root) !== root) root = parent.get(root); return root }
+  for (const [a, b] of pairs) {
+    if (!parent.has(a)) parent.set(a, a)
+    if (!parent.has(b)) parent.set(b, b)
+    parent.set(find(a), find(b))
+  }
+  const groups = new Map()
+  for (const [a, b, similarity] of pairs) {
+    const root = find(a)
+    if (!groups.has(root)) groups.set(root, {members: new Set(), maxSim: 0})
+    const group = groups.get(root)
+    group.members.add(a); group.members.add(b); group.maxSim = Math.max(group.maxSim, similarity)
+  }
+  return [...groups.values()].map((group) => {
+    const members = [...group.members].map((index) => fragments[index]).sort((a, b) => b.n - a.n)
+    return {members, maxSim: group.maxSim, tokens: members.reduce((sum, item) => sum + item.n, 0)}
+  }).sort((a, b) => b.tokens - a.tokens)
+}
+
+export function analyzeDuplicateGroups(repoRoot, graphPath, args = {}) {
+  const settings = {
+    simMin: Math.min(100, Math.max(50, Number(args.min_similarity) || 80)),
+    tokMin: Math.min(400, Math.max(12, Number(args.min_tokens) || 50)),
+    mode: args.mode === 'strict' ? 'strict' : 'renamed',
+    skipTests: args.include_tests !== true,
+    includeClassified: args.include_classified === true || args.include_non_product === true,
+  }
+  const data = computeDuplicates(repoRoot, graphPath, {includeStrings: args.include_strings === true, minTokens: settings.tokMin})
+  const groups = groupPairs(data, settings)
+  const suppressed = (data.frags || []).filter((fragment) => !eligible(fragment, settings)).length
+  return {settings, groups, suppressed}
+}
+
+const digest = (value) => createHash('sha256').update(value).digest('hex').slice(0, 20)
+function groupKey(group, mode) {
+  const members = group.members.map((fragment) => {
+    const fingerprints = Array.isArray(fragment.fp?.[mode]) ? [...fragment.fp[mode]].sort() : []
+    return `${String(fragment.file).replace(/\\/g, '/')}\0${fragment.label || ''}\0${digest(JSON.stringify(fingerprints))}`
+  }).sort()
+  return digest(members.join('\n'))
+}
+
+export async function compareDuplicateGroups({repoRoot, graphPath, currentGraph, baseRef, changedFiles = [], args = {}}) {
+  const current = analyzeDuplicateGroups(repoRoot, graphPath, args)
+  const mode = ['full', 'no-tests', 'tests-only'].includes(currentGraph?.graphBuildMode) ? currentGraph.graphBuildMode : 'full'
+  const baseline = await withGitRefCheckout(repoRoot, baseRef, async (checkout) => {
+    let graph = await buildInternalGraph(checkout)
+    if (mode !== 'full') graph = filterGraphForMode(graph, mode, {repoRoot: checkout})
+    graph.graphBuildMode = mode
+    const baselineGraphPath = join(checkout, '.weavatrix-verified-graph.json')
+    writeFileSync(baselineGraphPath, JSON.stringify(graph))
+    return analyzeDuplicateGroups(checkout, baselineGraphPath, args)
+  })
+  if (!baseline.ok) return {state: 'UNKNOWN', reason: baseline.error, currentGroups: current.groups.length}
+  const baselineKeys = new Set(baseline.value.groups.map((group) => groupKey(group, current.settings.mode)))
+  const changed = new Set(changedFiles.map((file) => String(file).replace(/\\/g, '/')))
+  const added = current.groups.filter((group) => !baselineKeys.has(groupKey(group, current.settings.mode)))
+  const scoped = added.filter((group) => group.members.some((member) => changed.has(String(member.file).replace(/\\/g, '/'))))
+  return {
+    state: scoped.length ? 'BLOCKED' : 'PASS', baseline: {ref: baseline.ref, commit: baseline.commit},
+    currentGroups: current.groups.length, baselineGroups: baseline.value.groups.length, newGroups: added.length,
+    scopedNewGroups: scoped.slice(0, 20).map((group) => ({similarity: group.maxSim, tokens: group.tokens, members: group.members.slice(0, 8).map((item) => ({file: item.file, start: item.start, end: item.end, label: item.label}))})),
+  }
+}

package/src/analysis/endpoints.js

@@ -27,6 +27,38 @@ function lineAt(text, index) {
   return line;
 }
 
+// Regex extractors must never see commented-out routes. Preserve string literals and every source
+// offset, but replace comment bodies with spaces so endpoint line numbers still refer to the original
+// file. Python `#` comments are enabled only for .py files; Rust attributes such as #[get] stay intact.
+function maskComments(text, { hashComments = false } = {}) {
+  const chars = String(text || "").split("");
+  let quote = "", escaped = false, lineComment = false, blockComment = false;
+  for (let i = 0; i < chars.length; i++) {
+    const ch = chars[i], next = chars[i + 1];
+    if (lineComment) {
+      if (ch === "\n" || ch === "\r") lineComment = false;
+      else chars[i] = " ";
+      continue;
+    }
+    if (blockComment) {
+      if (ch === "*" && next === "/") { chars[i] = chars[i + 1] = " "; i++; blockComment = false; }
+      else if (ch !== "\n" && ch !== "\r") chars[i] = " ";
+      continue;
+    }
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") { quote = ch; continue; }
+    if (ch === "/" && next === "/") { chars[i] = chars[i + 1] = " "; i++; lineComment = true; continue; }
+    if (ch === "/" && next === "*") { chars[i] = chars[i + 1] = " "; i++; blockComment = true; continue; }
+    if (hashComments && ch === "#") { chars[i] = " "; lineComment = true; }
+  }
+  return chars.join("");
+}
+
 // best-effort bare handler name from a value expression: the LAST identifier, unwrapping wrappers like
 // executionRoute(queryHandlers.executeQuery) → executeQuery, asyncHandler(fn) → fn, a.b.c → c.
 // An INLINE handler (arrow / function literal) has no named method to join to, so it returns "" (the
@@ -75,6 +107,7 @@ export function extractEndpointsFromText(text, file) {
   const py = /\.py$/i.test(file);
   const rust = /\.rs$/i.test(file);
   const java = /\.java$/i.test(file);
+  const scanText = maskComments(text, { hashComments: py });
   const add = (method, path, expr, idx) => {
     const p = cleanPath(path);
     if (!looksLikePath(p)) return;
@@ -90,13 +123,13 @@ export function extractEndpointsFromText(text, file) {
     const seen = new Set();
     const direct = /\bexport\s+(?:(?:async|declare)\s+)*(?:function\s+|(?:const|let|var)\s+)(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g;
     let nm;
-    while ((nm = direct.exec(text))) {
+    while ((nm = direct.exec(scanText))) {
       const method = nm[1].toUpperCase();
       if (!seen.has(method)) { seen.add(method); add(method, nextPath, method, nm.index); }
     }
     const lists = /\bexport\s*\{([^}]+)\}/g;
     let lm;
-    while ((lm = lists.exec(text))) {
+    while ((lm = lists.exec(scanText))) {
       for (const item of lm[1].split(",")) {
         const mm = /^\s*([A-Za-z_$][\w$]*)(?:\s+as\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS))?\s*$/.exec(item);
         if (!mm) continue;
@@ -108,9 +141,9 @@ export function extractEndpointsFromText(text, file) {
     }
   }
 
-  if (rust) extractRustEndpoints(text, add);
+  if (rust) extractRustEndpoints(scanText, add);
   if (java) {
-    out.push(...extractSpringEndpoints(text, file));
+    out.push(...extractSpringEndpoints(scanText, file));
     return out; // generic JS-style method calls would turn Java HTTP clients into fake server routes
   }
 
@@ -118,14 +151,14 @@ export function extractEndpointsFromText(text, file) {
   // find each  "…": {  or  "…": expr,  where the key looks like a path
   const objKeyRe = /(["'`])(\/[^"'`]*)\1\s*:\s*(\{)?/g;
   let m;
-  while ((m = objKeyRe.exec(text))) {
+  while ((m = objKeyRe.exec(scanText))) {
     const path = m[2], keyIdx = m.index;
     if (m[3]) {
       // object of METHOD: handler — scan to the matching close brace (routes objects are shallow)
       let i = objKeyRe.lastIndex, depth = 1;
       const start = i;
-      while (i < text.length && depth > 0) { const c = text[i]; if (c === "{") depth++; else if (c === "}") depth--; i++; }
-      const body = text.slice(start, i - 1);
+      while (i < scanText.length && depth > 0) { const c = scanText[i]; if (c === "{") depth++; else if (c === "}") depth--; i++; }
+      const body = scanText.slice(start, i - 1);
       objKeyRe.lastIndex = i;
       if (OPENAPI_BLOCK.test(body)) continue; // documentation, not a route table
       const methodRe = /\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b\s*:\s*([^,\n}]+)/gi;
@@ -133,9 +166,10 @@ export function extractEndpointsFromText(text, file) {
       while ((mm = methodRe.exec(body))) add(mm[1], path, mm[2], keyIdx);
     } else {
       // "/path": handlerExpr — a direct handler (any method); grab up to the next , or }
-      const tail = text.slice(objKeyRe.lastIndex, objKeyRe.lastIndex + 200);
+      const tail = scanText.slice(objKeyRe.lastIndex, objKeyRe.lastIndex + 200);
       const em = /^([^,\n}]+)/.exec(tail);
-      if (em && !/^\s*\{/.test(em[1])) add("ANY", path, em[1], keyIdx);
+      // A string/number/array value is an ordinary path/name lookup, not an executable handler.
+      if (em && !/^\s*(?:\{|["'`\[]|[-+]?\d|true\b|false\b|null\b|undefined\b)/i.test(em[1])) add("ANY", path, em[1], keyIdx);
     }
   }
 
@@ -146,7 +180,7 @@ export function extractEndpointsFromText(text, file) {
   // FRONTEND code, not server routes. A server route also REQUIRES a handler arg (an identifier/function),
   // so a bare `client.get("/x")` or one whose 2nd arg is a config object literal `{…}` is skipped.
   const callRe = /(?<!@)\b([\w$]+)\s*\.\s*(get|post|put|patch|delete|head|options|all)\s*\(\s*(["'`])(\/[^"'`]*)\3\s*(?:,\s*([\s\S]{0,160}?))?\)/gi;
-  while ((m = callRe.exec(text))) {
+  while ((m = callRe.exec(scanText))) {
     const caller = m[1], arg2 = String(m[5] || "").trim();
     if (HTTP_CLIENT_CALLER.test(caller)) continue;          // axios/http/fetch/apiClient… → a client request
     if (!arg2 || arg2[0] === "{") continue;                 // no handler, or a config object → not a route def
@@ -155,14 +189,14 @@ export function extractEndpointsFromText(text, file) {
 
   // ---- Go net/http: mux.HandleFunc("/path", handler) / http.Handle("/path", h) ------------------
   const goRe = /\.\s*(?:HandleFunc|Handle)\s*\(\s*(["'`])(\/[^"'`]*)\1\s*,\s*([\s\S]{0,120}?)\)/g;
-  while ((m = goRe.exec(text))) add("ANY", m[2], m[3], m.index);
+  while ((m = goRe.exec(scanText))) add("ANY", m[2], m[3], m.index);
 
   // ---- decorators: @app.get("/path") / @router.post("/path") / @Get("/path") -------------------
   if (py || /\.(ts|js|tsx|jsx|cjs|mjs)$/i.test(file)) {
     const decoRe = /@[\w$]*\.?\s*(get|post|put|patch|delete|head|options)\s*\(\s*(["'`])(\/[^"'`]*)\2/gi;
-    while ((m = decoRe.exec(text))) {
+    while ((m = decoRe.exec(scanText))) {
       // the handler is the def/function on a following line — best-effort: next def name
-      const after = text.slice(decoRe.lastIndex, decoRe.lastIndex + 200);
+      const after = scanText.slice(decoRe.lastIndex, decoRe.lastIndex + 200);
       const fn = /\b(?:def|async\s+def|function|const|export\s+function)\s+([A-Za-z_$][\w$]*)/.exec(after);
       add(m[1], m[3], fn ? fn[1] : "", m.index);
     }