weavatrix 0.3.10 → 0.3.12

package/src/mcp/graph/context-seeds.mjs

@@ -17,11 +17,12 @@ const TOOL_EXECUTION_TERMS = QUERY_INTENTS.find(([id]) => id === 'tool-execution
 const TOOL_EXECUTION_TRIGGERS = new Set(['tool', 'tools', 'tooling', 'mcp'])
 const wordsOf = (value) => String(value ?? '').replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean)
 const normPath = (value) => String(value ?? '').replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase()
-const CODE_FILE_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|kt|kts|cs|rb|php)$/i
+const CODE_FILE_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|kt|kts|cs|rb|php|sol|sql)$/i
 const DATA_OR_PROSE_RE = /\.(?:json|ya?ml|toml|ini|md|mdx|rst|adoc|html?|css|scss|less|svg)$/i
 const LANGUAGE_EXTENSIONS = Object.freeze({
     rust: ['rs'], python: ['py', 'pyi'], typescript: ['ts', 'tsx', 'mts', 'cts'],
     javascript: ['js', 'jsx', 'mjs', 'cjs'], go: ['go'], java: ['java'], csharp: ['cs'],
+    solidity: ['sol'], sql: ['sql'],
 })
 
 function requestedLanguages(query) {
@@ -33,6 +34,8 @@ function requestedLanguages(query) {
     if (words.has('golang') || /(?:^|[^A-Za-z])Go(?:[^A-Za-z]|$)/.test(raw)) requested.add('go')
     if (words.has('java')) requested.add('java')
     if (words.has('csharp') || words.has('dotnet') || /csharp|(?:^|[^A-Za-z])C#(?:[^A-Za-z]|$)/i.test(raw)) requested.add('csharp')
+    if (words.has('solidity') || words.has('contract') || words.has('contracts')) requested.add('solidity')
+    if (words.has('sql') || words.has('schema') || words.has('migration') || words.has('migrations')) requested.add('sql')
     return new Set([...requested].flatMap((language) => LANGUAGE_EXTENSIONS[language]))
 }
 
@@ -86,13 +89,16 @@ function toolExecutionSignal(node, source, words, stem) {
     return score
 }
 
-function queryConcepts(query) {
+// relaxStop is the last-resort fallback: when EVERY token is a stop word (e.g. a bare
+// "architecture" query), keep them as concepts so the query still seeds instead of
+// misreporting "No nodes matched" for a concept the repository clearly contains.
+function queryConcepts(query, {relaxStop = false} = {}) {
     const tokens = wordsOf(query)
     const toolExecution = tokens.some((token) => TOOL_EXECUTION_TRIGGERS.has(token))
     const explanatoryWork = tokens.some((token) => token === 'how' || token === 'explain')
     const seen = new Set(), concepts = []
     for (const raw of tokens) {
-        if (raw.length < 2 || QUERY_STOP.has(raw)) continue
+        if (raw.length < 2 || (!relaxStop && QUERY_STOP.has(raw))) continue
         if (explanatoryWork && (raw === 'work' || raw === 'works' || raw === 'working')) continue
         if (toolExecution && TOOL_EXECUTION_TERMS.includes(raw)) {
             if (seen.has('tool-execution')) continue
@@ -113,7 +119,7 @@ function exactIdentifierSeeds(g, query, limit, {repoRoot = null} = {}) {
     const identifiers = [...new Set((String(query || '').match(/[A-Za-z_$][A-Za-z0-9_$]*/g) || [])
         .filter((item) => /(?:[a-z0-9][A-Z]|_)/.test(item)).map((item) => item.toLowerCase()))]
     if (!identifiers.length) return []
-    const requestedClasses = requestedPathClasses(query), languageExtensions = requestedLanguages(query)
+    const requestedClasses = requestedPathClasses(query), languageExtensions = effectiveLanguages(g, query)
     const classifier = createPathClassifier(repoRoot), classificationCache = new Map(), matches = []
     for (const identifier of identifiers) {
         const candidates = g.nodes.filter((node) => String(node.label || '').replace(/\(\)$/, '').toLowerCase() === identifier
@@ -141,7 +147,7 @@ function conceptScore(g, node, concept, queryContext) {
         else if (term.length >= 4 && term !== 'tool' && term !== 'tools' && (id.includes(term) || label.includes(term))) match = Math.max(match, primary ? 12 : 7)
     })
     const extension = (/\.([^.\/]+)$/.exec(source) || [])[1] || ''
-    const languageConcept = {rust: ['rs'], python: ['py', 'pyi'], py: ['py', 'pyi'], typescript: ['ts', 'tsx', 'mts', 'cts'], ts: ['ts', 'tsx', 'mts', 'cts'], javascript: ['js', 'jsx', 'mjs', 'cjs'], js: ['js', 'jsx', 'mjs', 'cjs'], nodejs: ['js', 'jsx', 'mjs', 'cjs'], golang: ['go'], go: ['go'], java: ['java'], csharp: ['cs'], dotnet: ['cs']}[concept.raw]
+    const languageConcept = {rust: ['rs'], python: ['py', 'pyi'], py: ['py', 'pyi'], typescript: ['ts', 'tsx', 'mts', 'cts'], ts: ['ts', 'tsx', 'mts', 'cts'], javascript: ['js', 'jsx', 'mjs', 'cjs'], js: ['js', 'jsx', 'mjs', 'cjs'], nodejs: ['js', 'jsx', 'mjs', 'cjs'], golang: ['go'], go: ['go'], java: ['java'], csharp: ['cs'], dotnet: ['cs'], solidity: ['sol'], sql: ['sql'], schema: ['sql']}[concept.raw]
     if (languageConcept?.includes(extension) && queryContext.languageExtensions.has(extension)) match = Math.max(match, 58)
     const fileNode = !isSymbol(node.id), depth = source ? source.split('/').length : 9
     if (concept.id === 'bootstrap') match = Math.max(match, entrypointSignal(g, node, source, stem))
@@ -155,12 +161,22 @@ function conceptScore(g, node, concept, queryContext) {
     return Math.max(0, score)
 }
 
+// A requested language that matches ZERO nodes in this graph is over-eager inference (e.g.
+// "contract" inferring Solidity in a repo with no .sol files); drop the filter rather than
+// eliminate every candidate and return nothing.
+function effectiveLanguages(g, query) {
+    const languageExtensions = requestedLanguages(query)
+    if (languageExtensions.size && !g.nodes.some((node) => matchesLanguage(node, languageExtensions))) return new Set()
+    return languageExtensions
+}
+
 export function findSeeds(g, query, limit = 8, {repoRoot = null} = {}) {
     const exact = exactIdentifierSeeds(g, query, limit, {repoRoot})
     if (exact.length) return exact
-    const concepts = queryConcepts(query)
+    let concepts = queryConcepts(query)
+    if (!concepts.length) concepts = queryConcepts(query, {relaxStop: true})
     if (!concepts.length || limit <= 0) return []
-    const requestedClasses = requestedPathClasses(query), languageExtensions = requestedLanguages(query)
+    const requestedClasses = requestedPathClasses(query), languageExtensions = effectiveLanguages(g, query)
     const queryContext = {runtimeIntent: concepts.some((concept) => concept.id === 'bootstrap' || concept.id === 'tool-execution'), maintenanceIntent: wordsOf(query).some((word) => ['script', 'scripts', 'build', 'release', 'publish', 'packaging'].includes(word)), languageExtensions}
     const classifier = createPathClassifier(repoRoot), classificationCache = new Map()
     const rows = g.nodes.filter((node) => matchesLanguage(node, languageExtensions) && isQueryEligible(node, requestedClasses, classificationCache, classifier)).map((node) => {

package/src/precision/typescript-provider/client.js

@@ -37,6 +37,7 @@ export async function createTypeScriptLspClient({repoRoot, timeoutMs = 10_000} =
                 textDocument: {
                     definition: {linkSupport: true},
                     references: {},
+                    rename: {},
                     publishDiagnostics: {relatedInformation: false},
                 },
             },
@@ -68,6 +69,12 @@ export async function createTypeScriptLspClient({repoRoot, timeoutMs = 10_000} =
         references(relPath, position, includeDeclaration = true, referenceTimeoutMs = timeoutMs) {
             return client.references({filePath: relPath, position, includeDeclaration, timeoutMs: referenceTimeoutMs})
         },
+        // Generic read-only JSON-RPC passthrough plus URI normalization, so consumers outside
+        // the core (weavatrix-refactor) can issue their own read-only LSP requests. The client
+        // still refuses workspace/applyEdit, so nothing here can apply an edit.
+        request(method, params, options) { return client.request(method, params, options) },
+        toUri(relPath) { return client.normalizer.toUri(relPath) },
+        fromUri(uri) { return client.normalizer.fromUri(uri) },
         definition(relPath, position) { return client.definition({filePath: relPath, position}) },
         closeDocument(relPath) { return client.closeDocument(relPath) },
         async close(shutdownTimeoutMs = timeoutMs) {

package/src/security/advisory-store.js

@@ -76,7 +76,6 @@ export function normalizeOsvAdvisory(record, ecosystem, name) {
     kind: String(record.id || '').startsWith('MAL-') ? 'malicious' : 'vuln',
     severity: severityOf(record),
     summary: String(record.summary || record.details || '').slice(0, 300),
-    url: `https://osv.dev/vulnerability/${record.id}`,
     modified: record.modified || '',
     aliases: (record.aliases || []).slice(0, 6),
     fixedIn: [...new Set(fixed)].slice(0, 4),

package/src/security/malware-heuristics.exclusions.js

@@ -111,7 +111,7 @@ export function installScriptSnippet(scripts = {}) {
 }
 
 // weak URL rules only: URL evidence in a license/prose file or in comment/doc-link context is
-// documentation, not behavior (LICENSE:5 "http://www.apache.org/licenses/" was the hot FP).
+// documentation, not behavior (a license-header scheme reference on LICENSE line 5 was the hot FP).
 // Strong rules (miner/shell/exfil-url) are untouched and still scan those same files.
 export function isDocUrlNoise(file, signal) {
   if (!NOISY_URL_KEYS.has(signal?.key)) return false;

package/src/security/registry-sig.rules.js

@@ -77,7 +77,7 @@ export const CONTENT_RULES = [
     severity: "medium", // raw-IP URLs have some legit uses (local tooling) — escalates via co-occurrence
     nearZeroFp: false,
     pattern: "https?://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}",
-    re: /https?:\/\/(?!127\.|0\.0\.0\.0|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.)[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/i, // /i: rg sweeps -i; URL schemes are case-insensitive (HTTP:// is a known evasion)
+    re: /https?:\/\/(?!127\.|0\.0\.0\.0|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.)[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/i, // /i: rg sweeps -i; schemes are case-insensitive (an uppercase scheme prefix is a known evasion)
     what: "hardcoded raw-IP URL (loopback/private/link-local ranges excluded)", // 169.254.169.254 = cloud IMDS (AWS/GCP/Azure SDK metadata) — benign, was a hot FP
   },
   {