weavatrix 0.3.13 → 1.0.0

package/src/analysis/git-history/collector.js

@@ -1,67 +0,0 @@
-import {isWeavatrixIgnored} from '../../path-ignore.js'
-import {
-    boundedHistoryInteger,
-    GIT_HISTORY_DEFAULTS as DEFAULTS,
-    GIT_HISTORY_HARD_CAPS as HARD_CAPS,
-    safeHistoryPath,
-} from './options.js'
-
-const HEADER_SEPARATOR = '\x1e'
-const FIELD_SEPARATOR = '\x1f'
-
-// git subprocess execution (sync runGit + streaming boundedGitCommand) lives in ../../git-exec.js.
-
-const statNumber = (value) => value === '-'
-    ? {value: 0, binary: true}
-    : {value: Number(value), binary: false}
-
-export function parseGitNumstatLog(raw, options = {}) {
-    const maxFiles = boundedHistoryInteger(options.maxFilesPerCommit, DEFAULTS.maxFilesPerCommit, 2, HARD_CAPS.maxFilesPerCommit)
-    const ignoreRules = options.ignoreRules || []
-    const text = Buffer.isBuffer(raw) ? raw.toString('utf8') : String(raw || '')
-    const segments = text.split(HEADER_SEPARATOR).slice(1)
-    if (options.dropLastIncomplete && segments.length) segments.pop()
-    const commits = []
-    for (const segment of segments) {
-        const firstNul = segment.indexOf('\0')
-        if (firstNul < 0) continue
-        const header = segment.slice(0, firstNul).replace(/^[\r\n]+/, '')
-        const separator = header.indexOf(FIELD_SEPARATOR)
-        if (separator < 0) continue
-        const hash = header.slice(0, separator), timestamp = Number(header.slice(separator + 1))
-        if (!/^[a-f0-9]{40,64}$/i.test(hash) || !Number.isInteger(timestamp) || timestamp < 0) continue
-        const tokens = segment.slice(firstNul + 1).split('\0'), files = new Map()
-        let fileCount = 0, ignoredFiles = 0, invalidPaths = 0, oversized = false
-        for (let index = 0; index < tokens.length; index += 1) {
-            const token = tokens[index].replace(/^[\r\n]+/, '')
-            const match = /^(\d+|-)\t(\d+|-)\t(.*)$/s.exec(token)
-            if (!match) continue
-            let rawPath = match[3], renamedFrom = null
-            if (!rawPath) {
-                renamedFrom = safeHistoryPath(tokens[index + 1])
-                rawPath = tokens[index + 2]
-                index += 2
-            }
-            const path = safeHistoryPath(rawPath)
-            if (!path) { invalidPaths++; continue }
-            if (isWeavatrixIgnored(path, ignoreRules)) { ignoredFiles++; continue }
-            const additions = statNumber(match[1]), deletions = statNumber(match[2])
-            fileCount++
-            if (fileCount > maxFiles) { oversized = true; files.clear(); continue }
-            if (oversized) continue
-            const previous = files.get(path)
-            files.set(path, {
-                file: path,
-                additions: (previous?.additions || 0) + additions.value,
-                deletions: (previous?.deletions || 0) + deletions.value,
-                binary: Boolean(previous?.binary || additions.binary || deletions.binary),
-                ...(renamedFrom ? {renamedFrom} : previous?.renamedFrom ? {renamedFrom: previous.renamedFrom} : {}),
-            })
-        }
-        commits.push({
-            hash, timestamp, fileCount, ignoredFiles, invalidPaths, oversized,
-            files: oversized ? [] : [...files.values()].sort((a, b) => a.file.localeCompare(b.file)),
-        })
-    }
-    return commits
-}

package/src/analysis/git-history/options.js

@@ -1,66 +0,0 @@
-import {isAbsolute} from 'node:path'
-import {boundedInteger} from '../../util.js'
-
-export const GIT_HISTORY_V = 1
-export const GIT_HISTORY_WINDOWS = Object.freeze([3, 6, 12])
-export const GIT_HISTORY_DEFAULTS = Object.freeze({
-    months: 6,
-    maxCommits: 500,
-    maxFilesPerCommit: 80,
-    maxPairs: 100,
-    minPairCount: 2,
-    maxPairCandidates: 100_000,
-    maxOutputBytes: 16 * 1024 * 1024,
-    timeoutMs: 20_000,
-})
-export const GIT_HISTORY_HARD_CAPS = Object.freeze({
-    maxCommits: 2_000,
-    maxFilesPerCommit: 200,
-    maxPairs: 500,
-    maxPairCandidates: 250_000,
-    maxOutputBytes: 64 * 1024 * 1024,
-    timeoutMs: 60_000,
-})
-export const GIT_FORMAT = '%x1e%H%x1f%ct'
-
-export const graphEndpoint = (value) => value && typeof value === 'object' ? value.id : value
-export const roundHistoryNumber = (value, digits = 4) => {
-    if (!Number.isFinite(value)) return 0
-    const scale = 10 ** digits
-    return Math.round(value * scale) / scale
-}
-export const boundedHistoryInteger = boundedInteger
-
-export function safeHistoryPath(value) {
-    const path = String(value || '').replace(/\\/g, '/').replace(/^\.\//, '')
-    if (!path || path.includes('\0') || isAbsolute(path) || /^[a-z]:\//i.test(path)) return null
-    if (/[\x00-\x1f\x7f]/.test(path)) return null
-    const parts = path.split('/')
-    return parts.some((part) => !part || part === '.' || part === '..') ? null : path
-}
-
-export function utcMonthsBefore(date, months) {
-    const source = new Date(date)
-    if (!Number.isFinite(source.getTime())) throw new Error('now must be a valid date')
-    const targetMonth = source.getUTCMonth() - months
-    const first = new Date(Date.UTC(source.getUTCFullYear(), targetMonth, 1, source.getUTCHours(), source.getUTCMinutes(), source.getUTCSeconds(), source.getUTCMilliseconds()))
-    const lastDay = new Date(Date.UTC(first.getUTCFullYear(), first.getUTCMonth() + 1, 0)).getUTCDate()
-    first.setUTCDate(Math.min(source.getUTCDate(), lastDay))
-    return first
-}
-
-export function normalizeGitHistoryOptions(input = {}) {
-    const defaults = GIT_HISTORY_DEFAULTS, caps = GIT_HISTORY_HARD_CAPS
-    const months = Number(input.months ?? defaults.months)
-    if (!GIT_HISTORY_WINDOWS.includes(months)) throw new Error('months must be one of 3, 6 or 12')
-    return {
-        months,
-        maxCommits: boundedHistoryInteger(input.maxCommits, defaults.maxCommits, 1, caps.maxCommits),
-        maxFilesPerCommit: boundedHistoryInteger(input.maxFilesPerCommit, defaults.maxFilesPerCommit, 2, caps.maxFilesPerCommit),
-        maxPairs: boundedHistoryInteger(input.maxPairs, defaults.maxPairs, 1, caps.maxPairs),
-        minPairCount: boundedHistoryInteger(input.minPairCount, defaults.minPairCount, 1, 100),
-        maxPairCandidates: boundedHistoryInteger(input.maxPairCandidates, defaults.maxPairCandidates, 100, caps.maxPairCandidates),
-        maxOutputBytes: boundedHistoryInteger(input.maxOutputBytes, defaults.maxOutputBytes, 64 * 1024, caps.maxOutputBytes),
-        timeoutMs: boundedHistoryInteger(input.timeoutMs, defaults.timeoutMs, 1_000, caps.timeoutMs),
-    }
-}

package/src/analysis/git-history.js

@@ -1,143 +0,0 @@
-// Public facade and bounded local collector for behavioral Git-history intelligence.
-import {childProcessEnv} from '../child-env.js'
-import {createRepoBoundary} from '../repo-path.js'
-import {loadWeavatrixIgnore} from '../path-ignore.js'
-import {buildGitHistoryAnalytics} from './git-history/analytics.js'
-import {parseGitNumstatLog} from './git-history/collector.js'
-import {boundedGitCommand} from '../git-exec.js'
-import {
-    boundedHistoryInteger,
-    GIT_FORMAT,
-    GIT_HISTORY_V,
-    normalizeGitHistoryOptions,
-    utcMonthsBefore,
-} from './git-history/options.js'
-
-export {buildGitHistoryAnalytics} from './git-history/analytics.js'
-export {parseGitNumstatLog} from './git-history/collector.js'
-export {GIT_HISTORY_V, GIT_HISTORY_WINDOWS} from './git-history/options.js'
-
-const unavailableResult = (window, limits, reason) => ({
-    gitHistoryV: GIT_HISTORY_V,
-    status: 'unavailable',
-    window,
-    limits,
-    completeness: {complete: false, reasons: [reason]},
-    totals: {
-        commitsRead: 0, commitsAnalyzed: 0, oversizedCommitsSkipped: 0, files: 0,
-        additions: 0, deletions: 0, churn: 0, binaryChanges: 0, ignoredFiles: 0,
-        invalidPaths: 0, graphFiles: 0,
-    },
-    fileChurn: [],
-    hotspots: [],
-    coupling: {eligibleCommits: 0, totalCandidates: 0, candidatesTruncated: false, observed: [], expectedTestSource: [], hidden: []},
-})
-
-export async function analyzeGitHistory(input = {}) {
-    const options = normalizeGitHistoryOptions(input)
-    const now = new Date(input.now ?? Date.now())
-    if (!Number.isFinite(now.getTime())) throw new Error('now must be a valid date')
-    const since = utcMonthsBefore(now, options.months)
-    const window = {months: options.months, since: since.toISOString(), until: now.toISOString()}
-    const limits = {
-        maxCommits: options.maxCommits,
-        maxFilesPerCommit: options.maxFilesPerCommit,
-        maxPairs: options.maxPairs,
-        minPairCount: options.minPairCount,
-        maxPairCandidates: options.maxPairCandidates,
-    }
-    const boundary = createRepoBoundary(input.repoRoot)
-    if (!boundary.root) return unavailableResult(window, limits, 'repository root is unavailable')
-    const args = [
-        'log', '--no-merges', '--numstat', '-z', `--format=${GIT_FORMAT}`,
-        `--since=${window.since}`, `--until=${window.until}`, `--max-count=${options.maxCommits + 1}`,
-        '--', '.',
-    ]
-    let execution
-    try {
-        execution = await (input.runner || boundedGitCommand)('git', args, {
-            cwd: boundary.root,
-            env: childProcessEnv(),
-            timeoutMs: options.timeoutMs,
-            maxOutputBytes: options.maxOutputBytes,
-        })
-    } catch (error) {
-        return unavailableResult(window, limits, String(error?.message || 'git history collection failed').slice(0, 200))
-    }
-    if (execution.exitCode !== 0 && !execution.truncated) return unavailableResult(window, limits, 'git log failed')
-    const raw = Buffer.isBuffer(execution.stdout) ? execution.stdout : Buffer.from(String(execution.stdout || ''))
-    const tooLarge = raw.length > options.maxOutputBytes
-    const truncated = Boolean(execution.truncated || tooLarge)
-    const bounded = tooLarge ? raw.subarray(0, options.maxOutputBytes) : raw
-    const parsed = parseGitNumstatLog(bounded, {
-        maxFilesPerCommit: options.maxFilesPerCommit,
-        ignoreRules: loadWeavatrixIgnore(boundary.root),
-        dropLastIncomplete: truncated,
-    })
-    const commitsTruncated = parsed.length > options.maxCommits
-    return buildGitHistoryAnalytics({
-        commits: parsed.slice(0, options.maxCommits),
-        graph: input.graph || {},
-        window,
-        limits,
-        status: truncated || commitsTruncated ? 'partial' : 'complete',
-    })
-}
-
-export function formatGitHistoryAnalytics(result, options = {}) {
-    const topN = boundedHistoryInteger(options.topN, 10, 1, 50)
-    if (!result || result.status === 'unavailable') {
-        return `Git history intelligence: UNAVAILABLE — ${result?.completeness?.reasons?.[0] || 'history is unavailable'}`
-    }
-    const window = result.window
-        ? `${result.window.months} months (${result.window.since.slice(0, 10)} → ${result.window.until.slice(0, 10)})`
-        : 'configured window'
-    const lines = [
-        `Git history intelligence — ${window}`,
-        `Status: ${String(result.status).toUpperCase()} · ${result.totals.commitsAnalyzed}/${result.totals.commitsRead} commits analyzed · ${result.totals.files} files · ${result.totals.churn} changed lines`,
-        '',
-        'Hotspots (churn percentile × graph-connectivity percentile):',
-    ]
-    const hotspots = result.hotspots.slice(0, topN)
-    if (!hotspots.length) lines.push('- none')
-    for (const item of hotspots) lines.push(`- ${item.file}: score ${item.hotspotScore.toFixed(4)} · churn ${item.churn} in ${item.commits} commits · connectivity ${item.connectivity}`)
-    lines.push('', 'Hidden co-change coupling (no graph path within 2 hops):')
-    const hidden = result.coupling.hidden.slice(0, topN)
-    if (!hidden.length) lines.push('- none')
-    for (const pair of hidden) lines.push(`- ${pair.left} ↔ ${pair.right}: ${pair.count} commits · Jaccard ${pair.jaccard.toFixed(4)} · lift ${pair.lift.toFixed(4)} · confidence ${pair.confidence.toFixed(4)}`)
-    lines.push('', 'Expected test/source co-change:')
-    const expected = result.coupling.expectedTestSource.slice(0, topN)
-    if (!expected.length) lines.push('- none')
-    for (const pair of expected) lines.push(`- ${pair.test} ↔ ${pair.source}: ${pair.count} commits · confidence ${pair.confidence.toFixed(4)}`)
-    if (result.completeness.reasons.length) lines.push('', `Partial: ${result.completeness.reasons.join('; ')}.`)
-    return lines.join('\n')
-}
-
-export function boundGitHistoryAnalytics(result, options = {}) {
-    const topN = boundedHistoryInteger(options.topN, 10, 1, 50)
-    const source = result && typeof result === 'object' ? result : {}
-    const coupling = source.coupling && typeof source.coupling === 'object' ? source.coupling : {}
-    const collections = {}
-    const cap = (name, value) => {
-        const items = Array.isArray(value) ? value : []
-        const bounded = items.slice(0, topN)
-        collections[name] = {total: items.length, returned: bounded.length, truncated: items.length > bounded.length}
-        return bounded
-    }
-    const bounded = {
-        ...source,
-        limits: {...(source.limits || {}), topN},
-        fileChurn: cap('fileChurn', source.fileChurn),
-        hotspots: cap('hotspots', source.hotspots),
-        coupling: {
-            ...coupling,
-            observed: cap('coupling.observed', coupling.observed),
-            expectedTestSource: cap('coupling.expectedTestSource', coupling.expectedTestSource),
-            hidden: cap('coupling.hidden', coupling.hidden),
-        },
-    }
-    return {
-        result: bounded,
-        page: {limit: topN, truncated: Object.values(collections).some((entry) => entry.truncated), collections},
-    }
-}

package/src/analysis/git-ref-graph.js

@@ -1,76 +0,0 @@
-// Build a source graph for an immutable Git commit without mutating the user's worktree.
-// The commit is first resolved to a full object id, then exported into a private temporary
-// directory. No hooks are run and no branch/worktree metadata is changed.
-import {mkdtempSync, mkdirSync, rmSync} from 'node:fs'
-import {join} from 'node:path'
-import {tmpdir} from 'node:os'
-import {runGit} from '../git-exec.js'
-import {runCommandSync} from '../process.js'
-import {buildInternalGraph} from '../graph/internal-builder.js'
-import {filterGraphForMode} from '../graph/graph-filter.js'
-
-const SAFE_REF = /^(?!-)[A-Za-z0-9][A-Za-z0-9._\/@{}+~^-]{0,199}$/
-
-function git(repoRoot, args, timeout = 15_000) {
-    return runGit(repoRoot, args, {timeout, maxBuffer: 4 * 1024 * 1024})
-}
-
-export function resolveGitCommit(repoRoot, requestedRef) {
-    const ref = String(requestedRef || '').trim()
-    if (!SAFE_REF.test(ref)) return {ok: false, error: 'base_ref contains unsupported characters'}
-    const result = git(repoRoot, ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`])
-    const commit = String(result.stdout || '').trim()
-    if (result.status !== 0 || !/^[a-f0-9]{40,64}$/i.test(commit)) {
-        return {ok: false, error: `could not resolve Git ref "${ref}" to a commit`}
-    }
-    return {ok: true, ref, commit}
-}
-
-export async function withGitRefCheckout(repoRoot, requestedRef, operation) {
-    const resolved = resolveGitCommit(repoRoot, requestedRef)
-    if (!resolved.ok) return resolved
-    const temp = mkdtempSync(join(tmpdir(), 'weavatrix-git-ref-'))
-    const checkout = join(temp, 'repo')
-    const archive = join(temp, 'source.tar')
-    mkdirSync(checkout, {recursive: true})
-    try {
-        const archived = git(repoRoot, ['archive', '--format=tar', `--output=${archive}`, resolved.commit], 60_000)
-        if (archived.status !== 0) {
-            return {ok: false, error: `git archive failed for ${resolved.ref}: ${String(archived.stderr || '').trim() || 'unknown error'}`}
-        }
-        const extracted = runCommandSync('tar', ['-xf', archive, '-C', checkout], {timeout: 60_000, maxBuffer: 4 * 1024 * 1024})
-        if (extracted.status !== 0) {
-            return {ok: false, error: `temporary Git archive extraction failed: ${String(extracted.stderr || '').trim() || 'tar unavailable'}`}
-        }
-        // A normal build asks Git for tracked + non-ignored files. A plain archive has no .git
-        // directory, so the fallback walker deliberately skips tracked dot paths such as
-        // .github/workflows. Recreate only an index over the immutable archive (no commit, hooks or
-        // checkout) so live and baseline graphs use the same file-universe semantics.
-        const initialized = git(checkout, ['init', '--quiet'])
-        if (initialized.status !== 0) {
-            return {ok: false, error: `temporary Git index initialization failed: ${String(initialized.stderr || '').trim() || 'unknown error'}`}
-        }
-        const indexed = git(checkout, ['add', '--all', '--force'], 60_000)
-        if (indexed.status !== 0) {
-            return {ok: false, error: `temporary Git index population failed: ${String(indexed.stderr || '').trim() || 'unknown error'}`}
-        }
-        const value = await operation(checkout, resolved)
-        return {ok: true, ref: resolved.ref, commit: resolved.commit, value}
-    } catch (error) {
-        return {ok: false, error: error instanceof Error ? error.message : String(error)}
-    } finally {
-        rmSync(temp, {recursive: true, force: true})
-    }
-}
-
-export async function buildGraphAtGitRef(repoRoot, requestedRef, {mode = 'full'} = {}) {
-    const buildMode = ['full', 'no-tests', 'tests-only'].includes(mode) ? mode : 'full'
-    const result = await withGitRefCheckout(repoRoot, requestedRef, async (checkout) => {
-        const fullGraph = await buildInternalGraph(checkout)
-        return {
-            ...filterGraphForMode(fullGraph, buildMode, {repoRoot: checkout}),
-            graphBuildMode: buildMode,
-        }
-    })
-    return result.ok ? {...result, graph: result.value} : result
-}

package/src/analysis/go-dependency-evidence.js

@@ -1,62 +0,0 @@
-import { createRepoBoundary } from "../repo-path.js";
-import { computeGoDepFindings } from "./dep-check-ecosystems.js";
-import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
-import { parseGoMod } from "./manifests.js";
-import { makeFinding } from "./findings.js";
-import { dependencyScopeOwnsFile, dependencyScopeRoot } from "./dependency/scoped-dependencies.js";
-
-export function collectGoDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [], nonRuntimeRoots = [] } = {}) {
-  const boundary = createRepoBoundary(repoRoot);
-  const manifests = files.filter((file) => /(^|\/)go\.mod$/i.test(file));
-  const scopes = manifests.map((file) => ({ file, root: dependencyScopeRoot(file), parsed: parseGoMod(readRepoText(boundary, file)) }))
-    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
-  const importsByScope = new Map(scopes.map((scope) => [scope, []]));
-  for (const entry of externalImports) {
-    if (entry.ecosystem !== "Go") continue;
-    const owner = scopes.find((scope) => dependencyScopeOwnsFile(scope.root, entry.file));
-    if (owner) importsByScope.get(owner).push(entry);
-  }
-  const findings = [], declared = new Set(), issues = [];
-  if (!scopes.length) {
-    const missing = new Map();
-    for (const entry of externalImports.filter((item) => item.ecosystem === "Go" && item.pkg && !item.builtin && !item.unresolved)) {
-      if (!missing.has(entry.pkg)) missing.set(entry.pkg, entry);
-    }
-    for (const [name, entry] of missing) findings.push(makeFinding({
-      category: "unused", rule: "missing-dep", severity: "low", confidence: "high",
-      title: `Go import without a module manifest: ${name}`,
-      reason: "An indexed external Go import exists, but no go.mod was discovered.",
-      detail: `"${entry.spec || name}" is imported by ${entry.file}, but no go.mod exists in the repository.`,
-      package: name, file: entry.file, line: entry.line || 0, source: "internal",
-      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_PRESENT" }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Go module prefix" },
-      fixHint: "initialize or restore the owning Go module manifest",
-    }));
-  }
-  for (const scope of scopes) {
-    if (!scope.parsed.module) issues.push(`${scope.file}: module directive is missing or unreadable`);
-    const result = computeGoDepFindings({ externalImports: importsByScope.get(scope), goMod: scope.parsed, nonRuntimeRoots });
-    findings.push(...result.findings.map((finding) => ({
-      ...finding,
-      manifest: scope.file,
-      verification: finding.rule === "missing-dep"
-        ? { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", file: scope.file }, indexedSourceImports: { status: "FOUND", count: finding.evidence?.length || 1, files: (finding.evidence || []).map((item) => item.file) }, mapping: "longest go.mod module prefix" }
-        : { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "REVIEW_REQUIRED", manifestDeclaration: { status: "FOUND", file: scope.file }, indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] }, mapping: "longest go.mod module prefix" },
-    })));
-    for (const name of result.declared) declared.add(`${scope.root || "."}:${name}`);
-  }
-  const present = manifests.length > 0;
-  return {
-    present,
-    status: present ? "CHECKED" : "NOT_PRESENT",
-    completeness: present ? (issues.length ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
-    manifests,
-    declared,
-    findings,
-    reasons: issues,
-    reason: !present
-      ? "No go.mod was discovered."
-      : issues.length
-        ? `Go imports and requirements were checked across ${manifests.length} module(s), but ${issues.length} module descriptor(s) were incomplete.`
-        : `Every discovered go.mod scope (${manifests.length}) was compared with indexed Go imports, including direct/indirect requirements and replace directives.`,
-  };
-}