weavatrix 0.3.14 → 1.1.0

package/src/analysis/dep-check.js

@@ -1,290 +0,0 @@
-// Pure dependency checker (replaces depcheck + knip's dependency output) — set math over the graph's
-// externalImports vs package.json. NO filesystem here: the fs wrapper is internal-audit.js, so this is
-// fully unit-testable (same pattern as dead-check.js computeDead). See DEPS_SECURITY_PLAN.md (P1).
-//
-// Philosophy: bias to FALSE-NEGATIVES. A dep we can't prove unused stays unflagged (or drops to low
-// confidence) — knip's ~100 framework plugins know config conventions we don't, so we compensate with
-// script/config-text mention scanning + a config-ecosystem prefix rule, and we NEVER say "safe to
-// auto-remove", only "review".
-import { makeFinding } from "./findings.js";
-import {FRAMEWORK_RUNTIME_PEERS, IMPLICIT_STYLE_COMPILERS} from './dependency/conventions.js'
-import {createScopedDepFindings} from './dependency/scoped-dependencies.js'
-import {createPackageSourceMatcher} from './dependency/source-references.js'
-
-// Packages referenced by config CONVENTION, not imports (eslint extends "airbnb" → eslint-config-airbnb).
-// Flagged only at low confidence when nothing mentions them anywhere.
-const CONFIG_ECOSYSTEM_RE = /^(eslint-(config|plugin)-|@typescript-eslint\/|@eslint\/|prettier-plugin-|postcss-|autoprefixer$|tailwindcss$|babel-(plugin|preset)-|@babel\/(plugin|preset)-|stylelint-|@commitlint\/|commitlint-|remark-|rehype-|@semantic-release\/|karma-|grunt-|gulp-)/;
-
-// CLI name → package name, for script commands whose binary doesn't equal the package
-// (`tsc` comes from typescript, `depcruise` from dependency-cruiser, …).
-const BIN_PKG = {
-  tsc: "typescript", depcruise: "dependency-cruiser", "vue-cli-service": "@vue/cli-service",
-  ng: "@angular/cli", nest: "@nestjs/cli", sb: "storybook",
-  "electron-rebuild": "@electron/rebuild", playwright: "@playwright/test",
-};
-
-const isStylesheetSpecifier = (spec) => /\.(?:css|scss|sass|less|styl(?:us)?)(?:[?#].*)?$/i.test(String(spec || ""));
-const escRe = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-// word-ish mention: the name not embedded inside a longer identifier/path segment
-const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\w.-])`).test(blob);
-
-// computeDepFindings({ externalImports, pkg, workspacePkgNames, configTexts }) → { findings, usedPackages }
-//   externalImports — graph.json's array (P0): {file, spec, pkg, builtin, kind, line, dynamic?, unresolved?}
-//   pkg             — parsed package.json ({} for non-JS repos → no dep findings)
-//   workspacePkgNames — Set of monorepo-local package names (never "missing")
-//   configTexts     — Map<fileName, text> of root config files + CI workflows (mention scanning)
-//   sourceTexts     — Map<fileName, text> for narrow dynamic/package-path literal evidence
-export function computeDepFindings({
-  externalImports = [], pkg = {}, workspacePkgNames = new Set(), configTexts = new Map(),
-  sourceTexts = new Map(), aliases = [], scope = "", manifest = "package.json", nonRuntimeRoots = [], sourceFiles = [],
-} = {}) {
-  const findings = [];
-  const meta = { scope: scope || ".", manifest };
-  const isAliasSpec = (spec) => aliases.some((a) => {
-    const s = String(spec || "");
-    const key = typeof a === "string" ? a : String(a?.key || "");
-    const prefix = typeof a === "string" ? a.replace(/\*.*$/, "") : String(a?.prefix || "");
-    const suffix = key.includes("*") ? key.slice(key.indexOf("*") + 1) : String(a?.suffix || "");
-    return key.includes("*")
-      ? !!prefix && s.startsWith(prefix) && (!suffix || s.endsWith(suffix))
-      : !!key && s === key;
-  });
-  const sections = {
-    dependencies: pkg.dependencies || {},
-    devDependencies: pkg.devDependencies || {},
-    peerDependencies: pkg.peerDependencies || {},
-    optionalDependencies: pkg.optionalDependencies || {},
-  };
-  const allDeclared = new Set(Object.values(sections).flatMap((s) => Object.keys(s)));
-  const selfName = String(pkg.name || "");
-  const normRoots = (nonRuntimeRoots || []).map((root) => String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "")).filter(Boolean);
-  const isNonRuntimeFile = (file) => {
-    const normalized = String(file || "").replace(/\\/g, "/").replace(/^\.\//, "");
-    return normRoots.some((root) => normalized === root || normalized.startsWith(`${root}/`));
-  };
-  const npmNameParts = (name) => {
-    const value = String(name || "");
-    const slash = value.startsWith("@") ? value.indexOf("/") : -1;
-    return slash > 0 ? { scope: value.slice(0, slash), base: value.slice(slash + 1) } : { scope: "", base: value };
-  };
-  const selfParts = npmNameParts(selfName);
-  const configuredNapi = npmNameParts(pkg.napi?.name || selfName);
-  const napiBinding = {
-    scope: configuredNapi.scope || (configuredNapi.base === selfParts.base ? selfParts.scope : ""),
-    base: configuredNapi.base,
-  };
-  const NAPI_PLATFORM_SUFFIX = /^(?:android-(?:arm64|arm-eabi)|win32-(?:x64|ia32|arm64)-msvc|darwin-(?:universal|x64|arm64)|freebsd-(?:x64|arm64)|linux-(?:x64|arm64|arm|riscv64|s390x|ppc64|loong64)-(?:gnu|musl|gnueabihf|musleabihf)|aix-ppc64|sunos-x64|wasm32-wasi(?:-preview1-threads)?)$/;
-  const isGeneratedNapiPackage = (name, files) => {
-    if (!pkg.napi || !napiBinding.base || !files.every((file) => /(^|\/)index\.[cm]?js$/i.test(String(file || "").replace(/\\/g, "/")))) return false;
-    const candidate = npmNameParts(name);
-    if (candidate.scope !== napiBinding.scope || !candidate.base.startsWith(`${napiBinding.base}-`)) return false;
-    return NAPI_PLATFORM_SUFFIX.test(candidate.base.slice(napiBinding.base.length + 1));
-  };
-  const isGeneratedNapiBinary = (entry) => !!pkg.napi
-    && /(^|\/)index\.[cm]?js$/i.test(String(entry.file || "").replace(/\\/g, "/"))
-    && /^\.\/[^/]+\.node$/i.test(String(entry.spec || ""));
-  // Some frameworks consume required peers internally, so application source legitimately never imports
-  // them. Keep this deliberately narrow: react-dom is a required Next.js runtime peer in the same package
-  // scope, not a general React exemption and not a repo-wide whitelist.
-  const frameworkRuntime = new Set();
-  for (const [provider, peers] of FRAMEWORK_RUNTIME_PEERS) {
-    if (allDeclared.has(provider)) for (const peer of peers) frameworkRuntime.add(peer);
-  }
-  const implicitCompilerUsage = new Set();
-  for (const [name, sourcePattern] of IMPLICIT_STYLE_COMPILERS) {
-    if (allDeclared.has(name) && sourceFiles.some((file) => sourcePattern.test(String(file || "")))) {
-      implicitCompilerUsage.add(name);
-    }
-  }
-
-  // ---- usage index from the graph's recorded imports ----
-  const usedPackages = new Map(); // pkgName -> { files:Set, lines:Map(file→first line), kinds/specs:Set, typeOnly:boolean }
-  let builtinUsed = false;
-  for (const e of externalImports) {
-    if (e.ecosystem && e.ecosystem !== "npm") continue; // go/python imports have their own checkers
-    if (isAliasSpec(e.spec)) continue;
-    if (e.unresolved) continue;
-    if (e.builtin) { builtinUsed = true; continue; }
-    if (!e.pkg) continue;
-    let u = usedPackages.get(e.pkg);
-    if (!u) usedPackages.set(e.pkg, (u = { files: new Set(), lines: new Map(), kinds: new Set(), specs: new Set(), typeOnly: true }));
-    u.files.add(e.file);
-    if (!u.lines.has(e.file)) u.lines.set(e.file, e.line || 0);
-    u.kinds.add(e.kind);
-    u.specs.add(e.spec || e.pkg);
-    if (!e.typeOnly) u.typeOnly = false;
-  }
-
-  const scriptBlob = Object.values(pkg.scripts || {}).join("\n");
-  const configBlob = scriptBlob + "\n" + [...configTexts.values()].join("\n");
-  const scriptTokens = new Set(scriptBlob.split(/[^\w@/.:-]+/).filter(Boolean));
-  const binReferenced = (name) => {
-    if (scriptTokens.has(name)) return true;
-    for (const [bin, p] of Object.entries(BIN_PKG)) if (p === name && scriptTokens.has(bin)) return true;
-    return false;
-  };
-  const typesBase = (name) => (name.startsWith("@types/") ? name.slice(7).replace(/^(.+?)__(.+)$/, "@$1/$2") : null); // @types/babel__core → @babel/core
-  const sourceReferenced = createPackageSourceMatcher(sourceTexts);
-
-  // ---- unused dependencies (per section; prod vs dev differ in severity/confidence) ----
-  for (const [section, deps] of Object.entries(sections)) {
-    if (section === "peerDependencies") continue; // peers are consumer-facing contracts, not usage
-    for (const name of Object.keys(deps)) {
-      if (name === selfName || usedPackages.has(name) || frameworkRuntime.has(name) || implicitCompilerUsage.has(name) || sourceReferenced(name)) continue;
-      const tb = typesBase(name);
-      if (tb) { // @types/x is used iff x is used (or it types the Node builtins)
-        if (tb === "node" ? builtinUsed : usedPackages.has(tb) || frameworkRuntime.has(tb) || mentioned(configBlob, tb)) continue;
-      }
-      if (binReferenced(name) || mentioned(configBlob, name)) continue; // scripts/config keep it alive
-      const ecosystem = CONFIG_ECOSYSTEM_RE.test(name);
-      const dev = section !== "dependencies";
-      if (ecosystem && dev) continue; // config-convention devDeps: too FP-prone to flag at all
-      findings.push(makeFinding({
-        category: "unused",
-        rule: "unused-dep",
-        severity: dev ? "info" : "low",
-        confidence: dev || ecosystem ? "low" : "medium",
-        title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,
-        reason: "No indexed package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
-        detail: `"${name}" is declared in ${section}, but no usage was found in the indexed source scope, package scripts, or ${configTexts.size} known config file(s). Dynamic/plugin/config-convention usage is not proven absent — review before removing.`,
-        file: manifest,
-        package: name,
-        evidence: [{ file: manifest, line: 0, snippet: `declared in ${section}` }],
-        source: "internal",
-        actionability: "MANIFEST_REVIEW_REQUIRED",
-        autoRemove: false,
-        verification: {
-          evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
-          manifestDeclaration: { status: "FOUND", file: manifest, section, version: String(deps[name] || "") },
-          indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0 },
-          packageScripts: { status: "CHECKED", matched: false },
-          knownConfigs: { status: "CHECKED", filesScanned: configTexts.size, matched: false },
-          frameworkPeerContract: "NOT_FOUND",
-          implicitCompilerInput: "NOT_FOUND",
-          dynamicOrPluginUsage: "NOT_PROVEN_ABSENT",
-          decision: "REVIEW_REQUIRED",
-        },
-        fixHint: `Review manifest/config/plugin usage; if confirmed unused, remove ${name} with the package manager and run targeted tests`,
-        ...meta,
-      }));
-    }
-  }
-
-  // ---- missing (phantom) dependencies: imported but declared nowhere ----
-  for (const [name, use] of usedPackages) {
-    if (allDeclared.has(name) || name === selfName || workspacePkgNames.has(name)) continue;
-    const files = [...use.files];
-    if (files.every(isNonRuntimeFile) || isGeneratedNapiPackage(name, files)) continue;
-    const testOnly = files.every((f) => /(^|[/\\])(test|tests|__tests__|spec|e2e|__mocks__)([/\\]|$)|[._-](test|spec)\.[a-z]+$/i.test(f));
-    const stylesheetOnly = [...use.specs].length > 0 && [...use.specs].every(isStylesheetSpecifier);
-    const usageReason = stylesheetOnly
-      ? `Direct stylesheet import(s) resolve through "${name}"; CSS-only imports are build/runtime inputs even without JavaScript bindings.`
-      : use.typeOnly
-        ? `Direct type-only import(s) resolve through "${name}"; the compiler still requires a declared package.`
-        : `Direct source import(s) resolve through "${name}", but the nearest package manifest does not declare it.`;
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "missing-dep",
-      severity: testOnly ? "low" : "medium",
-      confidence: "high",
-      title: `Missing dependency: ${name}`,
-      reason: usageReason,
-      detail: `"${name}" is imported by ${files.length} file(s) in scope ${meta.scope} but not declared in ${manifest} — it only works via a transitive install (phantom dependency) and can break on any lockfile change.`,
-      package: name,
-      file: files[0],
-      line: use.lines.get(files[0]) || 0,
-      evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),
-      source: "internal",
-      actionability: "STRONG_MANIFEST_MISMATCH",
-      autoInstall: false,
-      verification: {
-        evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
-        manifestDeclaration: { status: "NOT_FOUND", file: manifest, checkedSections: Object.keys(sections) },
-        indexedSourceImports: {
-          status: "FOUND",
-          completeness: "COMPLETE_FOR_GRAPH_SCOPE",
-          count: files.length,
-          files: files.slice(0, 20),
-          truncated: files.length > 20,
-          typeOnly: use.typeOnly,
-          stylesheetOnly,
-          testOnly,
-        },
-        packageScope: meta.scope,
-        transitiveResolutionRisk: "PRESENT",
-        decision: "DECLARE_AFTER_SCOPE_REVIEW",
-      },
-      fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,
-      ...meta,
-    }));
-  }
-
-  // ---- duplicate declarations (same package in several sections) ----
-  const seenIn = new Map();
-  for (const [section, deps] of Object.entries(sections)) for (const name of Object.keys(deps)) (seenIn.get(name) || seenIn.set(name, []).get(name)).push(section);
-  for (const [name, ss] of seenIn) {
-    if (ss.length < 2) continue;
-    if (ss.includes("peerDependencies") && ss.includes("devDependencies") && ss.length === 2) continue; // standard lib-author pattern
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "duplicate-dep",
-      severity: "info",
-      confidence: "high",
-      title: `Duplicate declaration: ${name}`,
-      reason: `The same package is declared in multiple manifest sections: ${ss.join(" + ")}.`,
-      detail: `"${name}" is declared in ${ss.join(" + ")} — npm resolves one of them; keep a single section.`,
-      package: name,
-      source: "internal",
-      actionability: "MANIFEST_REVIEW_REQUIRED",
-      autoRemove: false,
-      verification: {
-        evidenceModel: "MANIFEST_ONLY",
-        manifestDeclaration: { status: "DUPLICATE", file: manifest, sections: ss },
-        decision: "REVIEW_REQUIRED",
-      },
-      ...meta,
-    }));
-  }
-
-  // ---- unresolved local imports (broken relative/alias paths) ----
-  const unresolvedSeen = new Set();
-  let unresolvedCount = 0;
-  for (const e of externalImports) {
-    if (!e.unresolved) continue;
-    if (isNonRuntimeFile(e.file) || isGeneratedNapiBinary(e)) continue;
-    unresolvedCount++;
-    const key = e.file + "|" + e.spec;
-    if (unresolvedSeen.has(key) || unresolvedSeen.size >= 100) continue; // cap the findings, keep the count honest
-    unresolvedSeen.add(key);
-    findings.push(makeFinding({
-      category: "structure",
-      rule: "unresolved-import",
-      severity: "low",
-      confidence: "medium",
-      title: `Unresolved import: ${e.spec}`,
-      detail: `${e.file}:${e.line} imports "${e.spec}", which resolves to no file in the repo (broken path, missing alias target, or a file type the graph doesn't index).`,
-      file: e.file,
-      line: e.line || 0,
-      source: "internal",
-      ...meta,
-    }));
-  }
-  if (unresolvedCount > unresolvedSeen.size) {
-    findings.push(makeFinding({
-      category: "structure",
-      rule: "unresolved-import",
-      severity: "info",
-      confidence: "high",
-      title: `…and ${unresolvedCount - unresolvedSeen.size} more unresolved imports`,
-      detail: "Finding list capped at 100 unique unresolved imports; the count above is the true total.",
-      source: "internal",
-      ...meta,
-    }));
-  }
-
-  return { findings, usedPackages, declared: allDeclared };
-}
-
-export const computeScopedDepFindings = createScopedDepFindings(computeDepFindings)
-
-export { computeGoDepFindings, computePyDepFindings } from "./dep-check-ecosystems.js";

package/src/analysis/dep-rules.js

@@ -1,10 +0,0 @@
-// Stable facade for structural dependency analysis.
-export {
-    buildFileImportGraph,
-    checkBoundaries,
-    findOrphans,
-    findSccs,
-    globToRe,
-    representativeCycle,
-} from './structure/dependency-graph.js'
-export {computeStructureFindings, isRustModuleTreeComponent} from './structure/findings.js'

package/src/analysis/dependency/conventions.js

@@ -1,16 +0,0 @@
-// Exact package contracts consumed by frameworks/build tools without a source
-// import. Keep them package-scope local; these are not repo-wide allowlists.
-export const FRAMEWORK_RUNTIME_PEERS = new Map([
-    ['next', ['react-dom']],
-    ['vinext', ['@vitejs/plugin-react', '@vitejs/plugin-rsc', 'react-server-dom-webpack', 'vite']],
-    ['electron-vite', ['vite']],
-    ['@cloudflare/vite-plugin', ['vite', 'wrangler']],
-])
-
-// Style preprocessors are compiler inputs proven by source extensions.
-export const IMPLICIT_STYLE_COMPILERS = new Map([
-    ['sass', /\.(?:scss|sass)$/i],
-    ['sass-embedded', /\.(?:scss|sass)$/i],
-    ['less', /\.less$/i],
-    ['stylus', /\.styl(?:us)?$/i],
-])

package/src/analysis/dependency/scoped-dependencies.js

@@ -1,51 +0,0 @@
-import {posix} from 'node:path'
-
-export const normalizeDependencyScope = (root) => String(root || '').replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+|\/+$/g, '')
-export const dependencyScopeRoot = (manifest) => {
-    const root = posix.dirname(normalizeDependencyScope(manifest))
-    return root === '.' ? '' : root
-}
-export const dependencyScopeOwnsFile = (scope, file) => !scope || file === scope || String(file || '').startsWith(`${scope}/`)
-
-// Bind the ecosystem-specific core without introducing a facade/helper import cycle.
-export function createScopedDepFindings(computeDepFindings) {
-    return function computeScopedDepFindings({
-        externalImports = [], packageScopes = [], workspacePkgNames = new Set(), configTexts = new Map(),
-        sourceTexts = new Map(), nonRuntimeRoots = [], sourceFiles = [],
-    } = {}) {
-        const scopes = packageScopes.length
-            ? packageScopes.map((scope) => ({...scope, root: normalizeDependencyScope(scope.root)})).sort((a, b) => b.root.length - a.root.length)
-            : [{root: '', manifest: 'package.json', pkg: {}, aliases: []}]
-        const importsByScope = new Map(scopes.map((scope) => [scope, []]))
-        const sourceFilesByScope = new Map(scopes.map((scope) => [scope, []]))
-        const sourceTextsByScope = new Map(scopes.map((scope) => [scope, new Map()]))
-        for (const item of externalImports) {
-            const owner = scopes.find((scope) => dependencyScopeOwnsFile(scope.root, item.file)) || scopes[scopes.length - 1]
-            importsByScope.get(owner).push(item)
-        }
-        for (const file of sourceFiles) {
-            const owner = scopes.find((scope) => dependencyScopeOwnsFile(scope.root, file)) || scopes[scopes.length - 1]
-            sourceFilesByScope.get(owner).push(file)
-        }
-        for (const [file, text] of sourceTexts) {
-            const owner = scopes.find((scope) => dependencyScopeOwnsFile(scope.root, file)) || scopes[scopes.length - 1]
-            sourceTextsByScope.get(owner).set(file, text)
-        }
-        const configOwner = new Map()
-        for (const [file] of configTexts) configOwner.set(file, scopes.find((scope) => dependencyScopeOwnsFile(scope.root, file)) || scopes[scopes.length - 1])
-        const findings = [], usedPackages = new Map(), declared = new Set()
-        for (const scope of scopes) {
-            const scopeConfig = new Map([...configTexts].filter(([file]) => configOwner.get(file) === scope))
-            const result = computeDepFindings({
-                externalImports: importsByScope.get(scope), pkg: scope.pkg || {}, workspacePkgNames,
-                configTexts: scopeConfig, sourceTexts: sourceTextsByScope.get(scope), aliases: scope.aliases || [], scope: scope.root,
-                manifest: scope.manifest || (scope.root ? `${scope.root}/package.json` : 'package.json'),
-                nonRuntimeRoots, sourceFiles: sourceFilesByScope.get(scope),
-            })
-            findings.push(...result.findings)
-            for (const [name, use] of result.usedPackages) usedPackages.set(`${scope.root || '.'}:${name}`, use)
-            for (const name of result.declared) declared.add(`${scope.root || '.'}:${name}`)
-        }
-        return {findings, usedPackages, declared}
-    }
-}

package/src/analysis/dependency/source-references.js

@@ -1,21 +0,0 @@
-// Dynamic package loaders often construct a node_modules path instead of using
-// import/require, so they never become graph externalImports. Restrict this
-// fallback to executable npm source: manifests merely declare every dependency
-// and must never count as usage evidence.
-const NPM_SOURCE_RE = /\.(?:[cm]?[jt]sx?|vue|svelte)$/i
-const escRe = (value) => String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\w.-])`).test(blob)
-
-export function createPackageSourceMatcher(sourceTexts = new Map()) {
-    const blob = [...sourceTexts]
-        .filter(([file]) => NPM_SOURCE_RE.test(String(file || '')))
-        .map(([, text]) => String(text || ''))
-        .join('\n')
-    return (name) => {
-        if (mentioned(blob, name)) return true
-        if (!name.startsWith('@') || !name.includes('/')) return false
-        const [namespace, base] = name.split('/', 2)
-        // join(root, "node_modules", "@scope", "package", ...)
-        return new RegExp(`["'\x60]${escRe(namespace)}["'\x60][\\s\\S]{0,96}?["'\x60]${escRe(base)}["'\x60]`).test(blob)
-    }
-}

package/src/analysis/duplicate-groups.js

@@ -1,104 +0,0 @@
-import {createHash} from 'node:crypto'
-import {writeFileSync} from 'node:fs'
-import {join} from 'node:path'
-import {computeDuplicates} from './duplicates.js'
-import {withGitRefCheckout} from './git-ref-graph.js'
-import {buildInternalGraph} from '../graph/internal-builder.js'
-import {filterGraphForMode} from '../graph/graph-filter.js'
-
-const NON_PRODUCT = new Set(['generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
-const eligible = (fragment, settings) => {
-  const classes = new Set(fragment.classes || [])
-  if (fragment.n < settings.tokMin) return false
-  if (settings.skipTests && (fragment.test || classes.has('test') || classes.has('e2e'))) return false
-  return settings.includeClassified || !(fragment.excluded || [...classes].some((name) => NON_PRODUCT.has(name)))
-}
-
-function groupPairs(data, settings) {
-  const fragments = data.frags || []
-  const pairs = (data.modes?.[settings.mode] || []).filter(([a, b, similarity]) => similarity >= settings.simMin && eligible(fragments[a], settings) && eligible(fragments[b], settings))
-  const parent = new Map()
-  const find = (value) => { let root = value; while (parent.get(root) !== root) root = parent.get(root); return root }
-  for (const [a, b] of pairs) {
-    if (!parent.has(a)) parent.set(a, a)
-    if (!parent.has(b)) parent.set(b, b)
-    parent.set(find(a), find(b))
-  }
-  const groups = new Map()
-  for (const [a, b, similarity] of pairs) {
-    const root = find(a)
-    if (!groups.has(root)) groups.set(root, {members: new Set(), maxSim: 0})
-    const group = groups.get(root)
-    group.members.add(a); group.members.add(b); group.maxSim = Math.max(group.maxSim, similarity)
-  }
-  return [...groups.values()].map((group) => {
-    const members = [...group.members].map((index) => fragments[index]).sort((a, b) => b.n - a.n)
-    return {members, maxSim: group.maxSim, tokens: members.reduce((sum, item) => sum + item.n, 0)}
-  }).sort((a, b) => b.tokens - a.tokens)
-}
-
-export function isFrameworkBoilerplateCloneGroup(group) {
-  const members = Array.isArray(group?.members) ? group.members : []
-  if (members.length < 2) return false
-  return members.every((member) => /(?:^|\/)\w[^/]*\.router\.[cm]?[jt]s$/i.test(String(member.file || '').replace(/\\/g, '/'))
-    && /^(?:router|routes)\(?\)?$/i.test(String(member.label || '').trim()))
-}
-
-export function isDeclarativeCatalogCloneGroup(group) {
-  const members = Array.isArray(group?.members) ? group.members : []
-  return members.length >= 2 && members.every((member) => member.declarative === true)
-}
-
-export function analyzeDuplicateGroups(repoRoot, graphPath, args = {}) {
-  const settings = {
-    simMin: Math.min(100, Math.max(50, Number(args.min_similarity) || 80)),
-    tokMin: Math.min(400, Math.max(12, Number(args.min_tokens) || 50)),
-    mode: args.mode === 'strict' ? 'strict' : 'renamed',
-    skipTests: args.include_tests !== true,
-    includeClassified: args.include_classified === true || args.include_non_product === true,
-    includeBoilerplate: args.include_boilerplate === true,
-    includeDeclarative: args.include_declarative === true,
-  }
-  const data = computeDuplicates(repoRoot, graphPath, {includeStrings: args.include_strings === true, minTokens: settings.tokMin})
-  const allGroups = groupPairs(data, settings)
-  const afterBoilerplate = settings.includeBoilerplate ? allGroups : allGroups.filter((group) => !isFrameworkBoilerplateCloneGroup(group))
-  const groups = settings.includeDeclarative ? afterBoilerplate : afterBoilerplate.filter((group) => !isDeclarativeCatalogCloneGroup(group))
-  const suppressed = (data.frags || []).filter((fragment) => !eligible(fragment, settings)).length
-  return {
-    settings, groups, suppressed,
-    boilerplateSuppressed: allGroups.length - afterBoilerplate.length,
-    declarativeSuppressed: afterBoilerplate.length - groups.length,
-  }
-}
-
-const digest = (value) => createHash('sha256').update(value).digest('hex').slice(0, 20)
-function groupKey(group, mode) {
-  const members = group.members.map((fragment) => {
-    const fingerprints = Array.isArray(fragment.fp?.[mode]) ? [...fragment.fp[mode]].sort() : []
-    return `${String(fragment.file).replace(/\\/g, '/')}\0${fragment.label || ''}\0${digest(JSON.stringify(fingerprints))}`
-  }).sort()
-  return digest(members.join('\n'))
-}
-
-export async function compareDuplicateGroups({repoRoot, graphPath, currentGraph, baseRef, changedFiles = [], args = {}}) {
-  const current = analyzeDuplicateGroups(repoRoot, graphPath, args)
-  const mode = ['full', 'no-tests', 'tests-only'].includes(currentGraph?.graphBuildMode) ? currentGraph.graphBuildMode : 'full'
-  const baseline = await withGitRefCheckout(repoRoot, baseRef, async (checkout) => {
-    let graph = await buildInternalGraph(checkout)
-    if (mode !== 'full') graph = filterGraphForMode(graph, mode, {repoRoot: checkout})
-    graph.graphBuildMode = mode
-    const baselineGraphPath = join(checkout, '.weavatrix-verified-graph.json')
-    writeFileSync(baselineGraphPath, JSON.stringify(graph))
-    return analyzeDuplicateGroups(checkout, baselineGraphPath, args)
-  })
-  if (!baseline.ok) return {state: 'UNKNOWN', reason: baseline.error, currentGroups: current.groups.length}
-  const baselineKeys = new Set(baseline.value.groups.map((group) => groupKey(group, current.settings.mode)))
-  const changed = new Set(changedFiles.map((file) => String(file).replace(/\\/g, '/')))
-  const added = current.groups.filter((group) => !baselineKeys.has(groupKey(group, current.settings.mode)))
-  const scoped = added.filter((group) => group.members.some((member) => changed.has(String(member.file).replace(/\\/g, '/'))))
-  return {
-    state: scoped.length ? 'BLOCKED' : 'PASS', baseline: {ref: baseline.ref, commit: baseline.commit},
-    currentGroups: current.groups.length, baselineGroups: baseline.value.groups.length, newGroups: added.length,
-    scopedNewGroups: scoped.slice(0, 20).map((group) => ({similarity: group.maxSim, tokens: group.tokens, members: group.members.slice(0, 8).map((item) => ({file: item.file, start: item.start, end: item.end, label: item.label}))})),
-  }
-}

package/src/analysis/duplicates-worker.js

@@ -1,11 +0,0 @@
-// duplicates-worker.js — runs clone detection OFF Electron's main thread (same rationale as
-// graph/build-worker.js: a blocked main event loop freezes every window on Windows). The fingerprint
-// sets never leave the worker; only slim fragment metadata + similarity pairs cross back.
-import { parentPort, workerData } from "node:worker_threads";
-import { computeDuplicates } from "./duplicates.js";
-
-try {
-  parentPort.postMessage(computeDuplicates(workerData.repoPath, workerData.graphJsonPath));
-} catch (e) {
-  parentPort.postMessage({ ok: false, error: (e && e.message) || String(e) });
-}