weavatrix 0.3.2 → 0.3.3

package/README.md

@@ -413,6 +413,21 @@ metrics are not persisted or transmitted by Weavatrix. If a source checkout's pa
 while an old daemon remains alive, `initialize`, `tools/list`, and tool calls fail loudly with
 `STALE_RUNTIME` until the client reconnects; the opt-out is reserved for deliberate development.
 
+### 0.3.3 parser supply-chain boundary
+
+- Before compiling parser WASM, Core now requires the package-pinned `web-tree-sitter` runtime and
+  each selected `tree-sitter-wasms` grammar to resolve inside its dependency directory and match a
+  release-pinned SHA-256 allowlist. Repository paths, URLs, symlinks and custom parser locations are
+  rejected; a mismatch fails the graph build.
+- This bounds the upstream Emscripten dynamic-module loader even though its generated code contains
+  `eval` glue for EM_ASM/EM_JS side modules. Weavatrix loads only its known local runtime and grammar
+  artifacts; it does not load a parser or grammar from the analyzed repository.
+- Supply-chain documentation now distinguishes the Apache-2.0 license declared by
+  `typescript@5.9.3` from the W3C agreement reproduced for one specification in its third-party
+  notices. Conservative dependency scanners may still surface that component notice for review.
+
+Full patch notes: [docs/releases/v0.3.3.md](docs/releases/v0.3.3.md).
+
 ### 0.3.2 exact impact over oversized diffs
 
 - `change_impact` now recovers a bounded per-file unified diff when one large asset exceeds the

package/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported |
 |---|---|
-| `0.2.15.x` | Yes |
-| `0.2.14` and older | Upgrade to the latest release |
+| `0.3.x` | Yes |
+| `0.2.x` and older | Upgrade to the latest release |
 
 Security fixes are provided for the latest published version of Weavatrix. Upgrade before reporting
 an issue that may already be resolved.
@@ -56,6 +56,22 @@ bounded graph-work drain, and closes or tree-terminates TLS/tsserver before exit
 Set `WEAVATRIX_PRECISION=off` before server startup (or select `off` in the MCPB semantic-precision
 setting) to keep new graphs parser-only from their first build.
 
+The parser runtime and language grammars are also exact package-pinned dependencies. Before compiling
+WASM, Weavatrix requires the runtime and every selected grammar to resolve inside their dependency
+directories and match a release-pinned SHA-256 allowlist. Repository paths, URLs, symlinks and custom
+`runtimeWasm`/`wasmDir` overrides cannot enter this path. This specifically bounds the generated
+Emscripten dynamic-module loader in `web-tree-sitter`: although upstream contains `eval` glue for
+EM_ASM/EM_JS side-module exports, Weavatrix supplies only its known local runtime and grammar artifacts.
+An integrity mismatch fails the graph build instead of silently falling back to an unverified parser.
+
+Dependency scanners should distinguish a package's declared license from component notices.
+`typescript@5.9.3` declares `Apache-2.0`; its `ThirdPartyNoticeText.txt` also reproduces the W3C Community
+Final Specification Agreement for the Web Background Synchronization specification. That attribution
+does not change the npm package's declared license, but conservative scanners may report the embedded
+notice separately. `web-tree-sitter@0.25.10` declares MIT; its generated loader is covered by the
+artifact boundary above. These observations are security evidence, not a request to suppress third-party
+scanner warnings or legal advice.
+
 `verified_change` is read-only by default. Its optional targeted-test step can execute only an
 existing `package.json` script whose name matches the bounded test/check/verify allowlist. The call
 must set `run_tests:true` and the server operator must separately set

package/docs/releases/v0.3.3.md

@@ -0,0 +1,25 @@
+# Weavatrix 0.3.3
+
+0.3.3 hardens the portable parser boundary after reviewing two conservative
+third-party supply-chain alerts.
+
+`web-tree-sitter@0.25.10` is MIT-licensed, but its generated Emscripten loader
+contains `eval` support for EM_ASM/EM_JS exports in dynamic side modules. The
+same generated path remains in `web-tree-sitter@0.26.11`; changing the version
+would not remove the signal. Weavatrix now verifies the exact SHA-256 of the
+package-owned runtime and every selected `tree-sitter-wasms@0.1.13` grammar
+before compilation. Parser artifacts must resolve inside their pinned package
+directories. Repository paths, URLs, symlink escapes and custom runtime or
+grammar locations are rejected, and an integrity mismatch fails closed.
+
+The release also documents a separate license-classification alert.
+`typescript@5.9.3` declares `Apache-2.0`. Its third-party notice reproduces the
+W3C Community Final Specification Agreement for the Web Background
+Synchronization specification; conservative scanners can identify that
+component notice as non-permissive even though it is not the package's declared
+license. Weavatrix keeps the notice visible and does not suppress the external
+scanner finding.
+
+The public site now presents the product boundary directly: the 34-tool MIT,
+network-free Core and the separately licensed 39-tool Online overlay, including
+managed Cloud and customer-hosted Enterprise availability.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -36,6 +36,7 @@
     "docs/releases/v0.3.0.md",
     "docs/releases/v0.3.1.md",
     "docs/releases/v0.3.2.md",
+    "docs/releases/v0.3.3.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/src/graph/internal-builder.langs.js

@@ -10,6 +10,7 @@ import { createRequire } from "node:module";
 import { isPathInside } from "../repo-path.js";
 import { childProcessEnv } from "../child-env.js";
 import { filterWeavatrixIgnored } from "../path-ignore.js";
+import {trustedGrammarWasm, trustedRuntimeWasm} from './parser-artifact-boundary.js'
 import LANG_JS from "./builder/lang-js.js";
 import LANG_PY from "./builder/lang-python.js";
 import LANG_GO from "./builder/lang-go.js";
@@ -24,7 +25,6 @@ const { Parser, Language, Query } = require("web-tree-sitter");
 
 const WTS_DIR = dirname(require.resolve("web-tree-sitter"));
 const NODE_MODULES = dirname(WTS_DIR);
-const DEFAULT_RUNTIME_WASM = join(WTS_DIR, "tree-sitter.wasm");
 const DEFAULT_WASM_DIR = join(NODE_MODULES, "tree-sitter-wasms", "out");
 
 // ---- language registry (derived from the per-language modules) ----
@@ -61,11 +61,19 @@ const _langs = {};
 // in the repo get compiled. The heavy WASMs (rust ~3MB, c_sharp ~4MB) cost seconds to compile — a tax
 // a JS-only repo must never pay. Omit `wanted` to load everything (old behavior).
 async function ensureParser(opts = {}, wanted = null) {
-  if (!_ready) _ready = Parser.init({ locateFile: () => opts.runtimeWasm || DEFAULT_RUNTIME_WASM });
+  if (opts.runtimeWasm != null || opts.wasmDir != null) {
+    throw new Error('custom parser artifacts are not supported; Weavatrix loads only pinned package-owned WASM')
+  }
+  if (!_ready) {
+    const runtimeWasm = trustedRuntimeWasm(WTS_DIR)
+    _ready = Parser.init({ locateFile: () => runtimeWasm });
+  }
   await _ready;
-  const wasmDir = opts.wasmDir || DEFAULT_WASM_DIR;
   const list = wanted ? GRAMMARS.filter((g) => wanted.has(g)) : GRAMMARS;
-  for (const g of list) if (!_langs[g]) { try { _langs[g] = await Language.load(join(wasmDir, `tree-sitter-${g}.wasm`)); } catch { _langs[g] = null; } }
+  for (const g of list) if (!_langs[g]) {
+    const grammarWasm = trustedGrammarWasm(DEFAULT_WASM_DIR, g)
+    try { _langs[g] = await Language.load(grammarWasm); } catch { _langs[g] = null; }
+  }
   return _langs;
 }
 

package/src/graph/parser-artifact-boundary.js

@@ -0,0 +1,56 @@
+import {createHash} from 'node:crypto'
+import {readFileSync, realpathSync, statSync} from 'node:fs'
+import {join} from 'node:path'
+import {isPathInside} from '../repo-path.js'
+
+// Exact SHA-256 allowlist for the parser artifacts shipped by the package-pinned
+// web-tree-sitter@0.25.10 and tree-sitter-wasms@0.1.13 dependencies. npm integrity
+// protects installation; this second boundary detects replacement or redirection
+// before Emscripten compiles a runtime or dynamic language module.
+const RUNTIME_SHA256 = 'f38dcc4b43b818f9a0785bc1c6d5611a75ac4cdd428ff3f02757c34ca4e46d7f'
+const GRAMMAR_SHA256 = Object.freeze({
+  javascript: '63812b9e275d26851264734868d27a1656bd44a2ef6eb3e85e6b03728c595ab5',
+  typescript: '8515404dceed38e1ed86aa34b09fcf3379fff1b4ff9dd3967bcd6d1eb5ac3d8f',
+  tsx: '6aa3b2c70e76f5d48eafef1093e9c4de383e13f2fdde2f4e9b98a378f6a8f1b6',
+  python: '9056d0fb0c337810d019fae350e8167786119da98f0f282aceae7ab89ee8253b',
+  go: '9963ca89b616eaf04b08a43bc1fb0f07b85395bec313330851f1f1ead2f755b6',
+  java: '637aac4415fb39a211a4f4292d63c66b5ce9c32fa2cd35464af4f681d91b9a1f',
+  c_sharp: '6266a7e32d68a3459104d994dc848df15d5672b0ea8e86d327274b694f8e6991',
+  rust: '4409921a70d0aa5bec7d1d7ce809a557a8ee1cf6ace901e3ac6a76e62cfea903',
+  html: '11b3405c1543fb012f5ed7f8ee73125076dce8b168301e1e787e4c717da6b456',
+  css: '5fc615467b1b98420ed7517e5bf9e1f88468132dd903d842dfb13714f6a1cb0c',
+})
+
+export function verifyParserArtifact({file, root, sha256, label = 'parser artifact'}) {
+  let rootReal, fileReal
+  try {
+    rootReal = realpathSync.native(root)
+    fileReal = realpathSync.native(file)
+  } catch {
+    throw new Error(`${label} is missing or cannot be resolved`)
+  }
+  if (!isPathInside(rootReal, fileReal) || !statSync(fileReal).isFile()) {
+    throw new Error(`${label} resolves outside its pinned package directory`)
+  }
+  const actual = createHash('sha256').update(readFileSync(fileReal)).digest('hex')
+  if (actual !== sha256) throw new Error(`${label} failed the pinned SHA-256 integrity check`)
+  return fileReal
+}
+
+export function trustedRuntimeWasm(wtsDir) {
+  return verifyParserArtifact({
+    file: join(wtsDir, 'tree-sitter.wasm'), root: wtsDir,
+    sha256: RUNTIME_SHA256, label: 'web-tree-sitter runtime',
+  })
+}
+
+export function trustedGrammarWasm(wasmDir, grammar) {
+  const sha256 = GRAMMAR_SHA256[grammar]
+  if (!sha256) throw new Error(`unsupported tree-sitter grammar: ${grammar}`)
+  return verifyParserArtifact({
+    file: join(wasmDir, `tree-sitter-${grammar}.wasm`), root: wasmDir,
+    sha256, label: `tree-sitter ${grammar} grammar`,
+  })
+}
+
+export const TRUSTED_GRAMMARS = Object.freeze(Object.keys(GRAMMAR_SHA256))