weavatrix 0.3.2 → 0.3.4

package/README.md

@@ -413,6 +413,37 @@ metrics are not persisted or transmitted by Weavatrix. If a source checkout's pa
 while an old daemon remains alive, `initialize`, `tools/list`, and tool calls fail loudly with
 `STALE_RUNTIME` until the client reconnects; the opt-out is reserved for deliberate development.
 
+### 0.3.4 self-audit precision and bounded dynamic imports
+
+- JS/TS graph construction now resolves the existing local-file prefix in
+  ``import(new URL(`./tool.mjs${runtimeValue}`, import.meta.url).href)`` while
+  preserving the edge as dynamic. Variable-first paths, remote URLs, alternate
+  bases and other runtime-only targets remain explicit unknowns.
+- Health dependency headlines now follow the same production-first path scope as
+  the displayed findings. Classified fixture results are counted separately
+  instead of making a clean application headline look unhealthy.
+- Dead-code liveness no longer treats comment-only symbol mentions as callers;
+  string-addressed runtime registries remain conservatively live. Dogfood removed
+  obsolete internal exports/wrappers while preserving every supported Online
+  extension point and TypeScript host callback.
+
+Full patch notes: [docs/releases/v0.3.4.md](docs/releases/v0.3.4.md).
+
+### 0.3.3 parser supply-chain boundary
+
+- Before compiling parser WASM, Core now requires the package-pinned `web-tree-sitter` runtime and
+  each selected `tree-sitter-wasms` grammar to resolve inside its dependency directory and match a
+  release-pinned SHA-256 allowlist. Repository paths, URLs, symlinks and custom parser locations are
+  rejected; a mismatch fails the graph build.
+- This bounds the upstream Emscripten dynamic-module loader even though its generated code contains
+  `eval` glue for EM_ASM/EM_JS side modules. Weavatrix loads only its known local runtime and grammar
+  artifacts; it does not load a parser or grammar from the analyzed repository.
+- Supply-chain documentation now distinguishes the Apache-2.0 license declared by
+  `typescript@5.9.3` from the W3C agreement reproduced for one specification in its third-party
+  notices. Conservative dependency scanners may still surface that component notice for review.
+
+Full patch notes: [docs/releases/v0.3.3.md](docs/releases/v0.3.3.md).
+
 ### 0.3.2 exact impact over oversized diffs
 
 - `change_impact` now recovers a bounded per-file unified diff when one large asset exceeds the

package/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported |
 |---|---|
-| `0.2.15.x` | Yes |
-| `0.2.14` and older | Upgrade to the latest release |
+| `0.3.x` | Yes |
+| `0.2.x` and older | Upgrade to the latest release |
 
 Security fixes are provided for the latest published version of Weavatrix. Upgrade before reporting
 an issue that may already be resolved.
@@ -56,6 +56,22 @@ bounded graph-work drain, and closes or tree-terminates TLS/tsserver before exit
 Set `WEAVATRIX_PRECISION=off` before server startup (or select `off` in the MCPB semantic-precision
 setting) to keep new graphs parser-only from their first build.
 
+The parser runtime and language grammars are also exact package-pinned dependencies. Before compiling
+WASM, Weavatrix requires the runtime and every selected grammar to resolve inside their dependency
+directories and match a release-pinned SHA-256 allowlist. Repository paths, URLs, symlinks and custom
+`runtimeWasm`/`wasmDir` overrides cannot enter this path. This specifically bounds the generated
+Emscripten dynamic-module loader in `web-tree-sitter`: although upstream contains `eval` glue for
+EM_ASM/EM_JS side-module exports, Weavatrix supplies only its known local runtime and grammar artifacts.
+An integrity mismatch fails the graph build instead of silently falling back to an unverified parser.
+
+Dependency scanners should distinguish a package's declared license from component notices.
+`typescript@5.9.3` declares `Apache-2.0`; its `ThirdPartyNoticeText.txt` also reproduces the W3C Community
+Final Specification Agreement for the Web Background Synchronization specification. That attribution
+does not change the npm package's declared license, but conservative scanners may report the embedded
+notice separately. `web-tree-sitter@0.25.10` declares MIT; its generated loader is covered by the
+artifact boundary above. These observations are security evidence, not a request to suppress third-party
+scanner warnings or legal advice.
+
 `verified_change` is read-only by default. Its optional targeted-test step can execute only an
 existing `package.json` script whose name matches the bounded test/check/verify allowlist. The call
 must set `run_tests:true` and the server operator must separately set

package/docs/releases/v0.3.3.md

@@ -0,0 +1,25 @@
+# Weavatrix 0.3.3
+
+0.3.3 hardens the portable parser boundary after reviewing two conservative
+third-party supply-chain alerts.
+
+`web-tree-sitter@0.25.10` is MIT-licensed, but its generated Emscripten loader
+contains `eval` support for EM_ASM/EM_JS exports in dynamic side modules. The
+same generated path remains in `web-tree-sitter@0.26.11`; changing the version
+would not remove the signal. Weavatrix now verifies the exact SHA-256 of the
+package-owned runtime and every selected `tree-sitter-wasms@0.1.13` grammar
+before compilation. Parser artifacts must resolve inside their pinned package
+directories. Repository paths, URLs, symlink escapes and custom runtime or
+grammar locations are rejected, and an integrity mismatch fails closed.
+
+The release also documents a separate license-classification alert.
+`typescript@5.9.3` declares `Apache-2.0`. Its third-party notice reproduces the
+W3C Community Final Specification Agreement for the Web Background
+Synchronization specification; conservative scanners can identify that
+component notice as non-permissive even though it is not the package's declared
+license. Weavatrix keeps the notice visible and does not suppress the external
+scanner finding.
+
+The public site now presents the product boundary directly: the 34-tool MIT,
+network-free Core and the separately licensed 39-tool Online overlay, including
+managed Cloud and customer-hosted Enterprise availability.

package/docs/releases/v0.3.4.md

@@ -0,0 +1,40 @@
+# Weavatrix 0.3.4
+
+0.3.4 is a focused self-audit precision release. It removes false Health and
+dead-code noise found while dogfooding Core against its own current source,
+without widening the 34-tool offline boundary.
+
+## Bounded dynamic-import evidence
+
+JS/TS graph construction now recognizes the statically named local module in
+URL-based imports such as
+``import(new URL(`./tools-health.mjs${cacheBust}`, import.meta.url).href)``.
+The resolved local candidate participates in reachability, while the edge keeps
+its `dynamic` marker. Variable-first templates, remote URLs, non-`import.meta.url`
+bases and other runtime-only expressions remain unresolved rather than being
+guessed.
+
+## Health and dead-code precision
+
+- The dependency summary uses the same production-first path scope as the
+  findings shown below it. Findings isolated to fixtures/tests are reported as a
+  separate suppressed count instead of leaking into the production headline.
+- Comment-only lexical mentions no longer prove symbol liveness. String-based
+  registries and reflective dispatch stay conservative because they may be real
+  runtime entry points.
+- Dogfood removed unnecessary internal exports, obsolete declarations and
+  uncalled LSP wrapper methods. Supported Online extension exports and
+  TypeScript host callbacks remain intact.
+
+Current-source dogfood reports zero Health findings in both full and no-tests
+graphs. The remaining low-confidence dead-code queue contains only the five
+supported Online extension exports and two TypeScript host callbacks. Classified
+benchmark dependency findings remain available through `include_classified`.
+
+The release remains gated by the full Node suite, release metadata validation,
+portable MCPB/npm runtime smoke, dependency audit and self-dogfood.
+
+The strict source-free real-repository benchmark was refreshed from clean,
+revision-bound checkouts and passes all six language repositories (TypeScript,
+JavaScript, Python, Go, Java and Rust) with complete provenance, expected-signal
+and relation-regression gates.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -36,6 +36,8 @@
     "docs/releases/v0.3.0.md",
     "docs/releases/v0.3.1.md",
     "docs/releases/v0.3.2.md",
+    "docs/releases/v0.3.3.md",
+    "docs/releases/v0.3.4.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/src/analysis/cycle-route.js

@@ -1,4 +1,4 @@
-export const MAX_REPRESENTATIVE_CYCLE_FILES = 64;
+const MAX_REPRESENTATIVE_CYCLE_FILES = 64;
 
 // Keep the complete closed route for normal cycles. Very large SCCs still get a closed, deterministic
 // head/tail route without letting one finding consume the whole audit response.

package/src/analysis/dead-check.js

@@ -2,17 +2,37 @@
 // calls/imports/references/inherits it) AND its bare name appears NOWHERE in the repo outside its own file.
 // A file is DEAD when nothing imports it, it isn't an entry point, and all its symbols are dead.
 //
-// Pure core `computeDead(graph, sources)` (sources = Map<fileRel, text>) is fully testable with no filesystem.
-// `analyzeDeadCode(graph, repoRoot)` is the thin fs wrapper. Works on ANY graph-builder-schema graph (built-in OR
-// graph-builder) — it only needs {nodes, links} + the source text. See [[graph-builder-internalization]].
-import { readFileSync } from "node:fs";
+// Pure core `computeDead(graph, sources)` (sources = Map<fileRel, text>) works on any graph-builder-schema graph
+// and is fully testable with no filesystem. It only needs {nodes, links} + source text. See [[graph-builder-internalization]].
 import { posix } from "node:path";
-import { createRepoBoundary } from "../repo-path.js";
 import { isStructuralRelation } from "../graph/relations.js";
 import { createPathClassifier, hasPathClass } from "../path-classification.js";
 
 const IDENT_RE = /[A-Za-z_$][\w$]*/g;
 const bareName = (label) => String(label || "").replace(/\s*\(.*$/, "").replace(/[()]/g, "").trim();
+// Ignore comment-only lexical mentions, which are documentation rather than callers. Keep strings on
+// purpose: registries/reflection often address a live symbol by name, and static liveness must stay
+// conservative there. This only strips comments that start a logical line, avoiding a language parser
+// guess around inline comment markers, regex literals, or URLs.
+const lexicalEvidenceText = (value) => {
+  let inBlockComment = false;
+  return String(value || "").split(/\r?\n/).map((line) => {
+    let rest = line;
+    while (true) {
+      if (inBlockComment) {
+        const end = rest.indexOf("*/");
+        if (end < 0) return "";
+        inBlockComment = false;
+        rest = rest.slice(end + 2);
+      }
+      const trimmed = rest.trimStart();
+      if (trimmed.startsWith("//") || trimmed.startsWith("#")) return "";
+      if (!trimmed.startsWith("/*")) return rest;
+      inBlockComment = true;
+      rest = trimmed.slice(2);
+    }
+  }).join("\n");
+};
 // entry surfaces are never dead even with no inbound edge (framework/CLI/HTTP enter them externally).
 // Exported for internal-audit.js (reachability entry set) — keep the two in lockstep.
 export const ENTRY_FILE = /(^|[\\/])(index|main|app|server|cli|cmd|bootstrap|entry|run|__main__|manage|wsgi|asgi|setup|conftest)\.[a-z0-9]+$|(^|[\\/])(bin|cmd)[\\/]|(^|[\\/])main\.go$/i;
@@ -21,8 +41,8 @@ const isTestFile = (file) => hasPathClass(defaultPathClassifier.explain(file), "
 
 // Framework-owned entry modules are invoked by convention rather than a source import. Keep this narrow:
 // these are Next.js App/Pages Router surfaces and framework metadata files, not every file under `app/`.
-export const NEXT_ENTRY_FILE = /(^|\/)(?:src\/)?app\/(?:.*\/)?(?:page|layout|template|loading|error|global-error|not-found|default|route|robots|sitemap|manifest|opengraph-image|twitter-image|icon|apple-icon)\.[cm]?[jt]sx?$|(^|\/)(?:src\/)?pages\/(?!.*\/(?:components?|lib|utils?)\/).+\.[cm]?[jt]sx?$|(^|\/)(?:middleware|instrumentation)\.[cm]?[jt]s$/i;
-export const RUST_ENTRY_FILE = /(^|\/)(?:build\.rs|src\/(?:lib|main)\.rs)$/i;
+const NEXT_ENTRY_FILE = /(^|\/)(?:src\/)?app\/(?:.*\/)?(?:page|layout|template|loading|error|global-error|not-found|default|route|robots|sitemap|manifest|opengraph-image|twitter-image|icon|apple-icon)\.[cm]?[jt]sx?$|(^|\/)(?:src\/)?pages\/(?!.*\/(?:components?|lib|utils?)\/).+\.[cm]?[jt]sx?$|(^|\/)(?:middleware|instrumentation)\.[cm]?[jt]s$/i;
+const RUST_ENTRY_FILE = /(^|\/)(?:build\.rs|src\/(?:lib|main)\.rs)$/i;
 export const isFrameworkEntryFile = (file) => {
   const normalized = String(file || "").replace(/\\/g, "/");
   return NEXT_ENTRY_FILE.test(normalized) || RUST_ENTRY_FILE.test(normalized);
@@ -114,7 +134,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
   // whole-repo identifier frequency: a symbol whose name appears MORE than once total (its definition + at least
   // one use, same-file OR cross-file) is referenced. Errs toward "alive" (common-named symbols never flagged).
   const globalFreq = new Map();
-  for (const [, text] of sources) for (const m of String(text || "").matchAll(IDENT_RE)) { const n = m[0]; globalFreq.set(n, (globalFreq.get(n) || 0) + 1); }
+  for (const [, text] of sources) for (const m of lexicalEvidenceText(text).matchAll(IDENT_RE)) { const n = m[0]; globalFreq.set(n, (globalFreq.get(n) || 0) + 1); }
 
   const symById = new Map();
   const symsByFile = new Map();
@@ -127,7 +147,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
   const symbolNames = new Set([...symById.values()].map((node) => bareName(node.label)).filter(Boolean));
   const occurrenceFiles = new Map();
   const occurrenceCounts = new Map();
-  for (const [file, text] of sources) for (const match of String(text || "").matchAll(IDENT_RE)) {
+  for (const [file, text] of sources) for (const match of lexicalEvidenceText(text).matchAll(IDENT_RE)) {
     const name = match[0];
     if (!symbolNames.has(name)) continue;
     const files = occurrenceFiles.get(name) || new Set();
@@ -276,17 +296,3 @@ export function computeUnusedExports(graph, sources, { dynamicTargets = new Set(
   }
   return out;
 }
-
-// fs wrapper: reads each graph file's source once, then runs the pure checker.
-export function analyzeDeadCode(graph, repoRoot) {
-  const sources = new Map();
-  const files = new Set();
-  const boundary = createRepoBoundary(repoRoot);
-  for (const n of graph.nodes || []) if (n.source_file) files.add(n.source_file);
-  for (const f of files) {
-    const resolved = boundary.resolve(f);
-    if (!resolved.ok) continue;
-    try { sources.set(f, readFileSync(resolved.path, "utf8")); } catch { /* file gone */ }
-  }
-  return computeDead(graph, sources);
-}

package/src/analysis/dead-code-review/policy.js

@@ -1,7 +1,7 @@
 import {hasPathClass} from '../../path-classification.js'
 
 export const DEAD_CODE_CONFIDENCE_RANK = Object.freeze({high: 0, medium: 1, low: 2})
-export const DYNAMIC_CODE_RE = /(?:\brequire\s*\(\s*(?!["'])|\bcreateRequire\s*\(|\b__import__\s*\(|\bimportlib\.|(?:^|[^\w.$])(?:eval|exec)\s*\()/m
+const DYNAMIC_CODE_RE = /(?:\brequire\s*\(\s*(?!["'])|\bcreateRequire\s*\(|\b__import__\s*\(|\bimportlib\.|(?:^|[^\w.$])(?:eval|exec)\s*\()/m
 const JS_DYNAMIC_IMPORT_RE = /\bimport\s*\(/
 const JS_LIKE_PATH_RE = /\.(?:[cm]?js|jsx|[cm]?ts|tsx)$/i
 export const REFLECTION_CODE_RE = /(?:\b(?:Class\.forName|get(?:Declared)?Method|getattr|setattr|hasattr|Method\.Invoke|GetMethod|GetProcAddress|dlsym)\s*\(|\b(?:globals|locals)\s*\(\s*\)\s*\[|\breflect\.[A-Za-z_$][\w$]*\s*\()/i

package/src/analysis/findings.js

@@ -3,8 +3,7 @@
 // so the renderer and the AI summarizer consume one contract regardless of engine.
 import { createHash } from "node:crypto";
 
-export const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
-export const FINDING_CATEGORIES = ["unused", "structure", "vulnerability", "malware"];
+const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
 
 export function dependencyVerification(manifest, imports, decision, mapping) {
   return {

package/src/analysis/package-reachability.js

@@ -1,7 +1,7 @@
 // Package-level reachability: correlate a dependency finding with the graph's external imports.
 // This is intentionally not function-level exploitability analysis. It only states whether product
 // code imports the package and preserves unknown as unknown.
-export const PACKAGE_REACHABILITY_V = 1
+const PACKAGE_REACHABILITY_V = 1
 
 export function packageReachability(externalImports, packageName, {isNonProductPath = () => false} = {}) {
     const imports = (Array.isArray(externalImports) ? externalImports : [])

package/src/graph/builder/js/dynamic-import.js

@@ -0,0 +1,26 @@
+// Resolve only the bounded local-file portion of URL-based dynamic imports.
+// Runtime substitutions remain uncertain; this candidate exists solely so a
+// statically named module is not mislabeled as an orphan.
+export function boundedUrlImportTarget(arg, {field, fileRel, resolveJsImport}) {
+  if (!arg || arg.type !== "member_expression" || field(arg, "property")?.text !== "href") return null;
+  const created = field(arg, "object");
+  if (!created || created.type !== "new_expression" || field(created, "constructor")?.text !== "URL") return null;
+  const urlArgs = field(created, "arguments")?.namedChildren || [];
+  if (urlArgs.length !== 2 || urlArgs[1].text !== "import.meta.url") return null;
+
+  const source = urlArgs[0];
+  let rawSpec = "";
+  if (source.type === "string") {
+    rawSpec = source.text.replace(/^['"`]|['"`]$/g, "");
+  } else if (source.type === "template_string") {
+    const parts = source.namedChildren || [];
+    if (parts.length !== 2 || parts[0].type !== "string_fragment" || parts[1].type !== "template_substitution") return null;
+    rawSpec = parts[0].text;
+  } else return null;
+
+  if (!/^\.\.?\//.test(rawSpec)) return null;
+  const staticPath = rawSpec.split(/[?#]/)[0];
+  if (!/\.[cm]?[jt]sx?$/i.test(staticPath)) return null;
+  const target = resolveJsImport(fileRel, staticPath);
+  return target ? {rawSpec: staticPath, target} : null;
+}

package/src/graph/builder/lang-js.js

@@ -6,6 +6,7 @@ import {
   CALLABLE, FUNCS, TOPVARS, TYPES, REQUIRE, parseExportSpecifiers,
   importTypeOnly, reexportTypeOnly,
 } from './js/queries.js';
+import {boundedUrlImportTarget} from './js/dynamic-import.js';
 
 export default {
   family: "js",
@@ -201,7 +202,8 @@ export default {
         else if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "dynamic", line });
         else if (rawSpec) recordUnresolved(rawSpec, "dynamic", line);
       } else {
-        addExternalImport({ dynamic: true, kind: "dynamic", line });
+        const bounded = boundedUrlImportTarget(arg, {field, fileRel, resolveJsImport});
+        addExternalImport({ dynamic: true, kind: "dynamic", line, ...(bounded ? {spec: bounded.rawSpec, target: bounded.target} : {}) });
       }
     }
 

package/src/graph/builder/spec-pkg.js

@@ -62,7 +62,7 @@ export const PY_STDLIB = new Set(("__future__ __main__ _thread abc aifc argparse
 
 // import name → PyPI dist where they differ. Generic python-X / X-python / X[2]-binary equivalence is
 // handled by the matcher in dep-check; this map covers the truly irregular names.
-export const PY_IMPORT_TO_DIST = {
+const PY_IMPORT_TO_DIST = {
   yaml: "PyYAML", cv2: "opencv-python", PIL: "Pillow", sklearn: "scikit-learn", skimage: "scikit-image",
   bs4: "beautifulsoup4", dateutil: "python-dateutil", dotenv: "python-dotenv", jose: "python-jose",
   magic: "python-magic", multipart: "python-multipart", docx: "python-docx", pptx: "python-pptx",
@@ -78,7 +78,7 @@ export const PY_IMPORT_TO_DIST = {
 };
 // namespace roots shared by many dists (google.protobuf/google.cloud.* …) — too ambiguous to name one
 // package; "src" is a repo-layout artifact (stale sys.path import), never a PyPI dist.
-export const PY_AMBIGUOUS_TOP = new Set(["google", "src"]);
+const PY_AMBIGUOUS_TOP = new Set(["google", "src"]);
 export function pySpecToPkg(topModule) {
   const t = String(topModule || "").trim();
   if (!t) return null;

package/src/graph/freshness-probe.js

@@ -8,8 +8,8 @@ import {createRequire} from 'node:module'
 import {childProcessEnv} from '../child-env.js'
 import {createRepoBoundary} from '../repo-path.js'
 
-export const REPOSITORY_FRESHNESS_PROBE_V = 1
-export const GRAPH_BUILDER_SCHEMA_V = 6
+const REPOSITORY_FRESHNESS_PROBE_V = 1
+const GRAPH_BUILDER_SCHEMA_V = 6
 export const GRAPH_BUILDER_VERSION = (() => {
     try { return String(createRequire(import.meta.url)('../../package.json').version) }
     catch { return '0.0.0' }

package/src/graph/internal-builder.langs.js

@@ -10,6 +10,7 @@ import { createRequire } from "node:module";
 import { isPathInside } from "../repo-path.js";
 import { childProcessEnv } from "../child-env.js";
 import { filterWeavatrixIgnored } from "../path-ignore.js";
+import {trustedGrammarWasm, trustedRuntimeWasm} from './parser-artifact-boundary.js'
 import LANG_JS from "./builder/lang-js.js";
 import LANG_PY from "./builder/lang-python.js";
 import LANG_GO from "./builder/lang-go.js";
@@ -24,7 +25,6 @@ const { Parser, Language, Query } = require("web-tree-sitter");
 
 const WTS_DIR = dirname(require.resolve("web-tree-sitter"));
 const NODE_MODULES = dirname(WTS_DIR);
-const DEFAULT_RUNTIME_WASM = join(WTS_DIR, "tree-sitter.wasm");
 const DEFAULT_WASM_DIR = join(NODE_MODULES, "tree-sitter-wasms", "out");
 
 // ---- language registry (derived from the per-language modules) ----
@@ -61,11 +61,19 @@ const _langs = {};
 // in the repo get compiled. The heavy WASMs (rust ~3MB, c_sharp ~4MB) cost seconds to compile — a tax
 // a JS-only repo must never pay. Omit `wanted` to load everything (old behavior).
 async function ensureParser(opts = {}, wanted = null) {
-  if (!_ready) _ready = Parser.init({ locateFile: () => opts.runtimeWasm || DEFAULT_RUNTIME_WASM });
+  if (opts.runtimeWasm != null || opts.wasmDir != null) {
+    throw new Error('custom parser artifacts are not supported; Weavatrix loads only pinned package-owned WASM')
+  }
+  if (!_ready) {
+    const runtimeWasm = trustedRuntimeWasm(WTS_DIR)
+    _ready = Parser.init({ locateFile: () => runtimeWasm });
+  }
   await _ready;
-  const wasmDir = opts.wasmDir || DEFAULT_WASM_DIR;
   const list = wanted ? GRAMMARS.filter((g) => wanted.has(g)) : GRAMMARS;
-  for (const g of list) if (!_langs[g]) { try { _langs[g] = await Language.load(join(wasmDir, `tree-sitter-${g}.wasm`)); } catch { _langs[g] = null; } }
+  for (const g of list) if (!_langs[g]) {
+    const grammarWasm = trustedGrammarWasm(DEFAULT_WASM_DIR, g)
+    try { _langs[g] = await Language.load(grammarWasm); } catch { _langs[g] = null; }
+  }
   return _langs;
 }
 

package/src/graph/parser-artifact-boundary.js

@@ -0,0 +1,54 @@
+import {createHash} from 'node:crypto'
+import {readFileSync, realpathSync, statSync} from 'node:fs'
+import {join} from 'node:path'
+import {isPathInside} from '../repo-path.js'
+
+// Exact SHA-256 allowlist for the parser artifacts shipped by the package-pinned
+// web-tree-sitter@0.25.10 and tree-sitter-wasms@0.1.13 dependencies. npm integrity
+// protects installation; this second boundary detects replacement or redirection
+// before Emscripten compiles a runtime or dynamic language module.
+const RUNTIME_SHA256 = 'f38dcc4b43b818f9a0785bc1c6d5611a75ac4cdd428ff3f02757c34ca4e46d7f'
+const GRAMMAR_SHA256 = Object.freeze({
+  javascript: '63812b9e275d26851264734868d27a1656bd44a2ef6eb3e85e6b03728c595ab5',
+  typescript: '8515404dceed38e1ed86aa34b09fcf3379fff1b4ff9dd3967bcd6d1eb5ac3d8f',
+  tsx: '6aa3b2c70e76f5d48eafef1093e9c4de383e13f2fdde2f4e9b98a378f6a8f1b6',
+  python: '9056d0fb0c337810d019fae350e8167786119da98f0f282aceae7ab89ee8253b',
+  go: '9963ca89b616eaf04b08a43bc1fb0f07b85395bec313330851f1f1ead2f755b6',
+  java: '637aac4415fb39a211a4f4292d63c66b5ce9c32fa2cd35464af4f681d91b9a1f',
+  c_sharp: '6266a7e32d68a3459104d994dc848df15d5672b0ea8e86d327274b694f8e6991',
+  rust: '4409921a70d0aa5bec7d1d7ce809a557a8ee1cf6ace901e3ac6a76e62cfea903',
+  html: '11b3405c1543fb012f5ed7f8ee73125076dce8b168301e1e787e4c717da6b456',
+  css: '5fc615467b1b98420ed7517e5bf9e1f88468132dd903d842dfb13714f6a1cb0c',
+})
+
+export function verifyParserArtifact({file, root, sha256, label = 'parser artifact'}) {
+  let rootReal, fileReal
+  try {
+    rootReal = realpathSync.native(root)
+    fileReal = realpathSync.native(file)
+  } catch {
+    throw new Error(`${label} is missing or cannot be resolved`)
+  }
+  if (!isPathInside(rootReal, fileReal) || !statSync(fileReal).isFile()) {
+    throw new Error(`${label} resolves outside its pinned package directory`)
+  }
+  const actual = createHash('sha256').update(readFileSync(fileReal)).digest('hex')
+  if (actual !== sha256) throw new Error(`${label} failed the pinned SHA-256 integrity check`)
+  return fileReal
+}
+
+export function trustedRuntimeWasm(wtsDir) {
+  return verifyParserArtifact({
+    file: join(wtsDir, 'tree-sitter.wasm'), root: wtsDir,
+    sha256: RUNTIME_SHA256, label: 'web-tree-sitter runtime',
+  })
+}
+
+export function trustedGrammarWasm(wasmDir, grammar) {
+  const sha256 = GRAMMAR_SHA256[grammar]
+  if (!sha256) throw new Error(`unsupported tree-sitter grammar: ${grammar}`)
+  return verifyParserArtifact({
+    file: join(wasmDir, `tree-sitter-${grammar}.wasm`), root: wasmDir,
+    sha256, label: `tree-sitter ${grammar} grammar`,
+  })
+}

package/src/mcp/architecture-starter.mjs

@@ -13,7 +13,7 @@ export const PROVISIONAL_BUDGETS = Object.freeze({
     maxModuleBoundaryRatio: .65,
 })
 
-export const STARTER_BUDGETS = Object.freeze({
+const STARTER_BUDGETS = Object.freeze({
     runtimeCycles: PROVISIONAL_BUDGETS.runtimeCycles,
     maxFileLoc: PROVISIONAL_BUDGETS.maxFileLoc,
 })

package/src/mcp/evidence-snapshot.duplicates.mjs

@@ -11,7 +11,7 @@ const MIN_TOKENS = 50
 const FILTERED_CLASSES = new Set(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const SAFE_SYMBOL = /^[A-Za-z_$][A-Za-z0-9_$]*$/
 
-export const DUPLICATE_EVIDENCE_THRESHOLDS = Object.freeze({
+const DUPLICATE_EVIDENCE_THRESHOLDS = Object.freeze({
     clones: Object.freeze({mode: 'renamed', minSimilarityPercent: CLONE_MIN_SIMILARITY, minTokens: MIN_TOKENS}),
     divergence: Object.freeze({
         sameName: true,

package/src/mcp/health/audit-format.mjs

@@ -96,10 +96,29 @@ const auditDependencyCoverageLines = (deps) => {
     ]
 }
 
-const auditDependencySummaryLine = (audit, deps) => {
+const scopedDependencyFindingCounts = (allFindings, scopedFindings) => {
+    const dependencyFindings = (items) => (items || []).filter(isDependencyAuditFinding)
+    const all = dependencyFindings(allFindings)
+    const scoped = dependencyFindings(scopedFindings)
+    const count = (rule) => scoped.filter((finding) => finding.rule === rule).length
+    return {
+        unused: count('unused-dep'),
+        missing: count('missing-dep'),
+        duplicateDeclarations: count('duplicate-dep'),
+        suppressed: Math.max(0, all.length - scoped.length),
+    }
+}
+
+const auditDependencySummaryLine = (audit, deps, scopedCounts = null) => {
     const ecosystems = Object.values(deps.ecosystems || {}).filter((item) => item?.present)
     const checked = ecosystems.filter((item) => item.status === 'CHECKED')
     const unsupported = ecosystems.filter((item) => item.status === 'NOT_SUPPORTED')
+    const unused = scopedCounts?.unused ?? deps.unused ?? 'unknown'
+    const missing = scopedCounts?.missing ?? deps.missing ?? 'unknown'
+    const duplicateDeclarations = scopedCounts?.duplicateDeclarations ?? deps.duplicateDeclarations ?? 'unknown'
+    const scopedSuffix = scopedCounts?.suppressed
+        ? ` Production-first path policy suppressed ${scopedCounts.suppressed} classified dependency finding(s).`
+        : ''
     if (!ecosystems.length || deps.status === 'NOT_CHECKED') {
         return 'Dependency manifests: NOT_CHECKED — no dependency manifest was discovered; manifest-to-import verification did not run and no dependency verdict was produced.'
     }
@@ -116,9 +135,9 @@ const auditDependencySummaryLine = (audit, deps) => {
         const unsupportedDeclared = unsupported.reduce((total, item) => total + (item.declared || 0), 0)
         const checkedNames = checked.map((item) => item.ecosystem).join(', ')
         const unsupportedNames = unsupported.map((item) => item.ecosystem).join(', ')
-        return `Dependency manifests: ${deps.status || 'PARTIAL'} — checked ${checkedDeclared} declaration(s) across ${checkedManifests} supported manifest(s) (${checkedNames}); inventoried ${unsupportedDeclared} declaration(s) across ${unsupportedManifests} unsupported manifest(s) (${unsupportedNames}), where package-to-artifact verification is NOT_SUPPORTED. Supported-ecosystem findings: unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`
+        return `Dependency manifests: ${deps.status || 'PARTIAL'} — checked ${checkedDeclared} declaration(s) across ${checkedManifests} supported manifest(s) (${checkedNames}); inventoried ${unsupportedDeclared} declaration(s) across ${unsupportedManifests} unsupported manifest(s) (${unsupportedNames}), where package-to-artifact verification is NOT_SUPPORTED. Supported-ecosystem findings: unused ${unused}, missing ${missing}, duplicate declarations ${duplicateDeclarations}.${scopedSuffix}`
     }
-    return `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`
+    return `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${unused}, missing ${missing}, duplicate declarations ${duplicateDeclarations}.${scopedSuffix}`
 }
 
 const auditConventionLines = (audit) => {
@@ -140,11 +159,12 @@ export const formatOrdinaryAudit = (audit, args, findings = audit.findings, head
     const sev = summary.bySeverity
     const bycat = summary.byCategory
     const deps = audit.dependencyReport || {}
+    const dependencyCounts = scopedDependencyFindingCounts(findings, pathScope.findings)
     return [
         heading,
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         ...auditConventionLines(audit),
-        auditDependencySummaryLine(audit, deps),
+        auditDependencySummaryLine(audit, deps, dependencyCounts),
         ...auditDependencyCoverageLines(deps),
         ...auditCapabilityLines(audit),
         ...auditExtensionLines(audit),

package/src/mcp/runtime-version.mjs

@@ -1,7 +1,7 @@
 import {readFileSync} from 'node:fs'
 import process from 'node:process'
 
-export const STALE_RUNTIME_OVERRIDE_ENV = 'WEAVATRIX_ALLOW_STALE_RUNTIME'
+const STALE_RUNTIME_OVERRIDE_ENV = 'WEAVATRIX_ALLOW_STALE_RUNTIME'
 
 export function runtimeVersionStatus({runningVersion, packageJsonPath, allowStale} = {}) {
     let diskVersion = null, packageVersionError = null
@@ -29,4 +29,3 @@ export function staleRuntimeMessage(status) {
     const disk = status.diskVersion || 'unavailable'
     return `STALE_RUNTIME: running Weavatrix ${status.version || 'unknown'} but package.json on disk is ${disk}. Restart/reconnect the MCP server before using tools. For deliberate source-development only, set ${STALE_RUNTIME_OVERRIDE_ENV}=1.`
 }
-

package/src/mcp/sync/evidence-common.mjs

@@ -1,7 +1,7 @@
 export const SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'info'])
 export const CONFIDENCE = new Set(['high', 'medium', 'low'])
 export const CATEGORIES = new Set(['unused', 'structure', 'vulnerability', 'malware'])
-export const CHECK_KEYS = ['osv', 'malware']
+const CHECK_KEYS = ['osv', 'malware']
 export const PACKAGE_DEPENDENCY_KINDS = new Set(['runtime', 'dev', 'optional', 'peer', 'optional-peer'])
 export const CAPS = Object.freeze({
     modules: 500, dependencies: 2000, findings: 500, hotspots: 250, badges: 100,

package/src/mcp/tool-result.mjs

@@ -2,7 +2,7 @@
 // JSON mode adds the stable machine-readable structuredContent envelope and mirrors that envelope
 // into TextContent for workflow runners that cannot consume structured results directly.
 
-export const TOOL_RESULT_SCHEMA = 'weavatrix.tool.v1'
+const TOOL_RESULT_SCHEMA = 'weavatrix.tool.v1'
 
 export function toolResult(text, result, extra = {}) {
     return {

package/src/precision/lsp-client/lifecycle.js

@@ -25,40 +25,19 @@ export function killClient(client, reason = new Error('LSP client was killed'))
     }
     if (client.child.exitCode != null || client.child.signalCode != null) return
     if (process.platform === 'win32' && client.child.pid) {
-        try {
-            const killer = spawnChild('taskkill', ['/pid', String(client.child.pid), '/T', '/F'], {
-                shell: false,
-                windowsHide: true,
-                env: lspChildProcessEnv(),
-                stdio: 'ignore',
-            })
-            const fallback = () => {
-                try { client.child.kill('SIGKILL') } catch { /* already exited */ }
-            }
-            killer.once('error', fallback)
-            killer.once('exit', (code) => { if (code !== 0) fallback() })
-        } catch {
-            try { client.child.kill('SIGKILL') } catch { /* already exited */ }
-        }
+        startWindowsTreeKill(client)
     } else {
         try { client.child.kill('SIGKILL') } catch { /* already exited */ }
     }
 }
 
-export async function killWindowsTreeAndWait(client, timeoutMs = 3_000) {
-    if (process.platform !== 'win32' || !client.child.pid || client.child.exitCode != null) return
-    await new Promise((resolveKill) => {
-        let settled = false
-        const done = () => {
-            if (settled) return
-            settled = true
-            clearTimeout(timer)
-            resolveKill()
-        }
-        const timer = setTimeout(() => {
-            try { client.child.kill() } catch { /* already exited */ }
-            done()
-        }, Math.max(250, Math.min(5_000, Number(timeoutMs) || 3_000)))
+function directChildKill(client) {
+    try { client.child.kill('SIGKILL') } catch { /* already exited */ }
+}
+
+function startWindowsTreeKill(client) {
+    if (client.windowsTreeKillPromise) return client.windowsTreeKillPromise
+    client.windowsTreeKillPromise = new Promise((resolveKill) => {
         try {
             const killer = spawnChild('taskkill', ['/pid', String(client.child.pid), '/T', '/F'], {
                 shell: false,
@@ -66,19 +45,27 @@ export async function killWindowsTreeAndWait(client, timeoutMs = 3_000) {
                 env: lspChildProcessEnv(),
                 stdio: 'ignore',
             })
-            const fallback = () => {
-                try { client.child.kill('SIGKILL') } catch { /* already exited */ }
-            }
-            killer.once('error', () => { fallback(); done() })
-            killer.once('exit', (code) => {
-                if (code !== 0) fallback()
-                done()
-            })
+            killer.once('error', () => { directChildKill(client); resolveKill() })
+            killer.once('exit', (code) => { if (code !== 0) directChildKill(client); resolveKill() })
         } catch {
-            try { client.child.kill('SIGKILL') } catch { /* already exited */ }
-            done()
+            directChildKill(client)
+            resolveKill()
         }
     })
+    return client.windowsTreeKillPromise
+}
+
+export async function killWindowsTreeAndWait(client, timeoutMs = 3_000) {
+    if (process.platform !== 'win32' || !client.child.pid || client.child.exitCode != null) return
+    const boundedTimeout = Math.max(250, Math.min(5_000, Number(timeoutMs) || 3_000))
+    let timer
+    await Promise.race([
+        startWindowsTreeKill(client),
+        new Promise((resolveKill) => {
+            timer = setTimeout(() => { directChildKill(client); resolveKill() }, boundedTimeout)
+        }),
+    ])
+    if (timer) clearTimeout(timer)
 }
 
 export async function waitForClientExit(client, timeoutMs = client.requestTimeoutMs) {

package/src/precision/lsp-client/registry.js

@@ -45,10 +45,11 @@ export async function shutdownActiveLspClients({timeoutMs = 3_000} = {}) {
         await Promise.allSettled(survivors.map(async (client) => {
             if (typeof client.killWindowsTreeAndWait === 'function') await client.killWindowsTreeAndWait(forceBudget)
             client.kill(reason)
-            if (typeof client.waitForExit === 'function') {
-                await client.waitForExit(Math.max(100, boundedTimeout - (Date.now() - startedAt)))
-            }
         }))
+        const reapBudget = Math.max(250, Math.min(1_000, Math.floor(boundedTimeout * 0.4)))
+        await Promise.allSettled(survivors.map((client) => (
+            typeof client.waitForExit === 'function' ? client.waitForExit(reapBudget) : undefined
+        )))
     }
     return {
         requested: clients.length,

package/src/precision/lsp-client/stdio-client.js

@@ -15,14 +15,9 @@ import {
     unregisterLspClient,
 } from './registry.js'
 import {
-    assertClientWritable,
     closeClientDocument,
-    defaultClientServerRequest,
-    handleClientServerRequest,
     handleClientMessage,
     initializeClient,
-    normalizeClientLocations,
-    notifyClient,
     openClientDocument,
     queryClientLocations,
     rejectPendingRequests,
@@ -34,7 +29,6 @@ import {
     killClient,
     killWindowsTreeAndWait,
     shutdownClient,
-    shutdownClientOnce,
     waitForClientExit,
 } from './lifecycle.js'
 
@@ -70,6 +64,7 @@ export class StdioLspClient {
         this.state = 'starting'
         this.stderrTail = ''
         this.shutdownPromise = null
+        this.windowsTreeKillPromise = null
         this.child = spawn(executablePath, args, {
             cwd: this.normalizer.rootPath,
             env: lspChildProcessEnv(env),
@@ -123,18 +118,13 @@ export class StdioLspClient {
     }
 
     async start() { await this.spawned; return this }
-    assertWritable() { return assertClientWritable(this) }
     writeMessage(message) { return writeClientMessage(this, message) }
     request(method, params, options) { return requestFromClient(this, method, params, options) }
-    notify(method, params) { return notifyClient(this, method, params) }
     initialize(options) { return initializeClient(this, options) }
     openDocument(options) { return openClientDocument(this, options) }
     closeDocument(filePath) { return closeClientDocument(this, filePath) }
-    normalizeLocations(result) { return normalizeClientLocations(this, result) }
     definition(options) { return queryClientLocations(this, 'definition', options) }
     references(options) { return queryClientLocations(this, 'references', options) }
-    defaultServerRequest(method, params) { return defaultClientServerRequest(this, method, params) }
-    handleServerRequest(message) { return handleClientServerRequest(this, message) }
     handleMessage(message) { return handleClientMessage(this, message) }
     rejectPending(error) { return rejectPendingRequests(this, error) }
     fail(error) { return failClient(this, error) }
@@ -142,7 +132,6 @@ export class StdioLspClient {
     killWindowsTreeAndWait(timeoutMs) { return killWindowsTreeAndWait(this, timeoutMs) }
     waitForExit(timeoutMs) { return waitForClientExit(this, timeoutMs) }
     shutdown(options) { return shutdownClient(this, options) }
-    shutdownOnce(options) { return shutdownClientOnce(this, options) }
 }
 
 export async function startStdioLspClient(options) {

package/src/precision/symbol-query.js

@@ -9,8 +9,8 @@ import {
 } from './lsp-overlay.js'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
-export const SYMBOL_PRECISION_CACHE_V = 1
-export const SYMBOL_PRECISION_CACHE_FILE = 'precision-symbols.json'
+const SYMBOL_PRECISION_CACHE_V = 1
+const SYMBOL_PRECISION_CACHE_FILE = 'precision-symbols.json'
 
 const MAX_CACHE_ENTRIES = 32
 const MAX_CACHE_BYTES = 8 * 1024 * 1024

package/src/precision/typescript-provider/discovery.js

@@ -3,7 +3,7 @@ import {dirname, extname, isAbsolute, join} from 'node:path'
 import {createRequire} from 'node:module'
 
 const requireFromWeavatrix = createRequire(import.meta.url)
-export const PROVIDER = 'typescript-language-server'
+const PROVIDER = 'typescript-language-server'
 export const TYPESCRIPT_LSP_CAPABILITY_CONTRACT = 'typescript-references-v4-plugin-suppression'
 let discoveredProvider = null
 

package/src/security/advisory-store.js

@@ -8,7 +8,7 @@ import {createHash} from 'node:crypto'
 import {uniqueBy} from '../util.js'
 
 export const DEFAULT_STORE = join(homedir(), '.weavatrix', 'advisories.json')
-export const OSV_SUPPORTED_ECOSYSTEMS = new Set(['npm', 'PyPI', 'Go', 'Maven', 'crates.io'])
+const OSV_SUPPORTED_ECOSYSTEMS = new Set(['npm', 'PyPI', 'Go', 'Maven', 'crates.io'])
 
 const keyOf = (ecosystem, name) => `${ecosystem}|${ecosystem === 'PyPI' ? String(name).toLowerCase().replace(/[-_.]+/g, '-') : name}`
 const uniquePackages = (packages) => uniqueBy(packages, (item) => `${item.ecosystem}|${item.name}|${item.version}`)