weavatrix 0.3.3 → 0.3.5

package/README.md

@@ -311,6 +311,17 @@ before starting the MCP server for parser-only operation from the first build, o
 `precision:"off"` to `rebuild_graph` / `open_repo`. The MCPB installer exposes the same `lsp` / `off`
 choice as **TypeScript/JavaScript semantic precision**.
 
+The broad prewarm stays conservative by default: it queries 32 ranked symbols and never more than
+64. A deliberate high-budget run can set `WEAVATRIX_PRECISION_MAX_SYMBOLS` above 64 (for example,
+`1000`), or set `WEAVATRIX_PRECISION_PREWARM=full` to select every eligible target up to the hard
+10,000-symbol safety ceiling. Expanded runs receive proportionate reference/link and deadline
+budgets, still capped at 131,072 references/links, a 30-minute deadline, 1,024 open documents and
+128 MiB of verified source. `WEAVATRIX_PRECISION_MAX_REFERENCES`,
+`WEAVATRIX_PRECISION_MAX_LINKS`, and `WEAVATRIX_PRECISION_TIMEOUT_MS` can lower or explicitly tune
+those budgets. Repositories that exceed any hard ceiling remain honestly `PARTIAL`; the default
+memory/time profile is unchanged. On-demand `get_dependents`, `inspect_symbol`, and
+`change_impact` queries remain revision-bound separate caches and do not require a full prewarm.
+
 **search / source** — `search_code` (ripgrep-backed, pure-Node fallback, with repository-relative
 path globs on Windows/macOS/Linux), `read_source` (a
 symbol's actual code in one hop), `context_bundle` (definition plus grouped inbound/outbound
@@ -413,6 +424,35 @@ metrics are not persisted or transmitted by Weavatrix. If a source checkout's pa
 while an old daemon remains alive, `initialize`, `tools/list`, and tool calls fail loudly with
 `STALE_RUNTIME` until the client reconnects; the opt-out is reserved for deliberate development.
 
+### 0.3.5 explicit full semantic prewarm
+
+- Normal startup remains bounded to 32 ranked semantic targets. An explicit
+  `WEAVATRIX_PRECISION_PREWARM=full` run, or a requested symbol budget above
+  64, can now cover every eligible JS/TS target within hard time, source and
+  memory ceilings instead of being silently clamped to 64.
+- Real Hosted dogfood queried all 800 eligible targets in about 49 seconds and
+  produced 4,127 `EXACT_LSP` edges with `COMPLETE` semantic precision.
+- Unreferenced public exports are now reported as low-confidence module-surface
+  evidence, not as proof that their implementations are dead.
+
+Full patch notes: [docs/releases/v0.3.5.md](docs/releases/v0.3.5.md).
+
+### 0.3.4 self-audit precision and bounded dynamic imports
+
+- JS/TS graph construction now resolves the existing local-file prefix in
+  ``import(new URL(`./tool.mjs${runtimeValue}`, import.meta.url).href)`` while
+  preserving the edge as dynamic. Variable-first paths, remote URLs, alternate
+  bases and other runtime-only targets remain explicit unknowns.
+- Health dependency headlines now follow the same production-first path scope as
+  the displayed findings. Classified fixture results are counted separately
+  instead of making a clean application headline look unhealthy.
+- Dead-code liveness no longer treats comment-only symbol mentions as callers;
+  string-addressed runtime registries remain conservatively live. Dogfood removed
+  obsolete internal exports/wrappers while preserving every supported Online
+  extension point and TypeScript host callback.
+
+Full patch notes: [docs/releases/v0.3.4.md](docs/releases/v0.3.4.md).
+
 ### 0.3.3 parser supply-chain boundary
 
 - Before compiling parser WASM, Core now requires the package-pinned `web-tree-sitter` runtime and

package/docs/releases/v0.3.4.md

@@ -0,0 +1,40 @@
+# Weavatrix 0.3.4
+
+0.3.4 is a focused self-audit precision release. It removes false Health and
+dead-code noise found while dogfooding Core against its own current source,
+without widening the 34-tool offline boundary.
+
+## Bounded dynamic-import evidence
+
+JS/TS graph construction now recognizes the statically named local module in
+URL-based imports such as
+``import(new URL(`./tools-health.mjs${cacheBust}`, import.meta.url).href)``.
+The resolved local candidate participates in reachability, while the edge keeps
+its `dynamic` marker. Variable-first templates, remote URLs, non-`import.meta.url`
+bases and other runtime-only expressions remain unresolved rather than being
+guessed.
+
+## Health and dead-code precision
+
+- The dependency summary uses the same production-first path scope as the
+  findings shown below it. Findings isolated to fixtures/tests are reported as a
+  separate suppressed count instead of leaking into the production headline.
+- Comment-only lexical mentions no longer prove symbol liveness. String-based
+  registries and reflective dispatch stay conservative because they may be real
+  runtime entry points.
+- Dogfood removed unnecessary internal exports, obsolete declarations and
+  uncalled LSP wrapper methods. Supported Online extension exports and
+  TypeScript host callbacks remain intact.
+
+Current-source dogfood reports zero Health findings in both full and no-tests
+graphs. The remaining low-confidence dead-code queue contains only the five
+supported Online extension exports and two TypeScript host callbacks. Classified
+benchmark dependency findings remain available through `include_classified`.
+
+The release remains gated by the full Node suite, release metadata validation,
+portable MCPB/npm runtime smoke, dependency audit and self-dogfood.
+
+The strict source-free real-repository benchmark was refreshed from clean,
+revision-bound checkouts and passes all six language repositories (TypeScript,
+JavaScript, Python, Go, Java and Rust) with complete provenance, expected-signal
+and relation-regression gates.

package/docs/releases/v0.3.5.md

@@ -0,0 +1,50 @@
+# Weavatrix 0.3.5
+
+0.3.5 removes the hidden 64-symbol ceiling from deliberately high-budget
+TypeScript/JavaScript semantic prewarms while keeping the ordinary offline
+startup profile unchanged.
+
+## Explicit full semantic prewarm
+
+- The default remains a 32-symbol ranked prewarm with the previous 64-symbol,
+  16,384-reference/link and 60-second hard ceilings.
+- Setting `WEAVATRIX_PRECISION_MAX_SYMBOLS` above 64 now explicitly opts into
+  the expanded policy instead of being silently clamped back to 64.
+- `WEAVATRIX_PRECISION_PREWARM=full` selects all eligible targets, bounded by a
+  10,000-symbol hard ceiling. It is intended for CI, release evidence and
+  manually requested deep repository audits, not implicit startup work.
+- Expanded runs scale their default reference/link budget to 16 per requested
+  symbol and their deadline to one second per requested symbol. Hard limits
+  remain 131,072 references/links and 30 minutes.
+- Verified source remains bounded to 4 MiB per file, 1,024 simultaneously open
+  documents and 128 MiB total. Crossing a ceiling remains `PARTIAL`; it never
+  becomes a false complete result or an unbounded allocation.
+
+The point-query cache used by `get_dependents` and `inspect_symbol`, and the
+bounded changed-symbol batch used by `change_impact`, remain separate from this
+broad overlay. Existing default and on-demand behavior is unchanged.
+
+The regression suite proves both sides of the contract: an ordinary build still
+selects 32 of 80 candidates and reports `PARTIAL`, while an explicit 1,000-symbol
+budget and `full` mode each query all 80 targets and report `COMPLETE` with a
+cooperative provider.
+
+## Dead-code verdict consistency
+
+- `run_audit` now labels an unreferenced public export as low-confidence
+  `unused-export-surface` evidence and sets `deadCodeCandidate:false`.
+- The audit explains that an unused module surface is not proof of a dead
+  implementation; downstream packages and runtime registries may be invisible.
+- This matches `find_dead_code`, which keeps the same uncertain public surface
+  out of its default medium-confidence review queue while reporting the
+  suppressed low-confidence count.
+
+## Consistent unused-export confidence
+
+`run_audit` now labels an unused export as low-confidence export-surface
+evidence, not a medium-confidence dead implementation. The finding explicitly
+distinguishes removing an unnecessary export keyword from deleting the symbol,
+which still requires the separate exact/reference-aware `find_dead_code`
+workflow. This aligns Health with the default dead-code queue, where public and
+framework-sensitive candidates are intentionally suppressed until
+`min_confidence=low` is requested.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -37,6 +37,8 @@
     "docs/releases/v0.3.1.md",
     "docs/releases/v0.3.2.md",
     "docs/releases/v0.3.3.md",
+    "docs/releases/v0.3.4.md",
+    "docs/releases/v0.3.5.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/src/analysis/cycle-route.js

@@ -1,4 +1,4 @@
-export const MAX_REPRESENTATIVE_CYCLE_FILES = 64;
+const MAX_REPRESENTATIVE_CYCLE_FILES = 64;
 
 // Keep the complete closed route for normal cycles. Very large SCCs still get a closed, deterministic
 // head/tail route without letting one finding consume the whole audit response.

package/src/analysis/dead-check.js

@@ -2,17 +2,37 @@
 // calls/imports/references/inherits it) AND its bare name appears NOWHERE in the repo outside its own file.
 // A file is DEAD when nothing imports it, it isn't an entry point, and all its symbols are dead.
 //
-// Pure core `computeDead(graph, sources)` (sources = Map<fileRel, text>) is fully testable with no filesystem.
-// `analyzeDeadCode(graph, repoRoot)` is the thin fs wrapper. Works on ANY graph-builder-schema graph (built-in OR
-// graph-builder) — it only needs {nodes, links} + the source text. See [[graph-builder-internalization]].
-import { readFileSync } from "node:fs";
+// Pure core `computeDead(graph, sources)` (sources = Map<fileRel, text>) works on any graph-builder-schema graph
+// and is fully testable with no filesystem. It only needs {nodes, links} + source text. See [[graph-builder-internalization]].
 import { posix } from "node:path";
-import { createRepoBoundary } from "../repo-path.js";
 import { isStructuralRelation } from "../graph/relations.js";
 import { createPathClassifier, hasPathClass } from "../path-classification.js";
 
 const IDENT_RE = /[A-Za-z_$][\w$]*/g;
 const bareName = (label) => String(label || "").replace(/\s*\(.*$/, "").replace(/[()]/g, "").trim();
+// Ignore comment-only lexical mentions, which are documentation rather than callers. Keep strings on
+// purpose: registries/reflection often address a live symbol by name, and static liveness must stay
+// conservative there. This only strips comments that start a logical line, avoiding a language parser
+// guess around inline comment markers, regex literals, or URLs.
+const lexicalEvidenceText = (value) => {
+  let inBlockComment = false;
+  return String(value || "").split(/\r?\n/).map((line) => {
+    let rest = line;
+    while (true) {
+      if (inBlockComment) {
+        const end = rest.indexOf("*/");
+        if (end < 0) return "";
+        inBlockComment = false;
+        rest = rest.slice(end + 2);
+      }
+      const trimmed = rest.trimStart();
+      if (trimmed.startsWith("//") || trimmed.startsWith("#")) return "";
+      if (!trimmed.startsWith("/*")) return rest;
+      inBlockComment = true;
+      rest = trimmed.slice(2);
+    }
+  }).join("\n");
+};
 // entry surfaces are never dead even with no inbound edge (framework/CLI/HTTP enter them externally).
 // Exported for internal-audit.js (reachability entry set) — keep the two in lockstep.
 export const ENTRY_FILE = /(^|[\\/])(index|main|app|server|cli|cmd|bootstrap|entry|run|__main__|manage|wsgi|asgi|setup|conftest)\.[a-z0-9]+$|(^|[\\/])(bin|cmd)[\\/]|(^|[\\/])main\.go$/i;
@@ -21,8 +41,8 @@ const isTestFile = (file) => hasPathClass(defaultPathClassifier.explain(file), "
 
 // Framework-owned entry modules are invoked by convention rather than a source import. Keep this narrow:
 // these are Next.js App/Pages Router surfaces and framework metadata files, not every file under `app/`.
-export const NEXT_ENTRY_FILE = /(^|\/)(?:src\/)?app\/(?:.*\/)?(?:page|layout|template|loading|error|global-error|not-found|default|route|robots|sitemap|manifest|opengraph-image|twitter-image|icon|apple-icon)\.[cm]?[jt]sx?$|(^|\/)(?:src\/)?pages\/(?!.*\/(?:components?|lib|utils?)\/).+\.[cm]?[jt]sx?$|(^|\/)(?:middleware|instrumentation)\.[cm]?[jt]s$/i;
-export const RUST_ENTRY_FILE = /(^|\/)(?:build\.rs|src\/(?:lib|main)\.rs)$/i;
+const NEXT_ENTRY_FILE = /(^|\/)(?:src\/)?app\/(?:.*\/)?(?:page|layout|template|loading|error|global-error|not-found|default|route|robots|sitemap|manifest|opengraph-image|twitter-image|icon|apple-icon)\.[cm]?[jt]sx?$|(^|\/)(?:src\/)?pages\/(?!.*\/(?:components?|lib|utils?)\/).+\.[cm]?[jt]sx?$|(^|\/)(?:middleware|instrumentation)\.[cm]?[jt]s$/i;
+const RUST_ENTRY_FILE = /(^|\/)(?:build\.rs|src\/(?:lib|main)\.rs)$/i;
 export const isFrameworkEntryFile = (file) => {
   const normalized = String(file || "").replace(/\\/g, "/");
   return NEXT_ENTRY_FILE.test(normalized) || RUST_ENTRY_FILE.test(normalized);
@@ -114,7 +134,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
   // whole-repo identifier frequency: a symbol whose name appears MORE than once total (its definition + at least
   // one use, same-file OR cross-file) is referenced. Errs toward "alive" (common-named symbols never flagged).
   const globalFreq = new Map();
-  for (const [, text] of sources) for (const m of String(text || "").matchAll(IDENT_RE)) { const n = m[0]; globalFreq.set(n, (globalFreq.get(n) || 0) + 1); }
+  for (const [, text] of sources) for (const m of lexicalEvidenceText(text).matchAll(IDENT_RE)) { const n = m[0]; globalFreq.set(n, (globalFreq.get(n) || 0) + 1); }
 
   const symById = new Map();
   const symsByFile = new Map();
@@ -127,7 +147,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
   const symbolNames = new Set([...symById.values()].map((node) => bareName(node.label)).filter(Boolean));
   const occurrenceFiles = new Map();
   const occurrenceCounts = new Map();
-  for (const [file, text] of sources) for (const match of String(text || "").matchAll(IDENT_RE)) {
+  for (const [file, text] of sources) for (const match of lexicalEvidenceText(text).matchAll(IDENT_RE)) {
     const name = match[0];
     if (!symbolNames.has(name)) continue;
     const files = occurrenceFiles.get(name) || new Set();
@@ -276,17 +296,3 @@ export function computeUnusedExports(graph, sources, { dynamicTargets = new Set(
   }
   return out;
 }
-
-// fs wrapper: reads each graph file's source once, then runs the pure checker.
-export function analyzeDeadCode(graph, repoRoot) {
-  const sources = new Map();
-  const files = new Set();
-  const boundary = createRepoBoundary(repoRoot);
-  for (const n of graph.nodes || []) if (n.source_file) files.add(n.source_file);
-  for (const f of files) {
-    const resolved = boundary.resolve(f);
-    if (!resolved.ok) continue;
-    try { sources.set(f, readFileSync(resolved.path, "utf8")); } catch { /* file gone */ }
-  }
-  return computeDead(graph, sources);
-}

package/src/analysis/dead-code-review/policy.js

@@ -1,7 +1,7 @@
 import {hasPathClass} from '../../path-classification.js'
 
 export const DEAD_CODE_CONFIDENCE_RANK = Object.freeze({high: 0, medium: 1, low: 2})
-export const DYNAMIC_CODE_RE = /(?:\brequire\s*\(\s*(?!["'])|\bcreateRequire\s*\(|\b__import__\s*\(|\bimportlib\.|(?:^|[^\w.$])(?:eval|exec)\s*\()/m
+const DYNAMIC_CODE_RE = /(?:\brequire\s*\(\s*(?!["'])|\bcreateRequire\s*\(|\b__import__\s*\(|\bimportlib\.|(?:^|[^\w.$])(?:eval|exec)\s*\()/m
 const JS_DYNAMIC_IMPORT_RE = /\bimport\s*\(/
 const JS_LIKE_PATH_RE = /\.(?:[cm]?js|jsx|[cm]?ts|tsx)$/i
 export const REFLECTION_CODE_RE = /(?:\b(?:Class\.forName|get(?:Declared)?Method|getattr|setattr|hasattr|Method\.Invoke|GetMethod|GetProcAddress|dlsym)\s*\(|\b(?:globals|locals)\s*\(\s*\)\s*\[|\breflect\.[A-Za-z_$][\w$]*\s*\()/i

package/src/analysis/findings.js

@@ -3,8 +3,7 @@
 // so the renderer and the AI summarizer consume one contract regardless of engine.
 import { createHash } from "node:crypto";
 
-export const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
-export const FINDING_CATEGORIES = ["unused", "structure", "vulnerability", "malware"];
+const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
 
 export function dependencyVerification(manifest, imports, decision, mapping) {
   return {

package/src/analysis/internal-audit.run.js

@@ -148,13 +148,16 @@ export async function runInternalAudit(repoPath, {
       category: "unused",
       rule: "unused-export",
       severity: "info",
-      confidence: "medium",
+      confidence: "low",
       title: `Unused export: ${symbol.label.replace(/\(\)$/, "")} — ${symbol.file}`,
-      detail: `${symbol.reason}. Either remove the export keyword (if used only internally) or delete the symbol.`,
+      detail: `${symbol.reason}. This is unused module-surface evidence, not proof that the implementation is dead: downstream packages and runtime registration can be invisible to the repository graph. Review external consumers first; remove only the export keyword when the symbol is still used internally, and delete the implementation only after separate dead-code verification.`,
       file: symbol.file,
       symbol: symbol.label,
       graphNodeId: symbol.id,
       source: "internal",
+      classification: "unused-export-surface",
+      deadCodeCandidate: false,
+      fixHint: "check downstream/runtime consumers, then remove only the export surface or run a separate exact dead-code review before deleting the implementation",
     }));
     unusedExportCount++;
   }

package/src/analysis/package-reachability.js

@@ -1,7 +1,7 @@
 // Package-level reachability: correlate a dependency finding with the graph's external imports.
 // This is intentionally not function-level exploitability analysis. It only states whether product
 // code imports the package and preserves unknown as unknown.
-export const PACKAGE_REACHABILITY_V = 1
+const PACKAGE_REACHABILITY_V = 1
 
 export function packageReachability(externalImports, packageName, {isNonProductPath = () => false} = {}) {
     const imports = (Array.isArray(externalImports) ? externalImports : [])

package/src/graph/builder/js/dynamic-import.js

@@ -0,0 +1,26 @@
+// Resolve only the bounded local-file portion of URL-based dynamic imports.
+// Runtime substitutions remain uncertain; this candidate exists solely so a
+// statically named module is not mislabeled as an orphan.
+export function boundedUrlImportTarget(arg, {field, fileRel, resolveJsImport}) {
+  if (!arg || arg.type !== "member_expression" || field(arg, "property")?.text !== "href") return null;
+  const created = field(arg, "object");
+  if (!created || created.type !== "new_expression" || field(created, "constructor")?.text !== "URL") return null;
+  const urlArgs = field(created, "arguments")?.namedChildren || [];
+  if (urlArgs.length !== 2 || urlArgs[1].text !== "import.meta.url") return null;
+
+  const source = urlArgs[0];
+  let rawSpec = "";
+  if (source.type === "string") {
+    rawSpec = source.text.replace(/^['"`]|['"`]$/g, "");
+  } else if (source.type === "template_string") {
+    const parts = source.namedChildren || [];
+    if (parts.length !== 2 || parts[0].type !== "string_fragment" || parts[1].type !== "template_substitution") return null;
+    rawSpec = parts[0].text;
+  } else return null;
+
+  if (!/^\.\.?\//.test(rawSpec)) return null;
+  const staticPath = rawSpec.split(/[?#]/)[0];
+  if (!/\.[cm]?[jt]sx?$/i.test(staticPath)) return null;
+  const target = resolveJsImport(fileRel, staticPath);
+  return target ? {rawSpec: staticPath, target} : null;
+}

package/src/graph/builder/lang-js.js

@@ -6,6 +6,7 @@ import {
   CALLABLE, FUNCS, TOPVARS, TYPES, REQUIRE, parseExportSpecifiers,
   importTypeOnly, reexportTypeOnly,
 } from './js/queries.js';
+import {boundedUrlImportTarget} from './js/dynamic-import.js';
 
 export default {
   family: "js",
@@ -201,7 +202,8 @@ export default {
         else if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "dynamic", line });
         else if (rawSpec) recordUnresolved(rawSpec, "dynamic", line);
       } else {
-        addExternalImport({ dynamic: true, kind: "dynamic", line });
+        const bounded = boundedUrlImportTarget(arg, {field, fileRel, resolveJsImport});
+        addExternalImport({ dynamic: true, kind: "dynamic", line, ...(bounded ? {spec: bounded.rawSpec, target: bounded.target} : {}) });
       }
     }
 

package/src/graph/builder/spec-pkg.js

@@ -62,7 +62,7 @@ export const PY_STDLIB = new Set(("__future__ __main__ _thread abc aifc argparse
 
 // import name → PyPI dist where they differ. Generic python-X / X-python / X[2]-binary equivalence is
 // handled by the matcher in dep-check; this map covers the truly irregular names.
-export const PY_IMPORT_TO_DIST = {
+const PY_IMPORT_TO_DIST = {
   yaml: "PyYAML", cv2: "opencv-python", PIL: "Pillow", sklearn: "scikit-learn", skimage: "scikit-image",
   bs4: "beautifulsoup4", dateutil: "python-dateutil", dotenv: "python-dotenv", jose: "python-jose",
   magic: "python-magic", multipart: "python-multipart", docx: "python-docx", pptx: "python-pptx",
@@ -78,7 +78,7 @@ export const PY_IMPORT_TO_DIST = {
 };
 // namespace roots shared by many dists (google.protobuf/google.cloud.* …) — too ambiguous to name one
 // package; "src" is a repo-layout artifact (stale sys.path import), never a PyPI dist.
-export const PY_AMBIGUOUS_TOP = new Set(["google", "src"]);
+const PY_AMBIGUOUS_TOP = new Set(["google", "src"]);
 export function pySpecToPkg(topModule) {
   const t = String(topModule || "").trim();
   if (!t) return null;

package/src/graph/freshness-probe.js

@@ -8,8 +8,8 @@ import {createRequire} from 'node:module'
 import {childProcessEnv} from '../child-env.js'
 import {createRepoBoundary} from '../repo-path.js'
 
-export const REPOSITORY_FRESHNESS_PROBE_V = 1
-export const GRAPH_BUILDER_SCHEMA_V = 6
+const REPOSITORY_FRESHNESS_PROBE_V = 1
+const GRAPH_BUILDER_SCHEMA_V = 6
 export const GRAPH_BUILDER_VERSION = (() => {
     try { return String(createRequire(import.meta.url)('../../package.json').version) }
     catch { return '0.0.0' }

package/src/graph/parser-artifact-boundary.js

@@ -52,5 +52,3 @@ export function trustedGrammarWasm(wasmDir, grammar) {
     sha256, label: `tree-sitter ${grammar} grammar`,
   })
 }
-
-export const TRUSTED_GRAMMARS = Object.freeze(Object.keys(GRAMMAR_SHA256))

package/src/mcp/architecture-starter.mjs

@@ -13,7 +13,7 @@ export const PROVISIONAL_BUDGETS = Object.freeze({
     maxModuleBoundaryRatio: .65,
 })
 
-export const STARTER_BUDGETS = Object.freeze({
+const STARTER_BUDGETS = Object.freeze({
     runtimeCycles: PROVISIONAL_BUDGETS.runtimeCycles,
     maxFileLoc: PROVISIONAL_BUDGETS.maxFileLoc,
 })

package/src/mcp/evidence-snapshot.duplicates.mjs

@@ -11,7 +11,7 @@ const MIN_TOKENS = 50
 const FILTERED_CLASSES = new Set(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const SAFE_SYMBOL = /^[A-Za-z_$][A-Za-z0-9_$]*$/
 
-export const DUPLICATE_EVIDENCE_THRESHOLDS = Object.freeze({
+const DUPLICATE_EVIDENCE_THRESHOLDS = Object.freeze({
     clones: Object.freeze({mode: 'renamed', minSimilarityPercent: CLONE_MIN_SIMILARITY, minTokens: MIN_TOKENS}),
     divergence: Object.freeze({
         sameName: true,

package/src/mcp/health/audit-format.mjs

@@ -96,10 +96,29 @@ const auditDependencyCoverageLines = (deps) => {
     ]
 }
 
-const auditDependencySummaryLine = (audit, deps) => {
+const scopedDependencyFindingCounts = (allFindings, scopedFindings) => {
+    const dependencyFindings = (items) => (items || []).filter(isDependencyAuditFinding)
+    const all = dependencyFindings(allFindings)
+    const scoped = dependencyFindings(scopedFindings)
+    const count = (rule) => scoped.filter((finding) => finding.rule === rule).length
+    return {
+        unused: count('unused-dep'),
+        missing: count('missing-dep'),
+        duplicateDeclarations: count('duplicate-dep'),
+        suppressed: Math.max(0, all.length - scoped.length),
+    }
+}
+
+const auditDependencySummaryLine = (audit, deps, scopedCounts = null) => {
     const ecosystems = Object.values(deps.ecosystems || {}).filter((item) => item?.present)
     const checked = ecosystems.filter((item) => item.status === 'CHECKED')
     const unsupported = ecosystems.filter((item) => item.status === 'NOT_SUPPORTED')
+    const unused = scopedCounts?.unused ?? deps.unused ?? 'unknown'
+    const missing = scopedCounts?.missing ?? deps.missing ?? 'unknown'
+    const duplicateDeclarations = scopedCounts?.duplicateDeclarations ?? deps.duplicateDeclarations ?? 'unknown'
+    const scopedSuffix = scopedCounts?.suppressed
+        ? ` Production-first path policy suppressed ${scopedCounts.suppressed} classified dependency finding(s).`
+        : ''
     if (!ecosystems.length || deps.status === 'NOT_CHECKED') {
         return 'Dependency manifests: NOT_CHECKED — no dependency manifest was discovered; manifest-to-import verification did not run and no dependency verdict was produced.'
     }
@@ -116,9 +135,9 @@ const auditDependencySummaryLine = (audit, deps) => {
         const unsupportedDeclared = unsupported.reduce((total, item) => total + (item.declared || 0), 0)
         const checkedNames = checked.map((item) => item.ecosystem).join(', ')
         const unsupportedNames = unsupported.map((item) => item.ecosystem).join(', ')
-        return `Dependency manifests: ${deps.status || 'PARTIAL'} — checked ${checkedDeclared} declaration(s) across ${checkedManifests} supported manifest(s) (${checkedNames}); inventoried ${unsupportedDeclared} declaration(s) across ${unsupportedManifests} unsupported manifest(s) (${unsupportedNames}), where package-to-artifact verification is NOT_SUPPORTED. Supported-ecosystem findings: unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`
+        return `Dependency manifests: ${deps.status || 'PARTIAL'} — checked ${checkedDeclared} declaration(s) across ${checkedManifests} supported manifest(s) (${checkedNames}); inventoried ${unsupportedDeclared} declaration(s) across ${unsupportedManifests} unsupported manifest(s) (${unsupportedNames}), where package-to-artifact verification is NOT_SUPPORTED. Supported-ecosystem findings: unused ${unused}, missing ${missing}, duplicate declarations ${duplicateDeclarations}.${scopedSuffix}`
     }
-    return `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`
+    return `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${unused}, missing ${missing}, duplicate declarations ${duplicateDeclarations}.${scopedSuffix}`
 }
 
 const auditConventionLines = (audit) => {
@@ -140,11 +159,12 @@ export const formatOrdinaryAudit = (audit, args, findings = audit.findings, head
     const sev = summary.bySeverity
     const bycat = summary.byCategory
     const deps = audit.dependencyReport || {}
+    const dependencyCounts = scopedDependencyFindingCounts(findings, pathScope.findings)
     return [
         heading,
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         ...auditConventionLines(audit),
-        auditDependencySummaryLine(audit, deps),
+        auditDependencySummaryLine(audit, deps, dependencyCounts),
         ...auditDependencyCoverageLines(deps),
         ...auditCapabilityLines(audit),
         ...auditExtensionLines(audit),

package/src/mcp/runtime-version.mjs

@@ -1,7 +1,7 @@
 import {readFileSync} from 'node:fs'
 import process from 'node:process'
 
-export const STALE_RUNTIME_OVERRIDE_ENV = 'WEAVATRIX_ALLOW_STALE_RUNTIME'
+const STALE_RUNTIME_OVERRIDE_ENV = 'WEAVATRIX_ALLOW_STALE_RUNTIME'
 
 export function runtimeVersionStatus({runningVersion, packageJsonPath, allowStale} = {}) {
     let diskVersion = null, packageVersionError = null
@@ -29,4 +29,3 @@ export function staleRuntimeMessage(status) {
     const disk = status.diskVersion || 'unavailable'
     return `STALE_RUNTIME: running Weavatrix ${status.version || 'unknown'} but package.json on disk is ${disk}. Restart/reconnect the MCP server before using tools. For deliberate source-development only, set ${STALE_RUNTIME_OVERRIDE_ENV}=1.`
 }
-

package/src/mcp/sync/evidence-common.mjs

@@ -1,7 +1,7 @@
 export const SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'info'])
 export const CONFIDENCE = new Set(['high', 'medium', 'low'])
 export const CATEGORIES = new Set(['unused', 'structure', 'vulnerability', 'malware'])
-export const CHECK_KEYS = ['osv', 'malware']
+const CHECK_KEYS = ['osv', 'malware']
 export const PACKAGE_DEPENDENCY_KINDS = new Set(['runtime', 'dev', 'optional', 'peer', 'optional-peer'])
 export const CAPS = Object.freeze({
     modules: 500, dependencies: 2000, findings: 500, hotspots: 250, badges: 100,

package/src/mcp/tool-result.mjs

@@ -2,7 +2,7 @@
 // JSON mode adds the stable machine-readable structuredContent envelope and mirrors that envelope
 // into TextContent for workflow runners that cannot consume structured results directly.
 
-export const TOOL_RESULT_SCHEMA = 'weavatrix.tool.v1'
+const TOOL_RESULT_SCHEMA = 'weavatrix.tool.v1'
 
 export function toolResult(text, result, extra = {}) {
     return {

package/src/precision/lsp-client/lifecycle.js

@@ -25,40 +25,19 @@ export function killClient(client, reason = new Error('LSP client was killed'))
     }
     if (client.child.exitCode != null || client.child.signalCode != null) return
     if (process.platform === 'win32' && client.child.pid) {
-        try {
-            const killer = spawnChild('taskkill', ['/pid', String(client.child.pid), '/T', '/F'], {
-                shell: false,
-                windowsHide: true,
-                env: lspChildProcessEnv(),
-                stdio: 'ignore',
-            })
-            const fallback = () => {
-                try { client.child.kill('SIGKILL') } catch { /* already exited */ }
-            }
-            killer.once('error', fallback)
-            killer.once('exit', (code) => { if (code !== 0) fallback() })
-        } catch {
-            try { client.child.kill('SIGKILL') } catch { /* already exited */ }
-        }
+        startWindowsTreeKill(client)
     } else {
         try { client.child.kill('SIGKILL') } catch { /* already exited */ }
     }
 }
 
-export async function killWindowsTreeAndWait(client, timeoutMs = 3_000) {
-    if (process.platform !== 'win32' || !client.child.pid || client.child.exitCode != null) return
-    await new Promise((resolveKill) => {
-        let settled = false
-        const done = () => {
-            if (settled) return
-            settled = true
-            clearTimeout(timer)
-            resolveKill()
-        }
-        const timer = setTimeout(() => {
-            try { client.child.kill() } catch { /* already exited */ }
-            done()
-        }, Math.max(250, Math.min(5_000, Number(timeoutMs) || 3_000)))
+function directChildKill(client) {
+    try { client.child.kill('SIGKILL') } catch { /* already exited */ }
+}
+
+function startWindowsTreeKill(client) {
+    if (client.windowsTreeKillPromise) return client.windowsTreeKillPromise
+    client.windowsTreeKillPromise = new Promise((resolveKill) => {
         try {
             const killer = spawnChild('taskkill', ['/pid', String(client.child.pid), '/T', '/F'], {
                 shell: false,
@@ -66,19 +45,27 @@ export async function killWindowsTreeAndWait(client, timeoutMs = 3_000) {
                 env: lspChildProcessEnv(),
                 stdio: 'ignore',
             })
-            const fallback = () => {
-                try { client.child.kill('SIGKILL') } catch { /* already exited */ }
-            }
-            killer.once('error', () => { fallback(); done() })
-            killer.once('exit', (code) => {
-                if (code !== 0) fallback()
-                done()
-            })
+            killer.once('error', () => { directChildKill(client); resolveKill() })
+            killer.once('exit', (code) => { if (code !== 0) directChildKill(client); resolveKill() })
         } catch {
-            try { client.child.kill('SIGKILL') } catch { /* already exited */ }
-            done()
+            directChildKill(client)
+            resolveKill()
         }
     })
+    return client.windowsTreeKillPromise
+}
+
+export async function killWindowsTreeAndWait(client, timeoutMs = 3_000) {
+    if (process.platform !== 'win32' || !client.child.pid || client.child.exitCode != null) return
+    const boundedTimeout = Math.max(250, Math.min(5_000, Number(timeoutMs) || 3_000))
+    let timer
+    await Promise.race([
+        startWindowsTreeKill(client),
+        new Promise((resolveKill) => {
+            timer = setTimeout(() => { directChildKill(client); resolveKill() }, boundedTimeout)
+        }),
+    ])
+    if (timer) clearTimeout(timer)
 }
 
 export async function waitForClientExit(client, timeoutMs = client.requestTimeoutMs) {

package/src/precision/lsp-client/registry.js

@@ -45,10 +45,11 @@ export async function shutdownActiveLspClients({timeoutMs = 3_000} = {}) {
         await Promise.allSettled(survivors.map(async (client) => {
             if (typeof client.killWindowsTreeAndWait === 'function') await client.killWindowsTreeAndWait(forceBudget)
             client.kill(reason)
-            if (typeof client.waitForExit === 'function') {
-                await client.waitForExit(Math.max(100, boundedTimeout - (Date.now() - startedAt)))
-            }
         }))
+        const reapBudget = Math.max(250, Math.min(1_000, Math.floor(boundedTimeout * 0.4)))
+        await Promise.allSettled(survivors.map((client) => (
+            typeof client.waitForExit === 'function' ? client.waitForExit(reapBudget) : undefined
+        )))
     }
     return {
         requested: clients.length,

package/src/precision/lsp-client/stdio-client.js

@@ -15,14 +15,9 @@ import {
     unregisterLspClient,
 } from './registry.js'
 import {
-    assertClientWritable,
     closeClientDocument,
-    defaultClientServerRequest,
-    handleClientServerRequest,
     handleClientMessage,
     initializeClient,
-    normalizeClientLocations,
-    notifyClient,
     openClientDocument,
     queryClientLocations,
     rejectPendingRequests,
@@ -34,7 +29,6 @@ import {
     killClient,
     killWindowsTreeAndWait,
     shutdownClient,
-    shutdownClientOnce,
     waitForClientExit,
 } from './lifecycle.js'
 
@@ -70,6 +64,7 @@ export class StdioLspClient {
         this.state = 'starting'
         this.stderrTail = ''
         this.shutdownPromise = null
+        this.windowsTreeKillPromise = null
         this.child = spawn(executablePath, args, {
             cwd: this.normalizer.rootPath,
             env: lspChildProcessEnv(env),
@@ -123,18 +118,13 @@ export class StdioLspClient {
     }
 
     async start() { await this.spawned; return this }
-    assertWritable() { return assertClientWritable(this) }
     writeMessage(message) { return writeClientMessage(this, message) }
     request(method, params, options) { return requestFromClient(this, method, params, options) }
-    notify(method, params) { return notifyClient(this, method, params) }
     initialize(options) { return initializeClient(this, options) }
     openDocument(options) { return openClientDocument(this, options) }
     closeDocument(filePath) { return closeClientDocument(this, filePath) }
-    normalizeLocations(result) { return normalizeClientLocations(this, result) }
     definition(options) { return queryClientLocations(this, 'definition', options) }
     references(options) { return queryClientLocations(this, 'references', options) }
-    defaultServerRequest(method, params) { return defaultClientServerRequest(this, method, params) }
-    handleServerRequest(message) { return handleClientServerRequest(this, message) }
     handleMessage(message) { return handleClientMessage(this, message) }
     rejectPending(error) { return rejectPendingRequests(this, error) }
     fail(error) { return failClient(this, error) }
@@ -142,7 +132,6 @@ export class StdioLspClient {
     killWindowsTreeAndWait(timeoutMs) { return killWindowsTreeAndWait(this, timeoutMs) }
     waitForExit(timeoutMs) { return waitForClientExit(this, timeoutMs) }
     shutdown(options) { return shutdownClient(this, options) }
-    shutdownOnce(options) { return shutdownClientOnce(this, options) }
 }
 
 export async function startStdioLspClient(options) {

package/src/precision/lsp-overlay/budget-policy.js

@@ -0,0 +1,78 @@
+import {boundedInteger} from '../../bounds.js'
+
+const DEFAULT_MAX_SYMBOLS = 32
+const BOUNDED_MAX_SYMBOLS = 64
+const EXPANDED_MAX_SYMBOLS = 10_000
+const DEFAULT_MAX_REFERENCES = 2_048
+const BOUNDED_MAX_REFERENCES = 16_384
+const EXPANDED_MAX_REFERENCES = 131_072
+const DEFAULT_MAX_LINKS = 2_048
+const BOUNDED_MAX_LINKS = 16_384
+const EXPANDED_MAX_LINKS = 131_072
+const DEFAULT_TIMEOUT_MS = 45_000
+const BOUNDED_MAX_TIMEOUT_MS = 60_000
+const EXPANDED_MAX_TIMEOUT_MS = 30 * 60_000
+
+function configured(value, environmentName) {
+  if (value !== undefined && value !== null && String(value).trim() !== '') return value
+  const environmentValue = process.env[environmentName]
+  return environmentValue != null && String(environmentValue).trim() !== ''
+    ? environmentValue : undefined
+}
+
+export function precisionPrewarmBudget(options = {}) {
+  const targetBatch = Array.isArray(options.targetIds) && options.targetIds.length > 0
+  const configuredMode = String(configured(
+    options.prewarmMode,
+    'WEAVATRIX_PRECISION_PREWARM',
+  ) || 'bounded').trim().toLowerCase()
+  const full = configuredMode === 'full' && !targetBatch
+  const requestedSymbols = configured(options.maxSymbols, 'WEAVATRIX_PRECISION_MAX_SYMBOLS')
+  const numericSymbols = Number(requestedSymbols)
+  const expanded = full || (Number.isFinite(numericSymbols) && numericSymbols > BOUNDED_MAX_SYMBOLS)
+  const maxSymbols = full ? EXPANDED_MAX_SYMBOLS : boundedInteger(
+    requestedSymbols,
+    DEFAULT_MAX_SYMBOLS,
+    1,
+    expanded ? EXPANDED_MAX_SYMBOLS : BOUNDED_MAX_SYMBOLS,
+  )
+  const referenceFallback = expanded
+    ? Math.min(EXPANDED_MAX_REFERENCES, Math.max(DEFAULT_MAX_REFERENCES, maxSymbols * 16))
+    : DEFAULT_MAX_REFERENCES
+  const linkFallback = expanded
+    ? Math.min(EXPANDED_MAX_LINKS, Math.max(DEFAULT_MAX_LINKS, maxSymbols * 16))
+    : DEFAULT_MAX_LINKS
+  const timeoutFallback = expanded
+    ? Math.min(15 * 60_000, Math.max(DEFAULT_TIMEOUT_MS, maxSymbols * 1_000))
+    : DEFAULT_TIMEOUT_MS
+  const maxReferences = boundedInteger(
+    configured(options.maxReferences, 'WEAVATRIX_PRECISION_MAX_REFERENCES'),
+    referenceFallback,
+    1,
+    expanded ? EXPANDED_MAX_REFERENCES : BOUNDED_MAX_REFERENCES,
+  )
+  const maxLinks = boundedInteger(
+    configured(options.maxLinks, 'WEAVATRIX_PRECISION_MAX_LINKS'),
+    linkFallback,
+    1,
+    expanded ? EXPANDED_MAX_LINKS : BOUNDED_MAX_LINKS,
+  )
+  const timeoutMs = boundedInteger(
+    configured(options.timeoutMs, 'WEAVATRIX_PRECISION_TIMEOUT_MS'),
+    timeoutFallback,
+    100,
+    expanded ? EXPANDED_MAX_TIMEOUT_MS : BOUNDED_MAX_TIMEOUT_MS,
+  )
+  return {
+    expanded,
+    full,
+    maxSymbols,
+    maxReferences,
+    maxLinks,
+    timeoutMs,
+    maxOpenDocuments: expanded ? 1_024 : 96,
+    maxOpenBytes: expanded ? 128 * 1024 * 1024 : 32 * 1024 * 1024,
+    maxClassificationDocuments: expanded ? 1_024 : 96,
+    maxClassificationBytes: expanded ? 128 * 1024 * 1024 : 32 * 1024 * 1024,
+  }
+}

package/src/precision/lsp-overlay/build.js

@@ -1,5 +1,5 @@
-import {boundedInteger} from '../../bounds.js'
 import {createTypeScriptLspClient} from '../typescript-lsp-provider.js'
+import {precisionPrewarmBudget} from './budget-policy.js'
 import {baseOverlay} from './contract.js'
 import {precisionOverlayMatches} from './contract.js'
 import {collectReferenceResults} from './reference-results.js'
@@ -106,17 +106,24 @@ function failedOverlay(session, error) {
 }
 
 function createSession(options) {
-  const boundedMax = boundedInteger(options.maxSymbols, 32, 1, 64)
-  const boundedReferences = boundedInteger(options.maxReferences, 2_048, 1, 16_384)
-  const boundedLinks = boundedInteger(options.maxLinks, 2_048, 1, 16_384)
-  const boundedTimeout = boundedInteger(options.timeoutMs, 45_000, 100, 60_000)
+  const budget = precisionPrewarmBudget(options)
   return {
     ...options,
-    boundedMax,
-    boundedReferences,
-    boundedLinks,
-    deadline: Date.now() + boundedTimeout,
-    request: {maxSymbols: boundedMax, maxReferences: boundedReferences, maxLinks: boundedLinks},
+    expandedPrewarm: budget.expanded,
+    fullPrewarm: budget.full,
+    boundedMax: budget.maxSymbols,
+    boundedReferences: budget.maxReferences,
+    boundedLinks: budget.maxLinks,
+    maxOpenDocuments: budget.maxOpenDocuments,
+    maxOpenBytes: budget.maxOpenBytes,
+    maxClassificationDocuments: budget.maxClassificationDocuments,
+    maxClassificationBytes: budget.maxClassificationBytes,
+    deadline: Date.now() + budget.timeoutMs,
+    request: {
+      maxSymbols: budget.maxSymbols,
+      maxReferences: budget.maxReferences,
+      maxLinks: budget.maxLinks,
+    },
     links: [],
     seen: new Set(),
     evidenceSeen: new Set(),
@@ -138,17 +145,18 @@ export async function buildLspPrecisionOverlay({
   graph,
   graphPath,
   mode = 'lsp',
-  maxSymbols = Number(process.env.WEAVATRIX_PRECISION_MAX_SYMBOLS) || 32,
-  maxReferences = Number(process.env.WEAVATRIX_PRECISION_MAX_REFERENCES) || 2_048,
-  maxLinks = Number(process.env.WEAVATRIX_PRECISION_MAX_LINKS) || 2_048,
-  timeoutMs = Number(process.env.WEAVATRIX_PRECISION_TIMEOUT_MS) || 45_000,
+  maxSymbols,
+  maxReferences,
+  maxLinks,
+  timeoutMs,
+  prewarmMode,
   targetIds,
   clientFactory,
 } = {}) {
   if (!graph || !repoRoot) throw new Error('precision overlay requires repoRoot and graph')
   const session = createSession({
     repoRoot, graph, graphPath, mode, maxSymbols, maxReferences, maxLinks,
-    timeoutMs, targetIds, clientFactory,
+    timeoutMs, prewarmMode, targetIds, clientFactory,
   })
   if (mode === 'off') {
     return persist(session, baseOverlay(graph, 'OFF', {

package/src/precision/lsp-overlay/source-session.js

@@ -62,11 +62,15 @@ export async function ensureOpen(session, relPath) {
   const file = norm(relPath)
   if (!file || session.opened.has(file)) return
   ensureBudget(session)
-  if (session.opened.size >= 96) throw new PrecisionLimitError('precision open-document limit reached')
-  const maxBytes = Math.min(4 * 1024 * 1024, 32 * 1024 * 1024 - session.openedBytes)
+  const maxDocuments = Number(session.maxOpenDocuments) || 96
+  const maxOpenBytes = Number(session.maxOpenBytes) || 32 * 1024 * 1024
+  if (session.opened.size >= maxDocuments) {
+    throw new PrecisionLimitError('precision open-document limit reached')
+  }
+  const maxBytes = Math.min(4 * 1024 * 1024, maxOpenBytes - session.openedBytes)
   const {bytes, text} = verifiedSource(session, file, maxBytes)
   if (bytes > 4 * 1024 * 1024) throw new PrecisionLimitError('precision document exceeds 4 MiB limit')
-  if (session.openedBytes + bytes > 32 * 1024 * 1024) {
+  if (session.openedBytes + bytes > maxOpenBytes) {
     throw new PrecisionLimitError('precision source-transfer budget reached')
   }
   await awaitWithBudget(session, () => session.client.openDocument(file, text))
@@ -79,13 +83,15 @@ export function sourceForClassification(session, relPath) {
   const file = norm(relPath)
   if (session.openedTexts.has(file)) return session.openedTexts.get(file)
   if (session.classificationTexts.has(file)) return session.classificationTexts.get(file)
-  if (session.classificationTexts.size >= 96) return null
+  const maxDocuments = Number(session.maxClassificationDocuments) || 96
+  const maxClassificationBytes = Number(session.maxClassificationBytes) || 32 * 1024 * 1024
+  if (session.classificationTexts.size >= maxDocuments) return null
   let source
   try {
     source = verifiedSource(
       session,
       file,
-      Math.min(4 * 1024 * 1024, 32 * 1024 * 1024 - session.classificationBytes),
+      Math.min(4 * 1024 * 1024, maxClassificationBytes - session.classificationBytes),
     )
   } catch (error) {
     if (error instanceof PrecisionLimitError) return null
@@ -100,7 +106,9 @@ export async function ensureFullUniverse(session) {
   if (session.fullUniverseOpened) return true
   if (!session.universe.complete) return false
   const additional = session.universe.files.filter((file) => !session.opened.has(file))
-  if (session.opened.size + additional.length > 96) {
+  const maxDocuments = Number(session.maxOpenDocuments) || 96
+  const maxOpenBytes = Number(session.maxOpenBytes) || 32 * 1024 * 1024
+  if (session.opened.size + additional.length > maxDocuments) {
     session.truncated = true
     return false
   }
@@ -115,7 +123,7 @@ export async function ensureFullUniverse(session) {
     let bytes
     try { bytes = statSync(resolvedFile.path).size }
     catch { throw new PrecisionStaleGraphError() }
-    if (bytes > 4 * 1024 * 1024 || projectedBytes + bytes > 32 * 1024 * 1024) {
+    if (bytes > 4 * 1024 * 1024 || projectedBytes + bytes > maxOpenBytes) {
       session.truncated = true
       return false
     }

package/src/precision/symbol-query.js

@@ -9,8 +9,8 @@ import {
 } from './lsp-overlay.js'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
-export const SYMBOL_PRECISION_CACHE_V = 1
-export const SYMBOL_PRECISION_CACHE_FILE = 'precision-symbols.json'
+const SYMBOL_PRECISION_CACHE_V = 1
+const SYMBOL_PRECISION_CACHE_FILE = 'precision-symbols.json'
 
 const MAX_CACHE_ENTRIES = 32
 const MAX_CACHE_BYTES = 8 * 1024 * 1024

package/src/precision/typescript-provider/discovery.js

@@ -3,7 +3,7 @@ import {dirname, extname, isAbsolute, join} from 'node:path'
 import {createRequire} from 'node:module'
 
 const requireFromWeavatrix = createRequire(import.meta.url)
-export const PROVIDER = 'typescript-language-server'
+const PROVIDER = 'typescript-language-server'
 export const TYPESCRIPT_LSP_CAPABILITY_CONTRACT = 'typescript-references-v4-plugin-suppression'
 let discoveredProvider = null
 

package/src/security/advisory-store.js

@@ -8,7 +8,7 @@ import {createHash} from 'node:crypto'
 import {uniqueBy} from '../util.js'
 
 export const DEFAULT_STORE = join(homedir(), '.weavatrix', 'advisories.json')
-export const OSV_SUPPORTED_ECOSYSTEMS = new Set(['npm', 'PyPI', 'Go', 'Maven', 'crates.io'])
+const OSV_SUPPORTED_ECOSYSTEMS = new Set(['npm', 'PyPI', 'Go', 'Maven', 'crates.io'])
 
 const keyOf = (ecosystem, name) => `${ecosystem}|${ecosystem === 'PyPI' ? String(name).toLowerCase().replace(/[-_.]+/g, '-') : name}`
 const uniquePackages = (packages) => uniqueBy(packages, (item) => `${item.ecosystem}|${item.name}|${item.version}`)