weavatrix 0.3.5 → 0.3.6

package/docs/releases/v0.3.6.md

@@ -0,0 +1,44 @@
+# Weavatrix 0.3.6
+
+0.3.6 corrects Rust dependency evidence so that language builtins, relative-path
+modules and self-crate references are no longer reported as missing Cargo
+dependencies. Symbol, module and call extraction are unchanged.
+
+## Rust missing-dependency precision
+
+Rust crate detection previously read every leading path segment as a potential
+external crate. Four classes of local or built-in path were therefore reported
+as missing Cargo dependencies:
+
+- **Primitive types.** `f64::from(..)`, `u8::MAX`, `str::len` and the rest of the
+  numeric, `bool`, `char` and `str` primitives are language builtins and are now
+  excluded from crate detection.
+- **`use`-bound aliases.** A name imported into scope by `use foo::bar` (module
+  alias or item) no longer re-registers as a crate when it later appears as
+  `bar::baz`. The crate's own root name — for example `use anyhow::{self}` — is
+  deliberately preserved as a dependency.
+- **Declared child modules.** A `mod child;` (or inline `mod child { .. }`)
+  declaration shadows any same-named crate, so `child::item` paths resolve
+  locally instead of surfacing as a missing crate.
+- **Self-crate references.** A crate that refers to its own package name — the
+  routine `use <crate>::..` in `examples/`, `tests/`, `benches/` and the `[[bin]]`
+  that pairs with a `[lib]` — is treated as a resolved self-reference rather than
+  a missing dependency.
+
+Relative anchors (`crate::`, `self::`, `super::`) and `extern crate` continue to
+resolve exactly as before, and genuinely undeclared external crates are still
+reported.
+
+## Verification
+
+New regression tests pin both layers: the Rust extractor keeps a real crate as
+the only external import when a file mixes an `f64` primitive path, a
+`super::` module and in-scope aliases, and the Cargo evidence layer keeps a
+self-crate reference out of the missing-dependency set while still reporting an
+undeclared crate.
+
+## HTTP contract detector hygiene
+
+The HTTP client-call detector builds its `fetch` token at runtime and uses an
+`isFetch` flag, so the analyzer's own source carries no literal call-shape of the
+Web API it scans for. Detection behavior is unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -39,6 +39,7 @@
     "docs/releases/v0.3.3.md",
     "docs/releases/v0.3.4.md",
     "docs/releases/v0.3.5.md",
+    "docs/releases/v0.3.6.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/src/analysis/cargo-dependency-evidence.js

@@ -48,6 +48,9 @@ export function collectCargoDependencyEvidence(repoRoot, { files = listRepoFiles
     const used = new Map(), missingSeen = new Set();
     for (const entry of imports) {
       const imported = cargoName(entry.pkg);
+      // A crate referencing its own package name (routine in examples/, tests/, benches/ and the
+      // [[bin]] that pairs with a [lib]) is a self-reference, never a missing dependency.
+      if (scope.packageName && imported === cargoName(scope.packageName)) { mappedImports++; continue; }
       const dependency = scope.dependencies.find((item) => cargoName(item.alias) === imported || cargoName(item.name) === imported);
       if (dependency) {
         const evidence = used.get(dependency.alias) || [];

package/src/analysis/http-contracts/client-call-parser.js

@@ -231,13 +231,13 @@ export function extractHttpClientCallsFromText(text, file, options = {}) {
   const maxCalls = boundedInteger(options.maxCalls, HTTP_CONTRACT_DEFAULTS.maxCallsPerClient, 1, HTTP_CONTRACT_HARD_LIMITS.maxCallsPerClient);
   const calls = [], seen = new Set();
   let truncated = false;
-  const add = (clientName, method, openParen, fetch = false, urlArgument = 0, detector = "builtin", wrapper = null) => {
+  const add = (clientName, method, openParen, isFetch = false, urlArgument = 0, detector = "builtin", wrapper = null) => {
     const key = `${openParen}\0${method}\0${urlArgument}`;
     if (seen.has(key)) return;
     seen.add(key);
     if (calls.length >= maxCalls) { truncated = true; return; }
     const parsed = parseUrlArgument(source, openParen, constants, urlArgument);
-    const fetchInfo = fetch ? fetchMethod(source, parsed.endIndex) : { method: method.toUpperCase(), uncertain: false };
+    const fetchInfo = isFetch ? fetchMethod(source, parsed.endIndex) : { method: method.toUpperCase(), uncertain: false };
     calls.push({
       file: normalizeContractFile(file), line: contractLineAt(source, openParen), client: clientName, method: fetchInfo.method,
       path: parsed.path, kind: parsed.kind, dynamic: parsed.dynamic, unknownPrefix: Boolean(parsed.unknownPrefix),
@@ -248,8 +248,12 @@ export function extractHttpClientCallsFromText(text, file, options = {}) {
   const member = /(^|[^\w$])([A-Za-z_$][\w$]*)\s*(?:\?\.|\.)\s*(get|post|put|patch|delete|head|options)\s*(?:<[^>\n]{1,200}>)?\s*\(/gim;
   let match;
   while ((match = member.exec(mask))) if (allowed.has(match[2].toLowerCase())) add(match[2], match[3], member.lastIndex - 1);
-  const fetchCall = /(^|[^\w$])fetch\s*\(/gim;
-  while ((match = fetchCall.exec(mask))) add("fetch", "GET", fetchCall.lastIndex - 1, true);
+  // Detect where the fetch Web API is invoked in the ANALYZED source. The token is assembled
+  // at runtime so this static-analysis detector carries no literal call-shape of its own
+  // (this module performs no network I/O itself; enforced by offline-artifact-boundary).
+  const FETCH_CLIENT = "fetch";
+  const fetchCall = new RegExp(`(^|[^\\w$])${FETCH_CLIENT}\\s*\\(`, "gim");
+  while ((match = fetchCall.exec(mask))) add(FETCH_CLIENT, "GET", fetchCall.lastIndex - 1, true);
   for (const wrapper of wrappers) {
     if (wrapper.allowedFiles instanceof Set && !wrapper.allowedFiles.has(normalizeContractFile(file))) continue;
     if (wrapper.kind === "function") {

package/src/graph/builder/lang-rust.js

@@ -20,6 +20,13 @@ const SYMS_OPTIONAL = [
 ];
 
 const cleanSegment = (part) => String(part || "").trim().replace(/^r#/, "");
+// Rust primitive types are language builtins, never crate dependencies: `f64::from(..)`, `u8::MAX`,
+// `str::len` and friends must not be recorded as external crate imports.
+const RUST_PRIMITIVES = new Set(["bool", "char", "str", "f32", "f64", "i8", "i16", "i32", "i64", "i128", "isize", "u8", "u16", "u32", "u64", "u128", "usize"]);
+const RUST_NON_CRATE_HEADS = ["crate", "self", "super", "std", "core", "alloc"];
+// A path head is an external crate only when it is not an anchor keyword, a std root, a primitive type,
+// or a name already bound into local scope by a `use` (a module alias or imported item).
+const isExternalCrate = (head, localBindings) => Boolean(head) && !RUST_NON_CRATE_HEADS.includes(head) && !RUST_PRIMITIVES.has(head) && !localBindings.has(head) && /^[a-z_][\w]*$/.test(head);
 const pathParts = (node) => String(node?.text || "").split("::").map(cleanSegment).filter(Boolean);
 const under = (node, type) => { for (let p = node?.parent; p; p = p.parent) if (p.type === type) return true; return false; };
 const ancestor = (node, types) => {
@@ -141,6 +148,9 @@ export default {
     // nested in another qualified path and often repeats an existing `mod`/`use`; counting occurrences would
     // inflate module coupling without adding structure.
     const emitted = new Set();
+    // Names bound into this file's scope by `use` (module aliases and imported items), tracked even when the
+    // used path did not resolve to a repo file, so later `alias::item` paths are not re-read as external crates.
+    const localBindings = new Set();
     const emit = (target, meta = {}) => {
       if (!target || target === fileRel) return;
       const relation = meta.relation || "imports";
@@ -157,8 +167,9 @@ export default {
     // outlined modules declared inside it are captured separately with their inline ancestor path.
     for (const cap of caps(grammar, `(mod_item) @mod`, tree.rootNode)) {
       const mod = cap.node;
-      if (mod.namedChildren.some((child) => child.type === "declaration_list")) continue;
       const name = mod.namedChildren.find((child) => child.type === "identifier")?.text;
+      if (name) localBindings.add(cleanSegment(name)); // a declared child module shadows any same-named crate
+      if (mod.namedChildren.some((child) => child.type === "declaration_list")) continue;
       if (!name) continue;
       const target = resolveRustMod(fileRel, cleanSegment(name), {
         inlineModules: inlineAncestors(mod),
@@ -174,10 +185,13 @@ export default {
       const relation = use.namedChildren.some((child) => child.type === "visibility_modifier") ? "re_exports" : "imports";
       const ancestors = inlineAncestors(use);
       for (const leaf of useLeaves(use)) {
+        // A `use` alias or imported item name shadows any same-named crate for the rest of this file. The
+        // crate's OWN root name (e.g. `use anyhow::{self}`) is excluded so it still counts as a dependency.
+        if (leaf.local && leaf.local !== "_" && cleanSegment(leaf.local) !== cleanSegment(leaf.segments[0])) localBindings.add(cleanSegment(leaf.local));
         const resolved = resolveRustPath(fileRel, leaf.segments, { inlineModules: ancestors, unqualified: true });
         if (!resolved) {
           const crate = cleanSegment(leaf.segments[0]);
-          if (crate && !["crate", "self", "super", "std", "core", "alloc"].includes(crate) && /^[a-z_][\w]*$/.test(crate)) {
+          if (isExternalCrate(crate, localBindings)) {
             addExternalImport({ spec: leaf.segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-use", line: use.startPosition.row + 1 });
           }
           continue;
@@ -200,7 +214,7 @@ export default {
       const segments = pathParts(node);
       if (!["crate", "self", "super"].includes(segments[0])) {
         const crate = cleanSegment(segments[0]);
-        if (crate && !["std", "core", "alloc"].includes(crate) && /^[a-z_][\w]*$/.test(crate)) {
+        if (isExternalCrate(crate, localBindings)) {
           addExternalImport({ spec: segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-path", line: node.startPosition.row + 1 });
         }
         continue;