weavatrix 0.3.7 → 0.3.9

package/docs/releases/v0.3.8.md

@@ -0,0 +1,21 @@
+# Weavatrix 0.3.8
+
+0.3.8 is a documentation and internal-structure release. Tool behavior and
+output are unchanged.
+
+## Slimmer README
+
+The README is refocused on the current release — install, configuration, tools,
+benchmarks and the security model — and the accumulated per-version changelog is
+removed in favor of the existing per-version notes under
+[docs/releases/](../releases/). This also slims the README rendered on the npm
+package page.
+
+## Internal module split
+
+`src/analysis/dead-code-review.js` is split along the repository's existing
+facade convention: the per-candidate record builders (`symbolCandidate`,
+`fileCandidate`) move to `src/analysis/dead-code-review/candidates.js`, while the
+orchestrator and the public `computeDeadCodeReview` export stay in place.
+Importers and returned records are unchanged, and both files are now within the
+300-line owner-module budget.

package/docs/releases/v0.3.9.md

@@ -0,0 +1,36 @@
+# Weavatrix 0.3.9
+
+0.3.9 consolidates every subprocess launch behind a small number of audited
+chokepoints. Tool behavior and output are unchanged — verified byte-identical
+against 0.3.8 on real repositories.
+
+## Single-chokepoint subprocess execution
+
+Git and other subprocess launches were scattered across roughly fifteen modules,
+each with its own near-identical spawn wrapper. They now route through two
+focused modules:
+
+- **git** — every git command runs through `src/git-exec.js`: `runGit` for
+  synchronous run-and-collect calls and `boundedGitCommand` for the streaming
+  history collector.
+- **everything else** — ripgrep resolution and search, `tar` archive extraction,
+  and `where`/`which` binary probing run through `src/process.js`: the existing
+  async `runCommand` plus a new synchronous `runCommandSync`.
+
+Every launch now applies the same credential-stripped child environment,
+`windowsHide`, bounded timeout, and `-C <repoRoot>`/`cwd` containment in one
+place. The number of modules importing `node:child_process` drops from fifteen
+to four — the two runners plus the long-lived language-server client — removing
+duplicated wrappers and making the whole process surface auditable from a single
+point.
+
+This is a pure refactor: graph construction, change impact, Health, history and
+search produce identical results. A byte-level comparison of the entire graph
+(every node, edge and external import, hashed with SHA-256) against the published
+0.3.8 matched exactly on the analytics, controller-rest-api and Weavatrix
+repositories.
+
+## Minor
+
+Removed two redundant module imports (`node:perf_hooks`, `node:process`) that
+re-imported values already available as Node globals.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -41,6 +41,8 @@
     "docs/releases/v0.3.5.md",
     "docs/releases/v0.3.6.md",
     "docs/releases/v0.3.7.md",
+    "docs/releases/v0.3.8.md",
+    "docs/releases/v0.3.9.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/scripts/run-agent-task-benchmark.mjs

@@ -1,6 +1,5 @@
 import {readFileSync} from 'node:fs'
 import {pathToFileURL} from 'node:url'
-import {performance} from 'node:perf_hooks'
 import {retrieveTaskContext} from '../src/analysis/task-retrieval.js'
 
 function graphFixture() {

package/src/analysis/change-classification.js

@@ -1,6 +1,5 @@
 // Symbol-aware git-diff classification for change_impact.
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 import {createPathClassifier} from '../path-classification.js'
 import {parseZeroContextDiff} from './change-classification/diff-parser.js'
 import {
@@ -33,13 +32,10 @@ function recoverBoundedDiff(repoRoot, base, files, limits) {
             fallbackFiles.push(...files.slice(index))
             break
         }
-        const result = spawnSync('git', [
-            '-C', repoRoot, 'diff', '--no-ext-diff', '--find-renames', '--no-color',
+        const result = runGit(repoRoot, [
+            'diff', '--no-ext-diff', '--find-renames', '--no-color',
             '--unified=0', String(base), '--', files[index],
-        ], {
-            encoding: 'utf8', windowsHide: true, timeout: Math.min(2_000, remainingMs),
-            maxBuffer: remainingBytes + 1, env: childProcessEnv(),
-        })
+        ], {timeout: Math.min(2_000, remainingMs), maxBuffer: remainingBytes + 1})
         const chunk = String(result.stdout || '')
         if (result.status !== 0 || !chunk || Buffer.byteLength(chunk) > remainingBytes) {
             fallbackFiles.push(files[index])
@@ -51,11 +47,8 @@ function recoverBoundedDiff(repoRoot, base, files, limits) {
 }
 
 function runGitDiff(repoRoot, base, limits) {
-    const args = ['-C', repoRoot, 'diff', '--no-ext-diff', '--find-renames', '--no-color', '--unified=0', String(base), '--']
-    const result = spawnSync('git', args, {
-        encoding: 'utf8', windowsHide: true, timeout: 12_000,
-        maxBuffer: limits.maxDiffBytes + 1, env: childProcessEnv(),
-    })
+    const args = ['diff', '--no-ext-diff', '--find-renames', '--no-color', '--unified=0', String(base), '--']
+    const result = runGit(repoRoot, args, {timeout: 12_000, maxBuffer: limits.maxDiffBytes + 1})
     const output = String(result.stdout || '')
     const oversized = result.error?.code === 'ENOBUFS' || Buffer.byteLength(output) > limits.maxDiffBytes
     if (result.status === 0 && !oversized) return {available: true, text: output, error: null}
@@ -63,12 +56,9 @@ function runGitDiff(repoRoot, base, limits) {
     let fallbackTruncated = false
     let recoveredText = ''
     if (oversized) {
-        const names = spawnSync('git', [
-            '-C', repoRoot, 'diff', '--name-only', '-z', '--no-ext-diff', '--find-renames', String(base), '--',
-        ], {
-            encoding: 'utf8', windowsHide: true, timeout: 12_000,
-            maxBuffer: Math.max(64 * 1024, limits.maxFiles * 4_096), env: childProcessEnv(),
-        })
+        const names = runGit(repoRoot, [
+            'diff', '--name-only', '-z', '--no-ext-diff', '--find-renames', String(base), '--',
+        ], {timeout: 12_000, maxBuffer: Math.max(64 * 1024, limits.maxFiles * 4_096)})
         if (names.status === 0) {
             const all = String(names.stdout || '').split('\0').map(normalizeChangePath).filter(Boolean)
             const boundedFiles = [...new Set(all)].sort((a, b) => a.localeCompare(b)).slice(0, limits.maxFiles)

package/src/analysis/dead-code-review/candidates.js

@@ -0,0 +1,194 @@
+// Per-candidate review records for the dead-code review queue, split out of dead-code-review.js so the
+// orchestrator stays within the file budget. The confidence, caveat, evidence and verification model is
+// unchanged; symbolCandidate and fileCandidate are pure over the context built by computeDeadCodeReview.
+import { isFrameworkEntryFile } from "../dead-check.js";
+import {
+  hasDynamicCode, REFLECTION_CODE_RE as REFLECTION_RE, normalizedReviewPath as normalizedPath,
+} from "./policy.js";
+
+const lineOf = (node) => {
+  const match = /@(\d+)$/.exec(String(node?.id || "")) || /L(\d+)/.exec(String(node?.source_location || ""));
+  return match ? Number(match[1]) : 0;
+};
+const bareLabel = (value) => String(value || "").replace(/\s*\(.*$/, "").replace(/[()]/g, "").trim();
+
+function kindOf(node) {
+  const symbolKind = String(node?.symbol_kind || "").toLowerCase();
+  if (symbolKind === "method" || symbolKind === "constructor") return "method";
+  if (["function", "function_definition", "func", "fn"].includes(symbolKind)) return "function";
+  // Old graphs may not retain symbol_kind. Only use call syntax as a compatibility fallback;
+  // member_of alone also describes fields and must never promote them to methods.
+  if (!symbolKind && /\([^)]*\)\s*$/.test(String(node?.label || ""))) return node?.member_of ? "method" : "function";
+  return "symbol";
+}
+
+function isPublicSurface(node) {
+  const visibility = String(node?.visibility || "").toLowerCase();
+  return node?.exported === true || visibility === "public" || visibility === "protected";
+}
+
+export function symbolCandidate(item, node, context) {
+  const file = normalizedPath(item.file);
+  const source = String(context.sources.get(file) || "");
+  const pathInfo = context.classify(file, source);
+  const publicSurface = isPublicSurface(node);
+  const testOnly = item.testOnly === true;
+  const externalEntry = context.entrySet.has(file) || isFrameworkEntryFile(file);
+  const framework = context.frameworkByFile.get(file) || null;
+  const dynamicFile = context.dynamicTargets.has(file) || hasDynamicCode(source, file);
+  const reflectionFile = REFLECTION_RE.test(source);
+  const kind = kindOf(node);
+  const exactNoReference = context.exactNoReferenceIds.has(String(item.id));
+  const internallyScoped = String(node?.visibility || "").toLowerCase() === "private"
+    || (!publicSurface && ["method", "function"].includes(kind));
+  // Static absence alone is never high-confidence dead code. High is reserved for a successfully
+  // queried semantic declaration whose language server also returned no in-workspace references.
+  let confidence = internallyScoped && exactNoReference ? "high" : "medium";
+  const caveats = [];
+
+  if (internallyScoped && !exactNoReference) {
+    caveats.push("No complete exact semantic no-reference result is available for this declaration; static absence remains medium confidence.");
+  }
+
+  if (publicSurface) {
+    confidence = "low";
+    caveats.push("Public/exported APIs can be consumed by downstream packages, interfaces, reflection, dependency injection, templates, or configuration outside this repository.");
+  }
+  if (externalEntry || framework) {
+    confidence = "low";
+    caveats.push(framework?.reason || "This file is an externally entered or framework-owned surface; static inbound edges are not complete usage evidence.");
+  }
+  if (node?.decorated) {
+    confidence = "low";
+    caveats.push("Decorators/annotations can register this symbol without a direct caller.");
+  }
+  if (dynamicFile) {
+    confidence = "low";
+    caveats.push("The declaring file uses or is reached through dynamic loading, so the static graph can miss callers.");
+  }
+  if (reflectionFile || (publicSurface && context.repoSignals.reflection)) {
+    confidence = "low";
+    caveats.push("Reflection is present and may invoke names without a resolvable static edge.");
+  }
+
+  const evidenceTier = confidence === "high" && exactNoReference
+    ? "STRONG_STATIC_EVIDENCE"
+    : confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE";
+  const remainingChecks = [
+    ...(!exactNoReference ? ["Run an exact language-server reference query for this declaration."] : []),
+    ...(publicSurface ? ["Check downstream/external consumers of the public API."] : []),
+    ...(externalEntry || framework ? ["Inspect framework registration and externally entered call paths."] : []),
+    ...(dynamicFile ? ["Resolve dynamic import/require targets and name-based dispatch."] : []),
+    ...(reflectionFile || (publicSurface && context.repoSignals.reflection) ? ["Inspect reflection/annotation/configuration consumers."] : []),
+    "Run targeted tests after any removal.",
+  ];
+
+  return {
+    id: String(item.id),
+    kind,
+    classification: testOnly ? `test-only-${kind}` : publicSurface ? `public-${kind}` : kind === "method" ? "internal-method" : kind === "function" ? "internal-function" : "unreferenced-symbol",
+    file,
+    line: lineOf(node),
+    symbol: bareLabel(node?.label || item.label),
+    owner: node?.member_of || null,
+    symbolKind: node?.symbol_kind || null,
+    visibility: node?.visibility || (node?.exported ? "exported" : "internal"),
+    confidence,
+    evidenceTier,
+    actionability: evidenceTier === "STRONG_STATIC_EVIDENCE" ? "PRIORITY_MANUAL_REVIEW" : "MANUAL_REVIEW",
+    reason: item.reason,
+    evidence: [
+      ...(testOnly ? [{kind: item.evidence || "graph", fact: `Only test/e2e consumers were found${item.testConsumerFiles?.length ? `: ${item.testConsumerFiles.join(", ")}` : "."}`}]
+        : [{ kind: "graph", fact: "No inbound non-structural graph edge targets this symbol." }, { kind: "source-index", fact: "Its identifier has no second indexed occurrence that establishes a caller." }]),
+      ...(exactNoReference ? [{kind: "exact-lsp", fact: "The active language server returned no in-workspace references for this exact declaration."}] : []),
+    ],
+    caveats,
+    publicApi: publicSurface,
+    externallyEnteredFile: externalEntry,
+    pathClasses: pathInfo.classes || [],
+    matchedPathRule: pathInfo.matchedRule || null,
+    verification: {
+      graphInboundRuntimeEdge: "NOT_FOUND",
+      indexedSecondOccurrence: testOnly ? "TEST_ONLY" : "NOT_FOUND",
+      exactLanguageServerReferences: exactNoReference ? "ZERO_CONFIRMED" : "NOT_CHECKED_OR_INCOMPLETE",
+      recognizedEntryPoint: externalEntry ? "FOUND" : "NOT_FOUND",
+      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED_IN_DECLARING_FILE",
+      reflectionRisk: reflectionFile || (publicSurface && context.repoSignals.reflection) ? "PRESENT" : "NOT_OBSERVED",
+      publicApi: publicSurface ? "YES" : "NO",
+      decision: "MANUAL_REVIEW_REQUIRED",
+    },
+    remainingChecks,
+    autoDelete: false,
+    reviewAction: testOnly
+      ? "Confirm that no production/config/framework consumer exists; decide whether the declaration is intentional test support or removable with its tests. Never auto-delete."
+      : "Confirm with read_source, get_dependents, exact search, framework/config inspection and tests; never auto-delete.",
+  };
+}
+
+export function fileCandidate(item, symbols, context) {
+  const file = normalizedPath(item.file);
+  const source = String(context.sources.get(file) || "");
+  const pathInfo = context.classify(file, source);
+  const publicSymbols = symbols.filter((symbol) => symbol.publicApi);
+  const dynamicFile = context.dynamicTargets.has(file) || hasDynamicCode(source, file);
+  const reflectionFile = REFLECTION_RE.test(source);
+  // Whole-file liveness always remains at most medium: external launchers/manifests can exist outside
+  // the indexed import graph even when every internal symbol signal is otherwise strong.
+  let confidence = "medium";
+  const caveats = ["Files can be launched by scripts, plugins, manifests, framework conventions, generated consumers, or external tooling without an import edge."];
+  if (publicSymbols.length) {
+    confidence = "low";
+    caveats.push(`${publicSymbols.length} indexed public/exported symbol(s) may be consumed outside this repository.`);
+  }
+  if (dynamicFile) {
+    confidence = "low";
+    caveats.push("Dynamic loading is present in or targets this file.");
+  }
+  if (reflectionFile) {
+    confidence = "low";
+    caveats.push("Reflection is present in this file.");
+  }
+  const remainingChecks = [
+    "Inspect package scripts, manifests, framework/plugin discovery and deployment configuration.",
+    "Check external launchers and consumers outside the indexed repository.",
+    ...(dynamicFile ? ["Resolve dynamic import/require targets."] : []),
+    ...(reflectionFile ? ["Inspect reflection/name-based consumers."] : []),
+    "Run targeted tests after any removal.",
+  ];
+  return {
+    id: `file:${file}`,
+    kind: "file",
+    classification: "unreferenced-file",
+    file,
+    line: 1,
+    symbol: null,
+    owner: null,
+    symbolKind: null,
+    visibility: null,
+    confidence,
+    evidenceTier: confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE",
+    actionability: "MANUAL_REVIEW",
+    reason: item.reason,
+    evidence: [
+      { kind: "graph", fact: "No indexed module imports this file." },
+      { kind: "symbol-liveness", fact: "Every indexed symbol in the file is statically unreferenced." },
+    ],
+    caveats,
+    publicApi: publicSymbols.length > 0,
+    externallyEnteredFile: false,
+    pathClasses: pathInfo.classes || [],
+    matchedPathRule: pathInfo.matchedRule || null,
+    verification: {
+      graphInboundModuleEdge: "NOT_FOUND",
+      indexedSymbolsReferenced: "NONE",
+      recognizedEntryPoint: "NOT_FOUND",
+      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED",
+      reflectionRisk: reflectionFile ? "PRESENT" : "NOT_OBSERVED",
+      externalConsumerCheck: "NOT_POSSIBLE_FROM_REPOSITORY_GRAPH",
+      decision: "MANUAL_REVIEW_REQUIRED",
+    },
+    remainingChecks,
+    autoDelete: false,
+    reviewAction: "Verify package scripts, manifests, framework discovery, dynamic loading and external consumers; never auto-delete.",
+  };
+}

package/src/analysis/dead-code-review.js

@@ -1,200 +1,16 @@
 // Conservative, source-free review queue for statically unreferenced code. This deliberately builds
 // on computeDead instead of inventing a second liveness model. Candidates are evidence for review,
 // never deletion instructions: framework entry, dynamic loading, reflection and public API surfaces
-// lower confidence and remain explicit in the returned record.
-import { computeDead, isFrameworkEntryFile } from "./dead-check.js";
+// lower confidence and remain explicit in the returned record. Per-candidate record shapes live in
+// dead-code-review/candidates.js; this module owns collection, filtering and the summary envelope.
+import { computeDead } from "./dead-check.js";
 import { createPathClassifier } from "../path-classification.js";
 import {
   DEAD_CODE_CONFIDENCE_RANK as CONFIDENCE_RANK, hasDynamicCode,
   REFLECTION_CODE_RE as REFLECTION_RE, deadCodePathAllowed as pathAllowed,
   normalizedReviewPath as normalizedPath,
 } from './dead-code-review/policy.js'
-const lineOf = (node) => {
-  const match = /@(\d+)$/.exec(String(node?.id || "")) || /L(\d+)/.exec(String(node?.source_location || ""));
-  return match ? Number(match[1]) : 0;
-};
-const bareLabel = (value) => String(value || "").replace(/\s*\(.*$/, "").replace(/[()]/g, "").trim();
-
-function kindOf(node) {
-  const symbolKind = String(node?.symbol_kind || "").toLowerCase();
-  if (symbolKind === "method" || symbolKind === "constructor") return "method";
-  if (["function", "function_definition", "func", "fn"].includes(symbolKind)) return "function";
-  // Old graphs may not retain symbol_kind. Only use call syntax as a compatibility fallback;
-  // member_of alone also describes fields and must never promote them to methods.
-  if (!symbolKind && /\([^)]*\)\s*$/.test(String(node?.label || ""))) return node?.member_of ? "method" : "function";
-  return "symbol";
-}
-
-function isPublicSurface(node) {
-  const visibility = String(node?.visibility || "").toLowerCase();
-  return node?.exported === true || visibility === "public" || visibility === "protected";
-}
-
-function symbolCandidate(item, node, context) {
-  const file = normalizedPath(item.file);
-  const source = String(context.sources.get(file) || "");
-  const pathInfo = context.classify(file, source);
-  const publicSurface = isPublicSurface(node);
-  const testOnly = item.testOnly === true;
-  const externalEntry = context.entrySet.has(file) || isFrameworkEntryFile(file);
-  const framework = context.frameworkByFile.get(file) || null;
-  const dynamicFile = context.dynamicTargets.has(file) || hasDynamicCode(source, file);
-  const reflectionFile = REFLECTION_RE.test(source);
-  const kind = kindOf(node);
-  const exactNoReference = context.exactNoReferenceIds.has(String(item.id));
-  const internallyScoped = String(node?.visibility || "").toLowerCase() === "private"
-    || (!publicSurface && ["method", "function"].includes(kind));
-  // Static absence alone is never high-confidence dead code. High is reserved for a successfully
-  // queried semantic declaration whose language server also returned no in-workspace references.
-  let confidence = internallyScoped && exactNoReference ? "high" : "medium";
-  const caveats = [];
-
-  if (internallyScoped && !exactNoReference) {
-    caveats.push("No complete exact semantic no-reference result is available for this declaration; static absence remains medium confidence.");
-  }
-
-  if (publicSurface) {
-    confidence = "low";
-    caveats.push("Public/exported APIs can be consumed by downstream packages, interfaces, reflection, dependency injection, templates, or configuration outside this repository.");
-  }
-  if (externalEntry || framework) {
-    confidence = "low";
-    caveats.push(framework?.reason || "This file is an externally entered or framework-owned surface; static inbound edges are not complete usage evidence.");
-  }
-  if (node?.decorated) {
-    confidence = "low";
-    caveats.push("Decorators/annotations can register this symbol without a direct caller.");
-  }
-  if (dynamicFile) {
-    confidence = "low";
-    caveats.push("The declaring file uses or is reached through dynamic loading, so the static graph can miss callers.");
-  }
-  if (reflectionFile || (publicSurface && context.repoSignals.reflection)) {
-    confidence = "low";
-    caveats.push("Reflection is present and may invoke names without a resolvable static edge.");
-  }
-
-  const evidenceTier = confidence === "high" && exactNoReference
-    ? "STRONG_STATIC_EVIDENCE"
-    : confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE";
-  const remainingChecks = [
-    ...(!exactNoReference ? ["Run an exact language-server reference query for this declaration."] : []),
-    ...(publicSurface ? ["Check downstream/external consumers of the public API."] : []),
-    ...(externalEntry || framework ? ["Inspect framework registration and externally entered call paths."] : []),
-    ...(dynamicFile ? ["Resolve dynamic import/require targets and name-based dispatch."] : []),
-    ...(reflectionFile || (publicSurface && context.repoSignals.reflection) ? ["Inspect reflection/annotation/configuration consumers."] : []),
-    "Run targeted tests after any removal.",
-  ];
-
-  return {
-    id: String(item.id),
-    kind,
-    classification: testOnly ? `test-only-${kind}` : publicSurface ? `public-${kind}` : kind === "method" ? "internal-method" : kind === "function" ? "internal-function" : "unreferenced-symbol",
-    file,
-    line: lineOf(node),
-    symbol: bareLabel(node?.label || item.label),
-    owner: node?.member_of || null,
-    symbolKind: node?.symbol_kind || null,
-    visibility: node?.visibility || (node?.exported ? "exported" : "internal"),
-    confidence,
-    evidenceTier,
-    actionability: evidenceTier === "STRONG_STATIC_EVIDENCE" ? "PRIORITY_MANUAL_REVIEW" : "MANUAL_REVIEW",
-    reason: item.reason,
-    evidence: [
-      ...(testOnly ? [{kind: item.evidence || "graph", fact: `Only test/e2e consumers were found${item.testConsumerFiles?.length ? `: ${item.testConsumerFiles.join(", ")}` : "."}`}]
-        : [{ kind: "graph", fact: "No inbound non-structural graph edge targets this symbol." }, { kind: "source-index", fact: "Its identifier has no second indexed occurrence that establishes a caller." }]),
-      ...(exactNoReference ? [{kind: "exact-lsp", fact: "The active language server returned no in-workspace references for this exact declaration."}] : []),
-    ],
-    caveats,
-    publicApi: publicSurface,
-    externallyEnteredFile: externalEntry,
-    pathClasses: pathInfo.classes || [],
-    matchedPathRule: pathInfo.matchedRule || null,
-    verification: {
-      graphInboundRuntimeEdge: "NOT_FOUND",
-      indexedSecondOccurrence: testOnly ? "TEST_ONLY" : "NOT_FOUND",
-      exactLanguageServerReferences: exactNoReference ? "ZERO_CONFIRMED" : "NOT_CHECKED_OR_INCOMPLETE",
-      recognizedEntryPoint: externalEntry ? "FOUND" : "NOT_FOUND",
-      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED_IN_DECLARING_FILE",
-      reflectionRisk: reflectionFile || (publicSurface && context.repoSignals.reflection) ? "PRESENT" : "NOT_OBSERVED",
-      publicApi: publicSurface ? "YES" : "NO",
-      decision: "MANUAL_REVIEW_REQUIRED",
-    },
-    remainingChecks,
-    autoDelete: false,
-    reviewAction: testOnly
-      ? "Confirm that no production/config/framework consumer exists; decide whether the declaration is intentional test support or removable with its tests. Never auto-delete."
-      : "Confirm with read_source, get_dependents, exact search, framework/config inspection and tests; never auto-delete.",
-  };
-}
-
-function fileCandidate(item, symbols, context) {
-  const file = normalizedPath(item.file);
-  const source = String(context.sources.get(file) || "");
-  const pathInfo = context.classify(file, source);
-  const publicSymbols = symbols.filter((symbol) => symbol.publicApi);
-  const dynamicFile = context.dynamicTargets.has(file) || hasDynamicCode(source, file);
-  const reflectionFile = REFLECTION_RE.test(source);
-  // Whole-file liveness always remains at most medium: external launchers/manifests can exist outside
-  // the indexed import graph even when every internal symbol signal is otherwise strong.
-  let confidence = "medium";
-  const caveats = ["Files can be launched by scripts, plugins, manifests, framework conventions, generated consumers, or external tooling without an import edge."];
-  if (publicSymbols.length) {
-    confidence = "low";
-    caveats.push(`${publicSymbols.length} indexed public/exported symbol(s) may be consumed outside this repository.`);
-  }
-  if (dynamicFile) {
-    confidence = "low";
-    caveats.push("Dynamic loading is present in or targets this file.");
-  }
-  if (reflectionFile) {
-    confidence = "low";
-    caveats.push("Reflection is present in this file.");
-  }
-  const remainingChecks = [
-    "Inspect package scripts, manifests, framework/plugin discovery and deployment configuration.",
-    "Check external launchers and consumers outside the indexed repository.",
-    ...(dynamicFile ? ["Resolve dynamic import/require targets."] : []),
-    ...(reflectionFile ? ["Inspect reflection/name-based consumers."] : []),
-    "Run targeted tests after any removal.",
-  ];
-  return {
-    id: `file:${file}`,
-    kind: "file",
-    classification: "unreferenced-file",
-    file,
-    line: 1,
-    symbol: null,
-    owner: null,
-    symbolKind: null,
-    visibility: null,
-    confidence,
-    evidenceTier: confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE",
-    actionability: "MANUAL_REVIEW",
-    reason: item.reason,
-    evidence: [
-      { kind: "graph", fact: "No indexed module imports this file." },
-      { kind: "symbol-liveness", fact: "Every indexed symbol in the file is statically unreferenced." },
-    ],
-    caveats,
-    publicApi: publicSymbols.length > 0,
-    externallyEnteredFile: false,
-    pathClasses: pathInfo.classes || [],
-    matchedPathRule: pathInfo.matchedRule || null,
-    verification: {
-      graphInboundModuleEdge: "NOT_FOUND",
-      indexedSymbolsReferenced: "NONE",
-      recognizedEntryPoint: "NOT_FOUND",
-      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED",
-      reflectionRisk: reflectionFile ? "PRESENT" : "NOT_OBSERVED",
-      externalConsumerCheck: "NOT_POSSIBLE_FROM_REPOSITORY_GRAPH",
-      decision: "MANUAL_REVIEW_REQUIRED",
-    },
-    remainingChecks,
-    autoDelete: false,
-    reviewAction: "Verify package scripts, manifests, framework discovery, dynamic loading and external consumers; never auto-delete.",
-  };
-}
+import { symbolCandidate, fileCandidate } from './dead-code-review/candidates.js'
 
 // Pure review model. Filesystem collection/entry inference stays in the MCP adapter so tests can pass
 // exact source maps and convention evidence without touching the working tree.

package/src/analysis/git-history/collector.js

@@ -1,4 +1,3 @@
-import {spawn} from 'node:child_process'
 import {isWeavatrixIgnored} from '../../path-ignore.js'
 import {
     boundedHistoryInteger,
@@ -10,48 +9,7 @@ import {
 const HEADER_SEPARATOR = '\x1e'
 const FIELD_SEPARATOR = '\x1f'
 
-export function boundedGitCommand(command, args, options) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
-            cwd: options.cwd, env: options.env, shell: false, windowsHide: true,
-            stdio: ['ignore', 'pipe', 'pipe'],
-        })
-        const stdout = [], stderr = []
-        let stdoutBytes = 0, stderrBytes = 0, truncated = false, timedOut = false, settled = false
-        const finish = (callback) => {
-            if (settled) return
-            settled = true
-            clearTimeout(timer)
-            callback()
-        }
-        const stop = () => { try { child.kill('SIGKILL') } catch { /* process already exited */ } }
-        const timer = setTimeout(() => { timedOut = true; stop() }, options.timeoutMs)
-        child.stdout?.on('data', (chunk) => {
-            if (truncated) return
-            const remaining = options.maxOutputBytes - stdoutBytes
-            if (remaining <= 0) { truncated = true; stop(); return }
-            const kept = chunk.length <= remaining ? chunk : chunk.subarray(0, remaining)
-            stdout.push(kept); stdoutBytes += kept.length
-            if (kept.length !== chunk.length) { truncated = true; stop() }
-        })
-        child.stderr?.on('data', (chunk) => {
-            const remaining = 64 * 1024 - stderrBytes
-            if (remaining <= 0) return
-            const kept = chunk.length <= remaining ? chunk : chunk.subarray(0, remaining)
-            stderr.push(kept); stderrBytes += kept.length
-        })
-        child.on('error', (error) => finish(() => reject(error)))
-        child.on('close', (exitCode) => finish(() => {
-            if (timedOut) return reject(new Error('git history collection timed out'))
-            resolve({
-                stdout: Buffer.concat(stdout),
-                stderr: Buffer.concat(stderr).toString('utf8'),
-                exitCode: Number(exitCode ?? 1),
-                truncated,
-            })
-        }))
-    })
-}
+// git subprocess execution (sync runGit + streaming boundedGitCommand) lives in ../../git-exec.js.
 
 const statNumber = (value) => value === '-'
     ? {value: 0, binary: true}

package/src/analysis/git-history.js

@@ -3,7 +3,8 @@ import {childProcessEnv} from '../child-env.js'
 import {createRepoBoundary} from '../repo-path.js'
 import {loadWeavatrixIgnore} from '../path-ignore.js'
 import {buildGitHistoryAnalytics} from './git-history/analytics.js'
-import {boundedGitCommand, parseGitNumstatLog} from './git-history/collector.js'
+import {parseGitNumstatLog} from './git-history/collector.js'
+import {boundedGitCommand} from '../git-exec.js'
 import {
     boundedHistoryInteger,
     GIT_FORMAT,

package/src/analysis/git-ref-graph.js

@@ -4,18 +4,15 @@
 import {mkdtempSync, mkdirSync, rmSync} from 'node:fs'
 import {join} from 'node:path'
 import {tmpdir} from 'node:os'
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
+import {runCommandSync} from '../process.js'
 import {buildInternalGraph} from '../graph/internal-builder.js'
 import {filterGraphForMode} from '../graph/graph-filter.js'
 
 const SAFE_REF = /^(?!-)[A-Za-z0-9][A-Za-z0-9._\/@{}+~^-]{0,199}$/
 
 function git(repoRoot, args, timeout = 15_000) {
-    return spawnSync('git', ['-C', repoRoot, ...args], {
-        encoding: 'utf8', timeout, env: childProcessEnv(), windowsHide: true,
-        maxBuffer: 4 * 1024 * 1024,
-    })
+    return runGit(repoRoot, args, {timeout, maxBuffer: 4 * 1024 * 1024})
 }
 
 export function resolveGitCommit(repoRoot, requestedRef) {
@@ -41,10 +38,7 @@ export async function withGitRefCheckout(repoRoot, requestedRef, operation) {
         if (archived.status !== 0) {
             return {ok: false, error: `git archive failed for ${resolved.ref}: ${String(archived.stderr || '').trim() || 'unknown error'}`}
         }
-        const extracted = spawnSync('tar', ['-xf', archive, '-C', checkout], {
-            encoding: 'utf8', timeout: 60_000, env: childProcessEnv(), windowsHide: true,
-            maxBuffer: 4 * 1024 * 1024,
-        })
+        const extracted = runCommandSync('tar', ['-xf', archive, '-C', checkout], {timeout: 60_000, maxBuffer: 4 * 1024 * 1024})
         if (extracted.status !== 0) {
             return {ok: false, error: `temporary Git archive extraction failed: ${String(extracted.stderr || '').trim() || 'tar unavailable'}`}
         }