codetruth 0.2.0__py3-none-any.whl

codetruth/languages/javascript/extractor.py

@@ -0,0 +1,402 @@
+"""Layer 1 — symbol extraction for JavaScript/TypeScript via tree-sitter.
+
+Modules are files; a module's name is its repo-relative posix path without
+extension (e.g. 'src/utils'). Symbol ids are '<module>:<qualname>' exactly
+like the Python plugin, so every language-agnostic layer (graph, evidence,
+ranking, backstop, cache, config) applies unchanged.
+
+Requires the optional dependency group:  pip install codetruth[javascript]
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Optional
+
+from ...core.models import Symbol, SymbolType
+
+try:
+    from tree_sitter_language_pack import get_parser
+except ImportError:  # pragma: no cover
+    get_parser = None
+
+JS_EXTS = {".js", ".jsx", ".mjs", ".cjs"}
+TS_EXTS = {".ts", ".mts", ".cts"}
+TSX_EXTS = {".tsx"}
+ALL_EXTS = JS_EXTS | TS_EXTS | TSX_EXTS
+
+SKIP_DIRS = {
+    "node_modules", ".git", ".hg", "dist", "build", "out", ".next", ".nuxt",
+    "coverage", ".turbo", ".cache", "vendor", ".codetruth", "__pycache__",
+}
+
+CONFIG_EXTS = {".json", ".yaml", ".yml", ".toml", ".html"}
+
+_FUNC_VALUE_TYPES = {"arrow_function", "function_expression", "function",
+                     "generator_function"}
+
+
+def _parser_for(path: Path):
+    if path.suffix in TS_EXTS:
+        return get_parser("typescript")
+    if path.suffix in TSX_EXTS:
+        return get_parser("tsx")
+    return get_parser("javascript")
+
+
+@dataclass
+class ImportRec:
+    kind: str          # named | default | namespace | side | reexport | reexport_all
+    source: str        # the module specifier string ('./utils', 'react')
+    name: str          # imported name ('' for default/namespace/side)
+    alias: str         # local binding ('' when none, e.g. side-effect import)
+    line: int
+
+
+@dataclass
+class ModuleInfo:
+    name: str
+    rel_path: str
+    abs_path: str
+    is_test: bool
+    source: bytes = b""
+    tree: object = None                      # tree_sitter.Tree
+    symbols: list[Symbol] = field(default_factory=list)
+    imports: list[ImportRec] = field(default_factory=list)
+    exports: set = field(default_factory=set)   # exported local names
+
+
+def is_test_path(rel_path: str) -> bool:
+    p = rel_path.replace("\\", "/").lower()
+    base = p.rsplit("/", 1)[-1]
+    return ("/__tests__/" in f"/{p}" or ".test." in base or ".spec." in base
+            or any(part in ("tests", "test") for part in p.split("/")[:-1]))
+
+
+def iter_source_files(root: Path, ignores: tuple[str, ...] = ()):
+    from ...core.config import RepoConfig
+    cfg = RepoConfig(ignore_paths=list(ignores)) if ignores else None
+    for path in sorted(root.rglob("*")):
+        if not path.is_file() or path.suffix.lower() not in ALL_EXTS:
+            continue
+        rel = path.relative_to(root)
+        if any(part in SKIP_DIRS for part in rel.parts):
+            continue
+        if path.name.endswith(".d.ts"):
+            continue  # type declarations describe externals; no runtime code
+        if cfg and cfg.is_ignored(rel.as_posix()):
+            continue
+        yield path
+
+
+def iter_config_files(root: Path, ignores: tuple[str, ...] = ()):
+    from ...core.config import RepoConfig
+    cfg = RepoConfig(ignore_paths=list(ignores)) if ignores else None
+    for path in sorted(root.rglob("*")):
+        if not path.is_file() or path.suffix.lower() not in CONFIG_EXTS:
+            continue
+        rel = path.relative_to(root)
+        if any(part in SKIP_DIRS for part in rel.parts):
+            continue
+        if cfg and cfg.is_ignored(rel.as_posix()):
+            continue
+        yield path
+
+
+def module_name_for(path: Path, root: Path) -> str:
+    rel = path.relative_to(root).as_posix()
+    return rel.rsplit(".", 1)[0]
+
+
+def _text(node, src: bytes) -> str:
+    return src[node.start_byte:node.end_byte].decode("utf-8", "replace")
+
+
+class _Extractor:
+    def __init__(self, mi: ModuleInfo):
+        self.mi = mi
+        self.src = mi.source
+
+    # -- helpers --------------------------------------------------------------
+
+    def _add(self, name: str, qual: str, stype: SymbolType, node,
+             parent: str, exported: bool) -> Symbol:
+        sym = Symbol(
+            id=f"{self.mi.name}:{qual}", name=name, qualname=qual, type=stype,
+            file=self.mi.rel_path, line=node.start_point[0] + 1,
+            end_line=node.end_point[0] + 1, module=self.mi.name,
+            parent=parent, exported=exported, is_public=exported,
+            is_test=self.mi.is_test,
+        )
+        self.mi.symbols.append(sym)
+        return sym
+
+    # -- main walk ------------------------------------------------------------
+
+    def run(self) -> None:
+        mi = self.mi
+        root = mi.tree.root_node
+        mi.symbols.append(Symbol(
+            id=mi.name, name=mi.name.rsplit("/", 1)[-1], qualname=mi.name,
+            type=SymbolType.MODULE, file=mi.rel_path, line=1,
+            end_line=root.end_point[0] + 1, module=mi.name, parent=None,
+            exported=True, is_public=True, is_test=mi.is_test,
+        ))
+        self._walk_statements(root, prefix="", parent=mi.name, exported=False)
+        # Second pass: exported flags for names exported via clauses/CommonJS.
+        for s in mi.symbols:
+            if s.parent == mi.name and s.name in mi.exports:
+                s.exported = True
+                s.is_public = True
+
+    def _walk_statements(self, container, prefix: str, parent: str,
+                         exported: bool) -> None:
+        for node in container.named_children:
+            t = node.type
+            if t == "export_statement":
+                self._handle_export(node, prefix, parent)
+            elif t in ("function_declaration", "generator_function_declaration"):
+                self._add_function(node, prefix, parent, exported)
+            elif t in ("class_declaration", "abstract_class_declaration"):
+                self._add_class(node, prefix, parent, exported)
+            elif t in ("lexical_declaration", "variable_declaration"):
+                self._add_variables(node, prefix, parent, exported)
+            elif t in ("interface_declaration", "enum_declaration"):
+                self._add_named(node, prefix, parent, exported, SymbolType.CLASS)
+            elif t == "type_alias_declaration":
+                self._add_named(node, prefix, parent, exported,
+                                SymbolType.VARIABLE)
+            elif t == "import_statement":
+                self._handle_import(node)
+            elif t == "expression_statement":
+                self._handle_expression(node)
+            elif t in ("statement_block", "if_statement", "try_statement",
+                       "for_statement", "while_statement", "labeled_statement"):
+                self._walk_statements(node, prefix, parent, exported)
+
+    # -- declarations -----------------------------------------------------------
+
+    def _add_function(self, node, prefix, parent, exported):
+        name_node = node.child_by_field_name("name")
+        if name_node is None:
+            return
+        name = _text(name_node, self.src)
+        qual = f"{prefix}{name}"
+        sym = self._add(name, qual, SymbolType.FUNCTION, node, parent, exported)
+        body = node.child_by_field_name("body")
+        if body is not None:
+            self._walk_statements(body, prefix=f"{qual}.", parent=sym.id,
+                                  exported=False)
+
+    def _add_class(self, node, prefix, parent, exported):
+        name_node = node.child_by_field_name("name")
+        if name_node is None:
+            return
+        name = _text(name_node, self.src)
+        qual = f"{prefix}{name}"
+        sym = self._add(name, qual, SymbolType.CLASS, node, parent, exported)
+        # Superclass name recorded for the external-base caution logic.
+        heritage = next((c for c in node.named_children
+                         if c.type in ("class_heritage", "extends_clause")), None)
+        if heritage is not None:
+            base = _text(heritage, self.src)
+            base = base.replace("extends", "").strip().split("{")[0].strip()
+            if base:
+                sym.bases.append(base.split("(")[0].strip())
+        body = node.child_by_field_name("body")
+        if body is None:
+            return
+        for member in body.named_children:
+            if member.type == "method_definition":
+                mname_node = member.child_by_field_name("name")
+                if mname_node is None:
+                    continue
+                mname = _text(mname_node, self.src)
+                msym = self._add(mname, f"{qual}.{mname}", SymbolType.METHOD,
+                                 member, sym.id, exported=False)
+                # Methods are reachable on any instance — public unless the
+                # name is conventionally/lexically private.
+                msym.is_public = not mname.startswith(("_", "#"))
+            elif member.type in ("field_definition", "public_field_definition"):
+                fname_node = member.child_by_field_name("property") \
+                    or member.child_by_field_name("name")
+                value = member.child_by_field_name("value")
+                if fname_node is None:
+                    continue
+                fname = _text(fname_node, self.src)
+                stype = SymbolType.METHOD if value is not None \
+                    and value.type in _FUNC_VALUE_TYPES else SymbolType.VARIABLE
+                fsym = self._add(fname, f"{qual}.{fname}", stype, member,
+                                 sym.id, exported=False)
+                fsym.is_public = not fname.startswith(("_", "#"))
+
+    def _add_named(self, node, prefix, parent, exported, stype):
+        name_node = node.child_by_field_name("name")
+        if name_node is not None:
+            name = _text(name_node, self.src)
+            self._add(name, f"{prefix}{name}", stype, node, parent, exported)
+
+    def _add_variables(self, node, prefix, parent, exported):
+        for decl in node.named_children:
+            if decl.type != "variable_declarator":
+                continue
+            name_node = decl.child_by_field_name("name")
+            if name_node is None or name_node.type != "identifier":
+                continue  # destructuring handled by import logic when relevant
+            name = _text(name_node, self.src)
+            value = decl.child_by_field_name("value")
+            # `const m = require('./x')` is an import, not a symbol.
+            if value is not None and self._maybe_require(name, value):
+                continue
+            stype = SymbolType.FUNCTION if value is not None \
+                and value.type in _FUNC_VALUE_TYPES else SymbolType.VARIABLE
+            qual = f"{prefix}{name}"
+            sym = self._add(name, qual, stype, decl, parent, exported)
+            if value is not None and value.type in _FUNC_VALUE_TYPES:
+                body = value.child_by_field_name("body")
+                if body is not None and body.type == "statement_block":
+                    self._walk_statements(body, prefix=f"{qual}.",
+                                          parent=sym.id, exported=False)
+
+    # -- imports / exports ------------------------------------------------------
+
+    def _maybe_require(self, local_name: str, value) -> bool:
+        """`const x = require('lit')` → namespace import; returns True if so."""
+        if value.type == "call_expression":
+            fn = value.child_by_field_name("function")
+            args = value.child_by_field_name("arguments")
+            if fn is not None and _text(fn, self.src) == "require" \
+                    and args is not None and args.named_child_count == 1 \
+                    and args.named_children[0].type == "string":
+                source = _text(args.named_children[0], self.src).strip("'\"`")
+                self.mi.imports.append(ImportRec(
+                    "namespace", source, "", local_name,
+                    value.start_point[0] + 1))
+                return True
+        return False
+
+    def _handle_import(self, node) -> None:
+        src_node = node.child_by_field_name("source")
+        if src_node is None:
+            return
+        source = _text(src_node, self.src).strip("'\"`")
+        line = node.start_point[0] + 1
+        clause = next((c for c in node.named_children
+                       if c.type == "import_clause"), None)
+        if clause is None:
+            self.mi.imports.append(ImportRec("side", source, "", "", line))
+            return
+        for child in clause.named_children:
+            if child.type == "identifier":  # default import
+                self.mi.imports.append(ImportRec(
+                    "default", source, "default", _text(child, self.src), line))
+            elif child.type == "namespace_import":
+                ident = next((c for c in child.named_children
+                              if c.type == "identifier"), None)
+                if ident is not None:
+                    self.mi.imports.append(ImportRec(
+                        "namespace", source, "", _text(ident, self.src), line))
+            elif child.type == "named_imports":
+                for spec in child.named_children:
+                    if spec.type != "import_specifier":
+                        continue
+                    name_node = spec.child_by_field_name("name")
+                    alias_node = spec.child_by_field_name("alias")
+                    name = _text(name_node, self.src) if name_node else ""
+                    alias = _text(alias_node, self.src) if alias_node else name
+                    self.mi.imports.append(ImportRec(
+                        "named", source, name, alias, line))
+
+    def _handle_export(self, node, prefix, parent) -> None:
+        line = node.start_point[0] + 1
+        src_node = node.child_by_field_name("source")
+        source = _text(src_node, self.src).strip("'\"`") if src_node else None
+
+        decl = node.child_by_field_name("declaration")
+        if decl is not None:
+            t = decl.type
+            if t in ("function_declaration", "generator_function_declaration"):
+                self._add_function(decl, prefix, parent, exported=True)
+            elif t in ("class_declaration", "abstract_class_declaration"):
+                self._add_class(decl, prefix, parent, exported=True)
+            elif t in ("lexical_declaration", "variable_declaration"):
+                self._add_variables(decl, prefix, parent, exported=True)
+            elif t in ("interface_declaration", "enum_declaration"):
+                self._add_named(decl, prefix, parent, True, SymbolType.CLASS)
+            elif t == "type_alias_declaration":
+                self._add_named(decl, prefix, parent, True, SymbolType.VARIABLE)
+            elif t == "identifier":  # export default someName
+                self.mi.exports.add(_text(decl, self.src))
+            return
+
+        # `export * from './m'` / `export { a, b as c } [from './m']`
+        for child in node.named_children:
+            if child.type == "export_clause":
+                for spec in child.named_children:
+                    if spec.type != "export_specifier":
+                        continue
+                    name_node = spec.child_by_field_name("name")
+                    if name_node is None:
+                        continue
+                    name = _text(name_node, self.src)
+                    if source:
+                        self.mi.imports.append(ImportRec(
+                            "reexport", source, name, "", line))
+                    else:
+                        self.mi.exports.add(name)
+            elif child.type in ("identifier",):  # export default ident (fallback)
+                self.mi.exports.add(_text(child, self.src))
+        if source and not any(c.type == "export_clause"
+                              for c in node.named_children):
+            self.mi.imports.append(ImportRec("reexport_all", source, "*", "",
+                                             line))
+
+    def _handle_expression(self, node) -> None:
+        """CommonJS export forms: module.exports = X / exports.name = X."""
+        expr = node.named_children[0] if node.named_child_count else None
+        if expr is None or expr.type != "assignment_expression":
+            return
+        left = expr.child_by_field_name("left")
+        right = expr.child_by_field_name("right")
+        if left is None or right is None:
+            return
+        lhs = _text(left, self.src)
+        if lhs == "module.exports":
+            if right.type == "identifier":
+                self.mi.exports.add(_text(right, self.src))
+            elif right.type == "object":
+                for pair in right.named_children:
+                    if pair.type == "shorthand_property_identifier":
+                        self.mi.exports.add(_text(pair, self.src))
+                    elif pair.type == "pair":
+                        v = pair.child_by_field_name("value")
+                        if v is not None and v.type == "identifier":
+                            self.mi.exports.add(_text(v, self.src))
+        elif lhs.startswith("exports.") or lhs.startswith("module.exports."):
+            if right.type == "identifier":
+                self.mi.exports.add(_text(right, self.src))
+            self.mi.exports.add(lhs.rsplit(".", 1)[-1])
+
+
+def extract_repo(repo_path: Path,
+                 ignores: tuple[str, ...] = ()) -> tuple[list[ModuleInfo], list[str]]:
+    if get_parser is None:
+        raise ImportError(
+            "The JavaScript plugin needs tree-sitter: "
+            "pip install codetruth[javascript]")
+    modules: list[ModuleInfo] = []
+    warnings: list[str] = []
+    for path in iter_source_files(repo_path, ignores):
+        rel = path.relative_to(repo_path).as_posix()
+        mi = ModuleInfo(name=module_name_for(path, repo_path), rel_path=rel,
+                        abs_path=str(path), is_test=is_test_path(rel))
+        try:
+            mi.source = path.read_bytes()
+            mi.tree = _parser_for(path).parse(mi.source)
+        except (OSError, ValueError) as exc:
+            warnings.append(f"parse error in {rel}: {exc}")
+            modules.append(mi)
+            continue
+        _Extractor(mi).run()
+        modules.append(mi)
+    return modules, warnings

codetruth/languages/javascript/plugin.py

@@ -0,0 +1,52 @@
+"""The JavaScript/TypeScript language plugin (beta).
+
+Layers 2 and 4 — graph, evidence, ranking, textual backstop, persistent
+cache, config — are the language-agnostic core; this plugin provides
+extraction, edge building, and the JS rule set.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+from ...core.graph import CodeGraph
+from ...core.models import Marker, Symbol
+from ...core.plugin import LanguagePlugin, Rule
+from . import edges as edges_mod
+from . import rules as rules_mod
+from .extractor import (ModuleInfo, extract_repo, iter_config_files,
+                        iter_source_files)
+
+
+class JavaScriptPlugin(LanguagePlugin):
+    name = "javascript"
+
+    def extract(self, repo_path: Path,
+                ignores: tuple[str, ...] = ()) -> tuple[list[ModuleInfo], list[str]]:
+        return extract_repo(repo_path, ignores)
+
+    def build_index(self, modules: list[ModuleInfo]) -> edges_mod.SymbolIndex:
+        return edges_mod.SymbolIndex(modules)
+
+    def build_edges(self, repo_path: Path, modules: list[ModuleInfo],
+                    index: edges_mod.SymbolIndex, graph: CodeGraph,
+                    markers: list[Marker]) -> None:
+        edges_mod.build_edges(modules, index, graph, markers)
+
+    def rules(self) -> list[Rule]:
+        return rules_mod.default_rules()
+
+    def symbols(self, modules: list[ModuleInfo]) -> list[Symbol]:
+        return [s for m in modules for s in m.symbols]
+
+    def config_files(self, repo_path: Path,
+                     ignores: tuple[str, ...] = ()) -> list[Path]:
+        return list(iter_config_files(repo_path, ignores))
+
+    def source_files(self, repo_path: Path,
+                     ignores: tuple[str, ...] = ()) -> list[Path]:
+        files = list(iter_source_files(repo_path, ignores)) \
+            + list(iter_config_files(repo_path, ignores))
+        toml = repo_path / ".codetruth.toml"
+        if toml.is_file():
+            files.append(toml)
+        return files

codetruth/languages/javascript/rules.py

@@ -0,0 +1,201 @@
+"""Layer 3 — semantic safety rules for JavaScript/TypeScript.
+
+The JS ecosystem wires code through package metadata and dynamic constructs;
+these rules surface those indirect usage paths as markers/weak edges.
+"""
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+from ...core.models import (Edge, EdgeKind, EdgeStrength, Marker, MarkerKind,
+                            SymbolType)
+from ...core.plugin import Rule, RuleContext
+from .extractor import _text
+
+IDENT_RE = re.compile(r"^[A-Za-z_$][A-Za-z0-9_$]*$")
+
+COMMON_WORDS = {
+    "main", "test", "data", "name", "type", "value", "true", "false", "null",
+    "undefined", "default", "error", "index", "utils", "string", "number",
+    "object", "click", "change", "submit", "content", "message", "props",
+    "state", "children", "class", "style", "text", "html", "json", "body",
+}
+
+
+class PackageJsonEntrypointRule(Rule):
+    """Modules referenced by package.json main/module/bin/exports are the
+    package's public surface — external consumers load them by path."""
+    id = "js-package-json-entrypoints"
+
+    def apply(self, ctx: RuleContext) -> None:
+        pkg = ctx.repo_path / "package.json"
+        if not pkg.is_file():
+            return
+        try:
+            doc = json.loads(pkg.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            return
+        specs: list[str] = []
+        for key in ("main", "module", "browser", "types"):
+            if isinstance(doc.get(key), str):
+                specs.append(doc[key])
+        bin_field = doc.get("bin")
+        if isinstance(bin_field, str):
+            specs.append(bin_field)
+        elif isinstance(bin_field, dict):
+            specs.extend(v for v in bin_field.values() if isinstance(v, str))
+        specs.extend(self._flatten_exports(doc.get("exports")))
+
+        for spec in specs:
+            mod = ctx.index.resolve_source("package", "./" + spec.lstrip("./"))
+            if mod is not None:
+                ctx.add_marker(Marker(
+                    mod, MarkerKind.ENTRYPOINT,
+                    f"referenced by package.json ('{spec}') — loaded "
+                    "externally by path", rule=self.id, file="package.json",
+                    line=1))
+
+    def _flatten_exports(self, exports) -> list[str]:
+        out: list[str] = []
+        if isinstance(exports, str):
+            out.append(exports)
+        elif isinstance(exports, dict):
+            for v in exports.values():
+                out.extend(self._flatten_exports(v))
+        return out
+
+
+class ConstructorRule(Rule):
+    """`constructor` is invoked implicitly via `new Class()`."""
+    id = "js-constructor"
+
+    def apply(self, ctx: RuleContext) -> None:
+        for sym in ctx.index.all_symbols():
+            if sym.type is SymbolType.METHOD and sym.name == "constructor":
+                ctx.add_marker(Marker(
+                    sym.id, MarkerKind.ENTRYPOINT,
+                    "constructor — invoked implicitly via `new`",
+                    rule=self.id, file=sym.file, line=sym.line))
+
+
+class DynamicCodeRule(Rule):
+    """eval / new Function / non-literal dynamic import poison the module:
+    nothing in it can be proved unreachable."""
+    id = "js-dynamic-code"
+
+    def apply(self, ctx: RuleContext) -> None:
+        for mi in ctx.modules:
+            if mi.tree is None:
+                continue
+            self._scan(ctx, mi, mi.tree.root_node)
+
+    def _scan(self, ctx, mi, node) -> None:
+        if node.type == "call_expression":
+            fn = node.child_by_field_name("function")
+            if fn is not None:
+                fname = _text(fn, mi.source)
+                if fname in ("eval",):
+                    ctx.add_marker(Marker(
+                        mi.name, MarkerKind.DYNAMIC_MODULE,
+                        f"eval() at {mi.rel_path}:{node.start_point[0] + 1} — "
+                        "symbols here cannot be proved unreachable",
+                        rule=self.id, file=mi.rel_path,
+                        line=node.start_point[0] + 1))
+        elif node.type == "new_expression":
+            ctor = node.child_by_field_name("constructor")
+            if ctor is not None and _text(ctor, mi.source) == "Function":
+                ctx.add_marker(Marker(
+                    mi.name, MarkerKind.DYNAMIC_MODULE,
+                    f"new Function() at {mi.rel_path}:{node.start_point[0] + 1}",
+                    rule=self.id, file=mi.rel_path,
+                    line=node.start_point[0] + 1))
+        for child in node.named_children:
+            self._scan(ctx, mi, child)
+
+
+class StringReferenceRule(Rule):
+    """String literals naming a symbol or module path create weak edges —
+    config-driven wiring, dependency-injection tokens, dynamic routes."""
+    id = "js-string-references"
+
+    def apply(self, ctx: RuleContext) -> None:
+        for mi in ctx.modules:
+            if mi.tree is None:
+                continue
+            self._scan_tree(ctx, mi, mi.tree.root_node)
+        for path in ctx.config_files:
+            rel = path.relative_to(ctx.repo_path).as_posix()
+            if rel == "package.json":
+                continue  # handled structurally by the entrypoint rule
+            try:
+                text = path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            for lineno, line in enumerate(text.splitlines(), 1):
+                self._match_line(ctx, line, f"file:{rel}", rel, lineno)
+
+    def _scan_tree(self, ctx, mi, node) -> None:
+        if node.type in ("string", "template_string"):
+            value = _text(node, mi.source).strip("'\"`")
+            self._match_value(ctx, value, mi.name, mi.rel_path,
+                              node.start_point[0] + 1)
+            return
+        for child in node.named_children:
+            self._scan_tree(ctx, mi, child)
+
+    def _match_value(self, ctx, value: str, src, file, lineno) -> None:
+        if IDENT_RE.match(value) and len(value) >= 4 \
+                and value.lower() not in COMMON_WORDS:
+            for sid in ctx.index.by_name.get(value, []):
+                ctx.add_edge(Edge(src, sid, EdgeKind.STRING_REF,
+                                  EdgeStrength.WEAK, file, lineno,
+                                  f"string literal '{value}'"))
+        elif "/" in value:
+            mod = value.lstrip("./")
+            if mod in ctx.index.modules:
+                ctx.add_edge(Edge(src, mod, EdgeKind.STRING_REF,
+                                  EdgeStrength.WEAK, file, lineno,
+                                  f"path string '{value}'"))
+
+    def _match_line(self, ctx, line: str, src, file, lineno) -> None:
+        for token in re.findall(r"[A-Za-z_$][A-Za-z0-9_$./-]*", line):
+            if "/" in token and token.lstrip("./") in ctx.index.modules:
+                ctx.add_edge(Edge(src, token.lstrip("./"), EdgeKind.STRING_REF,
+                                  EdgeStrength.WEAK, file, lineno,
+                                  f"path reference '{token}'"))
+            elif IDENT_RE.match(token) and len(token) >= 4 \
+                    and token.lower() not in COMMON_WORDS \
+                    and token in ctx.index.by_name:
+                for sid in ctx.index.by_name[token]:
+                    ctx.add_edge(Edge(src, sid, EdgeKind.STRING_REF,
+                                      EdgeStrength.WEAK, file, lineno,
+                                      f"config reference '{token}'"))
+
+
+class DeclaredEntrypointRule(Rule):
+    """.codetruth.toml entrypoints — same contract as the Python plugin."""
+    id = "declared-entrypoints"
+
+    def apply(self, ctx: RuleContext) -> None:
+        from ...core.config import load_config
+        cfg = load_config(ctx.repo_path)
+        if not cfg.entrypoints:
+            return
+        for sym in ctx.index.all_symbols():
+            if cfg.is_declared_entrypoint(sym.id):
+                ctx.add_marker(Marker(
+                    sym.id, MarkerKind.ENTRYPOINT,
+                    "declared as an entry point in .codetruth.toml",
+                    rule=self.id, file=sym.file, line=sym.line))
+
+
+def default_rules() -> list[Rule]:
+    return [
+        DeclaredEntrypointRule(),
+        PackageJsonEntrypointRule(),
+        ConstructorRule(),
+        DynamicCodeRule(),
+        StringReferenceRule(),
+    ]