roam-code 12.31__tar.gz → 12.32__tar.gz

{roam_code-12.31 → roam_code-12.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: roam-code
-Version: 12.31
+Version: 12.32
 Summary: Instant codebase comprehension for AI coding agents
 Author: CosmoHac
 License-Expression: Apache-2.0

{roam_code-12.31 → roam_code-12.32}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "roam-code"
-version = "12.31"
+version = "12.32"
 description = "Instant codebase comprehension for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{roam_code-12.31 → roam_code-12.32}/src/roam/catalog/detectors.py

@@ -1723,6 +1723,10 @@ def autodetect_framework_profile() -> str | None:
         tanstack = "@tanstack/vue-query" in deps or "@tanstack/query-core" in deps
         if tanstack and (vue_ver.startswith("^3") or vue_ver.startswith("3") or vue_ver.startswith("~3")):
             return "vue3-tanstack"
+        # Z6 (2026-05-06) — Express/Koa/Fastify don't have framework
+        # profiles yet (they're light frameworks; the I/O patterns are
+        # generic Node fs / http). Return None for now but flag in meta
+        # so future versions can add a profile when one becomes useful.
 
     composer = _read_json(_os.path.join(cwd, "composer.json"))
     if composer:
@@ -2766,6 +2770,197 @@ def detect_chained_collection_walks(conn: sqlite3.Connection) -> list[dict]:
     return results
 
 
+# Z1 (2026-05-06) — React: `useEffect(() => { ... })` without a dependency
+# array runs on EVERY render. Almost always a bug — the dev forgot the
+# second argument. The fix is `useEffect(() => { ... }, [deps])` or
+# `useEffect(() => { ... }, [])` for mount-only.
+_RE_USEEFFECT_NO_DEPS = re.compile(
+    r"\buseEffect\s*\(\s*(?:async\s+)?(?:\(\s*\)|function\s*\(\s*\))\s*=>\s*\{[^}]*?\}\s*\)",
+    re.DOTALL,
+)
+_RE_USEEFFECT_WITH_DEPS = re.compile(
+    r"\buseEffect\s*\(\s*[^,]+,\s*\[",
+)
+
+
+def detect_useeffect_missing_deps(conn: sqlite3.Connection) -> list[dict]:
+    """React: `useEffect(() => {...})` without a dependency array."""
+    try:
+        rows = conn.execute(
+            "SELECT s.id, s.name, s.qualified_name, s.kind, f.path AS file_path, "
+            "s.line_start, s.line_end "
+            "FROM symbols s "
+            "JOIN files f ON s.file_id = f.id "
+            "WHERE s.kind IN ('function', 'method') "
+            "AND f.language IN ('javascript', 'typescript', 'tsx', 'jsx')"
+        ).fetchall()
+    except Exception:
+        return []
+    results = []
+    for r in rows:
+        if _is_test_path(r["file_path"]):
+            continue
+        snippet = _read_symbol_source(r["file_path"], r["line_start"], r["line_end"])
+        if not snippet or "useEffect" not in snippet:
+            continue
+        # Skip if every useEffect call also has a deps array.
+        no_deps = _RE_USEEFFECT_NO_DEPS.search(snippet)
+        if not no_deps:
+            continue
+        # Verify the SAME call doesn't have a deps array (regex catches the
+        # no-deps shape but a more elaborate body could trick it).
+        # Conservative: only fire when there's NO useEffect-with-deps in body.
+        if _RE_USEEFFECT_WITH_DEPS.search(snippet):
+            # Mixed bag — at least one useEffect has deps, can't reliably
+            # tell which one is the problem without a real parser. Skip.
+            continue
+        line_offset = snippet[: no_deps.start()].count("\n")
+        match_line = (r["line_start"] or 1) + line_offset
+        results.append(
+            _finding(
+                "useeffect-missing-deps",
+                "no-deps-array",
+                r,
+                "useEffect without dependency array — runs on every render",
+                "high",
+                match_line=match_line,
+                snippet=snippet,
+                matched_patterns=["useEffect call", "no second-arg dep array"],
+            )
+        )
+    return results
+
+
+# Z2 (2026-05-06) — `eval()` / `exec()` / `new Function()` / `setTimeout(string)`
+# in production source. These are arbitrary code execution sinks if the
+# input is user-derived. Even when "safe" (literal string), they trip
+# CSP rules and bundler optimisations. Suppress when test path.
+_RE_EVAL_CALLS = re.compile(
+    r"\b(?:eval|exec|execfile|compile)\s*\("
+    r"|\bnew\s+Function\s*\("
+    r"|\bsetTimeout\s*\(\s*['\"]"
+    r"|\bsetInterval\s*\(\s*['\"]",
+)
+
+
+def detect_dangerous_eval(conn: sqlite3.Connection) -> list[dict]:
+    """Detect `eval`, `exec`, `new Function(...)`, `setTimeout(string)` — code-injection sinks."""
+    try:
+        rows = conn.execute(
+            "SELECT s.id, s.name, s.qualified_name, s.kind, f.path AS file_path, "
+            "f.language AS language, s.line_start, s.line_end "
+            "FROM symbols s "
+            "JOIN files f ON s.file_id = f.id "
+            "WHERE s.kind IN ('function', 'method')"
+        ).fetchall()
+    except Exception:
+        return []
+    results = []
+    for r in rows:
+        if _is_test_path(r["file_path"]):
+            continue
+        # Skip non-source roles when we can tell.
+        path = (r["file_path"] or "").replace("\\", "/").lower()
+        if "/migration" in path or "/script" in path or "/cli" in path:
+            # CLI / migration scripts often legitimately use exec/eval.
+            continue
+        snippet = _read_symbol_source(r["file_path"], r["line_start"], r["line_end"])
+        if not snippet:
+            continue
+        m = _RE_EVAL_CALLS.search(snippet)
+        if not m:
+            continue
+        # Skip ast.literal_eval (safe), regex.compile (different "compile"
+        # — won't actually match because it ends in `.compile(` with a dot
+        # before, so prefix isn't word-boundary — but be defensive).
+        if "literal_eval" in snippet[max(0, m.start() - 20) : m.end()]:
+            continue
+        if ".compile(" in snippet[max(0, m.start() - 5) : m.end() + 1]:
+            continue
+        line_offset = snippet[: m.start()].count("\n")
+        match_line = (r["line_start"] or 1) + line_offset
+        called = m.group(0).rstrip("(")
+        results.append(
+            _finding(
+                "dangerous-eval",
+                "eval-or-exec",
+                r,
+                f"Dangerous dynamic execution sink ({called}) — code-injection risk if input is user-derived",
+                "high",
+                match_line=match_line,
+                snippet=snippet,
+                matched_patterns=[f"call: {called}", "not in test/migration/script path"],
+            )
+        )
+    return results
+
+
+# Z5 (2026-05-06) — JS/TS DOM listener leak: `addEventListener` without
+# a paired `removeEventListener` keeps references alive after the
+# component unmounts. Detect ONLY when the function looks like a
+# component lifecycle (useEffect / componentDidMount / connectedCallback /
+# constructor) and addEventListener appears without remove.
+_RE_ADD_LISTENER = re.compile(r"\baddEventListener\s*\(")
+_RE_REMOVE_LISTENER = re.compile(r"\bremoveEventListener\s*\(")
+_RE_LIFECYCLE = re.compile(
+    r"\b(?:useEffect|componentDidMount|componentWillMount|connectedCallback|constructor)\b",
+)
+
+
+def detect_unremoved_event_listener(conn: sqlite3.Connection) -> list[dict]:
+    """JS/TS: `addEventListener` in a lifecycle without paired `removeEventListener`."""
+    try:
+        rows = conn.execute(
+            "SELECT s.id, s.name, s.qualified_name, s.kind, f.path AS file_path, "
+            "s.line_start, s.line_end "
+            "FROM symbols s "
+            "JOIN files f ON s.file_id = f.id "
+            "WHERE s.kind IN ('function', 'method') "
+            "AND f.language IN ('javascript', 'typescript', 'tsx', 'jsx')"
+        ).fetchall()
+    except Exception:
+        return []
+    results = []
+    for r in rows:
+        if _is_test_path(r["file_path"]):
+            continue
+        snippet = _read_symbol_source(r["file_path"], r["line_start"], r["line_end"])
+        if not snippet:
+            continue
+        if not _RE_ADD_LISTENER.search(snippet):
+            continue
+        # Only fire for lifecycle-ish bodies — outside of components,
+        # listeners are often global and intentionally never removed.
+        if not _RE_LIFECYCLE.search(snippet):
+            continue
+        # Already paired: presence of removeEventListener anywhere in body.
+        if _RE_REMOVE_LISTENER.search(snippet):
+            continue
+        # `useEffect` should also return a cleanup function. Check for one.
+        if "useEffect" in snippet and re.search(r"return\s+(?:\(\s*\)|function)", snippet):
+            continue
+        m = _RE_ADD_LISTENER.search(snippet)
+        line_offset = snippet[: m.start()].count("\n")
+        match_line = (r["line_start"] or 1) + line_offset
+        results.append(
+            _finding(
+                "unremoved-event-listener",
+                "no-cleanup",
+                r,
+                "addEventListener in component lifecycle without removeEventListener — memory leak",
+                "high",
+                match_line=match_line,
+                snippet=snippet,
+                matched_patterns=[
+                    "addEventListener call",
+                    "lifecycle context (useEffect / componentDidMount / etc.)",
+                    "no paired removeEventListener",
+                ],
+            )
+        )
+    return results
+
+
 def detect_loop_lookup(conn: sqlite3.Connection) -> list[dict]:
     """.index(), .indexOf(), .contains(), .includes() called inside a loop.
 
@@ -3736,6 +3931,9 @@ _MATH_DETECTORS = [
     ("spread-accumulator", "spread-rebind", detect_spread_accumulator),
     ("defer-in-loop", "loop-defer", detect_defer_in_loop),
     ("chained-collection-walk", "two-pass-walk", detect_chained_collection_walks),
+    ("useeffect-missing-deps", "no-deps-array", detect_useeffect_missing_deps),
+    ("dangerous-eval", "eval-or-exec", detect_dangerous_eval),
+    ("unremoved-event-listener", "no-cleanup", detect_unremoved_event_listener),
     ("list-prepend", "insert-front", detect_list_prepend),
     ("sort-to-select", "full-sort", detect_sort_to_select),
     ("loop-lookup", "method-scan", detect_loop_lookup),

{roam_code-12.31 → roam_code-12.32}/src/roam/catalog/tasks.py

@@ -400,6 +400,75 @@ CATALOG: dict[str, dict] = {
             },
         ],
     },
+    "unremoved-event-listener": {
+        "name": "addEventListener without paired removeEventListener (memory leak)",
+        "category": "concurrency",
+        "kind": "idiom",
+        "ways": [
+            {
+                "id": "with-cleanup",
+                "name": "useEffect cleanup / removeEventListener",
+                "time": "n/a",
+                "space": "n/a",
+                "rank": 1,
+                "tip": "Return a cleanup function from useEffect: `useEffect(() => { window.addEventListener('x', h); return () => window.removeEventListener('x', h); }, [])`. For class components, pair in componentWillUnmount.",
+            },
+            {
+                "id": "no-cleanup",
+                "name": "addEventListener with no cleanup",
+                "time": "n/a",
+                "space": "n/a",
+                "rank": 10,
+                "tip": "",
+            },
+        ],
+    },
+    "dangerous-eval": {
+        "name": "Dynamic execution sink (eval / exec / new Function)",
+        "category": "error-handling",
+        "kind": "idiom",
+        "ways": [
+            {
+                "id": "narrow-or-remove",
+                "name": "Use a parser / template / safer dispatch",
+                "time": "n/a",
+                "space": "n/a",
+                "rank": 1,
+                "tip": "Prefer ast.literal_eval, JSON.parse, a real template engine, or a switch/dispatch dict over arbitrary-string execution. Tightens CSP; eliminates injection surface.",
+            },
+            {
+                "id": "eval-or-exec",
+                "name": "eval / exec / new Function with dynamic input",
+                "time": "n/a",
+                "space": "n/a",
+                "rank": 10,
+                "tip": "",
+            },
+        ],
+    },
+    "useeffect-missing-deps": {
+        "name": "React useEffect without dependency array",
+        "category": "concurrency",
+        "kind": "idiom",
+        "ways": [
+            {
+                "id": "with-deps",
+                "name": "useEffect with explicit dep array",
+                "time": "n/a",
+                "space": "n/a",
+                "rank": 1,
+                "tip": "Add the dependency array as the second argument: `useEffect(() => {...}, [deps])`. Use `[]` for mount-only effects.",
+            },
+            {
+                "id": "no-deps-array",
+                "name": "useEffect without deps (runs every render)",
+                "time": "n/a",
+                "space": "n/a",
+                "rank": 10,
+                "tip": "",
+            },
+        ],
+    },
     "chained-collection-walk": {
         "name": "Chained collection walk (filter+find / map+find / filter+length)",
         "category": "collections",

{roam_code-12.31 → roam_code-12.32}/src/roam/commands/cmd_debt.py

@@ -562,10 +562,17 @@ def debt(ctx, limit, by_kind, threshold, roi):
         _debt_label = (
             "low debt" if stats["mean_debt"] < 0.1 else "moderate debt" if stats["mean_debt"] < 0.3 else "high debt"
         )
+        # Z14 (2026-05-06) — append top-1 hotspot to the verdict so the
+        # one-line summary tells you WHERE to look first, not just IF
+        # there's debt.
+        top_hint = ""
+        if all_items:
+            top1 = all_items[0]
+            top_hint = f" — top hotspot: {top1['path']} (score={top1['debt_score']})"
         _debt_verdict = (
             f"{_debt_label}: {_n_cycles} cycle files, "
             f"{_n_gods} god components, {_n_hotspots} hotspots "
-            f"across {stats['total_files']} files"
+            f"across {stats['total_files']} files{top_hint}"
         )
 
         roi_summary, roi_by_path = ({}, {})

{roam_code-12.31 → roam_code-12.32}/src/roam/commands/cmd_math.py

@@ -147,6 +147,23 @@ def math_cmd(
             click.echo(name)
         return
 
+    # Z7 (2026-05-06) — validate --task against the catalog; on typo, show
+    # the closest matches by edit distance instead of running 49 detectors
+    # silently to find zero results.
+    if task_filter:
+        from roam.catalog.tasks import CATALOG
+
+        if task_filter not in CATALOG:
+            import difflib
+
+            close = difflib.get_close_matches(task_filter, list(CATALOG.keys()), n=3, cutoff=0.4)
+            hint = f" Did you mean: {', '.join(close)}?" if close else ""
+            click.echo(
+                f"NOTE: --task '{task_filter}' is not a known task id."
+                f" Run `roam math --json` then look at distinct `task_id` values." + hint,
+                err=True,
+            )
+
     ensure_index()
 
     from roam.catalog.detectors import autodetect_framework_profile, run_detectors
@@ -289,7 +306,18 @@ def math_cmd(
             if top_n >= max(3, total // 2):
                 category_hint = f"; mostly: {top_cat}"
         if total == 0:
-            verdict = "No algorithmic issues detected"
+            # Z3 (2026-05-06) — informative zero-state. When 0 findings,
+            # tell the user (a) which profile filter was active, (b) how
+            # many detectors ran, (c) what to try next.
+            profile_note = ""
+            if profile != "balanced":
+                profile_note = f" (profile={profile} may be too strict; try --profile balanced)"
+            verdict = (
+                f"No algorithmic issues detected{profile_note} — "
+                f"{detector_meta.get('detectors_executed', 0)} detector(s) ran cleanly. "
+                f"Try `roam math --profile aggressive` for more candidates "
+                f"or `roam debt --top 10` for refactoring ROI hotspots."
+            )
         elif suppressed_count > 0:
             verdict = (
                 f"{unsuppressed_total} unsuppressed candidate{'s' if unsuppressed_total != 1 else ''} "
@@ -341,6 +369,15 @@ def math_cmd(
                                 [float(f.get("impact_score", 0.0) or 0.0) for f in findings],
                                 default=0.0,
                             ),
+                            # Z13 (2026-05-06) — top_tasks_by_count helps CI
+                            # dashboards / agents prioritise without iterating
+                            # every finding. Format: [{task_id, count}, ...].
+                            "top_tasks_by_count": [
+                                {"task_id": tid, "count": n}
+                                for tid, n in __import__("collections")
+                                .Counter(f.get("task_id", "?") for f in findings)
+                                .most_common(3)
+                            ],
                         },
                         findings=findings,
                     )

{roam_code-12.31 → roam_code-12.32}/src/roam/commands/cmd_pr_comment_render.py

@@ -287,6 +287,13 @@ def _section_rule_violations(rule_violations: list[dict]) -> list[str]:
     out = ["### Architecture rule violations", ""]
     block_v = [v for v in rule_violations if v.get("severity") == "BLOCK"]
     warn_v = [v for v in rule_violations if v.get("severity") in ("WARN", "WARNING")]
+    # Z4 (2026-05-06) — when total violations is huge, wrap the per-item
+    # detail in a collapsible <details> block so the comment doesn't
+    # dominate the PR thread on noisy diffs.
+    use_details = len(rule_violations) >= 12
+    if use_details:
+        out.append(f"<details><summary>{len(rule_violations)} violation(s) — expand for detail</summary>")
+        out.append("")
     for v in block_v[:5]:
         out.append(f"- **BLOCK** `{v['rule_id']}`: `{v['file']}` -> `{v['matched_import']}`")
         if v.get("description"):
@@ -309,6 +316,10 @@ def _section_rule_violations(rule_violations: list[dict]) -> list[str]:
         chunks = [f"`{rid}` x{n} ({sev})" for (sev, rid), n in counts.most_common(5)]
         more_total = extra_block + extra_warn
         out.append(f"- _...{more_total} more violation(s): " + ", ".join(chunks) + "._")
+    # Z4 — close the collapsible block when we opened one.
+    if use_details:
+        out.append("")
+        out.append("</details>")
     out.append("")
     return out
 

{roam_code-12.31 → roam_code-12.32}/src/roam/commands/finding_suppress.py

@@ -91,6 +91,52 @@ def _inline_match(line_text: str, command: str, task_id: str) -> bool:
     return False
 
 
+def _parse_simple_ignore_findings_yaml(text: str) -> dict:
+    """Minimal YAML parser for .roamignore-findings — no PyYAML required.
+
+    Handles the documented shape only:
+
+        rules:
+          - task_id: io-in-loop
+            path_glob: "src/composables/**/*.ts"
+            reason: "..."
+          - task_id: branching-recursion
+            path_glob: "src/utils/object-diff.ts"
+
+    Anything more complex (anchors, multi-line strings, nested lists)
+    needs real PyYAML. Returns ``{}`` on shapes we can't recognise so
+    callers fall through to a clean empty-rules state.
+    """
+    rules: list[dict] = []
+    current: dict | None = None
+    in_rules_block = False
+    for raw in text.splitlines():
+        line = raw.rstrip()
+        stripped = line.strip()
+        if not stripped or stripped.startswith("#"):
+            continue
+        if stripped == "rules:" or stripped.startswith("rules:"):
+            in_rules_block = True
+            continue
+        if not in_rules_block:
+            continue
+        if stripped.startswith("- "):
+            if current:
+                rules.append(current)
+            current = {}
+            stripped = stripped[2:].strip()
+            # First key on the same line as `-` is the common shape.
+            if ":" in stripped:
+                k, _, v = stripped.partition(":")
+                current[k.strip()] = v.strip().strip('"').strip("'")
+        elif current is not None and ":" in stripped:
+            k, _, v = stripped.partition(":")
+            current[k.strip()] = v.strip().strip('"').strip("'")
+    if current:
+        rules.append(current)
+    return {"rules": rules} if rules else {}
+
+
 def _load_ignore_findings_file(path: Path) -> list[dict]:
     """Load `.roamignore-findings` from ``path``. Returns ``[]`` on any error.
 
@@ -116,11 +162,15 @@ def _load_ignore_findings_file(path: Path) -> list[dict]:
 
         data = yaml.safe_load(text) or {}
     except ImportError:
-        # No PyYAML: assume strict JSON
+        # No PyYAML: try strict JSON first, then a minimal-YAML fallback so
+        # the .roamignore-findings format works on Python 3.9 / installs
+        # without PyYAML (PyYAML is not a project dependency).
         try:
             data = _json.loads(text)
         except _json.JSONDecodeError:
-            return []
+            data = _parse_simple_ignore_findings_yaml(text)
+            if not data:
+                return []
     except Exception:  # noqa: BLE001 — malformed YAML never crashes the analyser
         return []
     rules = data.get("rules") if isinstance(data, dict) else []

{roam_code-12.31 → roam_code-12.32}/src/roam/competitor_site_data.py

@@ -1362,8 +1362,8 @@ MAP_METADATA: dict[str, dict[str, object]] = {
         "relationship": "self",
         "peer": True,
         "graph": "PageRank + Tarjan + Louvain + layers",
-        "note": "Graph algorithms (PageRank, SCC, Louvain, Fiedler) on tree-sitter ASTs fused with git history in SQLite. 136 MCP tools, 187 CLI commands. 19 Python idiom detectors (v12.7+). 51 algo detectors (12.31).",
-        "version_evaluated": "12.31",
+        "note": "Graph algorithms (PageRank, SCC, Louvain, Fiedler) on tree-sitter ASTs fused with git history in SQLite. 136 MCP tools, 187 CLI commands. 19 Python idiom detectors (v12.7+). 54 algo detectors (12.32).",
+        "version_evaluated": "12.32",
         "repo_url": "https://github.com/Cranot/roam-code",
     },
     "CKB/CodeMCP": {

{roam_code-12.31 → roam_code-12.32}/src/roam/mcp-server-card.json

@@ -2,7 +2,7 @@
   "$schema": "https://schemas.modelcontextprotocol.io/server-card/v1",
   "name": "roam-code",
   "display_name": "roam — instant codebase intelligence",
-  "version": "12.31",
+  "version": "12.32",
   "description": "Architectural sight for AI agents before they edit. Pre-indexes symbols, call graphs, dependencies, architecture layers, and git history into a local SQLite DB. 136 MCP tools, 10 resources, 5 prompts, 27 languages. 100% local, zero API keys.",
   "vendor": {
     "name": "Cranot",

{roam_code-12.31 → roam_code-12.32}/src/roam_code.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: roam-code
-Version: 12.31
+Version: 12.32
 Summary: Instant codebase comprehension for AI coding agents
 Author: CosmoHac
 License-Expression: Apache-2.0

{roam_code-12.31 → roam_code-12.32}/tests/test_math.py

@@ -29,8 +29,9 @@ class TestCatalog:
 
         # T3 added serial-await-loop; X1-X5 added async-blocking-sleep,
         # broad-except-swallow, spread-accumulator, defer-in-loop;
-        # X13 added chained-collection-walk → 29.
-        assert len(CATALOG) == 29, f"Expected 29 tasks, got {len(CATALOG)}"
+        # X13 added chained-collection-walk; Z1/Z2/Z5 added useeffect-
+        # missing-deps, dangerous-eval, unremoved-event-listener → 32.
+        assert len(CATALOG) == 32, f"Expected 32 tasks, got {len(CATALOG)}"
 
     def test_detector_registry_covers_catalog(self):
         from roam.catalog.detectors import _MATH_DETECTORS
@@ -1166,6 +1167,82 @@ class TestBroadExceptSwallow:
             assert hits == []
 
 
+class TestUseEffectMissingDeps:
+    """Z1 (2026-05-06) — React useEffect without deps array."""
+
+    def test_detects_missing_deps(self, project_factory, monkeypatch):
+        proj = project_factory(
+            {
+                "Comp.tsx": (
+                    "import { useEffect } from 'react';\n"
+                    "export function Comp() {\n"
+                    "  useEffect(() => { console.log('hi'); });\n"
+                    "  return null;\n"
+                    "}\n"
+                ),
+            }
+        )
+        monkeypatch.chdir(proj)
+        from roam.catalog.detectors import detect_useeffect_missing_deps
+        from roam.db.connection import open_db
+
+        with open_db(readonly=True, project_root=proj) as conn:
+            hits = detect_useeffect_missing_deps(conn)
+            assert len(hits) >= 1
+
+    def test_skips_when_deps_present(self, project_factory, monkeypatch):
+        proj = project_factory(
+            {
+                "Comp.tsx": (
+                    "import { useEffect } from 'react';\n"
+                    "export function Comp(props: { id: string }) {\n"
+                    "  useEffect(() => { fetch(props.id); }, [props.id]);\n"
+                    "  return null;\n"
+                    "}\n"
+                ),
+            }
+        )
+        monkeypatch.chdir(proj)
+        from roam.catalog.detectors import detect_useeffect_missing_deps
+        from roam.db.connection import open_db
+
+        with open_db(readonly=True, project_root=proj) as conn:
+            hits = detect_useeffect_missing_deps(conn)
+            assert hits == []
+
+
+class TestDangerousEval:
+    """Z2 (2026-05-06) — eval / exec / new Function in production source."""
+
+    def test_detects_eval(self, project_factory, monkeypatch):
+        proj = project_factory(
+            {
+                "service.py": ("def evaluate(expr):\n    return eval(expr)\n"),
+            }
+        )
+        monkeypatch.chdir(proj)
+        from roam.catalog.detectors import detect_dangerous_eval
+        from roam.db.connection import open_db
+
+        with open_db(readonly=True, project_root=proj) as conn:
+            hits = detect_dangerous_eval(conn)
+            assert len(hits) >= 1
+
+    def test_skips_test_paths(self, project_factory, monkeypatch):
+        proj = project_factory(
+            {
+                "tests/test_eval.py": ("def test_eval():\n    return eval('1+1')\n"),
+            }
+        )
+        monkeypatch.chdir(proj)
+        from roam.catalog.detectors import detect_dangerous_eval
+        from roam.db.connection import open_db
+
+        with open_db(readonly=True, project_root=proj) as conn:
+            hits = detect_dangerous_eval(conn)
+            assert hits == []
+
+
 class TestBatchIterationGuard:
     """DF2 (2026-05-06) — `for chunk in _chunked(ids):` is not N+1."""
 

{roam_code-12.31 → roam_code-12.32}/tests/test_mcp_server.py

@@ -308,14 +308,24 @@ class TestToolDecorator:
             "roam_test_impact",
             "roam_disambiguate",
             "roam_why_fail",
+            # v12.27 / v12.28 — Roam Agent Review v2 layer (8)
+            "roam_pr_analyze",
+            "roam_pr_comment_render",
+            "roam_rules_validate",
+            "roam_audit_trail_export",
+            "roam_audit_trail_verify",
+            "roam_audit_trail_conformance_check",
+            "roam_dogfood",
+            "roam_metrics_push",
         }
         assert _CORE_TOOLS == expected
 
     def test_core_tools_count(self):
         from roam.mcp_server import _CORE_TOOLS
 
-        # v12.1: 27 + 6 = 33; v12.6: +2 Python-pivot = 35; v12.16: +1 catalog = 36.
-        assert len(_CORE_TOOLS) == 41
+        # v12.1: 27 + 6 = 33; v12.6: +2 Python-pivot = 35; v12.16: +1 catalog = 36;
+        # v12.19: +5 agent wrappers = 41; v12.28: +8 Agent Review v2 = 49.
+        assert len(_CORE_TOOLS) == 49
 
     def test_required_task_tools_declared(self):
         from roam.mcp_server import _TASK_REQUIRED_TOOLS