Skip to content

fix(analyzer): scanner deadlock, CRUD feature collapse, dependency updates - #107

Merged
itsflaid merged 3 commits into
mainfrom
fix/analyzer-audit-high
Oct 16, 2026
Merged

itsflaid merged 3 commits into
mainfrom
fix/analyzer-audit-high

Conversation

@itsflaid

Copy link
Copy Markdown
Owner

Ringkasan

Hasil audit analyzer: tiga bug HIGH diperbaiki, masing-masing dengan test regresi (dicek gagal di kode lama, lulus di kode baru), plus update dependency dalam rentang semver.

1. scanFiles deadlock di repo dengan banyak folder

visit() dijalankan di dalam pLimit(50) yang sama dengan task anaknya. Begitu ≥50 direktori terbuka bersamaan, semua slot dipegang parent yang menunggu anak yang antre di belakangnya. Hasilnya devmap analyze berhenti di "Scanning…" dan keluar dengan exit 13 (unsettled top-level await). Terbukti dengan 50 folder sejajar dan dengan pohon 8×8.

  • Limiter sekarang hanya membungkus I/O nyata (readdir, stat + readFile).
  • Symlink putus tidak lagi menggagalkan seluruh scan. Symlink ke folder, FIFO, dan socket dilewati (sebelumnya tampil sebagai file kosong, atau bisa menggantung).
  • Subfolder yang tidak terbaca dilewati; root yang hilang tetap error.

2. Semua resource CRUD runtuh jadi satu feature

deduplicateCapabilities mengelompokkan per kind saja, sehingga semua resource CRUD jadi satu capability. Karena rekonsiliasi kandidat memakai union-find (transitif), capability itu menjembatani semua entity. Project dengan route posts, invoices, users menghasilkan satu feature "Invoice Management".

  • Dedupe sekarang per kind + name.
  • reconcileFeatureCandidates menolak merge yang akan menyatukan dua cluster entity dengan nama entity yang tidak beririsan. Penolakan dicatat sebagai keputusan retained beserta alasannya.

3. Update dependency (commit terpisah)

  • CLI: ignore 7.0.12, p-limit 7.3.3, tsx 4.23, @types/node tetap di ^22. pnpm audit --prod CLI: 6 advisory brace-expansion → bersih.
  • Web: patch/minor lenis, postcss, autoprefixer, @astrojs/check.

Sengaja tidak diubah

  • astro 5 → 7, tailwindcss 3 → 4, typescript 7 adalah major upgrade. Sisa temuan pnpm audit (termasuk 1 critical di astro) semuanya ada di apps/web dan hanya bisa ditutup dengan upgrade astro mayor, yang perlu dikerjakan dan dites terpisah.
  • Temuan audit lain (heuristic analyzer untuk non-JS, import dinamis, tsconfig JSONC/extends, route detector, dll.) belum dikerjakan di PR ini.

Verifikasi

  • pnpm test di packages/cli (typecheck + unit): 281/281 lulus (sebelumnya 273)
  • pnpm build:cli, pnpm build:web, pnpm test:package-e2e: lulus
  • Test baru gagal di kode lama: scanner-robustness (4 dari 5), crud-feature-separation, dan satu test bridge di feature-candidates

🤖 Generated with Claude Code

https://claude.ai/code/session_019HJc4sv9pSLh7vhduSUxBE


Generated by Claude Code

claude added 3 commits October 8, 2026 11:34
…inks

scanFiles ran visit() inside the same pLimit(50) as its child tasks. Once 50
directories were open at once, every slot was held by a directory waiting on
children queued behind it, and the scan never finished (the CLI exited with
code 13, "unsettled top-level await"). The limiter now only wraps real I/O.

Also:
- stat() failures (dangling symlink, file removed mid-scan) skip the entry
  instead of rejecting Promise.all and aborting the whole analyze run
- non-regular files (symlinked directories, FIFOs, sockets) are skipped
  rather than reported as empty files or read forever
- unreadable subdirectories are skipped; an unreadable project root still
  rejects

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019HJc4sv9pSLh7vhduSUxBE
deduplicateCapabilities keyed capabilities by `kind` only, so every CRUD
resource ("Post Management", "Invoice Management", ...) was folded into one
capability named after the first resource, with all routes as its evidence.
Because candidate reconciliation is union-find (transitive), that single
capability then bridged every entity candidate, and a project with posts,
invoices and users routes produced one "Invoice Management" feature holding
all three routes.

- dedupe capabilities on kind + name so each resource stays separate
- reconcileFeatureCandidates now refuses a union that would join two
  entity-sourced clusters naming disjoint entities, so any remaining bridge
  candidate (e.g. a behavioral capability touching two resources) attaches
  to one entity instead of fusing them; refused merges are recorded as
  "retained" decisions with the reason

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019HJc4sv9pSLh7vhduSUxBE
CLI: ignore 7.0.6 -> 7.0.12, p-limit 7.3.0 -> 7.3.3, tsx 4.22 -> 4.23,
@types/node stays on the ^22 line (engines is >=22.12). The refreshed
lockfile also pulls brace-expansion to 5.0.12 (via ts-morph > minimatch),
clearing the 6 advisories `pnpm audit --prod` reported for the CLI.

Web: lenis, postcss, autoprefixer, @astrojs/check patch/minor bumps.

Not changed on purpose: astro 5 -> 7, tailwindcss 3 -> 4 and typescript 7 are
major upgrades; the remaining `pnpm audit` findings are all in apps/web and
need the astro major bump (see PR description).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019HJc4sv9pSLh7vhduSUxBE
@vercel

vercel Bot commented Oct 16, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
devmap-web Ready Ready Preview Oct 16, 2026 8:30am UTC

@github-actions

Copy link
Copy Markdown

✅ Welcome ke DevMap!

Terima kasih sudah buat PR. Pastikan checklist ini terpenuhi sebelum review:

  • devmap doctor lolos (tanpa error)
  • Test pnpm test:cli lolos (251 pass)
  • New commands diupdate di docs/commands.md
  • Tidak ada console.log di command files
  • Registry terms sesuai standar (baca docs/guide/05-signal-registry.md)
  • Code style match dengan CONTRIBUTING.md

CI akan jalan otomatis pada setiap update. Kalau gagal, akan muncul link run di komentar ini.

Kalau DevMap membantu, tolong star ya: https://github.com/itsflaid/devmap

Terima kasih kontribusinya! 🙏

@itsflaid
itsflaid merged commit c948b39 into main Oct 16, 2026
3 checks passed
@itsflaid
itsflaid deleted the fix/analyzer-audit-high branch October 16, 2026 08:31

This branch was successfully deployed

1 active deployment
Preview — 6ffef5d8 Deployed Oct 16, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants