Skip to content

fix(analyzer): sisa temuan audit — alias/graph, analyzer non-JS, detector - #108

Merged
itsflaid merged 3 commits into
mainfrom
fix/analyzer-audit-rest
Oct 17, 2026
Merged

itsflaid merged 3 commits into
mainfrom
fix/analyzer-audit-rest

Conversation

@itsflaid

Copy link
Copy Markdown
Owner

Ringkasan

Sisa temuan audit analyzer (setelah #107), dijadikan satu branch, satu commit per kelompok + regression test. Semua test baru sudah diverifikasi gagal di source lama dan lulus di source baru. Suite: 281 → 324 test, semuanya hijau; build:cli, build:web, test:package-e2e lulus.

1. Graph / alias / ignore (06db2c9)

  • Alias: tsconfig JSONC (komentar + trailing comma), extends, baseUrl, references (gaya Vite), tsconfig per workspace (apps/*, packages/*), $lib SvelteKit, exact alias (@config tidak lagi menelan @configuration/x), longest-pattern-wins.
  • Graph: edge di-dedupe, tanpa self-edge, import() dinamis, .jsx/.mts/.cts, ../x di atas root tidak lagi cocok ke file root.
  • ts-morph: import(), import x = require(), import("x").T, nama const hasil destructuring, overload dihitung sekali.
  • Filter: .gitignore bersarang, ekstensi case-insensitive, .env dicocokkan per nama file (.envrc tidak ikut terbuang), cache gitignore di-reset tiap scan.

2. Analyzer non-JS (c67087e)

.py/.rb/.php/.go/.cs/.java sebelumnya selalu imports kosong dan simbol sampah (class of dari docstring). Sekarang ada reader per bahasa (komentar/docstring dibuang tapi string literal dijaga). Edge graph untuk Python (relatif + dotted module, layout root/src/), Ruby require_relative, PHP require relatif. Go/C#/Java: import terbaca tapi belum jadi edge (butuh go.mod/namespace resolution).

3. Detector (73ec7fa)

BOM package.json, @vue/cli-service, "main" bawaan npm init tidak lagi mengubah app Express jadi "library", barrel index.ts bukan entry point (devmap sendiri: 9 dari 12 entry point adalah barrel → sekarang 3 entry nyata), sample/docs folder hanya dikecualikan di level repo/workspace, route: pages/index = /, export { h as GET }, export const { GET } = handlers, Nuxt server/api, mount Express dengan middleware dan nested router; scope file: test/ di root, .svelte/+page bukan api; fingerprint tidak bergantung locale.

Sengaja tidak dikerjakan

  • Major bump astro/tailwind/typescript (termasuk advisory critical astro di apps/web) — perlu PR sendiri.
  • Bonus ranking projectmap/filescanner/analyzerregistry di projectMap.ts: masih hardcode nama devmap, tapi test agent-navigation mengunci perilakunya; ubah bareng penyesuaian test.
  • Resolusi edge Go/C#/Java dan PSR-4 PHP.
  • Route detector: catch-all/intercepting route Next masih ditulis apa adanya.

Cara cek

cd packages/cli && pnpm test

devmap analyze --fresh di repo ini: 319 file, 467 edge, entry point packages/cli/src/index.ts, apps/web/src/pages/{index,docs}.astro.


Generated by Claude Code

…rt graph

Alias loading used plain JSON.parse on the root tsconfig only, so JSONC
configs, `extends`, `baseUrl`, project `references`, workspace sub-package
configs and SvelteKit's $lib were all silently dropped, and an exact alias
(`@config`) swallowed longer specifiers (`@configuration/x`).

- aliasResolver: parse JSONC via ts.parseConfigFileTextToJson, follow
  extends/references, honour baseUrl, scope mappings to the declaring config,
  longest-pattern-wins, exact aliases, $lib default for SvelteKit
- dependencyGraph: dedupe edges, drop self-edges, dynamic import(), .jsx/.mts/
  .cts resolution, relative imports above the root no longer match root files
- tsMorphAnalyzer: dynamic import(), import = require(), import() types,
  destructured const names, overload signatures listed once
- filterEngine: nested .gitignore, case-insensitive extensions, .env matching
  by file name instead of prefix, cache cleared per scan

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019HJc4sv9pSLh7vhduSUxBE
… and Java

The heuristic analyzer ran JS-syntax regexes over every language it claims to
support, so .py/.php/.go/.rb/.cs/.java files always had empty imports and
exports, and docstring text produced bogus symbols (`class of`).

- per-language readers with comment/docstring stripping that keeps string
  literals (a `//` in a URL no longer hides code)
- Python relative imports become path-style specifiers; the graph resolves
  them plus absolute dotted modules (root and src/ layouts, __init__.py)
- Ruby require_relative and relative PHP require/include become edges
- JS-family files handled by this analyzer also pick up dynamic import()

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019HJc4sv9pSLh7vhduSUxBE
- package.json with a UTF-8 BOM no longer empties every manifest detector
- @vue/cli-service (not vue-cli-service) marks a Vue app
- npm init's default "main" no longer turns an Express/Next app into a
  'library' with framework unknown
- barrel index files that the app imports are no longer entry points; only
  production importers count, so tests importing src/index.ts do not demote it
- sample/doc folders are only excluded at repo or workspace level, so a
  src/features/demo or src/docs feature is analysed; spec/test patterns cover
  .mts/.cts and Python/Go test files
- routes: pages/index is '/', export { h as GET } and export const { GET } =
  handlers report methods, Nuxt server/api + server/routes, express mounts
  with middleware and multi-level router nesting
- file scope: root test/ folders are tests; .svelte/.vue/.astro and
  +page/+layout files under routes/ are UI
- projectMap: fingerprint no longer depends on locale, escape entity slug in
  the CRUD flow regex, fix the db/ data-layer pattern, drop devmap-only
  projectMap/filescanner purposes that mislabelled other projects

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019HJc4sv9pSLh7vhduSUxBE
@vercel

vercel Bot commented Oct 17, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
devmap-web Skipped Skipped Oct 17, 2026 10:19am UTC

@github-actions

Copy link
Copy Markdown

✅ Welcome ke DevMap!

Terima kasih sudah buat PR. Pastikan checklist ini terpenuhi sebelum review:

  • devmap doctor lolos (tanpa error)
  • Test pnpm test:cli lolos (251 pass)
  • New commands diupdate di docs/commands.md
  • Tidak ada console.log di command files
  • Registry terms sesuai standar (baca docs/guide/05-signal-registry.md)
  • Code style match dengan CONTRIBUTING.md

CI akan jalan otomatis pada setiap update. Kalau gagal, akan muncul link run di komentar ini.

Kalau DevMap membantu, tolong star ya: https://github.com/itsflaid/devmap

Terima kasih kontribusinya! 🙏

@itsflaid
itsflaid merged commit 70db19e into main Oct 17, 2026
3 checks passed
@itsflaid
itsflaid deleted the fix/analyzer-audit-rest branch October 17, 2026 10:22
@itsflaid itsflaid mentioned this pull request Oct 17, 2026

This branch was previously deployed

1 inactive deployment
Preview — 73ec7faf Deployed Oct 17, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants