chore(release): 0.5.0 — Phase 6 (lifecycle, scale, hardening)#60
Merged
Conversation
… gate (6.3, G8) Make scan output reproducible across runs and machines, and enforce it in CI. - scanReact iterates source files in stable path order (new sortedSourceFiles) across all three file passes, and returns nodes sorted by id + edges by a total-order key over every identifying field (edgeSortKey). - resolveHookEdges re-sorts and dedups after rewriting unresolved-hook placeholders (a rewrite can collide two edges onto one hook id). - Candidate ranking gets a final id tiebreak (same-named components rank deterministically instead of by scan order). - Eval runner scans each fixture twice and byte-compares (dropping only generatedAt): new determinismStablePct metric, printed and hard-gated. - 4 new parser-react determinism tests; queryfn.test order-fragile assertion made order-independent. eval 304/0/0/0, determinism 1.000, all metrics 1.000; typecheck + lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…eterminism feat(determinism): stable ordering + eval two-run byte-diff gate (6.3, G8)
…nt (6.5, D5/G7) Machine-generated code is retained as lineage/API metadata but kept out of match candidates, and the screenshot-privacy policy is enforced in CI. - isGeneratedFile classifies files by __generated__//generated/ path segment, .generated./.gen. filename infix, @generated/DO NOT EDIT banner, or a minified (>=3000-char) line. A post-pass tags component/hook nodes with a `generated` flag (function + class components + hooks, uniformly). - matchComponents drops `generated` components from the candidate pool and IDF corpus; their nodes/edges (incl. data sources) stay for tracing. - docs/security.md states the G7 PII policy; packages/vision/src/policy.test.ts enforces it — greps vision source for fs-write/image-persistence APIs and asserts the package never imports fs. - New fixture d5-generated-code: path- and banner-classified generated components trace to endpoints but decline on their text; the hand-written component matches and isn't poisoned by generated text in the query. 6 parser-react + 7 vision tests; eval 314/0/0/0, determinism 1.000, all metrics 1.000; typecheck + lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…enerated-classification feat(classification): generated-code exclusion + PII policy enforcement (6.5, D5/G7)
…king (6.4, G3/A11)
Warn when a ticket resolved against a stored (production) graph points at a
definition that was renamed or moved in the current code.
- core diffRenames(from, to): pairs a definition gone by identity (name+file)
with a same-body-signature definition that is new in the newer graph. Signature
= structural fingerprint + normalized rendered text + props + rendered-children,
stable across a rename/move. Confident 1:1 only; generic/ambiguous bodies
skipped (no false renames).
- core SHA-keyed store: saveGraphToStore/loadGraphFromStore/graphStoreDir ->
.coderadar/graphs/<sha>.json (or "working") + a latest pointer.
- buildBundle gains a currentGraph option -> "version skew — matched `X`;
renamed `Y` (file) in the current graph".
- CLI: scan --store writes the store; bundle --against <sha|latest> loads the
current graph for the diff.
- Fixture pair g3-version-skew/{old,new} (InvoiceCard.tsx -> BillingCard.tsx,
renamed and moved). .coderadar/ gitignored.
7 core + 4 store + 2 parser-react + 3 agent-sdk tests; verified end-to-end via
the CLI. eval 317/0/0/0, determinism 1.000, all metrics 1.000; typecheck + lint
clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ersion-skew feat(version-skew): SHA-keyed store + cross-version rename tracking (6.4, G3/A11)
Guard against scaling regressions with a large synthetic app and a gated budget. - eval/src/bench.ts deterministically generates a ~2,000-file React app with realistic import depth (page -> 8 sections -> 8 atoms + a hook, direct fetch per section), scans it, and asserts a perf budget (--files / --budget-seconds / --budget-rss-mb), measuring wall time and peak RSS via process.resourceUsage().maxRSS. - Measured ~2,016 files in ~2s / ~400 MB — far under the 300s / 4 GB budget, so the optional worker-thread / tree-sitter fast paths were deliberately not applied (no measured bottleneck). - Root `pnpm bench` script; nightly .github/workflows/perf.yml (schedule + manual dispatch) runs the budget-gated bench off the per-PR path. - eval/bench/ gitignored and self-cleaned after each run. eval 317/0/0/0, determinism 1.000; typecheck + lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…cale-bench feat(bench): scale benchmark generator + nightly perf budget (6.2, D3)
…ch (6.1, D1/G2) Re-scan only what changed, with a graph provably identical to a full re-scan. - Split scanReact into createScanProject (build/load the ts-morph project) and scanProject (the full analysis). - New IncrementalScanner keeps one project alive; update() refreshes only files whose bytes changed (refreshFromFileSystemSync), adds new / drops deleted files, then re-runs scanProject. Correctness by construction: every node and cross-file edge is re-derived from current ASTs, so an update's graph is byte-identical to a fresh scan — the changed file's dependents are recomputed for free. The win is parsing: unchanged files keep cached ASTs. - Property test: an interconnected app stays byte-identical to a full re-scan across 20 randomized single-file edits, plus add/delete with exact `changed`. - GraphMeta.fileHashes (path -> sha256; schema regenerated) records provenance; projectFileHashes computes it. - CLI: `scan --update` short-circuits when nothing changed (else reports the changed set and full-rescans); `scan --watch` re-emits on debounced changes. Also strips a stray NUL byte that shipped in the 6.3 edgeSortKey join separator (now the intended space) — functionally inert but flagged the file as binary. eval 317/0/0/0, determinism 1.000; parser-react 151 tests, typecheck + lint clean. Gate 6 passes; M6 reached. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ncremental-rescan feat(incremental): incremental re-scan + scan --update/--watch (6.1, D1/G2)
Bump all packages to 0.5.0 and the generator / CLI / MCP version strings. Folds in Phase 6 — lifecycle, scale, and hardening (all merged to development since 0.4.1): - 6.1 incremental re-scan (scan --update / --watch, byte-identical to full) - 6.2 scale benchmark + nightly budget-gated perf CI (< 5 min / < 4 GB) - 6.3 determinism (stable ordering; eval hard-gates two-run byte-identity) - 6.4 version skew & rename tracking (SHA-keyed store; bundle --against) - 6.5 generated/vendored classification + PII policy (docs/security.md, enforced) Gate 6 passed; M6 reached (production-grade: incremental, fast, deterministic, versioned). README changelog updated. Verified: 7 packages build, full unit suite, eval 317/0/0 + determinism 1.000, typecheck + lint clean, npm pack -> ui-lineage-0.5.0.tgz (both bins, scan works, no runtime @coderadar/* leakage). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 0.5.0 — Phase 6 complete (Gate 6 passed · M6 reached)
Bumps all packages + generator/CLI/MCP version strings 0.4.1 → 0.5.0 and folds the whole Phase 6 — lifecycle, scale, and hardening line (merged to
developmentsince 0.4.1) intomain.What's in it
scan --update(byte-identical to a full re-scan, skips work when nothing changed) andscan --watch; per-file hashes inGraphMeta.bundle --against <sha|latest>warns on renamed/moved definitions.docs/security.md, enforced by a test.Verification
npm pack→ui-lineage-0.5.0.tgz(21 files, both bins run,--version0.5.0,scanworks, no runtime@coderadar/*leakage).Publish (
npm publish) is intentionally left to the maintainer (needs npm credentials). After publish, the tester re-validates viaui-lineage-mcp.🤖 Generated with Claude Code