v1.12.0 - TypeScript Integration

v1.12.0 - TypeScript Integration

🎯 Highlights

DX-78: TypeScript Compiler API Integration - Full cross-language reference finding now available for Python and TypeScript projects.

✨ New Features

Multi-Language Symbol Analysis

• TypeScript Compiler API integration via embedded ts-query.js tool

  • No npm installation required - bundled with package
  • Accurate symbol analysis using official TypeScript compiler
  • Support for sig, map, and refs commands

• Python reference finding via jedi library

  • Cross-file reference analysis
  • Symbol position tracking
  • Context-aware lookups

• Unified invar refs command

  invar refs src/auth.ts::login      # TypeScript
  invar refs src/parser.py::parse    # Python

MCP Protocol Enhancement

• New invar_refs MCP tool for AI agents
• Automatic language detection (Python/TypeScript)
• JSON-structured output for agent consumption

🔒 Security Fixes

TypeScript (4 Critical)

1. JSON parsing protection - Malformed input no longer crashes process
2. Null safety - Property access checks prevent TypeErrors
3. I/O error handling - Graceful degradation on file read failures
4. TOCTOU fix - Eliminated race condition in file operations

Python (5 Major)

1. Fixed hardcoded column=0 in TypeScript refs lookup
2. Added @shell_complexity markers to py_refs.py
3. Replaced trivial doctests with meaningful behavior tests
4. Fixed weak test assertions in integration tests
5. Replaced dynamic type creation with proper dataclass

📚 Documentation

• Updated .invar/context.md with DX-78 architecture details
• Enhanced CLAUDE.md with TypeScript review guidelines
• Security model and dependencies documented
• Review checklist for TypeScript vulnerabilities

🧪 Testing

• 32 new integration tests for TypeScript support
• All tests passing (Python + TypeScript)
• Guard verification: 0 errors, 0 warnings

📦 Installation

pip install --upgrade invar-tools

Dependencies:

• Node.js + TypeScript (for TypeScript project support)
• jedi (automatically installed for Python refs)

🔍 Technical Details

Architecture

src/invar/
├── node_tools/
│   └── ts-query.js         # TypeScript Compiler API tool
├── shell/
│   ├── ts_compiler.py      # Python wrapper (subprocess)
│   └── py_refs.py          # Python refs (jedi)
├── mcp/
│   ├── handlers.py         # MCP tool handlers
│   └── server.py           # Protocol registration
└── shell/commands/
    ├── perception.py       # Multi-language routing
    └── guard.py            # CLI entry point

Security Model

• Single-shot subprocess: No persistent Node.js processes
• Path validation: All inputs validated before subprocess execution
• Error isolation: Failures don't crash parent process
• No orphan risk: Process lifecycle strictly managed

📖 Usage Examples

Find all references to a TypeScript symbol

$ invar refs src/auth.ts::validateToken
{
  "file": "src/auth.ts",
  "line": 45,
  "column": 9,
  "references": [
    {"file": "src/middleware.ts", "line": 12, "column": 5, "context": "const valid = validateToken(token);"},
    {"file": "src/routes.ts", "line": 28, "column": 10, "context": "if (validateToken(req.token)) {"}
  ]
}

Find Python symbol references

$ invar refs src/parser.py::parse_source
{
  "file": "src/parser.py",
  "line": 23,
  "column": 4,
  "references": [
    {"file": "src/main.py", "line": 15, "column": 8, "context": "ast = parse_source(code)"}
  ]
}

🔗 Related

• Proposal: DX-78 MCP Protocol Sync
• Review: Adversarial review process (4 rounds, all issues fixed)

🙏 Credits

Reviewed-by: Adversarial Review Process

• 4 rounds of isolated subagent review
• All critical security issues addressed
• Zero test failures

---

Full Changelog: v1.11.0...v1.12.0