MOO-86: move ownership/blame and file-preview-fallback server-side

.github/workflows/codeql.yml

@@ -3,8 +3,9 @@ name: CodeQL
 on:
   push:
     branches: ["main"]
+  # MOO-71: no base filter, matching test.yml -- a stacked PR should get the
+  # same security analysis as one targeting main, not none.
   pull_request:
-    branches: ["main"]
 
 jobs:
   analyze:

.github/workflows/test.yml

@@ -0,0 +1,66 @@
+name: Test
+
+on:
+  push:
+    branches: ["main"]
+  # MOO-71: no base filter. This previously only ran for PRs targeting `main`,
+  # so a stacked PR (one opened against another in-review branch, which is how
+  # this project sequences dependent commits -- see MOO-71 Stage 1 and Stage 4)
+  # reported no checks at all and had to be verified by hand. Running on every
+  # pull request costs nothing here and means a stacked PR is verified before
+  # it is rebased onto main rather than after.
+  pull_request:
+
+jobs:
+  test:
+    name: Build and test
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.23.1"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install pyan3
+        run: pip install pyan3==2.6.2
+
+      - name: Production build
+        run: npm run build
+
+      - name: Run test suite
+        run: node --test tests/*.test.mjs
+
+      # MOO-72 Commit 7: structural end-to-end smoke tests, run against the
+      # real built app + real server process + real (public-repo-read-only)
+      # GitHub API calls -- "a clean environment can execute the full
+      # pipeline" is satisfied by these running here, on a fresh Actions
+      # runner, not just asserted locally. Uses the Actions-provided
+      # automatic token (no new secret to configure) -- sufficient for the
+      # public-repo reads both scripts make, including on a pull_request
+      # run from a fork. Deliberately does NOT run function-layer-smoke.mjs
+      # here -- that one is Playwright/browser-driven, needs a real GitHub
+      # PAT (not just API-read access) and the server's own AUTH_TOKEN via
+      # a separate-terminal flow, and belongs to MOO-71's visual-smoke path,
+      # not this structural-smoke commit.
+      - name: Run server smoke test
+        run: node tests/server-smoke.mjs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run e2e construction smoke test
+        run: node tests/e2e-construction-smoke.mjs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -5,6 +5,8 @@ build/
 .next/
 target/
 __pycache__/
+.venv-pyan3/
+.vendor/
 
 # Temp, coverage, and cache files
 *.log
@@ -36,3 +38,10 @@ Thumbs.db
 *_old.*
 *_copy.*
 *.swp
+
+# Regenerated on every tests/function-layer-smoke.mjs run (MOO-71 Commit 8)
+docs/img/smoke-*.png
+
+# Regenerated by scripts/generate-build-info.mjs on every `npm run build` --
+# a build artifact, not source (MOO-72 Commit 8)
+/build-info.json

.npmrc

@@ -0,0 +1 @@
+engine-strict=true

README.md

@@ -124,13 +124,25 @@ Just visit [CodeFlow](https://codeflow-five.vercel.app/) and paste any GitHub UR
 ### Option 2: Self-Host
 ```bash
 # Clone the repo
-git clone https://github.com/braedonsaunders/codeflow.git
+git clone https://github.com/OwenTanzer/codeflow.git
+cd codeflow
 
-# That's it! Just open index.html in your browser
-open index.html
+# Install dev tooling and start a local server
+npm install
+npm run dev
 ```
 
-No build process. No npm install. It is a single `index.html` app that loads pinned browser dependencies from CDNs.
+Then open the URL Vite prints (defaults to `http://localhost:5173`).
+
+Opening `index.html` directly from disk (`file://`, no server) is **not
+supported** — the app's analyzer code is loaded as an ES module
+(`src/analyzer.js`), and browsers block ES module imports under the
+`file://` origin's CORS restrictions. This was an intentional tradeoff made
+while modularizing the codebase for a future server-hosted deployment with
+server-held credentials (see `docs/baseline.md`); a zero-install, double-click
+local file was judged not worth preserving against that direction. A local
+HTTP server is required either way — `npm run dev` for development, or
+`npm run build && npm start` to run the production build locally.
 
 ### Option 3: Analyze Local Files
 You can now analyze code directly from your local machine without uploading to GitHub:
@@ -308,15 +320,17 @@ For larger repositories or team usage, we recommend using GitHub App authenticat
 │                       │                         │
 │              ┌────────▼────────┐                │
 │              │   React App     │                │
-│              │  (Single File)  │                │
 │              └─────────────────┘                │
 └─────────────────────────────────────────────────┘
 ```
 
-**Zero build dependencies to install.** Everything runs from pinned CDNs:
-- React 18
-- D3.js 7
-- Babel (for JSX)
+The analyzer (`Parser`, `buildAnalysisData`, the `GitHub` API client, and
+related logic) lives in `src/analyzer.js`, imported as an ES module by both
+`index.html` and the Node-side tooling (`card/`, tests) — one implementation,
+not a duplicated copy. React, D3, and Babel still load from pinned CDNs at
+runtime; `npm install` only brings in local dev tooling (Vite for
+building/serving, Playwright for headless browser verification), not
+application dependencies.
 
 ---
 
@@ -325,16 +339,18 @@ For larger repositories or team usage, we recommend using GitHub App authenticat
 We love contributions! Here's how:
 
 1. Fork the repo
-2. Make your changes to `index.html`
-3. Test locally (just open in browser)
+2. Make your changes to `index.html` (app shell/UI) or `src/analyzer.js` (analyzer logic)
+3. Test locally: `npm install && npm run dev`, then open the printed URL
 4. Submit a PR
 
-If you're editing the markdown / wiki-link parser, Node.js unit tests live under `tests/` and run with no dependencies:
+Node.js unit tests live under `tests/` — run them with:
 
 ```bash
-node --test tests/
+node --test tests/*.test.mjs
 ```
 
+(`node --test tests/` without the glob won't discover this repo's flat `tests/*.test.mjs` layout.)
+
 `tests/verify-brain-vault.mjs` is an optional end-to-end script that always verifies the bundled fixtures and will also scan a real local vault when you explicitly set `BRAIN_VAULT=/path/to/vault`.
 
 ### Ideas for Contributions
@@ -352,7 +368,7 @@ node --test tests/
 > CodeFlow runs entirely in your browser. It calls the GitHub API directly from your browser and processes everything client-side.
 
 **Q: Is my code safe?**
-> Yes. Your code is fetched directly from GitHub to your browser. Nothing is sent to any server we control. Check the source — it's one file!
+> Yes. Your code is fetched directly from GitHub to your browser. Nothing is sent to any server we control. The source is open — check it yourself.
 
 **Q: Can I use it offline?**
 > Yes. With the local file analysis feature, you can analyze code from your computer without any internet connection. Click the "Open Folder" button and select your files. All processing happens entirely in your browser.

card/.npmrc

@@ -0,0 +1 @@
+engine-strict=true

card/lib/analyzer.js

@@ -1,67 +1,37 @@
-// Extract the codeflow analyzer block from index.html and run it in a Node vm
-// context. Mirrors what tests/codeflow-golden.test.mjs does — the analyzer is
-// the single source of truth, lives in one file, never drifts.
+// Load the codeflow analyzer module. src/analyzer.js is the single source of
+// truth (see docs/baseline.md) — this used to VM-extract a marker-delimited
+// block from index.html's inline script; since MOO-67 Commit 3 the analyzer
+// is a real ES module and Node 22.12+'s synchronous `require(esm)` support
+// loads it directly, same as tests/*.test.mjs do via `import`.
 
 'use strict';
 
 const fs = require('fs');
 const path = require('path');
-const vm = require('vm');
-
-const START_MARKER = '// ===== CODEFLOW_ANALYZER_START =====';
-const END_MARKER = '// ===== CODEFLOW_ANALYZER_END =====';
-const METRICS_START = '// ===== CODEFLOW_METRICS_START =====';
-const METRICS_END = '// ===== CODEFLOW_METRICS_END =====';
-
-function sliceBlock(html, startMarker, endMarker, label) {
-  const start = html.indexOf(startMarker);
-  const end = html.indexOf(endMarker, start);
-  if (start < 0 || end < 0) {
-    throw new Error(
-      'Could not locate ' + label + ' block. Expected ' + startMarker + ' / ' + endMarker + '.'
-    );
-  }
-  return html.slice(start, end);
-}
 
 function loadAnalyzer(htmlPath) {
-  const html = fs.readFileSync(htmlPath, 'utf8');
-  const analyzerSource = sliceBlock(html, START_MARKER, END_MARKER, 'analyzer');
-  const metricsSource = sliceBlock(html, METRICS_START, METRICS_END, 'metrics');
-
-  const context = {
-    console,
-    TreeSitter: undefined,
-    Babel: undefined,
-    acorn: undefined,
-    getSecurityScanContent(file) {
-      return file && file.content ? file.content : '';
-    },
-    isSanitizedPreviewRenderer() {
-      return false;
-    },
-  };
-  vm.createContext(context, {
-    codeGeneration: {
-      strings: false,
-      wasm: false,
-    },
-  });
-  const exposeExports =
-    '\nthis.Parser = Parser;' +
-    '\nthis.buildAnalysisData = buildAnalysisData;' +
-    '\nthis.calcBlast = calcBlast;' +
-    '\nthis.calcHealth = calcHealth;';
-  const script = new vm.Script(analyzerSource + '\n' + metricsSource + exposeExports, {
-    filename: 'codeflow-analyzer.js',
-  });
-  script.runInContext(context, { timeout: 1000 });
+  // htmlPath is index.html's location (see locateIndexHtml below); the
+  // analyzer module is always its sibling src/analyzer.js — resolving
+  // relative to htmlPath (not the consuming repo) preserves the security
+  // property tests/card-analyzer-security.test.mjs guards: the action
+  // always loads its own analyzer, never one from the repo being analyzed.
+  const analyzerPath = path.resolve(path.dirname(htmlPath), 'src', 'analyzer.js');
+
+  // Parser's methods reference these as ambient globals when actually
+  // invoked (not at module-evaluation time) — stub them to `undefined` so a
+  // reference doesn't throw, mirroring the browser's real CDN-provided
+  // globals and tests/*.test.mjs's equivalent setup.
+  if (!('TreeSitter' in globalThis)) globalThis.TreeSitter = undefined;
+  if (!('Babel' in globalThis)) globalThis.Babel = undefined;
+  if (!('acorn' in globalThis)) globalThis.acorn = undefined;
+
+  const analyzerModule = require(analyzerPath);
 
   return {
-    Parser: context.Parser,
-    buildAnalysisData: context.buildAnalysisData,
-    calcBlast: context.calcBlast,
-    calcHealth: context.calcHealth,
+    Parser: analyzerModule.Parser,
+    buildAnalysisData: analyzerModule.buildAnalysisData,
+    calcBlast: analyzerModule.calcBlast,
+    calcHealth: analyzerModule.calcHealth,
   };
 }
 
@@ -74,4 +44,4 @@ function locateIndexHtml(actionDir) {
   );
 }
 
-module.exports = { loadAnalyzer, locateIndexHtml, START_MARKER, END_MARKER };
+module.exports = { loadAnalyzer, locateIndexHtml };

card/lib/collect.js

@@ -93,6 +93,14 @@ async function buildAnalyzed(repoRoot, Parser, excludePatterns) {
       layer,
       churn: 0,
       isCode: actualIsCode,
+      // MOO-72 Commit 1A review (round 2): carry forward the real parser
+      // path Parser.extract actually took (set only for the JS/TS/acorn
+      // branch, where success/failure is a runtime decision, not a static
+      // file-extension fact) -- leaves buildAnalysisData's later
+      // `f.parserProvenance||Parser.getParserProvenance(...)` fallback as
+      // a genuine best-effort guess only for files where nothing upstream
+      // observed what actually ran.
+      parserProvenance: functions.provenance,
     });
     if (actualIsCode) {
       for (const fn of functions) {

card/package.json

@@ -6,7 +6,7 @@
   "main": "index.js",
   "type": "commonjs",
   "engines": {
-    "node": ">=20"
+    "node": "^20.19.0 || >=22.12.0"
   },
   "scripts": {
     "dry-run": "node index.js"

codevisualizer-core.lock.json

@@ -0,0 +1,5 @@
+{
+  "repository": "https://github.com/OwenTanzer/CodeVisualizer.git",
+  "commit": "974d907a5490aa96fb8e84b6723d15bc5455c658",
+  "workspacePackage": "packages/core"
+}