Fourth Prerelease - View, Export, Deps, UX
Enhanced the UI lots, and its insights and features (+actions)
✨ Opus 5 Summary
Cycles, read off the files
- a folder loop and a real import cycle are different things, and only one of them runs
- 9 of 12 real cycles across our test repos were invisible to every grouping, hidden inside a single folder
- vscode: 142 rings over 1,096 files, every one of them invisible at top-folder grain
- ghloc-web reported a 5-group "loop at runtime" while having zero file cycles
- the grid crosses out what genuinely runs, amber is now "not isolated" rather than "loop"
Dependencies, licences and CVEs
- every package on disk, not only the ones the manifest names: 185 → 1,513 on example
- licences read from each installed package, grouped by what they ask of the code around them
- advisories from osv.dev against the exact installed version, not the package name
- example's only AGPL package is transitive, so a direct-only check reported zero copyleft
- last release date per named package, so a quiet two years is visible
Tests and repo actions
- test files and cases counted by reading, coverage parsed from a report already on disk
- ▶ buttons run the suite, or synthesise a coverage command per runner when none exists
- git and project scripts run from the interface; servers start, stream and stop like Ctrl+C
- a stop signals the process group and then every descendant, so nothing keeps the port
Getting things out
- every panel as CSV, TSV, JSON, TOML, Markdown or Excel; every drawing as PNG, JPEG, WebP or SVG
- the whole report as a PDF your own browser prints, so the text stays text
- --anon drops every commit address, and the avatars with it, since both come from one
- --out FILE writes where told, so CI never parses a path out of stdout
- published from the repo itself on every push: https://finnmglas.github.io/desprawl/
Fixes worth naming
- desprawl could not see its own src/graph.ts: the bundle detector matched the regex that defines it
- import { type X } counted as a runtime edge, so type-only imports read as real ones
- a partial clone made --numstat refetch the history over the network, forever
- the test suite left a temp repo per call: 18,772 of them, and /tmp out of inodes