codetrellis 0.0.0-stage → 0.2.0

package/src/backend/services/callsites/ruby.js

@@ -0,0 +1,164 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ruby_exports = {};
+__export(ruby_exports, {
+  rubyCallsites: () => rubyCallsites
+});
+module.exports = __toCommonJS(ruby_exports);
+var import_shared = require("./shared");
+const RESOURCE_ACTIONS = [
+  { action: "index", verb: "GET", member: false },
+  { action: "create", verb: "POST", member: false },
+  { action: "show", verb: "GET", member: true },
+  { action: "update", verb: "PATCH", member: true },
+  { action: "update", verb: "PUT", member: true },
+  { action: "destroy", verb: "DELETE", member: true }
+];
+const NAMESPACE_RE = /^\s*namespace\s+[:'"]([\w-]+)['"]?\s+do\b/;
+const SCOPE_RE = /^\s*scope\s+(?:path:\s*)?['"]([^'"]*)['"].*\bdo\b/;
+const RESOURCES_RE = /^\s*(resources?)\s+:([\w-]+)(.*)$/;
+const ONLY_RE = /\bonly:\s*(?:\[([^\]]*)\]|%i\[([^\]]*)\]|:(\w+))/;
+const EXCEPT_RE = /\bexcept:\s*(?:\[([^\]]*)\]|%i\[([^\]]*)\]|:(\w+))/;
+const VERB_ROUTE_RE = /^\s*(get|post|put|patch|delete|head|options)\s+['"]([^'"]*)['"]/;
+function isSpecFile(filePath) {
+  const p = filePath.replace(/\\/g, "/");
+  return /(^|\/)(spec|test)\//.test(p) || /_(spec|test)\.rb$/.test(p);
+}
+const ROOT_RE = /^\s*root\b/;
+const MEMBER_BLOCK_RE = /^\s*(member|collection)\s+do\b/;
+const NET_HTTP_RE = /Net::HTTP\s*\.\s*(get|post|put|patch|delete|head)\w*\s*\(\s*URI(?:\.parse)?\s*\(\s*['"]([^'"]*)['"]/g;
+const CLIENT_RE = /\b(HTTParty|RestClient|Faraday|[a-z_]\w*)\s*\.\s*(get|post|put|patch|delete|head|options)\s*\(?\s*['"]([^'"]*)['"]/g;
+const rubyCallsites = {
+  language: "ruby",
+  extract(content, filePath) {
+    const routes = isSpecFile(filePath) ? [] : extractRoutes(content, filePath);
+    return [...routes, ...extractOutbound(content)];
+  }
+};
+function blockDelta(line) {
+  const code = stripRubyComment(line);
+  let delta = 0;
+  if (/\bdo\b\s*(\|[^|]*\|)?\s*$/.test(code)) delta++;
+  if (/^\s*end\b/.test(code)) delta--;
+  return delta;
+}
+function stripRubyComment(line) {
+  const idx = line.indexOf("#");
+  if (idx === -1) return line;
+  const before = line.slice(0, idx);
+  const doubles = (before.match(/"/g) || []).length;
+  const singles = (before.match(/'/g) || []).length;
+  if (line[idx + 1] === "{") return line;
+  return doubles % 2 === 0 && singles % 2 === 0 ? before : line;
+}
+function actionFilter(re, tail) {
+  const m = re.exec(tail);
+  if (!m) return null;
+  const body = m[1] ?? m[2] ?? m[3] ?? "";
+  const names = body.split(/[,\s]+/).map((s) => s.replace(/^:/, "").trim()).filter(Boolean);
+  return names.length > 0 ? new Set(names) : null;
+}
+function extractRoutes(content, filePath) {
+  const lines = content.split("\n");
+  const out = [];
+  const blockStack = [];
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    const line = stripRubyComment(raw);
+    const lineNo = i + 1;
+    while (blockStack.length > 0 && depth < blockStack[blockStack.length - 1].depth) {
+      blockStack.pop();
+    }
+    const top = blockStack.length > 0 ? blockStack[blockStack.length - 1] : null;
+    const prefix = top ? top.prefix : "";
+    const depthBefore = depth;
+    depth += blockDelta(line);
+    const ns = NAMESPACE_RE.exec(line);
+    if (ns) {
+      const nsPath = (0, import_shared.joinPath)(prefix, "/" + ns[1]);
+      blockStack.push({ depth: depthBefore + 1, prefix: nsPath, collection: nsPath });
+      continue;
+    }
+    const scope = SCOPE_RE.exec(line);
+    if (scope) {
+      const scopePath = (0, import_shared.joinPath)(prefix, scope[1]);
+      blockStack.push({ depth: depthBefore + 1, prefix: scopePath, collection: scopePath });
+      continue;
+    }
+    const memberBlock = MEMBER_BLOCK_RE.exec(line);
+    if (memberBlock) {
+      const inner = memberBlock[1] === "member" ? prefix : top?.collection ?? prefix;
+      blockStack.push({ depth: depthBefore + 1, prefix: inner, collection: inner });
+      continue;
+    }
+    const resources = RESOURCES_RE.exec(line);
+    if (resources) {
+      const [, keyword, name, tail] = resources;
+      const plural = keyword === "resources";
+      const base = (0, import_shared.joinPath)(prefix, "/" + name);
+      const only = actionFilter(ONLY_RE, tail);
+      const except = actionFilter(EXCEPT_RE, tail);
+      for (const { action, verb, member } of RESOURCE_ACTIONS) {
+        if (!plural && action === "index") continue;
+        if (only && !only.has(action)) continue;
+        if (except && except.has(action)) continue;
+        const path = member && plural ? `${base}/:id` : base;
+        out.push((0, import_shared.route)(lineNo, verb, path, `${keyword} :${name} (${action})`));
+      }
+      if (/\bdo\b\s*$/.test(line)) {
+        const nested = plural ? `${base}/:id` : base;
+        blockStack.push({ depth: depthBefore + 1, prefix: nested, collection: base });
+      }
+      continue;
+    }
+    const verbRoute = VERB_ROUTE_RE.exec(line);
+    if (verbRoute) {
+      const [, verb, path] = verbRoute;
+      out.push((0, import_shared.route)(lineNo, verb, (0, import_shared.joinPath)(prefix, path), `${verb} '${path}'`));
+      continue;
+    }
+    if (ROOT_RE.test(line) && /\bto:|=>/.test(line)) {
+      out.push((0, import_shared.route)(lineNo, "GET", (0, import_shared.joinPath)(prefix, "/") || "/", "root"));
+    }
+  }
+  void filePath;
+  return out;
+}
+function extractOutbound(content) {
+  const out = [];
+  let m;
+  NET_HTTP_RE.lastIndex = 0;
+  while (m = NET_HTTP_RE.exec(content)) {
+    const [, verb, url] = m;
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    out.push((0, import_shared.call)((0, import_shared.lineOf)(content, m.index), verb, url, `Net::HTTP.${verb}`));
+  }
+  CLIENT_RE.lastIndex = 0;
+  while (m = CLIENT_RE.exec(content)) {
+    const [, recv, verb, url] = m;
+    if ((0, import_shared.isNonClientReceiver)(recv)) continue;
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    out.push((0, import_shared.call)((0, import_shared.lineOf)(content, m.index), verb, url, `${recv}.${verb}`));
+  }
+  return out;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  rubyCallsites
+});

package/src/backend/services/callsites/shared.js

@@ -0,0 +1,198 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var shared_exports = {};
+__export(shared_exports, {
+  HTTP_VERBS: () => HTTP_VERBS,
+  VERB_SET: () => VERB_SET,
+  call: () => call,
+  countBraces: () => countBraces,
+  hostField: () => hostField,
+  hostOf: () => hostOf,
+  isLikelyApiPath: () => isLikelyApiPath,
+  isNonClientReceiver: () => isNonClientReceiver,
+  joinPath: () => joinPath,
+  lineOf: () => lineOf,
+  normalizeRoute: () => normalizeRoute,
+  normalizeUrl: () => normalizeUrl,
+  route: () => route,
+  stripLineComment: () => stripLineComment,
+  unwindBlocks: () => unwindBlocks
+});
+module.exports = __toCommonJS(shared_exports);
+const HTTP_VERBS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+const VERB_SET = new Set(HTTP_VERBS);
+function lineOf(content, charIndex) {
+  let line = 1;
+  for (let i = 0; i < charIndex && i < content.length; i++) {
+    if (content.charCodeAt(i) === 10) line++;
+  }
+  return line;
+}
+function joinPath(prefix, literal) {
+  if (!prefix) return literal;
+  if (!literal || literal === "/") return prefix;
+  const left = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
+  const right = literal.startsWith("/") ? literal : "/" + literal;
+  return left + right;
+}
+function normalizeRoute(url) {
+  let p = url;
+  p = p.replace(/\$\{[^}]*\}/g, ":id");
+  p = p.replace(/<[^>]*>/g, ":id");
+  p = p.replace(/\{[^}]*\}/g, ":id");
+  p = p.replace(/:[A-Za-z_]\w*/g, ":id");
+  p = p.replace(/\/?\*+$/, "");
+  if (p.length > 1 && p.endsWith("/")) p = p.slice(0, -1);
+  if (!p) return "/";
+  return p.startsWith("/") ? p : "/" + p;
+}
+function hostOf(url) {
+  const m = /^https?:\/\/([^/:?#@]+)/i.exec(url.trim());
+  return m ? m[1].toLowerCase() : void 0;
+}
+function hostField(url) {
+  const host = hostOf(url);
+  return host ? { host } : {};
+}
+function normalizeUrl(url) {
+  let p = url.replace(/^https?:\/\/[^/]+/, "");
+  p = p.replace(/^(?:%[sv]|\\\([^)]*\)|#\{[^}]*\}|\$\{[^}]*\})/, "");
+  const q = p.indexOf("?");
+  if (q >= 0) p = p.slice(0, q);
+  p = p.replace(/%[sdv]/g, ":id");
+  p = p.replace(/\\\([^)]*\)/g, ":id");
+  p = p.replace(/#\{[^}]*\}/g, ":id");
+  p = normalizeRoute(p);
+  if (p.length > 1 && p.endsWith("/")) p = p.slice(0, -1);
+  return p;
+}
+function isLikelyApiPath(s) {
+  if (!s) return false;
+  if (s.startsWith("/")) return true;
+  if (/^https?:\/\//.test(s)) {
+    const afterHost = s.replace(/^https?:\/\/[^/]+/, "");
+    return afterHost !== "" && afterHost !== "/";
+  }
+  if (/^(?:%[sv]|\\\([^)]*\)|#\{[^}]*\}|\$\{[^}]*\})\//.test(s)) return true;
+  return false;
+}
+const NON_CLIENT_RECEIVERS = /* @__PURE__ */ new Set([
+  // Containers and config, in every language.
+  "params",
+  "options",
+  "opts",
+  "config",
+  "configuration",
+  "settings",
+  "props",
+  "properties",
+  "preferences",
+  "prefs",
+  "headers",
+  "env",
+  "session",
+  "cookies",
+  "cache",
+  "store",
+  "storage",
+  "hash",
+  "map",
+  "dict",
+  "data",
+  "payload",
+  "attributes",
+  "attrs",
+  "json",
+  "body",
+  "registry",
+  "context",
+  "bundle",
+  // JVM test DSLs that spell an assertion like a call.
+  "mockmvc",
+  "mvc",
+  "mockserver",
+  "stubfor"
+]);
+function isNonClientReceiver(recv) {
+  return NON_CLIENT_RECEIVERS.has(recv.toLowerCase());
+}
+function stripLineComment(line, marker) {
+  const idx = line.indexOf(marker);
+  if (idx === -1) return line;
+  const before = line.slice(0, idx);
+  const doubles = (before.match(/"/g) || []).length;
+  const singles = (before.match(/'/g) || []).length;
+  return doubles % 2 === 0 && singles % 2 === 0 ? before : line;
+}
+function countBraces(line) {
+  let delta = 0;
+  let inString = null;
+  let prev = "";
+  for (const ch of line) {
+    if ((ch === '"' || ch === "'") && prev !== "\\") {
+      if (inString === ch) inString = null;
+      else if (inString === null) inString = ch;
+    } else if (!inString && ch === "{") delta++;
+    else if (!inString && ch === "}") delta--;
+    prev = ch;
+  }
+  return delta;
+}
+function unwindBlocks(stack, depth) {
+  while (stack.length > 0 && depth < stack[stack.length - 1].depth) stack.pop();
+  return stack.length > 0 ? stack[stack.length - 1].prefix : "";
+}
+function route(line, method, pattern, context) {
+  return {
+    kind: "http_route",
+    protocol: "http",
+    line,
+    method: method.toUpperCase(),
+    urlPattern: normalizeRoute(pattern),
+    context
+  };
+}
+function call(line, method, url, context) {
+  return {
+    kind: "http_call",
+    protocol: "http",
+    line,
+    method: method.toUpperCase(),
+    urlPattern: normalizeUrl(url),
+    ...hostField(url),
+    context
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HTTP_VERBS,
+  VERB_SET,
+  call,
+  countBraces,
+  hostField,
+  hostOf,
+  isLikelyApiPath,
+  isNonClientReceiver,
+  joinPath,
+  lineOf,
+  normalizeRoute,
+  normalizeUrl,
+  route,
+  stripLineComment,
+  unwindBlocks
+});

package/src/backend/services/callsites/swift.js

@@ -0,0 +1,115 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var swift_exports = {};
+__export(swift_exports, {
+  swiftCallsites: () => swiftCallsites
+});
+module.exports = __toCommonJS(swift_exports);
+var import_shared = require("./shared");
+const HTTP_METHOD_WINDOW = 6;
+const URL_STRING_RE = /URL\s*\(\s*string\s*:\s*"([^"]*)"/g;
+const HTTP_METHOD_RE = /httpMethod\s*=\s*"([A-Za-z]+)"/;
+const ALAMOFIRE_RE = /\brequest\s*\(\s*"([^"]*)"(?:\s*,\s*method\s*:\s*\.\s*(\w+))?/g;
+const VAPOR_VERB_RE = /(\w+)\s*\.\s*(get|post|put|patch|delete|head|options)\s*\(\s*((?:"[^"]*"\s*,?\s*)+)\)\s*\{/g;
+const VAPOR_GROUP_RE = /(?:let|var)\s+(\w+)\s*=\s*(\w+)\s*\.\s*grouped\s*\(\s*((?:"[^"]*"\s*,?\s*)+)\)/;
+const VAPOR_GROUP_BLOCK_RE = /(\w+)\s*\.\s*group\s*\(\s*((?:"[^"]*"\s*,?\s*)+)\)\s*\{/;
+const swiftCallsites = {
+  language: "swift",
+  extract(content, _filePath) {
+    return [...extractRoutes(content), ...extractOutbound(content)];
+  }
+};
+function componentsToPath(argList) {
+  const parts = [...argList.matchAll(/"([^"]*)"/g)].map((m) => m[1]).filter(Boolean);
+  if (parts.length === 0) return "";
+  return "/" + parts.join("/");
+}
+function extractRoutes(content) {
+  const lines = content.split("\n").map((l) => (0, import_shared.stripLineComment)(l, "//"));
+  const out = [];
+  const groupPrefix = /* @__PURE__ */ new Map();
+  for (let sweep = 0; sweep < 2; sweep++) {
+    for (const line of lines) {
+      const m = VAPOR_GROUP_RE.exec(line);
+      if (!m) continue;
+      const [, name, parent, args] = m;
+      groupPrefix.set(name, (0, import_shared.joinPath)(groupPrefix.get(parent) ?? "", componentsToPath(args)));
+    }
+  }
+  const blockStack = [];
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    const depthBefore = depth;
+    depth += (0, import_shared.countBraces)(line);
+    const blockPrefix = (0, import_shared.unwindBlocks)(blockStack, depthBefore);
+    const groupBlock = VAPOR_GROUP_BLOCK_RE.exec(line);
+    if (groupBlock) {
+      const [, recv, args] = groupBlock;
+      const base = groupPrefix.get(recv) ?? blockPrefix;
+      blockStack.push({ depth: depthBefore + 1, prefix: (0, import_shared.joinPath)(base, componentsToPath(args)) });
+    }
+    VAPOR_VERB_RE.lastIndex = 0;
+    let m;
+    while (m = VAPOR_VERB_RE.exec(line)) {
+      const [, recv, verb, args] = m;
+      const prefix = groupPrefix.get(recv) ?? blockPrefix;
+      out.push((0, import_shared.route)(lineNo, verb, (0, import_shared.joinPath)(prefix, componentsToPath(args)), `${recv}.${verb}`));
+    }
+  }
+  return out;
+}
+function extractOutbound(content) {
+  const lines = content.split("\n");
+  const out = [];
+  let m;
+  const urls = [];
+  URL_STRING_RE.lastIndex = 0;
+  while (m = URL_STRING_RE.exec(content)) {
+    urls.push({ url: m[1], lineNo: (0, import_shared.lineOf)(content, m.index) });
+  }
+  for (let i = 0; i < urls.length; i++) {
+    const { url, lineNo } = urls[i];
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    const nextUrlLine = urls[i + 1]?.lineNo ?? Infinity;
+    out.push((0, import_shared.call)(lineNo, verbNear(lines, lineNo, nextUrlLine), url, "URL(string:)"));
+  }
+  ALAMOFIRE_RE.lastIndex = 0;
+  while (m = ALAMOFIRE_RE.exec(content)) {
+    const [, url, verb] = m;
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    const method = verb && import_shared.VERB_SET.has(verb.toUpperCase()) ? verb.toUpperCase() : "GET";
+    out.push((0, import_shared.call)((0, import_shared.lineOf)(content, m.index), method, url, "AF.request"));
+  }
+  return out;
+}
+function verbNear(lines, lineNo, nextUrlLine) {
+  const end = Math.min(lines.length, lineNo + HTTP_METHOD_WINDOW, nextUrlLine - 1);
+  for (let i = lineNo - 1; i < end; i++) {
+    const m = HTTP_METHOD_RE.exec(lines[i]);
+    if (!m) continue;
+    const verb = m[1].toUpperCase();
+    if (import_shared.VERB_SET.has(verb)) return verb;
+  }
+  return "GET";
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  swiftCallsites
+});

package/src/backend/services/callsites/typescript.js

@@ -0,0 +1,87 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var typescript_exports = {};
+__export(typescript_exports, {
+  javascriptCallsites: () => javascriptCallsites,
+  typescriptCallsites: () => typescriptCallsites
+});
+module.exports = __toCommonJS(typescript_exports);
+var import_shared = require("./shared");
+const FETCH_RE = /\bfetch\s*\(\s*([`'"])([^`'"]+?)\1(?:\s*,\s*\{([\s\S]*?)\})?/g;
+const AXIOS_RE = /\baxios\s*\.\s*(get|post|put|patch|delete|head|options)\s*\(\s*([`'"])([^`'"]+?)\2/gi;
+const METHOD_HINT_RE = /method\s*:\s*['"`](\w+)['"`]/i;
+const typescriptCallsites = {
+  language: "typescript",
+  extract(content, _filePath) {
+    return extractAll(content);
+  }
+};
+const javascriptCallsites = {
+  language: "javascript",
+  extract(content, _filePath) {
+    return extractAll(content);
+  }
+};
+function extractAll(content) {
+  const callsites = [];
+  for (const cs of iterateFetch(content)) callsites.push(cs);
+  for (const cs of iterateAxios(content)) callsites.push(cs);
+  return callsites;
+}
+function* iterateFetch(content) {
+  FETCH_RE.lastIndex = 0;
+  let match;
+  while (match = FETCH_RE.exec(content)) {
+    const url = match[2];
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    const optsBody = match[3] ?? "";
+    const methodMatch = METHOD_HINT_RE.exec(optsBody);
+    yield {
+      kind: "http_call",
+      protocol: "http",
+      line: (0, import_shared.lineOf)(content, match.index),
+      method: (methodMatch?.[1] || "GET").toUpperCase(),
+      urlPattern: (0, import_shared.normalizeUrl)(url),
+      ...(0, import_shared.hostField)(url),
+      context: "fetch"
+    };
+  }
+}
+function* iterateAxios(content) {
+  AXIOS_RE.lastIndex = 0;
+  let match;
+  while (match = AXIOS_RE.exec(content)) {
+    const verb = match[1].toUpperCase();
+    const url = match[3];
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    yield {
+      kind: "http_call",
+      protocol: "http",
+      line: (0, import_shared.lineOf)(content, match.index),
+      method: verb,
+      urlPattern: (0, import_shared.normalizeUrl)(url),
+      ...(0, import_shared.hostField)(url),
+      context: `axios.${verb.toLowerCase()}`
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  javascriptCallsites,
+  typescriptCallsites
+});

package/src/backend/services/capability-token.js

@@ -0,0 +1,108 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var capability_token_exports = {};
+__export(capability_token_exports, {
+  TOKEN_ENV_VAR: () => TOKEN_ENV_VAR,
+  TOKEN_HEADER: () => TOKEN_HEADER,
+  TOKEN_QUERY_PARAM: () => TOKEN_QUERY_PARAM,
+  extractToken: () => extractToken,
+  getCapabilityToken: () => getCapabilityToken,
+  getTokenFilePath: () => getTokenFilePath,
+  initCapabilityToken: () => initCapabilityToken,
+  verifyCapabilityToken: () => verifyCapabilityToken
+});
+module.exports = __toCommonJS(capability_token_exports);
+var fs = __toESM(require("node:fs"));
+var path = __toESM(require("node:path"));
+var crypto = __toESM(require("node:crypto"));
+var import_persistence = require("./persistence");
+var import_files = require("../mcp/connector/files");
+const TOKEN_HEADER = "x-codetrellis-token";
+const TOKEN_QUERY_PARAM = "ct_token";
+const TOKEN_ENV_VAR = "CODETRELLIS_CAPABILITY_TOKEN";
+let token = null;
+function getTokenFilePath() {
+  return path.join((0, import_persistence.getDataDir)(), import_files.TOKEN_FILE);
+}
+function initCapabilityToken() {
+  if (token) return token;
+  const fromEnv = process.env[TOKEN_ENV_VAR];
+  if (fromEnv && fromEnv.trim().length >= 16) {
+    token = fromEnv.trim();
+  } else {
+    token = crypto.randomBytes(32).toString("hex");
+  }
+  try {
+    (0, import_persistence.ensureDataDir)();
+    const file = getTokenFilePath();
+    fs.writeFileSync(file, token, { encoding: "utf-8", mode: 384 });
+    fs.chmodSync(file, 384);
+  } catch (err) {
+    console.warn("[Auth] Could not write the capability token file:", err);
+  }
+  return token;
+}
+function getCapabilityToken() {
+  return token ?? initCapabilityToken();
+}
+function verifyCapabilityToken(candidate) {
+  if (typeof candidate !== "string" || candidate.length === 0) return false;
+  const expected = getCapabilityToken();
+  const a = Buffer.from(candidate, "utf-8");
+  const b = Buffer.from(expected, "utf-8");
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+function extractToken(headers, url) {
+  const raw = headers[TOKEN_HEADER];
+  const direct = Array.isArray(raw) ? raw[0] : raw;
+  if (direct) return direct;
+  const authRaw = headers["authorization"];
+  const auth = Array.isArray(authRaw) ? authRaw[0] : authRaw;
+  if (auth && /^Bearer\s+/i.test(auth)) return auth.replace(/^Bearer\s+/i, "").trim();
+  if (url) {
+    try {
+      const parsed = new URL(url, "http://127.0.0.1");
+      const q = parsed.searchParams.get(TOKEN_QUERY_PARAM);
+      if (q) return q;
+    } catch {
+    }
+  }
+  return null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TOKEN_ENV_VAR,
+  TOKEN_HEADER,
+  TOKEN_QUERY_PARAM,
+  extractToken,
+  getCapabilityToken,
+  getTokenFilePath,
+  initCapabilityToken,
+  verifyCapabilityToken
+});