kodingo-cli 1.3.1 → 1.3.3

package/dist/__tests__/csharpParser.test.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * Real tests for C#/.NET support in tree-sitter-parser.ts / ast-parser.ts —
+ * build brief "Add real C#/.NET support to the CLI's parser" (2026-09-20).
+ *
+ * The real bar per the brief: not just "C# symbols get extracted", but
+ * genuine, stable deduplication — the same, unchanged function produces a
+ * byte-for-byte identical fingerprint across repeated runs, and a genuinely
+ * changed function's fingerprint correctly changes.
+ *
+ * Uses Node's built-in test runner (node:test) — this repo has no existing
+ * test framework to inherit (confirmed: package.json's own "test" script
+ * was a stub), and node:test needs zero new dependencies. Compiled and run
+ * via `npm test` (tsc then `node --test dist/__tests__`).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const tree_sitter_parser_1 = require("../utils/tree-sitter-parser");
+const ast_parser_1 = require("../utils/ast-parser");
+const REAL_CSHARP_SOURCE = `
+using System;
+using System.Threading.Tasks;
+
+namespace Acme.Orders
+{
+    public class OrderService : IOrderService
+    {
+        private readonly IRepository _repo;
+
+        public OrderService(IRepository repo)
+        {
+            _repo = repo;
+        }
+
+        public async Task<Order> GetOrderAsync(int id)
+        {
+            var order = await _repo.FindAsync(id);
+            LogAccess(id);
+            return order;
+        }
+
+        private void LogAccess(int id)
+        {
+            Console.WriteLine($"Accessed order {id}");
+        }
+
+        public static int Add(int a, int b)
+        {
+            if (a > 0)
+            {
+                return a + b;
+            }
+            return b;
+        }
+    }
+
+    public interface IOrderService
+    {
+        Task<Order> GetOrderAsync(int id);
+    }
+
+    public struct Point
+    {
+        public int Sum(int x, int y) => x + y;
+    }
+
+    public record OrderDto(int Id, string Name)
+    {
+        public string Describe() => $"{Id}: {Name}";
+    }
+
+    public class Order { }
+}
+`;
+// A real, structural change to GetOrderAsync — a distinct code path added,
+// not a cosmetic rename/whitespace/comment tweak (those are what
+// computeFingerprint is specifically designed to SURVIVE).
+const CHANGED_CSHARP_SOURCE = REAL_CSHARP_SOURCE.replace(`public async Task<Order> GetOrderAsync(int id)
+        {
+            var order = await _repo.FindAsync(id);
+            LogAccess(id);
+            return order;
+        }`, `public async Task<Order> GetOrderAsync(int id)
+        {
+            var order = await _repo.FindAsync(id);
+            LogAccess(id);
+            if (order == null) throw new InvalidOperationException("not found");
+            return order;
+        }`);
+(0, node_test_1.describe)("parseWithTreeSitter — real C# extraction", () => {
+    (0, node_test_1.it)("extracts every real method, constructor, and local function with class-qualified names", async () => {
+        const symbols = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const names = symbols.map(s => s.name).sort();
+        strict_1.default.deepEqual(names, [
+            "IOrderService.GetOrderAsync",
+            "OrderDto.Describe",
+            "OrderService.Add",
+            "OrderService.GetOrderAsync",
+            "OrderService.LogAccess",
+            "OrderService.OrderService",
+            "Point.Sum",
+        ].sort());
+    });
+    (0, node_test_1.it)("real, correct method vs constructor typing", async () => {
+        const symbols = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const ctor = symbols.find(s => s.name === "OrderService.OrderService");
+        const method = symbols.find(s => s.name === "OrderService.GetOrderAsync");
+        strict_1.default.equal(ctor?.type, "method");
+        strict_1.default.equal(method?.type, "method");
+    });
+    (0, node_test_1.it)("real call extraction trims member-access callees to their trailing identifier", async () => {
+        const symbols = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const method = symbols.find(s => s.name === "OrderService.GetOrderAsync");
+        strict_1.default.ok(method);
+        strict_1.default.ok(method.calls.includes("FindAsync"), `expected FindAsync in ${JSON.stringify(method.calls)}`);
+        strict_1.default.ok(method.calls.includes("LogAccess"), `expected LogAccess in ${JSON.stringify(method.calls)}`);
+    });
+    (0, node_test_1.it)("real using-directive extraction", async () => {
+        const symbols = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        strict_1.default.ok(symbols[0].imports.some(i => i.source.includes("using System;")));
+        strict_1.default.ok(symbols[0].imports.some(i => i.source.includes("using System.Threading.Tasks;")));
+    });
+    (0, node_test_1.it)("returns [] for an unrecognized extension rather than throwing", async () => {
+        const symbols = await (0, tree_sitter_parser_1.parseWithTreeSitter)("readme.md", "# not code");
+        strict_1.default.deepEqual(symbols, []);
+    });
+});
+(0, node_test_1.describe)("real deduplication — the actual bar this brief is judged against", () => {
+    (0, node_test_1.it)("the SAME, unchanged C# function produces a byte-for-byte identical fingerprint across repeated runs", async () => {
+        const run1 = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const run2 = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const run3 = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const fp1 = run1.find(s => s.name === "OrderService.GetOrderAsync")?.fingerprint;
+        const fp2 = run2.find(s => s.name === "OrderService.GetOrderAsync")?.fingerprint;
+        const fp3 = run3.find(s => s.name === "OrderService.GetOrderAsync")?.fingerprint;
+        strict_1.default.ok(fp1);
+        strict_1.default.equal(fp1, fp2);
+        strict_1.default.equal(fp2, fp3);
+        // Every single real symbol in the file, not just one — genuine, stable
+        // dedup across the whole file, not a cherry-picked case.
+        for (let i = 0; i < run1.length; i++) {
+            strict_1.default.equal(run1[i].fingerprint, run2[i].fingerprint, `symbol ${run1[i].name} fingerprint drifted across runs`);
+        }
+    });
+    (0, node_test_1.it)("via the real, full parseFile dispatch (the actual path scan-repo.ts calls) — same stability", async () => {
+        const run1 = await (0, ast_parser_1.parseFile)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const run2 = await (0, ast_parser_1.parseFile)("OrderService.cs", REAL_CSHARP_SOURCE);
+        strict_1.default.ok(run1.length > 0);
+        strict_1.default.deepEqual(run1.map(s => s.fingerprint), run2.map(s => s.fingerprint));
+    });
+    (0, node_test_1.it)("cosmetic-only changes (comments, whitespace) do NOT change the fingerprint — by design", async () => {
+        const cosmetic = REAL_CSHARP_SOURCE.replace(`public static int Add(int a, int b)`, `// adds two numbers\n        public static int Add(int a, int b)`);
+        const before = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const after = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", cosmetic);
+        const fpBefore = before.find(s => s.name === "OrderService.Add")?.fingerprint;
+        const fpAfter = after.find(s => s.name === "OrderService.Add")?.fingerprint;
+        strict_1.default.equal(fpBefore, fpAfter);
+    });
+    (0, node_test_1.it)("a genuinely CHANGED function's fingerprint correctly changes — an edit is not invisible", async () => {
+        const before = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", REAL_CSHARP_SOURCE);
+        const after = await (0, tree_sitter_parser_1.parseWithTreeSitter)("OrderService.cs", CHANGED_CSHARP_SOURCE);
+        const fpBefore = before.find(s => s.name === "OrderService.GetOrderAsync")?.fingerprint;
+        const fpAfter = after.find(s => s.name === "OrderService.GetOrderAsync")?.fingerprint;
+        strict_1.default.ok(fpBefore);
+        strict_1.default.ok(fpAfter);
+        strict_1.default.notEqual(fpBefore, fpAfter);
+        // Every OTHER real symbol in the file is untouched by the edit and must
+        // keep its own stable fingerprint — proving the change is properly
+        // scoped to the actual edited function, not a global reshuffle.
+        for (const name of ["OrderService.Add", "OrderService.LogAccess", "OrderService.OrderService", "Point.Sum"]) {
+            const b = before.find(s => s.name === name)?.fingerprint;
+            const a = after.find(s => s.name === name)?.fingerprint;
+            strict_1.default.equal(b, a, `unrelated symbol ${name} should not have changed`);
+        }
+    });
+});
+(0, node_test_1.describe)("computeFingerprint — sanity on real C# body text", () => {
+    (0, node_test_1.it)("normalizes C# string interpolation/comments deterministically", () => {
+        const a = (0, ast_parser_1.computeFingerprint)(`Console.WriteLine($"Accessed order {id}"); // log it`);
+        const b = (0, ast_parser_1.computeFingerprint)(`Console.WriteLine($"Accessed order {id}");`);
+        strict_1.default.equal(a, b);
+    });
+});

package/dist/__tests__/vendoredCodeDetector.test.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * Real tests for vendoredCodeDetector.ts — build brief "Stop capturing
+ * vendored/third-party code as if it were the client's own" (2026-09-22).
+ * Mirrors kodingo-api's own test coverage for the same, identically-
+ * designed module.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const vendoredCodeDetector_1 = require("../utils/vendoredCodeDetector");
+(0, node_test_1.describe)("isVendoredPath", () => {
+    (0, node_test_1.describe)("POSITIVE — real files confirmed polluting TestHaven/FOTX", () => {
+        for (const p of [
+            "wwwroot/lib/jquery/jquery.js",
+            "wwwroot/lib/jquery/jquery.min.js",
+            "Scripts/WebUIValidation.js",
+            "Scripts/WebForms.js",
+            "Scripts/MicrosoftAjaxWebForms.js",
+        ]) {
+            (0, node_test_1.it)(`flags ${p}`, () => {
+                strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredPath)(p).vendored, true);
+            });
+        }
+    });
+    (0, node_test_1.describe)("POSITIVE — general path/directory/filename conventions", () => {
+        for (const p of [
+            "node_modules/react/index.js",
+            "vendor/autoload.php",
+            "bower_components/angular/angular.js",
+            "jspm_packages/npm/lodash@4.js",
+            "Pods/Alamofire/Source/Request.swift",
+            ".venv/lib/python3.11/site-packages/flask/app.py",
+            "packages/Newtonsoft.Json.13.0.1/lib/net45/Newtonsoft.Json.cs",
+            "src/assets/app.min.js",
+            "src/assets/theme.min.css",
+            "jquery-3.6.0.js",
+            "bootstrap.bundle.min.js",
+            "modernizr-2.8.3.js",
+        ]) {
+            (0, node_test_1.it)(`flags ${p}`, () => {
+                strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredPath)(p).vendored, true);
+            });
+        }
+    });
+    (0, node_test_1.describe)("NEGATIVE — real, legitimate application files must NOT be flagged", () => {
+        for (const p of [
+            "src/validators/UserValidation.js",
+            "src/utils/MicrosoftAjaxHelper.cs",
+            "packages/api/src/OrderService.cs",
+            "src/lib/formatCurrency.ts",
+            "Scripts/OrderService.js",
+            "Scripts/checkout-page.js",
+            "src/services/OrderService.cs",
+            "src/controllers/CheckoutController.cs",
+        ]) {
+            (0, node_test_1.it)(`does not flag ${p}`, () => {
+                const result = (0, vendoredCodeDetector_1.isVendoredPath)(p);
+                strict_1.default.equal(result.vendored, false);
+                strict_1.default.equal(result.reason, null);
+            });
+        }
+    });
+});
+(0, node_test_1.describe)("isVendoredContent", () => {
+    (0, node_test_1.it)("flags genuinely minified-shaped content", () => {
+        const content = Array.from({ length: 5 }, () => "x".repeat(4000)).join("\n");
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredContent)(content).vendored, true);
+    });
+    (0, node_test_1.it)("does not flag a real, dense, hand-written file with normal line breaks", () => {
+        const lines = [];
+        for (let i = 0; i < 300; i++) {
+            lines.push(`        public Order GetOrder${i}(int id) { return _repo.Find(id, "status", "active"); }`);
+        }
+        const content = `namespace Acme.Orders {\n  public class OrderService {\n${lines.join("\n")}\n  }\n}`;
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredContent)(content).vendored, false);
+    });
+    (0, node_test_1.it)("flags an explicit auto-generated header", () => {
+        const content = "// <auto-generated>\n// This code was generated by a tool.\nnamespace Acme { public class Foo {} }";
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredContent)(content).vendored, true);
+    });
+    (0, node_test_1.it)("does not flag a small real file with one long line", () => {
+        const content = "const CONFIG = " + JSON.stringify({ a: 1, b: 2 });
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredContent)(content).vendored, false);
+    });
+});
+(0, node_test_1.describe)("isVendoredCode", () => {
+    (0, node_test_1.it)("flags on path alone without content", () => {
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredCode)("node_modules/react/index.js", null).vendored, true);
+    });
+    (0, node_test_1.it)("real, legitimate file is never flagged", () => {
+        const content = `export function calculateTotal(items) {\n  return items.reduce((sum, i) => sum + i.price, 0);\n}`;
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredCode)("src/services/OrderService.ts", content).vendored, false);
+    });
+});

package/dist/__tests__/vendoredCodeFiltering.test.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Real, end-to-end proof that vendored files never reach symbol
+ * extraction in either real local capture path — build brief "Stop
+ * capturing vendored/third-party code as if it were the client's own"
+ * (2026-09-22). Uses a real temp directory on disk (no mocking needed —
+ * these are pure filesystem + static-analysis functions), following the
+ * exact real symptom shape confirmed for TestHaven/FOTX.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const scan_repo_1 = require("../commands/scan-repo");
+const graph_builder_1 = require("../utils/graph-builder");
+let repoRoot;
+function write(relPath, content) {
+    const full = path.join(repoRoot, relPath);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content, "utf-8");
+}
+function realFunctionSource(name) {
+    return `function ${name}(x) {\n  const result = x + 1;\n  return result;\n}\n`;
+}
+(0, node_test_1.before)(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), "kortex-vendored-test-"));
+    // Real client business logic — must always survive.
+    write("src/OrderService.ts", realFunctionSource("getOrder"));
+    write("src/CheckoutController.ts", realFunctionSource("processCheckout"));
+    // Real jQuery, checked in under ASP.NET Core's real wwwroot/lib/ convention.
+    write("wwwroot/lib/jquery/jquery.js", `function domManip(a, b) { return a; }\nfunction isWindow(obj) { return obj === obj.window; }\n`);
+    // Real WebForms framework file, checked in under an ordinary Scripts/ folder.
+    write("Scripts/WebForms.js", `function WebForm_GetElementByTagName(tag) { return document.getElementsByTagName(tag); }\n`);
+    // Vendored via node_modules — already excluded at the directory-walk
+    // level by IGNORED_DIRS, included here to confirm it's genuinely never
+    // reached either way.
+    write("node_modules/some-lib/index.js", realFunctionSource("someLibInternal"));
+    // Genuinely minified, ordinary-looking filename — only real content
+    // reveals it.
+    write("src/thirdPartyBundle.js", Array.from({ length: 5 }, () => "x".repeat(4000)).join("\n"));
+});
+(0, node_test_1.after)(() => {
+    fs.rmSync(repoRoot, { recursive: true, force: true });
+});
+(0, node_test_1.describe)("scan-repo.ts — real walkFiles + extractSymbols never surface vendored files", () => {
+    (0, node_test_1.it)("walkFiles excludes the real jQuery file (path-level) but includes the client's own real files", () => {
+        const files = (0, scan_repo_1.walkFiles)(repoRoot).map(f => path.relative(repoRoot, f).split(path.sep).join("/"));
+        strict_1.default.ok(!files.includes("wwwroot/lib/jquery/jquery.js"), `jquery.js should have been excluded, got: ${JSON.stringify(files)}`);
+        strict_1.default.ok(!files.includes("Scripts/WebForms.js"), `WebForms.js should have been excluded, got: ${JSON.stringify(files)}`);
+        strict_1.default.ok(!files.includes("node_modules/some-lib/index.js"));
+        strict_1.default.ok(files.includes("src/OrderService.ts"));
+        strict_1.default.ok(files.includes("src/CheckoutController.ts"));
+        // The minified bundle passes the PATH check (ordinary name) — content
+        // filtering happens later, in extractSymbols.
+        strict_1.default.ok(files.includes("src/thirdPartyBundle.js"));
+    });
+    (0, node_test_1.it)("extractSymbols never returns real jQuery/WebForms symbols, and returns [] for the minified bundle via content-level detection", async () => {
+        const files = (0, scan_repo_1.walkFiles)(repoRoot);
+        const allSymbols = (await Promise.all(files.map(f => (0, scan_repo_1.extractSymbols)(f)))).flat();
+        const names = allSymbols.map(s => s.name);
+        strict_1.default.ok(!names.includes("domManip"), `domManip should never have been extracted, got: ${JSON.stringify(names)}`);
+        strict_1.default.ok(!names.includes("isWindow"));
+        strict_1.default.ok(!names.includes("WebForm_GetElementByTagName"));
+        strict_1.default.ok(names.includes("getOrder"));
+        strict_1.default.ok(names.includes("processCheckout"));
+        const bundleFile = files.find(f => f.endsWith("thirdPartyBundle.js"));
+        strict_1.default.ok(bundleFile);
+        const bundleSymbols = await (0, scan_repo_1.extractSymbols)(bundleFile);
+        strict_1.default.deepEqual(bundleSymbols, []);
+    });
+});
+(0, node_test_1.describe)("graph-builder.ts — real buildGraph never indexes vendored symbols", () => {
+    (0, node_test_1.it)("the real, built graph contains the client's own real functions and none of the vendored ones", async () => {
+        const graph = await (0, graph_builder_1.buildGraph)(repoRoot);
+        const names = Object.values(graph.nodes).map(n => n.name);
+        strict_1.default.ok(!names.includes("domManip"), `domManip should never appear in the graph, got: ${JSON.stringify(names)}`);
+        strict_1.default.ok(!names.includes("isWindow"));
+        strict_1.default.ok(!names.includes("WebForm_GetElementByTagName"));
+        strict_1.default.ok(!names.includes("someLibInternal"));
+        strict_1.default.ok(names.includes("getOrder"));
+        strict_1.default.ok(names.includes("processCheckout"));
+    });
+});

package/dist/commands/scan-repo.js

@@ -49,6 +49,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkFiles = walkFiles;
+exports.extractSymbols = extractSymbols;
 exports.scanRepoCommand = scanRepoCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -57,11 +59,12 @@ const os = __importStar(require("os"));
 const ast_parser_1 = require("../utils/ast-parser");
 const graph_builder_1 = require("../utils/graph-builder");
 const context_assembler_1 = require("../utils/context-assembler");
+const vendoredCodeDetector_1 = require("../utils/vendoredCodeDetector");
 const API_BASE = "https://kodingo-api.onrender.com";
 const SUPPORTED_EXTENSIONS = [
     ".ts", ".tsx", ".js", ".jsx",
     ".py", ".go", ".rs", ".php",
-    ".java", ".kt", ".rb", ".c", ".cpp",
+    ".java", ".kt", ".rb", ".c", ".cpp", ".cs",
 ];
 const IGNORED_DIRS = [
     "node_modules", ".git", ".kortex", "dist", "build",
@@ -84,7 +87,7 @@ function findRepoRoot(startPath) {
         current = parent;
     }
 }
-function walkFiles(dir) {
+function walkFiles(dir, repoRoot = dir) {
     const results = [];
     try {
         const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
@@ -93,9 +96,20 @@ function walkFiles(dir) {
                 continue;
             const fullPath = path_1.default.join(dir, entry.name);
             if (entry.isDirectory()) {
-                results.push(...walkFiles(fullPath));
+                results.push(...walkFiles(fullPath, repoRoot));
             }
             else if (entry.isFile() && SUPPORTED_EXTENSIONS.includes(path_1.default.extname(entry.name))) {
+                // Real, general vendored-code detection (build brief "Stop
+                // capturing vendored/third-party code as if it were the client's
+                // own", 2026-09-22) — IGNORED_DIRS above already prunes
+                // single-segment conventions (node_modules, vendor, .venv, ...)
+                // at real traversal speed; this catches the rest (two-segment
+                // conventions like wwwroot/lib/, minified-filename conventions,
+                // and known bundled framework files) which need the real,
+                // relative path to detect correctly.
+                const relativePath = path_1.default.relative(repoRoot, fullPath).split(path_1.default.sep).join("/");
+                if ((0, vendoredCodeDetector_1.isVendoredPath)(relativePath).vendored)
+                    continue;
                 results.push(fullPath);
             }
         }
@@ -106,6 +120,12 @@ function walkFiles(dir) {
 async function extractSymbols(filePath) {
     try {
         const source = fs_1.default.readFileSync(filePath, "utf-8");
+        // Content-level check — catches minified/auto-generated files that
+        // pass the path check (e.g. a bundled framework script checked in
+        // directly, not under a vendored-directory convention). Recognized
+        // and skipped BEFORE symbol extraction, not filtered after the fact.
+        if ((0, vendoredCodeDetector_1.isVendoredContent)(source).vendored)
+            return [];
         const nodes = await (0, ast_parser_1.parseFile)(filePath, source);
         return nodes.map(n => ({
             name: n.name,

package/dist/utils/ast-parser.js

@@ -417,7 +417,7 @@ const KOTLIN_PATTERNS = [
     /^(?:fun|override\s+fun|suspend\s+fun|private\s+fun|public\s+fun)\s+(\w+)/,
     /^(?:class|data class|object|interface)\s+(\w+)/,
 ];
-const TREE_SITTER_EXTENSIONS = new Set([".py", ".go", ".rs", ".java", ".kt", ".rb", ".php", ".c", ".cpp"]);
+const TREE_SITTER_EXTENSIONS = new Set([".py", ".go", ".rs", ".java", ".kt", ".rb", ".php", ".c", ".cpp", ".cs"]);
 async function parseFile(filePath, source) {
     const ext = path.extname(filePath).toLowerCase();
     switch (ext) {

package/dist/utils/graph-builder.js

@@ -61,10 +61,11 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const ts = __importStar(require("typescript"));
 const ast_parser_1 = require("./ast-parser");
+const vendoredCodeDetector_1 = require("./vendoredCodeDetector");
 const SUPPORTED_EXTENSIONS = [
     ".ts", ".tsx", ".js", ".jsx",
     ".py", ".go", ".rs", ".php",
-    ".java", ".kt", ".rb", ".c", ".cpp",
+    ".java", ".kt", ".rb", ".c", ".cpp", ".cs",
 ];
 const TS_JS_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx"]);
 const IGNORED_DIRS = [
@@ -73,7 +74,7 @@ const IGNORED_DIRS = [
     ".venv", "venv", "env", "site-packages", "virtualenv",
     ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj",
 ];
-function walkFiles(dir) {
+function walkFiles(dir, repoRoot = dir) {
     const results = [];
     try {
         const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
@@ -82,9 +83,17 @@ function walkFiles(dir) {
                 continue;
             const fullPath = path_1.default.join(dir, entry.name);
             if (entry.isDirectory()) {
-                results.push(...walkFiles(fullPath));
+                results.push(...walkFiles(fullPath, repoRoot));
             }
             else if (entry.isFile() && SUPPORTED_EXTENSIONS.includes(path_1.default.extname(entry.name))) {
+                // Real, general vendored-code detection (build brief "Stop
+                // capturing vendored/third-party code as if it were the client's
+                // own", 2026-09-22) — a polluted graph corrupts real centrality/
+                // reachability scoring (used by attack-surface reasoning), the
+                // same real underlying problem as polluted memory capture.
+                const relativePath = path_1.default.relative(repoRoot, fullPath).split(path_1.default.sep).join("/");
+                if ((0, vendoredCodeDetector_1.isVendoredPath)(relativePath).vendored)
+                    continue;
                 results.push(fullPath);
             }
         }
@@ -109,6 +118,8 @@ async function collectAllSymbols(repoRoot) {
     for (const file of files) {
         try {
             const source = fs_1.default.readFileSync(file, "utf-8");
+            if ((0, vendoredCodeDetector_1.isVendoredContent)(source).vendored)
+                continue;
             const nodes = await (0, ast_parser_1.parseFile)(file, source);
             for (const n of nodes) {
                 all.push({ ...n, language: languageForFile(file) });

package/dist/utils/tree-sitter-parser.js

@@ -104,6 +104,31 @@ const LANGUAGE_CONFIGS = {
         nameFieldCandidates: [], // handled via declarator fallback
         importTypes: ["preproc_include"],
     },
+    // C# — build brief "Add real C#/.NET support to the CLI's parser"
+    // (2026-09-20). Real node types confirmed directly against the bundled
+    // tree-sitter-c_sharp.wasm grammar (tree-sitter-wasms package, already a
+    // real dependency here — no new native package needed, see this brief's
+    // own final report for why that matters). method_declaration,
+    // constructor_declaration, and local_function_statement all carry a real
+    // `name` field; invocation_expression carries a real `function` field
+    // whose text (e.g. "_repo.FindAsync", "Console.WriteLine") is trimmed to
+    // its trailing identifier by the same extractTrailingIdentifier() already
+    // proven for PHP's "$this->service->method" shape — no C#-specific call
+    // handling needed. Deliberately excludes operator_declaration,
+    // destructor_declaration, and property accessors — real, distinct node
+    // shapes with no `name` field (or none at all) that no other language
+    // here gets special-cased treatment for either; kept proportionate to the
+    // existing five languages' own level of coverage rather than gold-plating
+    // C# beyond them.
+    csharp: {
+        wasmFile: "tree-sitter-c_sharp.wasm",
+        functionTypes: ["method_declaration", "constructor_declaration", "local_function_statement"],
+        classTypes: ["class_declaration", "interface_declaration", "struct_declaration", "record_declaration"],
+        callTypes: ["invocation_expression"],
+        calleeFieldCandidates: ["function"],
+        nameFieldCandidates: ["name"],
+        importTypes: ["using_directive"],
+    },
 };
 const EXT_TO_LANGUAGE = {
     ".py": "python",
@@ -115,6 +140,7 @@ const EXT_TO_LANGUAGE = {
     ".php": "php",
     ".c": "c",
     ".cpp": "cpp",
+    ".cs": "csharp",
 };
 let initialised = false;
 const languageCache = new Map();

package/dist/utils/vendoredCodeDetector.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * vendoredCodeDetector.ts
+ *
+ * Real, general, structural detection of vendored/third-party/bundled code
+ * — NOT a hardcoded library-name list as the primary mechanism. Build
+ * brief: "Stop capturing vendored/third-party code as if it were the
+ * client's own" (2026-09-22). Mirrored, identically-designed module in
+ * kodingo-api (utils/vendoredCodeDetector.ts) and kodingo-vscode
+ * (src/utils/vendoredCodeDetector.ts) — each repo has its own real,
+ * separate walk/extract pipeline with no shared low-level utility package
+ * between them (kodingo-core is explicitly scoped to decision/memory
+ * lifecycle domain logic, not general file classification), so this is
+ * duplicated by design, matching this codebase's own established
+ * precedent (e.g. IGNORED_DIRS is already independently duplicated across
+ * scan-repo.ts and security-scan.ts within this same repo). See this
+ * brief's own final report for the full reasoning.
+ *
+ * Real, confirmed evidence this fixes: an admin deep scan of a real
+ * .NET/WebForms project (TestHaven/FOTX) captured real jQuery internals
+ * (domManip, isWindow, movePrevious) and real ASP.NET WebForms framework
+ * internals (WebPartManager_InitiateWebPartDragDrop,
+ * WebForm_GetElementByTagName, Zone_UpdatePosition) as if they were the
+ * client's own business logic — diluting a real answer to "what is this
+ * project" into near-nothing.
+ *
+ * Three real, independent layers, checked cheapest/most-certain first:
+ *   1. Path/directory conventions — reliable across languages/ecosystems,
+ *      needs only the file path.
+ *   2. File-naming conventions (.min.js/.min.css) — same, path-only.
+ *   3. Content heuristics (minified shape, an explicit auto-generated
+ *      header) — needs real file content.
+ * A fourth, explicitly-acknowledged-INCOMPLETE layer: a real, growing list
+ * of specific, well-known bundled framework files. This list will NEVER be
+ * complete — it exists because layers 1-2, by design, cannot catch every
+ * real case: these specific files are frequently checked in un-minified,
+ * under an ordinarily-legitimate-looking folder name (e.g. "Scripts/",
+ * which is NOT treated as a vendored-directory convention here precisely
+ * because plenty of real WebForms projects also put their OWN
+ * app-specific JS there — see isVendoredPath's own reasoning below).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isVendoredPath = isVendoredPath;
+exports.isVendoredContent = isVendoredContent;
+exports.isVendoredCode = isVendoredCode;
+const NOT_VENDORED = { vendored: false, reason: null };
+// ── Layer 1: path/directory conventions ─────────────────────────────────────
+const VENDORED_DIR_SEGMENTS = [
+    "node_modules", "vendor", "bower_components", "jspm_packages", "pods",
+    ".venv", "venv", "site-packages",
+];
+// "wwwroot/lib/" specifically is ASP.NET Core's real, well-known convention
+// for client-side libraries pulled in via LibMan/npm — directly relevant
+// to this exact client's real stack. "lib/" alone is NOT treated as
+// vendored — an extremely common real application folder name on its own.
+const VENDORED_PATH_PAIRS = [
+    ["wwwroot", "lib"],
+];
+// Classic NuGet packages/ convention: packages/<PackageName>.<Version>/...
+// Deliberately NOT a bare "packages/" match — that would false-positive on
+// the equally common JS/TS monorepo convention (Lerna/Yarn/npm workspaces)
+// where packages/<name>/ holds the CLIENT'S OWN first-party code.
+const NUGET_VERSIONED_DIR = /^[A-Za-z0-9_.-]+\.\d+\.\d+(\.\d+)?(-[A-Za-z0-9.]+)?$/;
+function pathSegments(filePath) {
+    return filePath.replace(/\\/g, "/").split("/").filter(Boolean);
+}
+function isVendoredPath(filePath) {
+    const segments = pathSegments(filePath);
+    const lowerSegments = segments.map(s => s.toLowerCase());
+    for (const dir of VENDORED_DIR_SEGMENTS) {
+        if (lowerSegments.includes(dir)) {
+            return { vendored: true, reason: `Path contains the "${dir}/" vendored-dependency directory convention.` };
+        }
+    }
+    for (const [first, second] of VENDORED_PATH_PAIRS) {
+        for (let i = 0; i < lowerSegments.length - 1; i++) {
+            if (lowerSegments[i] === first && lowerSegments[i + 1] === second) {
+                return { vendored: true, reason: `Path contains the "${first}/${second}/" vendored-dependency directory convention.` };
+            }
+        }
+    }
+    const packagesIdx = lowerSegments.indexOf("packages");
+    if (packagesIdx !== -1 && packagesIdx + 1 < segments.length && NUGET_VERSIONED_DIR.test(segments[packagesIdx + 1])) {
+        return { vendored: true, reason: `Path matches the classic NuGet "packages/<Name>.<Version>/" vendored-package convention.` };
+    }
+    const basename = segments[segments.length - 1] ?? "";
+    if (/\.min\.(js|css)$/i.test(basename) || /-min\.(js|css)$/i.test(basename)) {
+        return { vendored: true, reason: `Filename "${basename}" follows the minified-distribution naming convention (.min.js/.min.css).` };
+    }
+    const knownFileReason = matchKnownVendoredFile(basename);
+    if (knownFileReason)
+        return { vendored: true, reason: knownFileReason };
+    return NOT_VENDORED;
+}
+// ── Layer 2: content heuristics ─────────────────────────────────────────────
+const MIN_CONTENT_LENGTH_FOR_MINIFICATION_CHECK = 5000;
+const MINIFIED_AVG_LINE_LENGTH_THRESHOLD = 500;
+const AUTO_GENERATED_HEADER_PATTERN = /<auto-generated|@generated\b|do not (edit|modify) this file|this file (is|was) auto-generated|machine[- ]generated/i;
+function isVendoredContent(content) {
+    const header = content.slice(0, 500);
+    if (AUTO_GENERATED_HEADER_PATTERN.test(header)) {
+        return { vendored: true, reason: "File header contains an explicit auto-generated marker." };
+    }
+    if (content.length >= MIN_CONTENT_LENGTH_FOR_MINIFICATION_CHECK) {
+        const lineCount = content.split("\n").length;
+        const avgLineLength = content.length / Math.max(1, lineCount);
+        if (avgLineLength > MINIFIED_AVG_LINE_LENGTH_THRESHOLD) {
+            return {
+                vendored: true,
+                reason: `Unusually long average line length (${Math.round(avgLineLength)} chars/line across ${lineCount} lines) consistent with minified/bundled code, not hand-written source.`,
+            };
+        }
+    }
+    return NOT_VENDORED;
+}
+// ── Layer 3 (secondary, explicitly incomplete): known bundled framework files ──
+const KNOWN_VENDORED_FILENAME_PATTERNS = [
+    /^jquery(-\d+(\.\d+){1,2})?(\.min)?\.js$/i,
+    /^jquery-ui(-\d+(\.\d+){1,2})?(\.min)?\.js$/i,
+    /^jquery\.validate(\.unobtrusive)?(\.min)?\.js$/i,
+    /^jquery\.unobtrusive-ajax(\.min)?\.js$/i,
+    /^WebUIValidation\.js$/i,
+    /^WebForms\.js$/i,
+    /^MicrosoftAjax(WebForms|Timer)?(\.debug)?\.js$/i,
+    /^SmartNav\.js$/i,
+    /^bootstrap(\.bundle)?(\.min)?\.(js|css)$/i,
+    /^modernizr(-\d+(\.\d+){1,2})?(\.min)?\.js$/i,
+];
+function matchKnownVendoredFile(basename) {
+    for (const pattern of KNOWN_VENDORED_FILENAME_PATTERNS) {
+        if (pattern.test(basename)) {
+            return `Filename "${basename}" matches a real, known bundled/vendored framework file (secondary, explicitly-incomplete list — see this module's own file header).`;
+        }
+    }
+    return null;
+}
+// ── Combined convenience ─────────────────────────────────────────────────────
+function isVendoredCode(filePath, content) {
+    const pathResult = isVendoredPath(filePath);
+    if (pathResult.vendored)
+        return pathResult;
+    if (content !== null)
+        return isVendoredContent(content);
+    return NOT_VENDORED;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,
@@ -16,7 +16,7 @@
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json --watch",
     "start": "node dist/cli.js",
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "npm run build && node --test dist/__tests__/*.js",
     "prepare": "npm run build"
   },
   "dependencies": {