recon-generate 0.0.7 → 0.0.8

package/dist/analyzer/call-tree-builder.d.ts

@@ -0,0 +1,14 @@
+import { ContractDefinition, Expression, FunctionCall, FunctionDefinition, ModifierDefinition, ModifierInvocation, Statement } from 'solc-typed-ast';
+import { CallTree } from '../types';
+export interface CallTreeBuilderContext {
+    nodeCounter: {
+        value: number;
+    };
+    contract: ContractDefinition;
+    callStack: number[];
+    activeNodes: Map<number, number>;
+}
+/**
+ * Build a call tree for a function or modifier
+ */
+export declare function buildCallTree(currentFunc: FunctionDefinition | ModifierDefinition, callArgs?: Expression[], fnCall?: FunctionCall | ModifierInvocation, callContext?: Statement, context?: CallTreeBuilderContext): CallTree;

package/dist/analyzer/call-tree-builder.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCallTree = buildCallTree;
+const solc_typed_ast_1 = require("solc-typed-ast");
+const expression_analyzer_1 = require("./expression-analyzer");
+/**
+ * Build a call tree for a function or modifier
+ */
+function buildCallTree(currentFunc, callArgs = [], fnCall, callContext, context) {
+    if (!context) {
+        throw new Error('CallTreeBuilderContext is required');
+    }
+    const functionAstId = currentFunc.id;
+    const isRecursiveCall = context.callStack.includes(functionAstId);
+    const recursiveTargetNodeId = context.activeNodes.get(functionAstId);
+    const node = {
+        nodeId: context.nodeCounter.value++,
+        definition: currentFunc,
+        fnCall: fnCall,
+        callArgs: callArgs,
+        callContext: callContext,
+        children: [],
+        isRecursive: isRecursiveCall,
+        recursiveTargetNodeId: recursiveTargetNodeId
+    };
+    if (isRecursiveCall) {
+        return node;
+    }
+    context.callStack.push(functionAstId);
+    context.activeNodes.set(functionAstId, node.nodeId);
+    // For modifiers, process argument calls first (before modifier body)
+    if (currentFunc instanceof solc_typed_ast_1.ModifierDefinition && fnCall instanceof solc_typed_ast_1.ModifierInvocation) {
+        for (const arg of fnCall.vArguments) {
+            (0, expression_analyzer_1.collectCallsFromExpression)(arg, node.children, fnCall, undefined, (func, args, call, ctx) => buildCallTree(func, args, call, ctx, context), context.contract);
+        }
+    }
+    // For constructors, process argument calls first (before constructor body)
+    if (currentFunc instanceof solc_typed_ast_1.FunctionDefinition && currentFunc.isConstructor && fnCall instanceof solc_typed_ast_1.ModifierInvocation) {
+        for (const arg of fnCall.vArguments) {
+            (0, expression_analyzer_1.collectCallsFromExpression)(arg, node.children, fnCall, undefined, (func, args, call, ctx) => buildCallTree(func, args, call, ctx, context), context.contract);
+        }
+    }
+    // Process function body first - only direct statements
+    if (currentFunc.vBody) {
+        // For modifiers, create the context for parameter resolution
+        const modifierContext = currentFunc instanceof solc_typed_ast_1.ModifierDefinition ?
+            { modifier: currentFunc, resolvedArgs: callArgs } : undefined;
+        for (const stmt of currentFunc.vBody.vStatements) {
+            (0, expression_analyzer_1.collectCallsFromExpression)(stmt, node.children, stmt, modifierContext, (func, args, call, ctx) => buildCallTree(func, args, call, ctx, context), context.contract);
+        }
+    }
+    // Helper function to resolve modifier arguments based on function parameters
+    function resolveModifierArguments(func, modifierArgs, functionCallArgs) {
+        return modifierArgs.map(arg => {
+            // If the argument is an Identifier that matches a function parameter, replace it with the actual argument
+            if (arg instanceof solc_typed_ast_1.Identifier) {
+                const paramIndex = func.vParameters.vParameters.findIndex(param => param.name === arg.name);
+                if (paramIndex !== -1 && paramIndex < functionCallArgs.length) {
+                    return functionCallArgs[paramIndex];
+                }
+            }
+            return arg;
+        });
+    }
+    // Process modifiers last for ALL functions (at the end of the frame in reverse order)
+    if (currentFunc instanceof solc_typed_ast_1.FunctionDefinition && currentFunc.vModifiers.length > 0) {
+        // Reverse the order of modifiers and add them at the end
+        const reversedModifiers = [...currentFunc.vModifiers].reverse();
+        for (const modifierInvocation of reversedModifiers) {
+            if (modifierInvocation.vModifierName.vReferencedDeclaration instanceof solc_typed_ast_1.ModifierDefinition) {
+                const calledModifier = modifierInvocation.vModifierName.vReferencedDeclaration;
+                // Resolve modifier arguments based on the actual function call arguments
+                const resolvedArgs = resolveModifierArguments(currentFunc, modifierInvocation.vArguments, callArgs);
+                node.children.push(buildCallTree(calledModifier, resolvedArgs, modifierInvocation, undefined, context));
+            }
+            else if (modifierInvocation.vModifierName.vReferencedDeclaration instanceof solc_typed_ast_1.ContractDefinition) {
+                // Handle constructor calls like ERC20("ETH", 18)
+                const baseContract = modifierInvocation.vModifierName.vReferencedDeclaration;
+                // Find the constructor in the base contract
+                const constructor = baseContract.vFunctions.find(f => f.isConstructor);
+                if (constructor) {
+                    // Resolve constructor arguments as well
+                    const resolvedArgs = resolveModifierArguments(currentFunc, modifierInvocation.vArguments, callArgs);
+                    node.children.push(buildCallTree(constructor, resolvedArgs, modifierInvocation, undefined, context));
+                }
+            }
+        }
+    }
+    context.callStack.pop();
+    context.activeNodes.delete(functionAstId);
+    return node;
+}

package/dist/analyzer/expression-analyzer.d.ts

@@ -0,0 +1,14 @@
+import { ASTNode, ContractDefinition, Expression, FunctionCall, FunctionDefinition, ModifierDefinition, Statement } from 'solc-typed-ast';
+import { CallTree } from '../types';
+export interface ModifierContext {
+    modifier: ModifierDefinition;
+    resolvedArgs: Expression[];
+}
+/**
+ * Helper to resolve modifier parameters in expressions
+ */
+export declare function resolveModifierParams(expr: Expression, modifierContext?: ModifierContext): Expression;
+/**
+ * Helper to collect direct function/library calls from an expression
+ */
+export declare function collectCallsFromExpression(expr: ASTNode, childrenArr: CallTree[], context: Statement, modifierContext?: ModifierContext, buildCallTree?: (currentFunc: FunctionDefinition | ModifierDefinition, callArgs: Expression[], fnCall?: FunctionCall, callContext?: Statement) => CallTree, contract?: ContractDefinition): void;

package/dist/analyzer/expression-analyzer.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveModifierParams = resolveModifierParams;
+exports.collectCallsFromExpression = collectCallsFromExpression;
+const solc_typed_ast_1 = require("solc-typed-ast");
+const utils_1 = require("../utils");
+const utils_2 = require("../utils");
+const utils_3 = require("../utils");
+/**
+ * Helper to resolve modifier parameters in expressions
+ */
+function resolveModifierParams(expr, modifierContext) {
+    if (!modifierContext)
+        return expr;
+    // If it's an identifier that matches a modifier parameter, replace it
+    if (expr instanceof solc_typed_ast_1.Identifier) {
+        const paramIndex = modifierContext.modifier.vParameters.vParameters.findIndex(param => param.name === expr.name);
+        if (paramIndex !== -1 && paramIndex < modifierContext.resolvedArgs.length) {
+            return modifierContext.resolvedArgs[paramIndex];
+        }
+    }
+    return expr;
+}
+/**
+ * Helper to collect direct function/library calls from an expression
+ */
+function collectCallsFromExpression(expr, childrenArr, context, modifierContext, buildCallTree, contract) {
+    if (!expr || !buildCallTree || !contract)
+        return;
+    // Find all function calls in this expression (include the root node itself if it is a call)
+    const rootCalls = [];
+    if (expr instanceof solc_typed_ast_1.FunctionCall) {
+        rootCalls.push(expr);
+    }
+    const allCalls = [...rootCalls, ...expr.getChildrenByType(solc_typed_ast_1.FunctionCall, true)].filter(c => !(0, utils_1.highLevelCall)(c) &&
+        !(0, utils_1.highLevelCallWithOptions)(c) &&
+        c.kind === solc_typed_ast_1.FunctionCallKind.FunctionCall &&
+        !!c.vReferencedDeclaration &&
+        (c.vReferencedDeclaration instanceof solc_typed_ast_1.FunctionDefinition || c.vReferencedDeclaration instanceof solc_typed_ast_1.ModifierDefinition));
+    // Deduplicate in case the root call also appears in children traversal
+    const uniqueCalls = Array.from(new Set(allCalls));
+    // Implement proper Solidity evaluation order
+    const evaluationOrder = [];
+    // Recursive function to traverse and collect calls in correct evaluation order
+    function collectInEvaluationOrder(node, visited = new Set()) {
+        if (!node)
+            return;
+        // If this is a function call we care about, process it
+        if (node instanceof solc_typed_ast_1.FunctionCall &&
+            !(0, utils_1.highLevelCall)(node) &&
+            !(0, utils_1.highLevelCallWithOptions)(node) &&
+            node.kind === solc_typed_ast_1.FunctionCallKind.FunctionCall &&
+            !!node.vReferencedDeclaration &&
+            (node.vReferencedDeclaration instanceof solc_typed_ast_1.FunctionDefinition || node.vReferencedDeclaration instanceof solc_typed_ast_1.ModifierDefinition) &&
+            uniqueCalls.includes(node) &&
+            !visited.has(node)) {
+            // First, evaluate all arguments (which may contain nested calls)
+            for (const arg of node.vArguments) {
+                collectInEvaluationOrder(arg, visited);
+            }
+            // Then add this call to the evaluation order
+            evaluationOrder.push(node);
+            visited.add(node);
+            return;
+        }
+        // For binary operations, evaluate right operand first, then left operand (Solidity stack-based evaluation)
+        if (node.type === 'BinaryOperation') {
+            const binaryOp = node;
+            // Access left and right operands through children array
+            const left = binaryOp.children && binaryOp.children[0];
+            const right = binaryOp.children && binaryOp.children[1];
+            if (right)
+                collectInEvaluationOrder(right, visited);
+            if (left)
+                collectInEvaluationOrder(left, visited);
+            return;
+        }
+        // For other nodes, recursively process children in order
+        const children = node.children || [];
+        for (const child of children) {
+            collectInEvaluationOrder(child, visited);
+        }
+    }
+    // Start the evaluation order collection from the root expression
+    collectInEvaluationOrder(expr);
+    // Use the collected evaluation order
+    const sortedCalls = evaluationOrder.length > 0 ? evaluationOrder : uniqueCalls;
+    // Filter to get only direct calls while preserving evaluation order
+    const directCalls = sortedCalls.filter(call => {
+        // A call is direct if no other call in this expression contains it
+        return !uniqueCalls.some(otherCall => otherCall !== call &&
+            otherCall.getChildrenByType(solc_typed_ast_1.FunctionCall, true).includes(call));
+    });
+    for (const call of directCalls) {
+        let callNode = null;
+        // Library call via MemberAccess
+        if (call.vExpression instanceof solc_typed_ast_1.MemberAccess) {
+            const memberAccess = call.vExpression;
+            if (memberAccess.vReferencedDeclaration instanceof solc_typed_ast_1.FunctionDefinition) {
+                const libraryFunc = memberAccess.vReferencedDeclaration;
+                if (memberAccess.vExpression instanceof solc_typed_ast_1.Identifier) {
+                    // Handle 'super' receiver first (special case)
+                    if (memberAccess.vExpression.name === 'super') {
+                        const currentContract = (0, utils_3.getEnclosingContract)(call);
+                        if (currentContract) {
+                            const targetFunc = (0, utils_3.resolveSuper)(contract, currentContract, (0, utils_2.getSignature)(libraryFunc));
+                            if (targetFunc && targetFunc.implemented) {
+                                const superArgs = call.vArguments.map((arg) => resolveModifierParams(arg, modifierContext));
+                                callNode = buildCallTree(targetFunc, superArgs, call, context);
+                            }
+                        }
+                        // Do NOT process further as library call
+                    }
+                    else {
+                        const receiverDeclaration = memberAccess.vExpression.vReferencedDeclaration;
+                        if (receiverDeclaration && receiverDeclaration instanceof solc_typed_ast_1.ContractDefinition) {
+                            // Direct library call: HelperLibrary.increase(10)
+                            if (libraryFunc.implemented) {
+                                const resolvedLibraryArgs = call.vArguments.map((arg) => resolveModifierParams(arg, modifierContext));
+                                callNode = buildCallTree(libraryFunc, resolvedLibraryArgs, call, context);
+                            }
+                        }
+                        else {
+                            // "Using for" call: result.increase()
+                            if (libraryFunc.implemented) {
+                                const resolvedReceiver = resolveModifierParams(memberAccess.vExpression, modifierContext);
+                                const resolvedArgs = call.vArguments.map((arg) => resolveModifierParams(arg, modifierContext));
+                                const libraryArgs = [resolvedReceiver, ...resolvedArgs];
+                                callNode = buildCallTree(libraryFunc, libraryArgs, call, context);
+                            }
+                        }
+                    }
+                }
+                else {
+                    // Complex receiver - collect receiver calls to add as children of this call
+                    const receiverCalls = [];
+                    collectCallsFromExpression(memberAccess.vExpression, receiverCalls, context, modifierContext, buildCallTree, contract);
+                    // Then add the library call with receiver calls as children
+                    if (libraryFunc.implemented) {
+                        const resolvedReceiver = resolveModifierParams(memberAccess.vExpression, modifierContext);
+                        const resolvedArgs = call.vArguments.map((arg) => resolveModifierParams(arg, modifierContext));
+                        const libraryArgs = [resolvedReceiver, ...resolvedArgs];
+                        callNode = buildCallTree(libraryFunc, libraryArgs, call, context);
+                        // Add receiver calls as children (before body calls)
+                        if (callNode) {
+                            callNode.children = [...receiverCalls, ...callNode.children];
+                        }
+                    }
+                }
+            }
+        }
+        else {
+            // Direct function call (could be internal/virtual and overridden)
+            const originalFunc = call.vReferencedDeclaration;
+            const resolved = (0, utils_3.resolveOverride)(contract, (0, utils_2.getSignature)(originalFunc)) || originalFunc;
+            if (resolved.implemented) {
+                // Resolve modifier parameters in call arguments
+                const resolvedCallArgs = call.vArguments.map((arg) => resolveModifierParams(arg, modifierContext));
+                callNode = buildCallTree(resolved, resolvedCallArgs, call, context);
+            }
+        }
+        // If we created a call node, process its arguments for nested calls
+        if (callNode) {
+            // First, recursively process arguments to find nested calls (these should come first)
+            const argumentCalls = [];
+            for (const arg of call.vArguments) {
+                collectCallsFromExpression(arg, argumentCalls, context, modifierContext, buildCallTree, contract);
+            }
+            // Then process function body calls (from buildCallTree)
+            const bodyCalls = callNode.children;
+            // Combine: argument calls first, then body calls
+            callNode.children = [...argumentCalls, ...bodyCalls];
+            childrenArr.push(callNode);
+        }
+    }
+}

package/dist/index.js

@@ -39,6 +39,7 @@ const path = __importStar(require("path"));
 const case_1 = require("case");
 const generator_1 = require("./generator");
 const coverage_1 = require("./coverage");
+const pathsGenerator_1 = require("./pathsGenerator");
 const utils_1 = require("./utils");
 const link_1 = require("./link");
 function parseFilter(input) {
@@ -129,14 +130,32 @@ async function main() {
         .option('--crytic-name <name>', 'Name of the Crytic tester contract to compile', 'CryticTester')
         .option('--name <suite>', 'Suite name; affects coverage filename (recon-<name>-coverage.json)')
         .option('--foundry-config <path>', 'Path to foundry.toml (defaults to ./foundry.toml)')
-        .action(async (opts) => {
+        .action(async (opts, cmd) => {
+        var _a;
         const workspaceRoot = process.cwd();
         const foundryConfig = (0, utils_1.getFoundryConfigPath)(workspaceRoot, opts.foundryConfig);
         const foundryRoot = path.dirname(foundryConfig);
-        const suiteRaw = opts.name ? String(opts.name).trim() : '';
+        const parentOpts = ((_a = cmd.parent) === null || _a === void 0 ? void 0 : _a.opts()) || {};
+        const suiteRaw = opts.name || parentOpts.name ? String(opts.name || parentOpts.name).trim() : '';
         const suiteSnake = suiteRaw ? (0, case_1.snake)(suiteRaw) : '';
         await (0, coverage_1.runCoverage)(foundryRoot, foundryConfig, opts.cryticName || 'CryticTester', suiteSnake);
     });
+    program
+        .command('paths')
+        .description('Generate recon-paths.json from a Crytic tester contract without scaffolding tests')
+        .option('--crytic-name <name>', 'Name of the Crytic tester contract to compile', 'CryticTester')
+        .option('--name <suite>', 'Suite name; affects paths filename (recon-<name>-paths.json)')
+        .option('--foundry-config <path>', 'Path to foundry.toml (defaults to ./foundry.toml)')
+        .action(async (opts, cmd) => {
+        var _a;
+        const workspaceRoot = process.cwd();
+        const foundryConfig = (0, utils_1.getFoundryConfigPath)(workspaceRoot, opts.foundryConfig);
+        const foundryRoot = path.dirname(foundryConfig);
+        const parentOpts = ((_a = cmd.parent) === null || _a === void 0 ? void 0 : _a.opts()) || {};
+        const suiteRaw = opts.name || parentOpts.name ? String(opts.name || parentOpts.name).trim() : '';
+        const suiteSnake = suiteRaw ? (0, case_1.snake)(suiteRaw) : '';
+        await (0, pathsGenerator_1.runPaths)(foundryRoot, opts.cryticName || 'CryticTester', suiteSnake);
+    });
     program
         .command('link')
         .description('Link library addresses into echidna/medusa configs via crytic-compile')
@@ -144,11 +163,13 @@ async function main() {
         .option('--medusa-config <path>', 'Path to medusa json (defaults based on --name)')
         .option('--name <suite>', 'Suite name to pick config defaults (echidna-<name>.yaml / medusa-<name>.json)')
         .option('--foundry-config <path>', 'Path to foundry.toml (defaults to ./foundry.toml)')
-        .action(async (opts) => {
+        .action(async (opts, cmd) => {
+        var _a;
         const workspaceRoot = process.cwd();
         const foundryConfig = (0, utils_1.getFoundryConfigPath)(workspaceRoot, opts.foundryConfig);
         const foundryRoot = path.dirname(foundryConfig);
-        const suiteRaw = opts.name ? String(opts.name).trim() : '';
+        const parentOpts = ((_a = cmd.parent) === null || _a === void 0 ? void 0 : _a.opts()) || {};
+        const suiteRaw = opts.name || parentOpts.name ? String(opts.name || parentOpts.name).trim() : '';
         const suiteSnake = suiteRaw ? (0, case_1.snake)(suiteRaw) : '';
         const suffix = suiteSnake ? `-${suiteSnake}` : '';
         const echidnaDefault = `echidna${suffix}.yaml`;

package/dist/pathsGenerator.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Path Generator
+ *
+ * Generates minimal paths needed for 100% branch coverage.
+ * Output is optimized for LLM consumption.
+ */
+/** Simple output: function name -> array of path condition strings */
+export type PathOutput = Record<string, string[]>;
+export declare const runPaths: (foundryRoot: string, cryticName: string, suiteNameSnake?: string) => Promise<void>;

package/dist/pathsGenerator.js

@@ -0,0 +1,627 @@
+"use strict";
+/**
+ * Path Generator
+ *
+ * Generates minimal paths needed for 100% branch coverage.
+ * Output is optimized for LLM consumption.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPaths = void 0;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const solc_typed_ast_1 = require("solc-typed-ast");
+const call_tree_builder_1 = require("./analyzer/call-tree-builder");
+const utils_1 = require("./utils");
+// Contracts to skip (test helpers)
+const SKIP_CONTRACTS = new Set(['IHevm', 'Vm', 'StdChains', 'StdCheatsSafe', 'StdCheats']);
+// ==================== Helpers ====================
+const runCmd = (cmd, cwd) => {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.exec)(cmd, { cwd, env: { ...process.env, PATH: (0, utils_1.getEnvPath)() } }, (err, _stdout, stderr) => {
+            if (err) {
+                reject(new Error(stderr || err.message));
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+};
+const loadLatestSourceUnits = async (foundryRoot) => {
+    var _a;
+    const outDir = path.join(foundryRoot, '.recon', 'out');
+    const buildInfoDir = path.join(outDir, 'build-info');
+    let files = [];
+    try {
+        const entries = await fs.readdir(buildInfoDir);
+        const jsonFiles = entries.filter((f) => f.endsWith('.json'));
+        files = await Promise.all(jsonFiles.map(async (f) => ({
+            name: f,
+            path: path.join(buildInfoDir, f),
+            mtime: (await fs.stat(path.join(buildInfoDir, f))).mtime,
+        })));
+    }
+    catch (e) {
+        throw new Error(`No build-info directory found at ${buildInfoDir}: ${e}`);
+    }
+    if (files.length === 0) {
+        throw new Error(`No build-info JSON files found in ${buildInfoDir}.`);
+    }
+    const latestFile = files.sort((a, b) => b.mtime.getTime() - a.mtime.getTime())[0].path;
+    const fileContent = await fs.readFile(latestFile, 'utf-8');
+    const buildInfo = JSON.parse(fileContent);
+    const buildOutput = (_a = buildInfo.output) !== null && _a !== void 0 ? _a : buildInfo;
+    if (!buildOutput) {
+        throw new Error(`Build-info file ${latestFile} is missing output data.`);
+    }
+    const filteredAstData = { ...buildOutput };
+    if (filteredAstData.sources) {
+        const validSources = {};
+        for (const [key, content] of Object.entries(filteredAstData.sources)) {
+            const ast = content.ast || content.legacyAST || content.AST;
+            if (ast && (ast.nodeType === 'SourceUnit' || ast.name === 'SourceUnit')) {
+                validSources[key] = content;
+            }
+        }
+        filteredAstData.sources = validSources;
+    }
+    const reader = new solc_typed_ast_1.ASTReader();
+    return reader.read(filteredAstData);
+};
+// ==================== Main Entry ====================
+const runPaths = async (foundryRoot, cryticName, suiteNameSnake) => {
+    const buildCmd = `forge build --contracts ${cryticName} --build-info --out .recon/out`.replace(/\s+/g, ' ').trim();
+    await runCmd(buildCmd, foundryRoot);
+    const sourceUnits = await loadLatestSourceUnits(foundryRoot);
+    if (!sourceUnits || sourceUnits.length === 0) {
+        throw new Error('No source units were produced from the Crytic build; cannot generate paths.');
+    }
+    // Find target contract
+    const targetContract = findContract(sourceUnits, cryticName);
+    if (!targetContract) {
+        throw new Error(`Contract ${cryticName} not found`);
+    }
+    // Get target functions (including inherited ones)
+    const allFunctions = (0, utils_1.getDefinitions)(targetContract, 'vFunctions');
+    const targetFunctions = allFunctions.filter(f => f.visibility === solc_typed_ast_1.FunctionVisibility.Public &&
+        f.implemented &&
+        !f.name.startsWith('_'));
+    // Process each function
+    const output = {};
+    let totalPaths = 0;
+    for (const func of targetFunctions) {
+        // Find external call
+        const externalCall = findExternalCall(func);
+        if (!externalCall)
+            continue;
+        // Build call tree for external function
+        const extFunc = findFunction(sourceUnits, externalCall.contract, externalCall.function);
+        if (!extFunc)
+            continue;
+        const extContract = findContract(sourceUnits, externalCall.contract);
+        if (!extContract)
+            continue;
+        // Build call tree context
+        const context = {
+            nodeCounter: { value: 0 },
+            contract: extContract,
+            callStack: [],
+            activeNodes: new Map()
+        };
+        const callTree = (0, call_tree_builder_1.buildCallTree)(extFunc, [], undefined, undefined, context);
+        // Build param mapping
+        const paramMapping = buildParamMapping(func, externalCall);
+        // Enumerate paths
+        const enumerator = new PathEnumerator(sourceUnits, paramMapping);
+        const paths = enumerator.enumerate(callTree);
+        if (paths.length === 0)
+            continue;
+        // Simple output - combined string
+        const simplified = simplifyPaths(paths);
+        // Skip if no real branches (only "true")
+        if (simplified.length === 1 && simplified[0] === 'true')
+            continue;
+        output[func.name] = simplified;
+        totalPaths += simplified.length;
+    }
+    const pathsName = suiteNameSnake ? `recon-${suiteNameSnake}-paths.json` : 'recon-paths.json';
+    const pathsFilePath = path.join(foundryRoot, pathsName);
+    await fs.writeFile(pathsFilePath, JSON.stringify(output, null, 2));
+    console.log(`[recon-generate] Wrote paths file to ${pathsFilePath}`);
+};
+exports.runPaths = runPaths;
+// ==================== Source Helpers ====================
+function findContract(units, name) {
+    for (const unit of units) {
+        for (const contract of unit.vContracts) {
+            if (contract.name === name)
+                return contract;
+        }
+    }
+    return null;
+}
+function findFunction(units, contractName, funcName) {
+    const contract = findContract(units, contractName);
+    if (!contract)
+        return null;
+    for (const func of contract.vFunctions) {
+        if (func.name === funcName && func.implemented)
+            return func;
+    }
+    // Check base contracts
+    for (const baseContract of contract.vLinearizedBaseContracts) {
+        if (baseContract.id === contract.id)
+            continue;
+        for (const f of baseContract.vFunctions) {
+            if (f.name === funcName && f.implemented)
+                return f;
+        }
+    }
+    return null;
+}
+function findExternalCall(func) {
+    if (!func.vBody)
+        return null;
+    const calls = func.vBody.getChildrenByType(solc_typed_ast_1.FunctionCall);
+    for (const call of calls) {
+        const expr = call.vExpression;
+        if (expr instanceof solc_typed_ast_1.MemberAccess) {
+            const baseType = expr.vExpression.typeString || '';
+            if (baseType.startsWith('contract ')) {
+                const match = baseType.match(/contract\s+(\w+)/);
+                if (match && !SKIP_CONTRACTS.has(match[1])) {
+                    return {
+                        contract: match[1],
+                        function: expr.memberName,
+                        args: call.vArguments
+                    };
+                }
+            }
+        }
+    }
+    return null;
+}
+function buildParamMapping(func, extCall) {
+    const mapping = new Map();
+    for (const param of func.vParameters.vParameters) {
+        mapping.set(param.name, param.name);
+    }
+    return mapping;
+}
+// ==================== Path Enumeration ====================
+class PathEnumerator {
+    constructor(sourceUnits, paramMap) {
+        this.pathIdCounter = 0;
+        this.branchPoints = 0;
+        this.sourceUnits = sourceUnits;
+        this.paramMap = new Map(paramMap);
+    }
+    enumerate(callTree) {
+        this.pathIdCounter = 0;
+        this.branchPoints = 0;
+        const paths = this.processCallTree(callTree);
+        return paths
+            .filter(p => p.result === 'success')
+            .map(p => ({ id: p.id, conditions: p.conditions, requires: p.requires, result: p.result }));
+    }
+    processCallTree(node) {
+        const def = node.definition;
+        // Process children first (leaf to root)
+        const childPathsMap = new Map();
+        for (const child of node.children) {
+            if (child.fnCall instanceof solc_typed_ast_1.ModifierInvocation)
+                continue;
+            const savedMap = new Map(this.paramMap);
+            this.updateParamMap(child);
+            const childPaths = this.processCallTree(child);
+            childPathsMap.set(child.nodeId, childPaths);
+            this.paramMap = savedMap;
+        }
+        // Process function body
+        let activePaths = [{
+                id: ++this.pathIdCounter,
+                conditions: [],
+                requires: [],
+                terminated: false
+            }];
+        if (def.vBody) {
+            activePaths = this.walkBlock(def.vBody, activePaths, node, childPathsMap);
+        }
+        // Mark non-terminated as success
+        for (const p of activePaths) {
+            if (!p.terminated) {
+                p.terminated = true;
+                p.result = 'success';
+            }
+        }
+        return activePaths;
+    }
+    updateParamMap(node) {
+        const params = node.definition.vParameters.vParameters;
+        const args = node.callArgs;
+        for (let i = 0; i < params.length && i < args.length; i++) {
+            if (params[i].name && args[i]) {
+                this.paramMap.set(params[i].name, this.resolveExpr(args[i]));
+            }
+        }
+    }
+    walkBlock(block, paths, node, childPaths) {
+        for (const stmt of block.vStatements) {
+            if (paths.every(p => p.terminated))
+                break;
+            paths = this.processStatement(stmt, paths, node, childPaths);
+        }
+        return paths;
+    }
+    processStatement(stmt, paths, node, childPaths) {
+        if (stmt instanceof solc_typed_ast_1.IfStatement) {
+            return this.handleIf(stmt, paths, node, childPaths);
+        }
+        if (stmt instanceof solc_typed_ast_1.TryStatement) {
+            return this.handleTryCatch(stmt, paths, node, childPaths);
+        }
+        if (stmt instanceof solc_typed_ast_1.Return) {
+            for (const p of paths)
+                if (!p.terminated) {
+                    p.terminated = true;
+                    p.result = 'success';
+                }
+            return paths;
+        }
+        if (stmt instanceof solc_typed_ast_1.RevertStatement) {
+            for (const p of paths)
+                if (!p.terminated) {
+                    p.terminated = true;
+                    p.result = 'revert';
+                }
+            return paths;
+        }
+        if (stmt instanceof solc_typed_ast_1.Block || stmt instanceof solc_typed_ast_1.UncheckedBlock) {
+            return this.walkBlock(stmt, paths, node, childPaths);
+        }
+        // Check for require/assert
+        paths = this.checkRequire(stmt, paths);
+        // Check for external calls (add as constraint - must succeed)
+        paths = this.checkExternalCalls(stmt, paths);
+        // Check for internal calls
+        paths = this.checkInternalCalls(stmt, paths, node, childPaths);
+        return paths;
+    }
+    handleTryCatch(stmt, paths, node, childPaths) {
+        this.branchPoints++;
+        // Get the external call expression
+        const extCall = stmt.vExternalCall;
+        const callExpr = this.formatExternalCall(extCall);
+        const results = [];
+        for (const path of paths) {
+            if (path.terminated) {
+                results.push(path);
+                continue;
+            }
+            // Process each clause
+            for (const clause of stmt.vClauses) {
+                if (clause.errorName === '') {
+                    // Success clause (try block) - external call succeeds
+                    const successPath = {
+                        id: ++this.pathIdCounter,
+                        conditions: [...path.conditions, {
+                                original: callExpr,
+                                resolved: callExpr,
+                                mustBeTrue: true
+                            }],
+                        requires: [...path.requires],
+                        terminated: false
+                    };
+                    const successResults = this.walkBlock(clause.vBlock, [successPath], node, childPaths);
+                    results.push(...successResults);
+                }
+                else {
+                    // Catch clause - external call fails
+                    const catchPath = {
+                        id: ++this.pathIdCounter,
+                        conditions: [...path.conditions, {
+                                original: callExpr,
+                                resolved: callExpr,
+                                mustBeTrue: false // negated - call failed
+                            }],
+                        requires: [...path.requires],
+                        terminated: false
+                    };
+                    const catchResults = this.walkBlock(clause.vBlock, [catchPath], node, childPaths);
+                    results.push(...catchResults);
+                }
+            }
+        }
+        return results;
+    }
+    checkExternalCalls(stmt, paths) {
+        var _a, _b;
+        // Find all function calls in this statement
+        const calls = ((_b = (_a = stmt).getChildrenByType) === null || _b === void 0 ? void 0 : _b.call(_a, solc_typed_ast_1.FunctionCall)) || [];
+        for (const call of calls) {
+            // Check if it's a high-level external call
+            if ((0, utils_1.highLevelCall)(call)) {
+                const callExpr = this.formatExternalCall(call);
+                // Add as a constraint - external call must succeed
+                for (const p of paths) {
+                    if (!p.terminated) {
+                        p.requires.push({
+                            original: callExpr,
+                            resolved: callExpr,
+                            mustBeTrue: true
+                        });
+                    }
+                }
+            }
+        }
+        return paths;
+    }
+    formatExternalCall(call) {
+        if (call.vExpression instanceof solc_typed_ast_1.MemberAccess) {
+            const base = call.vExpression.vExpression;
+            const func = call.vExpression.memberName;
+            const baseStr = this.resolveExpr(base);
+            const args = call.vArguments.map(a => this.resolveExpr(a)).join(', ');
+            return `${baseStr}.${func}(${args})`;
+        }
+        return this.safeToSource(call);
+    }
+    handleIf(stmt, paths, node, childPaths) {
+        this.branchPoints++;
+        const condOrig = this.safeToSource(stmt.vCondition);
+        const condResolved = this.resolveExpr(stmt.vCondition);
+        const results = [];
+        for (const path of paths) {
+            if (path.terminated) {
+                results.push(path);
+                continue;
+            }
+            // True branch
+            const truePath = {
+                id: ++this.pathIdCounter,
+                conditions: [...path.conditions, { original: condOrig, resolved: condResolved, mustBeTrue: true }],
+                requires: [...path.requires],
+                terminated: false
+            };
+            if (stmt.vTrueBody) {
+                const trueResults = stmt.vTrueBody instanceof solc_typed_ast_1.Block || stmt.vTrueBody instanceof solc_typed_ast_1.UncheckedBlock
+                    ? this.walkBlock(stmt.vTrueBody, [truePath], node, childPaths)
+                    : this.processStatement(stmt.vTrueBody, [truePath], node, childPaths);
+                results.push(...trueResults);
+            }
+            else {
+                results.push(truePath);
+            }
+            // False branch
+            const falsePath = {
+                id: ++this.pathIdCounter,
+                conditions: [...path.conditions, { original: condOrig, resolved: condResolved, mustBeTrue: false }],
+                requires: [...path.requires],
+                terminated: false
+            };
+            if (stmt.vFalseBody) {
+                const falseResults = stmt.vFalseBody instanceof solc_typed_ast_1.Block || stmt.vFalseBody instanceof solc_typed_ast_1.UncheckedBlock
+                    ? this.walkBlock(stmt.vFalseBody, [falsePath], node, childPaths)
+                    : this.processStatement(stmt.vFalseBody, [falsePath], node, childPaths);
+                results.push(...falseResults);
+            }
+            else {
+                results.push(falsePath);
+            }
+        }
+        return results;
+    }
+    checkRequire(stmt, paths) {
+        var _a, _b;
+        const calls = ((_b = (_a = stmt).getChildrenByType) === null || _b === void 0 ? void 0 : _b.call(_a, solc_typed_ast_1.FunctionCall)) || [];
+        for (const call of calls) {
+            const expr = call.vExpression;
+            if (expr instanceof solc_typed_ast_1.Identifier && (expr.name === 'require' || expr.name === 'assert')) {
+                if (call.vArguments.length > 0) {
+                    const cond = call.vArguments[0];
+                    const condOrig = this.safeToSource(cond);
+                    const condResolved = this.resolveExpr(cond);
+                    for (const p of paths) {
+                        if (!p.terminated) {
+                            p.requires.push({ original: condOrig, resolved: condResolved, mustBeTrue: true });
+                        }
+                    }
+                }
+            }
+        }
+        return paths;
+    }
+    checkInternalCalls(stmt, paths, node, childPaths) {
+        var _a, _b;
+        const calls = ((_b = (_a = stmt).getChildrenByType) === null || _b === void 0 ? void 0 : _b.call(_a, solc_typed_ast_1.FunctionCall)) || [];
+        for (const call of calls) {
+            for (const child of node.children) {
+                if (child.fnCall instanceof solc_typed_ast_1.ModifierInvocation)
+                    continue;
+                if (child.fnCall.id === call.id && childPaths.has(child.nodeId)) {
+                    const cPaths = childPaths.get(child.nodeId);
+                    const merged = [];
+                    for (const p of paths) {
+                        if (p.terminated) {
+                            merged.push(p);
+                            continue;
+                        }
+                        for (const cp of cPaths) {
+                            if (cp.result === 'revert')
+                                continue;
+                            merged.push({
+                                id: ++this.pathIdCounter,
+                                conditions: [...p.conditions, ...cp.conditions],
+                                requires: [...p.requires, ...cp.requires],
+                                terminated: false
+                            });
+                        }
+                    }
+                    if (merged.length > 0)
+                        paths = merged;
+                }
+            }
+        }
+        return paths;
+    }
+    resolveExpr(expr) {
+        if (expr instanceof solc_typed_ast_1.Literal)
+            return expr.value || '0';
+        if (expr instanceof solc_typed_ast_1.Identifier) {
+            const name = expr.name;
+            if (this.paramMap.has(name))
+                return this.paramMap.get(name);
+            // State variables - no prefix needed, context makes it clear
+            return name;
+        }
+        if (expr instanceof solc_typed_ast_1.MemberAccess) {
+            const base = expr.vExpression;
+            if (base instanceof solc_typed_ast_1.Identifier && ['msg', 'block', 'tx'].includes(base.name)) {
+                return `${base.name}.${expr.memberName}`;
+            }
+            return `${this.resolveExpr(base)}.${expr.memberName}`;
+        }
+        if (expr instanceof solc_typed_ast_1.IndexAccess) {
+            const base = this.resolveExpr(expr.vBaseExpression);
+            const idx = expr.vIndexExpression ? this.resolveExpr(expr.vIndexExpression) : '0';
+            return `${base}[${idx}]`;
+        }
+        if (expr instanceof solc_typed_ast_1.BinaryOperation) {
+            const left = this.resolveExpr(expr.vLeftExpression);
+            const right = this.resolveExpr(expr.vRightExpression);
+            return `(${left} ${expr.operator} ${right})`;
+        }
+        if (expr instanceof solc_typed_ast_1.UnaryOperation) {
+            const sub = this.resolveExpr(expr.vSubExpression);
+            return expr.prefix ? `${expr.operator}${sub}` : `${sub}${expr.operator}`;
+        }
+        if (expr instanceof solc_typed_ast_1.FunctionCall && expr.kind === solc_typed_ast_1.FunctionCallKind.TypeConversion && expr.vArguments.length > 0) {
+            return this.resolveExpr(expr.vArguments[0]);
+        }
+        return this.safeToSource(expr);
+    }
+    safeToSource(node) {
+        try {
+            return (0, utils_1.toSource)(node);
+        }
+        catch {
+            return String(node);
+        }
+    }
+}
+// ==================== Path Simplification ====================
+function simplifyPaths(paths) {
+    if (paths.length === 0)
+        return [];
+    // Extract unique branches
+    const branches = new Map();
+    for (const p of paths) {
+        for (const c of p.conditions) {
+            branches.set(c.resolved, true);
+        }
+    }
+    // Find minimum covering set (greedy)
+    const needToCover = new Set();
+    for (const key of branches.keys()) {
+        needToCover.add(`T:${key}`);
+        needToCover.add(`F:${key}`);
+    }
+    const selected = [];
+    const covered = new Set();
+    while (covered.size < needToCover.size) {
+        let bestPath = null;
+        let bestNewCoverage = 0;
+        for (const path of paths) {
+            if (selected.includes(path))
+                continue;
+            let newCoverage = 0;
+            for (const c of path.conditions) {
+                const key = c.mustBeTrue ? `T:${c.resolved}` : `F:${c.resolved}`;
+                if (needToCover.has(key) && !covered.has(key))
+                    newCoverage++;
+            }
+            if (newCoverage > bestNewCoverage) {
+                bestNewCoverage = newCoverage;
+                bestPath = path;
+            }
+        }
+        if (!bestPath || bestNewCoverage === 0)
+            break;
+        selected.push(bestPath);
+        for (const c of bestPath.conditions) {
+            covered.add(c.mustBeTrue ? `T:${c.resolved}` : `F:${c.resolved}`);
+        }
+    }
+    if (selected.length === 0)
+        selected.push(paths[0]);
+    // Format as strings - include both conditions and external call requires
+    return selected.map(p => {
+        const conds = p.conditions.map(c => {
+            const clean = c.resolved.replace(/storage\./g, '').replace(/^\((.+)\)$/, '$1');
+            return c.mustBeTrue ? clean : negateCond(clean);
+        });
+        // Add external call requires (detect by pattern: has dot and parentheses)
+        // Filter out SafeCast overflow checks (noise)
+        const extCalls = p.requires
+            .filter(r => r.resolved.includes('.') && r.resolved.includes('('))
+            .filter(r => !isOverflowCheck(r.resolved))
+            .map(r => r.mustBeTrue ? r.resolved : `!${r.resolved}`);
+        const allConds = [...conds, ...extCalls];
+        return allConds.join(' && ') || 'true';
+    });
+}
+// Detect SafeCast overflow guards like (x <= type(uint128).max)
+function isOverflowCheck(s) {
+    return /<=\s*type\(u?int\d+\)\.max/.test(s);
+}
+function negateCond(cond) {
+    if (cond.startsWith('!'))
+        return cond.slice(1);
+    if (cond.includes('=='))
+        return cond.replace('==', '!=');
+    if (cond.includes('!='))
+        return cond.replace('!=', '==');
+    if (cond.includes('>='))
+        return cond.replace('>=', '<');
+    if (cond.includes('<='))
+        return cond.replace('<=', '>');
+    if (cond.includes('>') && !cond.includes('>='))
+        return cond.replace('>', '<=');
+    if (cond.includes('<') && !cond.includes('<='))
+        return cond.replace('<', '>=');
+    return `!(${cond})`;
+}

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-import { ASTNode } from "solc-typed-ast";
+import { ASTNode, Expression, FunctionCall, FunctionDefinition, ModifierDefinition, ModifierInvocation, Statement } from "solc-typed-ast";
 export declare enum Actor {
     ACTOR = "actor",
     ADMIN = "admin"
@@ -54,3 +54,13 @@ export type RecordItem = {
     children: RecordItem[];
     callType?: CallType;
 };
+export type CallTree = {
+    nodeId: number;
+    definition: FunctionDefinition | ModifierDefinition;
+    fnCall?: FunctionCall | ModifierInvocation;
+    callArgs: Expression[];
+    callContext?: Statement;
+    children: CallTree[];
+    isRecursive?: boolean;
+    recursiveTargetNodeId?: number;
+};

package/dist/utils.d.ts

@@ -1,4 +1,4 @@
-import { ASTNode, ContractDefinition, Assignment, FunctionCall, FunctionDefinition, VariableDeclaration } from 'solc-typed-ast';
+import { ASTNode, ContractDefinition, Assignment, FunctionCall, FunctionDefinition, VariableDeclaration, EventDefinition, ErrorDefinition } from 'solc-typed-ast';
 import { CallType } from './types';
 export declare function fileExists(p: string): Promise<boolean>;
 export declare function getFoundryConfigPath(workspaceRoot: string, override?: string): string;
@@ -29,3 +29,13 @@ export declare function toSource(node: ASTNode, version?: string): string;
 export declare function getCallType(fnCall: FunctionCall): CallType;
 export declare const getFunctionName: (fnDef: FunctionDefinition) => string;
 export declare const signatureEquals: (a: FunctionDefinition, b: FunctionDefinition) => boolean;
+export declare function getSignature(definition: FunctionDefinition | EventDefinition | ErrorDefinition): string;
+export declare function getEnclosingContract(node: ASTNode): ContractDefinition | undefined;
+export declare function resolveOverride(root: ContractDefinition, signature: string): FunctionDefinition | undefined;
+export declare function idToContract(root: ContractDefinition, id: number): ContractDefinition | undefined;
+export declare function forwardLinearization(root: ContractDefinition): ContractDefinition[];
+/**
+ * Resolve the `super` call according to Solidity's C3 linearisation of the root
+ * contract. `current` is the contract whose code contains the `super` call.
+ */
+export declare function resolveSuper(root: ContractDefinition, current: ContractDefinition, signature: string): FunctionDefinition | undefined;

package/dist/utils.js

@@ -58,6 +58,12 @@ exports.getDeepRef = getDeepRef;
 exports.getDefinitions = getDefinitions;
 exports.toSource = toSource;
 exports.getCallType = getCallType;
+exports.getSignature = getSignature;
+exports.getEnclosingContract = getEnclosingContract;
+exports.resolveOverride = resolveOverride;
+exports.idToContract = idToContract;
+exports.forwardLinearization = forwardLinearization;
+exports.resolveSuper = resolveSuper;
 const fs = __importStar(require("fs/promises"));
 const path = __importStar(require("path"));
 const solc_typed_ast_1 = require("solc-typed-ast");
@@ -349,3 +355,84 @@ const signatureEquals = (a, b) => {
     return a.stateMutability === b.stateMutability;
 };
 exports.signatureEquals = signatureEquals;
+function getSignature(definition) {
+    let name;
+    if (definition instanceof solc_typed_ast_1.FunctionDefinition) {
+        if (definition.kind === solc_typed_ast_1.FunctionKind.Constructor) {
+            name = 'constructor';
+        }
+        else if (definition.kind === solc_typed_ast_1.FunctionKind.Fallback) {
+            name = 'fallback';
+        }
+        else if (definition.kind === solc_typed_ast_1.FunctionKind.Receive) {
+            name = 'receive';
+        }
+        else {
+            name = definition.name;
+        }
+    }
+    else {
+        name = definition.name;
+    }
+    const paramTypes = definition.vParameters.vParameters.map(param => param.typeString).join(',');
+    return `${name}(${paramTypes})`;
+}
+function getEnclosingContract(node) {
+    let cur = node;
+    while (cur) {
+        if (cur instanceof solc_typed_ast_1.FunctionDefinition && cur.vScope instanceof solc_typed_ast_1.ContractDefinition) {
+            return cur.vScope;
+        }
+        cur = cur.parent;
+    }
+    return undefined;
+}
+function resolveOverride(root, signature) {
+    for (const ctr of forwardLinearization(root)) {
+        const match = ctr.vFunctions.find(fn => getSignature(fn) === signature);
+        if (match)
+            return match;
+    }
+    return undefined;
+}
+function idToContract(root, id) {
+    try {
+        return root.requiredContext.locate(id);
+    }
+    catch {
+        return undefined;
+    }
+}
+// Build forward (source-order) linearized list: root, then direct bases left->right, then their bases recursively without duplicates.
+function forwardLinearization(root) {
+    // Solidity compiler provides the C3 linearized order in `linearizedBaseContracts`.
+    // We rely on that order directly; it already starts with `root` and follows the
+    // resolution order used for `super`.
+    const ids = root.linearizedBaseContracts;
+    const contracts = [];
+    for (const id of ids) {
+        const ctr = idToContract(root, id);
+        if (ctr)
+            contracts.push(ctr);
+    }
+    return contracts;
+}
+/**
+ * Resolve the `super` call according to Solidity's C3 linearisation of the root
+ * contract. `current` is the contract whose code contains the `super` call.
+ */
+function resolveSuper(root, current, signature) {
+    // Linearised list of contract IDs for `root` (e.g. [D, B, C, A])
+    const linearContracts = forwardLinearization(root);
+    // Find index of the current contract
+    const idx = linearContracts.findIndex(c => c.id === current.id);
+    if (idx === -1)
+        return undefined;
+    // Search forward for first contract implementing the function
+    for (let i = idx + 1; i < linearContracts.length; i++) {
+        const cand = linearContracts[i].vFunctions.find(fn => getSignature(fn) === signature);
+        if (cand)
+            return cand;
+    }
+    return undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "recon-generate",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "description": "CLI to scaffold Recon fuzzing suite inside Foundry projects",
   "main": "dist/index.js",
   "bin": {