seer-mcp 0.1.0

package/tests/fixtures-service/trpc_client.ts

@@ -0,0 +1,39 @@
+// Fixture: tRPC CLIENT CALLS. Each call goes through the trpc proxy and
+// terminates in one of {query, mutate, useQuery, useMutation, subscribe}.
+
+declare const trpc: any;
+declare const api: any;
+declare const someOtherObject: any;
+
+export async function fetchUser(id: string): Promise<unknown> {
+  // operation = 'user.getById' — last segment 'getById' matches userRouter.getById
+  return trpc.user.getById.query({ id });
+}
+
+export async function createUserClient(name: string): Promise<unknown> {
+  return trpc.user.create.mutate({ name });
+}
+
+export async function deleteUserClient(id: string): Promise<unknown> {
+  return trpc.user.delete.mutate({ id });
+}
+
+// React-Query hook variants — useQuery / useMutation map to query / mutation.
+export function useUser(id: string): unknown {
+  return trpc.user.getById.useQuery({ id });
+}
+
+export function useCreateUser(): unknown {
+  return trpc.user.create.useMutation();
+}
+
+// 'api' proxy variant — many monorepos name the root 'api'.
+export function viaApi(id: string): unknown {
+  return api.user.getById.query({ id });
+}
+
+// Negative case: an unrelated object that happens to have a .query method —
+// must NOT be classified as a tRPC client call (root name isn't a known proxy).
+export function notATrpcCall(): unknown {
+  return someOtherObject.foo.bar.query({});
+}

package/tests/fixtures-service/trpc_server.ts

@@ -0,0 +1,39 @@
+// Fixture: tRPC procedure DEFINITIONS (server side).
+// Each procedure has a deterministic key (`getById`, `create`, `delete`) — the
+// resolver matches client `trpc.user.getById.query()` against the procedure
+// whose operation == 'getById'.
+
+import { z } from 'zod';
+
+declare const publicProcedure: any;
+declare const protectedProcedure: any;
+declare const router: any;
+
+export function getUserById({ input }: any): any {
+  return { id: input.id };
+}
+
+export function createUser({ input }: any): any {
+  return { id: 'new', name: input.name };
+}
+
+export function deleteUser({ input }: any): any {
+  return { ok: true };
+}
+
+export const userRouter = router({
+  // operation = 'getById', method = QUERY
+  getById: publicProcedure
+    .input(z.object({ id: z.string() }))
+    .query(getUserById),
+
+  // operation = 'create', method = MUTATION
+  create: protectedProcedure
+    .input(z.object({ name: z.string() }))
+    .mutation(createUser),
+
+  // operation = 'delete', method = MUTATION  (inline arrow handler)
+  delete: protectedProcedure
+    .input(z.object({ id: z.string() }))
+    .mutation(({ input }: any) => deleteUser({ input })),
+});

package/tests/fixtures-service/user_service.proto

@@ -0,0 +1,33 @@
+// Test fixture for gRPC service detection.
+// The proto scanner should emit one route per rpc with operation="Service/Method".
+
+syntax = "proto3";
+
+package user.v1;
+
+service UserService {
+  // Single response RPC
+  rpc GetUser   (GetUserRequest)   returns (GetUserResponse);
+  // Server-streaming RPC
+  rpc ListUsers (ListUsersRequest) returns (stream User);
+  // Mutation-style RPC with HTTP annotation
+  rpc CreateUser (CreateUserRequest) returns (CreateUserResponse) {
+    option (google.api.http) = { post: "/v1/users" body: "*" };
+  }
+}
+
+service AuthService {
+  rpc Login  (LoginRequest)  returns (LoginResponse);
+  rpc Logout (LogoutRequest) returns (LogoutResponse);
+}
+
+message GetUserRequest  { string id = 1; }
+message GetUserResponse { string id = 1; string name = 2; }
+message ListUsersRequest {}
+message User             { string id = 1; string name = 2; }
+message CreateUserRequest  { string name = 1; }
+message CreateUserResponse { string id = 1; }
+message LoginRequest  { string username = 1; string password = 2; }
+message LoginResponse { string token = 1; }
+message LogoutRequest  { string token = 1; }
+message LogoutResponse { bool ok = 1; }

package/tests/fixtures-trackcd/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "trackcd-cargo"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = "1.0"
+tokio = { version = "1.0", features = ["full"] }
+
+[dev-dependencies]
+criterion = "0.5"

package/tests/fixtures-trackcd/SpringController.java

@@ -0,0 +1,36 @@
+// Spring Boot mapping annotations + System.getenv.
+package com.example.demo;
+
+import org.springframework.web.bind.annotation.*;
+
+@RestController
+@RequestMapping("/api")
+public class SpringController {
+
+    @GetMapping("/users")
+    public String listUsers() {
+        String db = System.getenv("DATABASE_URL");
+        if (db == null) {
+            return "no-db";
+        } else if (db.startsWith("postgres")) {
+            return "pg";
+        } else {
+            return "other";
+        }
+    }
+
+    @PostMapping("/users")
+    public String createUser(@RequestBody String body) {
+        return "created";
+    }
+
+    @DeleteMapping("/users/{id}")
+    public String deleteUser(@PathVariable String id) {
+        return "deleted";
+    }
+
+    @RequestMapping(value = "/items", method = RequestMethod.GET)
+    public String listItems() {
+        return "items";
+    }
+}

package/tests/fixtures-trackcd/auth_service.ts

@@ -0,0 +1,19 @@
+// Used by tests directory below — to verify test-edge synthesis works.
+export class AuthService {
+  login(username: string, password: string): boolean {
+    if (!username || !password) return false;
+    return validateCredentials(username, password);
+  }
+
+  logout(token: string): void {
+    invalidateToken(token);
+  }
+}
+
+export function validateCredentials(username: string, password: string): boolean {
+  return username === password;
+}
+
+export function invalidateToken(_token: string): void {
+  // no-op
+}

package/tests/fixtures-trackcd/complex_module.py

@@ -0,0 +1,50 @@
+# Complexity fixture: deliberately nested branches for cyclomatic / cognitive tests.
+
+def simple_function(x):
+    return x + 1
+
+
+def branchy_function(x, y):
+    if x > 0:
+        if y > 0:
+            if x > y:
+                return "x"
+            else:
+                return "y"
+        else:
+            return "x-only"
+    elif x < 0:
+        return "neg"
+    else:
+        return "zero"
+
+
+def loopy_function(items):
+    total = 0
+    for item in items:
+        if item > 0:
+            for sub in item:
+                if sub != 0:
+                    total += sub
+                else:
+                    continue
+        elif item < 0:
+            try:
+                total -= item
+            except Exception:
+                pass
+    return total
+
+
+class Calculator:
+    def add(self, a, b):
+        return a + b
+
+    def divide(self, a, b):
+        if b == 0:
+            raise ValueError("zero")
+        if a < 0 and b < 0:
+            return abs(a) / abs(b)
+        elif a < 0:
+            return -abs(a) / b
+        return a / b

package/tests/fixtures-trackcd/express_app.js

@@ -0,0 +1,30 @@
+// Express-style route registrations for the route extractor test.
+const express = require('express');
+const app = express();
+
+function listUsers(req, res) {
+  const dbUrl = process.env.DATABASE_URL;
+  const timeoutMs = process.env["TIMEOUT_MS"];
+  if (req.query.active) {
+    return res.json({ active: true });
+  } else if (req.query.archived) {
+    return res.json({ archived: true });
+  } else {
+    return res.json({ all: true });
+  }
+}
+
+function createUser(req, res) {
+  return res.status(201).json({ created: true });
+}
+
+function deleteUser(req, res) {
+  return res.status(204).end();
+}
+
+app.get('/users', listUsers);
+app.post('/users', createUser);
+app.delete('/users/:id', deleteUser);
+app.put('/users/:id', (req, res) => res.json({}));
+
+module.exports = app;

package/tests/fixtures-trackcd/fastapi_app.py

@@ -0,0 +1,49 @@
+# FastAPI + Flask route + env var fixture.
+import os
+from fastapi import FastAPI
+from flask import Flask, request
+
+app = FastAPI()
+flask_app = Flask(__name__)
+
+
+def get_db_url():
+    return os.getenv("DATABASE_URL", "sqlite:///dev.db")
+
+
+def feature_flag():
+    return os.environ.get("FEATURE_FLAG", "off")
+
+
+def secret_key():
+    return os.environ["SECRET_KEY"]
+
+
+@app.get("/items/{item_id}")
+def read_item(item_id: int):
+    if item_id < 0:
+        return {"error": "negative"}
+    elif item_id == 0:
+        return {"zero": True}
+    else:
+        for i in range(item_id):
+            if i % 2 == 0:
+                continue
+        return {"item_id": item_id, "url": get_db_url()}
+
+
+@app.post("/items")
+def create_item(name: str):
+    return {"name": name, "key": secret_key()}
+
+
+@flask_app.route("/health")
+def health():
+    return {"ok": True}
+
+
+@flask_app.route("/users", methods=["GET", "POST"])
+def users_handler():
+    if request.method == "POST":
+        return {"created": True}
+    return {"list": []}

package/tests/fixtures-trackcd/fastify_object_routes.js

@@ -0,0 +1,32 @@
+// Fastify object-style route registrations — regression fixture for the
+// `app.route({ method, url, handler })` shape that was claimed-but-not-
+// implemented before bug 6 was fixed.
+const fastify = require('fastify');
+const app = fastify();
+
+function getThing(req, reply) { return { ok: true }; }
+function upsertThing(req, reply) { return { upserted: true }; }
+function deleteThing(req, reply) { return { deleted: true }; }
+
+// Single-method object form
+app.route({
+  method: 'GET',
+  url: '/things/:id',
+  handler: getThing,
+});
+
+// Multi-method object form (array of methods → one route each)
+app.route({
+  method: ['PUT', 'PATCH'],
+  url: '/things/:id',
+  handler: upsertThing,
+});
+
+// Order of fields shouldn't matter — handler first, url last.
+app.route({
+  handler: deleteThing,
+  method: 'DELETE',
+  url: '/things/:id',
+});
+
+module.exports = app;

package/tests/fixtures-trackcd/go.mod

@@ -0,0 +1,8 @@
+module github.com/example/trackcd
+
+go 1.21
+
+require (
+	github.com/spf13/cobra v1.7.0
+	github.com/stretchr/testify v1.8.4
+)

package/tests/fixtures-trackcd/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "trackcd-fixture",
+  "version": "1.0.0",
+  "dependencies": {
+    "express": "^4.18.2",
+    "lodash": "^4.17.21"
+  },
+  "devDependencies": {
+    "jest": "^29.0.0",
+    "typescript": "^5.0.0"
+  },
+  "peerDependencies": {
+    "react": "^18.0.0"
+  }
+}

package/tests/fixtures-trackcd/requirements.txt

@@ -0,0 +1,4 @@
+# Top-level requirements
+requests>=2.31.0
+fastapi==0.104.0
+flask~=3.0.0

package/tests/fixtures-trackcd/tests/auth_service.test.ts

@@ -0,0 +1,13 @@
+// Test file — `tests/` directory triggers role='test' classification.
+// Calls into AuthService.login + validateCredentials should produce 'tests' edges.
+import { AuthService, validateCredentials } from '../auth_service';
+
+function testAuthServiceLogin() {
+  const svc = new AuthService();
+  const ok = svc.login('alice', 'alice');
+  return ok;
+}
+
+function testValidateCredentials() {
+  return validateCredentials('foo', 'foo');
+}

package/tests/fixtures-tracke/auth/AuthService.ts

@@ -0,0 +1,23 @@
+// Auth module entry point used by tests + billing.
+import { hashPassword } from './crypto';
+
+export class AuthService {
+  login(username: string, password: string): boolean {
+    if (!username || !password) return false;
+    const hashed = hashPassword(password);
+    return validateCredentials(username, hashed);
+  }
+
+  logout(token: string): void {
+    invalidateToken(token);
+  }
+}
+
+export function validateCredentials(username: string, password: string): boolean {
+  // Trivial check — fixture only.
+  return username.length > 0 && password.length > 0;
+}
+
+export function invalidateToken(_token: string): void {
+  // no-op
+}

package/tests/fixtures-tracke/auth/crypto.ts

@@ -0,0 +1,7 @@
+// Tiny helper kept inside the auth module so the clusterer sees a
+// same-directory shared dependency.
+export function hashPassword(pw: string): string {
+  let h = 0;
+  for (let i = 0; i < pw.length; i++) h = (h * 31 + pw.charCodeAt(i)) | 0;
+  return String(h);
+}

package/tests/fixtures-tracke/billing/Billing.ts

@@ -0,0 +1,20 @@
+// Billing module — imports auth so the file graph has a strong
+// billing → auth dependency.
+import { AuthService } from '../auth/AuthService';
+import { Invoice, formatAmount } from './Invoice';
+
+export class BillingService {
+  private auth = new AuthService();
+
+  chargeFor(userId: string, amountCents: number): Invoice | null {
+    const ok = this.auth.login(userId, 'token');
+    if (!ok) return null;
+    const inv = new Invoice(userId, amountCents);
+    inv.finalize();
+    return inv;
+  }
+}
+
+export function summariseAmount(c: number): string {
+  return formatAmount(c);
+}

package/tests/fixtures-tracke/billing/Invoice.ts

@@ -0,0 +1,10 @@
+export function formatAmount(cents: number): string {
+  return `$${(cents / 100).toFixed(2)}`;
+}
+
+export class Invoice {
+  constructor(public userId: string, public amountCents: number) {}
+  finalize(): void {
+    if (this.amountCents <= 0) throw new Error('non-positive');
+  }
+}

package/tests/fixtures-tracke/billing/server.ts

@@ -0,0 +1,17 @@
+// Express server for billing. `chargeCustomer` is the single canonical
+// route handler — it lives in the same file as the `app.post` call so
+// the route resolver (which links handlers by same-file name lookup)
+// attaches the route to it. That drives the "routeExposed" signal in
+// seer_risk.
+import express from 'express';
+import { BillingService } from './Billing';
+
+export const app = express();
+
+export function chargeCustomer(req: any, res: any): void {
+  const svc = new BillingService();
+  const inv = svc.chargeFor(req.body.userId, req.body.amountCents);
+  res.json({ ok: inv !== null });
+}
+
+app.post('/charge', chargeCustomer);

package/tests/fixtures-tracke/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "tracke-fixtures",
+  "version": "0.0.0",
+  "dependencies": {
+    "express": "^4.18.0"
+  }
+}

package/tests/fixtures-tracke/tests/auth.test.ts

@@ -0,0 +1,23 @@
+// Direct test of validateCredentials + login. Calls into auth so the
+// 'tests' edge synthesizer produces direct-coverage edges for the auth
+// module, and so seer_behavior 2.0 surfaces this as a direct-call test.
+import { AuthService, validateCredentials } from '../auth/AuthService';
+
+function testValidateDirectly() {
+  const ok = validateCredentials('alice', 'secret');
+  expect(ok).toBe(true);
+}
+
+function testLoginExercisesValidate() {
+  // login() calls validateCredentials() internally — used by the
+  // ranker to compute indirect coverage of validateCredentials.
+  const svc = new AuthService();
+  const ok = svc.login('alice', 'secret');
+  expect(ok).toBe(true);
+  expect(typeof ok).toBe('boolean');
+}
+
+// Standalone helper for assertion counting checks.
+function expect(_v: unknown) {
+  return { toBe(_e: unknown): void { /* */ } };
+}

package/tests/fixtures-tracke/tests/billing.test.ts

@@ -0,0 +1,14 @@
+// Direct billing test — covers chargeFor via BillingService. The
+// clusterer should keep billing tests near the billing module thanks to
+// the heavy test-edge weight.
+import { BillingService } from '../billing/Billing';
+
+function testChargeForReturnsInvoice() {
+  const svc = new BillingService();
+  const inv = svc.chargeFor('alice', 1000);
+  expect(inv).not.toBe(null);
+}
+
+function expect(_v: unknown) {
+  return { toBe(_e: unknown): void { /* */ }, not: { toBe(_e: unknown): void { /* */ } } };
+}

package/tests/fixtures-trackf/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "trackf-fixture",
+  "version": "0.0.1",
+  "private": true
+}

package/tests/fixtures-trackf/src/auth.ts

@@ -0,0 +1,26 @@
+// Auth module — used as the target of SCIP precision imports in tests.
+
+export class AuthService {
+  login(user: string, pass: string): boolean {
+    if (!user || !pass) return false;
+    return this.checkCredentials(user, pass);
+  }
+
+  logout(token: string): void {
+    if (!token) return;
+    this.revokeToken(token);
+  }
+
+  private checkCredentials(_user: string, _pass: string): boolean {
+    return true;
+  }
+
+  private revokeToken(_token: string): void {
+    return;
+  }
+}
+
+export function authenticate(user: string, pass: string): boolean {
+  const svc = new AuthService();
+  return svc.login(user, pass);
+}

package/tests/fixtures-trackf/src/handlers.ts

@@ -0,0 +1,35 @@
+// Two structurally identical handlers with renamed identifiers — these
+// should land in the same SimHash duplicate cluster.
+
+export function fetchUserById(id: number): { ok: boolean; data: string | null } {
+  if (id <= 0) {
+    return { ok: false, data: null };
+  }
+  const result = lookupRecord('user', id);
+  if (!result) {
+    return { ok: false, data: null };
+  }
+  return { ok: true, data: result };
+}
+
+export function fetchOrderById(orderId: number): { ok: boolean; data: string | null } {
+  if (orderId <= 0) {
+    return { ok: false, data: null };
+  }
+  const found = lookupRecord('order', orderId);
+  if (!found) {
+    return { ok: false, data: null };
+  }
+  return { ok: true, data: found };
+}
+
+// A wholly different function — should NOT cluster with the two above.
+export function sumNumbers(values: number[]): number {
+  let total = 0;
+  for (const v of values) {
+    total = total + v;
+  }
+  return total;
+}
+
+declare function lookupRecord(kind: string, id: number): string | null;

package/tests/fixtures-tracki/billing/routes.ts

@@ -0,0 +1,12 @@
+// Billing service — owns POST /api/charge and GET /users/:id
+declare const app: any;
+
+export function chargeHandler(req: any, res: any): unknown {
+  return res.send({ charged: true });
+}
+app.post('/api/charge', chargeHandler);
+
+export function getUser(req: any, res: any): unknown {
+  return res.send({ id: req.params.id });
+}
+app.get('/users/:id', getUser);

package/tests/fixtures-tracki/gateway/client.ts

@@ -0,0 +1,13 @@
+// Gateway service — calls into billing's /api/charge and /users/:id
+declare const fetch: any;
+
+export async function processPayment(amount: number): Promise<unknown> {
+  return await fetch('/api/charge', {
+    method: 'POST',
+    body: JSON.stringify({ amount }),
+  });
+}
+
+export async function fetchUser(id: string): Promise<unknown> {
+  return await fetch(`/users/${id}`, { method: 'GET' });
+}