septum 0.1.6 → 0.1.8

package/src/core/parser/extractors/laravel-semantic.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type { ExecutionChainNode, VerticalSliceRecord } from "../../../types/index.ts";
@@ -62,7 +63,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
     const parsedRoutes: ParsedRoute[] = [];
 
     for (const routeFile of routeFiles) {
-      const content = fs.readFileSync(routeFile, "utf-8");
+      const content = readOptionalSourceFile(routeFile, "utf-8");
       parsedRoutes.push(...this.parseRoutesContent(content));
     }
 
@@ -97,7 +98,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
       let behavioralInfo: import("../behavioral-analyzer.ts").MethodBehavioralSummary | null = null;
       if (controllerInfo.filePath && fs.existsSync(controllerInfo.filePath)) {
-        const controllerCode = fs.readFileSync(controllerInfo.filePath, "utf-8");
+        const controllerCode = readOptionalSourceFile(controllerInfo.filePath, "utf-8");
         const actionBody = this.extractActionBody(controllerCode, route.actionName);
         behavioralInfo = BehavioralAnalyzer.analyzeMethod(actionBody);
 
@@ -105,7 +106,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
         const requestClassName = this.detectFormRequestClass(controllerCode, route.actionName);
         if (requestClassName) {
           const reqFile = this.findClassFile("Requests", requestClassName);
-          const rules = reqFile && fs.existsSync(reqFile) ? this.extractValidationRules(fs.readFileSync(reqFile, "utf-8")) : {};
+          const rules = reqFile && fs.existsSync(reqFile) ? this.extractValidationRules(readOptionalSourceFile(reqFile, "utf-8")) : {};
           formRequestInfo = {
             className: requestClassName,
             filePath: reqFile ? path.relative(this.projectRoot, reqFile) : undefined,
@@ -117,7 +118,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
         const modelClassName = this.detectModelClass(controllerCode, route.actionName, actionBody);
         if (modelClassName) {
           const modFile = this.findClassFile("Models", modelClassName);
-          const modMetadata = modFile && fs.existsSync(modFile) ? this.extractModelMetadata(fs.readFileSync(modFile, "utf-8")) : { fillable: [], casts: {} };
+          const modMetadata = modFile && fs.existsSync(modFile) ? this.extractModelMetadata(readOptionalSourceFile(modFile, "utf-8")) : { fillable: [], casts: {} };
           modelInfo = {
             className: modelClassName,
             filePath: modFile ? path.relative(this.projectRoot, modFile) : undefined,
@@ -509,7 +510,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
     for (const c of candidates) {
       if (fs.existsSync(c)) {
-        const lines = fs.readFileSync(c, "utf-8").split("\n");
+        const lines = readOptionalSourceFile(c, "utf-8").split("\n");
         let targetLine = 1;
         for (let i = 0; i < lines.length; i++) {
           if (new RegExp(`function\\s+${actionName}\\s*\\(`, "i").test(lines[i])) {
@@ -814,7 +815,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
     for (const file of jobFiles) {
       const fullPath = path.join(jobsDir, file);
-      const content = fs.readFileSync(fullPath, "utf-8");
+      const content = readOptionalSourceFile(fullPath, "utf-8");
       const classMatch = content.match(/class\s+([A-Za-z0-9_]+)/);
       if (!classMatch) continue;
 
@@ -890,7 +891,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
     for (const file of files) {
       const fullPath = path.join(commandsDir, file);
-      const content = fs.readFileSync(fullPath, "utf-8");
+      const content = readOptionalSourceFile(fullPath, "utf-8");
       const classMatch = content.match(/class\s+([A-Za-z0-9_]+)/);
       if (!classMatch) continue;
 
@@ -969,7 +970,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
     for (const file of files) {
       const fullPath = path.join(listenersDir, file);
-      const content = fs.readFileSync(fullPath, "utf-8");
+      const content = readOptionalSourceFile(fullPath, "utf-8");
       const classMatch = content.match(/class\s+([A-Za-z0-9_]+)/);
       if (!classMatch) continue;
 

package/src/core/parser/extractors/mcp-cli-semantic.ts

@@ -1,5 +1,7 @@
+import { readOptionalSourceFile } from "../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { blankCommentsAndStrings } from "../boundary-tracker.ts";
 import type { SemanticSliceExtractor, VerticalSliceCandidate } from "./semantic-extractor.interface.ts";
 
 export class McpCliSemanticExtractor implements SemanticSliceExtractor {
@@ -18,7 +20,7 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
     const pkgPath = path.join(projectRoot, "package.json");
     if (fs.existsSync(pkgPath)) {
       try {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readOptionalSourceFile(pkgPath, "utf-8"));
         if (pkg.bin || pkg.dependencies?.["@modelcontextprotocol/sdk"]) {
           return true;
         }
@@ -44,11 +46,13 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
         for (const file of toolFiles) {
           const fullPath = path.join(mcpToolsDir, file);
           const relPath = path.relative(projectRoot, fullPath).replace(/\\/g, "/");
-          const content = fs.readFileSync(fullPath, "utf-8");
+          const content = readOptionalSourceFile(fullPath, "utf-8");
           const baseName = path.basename(file, path.extname(file));
           const snakeBase = baseName.replace(/-/g, "_");
-          const toolIdentifier =
-            registeredTools.get(snakeBase) || `${toolPrefix}_${snakeBase}`;
+
+          // MCP-07: Only create ingress slices for whitelisted public MCP tools
+          const toolIdentifier = registeredTools.get(snakeBase) || registeredTools.get(`${toolPrefix}_${snakeBase}`);
+          if (!toolIdentifier) continue;
 
           // Detect handler function (both sync and async) and its 1-indexed line number
           const handlerMatch = /export\s+(?:async\s+)?function\s+([a-zA-Z0-9_]+)/.exec(content);
@@ -143,7 +147,7 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
         for (const file of commandFiles) {
           const fullPath = path.join(cliCommandsDir, file);
           const relPath = path.relative(projectRoot, fullPath).replace(/\\/g, "/");
-          const content = fs.readFileSync(fullPath, "utf-8");
+          const content = readOptionalSourceFile(fullPath, "utf-8");
           const commandName = path.basename(file, path.extname(file));
 
           const handlerMatch = /export\s+(?:async\s+)?function\s+([a-zA-Z0-9_]+)/.exec(content);
@@ -235,7 +239,7 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
     const pkgPath = path.join(projectRoot, "package.json");
     if (fs.existsSync(pkgPath)) {
       try {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readOptionalSourceFile(pkgPath, "utf-8"));
         const rawName = typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : "mcp";
         const toolPrefix = rawName.replace(/[^a-zA-Z0-9_]/g, "_").toLowerCase() || "mcp";
         let cliBinName = rawName;
@@ -257,17 +261,53 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
     if (!fs.existsSync(serverPath)) return map;
 
     try {
-      const content = fs.readFileSync(serverPath, "utf-8");
-      const nameRegex = /name:\s*['"]([a-zA-Z0-9_-]+)['"]/g;
-      let match: RegExpExecArray | null;
-      while ((match = nameRegex.exec(content)) !== null) {
-        const fullToolName = match[1];
-        const normalized = fullToolName.replace(/-/g, "_");
-        map.set(normalized, fullToolName);
-        const withoutPrefix = normalized.replace(/^[a-z0-9]+_/, "");
-        if (withoutPrefix) {
-          map.set(withoutPrefix, fullToolName);
+      const content = readOptionalSourceFile(serverPath, "utf-8");
+      const masked = blankCommentsAndStrings(content);
+      const scan = (start: number, namesInArray: boolean) => {
+        let depth = 0;
+        const names: string[] = [];
+        const property = /\b([A-Za-z_]\w*)\s*:\s*(['"])?/y;
+        for (let i = start; i < masked.length; i++) {
+          const ch = masked[i];
+          if ("[{(".includes(ch)) depth++;
+          else if ("]})".includes(ch)) {
+            if (--depth === 0) break;
+          }
+          if (depth !== (namesInArray ? 2 : 1) || (i > 0 && /\w/.test(masked[i - 1]))) continue;
+          property.lastIndex = i;
+          const match = property.exec(masked);
+          if (!match) continue;
+          if (!namesInArray) names.push(match[1]);
+          else if (match[1] === "name" && match[2]) {
+            const quoteStart = i + match[0].lastIndexOf(match[2]);
+            const quoteEnd = masked.indexOf(match[2], quoteStart + 1);
+            const name = content.slice(quoteStart + 1, quoteEnd);
+            if (/^[A-Za-z0-9_-]+$/.test(name)) names.push(name);
+          }
+        }
+        // Unbalanced declarations are not evidence of public registration.
+        if (depth !== 0) return;
+        for (const fullToolName of names) {
+          const normalized = fullToolName.replace(/-/g, "_");
+          map.set(normalized, fullToolName);
+          const withoutPrefix = normalized.replace(/^[a-z0-9]+_/, "");
+          if (withoutPrefix) map.set(withoutPrefix, fullToolName);
+        }
+      };
+      const listCall = /setRequestHandler\s*\(\s*ListToolsRequestSchema\b/.exec(masked);
+      if (listCall) {
+        const callStart = masked.indexOf("(", listCall.index);
+        let depth = 1;
+        let end = callStart + 1;
+        for (; end < masked.length && depth; end++) {
+          if (masked[end] === "(") depth++;
+          else if (masked[end] === ")") depth--;
         }
+        const tools = /\btools\s*:\s*\[/.exec(masked.slice(callStart, end));
+        if (tools && depth === 0) scan(callStart + tools.index + tools[0].length - 1, true);
+      } else {
+        const schemas = /\bTOOL_SCHEMAS\s*=\s*\{/.exec(masked);
+        if (schemas) scan(schemas.index + schemas[0].length - 1, false);
       }
     } catch {}
     return map;

package/src/core/parser/extractors/nestjs-semantic.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type { SemanticSliceExtractor, VerticalSliceCandidate } from "./semantic-extractor.interface.ts";
@@ -14,7 +15,7 @@ export class NestJsSemanticExtractor implements SemanticSliceExtractor {
     const pkgPath = path.join(projectRoot, "package.json");
     if (fs.existsSync(pkgPath)) {
       try {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readOptionalSourceFile(pkgPath, "utf-8"));
         const deps = { ...pkg.dependencies, ...pkg.devDependencies };
         if (deps["@nestjs/core"]) return true;
       } catch {}
@@ -32,7 +33,7 @@ export class NestJsSemanticExtractor implements SemanticSliceExtractor {
 
     for (const file of controllerFiles) {
       const relPath = path.relative(projectRoot, file).replace(/\\/g, "/");
-      const content = fs.readFileSync(file, "utf-8");
+      const content = readOptionalSourceFile(file, "utf-8");
 
       // Extract @Controller('prefix')
       const controllerMatch = /@Controller\s*\(\s*['"]?([^'")]*)['"]?\s*\)[\s\S]*?export\s+class\s+([A-Za-z0-9_]+)/.exec(

package/src/core/parser/extractors/php.ts

@@ -44,10 +44,10 @@ export class PHPExtractor implements CodeExtractor {
       this.extractFromAst(rootNode, content)
     );
     if (astResult) {
-      return astResult;
+      return { ...astResult, status: "parsed" };
     }
 
-    return this.extractFallback(content);
+    return { ...this.extractFallback(content), status: "degraded" };
   }
 
   private isExternalNamespace(cleaned: string): boolean {

package/src/core/parser/extractors/python.ts

@@ -79,10 +79,10 @@ export class PythonExtractor implements CodeExtractor {
       this.extractFromAst(rootNode, content)
     );
     if (astResult) {
-      return astResult;
+      return { ...astResult, status: "parsed" };
     }
 
-    return this.extractFallback(content);
+    return { ...this.extractFallback(content), status: "degraded" };
   }
 
   private extractFallback(content: string): ParsedFileAST {

package/src/core/parser/extractors/typescript.ts

@@ -46,10 +46,10 @@ export class TypeScriptExtractor implements CodeExtractor {
     );
 
     if (treeSitterResult) {
-      return treeSitterResult;
+      return { ...treeSitterResult, status: "parsed" };
     }
 
-    return this.extractFallback(content);
+    return { ...this.extractFallback(content), status: "degraded" };
   }
 
   private resolveLanguageKey(filePath: string): string {

package/src/core/parser/schema/providers/laravel-migration-provider.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type {
@@ -35,7 +36,7 @@ export class LaravelMigrationSchemaProvider implements StackSchemaProvider {
     for (const migFile of migrationFiles) {
       const fullPath = path.join(migrationsDir, migFile);
       try {
-        const content = fs.readFileSync(fullPath, "utf-8");
+        const content = readOptionalSourceFile(fullPath, "utf-8");
         this.extractColumnsFromMigration(content, tableName, fieldsMap);
       } catch {
         // Skip unreadable files
@@ -66,7 +67,7 @@ export class LaravelMigrationSchemaProvider implements StackSchemaProvider {
         : path.join(projectRoot, entityFilePath);
       if (fs.existsSync(fullEntityPath)) {
         try {
-          const content = fs.readFileSync(fullEntityPath, "utf-8");
+          const content = readOptionalSourceFile(fullEntityPath, "utf-8");
           const tableMatch = /protected\s+\$table\s*=\s*['"]([^'"]+)['"]/.exec(content);
           if (tableMatch) {
             return tableMatch[1];
@@ -120,7 +121,7 @@ export class LaravelMigrationSchemaProvider implements StackSchemaProvider {
     if (matched.length === 0) {
       for (const f of files) {
         try {
-          const content = fs.readFileSync(path.join(migrationsDir, f), "utf-8");
+          const content = readOptionalSourceFile(path.join(migrationsDir, f), "utf-8");
           if (
             content.includes(`Schema::create('${tableName}'`) ||
             content.includes(`Schema::create("${tableName}"`) ||

package/src/core/parser/schema/providers/prisma-schema-provider.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type {
@@ -38,7 +39,7 @@ export class PrismaSchemaProvider implements StackSchemaProvider {
     if (!schemaPath) return null;
 
     try {
-      const content = fs.readFileSync(schemaPath, "utf-8");
+      const content = readOptionalSourceFile(schemaPath, "utf-8");
       const modelRegex = new RegExp(`model\\s+${entitySymbol}\\s*\\{([^}]+)\\}`, "m");
       const match = modelRegex.exec(content);
       if (!match) return null;

package/src/core/parser/tree-sitter.ts

@@ -8,6 +8,9 @@ import { PythonExtractor } from "./extractors/python.ts";
 import { TypeScriptExtractor } from "./extractors/typescript.ts";
 
 export class ASTParserEngine {
+  public static isSourceFile(filePath: string): boolean {
+    return /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs|php|py|go|rs|java|cs|rb|vue|astro|svelte)$/i.test(filePath);
+  }
   private extractors: CodeExtractor[];
 
   constructor() {
@@ -24,12 +27,14 @@ export class ASTParserEngine {
   public async parseFile(filePath: string, content: string): Promise<ParsedFileAST> {
     for (const extractor of this.extractors) {
       if (extractor.canHandle(filePath)) {
-        return extractor.extract(filePath, content);
+        const result = await extractor.extract(filePath, content);
+        return { status: "parsed", ...result };
       }
     }
 
     // Default fallback extractor for unknown file types
     return {
+      status: "unsupported",
       symbols: [],
       dependencies: [],
     };

package/src/core/parser/wasm-assets.ts

@@ -0,0 +1,17 @@
+import runtime from "web-tree-sitter/tree-sitter.wasm" with { type: "file" };
+import typescript from "tree-sitter-wasms/out/tree-sitter-typescript.wasm" with { type: "file" };
+import tsx from "tree-sitter-wasms/out/tree-sitter-tsx.wasm" with { type: "file" };
+import javascript from "tree-sitter-wasms/out/tree-sitter-javascript.wasm" with { type: "file" };
+import php from "tree-sitter-wasms/out/tree-sitter-php.wasm" with { type: "file" };
+import python from "tree-sitter-wasms/out/tree-sitter-python.wasm" with { type: "file" };
+import go from "tree-sitter-wasms/out/tree-sitter-go.wasm" with { type: "file" };
+
+export const WASM_ASSETS: Record<string, string> = {
+  "tree-sitter.wasm": runtime,
+  "tree-sitter-typescript.wasm": typescript,
+  "tree-sitter-tsx.wasm": tsx,
+  "tree-sitter-javascript.wasm": javascript,
+  "tree-sitter-php.wasm": php,
+  "tree-sitter-python.wasm": python,
+  "tree-sitter-go.wasm": go,
+};

package/src/core/parser/wasm-loader.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import Parser from "web-tree-sitter";
+import { WASM_ASSETS } from "./wasm-assets.ts";
 
 const GRAMMAR_BY_KEY: Record<string, string> = {
   // Extensions
@@ -74,6 +75,8 @@ export function resolveWasmPath(fileName: string, isCoreRuntime: boolean = false
     candidates.push(path.join(envDir, "out", fileName));
   }
 
+  if (WASM_ASSETS[fileName]) candidates.push(WASM_ASSETS[fileName]);
+
   // Tier 2: Walk up from import.meta.dir to package root
   let currentDir = getModuleDir();
   for (let depth = 0; depth < 7; depth++) {

package/src/core/resolver/call-graph-tracer.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../resources/source-files.ts";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, normalize, relative, resolve } from "node:path";
 import type {
@@ -86,7 +87,7 @@ export class CallGraphTracer {
       if (!existsSync(fullPath)) continue;
 
       try {
-        const content = readFileSync(fullPath, "utf-8");
+        const content = readOptionalSourceFile(fullPath, "utf-8");
         const lines = content.split("\n");
 
         for (let i = 0; i < lines.length; i++) {
@@ -414,7 +415,7 @@ export class CallGraphTracer {
           fileSymbols[0];
 
         const symbolDisplay = mainSymbol
-          ? `${mainSymbol.name}${mainSymbol.kind === "class" ? "::execute" : ""}`
+          ? mainSymbol.name
           : resolvedFile.path.split("/").pop()?.replace(/\.[^.]+$/, "") || "Module";
 
         // Prevent adding duplicate stages if already present, or add as refinement
@@ -428,7 +429,7 @@ export class CallGraphTracer {
             symbol: symbolDisplay,
             file: resolvedFile.path,
             line: mainSymbol?.line_start || 1,
-            description: `${stage.toUpperCase()}: ${symbolDisplay}`,
+            description: `${stage.toUpperCase()} (dependency): ${symbolDisplay}`,
           });
         }
 

package/src/core/resolver/module-resolver.ts

@@ -97,16 +97,7 @@ export class ModuleResolver {
     filePath: string,
     config: ValidatedSeptumConfig
   ): string | null {
-    const absPath = this.toAbsolutePath(filePath);
-
-    for (const [domainName, domainCfg] of Object.entries(config.domains)) {
-      const domainAbsRoot = this.toAbsolutePath(domainCfg.root);
-      if (this.isSubPathOrSame(absPath, domainAbsRoot)) {
-        return domainName;
-      }
-    }
-
-    return null;
+    return this.matchDomainByPath(filePath, config);
   }
 
   /**

package/src/core/resolver/path-resolver.ts

@@ -1,5 +1,5 @@
-import { existsSync, statSync } from "node:fs";
-import { dirname, isAbsolute, join, normalize, resolve } from "node:path";
+import { existsSync, statSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, normalize, relative, resolve } from "node:path";
 
 export const PROJECT_ROOT_MARKERS = [
   "package.json",
@@ -26,6 +26,7 @@ export function canonicalizePath(targetPath: string): string {
     return targetPath;
   }
   let abs = normalize(resolve(targetPath));
+  try { if (existsSync(abs)) abs = realpathSync(abs); } catch { /* Keep lexical paths for missing or inaccessible files. */ }
   if (process.platform === "win32") {
     abs = abs.replace(/^[a-zA-Z]:/, (m) => m.toUpperCase());
   }
@@ -104,7 +105,7 @@ export function findProjectRoot(fromPath: string): string {
     // Filesystem traversal error fallback
   }
 
-  return canonicalizePath(dirname(resolve(fromPath)));
+  return canonicalizePath(existsSync(fromPath) && statSync(fromPath).isDirectory() ? fromPath : dirname(resolve(fromPath)));
 }
 
 /**
@@ -117,7 +118,8 @@ export function findProjectRoot(fromPath: string): string {
 export function resolveWorkspaceRoot(pathHint?: string): string {
   if (pathHint && typeof pathHint === "string" && pathHint.trim()) {
     const trimmed = pathHint.trim().replace(/^['"]|['"]$/g, "");
-    const candidate = findProjectRoot(trimmed);
+    const absHint = resolve(trimmed);
+    const candidate = existsSync(absHint) && statSync(absHint).isDirectory() ? canonicalizePath(absHint) : findProjectRoot(trimmed);
     if (candidate && existsSync(candidate) && !isAppHostDirectory(candidate)) {
       setLastKnownProjectRoot(candidate);
       return candidate;
@@ -145,3 +147,54 @@ export function resolveWorkspaceRoot(pathHint?: string): string {
   // Fallback if inside app host directory: keep looking in lastKnown or return cwd
   return canonicalizePath(cwd);
 }
+
+/**
+ * Verifies that candidatePath is strictly contained within workspaceRoot.
+ * Resolves symlinks (realpath) if the path exists, and checks ancestor realpath if not yet created.
+ */
+export function isPathContained(candidatePath: string, workspaceRoot: string): boolean {
+  if (!candidatePath || !workspaceRoot) return false;
+  try {
+    const canonicalWorkspace = canonicalizePath(workspaceRoot);
+    const resolvedTarget = isAbsolute(candidatePath) ? normalize(candidatePath) : resolve(canonicalWorkspace, candidatePath);
+
+    // Lexical containment
+    const relLexical = relative(canonicalWorkspace, resolvedTarget).replace(/\\/g, "/");
+    if (relLexical === ".." || relLexical.startsWith("../") || isAbsolute(relLexical)) {
+      return false;
+    }
+
+    // Realpath / symlink containment
+    if (existsSync(resolvedTarget)) {
+      const realTarget = realpathSync(resolvedTarget);
+      const relReal = relative(canonicalWorkspace, realTarget).replace(/\\/g, "/");
+      if (relReal === ".." || relReal.startsWith("../") || isAbsolute(relReal)) {
+        return false;
+      }
+    } else {
+      let cur = dirname(resolvedTarget);
+      while (!existsSync(cur)) {
+        const parent = dirname(cur);
+        if (parent === cur) break;
+        cur = parent;
+      }
+      if (existsSync(cur)) {
+        const realCur = realpathSync(cur);
+        const relCur = relative(canonicalWorkspace, realCur).replace(/\\/g, "/");
+        if (relCur === ".." || relCur.startsWith("../") || isAbsolute(relCur)) {
+          return false;
+        }
+      }
+    }
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function assertPathContained(candidatePath: string, workspaceRoot: string, contextDescription = "Path"): void {
+  if (!isPathContained(candidatePath, workspaceRoot)) {
+    throw new Error(`${contextDescription} '${candidatePath}' escapes workspace boundary '${workspaceRoot}'.`);
+  }
+}

package/src/core/resolver/vertical-slice-tracer.ts

@@ -81,6 +81,7 @@ export class VerticalSliceTracer {
       if (exact) {
         return this.formatSuccessResponse(trimmed, exact, "exact", undefined, effectiveMaxDepth);
       }
+      return { query: trimmed, found: false, max_depth_applied: effectiveMaxDepth, message: `No vertical slice found matching query '${trimmed}'.` };
     }
 
     // 2. URI-only match: "/orders" or "orders/{id}"

package/src/core/resources/ignore.ts

@@ -0,0 +1,35 @@
+export function shouldIgnoreSourcePath(filePath: string, ignorePatterns: string[]): boolean {
+    if (filePath.replace(/\\/g, "/").split("/").some(segment => ["node_modules", "vendor", ".git", ".septum", ".strata", ".codegraph", "dist", "build", ".output", ".nuxt", ".next", ".cache", "coverage", ".turbo"].includes(segment))) return true;
+    const normPath = filePath.replace(/\\/g, "/").replace(/^\.\//, "");
+    for (const pattern of ignorePatterns) {
+      const normPattern = pattern.replace(/\\/g, "/").replace(/^\.\//, "").trim();
+      if (!normPattern) continue;
+
+      if (normPattern === "*" || normPattern === "**") {
+        return true;
+      }
+
+      if (normPath === normPattern) return true;
+
+      if (normPattern.endsWith("/**")) {
+        const prefix = normPattern.slice(0, -3);
+        if (normPath === prefix || normPath.startsWith(prefix + "/")) return true;
+      } else if (normPattern.endsWith("/*")) {
+        const prefix = normPattern.slice(0, -2);
+        if (normPath === prefix || normPath.startsWith(prefix + "/")) return true;
+      } else if (normPath.startsWith(normPattern + "/")) {
+        return true;
+      }
+
+      if (normPattern.startsWith("*.") && normPath.endsWith(normPattern.slice(1))) {
+        return true;
+      }
+
+      const segments = normPath.split("/");
+      if (segments.includes(normPattern)) {
+        return true;
+      }
+    }
+    return false;
+  }
+

package/src/core/resources/limits.ts

@@ -0,0 +1,14 @@
+export const RESOURCE_LIMITS = Object.freeze({
+  workspaces: 4,
+  workspaceIdleMs: 10 * 60_000,
+  watches: 2048,
+  pendingPaths: 1000,
+  debounceMs: 300,
+  pollMs: 5000,
+  verifyMs: 60_000,
+  sourceBytes: 2 * 1024 * 1024,
+  batchFiles: 50,
+  batchBytes: 1024 * 1024,
+  maxQueuePending: 50,
+  shutdownMs: 5000,
+});

package/src/core/resources/source-files.ts

@@ -0,0 +1,62 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { closeSync, fstatSync, openSync, readSync, statSync } from 'node:fs';
+import { relative } from 'node:path';
+import { computeContentHash } from "../ingestion/hasher.ts";
+import { RESOURCE_LIMITS } from './limits.ts';
+
+export interface SkippedSourceFile { path: string; reason: 'file_too_large' }
+export class SourceFileLimitError extends Error {
+  constructor(public readonly filePath: string) { super(`Source file exceeds ${RESOURCE_LIMITS.sourceBytes} bytes: ${filePath}`); }
+}
+export interface SourceReadFingerprint { path: string; hash: string; size: number; mtime: number }
+const reads = new AsyncLocalStorage<{skipped: Map<string, SkippedSourceFile>; inputs: Map<string, SourceReadFingerprint>}>();
+
+// Read at most the admission limit, even if the file grows after stat.
+export function readSourceFile(filePath: string, _encoding?: string): string {
+  const fd = openSync(filePath, 'r');
+  try {
+    const size = fstatSync(fd).size;
+    if (size > RESOURCE_LIMITS.sourceBytes) throw new SourceFileLimitError(filePath);
+    let buffer = Buffer.allocUnsafe(Math.min(Math.max(size + 1, 4096), RESOURCE_LIMITS.sourceBytes + 1));
+    let count = 0;
+    while (true) {
+      const read = readSync(fd, buffer, count, buffer.length - count, null);
+      if (!read) return buffer.toString('utf8', 0, count);
+      count += read;
+      if (count > RESOURCE_LIMITS.sourceBytes) throw new SourceFileLimitError(filePath);
+      if (count === buffer.length) {
+        const expanded = Buffer.allocUnsafe(Math.min(buffer.length * 2, RESOURCE_LIMITS.sourceBytes + 1));
+        buffer.copy(expanded, 0, 0, count);
+        buffer = expanded;
+      }
+    }
+  } finally { closeSync(fd); }
+}
+
+export function readOptionalSourceFile(filePath: string, encoding?: string): string {
+  try {
+    const content = readSourceFile(filePath, encoding);
+    const collector = reads.getStore();
+    if (collector) {
+      const stat = statSync(filePath);
+      collector.inputs.set(filePath, {path:filePath,hash:computeContentHash(content),size:stat.size,mtime:stat.mtimeMs});
+    }
+    return content;
+  }
+  catch (error) {
+    if (!(error instanceof SourceFileLimitError)) throw error;
+    const collector = reads.getStore();
+    if (!collector) throw error;
+    collector.skipped.set(filePath, { path: filePath, reason: 'file_too_large' });
+    const stat = statSync(filePath);
+    collector.inputs.set(filePath, {path:filePath,hash:'file_too_large',size:stat.size,mtime:stat.mtimeMs});
+    return '';
+  }
+}
+
+export async function collectSourceSkips<T>(root: string, read: () => Promise<T>): Promise<{ value: T; skipped: SkippedSourceFile[]; inputs: SourceReadFingerprint[] }> {
+  const collector = {skipped: new Map<string, SkippedSourceFile>(), inputs: new Map<string, SourceReadFingerprint>()};
+  const value = await reads.run(collector, read);
+  const rel = (file: {path:string}) => relative(root, file.path).replace(/\\/g, '/');
+  return {value, skipped:[...collector.skipped.values()].map(file => ({...file,path:rel(file)})), inputs:[...collector.inputs.values()].map(file => ({...file,path:rel(file)}))};
+}