septum 0.1.7 → 0.1.8

package/src/core/ingestion/pipeline.ts

@@ -1,5 +1,9 @@
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { shouldIgnoreSourcePath } from "../resources/ignore.ts";
+import { RESOURCE_LIMITS } from "../resources/limits.ts";
+import { readSourceFile, SourceFileLimitError, collectSourceSkips, type SkippedSourceFile, type SourceReadFingerprint } from "../resources/source-files.ts";
+import { existsSync, readdirSync, readFileSync, statSync, lstatSync, realpathSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { isPathContained, resolveWorkspaceRoot } from "../resolver/path-resolver.ts";
 import type { ParsedFileAST } from "../../types/index.ts";
 import type { ValidatedSeptumConfig } from "../config/schema.ts";
 import type { SeptumRepository } from "../database/repository.ts";
@@ -34,7 +38,21 @@ export class IngestionPipeline {
     }
   }
 
-  public async run(config: ValidatedSeptumConfig, options: { verifyContent?: boolean } = {}): Promise<IngestionMetrics> {
+  public async run(config: ValidatedSeptumConfig, options: { verifyContent?: boolean; signal?: AbortSignal } = {}): Promise<IngestionMetrics> {
+    this.repo.setMeta("sync_state", "running");
+    try {
+      const result = await this.runSync(config, options);
+      this.repo.setMeta("sync_state", "complete");
+      this.repo.setMeta("sync_error", "");
+      return result;
+    } catch (error) {
+      this.repo.setMeta("sync_state", "error");
+      this.repo.setMeta("sync_error", String(error));
+      throw error;
+    }
+  }
+
+  private async runSync(config: ValidatedSeptumConfig, options: { verifyContent?: boolean; signal?: AbortSignal }): Promise<IngestionMetrics> {
     this.ensureParserRevision();
     const startTime = performance.now();
     let filesScanned = 0;
@@ -43,9 +61,11 @@ export class IngestionPipeline {
     let symbolsIndexed = 0;
     let dependenciesIndexed = 0;
     const unsupportedFiles: string[] = [];
+    const skippedFiles: SkippedSourceFile[] = [];
+    let removedFiles = 0;
 
     let domainNames = Object.keys(config.domains);
-    const projectRoot = this.customWorkspaceRoot || process.cwd();
+    const projectRoot = this.customWorkspaceRoot || resolveWorkspaceRoot();
 
     // Auto-discovery mode if no domains explicitly declared in config
     if (domainNames.length === 0) {
@@ -71,11 +91,26 @@ export class IngestionPipeline {
       const domainCfg = config.domains[domainName];
       const domainId = this.repo.upsertDomain(domainName, domainCfg);
       const workspaceRoot = this.resolveWorkspaceRoot(config, domainCfg.root);
+      // SV-02: Enforce workspace containment during ingestion (reject traversal/symlink escape)
+      if (!isPathContained(domainCfg.root, workspaceRoot)) {
+        throw new Error(`Domain root '${domainCfg.root}' for domain '${domainName}' escapes workspace boundary '${workspaceRoot}'.`);
+      }
       const absDomainRoot = resolve(workspaceRoot, domainCfg.root);
 
-      if (!existsSync(absDomainRoot)) {
-        this.repo.files.deleteFilesNotInPaths(domainId, []);
-        continue;
+      try {
+        const rootStat = statSync(absDomainRoot);
+        if (!rootStat.isDirectory()) {
+          throw new Error(`Domain root '${domainCfg.root}' is not a directory.`);
+        }
+      } catch (err: any) {
+        if (err?.code === "ENOENT") {
+          removedFiles += this.repo.getAllFiles().filter(file => file.domain_id === domainId).length;
+          this.repo.files.deleteFilesNotInPaths(domainId, []);
+          if (removedFiles) this.repo.setMeta("slices_dirty", "1");
+          continue;
+        }
+        // SV-01: Permission or I/O failure (EACCES, EPERM, EIO). Do NOT prune, propagate error!
+        throw new Error(`Failed to access domain root '${domainCfg.root}' for domain '${domainName}': ${err.message || err}`);
       }
 
       const childDomainRoots = domainNames
@@ -90,7 +125,8 @@ export class IngestionPipeline {
         absDomainRoot,
         workspaceRoot,
         config.settings.ignore_patterns,
-        childDomainRoots
+        childDomainRoots,
+        options.signal
       );
       const activeRelPaths = new Set<string>();
 
@@ -111,8 +147,43 @@ export class IngestionPipeline {
         ast: ParsedFileAST;
       }> = [];
 
+      let batchBytes = 0;
+      const commitBatch = () => {
+        this.repo.runInTransaction(() => {
+          for (const meta of pendingMetadataUpdates) {
+            this.repo.updateFileMetadataOnly(meta.id, meta.mtimeMs, meta.sizeBytes);
+          }
+
+          if (pendingUpdates.length) this.repo.setMeta("slices_dirty", "1");
+          for (const item of pendingUpdates) {
+            const fileId = this.repo.upsertFile(
+              domainId,
+              item.relPath,
+              item.archetype,
+              item.contentHash,
+              item.lineCount,
+              item.mtimeMs,
+              item.sizeBytes
+            );
+
+            this.repo.replaceFileSymbols(fileId, item.ast.symbols);
+            this.repo.replaceFileDependencies(fileId, item.ast.dependencies);
+
+            symbolsIndexed += item.ast.symbols.length;
+            dependenciesIndexed += item.ast.dependencies.length;
+          }
+
+        });
+        pendingUpdates.length = 0;
+        pendingMetadataUpdates.length = 0;
+        batchBytes = 0;
+      };
+
       for (const { fullPath, relPath } of collectedFiles) {
+        options.signal?.throwIfAborted();
+        if (pendingMetadataUpdates.length >= RESOURCE_LIMITS.batchFiles) commitBatch();
         filesScanned++;
+        if (filesScanned % RESOURCE_LIMITS.batchFiles === 0) { await new Promise<void>(done => setTimeout(done, 0)); options.signal?.throwIfAborted(); }
         activeRelPaths.add(relPath);
 
         let stat;
@@ -139,7 +210,24 @@ export class IngestionPipeline {
         }
 
         // Tier 2: Content Hash verification
-        const content = readFileSync(fullPath, "utf-8");
+        if (sizeBytes > RESOURCE_LIMITS.sourceBytes) {
+          skippedFiles.push({path: relPath, reason: "file_too_large"});
+          if (existingFile) removedFiles++;
+          this.repo.deleteFileByPath(relPath);
+          this.repo.setMeta("slices_dirty", "1");
+          continue;
+        }
+        if (pendingUpdates.length >= RESOURCE_LIMITS.batchFiles || (batchBytes + sizeBytes > RESOURCE_LIMITS.batchBytes && pendingUpdates.length > 0)) { commitBatch(); await new Promise<void>(done => setTimeout(done, 0)); options.signal?.throwIfAborted(); }
+        let content: string;
+        try { content = readSourceFile(fullPath); }
+        catch (error) {
+          if (!(error instanceof SourceFileLimitError)) throw error;
+          skippedFiles.push({path: relPath, reason: "file_too_large"});
+          if (existingFile) removedFiles++;
+          this.repo.deleteFileByPath(relPath);
+          this.repo.setMeta("slices_dirty", "1");
+          continue;
+        }
         const currentHash = computeContentHash(content);
 
         if (
@@ -159,11 +247,13 @@ export class IngestionPipeline {
         if (ast.status === "unsupported") {
           unsupportedFiles.push(relPath);
           this.repo.deleteFileByPath(relPath);
+          this.repo.setMeta("slices_dirty", "1");
           continue;
         }
         if (ast.status === "degraded") throw new Error(`Cannot reliably index '${relPath}': parser is degraded.`);
 
         filesUpdated++;
+        batchBytes += sizeBytes;
         pendingUpdates.push({
           fullPath,
           relPath,
@@ -176,33 +266,13 @@ export class IngestionPipeline {
         });
       }
 
-      // Batch ACID Transaction per domain
+      commitBatch();
       this.repo.runInTransaction(() => {
-        for (const meta of pendingMetadataUpdates) {
-          this.repo.updateFileMetadataOnly(meta.id, meta.mtimeMs, meta.sizeBytes);
-        }
-
-        for (const item of pendingUpdates) {
-          const fileId = this.repo.upsertFile(
-            domainId,
-            item.relPath,
-            item.archetype,
-            item.contentHash,
-            item.lineCount,
-            item.mtimeMs,
-            item.sizeBytes
-          );
-
-          this.repo.replaceFileSymbols(fileId, item.ast.symbols);
-          this.repo.replaceFileDependencies(fileId, item.ast.dependencies);
-
-          symbolsIndexed += item.ast.symbols.length;
-          dependenciesIndexed += item.ast.dependencies.length;
-        }
-
         // State Reconciliation: Prune deleted files from DB using pre-loaded existingFilesMap
         for (const [existingPath, existingRecord] of existingFilesMap.entries()) {
           if (existingRecord.domain_id === domainId && !activeRelPaths.has(existingPath)) {
+            removedFiles++;
+            this.repo.setMeta("slices_dirty", "1");
             this.repo.deleteFileByPath(existingPath);
             existingFilesMap.delete(existingPath);
           }
@@ -210,37 +280,78 @@ export class IngestionPipeline {
       });
     }
 
-    // Framework-Agnostic Semantic Vertical Slice Extraction (via Registry Strategy)
-    const detectedTopology = TopologyDetector.detect(projectRoot);
-    const semanticSlices = await SemanticSliceExtractorRegistry.extractAllSlices(
-      projectRoot,
-      detectedTopology.framework
-    );
-
-    const slicesToPersist =
-      semanticSlices.length > 0
-        ? semanticSlices
-        : new CallGraphTracer(this.repo, projectRoot).traceAllSlices();
-
-    this.repo.runInTransaction(() => {
-      this.repo.clearVerticalSlices();
-      for (const slice of slicesToPersist) {
-        this.repo.upsertVerticalSlice(slice);
-      }
-    });
+    options.signal?.throwIfAborted();
+    const topologyInputs = ["package.json", "composer.json", "nest-cli.json", "go.mod", "artisan", "tsconfig.json"]
+      .map(file => { const target = join(projectRoot, file); return existsSync(target) ? readSourceFile(target) : ""; });
+    const semanticRevision = computeContentHash(JSON.stringify([config.domains, topologyInputs]));
+    // Membership covers newly added semantic files outside registered domains.
+    const inventory = this.collectFiles(projectRoot, projectRoot, config.settings.ignore_patterns, [], options.signal).map(({fullPath, relPath}) => {
+      const stat = statSync(fullPath);
+      const fingerprint = `${stat.size}:${stat.mtimeMs}`;
+      return `${relPath}:${fingerprint}`;
+    }).sort();
+    const inventoryRevision = computeContentHash(JSON.stringify(inventory));
+    const priorInputs: SourceReadFingerprint[] = JSON.parse(this.repo.getMeta("semantic_inputs") || "[]");
+    let semanticInputChanged = false;
+    for (let index = 0; index < priorInputs.length; index++) {
+      if (index % RESOURCE_LIMITS.batchFiles === 0) { await new Promise<void>(done => setTimeout(done, 0)); options.signal?.throwIfAborted(); }
+      const input = priorInputs[index];
+      const file = resolve(projectRoot, input.path);
+      if (!existsSync(file)) { semanticInputChanged = true; break; }
+      const stat = statSync(file);
+      if (stat.size !== input.size || stat.mtimeMs !== input.mtime) { semanticInputChanged = true; break; }
+      if (!options.verifyContent) continue;
+      try { semanticInputChanged = computeContentHash(readSourceFile(file)) !== input.hash; }
+      catch (error) { if (error instanceof SourceFileLimitError) semanticInputChanged = input.hash !== "file_too_large"; else throw error; }
+      if (semanticInputChanged) break;
+    }
+    const extractorRevision = "1"; // Bump when extractor or inferred-chain semantics change.
+    if (this.repo.getMeta("semantic_extractor_revision") !== extractorRevision || this.repo.getMeta("semantic_inventory") !== inventoryRevision || semanticInputChanged || filesUpdated > 0 || removedFiles > 0 || this.repo.getMeta("slices_dirty") === "1" || this.repo.getMeta("semantic_revision") !== semanticRevision) {
+      const extracted = await collectSourceSkips(projectRoot, async () => {
+        const detectedTopology = TopologyDetector.detect(projectRoot);
+        const semanticSlices = await SemanticSliceExtractorRegistry.extractAllSlices(projectRoot, detectedTopology.framework);
+        return semanticSlices.length > 0 ? semanticSlices : new CallGraphTracer(this.repo, projectRoot).traceAllSlices();
+      });
+      skippedFiles.push(...extracted.skipped);
+      this.repo.runInTransaction(() => {
+        this.repo.clearVerticalSlices();
+        for (const slice of extracted.value) this.repo.upsertVerticalSlice(slice);
+        this.repo.setMeta("slices_dirty", "");
+        this.repo.setMeta("semantic_revision", semanticRevision);
+        this.repo.setMeta("semantic_extractor_revision", extractorRevision);
+        this.repo.setMeta("semantic_inventory", inventoryRevision);
+        this.repo.setMeta("semantic_inputs", JSON.stringify(extracted.inputs));
+        this.repo.setMeta("semantic_skipped_files", JSON.stringify(extracted.skipped));
+      });
+    }
 
+    skippedFiles.push(...JSON.parse(this.repo.getMeta("semantic_skipped_files") || "[]"));
     const durationMs = Math.round(performance.now() - startTime);
 
+    // Identify uncovered eligible source files outside registered domains
+    const indexedPaths = new Set(this.repo.getAllFiles().map((file) => file.path));
+    const allWorkspaceFiles = this.collectFiles(projectRoot, projectRoot, config.settings.ignore_patterns, [], options.signal);
+    const unsupportedSet = new Set(unsupportedFiles);
+    const skippedSet = new Set(skippedFiles.map((file) => file.path));
+    const uncoveredFiles = allWorkspaceFiles
+      .map((file) => file.relPath)
+      .filter((rel) => !indexedPaths.has(rel) && !unsupportedSet.has(rel) && !skippedSet.has(rel));
+
     // Update SSOT repo_meta watermark
     this.repo.runInTransaction(() => {
       this.repo.setMeta("last_sync", new Date().toISOString());
+      this.repo.setMeta("sync_duration_ms", String(durationMs));
       this.repo.setMeta("files_scanned", String(filesScanned));
       this.repo.setMeta("files_updated", String(filesUpdated));
       this.repo.setMeta("symbols_indexed", String(symbolsIndexed));
       this.repo.setMeta("dependencies_indexed", String(dependenciesIndexed));
       this.repo.setMeta("unsupported_files", JSON.stringify(unsupportedFiles));
+      this.repo.setMeta("skipped_files", JSON.stringify([...new Map(skippedFiles.map(file => [file.path, file])).values()]));
+      this.repo.setMeta("uncovered_files", JSON.stringify(uncoveredFiles));
     });
 
+    this.repo.checkpoint();
+
     return {
       domains_processed: domainNames.length,
       files_scanned: filesScanned,
@@ -429,23 +540,43 @@ export class IngestionPipeline {
     dir: string,
     workspaceRoot: string,
     ignorePatterns: string[],
-    childDomainRoots: string[] = []
+    childDomainRoots: string[] = [],
+    signal?: AbortSignal
   ): Array<{ fullPath: string; relPath: string }> {
     const results: Array<{ fullPath: string; relPath: string }> = [];
 
+    // SV-02: Check if initial dir itself is an escaping symlink
+    try {
+      const dirLstat = lstatSync(dir);
+      if (dirLstat.isSymbolicLink()) {
+        const real = realpathSync(dir);
+        if (!isPathContained(real, workspaceRoot)) {
+          throw new Error(`Directory '${dir}' is a symlink escaping workspace boundary '${workspaceRoot}'.`);
+        }
+      }
+    } catch (err: any) {
+      if (err?.code !== "ENOENT") throw err;
+    }
+
     const walk = (currentDir: string) => {
+      signal?.throwIfAborted();
       let entries: string[] = [];
       try {
         entries = readdirSync(currentDir);
-      } catch {
-        return;
+      } catch (err: any) {
+        // SV-01: Do not swallow permission/IO errors; propagate so pipeline reports incomplete/error
+        if (err?.code === "ENOENT") {
+          return;
+        }
+        throw new Error(`Failed to read directory '${currentDir}': ${err.message || err}`);
       }
 
       for (const entry of entries) {
+        signal?.throwIfAborted();
         const fullPath = join(currentDir, entry);
         const relPath = relative(workspaceRoot, fullPath).replace(/\\/g, "/");
 
-        if (this.shouldIgnore(relPath, ignorePatterns)) {
+        if (shouldIgnoreSourcePath(relPath, ignorePatterns)) {
           continue;
         }
 
@@ -454,14 +585,35 @@ export class IngestionPipeline {
         }
 
         try {
-          const stat = statSync(fullPath);
+          const stat = lstatSync(fullPath);
+          if (stat.isSymbolicLink()) {
+            try {
+              const real = realpathSync(fullPath);
+              if (!isPathContained(real, workspaceRoot)) {
+                continue;
+              }
+              const targetStat = statSync(real);
+              if (targetStat.isDirectory()) {
+                continue;
+              } else if (targetStat.isFile() && this.isSourceFile(real)) {
+                results.push({ fullPath, relPath });
+              }
+            } catch {
+              continue;
+            }
+            continue;
+          }
+
           if (stat.isDirectory()) {
             walk(fullPath);
           } else if (stat.isFile() && this.isSourceFile(fullPath)) {
             results.push({ fullPath, relPath });
           }
-        } catch {
-          // ignore unreadable files
+        } catch (err: any) {
+          if (err?.code === "ENOENT") {
+            continue;
+          }
+          throw new Error(`Failed to stat path '${fullPath}': ${err.message || err}`);
         }
       }
     };
@@ -481,47 +633,14 @@ export class IngestionPipeline {
     if (config.settings.db_path && config.settings.db_path !== ":memory:") {
       const dbDir = dirname(resolve(config.settings.db_path));
       const candidate = basename(dbDir) === ".septum" ? dirname(dbDir) : dbDir;
-      const absDomainRoot = resolve(domainRoot);
+      const absDomainRoot = isAbsolute(domainRoot) ? domainRoot : resolve(candidate, domainRoot);
       if (absDomainRoot.startsWith(candidate)) {
         return candidate;
       }
     }
-    return process.cwd();
+    return resolveWorkspaceRoot();
   }
 
-  private shouldIgnore(filePath: string, ignorePatterns: string[]): boolean {
-    const normPath = filePath.replace(/\\/g, "/").replace(/^\.\//, "");
-    for (const pattern of ignorePatterns) {
-      const normPattern = pattern.replace(/\\/g, "/").replace(/^\.\//, "").trim();
-      if (!normPattern) continue;
-
-      if (normPattern === "*" || normPattern === "**") {
-        return true;
-      }
-
-      if (normPath === normPattern) return true;
-
-      if (normPattern.endsWith("/**")) {
-        const prefix = normPattern.slice(0, -3);
-        if (normPath === prefix || normPath.startsWith(prefix + "/")) return true;
-      } else if (normPattern.endsWith("/*")) {
-        const prefix = normPattern.slice(0, -2);
-        if (normPath === prefix || normPath.startsWith(prefix + "/")) return true;
-      } else if (normPath.startsWith(normPattern + "/")) {
-        return true;
-      }
-
-      if (normPattern.startsWith("*.") && normPath.endsWith(normPattern.slice(1))) {
-        return true;
-      }
-
-      const segments = normPath.split("/");
-      if (segments.includes(normPattern)) {
-        return true;
-      }
-    }
-    return false;
-  }
 
   private isSourceFile(path: string): boolean {
     return ASTParserEngine.isSourceFile(path);
@@ -559,10 +678,10 @@ export class IngestionPipeline {
     const mtimeMs = stat.mtimeMs;
     const sizeBytes = stat.size;
 
-    const projectRoot = this.customWorkspaceRoot || process.cwd();
+    const projectRoot = this.customWorkspaceRoot || resolveWorkspaceRoot();
     const relPath = relative(projectRoot, fullPath).replace(/\\/g, "/");
 
-    if (this.shouldIgnore(relPath, config.settings.ignore_patterns ?? [])) {
+    if (shouldIgnoreSourcePath(relPath, config.settings.ignore_patterns ?? [])) {
       return false;
     }
 
@@ -576,7 +695,19 @@ export class IngestionPipeline {
     const domainId = this.repo.upsertDomain(targetDomainName, targetDomainCfg);
     const existingFile = this.repo.getFileByPath(relPath);
 
-    const content = readFileSync(fullPath, "utf-8");
+    let content: string;
+    try { content = readSourceFile(fullPath); }
+    catch (error) {
+      if (!(error instanceof SourceFileLimitError)) throw error;
+      this.repo.runInTransaction(() => {
+        this.repo.deleteFileByPath(relPath);
+        this.repo.clearVerticalSlices();
+        this.repo.setMeta("slices_dirty", "1");
+        const skipped: SkippedSourceFile[] = JSON.parse(this.repo.getMeta("skipped_files") || "[]");
+        this.repo.setMeta("skipped_files", JSON.stringify([...skipped.filter(file => file.path !== relPath), {path: relPath, reason: "file_too_large"}]));
+      });
+      return false;
+    }
     const currentHash = computeContentHash(content);
 
     // Tier 2: Hash verification
@@ -610,6 +741,9 @@ export class IngestionPipeline {
       this.repo.replaceFileSymbols(fileId, ast.symbols);
       this.repo.replaceFileDependencies(fileId, ast.dependencies);
       this.repo.clearVerticalSlices();
+      this.repo.setMeta("slices_dirty", "1");
+      const skipped: SkippedSourceFile[] = JSON.parse(this.repo.getMeta("skipped_files") || "[]");
+      this.repo.setMeta("skipped_files", JSON.stringify(skipped.filter(file => file.path !== relPath)));
       const unsupported = JSON.parse(this.repo.getMeta("unsupported_files") || "[]") as string[];
       this.repo.setMeta("unsupported_files", JSON.stringify(unsupported.filter(path => path !== relPath)));
     });

package/src/core/parser/extractors/laravel-semantic.ts

@@ -1,3 +1,4 @@
+import { readOptionalSourceFile } from "../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type { ExecutionChainNode, VerticalSliceRecord } from "../../../types/index.ts";
@@ -62,7 +63,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
     const parsedRoutes: ParsedRoute[] = [];
 
     for (const routeFile of routeFiles) {
-      const content = fs.readFileSync(routeFile, "utf-8");
+      const content = readOptionalSourceFile(routeFile, "utf-8");
       parsedRoutes.push(...this.parseRoutesContent(content));
     }
 
@@ -97,7 +98,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
       let behavioralInfo: import("../behavioral-analyzer.ts").MethodBehavioralSummary | null = null;
       if (controllerInfo.filePath && fs.existsSync(controllerInfo.filePath)) {
-        const controllerCode = fs.readFileSync(controllerInfo.filePath, "utf-8");
+        const controllerCode = readOptionalSourceFile(controllerInfo.filePath, "utf-8");
         const actionBody = this.extractActionBody(controllerCode, route.actionName);
         behavioralInfo = BehavioralAnalyzer.analyzeMethod(actionBody);
 
@@ -105,7 +106,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
         const requestClassName = this.detectFormRequestClass(controllerCode, route.actionName);
         if (requestClassName) {
           const reqFile = this.findClassFile("Requests", requestClassName);
-          const rules = reqFile && fs.existsSync(reqFile) ? this.extractValidationRules(fs.readFileSync(reqFile, "utf-8")) : {};
+          const rules = reqFile && fs.existsSync(reqFile) ? this.extractValidationRules(readOptionalSourceFile(reqFile, "utf-8")) : {};
           formRequestInfo = {
             className: requestClassName,
             filePath: reqFile ? path.relative(this.projectRoot, reqFile) : undefined,
@@ -117,7 +118,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
         const modelClassName = this.detectModelClass(controllerCode, route.actionName, actionBody);
         if (modelClassName) {
           const modFile = this.findClassFile("Models", modelClassName);
-          const modMetadata = modFile && fs.existsSync(modFile) ? this.extractModelMetadata(fs.readFileSync(modFile, "utf-8")) : { fillable: [], casts: {} };
+          const modMetadata = modFile && fs.existsSync(modFile) ? this.extractModelMetadata(readOptionalSourceFile(modFile, "utf-8")) : { fillable: [], casts: {} };
           modelInfo = {
             className: modelClassName,
             filePath: modFile ? path.relative(this.projectRoot, modFile) : undefined,
@@ -509,7 +510,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
     for (const c of candidates) {
       if (fs.existsSync(c)) {
-        const lines = fs.readFileSync(c, "utf-8").split("\n");
+        const lines = readOptionalSourceFile(c, "utf-8").split("\n");
         let targetLine = 1;
         for (let i = 0; i < lines.length; i++) {
           if (new RegExp(`function\\s+${actionName}\\s*\\(`, "i").test(lines[i])) {
@@ -814,7 +815,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
     for (const file of jobFiles) {
       const fullPath = path.join(jobsDir, file);
-      const content = fs.readFileSync(fullPath, "utf-8");
+      const content = readOptionalSourceFile(fullPath, "utf-8");
       const classMatch = content.match(/class\s+([A-Za-z0-9_]+)/);
       if (!classMatch) continue;
 
@@ -890,7 +891,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
     for (const file of files) {
       const fullPath = path.join(commandsDir, file);
-      const content = fs.readFileSync(fullPath, "utf-8");
+      const content = readOptionalSourceFile(fullPath, "utf-8");
       const classMatch = content.match(/class\s+([A-Za-z0-9_]+)/);
       if (!classMatch) continue;
 
@@ -969,7 +970,7 @@ export class LaravelSemanticExtractor implements SemanticSliceExtractor {
 
     for (const file of files) {
       const fullPath = path.join(listenersDir, file);
-      const content = fs.readFileSync(fullPath, "utf-8");
+      const content = readOptionalSourceFile(fullPath, "utf-8");
       const classMatch = content.match(/class\s+([A-Za-z0-9_]+)/);
       if (!classMatch) continue;
 

package/src/core/parser/extractors/mcp-cli-semantic.ts

@@ -1,5 +1,7 @@
+import { readOptionalSourceFile } from "../../resources/source-files.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { blankCommentsAndStrings } from "../boundary-tracker.ts";
 import type { SemanticSliceExtractor, VerticalSliceCandidate } from "./semantic-extractor.interface.ts";
 
 export class McpCliSemanticExtractor implements SemanticSliceExtractor {
@@ -18,7 +20,7 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
     const pkgPath = path.join(projectRoot, "package.json");
     if (fs.existsSync(pkgPath)) {
       try {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readOptionalSourceFile(pkgPath, "utf-8"));
         if (pkg.bin || pkg.dependencies?.["@modelcontextprotocol/sdk"]) {
           return true;
         }
@@ -44,11 +46,13 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
         for (const file of toolFiles) {
           const fullPath = path.join(mcpToolsDir, file);
           const relPath = path.relative(projectRoot, fullPath).replace(/\\/g, "/");
-          const content = fs.readFileSync(fullPath, "utf-8");
+          const content = readOptionalSourceFile(fullPath, "utf-8");
           const baseName = path.basename(file, path.extname(file));
           const snakeBase = baseName.replace(/-/g, "_");
-          const toolIdentifier =
-            registeredTools.get(snakeBase) || `${toolPrefix}_${snakeBase}`;
+
+          // MCP-07: Only create ingress slices for whitelisted public MCP tools
+          const toolIdentifier = registeredTools.get(snakeBase) || registeredTools.get(`${toolPrefix}_${snakeBase}`);
+          if (!toolIdentifier) continue;
 
           // Detect handler function (both sync and async) and its 1-indexed line number
           const handlerMatch = /export\s+(?:async\s+)?function\s+([a-zA-Z0-9_]+)/.exec(content);
@@ -143,7 +147,7 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
         for (const file of commandFiles) {
           const fullPath = path.join(cliCommandsDir, file);
           const relPath = path.relative(projectRoot, fullPath).replace(/\\/g, "/");
-          const content = fs.readFileSync(fullPath, "utf-8");
+          const content = readOptionalSourceFile(fullPath, "utf-8");
           const commandName = path.basename(file, path.extname(file));
 
           const handlerMatch = /export\s+(?:async\s+)?function\s+([a-zA-Z0-9_]+)/.exec(content);
@@ -235,7 +239,7 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
     const pkgPath = path.join(projectRoot, "package.json");
     if (fs.existsSync(pkgPath)) {
       try {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readOptionalSourceFile(pkgPath, "utf-8"));
         const rawName = typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : "mcp";
         const toolPrefix = rawName.replace(/[^a-zA-Z0-9_]/g, "_").toLowerCase() || "mcp";
         let cliBinName = rawName;
@@ -257,17 +261,53 @@ export class McpCliSemanticExtractor implements SemanticSliceExtractor {
     if (!fs.existsSync(serverPath)) return map;
 
     try {
-      const content = fs.readFileSync(serverPath, "utf-8");
-      const nameRegex = /name:\s*['"]([a-zA-Z0-9_-]+)['"]/g;
-      let match: RegExpExecArray | null;
-      while ((match = nameRegex.exec(content)) !== null) {
-        const fullToolName = match[1];
-        const normalized = fullToolName.replace(/-/g, "_");
-        map.set(normalized, fullToolName);
-        const withoutPrefix = normalized.replace(/^[a-z0-9]+_/, "");
-        if (withoutPrefix) {
-          map.set(withoutPrefix, fullToolName);
+      const content = readOptionalSourceFile(serverPath, "utf-8");
+      const masked = blankCommentsAndStrings(content);
+      const scan = (start: number, namesInArray: boolean) => {
+        let depth = 0;
+        const names: string[] = [];
+        const property = /\b([A-Za-z_]\w*)\s*:\s*(['"])?/y;
+        for (let i = start; i < masked.length; i++) {
+          const ch = masked[i];
+          if ("[{(".includes(ch)) depth++;
+          else if ("]})".includes(ch)) {
+            if (--depth === 0) break;
+          }
+          if (depth !== (namesInArray ? 2 : 1) || (i > 0 && /\w/.test(masked[i - 1]))) continue;
+          property.lastIndex = i;
+          const match = property.exec(masked);
+          if (!match) continue;
+          if (!namesInArray) names.push(match[1]);
+          else if (match[1] === "name" && match[2]) {
+            const quoteStart = i + match[0].lastIndexOf(match[2]);
+            const quoteEnd = masked.indexOf(match[2], quoteStart + 1);
+            const name = content.slice(quoteStart + 1, quoteEnd);
+            if (/^[A-Za-z0-9_-]+$/.test(name)) names.push(name);
+          }
+        }
+        // Unbalanced declarations are not evidence of public registration.
+        if (depth !== 0) return;
+        for (const fullToolName of names) {
+          const normalized = fullToolName.replace(/-/g, "_");
+          map.set(normalized, fullToolName);
+          const withoutPrefix = normalized.replace(/^[a-z0-9]+_/, "");
+          if (withoutPrefix) map.set(withoutPrefix, fullToolName);
+        }
+      };
+      const listCall = /setRequestHandler\s*\(\s*ListToolsRequestSchema\b/.exec(masked);
+      if (listCall) {
+        const callStart = masked.indexOf("(", listCall.index);
+        let depth = 1;
+        let end = callStart + 1;
+        for (; end < masked.length && depth; end++) {
+          if (masked[end] === "(") depth++;
+          else if (masked[end] === ")") depth--;
         }
+        const tools = /\btools\s*:\s*\[/.exec(masked.slice(callStart, end));
+        if (tools && depth === 0) scan(callStart + tools.index + tools[0].length - 1, true);
+      } else {
+        const schemas = /\bTOOL_SCHEMAS\s*=\s*\{/.exec(masked);
+        if (schemas) scan(schemas.index + schemas[0].length - 1, false);
       }
     } catch {}
     return map;