torusguard 2.1.0 → 2.1.2

package/skills/torusguard/payload/core/authorization.py

@@ -0,0 +1,218 @@
+"""
+TorusGuard v0.7.0 Authorization & Scope Enforcement Engine
+Enforces explicit target authorization and scope boundaries before any runtime validation.
+No runtime HTTP or browser interaction is permitted without valid, non-expired authorization.
+"""
+
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import List, Optional, Dict, Any, Tuple
+from dataclasses import dataclass, asdict
+from urllib.parse import urlparse
+
+
+class AuthorizationError(PermissionError):
+    """Raised when runtime validation is attempted without valid authorization or outside approved scope."""
+    pass
+
+
+@dataclass
+class TargetScope:
+    target_hosts: List[str]
+    allowed_path_prefixes: List[str]
+    forbidden_paths: List[str]
+    valid_from: str
+    valid_until: str
+    max_depth: int = 3
+    max_requests: int = 100
+    allow_state_changing_methods: bool = False
+    allowed_issue_classes: Optional[List[str]] = None
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+    @classmethod
+    def from_dict(cls, data: Dict[str, Any]) -> "TargetScope":
+        return cls(
+            target_hosts=data.get("target_hosts", []),
+            allowed_path_prefixes=data.get("allowed_path_prefixes", ["/"]),
+            forbidden_paths=data.get("forbidden_paths", ["/admin/delete", "/system/shutdown"]),
+            valid_from=data.get("valid_from", ""),
+            valid_until=data.get("valid_until", ""),
+            max_depth=data.get("max_depth", 3),
+            max_requests=data.get("max_requests", 100),
+            allow_state_changing_methods=data.get("allow_state_changing_methods", False),
+            allowed_issue_classes=data.get("allowed_issue_classes", [
+                "auth_bypass",
+                "tenant_isolation",
+                "header_trust",
+                "path_traversal",
+                "debug_exposure"
+            ])
+        )
+
+
+@dataclass
+class AuthorizationRecord:
+    authorization_id: str
+    target_name: str
+    authorized_by: str
+    authorization_type: str  # "target_owner", "written_authorization", "ci_sandboxed_test"
+    scope: TargetScope
+    created_at: str = ""
+
+    def __post_init__(self):
+        if not self.created_at:
+            self.created_at = datetime.now(timezone.utc).isoformat()
+
+    def to_dict(self) -> Dict[str, Any]:
+        d = asdict(self)
+        d["scope"] = self.scope.to_dict()
+        return d
+
+
+class AuthorizationManager:
+    """
+    Validates, manages, and stores target authorizations in isolated run folders.
+    """
+
+    @staticmethod
+    def is_scope_active(scope: TargetScope) -> Tuple[bool, str]:
+        now = datetime.now(timezone.utc)
+        if scope.valid_from:
+            try:
+                v_from = datetime.fromisoformat(scope.valid_from.replace("Z", "+00:00"))
+                if now < v_from:
+                    return False, f"Authorization not yet active (starts {scope.valid_from})"
+            except Exception:
+                pass
+        if scope.valid_until:
+            try:
+                v_until = datetime.fromisoformat(scope.valid_until.replace("Z", "+00:00"))
+                if now > v_until:
+                    return False, f"Authorization expired at {scope.valid_until}"
+            except Exception:
+                pass
+        return True, "Authorization active"
+
+    @classmethod
+    def _match_host(cls, host: str, target_hosts: List[str]) -> bool:
+        """Checks if host matches approved host or host:port patterns."""
+        for approved in target_hosts:
+            approved_lower = approved.lower()
+            if host == approved_lower or host.startswith(approved_lower + ":") or approved_lower.startswith(host + ":"):
+                return True
+        return False
+
+    @classmethod
+    def _match_forbidden_path(cls, path: str, forbidden_paths: List[str]) -> Optional[str]:
+        """Returns matching forbidden path prefix if any, else None."""
+        for forbidden in forbidden_paths:
+            if path.startswith(forbidden):
+                return forbidden
+        return None
+
+    @classmethod
+    def _match_allowed_prefix(cls, path: str, allowed_prefixes: List[str]) -> bool:
+        """Checks if path matches at least one allowed prefix."""
+        for prefix in allowed_prefixes:
+            if path.startswith(prefix):
+                return True
+        return False
+
+    @classmethod
+    def validate_url(cls, url: str, scope: TargetScope) -> Tuple[bool, str]:
+        """
+        Ensures target URL is strictly inside approved hosts, allowed path prefixes,
+        and not in forbidden paths.
+        """
+        parsed = urlparse(url)
+        host = parsed.netloc.lower()
+        if not host:
+            return False, f"Invalid URL (missing host): {url}"
+
+        # 1. Match approved host
+        if not cls._match_host(host, scope.target_hosts):
+            return False, f"Host '{host}' is NOT in approved target_hosts: {scope.target_hosts}"
+
+        # 2. Check forbidden paths
+        path = parsed.path or "/"
+        matched_forbidden = cls._match_forbidden_path(path, scope.forbidden_paths)
+        if matched_forbidden:
+            return False, f"Path '{path}' matches forbidden path '{matched_forbidden}'"
+
+        # 3. Check allowed path prefixes
+        if not cls._match_allowed_prefix(path, scope.allowed_path_prefixes):
+            return False, f"Path '{path}' does NOT match any allowed_path_prefixes: {scope.allowed_path_prefixes}"
+
+        # 4. Check TTL
+        active, reason = cls.is_scope_active(scope)
+        if not active:
+            return False, reason
+
+        return True, "URL within authorized scope"
+
+    @classmethod
+    def check_authorized_or_raise(cls, url: str, auth: Optional[AuthorizationRecord], method: str = "GET") -> None:
+        """
+        Hard security gate: raises AuthorizationError if auth is missing, expired,
+        or URL violates scope boundaries.
+        """
+        if not auth:
+            raise AuthorizationError("Runtime validation blocked: No authorization record provided.")
+
+        # Method check
+        if method.upper() in ["POST", "PUT", "DELETE", "PATCH"] and not auth.scope.allow_state_changing_methods:
+            raise AuthorizationError(f"State-changing method '{method}' is forbidden under current scope.")
+
+        valid, reason = cls.validate_url(url, auth.scope)
+        if not valid:
+            raise AuthorizationError(f"Runtime validation blocked: {reason}")
+
+    @classmethod
+    def write_artifacts(cls, run_dir: Path, auth: AuthorizationRecord) -> Tuple[Path, Path]:
+        """
+        Emits standard scope.json and authorization.md into the run folder.
+        """
+        run_dir.mkdir(parents=True, exist_ok=True)
+        scope_file = run_dir / "scope.json"
+        auth_file = run_dir / "authorization.md"
+
+        # 1. Write scope.json
+        with open(scope_file, "w", encoding="utf-8") as f:
+            json.dump(auth.to_dict(), f, indent=2)
+
+        # 2. Write authorization.md
+        md_content = f"""# TorusGuard v0.7.0 Runtime Authorization Document
+
+**Authorization ID:** `{auth.authorization_id}`  
+**Target Application:** `{auth.target_name}`  
+**Authorized By:** `{auth.authorized_by}`  
+**Authorization Type:** `{auth.authorization_type}`  
+**Created At:** `{auth.created_at}`  
+
+---
+
+## 🔒 Scope Boundaries & Permitted Constraints
+
+| Parameter | Allowed Value |
+|---|---|
+| **Target Hosts** | `{", ".join(auth.scope.target_hosts)}` |
+| **Allowed Path Prefixes** | `{", ".join(auth.scope.allowed_path_prefixes)}` |
+| **Forbidden Paths** | `{", ".join(auth.scope.forbidden_paths)}` |
+| **Active Window** | `{auth.scope.valid_from}` ➔ `{auth.scope.valid_until}` |
+| **Max Navigation Depth** | `{auth.scope.max_depth}` levels |
+| **Max Request Budget** | `{auth.scope.max_requests}` requests |
+| **State-Changing Methods** | `{"Allowed" if auth.scope.allow_state_changing_methods else "Forbidden (Read-only GET/HEAD only)"}` |
+| **Approved Issue Classes** | `{", ".join(auth.scope.allowed_issue_classes or [])}` |
+
+---
+
+## ⚖️ Legal & Governance Statement
+This authorization represents verifiable consent by `{auth.authorized_by}` to perform non-destructive, bounded runtime validation against the specified target hosts. Destructive testing, denial of service, memory corruption, and automated credential stuffing are strictly prohibited.
+"""
+        with open(auth_file, "w", encoding="utf-8") as f:
+            f.write(md_content)
+
+        return scope_file, auth_file

package/skills/torusguard/payload/core/browser_verifier.py

@@ -0,0 +1,128 @@
+"""
+TorusGuard v0.7.0 Browser-Assisted Verification Engine
+Validates client-side route guards, authenticated frontend flows, and DOM/UI evidence
+with capped navigation depth, action logging, and safety controls.
+"""
+
+import json
+from pathlib import Path
+from typing import Dict, Any, List, Optional
+from dataclasses import dataclass, asdict
+
+from core.authorization import AuthorizationRecord, AuthorizationManager, AuthorizationError
+from core.safety_gate import SafetyGate, SafetyReviewLevel
+
+
+@dataclass
+class BrowserAction:
+    action_id: str
+    action_type: str  # "navigate", "assert_dom", "check_route_guard", "capture_snapshot"
+    target_url: str
+    selector: Optional[str] = None
+    outcome: str = ""
+    dom_snippet: Optional[str] = None
+    requires_approval: bool = False
+    approved: bool = True
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+class BrowserVerifier:
+    """
+    Simulates and executes bounded browser-assisted validations against client-side flows.
+    """
+
+    def __init__(
+        self,
+        auth_record: AuthorizationRecord,
+        max_depth: int = 3
+    ):
+        self.auth = auth_record
+        self.max_depth = min(max_depth, auth_record.scope.max_depth)
+        self.current_depth = 0
+        self.action_history: List[BrowserAction] = []
+
+    def verify_route_guard(
+        self,
+        target_url: str,
+        authenticated: bool,
+        expected_redirect_url: Optional[str] = None,
+        protected_dom_marker: Optional[str] = None,
+        client_dom_content: Optional[str] = None
+    ) -> Dict[str, Any]:
+        """
+        Validates whether client-side router/guards protect sensitive UI components
+        or leak them before authentication.
+        """
+        AuthorizationManager.check_authorized_or_raise(target_url, self.auth, method="GET")
+
+        action_id = f"BRW-{len(self.action_history) + 1:03d}"
+        decision = SafetyGate.evaluate_action(action_id, "GET", target_url)
+
+        if not decision.allowed_to_proceed:
+            action = BrowserAction(
+                action_id=action_id,
+                action_type="check_route_guard",
+                target_url=target_url,
+                outcome="BLOCKED_BY_SAFETY_GATE",
+                requires_approval=True,
+                approved=False
+            )
+            self.action_history.append(action)
+            return {"status": "Blocked by Safety Gate", "action": action.to_dict()}
+
+        # Evaluate Client-Side DOM Guard
+        dom = client_dom_content or ""
+        guard_intact = True
+        leak_detected = False
+
+        if not authenticated:
+            # When unauthenticated, sensitive DOM marker should NOT be present
+            if protected_dom_marker and protected_dom_marker in dom:
+                guard_intact = False
+                leak_detected = True
+                outcome = f"Client Route Guard Failed: Sensitive marker '{protected_dom_marker}' rendered without authentication."
+            else:
+                outcome = "Client Route Guard Enforced: Protected view withheld from unauthenticated DOM."
+        else:
+            outcome = "Authenticated Session Verified: Client loaded permitted views."
+
+        action = BrowserAction(
+            action_id=action_id,
+            action_type="check_route_guard",
+            target_url=target_url,
+            outcome=outcome,
+            dom_snippet=dom[:200] if dom else None,
+            requires_approval=False,
+            approved=True
+        )
+        self.action_history.append(action)
+
+        return {
+            "guard_intact": guard_intact,
+            "leak_detected": leak_detected,
+            "outcome": outcome,
+            "action": action.to_dict()
+        }
+
+    def write_report(self, run_dir: Path) -> Path:
+        run_dir.mkdir(parents=True, exist_ok=True)
+        report_file = run_dir / "browser-validation.md"
+        lines = [
+            "# TorusGuard v0.7.0 Browser-Assisted Validation Report",
+            f"\n**Authorization ID:** `{self.auth.authorization_id}`",
+            f"**Max Navigation Depth:** `{self.max_depth}` levels",
+            f"**Total Browser Actions:** `{len(self.action_history)}`",
+            "\n---",
+            "\n## 🖥️ UI Action Traces\n",
+            "| Action ID | Type | Target URL | Outcome | Approval Status |",
+            "|---|---|---|---|:---:|",
+        ]
+        for a in self.action_history:
+            lines.append(f"| `{a.action_id}` | `{a.action_type}` | `{a.target_url}` | {a.outcome} | **{'Approved' if a.approved else 'Blocked'}** |")
+
+        with open(report_file, "w", encoding="utf-8") as f:
+            f.write("\n".join(lines) + "\n")
+
+        return report_file

package/skills/torusguard/payload/core/bundle.py

@@ -0,0 +1,141 @@
+"""
+TorusGuard v6 Remediation Bundle Generator
+Constructs self-contained, structured remediation packages per cluster or finding containing:
+- finding.md
+- remediation.md
+- minimal_patch_plan.md
+- verify-after-change.md
+- metadata.json
+"""
+
+import json
+from pathlib import Path
+from dataclasses import dataclass, field, asdict
+from typing import Dict, Any, List, Optional
+
+
+@dataclass
+class RemediationBundle:
+    bundle_id: str
+    finding_id: str
+    rule_id: str
+    title: str
+    target_files: List[str]
+    risk_severity: str
+    what_is_wrong: str
+    why_it_matters: str
+    what_should_change: str
+    proposed_diff: str
+    verification_steps: str
+    cluster_id: Optional[str] = None
+    created_at: str = ""
+
+    def write_to_directory(self, base_dir: Path) -> Path:
+        bundle_dir = base_dir / self.bundle_id
+        bundle_dir.mkdir(parents=True, exist_ok=True)
+
+        # 1. finding.md
+        with open(bundle_dir / "finding.md", "w", encoding="utf-8") as f:
+            f.write(f"# Finding: {self.title}\n\n")
+            f.write(f"- **Finding ID:** `{self.finding_id}`\n")
+            f.write(f"- **Rule ID:** `{self.rule_id}`\n")
+            f.write(f"- **Severity:** {self.risk_severity}\n")
+            if self.cluster_id:
+                f.write(f"- **Root-Cause Cluster:** `{self.cluster_id}`\n")
+            f.write(f"- **Target Files:** {', '.join(f'`{tf}`' for tf in self.target_files)}\n\n")
+            f.write("## What Is Wrong\n")
+            f.write(f"{self.what_is_wrong}\n\n")
+            f.write("## Why It Matters\n")
+            f.write(f"{self.why_it_matters}\n")
+
+        # 2. remediation.md
+        with open(bundle_dir / "remediation.md", "w", encoding="utf-8") as f:
+            f.write(f"# Remediation Guide: {self.title}\n\n")
+            f.write("## What Should Change\n")
+            f.write(f"{self.what_should_change}\n\n")
+            f.write("## Target Files to Modify\n")
+            for tf in self.target_files:
+                f.write(f"- `{tf}`\n")
+
+        # 3. minimal_patch_plan.md
+        with open(bundle_dir / "minimal_patch_plan.md", "w", encoding="utf-8") as f:
+            f.write(f"# Minimal Patch Plan for `{self.finding_id}`\n\n")
+            f.write("```diff\n")
+            f.write(self.proposed_diff.strip() + "\n")
+            f.write("```\n")
+
+        # 4. verify-after-change.md
+        with open(bundle_dir / "verify-after-change.md", "w", encoding="utf-8") as f:
+            f.write(f"# Verification Steps for `{self.finding_id}`\n\n")
+            f.write(f"{self.verification_steps}\n\n")
+            f.write("### Recheck Command\n")
+            f.write("```bash\n/torusguard recheck\n```\n")
+
+        # 5. metadata.json
+        meta = {
+            "bundle_id": self.bundle_id,
+            "finding_id": self.finding_id,
+            "rule_id": self.rule_id,
+            "title": self.title,
+            "cluster_id": self.cluster_id,
+            "target_files": self.target_files,
+            "risk_severity": self.risk_severity,
+            "created_at": self.created_at,
+        }
+        with open(bundle_dir / "metadata.json", "w", encoding="utf-8") as f:
+            json.dump(meta, f, indent=2)
+
+        return bundle_dir
+
+
+class BundleManager:
+    """
+    Factory for generating remediation bundles from findings and clusters.
+    """
+
+    @staticmethod
+    def create_bundle(finding: Dict[str, Any], cluster_id: Optional[str] = None) -> RemediationBundle:
+        f_id = finding.get("finding_id", "fnd-01")
+        rule_id = finding.get("rule_id", "TG-GENERIC")
+        title = finding.get("title", "Security Finding")
+        target = finding.get("target", {})
+        file_path = target.get("file_path", "app.py")
+        severity = finding.get("severity", "High")
+
+        bundle_id = f"bundle-{f_id}"
+
+        what_is_wrong = finding.get(
+            "what_is_wrong",
+            f"The component in `{file_path}` violates security rule `{rule_id}`."
+        )
+        why_it_matters = finding.get(
+            "why_it_matters",
+            "This vulnerability could allow attackers to bypass authorization, access unauthorized tenant data, or inject malicious payloads."
+        )
+        what_should_change = finding.get(
+            "what_should_change",
+            f"Apply least-invasive framework-idiomatic hardening to `{file_path}`."
+        )
+        proposed_diff = finding.get(
+            "proposed_diff",
+            f"--- a/{file_path}\n+++ b/{file_path}\n@@ -1,3 +1,3 @@\n-# Unsafe pattern\n+# Hardened pattern\n"
+        )
+        verification_steps = finding.get(
+            "verification_steps",
+            f"Run `/torusguard recheck` on `{file_path}` to confirm vulnerability resolution."
+        )
+
+        return RemediationBundle(
+            bundle_id=bundle_id,
+            finding_id=f_id,
+            rule_id=rule_id,
+            title=title,
+            target_files=[file_path],
+            risk_severity=severity,
+            what_is_wrong=what_is_wrong,
+            why_it_matters=why_it_matters,
+            what_should_change=what_should_change,
+            proposed_diff=proposed_diff,
+            verification_steps=verification_steps,
+            cluster_id=cluster_id,
+        )

package/skills/torusguard/payload/core/call_graph.py

@@ -0,0 +1,184 @@
+"""
+TorusGuard Project-Wide Call Graph Engine
+Maps interprocedural call sites, function definitions, and caller/callee relationships
+across module boundaries.
+"""
+
+from pathlib import Path
+from dataclasses import dataclass, field, asdict
+from typing import Dict, List, Optional, Set, Any
+import re
+
+from core.parser import PolyglotParser, ParseResult
+from core.import_resolver import ImportResolver
+
+
+@dataclass
+class CallSite:
+    caller_file: str
+    caller_func: str
+    caller_line: int
+    callee_name: str
+    callee_file: Optional[str] = None
+    callee_line: Optional[int] = None
+    arguments: List[str] = field(default_factory=list)
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+@dataclass
+class FunctionDef:
+    file_path: str
+    func_name: str
+    start_line: int
+    end_line: int = 0
+    parameters: List[str] = field(default_factory=list)
+    return_expressions: List[str] = field(default_factory=list)
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+class CallGraph:
+    """Project-wide interprocedural function call graph."""
+
+    def __init__(self, project_root: Path):
+        self.project_root = project_root.resolve()
+        self.import_resolver = ImportResolver(self.project_root)
+        # Key: (file_path, func_name) -> FunctionDef
+        self.functions: Dict[Tuple[str, str], FunctionDef] = {}
+        # Key: func_name -> list of FunctionDef (for quick symbol lookup)
+        self.functions_by_name: Dict[str, List[FunctionDef]] = {}
+        # Key: (file_path, func_name) -> list of CallSite where this func is caller
+        self.callees: Dict[Tuple[str, str], List[CallSite]] = {}
+        # Key: (file_path, func_name) -> list of CallSite where this func is callee
+        self.callers: Dict[Tuple[str, str], List[CallSite]] = {}
+
+    def register_function(self, fdef: FunctionDef) -> None:
+        key = (fdef.file_path, fdef.func_name)
+        self.functions[key] = fdef
+        if fdef.func_name not in self.functions_by_name:
+            self.functions_by_name[fdef.func_name] = []
+        self.functions_by_name[fdef.func_name].append(fdef)
+
+    def add_call(self, call: CallSite) -> None:
+        caller_key = (call.caller_file, call.caller_func)
+        if caller_key not in self.callees:
+            self.callees[caller_key] = []
+        self.callees[caller_key].append(call)
+
+        if call.callee_file:
+            callee_key = (call.callee_file, call.callee_name)
+            if callee_key not in self.callers:
+                self.callers[callee_key] = []
+            self.callers[callee_key].append(call)
+
+    def build_from_files(self, file_paths: List[Path], parser: PolyglotParser) -> None:
+        """Parse files and construct functions and call edges."""
+        parsed_results: Dict[str, ParseResult] = {}
+
+        # Pass 1: Extract all function definitions
+        for p in file_paths:
+            try:
+                res = parser.parse_file(p)
+                rel_p = str(p.resolve().relative_to(self.project_root)).replace("\\", "/")
+                parsed_results[rel_p] = res
+                self._extract_function_defs(rel_p, res.raw_content, res.language)
+            except Exception:
+                continue
+
+        # Pass 2: Extract call sites and link to callees
+        for rel_p, res in parsed_results.items():
+            abs_p = self.project_root / rel_p
+            # Build import map: alias/name -> resolved Path
+            resolved_imports: Dict[str, str] = {}
+            for imp in res.imports:
+                target_p = self.import_resolver.resolve(abs_p, imp.module)
+                if target_p:
+                    rel_target = str(target_p.resolve().relative_to(self.project_root)).replace("\\", "/")
+                    for name in imp.imported_names:
+                        resolved_imports[name] = rel_target
+                    for alias, orig in imp.alias_map.items():
+                        resolved_imports[alias] = rel_target
+
+            # Process function calls
+            for fc in res.function_calls:
+                callee_name = fc.name
+                callee_file = None
+                callee_line = None
+
+                # Method call e.g. mod.func
+                if "." in callee_name:
+                    prefix, actual_name = callee_name.split(".", 1)
+                    if prefix in resolved_imports:
+                        callee_file = resolved_imports[prefix]
+                        callee_name = actual_name
+                elif callee_name in resolved_imports:
+                    callee_file = resolved_imports[callee_name]
+                else:
+                    # Check local in same file
+                    if (rel_p, callee_name) in self.functions:
+                        callee_file = rel_p
+
+                # Find which enclosing function contains this call
+                caller_func = self._find_enclosing_function(rel_p, fc.line_number)
+
+                call_site = CallSite(
+                    caller_file=rel_p,
+                    caller_func=caller_func,
+                    caller_line=fc.line_number,
+                    callee_name=callee_name,
+                    callee_file=callee_file,
+                    arguments=fc.arguments
+                )
+                self.add_call(call_site)
+
+    def _extract_function_defs(self, file_path: str, content: str, language: str) -> None:
+        lines = content.splitlines()
+        for idx, line in enumerate(lines):
+            line_num = idx + 1
+            stripped = line.strip()
+
+            # Python: def foo(a, b):
+            py_m = re.match(r"^def\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*\((.*?)\)", stripped)
+            if py_m:
+                fname = py_m.group(1)
+                params = [p.strip() for p in py_m.group(2).split(",") if p.strip()]
+                self.register_function(FunctionDef(file_path=file_path, func_name=fname, start_line=line_num, parameters=params))
+                continue
+
+            # JS/TS: function foo(a, b) or const foo = (a, b) =>
+            js_m = re.match(r"^(?:async\s+)?function\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*\((.*?)\)", stripped)
+            if js_m:
+                fname = js_m.group(1)
+                params = [p.strip() for p in js_m.group(2).split(",") if p.strip()]
+                self.register_function(FunctionDef(file_path=file_path, func_name=fname, start_line=line_num, parameters=params))
+                continue
+
+            arrow_m = re.match(r"^(?:const|let|var)\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(?:async\s*)?\((.*?)\)\s*=>", stripped)
+            if arrow_m:
+                fname = arrow_m.group(1)
+                params = [p.strip() for p in arrow_m.group(2).split(",") if p.strip()]
+                self.register_function(FunctionDef(file_path=file_path, func_name=fname, start_line=line_num, parameters=params))
+                continue
+
+            # Go: func foo(a string)
+            go_m = re.match(r"^func\s+(?:\(.*?\)\s+)?([a-zA-Z_][a-zA-Z0-9_]*)\s*\((.*?)\)", stripped)
+            if go_m:
+                fname = go_m.group(1)
+                params = [p.strip() for p in go_m.group(2).split(",") if p.strip()]
+                self.register_function(FunctionDef(file_path=file_path, func_name=fname, start_line=line_num, parameters=params))
+
+    def _find_enclosing_function(self, file_path: str, line_num: int) -> str:
+        candidates = [f for (fp, fn), f in self.functions.items() if fp == file_path and f.start_line <= line_num]
+        if not candidates:
+            return "<global>"
+        candidates.sort(key=lambda f: f.start_line, reverse=True)
+        return candidates[0].func_name
+
+    def get_callers(self, file_path: str, func_name: str) -> List[CallSite]:
+        return self.callers.get((file_path, func_name), [])
+
+    def get_callees(self, file_path: str, func_name: str) -> List[CallSite]:
+        return self.callees.get((file_path, func_name), [])