ucn 3.7.4 → 3.7.6

package/languages/go.js

@@ -183,12 +183,16 @@ function findClasses(code, parser) {
                         // Check if exported
                         const isExported = /^[A-Z]/.test(name);
 
+                        const members = typeKind === 'struct' ? extractStructFields(typeNode, code)
+                            : typeKind === 'interface' ? extractInterfaceMembers(typeNode, code)
+                            : [];
+
                         types.push({
                             name,
                             startLine,
                             endLine,
                             type: typeKind,
-                            members: typeKind === 'struct' ? extractStructFields(typeNode, code) : [],
+                            members,
                             modifiers: isExported ? ['export'] : [],
                             ...(docstring && { docstring }),
                             ...(typeParams && { generics: typeParams })
@@ -235,6 +239,62 @@ function extractStructFields(structNode, code) {
     return fields;
 }
 
+/**
+ * Extract interface method signatures
+ */
+function extractInterfaceMembers(interfaceNode, code) {
+    const members = [];
+    for (let i = 0; i < interfaceNode.namedChildCount; i++) {
+        const child = interfaceNode.namedChild(i);
+        // tree-sitter Go uses method_elem (or method_spec in older versions)
+        if (child.type === 'method_elem' || child.type === 'method_spec') {
+            const { startLine, endLine } = nodeToLocation(child, code);
+            // Name is in a field_identifier child
+            let nameText = null;
+            let paramsText = null;
+            let returnType = null;
+            for (let j = 0; j < child.namedChildCount; j++) {
+                const sub = child.namedChild(j);
+                if (sub.type === 'field_identifier' || sub.type === 'type_identifier') {
+                    if (!nameText) nameText = sub.text;
+                } else if (sub.type === 'parameter_list') {
+                    if (!paramsText) {
+                        paramsText = sub.text.slice(1, -1); // strip parens
+                    } else {
+                        // Second parameter_list is the return type tuple
+                        returnType = sub.text;
+                    }
+                }
+            }
+            // Also check childForFieldName for compatibility
+            if (!nameText) {
+                const nameNode = child.childForFieldName('name');
+                if (nameNode) nameText = nameNode.text;
+            }
+            if (!returnType) {
+                // Single return type (not a tuple) is a type_identifier
+                for (let j = 0; j < child.namedChildCount; j++) {
+                    const sub = child.namedChild(j);
+                    if (sub.type === 'type_identifier' && sub.text !== nameText) {
+                        returnType = sub.text;
+                    }
+                }
+            }
+            if (nameText) {
+                members.push({
+                    name: nameText,
+                    startLine,
+                    endLine,
+                    memberType: 'method',
+                    ...(paramsText !== null && { params: paramsText }),
+                    ...(returnType && { returnType })
+                });
+            }
+        }
+    }
+    return members;
+}
+
 /**
  * Find state objects (constants) in Go code
  */

package/languages/java.js

@@ -279,7 +279,7 @@ function findClasses(code, parser) {
                     startLine,
                     endLine,
                     type: 'interface',
-                    members: [],
+                    members: extractClassMembers(node, code),
                     modifiers,
                     ...(docstring && { docstring }),
                     ...(generics && { generics }),
@@ -307,7 +307,7 @@ function findClasses(code, parser) {
                     startLine,
                     endLine,
                     type: 'enum',
-                    members: [],
+                    members: extractEnumConstants(node, code),
                     modifiers,
                     ...(docstring && { docstring }),
                     ...(annotations.length > 0 && { annotations })
@@ -405,6 +405,82 @@ function extractInterfaceExtends(interfaceNode) {
     return [];
 }
 
+/**
+ * Extract enum constants from enum body
+ */
+function extractEnumConstants(enumNode, code) {
+    const constants = [];
+    const bodyNode = enumNode.childForFieldName('body');
+    if (!bodyNode) return constants;
+
+    for (let i = 0; i < bodyNode.namedChildCount; i++) {
+        const child = bodyNode.namedChild(i);
+        if (child.type === 'enum_constant') {
+            const nameNode = child.childForFieldName('name');
+            if (nameNode) {
+                const { startLine, endLine } = nodeToLocation(child, code);
+                const argsNode = child.childForFieldName('arguments');
+                constants.push({
+                    name: nameNode.text,
+                    startLine,
+                    endLine,
+                    memberType: 'constant',
+                    ...(argsNode && { params: argsNode.text.slice(1, -1) })
+                });
+            }
+        }
+    }
+
+    // Also extract methods from enum_body_declarations
+    if (bodyNode) {
+        for (let i = 0; i < bodyNode.namedChildCount; i++) {
+            const child = bodyNode.namedChild(i);
+            if (child.type === 'enum_body_declarations') {
+                for (let j = 0; j < child.namedChildCount; j++) {
+                    const member = child.namedChild(j);
+                    if (member.type === 'method_declaration') {
+                        const nameNode = member.childForFieldName('name');
+                        const paramsNode = member.childForFieldName('parameters');
+                        if (nameNode) {
+                            const { startLine, endLine } = nodeToLocation(member, code);
+                            const modifiers = extractModifiers(member);
+                            const returnType = extractReturnType(member);
+                            constants.push({
+                                name: nameNode.text,
+                                params: extractJavaParams(paramsNode),
+                                startLine,
+                                endLine,
+                                memberType: modifiers.includes('static') ? 'static' : 'method',
+                                modifiers,
+                                isMethod: true,
+                                ...(returnType && { returnType })
+                            });
+                        }
+                    } else if (member.type === 'constructor_declaration') {
+                        const nameNode = member.childForFieldName('name');
+                        const paramsNode = member.childForFieldName('parameters');
+                        if (nameNode) {
+                            const { startLine, endLine } = nodeToLocation(member, code);
+                            const modifiers = extractModifiers(member);
+                            constants.push({
+                                name: nameNode.text,
+                                params: extractJavaParams(paramsNode),
+                                startLine,
+                                endLine,
+                                memberType: 'constructor',
+                                modifiers,
+                                isMethod: true
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    return constants;
+}
+
 /**
  * Extract class members (methods, constructors)
  */

package/languages/rust.js

@@ -232,7 +232,7 @@ function findClasses(code, parser) {
                     startLine,
                     endLine,
                     type: 'enum',
-                    members: [],
+                    members: extractEnumVariants(node, code),
                     modifiers: visibility ? [visibility] : [],
                     ...(docstring && { docstring }),
                     ...(generics && { generics })
@@ -258,7 +258,7 @@ function findClasses(code, parser) {
                     startLine,
                     endLine,
                     type: 'trait',
-                    members: [],
+                    members: extractTraitMembers(node, code),
                     modifiers: visibility ? [visibility] : [],
                     ...(docstring && { docstring }),
                     ...(generics && { generics })
@@ -443,6 +443,75 @@ function extractImplInfo(implNode) {
     return { name, traitName, typeName };
 }
 
+/**
+ * Extract enum variants
+ */
+function extractEnumVariants(enumNode, code) {
+    const variants = [];
+    const bodyNode = enumNode.childForFieldName('body');
+    if (!bodyNode) return variants;
+
+    for (let i = 0; i < bodyNode.namedChildCount; i++) {
+        const child = bodyNode.namedChild(i);
+        if (child.type === 'enum_variant') {
+            const nameNode = child.childForFieldName('name');
+            if (nameNode) {
+                const { startLine, endLine } = nodeToLocation(child, code);
+                // Check for tuple/struct variant data
+                let params = undefined;
+                for (let j = 0; j < child.namedChildCount; j++) {
+                    const variantChild = child.namedChild(j);
+                    if (variantChild.type === 'field_declaration_list' || variantChild.type === 'ordered_field_declaration_list') {
+                        params = variantChild.text.slice(1, -1);
+                    }
+                }
+                variants.push({
+                    name: nameNode.text,
+                    startLine,
+                    endLine,
+                    memberType: 'variant',
+                    ...(params !== undefined && { params })
+                });
+            }
+        }
+    }
+    return variants;
+}
+
+/**
+ * Extract trait method signatures
+ */
+function extractTraitMembers(traitNode, code) {
+    const members = [];
+    const bodyNode = traitNode.childForFieldName('body');
+    if (!bodyNode) return members;
+
+    for (let i = 0; i < bodyNode.namedChildCount; i++) {
+        const child = bodyNode.namedChild(i);
+        if (child.type === 'function_item' || child.type === 'function_signature_item') {
+            const nameNode = child.childForFieldName('name');
+            if (nameNode) {
+                const { startLine, endLine } = nodeToLocation(child, code);
+                const paramsNode = child.childForFieldName('parameters');
+                const returnType = extractReturnType(child);
+                const hasSelf = paramsNode && paramsNode.text.includes('self');
+
+                members.push({
+                    name: nameNode.text,
+                    startLine,
+                    endLine,
+                    memberType: 'method',
+                    isMethod: true,
+                    ...(paramsNode && { params: extractRustParams(paramsNode) }),
+                    ...(returnType && { returnType }),
+                    ...(hasSelf && { receiver: 'self' })
+                });
+            }
+        }
+    }
+    return members;
+}
+
 /**
  * Extract impl block members (functions)
  * @param {Node} implNode - The impl block AST node

package/mcp/server.js

@@ -34,6 +34,7 @@ const { ProjectIndex } = require('../core/project');
 const { findProjectRoot, isTestFile } = require('../core/discovery');
 const { detectLanguage } = require('../core/parser');
 const output = require('../core/output');
+const { pickBestDefinition, addTestExclusions } = require('../core/shared');
 
 // ============================================================================
 // INDEX CACHE
@@ -98,24 +99,6 @@ function getIndex(projectDir) {
     return index;
 }
 
-function pickBestDefinition(matches) {
-    const typeOrder = new Set(['class', 'struct', 'interface', 'type', 'impl']);
-    const scored = matches.map(m => {
-        let score = 0;
-        const rp = m.relativePath || '';
-        if (typeOrder.has(m.type)) score += 1000;
-        if (isTestFile(rp, detectLanguage(m.file))) score -= 500;
-        if (/^(examples?|docs?|vendor|third[_-]?party|benchmarks?|samples?)\//i.test(rp)) score -= 300;
-        if (/^(lib|src|core|internal|pkg|crates)\//i.test(rp)) score += 200;
-        if (m.startLine && m.endLine) {
-            score += Math.min(m.endLine - m.startLine, 100);
-        }
-        return { match: m, score };
-    });
-    scored.sort((a, b) => b.score - a.score);
-    return scored[0].match;
-}
-
 // ============================================================================
 // SERVER SETUP
 // ============================================================================
@@ -129,13 +112,6 @@ const server = new McpServer({
 // TOOL HELPERS
 // ============================================================================
 
-function addTestExclusions(exclude) {
-    const testPatterns = ['test', 'spec', '__tests__', '__mocks__', 'fixture', 'mock'];
-    const existing = new Set((exclude || []).map(e => e.toLowerCase()));
-    const additions = testPatterns.filter(p => !existing.has(p));
-    return [...(exclude || []), ...additions];
-}
-
 function parseExclude(excludeStr) {
     if (!excludeStr) return [];
     return excludeStr.split(',').map(s => s.trim()).filter(Boolean);
@@ -158,6 +134,31 @@ function toolError(message) {
     return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
 }
 
+/**
+ * Resolve a file path via index and validate it's within the project root.
+ * Returns the resolved absolute path string, or a toolError response.
+ */
+function resolveAndValidatePath(index, file) {
+    const resolved = index.resolveFilePathForQuery(file);
+    if (typeof resolved !== 'string') {
+        if (resolved.error === 'file-ambiguous') {
+            return toolError(`Ambiguous file "${file}". Candidates:\n${resolved.candidates.map(c => '  ' + c).join('\n')}`);
+        }
+        return toolError(`File not found: ${file}`);
+    }
+    // Path boundary check: ensure resolved path is within the project root
+    try {
+        const realPath = fs.realpathSync(resolved);
+        const realRoot = fs.realpathSync(index.root);
+        if (realPath !== realRoot && !realPath.startsWith(realRoot + path.sep)) {
+            return toolError(`File is outside project root: ${file}`);
+        }
+    } catch (e) {
+        return toolError(`Cannot resolve file path: ${file}`);
+    }
+    return resolved;
+}
+
 function requireName(name) {
     if (!name || !name.trim()) {
         return toolError('Symbol name is required.');
@@ -305,6 +306,7 @@ server.registerTool(
                     file,
                     exclude: parseExclude(exclude)
                 });
+                if (!ctx) return toolResult(`Symbol "${name}" not found.`);
                 const { text, expandable } = output.formatContext(ctx, {
                     expandHint: 'Use expand command with item number to see code for any item.'
                 });
@@ -346,6 +348,7 @@ server.registerTool(
                     includeMethods: include_methods,
                     includeUncertain: include_uncertain || false
                 });
+                if (!result) return toolResult(`Function "${name}" not found.`);
                 return toolResult(output.formatSmart(result));
             }
 
@@ -364,7 +367,9 @@ server.registerTool(
                 const err = requireName(name);
                 if (err) return err;
                 const index = getIndex(project_dir);
-                return toolResult(output.formatExample(index.example(name), name));
+                const exResult = index.example(name);
+                if (!exResult) return toolResult(`No usage examples found for "${name}".`);
+                return toolResult(output.formatExample(exResult, name));
             }
 
             case 'related': {
@@ -372,6 +377,7 @@ server.registerTool(
                 if (err) return err;
                 const index = getIndex(project_dir);
                 const result = index.related(name, { file, top, all: top !== undefined });
+                if (!result) return toolResult(`Symbol "${name}" not found.`);
                 return toolResult(output.formatRelated(result, {
                     showAll: top !== undefined,
                     top,
@@ -465,6 +471,9 @@ server.registerTool(
                 }
 
                 const match = matches.length > 1 ? pickBestDefinition(matches) : matches[0];
+                // Validate file is within project root
+                const fnPathCheck = resolveAndValidatePath(index, match.relativePath || path.relative(index.root, match.file));
+                if (typeof fnPathCheck !== 'string') return fnPathCheck;
                 const code = fs.readFileSync(match.file, 'utf-8');
                 const codeLines = code.split('\n');
                 const fnCode = codeLines.slice(match.startLine - 1, match.endLine).join('\n');
@@ -490,6 +499,9 @@ server.registerTool(
                 }
 
                 const match = matches.length > 1 ? pickBestDefinition(matches) : matches[0];
+                // Validate file is within project root
+                const clsPathCheck = resolveAndValidatePath(index, match.relativePath || path.relative(index.root, match.file));
+                if (typeof clsPathCheck !== 'string') return clsPathCheck;
 
                 const code = fs.readFileSync(match.file, 'utf-8');
                 const codeLines = code.split('\n');
@@ -542,13 +554,8 @@ server.registerTool(
                     return toolError('Line range is required (e.g. "10-20" or "15").');
                 }
                 const index = getIndex(project_dir);
-                const resolved = index.resolveFilePathForQuery(file);
-                if (typeof resolved !== 'string') {
-                    if (resolved.error === 'file-ambiguous') {
-                        return toolError(`Ambiguous file "${file}". Candidates:\n${resolved.candidates.map(c => '  ' + c).join('\n')}`);
-                    }
-                    return toolError(`File not found: ${file}`);
-                }
+                const resolved = resolveAndValidatePath(index, file);
+                if (typeof resolved !== 'string') return resolved; // toolError response
                 const filePath = resolved;
 
                 const parts = range.split('-');
@@ -631,6 +638,16 @@ server.registerTool(
                 if (!filePath || !fs.existsSync(filePath)) {
                     return toolError(`Cannot locate file for ${match.name}`);
                 }
+                // Validate file is within project root
+                try {
+                    const realPath = fs.realpathSync(filePath);
+                    const realRoot = fs.realpathSync(index.root);
+                    if (realPath !== realRoot && !realPath.startsWith(realRoot + path.sep)) {
+                        return toolError(`File is outside project root: ${match.name}`);
+                    }
+                } catch (e) {
+                    return toolError(`Cannot resolve file path for ${match.name}`);
+                }
 
                 const content = fs.readFileSync(filePath, 'utf-8');
                 const fileLines = content.split('\n');
@@ -732,6 +749,10 @@ server.registerTool(
             }
 
             case 'diff_impact': {
+                // Validate git ref format to prevent argument injection
+                if (base && !/^[a-zA-Z0-9._\-~\/^@{}:]+$/.test(base)) {
+                    return toolError(`Invalid git ref format: ${base}`);
+                }
                 const index = getIndex(project_dir);
                 const result = index.diffImpact({
                     base: base || 'HEAD',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucn",
-  "version": "3.7.4",
+  "version": "3.7.6",
   "description": "Universal Code Navigator — AST-based call graph analysis for AI agents. Find callers, trace impact, detect dead code across JS/TS, Python, Go, Rust, Java, and HTML. CLI, MCP server, and agent skill.",
   "main": "index.js",
   "bin": {

package/test/mcp-edge-cases.js

@@ -376,6 +376,34 @@ const tests = [
         args: { command: 'api', project_dir: PROJECT_DIR, file: 'nonexistent.js' },
         assert: (res, text, isError) => (isError && /not found/i.test(text)) || 'Expected file-not-found error message'
     },
+    {
+        category: 'Correctness',
+        tool: 'ucn',
+        desc: 'smart(nonexistent) returns "not found" message',
+        args: { command: 'smart', project_dir: PROJECT_DIR, name: 'zzz_nonexistent_symbol_xyz' },
+        assert: (res, text, isError) => (!isError && /not found/i.test(text)) || 'Expected "not found" message for nonexistent smart target'
+    },
+    {
+        category: 'Correctness',
+        tool: 'ucn',
+        desc: 'context(nonexistent) returns "not found" message',
+        args: { command: 'context', project_dir: PROJECT_DIR, name: 'zzz_nonexistent_symbol_xyz' },
+        assert: (res, text, isError) => (!isError && /not found/i.test(text)) || 'Expected "not found" message for nonexistent context target'
+    },
+    {
+        category: 'Correctness',
+        tool: 'ucn',
+        desc: 'example(nonexistent) returns "no examples" message',
+        args: { command: 'example', project_dir: PROJECT_DIR, name: 'zzz_nonexistent_symbol_xyz' },
+        assert: (res, text, isError) => (!isError && /no .* examples found|not found/i.test(text)) || 'Expected "no examples found" message for nonexistent example target'
+    },
+    {
+        category: 'Correctness',
+        tool: 'ucn',
+        desc: 'related(nonexistent) returns "not found" message',
+        args: { command: 'related', project_dir: PROJECT_DIR, name: 'zzz_nonexistent_symbol_xyz' },
+        assert: (res, text, isError) => (!isError && /not found/i.test(text)) || 'Expected "not found" message for nonexistent related target'
+    },
     {
         category: 'Correctness',
         tool: 'ucn',
@@ -411,6 +439,59 @@ const tests = [
         args: { command: 'imports', project_dir: PROJECT_DIR, file: 'utils.js' },
         assert: (res, text, isError) => (isError && /ambiguous/i.test(text)) || 'Expected file-ambiguous error for utils.js'
     },
+
+    // ========================================================================
+    // CATEGORY 3: Security (path traversal, argument injection)
+    // ========================================================================
+    {
+        category: 'Security',
+        tool: 'ucn',
+        desc: 'lines rejects path traversal (../../../../etc/passwd)',
+        args: { command: 'lines', project_dir: PROJECT_DIR, file: '../../../../etc/passwd', range: '1-5' },
+        assert: (res, text, isError) => (isError && (/not found/i.test(text) || /outside project/i.test(text))) || 'Expected error for path traversal'
+    },
+    {
+        category: 'Security',
+        tool: 'ucn',
+        desc: 'lines rejects path traversal (../../other-project/secret.js)',
+        args: { command: 'lines', project_dir: PROJECT_DIR, file: '../../other-project/secret.js', range: '1-5' },
+        assert: (res, text, isError) => (isError && (/not found/i.test(text) || /outside project/i.test(text))) || 'Expected error for path traversal'
+    },
+    {
+        category: 'Security',
+        tool: 'ucn',
+        desc: 'lines works with valid file',
+        args: { command: 'lines', project_dir: PROJECT_DIR, file: 'core/discovery.js', range: '1-3' },
+        assert: (res, text, isError) => (!isError && text.length > 0) || 'Expected valid output for core/discovery.js'
+    },
+    {
+        category: 'Security',
+        tool: 'ucn',
+        desc: 'diff_impact rejects --config argument injection',
+        args: { command: 'diff_impact', project_dir: PROJECT_DIR, base: '--config=malicious' },
+        assert: (res, text, isError) => (isError && /invalid git ref/i.test(text)) || 'Expected error for argument injection in base'
+    },
+    {
+        category: 'Security',
+        tool: 'ucn',
+        desc: 'diff_impact rejects -o flag injection',
+        args: { command: 'diff_impact', project_dir: PROJECT_DIR, base: '-o /tmp/evil' },
+        assert: (res, text, isError) => (isError && /invalid git ref/i.test(text)) || 'Expected error for flag injection in base'
+    },
+    {
+        category: 'Security',
+        tool: 'ucn',
+        desc: 'diff_impact accepts valid ref HEAD~3',
+        args: { command: 'diff_impact', project_dir: PROJECT_DIR, base: 'HEAD~3' },
+        assert: (res, text, isError) => true  // Should not error on valid ref format
+    },
+    {
+        category: 'Security',
+        tool: 'ucn',
+        desc: 'diff_impact accepts valid ref origin/main',
+        args: { command: 'diff_impact', project_dir: PROJECT_DIR, base: 'origin/main' },
+        assert: (res, text, isError) => true  // Should not error on valid ref format
+    },
 ];
 
 // ============================================================================