ucn 4.0.1 → 4.1.0

package/core/shared.js

@@ -5,6 +5,19 @@
 const { isTestFile } = require('./discovery');
 const { detectLanguage } = require('./parser');
 
+/**
+ * Code-unit string comparison (rule 11 / fix #227): output ordering is part
+ * of the public contract and must be byte-identical across machines —
+ * localeCompare depends on the host ICU locale (case-insensitive-ish
+ * collation, locale tailoring), so two machines can render the same result
+ * in different orders. Every output-path comparator uses this instead.
+ */
+function codeUnitCompare(a, b) {
+    const sa = String(a ?? '');
+    const sb = String(b ?? '');
+    return sa < sb ? -1 : sa > sb ? 1 : 0;
+}
+
 /**
  * Path-based test heuristic — matches the same patterns as `find`'s exclusion
  * logic so that `about` and `find` agree on which files are de-emphasized.
@@ -59,7 +72,7 @@ function pickBestDefinition(matches, opts = {}) {
     });
     // Stable sort: by score desc, then alphabetical relativePath (so two equal-score
     // matches always pick the same one across runs).
-    scored.sort((a, b) => (b.score - a.score) || a.rp.localeCompare(b.rp));
+    scored.sort((a, b) => (b.score - a.score) || codeUnitCompare(a.rp, b.rp));
     return scored[0].match;
 }
 
@@ -84,6 +97,21 @@ function escapeRegExp(text) {
 // Symbol types that are not callable (used to filter class/struct/type declarations from call analysis)
 const NON_CALLABLE_TYPES = new Set(['class', 'struct', 'interface', 'type', 'enum', 'trait', 'state', 'impl', 'field']);
 
+/**
+ * Every function-shaped symbol kind across the parsers (fix #251 — stats
+ * ranked "longest/hottest functions" from a 7-kind subset, so private
+ * methods, accessors, and dunders were invisible to the rankings while the
+ * same command's "By Type" counted them). deadcode keeps its own narrower
+ * list: dunders ('special') stay out of the audit — protocol dispatch is
+ * invisible to the usage scan.
+ */
+const CALLABLE_SYMBOL_KINDS = new Set([
+    'function', 'method', 'static', 'public', 'abstract', 'constructor',
+    'private', 'get', 'set', 'property', 'setter', 'deleter', 'classmethod',
+    'special', 'override', 'static get', 'static set', 'override get',
+    'override set', 'static override', 'static override get', 'static override set',
+]);
+
 /**
  * Stable symbol handle: `relativePath:line` or `relativePath:line:name`.
  *
@@ -159,14 +187,270 @@ function isOverrideMarked(def) {
     return false;
 }
 
+// Per-language text patterns for the "blind spots" UCN's AST can't follow:
+// eval/exec-style code execution and reflection (dynamic attribute access /
+// dynamic dispatch). ONE source of truth so doctor's trust scan and
+// detectCompleteness's about-footer warning count identically (field-report #2:
+// they used to diverge — doctor 497 reflection vs footer 194, eval 3 vs 2 —
+// because each kept its own regex set). Dynamic imports are NOT here: those are
+// structural (fileEntry.dynamicImports), the AST-accurate count both paths share.
+// `new Function(...)` is categorized as eval (code execution), not reflection.
+const BLINDSPOT_TEXT_PATTERNS = {
+    reflection: {
+        python:     /\b(getattr|hasattr|setattr|__import__|importlib\.import_module)\s*\(/g,
+        javascript: /\bReflect\.\w+\s*\(/g,
+        typescript: /\bReflect\.\w+\s*\(/g,
+        go:         /\breflect\.\w+\s*\(/g,
+        java:       /\.getDeclaredMethod\b|\.getMethod\b|\.getDeclaredField\b|Class\.forName\b/g,
+        rust:       /\bAny::downcast/g,
+    },
+    eval: {
+        python:     /\b(eval|exec)\s*\(/g,
+        javascript: /\beval\s*\(|\bnew\s+Function\s*\(/g,
+        typescript: /\beval\s*\(|\bnew\s+Function\s*\(/g,
+    },
+};
+
+/** True when a language has any text-blind-spot pattern (so callers can skip the file read otherwise). */
+function hasTextBlindspots(language) {
+    return !!(BLINDSPOT_TEXT_PATTERNS.reflection[language] || BLINDSPOT_TEXT_PATTERNS.eval[language]);
+}
+
+/**
+ * Count text-detected blind spots (eval/exec, reflection) in one file's source.
+ * Returns { eval, reflection } OCCURRENCE counts (global match). Shared by doctor
+ * and detectCompleteness so both report the same numbers (field-report #2).
+ */
+function countTextBlindspots(content, language) {
+    const reRe = BLINDSPOT_TEXT_PATTERNS.reflection[language];
+    const evRe = BLINDSPOT_TEXT_PATTERNS.eval[language];
+    return {
+        eval: evRe ? (content.match(evRe) || []).length : 0,
+        reflection: reRe ? (content.match(reRe) || []).length : 0,
+    };
+}
+
+/**
+ * Line ranges of INLINE test symbols in a source file — Rust #[test] fns and
+ * #[cfg(test)] module members. A production file promoted to "test file"
+ * because it CONTAINS an inline test module is test code only within these
+ * ranges; counting its production lines as test matches claimed false
+ * coverage (fix #244: `let url = self.build_url(path)` in a production
+ * method body was credited as a test of build_url).
+ * @returns {Array<[number, number]>}
+ */
+function inlineTestRanges(fileEntry) {
+    const ranges = [];
+    for (const s of fileEntry.symbols || []) {
+        if (s.modifiers?.includes('test') || s.modifiers?.includes('cfg_test_module')) {
+            ranges.push([s.startLine, s.endLine ?? s.startLine]);
+        }
+    }
+    return ranges;
+}
+
+/** True when a line number falls inside any of the given [start, end] ranges. */
+function lineInRanges(line, ranges) {
+    for (const [s, e] of ranges) {
+        if (line >= s && line <= e) return true;
+    }
+    return false;
+}
+
+/**
+ * Class names whose instances dispatch `methodName` to className's own
+ * definition: the class itself plus its transitive NON-overriding
+ * descendants (fix #246 — the #198 subtype rule brought to the test-scan
+ * className scoping: `c.describe()` on `Circle extends Shape` runs
+ * Shape.describe when Circle doesn't override it). Descent stops at an
+ * overriding child — its subtree binds the override, not the target.
+ * @returns {Set<string>}
+ */
+function classDispatchNames(index, className, methodName, cap = 256) {
+    const out = new Set([className]);
+    if (!index?.extendedByGraph || !methodName) return out;
+    const methodDefs = index.symbols?.get(methodName) || [];
+    const queue = [className];
+    while (queue.length > 0 && out.size < cap) {
+        const children = index.extendedByGraph.get(queue.pop());
+        if (!children) continue;
+        for (const child of children) {
+            const cName = typeof child === 'string' ? child : child.name;
+            if (!cName || out.has(cName)) continue;
+            if (methodDefs.some(d => d.className === cName)) continue; // overrides
+            out.add(cName);
+            queue.push(cName);
+        }
+    }
+    return out;
+}
+
+// Languages with /* */ block comments (fix #253d). Python/HTML stay out:
+// Python has none (docstrings are strings, and doctest code inside them is
+// runnable), HTML's <!-- --> wraps virtual-JS line mapping.
+const BLOCK_COMMENT_LANGS = new Set(['javascript', 'typescript', 'tsx', 'go', 'java', 'rust']);
+
+// JS/TS chars after which a `/` starts a regex literal, not division.
+const _REGEX_PREV_CHARS = new Set(['=', '(', '[', '{', ',', ';', ':', '!', '&', '|', '?', '+', '-', '*', '%', '~', '^', '<', '>']);
+const _REGEX_PREV_WORDS = new Set(['return', 'typeof', 'case', 'in', 'of', 'new', 'delete', 'void', 'instanceof', 'do', 'else', 'yield', 'await']);
+
+/**
+ * Replace /* ... *\/ block-comment interiors with spaces, preserving line
+ * structure, so line-based usage scans stop counting commented-out code as
+ * consumption (fix #253d — the deadcode scan only skipped // and # lines).
+ *
+ * Failure directions are asymmetric: masking real code drops real usages
+ * (false-dead risk), while missing a comment keeps the status quo (false-
+ * alive). The scanner therefore only opens a block on a literal `/*` whose
+ * string/regex context is positively ruled out, and every ambiguous
+ * construct (mis-detected regex, template interpolation, lifetime lookalike)
+ * resolves to "skip without masking".
+ */
+function maskBlockComments(content, language) {
+    if (!BLOCK_COMMENT_LANGS.has(language) || !content.includes('/*')) return content;
+    const isJsLike = language === 'javascript' || language === 'typescript' || language === 'tsx';
+    const hasBacktick = isJsLike || language === 'go';
+    const out = content.split('');
+    const n = content.length;
+    let i = 0;
+    let prevSig = null; // last significant char seen in code mode
+    let prevWord = '';  // last identifier-ish word (survives whitespace)
+    const wordCh = (c) => c != null && /[\w$]/.test(c);
+    while (i < n) {
+        const ch = content[i];
+        const next = i + 1 < n ? content[i + 1] : '';
+        if (ch === '/' && next === '/') {
+            // Line comment — leave the text (the line scan handles // itself)
+            while (i < n && content[i] !== '\n') i++;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            let depth = 1;
+            out[i] = ' '; out[i + 1] = ' ';
+            i += 2;
+            while (i < n && depth > 0) {
+                if (content[i] === '*' && content[i + 1] === '/') {
+                    depth--; out[i] = ' '; out[i + 1] = ' '; i += 2; continue;
+                }
+                if (language === 'rust' && content[i] === '/' && content[i + 1] === '*') {
+                    depth++; out[i] = ' '; out[i + 1] = ' '; i += 2; continue; // Rust block comments nest
+                }
+                if (content[i] !== '\n') out[i] = ' ';
+                i++;
+            }
+            prevSig = null; prevWord = '';
+            continue;
+        }
+        if (isJsLike && ch === '/') {
+            // Regex literal detection: a false "regex" here only SKIPS a
+            // region (missing comments inside it — safe); it never masks.
+            const isRegex = prevSig === null || _REGEX_PREV_CHARS.has(prevSig) ||
+                (wordCh(prevSig) && _REGEX_PREV_WORDS.has(prevWord));
+            if (isRegex) {
+                let j = i + 1, inClass = false;
+                while (j < n && content[j] !== '\n') {
+                    const c = content[j];
+                    if (c === '\\') { j += 2; continue; }
+                    if (c === '[') inClass = true;
+                    else if (c === ']') inClass = false;
+                    else if (c === '/' && !inClass) break;
+                    j++;
+                }
+                if (j < n && content[j] === '/') {
+                    i = j + 1; prevSig = '/'; prevWord = '';
+                    continue;
+                }
+                // No closing slash on the line — it was division after all.
+            }
+        }
+        if (language === 'rust' && (ch === 'r' || ch === 'b') && !(i > 0 && wordCh(content[i - 1]))) {
+            // Raw strings r"..." / r#"..."# / br#"..."# span lines with no escapes.
+            let j = i + (ch === 'b' && next === 'r' ? 2 : 1);
+            if (ch === 'r' || (ch === 'b' && next === 'r')) {
+                let hashes = 0;
+                while (content[j] === '#') { hashes++; j++; }
+                if (content[j] === '"') {
+                    j++;
+                    while (j < n) {
+                        if (content[j] === '"') {
+                            let h = 0;
+                            while (h < hashes && content[j + 1 + h] === '#') h++;
+                            if (h === hashes) { j += 1 + hashes; break; }
+                        }
+                        j++;
+                    }
+                    i = j; prevSig = '"'; prevWord = '';
+                    continue;
+                }
+            }
+        }
+        if (ch === '"' || ch === "'") {
+            if (language === 'java' && ch === '"' && next === '"' && content[i + 2] === '"') {
+                // Java text block """...""" — spans lines
+                i += 3;
+                while (i < n && !(content[i] === '"' && content[i + 1] === '"' && content[i + 2] === '"')) i++;
+                i += 3; prevSig = '"'; prevWord = '';
+                continue;
+            }
+            if (language === 'rust' && ch === "'" && !(next === '\\' || content[i + 2] === "'")) {
+                // Lifetime/label ('a, 'outer:), not a char literal
+                prevSig = ch; prevWord = ''; i++;
+                continue;
+            }
+            const quote = ch;
+            i++;
+            if (language === 'rust' && quote === '"') {
+                // Rust plain strings may span lines
+                while (i < n && content[i] !== quote) {
+                    if (content[i] === '\\') i++;
+                    i++;
+                }
+            } else {
+                // Single-line semantics elsewhere; unterminated ends at EOL
+                while (i < n && content[i] !== quote && content[i] !== '\n') {
+                    if (content[i] === '\\') i++;
+                    i++;
+                }
+            }
+            if (i < n && content[i] === quote) i++;
+            prevSig = quote; prevWord = '';
+            continue;
+        }
+        if (hasBacktick && ch === '`') {
+            // JS/TS template literal / Go raw string — spans lines
+            i++;
+            while (i < n && content[i] !== '`') {
+                if (isJsLike && content[i] === '\\') i++; // Go raw strings have no escapes
+                i++;
+            }
+            i++; prevSig = '`'; prevWord = '';
+            continue;
+        }
+        if (!/\s/.test(ch)) {
+            prevWord = wordCh(ch) ? (wordCh(prevSig) ? prevWord + ch : ch) : '';
+            prevSig = ch;
+        }
+        i++;
+    }
+    return out.join('');
+}
+
 module.exports = {
     pickBestDefinition,
     addTestExclusions,
     escapeRegExp,
+    codeUnitCompare,
+    inlineTestRanges,
+    lineInRanges,
+    classDispatchNames,
+    maskBlockComments,
     NON_CALLABLE_TYPES,
+    CALLABLE_SYMBOL_KINDS,
     formatSymbolHandle,
     parseSymbolHandle,
     looksLikeHandle,
     isTestPath,
     isOverrideMarked,
+    hasTextBlindspots,
+    countTextBlindspots,
 };

package/core/stacktrace.js

@@ -276,6 +276,15 @@ function parseStackTrace(index, stackText) {
     // Stack trace patterns for different languages/runtimes
     // Order matters - more specific patterns first
     const patterns = [
+        // Rust pre-1.65 panic header: "panicked at 'message', src/main.rs:150:9"
+        // MUST precede the Node pattern — its [^():]+ file group has no
+        // space/comma guard, so the quoted message glued into the file field
+        // and the panic-location frame never resolved (fix #251).
+        { regex: /panicked at '(?:[^'\\]|\\.)*',\s+([^\s:]+):(\d+)(?::(\d+))?/, extract: (m) => ({ file: m[1], line: parseInt(m[2]), col: m[3] ? parseInt(m[3]) : null, funcName: null }) },
+        // V8 nested eval: "at eval (eval at createProcessor (file.js:10:5), <anonymous>:1:20)"
+        // Attribute to the outer function — the inner <anonymous> position
+        // has no project file (fix #251: the name parsed as "eval (eval at …").
+        { regex: /at\s+.*?\beval at\s+(.+?)\s+\(([^():]+):(\d+)(?::(\d+))?\)/, extract: (m) => ({ funcName: m[1], file: m[2], line: parseInt(m[3]), col: m[4] ? parseInt(m[4]) : null }) },
         // JavaScript Node.js: "at functionName (file.js:line:col)" or "at file.js:line:col"
         { regex: /at\s+(?:async\s+)?(?:(.+?)\s+\()?([^():]+):(\d+)(?::(\d+))?\)?/, extract: (m) => ({ funcName: m[1] || null, file: m[2], line: parseInt(m[3]), col: m[4] ? parseInt(m[4]) : null }) },
         // Deno: "at functionName (file:///path/to/file.ts:line:col)"
@@ -305,6 +314,7 @@ function parseStackTrace(index, stackText) {
 
     // Track Go function names that appear on a line before the file:line
     let pendingGoFuncName = null;
+    let skippedFrames = 0;
 
     for (const line of lines) {
         const trimmed = line.trim();
@@ -318,7 +328,10 @@ function parseStackTrace(index, stackText) {
                 if (pattern.extract === null) {
                     // Go function-only line (e.g. "package.FunctionName()")
                     // Extract the function name and carry it forward to the next file:line
-                    const fullName = match[1];
+                    // Generic instantiation markers first: "pkg.MapKeys[...]"
+                    // — lastIndexOf('.') landed inside the brackets and the
+                    // frame name parsed as "]" (fix #251).
+                    const fullName = match[1].replace(/\[[^\]]*\]$/, '');
                     // Go uses fully-qualified names: pkg/path.FuncName or pkg/path.(*Type).Method
                     const lastDot = fullName.lastIndexOf('.');
                     pendingGoFuncName = lastDot >= 0 ? fullName.slice(lastDot + 1) : fullName;
@@ -351,12 +364,21 @@ function parseStackTrace(index, stackText) {
             }
         }
         if (!matched) {
+            // Frame-shaped lines without a resolvable file:line — Java
+            // "(Unknown Source)"/"(Native Method)", zero-position frames —
+            // used to vanish without a trace (fix #251: inconsistent with
+            // unfound-file frames, which render found=false).
+            if (/^at\s/.test(trimmed)) skippedFrames++;
             pendingGoFuncName = null; // Reset if line doesn't match any pattern
         }
     }
 
     return {
+        // Advisory command (v4 two-tier surface): frames matched by path
+        // similarity scoring, not verified identity.
+        advisory: 'best-effort-frame-matching',
         frameCount: frames.length,
+        ...(skippedFrames > 0 && { skippedFrames }),
         frames
     };
 }