ucn 4.0.2 → 4.1.0

package/core/discovery.js

@@ -148,11 +148,19 @@ function parseGitignore(projectRoot) {
         // Strip trailing slash (directory indicator) — shouldIgnore checks names, not types
         let pattern = line.endsWith('/') ? line.slice(0, -1) : line;
 
-        // Strip leading slash (root-relative indicator) — we only match by name
-        if (pattern.startsWith('/')) pattern = pattern.slice(1);
-
-        // Skip patterns with path separators — shouldIgnore matches single name segments,
-        // not full paths. Patterns like "foo/bar" would need walkDir-level support.
+        // Leading slash = ANCHORED to the .gitignore's directory (fix #226).
+        // git semantics: `/locale` ignores only the root-level locale, never
+        // src/locale. Stripping the slash and matching by bare name silently
+        // excluded real source trees (dayjs ignores its BUILD outputs /locale
+        // /plugin — src/locale and src/plugin are ~160 tracked source files
+        // UCN never indexed, with no warning). Anchored patterns keep the
+        // slash; shouldIgnore applies them only at the walk's anchor root.
+        const anchored = pattern.startsWith('/');
+        if (anchored) pattern = pattern.slice(1);
+
+        // Skip patterns with interior path separators — shouldIgnore matches
+        // single name segments, not full paths. Patterns like "foo/bar" would
+        // need walkDir-level support.
         if (pattern.includes('/')) continue;
 
         // Skip empty after stripping
@@ -161,7 +169,7 @@ function parseGitignore(projectRoot) {
         // Avoid duplicating built-in ignores
         if (DEFAULT_IGNORES.includes(pattern)) continue;
 
-        patterns.push(pattern);
+        patterns.push(anchored ? '/' + pattern : pattern);
     }
 
     return patterns;
@@ -211,6 +219,9 @@ function expandGlob(pattern, options = {}) {
         ignores,
         maxDepth,
         followSymlinks,
+        // Anchored gitignore patterns ('/name') apply only to entries directly
+        // under the project root — the .gitignore's own directory (fix #226).
+        anchorRoot: root,
         onFile: (filePath) => {
             if (files.length < maxFiles) {
                 files.push(filePath);
@@ -309,7 +320,7 @@ function walkDir(dir, options, depth = 0, visited = new Set()) {
     for (const entry of entries) {
         const fullPath = path.join(dir, entry.name);
 
-        if (shouldIgnore(entry.name, options.ignores, dir)) continue;
+        if (shouldIgnore(entry.name, options.ignores, dir, dir === options.anchorRoot)) continue;
 
         let isDir = entry.isDirectory();
         let isFile = entry.isFile();
@@ -340,14 +351,22 @@ function walkDir(dir, options, depth = 0, visited = new Set()) {
 /**
  * Check if a file/directory name should be ignored
  * @param {string} name - File/directory name
- * @param {string[]} ignores - Patterns to always ignore
+ * @param {string[]} ignores - Patterns to always ignore. Patterns with a
+ *   leading '/' are ANCHORED (git semantics, fix #226): they match only when
+ *   `atAnchorRoot` is true — i.e. the entry sits directly in the directory
+ *   the .gitignore belongs to. Default false errs toward KEEPING files.
  * @param {string} [parentDir] - Parent directory path (for conditional checks)
+ * @param {boolean} [atAnchorRoot] - Whether parentDir IS the anchor root
  */
 const _globRegexCache = new Map();
 
-function shouldIgnore(name, ignores, parentDir) {
+function shouldIgnore(name, ignores, parentDir, atAnchorRoot = false) {
     // Check unconditional ignores
-    for (const pattern of ignores) {
+    for (let pattern of ignores) {
+        if (pattern.charCodeAt(0) === 47 /* '/' */) {
+            if (!atAnchorRoot) continue;
+            pattern = pattern.slice(1);
+        }
         if (pattern.includes('*')) {
             let regex = _globRegexCache.get(pattern);
             if (!regex) {
@@ -570,5 +589,6 @@ module.exports = {
     PROJECT_MARKERS,
     TEST_PATTERNS,
     ALL_SUPPORTED_EXTENSIONS,
-    MANIFEST_HINTS
+    MANIFEST_HINTS,
+    compareNames
 };

package/core/entrypoints.js

@@ -13,6 +13,7 @@
 'use strict';
 
 const fs = require('fs');
+const { codeUnitCompare, NON_CALLABLE_TYPES } = require('./shared');
 const path = require('path');
 const { getCachedCalls } = require('./callers');
 const { getLanguageModule } = require('../languages');
@@ -69,24 +70,28 @@ const FRAMEWORK_PATTERNS = [
         pattern: /^(Get|Post|Put|Delete|Patch|Options|Head|All|Controller|Injectable|Module)$/,
     },
 
-    // FastAPI (Python) — decorators: @app.get('/path'), @router.post('/path')
+    // Flask (Python) — decorators: @app.route('/path'), @bp.get('/path').
+    // Listed BEFORE fastapi: both frameworks share the @app.get/@app.post
+    // shortcuts, and @app.route is Flask-only — a file using @app.route +
+    // @app.post on the SAME app object got split across two frameworks
+    // (fix #245; first match wins in matchDecoratorOrModifier).
     {
-        id: 'fastapi-route',
+        id: 'flask-route',
         languages: new Set(['python']),
         type: 'http',
-        framework: 'fastapi',
+        framework: 'flask',
         detection: 'decorator',
-        pattern: /^(app|router)\.(get|post|put|delete|patch|options|head)/,
+        pattern: /^(app|bp|blueprint)\.(route|get|post|put|delete|patch)/,
     },
 
-    // Flask (Python) — decorators: @app.route('/path'), @bp.get('/path')
+    // FastAPI (Python) — decorators: @app.get('/path'), @router.post('/path')
     {
-        id: 'flask-route',
+        id: 'fastapi-route',
         languages: new Set(['python']),
         type: 'http',
-        framework: 'flask',
+        framework: 'fastapi',
         detection: 'decorator',
-        pattern: /^(app|bp|blueprint)\.(route|get|post|put|delete|patch)/,
+        pattern: /^(app|router)\.(get|post|put|delete|patch|options|head)/,
     },
 
     // Django (Python) — decorators: @api_view, @action, @permission_classes
@@ -131,6 +136,25 @@ const FRAMEWORK_PATTERNS = [
         methodPattern: /^(HandleFunc|Handle)$/,
     },
 
+    // Actix (Rust) — the runtime/test macros are NOT routes (fix #243:
+    // #[actix_web::main] was typed http, so --type runtime missed main on
+    // actix apps and --type http listed it as a route).
+    {
+        id: 'actix-main',
+        languages: new Set(['rust']),
+        type: 'runtime',
+        framework: 'actix',
+        detection: 'modifier',
+        pattern: /^actix_web::main$/,
+    },
+    {
+        id: 'actix-test',
+        languages: new Set(['rust']),
+        type: 'test',
+        framework: 'actix',
+        detection: 'modifier',
+        pattern: /^actix_web::test$/,
+    },
     // Actix (Rust) — modifiers from #[get("/path")], #[post("/path")]
     {
         id: 'actix-route',
@@ -138,7 +162,7 @@ const FRAMEWORK_PATTERNS = [
         type: 'http',
         framework: 'actix',
         detection: 'modifier',
-        pattern: /^(get|post|put|delete|patch|actix_web::main|actix_web::test)$/,
+        pattern: /^(get|post|put|delete|patch)$/,
     },
 
     // ── Dependency Injection ────────────────────────────────────────────
@@ -257,7 +281,8 @@ const FRAMEWORK_PATTERNS = [
 
     // ── Go Runtime Entry Points ─────────────────────────────────────────
 
-    // Go main function (program entry)
+    // Go main function (program entry). symbolFilter: only FREE functions —
+    // a method named main on a receiver is an ordinary method (fix #243).
     {
         id: 'go-main',
         languages: new Set(['go']),
@@ -265,6 +290,7 @@ const FRAMEWORK_PATTERNS = [
         framework: 'go',
         detection: 'namePattern',
         pattern: /^main$/,
+        symbolFilter: (s) => !s.className && !s.receiver,
     },
 
     // Go init functions (package initialization, called by runtime)
@@ -275,6 +301,7 @@ const FRAMEWORK_PATTERNS = [
         framework: 'go',
         detection: 'namePattern',
         pattern: /^init$/,
+        symbolFilter: (s) => !s.className && !s.receiver,
     },
 
     // Go test functions (called by go test)
@@ -289,7 +316,8 @@ const FRAMEWORK_PATTERNS = [
 
     // ── Java entry points ─────────────────────────────────────────────
 
-    // Java main(String[] args) — JVM entry point
+    // Java main(String[] args) — JVM entry point. Java main IS a method, but
+    // only a STATIC one is JVM-invocable (fix #243).
     {
         id: 'java-main',
         languages: new Set(['java']),
@@ -297,6 +325,7 @@ const FRAMEWORK_PATTERNS = [
         framework: 'java',
         detection: 'namePattern',
         pattern: /^main$/,
+        symbolFilter: (s) => (s.modifiers || []).includes('static'),
     },
 
     // JUnit @Test family — Java parser lowercases annotations into `modifiers`,
@@ -334,7 +363,8 @@ const FRAMEWORK_PATTERNS = [
 
     // ── Rust entry points ─────────────────────────────────────────────
 
-    // Rust main() — fn main() is the binary entry point
+    // Rust main() — the FREE function fn main() is the binary entry point;
+    // an impl method named main is an ordinary method (fix #243)
     {
         id: 'rust-main',
         languages: new Set(['rust']),
@@ -342,6 +372,7 @@ const FRAMEWORK_PATTERNS = [
         framework: 'rust',
         detection: 'namePattern',
         pattern: /^main$/,
+        symbolFilter: (s) => !s.className && !s.receiver,
     },
 
     // Rust #[test] attribute — Rust parser stores attributes as `modifiers`,
@@ -522,6 +553,20 @@ function buildCallbackEntrypointMap(index) {
 
     const result = new Map(); // name -> info
 
+    // Attribute the entry point to the handler's DEFINITION, not the
+    // registration call site: `about handler --file X --line N` handles must
+    // resolve, and reachability seeding matches (absoluteFile, line) against
+    // symbol defs — a handler defined in a different file than its
+    // registration was never seeded. The registration site is kept as
+    // evidence (registrationFile/registrationLine).
+    const resolveHandlerDef = (name, registrationFile) => {
+        const defs = index.symbols.get(name);
+        if (!defs || defs.length === 0) return null;
+        // Prefer a def in the registration file; defs are canonical-sorted,
+        // so falling back to the first is deterministic.
+        return defs.find(d => d.file === registrationFile) || defs[0];
+    };
+
     for (const [filePath, fileEntry] of index.files) {
         const lang = fileEntry.language;
 
@@ -552,11 +597,19 @@ function buildCallbackEntrypointMap(index) {
             }
 
             if (routeLines.size > 0) {
+                // Pass 2b prep: routes whose handler is an inline NAMED
+                // function expression (`app.post('/x', function createUser()
+                // {...})`) have no function-reference record — the name is
+                // only visible as the enclosingFunction of the handler
+                // body's own calls (fix #247; the route vanished entirely).
+                const handledLines = new Set();
+
                 // Pass 2: find callbacks on route-registration lines
                 for (const call of calls) {
                     if (!call.isFunctionReference && !call.isPotentialCallback) continue;
                     const route = routeLines.get(call.line);
                     if (!route) continue;
+                    handledLines.add(call.line);
 
                     // BUG M2: only treat as a handler if the name resolves to a
                     // project-defined symbol. Library code like gin's
@@ -568,13 +621,40 @@ function buildCallbackEntrypointMap(index) {
                     if (!index.symbols.has(call.name)) continue;
 
                     if (!result.has(call.name)) {
+                        const def = resolveHandlerDef(call.name, filePath);
                         result.set(call.name, {
+                            framework: route.pattern.framework,
+                            type: route.pattern.type,
+                            patternId: route.pattern.id,
+                            method: route.call.name.toUpperCase(),
+                            file: def ? def.file : filePath,
+                            line: def ? def.startLine : call.line,
+                            registrationFile: filePath,
+                            registrationLine: call.line,
+                        });
+                    }
+                }
+
+                // Pass 2b: inline NAMED function-expression handlers. The
+                // function is defined IN argument position, so the only
+                // evidence is the enclosingFunction of calls inside its body,
+                // anchored at the registration line (fix #247).
+                for (const call of calls) {
+                    const enc = call.enclosingFunction;
+                    if (!enc || !enc.name || enc.name === '<anonymous>') continue;
+                    const route = routeLines.get(enc.startLine);
+                    if (!route || handledLines.has(enc.startLine)) continue;
+                    if (index.symbols.has(enc.name)) continue; // real defs took pass 2
+                    if (!result.has(enc.name)) {
+                        result.set(enc.name, {
                             framework: route.pattern.framework,
                             type: route.pattern.type,
                             patternId: route.pattern.id,
                             method: route.call.name.toUpperCase(),
                             file: filePath,
-                            line: call.line,
+                            line: enc.startLine,
+                            registrationFile: filePath,
+                            registrationLine: enc.startLine,
                         });
                     }
                 }
@@ -592,13 +672,16 @@ function buildCallbackEntrypointMap(index) {
                     if (pattern.typePattern.test(call.compositeType) &&
                         pattern.fieldPattern.test(call.fieldName)) {
                         if (!result.has(call.name)) {
+                            const def = resolveHandlerDef(call.name, filePath);
                             result.set(call.name, {
                                 framework: pattern.framework,
                                 type: pattern.type,
                                 patternId: pattern.id,
                                 method: call.fieldName,
-                                file: filePath,
-                                line: call.line,
+                                file: def ? def.file : filePath,
+                                line: def ? def.startLine : call.line,
+                                registrationFile: filePath,
+                                registrationLine: call.line,
                             });
                         }
                         break;
@@ -622,6 +705,32 @@ function buildCallbackEntrypointMap(index) {
  * @returns {Array<{ name, file, line, type, framework, patternId, evidence, confidence }>}
  */
 function detectEntrypoints(index, options = {}) {
+    // Validate --type against the pattern registry up front — an unknown
+    // value used to fall through to the filter and silently return nothing.
+    if (options.type) {
+        const validTypes = new Set(FRAMEWORK_PATTERNS.map(p => p.type));
+        if (!validTypes.has(options.type)) {
+            return {
+                error: 'invalid-type',
+                message: `Unknown type "${options.type}". Valid: ${[...validTypes].sort().join(', ')}.`,
+            };
+        }
+    }
+
+    // Same discipline for --framework (fix #243) — a typo like 'flsk'
+    // silently filtered everything to an empty result.
+    if (options.framework) {
+        const validFrameworks = new Set(FRAMEWORK_PATTERNS.map(p => p.framework.toLowerCase()));
+        const wanted = String(options.framework).split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
+        const unknown = wanted.filter(f => !validFrameworks.has(f));
+        if (unknown.length > 0) {
+            return {
+                error: 'invalid-framework',
+                message: `Unknown framework "${unknown.join('", "')}". Valid: ${[...validFrameworks].sort().join(', ')}.`,
+            };
+        }
+    }
+
     // Build callback entrypoint map (call-pattern detection)
     const callbackMap = buildCallbackEntrypointMap(index);
 
@@ -711,6 +820,9 @@ function detectEntrypoints(index, options = {}) {
             // Check name-based patterns (main, init, TestXxx, etc.)
             for (const np of namePatterns) {
                 if (!np.languages.has(fileEntry.language)) continue;
+                // Per-pattern symbol predicate (fix #243) — e.g. main must be
+                // a free function (Rust/Go) or a static method (Java)
+                if (np.symbolFilter && !np.symbolFilter(symbol)) continue;
                 if (np.pattern.test(name)) {
                     const key = `${symbol.file}:${symbol.startLine}:${name}`;
                     if (seen.has(key)) continue;
@@ -743,6 +855,17 @@ function detectEntrypoints(index, options = {}) {
         if (seen.has(key)) continue;
         seen.add(key);
 
+        let evidence = `${info.method} route handler`;
+        let registeredAt;
+        if (info.registrationFile) {
+            const regEntry = index.files.get(info.registrationFile);
+            const regRel = regEntry?.relativePath || info.registrationFile;
+            registeredAt = { file: regRel, line: info.registrationLine };
+            if (info.registrationFile !== info.file || info.registrationLine !== info.line) {
+                evidence += ` — registered at ${regRel}:${info.registrationLine}`;
+            }
+        }
+
         results.push({
             name,
             file: relPath,
@@ -751,7 +874,8 @@ function detectEntrypoints(index, options = {}) {
             type: info.type,
             framework: info.framework,
             patternId: info.patternId,
-            evidence: [`${info.method} route handler`],
+            evidence: [evidence],
+            ...(registeredAt && { registeredAt }),
             confidence: 0.90,
         });
     }
@@ -860,6 +984,14 @@ function detectEntrypoints(index, options = {}) {
                 const fmatches = fileMatches.get(symbol.file);
                 if (!fmatches || fmatches.length === 0) continue;
 
+                // Entry points are executable: enum members, interface
+                // property signatures, type aliases, and fields in a matched
+                // file are declarations, not runtime entries (fix #247 — a
+                // spec file listed its enum members as test entry points).
+                // Callable members carry their own symbols, so reachability
+                // seeding loses nothing.
+                if (NON_CALLABLE_TYPES.has(symbol.type)) continue;
+
                 // Apply narrow filter: for shebang/cli-main files, only allow
                 // identified entry symbols.
                 if (narrowAllowedByFile.has(symbol.file)) {
@@ -916,7 +1048,7 @@ function detectEntrypoints(index, options = {}) {
 
     // Sort by file, then line
     filtered.sort((a, b) => {
-        if (a.file !== b.file) return a.file.localeCompare(b.file);
+        if (a.file !== b.file) return codeUnitCompare(a.file, b.file);
         return a.line - b.line;
     });