ucn 5.5.1 → 5.5.3

package/languages/utils.js

@@ -80,7 +80,11 @@ function nodeToLocation(node, codeOrLines) {
     const indentMatch = firstLine.match(/^(\s*)/);
     const indent = indentMatch ? indentMatch[1].length : 0;
 
-    return { startLine, endLine, indent };
+    return { startLine, endLine, indent, sourceSpan: {
+        start: node.startIndex, end: node.endIndex,
+        startLine, endLine,
+        startColumn: node.startPosition.column, endColumn: node.endPosition.column,
+    } };
 }
 
 /**
@@ -343,7 +347,7 @@ function parseRustParam(param, info) {
 function parseJavaParam(param, info) {
     if (param.type === 'formal_parameter' || param.type === 'spread_parameter') {
         let nameNode = param.childForFieldName('name');
-        const typeNode = param.childForFieldName('type');
+        let typeNode = param.childForFieldName('type');
         // Java varargs: spread_parameter wraps name in variable_declarator
         // e.g., `String... args` → spread_parameter > variable_declarator > identifier
         if (!nameNode && param.type === 'spread_parameter') {
@@ -355,8 +359,14 @@ function parseJavaParam(param, info) {
                 }
             }
         }
+        if (!typeNode && param.type === 'spread_parameter') {
+            const types = new Set(['type_identifier', 'scoped_type_identifier', 'generic_type',
+                'array_type', 'annotated_type', 'integral_type', 'floating_point_type', 'boolean_type']);
+            typeNode = param.namedChildren.find(child => types.has(child.type));
+        }
         if (nameNode) info.name = nodeTextWithoutComments(nameNode);
-        if (typeNode) info.type = nodeTextWithoutComments(typeNode);
+        if (typeNode) info.type = nodeTextWithoutComments(typeNode) +
+            (param.type === 'spread_parameter' ? '[]' : '');
         if (param.type === 'spread_parameter') info.rest = true;
     }
 }
@@ -676,6 +686,10 @@ function getTokenTypeAtPosition(rootNode, line, column) {
     // Find the smallest node at this position
     const node = rootNode.descendantForPosition({ row, column });
     if (!node) return 'code';
+    // A comment in an aliased rule can be wrapped with the alias type,
+    // depending on which traversal read it first (fix #420): an extra's
+    // grammar type is stable.
+    if (node.isExtra && /comment/.test(node.grammarType || '')) return 'comment';
 
     // Walk up the tree to check if we're in a comment or string
     let current = node;
@@ -843,17 +857,16 @@ const NAMED_CHILDREN_LIST = Symbol.for('ucn.namedChildrenList');
 function _buildNodeList(rootNode) {
     const nodes = [];
     const subtreeEnds = [];
-    // Iterative DFS with subtreeEnd tracking
-    // We use a post-processing step to fill subtreeEnds
-    function collect(node) {
+    // Depth-first preorder with each subtree boundary filled on return.
+    function collect(node, parent) {
         const idx = nodes.length;
         nodes.push(node);
         subtreeEnds.push(0);
         // Batched children read — one native call instead of N+1 (see
         // traverseTree); the array stays on the node for later reads.
-        const children = node[NAMED_CHILDREN_LIST] ? node[NAMED_CHILDREN_LIST]() : node.namedChildren;
+        const children = node[NAMED_CHILDREN_LIST] ? node[NAMED_CHILDREN_LIST](parent) : node.namedChildren;
         for (let i = 0; i < children.length; i++) {
-            collect(children[i]);
+            collect(children[i], node);
         }
         subtreeEnds[idx] = nodes.length;
     }
@@ -1322,6 +1335,20 @@ function genericArityOf(text) {
     return null;
 }
 
+// A type argument list on an enclosing segment belongs to that segment:
+// erasing everything after the first '<' would turn Outer<T>.Inner into
+// Outer. Callers without enclosing generic identity must retain uncertainty.
+function hasParameterizedQualifier(text) {
+    let depth = 0, parameterized = false;
+    for (const ch of String(text || '')) {
+        if (ch === '<') depth++;
+        else if (ch === '>') {
+            if (--depth === 0) parameterized = true;
+        } else if (ch === '.' && depth === 0 && parameterized) return true;
+    }
+    return false;
+}
+
 // Exclusive clauses of one compound statement (fix #398F): `if`/`elif`/
 // `else` and `case` arms never both run; a `try` body and its handlers, two
 // handlers, a handler and the `try` `else` are alternatives. A `try` body and
@@ -1358,8 +1385,40 @@ function goPathPackageName(modulePath) {
     return cut > 0 ? base.slice(0, cut) : base;
 }
 
+// Node types that declare a type parameter, and the name-token types under
+// them (fix #421; shared with core/provenance-type.js).
+const TYPE_PARAMETER_PARENTS = Object.freeze(['type_parameter', 'type_parameters',
+    'constrained_type_parameter', 'type_parameter_declaration',
+    'optional_type_parameter_declaration', 'variadic_type_parameter_declaration']);
+const TYPE_PARAMETER_NAME_TOKENS = Object.freeze(['identifier', 'type_identifier', 'namespace_identifier',
+    'qualified_identifier', 'scoped_type_identifier', 'qualified_name', 'alias_qualified_name']);
+const TYPE_PARAMETER_NAME_TOKEN_SET = new Set(TYPE_PARAMETER_NAME_TOKENS);
+
+/**
+ * Every name token written directly in a type-parameter declaration of the
+ * trees (fix #421): a superset of the file's type-parameter names (bounds
+ * and defaults included), sorted. A name outside it is no type parameter
+ * anywhere in the file, which a construction's name-scope proof reads
+ * without parsing the file again.
+ */
+function declaredTypeParameterNames(...trees) {
+    const names = new Set();
+    for (const tree of trees) {
+        for (const parent of tree?.rootNode?.descendantsOfType([...TYPE_PARAMETER_PARENTS]) || []) {
+            for (const node of parent.children) {
+                if (TYPE_PARAMETER_NAME_TOKEN_SET.has(node.type)) names.add(node.text);
+            }
+        }
+    }
+    return [...names].sort();
+}
+
 module.exports = {
+    TYPE_PARAMETER_PARENTS,
+    TYPE_PARAMETER_NAME_TOKENS,
+    declaredTypeParameterNames,
     genericArityOf,
+    hasParameterizedQualifier,
     goPathPackageName,
     parseErrorRegions,
     containsOwnNode,

package/mcp/server.js

@@ -35,6 +35,7 @@ const {
     formatSurfaceMessage,
 } = require('../core/registry');
 const { execute } = require('../core/execute');
+const { sourceRangeTarget } = require('../core/public-command');
 const { describeError, UcnError } = require('../core/errors');
 const { applyOutputBudget, MAX_OUTPUT_CHARS } = require('../core/output-budget');
 
@@ -245,7 +246,7 @@ Use UCN for semantic questions: exact definitions, symbol-aware callers/callees,
 - check: symbol signature check when name is set; precommit check when omitted. plan previews the selected declaration plus indexed call/import/export edits.
 - deadcode/audit_async/stacktrace: focused audits and runtime evidence. Computed dispatch is reported as a health/deletion blind spot; unknown decorators and member-assigned handlers are withheld from default dead-code claims.
 
-CONFIRMED carries target-identity evidence. UNVERIFIED is possible and requires review; when same-name definitions compete, show returns their stable handles once above the sites. ACCOUNT conserves observed literal-name lines; an observed-text zero never claims semantic completeness or safe deletion. Evidence weights are ordinal, not probabilities. Warnings, excluded reasons, and contract metadata remain visible when caller evidence is returned. Release evaluation cross-checks overlapping stable-handle claims across find, show, source, impact, tests, check, and caller trace, and compares pinned real-repository samples with ts-morph, Pyright, gopls, rust-analyzer, JDT LS, clangd, and Roslyn.` + generateMcpParamSection();
+CONFIRMED carries target-identity evidence. UNVERIFIED is possible and requires review; when same-name definitions compete, show returns their stable handles once above the sites. ACCOUNT conserves observed literal-name lines; an observed-text zero never claims semantic completeness or safe deletion. Evidence weights are ordinal, not probabilities. Warnings, excluded reasons, and contract metadata remain visible when caller evidence is returned. Releases are gated on pinned real repositories: sampled callers, callees, value references, and dead-code claims are compared with ts-morph, Pyright, gopls, rust-analyzer, JDT LS, Roslyn, and clangd, and one handle's claims must agree across find, show, source, impact, tests, check, and caller trace.` + generateMcpParamSection();
 
 // The default description is the only public contract. The former verbose
 // description is intentionally not selectable: it documented retired commands
@@ -306,7 +307,7 @@ const INPUT_SHAPE = {
     rename_to: stringParam('New name for the function, method, or type (plan command)'),
     default_value: stringParam('Default value for added parameter (plan command)'),
     stack: stringParam('The stack trace text to parse (stacktrace command)'),
-    range: stringParam('source line range, e.g. "10-20" or "15"; requires file.'),
+    range: stringParam('source line range, e.g. "10-20" or "15", of the file given as file or name.'),
     base: stringParam('Git ref (default: HEAD). impact/check without a symbol: diff against it; check with a symbol: compare the declaration with its version there. E.g. "HEAD~3", "main", a commit SHA'),
     staged: booleanParam('impact/check without a symbol: analyze staged changes.'),
     deep: booleanParam('repo: include health and sample the ordinal resolution-evidence profile, not accuracy.'),
@@ -473,6 +474,11 @@ server.registerTool(
             // Post-result checks are still retained below for symbol-derived
             // paths, but a range request may point at a real file outside the
             // project and must fail before any content leaves the process.
+            // `name` is the file of a range request (name=<file>, range="N-M").
+            if (canonicalCommand === 'source') {
+                const target = sourceRangeTarget(ep);
+                if (target !== ep) { delete ep.name; ep.file = target.file; }
+            }
             if (canonicalCommand === 'source' && ep.file) {
                 const sourcePath = resolveAndValidatePath(index, ep.file);
                 if (typeof sourcePath !== 'string') return sourcePath;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucn",
-  "version": "5.5.1",
+  "version": "5.5.3",
   "mcpName": "io.github.mleoca/ucn",
   "description": "Auditable AST code intelligence for AI agents: 18 task-oriented commands through one MCP tool, CLI, or agent skill. Supports JS/TS, Python, Go, Rust, Java, C, C++, C#, and HTML.",
   "main": "index.js",
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "version": "node scripts/sync-server-version.js && git add server.json",
-    "test": "node --test test/audit-5.4.0.test.js test/audit-5.3.8.test.js test/audit-5.3.7.test.js test/audit-5.3.6.test.js test/evidence-provenance.test.js test/provenance-unit.test.js test/shell-output.test.js test/parser-unit.test.js test/integration.test.js test/cache.test.js test/formatter.test.js test/interactive.test.js test/feature.test.js test/regression-js.test.js test/regression-py.test.js test/regression-go.test.js test/regression-java.test.js test/regression-rust.test.js test/regression-c-family.test.js test/regression-cross.test.js test/regression-mcp.test.js test/mcp-protocol.test.js test/mcp-sdk-compat.test.js test/dependency-security.test.js test/regression-parser.test.js test/regression-commands.test.js test/regression-fixes.test.js test/regression-bugfixes.test.js test/release-surface-regressions.test.js test/prerelease-audit.test.js test/release-readiness-audit.test.js test/cross-language.test.js test/accuracy.test.js test/command-coverage.test.js test/perf-optimizations.test.js test/performance-gate-policy.test.js test/oracle-gate-policy.test.js test/outcome-policy.test.js test/consistency-eval.test.js test/agent-public-surface-benchmark.test.js test/command-contracts.test.js test/language-adapter.test.js test/systematic-test.js test/mcp-edge-cases.js test/conservation.test.js test/parity-test.js test/trust-matrix.test.js",
+    "test": "node --test test/audit-5.4.0.test.js test/audit-5.3.8.test.js test/audit-5.3.7.test.js test/audit-5.3.6.test.js test/evidence-provenance.test.js test/provenance-unit.test.js test/provenance-scope.test.js test/shell-output.test.js test/parser-unit.test.js test/integration.test.js test/cache.test.js test/formatter.test.js test/interactive.test.js test/feature.test.js test/regression-js.test.js test/regression-py.test.js test/regression-go.test.js test/regression-java.test.js test/regression-rust.test.js test/regression-c-family.test.js test/regression-cross.test.js test/regression-mcp.test.js test/mcp-protocol.test.js test/mcp-sdk-compat.test.js test/dependency-security.test.js test/regression-parser.test.js test/regression-commands.test.js test/regression-fixes.test.js test/regression-bugfixes.test.js test/release-surface-regressions.test.js test/prerelease-audit.test.js test/release-readiness-audit.test.js test/cross-language.test.js test/accuracy.test.js test/command-coverage.test.js test/perf-optimizations.test.js test/performance-gate-policy.test.js test/oracle-gate-policy.test.js test/outcome-policy.test.js test/consistency-eval.test.js test/agent-public-surface-benchmark.test.js test/command-contracts.test.js test/language-adapter.test.js test/systematic-test.js test/mcp-edge-cases.js test/conservation.test.js test/parity-test.js test/trust-matrix.test.js",
     "benchmark:agent": "node test/agent-public-surface-benchmark.js",
     "benchmark:agent:gate": "node test/agent-public-surface-benchmark.js --gate",
     "benchmark:agent:legacy": "node test/agent-understanding-benchmark.js",
@@ -87,7 +87,7 @@
   "dependencies": {
     "node-addon-api": "8.9.2",
     "node-gyp-build": "4.8.4",
-    "re2js": "2.8.6",
+    "re2js": "2.8.7",
     "ret": "0.5.0",
     "safe-regex2": "5.1.1",
     "tree-sitter": "0.21.1",