ucn 5.5.2 → 5.5.3

package/.claude/skills/ucn/references/commands.md

@@ -62,7 +62,7 @@ Use text search (grep/ripgrep) for simple literals, error messages, configuratio
 | `--depth=N` | Trace, dependency, or test traversal depth. |
 | `--direction=<value>` | Trace (`callees`/`callers`) or dependency (`imports`/`importers`/`both`) direction. |
 | `--all` | Lift result and formatter caps where a command supports it; the truncation notice says when it does. |
-| `--max-chars=N` | Text budget in characters (10K targeted / 3K broad by default; 100K ceiling), including notices and trust lines. Trust lines are reserved first; a limit too small for them withholds the answer and names the budget that carries them. MCP: `max_chars`. JSON is not transport-truncated. |
+| `--max-chars=N` | Text budget in characters (10K targeted / 3K broad by default; 100K ceiling), including notices and trust lines. Trust lines are reserved first; a limit too small for them withholds the answer and names the budget that carries them. MCP: `max_chars`. CLI JSON is uncapped even with an explicit budget; `meta.maxChars` is `"not-applied"`. |
 | `--compact` / `--no-compact` | Token-efficient or full presentation (`show`/`impact` default compact, `usages` full). |
 | `--range=N-M` | Explicit line range with `source <file>` or `source --file=<path>`. |
 | `--json` | Stable `{ meta, data }` envelope; `meta.contract` carries the truth boundary, decision safety, and next actions. |
@@ -177,7 +177,7 @@ In JS/TS and Python, where an import runs the imported module, cycles distinguis
 
 Route tables count too: Django URLconfs (`path`/`re_path`/`include`, composed from `ROOT_URLCONF`), DRF routers, Starlette `Route`/`Mount`/`Host` lists, Flask `add_url_rule`, aiohttp `add_routes`/`router.add_*`. Methods come from the view (`require_*` decorators, class-view handlers, viewset actions); an unresolved view serves `ALL`. Tags: `[regex]` (a `re_path` shown in path form, an unconvertible part as `{?...}`), `[drf-router]`, `[static]`, and `[include]`/`[mount]` for a target that cannot be resolved (shown as `prefix/{?target}`, matched only as uncertain). Django composes as Django does: an include prefix and the included pattern are concatenated as written (`path("api", include(...))` + `"items/"` serves `/apiitems/`); a `re_path` without `^` or, for a view, without `$` matches any text there, shown as `{?*}` (matched as a catch-all); a regex group that can match `/` is written `<path:name>`.
 
-Client receivers are recognized by evidence (a receiver typed to an HTTP client class, or bound to a pytest fixture that constructs one), not only by name. Request-configuration calls (`request(OpenAPI, { method, url })`, `client.post({ url })`, `session.request(method=..., url=...)`, generated OpenAPI SDKs) count as clients when the callee's definition reaches an HTTP call (fetch, axios, requests, ...). Request-shaped calls on an unrecognized receiver or an unproven helper are listed under `Possible client requests` (JSON `uncertainRequests`, with the reason), counted in `meta`, never in the inventory.
+Client receivers require HTTP import, constructor, or factory evidence; names such as `client`, `session`, or `api` alone stay possible and never create bridges. Python follows returned clients and fixture chains, including imported/class fixtures and fixtures returning factories; JavaScript/TypeScript follows imported client values and factories such as `axios.create`, `ky.create`, and `got.extend`. Request-configuration calls (`request(OpenAPI, { method, url })`, `client.post({ url })`, `session.request(method=..., url=...)`, generated OpenAPI SDKs) count as clients when the callee's definition reaches an HTTP call (fetch, axios, requests, ...). Request-shaped calls on an unrecognized receiver or an unproven helper are listed under `Possible client requests` (JSON `uncertainRequests`, with the reason), counted in `meta`, never in the inventory.
 
 A request through an in-process test client built from an app (`TestClient(app)`, a fixture's client, `app.test_client()`, `AsyncClient(transport=ASGITransport(app=app))`) bridges only to routes of that app or mounted under it; an app declared as a function or class serves the request itself and matches no route. A supertest client (`request(app).get('/x')`, `request.agent(app)`, a client bound to a local; the name bound to the `supertest` module, whatever it is called) is one too, its app followed through imports and `app.callback()` / `http.createServer(app)`; `request(this.app)` in a mocha test or hook takes the app its suite's `before`/`beforeEach` hook stores on `this` (the nearest suite assigning it, which writes it nowhere else and registers nothing through `this.app`). When the app does not resolve, every path match stays, marked `[unscoped]` (JSON `unscoped: true`). A HEAD request matches a GET route where the framework serves HEAD with GET (Starlette, Flask, Express).
 
@@ -187,7 +187,7 @@ Route paths include router mount prefixes composed from the code: FastAPI `inclu
 
 Constructor declarations are not claims of their own (`N constructor(s) not listed`, JSON `excludedConstructors`): reflection, frameworks and the initializer the compiler generates when one is deleted can depend on them without a construction call. An unused type still appears as a whole-type candidate.
 
-`deadcode` is a candidate generator; every candidate is review-only. Computed dispatch such as `handlers[key]()` is a reported blind spot; registry members reached by a modeled computed receiver are withheld. Statically named reflection such as `getattr(obj, "run")` is positive liveness evidence, so every matching member spelling is withheld. A reflective name built from literal fragments around a runtime part (`getattr(self, "_get_%s_perms" % src)`, f-strings, `.format`, `"get" + name` in `getMethod`, `MethodByName(fmt.Sprintf(...))`, `obj["on" + evt]`) is a pattern: members it can spell on a receiver that may hold their class are withheld and counted per pattern, and `show`/`impact`/`plan` list the site as an unverified `reflection-pattern` caller. `eval(name)`/`globals()[name]` reach only their own module's top-level names; a fully dynamic one (`eval(code)`) withholds them all and is listed as a caller of none. A reflective name that is a parameter of the enclosing function, never reassigned (`registry[type](..)` in a call, `getattr(self, name)`, `getMethod(name)`), takes the string literals the function's callers pass at that position: those members are withheld and listed as `reflection-pattern` callers. Reflection with no specific literal part is counted and warned because it cannot be attributed to one member.
+`deadcode` is a candidate generator; every candidate is review-only. Computed dispatch such as `handlers[key]()` is a reported blind spot; registry members reached by a modeled computed receiver are withheld. Statically named reflection such as `getattr(obj, "run")` is positive liveness evidence, so every matching member spelling is withheld. A reflective name built from literal fragments around a runtime part (`getattr(self, "_get_%s_perms" % src)`, f-strings, `.format`, `"get" + name` in `getMethod`, `MethodByName(fmt.Sprintf(...))`, `obj["on" + evt]`) is a pattern: members it can spell on a receiver that may hold their class are withheld and counted per pattern, and `show`/`impact`/`plan` list the site as an unverified `reflection-pattern` caller. `eval(name)`/`globals()[name]` reach only their own module's top-level names; a fully dynamic one (`eval(code)`) withholds them all and is listed as a caller of none. A reflective name that is a parameter of the enclosing function, never reassigned (`registry[type](..)` in a call, `getattr(self, name)`, `getMethod(name)`), takes the string literals the function's callers pass at that position: those members are withheld and listed as `reflection-pattern` callers. Reflection with no specific literal part is counted and warned because it cannot be attributed to one member. When a file contains dynamic reflection, `deadcode` also conservatively withholds candidates in that file whose exact spelling occurs as an AST string literal. Text and JSON (`reflection.withheldByTable`) list each name and literal location. This does not prove flow: even an unrelated literal in that file can withhold a candidate; another file without dynamic reflection is unaffected.
 
 Members the runtime or compiler invokes by name are hidden as runtime callbacks: Python dunders and Enum hooks (`_generate_next_value_`, `_missing_`) on Enum subclasses, Java serialization callbacks and `serialVersionUID` on Serializable types (also when written `implements java.io.Serializable` or inherited) and, as possible members with the protocol's signature, on classes that derive from another out-of-project type (`extends IOException`, `extends ArrayList`; `plan` keeps their edits and lists the definition for review), C# pattern members (`GetEnumerator`, `GetAwaiter`, `Deconstruct`), C# compiler-required types the project declares for a feature it uses (`System.Runtime.CompilerServices.IsExternalInit` with `init` accessors or positional records, `RequiredMemberAttribute` with `required` members, `System.Index`/`Range` with `^i`/`a..b`; unused when the feature is absent), JS `toJSON`/`then`/`[Symbol.*]`, C++ `begin`/`end`. Unknown decorators/annotations and member-assigned event handlers are also withheld by default because they can be the registration itself. Members of a class deriving from an outside base (underscore hooks such as a stream's `_transform` included), members of an object literal declared with an outside type (`ProxyHandler` traps) and members of impls of an outside Rust trait (`impl FromIterator for A`, however many project types implement it) may be called by that outside code and are hidden as external-contract surface.
 

package/README.md

@@ -220,6 +220,8 @@ records carry a tab-separated reason. An empty `--lines` listing exits 1, an
 error exits 2, and a successful listing exits 0. `--lines` supports `find`, `show`,
 `usages`, `search`, and `impact`; `show --lines` lists callers by default.
 Use `--json` when the script needs structured fields or a tree result.
+CLI JSON is uncapped by `--max-chars`, even when explicitly supplied;
+`meta.maxChars` reports `"not-applied"`. Use command limits to narrow the result.
 
 Listings are deterministic for a given source tree: a fresh build, a cache
 load, and an incremental rebuild return the same records in the same order.

package/cli/index.js

@@ -963,6 +963,7 @@ Common flags:
   --range=N-M (source <file> --range=N-M, or --file=PATH)
   --base=REF --staged --no-cache --clear-cache [--all] --max-files=N --workers=N
   --max-chars=N (text characters, not UTF-8 bytes; default 10K targeted / 3K broad, ceiling 100K)
+           JSON is uncapped; meta.maxChars is "not-applied", even with an explicit budget.
   --lines  find/usages/search/show/impact: grep -n shape, one path:line:text
            record per output line; usages combines occurrences on each source line
            (tags after a tab: # unverified: <reason>, # import,

package/core/bridge.js

@@ -2279,53 +2279,6 @@ function extractNextjsRoutes(index) {
  * Detect HTTP client requests across the project.
  * Cached on `index._endpointsCache.clientRequests`.
  */
-// Python HTTP client types whose instances are receivers of request calls.
-// A receiver typed to one of these (with-binding, constructor assignment) or
-// bound to a pytest fixture that constructs one is a client by evidence, not
-// by name (fix #349: 145 of 625 real `tc.get("/api/...")` sites on one repo
-// were invisible because the receiver was not literally named `client`).
-const PY_CLIENT_TYPES = new Set([
-    'TestClient', 'Client', 'AsyncClient', 'Session', 'FlaskClient',
-    'ClientSession', 'AsyncSession', 'HTTPConnection', 'HTTPSConnection',
-]);
-const PY_CLIENT_FACTORIES = new Set(['test_client', 'Session', 'Client', 'AsyncClient']);
-const PY_REQUEST_METHODS = /^(get|post|put|delete|patch|options|head|request)$/;
-
-function _pythonClientFixtures(index) {
-    if (index._endpointsCache?.pyClientFixtures) return index._endpointsCache.pyClientFixtures;
-    const fixtures = new Set();
-    for (const [filePath, fileEntry] of index.files) {
-        if (fileEntry.language !== 'python') continue;
-        const fixtureDefs = (fileEntry.symbols || []).filter(s =>
-            (s.decorators || []).some(d => /(^|\.)fixture$/.test(String(d))));
-        if (fixtureDefs.length === 0) continue;
-        const calls = getCachedCalls(index, filePath) || [];
-        for (const def of fixtureDefs) {
-            const constructsClient = calls.some(c =>
-                c.enclosingFunction?.name === def.name &&
-                c.enclosingFunction?.startLine === def.startLine &&
-                (PY_CLIENT_TYPES.has(c.name) || (c.isMethod && PY_CLIENT_FACTORIES.has(c.name))));
-            if (constructsClient) fixtures.add(def.name);
-        }
-    }
-    if (!index._endpointsCache) index._endpointsCache = {};
-    index._endpointsCache.pyClientFixtures = fixtures;
-    return fixtures;
-}
-
-function _pythonClientReceiver(index, fileEntry, call, fixtures) {
-    if (!call.isMethod || !call.receiver || !PY_REQUEST_METHODS.test(call.name)) return null;
-    if (call.receiverType && PY_CLIENT_TYPES.has(String(call.receiverType).split('.').pop())) {
-        return 'python-client';
-    }
-    if (fixtures.size === 0 || !fixtures.has(call.receiver)) return null;
-    const fn = call.enclosingFunction;
-    if (!fn) return null;
-    const sym = (fileEntry.symbols || []).find(s => s.name === fn.name && s.startLine === fn.startLine);
-    const params = String(sym?.params || '').split(',').map(p => p.trim().split(/[:=]/)[0].trim());
-    return params.includes(call.receiver) ? 'pytest-client-fixture' : null;
-}
-
 // `fastify().route({...})` - a route declared on a freshly built server.
 const JS_SERVER_FACTORY_CALL = /^(fastify|Fastify|express|Hono|Koa)$/;
 
@@ -2347,7 +2300,7 @@ function extractClientRequests(index) {
     }
     const requests = [];
     const uncertain = [];
-    const pyFixtures = _pythonClientFixtures(index);
+    const clientProof = new (require('./client-receivers').ClientReceiverProof)(index, endpointsSession(index));
     let helperProof = null;
 
     for (const [filePath, fileEntry] of index.files) {
@@ -2431,7 +2384,9 @@ function extractClientRequests(index) {
                     continue;
                 }
                 if (!helperProof) helperProof = new RequestHelperProof(index, endpointsSession(index));
-                const proof = helperProof.classify(filePath, call);
+                const proof = call.isMethod
+                    ? { proven: !!clientProof.classify(filePath, call), reason: 'receiver-unproven' }
+                    : helperProof.classify(filePath, call);
                 const verb = call.isMethod && /^(get|post|put|delete|patch|options|head)$/i.test(call.name)
                     ? call.name.toUpperCase() : null;
                 const method = cfg.method || verb || 'ALL';
@@ -2462,7 +2417,7 @@ function extractClientRequests(index) {
             // fix #383: Go request constructors read their method and URL
             // from their own argument positions.
             if (call.requestTarget && lang === 'go' && call.receiver && !call.isPathCall &&
-                matchClientRequest({ ...call, firstStringArg: call.requestTarget.url }, lang, calls)) {
+                matchClientRequest({ ...call, firstStringArg: call.requestTarget.url }, lang, clientProof.classify(filePath, call))) {
                 const target = call.requestTarget;
                 if (isPathShaped(target.url)) {
                     // A request with a path but no scheme and host cannot be
@@ -2496,26 +2451,22 @@ function extractClientRequests(index) {
                 continue;
             }
             if (!call.firstStringArg) continue;
-            let r = matchClientRequest(call, lang, calls);
-            if (!r && lang === 'python') {
-                const framework = _pythonClientReceiver(index, fileEntry, call, pyFixtures);
-                if (framework) {
-                    r = { method: call.name.toUpperCase() === 'REQUEST' ? 'ALL' : call.name.toUpperCase(),
-                        framework, methodInferred: call.name === 'request' };
-                }
-            }
+            const conf = CLIENT_PATTERNS[lang];
+            const candidate = conf && (conf.bareCalls.has(call.name) ||
+                conf.receivers.some(p => p.methodPattern.test(call.name)));
+            const r = matchClientRequest(call, lang, candidate ? clientProof.classify(filePath, call) : null);
             if (!r) {
                 // Visible uncertainty: request-shaped call on an unrecognized
                 // receiver with a path-shaped literal. Listed, never counted.
-                const conf = CLIENT_PATTERNS[lang];
                 const pathShaped = call.firstStringArg.startsWith('/') || call.firstStringArg.includes('://');
-                if (conf && call.isMethod && call.receiver && pathShaped &&
+                if (conf && call.receiver && pathShaped &&
                     conf.receivers.some(p => p.methodPattern.test(call.name))) {
                     uncertain.push({
                         receiver: call.receiver, method: call.name, path: call.firstStringArg,
                         file: fileEntry.relativePath || filePath, absoluteFile: filePath, line: call.line,
                         callerName: call.enclosingFunction?.name || '<top-level>',
-                        reason: 'receiver-unrecognized',
+                        reason: conf.receivers.some(p => p.receiverPattern.test(call.receiver))
+                            ? 'receiver-name-only' : 'receiver-unrecognized',
                     });
                 }
                 continue;
@@ -2640,9 +2591,9 @@ function supertestProducerOf(call, calls, producers, locals) {
  * Match a call against client request patterns.
  * Returns { method, framework, methodInferred } or null.
  */
-function matchClientRequest(call, lang, allCallsInFile) {
+function matchClientRequest(call, lang, origin) {
     const conf = CLIENT_PATTERNS[lang];
-    if (!conf) return null;
+    if (!conf || !origin) return null;
 
     // 1) Bare-call patterns: fetch('/path') or fetch('/path', { method: 'POST' })
     if (!call.isMethod && conf.bareCalls.has(call.name)) {
@@ -2662,7 +2613,6 @@ function matchClientRequest(call, lang, allCallsInFile) {
     const isMethodLike = call.isMethod || (lang === 'go' && !!call.receiver && !call.isPathCall);
     if (isMethodLike && call.receiver) {
         for (const p of conf.receivers) {
-            if (!p.receiverPattern.test(call.receiver)) continue;
             if (!p.methodPattern.test(call.name)) continue;
 
             // Determine method
@@ -2697,7 +2647,7 @@ function matchClientRequest(call, lang, allCallsInFile) {
             } else {
                 method = methodName.toUpperCase();
             }
-            return { method, framework: p.framework, methodInferred: inferred };
+            return { method, framework: origin, methodInferred: inferred };
         }
     }
 

package/core/client-receivers.js

@@ -0,0 +1,189 @@
+'use strict';
+
+// Request verbs and receiver names discover candidates; only the value's
+// origin can confirm HTTP. Shared by positional and configuration requests.
+const rg = require('./route-graph');
+const { RequestHelperProof, PY_HTTP_MODULES, pyImportedFunction } = require('./request-helpers');
+const { PythonClientResolver } = require('./inprocess-clients');
+const { field, namedChildren, unwrap, findDecl } = rg;
+
+const PY_CLIENT_MODULES = [...PY_HTTP_MODULES, 'fastapi.testclient',
+    'starlette.testclient', 'flask.testing', 'werkzeug.test', 'django.test'];
+const PY_FACTORIES = new Set(['Session', 'Client', 'AsyncClient', 'TestClient',
+    'FlaskClient', 'ClientSession', 'AsyncSession', 'HTTPConnection', 'HTTPSConnection',
+    'PoolManager']);
+const NOMINAL_CLIENTS = {
+    go: ['net/http.Client', 'net/http'],
+    rust: ['reqwest.Client', 'reqwest.blocking.Client', 'reqwest'],
+    java: ['org.springframework.web.client.RestTemplate',
+        'org.springframework.web.reactive.function.client.WebClient', 'java.net.http.HttpClient'],
+    csharp: ['System.Net.Http.HttpClient'],
+};
+const HTTP_FRAMEWORK = { go: 'go-http', rust: 'reqwest', java: 'spring-client', csharp: 'dotnet-httpclient' };
+const MAX_DEPTH = 12;
+
+class ClientReceiverProof {
+    constructor(index, sess) {
+        this.index = index;
+        this.sess = sess;
+        this.helpers = new RequestHelperProof(index, sess);
+        this.python = new PythonClientResolver(index, sess, () => new Set());
+        this.memo = new Map();
+    }
+
+    classify(file, call) {
+        const lang = this.sess.lang(file);
+        if (['javascript', 'typescript', 'tsx'].includes(lang)) {
+            if (!this.helpers.classify(file, call).proven) return null;
+            const binding = this.helpers.jsBinding(file, call.receiver);
+            const decl = call.receiver && findDecl(this.sess, file, call.receiver,
+                this.sess.root(file)?.descendantForIndex(call.callStart, call.callStart));
+            const module = binding?.binding.module || this.helpers.requireSpecOf(decl);
+            return ['axios', 'ky', 'got'].includes(module) ? module : 'http-client';
+        }
+        if (lang === 'python') {
+            const root = this.sess.root(file);
+            const start = call.callSite?.start;
+            if (!root || start == null) return null;
+            let node = root.descendantForIndex(start, start);
+            while (node && node.type !== 'call') node = node.parent;
+            const fn = node && field(node, 'function');
+            const receiver = fn?.type === 'attribute' ? unwrap(field(fn, 'object')) : null;
+            if (!receiver) return null;
+            if (PY_HTTP_MODULES.includes(this.pyModule(file, receiver))) return 'requests';
+            const values = this.python.clientValues(file, call.line, call.receiver, call.name);
+            if (!values?.length || !values.every(v => this.pyValue(v.file, v.expr, 0))) return null;
+            return findDecl(this.sess, file, receiver.text, receiver)?.kind === 'param'
+                ? 'pytest-client-fixture' : 'python-client';
+        }
+        return this.nominal(file, call, lang);
+    }
+
+    pyModule(file, expr) {
+        if (expr?.type === 'identifier' && !findDecl(this.sess, file, expr.text, expr)) {
+            const entry = this.sess.entry(file);
+            const candidates = (entry?.importBindings || []).filter(b => (b.alias || b.name) === expr.text);
+            const visible = candidates.filter(binding => {
+                if (!binding.deferred) return true;
+                const row = binding.line - 1;
+                const imports = this.sess.root(file)?.descendantsOfType(
+                    ['import_statement', 'import_from_statement'],
+                    { row, column: 0 }, { row, column: 1 << 20 }) || [];
+                return imports.some(node => {
+                    let scope = node.parent;
+                    while (scope && scope.type !== 'function_definition' && scope.type !== 'class_definition') scope = scope.parent;
+                    return scope?.type === 'function_definition' && scope.startIndex <= expr.startIndex &&
+                        scope.endIndex >= expr.endIndex;
+                });
+            });
+            if (!visible.length || new Set(visible.map(b => `${b.kind}:${b.module}:${b.name}`)).size !== 1) return null;
+            const binding = visible[0];
+            if (entry.moduleResolved?.[binding.module]) return null;
+            const module = binding.module;
+            return PY_CLIENT_MODULES.includes(module)
+                ? (binding.kind === 'from' ? `${module}.${binding.name}` : module) : null;
+        }
+        if (expr?.type === 'attribute') {
+            const parent = this.pyModule(file, unwrap(field(expr, 'object')));
+            return parent ? `${parent}.${field(expr, 'attribute')?.text}` : null;
+        }
+        return null;
+    }
+
+    pyValue(file, expr, depth) {
+        const e = unwrap(expr);
+        if (!e || depth > MAX_DEPTH) return false;
+        const key = `${file}:${e.startIndex}:${e.endIndex}`;
+        if (this.memo.has(key)) return this.memo.get(key);
+        this.memo.set(key, false); // cycles cannot prove an origin
+        let proven = false;
+        if (e.type === 'identifier') {
+            let fn = e.parent;
+            while (fn && fn.type !== 'function_definition') fn = fn.parent;
+            const value = this.python.followBinding(file, fn, e, 0);
+            if (value && (value.file !== file || value.expr?.startIndex !== e.startIndex)) {
+                proven = this.pyValue(value.file, value.expr, depth + 1);
+            } else {
+                const decl = findDecl(this.sess, file, e.text, e);
+                if (decl?.count === 1 && decl.valueNode) proven = this.pyValue(file, decl.valueNode, depth + 1);
+            }
+        } else if (e.type === 'call') {
+            const callee = unwrap(field(e, 'function'));
+            const identity = this.pyModule(file, callee);
+            if (identity && PY_FACTORIES.has(identity.split('.').pop())) proven = true;
+            if (!proven) {
+                // A helper must RETURN a proven client; merely performing
+                // HTTP somewhere in its body does not type its return value.
+                const decl = callee?.type === 'identifier' && findDecl(this.sess, file, callee.text, callee);
+                let target = decl?.kind === 'function'
+                    ? { kind: 'function', file, node: decl.valueNode }
+                    : !decl && callee?.type === 'identifier' ? pyImportedFunction(this.sess, file, callee.text, 0) : null;
+                if (decl?.kind === 'param') {
+                    const fixture = this.python.fixtureDef(file, callee.text, decl.scope);
+                    const provided = fixture && this.python.fixtureValue(fixture.file, fixture.fnNode, 0);
+                    if (provided?.expr?.type === 'function_definition') {
+                        target = { kind: 'function', file: provided.file, node: provided.expr };
+                    } else if (provided?.expr?.type === 'call') {
+                        const fn = field(provided.expr, 'function');
+                        // functools.partial(Client) still constructs the
+                        // imported client when the fixture is called.
+                        const binding = fn?.type === 'attribute' &&
+                            this.helpers.pyBinding(provided.file, field(fn, 'object')?.text);
+                        if (binding?.module === 'functools' && field(fn, 'attribute')?.text === 'partial') {
+                            const ctor = namedChildren(field(provided.expr, 'arguments'))[0];
+                            const identity = this.pyModule(provided.file, ctor);
+                            proven = !!identity && PY_FACTORIES.has(identity.split('.').pop());
+                        }
+                    }
+                }
+                if (target?.kind === 'function') {
+                    const fnNode = target.node || target.decl?.valueNode;
+                    const value = fnNode && this.python.fixtureValue(target.file, fnNode, 0);
+                    if (value) proven = this.pyValue(value.file, value.expr, depth + 1);
+                }
+            }
+        }
+        this.memo.set(key, proven);
+        return proven;
+    }
+
+    nominal(file, call, lang) {
+        const known = NOMINAL_CLIENTS[lang];
+        if (!known || call.localShadow || (call.isPathCall && call.receiverScopeBinding)) return null;
+        const entry = this.sess.entry(file);
+        const bindings = entry?.importBindings || [];
+        const qualifies = name => {
+            if (!name) return false;
+            const normalized = name.replace(/::/g, '.').replace(/^[*&]+/, '');
+            if (known.includes(normalized)) return true;
+            return bindings.some(b => {
+                const local = b.alias || b.name;
+                const module = String(b.module || '').replace(/::/g, '.');
+                return (normalized === local && (known.includes(module) || known.includes(`${module}.${b.name}`))) ||
+                    (normalized.startsWith(local + '.') && known.includes(module + normalized.slice(local.length)));
+            });
+        };
+        if (!call.receiverLocalBinding && !call.isMethod && qualifies(call.receiver)) return HTTP_FRAMEWORK[lang];
+        if (call.isPathCall && qualifies(call.receiver)) return HTTP_FRAMEWORK[lang];
+        const qualifier = call.receiverTypeQualifier || call.receiverTypeNamespace;
+        const type = qualifier ? `${qualifier}.${call.receiverType}` : call.receiverType;
+        if (qualifies(type)) return HTTP_FRAMEWORK[lang];
+        // Java field receivers carry the enclosing owner rather than the
+        // field type in the call record. Read the declared field's AST type.
+        if (lang === 'java' && call.receiverRootType && call.receiverField) {
+            const root = this.sess.root(file);
+            for (const declaration of root?.descendantsOfType('field_declaration') || []) {
+                let owner = declaration.parent;
+                while (owner && owner.type !== 'class_declaration') owner = owner.parent;
+                if (field(owner, 'name')?.text !== call.receiverRootType) continue;
+                if (namedChildren(declaration).some(n => n.type === 'variable_declarator' &&
+                    field(n, 'name')?.text === call.receiverField) && qualifies(field(declaration, 'type')?.text)) {
+                    return HTTP_FRAMEWORK[lang];
+                }
+            }
+        }
+        return null;
+    }
+}
+
+module.exports = { ClientReceiverProof };

package/core/deadcode.js

@@ -14,7 +14,7 @@ const { isFrameworkEntrypoint } = require('./entrypoints');
 const { splitParentList } = require('./graph-build');
 const { isOverrideMarked, codeUnitCompare, lineInRanges, maskBlockComments, escapeRegExp } = require('./shared');
 const { projectComputedDispatch, projectReflectionSites } = require('./ast-analysis');
-const { reflectionPatternReferences } = require('./reflection');
+const { reflectionPatternReferences, reflectionLiteralNames } = require('./reflection');
 const { protocolMemberOf, protocolTypeOf, typedLiteralContract, rustProjectTraits } = require('./contract-membership');
 
 const _CLASS_KINDS = ['class', 'struct', 'interface', 'trait', 'record'];
@@ -770,6 +770,8 @@ function deadcode(index, options = {}) {
         }
     }
     const literalReflectionNames = new Set();
+    const dynamicReflectionFiles = new Set();
+    const reflectionTables = new Map();
     const reflectionInfo = {
         count: 0,
         literalCount: 0,
@@ -781,6 +783,7 @@ function deadcode(index, options = {}) {
         patterns: [],
         withheld: 0,
         withheldByPattern: [],
+        withheldByTable: [],
     };
     // Reflection is liveness evidence wherever it sits (a test or script
     // outside --in still reaches the member); the disclosure counts cover the
@@ -790,6 +793,7 @@ function deadcode(index, options = {}) {
         const fe = index.files.get(reflectionFile);
         if (!fe || sites.length === 0) continue;
         for (const site of sites) {
+            if (site.dynamic) dynamicReflectionFiles.add(reflectionFile);
             if (site.name) literalReflectionNames.add(site.name);
             if (site.patterns && site.patterns.length > 0 && !site.name) {
                 // Exact alternatives of a multi-spelling site are literals.
@@ -1598,6 +1602,25 @@ function deadcode(index, options = {}) {
                     continue;
                 }
 
+                // A table may feed a dynamic reflection site through a loop
+                // or helper. Withhold exact same-file literal spellings,
+                // conservatively: this is possible dispatch, not proven flow.
+                if (dynamicReflectionFiles.has(symbol.file)) {
+                    if (!reflectionTables.has(symbol.file)) {
+                        const source = index._readFile(symbol.file);
+                        const tree = index._getParsedTree(symbol.file, source,
+                            index.files.get(symbol.file).language);
+                        reflectionTables.set(symbol.file, reflectionLiteralNames(tree));
+                    }
+                    const line = reflectionTables.get(symbol.file).get(symbol.name);
+                    if (line) {
+                        reflectionInfo.withheldByTable.push({ name: symbol.name,
+                            file: symbol.relativePath, line, startLine: symbol.startLine,
+                            reason: 'literal-name-near-dynamic-reflection' });
+                        continue;
+                    }
+                }
+
                 results.push({
                     name: symbol.name,
                     type: symbol.type,
@@ -1635,6 +1658,8 @@ function deadcode(index, options = {}) {
     results.excludedConstructors = excludedConstructors;
     results.excludedDynamicDispatch = excludedDynamicDispatch;
     results.computedDispatch = computedDispatchInfo;
+    reflectionInfo.withheldByTable.sort((a, b) => codeUnitCompare(a.file, b.file) ||
+        a.startLine - b.startLine || codeUnitCompare(a.name, b.name));
     reflectionInfo.withheldByPattern = [...reflectionWithheldByPattern]
         .map(([key, count]) => {
             const [pattern, namespaceOf] = key.split('\u0000');

package/core/inprocess-clients.js

@@ -195,9 +195,23 @@ class PythonClientResolver {
 
     /** The fixture named `name` a test in `file` requests: same module first,
      *  then conftest.py files from the test's directory up to the root. */
-    fixtureDef(file, name) {
-        const key = `${file}\0${name}`;
+    fixtureDef(file, name, requester = null) {
+        let owner = requester?.parent;
+        while (owner && owner.type !== 'class_definition') owner = owner.parent;
+        const key = `${file}\0${name}\0${owner?.startIndex ?? ''}`;
         if (this.fixtureMemo.has(key)) return this.fixtureMemo.get(key);
+        this.fixtureMemo.set(key, null);
+        if (owner) {
+            const matches = namedChildren(field(owner, 'body')).map(stmt =>
+                stmt.type === 'decorated_definition' ? field(stmt, 'definition') : stmt)
+                .filter(fn => fn?.type === 'function_definition' && field(fn, 'name')?.text === name);
+            if (matches.length) {
+                const found = matches.length === 1 && this.isFixture(file, matches[0])
+                    ? { file, fnNode: matches[0] } : null;
+                this.fixtureMemo.set(key, found);
+                return found;
+            }
+        }
         let found = this.moduleFixture(file, name);
         if (!found) {
             for (let dir = path.dirname(file); dir.startsWith(this.index.root); dir = path.dirname(dir)) {
@@ -213,7 +227,8 @@ class PythonClientResolver {
         return found;
     }
 
-    moduleFixture(file, name) {
+    moduleFixture(file, name, depth = 0) {
+        if (depth > MAX_HOPS) return null;
         const root = this.sess.root(file);
         if (!root) return null;
         const hits = [];
@@ -222,7 +237,12 @@ class PythonClientResolver {
             if (fn?.type === 'function_definition' && field(fn, 'name')?.text === name &&
                 this.isFixture(file, fn)) hits.push(fn);
         }
-        return hits.length === 1 ? { file, fnNode: hits[0] } : null;
+        if (hits.length) return hits.length === 1 ? { file, fnNode: hits[0] } : null;
+        const entry = this.sess.entry(file);
+        const bindings = (entry?.importBindings || []).filter(b => (b.alias || b.name) === name && !b.deferred);
+        if (bindings.length !== 1 || bindings[0].kind !== 'from') return null;
+        const relative = entry.moduleResolved?.[bindings[0].module];
+        return relative ? this.moduleFixture(path.join(this.index.root, relative), bindings[0].name, depth + 1) : null;
     }
 
     /** The expression a fixture provides: its single yielded/returned value,
@@ -253,11 +273,14 @@ class PythonClientResolver {
         if (!expr || expr.type !== 'identifier' || hops > MAX_HOPS) return { file, expr };
         if (fnNode) {
             const values = boundValues(field(fnNode, 'body'), expr.text, this.bindingMemo);
-            if (values === null) return null;
+            if (values === null) {
+                const decl = routeGraph.findDecl(this.sess, file, expr.text, expr);
+                return decl?.kind === 'function' ? { file, expr: decl.valueNode } : null;
+            }
             if (values.length === 1) return this.followBinding(file, fnNode, unwrap(values[0].node), hops + 1);
             if (values.length > 1) return null;
             if (isParameterOf(fnNode, expr.text)) {
-                const fixture = this.fixtureDef(file, expr.text);
+                const fixture = this.fixtureDef(file, expr.text, fnNode);
                 return fixture ? this.fixtureValue(fixture.file, fixture.fnNode, hops + 1) : null;
             }
         }
@@ -319,7 +342,7 @@ class PythonClientResolver {
         if (expr.type !== 'identifier') return null;
         const fnNode = enclosingFunctionNode(expr);
         if (fnNode && isParameterOf(fnNode, expr.text)) {
-            const fixture = this.fixtureDef(file, expr.text);
+            const fixture = this.fixtureDef(file, expr.text, fnNode);
             if (!fixture) return null;
             const value = this.fixtureValue(fixture.file, fixture.fnNode, hops + 1);
             if (!value?.expr) return null;
@@ -345,13 +368,8 @@ class PythonClientResolver {
         return null;
     }
 
-    /**
-     * { appKey } for a request `receiver.verb(path)` at `line` of `file` made
-     * through an in-process client, { inProcess: true } when the client is
-     * built from an app that did not resolve, else null (not a client built
-     * from an app).
-     */
-    resolve(file, line, receiver, name) {
+    /** Values bound to a request receiver, without assuming they are clients. */
+    clientValues(file, line, receiver, name) {
         const root = this.sess.root(file);
         if (!root) return null;
         const sites = requestCallNodes(root, line, receiver, name);
@@ -365,7 +383,7 @@ class PythonClientResolver {
             if (values.length > 0) {
                 clients = this.bindingInEffect(values, receiverNode).map(node => ({ file, expr: unwrap(node) }));
             } else if (isParameterOf(fnNode, receiver)) {
-                const fixture = this.fixtureDef(file, receiver);
+                const fixture = this.fixtureDef(file, receiver, fnNode);
                 const value = fixture ? this.fixtureValue(fixture.file, fixture.fnNode, 1) : null;
                 clients = value ? [value] : [];
             }
@@ -376,6 +394,14 @@ class PythonClientResolver {
                 clients = this.bindingInEffect(values, receiverNode).map(node => ({ file, expr: unwrap(node) }));
             }
         }
+        const values = clients?.map(c => this.followBinding(c.file,
+            enclosingFunctionNode(c.expr), c.expr, 0));
+        return values?.every(Boolean) ? values : null;
+    }
+
+    /** The served app key, an unresolved in-process app, or null. */
+    resolve(file, line, receiver, name) {
+        const clients = this.clientValues(file, line, receiver, name);
         if (!clients || clients.length === 0 || clients.some(c => c.expr?.type !== 'call')) return null;
         const keys = clients.map(c => this.clientAppOnce(c.file, c.expr));
         if (keys.every(key => key && key === keys[0])) {

package/core/output/public.js

@@ -476,6 +476,7 @@ function formatPublicJson(command, result, params = {}, execution = {}) {
     const envelope = {
         meta: {
             command: surfaceCommand,
+            ...(execution.surface === 'cli' && { maxChars: 'not-applied' }),
             ...(surfaceCommand !== command && { canonicalCommand: command }),
             // A result that self-reports it could not run (check with a bad
             // base ref / outside git) must be machine-distinguishable from a

package/core/output/reporting.js

@@ -315,6 +315,12 @@ function formatDeadcode(results, options = {}) {
     if (results.reflection?.dynamicCount > 0) {
         lines.push(`\nWARNING: ${results.reflection.dynamicCount} dynamic reflection use(s) have no static member spelling. Dead-code results remain review candidates because runtime-selected members cannot be attributed.`);
     }
+    if (results.reflection?.withheldByTable?.length > 0) {
+        lines.push('\nConservatively withheld: exact string literals in a file with dynamic reflection (flow to the reflection call is unproven):');
+        for (const site of results.reflection.withheldByTable) {
+            lines.push(`  ${site.name}: named in possible reflection table ${site.file}:${site.line}`);
+        }
+    }
     if (results.macroPaste) {
         const m = results.macroPaste;
         if (m.withheld > 0) {

package/core/reflection.js

@@ -1113,6 +1113,20 @@ function resetReflectionIndex(index) {
     index._reflectionPatternIndex = null;
 }
 
+/** Exact AST string literals, for conservative same-file dynamic dispatch.
+ * This does not prove that a literal flows to a reflection call. */
+function reflectionLiteralNames(tree) {
+    const names = new Map();
+    if (!tree) return names;
+    for (const node of tree.rootNode.descendantsOfType([...STRING_NODES])) {
+        const value = classifyNameExpression(node);
+        if (value.name && !value.dynamic && !names.has(value.name)) {
+            names.set(value.name, node.startPosition.row + 1);
+        }
+    }
+    return names;
+}
+
 module.exports = {
     WILD,
     stringAlternatives,
@@ -1126,5 +1140,6 @@ module.exports = {
     reflectionPatternIndex,
     patternIsAttributable,
     resetReflectionIndex,
+    reflectionLiteralNames,
     resolveKeyParameter,
 };

package/core/request-helpers.js

@@ -43,6 +43,8 @@ const JS_HTTP_PACKAGES = [
 ];
 const JS_HTTP_GLOBAL_CALLS = new Set(['fetch']);
 const JS_HTTP_GLOBAL_CTORS = new Set(['XMLHttpRequest', 'EventSource']);
+const JS_HTTP_CLIENT_TYPES = new Set(['AxiosInstance', 'AxiosStatic', 'KyInstance',
+    'Got', 'GotInstance', 'HttpClient', 'Dispatcher', 'Agent']);
 const PY_HTTP_MODULES = [
     'requests', 'httpx', 'aiohttp', 'urllib3', 'urllib.request', 'http.client', 'niquests', 'treq',
 ];
@@ -173,7 +175,7 @@ class RequestHelperProof {
     }
 
     /** Proof for the function expression being called. */
-    jsCallee(file, fn, depth, factory = false) {
+    jsCallee(file, fn, depth) {
         if (!fn || depth > MAX_RESOLVE) return unknown('depth');
         if (fn.type === 'identifier') {
             const decl = findDecl(this.sess, file, fn.text, fn);
@@ -201,9 +203,7 @@ class RequestHelperProof {
             // the method reads as one (`client.post`, `instance.request`);
             // a server built on an HTTP stack (`app.route(...)`) is not a
             // client.
-            // A factory call on a client value (`axios.create()`) yields a
-            // client value too.
-            if (!factory && (!prop || !CLIENT_METHOD.test(prop))) return unknown('method-not-request');
+            if (!prop || !CLIENT_METHOD.test(prop)) return unknown('method-not-request');
             return this.jsValue(file, obj, depth + 1);
         }
         if (fn.type === 'call_expression') return this.jsValue(file, fn, depth + 1);
@@ -296,7 +296,7 @@ class RequestHelperProof {
                     const spec = this.requireSpecOf({ valueNode: e });
                     return isHttpPackage(spec, JS_HTTP_PACKAGES) ? PROVEN : unknown('receiver-unproven');
                 }
-                return this.jsCallee(file, callee, depth + 1, true);
+                return this.jsFactory(file, callee, depth + 1);
             }
             default:
                 return unknown('receiver-unproven');
@@ -314,6 +314,59 @@ class RequestHelperProof {
         return last;
     }
 
+    /** A request result or server is not a client just because the function
+     *  that produced it uses an HTTP package. Follow factory return values. */
+    jsFactory(file, callee, depth) {
+        if (!callee || depth > MAX_RESOLVE) return unknown('receiver-unproven');
+        if (callee.type === 'member_expression') {
+            const name = field(callee, 'property')?.text;
+            if (name === 'create' || name === 'extend') {
+                return this.jsValue(file, unwrap(field(callee, 'object')), depth + 1);
+            }
+            return unknown('factory-unproven');
+        }
+        if (callee.type !== 'identifier') return unknown('factory-unproven');
+        const decl = findDecl(this.sess, file, callee.text, callee);
+        let target = decl ? { file, value: decl.count === 1 ? decl.valueNode : null } : null;
+        if (!decl) {
+            const binding = this.jsBinding(file, callee.text);
+            if (binding) {
+                if (binding.binding.module?.startsWith('@hey-api/client-') ||
+                    binding.binding.module === 'openapi-fetch') return PROVEN;
+                const rec = this.jsImportRecord(file, binding.binding, binding.original);
+                if (rec) target = { file: rec.file, value: rec.decl?.valueNode || rec.valueNode };
+            }
+        }
+        const fn = unwrap(target?.value);
+        if (!fn || !JS_FUNCTION_TYPES.has(fn.type)) return unknown('factory-unproven');
+        const body = field(fn, 'body');
+        if (!body) return unknown('factory-unproven');
+        const values = [];
+        const visit = node => {
+            if (node.type === 'return_statement') {
+                values.push(node.namedChild(0));
+                return;
+            }
+            for (const child of namedChildren(node)) {
+                if (!JS_FUNCTION_TYPES.has(child.type) && child.type !== 'class_declaration') visit(child);
+            }
+        };
+        if (body.type === 'statement_block') visit(body);
+        else values.push(body);
+        if (!values.length) return unknown('factory-unproven');
+        const proven = values.every(value => {
+            const v = unwrap(value);
+            if (v?.type !== 'object') return this.jsValue(target.file, v, depth + 1).proven;
+            const methods = namedChildren(v).filter(member =>
+                CLIENT_METHOD.test((field(member, 'key') || field(member, 'name'))?.text || ''));
+            return methods.length > 0 && methods.every(member => {
+                const impl = member.type === 'method_definition' ? member : unwrap(field(member, 'value'));
+                return impl && JS_FUNCTION_TYPES.has(impl.type) && this.jsFunction(target.file, impl, 0).proven;
+            });
+        });
+        return proven ? PROVEN : unknown('factory-unproven');
+    }
+
     /** A parameter proves a client only through its declared type or default. */
     jsParam(file, decl, depth) {
         const holder = decl.nameNode.parent;
@@ -321,7 +374,8 @@ class RequestHelperProof {
         if (typeNode) {
             const m = typeNode.text.replace(/^:\s*/, '').match(/^([A-Za-z_$][\w$]*)/);
             const b = m ? this.jsBinding(file, m[1]) : null;
-            if (b && isHttpPackage(b.binding.module, JS_HTTP_PACKAGES)) return PROVEN;
+            if (b && isHttpPackage(b.binding.module, JS_HTTP_PACKAGES) &&
+                JS_HTTP_CLIENT_TYPES.has(b.original)) return PROVEN;
         }
         const dflt = holder ? (field(holder, 'value') || field(holder, 'right')) : null;
         if (dflt) return this.jsValue(file, dflt, depth + 1);
@@ -374,6 +428,8 @@ class RequestHelperProof {
             return !!b && isHttpPackage(b.binding.module, JS_HTTP_PACKAGES);
         }
         if (callee.type === 'member_expression') {
+            if (CLIENT_METHOD.test(field(callee, 'property')?.text || '') &&
+                this.jsValue(file, unwrap(field(callee, 'object')), 0).proven) return true;
             let root = unwrap(field(callee, 'object'));
             while (root && root.type === 'member_expression') root = unwrap(field(root, 'object'));
             if (!root || root.type !== 'identifier') return false;
@@ -558,4 +614,4 @@ function locateCall(root, start, end, type) {
     return node;
 }
 
-module.exports = { RequestHelperProof, JS_HTTP_PACKAGES, PY_HTTP_MODULES };
+module.exports = { RequestHelperProof, JS_HTTP_PACKAGES, PY_HTTP_MODULES, pyImportedFunction };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucn",
-  "version": "5.5.2",
+  "version": "5.5.3",
   "mcpName": "io.github.mleoca/ucn",
   "description": "Auditable AST code intelligence for AI agents: 18 task-oriented commands through one MCP tool, CLI, or agent skill. Supports JS/TS, Python, Go, Rust, Java, C, C++, C#, and HTML.",
   "main": "index.js",
@@ -87,7 +87,7 @@
   "dependencies": {
     "node-addon-api": "8.9.2",
     "node-gyp-build": "4.8.4",
-    "re2js": "2.8.6",
+    "re2js": "2.8.7",
     "ret": "0.5.0",
     "safe-regex2": "5.1.1",
     "tree-sitter": "0.21.1",