- Added section for supported programming languages with icons.

* chore: apply go fix ./... cleanup across sast-engine

Run the revamped `go fix` command to apply automated code fixes
across the entire sast-engine module (87 files, net -108 lines).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: remove unused io/fs import in utils_test.go

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

Bumps the npm_and_yarn group with 1 update in the /extension/secureflow directory: [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte).


Updates `svelte` from 4.2.20 to 5.53.0
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte)

---
updated-dependencies:
- dependency-name: svelte
  dependency-version: 5.53.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Shivasurya <[email protected]>

)

## Summary

Introduce all data structures and type definitions required for Go standard library registry support (PR-01 of the Go stdlib support series).

- Add `go_stdlib_types.go` with 13 typed structs covering the full Go stdlib registry schema: `GoStdlibRegistry`, `GoManifest`, `GoVersionInfo`, `GoPackageEntry`, `GoRegistryStats`, `GoStdlibPackage`, `GoStdlibFunction`, `GoFunctionParam`, `GoReturnValue`, `GoTypeParam`, `GoStdlibType`, `GoStructField`, `GoStdlibConstant`, `GoStdlibVariable`
- Add `GoCallEdge` struct to `types.go` with `IsStdlib bool` and `Confidence float32` fields for call resolution metadata
- Add `GoStdlibLoader` interface to `types.go` to decouple core from the registry package (avoids import cycles)
- Add `StdlibLoader GoStdlibLoader` field to `GoModuleRegistry` for lazy stdlib metadata attachment
- All JSON tags use snake_case matching the Go stdlib CDN registry format
- All structs include constructor functions and helper methods (`GetPackage`, `GetFunction`, `GetType`, `GetConstant`, `GetVariable`, `HasPackage`, `PackageCount`, etc.)

## Test plan

- [x] `go test ./graph/callgraph/core/...` — 36 new tests, all passing
- [x] `golangci-lint run ./graph/callgraph/core/...` — 0 issues
- [x] `go build ./...` — builds cleanly
- [x] 100% coverage on all new code in `go_stdlib_types.go` and new additions to `types.go`
- [x] JSON round-trip tests verify snake_case tag names for every multi-word field
- [x] Table-driven tests cover all nil/missing/found paths for every lookup method
- [x] Integration test validates end-to-end registry workflow

## Dependencies

Prerequisite for:
- PR-21: Extraction tool (`tools/generate_go_stdlib_registry.go`)
- PR-22: Remote loader (`registry/go_stdlib_remote.go`)
- PR-23: R2 publishing pipeline

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…2) (#548)

## Summary

- Add `tools/internal/goextract` package implementing `Extractor` for walking `$GOROOT/src` and extracting the full exported API surface of Go stdlib packages via `go/parser` and `go/ast`
- Extract functions (signatures, params, returns, generics, variadic, methods), types (struct/interface/alias with fields and methods), constants (iota detection), and package-level variables with docstrings and deprecation markers
- Generate per-package JSON files (`{pkg}_stdlib.json`) and `manifest.json` with SHA256 checksums and aggregate statistics (186 packages from Go 1.26 stdlib)
- Add CLI entry point `tools/generate_go_stdlib_registry.go` with `--go-version`, `--output-dir`, and `--goroot` flags
- Achieve **100% test coverage** with 40+ unit tests and integration tests against real Go 1.26 stdlib

## Test plan

- [x] `go build ./...` passes with zero errors
- [x] `golangci-lint run ./...` reports 0 issues
- [x] `go test ./tools/internal/goextract/` — 100% coverage, all tests pass
- [x] Integration test extracts 186 packages from Go 1.26 stdlib, verifies `fmt.Println` variadic, `slices.Sort` generic, `os.Stdin` variable
- [x] Full module test suite `go test ./...` — all 29 packages pass
- [x] JSON output uses snake_case keys (`import_path`, `is_variadic`, `is_generic`, etc.) matching core types from PR-01

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…03) (#549)

## Summary

- Add `GoStdlibRegistryRemote` implementing the `core.GoStdlibLoader` interface
- Lazy per-package loading: only download packages when first accessed
- SHA256 checksum verification of each package against the manifest
- Thread-safe double-check locking (`sync.RWMutex`) prevents duplicate downloads under concurrency
- 30s HTTP timeout; versioned CDN URL pattern (`{baseURL}/go{version}/stdlib/v1/`)
- Helper methods: `CacheSize`, `ClearCache`, `IsManifestLoaded`, `GoVersion`

## Test plan

- [x] `TestLoadManifest_*` — success, HTTP error, network error, invalid JSON, bad URL, body read error
- [x] `TestGetPackage_*` — cache hit (fast path), download, not found, HTTP error, network error, invalid JSON, checksum mismatch, checksum skip, body read error
- [x] `TestFetchPackageLocked_DoubleCheckCacheHit` — deterministic double-check path coverage
- [x] `TestValidateStdlibImport_*`, `TestGetFunction_*`, `TestGetType_*`, `TestPackageCount_*`
- [x] `TestConcurrentGetPackage` — race detector clean
- [x] 100% coverage on `go_stdlib_remote.go`, 0 lint issues, all 20 packages pass

## Stacked on
PR-21 (`shiva/go-stdlib-support-pr02`) — Go stdlib extraction tool

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

- Add `sast-engine/tools/upload_go_stdlib_to_r2.sh` — mirrors the Python stdlib upload script for Go
- Add `.github/workflows/go-stdlib-r2-upload.yml` — triggered on `release` or `workflow_dispatch`
- Install Go 1.18–1.26 sequentially via `actions/setup-go@v6`; capture each version's `$GOROOT` into `GOROOT_1_XX` env vars
- Last setup (Go 1.26) remains active for compilation, satisfying the module's `go 1.26.0` requirement
- Generator runs with `-tags ignore` (required for `//go:build ignore` files in Go 1.17+)
- `aws s3 sync` with `--delete`, `application/json`, `public, max-age=3600` to `code-pathfinder-assets/registries/goX.Y/stdlib/v1/`
- Post-upload: R2 `aws s3 ls` verification + public CDN HTTP 200 accessibility check per version

## Test plan

- [x] Shell script passes `bash -n` syntax check
- [x] YAML passes `python3 yaml.safe_load` validation
- [x] Mirrors existing `upload_to_r2.sh` / `stdlib-r2-upload.yml` patterns exactly
- [x] Graceful skip when a version's GOROOT is not set (no hard failure)
- [x] Uses same R2 secrets (`R2_ACCOUNT_ID`, `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`) already configured

## Stacked on
PR-03 (`shiva/go-stdlib-support-pr03`) — Go stdlib remote registry loader

🤖 Generated with [Claude Code](https://claude.com/claude-code)

### Description

- Add `DetectGoVersion(projectPath)` with priority chain: `go.mod` → `.go-version` → `go.work` → default `"1.21"`
- Add `normalizeGoVersion` to strip patch component: `"1.26.0"` → `"1.26"`
- Add `InitGoStdlibLoader(reg, projectPath, logger)` wiring `GoStdlibRegistryRemote` into `GoModuleRegistry.StdlibLoader`
- Graceful degradation on manifest fetch failure (`StdlibLoader` remains `nil`; downstream code nil-checks)
- `stdlibRegistryBaseURL` package var allows test override without modifying production logic
- 25 tests, 100% coverage on `go_version.go`, 0 lint issues, all packages pass

### Checklist
* [x] Tests passing (`gradle testGo`)?
* [x] Lint passing (`golangci-lint run`)?

🤖 Generated with [Claude Code](https://claude.com/claude-code)

### Description

- Wire `InitGoStdlibLoader` into `cmd/serve.go`, `cmd/scan.go`, `cmd/ci.go` after `BuildGoModuleRegistry` — populates `reg.StdlibLoader` at runtime with graceful CDN degradation
- Extend `resolveGoCallTarget` to return `(targetFQN, resolved, isStdlib)`: Pattern 1a checks `registry.StdlibLoader.ValidateStdlibImport(importPath)` to tag stdlib imports; all other patterns return `isStdlib=false`
- Add `IsStdlib bool` to `core.CallSite` and set it from the resolver result
- Track `stdlibCount` in Pass 4 and print stdlib breakdown in final build summary
- Add `go_builder_stdlib_test.go`: 6 tests covering stdlib, nil-loader, third-party, multi-segment path, builtin, and unresolved cases — 0 lint issues, all packages pass

### Checklist
* [x] Tests passing (`gradle testGo`)?
* [x] Lint passing (`golangci-lint run`)?

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…554)

## Summary

- Extends Pass 2b (variable extraction) to resolve return types of Go stdlib function calls via the `StdlibLoader` attached to the module registry
- Previously, variables assigned from stdlib calls (e.g., `resp := http.Get(url)`) remained untyped; now they receive a concrete TypeFQN (e.g., `net/http.Response`)
- Adds `inferTypeFromStdlibFunction` helper that validates the import path is stdlib, calls `StdlibLoader.GetFunction`, and picks the first non-error return
- Adds `normalizeStdlibReturnType` helper that converts raw JSON type strings (`"*Request"`, `"string"`, `"io.Reader"`) to TypeFQNs (`"net/http.Request"`, `"builtin.string"`, `"io.Reader"`)
- Graceful degradation: when `StdlibLoader` is nil (network unavailable), variables remain untyped and no error is raised
- 21 new tests in `go_variables_stdlib_test.go` covering both helpers (unit) and three end-to-end `ExtractGoVariableAssignments` scenarios

## Test plan

- [ ] `go test ./graph/callgraph/extraction/... -v -run "TestNormalize|TestInferTypeFromStdlib|TestExtractGoVariables_Stdlib"` — all 21 pass
- [ ] `go test ./...` — all 29 packages pass
- [ ] `golangci-lint run ./graph/callgraph/extraction/...` — 0 issues
- [ ] `normalizeStdlibReturnType` — 100% coverage; `inferTypeFromStdlibFunction` — 93.3%

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…555)

## Summary

- Enhance `GoTypeInferenceEngine.GetReturnType` in `resolution/go_types.go` to fall back to the stdlib registry when the local user-code type map has no answer
- All code paths that call `GetReturnType` (type chaining, bidirectional inference, variable extraction) now receive stdlib type data automatically without any per-caller changes
- Add `stdlibNormalizeType` helper with the same pointer/slice/builtin/cross-package normalization logic as the extraction layer
- Fix extraction integration test: type now resolves via the engine (`Source: "stdlib"`, `Confidence: 1.0`) instead of the extraction-layer fallback

## Gap closed

Previously `GoTypeInferenceEngine.GetReturnType` only looked up user-code types. Any code path that called it for a stdlib function got `(nil, false)` even when `StdlibLoader` was set. The extraction-layer helper in `go_variables.go` worked around this for variable assignments, but chaining and bidirectional inference paths were still blind to stdlib types.

## Test coverage

- `go_types.go`: **100% coverage on every function** (15/15)
- `stdlibNormalizeType`: all branches covered (builtin, pointer, slice, cross-package, unqualified, empty)
- `GetReturnType` stdlib fallback: 10 new focused tests (nil loader, no dot, not stdlib, fn not found, error-only return, empty-typeFQN skip, local priority, pointer return, cross-package, simple function)
- Full test suite: all 30 packages green, 0 lint issues

## Files changed

| File | Change |
|------|--------|
| `resolution/go_types.go` | Add stdlib fallback in `GetReturnType` + `stdlibNormalizeType` helper |
| `resolution/go_types_test.go` | Add `mockGoTypesStdlibLoader`, 10+ new tests covering all new branches |
| `extraction/go_variables_stdlib_test.go` | Update source assertion from `stdlib_registry` → `stdlib` |

#556)

## Summary

- Add `goVersion` and `goModuleRegistry` fields to `mcp.Server`; wire via `SetGoContext` called from `cmd/serve.go` after `InitGoStdlibLoader`
- Add `stdlibInfoForFQN` helper: resolves a call target FQN to `{package, signature, return_types}` using `GoStdlibLoader`
- Enhance `get_callees`: each callee now includes `is_stdlib` (bool) and, when the loader is available, a `stdlib_info` block
- Enhance `get_call_details`: resolution section now includes `is_stdlib` and `stdlib_info`
- Enhance `get_callers`: propagates `is_stdlib: true` from matching call site when applicable
- Graceful degradation: all additions are no-ops when `StdlibLoader` is nil

## Test plan

- [x] `TestSetGoContext_*` — fields set correctly; nil registry allowed without panic
- [x] `TestStdlibInfoForFQN_*` (8 cases) — nil registry, nil loader, no dot, non-stdlib pkg, function not found, function with signature/returns, empty returns, blank return type skipped; helper at 100% coverage
- [x] `TestToolGetCallees_*` — `is_stdlib` present on every callee, `stdlib_info` added when loader available, absent for local callees and when loader is nil
- [x] `TestToolGetCallDetails_*` — `is_stdlib` and optional `stdlib_info` in resolution block
- [x] `TestToolGetCallers_*` — `is_stdlib` propagated from call site when true; absent when false
- [x] `TestHandleToolsCall_GetCallees_StdlibRoundTrip` — JSON-RPC end-to-end confirms `stdlib_info` in response
- [x] `golangci-lint ./mcp/...` → 0 issues
- [x] `go test ./mcp/...` → all pass, 92.7% package coverage

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…PR-09) (#557)

## Summary

- Replaced the static `goStdlibSet()` hardcoded map with a dynamic `GoImportResolver` struct that uses `StdlibLoader.ValidateStdlibImport()` for version-aware, registry-backed stdlib detection
- Added `ImportType` enum (`ImportUnknown`, `ImportStdlib`, `ImportThirdParty`, `ImportLocal`) and public methods `ClassifyImport` / `ResolveImports` for structured import classification
- Implemented offline heuristic fallback (`isStdlibImportFallback`) for cases where no `StdlibLoader` is available — packages with no domain separator (`.`) in their path and not prefixed with `internal/` are classified as stdlib
- Removed hardcoded `StdlibPackages` assertions from `TestBuildGoModuleRegistry` and deleted `TestGoStdlibSet`; added 10 new `TestGoImportResolver_*` tests covering nil registry, fallback heuristic, loader delegation, local module detection, relative paths, and batch resolution

## Changes

### `sast-engine/graph/callgraph/resolution/go_imports.go`
- Removed `goStdlibSet()` function (~124 lines of hardcoded map)
- Removed `registry.StdlibPackages = goStdlibSet()` call from `BuildGoModuleRegistry`
- Added `ImportType` enum with four constants
- Added `GoImportResolver` struct with `NewGoImportResolver` constructor
- Added `isStdlibImport`, `isStdlibImportFallback`, `ClassifyImport`, `ResolveImports` methods

### `sast-engine/graph/callgraph/resolution/go_imports_test.go`
- Removed `TestGoStdlibSet` test
- Removed hardcoded `StdlibPackages` assertions from `TestBuildGoModuleRegistry`
- Added `mockResolutionStdlibLoader` in-package mock implementing `StdlibLoaderInterface`
- Added 10 new tests: `TestGoImportResolver_NilRegistry`, `TestGoImportResolver_isStdlibImportFallback`, `TestGoImportResolver_isStdlibImport_WithLoader`, `TestGoImportResolver_isStdlibImport_NilLoader_FallsBackToHeuristic`, `TestGoImportResolver_ClassifyImport_Stdlib`, `TestGoImportResolver_ClassifyImport_ThirdParty`, `TestGoImportResolver_ClassifyImport_Local_RelativePath`, `TestGoImportResolver_ClassifyImport_Local_SameModule`, `TestGoImportResolver_ResolveImports`, `TestGoImportResolver_ResolveImports_Empty`

## Test plan

- [x] All 10 new `TestGoImportResolver_*` tests pass
- [x] Existing `TestBuildGoModuleRegistry` still passes
- [x] `TestExtractGoImports` still passes (uses empty `StdlibPackages` map)
- [x] No hardcoded stdlib package list remains in the resolver
- [x] Nil registry / nil loader cases handled without panics
- [x] Local module detection works for both relative paths and same-module prefix imports

🤖 Generated with [Claude Code](https://claude.com/claude-code)

… conflict) (#559)

* fix(ci): use go env GOROOT instead of \$GOROOT in stdlib upload workflow

\$GOROOT is not exported to the shell environment by actions/setup-go —
only the go binary is added to PATH. Using \`go env GOROOT\` correctly
queries the active Go installation's root directory, so all GOROOT_1_XX
variables are now captured and the upload script no longer skips every
version.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* fix(ci): add push trigger on fix branch for in-branch testing

Adds a push trigger scoped to fix/go-stdlib-r2-goroot-capture so the
upload workflow can be validated directly on this branch without
needing to merge to main first.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* fix(go-stdlib): replace //go:build ignore with unique tag to avoid stdlib conflict

Using -tags ignore with go run accidentally satisfies //go:build ignore
constraints on Go stdlib generator files (gen_cooked.go, pow10gen.go, etc.),
causing 'found packages X and main' and import cycle errors during compilation.

Replace the build tag with cpf_generate_stdlib_registry — a project-specific
tag that no stdlib file uses — so go run -tags cpf_generate_stdlib_registry
compiles only our generator without polluting the stdlib package graph.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* fix(ci): remove push trigger from go-stdlib R2 upload workflow

Now matches stdlib-r2-upload.yml (Python): only runs on release
publish or manual workflow_dispatch, not on branch pushes.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

---------

Co-authored-by: Claude Sonnet 4.6 <[email protected]>

Bumps the npm_and_yarn group with 1 update in the /extension/secureflow directory: [minimatch](https://github.com/isaacs/minimatch).


Updates `minimatch` from 3.1.2 to 3.1.4
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.4)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Shivasurya <[email protected]>

- Replace hardcoded 0.1.0-poc version with cmd.Version (ldflags-injected)
- Update server name to dev.codepathfinder/pathfinder in initialize response
- Add server.json for MCP Registry (PyPI + Docker packages, stdio transport)
- Add MCP verification marker to python-sdk/README.md
- Add MCP label to Dockerfile
- Bump version to 1.3.7 across VERSION, pyproject.toml, server.json

Co-authored-by: Claude Sonnet 4.5 <[email protected]>