Summary

TRACKER Step 1.2 — the wrapper half of C2. Real codebases never call fetch inline; they route through client layers. The scanner now sees through them:

useApi("/projects") → apiClient.get(path) → request(path) → fetch(`${API_BASE}${path}`)
                                     ⇒ ProjectsPage ← GET /api/projects

How it works

• Heuristic detection — any named callable (function declaration, const arrow, object-literal method) whose body reaches fetch/axios/another wrapper with one of its own parameters inside the URL is classified as a wrapper. Runs up to 3 composition rounds, so three-layer chains resolve.
• Template composition — each wrapper stores its endpoint shape with a :param marker (request → /api:path); chains substitute inward, constants fold along the way. Call sites then substitute the real argument: apiClient.get("/projects") → /api/projects (full).
• Method inference — name suffix wins (apiClient.post → POST), inner call's method otherwise.
• apiWrappers scan option — declare wrappers the heuristic can't see (imported clients, class-based SDKs).
• No placeholder leakage — wrapper bodies emit no data sources of their own; the fixture's forbidden assertions gate the :path-leak poison forever.

Eval movement

• New fixture c2-api-wrapper (the three-layer chain, GET via hook + POST via event handler).
• Threshold ratcheted: minLineageRecall: 0.85.
• Scorecard: 47 pass / 0 fail / 2 xfail / 0 unexpected-pass · precision 1.000 · recall 0.857 (was 0.833) · match accuracy 1.000.

Test plan

• 39 unit tests green (6 new: function wrapper, prefix capture, object methods + suffix inference, 3-layer composition, config registration, non-wrapper rejection)
• pnpm eval gate OK

Documentation

• TRACKER.md — 1.2 done, Status → 1.3

🤖 Generated with Claude Code