From 6a9cafb463cadc64fb55997e856245b1ef298907 Mon Sep 17 00:00:00 2001
From: carlos-alm <127798846+carlos-alm@users.noreply.github.com>
Date: Tue, 3 Mar 2026 22:43:43 -0700
Subject: [PATCH] fix: use isIdent in collectIdentifiers for language-aware
 referencedNames
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

collectIdentifiers hardcoded node.type === 'identifier', missing PHP's
variable_name and other language-specific identifier types in return
statement referencedNames. Now uses the existing isIdent(nodeType, rules)
helper with rules passed from the call site. Also adds null guard.

Updated PHP dataflow test to assert referencedNames contains $x, $a, $b
— previously only checked funcName without validating identifier capture.

Impact: 3 functions changed, 2 affected
---
 src/dataflow.js                    | 11 +++++++----
 tests/parsers/dataflow-php.test.js | 17 +++++++++++++++--
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/src/dataflow.js b/src/dataflow.js
index f6a81606..ad6f156f 100644
--- a/src/dataflow.js
+++ b/src/dataflow.js
@@ -911,7 +911,7 @@ export function extractDataflow(tree, _filePath, _definitions, langId = 'javascr
       if (scope?.funcName) {
         const expr = node.namedChildren[0];
         const referencedNames = [];
-        if (expr) collectIdentifiers(expr, referencedNames);
+        if (expr) collectIdentifiers(expr, referencedNames, rules);
         returns.push({
           funcName: scope.funcName,
           expression: truncate(expr ? expr.text : ''),
@@ -977,14 +977,17 @@ export function extractDataflow(tree, _filePath, _definitions, langId = 'javascr
 
 /**
  * Collect all identifier names referenced within a node.
+ * Uses isIdent() to support language-specific identifier node types
+ * (e.g. PHP's `variable_name`).
  */
-function collectIdentifiers(node, out) {
-  if (node.type === 'identifier') {
+function collectIdentifiers(node, out, rules) {
+  if (!node) return;
+  if (isIdent(node.type, rules)) {
     out.push(node.text);
     return;
   }
   for (const child of node.namedChildren) {
-    collectIdentifiers(child, out);
+    collectIdentifiers(child, out, rules);
   }
 }
 
diff --git a/tests/parsers/dataflow-php.test.js b/tests/parsers/dataflow-php.test.js
index bc35123a..8d1d4cb3 100644
--- a/tests/parsers/dataflow-php.test.js
+++ b/tests/parsers/dataflow-php.test.js
@@ -32,12 +32,25 @@ describe('extractDataflow — PHP', () => {
   });
 
   describe('returns', () => {
-    it('captures return expressions', () => {
+    it('captures return expressions with referencedNames', () => {
       const data = parseAndExtract('<?php\nfunction double($x) {\n    return $x * 2;\n}\n');
       expect(data.returns).toEqual(
-        expect.arrayContaining([expect.objectContaining({ funcName: 'double' })]),
+        expect.arrayContaining([
+          expect.objectContaining({
+            funcName: 'double',
+            referencedNames: expect.arrayContaining(['$x']),
+          }),
+        ]),
       );
     });
+
+    it('captures multiple referencedNames in return', () => {
+      const data = parseAndExtract('<?php\nfunction add($a, $b) {\n    return $a + $b;\n}\n');
+      const ret = data.returns.find((r) => r.funcName === 'add');
+      expect(ret).toBeDefined();
+      expect(ret.referencedNames).toContain('$a');
+      expect(ret.referencedNames).toContain('$b');
+    });
   });
 
   describe('assignments', () => {