Add searchable NuGet security policy metadata (#4459) (#4520)

* Add NuGet security policy extraction (#4459)

* Reindex XML after extractor upgrade (#4459)

Author: Widthdom

DEVELOPER_GUIDE.md

@@ -1009,6 +1009,7 @@ Extractor strategy by language surface:
 | Common Lisp / Racket | Use a lightweight S-expression scanner that masks strings, line comments, and `#| ... |#` block comments before extracting definitions and function ranges. |
 | HTML | Uses a dedicated character-level state machine instead of the regex pattern loop. It walks tag openers, quoted/unquoted attribute values including multi-line values, and masks `<script>` / `<style>` / `<textarea>` / `<title>` bodies plus `<!-- ... -->` comments so attribute-lookalike strings inside those regions do not leak phantom symbols. |
 | JSON / JSON Lines | JSON emits `object`, `array`, `property`, and bounded primitive-array `value` symbols with indexed paths. `.jsonl` and `.ndjson` parse each non-empty physical line independently and prefix symbols with a stable zero-based record path such as `[0].result.path`. |
+| XML / NuGet.config | Generic XML emits bounded element and attribute paths. NuGet.config additionally promotes package sources, source mappings, signature validation mode, trusted signer names, certificate fingerprints, and `allowUntrustedRoot` values to semantic `property` symbols with `nuget.*` subkinds. |
 
 JavaScript and TypeScript export/reference details:
 
@@ -1061,6 +1062,7 @@ Supported symbol kinds by language:
 | Lua / R / Haskell / F# | language-specific functions/types/modules/signatures | imports/requires/opens where supported | mixed |
 | VB.NET | subs/functions, classes/modules, structures, interfaces, enums, properties, events | namespaces/imports, `AddressOf`, `Handles` | yes |
 | Zig / PowerShell / CSS-SCSS / Batch / Assembly / HTML | language-specific functions, labels, selectors, stages, Web Components, properties, imports | language-specific references where implemented | mixed |
+| XML | bounded element/attribute paths plus NuGet.config security-policy values | XAML references where implemented | mixed |
 
 Shell and PowerShell files also expose a synthetic `<script>` function symbol spanning the file. Top-level call references use this scope as their graph container, while references inside declared functions retain the declared function container.
 
@@ -1072,7 +1074,7 @@ For JavaScript / TypeScript, reference extraction also captures tagged template
 
 SQL also emits `namespace` symbols for `CREATE SCHEMA`, but the summary table above does not have a dedicated namespace column. SQL graph extraction emits `reference` edges for named source/target forms such as `FROM`, `JOIN`, `INSERT INTO`, `UPDATE`, `TRUNCATE TABLE`, `DELETE FROM`, `DELETE ... USING`, and `MERGE ... USING`; procedure and table-valued-function calls stay on the `call` path.
 
-Additionally, 19 languages are detected and indexed as raw text without symbol extraction: cmake, clojure, crystal, dockerignore, d, editorconfig, erlang, gitignore, justfile, julia, markdown, nim, ocaml, svelte, tcl, toml, vue, xml, yaml.
+Additionally, 18 languages are detected and indexed as raw text without symbol extraction: cmake, clojure, crystal, dockerignore, d, editorconfig, erlang, gitignore, justfile, julia, markdown, nim, ocaml, svelte, tcl, toml, vue, yaml.
 
 VB.NET container patterns use `RegexOptions.IgnoreCase` plus `VisualBasicEnd`-based range tracking, so `Partial` spelling differences and multi-file type families still receive stable definition ranges and hotspot-family metadata.
 
@@ -3458,6 +3460,7 @@ LIMIT 20;
 | Common Lisp / Racket | 文字列、行 comment、`#| ... |#` block comment を mask してから definition と function range を抽出する軽量な S-expression scanner を使います。 |
 | HTML | 汎用の正規表現 loop を使わず、専用の文字単位 state machine で tag opener、引用符付き/なし attribute value（複数行値を含む）、`<script>` / `<style>` / `<textarea>` / `<title>` body、`<!-- ... -->` comment を扱い、attribute 名に似た body 内文字列から phantom symbol が漏れないようにします。 |
 | JSON / JSON Lines | JSON は `object`、`array`、`property` と、上限付きの primitive-array `value` symbol を index 付き path で出力します。`.jsonl` と `.ndjson` は空でない物理行を個別に parse し、`[0].result.path` のような安定した 0 始まり record path を付けます。 |
+| XML / NuGet.config | 汎用 XML は上限付きの element / attribute path を出力します。NuGet.config ではさらに package source、source mapping、署名検証モード、trusted signer 名、証明書 fingerprint、`allowUntrustedRoot` の値を `nuget.*` subkind 付きの semantic `property` symbol にします。 |
 
 JavaScript / TypeScript の export / reference 詳細:
 
@@ -3510,6 +3513,7 @@ SQL 固有の symbol extraction:
 | Lua / R / Haskell / F# | 言語別の function / type / module / signature | import / require / open など対応済み surface | mixed |
 | VB.NET | Sub/Function、Class/Module、Structure、Interface、Enum、Property、Event | Namespace、Imports、`AddressOf`、`Handles` | yes |
 | Zig / PowerShell / CSS-SCSS / Batch / Assembly / HTML | 言語別 function、label、selector、stage、Web Component、property、import | 実装済みの言語別 reference | mixed |
+| XML | 上限付き element / attribute path と NuGet.config security-policy value | 実装済みの XAML reference | mixed |
 
 Shell と PowerShell のファイルには、ファイル全体を覆う合成 `<script>` 関数シンボルも作成される。トップレベルの call reference はこのスコープを graph container として使い、宣言済み関数内の reference はその関数 container を維持する。
 
@@ -3521,7 +3525,7 @@ JavaScript / TypeScript では、reference extraction が `` gql`...` ``、`` st
 
 SQL は `CREATE SCHEMA` から `namespace` シンボルも出力するが、上の要約表には namespace 専用列はない。SQL graph extraction は `FROM`、`JOIN`、`INSERT INTO`、`UPDATE`、`TRUNCATE TABLE`、`DELETE FROM`、`DELETE ... USING`、`MERGE ... USING` のような source/target 形を `reference` edge として出力し、procedure call と table-valued function 使用は `call` 経路に残す。
 
-他に19言語がテキスト検索用に検出されるがシンボル抽出パターンは未対応: cmake, clojure, crystal, dockerignore, d, editorconfig, erlang, gitignore, justfile, julia, markdown, nim, ocaml, svelte, tcl, toml, vue, xml, yaml。
+他に18言語がテキスト検索用に検出されるがシンボル抽出パターンは未対応: cmake, clojure, crystal, dockerignore, d, editorconfig, erlang, gitignore, justfile, julia, markdown, nim, ocaml, svelte, tcl, toml, vue, yaml。
 
 正規表現ベースの抽出は意図的にシンプルです。AST精度よりも速度とポータビリティを優先しています。
 

README.md

@@ -44,6 +44,10 @@ Symbol and reference extraction are lightweight indexing hints optimized for
 speed, locality, explainability, and retrieval usefulness. Embeddings, vector
 search, and LLM-based semantic ranking are not assumptions of CodeIndex core.
 
+NuGet.config XML receives security-policy symbols for package sources and source
+mappings, signature validation mode, trusted signers, certificate fingerprints,
+and `allowUntrustedRoot`, so these controls can be queried by their configured values.
+
 ## Contribution Policy
 
 Issue reports, feature requests, and improvement suggestions are welcome.
@@ -259,6 +263,10 @@ Symbol / reference extraction は、速度、ローカル完結、説明可能
 寄せた lightweight indexing hint です。Embedding、vector search、LLM-based semantic
 ranking は CodeIndex core の前提機能ではありません。
 
+NuGet.config XML では package source / source mapping、署名検証モード、trusted
+signer、証明書 fingerprint、`allowUntrustedRoot` をセキュリティポリシーの
+シンボルとして抽出するため、設定値からこれらの制御を検索できます。
+
 ## コントリビューション方針
 
 不具合報告、機能要望、改善提案の Issue は歓迎します。

changelog.d/unreleased/4459.added.md

@@ -0,0 +1,20 @@
+---
+category: added
+issues:
+  - 4459
+affected:
+  - src/CodeIndex/Indexer/Symbols/SymbolExtractor.cs
+  - src/CodeIndex/Indexer/Symbols/SymbolExtractor.StructuralMetadata.cs
+  - tests/CodeIndex.Tests/IndexCommandRunnerTests.cs
+  - tests/CodeIndex.Tests/SymbolExtractorXmlTests.cs
+  - README.md
+  - DEVELOPER_GUIDE.md
+---
+
+## English
+
+- **NuGet.config security policy is now directly searchable (#4459)** — XML extraction promotes package sources, source mappings, signature validation mode, trusted signer names, certificate fingerprints, and `allowUntrustedRoot` values to bounded semantic symbols.
+
+## 日本語
+
+- **NuGet.config のセキュリティポリシーを直接検索できるようになりました (#4459)** — XML 抽出は package source、source mapping、署名検証モード、trusted signer 名、証明書 fingerprint、`allowUntrustedRoot` の値を上限付き semantic symbol として出力します。

src/CodeIndex/Indexer/Symbols/SymbolExtractor.StructuralMetadata.cs

@@ -191,6 +191,9 @@ private static List<SymbolRecord> ExtractGenericXmlSymbols(long fileId, string c
                         reader.MoveToElement();
                     }
 
+                    if (!TryAddNuGetConfigValueSymbols(fileId, reader, path, lineNumber, lines, symbols, ref truncated))
+                        return symbols;
+
                     if (!reader.IsEmptyElement)
                     {
                         elementPaths.Push(path);
@@ -215,6 +218,88 @@ private static List<SymbolRecord> ExtractGenericXmlSymbols(long fileId, string c
         return TrimStructuredDataSymbols(symbols, fileId, "structured_data_xml_symbol_budget_exceeded", lines);
     }
 
+    private static bool TryAddNuGetConfigValueSymbols(
+        long fileId,
+        XmlReader reader,
+        string path,
+        int lineNumber,
+        string[] lines,
+        List<SymbolRecord> symbols,
+        ref bool truncated)
+    {
+        if (!path.StartsWith("configuration.", StringComparison.OrdinalIgnoreCase))
+            return true;
+
+        string? subKind = null;
+        string? value = null;
+        var localName = reader.LocalName;
+
+        if (path.Equals("configuration.packageSources.add", StringComparison.OrdinalIgnoreCase))
+        {
+            if (!TryAddNuGetConfigValueSymbol(fileId, "nuget.package_source", reader.GetAttribute("key"), lineNumber, lines, path, symbols, ref truncated))
+                return false;
+            subKind = "nuget.package_source_url";
+            value = reader.GetAttribute("value");
+        }
+        else if (path.Equals("configuration.packageSourceMapping.packageSource", StringComparison.OrdinalIgnoreCase))
+        {
+            subKind = "nuget.package_source_mapping";
+            value = reader.GetAttribute("key");
+        }
+        else if (path.EndsWith(".packageSource.package", StringComparison.OrdinalIgnoreCase)
+                 && path.Contains(".packageSourceMapping.", StringComparison.OrdinalIgnoreCase))
+        {
+            subKind = "nuget.package_source_mapping_pattern";
+            value = reader.GetAttribute("pattern");
+        }
+        else if (path.Equals("configuration.config.add", StringComparison.OrdinalIgnoreCase)
+                 && string.Equals(reader.GetAttribute("key"), "signatureValidationMode", StringComparison.OrdinalIgnoreCase))
+        {
+            subKind = "nuget.signature_validation_mode";
+            value = reader.GetAttribute("value");
+        }
+        else if (path.Contains(".trustedSigners.", StringComparison.OrdinalIgnoreCase)
+                 && (localName.Equals("author", StringComparison.OrdinalIgnoreCase)
+                     || localName.Equals("repository", StringComparison.OrdinalIgnoreCase)))
+        {
+            subKind = "nuget.trusted_signer";
+            value = reader.GetAttribute("name");
+        }
+        else if (path.Contains(".trustedSigners.", StringComparison.OrdinalIgnoreCase)
+                 && localName.Equals("certificate", StringComparison.OrdinalIgnoreCase))
+        {
+            if (!TryAddNuGetConfigValueSymbol(fileId, "nuget.certificate_fingerprint", reader.GetAttribute("fingerprint"), lineNumber, lines, path, symbols, ref truncated))
+                return false;
+            subKind = "nuget.allow_untrusted_root";
+            value = reader.GetAttribute("allowUntrustedRoot");
+        }
+
+        return TryAddNuGetConfigValueSymbol(fileId, subKind, value, lineNumber, lines, path, symbols, ref truncated);
+    }
+
+    private static bool TryAddNuGetConfigValueSymbol(
+        long fileId,
+        string? semanticKind,
+        string? semanticValue,
+        int lineNumber,
+        string[] lines,
+        string path,
+        List<SymbolRecord> symbols,
+        ref bool truncated)
+    {
+        if (semanticKind == null || string.IsNullOrWhiteSpace(semanticValue))
+            return true;
+
+        var normalizedValue = semanticValue.Trim();
+        if (normalizedValue.Length > StructuredDataMaxPathLength)
+            return true;
+        if (!TryAddStructuredDataSymbol(fileId, "property", normalizedValue, lineNumber, lines, path, symbols, "structured_data_xml_symbol_budget_exceeded", ref truncated))
+            return false;
+
+        symbols[^1].SubKind = semanticKind;
+        return true;
+    }
+
     private static void AddManifestAssemblyIdentitySymbols(
         long fileId,
         string[] lines,

src/CodeIndex/Indexer/Symbols/SymbolExtractor.cs

@@ -19,6 +19,7 @@ public static partial class SymbolExtractor
     public const int DockerfileContractVersion = 2;
     public const int MakefileContractVersion = 2;
     public const int StyleAndXamlContractVersion = 2;
+    public const int XmlContractVersion = 3;
     public const int FunctionalLanguageContractVersion = 2;
     public const int DynamicLanguageContractVersion = 2;
     public const int SystemsLanguageContractVersion = 2;
@@ -73,7 +74,8 @@ public static int GetContractVersion(string? lang)
             "csharp" => CSharpContractVersion,
             "dockerfile" => DockerfileContractVersion,
             "makefile" => MakefileContractVersion,
-            "sass" or "stylus" or "xml" => StyleAndXamlContractVersion,
+            "sass" or "stylus" => StyleAndXamlContractVersion,
+            "xml" => XmlContractVersion,
             "clojure" or "erlang" or "ocaml" or "raku" => FunctionalLanguageContractVersion,
             "crystal" or "groovy" or "julia" or "tcl" => DynamicLanguageContractVersion,
             "ada" or "d" or "nim" => SystemsLanguageContractVersion,

tests/CodeIndex.Tests/IndexCommandRunnerTests.cs

@@ -5739,6 +5739,56 @@ def target():
         }
     }
 
+    [Fact]
+    public void Run_FilesUpdate_ReindexesUnchangedNuGetConfigWhenXmlExtractorVersionChanged_Issue4459()
+    {
+        var projectRoot = CreateTempProject();
+        try
+        {
+            var sourcePath = Path.Combine(projectRoot, "nuget.config");
+            File.WriteAllText(
+                sourcePath,
+                """
+                <configuration>
+                  <config>
+                    <add key="signatureValidationMode" value="require" />
+                  </config>
+                </configuration>
+                """);
+
+            var initialExitCode = IndexCommandRunner.Run([projectRoot, "--json"], _jsonOptions);
+            Assert.Equal(CommandExitCodes.Success, initialExitCode);
+
+            var dbPath = Path.Combine(projectRoot, ".cdidx", "codeindex.db");
+            using (var conn = OpenNonPoolingConnection(dbPath))
+            {
+                conn.Open();
+                using var cmd = conn.CreateCommand();
+                cmd.CommandText = """
+                    DELETE FROM symbols WHERE sub_kind = 'nuget.signature_validation_mode';
+                    UPDATE codeindex_meta SET value = '2' WHERE key = 'symbol_extractor_version_xml';
+                    """;
+                cmd.ExecuteNonQuery();
+            }
+
+            var (exitCode, json) = RunAndCaptureJson([projectRoot, "--files", sourcePath, "--json"]);
+
+            Assert.Equal(CommandExitCodes.Success, exitCode);
+            Assert.Equal(1, json.GetProperty("summary").GetProperty("updated").GetInt32());
+            Assert.Equal(0, json.GetProperty("summary").GetProperty("skipped").GetInt32());
+
+            using var verify = OpenNonPoolingConnection(dbPath);
+            verify.Open();
+            using var symbolCmd = verify.CreateCommand();
+            symbolCmd.CommandText = "SELECT COUNT(*) FROM symbols WHERE name = 'require' AND sub_kind = 'nuget.signature_validation_mode'";
+            Assert.Equal(1L, (long)symbolCmd.ExecuteScalar()!);
+        }
+        finally
+        {
+            DeleteDirectory(projectRoot);
+        }
+    }
+
     [Fact]
     public void Run_FilesUpdate_ReindexesUnchangedJsonFileWhenExpandedLanguageExtractorVersionChanged()
     {

tests/CodeIndex.Tests/SymbolExtractorTests.cs

@@ -12084,8 +12084,9 @@ public void GetContractVersion_LanguageSpecificKinds_UseDedicatedVersions()
         Assert.True(SymbolExtractor.MakefileContractVersion > SymbolExtractor.DefaultContractVersion);
         Assert.Equal(SymbolExtractor.StyleAndXamlContractVersion, SymbolExtractor.GetContractVersion("sass"));
         Assert.Equal(SymbolExtractor.StyleAndXamlContractVersion, SymbolExtractor.GetContractVersion("stylus"));
-        Assert.Equal(SymbolExtractor.StyleAndXamlContractVersion, SymbolExtractor.GetContractVersion("xml"));
         Assert.True(SymbolExtractor.StyleAndXamlContractVersion > SymbolExtractor.DefaultContractVersion);
+        Assert.Equal(SymbolExtractor.XmlContractVersion, SymbolExtractor.GetContractVersion("xml"));
+        Assert.True(SymbolExtractor.XmlContractVersion > SymbolExtractor.StyleAndXamlContractVersion);
     }
 
     [Fact]