11 commits

Author	SHA1	Message	Date
ChunxueLi	1029a8ddd7	feat: add Spring DI resolver for @Autowired List<T> injection (#2200) ... * feat: add Spring DI resolver for @Autowired List<T> injection Addresses all P0/P1 findings from tri-review (#2200): - P0: Register INJECTS in RelationshipType union (compiles) - P0: Rewrite execute() to emit consumer→implementation edges from graph data only - P1: Register in VALID_RELATION_TYPES, single-pass O(N) indexes - P1: Java-only gate with early exit on non-Java repos - P1: Update FULL_ORDER golden test - 8 unit tests covering all edge cases * test: make VALID_RELATION_TYPES size assertion array-driven (no hardcoded count) The security test hardcoded toBe(16) for the relation type count, but PR #2200 added INJECTS, bumping it to 17. Replace the magic number with an EXPECTED_RELATION_TYPES array whose .length drives the size assertion, so future additions only need to append to the list. Fixes CI failure on PR #2200. * fix(ingestion): thread raw generic field types onto Property nodes so Spring DI matching works (review 4616076037 P0) Production declaredType is generics-stripped by design (extractSimpleTypeName: List<Shape> -> "List"), so the spring-di phase's anchored regexes could never match real extraction output — the phase was a silent no-op on every real Java repository, while its unit tests passed against hand-built node shapes. Add FieldInfo.rawDeclaredType captured verbatim from the field's type node (.text, generics and qualifiers preserved — same precedent as the JVM method extractor), thread it through both parse-worker Property sites, add it to the shared NodeProperties contract, and match on rawDeclaredType ONLY (no declaredType fallback: it can never match real data and would mask future plumbing regressions as quiet no-ops). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): gate Spring DI on real injection annotations, honest edge reason (review 4616076037 P1) Extract Java field annotations (shared extractAnnotations helper, moved verbatim from the method extractor) onto Property nodes and require @Autowired or @Inject before a collection field becomes an INJECTS candidate. Previously every edge's reason string fabricated "@Autowired" without any annotation ever being checked, and any plain collection field would have fanned out false edges once matching worked. @Resource is deliberately excluded: JSR-250 resolves by bean name first (defaulting to the field name), injecting a single named collection bean — the opposite of the collect-all-implementers fan-out INJECTS models. Pinned by a test. An annotated candidate missing rawDeclaredType now logs an isDev warning (plumbing-contract breach signal) instead of vanishing silently. SCHEMA_BUMP 9 -> 10: Property nodes gained rawDeclaredType + annotations; warm parse caches must invalidate or the DI phase silently no-ops on replayed pre-upgrade nodes (the #2038 trap). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(ingestion): framework-neutral di phase + language-scoped Spring matcher registry (review 4616076037 P1) spring-di was the only pipeline phase naming a language in shared core/ingestion code (DoD.md language rule; the maintainer's direction is a generic DI solution). Split it: - di-extractors/spring.ts: the Spring matcher (annotation gate, collection type parse, @Resource exclusion rationale, framework-specific reason payload) — language-scoped home, mirroring route-extractors/. - di-extractors/index.ts: DI_MATCHERS, a single-valued ReadonlyMap<SupportedLanguages, DiFieldMatcher> mirroring the SCOPE_RESOLVERS registry shape sanctioned by AGENTS.md. Constructor injection deliberately out of scope; widen to arrays only when a second same-language framework lands. - pipeline-phases/di.ts (renamed from spring-di.ts): framework-neutral — routes Property nodes to registered matchers by node language via a typed guard, then runs the unchanged reverse-index fan-out. Zero language or framework names remain (grep-verified). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): language- and qualified-name-scoped interface resolution for DI fan-out (review 4616076037 P2) The interface index was built from ALL Interface nodes regardless of language, keyed by bare simple name with last-writer-wins overwrite — a polyglot repo with a TS and a Java 'Shape' could fan Java INJECTS edges into TypeScript classes, and two same-named Java interfaces in different packages silently collapsed to whichever parsed last (documented GitNexus bug class: #2054, PR #1956). Resolution is now per-language with qualifiedName as the primary key (Interface nodes already carry package-qualified qualifiedName); dotted element types resolve via qualifiedName, bare names via a per-language simple-name index that records ambiguity and fails CLOSED. Ambiguity skips are observable: DIOutput.ambiguousSkipped + an aggregated isDev debug log, so 'no DI fields' is distinguishable from 'all candidates ambiguous'. Same-package tiebreaking is a pinned, documented follow-up. Order-independence pinned by running collision tests in both insertion orders. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): depth-aware Spring collection-type parser for idiomatic generics (review 4616076037 P3) The two anchored regexes silently skipped idiomatic Spring shapes: Map<Pair<A,B>, IFoo> (nested-generic key broke the [^,]+ split), List<? extends IFoo> / List<? super IFoo> (bounded wildcards), java.util.List<IFoo> (qualified wrapper), and whitespace/multi-line declarations. Replace them with a small scanner: whitespace normalization, wrapper matched by last dotted segment, depth-aware top-level-comma split, wildcard bound stripping, and a final plain-dotted-type-name gate so anything else (nested-generic elements, arrays, unbounded wildcards, embedded comments, unbalanced brackets) fails closed. Every accept and reject is documented in the module docstring and pinned by 27 table-driven cases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(integration): prove Spring DI end-to-end through the real pipeline (review 4616076037 P1) Both no-op incarnations of this feature shipped with a green unit suite because every test hand-built the exact graph shape the phase expected — no test ever ran real Java source through the actual extraction pipeline. Add test/integration/spring-di-pipeline.test.ts: real .java fixtures via runPipelineFromRepo, pinning (a) the extraction contract on the annotated field's Property node (declaredType 'List', rawDeclaredType 'List<IFoo>', annotations ['@Autowired']), (b) set-equality on ALL INJECTS edges (exactly Consumer->FooA and Consumer->FooB; the non-annotated 'plain' field of the same type contributes nothing; no self-edges), and (c) a negative-control fixture with no injection annotations producing zero INJECTS edges. Either historical regression fails at least one of these. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(incremental): register INJECTS across product surfaces + delete-before-writeback (review 4616076037 P2) INJECTS was allowlisted in VALID_RELATION_TYPES but invisible or unhandled everywhere else. Register it deliberately: - REL_TYPES (gitnexus-shared schema-constants): web-side validRelType() otherwise silently rejects INJECTS filters (CLI/web single source of truth). - mcp/tools.ts cypher edge list (agent-facing schema discovery). - isGraphWideRelType: INJECTS validity is a whole-program property — a change to a THIRD file (the interface, or a new/removed implementer) creates/invalidates edges between two untouched files (the TAINT_PATH / #2084 M4 U6 class), so incremental extraction must always re-include the full fresh set. - deleteAllInjects (lbug-adapter): mirrors deleteAllInterprocTaintPaths — COUNT-then-DELETE under withConnLock, benign missing-table carve-out, re-throw otherwise (CodeRelation has no PK and there is no read-side dedup; a fail-soft delete + re-add would silently duplicate rows). - run-analyze.ts: the delete is UNCONDITIONAL, next to the Communities delete — deliberately NOT inside the options.pdg block: the di phase runs on every persisting analyze while the graph-wide re-include is unconditional, so a pdg-gated delete would append without deleting on every non-pdg incremental run (N runs = N copies). - local-backend.ts comment: opt-in traversal by design (not in default impact()/context() lists; no IMPACT_RELATION_CONFIDENCE entry per the WRAPS/FETCHES precedent — edges carry their own 0.8). - ARCHITECTURE.md: 14 -> 15 phases, DAG diagram, phase table, skip-list. Note: the tools.ts edge list also predates WRAPS/QUERIES/USES — that drift is pre-existing and left for a follow-up. Idempotency pinned end-to-end: two successive incremental runs (real runFullAnalysis + real LadybugDB, unrelated-file touches) leave the INJECTS row count stable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: describe INJECTS' actual precondition; drop stale fixed-at-16 comments (review 4616076037 P3) The shared-schema doc for INJECTS claimed an @Autowired precondition the code (pre-fix) never checked, and hardwired Spring semantics into what is now a framework-neutral edge type. Reword: precondition is an injection annotation recognized by a per-language matcher in di-extractors/; framework specifics live in the reason payload, not the type contract. security.test.ts comments still said the allow-list size 'stays fixed at 16' (it is 17 and the assertion derives from EXPECTED_RELATION_TYPES). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: simplify DI surfaces — narrow matcher contract, dedup delete-alls, derive tools edge list Post-implementation simplification pass (4 review angles): - DiFieldMatch/CandidateField carried collectionType + matchedAnnotation that no consumer read (the matcher bakes both into reason) — narrowed to {elementTypeName, reason}. - parseElementTypeName had two guard branches fully subsumed by the final plain-dotted-type-name gate — deleted, rationale folded into the regex comment. - The three byte-identical delete-all-by-rel-type functions in lbug-adapter (TAINT_PATH / CALL_SUMMARY / INJECTS) are now one parameterized helper + thin wrappers with identical names, signatures, and message text (character-diff verified) — the missing-table regex and abort policy now live in exactly one place. - The cypher tool's hand-maintained edge-type list (already missing WRAPS/QUERIES/USES) is now derived from the canonical REL_TYPES — the drift class is gone rather than patched. - di phase: interface indexes are built only for languages that actually have candidates; test builder gained a rawDeclaredType opt-out replacing a hand-rolled node. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: apply Tier-2 review findings — qualified-name fail-closed, honest cypher docs, pinned delete contract, hook isolation - byQualifiedName was last-writer-wins on duplicate qualified names (reproduced: order-dependent INJECTS edges with ambiguousSkipped 0 — same package+interface duplicated across monorepo modules/source roots; Java qualifiedName has no file-path component). Both indexes now share the AMBIGUOUS fail-closed sentinel; order-flip test added. - The REL_TYPES-derived cypher edge list advertised pdg-gated types with no caveat (LLM queries on them silently return zero rows on default indexes) — caveat appended, INJECTS example added, impact relationTypes description now names the DI fan-out opt-in. - The delete-all re-throw contract (only defense against duplicate CodeRelation rows) was untested — error classification extracted to a pure classifyDeleteAllError and pinned exhaustively. - extractRawType/extractAnnotations hooks lacked the per-hook try/catch the pipeline applies elsewhere (#2286 pattern): a throwing hook would silently drop every remaining file in the language group. Hardened, degradation tested. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 17:49:46 +01:00
Gergő Magyar	78b4077d8a	feat(impact): opt-in PDG-backed impact mode - statement + inter-procedural slicing, resolved-callee-id soundness, mutation-oracle validated (#2227)	2026-06-20 12:04:32 +01:00
Gergő Magyar	7c3d4e6862	feat(pdg): control dependence — post-dominators + CDG (Ferrante) [M5 #2085] (#2188) ... * feat(pdg): add CDG + POST_DOMINATE edge types (M5 #2085) * feat(pdg): post-dominator tree on reverse CFG (M5 #2085) * feat(pdg): Ferrante control-dependence over the post-dom tree (M5 #2085) * feat(pdg): emitFileCdg + optional POST_DOMINATE debug edges (M5 #2085) * feat(pdg): wire CDG emission in-phase + pdgModeMismatch CDG-cap stamp (M5 #2085) * test(pdg): CDG snapshot + end-to-end pipeline answerability (M5 #2085) * fix(review): apply autofix feedback (M5 #2085) * fix(pdg): label CDG edges by controller arm sense, not edge kind (#2188 F1/F2/F4) Tri-review (with Codex as the independent engine) found the CDG 'T'/'F' label was wrong for the commonest control flow: the M1 TS visitor wires a condition's fall-through FALSE arm as `seq`/`loop-back`, but `branchSense` mapped both to 'T', so guard clauses, if-no-else, and loop `break` got 'T' instead of 'F' (F1, P1). The structural CDG edges were correct; only the label — the AC3 "under what condition does X run?" answer — was wrong. - F1: replace edge-kind `branchSense` with controller-arm-sense `labelFor`. An ambiguous fall-through edge (seq/loop-back) takes the COMPLEMENT of its source block's explicit cond-true/cond-false sibling arm. This correctly handles do/while (loop-back = TRUE arm) and inner-if-in-loop (loop-back = FALSE arm) — the ambiguity a kind→label table cannot resolve. Adds real-parser regression tests (the hand-built tests used a fictional cond-false edge and missed it). - F2: correct the false "sound over-approximation that never drops a real dependence" claim in post-dominators.ts — exit-unreachable regions both drop and invent control dependences (latent for the current TS visitor, which keeps EXIT reverse-reachable). Reframe the exit-less-loop test to characterize, not bless, the degenerate behavior. - F4: make the AC2 property-test reference compute post-dominance INDEPENDENTLY (node-removal reachability, no shared code with post-dominators.ts), so a post-dom direction bug can no longer pass both the impl and the reference. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ci): root-prettier format + run-analyze pdg stamp gains maxCdgEdgesPerFunction (#2085) Two deterministic CI failures from the M5 CDG work: - quality/format: basicblock-roundtrip.test.ts failed CI's root `prettier --check .` (the pre-commit hook uses the gitnexus-local prettier config, which differs); reformatted with the root config. - tests/ubuntu/coverage: run-analyze.test.ts pinned the resolved RepoMeta.pdg shape (DEFAULTS) and the all-zero cap override without the new maxCdgEdgesPerFunction key (default 5000); added it so resolvePdgConfig toEqual and pdgModeMismatch(DEFAULTS) pass. (The stale-test sweep missed this file in PR #2188 — same trap M2 hit.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(mcp): add pdg_query tool definition (controls/flows modes) [M6 #2086] * feat(mcp): pdg_query backend — controls (CDG) + flows (REACHING_DEF) + e2e test [M6 #2086] * feat(mcp): document PDG edges + pdg_query (schema, cypher, skill, --pdg-gated ai-context) [M6 #2086] * fix(mcp): correct pdg_query symbol-anchor lower bound + harden inputs [PR #2188 review] Tri-review (Codex + adversarial + correctness lanes) of the M6 pdg_query surface found the symbol-anchor window over-includes a neighbor function's block. The upper bound was widened to the 1-based BasicBlock basis (symEnd+1) but the lower bound was left 0-based, so a block on the line directly above the target function leaked into the result. Shift both bounds +1 ([symStart+1, symEnd+1]) so the window is the function's true block span. Also from the same review: - pdg_query no longer throws on a no-arguments MCP call: the dispatch passes raw `params`, so default it to {} → a clean mode-validation error instead of a TypeError. (`explain` shares this latent pattern — pre-existing follow-up.) - tools.ts: the controls-mode description no longer hard-codes the 'F' branch sense for guards — `if (!ok) return;` rides the predicate's 'T' arm; the guard:true flag is label-agnostic (regex on the dependent block text). Tests: a hand-seeded adjacency regression (verified failing without the lower-bound +1) + a no-arguments validation test. Skill doc updated to document the two-sided [symStart+1, symEnd+1] window. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(mcp): drop always-true anchor conditional in pdg_query [CodeQL #2188] CodeQL alert 756 flagged `...(anchor ? { anchor } : {})` in _pdgQueryImpl as a useless conditional: `anchor` is unconditionally assigned in both the file-path and symbol branches before the return (the not-found/ambiguous/no-layer paths return earlier), so it is always truthy. Drop `| undefined` from the declaration (TypeScript definite-assignment holds across both branches) and emit `anchor` directly. No runtime change — the `anchor` field was already present on every result. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cli): add hasPdg to the noStats bridge expectation [#2188] The M6 work threaded `hasPdg: options.pdg === true` into the AIContextOptions passed to generateAIContextFiles on the --skills regeneration path, but this test's strict .toEqual expectation predated it (4 keys vs 3 → CI failure). Add `hasPdg: false` (the value on this non---pdg path). The assertion stays strict; the #1477 noStats bridging it guards is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cli): collapse generateGitNexusContent params to an options bag [#2188] The function had grown to 9 positional params; reaching `hasPdg` meant passing six `undefined`s (the M6 review's maintainability flag). Collapse params 3-9 (generatedSkills, groupNames, noStats, skipSkills, runnerPath, defaultBranch, hasPdg) into a `GitNexusContentOptions` object with the defaults moved to destructuring. The body is unchanged (same local names); the single production caller and the test calls become self-documenting named fields. Pure refactor — generated AGENTS.md/CLAUDE.md content is byte-identical. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): skip CDG for exit-unreachable CFGs (unsound post-dominance) [#2188] M5 review P2: computePostDominators roots only at cfg.exitIndex and nothing enforced that EXIT is reachable from every block. For an entry-reachable region that cannot reach EXIT (a non-terminating loop, or a multi-terminal CFG a future visitor might emit) the EXIT-rooted reverse walk degenerates — it both drops real control dependences and invents spurious ones. Add a pure precondition predicate `isExitReachableFromAllBlocks` (co-located with the algorithm it guards) and gate it in emitFileCdg: a CFG that violates it is skipped for CDG (counted as skippedUnsoundFunctions + one onWarn), while its CFG and REACHING_DEF projections — which do not depend on post-dominance — are kept. A CDG-specific gate, not a widening of isEmitSafeCfg, so the blast radius is exactly the unsound CDG. The current TS visitor always satisfies the precondition (every loop gets a structural header→loopExit edge), so CDG output for real fixtures is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): bound computeControlDependence materialization (heap parity) [#2188] M5 review P2: unlike computeReachingDefs (maxFacts) and the emit-side edge cap, computeControlDependence materialized the full deduped seen/out before emitFileCdg's per-function cap could trim it — O(edges × post-dom depth) heap for a deeply nested function. Add a `maxEdges` ceiling (default 0 = unbounded) returning {edges, truncated}, mirroring computeReachingDefs's {facts, truncated}. The ceiling is checked before pushing a new unique edge, so `truncated` means a genuine overflow (not merely "reached cap"). emitFileCdg passes a FIXED materialization ceiling (8× the default edge cap) — deliberately NOT derived from the runtime edge cap, because CDG's materialization IS the deduped-edge quantity the cap reports on (deriving it would pre-truncate that set and lose the exact dropped count). A ceiling hit is surfaced via onWarn + the truncated flag — never silent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(mcp): share resolveBlockAnchor; fix explain's anchor off-by-one [#2188] M6 review P2 (duplication) + the flagged pre-existing _explainImpl correctness follow-up. _pdgQueryImpl and _explainImpl each carried a near-identical symbol↔block anchor resolver that had DRIFTED: pdg_query used the corrected [symStart+1, symEnd+1] window (BasicBlock startLine is 1-based, the symbol span 0-based) while _explainImpl still used [symStart, symEnd] — dropping a taint source on the function's final line AND leaking a neighbor's block on the line directly above. Extract one `resolveBlockAnchor` helper, used by both, that applies the correct window and a single (bare) clause convention (callers compose their own WHERE). This removes ~50 duplicated lines and fixes explain's anchor in one place. A hand-seeded characterization test (taint-explain Block 4) pins both bounds — verified to FAIL on the pre-fix window (it returned the line-10 neighbor instead of the line-15 final-line source). Existing taint-explain + pdg-query suites are unchanged (their fixtures have interior sources/sinks). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(mcp): pdg_query reports "status unknown" when the layer can't be confirmed [#2188] M6 review P3 (Codex): when meta is UNREADABLE and the bounded global existence probe returns zero rows of the edge type, _pdgQueryImpl asserted "no PDG layer" — but a genuinely edge-free layer (all-linear functions) is indistinguishable from a missing one via that probe. Soften only that fallback path to an inconclusive "PDG layer status unknown — was this repo indexed with --pdg?" note. The meta-stamped path (stamp present, cap absent ⇒ layer truly missing) keeps the definitive "no PDG layer" wording. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(mcp): cover pdg_query ambiguous / pagination / Windows-path gaps [#2188] M6 review test-gap follow-ups, all hand-seeded with controlled data: - ambiguous symbol name → status:'ambiguous' + ranked candidates shape (uid/name/filePath/score), never a silent guess; - total/truncated page boundary in both directions (limit below the match count sets truncated with the full total; limit above it omits truncated); - a Windows-style filePath containing ':' resolves and fnLineOf decodes the function-line segment correctly (split-from-right past the drive letter). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(skills): ship gitnexus-pdg-query skill mirrors + add pdg_query to the guide [#2086] M6 bundled pdg_query into this PR, but the skill shipped only in the canonical gitnexus/skills/ root. Mirror it (byte-identical) to the two hand-maintained roots the sibling taint skill uses — .claude/skills/gitnexus/ and the plugin — so Claude Code + plugin users get it too. Also extend the gitnexus-guide tool reference (all 3 copies, now byte-identical): add a `pdg_query` row + a "Control & data dependence" section mirroring the taint/`explain` section, and reconcile the pre-existing drift where only the .claude copy carried the `check` tool row (a real registered tool) — all three now list it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(architecture): refresh CFG/PDG section for the full M1–M6 stack [#2086] The PR body had deferred the "ARCHITECTURE docs refresh" to #2086; now that M6 ships here, do it: - MCP tools table gains `explain` and `pdg_query` (were absent). - "Optional CFG/PDG emission" was M1-only; rewrite to cover the whole opt-in stack — M1 CFG, M2 REACHING_DEF, M3/M4 taint, M5 CDG (Ferrante over CHK post-dominators, with the exit-unreachable skip), M6 read surface (pdg_query + explain, anchored + LIMIT-bounded, shared resolveBlockAnchor) — and note the no-Function→BasicBlock-edge join. - LadybugDB schema notes the `--pdg` additions: the `BasicBlock` node table and the CFG/REACHING_DEF/CDG/TAINTED/SANITIZES/TAINT_PATH relation types, kept out of the default VALID_RELATION_TYPES / web schema. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 18:49:03 +01:00
Gergő Magyar	f2c9e69792	feat(ingestion): M0 — taint/PDG substrate (schema + seams + spikes) (#2080) (#2092)	2026-06-08 18:56:10 +01:00
DuduPhudu	c2b4ec6c31	feat(vue): migrate Vue SFC to scope-based resolution (RFC #909 Ring 3, closes #940) (#1950) ... * feat(vue): migrate Vue SFC to scope-based resolution (RFC #909 Ring 3, closes #940) Adds `vueScopeResolver` and wires Vue into the scope-resolution pipeline (`SCOPE_RESOLVERS`, `MIGRATED_LANGUAGES`). Vue's `<script>` / `<script setup>` blocks are TypeScript — `emitVueScopeCaptures` extracts the script block via the existing `extractVueScript` utility and delegates to `emitTsScopeCaptures`, keeping grammar identity consistent with the cached tree the parse-worker already builds. - `languages/vue/captures.ts` — `emitVueScopeCaptures` - `languages/vue/import-target.ts` — `makeVueResolveImportTarget` (TS resolver + tsconfig path-alias support; explicit `.vue` imports resolve via the exact-path branch) - `languages/vue/scope-resolver.ts` — `vueScopeResolver` - `languages/vue/index.ts` — barrel + known-limitations doc - `languages/vue.ts` — `emitScopeCaptures` hooked up - `scope-resolution/pipeline/registry.ts` — Vue entry added - `registry-primary-flag.ts` — `SupportedLanguages.Vue` added to `MIGRATED_LANGUAGES` (production default → registry-primary) - `vue-composition-api` — `<script setup lang="ts">`, defineProps / defineEmits macros, cross-file TS imports, computed refs - `vue-options-api` — `defineComponent({methods, computed, data})`, this-based method calls, imported utility calls - `vue-cross-file` — composable functions returning class instances, multi-level import chains, UserModel/PostModel method calls - `fieldFallbackOnMethodLookup: true` — Options API `this.X()` calls may not resolve through the type-binding layer (no formal class); fallback catches common patterns via declared field names. - `allowGlobalFreeCallFallback: false` — Vue uses explicit imports; workspace-wide unique-name fallback would produce spurious edges for built-ins (ref, reactive, defineProps, …). - Template expression calls intentionally out of scope: component- reference CALLS edges are already emitted by the legacy template extractor. Remaining template gaps tracked in #1647. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(vue): address P0/P1 review findings from #1950 ## P0 #1 — missing scope-resolution hooks in vueProvider `pass3CollectImports` early-returns when `interpretImport` is undefined, producing zero IMPORTS and zero cross-file CALLS edges. Add the four hooks to `vueProvider` in `vue.ts`: - `interpretImport: interpretTsImport` - `interpretTypeBinding: interpretTsTypeBinding` - `bindingScopeFor: tsBindingScopeFor` - `importOwningScope: tsImportOwningScope` Also add `receiverBinding`, `mergeBindings`, `arityCompatibility`, and `resolveImportTarget` to complete the scope-resolution contract. ## P0 #2 — template-component CALLS dropped when Vue is registry-primary `isRegistryPrimary(Vue) → true` makes the main call-processor loop skip Vue files entirely, silencing the inline `vue-template-component` CALLS emitter at ≈L1506. Add a dedicated post-loop pass in `call-processor.ts` that emits template-component CALLS for Vue files whenever Vue is registry-primary. Update the stale `vue/index.ts` limitation comment to reflect the new emit site. ## P1 #3 — worker-mode double-extraction → zero captures In worker mode (≥15 files) the parse worker pre-extracts the `<script>` block and passes `scriptContent` as `sourceText`. `emitVueScopeCaptures` was calling `extractVueScript` a second time, getting null, and returning `[]`. Fix: if extraction returns null and the content has no SFC block- level markers (`<template`, `<style`), treat it as already-extracted script text and delegate directly to `emitTsScopeCaptures`. ## Test assertion strictness Replace all `toBeGreaterThanOrEqual(1)` assertions with exact `toBe(N)` counts. IMPORTS counts reflect per-symbol scope-based edges (value imports only; `import type` is not emitted as an IMPORTS edge). CALLS counts are 1 per single-call-site. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(vue): template-derived edges + pipeline benchmark (#1950 review) Addresses the reviewer's request for template edge attribution and a performance benchmark. ## Template event-handler CALLS (`vue-template-callback`) Add `extractTemplateEventHandlers` to `vue-sfc-extractor.ts`. Extracts bare single-identifier handlers from `@event="methodName"` and `v-on:event="methodName"` attributes. Inline expressions with arguments or operators (`@click="toggle(item)"`) are intentionally excluded. Wire into the dedicated registry-primary Vue template pass in `call-processor.ts`. For each extracted handler name, `ctx.resolve` finds the in-file Function/Method node and emits a CALLS edge with `reason: 'vue-template-callback'`. ## Template attribute-binding ACCESSES (`vue-template-attribute`) Add `extractTemplateAttributeBindings` to `vue-sfc-extractor.ts`. Extracts bare single-identifier values from `:prop="varName"` and `v-bind:prop="varName"` bindings. Member-access (`:key="post.id"`) and literals are excluded by the identifier-boundary regex. Wire into the same template pass. For each extracted variable, `ctx.resolve` finds the in-file node and emits an ACCESSES edge with `reason: 'vue-template-attribute'`. ## `vue/index.ts` limitations comment Updated to accurately describe all three categories of template-derived edges and explicitly document the complex-expression exclusions. ## Tests Add 6 new assertions in `vue-scope.test.ts`: - `@click="handleSave"` → CALLS `handleSave` (UserProfile.vue) - `@select="onPostSelected"` → CALLS `onPostSelected` (App.vue composition) - `@keyup.enter="addTodo"` → CALLS `addTodo` (TodoList.vue) - `@loaded="onUserLoaded"` → CALLS `onUserLoaded` (App.vue cross-file) - `:userId="currentUserId"` → ACCESSES `currentUserId` (App.vue composition) - `:posts="allPosts"` → ACCESSES `allPosts` (App.vue composition) Add `vue` entry to `LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES` in `helpers.ts` documenting which assertions are registry-primary-only (IMPORTS cardinality, template-derived edges, `<script setup>` export). ## Benchmark Add `vue-pipeline-benchmark.test.ts` (gated by `GITNEXUS_BENCH=1`). Generates N-component synthetic repos (10 / 25 / 50 / 100) and asserts that wall-clock and node counts scale sub-quadratically with component count, guarding against O(n²) regressions in the template extraction or scope-resolution passes. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(vue): BINDS_EVENT_HANDLER/EMITS_EVENT edges via ScopeResolver hook Per maintainer feedback on PR #1950: - Do not edit call-processor.ts (will be removed when all languages migrate) - Model Vue component-event system with dedicated edge types to avoid CALLS noise in deep component hierarchies (per contributor discussion) Changes: - gitnexus-shared: add BINDS_EVENT_HANDLER and EMITS_EVENT to RelationshipType - vue-sfc-extractor: add extractComponentEventBindings, extractNativeElementEventHandlers, and extractScriptEmitCalls - ScopeResolver contract: add optional emitPostResolutionEdges hook - run.ts: wire emitPostResolutionEdges after emitImportEdges - vue/scope-resolver: implement emitPostResolutionEdges emitting: 1. CALLS (vue-template-component) — PascalCase component File refs 2. CALLS (vue-template-callback) — @event on native HTML elements 3. BINDS_EVENT_HANDLER (vue-event: @name) — @event on component elements; source = handler fn in parent, target = child component File (not CALLS) 4. EMITS_EVENT (vue-emit: name) — emit() calls; self-loop on component File, joinable with BINDS_EVENT_HANDLER via Cypher for impact tracing 5. ACCESSES (vue-template-attribute) — :prop="var" bindings - call-processor.ts: revert dedicated Vue post-loop pass; moved to scope resolver - Tests and parity expected-failures updated accordingly Co-authored-by: Cursor <cursoragent@cursor.com> * fix(vue): close review gaps in scope/parity extraction Resolve the new PR #1950 review findings by widening Vue scope context to include TS/JS import closures, fixing BINDS_EVENT_HANDLER endpoint assertions, hardening emit/event extraction to avoid comment/property false positives, supporting kebab-case component tags, and ensuring parity runs include vue-scope suites. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(vue): address second review round — regex safety, emit coverage, arch Closes items raised in the Jun 2 review comment on PR #1950. Correctness fixes: - ReDoS mitigation: bound attribute-capture spans to [^>]{0,512}? in all three template tag regexes to prevent pathological backtracking. - Kebab-case misclassified as native: added (?![A-Za-z0-9-]) negative lookahead to NATIVE_TAG_RE so <post-list> is no longer split as native tag `post` with attrs `-list ...`. - Hyphenated event names dropped: widened TAG_EVENT_RE from [\w:.]+ to [\w:.-]+ so @user-loaded and @update:model-value are captured. - this.$emit silently dropped: collectBareEmitEventNames now allows this.$emit(...) by looking back past the '.' to verify preceding token is exactly `this`; socket.emit etc. remain blocked. - Event names with colon rejected: extended validator to accept update:modelValue and update:model-value patterns. Architecture fix: - Moved collectVueScopeFilePaths out of shared phase.ts into a new collectScopeContextPaths optional hook on ScopeResolver, keeping shared pipeline code language-agnostic. vueScopeResolver implements the hook. - Fixed memory leak: preExtractedByPath cleanup now iterates filePaths (all context files) not just primaryFilePaths (only .vue files). Cleanup: - Removed unused extractTemplateEventHandlers and duplicate EVENT_HANDLER_RE. - Fixed skipped comment numbers in emitPostResolutionEdges (1,2,4,5,6 -> 1-6). - Updated vue/index.ts: four categories -> five (added EMITS_EVENT). - Fixed gitnexus-shared EMITS_EVENT JSDoc to reflect File->File reality. Tests: 7 new unit tests covering hyphenated events, this.$emit, kebab-case native-tag exclusion, and update:modelValue event name validation. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(vue): eliminate double file-read and per-file template re-scans Two performance fixes from the self-review pass: 1. **No more double read of .vue files in phase.ts**: primary files were previously read once for `collectScopeContextPaths` (via `entryFileContents`) and again in the blanket `readFileContents(filePaths)` call. Now the primary-file map is passed directly and only the extra context files (TS/JS import closure) require a second I/O round-trip. 2. **Single template parse per .vue file in emitPostResolutionEdges**: previously each of the five extractor functions (components, native handlers, component event bindings, emit calls, attribute bindings) ran `TEMPLATE_RE.exec(content)` independently — five full-file scans per `.vue` file. Replaced with a new `extractVueTemplateEdgeData` batching helper that parses the template and script blocks once and feeds all five extractors from the pre-extracted content. emitPostResolutionEdges now calls a single function and destructures the results. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(parity): exclude TypeScript HOC/HOF/JSX scope-resolver tests from legacy DAG parity gate Three test files introduced in prior PRs exercise scope-resolver-only correctness wins: HOC-wrapped const declarations, HOF-callback caller attribution, and JSX-as-call CALLS edges. The parity runner's ${slug}-*.test.ts glob now picks them up, causing typescript [legacy] failures in CI. Fix: convert each file to use createResolverParityIt('typescript') and register all 26 legacy-failing test names in LEGACY_RESOLVER_PARITY_EXPECTED_FAILURES.typescript with explanatory comments. Legacy mode: 11+11+4 tests skipped, zero failures. Registry-primary mode: all 37 tests pass as before. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(test): remove registry-primary-flag unit tests after migration complete All languages are now in MIGRATED_LANGUAGES; the per-language flip tests are no longer needed. Addresses PR #1950 review feedback. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-06-03 21:48:38 +01:00
Gergő Magyar	6222b5be9b	feat(ingestion): emit-references drains ReferenceIndex to graph edges (#925, RFC #909 Ring 2 PKG) (#973)	2026-04-18 23:36:10 +01:00
Gergő Magyar	0561d24efd	feat: METHOD_IMPLEMENTS edges, overload disambiguation, MethodExtractor unification (#574) (#642)	2026-04-04 18:41:47 +01:00
Gergő Magyar	c72890d59d	feat(csharp): C# MethodExtractor config (#582) ... * feat(csharp): add C# MethodExtractor config (#573) Add C# method extraction config mirroring the JVM pattern from PR #576. Wire csharpMethodConfig into the C# language provider and add 18 tests covering classes, interfaces, abstract classes, structs, records, constructors, params/out/ref/optional parameters, sealed methods, attributes, and visibility modifiers. * fix(csharp): add destructor, operator, conversion operator, and in-param support - Add destructor_declaration, operator_declaration, and conversion_operator_declaration to methodNodeTypes - Custom extractName for operators (e.g., "operator +", "implicit operator double") - Fix extractReturnType for operator declarations (use type field, not returns) - Add in modifier to parameter extraction (alongside out/ref) - Add 4 new tests: destructor, operator+, implicit conversion, in parameter * fix(csharp): add ref param test and document compound visibility limitation - Add test for ref parameter modifier (was only testing out) - Document that protected internal / private protected resolve to first modifier * feat(csharp): support compound visibilities (protected internal, private protected) - Add 'protected internal' and 'private protected' to FieldVisibility union - Detect compound modifiers in both C# method and field extractors via collectModifierTexts helper scanning adjacent modifier nodes - Add 2 tests for compound visibility detection * feat(csharp): primary constructors, virtual/override/async, primary fields Address all known limitations from review: - Primary constructor support (C# 12): add extractPrimaryConstructor to MethodExtractionConfig and extractPrimaryFields to FieldExtractionConfig. Record params become public readonly properties; class params become private captured fields. - Add isVirtual, isOverride, isAsync optional fields to MethodInfo, MethodExtractionConfig, NodeProperties, and parse-worker propagation. - Detect virtual/override/async modifiers in C# method config. - Move collectModifierTexts to shared helpers.ts (deduplicate). - Fix destructor name to ~ClassName (disambiguates from constructor). - Add expression-bodied method test. - 118 tests total across method + field extraction suites, all passing. * fix(csharp): review round 2 — annotations, record_struct, grammar pin - Fix primary constructor annotations: use [] instead of extracting class-level attributes (C# has no syntax for ctor-specific attributes) - Add record_struct_declaration to typeDeclarationNodes in both method and field extractors, CLASS_CONTAINER_TYPES, and isRecord visibility check - Pin tree-sitter-c-sharp version (^0.23.1) in params comment * fix(csharp): complete record_struct query + label mapping, sealed override test - Add record_struct_declaration capture patterns to tree-sitter-queries.ts (type definition + primary constructor) - Add record_struct_declaration → 'Struct' in CONTAINER_TYPE_TO_LABEL - Assert isOverride: true alongside isFinal in sealed override test * fix(csharp): record_struct label mismatch, add record struct + documented limitation tests - Fix record_struct_declaration query tag: @definition.struct (not @definition.record) to match CONTAINER_TYPE_TO_LABEL and prevent broken HAS_METHOD edges - Add 3 record struct tests: isTypeDeclaration, method extraction, primary constructor - Add documented limitation tests: partial method (isAbstract: false), generic type parameter stripping (name excludes <T>) * fix(csharp): remove record_struct_declaration — not a real tree-sitter node type tree-sitter-c-sharp 0.23.1 parses 'record struct' as record_declaration (absorbs the 'struct' keyword as an unnamed child token). The non-existent record_struct_declaration in queries caused TSQueryErrorNodeType, breaking ALL C# file processing. Remove from: tree-sitter-queries.ts, typeDeclarationNodes in both extractors, CLASS_CONTAINER_TYPES, and CONTAINER_TYPE_TO_LABEL. Record struct types are already handled via record_declaration. * feat(csharp): add isPartial support, filter targeted attributes, static ctor test - Add isPartial optional field to MethodInfo, MethodExtractionConfig, NodeProperties, and parse-worker propagation pipeline - Detect partial modifier in C# config — marks both declaration-only and implemented partial methods - Filter targeted attribute lists (e.g. [return: MarshalAs(...)]) in extractCSharpAnnotations — only untargeted attributes collected - Add static constructor test (isStatic: true, same name as class) - Add 3 partial method tests: declaration-only, with body, coexisting pair - Document record_struct/record_class as defensive dead code in export-detection.ts (grammar absorbs keywords into record_declaration) * fix(csharp): this param for extension methods, dedup visibility, test fixes - Handle this modifier on extension method parameters (type prefixed as 'this string', consistent with out/ref/in handling) - Deduplicate visibility logic in extractPrimaryConstructor — reuse csharpMethodConfig.extractVisibility instead of inline compound check - Fix record struct test title to reflect actual grammar behavior - Add conversion operator returnType assertion - Add extension method this parameter test * fix(csharp): primary constructor line points to param list, empty name guard - Use paramList.startPosition instead of ownerNode.startPosition for primary constructor line number (avoids methodInfoCache key collision) - Guard against empty param names from tree-sitter error recovery nodes	2026-03-30 08:41:17 +01:00
Gergő Magyar	313b13fade	feat(java,kotlin): MethodExtractor abstraction with per-language configs (#576)	2026-03-28 21:31:08 +00:00
Gergő Magyar	ddb6a704b3	refactor: reduce explicit any types (#566) ... * refactor: replace NodeProperties index signature any with unknown Change [key: string]: any to [key: string]: unknown in NodeProperties. Remove 19 redundant (node.properties as any) casts in csv-generator.ts — all accessed properties are already declared on the type. * refactor: replace any with SyntaxNode across ingestion layer Mechanical substitution — all tree-sitter AST node parameters and variables typed as any are now properly typed as SyntaxNode. - ast-helpers.ts: 13 any → SyntaxNode - parsing-processor.ts: 8 any → SyntaxNode - parse-worker.ts: 40 any → SyntaxNode/TreeSitterLanguage/Parser.Query - php.ts: 11 any → SyntaxNode Also adds TreeSitterLanguage type alias for optional grammar loading. * refactor: eliminate remaining any in ingestion layer - call-processor, call-routing, c-cpp: SyntaxNode substitutions - parse-worker: typed WorkerIncomingMessage discriminated union - worker-pool: typed WorkerOutgoingMessage + Error handler - ast-cache, import-processor: targeted cast for Tree.delete() - community-processor: graphology AbstractGraph types, LeidenModule interface for vendored leiden code Ingestion layer: 130 → 7 any warnings remaining.	2026-03-28 17:11:24 +00:00
Gergő Magyar	fd7fb5bf1f	feat: unify web and cli ingestion pipeline (#536) ... * feat: add server-side ingestion API (POST /api/analyze, SSE progress) Extract core analysis orchestration from CLI into shared run-analyze.ts module. Add server-side analyze endpoints so the web app can trigger ingestion via HTTP instead of running the full pipeline in-browser. New files: - src/core/run-analyze.ts — shared runFullAnalysis() orchestrator - src/server/analyze-job.ts — job manager (single-slot, dedup, SSE events) - src/server/analyze-worker.ts — forked child process (8GB heap, IPC) - src/server/git-clone.ts — shallow clone/pull with SSRF protection API endpoints: - POST /api/analyze — start analysis (returns 202 + jobId) - GET /api/analyze/:jobId — poll job status - GET /api/analyze/:jobId/progress — SSE progress stream Security: URL validation blocks private IPs and non-HTTP schemes. Path validation requires absolute paths. Git stderr not leaked to API. * feat(web): add server-side analyze UI (Phase 2) Add "Analyze on Server" flow to the web app's Server tab so users can trigger server-side ingestion from the browser. On completion, the graph is automatically loaded via the existing connectToServer flow. New files: - AnalyzeProgress.tsx — progress bar with phase label, elapsed time, cancel Modified files: - backend.ts — startAnalyze(), streamAnalyzeProgress() SSE client - DropZone.tsx — analyze URL input + button below Connect section - App.tsx — onServerAnalyze handler wires analyze -> connect flow * feat: add job cancellation, timeout, and child process tracking (Phase 3) - DELETE /api/analyze/:jobId — cancel running analysis (SIGTERM to worker) - 30-minute timeout kills long-running workers automatically - Child process refs tracked in JobManager for cleanup on shutdown - dispose() kills all active children on SIGINT/SIGTERM - Web cancel button now calls server DELETE endpoint - cancelAnalyze() added to web backend client * refactor(web): remove browser ingestion pipeline (Phase 4) Delete 16 duplicated ingestion files, 2 unused service files (git-clone, zip), and tree-sitter parser-loader from gitnexus-web. All ingestion now runs server-side via POST /api/analyze. Deleted (18 files, ~5,000 lines): - core/ingestion/*.ts (16 pipeline processors) - core/tree-sitter/parser-loader.ts (WASM tree-sitter loader) - services/git-clone.ts (isomorphic-git client-side clone) - services/zip.ts (JSZip extraction) Simplified: - DropZone.tsx — server-only (removed ZIP/GitHub tabs) - ingestion.worker.ts — removed runPipeline/runPipelineFromFiles - useAppState.tsx — removed pipeline callbacks - App.tsx — removed handleFileSelect/handleGitClone - main.tsx — removed Buffer polyfill for isomorphic-git - types/pipeline.ts — removed PipelineResult/serialize helpers Kept: cluster-enricher.ts (LLM enrichment, still used by worker) Dependencies now removable: web-tree-sitter, isomorphic-git, @isomorphic-git/lightning-fs, jszip (estimated 3-4MB bundle savings) * refactor(web): sync graph schema from CLI + delete WASM grammars Sync graph/types.ts and lbug/schema.ts from the CLI (source of truth) to the web module so the browser LadybugDB can handle all node and relationship types the server pipeline produces. Synced types: Route, Tool, Section node labels; HANDLES_ROUTE, FETCHES, HANDLES_TOOL, ENTRY_POINT_OF, WRAPS, QUERIES relationship types; description fields on Function/Class/Interface/Method/CodeElement. Deleted: public/wasm/ directory (14 tree-sitter WASM grammars + core). Removed deps: web-tree-sitter, isomorphic-git, @isomorphic-git/lightning-fs, jszip, buffer, @types/jszip (~3-4MB bundle savings). * feat: create gitnexus-shared package for unified type definitions Create a new gitnexus-shared package that is the single source of truth for types shared between the CLI and web modules: - SupportedLanguages enum (15 languages) - Graph types: NodeLabel, NodeProperties, RelationshipType, GraphNode, GraphRelationship - Schema constants: NODE_TABLES, REL_TYPES, REL_TABLE_NAME, EMBEDDING_TABLE_NAME - Pipeline types: PipelinePhase, PipelineProgress Both gitnexus (CLI) and gitnexus-web import from gitnexus-shared via file: dependency. Each package re-exports and extends with platform-specific additions (CLI: KnowledgeGraph with mutation methods; Web: simpler KnowledgeGraph). This ensures types can never drift between packages — adding a new language, node type, or relationship type in gitnexus-shared automatically propagates to both consumers. * refactor: import shared types directly from gitnexus-shared at call sites Replace all re-export patterns with direct imports from gitnexus-shared. 72 files updated across CLI and web: - SupportedLanguages: 49 CLI files now import from 'gitnexus-shared' instead of '../config/supported-languages.js' - GraphNode, GraphRelationship, NodeLabel: 22 CLI + 10 web files now import from 'gitnexus-shared' instead of local re-export wrappers - NODE_TABLES: api.ts imports from 'gitnexus-shared' - PipelineProgress: useAppState.tsx imports from 'gitnexus-shared' Local types.ts files now only define platform-specific KnowledgeGraph (CLI has mutation methods, web has add-only). No more re-exports. * fix: update lock files for gitnexus-shared, remove stale vite polyfills Add gitnexus-shared@1.0.0 to lock files so npm ci succeeds in CI. Remove buffer polyfill and global define from vite.config.ts (isomorphic-git was removed). * fix(security): add write guard to HTTP /api/query, fix CORS proxy bypass - Add isWriteQuery() check to POST /api/query handler — blocks CREATE, DELETE, SET, MERGE, DROP, etc. via HTTP API (guard was only in MCP pool adapter and browser-side, not the HTTP server path) - Extend CYPHER_WRITE_RE with CALL, INSTALL, LOAD keywords - Fix CORS proxy subdomain bypass: endsWith('github.com') allowed 'evil-github.com'. Now requires exact match or '.github.com' suffix * feat(server): enhance /api/search with enrichment, add /api/grep, strip graph content - POST /api/search: add mode param (hybrid|semantic|bm25), server-side enrichment returns connections/cluster/processes per result in one call (collapses 31 sequential HTTP calls to 1 for the agent search tool) - GET /api/grep: regex search across indexed file contents, eliminates need to transfer all file contents to browser - GET /api/graph: strip content field by default (80-95% payload reduction). Use ?includeContent=true for backward compat - Add LRU cache invalidation hook point for future caching * feat(server): add /api/embed endpoint for server-side embedding generation - POST /api/embed: triggers embedding pipeline via onnxruntime-node with JobManager for single-slot concurrency, timeout, and dedup - GET /api/embed/:jobId: poll job status - GET /api/embed/:jobId/progress: SSE stream with heartbeat, event IDs, and X-Accel-Buffering:no header for proxy compatibility - DELETE /api/embed/:jobId: cancel running embedding job - Maps embedding pipeline phases (ready→complete, error→failed) to JobManager status conventions * feat(web): create consolidated BackendClient module Single HTTP client replacing backend.ts, server-connection.ts, and worker HTTP helpers. Includes: - Typed methods: runQuery, search (enriched), grep, readFile, connect - Generic streamSSE<T> utility extracted from analyze progress pattern - BackendError with discriminated code field (network/server/client/timeout) - Embed API: startEmbeddings, streamEmbeddingProgress, cancelEmbeddings - Search with mode param (hybrid|semantic|bm25) and enrichment * refactor(web): rewrite Graph RAG tools for backend-only HTTP queries - Search tool: uses enriched /api/search (1 call replaces 31 sequential queries) - Cypher tool: removes browser-side embedding; {{QUERY_VECTOR}} routes to /api/search with mode:'semantic' instead of local transformers.js - Grep tool: uses /api/grep instead of in-memory fileContents map - Read tool: uses /api/file instead of fileContents map lookup - Impact tool: getCallSiteSnippet now async via /api/file - createGraphRAGTools now accepts GraphRAGBackend interface instead of 7 separate function params + fileContents map - createGraphRAGAgent simplified to (config, backend, context?) - Removed imports: embedder, lbug/schema (replaced with gitnexus-shared) - Net: -205 lines * refactor(web): delete WASM infrastructure, remove 7 packages (-5242 lines) Delete browser-side LadybugDB, embeddings, search, and worker: - gitnexus-web/src/core/lbug/ (adapter, csv-generator, schema, query-result) - gitnexus-web/src/core/embeddings/ (embedder, pipeline, text-gen, types) - gitnexus-web/src/core/search/ (bm25-index, hybrid-search) - gitnexus-web/src/workers/ingestion.worker.ts (828 lines) - gitnexus-web/src/services/server-connection.ts (merged into backend-client) - gitnexus-web/src/types/lbug-wasm.d.ts Remove packages: @ladybugdb/wasm-core, @huggingface/transformers, comlink, minisearch, vite-plugin-wasm, vite-plugin-top-level-await, vite-plugin-static-copy Update vite.config.ts: remove WASM plugins, COOP/COEP headers, worker config, optimizeDeps exclude Update imports: App.tsx, DropZone, Header, AnalyzeProgress, BackendRepoSelector, useBackend → backend-client * refactor(web): replace Worker/Comlink with direct BackendClient calls - useAppState: remove Worker instantiation, Comlink.wrap, apiRef. All queries now go through BackendClient HTTP functions directly. - Agent runs on main thread (I/O-bound LLM streaming, not CPU-bound) - initializeAgent: creates GraphRAGAgent with GraphRAGBackend interface bound to BackendClient methods (runQuery, search, grep, readFile) - startEmbeddings: calls POST /api/embed + SSE progress instead of running browser-side transformers.js pipeline - switchRepo: no longer loads graph into WASM DB or extracts fileContents - App.tsx: handleServerConnect simplified (no fileContents, no loadServerGraph) - Delete old backend.ts (replaced by backend-client.ts) - Net: -396 lines * fix(web): fix await-in-map build error in agent streaming Move dynamic import of AIMessage outside .map() callback to avoid "await can only be used inside an async function" build error. * fix(web): remove stale apiRef references that broke chat functionality sendChatMessage referenced apiRef.current (deleted Worker ref) which would throw TypeError. Replaced with agentRef.current guard since agent now runs on main thread. * fix(server): dispose embedJobManager on shutdown, fix job mutation - Add embedJobManager.dispose() to shutdown handler (was missing, causing cleanup timer to keep Node process alive) - Replace direct job.repoName/status mutation with updateJob() to ensure SSE event emission for initial status change * fix(server): parameterize Cypher, harden grep, unify SSE endpoints - Search enrichment: replace string interpolation with executePrepared() using $nid parameter binding to prevent Cypher injection - Add executePrepared() to core lbug-adapter (prepare/execute pattern) - /api/grep: add 200-char pattern length limit (ReDoS protection), search files on disk instead of loading entire corpus into memory (constant memory usage regardless of repo size) - Extract mountSSEProgress() shared helper for SSE streaming — both analyze and embed endpoints now have consistent heartbeat (30s), event IDs (reconnection support), and X-Accel-Buffering header * refactor(web): remove dead code from Worker-era architecture - Remove loadServerGraph no-op function, interface member, and all consumers - Remove testArrayParams stub and interface member - Remove fileContents state from GraphStateProvider (never populated in server-side architecture) - Remove forceDevice parameter from startEmbeddings (server-side, no device choice) - Replace phantom EmbeddingProgress type with inline { phase, percent } - Replace resolvePathFromContents (needed fileContents Map) with graph-based file path resolution using filePathIndex built from graph nodes - Fix: AI citation grounding ([[file.ts:10]]) now works via graph node lookup instead of broken fileContents-based resolution * fix(web): use streamAgentResponse for full tool_call/reasoning streaming Replace naive agent.stream() loop that only handled content chunks with streamAgentResponse() generator from agent.ts. This properly routes: - reasoning tokens (before/between tool calls) - tool_call events (name, args, status) - tool_result events (completed tool output) - content tokens (final answer after all tools done) Previously the onChunk handler for tool_call/tool_result/reasoning was dead code since the streaming loop only emitted content events. * fix(web): resolve CI type errors from dead code removal - Import GraphNode/GraphRelationship from gitnexus-shared in graph.ts (not re-exported from local types.ts) - Add Route, Tool entries to NODE_COLORS and NODE_SIZES constants - Add PipelineResult type to web types/pipeline.ts - Remove fileContents from CodeReferencesPanel and RightPanel - Remove testArrayParams and forceDevice from EmbeddingStatus - Remove forceDevice args from startEmbeddings() calls in App.tsx - Fix embeddingProgress property accesses for simplified type * fix(ci): add setup-gitnexus-web action, build shared once per job - Remove prepare script from gitnexus-shared (tsc not available during npm ci of consuming packages) - Create .github/actions/setup-gitnexus-web composite action: builds gitnexus-shared then runs npm ci for gitnexus-web - setup-gitnexus action: already builds gitnexus-shared for CLI jobs - ci-quality typecheck-web: uses setup-gitnexus-web (DRY) - ci-e2e: uses setup-gitnexus-web (DRY) - ci-tests: gitnexus-shared already built by setup-gitnexus, just install web deps without rebuilding * fix(ci): use prepare script so gitnexus-shared builds during npm ci Move typescript from devDependencies to dependencies in gitnexus-shared so the prepare script (tsc) works when npm resolves file: deps during npm ci. No GHA modifications needed — npm handles the build lifecycle automatically. Remove manual gitnexus-shared build steps from setup-gitnexus and setup-gitnexus-web actions. * fix(ci): build gitnexus-shared explicitly in setup actions The file: dependency protocol doesn't reliably run prepare scripts because devDependencies aren't installed first. Instead of fragile lifecycle hacks, build gitnexus-shared explicitly in both setup actions: - setup-gitnexus: npm install && npm run build in gitnexus-shared/ - setup-gitnexus-web: same, before npm ci in gitnexus-web/ - ci-tests: shared already built by setup-gitnexus, web just npm ci No prepare script, no dist in git, no typescript as a prod dependency. * fix: remove CALL from CYPHER_WRITE_RE — breaks FTS and vector search CALL is used by read-only procedures: CALL QUERY_FTS_INDEX(...) and CALL QUERY_VECTOR_INDEX(...). Adding it to the write guard blocked all FTS search, causing 3 test failures. The database is opened in read-only mode as defense-in-depth against write procedures via CALL. Keep INSTALL and LOAD in the blocklist (genuinely dangerous). * fix(web): update vercel.json for gitnexus-shared, remove COOP/COEP - Add installCommand that builds gitnexus-shared before installing web deps (Vercel doesn't know about the monorepo file: dependency) - Remove Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers (no longer needed — WASM LadybugDB removed) * fix(web): update tests for deleted modules - Delete csv-generator.test.ts (tests deleted WASM-only csv-generator) - Update security-guards.test.ts: import NODE_TABLES/REL_TYPES from gitnexus-shared instead of deleted src/core/lbug/schema - Update server-connection.test.ts: import normalizeServerUrl from backend-client, remove extractFileContents tests (function deleted) * fix(e2e): remove Server tab click — UI is now server-only The DropZone no longer has ZIP/GitHub/Server tabs (browser ingestion was removed). The server URL input is directly visible on the landing page. Update e2e test to skip the tab click and go straight to input. All 5 e2e tests pass locally. * refactor: use gitnexus-shared for PipelinePhase/PipelineProgress types CLI was duplicating PipelinePhase and PipelineProgress locally instead of importing from gitnexus-shared. Updated all consumers to import directly. Also removed dead code: SerializablePipelineResult, serializePipelineResult(), deserializePipelineResult(). * fix(server): address PR #536 review — security, race conditions, dead code - Fix path traversal in POST /api/analyze: split into isAbsolute + normalize check - Add shared repo lock (activeRepoPaths) preventing concurrent analyze+embed on same repo - Fix 202 response returning actual job.status instead of hardcoded 'queued' - Add 30-minute timeout for embedding jobs (was missing unlike analyze jobs) - Fix DropZone calling startAnalyze without setting backend URL first - Add SSE reconnect with exponential backoff (3 retries) and Last-Event-ID - Fix normalizeServerUrl to return base URL (no /api suffix) — clear contract - Delete dead code: proxy.ts, server-graph-hydration.ts, pipeline.ts re-export barrel - Update LoadingOverlay to import PipelineProgress directly from gitnexus-shared * fix(server): fix repo lock key mismatch and embed cancel race - Use getStoragePath(targetPath) as lock key in analyze handler to match embed handler's entry.storagePath — keys now always align - Guard embed completion: don't overwrite 'failed' with 'complete' when job was cancelled while pipeline was still running - Remove unused jobType parameter from acquireRepoLock - Log backend.init() errors instead of silently swallowing * fix: add gitnexus-shared as a local dependency in package-lock.json * refactor: move language detection to gitnexus-shared, add syntax highlighting for all 15 languages Move getLanguageFromFilename() from CLI to gitnexus-shared with COBOL support added. Add getSyntaxLanguageFromFilename() for Prism-compatible syntax highlighting covering all 15 code languages plus auxiliary formats (json, yaml, markdown, html, css, bash, sql, xml). Refactor CodeReferencesPanel to use shared function instead of a local 30-line switch. Delete dead gitnexus-web/src/config/supported-languages.ts (web already imports SupportedLanguages from gitnexus-shared). * feat(web): add first-time user onboarding with auto server detection Replace the manual "Connect to Server" panel with an automatic onboarding flow that guides first-time users through starting the GitNexus server. Server detection: - useBackend hook polls via setTimeout chain (3s, no overlap) - Page Visibility API pauses polling when tab is hidden - SSE heartbeat (/api/heartbeat) for instant disconnect detection Onboarding UI (OnboardingGuide.tsx): - Step-by-step flow: copy command → run → auto-connect - Smart command: shows `gitnexus serve` in dev, `npx gitnexus@latest serve` in prod - Node.js version auto-detected from package.json via Vite define - Faux terminal windows with copy-to-clipboard, platform tabs, polling indicator Transitions (DropZone.tsx): - Crossfade wrapper with snapshot pattern for smooth phase transitions - Three phases: onboarding → success (1.2s hold) → loading → graph - Auto-recovery: falls back to onboarding if server dies or connect fails Server changes: - GET /api/heartbeat: SSE endpoint for liveness detection - GET /api/info: version, launch context, Node.js version - npm run serve script for local development - app.disable('x-powered-by') hardening * feat(web): add repo analysis UI, SSE heartbeat, and review fixes Repo analysis: - AnalyzeOnboarding: empty-state card when server has zero repos - RepoAnalyzer: GitHub URL + Local Folder tabs with browse button - Header repo dropdown: click project badge to switch repos or analyze new - DropZone 'analyze' phase integrated into Crossfade transitions Reliability fixes from 5-agent review: - Polling: stop scheduling timers when tab hidden, restart on visibility return - Heartbeat: exponential backoff (1s/2s/4s, 3 retries) prevents graph loss on blip - RepoAnalyzer: completion timer tracked in ref, cleaned up on unmount - DropZone: standardized card padding (p-7), heading sizes (text-lg) Accessibility: - prefers-reduced-motion global CSS rule (WCAG 2.3.3) - focus-visible rings on CopyButton - cursor-pointer on all Header buttons - Consistent rounded-xl on all dropdowns Cleanup: - Deleted dead AnalyzeSheet.tsx (219 LOC) and BackendRepoSelector.tsx (89 LOC) - Fixed AnalyzeProgress lucide import (lucide-react → @/lib/lucide-icons) * fix(server): resolve analyze worker fork crash in dev mode The forked analyze worker was crashing immediately with exit code 1 when running via `npm run serve` (tsx). Two issues: 1. Worker path resolved to `analyze-worker.js` but only `.ts` exists in the source directory — the `.js` file is only in `dist/`. 2. On Windows, bare `--import tsx` in execArgv fails because Node's ESM resolver for --import uses the child's CWD, not the parent's node_modules. Windows also rejects raw paths as `d:` is not a valid URL scheme. Fix: detect dev vs prod via `import.meta.url` extension. In dev mode, resolve `tsx/esm` to an absolute `file://` URL via `pathToFileURL()` anchored to the parent's `createRequire` context. This works on all platforms and doesn't depend on the child's CWD or PATH. Also captures child stderr for better crash diagnostics. Verified: `POST /api/analyze` with GitHub URL completes successfully in dev mode (tsx) — status goes from cloning → analyzing → complete. * fix(server): add worker auto-retry, error handling, and crash diagnostics Worker resilience: - Auto-retry up to 2 times with exponential backoff (1s, 2s) on crash - SSE progress shows "Retrying after crash (1/2)..." during retry - Captures child stderr for crash diagnostics in failure message - AnalyzeJob tracks retryCount per job Server error handling: - app.listen wrapped in Promise so EADDRINUSE/EACCES propagate cleanly - serve.ts catches startup errors with friendly messages and exit code 1 - EADDRINUSE gets actionable guidance (stop other process or --port flag) - Global uncaughtException/unhandledRejection handlers prevent silent exits - DEBUG=1 env var shows full stack traces * feat: add e2e tests for onboarding flows, worker retry, and error handling E2E tests (onboarding.spec.ts — 11 tests): - Flow 1: OnboardingGuide shown when server unreachable (6 tests) - Flow 2: Auto-connect with success card, analyze phase for zero repos - Flow 3: Analyze form — GitHub URL validation, Local Folder tab, tab switching - Flow 4: Repo dropdown in exploring view (skipped without live server) Updated server-connect.spec.ts: - Replaced manual Connect button flow with auto-connect waitForGraphLoaded Server resilience: - Worker auto-retry (2 attempts with exponential backoff) on crash - Friendly error messages for serve startup failures (EADDRINUSE etc.) - Global uncaughtException/unhandledRejection handlers prevent silent exits - app.listen wrapped in Promise for proper error propagation * refactor(shared): enforce exhaustive language coverage via Record types Replace the if/else chain in getLanguageFromFilename with two exhaustive Record<SupportedLanguages, ...> maps: - EXTENSION_MAP: every language → its file extensions - SYNTAX_MAP: every language → its Prism syntax identifier Adding a new member to the SupportedLanguages enum without adding it to both maps now produces a TypeScript compile error: Property '[SupportedLanguages.NewLang]' is missing in type... This matches the existing pattern in languages/index.ts (providers table) which already uses `satisfies Record<SupportedLanguages, LanguageProvider>`. Three compile-time enforcement points now exist: 1. EXTENSION_MAP in language-detection.ts (file extensions) 2. SYNTAX_MAP in language-detection.ts (Prism syntax identifiers) 3. providers in languages/index.ts (LanguageProvider instances) * feat(web): load source code from server and scroll to selected line CodeReferencesPanel now fetches file content via GET /api/file when a node is selected, instead of showing "Code not available in memory". - Fetches via readFile() from backend-client when selectedFilePath changes - Shows loading spinner while fetching - After content loads, auto-scrolls to the selected node's startLine - Highlights the selected line range with a cyan left border - Cancels in-flight fetch if selection changes before it completes Also: refactored language-detection.ts to use exhaustive Record types (EXTENSION_MAP and SYNTAX_MAP) so adding a new SupportedLanguages enum member without implementing extensions/syntax is a compile error. * feat: buffered file reading for Code Inspector Server: GET /api/file now supports ?startLine=N&endLine=M for reading a line range instead of the entire file. Returns { content, startLine, endLine, totalLines }. Client: readFile() returns ReadFileResult with metadata. When selecting a symbol (function, class, method), fetches only ±50 lines around the symbol's startLine/endLine instead of the full file. File nodes still fetch the entire file. SyntaxHighlighter startingLineNumber set from the buffer offset so line numbers are correct even for partial reads. * fix: adapt readFile callers to new ReadFileResult return type tools.ts: readFile comes from GraphRAGBackend interface which returns Promise<string> (the adapter in useAppState extracts .content), so revert the { content } destructuring back to plain string assignment. useAppState.tsx: wrap backendReadFile with { repo } options object and extract .content to satisfy the GraphRAGBackend interface. * fix(web): ensure new repos appear in list immediately after analysis Two fixes: 1. DropZone: handleAnalyzeComplete now passes the repoName through to connectToServer so the specific newly-analyzed repo loads — not the server's default first repo. 2. App.tsx: fetchRepos() is now awaited BEFORE handleServerConnect in both the DropZone and Header flows. This ensures the repo list is populated before the exploring view renders, so the new repo appears in the header dropdown immediately without a page reload. * feat: delete repos, re-analyze with force, select after analysis Server — DELETE /api/repo: - Acquires repo lock first (409 if analyze/embed in flight) - Closes LadybugDB, deletes index + clone dir, unregisters, re-inits - Lock released in finally block Server — analyze complete: - backend.init() must succeed before SSE complete fires - If backend.init() fails, job is marked failed (not complete) Web — Header repo dropdown: - Re-analyze: calls POST /api/analyze with force=true, shows spinning icon + inline progress bar via SSE - Delete: acquires lock, aborts any running re-analysis SSE for same repo, refreshes list, switches to next repo - After analysis completes: refreshes repo list, connects to the specific repo by name, loads graph, shows in explorer - Retry with 1.5s backoff on 404 (server may still be reinitializing) Type safety: - err: any → err: unknown + instanceof BackendError in retry loop - Added missing BackendRepo + BackendError imports in App.tsx	2026-03-28 14:07:11 +00:00