1031 commits

Author	SHA1	Message	Date
Navid EMAD	506432017f	fix(zig): model callable-value references, and stop reporting their absence as exact (#3219) ... * fix(impact): stop reporting 'exact' over unmodelled callable-value references A function named in VALUE position — `bridge.accessor(Element.getNamespaceUri, null, .{})`, `{ onClick: handler }`, a comparator handed to a sort — is registered somewhere rather than called. The registration is modelled (a `value-ref` site becomes a USES edge; Kythe `ref` vs `ref/call`, Joern METHOD_REF), but the invocation THROUGH the stored value is not: it happens later via a struct field, a registry lookup or comptime reflection. impact()/context() nonetheless reported such a target as `epistemic: 'exact'`. For lightpanda-io/browser that meant the DOM `Element.namespaceURI` accessor came back with two internal callers, LOW risk and a claim of completeness — worse than no answer, because 'exact' tells the reader not to look further. tools.ts defines 'lower-bound' as "the walk provably missed callers", which is precisely this case. computeEpistemicBoundary now probes for inbound USES edges stamped with the value-ref reason and hedges when it finds any, contributing a boundary note and a new `causes.callableValueReferences` (unit: distinct referrer symbols). Read from the graph, not from index metadata: unlike a dropped receiver — which leaves no edge to find and therefore needs a persisted summary — a value reference IS in the graph. So the signal needs no re-index and no analyzer change, and it works on indexes written before this commit. The cause gets its own slot rather than joining `dispatchBoundary`: a value referrer is neither an implementation nor an interface-level consumer, and the two differ in what the reader should do about them — a dispatch boundary is irreducible, a callable value usually becomes traceable once the provider models the store/load that carries it. Language-neutral: every provider that emits a `value-ref` capture participates. The writer and the reader now share VALUE_REF_EDGE_REASON, because drift between them would fail silently — the probe would match nothing and every answer would go back to claiming certainty. * fix(zig): emit `value-ref` for a callable named in value position `mapReferenceKindToEdgeType` has handled the registration-vs-invocation case since #2437, and TypeScript, JavaScript and C++ all emit `value-ref`. Zig emitted zero — so a Zig function handed somewhere as a VALUE was absent from the graph entirely. That is not a corner: Zig's JS bridge is built out of this one shape, pub const namespaceURI = bridge.accessor(Element.getNamespaceUri, null, .{}); and `bridge.{accessor,function,indexed,…}` appears 2,047 times across 257 files in lightpanda-io/browser — the project's whole JS<->Zig surface, none of it reaching the graph. `impact` on `Element.getNamespaceUri`, which IS the DOM `Element.namespaceURI` accessor, answered with its two in-file callers. Three query rules, tagging `@reference.value-ref` on: a bare identifier in argument position (`bridge.accessor(_tagName, …)`), a qualified one (`bridge.accessor(Element.getNamespaceUri, …)`), and a const binding initialiser (`pub const defaultHandler = onReset;`). Everything downstream already existed — no new edge type, no schema change, no capture-machinery change, no baseline edited. One grammar detail is load-bearing: in tree-sitter-zig, call arguments are DIRECT children of `call_expression` — there is no `arguments` node, only builtins have one — so the callee has to be consumed explicitly by `function:`. Without that binding the same rule also matches the callee of `foo(bar)` and mints a USES edge shadowing the call's own CALLS edge. There is a test for it. The rules are deliberately broad — `js.Bridge(Element)` and `register(count)` match too — because the callable gate in the property-dispatch pass (Function/Method/Constructor only) is the filter, the same design that keeps TypeScript's `{ port: DEFAULT_PORT }` from registering anything. Measured on the real corpus: all 3,169 emitted edges land on a Method (3,146) or Function (23). Deliberately NOT modelled: the terminal invoke. The value reaches `Accessor.init` -> a struct field -> `Factory.zig` reflection (`inline for`, `@typeInfo`) -> `Caller.zig`'s `@call(.auto, func, args)` over `func: anytype`. Resolving that needs comptime evaluation. The point is to stop dropping the reference; the shortfall is now reported as `epistemic: "lower-bound"` by the preceding commit instead of being papered over. Measured on lightpanda-io/browser (698 .zig files), wiped index both times: 30,222 nodes / 71,070 edges -> 30,222 nodes / 74,229 edges. The delta is entirely `USES` (3,169 after vs 10 before, and every one is a value-ref); CALLS, ACCESSES, IMPORTS, HAS_METHOD, DEFINES and the rest are unchanged — purely additive, no node invented. The fixture joins the existing `zig-idioms` corpus rather than adding a new one, because `bench/receiver-resolution` uses `test/fixtures/lang-resolution` as its `--check` corpus. That gate, `scope-capture` (15 languages), `zig-cross-file-resolution` and every other bench `--check` pass unchanged. * fix(review): resolve qualified value references through their owner, and stop hedging on registrations the analyzer already followed Five findings from the review bot on #3219; four valid, all addressed. 1. QUALIFIED VALUE REFERENCES RESOLVED BY TAIL NAME (the serious one). `bridge.accessor(Element.getNamespaceUri, …)` was resolved with `findCallableBindingInScope(site.inScope, site.name, …)`, which never sees the receiver and gives LOCAL bindings precedence. Reproduced: const Element = @This(); pub fn getThing(...) // main.getThing pub const JsApi = struct { fn getThing(...) // JsApi.getThing pub const thing = bridge.accessor(Element.getThing, null, .{}); }; emitted `USES JsApi → JsApi.getThing` — a WRONG edge, which is worse than the missing edge this PR set out to fix. `resolveValueRefTarget` now resolves a site carrying an explicit receiver through `findClassBindingInScope` → `findOwnedMember` (the machinery `receiver-bound-calls` already uses), gated on `CALL_TARGET_TYPES` because `findOwnedMember` also answers with fields. A bare site keeps the lexical walk, which is what an unqualified name means. When the owner cannot be resolved the site is DECLINED rather than falling back: declining costs a reference, falling back mints a confident edge to the wrong function, and the missing reference is now reported as `lower-bound` anyway. Cost on lightpanda-io/browser: value-ref edges 3,169 → 2,799 (−12%). Those 370 were tail-name coincidences, not registrations — all 94 `Element.zig` `JsApi` entries survive, the cross-container case resolves and is correctly attributed (`IntersectionObserverEntry.JsApi` → `IntersectionObserverEntry. getTarget#0`, not the enclosing observer), and both acceptance probes are unchanged: `getNamespaceUri` 7/3/LOW/lower-bound, `getTagNameLower` 31/10/HIGH/exact. 2. A FAILED PROBE READ AS "NO BOUNDARY". `.catch(() => [])` turned an unanswerable query into count 0 and no note, so `exact` could be published on the strength of a question that was never asked. It now returns `null` and emits a boundary note. This file's own `loadMeta` comment states the rule: a probe failing must never read as certainty. 3. NOT EVERY VALUE REFERENCE IS AN UNMODELLED INVOCATION. Where `emitPropertyDispatchCalls` sweep 2 synthesized the dispatch (reason `property-dispatch`), the walk did NOT provably miss the caller, so hedging was noise over an answer that was computed — and a signal that fires on every JS/TS hook table stops carrying information. A second probe excludes those targets. Zig never sets a property key, so the motivating case is untouched. The exclusion is symbol-level, not per-edge, because the graph does not record which registration produced which synthesized call; that residual is documented at the call site. 4. `LIMIT 50` SILENTLY UNDERSTATED THE COUNT. `rows.length` over a capped row set published a ceiling as the documented symbol count. Replaced with `COUNT(DISTINCT other.id)` — bounded work without a bounded answer, the shape `countByType` in the same file already uses. 5. THE TEST DID NOT PIN THE CALLER COUNT its own comment promised. Added `expect(result.impactedCount).toBe(2)`. New regression tests: qualified references bind the written owner and not the nearer lexical match; an unresolvable receiver emits nothing rather than a wrong edge; a dispatch-modelled registration stays `exact`; a probe that cannot run hedges instead of claiming certainty. Known limitation, pinned by a test rather than left implicit: when a `@This()` alias's NAME differs from its container's (`const Element = @This();` inside `main.zig`), the receiver does not resolve and the reference is declined. The provider has `rewriteZigThisAlias` for this, but it is applied to type nodes and extending it to reference receivers would change existing CALL-site behaviour. Lightpanda's `const Foo = @This();` in `Foo.zig` convention makes the names coincide, which is why the corpus is unaffected. * fix(review): bump the parse-cache schema and resolve module-owned value references Review round 2 on #3219. Four inline items, all reproduced against the worktree before deciding. P1 — the new captures could stay INERT on a warm parse cache. Adding `@reference.value-ref` rules to `ZIG_SCOPE_QUERY` changes `ParsedFile.referenceSites`, which is a PARSE-TIME fact, but `SCHEMA_BUMP` stayed at 93. A repo indexed before this branch and re-analyzed after it replays the old, empty site list for every unchanged `.zig` file — `--force` included, since shards are content-addressed — so no USES edge is emitted, the boundary probe measures a real zero, and `impact` on a registered accessor goes back to `epistemic: "exact"`. #3399 un-fixed on the incremental path most users are on, with every cold-run test still green. DECISIONS D1-1's "zero changes to … the schema" conflated the graph schema with the cache schema. Bumped 93 -> 98, not 94: #3190 claims 94 and #3179 claims 94 through 97 in one PR. `incremental-parse-cache.test.ts` re-pinned, with 93-97 added to the taken list. Re-check against origin/main and open PRs immediately before merging. P2 — a qualified value reference through a MODULE was declined with no hedge. R1-2 resolves a written receiver with `findClassBindingInScope`, which requires `isClassLike`; a namespace-only `@import` handle is not class-like, so const dom_utils = @import("dom_utils.zig"); // no `@This()` in that file pub const comparator = bridge.accessor(dom_utils.compare, null, .{}); resolved to nothing. That is not the conservative half of R1-2's trade-off: a declined site emits NO edge, so there is nothing for the probe to read and `impact` on `compare` reports `exact`. Silence, not a hedge — and the pass comment claiming otherwise was wrong on this path. `resolveValueRefTarget` now tries the second kind of owner a qualified name can have. `findNamespaceValueRefTarget` reads the file's `namespace` import edges for the handle and the target module's own `origin: 'local'` module-scope bindings for the member — the same channel `receiver-bound-calls` Case 1 already trusts for `dom_utils.compare()`, with Case 1's three guards for Case 1's reasons: `isNamespaceNameShadowed`, local-origin bindings only, and two distinct defs under one name resolve nothing. `CALL_TARGET_TYPES` gates module owners exactly as it gates container owners. Language-neutral: it reads generic namespace import edges, names no language. Still declined, deliberately: a receiver this index knows under no name at all (the `@This()`-alias case, owners outside the workspace). There the alternative is a confident edge to a lexically-nearer function the source did not name. P2 — `impact-callable-value-references.test.ts` was in neither vitest list. It opens a real engine via `withTestLbugDB(poolAdapter: true)`, so TESTING.md puts it in the `lbug-db` include list and the `default` exclude list; it was in neither, so `default` also collected it into the parallel pool. Added next to its `impact-epistemic-lower-bound` sibling in both arrays. P3 — DECISIONS.md was stale against HEAD and embedded host paths. D2-3 still described the `LIMIT 50` that R1-5 removed and D1-3 still described the receiver-blind resolution that R1-2 replaced; both now carry explicit "superseded by" pointers. The `~/code/...` and mise-node paths are replaced with placeholders. Two smaller corrections the new cause made necessary: - `formatImpactResult`'s `lower-bound` header hard-coded "callers binding via DI / dynamic dispatch", which now contradicts the value-reference bullet printed directly under it. The bullets carry the cause; the header only states that the count is a floor. - `tools.ts` said a `causes.callableValueReferences` of 0 means "nothing was missed". The dispatch exclusion is symbol-level, not edge-level, so a target with both a followed registration and an unfollowed escape also reads 0. The docs now say a 0 means "no unfollowed registration was proven". Fixture: `src/webapi/dom_utils.zig` (namespace-only) plus three cases in `Element.zig` — the module-qualified registration, a non-callable module member, and a `u8` parameter shadowing the handle. The shadow case was verified to FAIL with the guard disabled, so it is not passing for an unrelated reason. Gates: `tsc --noEmit` clean, `npm run build` clean, prettier clean. `resolvers/` 3,630 passed / 3 skipped; `unit/scope-resolution` 2,010 passed; `impact-callable-value-references` 7 passed under `lbug-db`; `incremental-parse-cache` 40 passed; eval formatters 104 passed. Bench --check all PASS with no baseline edited: receiver-resolution, zig-cross-file-resolution, scope-emission, callable-value-flow, scope-capture (15 languages), python-scope. * fix(review): guard the class receiver against a shadowing binding, and pin the dispatchability partition Review round 3 (`gitnexus-check` bot on `cf53bbaa`). Three findings, each reproduced against the code before deciding. R3-1 (Error, valid, REPRODUCED) — a CLASS receiver could resolve through a shadowing value binding. `findClassBindingInScope` is a class-only walk: it filters the scope chain by `isClassLike`, so it steps over a nearer binding that is a value and keeps climbing — and past the chain entirely, into a qualified-name fallback that answers with the unique workspace definition of the name. A `u8` parameter named `Ticker`, in a file that neither declares nor imports the `Ticker` container another file defines, therefore emitted `register(Ticker.fire)` as a confident USES edge to that container's method. That is exactly the wrong-edge failure R1-2 exists to prevent, arriving through the class channel instead of the lexical one. Fixed with `isOwnerNameShadowedBySomethingElse` — a sibling of `isNamespaceNameShadowed` with one extra clause. The plain namespace guard could NOT be reused: a container is often its own local declaration (`fn make() { const Local = struct {…}; register(Local.go); }`), and reading that binding as its own shadow suppresses precisely the resolutions this path exists to make — the #2723 mistake, one channel over. So a scope that binds the name answers immediately, and the answer is "not shadowed" only when one of that scope's own bindings IS the def just resolved. Both halves are pinned and both were verified to fail when the guard is weakened: the parameter case fails with no guard at all, the local-container case fails with the plain `isNamespaceNameShadowed`. R3-2 (Warning; mechanism correct, unreachable today; fragility fixed instead) — the dispatch exclusion could suppress an unfollowed registration. The bot is right about the code: sweep 2 synthesizes CALLS only for a registration whose site carried a `propertyKey`, while the exclusion zeroes the note on ANY inbound `property-dispatch` CALLS edge. It is not reachable in the current rule set, and the reason is measured rather than assumed: `@reference.value-ref` is emitted by exactly three languages — JavaScript (2 rules), TypeScript (2), Zig (3) — every JS/TS rule also captures `@reference.property-key` (both are object-literal shapes) and no Zig rule does. A dispatchable registration is therefore always a JS/TS one, an undispatchable one always a Zig one, and they cannot meet on one symbol. Rejected: splitting the edge `reason` into dispatchable / undispatchable. It is the precise fix, but it is a graph-content change that churns whichever side keeps the old literal — the Zig, TypeScript and probe suites all pin 'scope-resolution: value-ref' by hand as a drift canary — and it buys nothing against a case no rule can produce. What was actually wrong is that the exclusion's soundness rested on a coincidence recorded nowhere, in files nobody reading `local-backend.ts` would open. Fixed at both ends: the exclusion site now states the invariant, the three facts it rests on and the two options for when it breaks; and `value-ref-dispatchability.test.ts` fails the day it does — a JS/TS rule for a bare callback argument, a Zig rule that grows a key, or a fourth language emitting `value-ref` at all. Verified to fire (adding a property key to a Zig value-ref rule fails the Zig case), and its rule splitter has its own guard test so the suite cannot pass vacuously. `ZIG_SCOPE_QUERY` is exported for that test only. R3-3 (Nit, valid) — a test comment claimed the wrong epistemic result. The `declines a qualified reference whose receiver cannot be resolved` case said the shortfall shows up as `lower-bound`. It does not: with no edge there is no evidence and the target stays `exact`. The pass docstring was corrected in round 2 and this comment was missed. It now says the decline costs the reference AND the hedge, and why that is still the right trade. Gates: tsc --noEmit clean, npm run build clean, prettier clean. `test/integration/resolvers` 3,632 passed / 3 skipped (70 files); `test/unit/scope-resolution` 2,015 passed (120 files); `impact-callable-value-references` 7 passed under `lbug-db`. Bench --check: receiver-resolution, zig-cross-file-resolution, scope-capture (15 languages), scope-emission PASS with no baseline edited; callable-value-flow failed once on its TIMING budget (2.006 > 1.9) with a byte-identical fingerprint, then passed twice at 1.788 / 1.813 — machine load, not a regression. * fix(review): let a file's own `@import` outrank the workspace-wide class fallback Found by running the local preflight harness before pushing rather than after. One of its five findings is a real hole in R2-2; the rest are documentation that overclaimed. R4-1 (valid, REPRODUCED) — the container channel preempted the file's own `@import`. R2-2 added the module channel as a FALLBACK after `findClassBindingInScope`, and that order is wrong: `findClassBindingInScope` does not stop at the scope chain. When its `isClassLike` walk misses — and a namespace handle binds a Module, so it always misses — it falls back to `scopes.qualifiedNames`, a workspace-wide index, and answers with the unique def of that name anywhere in the repo. A container named `dom_utils` in a file `Element.zig` never imports therefore captured `bridge.accessor(dom_utils.compare, …)`, binding `Method:src/webapi/decoy.zig:dom_utils.compare#2` while the module channel that would have answered correctly was never reached. R3-1's shadow guard cannot catch it: the import binds at MODULE scope, which that guard treats as the floor. Fixed by trying the module channel FIRST. An `@import` written in this file is the strongest available statement about what the name means here and outranks a global uniqueness guess; when the handle is not an import of this file the channel answers nothing and the container path runs exactly as before. Pinned by `decoy.zig` and a strengthened assertion on the existing module-owner test, which fails on the old order. R4-2 — the cause documentation named shapes nothing captures. `tools.ts` illustrated `callableValueReferences` with "a callback argument", "a stored function pointer" and `qsort(xs, n, sz, compareItems)`. Only Zig captures a call argument or a const initialiser; JS/TS capture only object-literal property values, and C has no value-ref rule, so the `qsort` example is counted in no language. Both cause blocks now name the captured shapes and say that a bare JS/TS callback argument is not among them, so a 0 does not rule it out. R4-3 — the same block exempted itself from the re-index caveat this PR proves it needs. "Read from the graph, so it needs no index-time metadata" is true of the probe and false of the edges: an index built before a language emitted these captures has none and reports 0 — the warm-cache failure R2-1 bumped SCHEMA_BUMP for. It now says to re-analyze before reading a 0 as measured. R4-4 — the dispatchability canary was narrower than its own promise. Its header claimed it fails on "a fourth language emitting value-ref at all"; it reads `languages/<dir>/query.ts`, so Vue — which owns no query and borrows `emitTsScopeCaptures` / `emitJsScopeCaptures` — emits value-refs while the assertion lists three languages, and a capture synthesized in code is invisible to it. The case now asserts on query OWNERS, which is what it checks and is sound because a delegating language inherits the rules it borrows; the header states the synthesized-capture gap instead of letting a green tick imply it away. R4-5 — the BARE docstring described a lexical walk that is not one. `findCallableBindingInScope` applies the callable predicate WHILE walking, so a nearer parameter or local is stepped over: the defect R3-1 fixed on the container channel, unguarded here, pre-existing since #2437 and reachable in JS/TS. Out of scope for #3399, so behaviour is unchanged and the sentence now says what the walk does rather than implying a guarantee it does not give. Gates: tsc --noEmit clean, npm run build clean, prettier clean. `test/integration/resolvers` 3,632 passed / 3 skipped (70 files); `test/unit/scope-resolution` 2,015 passed (120 files); `impact-callable-value-references` 7 passed under `lbug-db`. Bench --check: receiver-resolution, zig-cross-file-resolution, scope-capture (15 languages), scope-emission, callable-value-flow all PASS with no baseline edited. * fix(review): honour the hub opt-in for value references, so `hub.fn` means one thing Review round 5 (`gitnexus-check` bot on `1c7c05ff`). One finding, valid and reproduced before fixing. `findNamespaceValueRefTarget` accepted only `ref.origin === 'local'`. R2-2 recorded that as deliberate — "the `namespaceExportsIncludeImportedNames` hub opt-in is a provider decision this language-neutral pass does not make" — and that reasoning was wrong twice over. Zig sets the flag (`languages/zig/scope-resolver.ts:41`, measured on ghostty and tigerbeetle before it landed), and the pass does have the provider in scope: `runScopeResolution` takes one and already forwards several of its hooks to other passes. The result was the exact asymmetry R2-2 argued against in its own first paragraph. A Zig hub declares nothing — every name it publishes it imported — so requiring a local declaration declines every member reached through one: // hub.zig pub const scale = @import("dom_utils.zig").scale; // Element.zig const hub = @import("hub.zig"); pub fn callsThroughTheHub(v: u8) u8 { return hub.scale(v); } // resolved pub const scaled = bridge.accessor(hub.scale, null, .{}); // declined One name meaning two different things depending on whether a `(` follows it. Fixed by forwarding `provider.namespaceExportsIncludeImportedNames` into the pass and consulting the published channel when it is set — the same question `receiver-bound-calls` Case 1 asks, through the same `lookupBindingsAt` read `findExportedDefIncludingImportedNames` performs for the CALL form. The pass still names no language; it asks the provider, which is the sanctioned hook. Precedence is unchanged where it mattered: a locally declared member still wins over a republished one, two distinct defs under one name still resolve nothing, and `CALL_TARGET_TYPES` still gates the answer — pinned by `hub.DEFAULT_NS`, a re-exported CONSTANT, which stays unregistered. Languages that do not opt in are unaffected: the parameter defaults to `false`, and passing `false` was verified to fail the new hub test, so it is load-bearing. The fixture republishes a member (`scale`) that nothing else uses, so the hub assertion cannot be satisfied by an edge another case emitted. Gates: tsc --noEmit clean, npm run build clean, prettier clean. `test/integration/resolvers` 3,634 passed / 3 skipped (70 files); `test/unit/scope-resolution` 2,015 passed (120 files); `impact-callable-value-references` 7 passed under `lbug-db`. Bench --check: receiver-resolution, zig-cross-file-resolution, scope-capture (15 languages), scope-emission, callable-value-flow all PASS with no baseline edited. Also recorded in DECISIONS.md: `/autofix` returned "No successful autofix run" because the `PR Autofix` run on `1c7c05ff` failed at `actions/upload-artifact` with a 403 from GitHub's artifact storage, not because of anything in this branch. This push triggers a fresh run. * fix(review): inspect the module scope in the owner-shadow guard, and check the TSX suffix The `gitnexus-check` pass on `bd6e577e` carried three findings of its own, and I answered the later `1c7c05ff` pass without noticing them. Recording that as a process failure too: bot reviews are per-head, and a later pass does not necessarily repeat an earlier one's findings. R6-1 (Error, valid, REPRODUCED) — the shadow guard stopped one rung short. `isOwnerNameShadowedBySomethingElse` returned `false` on reaching the module scope, justified as "a container declared there IS the binding, and the caller already resolved it". That holds when the owner came from the scope chain and fails when it came from the workspace-wide qualified-name fallback: // Gauge.zig — never imported by Element.zig const Gauge = @This(); pub fn read(self: *Gauge) u8 { … } // Element.zig const Gauge = @import("dom_utils.zig").DEFAULT_NS; // NOT a container pub const level = bridge.accessor(Gauge.read, null, .{}); // → Gauge.zig's read `findClassBindingInScope` steps over the module-scope binding because it is not class-like, answers from `scopes.qualifiedNames`, and the guard waved it through. Worth recording: the first fixture attempt did NOT reproduce. A local `const Gauge: u8 = 3;` also claims the workspace qualified name `Gauge`, leaving two candidates, and the fallback refuses to guess between two — so the shape defeated itself. Binding the name by IMPORT claims no qualified name, the fallback stays unique, and it fires. A negative result on the first shape was not evidence the finding was wrong. Fixed by inspecting the module scope as the last rung instead of skipping it. The identity exemption is what makes that safe where `isNamespaceNameShadowed` cannot do it (#2723: a namespace import writes its own name into the module scope and would read as its own shadow) — the binding that IS the owner exempts itself, and only a binding to something else answers `true`. `lookupBindingsAt` is consulted at that scope and only there, because an imported alias lives in the finalized channel rather than in `scope.bindings`. R6-2 — the hub re-export finding, already fixed in `5d8fe9d8`; the same defect restated on the later head. R6-3 (valid, fixed) — the dispatchability canary omitted the TSX suffix. `getTsScopeQuery` analyzes a `.tsx` file with `TYPESCRIPT_SCOPE_QUERY + TSX_JSX_QUERY_SUFFIX`, and the test read only the base, so a `value-ref` rule added to the suffix would be emitted in TSX analysis with the canary green. The suffix is now exported and concatenated into the check; verified load-bearing by adding an unkeyed `jsx_expression` value-ref rule to it, which fails the TypeScript case. Gates: tsc --noEmit clean, npm run build clean, prettier clean. `test/integration/resolvers` 3,635 passed / 3 skipped (70 files); `test/unit/scope-resolution` 2,015 passed (120 files); `impact-callable-value-references` 7 passed under `lbug-db`. Bench --check: receiver-resolution, zig-cross-file-resolution, scope-capture (15 languages), scope-emission, callable-value-flow all PASS with no baseline edited. * perf(bench): gate callable-value reference resolution on linear scaling `resolveValueRefTarget` (#3399) replaced one lexical walk with four channels, and the last of them — a qualified receiver resolved through `findClassBindingInScope` — falls back to `scopes.qualifiedNames`, a WORKSPACE-WIDE index consulted once per site. Keyed that is O(1); scanned it is O(files) per site, and a registration table that costs O(sites) today costs O(sites x files) tomorrow. Nothing in the suite can see that: the fixtures are single-file, and the corpus it actually matters on is lightpanda-io/browser, where `bridge.{accessor,function,…}` appears 2,047 times across 257 files. `bench/value-ref-resolution/measure.mjs` builds two synthetic Zig corpora of identical shape 4x apart in file count, and times ONLY the per-site resolution loop — extraction, `reconcileOwnership` and finalize are setup. `linear_factor` is `(t_large/t_small)/(N_large/N_small)`: measured 1.00-1.09 across runs, with `us_per_site` flat at 1.4-1.5 between the arms. Correctness comes first, because a timing gate alone is satisfied by a fast wrong answer: exact site/resolved/declined counts per arm plus an order-independent sha256 over every (site -> resolved target) pair. The corpus exercises all four channels — CONTAINER, NAMESPACE, HUB and BARE — and carries two DECLINE controls per module (a non-callable namespace member, a non-callable bare argument), so a widened callable gate moves `declined` instead of hiding inside the timing. Verified load-bearing rather than assumed: making the qualified lookup scan a workspace-sized collection leaves the fingerprint IDENTICAL and takes `linear_factor` to 3.752 against a slack of 1.375 — the regression class this exists for is exactly the one no correctness gate can see. Zig is the corpus because it is the only language whose provider sets `namespaceExportsIncludeImportedNames`, so it is the only one that can exercise the hub channel at all; the pass itself names no language. `resolveValueRefTarget` is exported for the bench. Timing `emitPropertyDispatchCalls` instead would fold the signal into edge emission, and re-implementing the channel order in the bench would pin the bench's idea of the function rather than the function. * feat(zig): index every build package in the repo, not only the root one Zig already had workspace setup — `loadZigBuildConfig` has parsed `build.zig.zon` `.path` deps, the root `build.zig`'s named modules and each build module's own `addImport` table since #1432, threaded through `ScopeResolver.loadResolutionConfig` exactly as tsconfig is for TypeScript. What it did not have is the part `tsconfigFor` supplies: per-package scope. `loadZigBuildConfig` reads `<repoRoot>/build.zig{,.zon}` and nothing else, so a repo laying its packages out as `packages/<name>/build.zig` — no root build files at all — got `null`, and EVERY bare `@import("<module>")` in it went unresolved. Cross-file resolution silently degraded to relative imports. Measured on a two-package probe before this change: `config = null`, `@import("core")` from `packages/app/src/main.zig` → `null`. `loadZigWorkspaceIndex` discovers packages the way `findTsconfigFiles` discovers configs — one bounded breadth-first walk that skips the hardcoded ignore set — and `zigPackageFor` is the `tsconfigFor` analogue: the nearest enclosing package governs a file, deepest-first, with no fall-through to an outer package. Fall-through is what makes a vendored dependency's `@import("config")` resolve to the outer repo's `config` module, the same failure `loadTsconfigIndex` documents for a package declaring no `baseUrl`. `resolveZigImportInternal` is UNCHANGED — impact analysis puts it at HIGH risk with 6 dependents, and it does not need to move: it is handed one package's config, and which config it receives is the only difference. Its 48 existing tests pass untouched. A nested package's paths are rebased to repo-relative at load time (`.path = "../core"` → `packages/core`, which the root-relative reading rejects outright as an escape); the ROOT package keeps its raw spelling, which is what `parseZigBuildZon` promises and its tests pin, so a single-package repo is byte-identical. `loadImportConfigs` — which runs unconditionally for every repo, Zig or not — keeps calling the root-only loader, so no non-Zig repo pays for the walk. That is the split TypeScript already has between the cheap `loadTsconfigPaths` and the repo-walking `loadTsconfigIndex`, which `loadResolutionConfig` reaches only during a language pass. The `zig-monorepo` fixture carries the discriminating case rather than only the happy path: `tool` binds the alias `core` to its OWN `src/core.zig`, so a repo-wide flattened module map — the shape a workspace index invites — would point `measure` at `packages/core`, a confident edge into a package `tool` does not depend on. That is worse than the unresolved import this fixes, and only per-package scoping keeps them apart. Tests: 7 unit cases pinning the index (including `loadZigBuildConfig` answering `null` on the same fixture, side by side) and 3 integration cases pinning the EDGES — cross-package CALLS from the module root AND from a non-root file, and `tool` not crossing over. Verified load-bearing: restricting the index to the root package fails all three. Second consumer caught by the integration test and fixed with it: `populateZigWorkspaceStaticGating` reads the same `resolutionConfig`, per file because two files of that pass can belong to different packages. Gates: build clean, `tsc --noEmit` clean, prettier clean, eslint 0 errors. `test/integration/resolvers` 3,768 passed / 4 skipped, `test/unit/scope-resolution` 2,015 passed. Bench `--check` with NO baseline edited: `receiver-resolution` (whose corpus is `test/fixtures/lang-resolution`, where the fixture lands), `zig-cross-file-resolution`, `value-ref-resolution`, `scope-capture` (15 languages), `import-target`, `callable-value-flow`, `scope-emission`. * perf(zig): dequeue the package walk by head index, not `shift()` `findZigPackageDirs` pushes children while it drains the queue, which keeps the array in a mode where `Array.prototype.shift()` memmoves the whole remainder rather than taking V8's left-trimming fast path — so the walk is quadratic in the frontier, bounded only by `ZIG_SCAN_MAX_DIRS` (20,000). Measured at that bound rather than estimated from the move count: 53 ms at fan-out 4 and 81 ms at fan-out 20, against 0.8 ms with a head index — 66-106x, and paid before a single config is read. FIFO order is unchanged, and the package ordering never depended on the walk anyway: `loadZigWorkspaceIndex` sorts by (dir length desc, localeCompare). Memory is unchanged too — the entries were already retained by the pushes; `shift()` only dropped the head. `findTsconfigFiles` and `loadNodeWorkspacePackages` carry the same walk with the same bound and are equally affected. Deliberately NOT fixed here: they are pre-existing, outside this PR's diff, and reach TypeScript/Node import resolution, which nothing in this change set covers. Filed separately. Reported by gitnexus-check on aea0ab06. * chore: drop DECISIONS.md from the branch Review feedback: the working log does not belong in the repository. The reasoning it carried that is still load-bearing lives in the code comments and in the PR description. * perf(bench): gate value-ref resolution on scaling alone, not wall clock A millisecond ceiling measures the runner. This repo has been bitten by that twice already — bench/callable-value-flow's widening_overhead failed at 2.07 and 1.975 against a 1.9 budget on a shared runner while the code was correct, both times on a sub-11ms measurement — so the arm is dropped rather than loosened. `ms_budget` is gone from both arms and from `--check`; `min_ms` and `us_per_site` are still reported, and nothing compares them to anything. The remaining timing gate is the ratio, reshaped after bench/parse-dispatch-rounds/baselines.json: `_what` / `_triage` notes, a `_measured` block recording samples for context, and min-of-15 reps instead of 7 (bench/import-target measured N=5 tripping its own budget about one run in twenty, N=15 holding). Budget 1.6 — 1.40x the measured maximum over 12 runs (0.907 .. 1.146), the ~1.5x headroom its siblings use on ratios. Re-verified rather than re-quoted, and the previous note was wrong: replacing QualifiedNameIndex.get with a full scan moves linear_factor from ~1.0 to 2.07, not the ~3.7 recorded. Only 1 of the 17 value-ref sites per module reaches that workspace-wide fallback. 1.6 sits clear of both ends. The note also records the trap the first attempt fell into: patching gitnexus-shared/src changes nothing, because the bench resolves the built package. * fix(review): settle namespace precedence on the name, before the type gate findNamespaceValueRefTarget's local lookup applied CALL_TARGET_TYPES while selecting, so a target module declaring a NON-callable under the name answered nothing and fell through to the published channel — binding a re-exported callable under a name the module's own declaration owns. findExportedDef does not do that: it returns any local def and lets its caller's type gate reject it, so findExportedDefIncludingImportedNames never reaches the imported names for a name the file declares. `x.f` and `x.f()` must not disagree about which module owns f. Not reachable through valid Zig today (a container cannot declare a name twice, and Zig is the only provider setting namespaceExportsIncludeImportedNames), which is why the regression test builds the indexes directly instead of adding a fixture — there is no valid source to write. Its second case fails with the guard removed. Three smaller corrections from the same review: - ZigBuildZonConfig.pathDeps promised the raw `.path` string; a nested package stores the normalized repo-relative value. The interface now documents both spellings and why either is safe to hand to normalizeZigDepPath. Comment only — no behaviour change. - The 'single-package repo' compatibility test ran against zig-idioms, which declares libs/geo as a path dep and that directory has its own build.zig, so the walk finds two packages and the name was a claim rather than a check. It now runs against libs/geo itself and asserts the package list is exactly ['']; a second test pins the multi-package case, including that a file inside libs/geo is governed by that package and not by the root. - The lower-bound header asserted 'some callers are not traced'. callableValueReferenceBoundaries hedges when its probe could not RUN and says whether the symbol is registered is unknown, so the header claimed an omission nothing established. It now says the count may be incomplete and names no cause; the per-cause bullets underneath carry that. * feat(zig): bind a `@This()` alias to the container it names `@This()` IS the enclosing container, and `const Self = @This();` is how most Zig files say so. The container is minted under the FILE STEM and the alias bound nothing class-like: a file-level alias mints no Const at all (isZigFileThisAlias suppresses it so it cannot shadow the type for `w: *Widget`), a container-level one mints a Variable every isClassLike walk steps over. So `Self.member` resolved to nothing — not a wrong edge, no edge, and a caller list missing it is the false confidence #3399 is about. This was the PR's declared known limitation. bindZigThisAliases binds the alias name to its container definition in indexes.bindingAugmentations — the sanctioned post-finalize channel (I8), consulted only AFTER a scope's own bindings, so it can never outrank a real local declaration and can only answer where nothing answered before. Nothing is replaced or removed. No query, capture or SCHEMA_BUMP change. It runs inside populateZigRangeBindings, sharing that pass's parsed tree: a pass of its own would re-parse every Zig file on a cold tree cache. Only aliases declared directly in a container body or at file level are bound — the same set collectZigThisAliases recognizes — because a function-local alias belongs in that function's scope. Measured cold-index before/after, same command, same build: tigerbeetle (246 .zig) CALLS 17,066 -> 17,140 (+74), USES 437 -> 443, MEMBER_OF 5,131 -> 5,143; every other edge type unchanged, all 24 node-label counts identical mach (132 .zig) CALLS 7,600 -> 7,615 (+15), MEMBER_OF +1, USES flat The +74 matches a source census of 72 `Alias.member(` call sites in tigerbeetle files whose alias differs from the stem. Spot-checked end to end: src/aof.zig:636 writes `try AOF.init(io, output_path)` inside AOFType, and the edge AOFType.merge -> AOFType.init#2 is present after and absent before. Node totals move only through the derived layers (Community 524->527, Process 774->763) — no source symbol added or removed. Scale of what was dropped: 73 of ghostty's 185 `@This()` files, 93 of tigerbeetle's 94 and 8 of mach's 42 spell the alias differently from the stem, carrying 302 `Alias.member` references between them, 96 of those calls. Fixture zig-idioms/src/webapi/Widget.zig exercises both paths — a file-level `Self` and a container-level `Me` in Metrics — through a call and a registration. Five cases; three fail with the binding disabled, and the two that do not are the controls: Element.zig's stem-spelled alias must keep resolving byte-identically, and the alias name must not become resolvable from another file. * docs(review): stop claiming what the alias pass does not do Two comments asserted things the adjacent code does not support. The alias pass's call site said it ran before the payload walk "so a subject spelled through the alias resolves here too". It does not: the payload walk types subjects through findReceiverTypeBinding, which reads typeBindings plus the namespace/workspace type channels and never bindingAugmentations, where bindZigThisAliases writes. Measured on `for (Self.items) |it|` — `it` is bound neither before nor after. The pass is in that loop for the tree and nothing else, which is now what the comment says. Nor is that a gap to close by also writing a typeBinding: no container name has one, the file stem included, so a payload subject written `Type.member` resolves for no spelling at all. Giving the alias an entry would make it behave unlike the container it names. Recorded at the call site so the next reader does not re-derive it. The module-shadow test said Element.zig declares `const Gauge: u8 = 3;`. It binds `Gauge` by IMPORT, and the distinction is the point of the fixture: a local declaration would also claim the workspace qualified name `Gauge`, leaving two candidates, and the fallback refuses to guess between two — so the case the test exists for would never be reached. The comment now says which binding it is and why the other shape would be self-defeating. Comment-only: node and edge counts are byte-identical across a full re-index (52,083 / 165,261 both sides). * docs(zig): stop describing loadZigBuildConfig as root-only in the present tense It takes a `packageDir` since this branch and reads `path.join(repoRoot, packageDir, name)`; `loadZigWorkspaceIndex` is what supplies it one, per package. Two comments still described the historical root-only invocation as the function's current behaviour: - the monorepo integration-test header, flagged by review; - loadZigWorkspaceIndex's own docstring — the same sentence, in the function that calls it WITH a packageDir a few lines below, so fixing only the test copy would have left the worse of the two. Both now attribute root-only reading to the CALL (no `packageDir`), which is what the argument actually rests on: a monorepo has no root build files, so that call answers null and every bare @import goes unresolved. The trailing note about `loadImportConfigs` is reworded the same way — it calls the loader for the root package alone; the loader is not root-bound. Comment-only: node and edge counts byte-identical across a full re-index (52,083 / 165,261 both sides), and detect-changes reports the two hunks overlap no indexed symbol. * fix(zig): a written namespace handle owns its own decline `findNamespaceValueRefTarget` returning `undefined` conflated two different answers: "no namespace import named this receiver" and "the module this file named does not expose that member as a callable". Only the first should fall through to the container channel. The second did too, and `findClassBindingInScope`'s miss path answers from the WORKSPACE-wide qualified-name index — so a same-named container in a file this one never imported supplied the member the written module does not have. The owner-shadow guard does not stop it, which is the part that is not obvious: a plain `const utils = @import("utils.zig");` records a namespace IMPORT EDGE, not a module-scope binding, so the guard finds nothing bound under the name and reads the container as unshadowed. It catches `const Gauge = @import(x).MEMBER` (a real binding) and misses the handle form. Reproduced before fixing, not argued: `decoy.zig`'s `dom_utils` struct gains `onlyOnDecoy`, a callable `dom_utils.zig` does not have, and `Element.zig` registers `dom_utils.onlyOnDecoy`. That minted `JsApi -> onlyOnDecoy` — a confident USES edge into a file `Element.zig` never imports, the wrong-edge failure this PR exists to avoid, arriving through the container channel after the namespace channel said no. The channel now returns 'owned' for every outcome reached once the receiver is established as this file's unshadowed namespace handle, and the caller declines on it. A locally shadowed handle still falls through, because there the name does not mean the import at that site and the container channel's guard is the right decider. Bench fingerprint and counts unchanged; no baseline edited. * fix(zig): reject an absolute nested-package `.path` before rebasing it The nested-package branch prefixes the package directory and THEN normalizes, so an absolute `.path` stops looking absolute on the way: `packages/app/` plus `/src` is `packages/app//src`, which is relative by inspection. `normalizeZigDepPath` drops the empty segment and the dep lands on `packages/app/src` — a directory that really exists — so a dependency pointing outside the repository is fabricated into an in-repo resolution. The root package was never affected: its prefix is empty, so the value reached the check as written. `isAbsoluteZigDepPath` is now asked of the value AS WRITTEN, before any prefixing, and `normalizeZigDepPath` asks the same helper so the two cannot drift. `..` is deliberately not handled there: `../core` escapes the package but not the repo, and rebasing it is what the branch exists to do — `normalizeZigDepPath` still rejects what escapes the ROOT afterwards. Note for the reviewer: `path.posix.join(pkg, depPath)` does NOT fix this. `join('packages/app/', '/dep')` is `packages/app/dep` — it strips the leading slash too, producing the same fabricated path without rejecting anything. Measured before writing the fix. Regression test pins it through the real loader: `packages/app` declares `.escapes = .{ .path = "/src" }`, and the test fails without the guard. `impact normalizeZigDepPath` is HIGH (14 impacted, 4 direct, exact). The edit is behaviour-preserving for that function — the same two conditions moved into a named helper it calls — and its existing absolute-path suite, POSIX, Windows drive and UNC spellings included, passes unchanged. * docs(mcp): stop defining lower-bound as proof that callers were missed The CLI header was corrected in round 8; the MCP tool contract still made the assertion the CLI stopped making. `context` said lower-bound "means callers exist that this view provably does not list" and `impact` said "the walk provably missed callers" — but `callableValueReferenceBoundaries` also publishes lower-bound when its probe could not RUN, and says in its own note that whether the symbol is registered is unknown. A client following the contract would read an unanswered question as evidence of an omission. Both now define it as a FLOOR with two possible causes — the walk provably missed callers, or a probe that would have established completeness could not run — and point at `boundaries` for which. That keeps the common case exactly as strong as it was; it only stops the contract asserting the one case it cannot support. The `causes.callableValueReferences` bullet already documented the probe-failure branch, so the headline was contradicting the body. `local-backend.ts` quotes that definition to justify hedging; the quote is updated to name which half it relies on. --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-09 20:12:17 +00:00
Gergő Magyar	b60c21d05d	fix(group): extract NestJS GraphQL contracts on real indexes (#3201) (#3227) ... * fix(group): extract NestJS GraphQL contracts against real 0-based indexes (#3201) Provider lookup used 1-based startLine while the graph stores tree-sitter rows, so every resolver missed. Also try PascalCased Document names and inline sibling FragmentDoc interpolations from graphql-codegen output. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(group): bind arrow-field providers and fail closed on interpolations Match Method startLine to the public_field_definition wrapper, decode template escape sequences, and reject FragmentDoc names that mix static and dynamic declarators. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(group): only inline interpolated templates under a gql tag Cooked reconstruction is not the runtime value for String.raw or unknown tags, so those interpolations stay fail-closed. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(group): tighten gql-tag trust and PascalCase Document lookup Only the identifier `gql` is a trusted interpolating tag. Underscored operation names now try the full pascal-case Document candidate graphql-codegen emits. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(group): memoize GraphQL interpolation source resolution Avoid exponential re-walks when the same fragment name is declared twice at each layer of a ${FragmentDoc} chain. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(group): fail closed on invalid tagged-template escapes Treat line continuations as empty cooked text and reject \8/\9 plus legacy octals so reconstructed gql source matches runtime. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-09 17:30:00 +01:00
Parafee41	20b13b3ed6	perf(resolution): avoid quadratic config walk queues (#3237)	2026-09-09 17:29:28 +01:00
Ankit Verma	a839d029ac	feat(api): report branch and index freshness on the serve repo routes (#3232) ... * feat(api): report branch and index freshness on the serve repo routes `GET /api/repos` and `GET /api/repo` now return the branch an index was built from, its `lastCommit`, and — where it can be computed — how far behind the working tree it is. All of it already existed: the fields are on `RegistryEntry`, and `checkStalenessAsync` is the helper MCP `list_repos` and `gitnexus status` already use. Only HTTP never asked. #3199 made this pointed. A branch-pinned analyze registers its own entry, so one repository yields two rows in /api/repos, and telling them apart over HTTP meant pattern-matching the clone-directory suffix — a layout detail that is trimmed for long refs and absent for path-registered repos. Staleness is reported in the shape `list_repos` already returns: present only when the index is behind, carrying commitsBehind and hint. It is meaningful for path-registered repos; a url-registered repo is cloned --depth 1, so its recorded commit is HEAD and a diverged history cannot be walked by rev-list anyway. Documented in repo-projection.ts rather than left to be discovered. The projections live in their own module so the field list is assertable. Route-inline, they were reachable only by booting a server, which is how `branch` stayed unexposed while `gitnexus list` printed it. /api/repos also gains the rate limiter it lacked: this change makes one unauthenticated GET cost a `git rev-list` per registered repo, the shape this codebase already limits elsewhere. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(api): bound the staleness probe and keep liveness off the fan-out route Addresses the tri-review on #3232. P1. `checkStalenessAsync` caught every git ERROR but not a HANG — a working tree on a disconnected mount or behind a stuck lock never settles, and /api/repos fans that out once per registered repo. Worse, the web liveness probe used /api/repos on a 2s budget and re-polls on failure, so each failed probe stacked another N children on a server that was actually healthy. Two independent fixes, because either alone still leaves a sharp edge: - `execFileAsync` now carries a 5s timeout, so a hang is killed and routed into the same fail-closed "not stale" answer the existing catch already gives a bad SHA. This also protects MCP `list_repos`, which shares the helper. - `probeBackendStatus` (and `isDatabaseReady` through it) asks /api/health instead. Liveness should not cost one subprocess per indexed repo. Health sits behind the same /api/* edge gate, so the 401 "gated vs absent" distinction is preserved. P2. rate-limit.test.ts pins which routes carry a limiter so a dropped one fails a test before CodeQL has to catch it; /api/repos was newly limited but not pinned. Added, and verified it fails when the limiter is removed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-09 17:28:45 +01:00
EVA	25974caf05	fix(doctor): distinguish vector capability from repository index state (#3228) ... Co-authored-by: Eva <eva@100yen.org> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-09 13:06:41 +01:00
mengkaka	4154b63131	feat(indexing): add Objective-C semantic indexing support (#3179) ... * docs: add Objective-C fork provider notes * feat(objective-c): add deterministic provider and grammar * feat(objective-c): finalize provider MVP * fix(objective-c): harden provider integration * fix(objective-c): normalize bare macro markers * docs(objective-c): integrate provider documentation * fix(objective-c): harden resolution and header classification * fix(objective-c): complete provider follow-ups * fix: address Objective-C review follow-ups * chore: format Objective-C grammar sources * fix(objective-c): harden review follow-ups * Address PR review feedback (#3179) Keep Objective-C chunking and macro recovery aligned with the grammar, and stop Community MEMBER_OF edges from leaking into symbol context. Co-authored-by: Cursor <cursoragent@cursor.com> * Address follow-up review on ObjC chunking and language fallback. Keep preprocessor directive text from changing file-scope brace depth, group real ivar nodes, skip header modifiers, and restore Rakefile/Gemfile detection through getLanguageFromFilename. Co-authored-by: Cursor <cursoragent@cursor.com> * Parse Objective-C headers with the objc grammar in embeddings. ensureAndParse and structural extraction now use the same content classifier as ingest, including method snippets from .h files, so Protocol/Category/Class chunks are not re-parsed as C++. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3179) Keep file-scope macro elision off C line splices and @interface/@protocol/@implementation bodies, and attach ivar attributes to the following instance variable when chunking. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(bench): rebaseline Objective-C CSV emit * feat(objective-c): add workspace resolution and linear emit benches Plain .h files are classified as C++, so the ObjC pass could not resolve #import of those headers. Load a C/C#-style workspace once per pass, and keep protocol-candidate USES linear. Refs #3179 Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3179) - Compare LadybugDB labels() as a scalar when excluding Community MEMBER_OF edges. - Walk superclass members, skip file-static C sibling defs, and ignore comments in ObjC header/macro scans. Note: pre-existing failure in objective-c-provider integration (worker-pool ready timeout) not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3179) Emit Objective-C declaration captures so compilation-unit siblings can share header/implementation bindings, and keep class vs protocol visibility groups distinct. Note: pre-existing failure in worker-pool startup (GITNEXUS_WORKER_READY_TIMEOUT_MS) not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3179) Emit every comma-separated property/ivar declarator, and count @interface after a multiline block comment closes so in-declaration macros stay intact. Note: pre-existing failure in worker-pool startup (GITNEXUS_WORKER_READY_TIMEOUT_MS) not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: ximengkai <ximengkai@soyoung.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-09 09:40:21 +00:00
Gergő Magyar	376ed3bb4a	perf(lock): probe this process's own start time once (#3222) ... * perf(lock): probe this process's own start time once `acquireFileLock` stamps the owner file with the acquiring process's start time so a later reclaimer can tell a live owner from pid reuse. That value cannot change while we are running, but it was re-probed on every acquisition — and on Windows the probe is a `powershell.exe` spawn plus a `Get-CimInstance Win32_Process` WMI query, which is the single most expensive step in taking an uncontended lock. Add `readProcessStartTimeCached` and make it the default reader in `acquireFileLock` and `resolveWatchDeps`. Only this process's own pid is cached: - A foreign pid is always re-probed. That process can exit and its pid be reused, which is precisely what the stamp exists to detect. - A failed probe is not cached. `acquireFileLock` throws when the start time is empty, so caching one transient failure would leave the process unable to take a lock for the rest of its life. `readProcessStartTime` itself is unchanged and still probes every call, so the existing timezone-pinning regression test keeps exercising the real `ps` invocation instead of passing off a cached value. Behavior is otherwise identical: same probe, same string, same stamp. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-08 19:06:03 +01:00
Ankit Verma	8ddab9aed5	feat(api): honor branch on POST /api/analyze (#3199) ... * feat(api): honor branch on POST /api/analyze The serve route accepted a `branch` field in the request body, returned 202 and reported the job `complete` — while indexing the remote's default branch. Express drops unknown body fields, so the caller got no error and no warning; the only way to notice was to inspect the checked-out clone. Both ends of the plumbing already existed: CloneOrPullOptions.branch is honored by cloneOrPull, and AnalyzeOptions.branch already drives resolveBranchPlacement. Only the HTTP layer was missing, so this wires `branch` from the route through cloneOrPull and LaunchOptions into the worker's AnalyzeOptions. StartMessage.options is already typed as AnalyzeOptions, so the IPC protocol is unchanged. Validation reuses validateBranchName — the same function backing the CLI's `--branch` — so both entry points accept exactly the same refs and a malformed value is rejected with 400 before it can reach git. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(api): make branch part of job identity and complete ref validation Addresses the review on #3199. 1. Job dedup ignored `branch`, so a request for branch B while branch A was in flight was answered with A's job and a 202. The caller would read that as "B is indexed" — the same silent wrong-branch outcome honoring `branch` was meant to remove. Branch is now part of the dedup identity; a different-branch request falls through to the single-slot guard and gets a truthful 409 instead. 2. validateBranchName implemented only a subset of git's ref rules, so `feature.lock`, `/feature`, `feature/`, `feature//next`, `@`, `@{` and dot-prefixed components passed validation and failed later in the git subprocess — a 202 plus a background failure rather than the advertised 400. The remaining `git check-ref-format` rules are now enforced at the same chokepoint, which fixes the CLI and `.gitnexusrc` paths too. No branch git can create is affected. 3. The LaunchOptions doc claimed an explicit branch always pins `branches/<slug>/`. resolveBranchPlacement keeps the run on the flat slot when that slot has no owner, or when its owner is already this label. Comment and CHANGELOG corrected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(server): describe cloneOrPull's branch path in its contract comment The header comment predated `options.branch` and still said an existing clone is only ever `git pull --ff-only`. The implementation has a second path: with a branch it fetches that ref and runs `checkout -B <branch> origin/<branch>`, so the requested branch — not the one already checked out — ends up in the working tree. The stale comment is actively misleading: a reviewer reading it concludes that requesting a branch on an existing clone silently analyzes the default branch, which is not what happens. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(server): scope the origin check to the existing-clone path My previous comment said remote.origin is verified "in both cases", which is wrong: assertRemoteMatchesRequestedUrl runs inside `if (exists)`, so a fresh clone has no origin to check. Restructured around whether targetDir exists, which is what actually selects the behavior. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(server): cover branch job identity in JobManager's own suite The branch dedup tests were sitting in analyze-api.test.ts, but they exercise JobManager directly, so they belong beside the existing "returns existing job for same repoUrl when active" case in analyze-job.test.ts. Moved, and extended to cover the callers that omit branch entirely — the upload route, the embed manager and the existing tests — which compare undefined === undefined and are unaffected. Also pins that branch survives the whole clone -> analyze -> terminal update sequence, since it is now part of dedup identity and must not drift mid-flight. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(api): give a pinned branch its own clone and settle the slot it wrote Addresses the review on #3199. Per-branch clone directories (review option 2). One checkout per repo made `branch` one-shot: after any analyze the tree is dirty with generated AGENTS.md / CLAUDE.md / .claude/, so a pinned request 202'd and then died on cloneOrPull's porcelain refusal. Worse, a later request that OMITTED `branch` pulled whatever branch the last pin left checked out and indexed it as the default — silent wrong content, the same class as #3198 one request later. A pinned run now clones into `<repo>__<branchSlug>`, so the two requests no longer share a tree. The pinned clone registers under its directory name, because both dirs share an origin and the inferred name would otherwise collide; that name re-derives through getCloneDir, so DELETE still finds it. Finalization gate. registerRepo always records the flat `.gitnexus`, but a pinned run whose label differs from the flat slot's owner writes `branches/<slug>/`. The gate probed the flat path regardless, so it never settled, and the worker's normal exit 0 — sent ~500ms after `complete`, while the job is deliberately still non-terminal — was classified as a crash and a successful analysis was retried three times and failed. The gate now follows the placement the worker reports (isPrimaryBranch, added to the IPC allowlist under the rule that module already documents), and an exit after a terminal IPC counts as winding down, not dying. Reported by the maintainer and reproduced independently by @azizur100389. analyzeCloneOptions extracted so the token/branch combination is asserted. Inline, the branch-only case — a public URL with no token — was untested, and dropping it there would silently reindex the default branch while every other test stayed green. CHANGELOG: the previous entry claimed the newly-400'd payloads "would have failed at git", which is true of CLI --branch but wrong for HTTP, where they succeeded on the default branch. Documented as an explicit behavior change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(server): bound the branch clone-dir name to one path component `validateBranchName` allows a 255-character ref and `branchSlug` appends a dash plus 8 hash characters, so `<repo>__<slug>` reached 267 — past the 255-byte component limit on ext4/APFS/NTFS. The clone would then fail to create its target directory, which the character-only regex could not catch. Only the readable half is trimmed. The hash is a digest of the full ref and is always kept, so two long branches sharing a prefix still resolve to different directories rather than silently sharing an index. `branchSlug` itself is untouched: the per-branch index slots already use those names on disk, and shortening them there would orphan existing indexes. Also corrects two comments: the forwarding test claimed a branch selector always pins `branches/<slug>/` (it keeps the flat slot when that slot has no owner or already owns the label), and the web client's `branch` doc said omitting it means the remote default — true for a `url` request, but a `path` request is never cloned and indexes whatever that tree has checked out. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(server): bound the branch clone-dir name and unblock same-branch re-index Two defects found by testing this branch end to end, plus the review nits. 1. Path length. `validateBranchName` allows a 255-character ref and `branchSlug` appends a dash plus 8 hash characters, so `<repo>__<slug>` reached 267 — past the 255-byte component limit on ext4/APFS/NTFS, and the clone could not create its directory. Only the readable half is trimmed; the hash is a digest of the full ref and is always kept, so two long branches sharing a prefix still get separate directories. `branchSlug` itself is untouched — the per-branch index slots already use those names on disk and shortening them there would orphan existing indexes. 2. Same-branch re-index. Per-branch clone dirs stopped branches from contaminating each other, but a REPEAT pin still failed: analyze writes AGENTS.md / CLAUDE.md / .claude/ into the clone, so the second pinned run met its own dirt at the porcelain check and asked for `overwrite_local_changes`. When HEAD already matches the requested branch there is nothing to switch, so the run now takes the same `pull --ff-only` path an unpinned request takes — review option (1), alongside (2). The refusal is untouched where it matters: a real switch, or a detached HEAD, still goes through the checkout path and can still refuse. Also: repositions getCloneDir's JSDoc, which an inserted constant had orphaned; gates the pinned `registryName` on the same condition as the clone, so supplying both `url` and `path` no longer renames the operator's local repo; corrects a test comment that claimed a branch selector always pins `branches/<slug>/`; and corrects the web client's `branch` doc, which said omitting it means the remote default — true for `url`, but a `path` request is never cloned. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: drop the CHANGELOG edits from this PR Requested in review. Checking the history, no feat/fix PR here touches gitnexus/CHANGELOG.md — the only recent commit on it is `chore: release v1.6.11`, and CONTRIBUTING says release notes are generated from the merged PR title via .github/release.yml. Hand-editing an [Unreleased] section from a feature branch was my mistake, not the project's convention. The behavior change it documented (branch: null / "" / non-string now 400 where they were previously dropped and the default branch indexed) is stated in the PR description instead, which is what feeds the release notes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(server): align the clone/pull contract with the same-branch fast path Two comments I wrote went stale against my own later change. `cloneOrPull`'s header still said an existing clone with `options.branch` always fetches and runs `checkout -B`. Since the same-branch fast path landed that is only true when the branch actually differs; when it is already checked out the run takes `pull --ff-only` and no dirty-tree check applies. The header now splits on whether the branch differs, which is what the code branches on. The web client's `branch` doc said omitting it on a `url` request clones the remote default. That holds only when there is no clone yet — an existing unpinned clone is pulled on whatever branch it already has checked out. Comments only; no behavior change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Address PR review feedback (#3199) Pin a same-branch re-index to `git pull --ff-only origin <branch>` so the job cannot follow an unverified `branch.<name>.merge` while still skipping the dirty-tree refuse. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): close the #3199 holes on pinned analyze re-index Same-ref updates were a raw pull dest (force-fetch via +) or a shallow ff-merge that could not move, and a tag pin compared the tag-object SHA so re-index refused a dirty tree. Fetch the mapped remote-tracking ref, stay put on a peeled SHA match, restore only GitNexus overlays, skip the 60s settle on alreadyUpToDate, and keep branch validation in core so the HTTP route does not import the CLI. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-08 15:15:45 +01:00
Gergő Magyar	96132bd13a	perf(scope-resolution): stop re-scanning the ParsedFile store once per language (#3211) ... * perf(scope-resolution): stop re-scanning the ParsedFile store once per language Scope resolution calls `loadParsedFilesForPaths` once per language, and every call walks every shard in the store. The skip decision needs the envelope's path listing, and that listing is only trustworthy after the payload digest has been checked -- so a pass that wants 50 Python files still opens and SHA-256s all 413 shards / 301MB of a TypeScript-dominated store to prove it can skip them. A pass wanting a SINGLE file costs 335ms. The cost scales with language count, not with the files that language has, so a polyglot repo pays it worst. `tryLoadV8Cache` now returns the listing it already parsed for that skip decision, and the store memoizes it per run. Later passes skip on the memoized listing without reopening the file. Measured on a 2234-file, 3-language repo, min-of-5: before python 411ms typescript 2872ms javascript 507ms = 3834ms after python 415ms typescript 2805ms javascript 248ms = 3484ms -350ms here, roughly -250ms per additional language elsewhere. The first pass is unchanged by construction -- it is what populates the memo. End-to-end the graph is byte-identical: 51,288 nodes / 163,094 edges / 2106 clusters / 759 flows on a true incremental run. Keyed on size+mtime as well as name. Shard names are content-addressed, so a name collision across different content should be impossible, but that invariant lives in the parse-cache keying rather than here and one stat per shard is a few ms against the hundreds this saves. The memo holds one store directory at a time, so a new repo in a long-lived MCP process drops the previous set instead of accumulating. The failure mode a listing memo introduces is a FALSE SKIP: a pass concludes a shard holds nothing it wants and those files silently never reach the graph -- an exit-0 wrong answer, not a crash. The new test walks four passes with disjoint wants over one store, plus a shard written after the memo is warm; it fails when the skip is forced. Also records the full scopeResolution breakdown in bench/. The headline is that `emit` is 7161ms of the 14.7s phase and ~21% of the edit loop, spread across a fan of passes with no hot inner loop -- so the win there is not running them for unchanged files, which is a design rather than a patch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3211) Strengthen the shard-listing memo test so a later miss asserts fs.open and v8.deserialize never run for the skipped shard. Key-set checks alone still passed if the memo never skipped. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-08 13:48:30 +01:00
Gergő Magyar	0d1aed942f	docs(bench): close FTS as an optimization target with measured evidence (#3209) ... PR #3208 landed two claims that further measurement disproved. The narrowing is not inconsistent. A true incremental leaf edit rebuilds exactly 8 of the 20 configured indexes -- the tables the writeback DMLs -- and the 20-index run I compared it against was a forced full rebuild (runner-identity trap). Per-index costs for those 8 sum to 7769ms against the 7525ms measured in-analyze. There is nothing to fix in `touchedFts`. The 845ms was not `import('./platform/capabilities.js')`. The CLI already imports that module statically; a cached dynamic import measures 0.035ms. The `await` is the first yield after the native FTS build and absorbs the libuv work still queued behind it. Recorded as a fourth measurement trap, since it invalidates any mark placed on an await that follows native work. What replaces them is a floor, established by probing a copy of the corpus index directly: - narrowing further: nothing left, the 8 tables are exactly the DML'd set - concurrent builds: hard error, one write transaction at a time - connection thread count: flat at 4/8/16/24 (7298/7133/7109/7345ms min-of-3), though the default burns ~60% more CPU for it - dropping `content` from File: 3541ms -> 241ms, but that deletes full-file keyword search (#2317/#2323); capping is a bad trade because the size distribution is flat The one lever left is overlap: the build runs on a libuv thread and hides behind main-thread JS (3337ms for the index plus a 3000ms JS burn, against ~6859ms serial). File rows are `{ name, filePath }` from `processStructure` with content lazy-read at CSV time, so they are known before parsing. What blocks it is that the DB is closed for the whole pipeline and that an early write moves `liveIndexMutationStarted` ahead of it. The `ponytail:` comment in `createSearchFTSIndexes` invited exactly the fix that cannot work -- every caller has already dropped the indexes it passes, so a presence gate would never fire. Replaced with the measured reason. Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-07 19:22:24 +01:00
Gergő Magyar	f48bf81256	perf(parse): tighten the dispatch-round memory bound and unclamp the worker-pool override (#3200) ... * docs(parse): record why dispatchGroups is a required interface member Review finding #10 argued dispatchGroups should be optional to match `getQuarantinedPaths?` / `getStats?`. Those are compatibility accommodation for WorkerPool shapes that predate them, not a convention for new members; optional here would force a `?.` plus an unreachable fallback at the single production call site. Documenting the decision so the next reader does not re-litigate it from the neighbouring optional markers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (cherry picked from commit addaab647377f3c4553f752fa3ca1388bcb9ca81) * refactor(parse): simplify round accounting and dispatch setup Simplification pass over the dispatch-rounds change. Behavior preserved: identical graph on a full analyze (51,286 nodes / 163,092 edges). - Drop `roundMissBytes`. `roundBufferedBytes` counts the same bytes plus the cache hits, so it is always the greater of the two and the first disjunct of the close condition could never fire on its own. One counter, one reset, one check. - Measure round bytes with `Buffer.byteLength(content, 'utf8')` instead of `String.length`. UTF-16 code units undercount non-ASCII source by up to 3x, so the cap meant to bound main-thread retention was letting a CJK-heavy repo hold well past its nominal budget. Matches `estimateItemBytes` in the pool. - Reset the durable ParsedFile directories for a round's chunks concurrently. Each targets its own chunk-hash directory, and running them serially put N round trips of fs work on the critical path the round exists to shorten. The try/catch stays inside the mapped callback, so one failure still degrades that chunk alone. - Skip the quarantine filter entirely when nothing is quarantined, which is every run without a worker death. It was an identity copy of every group. - `dispatchChunkParseRound` takes `DispatchGroup<...>` rather than re-declaring that shape inline; the type was already imported and used in its body. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (cherry picked from commit 527d5b6e0ca8ae7bbc6a414c5ac7e27fd85e9995) * refactor(parse): count round misses with the same idiom startRound uses `drainRound` hand-rolled a reduce to count 'miss' entries while `startRound`, one function above, filters the same predicate over the same union. Same integer, one idiom. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (cherry picked from commit 7eaa193b0cb5fa515844f36ae1401d6fb2fed7b8) * fix(parse): honor GITNEXUS_WORKER_POOL_SIZE above the auto sizing cap The auto pool size is bounded by source bytes so a tiny repo does not spawn a full idle pool. That bound was also clamping the operator's env override, because the env value is read inside `resolveAutoPoolSize()` and the result went through `Math.min(..., workProportionalCap)`. `DEFAULT_POOL_SIZE_CAP`'s own comment offers `GITNEXUS_WORKER_POOL_SIZE` and `--workers <N>` as equivalent escape hatches for operators on bigger machines. They were not. Measured on a 30MB corpus, where the byte-derived cap is 16: --workers 24 -> pool: 24/24 active GITNEXUS_WORKER_POOL_SIZE=24 -> pool: 16/16 active (silently ignored) Both are deliberate operator input, so both now bypass the work-proportional cap, which goes back to bounding only the auto default. After the fix, on the same corpus, with identical graph output (51,286 nodes / 163,092 edges): GITNEXUS_WORKER_POOL_SIZE=24 -> pool: 24/24 active GITNEXUS_WORKER_POOL_SIZE=4 -> pool: 4/4 active unset -> pool: 16/16 active Verified by hand against the pool's own throughput log; not covered by an automated regression test, since the pool size is only observable through that log line and not through the progress stream a test can read. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (cherry picked from commit 17ed08608c878079b2927da25cfd39c1608a02a2) * fix(parse): bound the durable-reset fan-out and pin the pool-size override Review follow-ups on #3200. The round's durable ParsedFile directory resets went out as one unbounded `Promise.all` — one recursive rm + mkdir per miss chunk, all at once. A round can hold hundreds of small packs, and those resets compete for descriptors with the chunk prefetch this loop already has in flight. `readFileContents` degrades a losing read SILENTLY by documented contract, so a dropped file would vanish from the chunk, from the graph, and from the chunk hash — shipping a narrowed index with exit 0. Now routed through `mapConcurrent` at the same width the file reads use, which keeps the pipelining win and caps in-flight descriptors. An operator's pool size is now also bounded by the number of files there are to parse, so `GITNEXUS_WORKER_POOL_SIZE=100000` on a five-file repo cannot become the literal thread count. This applies to `--workers` and the env var alike, so the parity the previous commit established is intact. It does NOT shrink an incremental re-analyze: `totalParseable` counts every parseable file in the scan, not the changed ones. Adds the regression test a reviewer asked for. The existing coverage (`worker-pool-resilience` calling `resolveAutoPoolSize` directly, `analyze-worker-pool-size` mocking `runFullAnalysis`) never reaches `runChunkedParseAndResolve`'s `effectivePoolSize`, so both stayed green through a revert of the fix. The new test drives the real parse phase with a worker double that writes a per-`threadId` marker, and counts them: verified it fails on the reverted line with `expected [ 'worker-1' ] to have a length of 3 but got 1`, and passes on HEAD. Also corrects the `GITNEXUS_PARSE_ROUND_BYTES` docstring, which still described the cache-miss counter deleted two commits ago. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(parse): skip caching a chunk with a stale durable generation; warn on over-subscription Closes the two findings left open by the review of #3200. When `prepareDurableParsedFileChunk` fails, the previous generation's shards are still on disk, so a later warm hit would union them with the new ones. The chunk is now recorded and its parse-cache write skipped -- the same posture `finalizeWorkerChunk` already takes for a quarantined chunk, and for the same reason: do not cache what we cannot vouch for. The next run re-dispatches into a directory it can actually clear. Bounding the reset fan-out removed the correlated trigger; this closes the individual case. Pool size over-subscription now warns rather than caps. Silently capping is precisely what the override exists to prevent, so an operator's number is still honored -- but an exported GITNEXUS_WORKER_POOL_SIZE applies to every analyze in a long-lived caller (watch auto-sync, the MCP server), including small incremental ones, and that is easy to set once and forget. The warning names the host's usable core count, so it is a hardware fact rather than an invented threshold. `resolveHostParallelism` is extracted from `resolveAutoPoolSize` rather than re-deriving the cgroup-aware fallback at the new call site. Tests: the stale-generation skip is pinned by a new case asserting nothing is written under any key; verified it fails without the guard with `expected 1 to be +0`. 60 unit and 49 integration tests pass across the affected suites. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(parse): guard dispatch-round cadence with a bench, not a wall-clock budget Round boundaries are deliberately invisible to graph output — batching that changed output would be a bug — so nothing in the repo could see the #3196 win regress. It would have come back as a silent ~1.5x on every cold analyze. Two earlier attempts to pin it as a unit test failed for that exact reason: one scraped a logger line the progress stream does not carry, the other asserted graph content that is identical either way. Extracts the round-close fold into `createRoundBudget`, so the decision is a shared unit the bench measures rather than a copy that drifts. The parse loop is streaming and cannot know chunk sizes up front, so an accumulator is the honest shape — not a planner. Four deterministic arms, one ratio, no millisecond gate: - layout_fingerprint — pack membership. Every cache key derives from it, so drift needs a SCHEMA_BUMP, never a lone re-baseline. - packs / single_file_packs — the FLOOR. `rounds` only asserts something while the corpus over-splits (774 packs where the byte budget needs 5). This is bench/import-target's lesson, where four heap arms read 0 B and passed every ceiling: a ceiling says "not too big", nothing said "still measuring". - rounds — the regression signal, both directions. - cjk_rounds vs ascii_rounds — pins UTF-8 byte accounting. The two corpora share a UTF-16 length and differ only in encoded size, so String.length collapses them to equal. This is the arm no unit test could be. - pack_scaling_ratio — (t_4n/t_n)/4, min-of-15. A ratio because wall-clock is runner-speed-dependent and this repo has the scar: callable-value-flow's ms gate failed twice at 2.07 and 1.975 against 1.9 with correct code, on a sub-11ms measurement. Every arm verified to fail before being recorded: close-every-chunk reads 774 rounds, disabling the close reads 1, reverting roundFileBytes to String.length takes cjk_rounds 8 -> 3, and shrinking the corpus trips the shape floor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(bench): record the analyze phase breakdown and the rejected optimizations Where analyze time actually goes, measured while landing #3194/#3196/#3200, plus the two optimizations that looked compelling and were measured away. The headline is that the parse work is done: a one-file-edit re-analyze is 36.5s, of which parse is 2.8s (8%). scopeResolution is 40% and the unlogged graph emit + FTS rebuild is 49% — neither is incremental, and the ~18s sits outside the phase runner so every phase log is blind to it. Also records the trap that invalidated an earlier measurement: a non-git corpus never records a schema fingerprint, so every run is a forced rebuild and any "warm" number taken that way is fiction. Rejected, with numbers: more workers (16/20/24 land inside run-to-run spread) and bundling the worker entry (~250ms on a normal filesystem; the 8.6s that motivated it was a 9p-mount artifact). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-07 13:53:31 +01:00
Parafee41	1c1cbf111e	fix(zig): resolve cross-file static gates (#3185) ... * fix(zig): resolve cross-file static gates * Fix Zig workspace import alias enrichment * Handle extensionless Zig workspace imports * Reuse Zig import resolution for static gates * Document Zig workspace static gating * Harden Zig workspace reference enrichment * Benchmark Zig cross-file static gating * Enforce linear Zig benchmark scaling --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-07 07:19:30 +01:00
Gergő Magyar	8f006bd759	perf(parse): batch cache packs into one dispatch round (#3196) ... * perf(parse): batch cache packs into one dispatch round `WorkerPool.dispatch` is a barrier, so dispatching one parse-cache pack at a time leaves most slots idle for every round-trip. Packs are keyed by `(language, hash(path) % 128)`, so the byte budget rarely binds: this repo produces 1285 packs where the budget alone needs 16, and 549 of those hold a single file. In a real analyze, 76 of 221 dispatched chunks carried one file and cost 15.3s — 20% of the parse phase for 3.4% of the files. Chunks now accumulate into a round bounded by `GITNEXUS_PARSE_ROUND_BYTES` of cache-missing source (default: the chunk byte budget) and go out through a new `WorkerPool.dispatchGroups`. Jobs are still cut at pack boundaries, so each job carries exactly one `chunkHash` and every result stays attributable to the pack whose cache key owns it. Cache hits ride along as round entries, and rounds drain in `chunkIdx` order, so deferred aggregation stays deterministic. Cold `analyze --index-only` on this repo (2234 parseable files, 16 workers): 110.3s -> 70.5s total, parse phase 74.0s -> 40.5s, 221 dispatches -> 15. Graph output is unchanged: 51,286 nodes / 163,092 edges / 2106 clusters / 759 flows in both arms. Peak main-thread RSS 3372MB -> 3487MB (+3.4%). `dispatchGroups` also claims the pool synchronously and rejects a concurrent call. Two overlapping dispatches hand the same slots out twice and both stall; the first version of this change did exactly that, and the only symptom was every worker idle-timing out ~10s later with no indication of the cause. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(parse): bound what an open round holds, not just what it dispatches Follow-up to the review of #3196. Three reviewers independently found the same defect: `roundMissBytes` was the only in-loop close condition, but cache HITS were queued into the same round without contributing to it. A warm re-analyze misses nothing, so no round ever closed and every chunk's source plus its cached worker output stayed resident until the tail drain — the #2649 heap failure shape on a large repo. - Hit entries now carry a file COUNT, not the file array, so a replayed chunk never pins its source text. `applyChunkResults` only ever read `.length`. - Track `roundBufferedBytes` across hits and misses and close on either cap. Verified on a warm run: with the cap, draining starts as soon as 2MB is buffered; without it all 221 merges land in the final 10% of the phase. - Warm progress no longer freezes at the phase floor. `filesParsedSoFar` only advances at drain, so a new `queuedFilesSoFar` feeds the progress events while `filesParsedSoFar` stays the merge-accurate throughput number. - A throw from `drainRound` used to unwind straight to `terminate()` while the next round's workers were still busy — the #2432 mid-N-API abort hazard. Settle the in-flight round first, then propagate. - `dispatchGroups` returns one array per group; assert that length instead of `?? []`, which turned a contract break into a silently empty chunk. - Collapse `PendingWorkerChunk` into the `miss` RoundEntry it duplicated. - Repair two stale doc comments: `dispatch`'s JSDoc had been orphaned onto `dispatchGroups`, and `dispatchChunkParse` still described chunk overlap that now lives in parse-impl's round machinery. - New test: a round mixing a cache hit and a cache miss. `drainRound` walks entries in chunkIdx order but pulls results on a separate cursor, and no existing test put both kinds in one round with content assertions. Cold analyze unchanged: 71.3s, 15 rounds, 51,286 nodes / 163,092 edges. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-06 18:27:09 +01:00
Gergő Magyar	780cac7885	fix(parse): keep stable cache packs parallel (#3194) ... Stable cache packs introduced by 9718e1247 often fit one worker job, leaving most workers idle. Size jobs against live pool capacity and reuse extraction queries per native grammar instead of recompiling on every pack. Preserve recovery readiness across dispatches and bound failed-thread termination acknowledgment. Bisect confirms the scheduling regression. Controlled parsing of 951 TypeScript files falls from 56.39s to 26.66s with identical graph output; peak RSS increases roughly 10%. Add scheduling and query reuse coverage and repair recovery fixtures that assumed single-job dispatch. Validation: build, typecheck, formatting and 229 focused tests pass. Full suite was interrupted during lengthy native DB testing; full release CI remains outstanding. Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>	2026-09-06 10:37:05 +01:00
Gergő Magyar	a957c5d757	Merge branch 'main' into fix/skill-evolution-gate	2026-09-05 11:11:45 +01:00
Gergő Magyar	c5c4fbe43c	fix(zig): vendor tree-sitter-zig so npm i -g no longer warns on peers (#3180) ... * fix(zig): vendor tree-sitter-zig so npm i -g no longer warns on peers Published overrides do not apply to dependents, so the Zig optionalDependency kept warning that tree-sitter@0.21.1 does not satisfy peerOptional ^0.22.1. Load it from vendor/ like Dart/Kotlin/Swift instead. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): add zig parse snippet to prebuild validate The six zig prebuild jobs failed at "Validate the .node loads and parses" because snippets[GRAMMAR] was undefined and tree-sitter threw "Input must be a function". Co-authored-by: Cursor <cursoragent@cursor.com> * chore: drop Unreleased changelog note from the Zig vendor PR CHANGELOG.md is owned by the release process, not individual PRs. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33949409205 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33949616521 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33949829377 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950025077 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950220655 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950400275 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950607933 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950882912 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951170483 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951386477 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951624305 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951813452 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951998309 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33952225172 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33952524393 * fix(ci): stop native prebuild rebuild loops PR path filters and source checks see the cumulative diff, so generated binaries kept rebuilding the original source change. Skip output-only synchronize events using their exact before/head range, failing closed when Git cannot compare it. Exercise the workflow against real commit histories, including multi-commit source pushes and merge-ref drift. * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33953226606 * fix: address Zig PR review feedback (#3180) Check for the vendored package without loading its native binding so a broken installed Zig grammar fails the parsing test instead of skipping. Match the optional child descriptor in the Zig metadata declaration and include Zig in the two optional/vendored grammar comments. Validation: 159 targeted tests, TypeScript, metadata type fixture, and formatting passed. Injected native-load failure now fails instead of skipping; explicit Zig opt-out still skips. * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33956342308 --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: gitnexus-release-bot[bot] <gitnexus-release-bot[bot]@users.noreply.github.com>	2026-09-05 10:35:33 +01:00
Gergő Magyar	8f08261d05	Merge branch 'main' into fix/skill-evolution-gate	2026-09-04 20:02:51 +01:00
Gergő Magyar	c0c3fa18a9	chore: release v1.6.11 (#3177) ... * chore: release v1.6.11 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(test): read /api/info version from package.json server-info unit tests hardcoded 1.6.10 while buildServerInfo reads package.json, so the 1.6.11 bump failed ubuntu coverage 3/3. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor: read the published version from one helper Release bumps kept breaking tests that each re-required package.json. packageVersion() is now the single read for CLI, MCP, serve, and those tests. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-04 20:02:37 +01:00
Gergo Magyar	7c68905aac	Merge branch 'main' into pr-2785-feedback	2026-09-04 18:38:07 +00:00
Gergő Magyar	9bf307123e	feat: notify users when a newer gitnexus version is available (#3175) ... * feat(core): add cache-first npm update-check service Shared fail-open checker: validated 24h cache under GITNEXUS_HOME, acquireFileLock-guarded refresh, monotonic publication, hardened registry fetch (no credentials, private-address redirects refused, body-capped), strict x.y.z comparator, install-eligibility classification, and an unref'd refresh scheduler for long-lived processes. Extracts getGlobalDir into storage/global-dir.ts with a repo-manager re-export (no caller changes). Co-authored-by: Cursor <cursoragent@cursor.com> * feat(cli): notify on available updates via stderr and doctor One i18n'd stderr line on interactive invocations when the validated cache holds a newer version (TTY-gated, CI/opt-out/eligibility-gated, hook and help/version command identities excluded). Stale cache spawns a detached hidden __update-check refresh child so command exit latency is unchanged. doctor prints the cached latest version when known. Dockerfile.cli sets GITNEXUS_NO_UPDATE_NOTIFIER=1. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(mcp): emit one stderr update notice per process per version Process-scoped adapter in mcpCommand (stdio and --http), dynamically imported after the stdout sentinel, started only after connect, fully catch-isolated. Arms the shared refresh scheduler with cleanup on process exit. Protocol payloads stay free of update state (R15). Co-authored-by: Cursor <cursoragent@cursor.com> * feat(serve): expose update state on /api/info Serve-scoped controller owns an in-memory update snapshot: one staleness evaluation after listen, then the shared unref'd scheduler, stopped on close/shutdown. /api/info reads only the snapshot and gains optional latestVersion/updateAvailable fields for eligible installs; the existing three fields are byte-compatible. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(web): dismissible update-available banner from /api/info Fetches server info after backend connect and on reconnect, renders a fixed banner in the exploring view only when updateAvailable is true and the version is undismissed, hides while the reconnect banner is active, and fails open on fetch errors. role=status + aria-live with a keyboard-focusable dismiss; dismissal persists per version in localStorage. Copy in en/zh-CN common.json with version interpolation. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(cli): document update notifications and opt-outs Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): apply review findings and simplify pass Review: gate the detached refresh spawn on a live lock-owner probe so parallel CLI invocations coalesce to one refresh child (validated P2, three-reviewer agreement); poll /api/info on a slow cadence while exploring so post-load server-side discoveries surface (validated P1); add a monotonic sequence guard so overlapping server-info fetches commit in order. Simplify (behavior-preserving): shared truthy-env/opt-out/freshness helpers in update-cache.ts, shared cachedUpdateNoticeLine for CLI and doctor, extracted install-eligibility core with per-process memo, memoized registry parsing, single evaluation per scheduler cycle, cache-only startup evaluate in serve, flattened MCP exit handler, shared bottom-banner shell, storage keys in ui-constants. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(update-notifier): address residual review tickets on this PR Stop the lock-busy 1ms scheduler spin, replace clock-skewed cache entries, move the outbound URL guard into core, and extract the serve update controller. Pin the startup/guard/single-flight/MCP/CLI contracts those tickets called out. Fixes #3167 #3168 #3169 #3170 #3171 #3172 #3173 #3174 Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3175) Fetch the npm /latest document instead of the full packument so the 64KiB cap can succeed, and treat reused lock PIDs as stale so refresh is not suppressed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3175) Register the CLI spawn suite on the OS matrix, pin MCP opt-out env, and compare versions without IEEE-754 rounding. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(cli): add gitnexus update install and versioned command banners Give an explicit Claude/Codex-style upgrade (`npm i -g gitnexus@version`) and print `GitNexus <Name> (version)` on every command so the running build is obvious without silent self-update. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3175) - Document the pinned install as npm i -g gitnexus@<x.y.z>, not a copyable @version tag - Wait for wall-clock-future cache repair to publish before asserting - Restore the stdout spy if the TTY notice assertions fail Co-authored-by: Cursor <cursoragent@cursor.com> * fix(update-notifier): keep last known latestVersion on a failed refresh A later offline check was wiping the pin and hiding a known update for 24h. gitnexus update still treats a failed live fetch as checkFailed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3175) - Word update.current so a newer-than-latest install is not called the latest stable version. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): hide the detached update-check spawn on Windows The refresh child was spawned without windowsHide, so Windows CI could stall before writing the cache and then fail cleanup with EBUSY. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-04 18:50:03 +01:00
Parafee41	47c2799ba7	fix(analyze): add cold parser rebuild option (#3153)	2026-09-04 05:14:00 +01:00
Gergo Magyar	bc7f4a907e	Merge branch 'main' into pr-2785-feedback	2026-09-03 19:01:52 +00:00
Gergo Magyar	d541105340	fix(workflow-bench): repair the harness defects the verbose proposer logs exposed ... The first fully-logged skill-evolution run failed for five deterministic reasons that had nothing to do with the candidate under test. Each is fixed at the layer that actually owns the contract: - Strict provider adapters materialize omitted optional string arguments as "". The MCP alias normalizer now treats a blank optional alias as absent (a blank REQUIRED target is still rejected), and a trusted PreToolUse hook strips blank strings before Read/GitNexus tool calls. - MCP semantic errors rode home in a successful envelope and logged as result=ok. SessionProgress now inspects the payload and reports them as semantic-error. - Claude Code's nested sandbox overlays absent root dotfiles with device nodes, which the provenance snapshot read as unauthorized workspace changes. Those names are excluded at the workspace root and hidden from git via an immutable excludes file. - The proposer could not read /evidence from Bash (missing allowRead entry) and had no offline gitnexus runner, so it fell back to npx and hit the network. Both are now mounted; ripgrep is installed in CI. - selected-rows.json advertised host artifact names that do not exist in the mount. Rows now name their staged patch_file/transcript_files, the prompt describes the real layout, and oversized bundles compact artifacts before dropping evidence rows so no row is silently lost. Also replaces two benchmark scenarios that main already satisfies (trivial-version-alias, inv-bug-pdg-note) with non-vacuous ones, verified to fail against a pristine checkout. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-03 19:01:45 +00:00
Garrett Griffin	3c2b14aff5	feat(zig): mark CALLS edges inside comptime-false branches as staticGated (#3161) ... * feat(zig): static-gating analysis module + fixture (ported from feat/zig-static-gated-edges-v2) Squashes c6fe922c, 2f3c8e9e, fab088f4, 9b58af74, aef2ae83, 86b892ef, d5657861, f3780b3a: file-local comptime bool constants, cross-file flag resolution via the @import alias map, re-aliased const chains, == / != against known bools, else / else-if branch awareness. The module is self-contained; the hooks that call it land in the next commit. * feat(zig): stamp static-gated call sites through the scope pipeline Wires the ported gating module into the scope-resolution pipeline that now emits every Zig CALLS edge (PR #1432), replacing the parse-worker / call-processor hooks of the original branch, which targeted the legacy DAG path the merged provider no longer uses. Data flow, one new fact carried end to end: emitZigScopeCaptures stamps `@reference.static-gated` on a call capture whose anchor lies in a statically dead range (body of `if (CONST_FALSE)`, else of `if (CONST_TRUE)`), via the module's new `collectZigStaticGatedRanges` (line/col ranges, because a Capture keeps no node) scope-extractor marker -> `ReferenceSite.staticGated` buildReference -> `Reference.staticGated` references-to-edges, -> `GraphRelationship.staticGated` on the free-call-fallback, emitted CALLS edge (both emit paths, plus edges.ts (tryEmitEdge*) the generic bridge) local-backend impact -> `staticGated` on impact frontier edges Same marker idiom as Go's `@reference.callee-position` / `embedded-pointer`: zero-range, present or absent, so every ungated site's capture set is byte-identical and no other language changes. SCHEMA_BUMP 92 -> 93: parse-time captures changed. Cross-file constants (`if (cfg.FOO)` with `cfg = @import("cfg.zig")`) are NOT stamped yet: the module resolves them through `lookupBoolsForPath`, but the capture emitter runs per file in the parse worker with only `{ path, content }`, so it cannot see the sibling source. The two positive cross-file cases in zig-static-gating.test.ts are `it.skip` with that reason; the negative ones pass unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ciQ3MTjpQXkCoNntZR9zG * feat(graph): add staticGated edge property Adds an optional `staticGated?: boolean` field to `GraphRelationship` that flags edges originating in code branches known at index time to be unreachable in production — e.g. `if (CONST_FALSE)` blocks where the condition reduces to a comptime-known `false`. Schema + persistence wiring: - `gitnexus-shared/src/graph/types.ts` — additive optional field on `GraphRelationship`; absent edges read identically to live ones. - `gitnexus/src/core/lbug/schema.ts` — `staticGated BOOLEAN` column on the `CodeRelation` REL table. - `gitnexus/src/core/lbug/csv-generator.ts` — appends a `staticGated` column (0/1) to the `relations.csv` written for bulk COPY ingest. - `gitnexus/src/core/lbug/lbug-adapter.ts` — fallback per-row `MATCH ... CREATE` insert reads the optional column and threads it into the relationship properties. No language has populated this field yet — the Zig hookup lands in the next commit. Existing DBs need a re-index for the new column to appear; existing readers are unchanged because the field is optional and absent on every other language's edges. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> (cherry picked from commit c8cd5efe27a77a5d1b3f05e3f4e89069b5c6b19e) * fix(zig): gate bare literal branches; AND the flag over deduplicated free-call sites PR #3161 review, two findings: 1. `stampZigStaticGating` returned early when the file declared no boolean constants, but `collectZigStaticGatedRanges` also folds bare literals, so `if (false) { foo(); }` in a constant-free file went unstamped. The early return is gone; the range walk runs for every file. 2. `emitFreeCallFallback` deduplicates CALLS edges per (caller, callee) and wrote `staticGated` from whichever site it met first, so a callee reached from one live site and one dead site was gated or not by traversal order. Emission is now deferred to the end of each file's sites and the flag is the AND over every site that collapsed into the edge: one live site keeps the edge live. The other emit path keys its dedup on the site range and was not affected; `collapseByCallerTarget` in the generic bridge would have the same shape but no language that sets the marker opts into it. Fixture + tests: `gated_bare_literal`, `live_and_gated_same_callee` (live site first) and `gated_then_live_same_callee` (dead site first) in zig-static-gating.test.ts. All 70 resolver suites (3,603 tests) pass with the shared emitter change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ciQ3MTjpQXkCoNntZR9zG * test(zig): move the SCHEMA_BUMP pin to 93; rebaseline emit fingerprints for the staticGated column Three CI failures on f4954963, all consequences of this PR: - test/unit/incremental-parse-cache.test.ts pins SCHEMA_BUMP so concurrent bumps cannot collide; 92 -> 93 for #3161 (parse-time call captures gain `@reference.static-gated`), 92 added to the taken list. - bench/emit-persistence `measure.mjs --check` and `measure-streaming.mjs --check`: byte-identity fingerprints drift because every relationship row now ends in a `staticGated` cell. Regenerated with the inverse-operation evidence recorded under `_rebaselined_3161_static_gated_column` in both baseline files: stripping ONLY the new column from the emitted CSVs reproduces the prior fingerprints exactly (36 files, 3 rel_* files differ, 33 byte-identical; 36,000 PDG rows each +2 bytes), so no row moved between pair files or reordered. Timing and retention gates passed throughout. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ciQ3MTjpQXkCoNntZR9zG * docs(graph): state the CALLS contract on staticGated; say "provably unreachable at compile time" Review on #3161 (magyargergo): the flag must not redefine what a CALLS edge means. The field's doc now says so explicitly: CALLS still means "there is a resolved call site from A to B", never "B is reachable from A"; `staticGated` is additional, statically provable path-feasibility metadata, an opt-in analysis layer that no core pass acts on. The edge is emitted, persisted, traversed and counted exactly as before. Wording: "unreachable in production" -> "provably unreachable from the indexed source at compile time" on GraphRelationship, ReferenceSite and Reference. The index has no production build configuration and should not claim one. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ciQ3MTjpQXkCoNntZR9zG * feat(zig): surface staticGated on impact byDepth items; gate if-expressions and negated/parenthesized conditions Addresses the tri-review on #3161. - impact: the depth traversal already selected r.staticGated but dropped it when building the byDepth item. Forward it (present only when true) and document the field on the impact tool's byDepth contract. Traversal and ranking still do not act on it; that stays opt-in for consumers. - zig-static-gating: walk `if_expression` (`const x = if (c) a() else b();`) in addition to `if_statement`. The expression form has no field names and no else_clause wrapper, so the arms are located positionally (`ifExpressionArms`). Labeled-block arms are covered. - evalCond: `parenthesized_expression` is transparent, so `!(A and B)` and `((FLAG))` fold. Prefix `!` has no unary node in tree-sitter-zig; the header now says exactly which shapes fold instead of "simple negation". - fixture + tests: nine new cases (negation x2, parentheses x2, if-expression then/else/labeled-block x5). Cross-file `@import` constants remain skipped and now cite the tracking issue #3162. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ciQ3MTjpQXkCoNntZR9zG * refactor(zig): drop the unreachable cross-file gating builders; document the real wiring gitnexus-check on b77cb4ed: `buildZigImportAliasMap` / `buildZigRawImportAliasMap` and the per-call ancestor walk (`isCallStaticGated`, `ifBranchDirection`, `nodesEqual`) had no caller anywhere. They were ported from the legacy call-processor design; the scope-resolution provider stamps ranges via `collectZigStaticGatedRanges` instead, and nothing populates the cross-file seam yet (#3162). Remove them so the module exports only what runs. The evaluator keeps `importAliases` + `lookupBoolsForPath` (the seam #3162 will fill); the header now says so explicitly and points at the actual wire-up (`stampZigStaticGating` in languages/zig/captures.ts) instead of the retired `configs/zig.ts` hook. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ciQ3MTjpQXkCoNntZR9zG * refactor(zig): reuse descendantsOfType and tighten static-gated capture matching Walk if-nodes through tree-sitter instead of a hand-rolled stack, return the original capture array when nothing is gated, and register the marker as a known sub-tag so it cannot be mistaken for an anchor. Co-authored-by: Cursor <cursoragent@cursor.com> * style(zig): wrap a long else-clause assignment to satisfy prettier Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-03 19:49:16 +01:00
Navid EMAD	932d937085	feat: add Zig language support (#1432) ... * feat: add Zig language support Adds a Zig LanguageProvider grounded in @tree-sitter-grammars/tree-sitter-zig 1.1.2. The grammar's published peerOptional `tree-sitter@^0.22.1` is suppressed via an npm `overrides` entry that aliases the peer to the bundled `tree-sitter@0.21.x`; load-time smoke testing confirmed ABI compatibility. v1 capabilities: - .zig file detection + Prism syntax mapping - Top-level + nested function_declaration as Function/Method - struct/enum/union (anonymous in the grammar — owner name resolved from the enclosing variable_declaration in class/field/method extractors) - container_field as struct/union fields and enum variants - top-level const/var as Variable nodes - free + member call_expression as @call edges - @import("./foo.zig") local-file resolution; std and external packages return empty (no ghost edges) - pub keyword detection for export checking - no heritage hooks (Zig has no inheritance; queries never emit @heritage.*) Generic extractor changes (backward-compatible): - field-extractors/generic.ts and method-extractors/generic.ts: empty `bodyNodeTypes` falls back to the type declaration node itself as its own body container — needed because Zig's struct_declaration directly contains its container_field children. (The `extractOwnerName` hook this commit originally introduced now exists upstream; Zig just configures it.) Out of scope (deferred): - usingnamespace, build.zig.zon package graph, comptime/anytype - scope-resolution hooks (emitScopeCaptures, interpretImport, …): Zig is classified `experimental` and uses the generic fallback resolution path - cross-package imports (std, deps) Tests: - new fixture test/fixtures/sample-code/simple.zig - Zig describe block in tree-sitter-languages integration test - simple.zig added to parsing.test.ts fixture-existence list - Zig added to ingestion-utils detection unit test - Zig smoke case in parser-loader-abi.test.ts - Zig grammar registered in the grammar-literal validation gate * feat(zig): integrate build.zig.zon resolution + Union label from PR 1096 Ports the additive pieces of grgisme's standalone Zig provider PR (https://github.com/abhigyanpatwari/GitNexus/pull/1096) onto the rebased provider: - build.zig.zon `.path` dependency resolution for bare-name @import("pkg") (parseZigBuildZon / loadZigBuildZon in language-config.ts, resolveZigImportInternal in import-resolvers/zig.ts, wired through ImportConfigs.zigBuildZon). `.url` deps and repo-escaping paths return null cleanly. 13 unit tests. - `union(enum)` containers now produce `Union` nodes (not Struct): 'Union' added to ClassLikeNodeLabel + CLASS_LIKE_LABELS, the Zig query tags @definition.union, CONTAINER_TYPE_TO_LABEL maps union_declaration to 'Union'. The label was already plumbed graph-wide on main. - /^build$/ entry-point pattern (build.zig). - zig-basic lang-resolution fixture + resolvers integration test. Adapted to current main while porting: - labelOverride relabels container-nested fns Function → Method (mirrors isKotlinClassMethod); the structure phase no longer derives Method from the legacy method-extraction path for plain @definition.function captures. - IMPORTS/CALLS edges require scope-resolution hooks (emitScopeCaptures / interpretImport) since the legacy DAG removal; Zig does not implement them yet, so the integration test documents that with a skipped import-edge case. The resolver itself is wired into the resolver factory and becomes live when the hooks land. Not ported: named-bindings extractor (the legacy namedBindingExtractor API no longer exists) and the bespoke field extractor (the generic factory's extractOwnerName / empty-bodyNodeTypes hooks cover Zig). Co-authored-by: Garrett Griffin-Morales <grgisme@gmail.com> * feat(zig): scope-resolution hooks — IMPORTS and CALLS edges (Ring 3) Implements the registry-primary scope-resolution path for Zig, the prerequisite for cross-file edges since the legacy DAG removal. Adds the standard per-language stack under languages/zig/: - query.ts: scope query (containers as Class scopes, blocks, functions), declarations (container anchors placed on the container node itself so the def lands in its own Class scope and the name binding auto-hoists to the parent — populateClassOwnedMembers needs the class-like def among the class scope's ownedDefs), @import statements (#eq?-gated builtin), parameter/constructor type bindings, and call/constructor reference sites. The grammar is required lazily (optionalDependency). - captures.ts: emitZigScopeCaptures — groups query matches, drops the plain-variable group for container/import bindings (their dedicated rules bind the name), and relabels container-nested fns @declaration.function → @declaration.method (labelOverride parity). - interpret.ts: namespace-kind imports (const x = @import("…")) and type bindings — self-parameter convention marks the receiver, Zig sigils (*, ?, [], error unions, const) stripped from type names while dotted qualifiers (mod.T) are preserved for Case-3 namespace-prefix receiver dispatch. - simple-hooks.ts: parameter bindings stay function-local (Go rationale), local-over-import merge precedence, bounds-check arity (always 'unknown' today — no synthesized arity metadata). - scope-resolver.ts: emit-side wiring; build.zig.zon threads through loadResolutionConfig into the same resolveZigImportInternal the legacy resolver config wraps. fieldFallbackOnMethodLookup off (statically typed). Registered in SCOPE_RESOLVERS. The resolvers integration test un-skips the import-edge case and gains CALLS assertions: free call (main → helper) and receiver-bound method dispatch through a namespace-qualified constructor (var p = pioneer.Pioneer{…}; p.tick() → main → tick). * fix(zig): Union is class-like + missing-grammar warning (review pass) Self-review findings on the Zig branch: - scope/walkers.ts `isClassLike` and finalize-algorithm's CALLABLE_OR_TYPE_LIKE did not include 'Union': a `union(enum)` container's methods got no ownerId from populateClassOwnedMembers, so method dispatch on union receivers silently dropped. Widened both sets; the zig-basic fixture gains a Tag method + a CALLS assertion (main → isEnergy) that fails without the widening (verified by reverting). - optional-grammars.ts now lists tree-sitter-zig with an npm `probe` (it is an optionalDependency, not vendored): users with .zig files and no prebuild get the standard one-line stderr warning instead of a silently degraded index. - Deduplicated the container-method predicate: `isZigContainerMethod` + ZIG_CONTAINER_TYPES now live once in languages/zig/captures.ts and feed both the provider labelOverride and the scope-capture relabel. - README language matrices: Zig row now claims Type Annotations, Constructor Inference, and Config (build.zig.zon) — all true since the scope-resolution hooks landed. * fix(zig): anchor @declaration.variable to the binding identifier `(variable_declaration (identifier) @declaration.name)` matched EVERY identifier child of the node, so `const first = target;` also declared a phantom local named `target` in the enclosing block. That phantom shadowed the real function for later references (and starved callable-value-flow seeds of a target). The `.` anchor pins the pattern to the first named child — the bound name. Regression test in resolvers/zig.test.ts pins the capture set. * feat(zig): callable-value-flow captures + main's per-language conformance gates Post-rebase catch-up: since this branch forked, main added three "every registered language must appear here" tests. Each needs a Zig entry: - callable-value-flow (#2522): Zig now emits `@callable-flow.*` facts via `synthesizeCallableFlowCaptures` (ZIG_CALLABLE_CAPTURE_OPTIONS in zig/captures.ts). tree-sitter-zig's `call_expression` carries arguments as direct children with no wrapper node, which the shared helper could not decompose, so this adds a language-neutral `extractCallArguments` hook (mirror of `extractFunctionParameters`; `undefined` = shared path). Zig joins the provider matrix as 'matrix' with a real assign→copy→ argument→invoke case. - external-import-conformance (#2953): `@import("std")` beside a decoy `src/std.zig` resolves to nothing; the decoy stays reachable via the relative spelling. Zig holds the property (no suffix fallback), so it is a case, not a KNOWN_GAPS entry. - import-target-index-reuse contract (#2909): membership-probe-only fixture (minimumScans: 0, same shape as Rust). * fix(zig): address gitnexus-check review findings One commit per the bot's list so each item is easy to check off: - parser-loader: Zig row gains `userSkippable: true`, so `GITNEXUS_SKIP_OPTIONAL_GRAMMARS` (=1 or a list naming `zig`) disables it at analyze time like swift/dart/kotlin — as `optional-grammars.ts` already documented. Covered in parser-loader-skip-optional.test.ts. - export-detection: `zigExportChecker` stops at the first declaration it reaches. A non-`pub` fn inside `pub const T = struct {…}` was reported exported because the walk continued up to the wrapper. - import-resolvers/zig: a `.path = "."` dep normalizes to '' and no longer grows a leading slash (`/src/main.zig` could never match). - language-config: build.zig.zon parsing strips `//` comments string-aware (a `//` inside `.url = "https://…"` survives) and matches braces while skipping string literals, so a commented-out `.path` cannot declare a dep and a `}` in a comment/string cannot truncate the block. - method-extractors/configs/zig: the leading `self` receiver is excluded from `parameters` (Rust parity). Fixing that exposed a worse bug: the `parameters` node is a plain child of `function_declaration`, not a `parameters:` field, so `childForFieldName('parameters')` was always null and every Zig method had no parameters, no receiver and `isStatic: true`. One `zigParameterList` helper now feeds all three readers. - variable-extractors/configs/zig: container (`struct`/`enum`/`union`) and `@import` bindings are skipped via the same predicate the scope captures use (`isZigContainerOrImportBinding`), instead of the comment merely claiming they were. - tree-sitter-languages.test.ts: the "missing grammar" case now forces the absent-binding path through the loader's runtime opt-out on a fresh module instead of passing vacuously when the package is installed. New: test/unit/zig-extractors.test.ts (exports, receiver/parameters, variable guard); zig-import-resolver.test.ts gains the `.` dep, comment and brace cases. The `createFieldExtractor` heads-up needs no change: the added branch is unreachable for every existing config (none has empty `bodyNodeTypes`). * fix(zig): address second gitnexus-check review pass - import-resolvers/zig: `..` above the repository root now returns null instead of aliasing a same-named root file (`../bar.zig` from `main.zig` is not `bar.zig`); the stale "extension is stripped and re-added" comment is corrected to what the code does. - variable-extractors/configs/zig `extractType`: read the `type:` field only. The positional fallback returned the INITIALIZER of `const f = target;` as its type and gave up on compound annotations (`*Foo`, `?[]const u8`). The comment claiming 1.1.2 has no `type` field on variable_declaration was wrong (verified by AST dump) — and it is what led the review to suspect the callable-flow `extractAssignment` callback, which was already correct for `extern var f: T;`. - receiver detection: only a FIRST parameter named `self` is the receiver. `emitZigScopeCaptures` tags first-position parameters (`@type-binding.first-parameter`), `interpretZigTypeBinding` requires the tag as well as the name, so `zigReceiverBinding` no longer turns `fn f(a: u32, self: T)` into an instance method. - resolvers/zig.test.ts: both suites `describe.skipIf(!zigAvailable)` (Swift/Dart pattern) — the grammar is an optionalDependency. - tree-sitter-languages.test.ts: the Zig parsing case gates on `isLanguageAvailable` instead of a catch-all `return`, so an installed grammar that fails to load fails the test; comment no longer calls Dart and Swift npm optionalDependencies (they are vendored). - test/helpers/literal-collectors: `DIR_LANG` gains `zig`, so literals under `languages/zig/**` are validated against the Zig grammar alone rather than against every grammar. - walkers.ts `isShapeLike` doc: Union IS included (via isClassLike, wired by Zig's union member container); Typedef remains the only deferred one. - language-config `ZigBuildZonConfig.pathDeps` doc: values are the raw `.path` strings; the resolver normalizes. Tests: zig-import-resolver (+1), zig-extractors (+3). * fix(zig): address third gitnexus-check review pass - language-config `parseZigBuildZon`: the `.dependencies = .{` header and the per-entry `.<name> = .{` headers are matched only OUTSIDE string literals (per-offset string mask + `matchZonHeader`). A `.name` or `.description` value spelling `.dependencies = .{ .fake = .{ .path = … } }` used to be taken as the block and returned the fake dep instead of the real top-level one. - import-resolvers/zig: an absolute import (`@import("/foo.zig")`) returns null. The path walker skipped every empty component, so the leading `/` vanished and `/foo.zig` resolved as importer-relative `src/foo.zig` — an in-repo edge for an import Zig rejects as outside the module path. - tree-sitter-languages.test.ts: the Zig parsing case gates on the PACKAGE being installed (`createRequire().resolve`, minus a deliberate `GITNEXUS_SKIP_OPTIONAL_GRAMMARS` opt-out), not on `isLanguageAvailable`, which is false for absent AND for installed-but-broken bindings — so a load failure (ABI mismatch, bad export) now fails the test instead of skipping it, as the comment already claimed. - walkers.ts `isShapeLike` doc: `Union` sits in `isClassLike` because that is the label set the ownership walkers consult, not because unions inherit — Zig has no inheritance and no heritage hooks. The previous wording ("inheritance-capable owner") said otherwise. - Not re-fixed (already addressed in the second pass, findings carried over): "receiver = any parameter named self" — `interpretZigTypeBinding` only sources a first-position parameter as `self`; `zigReceiverBinding`'s doc now states that invariant. "`DIR_LANG` has no zig entry" — it does. Extended one level out: `BASENAME_LANGS` (`zig.ts`) and `PREFIX_LANGS` (`ZIG_`) map to the Zig grammar too, so extractor configs and the export-detection set are validated against Zig alone. That immediately caught a dead `childForFieldName('parameters')` in method-extractors/configs/zig `zigParameterList` (there is no such field; the named-child lookup was already the one doing the work) — removed. Tests: zig-import-resolver (+2: absolute path, header inside a string); both fail on the previous code. * fix(zig): address fourth gitnexus-check review pass - language-config: `parseZigBuildZon` only accepts a `.path` that is a DIRECT field of a dependency entry. Nested blocks inside the entry body are blanked (string-aware, offsets preserved) before the `.path` regex runs, and a match starting inside a string literal is rejected, so `.dep = .{ .url = "…", .meta = .{ .path = "x" } }` no longer becomes a path dep. Regression test in zig-import-resolver.test.ts (fails on the previous code). - tree-sitter-languages test: the "grammar is absent" case now drives the loader's real `source.load()` catch branch — `node:module` is stood in with a `createRequire` whose require throws MODULE_NOT_FOUND for `@tree-sitter-grammars/tree-sitter-zig` and delegates everything else — instead of the `GITNEXUS_SKIP_OPTIONAL_GRAMMARS` opt-out, which has its own test. It also asserts the opt-out flag is NOT set and that other grammars still load (non-fatal optional failure). Not re-fixed: - "Return type is read from the wrong tree-sitter field": tree-sitter-zig 1.1.2 has NO `return_type` field on function_declaration — the type after `)` is the `type` field (AST dump: `builtin_type "i32" field=type`; the proposed `childForFieldName('return_type')` is null for every function). A pin test in zig-extractors.test.ts asserts both the grammar fact and that `returnType` is extracted (`void`, `!*Counter`). - "`DIR_LANG` has no zig entry": it does (added in the first pass and answered again in the third); the finding is carried over unchanged. * fix(zig): address fifth gitnexus-check review pass - tree-sitter-languages test: the Zig "functions, structs, enums, and imports" case now asserts the `import.source` capture for `const std = @import("std");` (the fixture's only import), so a query change that drops Zig import matching fails it instead of passing unchanged. Not re-fixed: - "Return type is read from the wrong tree-sitter field": carried over from the fourth pass unchanged. tree-sitter-zig 1.1.2 has no `return_type` field on function_declaration; the return type IS the `type` field, and the pin test added in the fourth-pass commit (zig-extractors.test.ts, `childForFieldName('return_type')` is null, `returnType` = `void` / `!*Counter`) proves it. - "`DIR_LANG` has no zig entry": carried over unchanged for the third time; the entry exists since the second-pass commit. * feat(zig): export fn visibility, opaque containers, named test blocks, member ownership Ports the parts of upstream PR #305 (closed, unmerged) that our Zig provider lacked, plus two gaps found while porting. - `export fn` / `export var` (C-ABI linkage, never `pub`) are exported; the pub/export predicate is now shared by the export checker and the method/variable extractors' visibility (`hasZigVisibilityKeyword`). - `const H = opaque { … }` is a Struct-labelled container (it may own methods, never fields) in both the structure queries and the scope query; ZIG_CONTAINER_TYPES is the single source for the extractor configs. - `test "name" { … }` blocks are Function nodes named by the string node WITH quotes, so `test "add"` beside `fn add` cannot merge onto Function:<file>:add; `test_declaration` joins FUNCTION_NODE_TYPES and the Zig method config names it in the enclosing-function walk, so calls inside a test attribute to the test. Anonymous `test {}` and decl-tests `test add {}` are scopes without a node (an empty-name hook result stops the walk instead of falling through to the identifier of the function under test). - Empty container bodies (`struct {}`, `opaque {}`) no longer mint a nameless Property: tree-sitter-zig 1.1.2 recovers them as a container_field with a MISSING identifier; #not-eq? guards in both queries and the field extractor drop it. - Owner walk (`findEnclosingClassInfo`): an anonymous container bound by the enclosing `variable_declaration` takes the binding identifier, same shape as the Go `type_spec` branch. Before this NO Zig member had an owner — zero HAS_METHOD / HAS_PROPERTY edges for Zig. Not ported from #305, deliberately: `builtInNames` (a bare-name call-site drop filter; `alloc`/`free`/`append`/`print` are the most common user method names in Zig and `std.*` receivers are already external via the import binding), `usingnamespace` (removed in Zig 0.15), `@cImport`, `build.zig` ignore, and the web-app changes. * test(zig): absent-grammar case owns GITNEXUS_SKIP_OPTIONAL_GRAMMARS The loader parses the opt-out variable lazily once per module copy, so under `GITNEXUS_SKIP_OPTIONAL_GRAMMARS=zig` (or `all`) — a supported way to run — the fresh loader took the opt-out branch and the "not the opt-out path" assertion failed before the absent-binding path ran. Clear the variable for the fresh module and restore it in `finally`, instead of returning early: the branch stays exercised in every environment. Verified: fails on the previous code under `=zig`, passes with and without the variable now. * fix(zig): declare the Union relation pairs — analyze aborted on any union `gitnexus analyze` exited 1 on every Zig repository that declares a `union` (including the zig-basic fixture itself): the member-ownership commit made `union_declaration` a MEMBER_OWNER, so HAS_PROPERTY / HAS_METHOD edges are emitted FROM a Union node, but `Union` was not in LINKABLE_LABELS, so the schema's scope-bridge cross product never generated a `FROM Union` pair and LadybugDB rejected the edge (`labelPair: "Union|Property"`). Resolver tests stayed green because they never write to the DB. - `Union` joins LINKABLE_LABELS (also bridges `Tag{…}` constructor references); the three hand-written `→ Union` target pairs move to the generated half, per the STRUCTURAL_PAIR_DDL rule. - structural-pair-coverage gains an optional-grammar corpus with zig-basic (`Union|Property`, `Union|Method` sentinels), skipped when the grammar is absent. - Rust `union_item` note updated: the three gates it cited are widened. Note for reviewers: the DDL fingerprint changes (#2808), so existing indexes are rebuilt on next analyze. * feat(zig): resolve path deps through the dep's build.zig and src/root.zig The bare-name resolver only knew `src/<name>.zig` and `src/main.zig`. `zig init` has written `src/root.zig` for libraries since 0.12, so the default library layout never resolved. Now: the root the dep's own build.zig declares (`b.addModule("<name>", .{ .root_source_file = b.path("…") })`, name-matched module first), then src/root.zig, src/<name>.zig, src/main.zig. `normalizeZigDepPath` is shared by the loader and the resolver. * feat(zig): Const/Variable defs, member imports, receiver typing, generic type constructors Coverage gaps found by indexing idiomatic Zig against the branch: - Const / Variable nodes: ZIG_QUERIES had no @definition.const / @definition.variable, so `pub const VERSION`, error sets and type aliases were absent and zigVariableConfig never ran. Rules are gated on the literal `const` / `var` keyword — tree-sitter-zig 1.1.2 parses statement assignments (`x = 5;`, `x += 1;`, `_ = expr;`) as keyword- less `variable_declaration`s, and the scope query minted a phantom local per assignment and one `_` per discard. Container and @import bindings are skipped via `shouldSkipDefinitionCapture`. - Imports: `const X = @import("x.zig").X` (named / alias), `const X = ns.X` where `ns` is an @import binding of the file (promoted to a named import), and `pub usingnamespace @import(...)` (wildcard, with `expandsWildcardTo`). All three lost the file-level IMPORTS edge. - Receiver typing: `var x: T = undefined` / decl literals `const x: T = .init()` (annotation), `var c = T.init()` / `mod.T.init()` (call return), `List(u8){}` (instantiation literal); `normalizeZigTypeName` drops the comptime argument list. - Generic type constructors `fn List(comptime T: type) type { return struct {…}; }`: the returned container is a Struct/Union/Enum named after the fn, owns its members (HAS_METHOD / HAS_PROPERTY), binds in the module scope beside the Function def, and is emitted ahead of it so a named import binds the type. - `export` vs `pub`: `visibility` is now `pub`-only (Zig-module fact); `isExported` keeps `pub|export` (visible outside the unit, as C's external linkage). `export fn` without `pub` is not reachable from other Zig files. - Extractor configs share `zigContainerName`; ast-helpers' owner walk learns the type-constructor shape. Tests: zig-idioms fixture (10 resolver cases), extractor/interpret unit cases for each rule. * fix(zig): address sixth gitnexus-check review pass - Windows absolute `.path` deps (`C:\x`, `C:/x`) return null from `normalizeZigDepPath` like POSIX ones; a `/`-only check let them through as repo-relative. - `parseZigBuildZon` accepts the `.dependencies = .{` header only at brace depth 1 (a direct field of the file's `.{`), so a same-named field nested in an earlier struct cannot hijack the block. - `importsExecuteWhereWritten: false` on the provider: `@import` is compile-time name lookup (as C `#include`, Rust `use`); a body-level `@import` is no longer marked `runsOnlyWhenCalled`. - Namespace imports record the MODULE as `importedName` (`zigModuleNameOf`: last path segment without `.zig`), per the shared contract; the local handle stays `localName`. - Keyword-less `<ident> = @import(…)` (`_ = @import("x.zig")` in a test block) is a `side-effect` import: file edge, no binding. Only `const`/`var` declarations bind a name or feed alias promotion. - `extractZigFunctionName` doc: an empty name is falsy, so the enclosing- function walk skips the test node and continues to the File; it does not "end" there. Not re-fixed: "DIR_LANG has no zig entry" — carried over for the fourth pass in a row; `test/helpers/literal-collectors.ts` has had `zig` in `DIR_LANG` (line 91) and `BASENAME_LANGS` since the second-pass commit. Regression tests: absolute-path spellings, nested `.dependencies` decoy, namespace/side-effect interpretation, function-scoped `@import` not deferred (all four fail on the previous source). * fix(zig): address seventh gitnexus-check review pass - The scope query's `@import` binding rules are keyword-gated (`"const"` / `"var"`, first-child anchored) like every other binding rule, and the keyword-less `<ident> = @import(…)` statement has its own `@import.side-effect` rule. Tree-sitter queries cannot express "no keyword child", so that rule also matches the keyword shapes and `emitZigScopeCaptures` drops those (they are the binding rules' matches). Behaviour is unchanged from the sixth-pass fix — the existing side-effect test covers it — the query text now carries the guard the finding asked for. Not re-fixed: "DIR_LANG has no zig entry" — fifth pass in a row; `test/helpers/literal-collectors.ts` has had `zig` in `DIR_LANG` since the second-pass commit. Left for a human reviewer to close. * fix(zig): resolve @import of the repo's own build.zig modules (F3) Bare-name imports were resolved through build.zig.zon path deps only, so the module a repo's ROOT build.zig declares for itself — `b.addModule("lightpanda", .{ .root_source_file = b.path("src/lightpanda.zig") })`, imported by name from 378/567 Lightpanda files — never produced an IMPORTS edge, and nothing reached through `lp.X` resolved. A repo with a build.zig but no build.zig.zon got no resolution config at all. - language-config: `parseZigRootModules` (static scan of the root build.zig: `addModule("<name>", …root_source_file = b.path("<p>.zig")…)`, and `createModule`/`addModule` bindings named via `addImport("<name>", m)` or `.imports = &.{ .{ .name, .module = m } }`; generated / `.url` / computed modules are skipped) → `ZigBuildZonConfig.rootModules`. - `loadZigBuildZon` → `loadZigBuildConfig`: reads the zon AND the root build.zig; null only when neither contributes. - resolver: root modules are consulted before path deps; std/builtin/root still never resolve. - fixtures: zig-idioms gains a Lightpanda-shaped root module (+ decoy `addOptions().createModule()`); new zig-rootmodule (build.zig, no zon). Corpus (Lightpanda): IMPORTS 3014→3389 (378 edges to src/lightpanda.zig, was 0), CALLS 13885→13989, ns.f() 79.3%→83.3%, param.m() type=ns-qualified 43→46/417. * fix(zig): import every @import in expression position; resolve @import("x").f() Both query sets only saw `@import` as the value of a const/var or under `usingnamespace`, so an @import in any other position produced no file edge: Lightpanda's `pub const Interfaces = .{ @import("a.zig"), … }` registration table (288 modules), call arguments (`CounterEnum("size", @import("ArenaPool.zig").BucketSize)`), comparison operands (`JsApi == @import("x.zig").JsApi`) and member-call receivers (`try @import("dump.zig").root(...)`) — 417 of 3,401 in-repo import pairs had no IMPORTS edge, and the 80 inline-receiver calls resolved 0 times. Scope query: a catch-all `@import.inline` rule matches every `@import` builtin; `emitZigScopeCaptures` drops the ones a binding rule (or the keyword-less side-effect rule) already claimed (by string-node id) so a bound import is never doubled, emits the rest as side-effect imports once per distinct source per file, and binds a member-call receiver as a namespace import whose local name is the builtin's own text — the `@reference.receiver` text on that call is identical, so the shared namespace-receiver lookup (Case 1) resolves the member in the imported module. ZIG_QUERIES: the three variable_declaration/usingnamespace-anchored `@import` rules collapse into the same single builtin rule (the structure phase only skips import matches; one match per builtin keeps tree-sitter-languages' exact-capture assertion intact). Lightpanda corpus (zig-corpus-check, before → after): IMPORTS 3014 → 3426, in-repo pairs missing 417 → 5 (4 under a default-ignored `cache/` dir, 1 a commented-out import the census regex counts), `@import(..).f()` 0/80 → 72/80 (the 8 left are `@import("root")` and non-import builtins the census mislabels), CALLS 13885 → 13959; every other line unchanged. * feat(zig): model file-structs — a file with top-level fields is a Struct named after the file In Zig every file is a struct; one that declares top-level fields is an instantiable type whose name is the file stem (`Page.zig` declares `Page`, `@typeName` agrees), and its top-level `fn`s taking `self` are its methods. Lightpanda spells 413 of 567 files this way and, before this, `page.getArena()` on a `page: *Page` parameter resolved 23 of 993 times (2.3 %) — `impact` on `Page.getArena` reported 0 callers for 159 call sites, and 2,395 top-level fields were ownerless Property nodes. Definition phase: `((source_file (container_field …)) @definition.struct)` + the class extractor names it from the file path (`zigContainerName(source_file, filePath)`); top-level fns/fields are owned through the new `LanguageProvider.resolveFileTypeOwner` hook (consulted by `findEnclosingClassInfo` when the walk reaches the tree root, and by the method/field extractors' owner lookup) — ids become `Method:<file>:Page.getArena#0` / `Property:<file>:Page.session` with HAS_METHOD / HAS_PROPERTY edges. Scope phase: `emitZigScopeCaptures` emits a Class scope over the whole file (same range as the Module scope, nested under it — the pair `canParentScope` already admits) plus a Struct def anchored on it; member NAME bindings are hoisted back to the Module scope by `zigBindingScopeFor` so `Page.init()` (namespace member) keeps working, while ownedDefs stay in the Class scope so `populateClassOwnedMembers` stamps the owner. The file-level `const Page = @This();` alias no longer mints a Const (it would shadow the Struct); `@This()` aliases in type position (`self: *SigHandler` in Sighandler.zig, nested `Self`) are rewritten to the container name so receivers resolve. A namespace import of a `.zig` file gets a NAMED twin of the file stem so `x: *Page` in the importer binds the type as well as the module. Shared, additive: `resolveFileTypeOwner` hook; `filePath` threaded to `ClassExtractionConfig.extractName` / `extractOwnerName`; nameless `definition.struct` passes `getLabelFromCaptures` like `definition.class` already did (extractor synthesizes the name). Lightpanda corpus (zig-corpus-check): param receivers typed by a file import 23/993 → 993/993; `self.m()` 99.2 → 100 %; annotated locals 11.6 → 23.2 %; CALLS 13,885 → 15,689; HAS_METHOD 1,477 → 8,003; ownerless Property 2,395 → 276; Function/Method 8,378/1,518 → 2,562/7,330; no row regressed. Fixture `zig-filestruct` (Page/Session/Sighandler/util) + unit tests pin the shape, the stem naming, the alias rewrite, the namespace twin and the unchanged namespace-file behaviour. * test(zig): expression-position import case sees the file-struct type twin * fix(zig): stop reading member calls `x.f(arg)` as direct calls named `f` tree-sitter-zig spells `field_expression` as `object:`/`member:`; the shared callable-flow reader only knew `property`/`field`/`method`, so every Zig member call collapsed to a DIRECT call named after the member and the solver fanned each argument out to every same-named callable (4,761 cap warnings on Lightpanda, `Global.deinit -> Global.deinit` self-loops through `pub const release = deinit;`). Shared (grammar-neutral, receiver-gated): - `memberParts` also reads `member` (only C/C++ `offsetof_expression` and JS `class_body` expose that field, without a receiver field). - A member call is a field-stored-callable invoke only when a MEMBER store (`o->run = handler`, `self.f = target`) or a declared callable-typed field is visible — a same-named plain binding no longer gates it. - `direct-callee-name` requires a direct designator: `.init(x)`, `' '.join(x)`, `string.Join(x)` name no callee to seed by simple name. Zig: formals are numbered without the leading `self`, so `r.run(target)` joins `cb` and yields `Runner.run -> target`. Goldens for python/csharp regenerated: the only drift is the dropped `direct-callee-name` on `' '.join(...)`, `text.strip().ljust(...)`, `string.Join(...)`. Lightpanda: cap-warnings 4761 -> 2, cvf self-loops 10 -> 0, CALLS 13885 -> 13857 (28 removed, all callable-value-flow: 10 self-loops, 17 same-name fan-out, 1 lost `on -> TypeErased.start`; +1 correct `Arena.alloc -> allocator`). * fix(zig): bind container field types so `self.field.m()` resolves (F5) A container's field types were never bound on its Class scope: the scope query's `container_field` rule captured only the name, and `emitZigScopeCaptures` synthesized no `@type-binding.field` group. The compound resolver reads member types from that scope (`typeOfMemberOnClass` → `classScope.typeBindings.get(field)`), so `self.session.name()`, `self.counter.incr()` — Lightpanda's dominant cross-object call shape — resolved 9 of 2803 times (0.3 %). - query.ts: capture `type: (_)? @declaration.field-type` on `container_field` (enum variants have none). - captures.ts: per typed field, push a `@type-binding.field` group (name = field, type = the type text, `@This()` aliases rewritten to the container name like parameter types); anonymous inline containers are skipped. The binding lands on the container's Class scope — the file's Class scope for a file-struct — since `zigBindingScopeFor` hoists only declaration names. - query.ts/captures.ts: `const page = self.page;` / `var s = self.session;` one-level field aliases become `@type-binding.alias` bindings whose "type" is the RHS path; the resolver's member-alias branch re-resolves it as a receiver chain. Import aliases (`const Counter = counter.Counter;`) are dropped — they are named imports. - interpret.ts: `@type-binding.field` → 'annotation', `@type-binding.alias` → 'assignment-inferred' (an annotation on the same binding wins). Corpus (Lightpanda, zig-corpus-check): self.field.m() 11/2803 (0.4 %) → 1433/2803 (51.1 %); ident.m() bound=local-field-access 29/1902 (1.5 %) → 307/1902 (16.1 %); chain.m() 146/5022 (2.9 %) → 642/5022 (12.8 %); CALLS 15838 → 18066. self.m() / free f() / ns.f() unchanged. Tests: unit (zig-extractors) — one @type-binding.field per typed field with sigils stripped and aliases rewritten; the binding hosted on the container's Class scope (file-struct: the file's Class scope, not Module) with the written spelling as declaredSpelling; field aliases bound to the RHS path and never for import aliases. Integration (zig-idioms `holder.zig`, zig-filestruct `Page.zig`): `viaField → incr` ×2 into counter.zig, `viaAlias → get/twice`, `sessionName → name` / `sessionLabel → name` into Session.zig. All fail without the change. The optional-payload capture `if (self.opt) |c| c.incr()` is not asserted (F6). * fix(zig): `pub const X = @import(…)` at file scope republishes X (reexportsName) Lightpanda's `lightpanda.zig` is one long list of `pub const Arena = @import("Arena.zig");`, and most files name their types through it (`const lp = @import("lightpanda"); const Arena = lp.Arena;`, `arena: *lp.Arena`). The scope side treated those bindings as plain imports of the hub file, so the hub never published the names it re-exports and a third file's `const Arena = lp.Arena;` (promoted to a named import of `Arena` from the hub) found nothing. `emitZigScopeCaptures` now marks named/alias import groups whose declaration is a file-level `pub const` — the `@import(...).X` form, the alias promotion `pub const Bar = ns.Bar`, and the file-struct type twin of `pub const Arena = @import("Arena.zig")` — and `interpretZigImport` sets the shared contract's `reexportsName: true` on them (the Python `__init__.py` shape, consumed by `buildReexportClosures`). Private and fn-local bindings stay unflagged. Not covered here: a receiver ANNOTATED with the dotted hub path (`arena: *lp.Arena`) — Case 3 of the receiver-bound pass looks the member up with `findExportedDef`, which only sees locally declared names; following re-exports there is a shared change left for a follow-up. * fix(zig): type receivers through `const X = <type expr>;` aliases (F7) `const LocalAlias = Local;`, `const T2 = Thing;` (alias of an alias/import) and `const B = util.List(u8);` (an INSTANTIATED generic type constructor) were plain `@declaration.variable` bindings, so `LocalAlias.mk()`, `var l = LocalAlias.mk(); l.go()`, `T2.make()`, `B.init()`, `B{}` and `var x: B` all typed nothing (review repro r3-flow b1..b9; Lightpanda: `pub const Proto = HtmlElement;` x68, `const Allocator = std.mem.Allocator` x104, `pub const KeyIterator = GenericIterator(...)`, fn-local `const R = ...(...)`). Model: a `@type-binding.alias` binding of the alias NAME to the value's type text — Rust's `let x = y` / JS's `const B = Foo`, source 'assignment-inferred' — NOT a TypeAlias def. Reasons: (1) the shared machinery already chains typeBindings (`followChainedRef` in the extractor, `followChainPostFinalize` after propagation), so `var l = LocalAlias.mk()` and `var x: B` reach the target through the alias with no new shared code; (2) nothing shared follows a `TypeAlias` def to its target — `isShapeLike` only makes the alias itself a member owner (TS object-type aliases) — so a relabel would have needed language-named shared code; (3) graph node ids are UNCHANGED: every alias stays `Const:<file>:X`. `normalizeZigTypeName` already drops the comptime arguments, so `util.List(u8)` binds `util.List` and resolves through the namespace import (Case 3). The identifier / member shapes also take `var` (`var cur = orig; cur.go()` — the cursor idiom, same binding as Rust's `let x = y`). Heuristic, stated as such: a CALL value is kept only when the callee's last identifier is TitleCase (Zig's naming convention for types), because the grammar cannot tell `util.List(u8)` from `util.makeThing()` and the latter belongs to the call-return rules; the call-return group is dropped for the same TitleCase shape so the two never race on match order. Import bindings (`const Stack = @import("x.zig").Stack`), promoted namespace-member aliases, enum/decl literals (`.foo`) and the `type:` annotation of `var b: T = undefined;` are excluded. Not done: the two-hop `pub const bridge = js.Bridge(T); bridge.accessor()` chain. `js.Bridge` is a Function that RETURNS `bridge.Builder(T)` (a call, not a container), so the alias binds `js.Bridge`, Case 3 finds a Function with no members in js.zig, and Case 3b is skipped for a namespace head. Following that hop needs a namespace-member return-type route in shared code (or a Zig `resolveQualifiedReceiverMember` hook that re-implements member lookup without the model); left for a follow-up. Corpus (Lightpanda, `harness/zig-corpus-check.mjs`): CALLS 15838 -> 16051 (+213, 0 removed), `ident.m() bound=local-alias` 6/63 -> 36/63, `local-call` 159 -> 176, `module/unknown` 110 -> 116, `local-other` 271 -> 273; `self.m()`, `free f()`, `ns.f()` unchanged or up. * fix(zig): one alias rule set — F7's alias rules subsume F5's field-access alias rules * fix(zig): type locals through try/catch/orelse, return types and payload captures F6 of the gitnexus-check review. Three gaps in the value flow that types a local receiver, all measured on Lightpanda: 1. `@type-binding.call-return` needed the `call_expression` as the DIRECT value child, so `const p = try Page.init(…)` (2,551 sites), `… catch return` (410) and `… orelse return` typed nothing. The rule is now one keyword-gated declaration match; `emitZigScopeCaptures` unwraps `try`, `catch`, `orelse` and parentheses (`zigUnwrapValue`) and decides what the value types (`zigCallReturnTypeOf`): a module-level receiver still names the type (`Counter.init()` → Counter, Rust `Foo::new()`); a free call binds the callee name (`makeThing`); a member call on a fn-LOCAL receiver (parameter / local / payload — Zig forbids shadowing, so "declared in the fn" is exact) binds the compound `node.asElement()` the shared resolver walks to the method's return type — instead of typing `el` as `Node`. A TitleCase callee (`List(u8)`) is a type constructor and binds nothing. 2. No `@type-binding.return` existed. `fn make() !*Thing` now binds `make ↦ Thing` in the enclosing scope (Module for free fns, the container's Class scope for methods, where the compound resolver reads it). Builtins, `type`, `@TypeOf(…)` and comptime type parameters (`?*T`) bind nothing; `@This()` / `Self` returns name the container. `normalizeZigTypeName` now strips the error union BEFORE the payload's sigils, so `Allocator.Error!*Page` → `Page` (it used to leave `*Page`). 3. Payload captures had no binding at all. `populateZigRangeBindings` (registered as `populateRangeBindings`) types `for (items) |it| / |*it|`, `for (items, 0..) |it, i|`, `if (opt) |v|`, `if (call()) |v|`, `while (it.next()) |x|` from the SUBJECT's written type minus one layer (`[]T` element, `?T` payload) — declining when the layer is not visible (`ArrayList(T)`) — and the same projection for `const t = items[i]` / `opt.?` / `ptr.*`. `catch |err|` and `switch` prongs are skipped. Corpus (Lightpanda, gate before → after): CALLS 15838 → 17853; `ident.m() bound=local-try/catch/orelse` 11/1298 → 584/1298; `local-call` 159/1282 → 398/1282; `payload` 82/1085 → 233/1085; `other-recv:call_expression` 5/991 → 457/991; `local-other` 271 → 364; `self.m()` 100 %, `free f()` 97.5 %, `ns.f()` 83.4 % unchanged; nothing down. Not covered: `const t = ns.f()` (a namespace fn's return type across files — Case 3 has no path from a namespace head to a callable's return binding), and expression receivers (`items[i].run()`, `o.?.run()`). * fix(zig): resolve leftover fixture merge markers (Page.zig) * fix(zig): reconcile F6 value inference with F7 aliases and F5 field bindings - A fn-local TitleCase receiver (`const R = generic.List(u8); var l = R.init();`) is a type alias (F7), not a value local: `R.init()` names the type `R` like `Counter.init()` does at module level, so `l` chains R → util.List → push. F6's local-receiver rule now excludes TitleCase heads. - The F6 unit helper only collects the value-inferred / return kinds it owns; F5 field and F7 alias bindings for the same names are asserted in their own suites. * fix(zig): give function-local and anonymous containers an identity (F8) `const R = struct {…}` declared inside a fn (Lightpanda's reflection.zig has ~20, one per builder) all collapsed onto one `Struct:<file>:R` with one `R.get`; anonymous containers (`std.sort.pdq(…, struct { fn lessThan … } .lessThan)`, `const byte_size = struct { fn it … }.it;`, `?struct { min, max }` field types) had no identity at all, so their fns were OWNERLESS Methods (`Method:<file>:lessThan#3`) that collided across a file. `zigContainerName` now yields the graph IDENTITY on both phases: - function-local named: `<enclosing callable>$<name>` — `Reflect.string$R` (Java local-class `$` chain; `populateClassOwnedMembers` leaves it whole); - anonymous: `<host>$<ordinal>` — `build$1`, `Outer$1`, `Page$1` (javac's `Outer$1` numbering per host, in source order); - a `test` host is keyed `test@L<line>` (its string does not survive the class extractor's qualified-name normalization). `zigContainerBindingName` keeps the spelling code writes (`R`) for scope bindings and `@This()` alias rewrites (`@declaration.binding-name`). Structure phase: bare `(struct|enum|union|opaque_declaration)` rules mint the local/anonymous nodes via the class extractor; `shouldSkipDefinitionCapture` keeps exactly one rule per container (`zigContainerAnchor`); a new grammar-neutral `resolveContainerTypeOwner` provider hook lets the shared owner walk name a container from context, so `Method:<file>:Reflect.string$R .get#0` and its HAS_METHOD source agree by construction. Scope phase: the wrapper group splits name/binding-name for locals and anonymous containers get synthesized `@declaration.<kind>` defs (`is-synthetic`). Lightpanda: ownerless Methods 14 → 0, fns without a node 55 → 0, ownerless Properties 276 → 5, HAS_METHOD 8003 → 8074, HAS_PROPERTY 7275 → 7403, CALLS 15838 → 15857, Struct 1905 → 2199; no resolution bucket dropped. * fix(zig): re-add the implicit receiver on the call side so both method-call spellings reach the callback formal `extractFunctionParameters` sliced the leading `self` off the formals, which lined up `r.run(target)` (target@0 ↔ cb@0) but lost the explicit spelling `Runner.run(&r, target)` (&r@0, target@1 ↔ cb@0): the callback never joined its formal and `run → target` was missing (PR #1432 review by koriyoshi2041). Formals are numbered once per function while the receiver differs per call shape, so the fix lives in `extractCallArguments`: keep `self` as formal 0 and prepend the receiver as actual 0 when the callee is a member call on a VALUE receiver — chain head is a fn-local name that is not TitleCase, the same value-vs-type rule F6 uses. Namespace / type / decl-literal receivers (`Runner.init(cb)`, `helpers.apply(cb)`, `List(u8).init`, `.init(cb)`) get no prepend. Known residual gap, documented: a module-level value receiver (`global_runner.run(cb)`) is not fn-local and still misses. Tests: the F2 integration case now asserts both spellings plus a namespace call; the unit contract pins `self@0, cb@1` and the per-call actual index. * fix(zig): address eighth gitnexus-check review pass - Named dependency modules: `parseZigBuildModuleRoots` scanned `addModule("<name>", .{ … })` with a `[^}]*` regex, so a nested field before `.root_source_file` (`.imports = &.{ .{ … } }`) ended the match at the inner `}` and demoted the module to an unnamed fallback — the first exe/lib root in the file then answered `@import("<name>")`. The named lookup now walks the balanced `addModule(…)` argument list (same scanner as `parseZigRootModules`, comment-stripped, string-aware); the unnamed fallbacks are unchanged. Regression test in `zig-import-resolver.test.ts`. - Type-position `@import`: `var x: @import("m.zig").T = undefined;` was read as an import binding of `x` on both sides — the query rules match the `type:` child like a value, and `isZigContainerOrImportBinding` scanned every named child — so `x` was never declared and became a named import of `T`. The helper now skips the `type:` field, and `emitZigScopeCaptures` drops binding-rule matches whose `@import` sits in the annotation (`isZigTypePositionImport`) without claiming the source, so `x` binds as a variable and the file edge survives as a side-effect import. Regression tests in `zig-extractors.test.ts` (variable extractor + scope captures). - Union in the class-capture skip guard: the parse-worker's inline class-like predicate lacked `Union`, so a `Union` definition bypassed `shouldSkipClassCapture` unlike every other `ClassLikeNodeLabel`. Added the label; no Zig behavior changes (Zig defines no skip hook), so no test. - File-owned method ids in `findEnclosingFunctionId`: the arity lookup used `findEnclosingClassNode` while the owner came from the file-owner aware `cachedFindEnclosingClassInfo`, so a Zig file-struct's top-level fn produced `Method::Page.get` without the `#<arity>` suffix. It now uses `findEnclosingClassNodeOrFileOwner`, the definition-phase lookup. Consistency fix only: `ParseWorkerResult.calls` / `.assignments` (the sole consumers of this id) are merged but not read since #942 — CALLS edges come from the scope pipeline, whose ids were already right — so no observable graph change and no test. Not re-fixed: - `test/helpers/literal-collectors.ts` `DIR_LANG` has no `zig` entry (raised for the seventh time): the entry exists (`zig: SupportedLanguages.Zig`, added by the second-pass commit), so `languages/zig/**` literals are already validated against the Zig grammar alone; documented in the PR body since the fifth pass. * fix(zig): keyword-gate the constructor type-binding rules The three `@type-binding.constructor` rules (`const p = T{…}`, `mod.T{…}`, `List(u8){…}`) matched any `variable_declaration` with an identifier and a `struct_initializer`, keyword or not — and tree-sitter-zig 1.1.2 parses a re-assignment `p = T{…};` (and `_ = T{…};`) as the same node type. So an assignment minted a constructor binding for `p` in its own block, and one for `_`. Zig's static typing makes the extra binding redundant (`p` already carries its type from its declaration: annotation, constructor or inferred value), so it cost little, but it declared nothing and stood out against every other binding rule (`@declaration.variable`, the import rules, the call-return rules), which are keyword-gated for exactly this shape. Split each rule into `"const" .` / `"var" .` variants, like the call-return rules. Regression test in `zig-extractors.test.ts`: `p = T{…}`, `q = mod.T{…}`, `l = List(u8){}` and `_ = T{…}` after their declarations yield only the three declaration bindings (fails on the previous query). The zig, callable-value-flow, grammar-literal and tree-sitter-languages suites are unchanged. Raised twice by gitnexus-check (passes on 2026-08-18 12:42 and 12:56). * fix(zig): re-baseline the callable-flow capture fingerprints, keep `await f<T>(x)` a direct callee The `benchmarks (GITNEXUS_BENCH)` CI job gates two capture fingerprints that this branch's shared callable-flow change (3e62b99a) moved without re-baselining: `bench/python-scope/baseline-fingerprint.txt` and four languages in `bench/scope-capture/baselines.json` (csharp, cpp, typescript, kotlin). Both `--check` runs pass on origin/main and failed on this branch; every other language matched its baseline on the same run. Drift, verified by dumping the canonical matches on both trees: - csharp / kotlin / python: exactly the intended change — a MEMBER call (`string.Join(x)`, `.forEach { }`, `' '.join(x)`, `.ljust(w)`) no longer carries `direct-callee-name`; the argument fact is unchanged. - cpp: `choice.select(1)` (cpp-deleted-overload) drops an INDIRECT invoke + its synthetic `@reference.call.free` that were gated only by the same-named free `select` binding; the site is a genuine method call already captured as `@reference.call.member`. capture_groups_fp 4605 -> 4601. - typescript: `await svc.verify<T>(x)` (member) and `initializer()(cb)` (call-of-call) drop the name as intended. But `await verifyToken<T>(x)` — a DIRECT call — lost it too, because tree-sitter-typescript parses `await f<T>(x)` as `call_expression(function: await_expression(f), type_arguments, …)` and the new direct-designator gate saw an await_expression, not `f`. `wrappedExpression` now unwraps `await_expression` (no named field, so the field-based unwrap missed it), restoring parity with main for the direct spelling while the member spelling stays nameless. Regression test added; it fails without the unwrap on both assertions. Gates run locally: scope-capture --check (15 languages), python-scope --check, import-target --check, tsc, eslint, prettier, the callable-flow / golden / tripwire / resolver test files (33 files), full suite with coverage (82.9/71.5/89.1/86.4 vs 26/23/28/27 thresholds). * test(zig): fail CI when the optional Zig grammar is absent `@tree-sitter-grammars/tree-sitter-zig` is an optionalDependency, so every Zig suite gates on `isLanguageAvailable(Zig)` and the ABI load-smoke accepts a clean load failure for an optional grammar. Both are the right contract for a platform with no prebuild, and together they leave a hole: if the grammar never installed on any CI runner, this PR would merge with all eight Zig resolver suites plus the structure-phase suite reported green-by-skip, having never executed the native Zig parser once. Close it with the `GITNEXUS_REQUIRE_FTS` idiom already used for the FTS suites. `GITNEXUS_REQUIRE_ZIG=1` declares "this runner has a prebuild, the grammar MUST be here", and a missing grammar becomes a failure instead of a skip. tree-sitter-zig@1.1.2 publishes prebuilds for {darwin,linux,win32}- {x64,arm64}, so the flag is set on two required jobs that all run on covered platforms: the sharded ubuntu `tests` job and the three-OS `abi-assert` job. - test/helpers/optional-grammar.ts: the registry mapping a language to its require-variable, plus `describeGrammarPresence`, a presence assertion that FAILS when required-but-absent. Deliberately a separate test rather than flipping the suites from skip to fail: a skipped suite reports success, so only a failing test can turn "Zig never ran" into a red job. - parser-loader-abi.test.ts: the optional exemption is revoked for a language the environment declares required, so an ABI-broken Zig binding fails the smoke instead of passing as a clean absence. - optional-grammar-gate.test.ts: pins the two ways the gate could silently never fire — reading a variable name CI does not set, or accepting a value CI does not write. Nothing changes for a run that leaves the variable unset: local runs and any future prebuild-less platform still skip. Verified both directions -- `GITNEXUS_REQUIRE_ZIG=1` alone: 149 passed, 0 skipped; with `GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1` forcing the grammar away it fails 2 tests with an actionable message; with the skip flag but no require flag it is green-by-skip exactly as before. Addresses the test-only blocker in the gitnexus-check review of #1432. * fix(zig): type the optional-grammar gate by grammar key, not language The gitnexus-check finding on parser-loader-abi.test.ts:155 is right, and none of the gates caught it: `tsconfig.json` includes only `src/**/*`, so neither `tsc --noEmit` nor CI typechecks the test tree, and vitest strips types without checking them. Confirmed with a scoped tsc run over the file: `error TS2345: Argument of type 'string' is not assignable to parameter of type 'SupportedLanguages'`. Not fixed with the proposed `key as SupportedLanguages` cast, which would assert something false: `listGrammarSources()` yields one row per SOURCES entry, including variants like `typescript:tsx` that are not enum members. `isOptionalGrammarRequired` now takes the grammar KEY it is really given, and the registry keeps a `satisfies Partial<Record<SupportedLanguages, string>>` so every key we write is still pinned to a real language. Two new cases cover the failure mode the type error was pointing at — a registry key that can never match what the ABI smoke passes, leaving the gate configured-looking and permanently inert: every OPTIONAL_GRAMMAR_ENV key must be a key `listGrammarSources()` yields and must be marked optional there, and an unregistered variant (`typescript:tsx`) must not be required even with the variable set. Same blind spot, two more latent errors in files this PR adds, both fixed: `Parser.Language` is not an exported member (use the `setLanguage` parameter type, as parser-loader-abi.test.ts already does), and the `ParsedImport` filter did not narrow the union, so `localName` was read through a `!` on an arm that has no such property — now a type predicate. The one remaining error under the same probe, in `resolvers/callable-value-flow.test.ts:319`, predates this branch (authored 2026-07-17, on main) and is left alone. structural-pair-coverage's optional-grammar case switches from `it.concurrent.each` to `it.concurrent.for`: only `for` passes the test context as a second argument (`each`'s callback is `(...args: T[])`), and that context carries the dynamic `skip()` the per-language gate calls. Behaviour is unchanged — grammar present: 10 passed; grammar forced away: 9 passed, 1 skipped. Whole test tree typechecking is a separate, much larger job: the same probe over `test/**` minus fixtures reports 734 pre-existing errors across the repo. Out of scope here. * fix(zig): address tenth gitnexus-check review pass - `normalizeZigDepPath`: normalize backslashes BEFORE the absolute-path check. A UNC dep (`\\server\share\dep`) used to slip past the check and normalize to the repo-relative `server/share/dep`; root-relative `\dep` had the same hole. Both now return null. Regression case added to the absolute-spellings test with the files those misreadings would resolve. - `bindPayloads`: a pointer capture `for (pages) |*p|` now records `*Page` (declaredSpelling) instead of `Page` — the `*` is an anonymous payload child before the identifier. Method dispatch is unchanged (`rawName` strips the sigil), but a deref projection `const q = p.*;` now sees the pointer layer. New fixture fn `viaPtrCaptureDeref` + assertion; fails on the previous code (verified by stashing the src fix). - `optional-grammar-gate.test.ts`: renamed the `typescript:tsx` case — the key IS a registry row; what makes it inert is the missing gate entry. Now also asserts a key no registry yields. - `structural-pair-coverage.test.ts`: header updated — ten tables (not eleven) are absent from every rule's target side; `Union` left the set when Zig made it linkable. - `language-classification.ts`: doc comment now names zig in the experimental set (added after Ring 1). Not re-fixed (invalid findings): - "owner-hook contract wired to an undeclared variable": stale-diff read — `findEnclosingClassInfo` declares `resolveFileTypeOwner` / `resolveContainerTypeOwner` as optional parameters (ast-helpers.ts:905, 917) and parse-worker threads them at every call site; tsc compiles clean. - "optional Zig grammar added unconditionally to the parsing fixture suite": the cited block only `fs.readFile`s the committed fixture file to assert it is non-empty — no parser or grammar load is involved. * fix(scope-resolution): mark construction-site CALLS edges in reason (opt-in), enable for Zig PR #1432 human review, item 2: a Zig struct literal `T{ .f = x }` (no parens) is modelled as a CALLS edge to the type — the Rust `T { .. }` / Go `T{}` shape — and nothing on the edge told it apart from an invocation (`get_next_spawn → SpawnRequest` from seven `return SpawnRequest{ … }`). `ScopeResolver.markConstructionSites` (default off): when set, the edge emitted for a `callForm === 'constructor'` site gets ` (constructor)` appended to its reason, in both emit paths — `local-call (constructor)` / `import-resolved (constructor)` in the free-call fallback and `scope-resolution: call (constructor)` in the reference bridge. The Zig resolver opts in. `Reference` gains an optional `callForm`, copied from the site by `buildReference`, so the bridge can see the form. Why `reason` and not a property or edge type: relationships carry no arbitrary properties, a new column changes the relation DDL and moves SCHEMA_FINGERPRINT, and `reason` is the channel the IMPLEMENTS `-pointer` receiver form already uses. Why opt-in: the unsuffixed strings are a pinned contract asserted verbatim by the other language suites (php/cpp constructor calls expect exactly `import-resolved`); every non-Zig edge stays byte-identical. Tests: `references-to-edges-call-form.test.ts` pins both vocabularies and the default-off behaviour; `zig.test.ts` asserts `Reflect.string → Accessor` / `Reflect.url → Accessor` carry `local-call (constructor)` next to a plain invocation, and that every marked edge targets a Struct. * feat(zig): track qualified struct literals (`mod.T{…}`) as construction sites PR #1432 re-test (issue comment on 97571d23): 163 qualified literals `mod.Type{ … }` in a real project produced no CALLS edge at all, so only same-file and imported-name literals were tracked as construction sites. One query rule captures `(struct_initializer (field_expression object member))` as `@reference.call.constructor` WITH the receiver. Captured as a free constructor instead, the site resolves by its simple tail and a workspace-unique `Thing` answers for `c.Thing{}` whichever module the source named (measured: c.zig defines no `Thing`, the edge went to a.zig's). With the receiver the site takes the receiver-bound namespace case — the path `mod.fn()` takes — which resolves inside the module the receiver is bound to: `a.Thing{}` / `b.Thing{}` bind their own files, `c.Thing{}` binds nothing, `std.Thread.Mutex{}` binds nothing next to a local `Mutex`. That case's edge now goes through `constructionSiteReason` too, so the opt-in marker (`import-resolved (constructor)` / `global (constructor)`) reaches it; `markConstructionSites` joins `ReceiverBoundProviderSubset`. Byte-identical for every provider that does not set the flag. Also answers the twelfth gitnexus-check pass: the `bodyNodeSet.size === 0` guard on the extractor factories' no-wrapper branch is deliberate (a config with wrappers whose node lacks one is a bodiless declaration); the two comments now say so instead of reading as a universal last resort. Go's method config, the only other empty-`bodyNodeTypes` config, never reaches the branch (its `extract()` gates on method/function nodes the class-node caller never passes). Tests: new `zig-qualified-literal` fixture (same-named `Thing` in two modules, a module without it, an external `std` qualifier next to a local and an imported `Mutex`); `zig-basic` pins `pioneer.Pioneer{…}` and the union `pioneer.Tag{…}` as marked construction sites. * feat(zig): resolve hub re-exports, enum-variant receivers and type-named receivers (real-project audit) Audit of three real Zig projects indexed with this branch (tigerbeetle 246 files, mach 132, ghostty 788): method reachability was 63 % / 35 % / 55 %, and three shapes accounted for most of the misses. 1. Hub modules. Zig projects publish types through a file made only of re-exports (`pub const Terminal = @import("Terminal.zig");`, `pub const PRNG = @import("prng.zig");`, `pub const Thing = @import("thing.zig") .Thing;`). Such a file owns NO local binding, and `findExportedDef` reads local bindings only — so `terminal.Terminal.init()`, `t: stdx.Thing`, `var p = stdx.PRNG.from_seed()` and `h: stdx.BoundedArrayType(u8, 4)` all resolved to nothing. Measured before → after: CALLS into ghostty's `src/terminal/` from outside it 46 → 253 (150 `terminal.Terminal.` sites alone); into tigerbeetle's `stdx` hub from outside it 837 → 1500 (136 static calls, 289 annotations). Method reachability: tigerbeetle 2249 → 2272 of 3544, ghostty 2766 → 2865 of 5016, mach 1047 → 1051 of 2967 (mach's hub publishes generic instantiations, `pub const Quat = q.Quat(f32)`, a shape this commit does not cover). `findExportedDefIncludingImportedNames` reads the finalized channel (origin import / namespace / reexport, def already resolved to the declaring file), refusing a name bound to two distinct defs. Opt-in per provider (`namespaceExportsIncludeImportedNames`): a module's imports are not its exports in most languages; Zig opts in because a hub member a consumer can name is public by construction. Used by receiver-bound Case 1, Case 3, the compound resolver's namespace branch, and a new Case 2 route that resolves a namespace-qualified class receiver (`stdx.PRNG`) through the same lookup. 2. Enum variants as receivers. `Operation.create_accounts.event_max()` (147 sites in tigerbeetle): a variant has no written type, but it has one — the enum itself. `emitZigScopeCaptures` now emits a field type binding per enum variant, so the field walk that already handles `self.session.name()` types `Op.create` as `Op`. 3. Receivers named after their type. `self` is a convention, not a rule: tigerbeetle writes `replica: *Replica` (777 of 1127 methods), mach `pool: *@This()` (764 of 833). Reading only `self` as the receiver labelled all of them `isStatic: true`, counted the receiver in their arity (`Counter.incr#1`) and sourced the scope binding as a plain parameter. `zigReceiverParameter` is the single rule for both phases: the FIRST parameter when named `self`, or typed as the enclosing container (`@This()`, its binding name, a `const X = @This();` alias), pointers / const / optionals stripped. Fixtures `zig-hub` and `zig-receivers` pin each shape, including the refusals: a private hub import does not leak, a foreign-typed first parameter is not a receiver, a factory stays static. * fix(zig): address thirteenth gitnexus-check review pass - File-struct receivers named after the file stem were always static: the method builder called `isStatic` / `extractReceiverType` / `extractParameters` without the extractor context's `filePath`, so `zigReceiverParameter` could not name a file-struct (`fn add(ledger: *Ledger)` in `Ledger.zig`, no `Self` alias) and the fn came out static with the receiver in its arity (`Ledger.add#2`) — an id the scope side, which always has the path, never produces, so its CALLS edges went nowhere. `MethodExtractionConfig` now passes `filePath` as an optional trailing argument to those three hooks (same shape as `extractOwnerName`); the Zig config threads it through, every other config ignores it. Regression tests in `zig-extractors.test.ts` (unit) and `resolvers/zig.test.ts` (new `Ledger.zig` in the `zig-receivers` fixture: ids, `isStatic`, and the three CALLS edges); both fail on the previous source. - `LINKABLE_LABELS` comment: the remaining `CLASS_KINDS` entries include `Namespace`. Not re-fixed: - "Ownerless-method assertion regex cannot match `.zig` graph IDs": the `[^:]+` segment consumes the whole file path (dots included) up to the second colon, and `[^.]+#\d+$` then matches only an owner-less name — `Method:src/Sorter.zig:lessThan#3` → true, `…:Sorter.sortBoth$1.lessThan#3` → false, checked with node. - "Public namespace imports are never marked as re-exports": the shared `ParsedImport` namespace variant has no `reexportsName` field and `contributesReexportEdge` excludes namespace drafts on `base.kind` by contract; a `pub const X = @import("x.zig")` hub member is exposed through `findExportedDefIncludingImportedNames` instead, which is what the audit commit added for exactly that shape. - "Private Zig namespace imports are treated as public hub exports": a private import cannot be named through the hub in code that compiles, and `findExportedDef` applies the same no-visibility rule to local defs; the finalized binding channel carries no `pub` bit to check. - "Range binding mutates finalized scopes" and "unconditionally adds an optional Zig grammar to the fixture suite": refuted in the tenth and eleventh pass notes of the PR body, unchanged since. * fix(zig): close the adversarial review's ten findings (8.2–8.12) PR #1432 review 5095267917 on 34c53473 retained eight P1 and two P2 findings; each is reproduced on the new `zig-chains` / `zig-buildmodules` fixtures with the decoy that made the old answer wrong, and pinned by a test named after its number. - 8.2 per-build-module import tables (`parseZigBuildModules`): a source resolves a bare name through its own module's `addImport` table (root file, else deepest root directory), fails closed when same-directory modules disagree, and follows `addImport("api", dep.module("core"))` through the dep's `addModule`; repo-wide names and zon deps remain the fallback. - 8.3 module-level value receivers (`zigHostValueNames`) prepend the implicit `self` like fn-locals, so `global_runner.run(cb)` joins `cb@1`. - 8.4 deep member aliases (`@import("lib.zig").B.work`, `lib.B.work`) keep the written owner: the module is bound as a namespace and the alias's use sites are rewritten to `receiver . member`; only one-level aliases are promoted to named imports. - 8.5 container-hosted containers get owner-qualified identities (`A.Item`, `B.Item`, `Outer.Inner`), minted by the bare-container rule, while the scope keeps the lexical binding. - 8.6 result-location `.init(…)` / `.{…}` under an annotation, a return type or a field type emit the call / construction site with the expected type as receiver. - 8.7 Zig arm in bench/import-target (five dispatchers, config-free fingerprint) + baselines row; `--check` passes. - 8.9 fn-local `@import` bindings and their uses are keyed per callable (`m$f_sib_a`), so sibling fns no longer share one namespace bucket. - 8.10 `ScopeResolver.resolveNamespaceChains` (opt-in, Zig only): Case 1 / Case 2 / Case 3 and the compound resolver walk a qualified receiver segment by segment — republished modules, nested types, enum variants through the module — refusing ambiguous hops. Off, every lookup keeps its one-hop split; the 70 resolver suites are unchanged. - 8.11 `@import("a.zig").Thing{}` binds the module as a namespace in type position; `List(u8){}` / `lists.List(u8){}` get constructor sites. - 8.12 a fieldless file whose top-level fn takes the file's own type (`self: *@This()`, `self: *Self`) is a file-struct; two over-matching ZIG_QUERIES rules are filtered by `shouldSkipDefinitionCapture`. Also asserts the committed `opmod.Op.lookup.event_max()` call in zig-hub. * fix(zig): address gitnexus-check findings on 215f70e3 - receiver-bound Case 3 wraps its reason in constructionSiteReason, like Case 1 and the nested-type route of Case 2 (one vocabulary per provider) - resolveZigImportInternal rejects drive-qualified absolute imports (C:\foo.zig), the same test normalizeZigDepPath applies; unit case added - the compound resolver's chain seed also tries the whole receiver as the qualified class (opmod.Op), as a bare class-name head already does - markConstructionSites contract text names the receiver-bound routes The return_type field claim is refuted: tree-sitter-zig exposes a fn's return type as the type field (checked on the grammar). * fix(zig): a build-module alias bound to an unindexed root fails closed resolveThroughBuildModules returned undefined when the containing module bound the alias to a file that is not indexed, which let the repo-wide addModule map answer under the same name (gitnexus-check on 5299c552). The module's table is the authority for its aliases: bound-but-unindexed is null, only an unbound name falls through. Unit case with a same-named repo-wide decoy, plus the outside-module file that still reaches it. * fix(zig): an unindexed root module fails closed, never a same-named zon dep The root build.zig's addModule declaration is authoritative for a bare name when it binds it; a root that is not indexed used to fall through to a build.zig.zon path dep of the same name — a different declaration answering under the name (gitnexus-check on fe24b37f). Same rule as the build-module tables. Unit case added. * Address PR review feedback (#1432) Tighten Zig build-module parsing, receiver/merge helpers, and container queries that gitnexus-check flagged on the open threads. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#1432) Attach the paren-matcher doc comment to findZigParenEnd instead of zigTopLevelStaticRoot. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify Zig review-feedback helpers after #1432. Reuse ZON brace/string walkers for top-level root_source_file, drop the dead bind flag and one-off staticRoot wrapper, and merge bindings via a first-wins map. Co-authored-by: Cursor <cursoragent@cursor.com> * bench(receiver-resolution): rebaseline for the Zig lang-resolution fixtures The receiver-resolution gate (#2856/#2899) landed on main after this branch forked and counts call drops over test/fixtures/lang-resolution, which this branch extends with the zig-* fixture projects. Regenerated with `measure.mjs --update-baseline`: callDrops 102 -> 113, all 11 new drops in .zig files, shape `no-chain`. Every new drop is a call whose callee has no node in the corpus, not a resolver regression: `std.Build.Module.addImport` in the three build.zig fixtures (7, classified in-program), `std.sort.pdq` in Sorter.zig (2, unknown), `std.Thread.Mutex{}` / `std.mem.Allocator{}` literals in zig-qualified-literal (2, unknown, the fixture asserts std stays external), and one `.init()` decl literal on a generic instantiation (`const u: Stack(u16) = .init()`, in-program). Shape arm unchanged. --------- Co-authored-by: Garrett Griffin-Morales <grgisme@gmail.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-03 13:29:42 +01:00
Gergő Magyar	12763a40c8	fix(watch): await a watcher re-arm barrier so gitignore reloads cannot drop events (#3159) ... * Increase CI timeout budget for flaky watch-filesystem test * test(watch): include elapsed budget in waitFor timeout errors (#3156) Make CI flake timeouts self-describing without raising the 90s ceiling, and cite the mcp/server-startup 15s/5s convention in the helper comment. * fix(watch): await a watcher re-arm barrier after an ignore-rule reload An ignore-rule reload re-armed the watcher with `watcher.add(repoPath)`, which returns before the rescan it starts has finished and offers no signal for that completion. A file the reload had just unignored was therefore still unregistered when the call returned, and since `ignoreInitial` suppresses the `add` that the in-flight rescan would emit, an immediate rewrite of that file was dropped permanently. A standalone reproduction missed the rewrite 40/40 times on both chokidar 4.0.3 and 5.0.0. Re-arm by arming a replacement watcher and awaiting its `ready` instead, which is the only completion signal chokidar exposes (`ready` never fires twice on one instance). The re-arm runs before the refresh, so a write that lands while the replacement arms is still read by that refresh; the outgoing instance keeps reporting until the swap, so no event window is dropped; and a replacement that fails to arm leaves the working instance in place for the queue to retry. The transient-watcher-error path now requests the same awaited re-arm rather than re-arming inline ahead of its catch-up refresh. This replaces the CI timeout increase from #3156, which treated the symptom: the test was not slow, it was waiting for an event that never came. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(watch): drop restating comments and duplicated waitFor state The re-arm error now uses the same cause-wrapping shape as ignore-control reload, and the instant-rewrite test waits for both paths in one poll. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-03 11:25:51 +00:00
glier	b15ff2d888	feat(ingestion): mint Destination nodes from AsyncAPI 3.x documents (#3140) ... * feat(ingestion): read AsyncAPI 3.x documents into broker addresses Adds a format-driven reader that turns the `operations[]` entries of an AsyncAPI 3.x document into (broker, address, direction) triples, plus the protocol-to-broker map behind it. Nothing consumes it yet. The reader lives outside `frameworks/spring/` on purpose, like `destination-key.ts` and for the same reason: an AsyncAPI document is a published artifact emitted by generators across several language toolchains and written by hand as often as generated. The entry criterion is therefore the document format -- a root `asyncapi` key -- and never the generator. AsyncAPI 2.x is refused under its own countable reason rather than mapped. Its `publish`/`subscribe` are inverted relative to 3.x `send`/`receive`, so a naive mapping reverses every direction in the async graph while leaving it connected: nothing fails, the arrows simply point the wrong way. A silent skip would be indistinguishable from "this service publishes no document", which is the one thing the refusal count has to be able to tell us. The broker is read twice over -- from the operation's bindings and from its channel's server protocol -- and the two readings must agree. A destination keyed on the wrong broker joins a stranger, and with the document contradicting itself there is no way to tell which reading is right, so the operation is refused rather than decided by a coin flip. An unmapped protocol passes through as its own literal instead of being dropped, because `destinationNodeKey` takes a plain string precisely so a non-Spring caller can attest to a broker Spring has no member for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(cli): add --asyncapi-spec, an explicit path to AsyncAPI documents Threads an `asyncApiSpecPath` option from the CLI, the server analyze endpoint, and the programmatic entry through to `PipelineOptions`. Nothing reads it yet; the reader added in the previous commit is still unwired. Shaped deliberately after `springActuatorPath`, the existing option for an out-of-band artifact: an explicit local path, accepting a directory or a single file, resolved against the repository root so a committed `docs/asyncapi` and an absolute cache populated by something else are both natural, and `undefined` keeping the feature entirely off. Mirroring that option rather than inventing a mechanism is what lets a downstream consumer point the reader at documents fetched out of band without patching a file here. `analyze --watch` REJECTS the flag, exactly as it rejects --spring-actuator. The watcher reacts to source changes and nothing watches a document directory, so honouring it there would read the documents once and then serve a stale answer for the rest of the session -- worse than refusing, because it looks like it worked. Additive only: 49 inserted lines, no deletions and no modified lines. Every new interface member is optional and every forward is an object-literal spread of an undefined value, so with the option unset the analyzer takes byte-identical paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(ingestion): mint Destination nodes from AsyncAPI documents Wires the reader into the destinations phase. With `--asyncapi-spec` set, every `send` operation emits PUBLISHES_TO and every `receive` emits CONSUMES_FROM against the ordinary resolved `Destination` node -- same key, same `address` property -- so a document and a source site that name one address on one broker land on ONE node and the two halves of a conversation meet. Verified end to end: an address named only in a document is minted with the right broker and direction, and an address a source site already resolved stays a single node with its own `literal` provenance while the same address on a different broker stays separate. This claims only what a document states -- that the service talks to that address, on that broker, in that direction -- and never which method does it. The addresses in one document partition by (broker, action) into buckets that usually hold more than one operation, so any assignment past a bucket of size one is a heuristic, and a wrong one attaches a real address to the wrong handler: a false connection wearing the clothes of a resolved one. The edge therefore starts at the document, not at a callable. That is weaker than a source-derived edge and worth having anyway, because it is available where the source supplies nothing at all -- a programmatically registered listener, a broker with no patterns here, a language whose messaging idiom nobody has taught this codebase yet. Documents are read even when the source pass found no messaging, which is why the early return had to move: a repository whose brokers are invisible to the patterns is precisely the case a published document covers, and an early return keyed on source sites skipped the documents exactly there. Their counters are kept in their own block rather than folded into the existing ones. `refusalsByReason` is the denominator of the SOURCE unresolved fraction, and a mistyped specification directory must not be able to make the source look worse than it is. The block is absent -- not zeroed -- when no path was configured, so "not asked for" stays distinguishable from "asked for and found nothing"; those need different answers from an operator and one zero cannot say which happened. The direction assertion is the one that matters and it is pinned by type, not by existence: inverting the mapping in the source tree fails exactly one test, because every other assertion passes identically under both readings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: document --asyncapi-spec and why step 4 of the cascade stays empty Adds the flag to both READMEs and to the three byte-identical copies of the CLI skill, which a sync test pins together. Also rewrites the note on the `specification` seam in the address cascade. It said "nothing supplies it today", which was true and is now misleading: a reader exists, and the hook is still unsupplied because of a decision rather than for want of one. A document names addresses; it does not name the method that uses one. To hand an address to a particular candidate something must choose which of the document's operations belongs to it, and the only division both sides agree on -- (broker, action) -- leaves buckets that usually hold more than one operation. On a real generated document exactly one bucket of four was unambiguous. Every assignment past a bucket of size one is a heuristic, and a wrong one puts a REAL address on a joining node under the wrong site: a false connection wearing the clothes of a resolved one, which is the outcome the keying rule exists to prevent. The note also records the two things that would change that and are not heuristics -- a document carrying the implementing symbol, or a configuration source answering the `${key}` the candidate already recorded -- and that the second wants its own resolver, since what it needs is the placeholder key rather than the candidate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): refuse the document shapes that would forge a join Four ways a conformant AsyncAPI document could mint a Destination that connects two services which have said nothing about each other. Every one is reachable from ordinary 3.x vocabulary, not from malformed input, and each is now a countable refusal. A PARAMETERIZED ADDRESS is a pattern, not a place. Two services that publish `{env}.orders` share a template; one deploys with env=prod and the other with env=staging, and keying on the template text merges them into a single node with a publisher on one side and a subscriber on the other. This is the document-side twin of `overridable-config-default`, which argues the same thing about `${key:default}` in source. A channel declaring `parameters` is the specification's own statement that its address is a template, so the detector is a reading rather than a guess; the `{` test catches generators that template without declaring. ANY BINDINGS KEY WAS TAKEN AS A PROTOCOL. AsyncAPI allows `bindings` to be a Reference Object, so the map's own key can be `$ref` -- and passed through, that becomes half of a join key carrying no broker information at all. Two services that both reference shared bindings and both name `orders` then land on one node, defeating the broker-in-key rule that keeps `kafka orders` and `rabbit orders` apart. A broker must now be spelled like a protocol name. A BROKER CONTAINING A SPACE COLLIDES, because the node key joins with one: ("kafka orders", "x") and ("kafka", "orders x") are the same key. That was latent while every broker came from Spring's closed union. This module is the first caller to feed the shared helper text that a document wrote, which is exactly the condition under which it stops being latent, so it is closed here -- at the producer -- rather than by changing an encoding that `routeNodeKey` shares. THE ADDRESS WAS TRIMMED, while the source cascade keeps an address exactly as written so `" orders "` stays its own node. Two producers of one key held opposite whitespace policies and the document side erred toward joining. Also: fold the transport-security protocol variants (`kafka-secure`, `secure-mqtt`, `wss`, `stomps`, `https`) onto their base protocol. The `amqp`->`rabbit` argument already in this file demands it -- AsyncAPI's server vocabulary distinguishes them and its bindings vocabulary does not, so a secured cluster's own document was being read as self-contradictory. Treat a channel with no `servers` as available on all of the document's servers, which is the specification's default and was costing every single-server document its destinations. Bound the address and operation-id lengths, because `generateId` concatenates rather than hashes, and bound total operations across the run rather than only per document. Read each file through ONE handle for both the size gate and the read, as `actuator-runtime.ts` does and for the reason its comment gives (CodeQL js/file-system-race): re-resolving the path lets a swapped file bypass the cap, and the out-of-band cache this option reads is written by other tooling by definition. Open it with O_NONBLOCK: the type check that rejects a FIFO is unreachable without it, because opening a FIFO for reading blocks in open(2) until a writer appears -- found by writing the test first and watching it time out rather than fail. Count symlinked entries and walk truncation instead of dropping them in silence. A symlinked cache and a wrong path were producing identical results. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(analyze): rebuild when documents are configured, and report what was read An AsyncAPI document is external to git freshness in exactly the way an Actuator snapshot is: replacing one moves no commit and dirties no file. The option's own README paragraph advertises an absolute cache written by other tooling, and on the second run of that workflow the already-up-to-date fast path fired, no document was ever opened, and the previous run's addresses were served as current. Measured, not reasoned: editing a document and re-running printed "Already up to date" and left the old address in the graph; with this change the same probe re-reads and the new address replaces it. So an enabled run forces a rebuild and dropping the option forces one more, to clear document-derived evidence -- the treatment `springActuatorPath` already gets, for the same reason. Only the FLAG is recorded in index metadata, not the path: Actuator retains its inputs so future scans keep excluding them, whereas a committed document is deliberately NOT excluded (it wants its real `File` node), so there is nothing to retain and recording the path would put an operator's directory layout into metadata for no consumer. That also settles a defect it would have been tempting to patch separately. A synthetic `File` node for an out-of-tree document carries a path that is in no write set and is not covered by `isGraphWideNode`, so an incremental writeback dropped the node while keeping its edges -- which then COPY against a row that was never written, and fail into an IGNORE_ERRORS retry that reports success. A forced rebuild has no incremental subgraph to get that wrong. Distinguish the two meanings of `resolution: 'specification'`. That value belongs to the address cascade and means a CODE candidate was resolved through the step-4 hook; a node minted from a document has no code site and now says `asyncapi-document`. Reusing one string would leave a query that groups by provenance unable to separate an address a document states from one a document was used to resolve, and only the second is a claim about source. Report what was read. The stats block was justified on the grounds that an operator must be able to tell a mistyped directory from a repository with no documents -- and nothing surfaced it, so the justification was aspirational. A configured path that yields nothing, or a walk that hit a bound, now warns unconditionally, as `spring-auto-configuration.ts` does for the same class of input. The phase summary carries the refusal breakdown rather than only the totals, because the unresolved fraction is the number this work is judged on and a bare count says how big the gap is without saying what would close it. Tests for the three wiring lines that were individually deletable with a green suite, following the templates already in the repository: a row in the `--watch` rejection table, the CLI-threading assertion beside the Actuator one, and the shipped-skill fragment that pins the flag in all three copies. Also pin `filePath: ''` on a spec-minted destination -- the half of the keying rule that stops a shared node becoming collateral damage of one document's next change -- and the in-repo `File` branch, which was dead-code-able. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): close the join-forging paths a second review round found The `$ref` exclusion added last round fixed one instance of a class and left the class open. A `bindings` map key of `x-scs-function` -- an ordinary Specification Extension, which generators emit -- still became the broker, so two unrelated services carrying one vendor annotation and one address landed on ONE node whose broker half said nothing about any broker. And `{ kafka: {}, x-internal: {} }` read as two brokers, losing a conformant document and reporting it as self-contradictory, which also made any document author a one-line saboteur of their own cross-service links. So the two readers are now separate functions with opposite defaults, and the header says why they must be. `servers[].protocol` is a FIELD DECLARED to hold a protocol: an unrecognized value there is the document's own claim and passes through, because refusing it would lose a destination the document states plainly. A `bindings` MAP KEY is not that -- the specification puts `$ref` and `x-` in the same namespace -- so a non-protocol key is the EXPECTED case and only AsyncAPI's binding vocabulary may answer. The syntactic test that was applied to both was the right rule for one of them. The walk fix from last round introduced something worse than it reported. A shared abort flag meant depth exhaustion in ONE branch terminated the whole traversal, so ten good documents beside a twelve-deep unrelated subtree were kept or lost depending on whether that subtree sorted before or after them. Truncation and budget-exhaustion are now separate: depth returns from its own branch, and only a genuinely global bound stops the walk. Rewriting `protocol.ts` dropped the whitespace check from the server-protocol path and made the node-key collision reachable again. The test written for that collision last round caught it within the minute; the comment now records that it was learned twice. Everything else measured this round: - The broker is the THIRD string that reaches a graph identifier, and it was unbounded while the header claimed there were two. A one-megabyte protocol in a document satisfying every other cap was measured producing a gigabyte of resident identifier strings, because `generateId` concatenates rather than hashes and the phase mints one id per node and per edge. - The run-wide operation budget counted ACCEPTED operations, reproducing at the run level the exact defect the per-document cap was corrected for last round: a run whose every operation is refused never decrements it. Both now count operations EXAMINED, and `operation-cap` sets `truncated` -- it is a bound that stopped the operation count, which is what that flag is documented to mean. - The channel-inherits-all-servers rule ran per operation. Hoisted: it depends only on the servers. - A subdirectory that cannot be listed is counted rather than dropped, so a mixed-permission cache cannot report a clean, complete read. - The read LOOPS, like the Actuator reader this claims to follow. A single read was never short across seven hundred probes on APFS, but POSIX permits it and FUSE mounts with `direct_io` -- the deployment this option targets -- return short counts. A document truncated at a line boundary still parses, so the failure is silent: operations vanish with `refusals: {}`. - `parameters: {}` no longer refuses a literal address; an empty container states nothing and generators emit them. - A channel that is itself a Reference Object gets its own reason instead of `no-address`, which was telling operators their documents omit addresses when the reader simply stops one hop short. - A multi-protocol document resolves from its operation's own bindings; only when those are silent does an inherited multi-protocol server set refuse, and under `ambiguous-server-default` rather than a reason that says the document contradicts itself. It does not. - HTTP and WebSocket are refused for destination minting. For a broker the topic is the namespace; for HTTP the host is, so keying on the path alone would make every service exposing `/events` one node. A `Route` already models an HTTP endpoint, with its method in the key. - The sniff window is a parse gate, not a read gate, and four kilobytes refused a good document behind a licence header. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(ingestion): pin the wiring and the reporting that were deletable Three lines could be deleted with the whole suite green, and each of them makes the feature partly or wholly inert: the forward from `run-analyze` into `PipelineOptions`, the forced rebuild while documents are configured, and the cleanup rebuild when the option is dropped. None is visible one layer up, where the CLI test asserts on a mock's arguments. One integration test closes all three. It drives the real `runFullAnalysis` against a real repository and asserts, in order: the enabled run does not take the up-to-date fast path and logs the rebuild; the destination reaches the graph, which only happens if the option is forwarded; a document edited with the tree clean and the commit unchanged is re-read; dropping the option rebuilds once and removes the document-derived evidence; and the run after that is up to date again -- the "rebuilds once" half, which rests on the metadata being written as a fresh literal rather than merged, and which nothing pinned. The document lives OUTSIDE the repository on purpose. That is the workflow the option is documented for, and it is the only one where the hazard exists: editing a tracked file dirties the tree and forces a rebuild anyway, so an in-repo fixture would pass with the freshness fix reverted. Verified by reverting both: deleting the forward fails on the empty destination list, deleting the forced rebuild fails on the missing log line. Also pinned, each because deleting the code it covers left the suite green: the `parameters` half of the templated-address refusal (its old test supplied a braced address too, so the `{` half alone satisfied it); the phase actually forwarding `symlinksSkipped`; the unconditional warning, whose whole argument is that a tally nobody can see is not a tally -- captured through the repository's own `_captureLogger`; a `.yml` document; a character device, which is the case the `isFile` check exists for and which the FIFO test does not reach; and the bound that stops a walk. Reject an empty `--asyncapi-spec` at the CLI. It resolved to the repository root and walked the whole tree, defeating this module's own rule that there is no glob-based auto-discovery -- and the HTTP entry point already rejected the identical value. Two doors onto one option must not hold different rules. Surface the flag in the MCP context resource beside `spring_actuator`. It matters more there than for its neighbour: Actuator annotates nodes the source pass already found, while document reading mints destinations and edges with no code site, and nothing said where they came from. Log the configured path relative to the repository. The same change refuses to persist that path to index metadata because it would record an operator's directory layout; holding that rule for metadata and not for logs was holding it in one place. Both test files now clean up their temporary directories. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * style(ingestion): apply the repository's prettier contract `quality / format` runs `npx prettier --check .`, and three files added by this branch were not formatted to it. No behaviour changes: the reader's line breaks and two test literals move, nothing else. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(ingestion): release the mini-repo handle the document test allocated `setupMiniRepo` documents that the caller owns cleanup, and every other test in this file calls `repo.cleanup()` in its `finally`. The AsyncAPI document test removed only the document directory, so each run left a temporary repository behind. The two owners are separate on purpose: the document directory is a SIBLING of the repository, placed outside the working tree so that editing it cannot dirty the tree and force a rebuild on its own. The repo's cleanup therefore does not reach it, and both calls belong in the same block. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): stop partial server evidence from reading as unanimous Six review findings, every one a way this reader could name a broker the document does not name. They share a shape: something is DROPPED rather than refused, the remaining evidence agrees with itself, and an operation is attributed with confidence to a broker its document never settled on. A wrong broker is half a join key, so it does not produce a missing edge -- it produces an edge to a stranger, reported as a fact. CAPPED SERVER MAPS. A channel with no `servers` inherits all of them, and that map is capped at 1,000. A document whose first thousand servers are Kafka and whose thousand-and-first is JMS read as unanimously Kafka, because unanimity was tested on the slice. Counted `server-cap` and set `truncated`, but neither stopped the attribution. The inherited path now refuses under `capped-server-default` -- checked BEFORE agreement, since a subset agrees with itself for free. ROOT SERVER REFERENCE OBJECTS. The Servers Object patterned field is `Server Object | Reference Object`, so `{ $ref: '#/components/servers/prod' }` is conformant. Reading `protocol` off the raw value dropped every one: an all-reference document had no protocol at all, and -- worse -- a MIXED set lost its disagreeing half and became unanimous. One hop is now followed, through `#/servers` and `#/components/servers`; anything else is refused under `unresolved-server-reference` rather than skipped. CHANNEL BINDINGS. Only the operation's bindings were read. A conformant channel carrying `bindings: { kafka: {} }` with no operation binding was dropped as `protocol-unknown` while the document said plainly which broker it meant, and a disagreement between the two levels was invisible. Both are read; a conflict is `protocol-disagreement`. EMPTY `servers`. "If `servers` is absent or empty, this channel MUST be available on all the servers defined in the Servers Object" -- one sentence, both cases. A zero-iteration loop returned `explicit: true`, which blocked the inherited fallback and dropped valid operations. POINTER DECODING ORDER. RFC 6901 percent-decodes the fragment BEFORE splitting on `/`. The raw token was tested for a separator first, so `#/channels/orders%2Fv1` passed a check it should have failed and then decoded into two segments -- a pointer addressing `channels.orders.v1` was read as a channel named `orders/v1`, inventing a channel the document never declared. A malformed escape is now refused rather than resolved against its undecoded text. `~1` still resolves; it is the pointer's own escape and belongs after segmentation. THE SNIFF WINDOW. A fixed window decides by where the root key sits rather than whether it is there, so every window is a false negative waiting for a longer preamble -- 4 KiB was replaced by 64 KiB for that reason and inherited the same defect. The whole text is scanned; it is already bounded and already in memory, and the gate exists to skip the PARSE, which is the expensive half. A leading UTF-8 BOM is stripped before both sniff and parse. Twelve of the fourteen new tests were run against the unfixed reader and all twelve failed; the other two are controls that must pass either way. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(ingestion): simplify AsyncAPI pointer and binding resolution Decode each $ref once, union binding evidence, and stop walking capped server maps whose brokers are unused on the inherit path. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-02 22:01:15 +00:00
ChunxueLi	131d9f93fd	feat(route): resolve vendor-derived Spring mapping annotations by suffix (#2883) ... * feat(route): resolve vendor-derived Spring mapping annotations by suffix Frameworks commonly wrap Spring's built-in annotations with company-specific variants (e.g. Winning Health's @WinPostMapping wraps @PostMapping). The annotation definition lives in a binary JAR — not in source — so the meta-annotation cannot be read statically. Add resolveSpringAnnotationAlias(): resolves custom annotations by naming suffix (WinPostMapping → PostMapping → POST). This matches the universal Java convention of naming derived annotations with the base name as a suffix. Works for any vendor prefix, not just one company. The fix is in springAnnotationHttpMethods() (spring-shared.ts), which both the ingestion extractor (spring.ts) and the group extractor (java.ts) call. A single-function change propagates to both layers automatically. Zero configuration: no .gitnexusrc, no annotation allowlist. If an annotation name ends with a known Spring mapping suffix, it inherits that annotation's HTTP semantics. False-positive risk is negligible. Tests: 16 new unit tests covering resolveSpringAnnotationAlias directly, springAnnotationHttpMethods with aliased annotations, end-to-end extractSpringRoutes with vendor annotations, and ingestion/group parity. Existing route tests (260) continue to pass. * fix(route): address review findings — class-level aliases, registered prefixes P1: class-level @WinRequestMapping now gets the same prefix/constraint semantics as @RequestMapping — all five class-level exact-match sites (spring.ts phase-1 collect, typeRequestMethods, typeClassPrefixes; group http-patterns java.ts typeRequestMethods + type-level branch) route through the new shared isClassLevelMappingAnnotation predicate, and the hard-coded 'RequestMapping' argument in springAnnotationHttpMethods calls is replaced with the actual annotation name so alias resolution applies. P2: suffix-only alias matching accepted unrelated annotations (@AuditPostMapping emitted a phantom POST /audit). Alias resolution now requires a REGISTERED vendor prefix — 'Win' by default, extendable via GITNEXUS_SPRING_VENDOR_PREFIXES=Win,Acme without a rebuild. Tests: negative e2e for the unregistered-suffix phantom route, vendor class-prefix parity e2e, predicate unit matrix, env-registration test. * style: prettier * chore: drop accidental gitnexus-shared/dist worktree symlink from prettier commit Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#2883) Wire vendor Spring mapping aliases into Kotlin ingestion and group extraction, restore GITNEXUS_SPRING_VENDOR_PREFIXES after the env test, and stamp spring.route-bindings so existing indexes rebuild. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(route): honor Kotlin vendor aliases and prefix freshness Parse Kotlin RequestMapping method arrays in the shared Spring helper, bump spring.route-bindings, and rebuild when registered vendor prefixes change. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: ChunxueLi <mecoloud@users.noreply.gitee.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-02 21:01:59 +00:00
ChunxueLi	b9613ee86b	feat(node): wrapped-client HTTP consumers + leading-prefix template stripping (#3111) ... * feat(http-patterns): Patch 8 - extract enterprise wrapped-client HTTP consumers Recognize the enterprise axios-wrapper call shape X.request({ url, method }) (e.g. httpClient.request from @winex-plugin/win-request) as a consumer contract source, and strip the leading gateway/service-prefix template variable so consumer paths align with backend provider routes. Effect on sr-next group: 1740 contracts / 0 cross-links -> 3540 contracts / 883 exact cross-links (14 frontend repos <-> backend/opt). Not submitted upstream yet; see CUSTOM_PATCHES.md Patch 8 for details. Co-Authored-By: Claude <noreply@anthropic.com> * feat(node): wrapped-client HTTP consumers + leading-prefix template stripping Consumer extraction for enterprise axios-wrapped clients: - X.request({ url, method }) member form (httpClient.request from win-request and friends): any .request(options) call with url/method|type string props; the url template literal is split on ${...} spans and the longest /-leading literal segment is kept. - Leading ${...} gateway/service-prefix variables are stripped as consumer-path normalization semantics in normalizeHttpPath (stripLeadingTemplatePrefix): `${client}/api/v1/x` → /api/v1/x for fetch/axios/wrapped shapes alike. Mid/tail interpolations still round-trip through {param}; a stripped remainder not starting with / is dropped (same rejection static relative urls get at scan time). - %7B/%7D unescaping for absolute-URL branches. On our 16-repo frontend monorepo this took group sync from 1740 contracts / 0 cross-links to 5111 / 2097 (exact links, 16/16 repos linked). * fix(route): preserve upstream symbol-resolution machinery; strip only Rebasing correction: an earlier iteration of this change simplified the symbol probing to a bare line-1 offset and dropped the exact-module match, which mis-attributed data-table handlers to decoy same-name symbols (6 data-route-table regressions). Restore the upstream probing (toZeroBasedLine + exact-module resolution) wholesale; the deltas this change actually needs are the pure ones: stripLeadingTemplatePrefix, normalizeConsumerPath returning null for un-reducible urls (callers drop), and the %7B/%7D brace restoration in the absolute-URL branch. * style: prettier * Address PR review feedback (#3111) Pass wrapped-client URLs through shared consumer-path normalization instead of the longest-segment reducer, emit * for present-but-non-literal methods, restore {param} via a sentinel so literal %7B segments stay encoded, and drop unused decorator helpers. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3111) Gate wrapped X.request({url}) on axios-proven receivers or a small wrapper allowlist so cy.request/queue.request cannot mint HTTP consumers. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3111) Use a private-use sentinel so literal path segments are not rewritten, trim wrapped URLs before the scan-time path gate, and treat interpolated/shorthand methods as *. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(http): honest wrapped-request methods and tighter admission (#3111) Quoted keys and object spreads were minted as GET; drop spelling-only `api`, align gateway-prefix member verbs with prefix-strip, and keep absolute URLs. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: l.cx <l.cx@winning.com.cn> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: ChunxueLi <mecoloud@users.noreply.gitee.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-02 19:59:45 +00:00
Yayler	3aa62be717	feat: add gitnexus auto-sync for scheduled remote clone and analyze (#2493) ... * adds an opt-in auto sync and analysis loop for GitNexus * adds an opt-in auto sync and analysis loop for GitNexus,gitnexus watch [init|start|restart|stop|status] * adds an opt-in auto sync and analysis loop for GitNexus,gitnexus watch [init|start|restart|stop|status] * fix: address PR review cleanup * Prettier code style * merge main * fix(watch): protect local repos and cancel active analysis * fix(watch): harden auto-sync lifecycle and locking - validate watch process identity before lifecycle operations\n- serialize registry, analysis, and LadybugDB access with recoverable locks\n- harden clone paths, symlinks, hooks, quarantine, and worker timeouts\n- install procps in the CLI image for reliable Docker watch control\n- add focused regression coverage for lifecycle, locks, clone, and registry behavior * update agents & claude md * merge main * fix(watch): harden auto-sync lifecycle * fix(watch): normalize SSH repo identity paths * fix(watch): normalize SSH repo identity paths * fix(watch): safely cancel analysis across platforms * fix(auto-sync): close worker and group sync failure paths * fix(auto-sync): drop retired allowStale from group sync allowStale was removed from SyncOptions, which broke typecheck and CI on this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): satisfy prefer-const and Prettier in auto-sync The watch timers are assigned exactly once, so prefer-const rejected the deferred `let` declarations. They are only read from `stop()` and the control poll, both of which run after the assignments, so binding them at creation is safe and drops the now-dead undefined guards. Remaining files are formatting only. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): make lock identity absolute and stop three fail-open paths Lock owner identity was rendered by `ps -o lstart=` through localtime and the active locale, so the same live process produced a different string under a different TZ. A mismatch reads as PID reuse, so one daemon could reclaim a mutex another still held. Pin TZ=UTC and LC_ALL=C. The owner record also carried no hostname, so a holder on another machine was judged by this kernel's view of its PID — always "stale" — and its lock stolen whenever GITNEXUS_HOME is a shared volume. Record and compare the hostname, as the index lock already does. Ownership verification threw unconditionally on win32, which is reached once per project per tick, so watch reported `running` and then failed every repo forever. POSIX uid/mode cannot be checked there; skip those two assertions and keep the dangerous-root, symlink, containment and internal-root guards. Also: quarantine sweep now refuses a symlinked root instead of deleting through it; an unreadable state file propagates instead of being rewritten as empty state, which used to erase every repo's analyzed commit and failure count; a failed staging cleanup no longer strands a published lock with no release handle; and the concurrency runner settles every worker before surfacing a failure so cancellation cannot orphan a live analyze fork. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): land the deferred review findings Six findings that were deferred from the review backlog, plus the docs they change. Worker heap: admission allowed `floor(availableMemoryGB / 2)` slots while every fork was handed the whole machine's heap cap, so the budget meant nothing as soon as an operator raised max_concurrency. Divide the cap by the repos actually analyzed in parallel. The default single-project path is unchanged. Registration: the parent registered without a branch, so it always took the primary/flat arm and relabelled a pinned branch entry on the branch-fallback path. Reproduce the worker's own resolveBranchPlacement decision instead. Cancellation: requestCancellation cleared the only timer and settled nothing, so a worker wedged past its safe point left the promise pending forever, wedging activeRun and hanging `watch stop`. Add a 5s grace after which the parent stops waiting and releases the IPC channel's hold on its event loop. The child is still never killed — it may be inside native work. overwrite_local_changes: `checkout --force` rewrites tracked files only, so untracked sources survived and were indexed as if they came from the remote. `git clean -fd -e /.gitnexus` after checkout; no -x/-X, so ignored paths and GitNexus's own storage survive. Quarantine: age alone never bounds a repo that fails every tick, since each partial clone is younger than the retention window. Keep the five newest per repo. Validation: repo_git_timeout is now bounded by the lesser of an hour and the sync interval, which is also the guard for the bare-number-means-seconds slip (`600000` meant ~7 days and cleared the timer ceiling). And the remote URL's final segment is validated at config load rather than failing once per tick inside the sync loop. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): release an errored worker, and stop rejecting dotted repo names Three findings from the latest review pass. The 'error' handler settles immediately rather than waiting out the grace, so cleanup() clears the grace timer that would otherwise have released the child. An errored IPC channel does not mean the worker stopped, so release it on that path too — still no kill. The traversal guard tested the raw path for '..', which also rejected an ordinary name like owner/foo..bar that the repository-name rule accepts. Traversal is a whole segment, so test segments. The heap-cap test left two runs and their real timers pending; it now stubs timers and settles both promises. Registration coverage now pins the branch slot rather than leaving it implicit. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): validate namespace segments and pin the stopped process identity Replacing the raw-string `..` test with a per-segment one dropped a guard: a segment like `..\..\outside` is not literally `..`, so it passed, and those segments build the clone path — on Windows the backslashes are separators. Hold every namespace segment to the same charset as the repo name, which keeps a separator out of a segment while still allowing an ordinary `foo..bar`. The final segment keeps its own check so a bad repo name keeps its own message. The stop wait polled liveness by pid alone, so a pid reused mid-wait would have it wait on an unrelated process and then report the watch stopped. Compare the process start time recorded for the owner, which also returns sooner. Registration now omits `branch` for a primary index instead of passing it as undefined, so that call keeps the shape it had before this branch. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): ship auto-sync as the remote daemon, reserve gitnexus watch. Keep analyze --watch for local incremental re-index and stop the top-level watch verb from starting a clone/pull loop. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): reject invalid branch refs and verify status identity (#2493) Reject leading slashes and per-component trailing dots in configured branches, and verify the live watch owner before trusting a stored error status. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): reject ownerIds that can escape the watch directory (#2493) Stop interpolating a tampered ownerId into the stop-request filename; only basename-safe values are treated as owners. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): recognize auto-sync in the watch-process identity check (#2493) Stop/status were still looking for a standalone watch token after the command rename, so a live gitnexus auto-sync start process would be refused as unrelated. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(auto-sync): reject boolean max_concurrency instead of coercing it to 1 (#2493) Number(true) is 1, so a YAML boolean would have passed the integer check and silently meant one worker. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): swallow status errors in the watch finally path (#2493) An uncaught updateStatus rejection in finally became an unhandled rejection. Skip the clone-root symlink test on Windows, where directory symlinks need privileges. Align the group-lock comment with fail-closed registry timeouts. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): catch cancelling status-write failures (#2493) Fire-and-forget updateStatus('cancelling') could become an unhandled rejection, the same class as the finally-path status write. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): ignore queued interval ticks after stop (#2493) clearInterval does not cancel a timer callback already queued. Guard runSafely on stopping so shutdown cannot start a new un-cancellable run. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): report stored watch status timestamps (#2493) status should show when the watch last entered a state, not when the CLI queried it. The failure-count test still expects 1 after a new commit resets the streak; rename it so that reset is explicit. Co-authored-by: Cursor <cursoragent@cursor.com> * style(auto-sync): apply prettier to starter status logger (#2493) Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: weiyf <weiyf3634@163.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-02 19:40:18 +01:00
Kevin Rajan	5e6b79deba	fix(cli): do not call zero-symbol detect-changes a clean tree (#3138) ... * fix(cli): do not call zero-symbol detect-changes a clean tree Print backend summary.message and distinguish a parsed diff with no overlapping indexed symbols from an empty git diff. Pin --color=never so color.ui=always cannot hide +++ b/ headers. * fix(cli): localize clean-tree detect-changes and skip no-overlap when partial Production empty diffs carry English summary.message; route that through t() so zh-CN fires. Do not claim no indexed-symbol overlap on queryDegraded partial results. Pin formatter tests to en and cover the production payload shapes. * fix(cli): prettier detect-changes-format and degraded eval assertion --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-02 18:59:53 +01:00
glier	dea396a13c	feat(ingestion): resolve Spring messaging destinations into Destination nodes (#3132)	2026-09-02 11:46:50 +01:00
Gergő Magyar	5a1e5c8803	feat(kotlin): ingest Spring HTTP routes as decoratorRoutes (#3133) ... * feat(kotlin): ingest Spring HTTP routes as decoratorRoutes (#3130) Kotlin RestControllers now emit analyze Route nodes, handler attribution, and folded constant paths on the ingestion decoratorRoutes channel, matching Java Spring without changing Java or Python extractors. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): reject abstract/sealed Kotlin RestControllers and keep Java brace parsing Code review required fail-closed admission for abstract and sealed classes, and Kotlin-owned method=[...] translation so Java extractors do not start emitting routes from bracket arrays. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(kotlin): note ingestion-side Spring decoratorRoutes wiring The module comment still described Kotlin as group-layer-only. Ingestion now uses the same constant-fold hooks as Java. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(kotlin): keep empty Spring path arrays and trailing commas (#3133) Empty [] / arrayOf() class or method paths are no prefix, not a skip, matching the group-layer contract. Trailing commas in annotation argument lists no longer fail parseSpringAnnotationArguments. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(kotlin): flatten empty Spring path classification Match class-level empty [] / arrayOf() handling to the method-level branch so the fail-closed path is not nested. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 23:06:56 +01:00
Carter LaSalle	c283b21e9a	fix(mcp): honor includeTests for C#, Java, Swift and PHP test paths (#2866) ... * fix(mcp): honor includeTests for C#, Java, Swift and PHP test paths Test-file classification had two hand-maintained implementations that had drifted: core/ingestion/entry-point-scoring.ts isTestFile — excludes tests from process entry points mcp/local/local-backend.ts isTestFilePath — backs `includeTests` on impact/trace/context The MCP copy recognized no C#, Java or Swift test convention and neither PHP form, so `includeTests: false` silently failed to filter them — a C# project's `*.Tests/` and a Maven project's `src/test/` landed in blast-radius output as though they were production callers. The scoring copy missed `/fixtures/` and `/conftest.`, so those could be selected as process entry points. Both now delegate to one predicate carrying the union of the two pattern sets. Public names are unchanged, so importers are unaffected. The duplication was not gratuitous: `entry-point-scoring.ts` imports the language-provider registry, and #2802 deliberately cut that closure out of MCP server startup — importing it from `local-backend.ts` would put it back. The shared predicate therefore lives in its own module with NO imports, and a test asserts it declares none, so the startup cost cannot be reintroduced by a future import added there. 19 new tests: the previously-missed paths per language, nullish and Windows-separator handling, production paths that must NOT match, and a cross-check that both public names agree on every case — the regression guard for the drift itself. Behavior-neutral on a Python/Go/TypeScript repository (204,336 nodes / 299,580 edges / 813 flows before and after), since the newly-recognized patterns are languages it does not contain. `npx tsc --noEmit` clean; 728 tests pass across the entry-point, process, impact and test-file suites. * Address PR review feedback (#2866) Tighten the shared test-path predicate so includeTests filtering no longer treats Contest.swift/Latest.php as tests, unanchored uitests/ as a substring, or production /fixtures/ trees as test code. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify the shared test-path matcher Drop substring needles already covered by /test/, /tests/, and /spec/, and inline the one-off slash-prefix helper. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#2866) Correct the module header: scoring already matched /test/, so /test/fixtures/ was never the scoring gap — only /conftest. was. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#2866) Classify Xcode *UITests path segments without restoring the unanchored uitests/ substring that also matches fruitests. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Carter LaSalle <carterlasalle@gmail.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 17:43:53 +01:00
Carter LaSalle	f34daea86a	fix(routes): connect decorator routes to their handler function (#2865) ... * fix(routes): connect decorator routes to their handler function A Route node's only relationship was HANDLES_ROUTE from its FILE. The graph knew a route existed and which file declared it, but not which function implemented it. Two consequences on a 12.4k-file repository with 162 FastAPI routes: - Every decorated handler was indistinguishable from dead code. Its sole edge was DEFINES, so a reachability query reported it unreferenced even though the framework invokes it on every request. - `route_map` / `api_impact` could only answer at file granularity, and `processes.ts` routed every route through its `routesWithoutHandlerByFile` fallback instead of keying by handler. Two halves of one gap, both already designed for and neither wired: 1. `ExtractedDecoratorRoute.handlerName` is documented as "captured at extraction where the decorated definition node is in hand", and `resolveRouteHandlerSymbols` already consumes it to stamp `handlerSymbolId`. Only the Spring extractor ever set it, so for every decorator-routed framework — FastAPI, Flask, NestJS — it arrived undefined and 0 of 162 routes carried a handler. A route decorator's parent IS the decorated definition, so the name is in hand: add `decoratedDefinitionName` and thread it through. It climbs consecutive decorators so stacked forms (`@router.get(...)` over `@requires_auth`) resolve, caps the climb so a malformed tree cannot loop, and returns undefined rather than guessing — the routes phase already treats a missing name as "fall back to file-level". 2. With a handler symbol resolved there is finally something to point an edge at. Emit a definition-level HANDLES_ROUTE alongside the file-level one. The sibling decorator overlay already does exactly this: `pipeline-phases/tools.ts` anchors HANDLES_TOOL on the definition the decorator sat on, not its file. Routes were the outlier. Kept as one change because the edge is inert without the symbol — emitted from a branch lacking part 1 it produces zero edges, since `handlerSymbolId` is empty. Additive, and both existing consumers are unaffected: `group/extractors/http-route-extractor.ts` types its query `(handlerFile:File)`; `manifest-extractor.ts` matches an untyped `(handler)` but takes `LIMIT 1` ordered by `handler.id`, and `File:…` sorts before `Function:…`, so its selected row is unchanged. Direction is Function → Route, matching how every other overlay attaches (MEMBER_OF → Community, STEP_IN_PROCESS → Process, HANDLES_TOOL → Tool: the symbol is the source). That also keeps it free of schema risk — `Function|Route` is already declared by the ATTACHMENT rule in `lbug/schema.ts` (`DEFINITION_ANCHOR_LABELS × ATTACHMENT_TARGET_LABELS`), which that file documents as deliberate headroom for this case. Route → Function would have needed a new hand-listed pair, and an undeclared pair aborts `analyze` outright — a failure that file records having hit four separate times. Verified on a FastAPI fixture (edges 9 → 11): api.py (File) -> GET /widgets, POST /widgets [unchanged] list_widgets (line 10) -> GET /widgets [new] create_widget (line 15) -> POST /widgets [new] On the 12.4k-file repository: 161 of 162 routes now resolve to their handler function, up from 0. The single abstention is `uniqueSymbolId` correctly refusing to guess where the name is not uniquely resolvable in its file. `npx tsc --noEmit` clean; schema-pair coverage and route suites pass (196 tests). * fix(routes): harden decorator handler attribution (#2865) Keep definition-level route links correct across warm caches and malformed symbol lookups, and avoid per-route group-sync scans. Move Python AST ownership behind the language provider and add end-to-end regression coverage. Note: full npm test could not complete in this container due unrelated worker startup failures and a stalled retry; targeted route suites, typecheck, format, and lint passed. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(routes): reuse per-file symbol lookup and drop duplicate warm-cache test Share extract()'s CONTAINING_QUERY memo with the graph provider path, resolve each route handler once, and fold the decorator-edge warm-cache assertions into the existing FastAPI composed-route round-trip. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Carter LaSalle <carterlasalle@gmail.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 14:03:30 +00:00
glier	f7a58cf188	feat(ingestion): capture Spring handler annotation arguments and template publishes (#3128) ... * feat(ingestion): capture Spring handler annotation arguments and template publishes Non-HTTP handler recognition already resolves the annotation NAME through imports, aliases, use-site targets and package visibility. What it never captured is the annotation's ARGUMENTS, so the destination a listener binds to was invisible: `@KafkaListener(topics = ...)` and `@RabbitListener(queues = ...)` name it with different attributes, and a producer names it by position. The publishing side was missing entirely, which left every messaging edge one-directional by construction. Consumer side: `SpringNonHttpHandlerAnnotationFact` gains an optional `args?: readonly { name?: string; text: string }[]`. `name` is optional because positional and named arguments are genuinely different shapes, not because it is sometimes unknown. Producer side: `KafkaTemplate.send`, `RabbitTemplate.convertAndSend`, `JmsTemplate.convertAndSend` and `StreamBridge.send` for both languages. Arguments are captured as SYNTAX, never as a resolved address. At capture time imports are not final, a sibling file's constants do not exist yet and configuration has not been read — the same reason annotation-name resolution was deferred. Resolution belongs to a later phase; doing it here would be a layering error that happens to work on simple inputs. The parse cache schema moves 82 -> 83. Both new facts ride the existing worker -> main side channel, which is replayed verbatim from `ParsedFile.captureSideChannel`, so a warm v82 cache would skip the workers and hand back annotation facts with no `args` and an empty producer list. Measured on the fixture app: a warm all-cache-hit run (`usedWorkerPool=false`, `reparsedFileCount=0`) reproduces 6 Java and 7 Kotlin producer facts from the store alone — exactly the state a pre-change cache would have served as zero. Tests cover both languages across literal, constant and configuration-key destinations, and pin the PREVIOUS behaviour too: handlers captured before are still captured, and shapes that must not produce a fact still do not. * test(ingestion): cover the handler and template shapes capture left unpinned Auditing the argument capture against its own definition of done turned up three annotations and three templates that work but that nothing asserts, so a regression in them would land silently. Handler side: `@EventListener` and `@ServiceActivator` were only ever checked for RECOGNITION, never for arguments, in either language, and Kotlin `@RabbitListener` appeared in no argument test at all. Both annotations carry an address just as `topics` and `queues` do — an event listener names it as a type and an integration endpoint names it as a channel — so leaving them unpinned left a third of the handler family covered by nothing. Producer side: Kafka was the only template whose destination was written three ways. Rabbit, JMS and the stream bridge each appeared with a single spelling, so nothing said that a constant or a configuration-bound name produces a fact for them too. The same fixtures pin the negative that `RabbitTemplate.send` and `JmsTemplate.send` stay unrecognized, since only the method that belongs to the template counts. Each test asserts the previous behaviour alongside the new one: the handler is still recognized and still named the same, and only then are its arguments checked. A test that looked at arguments alone would keep passing if recognition itself broke. Verified against the parent commit that this is coverage, not repair: every Java and Kotlin fixture in the suite produces a byte-identical capture side channel on both revisions once arguments and producer facts are set aside. Mutating `StreamBridge` out of the template table, and making Kotlin annotation arguments return nothing, each fail the new tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): stop Spring capture from inventing arguments and receivers Five defects in the capture-time Spring messaging facts, all of which put data that is wrong — not data that is missing — into a durable store. Facts built from recovered syntax. After a syntax error tree-sitter keeps parsing by guessing boundaries, so the tree stays well formed while describing text nobody wrote. An unterminated `kafkaTemplate.send(TOPIC,` absorbed the next method's source and offered it as two more arguments; `@KafkaListener(topics = "orders", groupId =` reported a `groupId` whose value was an empty `{}` borrowed from the method body. Both now fail closed: a producer call with an unparsed argument list yields no fact at all, and an annotation with one reports no arguments. Neither carries a state that could mean "published somewhere unreadable", so the choice was between silence and a plausible lie. Arguments were not normalized though the receiver beside them was. The receiver already collapsed a wrapped chain to one spelling; the argument kept its newlines and the ENCLOSING block's indentation, so the same constant compared unequal to itself at two nesting depths, and again in a CRLF checkout. Receiver and argument now share one normalizer. That normalizer damaged multi-line literals. Its doc comment promised to keep the rewrite away from nested string literals, and delivered that only for single-line ones: a Java text block or Kotlin raw string whose newline sat next to a dot lost the newline, changing the value. The normalizer is now literal-aware, which makes the promise true for both. The receiver name match accepted only one decoration. Matching the type name as a suffix recognized `orderKafkaTemplate` and dropped `kafkaTemplateDlq`, `kafkaTemplateV2`, `kafkaTemplate2`, `KAFKA_TEMPLATE`, `kafka_template`, `streamBridge2`, `STREAM_BRIDGE`, and `rabbitTemplate1` — including the `static final` constant spelling, which is exactly the shape this capture exists to find. The name is now folded on `_`/`$` and matched as a substring. The bare-identifier gate still runs first and is what keeps `config.get("a.kafkaTemplate")`, `templates["k"]`, and `getTemplate()` out. Ownership was attributed one level too deep. With no boundary types the ancestor walk passed through a nested type body, so a publish in the field initializer of a class declared inside a method was attributed to that method, which may never run it. The identical construct at the top level of a class already yielded no fact; a type body is now a boundary so the rule reads the same at every depth, while a publish in a METHOD of a nested or anonymous type is still attributed to that method. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * perf(ingestion): read Kotlin handler annotation arguments on evidence Kotlin asked for annotation arguments unconditionally, for every annotated function with any annotation, while Java made the same decision in two passes and paid only for callables that carry a handler annotation. Measured on 200 annotated NON-handler functions in one file, the Kotlin side-channel payload went from 41069 bytes to 78797 — a doubling, crossing the worker boundary and landing in the durable store, for data no consumer reads today. The reason Kotlin had no prefilter is real and is preserved: an import alias (`EventListener as SpringEvent`) gives a handler annotation a local name no list can contain, so discarding CALLABLES by simple name would lose them before the post-import resolver runs. That argument covers capturing the annotation; it does not cover reading its arguments, because the alias is not a mystery at capture time. The import header states both the local name and the FQN it stands for, so the existing relevance predicate can be asked about the IMPORTED name and the answer carried back to the alias. Kotlin now runs Java's two passes, with that alias set widening the first one. Every annotated function still produces a fact with the same name and use-site target as before — the non-handler payload is 41069 bytes again, byte for byte what it cost before arguments existed — while handlers, and handlers reached only through an alias, keep their arguments. Also corrects two comments that described behavior the code did not have. The Java capture claimed an economy Kotlin was not making; it now describes both languages. The argument opt-in on both DI modules claimed it kept argument text off the wire, but every DI fact already carries the annotation's full source text — what the opt-in avoids is a second, parsed copy, and the comment now says so. The test file is renamed: `spring-handler-annotation-arguments` differed from the pre-existing `spring-annotation-arguments` by one word in the middle, though they cover different mechanisms — an AST capture versus a text parser. It is now `spring-argument-fact-capture`, after the module it exercises. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(ingestion): correct the argument-text contract the normalizer outgrew Both `SpringNonHttpHandlerAnnotationFact.args` and `SpringArgumentFact.text` promised the value stays "exactly as written". That was true when the field was added and stopped being true in the same branch, when argument text started going through `normalizeSpringFactText` so that one destination written across two lines would not compare unequal to the same reference on one line. A consumer reading only the interface would have assumed a source spelling the fact does not retain — and the indentation such a consumer would have seen is the enclosing block's, not a property of the expression at all. Both docs now state the single rewrite and its reason, and still say plainly that nothing is resolved. Reported by the review bot on #3128; the claim was introduced by this branch, not inherited. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * style(ingestion): apply Prettier to the four files CI flagged `quality / format` runs `prettier --check .` and four files from this branch had drifted: two line-width wraps and two of the opposite kind, where a call fits on one line. No behaviour change — tsc clean, the four affected suites still pass 126 tests. Worth noting why the pre-commit hook did not catch it: lint-staged formats staged files, but a rebase replays commits without running hooks, so anything that only becomes unformatted relative to a moved base slips through. Checking the whole diff against `prettier --check` before pushing is the reliable step. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(ingestion): publish Kotlin named arguments through a Kotlin template Kotlin forbids named arguments when the callee is a Java method: parameter names are not guaranteed to survive into bytecode, so the compiler refuses `kafkaTemplate.send(topic = ..., data = ...)` for the Spring `KafkaTemplate` imported from `org.springframework.kafka.core`. Every named-argument example in this feature was written that way, which asserted capture on source that could never compile. The path itself is real and stays covered. The classifier matches on the receiver's NAME, so a template declared in Kotlin is recognized exactly like the Spring one, and named arguments to it are legal. Each affected example now declares that template and publishes through it; the assertions are unchanged except for the one receiver spelling they name. The fixture's `publishWithNamedArguments` had no test reading it at all, so it carried the illegal shape into an app fixture for nothing. It is removed, and the two pipeline expectations that counted its publish drop a row. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): withhold a broker when the receiver name matches two templates Widening the receiver-name rule from a suffix to a substring — needed to accept `kafkaTemplateDlq`, `KAFKA_TEMPLATE`, and the rest — also let ONE receiver satisfy TWO signatures. `KafkaTemplate` and `StreamBridge` both publish through `send`, `RabbitTemplate` and `JmsTemplate` both through `convertAndSend`, so `streamBridgeKafkaTemplate.send(...)` matched twice and the loop returned whichever came first in the list: kafka, by declaration order alone. The receiver's TYPE is deliberately never resolved here, so nothing in this module can rank the two matches. Neither the longest match, nor the last one, nor the order of the signature list is evidence about the bean: that name reads equally as a KafkaTemplate fronted by a stream binding or a StreamBridge named after the broker behind it. Publishing one of them as the template turned an unanswered question into a definite attribution a consumer has no way to distinguish from a resolved one — a publish routed to the wrong broker. An ambiguous receiver now yields no fact at all. That costs a rare publish, stays recoverable by a later phase that owns type information, and is the failure this capture already prefers everywhere else. Both outcomes are pinned: three receivers naming two templates yield nothing, while decorated names that merely look long (`orderStreamBridge`, `streamingKafkaTemplate`) still resolve. The `typeName` contract said "suffix", which the same widening had made false. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(ingestion): correct two argument contracts this change set invalidated Sweeping the Spring capture comments for claims the feature commits outgrew turned up two more, both about what a MISSING argument list means. `SpringNonHttpHandlerAnnotationFact.args` promised that absence means the annotation was written without an argument list. Reading Kotlin arguments on evidence gave absence a second cause: Kotlin still produces a fact for every annotated function — it has no name prefilter, so an import alias cannot hide a handler — but reads arguments only for callables carrying a handler annotation, so a non-handler fact has no arguments however its annotation was written. Java produces facts for handler-bearing callables only, so there the old reading still holds. The field now states both causes and which language has which. `SpringArgumentFact.name` said a template call gives its destination by position. That is true of Java, which has no named arguments, but Kotlin names call arguments whenever the callee is declared in Kotlin, and this module captures the key when it does — the reason the field exists for calls at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): make the Kotlin argument reader refuse recovered syntax itself `kotlinValueArgumentFacts` is exported and already has a caller in another module, and its contract said the caller MUST reject a recovered list first. Both callers did. But a guard that every future caller has to remember is the same fragility this change set exists to remove — the Java twin is safe only because it is module-private with one call site. It now returns `null` for a recovered list, so the decision is unavoidable at the type level, and each caller answers in the way its fact requires: a producer call drops the whole fact, having no state for "published somewhere unreadable", while an annotation reports no arguments and collapses into the marker form. Both say "nothing here to resolve", which is true. No behaviour change — the same 126 tests across the three affected suites pass, including the truncated-annotation and truncated-call cases that pin the fail-closed path. Raised as hardening in the maintainer review of #3128. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-01 14:35:19 +01:00
Gergő Magyar	52924ef12c	perf(emit): drop six equivalent redundancies on Java-scale index path (#3129) ... * perf(scope): reuse deferred sites and signatures for callable-value-flow Pass the Phase 4 deferred-site collection and signature map into emitCallableValueFlow so the emit path does not rescan the same call sites. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(ingestion): nest owner registries instead of composite string keys Look up methods, fields, and nested types via Map<owner, Map<name, defs>> while keeping EMPTY identity and TypeRegistry miss [] semantics. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(scope): memoize resolveDefGraphId per nodeLookup Cache graph ids on a WeakMap keyed by lookup identity so heritage rebuild invalidates, with an env opt-out that skips the cache. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(csv): prepare file content once and LRU-touch via Map order Cache split lines and binary flags per source file so snippet and FTS extraction do not re-scan the same bytes. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(identity): allow in-process cache guards only when opted in or unwritable Keep the ≥128-guard subprocess default on writable installs; use direct snapshots when the env flag is set or W_OK fails on the analyzer tree. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor: share empty CSV payload and restore spacing after memo key (U4, U3) Co-authored-by: Cursor <cursoragent@cursor.com> * test(scope): assert resolveDefGraphId memo skips a second lookup walk The ID-equality checks still passed with the memo disabled. Count Map#get on the lookup so a repeat call must hit the WeakMap cache. Also apply prettier on the remaining emit-path files CI flagged. Co-authored-by: Cursor <cursoragent@cursor.com> * test: pin identity W_OK probes and memo env isolation Co-authored-by: Cursor <cursoragent@cursor.com> * docs: document emit-path env knobs and fix registry headers CONTRIBUTING requires README rows for new GITNEXUS_* variables; also drop stale owner\0name comments after the nested-map change. --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 11:22:55 +00:00
Gergő Magyar	e1e2464960	feat(kotlin): bind Spring config consumers on Kotlin sources (#3126) ... * feat(kotlin): bind Spring @Value and ConfigurationProperties consumers Kotlin sources were skipping the Java-only config-binding attach path, so mixed JVM apps under-reported blast radius for Kotlin placeholders. Capture from the live AST, serialize on the existing side channel, and reuse the shared binder. (U1-U4) Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): require exact Spring annotation FQNs and skip raw-string escapes Reject similarly named third-party imports and leave Kotlin triple-quoted bodies undecoded so capture stays fail-closed. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(kotlin): use only grammar-valid Kotlin string and class-name nodes The coverage shard failed the #1920 literal gate on invented string node types and a Java-style name field. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(kotlin): fail closed on non-literal prefixes and persist unresolved config markers Reject constant and boolean @ConfigurationProperties arguments, scope nested Value shadows to their owner, and rewrite drifted consumer files when a config key is deleted. Co-authored-by: Cursor <cursoragent@cursor.com> * test(kotlin): add config-consumer capture benchmark and fix JVM feature stamps The Kotlin capture path had no performance or behavior guard: a file-wide lexical shadow regression silently dropped two of every three facts. The new bench arm fingerprints @Value / @ConfigurationProperties facts from an explicit-import control against a wildcard-import corpus whose files each declare a sibling nested `Value` type, so parity between the arms is the regression gate, and CI runs it with scaling + widening budgets. Broadening spring.config-bindings to .kt also means Kotlin-only JVM repos now stamp the feature, which the two exact-map orchestration expectations still denied. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(kotlin): let an explicit import shadow the Spring wildcard import importedAs accepted a star import of the Spring package even when the same simple name was explicitly bound to another type, so a file importing com.example.Value alongside the Spring annotation package emitted a false @Value consumer fact. Kotlin resolves the explicit import first, so the wildcard branch now only applies when the name is otherwise unbound. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 10:32:09 +00:00
Gergő Magyar	a82362765c	fix: stop analyze from clobbering customized GitNexus skills (#3124) ... * fix: preserve customized SKILL.md files during analyze Skip overwriting standard GitNexus skill files when they already differ from the bundled template, and keep divergent nested leftovers instead of deleting them. Fixes #3080 Co-authored-by: Cursor <cursoragent@cursor.com> * docs: note --skip-agents-md does not skip skills Point operators at --skip-skills so the AGENTS/CLAUDE skip flag is not mistaken for a full agent-file freeze. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): treat unreadable SKILL.md as an error, not missing Only ENOENT counts as absent so EACCES cannot fall through to recursive rm. Strengthen the skipSkills nested leftover test with a bundle-identical file that install would otherwise delete. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): prettier-format ai-context unit tests Co-authored-by: Cursor <cursoragent@cursor.com> * docs: clarify --skip-agents-md vs community --skills Co-authored-by: Cursor <cursoragent@cursor.com> * test: pin GITNEXUS_LANG=en for skip-agents-md help assertions Co-authored-by: Cursor <cursoragent@cursor.com> * fix: preserve customized skills in analyze summaries and setup Report preserved vs written skills, keep leftover nested directories that contain extra files, and skip setup overwrite of divergent SKILL.md. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3124) Preserve operator-edited files inside directory skills during setup, and restore GITNEXUS_TEST_SKILLS_ROOT after the Antigravity skill tests. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3124) Copy directory-skill companions even when SKILL.md is customized, while still skipping files whose bytes already differ from the bundle. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 09:56:48 +00:00
Gergő Magyar	9f82ffd6bf	fix: MUST graph tools on structural reads in generated agent block (#3125) ... * fix: add a read-path MUST so generated agent blocks invoke GitNexus on structural questions The managed Always-Do list gated every MUST on edit/commit/rename, so read-only sessions had no reason to call query, context, or impact. Replace the advisory Explore/Use bullets and keep the #2059 call shapes. Fixes #3076 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): assert pdg_query, Spring Actuator, and Explore/Use absence Co-authored-by: Cursor <cursoragent@cursor.com> * style: prettier-wrap read-path MUST unit assertions CI quality/format failed on the two test files that grew beyond printWidth. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3125) - Assert the read-path MUST bullet is immediately followed by the Spring Actuator Always-Do line, not merely that both substrings exist. Co-authored-by: Cursor <cursoragent@cursor.com> * test: pin the read-path MUST to Always-Do so CI cannot miss a move The previous floor and whole-block toContain still passed if the MUST left Always-Do while pdg_query kept the count. Own-line and ungated-length asserts close that hole. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: pick graph tools by question type and require graph-first reads Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 09:03:08 +00:00
MyShining	c217a0f257	feat(spring): import optional Actuator runtime data with Kotlin JVM mapping (#3107)	2026-09-01 06:22:38 +01:00
ChunxueLi	72ff2b9453	feat(jvm): fold Java static wildcards and Kotlin star imports for route constants (#3110) ... * feat(java): expand wildcard static imports + POSIX-space import resolution - `import static a.b.C.*` records the class FQN at extract time (ModuleConstants.wildcardImports) and expandJavaWildcardStaticImports materializes the bare-name bindings once the repo constants map exists, mirroring explicit single-member static imports. Wired in both the group-side prepareRepo fold and the ingestion-side parse-impl pass so the two query surfaces cannot diverge. Without this, wildcard-imported route constants (~693 routes on our monorepo) silently failed to fold and their provider contracts were dropped. - resolveJavaImport compares in POSIX space (backslash-normalized repo keys) — on Windows the '/'-joined class file never matched a backslash-keyed repo (observed: 675 calls, zero hits). - Wildcard bindings never overwrite single imports (a member shadowing its own wildcard is honored); unresolved wildcards degrade to the existing skip floor. Rebased onto current main: the parse-worker gate this originally carried is superseded by the provider moduleConstantHeuristic architecture; only the resolver-side wildcard expansion and POSIX tolerance remain. * chore(cache): claim SCHEMA_BUMP 83 (82 taken upstream by Spring lookup facts) * style: prettier * fix(java): make wildcard static imports actually resolve route constants extractJavaModuleConstants never populated wildcardImports, so `import static a.b.C.*;` was inert: the asterisk is a sibling of scoped_identifier in tree-sitter-java, not a path segment. Record the class FQN there and stop binding the class simple name as a field. Wildcard-only files also fell through every harvest gate (the java provider heuristic regex, the parse worker emit check, and the group prepareRepo filter), so the constants never reached either layer. Expansion now resolves targets against constant-defining files only, keeping ingestion and group in parity (#2980 R4). Adds unit coverage for extraction, expansion/shadowing, the unresolved skip floor, the harvest heuristic, Windows path keys, and group <-> ingestion parity. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(kotlin): fold package-star imports for route constants Kotlin `import pkg.*` now records star scopes and resolves unique top-level names after local and explicit imports, matching the Java wildcard path without accepting invalid object-star imports. Reuse a Java constant-file suffix index across expansion so wildcard materialization stays linear as both constants and importers scale. Add named-vs-star benches and CI --check gates. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(jvm): fold wildcard imports without shadowing locals or skipping same-package names Keep Java unfoldable declarations from being resurrected by static wildcards, bind only the target type's members, and prefer Kotlin same-package names over package-star imports. Move repo-wide preparation behind a language-provider hook so the shared parse phase stays language-agnostic. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3110) - Stop treating a Java static wildcard as a type import for qualified refs. - Harvest only class and static (including on-demand) imports, not import pkg.*. - Let harvested Kotlin top-level names shadow same-package star imports. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3110) - Fold Kotlin classifier-star imports (`import Type.*`) the same way package stars already fold. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3110) - Rebuild the Kotlin constant index when overlay replaces a contributing file. - Document the wildcard shape in the Java pipeline e2e fixture. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: l.cx <l.cx@winning.com.cn> Co-authored-by: ChunxueLi <mecoloud@users.noreply.gitee.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-31 21:58:40 +00:00
Gergő Magyar	66b44afe8c	fix(group): make degraded links, sync warnings and UID-only impact actually work (#3113) ... * feat(group-surface): impact selector pass-through + degraded links + sync hygiene - @group impact forwards target_uid/file_path/kind through service port and cross-impact impactParams (was dead-wired: params accepted at MCP boundary then dropped at validation). - crossLinks with unresolved provider symbols carry degraded: true, derived at the persistence boundary after merge/dedupe; sync reports 'degraded links: N' and per-repo extraction failures instead of swallowing them; bridge write failures surface as sync warnings; contracts.json passes through dedupeContracts. - Absolute-URL branch restores %7B/%7D around {param} after URL parsing. - tests: consumer matrix + wildcard folding + degraded pins (261 new); SCHEMA_BUMP pin 47 -> 48 (wildcardImports cache shape); sync.ts NUL byte rewritten as text escape (no longer binary to git). Co-Authored-By: Claude <noreply@anthropic.com> * fix(group): impact selector pass-through, degraded links, sync failure hygiene - @group impact forwards target_uid/file_path/kind through the service port into cross-impact impactParams. These were accepted at the MCP boundary and then dropped in validation — a dead wire: disambiguating an ambiguous impact target never actually reached the per-member impact. - Cross-links whose provider endpoint never resolves to a graph symbol are marked degraded: true at the single persistence boundary (post merge/dedupe, before re-export), counted as SyncResult.degradedLinks, and surfaced by the sync summary ('degraded links: N') — the remedy (re-analyze the provider repo) is documented on the field. - Sync failure hygiene: a repo whose per-repo extraction throws records its reason in SyncResult.failedRepos (still lands in missingRepos, so downstream semantics are unchanged) instead of the old silent swallow that could persist half a repo's contracts; operator warnings accumulate in SyncResult.warnings. Tests: cross-impact selector threading, degraded-link marking, per-repo failure reporting. * style: prettier * fix(group): make degraded links, sync warnings and UID-only impact actually work The three fixes this branch claims were wired at the type and payload level but never at the boundary that produces the values: - `degraded` was only ever cleared by the exported `dedupeCrossLinks`, which the sync path does not use, so `degradedLinks` was always 0. Derivation now lives in one exported `applyDegradedFlag` that both the sync finalize and the post-merge re-derivation call. - The bridge-write catch logged an operator warning and dropped it, leaving `warnings` permanently `[]`. - `@group impact` rejected a UID-only call before it parsed `target_uid`, so the documented "re-call with target_uid" disambiguation loop was unreachable in group mode even though the selectors were forwarded. - `failedRepos[].repo` reported the registry display name while the repo landed in `unreadableRepos` under its group path, so the two lists could not be joined; the JSDoc also pointed at the wrong list. - Restored the truncated `READ THE RESULT:` heading in the group_sync tool description and documented degradedLinks / failedRepos / warnings. Tests pin each value at the boundary that produces it, including the exact group_sync wire shape, which previously omitted all three new fields. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: l.cx <l.cx@winning.com.cn> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: ChunxueLi <mecoloud@users.noreply.gitee.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-31 20:03:53 +00:00
ChunxueLi	678a0e11c9	fix(server,web): honor the grep tool contract — real regex, fileFilter, caseSensitive (#3109) ... * fix(server,web): honor grep tool contract — real regex, fileFilter, caseSensitive (Patch 12) Background ========== The web chat's grep tool schema has always promised regex search with an optional path-substring fileFilter and caseSensitive control, but the GET /api/grep handler escapeRegExp()'d every pattern into a literal substring (a ReDoS hardening from fa36254e / #1317 that never re-synced the tool contract). Consequences, verified in production use against the sr-next backend repo (23k-file Java monorepo): - An agent sending the documented alternation form ("sign|Sign") got zero hits and concluded the sign/签署 interface did not exist. - The schema's own example pattern ("console\\.log") could never match: the escaped literal searched for a backslash in the source. - fileFilter / caseSensitive were read by nobody — pure schema fiction. - The web handler worked around the server with a (?=.*filter).*pattern lookahead splice that the same escaping also defeated. - Collateral: the impact tool's grep fallback (\b${escapeRegex(name)}\b) was silently dead code under literal semantics; it comes back to life with this fix (expected improvement, noted for reviewers). Fix === Server (gitnexus): - New src/server/grep-params.ts — pure query-param parser (no Express / native imports, per the #2790 helper-extraction convention): regex construction (default real regex; literal=1 restores the old escaped-substring semantics as an opt-out), lowercase path-substring fileFilter, caseSensitive flag, limit clamp [1,200] default 50, BadRequestError error paths (mapped to 400 by statusFromError). - /api/grep handler in api.ts becomes thin wiring: fileFilter path filtering before the (unchanged) traversal guard, a 5s wall-clock budget checked between files (partial results plus timedOut: true), read-only DB open unchanged. The regex is deliberately built WITHOUT the 'g' flag: the handler tests line-by-line and a stale lastIndex would skip matches (the old code had to reset it manually); 'm' is likewise omitted — each test sees one line, so ^/$ already anchor at string boundaries. Web (gitnexus-web): - tools.ts: drop the lookahead splice; description now tells the model the truth (real regex, alternation works, path-substring filter, case-insensitive default, result cap and time budget). - backend-client.ts: grep() takes GrepOptions {fileFilter,caseSensitive} and forwards them as query params. - useAppState.tsx: assembly site threads the options through. Security — residual ReDoS exposure (read this before deploying) =============================================================== The literal-only era was accidentally ReDoS-immune; this patch knowingly trades that immunity back for the promised contract. The bounds (200-char pattern cap, line-by-line matching, result cap, 5s budget) do NOT cover a single catastrophically backtracking regex.test(): it blocks the Node event loop synchronously, the budget (checked between files) cannot interrupt it, and the whole server is unresponsive for the duration (measured: (a+)+$ against a 35-char line exceeds 120 seconds). Accepted because local serve binds loopback by default and hosted deploys gate /api/grep behind the edge token; documented in SECURITY.md (new section) with the worker_threads+terminate / optional-re2 follow-up called out. literal=1 restores full immunity for untrusted callers. Compatibility audit =================== Repo-wide: /api/grep's only HTTP caller is backend-client.grep(); the MCP tool surface has no grep tool; eval/ uses shell grep, not this endpoint; the endpoint is undocumented (docs/llms.txt) with no known third-party consumers. Breaking surface ≈ zero. Pattern metacharacter semantics change for direct curl users ("array[0]" now needs escaping or literal=1). Tests ===== +20 cases in test/unit/grep-params.test.ts: alternation (the regression that burned the agent), the schema's own example, case flags, literal compat, CJK patterns, ^/$ line anchors, fileFilter normalization + array-form rejection, limit clamping, type-confusion guards, invalid regex, and a source-level handler wiring assertion (api-readonly-wiring style). Full unit suite: no new failures (22 pre-existing failures reproduced identically with this patch stashed — analyzer-identity dist fingerprint + lbug native-env classes). Upstream plan ============= Issue + PR to abhigyanpatwari/GitNexus; the PR description must front the ReDoS trade-off with the worker-isolation follow-up. Repro for the issue: curl ".../api/grep?pattern=TODO%7CFIXME" — 0 hits under literal semantics, both marker classes under regex semantics. Custom-patch ledger: CUSTOM_PATCHES.md Patch 12. * style: prettier * fix(web): surface grep timedOut so partial scans are not silent misses Propagate the server timeout flag through the backend client and chat tool, check the 5s budget between lines, and document the accepted regex-injection CodeQL finding next to new RegExp. * Address PR review feedback (#3109) - Cover empty and null fileFilter in the grep client test - Keep timedOut as a required boolean and reuse GrepOptions - Sample the grep deadline every 256 lines instead of every line Note: pre-existing failure in impact-tool.test.ts not addressed by this PR. * Address PR review feedback (#3109) Run /api/grep matching in a worker_threads worker so terminate() can cut a catastrophic regex.test without blocking the parent event loop. * Address PR review feedback (#3109) Reset lastIndex per line, restore the missing-pattern 400 message, and make the traversal test create a real outside file. * fix(web): align agent grep opts with GrepOptions Use GrepOptions so fileFilter null is accepted by the local GraphRAGBackend stub. * fix(server): silence CodeQL js/regex-injection on intentional grep regex Split literal vs regex construction and suppress with the correct rule id (js/regex-injection). Real regex remains the default contract; literal=1 still escapes. * Address PR review feedback (#3109) Clean up grep-scan temp dirs after each test, and exclude the intentional grep-params RegExp site from CodeQL so js/regex-injection does not re-file. --------- Co-authored-by: l.cx <l.cx@winning.com.cn> Co-authored-by: ChunxueLi <mecoloud@users.noreply.gitee.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>	2026-08-31 20:43:28 +01:00
ChunxueLi	4aa6bddd0a	feat(jvm): synthesize Lombok and Kotlin JVM accessor methods (#2885) ... * feat(java): synthesize Lombok @Data/@Getter/@Setter accessor methods * fix(lombok): resolve class identity by AST node id, not simple name Root-cause fix for the bot review's name-ambiguity findings: 1. Cross-file collision: the owner map was rebuilt per file from result.symbols, which accumulates across the whole language group — a later Java file with the same simple class name resolved to the earlier file's class node. The map is now filled INSIDE the capture loop (per-file scope) and keyed by the class_declaration AST node id (SyntaxNode.id), which is unique by construction. 2. Same-tail nested classes (Outer.A vs Other.A): a name-keyed map overwrote one with the other; AST-node-id keys cannot collide. 3. Synthesized method ids now follow the SAME convention real nested member ids use (keyed by the class's own simple name, matching findEnclosingClassInfo().className), so call resolution can hit synthesized accessors exactly like hand-written ones. 4. Lombok semantics: setters are no longer generated for final fields (Lombok never emits those) and @Setter(AccessLevel.NONE) now suppresses setters, symmetric to the existing getter suppression. Also tightens two vacuous test loops flagged by the bot (empty-array for..of passed trivially): counts are asserted before property loops, and a new regression test pins distinct owners for same-tailed nested classes plus the real id convention for nested accessors. * feat(java): synthesize Lombok accessors via provider hook and scope dual-path Replace the worker language===Java branch with LanguageProvider.synthesizeStructureMembers, align MethodRegistry ownership through scope captures, and bump parse-cache schema to 83 so warm caches cannot replay pre-synthesis worker output. Co-authored-by: Cursor <cursoragent@cursor.com> * test(java): cover Lombok synthesis semantics, cache replay, and CI bench Add unit/integration matrices (including durable cold/warm/historical parse-cache), a permanent no-Lombok vs Lombok-heavy harness with fingerprint budgets, and a CI --check step. Document that Kotlin→Java member CALLS remains a pre-existing gap. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(lombok): drop dead state and redundant scans from accessor synthesis Collapse Lombok import provenance into one compilation-unit scan with a cached wildcard flag, remove unused planned-accessor fields and the duplicate @Data enable flag, and plan scope captures without wrapping a fake Parser.Tree. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#2885) Give each Lombok accessor a unique scope range so multi-declarator fields do not share @scope.function IDs, and type the owner map as ReadonlyMap to match the provider hook. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(bench): pin the real Lombok synthesis fingerprint (#2885) The committed baseline held a fingerprint no revision of this branch ever produced, so the CI guard failed on every push. Re-pin it to the value the synthesizer deterministically emits and correct the method count the comment claims (800 x 4 x 2 = 6400, not 12800). Co-authored-by: Cursor <cursoragent@cursor.com> * feat(kotlin): synthesize JVM accessors using shared beanspec helpers (#2885) Kotlin val/var properties now emit the same JavaBeans get/set Methods as Lombok, via jvm/beanspec + jvm/synthetic-accessors. SCHEMA_BUMP 84 invalidates warm caches that would omit those callables. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(kotlin): match kotlinc JVM accessor ABI (#2885) Emit custom getters, preserve is-prefix names, and convert synthetic graph lines to 0-based so same-name accessors resolve to the owner. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#2885) Restrict Lombok provenance to lombok/experimental FQNs and match Kotlin existing methods by exact JVM name. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(jvm): consolidate accessor synthesis (#2885) Keep language-specific discovery in Java and Kotlin adapters while centralizing owner orchestration, collision policy, graph emission, and captures. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(jvm): align accessor synthesis with compiler ABI (#2885) Match Lombok and kotlinc provenance, companion owners, and collision arity so mixed-JVM CALLS bind to the Methods compilers actually emit. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#2885) Mark Kotlin interface accessors abstract, pin the Lombok case-fold collision test, and document the non-lowercase is-prefix rule. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#2885) Honor explicit Getter/Setter over @Data regardless of order, and let field @Accessors replace class-level fluent/chain. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): pin Kotlin scope-capture fingerprint after interface accessors (#2885) Invalidate warm parse cache so interface property Methods are not replayed as concrete. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: ChunxueLi <mecoloud@users.noreply.gitee.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-31 17:55:52 +00:00
Gergő Magyar	e04e1ecc65	fix(group): parse Maven child coordinates independently of parent POMs (#3108) ... * fix(group): parse Maven child coordinates independently of parent POMs Stop treating inherited parent groupId/artifactId as the child's identity so sibling repos no longer collide and workspace manifest links can resolve. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(group): parse Maven POMs with fast-xml-parser Replace the hand-rolled tokenizer so child identity and CDATA/namespaces stay accurate, and collect only project.dependencies so BOM, profile, and plugin entries cannot create workspace links. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(group): parse Gradle identity, catalogs, and named coordinates Read gradle.properties, settings.gradle, and the default libs.versions.toml catalog so workspace links work without executing Gradle, matching the static POM contract. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(group): resolve Kotlin Gradle DSL workspace coordinates Honor Kotlin named arguments, catalog get()/asProvider(), type-safe projects.* accessors, and ksp/kapt/commonMain configs without executing Gradle. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3108) Recognize Gradle group inside allprojects { } and Groovy name-first map coordinates so workspace identity and deps match common DSL forms. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3108) Restore XMLParser.parse for POMs after /autofix swapped in tree-sitter parseSourceSafe, and match underscore catalog aliases from Gradle files. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-31 15:49:43 +00:00
ChunxueLi	19f6731c34	feat(java): resolve SpringContextUtil.getBeans(X.class) dynamic lookups (#2886) ... * feat(java): resolve SpringContextUtil.getBeans(X.class) dynamic lookups * fix(ingestion): make Spring dynamic lookups graph-correct Capture Java and Kotlin lookups from ASTs and resolve them through scoped type bindings and transitive JVM assignability so emitted INJECTS edges are attributable, cache-safe, and production-tested. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(ingestion): keep Spring lookup capture linear Reuse Java and Kotlin scope-query call nodes instead of rewalking each AST, cache DI subtype closures, and enforce linear scaling with production-path benchmarks in CI. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-30 23:09:21 +00:00
Gergő Magyar	43a842724d	fix: bind Razor ViewComponent names to in-repo classes (#3104) ... * fix: bind Razor ViewComponent names to in-repo classes Index Component.InvokeAsync("Name") and in-repo ViewComponent("Name") as CALLS to workspace ViewComponent classes so impact sees real callers instead of an empty graph. SDK types stay unresolved. Fixes #2991 Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix: scan Razor and C# ViewComponent names without regex holes Use string-aware lexers so combined Name= aliases, code-block calls, this/base helpers, and escaped @@ markup match ASP.NET instead of emitting false or missing CALLS. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * perf: skip Razor scans without ViewComponent tokens Preserve the lexer correctness fixes while avoiding per-character work for the common view that cannot contain a supported invocation. Co-authored-by: Cursor <cursoragent@cursor.com> * test: gate Razor ViewComponent extractor scaling in CI Wire mixed-corpus tripwire + GITNEXUS_BENCH loader/scaling checks into the dedicated ci-tests benchmarks job so the #2991 lexer cannot regress without a wall-clock gate. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: read Razor views through one file handle CodeQL js/file-system-race: the size gate stat'd the path and the read re-resolved it, so a template swapped in between could be read past the size ceiling. Both now go through the same handle. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-30 22:41:13 +00:00
Gergő Magyar	72edf40087	perf(store): V8 sidecars plus hardlinked ParsedFile restore (#3099) ... * perf(store): add best-effort V8 sidecars beside canonical JSON caches Warm ParsedFile and parse-cache loads skip JSON.parse when a sidecar is present. JSON remains authoritative: envelope validation plus v8.deserialize decide the hit, and any failure falls back without reparsing. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(store): require generation bind or sidecar drop before cache overwrite A same-length JSON rewrite could accept a leftover V8 sidecar if both generation rotation and unlink failed. Refuse the new generation unless at least one of those invalidations succeeds; skip publishing a sidecar when only the drop succeeded. detect_changes --scope all: 7 files, risk low, no affected processes. tsc --noEmit clean; 115/115 relevant unit tests; cache-related integration tests pass. parse-impl-env-reads worker-ready timeout is pre-existing (same 5 failures with this change set stashed). ESLint 0 errors; remaining warnings are pre-existing and not on changed lines. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * refactor(store): share V8 overwrite invalidation across persist paths The bind-or-drop gate lived in five writers. One helper keeps the protocol in a single place and lets bind/drop run together on the async path. detect_changes --scope all: 3 files, risk low, no affected processes. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(store): hardlink durable ParsedFile shards into the run store Warm restore of parsedfile-cache into parsedfile-store now publishes all four shard files via fs.link, falling back to copy-into-tmp + rename so a leftover dest hardlink can never be written through. JSON remains the canonical cache; V8 sidecars ride the same path. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(store): load immutable V8 shards in place, drop JSON fallback Warm analyze was still paying JSON.parse plus a restore copy. One .v8 envelope per shard and SCHEMA_BUMP 81 make a miss re-extract instead of serving a stale JSON twin. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(store): validate durable V8 warm-cache restores Reject incomplete or corrupt durable generations and snapshot valid shards before skipping parse workers, preserving ParsedFiles when persistence fails. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(store): drop unused durable load path Load ParsedFiles only from the run-store snapshot and share one checksummed payload reader so inspect and deserialize stay consistent. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-30 20:50:20 +00:00
Gergő Magyar	94f67d79d5	fix(analyze): make incremental analyze skip the derived layers it can reuse (#3016) (#3102) ... * fix(analyze): make incremental analyze skip the derived layers it can reuse (#3016) A warm incremental run only ever wrote a handful of files, but it still paid for the whole graph on the way out: Leiden ran over every node, flow extraction re-derived every process, and all FTS indexes were dropped and rebuilt from scratch. On a small edit that tail dominated the run, which is why "incremental" did not feel incremental. Reuse what the previous run already derived when the write plan allows it. The pipeline holds back community detection and flow extraction whenever the persisted metadata says this run is a candidate for a surgical write; the DB keeps its Community/Process rows instead of a wipe-and-rewrite; and the FTS sweep is narrowed to the indexes the run actually has to touch. The bet is placed before the pipeline and settled after it. Any plan that turns out to need a freshly derived layer — full rebuild, escalated write, or an incremental diff with deleted files — runs the held-back phases through `runDeferredDerivedPhases`, against the same graph and phase outputs, so its output is identical to never having skipped them. Correctness details worth naming, since each one silently loses data if got wrong: - The MEMBER_OF / STEP_IN_PROCESS edges of the changed files are snapshotted before the DETACH DELETE and reattached after the subgraph load. Both endpoints are matched by explicit label: `labels(n)[0]` over an unlabelled match returns an empty string on this engine, which produced a snapshot that restored nothing. - The FTS narrowing unions three sets — what the writeback deletes (a DB probe, because a symbol the edit removed is in no fresh graph but is still a row), what it inserts (the fresh graph), and what is missing right now (else a prior escalation's dropped indexes would never come back). An unreadable index catalog withdraws the narrowing entirely. - Deletions disqualify reuse outright: persisted derived rows can reference nodes this run removes, and nothing short of re-deriving can tell which. Covered by the existing incremental suites, including the incremental-equals-force byte-equivalence test and the #2589 drop-before-delete ordering test, plus unit tests for the new helpers. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): address #3102 review on derived reuse and FTS narrowing Re-run Leiden/flows unless the file-hash diff is empty, restore ENTRY_POINT_OF on the preserve path, always drop class_fts before Spring synthetic Class DML, and reject seeded duplicate phase names. Prettier and exact FTS drop-ordering assertions unblock CI and pin the #2589/#3016 contract. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(analyze): reuse FileHashDiff for derived-layer preserve Drop the count DTO, share phase-name uniqueness, and remove the File FTS sentinel that Class already makes unreachable. Refs #3102 Co-authored-by: Cursor <cursoragent@cursor.com> * style(analyze): prettier-wrap shouldPreservePersistedDerivedGraph quality / format failed on the Pick<FileHashDiff> signature wrapping. Refs #3102 Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-30 17:07:57 +00:00