mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-10-05 02:43:32 +00:00
28187bb3a7
Some checks are pending
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Publish / Classify release event (push) Waiting to run
Publish / RC guard (marker + release-PR skip) (push) Blocked by required conditions
Publish / ci (push) Blocked by required conditions
Publish / Publish to npm (push) Blocked by required conditions
Publish / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
* fix(typescript): resolve imports against declared config, not path suffixes (#2953) TypeScript/JavaScript/Vue import resolution ended in `suffixResolve`, which answers "does any file in this repo have a path ending in this specifier?" and answers it by dropping leading segments until something matches. That is not module resolution, and it failed in both directions at once: - `@acme/telemetry/nest`, a registry dependency with no in-repo file, landed on the repo's only path ending in `nest/index.ts` — a false IMPORTS edge at confidence 1.0, indistinguishable downstream from a real one. The reporter measured 44 of 74 `apps/ -> packages/` edges landing on two such files. - `@repo/utils`, a first-party workspace package, resolved to nothing: its name lives in `packages/utils/package.json` and appears in no file path, so a path matcher cannot find it. Zero CALLS from 75 import statements. Both come from the same missing input — nothing read the config that says what exists — so both are fixed by reading it. Replaces the suffix matcher on this path with the algorithm tsc and Node actually run, in their order: relative/absolute, `#imports`, tsconfig `paths` (longest literal prefix wins, every target tried), tsconfig `baseUrl`, then the workspace package's own `exports`/`main`. A specifier none of those declare is external, and resolves to nothing. There is deliberately no fallback. New: - `typescript/tsconfig.ts` — every tsconfig/jsconfig in the repo with `extends` chains resolved, nearest-config-wins per file. The old loader read three filenames at the repo root, required `paths` to exist, and kept only `targets[0]` — none of which describes a monorepo, where `apps/web/ tsconfig.json` is what governs `apps/web/src/main.ts`. - `typescript/module-resolution.ts` — the algorithm. - `typescript/file-candidates.ts` — 11 TS-family extensions, replacing a shared 39-entry list spanning every indexed language, so a TypeScript import can no longer resolve to a `.py` file. - `import-resolvers/node-workspace-packages.ts` — in-repo manifests, with `exports` subpath maps, patterns, condition nesting, and the restriction that a package declaring `exports` exposes only what it lists. The per-pass `SuffixIndex` is gone from these three adapters: real resolution derives nothing from the file list — every candidate comes from a declared source and is checked with one `Set.has` — so there is nothing left to cache. Their `*-import-index-reuse` guards and the JS index-vs-scan differential are deleted with the mechanism they measured; the cross-language contract test moves the three languages to its existing `KNOWN_UNINDEXED` channel, and pins the exemption as a list so a fourth arrival is deliberate. Python, Ruby, Java, Go and the rest still route through `suffixResolve` and are untouched here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Px638Zyqa9CJMUU7DsJoB * test(scope-resolution): assert every resolver refuses external imports (#2953) One property, for all 16 registered resolvers: a specifier naming something outside the repository must not resolve to a file inside it. That is the property #2953 was filed against, and its violation is not a missing edge but a fabricated one — an IMPORTS edge at full confidence between two files with no relationship, which `impact` then reports as blast radius. The mechanism is shared (`suffixResolve`), so the guard is too. Every case pairs an external specifier with a DECOY: an unrelated in-repo file whose path ends the way the specifier does. Without one a resolver that merely found nothing would pass while holding no property at all, so each case also asserts the decoy is reachable by the spelling that SHOULD find it — a typo in a fixture cannot manufacture a pass. Two fixtures had to be corrected before the results meant anything, and both would have recorded a false gap: - C# reads its #1881 gate from scanned namespace evidence and fails OPEN without any, so passing `undefined` measured nothing. Armed, C# holds. - C++ was posting a pass on an extension mismatch (`vector` could never match `src/vector.hpp` whatever the resolver did). Given the header spelling, it does not hold. Result: six hold it — TypeScript, JavaScript and Vue because they resolve against declared config only (#2953); Python (#898) and C# (#1881) because they gate the fallback on in-repo evidence; Rust because `::` never decomposes into a path suffix, which the decoy-reachability arm confirms is a real pass rather than a vacuous one. Ten do not, and are recorded in KNOWN_GAPS with what each currently answers: Java, Kotlin, Go, Ruby, PHP, Dart, Swift, C, C++, COBOL. The map is a work list, not an allowance — the entries are ASSERTED, so a language that starts holding the property fails here and its line gets deleted deliberately rather than rotting into a lie. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Px638Zyqa9CJMUU7DsJoB * fix(typescript): admit only declared workspace packages, and fix four resolver defects (#2953) Review of #2956 found one boundary bug and four correctness defects. The boundary one is the same defect class this PR exists to fix, arriving from a different direction. ## The workspace boundary (review) `loadNodeWorkspacePackages` registered every `package.json` the repo-wide scan found, and never read `pnpm-workspace.yaml` or a root `workspaces` declaration. Finding a manifest is not the same as the workspace admitting one: an app importing registry package `foo` would bind to an excluded fixture or example that happens to declare `name: "foo"` — the false-positive half of #2953, from a new source of evidence. This repository is the example, since `test/fixtures/**` declares `@repo/utils` among others. The admitted set now comes from the declaration — `workspaces` (array and yarn object form), `pnpm-workspace.yaml`, `lerna.json`, with `!` exclusions and `*`/`**` — plus the root package itself. A repo that declares no workspace has exactly one package: the root. A negative fixture pins it, with a named package outside the declared globs that must not resolve. ## Four defects - tsconfig `paths` targets were resolved against the config's own directory when it declared `paths` but inherited `baseUrl`. tsc resolves them against the EFFECTIVE base, so an extending config loaded the right alias pattern and pointed every target at the wrong directory. - two configs in one directory were ranked by directory-listing order, so `tsconfig.base.json` could govern instead of `tsconfig.json` and a config's own `paths` went invisible. Found by the test written for the fix above. - an unexported package subpath also tried `<dir>/src/<subpath>`. Nothing declares that mapping; it is the same kind of guess this PR removes, and the import it "resolved" is broken in the real project too. - `imports` pattern keys (`"#internal/*"`) were looked up exactly, so a valid `#internal/foo` never matched. `exports` and `imports` now share one matcher, which is where they should never have diverged. - a relative specifier climbing past the repo root was silently clamped, so `../../../secret` from `src/main.ts` became `secret` and could resolve a root file it never named. ## Test rigor The conformance suite asserted less than it claimed. The decoy-reachability arm only checked non-empty, so five cases paired `reachesDecoy` with a different file than `decoy` and passed while establishing nothing; the KNOWN_GAPS arm likewise accepted any in-repo answer instead of the recorded one. Both now assert the exact file. The reachability arm runs only for languages that HOLD the property — for a gap language the recorded-answer assertion IS that proof, and for Swift and COBOL no other spelling exists, since `Foundation` and `EXTERNAL` name the in-repo directory and copybook as well as the external module, which is precisely why those resolvers cannot tell them apart. ## Benchmarks Both `--check` guards were red, and both were reporting something true. `import-target`: the ts-family arms resolved 0 of 3200 imports. Their corpus is bare specifiers with no config, which the deleted `suffixResolve` answered without one — so the arms measured an empty branch while printing a clean scaling ratio. Each now carries the config its corpus is spelled for, and the `deep` arm's uniform prefix reaches it. THE FINGERPRINTS THEN MATCHED THE RECORDED BASELINES EXACTLY: same corpus, same targets, once the config it always implied is passed explicitly. Retained per-pass index went from 26 745 296 B (js, ts) and 28 884 016 B (vue) at 32 000 files to 0-16 B, because these resolvers no longer build one; they move to the `HEAP_BOUNDED` tier rust already occupies for the same reason. Depth ratio moved 2.0 -> ~2.2 and the budget goes to 2.6: candidates now carry the 16-segment baseUrl prefix, so each `Set.has` hashes a longer string — linear in path LENGTH, independent of file COUNT. `scope-capture`: TypeScript capture fingerprint drift, caused by this PR's 12 new `.ts` fixtures entering the corpus. Attribution is exact rather than inferred — moving that one fixture directory aside returns the fingerprint to `f719163e…` byte-for-byte with `fixture_count` back at 155 and all 15 languages passing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Px638Zyqa9CJMUU7DsJoB * fix(typescript): honour exports fallback arrays, paths precedence and package extends (#2953) Second review round. Four findings, judged against what this tool is: a static analyser building a code graph, not a compiler. The bar is resolving what the project DECLARES, on a checkout that may never have been built or installed, and never inventing an edge. - `exports` and `imports` ARRAYS were skipped. An array is Node's ordered fallback list, and `{"./feature": ["./dist/feature.js", "./src/feature.ts"]}` is exactly what a workspace package publishes to mean "built output, or source". Skipping it dropped the declaration entirely and left the package looking as though it exported no subpaths. The source arm is the one that matters here, because `dist/` is build output and is not indexed — and for a static analyser the build need not have run at all. - an exact `paths` pattern did not reliably outrank a wildcard. `a` and `a*` both match `a` with the same literal prefix length, so sorting on length alone left tsc's exact-wins rule to declaration order. - package-form `extends` (`"@acme/tsconfig"`) was refused outright. Not indexing `node_modules` is different from not READING it, and a shared internal base is where a monorepo puts the `paths` its packages import through. It is now read from disk, walking `node_modules` up from the extending config the way Node does, and absent on an un-installed checkout it degrades to whatever that config declared itself. The test pins what tsc actually does with such a base rather than what one might hope: `extends` never rebases `baseUrl`, so a package base's paths point at the package's own directory. That is why a published base rarely contributes aliases a repo's files resolve through, and why the `@tsconfig/*` family — which sets `target` and `lib`, never `paths` — is a no-op here either way. - CodeQL flagged `String.replace('*', …)` in two places as replacing only the first occurrence. Node subpath patterns and tsconfig `paths` both allow AT MOST one `*`, so that IS the specified behaviour — but the spelling states it by accident and reads as the replace-all footgun. `substituteStar` slices at the known index and says the rule. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Px638Zyqa9CJMUU7DsJoB * fix(typescript): treat `exports` as the whole interface, and keep empty tsconfig scopes (#2953) Third review round. Two findings, both valid, both cases of this resolver being laxer than the thing it models — which is the direction that fabricates edges. - `exports`, when a manifest declares it, is the package's ENTIRE public interface: Node ignores `main` outright and refuses any subpath the map does not list. This resolver already honoured that restriction for SUBPATHS and not for the package ROOT, which is the same rule. A manifest exporting only `"./feature"` therefore still answered a bare `@repo/pkg` with `main` or `src/index` — an edge for an import that does not resolve in the real project. Legacy and conventional root candidates are now offered only when there is no `exports` field at all. - a tsconfig declaring neither `baseUrl` nor `paths` was dropped rather than kept as an empty scope, so `tsconfigFor` fell through to an enclosing config. A package whose own tsconfig declares no `baseUrl` — meaning its non-relative specifiers are package lookups — silently inherited the repo root's aliases instead. An empty scope is the accurate answer for such a file, and only a scope can express it. Both are pinned at the level they broke: the manifest arms assert what `readManifest` produces, not a hand-built package, since the resolver honouring empty entries and the loader producing them are different claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Px638Zyqa9CJMUU7DsJoB --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| cfg | ||
| cli | ||
| group | ||
| mcp | ||
| optional-grammars | ||
| resolvers | ||
| analyze-atomic-swap.test.ts | ||
| analyze-embedding-flags-e2e.test.ts | ||
| analyze-heap-oom-e2e.test.ts | ||
| analyze-index-lock-concurrency.test.ts | ||
| analyze-wal-checkpoint-failure.test.ts | ||
| analyzer-identity-cli.test.ts | ||
| antigravity-hook-e2e.test.ts | ||
| api-impact-e2e.test.ts | ||
| api-impact-method-e2e.test.ts | ||
| api-query.test.ts | ||
| ast-helpers-object-literal-binding.test.ts | ||
| augmentation.test.ts | ||
| basicblock-roundtrip.test.ts | ||
| block-scope-shadowing.test.ts | ||
| c-cpp-typedef-legacy-parse.test.ts | ||
| callable-capture-options-literal-gate.test.ts | ||
| caller-identity-regression.test.ts | ||
| cjs-exports-assignment.test.ts | ||
| class-impact-all-languages.test.ts | ||
| cli-e2e.test.ts | ||
| cli-limit-e2e.test.ts | ||
| closure-binding-labels.test.ts | ||
| closure-review-findings.test.ts | ||
| cobol-import-index-reuse.test.ts | ||
| cobol-pipeline-benchmark.test.ts | ||
| const-function-twin.test.ts | ||
| context-cross-language-anchor.test.ts | ||
| context-resource-staleness.test.ts | ||
| context-typed-property.test.ts | ||
| copy-parallel-invariant.test.ts | ||
| cpp-adl-benchmark.test.ts | ||
| cpp-captures-typeclass-benchmark.test.ts | ||
| cpp-pipeline-benchmark.test.ts | ||
| cross-file-binding.test.ts | ||
| csharp-import-index-reuse.test.ts | ||
| csharp-pipeline-benchmark.test.ts | ||
| csharp-scope-capture-tripwire.test.ts | ||
| csv-pipeline.test.ts | ||
| dart-import-index-reuse.test.ts | ||
| detect-changes-path-anchoring.test.ts | ||
| dispatch-guard-route-pipeline.test.ts | ||
| django-route-extraction-e2e.test.ts | ||
| doc-comment-description-e2e.test.ts | ||
| enrichment.test.ts | ||
| expo-routes.test.ts | ||
| extension-binary-real.test.ts | ||
| fastapi-composed-route-constants.test.ts | ||
| fastapi-prefix-pipeline.test.ts | ||
| filesystem-walker.test.ts | ||
| fts-cjk-segmentation-search.test.ts | ||
| fts-description-search.test.ts | ||
| fts-extension-e2e.test.ts | ||
| fts-fullfile-search.test.ts | ||
| fts-repair-warm-session.test.ts | ||
| fts-stemmer-sweep.test.ts | ||
| function-local-identity.test.ts | ||
| go-import-index-reuse.test.ts | ||
| go-multi-name-worker-metadata.test.ts | ||
| go-pipeline-benchmark.test.ts | ||
| grammar-introspection.test.ts | ||
| grammar-literal-validation.test.ts | ||
| graph-emit-streaming-roundtrip.test.ts | ||
| has-method.test.ts | ||
| hooks-e2e.test.ts | ||
| http-inline-handler-symbol-roundtrip.test.ts | ||
| ignore-and-skip-e2e.test.ts | ||
| impact-ambiguous-blast-radius.test.ts | ||
| impact-epistemic-lower-bound.test.ts | ||
| impact-pdg-callsummary-degradation.test.ts | ||
| impact-pdg-degradation.test.ts | ||
| impact-pdg-e2e.test.ts | ||
| impact-pdg-fixtures.test.ts | ||
| impact-pdg-fullchain-e2e.test.ts | ||
| impact-pdg-id-degradation.test.ts | ||
| impact-pdg-interproc.test.ts | ||
| impact-pdg-shape.test.ts | ||
| impact-pdg-statement-precise.test.ts | ||
| impact-pdg-traversal.test.ts | ||
| impact-undecided-satisfaction.test.ts | ||
| impact-zero-caller-risk.test.ts | ||
| instance-ownership-pipeline-benchmark.test.ts | ||
| java-class-impact.test.ts | ||
| java-import-index-reuse.test.ts | ||
| js-array-method-callback-attribution.test.ts | ||
| kotlin-import-index-reuse.test.ts | ||
| lbug-close-handle-release.test.ts | ||
| lbug-conn-serialization.test.ts | ||
| lbug-core-adapter.test.ts | ||
| lbug-delete-nodes-for-files.test.ts | ||
| lbug-load-overlap-errors.test.ts | ||
| lbug-load-overlap.test.ts | ||
| lbug-load-prof.test.ts | ||
| lbug-lock-retry.test.ts | ||
| lbug-multiwriter-deadlock.test.ts | ||
| lbug-non-ascii-path.test.ts | ||
| lbug-open-retry.test.ts | ||
| lbug-orphan-sidecar-recovery.test.ts | ||
| lbug-pool-stability.test.ts | ||
| lbug-pool.test.ts | ||
| lbug-query-importers-batch.test.ts | ||
| lbug-readonly-init.test.ts | ||
| lbug-vector-extension.test.ts | ||
| literal-collectors.test.ts | ||
| local-backend-calltool.test.ts | ||
| local-backend.test.ts | ||
| local-symbol-pruner-pipeline.test.ts | ||
| markdown-processor-crlf.test.ts | ||
| mcp-line-display.test.ts | ||
| multi-branch-analyze.test.ts | ||
| multi-verb-route-identity.test.ts | ||
| object-literal-method-exports.test.ts | ||
| object-literal-owner-resolution.test.ts | ||
| orm-dataflow.test.ts | ||
| parse-impl-chunk-concurrency.test.ts | ||
| parse-impl-clone-skip.test.ts | ||
| parse-impl-env-reads.test.ts | ||
| parse-impl-large-fixture.test.ts | ||
| parse-impl-progress-monotonic.test.ts | ||
| parse-impl-quarantine-cache-skip.test.ts | ||
| parsing.test.ts | ||
| pdg-emit-streaming-roundtrip.test.ts | ||
| pdg-query.test.ts | ||
| php-import-index-reuse.test.ts | ||
| php-pipeline-benchmark.test.ts | ||
| php-scope-capture-tripwire.test.ts | ||
| pipeline-graph-golden.test.ts | ||
| pipeline.test.ts | ||
| python-import-index-reuse.test.ts | ||
| python-scope-capture-tripwire.test.ts | ||
| qualified-class-lookups.test.ts | ||
| query-compilation.test.ts | ||
| route-handler-symbol-roundtrip.test.ts | ||
| route-method-roundtrip.test.ts | ||
| route-parse-skip.test.ts | ||
| ruby-import-index-reuse.test.ts | ||
| ruby-pipeline-benchmark.test.ts | ||
| ruby-scope-capture-tripwire.test.ts | ||
| run-analyze-adopt-failure.test.ts | ||
| rust-pipeline-benchmark.test.ts | ||
| rust-scope-capture-tripwire.test.ts | ||
| search-core.test.ts | ||
| search-pool.test.ts | ||
| server-analyze-token-validation.test.ts | ||
| server-analyze.test.ts | ||
| server-http-startup.test.ts | ||
| setup-antigravity.test.ts | ||
| setup-skills.test.ts | ||
| setup-uninstall-roundtrip.test.ts | ||
| shape-check-regression.test.ts | ||
| skills-e2e.test.ts | ||
| spring-aop-benchmark.test.ts | ||
| spring-aop-mcp.test.ts | ||
| spring-aop-pipeline.test.ts | ||
| spring-bean-mcp.test.ts | ||
| spring-bean-metadata-roundtrip.test.ts | ||
| spring-bean-pipeline.test.ts | ||
| spring-bean-resource-benchmark.test.ts | ||
| spring-bean-resource-pipeline.test.ts | ||
| spring-conditionals-pipeline.test.ts | ||
| spring-config-mcp.test.ts | ||
| spring-config-pipeline.test.ts | ||
| spring-di-benchmark.test.ts | ||
| spring-di-pipeline.test.ts | ||
| spring-inheritance-benchmark.test.ts | ||
| spring-interface-inheritance-pipeline.test.ts | ||
| spring-route-pipeline.test.ts | ||
| staleness-and-stability.test.ts | ||
| structural-pair-coverage.test.ts | ||
| swift-conditional-directive.test.ts | ||
| swift-scope-capture-tripwire.test.ts | ||
| taint-explain.test.ts | ||
| this-boundary.test.ts | ||
| tree-sitter-languages.test.ts | ||
| typescript-async-generator-functions.test.ts | ||
| vue-pipeline-benchmark.test.ts | ||
| wiki-graph-queries-engine.test.ts | ||
| worker-pool.test.ts | ||