GitNexus/gitnexus/test
Void Freud 0f78179e7f
fix(jvm): enforce proximity-bounded sibling injection (#2732)
* fix(jvm): bound same-package sibling injection

* docs(jvm): document sibling injection cap

* fix(jvm): mark truncated sibling sets incomplete and bound the merge

Review follow-ups on the sibling injection cap (#2732):

- The cap silently produced a third visibility state. Before it, a file was
  either fully visible (package under 500 files) or fully incomplete; once
  `injectedIds.size` hit the cap, real siblings were dropped while
  `isVisibilityIncomplete` still returned `false`. That flag gates wildcard
  attribution in seven Spring passes (`bean-candidates.ts:199` and the java/
  kotlin bean-metadata, conditionals, config-bindings and DI resolvers), so
  201-500-file packages — exactly this cap's population — resolved wildcard
  annotations against a truncated sibling set with no log signal. Truncation
  now marks the file incomplete and analyze warns once with the affected file
  count.

- The cap only bounded `bindingAugmentations`; the two `typeBindings` merges
  below it still absorbed every sibling, so a class excluded from the binding
  set could still steer receiver/variable type inference through
  `scope.typeBindings`. Both halves now use the same bounded sibling set, and
  the merge iterates that set directly rather than filtering a full rescan, so
  the cap bounds the work as well as the result.

- Path segments are split once per bucket instead of on every pairwise
  proximity comparison — that comparison runs O(files²) per package.

- `JvmPackageFact` was re-declared locally instead of imported from
  `package-facts.js`, where the canonical declaration still serves both
  languages' facades and capture side-channels. Nothing kept the copies in
  sync. Restored the import.

- README/.env.example: `GITNEXUS_MAX_INJECTED_SIBLINGS` does not lift the
  fixed 500-file package skip (including at `0`), and truncation disables
  wildcard attribution for the affected files. Both are now stated.

* test(jvm): restore the language-facade coverage and pin the cap's behaviour

The cap rewrite replaced the per-language harness with generic fixtures,
dropping the Java/Kotlin capture-side-channel and facade coverage (package fact
extraction, the 500-file skip, fail-closed on a file that produced no
ParsedFile) and leaving a proximity fixture whose candidates were already in
order — so it could not tell a working sort from plain truncation of the input.

Restores that harness and adds cap-specific cases on top, driven through the
shared JVM factory. The fixture interleaves near and distant siblings, so the
retained set is only reachable by a working proximity sort. Covers: the exact
capped set, truncation marking the file visibility-incomplete, type bindings
bounded by the same sibling set, the unbounded `0` override staying complete,
and the documented default of 200 applying when the variable is unset.

Each new case fails against the pre-fix implementation.

---------

Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
2026-08-01 09:38:10 +01:00
..
fixtures fix(python): resolve classes through module imports (#2770) 2026-08-01 06:02:47 +01:00
helpers fix(test): harden findInstalledFtsExtension for cross-OS filesystem quirks 2026-07-21 06:14:58 +00:00
integration fix(mcp): resolve false FTS-missing warnings in the query tool (#2773) 2026-08-01 08:42:51 +01:00
unit fix(jvm): enforce proximity-bounded sibling injection (#2732) 2026-08-01 09:38:10 +01:00
utils fix(hook): emit MCP query hint when server owns DB lock (#2396) (#2397) 2026-07-08 18:34:05 +01:00