@guanlin4924/devflow-pi 0.1.79 → 0.1.81

package/plugins/devflow-intel/skills/workflow-code-index/scripts/code_index.py

@@ -27,7 +27,10 @@ from adapters.registry import AdapterRegistry
 from semantic import SEMANTIC_EXTRACTOR_VERSION, build_semantic_facts
 from core.discovery import discover_codebases
 from core.hashing import file_sha256
-from core.scanner import scan_files
+from core.scanner import scan_files, DEFAULT_EXCLUDES
+from hybrid_query import execute as execute_plan, read_connection, validate_plan
+from domain_registry import import_bundle
+from source_content import content_integrity
 from validators.project_binding_check import audit_project_binding
 from validators.relation_check import audit_relations
 from validators.schema_validate import validate_index
@@ -68,13 +71,16 @@ def _publish_snapshot(staging: Path, output: Path, counts: Dict[str, int], works
         # Keep the public snapshot schema stable while exposing the richer
         # SQLite schema separately.  Older consumers only know schemaVersion=1.
         "schemaVersion": 1,
-        "indexSchemaVersion": 3,
+        "indexSchemaVersion": 4 if workspace_state.get("contentSearch") else 3,
         "capabilities": {
             "structural": True,
             "semantic": True,
             "fts": True,
             "relations": True,
             "provenance": True,
+            "contentSearch": workspace_state.get("contentSearch", False),
+            "domainMapping": {"version": 1, "storage": "external_registry"},
+            "queryPlan": {"version": 1},
         },
         "generation": generation,
         "generatedAt": datetime.now(timezone.utc).isoformat(),
@@ -195,17 +201,26 @@ def main(argv=None) -> int:
     scan.add_argument("--output", default=".planning/code-index", help="Index output directory.")
     scan.add_argument("--codebase", action="append", default=[], help="Explicit codebase: name:path[:type]. Can repeat.")
     scan.add_argument("--changed-files", nargs="*", default=[], help="Optional changed files for incremental refresh.")
+    scan.add_argument("--include", action="append", default=[], help="Repository-relative include glob. Can repeat.")
+    scan.add_argument("--max-file-size", type=int, default=1500000)
     scan.add_argument("--exclude", action="append", default=[], help="Additional directory names to exclude.")
 
-    validate = sub.add_parser("validate", help="Validate JSONL schema.")
+    validate = sub.add_parser("validate", help="Validate an index in staged levels.")
     validate.add_argument("--index", default=".planning/code-index", help="Index directory.")
     validate.add_argument("--snapshot", help="Immutable generation id.")
+    validate.add_argument(
+        "--level",
+        choices=("fast", "publish", "full"),
+        default="publish",
+        help="fast bundle checks, publish gate checks, or full JSONL/semantic audit",
+    )
 
     audit = sub.add_parser("audit", help="Audit stale files and relation integrity.")
     audit.add_argument("--root", default=".", help="Project root.")
     audit.add_argument("--index", default=".planning/code-index", help="Index directory.")
     audit.add_argument("--skill-root", default=".skills", help="Optional skill root for project-binding checks.")
     audit.add_argument("--snapshot", help="Immutable generation id.")
+    audit.add_argument("--level", choices=("publish", "full"), default="publish")
 
     query = sub.add_parser("query", help="Search symbols using SQLite FTS or LIKE fallback.")
     query.add_argument("--index", default=".planning/code-index", help="Index directory.")
@@ -220,6 +235,7 @@ def main(argv=None) -> int:
     relations.add_argument("--limit", type=int, default=100)
     relations.add_argument("--snapshot")
     relations.add_argument("--include-heuristic", action="store_true")
+    relations.add_argument("--direction", choices=["incoming", "outgoing", "both"], default="outgoing")
 
     impact = sub.add_parser("impact", help="Traverse cross-layer semantic facts in a fixed snapshot.")
     impact.add_argument("--index", default=".planning/code-index")
@@ -229,7 +245,28 @@ def main(argv=None) -> int:
     impact.add_argument("--snapshot")
     impact.add_argument("--change-type", choices=["remove_field", "rename_field", "change_type", "optional_to_required", "required_to_optional", "change_nullability", "change_enum"], help="Optional proposed change classification.")
 
+    for action in ("search-content", "resolve-domain", "query-plan", "domain-import"):
+        operation = sub.add_parser(action)
+        operation.add_argument("--index", default=".planning/code-index")
+        operation.add_argument("--snapshot")
+        operation.add_argument("--project-id", default="")
+        operation.add_argument("--limit", type=int, default=20)
+        operation.add_argument("--repository", action="append", default=[])
+        operation.add_argument("--path-prefix", default="")
+        operation.add_argument("--mapping-revision", default="approved-current")
+        if action == "search-content":
+            operation.add_argument("--language")
+            operation.add_argument("--match-kind", choices=["literal", "substring", "identifier", "exact_phrase"], default="literal")
+        if action == "query-plan":
+            operation.add_argument("--plan", required=True, help="Structured QueryPlan JSON, never SQL")
+        elif action == "domain-import":
+            operation.add_argument("--bundle", required=True, help="JSON mapping bundle file")
+            operation.add_argument("--expected-revision", help="Expected approved current revision for CAS")
+        elif action in {"search-content", "resolve-domain"}:
+            operation.add_argument("--term", required=True)
     args = parser.parse_args(argv)
+    if args.command in {"search-content", "resolve-domain", "query-plan", "domain-import"}:
+        return command_structured(args)
     if args.command == "scan":
         return command_scan(args)
     if args.command == "validate":
@@ -248,6 +285,10 @@ def main(argv=None) -> int:
 def command_scan(args) -> int:
     root = Path(args.root).resolve()
     output = (root / args.output).resolve() if not Path(args.output).is_absolute() else Path(args.output).resolve()
+    includes = getattr(args, "include", [])
+    max_file_size = getattr(args, "max_file_size", 1500000)
+    if not 1 <= max_file_size <= 50000000:
+        raise ValueError("max-file-size must be 1..50000000")
     progress = _Progress(output)
     progress.emit("start", "scan started", root=str(root), output=str(output), codebases=args.codebase)
     with _index_lock(output, exclusive=True):
@@ -256,6 +297,10 @@ def command_scan(args) -> int:
         registry = AdapterRegistry()
         changed = _normalize_changed_files(root, args.changed_files)
         existing = _load_existing(output)
+        previous_scope = _load_snapshot(output).get("workspace", {}).get("scanScope", {})
+        previous_roots = {(item.get("name"), item.get("path")) for item in previous_scope.get("codebases", [])}
+        if changed and (set(previous_scope.get("exclude", [])) != DEFAULT_EXCLUDES | set(args.exclude) or previous_roots != {(item.name, str(item.root)) for item in codebases} or previous_scope.get("includes", []) != sorted(set(includes)) or previous_scope.get("maxFileSize", 1500000) != max_file_size):
+            changed = set()  # Scope changes require a complete rebuild, never reuse out-of-scope rows.
         secondary_changed = _incoming_evidence_files(existing, changed)
         changed |= secondary_changed
 
@@ -270,7 +315,7 @@ def command_scan(args) -> int:
                 diagnostics.append(_diagnostic(codebase.name, "", 1, "warning", "skipped_file", f"codebase root does not exist: {codebase.root}", "discovery@1"))
                 continue
             progress.emit("discover", f"discovering {codebase.name}", codebase=codebase.name, path=str(codebase.root))
-            all_files = scan_files(codebase.root, excludes=args.exclude)
+            all_files = scan_files(codebase.root, excludes=args.exclude, includes=includes, max_bytes=max_file_size)
             progress.emit("discover", f"discovered {len(all_files)} files in {codebase.name}", codebase=codebase.name, files=len(all_files))
             discovered_paths.update(_workspace_rel(root, path) for path in all_files)
             if changed:
@@ -348,11 +393,17 @@ def command_scan(args) -> int:
             )
             workspace_state["generatedAt"] = datetime.now(timezone.utc).isoformat()
             workspace_state["scanScope"] = {
-                "exclude": sorted(set(args.exclude)),
+                "exclude": sorted(DEFAULT_EXCLUDES | set(args.exclude)),
+                "includes": sorted(set(includes)),
+                "generatedPolicy": "exclude_known_build_directories",
+                "dependencyPolicy": "exclude_known_dependency_directories",
+                "maxFileSize": max_file_size,
                 "codebases": [
-                    {"name": item.name, "path": str(item.root)} for item in codebases
+                    {"name": item.name, "path": str(item.root), "workspacePath": _workspace_rel(root, item.root)} for item in codebases
                 ],
             }
+            workspace_state["scopeHash"] = _hash_lines([json.dumps(workspace_state["scanScope"], sort_keys=True)])
+            workspace_state["root"] = str(root)
             workspace_state["semanticExtractor"] = SEMANTIC_EXTRACTOR_VERSION
             workspace_state["extractorSetHash"] = _hash_lines([*workspace_state.get("extractors", []), SEMANTIC_EXTRACTOR_VERSION])
             progress.emit("semantic", "building semantic facts")
@@ -374,6 +425,7 @@ def command_scan(args) -> int:
                 semantic_entities=semantic_entities,
                 semantic_flows=semantic_flows,
                 feature_bindings=feature_bindings,
+                source_root=root,
             )
             progress.emit("documents", "writing index projections")
             write_markdown(staging, files, symbols, relations, diagnostics)
@@ -405,58 +457,198 @@ def command_scan(args) -> int:
         return 0
 
 
-def command_validate(args) -> int:
-    output = Path(args.index).resolve()
-    selected = _selected_generation(output, getattr(args, "snapshot", None))
-    errors = []
+def _validate_publish_gate(selected: Path, snapshot: Dict[str, object]) -> List[str]:
+    """Run bounded checks required before publishing a generation.
+
+    This deliberately uses SQLite for referential checks.  The previous
+    implementation loaded every JSONL sidecar before it could decide whether
+    a snapshot was publishable, which made large projects spend minutes at
+    100% CPU in a validation process.
+    """
+    errors = _validate_snapshot_bundle(selected, snapshot)
+    if errors:
+        return errors
+    index = selected / "index.sqlite"
     try:
-        snapshot = _load_snapshot(selected)
-        errors.extend(_validate_snapshot_bundle(selected, snapshot))
-        files, symbols, relations, diagnostics = _load_tuple(selected)
-        errors.extend(validate_index(files, symbols, relations, diagnostics))
-        conn = sqlite3.connect(str(selected / "index.sqlite"))
+        conn = sqlite3.connect(str(index))
         try:
+            quick = conn.execute("PRAGMA quick_check").fetchone()
+            if not quick or quick[0] != "ok":
+                errors.append(f"sqlite quick_check failed: {quick[0] if quick else 'no result'}")
+            if snapshot.get("capabilities", {}).get("contentSearch"):
+                content_tables = _table_names(conn)
+                for table in ("source_artifacts", "source_content_chunks", "snapshot_metadata"):
+                    if table not in content_tables:
+                        errors.append(f"content capability missing table {table}")
+                content_capability = snapshot["capabilities"]["contentSearch"]
+                if isinstance(content_capability, dict) and content_capability.get("tokenizer") == "trigram" and "source_content_fts" not in content_tables:
+                    errors.append("trigram content capability missing FTS table")
+                if {"source_content_chunks", "snapshot_metadata"}.issubset(content_tables):
+                    declared = conn.execute("SELECT value FROM snapshot_metadata WHERE key='contentSearch'").fetchone()
+                    integrity = conn.execute("SELECT value FROM snapshot_metadata WHERE key='contentIntegrity'").fetchone()
+                    if declared is None or json.loads(declared[0]) != content_capability:
+                        errors.append("content capability metadata mismatch")
+                    actual = content_integrity(conn)
+                    if integrity is None or json.loads(integrity[0]) != actual or actual.get("missing_fts_rowids", 0):
+                        errors.append("content/FTS rowid, count or integrity mismatch")
+                if {"source_content_chunks", "code_files", "source_artifacts"}.issubset(content_tables):
+                    invalid = conn.execute("SELECT count(*) FROM source_content_chunks c LEFT JOIN code_files f ON f.id=c.code_file_id LEFT JOIN source_artifacts a ON a.content_hash=c.content_hash WHERE f.id IS NULL OR a.content_hash IS NULL OR c.content_hash<>f.content_hash OR c.code_generation<>?", (snapshot.get("generation"),)).fetchone()[0]
+                    if invalid:
+                        errors.append(f"content index has {invalid} invalid chunk references")
             snapshot_id = snapshot.get("generation")
             tables = _table_names(conn)
-            if "analysis_snapshots" in tables:
-                row = conn.execute("SELECT snapshot_id FROM analysis_snapshots WHERE snapshot_id=?", (snapshot_id,)).fetchone()
-                if not row:
-                    errors.append(f"snapshot metadata missing generation {snapshot_id}")
-            semantic_tables = {"semantic_flows", "entity_versions", "feature_bindings", "coverage_metrics"}
-            if not semantic_tables.issubset(tables):
-                # Structural-only historical snapshots remain valid.
-                snapshot.setdefault("capabilities", {})["semantic"] = False
-            else:
+            required = {"analysis_snapshots", "code_files", "symbols", "relations", "diagnostics"}
+            missing = sorted(required - tables)
+            if missing:
+                errors.append(f"index missing required tables: {', '.join(missing)}")
+            elif not conn.execute("SELECT 1 FROM analysis_snapshots WHERE snapshot_id=? LIMIT 1", (snapshot_id,)).fetchone():
+                errors.append(f"snapshot metadata missing generation {snapshot_id}")
+
+            if {"relations", "symbols"}.issubset(tables):
+                dangling = conn.execute("""
+                    SELECT COUNT(*) FROM relations r
+                    LEFT JOIN symbols s ON s.id=r.from_id
+                    WHERE s.id IS NULL
+                """).fetchone()[0]
+                if dangling:
+                    errors.append(f"relations have {dangling} missing source symbols")
                 dangling = conn.execute("""
-              SELECT COUNT(*) FROM semantic_flows f
-              WHERE f.snapshot_id=? AND (
-                (NOT EXISTS (SELECT 1 FROM entity_versions e WHERE e.snapshot_id=f.snapshot_id AND e.logical_id=f.source_id)
-                 AND NOT EXISTS (SELECT 1 FROM symbols s WHERE s.id=f.source_id))
-                OR
-                (NOT EXISTS (SELECT 1 FROM entity_versions e WHERE e.snapshot_id=f.snapshot_id AND e.logical_id=f.target_id)
-                 AND NOT EXISTS (SELECT 1 FROM symbols s WHERE s.id=f.target_id))
-              )
-                """, (snapshot_id,)).fetchone()[0]
+                    SELECT COUNT(*) FROM relations r
+                    LEFT JOIN symbols s ON s.id=r.to_id
+                    WHERE r.to_id IS NOT NULL AND s.id IS NULL AND (r.to_external IS NULL OR r.to_external='')
+                """).fetchone()[0]
                 if dangling:
-                    errors.append(f"semantic flows have {dangling} dangling source or target nodes")
-                binding_dangling = conn.execute("""
-              SELECT COUNT(*) FROM feature_bindings b
-              WHERE b.snapshot_id=? AND (
-                NOT EXISTS (SELECT 1 FROM entity_versions e WHERE e.snapshot_id=b.snapshot_id AND e.logical_id=b.feature_id)
-                OR NOT EXISTS (SELECT 1 FROM entity_versions e WHERE e.snapshot_id=b.snapshot_id AND e.logical_id=b.entity_id)
-              )
-                """, (snapshot_id,)).fetchone()[0]
-                if binding_dangling:
-                    errors.append(f"feature bindings have {binding_dangling} dangling feature or entity nodes")
+                    errors.append(f"relations have {dangling} missing target symbols")
         finally:
             conn.close()
+    except (OSError, sqlite3.Error) as exc:
+        errors.append(str(exc))
+    return errors
+
+
+def _validate_semantic_graph(conn: sqlite3.Connection, snapshot_id: str, tables: set[str]) -> List[str]:
+    errors: List[str] = []
+    semantic_tables = {"semantic_flows", "entity_versions", "feature_bindings", "coverage_metrics"}
+    if not semantic_tables.issubset(tables):
+        missing = ", ".join(sorted(semantic_tables - tables))
+        errors.append(f"full validation unavailable: missing semantic tables: {missing}")
+        return errors
+    dangling = conn.execute("""
+      SELECT COUNT(*) FROM semantic_flows f
+      WHERE f.snapshot_id=? AND (
+        (NOT EXISTS (SELECT 1 FROM entity_versions e WHERE e.snapshot_id=f.snapshot_id AND e.logical_id=f.source_id)
+         AND NOT EXISTS (SELECT 1 FROM symbols s WHERE s.id=f.source_id))
+        OR
+        (NOT EXISTS (SELECT 1 FROM entity_versions e WHERE e.snapshot_id=f.snapshot_id AND e.logical_id=f.target_id)
+         AND NOT EXISTS (SELECT 1 FROM symbols s WHERE s.id=f.target_id))
+      )
+    """, (snapshot_id,)).fetchone()[0]
+    if dangling:
+        errors.append(f"semantic flows have {dangling} dangling source or target nodes")
+    binding_dangling = conn.execute("""
+      SELECT COUNT(*) FROM feature_bindings b
+      WHERE b.snapshot_id=? AND (
+        NOT EXISTS (SELECT 1 FROM entity_versions e WHERE e.snapshot_id=b.snapshot_id AND e.logical_id=b.feature_id)
+        OR NOT EXISTS (SELECT 1 FROM entity_versions e WHERE e.snapshot_id=b.snapshot_id AND e.logical_id=b.entity_id)
+      )
+    """, (snapshot_id,)).fetchone()[0]
+    if binding_dangling:
+        errors.append(f"feature bindings have {binding_dangling} dangling feature or entity nodes")
+    return errors
+
+
+def command_validate(args) -> int:
+    output = Path(args.index).resolve()
+    selected = _selected_generation(output, getattr(args, "snapshot", None))
+    level = getattr(args, "level", "publish")
+    errors: List[str] = []
+    try:
+        snapshot = _load_snapshot(selected)
+        print(f"[code-index][validate] level={level} snapshot={snapshot.get('generation', 'unknown')}", file=sys.stderr, flush=True)
+        if level == "fast":
+            errors.extend(_validate_snapshot_bundle(selected, snapshot))
+        else:
+            errors.extend(_validate_publish_gate(selected, snapshot))
+        if level == "full" and not errors:
+            print("[code-index][validate] full JSONL schema validation", file=sys.stderr, flush=True)
+            files, symbols, relations, diagnostics = _load_tuple(selected)
+            errors.extend(validate_index(files, symbols, relations, diagnostics))
+            if not errors:
+                conn = sqlite3.connect(str(selected / "index.sqlite"))
+                try:
+                    errors.extend(_validate_semantic_graph(conn, str(snapshot.get("generation")), _table_names(conn)))
+                finally:
+                    conn.close()
     except (OSError, sqlite3.Error, ValueError) as exc:
         errors.append(str(exc))
     for error in errors:
         print(error, file=sys.stderr)
+    if not errors:
+        print(f"Index validation passed ({level}).")
     return 1 if errors else 0
+def command_structured(args) -> int:
+    output = Path(args.index).resolve()
+    try:
+        if args.command == "query-plan":
+            if len(args.plan) > 32000:
+                raise ValueError("QueryPlan exceeds 32KB")
+            raw_plan = json.loads(args.plan)
+            if "limit" not in raw_plan:
+                raw_plan["limit"] = getattr(args, "limit", 20)
+            plan = validate_plan(raw_plan)
+        else:
+            plan = {"featureTerms": [args.term] if hasattr(args, "term") else [],
+                    "phases": ["search_content", "verify_evidence"] if args.command == "search-content" else ["resolve_domain"],
+                    "limit": args.limit, "repositoryFilter": getattr(args, "repository", []),
+                    "pathPrefix": getattr(args, "path_prefix", ""), "mappingRevision": getattr(args, "mapping_revision", "approved-current"),
+                    "language": getattr(args, "language", None), "matchKind": getattr(args, "match_kind", "literal")}
+            plan = validate_plan(plan)
+        requested = getattr(args, "snapshot", None)
+        planned = plan.get("codeGeneration")
+        if planned and planned != "current":
+            if requested and requested != planned:
+                raise ValueError("conflicting snapshot and codeGeneration")
+            requested = planned
+        with _index_lock(output, exclusive=False):
+            selected = _selected_generation(output, requested)
+            snapshot = _load_snapshot(selected)
+            errors = _validate_snapshot_bundle(selected, snapshot)
+            if errors:
+                raise ValueError(errors[0])
+            if not requested and not _query_is_fresh(Path(snapshot.get("workspace", {}).get("root", output.parent.parent)), snapshot, read_jsonl(selected / INDEX_FILES["files"])):
+                print(json.dumps({"_meta": {"status": "stale_index", "snapshot": snapshot.get("generation")}}))
+                return 1
+            conn = read_connection(selected / "index.sqlite")
+            try:
+                if snapshot.get("workspace", {}).get("scopeHash"):
+                    scope_json = json.dumps(snapshot["workspace"]["scanScope"], sort_keys=True)
+                    if _hash_lines([scope_json]) != snapshot["workspace"]["scopeHash"]:
+                        raise ValueError("scan scope hash mismatch")
+                    stored = conn.execute("SELECT value FROM snapshot_metadata WHERE key='scanScope'").fetchone()
+                    if stored is None or json.loads(stored[0]) != snapshot["workspace"]["scanScope"]:
+                        raise ValueError("scan scope metadata mismatch")
+                registry = output.parent / "domain-registry.sqlite"
+                if args.command == "domain-import":
+                    bundle_path = Path(args.bundle)
+                    if bundle_path.stat().st_size > 2_000_000:
+                        raise ValueError("mapping bundle exceeds 2MB")
+                    result = import_bundle(registry, args.project_id, json.loads(bundle_path.read_text()), getattr(args, "expected_revision", None), conn, snapshot["generation"])
+                else:
+                    result = execute_plan(conn, snapshot, plan, registry, getattr(args, "project_id", ""))
+                print(json.dumps(result, ensure_ascii=False, sort_keys=True))
+            finally:
+                conn.close()
+        return 0
+    except (ValueError, TypeError, KeyError, OSError, sqlite3.Error) as exc:
+        status = "partial" if isinstance(exc, sqlite3.OperationalError) and "interrupt" in str(exc) else "invalid_query"
+        print(json.dumps({"_meta": {"status": status, "reason": str(exc)}}))
+        return 1
+
+
 def command_query(args) -> int:
     output = Path(args.index).resolve()
+    if hasattr(args, "term") and (not args.term or len(args.term) > 256 or "\x00" in args.term):
+        raise ValueError("term must contain 1..256 characters")
     with _index_lock(output, exclusive=False):
         selected = _selected_generation(output, getattr(args, "snapshot", None))
         index = selected / "index.sqlite"
@@ -473,8 +665,7 @@ def command_query(args) -> int:
         if not getattr(args, "snapshot", None) and not _query_is_fresh(output.parent.parent, snapshot, files):
             print("Stale code index: refresh required before query.", file=sys.stderr)
             return 1
-        conn = sqlite3.connect(str(index))
-        conn.row_factory = sqlite3.Row
+        conn = read_connection(index)
         try:
             symbol_columns = {row[1] for row in conn.execute("PRAGMA table_info(symbols)")}
             provenance = ", parser, content_hash, metadata_json" if {"parser", "content_hash", "metadata_json"}.issubset(symbol_columns) else ", NULL AS parser, NULL AS content_hash, NULL AS metadata_json"
@@ -488,16 +679,16 @@ def command_query(args) -> int:
                     WHERE symbols_fts MATCH ?
                     LIMIT ?
                     """,
-                    (args.term, limit),
+                    ('"' + args.term.replace('"', '""') + '"', limit),
                 ).fetchall()
             except sqlite3.OperationalError:
-                like = f"%{args.term}%"
+                like = args.term
                 rows = conn.execute(
                     f"""
                     SELECT id, codebase, kind, name, qualified_name, path, line_start, line_end,
                            {provenance[2:]}
                     FROM symbols
-                    WHERE name LIKE ? OR qualified_name LIKE ? OR path LIKE ?
+                    WHERE instr(lower(name),lower(?))>0 OR instr(lower(qualified_name),lower(?))>0 OR instr(lower(path),lower(?))>0
                     LIMIT ?
                     """,
                     (like, like, like, limit),
@@ -514,6 +705,10 @@ def command_query(args) -> int:
 
 
 def command_relations(args) -> int:
+    if getattr(args, "direction", "outgoing") != "outgoing":
+        args.plan = json.dumps({"seedEntityIds": [args.object], "phases": ["traverse_relations", "verify_evidence"], "direction": args.direction, "depth": min(args.depth, 5), "limit": min(args.limit, 100), "includeHeuristic": args.include_heuristic})
+        args.command = "query-plan"
+        return command_structured(args)
     output = Path(args.index).resolve()
     depth = max(0, min(args.depth, 20)); limit = _bounded_limit(args.limit, 1000)
     with _index_lock(output, exclusive=False):
@@ -524,7 +719,7 @@ def command_relations(args) -> int:
             print(bundle_errors[0], file=sys.stderr); return 1
         if not getattr(args, "snapshot", None) and not _query_is_fresh(output.parent.parent, snapshot, files):
             print("Stale code index: refresh required before query.", file=sys.stderr); return 1
-        conn = sqlite3.connect(str(selected / "index.sqlite")); conn.row_factory = sqlite3.Row
+        conn = read_connection(selected / "index.sqlite")
         try:
             symbol_columns = {row[1] for row in conn.execute("PRAGMA table_info(symbols)")}
             parser_expr = "s.parser" if "parser" in symbol_columns else "NULL"
@@ -555,6 +750,10 @@ def command_relations(args) -> int:
             for row in rows[:limit]:
                 item = dict(row)
                 item["snapshot"] = snapshot.get("generation")
+                relation_parser = conn.execute("SELECT parser FROM relations WHERE from_id=? AND relation_type=? AND evidence_path=? AND evidence_line=? LIMIT 1", (item["from_id"], item["relation_type"], item["evidence_path"], item["evidence_line"])).fetchone()
+                item["relation_parser"] = relation_parser[0] if relation_parser else "unknown"
+                item["source_file_parser"] = item.get("from_parser")
+                item["provenance"] = {"relation_parser": item["relation_parser"], "source_file_parser": item["source_file_parser"], "snapshot": snapshot.get("generation")}
                 if getattr(args, "change_type", None):
                     item["impact_kind"] = args.change_type
                     item["severity"] = _impact_severity(args.change_type, item.get("flow_type", "relation"))
@@ -589,7 +788,7 @@ def command_impact(args) -> int:
             if not _query_is_fresh(output.parent.parent, snapshot, files):
                 print("Stale code index: refresh required before impact query.", file=sys.stderr)
                 return 1
-        conn = sqlite3.connect(str(selected / "index.sqlite")); conn.row_factory = sqlite3.Row
+        conn = read_connection(selected / "index.sqlite")
         try:
             tables = _table_names(conn)
             semantic_tables = {"semantic_flows", "entity_versions", "feature_bindings", "coverage_metrics"}
@@ -625,21 +824,37 @@ def _selected_generation(output: Path, generation: str | None) -> Path:
     if not generation:
         root_snapshot = _load_snapshot(output)
         current = root_snapshot.get("generation") if root_snapshot else None
-        if current and re.fullmatch(r"[0-9a-f-]{36}", str(current), re.I):
-            selected = output / "snapshots" / str(current)
-            if selected.is_dir():
-                return selected
+        if current is not None:
+            if not re.fullmatch(r"[0-9a-f-]{36}", str(current), re.I):
+                raise ValueError(f"invalid current snapshot generation: {current}")
+            current = str(current)
+            _validate_generation_pointer(output, root_snapshot, current)
+            selected = output / "snapshots" / current
+            if not selected.is_dir():
+                raise ValueError(f"current snapshot directory is missing: {selected}")
+            selected_snapshot = _load_snapshot(selected)
+            _validate_generation_pointer(selected, selected_snapshot, current)
+            return selected
         # Legacy indexes predating immutable snapshots remain readable.
         return output
     if not re.fullmatch(r"[0-9a-f-]{36}", generation, re.I):
         raise ValueError("invalid snapshot generation")
     selected = output / "snapshots" / generation
     snapshot = _load_snapshot(selected)
-    if snapshot.get("generation") != generation:
-        raise ValueError(f"unknown snapshot generation: {generation}")
+    _validate_generation_pointer(selected, snapshot, generation)
     return selected
 
 
+def _validate_generation_pointer(selected: Path, snapshot: Dict[str, object], expected: str) -> None:
+    if snapshot.get("generation") != expected:
+        raise ValueError(f"snapshot generation mismatch: expected={expected}, metadata={snapshot.get('generation')}")
+    expected_path = f"snapshots/{expected}"
+    if snapshot.get("immutablePath") != expected_path:
+        raise ValueError(
+            f"snapshot immutablePath mismatch: expected={expected_path}, metadata={snapshot.get('immutablePath')}"
+        )
+
+
 def _load_snapshot(output: Path) -> Dict[str, object]:
     path = output / SNAPSHOT_FILE
     if not path.exists():
@@ -664,6 +879,11 @@ def _validate_snapshot_bundle(selected: Path, snapshot: Dict[str, object]) -> Li
     generation = snapshot.get("generation")
     if not generation:
         return [f"snapshot metadata missing generation in {selected}"]
+    if selected.parent.name == "snapshots":
+        try:
+            _validate_generation_pointer(selected, snapshot, selected.name)
+        except ValueError as exc:
+            errors.append(str(exc))
     required = [SNAPSHOT_FILE, "index.sqlite", *INDEX_FILES.values()]
     for name in required:
         if not (selected / name).is_file():
@@ -705,7 +925,9 @@ def _query_is_fresh(root: Path, snapshot: Dict[str, object], files: List[dict])
     if not any(path.startswith("../") for path in indexed_paths):
         scope = workspace.get("scanScope") if isinstance(workspace.get("scanScope"), dict) else {}
         excludes = scope.get("exclude", []) if isinstance(scope, dict) else []
-        current_paths = sorted(_workspace_rel(root, item) for item in scan_files(root, excludes=excludes))
+        repositories = scope.get("codebases", [])
+        roots = [Path(item["path"]) for item in repositories] if repositories else [root]
+        current_paths = sorted({_workspace_rel(root, item) for repository in roots for item in scan_files(repository, excludes=excludes, max_bytes=scope.get("maxFileSize", 1500000), includes=scope.get("includes", []))})
         expected_paths_hash = workspace.get("discoveredPathsHash") or workspace.get("indexedPathsHash")
         if _hash_lines(current_paths) != expected_paths_hash:
             return False
@@ -724,10 +946,39 @@ def command_audit(args) -> int:
             for error in bundle_errors:
                 print(error, file=sys.stderr)
             return 1
-        files, symbols, relations, diagnostics = _load_tuple(selected)
         findings = []
-        findings.extend(audit_stale(root, files))
-        findings.extend(audit_relations(symbols, relations))
+        level = getattr(args, "level", "publish")
+        if level == "full":
+            files, symbols, relations, diagnostics = _load_tuple(selected)
+            findings.extend(audit_stale(root, files))
+            findings.extend(audit_relations(symbols, relations))
+        else:
+            # The publish audit is intentionally bounded and SQL-backed.  A
+            # full stale/content audit remains available explicitly via
+            # --level full and should not block initialization publication.
+            try:
+                conn = sqlite3.connect(str(selected / "index.sqlite"))
+                try:
+                    tables = _table_names(conn)
+                    if {"relations", "symbols"}.issubset(tables):
+                        row = conn.execute("""
+                            SELECT COUNT(*) FROM relations r
+                            LEFT JOIN symbols s ON s.id=r.from_id
+                            WHERE s.id IS NULL
+                        """).fetchone()
+                        if row and row[0]:
+                            findings.append({"severity": "error", "kind": "dangling_relation", "message": f"{row[0]} relations have missing source symbols"})
+                        row = conn.execute("""
+                            SELECT COUNT(*) FROM relations r
+                            LEFT JOIN symbols s ON s.id=r.to_id
+                            WHERE r.to_id IS NOT NULL AND s.id IS NULL AND (r.to_external IS NULL OR r.to_external='')
+                        """).fetchone()
+                        if row and row[0]:
+                            findings.append({"severity": "error", "kind": "dangling_relation", "message": f"{row[0]} relations have missing target symbols"})
+                finally:
+                    conn.close()
+            except sqlite3.Error as exc:
+                findings.append({"severity": "error", "kind": "sqlite_error", "message": str(exc)})
         skill_root = Path(args.skill_root)
         if skill_root.exists():
             findings.extend(audit_project_binding([skill_root / "workflow-code-index", skill_root / "code-index-query"]))

package/plugins/devflow-intel/skills/workflow-code-index/scripts/core/scanner.py

@@ -1,4 +1,5 @@
 import os
+import fnmatch
 import subprocess
 from pathlib import Path
 from typing import Iterable, List, Sequence
@@ -22,6 +23,7 @@ DEFAULT_EXCLUDES = {
     ".dart_tool",
     "__pycache__",
     "Pods",
+    "server/public",
 }
 
 TEXT_EXTENSIONS = {
@@ -57,7 +59,7 @@ TEXT_EXTENSIONS = {
 }
 
 
-def scan_files(root: Path, excludes: Iterable[str] = (), max_bytes: int = 1_500_000) -> List[Path]:
+def scan_files(root: Path, excludes: Iterable[str] = (), max_bytes: int = 1_500_000, includes: Iterable[str] = ()) -> List[Path]:
     root = root.resolve()
     excluded = DEFAULT_EXCLUDES | set(excludes)
     paths = _scan_with_git(root, excluded) or _scan_with_rg(root, excluded) or _scan_with_walk(root, excluded)
@@ -65,6 +67,9 @@ def scan_files(root: Path, excludes: Iterable[str] = (), max_bytes: int = 1_500_
     for path in sorted(paths):
         if not path.is_file():
             continue
+        relative = path.relative_to(root).as_posix()
+        if includes and not any(fnmatch.fnmatch(relative, pattern) or (pattern.startswith("**/") and fnmatch.fnmatch(relative, pattern[3:])) for pattern in includes):
+            continue
         if _is_excluded(path, root, excluded):
             continue
         if path.suffix and path.suffix.lower() not in TEXT_EXTENSIONS:
@@ -130,5 +135,8 @@ def _is_excluded(path: Path, root: Path, excluded: Sequence[str]) -> bool:
         parts = path.resolve().relative_to(root).parts
     except ValueError:
         return True
-    return any(part in excluded for part in parts)
+    relative = "/".join(parts)
+    if any(fnmatch.fnmatch(relative, pattern) or fnmatch.fnmatch(relative + "/", pattern.rstrip("/") + "/") for pattern in excluded):
+        return True
+    return any(part in excluded for part in parts) or any("/" in pattern and ("/" + "/".join(parts) + "/").find("/" + pattern.strip("/") + "/") >= 0 for pattern in excluded)