@lzehrung/codegraph 2.1.0 → 2.1.2

package/dist/indexer/build-index.js

@@ -4,12 +4,14 @@ import fsp from "node:fs/promises";
 import path from "node:path";
 import { performance } from "node:perf_hooks";
 import { languageExtensionPatterns, supportForFile } from "../languages.js";
+import { isJsTsLanguage } from "../languages/js-family.js";
 import { loadWorkspaceConfig, resolveWorkspacePackage } from "../util/workspace.js";
 import { DEFAULT_PROJECT_PATTERNS, discoverProjectFiles, listProjectFiles, } from "../util/projectFiles.js";
 import { getGitHead, isGitRepo, getGitBlobHashes, listChangedFiles } from "../util/git.js";
-import { clearImportResolutionCaches, resolveSpecifier } from "../util/resolution.js";
-import { assertFilePathWithinRoot, fileIdentityKey, initializeFileIdentityCaseSensitivity, normalizePath, } from "../util/paths.js";
+import { clearResolutionCaches, resolveSpecifier } from "../util/resolution.js";
+import { assertFilePathWithinRoot, fileIdentityKey, initializeFileIdentityCaseSensitivity, isFilePathWithinRoot, normalizePath, } from "../util/paths.js";
 import { mapLimit } from "../util/concurrency.js";
+import { readConfinedUtf8File } from "../util/confinedFile.js";
 import { resolveWorkerThreadCount } from "../util/workerThreads.js";
 import { logWithLevel } from "../logging.js";
 import { collectGraph } from "../graph-builder.js";
@@ -26,8 +28,9 @@ import { initNativeBackendReport } from "../native/nativeBackendReport.js";
 import { closeDuplicateUnitCacheDatabase } from "../duplicates.js";
 import { isNativeRequiredUnavailableError } from "../native/treeSitterNative.js";
 import { isNodeSqliteUnavailableError } from "../sqlite-driver.js";
-import { buildBloomFilterForFile, cacheSignatureForFile, closeDiskCacheDatabase, collectWorkspaceManifestDependencyEdges, computeConfigHash, createFallbackImportExtractionHandler, diffBuildOptions, fileSignature, graphOptionsEqual, initFileReport, initManifestReport, loadManifest, normalizeGraphOptions, normalizeIndexedFileInputs, normalizeLanguageExtensions, projectSnapshotFilesSignature, recordConfigHashResult, recordFileFailure, sanitizeManifestEntriesForRoot, sanitizeManifestTransientFilesForRoot, tryLoadFromCache, tryLoadPersistedBloomFilters, tryLoadProjectIndexSnapshot, verifyManifestEntries, writeProjectIndexSnapshot, writeToCache, } from "./build-cache.js";
-import { cacheRoot } from "./build-cache/module-cache.js";
+import { buildBloomFilterForFile, cacheSignatureForFile, closeDiskCacheDatabase, collectWorkspaceManifestDependencyEdges, computeConfigHash, createFallbackImportExtractionHandler, diffBuildOptions, fileSignature, fileSignatureFromSource, graphOptionsEqual, initFileReport, initManifestReport, loadManifest, normalizeGraphOptions, normalizeIndexedFileInputs, normalizeIndexedFileInputsWithinRoot, normalizeLanguageExtensions, projectSnapshotFilesSignature, recordConfigHashResult, recordFileFailure, sanitizeManifestEntriesForRoot, sanitizeManifestTransientFilesForRoot, tryLoadFromCache, tryLoadPersistedBloomFilters, tryLoadProjectIndexSnapshot, tryLoadProjectSnapshotModules, verifyManifestEntries, writeModulesToCache, writeProjectIndexSnapshot, writeToCache, } from "./build-cache.js";
+import { computeResolverEnvironmentFingerprint } from "./build-cache/resolver-environment.js";
+import { cacheRoot } from "./build-cache/location.js";
 import { SymbolKind, } from "./types.js";
 import { isNonNativeParserUnavailableError, isParserSyntaxTree } from "../parserBackend.js";
 import { isUnsupportedParserInputError } from "../languages/filePrep.js";
@@ -35,7 +38,7 @@ import { buildSqlFactCache, buildSqlModuleIndex, sqlCorpusSignature } from "../s
 import { finalizeProjectIndex } from "./finalize.js";
 import { toManifestFileEntry, writeIndexManifestSnapshot } from "./build-manifest.js";
 import { prepareFileContextForBuild, setupWorkerPool, teardownWorkerPool, } from "./build-workers.js";
-import { buildIncrementalGitDiffOptions, canUseIncrementalDiscoveryFastPath, collectDeletedTrackedFileDependents, collectTrackedFileDependents, isMissingGitRevisionError, listUntrackedProjectFiles, partitionTrackedManifestFiles, probePathExistence, } from "./incremental-plan.js";
+import { buildIncrementalGitDiffOptions, canUseIncrementalDiscoveryFastPath, buildTrackedFileReverseDependencies, collectDeletedTrackedFileDependents, collectTrackedFileDependents, isMissingGitRevisionError, listUntrackedProjectFiles, partitionTrackedManifestFiles, probePathExistence, } from "./incremental-plan.js";
 import { parsedCacheMaxEntries, setParsedCacheEntry } from "./parsed-cache.js";
 function initParserBackendDegradationReport(report) {
     if (!report)
@@ -74,13 +77,17 @@ function recordParserBackendDegradation(report, entry) {
         return;
     parserReport.files.push(entry);
 }
+function isConfinedFileReadError(error) {
+    return (error instanceof Error &&
+        /outside project root|possible path confinement race|changed between verification and open|confined file target/u.test(error.message));
+}
 function createEmptyModuleIndex(file) {
     return { file, exports: [], imports: [], locals: [] };
 }
 async function resolveCrossModuleSymbolExports(file, mod, support, projectRoot, graphOptions, workspaceConfig, logLevel) {
     if (!support.supportsCrossModuleSymbols)
         return;
-    if (support.id !== "ts" && support.id !== "js")
+    if (!isJsTsLanguage(support.id))
         return;
     const { matchPath } = await import("../util/resolution.js").then((mod) => mod.loadNearestTsconfigFor(file, projectRoot, logLevel));
     for (const entry of mod.exports) {
@@ -88,29 +95,43 @@ async function resolveCrossModuleSymbolExports(file, mod, support, projectRoot,
             continue;
         }
         if (entry.fromModule.startsWith(".")) {
+            entry.moduleSpecifier ??= entry.fromModule;
             const resolved = await resolveSpecifier(file, entry.fromModule, projectRoot, matchPath, workspaceConfig, {
                 resolveNodeModules: !!graphOptions.resolveNodeModules,
                 ...(graphOptions.resolutionHints ? { resolutionHints: graphOptions.resolutionHints } : {}),
             });
-            if (typeof resolved === "string")
+            if (typeof resolved === "string" && isFilePathWithinRoot(projectRoot, resolved))
                 entry.fromModule = resolved;
             continue;
         }
         const pkgResolved = await resolveWorkspacePackage(entry.fromModule, workspaceConfig);
-        if (pkgResolved)
-            entry.fromModule = pkgResolved;
+        if (pkgResolved) {
+            entry.moduleSpecifier ??= entry.fromModule;
+            if (isFilePathWithinRoot(projectRoot, pkgResolved))
+                entry.fromModule = pkgResolved;
+        }
     }
 }
 async function buildIndexedModuleForFile(args) {
-    const prepared = await prepareFileContextForBuild(args.file, args.support, args.opts, args.workerSetup, args.report);
+    const prepared = await prepareFileContextForBuild(args.file, args.support, args.opts, args.workerSetup, args.report, args.confinedRoot, args.projectRoot, args.trustedSource);
     const { source, sup, nativeQueries, embeddedBlocks } = prepared;
     let resolvedLang = prepared.lang;
     let tree;
-    const graphOnlyLanguage = isGraphOnlyLanguage(sup.id);
+    const graphOnlyLanguage = isGraphOnlyLanguage(sup.id), nativeSourceLimitFallback = prepared.nativeFallbackReason === "queryFailure" &&
+        !!prepared.nativeError?.startsWith("source exceeds native byte limit");
     if (prepared.syntaxTree) {
-        tree = new ProjectedSyntaxTree(source, prepared.syntaxTree);
+        const parsedTree = new ProjectedSyntaxTree(source, prepared.syntaxTree);
+        tree = parsedTree;
+        setParsedCacheEntry(args.parsedMap, args.file, {
+            source,
+            tree: parsedTree,
+            sup,
+            ...(resolvedLang ? { lang: resolvedLang } : {}),
+            ...(embeddedBlocks ? { embeddedBlocks } : {}),
+            nativeQueries,
+        }, args.parsedCacheMaxEntries);
     }
-    else if (!nativeQueries && !graphOnlyLanguage && sup.id !== "sql") {
+    else if (!nativeQueries && !graphOnlyLanguage && sup.id !== "sql" && !nativeSourceLimitFallback) {
         const parseAttempt = attemptParsePreparedFileContext(prepared);
         const parsed = parseAttempt.parsed;
         if (parsed) {
@@ -135,14 +156,24 @@ async function buildIndexedModuleForFile(args) {
         if (parsed) {
             tree = parsed.tree;
             resolvedLang = parsed.lang ?? resolvedLang;
+            setParsedCacheEntry(args.parsedMap, args.file, parsed, args.parsedCacheMaxEntries);
         }
     }
     const lacksParserContext = !nativeQueries && !tree;
-    if (args.bloomFilterCache) {
-        const filter = buildBloomFilterFromSource(source, sup.id);
+    if (args.bloomFilterCache && !nativeSourceLimitFallback) {
+        const filter = buildBloomFilterFromSource(source, sup);
         args.bloomFilterCache.set(args.file, filter);
     }
-    const imports = sup.id === "sql"
+    // Single builder so an option added here always reaches both the primary source and
+    // every embedded (SFC) block, instead of one path silently missing a future option.
+    const sharedImportOptions = {
+        graphOptions: args.graphOptions,
+        ...(args.opts?.native ? { native: args.opts.native } : {}),
+        ...(args.opts?.logLevel ? { logLevel: args.opts.logLevel } : {}),
+        ...(args.opts?.languageExtensions ? { languageExtensions: args.opts.languageExtensions } : {}),
+        ...(args.onFallbackImportExtraction ? { onFallbackImportExtraction: args.onFallbackImportExtraction } : {}),
+    };
+    const imports = nativeSourceLimitFallback || sup.id === "sql"
         ? []
         : await collectImportsForFile(args.file, args.projectRoot, {
             source,
@@ -150,21 +181,13 @@ async function buildIndexedModuleForFile(args) {
             sup,
             ...(resolvedLang ? { lang: resolvedLang } : {}),
             ...(nativeQueries !== undefined ? { nativeQueries } : {}),
-            graphOptions: args.graphOptions,
-            ...(args.opts?.native ? { native: args.opts.native } : {}),
-            ...(args.opts?.logLevel ? { logLevel: args.opts.logLevel } : {}),
-            ...(args.opts?.languageExtensions ? { languageExtensions: args.opts.languageExtensions } : {}),
-            ...(args.onFallbackImportExtraction ? { onFallbackImportExtraction: args.onFallbackImportExtraction } : {}),
+            ...sharedImportOptions,
         });
     for (const block of embeddedBlocks ?? []) {
         imports.push(...(await collectImportsForFile(args.file, args.projectRoot, {
             source: block.source,
             sup: block.sup,
-            graphOptions: args.graphOptions,
-            ...(args.opts?.native ? { native: args.opts.native } : {}),
-            ...(args.opts?.logLevel ? { logLevel: args.opts.logLevel } : {}),
-            ...(args.opts?.languageExtensions ? { languageExtensions: args.opts.languageExtensions } : {}),
-            ...(args.onFallbackImportExtraction ? { onFallbackImportExtraction: args.onFallbackImportExtraction } : {}),
+            ...sharedImportOptions,
         })));
     }
     collectJsonDependencies(imports, args.jsonDependencies);
@@ -187,14 +210,16 @@ async function buildIndexedModuleForFile(args) {
     await resolveCrossModuleSymbolExports(args.file, mod, sup, args.projectRoot, args.graphOptions, args.workspaceConfig, args.opts?.logLevel);
     const sigInfo = args.fileSignatures.get(args.file);
     const cacheable = !prepared.nativeFallbackReason && !lacksParserContext;
+    let cacheWrite;
     if (sigInfo && cacheable) {
         const cacheSig = args.cacheEnabled
-            ? await moduleCacheSignatureForFile(args.file, sigInfo, args.opts)
+            ? await moduleCacheSignatureForFile(args.file, sigInfo, args.opts, args.resolverEnvironmentFingerprint)
             : sigInfo.cacheSig;
-        writeToCache(args.projectRoot, args.file, cacheSig, mod, args.opts);
+        cacheWrite = { file: args.file, sig: cacheSig, mod };
     }
     return {
         module: mod,
+        ...(cacheWrite !== undefined ? { cacheWrite } : {}),
         graphContext: {
             source,
             sup,
@@ -242,19 +267,24 @@ function graphEdgeKey(edge) {
     const target = edge.to.type === "file" ? `file:${fileIdentityKey(edge.to.path)}` : `external:${edge.to.name}`;
     return `${from}::${target}::${edge.raw ?? ""}::${edge.typeOnly ? 1 : 0}`;
 }
-async function moduleCacheSignatureForFile(file, sigInfo, opts) {
+async function moduleCacheSignatureForFile(file, sigInfo, opts, resolverEnvironmentFingerprint) {
     const baseSignature = await cacheSignatureForFile(file, sigInfo, opts);
     const normalizedExtensions = normalizeLanguageExtensions(opts?.languageExtensions);
-    if (!normalizedExtensions)
+    const resolveNodeModules = normalizeGraphOptions(opts?.graph).resolveNodeModules;
+    if (!normalizedExtensions && !resolveNodeModules)
         return baseSignature;
     // Combine via a hash rather than raw concatenation: the disk cache stores this string in a
     // SQLite TEXT column, and node:sqlite's DatabaseSync silently truncates TEXT bind parameters
     // at embedded NUL bytes, so a raw separator character risks the stored and freshly-computed
     // signatures never matching (permanent cache miss) if either baseSignature or the serialized
-    // extensions ever contained one.
+    // extensions ever contained one. A cached ModuleIndex's ImportBinding.resolved values differ
+    // depending on whether resolveNodeModules was on at write time (resolved node_modules targets
+    // vs. external), so that state and the environment that produced it must be part of the key.
     const hash = crypto.createHash("sha1");
     hash.update(baseSignature);
-    hash.update(JSON.stringify(Object.entries(normalizedExtensions)));
+    hash.update(JSON.stringify(Object.entries(normalizedExtensions ?? {})));
+    hash.update(resolveNodeModules ? "\0resolveNodeModules" : "");
+    hash.update(resolverEnvironmentFingerprint === null ? "\0resolverEnvironmentTooLarge" : (resolverEnvironmentFingerprint ?? ""));
     return hash.digest("hex");
 }
 function projectPatternsForLanguageExtensions(opts) {
@@ -325,21 +355,25 @@ function expandStarImports(modules, opts) {
     }
 }
 function toProjectIndexManifestEntry(entry) {
+    // A git signature alone is already a strong content identity (`fileSignature()` derives
+    // `cacheSig` the same way: `gitSig ?? contentHash ?? sig`), so entries sourced from the disk
+    // manifest (which does not persist `cacheSig`) still get one whenever `gitSig` is available.
+    const cacheSig = entry.cacheSig ?? entry.gitSig;
     return {
         sig: entry.sig,
         ...(entry.gitSig ? { gitSig: entry.gitSig } : {}),
+        ...(cacheSig ? { cacheSig } : {}),
     };
 }
 function projectIndexManifestEntries(entries) {
     return new Map(Array.from(entries, ([file, entry]) => [file, toProjectIndexManifestEntry(entry)]));
 }
 function createIndexBuildRunState(projectRoot, opts, graphOptions = normalizeGraphOptions(opts?.graph)) {
-    const report = opts?.report;
-    if (report)
-        initNativeBackendReport(report);
+    const report = opts?.report ?? { timings: {} };
+    initNativeBackendReport(report);
     const cacheMode = opts?.cache ?? "off";
     return {
-        normalizedProjectRoot: normalizePath(projectRoot),
+        normalizedProjectRoot: normalizePath(path.resolve(projectRoot)),
         report,
         timings: report?.timings,
         totalStart: performance.now(),
@@ -371,7 +405,14 @@ function buildConcurrency(opts) {
 async function prepareFileSignatures(args) {
     const entries = await mapLimit(args.files, args.concurrency, async (file) => {
         const gitSig = args.gitSigMap.get(file);
-        const sigInfo = await fileSignature(file, args.opts?.cacheStrict, gitSig, {
+        const source = args.confinedRoot
+            ? await readConfinedUtf8File(args.confinedRoot, args.projectRoot, file)
+            : undefined;
+        if (source !== undefined) {
+            args.trustedSources?.set(file, source);
+            return [file, fileSignatureFromSource(source, gitSig)];
+        }
+        const sigInfo = await fileSignature(file, args.needsContentHash ? args.opts?.cacheStrict : false, gitSig, {
             forceContentHash: args.cacheEnabled && !gitSig,
         });
         return [file, sigInfo];
@@ -382,7 +423,7 @@ async function buildProjectIndexFromExport(projectRoot, opts, helperOpts) {
     return buildProjectIndexWithManifestOptions(projectRoot, opts, helperOpts);
 }
 async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperOpts) {
-    clearImportResolutionCaches();
+    clearResolutionCaches();
     await initializeFileIdentityCaseSensitivity(projectRoot);
     const { normalizedProjectRoot, report, timings, totalStart, cacheMode, cacheEnabled, graphOptions, onFallbackImportExtraction, } = createIndexBuildRunState(projectRoot, opts);
     const manifestMode = helperOpts?.manifestMode ?? "off";
@@ -390,7 +431,11 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     const shouldWriteManifest = manifestMode === "read-write";
     const projectFiles = helperOpts?.projectFiles;
     initManifestReport(report, useManifest, false);
-    const normalizedFiles = Array.from(new Set(normalizeIndexedFileInputs(projectRoot, rawFiles ?? [], "Index file")));
+    const confinedRoot = helperOpts?.confineReads ? await fsp.realpath(projectRoot) : undefined;
+    const [trustedSources, normalizedFiles] = [
+        confinedRoot ? new Map() : undefined,
+        Array.from(new Set(normalizeIndexedFileInputs(projectRoot, rawFiles ?? [], "Index file"))),
+    ];
     if (!normalizedFiles.length && helperOpts?.warnNoFilesMessage) {
         logWithLevel(opts?.logLevel, "warn", helperOpts.warnNoFilesMessage);
     }
@@ -398,11 +443,21 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     if (fileReport)
         fileReport.total = normalizedFiles.length;
     const manifestStart = performance.now();
-    const manifest = useManifest && !helperOpts?.ignoreExistingManifest ? await loadManifest(projectRoot, opts) : null;
+    const manifest = useManifest && !helperOpts?.ignoreExistingManifest ? await loadManifest(projectRoot, opts, report) : null;
     const manifestFiles = sanitizeManifestEntriesForRoot(projectRoot, manifest?.files);
     const manifestOptionDiffs = manifest ? diffBuildOptions(manifest.buildOptions, opts) : [];
     const languageExtensionsChanged = manifestOptionDiffs.includes("languageExtensions");
     const implementationChanged = manifestOptionDiffs.includes("implementation");
+    let resolverEnvironmentFingerprint;
+    let resolverEnvironmentMatchesManifest = true;
+    if (cacheEnabled && graphOptions.resolveNodeModules) {
+        resolverEnvironmentFingerprint = await computeResolverEnvironmentFingerprint(projectRoot, normalizedFiles);
+        if (useManifest) {
+            resolverEnvironmentMatchesManifest =
+                resolverEnvironmentFingerprint !== null &&
+                    manifest?.resolverEnvironmentFingerprint === resolverEnvironmentFingerprint;
+        }
+    }
     if (timings && useManifest) {
         timings.manifestMs = Math.round(performance.now() - manifestStart);
     }
@@ -426,13 +481,14 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     const cachedGraphEntries = manifest &&
         !languageExtensionsChanged &&
         !implementationChanged &&
+        resolverEnvironmentMatchesManifest &&
         graphOptionsEqual(manifest.graphOptions, graphOptions)
         ? new Map(Object.entries(manifestFiles).filter(([file]) => !staleCachedEdgeFiles.has(file)))
         : undefined;
+    const manifestEntries = shouldWriteManifest ? new Map() : undefined;
     if (report?.manifest) {
         report.manifest.reused = !!cachedGraphEntries;
     }
-    const manifestEntries = shouldWriteManifest ? new Map() : undefined;
     const manifestEntriesForIndex = useManifest
         ? projectIndexManifestEntries(cachedGraphEntries ?? [])
         : new Map();
@@ -455,11 +511,14 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     })
         .sort((left, right) => left.localeCompare(right));
     const fileSignatures = await prepareFileSignatures({
+        projectRoot,
         files: sqlFiles,
         opts,
         gitSigMap,
         cacheEnabled,
+        needsContentHash: true,
         concurrency: conc,
+        ...(confinedRoot ? { confinedRoot, trustedSources } : {}),
     });
     const sqlCorpusSig = sqlCorpusSignature(sqlFiles, fileSignatures);
     let sqlFactCachePromise;
@@ -482,7 +541,9 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
         const bloomFilterCache = useBloomFilters
             ? new (await import("../util/bloomFilter.js")).BloomFilterCache()
             : undefined;
-        const persistedBloomFilters = bloomFilterCache ? await tryLoadPersistedBloomFilters(projectRoot, opts) : null;
+        const persistedBloomFilters = bloomFilterCache
+            ? await tryLoadPersistedBloomFilters(projectRoot, opts, report)
+            : null;
         const parsedMap = new Map();
         const workspaceConfig = await loadWorkspaceConfig(projectRoot);
         const parseStart = performance.now();
@@ -509,9 +570,16 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                 let sigInfo = fileSignatures.get(file);
                 if (!sigInfo) {
                     const gitSig = gitSigMap.get(file);
-                    sigInfo = await fileSignature(file, opts?.cacheStrict, gitSig, {
-                        forceContentHash: cacheEnabled && !gitSig,
-                    });
+                    const source = confinedRoot ? await readConfinedUtf8File(confinedRoot, projectRoot, file) : undefined;
+                    if (source !== undefined) {
+                        trustedSources?.set(file, source);
+                        sigInfo = fileSignatureFromSource(source, gitSig);
+                    }
+                    else {
+                        sigInfo = await fileSignature(file, opts?.cacheStrict, gitSig, {
+                            forceContentHash: cacheEnabled && !gitSig,
+                        });
+                    }
                     fileSignatures.set(file, sigInfo);
                 }
                 manifestEntriesForIndex.set(file, toProjectIndexManifestEntry(sigInfo));
@@ -520,8 +588,13 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                     if (initialManifestEntry)
                         manifestEntries.set(file, initialManifestEntry);
                 }
-                const cacheSig = cacheEnabled ? await moduleCacheSignatureForFile(file, sigInfo, opts) : sigInfo.cacheSig;
-                let mod = cacheEnabled ? tryLoadFromCache(projectRoot, file, cacheSig, opts, report) : null;
+                const cacheSig = cacheEnabled
+                    ? await moduleCacheSignatureForFile(file, sigInfo, opts, resolverEnvironmentFingerprint)
+                    : sigInfo.cacheSig;
+                const canReuseModuleCache = cacheEnabled && (!graphOptions.resolveNodeModules || resolverEnvironmentFingerprint !== null);
+                let mod = canReuseModuleCache
+                    ? tryLoadFromCache(projectRoot, file, cacheSig, opts, report)
+                    : null;
                 if (mod && fileReport) {
                     fileReport.cached = (fileReport.cached ?? 0) + 1;
                 }
@@ -555,7 +628,7 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                         ...(sqlFactCache ? { sqlFactCache } : {}),
                     });
                     if (bloomFilterCache) {
-                        const persistedFilter = persistedBloomFilters?.get(file);
+                        const persistedFilter = persistedBloomFilters?.get(file, sigInfo);
                         if (persistedFilter) {
                             bloomFilterCache.set(file, persistedFilter);
                         }
@@ -565,15 +638,16 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                                 bloomFilterCache.set(file, filter);
                         }
                     }
-                    return [file, mod, edges];
+                    return [file, mod, edges, undefined];
                 }
                 if (fileReport)
                     fileReport.parsed = (fileReport.parsed ?? 0) + 1;
                 const support = supportForFile(file, opts?.languageExtensions);
                 if (!support)
-                    return [file, createEmptyModuleIndex(file), []];
+                    return [file, createEmptyModuleIndex(file), [], undefined];
                 ensureBuildProgressStarted();
                 let graphContext;
+                let cacheWrite;
                 if (!mod) {
                     const built = await buildIndexedModuleForFile({
                         file,
@@ -584,6 +658,7 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                         graphOptions,
                         workspaceConfig,
                         workerSetup,
+                        ...(resolverEnvironmentFingerprint !== undefined ? { resolverEnvironmentFingerprint } : {}),
                         parsedMap,
                         parsedCacheMaxEntries: parsedCacheMaxEntries(opts),
                         jsonDependencies,
@@ -591,9 +666,11 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                         onFallbackImportExtraction,
                         fileSignatures,
                         cacheEnabled,
+                        ...(confinedRoot ? { confinedRoot, trustedSource: trustedSources?.get(file) } : {}),
                     });
                     mod = built.module;
                     graphContext = built.graphContext;
+                    cacheWrite = built.cacheWrite;
                 }
                 else {
                     collectJsonDependencies(mod.imports, jsonDependencies);
@@ -619,13 +696,15 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                     allFiles: normalizedFiles,
                     ...(sqlFactCache ? { sqlFactCache } : {}),
                 });
-                return [file, mod ?? createEmptyModuleIndex(file), edges];
+                return [file, mod ?? createEmptyModuleIndex(file), edges, cacheWrite];
             }
             catch (error) {
                 if (isNativeRequiredUnavailableError(error) || isNodeSqliteUnavailableError(error))
                     throw error;
+                if (isConfinedFileReadError(error))
+                    throw error;
                 if (isUnsupportedParserInputError(error) || isNonNativeParserUnavailableError(error)) {
-                    return [file, createEmptyModuleIndex(file), []];
+                    return [file, createEmptyModuleIndex(file), [], undefined];
                 }
                 recordFileFailure(report, file, error);
                 logWithLevel(opts?.logLevel, "warn", `Warning: Failed to process file ${file}:`, error);
@@ -662,11 +741,17 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                     graph.nodes.add(edge.to.path);
             }
         };
-        for (const [file, mod, edges] of fileResults) {
+        const pendingCacheWrites = [];
+        for (const [file, mod, edges, cacheWrite] of fileResults) {
             modules.set(fileIdentityKey(file), mod);
             appendUniqueGraphEdges(edges);
+            if (cacheWrite)
+                pendingCacheWrites.push(cacheWrite);
+        }
+        if (pendingCacheWrites.length) {
+            writeModulesToCache(projectRoot, pendingCacheWrites, opts);
         }
-        const workspaceManifestEdges = await collectWorkspaceManifestDependencyEdges(projectRoot, opts?.discovery, new Set(normalizedFiles), opts?.logLevel);
+        const workspaceManifestEdges = await collectWorkspaceManifestDependencyEdges(projectRoot, normalizedFiles.filter((file) => path.basename(file) === "package.json"), opts?.discovery, opts?.logLevel);
         appendUniqueGraphEdges(workspaceManifestEdges);
         if (timings)
             timings.graphMs = Math.round(performance.now() - graphStart);
@@ -674,11 +759,23 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
             ensureJsonModule(modules, jsonPath);
         }
         expandStarImports(modules, opts);
+        if (manifestEntries) {
+            for (const [file, signature] of fileSignatures) {
+                if (manifestEntries.has(file))
+                    continue;
+                manifestEntries.set(file, {
+                    sig: signature.sig,
+                    ...(signature.gitSig ? { gitSig: signature.gitSig } : {}),
+                    edges: [],
+                });
+            }
+        }
         if (manifestEntries) {
             await writeIndexManifestSnapshot({
                 projectRoot,
                 opts,
                 graphOptions,
+                ...(resolverEnvironmentFingerprint ? { resolverEnvironmentFingerprint } : {}),
                 files: manifestEntries,
                 timings,
                 manifestReport: report?.manifest,
@@ -686,6 +783,12 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                 ...(helperOpts?.symlinkDirectories !== undefined ? { symlinkDirectories: helperOpts.symlinkDirectories } : {}),
             });
         }
+        const indexManifestEntries = manifestEntries
+            ? projectIndexManifestEntries(Array.from(manifestEntries, ([file, entry]) => {
+                const cacheSig = fileSignatures.get(file)?.cacheSig;
+                return [file, { ...entry, ...(cacheSig ? { cacheSig } : {}) }];
+            }))
+            : manifestEntriesForIndex;
         const index = await finalizeProjectIndex({
             projectRoot,
             normalizedProjectRoot,
@@ -698,10 +801,10 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
             bloomFilterCache,
             ...(projectFiles !== undefined ? { projectFiles } : {}),
             buildReport: report,
-            manifestEntries: manifestEntriesForIndex,
+            manifestEntries: indexManifestEntries,
         });
         if (manifestEntries) {
-            await writeProjectIndexSnapshot(projectRoot, opts, index, projectSnapshotFilesSignature(manifestEntries));
+            await writeProjectIndexSnapshot(projectRoot, opts, index, projectSnapshotFilesSignature(manifestEntries, projectRoot));
         }
         if (buildStartedAt !== undefined) {
             emitIndexLifecycleProgress(opts, "complete", "build", index.byFile.size, performance.now() - buildStartedAt);
@@ -721,34 +824,29 @@ async function buildProjectIndexWithManifestOptions(projectRoot, opts, helperOpt
         // full-tree symlink probe. Off and memory modes never read or write this disk
         // manifest, keeping read-only builds from mutating the project root. A missing or
         // unusable manifest falls back to probing once.
-        // A symlink hint never expires on its own: `knownSymlinkDirectories` disables probing entirely, so
-        // a directory symlinked in after the hint was recorded (e.g. `npm link`) would
-        // otherwise never be discovered. `--cache-strict`/`--cache-verify` are explicit asks
-        // for maximum correctness over speed, so both force a fresh probe here too.
+        // The manifest records the project-root directory mtime alongside symlink hints. A changed
+        // root mtime triggers the cheap full-tree probe, while strict modes always probe.
         const wantsMaxSymlinkCorrectness = !!opts?.cacheStrict || !!opts?.cacheVerify;
         const symlinkHintManifest = helperOpts?.ignoreExistingManifest || wantsMaxSymlinkCorrectness || !useDiskCache
             ? null
             : await loadManifest(projectRoot, opts);
-        const knownSymlinkDirectories = symlinkHintManifest?.symlinkDirectories;
+        const rootMtime = symlinkHintManifest ? (await fsp.stat(projectRoot)).mtimeMs : undefined;
+        const symlinkHintIsFresh = symlinkHintManifest?.symlinkDirectoriesRootMtimeMs !== undefined &&
+            rootMtime === symlinkHintManifest.symlinkDirectoriesRootMtimeMs;
+        const knownSymlinkDirectories = symlinkHintIsFresh ? symlinkHintManifest?.symlinkDirectories : undefined;
         let discoveredSymlinkDirectories = knownSymlinkDirectories;
         const onSymlinkDirectoriesDiscovered = (directories) => {
             discoveredSymlinkDirectories = Array.from(directories);
         };
         // When the hint is unknown, listProjectFiles() and discoverProjectFiles() must run
-        // sequentially rather than in Promise.all: both would otherwise start their own
-        // full-tree symlink probe concurrently, since the callback only reports back after
-        // listProjectFiles() resolves, too late to inform a probe discoverProjectFiles()
-        // already started on its own. Sequencing costs a little parallelism on that one
-        // cold-start case, but avoids paying for two full-tree walks instead of one. Once a
-        // hint is known (the common warm case), both calls skip probing entirely, so running
-        // them sequentially here costs no meaningful time either way.
+        // sequentially rather than in Promise.all to avoid duplicate full-tree probes.
         const discoveredFiles = await listProjectFiles(projectRoot, projectPatternsForLanguageExtensions(opts), {
             ...opts?.discovery,
             ...(opts?.logLevel ? { logLevel: opts.logLevel } : {}),
             ...(knownSymlinkDirectories !== undefined ? { knownSymlinkDirectories } : {}),
             onSymlinkDirectoriesDiscovered,
         });
-        const additionalFileCandidates = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
+        const additionalFileCandidates = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
         const additionalFileExistence = await probePathExistence(additionalFileCandidates, buildConcurrency(opts));
         const additionalFiles = additionalFileCandidates.filter((file) => additionalFileExistence.get(file));
         const discoveredFileSet = new Set(discoveredFiles);
@@ -795,9 +893,11 @@ export async function buildProjectIndex(projectRoot, opts) {
 export async function buildProjectIndexFromFiles(projectRoot, inputFiles, opts) {
     try {
         const useDiskCache = (opts?.cache ?? "off") === "disk";
-        return await buildIndexFromFileListShared(projectRoot, inputFiles, opts, {
+        const normalizedInputFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, inputFiles, "Index file");
+        return await buildIndexFromFileListShared(projectRoot, normalizedInputFiles, opts, {
             manifestMode: useDiskCache ? "read-only" : "off",
             warnNoFilesMessage: `Warning: No files provided for indexing in ${projectRoot}. Check the explicit file list and include/ignore filters. Diagnostic: codegraph doctor`,
+            confineReads: true,
         });
     }
     finally {
@@ -838,7 +938,7 @@ async function buildDeclaredScopeIndex(projectRoot, scopeFiles, opts) {
  */
 export async function buildProjectIndexIncremental(projectRoot, opts) {
     await initializeFileIdentityCaseSensitivity(projectRoot);
-    clearImportResolutionCaches();
+    clearResolutionCaches();
     const graphOptions = normalizeGraphOptions(opts?.graph);
     const strictIncremental = opts?.incrementalStrict ?? false;
     if (strictIncremental && graphOptions.fast)
@@ -889,7 +989,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         }
         startCheckProgress();
         const manifestStart = performance.now();
-        const manifest = await loadManifest(projectRoot, opts);
+        const manifest = await loadManifest(projectRoot, opts, report);
         if (timings)
             timings.manifestMs = Math.round(performance.now() - manifestStart);
         const manifestUsed = !!manifest;
@@ -907,8 +1007,21 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         const currentConfigHashResult = await computeConfigHash(projectRoot, opts?.logLevel);
         const currentConfigHash = recordConfigHashResult(manifestReport, currentConfigHashResult, opts?.logLevel);
         const configChanged = !!currentConfigHashResult.error || !manifest?.configHash || currentConfigHash !== manifest.configHash;
+        let resolverEnvironmentFingerprint;
+        let resolverEnvironmentMatchesManifest = true;
+        if (manifest && graphOptions.resolveNodeModules) {
+            resolverEnvironmentFingerprint = await computeResolverEnvironmentFingerprint(projectRoot, Object.keys(manifest.files));
+            resolverEnvironmentMatchesManifest =
+                resolverEnvironmentFingerprint !== null &&
+                    manifest.resolverEnvironmentFingerprint === resolverEnvironmentFingerprint;
+        }
         const requiresFullRebuild = optionDiffs.some((diff) => diff === "discovery" || diff === "native" || diff === "implementation" || diff === "languageExtensions");
-        if (!manifest || !graphOptionsEqual(manifest.graphOptions, graphOptions) || configChanged || requiresFullRebuild) {
+        const graphOptionsChanged = !graphOptionsEqual(manifest?.graphOptions, graphOptions);
+        if (!manifest ||
+            graphOptionsChanged ||
+            configChanged ||
+            requiresFullRebuild ||
+            !resolverEnvironmentMatchesManifest) {
             if (manifest && configChanged) {
                 logWithLevel(opts?.logLevel, "warn", "Configuration changed, rebuilding index...");
             }
@@ -920,6 +1033,9 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 else if (configChanged) {
                     reason = "configChanged";
                 }
+                else if (!graphOptionsChanged && !resolverEnvironmentMatchesManifest) {
+                    reason = "resolverEnvironmentChanged";
+                }
                 manifestReport.reason = reason;
                 manifestReport.reused = false;
             }
@@ -979,9 +1095,9 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         const trackedEntryKeys = Object.keys(trackedEntries);
         let manifestRequiresSanitization = manifestFileKeys.length !== trackedEntryKeys.length ||
             manifestFileKeys.some((file) => !Object.hasOwn(trackedEntries, file));
-        const explicitFiles = normalizeIndexedFileInputs(projectRoot, opts?.files ?? [], "Incremental file");
-        const additionalFiles = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
-        const previousTransientFiles = sanitizeManifestTransientFilesForRoot(projectRoot, manifest.transientFiles).filter((file) => Object.hasOwn(trackedEntries, file));
+        const explicitFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.files ?? [], "Incremental file");
+        const additionalFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
+        const previousTransientFiles = sanitizeManifestTransientFilesForRoot(projectRoot, projectRoot, manifest.transientFiles).filter((file) => Object.hasOwn(trackedEntries, file));
         const previousTransientFileSet = new Set(previousTransientFiles);
         const needsGitScan = !!opts?.gitBase || !!opts?.changedSince;
         const gitFiles = needsGitScan ? await listChangedFiles(projectRoot, buildIncrementalGitDiffOptions(opts)) : [];
@@ -1067,6 +1183,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 projectRoot,
                 opts,
                 graphOptions,
+                ...(resolverEnvironmentFingerprint ? { resolverEnvironmentFingerprint } : {}),
                 files: {},
                 timings,
                 manifestReport,
@@ -1087,6 +1204,10 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
             };
         }
         const changedFiles = new Set();
+        if (!resolverEnvironmentMatchesManifest) {
+            for (const file of allFiles)
+                changedFiles.add(file);
+        }
         const markAsChanged = (file) => {
             if (allFiles.has(file))
                 changedFiles.add(file);
@@ -1109,7 +1230,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         const explicitFileSet = new Set(explicitFiles);
         const explicitFilesCoverAllFiles = explicitFileSet.size === allFiles.size && [...allFiles].every((file) => explicitFileSet.has(file));
         const explicitFilesAreChangeInputs = !opts?.filesAreProjectScope;
-        if (explicitFileSet.size && explicitFilesAreChangeInputs && (!explicitFilesCoverAllFiles || report)) {
+        if (explicitFileSet.size && explicitFilesAreChangeInputs && (!explicitFilesCoverAllFiles || opts?.report)) {
             explicitFileSet.forEach(markAsChanged);
         }
         dependentFilesOfDeletedTracked.forEach(markAsChanged);
@@ -1119,7 +1240,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
             if (changedFiles.size || deletedTrackedFiles.size || manifestRequiresSanitization)
                 return null;
             const manifestEntryMap = new Map(Object.entries(trackedEntries));
-            const snapshotLoad = await tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEntryMap);
+            const snapshotLoad = await tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEntryMap, report);
             if (!snapshotLoad)
                 return null;
             const snapshot = snapshotLoad.index;
@@ -1199,10 +1320,12 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 })
                 : new Map();
             const fileSignatures = await prepareFileSignatures({
+                projectRoot,
                 files: Array.from(allFiles),
                 opts,
                 gitSigMap,
                 cacheEnabled,
+                needsContentHash: cacheEnabled || manifestUsed || opts?.cacheStrict === true,
                 concurrency: conc,
             });
             const modules = new Map();
@@ -1223,8 +1346,9 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                     changedFiles.add(file);
                 }
             }
+            const reverseDeps = buildTrackedFileReverseDependencies(trackedEntries);
             const invalidateCachedDependents = () => {
-                const dependentFilesOfChanged = collectTrackedFileDependents(trackedEntries, changedFiles);
+                const dependentFilesOfChanged = collectTrackedFileDependents(trackedEntries, changedFiles, reverseDeps);
                 for (const file of dependentFilesOfChanged) {
                     const key = fileIdentityKey(file);
                     if (modules.has(key)) {
@@ -1248,20 +1372,32 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 completeCheckProgress(allFiles.size);
                 return unchangedSnapshot;
             }
-            const persistedBloomFilters = bloomFilterCache ? await tryLoadPersistedBloomFilters(projectRoot, opts) : null;
+            const snapshotModules = cacheEnabled
+                ? await tryLoadProjectSnapshotModules(projectRoot, opts, fileSignatures, report)
+                : null;
+            const persistedBloomFilters = bloomFilterCache
+                ? await tryLoadPersistedBloomFilters(projectRoot, opts, report)
+                : null;
             for (const file of allFiles) {
                 if (changedFiles.has(file))
                     continue;
                 const sigInfo = fileSignatures.get(file);
-                const cacheSig = cacheEnabled ? await moduleCacheSignatureForFile(file, sigInfo, opts) : sigInfo.cacheSig;
-                const cached = cacheEnabled ? tryLoadFromCache(projectRoot, file, cacheSig, opts, report) : null;
+                let cached = null;
+                const snapshotMod = snapshotModules?.get(fileIdentityKey(file));
+                if (snapshotMod) {
+                    cached = snapshotMod;
+                }
+                else if (cacheEnabled) {
+                    const cacheSig = await moduleCacheSignatureForFile(file, sigInfo, opts, resolverEnvironmentFingerprint);
+                    cached = tryLoadFromCache(projectRoot, file, cacheSig, opts, report);
+                }
                 if (cached) {
                     if (fileReport)
                         fileReport.cached = (fileReport.cached ?? 0) + 1;
                     modules.set(fileIdentityKey(file), cached);
                     collectJsonDependencies(cached.imports, jsonDependencies);
                     if (bloomFilterCache) {
-                        const persistedFilter = persistedBloomFilters?.get(file);
+                        const persistedFilter = persistedBloomFilters?.get(file, sigInfo);
                         if (persistedFilter) {
                             bloomFilterCache.set(file, persistedFilter);
                         }
@@ -1312,8 +1448,9 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                             onFallbackImportExtraction,
                             fileSignatures,
                             cacheEnabled,
+                            ...(resolverEnvironmentFingerprint !== undefined ? { resolverEnvironmentFingerprint } : {}),
                         });
-                        return [file, built.module];
+                        return [file, built.module, built.cacheWrite];
                     }
                     catch (error) {
                         if (isNativeRequiredUnavailableError(error) || isNodeSqliteUnavailableError(error))
@@ -1323,7 +1460,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                         }
                         recordFileFailure(report, file, error);
                         logWithLevel(opts?.logLevel, "warn", `Warning: Failed to process file ${file}:`, error);
-                        return [file, createEmptyModuleIndex(file)];
+                        return [file, createEmptyModuleIndex(file), undefined];
                     }
                     finally {
                         if (opts?.onProgress) {
@@ -1338,8 +1475,14 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                         }
                     }
                 });
-                for (const [file, mod] of fileResults) {
+                const pendingIncrementalCacheWrites = [];
+                for (const [file, mod, cacheWrite] of fileResults) {
                     modules.set(fileIdentityKey(file), mod);
+                    if (cacheWrite)
+                        pendingIncrementalCacheWrites.push(cacheWrite);
+                }
+                if (pendingIncrementalCacheWrites.length) {
+                    writeModulesToCache(projectRoot, pendingIncrementalCacheWrites, opts);
                 }
                 if (timings)
                     timings.parseMs = Math.round(performance.now() - parseStart);
@@ -1349,7 +1492,9 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
             }
             expandStarImports(modules, opts);
             const retainedTrackedEntries = Object.entries(trackedEntries).filter(([file]) => !deletedTrackedFiles.has(file));
-            const cachedGraphEntries = new Map(retainedTrackedEntries);
+            const cachedGraphEntries = resolverEnvironmentMatchesManifest
+                ? new Map(retainedTrackedEntries)
+                : new Map();
             const manifestEntries = new Map(cachedGraphEntries);
             const baseGraph = cachedGraphEntries.size > 0 ? { nodes: new Set(), edges: [] } : undefined;
             if (baseGraph) {
@@ -1385,6 +1530,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                     dynamicImportHeuristics: !!graphOptions.dynamicImportHeuristics,
                     ...(opts?.native ? { native: opts.native } : {}),
                     ...(opts?.languageExtensions ? { languageExtensions: opts.languageExtensions } : {}),
+                    threads: conc,
                     ...(opts?.logLevel ? { logLevel: opts.logLevel } : {}),
                     ...(graphOptions.resolutionHints ? { resolutionHints: graphOptions.resolutionHints } : {}),
                     allFiles: Array.from(allFiles),
@@ -1402,10 +1548,21 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 });
             if (timings)
                 timings.graphMs = Math.round(performance.now() - graphStart);
+            for (const file of new Set([...changedFiles, ...transientFiles])) {
+                const signature = fileSignatures.get(file);
+                if (!signature || manifestEntries.has(file))
+                    continue;
+                manifestEntries.set(file, {
+                    sig: signature.sig,
+                    ...(signature.gitSig ? { gitSig: signature.gitSig } : {}),
+                    edges: [],
+                });
+            }
             await writeIndexManifestSnapshot({
                 projectRoot,
                 opts,
                 graphOptions,
+                ...(resolverEnvironmentFingerprint ? { resolverEnvironmentFingerprint } : {}),
                 files: manifestEntries,
                 timings,
                 manifestReport,
@@ -1422,10 +1579,20 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 modules,
                 parsedMap,
                 bloomFilterCache,
-                manifestEntries: projectIndexManifestEntries(manifestEntries),
+                manifestEntries: projectIndexManifestEntries(
+                // `manifestEntries` (a `ManifestFileEntry`) never carries `cacheSig` -- that field
+                // only lives on `FileSignature`. Overlay each entry with the `cacheSig` this build
+                // actually computed (content-hash-derived for non-git files, since caching is enabled
+                // whenever this path runs) so incremental writes preserve the same strong identity a
+                // cold build produces, instead of leaving snapshot/bloom reuse to fall back to the
+                // weak `mtime:size` `sig`.
+                Array.from(manifestEntries, ([file, entry]) => {
+                    const cacheSig = fileSignatures.get(file)?.cacheSig;
+                    return [file, { ...entry, ...(cacheSig ? { cacheSig } : {}) }];
+                })),
                 buildReport: report,
             });
-            await writeProjectIndexSnapshot(projectRoot, opts, index, projectSnapshotFilesSignature(manifestEntries));
+            await writeProjectIndexSnapshot(projectRoot, opts, index, projectSnapshotFilesSignature(manifestEntries, projectRoot));
             if (updateStartedAt !== undefined) {
                 emitIndexLifecycleProgress(opts, "complete", "update", index.byFile.size, performance.now() - updateStartedAt);
             }
@@ -1458,8 +1625,8 @@ export async function buildGraphDelta(projectRoot, opts) {
     const strictIncremental = opts?.incrementalStrict ?? false;
     if (strictIncremental && graphOptions.fast)
         graphOptions.fast = false;
-    const explicitFiles = normalizeIndexedFileInputs(projectRoot, opts?.files ?? [], "Graph delta file");
-    const additionalFiles = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional graph delta file");
+    const explicitFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.files ?? [], "Graph delta file");
+    const additionalFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional graph delta file");
     const needsGitScan = !!opts?.gitBase || !!opts?.changedSince;
     const gitFiles = needsGitScan ? await listChangedFiles(projectRoot, buildIncrementalGitDiffOptions(opts)) : [];
     const { trackedFiles } = await partitionTrackedManifestFiles(trackedEntries);
@@ -1484,14 +1651,19 @@ export async function buildGraphDelta(projectRoot, opts) {
     }
     const candidateExistence = await probePathExistence([...explicitFiles, ...additionalFiles, ...manifestDiffFiles, ...gitFiles], buildConcurrency(opts));
     const existsInCandidateSnapshot = (file) => candidateExistence.get(file) ?? false;
-    const existingExplicitFiles = explicitFiles.filter(existsInCandidateSnapshot);
+    const normalizeChangedFiles = (files) => files.map((file) => {
+        if (!existsInCandidateSnapshot(file))
+            return file;
+        const [normalizedFile] = normalizeIndexedFileInputs(projectRoot, [file], "Graph delta file");
+        return normalizedFile ?? file;
+    }), normalizedManifestDiffFiles = normalizeChangedFiles(manifestDiffFiles), normalizedGitFiles = normalizeChangedFiles(gitFiles), existingExplicitFiles = explicitFiles.filter(existsInCandidateSnapshot);
     const existingAdditionalFiles = additionalFiles.filter(existsInCandidateSnapshot);
     const allFiles = new Set([
         ...trackedFiles,
         ...existingExplicitFiles,
         ...existingAdditionalFiles,
-        ...manifestDiffFiles.filter(existsInCandidateSnapshot),
-        ...gitFiles.filter(existsInCandidateSnapshot),
+        ...normalizedManifestDiffFiles.filter((_, index) => existsInCandidateSnapshot(manifestDiffFiles[index])),
+        ...normalizedGitFiles.filter((_, index) => existsInCandidateSnapshot(gitFiles[index])),
     ]);
     const changedFiles = new Set();
     const changedFileKeys = new Set();
@@ -1503,8 +1675,8 @@ export async function buildGraphDelta(projectRoot, opts) {
         changedFiles.add(file);
     };
     existingExplicitFiles.forEach(addChangedFile);
-    manifestDiffFiles.forEach(addChangedFile);
-    gitFiles.forEach(addChangedFile);
+    normalizedManifestDiffFiles.forEach(addChangedFile);
+    normalizedGitFiles.forEach(addChangedFile);
     if (languageExtensionsChanged) {
         for (const file of trackedFiles) {
             if (languageSupportChangedForFile(file))