@lzehrung/codegraph 2.1.1 → 2.1.2

package/dist/indexer/build-index.js

@@ -4,12 +4,14 @@ import fsp from "node:fs/promises";
 import path from "node:path";
 import { performance } from "node:perf_hooks";
 import { languageExtensionPatterns, supportForFile } from "../languages.js";
+import { isJsTsLanguage } from "../languages/js-family.js";
 import { loadWorkspaceConfig, resolveWorkspacePackage } from "../util/workspace.js";
 import { DEFAULT_PROJECT_PATTERNS, discoverProjectFiles, listProjectFiles, } from "../util/projectFiles.js";
 import { getGitHead, isGitRepo, getGitBlobHashes, listChangedFiles } from "../util/git.js";
-import { clearImportResolutionCaches, resolveSpecifier } from "../util/resolution.js";
+import { clearResolutionCaches, resolveSpecifier } from "../util/resolution.js";
 import { assertFilePathWithinRoot, fileIdentityKey, initializeFileIdentityCaseSensitivity, isFilePathWithinRoot, normalizePath, } from "../util/paths.js";
 import { mapLimit } from "../util/concurrency.js";
+import { readConfinedUtf8File } from "../util/confinedFile.js";
 import { resolveWorkerThreadCount } from "../util/workerThreads.js";
 import { logWithLevel } from "../logging.js";
 import { collectGraph } from "../graph-builder.js";
@@ -26,7 +28,7 @@ import { initNativeBackendReport } from "../native/nativeBackendReport.js";
 import { closeDuplicateUnitCacheDatabase } from "../duplicates.js";
 import { isNativeRequiredUnavailableError } from "../native/treeSitterNative.js";
 import { isNodeSqliteUnavailableError } from "../sqlite-driver.js";
-import { buildBloomFilterForFile, cacheSignatureForFile, closeDiskCacheDatabase, collectWorkspaceManifestDependencyEdges, computeConfigHash, createFallbackImportExtractionHandler, diffBuildOptions, fileSignature, graphOptionsEqual, initFileReport, initManifestReport, loadManifest, normalizeGraphOptions, normalizeIndexedFileInputs, normalizeLanguageExtensions, projectSnapshotFilesSignature, recordConfigHashResult, recordFileFailure, sanitizeManifestEntriesForRoot, sanitizeManifestTransientFilesForRoot, tryLoadFromCache, tryLoadPersistedBloomFilters, tryLoadProjectIndexSnapshot, tryLoadProjectSnapshotModules, verifyManifestEntries, writeModulesToCache, writeProjectIndexSnapshot, writeToCache, } from "./build-cache.js";
+import { buildBloomFilterForFile, cacheSignatureForFile, closeDiskCacheDatabase, collectWorkspaceManifestDependencyEdges, computeConfigHash, createFallbackImportExtractionHandler, diffBuildOptions, fileSignature, fileSignatureFromSource, graphOptionsEqual, initFileReport, initManifestReport, loadManifest, normalizeGraphOptions, normalizeIndexedFileInputs, normalizeIndexedFileInputsWithinRoot, normalizeLanguageExtensions, projectSnapshotFilesSignature, recordConfigHashResult, recordFileFailure, sanitizeManifestEntriesForRoot, sanitizeManifestTransientFilesForRoot, tryLoadFromCache, tryLoadPersistedBloomFilters, tryLoadProjectIndexSnapshot, tryLoadProjectSnapshotModules, verifyManifestEntries, writeModulesToCache, writeProjectIndexSnapshot, writeToCache, } from "./build-cache.js";
 import { computeResolverEnvironmentFingerprint } from "./build-cache/resolver-environment.js";
 import { cacheRoot } from "./build-cache/location.js";
 import { SymbolKind, } from "./types.js";
@@ -36,7 +38,7 @@ import { buildSqlFactCache, buildSqlModuleIndex, sqlCorpusSignature } from "../s
 import { finalizeProjectIndex } from "./finalize.js";
 import { toManifestFileEntry, writeIndexManifestSnapshot } from "./build-manifest.js";
 import { prepareFileContextForBuild, setupWorkerPool, teardownWorkerPool, } from "./build-workers.js";
-import { buildIncrementalGitDiffOptions, canUseIncrementalDiscoveryFastPath, collectDeletedTrackedFileDependents, collectTrackedFileDependents, isMissingGitRevisionError, listUntrackedProjectFiles, partitionTrackedManifestFiles, probePathExistence, } from "./incremental-plan.js";
+import { buildIncrementalGitDiffOptions, canUseIncrementalDiscoveryFastPath, buildTrackedFileReverseDependencies, collectDeletedTrackedFileDependents, collectTrackedFileDependents, isMissingGitRevisionError, listUntrackedProjectFiles, partitionTrackedManifestFiles, probePathExistence, } from "./incremental-plan.js";
 import { parsedCacheMaxEntries, setParsedCacheEntry } from "./parsed-cache.js";
 function initParserBackendDegradationReport(report) {
     if (!report)
@@ -75,13 +77,17 @@ function recordParserBackendDegradation(report, entry) {
         return;
     parserReport.files.push(entry);
 }
+function isConfinedFileReadError(error) {
+    return (error instanceof Error &&
+        /outside project root|possible path confinement race|changed between verification and open|confined file target/u.test(error.message));
+}
 function createEmptyModuleIndex(file) {
     return { file, exports: [], imports: [], locals: [] };
 }
 async function resolveCrossModuleSymbolExports(file, mod, support, projectRoot, graphOptions, workspaceConfig, logLevel) {
     if (!support.supportsCrossModuleSymbols)
         return;
-    if (support.id !== "ts" && support.id !== "js")
+    if (!isJsTsLanguage(support.id))
         return;
     const { matchPath } = await import("../util/resolution.js").then((mod) => mod.loadNearestTsconfigFor(file, projectRoot, logLevel));
     for (const entry of mod.exports) {
@@ -107,11 +113,12 @@ async function resolveCrossModuleSymbolExports(file, mod, support, projectRoot,
     }
 }
 async function buildIndexedModuleForFile(args) {
-    const prepared = await prepareFileContextForBuild(args.file, args.support, args.opts, args.workerSetup, args.report);
+    const prepared = await prepareFileContextForBuild(args.file, args.support, args.opts, args.workerSetup, args.report, args.confinedRoot, args.projectRoot, args.trustedSource);
     const { source, sup, nativeQueries, embeddedBlocks } = prepared;
     let resolvedLang = prepared.lang;
     let tree;
-    const graphOnlyLanguage = isGraphOnlyLanguage(sup.id);
+    const graphOnlyLanguage = isGraphOnlyLanguage(sup.id), nativeSourceLimitFallback = prepared.nativeFallbackReason === "queryFailure" &&
+        !!prepared.nativeError?.startsWith("source exceeds native byte limit");
     if (prepared.syntaxTree) {
         const parsedTree = new ProjectedSyntaxTree(source, prepared.syntaxTree);
         tree = parsedTree;
@@ -124,7 +131,7 @@ async function buildIndexedModuleForFile(args) {
             nativeQueries,
         }, args.parsedCacheMaxEntries);
     }
-    else if (!nativeQueries && !graphOnlyLanguage && sup.id !== "sql") {
+    else if (!nativeQueries && !graphOnlyLanguage && sup.id !== "sql" && !nativeSourceLimitFallback) {
         const parseAttempt = attemptParsePreparedFileContext(prepared);
         const parsed = parseAttempt.parsed;
         if (parsed) {
@@ -153,7 +160,7 @@ async function buildIndexedModuleForFile(args) {
         }
     }
     const lacksParserContext = !nativeQueries && !tree;
-    if (args.bloomFilterCache) {
+    if (args.bloomFilterCache && !nativeSourceLimitFallback) {
         const filter = buildBloomFilterFromSource(source, sup);
         args.bloomFilterCache.set(args.file, filter);
     }
@@ -166,7 +173,7 @@ async function buildIndexedModuleForFile(args) {
         ...(args.opts?.languageExtensions ? { languageExtensions: args.opts.languageExtensions } : {}),
         ...(args.onFallbackImportExtraction ? { onFallbackImportExtraction: args.onFallbackImportExtraction } : {}),
     };
-    const imports = sup.id === "sql"
+    const imports = nativeSourceLimitFallback || sup.id === "sql"
         ? []
         : await collectImportsForFile(args.file, args.projectRoot, {
             source,
@@ -362,9 +369,8 @@ function projectIndexManifestEntries(entries) {
     return new Map(Array.from(entries, ([file, entry]) => [file, toProjectIndexManifestEntry(entry)]));
 }
 function createIndexBuildRunState(projectRoot, opts, graphOptions = normalizeGraphOptions(opts?.graph)) {
-    const report = opts?.report;
-    if (report)
-        initNativeBackendReport(report);
+    const report = opts?.report ?? { timings: {} };
+    initNativeBackendReport(report);
     const cacheMode = opts?.cache ?? "off";
     return {
         normalizedProjectRoot: normalizePath(path.resolve(projectRoot)),
@@ -399,6 +405,13 @@ function buildConcurrency(opts) {
 async function prepareFileSignatures(args) {
     const entries = await mapLimit(args.files, args.concurrency, async (file) => {
         const gitSig = args.gitSigMap.get(file);
+        const source = args.confinedRoot
+            ? await readConfinedUtf8File(args.confinedRoot, args.projectRoot, file)
+            : undefined;
+        if (source !== undefined) {
+            args.trustedSources?.set(file, source);
+            return [file, fileSignatureFromSource(source, gitSig)];
+        }
         const sigInfo = await fileSignature(file, args.needsContentHash ? args.opts?.cacheStrict : false, gitSig, {
             forceContentHash: args.cacheEnabled && !gitSig,
         });
@@ -410,7 +423,7 @@ async function buildProjectIndexFromExport(projectRoot, opts, helperOpts) {
     return buildProjectIndexWithManifestOptions(projectRoot, opts, helperOpts);
 }
 async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperOpts) {
-    clearImportResolutionCaches();
+    clearResolutionCaches();
     await initializeFileIdentityCaseSensitivity(projectRoot);
     const { normalizedProjectRoot, report, timings, totalStart, cacheMode, cacheEnabled, graphOptions, onFallbackImportExtraction, } = createIndexBuildRunState(projectRoot, opts);
     const manifestMode = helperOpts?.manifestMode ?? "off";
@@ -418,7 +431,11 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     const shouldWriteManifest = manifestMode === "read-write";
     const projectFiles = helperOpts?.projectFiles;
     initManifestReport(report, useManifest, false);
-    const normalizedFiles = Array.from(new Set(normalizeIndexedFileInputs(projectRoot, rawFiles ?? [], "Index file")));
+    const confinedRoot = helperOpts?.confineReads ? await fsp.realpath(projectRoot) : undefined;
+    const [trustedSources, normalizedFiles] = [
+        confinedRoot ? new Map() : undefined,
+        Array.from(new Set(normalizeIndexedFileInputs(projectRoot, rawFiles ?? [], "Index file"))),
+    ];
     if (!normalizedFiles.length && helperOpts?.warnNoFilesMessage) {
         logWithLevel(opts?.logLevel, "warn", helperOpts.warnNoFilesMessage);
     }
@@ -426,7 +443,7 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     if (fileReport)
         fileReport.total = normalizedFiles.length;
     const manifestStart = performance.now();
-    const manifest = useManifest && !helperOpts?.ignoreExistingManifest ? await loadManifest(projectRoot, opts) : null;
+    const manifest = useManifest && !helperOpts?.ignoreExistingManifest ? await loadManifest(projectRoot, opts, report) : null;
     const manifestFiles = sanitizeManifestEntriesForRoot(projectRoot, manifest?.files);
     const manifestOptionDiffs = manifest ? diffBuildOptions(manifest.buildOptions, opts) : [];
     const languageExtensionsChanged = manifestOptionDiffs.includes("languageExtensions");
@@ -468,10 +485,10 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
         graphOptionsEqual(manifest.graphOptions, graphOptions)
         ? new Map(Object.entries(manifestFiles).filter(([file]) => !staleCachedEdgeFiles.has(file)))
         : undefined;
+    const manifestEntries = shouldWriteManifest ? new Map() : undefined;
     if (report?.manifest) {
         report.manifest.reused = !!cachedGraphEntries;
     }
-    const manifestEntries = shouldWriteManifest ? new Map() : undefined;
     const manifestEntriesForIndex = useManifest
         ? projectIndexManifestEntries(cachedGraphEntries ?? [])
         : new Map();
@@ -494,12 +511,14 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     })
         .sort((left, right) => left.localeCompare(right));
     const fileSignatures = await prepareFileSignatures({
+        projectRoot,
         files: sqlFiles,
         opts,
         gitSigMap,
         cacheEnabled,
         needsContentHash: true,
         concurrency: conc,
+        ...(confinedRoot ? { confinedRoot, trustedSources } : {}),
     });
     const sqlCorpusSig = sqlCorpusSignature(sqlFiles, fileSignatures);
     let sqlFactCachePromise;
@@ -522,7 +541,9 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
         const bloomFilterCache = useBloomFilters
             ? new (await import("../util/bloomFilter.js")).BloomFilterCache()
             : undefined;
-        const persistedBloomFilters = bloomFilterCache ? await tryLoadPersistedBloomFilters(projectRoot, opts) : null;
+        const persistedBloomFilters = bloomFilterCache
+            ? await tryLoadPersistedBloomFilters(projectRoot, opts, report)
+            : null;
         const parsedMap = new Map();
         const workspaceConfig = await loadWorkspaceConfig(projectRoot);
         const parseStart = performance.now();
@@ -549,9 +570,16 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                 let sigInfo = fileSignatures.get(file);
                 if (!sigInfo) {
                     const gitSig = gitSigMap.get(file);
-                    sigInfo = await fileSignature(file, opts?.cacheStrict, gitSig, {
-                        forceContentHash: cacheEnabled && !gitSig,
-                    });
+                    const source = confinedRoot ? await readConfinedUtf8File(confinedRoot, projectRoot, file) : undefined;
+                    if (source !== undefined) {
+                        trustedSources?.set(file, source);
+                        sigInfo = fileSignatureFromSource(source, gitSig);
+                    }
+                    else {
+                        sigInfo = await fileSignature(file, opts?.cacheStrict, gitSig, {
+                            forceContentHash: cacheEnabled && !gitSig,
+                        });
+                    }
                     fileSignatures.set(file, sigInfo);
                 }
                 manifestEntriesForIndex.set(file, toProjectIndexManifestEntry(sigInfo));
@@ -638,6 +666,7 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                         onFallbackImportExtraction,
                         fileSignatures,
                         cacheEnabled,
+                        ...(confinedRoot ? { confinedRoot, trustedSource: trustedSources?.get(file) } : {}),
                     });
                     mod = built.module;
                     graphContext = built.graphContext;
@@ -672,6 +701,8 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
             catch (error) {
                 if (isNativeRequiredUnavailableError(error) || isNodeSqliteUnavailableError(error))
                     throw error;
+                if (isConfinedFileReadError(error))
+                    throw error;
                 if (isUnsupportedParserInputError(error) || isNonNativeParserUnavailableError(error)) {
                     return [file, createEmptyModuleIndex(file), [], undefined];
                 }
@@ -728,6 +759,17 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
             ensureJsonModule(modules, jsonPath);
         }
         expandStarImports(modules, opts);
+        if (manifestEntries) {
+            for (const [file, signature] of fileSignatures) {
+                if (manifestEntries.has(file))
+                    continue;
+                manifestEntries.set(file, {
+                    sig: signature.sig,
+                    ...(signature.gitSig ? { gitSig: signature.gitSig } : {}),
+                    edges: [],
+                });
+            }
+        }
         if (manifestEntries) {
             await writeIndexManifestSnapshot({
                 projectRoot,
@@ -741,6 +783,12 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                 ...(helperOpts?.symlinkDirectories !== undefined ? { symlinkDirectories: helperOpts.symlinkDirectories } : {}),
             });
         }
+        const indexManifestEntries = manifestEntries
+            ? projectIndexManifestEntries(Array.from(manifestEntries, ([file, entry]) => {
+                const cacheSig = fileSignatures.get(file)?.cacheSig;
+                return [file, { ...entry, ...(cacheSig ? { cacheSig } : {}) }];
+            }))
+            : manifestEntriesForIndex;
         const index = await finalizeProjectIndex({
             projectRoot,
             normalizedProjectRoot,
@@ -753,7 +801,7 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
             bloomFilterCache,
             ...(projectFiles !== undefined ? { projectFiles } : {}),
             buildReport: report,
-            manifestEntries: manifestEntriesForIndex,
+            manifestEntries: indexManifestEntries,
         });
         if (manifestEntries) {
             await writeProjectIndexSnapshot(projectRoot, opts, index, projectSnapshotFilesSignature(manifestEntries, projectRoot));
@@ -776,34 +824,29 @@ async function buildProjectIndexWithManifestOptions(projectRoot, opts, helperOpt
         // full-tree symlink probe. Off and memory modes never read or write this disk
         // manifest, keeping read-only builds from mutating the project root. A missing or
         // unusable manifest falls back to probing once.
-        // A symlink hint never expires on its own: `knownSymlinkDirectories` disables probing entirely, so
-        // a directory symlinked in after the hint was recorded (e.g. `npm link`) would
-        // otherwise never be discovered. `--cache-strict`/`--cache-verify` are explicit asks
-        // for maximum correctness over speed, so both force a fresh probe here too.
+        // The manifest records the project-root directory mtime alongside symlink hints. A changed
+        // root mtime triggers the cheap full-tree probe, while strict modes always probe.
         const wantsMaxSymlinkCorrectness = !!opts?.cacheStrict || !!opts?.cacheVerify;
         const symlinkHintManifest = helperOpts?.ignoreExistingManifest || wantsMaxSymlinkCorrectness || !useDiskCache
             ? null
             : await loadManifest(projectRoot, opts);
-        const knownSymlinkDirectories = symlinkHintManifest?.symlinkDirectories;
+        const rootMtime = symlinkHintManifest ? (await fsp.stat(projectRoot)).mtimeMs : undefined;
+        const symlinkHintIsFresh = symlinkHintManifest?.symlinkDirectoriesRootMtimeMs !== undefined &&
+            rootMtime === symlinkHintManifest.symlinkDirectoriesRootMtimeMs;
+        const knownSymlinkDirectories = symlinkHintIsFresh ? symlinkHintManifest?.symlinkDirectories : undefined;
         let discoveredSymlinkDirectories = knownSymlinkDirectories;
         const onSymlinkDirectoriesDiscovered = (directories) => {
             discoveredSymlinkDirectories = Array.from(directories);
         };
         // When the hint is unknown, listProjectFiles() and discoverProjectFiles() must run
-        // sequentially rather than in Promise.all: both would otherwise start their own
-        // full-tree symlink probe concurrently, since the callback only reports back after
-        // listProjectFiles() resolves, too late to inform a probe discoverProjectFiles()
-        // already started on its own. Sequencing costs a little parallelism on that one
-        // cold-start case, but avoids paying for two full-tree walks instead of one. Once a
-        // hint is known (the common warm case), both calls skip probing entirely, so running
-        // them sequentially here costs no meaningful time either way.
+        // sequentially rather than in Promise.all to avoid duplicate full-tree probes.
         const discoveredFiles = await listProjectFiles(projectRoot, projectPatternsForLanguageExtensions(opts), {
             ...opts?.discovery,
             ...(opts?.logLevel ? { logLevel: opts.logLevel } : {}),
             ...(knownSymlinkDirectories !== undefined ? { knownSymlinkDirectories } : {}),
             onSymlinkDirectoriesDiscovered,
         });
-        const additionalFileCandidates = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
+        const additionalFileCandidates = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
         const additionalFileExistence = await probePathExistence(additionalFileCandidates, buildConcurrency(opts));
         const additionalFiles = additionalFileCandidates.filter((file) => additionalFileExistence.get(file));
         const discoveredFileSet = new Set(discoveredFiles);
@@ -850,9 +893,11 @@ export async function buildProjectIndex(projectRoot, opts) {
 export async function buildProjectIndexFromFiles(projectRoot, inputFiles, opts) {
     try {
         const useDiskCache = (opts?.cache ?? "off") === "disk";
-        return await buildIndexFromFileListShared(projectRoot, inputFiles, opts, {
+        const normalizedInputFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, inputFiles, "Index file");
+        return await buildIndexFromFileListShared(projectRoot, normalizedInputFiles, opts, {
             manifestMode: useDiskCache ? "read-only" : "off",
             warnNoFilesMessage: `Warning: No files provided for indexing in ${projectRoot}. Check the explicit file list and include/ignore filters. Diagnostic: codegraph doctor`,
+            confineReads: true,
         });
     }
     finally {
@@ -893,7 +938,7 @@ async function buildDeclaredScopeIndex(projectRoot, scopeFiles, opts) {
  */
 export async function buildProjectIndexIncremental(projectRoot, opts) {
     await initializeFileIdentityCaseSensitivity(projectRoot);
-    clearImportResolutionCaches();
+    clearResolutionCaches();
     const graphOptions = normalizeGraphOptions(opts?.graph);
     const strictIncremental = opts?.incrementalStrict ?? false;
     if (strictIncremental && graphOptions.fast)
@@ -944,7 +989,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         }
         startCheckProgress();
         const manifestStart = performance.now();
-        const manifest = await loadManifest(projectRoot, opts);
+        const manifest = await loadManifest(projectRoot, opts, report);
         if (timings)
             timings.manifestMs = Math.round(performance.now() - manifestStart);
         const manifestUsed = !!manifest;
@@ -1050,8 +1095,8 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         const trackedEntryKeys = Object.keys(trackedEntries);
         let manifestRequiresSanitization = manifestFileKeys.length !== trackedEntryKeys.length ||
             manifestFileKeys.some((file) => !Object.hasOwn(trackedEntries, file));
-        const explicitFiles = normalizeIndexedFileInputs(projectRoot, opts?.files ?? [], "Incremental file");
-        const additionalFiles = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
+        const explicitFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.files ?? [], "Incremental file");
+        const additionalFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
         const previousTransientFiles = sanitizeManifestTransientFilesForRoot(projectRoot, projectRoot, manifest.transientFiles).filter((file) => Object.hasOwn(trackedEntries, file));
         const previousTransientFileSet = new Set(previousTransientFiles);
         const needsGitScan = !!opts?.gitBase || !!opts?.changedSince;
@@ -1185,7 +1230,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         const explicitFileSet = new Set(explicitFiles);
         const explicitFilesCoverAllFiles = explicitFileSet.size === allFiles.size && [...allFiles].every((file) => explicitFileSet.has(file));
         const explicitFilesAreChangeInputs = !opts?.filesAreProjectScope;
-        if (explicitFileSet.size && explicitFilesAreChangeInputs && (!explicitFilesCoverAllFiles || report)) {
+        if (explicitFileSet.size && explicitFilesAreChangeInputs && (!explicitFilesCoverAllFiles || opts?.report)) {
             explicitFileSet.forEach(markAsChanged);
         }
         dependentFilesOfDeletedTracked.forEach(markAsChanged);
@@ -1195,7 +1240,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
             if (changedFiles.size || deletedTrackedFiles.size || manifestRequiresSanitization)
                 return null;
             const manifestEntryMap = new Map(Object.entries(trackedEntries));
-            const snapshotLoad = await tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEntryMap);
+            const snapshotLoad = await tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEntryMap, report);
             if (!snapshotLoad)
                 return null;
             const snapshot = snapshotLoad.index;
@@ -1275,6 +1320,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 })
                 : new Map();
             const fileSignatures = await prepareFileSignatures({
+                projectRoot,
                 files: Array.from(allFiles),
                 opts,
                 gitSigMap,
@@ -1300,8 +1346,9 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                     changedFiles.add(file);
                 }
             }
+            const reverseDeps = buildTrackedFileReverseDependencies(trackedEntries);
             const invalidateCachedDependents = () => {
-                const dependentFilesOfChanged = collectTrackedFileDependents(trackedEntries, changedFiles);
+                const dependentFilesOfChanged = collectTrackedFileDependents(trackedEntries, changedFiles, reverseDeps);
                 for (const file of dependentFilesOfChanged) {
                     const key = fileIdentityKey(file);
                     if (modules.has(key)) {
@@ -1326,9 +1373,11 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 return unchangedSnapshot;
             }
             const snapshotModules = cacheEnabled
-                ? await tryLoadProjectSnapshotModules(projectRoot, opts, fileSignatures)
+                ? await tryLoadProjectSnapshotModules(projectRoot, opts, fileSignatures, report)
+                : null;
+            const persistedBloomFilters = bloomFilterCache
+                ? await tryLoadPersistedBloomFilters(projectRoot, opts, report)
                 : null;
-            const persistedBloomFilters = bloomFilterCache ? await tryLoadPersistedBloomFilters(projectRoot, opts) : null;
             for (const file of allFiles) {
                 if (changedFiles.has(file))
                     continue;
@@ -1481,6 +1530,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                     dynamicImportHeuristics: !!graphOptions.dynamicImportHeuristics,
                     ...(opts?.native ? { native: opts.native } : {}),
                     ...(opts?.languageExtensions ? { languageExtensions: opts.languageExtensions } : {}),
+                    threads: conc,
                     ...(opts?.logLevel ? { logLevel: opts.logLevel } : {}),
                     ...(graphOptions.resolutionHints ? { resolutionHints: graphOptions.resolutionHints } : {}),
                     allFiles: Array.from(allFiles),
@@ -1498,6 +1548,16 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 });
             if (timings)
                 timings.graphMs = Math.round(performance.now() - graphStart);
+            for (const file of new Set([...changedFiles, ...transientFiles])) {
+                const signature = fileSignatures.get(file);
+                if (!signature || manifestEntries.has(file))
+                    continue;
+                manifestEntries.set(file, {
+                    sig: signature.sig,
+                    ...(signature.gitSig ? { gitSig: signature.gitSig } : {}),
+                    edges: [],
+                });
+            }
             await writeIndexManifestSnapshot({
                 projectRoot,
                 opts,
@@ -1565,8 +1625,8 @@ export async function buildGraphDelta(projectRoot, opts) {
     const strictIncremental = opts?.incrementalStrict ?? false;
     if (strictIncremental && graphOptions.fast)
         graphOptions.fast = false;
-    const explicitFiles = normalizeIndexedFileInputs(projectRoot, opts?.files ?? [], "Graph delta file");
-    const additionalFiles = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional graph delta file");
+    const explicitFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.files ?? [], "Graph delta file");
+    const additionalFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional graph delta file");
     const needsGitScan = !!opts?.gitBase || !!opts?.changedSince;
     const gitFiles = needsGitScan ? await listChangedFiles(projectRoot, buildIncrementalGitDiffOptions(opts)) : [];
     const { trackedFiles } = await partitionTrackedManifestFiles(trackedEntries);
@@ -1591,14 +1651,19 @@ export async function buildGraphDelta(projectRoot, opts) {
     }
     const candidateExistence = await probePathExistence([...explicitFiles, ...additionalFiles, ...manifestDiffFiles, ...gitFiles], buildConcurrency(opts));
     const existsInCandidateSnapshot = (file) => candidateExistence.get(file) ?? false;
-    const existingExplicitFiles = explicitFiles.filter(existsInCandidateSnapshot);
+    const normalizeChangedFiles = (files) => files.map((file) => {
+        if (!existsInCandidateSnapshot(file))
+            return file;
+        const [normalizedFile] = normalizeIndexedFileInputs(projectRoot, [file], "Graph delta file");
+        return normalizedFile ?? file;
+    }), normalizedManifestDiffFiles = normalizeChangedFiles(manifestDiffFiles), normalizedGitFiles = normalizeChangedFiles(gitFiles), existingExplicitFiles = explicitFiles.filter(existsInCandidateSnapshot);
     const existingAdditionalFiles = additionalFiles.filter(existsInCandidateSnapshot);
     const allFiles = new Set([
         ...trackedFiles,
         ...existingExplicitFiles,
         ...existingAdditionalFiles,
-        ...manifestDiffFiles.filter(existsInCandidateSnapshot),
-        ...gitFiles.filter(existsInCandidateSnapshot),
+        ...normalizedManifestDiffFiles.filter((_, index) => existsInCandidateSnapshot(manifestDiffFiles[index])),
+        ...normalizedGitFiles.filter((_, index) => existsInCandidateSnapshot(gitFiles[index])),
     ]);
     const changedFiles = new Set();
     const changedFileKeys = new Set();
@@ -1610,8 +1675,8 @@ export async function buildGraphDelta(projectRoot, opts) {
         changedFiles.add(file);
     };
     existingExplicitFiles.forEach(addChangedFile);
-    manifestDiffFiles.forEach(addChangedFile);
-    gitFiles.forEach(addChangedFile);
+    normalizedManifestDiffFiles.forEach(addChangedFile);
+    normalizedGitFiles.forEach(addChangedFile);
     if (languageExtensionsChanged) {
         for (const file of trackedFiles) {
             if (languageSupportChangedForFile(file))