@lzehrung/codegraph 2.1.1 → 2.2.0

package/dist/indexer/build-index.js

@@ -4,12 +4,14 @@ import fsp from "node:fs/promises";
 import path from "node:path";
 import { performance } from "node:perf_hooks";
 import { languageExtensionPatterns, supportForFile } from "../languages.js";
+import { isJsTsLanguage } from "../languages/js-family.js";
 import { loadWorkspaceConfig, resolveWorkspacePackage } from "../util/workspace.js";
 import { DEFAULT_PROJECT_PATTERNS, discoverProjectFiles, listProjectFiles, } from "../util/projectFiles.js";
 import { getGitHead, isGitRepo, getGitBlobHashes, listChangedFiles } from "../util/git.js";
-import { clearImportResolutionCaches, resolveSpecifier } from "../util/resolution.js";
-import { assertFilePathWithinRoot, fileIdentityKey, initializeFileIdentityCaseSensitivity, isFilePathWithinRoot, normalizePath, } from "../util/paths.js";
+import { clearResolutionCaches, resolveSpecifier } from "../util/resolution.js";
+import { fileIdentityKey, initializeFileIdentityCaseSensitivity, isFilePathWithinRoot, normalizePath, } from "../util/paths.js";
 import { mapLimit } from "../util/concurrency.js";
+import { readConfinedUtf8File } from "../util/confinedFile.js";
 import { resolveWorkerThreadCount } from "../util/workerThreads.js";
 import { logWithLevel } from "../logging.js";
 import { collectGraph } from "../graph-builder.js";
@@ -26,17 +28,16 @@ import { initNativeBackendReport } from "../native/nativeBackendReport.js";
 import { closeDuplicateUnitCacheDatabase } from "../duplicates.js";
 import { isNativeRequiredUnavailableError } from "../native/treeSitterNative.js";
 import { isNodeSqliteUnavailableError } from "../sqlite-driver.js";
-import { buildBloomFilterForFile, cacheSignatureForFile, closeDiskCacheDatabase, collectWorkspaceManifestDependencyEdges, computeConfigHash, createFallbackImportExtractionHandler, diffBuildOptions, fileSignature, graphOptionsEqual, initFileReport, initManifestReport, loadManifest, normalizeGraphOptions, normalizeIndexedFileInputs, normalizeLanguageExtensions, projectSnapshotFilesSignature, recordConfigHashResult, recordFileFailure, sanitizeManifestEntriesForRoot, sanitizeManifestTransientFilesForRoot, tryLoadFromCache, tryLoadPersistedBloomFilters, tryLoadProjectIndexSnapshot, tryLoadProjectSnapshotModules, verifyManifestEntries, writeModulesToCache, writeProjectIndexSnapshot, writeToCache, } from "./build-cache.js";
+import { buildBloomFilterForFile, cacheSignatureForFile, closeDiskCacheDatabase, collectWorkspaceManifestDependencyEdges, computeConfigHash, createFallbackImportExtractionHandler, diffBuildOptions, fileSignature, fileSignatureFromSource, graphOptionsEqual, initFileReport, initManifestReport, loadManifest, normalizeGraphOptions, normalizeIndexedFileInputs, normalizeIndexedFileInputsWithinRoot, normalizeLanguageExtensions, projectSnapshotFilesSignature, recordConfigHashResult, recordFileFailure, sanitizeManifestEntriesForRoot, sanitizeManifestTransientFilesForRoot, tryLoadFromCache, tryLoadPersistedBloomFilters, tryLoadProjectIndexSnapshot, tryLoadProjectSnapshotModules, verifyManifestEntries, writeModulesToCache, writeProjectIndexSnapshot, } from "./build-cache.js";
 import { computeResolverEnvironmentFingerprint } from "./build-cache/resolver-environment.js";
 import { cacheRoot } from "./build-cache/location.js";
 import { SymbolKind, } from "./types.js";
-import { isNonNativeParserUnavailableError, isParserSyntaxTree } from "../parserBackend.js";
 import { isUnsupportedParserInputError } from "../languages/filePrep.js";
 import { buildSqlFactCache, buildSqlModuleIndex, sqlCorpusSignature } from "../sql/sourceGraph.js";
 import { finalizeProjectIndex } from "./finalize.js";
 import { toManifestFileEntry, writeIndexManifestSnapshot } from "./build-manifest.js";
-import { prepareFileContextForBuild, setupWorkerPool, teardownWorkerPool, } from "./build-workers.js";
-import { buildIncrementalGitDiffOptions, canUseIncrementalDiscoveryFastPath, collectDeletedTrackedFileDependents, collectTrackedFileDependents, isMissingGitRevisionError, listUntrackedProjectFiles, partitionTrackedManifestFiles, probePathExistence, } from "./incremental-plan.js";
+import { prepareFileContextForBuild, countNativeWorkerEligibleFiles, emptyWorkerPoolSetup, setupWorkerPool, teardownWorkerPool, } from "./build-workers.js";
+import { buildIncrementalGitDiffOptions, canUseIncrementalDiscoveryFastPath, buildTrackedFileReverseDependencies, collectDeletedTrackedFileDependents, collectTrackedFileDependents, isMissingGitRevisionError, listUntrackedProjectFiles, partitionTrackedManifestFiles, probePathExistence, } from "./incremental-plan.js";
 import { parsedCacheMaxEntries, setParsedCacheEntry } from "./parsed-cache.js";
 function initParserBackendDegradationReport(report) {
     if (!report)
@@ -75,13 +76,17 @@ function recordParserBackendDegradation(report, entry) {
         return;
     parserReport.files.push(entry);
 }
+function isConfinedFileReadError(error) {
+    return (error instanceof Error &&
+        /outside project root|possible path confinement race|changed between verification and open|confined file target/u.test(error.message));
+}
 function createEmptyModuleIndex(file) {
     return { file, exports: [], imports: [], locals: [] };
 }
 async function resolveCrossModuleSymbolExports(file, mod, support, projectRoot, graphOptions, workspaceConfig, logLevel) {
     if (!support.supportsCrossModuleSymbols)
         return;
-    if (support.id !== "ts" && support.id !== "js")
+    if (!isJsTsLanguage(support.id))
         return;
     const { matchPath } = await import("../util/resolution.js").then((mod) => mod.loadNearestTsconfigFor(file, projectRoot, logLevel));
     for (const entry of mod.exports) {
@@ -107,11 +112,11 @@ async function resolveCrossModuleSymbolExports(file, mod, support, projectRoot,
     }
 }
 async function buildIndexedModuleForFile(args) {
-    const prepared = await prepareFileContextForBuild(args.file, args.support, args.opts, args.workerSetup, args.report);
+    const prepared = await prepareFileContextForBuild(args.file, args.support, args.opts, args.workerSetup, args.report, args.confinedRoot, args.projectRoot, args.trustedSource);
     const { source, sup, nativeQueries, embeddedBlocks } = prepared;
-    let resolvedLang = prepared.lang;
     let tree;
-    const graphOnlyLanguage = isGraphOnlyLanguage(sup.id);
+    const graphOnlyLanguage = isGraphOnlyLanguage(sup.id), nativeSourceLimitFallback = prepared.nativeFallbackReason === "queryFailure" &&
+        !!prepared.nativeError?.startsWith("source exceeds native byte limit");
     if (prepared.syntaxTree) {
         const parsedTree = new ProjectedSyntaxTree(source, prepared.syntaxTree);
         tree = parsedTree;
@@ -119,17 +124,15 @@ async function buildIndexedModuleForFile(args) {
             source,
             tree: parsedTree,
             sup,
-            ...(resolvedLang ? { lang: resolvedLang } : {}),
             ...(embeddedBlocks ? { embeddedBlocks } : {}),
             nativeQueries,
         }, args.parsedCacheMaxEntries);
     }
-    else if (!nativeQueries && !graphOnlyLanguage && sup.id !== "sql") {
+    else if (!nativeQueries && !graphOnlyLanguage && sup.id !== "sql" && !nativeSourceLimitFallback) {
         const parseAttempt = attemptParsePreparedFileContext(prepared);
         const parsed = parseAttempt.parsed;
         if (parsed) {
             tree = parsed.tree;
-            resolvedLang = parsed.lang;
             setParsedCacheEntry(args.parsedMap, args.file, parsed, args.parsedCacheMaxEntries);
         }
         else {
@@ -148,12 +151,11 @@ async function buildIndexedModuleForFile(args) {
         const parsed = parseAttempt.parsed;
         if (parsed) {
             tree = parsed.tree;
-            resolvedLang = parsed.lang ?? resolvedLang;
             setParsedCacheEntry(args.parsedMap, args.file, parsed, args.parsedCacheMaxEntries);
         }
     }
     const lacksParserContext = !nativeQueries && !tree;
-    if (args.bloomFilterCache) {
+    if (args.bloomFilterCache && !nativeSourceLimitFallback) {
         const filter = buildBloomFilterFromSource(source, sup);
         args.bloomFilterCache.set(args.file, filter);
     }
@@ -166,13 +168,11 @@ async function buildIndexedModuleForFile(args) {
         ...(args.opts?.languageExtensions ? { languageExtensions: args.opts.languageExtensions } : {}),
         ...(args.onFallbackImportExtraction ? { onFallbackImportExtraction: args.onFallbackImportExtraction } : {}),
     };
-    const imports = sup.id === "sql"
+    const imports = nativeSourceLimitFallback || sup.id === "sql"
         ? []
         : await collectImportsForFile(args.file, args.projectRoot, {
             source,
-            ...(tree && isParserSyntaxTree(tree) ? { tree } : {}),
             sup,
-            ...(resolvedLang ? { lang: resolvedLang } : {}),
             ...(nativeQueries !== undefined ? { nativeQueries } : {}),
             ...sharedImportOptions,
         });
@@ -192,7 +192,7 @@ async function buildIndexedModuleForFile(args) {
         mod = { ...createEmptyModuleIndex(args.file), imports };
     }
     else {
-        mod = collectLocalsAndExportsFromSource(args.file, source, sup, resolvedLang, imports, {
+        mod = collectLocalsAndExportsFromSource(args.file, source, sup, imports, {
             ...(tree ? { tree } : {}),
             ...(nativeQueries !== undefined ? { nativeQueries } : {}),
             ...(args.opts?.native ? { nativeMode: args.opts.native } : {}),
@@ -216,7 +216,6 @@ async function buildIndexedModuleForFile(args) {
         graphContext: {
             source,
             sup,
-            ...(resolvedLang ? { lang: resolvedLang } : {}),
             ...(nativeQueries !== undefined ? { nativeQueries } : {}),
             ...(tree ? { tree } : {}),
             ...(embeddedBlocks ? { embeddedBlocks } : {}),
@@ -362,9 +361,8 @@ function projectIndexManifestEntries(entries) {
     return new Map(Array.from(entries, ([file, entry]) => [file, toProjectIndexManifestEntry(entry)]));
 }
 function createIndexBuildRunState(projectRoot, opts, graphOptions = normalizeGraphOptions(opts?.graph)) {
-    const report = opts?.report;
-    if (report)
-        initNativeBackendReport(report);
+    const report = opts?.report ?? { timings: {} };
+    initNativeBackendReport(report);
     const cacheMode = opts?.cache ?? "off";
     return {
         normalizedProjectRoot: normalizePath(path.resolve(projectRoot)),
@@ -399,6 +397,13 @@ function buildConcurrency(opts) {
 async function prepareFileSignatures(args) {
     const entries = await mapLimit(args.files, args.concurrency, async (file) => {
         const gitSig = args.gitSigMap.get(file);
+        const source = args.confinedRoot
+            ? await readConfinedUtf8File(args.confinedRoot, args.projectRoot, file)
+            : undefined;
+        if (source !== undefined) {
+            args.trustedSources?.set(file, source);
+            return [file, fileSignatureFromSource(source, gitSig)];
+        }
         const sigInfo = await fileSignature(file, args.needsContentHash ? args.opts?.cacheStrict : false, gitSig, {
             forceContentHash: args.cacheEnabled && !gitSig,
         });
@@ -410,7 +415,7 @@ async function buildProjectIndexFromExport(projectRoot, opts, helperOpts) {
     return buildProjectIndexWithManifestOptions(projectRoot, opts, helperOpts);
 }
 async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperOpts) {
-    clearImportResolutionCaches();
+    clearResolutionCaches();
     await initializeFileIdentityCaseSensitivity(projectRoot);
     const { normalizedProjectRoot, report, timings, totalStart, cacheMode, cacheEnabled, graphOptions, onFallbackImportExtraction, } = createIndexBuildRunState(projectRoot, opts);
     const manifestMode = helperOpts?.manifestMode ?? "off";
@@ -418,7 +423,11 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     const shouldWriteManifest = manifestMode === "read-write";
     const projectFiles = helperOpts?.projectFiles;
     initManifestReport(report, useManifest, false);
-    const normalizedFiles = Array.from(new Set(normalizeIndexedFileInputs(projectRoot, rawFiles ?? [], "Index file")));
+    const confinedRoot = helperOpts?.confineReads ? await fsp.realpath(projectRoot) : undefined;
+    const [trustedSources, normalizedFiles] = [
+        confinedRoot ? new Map() : undefined,
+        Array.from(new Set(normalizeIndexedFileInputs(projectRoot, rawFiles ?? [], "Index file"))),
+    ];
     if (!normalizedFiles.length && helperOpts?.warnNoFilesMessage) {
         logWithLevel(opts?.logLevel, "warn", helperOpts.warnNoFilesMessage);
     }
@@ -426,7 +435,7 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     if (fileReport)
         fileReport.total = normalizedFiles.length;
     const manifestStart = performance.now();
-    const manifest = useManifest && !helperOpts?.ignoreExistingManifest ? await loadManifest(projectRoot, opts) : null;
+    const manifest = useManifest && !helperOpts?.ignoreExistingManifest ? await loadManifest(projectRoot, opts, report) : null;
     const manifestFiles = sanitizeManifestEntriesForRoot(projectRoot, manifest?.files);
     const manifestOptionDiffs = manifest ? diffBuildOptions(manifest.buildOptions, opts) : [];
     const languageExtensionsChanged = manifestOptionDiffs.includes("languageExtensions");
@@ -468,10 +477,10 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
         graphOptionsEqual(manifest.graphOptions, graphOptions)
         ? new Map(Object.entries(manifestFiles).filter(([file]) => !staleCachedEdgeFiles.has(file)))
         : undefined;
+    const manifestEntries = shouldWriteManifest ? new Map() : undefined;
     if (report?.manifest) {
         report.manifest.reused = !!cachedGraphEntries;
     }
-    const manifestEntries = shouldWriteManifest ? new Map() : undefined;
     const manifestEntriesForIndex = useManifest
         ? projectIndexManifestEntries(cachedGraphEntries ?? [])
         : new Map();
@@ -494,12 +503,14 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
     })
         .sort((left, right) => left.localeCompare(right));
     const fileSignatures = await prepareFileSignatures({
+        projectRoot,
         files: sqlFiles,
         opts,
         gitSigMap,
         cacheEnabled,
         needsContentHash: true,
         concurrency: conc,
+        ...(confinedRoot ? { confinedRoot, trustedSources } : {}),
     });
     const sqlCorpusSig = sqlCorpusSignature(sqlFiles, fileSignatures);
     let sqlFactCachePromise;
@@ -516,13 +527,53 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
         return !(matchesGitSig || cachedEdgesEntry.sig === sigInfo.sig);
     };
     const jsonDependencies = new Map();
-    const workerSetup = await setupWorkerPool(opts, normalizedFiles.length);
+    // Cache lookup determines the work a full build will actually parse. Complete that cheap phase
+    // before starting Piscina, so a warm build does not bootstrap workers and partial hits bound
+    // the pool to real parse misses rather than the input file list.
+    const cacheProbes = new Map(await mapLimit(normalizedFiles, conc, async (file) => {
+        try {
+            let sigInfo = fileSignatures.get(file);
+            if (!sigInfo) {
+                const gitSig = gitSigMap.get(file);
+                const source = confinedRoot ? await readConfinedUtf8File(confinedRoot, projectRoot, file) : undefined;
+                if (source !== undefined) {
+                    trustedSources?.set(file, source);
+                    sigInfo = fileSignatureFromSource(source, gitSig);
+                }
+                else {
+                    sigInfo = await fileSignature(file, opts?.cacheStrict, gitSig, {
+                        forceContentHash: cacheEnabled && !gitSig,
+                    });
+                }
+                fileSignatures.set(file, sigInfo);
+            }
+            manifestEntriesForIndex.set(file, toProjectIndexManifestEntry(sigInfo));
+            if (manifestEntries) {
+                const initialManifestEntry = toManifestFileEntry({ ...sigInfo, edges: [] });
+                if (initialManifestEntry)
+                    manifestEntries.set(file, initialManifestEntry);
+            }
+            const cacheSig = cacheEnabled
+                ? await moduleCacheSignatureForFile(file, sigInfo, opts, resolverEnvironmentFingerprint)
+                : sigInfo.cacheSig;
+            const canReuseModuleCache = cacheEnabled && (!graphOptions.resolveNodeModules || resolverEnvironmentFingerprint !== null);
+            const mod = canReuseModuleCache ? tryLoadFromCache(projectRoot, file, cacheSig, opts, report) : null;
+            return [file, { sigInfo, mod }];
+        }
+        catch (error) {
+            return [file, { error }];
+        }
+    }));
+    const cacheMisses = Array.from(cacheProbes, ([file, probe]) => !("error" in probe) && !probe.mod ? file : null).filter((file) => file !== null);
+    const workerSetup = await setupWorkerPool(opts, countNativeWorkerEligibleFiles(cacheMisses, opts?.languageExtensions));
     try {
         const useBloomFilters = opts?.useBloomFilters ?? true;
         const bloomFilterCache = useBloomFilters
             ? new (await import("../util/bloomFilter.js")).BloomFilterCache()
             : undefined;
-        const persistedBloomFilters = bloomFilterCache ? await tryLoadPersistedBloomFilters(projectRoot, opts) : null;
+        const persistedBloomFilters = bloomFilterCache
+            ? await tryLoadPersistedBloomFilters(projectRoot, opts, report)
+            : null;
         const parsedMap = new Map();
         const workspaceConfig = await loadWorkspaceConfig(projectRoot);
         const parseStart = performance.now();
@@ -546,27 +597,13 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
         };
         const fileResults = await mapLimit(normalizedFiles, conc, async (file) => {
             try {
-                let sigInfo = fileSignatures.get(file);
-                if (!sigInfo) {
-                    const gitSig = gitSigMap.get(file);
-                    sigInfo = await fileSignature(file, opts?.cacheStrict, gitSig, {
-                        forceContentHash: cacheEnabled && !gitSig,
-                    });
-                    fileSignatures.set(file, sigInfo);
-                }
-                manifestEntriesForIndex.set(file, toProjectIndexManifestEntry(sigInfo));
-                if (manifestEntries) {
-                    const initialManifestEntry = toManifestFileEntry({ ...sigInfo, edges: [] });
-                    if (initialManifestEntry)
-                        manifestEntries.set(file, initialManifestEntry);
-                }
-                const cacheSig = cacheEnabled
-                    ? await moduleCacheSignatureForFile(file, sigInfo, opts, resolverEnvironmentFingerprint)
-                    : sigInfo.cacheSig;
-                const canReuseModuleCache = cacheEnabled && (!graphOptions.resolveNodeModules || resolverEnvironmentFingerprint !== null);
-                let mod = canReuseModuleCache
-                    ? tryLoadFromCache(projectRoot, file, cacheSig, opts, report)
-                    : null;
+                const cacheProbe = cacheProbes.get(file);
+                if (!cacheProbe)
+                    throw new Error(`Missing module cache probe for ${file}`);
+                if ("error" in cacheProbe)
+                    throw cacheProbe.error;
+                const { sigInfo } = cacheProbe;
+                let mod = cacheProbe.mod;
                 if (mod && fileReport) {
                     fileReport.cached = (fileReport.cached ?? 0) + 1;
                 }
@@ -638,6 +675,7 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                         onFallbackImportExtraction,
                         fileSignatures,
                         cacheEnabled,
+                        ...(confinedRoot ? { confinedRoot, trustedSource: trustedSources?.get(file) } : {}),
                     });
                     mod = built.module;
                     graphContext = built.graphContext;
@@ -672,7 +710,9 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
             catch (error) {
                 if (isNativeRequiredUnavailableError(error) || isNodeSqliteUnavailableError(error))
                     throw error;
-                if (isUnsupportedParserInputError(error) || isNonNativeParserUnavailableError(error)) {
+                if (isConfinedFileReadError(error))
+                    throw error;
+                if (isUnsupportedParserInputError(error)) {
                     return [file, createEmptyModuleIndex(file), [], undefined];
                 }
                 recordFileFailure(report, file, error);
@@ -728,6 +768,17 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
             ensureJsonModule(modules, jsonPath);
         }
         expandStarImports(modules, opts);
+        if (manifestEntries) {
+            for (const [file, signature] of fileSignatures) {
+                if (manifestEntries.has(file))
+                    continue;
+                manifestEntries.set(file, {
+                    sig: signature.sig,
+                    ...(signature.gitSig ? { gitSig: signature.gitSig } : {}),
+                    edges: [],
+                });
+            }
+        }
         if (manifestEntries) {
             await writeIndexManifestSnapshot({
                 projectRoot,
@@ -741,6 +792,12 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
                 ...(helperOpts?.symlinkDirectories !== undefined ? { symlinkDirectories: helperOpts.symlinkDirectories } : {}),
             });
         }
+        const indexManifestEntries = manifestEntries
+            ? projectIndexManifestEntries(Array.from(manifestEntries, ([file, entry]) => {
+                const cacheSig = fileSignatures.get(file)?.cacheSig;
+                return [file, { ...entry, ...(cacheSig ? { cacheSig } : {}) }];
+            }))
+            : manifestEntriesForIndex;
         const index = await finalizeProjectIndex({
             projectRoot,
             normalizedProjectRoot,
@@ -753,7 +810,7 @@ async function buildIndexFromFileListShared(projectRoot, rawFiles, opts, helperO
             bloomFilterCache,
             ...(projectFiles !== undefined ? { projectFiles } : {}),
             buildReport: report,
-            manifestEntries: manifestEntriesForIndex,
+            manifestEntries: indexManifestEntries,
         });
         if (manifestEntries) {
             await writeProjectIndexSnapshot(projectRoot, opts, index, projectSnapshotFilesSignature(manifestEntries, projectRoot));
@@ -776,34 +833,29 @@ async function buildProjectIndexWithManifestOptions(projectRoot, opts, helperOpt
         // full-tree symlink probe. Off and memory modes never read or write this disk
         // manifest, keeping read-only builds from mutating the project root. A missing or
         // unusable manifest falls back to probing once.
-        // A symlink hint never expires on its own: `knownSymlinkDirectories` disables probing entirely, so
-        // a directory symlinked in after the hint was recorded (e.g. `npm link`) would
-        // otherwise never be discovered. `--cache-strict`/`--cache-verify` are explicit asks
-        // for maximum correctness over speed, so both force a fresh probe here too.
+        // The manifest records the project-root directory mtime alongside symlink hints. A changed
+        // root mtime triggers the cheap full-tree probe, while strict modes always probe.
         const wantsMaxSymlinkCorrectness = !!opts?.cacheStrict || !!opts?.cacheVerify;
         const symlinkHintManifest = helperOpts?.ignoreExistingManifest || wantsMaxSymlinkCorrectness || !useDiskCache
             ? null
             : await loadManifest(projectRoot, opts);
-        const knownSymlinkDirectories = symlinkHintManifest?.symlinkDirectories;
+        const rootMtime = symlinkHintManifest ? (await fsp.stat(projectRoot)).mtimeMs : undefined;
+        const symlinkHintIsFresh = symlinkHintManifest?.symlinkDirectoriesRootMtimeMs !== undefined &&
+            rootMtime === symlinkHintManifest.symlinkDirectoriesRootMtimeMs;
+        const knownSymlinkDirectories = symlinkHintIsFresh ? symlinkHintManifest?.symlinkDirectories : undefined;
         let discoveredSymlinkDirectories = knownSymlinkDirectories;
         const onSymlinkDirectoriesDiscovered = (directories) => {
             discoveredSymlinkDirectories = Array.from(directories);
         };
         // When the hint is unknown, listProjectFiles() and discoverProjectFiles() must run
-        // sequentially rather than in Promise.all: both would otherwise start their own
-        // full-tree symlink probe concurrently, since the callback only reports back after
-        // listProjectFiles() resolves, too late to inform a probe discoverProjectFiles()
-        // already started on its own. Sequencing costs a little parallelism on that one
-        // cold-start case, but avoids paying for two full-tree walks instead of one. Once a
-        // hint is known (the common warm case), both calls skip probing entirely, so running
-        // them sequentially here costs no meaningful time either way.
+        // sequentially rather than in Promise.all to avoid duplicate full-tree probes.
         const discoveredFiles = await listProjectFiles(projectRoot, projectPatternsForLanguageExtensions(opts), {
             ...opts?.discovery,
             ...(opts?.logLevel ? { logLevel: opts.logLevel } : {}),
             ...(knownSymlinkDirectories !== undefined ? { knownSymlinkDirectories } : {}),
             onSymlinkDirectoriesDiscovered,
         });
-        const additionalFileCandidates = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
+        const additionalFileCandidates = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
         const additionalFileExistence = await probePathExistence(additionalFileCandidates, buildConcurrency(opts));
         const additionalFiles = additionalFileCandidates.filter((file) => additionalFileExistence.get(file));
         const discoveredFileSet = new Set(discoveredFiles);
@@ -850,9 +902,11 @@ export async function buildProjectIndex(projectRoot, opts) {
 export async function buildProjectIndexFromFiles(projectRoot, inputFiles, opts) {
     try {
         const useDiskCache = (opts?.cache ?? "off") === "disk";
-        return await buildIndexFromFileListShared(projectRoot, inputFiles, opts, {
+        const normalizedInputFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, inputFiles, "Index file");
+        return await buildIndexFromFileListShared(projectRoot, normalizedInputFiles, opts, {
             manifestMode: useDiskCache ? "read-only" : "off",
             warnNoFilesMessage: `Warning: No files provided for indexing in ${projectRoot}. Check the explicit file list and include/ignore filters. Diagnostic: codegraph doctor`,
+            confineReads: true,
         });
     }
     finally {
@@ -893,7 +947,7 @@ async function buildDeclaredScopeIndex(projectRoot, scopeFiles, opts) {
  */
 export async function buildProjectIndexIncremental(projectRoot, opts) {
     await initializeFileIdentityCaseSensitivity(projectRoot);
-    clearImportResolutionCaches();
+    clearResolutionCaches();
     const graphOptions = normalizeGraphOptions(opts?.graph);
     const strictIncremental = opts?.incrementalStrict ?? false;
     if (strictIncremental && graphOptions.fast)
@@ -944,7 +998,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         }
         startCheckProgress();
         const manifestStart = performance.now();
-        const manifest = await loadManifest(projectRoot, opts);
+        const manifest = await loadManifest(projectRoot, opts, report);
         if (timings)
             timings.manifestMs = Math.round(performance.now() - manifestStart);
         const manifestUsed = !!manifest;
@@ -1050,8 +1104,8 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         const trackedEntryKeys = Object.keys(trackedEntries);
         let manifestRequiresSanitization = manifestFileKeys.length !== trackedEntryKeys.length ||
             manifestFileKeys.some((file) => !Object.hasOwn(trackedEntries, file));
-        const explicitFiles = normalizeIndexedFileInputs(projectRoot, opts?.files ?? [], "Incremental file");
-        const additionalFiles = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
+        const explicitFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.files ?? [], "Incremental file");
+        const additionalFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional index file");
         const previousTransientFiles = sanitizeManifestTransientFilesForRoot(projectRoot, projectRoot, manifest.transientFiles).filter((file) => Object.hasOwn(trackedEntries, file));
         const previousTransientFileSet = new Set(previousTransientFiles);
         const needsGitScan = !!opts?.gitBase || !!opts?.changedSince;
@@ -1185,7 +1239,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         const explicitFileSet = new Set(explicitFiles);
         const explicitFilesCoverAllFiles = explicitFileSet.size === allFiles.size && [...allFiles].every((file) => explicitFileSet.has(file));
         const explicitFilesAreChangeInputs = !opts?.filesAreProjectScope;
-        if (explicitFileSet.size && explicitFilesAreChangeInputs && (!explicitFilesCoverAllFiles || report)) {
+        if (explicitFileSet.size && explicitFilesAreChangeInputs && (!explicitFilesCoverAllFiles || opts?.report)) {
             explicitFileSet.forEach(markAsChanged);
         }
         dependentFilesOfDeletedTracked.forEach(markAsChanged);
@@ -1195,7 +1249,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
             if (changedFiles.size || deletedTrackedFiles.size || manifestRequiresSanitization)
                 return null;
             const manifestEntryMap = new Map(Object.entries(trackedEntries));
-            const snapshotLoad = await tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEntryMap);
+            const snapshotLoad = await tryLoadProjectIndexSnapshot(projectRoot, opts, manifestEntryMap, report);
             if (!snapshotLoad)
                 return null;
             const snapshot = snapshotLoad.index;
@@ -1265,7 +1319,10 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
         }
         const workspaceConfig = await loadWorkspaceConfig(projectRoot);
         const conc = buildConcurrency(opts);
-        const workerSetup = await setupWorkerPool(opts, allFiles.size);
+        // Created below, once the changed-file set is known. Building it here would spawn a full
+        // pool before the signature pass and the unchanged-snapshot early return, so a warm
+        // no-change run paid for threads that never received a task.
+        let workerSetup = emptyWorkerPoolSetup();
         try {
             const useGitSignatures = gitAvailable;
             const gitSigMap = useGitSignatures
@@ -1275,6 +1332,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 })
                 : new Map();
             const fileSignatures = await prepareFileSignatures({
+                projectRoot,
                 files: Array.from(allFiles),
                 opts,
                 gitSigMap,
@@ -1300,8 +1358,9 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                     changedFiles.add(file);
                 }
             }
+            const reverseDeps = buildTrackedFileReverseDependencies(trackedEntries);
             const invalidateCachedDependents = () => {
-                const dependentFilesOfChanged = collectTrackedFileDependents(trackedEntries, changedFiles);
+                const dependentFilesOfChanged = collectTrackedFileDependents(trackedEntries, changedFiles, reverseDeps);
                 for (const file of dependentFilesOfChanged) {
                     const key = fileIdentityKey(file);
                     if (modules.has(key)) {
@@ -1326,9 +1385,11 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 return unchangedSnapshot;
             }
             const snapshotModules = cacheEnabled
-                ? await tryLoadProjectSnapshotModules(projectRoot, opts, fileSignatures)
+                ? await tryLoadProjectSnapshotModules(projectRoot, opts, fileSignatures, report)
+                : null;
+            const persistedBloomFilters = bloomFilterCache
+                ? await tryLoadPersistedBloomFilters(projectRoot, opts, report)
                 : null;
-            const persistedBloomFilters = bloomFilterCache ? await tryLoadPersistedBloomFilters(projectRoot, opts) : null;
             for (const file of allFiles) {
                 if (changedFiles.has(file))
                     continue;
@@ -1365,6 +1426,9 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
             }
             invalidateCachedDependents();
             const changedList = Array.from(changedFiles);
+            // Sized by the work that remains rather than the size of the project: an incremental build
+            // touching a handful of files gets a handful of threads, or none.
+            workerSetup = await setupWorkerPool(opts, countNativeWorkerEligibleFiles(changedList, opts?.languageExtensions));
             let updateStartedAt;
             if (changedList.length || deletedTrackedFiles.size) {
                 updateStartedAt = performance.now();
@@ -1406,7 +1470,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                     catch (error) {
                         if (isNativeRequiredUnavailableError(error) || isNodeSqliteUnavailableError(error))
                             throw error;
-                        if (isUnsupportedParserInputError(error) || isNonNativeParserUnavailableError(error)) {
+                        if (isUnsupportedParserInputError(error)) {
                             return [file, createEmptyModuleIndex(file)];
                         }
                         recordFileFailure(report, file, error);
@@ -1481,6 +1545,7 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                     dynamicImportHeuristics: !!graphOptions.dynamicImportHeuristics,
                     ...(opts?.native ? { native: opts.native } : {}),
                     ...(opts?.languageExtensions ? { languageExtensions: opts.languageExtensions } : {}),
+                    threads: conc,
                     ...(opts?.logLevel ? { logLevel: opts.logLevel } : {}),
                     ...(graphOptions.resolutionHints ? { resolutionHints: graphOptions.resolutionHints } : {}),
                     allFiles: Array.from(allFiles),
@@ -1498,6 +1563,16 @@ export async function buildProjectIndexIncremental(projectRoot, opts) {
                 });
             if (timings)
                 timings.graphMs = Math.round(performance.now() - graphStart);
+            for (const file of new Set([...changedFiles, ...transientFiles])) {
+                const signature = fileSignatures.get(file);
+                if (!signature || manifestEntries.has(file))
+                    continue;
+                manifestEntries.set(file, {
+                    sig: signature.sig,
+                    ...(signature.gitSig ? { gitSig: signature.gitSig } : {}),
+                    edges: [],
+                });
+            }
             await writeIndexManifestSnapshot({
                 projectRoot,
                 opts,
@@ -1565,8 +1640,8 @@ export async function buildGraphDelta(projectRoot, opts) {
     const strictIncremental = opts?.incrementalStrict ?? false;
     if (strictIncremental && graphOptions.fast)
         graphOptions.fast = false;
-    const explicitFiles = normalizeIndexedFileInputs(projectRoot, opts?.files ?? [], "Graph delta file");
-    const additionalFiles = normalizeIndexedFileInputs(projectRoot, opts?.additionalFiles ?? [], "Additional graph delta file");
+    const explicitFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.files ?? [], "Graph delta file");
+    const additionalFiles = await normalizeIndexedFileInputsWithinRoot(projectRoot, opts?.additionalFiles ?? [], "Additional graph delta file");
     const needsGitScan = !!opts?.gitBase || !!opts?.changedSince;
     const gitFiles = needsGitScan ? await listChangedFiles(projectRoot, buildIncrementalGitDiffOptions(opts)) : [];
     const { trackedFiles } = await partitionTrackedManifestFiles(trackedEntries);
@@ -1591,14 +1666,19 @@ export async function buildGraphDelta(projectRoot, opts) {
     }
     const candidateExistence = await probePathExistence([...explicitFiles, ...additionalFiles, ...manifestDiffFiles, ...gitFiles], buildConcurrency(opts));
     const existsInCandidateSnapshot = (file) => candidateExistence.get(file) ?? false;
-    const existingExplicitFiles = explicitFiles.filter(existsInCandidateSnapshot);
+    const normalizeChangedFiles = (files) => files.map((file) => {
+        if (!existsInCandidateSnapshot(file))
+            return file;
+        const [normalizedFile] = normalizeIndexedFileInputs(projectRoot, [file], "Graph delta file");
+        return normalizedFile ?? file;
+    }), normalizedManifestDiffFiles = normalizeChangedFiles(manifestDiffFiles), normalizedGitFiles = normalizeChangedFiles(gitFiles), existingExplicitFiles = explicitFiles.filter(existsInCandidateSnapshot);
     const existingAdditionalFiles = additionalFiles.filter(existsInCandidateSnapshot);
     const allFiles = new Set([
         ...trackedFiles,
         ...existingExplicitFiles,
         ...existingAdditionalFiles,
-        ...manifestDiffFiles.filter(existsInCandidateSnapshot),
-        ...gitFiles.filter(existsInCandidateSnapshot),
+        ...normalizedManifestDiffFiles.filter((_, index) => existsInCandidateSnapshot(manifestDiffFiles[index])),
+        ...normalizedGitFiles.filter((_, index) => existsInCandidateSnapshot(gitFiles[index])),
     ]);
     const changedFiles = new Set();
     const changedFileKeys = new Set();
@@ -1610,8 +1690,8 @@ export async function buildGraphDelta(projectRoot, opts) {
         changedFiles.add(file);
     };
     existingExplicitFiles.forEach(addChangedFile);
-    manifestDiffFiles.forEach(addChangedFile);
-    gitFiles.forEach(addChangedFile);
+    normalizedManifestDiffFiles.forEach(addChangedFile);
+    normalizedGitFiles.forEach(addChangedFile);
     if (languageExtensionsChanged) {
         for (const file of trackedFiles) {
             if (languageSupportChangedForFile(file))