@mmerterden/multi-agent-pipeline 20.20.0 → 20.22.0

package/pipeline/multi-agent-refs/platform-parity.md

@@ -14,13 +14,13 @@ description: "Internal  -  cross-platform parity cross-check for Phase 4 and /mu
 - [Severity](#severity)
 <!-- /toc -->
 
-A feature that exists on iOS and Android is written twice, and the two copies
-drift. The drift is invisible from inside one repo: the iOS diff is
+A feature that exists on several platforms is written more than once, and the
+copies drift. The drift is invisible from inside one repo: the iOS diff is
 self-consistent, the tests pass, and nobody notices that the Android screen
 calls a different endpoint, sends one parameter fewer, or reads a localization
 key that no longer exists on the other side.
 
-This step reads the counterpart repo and reports what differs. It is advisory:
+This step reads the counterpart repositories and reports what differs. It is advisory:
 it never blocks, never edits, and its silence is never evidence.
 
 ## When it runs
@@ -29,6 +29,17 @@ The counterpart is **resolved automatically**. Nothing is asked in the normal
 case, because the answer is the same on every run of the same project and a
 question asked every time is a question people learn to dismiss.
 
+**Source 0, when present, replaces the rest.** If Phase 1 recorded
+`state.productContext[]` (`features/product-context.md`), every entry without
+an `error` is a counterpart: the product's other app, web and backend
+repositories, read at the sha Phase 1 pinned, through `repo_grep` /
+`repo_read` / `repo_find_keys`. No local checkout is needed and none is read,
+so the comparison is against the latest integration branch rather than
+whatever a sibling directory has checked out. A `stale` entry is still
+compared, and the section header says it is stale. Resources entries are
+compared on axis 4 only.
+
+Without product context, the mirrored-platform resolution below applies.
 Resolution order, first hit wins. `<slug>` is the primary project's prefs key,
 and `MIRROR` is `android` when the run's stack is `ios`, `ios` when it is
 `android` - the check runs in both directions and neither platform is the
@@ -38,7 +49,7 @@ default one.
 |---|---|---|
 | 1 | `--with <path\|owner/repo>` (`/multi-agent:review` only) | An explicit override for a one-off. Remembered like any other resolution. |
 | 2 | `prefs.projects[<slug>].counterpartRoots[]` | What a previous run learned. Verified before use: the path must still exist and its markers must still resolve to `MIRROR`, otherwise the entry is dropped and detection continues at 3. A remembered answer that has gone stale is worse than none. |
-| 3 | Sibling checkouts of the primary repo | List the primary checkout's **parent directory**, depth 1, keep the git repos, resolve each one's stack from its marker files. This matches how the repos are actually laid out - a product's iOS and Android checkouts sit next to each other - and it is one directory listing, not a scan of `$HOME`. |
+| 3 | Sibling checkouts of the primary repo | List the primary checkout's **parent directory**, depth 1, keep the git repos, resolve each one's stack from its marker files, and keep only those whose name core matches the primary's (`product-context.mjs suggest`: platform and version words dropped, so `acme-shop-ios-new` keeps `acme-shop-android` and drops an unrelated repo that merely has Android markers). For a run inside a worktree, the parent is that of the primary repository's main checkout, not of the worktree. One directory listing, not a scan of `$HOME`. |
 | 4 | `state.siblings[]` | Anything the Phase 0 dev-context picker recorded, in case the counterpart is a submodule or a repo the user selected by hand. |
 
 Then:
@@ -64,9 +75,9 @@ The second condition is the diff: it has to touch something with a counterpart
 worth checking - a screen, a service/repository/use-case, a request model, or a
 localization file. Otherwise the step is skipped even when a counterpart exists.
 
-Nothing is ever cloned. A counterpart that is not checked out locally is
-skipped: cloning a repository in order to review a different one is a side
-effect nobody asked for.
+Nothing is cloned into a workspace. Product-context counterparts live in the
+`repo_*` tools' read-only cache, which has no working tree; a fallback
+counterpart that is not checked out locally is skipped.
 
 ## Read-only, without exception
 
@@ -80,8 +91,11 @@ for a human, not a task for the pipeline.
 
 ## Locating the counterpart, deterministically
 
-Do not grep the other repo by hand and do not read it broadly. Use the code
-graph, which is LLM-free and token-budgeted:
+Do not read the other repo broadly. For a product-context counterpart, look the
+diff's identifiers up with one `repo_find_keys` call at the recorded sha (paths,
+endpoint strings, request type names, localization keys), then `repo_read` the
+hit files. For a local fallback counterpart, use the code graph, which is
+LLM-free and token-budgeted:
 
 ```bash
 SIB_STACK=android                      # or ios, mirrored

package/pipeline/multi-agent-refs/setup/free-models.md

@@ -0,0 +1,22 @@
+# Setup Step 3e - free-model keys
+
+Runs inside setup Step 3, only when `prefs.global.modelRouting.free.enabled` is
+true (`/multi-agent:route-on --free`). These are the keys the toolkit's
+free-model chain reads; `llm_delegate` and `bulk-read.sh` look for them under
+fixed names, so there is no `keychainMapping` entry.
+
+| Key | Provider | Where to get it | Asked |
+|---|---|---|---|
+| `llm-groq` | Groq (free tier does not train on prompts) | https://console.groq.com/keys | always first |
+| `llm-mistral` | Mistral | https://console.mistral.ai/api-keys | only with `modelRouting.free.allowTraining` |
+| `llm-gemini` | Google Gemini | https://aistudio.google.com/apikey | only with `allowTraining` |
+| `llm-openrouter` | OpenRouter, free models only | https://openrouter.ai/keys | only with `allowTraining` |
+| `llm-zai` | Z.AI GLM Flash | https://z.ai/manage-apikey/apikey-list | only with `allowTraining` |
+
+Each key is one Token Save Flow pass (`token-save-flow.md`) with the clipboard
+save, `pbpaste | credential-store.sh set "<key>" -`, and no author or host step.
+Skip writes nothing and moves to the next key. After the last pass, run
+`route-state.sh status` so the user sees each saved provider reported ready.
+
+A local Ollama needs no key: the user sets `OLLAMA_MODEL` for the server. The
+full contract: `$HOME/.claude/multi-agent-refs/features/free-models.md`.

package/pipeline/multi-agent-refs/setup/token-save-flow.md

@@ -1,5 +1,11 @@
 ## Token Save Flow (reusable)
 
+<!-- toc -->
+- [Token Save Flow (reusable)](#token-save-flow-reusable)
+- [Step 3.5  -  Host Prompt (embedded in Token Save Flow)](#step-35---host-prompt-embedded-in-token-save-flow)
+- [Step 3.7  -  Repository read binding (embedded in Token Save Flow)](#step-37---repository-read-binding-embedded-in-token-save-flow)
+<!-- /toc -->
+
 This flow is used in TWO contexts:
 - **Setup Step 4**  -  for missing tokens during first-time onboarding
 - **Phase 0 token pre-check**  -  when a token is missing or expired (401/403) at runtime
@@ -199,3 +205,21 @@ Test host → `hosts.graylogTest` (`{GRAYLOG_TEST_HOST}`); skipped means product
 **Re-run / update**: `/multi-agent:setup hosts` re-opens the prompt to edit values without touching tokens.
 
 Team-sharing note: Hosts are the only corporate metadata the pipeline needs. Tokens live in macOS Keychain (encrypted, never on disk inside the repo). Preferences file lives in `~/.claude/`  -  fully outside the repo clone. A teammate cloning the repo runs `/multi-agent:setup` once; host + token prompts run naturally together.
+
+## Step 3.7  -  Repository read binding (embedded in Token Save Flow)
+
+Runs inline when the saved token can read git repositories over https (a
+GitHub PAT, a Bitbucket Data Center HTTP access token). The multi-agent-toolkit
+`repo_*` tools send a token only to a host bound to it here, and nothing else
+in the pipeline writes this binding: a product map or a planner's request
+naming a credential never creates one.
+
+```
+Repository hosts this token may be sent to for read-only clone and fetch
+(comma-separated, empty for none). Suggested: {github.com | prefs.global.hosts.bitbucket}
+  ___
+```
+
+Save the answer, lowercased, to `prefs.global.credentialHosts.{logical-key}`
+(an array of hostnames). Empty leaves the key unbound. `/multi-agent:setup hosts`
+re-opens it.

package/pipeline/preferences-template.json

@@ -79,6 +79,7 @@
       "strategy": "manual",
       "scope": ["subagent"],
       "rules": [],
+      "free": { "enabled": false, "allowTraining": false },
       "budgetCeilingUsd": null,
       "recordDecisions": true
     },

package/pipeline/schemas/agent-state.schema.json

@@ -551,6 +551,37 @@
         }
       }
     },
+    "productContext": {
+      "type": "array",
+      "maxItems": 20,
+      "description": "What Phase 1 read from the other repositories of the product (every product repo except the ones this run develops), each at its pinned sha through the toolkit's repo_* tools. Written by scripts/product-context.mjs record; read by Phase 1 planning, Phase 2 dev and Phase 3 platform parity. See multi-agent-refs/features/product-context.md.",
+      "items": {
+        "type": "object",
+        "required": ["remote", "slug"],
+        "properties": {
+          "remote": { "type": "string" },
+          "slug": { "type": "string" },
+          "stack": { "type": "string" },
+          "branch": { "type": "string" },
+          "sha": { "type": "string" },
+          "stale": { "type": "boolean" },
+          "error": { "type": "string" },
+          "keys": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["key", "status"],
+              "properties": {
+                "key": { "type": "string" },
+                "status": { "enum": ["implemented", "not-yet-implemented", "diverges", "error"] },
+                "hits": { "type": "array" },
+                "note": { "type": "string" }
+              }
+            }
+          }
+        }
+      }
+    },
     "siblings": {
       "type": "array",
       "maxItems": 10,

package/pipeline/schemas/analysis-spec.schema.json

@@ -610,6 +610,20 @@
             }
           }
         },
+        "repoShas": {
+          "type": "array",
+          "description": "Every repo read through the toolkit's repo_* tools at its latest integration branch, with the sha it was read at. Sorted shas are an evidence_digest input, so a new commit invalidates the cache.",
+          "items": {
+            "type": "object",
+            "required": ["remote", "branch", "sha"],
+            "properties": {
+              "remote": { "type": "string" },
+              "branch": { "type": "string" },
+              "sha": { "type": "string" },
+              "stale": { "type": "boolean" }
+            }
+          }
+        },
         "repoEvidence": {
           "type": "object",
           "description": "Phase 1b deep-scan result keyed by repo name. Each value holds the 13-bucket catalogue.",

package/pipeline/schemas/code-graph.schema.json

@@ -8,7 +8,8 @@
   "additionalProperties": false,
   "properties": {
     "schemaVersion": {
-      "const": "1.0.0"
+      "enum": ["1.0.0", "1.1.0"],
+      "description": "1.1.0 adds endLine on symbol nodes. A 1.0.0 graph stays readable; diff mapping falls back to file level for it."
     },
     "stack": {
       "type": "string",
@@ -51,6 +52,16 @@
           "name": { "type": "string" },
           "path": { "type": ["string", "null"] },
           "line": { "type": "integer", "minimum": 1 },
+          "startLine": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "First line of the declaration when attribute or decorator lines sit directly above it; absent when it equals line."
+          },
+          "endLine": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Last line indented deeper than the declaration, plus a closing bracket at its own indentation when one follows. Absent in graphs built before schema 1.1.0."
+          },
           "symbolKind": { "type": "string" },
           "nested": {
             "type": "boolean",

package/pipeline/schemas/diff-risk.schema.json

@@ -64,7 +64,8 @@
                     "complexity_delta",
                     "ui_critical",
                     "migration",
-                    "test_lines_removed"
+                    "test_lines_removed",
+                    "dependents_reached"
                   ]
                 },
                 "weight": { "type": "number" },

package/pipeline/schemas/prefs.schema.json

@@ -599,10 +599,19 @@
               "uniqueItems": true,
               "items": {
                 "type": "string",
-                "enum": ["subagent", "bulk-read", "research"]
+                "enum": ["subagent", "bulk-read", "delegate", "research"]
               },
               "description": "No host-session member, deliberately: rewriting the host's base URL would route the user's whole session, not just this pipeline's calls."
             },
+            "free": {
+              "type": "object",
+              "additionalProperties": false,
+              "description": "Layer 2: the verified free-model chain at bulk-read and delegate. Contract: route-config.schema.json.",
+              "properties": {
+                "enabled": { "type": "boolean", "default": false },
+                "allowTraining": { "type": "boolean", "default": false }
+              }
+            },
             "rules": {
               "type": "array",
               "default": [],
@@ -1454,6 +1463,60 @@
             }
           }
         },
+        "credentialHosts": {
+          "type": "object",
+          "description": "Hosts each credential-store key may be sent to by the multi-agent-toolkit repo_* tools for read-only clone and fetch over https. Written by /multi-agent:setup (Token Save Flow Step 3.7) with the person present; product-context.mjs learn refuses a repository credential whose host is not listed here, and the toolkit refuses to send a token anywhere else.",
+          "additionalProperties": {
+            "type": "array",
+            "items": { "type": "string", "pattern": "^[a-z0-9.-]+$" },
+            "maxItems": 20
+          }
+        },
+        "products": {
+          "type": "object",
+          "description": "Products and the repositories each is made of, for the planning step that reads every repository of the product except the ones a run develops (scripts/product-context.mjs, toolkit repo_* tools). Keyed by product name; a project joins one through projects[<key>].product, or implicitly when one of its developed remotes is listed here. Written by product-context.mjs learn after the user confirms; read-only to everything else.",
+          "propertyNames": { "pattern": "^[A-Za-z0-9._-]{1,64}$" },
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["repos"],
+            "properties": {
+              "repos": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 20,
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["stack", "remote"],
+                  "properties": {
+                    "stack": { "enum": ["ios", "android", "web", "backend", "resources"] },
+                    "remote": {
+                      "type": "string",
+                      "description": "https://, ssh:// or user@host:path remote, without credentials."
+                    },
+                    "branch": {
+                      "type": "string",
+                      "description": "Override for the branch rule (develop when the remote has it, else its default branch)."
+                    },
+                    "credential": {
+                      "type": "string",
+                      "description": "Logical credential-store key of a read token for this host, accepted only when global.credentialHosts already binds the key to this https host. Omit to use git's own credential helper or SSH agent."
+                    },
+                    "authScheme": {
+                      "enum": ["basic", "bearer"],
+                      "description": "basic for GitHub, bearer for Bitbucket Data Center HTTP access tokens."
+                    },
+                    "username": {
+                      "type": "string",
+                      "description": "Username for basic auth. Default x-access-token."
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
         "codeGraph": {
           "type": "object",
           "additionalProperties": false,
@@ -2329,6 +2392,10 @@
                 }
               }
             },
+            "product": {
+              "type": "string",
+              "description": "Name of the global.products entry this project belongs to. Planning reads every repository of that product except the ones the run develops. Written by product-context.mjs learn."
+            },
             "counterpartRoots": {
               "type": "array",
               "items": {

package/pipeline/schemas/route-config.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/mmerterden/multi-agent-pipeline/pipeline/schemas/route-config.schema.json",
   "title": "Model routing configuration",
-  "description": "Policy-driven model selection, OFF by default. Lives under prefs.global.modelRouting. Two layers, and the difference is the whole safety argument. Layer 1 chooses a rung INSIDE the Anthropic ladder and writes to the existing PHASE_MODEL_OVERRIDE seam - no new network path, no new account. Layer 2 would send a call to a non-Anthropic provider, and no call site can do that yet: a subagent is dispatched by the host, bulk-read.sh shells out to `claude -p --model <rung>`, and research_ask runs in the MCP server and picks its own model. model-dispatch.sh therefore refuses a non-Anthropic rung everywhere and falls to the rule's next rung, because an allowed rung nothing can honour is a rule the user believes worked. `provider` in cost-table.json is the seam a future call site would use. `scope` has no `host-session` member and that absence is enforced here rather than written in prose: rewriting the host's base URL would route the user's ENTIRE session, including work that has nothing to do with this pipeline, through a third layer - breaking the subscription's auth model and silently changing which model answers. Shipping this disabled is the same reasoning as modelFallback.fableEnabled: a cost control that is on by default is not a control.",
+  "description": "Policy-driven model selection, OFF by default. Lives under prefs.global.modelRouting. Two layers, and the difference is the whole safety argument. Layer 1 chooses a rung INSIDE the Anthropic ladder and writes to the existing PHASE_MODEL_OVERRIDE seam - no new network path, no new account. Layer 2 is the `free` rung: a simple text task (a bulk read, a summary, an extraction, a label, a translation draft) goes to the multi-agent-toolkit's verified free-model chain (llm_delegate / multi-agent-toolkit-llm), whose every answer is checked against its source and discarded when it does not hold, with the Anthropic default taking over. It is reachable only where the pipeline makes the call itself (`bulk-read`, `delegate`); a subagent is dispatched by the host, so model-dispatch.sh refuses `free` and every other non-Anthropic rung at the subagent site and falls to the rule's next rung. `scope` has no `host-session` member and that absence is enforced here rather than written in prose: rewriting the host's base URL would route the user's ENTIRE session, including work that has nothing to do with this pipeline, through a third layer - breaking the subscription's auth model and silently changing which model answers. Shipping this disabled is the same reasoning as modelFallback.fableEnabled: a cost control that is on by default is not a control.",
   "type": "object",
   "additionalProperties": false,
   "required": ["enabled"],
@@ -16,16 +16,16 @@
       "type": "string",
       "enum": ["manual", "task-fit", "cost-ceiling"],
       "default": "manual",
-      "description": "manual: only the explicit rules[] apply, nothing is inferred. task-fit: a rule may match on taskKind and the router picks the cheapest rung that clears it. cost-ceiling: rungs downgrade as the run approaches budgetCeilingUsd."
+      "description": "manual: only the explicit rules[] apply, nothing is inferred. task-fit: the matched rule's rungs are tried cheapest first (cost-table.json prices, free first). cost-ceiling: rules apply in order until the run reaches the warn threshold of budgetCeilingUsd, then the cheapest rung is tried first."
     },
     "scope": {
       "type": "array",
       "default": ["subagent"],
       "uniqueItems": true,
-      "description": "Where routing is allowed to act. Every member names a call site the pipeline itself owns. There is deliberately no `host-session` member - see the title description.",
+      "description": "Where routing is allowed to act. Every member names a call site the pipeline itself owns: subagent (persona dispatch, Anthropic rungs only), bulk-read (bulk-read.sh), delegate (simple text tasks the skills hand to llm_delegate), research. There is deliberately no `host-session` member - see the title description.",
       "items": {
         "type": "string",
-        "enum": ["subagent", "bulk-read", "research"]
+        "enum": ["subagent", "bulk-read", "delegate", "research"]
       }
     },
     "rules": {
@@ -42,8 +42,14 @@
             "additionalProperties": false,
             "minProperties": 1,
             "properties": {
-              "persona": { "type": "string" },
-              "phase": { "type": "integer", "minimum": 0, "maximum": 5 },
+              "persona": {
+                "type": "string"
+              },
+              "phase": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 5
+              },
               "taskKind": {
                 "type": "string",
                 "enum": ["bugfix", "feature", "refactor", "chore", "component"]
@@ -54,16 +60,35 @@
             "type": "array",
             "minItems": 1,
             "description": "Rungs in descending preference. Rung NAMES are the contract; model ids are not - they live in cost-table.json and change without a config edit.",
-            "items": { "type": "string" }
+            "items": {
+              "type": "string"
+            }
           }
         }
       }
     },
+    "free": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Layer 2. With enabled:true, the bulk-read and delegate call sites try the free rung before the rule's Anthropic rungs. Written by route-on --free.",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "default": false,
+          "description": "Try the verified free-model chain first at bulk-read and delegate. Ships false."
+        },
+        "allowTraining": {
+          "type": "boolean",
+          "default": false,
+          "description": "Also use free tiers that may train on prompts (Mistral, Gemini) or whose data use is unknown. false keeps text to providers that do not (Groq) and a local Ollama."
+        }
+      }
+    },
     "budgetCeilingUsd": {
       "type": ["number", "null"],
       "default": null,
       "minimum": 0,
-      "description": "Only consulted by the cost-ceiling strategy. null means no ceiling, which is not the same as a ceiling of 0."
+      "description": "Only consulted by the cost-ceiling strategy, through cost-budget-check.mjs against the run's tracker. null means no ceiling, which is not the same as a ceiling of 0."
     },
     "recordDecisions": {
       "type": "boolean",

package/pipeline/schemas/secret-patterns.json

@@ -78,6 +78,20 @@
       "len": 36,
       "suffix": ""
     },
+    {
+      "id": "groq",
+      "prefix": "gsk_",
+      "fill": "A",
+      "len": 52,
+      "suffix": ""
+    },
+    {
+      "id": "openrouter",
+      "prefix": "sk-or-v1-",
+      "fill": "a",
+      "len": 64,
+      "suffix": ""
+    },
     {
       "id": "huggingface",
       "prefix": "hf_",

package/pipeline/scripts/_code-graph.mjs

@@ -35,7 +35,7 @@ import { isExcludedBy } from "./_path-match.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-export const GRAPH_SCHEMA_VERSION = "1.0.0";
+export const GRAPH_SCHEMA_VERSION = "1.1.0";
 
 /**
  * Stack words the pipeline uses elsewhere, mapped to the rule-file id.
@@ -256,6 +256,74 @@ function indentOf(text, index) {
   return i - start;
 }
 
+const leading = (line) => line.length - line.replace(/^[ \t]+/, "").length;
+const ATTRIBUTE_RE = /^[ \t]*@/;
+const CLOSER_RE = /^[ \t]*[}\])]/;
+const OPENS_BLOCK_RE = /(?:[{:=]|=>|->)[ \t]*$/;
+const DIRECTIVE_RE = /^#(?:if|elseif|else|endif)\b/;
+const STORED_PROPERTY_RE = /\b(?:var|let|val)\b/;
+
+/**
+ * Give every definition a span: `startLine` (the declaration line, or the first
+ * of the attribute or decorator lines directly above it, never a stored
+ * property) and `endLine` (the last line indented deeper than the declaration,
+ * plus a closing bracket at the declaration's own indentation when one
+ * follows). A closing bracket that opens the body again - the end of a
+ * multi-line parameter list, `) -> Int {`, `):`, `) : Base() {` - continues the
+ * span, and compiler directives in column 0 (`#if`, `#endif`) are skipped like
+ * blank lines. Code after the span, at the same or a lower indentation,
+ * belongs to no declaration until the next one starts.
+ *
+ * Indentation is the nesting signal the engine already trusts (see indentOf),
+ * so this needs no parser and holds for Python as well as the brace languages.
+ *
+ * @param {Array<{line: number, indent: number}>} definitions - mutated in place
+ * @param {string[]} lines - the stripped body, one entry per source line
+ */
+export function assignSpans(definitions, lines) {
+  for (const d of definitions) {
+    let start = d.line;
+    while (start > 1) {
+      const above = lines[start - 2];
+      if (
+        !ATTRIBUTE_RE.test(above) ||
+        leading(above) !== d.indent ||
+        STORED_PROPERTY_RE.test(above)
+      )
+        break;
+      start--;
+    }
+    d.startLine = start;
+  }
+  const ordered = [...definitions].sort((a, b) => a.line - b.line || a.indent - b.indent);
+  for (let i = 0; i < ordered.length; i++) {
+    const d = ordered[i];
+    let limit = lines.length;
+    for (let j = i + 1; j < ordered.length; j++) {
+      if (ordered[j].line > d.line && ordered[j].indent <= d.indent) {
+        limit = ordered[j].startLine - 1;
+        break;
+      }
+    }
+    let end = d.line;
+    for (let n = d.line + 1; n <= limit; n++) {
+      const text = lines[n - 1];
+      if (!text.trim() || DIRECTIVE_RE.test(text)) continue;
+      const ind = leading(text);
+      if (ind > d.indent) {
+        end = n;
+        continue;
+      }
+      if (ind === d.indent && CLOSER_RE.test(text)) {
+        end = n;
+        if (OPENS_BLOCK_RE.test(text)) continue;
+      }
+      break;
+    }
+    d.endLine = end;
+  }
+}
+
 /**
  * Extract one file's definitions, imports and identifier set.
  *
@@ -303,11 +371,14 @@ export function extractFile(text, rules) {
         kind: pattern.kind || pattern.id,
         patternId: pattern.id,
         line: lineOf(body, m.index),
+        indent: indentOf(body, m.index),
         nested: indentOf(body, m.index) > 0,
       });
     }
   }
 
+  assignSpans(definitions, body.split("\n"));
+  for (const d of definitions) delete d.indent;
   return { definitions, imports, tokens: identifiers(body) };
 }
 
@@ -325,11 +396,11 @@ export function extractFile(text, rules) {
 export function listSourceFiles(root, rules) {
   let candidates;
   try {
-    const out = execFileSync("git", ["-C", root, "ls-files", "-co", "--exclude-standard"], {
+    const out = execFileSync("git", ["-C", root, "ls-files", "-z", "-co", "--exclude-standard"], {
       encoding: "utf8",
       maxBuffer: 64 * 1024 * 1024,
     });
-    candidates = out.split("\n").filter(Boolean);
+    candidates = out.split("\0").filter(Boolean);
   } catch {
     candidates = walkDir(root, root);
   }
@@ -427,6 +498,8 @@ export function buildGraph({
           name: def.name,
           path,
           line: def.line,
+          ...(def.endLine ? { endLine: def.endLine } : {}),
+          ...(def.startLine && def.startLine !== def.line ? { startLine: def.startLine } : {}),
           symbolKind: def.kind,
           isTest: isTestPath(path, rules),
           nested: def.nested === true,