@piagent/platform 1.2.8 → 1.2.10

package/packages/piagent-core/extensions/context-engine.js

@@ -3,6 +3,13 @@ import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 
+import {
+  contextIndexExcludeDigest,
+  contextIndexExcludePolicyVersion,
+  normalizeContextIndexExcludePatterns
+} from "./context-index-policy.js";
+import { matchesProtectedPath } from "./policy-core.js";
+
 const INDEX_SCHEMA_VERSION = 2;
 const TELEMETRY_SCHEMA_VERSION = 1;
 const RRF_K = 60;
@@ -64,6 +71,13 @@ function clampInteger(value, fallback, min, max) {
   return Math.max(min, Math.min(max, Math.trunc(number)));
 }
 
+function requireExplicitExcludePatterns(options, operation) {
+  if (!Array.isArray(options?.excludePatterns)) {
+    throw new TypeError(`${operation} requires an explicit excludePatterns array`);
+  }
+  return normalizeContextIndexExcludePatterns(options.excludePatterns);
+}
+
 export function estimateContextTokens(value) {
   return Math.max(0, Math.ceil(String(value ?? "").length / 4));
 }
@@ -78,6 +92,21 @@ export function contextEnginePaths(cwd) {
   };
 }
 
+function hardenContextDatabaseArtifacts(cwd) {
+  const database = contextEnginePaths(cwd).database;
+  for (const artifact of [database, `${database}-wal`, `${database}-shm`]) {
+    try {
+      const stat = fs.lstatSync(artifact);
+      if (!stat.isFile()) {
+        throw new Error(`Context index storage path must be a regular file: ${artifact}`);
+      }
+      fs.chmodSync(artifact, 0o600);
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+    }
+  }
+}
+
 async function loadSqlite() {
   if (!sqliteModulePromise) {
     sqliteModulePromise = (async () => {
@@ -103,53 +132,85 @@ async function loadSqlite() {
 async function openDatabase(cwd, { create = true } = {}) {
   const paths = contextEnginePaths(cwd);
   if (!create && !fs.existsSync(paths.database)) return undefined;
-  fs.mkdirSync(paths.root, { recursive: true });
+  fs.mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+  if (!fs.lstatSync(paths.root).isDirectory()) {
+    throw new Error(`Context index storage root must be a directory: ${paths.root}`);
+  }
+  fs.chmodSync(paths.root, 0o700);
+  hardenContextDatabaseArtifacts(cwd);
+  const descriptor = fs.openSync(
+    paths.database,
+    fs.constants.O_RDWR
+      | (create ? fs.constants.O_CREAT : 0)
+      | (fs.constants.O_NOFOLLOW ?? 0),
+    0o600
+  );
+  try {
+    fs.fchmodSync(descriptor, 0o600);
+  } finally {
+    fs.closeSync(descriptor);
+  }
   const { DatabaseSync } = await loadSqlite();
   const db = new DatabaseSync(paths.database);
-  db.exec(`
-    PRAGMA journal_mode = WAL;
-    PRAGMA synchronous = NORMAL;
-    PRAGMA foreign_keys = ON;
-    CREATE TABLE IF NOT EXISTS metadata (
-      key TEXT PRIMARY KEY,
-      value TEXT NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS files (
-      path TEXT PRIMARY KEY,
-      hash TEXT NOT NULL,
-      bytes INTEGER NOT NULL,
-      mtime_ms REAL NOT NULL,
-      language TEXT NOT NULL,
-      indexed_at TEXT NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS symbols (
-      id INTEGER PRIMARY KEY,
-      file_path TEXT NOT NULL REFERENCES files(path) ON DELETE CASCADE,
-      name TEXT NOT NULL,
-      kind TEXT NOT NULL,
-      line INTEGER NOT NULL,
-      end_line INTEGER NOT NULL,
-      signature TEXT NOT NULL
-    );
-    CREATE INDEX IF NOT EXISTS symbols_name_idx ON symbols(name);
-    CREATE INDEX IF NOT EXISTS symbols_file_idx ON symbols(file_path);
-    CREATE TABLE IF NOT EXISTS imports (
-      id INTEGER PRIMARY KEY,
-      file_path TEXT NOT NULL REFERENCES files(path) ON DELETE CASCADE,
-      specifier TEXT NOT NULL,
-      target_path TEXT,
-      line INTEGER NOT NULL
-    );
-    CREATE INDEX IF NOT EXISTS imports_file_idx ON imports(file_path);
-    CREATE INDEX IF NOT EXISTS imports_target_idx ON imports(target_path);
-    CREATE VIRTUAL TABLE IF NOT EXISTS file_fts USING fts5(
-      path UNINDEXED,
-      body,
-      symbol_names,
-      tokenize = 'unicode61 remove_diacritics 2'
-    );
-  `);
-  return db;
+  try {
+    db.exec(`
+      PRAGMA journal_mode = WAL;
+      PRAGMA synchronous = NORMAL;
+      PRAGMA foreign_keys = ON;
+      PRAGMA secure_delete = ON;
+      CREATE TABLE IF NOT EXISTS metadata (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS files (
+        path TEXT PRIMARY KEY,
+        hash TEXT NOT NULL,
+        bytes INTEGER NOT NULL,
+        mtime_ms REAL NOT NULL,
+        language TEXT NOT NULL,
+        indexed_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS symbols (
+        id INTEGER PRIMARY KEY,
+        file_path TEXT NOT NULL REFERENCES files(path) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        line INTEGER NOT NULL,
+        end_line INTEGER NOT NULL,
+        signature TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS symbols_name_idx ON symbols(name);
+      CREATE INDEX IF NOT EXISTS symbols_file_idx ON symbols(file_path);
+      CREATE TABLE IF NOT EXISTS imports (
+        id INTEGER PRIMARY KEY,
+        file_path TEXT NOT NULL REFERENCES files(path) ON DELETE CASCADE,
+        specifier TEXT NOT NULL,
+        target_path TEXT,
+        line INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS imports_file_idx ON imports(file_path);
+      CREATE INDEX IF NOT EXISTS imports_target_idx ON imports(target_path);
+      CREATE VIRTUAL TABLE IF NOT EXISTS file_fts USING fts5(
+        path UNINDEXED,
+        body,
+        symbol_names,
+        tokenize = 'unicode61 remove_diacritics 2'
+      );
+    `);
+    const ftsSecureDelete = db.prepare(`
+      SELECT v
+      FROM file_fts_config
+      WHERE k = 'secure-delete'
+    `).get();
+    if (Number(ftsSecureDelete?.v) !== 1) {
+      db.exec("INSERT INTO file_fts(file_fts, rank) VALUES('secure-delete', 1)");
+    }
+    hardenContextDatabaseArtifacts(cwd);
+    return db;
+  } catch (error) {
+    db.close();
+    throw error;
+  }
 }
 
 function metadataMap(db) {
@@ -184,41 +245,28 @@ function shouldIndexPath(relativePath, options) {
   const segments = rel.split("/");
   if (segments.some((segment) => IGNORED_SEGMENTS.has(segment))) return false;
   if (SECRET_FILE_PATTERNS.some((pattern) => pattern.test(rel))) return false;
-  if ((options.excludePatterns ?? []).some((pattern) => simpleGlobMatch(rel, pattern))) return false;
+  if (matchesProtectedPath(rel, options.excludePatterns ?? [])) return false;
   const name = path.posix.basename(rel);
   return SOURCE_NAMES.has(name) || SOURCE_EXTENSIONS.has(path.posix.extname(name).toLowerCase());
 }
 
-function simpleGlobMatch(relativePath, pattern) {
-  const rel = normalizeRelative(relativePath);
-  const normalized = normalizeRelative(pattern);
-  let source = "";
-  for (let index = 0; index < normalized.length; index += 1) {
-    const char = normalized[index];
-    if (char === "*" && normalized[index + 1] === "*") {
-      if (normalized[index + 2] === "/") {
-        source += "(?:.*/)?";
-        index += 2;
-      } else {
-        source += ".*";
-        index += 1;
-      }
-      continue;
-    }
-    if (char === "*") {
-      source += "[^/]*";
-      continue;
-    }
-    if (char === "?") {
-      source += "[^/]";
-      continue;
-    }
-    source += /[.+^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
-  }
+function projectFileInfo(cwd, relativePath, root = fs.realpathSync.native(cwd), directoryCache = new Map()) {
+  const expected = path.resolve(root, relativePath);
+  if (expected !== root && !expected.startsWith(`${root}${path.sep}`)) return undefined;
   try {
-    return new RegExp(`^${source}$`, "i").test(rel);
+    const directPath = path.resolve(cwd, relativePath);
+    const directParent = path.dirname(directPath);
+    let canonicalParent = directoryCache.get(directParent);
+    if (canonicalParent === undefined) {
+      canonicalParent = fs.realpathSync.native(directParent);
+      directoryCache.set(directParent, canonicalParent);
+    }
+    if (canonicalParent !== path.dirname(expected)) return undefined;
+    const direct = fs.lstatSync(directPath);
+    if (direct.isSymbolicLink() || !direct.isFile()) return undefined;
+    return { absolute: expected, stat: direct };
   } catch {
-    return rel === normalized;
+    return undefined;
   }
 }
 
@@ -463,13 +511,20 @@ export function classifyContextTask(prompt) {
 }
 
 export async function buildContextIndexV2(cwd, options = {}) {
+  const excludePatterns = requireExplicitExcludePatterns(options, "buildContextIndexV2");
+  const excludeDigest = contextIndexExcludeDigest(excludePatterns);
   const startedAt = Date.now();
+  const projectRoot = fs.realpathSync.native(cwd);
+  const directoryCache = new Map();
   const maxFiles = clampInteger(options.maxFiles, DEFAULT_MAX_FILES, 1, 50_000);
   const maxFileBytes = clampInteger(options.maxFileBytes, DEFAULT_MAX_FILE_BYTES, 1_024, 2 * 1024 * 1024);
   const listed = gitFileList(cwd) ?? walkedFileList(cwd, maxFiles);
-  const candidates = listed.filter((file) => shouldIndexPath(file, options)).slice(0, maxFiles).sort();
+  const candidates = listed.filter((file) => shouldIndexPath(file, { ...options, excludePatterns })).slice(0, maxFiles).sort();
   const db = await openDatabase(cwd);
+  const previousMetadata = metadataMap(db);
   const existing = new Map(db.prepare("SELECT path, hash, bytes, mtime_ms FROM files").all().map((row) => [row.path, row]));
+  const purgeStaleContent = Boolean(previousMetadata.builtAt || existing.size > 0)
+    && (previousMetadata.purgePending === "1" || previousMetadata.excludeDigest !== excludeDigest);
   const current = new Set();
   const currentHashes = new Map();
   const changed = [];
@@ -480,18 +535,12 @@ export async function buildContextIndexV2(cwd, options = {}) {
   const skippedPaths = [];
 
   for (const relativePath of candidates) {
-    const absolute = path.resolve(cwd, relativePath);
-    if (!absolute.startsWith(`${path.resolve(cwd)}${path.sep}`) && absolute !== path.resolve(cwd)) continue;
-    let stat;
-    try {
-      stat = fs.statSync(absolute);
-      if (!stat.isFile()) continue;
-      if (stat.size > maxFileBytes) {
-        skippedLarge += 1;
-        skippedPaths.push(relativePath);
-        continue;
-      }
-    } catch {
+    const file = projectFileInfo(cwd, relativePath, projectRoot, directoryCache);
+    if (!file) continue;
+    const { absolute, stat } = file;
+    if (stat.size > maxFileBytes) {
+      skippedLarge += 1;
+      skippedPaths.push(relativePath);
       continue;
     }
     const previous = existing.get(relativePath);
@@ -527,8 +576,10 @@ export async function buildContextIndexV2(cwd, options = {}) {
   }
 
   const removed = [...existing.keys()].filter((file) => !current.has(file));
-  db.exec("BEGIN IMMEDIATE");
+  let transactionOpen = false;
   try {
+    db.exec("BEGIN IMMEDIATE");
+    transactionOpen = true;
     const deleteFile = db.prepare("DELETE FROM files WHERE path = ?");
     const deleteFts = db.prepare("DELETE FROM file_fts WHERE path = ?");
     for (const relativePath of [...removed, ...changed.map((item) => item.relativePath)]) {
@@ -575,11 +626,29 @@ export async function buildContextIndexV2(cwd, options = {}) {
       symbolCount: counts.symbols,
       importCount: counts.imports,
       maxFileBytes,
-      excludePatterns: JSON.stringify(options.excludePatterns ?? []),
+      excludePatterns: JSON.stringify(excludePatterns),
+      excludeDigest,
+      excludePolicyVersion: contextIndexExcludePolicyVersion(),
+      purgePending: purgeStaleContent ? 1 : 0,
       skippedPaths: JSON.stringify(skippedPaths)
     });
     db.exec("COMMIT");
-    db.close();
+    transactionOpen = false;
+    if (purgeStaleContent) {
+      if (typeof options.onPurgeStart === "function") await options.onPurgeStart();
+      db.exec("INSERT INTO file_fts(file_fts) VALUES('rebuild')");
+      db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+      db.exec("VACUUM");
+      db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+      db.exec("BEGIN IMMEDIATE");
+      transactionOpen = true;
+      setMetadata(db, {
+        purgePending: 0,
+        purgedAt: nowIso()
+      });
+      db.exec("COMMIT");
+      transactionOpen = false;
+    }
     return {
       schemaVersion: INDEX_SCHEMA_VERSION,
       builtAt: indexedAt,
@@ -590,19 +659,35 @@ export async function buildContextIndexV2(cwd, options = {}) {
       removed: removed.length,
       skippedLarge,
       skippedBinary,
+      purgedStaleContent: purgeStaleContent,
       ...counts
     };
   } catch (error) {
-    db.exec("ROLLBACK");
-    db.close();
+    if (transactionOpen) db.exec("ROLLBACK");
     throw error;
+  } finally {
+    db.close();
+    hardenContextDatabaseArtifacts(cwd);
   }
 }
 
-export async function contextIndexV2Status(cwd) {
+export async function contextIndexV2Status(cwd, options = {}) {
+  const expectedExcludePatterns = requireExplicitExcludePatterns(options, "contextIndexV2Status");
+  const expectedExcludeDigest = contextIndexExcludeDigest(expectedExcludePatterns);
   const paths = contextEnginePaths(cwd);
+  const projectRoot = fs.realpathSync.native(cwd);
+  const directoryCache = new Map();
   if (!fs.existsSync(paths.database)) {
-    return { schemaVersion: INDEX_SCHEMA_VERSION, exists: false, path: normalizeRelative(path.relative(cwd, paths.database)), warnings: ["index-v2 missing"] };
+    return {
+      schemaVersion: INDEX_SCHEMA_VERSION,
+      exists: false,
+      path: normalizeRelative(path.relative(cwd, paths.database)),
+      stale: false,
+      policyStale: false,
+      expectedExcludeDigest,
+      purgePending: false,
+      warnings: ["index-v2 missing"]
+    };
   }
   const db = await openDatabase(cwd, { create: false });
   try {
@@ -612,24 +697,23 @@ export async function contextIndexV2Status(cwd) {
     const symbols = Number(db.prepare("SELECT COUNT(*) count FROM symbols").get().count);
     const imports = Number(db.prepare("SELECT COUNT(*) count FROM imports").get().count);
     const indexedPaths = new Set(fileRows.map((row) => row.path));
+    const storedExcludeDigest = metadata.excludeDigest;
+    const purgePending = metadata.purgePending === "1";
+    const excludeDigestStale = typeof storedExcludeDigest !== "string"
+      || storedExcludeDigest !== expectedExcludeDigest;
+    const policyStale = purgePending || excludeDigestStale;
     const statChanged = [];
     for (const row of fileRows) {
-      try {
-        const stat = fs.statSync(path.resolve(cwd, row.path));
-        if (!stat.isFile() || stat.size !== Number(row.bytes) || Math.abs(stat.mtimeMs - Number(row.mtime_ms)) >= 0.5) {
-          statChanged.push(row.path);
-        }
-      } catch {
+      if (!shouldIndexPath(row.path, { excludePatterns: expectedExcludePatterns })) continue;
+      const file = projectFileInfo(cwd, row.path, projectRoot, directoryCache);
+      if (
+        !file
+        || file.stat.size !== Number(row.bytes)
+        || Math.abs(file.stat.mtimeMs - Number(row.mtime_ms)) >= 0.5
+      ) {
         statChanged.push(row.path);
       }
     }
-    let excludePatterns = [];
-    try {
-      const parsed = JSON.parse(metadata.excludePatterns ?? "[]");
-      if (Array.isArray(parsed)) excludePatterns = parsed.filter((value) => typeof value === "string");
-    } catch {
-      excludePatterns = [];
-    }
     let skippedPaths = new Set();
     try {
       const parsed = JSON.parse(metadata.skippedPaths ?? "[]");
@@ -639,9 +723,13 @@ export async function contextIndexV2Status(cwd) {
     }
     const listed = gitFileList(cwd);
     const newlyVisible = listed
-      ? listed.filter((file) => !indexedPaths.has(file) && !skippedPaths.has(file) && shouldIndexPath(file, { excludePatterns }))
+      ? listed.filter((file) => !indexedPaths.has(file) && !skippedPaths.has(file) && shouldIndexPath(file, { excludePatterns: expectedExcludePatterns }))
       : [];
     const stalePaths = [...new Set([...statChanged, ...newlyVisible])];
+    const warnings = [];
+    if (purgePending) warnings.push("context index storage purge pending");
+    if (excludeDigestStale) warnings.push("context index exclusion policy changed");
+    if (stalePaths.length > 0) warnings.push(`${stalePaths.length} changed file(s) since the last index build`);
     return {
       schemaVersion: Number(metadata.schemaVersion ?? INDEX_SCHEMA_VERSION),
       exists: true,
@@ -650,15 +738,38 @@ export async function contextIndexV2Status(cwd) {
       files,
       symbols,
       imports,
-      stale: stalePaths.length > 0,
+      stale: policyStale || stalePaths.length > 0,
+      policyStale,
+      purgePending,
+      excludePolicyVersion: metadata.excludePolicyVersion,
+      excludeDigest: storedExcludeDigest,
+      expectedExcludeDigest,
       stalePaths: stalePaths.slice(0, 20),
-      warnings: stalePaths.length > 0 ? [`${stalePaths.length} changed file(s) since the last index build`] : []
+      warnings
     };
   } finally {
     db.close();
   }
 }
 
+export async function ensureContextIndexV2(cwd, options = {}) {
+  const excludePatterns = requireExplicitExcludePatterns(options, "ensureContextIndexV2");
+  let status = await contextIndexV2Status(cwd, { excludePatterns });
+  const reason = options.refresh
+    ? "refresh"
+    : status.policyStale
+      ? "exclusion-policy"
+      : !status.exists && options.rebuildMissing
+        ? "missing"
+        : undefined;
+  let build;
+  if (reason) {
+    build = await buildContextIndexV2(cwd, { ...options, excludePatterns });
+    status = await contextIndexV2Status(cwd, { excludePatterns });
+  }
+  return { status, rebuilt: Boolean(reason), reason, build, excludePatterns };
+}
+
 function addRankedList(scores, rows, source, weight = 1) {
   rows.forEach((row, index) => {
     const filePath = row.path ?? row.file_path;
@@ -783,8 +894,11 @@ function retrievalFeedback(cwd) {
 }
 
 export async function searchContextIndexV2(cwd, query, options = {}) {
+  const excludePatterns = requireExplicitExcludePatterns(options, "searchContextIndexV2");
   const limit = clampInteger(options.limit, 12, 1, 50);
-  const status = await contextIndexV2Status(cwd);
+  const projectRoot = fs.realpathSync.native(cwd);
+  const directoryCache = new Map();
+  const status = await contextIndexV2Status(cwd, { excludePatterns });
   if (!status.exists) return { query, terms: [], confidence: "none", results: [], status };
   const terms = tokenizeQuery(query);
   const explicitPaths = queryPathCandidates(query);
@@ -792,7 +906,8 @@ export async function searchContextIndexV2(cwd, query, options = {}) {
   const db = await openDatabase(cwd, { create: false });
   try {
     const scores = new Map();
-    const allFiles = db.prepare("SELECT path, mtime_ms FROM files").all();
+    const pathAllowed = (filePath) => shouldIndexPath(filePath, { excludePatterns });
+    const allFiles = db.prepare("SELECT path, mtime_ms FROM files").all().filter((file) => pathAllowed(file.path));
     const explicitRows = [];
     for (const file of allFiles) {
       const basename = path.posix.basename(file.path).toLowerCase();
@@ -809,7 +924,7 @@ export async function searchContextIndexV2(cwd, query, options = {}) {
       lexicalRows = db.prepare(`
         SELECT path, bm25(file_fts, 0.0, 1.0, 2.2) lexical_score
         FROM file_fts WHERE file_fts MATCH ? ORDER BY lexical_score LIMIT ?
-      `).all(ftsQuery(terms), Math.max(limit * 4, 30));
+      `).all(ftsQuery(terms), Math.max(limit * 4, 30)).filter((row) => pathAllowed(row.path));
       addRankedList(scores, lexicalRows, "lexical", 1.5);
     }
 
@@ -820,7 +935,7 @@ export async function searchContextIndexV2(cwd, query, options = {}) {
       ORDER BY CASE WHEN lower(name) = ? THEN 0 ELSE 1 END, length(name) LIMIT ?
     `);
     for (const term of terms.slice(0, 8)) {
-      symbolRows.push(...symbolStatement.all(term, `%${term}%`, term, Math.max(limit * 2, 20)));
+      symbolRows.push(...symbolStatement.all(term, `%${term}%`, term, Math.max(limit * 2, 20)).filter((row) => pathAllowed(row.file_path)));
     }
     const dedupedSymbols = [...new Map(symbolRows.map((row) => [`${row.file_path}:${row.line}`, row])).values()];
     addRankedList(scores, dedupedSymbols, "symbol", 2.2);
@@ -841,11 +956,19 @@ export async function searchContextIndexV2(cwd, query, options = {}) {
     addRankedList(scores, feedbackRows, "feedback", 0.45);
 
     const graphSeeds = new Map([...scores.entries()].map(([filePath, value]) => [filePath, value.score]));
-    const importRows = db.prepare("SELECT file_path, target_path FROM imports WHERE target_path IS NOT NULL").all();
+    const importRows = db.prepare("SELECT file_path, target_path FROM imports WHERE target_path IS NOT NULL")
+      .all()
+      .filter((row) => pathAllowed(row.file_path) && pathAllowed(row.target_path));
     const graphRows = personalizedPageRank(importRows, graphSeeds).slice(0, Math.max(limit * 3, 30));
     addRankedList(scores, graphRows, "graph", 1);
 
-    const ranked = [...scores.values()].sort((left, right) => right.score - left.score).slice(0, limit);
+    const ranked = [...scores.values()]
+      .filter((candidate) => (
+        shouldIndexPath(candidate.path, { excludePatterns })
+        && projectFileInfo(cwd, candidate.path, projectRoot, directoryCache)
+      ))
+      .sort((left, right) => right.score - left.score)
+      .slice(0, limit);
     const symbolLookup = db.prepare("SELECT name, kind, line, end_line, signature FROM symbols WHERE file_path = ? ORDER BY line LIMIT 12");
     const results = ranked.map((candidate) => {
       const matchingSymbols = candidate.rows
@@ -897,9 +1020,15 @@ function lineRangesForFile(text, result, terms, includeCode) {
 }
 
 export async function buildContextPack(cwd, query, options = {}) {
+  const excludePatterns = requireExplicitExcludePatterns(options, "buildContextPack");
   const budgetTokens = clampInteger(options.budgetTokens, DEFAULT_PACK_TOKENS, 200, 50_000);
   const includeCode = options.includeCode !== false;
-  const search = await searchContextIndexV2(cwd, query, { limit: clampInteger(options.limit, 16, 1, 50) });
+  const projectRoot = fs.realpathSync.native(cwd);
+  const directoryCache = new Map();
+  const search = await searchContextIndexV2(cwd, query, {
+    limit: clampInteger(options.limit, 16, 1, 50),
+    excludePatterns
+  });
   const selected = [];
   const mapBudget = Math.min(1_200, Math.max(40, Math.trunc(budgetTokens * 0.2)));
   const mapLines = [];
@@ -935,7 +1064,9 @@ export async function buildContextPack(cwd, query, options = {}) {
   for (const result of search.results) {
     let text;
     try {
-      text = fs.readFileSync(path.resolve(cwd, result.path), "utf8");
+      const file = projectFileInfo(cwd, result.path, projectRoot, directoryCache);
+      if (!file) continue;
+      text = fs.readFileSync(file.absolute, "utf8");
     } catch {
       continue;
     }
@@ -979,7 +1110,10 @@ export async function buildContextPack(cwd, query, options = {}) {
 }
 
 export async function buildTestImpact(cwd, changedFiles = [], options = {}) {
-  const status = await contextIndexV2Status(cwd);
+  const excludePatterns = requireExplicitExcludePatterns(options, "buildTestImpact");
+  const projectRoot = fs.realpathSync.native(cwd);
+  const directoryCache = new Map();
+  const status = await contextIndexV2Status(cwd, { excludePatterns });
   const normalizedChanged = [...new Set((changedFiles.length > 0 ? changedFiles : gitChangedFiles(cwd)).map(normalizeRelative).filter(Boolean))];
   if (!status.exists) return { changedFiles: normalizedChanged, impactedFiles: [], tests: [], status };
   const db = await openDatabase(cwd, { create: false });
@@ -993,13 +1127,22 @@ export async function buildTestImpact(cwd, changedFiles = [], options = {}) {
       const current = queue.shift();
       if (current.depth >= maxDepth) continue;
       for (const row of reverseStatement.all(current.filePath)) {
+        if (
+          !shouldIndexPath(row.file_path, { excludePatterns })
+          || !projectFileInfo(cwd, row.file_path, projectRoot, directoryCache)
+        ) continue;
         if (seen.has(row.file_path)) continue;
         seen.add(row.file_path);
         impacted.push({ path: row.file_path, via: current.filePath, depth: current.depth + 1 });
         queue.push({ filePath: row.file_path, depth: current.depth + 1 });
       }
     }
-    const allFiles = db.prepare("SELECT path FROM files").all().map((row) => row.path);
+    const allFiles = db.prepare("SELECT path FROM files").all()
+      .map((row) => row.path)
+      .filter((filePath) => (
+        shouldIndexPath(filePath, { excludePatterns })
+        && projectFileInfo(cwd, filePath, projectRoot, directoryCache)
+      ));
     const stemTerms = normalizedChanged.flatMap((filePath) => {
       const basename = path.posix.basename(filePath, path.posix.extname(filePath)).replace(/\.(?:test|spec)$/, "");
       return basename.split(/[-_.]/).filter((term) => term.length >= 3);