@remnic/coding-graph 9.6.23 → 9.6.24

package/src/engine/extractors.ts

@@ -56,15 +56,25 @@ const JS_FAMILY_DEFINITIONS = `
 const JS_IMPORTS = `
 (import_statement
   source: (string (string_fragment) @import.module)) @__import.stmt
+; Default and namespace imports bind LOCAL aliases whose exported symbol
+; is unknowable to Phase A (issue #1894 round 12): they appear in
+; importedNames (informational) but never in bindings (call-bindable).
 (import_statement
-  (import_clause (identifier) @import.name)
+  (import_clause (identifier) @import.unboundName)
   source: (string (string_fragment) @import.module)) @__import.stmt
 (import_statement
-  (import_clause (namespace_import (identifier) @import.name))
+  (import_clause (namespace_import (identifier) @import.unboundName))
   source: (string (string_fragment) @import.module)) @__import.stmt
 (import_statement
   (import_clause (named_imports (import_specifier name: (identifier) @import.name)))
   source: (string (string_fragment) @import.module)) @__import.stmt
+; Aliased named import (issue #1894 review): import { foo as bar } — the
+; local binding is the alias; the exported name stays the binding target.
+(import_statement
+  (import_clause (named_imports (import_specifier
+    name: (identifier) @import.aliasExported
+    alias: (identifier) @import.aliasLocal)))
+  source: (string (string_fragment) @import.module)) @__import.stmt
 
 ; CommonJS require("...") — capture the module specifier so dependency
 ; edges exist for Node/CommonJS codebases, not just ES-module imports.
@@ -130,7 +140,10 @@ const JS_EXPORTS = `
 
 const JS_CALLS = `
 (call_expression function: (identifier) @call.callee)
-(call_expression function: (member_expression property: (property_identifier) @call.callee))
+; Member calls are captured separately (issue #1894 review): obj.save()'s
+; \`save\` must never bind a bare visible symbol — method dispatch is
+; Phase B (LSP) territory. The emit layer marks these memberAccess: true.
+(call_expression function: (member_expression property: (property_identifier) @call.member))
 `.trim();
 
 const JS_ROUTES = `
@@ -187,6 +200,17 @@ const PYTHON_EXTRACTOR: LanguageExtractor = {
   importsQuery: `
 (import_statement (dotted_name) @import.module) @__import.stmt
 (import_from_statement module_name: (dotted_name) @import.module) @__import.stmt
+; Imported names (issue #1894 review round 7): without these captures,
+; extractImports emits importedNames: [] and the heuristic resolver's
+; import bindings never fire for real Python parses.
+(import_from_statement
+  module_name: (dotted_name) @import.module
+  name: (dotted_name) @import.name) @__import.stmt
+(import_from_statement
+  module_name: (dotted_name) @import.module
+  name: (aliased_import
+    name: (dotted_name) @import.aliasExported
+    alias: (identifier) @import.aliasLocal)) @__import.stmt
 ; Python relative imports: from .models import User / from ..parent import X
 ; tree-sitter-python wraps the module inside a relative_import node, so the
 ; module_name field is NOT set. Capture the relative_import node itself so
@@ -194,11 +218,19 @@ const PYTHON_EXTRACTOR: LanguageExtractor = {
 ; relative levels must not collapse to the same module name
 ; (chatgpt-codex-connector #1688 P2: 'Preserve dots in Python relative imports').
 (import_from_statement (relative_import) @import.module) @__import.stmt
+(import_from_statement
+  (relative_import) @import.module
+  name: (dotted_name) @import.name) @__import.stmt
+(import_from_statement
+  (relative_import) @import.module
+  name: (aliased_import
+    name: (dotted_name) @import.aliasExported
+    alias: (identifier) @import.aliasLocal)) @__import.stmt
 `.trim(),
   exportsQuery: ``,
   callSitesQuery: `
 (call function: (identifier) @call.callee)
-(call function: (attribute attribute: (identifier) @call.callee))
+(call function: (attribute attribute: (identifier) @call.member))
 `.trim(),
   routesQuery: `
 (decorated_definition
@@ -235,7 +267,7 @@ const GO_EXTRACTOR: LanguageExtractor = {
   exportsQuery: ``,
   callSitesQuery: `
 (call_expression function: (identifier) @call.callee)
-(call_expression function: (selector_expression field: (field_identifier) @call.callee))
+(call_expression function: (selector_expression field: (field_identifier) @call.member))
 `.trim(),
   routesQuery: ``,
 };
@@ -271,7 +303,7 @@ const RUST_EXTRACTOR: LanguageExtractor = {
   exportsQuery: ``,
   callSitesQuery: `
 (call_expression function: (identifier) @call.callee)
-(call_expression function: (field_expression field: (field_identifier) @call.callee))
+(call_expression function: (field_expression field: (field_identifier) @call.member))
 (call_expression function: (scoped_identifier) @call.callee)
 `.trim(),
   routesQuery: ``,
@@ -291,7 +323,8 @@ const JAVA_EXTRACTOR: LanguageExtractor = {
 `.trim(),
   exportsQuery: ``,
   callSitesQuery: `
-(method_invocation name: (identifier) @call.callee)
+(method_invocation !object name: (identifier) @call.callee)
+(method_invocation object: (_) name: (identifier) @call.member)
 `.trim(),
   routesQuery: ``,
 };
@@ -331,7 +364,7 @@ const CPP_EXTRACTOR: LanguageExtractor = {
   exportsQuery: ``,
   callSitesQuery: `
 (call_expression function: (identifier) @call.callee)
-(call_expression function: (field_expression field: (field_identifier) @call.callee))
+(call_expression function: (field_expression field: (field_identifier) @call.member))
 `.trim(),
   routesQuery: ``,
 };
@@ -351,7 +384,7 @@ const CSHARP_EXTRACTOR: LanguageExtractor = {
   exportsQuery: ``,
   callSitesQuery: `
 (invocation_expression function: (identifier) @call.callee)
-(invocation_expression function: (member_access_expression name: (identifier) @call.callee))
+(invocation_expression function: (member_access_expression name: (identifier) @call.member))
 `.trim(),
   routesQuery: ``,
 };
@@ -371,7 +404,8 @@ const RUBY_EXTRACTOR: LanguageExtractor = {
 `.trim(),
   exportsQuery: ``,
   callSitesQuery: `
-(call method: (identifier) @call.callee)
+(call !receiver method: (identifier) @call.callee)
+(call receiver: (_) method: (identifier) @call.member)
 `.trim(),
   routesQuery: ``,
 };
@@ -390,7 +424,7 @@ const PHP_EXTRACTOR: LanguageExtractor = {
   exportsQuery: ``,
   callSitesQuery: `
 (function_call_expression function: (name) @call.callee)
-(member_call_expression (name) @call.callee)
+(member_call_expression (name) @call.member)
 `.trim(),
   routesQuery: ``,
 };

package/src/graph-store.ts

@@ -134,6 +134,23 @@ export interface EdgeIR {
   readonly srcNodeId?: string;
   /** Optional content-derived destination node id — see {@link EdgeIR.srcNodeId}. */
   readonly dstNodeId?: string;
+  /**
+   * Repo-relative, extension-stripped path the dst must live in (issue
+   * #1894 review): derived from a relative import's module specifier. A
+   * hinted edge resolves ONLY among nodes whose file path matches the
+   * hint (`<hint>`, `<hint>.<ext>`, `<hint>/index.<ext>`, or
+   * `<hint>/__init__.<ext>`) — never via
+   * the global bare-name fallback — so `import { foo } from "./missing"`
+   * can never bind an unrelated same-named symbol elsewhere in the repo.
+   */
+  readonly dstPathHint?: string;
+  /**
+   * Language of the importing file (issue #1894 round 13): constrains the
+   * hinted dst's file extension to that language's module-resolution set
+   * so a polyglot repo cannot cross-bind a JS import to a same-named .py
+   * file.
+   */
+  readonly dstImporterLanguage?: string;
 }
 
 /**
@@ -159,6 +176,16 @@ export interface StoreFileIR {
   readonly symbols: readonly SymbolIR[];
   /** Store-specific edges derived from the IR by the caller. */
   readonly edges?: readonly EdgeIR[];
+  /**
+   * When present, the stale-edge delete in `upsertFileEdges` is scoped to
+   * edges whose provenance is in this list: prior src-owned edges of OTHER
+   * provenances survive un-asserted (issue #1891). The reindex pipeline
+   * asserts `["heuristic"]` because a fresh parse says nothing about
+   * `trace`/`lsp` edges; deleting them on every re-ingest would destroy
+   * state the parse never contradicted (rule 25). Absent = legacy
+   * behavior: every stale src-owned edge is deleted.
+   */
+  readonly assertedEdgeProvenances?: readonly EdgeProvenance[];
   /**
    * Per-file export list (mirrors core FileIR.exports). When present,
    * the write pipeline marks every node in this file whose `name`
@@ -1752,12 +1779,18 @@ export class GraphStore {
       // re-ingest (chatgpt-codex-connector P2).
       const srcId = qualifiedNameToId.get(edge.srcQualifiedName);
       if (!srcId) continue;
-      // DST may be cross-file — use the full-DB fallback.
-      const dstId = resolveNodeId(
-        edge.dstQualifiedName,
-        qualifiedNameToId,
-        this.db,
-      );
+      // DST may be cross-file. A path-hinted edge (relative import,
+      // issue #1894 review) resolves ONLY within its declared target
+      // file — never via the global bare-name fallback; unhinted edges
+      // keep the batch-map + full-DB fallback.
+      const dstId = edge.dstPathHint
+        ? resolveNodeIdWithPathHint(
+            edge.dstQualifiedName,
+            edge.dstPathHint,
+            this.db,
+            edge.dstImporterLanguage,
+          )
+        : resolveNodeId(edge.dstQualifiedName, qualifiedNameToId, this.db);
       if (!dstId) continue;
       const key = `${srcId}\u0000${dstId}\u0000${edge.type}`;
       assertedKeys.add(key);
@@ -1788,12 +1821,24 @@ export class GraphStore {
     );
     const priorByKey = new Map<string, { confidence: number; provenance: string }>();
     const staleSrcDstTypes: Array<{ src: string; dst: string; type: string }> = [];
+    // Provenance scoping (issue #1891): when the IR declares which
+    // provenances it asserts, stale edges of OTHER provenances are not
+    // this ingest's to delete — a fresh parse contradicts only its own
+    // derivation class (rule 25). Absent = legacy delete-all-stale.
+    // An EMPTY scope array is treated as absent (cursor review round 9):
+    // "[]" would otherwise be truthy, protect every prior edge from
+    // deletion AND from updates, and silently disable cleanup — an
+    // assertion that scopes nothing scopes nothing.
+    const scoped =
+      ir.assertedEdgeProvenances && ir.assertedEdgeProvenances.length > 0
+        ? ir.assertedEdgeProvenances
+        : undefined;
     for (const p of priorEdges) {
       const key = `${p.src}\u0000${p.dst}\u0000${p.type}`;
       priorByKey.set(key, { confidence: p.confidence, provenance: p.provenance });
-      if (!assertedKeys.has(key)) {
-        staleSrcDstTypes.push({ src: p.src, dst: p.dst, type: p.type });
-      }
+      if (assertedKeys.has(key)) continue;
+      if (scoped && !(scoped as readonly string[]).includes(p.provenance)) continue;
+      staleSrcDstTypes.push({ src: p.src, dst: p.dst, type: p.type });
     }
 
     // Delete only the stale src-owned edges (prior-but-not-asserted).
@@ -1852,6 +1897,27 @@ export class GraphStore {
         // stale keys.
         continue;
       }
+      // Two update-path protections under provenance scoping (issue
+      // #1891 + #1894 review rounds):
+      //  1. a prior row whose provenance is OUTSIDE the asserted scope
+      //     is not this assertion's to modify (defense in depth — in
+      //     practice cross-provenance key collisions are heuristic/lsp
+      //     only, handled by 2);
+      //  2. an lsp row is a strictly stronger derivation of the SAME
+      //     source-derived edge: re-asserting the heuristic key keeps
+      //     the row alive (it is not stale) but must never downgrade it.
+      //     Retirement of lsp rows happens through the stale-delete when
+      //     the call disappears from the parse — lsp IS in the reindex
+      //     assertion scope precisely so vanished calls retire their
+      //     upgraded rows too.
+      if (
+        prior &&
+        scoped &&
+        (!(scoped as readonly string[]).includes(prior.provenance) ||
+          (prior.provenance === "lsp" && edge.provenance === "heuristic"))
+      ) {
+        continue;
+      }
       const r = insertEdge.run(srcId, dstId, edge.type, edge.confidence, edge.provenance);
       edgeCount += r.changes;
     }
@@ -3289,6 +3355,97 @@ function resolveNodeId(
   return rows[0]?.id;
 }
 
+/**
+ * Resolve a dst node constrained to a path hint (issue #1894 review): the
+ * node's file path must be the hint verbatim, `<hint>.<ext>`,
+ * `<hint>/index.<ext>`, or `<hint>/__init__.<ext>` (Python packages) —
+ * where `<ext>` is a SINGLE dot-free extension segment, so `main.test.ts`
+ * and `main.d.ts` never satisfy a `main` hint (they are not what a module
+ * resolver would load for `./main`). Candidate rows are fetched by
+ * qualified name and the path shape is checked in JS: no LIKE/GLOB, so
+ * hint characters are never pattern metacharacters. Zero or multiple
+ * matches return `undefined` — the edge is dropped rather than guessed
+ * (same conservative policy as {@link resolveNodeId}).
+ */
+/**
+ * Language families and the file extensions a module resolver in that
+ * family accepts (issue #1894 round 13). A polyglot repo cannot let a
+ * JS import bind a same-named .py file: constrain by importer language.
+ */
+const LANG_FAMILY_EXTENSIONS: Record<string, ReadonlySet<string>> = {
+  js: new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "mts", "cts"]),
+  python: new Set(["py", "pyi"]),
+  ruby: new Set(["rb"]),
+  go: new Set(["go"]),
+  rust: new Set(["rs"]),
+  php: new Set(["php"]),
+  java: new Set(["java"]),
+  csharp: new Set(["cs"]),
+  cpp: new Set(["cc", "cpp", "cxx", "c", "hh", "hpp", "hxx", "h"]),
+  kotlin: new Set(["kt"]),
+  swift: new Set(["swift"]),
+  bash: new Set(["sh", "bash"]),
+};
+
+const IMPORTER_LANG_FAMILY: Record<string, keyof typeof LANG_FAMILY_EXTENSIONS> = {
+  typescript: "js",
+  tsx: "js",
+  javascript: "js",
+  python: "python",
+  ruby: "ruby",
+  go: "go",
+  rust: "rust",
+  php: "php",
+  java: "java",
+  csharp: "csharp",
+  c: "cpp",
+  cpp: "cpp",
+  kotlin: "kotlin",
+  swift: "swift",
+  bash: "bash",
+};
+
+function resolveNodeIdWithPathHint(
+  qualifiedName: string,
+  pathHint: string,
+  db: BetterSqlite3Database,
+  importerLanguage?: string,
+): string | undefined {
+  const family = importerLanguage ? IMPORTER_LANG_FAMILY[importerLanguage] : undefined;
+  const allowedExts = family ? LANG_FAMILY_EXTENSIONS[family] : undefined;
+  const rows = expectRows<{ id: string; path: string }>(
+    db
+      .prepare(
+        `SELECT n.id, f.path FROM nodes n JOIN files f ON n.file_id = f.id
+          WHERE n.qualified_name = ?
+          ORDER BY f.path, n.id`,
+      )
+      .all(qualifiedName),
+    ["id", "path"],
+  );
+  const matches = rows.filter((row) => {
+    if (row.path === pathHint) {
+      // Language filter still applies on exact match: a TS import whose
+      // normalized hint happens to equal a bare directory name must not
+      // bind a same-named .py file (codex review round 15).
+      if (allowedExts) {
+        return false; // bare hint with no extension cannot match a family
+      }
+      return true;
+    }
+    if (!row.path.startsWith(pathHint)) return false;
+    const rest = row.path.slice(pathHint.length);
+    const m = /^(?:\.([^./]+)|\/(?:index|__init__)\.([^./]+))$/.exec(rest);
+    if (!m) return false;
+    const ext = m[1] ?? m[2];
+    // When the importer's language family is known, only that family's
+    // extensions may satisfy the hint; otherwise any single extension.
+    return !allowedExts || allowedExts.has(ext);
+  });
+  if (matches.length !== 1) return undefined;
+  return matches[0]?.id;
+}
+
 /**
  * Resolve a standalone-edge endpoint by content-derived node id (issue #1677).
  *