cgraphx 2.0.2 → 2.0.3

package/dist/core/code/engine/config/ignore-service.js

@@ -0,0 +1,511 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createIgnoreFilter = exports.loadIgnoreRules = exports.isHardcodedIgnoredDirectory = exports.shouldIgnorePath = void 0;
+const ignore_1 = __importDefault(require("ignore"));
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const logger_js_1 = require("../core/logger.js");
+const git_js_1 = require("../storage/git.js");
+const DEFAULT_IGNORE_LIST = new Set([
+    // Version Control
+    '.git',
+    '.svn',
+    '.hg',
+    '.bzr',
+    // IDEs & Editors
+    '.idea',
+    '.vscode',
+    '.vs',
+    '.eclipse',
+    '.settings',
+    '.DS_Store',
+    'Thumbs.db',
+    // Dependencies
+    'node_modules',
+    'bower_components',
+    'jspm_packages',
+    'vendor', // PHP/Go
+    'third_party', // C/C++ (Google-style vendored dependencies)
+    '3rdparty', // C/C++ (alternate spelling, also Qt convention)
+    // 'packages' removed - commonly used for monorepo source code (lerna, pnpm, yarn workspaces)
+    'venv',
+    '.venv',
+    'env',
+    '.env',
+    '__pycache__',
+    '.pytest_cache',
+    '.mypy_cache',
+    'site-packages',
+    '.tox',
+    'eggs',
+    '.eggs',
+    'lib64',
+    'parts',
+    'sdist',
+    'wheels',
+    // Build Outputs
+    'dist',
+    'build',
+    'out',
+    'output',
+    'bin',
+    'obj',
+    'target', // Java/Rust
+    '.next',
+    '.nuxt',
+    '.output',
+    '.vercel',
+    '.netlify',
+    '.serverless',
+    '_build',
+    'public/build',
+    '.parcel-cache',
+    '.turbo',
+    '.svelte-kit',
+    // Test & Coverage
+    'coverage',
+    '.nyc_output',
+    'htmlcov',
+    '.coverage',
+    '__tests__', // Often just test files
+    '__mocks__',
+    '.jest',
+    // Logs & Temp
+    'logs',
+    'log',
+    'tmp',
+    'temp',
+    'cache',
+    '.cache',
+    '.tmp',
+    '.temp',
+    // Generated/Compiled
+    '.generated',
+    'generated',
+    'auto-generated',
+    'monaco-workers', // Monaco editor web-worker bundles generated for browser runtime
+    '.terraform',
+    '.serverless',
+    // Documentation (optional - might want to keep)
+    // 'docs',
+    // 'documentation',
+    // Misc
+    '.husky',
+    '.github', // GitHub config, not code
+    '.circleci',
+    '.gitlab',
+    'fixtures', // Test fixtures
+    'snapshots', // Jest snapshots
+    '__snapshots__',
+]);
+const IGNORED_EXTENSIONS = new Set([
+    // Images
+    '.png',
+    '.jpg',
+    '.jpeg',
+    '.gif',
+    '.svg',
+    '.ico',
+    '.webp',
+    '.bmp',
+    '.tiff',
+    '.tif',
+    '.psd',
+    '.ai',
+    '.sketch',
+    '.fig',
+    '.xd',
+    // Archives
+    '.zip',
+    '.tar',
+    '.gz',
+    '.rar',
+    '.7z',
+    '.bz2',
+    '.xz',
+    '.tgz',
+    // Binary/Compiled
+    '.exe',
+    '.dll',
+    '.so',
+    '.dylib',
+    '.a',
+    '.lib',
+    '.o',
+    '.obj',
+    '.class',
+    '.jar',
+    '.war',
+    '.ear',
+    '.pyc',
+    '.pyo',
+    '.pyd',
+    '.beam', // Erlang
+    '.wasm', // WebAssembly - important!
+    '.node', // Native Node addons
+    // Documents
+    '.pdf',
+    '.doc',
+    '.docx',
+    '.xls',
+    '.xlsx',
+    '.ppt',
+    '.pptx',
+    '.odt',
+    '.ods',
+    '.odp',
+    // Media
+    '.mp4',
+    '.mp3',
+    '.wav',
+    '.mov',
+    '.avi',
+    '.mkv',
+    '.flv',
+    '.wmv',
+    '.ogg',
+    '.webm',
+    '.flac',
+    '.aac',
+    '.m4a',
+    // Fonts
+    '.woff',
+    '.woff2',
+    '.ttf',
+    '.eot',
+    '.otf',
+    // Databases
+    '.db',
+    '.sqlite',
+    '.sqlite3',
+    '.mdb',
+    '.accdb',
+    // Minified/Bundled files
+    '.min.js',
+    '.min.css',
+    '.bundle.js',
+    '.chunk.js',
+    // Source maps (debug files, not source)
+    '.map',
+    // Lock files (handled separately, but also here)
+    '.lock',
+    // Certificates & Keys (security - don't index!)
+    '.pem',
+    '.key',
+    '.crt',
+    '.cer',
+    '.p12',
+    '.pfx',
+    // Data files (often large/binary)
+    '.csv',
+    '.tsv',
+    '.parquet',
+    '.avro',
+    '.feather',
+    '.npy',
+    '.npz',
+    '.pkl',
+    '.pickle',
+    '.h5',
+    '.hdf5',
+    // Misc binary
+    '.bin',
+    '.dat',
+    '.data',
+    '.raw',
+    '.iso',
+    '.img',
+    '.dmg',
+]);
+// Files to ignore by exact name
+const IGNORED_FILES = new Set([
+    'package-lock.json',
+    'yarn.lock',
+    'pnpm-lock.yaml',
+    'composer.lock',
+    'Gemfile.lock',
+    'poetry.lock',
+    'Cargo.lock',
+    'go.sum',
+    '.gitignore',
+    '.gitattributes',
+    '.npmrc',
+    '.yarnrc',
+    '.editorconfig',
+    '.prettierrc',
+    '.prettierignore',
+    '.eslintignore',
+    '.dockerignore',
+    'Thumbs.db',
+    '.DS_Store',
+    'LICENSE',
+    'LICENSE.md',
+    'LICENSE.txt',
+    'CHANGELOG.md',
+    'CHANGELOG',
+    'CONTRIBUTING.md',
+    'CODE_OF_CONDUCT.md',
+    'SECURITY.md',
+    '.env',
+    '.env.local',
+    '.env.development',
+    '.env.production',
+    '.env.test',
+    '.env.example',
+]);
+// The hardcoded DEFAULT_IGNORE_LIST is the "safety net" default: directories
+// that are almost never source code (node_modules, .git, dist, __tests__,
+// etc.). Users who legitimately need to index one of these can negate the
+// hardcoded rule via a `!pattern` line in `.cgraphignore` (#771) — same
+// semantics as `.gitignore` negation. That override is applied in
+// `createIgnoreFilter` below; `shouldIgnorePath` itself stays a pure
+// hardcoded-list check so its callers (wiki generator, tests) get
+// deterministic results independent of per-repo config.
+const shouldIgnorePath = (filePath) => {
+    const normalizedPath = filePath.replace(/\\/g, '/');
+    const normalizedPathLower = normalizedPath.toLowerCase();
+    const parts = normalizedPath.split('/');
+    const fileName = parts[parts.length - 1];
+    const fileNameLower = fileName.toLowerCase();
+    // Laravel compiles Blade templates into generated PHP cache files under
+    // storage/framework/views.  Source templates live in resources/views and are
+    // handled separately; compiled cache should not become source-of-truth. Keep
+    // storage/framework/cache parseable unless a separate warning source is proven:
+    // Laravel route/config cache files are ordinary generated PHP, not Blade.
+    if (/(^|\/)storage\/framework\/views(\/|$)/.test(normalizedPathLower)) {
+        return true;
+    }
+    // Check if any path segment is in the hardcoded ignore list.
+    for (const part of parts) {
+        if (DEFAULT_IGNORE_LIST.has(part)) {
+            return true;
+        }
+    }
+    // Check exact filename matches
+    if (IGNORED_FILES.has(fileName) || IGNORED_FILES.has(fileNameLower)) {
+        return true;
+    }
+    // Check extension
+    const lastDotIndex = fileNameLower.lastIndexOf('.');
+    if (lastDotIndex !== -1) {
+        const ext = fileNameLower.substring(lastDotIndex);
+        if (IGNORED_EXTENSIONS.has(ext))
+            return true;
+        // Handle compound extensions like .min.js, .bundle.js
+        const secondLastDot = fileNameLower.lastIndexOf('.', lastDotIndex - 1);
+        if (secondLastDot !== -1) {
+            const compoundExt = fileNameLower.substring(secondLastDot);
+            if (IGNORED_EXTENSIONS.has(compoundExt))
+                return true;
+        }
+    }
+    // Ignore files that look like generated/bundled code
+    if (fileNameLower.includes('.bundle.') ||
+        fileNameLower.includes('.chunk.') ||
+        fileNameLower.includes('.generated.') ||
+        fileNameLower.endsWith('.d.ts')) {
+        // TypeScript declaration files
+        return true;
+    }
+    return false;
+};
+exports.shouldIgnorePath = shouldIgnorePath;
+/** Check if a directory name is in the hardcoded ignore list */
+const isHardcodedIgnoredDirectory = (name) => {
+    return DEFAULT_IGNORE_LIST.has(name);
+};
+exports.isHardcodedIgnoredDirectory = isHardcodedIgnoredDirectory;
+const loadIgnoreRules = async (repoPath, options) => {
+    const ig = (0, ignore_1.default)();
+    let hasRules = false;
+    // Mirror git's own precedence for ignore sources (gitignore(5)): patterns
+    // from core.excludesFile are consulted first (lowest precedence — git's
+    // real global, all-repos file), then $GIT_COMMON_DIR/info/exclude
+    // (per-repo, untracked — no write access to the repo needed), then
+    // .gitignore/.cgraphignore below. Later ig.add() calls win on
+    // conflicting patterns, matching git's own last-match-wins semantics (#2606).
+    const skipGlobalIgnore = options?.noGlobalIgnore ?? !!process.env.CGRAPH_NO_GLOBAL_IGNORE;
+    if (!skipGlobalIgnore) {
+        const globalSources = [
+            (0, git_js_1.getCoreExcludesFilePath)(repoPath),
+            (0, git_js_1.getGitInfoExcludePath)(repoPath),
+        ].filter((candidate) => candidate !== null);
+        for (const sourcePath of globalSources) {
+            try {
+                const content = await promises_1.default.readFile(sourcePath, 'utf-8');
+                ig.add(content);
+                hasRules = true;
+            }
+            catch (err) {
+                const code = err.code;
+                if (code !== 'ENOENT') {
+                    logger_js_1.logger.warn(`  Warning: could not read ${sourcePath}: ${err.message}`);
+                }
+            }
+        }
+    }
+    // Allow users to bypass .gitignore parsing (e.g. when .gitignore accidentally excludes source files)
+    const skipGitignore = options?.noGitignore ?? !!process.env.CGRAPH_NO_GITIGNORE;
+    const filenames = skipGitignore ? ['.cgraphignore'] : ['.gitignore', '.cgraphignore'];
+    for (const filename of filenames) {
+        try {
+            const content = await promises_1.default.readFile(path_1.default.join(repoPath, filename), 'utf-8');
+            ig.add(content);
+            hasRules = true;
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== 'ENOENT') {
+                logger_js_1.logger.warn(`  Warning: could not read ${filename}: ${err.message}`);
+            }
+        }
+    }
+    return hasRules ? ig : null;
+};
+exports.loadIgnoreRules = loadIgnoreRules;
+/**
+ * Walk ancestor segments of `rel` and check whether `.cgraphignore`
+ * (or `.gitignore`) contains an explicit `!pattern` negation that
+ * applies. Returns true as soon as any segment — or the path itself —
+ * is matched by a negation rule.
+ *
+ * Why this exists (#771): the hardcoded DEFAULT_IGNORE_LIST would
+ * otherwise block indexing of directories like `__tests__/` even when
+ * the user has an explicit `!__tests__/` line in `.cgraphignore`.
+ * Mirroring `.gitignore` negation semantics: a user's explicit
+ * unignore of a parent directory implicitly unignores everything
+ * underneath, so we walk the ancestor chain rather than only testing
+ * the leaf.
+ *
+ * The `ignore` package's `test(path)` returns `{ignored, unignored}`;
+ * `unignored: true` is the "a negation rule matched this path"
+ * signal. Children of a negated directory return
+ * `{ignored: false, unignored: false}` on a direct test, which is why
+ * we also walk the ancestors here.
+ */
+const hasExplicitUnignore = (ig, rel) => {
+    // Direct match on the path (as a file).
+    if (ig.test(rel).unignored)
+        return true;
+    // Direct match on the path treated as a directory — `!dir/` matches
+    // here when rel is the directory itself.
+    if (ig.test(rel + '/').unignored)
+        return true;
+    // Walk ancestor segments. `!parent/` should propagate to every
+    // descendant the same way `.gitignore` negation propagates.
+    const parts = rel.split('/');
+    for (let i = parts.length - 1; i > 0; i--) {
+        const ancestor = parts.slice(0, i).join('/') + '/';
+        if (ig.test(ancestor).unignored)
+            return true;
+    }
+    return false;
+};
+/**
+ * Create a glob-compatible ignore filter combining:
+ * - .gitignore / .cgraphignore patterns (via `ignore` package)
+ * - Hardcoded DEFAULT_IGNORE_LIST, IGNORED_EXTENSIONS, IGNORED_FILES
+ *
+ * Returns an IgnoreLike object for glob's `ignore` option,
+ * enabling directory-level pruning during traversal.
+ *
+ * Precedence (#771): user's `.cgraphignore` negation patterns take
+ * priority over the hardcoded list, matching `.gitignore` semantics.
+ * An explicit `!pattern` rule unignores descendants even when they
+ * would otherwise be blocked by DEFAULT_IGNORE_LIST — UNLESS a more
+ * specific rule in the same file re-ignores a subset (e.g.
+ * `!__tests__/` paired with `__tests__/generated/` blocks the child
+ * while leaving the parent negated). Last-match-wins is enforced by
+ * consulting `ig.ignores(rel)` after `hasExplicitUnignore`.
+ */
+const createIgnoreFilter = async (repoPath, options) => {
+    const ig = await (0, exports.loadIgnoreRules)(repoPath, options);
+    // Workspace subproject directories (spec §4 / §5.1) declared in
+    // cgraphx-workspace.yaml `services`. Files under a declared service
+    // directory must NOT be pruned by .gitignore — multi-git-subproject
+    // aggregation roots (hx mode) list each subproject as its own git repo,
+    // so the root .gitignore typically ignores them. Trailing slashes are
+    // normalized so both `cust-service` and `cust-service/` match. `null`
+    // (no workspace config) leaves ignore semantics entirely unchanged.
+    const workspaceSet = options?.workspaceDirs
+        ? new Set(options.workspaceDirs.map((d) => d.replace(/\/+$/, '')))
+        : null;
+    return {
+        ignored(p) {
+            // The `ignore` package expects POSIX separators; path-scurry can surface
+            // native separators on Windows when called through glob.
+            const rel = p.relative().replace(/\\/g, '/');
+            if (!rel)
+                return false;
+            // Workspace subproject directories override .gitignore pruning (spec
+            // §4): a file whose top-level directory is a declared service is never
+            // ignored, even if .gitignore matches it. This exemption is deliberately
+            // narrow — noise subdirectories (node_modules, dist, …) inside a service
+            // are still pruned at the childrenIgnored() level before glob descends,
+            // so the only files reaching here are genuine source files in the service.
+            // `rel` is already POSIX-normalized above, so split('/')[0] is the top dir.
+            if (workspaceSet && workspaceSet.has(rel.split('/')[0]))
+                return false;
+            // User's .cgraphignore negation takes precedence over hardcoded
+            // rules (#771). If any ancestor or the path itself was explicitly
+            // unignored AND no more-specific rule re-ignores this exact path,
+            // allow it through. The `!ig.ignores(rel)` guard matches
+            // .gitignore's last-match-wins semantics: `!__tests__/` followed
+            // by `__tests__/generated/` negates the parent but still blocks
+            // the re-ignored child.
+            if (ig && hasExplicitUnignore(ig, rel) && !ig.ignores(rel))
+                return false;
+            // Check .gitignore / .cgraphignore patterns
+            if (ig && ig.ignores(rel))
+                return true;
+            // Fall back to hardcoded rules
+            return (0, exports.shouldIgnorePath)(rel);
+        },
+        childrenIgnored(p) {
+            // Note: dot-directories (.git, .vscode, etc.) are primarily excluded by
+            // glob's `dot: false` option in filesystem-walker.ts. The hardcoded
+            // list check below is defense-in-depth — do not remove `dot: false`
+            // assuming this covers it.
+            const rel = p.relative().replace(/\\/g, '/');
+            // User's .cgraphignore negation takes precedence (#771) — if the
+            // user explicitly unignored this directory or any ancestor via a
+            // !pattern rule, allow descent even if the directory name is in
+            // DEFAULT_IGNORE_LIST. The `!ig.ignores(rel + '/')` guard keeps
+            // last-match-wins: `!__tests__/` + `__tests__/generated/` still
+            // blocks descent into `__tests__/generated/`.
+            if (ig && rel && hasExplicitUnignore(ig, rel) && !ig.ignores(rel + '/'))
+                return false;
+            // Hardcoded list: block descent into well-known noise directories.
+            // Deliberately evaluated BEFORE the workspace exemption so noise dirs
+            // (node_modules, build, …) nested inside a declared service are still
+            // pruned — only service roots and their non-noise subdirectories get the
+            // exemption below.
+            if (DEFAULT_IGNORE_LIST.has(p.name))
+                return true;
+            // Workspace subproject directories override .gitignore pruning (spec §4):
+            // allow descent into a declared service root and into any subdirectory
+            // whose top-level segment is a declared service (e.g. cust-service and
+            // cust-service/cust-busi both qualify — top segment is `cust-service`).
+            // `rel` is already POSIX-normalized above, so split('/')[0] is the top dir.
+            if (workspaceSet) {
+                if (rel && workspaceSet.has(rel.split('/')[0]))
+                    return false;
+            }
+            // Check against .gitignore / .cgraphignore patterns.
+            // Since childrenIgnored is only called for directories, always test with
+            // a trailing slash. This ensures directory-only negation patterns (e.g.
+            // `!iOS/`) are applied correctly — without the slash, `ig.ignores('iOS')`
+            // treats the path as a file and misses the negation.
+            // Bare-name patterns (e.g. `local`) still match `local/` per gitignore spec:
+            // the `ignore` package normalizes `dir` and `dir/` to match directories.
+            // See: https://github.com/kaelzhang/node-ignore#2-filenames-and-dirnames
+            if (ig && rel && ig.ignores(rel + '/'))
+                return true;
+            return false;
+        },
+    };
+};
+exports.createIgnoreFilter = createIgnoreFilter;

package/dist/core/code/engine/config/supported-languages.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SupportedLanguages = void 0;
+/**
+ * Re-export SupportedLanguages from cgraph-shared (single source of truth).
+ *
+ * HOW TO ADD A NEW LANGUAGE:
+ *
+ * 1. Add the enum member in cgraph-shared/src/languages.ts
+ * 2. Run `tsc --noEmit` — compiler errors guide you to every dispatch table
+ * 3. Use the checklist in each ingestion file for what to add
+ * 4. Add tree-sitter-<lang> to cgraph/package.json dependencies
+ * 5. Add file extension mapping in utils.ts getLanguageFromFilename()
+ * 6. Run full test suite
+ */
+var index_js_1 = require("../../shared/index.js");
+Object.defineProperty(exports, "SupportedLanguages", { enumerable: true, get: function () { return index_js_1.SupportedLanguages; } });

package/dist/core/code/engine/core/analysis-features.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLASS_FRAMEWORK_ANNOTATIONS_FEATURE = void 0;
+exports.resolveAnalysisFeatureVersions = resolveAnalysisFeatureVersions;
+exports.findAnalysisFeatureMismatches = findAnalysisFeatureMismatches;
+/**
+ * The Class table shape is global even when a repository contains no JVM code.
+ * Existing v8 indexes predate the frameworkAnnotations column and therefore
+ * need one full rebuild before any incremental Class write can be safe.
+ */
+exports.CLASS_FRAMEWORK_ANNOTATIONS_FEATURE = {
+    id: 'graph.class-framework-annotations',
+    version: 1,
+    appliesTo: () => true,
+};
+/** Resolve the exact feature set this build promises for the supplied files. */
+function resolveAnalysisFeatureVersions(descriptors, filePaths) {
+    const resolved = new Map();
+    const seenIds = new Set();
+    for (const descriptor of descriptors) {
+        if (descriptor.id.trim().length === 0) {
+            throw new Error('Analysis feature descriptor id must not be empty');
+        }
+        if (!Number.isSafeInteger(descriptor.version) || descriptor.version < 1) {
+            throw new Error(`Analysis feature "${descriptor.id}" has invalid version ${descriptor.version}`);
+        }
+        if (seenIds.has(descriptor.id)) {
+            throw new Error(`Duplicate analysis feature descriptor: ${descriptor.id}`);
+        }
+        seenIds.add(descriptor.id);
+        if (!descriptor.appliesTo(filePaths))
+            continue;
+        resolved.set(descriptor.id, descriptor.version);
+    }
+    return Object.fromEntries([...resolved].sort(([left], [right]) => left.localeCompare(right)));
+}
+/**
+ * Compare an untrusted metadata value with the exact capabilities produced by
+ * this build. Extra keys also mismatch: a rollback must rebuild instead of
+ * certifying graph semantics emitted only by a newer binary.
+ */
+function findAnalysisFeatureMismatches(actual, expected) {
+    const expectedKeys = Object.keys(expected);
+    if (actual === undefined)
+        return expectedKeys.map((id) => `missing:${id}`);
+    if (actual === null || typeof actual !== 'object' || Array.isArray(actual)) {
+        return ['invalid:analysisFeatures'];
+    }
+    const stamped = actual;
+    const mismatches = [];
+    for (const id of expectedKeys) {
+        const value = stamped[id];
+        if (value === undefined)
+            mismatches.push(`missing:${id}`);
+        else if (value !== expected[id])
+            mismatches.push(`version:${id}`);
+    }
+    for (const id of Object.keys(stamped)) {
+        if (!Object.prototype.hasOwnProperty.call(expected, id)) {
+            mismatches.push(`unexpected:${id}`);
+        }
+    }
+    return mismatches.sort();
+}