cgraphx 2.0.2 → 2.0.6

package/dist/core/code/engine/core/ingestion/pipeline-phases/spring-config.js

@@ -0,0 +1,440 @@
+"use strict";
+/**
+ * Phase: springConfig
+ *
+ * Adds key-only nodes for statically readable Spring
+ * `application*.properties` / `application*.yml` / `application*.yaml` files.
+ * Language-specific ScopeResolver hooks attach consumers later. Configuration
+ * values are deliberately never copied into the graph because they may contain
+ * credentials and key identity is sufficient for impact analysis.
+ *
+ * @deps    structure
+ * @reads   Spring application configuration files
+ * @writes  Property nodes and DEFINES edges
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.springConfigPhase = void 0;
+exports.classifySpringConfigFile = classifySpringConfigFile;
+exports.parseSpringProperties = parseSpringProperties;
+exports.parseSpringYaml = parseSpringYaml;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const config_bindings_js_1 = require("../frameworks/spring/config-bindings.js");
+const utils_js_1 = require("../../../lib/utils.js");
+const types_js_1 = require("./types.js");
+const yaml = require('js-yaml');
+// js-yaml 5 dropped DEFAULT_SCHEMA; CORE plus these tags is what it used to be, so
+// explicitly tagged values keep parsing instead of throwing (an unknown tag aborts
+// the whole file). None of them can execute code.
+const SPRING_YAML_SCHEMA = yaml.CORE_SCHEMA.withTags(yaml.mergeTag, yaml.timestampTag, yaml.binaryTag, yaml.omapTag, yaml.pairsTag, yaml.setTag);
+const MAX_CONFIG_FILE_BYTES = 2 * 1024 * 1024;
+const MAX_YAML_TRAVERSAL_DEPTH = 128;
+const MAX_YAML_TRAVERSAL_NODES = 100_000;
+/** Match only Spring Boot's conventional application config file names. */
+function classifySpringConfigFile(filePath) {
+    const base = node_path_1.default.posix.basename(filePath.replaceAll('\\', '/'));
+    const match = /^application(?:-([^.]+))?\.(properties|ya?ml)$/i.exec(base);
+    if (match === null)
+        return null;
+    return {
+        filePath,
+        ...(match[1] ? { profile: match[1] } : {}),
+        format: match[2].toLowerCase() === 'properties' ? 'properties' : 'yaml',
+    };
+}
+function unescapePropertyKey(raw) {
+    return raw
+        .replace(/\\u([0-9a-fA-F]{4})/g, (_match, hex) => String.fromCharCode(Number.parseInt(hex, 16)))
+        .replace(/\\([:=#!\\ ])/g, '$1');
+}
+function logicalPropertiesLines(content) {
+    const physical = content.split(/\r?\n/);
+    const logical = [];
+    let current = '';
+    let startLine = 1;
+    for (let index = 0; index < physical.length; index++) {
+        const line = physical[index];
+        if (current.length === 0)
+            startLine = index + 1;
+        current += current.length === 0 ? line : line.trimStart();
+        let trailingBackslashes = 0;
+        for (let cursor = current.length - 1; cursor >= 0 && current[cursor] === '\\'; cursor--) {
+            trailingBackslashes++;
+        }
+        if (trailingBackslashes % 2 === 1) {
+            current = current.slice(0, -1);
+            continue;
+        }
+        logical.push({ text: current, line: startLine });
+        current = '';
+    }
+    if (current.length > 0)
+        logical.push({ text: current, line: startLine });
+    return logical;
+}
+/** Parse `.properties` keys without retaining their values. */
+function parseSpringProperties(content, filePath, profile) {
+    const keys = [];
+    const seen = new Set();
+    for (const logical of logicalPropertiesLines(content)) {
+        const trimmed = logical.text.trimStart();
+        if (trimmed.length === 0 || trimmed.startsWith('#') || trimmed.startsWith('!'))
+            continue;
+        let separator = -1;
+        let escaped = false;
+        for (let index = 0; index < trimmed.length; index++) {
+            const char = trimmed[index];
+            if (!escaped && (char === '=' || char === ':' || /\s/.test(char))) {
+                separator = index;
+                break;
+            }
+            escaped = !escaped && char === '\\';
+            if (char !== '\\')
+                escaped = false;
+        }
+        const rawKey = (separator === -1 ? trimmed : trimmed.slice(0, separator)).trim();
+        const key = unescapePropertyKey(rawKey);
+        if (key.length === 0 || seen.has(key))
+            continue;
+        seen.add(key);
+        keys.push({
+            key,
+            filePath,
+            line: logical.line,
+            ...(profile ? { profile } : {}),
+            format: 'properties',
+        });
+    }
+    return keys;
+}
+function consumeYamlTraversalBudget(state, depth) {
+    if (depth > MAX_YAML_TRAVERSAL_DEPTH) {
+        throw new Error(`Spring YAML traversal depth exceeds ${MAX_YAML_TRAVERSAL_DEPTH}`);
+    }
+    state.remainingNodes--;
+    if (state.remainingNodes < 0) {
+        throw new Error(`Spring YAML traversal exceeds ${MAX_YAML_TRAVERSAL_NODES} nodes`);
+    }
+}
+function isObjectValue(value) {
+    return value !== null && typeof value === 'object';
+}
+// Aliases are resolved to their anchor event by name while the tree is built,
+// so following one here is a single pointer hop.
+function resolveYamlAliasEvent(event) {
+    return event?.aliasOf ?? event;
+}
+function yamlMappingPairs(event) {
+    const pairs = [];
+    for (let index = 0; index + 1 < event.children.length; index += 2) {
+        const keyEvent = event.children[index];
+        const valueEvent = event.children[index + 1];
+        if (keyEvent.kind !== 'scalar')
+            continue;
+        pairs.push({ key: String(keyEvent.result), keyEvent, valueEvent });
+    }
+    return pairs;
+}
+/**
+ * First match in a pre-order walk of `event`, following sequences and `<<` merge
+ * chains. Iterative: children are pushed in reverse so the explicit stack pops
+ * them in declaration order, which is what makes "first match" mean the same
+ * thing it did when this recursed.
+ */
+function findYamlMappingLocation(event, key, traversal) {
+    const visited = new Set();
+    const stack = [{ event, depth: 0 }];
+    while (stack.length > 0) {
+        const step = stack.pop();
+        if (step === undefined)
+            break;
+        consumeYamlTraversalBudget(traversal, step.depth);
+        const resolved = resolveYamlAliasEvent(step.event);
+        if (resolved === undefined || visited.has(resolved))
+            continue;
+        visited.add(resolved);
+        if (resolved.kind === 'sequence') {
+            for (let index = resolved.children.length - 1; index >= 0; index--) {
+                stack.push({ event: resolved.children[index], depth: step.depth + 1 });
+            }
+            continue;
+        }
+        if (resolved.kind !== 'mapping')
+            continue;
+        const pairs = yamlMappingPairs(resolved);
+        const direct = pairs.find((pair) => pair.key === key);
+        if (direct !== undefined) {
+            return { valueEvent: direct.valueEvent, line: direct.keyEvent.startLine };
+        }
+        const merges = pairs.filter((pair) => pair.key === '<<');
+        for (let index = merges.length - 1; index >= 0; index--) {
+            stack.push({ event: merges[index].valueEvent, depth: step.depth + 1 });
+        }
+    }
+    return undefined;
+}
+/**
+ * Flatten a document to `dotted.key -> line`, iteratively. Children are pushed in
+ * reverse so the stack pops them in declaration order, keeping `out` in the same
+ * insertion order — and the traversal budget consumed in the same sequence — as
+ * the recursive walk this replaced.
+ */
+function flattenYamlValue(value, event, prefix, out, traversal) {
+    const stack = [
+        { kind: 'visit', value, event, prefix, sourceLine: event?.startLine ?? 1, depth: 0 },
+    ];
+    while (stack.length > 0) {
+        const step = stack.pop();
+        if (step === undefined)
+            break;
+        if (step.kind === 'leave') {
+            traversal.activeObjects.delete(step.object);
+            continue;
+        }
+        const { value: current, prefix: currentPrefix, sourceLine, depth } = step;
+        consumeYamlTraversalBudget(traversal, depth);
+        const resolvedEvent = resolveYamlAliasEvent(step.event);
+        const trackedObject = isObjectValue(current) ? current : undefined;
+        if (trackedObject !== undefined) {
+            if (traversal.activeObjects.has(trackedObject))
+                continue;
+            traversal.activeObjects.add(trackedObject);
+            stack.push({ kind: 'leave', object: trackedObject });
+        }
+        if (Array.isArray(current)) {
+            if (current.length === 0 && currentPrefix.length > 0 && !out.has(currentPrefix)) {
+                out.set(currentPrefix, sourceLine);
+            }
+            for (let index = current.length - 1; index >= 0; index--) {
+                stack.push({
+                    kind: 'visit',
+                    value: current[index],
+                    event: resolvedEvent?.children[index],
+                    prefix: `${currentPrefix}[${index}]`,
+                    sourceLine,
+                    depth: depth + 1,
+                });
+            }
+            continue;
+        }
+        if (current !== null &&
+            typeof current === 'object' &&
+            (resolvedEvent?.kind === 'mapping' || resolvedEvent === undefined)) {
+            // js-yaml 5 builds `!!set` as a native Set, whose members are not own
+            // properties; v4 built a plain `{member: null}` object. Enumerate them so a
+            // tagged set still contributes one key per member instead of a bare leaf.
+            const entries = current instanceof Set
+                ? [...current].map((member) => [String(member), null])
+                : Object.entries(current);
+            if (entries.length === 0 && currentPrefix.length > 0 && !out.has(currentPrefix)) {
+                out.set(currentPrefix, sourceLine);
+            }
+            for (let index = entries.length - 1; index >= 0; index--) {
+                const [key, nested] = entries[index];
+                const location = findYamlMappingLocation(resolvedEvent, key, traversal);
+                stack.push({
+                    kind: 'visit',
+                    value: nested,
+                    event: location?.valueEvent,
+                    prefix: currentPrefix.length === 0 ? key : `${currentPrefix}.${key}`,
+                    sourceLine: location?.line ?? sourceLine,
+                    depth: depth + 1,
+                });
+            }
+            continue;
+        }
+        if (currentPrefix.length > 0 && !out.has(currentPrefix))
+            out.set(currentPrefix, sourceLine);
+    }
+}
+// js-yaml 5 reports node positions as source offsets; map them to 1-based lines.
+function makeLineResolver(source) {
+    const lineStarts = [0];
+    for (let index = 0; index < source.length; index++) {
+        if (source[index] === '\n')
+            lineStarts.push(index + 1);
+    }
+    return (offset) => {
+        let low = 0;
+        let high = lineStarts.length - 1;
+        let line = 0;
+        while (low <= high) {
+            const mid = (low + high) >> 1;
+            if (lineStarts[mid] <= offset) {
+                line = mid;
+                low = mid + 1;
+            }
+            else {
+                high = mid - 1;
+            }
+        }
+        return line + 1;
+    };
+}
+/**
+ * Rebuild the parse tree from js-yaml 5's event stream (v4's `listener` option
+ * was removed). Returns each document's root event, with aliases already
+ * resolved to their anchor event so merged/aliased keys keep the line where
+ * they were declared.
+ *
+ * One node per event, so this pass is bounded by MAX_CONFIG_FILE_BYTES alone —
+ * MAX_YAML_TRAVERSAL_NODES governs the later walk, which can revisit a shared
+ * anchor many times and so needs a budget this linear pass does not.
+ */
+function buildYamlEventTree(events, source) {
+    const lineOf = makeLineResolver(source);
+    const anchors = new Map();
+    const stack = [];
+    const documentRoots = [];
+    const anchorName = (start, end) => start >= 0 && end > start ? source.slice(start, end) : null;
+    const attach = (node) => {
+        stack[stack.length - 1]?.children.push(node);
+    };
+    const register = (name, node) => {
+        if (name !== null)
+            anchors.set(name, node);
+    };
+    for (const event of events) {
+        switch (event.type) {
+            case yaml.EVENT_DOCUMENT:
+                // Anchors are document-scoped. constructFromEvents already rejects a
+                // cross-document alias before we get here, so this only keeps the two
+                // layers from disagreeing.
+                anchors.clear();
+                stack.push({
+                    startLine: 1,
+                    kind: null,
+                    result: undefined,
+                    aliasOf: undefined,
+                    children: [],
+                });
+                break;
+            case yaml.EVENT_MAPPING:
+            case yaml.EVENT_SEQUENCE: {
+                const node = {
+                    startLine: lineOf(event.start),
+                    kind: event.type === yaml.EVENT_MAPPING ? 'mapping' : 'sequence',
+                    result: undefined,
+                    aliasOf: undefined,
+                    children: [],
+                };
+                register(anchorName(event.anchorStart, event.anchorEnd), node);
+                attach(node);
+                stack.push(node);
+                break;
+            }
+            case yaml.EVENT_SCALAR: {
+                const node = {
+                    startLine: lineOf(event.valueStart),
+                    kind: 'scalar',
+                    result: yaml.getScalarValue(source, event),
+                    aliasOf: undefined,
+                    children: [],
+                };
+                register(anchorName(event.anchorStart, event.anchorEnd), node);
+                attach(node);
+                break;
+            }
+            case yaml.EVENT_ALIAS: {
+                const target = anchors.get(anchorName(event.anchorStart, event.anchorEnd) ?? '');
+                attach({ startLine: 1, kind: 'alias', result: undefined, aliasOf: target, children: [] });
+                break;
+            }
+            case yaml.EVENT_POP: {
+                const done = stack.pop();
+                // Documents are the only top-level containers, so a pop that empties the
+                // stack closes a document; its single child is the document's root value.
+                if (done !== undefined && stack.length === 0)
+                    documentRoots.push(done.children[0]);
+                break;
+            }
+        }
+    }
+    return documentRoots;
+}
+/** Parse and flatten YAML leaves without retaining their values. */
+function parseSpringYaml(content, filePath, profile) {
+    const flattened = new Map();
+    const traversal = {
+        remainingNodes: MAX_YAML_TRAVERSAL_NODES,
+        activeObjects: new Set(),
+    };
+    const events = yaml.parseEvents(content, { maxDepth: MAX_YAML_TRAVERSAL_DEPTH });
+    const documents = yaml.constructFromEvents(events, {
+        source: content,
+        schema: SPRING_YAML_SCHEMA,
+        json: true,
+    });
+    const documentEvents = buildYamlEventTree(events, content);
+    documents.forEach((document, index) => flattenYamlValue(document, documentEvents[index], '', flattened, traversal));
+    return [...flattened.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, line]) => ({
+        key,
+        filePath,
+        line,
+        ...(profile ? { profile } : {}),
+        format: 'yaml',
+    }));
+}
+function configKeyNodeId(entry) {
+    return (0, utils_js_1.generateId)('Property', `spring-config:${entry.filePath}:${entry.key}`);
+}
+async function readConfigKeys(repoPath, scannedFiles) {
+    const keys = [];
+    for (const scanned of scannedFiles) {
+        const classified = classifySpringConfigFile(scanned.path);
+        if (classified === null || scanned.size > MAX_CONFIG_FILE_BYTES)
+            continue;
+        try {
+            const content = await promises_1.default.readFile(node_path_1.default.join(repoPath, scanned.path), 'utf8');
+            keys.push(...(classified.format === 'properties'
+                ? parseSpringProperties(content, classified.filePath, classified.profile)
+                : parseSpringYaml(content, classified.filePath, classified.profile)));
+        }
+        catch {
+            // Malformed configuration is not a reason to fail the entire code index.
+            // Fail closed: no keys and therefore no misleading bindings for this file.
+        }
+    }
+    return keys;
+}
+exports.springConfigPhase = {
+    name: 'springConfig',
+    deps: ['structure'],
+    async execute(ctx, deps) {
+        const { scannedFiles } = (0, types_js_1.getPhaseOutput)(deps, 'structure');
+        const configKeys = await readConfigKeys(ctx.repoPath, scannedFiles);
+        for (const entry of configKeys) {
+            const nodeId = configKeyNodeId(entry);
+            ctx.graph.addNode({
+                id: nodeId,
+                label: 'Property',
+                properties: {
+                    name: entry.key,
+                    filePath: entry.filePath,
+                    startLine: entry.line,
+                    endLine: entry.line,
+                    description: entry.profile
+                        ? `${config_bindings_js_1.SPRING_CONFIG_DESCRIPTION} (profile: ${entry.profile})`
+                        : config_bindings_js_1.SPRING_CONFIG_DESCRIPTION,
+                },
+            });
+            const fileId = (0, utils_js_1.generateId)('File', entry.filePath);
+            if (ctx.graph.getNode(fileId) !== undefined) {
+                ctx.graph.addRelationship({
+                    id: (0, utils_js_1.generateId)('DEFINES', `${fileId}->${nodeId}`),
+                    sourceId: fileId,
+                    targetId: nodeId,
+                    type: 'DEFINES',
+                    confidence: 1,
+                    reason: 'spring-config:key',
+                });
+            }
+        }
+        return { configKeys: configKeys.length };
+    },
+};

package/dist/core/code/engine/core/ingestion/pipeline-phases/structure.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Phase: structure
+ *
+ * Builds File and Folder nodes in the graph from scanned paths.
+ *
+ * @deps    scan
+ * @reads   allPaths (from scan phase)
+ * @writes  graph (File, Folder nodes + CONTAINS edges)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.structurePhase = void 0;
+const types_js_1 = require("./types.js");
+const structure_processor_js_1 = require("../structure-processor.js");
+exports.structurePhase = {
+    name: 'structure',
+    deps: ['scan'],
+    async execute(ctx, deps) {
+        const { scannedFiles, allPaths, totalFiles } = (0, types_js_1.getPhaseOutput)(deps, 'scan');
+        ctx.onProgress({
+            phase: 'structure',
+            percent: 15,
+            message: 'Analyzing project structure...',
+            stats: { filesProcessed: 0, totalFiles, nodesCreated: ctx.graph.nodeCount },
+        });
+        (0, structure_processor_js_1.processStructure)(ctx.graph, allPaths);
+        ctx.onProgress({
+            phase: 'structure',
+            percent: 20,
+            message: 'Project structure analyzed',
+            stats: { filesProcessed: totalFiles, totalFiles, nodesCreated: ctx.graph.nodeCount },
+        });
+        // Build the set once here so cobol, markdown, and cross-file propagation
+        // can all reuse it instead of re-materializing `new Set(allPaths)` each.
+        const allPathSet = new Set(allPaths);
+        return { scannedFiles, allPaths, allPathSet, totalFiles };
+    },
+};

package/dist/core/code/engine/core/ingestion/pipeline-phases/tools.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * Phase: tools
+ *
+ * Detects MCP/RPC tool definitions and creates Tool graph nodes.
+ *
+ * @deps    parse
+ * @reads   allToolDefs (from parse), allPaths
+ * @writes  graph (Tool nodes, HANDLES_TOOL edges)
+ * @output  toolDefs array
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolsPhase = void 0;
+const types_js_1 = require("./types.js");
+const utils_js_1 = require("../../../lib/utils.js");
+const filesystem_walker_js_1 = require("../filesystem-walker.js");
+const env_js_1 = require("../utils/env.js");
+const logger_js_1 = require("../../logger.js");
+exports.toolsPhase = {
+    name: 'tools',
+    deps: ['parse'],
+    async execute(ctx, deps) {
+        const { allToolDefs, allPaths } = (0, types_js_1.getPhaseOutput)(deps, 'parse');
+        const toolDefs = [];
+        const seenToolNames = new Set();
+        for (const td of allToolDefs) {
+            if (seenToolNames.has(td.toolName))
+                continue;
+            seenToolNames.add(td.toolName);
+            const handlerNodeId = td.handlerNodeId && ctx.graph.getNode(td.handlerNodeId) ? td.handlerNodeId : undefined;
+            toolDefs.push({
+                name: td.toolName,
+                filePath: td.filePath,
+                description: td.description,
+                ...(handlerNodeId !== undefined ? { handlerNodeId } : {}),
+            });
+        }
+        // TS tool definition arrays — require inputSchema nearby
+        const toolCandidatePaths = allPaths.filter((p) => (p.endsWith('.ts') || p.endsWith('.js')) &&
+            p.toLowerCase().includes('tool') &&
+            !p.includes('node_modules') &&
+            !p.includes('test') &&
+            !p.includes('__'));
+        if (toolCandidatePaths.length > 0) {
+            const toolContents = await (0, filesystem_walker_js_1.readFileContents)(ctx.repoPath, toolCandidatePaths);
+            for (const [filePath, content] of toolContents) {
+                if (!content.includes('inputSchema'))
+                    continue;
+                const toolPattern = /name:\s*['"](\w+)['"]\s*,\s*\n?\s*description:\s*[`'"]([\s\S]*?)[`'"]/g;
+                let match;
+                while ((match = toolPattern.exec(content)) !== null) {
+                    const name = match[1];
+                    if (seenToolNames.has(name))
+                        continue;
+                    seenToolNames.add(name);
+                    toolDefs.push({
+                        name,
+                        filePath,
+                        description: match[2].slice(0, 200).replace(/\n/g, ' ').trim(),
+                    });
+                }
+            }
+        }
+        // Create Tool nodes and HANDLES_TOOL edges
+        if (toolDefs.length > 0) {
+            for (const td of toolDefs) {
+                const toolNodeId = (0, utils_js_1.generateId)('Tool', td.name);
+                ctx.graph.addNode({
+                    id: toolNodeId,
+                    label: 'Tool',
+                    properties: { name: td.name, filePath: td.filePath, description: td.description },
+                });
+                const handlerId = td.handlerNodeId ?? (0, utils_js_1.generateId)('File', td.filePath);
+                ctx.graph.addRelationship({
+                    id: (0, utils_js_1.generateId)('HANDLES_TOOL', `${handlerId}->${toolNodeId}`),
+                    sourceId: handlerId,
+                    targetId: toolNodeId,
+                    type: 'HANDLES_TOOL',
+                    confidence: 1.0,
+                    reason: 'tool-definition',
+                });
+            }
+            if (env_js_1.isDev) {
+                logger_js_1.logger.info(`🔧 Tool registry: ${toolDefs.length} tools detected`);
+            }
+        }
+        return { toolDefs };
+    },
+};

package/dist/core/code/engine/core/ingestion/pipeline-phases/types.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Pipeline Phase — Type definitions.
+ *
+ * Each phase is a named node in the dependency graph with typed inputs and outputs.
+ * The runner resolves dependencies via topological sort and passes
+ * typed results from upstream phases as inputs to downstream phases.
+ *
+ * Design goals:
+ *  - Explicit data flow between phases via typed outputs
+ *  - The knowledge graph is a shared mutable accumulator — phases add nodes/edges
+ *    and may read prior phases' contributions. This is intentional: the graph is
+ *    the pipeline's primary output, not an inter-phase communication channel.
+ *  - Compile-time exhaustiveness (adding a phase = type error until wired)
+ *  - Each phase is independently testable with mocked inputs
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPhaseOutput = getPhaseOutput;
+/**
+ * Helper to extract the typed output of a dependency phase.
+ *
+ * Type safety note: This uses an `as T` cast because the runner stores
+ * heterogeneous phase outputs in a single `Map<string, PhaseResult<unknown>>`.
+ * The cast is safe as long as callers use the correct output type for the
+ * named phase. Mismatches will surface as runtime type errors, not compile-time
+ * errors — this is an intentional trade-off for a static phase graph without
+ * a dynamic type registry.
+ *
+ * @param deps       The resolved dependency map from the runner
+ * @param phaseName  The name of the upstream phase whose output you need
+ * @returns          The typed output of the phase
+ * @throws           If the phase is not found in the dependency map
+ */
+function getPhaseOutput(deps, phaseName) {
+    const result = deps.get(phaseName);
+    if (!result) {
+        throw new Error(`Phase '${phaseName}' not found in resolved dependencies`);
+    }
+    return result.output;
+}