code-graph-context 1.1.0 → 2.0.0

package/dist/storage/neo4j/neo4j.service.js

@@ -1,5 +1,6 @@
 import neo4j from 'neo4j-driver';
 import { MAX_TRAVERSAL_DEPTH } from '../../constants.js';
+import { getTimeoutConfig } from '../../core/config/timeouts.js';
 export class Neo4jService {
     driver;
     constructor() {
@@ -9,20 +10,39 @@ export class Neo4jService {
         const uri = process.env.NEO4J_URI ?? 'bolt://localhost:7687';
         const user = process.env.NEO4J_USER ?? 'neo4j';
         const password = process.env.NEO4J_PASSWORD ?? 'PASSWORD';
-        return neo4j.driver(uri, neo4j.auth.basic(user, password));
+        const timeoutConfig = getTimeoutConfig();
+        return neo4j.driver(uri, neo4j.auth.basic(user, password), {
+            connectionTimeout: timeoutConfig.neo4j.connectionTimeoutMs,
+            maxTransactionRetryTime: timeoutConfig.neo4j.queryTimeoutMs,
+        });
     }
     async run(query, params = {}) {
         const session = this.driver.session();
+        const timeoutConfig = getTimeoutConfig();
         try {
-            const result = await session.run(query, params);
+            const result = await session.run(query, params, {
+                timeout: timeoutConfig.neo4j.queryTimeoutMs,
+            });
             return result.records.map((record) => record.toObject());
         }
         catch (error) {
+            // Provide helpful error message for timeout
+            if (error.code === 'Neo.TransientError.Transaction.Terminated') {
+                throw new Error(`Neo4j query timed out after ${timeoutConfig.neo4j.queryTimeoutMs}ms. ` +
+                    'Consider simplifying the query or increasing NEO4J_QUERY_TIMEOUT_MS.');
+            }
             console.error('Error running query:', error);
             throw error;
         }
         finally {
-            await session.close();
+            // Wrap session close in try-catch to avoid masking the original error
+            try {
+                await session.close();
+            }
+            catch (closeError) {
+                // Log but don't re-throw to preserve original error
+                console.warn('Error closing Neo4j session:', closeError);
+            }
         }
     }
     getDriver() {
@@ -30,15 +50,34 @@ export class Neo4jService {
     }
     async getSchema() {
         const session = this.driver.session();
+        const timeoutConfig = getTimeoutConfig();
         try {
-            return await session.run(QUERIES.APOC_SCHEMA);
+            return await session.run(QUERIES.APOC_SCHEMA, {}, {
+                timeout: timeoutConfig.neo4j.queryTimeoutMs,
+            });
         }
         catch (error) {
             console.error('Error fetching schema:', error);
             throw error;
         }
         finally {
-            await session.close();
+            // Wrap session close in try-catch to avoid masking the original error
+            try {
+                await session.close();
+            }
+            catch (closeError) {
+                // Log but don't re-throw to preserve original error
+                console.warn('Error closing Neo4j session:', closeError);
+            }
+        }
+    }
+    /**
+     * Close the Neo4j driver connection.
+     * Should be called when the service is no longer needed to release resources.
+     */
+    async close() {
+        if (this.driver) {
+            await this.driver.close();
         }
     }
 }
@@ -47,7 +86,34 @@ export const QUERIES = {
     CALL apoc.meta.schema() YIELD value
       RETURN value as schema
     `,
-    CLEAR_DATABASE: 'MATCH (n) DETACH DELETE n',
+    // Project-scoped deletion - only deletes nodes for the specified project
+    // Uses APOC batched deletion to avoid transaction memory limits on large projects
+    CLEAR_PROJECT: `
+    CALL apoc.periodic.iterate(
+      'MATCH (n) WHERE n.projectId = $projectId RETURN n',
+      'DETACH DELETE n',
+      {batchSize: 1000, params: {projectId: $projectId}}
+    )
+    YIELD batches, total
+    RETURN batches, total
+  `,
+    // Full database clear - use with caution, clears ALL projects
+    // Uses APOC batched deletion to avoid transaction memory limits
+    CLEAR_DATABASE: `
+    CALL apoc.periodic.iterate(
+      'MATCH (n) RETURN n',
+      'DETACH DELETE n',
+      {batchSize: 1000}
+    )
+    YIELD batches, total
+    RETURN batches, total
+  `,
+    // Create indexes on projectId for efficient filtering across key node types
+    CREATE_PROJECT_INDEX_EMBEDDED: 'CREATE INDEX project_embedded_idx IF NOT EXISTS FOR (n:Embedded) ON (n.projectId)',
+    CREATE_PROJECT_INDEX_SOURCEFILE: 'CREATE INDEX project_sourcefile_idx IF NOT EXISTS FOR (n:SourceFile) ON (n.projectId)',
+    // Create composite indexes on projectId + id for efficient lookups
+    CREATE_PROJECT_ID_INDEX_EMBEDDED: 'CREATE INDEX project_id_embedded_idx IF NOT EXISTS FOR (n:Embedded) ON (n.projectId, n.id)',
+    CREATE_PROJECT_ID_INDEX_SOURCEFILE: 'CREATE INDEX project_id_sourcefile_idx IF NOT EXISTS FOR (n:SourceFile) ON (n.projectId, n.id)',
     CREATE_NODE: `
     UNWIND $nodes AS nodeData
     CALL apoc.create.node(nodeData.labels, nodeData.properties) YIELD node
@@ -55,16 +121,17 @@ export const QUERIES = {
   `,
     CREATE_RELATIONSHIP: `
     UNWIND $edges AS edgeData
-    MATCH (start) WHERE start.id = edgeData.startNodeId
-    MATCH (end) WHERE end.id = edgeData.endNodeId
+    MATCH (start) WHERE start.id = edgeData.startNodeId AND start.projectId = $projectId
+    MATCH (end) WHERE end.id = edgeData.endNodeId AND end.projectId = $projectId
     WITH start, end, edgeData
     CALL apoc.create.relationship(start, edgeData.type, edgeData.properties, end) YIELD rel
     RETURN count(*) as created
   `,
     CREATE_INDEX: (label, property) => `CREATE INDEX IF NOT EXISTS FOR (n:${label}) ON (n.${property})`,
     GET_STATS: `
-    MATCH (n) 
-    RETURN labels(n)[0] as nodeType, count(*) as count 
+    MATCH (n)
+    WHERE n.projectId = $projectId
+    RETURN labels(n)[0] as nodeType, count(*) as count
     ORDER BY count DESC
   `,
     CREATE_EMBEDDED_VECTOR_INDEX: `
@@ -75,9 +142,16 @@ export const QUERIES = {
     \`vector.similarity_function\`: 'cosine'
   }}
 `,
+    // Vector search with configurable fetch multiplier for project filtering.
+    // fetchMultiplier (default: 10) controls how many extra results to fetch before filtering by projectId.
+    // minSimilarity (default: 0.3) filters out low-confidence matches for nonsense queries.
+    // Higher values = more accurate results but slower; lower values = faster but may miss results.
     VECTOR_SEARCH: `
-  CALL db.index.vector.queryNodes('embedded_nodes_idx', $limit, $embedding)
+  CALL db.index.vector.queryNodes('embedded_nodes_idx', toInteger($limit * coalesce($fetchMultiplier, 10)), $embedding)
   YIELD node, score
+  WHERE node.projectId = $projectId AND score >= coalesce($minSimilarity, 0.3)
+  WITH node, score
+  LIMIT toInteger($limit)
   RETURN {
     id: node.id,
     labels: labels(node),
@@ -93,18 +167,22 @@ export const QUERIES = {
   `,
     GET_SOURCE_FILE_TRACKING_INFO: `
     MATCH (sf:SourceFile)
-    RETURN sf.filePath AS filePath, sf.mtime AS mtime, sf.size AS size, sf.contentHash AS contentHash
+    WHERE sf.projectId = $projectId
+    RETURN sf.filePath AS filePath,
+           COALESCE(sf.mtime, 0) AS mtime,
+           COALESCE(sf.size, 0) AS size,
+           COALESCE(sf.contentHash, '') AS contentHash
   `,
     // Get cross-file edges before deletion (edges where one endpoint is outside the subgraph)
     // These will be recreated after import using deterministic IDs
     GET_CROSS_FILE_EDGES: `
     MATCH (sf:SourceFile)
-    WHERE sf.filePath IN $filePaths
+    WHERE sf.filePath IN $filePaths AND sf.projectId = $projectId
     OPTIONAL MATCH (sf)-[*]->(child)
     WITH collect(DISTINCT sf) + collect(DISTINCT child) AS nodesToDelete
     UNWIND nodesToDelete AS n
     MATCH (n)-[r]-(other)
-    WHERE NOT other IN nodesToDelete
+    WHERE NOT other IN nodesToDelete AND other.projectId = $projectId
     RETURN DISTINCT
       startNode(r).id AS startNodeId,
       endNode(r).id AS endNodeId,
@@ -114,7 +192,7 @@ export const QUERIES = {
     // Delete source file subgraphs (nodes and all their edges)
     DELETE_SOURCE_FILE_SUBGRAPHS: `
     MATCH (sf:SourceFile)
-    WHERE sf.filePath IN $filePaths
+    WHERE sf.filePath IN $filePaths AND sf.projectId = $projectId
     OPTIONAL MATCH (sf)-[*]->(child)
     DETACH DELETE sf, child
   `,
@@ -122,23 +200,21 @@ export const QUERIES = {
     RECREATE_CROSS_FILE_EDGES: `
     UNWIND $edges AS edge
     MATCH (startNode {id: edge.startNodeId})
+    WHERE startNode.projectId = $projectId
     MATCH (endNode {id: edge.endNodeId})
+    WHERE endNode.projectId = $projectId
     CALL apoc.create.relationship(startNode, edge.edgeType, edge.edgeProperties, endNode) YIELD rel
     RETURN count(rel) AS recreatedCount
   `,
-    // Clean up dangling edges (edges pointing to non-existent nodes)
-    // Run after incremental parse to remove edges to renamed/deleted nodes
-    CLEANUP_DANGLING_EDGES: `
-    MATCH ()-[r]->()
-    WHERE startNode(r) IS NULL OR endNode(r) IS NULL
-    DELETE r
-    RETURN count(r) AS deletedCount
-  `,
+    // Note: Dangling edge cleanup is not needed because:
+    // 1. DETACH DELETE removes all edges when deleting nodes
+    // 2. Edges cannot exist without both endpoints in Neo4j
+    // The previous query (WHERE startNode(r) IS NULL OR endNode(r) IS NULL) could never match anything
     // Get existing nodes (excluding files being reparsed) for edge target matching
     // Returns minimal info needed for edge detection: id, name, coreType, semanticType
     GET_EXISTING_NODES_FOR_EDGE_DETECTION: `
     MATCH (sf:SourceFile)-[*]->(n)
-    WHERE NOT sf.filePath IN $excludeFilePaths
+    WHERE NOT sf.filePath IN $excludeFilePaths AND sf.projectId = $projectId
     RETURN n.id AS id,
            n.name AS name,
            n.coreType AS coreType,
@@ -149,29 +225,45 @@ export const QUERIES = {
     EXPLORE_ALL_CONNECTIONS: (maxDepth = MAX_TRAVERSAL_DEPTH, direction = 'BOTH', relationshipTypes) => {
         const safeMaxDepth = Math.min(Math.max(maxDepth, 1), MAX_TRAVERSAL_DEPTH);
         // Build relationship pattern based on direction
+        // For INCOMING, we reverse the match order: (connected)-[*]->(start) instead of (start)<-[*]-(connected)
+        // This is because Neo4j variable-length patterns like <-[*1..N]- require ALL edges to point toward start,
+        // but in multi-hop paths (A→B→C), intermediate edges (A→B) don't point toward C, causing 0 results.
         let relPattern = '';
+        let isReversed = false;
         if (direction === 'OUTGOING') {
             relPattern = `-[*1..${safeMaxDepth}]->`;
         }
         else if (direction === 'INCOMING') {
-            relPattern = `<-[*1..${safeMaxDepth}]-`;
+            relPattern = `-[*1..${safeMaxDepth}]->`; // Same pattern as OUTGOING
+            isReversed = true; // But we'll reverse start/connected in MATCH
         }
         else {
             relPattern = `-[*1..${safeMaxDepth}]-`;
         }
         // Build relationship type filter if specified
+        // SECURITY: Validate relationship types to prevent Cypher injection
+        // Only allow uppercase letters and underscores (valid Neo4j relationship type format)
         let relTypeFilter = '';
         if (relationshipTypes && relationshipTypes.length > 0) {
-            const types = relationshipTypes.map((t) => `'${t}'`).join(', ');
-            relTypeFilter = `AND all(rel in relationships(path) WHERE type(rel) IN [${types}])`;
+            const validRelTypePattern = /^[A-Z_]+$/;
+            const validatedTypes = relationshipTypes.filter((t) => validRelTypePattern.test(t));
+            if (validatedTypes.length !== relationshipTypes.length) {
+                console.warn('Some relationship types were filtered out due to invalid format. Valid format: uppercase letters and underscores only.');
+            }
+            if (validatedTypes.length > 0) {
+                const types = validatedTypes.map((t) => `'${t}'`).join(', ');
+                relTypeFilter = `AND all(rel in relationships(path) WHERE type(rel) IN [${types}])`;
+            }
         }
+        // For INCOMING, reverse the match: (connected)-[*]->(start) finds nodes that can REACH start
+        const matchPattern = isReversed ? `(connected)${relPattern}(start)` : `(start)${relPattern}(connected)`;
         return `
-      MATCH (start) WHERE start.id = $nodeId
+      MATCH (start) WHERE start.id = $nodeId AND start.projectId = $projectId
 
       CALL {
         WITH start
-        MATCH path = (start)${relPattern}(connected)
-        WHERE connected <> start
+        MATCH path = ${matchPattern}
+        WHERE connected <> start AND connected.projectId = $projectId
         ${relTypeFilter}
         WITH path, connected, length(path) as depth
 
@@ -267,13 +359,13 @@ export const QUERIES = {
         return `
       // Unwind the source nodes we're exploring from
       UNWIND $sourceNodeIds AS sourceId
-      MATCH (source) WHERE source.id = sourceId
+      MATCH (source) WHERE source.id = sourceId AND source.projectId = $projectId
 
       // Find immediate neighbors (exactly 1 hop)
       MATCH (source)${relPattern}(neighbor)
 
-      // Filter: skip already visited nodes to avoid cycles
-      WHERE NOT neighbor.id IN $visitedNodeIds
+      // Filter: skip already visited nodes and ensure same project
+      WHERE NOT neighbor.id IN $visitedNodeIds AND neighbor.projectId = $projectId
 
       // Calculate the three scoring components
       WITH source, neighbor, rel,
@@ -326,7 +418,7 @@ export const QUERIES = {
 
       // Sort by score and limit to top N per depth
       ORDER BY combinedScore DESC
-      LIMIT ${maxNodesPerDepth}
+      LIMIT toInteger(${maxNodesPerDepth})
     `;
     },
     // ============================================
@@ -339,13 +431,13 @@ export const QUERIES = {
     CALL db.labels() YIELD label
     CALL {
       WITH label
-      MATCH (n) WHERE label IN labels(n)
+      MATCH (n) WHERE label IN labels(n) AND n.projectId = $projectId
       WITH n LIMIT 1
       RETURN keys(n) AS sampleProperties
     }
     CALL {
       WITH label
-      MATCH (n) WHERE label IN labels(n)
+      MATCH (n) WHERE label IN labels(n) AND n.projectId = $projectId
       RETURN count(n) AS nodeCount
     }
     RETURN label, nodeCount, sampleProperties
@@ -358,14 +450,14 @@ export const QUERIES = {
     CALL db.relationshipTypes() YIELD relationshipType
     CALL {
       WITH relationshipType
-      MATCH (a)-[r]->(b) WHERE type(r) = relationshipType
+      MATCH (a)-[r]->(b) WHERE type(r) = relationshipType AND a.projectId = $projectId AND b.projectId = $projectId
       WITH labels(a)[0] AS fromLabel, labels(b)[0] AS toLabel
       RETURN fromLabel, toLabel
       LIMIT 10
     }
     CALL {
       WITH relationshipType
-      MATCH ()-[r]->() WHERE type(r) = relationshipType
+      MATCH (a)-[r]->(b) WHERE type(r) = relationshipType AND a.projectId = $projectId
       RETURN count(r) AS relCount
     }
     RETURN relationshipType, relCount, collect(DISTINCT {from: fromLabel, to: toLabel}) AS connections
@@ -376,7 +468,7 @@ export const QUERIES = {
      */
     DISCOVER_SEMANTIC_TYPES: `
     MATCH (n)
-    WHERE n.semanticType IS NOT NULL
+    WHERE n.semanticType IS NOT NULL AND n.projectId = $projectId
     WITH n.semanticType AS semanticType, count(*) AS count
     ORDER BY count DESC
     RETURN semanticType, count
@@ -386,6 +478,7 @@ export const QUERIES = {
      */
     DISCOVER_COMMON_PATTERNS: `
     MATCH (a)-[r]->(b)
+    WHERE a.projectId = $projectId AND b.projectId = $projectId
     WITH labels(a)[0] AS fromType, type(r) AS relType, labels(b)[0] AS toType, count(*) AS count
     WHERE count > 5
     RETURN fromType, relType, toType, count
@@ -400,7 +493,7 @@ export const QUERIES = {
      * Get node details by ID
      */
     GET_NODE_BY_ID: `
-    MATCH (n) WHERE n.id = $nodeId
+    MATCH (n) WHERE n.id = $nodeId AND n.projectId = $projectId
     RETURN n.id AS id,
            n.name AS name,
            labels(n) AS labels,
@@ -413,9 +506,9 @@ export const QUERIES = {
      * Based on GET_CROSS_FILE_EDGES pattern but for a single node
      */
     GET_NODE_IMPACT: `
-    MATCH (target) WHERE target.id = $nodeId
+    MATCH (target) WHERE target.id = $nodeId AND target.projectId = $projectId
     MATCH (dependent)-[r]->(target)
-    WHERE dependent.id <> target.id
+    WHERE dependent.id <> target.id AND dependent.projectId = $projectId
     RETURN DISTINCT
       dependent.id AS nodeId,
       dependent.name AS name,
@@ -431,12 +524,17 @@ export const QUERIES = {
      * Directly reuses GET_CROSS_FILE_EDGES pattern
      */
     GET_FILE_IMPACT: `
-    MATCH (sf:SourceFile {filePath: $filePath})
-    OPTIONAL MATCH (sf)-[*]->(child)
-    WITH collect(DISTINCT sf) + collect(DISTINCT child) AS nodesInFile
-    UNWIND nodesInFile AS n
+    MATCH (sf:SourceFile)
+    WHERE sf.projectId = $projectId
+      AND (sf.filePath = $filePath OR sf.filePath ENDS WITH '/' + $filePath)
+    MATCH (sf)-[:CONTAINS]->(entity)
+    WHERE entity:Class OR entity:Function OR entity:Interface
+    WITH collect(DISTINCT entity) AS entitiesInFile, sf.filePath AS sourceFilePath
+    UNWIND entitiesInFile AS n
     MATCH (dependent)-[r]->(n)
-    WHERE NOT dependent IN nodesInFile
+    WHERE NOT dependent IN entitiesInFile
+      AND dependent.projectId = $projectId
+      AND dependent.filePath <> sourceFilePath
     RETURN DISTINCT
       dependent.id AS nodeId,
       dependent.name AS name,
@@ -453,8 +551,9 @@ export const QUERIES = {
      * Get transitive dependents - nodes that depend on dependents (for deeper impact)
      */
     GET_TRANSITIVE_DEPENDENTS: (maxDepth = 4) => `
-    MATCH (target) WHERE target.id = $nodeId
+    MATCH (target) WHERE target.id = $nodeId AND target.projectId = $projectId
     MATCH path = (dependent)-[*2..${maxDepth}]->(target)
+    WHERE dependent.projectId = $projectId AND all(n IN nodes(path) WHERE n.projectId = $projectId)
     WITH dependent,
          length(path) AS depth,
          [r IN relationships(path) | type(r)] AS relationshipPath

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-graph-context",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "description": "MCP server that builds code graphs to provide rich context to LLMs",
   "type": "module",
   "homepage": "https://github.com/drewdrewH/code-graph-context#readme",
@@ -49,12 +49,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.15.1",
+    "@parcel/watcher": "^2.5.1",
     "commander": "^14.0.0",
     "dotenv": "^17.2.3",
     "glob": "^11.0.3",
     "neo4j": "^2.0.0-RC2",
     "neo4j-driver": "^5.28.1",
     "openai": "^5.10.1",
+    "ts-morph": "^26.0.0",
+    "yaml": "^2.8.2",
     "zod": "^3.25.76"
   },
   "devDependencies": {
@@ -73,7 +76,6 @@
     "globals": "^16.2.0",
     "prettier": "^3.5.3",
     "reflect-metadata": "^0.2.2",
-    "ts-morph": "^26.0.0",
     "ts-node": "^10.9.2",
     "typescript": "^5.8.3",
     "typescript-eslint": "^8.34.1",