gitnexus 1.4.7 → 1.4.9

package/dist/mcp/resources.js

@@ -277,6 +277,8 @@ node_properties:
   Function: "parameterCount (INT32), returnType (STRING), isVariadic (BOOL)"
   Property: "declaredType (STRING) — the field's type annotation (e.g., 'Address', 'City'). Used for field-access chain resolution."
   Constructor: "parameterCount (INT32)"
+  Community: "heuristicLabel (STRING), cohesion (DOUBLE), symbolCount (INT32), keywords (STRING[]), description (STRING), enrichedBy (STRING)"
+  Process: "heuristicLabel (STRING), processType (STRING — 'intra_community' or 'cross_community'), stepCount (INT32), communities (STRING[]), entryPointId (STRING), terminalId (STRING)"
 
 relationships:
   - CONTAINS: File/Folder contains child

package/dist/mcp/tools.js

@@ -58,10 +58,10 @@ WHEN TO USE: Complex structural queries that search/explore can't answer. READ g
 AFTER THIS: Use context() on result symbols for deeper context.
 
 SCHEMA:
-- Nodes: File, Folder, Function, Class, Interface, Method, CodeElement, Community, Process
+- Nodes: File, Folder, Function, Class, Interface, Method, CodeElement, Community, Process, Route, Tool
 - Multi-language nodes (use backticks): \`Struct\`, \`Enum\`, \`Trait\`, \`Impl\`, etc.
 - All edges via single CodeRelation table with 'type' property
-- Edge types: CONTAINS, DEFINES, CALLS, IMPORTS, EXTENDS, IMPLEMENTS, HAS_METHOD, HAS_PROPERTY, ACCESSES, OVERRIDES, MEMBER_OF, STEP_IN_PROCESS
+- Edge types: CONTAINS, DEFINES, CALLS, IMPORTS, EXTENDS, IMPLEMENTS, HAS_METHOD, HAS_PROPERTY, ACCESSES, OVERRIDES, MEMBER_OF, STEP_IN_PROCESS, HANDLES_ROUTE, FETCHES, HANDLES_TOOL, ENTRY_POINT_OF
 - Edge properties: type (STRING), confidence (DOUBLE), reason (STRING), step (INT32)
 
 EXAMPLES:
@@ -93,8 +93,8 @@ OUTPUT: Returns { markdown, row_count } — results formatted as a Markdown tabl
 
 TIPS:
 - All relationships use single CodeRelation table — filter with {type: 'CALLS'} etc.
-- Community = auto-detected functional area (Leiden algorithm)
-- Process = execution flow trace from entry point to terminal
+- Community = auto-detected functional area (Leiden algorithm). Properties: heuristicLabel, cohesion, symbolCount, keywords, description, enrichedBy
+- Process = execution flow trace from entry point to terminal. Properties: heuristicLabel, processType, stepCount, communities, entryPointId, terminalId
 - Use heuristicLabel (not label) for human-readable community/process names`,
         inputSchema: {
             type: 'object',
@@ -209,4 +209,73 @@ Confidence: 1.0 = certain, <0.8 = fuzzy match`,
             required: ['target', 'direction'],
         },
     },
+    {
+        name: 'route_map',
+        description: `Show API route mappings: which components/hooks fetch which API endpoints, and which handler files serve them.
+
+WHEN TO USE: Understanding API consumption patterns, finding orphaned routes. For pre-change analysis, prefer \`api_impact\` which combines this data with mismatch detection and risk assessment.
+AFTER THIS: Use impact() on specific route handlers to see full blast radius.
+
+Returns: route nodes with their handlers, middleware wrapper chains (e.g., withAuth, withRateLimit), and consumers.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                route: { type: 'string', description: 'Filter by route path (e.g., "/api/grants"). Omit for all routes.' },
+                repo: { type: 'string', description: 'Repository name or path. Omit if only one repo is indexed.' },
+            },
+            required: [],
+        },
+    },
+    {
+        name: 'tool_map',
+        description: `Show MCP/RPC tool definitions: which tools are defined, where they're handled, and their descriptions.
+
+WHEN TO USE: Understanding tool APIs, finding tool implementations, impact analysis for tool changes.
+
+Returns: tool nodes with their handler files and descriptions.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                tool: { type: 'string', description: 'Filter by tool name. Omit for all tools.' },
+                repo: { type: 'string', description: 'Repository name or path.' },
+            },
+            required: [],
+        },
+    },
+    {
+        name: 'shape_check',
+        description: `Check response shapes for API routes against their consumers' property accesses.
+
+WHEN TO USE: Detecting mismatches between what an API route returns and what consumers expect. Finding shape drift. For pre-change analysis, prefer \`api_impact\` which combines this data with mismatch detection and risk assessment.
+REQUIRES: Route nodes with responseKeys (extracted from .json({...}) calls during indexing).
+
+Returns routes that have both detected response keys AND consumers. Shows top-level keys each endpoint returns (e.g., data, pagination, error) and what keys each consumer accesses. Reports MISMATCH status when a consumer accesses keys not present in the route's response shape.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                route: { type: 'string', description: 'Check a specific route (e.g., "/api/grants"). Omit to check all routes.' },
+                repo: { type: 'string', description: 'Repository name or path. Omit if only one repo is indexed.' },
+            },
+            required: [],
+        },
+    },
+    {
+        name: 'api_impact',
+        description: `Pre-change impact report for an API route handler.
+
+WHEN TO USE: BEFORE modifying any API route handler. Shows what consumers depend on, what response fields they access, what middleware protects the route, and what execution flows it triggers. Requires at least "route" or "file" parameter.
+
+Risk levels: LOW (0-3 consumers), MEDIUM (4-9 or any mismatches), HIGH (10+ consumers or mismatches with 4+ consumers). Mismatches with confidence "low" indicate the consumer file fetches multiple routes — property attribution is approximate.
+
+Returns: single route object when one match, or { routes: [...], total: N } for multiple matches. Combines route_map, shape_check, and impact data.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                route: { type: 'string', description: 'Route path (e.g., "/api/grants")' },
+                file: { type: 'string', description: 'Handler file path (alternative to route)' },
+                repo: { type: 'string', description: 'Repository name or path.' },
+            },
+            required: [],
+        },
+    },
 ];

package/dist/server/api.d.ts

@@ -5,6 +5,24 @@
  * Also hosts the MCP server over StreamableHTTP for remote AI tool access.
  *
  * Security: binds to 127.0.0.1 by default (use --host to override).
- * CORS is restricted to localhost and the deployed site.
+ * CORS is restricted to localhost, private/LAN networks, and the deployed site.
  */
+/**
+ * Determine whether an HTTP Origin header value is allowed by CORS policy.
+ *
+ * Permitted origins:
+ * - No origin (non-browser requests such as curl or server-to-server calls)
+ * - http://localhost:<port> — local development
+ * - http://127.0.0.1:<port> — loopback alias
+ * - RFC 1918 private/LAN networks (any port):
+ *     10.0.0.0/8      → 10.x.x.x
+ *     172.16.0.0/12   → 172.16.x.x – 172.31.x.x
+ *     192.168.0.0/16  → 192.168.x.x
+ * - https://gitnexus.vercel.app — the deployed GitNexus web UI
+ *
+ * @param origin - The value of the HTTP `Origin` request header, or `undefined`
+ *                 when the header is absent (non-browser request).
+ * @returns `true` if the origin is allowed, `false` otherwise.
+ */
+export declare const isAllowedOrigin: (origin: string | undefined) => boolean;
 export declare const createServer: (port: number, host?: string) => Promise<void>;

package/dist/server/api.js

@@ -5,7 +5,7 @@
  * Also hosts the MCP server over StreamableHTTP for remote AI tool access.
  *
  * Security: binds to 127.0.0.1 by default (use --host to override).
- * CORS is restricted to localhost and the deployed site.
+ * CORS is restricted to localhost, private/LAN networks, and the deployed site.
  */
 import express from 'express';
 import cors from 'cors';
@@ -20,6 +20,69 @@ import { hybridSearch } from '../core/search/hybrid-search.js';
 // at server startup — crashes on unsupported Node ABI versions (#89)
 import { LocalBackend } from '../mcp/local/local-backend.js';
 import { mountMCPEndpoints } from './mcp-http.js';
+/**
+ * Determine whether an HTTP Origin header value is allowed by CORS policy.
+ *
+ * Permitted origins:
+ * - No origin (non-browser requests such as curl or server-to-server calls)
+ * - http://localhost:<port> — local development
+ * - http://127.0.0.1:<port> — loopback alias
+ * - RFC 1918 private/LAN networks (any port):
+ *     10.0.0.0/8      → 10.x.x.x
+ *     172.16.0.0/12   → 172.16.x.x – 172.31.x.x
+ *     192.168.0.0/16  → 192.168.x.x
+ * - https://gitnexus.vercel.app — the deployed GitNexus web UI
+ *
+ * @param origin - The value of the HTTP `Origin` request header, or `undefined`
+ *                 when the header is absent (non-browser request).
+ * @returns `true` if the origin is allowed, `false` otherwise.
+ */
+export const isAllowedOrigin = (origin) => {
+    if (origin === undefined) {
+        // Non-browser requests (curl, server-to-server) have no Origin header
+        return true;
+    }
+    if (origin.startsWith('http://localhost:')
+        || origin === 'http://localhost'
+        || origin.startsWith('http://127.0.0.1:')
+        || origin === 'http://127.0.0.1'
+        || origin.startsWith('http://[::1]:')
+        || origin === 'http://[::1]'
+        || origin === 'https://gitnexus.vercel.app') {
+        return true;
+    }
+    // RFC 1918 private network ranges — allow any port on these hosts.
+    // We parse the hostname out of the origin URL and check against each range.
+    let hostname;
+    let protocol;
+    try {
+        const parsed = new URL(origin);
+        hostname = parsed.hostname;
+        protocol = parsed.protocol;
+    }
+    catch {
+        // Malformed origin — reject
+        return false;
+    }
+    // Only allow HTTP(S) origins — reject ftp://, file://, etc.
+    if (protocol !== 'http:' && protocol !== 'https:')
+        return false;
+    const octets = hostname.split('.').map(Number);
+    if (octets.length !== 4 || octets.some(o => !Number.isInteger(o) || o < 0 || o > 255)) {
+        return false;
+    }
+    const [a, b] = octets;
+    // 10.0.0.0/8
+    if (a === 10)
+        return true;
+    // 172.16.0.0/12  →  172.16.x.x – 172.31.x.x
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    // 192.168.0.0/16
+    if (a === 192 && b === 168)
+        return true;
+    return false;
+};
 const buildGraph = async () => {
     const nodes = [];
     for (const table of NODE_TABLES) {
@@ -101,14 +164,11 @@ const requestedRepo = (req) => {
 };
 export const createServer = async (port, host = '127.0.0.1') => {
     const app = express();
-    // CORS: only allow localhost origins and the deployed site.
+    // CORS: allow localhost, private/LAN networks, and the deployed site.
     // Non-browser requests (curl, server-to-server) have no origin and are allowed.
     app.use(cors({
         origin: (origin, callback) => {
-            if (!origin
-                || origin.startsWith('http://localhost:')
-                || origin.startsWith('http://127.0.0.1:')
-                || origin === 'https://gitnexus.vercel.app') {
+            if (isAllowedOrigin(origin)) {
                 callback(null, true);
             }
             else {

package/dist/storage/git.d.ts

@@ -4,3 +4,15 @@ export declare const getCurrentCommit: (repoPath: string) => string;
  * Find the git repository root from any path inside the repo
  */
 export declare const getGitRoot: (fromPath: string) => string | null;
+/**
+ * Check whether a directory contains a .git entry (file or folder).
+ *
+ * This is intentionally a simple filesystem check rather than running
+ * `git rev-parse`, so it works even when git is not installed or when
+ * the directory is a git-worktree root (which has a .git file, not a
+ * directory).  Use `isGitRepo` for a definitive git answer.
+ *
+ * @param dirPath - Absolute path to the directory to inspect.
+ * @returns `true` when `.git` is present, `false` otherwise.
+ */
+export declare const hasGitDir: (dirPath: string) => boolean;

package/dist/storage/git.js

@@ -1,4 +1,5 @@
 import { execSync } from 'child_process';
+import { statSync } from 'fs';
 import path from 'path';
 // Git utilities for repository detection, commit tracking, and diff analysis
 export const isGitRepo = (repoPath) => {
@@ -33,3 +34,23 @@ export const getGitRoot = (fromPath) => {
         return null;
     }
 };
+/**
+ * Check whether a directory contains a .git entry (file or folder).
+ *
+ * This is intentionally a simple filesystem check rather than running
+ * `git rev-parse`, so it works even when git is not installed or when
+ * the directory is a git-worktree root (which has a .git file, not a
+ * directory).  Use `isGitRepo` for a definitive git answer.
+ *
+ * @param dirPath - Absolute path to the directory to inspect.
+ * @returns `true` when `.git` is present, `false` otherwise.
+ */
+export const hasGitDir = (dirPath) => {
+    try {
+        statSync(path.join(dirPath, '.git'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+};

package/dist/storage/repo-manager.d.ts

@@ -119,10 +119,13 @@ export declare const unregisterRepo: (repoPath: string) => Promise<void>;
 export declare const listRegisteredRepos: (opts?: {
     validate?: boolean;
 }) => Promise<RegistryEntry[]>;
+export type LLMProvider = 'openai' | 'cursor';
 export interface CLIConfig {
     apiKey?: string;
     model?: string;
     baseUrl?: string;
+    provider?: LLMProvider;
+    cursorModel?: string;
 }
 /**
  * Get the path to the global CLI config file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.4.7",
+  "version": "1.4.9",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -20,6 +20,7 @@
     "knowledge-graph",
     "cursor",
     "claude",
+    "codex",
     "ai-agent",
     "gitnexus",
     "static-analysis",
@@ -45,11 +46,11 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "prepare": "npm run build",
-    "postinstall": "node scripts/patch-tree-sitter-swift.cjs",
     "prepack": "npm run build && chmod +x dist/cli/index.js"
   },
   "dependencies": {
     "@huggingface/transformers": "^3.0.0",
+    "@ladybugdb/core": "^0.15.2",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "cli-progress": "^3.12.0",
     "commander": "^12.0.0",
@@ -59,28 +60,29 @@
     "graphology": "^0.25.4",
     "graphology-indices": "^0.17.0",
     "graphology-utils": "^2.3.0",
-    "@ladybugdb/core": "^0.15.2",
     "ignore": "^7.0.5",
     "lru-cache": "^11.0.0",
     "mnemonist": "^0.39.0",
+    "onnxruntime-node": "^1.24.0",
     "pandemonium": "^2.4.0",
-    "tree-sitter": "^0.21.0",
-    "tree-sitter-c": "^0.21.0",
-    "tree-sitter-c-sharp": "^0.21.0",
-    "tree-sitter-cpp": "^0.22.0",
-    "tree-sitter-go": "^0.21.0",
-    "tree-sitter-java": "^0.21.0",
-    "tree-sitter-javascript": "^0.21.0",
-    "tree-sitter-php": "^0.23.12",
-    "tree-sitter-python": "^0.21.0",
+    "tree-sitter": "^0.25.0",
+    "tree-sitter-c": "^0.24.1",
+    "tree-sitter-c-sharp": "^0.23.1",
+    "tree-sitter-cpp": "^0.23.4",
+    "tree-sitter-go": "^0.25.0",
+    "tree-sitter-java": "^0.23.5",
+    "tree-sitter-javascript": "^0.25.0",
+    "tree-sitter-php": "^0.24.2",
+    "tree-sitter-python": "^0.25.0",
     "tree-sitter-ruby": "^0.23.1",
-    "tree-sitter-rust": "^0.21.0",
-    "tree-sitter-typescript": "^0.21.0",
+    "tree-sitter-rust": "^0.24.0",
+    "tree-sitter-typescript": "^0.23.2",
     "uuid": "^13.0.0"
   },
   "optionalDependencies": {
+    "tree-sitter-dart": "github:UserNobody14/tree-sitter-dart#0fc19c3a57b1109802af41d2b8f60d8835c5da3a",
     "tree-sitter-kotlin": "^0.3.8",
-    "tree-sitter-swift": "^0.6.0"
+    "tree-sitter-swift": "0.7.1"
   },
   "devDependencies": {
     "@types/cli-progress": "^3.11.6",
@@ -89,11 +91,18 @@
     "@types/node": "^20.0.0",
     "@types/uuid": "^10.0.0",
     "@vitest/coverage-v8": "^4.0.18",
+    "husky": "^9.1.7",
     "tsx": "^4.0.0",
     "typescript": "^5.4.5",
     "vitest": "^4.0.18"
   },
+  "overrides": {
+    "@huggingface/transformers": {
+      "onnxruntime-node": "$onnxruntime-node"
+    },
+    "tree-sitter": "^0.25.0"
+  },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   }
 }

package/dist/core/ingestion/named-binding-extraction.d.ts

@@ -1,61 +0,0 @@
-import { SupportedLanguages } from '../../config/supported-languages.js';
-import type { SymbolTable, SymbolDefinition } from './symbol-table.js';
-import type { NamedImportMap } from './import-processor.js';
-/**
- * Walk a named-binding re-export chain through NamedImportMap.
- *
- * When file A imports { User } from B, and B re-exports { User } from C,
- * the NamedImportMap for A points to B, but B has no User definition.
- * This function follows the chain: A→B→C until a definition is found.
- *
- * Returns the definitions found at the end of the chain, or null if the
- * chain breaks (missing binding, circular reference, or depth exceeded).
- * Max depth 5 to prevent infinite loops.
- *
- * @param allDefs Pre-computed `symbolTable.lookupFuzzy(name)` result — must be the
- *               complete unfiltered result. Passing a file-filtered subset will cause
- *               silent misses at depth=0 for non-aliased bindings.
- */
-export declare function walkBindingChain(name: string, currentFilePath: string, symbolTable: SymbolTable, namedImportMap: NamedImportMap, allDefs: SymbolDefinition[]): SymbolDefinition[] | null;
-/**
- * Extract named bindings from an import AST node.
- * Returns undefined if the import is not a named import (e.g., import * or default).
- *
- * TS: import { User, Repo as R } from './models'
- *   → [{local:'User', exported:'User'}, {local:'R', exported:'Repo'}]
- *
- * Python: from models import User, Repo as R
- *   → [{local:'User', exported:'User'}, {local:'R', exported:'Repo'}]
- */
-export declare function extractNamedBindings(importNode: any, language: SupportedLanguages): {
-    local: string;
-    exported: string;
-}[] | undefined;
-export declare function extractTsNamedBindings(importNode: any): {
-    local: string;
-    exported: string;
-}[] | undefined;
-export declare function extractPythonNamedBindings(importNode: any): {
-    local: string;
-    exported: string;
-}[] | undefined;
-export declare function extractKotlinNamedBindings(importNode: any): {
-    local: string;
-    exported: string;
-}[] | undefined;
-export declare function extractRustNamedBindings(importNode: any): {
-    local: string;
-    exported: string;
-}[] | undefined;
-export declare function extractPhpNamedBindings(importNode: any): {
-    local: string;
-    exported: string;
-}[] | undefined;
-export declare function extractCsharpNamedBindings(importNode: any): {
-    local: string;
-    exported: string;
-}[] | undefined;
-export declare function extractJavaNamedBindings(importNode: any): {
-    local: string;
-    exported: string;
-}[] | undefined;