gitnexus 1.6.10-rc.215 → 1.6.10-rc.216

package/dist/core/ingestion/import-resolvers/php.js

@@ -36,12 +36,23 @@ export function resolvePhpImportInternal(importPath, composerConfig, allFiles, n
         return null;
     if (composerConfig) {
         const sorted = getSortedPsr4(composerConfig);
+        const authoritativePsr4 = composerConfig.authoritativePsr4 ?? new Set(sorted.map(([namespace]) => namespace));
+        let matchedAuthoritativeNamespace = false;
+        let hasAuthoritativeCatchAllNamespace = false;
+        const ownershipPath = normalized.replace(/^\/+/, '');
         for (const [nsPrefix, dirPrefix] of sorted) {
-            const nsPrefixSlash = nsPrefix.replace(/\\/g, '/');
-            if (normalized.startsWith(nsPrefixSlash + '/') || normalized === nsPrefixSlash) {
-                const remainder = normalized.slice(nsPrefixSlash.length).replace(/^\//, '');
+            const nsPrefixSlash = nsPrefix.replace(/\\/g, '/').replace(/\/+$/, '');
+            const isCatchAll = nsPrefixSlash === '';
+            if (isCatchAll ||
+                ownershipPath.startsWith(nsPrefixSlash + '/') ||
+                ownershipPath === nsPrefixSlash) {
+                const isAuthoritative = authoritativePsr4.has(nsPrefix);
+                matchedAuthoritativeNamespace ||= isAuthoritative;
+                hasAuthoritativeCatchAllNamespace ||= isAuthoritative && isCatchAll;
+                const remainder = ownershipPath.slice(nsPrefixSlash.length).replace(/^\//, '');
                 // 1. Try class-style PSR-4: full path → file (e.g. App\Models\User → app/Models/User.php)
-                const filePath = dirPrefix + (remainder ? '/' + remainder : '') + '.php';
+                const mappedPath = dirPrefix === '' ? remainder : dirPrefix + (remainder ? '/' + remainder : '');
+                const filePath = mappedPath + '.php';
                 if (allFiles.has(filePath))
                     return filePath;
                 if (index) {
@@ -51,44 +62,60 @@ export function resolvePhpImportInternal(importPath, composerConfig, allFiles, n
                 }
                 // 2. Function/constant fallback: strip last segment (symbol name), scan namespace directory.
                 //    e.g. App\Models\getUser → directory app/Models/, find first .php file in that dir.
-                const lastSlash = remainder.lastIndexOf('/');
-                const nsDir = lastSlash >= 0 ? dirPrefix + '/' + remainder.slice(0, lastSlash) : dirPrefix;
-                // Prefer SuffixIndex directory lookup (O(log n + matches)) over linear scan.
-                //
-                // An EMPTY bucket is a final answer, not a miss to retry with the scan
-                // below — which is what the `else` restores, and what this comment
-                // always claimed. Re-scanning on empty was the last per-import
-                // workspace traversal left in PHP resolution after #2901: any `use`
-                // matching a PSR-4 prefix whose directory holds no direct `.php` child
-                // (`App\Legacy\Ghost`) paid a full pass, measured at 201 traversals for
-                // 200 imports.
-                //
-                // The bucket is a superset of what the scan can find, for BOTH index
-                // shapes that reach here. A root-anchored direct child `nsDir/<x>.php`
-                // has its directory exactly equal to `nsDir`, and `nsDir` is always one
-                // of that directory's own suffixes — so the shared `dirMap` (keyed on
-                // every directory suffix) necessarily contains it, as does the
-                // root-anchored parity index `languages/php/import-target.ts` builds.
-                // Empty superset therefore implies empty scan, and control falls
-                // through to the next PSR-4 prefix exactly as before.
-                if (index) {
-                    const candidates = index.getFilesInDir(nsDir, '.php');
-                    if (candidates.length > 0)
-                        return candidates[0];
-                }
-                else {
-                    // Linear scan, only when a SuffixIndex is genuinely unavailable.
-                    const nsDirPrefix = nsDir.endsWith('/') ? nsDir : nsDir + '/';
-                    for (const f of allFiles) {
-                        if (f.startsWith(nsDirPrefix) &&
-                            f.endsWith('.php') &&
-                            !f.slice(nsDirPrefix.length).includes('/')) {
-                            return f;
+                // A root/catch-all mapping cannot safely infer a symbol's declaring
+                // file from an arbitrary sibling. The higher-level PHP resolver has
+                // parsed symbol-kind and declaration evidence for function/const
+                // imports; class imports must not inherit this directory heuristic.
+                if (!isCatchAll && dirPrefix !== '') {
+                    const lastSlash = remainder.lastIndexOf('/');
+                    const relativeNamespace = lastSlash >= 0 ? remainder.slice(0, lastSlash) : '';
+                    const nsDir = relativeNamespace === '' ? dirPrefix : `${dirPrefix}/${relativeNamespace}`;
+                    // Prefer SuffixIndex directory lookup (O(log n + matches)) over linear scan.
+                    //
+                    // An EMPTY bucket is a final answer, not a miss to retry with the scan
+                    // below — which is what the `else` restores, and what this comment
+                    // always claimed. Re-scanning on empty was the last per-import
+                    // workspace traversal left in PHP resolution after #2901: any `use`
+                    // matching a PSR-4 prefix whose directory holds no direct `.php` child
+                    // (`App\Legacy\Ghost`) paid a full pass, measured at 201 traversals for
+                    // 200 imports.
+                    //
+                    // The bucket is a superset of what the scan can find, for BOTH index
+                    // shapes that reach here. A root-anchored direct child `nsDir/<x>.php`
+                    // has its directory exactly equal to `nsDir`, and `nsDir` is always one
+                    // of that directory's own suffixes — so the shared `dirMap` (keyed on
+                    // every directory suffix) necessarily contains it, as does the
+                    // root-anchored parity index `languages/php/import-target.ts` builds.
+                    // Empty superset therefore implies empty scan, and control falls
+                    // through to the next PSR-4 prefix exactly as before.
+                    if (index) {
+                        const candidates = index.getFilesInDir(nsDir, '.php');
+                        if (candidates.length > 0)
+                            return candidates[0];
+                    }
+                    else {
+                        // Linear scan, only when a SuffixIndex is genuinely unavailable.
+                        const nsDirPrefix = nsDir.endsWith('/') ? nsDir : nsDir + '/';
+                        for (const f of allFiles) {
+                            if (f.startsWith(nsDirPrefix) &&
+                                f.endsWith('.php') &&
+                                !f.slice(nsDirPrefix.length).includes('/')) {
+                                return f;
+                            }
                         }
                     }
                 }
             }
         }
+        // A non-empty PSR-4 map is authoritative for namespaces it does not own.
+        // Preserve the existing mapped-namespace fallback behavior; #2962 is the
+        // conservative external-namespace gate, not a rewrite of mapped lookup.
+        // A catch-all owns every namespace, so its misses remain authoritative.
+        if (authoritativePsr4.size > 0 &&
+            !composerConfig.hasUnmodeledAutoload &&
+            (!matchedAuthoritativeNamespace || hasAuthoritativeCatchAllNamespace)) {
+            return null;
+        }
     }
     // Fallback: suffix matching (works without composer.json)
     const pathParts = normalized.split('/').filter(Boolean);

package/dist/core/ingestion/language-config.d.ts

@@ -14,10 +14,19 @@ export interface GoModuleConfig {
 export interface ComposerConfig {
     /** Map of namespace prefix -> directory (e.g., "App\\" -> "app/") */
     psr4: Map<string, string>;
+    /** Production `autoload.psr-4` prefixes that may gate external namespaces.
+     *  Absent on legacy/manual configs, where every mapping remains authoritative. */
+    authoritativePsr4?: ReadonlySet<string>;
+    /** True when Composer also declares an autoload mechanism this resolver does not model. */
+    hasUnmodeledAutoload?: boolean;
     /** PSR-4 entries sorted by namespace length descending (longest match wins).
      *  Cached once at config load time to avoid re-sorting on every import. */
     psr4Sorted?: readonly [string, string][];
 }
+/** Parse one Composer manifest without performing I/O. */
+export declare function parseComposerConfig(value: unknown, baseDir?: string): ComposerConfig | null;
+/** Merge package-local Composer manifests into one repository-relative config. */
+export declare function mergeComposerConfigs(configs: readonly ComposerConfig[]): ComposerConfig | null;
 /** C# project config parsed from .csproj files */
 export interface CSharpProjectConfig {
     /** Root namespace from <RootNamespace> or assembly name (default: project directory name) */

package/dist/core/ingestion/language-config.js

@@ -5,6 +5,93 @@ import path from 'path';
 import { isDev } from './utils/env.js';
 import { mapConcurrent } from '../../lib/utils.js';
 import { logger } from '../logger.js';
+function normalizeComposerDirectory(baseDir, directory) {
+    const normalizedBase = baseDir.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/, '');
+    const normalizedDirectory = directory
+        .replace(/\\/g, '/')
+        .replace(/^(?:\.\/)+/, '')
+        .replace(/\/+$/, '');
+    if (normalizedBase === '')
+        return normalizedDirectory;
+    if (normalizedDirectory === '')
+        return normalizedBase;
+    return path.posix.normalize(`${normalizedBase}/${normalizedDirectory}`);
+}
+/** Parse one Composer manifest without performing I/O. */
+export function parseComposerConfig(value, baseDir = '') {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return null;
+    const composer = value;
+    const autoload = composer.autoload;
+    const autoloadDev = composer['autoload-dev'];
+    if (autoload === undefined && autoloadDev === undefined)
+        return null;
+    const psr4 = new Map();
+    const authoritativePsr4 = new Set();
+    let hasUnmodeledAutoload = false;
+    const addSection = (sectionValue, authoritative) => {
+        if (typeof sectionValue !== 'object' || sectionValue === null || Array.isArray(sectionValue)) {
+            return;
+        }
+        const section = sectionValue;
+        if ('psr-0' in section || 'classmap' in section)
+            hasUnmodeledAutoload = true;
+        const rawPsr4 = section['psr-4'];
+        if (typeof rawPsr4 !== 'object' || rawPsr4 === null || Array.isArray(rawPsr4))
+            return;
+        for (const [namespace, directories] of Object.entries(rawPsr4)) {
+            const stringDirectories = Array.isArray(directories)
+                ? directories.filter((entry) => typeof entry === 'string')
+                : typeof directories === 'string'
+                    ? [directories]
+                    : [];
+            if (stringDirectories.length === 0)
+                continue;
+            if (stringDirectories.length > 1)
+                hasUnmodeledAutoload = true;
+            const normalizedNamespace = namespace.replace(/\\+$/, '');
+            const normalizedDirectory = normalizeComposerDirectory(baseDir, stringDirectories[0]);
+            const existing = psr4.get(normalizedNamespace);
+            if (existing !== undefined && existing !== normalizedDirectory) {
+                hasUnmodeledAutoload = true;
+                continue;
+            }
+            if (existing === undefined)
+                psr4.set(normalizedNamespace, normalizedDirectory);
+            if (authoritative)
+                authoritativePsr4.add(normalizedNamespace);
+        }
+    };
+    // Production mappings win duplicate prefixes. Development mappings remain
+    // usable for test code but do not establish authority for the external gate.
+    addSection(autoload, true);
+    addSection(autoloadDev, false);
+    return { psr4, authoritativePsr4, hasUnmodeledAutoload };
+}
+/** Merge package-local Composer manifests into one repository-relative config. */
+export function mergeComposerConfigs(configs) {
+    if (configs.length === 0)
+        return null;
+    const psr4 = new Map();
+    const authoritativePsr4 = new Set();
+    let hasUnmodeledAutoload = false;
+    for (const config of configs) {
+        hasUnmodeledAutoload ||= config.hasUnmodeledAutoload === true;
+        for (const [namespace, directory] of config.psr4) {
+            const existing = psr4.get(namespace);
+            if (existing !== undefined && existing !== directory) {
+                hasUnmodeledAutoload = true;
+                continue;
+            }
+            if (existing === undefined)
+                psr4.set(namespace, directory);
+        }
+        for (const namespace of config.authoritativePsr4 ?? config.psr4.keys()) {
+            authoritativePsr4.add(namespace);
+        }
+    }
+    return { psr4, authoritativePsr4, hasUnmodeledAutoload };
+}
 /** Project the one-pass {@link CSharpProjectScan} into the
  *  {@link CSharpNamespaceEvidence} both import-resolution legs thread to the
  *  #1881 gate — one shape, two carriers (`ImportConfigs.csharpNamespaces` for
@@ -85,20 +172,13 @@ export async function loadComposerConfig(repoRoot) {
     try {
         const composerPath = path.join(repoRoot, 'composer.json');
         const raw = await fs.readFile(composerPath, 'utf-8');
-        const composer = JSON.parse(raw);
-        const psr4Raw = composer.autoload?.['psr-4'] ?? {};
-        const psr4Dev = composer['autoload-dev']?.['psr-4'] ?? {};
-        const merged = { ...psr4Raw, ...psr4Dev };
-        const psr4 = new Map();
-        for (const [ns, dir] of Object.entries(merged)) {
-            const nsNorm = ns.replace(/\\+$/, '');
-            const dirNorm = dir.replace(/\\/g, '/').replace(/\/+$/, '');
-            psr4.set(nsNorm, dirNorm);
-        }
+        const config = parseComposerConfig(JSON.parse(raw));
+        if (config === null)
+            return null;
         if (isDev) {
-            logger.info(`📦 Loaded ${psr4.size} PSR-4 mappings from composer.json`);
+            logger.info(`📦 Loaded ${config.psr4.size} PSR-4 mappings from composer.json`);
         }
-        return { psr4 };
+        return config;
     }
     catch {
         return null;

package/dist/core/ingestion/languages/php/import-target.d.ts

@@ -16,15 +16,14 @@
  */
 import type { ParsedImport, WorkspaceIndex } from '../../../../_shared/index.js';
 import type { ImportResolutionContext } from '../../scope-resolution/contract/scope-resolver.js';
-import type { ComposerConfig } from '../../language-config.js';
+import { type ComposerConfig } from '../../language-config.js';
 export interface PhpResolveContext {
     readonly fromFile: string;
     readonly allFilePaths: ReadonlySet<string>;
 }
 /**
- * Load and parse `composer.json` from the repo root. Returns a
- * `ComposerConfig` object (PSR-4 namespace → directory mappings) or
- * `null` when no `composer.json` is present or it cannot be parsed.
+ * Load and parse repository and package-local `composer.json` manifests.
+ * Package mappings are rebased to repository-relative paths before merging.
  *
  * The result is threaded into each `resolvePhpImportInternal` call as
  * the `composerConfig` argument.

package/dist/core/ingestion/languages/php/import-target.js

@@ -17,8 +17,9 @@
 import { resolvePhpImportInternal } from '../../import-resolvers/php.js';
 import { perFileSet } from '../../import-resolvers/per-file-set.js';
 import { getWorkspaceFileIndex } from '../../import-resolvers/workspace-file-index.js';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { mergeComposerConfigs, parseComposerConfig, } from '../../language-config.js';
+import { readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, relative } from 'node:path';
 function normalizePhpPath(value) {
     return value.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/, '');
 }
@@ -32,17 +33,18 @@ function namespaceDirectories(targetRaw, composerConfig, resolved) {
     }
     if (composerConfig === null)
         return [...directories];
-    const normalizedTarget = normalizePhpPath(targetRaw);
+    const normalizedTarget = normalizePhpPath(targetRaw).replace(/^\/+/, '');
     const mappings = [...composerConfig.psr4.entries()].sort((left, right) => {
         const lengthDifference = right[0].length - left[0].length;
         return lengthDifference !== 0 ? lengthDifference : left[0].localeCompare(right[0]);
     });
     for (const [namespacePrefix, directoryPrefix] of mappings) {
         const normalizedPrefix = normalizePhpPath(namespacePrefix);
-        if (normalizedTarget !== normalizedPrefix &&
-            !normalizedTarget.startsWith(`${normalizedPrefix}/`)) {
+        const matchesNamespace = normalizedPrefix === '' ||
+            normalizedTarget === normalizedPrefix ||
+            normalizedTarget.startsWith(`${normalizedPrefix}/`);
+        if (!matchesNamespace)
             continue;
-        }
         const remainder = normalizedTarget.slice(normalizedPrefix.length).replace(/^\//, '');
         const separator = remainder.lastIndexOf('/');
         const relativeNamespace = separator >= 0 ? remainder.slice(0, separator) : '';
@@ -57,20 +59,10 @@ function parentDirectory(filePath) {
     return separator < 0 ? '' : normalizedPath.slice(0, separator);
 }
 function directoryAliases(filePath) {
-    const normalizedPath = normalizePhpPath(filePath);
-    const separator = normalizedPath.lastIndexOf('/');
-    if (separator < 0)
-        return [''];
-    const parent = normalizedPath.slice(0, separator);
-    const aliases = new Set([parent]);
-    const segments = parent.split('/').filter(Boolean);
-    for (let index = 0; index < segments.length; index++) {
-        aliases.add(segments.slice(index).join('/'));
-    }
-    return [...aliases];
+    return [parentDirectory(filePath)];
 }
 /**
- * Directory alias → the files under it, built once per pass.
+ * Exact repository-relative directory → the files under it, built once per pass.
  *
  * A scope-resolution pass shares one stable `parsedFiles` array across imports,
  * so the array identity is the memo key — see `perFileSet`.
@@ -200,41 +192,69 @@ const getPhpWorkspaceIndex = perFileSet((allFilePaths) => {
 });
 // ─── loadResolutionConfig ──────────────────────────────────────────────────
 /**
- * Load and parse `composer.json` from the repo root. Returns a
- * `ComposerConfig` object (PSR-4 namespace → directory mappings) or
- * `null` when no `composer.json` is present or it cannot be parsed.
+ * Load and parse repository and package-local `composer.json` manifests.
+ * Package mappings are rebased to repository-relative paths before merging.
  *
  * The result is threaded into each `resolvePhpImportInternal` call as
  * the `composerConfig` argument.
  */
 export function loadPhpComposerConfig(repoPath) {
-    try {
-        const composerPath = join(repoPath, 'composer.json');
-        const raw = readFileSync(composerPath, 'utf8');
-        const parsed = JSON.parse(raw);
-        if (typeof parsed !== 'object' || parsed === null)
-            return null;
-        const composer = parsed;
-        const autoload = composer['autoload'];
-        if (autoload === undefined)
-            return null;
-        const psr4Raw = (autoload['psr-4'] ?? {});
-        const psr4 = new Map();
-        for (const [ns, dirs] of Object.entries(psr4Raw)) {
-            // namespace prefix ends with `\` — keep as-is; resolver strips it
-            const normalizedNs = ns.replace(/\\$/, '');
-            const dir = Array.isArray(dirs) ? dirs[0] : dirs;
-            if (typeof dir === 'string') {
-                // Normalize directory path (strip trailing slash)
-                const normalizedDir = dir.replace(/\/+$/, '');
-                psr4.set(normalizedNs, normalizedDir);
+    const skipDirectories = new Set([
+        '.git',
+        '.gitnexus',
+        'node_modules',
+        'vendor',
+        'dist',
+        'build',
+        'coverage',
+    ]);
+    const pending = [repoPath];
+    const manifests = [];
+    let incomplete = false;
+    let visitedDirectories = 0;
+    while (pending.length > 0) {
+        const directory = pending.pop();
+        if (directory === undefined)
+            break;
+        if (++visitedDirectories > 20_000) {
+            incomplete = true;
+            break;
+        }
+        let entries;
+        try {
+            entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+        }
+        catch {
+            incomplete = true;
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.isFile() && entry.name === 'composer.json') {
+                manifests.push(join(directory, entry.name));
+            }
+            else if (entry.isDirectory() && !skipDirectories.has(entry.name)) {
+                pending.push(join(directory, entry.name));
             }
         }
-        return { psr4 };
     }
-    catch {
-        return null;
+    const configs = [];
+    for (const manifest of manifests.sort()) {
+        try {
+            const baseDir = normalizePhpPath(relative(repoPath, dirname(manifest)));
+            const config = parseComposerConfig(JSON.parse(readFileSync(manifest, 'utf8')), baseDir);
+            if (config !== null)
+                configs.push(config);
+        }
+        catch {
+            incomplete = true;
+        }
     }
+    const merged = mergeComposerConfigs(configs);
+    if (merged === null)
+        return null;
+    if (incomplete)
+        merged.hasUnmodeledAutoload = true;
+    return merged;
 }
 // ─── resolvePhpImportTarget ────────────────────────────────────────────────
 /**
@@ -295,11 +315,7 @@ export function resolvePhpImportTargetInternal(targetRaw, _fromFile, allFilePath
     const candidateFiles = [
         ...new Set(directories.flatMap((directory) => {
             const files = directoryIndex.get(normalizePhpPath(directory)) ?? [];
-            // A suffix alias can match directories under different roots (for
-            // example app/Models and vendor/pkg/app/Models). Picking either root
-            // would be a guess, so fail closed to the composer resolution instead.
-            const distinctParents = new Set(files.map((file) => parentDirectory(file.filePath)));
-            return distinctParents.size > 1 ? [] : files;
+            return files;
         })),
     ];
     const expectedType = symbolKind === 'function' ? 'Function' : 'Variable';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.10-rc.215",
+  "version": "1.6.10-rc.216",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",