gitnexus 1.6.10-rc.83 → 1.6.10-rc.84

package/dist/core/ingestion/pipeline-phases/spring-config.js

@@ -19,6 +19,10 @@ import { generateId } from '../../../lib/utils.js';
 import { getPhaseOutput } from './types.js';
 const require = createRequire(import.meta.url);
 const yaml = require('js-yaml');
+// js-yaml 5 dropped DEFAULT_SCHEMA; CORE plus these tags is what it used to be, so
+// explicitly tagged values keep parsing instead of throwing (an unknown tag aborts
+// the whole file). None of them can execute code.
+const SPRING_YAML_SCHEMA = yaml.CORE_SCHEMA.withTags(yaml.mergeTag, yaml.timestampTag, yaml.binaryTag, yaml.omapTag, yaml.pairsTag, yaml.setTag);
 const MAX_CONFIG_FILE_BYTES = 2 * 1024 * 1024;
 const MAX_YAML_TRAVERSAL_DEPTH = 128;
 const MAX_YAML_TRAVERSAL_NODES = 100_000;
@@ -111,10 +115,10 @@ function consumeYamlTraversalBudget(state, depth) {
 function isObjectValue(value) {
     return value !== null && typeof value === 'object';
 }
-function resolveYamlAliasEvent(event, objectEvents) {
-    if (event?.kind !== null || !isObjectValue(event.result))
-        return event;
-    return objectEvents.get(event.result) ?? event;
+// Aliases are resolved to their anchor event by name while the tree is built,
+// so following one here is a single pointer hop.
+function resolveYamlAliasEvent(event) {
+    return event?.aliasOf ?? event;
 }
 function yamlMappingPairs(event) {
     const pairs = [];
@@ -127,112 +131,238 @@ function yamlMappingPairs(event) {
     }
     return pairs;
 }
-function findYamlMappingLocation(event, key, objectEvents, traversal, visited = new Set(), depth = 0) {
-    consumeYamlTraversalBudget(traversal, depth);
-    const resolved = resolveYamlAliasEvent(event, objectEvents);
-    if (resolved === undefined || visited.has(resolved))
-        return undefined;
-    visited.add(resolved);
-    if (resolved.kind === 'sequence') {
-        for (const child of resolved.children) {
-            const found = findYamlMappingLocation(child, key, objectEvents, traversal, visited, depth + 1);
-            if (found !== undefined)
-                return found;
+/**
+ * First match in a pre-order walk of `event`, following sequences and `<<` merge
+ * chains. Iterative: children are pushed in reverse so the explicit stack pops
+ * them in declaration order, which is what makes "first match" mean the same
+ * thing it did when this recursed.
+ */
+function findYamlMappingLocation(event, key, traversal) {
+    const visited = new Set();
+    const stack = [{ event, depth: 0 }];
+    while (stack.length > 0) {
+        const step = stack.pop();
+        if (step === undefined)
+            break;
+        consumeYamlTraversalBudget(traversal, step.depth);
+        const resolved = resolveYamlAliasEvent(step.event);
+        if (resolved === undefined || visited.has(resolved))
+            continue;
+        visited.add(resolved);
+        if (resolved.kind === 'sequence') {
+            for (let index = resolved.children.length - 1; index >= 0; index--) {
+                stack.push({ event: resolved.children[index], depth: step.depth + 1 });
+            }
+            continue;
+        }
+        if (resolved.kind !== 'mapping')
+            continue;
+        const pairs = yamlMappingPairs(resolved);
+        const direct = pairs.find((pair) => pair.key === key);
+        if (direct !== undefined) {
+            return { valueEvent: direct.valueEvent, line: direct.keyEvent.startLine };
+        }
+        const merges = pairs.filter((pair) => pair.key === '<<');
+        for (let index = merges.length - 1; index >= 0; index--) {
+            stack.push({ event: merges[index].valueEvent, depth: step.depth + 1 });
         }
-        return undefined;
-    }
-    if (resolved.kind !== 'mapping')
-        return undefined;
-    const pairs = yamlMappingPairs(resolved);
-    const direct = pairs.find((pair) => pair.key === key);
-    if (direct !== undefined) {
-        return { valueEvent: direct.valueEvent, line: direct.keyEvent.startLine };
-    }
-    for (const merge of pairs.filter((pair) => pair.key === '<<')) {
-        const found = findYamlMappingLocation(merge.valueEvent, key, objectEvents, traversal, visited, depth + 1);
-        if (found !== undefined)
-            return found;
     }
     return undefined;
 }
-function flattenYamlValue(value, event, prefix, out, objectEvents, traversal, sourceLine = event?.startLine ?? 1, depth = 0) {
-    consumeYamlTraversalBudget(traversal, depth);
-    const resolvedEvent = resolveYamlAliasEvent(event, objectEvents);
-    const trackedObject = isObjectValue(value) ? value : undefined;
-    if (trackedObject !== undefined && traversal.activeObjects.has(trackedObject))
-        return;
-    if (trackedObject !== undefined)
-        traversal.activeObjects.add(trackedObject);
-    try {
-        if (Array.isArray(value)) {
-            if (value.length === 0 && prefix.length > 0 && !out.has(prefix))
-                out.set(prefix, sourceLine);
-            value.forEach((item, index) => flattenYamlValue(item, resolvedEvent?.children[index], `${prefix}[${index}]`, out, objectEvents, traversal, sourceLine, depth + 1));
-            return;
+/**
+ * Flatten a document to `dotted.key -> line`, iteratively. Children are pushed in
+ * reverse so the stack pops them in declaration order, keeping `out` in the same
+ * insertion order — and the traversal budget consumed in the same sequence — as
+ * the recursive walk this replaced.
+ */
+function flattenYamlValue(value, event, prefix, out, traversal) {
+    const stack = [
+        { kind: 'visit', value, event, prefix, sourceLine: event?.startLine ?? 1, depth: 0 },
+    ];
+    while (stack.length > 0) {
+        const step = stack.pop();
+        if (step === undefined)
+            break;
+        if (step.kind === 'leave') {
+            traversal.activeObjects.delete(step.object);
+            continue;
+        }
+        const { value: current, prefix: currentPrefix, sourceLine, depth } = step;
+        consumeYamlTraversalBudget(traversal, depth);
+        const resolvedEvent = resolveYamlAliasEvent(step.event);
+        const trackedObject = isObjectValue(current) ? current : undefined;
+        if (trackedObject !== undefined) {
+            if (traversal.activeObjects.has(trackedObject))
+                continue;
+            traversal.activeObjects.add(trackedObject);
+            stack.push({ kind: 'leave', object: trackedObject });
         }
-        if (value !== null &&
-            typeof value === 'object' &&
+        if (Array.isArray(current)) {
+            if (current.length === 0 && currentPrefix.length > 0 && !out.has(currentPrefix)) {
+                out.set(currentPrefix, sourceLine);
+            }
+            for (let index = current.length - 1; index >= 0; index--) {
+                stack.push({
+                    kind: 'visit',
+                    value: current[index],
+                    event: resolvedEvent?.children[index],
+                    prefix: `${currentPrefix}[${index}]`,
+                    sourceLine,
+                    depth: depth + 1,
+                });
+            }
+            continue;
+        }
+        if (current !== null &&
+            typeof current === 'object' &&
             (resolvedEvent?.kind === 'mapping' || resolvedEvent === undefined)) {
-            const entries = Object.entries(value);
-            if (entries.length === 0 && prefix.length > 0 && !out.has(prefix))
-                out.set(prefix, sourceLine);
-            for (const [key, nested] of entries) {
-                const next = prefix.length === 0 ? key : `${prefix}.${key}`;
-                const location = findYamlMappingLocation(resolvedEvent, key, objectEvents, traversal);
-                flattenYamlValue(nested, location?.valueEvent, next, out, objectEvents, traversal, location?.line ?? sourceLine, depth + 1);
+            // js-yaml 5 builds `!!set` as a native Set, whose members are not own
+            // properties; v4 built a plain `{member: null}` object. Enumerate them so a
+            // tagged set still contributes one key per member instead of a bare leaf.
+            const entries = current instanceof Set
+                ? [...current].map((member) => [String(member), null])
+                : Object.entries(current);
+            if (entries.length === 0 && currentPrefix.length > 0 && !out.has(currentPrefix)) {
+                out.set(currentPrefix, sourceLine);
             }
-            return;
+            for (let index = entries.length - 1; index >= 0; index--) {
+                const [key, nested] = entries[index];
+                const location = findYamlMappingLocation(resolvedEvent, key, traversal);
+                stack.push({
+                    kind: 'visit',
+                    value: nested,
+                    event: location?.valueEvent,
+                    prefix: currentPrefix.length === 0 ? key : `${currentPrefix}.${key}`,
+                    sourceLine: location?.line ?? sourceLine,
+                    depth: depth + 1,
+                });
+            }
+            continue;
         }
-        if (prefix.length > 0 && !out.has(prefix))
-            out.set(prefix, sourceLine);
+        if (currentPrefix.length > 0 && !out.has(currentPrefix))
+            out.set(currentPrefix, sourceLine);
     }
-    finally {
-        if (trackedObject !== undefined)
-            traversal.activeObjects.delete(trackedObject);
+}
+// js-yaml 5 reports node positions as source offsets; map them to 1-based lines.
+function makeLineResolver(source) {
+    const lineStarts = [0];
+    for (let index = 0; index < source.length; index++) {
+        if (source[index] === '\n')
+            lineStarts.push(index + 1);
     }
+    return (offset) => {
+        let low = 0;
+        let high = lineStarts.length - 1;
+        let line = 0;
+        while (low <= high) {
+            const mid = (low + high) >> 1;
+            if (lineStarts[mid] <= offset) {
+                line = mid;
+                low = mid + 1;
+            }
+            else {
+                high = mid - 1;
+            }
+        }
+        return line + 1;
+    };
+}
+/**
+ * Rebuild the parse tree from js-yaml 5's event stream (v4's `listener` option
+ * was removed). Returns each document's root event, with aliases already
+ * resolved to their anchor event so merged/aliased keys keep the line where
+ * they were declared.
+ *
+ * One node per event, so this pass is bounded by MAX_CONFIG_FILE_BYTES alone —
+ * MAX_YAML_TRAVERSAL_NODES governs the later walk, which can revisit a shared
+ * anchor many times and so needs a budget this linear pass does not.
+ */
+function buildYamlEventTree(events, source) {
+    const lineOf = makeLineResolver(source);
+    const anchors = new Map();
+    const stack = [];
+    const documentRoots = [];
+    const anchorName = (start, end) => start >= 0 && end > start ? source.slice(start, end) : null;
+    const attach = (node) => {
+        stack[stack.length - 1]?.children.push(node);
+    };
+    const register = (name, node) => {
+        if (name !== null)
+            anchors.set(name, node);
+    };
+    for (const event of events) {
+        switch (event.type) {
+            case yaml.EVENT_DOCUMENT:
+                // Anchors are document-scoped. constructFromEvents already rejects a
+                // cross-document alias before we get here, so this only keeps the two
+                // layers from disagreeing.
+                anchors.clear();
+                stack.push({
+                    startLine: 1,
+                    kind: null,
+                    result: undefined,
+                    aliasOf: undefined,
+                    children: [],
+                });
+                break;
+            case yaml.EVENT_MAPPING:
+            case yaml.EVENT_SEQUENCE: {
+                const node = {
+                    startLine: lineOf(event.start),
+                    kind: event.type === yaml.EVENT_MAPPING ? 'mapping' : 'sequence',
+                    result: undefined,
+                    aliasOf: undefined,
+                    children: [],
+                };
+                register(anchorName(event.anchorStart, event.anchorEnd), node);
+                attach(node);
+                stack.push(node);
+                break;
+            }
+            case yaml.EVENT_SCALAR: {
+                const node = {
+                    startLine: lineOf(event.valueStart),
+                    kind: 'scalar',
+                    result: yaml.getScalarValue(source, event),
+                    aliasOf: undefined,
+                    children: [],
+                };
+                register(anchorName(event.anchorStart, event.anchorEnd), node);
+                attach(node);
+                break;
+            }
+            case yaml.EVENT_ALIAS: {
+                const target = anchors.get(anchorName(event.anchorStart, event.anchorEnd) ?? '');
+                attach({ startLine: 1, kind: 'alias', result: undefined, aliasOf: target, children: [] });
+                break;
+            }
+            case yaml.EVENT_POP: {
+                const done = stack.pop();
+                // Documents are the only top-level containers, so a pop that empties the
+                // stack closes a document; its single child is the document's root value.
+                if (done !== undefined && stack.length === 0)
+                    documentRoots.push(done.children[0]);
+                break;
+            }
+        }
+    }
+    return documentRoots;
 }
 /** Parse and flatten YAML leaves without retaining their values. */
 export function parseSpringYaml(content, filePath, profile) {
     const flattened = new Map();
-    const eventStack = [];
-    const documentEvents = [];
-    const objectEvents = new WeakMap();
-    const documents = [];
     const traversal = {
         remainingNodes: MAX_YAML_TRAVERSAL_NODES,
         activeObjects: new Set(),
     };
-    yaml.loadAll(content, (document) => documents.push(document), {
-        schema: yaml.DEFAULT_SCHEMA,
+    const events = yaml.parseEvents(content, { maxDepth: MAX_YAML_TRAVERSAL_DEPTH });
+    const documents = yaml.constructFromEvents(events, {
+        source: content,
+        schema: SPRING_YAML_SCHEMA,
         json: true,
-        listener: (eventType, state) => {
-            if (eventType === 'open') {
-                eventStack.push({
-                    startLine: state.line + 1,
-                    kind: null,
-                    result: undefined,
-                    tag: null,
-                    children: [],
-                });
-                return;
-            }
-            const event = eventStack.pop();
-            if (event === undefined)
-                return;
-            event.kind = state.kind ?? null;
-            event.result = state.result;
-            event.tag = state.tag ?? null;
-            if (isObjectValue(event.result) && event.kind !== null) {
-                objectEvents.set(event.result, event);
-            }
-            const parent = eventStack[eventStack.length - 1];
-            if (parent === undefined)
-                documentEvents.push(event);
-            else
-                parent.children.push(event);
-        },
     });
-    documents.forEach((document, index) => flattenYamlValue(document, documentEvents[index], '', flattened, objectEvents, traversal));
+    const documentEvents = buildYamlEventTree(events, content);
+    documents.forEach((document, index) => flattenYamlValue(document, documentEvents[index], '', flattened, traversal));
     return [...flattened.entries()]
         .sort(([left], [right]) => left.localeCompare(right))
         .map(([key, line]) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.10-rc.83",
+  "version": "1.6.10-rc.84",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -70,7 +70,7 @@
     "graphology-indices": "^0.17.0",
     "graphology-utils": "^2.3.0",
     "ignore": "^7.0.5",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^5.0.0",
     "jsonc-parser": "^3.3.1",
     "mnemonist": "^0.40.3",
     "node-addon-api": "^8.0.0",
@@ -105,7 +105,6 @@
     "@types/cli-progress": "^3.11.6",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.6",
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.0.18",
     "gitnexus-shared": "file:../gitnexus-shared",