gitnexus 1.6.10-rc.99 → 1.6.10

package/dist/config/ignore-service.js

@@ -1,4 +1,5 @@
 import ignore from 'ignore';
+import { existsSync } from 'fs';
 import fs from 'fs/promises';
 import nodePath from 'path';
 import { logger } from '../core/logger.js';
@@ -27,12 +28,15 @@ const DEFAULT_IGNORE_LIST = new Set([
     // 'packages' removed - commonly used for monorepo source code (lerna, pnpm, yarn workspaces)
     'venv',
     '.venv',
-    'env',
     '.env',
+    // Bare `env/` can be application source or a Python virtual environment.
+    // Path-aware rules below prune it at the root and wherever pyvenv.cfg marks
+    // a virtual environment, while preserving ordinary nested source folders.
     '__pycache__',
     '.pytest_cache',
     '.mypy_cache',
     'site-packages',
+    'dist-packages',
     '.tox',
     'eggs',
     '.eggs',
@@ -49,13 +53,33 @@ const DEFAULT_IGNORE_LIST = new Set([
     'obj',
     'target', // Java/Rust
     '.next',
+    // `.next` is Next.js's build CACHE; `_next` is the EMITTED output, and the two
+    // are different directories. A Capacitor/Cordova shell copies the emitted
+    // bundle to `<platform>/app/src/main/assets/public/_next/static/…`, where none
+    // of the path segments hit this list — so a mobile-wrapped Next.js app had its
+    // shipped bundle indexed as source, and every Route node it produced pointed at
+    // a webpack chunk rather than code anyone wrote (#3007).
+    //
+    // The name is deliberately unanchored. No `<web-root>/_next` form matches a
+    // root-level `_next/static/…`, which is the shape the reported repo has, so
+    // anchoring it would miss the case it was added for. The accepted cost is a
+    // hand-written directory literally named `_next`; recover one with a bare
+    // `!_next/` line in `.gitnexusignore`.
+    '_next',
     '.nuxt',
     '.output',
     '.vercel',
     '.netlify',
     '.serverless',
     '_build',
-    'public/build',
+    // `'public/build'` used to sit here. This set is tested one path SEGMENT at a
+    // time, and `isHardcodedIgnoredDirectory(name)` takes a bare directory name,
+    // so a slash-containing member could never match either — it was inert. Its
+    // paths were never unignored though: bare `'build'` above already prunes
+    // `public/build/**`, so removing the entry changes no behavior (#3007).
+    // `test/unit/ignore-build-output.test.ts` keeps the next slash-bearing entry
+    // in this set — or in IGNORED_FILES, ROOT_ARTIFACT_DIRECTORIES or
+    // IGNORED_EXTENSIONS — from dying the same way.
     '.parcel-cache',
     '.turbo',
     '.svelte-kit',
@@ -78,11 +102,11 @@ const DEFAULT_IGNORE_LIST = new Set([
     '.temp',
     // Generated/Compiled
     '.generated',
-    'generated',
     'auto-generated',
+    // Bare `generated/` can contain tracked source-of-truth code. Build output
+    // remains covered by .gitignore/.gitnexusignore and the unambiguous names.
     'monaco-workers', // Monaco editor web-worker bundles generated for browser runtime
     '.terraform',
-    '.serverless',
     // Documentation (optional - might want to keep)
     // 'docs',
     // 'documentation',
@@ -95,6 +119,11 @@ const DEFAULT_IGNORE_LIST = new Set([
     'snapshots', // Jest snapshots
     '__snapshots__',
 ]);
+// Ambiguous names that conventionally denote generated artifacts only at the
+// repository root. Nested directories with these names are frequently source
+// modules (for example apps/web/src/env or packages/api/generated).
+const ROOT_ARTIFACT_DIRECTORIES = new Set(['env', 'generated']);
+const isRootArtifactDirectory = (relativePath, name) => !relativePath.includes('/') && ROOT_ARTIFACT_DIRECTORIES.has(name);
 const IGNORED_EXTENSIONS = new Set([
     // Images
     '.png',
@@ -264,6 +293,9 @@ export const shouldIgnorePath = (filePath) => {
     const parts = normalizedPath.split('/');
     const fileName = parts[parts.length - 1];
     const fileNameLower = fileName.toLowerCase();
+    if (parts.length > 0 && isRootArtifactDirectory(parts[0], parts[0])) {
+        return true;
+    }
     // Laravel compiles Blade templates into generated PHP cache files under
     // storage/framework/views.  Source templates live in resources/views and are
     // handled separately; compiled cache should not become source-of-truth. Keep
@@ -299,9 +331,7 @@ export const shouldIgnorePath = (filePath) => {
     // Ignore files that look like generated/bundled code
     if (fileNameLower.includes('.bundle.') ||
         fileNameLower.includes('.chunk.') ||
-        fileNameLower.includes('.generated.') ||
-        fileNameLower.endsWith('.d.ts')) {
-        // TypeScript declaration files
+        fileNameLower.includes('.generated.')) {
         return true;
     }
     return false;
@@ -310,6 +340,16 @@ export const shouldIgnorePath = (filePath) => {
 export const isHardcodedIgnoredDirectory = (name) => {
     return DEFAULT_IGNORE_LIST.has(name);
 };
+/** Apply directory ignore rules that depend on repository-relative depth. */
+export const isHardcodedIgnoredDirectoryAtPath = (repoRoot, directoryPath) => {
+    const name = nodePath.basename(directoryPath);
+    if (isHardcodedIgnoredDirectory(name))
+        return true;
+    const relative = nodePath.relative(repoRoot, directoryPath).replace(/\\/g, '/');
+    if (isRootArtifactDirectory(relative, name))
+        return true;
+    return name === 'env' && existsSync(nodePath.join(directoryPath, 'pyvenv.cfg'));
+};
 export const loadIgnoreRules = async (repoPath, options) => {
     const ig = ignore();
     let hasRules = false;
@@ -416,9 +456,9 @@ export const createIgnoreFilter = async (repoPath, options) => {
     const ig = await loadIgnoreRules(repoPath, options);
     return {
         ignored(p) {
-            // path-scurry's Path.relative() returns POSIX paths on all platforms,
-            // which is what the `ignore` package expects. No explicit normalization needed.
-            const rel = p.relative();
+            // The `ignore` package expects POSIX separators; path-scurry can surface
+            // native separators on Windows when called through glob.
+            const rel = p.relative().replace(/\\/g, '/');
             if (!rel)
                 return false;
             // User's .gitnexusignore negation takes precedence over hardcoded
@@ -441,7 +481,7 @@ export const createIgnoreFilter = async (repoPath, options) => {
             // glob's `dot: false` option in filesystem-walker.ts. The hardcoded
             // list check below is defense-in-depth — do not remove `dot: false`
             // assuming this covers it.
-            const rel = p.relative();
+            const rel = p.relative().replace(/\\/g, '/');
             // User's .gitnexusignore negation takes precedence (#771) — if the
             // user explicitly unignored this directory or any ancestor via a
             // !pattern rule, allow descent even if the directory name is in
@@ -450,9 +490,10 @@ export const createIgnoreFilter = async (repoPath, options) => {
             // blocks descent into `__tests__/generated/`.
             if (ig && rel && hasExplicitUnignore(ig, rel) && !ig.ignores(rel + '/'))
                 return false;
-            // Hardcoded list: block descent into well-known noise directories.
-            if (DEFAULT_IGNORE_LIST.has(p.name))
+            // Hardcoded and path-aware rules prune whole trees before glob walks them.
+            if (rel && isHardcodedIgnoredDirectoryAtPath(repoPath, nodePath.join(repoPath, rel))) {
                 return true;
+            }
             // Check against .gitignore / .gitnexusignore patterns.
             // Since childrenIgnored is only called for directories, always test with
             // a trailing slash. This ensures directory-only negation patterns (e.g.

package/dist/core/analyzer-identity.d.ts

@@ -13,6 +13,7 @@
  * different entry files inside the same build tree; alternating between them
  * must not make an otherwise identical index stale.
  */
+import path from 'node:path';
 import type { AnalyzerRunnerIdentity } from '../storage/repo-manager.js';
 export declare const ANALYZER_RUNNER_IDENTITY_SCHEMA_VERSION: 4;
 export interface AnalyzerIdentityTraversalLimits {
@@ -48,6 +49,84 @@ export interface AnalyzerIdentityResolveOptions {
         guardCount: number;
     }) => void;
 }
+/**
+ * Case-stabilize a path's Windows drive letter so two processes that observed
+ * the same directory under different drive-letter casing (`c:\…` vs `C:\…`)
+ * produce byte-identical analyzer-identity path fields (#2668).
+ *
+ * `realpathSync.native` canonicalizes 8.3 short names and symlinks but does not
+ * guarantee the drive-letter case it returns — it can preserve whatever casing
+ * the caller's path carried, and `import.meta.url` casing depends on how each
+ * entry process (CLI shim vs `npx`/npm wrapper vs server worker) was launched.
+ * When `analyze` stamps `build.rootPath` under one casing and `status`
+ * recomputes it under another, `analyzerRunnerIdentitiesEqual` deep-compares
+ * unequal and `status` reports a freshly-analyzed, untouched repo as stale.
+ * Uppercasing the drive letter (drive letters are case-insensitive; uppercase
+ * is the conventional form) collapses that variance. POSIX paths are returned
+ * unchanged. `platform` is explicit so the transform is unit-testable off
+ * Windows.
+ *
+ * The optional `\\?\` extended-length prefix is preserved and the drive letter
+ * after it is still normalized; UNC paths (`\\server\share`, `\\?\UNC\...`)
+ * have no drive letter and are left untouched.
+ *
+ * That optional group is defensive, not a case `realpathSync.native` produces:
+ * libuv's `fs__realpath_handle` strips `\\?\` (and rewrites `\\?\UNC\` back to
+ * `\\`) before returning, so the prefix can only reach here from caller-supplied
+ * input, which `path.resolve` preserves (#2667).
+ *
+ * Preserving it is load-bearing. The roots this normalizes are not just compared —
+ * they are READ FROM: `resolveBuildRoot` joins `package.json` onto `packageRoot`,
+ * `collectBuildEntries` walks `buildRoot`, and the lockfile lookup walks
+ * `packageRoot`'s ancestors. Node does not re-add `\\?\` for over-MAX_PATH paths,
+ * so stripping here would break analyzer-identity resolution on a deep checkout
+ * exactly as it would at any other filesystem boundary. (These fields are also
+ * compared between an `analyze` and a later `status` run, so a shape change would
+ * additionally risk the #2668 false-stale class — but the filesystem reads are the
+ * reason that matters.)
+ *
+ * Registry-style path COMPARISON is a different domain, never opens what it
+ * canonicalizes, and does normalize the prefix away: see
+ * `stripWindowsLongPathPrefix` in `src/lib/utils.ts` and its use in
+ * `canonicalizePath`.
+ */
+export declare function normalizeAnalyzerRootPath(p: string, platform: NodeJS.Platform): string;
+/**
+ * Whether `candidate` is `parent` itself or lives beneath it.
+ *
+ * The absolute-result rejection is load-bearing on Windows: `path.relative`
+ * cannot express a relative path between two different drives, so it returns the
+ * absolute target instead — `path.win32.relative('C:\\parent', 'D:\\other')` is
+ * `'D:\\other'`. That string does not start with `..`, so the `..` checks alone
+ * would report an unrelated drive as *inside* the parent. This mirrors the
+ * containment guards elsewhere in the repo (`server/api.ts`,
+ * `server/git-clone.ts`, `group/extractors/fs-utils.ts`), which all pair the
+ * `..` check with `path.isAbsolute`.
+ *
+ * `pathApi` is injectable so the win32 semantics are unit-testable from a POSIX
+ * runner; production callers always use the platform-bound `path`.
+ */
+declare function isInside(parent: string, candidate: string, pathApi?: typeof path): boolean;
+/** Test seam for {@link isInside} (see `_hashAnalyzerIdentityFramesForTests`). */
+export declare const _isInsideForTests: typeof isInside;
+/**
+ * Whether a REALPATH'd package root lives inside some installed dependency
+ * tree. Used as the resolved-location half of "is this dependency a checkout
+ * this repository owns?" (see {@link undeclaredLocalDevDependencyNames}).
+ *
+ * The input must already be realpath'd: `resolveDependencyPackageRoot` returns
+ * `realpathSync.native`, so a package reached through a link out of
+ * `node_modules` reports its checkout location and a package that merely lives
+ * in `node_modules` reports a path that still carries the segment.
+ *
+ * `pathApi` is injectable so the Windows separator handling is unit-testable
+ * from a POSIX runner, exactly as {@link isInside} does. The separator sets
+ * differ deliberately: `\` is a legal filename character on POSIX, so only
+ * win32 may treat it as a boundary.
+ */
+declare function hasNodeModulesSegment(candidate: string, pathApi?: typeof path): boolean;
+/** Test seam for {@link hasNodeModulesSegment} (see {@link _isInsideForTests}). */
+export declare const _hasNodeModulesSegmentForTests: typeof hasNodeModulesSegment;
 export type AnalyzerRunnerSemanticIdentity = Omit<AnalyzerRunnerIdentity, 'invokedArtifact'>;
 /**
  * Normalize a raw diagnostic receipt for freshness comparison. The entrypoint
@@ -72,3 +151,4 @@ export declare function captureAnalyzerIdentityBeforeLoad<T>(analyzerModuleUrl:
 }>;
 /** Re-resolve immediately before commit and reject analyzer mutation mid-run. */
 export declare function finalizeAnalyzerRunnerIdentity(analyzerModuleUrl: string, startedWith: AnalyzerRunnerIdentity, options?: AnalyzerIdentityResolveOptions): AnalyzerRunnerIdentity;
+export {};