gitnexus 1.6.11-rc.8 → 1.6.11

package/dist/core/group/extractors/http-patterns/node.js

@@ -3,7 +3,7 @@ import JavaScript from 'tree-sitter-javascript';
 import TypeScript from 'tree-sitter-typescript';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
 import { MAX_FOLD_LENGTH } from '../../../ingestion/route-extractors/constant-resolver.js';
-import { DATA_ROUTE_TABLE_SOURCE, scanDataRouteTables, } from '../../../ingestion/route-extractors/data-route-table.js';
+import { DATA_ROUTE_TABLE_SOURCE, propertyName, scanDataRouteTables, } from '../../../ingestion/route-extractors/data-route-table.js';
 import { extractNestRoutes } from '../../../ingestion/route-extractors/nest.js';
 import { normalizeExtractedRoutePath } from '../../../ingestion/route-extractors/route-path.js';
 import { buildJsRepoFacts, extractJsModuleFacts, isAxiosNamespace, isHttpClientRef, resolveJsPathExpression, } from '../../../ingestion/route-extractors/js-const-resolver.js';
@@ -123,6 +123,35 @@ const AXIOS_OBJECT_SPEC = {
       arguments: (arguments (object) @options))
   `,
 };
+// ─── Consumer: wrapped client X.request({ url, method }) ────────────
+// Enterprise wrapper shape: an axios instance (or a named request helper)
+// re-exported under a local name — `httpClient.request({ url, method })`
+// from `@winex-plugin/win-request`, `$http.request(...)`. Generic names
+// like `api` need axios.create/import proof (`isHttpClientRef`); spelling
+// alone is too common (graphql-request helpers, domain `api` objects).
+// The member property is `request` (not an HTTP verb), so this cannot
+// collide with the Express provider pattern (`router.get`) or the axios
+// member form (`axios.get`). Option keys are resolved programmatically,
+// same as the jQuery ajax / axios object forms.
+//
+// The query captures the receiver so scan can reject unrelated
+// `.request({ url })` APIs (`cy.request`, `queue.request`).
+const REQUEST_OBJECT_SPEC = {
+    meta: {},
+    query: `
+    (call_expression
+      function: (member_expression
+        object: (_) @obj
+        property: (property_identifier) @fn (#eq? @fn "request"))
+      arguments: (arguments . (object) @options))
+  `,
+};
+/**
+ * Receivers admitted as wrapped HTTP clients without axios.create proof.
+ * Spelling-only: the last identifier in `obj.text` (`this.$http` → `$http`).
+ * Keep this set small — every extra name is a false-positive surface.
+ */
+const WRAPPED_REQUEST_RECEIVERS = new Set(['httpClient', '$http']);
 function compileBundle(language, name) {
     const mk = (spec, suffix) => compilePatterns({
         name: `${name}-${suffix}`,
@@ -137,6 +166,7 @@ function compileBundle(language, name) {
         jqueryShorthand: mk(JQUERY_SHORTHAND_SPEC, 'jquery-shorthand'),
         jqueryAjax: mk(JQUERY_AJAX_SPEC, 'jquery-ajax'),
         axiosObject: mk(AXIOS_OBJECT_SPEC, 'axios-object'),
+        requestObject: mk(REQUEST_OBJECT_SPEC, 'request-object'),
     };
 }
 const JAVASCRIPT_BUNDLE = compileBundle(JavaScript, 'javascript-http');
@@ -148,6 +178,7 @@ const TSX_BUNDLE = compileBundle(TypeScript.tsx, 'tsx-http');
  * of `keyNames`. Returns null when no matching pair is present or the
  * value is not a string literal. Used by the jQuery ajax / axios object
  * consumers to resolve `url` / `method` / `type` keys in any order.
+ * Keys use shared `propertyName` so quoted `"method"` matches `method`.
  */
 function readStringProp(objectNode, keyNames) {
     for (let i = 0; i < objectNode.namedChildCount; i++) {
@@ -158,7 +189,8 @@ function readStringProp(objectNode, keyNames) {
         const valueNode = pair.childForFieldName('value');
         if (!keyNode || !valueNode)
             continue;
-        if (!keyNames.includes(keyNode.text))
+        const key = propertyName(keyNode);
+        if (key === null || !keyNames.includes(key))
             continue;
         if (valueNode.type !== 'string' && valueNode.type !== 'template_string')
             continue;
@@ -168,6 +200,77 @@ function readStringProp(objectNode, keyNames) {
     }
     return null;
 }
+/**
+ * Verb for wrapped `X.request({ url, method|type })`. Absent key → GET
+ * (same default as fetch-without-options / jQuery ajax). Present but not a
+ * string/template, supplied only via object spread, or later overwritten by
+ * a duplicate key / spread → `*` so matching can still link without pinning GET.
+ * Later properties win, matching JavaScript object-literal evaluation.
+ */
+function readRequestMethod(objectNode, keyNames = ['method', 'type']) {
+    let last = { kind: 'absent' };
+    for (let i = 0; i < objectNode.namedChildCount; i++) {
+        const child = objectNode.namedChild(i);
+        if (!child)
+            continue;
+        if (child.type === 'spread_element') {
+            last = { kind: 'unknown' };
+            continue;
+        }
+        if (child.type === 'shorthand_property_identifier' ||
+            child.type === 'shorthand_property_identifier_pattern') {
+            if (keyNames.includes(child.text))
+                last = { kind: 'unknown' };
+            continue;
+        }
+        if (child.type !== 'pair')
+            continue;
+        const keyNode = child.childForFieldName('key');
+        const valueNode = child.childForFieldName('value');
+        if (!keyNode)
+            continue;
+        const key = propertyName(keyNode);
+        if (key === null || !keyNames.includes(key))
+            continue;
+        if (!valueNode || (valueNode.type !== 'string' && valueNode.type !== 'template_string')) {
+            last = { kind: 'unknown' };
+            continue;
+        }
+        const lit = unquoteLiteral(valueNode.text);
+        if (lit === null || lit.includes('${')) {
+            last = { kind: 'unknown' };
+            continue;
+        }
+        last = { kind: 'literal', value: lit };
+    }
+    if (last.kind === 'literal')
+        return last.value.toUpperCase();
+    if (last.kind === 'unknown')
+        return '*';
+    return 'GET';
+}
+function wrappedRequestReceiverName(receiver) {
+    const parts = receiver.split('.');
+    return parts[parts.length - 1] ?? receiver;
+}
+/** Axios module / axios.create instance, or a registered wrapper identifier. */
+function isAdmittedWrappedRequestReceiver(receiver, fileKey, facts) {
+    if (WRAPPED_REQUEST_RECEIVERS.has(wrappedRequestReceiverName(receiver)))
+        return true;
+    try {
+        const isModule = facts === null || fileKey === undefined
+            ? receiver === 'axios'
+            : isAxiosNamespace(fileKey, receiver, facts);
+        if (isModule)
+            return true;
+        if (!facts || fileKey === undefined)
+            return false;
+        return isHttpClientRef(fileKey, receiver, facts);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Map each named import's LOCAL binding to its DECLARED export name and source
  * module, by walking the file's `import { x as y } from 'm'` statements. Lets
@@ -335,9 +438,10 @@ function resolveFactsFor(repoContext, fileRel) {
  *
  * `/{param}` matches every one-segment provider route in the group, and
  * `matching.exclude_links_param_only_paths` defaults to `false`. A path whose
- * leading term is an unresolved placeholder is refused for the same reason —
- * nothing pins where it starts. (`resolveJsPathExpression` already refuses those
- * it folded itself; this also covers the literal fallback below.)
+ * leading term is an unresolved placeholder is refused unless the next
+ * character is `/` — that is the gateway-prefix shape
+ * `` `${serviceClient}/api/v1/x` `` that `stripLeadingTemplatePrefix` keeps.
+ * Bare `{param}` and `{param}api/x` stay rejected: nothing pins a route.
  */
 function looksLikeHttpPath(path) {
     if (path === '')
@@ -352,7 +456,7 @@ function looksLikeHttpPath(path) {
     const shape = path.replace(/\$\{[^}]+\}/g, '{param}');
     if (/\s/.test(shape))
         return false;
-    if (shape.startsWith('{param}'))
+    if (shape.startsWith('{param}') && !shape.startsWith('{param}/'))
         return false;
     // An all-digit string is a path only when it is written as one. A leading
     // slash is that evidence: `client.get('/123')` is a route whose segment the
@@ -613,8 +717,7 @@ function scanBundle(bundle, tree, repoContext, fileRel) {
         const path = readStringProp(optionsNode, ['url']);
         if (path === null)
             continue;
-        const rawMethod = readStringProp(optionsNode, ['method']);
-        const method = (rawMethod ?? 'GET').toUpperCase();
+        const method = readRequestMethod(optionsNode, ['method']);
         out.push({
             role: 'consumer',
             framework: 'axios',
@@ -625,6 +728,40 @@ function scanBundle(bundle, tree, repoContext, fileRel) {
             confidence: 0.7,
         });
     }
+    // Consumer: wrapped client `X.request({ url, method })` — the shared
+    // enterprise axios-instance shape (`httpClient.request` from
+    // win-request and friends). Emit the raw url (templates intact) so
+    // shared `normalizeConsumerPath` can strip a leading `${…}` gateway
+    // prefix and fold mid/tail interpolations to `{param}`. A plugin-side
+    // longest-slash-segment reducer would truncate those mid-templates
+    // before the shared normalizer ever saw them. This scan drops only
+    // static relative urls (no `${`, no leading `/`, not `https?://`).
+    // That filter is request-wrapper-specific: fetch/axios member forms
+    // already admit absolute urls and leave host stripping to
+    // `normalizeConsumerPath`.
+    for (const match of runCompiledPatterns(bundle.requestObject, tree)) {
+        const optionsNode = match.captures.options;
+        const objNode = match.captures.obj;
+        if (!optionsNode || !objNode)
+            continue;
+        if (!isAdmittedWrappedRequestReceiver(objNode.text, fileKey, facts))
+            continue;
+        const rawUrl = readStringProp(optionsNode, ['url']);
+        if (rawUrl === null)
+            continue;
+        const url = rawUrl.trim();
+        if (!url.includes('${') && !url.startsWith('/') && !/^https?:\/\//i.test(url))
+            continue;
+        out.push({
+            role: 'consumer',
+            framework: 'request',
+            method: readRequestMethod(optionsNode),
+            path: url,
+            name: null,
+            line: optionsNode.startPosition.row + 1,
+            confidence: 0.65,
+        });
+    }
     for (const route of scanDataRouteTables(tree)) {
         const imported = route.handlerLocalName === undefined ? undefined : importMap.get(route.handlerLocalName);
         out.push({

package/dist/core/group/extractors/http-patterns/python.js

@@ -1028,13 +1028,17 @@ export const PYTHON_HTTP_PLUGIN = {
     name: 'python-http',
     language: Python,
     // routeCoverage intentionally LEFT at the default 'partial' (#2138 Part 2).
-    // It would be a no-op even if set to 'complete': FastAPI decorator routes set
-    // no handlerName (generic worker path) and Django sets methodName: null, so no
-    // Python file ever resolves a handlerSymbolId and none would be parse-skipped.
-    // Declaring 'complete' now is only a latent trap for the moment a follow-up
-    // gives FastAPI routes a handlerName. `hasConsumerSignals` is kept (and is a
-    // true superset of scan()'s consumer shapes) so the precondition already holds
-    // when Python is later flipped to 'complete'.
+    // 'complete' is now an active data-loss risk rather than a no-op: FastAPI and
+    // Flask decorator routes do carry a handlerName (Python's
+    // `decoratorRouteHandlerName` hook reads the `decorated_definition`), so their
+    // files can resolve every handlerSymbolId and become parse-skip candidates.
+    // The flag asserts more than that — it asserts ingestion emits a Route node
+    // for EVERY provider route this scan() finds, and it does not: Flask's
+    // imperative `add_url_rule('/p', view_func=handler)` registration below has no
+    // ingestion counterpart, so skipping a file that mixes it with resolved
+    // decorator routes would drop those providers. `hasConsumerSignals` is kept
+    // (and is a true superset of scan()'s consumer shapes) so the consumer half of
+    // the precondition already holds once provider parity is closed.
     // Consumer signals scan() can detect: `requests.<verb>`/`requests.request`,
     // `httpx` (sync/async client), the `uri=`/`url=` keyword/variable wrapper
     // calls, plus aiohttp/urllib. Conservative — over-matching only costs a parse.

package/dist/core/group/extractors/http-route-extractor.js

@@ -261,13 +261,56 @@ export function normalizeHttpPath(p) {
     return s === '' ? '/' : s;
 }
 /**
- * Consumer-side normalization is more aggressive:
- *   - template literals (`${x}`) → `{param}`
- *   - strip protocol + host if the URL is absolute
- *   - numeric segments → `{param}` (so `/api/orders/42` → `/api/orders/{param}`)
+ * Strip LEADING template interpolations from a consumer url as gateway/host
+ * bindings — the enterprise wrapper shape `` `${serviceClient}/api/v1/x` ``
+ * where `${serviceClient}` selects the gateway service, not a route segment.
+ * This is consumer-path framework semantics (mirrors how an absolute
+ * `https://host/path` url keeps only its path), so it lives here rather than
+ * in any one language plugin:
+ *   - `` `${c}/api/x` ``      → `/api/x`   (clean prefix; `${c}${d}/api/x` → `/api/x`)
+ *   - `` `${c}/api/x/${id}` ``→ `/api/x/${id}` (mid/tail interpolations are left for the `{param}` pass)
+ * Returns null when the stripped remainder is not a single-slash path:
+ *   - remainder without `/` — relative fragment (`${c}api/x`) or scheme/host
+ *     (`${scheme}://${host}/api/x`); whether it is a path depends on
+ *     unverifiable runtime state, so it is dropped rather than guessed at;
+ *   - remainder starting with `//` — protocol-relative (`${proto}//host/api/x`);
+ *     keeping it would later collapse to `/host/api/x`.
+ *
+ * The `?` in a query string cannot leak into the brace matching: `${...}`
+ * spans are matched by braces here (before any `{param}` replacement), and
+ * `normalizeHttpPath` splits on `?` only after the whole `${...}` span —
+ * including any `?` inside it — has been collapsed to `{param}`. So
+ * `` `${c}/api/x?id=${id}` `` reduces to `/api/x` on both orderings.
+ */
+function stripLeadingTemplatePrefix(url) {
+    if (!url.startsWith('${'))
+        return url;
+    const rest = url.replace(/^(?:\$\{[^}]*\})+/, '');
+    return rest.startsWith('/') && !rest.startsWith('//') ? rest : null;
+}
+/**
+ * Placeholder substituted for `${...}` before WHATWG `URL` parsing so the
+ * parser cannot percent-encode our own `{param}` markers. A genuine encoded
+ * segment like `%7Bfoo%7D` then survives as a literal, instead of being
+ * rewritten into braces and folded into `{param}`.
+ *
+ * Private-use U+E000 cannot appear in a real URL path, so a literal
+ * `__gitnexus_http_param__` segment is not rewritten into `{param}`.
  */
+const CONSUMER_PARAM_SENTINEL = '\uE000';
+const CONSUMER_PARAM_SENTINEL_ENC = '%ee%80%80';
+function restoreConsumerParamSentinel(pathOnly) {
+    return pathOnly
+        .split(CONSUMER_PARAM_SENTINEL)
+        .join('{param}')
+        .replace(new RegExp(CONSUMER_PARAM_SENTINEL_ENC, 'gi'), '{param}');
+}
+/** Canonicalize a consumer URL after `stripLeadingTemplatePrefix`. */
 function normalizeConsumerPath(url) {
-    const templated = url.replace(/\$\{[^}]+\}/g, '{param}').trim();
+    const stripped = stripLeadingTemplatePrefix(url.trim());
+    if (stripped === null)
+        return null;
+    const templated = stripped.replace(/\$\{[^}]+\}/g, CONSUMER_PARAM_SENTINEL).trim();
     let pathOnly = templated;
     if (/^https?:\/\//i.test(templated)) {
         try {
@@ -277,6 +320,7 @@ function normalizeConsumerPath(url) {
             pathOnly = templated.replace(/^https?:\/\/[^/]+/i, '');
         }
     }
+    pathOnly = restoreConsumerParamSentinel(pathOnly);
     const normalized = normalizeHttpPath(pathOnly || '/');
     const segments = normalized
         .split('/')
@@ -571,7 +615,7 @@ export class HttpRouteExtractor {
         // removes any candidate that still needs scanning for outbound calls.
         const coveredFiles = new Set();
         const graphProviders = dbExecutor != null
-            ? await this.extractProvidersGraph(dbExecutor, getDetections, resolveDetectionSymbol, coveredFiles)
+            ? await this.extractProvidersGraph(dbExecutor, getDetections, resolveDetectionSymbol, loadFileSymbols, coveredFiles)
             : [];
         // Consumer-safety gate (#2138 Part 2): `extractProvidersGraph` marks a file
         // covered on *provider* grounds (all HANDLES_ROUTE rows resolved + a
@@ -619,7 +663,7 @@ export class HttpRouteExtractor {
         });
     }
     // ─── Graph-assisted providers ──────────────────────────────────────
-    async extractProvidersGraph(db, getDetections, resolveSymbol, coveredFiles) {
+    async extractProvidersGraph(db, getDetections, resolveSymbol, loadFileSymbols, coveredFiles) {
         const out = [];
         // Per-file coverage tracking (#2138 Part 2): a file is "fully graph-covered"
         // when every one of its HANDLES_ROUTE rows resolved a handlerSymbolId AND its
@@ -672,16 +716,11 @@ export class HttpRouteExtractor {
                     method = 'GET';
                 symbolUid = handlerSymbolId;
                 if (filePath) {
-                    try {
-                        const syms = await db(CONTAINING_QUERY, { filePath });
-                        const hit = syms.find((s) => String(s.uid ?? s[0]) === handlerSymbolId);
-                        if (hit) {
-                            symbolName = String(hit.name ?? hit[1]) || symbolName;
-                            symPath = String(hit.filePath ?? hit[2]) || filePath;
-                        }
-                    }
-                    catch {
-                        /* keep the authoritative uid + basename fallback */
+                    const syms = await loadFileSymbols(filePath);
+                    const hit = syms.find((s) => String(s.uid ?? s[0]) === handlerSymbolId);
+                    if (hit) {
+                        symbolName = String(hit.name ?? hit[1]) || symbolName;
+                        symPath = String(hit.filePath ?? hit[2]) || filePath;
                     }
                 }
             }
@@ -891,6 +930,13 @@ export class HttpRouteExtractor {
                 if (d.role !== 'consumer')
                     continue;
                 const pathNorm = normalizeConsumerPath(d.path);
+                // A consumer url that cannot be reduced to a routable path (e.g. a
+                // leading template binding that is neither a clean prefix nor a
+                // remainder that starts with `/`) is dropped here rather than emitted
+                // as a never-matching contract — same treatment the plugins give
+                // static relative urls at scan time.
+                if (pathNorm === null)
+                    continue;
                 // Resolve the function CONTAINING the fetch/axios call so the consumer
                 // contract carries a real symbolUid (was always '' — the gap that left
                 // cross-repo trace/impact unable to traverse HTTP links).