gitnexus 1.6.12-rc.25 → 1.6.12-rc.27

package/dist/core/ingestion/cobol-processor.d.ts

@@ -6,8 +6,8 @@
  * does its own extraction, and writes directly to the graph.
  *
  * Pipeline:
- *   1. Separate programs from copybooks
- *   2. Build copybook map (name -> content)
+ *   1. Separate programs from copybooks and JCL
+ *   2. Index file content by path for COPY expansion
  *   3. For each program: expand COPY statements, then run regex extraction
  *   4. Map CobolRegexResults to graph nodes and relationships
  *   5. Optionally process JCL files for job-step cross-references

package/dist/core/ingestion/cobol-processor.js

@@ -6,8 +6,8 @@
  * does its own extraction, and writes directly to the graph.
  *
  * Pipeline:
- *   1. Separate programs from copybooks
- *   2. Build copybook map (name -> content)
+ *   1. Separate programs from copybooks and JCL
+ *   2. Index file content by path for COPY expansion
  *   3. For each program: expand COPY statements, then run regex extraction
  *   4. Map CobolRegexResults to graph nodes and relationships
  *   5. Optionally process JCL files for job-step cross-references
@@ -19,6 +19,7 @@ import { SupportedLanguages } from '../../_shared/index.js';
 import { preprocessCobolSource, extractCobolSymbolsWithRegex, } from './cobol/cobol-preprocessor.js';
 import { expandCopies } from './cobol/cobol-copy-expander.js';
 import { processJclFiles } from './cobol/jcl-processor.js';
+import { resolveCobolCopyTarget } from './languages/cobol/copy-target.js';
 import { logger } from '../logger.js';
 // ---------------------------------------------------------------------------
 // File detection
@@ -74,36 +75,22 @@ export const processCobol = (graph, files, allPathSet) => {
     };
     // ── 1. Separate programs, copybooks, and JCL ───────────────────────
     const programs = [];
-    const copybooks = [];
     const jclFiles = [];
     for (const file of files) {
         const ext = path.extname(file.path).toLowerCase();
         if (JCL_EXTENSIONS.has(ext)) {
             jclFiles.push(file);
         }
-        else if (isCopybook(file.path)) {
-            copybooks.push(file);
-        }
-        else if (COBOL_EXTENSIONS.has(ext)) {
+        else if (COBOL_EXTENSIONS.has(ext) && !isCopybook(file.path)) {
             programs.push(file);
         }
     }
-    // ── 2. Build copybook map (uppercase name -> content) ──────────────
-    const copybookMap = new Map();
-    for (const cb of copybooks) {
-        const name = path.basename(cb.path, path.extname(cb.path)).toUpperCase();
-        copybookMap.set(name, { content: cb.content, path: cb.path });
-    }
-    // Build reverse lookup: path -> content for O(1) readCopy
+    // Path → content for every COBOL/JCL file we ingested. Resolution picks
+    // the path (#2967 / census lockstep); this map only supplies the body.
     const copybookByPath = new Map();
-    for (const [, entry] of copybookMap) {
-        copybookByPath.set(entry.path, entry.content);
+    for (const f of files) {
+        copybookByPath.set(f.path, f.content);
     }
-    // Resolve and read callbacks for expandCopies
-    const resolveCopy = (name) => {
-        const entry = copybookMap.get(name.toUpperCase());
-        return entry ? entry.path : null;
-    };
     // Memoize preprocessed copybook content for the duration of this
     // processCobol call. A single copybook is COPYed by many programs (and at
     // many COPY sites within a program); without this cache
@@ -142,6 +129,9 @@ export const processCobol = (graph, files, allPathSet) => {
             continue;
         // Preprocess: clean patch markers
         const cleaned = preprocessCobolSource(file.content);
+        // Per-program so COPY EXTERNAL in src/PROG.cbl cannot land on
+        // vendor/EXTERNAL.cpy when a copybooks/ dir is present (#2967).
+        const resolveCopy = (name) => resolveCobolCopyTarget(name, file.path, allPathSet);
         // Expand COPY statements
         const { expandedContent, copyResolutions } = expandCopies(cleaned, file.path, resolveCopy, readCopy);
         // Extract symbols from expanded source

package/dist/core/ingestion/languages/cobol/copy-target.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resolve a COBOL `COPY` member name against the workspace file set.
+ *
+ * `fromFile` is the importing program (census) or the program currently
+ * being expanded (processor). It is used only to include the importer's
+ * directory in the preferred class when a well-known copybook dir exists.
+ */
+export declare function resolveCobolCopyTarget(targetRaw: string, fromFile: string, allFilePaths: ReadonlySet<string>): string | null;

package/dist/core/ingestion/languages/cobol/copy-target.js

@@ -0,0 +1,94 @@
+/**
+ * Shared COBOL `COPY` target resolution (#2967 / #2908).
+ *
+ * Both the census (`cobolScopeResolver.resolveImportTarget`) and the live
+ * regex processor (`resolveCopy` → `cobol-copy` IMPORTS) must answer the
+ * same path for the same `(name, fromFile, allFilePaths)`. Greening only
+ * the census would leave analyze fabricating an IMPORTS edge onto a vendor
+ * decoy the compiler would never have searched.
+ *
+ * Well-known copybook directory segments (`copybooks`, `COPYBOOKS`, `cpy`,
+ * `copy`) plus the importer's own directory are the preferred class. When
+ * the file set contains at least one of those well-known segments, a `COPY`
+ * name resolves only inside that class (first in Set-iteration order).
+ * `vendor/EXTERNAL.cpy` therefore misses while `copybooks/CUSTREC.cpy` hits.
+ *
+ * When the file set has no such directory, fail-open to today's two-tier
+ * first-wins basename index — shops whose copybooks *are* the tree have
+ * nothing to prefer. The importer directory is *not* enough on its own to
+ * leave fail-open (`{vendor/EXTERNAL.cpy, src/PROG.cbl}` must still answer
+ * `vendor/EXTERNAL.cpy`).
+ *
+ * The two-tier index is still memoized on the `allFilePaths` Set identity
+ * (#2908). Preferred-class filtering happens at pick time from the stored
+ * per-name arrays, so a pass still scans the set once.
+ */
+import path from 'node:path';
+import { perFileSet } from '../../import-resolvers/per-file-set.js';
+const COPYBOOK_EXTENSIONS = new Set(['.cpy', '.copybook']);
+const COBOL_SOURCE_EXTENSIONS = new Set(['.cbl', '.cob', '.cobol']);
+/** Path-component names that mark a conventional copybook directory. */
+const PREFERRED_DIR_NAMES = new Set(['copybooks', 'COPYBOOKS', 'cpy', 'copy']);
+function pathHasPreferredDir(fp) {
+    const parts = fp.split('/');
+    for (let i = 0; i < parts.length - 1; i++) {
+        if (PREFERRED_DIR_NAMES.has(parts[i]))
+            return true;
+    }
+    return false;
+}
+function pushUnique(map, key, fp) {
+    const list = map.get(key);
+    if (list === undefined) {
+        map.set(key, [fp]);
+        return;
+    }
+    list.push(fp);
+}
+const getCobolCopyIndex = perFileSet((allFilePaths) => {
+    const copybooks = new Map();
+    const sources = new Map();
+    let hasPreferredDir = false;
+    for (const fp of allFilePaths) {
+        const extRaw = path.extname(fp);
+        const extLower = extRaw.toLowerCase();
+        const tier = COPYBOOK_EXTENSIONS.has(extLower)
+            ? copybooks
+            : COBOL_SOURCE_EXTENSIONS.has(extLower)
+                ? sources
+                : undefined;
+        if (tier === undefined)
+            continue;
+        if (!hasPreferredDir && pathHasPreferredDir(fp))
+            hasPreferredDir = true;
+        const basename = path.basename(fp, extRaw).toUpperCase();
+        pushUnique(tier, basename, fp);
+    }
+    return { copybooks, sources, hasPreferredDir };
+});
+function pickCopyPath(paths, fromFile, hasPreferredDir) {
+    if (paths === undefined || paths.length === 0)
+        return null;
+    if (!hasPreferredDir)
+        return paths[0] ?? null;
+    const fromDir = path.dirname(fromFile);
+    for (const fp of paths) {
+        if (pathHasPreferredDir(fp) || path.dirname(fp) === fromDir)
+            return fp;
+    }
+    return null;
+}
+/**
+ * Resolve a COBOL `COPY` member name against the workspace file set.
+ *
+ * `fromFile` is the importing program (census) or the program currently
+ * being expanded (processor). It is used only to include the importer's
+ * directory in the preferred class when a well-known copybook dir exists.
+ */
+export function resolveCobolCopyTarget(targetRaw, fromFile, allFilePaths) {
+    const upper = targetRaw.toUpperCase();
+    const index = getCobolCopyIndex(allFilePaths);
+    return (pickCopyPath(index.copybooks.get(upper), fromFile, index.hasPreferredDir) ??
+        pickCopyPath(index.sources.get(upper), fromFile, index.hasPreferredDir) ??
+        null);
+}

package/dist/core/ingestion/languages/cobol/scope-resolver.js

@@ -8,46 +8,18 @@
  *
  * Reference: `languages/python/scope-resolver.ts`.
  */
-import path from 'node:path';
 import { SupportedLanguages } from '../../../../_shared/index.js';
-import { perFileSet } from '../../import-resolvers/per-file-set.js';
 import { populateClassOwnedMembers } from '../../scope-resolution/scope/walkers.js';
 import { cobolProvider } from '../cobol.js';
-// Copybook file extensions for COPY name resolution
-const COPYBOOK_EXTENSIONS = new Set(['.cpy', '.copybook']);
-// COBOL source files, searched only after every copybook has missed.
-const COBOL_SOURCE_EXTENSIONS = new Set(['.cbl', '.cob', '.cobol']);
-const getCobolCopyIndex = perFileSet((allFilePaths) => {
-    const copybooks = new Map();
-    const sources = new Map();
-    // One pass builds both tiers: the two scans walked the same files and
-    // classified each by the same extension test.
-    for (const fp of allFilePaths) {
-        const ext = path.extname(fp).toLowerCase();
-        const tier = COPYBOOK_EXTENSIONS.has(ext)
-            ? copybooks
-            : COBOL_SOURCE_EXTENSIONS.has(ext)
-                ? sources
-                : undefined;
-        if (tier === undefined)
-            continue;
-        const basename = path.basename(fp, ext).toUpperCase();
-        // First in Set-iteration order wins, as the scans' first-match `return` did.
-        if (!tier.has(basename))
-            tier.set(basename, fp);
-    }
-    return { copybooks, sources };
-});
+import { resolveCobolCopyTarget } from './copy-target.js';
 const cobolScopeResolver = {
     language: SupportedLanguages.Cobol,
     languageProvider: cobolProvider,
     importEdgeReason: 'cobol-scope: copy',
     // ── Resolve COPY bookname to file path ─────────────────────────────
-    resolveImportTarget: (targetRaw, _fromFile, allFilePaths) => {
-        const upper = targetRaw.toUpperCase();
-        const index = getCobolCopyIndex(allFilePaths);
-        // Copybooks first, then COBOL sources — the tier order IS the tie-break.
-        return index.copybooks.get(upper) ?? index.sources.get(upper) ?? null;
+    // Shared with the regex processor's resolveCopy (#2967 lockstep).
+    resolveImportTarget: (targetRaw, fromFile, allFilePaths) => {
+        return resolveCobolCopyTarget(targetRaw, fromFile, allFilePaths);
     },
     // COBOL has no binding-merge rules beyond the default (local-first-then-imports).
     mergeBindings: (existing) => [...existing],

package/dist/core/ingestion/languages/ruby/import-target.d.ts

@@ -3,8 +3,9 @@
  *
  * Ruby import resolution rules:
  *   - `require_relative './foo'` → resolve relative to the importing file's dir
- *   - `require 'foo'`           → suffix-match via the existing Ruby import resolver
- *   - External gems             → null (unresolvable within the repo)
+ *   - `require 'foo'` → use scoped gem metadata before legacy suffix matching
+ *   - Known local gems → resolve only within their declared load roots
+ *   - Known external gems → null, even if an unrelated repo file suffix matches
  */
 export interface RubyResolveContext {
     readonly fromFile: string;
@@ -18,9 +19,10 @@ export interface RubyResolveContext {
  * against the importing file's directory, trying `.rb` and `/index.rb`
  * suffixes.
  *
- * For bare requires (gem-style like `'json'`, `'serializable'`), delegates
- * to the existing `resolveRubyImportInternal` which uses suffix matching.
- *
- * Returns `null` for external gems that have no matching file in the repo.
+ * For bare requires, scoped manifest metadata takes precedence: known local
+ * gems resolve only within their declared load roots (a miss returns `null`),
+ * and known external gem prefixes return `null` even if a repo suffix matches.
+ * Only requires without matching gem evidence delegate to the existing
+ * `resolveRubyImportInternal` suffix matcher.
  */
-export declare function resolveRubyImportTarget(targetRaw: string, fromFile: string, allFilePaths: ReadonlySet<string>, _resolutionConfig?: unknown): string | readonly string[] | null;
+export declare function resolveRubyImportTarget(targetRaw: string, fromFile: string, allFilePaths: ReadonlySet<string>, resolutionConfig?: unknown): string | readonly string[] | null;

package/dist/core/ingestion/languages/ruby/import-target.js

@@ -3,12 +3,14 @@
  *
  * Ruby import resolution rules:
  *   - `require_relative './foo'` → resolve relative to the importing file's dir
- *   - `require 'foo'`           → suffix-match via the existing Ruby import resolver
- *   - External gems             → null (unresolvable within the repo)
+ *   - `require 'foo'` → use scoped gem metadata before legacy suffix matching
+ *   - Known local gems → resolve only within their declared load roots
+ *   - Known external gems → null, even if an unrelated repo file suffix matches
  */
 import { resolveRubyImportInternal } from '../../import-resolvers/ruby.js';
 import { getWorkspaceFileIndex } from '../../import-resolvers/workspace-file-index.js';
 import { isHeritageMarker } from '../../utils/heritage-marker.js';
+import { findRubyResolutionScope, } from './resolution-config.js';
 // ─── resolveRubyImportTarget ──────────────────────────────────────────────
 /**
  * ScopeResolver-shaped adapter:
@@ -18,12 +20,13 @@ import { isHeritageMarker } from '../../utils/heritage-marker.js';
  * against the importing file's directory, trying `.rb` and `/index.rb`
  * suffixes.
  *
- * For bare requires (gem-style like `'json'`, `'serializable'`), delegates
- * to the existing `resolveRubyImportInternal` which uses suffix matching.
- *
- * Returns `null` for external gems that have no matching file in the repo.
+ * For bare requires, scoped manifest metadata takes precedence: known local
+ * gems resolve only within their declared load roots (a miss returns `null`),
+ * and known external gem prefixes return `null` even if a repo suffix matches.
+ * Only requires without matching gem evidence delegate to the existing
+ * `resolveRubyImportInternal` suffix matcher.
  */
-export function resolveRubyImportTarget(targetRaw, fromFile, allFilePaths, _resolutionConfig) {
+export function resolveRubyImportTarget(targetRaw, fromFile, allFilePaths, resolutionConfig) {
     if (!targetRaw)
         return null;
     if (isHeritageMarker(targetRaw))
@@ -37,7 +40,16 @@ export function resolveRubyImportTarget(targetRaw, fromFile, allFilePaths, _reso
         const resolved = resolveRelative(targetRaw, fromDir, allFilePaths);
         return resolved;
     }
-    // ── require: bare/gem-style suffix matching ─────────────────────────
+    // ── require: scoped gem evidence before repository-wide fallback ────
+    const config = resolutionConfig;
+    const scope = config === null || config === undefined ? undefined : findRubyResolutionScope(config, fromFile);
+    if (scope !== undefined) {
+        const localGemTarget = resolveLocalGemTarget(targetRaw, scope, allFilePaths);
+        if (localGemTarget !== undefined)
+            return localGemTarget;
+        if (matchesRequirePrefix(targetRaw, scope.externalRequirePrefixes))
+            return null;
+    }
     return resolveBare(targetRaw, allFilePaths);
 }
 // ─── internal helpers ─────────────────────────────────────────────────────
@@ -73,6 +85,55 @@ function resolveRelative(targetRaw, fromDir, allFilePaths) {
         return resolvedPath;
     return null;
 }
+/**
+ * Yield the require stem, then each slash-delimited ancestor. This makes both
+ * local-root and external-gem lookup O(require path depth), not O(gem count).
+ * A trailing `.rb` is stripped first so `require 'my_engine.rb'` matches the
+ * configured prefix `my_engine`, matching Ruby's optional-suffix require.
+ */
+function requirePrefixCandidates(targetRaw) {
+    const stem = targetRaw.endsWith('.rb') ? targetRaw.slice(0, -3) : targetRaw;
+    if (stem.length === 0)
+        return [];
+    const candidates = [stem];
+    let slash = stem.lastIndexOf('/');
+    while (slash !== -1) {
+        candidates.push(stem.slice(0, slash));
+        slash = stem.lastIndexOf('/', slash - 1);
+    }
+    return candidates;
+}
+function matchesRequirePrefix(targetRaw, prefixes) {
+    return requirePrefixCandidates(targetRaw).some((candidate) => prefixes.has(candidate));
+}
+/**
+ * Resolve a path/gemspec-backed gem against its declared Ruby load roots.
+ * `undefined` means no local-gem prefix matched; `null` means one matched but
+ * none of its declared load roots contained the target.
+ */
+function resolveLocalGemTarget(targetRaw, scope, allFilePaths) {
+    for (const prefix of requirePrefixCandidates(targetRaw)) {
+        const loadRoots = scope.localLoadRootsByPrefix.get(prefix);
+        if (loadRoots === undefined)
+            continue;
+        for (const loadRoot of loadRoots) {
+            const base = loadRoot ? `${loadRoot}/${targetRaw}` : targetRaw;
+            if (base.endsWith('.rb')) {
+                if (allFilePaths.has(base))
+                    return base;
+                continue;
+            }
+            const rbFile = `${base}.rb`;
+            if (allFilePaths.has(rbFile))
+                return rbFile;
+        }
+        // The prefix is owned by a known local gem. If its declared roots do not
+        // contain the target, repository-wide suffix matching would fabricate an
+        // edge to an unrelated file.
+        return null;
+    }
+    return undefined;
+}
 /**
  * Resolve a bare require path (`'serializable'`, `'json'`, `'net/http'`)
  * via suffix matching using the existing Ruby import resolver.

package/dist/core/ingestion/languages/ruby/resolution-config.d.ts

@@ -0,0 +1,28 @@
+export interface RubyResolutionScope {
+    /** Require prefixes provided by gems whose source is outside this repository. */
+    readonly externalRequirePrefixes: ReadonlySet<string>;
+    /** Require prefix -> repository-relative Ruby load roots for local gems. */
+    readonly localLoadRootsByPrefix: ReadonlyMap<string, readonly string[]>;
+}
+export interface RubyResolutionConfig {
+    /** Manifest directory (repository-relative POSIX path) -> dependency scope. */
+    readonly scopesByDirectory: ReadonlyMap<string, RubyResolutionScope>;
+}
+/**
+ * Select the nearest manifest directory that owns `fromFile`.
+ *
+ * Walking ancestors makes lookup O(path depth), independent of how many
+ * sibling Gemfiles a monorepo contains.
+ */
+export declare function findRubyResolutionScope(config: RubyResolutionConfig, fromFile: string): RubyResolutionScope | undefined;
+/**
+ * Statically collect Ruby dependency sources without evaluating Gemfile or
+ * gemspec code. Scopes stay separate by manifest directory so sibling projects
+ * in a monorepo cannot suppress one another's local imports. Lockfiles
+ * contribute remote GEM/GIT specs and local PATH/GEMSPEC load roots only when
+ * an adjacent Gemfile or gemspec establishes a Bundler/RubyGems project.
+ *
+ * No declarative manifest means no safe gate, so return null and preserve the
+ * resolver's existing fail-open behavior for loose script directories.
+ */
+export declare function loadRubyResolutionConfig(repoPath: string): RubyResolutionConfig | null;

package/dist/core/ingestion/languages/ruby/resolution-config.js

@@ -0,0 +1,311 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+const MAX_VISITED_DIRECTORIES = 20_000;
+const SKIP_DIRECTORIES = new Set([
+    '.git',
+    '.gitnexus',
+    'node_modules',
+    'vendor',
+    'dist',
+    'build',
+    'coverage',
+]);
+const GEMFILE_DEPENDENCY = /^\s*gem\s*(?:\(\s*)?(['"])([A-Za-z0-9_.-]+)\1(?<options>.*)$/;
+const GEMSPEC_DEPENDENCY = /^\s*(?:[A-Za-z_]\w*\.)?(?:add_dependency|add_runtime_dependency|add_development_dependency)\s*(?:\(\s*)?(['"])([A-Za-z0-9_.-]+)\1/;
+const GEMSPEC_NAME = /^\s*(?:[A-Za-z_]\w*\.)?name\s*=\s*(['"])([A-Za-z0-9_.-]+)\1/;
+const GEMSPEC_REQUIRE_PATHS = /^\s*(?:[A-Za-z_]\w*\.)?require_paths\s*=\s*\[([^\]]*)\]/;
+const QUOTED_LITERAL = /(['"])([^'"]+)\1/g;
+const LOCKFILE_SECTION = /^([A-Z][A-Z ]*)\s*$/;
+const LOCKFILE_REMOTE = /^ {2}remote:\s*(.+?)\s*$/;
+const LOCKFILE_SPECS_HEADER = /^ {2}specs:\s*$/;
+const LOCKFILE_SPEC = /^ {4}([A-Za-z0-9_.-]+) \(/;
+function createMutableScope() {
+    return {
+        externalRequirePrefixes: new Set(),
+        localLoadRootsByPrefix: new Map(),
+    };
+}
+function normalizeRepoPath(filePath) {
+    return filePath.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/$/, '');
+}
+function repoRelativePath(repoPath, candidate) {
+    const rel = relative(resolve(repoPath), resolve(candidate));
+    if (rel === '')
+        return '';
+    if (rel === '..' || rel.startsWith(`..\\`) || rel.startsWith('../') || isAbsolute(rel)) {
+        return null;
+    }
+    return normalizeRepoPath(rel);
+}
+function requirePrefixes(gemName, requireAs) {
+    const prefixes = new Set([gemName]);
+    if (gemName.includes('-'))
+        prefixes.add(gemName.replaceAll('-', '/'));
+    if (requireAs !== undefined && requireAs.length > 0)
+        prefixes.add(requireAs);
+    return [...prefixes];
+}
+function literalOption(options, name) {
+    const modern = new RegExp(`(?:^|[,\\s])${name}\\s*:\\s*(['"])([^'"]+)\\1`).exec(options);
+    if (modern !== null)
+        return modern[2];
+    const hashRocket = new RegExp(`(?:^|[,\\s]):${name}\\s*=>\\s*(['"])([^'"]+)\\1`).exec(options);
+    return hashRocket?.[2];
+}
+function hasOption(options, name) {
+    return (new RegExp(`(?:^|[,\\s])${name}\\s*:`).test(options) ||
+        new RegExp(`(?:^|[,\\s]):${name}\\s*=>`).test(options));
+}
+function addExternalGem(scope, gemName, requireAs) {
+    for (const prefix of requirePrefixes(gemName, requireAs)) {
+        if (!scope.localLoadRootsByPrefix.has(prefix))
+            scope.externalRequirePrefixes.add(prefix);
+    }
+}
+function addLocalGem(scope, gemName, loadRoots, requireAs) {
+    for (const prefix of requirePrefixes(gemName, requireAs)) {
+        scope.externalRequirePrefixes.delete(prefix);
+        let roots = scope.localLoadRootsByPrefix.get(prefix);
+        if (roots === undefined) {
+            roots = new Set();
+            scope.localLoadRootsByPrefix.set(prefix, roots);
+        }
+        for (const loadRoot of loadRoots)
+            roots.add(loadRoot);
+    }
+}
+function parseGemspecMetadata(contents) {
+    let name = null;
+    let requirePaths = null;
+    for (const line of contents.split(/\r?\n/)) {
+        const nameMatch = GEMSPEC_NAME.exec(line);
+        if (nameMatch !== null)
+            name = nameMatch[2];
+        const requirePathsMatch = GEMSPEC_REQUIRE_PATHS.exec(line);
+        if (requirePathsMatch === null)
+            continue;
+        const paths = [];
+        for (const match of requirePathsMatch[1].matchAll(QUOTED_LITERAL))
+            paths.push(match[2]);
+        if (paths.length > 0)
+            requirePaths = paths;
+    }
+    return { name, requirePaths: requirePaths ?? ['lib'] };
+}
+function loadLocalGemRoots(repoPath, gemRoot, expectedGemName) {
+    const gemRootRelative = repoRelativePath(repoPath, gemRoot);
+    if (gemRootRelative === null)
+        return null;
+    let requirePaths = ['lib'];
+    try {
+        const gemspecs = readdirSync(gemRoot, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && entry.name.endsWith('.gemspec'))
+            .map((entry) => join(gemRoot, entry.name))
+            .sort();
+        for (const gemspec of gemspecs) {
+            const metadata = parseGemspecMetadata(readFileSync(gemspec, 'utf8'));
+            if (metadata.name === expectedGemName) {
+                requirePaths = metadata.requirePaths;
+                break;
+            }
+        }
+    }
+    catch {
+        // An unreadable local gem stays local; the conventional lib root is a
+        // bounded best effort, and resolution falls through if no file matches.
+    }
+    return requirePaths
+        .map((requirePath) => repoRelativePath(repoPath, resolve(gemRoot, requirePath)))
+        .filter((loadRoot) => loadRoot !== null);
+}
+function addGemfileDependencies(contents, manifestDirectory, repoPath, scope) {
+    for (const line of contents.split(/\r?\n/)) {
+        const match = GEMFILE_DEPENDENCY.exec(line);
+        if (match === null)
+            continue;
+        const gemName = match[2];
+        const options = match.groups?.options ?? '';
+        const requireAs = literalOption(options, 'require');
+        const localPath = literalOption(options, 'path');
+        if (localPath !== undefined) {
+            const loadRoots = loadLocalGemRoots(repoPath, resolve(manifestDirectory, localPath), gemName);
+            if (loadRoots === null)
+                addExternalGem(scope, gemName, requireAs);
+            else
+                addLocalGem(scope, gemName, loadRoots, requireAs);
+            continue;
+        }
+        // A dynamic path expression cannot be classified without evaluating Ruby.
+        // Fail open instead of deleting a potentially real in-repo import edge.
+        if (hasOption(options, 'path'))
+            continue;
+        addExternalGem(scope, gemName, requireAs);
+    }
+}
+function addGemspecDependencies(contents, gemspecDirectory, repoPath, scope) {
+    const metadata = parseGemspecMetadata(contents);
+    if (metadata.name !== null) {
+        if (repoRelativePath(repoPath, gemspecDirectory) !== null) {
+            const loadRoots = metadata.requirePaths
+                .map((requirePath) => repoRelativePath(repoPath, resolve(gemspecDirectory, requirePath)))
+                .filter((loadRoot) => loadRoot !== null);
+            addLocalGem(scope, metadata.name, loadRoots);
+        }
+    }
+    for (const line of contents.split(/\r?\n/)) {
+        const match = GEMSPEC_DEPENDENCY.exec(line);
+        if (match !== null)
+            addExternalGem(scope, match[2]);
+    }
+}
+function addLockedDependencies(contents, lockfileDirectory, repoPath, scope) {
+    let section = '';
+    let remote = null;
+    let inSpecs = false;
+    for (const line of contents.split(/\r?\n/)) {
+        const sectionMatch = LOCKFILE_SECTION.exec(line);
+        if (sectionMatch !== null) {
+            section = sectionMatch[1];
+            remote = null;
+            inSpecs = false;
+            continue;
+        }
+        const remoteMatch = LOCKFILE_REMOTE.exec(line);
+        if (remoteMatch !== null) {
+            remote = remoteMatch[1];
+            continue;
+        }
+        if (LOCKFILE_SPECS_HEADER.test(line)) {
+            inSpecs = true;
+            continue;
+        }
+        if (!inSpecs)
+            continue;
+        const specMatch = LOCKFILE_SPEC.exec(line);
+        if (specMatch === null)
+            continue;
+        const gemName = specMatch[1];
+        if (section === 'GEM' || section === 'GIT') {
+            addExternalGem(scope, gemName);
+            continue;
+        }
+        if (section !== 'PATH' && section !== 'GEMSPEC')
+            continue;
+        if (remote === null)
+            continue;
+        const loadRoots = loadLocalGemRoots(repoPath, resolve(lockfileDirectory, remote), gemName);
+        if (loadRoots === null)
+            addExternalGem(scope, gemName);
+        else
+            addLocalGem(scope, gemName, loadRoots);
+    }
+}
+function freezeScope(scope) {
+    const localLoadRootsByPrefix = new Map();
+    for (const [prefix, roots] of scope.localLoadRootsByPrefix) {
+        localLoadRootsByPrefix.set(prefix, [...roots].sort());
+    }
+    return {
+        externalRequirePrefixes: new Set(scope.externalRequirePrefixes),
+        localLoadRootsByPrefix,
+    };
+}
+/**
+ * Select the nearest manifest directory that owns `fromFile`.
+ *
+ * Walking ancestors makes lookup O(path depth), independent of how many
+ * sibling Gemfiles a monorepo contains.
+ */
+export function findRubyResolutionScope(config, fromFile) {
+    const normalized = normalizeRepoPath(fromFile);
+    let directory = normalized.includes('/') ? normalized.slice(0, normalized.lastIndexOf('/')) : '';
+    for (;;) {
+        const scope = config.scopesByDirectory.get(directory);
+        if (scope !== undefined)
+            return scope;
+        if (directory === '')
+            return undefined;
+        const slash = directory.lastIndexOf('/');
+        directory = slash === -1 ? '' : directory.slice(0, slash);
+    }
+}
+/**
+ * Statically collect Ruby dependency sources without evaluating Gemfile or
+ * gemspec code. Scopes stay separate by manifest directory so sibling projects
+ * in a monorepo cannot suppress one another's local imports. Lockfiles
+ * contribute remote GEM/GIT specs and local PATH/GEMSPEC load roots only when
+ * an adjacent Gemfile or gemspec establishes a Bundler/RubyGems project.
+ *
+ * No declarative manifest means no safe gate, so return null and preserve the
+ * resolver's existing fail-open behavior for loose script directories.
+ */
+export function loadRubyResolutionConfig(repoPath) {
+    const pending = [repoPath];
+    const manifestsByDirectory = new Map();
+    const lockfilesByDirectory = new Map();
+    let visitedDirectories = 0;
+    while (pending.length > 0 && visitedDirectories < MAX_VISITED_DIRECTORIES) {
+        const directory = pending.pop();
+        if (directory === undefined)
+            break;
+        visitedDirectories++;
+        let entries;
+        try {
+            entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory() && !SKIP_DIRECTORIES.has(entry.name)) {
+                pending.push(join(directory, entry.name));
+            }
+            else if (entry.isFile() && (entry.name === 'Gemfile' || entry.name.endsWith('.gemspec'))) {
+                const manifests = manifestsByDirectory.get(directory) ?? [];
+                manifests.push(join(directory, entry.name));
+                manifestsByDirectory.set(directory, manifests);
+            }
+            else if (entry.isFile() && entry.name === 'Gemfile.lock') {
+                lockfilesByDirectory.set(directory, join(directory, entry.name));
+            }
+        }
+    }
+    if (manifestsByDirectory.size === 0)
+        return null;
+    const mutableScopes = new Map();
+    for (const [directory, manifests] of [...manifestsByDirectory].sort(([left], [right]) => left.localeCompare(right))) {
+        const directoryRelative = repoRelativePath(repoPath, directory);
+        if (directoryRelative === null)
+            continue;
+        const scope = createMutableScope();
+        mutableScopes.set(directoryRelative, scope);
+        for (const manifest of manifests.sort()) {
+            try {
+                const contents = readFileSync(manifest, 'utf8');
+                if (manifest.endsWith('.gemspec')) {
+                    addGemspecDependencies(contents, directory, repoPath, scope);
+                }
+                else {
+                    addGemfileDependencies(contents, directory, repoPath, scope);
+                }
+            }
+            catch {
+                // A partially readable scope remains fail-open for unknown gems.
+            }
+        }
+        const lockfile = lockfilesByDirectory.get(directory);
+        if (lockfile === undefined)
+            continue;
+        try {
+            addLockedDependencies(readFileSync(lockfile, 'utf8'), directory, repoPath, scope);
+        }
+        catch {
+            // Direct declarations still provide bounded evidence when the lock is unreadable.
+        }
+    }
+    const scopesByDirectory = new Map();
+    for (const [directory, scope] of mutableScopes) {
+        scopesByDirectory.set(directory, freezeScope(scope));
+    }
+    return { scopesByDirectory };
+}

package/dist/core/ingestion/languages/ruby/scope-resolver.js

@@ -7,6 +7,7 @@ import { resolveDefGraphId } from '../../scope-resolution/graph-bridge/ids.js';
 import { generateId } from '../../../../lib/utils.js';
 import { decodeMarker } from '../../utils/heritage-marker.js';
 import { rubyIsGlobalNameFallbackPlausible } from './name-fallback-visibility.js';
+import { loadRubyResolutionConfig } from './resolution-config.js';
 /**
  * #1991: resolve a BARE mixin reference (`include Loggable`) to a nested module by
  * the INCLUDING class's lexical scope — Ruby looks up a constant in the innermost
@@ -248,6 +249,7 @@ export const rubyScopeResolver = {
     languageProvider: rubyProvider,
     importEdgeReason: 'ruby-scope: import',
     resolveImportTarget: (targetRaw, fromFile, allFilePaths, resolutionConfig) => resolveRubyImportTarget(targetRaw, fromFile, allFilePaths, resolutionConfig),
+    loadResolutionConfig: (repoPath) => loadRubyResolutionConfig(repoPath),
     expandsWildcardTo: (targetModuleScope, parsedFiles) => expandRubyWildcardNames(targetModuleScope, parsedFiles),
     mergeBindings: (existing, incoming, scopeId) => rubyMergeBindings(existing, incoming, scopeId),
     arityCompatibility: (callsite, def) => rubyArityCompatibility(def, callsite),

package/dist/core/lbug/schema.d.ts

@@ -47,7 +47,7 @@ export declare const DESTINATION_SCHEMA = "\nCREATE NODE TABLE Destination (\n
 export declare const SECTION_SCHEMA = "\nCREATE NODE TABLE Section (\n  id STRING,\n  name STRING,\n  filePath STRING,\n  startLine INT64,\n  endLine INT64,\n  level INT64,\n  content STRING,\n  description STRING,\n  PRIMARY KEY (id)\n)";
 export declare const BASICBLOCK_SCHEMA = "\nCREATE NODE TABLE BasicBlock (\n  id STRING,\n  filePath STRING,\n  startLine INT64,\n  endLine INT64,\n  text STRING,\n  callees STRING,\n  calleeIds STRING,\n  PRIMARY KEY (id)\n)";
 /**
- * The 66 pairs NEITHER rule above generates — everything left after the two
+ * The pairs NEITHER rule above generates — everything left after the two
  * cross products are subtracted. Carried by CONTAINMENT, inheritance, imports
  * and DI: a container label crossed with a contained label. No predicate
  * describes that surface (any container can hold any definition).
@@ -60,6 +60,8 @@ export declare const BASICBLOCK_SCHEMA = "\nCREATE NODE TABLE BasicBlock (\n  id
  * templates), the two `Route|Process` / `Tool|Process` entry points whose
  * emitter names both labels as literals, and `BasicBlock|BasicBlock`, the PDG
  * substrate.
+ * Spring dynamic lookup in a constructor also emits INJECTS to a synthetic
+ * @Bean CodeElement (#3238), so Constructor|CodeElement belongs here.
  *
  * NOTHING A RULE ALREADY COVERS BELONGS HERE. `generatedRelationPairs` skips
  * any pair present in this block, so a redundant line does not merely duplicate
@@ -96,7 +98,7 @@ export declare const BASICBLOCK_SCHEMA = "\nCREATE NODE TABLE BasicBlock (\n  id
  * `test/integration/structural-pair-coverage.test.ts` guards this half from a
  * corpus — that is the guard, not this comment.
  */
-export declare const STRUCTURAL_PAIR_DDL = "  FROM File TO Folder,\n  FROM File TO CodeElement,\n  FROM File TO `Typedef`,\n  FROM File TO `Namespace`,\n  FROM File TO `Impl`,\n  FROM File TO `Static`,\n  FROM File TO `Template`,\n  FROM File TO Section,\n  FROM Folder TO Folder,\n  FROM Folder TO File,\n  FROM Function TO `Template`,\n  FROM Function TO `Namespace`,\n  FROM Function TO `Impl`,\n  FROM Function TO `Typedef`,\n  FROM Function TO CodeElement,\n  FROM Class TO `Template`,\n  FROM Class TO `Impl`,\n  FROM Class TO `Namespace`,\n  FROM Class TO `Typedef`,\n  FROM Class TO CodeElement,\n  FROM Method TO `Template`,\n  FROM Method TO `Namespace`,\n  FROM Method TO `Impl`,\n  FROM Method TO CodeElement,\n  FROM `Template` TO `Template`,\n  FROM `Template` TO Function,\n  FROM `Template` TO Method,\n  FROM `Template` TO Class,\n  FROM `Template` TO `Struct`,\n  FROM `Template` TO `TypeAlias`,\n  FROM `Template` TO `Enum`,\n  FROM `Template` TO `Macro`,\n  FROM `Template` TO Interface,\n  FROM `Template` TO `Constructor`,\n  FROM `Module` TO CodeElement,\n  FROM `Module` TO `Namespace`,\n  FROM `Namespace` TO Function,\n  FROM CodeElement TO CodeElement,\n  FROM CodeElement TO Class,\n  FROM CodeElement TO Category,\n  FROM CodeElement TO Method,\n  FROM CodeElement TO `Module`,\n  FROM CodeElement TO `Property`,\n  FROM Section TO Section,\n  FROM Interface TO CodeElement,\n  FROM `Namespace` TO `Struct`,\n  FROM `Impl` TO Method,\n  FROM `Impl` TO Function,\n  FROM `Impl` TO `Constructor`,\n  FROM `Impl` TO `Property`,\n  FROM `Impl` TO `Trait`,\n  FROM `Impl` TO `Struct`,\n  FROM `Impl` TO `Impl`,\n  FROM `Constructor` TO `Template`,\n  FROM `Constructor` TO `Impl`,\n  FROM `Constructor` TO `Namespace`,\n  FROM `Constructor` TO `Typedef`,\n  FROM Route TO Process,\n  FROM Tool TO Process,\n  FROM Destination TO `Property`,\n  FROM BasicBlock TO BasicBlock";
+export declare const STRUCTURAL_PAIR_DDL = "  FROM File TO Folder,\n  FROM File TO CodeElement,\n  FROM File TO `Typedef`,\n  FROM File TO `Namespace`,\n  FROM File TO `Impl`,\n  FROM File TO `Static`,\n  FROM File TO `Template`,\n  FROM File TO Section,\n  FROM Folder TO Folder,\n  FROM Folder TO File,\n  FROM Function TO `Template`,\n  FROM Function TO `Namespace`,\n  FROM Function TO `Impl`,\n  FROM Function TO `Typedef`,\n  FROM Function TO CodeElement,\n  FROM Class TO `Template`,\n  FROM Class TO `Impl`,\n  FROM Class TO `Namespace`,\n  FROM Class TO `Typedef`,\n  FROM Class TO CodeElement,\n  FROM Method TO `Template`,\n  FROM Method TO `Namespace`,\n  FROM Method TO `Impl`,\n  FROM Method TO CodeElement,\n  FROM `Template` TO `Template`,\n  FROM `Template` TO Function,\n  FROM `Template` TO Method,\n  FROM `Template` TO Class,\n  FROM `Template` TO `Struct`,\n  FROM `Template` TO `TypeAlias`,\n  FROM `Template` TO `Enum`,\n  FROM `Template` TO `Macro`,\n  FROM `Template` TO Interface,\n  FROM `Template` TO `Constructor`,\n  FROM `Module` TO CodeElement,\n  FROM `Module` TO `Namespace`,\n  FROM `Namespace` TO Function,\n  FROM CodeElement TO CodeElement,\n  FROM CodeElement TO Class,\n  FROM CodeElement TO Category,\n  FROM CodeElement TO Method,\n  FROM CodeElement TO `Module`,\n  FROM CodeElement TO `Property`,\n  FROM Section TO Section,\n  FROM Interface TO CodeElement,\n  FROM `Namespace` TO `Struct`,\n  FROM `Impl` TO Method,\n  FROM `Impl` TO Function,\n  FROM `Impl` TO `Constructor`,\n  FROM `Impl` TO `Property`,\n  FROM `Impl` TO `Trait`,\n  FROM `Impl` TO `Struct`,\n  FROM `Impl` TO `Impl`,\n  FROM `Constructor` TO `Template`,\n  FROM `Constructor` TO `Impl`,\n  FROM `Constructor` TO `Namespace`,\n  FROM `Constructor` TO `Typedef`,\n  FROM `Constructor` TO CodeElement,\n  FROM Route TO Process,\n  FROM Tool TO Process,\n  FROM Destination TO `Property`,\n  FROM BasicBlock TO BasicBlock";
 export declare const RELATION_SCHEMA: string;
 export declare const EMBEDDING_DIMS: number;
 /** HNSW vector index name for the CodeEmbedding table. */

package/dist/core/lbug/schema.js

@@ -485,7 +485,7 @@ const ATTACHMENT_TARGET_LABELS = [
     'Record',
 ];
 /**
- * The 66 pairs NEITHER rule above generates — everything left after the two
+ * The pairs NEITHER rule above generates — everything left after the two
  * cross products are subtracted. Carried by CONTAINMENT, inheritance, imports
  * and DI: a container label crossed with a contained label. No predicate
  * describes that surface (any container can hold any definition).
@@ -498,6 +498,8 @@ const ATTACHMENT_TARGET_LABELS = [
  * templates), the two `Route|Process` / `Tool|Process` entry points whose
  * emitter names both labels as literals, and `BasicBlock|BasicBlock`, the PDG
  * substrate.
+ * Spring dynamic lookup in a constructor also emits INJECTS to a synthetic
+ * @Bean CodeElement (#3238), so Constructor|CodeElement belongs here.
  *
  * NOTHING A RULE ALREADY COVERS BELONGS HERE. `generatedRelationPairs` skips
  * any pair present in this block, so a redundant line does not merely duplicate
@@ -591,6 +593,7 @@ export const STRUCTURAL_PAIR_DDL = `  FROM File TO Folder,
   FROM \`Constructor\` TO \`Impl\`,
   FROM \`Constructor\` TO \`Namespace\`,
   FROM \`Constructor\` TO \`Typedef\`,
+  FROM \`Constructor\` TO CodeElement,
   FROM Route TO Process,
   FROM Tool TO Process,
   FROM Destination TO \`Property\`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.12-rc.25",
+  "version": "1.6.12-rc.27",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",