gitnexus 1.6.13-rc.42 → 1.6.13-rc.44

package/README.md

@@ -354,6 +354,7 @@ max_concurrency: 1
 repo_git_timeout: 10s
 analyze_timeout: 5m
 analyze_failure_threshold: 3
+# allowed_hosts: [gitlab.mycompany.com]
 projects:
   - local_path: /abs/path/to/repos
     branches: [master, main]
@@ -368,7 +369,7 @@ projects:
       - git@gitee.com:owner/repo.git
 ```
 
-`sync_interval_minutes` must be an integer of at least `5`. `local_path` must be an absolute path without traversal; each remote is cloned below it as `host/namespace/repo`, preventing same-basename repositories from colliding. `remote_urls` may use SSH SCP form (`git@host:owner/repo.git`) or HTTPS (`https://host/owner/repo.git`) for github.com, gitlab.com, or gitee.com. The published CLI image includes `openssh-client` so SSH remotes can clone; mount keys and `known_hosts` yourself. An invalid `watch_config.yml` skips auto-sync immediately with the validation error. `repo_git_timeout` applies to each repo clone/pull and defaults to `10s`; a bare number such as `10` is interpreted as seconds, while `10000ms`, `10s`, and `1m` keep their explicit units. It must not exceed one hour or `sync_interval_minutes`, whichever is smaller — so a bare `600000` is rejected, because it means 600000 seconds rather than milliseconds. `analyze_timeout` applies to each isolated analysis worker and defaults to half of `sync_interval_minutes`, but it is independent of polling and may be longer, up to Node's timer limit (`2147483647ms`). A `5` minute poll with `analyze_timeout: 30m` is valid. Auto-sync analysis honors the cloned repo's `.gitnexusrc` embeddings settings; the CLI image still needs `GITNEXUS_EMBEDDING_URL` or a bind-mounted embedding stack because npm is stripped. A tick that arrives while the previous loop is active never overlaps it: ticks coalesce into one immediate follow-up run, which pulls and analyzes the newest commit. If the parent times out and leaves that worker running, the follow-up is deferred to the next interval so a leftover lock holder is not counted as a hard analyze failure. Timeout and `auto-sync stop` request safe cancellation; a worker already in native work exits after it returns to a JS-visible safe point. While waiting, auto-sync reports `cancelling` or `stopping` and keeps its ownership files so another auto-sync cannot take over. The parent waits up to 5 seconds for the worker to exit; after that it stops waiting, releases its ownership files, and leaves the worker to finish and exit on its own rather than killing it mid-write. `auto-sync stop` uses this same control path on macOS and Windows.
+`sync_interval_minutes` must be an integer of at least `5`. `local_path` must be an absolute path without traversal; each remote is cloned below it as `host/namespace/repo`, preventing same-basename repositories from colliding. `remote_urls` may use SSH SCP form (`git@host:owner/repo.git`) or HTTPS (`https://host/owner/repo.git`). Hosts are limited to github.com, gitlab.com, and gitee.com unless listed in top-level `allowed_hosts` (exact DNS names, no wildcards). The published CLI image includes `openssh-client` so SSH remotes can clone; mount keys and `known_hosts` yourself. An invalid `watch_config.yml` skips auto-sync immediately with the validation error. `repo_git_timeout` applies to each repo clone/pull and defaults to `10s`; a bare number such as `10` is interpreted as seconds, while `10000ms`, `10s`, and `1m` keep their explicit units. It must not exceed one hour or `sync_interval_minutes`, whichever is smaller — so a bare `600000` is rejected, because it means 600000 seconds rather than milliseconds. `analyze_timeout` applies to each isolated analysis worker and defaults to half of `sync_interval_minutes`, but it is independent of polling and may be longer, up to Node's timer limit (`2147483647ms`). A `5` minute poll with `analyze_timeout: 30m` is valid. Auto-sync analysis honors the cloned repo's `.gitnexusrc` embeddings settings; the CLI image still needs `GITNEXUS_EMBEDDING_URL` or a bind-mounted embedding stack because npm is stripped. A tick that arrives while the previous loop is active never overlaps it: ticks coalesce into one immediate follow-up run, which pulls and analyzes the newest commit. If the parent times out and leaves that worker running, the follow-up is deferred to the next interval so a leftover lock holder is not counted as a hard analyze failure. Timeout and `auto-sync stop` request safe cancellation; a worker already in native work exits after it returns to a JS-visible safe point. While waiting, auto-sync reports `cancelling` or `stopping` and keeps its ownership files so another auto-sync cannot take over. The parent waits up to 5 seconds for the worker to exit; after that it stops waiting, releases its ownership files, and leaves the worker to finish and exit on its own rather than killing it mid-write. `auto-sync stop` uses this same control path on macOS and Windows.
 
 `pdg` is configured per project. `pdg: true` builds and maintains the full CFG, control-dependence, reaching-definition, and taint layers on both initial and incremental analyses. Auto-sync requests staged atomic incremental publication where the analyzer supports it: the old graph remains available to readers until the replacement succeeds, and analysis errors are recorded while the old graph remains intact. Unsupported paths retain the analyzer's existing in-place behavior. Untouched configs that omit `pdg` preserve the existing index mode and cannot silently strip PDG data. Do not paste `pdg: false` from this example onto an existing watch file unless you intend to drop PDG. An explicit `pdg: false` disables PDG and emits a warning before a successful rebuild removes those layers. `overwrite_local_changes` defaults to `false`; a dirty local clone is skipped with an error log, while `true` allows branch fallback to replace local changes and additionally discards untracked files and directories in the clone after checkout — ignored paths, including GitNexus's own `.gitnexus/` storage, are preserved. `max_concurrency` defaults to `1` and is capped at runtime by `floor(availableMemoryGB / 2)` with a minimum of `1`; the effective value is printed at the start of each loop. Each analysis worker's heap cap is the machine-wide cap divided by the number of repositories analyzed in parallel, so concurrent workers share one memory budget instead of each claiming the whole machine. `analyze_failure_threshold` defaults to `3`, must be at least `2`, and pauses repeated failures only for the same repo branch, commit, and requested PDG mode; a new commit, a PDG mode change, or `gitnexus auto-sync reset` clears the block and allows analysis again. Repositories are registered and added to groups by their full remote identity (`host/namespace/repo`), so repositories with the same basename remain distinct. Use `branches` to try branches in order; legacy `branch` remains supported, but the two fields cannot be set together. If all branches are unavailable or time out, watch logs an error, records the repo status, and skips that repo for the loop. Leave `group_name` empty or omit it to skip group add/sync for that project; otherwise create the group first with `gitnexus group create <name>`. `$GITNEXUS_HOME/watch/project_commit_info.txt` is for inspection only; GitNexus stores machine state separately in `$GITNEXUS_HOME/watch/auto-sync-state.json`.
 

package/dist/_shared/scope-resolution/types.d.ts

@@ -355,6 +355,12 @@ type ParsedImportSyntax =
      *  deferred — `use` does not execute
      *  (`LanguageProvider.importsExecuteWhereWritten`). */
     readonly runsOnlyWhenCalled?: boolean;
+    /**
+     * C/C++ `#include <…>` (true) versus `#include "…"`.
+     * Angle includes resolve only on header search paths. Quoted includes
+     * may still use the including file's directory and the basename index.
+     */
+    readonly isSystem?: boolean;
 }
 /**
  * Runtime-computed target — the import path is not a static literal at

package/dist/_shared/scope-resolution/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,4FAA4F;AAC5F,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,0DAA0D;AAC1D,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC;AAE3B;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GACjB,QAAQ,GACR,WAAW,GACX,OAAO,GACP,UAAU,GACV,OAAO,GACP,YAAY,GACZ,QAAQ,CAAC;AAIb,qFAAqF;AACrF,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAI7D;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG;IAC9C;;0DAEsD;IACtD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,KAAK,kBAAkB;AACrB;;;;;;;GAOG;AACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;mEAI+D;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AACH;;;;;;GAMG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5D;;8EAE0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;+DAE2D;IAC3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,iDAAiD;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C,iDAAiD;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AACH;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;sDACkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;kDAC8C;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;wFACoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;sDAQkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;;;;;;;;;GAiBG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;2DAOuD;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;GASG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;8EAC0E;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;;;;;;;;GAgBG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;4EAEwE;IACxE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;uEAEmE;IACnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;uDACmD;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;AAMrC;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;CAC1C;AAED,4DAA4D;AAC5D,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;iEAC6D;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAID;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC7B,QAAQ,CAAC,IAAI,EACT,OAAO,GACP,OAAO,GACP,WAAW,GACX,mBAAmB,GACnB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,GAClB,aAAa,CAAC;IAClB,oFAAoF;IACpF,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC;CACpC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;IAC5E,sGAAsG;IACtG,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CAC9C;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,MAAM,EACX,YAAY,GACZ,sBAAsB,GACtB,mBAAmB,GACnB,MAAM,GACN,qBAAqB,GACrB,sBAAsB,GACtB,qBAAqB,CAAC;IAC1B,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CACxC;AAID;;;;;GAKG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,CAAC;IAE9D,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAEhD;;kDAE8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAExC,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpD;;uEAEmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAE5C;;;;;;;;;;;gEAW4D;IAC5D,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9C;AAID;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EACT,OAAO,GACP,aAAa,GACb,QAAQ,GACR,cAAc,GACd,aAAa,GACb,YAAY,GACZ,aAAa,GACb,aAAa,GACb,kBAAkB,GAClB,2BAA2B,CAAC;IAChC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACjD,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CACpC;AAID;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,IAAI,EACT,MAAM,GACN,MAAM,GACN,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,YAAY,GACZ,WAAW,GACX,OAAO,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B;;;8DAG0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC,CAAC;CAChE;AAID;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,EAAE,SAAS,SAAS,EAAE,CAAC;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,sBAAsB,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5D,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;gFAE4E;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,4FAA4F;AAC5F,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,0DAA0D;AAC1D,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC;AAE3B;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GACjB,QAAQ,GACR,WAAW,GACX,OAAO,GACP,UAAU,GACV,OAAO,GACP,YAAY,GACZ,QAAQ,CAAC;AAIb,qFAAqF;AACrF,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAI7D;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG;IAC9C;;0DAEsD;IACtD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,KAAK,kBAAkB;AACrB;;;;;;;GAOG;AACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;mEAI+D;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AACH;;;;;;GAMG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5D;;8EAE0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;+DAE2D;IAC3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,iDAAiD;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C,iDAAiD;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AACH;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;sDACkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;kDAC8C;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;wFACoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;sDAQkD;IAClD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;;;;;;;;;GAiBG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;2DAOuD;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AACH;;;;;;;;;GASG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;8EAC0E;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;;;;;;;;GAgBG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;4EAEwE;IACxE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AACH;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;uEAEmE;IACnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;uDACmD;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;AAMrC;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;CAC1C;AAED,4DAA4D;AAC5D,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;iEAC6D;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAID;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC7B,QAAQ,CAAC,IAAI,EACT,OAAO,GACP,OAAO,GACP,WAAW,GACX,mBAAmB,GACnB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,GAClB,aAAa,CAAC;IAClB,oFAAoF;IACpF,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC;CACpC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;IAC5E,sGAAsG;IACtG,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CAC9C;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,MAAM,EACX,YAAY,GACZ,sBAAsB,GACtB,mBAAmB,GACnB,MAAM,GACN,qBAAqB,GACrB,sBAAsB,GACtB,qBAAqB,CAAC;IAC1B,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CACxC;AAID;;;;;GAKG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,CAAC;IAE9D,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAEhD;;kDAE8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAExC,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpD;;uEAEmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAE5C;;;;;;;;;;;gEAW4D;IAC5D,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9C;AAID;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EACT,OAAO,GACP,aAAa,GACb,QAAQ,GACR,cAAc,GACd,aAAa,GACb,YAAY,GACZ,aAAa,GACb,aAAa,GACb,kBAAkB,GAClB,2BAA2B,CAAC;IAChC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACjD,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CACpC;AAID;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,IAAI,EACT,MAAM,GACN,MAAM,GACN,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,YAAY,GACZ,WAAW,GACX,OAAO,CAAC;IACZ;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B;;;8DAG0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC,CAAC;CAChE;AAID;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,EAAE,SAAS,SAAS,EAAE,CAAC;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,sBAAsB,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5D,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;gFAE4E;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD"}

package/dist/cli/auto-sync.js

@@ -96,6 +96,9 @@ function defaultSyncConfig(localPath) {
         'repo_git_timeout: 10s',
         'analyze_timeout: 5m',
         'analyze_failure_threshold: 3',
+        '# Extra SSH/HTTPS hosts beyond github.com, gitlab.com, and gitee.com.',
+        '# Exact DNS names only; wildcards are rejected.',
+        '# allowed_hosts: [gitlab.mycompany.com]',
         'projects:',
         `  - local_path: ${localPath}`,
         '    branches: [master, main]',
@@ -106,7 +109,7 @@ function defaultSyncConfig(localPath) {
         '    overwrite_local_changes: false',
         '    remote_urls:',
         '      - git@github.com:owner/repo.git',
-        '      # HTTPS remotes on github.com, gitlab.com, or gitee.com are also allowed',
+        '      # HTTPS remotes are also allowed. Other hosts need top-level allowed_hosts.',
         '      # - https://github.com/owner/public-repo.git',
         '',
     ].join('\n');

package/dist/cli/i18n/en.d.ts

@@ -170,7 +170,7 @@ export declare const en: {
     readonly 'help.command.setup.description': 'One-time setup: configure MCP for Cursor, Claude Code, Antigravity, OpenCode, CodeBuddy, Qoder, Codex, Factory Droid';
     readonly 'help.command.uninstall.description': 'Reverse `setup`: remove GitNexus MCP entries, skills, and hooks from all detected editors';
     readonly 'help.command.autoSync.description': 'Control scheduled repository clone/pull and analysis from GITNEXUS_HOME/watch_config.yml';
-    readonly 'help.autoSync.details': '\nActions: init, start (default), restart, stop, status, reset\nConfiguration: GITNEXUS_HOME/watch_config.yml\nRuntime files: GITNEXUS_HOME/watch/watch.pid, watch.mutex, watch.owner.json, watch.status.json, auto-sync-state.json\nRecovery: mutexes with verified dead owners are reclaimed automatically; invalid or legacy mutexes fail closed and require manual removal after confirming no watch process is running.\nWrites: GITNEXUS_HOME/watch/project_commit_info.txt\nRemote URLs: SSH or HTTPS URLs on github.com, gitlab.com, and gitee.com are allowed. Invalid watch_config.yml skips auto-sync immediately.\nRuns once immediately, then repeats on sync_interval_minutes.';
+    readonly 'help.autoSync.details': '\nActions: init, start (default), restart, stop, status, reset\nConfiguration: GITNEXUS_HOME/watch_config.yml\nRuntime files: GITNEXUS_HOME/watch/watch.pid, watch.mutex, watch.owner.json, watch.status.json, auto-sync-state.json\nRecovery: mutexes with verified dead owners are reclaimed automatically; invalid or legacy mutexes fail closed and require manual removal after confirming no watch process is running.\nWrites: GITNEXUS_HOME/watch/project_commit_info.txt\nRemote URLs: SSH or HTTPS URLs on github.com, gitlab.com, and gitee.com are allowed. Other hosts need a top-level allowed_hosts list of exact DNS names. Invalid watch_config.yml skips auto-sync immediately.\nRuns once immediately, then repeats on sync_interval_minutes.';
     readonly 'help.command.watch.description': 'Ambiguous: use `analyze --watch` for local files, or `auto-sync` for scheduled remotes';
     readonly 'help.watch.details': '\n`gitnexus watch` does not start a watcher.\n  Local working-tree incremental index:  gitnexus analyze --watch\n  Scheduled remote clone/pull + analyze: gitnexus auto-sync start\n';
     readonly 'error.watch.ambiguous': '`gitnexus watch` is ambiguous.\n  Local working-tree incremental index:  gitnexus analyze --watch\n  Scheduled remote clone/pull + analyze: gitnexus auto-sync start\n';

package/dist/cli/i18n/en.js

@@ -172,7 +172,7 @@ export const en = {
     'help.command.setup.description': 'One-time setup: configure MCP for Cursor, Claude Code, Antigravity, OpenCode, CodeBuddy, Qoder, Codex, Factory Droid',
     'help.command.uninstall.description': 'Reverse `setup`: remove GitNexus MCP entries, skills, and hooks from all detected editors',
     'help.command.autoSync.description': 'Control scheduled repository clone/pull and analysis from GITNEXUS_HOME/watch_config.yml',
-    'help.autoSync.details': '\nActions: init, start (default), restart, stop, status, reset\nConfiguration: GITNEXUS_HOME/watch_config.yml\nRuntime files: GITNEXUS_HOME/watch/watch.pid, watch.mutex, watch.owner.json, watch.status.json, auto-sync-state.json\nRecovery: mutexes with verified dead owners are reclaimed automatically; invalid or legacy mutexes fail closed and require manual removal after confirming no watch process is running.\nWrites: GITNEXUS_HOME/watch/project_commit_info.txt\nRemote URLs: SSH or HTTPS URLs on github.com, gitlab.com, and gitee.com are allowed. Invalid watch_config.yml skips auto-sync immediately.\nRuns once immediately, then repeats on sync_interval_minutes.',
+    'help.autoSync.details': '\nActions: init, start (default), restart, stop, status, reset\nConfiguration: GITNEXUS_HOME/watch_config.yml\nRuntime files: GITNEXUS_HOME/watch/watch.pid, watch.mutex, watch.owner.json, watch.status.json, auto-sync-state.json\nRecovery: mutexes with verified dead owners are reclaimed automatically; invalid or legacy mutexes fail closed and require manual removal after confirming no watch process is running.\nWrites: GITNEXUS_HOME/watch/project_commit_info.txt\nRemote URLs: SSH or HTTPS URLs on github.com, gitlab.com, and gitee.com are allowed. Other hosts need a top-level allowed_hosts list of exact DNS names. Invalid watch_config.yml skips auto-sync immediately.\nRuns once immediately, then repeats on sync_interval_minutes.',
     'help.command.watch.description': 'Ambiguous: use `analyze --watch` for local files, or `auto-sync` for scheduled remotes',
     'help.watch.details': '\n`gitnexus watch` does not start a watcher.\n  Local working-tree incremental index:  gitnexus analyze --watch\n  Scheduled remote clone/pull + analyze: gitnexus auto-sync start\n',
     'error.watch.ambiguous': '`gitnexus watch` is ambiguous.\n  Local working-tree incremental index:  gitnexus analyze --watch\n  Scheduled remote clone/pull + analyze: gitnexus auto-sync start\n',

package/dist/cli/i18n/resources.d.ts

@@ -171,7 +171,7 @@ export declare const cliResources: {
         readonly 'help.command.setup.description': 'One-time setup: configure MCP for Cursor, Claude Code, Antigravity, OpenCode, CodeBuddy, Qoder, Codex, Factory Droid';
         readonly 'help.command.uninstall.description': 'Reverse `setup`: remove GitNexus MCP entries, skills, and hooks from all detected editors';
         readonly 'help.command.autoSync.description': 'Control scheduled repository clone/pull and analysis from GITNEXUS_HOME/watch_config.yml';
-        readonly 'help.autoSync.details': '\nActions: init, start (default), restart, stop, status, reset\nConfiguration: GITNEXUS_HOME/watch_config.yml\nRuntime files: GITNEXUS_HOME/watch/watch.pid, watch.mutex, watch.owner.json, watch.status.json, auto-sync-state.json\nRecovery: mutexes with verified dead owners are reclaimed automatically; invalid or legacy mutexes fail closed and require manual removal after confirming no watch process is running.\nWrites: GITNEXUS_HOME/watch/project_commit_info.txt\nRemote URLs: SSH or HTTPS URLs on github.com, gitlab.com, and gitee.com are allowed. Invalid watch_config.yml skips auto-sync immediately.\nRuns once immediately, then repeats on sync_interval_minutes.';
+        readonly 'help.autoSync.details': '\nActions: init, start (default), restart, stop, status, reset\nConfiguration: GITNEXUS_HOME/watch_config.yml\nRuntime files: GITNEXUS_HOME/watch/watch.pid, watch.mutex, watch.owner.json, watch.status.json, auto-sync-state.json\nRecovery: mutexes with verified dead owners are reclaimed automatically; invalid or legacy mutexes fail closed and require manual removal after confirming no watch process is running.\nWrites: GITNEXUS_HOME/watch/project_commit_info.txt\nRemote URLs: SSH or HTTPS URLs on github.com, gitlab.com, and gitee.com are allowed. Other hosts need a top-level allowed_hosts list of exact DNS names. Invalid watch_config.yml skips auto-sync immediately.\nRuns once immediately, then repeats on sync_interval_minutes.';
         readonly 'help.command.watch.description': 'Ambiguous: use `analyze --watch` for local files, or `auto-sync` for scheduled remotes';
         readonly 'help.watch.details': '\n`gitnexus watch` does not start a watcher.\n  Local working-tree incremental index:  gitnexus analyze --watch\n  Scheduled remote clone/pull + analyze: gitnexus auto-sync start\n';
         readonly 'error.watch.ambiguous': '`gitnexus watch` is ambiguous.\n  Local working-tree incremental index:  gitnexus analyze --watch\n  Scheduled remote clone/pull + analyze: gitnexus auto-sync start\n';

package/dist/cli/i18n/zh-CN.js

@@ -170,7 +170,7 @@ export const zhCN = {
     'help.command.setup.description': '一次性设置：为 Cursor、Claude Code、Antigravity、OpenCode、CodeBuddy、Qoder、Codex、Factory Droid 配置 MCP',
     'help.command.uninstall.description': '撤销 `setup`：从所有检测到的编辑器中移除 GitNexus 的 MCP 配置、技能和钩子',
     'help.command.autoSync.description': '控制基于 GITNEXUS_HOME/watch_config.yml 的定时 clone/pull 和分析',
-    'help.autoSync.details': '\n操作：init、start（默认）、restart、stop、status、reset\n配置：GITNEXUS_HOME/watch_config.yml\n运行时文件：GITNEXUS_HOME/watch/watch.pid、watch.mutex、watch.owner.json、watch.status.json、auto-sync-state.json\n恢复：已验证 owner 退出的 mutex 会自动回收；无效或旧版 mutex 会安全拒绝，确认没有 watch 进程运行后再手动删除。\n写入：GITNEXUS_HOME/watch/project_commit_info.txt\n远程地址：允许 github.com、gitlab.com 和 gitee.com 上的 SSH 或 HTTPS 地址。无效的 watch_config.yml 会立即跳过 auto-sync。\n启动后立即运行一次，之后按 sync_interval_minutes 重复。',
+    'help.autoSync.details': '\n操作：init、start（默认）、restart、stop、status、reset\n配置：GITNEXUS_HOME/watch_config.yml\n运行时文件：GITNEXUS_HOME/watch/watch.pid、watch.mutex、watch.owner.json、watch.status.json、auto-sync-state.json\n恢复：已验证 owner 退出的 mutex 会自动回收；无效或旧版 mutex 会安全拒绝，确认没有 watch 进程运行后再手动删除。\n写入：GITNEXUS_HOME/watch/project_commit_info.txt\n远程地址：允许 github.com、gitlab.com 和 gitee.com 上的 SSH 或 HTTPS 地址。其他主机需在顶层 allowed_hosts 中列出精确 DNS 名称。无效的 watch_config.yml 会立即跳过 auto-sync。\n启动后立即运行一次，之后按 sync_interval_minutes 重复。',
     'help.command.watch.description': '含义不明确：本地文件请用 `analyze --watch`，定时远程同步请用 `auto-sync`',
     'help.watch.details': '\n`gitnexus watch` 不会启动监视器。\n  本地工作区增量索引：gitnexus analyze --watch\n  定时远程 clone/pull 并分析：gitnexus auto-sync start\n',
     'error.watch.ambiguous': '`gitnexus watch` 含义不明确。\n  本地工作区增量索引：gitnexus analyze --watch\n  定时远程 clone/pull 并分析：gitnexus auto-sync start\n',

package/dist/core/auto-sync/config.d.ts

@@ -1,5 +1,12 @@
 export declare const AUTO_SYNC_CONFIG_FILE = "watch_config.yml";
 export declare const DEFAULT_ANALYZE_FAILURE_THRESHOLD = 3;
+/**
+ * Name git should resolve. A trailing dot forces an absolute lookup, so a
+ * search list cannot answer `git` as `git.<domain>` or retry an FQDN under
+ * that domain after NXDOMAIN. A strict IPv4 literal stays undotted: `10.0.0.1.`
+ * is a DNS name, not that address.
+ */
+export declare function absoluteAutoSyncRemoteUrl(remoteUrl: string): string;
 export interface AutoSyncProjectConfig {
     localPath: string;
     groupName?: string;
@@ -16,6 +23,11 @@ export interface AutoSyncConfig {
     analyzeTimeoutMs: number;
     maxConcurrency: number;
     analyzeFailureThreshold: number;
+    /**
+     * Extra remote hosts from top-level `allowed_hosts`, already lowercased.
+     * Omitted on hand-built configs; treated as none.
+     */
+    allowedHosts?: readonly string[];
     projects: AutoSyncProjectConfig[];
 }
 export type AutoSyncConfigLoadResult = {
@@ -30,12 +42,12 @@ export declare function getAutoSyncConfigPath(gitnexusDir?: string): string;
 export declare function parseBranchCandidates(branchValue: unknown): string[];
 export declare function loadAutoSyncConfig(configPath?: string): Promise<AutoSyncConfigLoadResult>;
 export declare function parseAutoSyncConfig(content: string, configPath: string): AutoSyncConfig;
-export declare function parseAutoSyncRemoteIdentity(remoteUrl: string): {
+export declare function parseAutoSyncRemoteIdentity(remoteUrl: string, allowedHosts?: readonly string[]): {
     host: string;
     repoPath: string;
 };
 /** Canonical `host/owner/repo` key. Strips one trailing `.git`. Throws on an invalid remote. */
-export declare function getAutoSyncRepoIdentity(remoteUrl: string): string;
-export declare function validateAutoSyncRemoteUrl(remoteUrl: string): void;
+export declare function getAutoSyncRepoIdentity(remoteUrl: string, allowedHosts?: readonly string[]): string;
+export declare function validateAutoSyncRemoteUrl(remoteUrl: string, allowedHosts?: readonly string[]): void;
 export declare function validateAutoSyncBranchName(branch: string): void;
 export declare function parseDurationMs(value: unknown): number;

package/dist/core/auto-sync/config.js

@@ -14,7 +14,69 @@ const DEFAULT_REPO_GIT_TIMEOUT_MS = 10_000;
 const DEFAULT_MAX_CONCURRENCY = 1;
 export const DEFAULT_ANALYZE_FAILURE_THRESHOLD = 3;
 const MIN_ANALYZE_FAILURE_THRESHOLD = 2;
-const ALLOWED_REMOTE_HOSTS = new Set(['github.com', 'gitlab.com', 'gitee.com']);
+const BUILTIN_REMOTE_HOSTS = new Set(['github.com', 'gitlab.com', 'gitee.com']);
+// Exact DNS names only. The host is a directory under local_path, so wildcards,
+// ports, and path characters stay out. A label is 1-63 chars and cannot start
+// or end with a hyphen; the whole name is at most 253 characters.
+// One trailing dot is stripped before this runs: it marks an absolute lookup,
+// it is not a different host.
+const AUTO_SYNC_HOST_PATTERN = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+/** Lowercase, and drop one trailing root dot so `git.` and `git` are one host. */
+function canonicalAutoSyncHost(host) {
+    return host.trim().toLowerCase().replace(/\.$/, '');
+}
+function isStrictDottedQuad(host) {
+    const labels = host.split('.');
+    if (labels.length !== 4)
+        return false;
+    return labels.every((label) => /^(0|[1-9]\d{0,2})$/.test(label) && Number(label) <= 255);
+}
+/**
+ * Spellings glibc inet_aton dials as a different address than the token
+ * (`192.168.1` → 192.168.0.1, `0x7f.0.0.1` / `2130706433` → 127.0.0.1).
+ * A strict four-octet address is the address written; listing it is opt-in.
+ */
+function isAmbiguousNumericHost(host) {
+    const labels = host.split('.');
+    if (labels.some((label) => /^0x[0-9a-f]+$/i.test(label) || /^0\d/.test(label)))
+        return true;
+    return labels.every((label) => /^\d+$/.test(label)) && !isStrictDottedQuad(host);
+}
+function autoSyncHostProblem(host) {
+    if (!AUTO_SYNC_HOST_PATTERN.test(host))
+        return 'shape';
+    if (isAmbiguousNumericHost(host))
+        return 'numeric';
+    return null;
+}
+function autoSyncHostProblemMessage(problem) {
+    return problem === 'numeric'
+        ? 'must not use an ambiguous numeric spelling'
+        : 'must be a DNS hostname';
+}
+function rewriteAutoSyncRemoteHost(remoteUrl, mapHost) {
+    const ssh = /^(git@)([^:\s/]+)(:[^\s]+)$/.exec(remoteUrl);
+    if (ssh)
+        return `${ssh[1]}${mapHost(ssh[2])}${ssh[3]}`;
+    const https = /^(https:\/\/)([^/\s]+)(\/[^\s]+)$/.exec(remoteUrl);
+    if (https)
+        return `${https[1]}${mapHost(https[2])}${https[3]}`;
+    return remoteUrl;
+}
+/**
+ * Name git should resolve. A trailing dot forces an absolute lookup, so a
+ * search list cannot answer `git` as `git.<domain>` or retry an FQDN under
+ * that domain after NXDOMAIN. A strict IPv4 literal stays undotted: `10.0.0.1.`
+ * is a DNS name, not that address.
+ */
+export function absoluteAutoSyncRemoteUrl(remoteUrl) {
+    return rewriteAutoSyncRemoteHost(remoteUrl.trim(), (host) => {
+        const canonical = canonicalAutoSyncHost(host);
+        if (isStrictDottedQuad(canonical))
+            return canonical;
+        return `${canonical}.`;
+    });
+}
 /**
  * A single clone/pull must fit inside one sync interval and inside an hour.
  * This is also the guard for the unit slip the bare-number rule invites:
@@ -148,6 +210,7 @@ export function parseAutoSyncConfig(content, configPath) {
         analyzeFailureThreshold < MIN_ANALYZE_FAILURE_THRESHOLD) {
         errors.push(`analyze_failure_threshold must be an integer >= ${MIN_ANALYZE_FAILURE_THRESHOLD}`);
     }
+    const allowedHosts = parseAllowedAutoSyncHosts(raw.allowed_hosts, errors);
     const rawProjects = raw.projects;
     if (!Array.isArray(rawProjects) || rawProjects.length === 0) {
         errors.push('projects must contain at least one project');
@@ -180,7 +243,7 @@ export function parseAutoSyncConfig(content, configPath) {
             }
             for (let urlIndex = 0; urlIndex < remoteUrls.length; urlIndex += 1) {
                 try {
-                    validateAutoSyncRemoteUrl(remoteUrls[urlIndex]);
+                    validateAutoSyncRemoteUrl(remoteUrls[urlIndex], allowedHosts);
                 }
                 catch (err) {
                     errors.push(`projects[${index}].remote_urls[${urlIndex}] ${err.message}`);
@@ -234,10 +297,39 @@ export function parseAutoSyncConfig(content, configPath) {
         analyzeTimeoutMs,
         maxConcurrency,
         analyzeFailureThreshold,
+        allowedHosts,
         projects,
     };
 }
-export function parseAutoSyncRemoteIdentity(remoteUrl) {
+function parseAllowedAutoSyncHosts(value, errors) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value)) {
+        errors.push('allowed_hosts must be a list of DNS hostnames');
+        return [];
+    }
+    const hosts = [];
+    const seen = new Set();
+    for (let index = 0; index < value.length; index += 1) {
+        const entry = value[index];
+        if (typeof entry !== 'string') {
+            errors.push(`allowed_hosts[${index}] must be a DNS hostname`);
+            continue;
+        }
+        const host = canonicalAutoSyncHost(entry);
+        const problem = autoSyncHostProblem(host);
+        if (problem) {
+            errors.push(`allowed_hosts[${index}] ${autoSyncHostProblemMessage(problem)}`);
+            continue;
+        }
+        if (seen.has(host))
+            continue;
+        seen.add(host);
+        hosts.push(host);
+    }
+    return hosts;
+}
+export function parseAutoSyncRemoteIdentity(remoteUrl, allowedHosts) {
     const trimmed = remoteUrl.trim();
     if (trimmed.includes('?') || trimmed.includes('#')) {
         throw new Error('must not include query strings or fragments');
@@ -258,23 +350,38 @@ export function parseAutoSyncRemoteIdentity(remoteUrl) {
         }
     }
     else {
-        throw new Error('must use an SSH or HTTPS URL on github.com, gitlab.com, or gitee.com');
+        throw new Error('must use an SSH or HTTPS URL (git@host:owner/repo or https://host/owner/repo)');
     }
-    host = host.toLowerCase();
-    assertAutoSyncRemotePath(host, repoPath);
+    host = canonicalAutoSyncHost(host);
+    assertAutoSyncRemotePath(host, repoPath, allowedHosts);
     return { host, repoPath };
 }
 /** Canonical `host/owner/repo` key. Strips one trailing `.git`. Throws on an invalid remote. */
-export function getAutoSyncRepoIdentity(remoteUrl) {
-    const { host, repoPath } = parseAutoSyncRemoteIdentity(remoteUrl);
+export function getAutoSyncRepoIdentity(remoteUrl, allowedHosts) {
+    const { host, repoPath } = parseAutoSyncRemoteIdentity(remoteUrl, allowedHosts);
     return `${host}/${repoPath.replace(/\.git$/i, '')}`;
 }
-export function validateAutoSyncRemoteUrl(remoteUrl) {
-    parseAutoSyncRemoteIdentity(remoteUrl);
+export function validateAutoSyncRemoteUrl(remoteUrl, allowedHosts) {
+    parseAutoSyncRemoteIdentity(remoteUrl, allowedHosts);
 }
-function assertAutoSyncRemotePath(host, repoPath) {
-    if (!ALLOWED_REMOTE_HOSTS.has(host)) {
-        throw new Error('host must be one of github.com, gitlab.com, or gitee.com');
+function isPermittedAutoSyncHost(host, allowedHosts) {
+    if (BUILTIN_REMOTE_HOSTS.has(host))
+        return true;
+    if (!allowedHosts)
+        return false;
+    for (const entry of allowedHosts) {
+        if (canonicalAutoSyncHost(entry) === host)
+            return true;
+    }
+    return false;
+}
+function assertAutoSyncRemotePath(host, repoPath, allowedHosts) {
+    const problem = autoSyncHostProblem(host);
+    if (problem) {
+        throw new Error(`host ${autoSyncHostProblemMessage(problem)}`);
+    }
+    if (!isPermittedAutoSyncHost(host, allowedHosts)) {
+        throw new Error('host must be one of github.com, gitlab.com, or gitee.com, or listed in top-level allowed_hosts');
     }
     const pathParts = repoPath.split('/');
     // Every segment becomes a directory component: the namespace segments build

package/dist/core/auto-sync/repo.d.ts

@@ -1 +1 @@
-export declare function extractRepoNameFromRemoteUrl(remoteUrl: string): string;
+export declare function extractRepoNameFromRemoteUrl(remoteUrl: string, allowedHosts?: readonly string[]): string;

package/dist/core/auto-sync/repo.js

@@ -1,6 +1,6 @@
 import { extractRepoName } from '../../server/git-clone.js';
 import { validateAutoSyncRemoteUrl } from './config.js';
-export function extractRepoNameFromRemoteUrl(remoteUrl) {
-    validateAutoSyncRemoteUrl(remoteUrl);
+export function extractRepoNameFromRemoteUrl(remoteUrl, allowedHosts) {
+    validateAutoSyncRemoteUrl(remoteUrl, allowedHosts);
     return extractRepoName(remoteUrl);
 }

package/dist/core/auto-sync/runner.d.ts

@@ -40,7 +40,7 @@ export declare function runAutoSyncOnce(config: AutoSyncConfig, options?: {
     signal?: AbortSignal;
     onAnalysisCancellationRequested?: () => void;
 }): Promise<AutoSyncRunResult>;
-export declare function getConfiguredRepoPath(project: Pick<AutoSyncProjectConfig, 'localPath'>, repoName: string, remoteUrl?: string): string;
+export declare function getConfiguredRepoPath(project: Pick<AutoSyncProjectConfig, 'localPath'>, repoName: string, remoteUrl?: string, allowedHosts?: readonly string[]): string;
 export declare function addRepoToGroup(project: Pick<AutoSyncProjectConfig, 'groupName'>, groupPath: string, registryName?: string): Promise<boolean>;
 export { getAutoSyncRepoIdentity } from './config.js';
 export declare function syncGroupByName(groupName: string): Promise<void>;

package/dist/core/auto-sync/runner.js

@@ -86,6 +86,7 @@ export async function runAutoSyncOnce(config, options = {}) {
                 repoName,
                 targetDir,
                 timeoutMs: config.repoGitTimeoutMs,
+                allowedHosts: config.allowedHosts,
                 deps,
                 logger,
             });
@@ -254,7 +255,7 @@ export async function runAutoSyncOnce(config, options = {}) {
                 // on the documented branch-fallback path.
                 const placement = await deps.resolveBranchPlacement(repoResult.targetDir, repoResult.branch);
                 await deps.registerRepo(repoResult.targetDir, meta, {
-                    name: getAutoSyncRepoIdentity(repoResult.remoteUrl),
+                    name: getAutoSyncRepoIdentity(repoResult.remoteUrl, config.allowedHosts),
                     // Omitted rather than passed as undefined, so a primary index is
                     // registered with the same option shape it had before this branch.
                     ...(placement.branch ? { branch: placement.branch } : {}),
@@ -303,7 +304,7 @@ export async function runAutoSyncOnce(config, options = {}) {
             let groupMembershipOk = false;
             let membershipAdded = false;
             try {
-                membershipAdded = await deps.addRepoToGroup(repoResult.project, getAutoSyncRepoIdentity(repoResult.remoteUrl), getAutoSyncRepoIdentity(repoResult.remoteUrl));
+                membershipAdded = await deps.addRepoToGroup(repoResult.project, getAutoSyncRepoIdentity(repoResult.remoteUrl, config.allowedHosts), getAutoSyncRepoIdentity(repoResult.remoteUrl, config.allowedHosts));
                 groupMembershipOk = true;
             }
             catch (err) {
@@ -369,10 +370,10 @@ function isRetryableAnalyzeContention(err) {
         err.code === 'index-lock-timeout' &&
         err.retryable === true);
 }
-export function getConfiguredRepoPath(project, repoName, remoteUrl) {
+export function getConfiguredRepoPath(project, repoName, remoteUrl, allowedHosts) {
     if (!remoteUrl)
         return path.resolve(project.localPath, repoName);
-    const identity = getAutoSyncRepoIdentity(remoteUrl);
+    const identity = getAutoSyncRepoIdentity(remoteUrl, allowedHosts);
     return path.resolve(project.localPath, ...identity.split('/').slice(0, -1), repoName);
 }
 export async function addRepoToGroup(project, groupPath, registryName = groupPath) {
@@ -420,8 +421,8 @@ async function buildWorkItems(config, deps) {
         }
         for (const remoteUrl of project.remoteUrls) {
             try {
-                const repoName = extractRepoNameFromRemoteUrl(remoteUrl);
-                const targetDir = getConfiguredRepoPath({ localPath: cloneRoot.root }, repoName, remoteUrl);
+                const repoName = extractRepoNameFromRemoteUrl(remoteUrl, config.allowedHosts);
+                const targetDir = getConfiguredRepoPath({ localPath: cloneRoot.root }, repoName, remoteUrl, config.allowedHosts);
                 const previous = targetOwners.get(targetDir);
                 if (previous !== undefined) {
                     throw new Error(`Duplicate auto-sync targetDir ${targetDir} for ${previous} and ${remoteUrl}`);
@@ -474,6 +475,9 @@ async function syncFirstAvailableBranch(input) {
                 expectedRepoName: input.repoName,
                 quarantineRoot: input.item.cloneRoot.quarantineRoot,
                 allowAutoSyncSsh: true,
+                ...(input.allowedHosts && input.allowedHosts.length > 0
+                    ? { autoSyncAllowedHosts: input.allowedHosts }
+                    : {}),
                 timeoutMs: input.timeoutMs,
                 branch,
                 overwriteLocalChanges: input.item.project.overwriteLocalChanges,

package/dist/core/ingestion/languages/c/header-scan.d.ts

@@ -1,7 +1,5 @@
 /**
- * Walk `repoPath` recursively and return relative paths of all `.h` files.
- * Used by `loadResolutionConfig` so the C resolver can resolve `#include`
- * targets that live in `.h` files (classified as C++ by language detection
- * but importable from `.c` files).
+ * Walk `repoPath` and return relative paths of all `.h` files.
+ * Search paths stay on the workspace config; this is only the header set.
  */
 export declare function scanHeaderFiles(repoPath: string): ReadonlySet<string>;

package/dist/core/ingestion/languages/c/header-scan.js

@@ -1,55 +1,8 @@
-import { readdirSync } from 'fs';
-import { join, relative } from 'path';
-/** C header extensions to scan for in the workspace. */
-const HEADER_EXTENSIONS = new Set(['.h']);
+import { C_HEADER_EXTENSIONS, scanCFamilyHeaders } from './resolution-config.js';
 /**
- * Walk `repoPath` recursively and return relative paths of all `.h` files.
- * Used by `loadResolutionConfig` so the C resolver can resolve `#include`
- * targets that live in `.h` files (classified as C++ by language detection
- * but importable from `.c` files).
+ * Walk `repoPath` and return relative paths of all `.h` files.
+ * Search paths stay on the workspace config; this is only the header set.
  */
 export function scanHeaderFiles(repoPath) {
-    const headers = new Set();
-    walk(repoPath, repoPath, headers);
-    return headers;
-}
-function walk(dir, root, out) {
-    let entries;
-    try {
-        entries = readdirSync(dir, { withFileTypes: true, encoding: 'utf8' });
-    }
-    catch {
-        return; // permission denied, etc.
-    }
-    for (const entry of entries) {
-        const name = entry.name;
-        const full = join(dir, name);
-        if (entry.isDirectory()) {
-            // Skip common non-source directories and build output dirs.
-            // Build dirs (dist, build, out, target, _build, .next, cmake-build-*)
-            // may contain generated headers that shadow source headers.
-            if (name === 'node_modules' ||
-                name === '.git' ||
-                name === 'vendor' ||
-                name === 'dist' ||
-                name === 'build' ||
-                name === 'out' ||
-                name === 'target' ||
-                name === '_build' ||
-                name === '.next' ||
-                name.startsWith('cmake-build')) {
-                continue;
-            }
-            walk(full, root, out);
-        }
-        else if (entry.isFile()) {
-            const ext = name.slice(name.lastIndexOf('.'));
-            if (HEADER_EXTENSIONS.has(ext)) {
-                // Normalize to forward slashes for cross-platform consistency.
-                // path.relative() returns backslash-separated paths on Windows,
-                // but the scope-resolution pipeline uses forward slashes uniformly.
-                out.add(relative(root, full).replace(/\\/g, '/'));
-            }
-        }
-    }
+    return scanCFamilyHeaders(repoPath, C_HEADER_EXTENSIONS).headers;
 }

package/dist/core/ingestion/languages/c/import-target.d.ts

@@ -1,14 +1,61 @@
+import { type CTranslationUnitPaths } from './resolution-config.js';
+/**
+ * A workspace file path pre-decomposed for the suffix-match fallback:
+ * `original` is returned verbatim (preserving the prior `bestMatch = filePath`
+ * contract); `normalized` and `depth` are precomputed so the hot path does no
+ * per-element regex/`split`.
+ */
+export interface CSuffixCandidate {
+    original: string;
+    normalized: string;
+    depth: number;
+}
+export type CIncludeSuffixIndex = (allFilePaths: ReadonlySet<string>) => Map<string, CSuffixCandidate[]>;
+/**
+ * Basename buckets for quoted `#include "…"` suffix fallback.
+ *
+ * The builder is shared. Each language keeps its own memo: C++ calls
+ * `resolveCFamilyImport` with the index it created here, so a C pass and a
+ * C++ pass never read each other's map even when handed the same set.
+ */
+export declare function createCIncludeSuffixIndex(): CIncludeSuffixIndex;
+/** Optional search roots. Absent means "quoted include, no declared paths". */
+export interface CIncludeLookup {
+    /** `#include <…>`. Never suffix-matches the workspace. */
+    readonly isSystem?: boolean;
+    /** Fallback `-I` / `-isystem` / `/I` and implicit roots. */
+    readonly headerSearchPaths?: readonly string[];
+    /** Fallback `-iquote`. Quoted includes only. */
+    readonly userHeaderSearchPaths?: readonly string[];
+    /**
+     * Per translation unit. A hit replaces the fallback lists for that file.
+     * The map is the one built at config load — lookup does not copy it.
+     */
+    readonly translationUnits?: ReadonlyMap<string, CTranslationUnitPaths>;
+    /** Nearest-ancestor lists for a file with no database entry. */
+    readonly directoryScopes?: ReadonlyMap<string, CTranslationUnitPaths>;
+    /** Interface include roots from `target_link_libraries`, keyed by source file. */
+    readonly cmakeLinkHeaders?: ReadonlyMap<string, readonly string[]>;
+}
 /**
  * Resolve a C #include path to a file in the workspace.
  *
- * Strategy:
- * 1. Check for a same-directory sibling relative to the including file
- *    (matches C compiler `#include "…"` relative-lookup semantics).
- * 2. Check for an exact match (path as-is in the workspace).
- * 3. Fall back to suffix matching against all workspace file paths.
- *    Tie-breaking: prefer the match with the fewest path components
- *    (closest to root). On equal depth, break ties lexicographically
- *    by normalized path to ensure deterministic resolution regardless
- *    of filesystem iteration order.
+ * Quoted `#include "…"` (the default when `lookup` is omitted, which is
+ * what the import-target bench and the older unit tests call):
+ *   1. Same directory as the including file
+ *   2. User search paths, then header search paths
+ *   3. Exact path, then the basename bucket
+ *
+ * Angle `#include <…>` (`lookup.isSystem`): join the target onto each
+ * header search path and return that file, or null. A same-named header
+ * under `src/` is not a candidate when `src` is not a search path.
  */
-export declare function resolveCImportTarget(targetRaw: string, fromFile: string, allFilePaths: ReadonlySet<string>): string | null;
+export declare function cIncludeLookupFromConfig(config: {
+    readonly headerSearchPaths?: readonly string[];
+    readonly userHeaderSearchPaths?: readonly string[];
+    readonly translationUnits?: ReadonlyMap<string, CTranslationUnitPaths>;
+    readonly directoryScopes?: ReadonlyMap<string, CTranslationUnitPaths>;
+    readonly cmakeLinkHeaders?: ReadonlyMap<string, readonly string[]>;
+} | undefined, isSystem: boolean): CIncludeLookup;
+export declare function resolveCImportTarget(targetRaw: string, fromFile: string, allFilePaths: ReadonlySet<string>, lookup?: CIncludeLookup): string | null;
+export declare function resolveCFamilyImport(targetRaw: string, fromFile: string, allFilePaths: ReadonlySet<string>, lookup: CIncludeLookup | undefined, suffixIndex: CIncludeSuffixIndex): string | null;