gitnexus 1.6.13-rc.63 → 1.6.13-rc.64

package/dist/mcp/local/local-backend.js

@@ -190,6 +190,22 @@ function resolveAliasString(canonical, legacy) {
 function nonBlankUid(value) {
     return typeof value === 'string' ? value.trim() || undefined : undefined;
 }
+const SYMBOL_IDENTITY_RECOVERY_SUGGESTION = 'Run gitnexus analyze --force from the affected repository root to rebuild the index.';
+class SymbolIdentityError extends Error {
+    constructor() {
+        super('The index returned an invalid symbol identity. ' + SYMBOL_IDENTITY_RECOVERY_SUGGESTION);
+        this.name = 'SymbolIdentityError';
+    }
+}
+/** Validate database identities before using them as graph traversal anchors. */
+function assertSymbolIdentity(id, expectedUid) {
+    if (typeof id !== 'string' ||
+        !id.trim() ||
+        id.includes('\0') ||
+        (expectedUid !== undefined && id !== expectedUid)) {
+        throw new SymbolIdentityError();
+    }
+}
 const TOOL_STRING_ALIASES = {
     impact: [{ canonical: 'target', aliases: ['name', 'symbol'] }],
     context: [{ canonical: 'file_path', aliases: ['file'] }],
@@ -3562,6 +3578,7 @@ export class LocalBackend {
                 endLine: (r.endLine ?? r[5]),
                 ...(include_content ? { content: (r.content ?? r[6]) } : {}),
             };
+            assertSymbolIdentity(symbol.id, uid);
             // Same LadybugDB label-enrichment as the name-based path: a UID
             // pointing at a Class must still surface `type: 'Class'` so impact's
             // Class/Interface BFS seed fires. No-op when type is already set.
@@ -3683,6 +3700,10 @@ export class LocalBackend {
             endLine: (r.endLine ?? r[5]),
             ...(include_content ? { content: (r.content ?? r[6]) } : {}),
         }));
+        // Reject the whole result before narrowing or scoring: dropping a corrupt
+        // candidate could make an unrelated surviving symbol look unambiguous.
+        for (const candidate of normalized)
+            assertSymbolIdentity(candidate.id);
         // An exact File path wins over anchored suffix candidates. Without this,
         // `lib/a.ts` and `src/lib/a.ts` both score as File candidates and turn an
         // otherwise unambiguous exact target into `ambiguous` (#3084 review P2).
@@ -3812,6 +3833,9 @@ export class LocalBackend {
         }
         catch (err) {
             const msg = (err instanceof Error ? err.message : String(err)) || 'Context query failed';
+            if (err instanceof SymbolIdentityError) {
+                return { error: msg, recoverySuggestion: SYMBOL_IDENTITY_RECOVERY_SUGGESTION };
+            }
             if (isWalCorruptionError(err)) {
                 return {
                     error: msg,
@@ -5749,8 +5773,14 @@ export class LocalBackend {
         catch (err) {
             // Return structured error instead of crashing (#321)
             const message = (err instanceof Error ? err.message : String(err)) || 'Impact analysis failed';
-            const suggestion = 'The graph query failed — try gitnexus context <symbol> as a fallback';
-            const recoverySuggestion = isWalCorruptionError(err) ? WAL_RECOVERY_SUGGESTION : undefined;
+            const recoverySuggestion = err instanceof SymbolIdentityError
+                ? SYMBOL_IDENTITY_RECOVERY_SUGGESTION
+                : isWalCorruptionError(err)
+                    ? WAL_RECOVERY_SUGGESTION
+                    : undefined;
+            const suggestion = err instanceof SymbolIdentityError
+                ? SYMBOL_IDENTITY_RECOVERY_SUGGESTION
+                : 'The graph query failed — try gitnexus context <symbol> as a fallback';
             if (params.mode === 'pdg') {
                 // Symbol resolution never reached the catch with a resolved symbol (the
                 // throw can originate before/within resolution), so the envelope carries
@@ -7496,6 +7526,7 @@ export class LocalBackend {
                 'METHOD_IMPLEMENTS',
             ];
         try {
+            assertSymbolIdentity(sym.id ?? sym[0], uid);
             // skipPerSymbolEnrichment suppresses ONLY the per-symbol STEP_IN_PROCESS
             // enrichment pass while preserving byDepth. Group-mode cross-repo fan-out
             // may fan across many repos; the per-symbol pass adds up to MAX_CHUNKS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.13-rc.63",
+  "version": "1.6.13-rc.64",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",