gitnexus 1.6.13-rc.73 → 1.6.13-rc.74

package/dist/mcp/local/aop-metadata.d.ts

@@ -72,6 +72,7 @@ export interface SpringAopMetadata {
  * shared decoder. Other DECLARES edges (for example Spring Bean factories)
  * and malformed/forward-version evidence are ignored. Query failures are
  * fail-soft because older or partially upgraded indexes must remain readable.
+ * Corrupt identities propagate to the context/impact integrity error boundary.
  */
 export declare function querySpringAopMetadata(lbugPath: string, symbolId: string, symbolType: string): Promise<SpringAopMetadata | undefined>;
 export {};

package/dist/mcp/local/aop-metadata.js

@@ -1,4 +1,5 @@
 import { executeParameterized } from '../../core/lbug/pool-adapter.js';
+import { assertSymbolIdentity, assertIdentityFields, rethrowSymbolIdentityError, } from './query-result-integrity.js';
 import { decodeSpringAopReason, } from '../../core/ingestion/frameworks/spring/aop.js';
 const SUPPORTED_SYMBOL_TYPES = new Set(['Class', 'Interface', 'Method', 'CodeElement']);
 const QUERY_RESULT_LIMIT = 1_000;
@@ -60,6 +61,7 @@ const DETERMINISTIC_RELATIONSHIP_ORDER = 'ORDER BY sourceId, targetId, reason, s
  * shared decoder. Other DECLARES edges (for example Spring Bean factories)
  * and malformed/forward-version evidence are ignored. Query failures are
  * fail-soft because older or partially upgraded indexes must remain readable.
+ * Corrupt identities propagate to the context/impact integrity error boundary.
  */
 export async function querySpringAopMetadata(lbugPath, symbolId, symbolType) {
     if (!SUPPORTED_SYMBOL_TYPES.has(symbolType))
@@ -91,6 +93,18 @@ export async function querySpringAopMetadata(lbugPath, symbolId, symbolType) {
            ${DETERMINISTIC_RELATIONSHIP_ORDER}
            LIMIT 1001`, { symbolId }),
         ]);
+        for (const rows of [
+            outgoingAdviceRows,
+            incomingAdviceRows,
+            outgoingPointcutRows,
+            incomingPointcutRows,
+        ]) {
+            for (const row of rows) {
+                assertSymbolIdentity(readRowValue(row, 'sourceId', 0));
+                assertSymbolIdentity(readRowValue(row, 'targetId', 3));
+                assertIdentityFields(readRowValue(row, 'sourceName', 1), readRowValue(row, 'sourceFilePath', 2), readRowValue(row, 'targetName', 4), readRowValue(row, 'targetFilePath', 5));
+            }
+        }
         const behaviors = [];
         const advices = [];
         const resolvedPointcuts = [];
@@ -221,7 +235,8 @@ export async function querySpringAopMetadata(lbugPath, symbolId, symbolType) {
             unresolvedPointcuts: dedupedPointcuts,
         };
     }
-    catch {
+    catch (error) {
+        rethrowSymbolIdentityError(error);
         return undefined;
     }
 }

package/dist/mcp/local/local-backend.d.ts

@@ -660,9 +660,10 @@ export declare class LocalBackend {
      * "unknown kind" and, worse, makes the `kind` disambiguation hint unable to
      * filter it out (#2687).
      *
-     * Failures are swallowed: label enrichment is an optimisation for
+     * Ordinary query failures are swallowed: label enrichment is an optimisation for
      * downstream scoring and #480 Class/Interface BFS seeding; if it fails
      * the symbol still resolves, just without the kind-priority bonus.
+     * Corrupt identities propagate to the context/impact error envelope.
      */
     private enrichCandidateLabels;
     /**

package/dist/mcp/local/local-backend.js

@@ -13,6 +13,7 @@ import { scoreImpactRisk, unusedAxesForImpactWalk, getLanguageFromFilename, } fr
 import { initLbug, executeQuery, executeParameterized, ensureVectorExtension, closeLbug, isLbugReady, statDbIdentity, dbIdentityChanged, } from '../../core/lbug/pool-adapter.js';
 import { queryClassBeanMetadata } from './bean-metadata.js';
 import { querySpringAopMetadata } from './aop-metadata.js';
+import { SYMBOL_IDENTITY_RECOVERY_SUGGESTION, SymbolIdentityError, assertSymbolIdentity, queryRowValue, assertIdentityFields, assertQueryIdentity, rethrowSymbolIdentityError, } from './query-result-integrity.js';
 import { queryConvexDispatchMetadata } from './convex-metadata.js';
 import { isValidQueryParams } from '../../core/lbug/query-params.js';
 import { toDisplayLine } from './line-display.js';
@@ -190,20 +191,69 @@ function resolveAliasString(canonical, legacy) {
 function nonBlankUid(value) {
     return typeof value === 'string' ? value.trim() || undefined : undefined;
 }
-const SYMBOL_IDENTITY_RECOVERY_SUGGESTION = 'Run gitnexus analyze --force from the affected repository root to rebuild the index.';
-class SymbolIdentityError extends Error {
-    constructor() {
-        super('The index returned an invalid symbol identity. ' + SYMBOL_IDENTITY_RECOVERY_SUGGESTION);
-        this.name = 'SymbolIdentityError';
+function assertSymbolRowIdentity(row) {
+    assertQueryIdentity(row, 'id', 0, [
+        ['name', 1],
+        ['type', 2],
+        ['filePath', 3],
+    ]);
+}
+function assertContextRefs(rows) {
+    for (const row of rows) {
+        assertQueryIdentity(row, 'uid', 1, [
+            ['name', 2],
+            ['filePath', 3],
+            ['kind', 4],
+        ]);
+        assertSymbolIdentity(queryRowValue(row, 'relType', 0));
     }
 }
-/** Validate database identities before using them as graph traversal anchors. */
-function assertSymbolIdentity(id, expectedUid) {
-    if (typeof id !== 'string' ||
-        !id.trim() ||
-        id.includes('\0') ||
-        (expectedUid !== undefined && id !== expectedUid)) {
-        throw new SymbolIdentityError();
+const RESPONSE_IDENTITY_FIELDS = new Set([
+    'id',
+    'uid',
+    'name',
+    'filePath',
+    'label',
+    'kind',
+    'type',
+    'relationType',
+    'processType',
+    'url',
+    'method',
+    'sourceId',
+    'targetId',
+    'symbolId',
+    'symbolName',
+    'symbolFilePath',
+    'adviceId',
+    'adviceName',
+    'adviceFilePath',
+    'advisedId',
+    'advisedName',
+    'advisedFilePath',
+    'evidenceId',
+]);
+/** Cover nested additive identity fields while leaving source/metadata text alone. */
+function assertResponseIdentities(value) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            assertResponseIdentities(item);
+    }
+    else if (value !== null && typeof value === 'object') {
+        for (const [key, field] of Object.entries(value)) {
+            if (key === 'seedBlocks' || key === 'reachableBlocks' || key === 'intraReachableBlocks') {
+                if (!Array.isArray(field))
+                    throw new SymbolIdentityError();
+                for (const id of field)
+                    assertSymbolIdentity(id);
+                continue;
+            }
+            if (RESPONSE_IDENTITY_FIELDS.has(key))
+                assertIdentityFields(field);
+            if (key !== 'content' && key !== 'methodMetadata' && key !== 'bean') {
+                assertResponseIdentities(field);
+            }
+        }
     }
 }
 const TOOL_STRING_ALIASES = {
@@ -3467,9 +3517,10 @@ export class LocalBackend {
      * "unknown kind" and, worse, makes the `kind` disambiguation hint unable to
      * filter it out (#2687).
      *
-     * Failures are swallowed: label enrichment is an optimisation for
+     * Ordinary query failures are swallowed: label enrichment is an optimisation for
      * downstream scoring and #480 Class/Interface BFS seeding; if it fails
      * the symbol still resolves, just without the kind-priority bonus.
+     * Corrupt identities propagate to the context/impact error envelope.
      */
     async enrichCandidateLabels(repo, candidates) {
         const ids = candidates.filter((c) => c.type === '' && c.id).map((c) => c.id);
@@ -3497,6 +3548,7 @@ export class LocalBackend {
         `, { ids });
             const labelById = new Map();
             for (const r of rows) {
+                assertQueryIdentity(r, 'id', 0, [['label', 1]]);
                 const id = (r.id ?? r[0]);
                 const label = (r.label ?? r[1]);
                 if (id && label && !labelById.has(id))
@@ -3507,7 +3559,8 @@ export class LocalBackend {
                     c.type = labelById.get(c.id);
             }
         }
-        catch {
+        catch (error) {
+            rethrowSymbolIdentityError(error);
             /* best-effort — downstream resolvers still work without the label */
         }
     }
@@ -3578,6 +3631,7 @@ export class LocalBackend {
             const rows = await executeParameterized(repo.lbugPath, `MATCH (n {id: $uid}) RETURN ${selectClause} LIMIT 1`, { uid });
             if (rows.length === 0)
                 return { kind: 'not_found' };
+            assertSymbolRowIdentity(rows[0]);
             const r = rows[0];
             const symbol = {
                 id: (r.id ?? r[0]),
@@ -3700,6 +3754,10 @@ export class LocalBackend {
         }
         if (rows.length === 0)
             return { kind: 'not_found' };
+        // Reject every raw candidate before narrowing/scoring can hide a corrupt row.
+        for (const row of rows) {
+            assertSymbolRowIdentity(row);
+        }
         // Normalise row shape across object / tuple returns from LadybugDB.
         let normalized = rows.map((r) => ({
             id: (r.id ?? r[0]),
@@ -3710,10 +3768,6 @@ export class LocalBackend {
             endLine: (r.endLine ?? r[5]),
             ...(include_content ? { content: (r.content ?? r[6]) } : {}),
         }));
-        // Reject the whole result before narrowing or scoring: dropping a corrupt
-        // candidate could make an unrelated surviving symbol look unambiguous.
-        for (const candidate of normalized)
-            assertSymbolIdentity(candidate.id);
         // An exact File path wins over anchored suffix candidates. Without this,
         // `lib/a.ts` and `src/lib/a.ts` both score as File candidates and turn an
         // otherwise unambiguous exact target into `ambiguous` (#3084 review P2).
@@ -3839,7 +3893,10 @@ export class LocalBackend {
      */
     async context(repo, params) {
         try {
-            return await this._contextImpl(repo, params);
+            const result = await this._contextImpl(repo, params);
+            if (!result.error)
+                assertResponseIdentities(result);
+            return result;
         }
         catch (err) {
             const msg = (err instanceof Error ? err.message : String(err)) || 'Context query failed';
@@ -3930,6 +3987,8 @@ export class LocalBackend {
       LIMIT 30
     `, { symId }),
         ]);
+        assertContextRefs(incomingRows);
+        assertContextRefs(incomingAdvisedRows);
         incomingRows.push(...incomingAdvisedRows);
         let typedPropertyRows = [];
         // Fix #480: Class/Interface nodes have no direct CALLS/IMPORTS edges —
@@ -4013,6 +4072,16 @@ export class LocalBackend {
                         genericArg: `<${sym.name}>`,
                     }),
                 ]);
+                assertContextRefs(ctorIncoming);
+                assertContextRefs(fileIncoming);
+                assertContextRefs(typedPropertyIncoming);
+                for (const row of typedProperties) {
+                    assertQueryIdentity(row, 'uid', 0, [
+                        ['name', 1],
+                        ['filePath', 2],
+                        ['kind', 3],
+                    ]);
+                }
                 typedPropertyRows = typedProperties;
                 // Deduplicate by (relType, uid) — a caller can have multiple relation
                 // types to the same target (e.g. both IMPORTS and CALLS), and each
@@ -4027,6 +4096,7 @@ export class LocalBackend {
                 }
             }
             catch (e) {
+                rethrowSymbolIdentityError(e);
                 logQueryError('context:class-incoming-expansion', e);
             }
         }
@@ -4048,6 +4118,8 @@ export class LocalBackend {
       LIMIT 30
     `, { symId }),
         ]);
+        assertContextRefs(outgoingRows);
+        assertContextRefs(outgoingAdvisedRows);
         outgoingRows.push(...outgoingAdvisedRows);
         // Process participation.
         //
@@ -4066,8 +4138,15 @@ export class LocalBackend {
         RETURN p.id AS pid, p.heuristicLabel AS label, MIN(r.step) AS step, p.stepCount AS stepCount, p.entryPointId AS entryPointId
         ORDER BY pid
       `, { symId });
+            for (const row of processRows) {
+                assertQueryIdentity(row, 'pid', 0, [
+                    ['label', 1],
+                    ['entryPointId', 4],
+                ]);
+            }
         }
         catch (e) {
+            rethrowSymbolIdentityError(e);
             logQueryError('context:process-participation', e);
         }
         // Route lookup — HTTP endpoints this symbol handles, plus entry-point
@@ -4099,6 +4178,7 @@ export class LocalBackend {
             // (GET/POST pair). URL-only dedup would drop the second endpoint.
             const seenRoutes = new Set();
             for (const r of routeRows) {
+                assertIdentityFields(queryRowValue(r, 'url', 0), queryRowValue(r, 'method', 1));
                 const url = r.url ?? r[0];
                 const method = r.method ?? r[1];
                 const dedupKey = routeEnrichmentKey(method ? String(method) : undefined, url);
@@ -4109,7 +4189,8 @@ export class LocalBackend {
             }
         }
         catch (e) {
-            // Best-effort enrichment — never fail the context call.
+            rethrowSymbolIdentityError(e);
+            // Ordinary query failures leave this best-effort enrichment unavailable.
             logQueryError('context:route-lookup', e);
         }
         // Helper to categorize refs
@@ -4151,6 +4232,7 @@ export class LocalBackend {
         const epistemicPromise = this.computeEpistemicBoundary(repo, symId, epistemicSymType, (sym.name || sym[1]));
         const beanMetadataPromise = queryClassBeanMetadata(repo.lbugPath, symId, epistemicSymType);
         const aopMetadataPromise = querySpringAopMetadata(repo.lbugPath, symId, epistemicSymType);
+        void aopMetadataPromise.catch(() => undefined);
         // R3-1. A `Property` whose name the analyzer declined to link — because
         // every definition of it lives in another language — otherwise returns an
         // incoming list byte-identical to a genuinely unread field. Those demand
@@ -4237,6 +4319,7 @@ export class LocalBackend {
                 chain = await this._computeContextChain(repo, symId, requestedDepth);
             }
             catch (e) {
+                rethrowSymbolIdentityError(e);
                 logQueryError('context:chain-bfs', e);
             }
         }
@@ -4276,8 +4359,8 @@ export class LocalBackend {
             processes: processRows.map((r) => ({
                 id: r.pid || r[0],
                 name: r.label || r[1],
-                step_index: r.step || r[2],
-                step_count: r.stepCount || r[3],
+                step_index: r.step ?? r[2],
+                step_count: r.stepCount ?? r[3],
             })),
         };
     }
@@ -4342,6 +4425,13 @@ export class LocalBackend {
                 });
                 if (rows.length === 0)
                     return { nextFrontier: [] };
+                for (const row of rows) {
+                    assertQueryIdentity(row, 'uid', 0, [
+                        ['name', 1],
+                        ['filePath', 2],
+                        ['kind', 3],
+                    ]);
+                }
                 // MATCH is one row per CALLS edge. Cypher `WITH DISTINCT` applies
                 // LIMIT 50 to unique neighbors; this second pass still collapses
                 // twins if a driver/engine ever returns duplicate rows.
@@ -4364,6 +4454,7 @@ export class LocalBackend {
                 return { nodes, nextFrontier: fresh.map((r) => r.uid) };
             }
             catch (e) {
+                rethrowSymbolIdentityError(e);
                 logQueryError(logLabel, e);
                 return { nextFrontier: [] };
             }
@@ -5778,7 +5869,10 @@ export class LocalBackend {
     }
     async impact(repo, params) {
         try {
-            return await this._impactImpl(repo, params);
+            const result = await this._impactImpl(repo, params);
+            if (!result.error)
+                assertResponseIdentities(result);
+            return result;
         }
         catch (err) {
             // Return structured error instead of crashing (#321)
@@ -6058,6 +6152,7 @@ export class LocalBackend {
                 catch (e) {
                     probeFailed = true;
                     candidateProbeFailed = true;
+                    rethrowSymbolIdentityError(e);
                     logQueryError('impact:ambiguous-candidate', e);
                 }
                 return {
@@ -6298,6 +6393,7 @@ export class LocalBackend {
                 return composeUnifiedPdgImpactResult(pdgResult, interproceduralResult);
             }
             catch (e) {
+                rethrowSymbolIdentityError(e);
                 logQueryError('impact:pdg-interprocedural-reach', e);
                 return composeUnifiedPdgImpactResult(pdgResult, null, e);
             }
@@ -6330,6 +6426,7 @@ export class LocalBackend {
         try {
             const rows = await executeParameterized(repo.lbugPath, `MATCH (b:BasicBlock) WHERE b.id IN $ids RETURN b.callees AS callees`, { ids: blockIds });
             for (const r of rows) {
+                assertIdentityFields(r.callees ?? r[0]);
                 const raw = String(r.callees ?? r[0] ?? '');
                 for (const n of raw.split(' '))
                     if (n)
@@ -6337,6 +6434,7 @@ export class LocalBackend {
             }
         }
         catch (e) {
+            rethrowSymbolIdentityError(e);
             logQueryError('impact:pdg-slice-callees', e);
         }
         return names;
@@ -6370,6 +6468,7 @@ export class LocalBackend {
             }
         }
         catch (e) {
+            rethrowSymbolIdentityError(e);
             logQueryError('impact:pdg-slice-callee-ids', e);
         }
         return ids;
@@ -6488,7 +6587,10 @@ export class LocalBackend {
        WHERE x.id = $symId AND r.type IN $heritage
        RETURN DISTINCT iface.id AS id, iface.name AS name, labels(iface)[0] AS label
        ORDER BY id
-       LIMIT 25`, { symId, heritage: HERITAGE_TYPES }).catch(() => []);
+       LIMIT 25`, { symId, heritage: HERITAGE_TYPES }).catch((error) => {
+            rethrowSymbolIdentityError(error);
+            return [];
+        });
         const undecidedSummary = meta?.undecidedInterfaceSatisfaction;
         const undecidedDrops = undecidedSummary === undefined
             ? { notes: [], undecided: 0 }
@@ -6526,6 +6628,10 @@ export class LocalBackend {
             }
             const ifaceRows = await interfaceRowsPromise;
             for (const r of ifaceRows) {
+                assertQueryIdentity(r, 'id', 0, [
+                    ['name', 1],
+                    ['label', 2],
+                ]);
                 const id = (r.id ?? r[0]);
                 if (id && !boundary.has(id)) {
                     boundary.set(id, {
@@ -6546,7 +6652,10 @@ export class LocalBackend {
                 await Promise.all(ifaceIds.map(async (ifaceId) => {
                     const rows = await executeParameterized(repo.lbugPath, `MATCH (other)-[r:CodeRelation]->(iface)
                WHERE iface.id = $ifaceId AND r.type IN $types
-               RETURN COUNT(DISTINCT other.id) AS cnt`, { ifaceId, types }).catch(() => []);
+               RETURN COUNT(DISTINCT other.id) AS cnt`, { ifaceId, types }).catch((error) => {
+                        rethrowSymbolIdentityError(error);
+                        return [];
+                    });
                     const cnt = rows.length > 0 ? Number(rows[0].cnt ?? rows[0][0] ?? 0) : 0;
                     m.set(ifaceId, cnt);
                 }));
@@ -6600,7 +6709,8 @@ export class LocalBackend {
                 },
             };
         }
-        catch {
+        catch (error) {
+            rethrowSymbolIdentityError(error);
             // Never let the heritage probe's failure suppress a drop we already know
             // about — the whole point is that silence must not read as certainty.
             return epistemicFrom(droppedBoundaries);
@@ -6648,6 +6758,7 @@ export class LocalBackend {
         if (!symId) {
             throw new Error(`Impact target '${sym.name || sym[1] || '?'}' resolved without a node id; refusing to report a blast radius`);
         }
+        assertSymbolRowIdentity(sym);
         // #1858 — kick off the epistemic boundary probe concurrently with the BFS.
         // It depends only on symId/symType/symName (all known now) and touches no
         // shared state, so its extra round-trip overlaps the traversal instead of
@@ -6670,6 +6781,7 @@ export class LocalBackend {
         const aopMetadataPromise = opts.skipEpistemic || summaryOnly
             ? Promise.resolve(undefined)
             : querySpringAopMetadata(repo.lbugPath, symId, symType);
+        void aopMetadataPromise.catch(() => undefined);
         const impacted = [];
         const visited = new Set([symId]);
         const pdgBridgeEvidenceById = new Map();
@@ -6704,6 +6816,7 @@ export class LocalBackend {
           `, { symId }),
                 ]);
                 for (const r of ctorRows) {
+                    assertSymbolRowIdentity(r);
                     const rid = r.id || r[0];
                     if (rid && !visited.has(rid)) {
                         visited.add(rid);
@@ -6711,6 +6824,7 @@ export class LocalBackend {
                     }
                 }
                 for (const r of fileRows) {
+                    assertSymbolRowIdentity(r);
                     const rid = r.id || r[0];
                     if (rid && !visited.has(rid)) {
                         visited.add(rid);
@@ -6729,6 +6843,7 @@ export class LocalBackend {
                     genericArg: `<${sym.name}>`,
                 });
                 for (const r of typedPropertyRows) {
+                    assertSymbolRowIdentity(r);
                     const rid = r.id || r[0];
                     if (rid && !visited.has(rid)) {
                         visited.add(rid);
@@ -6737,6 +6852,7 @@ export class LocalBackend {
                 }
             }
             catch (e) {
+                rethrowSymbolIdentityError(e);
                 logQueryError('impact:class-node-expansion', e);
                 traversalComplete = false;
             }
@@ -6767,6 +6883,9 @@ export class LocalBackend {
           ORDER BY id
           LIMIT ${OBJECT_CALLABLE_MEMBER_CAP + 1}
         `, { symId });
+                for (const row of memberRows) {
+                    assertSymbolRowIdentity(row);
+                }
                 memberRows.sort((a, b) => compareCodeUnits(String(a.id ?? a[0]), String(b.id ?? b[0])));
                 if (memberRows.length > OBJECT_CALLABLE_MEMBER_CAP)
                     traversalComplete = false;
@@ -6788,6 +6907,7 @@ export class LocalBackend {
                 }
             }
             catch (e) {
+                rethrowSymbolIdentityError(e);
                 logQueryError('impact:object-callable-expansion', e);
                 traversalComplete = false;
             }
@@ -6840,6 +6960,17 @@ export class LocalBackend {
                     relTypes: relationTypes,
                     ...(safeMinConfidence > 0 ? { minConfidence: safeMinConfidence } : {}),
                 });
+                // Validate before filtering/deduplication; a discarded corrupt edge is
+                // still evidence that this result's counts cannot be trusted.
+                for (const row of related) {
+                    assertQueryIdentity(row, 'id', 1, [
+                        ['sourceId', 0],
+                        ['name', 2],
+                        ['type', 3],
+                        ['filePath', 4],
+                    ]);
+                    assertSymbolIdentity(queryRowValue(row, 'relType', 5));
+                }
                 const edges = related.map((rel) => ({
                     id: rel.id || rel[1],
                     name: rel.name || rel[2],
@@ -6931,6 +7062,7 @@ export class LocalBackend {
                 }
             }
             catch (e) {
+                rethrowSymbolIdentityError(e);
                 logQueryError('impact:depth-traversal', e);
                 // Break out of depth loop on query failure but return partial results
                 // collected so far, rather than silently swallowing the error (#321)
@@ -7031,12 +7163,21 @@ export class LocalBackend {
                    ep.name AS epName, labels(ep)[0] AS epType, ep.filePath AS epFilePath
             ORDER BY pId
           `, { ids }).catch((err) => {
+                        rethrowSymbolIdentityError(err);
                         processQueryFailed = true;
                         enrichmentDegraded = true;
                         logQueryError('impact:process-chunk', err);
                         return [];
                     });
                     for (const row of rows) {
+                        assertQueryIdentity(row, 'pId', 0, [
+                            ['name', 1],
+                            ['processType', 2],
+                            ['entryPointId', 3],
+                            ['epName', 7],
+                            ['epType', 8],
+                            ['epFilePath', 9],
+                        ]);
                         const pId = row.pId ?? row[0];
                         const epId = row.entryPointId ?? row[3] ?? row.pId ?? row[0];
                         // Track mapping from process -> entryPoint so we can backfill missing minStep
@@ -7083,6 +7224,7 @@ export class LocalBackend {
                     }
                 }
                 catch (e) {
+                    rethrowSymbolIdentityError(e);
                     processQueryFailed = true;
                     enrichmentDegraded = true;
                     logQueryError('impact:process-chunk', e);
@@ -7100,11 +7242,13 @@ export class LocalBackend {
             WHERE p.id IN $pIds AND s.id IN $ids
             RETURN p.id AS pid, MIN(r.step) AS minStep
           `, { pIds, ids: allImpactedIds }).catch((err) => {
+                        rethrowSymbolIdentityError(err);
                         enrichmentDegraded = true;
                         logQueryError('impact:process-chunk-backfill', err);
                         return [];
                     });
                     for (const mr of missingRows) {
+                        assertQueryIdentity(mr, 'pid', 0, []);
                         const pid = mr.pid ?? mr[0];
                         const minStep = mr.minStep ?? mr[1];
                         const epId = processToEntryPoint.get(String(pid));
@@ -7119,6 +7263,7 @@ export class LocalBackend {
                     }
                 }
                 catch (e) {
+                    rethrowSymbolIdentityError(e);
                     enrichmentDegraded = true;
                     logQueryError('impact:process-chunk-backfill', e);
                 }
@@ -7168,12 +7313,14 @@ export class LocalBackend {
             ORDER BY hits DESC, name
             LIMIT 20
           `, { ids: idsChunk }).catch((err) => {
+                        rethrowSymbolIdentityError(err);
                         moduleQueryFailed = true;
                         enrichmentDegraded = true;
                         logQueryError('impact:module-chunk', err);
                         return [];
                     });
                     for (const r of rows) {
+                        assertIdentityFields(queryRowValue(r, 'name', 0));
                         const name = r.name ?? r[0] ?? null;
                         const hits = (r.hits ?? r[1]) || 0;
                         if (!name)
@@ -7182,6 +7329,7 @@ export class LocalBackend {
                     }
                 }
                 catch (e) {
+                    rethrowSymbolIdentityError(e);
                     moduleQueryFailed = true;
                     enrichmentDegraded = true;
                     logQueryError('impact:module-chunk', e);
@@ -7205,18 +7353,21 @@ export class LocalBackend {
             WHERE s.id IN $ids
             RETURN DISTINCT c.heuristicLabel AS name
           `, { ids: idsChunk }).catch((err) => {
+                        rethrowSymbolIdentityError(err);
                         enrichmentDegraded = true;
                         moduleClassificationFailed = true;
                         logQueryError('impact:direct-module-chunk', err);
                         return [];
                     });
                     for (const r of rows) {
+                        assertIdentityFields(queryRowValue(r, 'name', 0));
                         const name = r.name ?? r[0] ?? null;
                         if (name)
                             directModuleSet.add(name);
                     }
                 }
                 catch (e) {
+                    rethrowSymbolIdentityError(e);
                     enrichmentDegraded = true;
                     moduleClassificationFailed = true;
                     logQueryError('impact:direct-module-chunk', e);
@@ -7269,11 +7420,14 @@ export class LocalBackend {
           RETURN h.id AS hid, route.name AS url, route.method AS method
           ORDER BY url, method
         `, { ids: chunkIds }).catch((err) => {
+                    rethrowSymbolIdentityError(err);
                     enrichmentDegraded = true;
                     logQueryError('impact:route-chunk', err);
                     return [];
                 });
                 for (const row of rows) {
+                    assertSymbolIdentity(queryRowValue(row, 'hid', 0));
+                    assertIdentityFields(queryRowValue(row, 'url', 1), queryRowValue(row, 'method', 2));
                     const hid = String(row.hid ?? row[0] ?? '');
                     const url = row.url ?? row[1];
                     if (!hid || typeof url !== 'string')
@@ -7421,8 +7575,16 @@ export class LocalBackend {
             WHERE s.id IN $ids
             RETURN s.id AS sid, p.id AS pid, p.heuristicLabel AS pName,
                    p.processType AS pType, MIN(r.step) AS step
-          `, { ids: chunkIds }).catch(() => []);
+          `, { ids: chunkIds }).catch((err) => {
+                        rethrowSymbolIdentityError(err);
+                        return [];
+                    });
                     for (const row of rows) {
+                        assertQueryIdentity(row, 'sid', 0, []);
+                        assertQueryIdentity(row, 'pid', 1, [
+                            ['pName', 2],
+                            ['pType', 3],
+                        ]);
                         const sid = row.sid ?? row[0];
                         if (!sid)
                             continue;
@@ -7440,6 +7602,7 @@ export class LocalBackend {
                     }
                 }
                 catch (e) {
+                    rethrowSymbolIdentityError(e);
                     logQueryError('impact:per-symbol-process-chunk', e);
                 }
             }

package/dist/mcp/local/pdg-impact.js

@@ -22,6 +22,7 @@ import { toDisplayLine } from './line-display.js';
 import { toOneBasedLine } from '../../core/ingestion/utils/line-base.js';
 import { decodeCallSummary } from '../../core/ingestion/taint/call-summary-codec.js';
 import { decodeReachingDefReason } from '../../core/ingestion/cfg/reaching-def-reason-codec.js';
+import { assertSymbolIdentity, assertIdentityFields, assertQueryIdentity, } from './query-result-integrity.js';
 /**
  * Parse the `<fnLine>` segment out of a `BasicBlock` id (1-based function start
  * line). The id template is
@@ -81,16 +82,21 @@ const INTERPROC_NODE_BUDGET = 5000;
  * `classifyPdgBridgeEvidence`); this is the same fact, read at the descent side.
  */
 function parseCalleeIdsCell(raw) {
+    assertIdentityFields(raw);
     const ids = [];
     let truncated = false;
+    if (!String(raw ?? '').trim())
+        return { ids, truncated };
     // Split on the SHARED CALLEE_ID_SEP (tab) — ids embed file paths / multi-word
     // C++ type tokens that can contain a space, so a space split would fragment
     // them. Producer (calleeIdsOfBlock) joins with the same constant.
     for (const id of String(raw ?? '').split(CALLEE_ID_SEP)) {
         if (id === CALLEES_TRUNCATED_SENTINEL)
             truncated = true;
-        else if (id)
+        else {
+            assertSymbolIdentity(id);
             ids.push(id);
+        }
     }
     return { ids, truncated };
 }
@@ -179,6 +185,7 @@ async function selfReachingDefEdgesByBlock(lbugPath, blockIds, exec) {
        WHERE r.type = 'REACHING_DEF' AND a.id IN $ids
        RETURN a.id AS id, r.reason AS reason`, { ids: blockIds });
     for (const r of rows) {
+        assertQueryIdentity(r, 'id', 0);
         const id = String(r['id'] ?? '');
         if (!id)
             continue;
@@ -251,6 +258,7 @@ chainWalkBlocks = new Map()) {
     // Narrow the awaited rows ONCE at the boundary to a typed record shape; read
     // the aliased cells via bracket access with String()/Number() coercion.
     for (const r of rows) {
+        assertQueryIdentity(r, 'id', 0);
         const id = String(r['id'] ?? '');
         const line = Number(r['line'] ?? 0);
         if (!id || !Number.isFinite(line) || line <= 0)
@@ -416,6 +424,10 @@ async function projectBlocksToSymbols(deps) {
         // non-aliased row shape) — no per-field `as any`, matching the typed-row
         // pattern used elsewhere in this file (e.g. lines ~264, ~1309, ~1386).
         for (const r of rows) {
+            assertQueryIdentity(r, 'id', 0, [
+                ['name', 1],
+                ['label', 2],
+            ]);
             resolved.push({
                 id: String(r['id'] ?? r['0'] ?? ''),
                 name: String(r['name'] ?? r['1'] ?? ''),
@@ -1078,6 +1090,8 @@ async function bfsReachableBlocks(input) {
         // Narrow the awaited rows ONCE at the boundary (executeParameterized returns
         // any[]) to a typed record shape, then read the aliased `id` via bracket
         // access — no `as any` sprayed per field.
+        for (const row of rawRows)
+            assertQueryIdentity(row, 'id', 0);
         const rows = rawRows.slice(0, stepLimit);
         depthReached = depth + 1;
         if (rawRows.length > stepLimit)
@@ -1134,6 +1148,10 @@ async function calleeIdsByBlock(lbugPath, blockIds, exec) {
     // Narrow the awaited rows ONCE at the boundary to a typed record shape; read
     // the aliased cells via bracket access — no per-field `as any`.
     for (const r of rows) {
+        assertQueryIdentity(r, 'id', 0, [
+            ['calleeIds', 1],
+            ['callees', 2],
+        ]);
         const blockId = String(r['id'] ?? '');
         if (!blockId)
             continue;
@@ -1184,6 +1202,7 @@ async function calleesWithReturnFlow(lbugPath, calleeIds, exec) {
        WHERE r.type = 'CALL_SUMMARY' AND c.id IN $ids
        RETURN c.id AS id, r.reason AS reason`, { ids: calleeIds });
     for (const r of rows) {
+        assertQueryIdentity(r, 'id', 0);
         const id = String(r['id'] ?? '');
         if (!id)
             continue;
@@ -1232,6 +1251,7 @@ async function resolveCalleeSpans(lbugPath, calleeIds, exec) {
     // the aliased columns via bracket access with Number()/String() coercion —
     // no per-field `as any` (the same boundary-narrowing the typed helpers use).
     for (const r of rows) {
+        assertQueryIdentity(r, 'id', 0, [['filePath', 1]]);
         const id = String(r['id'] ?? '');
         const filePath = String(r['filePath'] ?? '');
         const startLine = Number(r['startLine']);
@@ -1408,6 +1428,8 @@ async function interproceduralDescent(input) {
         const spanSeeds = await Promise.all(spans.map(async (span) => {
             const { anchorClause, queryParams } = blockAnchorForResolvedSymbol(span);
             const rawSeedRows = await exec(lbugPath, seedBlockQuery(anchorClause, probeLimit), queryParams);
+            for (const row of rawSeedRows)
+                assertQueryIdentity(row, 'id', 0);
             const exceeded = rawSeedRows.length > stepLimit;
             const seeds = rawSeedRows
                 .slice(0, stepLimit)
@@ -1559,6 +1581,8 @@ export async function runImpactPDG(deps) {
         : blockAnchorForResolvedSymbol(sym);
     const probeLimit = stepLimit + 1;
     const rawSeedRows = await exec(repo.lbugPath, seedBlockQuery(anchorClause, probeLimit), queryParams);
+    for (const row of rawSeedRows)
+        assertQueryIdentity(row, 'id', 0);
     const seedRows = rawSeedRows.slice(0, stepLimit);
     let seedBlocks = seedRows
         .map((r) => String(r['id'] ?? ''))

package/dist/mcp/local/query-result-integrity.d.ts

@@ -0,0 +1,14 @@
+/** Shared integrity boundary for identities returned by impact/context queries. */
+export declare const SYMBOL_IDENTITY_RECOVERY_SUGGESTION = "Run gitnexus analyze --force from the affected repository root to rebuild the index.";
+export declare class SymbolIdentityError extends Error {
+    constructor();
+}
+/** Validate database identities before using them as graph traversal anchors. */
+export declare function assertSymbolIdentity(id: unknown, expectedUid?: string): asserts id is string;
+/** Read either native row shape without turning an absent row into a TypeError. */
+export declare function queryRowValue(row: unknown, key: string, index: number): unknown;
+/** Optional labels/paths may be empty or NULL; NUL is never a usable identity. */
+export declare function assertIdentityFields(...values: unknown[]): void;
+export declare function assertQueryIdentity(row: unknown, idKey: string, idIndex: number, fields?: ReadonlyArray<readonly [string, number]>): void;
+/** Ordinary query failures may degrade; corrupt identities must reach the outer error envelope. */
+export declare function rethrowSymbolIdentityError(error: unknown): void;

package/dist/mcp/local/query-result-integrity.js

@@ -0,0 +1,44 @@
+/** Shared integrity boundary for identities returned by impact/context queries. */
+export const SYMBOL_IDENTITY_RECOVERY_SUGGESTION = 'Run gitnexus analyze --force from the affected repository root to rebuild the index.';
+export class SymbolIdentityError extends Error {
+    constructor() {
+        super('The index returned an invalid symbol identity. ' + SYMBOL_IDENTITY_RECOVERY_SUGGESTION);
+        this.name = 'SymbolIdentityError';
+    }
+}
+/** Validate database identities before using them as graph traversal anchors. */
+export function assertSymbolIdentity(id, expectedUid) {
+    if (typeof id !== 'string' ||
+        !id.trim() ||
+        id.includes('\0') ||
+        (expectedUid !== undefined && id !== expectedUid)) {
+        throw new SymbolIdentityError();
+    }
+}
+/** Read either native row shape without turning an absent row into a TypeError. */
+export function queryRowValue(row, key, index) {
+    if (typeof row !== 'object' || row === null)
+        return undefined;
+    const value = row;
+    return value[key] ?? value[index];
+}
+/** Optional labels/paths may be empty or NULL; NUL is never a usable identity. */
+export function assertIdentityFields(...values) {
+    for (const value of values) {
+        if (value !== null &&
+            value !== undefined &&
+            (typeof value !== 'string' || value.includes('\0'))) {
+            throw new SymbolIdentityError();
+        }
+    }
+}
+export function assertQueryIdentity(row, idKey, idIndex, fields = []) {
+    assertSymbolIdentity(queryRowValue(row, idKey, idIndex));
+    for (const [key, index] of fields)
+        assertIdentityFields(queryRowValue(row, key, index));
+}
+/** Ordinary query failures may degrade; corrupt identities must reach the outer error envelope. */
+export function rethrowSymbolIdentityError(error) {
+    if (error instanceof SymbolIdentityError)
+        throw error;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.13-rc.73",
+  "version": "1.6.13-rc.74",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",