gitnexus 1.6.13-rc.91 → 1.6.13-rc.92

package/dist/core/ingestion/call-processor.d.ts

@@ -91,12 +91,12 @@ export declare const processRoutesFromExtracted: (graph: KnowledgeGraph, extract
  *     `handlerName` (the decorated method, captured at extraction); resolve it
  *     directly in the route's own file.
  *
- * First-writer-wins per route identity, matching the routes phase's dedup (it
- * keeps the first route registered for a `(method, url)` key and counts the rest
- * as duplicates). The first route to claim a key reserves it **even when its
- * handler is unresolvable**, so a later same-key route can never stamp its
- * handler onto the first route's Route node (the routes phase made that first
- * route the node-winner). Keying is `routeNodeKey(method, url)` (#2289): a
+ * Production declarations take precedence over test declarations; equal-priority
+ * candidates remain first-writer-wins. The selected declaration reserves its key **even when its
+ * handler is unresolvable**, so a losing route can never donate its handler.
+ * When supplied, `selectedRoutes` receives the admitted winners for the routes
+ * phase, keeping node provenance and handler provenance identical.
+ * Keying is `routeNodeKey(method, url)` (#2289): a
  * same-URL multi-verb pair (`GET /x` + `POST /x`) resolves two handlers, one per
  * node; method-less / wildcard routes key by URL alone, byte-identical to the
  * pre-#2289 behavior. Routes whose handler cannot be *uniquely* resolved (no
@@ -104,7 +104,7 @@ export declare const processRoutesFromExtracted: (graph: KnowledgeGraph, extract
  * `handlerSymbolId`; the extractor then falls back to source scan for that route
  * (fail-open, no regression, never a wrong handler).
  */
-export declare function resolveRouteHandlerSymbols(model: SemanticModel, extractedRoutes: readonly ExtractedRoute[], decoratorRoutes: readonly ExtractedDecoratorRoute[], routeContext?: RouteHandlerResolutionContext): Map<string, string>;
+export declare function resolveRouteHandlerSymbols(model: SemanticModel, extractedRoutes: readonly ExtractedRoute[], decoratorRoutes: readonly ExtractedDecoratorRoute[], routeContext?: RouteHandlerResolutionContext, selectedRoutes?: Set<ExtractedRoute | ExtractedDecoratorRoute>): Map<string, string>;
 /**
  * Extract property access keys from a consumer file's source code near fetch calls.
  *

package/dist/core/ingestion/call-processor.js

@@ -17,9 +17,10 @@
 import { generateId } from '../../lib/utils.js';
 import { yieldToEventLoop } from './utils/event-loop.js';
 import { normalizeFetchURL, routeMatches } from './route-extractors/nextjs.js';
-import { normalizeExtractedRoutePath, normalizeRouteMethod, routeNodeKey, } from './route-extractors/route-path.js';
+import { isTestRouteFile, normalizeExtractedRoutePath, normalizeRouteMethod, routeNodeKey, } from './route-extractors/route-path.js';
 import { extractReturnTypeName } from './type-extractors/shared.js';
 import { DATA_ROUTE_TABLE_SOURCE } from './route-extractors/data-route-table.js';
+import { reconcileDispatchGuardRoutes } from './route-extractors/dispatch-guard.js';
 import { toZeroBasedLine } from './utils/line-base.js';
 const MAX_EXPORTS_PER_FILE = 500;
 const MAX_TYPE_NAME_LENGTH = 256;
@@ -292,12 +293,12 @@ export const processRoutesFromExtracted = async (graph, extractedRoutes, model,
  *     `handlerName` (the decorated method, captured at extraction); resolve it
  *     directly in the route's own file.
  *
- * First-writer-wins per route identity, matching the routes phase's dedup (it
- * keeps the first route registered for a `(method, url)` key and counts the rest
- * as duplicates). The first route to claim a key reserves it **even when its
- * handler is unresolvable**, so a later same-key route can never stamp its
- * handler onto the first route's Route node (the routes phase made that first
- * route the node-winner). Keying is `routeNodeKey(method, url)` (#2289): a
+ * Production declarations take precedence over test declarations; equal-priority
+ * candidates remain first-writer-wins. The selected declaration reserves its key **even when its
+ * handler is unresolvable**, so a losing route can never donate its handler.
+ * When supplied, `selectedRoutes` receives the admitted winners for the routes
+ * phase, keeping node provenance and handler provenance identical.
+ * Keying is `routeNodeKey(method, url)` (#2289): a
  * same-URL multi-verb pair (`GET /x` + `POST /x`) resolves two handlers, one per
  * node; method-less / wildcard routes key by URL alone, byte-identical to the
  * pre-#2289 behavior. Routes whose handler cannot be *uniquely* resolved (no
@@ -305,12 +306,10 @@ export const processRoutesFromExtracted = async (graph, extractedRoutes, model,
  * `handlerSymbolId`; the extractor then falls back to source scan for that route
  * (fail-open, no regression, never a wrong handler).
  */
-export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRoutes, routeContext) {
+export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRoutes, routeContext, selectedRoutes) {
     const out = new Map();
-    // Route identities already claimed by an earlier route (resolved or not).
-    // Mirrors the routes phase `addRoute` first-writer-wins so the handler we
-    // stamp always belongs to the route that actually won the Route node.
-    const claimed = new Set();
+    const claimed = new Map();
+    const admittedDecoratorRoutes = reconcileDispatchGuardRoutes(decoratorRoutes);
     // Resolve a single same-file symbol by name. Exactly one match → its nodeId.
     // Zero or many matches → undefined (fail-open). tRPC same-name handlers
     // use pickSameFileHandler at the controller-less call site instead.
@@ -386,21 +385,29 @@ export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRout
             ? undefined
             : uniqueById(model.methods.lookupAllByOwner(owner.nodeId, member))?.nodeId;
     };
-    const claim = (routePath, prefix, httpMethod, symbolId) => {
+    const claim = (route, symbolId) => {
         // An empty path is a valid, pathless mapping and normalizes to either `/`
         // or its class/router prefix. Only null means the extractor had no route.
-        if (routePath === null)
+        if (route.routePath === null)
             return;
-        const url = normalizeExtractedRoutePath(routePath, prefix);
-        const key = routeNodeKey(normalizeRouteMethod(httpMethod), url);
-        if (claimed.has(key))
-            return; // first-writer-wins: later same-key routes can't override
-        claimed.add(key);
+        const url = normalizeExtractedRoutePath(route.routePath, route.prefix ?? null);
+        const key = routeNodeKey(normalizeRouteMethod(route.httpMethod), url);
+        const previous = claimed.get(key);
+        if (previous && (!isTestRouteFile(previous.filePath) || isTestRouteFile(route.filePath)))
+            return;
+        if (previous)
+            selectedRoutes?.delete(previous);
+        claimed.set(key, route);
+        selectedRoutes?.add(route);
+        out.delete(key);
         if (symbolId)
             out.set(key, symbolId);
     };
     // Laravel framework routes — controller class + method name.
     for (const route of extractedRoutes) {
+        // Match the routes phase's admission rule for extracted declarations.
+        if (!route.routePath)
+            continue;
         let methodId;
         if (route.controllerName && route.methodName) {
             let controllerDef;
@@ -418,16 +425,21 @@ export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRout
         else if (!route.controllerName && route.methodName) {
             methodId = pickSameFileHandler(model.symbols.lookupExactAll(route.filePath, route.methodName), route, routeContext?.nodeStartLine)?.nodeId;
         }
-        claim(route.routePath, route.prefix ?? null, route.httpMethod, methodId);
+        claim(route, methodId);
     }
     const dataHandlerByRoute = new Map();
     const dataHandlersByIdentity = new Map();
-    for (const dr of decoratorRoutes) {
+    const dataIdentity = (dr) => {
+        const url = normalizeExtractedRoutePath(dr.routePath, dr.prefix ?? null);
+        return `${Number(isTestRouteFile(dr.filePath))}:${routeNodeKey(normalizeRouteMethod(dr.httpMethod), url)}`;
+    };
+    for (const dr of admittedDecoratorRoutes) {
         if (dr.source !== DATA_ROUTE_TABLE_SOURCE || !dr.handlerName || !dr.routePath)
             continue;
         const handlerId = resolveDataRouteHandler(dr.filePath, dr.handlerName);
-        const url = normalizeExtractedRoutePath(dr.routePath, dr.prefix ?? null);
-        const key = routeNodeKey(normalizeRouteMethod(dr.httpMethod), url);
+        // Conflicting test handlers must not invalidate a production table.
+        // Ambiguity is still rejected within each priority tier.
+        const key = dataIdentity(dr);
         const state = dataHandlersByIdentity.get(key) ?? {
             handlers: new Set(),
             hasUnresolved: false,
@@ -463,20 +475,18 @@ export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRout
     // handlers. Data tables additionally suppress an identity when duplicate
     // entries resolve to different handlers: recording either one would invent a
     // single-winner dispatch that the loop does not prove.
-    for (const dr of decoratorRoutes) {
+    for (const dr of admittedDecoratorRoutes) {
         const handlerId = decoratorHandlerId(dr);
         // An unproven data-table entry never becomes a Route node, so it must not
         // reserve the identity and suppress a later, valid framework declaration.
         if (dr.source === DATA_ROUTE_TABLE_SOURCE && handlerId === undefined)
             continue;
         if (dr.source === DATA_ROUTE_TABLE_SOURCE && dr.routePath) {
-            const url = normalizeExtractedRoutePath(dr.routePath, dr.prefix ?? null);
-            const key = routeNodeKey(normalizeRouteMethod(dr.httpMethod), url);
-            const state = dataHandlersByIdentity.get(key);
+            const state = dataHandlersByIdentity.get(dataIdentity(dr));
             if (state === undefined || state.hasUnresolved || state.handlers.size !== 1)
                 continue;
         }
-        claim(dr.routePath, dr.prefix ?? null, dr.httpMethod, handlerId);
+        claim(dr, handlerId);
     }
     return out;
 }

package/dist/core/ingestion/pipeline-phases/parse-impl.d.ts

@@ -68,6 +68,7 @@ export declare function runChunkedParseAndResolve(graph: KnowledgeGraph, scanned
     allFetchWrapperDefs: FetchWrapperDef[];
     allExtractedRoutes: ExtractedRoute[];
     allDecoratorRoutes: ExtractedDecoratorRoute[];
+    selectedRoutes: ReadonlySet<ExtractedRoute | ExtractedDecoratorRoute>;
     allToolDefs: ExtractedToolDef[];
     allORMQueries: ExtractedORMQuery[];
     bindingAccumulator: BindingAccumulator;

package/dist/core/ingestion/pipeline-phases/parse-impl.js

@@ -1553,6 +1553,7 @@ export async function runChunkedParseAndResolve(graph, scannedFiles, allPaths, t
             parsedImports: parsed.parsedImports.map((parsedImport) => resolveBinding(parsedImport, () => resolveRouteImportTargets(parsedImport, parsed.filePath), routeSourceTextFor)),
         };
     });
+    const selectedRoutes = new Set();
     const routeHandlerSymbols = resolveRouteHandlerSymbols(model, allExtractedRoutes, allDecoratorRoutes, {
         files: routeResolutionFiles,
         resolveImportTarget: resolveRouteImportTarget,
@@ -1563,13 +1564,14 @@ export async function runChunkedParseAndResolve(graph, scannedFiles, allPaths, t
             const n = graph.getNode(id);
             return typeof n?.properties.startLine === 'number' ? n.properties.startLine : undefined;
         },
-    });
+    }, selectedRoutes);
     return {
         exportedTypeMap,
         allFetchCalls,
         allFetchWrapperDefs,
         allExtractedRoutes,
         allDecoratorRoutes,
+        selectedRoutes,
         allToolDefs,
         allORMQueries,
         bindingAccumulator,

package/dist/core/ingestion/pipeline-phases/parse.d.ts

@@ -38,6 +38,8 @@ export interface ParseOutput {
     readonly allFetchWrapperDefs: readonly FetchWrapperDef[];
     readonly allExtractedRoutes: readonly ExtractedRoute[];
     readonly allDecoratorRoutes: readonly ExtractedDecoratorRoute[];
+    /** Exact admitted declarations that own Route nodes and handler attribution. */
+    readonly selectedRoutes: ReadonlySet<ExtractedRoute | ExtractedDecoratorRoute>;
     readonly allToolDefs: readonly ExtractedToolDef[];
     readonly allORMQueries: readonly ExtractedORMQuery[];
     /** Route URL → resolved handler symbol UID (Part 2, #2138). Consumed by the

package/dist/core/ingestion/pipeline-phases/routes.js

@@ -109,7 +109,7 @@ export const routesPhase = {
     name: 'routes',
     deps: ['parse'],
     async execute(ctx, deps) {
-        const { allPaths, allFetchCalls: parseFetchCalls, allFetchWrapperDefs, allExtractedRoutes, allDecoratorRoutes, routeHandlerSymbols, } = getPhaseOutput(deps, 'parse');
+        const { allPaths, allFetchCalls: parseFetchCalls, allFetchWrapperDefs, allExtractedRoutes, allDecoratorRoutes, routeHandlerSymbols, selectedRoutes, } = getPhaseOutput(deps, 'parse');
         // Local copy — routes phase must not mutate upstream ParseOutput
         const allFetchCalls = [...parseFetchCalls];
         const routeRegistry = new Map();
@@ -226,11 +226,14 @@ export const routesPhase = {
             if (!route.routePath)
                 continue;
             const routeUrl = normalizeExtractedRoutePath(route.routePath, route.prefix);
-            addRoute(routeUrl, {
-                filePath: route.filePath,
-                source: 'framework-route',
-                method: normalizeRouteMethod(route.httpMethod),
-            });
+            if (!selectedRoutes || selectedRoutes.has(route)) {
+                addRoute(routeUrl, {
+                    filePath: route.filePath,
+                    source: 'framework-route',
+                    method: normalizeRouteMethod(route.httpMethod),
+                });
+            }
+            // Losing declarations may still provide distinct named aliases.
             if (route.routeName && !namedRouteRegistry.has(route.routeName)) {
                 namedRouteRegistry.set(route.routeName, routeUrl);
             }
@@ -240,6 +243,8 @@ export const routesPhase = {
         // idiom, which no single file can reconcile. Framework routes are untouched;
         // their verb-less form is a declaration, not a weaker observation.
         for (const dr of reconcileDispatchGuardRoutes(allDecoratorRoutes)) {
+            if (selectedRoutes && !selectedRoutes.has(dr))
+                continue;
             const url = normalizeExtractedRoutePath(dr.routePath, dr.prefix ?? null);
             const method = normalizeRouteMethod(dr.httpMethod);
             const routeKey = routeNodeKey(method, url);

package/dist/core/ingestion/route-extractors/route-path.d.ts

@@ -1,12 +1,12 @@
 /**
- * Shared route-path normalization.
+ * Shared route-path normalization, route identity, and test-file classification.
  *
  * Extracted from the routes phase so both the routes phase (which creates the
  * `Route` graph node, keyed by `(method, url)` via `routeNodeKey` — #2289) and
  * the parse phase (which resolves each route's handler symbol and needs the
  * SAME key to associate the resolved id back to the route) can compute an
- * identical route identity without a phase-to-phase import cycle. Pure string
- * logic, no dependencies.
+ * identical route identity without a phase-to-phase import cycle. Test-route
+ * classification reuses the shared test-file path classifier.
  */
 /**
  * Join a route's path with its (optional) prefix into a normalized,
@@ -37,3 +37,5 @@ export declare function normalizeRouteMethod(raw: string | null | undefined): st
  * identically.
  */
 export declare function routeNodeKey(method: string | undefined, url: string): string;
+/** Keep test registrations available, but let production files win duplicate route identities. */
+export declare function isTestRouteFile(filePath: string): boolean;

package/dist/core/ingestion/route-extractors/route-path.js

@@ -1,12 +1,13 @@
+import { isTestFilePath } from '../utils/test-file-path.js';
 /**
- * Shared route-path normalization.
+ * Shared route-path normalization, route identity, and test-file classification.
  *
  * Extracted from the routes phase so both the routes phase (which creates the
  * `Route` graph node, keyed by `(method, url)` via `routeNodeKey` — #2289) and
  * the parse phase (which resolves each route's handler symbol and needs the
  * SAME key to associate the resolved id back to the route) can compute an
- * identical route identity without a phase-to-phase import cycle. Pure string
- * logic, no dependencies.
+ * identical route identity without a phase-to-phase import cycle. Test-route
+ * classification reuses the shared test-file path classifier.
  */
 /**
  * Join a route's path with its (optional) prefix into a normalized,
@@ -64,3 +65,8 @@ export function normalizeRouteMethod(raw) {
 export function routeNodeKey(method, url) {
     return method && method !== '*' ? `${method} ${url}` : url;
 }
+/** Keep test registrations available, but let production files win duplicate route identities. */
+export function isTestRouteFile(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    return isTestFilePath(normalized) || /(^|\/)e2e(\/|$)/i.test(normalized);
+}

package/dist/core/ingestion/workers/parse-worker.js

@@ -71,7 +71,7 @@ catch { }
 import { getLanguageFromFilename } from '../../../_shared/index.js';
 import { buildDefinitionPreScan, FUNCTION_NODE_TYPES, findAncestorBeforeBoundary, findSplitBodyCallableAncestor, SPLIT_SIGNATURE_NODE_TYPES, getDefinitionNodeFromCaptures, findEnclosingClassInfo, findObjectLiteralBindingInfo, isArrayContainedObjectLiteralMember, findReturnShapeOwnerInfo, isReturnShapeProperty, findMemberAssignmentOwnerInfo, isCjsDefaultExportAssignment, getLabelFromCaptures, genericFuncName, inferFunctionLabel, isSuppressedConcreteTypedefDuplicate, isValueDefinitionLabel, isQualifiableScopeLabel, MEMBER_OWNER_NODE_TYPES, qualifyByEnclosingModScope, qualifyRustImplTargetByModScope, CLASS_CONTAINER_TYPES, PARAMETER_LIST_NODE_TYPES, LOCAL_SCOPE_BODY_NODE_TYPES, } from '../utils/ast-helpers.js';
 import { isPositionQualifiedLocalLabel } from '../utils/callable-labels.js';
-import { extractCallArgTypes } from '../utils/call-analysis.js';
+import { countCallArguments, extractCallArgTypes, } from '../utils/call-analysis.js';
 import { buildTypeEnv } from '../type-env.js';
 import { detectFrameworkFromAST } from '../framework-detection.js';
 import { generateId } from '../../../lib/utils.js';
@@ -1404,6 +1404,11 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
                     // HTTP client calls like axios.get('/api/users') that match the same pattern
                     // as Express route registrations.
                     const callNode = captureMap['express_route'];
+                    // route(path) returns a builder; verb registrations need a handler.
+                    // Count arguments without comments, which are also named AST children.
+                    const minimumArguments = method === 'route' ? 1 : 2;
+                    if ((countCallArguments(callNode) ?? 0) < minimumArguments)
+                        continue;
                     const funcNode = callNode.childForFieldName?.('function') ?? callNode.children?.[0];
                     // Walk through nested member_expressions and call_expressions to
                     // reach the innermost receiver identifier.  Handles chains like:
@@ -1439,16 +1444,47 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
                         // This is an HTTP client call, not a route definition u2014 skip it
                         continue;
                     }
-                    const httpMethod = method === 'all' || method === 'use' || method === 'route'
-                        ? 'GET'
-                        : method.toUpperCase();
-                    result.decoratorRoutes.push({
-                        filePath: file.path,
-                        routePath,
-                        httpMethod,
-                        decoratorName: `express.${method}`,
-                        lineNumber: captureMap['express_route'].startPosition.row + lineOffset,
-                    });
+                    const registrations = [];
+                    if (method === 'route') {
+                        // A builder alone registers nothing. Follow only direct chained
+                        // verb calls, each of which must supply a non-comment handler arg.
+                        let builderNode = callNode;
+                        while (builderNode.parent?.type === 'member_expression') {
+                            const member = builderNode.parent;
+                            const registration = member.parent;
+                            const verb = member.childForFieldName('property')?.text;
+                            if (member.childForFieldName('object')?.id !== builderNode.id ||
+                                registration?.type !== 'call_expression' ||
+                                registration.childForFieldName('function')?.id !== member.id ||
+                                !verb ||
+                                !EXPRESS_ROUTE_METHODS.has(verb) ||
+                                verb === 'route' ||
+                                verb === 'use') {
+                                break;
+                            }
+                            if ((countCallArguments(registration) ?? 0) >= 1) {
+                                registrations.push({ method: verb, node: registration });
+                            }
+                            builderNode = registration;
+                        }
+                    }
+                    else {
+                        registrations.push({ method, node: callNode });
+                    }
+                    for (const registration of registrations) {
+                        const httpMethod = registration.method === 'all'
+                            ? '*'
+                            : registration.method === 'use'
+                                ? 'GET'
+                                : registration.method.toUpperCase();
+                        result.decoratorRoutes.push({
+                            filePath: file.path,
+                            routePath,
+                            httpMethod,
+                            decoratorName: `express.${registration.method}`,
+                            lineNumber: registration.node.startPosition.row + lineOffset,
+                        });
+                    }
                 }
                 continue;
             }

package/dist/storage/parse-cache.js

@@ -833,7 +833,14 @@ import { copyV8CacheIfPresent, tryLoadV8Cache, writeV8CacheFile } from './v8-sid
 // v131 (#3504): Python namespace imports retain explicit alias syntax. Warm
 // v130 ParsedFiles lack this fact and can bind a root-spelled alias to the
 // package root instead of the imported module.
-const SCHEMA_BUMP = 131;
+// v132 (#3487, #3505): merge the parallel Express route capture changes.
+// Require semantic handler arguments, retain route(path) builders, and preserve
+// app.all as method-agnostic. Both branches used v131 for different captures,
+// so invalidate either branch's cache before reusing the combined schema.
+// v133 (#3505): route(path) builders emit only chained verb registrations
+// with semantic handler arguments. Warm v132 caches can retain phantom GET
+// routes for bare builders and lose the actual methods of chained handlers.
+const SCHEMA_BUMP = 133;
 const GITNEXUS_PKG_VERSION = (() => {
     try {
         // package.json sits at gitnexus/package.json — two levels up from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.13-rc.91",
+  "version": "1.6.13-rc.92",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",