gitnexus 1.6.4-rc.37 → 1.6.4-rc.39

package/dist/cli/index-repo.js

@@ -10,7 +10,7 @@
  */
 import path from 'path';
 import fs from 'fs/promises';
-import { getStoragePaths, loadMeta, addToGitignore, registerRepo, } from '../storage/repo-manager.js';
+import { getStoragePaths, loadMeta, ensureGitNexusIgnored, registerRepo, } from '../storage/repo-manager.js';
 import { getGitRoot, getRemoteUrl, isGitRepo } from '../storage/git.js';
 export const indexCommand = async (inputPathParts, options) => {
     console.log('\n  GitNexus Index\n');
@@ -96,7 +96,7 @@ export const indexCommand = async (inputPathParts, options) => {
         meta.remoteUrl = getRemoteUrl(repoPath);
     }
     await registerRepo(repoPath, meta);
-    await addToGitignore(repoPath);
+    await ensureGitNexusIgnored(repoPath);
     const projectName = path.basename(repoPath);
     const { stats } = meta;
     console.log(`  Repository registered: ${projectName}`);

package/dist/core/group/extractors/grpc-extractor.js

@@ -1,6 +1,7 @@
 import * as path from 'node:path';
 import { glob } from 'glob';
 import Parser from 'tree-sitter';
+import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import { readSafe } from './fs-utils.js';
 import { GRPC_SCAN_GLOB, getPluginForFile, hasProtoPlugin, } from './grpc-patterns/index.js';
 /**
@@ -185,11 +186,16 @@ function longestSharedSegmentRun(aPath, bPath) {
 }
 async function buildProtoContext(repoPath) {
     const servicesByName = new Map();
+    // `.gitnexusignore` / `.gitignore` honoured via the shared IgnoreService —
+    // see `filesystem-walker.ts` for the canonical pattern. Replaces a
+    // hardcoded `[node_modules, .git, vendor]` array; those names plus the
+    // rest of `DEFAULT_IGNORE_LIST` are still excluded by default (#1185).
+    const protoIgnoreFilter = await createIgnoreFilter(repoPath);
     const protoFiles = await glob('**/*.proto', {
         cwd: repoPath,
         absolute: false,
         nodir: true,
-        ignore: ['**/node_modules/**', '**/.git/**', '**/vendor/**'],
+        ignore: protoIgnoreFilter,
     });
     const contents = new Map();
     for (const rel of protoFiles) {
@@ -324,9 +330,14 @@ export class GrpcExtractor {
             }
         }
         // ─── Source files (+ .proto when plugin available) ────────────
+        // Honour `.gitnexusignore` / `.gitignore` via the shared IgnoreService —
+        // mirrors `filesystem-walker.ts`. Replaces a hardcoded
+        // `[node_modules, .git, vendor, dist, build]` array; those names are all
+        // in `DEFAULT_IGNORE_LIST`, so default behaviour is preserved (#1185).
+        const sourceIgnoreFilter = await createIgnoreFilter(repoPath);
         const sourceFiles = await glob(GRPC_SCAN_GLOB, {
             cwd: repoPath,
-            ignore: ['**/node_modules/**', '**/.git/**', '**/vendor/**', '**/dist/**', '**/build/**'],
+            ignore: sourceIgnoreFilter,
             nodir: true,
         });
         const parser = new Parser();

package/dist/core/group/extractors/http-route-extractor.js

@@ -1,6 +1,7 @@
 import * as path from 'node:path';
 import { glob } from 'glob';
 import Parser from 'tree-sitter';
+import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import { readSafe } from './fs-utils.js';
 import { getPluginForFile, HTTP_SCAN_GLOB } from './http-patterns/index.js';
 /**
@@ -183,9 +184,16 @@ export class HttpRouteExtractor {
         return [...providers, ...consumers];
     }
     async scanFiles(repoPath) {
+        // Honour `.gitnexusignore` and `.gitignore` via the shared IgnoreService
+        // so contract extraction respects the same exclusion rules as the rest of
+        // the ingestion pipeline. Mirrors `filesystem-walker.ts` which uses the
+        // same shape. Replaces a hardcoded `[node_modules, .git, dist, build,
+        // vendor]` array — those names are still in `DEFAULT_IGNORE_LIST`, so
+        // default behaviour is preserved (#1185).
+        const ignoreFilter = await createIgnoreFilter(repoPath);
         return glob(HTTP_SCAN_GLOB, {
             cwd: repoPath,
-            ignore: ['**/node_modules/**', '**/.git/**', '**/dist/**', '**/build/**', '**/vendor/**'],
+            ignore: ignoreFilter,
             nodir: true,
         });
     }

package/dist/core/group/extractors/topic-extractor.js

@@ -1,5 +1,6 @@
 import { glob } from 'glob';
 import Parser from 'tree-sitter';
+import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import { readSafe } from './fs-utils.js';
 import { scanFile, unquoteLiteral } from './tree-sitter-scanner.js';
 import { TOPIC_SCAN_GLOB, getProviderForFile, } from './topic-patterns/index.js';
@@ -40,22 +41,21 @@ export class TopicExtractor {
         return true;
     }
     async extract(_dbExecutor, repoPath, _repo) {
+        // Honour `.gitnexusignore` / `.gitignore` via the shared IgnoreService —
+        // mirrors `filesystem-walker.ts`. The 5-name hardcoded list
+        // (`node_modules, .git, vendor, dist, build`) is preserved because every
+        // entry is in `DEFAULT_IGNORE_LIST`, so default behaviour is unchanged
+        // (#1185). The Go-specific `**/*_test.go` filter is layered on top via a
+        // small wrapper so glob-level pruning is preserved (we never read those
+        // files); the wrapper short-circuits before calling the base filter.
+        const baseFilter = await createIgnoreFilter(repoPath);
+        const ignoreFilter = {
+            ignored: (p) => p.relative().endsWith('_test.go') || baseFilter.ignored(p),
+            childrenIgnored: (p) => baseFilter.childrenIgnored(p),
+        };
         const files = await glob(TOPIC_SCAN_GLOB, {
             cwd: repoPath,
-            ignore: [
-                '**/node_modules/**',
-                '**/.git/**',
-                '**/vendor/**',
-                '**/dist/**',
-                '**/build/**',
-                // Language-level test file conventions. Go test files
-                // `*_test.go` live next to source; other languages either use
-                // separate test directories (Python's `tests/`, Java's
-                // `src/test/`) or are already covered by the dist/build ignores.
-                // Pushed to the glob level so the orchestrator stays
-                // language-agnostic.
-                '**/*_test.go',
-            ],
+            ignore: ignoreFilter,
             nodir: true,
         });
         // One parser reused across files; the scanner calls `setLanguage` per

package/dist/core/ingestion/languages/python/import-target.js

@@ -41,35 +41,76 @@ export function resolvePythonImportTarget(parsedImport, workspaceIndex) {
     const pathLike = parsedImport.targetRaw.replace(/\./g, '/');
     if (pathLike.includes('/')) {
         const [leadingSegment] = pathLike.split('/').filter(Boolean);
-        if (!leadingSegment || !hasRepoCandidate(leadingSegment, ctx.allFilePaths)) {
+        if (!leadingSegment || !hasRepoCandidate(leadingSegment, ctx.allFilePaths, ctx.fromFile)) {
             return null;
         }
     }
-    // Multi-segment absolute resolve: try exact paths first, then suffix
-    // match in nested repos. Using direct `Set.has` + `endsWith` instead of
-    // `suffixResolve`'s shared helper because that helper requires a
-    // pre-built `SuffixIndex` to disambiguate ties — without one it falls
-    // back to an O(files) scan that silently picks the wrong file when
-    // the last segment collides across directories (e.g. `accounts.models`
-    // matching `billing/models.py` when both files exist).
-    return resolveAbsoluteFromFiles(pathLike, ctx.allFilePaths);
+    // Multi-segment absolute resolve: try exact paths first, then ancestor
+    // walk (mirrors the single-segment ancestor walk in
+    // `resolvePythonImportInternal`), then a suffix match in nested repos.
+    // Using direct `Set.has` + `endsWith` instead of `suffixResolve`'s shared
+    // helper because that helper requires a pre-built `SuffixIndex` to
+    // disambiguate ties — without one it falls back to an O(files) scan that
+    // silently picks the wrong file when the last segment collides across
+    // directories (e.g. `accounts.models` matching `billing/models.py` when
+    // both files exist).
+    return resolveAbsoluteFromFiles(pathLike, ctx.allFilePaths, ctx.fromFile);
 }
 /**
  * Resolve `package/sub/module` style paths (already dot-flattened) to a
- * concrete file in `allFilePaths`. Tries the exact path first, then the
- * `__init__.py` variant, then a suffix match for nested layouts.
+ * concrete file in `allFilePaths`. Tries the exact path first, then walks
+ * ancestors of `fromFile` looking for `<ancestor>/<pathLike>.py` (or
+ * `__init__.py`), then falls back to a suffix match for nested layouts.
  * Returns the original (un-normalized) path from the set.
+ *
+ * Precedence order:
+ *  1. Workspace-root direct hit (`<pathLike>.py`, `<pathLike>/__init__.py`).
+ *  2. Closest-ancestor match walking up from the importer's directory.
+ *  3. Suffix fallback (first match).
+ *
+ * Root wins over ancestor by construction — if both `services/sync.py` and
+ * `backend/services/sync.py` exist, `backend/routers/cron.py`'s
+ * `from services.sync import X` resolves to the root file. This mirrors
+ * Python's `sys.path` semantics where the project root is searched first.
+ *
+ * The ancestor walk mirrors the single-segment behavior in
+ * `resolvePythonImportInternal`. For `from services.sync import X` in
+ * `backend/routers/cron.py`, walk up: `backend/routers/services/sync.py` →
+ * `backend/services/sync.py` ✓.
  */
-function resolveAbsoluteFromFiles(pathLike, allFilePaths) {
+function resolveAbsoluteFromFiles(pathLike, allFilePaths, fromFile) {
     const directFile = `${pathLike}.py`;
     const directPkg = `${pathLike}/__init__.py`;
+    // Direct hit at workspace root.
+    if (allFilePaths.has(directFile))
+        return directFile;
+    if (allFilePaths.has(directPkg))
+        return directPkg;
+    // Ancestor walk — match the single-segment resolver's behavior at
+    // multi-segment granularity. Closest match wins. Stop at `i > 0` because
+    // `i === 0` would re-check the workspace-root candidates already covered
+    // by the direct check above.
+    const importerDir = fromFile.replace(/\\/g, '/').split('/').slice(0, -1).join('/');
+    if (importerDir) {
+        const dirParts = importerDir.split('/').filter(Boolean);
+        for (let i = dirParts.length; i > 0; i--) {
+            const ancestor = dirParts.slice(0, i).join('/');
+            const prefix = `${ancestor}/`;
+            const candidateFile = `${prefix}${directFile}`;
+            const candidatePkg = `${prefix}${directPkg}`;
+            if (allFilePaths.has(candidateFile))
+                return candidateFile;
+            if (allFilePaths.has(candidatePkg))
+                return candidatePkg;
+        }
+    }
+    // Existing suffix-match fallback (preserved for monorepo/nested-repo
+    // layouts that don't share a directory ancestor with the importer).
     const suffixFile = `/${directFile}`;
     const suffixPkg = `/${directPkg}`;
     let suffixMatch = null;
     for (const raw of allFilePaths) {
         const f = raw.replace(/\\/g, '/');
-        if (f === directFile || f === directPkg)
-            return raw;
         if (suffixMatch === null && (f.endsWith(suffixFile) || f.endsWith(suffixPkg))) {
             suffixMatch = raw;
         }
@@ -77,23 +118,51 @@ function resolveAbsoluteFromFiles(pathLike, allFilePaths) {
     return suffixMatch;
 }
 /**
- * Does the repo contain a module/package named `leadingSegment` at the top
- * level? Used to guard against false-positive suffix matches on external
- * dotted imports (e.g. `django.apps` matching a local `accounts/apps.py`).
+ * Does the repo contain a module/package named `leadingSegment` somewhere
+ * the importer can plausibly reach?
  *
- * Checks, in order: `<segment>.py` root file, `<segment>/__init__.py`
- * regular package, or any `<segment>/**.py` file (namespace package).
+ * Used to guard against false-positive suffix matches on external dotted
+ * imports (e.g. `django.apps` matching a local `accounts/apps.py`).
+ *
+ * Checks, in order:
+ *  1. `SEGMENT.py` root file or `SEGMENT/__init__.py` regular package.
+ *  2. Any `SEGMENT/...py` file at the workspace root (namespace package).
+ *  3. Any `<importer-ancestor>/SEGMENT/...py` file (nested namespace
+ *     package the importer could reach via an ancestor walk, e.g.
+ *     `backend/services/sync.py` from `backend/routers/cron.py`).
+ *
+ * The nested case is bounded to the importer's own ancestors so a
+ * vendored copy of an external package (e.g. `vendor/django/urls.py`)
+ * does not gate-pass external imports like `from django.urls import path`
+ * issued from `app/main.py`. Files inside the vendored tree itself
+ * (importer under `vendor/django/...`) still resolve correctly because
+ * the ancestor walk includes their own parents.
  */
-function hasRepoCandidate(leadingSegment, allFilePaths) {
+function hasRepoCandidate(leadingSegment, allFilePaths, fromFile) {
     const prefix = `${leadingSegment}/`;
     const rootFile = `${leadingSegment}.py`;
     const initFile = `${leadingSegment}/__init__.py`;
+    // Build importer-ancestor prefixes: for `backend/routers/cron.py`,
+    // produces `["backend/routers/services/", "backend/services/"]` for
+    // segment `services` (closest first, root excluded — covered above).
+    const importerDir = fromFile.replace(/\\/g, '/').split('/').slice(0, -1).join('/');
+    const dirParts = importerDir ? importerDir.split('/').filter(Boolean) : [];
+    const ancestorPrefixes = [];
+    for (let i = dirParts.length; i > 0; i--) {
+        ancestorPrefixes.push(`${dirParts.slice(0, i).join('/')}/${leadingSegment}/`);
+    }
     for (const raw of allFilePaths) {
         const f = raw.replace(/\\/g, '/');
         if (f === rootFile || f === initFile)
             return true;
         if (f.startsWith(prefix) && f.endsWith('.py'))
             return true;
+        if (f.endsWith('.py')) {
+            for (const ap of ancestorPrefixes) {
+                if (f.startsWith(ap))
+                    return true;
+            }
+        }
     }
     return false;
 }

package/dist/core/run-analyze.js

@@ -13,7 +13,7 @@ import fs from 'fs/promises';
 import { runPipelineFromRepo } from './ingestion/pipeline.js';
 import { initLbug, loadGraphToLbug, getLbugStats, executeQuery, executeWithReusedStatement, closeLbug, loadCachedEmbeddings, } from './lbug/lbug-adapter.js';
 import { createSearchFTSIndexes } from './search/fts-indexes.js';
-import { getStoragePaths, saveMeta, loadMeta, addToGitignore, registerRepo, cleanupOldKuzuFiles, } from '../storage/repo-manager.js';
+import { getStoragePaths, saveMeta, loadMeta, ensureGitNexusIgnored, registerRepo, cleanupOldKuzuFiles, } from '../storage/repo-manager.js';
 import { getCurrentCommit, getRemoteUrl, hasGitDir, getInferredRepoName } from '../storage/git.js';
 import { generateAIContextFiles } from '../cli/ai-context.js';
 import { EMBEDDING_TABLE_NAME } from './lbug/schema.js';
@@ -69,6 +69,7 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
     if (existingMeta && !options.force && existingMeta.lastCommit === currentCommit) {
         // Non-git folders have currentCommit = '' — always rebuild since we can't detect changes
         if (currentCommit !== '') {
+            await ensureGitNexusIgnored(repoPath);
             return {
                 repoName: options.registryName ?? getInferredRepoName(repoPath) ?? path.basename(repoPath),
                 repoPath,
@@ -302,10 +303,8 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
             name: options.registryName,
             allowDuplicateName: options.allowDuplicateName,
         });
-        // Only attempt to update .gitignore when a .git directory is present.
-        if (hasGitDir(repoPath)) {
-            await addToGitignore(repoPath);
-        }
+        // Keep generated .gitnexus contents ignored without editing the user's root .gitignore.
+        await ensureGitNexusIgnored(repoPath);
         // ── Generate AI context files (best-effort) ───────────────────────
         let aggregatedClusterCount = 0;
         if (pipelineResult.communityResult?.communities) {

package/dist/storage/repo-manager.d.ts

@@ -128,9 +128,9 @@ export declare const loadRepo: (repoPath: string) => Promise<IndexedRepo | null>
  */
 export declare const findRepo: (startPath: string) => Promise<IndexedRepo | null>;
 /**
- * Add .gitnexus to .gitignore if not already present
+ * Keep generated index files ignored without modifying the user's root .gitignore.
  */
-export declare const addToGitignore: (repoPath: string) => Promise<void>;
+export declare const ensureGitNexusIgnored: (repoPath: string) => Promise<void>;
 /**
  * Get the path to the global GitNexus directory
  */

package/dist/storage/repo-manager.js

@@ -50,6 +50,7 @@ export const canonicalizePath = (p) => {
     }
 };
 const GITNEXUS_DIR = '.gitnexus';
+const GITNEXUS_EXCLUDE_ENTRY = `${GITNEXUS_DIR}/`;
 // ─── Local Storage Helpers ─────────────────────────────────────────────
 /**
  * Get the .gitnexus storage path for a repository
@@ -185,23 +186,42 @@ export const findRepo = async (startPath) => {
     return null;
 };
 /**
- * Add .gitnexus to .gitignore if not already present
+ * Keep generated index files ignored without modifying the user's root .gitignore.
  */
-export const addToGitignore = async (repoPath) => {
-    const gitignorePath = path.join(repoPath, '.gitignore');
+export const ensureGitNexusIgnored = async (repoPath) => {
+    const gitignorePath = path.join(getStoragePath(repoPath), '.gitignore');
+    await fs.mkdir(path.dirname(gitignorePath), { recursive: true });
+    await fs.writeFile(gitignorePath, '*\n', 'utf-8');
+    await ensureGitInfoExclude(repoPath);
+};
+const ensureGitInfoExclude = async (repoPath) => {
+    const gitDirPath = path.join(path.resolve(repoPath), '.git');
+    const excludePath = path.join(gitDirPath, 'info', 'exclude');
     try {
-        const content = await fs.readFile(gitignorePath, 'utf-8');
-        if (content.includes(GITNEXUS_DIR))
+        const gitDir = await fs.stat(gitDirPath);
+        if (!gitDir.isDirectory())
             return;
-        const newContent = content.endsWith('\n')
-            ? `${content}${GITNEXUS_DIR}\n`
-            : `${content}\n${GITNEXUS_DIR}\n`;
-        await fs.writeFile(gitignorePath, newContent, 'utf-8');
     }
     catch {
-        // .gitignore doesn't exist, create it
-        await fs.writeFile(gitignorePath, `${GITNEXUS_DIR}\n`, 'utf-8');
+        return;
     }
+    await fs.mkdir(path.dirname(excludePath), { recursive: true });
+    let content = '';
+    try {
+        content = await fs.readFile(excludePath, 'utf-8');
+    }
+    catch (err) {
+        if (err?.code !== 'ENOENT')
+            throw err;
+    }
+    const excludes = content
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith('#'));
+    if (excludes.includes(GITNEXUS_DIR) || excludes.includes(GITNEXUS_EXCLUDE_ENTRY))
+        return;
+    const separator = content.length === 0 || content.endsWith('\n') ? '' : '\n';
+    await fs.writeFile(excludePath, `${content}${separator}${GITNEXUS_EXCLUDE_ENTRY}\n`, 'utf-8');
 };
 // ─── Global Registry (~/.gitnexus/registry.json) ───────────────────────
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.4-rc.37",
+  "version": "1.6.4-rc.39",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",