gitnexus 1.6.4-rc.98 → 1.6.4

package/dist/core/lbug/csv-generator.js

@@ -237,9 +237,10 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir) => {
         'Template',
         'Module',
     ];
+    const propertyHeader = 'id,name,filePath,startLine,endLine,content,description,declaredType';
     const multiLangWriters = new Map();
     for (const t of MULTI_LANG_TYPES) {
-        multiLangWriters.set(t, new BufferedCSVWriter(path.join(csvDir, `${t.toLowerCase()}.csv`), multiLangHeader));
+        multiLangWriters.set(t, new BufferedCSVWriter(path.join(csvDir, `${t.toLowerCase()}.csv`), t === 'Property' ? propertyHeader : multiLangHeader));
     }
     const codeWriterMap = {
         Function: functionWriter,
@@ -390,6 +391,9 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir) => {
                             escapeCSVNumber(node.properties.endLine, -1),
                             escapeCSVField(content),
                             escapeCSVField(node.properties.description || ''),
+                            ...(node.label === 'Property'
+                                ? [escapeCSVField(node.properties.declaredType || '')]
+                                : []),
                         ].join(','));
                     }
                 }

package/dist/core/lbug/lbug-adapter.js

@@ -520,6 +520,9 @@ const getCopyQuery = (table, filePath) => {
     if (table === 'Method') {
         return `COPY ${t}(id, name, filePath, startLine, endLine, isExported, content, description, parameterCount, returnType) FROM "${filePath}" ${COPY_CSV_OPTS}`;
     }
+    if (table === 'Property') {
+        return `COPY ${t}(id, name, filePath, startLine, endLine, content, description, declaredType) FROM "${filePath}" ${COPY_CSV_OPTS}`;
+    }
     // TypeScript/JS code element tables have isExported; multi-language tables do not
     if (TABLES_WITH_EXPORTED.has(table)) {
         return `COPY ${t}(id, name, filePath, startLine, endLine, isExported, content, description) FROM "${filePath}" ${COPY_CSV_OPTS}`;
@@ -569,6 +572,12 @@ export const insertNodeToLbug = async (label, properties, dbPath) => {
                 : '';
             query = `CREATE (n:${t} {id: ${escapeValue(properties.id)}, name: ${escapeValue(properties.name)}, filePath: ${escapeValue(properties.filePath)}, startLine: ${properties.startLine || 0}, endLine: ${properties.endLine || 0}, isExported: ${!!properties.isExported}, content: ${escapeValue(properties.content || '')}${descPart}})`;
         }
+        else if (label === 'Property') {
+            const descPart = properties.description
+                ? `, description: ${escapeValue(properties.description)}`
+                : '';
+            query = `CREATE (n:${t} {id: ${escapeValue(properties.id)}, name: ${escapeValue(properties.name)}, filePath: ${escapeValue(properties.filePath)}, startLine: ${properties.startLine || 0}, endLine: ${properties.endLine || 0}, content: ${escapeValue(properties.content || '')}${descPart}, declaredType: ${escapeValue(properties.declaredType || '')}})`;
+        }
         else {
             // Multi-language tables (Struct, Impl, Trait, Macro, etc.) — no isExported
             const descPart = properties.description
@@ -646,6 +655,12 @@ export const batchInsertNodesToLbug = async (nodes, dbPath) => {
                         : '';
                     query = `MERGE (n:${t} {id: ${escapeValue(properties.id)}}) SET n.name = ${escapeValue(properties.name)}, n.filePath = ${escapeValue(properties.filePath)}, n.startLine = ${properties.startLine || 0}, n.endLine = ${properties.endLine || 0}, n.isExported = ${!!properties.isExported}, n.content = ${escapeValue(properties.content || '')}${descPart}`;
                 }
+                else if (label === 'Property') {
+                    const descPart = properties.description
+                        ? `, n.description = ${escapeValue(properties.description)}`
+                        : '';
+                    query = `MERGE (n:${t} {id: ${escapeValue(properties.id)}}) SET n.name = ${escapeValue(properties.name)}, n.filePath = ${escapeValue(properties.filePath)}, n.startLine = ${properties.startLine || 0}, n.endLine = ${properties.endLine || 0}, n.content = ${escapeValue(properties.content || '')}${descPart}, n.declaredType = ${escapeValue(properties.declaredType || '')}`;
+                }
                 else {
                     const descPart = properties.description
                         ? `, n.description = ${escapeValue(properties.description)}`

package/dist/core/lbug/schema.d.ts

@@ -32,7 +32,7 @@ export declare const TYPE_ALIAS_SCHEMA: string;
 export declare const CONST_SCHEMA: string;
 export declare const STATIC_SCHEMA: string;
 export declare const VARIABLE_SCHEMA: string;
-export declare const PROPERTY_SCHEMA: string;
+export declare const PROPERTY_SCHEMA = "\nCREATE NODE TABLE `Property` (\n  id STRING,\n  name STRING,\n  filePath STRING,\n  startLine INT64,\n  endLine INT64,\n  content STRING,\n  description STRING,\n  declaredType STRING,\n  PRIMARY KEY (id)\n)";
 export declare const RECORD_SCHEMA: string;
 export declare const DELEGATE_SCHEMA: string;
 export declare const ANNOTATION_SCHEMA: string;

package/dist/core/lbug/schema.js

@@ -150,7 +150,18 @@ export const TYPE_ALIAS_SCHEMA = CODE_ELEMENT_BASE('TypeAlias');
 export const CONST_SCHEMA = CODE_ELEMENT_BASE('Const');
 export const STATIC_SCHEMA = CODE_ELEMENT_BASE('Static');
 export const VARIABLE_SCHEMA = CODE_ELEMENT_BASE('Variable');
-export const PROPERTY_SCHEMA = CODE_ELEMENT_BASE('Property');
+export const PROPERTY_SCHEMA = `
+CREATE NODE TABLE \`Property\` (
+  id STRING,
+  name STRING,
+  filePath STRING,
+  startLine INT64,
+  endLine INT64,
+  content STRING,
+  description STRING,
+  declaredType STRING,
+  PRIMARY KEY (id)
+)`;
 export const RECORD_SCHEMA = CODE_ELEMENT_BASE('Record');
 export const DELEGATE_SCHEMA = CODE_ELEMENT_BASE('Delegate');
 export const ANNOTATION_SCHEMA = CODE_ELEMENT_BASE('Annotation');

package/dist/core/wiki/llm-client.d.ts

@@ -36,6 +36,22 @@ export declare function resolveLLMConfig(overrides?: Partial<LLMConfig>): Promis
  * Estimate token count from text (rough heuristic: ~4 chars per token).
  */
 export declare function estimateTokens(text: string): number;
+/**
+ * Validate that a base URL supplied for LLM API calls is a safe HTTP/HTTPS
+ * endpoint (CWE-918 / CodeQL js/http-to-file-access).
+ *
+ * Allowed:
+ *  - https:// with any hostname (public LLM APIs, Azure, OpenRouter, …)
+ *  - http:// restricted to localhost / 127.0.0.1 (local servers: Ollama, LiteLLM, …)
+ *
+ * Rejected:
+ *  - file://, data:, javascript:, and any other non-HTTP scheme
+ *  - http:// aimed at non-loopback hosts (avoids SSRF against internal networks)
+ *
+ * Throws with a descriptive message on validation failure so callers surface a
+ * clear error rather than an opaque network error.
+ */
+export declare function validateLLMBaseUrl(baseUrl: string): void;
 /**
  * Returns true if the given base URL is an Azure OpenAI endpoint.
  * Uses proper hostname matching to avoid spoofed URLs like

package/dist/core/wiki/llm-client.js

@@ -1,4 +1,5 @@
 import { logger } from '../logger.js';
+import { CircuitOpenError, ResilientFetchExhaustedError, resilientFetch } from '../../_shared/index.js';
 /**
  * Resolve LLM configuration from env vars, saved config, and optional overrides.
  * Priority: overrides (CLI flags) > env vars > ~/.gitnexus/config.json > error
@@ -37,6 +38,45 @@ export async function resolveLLMConfig(overrides) {
 export function estimateTokens(text) {
     return Math.ceil(text.length / 4);
 }
+/**
+ * Validate that a base URL supplied for LLM API calls is a safe HTTP/HTTPS
+ * endpoint (CWE-918 / CodeQL js/http-to-file-access).
+ *
+ * Allowed:
+ *  - https:// with any hostname (public LLM APIs, Azure, OpenRouter, …)
+ *  - http:// restricted to localhost / 127.0.0.1 (local servers: Ollama, LiteLLM, …)
+ *
+ * Rejected:
+ *  - file://, data:, javascript:, and any other non-HTTP scheme
+ *  - http:// aimed at non-loopback hosts (avoids SSRF against internal networks)
+ *
+ * Throws with a descriptive message on validation failure so callers surface a
+ * clear error rather than an opaque network error.
+ */
+export function validateLLMBaseUrl(baseUrl) {
+    let parsed;
+    try {
+        parsed = new URL(baseUrl);
+    }
+    catch {
+        // Do not include the raw input in the message — it may contain credentials.
+        throw new Error('Invalid LLM base URL: must be a well-formed http:// or https:// URL');
+    }
+    if (!['https:', 'http:'].includes(parsed.protocol)) {
+        // Use parsed.protocol only (scheme), not the full URL, to avoid leaking credentials.
+        throw new Error(`LLM base URL must use http:// or https:// (got ${parsed.protocol})`);
+    }
+    if (parsed.protocol === 'http:') {
+        // Node's URL parser preserves IPv6 brackets in hostname (e.g. "[::1]"),
+        // so strip them before comparing to bare address literals.
+        const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+        if (host !== 'localhost' && host !== '127.0.0.1' && host !== '::1') {
+            // Use parsed.origin (scheme+host+port, no credentials) instead of the full URL.
+            throw new Error(`Insecure http:// LLM base URLs are only allowed for localhost/127.0.0.1. ` +
+                `Use https:// for remote endpoints (got ${parsed.origin})`);
+        }
+    }
+}
 /**
  * Returns true if the given base URL is an Azure OpenAI endpoint.
  * Uses proper hostname matching to avoid spoofed URLs like
@@ -78,6 +118,8 @@ export function buildRequestUrl(baseUrl, apiVersion) {
  * Retries up to 3 times on transient failures (429, 5xx, network errors).
  */
 export async function callLLM(prompt, config, systemPrompt, options) {
+    // Validate base URL before any fetch (CodeQL js/http-to-file-access)
+    validateLLMBaseUrl(config.baseUrl);
     const messages = [];
     if (systemPrompt) {
         messages.push({ role: 'system', content: systemPrompt });
@@ -110,69 +152,68 @@ export async function callLLM(prompt, config, systemPrompt, options) {
     const authHeaders = azure
         ? { 'api-key': config.apiKey }
         : { Authorization: `Bearer ${config.apiKey}` };
-    const MAX_RETRIES = 3;
-    let lastError = null;
-    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-        try {
-            const response = await fetch(url, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    ...authHeaders,
-                },
-                body: JSON.stringify(body),
-            });
-            if (!response.ok) {
-                const errorText = await response.text().catch(() => 'unknown error');
-                // Azure content filter — surface a clear message instead of a generic API error
-                if (azure &&
-                    response.status === 400 &&
-                    (errorText.includes('content_filter') ||
-                        errorText.includes('ResponsibleAIPolicyViolation'))) {
-                    throw new Error(`Azure content filter blocked this request. The prompt triggered content policy. Details: ${errorText.slice(0, 300)}`);
-                }
-                // Rate limit — wait with exponential backoff and retry
-                if (response.status === 429 && attempt < MAX_RETRIES - 1) {
-                    const retryAfter = parseInt(response.headers.get('retry-after') || '0', 10);
-                    const delay = retryAfter > 0 ? retryAfter * 1000 : 2 ** attempt * 3000;
-                    await sleep(delay);
-                    continue;
-                }
-                // Server error — retry with backoff
-                if (response.status >= 500 && attempt < MAX_RETRIES - 1) {
-                    await sleep((attempt + 1) * 2000);
-                    continue;
-                }
-                throw new Error(`LLM API error (${response.status}): ${errorText.slice(0, 500)}`);
-            }
-            // Streaming path
-            if (useStream && response.body) {
-                return await readSSEStream(response.body, options.onChunk);
-            }
-            // Non-streaming path
-            const json = (await response.json());
-            const choice = json.choices?.[0];
-            if (!choice?.message?.content) {
-                throw new Error('LLM returned empty response');
-            }
-            return {
-                content: choice.message.content,
-                promptTokens: json.usage?.prompt_tokens,
-                completionTokens: json.usage?.completion_tokens,
-            };
+    // Network resilience (bounded retries with exponential-backoff jitter,
+    // 5xx + 429 + Retry-After handling, in-process circuit breaker on the
+    // LLM endpoint) is delegated to resilientFetch. Provider-specific
+    // error parsing (Azure content filter, empty-content checks) stays
+    // here since it requires response-body inspection.
+    let response;
+    try {
+        response = await resilientFetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                ...authHeaders,
+            },
+            body: JSON.stringify(body),
+            // Per-attempt timeout. Without this each retry can hang
+            // indefinitely on a frozen TCP connection — the per-call
+            // signal is the only timeout `resilientFetch` honors;
+            // `capDelayMs` only bounds the *backoff* between attempts.
+            // 60s matches typical LLM completion budgets.
+            signal: AbortSignal.timeout(60_000),
+        }, {
+            breakerKey: `wiki-llm-${new URL(url).host}`,
+            retry: { maxAttempts: 3, baseDelayMs: 2_000, capDelayMs: 30_000 },
+        });
+    }
+    catch (err) {
+        if (err instanceof CircuitOpenError) {
+            throw new Error(`LLM endpoint circuit open: retry in ${Math.ceil(err.retryAfterMs / 1000)}s. ${err.message}`);
         }
-        catch (err) {
-            lastError = err;
-            // Network error — retry with backoff
-            if (attempt < MAX_RETRIES - 1 &&
-                (err.code === 'ECONNREFUSED' || err.code === 'ETIMEDOUT' || err.message?.includes('fetch'))) {
-                await sleep((attempt + 1) * 3000);
-                continue;
-            }
-            throw err;
+        if (err instanceof ResilientFetchExhaustedError) {
+            const errorText = await err.response.text().catch(() => 'unknown error');
+            throw new Error(`LLM API error (${err.response.status} after retries): ${errorText.slice(0, 500)}`);
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const errorText = await response.text().catch(() => 'unknown error');
+        // Azure content filter — surface a clear message instead of a generic API error.
+        if (azure &&
+            response.status === 400 &&
+            (errorText.includes('content_filter') || errorText.includes('ResponsibleAIPolicyViolation'))) {
+            throw new Error(`Azure content filter blocked this request. The prompt triggered content policy. Details: ${errorText.slice(0, 300)}`);
         }
+        // Any other non-OK response here is a terminal 4xx — resilientFetch
+        // already retried 5xx/429 to exhaustion and would have thrown above.
+        throw new Error(`LLM API error (${response.status}): ${errorText.slice(0, 500)}`);
+    }
+    // Streaming path
+    if (useStream && response.body) {
+        return await readSSEStream(response.body, options.onChunk);
     }
-    throw lastError || new Error('LLM call failed after retries');
+    // Non-streaming path
+    const json = (await response.json());
+    const choice = json.choices?.[0];
+    if (!choice?.message?.content) {
+        throw new Error('LLM returned empty response');
+    }
+    return {
+        content: choice.message.content,
+        promptTokens: json.usage?.prompt_tokens,
+        completionTokens: json.usage?.completion_tokens,
+    };
 }
 /**
  * Read an SSE stream from an OpenAI-compatible streaming response.
@@ -224,6 +265,3 @@ async function readSSEStream(body, onChunk) {
     }
     return { content };
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}

package/dist/mcp/local/local-backend.js

@@ -1443,10 +1443,11 @@ export class LocalBackend {
         // Categorized incoming refs
         const incomingRows = await executeParameterized(repo.id, `
       MATCH (caller)-[r:CodeRelation]->(n {id: $symId})
-      WHERE r.type IN ['CALLS', 'IMPORTS', 'EXTENDS', 'IMPLEMENTS', 'HAS_METHOD', 'HAS_PROPERTY', 'METHOD_OVERRIDES', 'OVERRIDES', 'METHOD_IMPLEMENTS', 'ACCESSES']
+      WHERE r.type IN ['CALLS', 'IMPORTS', 'EXTENDS', 'IMPLEMENTS', 'USES', 'HAS_METHOD', 'HAS_PROPERTY', 'METHOD_OVERRIDES', 'OVERRIDES', 'METHOD_IMPLEMENTS', 'ACCESSES']
       RETURN r.type AS relType, caller.id AS uid, caller.name AS name, caller.filePath AS filePath, labels(caller)[0] AS kind
       LIMIT 30
     `, { symId });
+        let typedPropertyRows = [];
         // Fix #480: Class/Interface nodes have no direct CALLS/IMPORTS edges —
         // those point to Constructor and File nodes respectively. Fetch those
         // extra incoming refs and merge them in so context() shows real callers.
@@ -1476,13 +1477,13 @@ export class LocalBackend {
         }
         if (isClassLike) {
             try {
-                // Run both incoming-ref queries in parallel — they are independent.
-                const [ctorIncoming, fileIncoming] = await Promise.all([
+                // Run incoming-ref queries in parallel — they are independent.
+                const [ctorIncoming, fileIncoming, typedPropertyIncoming, typedProperties] = await Promise.all([
                     executeParameterized(repo.id, `
             MATCH (n)-[hm:CodeRelation]->(ctor:Constructor)
             WHERE n.id = $symId AND hm.type = 'HAS_METHOD'
             MATCH (caller)-[r:CodeRelation]->(ctor)
-            WHERE r.type IN ['CALLS', 'IMPORTS', 'EXTENDS', 'IMPLEMENTS', 'ACCESSES']
+            WHERE r.type IN ['CALLS', 'IMPORTS', 'EXTENDS', 'IMPLEMENTS', 'USES', 'ACCESSES']
             RETURN r.type AS relType, caller.id AS uid, caller.name AS name, caller.filePath AS filePath, labels(caller)[0] AS kind
             LIMIT 30
           `, { symId }),
@@ -1494,12 +1495,40 @@ export class LocalBackend {
             RETURN r.type AS relType, caller.id AS uid, caller.name AS name, caller.filePath AS filePath, labels(caller)[0] AS kind
             LIMIT 30
           `, { symId }),
+                    executeParameterized(repo.id, `
+            MATCH (p:\`Property\`)
+            WHERE p.declaredType = $name
+               OR p.declaredType STARTS WITH $genericPrefix
+               OR p.declaredType CONTAINS $genericArg
+            MATCH (caller)-[r:CodeRelation]->(p)
+            WHERE r.type IN ['CALLS', 'IMPORTS', 'EXTENDS', 'IMPLEMENTS', 'USES', 'ACCESSES']
+            RETURN r.type AS relType, caller.id AS uid, caller.name AS name, caller.filePath AS filePath, labels(caller)[0] AS kind
+            LIMIT 30
+          `, {
+                        name: sym.name,
+                        genericPrefix: `${sym.name}<`,
+                        genericArg: `<${sym.name}>`,
+                    }),
+                    executeParameterized(repo.id, `
+            MATCH (p:\`Property\`)
+            WHERE p.declaredType = $name
+               OR p.declaredType STARTS WITH $genericPrefix
+               OR p.declaredType CONTAINS $genericArg
+            RETURN p.id AS uid, p.name AS name, p.filePath AS filePath, labels(p)[0] AS kind,
+                   p.declaredType AS declaredType
+            LIMIT 30
+          `, {
+                        name: sym.name,
+                        genericPrefix: `${sym.name}<`,
+                        genericArg: `<${sym.name}>`,
+                    }),
                 ]);
+                typedPropertyRows = typedProperties;
                 // Deduplicate by (relType, uid) — a caller can have multiple relation
                 // types to the same target (e.g. both IMPORTS and CALLS), and each
                 // must be preserved so every category appears in the output.
                 const seenKeys = new Set(incomingRows.map((r) => `${r.relType || r[0]}:${r.uid || r[1]}`));
-                for (const r of [...ctorIncoming, ...fileIncoming]) {
+                for (const r of [...ctorIncoming, ...fileIncoming, ...typedPropertyIncoming]) {
                     const key = `${r.relType || r[0]}:${r.uid || r[1]}`;
                     if (!seenKeys.has(key)) {
                         seenKeys.add(key);
@@ -1514,7 +1543,7 @@ export class LocalBackend {
         // Categorized outgoing refs
         const outgoingRows = await executeParameterized(repo.id, `
       MATCH (n {id: $symId})-[r:CodeRelation]->(target)
-      WHERE r.type IN ['CALLS', 'IMPORTS', 'EXTENDS', 'IMPLEMENTS', 'HAS_METHOD', 'HAS_PROPERTY', 'METHOD_OVERRIDES', 'OVERRIDES', 'METHOD_IMPLEMENTS', 'ACCESSES']
+      WHERE r.type IN ['CALLS', 'IMPORTS', 'EXTENDS', 'IMPLEMENTS', 'USES', 'HAS_METHOD', 'HAS_PROPERTY', 'METHOD_OVERRIDES', 'OVERRIDES', 'METHOD_IMPLEMENTS', 'ACCESSES']
       RETURN r.type AS relType, target.id AS uid, target.name AS name, target.filePath AS filePath, labels(target)[0] AS kind
       LIMIT 30
     `, { symId });
@@ -1593,6 +1622,17 @@ export class LocalBackend {
             },
             incoming: categorize(incomingRows),
             outgoing: categorize(outgoingRows),
+            ...(typedPropertyRows.length > 0
+                ? {
+                    typed_properties: typedPropertyRows.map((r) => ({
+                        uid: r.uid || r[0],
+                        name: r.name || r[1],
+                        filePath: r.filePath || r[2],
+                        kind: r.kind || r[3],
+                        declaredType: r.declaredType || r[4],
+                    })),
+                }
+                : {}),
             processes: processRows.map((r) => ({
                 id: r.pid || r[0],
                 name: r.label || r[1],
@@ -2024,6 +2064,7 @@ export class LocalBackend {
         const maxDepth = params.maxDepth || 3;
         // Map legacy relation type names before filtering (backward compat for OVERRIDES → METHOD_OVERRIDES)
         const mappedRelTypes = params.relationTypes?.flatMap((t) => t === 'OVERRIDES' ? ['OVERRIDES', 'METHOD_OVERRIDES'] : [t]);
+        const hasExplicitRelationTypes = mappedRelTypes !== undefined && mappedRelTypes.length > 0;
         const rawRelTypes = mappedRelTypes && mappedRelTypes.length > 0
             ? mappedRelTypes.filter((t) => VALID_RELATION_TYPES.has(t))
             : [
@@ -2031,6 +2072,7 @@ export class LocalBackend {
                 'IMPORTS',
                 'EXTENDS',
                 'IMPLEMENTS',
+                'USES',
                 'METHOD_OVERRIDES',
                 'OVERRIDES',
                 'METHOD_IMPLEMENTS',
@@ -2042,6 +2084,7 @@ export class LocalBackend {
                 'IMPORTS',
                 'EXTENDS',
                 'IMPLEMENTS',
+                'USES',
                 'METHOD_OVERRIDES',
                 'OVERRIDES',
                 'METHOD_IMPLEMENTS',
@@ -2092,9 +2135,14 @@ export class LocalBackend {
             filePath: outcome.symbol.filePath,
         };
         const symType = outcome.resolvedLabel || outcome.symbol.type || '';
+        const effectiveRelationTypes = (symType === 'Class' || symType === 'Interface') &&
+            !hasExplicitRelationTypes &&
+            !relationTypes.includes('ACCESSES')
+            ? [...relationTypes, 'ACCESSES']
+            : relationTypes;
         return this._runImpactBFS(repo, sym, symType, direction, {
             maxDepth,
-            relationTypes,
+            relationTypes: effectiveRelationTypes,
             includeTests,
             minConfidence,
         });
@@ -2149,6 +2197,24 @@ export class LocalBackend {
                         frontier.push(rid);
                     }
                 }
+                const typedPropertyRows = await executeParameterized(repo.id, `
+          MATCH (p:\`Property\`)
+          WHERE p.declaredType = $name
+             OR p.declaredType STARTS WITH $genericPrefix
+             OR p.declaredType CONTAINS $genericArg
+          RETURN p.id AS id, p.name AS name, labels(p)[0] AS type, p.filePath AS filePath
+        `, {
+                    name: sym.name,
+                    genericPrefix: `${sym.name}<`,
+                    genericArg: `<${sym.name}>`,
+                });
+                for (const r of typedPropertyRows) {
+                    const rid = r.id || r[0];
+                    if (rid && !visited.has(rid)) {
+                        visited.add(rid);
+                        frontier.push(rid);
+                    }
+                }
             }
             catch (e) {
                 logQueryError('impact:class-node-expansion', e);

package/dist/server/api.js

@@ -638,7 +638,11 @@ export const createServer = async (port, host = '127.0.0.1') => {
                     (job.repoPath && path.basename(job.repoPath).toLowerCase() === lower);
                 if (isMatch && ['queued', 'cloning', 'analyzing'].includes(job.status)) {
                     if (process.env.DEBUG) {
-                        console.log(`[debug] resolveRepo waiting for active job ${job.id} (${normalizedName})...`);
+                        // Sanitize user-controlled values to prevent log injection (CodeQL js/log-injection).
+                        logger.debug({
+                            jobId: String(job.id).replace(/[\r\n]/g, ' '),
+                            repoName: String(normalizedName).replace(/[\r\n]/g, ' '),
+                        }, '[debug] resolveRepo waiting for active job');
                     }
                     for (let wait = 0; wait < HOLD_QUEUE_TIMEOUT_SECS; wait++) {
                         if (clientGone)
@@ -662,7 +666,8 @@ export const createServer = async (port, host = '127.0.0.1') => {
         // (e.g. registry file not yet flushed after clone completes).
         if (!found && normalizedName && !isRetry) {
             if (process.env.DEBUG) {
-                console.log(`[debug] resolveRepo 404 for "${normalizedName}". Triggering deep init...`);
+                // Sanitize user-controlled values to prevent log injection (CodeQL js/log-injection).
+                logger.debug({ repoName: String(normalizedName).replace(/[\r\n]/g, ' ') }, '[debug] resolveRepo 404, triggering deep init');
             }
             await backend.init();
             return await resolveRepo(normalizedName, true, req);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.4-rc.98",
+  "version": "1.6.4",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -116,6 +116,6 @@
     }
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   }
 }

package/vendor/node_modules/node-addon-api/node_addon_api.target.mk

@@ -34,16 +34,17 @@ CFLAGS_C_Debug :=
 CFLAGS_CC_Debug := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 DEFS_Release := \
 	'-DNODE_GYP_MODULE_NAME=node_addon_api' \
@@ -75,16 +76,17 @@ CFLAGS_C_Release :=
 CFLAGS_CC_Release := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 OBJS :=
 

package/vendor/node_modules/node-addon-api/node_addon_api_except.target.mk

@@ -34,16 +34,17 @@ CFLAGS_C_Debug :=
 CFLAGS_CC_Debug := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 DEFS_Release := \
 	'-DNODE_GYP_MODULE_NAME=node_addon_api_except' \
@@ -75,16 +76,17 @@ CFLAGS_C_Release :=
 CFLAGS_CC_Release := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 OBJS :=