gitnexus 1.6.5-rc.2 → 1.6.5-rc.21

package/dist/core/run-analyze.js

@@ -10,10 +10,15 @@
  */
 import path from 'path';
 import fs from 'fs/promises';
+import { execFileSync } from 'child_process';
 import { runPipelineFromRepo } from './ingestion/pipeline.js';
-import { initLbug, loadGraphToLbug, getLbugStats, executeQuery, executeWithReusedStatement, closeLbug, loadCachedEmbeddings, } from './lbug/lbug-adapter.js';
+import { initLbug, loadGraphToLbug, getLbugStats, executeQuery, executeWithReusedStatement, closeLbug, loadCachedEmbeddings, deleteNodesForFile, deleteAllCommunitiesAndProcesses, queryImporters, } from './lbug/lbug-adapter.js';
 import { createSearchFTSIndexes } from './search/fts-indexes.js';
-import { getStoragePaths, saveMeta, loadMeta, ensureGitNexusIgnored, registerRepo, cleanupOldKuzuFiles, } from '../storage/repo-manager.js';
+import { getStoragePaths, saveMeta, loadMeta, ensureGitNexusIgnored, registerRepo, cleanupOldKuzuFiles, INCREMENTAL_SCHEMA_VERSION, } from '../storage/repo-manager.js';
+import { computeFileHashes, diffFileHashes } from '../storage/file-hash.js';
+import { extractChangedSubgraph, computeEffectiveWriteSet, } from './incremental/subgraph-extract.js';
+import { shadowCandidatesFor } from './incremental/shadow-candidates.js';
+import { loadParseCache, saveParseCache, pruneCache } from '../storage/parse-cache.js';
 import { getCurrentCommit, getRemoteUrl, hasGitDir, getInferredRepoName, resolveRepoIdentityRoot, } from '../storage/git.js';
 import { generateAIContextFiles } from '../cli/ai-context.js';
 import { EMBEDDING_TABLE_NAME } from './lbug/schema.js';
@@ -63,22 +68,74 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
     const repoHasGit = hasGitDir(repoPath);
     const currentCommit = repoHasGit ? getCurrentCommit(repoPath) : '';
     const existingMeta = await loadMeta(storagePath);
+    // ── Crash recovery: dirty flag forces full rebuild ────────────────
+    // If the previous incremental run set incrementalInProgress and didn't
+    // clear it, the on-disk index may be in a half-state. Cheapest path
+    // back to a known-good index is to wipe + rebuild from scratch.
+    if (existingMeta?.incrementalInProgress) {
+        log('Previous incremental run did not complete cleanly (incrementalInProgress flag set); ' +
+            'forcing full rebuild to restore a known-good index.');
+        options = { ...options, force: true };
+        // Reload meta after clearing the flag in-memory; we still want fileHashes
+        // for the post-rebuild meta carry-over, but force=true ensures the
+        // rebuild path executes.
+    }
     // ── Early-return: already up to date ──────────────────────────────
     if (existingMeta && !options.force && existingMeta.lastCommit === currentCommit) {
         // Non-git folders have currentCommit = '' — always rebuild since we can't detect changes
         if (currentCommit !== '') {
-            await ensureGitNexusIgnored(repoPath);
-            return {
-                // `resolveRepoIdentityRoot` collapses worktree roots to the
-                // canonical repo basename (#1259) but leaves arbitrary subdirs
-                // and `--skip-git` paths unchanged (#1232/#1233 intent preserved).
-                repoName: options.registryName ??
-                    getInferredRepoName(repoPath) ??
-                    path.basename(resolveRepoIdentityRoot(repoPath)),
-                repoPath,
-                stats: existingMeta.stats ?? {},
-                alreadyUpToDate: true,
-            };
+            // For git repos, even if HEAD matches lastCommit, the working tree
+            // may have uncommitted changes. Only short-circuit when the working
+            // tree is also clean — otherwise fall through to the incremental
+            // path which will hash-diff and update only changed files.
+            //
+            // We exclude paths that GitNexus itself writes during analyze:
+            //   .gitnexus/                  — db / parse cache / meta.json
+            //   .claude/, .cursor/          — auto-generated agent skill files
+            //   AGENTS.md, CLAUDE.md        — auto-updated stats blocks
+            // Counting them as dirty would perpetually defeat the up-to-date
+            // fast path because the previous analyze just wrote them
+            // (regression vs PR #1233 behavior).
+            const dirty = (() => {
+                try {
+                    const out = execFileSync('git', [
+                        'status',
+                        '--porcelain',
+                        '--',
+                        '.',
+                        ':(exclude).gitnexus',
+                        ':(exclude).gitnexus/**',
+                        ':(exclude).claude',
+                        ':(exclude).claude/**',
+                        ':(exclude).cursor',
+                        ':(exclude).cursor/**',
+                        ':(exclude)AGENTS.md',
+                        ':(exclude)CLAUDE.md',
+                    ], {
+                        cwd: repoPath,
+                        stdio: ['ignore', 'pipe', 'ignore'],
+                        encoding: 'utf8',
+                    });
+                    return out.trim().length > 0;
+                }
+                catch {
+                    return true; // conservative on git failure
+                }
+            })();
+            if (!dirty) {
+                await ensureGitNexusIgnored(repoPath);
+                return {
+                    // `resolveRepoIdentityRoot` collapses worktree roots to the
+                    // canonical repo basename (#1259) but leaves arbitrary subdirs
+                    // and `--skip-git` paths unchanged (#1232/#1233 intent preserved).
+                    repoName: options.registryName ??
+                        getInferredRepoName(repoPath) ??
+                        path.basename(resolveRepoIdentityRoot(repoPath)),
+                    repoPath,
+                    stats: existingMeta.stats ?? {},
+                    alreadyUpToDate: true,
+                };
+            }
         }
     }
     // ── Cache embeddings from existing index before rebuild ────────────
@@ -114,6 +171,14 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
             `Pass --embeddings to also generate embeddings for new/changed nodes, ` +
             `or --drop-embeddings to wipe them.`);
     }
+    // We *always* load the embedding cache when one is requested (regardless
+    // of the predicted `willTryIncremental`). The post-pipeline branch may
+    // disagree with the prediction (e.g. when the pipeline produces zero
+    // File nodes, `isIncremental` flips false and the full-rebuild path
+    // wipes the DB) — loading unconditionally is cheap insurance against
+    // silently dropping embeddings on a mispredicted run. The re-insert
+    // step gates itself on the actual `isIncremental` value to avoid
+    // PK-conflicts when the incremental writeback path keeps the rows.
     if (shouldLoadCache && existingMeta) {
         try {
             progress('embeddings', 0, 'Caching embeddings...');
@@ -140,23 +205,77 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
             }
         }
     }
+    // ── Load incremental parse cache ──────────────────────────────────
+    // Content-addressed: safe to reuse across `--force` runs (chunks whose
+    // file contents haven't changed produce identical worker output).
+    // Loaded into a single ParseCache object that the pipeline mutates
+    // in-place (cache hits leave entries unchanged; misses add new ones).
+    const parseCache = await loadParseCache(storagePath);
     // ── Phase 1: Full Pipeline (0–60%) ────────────────────────────────
     const pipelineResult = await runPipelineFromRepo(repoPath, (p) => {
         const phaseLabel = PHASE_LABELS[p.phase] || p.phase;
         const scaled = Math.round(p.percent * 0.6);
-        const message = p.detail ? `${p.message || phaseLabel} (${p.detail})` : p.message || phaseLabel;
+        const message = p.detail
+            ? `${p.message || phaseLabel} (${p.detail})`
+            : p.message || phaseLabel;
         progress(p.phase, scaled, message);
-    });
+    }, { parseCache });
     // ── Phase 2: LadybugDB (60–85%) ──────────────────────────────────
     progress('lbug', 60, 'Loading into LadybugDB...');
-    await closeLbug();
-    const lbugFiles = [lbugPath, `${lbugPath}.wal`, `${lbugPath}.lock`];
-    for (const f of lbugFiles) {
-        try {
-            await fs.rm(f, { recursive: true, force: true });
+    // Compute current per-file content hashes from the pipeline's File nodes.
+    // Used both to drive the incremental DB writeback (when eligible) and to
+    // populate meta.json.fileHashes for the next run.
+    const allFilePaths = [];
+    pipelineResult.graph.forEachNode((n) => {
+        if (n.label === 'File') {
+            const fp = n.properties?.filePath;
+            if (fp)
+                allFilePaths.push(fp);
         }
-        catch {
-            /* swallow */
+    });
+    const newFileHashes = await computeFileHashes(repoPath, allFilePaths);
+    // Decide incremental vs full at THIS point (post-pipeline, pre-DB).
+    // All eligibility conditions are checked here against the actual
+    // pipeline output — no separate pre-pipeline prediction to desync from
+    // (Bugbot review on PR #1479: a prediction that flipped post-pipeline
+    // could skip the embedding cache load and then take the full-rebuild
+    // path, silently losing embeddings).
+    const isIncremental = !options.force &&
+        !!existingMeta &&
+        existingMeta.schemaVersion === INCREMENTAL_SCHEMA_VERSION &&
+        !!existingMeta.fileHashes &&
+        Object.keys(existingMeta.fileHashes).length > 0 &&
+        repoHasGit &&
+        allFilePaths.length > 0;
+    const hashDiff = isIncremental
+        ? diffFileHashes(newFileHashes, existingMeta.fileHashes)
+        : undefined;
+    if (isIncremental && hashDiff) {
+        log(`Incremental: changed=${hashDiff.changed.length}, ` +
+            `added=${hashDiff.added.length}, ` +
+            `deleted=${hashDiff.deleted.length} ` +
+            `(skipping wipe + ${allFilePaths.length - hashDiff.toWrite.length} unchanged file rows preserved)`);
+        // Set the dirty flag BEFORE any destructive DB mutation. Cleared on
+        // success at the meta-save step.
+        await saveMeta(storagePath, {
+            ...existingMeta,
+            incrementalInProgress: {
+                startedAt: Date.now(),
+                toWriteCount: hashDiff.toWrite.length,
+            },
+        });
+    }
+    else {
+        // Full rebuild path: wipe DB files first.
+        await closeLbug();
+        const lbugFiles = [lbugPath, `${lbugPath}.wal`, `${lbugPath}.lock`];
+        for (const f of lbugFiles) {
+            try {
+                await fs.rm(f, { recursive: true, force: true });
+            }
+            catch {
+                /* swallow */
+            }
         }
     }
     await initLbug(lbugPath);
@@ -165,16 +284,158 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
         // is called even if an error occurs — the module-level singleton DB handle
         // must be released to avoid blocking subsequent invocations.
         let lbugMsgCount = 0;
-        await loadGraphToLbug(pipelineResult.graph, pipelineResult.repoPath, storagePath, (msg) => {
-            lbugMsgCount++;
-            const pct = Math.min(84, 60 + Math.round((lbugMsgCount / (lbugMsgCount + 10)) * 24));
-            progress('lbug', pct, msg);
-        });
+        if (isIncremental && hashDiff) {
+            // ── Incremental DB writeback ───────────────────────────────────
+            // 0. Expand the writable set with transitive importers of
+            //    changed/deleted files (bounded BFS).
+            //
+            //    Reason (Bugbot/Claude review on PR #1479): when a barrel /
+            //    re-export file C changes, cross-file resolution may update
+            //    CALLS edges between two unchanged files A and B (A imports
+            //    from C, C re-exports something from B). Those refined edges
+            //    live in `ctx.graph` but would be excluded from the subgraph
+            //    if neither endpoint is in the changed set. To catch this,
+            //    files that imported (directly OR transitively, through
+            //    other unchanged intermediaries) any changed file get pulled
+            //    into the writable set so their rows are deleted + rewritten
+            //    against the refined edges.
+            //
+            //    BFS bound: MAX_IMPORTER_BFS_DEPTH. Practically sized to
+            //    catch nested barrel chains (e.g. `index.ts → submodule/index.ts
+            //    → submodule/impl.ts`) without ballooning into a near-full-
+            //    rebuild on monorepos with deep re-export pyramids. Beyond
+            //    this depth, the "incremental ≡ full-rebuild" invariant is
+            //    self-acknowledged as best-effort; `--force` remains the
+            //    escape hatch documented in GUARDRAILS.md.
+            //
+            //    `queryImporters` reads `IMPORTS` from the pre-pipeline DB
+            //    state, so the result is "files that USED TO import the
+            //    target" — exactly the set whose previously-stored edges may
+            //    no longer match what cross-file resolution produces this run.
+            const MAX_IMPORTER_BFS_DEPTH = 4;
+            const writableFiles = new Set(hashDiff.toWrite);
+            const directlyChangedCount = writableFiles.size;
+            // Shadow-seed: for ADDED files, queryImporters returns 0 (the new
+            // file has no IMPORTS rows in the pre-pipeline DB yet). But pre-
+            // existing unchanged files may have IMPORTS edges whose module-
+            // resolution claim the newcomer can steal under standard JS/TS
+            // resolution (Bugbot review on PR #1479). For each added file we
+            // derive the shadow candidates and, if the candidate was a known
+            // file in the prior meta, seed it into the BFS frontier so its
+            // importers — surfaced via queryImporters — get their CALLS edges
+            // re-resolved against the new file. See shadow-candidates.ts for
+            // the full pattern catalogue.
+            const priorFileSet = new Set(existingMeta?.fileHashes ? Object.keys(existingMeta.fileHashes) : []);
+            const shadowSeed = [];
+            for (const added of hashDiff.added) {
+                for (const cand of shadowCandidatesFor(added)) {
+                    if (priorFileSet.has(cand) && !writableFiles.has(cand)) {
+                        shadowSeed.push(cand);
+                    }
+                }
+            }
+            {
+                let frontier = [...hashDiff.toWrite, ...hashDiff.deleted, ...shadowSeed];
+                for (let depth = 0; depth < MAX_IMPORTER_BFS_DEPTH && frontier.length > 0; depth++) {
+                    const nextFrontier = [];
+                    for (const f of frontier) {
+                        try {
+                            const importers = await queryImporters(f);
+                            for (const i of importers) {
+                                if (!writableFiles.has(i)) {
+                                    writableFiles.add(i);
+                                    nextFrontier.push(i);
+                                }
+                            }
+                        }
+                        catch {
+                            /* per-file importer query failure → skip; correctness degrades on
+                               that branch, but DB stays writable. */
+                        }
+                    }
+                    frontier = nextFrontier;
+                }
+            }
+            const importerExpansion = writableFiles.size - directlyChangedCount;
+            if (importerExpansion > 0) {
+                log(`Incremental: +${importerExpansion} importer(s) added to writable set ` +
+                    `(BFS depth ≤ ${MAX_IMPORTER_BFS_DEPTH}` +
+                    (shadowSeed.length > 0 ? `, ${shadowSeed.length} shadow-seed(s)` : '') +
+                    `)`);
+            }
+            // 1. Compute the EFFECTIVE write-set (Finding 1). Two layers,
+            //    composed:
+            //      (a) `writableFiles` — toWrite ∪ transitive importers of
+            //          changed/deleted files (the bounded BFS above, reading
+            //          IMPORTS from the pre-pipeline DB).
+            //      (b) `computeEffectiveWriteSet` — walks the NEW graph's
+            //          edges and pulls in any unchanged-side file that sits
+            //          on a writable-boundary-crossing edge (catches refined
+            //          cross-file CALLS edges that the pre-run DB couldn't
+            //          predict, e.g. a barrel re-export shifting `foo` from
+            //          B to D).
+            //    The composed set is the input to BOTH deleteNodesForFile
+            //    and extractChangedSubgraph — asymmetry between the two would
+            //    leave stale rows or PK-conflict at COPY time.
+            const effectiveWriteSet = computeEffectiveWriteSet(pipelineResult.graph, writableFiles);
+            // Deduped: deleted entries may already appear via importer-BFS
+            // expansion (queryImporters can return a now-deleted path), which
+            // would otherwise call deleteNodesForFile twice for the same file
+            // (Bugbot LOW finding on PR #1479).
+            const filesToDelete = [...new Set([...effectiveWriteSet, ...hashDiff.deleted])];
+            for (let i = 0; i < filesToDelete.length; i++) {
+                const f = filesToDelete[i];
+                try {
+                    await deleteNodesForFile(f);
+                }
+                catch {
+                    /* file may not have rows (e.g. an unparseable file) — fine */
+                }
+                if (i % 20 === 0) {
+                    progress('lbug', 62, `Removing rows for changed files (${i}/${filesToDelete.length})...`);
+                }
+            }
+            // 2. Drop graph-wide nodes (Community, Process). They'll be re-inserted
+            //    from the fresh pipeline output below. Required for the
+            //    "Leiden runs on the FULL graph" correctness invariant.
+            await deleteAllCommunitiesAndProcesses();
+            // 3. Extract the changed subgraph from the FULL ctx.graph and write
+            //    only that. Unchanged-file rows in the DB stay untouched. Pass
+            //    the SAME effectiveWriteSet so the subgraph and the deletes
+            //    cover identical files (asymmetry would silently corrupt).
+            const subgraph = extractChangedSubgraph(pipelineResult.graph, effectiveWriteSet);
+            await loadGraphToLbug(subgraph, pipelineResult.repoPath, storagePath, (msg) => {
+                lbugMsgCount++;
+                const pct = Math.min(84, 65 + Math.round((lbugMsgCount / (lbugMsgCount + 10)) * 19));
+                progress('lbug', pct, msg);
+            });
+        }
+        else {
+            // ── Full rebuild ───────────────────────────────────────────────
+            await loadGraphToLbug(pipelineResult.graph, pipelineResult.repoPath, storagePath, (msg) => {
+                lbugMsgCount++;
+                const pct = Math.min(84, 60 + Math.round((lbugMsgCount / (lbugMsgCount + 10)) * 24));
+                progress('lbug', pct, msg);
+            });
+        }
         // ── Phase 3: FTS (85–90%) ─────────────────────────────────────────
         progress('fts', 85, 'Creating search indexes...');
         await createSearchFTSIndexes();
         progress('fts', 90, 'Search indexes ready');
         // ── Phase 3.5: Re-insert cached embeddings ────────────────────────
+        // Runs on BOTH the full-rebuild path and the incremental path:
+        //   - Full rebuild: DB was wiped, every cached row needs to come back.
+        //   - Incremental:  changed-file rows were just deleted by
+        //                   deleteNodesForFile (which cascades to their
+        //                   embedding rows) — so their cached vectors need
+        //                   to come back too. Unchanged-file rows still
+        //                   exist; re-inserting their cached vectors would
+        //                   PK-conflict, but the per-batch try/catch below
+        //                   silently ignores those (matches the existing
+        //                   "some may fail if node was removed, that's
+        //                   fine" semantics). Bugbot review on PR #1479
+        //                   flagged that gating this on `!isIncremental`
+        //                   silently lost changed-file embeddings.
         if (cachedEmbeddings.length > 0) {
             const cachedDims = cachedEmbeddings[0].embedding.length;
             const { EMBEDDING_DIMS } = await import('./lbug/schema.js');
@@ -286,6 +547,11 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
         const runtimeCapabilities = getRuntimeCapabilities();
         const effectiveSemanticMode = semanticMode ??
             (runtimeCapabilities.semanticMode === 'vector-index' ? 'vector-index' : 'exact-scan');
+        // Convert the post-run file-hash map to the on-disk Record<string,string>
+        // shape consumed by RepoMeta.fileHashes.
+        const newFileHashesRecord = {};
+        for (const [k, v] of newFileHashes)
+            newFileHashesRecord[k] = v;
         const meta = {
             repoPath,
             lastCommit: currentCommit,
@@ -315,8 +581,32 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
                     reason: runtimeCapabilities.reason,
                 },
             },
+            // Incremental-indexing fields. Populated for git repos so the next
+            // analyze run can take the incremental DB-writeback path. Setting
+            // incrementalInProgress to undefined explicitly clears any prior
+            // dirty flag (full and incremental success paths converge here).
+            schemaVersion: hasGitDir(repoPath) ? INCREMENTAL_SCHEMA_VERSION : undefined,
+            fileHashes: hasGitDir(repoPath) ? newFileHashesRecord : undefined,
+            incrementalInProgress: undefined,
         };
         await saveMeta(storagePath, meta);
+        // Persist the incremental parse cache for the next run. Wraps in
+        // try/catch so a cache-write failure never breaks an otherwise
+        // successful indexing run. Prune stale chunk-hash entries first so
+        // the cache file size stays bounded across runs (chunks whose
+        // composition no longer matches anything in the current scan are
+        // dead weight; the parse phase populates `usedKeys` as it processes
+        // chunks).
+        try {
+            const pruned = pruneCache(parseCache, parseCache.usedKeys);
+            if (pruned > 0) {
+                log(`Parse cache: pruned ${pruned} stale chunk entries`);
+            }
+            await saveParseCache(storagePath, parseCache);
+        }
+        catch (e) {
+            log(`Warning: could not save parse cache (${e.message}); continuing.`);
+        }
         // Forward the --name alias and the registry-collision bypass bit.
         // `allowDuplicateName` is its own concern — independent from the
         // pipeline `force` above. The CLI maps it from
@@ -350,7 +640,11 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
                 communities: pipelineResult.communityResult?.stats.totalCommunities,
                 clusters: aggregatedClusterCount,
                 processes: pipelineResult.processResult?.stats.totalProcesses,
-            }, undefined, { skipAgentsMd: options.skipAgentsMd, noStats: options.noStats });
+            }, undefined, {
+                skipAgentsMd: options.skipAgentsMd,
+                skipSkills: options.skipSkills,
+                noStats: options.noStats,
+            });
         }
         catch {
             // Best-effort — don't fail the entire analysis for context file issues

package/dist/core/tree-sitter/safe-parse.d.ts

@@ -0,0 +1,6 @@
+import type Parser from 'tree-sitter';
+/**
+ * Parse `sourceText` safely on every platform. See {@link SAFE_PARSE_CHUNK_CHARS}
+ * for the underlying tree-sitter binding bug this works around.
+ */
+export declare function parseSourceSafe(parser: Parser, sourceText: string, oldTree?: Parser.Tree, options?: Parser.Options): Parser.Tree;

package/dist/core/tree-sitter/safe-parse.js

@@ -0,0 +1,32 @@
+/**
+ * tree-sitter 0.21.x's Node native binding crashes (SIGSEGV) on Windows when
+ * `parser.parse(string, …)` is handed a JS string longer than 32 767 chars.
+ * The crash happens inside the binding's V8 string-to-buffer conversion and
+ * cannot be intercepted from JavaScript. The callback (`Parser.Input`) overload
+ * pulls source in fixed-size chunks via repeated callback invocations and
+ * bypasses that conversion path entirely.
+ *
+ * Chunk size is comfortably below the boundary; any value < 32 767 works.
+ */
+const SAFE_PARSE_CHUNK_CHARS = 16 * 1024;
+/**
+ * Files at or below this length skip the callback machinery and use the
+ * direct string overload — the bug only manifests above the int16 boundary,
+ * so small inputs save the cost of N callback invocations per parse.
+ */
+const DIRECT_PARSE_LIMIT_CHARS = 16 * 1024;
+/**
+ * Parse `sourceText` safely on every platform. See {@link SAFE_PARSE_CHUNK_CHARS}
+ * for the underlying tree-sitter binding bug this works around.
+ */
+export function parseSourceSafe(parser, sourceText, oldTree, options) {
+    if (sourceText.length <= DIRECT_PARSE_LIMIT_CHARS) {
+        return parser.parse(sourceText, oldTree, options);
+    }
+    const input = (index) => {
+        if (index >= sourceText.length)
+            return null;
+        return sourceText.slice(index, index + SAFE_PARSE_CHUNK_CHARS);
+    };
+    return parser.parse(input, oldTree, options);
+}

package/dist/server/git-clone.js

@@ -10,6 +10,7 @@ import os from 'os';
 import fs from 'fs/promises';
 import { isIP } from 'net';
 import { logger } from '../core/logger.js';
+import { parseRepoNameFromUrl } from '../storage/git.js';
 /** Root directory for all cloned repositories. Targets must resolve inside this. */
 const CLONE_ROOT = path.resolve(path.join(os.homedir(), '.gitnexus', 'repos'));
 // A valid git repository name is filesystem-safe: alphanumerics plus `. _ -`.
@@ -25,19 +26,15 @@ const REPO_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
  * clone root via path traversal.
  */
 export function extractRepoName(url) {
-    // Strip trailing slashes without a regex to avoid polynomial-ReDoS on
-    // pathological inputs like `https://x.com/y` + '/'.repeat(1e6). CodeQL's
-    // js/polynomial-redos flagged `/\/+$/` here.
-    let end = url.length;
-    while (end > 0 && url.charCodeAt(end - 1) === 47 /* '/' */)
-        end--;
-    const cleaned = url.slice(0, end);
-    const lastSegment = cleaned.split(/[/:]/).pop() || '';
-    const stripped = lastSegment.endsWith('.git') ? lastSegment.slice(0, -4) : lastSegment;
-    if (!stripped || stripped === '.' || stripped === '..' || !REPO_NAME_PATTERN.test(stripped)) {
+    const name = parseRepoNameFromUrl(url);
+    if (!name ||
+        name === '.' ||
+        name === '..' ||
+        name === 'unknown' ||
+        !REPO_NAME_PATTERN.test(name)) {
         throw new Error('Could not extract a valid repository name from URL');
     }
-    return stripped;
+    return name;
 }
 /** Get the clone target directory for a repo name. */
 export function getCloneDir(repoName) {
@@ -347,8 +344,8 @@ export async function cloneOrPull(url, targetDir, onProgress) {
         throw new Error(`Clone target must be a subdirectory of ${CLONE_ROOT}`);
     }
     // Always validate the requested URL — the prior shape only ran this in
-    // the clone branch, leaving the pull branch as an SSRF / blocked-host
-    // bypass when an existing clone shared the basename of an attacker URL.
+    // the code path where the repo was cloned. Now it runs unconditionally,
+    // preventing SSRF / blocked-host bypasses even when targetDir already exists.
     validateGitUrl(url);
     const exists = await fs.access(path.join(safeTarget, '.git')).then(() => true, () => false);
     if (exists) {

package/dist/storage/file-hash.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Per-file content hashing for incremental DB writeback.
+ *
+ * On every analyze run we compute SHA-256 of every file's content and
+ * store the map in meta.json. The next run compares disk against the
+ * stored map and produces:
+ *   - `changed` — content differs (re-emit DB rows for this file)
+ *   - `added`   — file is new on disk (insert DB rows)
+ *   - `deleted` — file was in last meta but no longer on disk (drop rows)
+ *
+ * The pipeline still parses every file (correctness invariant: cross-file
+ * resolution needs full data). What this enables is a SELECTIVE DB
+ * writeback: instead of wipe-and-reload of the whole graph (~50s of CSV
+ * COPY on a 25K-node repo), we only delete-and-rewrite rows for the
+ * changed/added/deleted set.
+ *
+ * See docs/superpowers/specs/2026-05-10-incremental-indexing-design.md
+ * (Option B revision).
+ */
+/**
+ * Compute SHA-256 of a single file. Returns null when the file can't be
+ * read — caller treats that as "no signature, assume changed".
+ */
+export declare const computeFileHash: (absPath: string) => Promise<string | null>;
+/**
+ * Compute SHA-256 hashes for many files in parallel batches. Files that
+ * fail to read are omitted from the result map.
+ */
+export declare const computeFileHashes: (repoPath: string, relPaths: readonly string[]) => Promise<Map<string, string>>;
+/** Result of comparing the current on-disk hashes against stored ones. */
+export interface FileHashDiff {
+    /** Files whose content hash differs from stored. */
+    changed: string[];
+    /** Files in the current scan that weren't in the stored map. */
+    added: string[];
+    /** Files in the stored map that aren't in the current scan. */
+    deleted: string[];
+    /** All files whose DB rows must be replaced (changed ∪ added). */
+    toWrite: string[];
+}
+/**
+ * Diff a current hash map against a previously stored one.
+ *
+ * Sorted output so two runs produce identical diff arrays for the same
+ * changes — useful for stable logging / equivalence checks.
+ */
+export declare const diffFileHashes: (current: ReadonlyMap<string, string>, stored: Readonly<Record<string, string>> | undefined) => FileHashDiff;

package/dist/storage/file-hash.js

@@ -0,0 +1,86 @@
+/**
+ * Per-file content hashing for incremental DB writeback.
+ *
+ * On every analyze run we compute SHA-256 of every file's content and
+ * store the map in meta.json. The next run compares disk against the
+ * stored map and produces:
+ *   - `changed` — content differs (re-emit DB rows for this file)
+ *   - `added`   — file is new on disk (insert DB rows)
+ *   - `deleted` — file was in last meta but no longer on disk (drop rows)
+ *
+ * The pipeline still parses every file (correctness invariant: cross-file
+ * resolution needs full data). What this enables is a SELECTIVE DB
+ * writeback: instead of wipe-and-reload of the whole graph (~50s of CSV
+ * COPY on a 25K-node repo), we only delete-and-rewrite rows for the
+ * changed/added/deleted set.
+ *
+ * See docs/superpowers/specs/2026-05-10-incremental-indexing-design.md
+ * (Option B revision).
+ */
+import { createHash } from 'crypto';
+import fs from 'fs/promises';
+import path from 'path';
+/**
+ * Compute SHA-256 of a single file. Returns null when the file can't be
+ * read — caller treats that as "no signature, assume changed".
+ */
+export const computeFileHash = async (absPath) => {
+    try {
+        const buf = await fs.readFile(absPath);
+        return createHash('sha256').update(buf).digest('hex');
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Compute SHA-256 hashes for many files in parallel batches. Files that
+ * fail to read are omitted from the result map.
+ */
+export const computeFileHashes = async (repoPath, relPaths) => {
+    const out = new Map();
+    const BATCH = 100;
+    for (let i = 0; i < relPaths.length; i += BATCH) {
+        const batch = relPaths.slice(i, i + BATCH);
+        const results = await Promise.all(batch.map(async (rel) => {
+            const h = await computeFileHash(path.join(repoPath, rel));
+            return h ? [rel, h] : null;
+        }));
+        for (const r of results)
+            if (r)
+                out.set(r[0], r[1]);
+    }
+    return out;
+};
+/**
+ * Diff a current hash map against a previously stored one.
+ *
+ * Sorted output so two runs produce identical diff arrays for the same
+ * changes — useful for stable logging / equivalence checks.
+ */
+export const diffFileHashes = (current, stored) => {
+    const storedMap = new Map(stored ? Object.entries(stored) : []);
+    const changed = [];
+    const added = [];
+    for (const [p, h] of current) {
+        const prev = storedMap.get(p);
+        if (prev === undefined)
+            added.push(p);
+        else if (prev !== h)
+            changed.push(p);
+    }
+    const deleted = [];
+    for (const p of storedMap.keys()) {
+        if (!current.has(p))
+            deleted.push(p);
+    }
+    changed.sort();
+    added.sort();
+    deleted.sort();
+    return {
+        changed,
+        added,
+        deleted,
+        toWrite: [...changed, ...added].sort(),
+    };
+};