gitnexus 1.6.5-rc.4 → 1.6.5-rc.6

package/dist/core/ingestion/languages/c/arity-metadata.d.ts

@@ -0,0 +1,14 @@
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+export interface CArityInfo {
+    parameterCount?: number;
+    requiredParameterCount?: number;
+    parameterTypes?: string[];
+}
+/**
+ * Compute declaration arity from a C function definition or declaration node.
+ */
+export declare function computeCDeclarationArity(node: SyntaxNode): CArityInfo;
+/**
+ * Compute call-site arity from a call_expression node.
+ */
+export declare function computeCCallArity(node: SyntaxNode): number;

package/dist/core/ingestion/languages/c/arity-metadata.js

@@ -0,0 +1,94 @@
+/**
+ * Compute declaration arity from a C function definition or declaration node.
+ */
+export function computeCDeclarationArity(node) {
+    // Find the function_declarator child (may be wrapped in pointer_declarator)
+    const funcDecl = findFuncDeclarator(node);
+    if (funcDecl === null)
+        return {};
+    const paramList = funcDecl.childForFieldName('parameters');
+    if (paramList === null)
+        return {};
+    const params = [];
+    for (let i = 0; i < paramList.childCount; i++) {
+        const child = paramList.child(i);
+        if (child === null)
+            continue;
+        if (child.type === 'parameter_declaration' || child.type === 'variadic_parameter') {
+            params.push(child);
+        }
+    }
+    // K&R old-style declaration: `int foo()` has an empty parameter_list with
+    // no parameter_declaration or variadic_parameter children. Per C89/C99,
+    // this means the function accepts an unspecified number/types of arguments —
+    // NOT zero arguments. Return unknown arity to avoid false 'incompatible'.
+    // `int foo(void)` is the explicit zero-parameter form and is handled below.
+    if (params.length === 0)
+        return {};
+    // (void) means zero parameters
+    if (params.length === 1 && params[0].type === 'parameter_declaration') {
+        const typeNode = params[0].childForFieldName('type');
+        const hasDeclarator = params[0].childForFieldName('declarator') !== null;
+        if (typeNode !== null && typeNode.text === 'void' && !hasDeclarator) {
+            return { parameterCount: 0, requiredParameterCount: 0, parameterTypes: [] };
+        }
+    }
+    const isVariadic = params.some((p) => p.type === 'variadic_parameter');
+    const nonVariadicCount = params.filter((p) => p.type !== 'variadic_parameter').length;
+    const types = [];
+    for (const p of params) {
+        if (p.type === 'variadic_parameter') {
+            types.push('...');
+        }
+        else {
+            const typeNode = p.childForFieldName('type');
+            types.push(typeNode?.text ?? 'unknown');
+        }
+    }
+    return {
+        parameterCount: isVariadic ? undefined : nonVariadicCount,
+        requiredParameterCount: nonVariadicCount,
+        parameterTypes: types,
+    };
+}
+/**
+ * Compute call-site arity from a call_expression node.
+ */
+export function computeCCallArity(node) {
+    const argList = node.childForFieldName('arguments');
+    if (argList === null)
+        return 0;
+    let count = 0;
+    for (let i = 0; i < argList.childCount; i++) {
+        const child = argList.child(i);
+        if (child === null)
+            continue;
+        // Skip punctuation (commas, parens)
+        if (child.type !== ',' && child.type !== '(' && child.type !== ')') {
+            count++;
+        }
+    }
+    return count;
+}
+function findFuncDeclarator(node) {
+    // Direct child
+    let decl = node.childForFieldName('declarator');
+    if (decl === null) {
+        for (let i = 0; i < node.childCount; i++) {
+            const c = node.child(i);
+            if (c?.type === 'function_declarator')
+                return c;
+        }
+        return null;
+    }
+    // Unwrap pointer_declarator
+    while (decl.type === 'pointer_declarator') {
+        const next = decl.childForFieldName('declarator');
+        if (next === null)
+            break;
+        decl = next;
+    }
+    if (decl.type === 'function_declarator')
+        return decl;
+    return null;
+}

package/dist/core/ingestion/languages/c/arity.d.ts

@@ -0,0 +1,6 @@
+import type { Callsite, SymbolDefinition } from '../../../../_shared/index.js';
+/**
+ * C arity compatibility: no overloading. Variadic functions detected
+ * via '...' in parameterTypes. Otherwise exact match or unknown.
+ */
+export declare function cArityCompatibility(def: SymbolDefinition, callsite: Callsite): 'compatible' | 'unknown' | 'incompatible';

package/dist/core/ingestion/languages/c/arity.js

@@ -0,0 +1,18 @@
+/**
+ * C arity compatibility: no overloading. Variadic functions detected
+ * via '...' in parameterTypes. Otherwise exact match or unknown.
+ */
+export function cArityCompatibility(def, callsite) {
+    const max = def.parameterCount;
+    const min = def.requiredParameterCount;
+    if (max === undefined && min === undefined)
+        return 'unknown';
+    if (!Number.isFinite(callsite.arity) || callsite.arity < 0)
+        return 'unknown';
+    const variadic = def.parameterTypes?.some((t) => t === '...') ?? false;
+    if (min !== undefined && callsite.arity < min)
+        return 'incompatible';
+    if (max !== undefined && callsite.arity > max && !variadic)
+        return 'incompatible';
+    return 'compatible';
+}

package/dist/core/ingestion/languages/c/captures.d.ts

@@ -0,0 +1,2 @@
+import type { CaptureMatch } from '../../../../_shared/index.js';
+export declare function emitCScopeCaptures(sourceText: string, filePath: string, cachedTree?: unknown): readonly CaptureMatch[];

package/dist/core/ingestion/languages/c/captures.js

@@ -0,0 +1,105 @@
+import { findNodeAtRange, nodeToCapture, syntheticCapture, } from '../../utils/ast-helpers.js';
+import { getCParser, getCScopeQuery } from './query.js';
+import { getTreeSitterBufferSize } from '../../constants.js';
+import { parseSourceSafe } from '../../../tree-sitter/safe-parse.js';
+import { splitCInclude } from './import-decomposer.js';
+import { computeCDeclarationArity, computeCCallArity } from './arity-metadata.js';
+import { markStaticName } from './static-linkage.js';
+export function emitCScopeCaptures(sourceText, filePath, cachedTree) {
+    let tree = cachedTree;
+    if (tree === undefined) {
+        tree = parseSourceSafe(getCParser(), sourceText, undefined, {
+            bufferSize: getTreeSitterBufferSize(sourceText),
+        });
+    }
+    const rawMatches = getCScopeQuery().matches(tree.rootNode);
+    const out = [];
+    // Track ranges where typedef-struct/union was captured as @declaration.struct/union
+    // so we can suppress the duplicate @declaration.typedef match at the same range.
+    const structTypedefRanges = new Set();
+    for (const m of rawMatches) {
+        const grouped = {};
+        for (const c of m.captures) {
+            const tag = '@' + c.name;
+            if (tag.startsWith('@_'))
+                continue;
+            grouped[tag] = nodeToCapture(tag, c.node);
+        }
+        if (Object.keys(grouped).length === 0)
+            continue;
+        // Handle #include statements
+        if (grouped['@import.statement'] !== undefined) {
+            const anchor = grouped['@import.statement'];
+            const includeNode = findNodeAtRange(tree.rootNode, anchor.range, 'preproc_include');
+            if (includeNode !== null) {
+                const split = splitCInclude(includeNode);
+                if (split !== null) {
+                    out.push(split);
+                    continue;
+                }
+            }
+        }
+        // Track typedef-struct ranges to suppress duplicate typedef declarations
+        const structAnchor = grouped['@declaration.struct'] ?? grouped['@declaration.union'];
+        if (structAnchor !== undefined) {
+            const r = structAnchor.range;
+            structTypedefRanges.add(`${r.startLine}:${r.startCol}:${r.endLine}:${r.endCol}`);
+        }
+        // Suppress @declaration.typedef if the same range was already captured as struct/union
+        const typedefAnchor = grouped['@declaration.typedef'];
+        if (typedefAnchor !== undefined) {
+            const r = typedefAnchor.range;
+            const key = `${r.startLine}:${r.startCol}:${r.endLine}:${r.endCol}`;
+            if (structTypedefRanges.has(key))
+                continue;
+        }
+        // Enrich function declarations with arity metadata and detect static linkage
+        const declAnchor = grouped['@declaration.function'];
+        if (declAnchor !== undefined) {
+            const fnNode = findNodeAtRange(tree.rootNode, declAnchor.range, 'function_definition') ??
+                findNodeAtRange(tree.rootNode, declAnchor.range, 'declaration');
+            if (fnNode !== null) {
+                const arity = computeCDeclarationArity(fnNode);
+                if (arity.parameterCount !== undefined) {
+                    grouped['@declaration.parameter-count'] = syntheticCapture('@declaration.parameter-count', fnNode, String(arity.parameterCount));
+                }
+                if (arity.requiredParameterCount !== undefined) {
+                    grouped['@declaration.required-parameter-count'] = syntheticCapture('@declaration.required-parameter-count', fnNode, String(arity.requiredParameterCount));
+                }
+                if (arity.parameterTypes !== undefined) {
+                    grouped['@declaration.parameter-types'] = syntheticCapture('@declaration.parameter-types', fnNode, JSON.stringify(arity.parameterTypes));
+                }
+                // Detect static storage class (file-local linkage)
+                if (hasStaticStorageClass(fnNode)) {
+                    const nameText = grouped['@declaration.name']?.text;
+                    if (nameText !== undefined) {
+                        markStaticName(filePath, nameText);
+                    }
+                }
+            }
+        }
+        // Enrich call references with arity
+        const callAnchor = grouped['@reference.call.free'] ?? grouped['@reference.call.member'];
+        if (callAnchor !== undefined && grouped['@reference.arity'] === undefined) {
+            const callNode = findNodeAtRange(tree.rootNode, callAnchor.range, 'call_expression');
+            if (callNode !== null) {
+                grouped['@reference.arity'] = syntheticCapture('@reference.arity', callNode, String(computeCCallArity(callNode)));
+            }
+        }
+        out.push(grouped);
+    }
+    return out;
+}
+/**
+ * Check if a C function_definition or declaration has `static` storage class.
+ * Walks direct children for a `storage_class_specifier` node with text `static`.
+ */
+function hasStaticStorageClass(node) {
+    for (let i = 0; i < node.childCount; i++) {
+        const child = node.child(i);
+        if (child !== null && child.type === 'storage_class_specifier' && child.text === 'static') {
+            return true;
+        }
+    }
+    return false;
+}

package/dist/core/ingestion/languages/c/header-scan.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Walk `repoPath` recursively and return relative paths of all `.h` files.
+ * Used by `loadResolutionConfig` so the C resolver can resolve `#include`
+ * targets that live in `.h` files (classified as C++ by language detection
+ * but importable from `.c` files).
+ */
+export declare function scanHeaderFiles(repoPath: string): ReadonlySet<string>;

package/dist/core/ingestion/languages/c/header-scan.js

@@ -0,0 +1,55 @@
+import { readdirSync } from 'fs';
+import { join, relative } from 'path';
+/** C header extensions to scan for in the workspace. */
+const HEADER_EXTENSIONS = new Set(['.h']);
+/**
+ * Walk `repoPath` recursively and return relative paths of all `.h` files.
+ * Used by `loadResolutionConfig` so the C resolver can resolve `#include`
+ * targets that live in `.h` files (classified as C++ by language detection
+ * but importable from `.c` files).
+ */
+export function scanHeaderFiles(repoPath) {
+    const headers = new Set();
+    walk(repoPath, repoPath, headers);
+    return headers;
+}
+function walk(dir, root, out) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true, encoding: 'utf8' });
+    }
+    catch {
+        return; // permission denied, etc.
+    }
+    for (const entry of entries) {
+        const name = entry.name;
+        const full = join(dir, name);
+        if (entry.isDirectory()) {
+            // Skip common non-source directories and build output dirs.
+            // Build dirs (dist, build, out, target, _build, .next, cmake-build-*)
+            // may contain generated headers that shadow source headers.
+            if (name === 'node_modules' ||
+                name === '.git' ||
+                name === 'vendor' ||
+                name === 'dist' ||
+                name === 'build' ||
+                name === 'out' ||
+                name === 'target' ||
+                name === '_build' ||
+                name === '.next' ||
+                name.startsWith('cmake-build')) {
+                continue;
+            }
+            walk(full, root, out);
+        }
+        else if (entry.isFile()) {
+            const ext = name.slice(name.lastIndexOf('.'));
+            if (HEADER_EXTENSIONS.has(ext)) {
+                // Normalize to forward slashes for cross-platform consistency.
+                // path.relative() returns backslash-separated paths on Windows,
+                // but the scope-resolution pipeline uses forward slashes uniformly.
+                out.add(relative(root, full).replace(/\\/g, '/'));
+            }
+        }
+    }
+}

package/dist/core/ingestion/languages/c/import-decomposer.d.ts

@@ -0,0 +1,8 @@
+import type { CaptureMatch } from '../../../../_shared/index.js';
+import { type SyntaxNode } from '../../utils/ast-helpers.js';
+/**
+ * Decompose a `preproc_include` node into a CaptureMatch with structured
+ * import captures. C #include maps to a wildcard import (all symbols
+ * from the header are visible).
+ */
+export declare function splitCInclude(node: SyntaxNode): CaptureMatch | null;

package/dist/core/ingestion/languages/c/import-decomposer.js

@@ -0,0 +1,50 @@
+import { nodeToCapture, syntheticCapture } from '../../utils/ast-helpers.js';
+/**
+ * Decompose a `preproc_include` node into a CaptureMatch with structured
+ * import captures. C #include maps to a wildcard import (all symbols
+ * from the header are visible).
+ */
+export function splitCInclude(node) {
+    // node.type === 'preproc_include'
+    // path field: (string_literal (string_content)) | (system_lib_string)
+    const pathNode = node.childForFieldName?.('path') ?? null;
+    if (pathNode === null) {
+        // Fallback: scan children
+        for (let i = 0; i < node.childCount; i++) {
+            const child = node.child(i);
+            if (child === null)
+                continue;
+            if (child.type === 'string_literal' || child.type === 'system_lib_string') {
+                return buildIncludeCapture(node, child);
+            }
+        }
+        return null;
+    }
+    return buildIncludeCapture(node, pathNode);
+}
+function buildIncludeCapture(node, pathNode) {
+    let raw;
+    if (pathNode.type === 'string_literal') {
+        // string_literal has children: `"`, string_content, `"`
+        // Use namedChildren to find the string_content node
+        const content = pathNode.namedChildren.find((c) => c.type === 'string_content');
+        raw = content?.text ?? pathNode.text.replace(/^"|"$/g, '');
+    }
+    else {
+        // system_lib_string: <stdio.h> → strip angle brackets
+        raw = pathNode.text;
+        if (raw.startsWith('<') && raw.endsWith('>')) {
+            raw = raw.slice(1, -1);
+        }
+    }
+    const isSystem = pathNode.type === 'system_lib_string';
+    const result = {
+        '@import.statement': nodeToCapture('@import.statement', node),
+        '@import.kind': syntheticCapture('@import.kind', node, 'wildcard'),
+        '@import.source': syntheticCapture('@import.source', node, raw),
+    };
+    if (isSystem) {
+        result['@import.system'] = syntheticCapture('@import.system', node, 'true');
+    }
+    return result;
+}

package/dist/core/ingestion/languages/c/import-target.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolve a C #include path to a file in the workspace.
+ *
+ * Strategy:
+ * 1. Check for a same-directory sibling relative to the including file
+ *    (matches C compiler `#include "…"` relative-lookup semantics).
+ * 2. Check for an exact match (path as-is in the workspace).
+ * 3. Fall back to suffix matching against all workspace file paths.
+ *    Tie-breaking: prefer the match with the fewest path components
+ *    (closest to root). On equal depth, break ties lexicographically
+ *    by normalized path to ensure deterministic resolution regardless
+ *    of filesystem iteration order.
+ */
+export declare function resolveCImportTarget(targetRaw: string, fromFile: string, allFilePaths: ReadonlySet<string>): string | null;

package/dist/core/ingestion/languages/c/import-target.js

@@ -0,0 +1,57 @@
+import { dirname, join } from 'path';
+/**
+ * Resolve a C #include path to a file in the workspace.
+ *
+ * Strategy:
+ * 1. Check for a same-directory sibling relative to the including file
+ *    (matches C compiler `#include "…"` relative-lookup semantics).
+ * 2. Check for an exact match (path as-is in the workspace).
+ * 3. Fall back to suffix matching against all workspace file paths.
+ *    Tie-breaking: prefer the match with the fewest path components
+ *    (closest to root). On equal depth, break ties lexicographically
+ *    by normalized path to ensure deterministic resolution regardless
+ *    of filesystem iteration order.
+ */
+export function resolveCImportTarget(targetRaw, fromFile, allFilePaths) {
+    if (!targetRaw)
+        return null;
+    const normalizedTarget = targetRaw.replace(/\\/g, '/');
+    // Same-directory sibling first: mirrors the C compiler's #include "…"
+    // relative-lookup semantics where the directory of the including
+    // file is searched before the include-path list.
+    if (fromFile) {
+        const siblingRaw = join(dirname(fromFile), targetRaw);
+        const sibling = siblingRaw.replace(/\\/g, '/');
+        if (allFilePaths.has(sibling))
+            return sibling;
+        // When targetRaw contains backslashes, the normalized form may
+        // resolve to a different sibling path — try it as well.
+        if (targetRaw !== normalizedTarget) {
+            const siblingAlt = join(dirname(fromFile), normalizedTarget);
+            const siblingAltNorm = siblingAlt.replace(/\\/g, '/');
+            if (allFilePaths.has(siblingAltNorm))
+                return siblingAltNorm;
+        }
+    }
+    // Exact match (path as-is in the workspace)
+    if (allFilePaths.has(normalizedTarget))
+        return normalizedTarget;
+    // Suffix match: find files ending with /targetRaw or equal to targetRaw
+    const suffix = '/' + normalizedTarget;
+    let bestMatch = null;
+    let bestDepth = Infinity;
+    let bestNormalized = '';
+    for (const filePath of allFilePaths) {
+        const normalized = filePath.replace(/\\/g, '/');
+        if (normalized === normalizedTarget || normalized.endsWith(suffix)) {
+            // Prefer shortest path (closest match)
+            const depth = normalized.split('/').length;
+            if (depth < bestDepth || (depth === bestDepth && normalized < bestNormalized)) {
+                bestDepth = depth;
+                bestMatch = filePath;
+                bestNormalized = normalized;
+            }
+        }
+    }
+    return bestMatch;
+}

package/dist/core/ingestion/languages/c/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * C scope-resolution hooks (RFC #909 Ring 3).
+ */
+export { emitCScopeCaptures } from './captures.js';
+export { interpretCImport, interpretCTypeBinding, normalizeCTypeName } from './interpret.js';
+export { splitCInclude } from './import-decomposer.js';
+export { cArityCompatibility } from './arity.js';
+export { cMergeBindings } from './merge-bindings.js';
+export { cBindingScopeFor, cImportOwningScope, cReceiverBinding } from './simple-hooks.js';
+export { resolveCImportTarget } from './import-target.js';
+export { markStaticName, isStaticName, clearStaticNames, expandCWildcardNames, } from './static-linkage.js';

package/dist/core/ingestion/languages/c/index.js

@@ -0,0 +1,11 @@
+/**
+ * C scope-resolution hooks (RFC #909 Ring 3).
+ */
+export { emitCScopeCaptures } from './captures.js';
+export { interpretCImport, interpretCTypeBinding, normalizeCTypeName } from './interpret.js';
+export { splitCInclude } from './import-decomposer.js';
+export { cArityCompatibility } from './arity.js';
+export { cMergeBindings } from './merge-bindings.js';
+export { cBindingScopeFor, cImportOwningScope, cReceiverBinding } from './simple-hooks.js';
+export { resolveCImportTarget } from './import-target.js';
+export { markStaticName, isStaticName, clearStaticNames, expandCWildcardNames, } from './static-linkage.js';

package/dist/core/ingestion/languages/c/interpret.d.ts

@@ -0,0 +1,14 @@
+import type { CaptureMatch, ParsedImport, ParsedTypeBinding } from '../../../../_shared/index.js';
+/**
+ * Interpret a C #include capture into a ParsedImport.
+ * C includes are always wildcard imports (all symbols from the header).
+ */
+export declare function interpretCImport(captures: CaptureMatch): ParsedImport | null;
+/**
+ * Interpret a C type-binding capture into a ParsedTypeBinding.
+ */
+export declare function interpretCTypeBinding(captures: CaptureMatch): ParsedTypeBinding | null;
+/**
+ * Normalize a C type name: strip pointer/array syntax, qualifiers.
+ */
+export declare function normalizeCTypeName(text: string): string;

package/dist/core/ingestion/languages/c/interpret.js

@@ -0,0 +1,48 @@
+/**
+ * Interpret a C #include capture into a ParsedImport.
+ * C includes are always wildcard imports (all symbols from the header).
+ */
+export function interpretCImport(captures) {
+    const source = captures['@import.source']?.text;
+    if (source === undefined)
+        return null;
+    // System headers (e.g. <stdio.h>) are not resolved to local files
+    if (captures['@import.system'] !== undefined)
+        return null;
+    return { kind: 'wildcard', targetRaw: source };
+}
+/**
+ * Interpret a C type-binding capture into a ParsedTypeBinding.
+ */
+export function interpretCTypeBinding(captures) {
+    const name = captures['@type-binding.name']?.text;
+    const type = captures['@type-binding.type']?.text;
+    if (name === undefined || type === undefined)
+        return null;
+    let source = 'annotation';
+    if (captures['@type-binding.parameter'] !== undefined) {
+        source = 'parameter-annotation';
+    }
+    else if (captures['@type-binding.assignment'] !== undefined) {
+        source = 'assignment-inferred';
+    }
+    return { boundName: name, rawTypeName: normalizeCTypeName(type), source };
+}
+/**
+ * Normalize a C type name: strip pointer/array syntax, qualifiers.
+ */
+export function normalizeCTypeName(text) {
+    let t = text.trim();
+    // Strip const, volatile, restrict qualifiers
+    t = t.replace(/\b(const|volatile|restrict|static|extern|inline)\b/g, '').trim();
+    // Strip pointer stars
+    while (t.endsWith('*'))
+        t = t.slice(0, -1).trim();
+    while (t.startsWith('*'))
+        t = t.slice(1).trim();
+    // Strip array brackets
+    t = t.replace(/\[.*?\]/g, '').trim();
+    // Strip struct/union/enum prefixes
+    t = t.replace(/^(struct|union|enum)\s+/, '');
+    return t;
+}

package/dist/core/ingestion/languages/c/merge-bindings.d.ts

@@ -0,0 +1,7 @@
+import type { BindingRef } from '../../../../_shared/index.js';
+/**
+ * C merge bindings: simple first-wins by tier (local > import > wildcard).
+ * C has no namespaces or reexports, but the tiers are defined for
+ * compatibility with the shared infrastructure.
+ */
+export declare function cMergeBindings(existing: readonly BindingRef[], incoming: readonly BindingRef[], _scopeId: string): BindingRef[];

package/dist/core/ingestion/languages/c/merge-bindings.js

@@ -0,0 +1,23 @@
+const TIER = {
+    local: 0,
+    namespace: 1,
+    import: 2,
+    reexport: 3,
+    wildcard: 4,
+};
+/**
+ * C merge bindings: simple first-wins by tier (local > import > wildcard).
+ * C has no namespaces or reexports, but the tiers are defined for
+ * compatibility with the shared infrastructure.
+ */
+export function cMergeBindings(existing, incoming, _scopeId) {
+    const seen = new Set();
+    return [...existing, ...incoming]
+        .sort((a, b) => (TIER[a.origin] ?? 99) - (TIER[b.origin] ?? 99) || a.def.nodeId.localeCompare(b.def.nodeId))
+        .filter((binding) => {
+        if (seen.has(binding.def.nodeId))
+            return false;
+        seen.add(binding.def.nodeId);
+        return true;
+    });
+}

package/dist/core/ingestion/languages/c/query.d.ts

@@ -0,0 +1,3 @@
+import Parser from 'tree-sitter';
+export declare function getCParser(): Parser;
+export declare function getCScopeQuery(): Parser.Query;

package/dist/core/ingestion/languages/c/query.js

@@ -0,0 +1,161 @@
+import Parser from 'tree-sitter';
+import C from 'tree-sitter-c';
+const C_SCOPE_QUERY = `
+;; Scopes
+(translation_unit) @scope.module
+(struct_specifier) @scope.class
+(union_specifier) @scope.class
+(function_definition) @scope.function
+(compound_statement) @scope.block
+(if_statement) @scope.block
+(for_statement) @scope.block
+(while_statement) @scope.block
+(do_statement) @scope.block
+(switch_statement) @scope.block
+(case_statement) @scope.block
+
+;; Declarations — struct (named)
+(struct_specifier
+  name: (type_identifier) @declaration.name
+  body: (field_declaration_list)) @declaration.struct
+
+;; Declarations — struct (typedef struct { ... } Name)
+(type_definition
+  type: (struct_specifier
+    body: (field_declaration_list))
+  declarator: (type_identifier) @declaration.name) @declaration.struct
+
+;; Declarations — union (named)
+(union_specifier
+  name: (type_identifier) @declaration.name
+  body: (field_declaration_list)) @declaration.union
+
+;; Declarations — union (typedef union { ... } Name)
+(type_definition
+  type: (union_specifier
+    body: (field_declaration_list))
+  declarator: (type_identifier) @declaration.name) @declaration.union
+
+;; Declarations — enum
+(enum_specifier
+  name: (type_identifier) @declaration.name) @declaration.enum
+
+;; Declarations — function definition
+(function_definition
+  declarator: (function_declarator
+    declarator: (identifier) @declaration.name)) @declaration.function
+
+;; Declarations — function definition with pointer return
+(function_definition
+  declarator: (pointer_declarator
+    declarator: (function_declarator
+      declarator: (identifier) @declaration.name))) @declaration.function
+
+;; Declarations — function declaration (prototype)
+;; Note: Both prototypes and definitions are captured as @declaration.function.
+;; This may produce duplicate Function nodes in the knowledge graph when a
+;; function is declared in a header and defined in a .c file. CALLS edges
+;; resolve correctly through scope-based wildcard import chains; the
+;; duplication is a graph-quality concern only (no false edges).
+(declaration
+  declarator: (function_declarator
+    declarator: (identifier) @declaration.name)) @declaration.function
+
+;; Declarations — function declaration with pointer return (prototype)
+(declaration
+  declarator: (pointer_declarator
+    declarator: (function_declarator
+      declarator: (identifier) @declaration.name))) @declaration.function
+
+;; Declarations — typedef
+(type_definition
+  declarator: (type_identifier) @declaration.name) @declaration.typedef
+
+;; Declarations — typedef for function pointers: typedef void (*callback)(int, int)
+(type_definition
+  declarator: (function_declarator
+    declarator: (parenthesized_declarator
+      (pointer_declarator
+        declarator: (type_identifier) @declaration.name)))) @declaration.typedef
+
+;; Declarations — struct fields
+(field_declaration
+  declarator: (field_identifier) @declaration.name) @declaration.field
+
+;; Declarations — struct fields (pointer)
+(field_declaration
+  declarator: (pointer_declarator
+    declarator: (field_identifier) @declaration.name)) @declaration.field
+
+;; Declarations — variables (with initializer)
+(declaration
+  declarator: (init_declarator
+    declarator: (identifier) @declaration.name)) @declaration.variable
+
+;; Declarations — macro definitions
+(preproc_def
+  name: (identifier) @declaration.name) @declaration.macro
+
+(preproc_function_def
+  name: (identifier) @declaration.name) @declaration.macro
+
+;; Declarations — enum constants
+(enumerator
+  name: (identifier) @declaration.name) @declaration.const
+
+;; Imports
+(preproc_include) @import.statement
+
+;; Type bindings — parameter annotations
+(parameter_declaration
+  type: (_) @type-binding.type
+  declarator: (identifier) @type-binding.name) @type-binding.parameter
+
+;; Type bindings — variable with type (init_declarator)
+(declaration
+  type: (_) @type-binding.type
+  declarator: (init_declarator
+    declarator: (identifier) @type-binding.name)) @type-binding.assignment
+
+;; References — free calls
+;; Note: This also captures calls through function pointer variables (e.g. fp(x))
+;; since tree-sitter-c produces structurally identical AST nodes for both direct
+;; function calls and function-pointer-variable calls. A type-based guard to
+;; distinguish variable-calls from function-calls is not implemented — this is a
+;; known architectural trade-off shared with the Go resolver. The uniqueness
+;; constraint in pickUniqueGlobalCallable limits false edge exposure.
+(call_expression
+  function: (identifier) @reference.name) @reference.call.free
+
+;; References — member calls via pointer (ptr->func())
+(call_expression
+  function: (field_expression
+    argument: (_) @reference.receiver
+    field: (field_identifier) @reference.name)) @reference.call.member
+
+;; References — field reads
+(field_expression
+  argument: (_) @reference.receiver
+  field: (field_identifier) @reference.name) @reference.read
+
+;; References — field writes (assignment)
+(assignment_expression
+  left: (field_expression
+    argument: (_) @reference.receiver
+    field: (field_identifier) @reference.name)) @reference.write
+`;
+let _parser = null;
+let _query = null;
+export function getCParser() {
+    if (_parser === null) {
+        _parser = new Parser();
+        _parser.setLanguage(C);
+    }
+    return _parser;
+}
+export function getCScopeQuery() {
+    if (_query === null) {
+        _query = new Parser.Query(C, C_SCOPE_QUERY);
+    }
+    return _query;
+}

package/dist/core/ingestion/languages/c/scope-resolver.d.ts

@@ -0,0 +1,13 @@
+import type { ScopeResolver } from '../../scope-resolution/contract/scope-resolver.js';
+/**
+ * C `ScopeResolver` registered in `SCOPE_RESOLVERS` and consumed by
+ * the generic `runScopeResolution` orchestrator (RFC #909 Ring 3).
+ *
+ * C is a structurally simple language for scope resolution:
+ * - No classes (structs are value types, no method dispatch)
+ * - No inheritance (no MRO needed beyond the shared first-wins default)
+ * - No overloading (arity check is simple: variadic detection only)
+ * - `#include` is wildcard import (all symbols from header are visible)
+ * - `static` functions are file-local (not exported)
+ */
+export declare const cScopeResolver: ScopeResolver;

package/dist/core/ingestion/languages/c/scope-resolver.js

@@ -0,0 +1,60 @@
+import { SupportedLanguages } from '../../../../_shared/index.js';
+import { buildMro, defaultLinearize } from '../../scope-resolution/passes/mro.js';
+import { populateClassOwnedMembers } from '../../scope-resolution/scope/walkers.js';
+import { cProvider } from '../c-cpp.js';
+import { cArityCompatibility, cMergeBindings, resolveCImportTarget } from './index.js';
+import { scanHeaderFiles } from './header-scan.js';
+import { expandCWildcardNames, isStaticName, clearStaticNames } from './static-linkage.js';
+/**
+ * C `ScopeResolver` registered in `SCOPE_RESOLVERS` and consumed by
+ * the generic `runScopeResolution` orchestrator (RFC #909 Ring 3).
+ *
+ * C is a structurally simple language for scope resolution:
+ * - No classes (structs are value types, no method dispatch)
+ * - No inheritance (no MRO needed beyond the shared first-wins default)
+ * - No overloading (arity check is simple: variadic detection only)
+ * - `#include` is wildcard import (all symbols from header are visible)
+ * - `static` functions are file-local (not exported)
+ */
+export const cScopeResolver = {
+    language: SupportedLanguages.C,
+    languageProvider: cProvider,
+    importEdgeReason: 'c-scope: include',
+    loadResolutionConfig: (repoPath) => {
+        // Clear stale static-linkage data from any previous invocation to
+        // prevent cross-repo contamination in server-mode scenarios.
+        clearStaticNames();
+        return scanHeaderFiles(repoPath);
+    },
+    resolveImportTarget: (targetRaw, fromFile, allFilePaths, resolutionConfig) => {
+        // Augment allFilePaths with .h files discovered via loadResolutionConfig
+        // since the phase only passes .c files to the C resolver but #include
+        // targets .h files classified as C++ in language detection.
+        const headerPaths = resolutionConfig;
+        if (headerPaths !== undefined && headerPaths.size > 0) {
+            const augmented = new Set(allFilePaths);
+            for (const h of headerPaths)
+                augmented.add(h);
+            return resolveCImportTarget(targetRaw, fromFile, augmented);
+        }
+        return resolveCImportTarget(targetRaw, fromFile, allFilePaths);
+    },
+    expandsWildcardTo: (targetModuleScope, parsedFiles) => expandCWildcardNames(targetModuleScope, parsedFiles),
+    mergeBindings: (existing, incoming, scopeId) => cMergeBindings(existing, incoming, scopeId),
+    arityCompatibility: (callsite, def) => cArityCompatibility(def, callsite),
+    buildMro: (graph, parsedFiles, nodeLookup) => buildMro(graph, parsedFiles, nodeLookup, defaultLinearize),
+    populateOwners: (parsed) => populateClassOwnedMembers(parsed),
+    isSuperReceiver: () => false,
+    // C is statically typed — disable field fallback heuristic
+    fieldFallbackOnMethodLookup: false,
+    // C has no method return types to propagate
+    propagatesReturnTypesAcrossImports: false,
+    // C #include brings in all symbols — enable global free call fallback
+    allowGlobalFreeCallFallback: true,
+    // C `static` functions have file-local (translation-unit) linkage —
+    // exclude them from global free-call fallback cross-file resolution.
+    isFileLocalDef: (def) => {
+        const simple = def.qualifiedName?.split('.').pop() ?? def.qualifiedName ?? '';
+        return isStaticName(def.filePath, simple);
+    },
+};

package/dist/core/ingestion/languages/c/simple-hooks.d.ts

@@ -0,0 +1,14 @@
+import type { CaptureMatch, ParsedImport, Scope, ScopeId, ScopeTree, TypeRef } from '../../../../_shared/index.js';
+/**
+ * C binding scope: always use default auto-hoist (null).
+ * C has no self/receiver bindings that need special scoping.
+ */
+export declare function cBindingScopeFor(_decl: CaptureMatch, _innermost: Scope, _tree: ScopeTree): ScopeId | null;
+/**
+ * C import owning scope: always use default (null).
+ */
+export declare function cImportOwningScope(_imp: ParsedImport, _innermost: Scope, _tree: ScopeTree): ScopeId | null;
+/**
+ * C receiver binding: always null. C has no methods or receivers.
+ */
+export declare function cReceiverBinding(_functionScope: Scope): TypeRef | null;

package/dist/core/ingestion/languages/c/simple-hooks.js

@@ -0,0 +1,19 @@
+/**
+ * C binding scope: always use default auto-hoist (null).
+ * C has no self/receiver bindings that need special scoping.
+ */
+export function cBindingScopeFor(_decl, _innermost, _tree) {
+    return null;
+}
+/**
+ * C import owning scope: always use default (null).
+ */
+export function cImportOwningScope(_imp, _innermost, _tree) {
+    return null;
+}
+/**
+ * C receiver binding: always null. C has no methods or receivers.
+ */
+export function cReceiverBinding(_functionScope) {
+    return null;
+}

package/dist/core/ingestion/languages/c/static-linkage.d.ts

@@ -0,0 +1,13 @@
+import type { ParsedFile, ScopeId } from '../../../../_shared/index.js';
+/** Record a symbol name as `static` (file-local linkage) for the given file. */
+export declare function markStaticName(filePath: string, name: string): void;
+/** Check whether a symbol name has `static` linkage in the given file. */
+export declare function isStaticName(filePath: string, name: string): boolean;
+/** Clear tracked static names (for testing). */
+export declare function clearStaticNames(): void;
+/**
+ * Return the names visible through a C wildcard import (`#include`).
+ * All module-scope defs from the target file are visible EXCEPT those
+ * declared with `static` storage class (file-local linkage in C).
+ */
+export declare function expandCWildcardNames(targetModuleScope: ScopeId, parsedFiles: readonly ParsedFile[]): readonly string[];

package/dist/core/ingestion/languages/c/static-linkage.js

@@ -0,0 +1,57 @@
+/**
+ * Per-file set of function names declared with `static` storage class.
+ * Populated during `emitCScopeCaptures` and consumed by `expandCWildcardNames`
+ * to exclude file-local symbols from cross-file wildcard import visibility.
+ *
+ * NOTE: module-level state, single-process-single-repo use only.
+ * For server-mode or multi-repo-in-one-process use cases, call
+ * `clearStaticNames()` at the start of each resolution pass to avoid
+ * stale static-linkage data from a previous invocation.
+ *
+ * Key: filePath, Value: Set of static function names.
+ */
+const staticNames = new Map();
+/** Record a symbol name as `static` (file-local linkage) for the given file. */
+export function markStaticName(filePath, name) {
+    let names = staticNames.get(filePath);
+    if (names === undefined) {
+        names = new Set();
+        staticNames.set(filePath, names);
+    }
+    names.add(name);
+}
+/** Check whether a symbol name has `static` linkage in the given file. */
+export function isStaticName(filePath, name) {
+    return staticNames.get(filePath)?.has(name) ?? false;
+}
+/** Clear tracked static names (for testing). */
+export function clearStaticNames() {
+    staticNames.clear();
+}
+/**
+ * Return the names visible through a C wildcard import (`#include`).
+ * All module-scope defs from the target file are visible EXCEPT those
+ * declared with `static` storage class (file-local linkage in C).
+ */
+export function expandCWildcardNames(targetModuleScope, parsedFiles) {
+    const target = parsedFiles.find((p) => p.moduleScope === targetModuleScope);
+    if (target === undefined)
+        return [];
+    const seen = new Set();
+    const names = [];
+    for (const def of target.localDefs) {
+        const name = simpleName(def);
+        if (name === '')
+            continue;
+        if (isStaticName(target.filePath, name))
+            continue;
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        names.push(name);
+    }
+    return names;
+}
+function simpleName(def) {
+    return def.qualifiedName?.split('.').pop() ?? def.qualifiedName ?? '';
+}

package/dist/core/ingestion/languages/c-cpp.js

@@ -37,6 +37,7 @@ import { createCallExtractor } from '../call-extractors/generic.js';
 import { cCallConfig, cppCallConfig } from '../call-extractors/configs/c-cpp.js';
 import { createHeritageExtractor } from '../heritage-extractors/generic.js';
 import { stripUeMacros } from '../cpp-ue-preprocessor.js';
+import { emitCScopeCaptures, interpretCImport, interpretCTypeBinding, cArityCompatibility, cBindingScopeFor, cImportOwningScope, cReceiverBinding, } from './c/index.js';
 const C_BUILT_INS = new Set([
     'printf',
     'fprintf',
@@ -338,6 +339,15 @@ export const cProvider = defineLanguage({
     heritageExtractor: createHeritageExtractor(SupportedLanguages.C),
     labelOverride: cppLabelOverride,
     builtInNames: C_BUILT_INS,
+    // ── RFC #909 Ring 3: scope-based resolution hooks (RFC §5) ──────────
+    emitScopeCaptures: emitCScopeCaptures,
+    interpretImport: interpretCImport,
+    interpretTypeBinding: interpretCTypeBinding,
+    bindingScopeFor: cBindingScopeFor,
+    importOwningScope: cImportOwningScope,
+    receiverBinding: cReceiverBinding,
+    arityCompatibility: cArityCompatibility,
+    // mergeBindings + resolveImportTarget live on ScopeResolver (see c/scope-resolver.ts).
 });
 export const cppProvider = defineLanguage({
     id: SupportedLanguages.CPlusPlus,

package/dist/core/ingestion/registry-primary-flag.js

@@ -69,6 +69,7 @@ export const MIGRATED_LANGUAGES = new Set([
     SupportedLanguages.CSharp,
     SupportedLanguages.TypeScript,
     SupportedLanguages.Go,
+    SupportedLanguages.C,
 ]);
 /**
  * Return the env-var name that controls a given language's registry-

package/dist/core/ingestion/scope-resolution/contract/scope-resolver.d.ts

@@ -414,6 +414,17 @@ export interface ScopeResolver {
      * but is too loose as a default for strict module systems.
      */
     readonly allowGlobalFreeCallFallback?: boolean;
+    /**
+     * Optional predicate to identify definitions with file-local linkage
+     * (e.g. C `static` functions). When provided, `pickUniqueGlobalCallable`
+     * excludes defs where `isFileLocalDef(def) === true` and the def lives
+     * in a different file from the caller. This prevents the global free-call
+     * fallback from creating CALLS edges to file-local symbols that are
+     * logically invisible from the caller's translation unit.
+     *
+     * Languages without file-local linkage semantics leave this undefined.
+     */
+    readonly isFileLocalDef?: (def: SymbolDefinition) => boolean;
     /**
      * Optional post-finalize hook to inject cross-file bindings that
      * aren't modeled via explicit imports. Runs after

package/dist/core/ingestion/scope-resolution/passes/free-call-fallback.d.ts

@@ -16,7 +16,7 @@
  * Generic; promoted from `languages/python/scope-resolver.ts` per the scope-resolution
  * generalization plan.
  */
-import type { ParsedFile, Reference, ScopeId } from '../../../../_shared/index.js';
+import type { ParsedFile, Reference, ScopeId, SymbolDefinition } from '../../../../_shared/index.js';
 import type { KnowledgeGraph } from '../../../graph/types.js';
 import type { ScopeResolutionIndexes } from '../../model/scope-resolution-indexes.js';
 import type { SemanticModel } from '../../model/semantic-model.js';
@@ -26,4 +26,5 @@ export declare function emitFreeCallFallback(graph: KnowledgeGraph, scopes: Scop
     readonly bySourceScope: ReadonlyMap<ScopeId, readonly Reference[]>;
 }, handledSites: Set<string>, model: SemanticModel, workspaceIndex: WorkspaceResolutionIndex, options?: {
     readonly allowGlobalFallback?: boolean;
+    readonly isFileLocalDef?: (def: SymbolDefinition) => boolean;
 }): number;

package/dist/core/ingestion/scope-resolution/passes/free-call-fallback.js

@@ -55,7 +55,7 @@ export function emitFreeCallFallback(graph, scopes, parsedFiles, nodeLookup, _re
             // the caller does not import the target package. Same-package calls are
             // caught by findCallableBindingInScope above before reaching here.
             if (fnDef === undefined && options.allowGlobalFallback === true) {
-                fnDef = pickUniqueGlobalCallable(site.name, model, scopes);
+                fnDef = pickUniqueGlobalCallable(site.name, model, scopes, parsed.filePath, options.isFileLocalDef);
             }
             if (fnDef === undefined)
                 continue;
@@ -88,7 +88,7 @@ export function emitFreeCallFallback(graph, scopes, parsedFiles, nodeLookup, _re
     }
     return emitted;
 }
-function pickUniqueGlobalCallable(name, model, scopes) {
+function pickUniqueGlobalCallable(name, model, scopes, callerFilePath, isFileLocalDef) {
     const scopeDefs = [];
     const scopeSeen = new Set();
     for (const def of scopes.defs.byId.values()) {
@@ -97,6 +97,11 @@ function pickUniqueGlobalCallable(name, model, scopes) {
             continue;
         if (def.type !== 'Function' && def.type !== 'Method' && def.type !== 'Constructor')
             continue;
+        // Skip file-local defs (e.g. C `static` functions) that live in a
+        // different file from the caller — they are logically invisible.
+        if (isFileLocalDef !== undefined && def.filePath !== callerFilePath && isFileLocalDef(def)) {
+            continue;
+        }
         const key = logicalCallableKey(def);
         if (scopeSeen.has(key))
             continue;
@@ -109,6 +114,12 @@ function pickUniqueGlobalCallable(name, model, scopes) {
     const seen = new Set();
     const push = (pool) => {
         for (const def of pool) {
+            // Apply the same file-local linkage filter as Phase 1 —
+            // cross-file static defs must never leak through the
+            // SemanticModel fallback path.
+            if (isFileLocalDef !== undefined && def.filePath !== callerFilePath && isFileLocalDef(def)) {
+                continue;
+            }
             const key = logicalCallableKey(def);
             if (seen.has(key))
                 continue;

package/dist/core/ingestion/scope-resolution/pipeline/registry.js

@@ -13,6 +13,7 @@ import { pythonScopeResolver } from '../../languages/python/scope-resolver.js';
 import { csharpScopeResolver } from '../../languages/csharp/scope-resolver.js';
 import { typescriptScopeResolver } from '../../languages/typescript/scope-resolver.js';
 import { goScopeResolver } from '../../languages/go/scope-resolver.js';
+import { cScopeResolver } from '../../languages/c/scope-resolver.js';
 /** Map of `SupportedLanguages` → `ScopeResolver`. The phase iterates
  *  this map intersected with `MIGRATED_LANGUAGES` (the per-language
  *  flag set) so adding a resolver here without flipping the flag is
@@ -22,4 +23,5 @@ export const SCOPE_RESOLVERS = new Map([
     [SupportedLanguages.CSharp, csharpScopeResolver],
     [SupportedLanguages.TypeScript, typescriptScopeResolver],
     [SupportedLanguages.Go, goScopeResolver],
+    [SupportedLanguages.C, cScopeResolver],
 ]);

package/dist/core/ingestion/scope-resolution/pipeline/run.js

@@ -169,7 +169,10 @@ export function runScopeResolution(input, provider) {
     // ── Phase 4: emit graph edges (LOAD-BEARING ORDER — see I1) ────────────
     const handledSites = new Set();
     const receiverExtras = emitReceiverBoundCalls(graph, indexes, parsedFiles, nodeLookup, handledSites, provider, workspaceIndex, readonlyModel);
-    const freeCallExtras = emitFreeCallFallback(graph, indexes, parsedFiles, nodeLookup, referenceIndex, handledSites, readonlyModel, workspaceIndex, { allowGlobalFallback: provider.allowGlobalFreeCallFallback === true });
+    const freeCallExtras = emitFreeCallFallback(graph, indexes, parsedFiles, nodeLookup, referenceIndex, handledSites, readonlyModel, workspaceIndex, {
+        allowGlobalFallback: provider.allowGlobalFreeCallFallback === true,
+        isFileLocalDef: provider.isFileLocalDef,
+    });
     const { emitted, skipped } = emitReferencesViaLookup(graph, indexes, referenceIndex, nodeLookup, handledSites);
     const importsEmitted = emitImportEdges(graph, indexes.imports, indexes.scopeTree, provider.importEdgeReason);
     if (PROF) {

package/dist/server/git-clone.js

@@ -10,6 +10,7 @@ import os from 'os';
 import fs from 'fs/promises';
 import { isIP } from 'net';
 import { logger } from '../core/logger.js';
+import { parseRepoNameFromUrl } from '../storage/git.js';
 /** Root directory for all cloned repositories. Targets must resolve inside this. */
 const CLONE_ROOT = path.resolve(path.join(os.homedir(), '.gitnexus', 'repos'));
 // A valid git repository name is filesystem-safe: alphanumerics plus `. _ -`.
@@ -25,19 +26,15 @@ const REPO_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
  * clone root via path traversal.
  */
 export function extractRepoName(url) {
-    // Strip trailing slashes without a regex to avoid polynomial-ReDoS on
-    // pathological inputs like `https://x.com/y` + '/'.repeat(1e6). CodeQL's
-    // js/polynomial-redos flagged `/\/+$/` here.
-    let end = url.length;
-    while (end > 0 && url.charCodeAt(end - 1) === 47 /* '/' */)
-        end--;
-    const cleaned = url.slice(0, end);
-    const lastSegment = cleaned.split(/[/:]/).pop() || '';
-    const stripped = lastSegment.endsWith('.git') ? lastSegment.slice(0, -4) : lastSegment;
-    if (!stripped || stripped === '.' || stripped === '..' || !REPO_NAME_PATTERN.test(stripped)) {
+    const name = parseRepoNameFromUrl(url);
+    if (!name ||
+        name === '.' ||
+        name === '..' ||
+        name === 'unknown' ||
+        !REPO_NAME_PATTERN.test(name)) {
         throw new Error('Could not extract a valid repository name from URL');
     }
-    return stripped;
+    return name;
 }
 /** Get the clone target directory for a repo name. */
 export function getCloneDir(repoName) {
@@ -347,8 +344,8 @@ export async function cloneOrPull(url, targetDir, onProgress) {
         throw new Error(`Clone target must be a subdirectory of ${CLONE_ROOT}`);
     }
     // Always validate the requested URL — the prior shape only ran this in
-    // the clone branch, leaving the pull branch as an SSRF / blocked-host
-    // bypass when an existing clone shared the basename of an attacker URL.
+    // the code path where the repo was cloned. Now it runs unconditionally,
+    // preventing SSRF / blocked-host bypasses even when targetDir already exists.
     validateGitUrl(url);
     const exists = await fs.access(path.join(safeTarget, '.git')).then(() => true, () => false);
     if (exists) {

package/dist/storage/git.d.ts

@@ -108,13 +108,24 @@ export declare const hasGitDir: (dirPath: string) => boolean;
  */
 export declare const getRemoteOriginUrl: (repoPath: string) => string | null;
 /**
- * Parse a repository name out of a git remote URL. Handles the common
- * SSH (`git@host:owner/repo.git`), HTTPS (`https://host/owner/repo.git`),
- * `git://`, `ssh://`, and `file://` shapes. Returns `null` for empty /
- * unparseable input.
+ * Sanitize a repository name to prevent argument injection and ensure
+ * cross-platform filesystem compatibility.
  *
- * The heuristic: strip a trailing `.git` and trailing slashes, then
- * take the segment after the last `/` or `:`.
+ * 1. Strips leading dashes to prevent git command-line argument injection
+ *    (e.g., --upload-pack=evil).
+ * 2. Replaces characters that are unsafe for directory names across
+ *    platforms (Windows/macOS/Linux) with underscores.
+ * 3. Blocks path traversal segments ("." and "..") and Windows reserved
+ *    names (e.g., CON, NUL) to prevent directory escape.
+ */
+export declare const sanitizeRepoName: (name: string) => string;
+/**
+ * Parse a repository name out of a git remote URL. Handles common shapes
+ * including SSH (git@host:owner/repo.git) and HTTPS (https://host/owner/repo.git).
+ *
+ * Returns a sanitized, filesystem-safe name or null if no name could be inferred.
+ * Returning null (rather than 'unknown') allows callers to use ?? null-coalescing
+ * for fallbacks without risk of registry collisions on 'unknown'.
  */
 export declare const parseRepoNameFromUrl: (url: string | null | undefined) => string | null;
 /**

package/dist/storage/git.js

@@ -257,13 +257,36 @@ export const getRemoteOriginUrl = (repoPath) => {
     }
 };
 /**
- * Parse a repository name out of a git remote URL. Handles the common
- * SSH (`git@host:owner/repo.git`), HTTPS (`https://host/owner/repo.git`),
- * `git://`, `ssh://`, and `file://` shapes. Returns `null` for empty /
- * unparseable input.
+ * Sanitize a repository name to prevent argument injection and ensure
+ * cross-platform filesystem compatibility.
  *
- * The heuristic: strip a trailing `.git` and trailing slashes, then
- * take the segment after the last `/` or `:`.
+ * 1. Strips leading dashes to prevent git command-line argument injection
+ *    (e.g., --upload-pack=evil).
+ * 2. Replaces characters that are unsafe for directory names across
+ *    platforms (Windows/macOS/Linux) with underscores.
+ * 3. Blocks path traversal segments ("." and "..") and Windows reserved
+ *    names (e.g., CON, NUL) to prevent directory escape.
+ */
+export const sanitizeRepoName = (name) => {
+    // 1. Prevent argument injection by stripping leading dashes.
+    // 2. Remove characters that are not alphanumerics, dots, underscores, or dashes.
+    const sanitized = name.replace(/^-+/, '').replace(/[^a-zA-Z0-9._-]/g, '_');
+    // 3. Block path traversal segments and Windows reserved names.
+    // Windows reserved names like CON, PRN, AUX, NUL, COM1-9, LPT1-9 cannot
+    // be used as directory names on Windows even if they have an extension.
+    const reserved = /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\..*)?$/i;
+    if (!sanitized || sanitized === '.' || sanitized === '..' || reserved.test(sanitized)) {
+        return 'unknown';
+    }
+    return sanitized;
+};
+/**
+ * Parse a repository name out of a git remote URL. Handles common shapes
+ * including SSH (git@host:owner/repo.git) and HTTPS (https://host/owner/repo.git).
+ *
+ * Returns a sanitized, filesystem-safe name or null if no name could be inferred.
+ * Returning null (rather than 'unknown') allows callers to use ?? null-coalescing
+ * for fallbacks without risk of registry collisions on 'unknown'.
  */
 export const parseRepoNameFromUrl = (url) => {
     if (!url)
@@ -271,12 +294,23 @@ export const parseRepoNameFromUrl = (url) => {
     const trimmed = url.trim();
     if (!trimmed)
         return null;
-    // Strip `.git` suffix (case-insensitive) and any trailing slashes.
-    const withoutSuffix = trimmed.replace(/\.git\/*$/i, '').replace(/\/+$/, '');
-    // Last path segment, splitting on either `/` or `:` (covers SSH form).
-    const m = withoutSuffix.match(/[/:]([^/:]+)$/);
-    const candidate = m ? m[1] : withoutSuffix;
-    return candidate || null;
+    // Strip trailing slashes without a regex to avoid polynomial-ReDoS on
+    // pathological inputs like `https://x.com/y` + '/'.repeat(1e6).
+    let end = trimmed.length;
+    while (end > 0 && trimmed.charCodeAt(end - 1) === 47 /* '/' */)
+        end--;
+    let cleaned = trimmed.slice(0, end);
+    // Strip trailing .git (case-insensitive)
+    if (cleaned.toLowerCase().endsWith('.git')) {
+        cleaned = cleaned.slice(0, -4);
+    }
+    // Last path segment, handling colons for SSH URLs and path traversal.
+    // Split on both / and : to consistently extract the last part.
+    const candidate = cleaned.split(/[/:]/).pop() || '';
+    if (!candidate)
+        return null;
+    const safe = sanitizeRepoName(candidate);
+    return safe === 'unknown' ? null : safe;
 };
 /**
  * Convenience wrapper: derive a registry-friendly name from the repo's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.5-rc.4",
+  "version": "1.6.5-rc.6",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",