gitnexus 1.6.6-rc.32 → 1.6.6-rc.34

package/dist/core/group/extractors/http-patterns/python.js

@@ -5,7 +5,12 @@ import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-s
  *   - FastAPI `@app.get("/path")` provider decorators
  *   - `requests.get/post/...("url")` consumer calls
  *   - Generic `requests.request("METHOD", "url")` consumer calls
- *   - `httpx.AsyncClient` instances calling `.get/.post/...("url")`
+ *   - `httpx.AsyncClient` instances calling `.get/.post/...("url")`, including
+ *     aliased imports such as `import httpx as hx`,
+ *     `from httpx import AsyncClient`, and
+ *     `from httpx import AsyncClient as HttpxAsyncClient`.
+ *     Locally rebound names (e.g. `AsyncClient = mock_factory()` inside a
+ *     function) are excluded to avoid false-positive consumer contracts.
  */
 const FASTAPI_VERBS = {
     get: 'GET',
@@ -67,12 +72,48 @@ const REQUESTS_GENERIC_PATTERNS = compilePatterns({
     ],
 });
 // ─── Consumer: httpx.AsyncClient assignments ────────────────────────
-// NOTE: This targeted detector only tracks explicit `httpx.AsyncClient(...)`
-// construction. Direct imports (`from httpx import AsyncClient`) and module
-// aliases (`import httpx as hx`) and annotated assignments (`client: httpx.AsyncClient = ...`)
-// are intentionally left for a follow-up. Module-scope clients are only matched
+// Module-scope clients are only matched
 // at module scope; calls inside functions require a function/class-local tracked
 // client to avoid false positives from same-name local variables.
+const HTTPX_MODULE_IMPORT_PATTERNS = compilePatterns({
+    name: 'python-httpx-module-imports',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (import_statement
+          name: (aliased_import
+            name: (dotted_name (identifier) @module)
+            alias: (identifier) @alias))
+      `,
+        },
+    ],
+});
+const HTTPX_ASYNC_CLIENT_IMPORT_PATTERNS = compilePatterns({
+    name: 'python-httpx-async-client-imports',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (import_from_statement
+          module_name: (dotted_name (identifier) @module)
+          name: (dotted_name (identifier) @client_class))
+      `,
+        },
+        {
+            meta: {},
+            query: `
+        (import_from_statement
+          module_name: (dotted_name (identifier) @module)
+          name: (aliased_import
+            name: (dotted_name (identifier) @client_class)
+            alias: (identifier) @alias))
+      `,
+        },
+    ],
+});
 const HTTPX_ASYNC_CLIENT_ASSIGN_PATTERNS = compilePatterns({
     name: 'python-httpx-async-client-assign',
     language: Python,
@@ -84,8 +125,23 @@ const HTTPX_ASYNC_CLIENT_ASSIGN_PATTERNS = compilePatterns({
           left: (_) @client
           right: (call
             function: (attribute
-              object: (identifier) @module (#eq? @module "httpx")
-              attribute: (identifier) @client_class (#eq? @client_class "AsyncClient"))))
+              object: (identifier) @module
+              attribute: (identifier) @client_class)))
+      `,
+        },
+    ],
+});
+const HTTPX_ASYNC_CLIENT_DIRECT_ASSIGN_PATTERNS = compilePatterns({
+    name: 'python-httpx-async-client-direct-assign',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (assignment
+          left: (_) @client
+          right: (call
+            function: (identifier) @client_class))
       `,
         },
     ],
@@ -101,8 +157,23 @@ const HTTPX_ASYNC_CLIENT_WITH_ALIAS_PATTERNS = compilePatterns({
         (as_pattern
           (call
             function: (attribute
-              object: (identifier) @module (#eq? @module "httpx")
-              attribute: (identifier) @client_class (#eq? @client_class "AsyncClient")))
+              object: (identifier) @module
+              attribute: (identifier) @client_class))
+          (as_pattern_target (identifier) @client))
+      `,
+        },
+    ],
+});
+const HTTPX_ASYNC_CLIENT_DIRECT_WITH_ALIAS_PATTERNS = compilePatterns({
+    name: 'python-httpx-async-client-direct-with-alias',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (as_pattern
+          (call
+            function: (identifier) @client_class)
           (as_pattern_target (identifier) @client))
       `,
         },
@@ -131,14 +202,120 @@ function trackedClientScopeKey(clientNode) {
     return getScopeKey(clientNode.parent, clientNode.text.includes('.'));
 }
 function callScopeKeys(clientNode) {
-    const keys = new Set();
-    const preferClass = clientNode.text.includes('.');
-    const nearestScope = getScopeKey(clientNode.parent, preferClass);
-    keys.add(nearestScope);
-    return [...keys];
+    return [getScopeKey(clientNode.parent, clientNode.text.includes('.'))];
+}
+// Returns the scope key that a rebind of an imported alias would shadow under
+// Python LEGB rules, or `null` when the rebind does not shadow anything that
+// could produce a false-positive consumer detection.
+//   - Rebind inside a function/method → that function's scope.
+//   - Rebind at module top level → 'module' (shadows the whole file).
+//   - Rebind in a class body without an enclosing function → null. Python
+//     class attributes do not shadow bare-name lookups inside methods (methods
+//     see the module binding, not the class attribute), so we must not poison
+//     them.
+function shadowScopeKey(node) {
+    let current = node;
+    let passedThroughClass = false;
+    while (current) {
+        if (current.type === 'function_definition') {
+            // Reuse getScopeKey's key format so the two helpers cannot drift apart.
+            return getScopeKey(current);
+        }
+        if (current.type === 'class_definition') {
+            passedThroughClass = true;
+        }
+        current = current.parent;
+    }
+    return passedThroughClass ? null : 'module';
+}
+function collectHttpxImportAliases(tree) {
+    const moduleAliases = new Set(['httpx']);
+    const asyncClientAliases = new Set();
+    // The @module capture is a single identifier inside a `dotted_name`, so for
+    // `import package.httpx as hx` the pattern would match the inner `httpx`
+    // segment. Check the full `dotted_name` text via `parent` to anchor the match.
+    for (const match of runCompiledPatterns(HTTPX_MODULE_IMPORT_PATTERNS, tree)) {
+        const moduleNode = match.captures.module;
+        const aliasNode = match.captures.alias;
+        if (moduleNode?.parent?.text === 'httpx' && aliasNode)
+            moduleAliases.add(aliasNode.text);
+    }
+    for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_IMPORT_PATTERNS, tree)) {
+        const moduleNode = match.captures.module;
+        const classNode = match.captures.client_class;
+        if (moduleNode?.parent?.text !== 'httpx' || classNode?.text !== 'AsyncClient')
+            continue;
+        asyncClientAliases.add(match.captures.alias?.text ?? classNode.text);
+    }
+    return { moduleAliases, asyncClientAliases };
+}
+// Tracks local rebindings (`AsyncClient = ...`, `hx = ...`) that shadow an
+// imported alias. We treat the whole enclosing scope (module, class, or
+// function) as shadowed for that alias name, so subsequent constructions in
+// that scope are not falsely detected as httpx consumers. Covers bare-identifier
+// targets and the common tuple / list destructuring shapes.
+const ALIAS_SHADOW_PATTERNS = compilePatterns({
+    name: 'python-httpx-alias-shadow',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `(assignment left: (identifier) @name)`,
+        },
+        {
+            meta: {},
+            query: `(assignment left: (pattern_list (identifier) @name))`,
+        },
+        {
+            meta: {},
+            query: `(assignment left: (tuple_pattern (identifier) @name))`,
+        },
+        {
+            meta: {},
+            query: `(assignment left: (list_pattern (identifier) @name))`,
+        },
+    ],
+});
+function collectAliasShadowScopes(tree, aliases) {
+    const shadowed = new Map();
+    if (aliases.size === 0)
+        return shadowed;
+    for (const match of runCompiledPatterns(ALIAS_SHADOW_PATTERNS, tree)) {
+        const nameNode = match.captures.name;
+        if (!nameNode || !aliases.has(nameNode.text))
+            continue;
+        const scopeKey = shadowScopeKey(nameNode.parent);
+        if (scopeKey === null)
+            continue;
+        const set = shadowed.get(nameNode.text) ?? new Set();
+        set.add(scopeKey);
+        shadowed.set(nameNode.text, set);
+    }
+    return shadowed;
+}
+function isAliasShadowed(shadowed, aliasName, node) {
+    const scopes = shadowed.get(aliasName);
+    if (!scopes || scopes.size === 0)
+        return false;
+    let current = node.parent;
+    while (current) {
+        if (current.type === 'function_definition') {
+            // Reuse getScopeKey's key format so the two helpers cannot drift apart.
+            if (scopes.has(getScopeKey(current)))
+                return true;
+        }
+        current = current.parent;
+    }
+    // A module-level rebind shadows the alias for the entire file.
+    return scopes.has('module');
 }
 function collectHttpxAsyncClients(tree) {
     const clients = new Map();
+    const { moduleAliases, asyncClientAliases } = collectHttpxImportAliases(tree);
+    // Module aliases (`hx`) and AsyncClient aliases (`AsyncClient`,
+    // `HttpxAsyncClient`) share disjoint name spaces, so one shadow map keyed by
+    // alias name serves both lookups and we only walk the tree for rebinds once.
+    const shadowed = collectAliasShadowScopes(tree, new Set([...moduleAliases, ...asyncClientAliases]));
     const addClient = (clientNode) => {
         if (!clientNode)
             return;
@@ -149,9 +326,41 @@ function collectHttpxAsyncClients(tree) {
         clients.set(clientText, scopes);
     };
     for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_ASSIGN_PATTERNS, tree)) {
+        const moduleNode = match.captures.module;
+        const classNode = match.captures.client_class;
+        if (!moduleNode || !classNode)
+            continue;
+        if (!moduleAliases.has(moduleNode.text) || classNode.text !== 'AsyncClient')
+            continue;
+        if (isAliasShadowed(shadowed, moduleNode.text, moduleNode))
+            continue;
+        addClient(match.captures.client);
+    }
+    for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_DIRECT_ASSIGN_PATTERNS, tree)) {
+        const classNode = match.captures.client_class;
+        if (!classNode || !asyncClientAliases.has(classNode.text))
+            continue;
+        if (isAliasShadowed(shadowed, classNode.text, classNode))
+            continue;
         addClient(match.captures.client);
     }
     for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_WITH_ALIAS_PATTERNS, tree)) {
+        const moduleNode = match.captures.module;
+        const classNode = match.captures.client_class;
+        if (!moduleNode || !classNode)
+            continue;
+        if (!moduleAliases.has(moduleNode.text) || classNode.text !== 'AsyncClient')
+            continue;
+        if (isAliasShadowed(shadowed, moduleNode.text, moduleNode))
+            continue;
+        addClient(match.captures.client);
+    }
+    for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_DIRECT_WITH_ALIAS_PATTERNS, tree)) {
+        const classNode = match.captures.client_class;
+        if (!classNode || !asyncClientAliases.has(classNode.text))
+            continue;
+        if (isAliasShadowed(shadowed, classNode.text, classNode))
+            continue;
         addClient(match.captures.client);
     }
     return clients;

package/dist/mcp/local/local-backend.d.ts

@@ -73,6 +73,12 @@ interface RepoHandle {
  * and cannot be changed mid-process.
  */
 export declare function resolveWorktreeCwd(repoPath: string, launchCwd: string): string;
+/**
+ * Length of the base64url path hash appended to a colliding repo id.
+ * Exported so tests can pin the suffix shape without re-deriving the
+ * literal; see `repoId()` and the hashed-id resolution tier (#1658).
+ */
+export declare const REPO_ID_HASH_LENGTH = 6;
 export declare class LocalBackend {
     private repos;
     private contextCache;
@@ -128,8 +134,20 @@ export declare class LocalBackend {
     resolveRepo(repoParam?: string): Promise<RepoHandle>;
     /**
      * Try to resolve a repo from the in-memory cache. Returns null on miss.
+     * Throws {@link RegistryAmbiguousTargetError} when `repoParam` matches
+     * multiple handles by name and cwd cannot disambiguate (#1658).
      */
     private resolveRepoFromCache;
+    /**
+     * Prefer the indexed repo whose path matches the git root of process.cwd().
+     *
+     * In MCP stdio server mode, `process.cwd()` is the server's launch directory,
+     * not the agent client's cwd. If the server was started from an unrelated
+     * directory, `getGitRoot` returns null and duplicate-name resolution throws
+     * {@link RegistryAmbiguousTargetError} — callers should pass an absolute path.
+     */
+    private pickRepoHandleForCwd;
+    private handleToRegistryEntry;
     private ensureInitialized;
     /**
      * Get context for a specific repo (or the single repo if only one).

package/dist/mcp/local/local-backend.js

@@ -16,7 +16,7 @@ import { isWalCorruptionError, WAL_RECOVERY_SUGGESTION } from '../../core/lbug/l
 // import { isGitRepo, getCurrentCommit, getGitRoot } from '../../storage/git.js';
 import { parseDiffHunks, getCanonicalRepoRoot, getGitRoot, } from '../../storage/git.js';
 import { realpathSync } from 'fs';
-import { listRegisteredRepos, cleanupOldKuzuFiles, } from '../../storage/repo-manager.js';
+import { listRegisteredRepos, cleanupOldKuzuFiles, canonicalizePath, RegistryAmbiguousTargetError, } from '../../storage/repo-manager.js';
 import { GroupService } from '../../core/group/service.js';
 import { resolveAtGroupMemberRepoPath } from '../../core/group/resolve-at-member.js';
 import { collectBestChunks } from '../../core/embeddings/types.js';
@@ -233,6 +233,12 @@ export function resolveWorktreeCwd(repoPath, launchCwd) {
     }
     return repoPath;
 }
+/**
+ * Length of the base64url path hash appended to a colliding repo id.
+ * Exported so tests can pin the suffix shape without re-deriving the
+ * literal; see `repoId()` and the hashed-id resolution tier (#1658).
+ */
+export const REPO_ID_HASH_LENGTH = 6;
 export class LocalBackend {
     repos = new Map();
     contextCache = new Map();
@@ -345,7 +351,13 @@ export class LocalBackend {
         for (const [id, handle] of this.repos) {
             if (id === base && handle.repoPath !== path.resolve(repoPath)) {
                 // Collision — use path hash
-                const hash = Buffer.from(repoPath).toString('base64url').slice(0, 6);
+                // Lowercase the hash so it survives the `paramLower` lookup in
+                // resolveRepoFromCache — base64url retains mixed case, but the id
+                // tier compares against `repoParam.toLowerCase()` (#1658 follow-up).
+                const hash = Buffer.from(repoPath)
+                    .toString('base64url')
+                    .slice(0, REPO_ID_HASH_LENGTH)
+                    .toLowerCase();
                 return `${base}-${hash}`;
             }
         }
@@ -362,7 +374,20 @@ export class LocalBackend {
      * while the MCP server was running.
      */
     async resolveRepo(repoParam) {
-        const result = this.resolveRepoFromCache(repoParam);
+        let refreshedAfterAmbiguity = false;
+        let result;
+        try {
+            result = this.resolveRepoFromCache(repoParam);
+        }
+        catch (err) {
+            if (!(err instanceof RegistryAmbiguousTargetError))
+                throw err;
+            // Stale in-memory duplicate siblings can linger after unregister; refresh
+            // once before re-throwing so a resolved registry can disambiguate (#1658).
+            await this.refreshRepos();
+            refreshedAfterAmbiguity = true;
+            result = this.resolveRepoFromCache(repoParam);
+        }
         if (result) {
             // Issue: silent graph drift across sibling clones.
             // If the caller's cwd lives in a *different* on-disk clone of
@@ -375,8 +400,10 @@ export class LocalBackend {
             });
             return result;
         }
-        // Miss — refresh registry and try once more
-        await this.refreshRepos();
+        // Miss — refresh registry and try once more (skip if already refreshed above)
+        if (!refreshedAfterAmbiguity) {
+            await this.refreshRepos();
+        }
         const retried = this.resolveRepoFromCache(repoParam);
         if (retried) {
             this.maybeWarnSiblingDrift(retried).catch(() => { });
@@ -403,31 +430,57 @@ export class LocalBackend {
     }
     /**
      * Try to resolve a repo from the in-memory cache. Returns null on miss.
+     * Throws {@link RegistryAmbiguousTargetError} when `repoParam` matches
+     * multiple handles by name and cwd cannot disambiguate (#1658).
      */
     resolveRepoFromCache(repoParam) {
         if (this.repos.size === 0)
             return null;
         if (repoParam) {
             const paramLower = repoParam.toLowerCase();
-            // Match by id
+            const looksLikePath = path.isAbsolute(repoParam) || repoParam.includes(path.sep) || repoParam.includes('/');
+            const resolvePathMatch = () => {
+                const canonicalTarget = canonicalizePath(repoParam);
+                return [...this.repos.values()].find((handle) => {
+                    const stored = canonicalizePath(handle.repoPath);
+                    return process.platform === 'win32'
+                        ? stored.toLowerCase() === canonicalTarget.toLowerCase()
+                        : stored === canonicalTarget;
+                });
+            };
+            // Path-like params first (absolute or contains separators) — aligns with
+            // resolveRegistryEntry (#829). Bare aliases such as ".tmp-repro-mini" must
+            // not be resolved via path.resolve(cwd) before duplicate-name handling.
+            if (looksLikePath) {
+                const pathMatch = resolvePathMatch();
+                if (pathMatch)
+                    return pathMatch;
+            }
+            // Exact name before id — the first duplicate sibling keeps id === name
+            // (e.g. id "shared"), so a name lookup must not be captured by the id tier.
+            const nameMatches = [...this.repos.values()].filter((handle) => handle.name.toLowerCase() === paramLower);
+            if (nameMatches.length === 1)
+                return nameMatches[0];
+            if (nameMatches.length > 1) {
+                const cwdPick = this.pickRepoHandleForCwd(nameMatches);
+                if (cwdPick)
+                    return cwdPick;
+                throw new RegistryAmbiguousTargetError(repoParam, nameMatches.map((h) => this.handleToRegistryEntry(h)));
+            }
+            // Stable hashed id (e.g. "shared-abc123") from repoId() collision suffix
             if (this.repos.has(paramLower))
                 return this.repos.get(paramLower);
-            // Match by name (case-insensitive)
-            for (const handle of this.repos.values()) {
-                if (handle.name.toLowerCase() === paramLower)
-                    return handle;
-            }
-            // Match by path (substring)
-            const resolved = path.resolve(repoParam);
-            for (const handle of this.repos.values()) {
-                if (handle.repoPath === resolved)
-                    return handle;
-            }
-            // Match by partial name
-            for (const handle of this.repos.values()) {
-                if (handle.name.toLowerCase().includes(paramLower))
-                    return handle;
-            }
+            // Bare name resolved as a cwd-relative path (e.g. "myrepo" against process.cwd()),
+            // after name/id tiers. Path-like strings with separators were handled at the top.
+            if (!looksLikePath) {
+                const pathMatch = resolvePathMatch();
+                if (pathMatch)
+                    return pathMatch;
+            }
+            // Partial name — only when unambiguous
+            const partialMatches = [...this.repos.values()].filter((handle) => handle.name.toLowerCase().includes(paramLower));
+            if (partialMatches.length === 1)
+                return partialMatches[0];
             return null;
         }
         if (this.repos.size === 1) {
@@ -435,6 +488,38 @@ export class LocalBackend {
         }
         return null; // Multiple repos, no param — ambiguous
     }
+    /**
+     * Prefer the indexed repo whose path matches the git root of process.cwd().
+     *
+     * In MCP stdio server mode, `process.cwd()` is the server's launch directory,
+     * not the agent client's cwd. If the server was started from an unrelated
+     * directory, `getGitRoot` returns null and duplicate-name resolution throws
+     * {@link RegistryAmbiguousTargetError} — callers should pass an absolute path.
+     */
+    pickRepoHandleForCwd(candidates) {
+        const cwdRoot = getGitRoot(process.cwd());
+        if (!cwdRoot)
+            return null;
+        const canonicalCwd = canonicalizePath(cwdRoot);
+        const cwdMatches = candidates.filter((handle) => {
+            const stored = canonicalizePath(handle.repoPath);
+            return process.platform === 'win32'
+                ? stored.toLowerCase() === canonicalCwd.toLowerCase()
+                : stored === canonicalCwd;
+        });
+        return cwdMatches.length === 1 ? cwdMatches[0] : null;
+    }
+    handleToRegistryEntry(handle) {
+        return {
+            name: handle.name,
+            path: handle.repoPath,
+            storagePath: handle.storagePath,
+            indexedAt: handle.indexedAt,
+            lastCommit: handle.lastCommit,
+            stats: handle.stats,
+            remoteUrl: handle.remoteUrl,
+        };
+    }
     // ─── Lazy LadybugDB Init ────────────────────────────────────────────
     async ensureInitialized(repoId) {
         // If a reinit is already in progress for this repo, wait for it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.6-rc.32",
+  "version": "1.6.6-rc.34",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",