gitnexus 1.6.9-rc.10 → 1.6.9-rc.12

package/dist/core/group/cross-trace.js

@@ -732,18 +732,20 @@ async function stitchCrossRepo(deps, p, fromEp, toEp, groupDir, notes) {
 const FILE_BASENAME_RE = /\.(ts|tsx|js|jsx|mjs|cjs|py|go|php|java|kt|kts|rb|cs|rs|swift|dart|scala|c|cc|cpp|cxx|h|hpp|m|mm)$/i;
 /**
  * A provider endpoint's display label. A resolved handler has a real function
- * name; the source-scan fallbacks leave a generic token (`'handler'`/`'fetch'`)
- * or a file basename. Those are treated as anonymous and shown as
+ * name; the source-scan fallbacks leave a generic token (`'handler'`/`'fetch'`,
+ * or `'route'` for an unresolved named-controller / closure Laravel route) or a
+ * file basename. Those are treated as anonymous and shown as
  * `<METHOD /path handler>` so the endpoint is still identifiable by route. When
  * the bridge row carries a resolved `providerUid`, the name IS a real symbol —
- * the `'handler'`/`'fetch'` sentinel check is suppressed so a function genuinely
- * named `handler` is not mislabeled anonymous.
+ * the sentinel check is suppressed so a function genuinely named `handler` (or,
+ * hypothetically, `route`) is not mislabeled anonymous.
  */
 function providerLabel(providerName, contractId, providerUid) {
     const resolved = providerUid !== '';
     const generic = providerName === '' ||
         FILE_BASENAME_RE.test(providerName) ||
-        (!resolved && (providerName === 'handler' || providerName === 'fetch'));
+        (!resolved &&
+            (providerName === 'handler' || providerName === 'fetch' || providerName === 'route'));
     return generic
         ? { label: `<${contractId} handler>`, anon: true }
         : { label: providerName, anon: false };

package/dist/core/group/extractors/http-patterns/go.js

@@ -9,8 +9,11 @@ import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-s
  */
 // ─── Provider: framework routing ──────────────────────────────────────
 // Matches `\w+\.GET(...)` etc. (gin, echo, chi all share this shape).
-// Captures the HTTP method (field name), path literal, and handler
-// identifier passed as the second argument.
+// Captures the HTTP method (field name), path literal, and the handler —
+// anchored to the LAST argument (`@handler .`) so a variadic middleware
+// chain (`r.GET("/x", mw, handler)`, gin/echo/chi style) binds the real
+// handler, not a middleware identifier (which would otherwise over-match
+// and attach the route to the wrong symbol — see #2276 review).
 const FRAMEWORK_ROUTE_PATTERNS = compilePatterns({
     name: 'go-framework-route',
     language: Go,
@@ -23,7 +26,8 @@ const FRAMEWORK_ROUTE_PATTERNS = compilePatterns({
             field: (field_identifier) @http_method (#match? @http_method "^(GET|POST|PUT|DELETE|PATCH)$"))
           arguments: (argument_list
             (interpreted_string_literal) @path
-            (identifier) @handler))
+            [(identifier) (func_literal)] @handler
+            .))
       `,
         },
     ],
@@ -42,7 +46,8 @@ const HANDLE_FUNC_PATTERNS = compilePatterns({
             field: (field_identifier) @fn (#eq? @fn "HandleFunc"))
           arguments: (argument_list
             (interpreted_string_literal) @path
-            (identifier) @handler))
+            [(identifier) (func_literal)] @handler
+            .))
       `,
         },
     ],
@@ -125,12 +130,18 @@ export const GO_HTTP_PLUGIN = {
             const path = unquoteLiteral(pathNode.text);
             if (path === null)
                 continue;
+            // An inline `func(){…}` handler has no name → emit `name: null` and a
+            // `line` so it resolves to its containing/closure symbol by line-span
+            // containment (like a consumer). A named identifier handler keeps its
+            // name and resolves by name; `line` is harmless there.
+            const isInlineHandler = handlerNode?.type === 'func_literal';
             out.push({
                 role: 'provider',
                 framework: 'go-framework',
                 method: methodNode.text.toUpperCase(),
                 path,
-                name: handlerNode?.text ?? null,
+                name: isInlineHandler ? null : (handlerNode?.text ?? null),
+                line: (handlerNode ?? pathNode).startPosition.row + 1,
                 confidence: 0.8,
             });
         }
@@ -143,12 +154,16 @@ export const GO_HTTP_PLUGIN = {
             const path = unquoteLiteral(pathNode.text);
             if (path === null)
                 continue;
+            // Inline `func(){…}` handler → resolve by containment (see go-framework
+            // note above); a named handler resolves by name.
+            const isInlineHandler = handlerNode?.type === 'func_literal';
             out.push({
                 role: 'provider',
                 framework: 'go-stdlib',
                 method: 'GET',
                 path,
-                name: handlerNode?.text ?? null,
+                name: isInlineHandler ? null : (handlerNode?.text ?? null),
+                line: (handlerNode ?? pathNode).startPosition.row + 1,
                 confidence: 0.8,
             });
         }

package/dist/core/group/extractors/http-patterns/java.js

@@ -634,6 +634,13 @@ export const JAVA_HTTP_PLUGIN = {
                     method: route.httpMethod,
                     path: joinPath(prefix, route.rawPath),
                     name: route.methodName,
+                    // Spring providers are named controller methods resolved BY NAME, so
+                    // `line` is inert — a named provider never falls through to line-span
+                    // containment. Gate it on a present name so a (grammar-impossible)
+                    // nameless provider degrades to file-level rather than resolving by
+                    // containment to the enclosing class. Wired for consumer-emit parity
+                    // and a future inline DSL.
+                    line: route.methodName ? route.methodNode.startPosition.row + 1 : undefined,
                     confidence: 0.8,
                 });
             }

package/dist/core/group/extractors/http-patterns/kotlin.js

@@ -977,6 +977,13 @@ function buildKotlinPlugin(language) {
                         method: httpMethod,
                         path: joinPath(prefix, rawPath),
                         name: nameNode?.text ?? null,
+                        // Spring providers are named controller methods resolved BY NAME, so
+                        // `line` is inert — a named provider never falls through to line-span
+                        // containment. Gate it on a present name so a (grammar-impossible)
+                        // nameless provider degrades to file-level rather than resolving by
+                        // containment to the enclosing class. Wired for consumer-emit parity
+                        // and a future inline DSL.
+                        line: nameNode?.text ? methodNode.startPosition.row + 1 : undefined,
                         confidence: 0.8,
                     });
                 }

package/dist/core/group/extractors/http-patterns/node.js

@@ -270,8 +270,54 @@ function findDecoratedMethod(decoratorNode) {
     }
     return null;
 }
+/**
+ * Map each named import's LOCAL binding to its DECLARED export name and source
+ * module, by walking the file's `import { x as y } from 'm'` statements. Lets
+ * the express handler resolve through an alias (the local `y`) to the real
+ * symbol (`x` in `m`) instead of looking up the alias text. Only named imports
+ * are mapped — default and namespace imports are left to fall through as
+ * locally-scoped identifiers.
+ */
+function buildImportMap(tree) {
+    const map = new Map();
+    const walk = (node) => {
+        if (node.type === 'import_statement') {
+            const sourceNode = node.childForFieldName('source');
+            const module = sourceNode ? unquoteLiteral(sourceNode.text) : null;
+            if (module !== null) {
+                const collect = (n) => {
+                    if (n.type === 'import_specifier') {
+                        const nameNode = n.childForFieldName('name');
+                        const aliasNode = n.childForFieldName('alias');
+                        const local = aliasNode ?? nameNode;
+                        if (nameNode && local && local.type === 'identifier') {
+                            map.set(local.text, { name: nameNode.text, module });
+                        }
+                    }
+                    for (let i = 0; i < n.namedChildCount; i++) {
+                        const c = n.namedChild(i);
+                        if (c)
+                            collect(c);
+                    }
+                };
+                collect(node);
+            }
+        }
+        for (let i = 0; i < node.namedChildCount; i++) {
+            const c = node.namedChild(i);
+            if (c)
+                walk(c);
+        }
+    };
+    walk(tree.rootNode);
+    return map;
+}
 function scanBundle(bundle, tree) {
     const out = [];
+    // Local-binding → { declared export name, module } for the file's named
+    // imports, so an express handler that is an imported (possibly aliased)
+    // symbol resolves to the real definition rather than its local alias text.
+    const importMap = buildImportMap(tree);
     // NestJS: collect `@Controller('prefix')` class decorators, keyed by
     // the `class_declaration` they decorate.
     const prefixByClassId = new Map();
@@ -343,14 +389,19 @@ function scanBundle(bundle, tree) {
         // → `listUsers`) so a named handler resolves by name. For an inline/anonymous
         // handler emit `name: null` (NOT the sentinel `'handler'`) so the resolver
         // does NOT match an unrelated function that happens to be named `handler` —
-        // it uses the registration line for containment instead.
+        // it uses the registration line for containment instead. When the handler is
+        // an imported (possibly aliased) symbol, carry the resolved import so the
+        // extractor can pin it to the source module rather than the local alias text.
         const handlerNode = match.captures.handler;
+        const localHandler = handlerNode?.type === 'identifier' ? handlerNode.text : null;
+        const imported = localHandler !== null ? importMap.get(localHandler) : undefined;
         out.push({
             role: 'provider',
             framework: 'express',
             method: methodNode.text.toUpperCase(),
             path,
-            name: handlerNode?.type === 'identifier' ? handlerNode.text : null,
+            name: imported ? imported.name : localHandler,
+            handlerImport: imported,
             line: (handlerNode ?? pathNode).startPosition.row + 1,
             confidence: 0.8,
         });

package/dist/core/group/extractors/http-patterns/php.js

@@ -27,7 +27,9 @@ const LARAVEL_ROUTE_SPEC = {
     (scoped_call_expression
       scope: (name) @scope (#eq? @scope "Route")
       name: (name) @method (#match? @method "^(get|post|put|delete|patch)$")
-      arguments: (arguments . (argument (string) @path)))
+      arguments: (arguments
+        . (argument (string) @path)
+        (argument [(anonymous_function) (arrow_function)] @closure)?))
   `,
 };
 const HTTP_FACADE_SPEC = {
@@ -125,12 +127,22 @@ export const PHP_HTTP_PLUGIN = {
             const path = phpStringText(pathNode);
             if (path === null)
                 continue;
+            // A closure handler (`Route::get('/x', function(){…})` / `fn() => …`) has
+            // no name → emit `name: null` + the registration line so it resolves to
+            // its containing symbol (e.g. a service-provider `boot()` or controller
+            // method) by line-span containment. A named-controller route keeps the
+            // `'route'` label — resolving its array/string handler to a real method is
+            // a separate, graph-backed concern. NOTE: a closure at FILE scope
+            // (routes/web.php) has no enclosing function and PHP closures are not yet
+            // indexed as symbols, so it still degrades to file-level (see #2276).
+            const closureNode = match.captures.closure;
             out.push({
                 role: 'provider',
                 framework: 'laravel',
                 method: methodNode.text.toUpperCase(),
                 path,
-                name: 'route',
+                name: closureNode ? null : 'route',
+                line: (closureNode ?? pathNode).startPosition.row + 1,
                 confidence: 0.8,
             });
         }

package/dist/core/group/extractors/http-patterns/python.js

@@ -66,6 +66,32 @@ const FASTAPI_ROUTER_PATTERNS = compilePatterns({
         },
     ],
 });
+// ─── Provider: Flask `app.add_url_rule('/path', view_func=handler)` ───
+// The imperative Flask route registration: unlike `@app.route` (whose handler
+// is the decorated function, same-file), `view_func` is frequently an IMPORTED
+// (and sometimes aliased) view, so the handler resolves through the file's
+// imports. `add_url_rule` + a `view_func=` keyword is highly Flask-specific, so
+// the false-positive risk is low. Method(s) come from a `methods=[...]` keyword
+// (default GET), extracted in code from the captured call.
+const FLASK_ADD_URL_RULE_PATTERNS = compilePatterns({
+    name: 'python-flask-add-url-rule',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (call
+          function: (attribute
+            attribute: (identifier) @fn (#eq? @fn "add_url_rule"))
+          arguments: (argument_list
+            . (string) @path
+            (keyword_argument
+              name: (identifier) @kw (#eq? @kw "view_func")
+              value: (identifier) @handler))) @call
+      `,
+        },
+    ],
+});
 // ─── include_router(<router_obj>, prefix='/x') across the repo ────────
 // Two shapes are common:
 //   app.include_router(assistant.router, prefix='/ai')
@@ -306,6 +332,79 @@ const WRAPPER_URI_VAR_PATTERNS = compilePatterns({
         },
     ],
 });
+/**
+ * Map each `from <module> import <name> [as <alias>]` binding to its declared
+ * name + raw module specifier (the spec keeps the leading dots for relative
+ * imports — `.users`, `..pkg.users` — which the extractor resolves to a target
+ * file). Lets a Flask `view_func` handler resolve through an alias to the real
+ * symbol in its module rather than the local alias text. `import x` / `import x
+ * as y` (module imports, not symbol imports) are left out — a route handler is a
+ * symbol, addressed via `from … import …`.
+ */
+function buildPythonImportMap(tree) {
+    const map = new Map();
+    const walk = (node) => {
+        if (node.type === 'import_from_statement') {
+            const moduleNode = node.childForFieldName('module_name');
+            const module = moduleNode?.text ?? null;
+            if (module !== null) {
+                for (let i = 0; i < node.namedChildCount; i++) {
+                    const c = node.namedChild(i);
+                    if (!c || c.id === moduleNode?.id)
+                        continue;
+                    if (c.type === 'dotted_name') {
+                        map.set(c.text, { name: c.text, module });
+                    }
+                    else if (c.type === 'aliased_import') {
+                        const nameNode = c.childForFieldName('name');
+                        const aliasNode = c.childForFieldName('alias');
+                        if (nameNode && aliasNode) {
+                            map.set(aliasNode.text, { name: nameNode.text, module });
+                        }
+                    }
+                }
+            }
+        }
+        for (let i = 0; i < node.namedChildCount; i++) {
+            const c = node.namedChild(i);
+            if (c)
+                walk(c);
+        }
+    };
+    walk(tree.rootNode);
+    return map;
+}
+/**
+ * HTTP verbs declared on a Flask `add_url_rule(..., methods=[...])` call, upper-
+ * cased. Defaults to `['GET']` when no `methods` keyword is present (Flask's own
+ * default). Reads the captured call node directly since the list value is awkward
+ * to capture in a tree-sitter query.
+ */
+function extractFlaskMethods(callNode) {
+    const args = callNode.childForFieldName('arguments');
+    if (args) {
+        for (let i = 0; i < args.namedChildCount; i++) {
+            const kw = args.namedChild(i);
+            if (!kw || kw.type !== 'keyword_argument')
+                continue;
+            if (kw.childForFieldName('name')?.text !== 'methods')
+                continue;
+            const list = kw.childForFieldName('value');
+            if (!list)
+                continue;
+            const methods = [];
+            for (let j = 0; j < list.namedChildCount; j++) {
+                const el = list.namedChild(j);
+                const v = el && el.type === 'string' ? unquoteLiteral(el.text) : null;
+                if (v)
+                    methods.push(v.toUpperCase());
+            }
+            if (methods.length > 0)
+                return methods;
+        }
+    }
+    return ['GET'];
+}
 // Pre-scan: collect local string assignments (uri = "api/v1/endpoint/")
 function buildLocalStringMap(tree) {
     const map = new Map();
@@ -846,6 +945,10 @@ export const PYTHON_HTTP_PLUGIN = {
         const out = [];
         const httpxAsyncClients = collectHttpxAsyncClients(tree);
         const ctx = repoContext;
+        // Local-binding → { declared name, module } for the file's `from … import …`
+        // statements, so an imperatively-registered handler (Flask `view_func`) that
+        // is an imported (possibly aliased) symbol resolves to its real definition.
+        const importMap = buildPythonImportMap(tree);
         // Providers: FastAPI @app.<verb>("/path") — already absolute path.
         for (const match of runCompiledPatterns(FASTAPI_APP_PATTERNS, tree)) {
             const methodNode = match.captures.method;
@@ -864,6 +967,12 @@ export const PYTHON_HTTP_PLUGIN = {
                 method: httpMethod,
                 path,
                 name: null,
+                // The decorated handler has no captured name → resolve by line-span
+                // containment. Best-effort fallback: FastAPI routes are graph-backed
+                // (ingestion decorator routes) and the function span starts at `def`
+                // (decorators excluded), so this lands the single-decorator case and
+                // degrades to file-level for multi-decorator stacks.
+                line: pathNode.startPosition.row + 1,
                 confidence: 0.8,
             });
         }
@@ -905,6 +1014,35 @@ export const PYTHON_HTTP_PLUGIN = {
                     method: httpMethod,
                     path: p,
                     name: null,
+                    // Best-effort containment fallback — see the @app provider note above.
+                    line: pathNode.startPosition.row + 1,
+                    confidence: 0.8,
+                });
+            }
+        }
+        // Providers: Flask `app.add_url_rule('/path', view_func=handler, methods=[…])`.
+        // The handler is a `view_func` identifier, frequently an imported (possibly
+        // aliased) view, so resolve it through the file's imports to the declared
+        // symbol + its module for import-pinned resolution downstream.
+        for (const match of runCompiledPatterns(FLASK_ADD_URL_RULE_PATTERNS, tree)) {
+            const pathNode = match.captures.path;
+            const handlerNode = match.captures.handler;
+            const callNode = match.captures.call;
+            if (!pathNode || !handlerNode || !callNode)
+                continue;
+            const path = unquoteLiteral(pathNode.text);
+            if (path === null)
+                continue;
+            const imported = importMap.get(handlerNode.text);
+            for (const method of extractFlaskMethods(callNode)) {
+                out.push({
+                    role: 'provider',
+                    framework: 'flask',
+                    method,
+                    path,
+                    name: imported ? imported.name : handlerNode.text,
+                    handlerImport: imported,
+                    line: (imported ? pathNode : handlerNode).startPosition.row + 1,
                     confidence: 0.8,
                 });
             }

package/dist/core/group/extractors/http-patterns/types.d.ts

@@ -42,6 +42,20 @@ export interface HttpDetection {
      * not set it falls back to file-level boundary resolution downstream.
      */
     line?: number;
+    /**
+     * When the handler is an IMPORTED symbol, the import resolved to its declared
+     * (exported) `name` and the `module` specifier it came from. The extractor
+     * pins resolution to the import's target file, so an aliased import
+     * (`import { listUsers as handleUsers }`) or a name that collides with a local
+     * symbol resolves to the right handler instead of a same-named decoy. `name`
+     * here is the DECLARED export name (not the local alias); `module` is the raw
+     * specifier (e.g. `./handlers/users`). Set only for named imports; omitted for
+     * locally-defined or anonymous handlers.
+     */
+    handlerImport?: {
+        name: string;
+        module: string;
+    };
     /** Confidence in (0, 1]. Source-scan plugins typically use 0.7–0.8. */
     confidence: number;
 }

package/dist/core/group/extractors/http-route-extractor.js

@@ -67,6 +67,65 @@ MATCH (sym:CodeElement)
 WHERE sym.filePath = $filePath AND sym.startLine IS NOT NULL AND sym.endLine IS NOT NULL
 RETURN sym.id AS uid, sym.name AS name, sym.filePath AS filePath,
        sym.startLine AS startLine, sym.endLine AS endLine, labels(sym) AS labels`;
+// Repo-wide lookup of a symbol by exact name (label-union, as in
+// manifest-extractor.ts). Used to resolve a provider's named handler when it is
+// defined in a file OTHER than its route registration — and only honored when
+// the result is unique (see resolveSymbolByNameUnique).
+//
+// `n.filePath <> ''` excludes synthetic non-source `CodeElement` nodes that
+// carry no real file — ORM model/table nodes (orm.ts emits `filePath: ''`) and
+// similar — so a handler name colliding with an ORM model neither resolves to a
+// degenerate edge-less node NOR inflates the uniqueness count and masks the real
+// handler. `LIMIT 2` bounds materialization: distinguishing unique (1) from
+// ambiguous (>=2) never needs more than two rows (the count guard stays exact).
+const RESOLVE_BY_NAME_QUERY = `
+MATCH (n:Function|Method|CodeElement)
+WHERE n.name = $name AND n.filePath <> ''
+RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
+LIMIT 2`;
+// Resolve an IMPORTED handler by pinning it to the import's target module: the
+// declared export `$name` whose file is the module the handler was imported from
+// (`$fileDot` matches `mod.ext`, `$fileSlash` matches `mod/index.ext`). This is
+// the precise rung — it survives aliases and local same-name collisions that a
+// repo-wide name lookup cannot, and only resolves on a unique match within that
+// module. `LIMIT 2` keeps the uniqueness count exact (see RESOLVE_BY_NAME_QUERY).
+const RESOLVE_IN_MODULE_QUERY = `
+MATCH (n:Function|Method|CodeElement)
+WHERE n.name = $name AND (n.filePath STARTS WITH $fileDot OR n.filePath STARTS WITH $fileSlash)
+RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
+LIMIT 2`;
+// Source-file extensions an import specifier may resolve to (stripped before
+// building the module file-prefix so `./h/users` and `./h/users.ts` agree).
+const SOURCE_EXT_RE = /\.(?:m|c)?[jt]sx?$/;
+/**
+ * Resolve an import specifier to a repo-relative FILE BASE (path without
+ * extension) so the target module can be matched by `filePath STARTS WITH`.
+ * Handles two relative-import dialects and returns null for bare/absolute
+ * imports (which fall back to a repo-wide name lookup):
+ *   - path-style (JS/TS): `./handlers/users`, `../x` → joined against the
+ *     importing file's directory.
+ *   - dotted-relative (Python): `.users`, `..pkg.users` → leading dots are
+ *     package levels (one dot = the file's own package), the rest dot→slash.
+ */
+function resolveModuleBase(fromFile, module) {
+    const dir = path.posix.dirname(fromFile.replace(/\\/g, '/'));
+    if (module.includes('/')) {
+        // path-style relative import
+        if (!module.startsWith('.'))
+            return null;
+        return path.posix.normalize(path.posix.join(dir, module)).replace(SOURCE_EXT_RE, '');
+    }
+    if (module.startsWith('.')) {
+        // Python dotted-relative import
+        const dots = module.length - module.replace(/^\.+/, '').length;
+        const rest = module.slice(dots).replace(/\./g, '/');
+        let base = dir;
+        for (let i = 1; i < dots; i++)
+            base = path.posix.dirname(base);
+        return rest ? path.posix.normalize(path.posix.join(base, rest)) : base;
+    }
+    return null; // bare / absolute import — repo-wide fallback
+}
 /**
  * The innermost Function/Method whose `[startLine, endLine]` span contains
  * `line` — i.e. the symbol the HTTP call lives inside. For a consumer this is
@@ -324,22 +383,120 @@ export class HttpRouteExtractor {
             fileSymbolCache.set(filePath, rows);
             return rows;
         };
+        // Repo-wide UNAMBIGUOUS resolution for a provider handler defined in a file
+        // other than its route registration (e.g. `router.get('/x', listUsers)` with
+        // `listUsers` imported from another module). Returns the symbol ONLY when
+        // exactly one Function/Method/CodeElement carries that name across the repo.
+        // The strict uniqueness guard is intentionally conservative: when a name is
+        // shared across files (homonyms like `handler`/`index`), we prefer a
+        // false-negative (no attribution → file-level fallback) over a false-positive
+        // (wrong symbol).
+        //
+        // An IMPORTED handler (the common cross-file case) is pinned to its source
+        // module first by resolveImportedSymbol, so an alias or a name colliding with
+        // a local symbol resolves correctly; this repo-wide-by-name rung is the
+        // fallback for non-relative/bare imports and for plugins that supply only a
+        // name. Cached by name for the lifetime of this extract().
+        const globalNameCache = new Map();
+        const toResolvedSymbol = (rows) => {
+            const norm = (x) => String(x ?? '');
+            const uid = rows.length === 1 ? norm(rows[0].uid ?? rows[0][0]) : '';
+            const filePath = uid ? norm(rows[0].filePath ?? rows[0][2]) : '';
+            // Reject a unique match that carries no real file (a synthetic ORM /
+            // non-source node) so it can never anchor a cross-trace on an edge-less
+            // node — defence in depth alongside the queries' filePath predicates.
+            return uid && filePath ? { uid, name: norm(rows[0].name ?? rows[0][1]), filePath } : null;
+        };
+        const resolveSymbolByNameUnique = async (name) => {
+            if (!dbExecutor)
+                return null;
+            const cached = globalNameCache.get(name);
+            if (cached !== undefined)
+                return cached;
+            let rows = [];
+            try {
+                rows = await dbExecutor(RESOLVE_BY_NAME_QUERY, { name });
+            }
+            catch {
+                rows = [];
+            }
+            const result = toResolvedSymbol(rows);
+            globalNameCache.set(name, result);
+            return result;
+        };
+        // Resolve a handler imported from a RELATIVE module to the unique declared
+        // symbol of that name inside the import's target file. Returns null for
+        // non-relative (bare/aliased-path) imports — those fall back to the repo-wide
+        // name lookup. Cached by (target-file-prefix, declared name).
+        const importedSymbolCache = new Map();
+        const resolveImportedSymbol = async (fromFile, imp) => {
+            if (!dbExecutor)
+                return null;
+            const base = resolveModuleBase(fromFile, imp.module);
+            if (base === null)
+                return null; // bare/absolute import → repo-wide fallback
+            const cacheKey = JSON.stringify([base, imp.name]);
+            const cached = importedSymbolCache.get(cacheKey);
+            if (cached !== undefined)
+                return cached;
+            let rows = [];
+            try {
+                rows = await dbExecutor(RESOLVE_IN_MODULE_QUERY, {
+                    name: imp.name,
+                    fileDot: `${base}.`,
+                    fileSlash: `${base}/`,
+                });
+            }
+            catch {
+                rows = [];
+            }
+            const result = toResolvedSymbol(rows);
+            importedSymbolCache.set(cacheKey, result);
+            return result;
+        };
         const resolveDetectionSymbol = async (filePath, d) => {
             if (!dbExecutor)
                 return null;
             const syms = await loadFileSymbols(filePath);
-            if (syms.length === 0)
-                return null;
             // Name resolution does NOT need a detection line — a named provider
             // handler (Spring/Go/etc. method name) resolves by name even when the
-            // plugin didn't set `line`. Try it FIRST; only the containment fallback
-            // requires a line.
+            // plugin didn't set `line`. Try the registration file FIRST; then, for a
+            // handler defined in another file, the unique repo-wide match. Only the
+            // containment fallback requires a line.
             if (d.role === 'provider' && d.name) {
+                // IMPORTED handler: pin to the import's target module first. This is the
+                // precise rung — it survives aliases and names that collide with a local
+                // symbol. The handler is defined ELSEWHERE, so a file-scoped lookup of
+                // its (declared) name would be wrong; on a miss go straight to a unique
+                // repo-wide match on the declared name, never file-scoped.
+                if (d.handlerImport) {
+                    const byImport = await resolveImportedSymbol(filePath, d.handlerImport);
+                    if (byImport)
+                        return byImport;
+                    const byGlobal = await resolveSymbolByNameUnique(d.handlerImport.name);
+                    if (byGlobal)
+                        return byGlobal;
+                    return null;
+                }
                 const byName = resolveSymbolByName(syms, d.name);
                 if (byName)
                     return byName;
+                const byGlobal = await resolveSymbolByNameUnique(d.name);
+                if (byGlobal)
+                    return byGlobal;
+                // A NAMED handler we could not resolve by name (neither file-scoped nor
+                // the unique repo-wide match) must NOT fall through to line-span
+                // containment: `d.line` is the route REGISTRATION site, so containment
+                // would attach the route to the enclosing registrar (e.g. a
+                // `setupRoutes()` wrapper) rather than the handler. Leave it empty →
+                // file-level boundary fallback, upholding the invariant that a
+                // zero/ambiguous name match never yields a wrong-symbol attribution.
+                return null;
             }
-            if (d.line == null)
+            // Consumers (the function making the fetch) and inline-arrow providers
+            // (d.name === null) DO resolve by containment — there the enclosing symbol
+            // is the right one.
+            if (syms.length === 0 || d.line == null)
                 return null;
             return resolveContainingSymbol(syms, d.line);
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.9-rc.10",
+  "version": "1.6.9-rc.12",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",