gitnexus 1.6.9-rc.4 → 1.6.9-rc.5

package/dist/core/group/extractors/http-patterns/java-static-path.d.ts

@@ -0,0 +1,39 @@
+import Parser from 'tree-sitter';
+/**
+ * Resolve a statically-derivable path argument to a literal path: a bare
+ * string literal, a `URI.create("/x")` call, or a `UriComponentsBuilder`
+ * fluent chain. Genuinely dynamic arguments → null.
+ */
+export declare function extractStaticPathExpression(node: Parser.SyntaxNode): string | null;
+/**
+ * Infer an OkHttp request verb by scanning the builder chain around the matched
+ * `.url(...)` call: a `.get()/.head()/.post()/.put()/.delete()/.patch()` helper
+ * (before or after `.url()`), or a `.method("VERB", …)` literal, wins. Returns
+ * `'GET'` only when the chain has NO verb call at all (a bare `.url(...).build()`
+ * — OkHttp's real default). Returns `null` for an explicit `.method(verb, …)`
+ * whose verb is a non-literal: the verb is set but not statically resolvable, so
+ * the caller skips the call rather than asserting a wrong GET (parity with the
+ * WebClient long-form variable-bound-verb behavior, which also skips).
+ */
+export declare function inferOkHttpMethod(urlCall: Parser.SyntaxNode): string | null;
+/**
+ * Infer a Java-`HttpClient` request verb by walking UP the builder chain from the
+ * matched `.uri(URI.create("..."))` call: the first `.GET()/.POST()/.PUT()/`
+ * `.DELETE()/.HEAD()` verb-helper, or a `.method("VERB", body)` literal, wins.
+ * Returns `'GET'` only when the chain has no verb call (a bare `.build()` — the
+ * builder's real default). Returns `null` for an explicit `.method(verb, …)` with
+ * a non-literal verb (skip, not a guessed GET). The scan is transparent to
+ * neutral calls anywhere in the chain (`.header()`/`.timeout()`/`.version()`),
+ * before or after `.uri()`, so neither a header/timeout hop nor a verb call's
+ * position drops the contract.
+ */
+export declare function inferHttpClientMethod(uriCall: Parser.SyntaxNode): string | null;
+/** True when `urlCall`'s receiver chain bottoms out on a `new Request.Builder()`
+ *  object-creation (descending the `.object` chain past any intervening calls). */
+export declare function okHttpUrlRootsAtBuilder(urlCall: Parser.SyntaxNode): boolean;
+/** True when `uriCall`'s receiver chain includes a `HttpRequest.newBuilder()`. */
+export declare function httpClientUriRootsAtNewBuilder(uriCall: Parser.SyntaxNode): boolean;
+/** True when a `HttpRequest.newBuilder(URI.create(...))` chain ALSO calls `.uri(...)`
+ *  later — a later `.uri()` overrides the constructor URI at runtime, so the
+ *  constructor-arg path must NOT be emitted (the `.uri()` query emits the override). */
+export declare function httpClientChainHasUriCall(newBuilderCall: Parser.SyntaxNode): boolean;

package/dist/core/group/extractors/http-patterns/java-static-path.js

@@ -0,0 +1,248 @@
+import { unquoteLiteral } from '../tree-sitter-scanner.js';
+// ─── Statically-resolvable consumer path + builder verb-walk helpers ──────
+// RestTemplate calls increasingly pass a non-literal path argument that is
+// still statically derivable — `URI.create("/x")` or a `UriComponentsBuilder`
+// fluent chain. These helpers resolve those shapes to a literal path; a
+// genuinely dynamic argument (a variable, a non-`URI`/`UriComponentsBuilder`
+// call) resolves to null and the call site is skipped. This module also owns
+// the OkHttp / Java-HttpClient builder verb-walks (`inferOkHttpMethod` /
+// `inferHttpClientMethod`), which recover the request verb by walking UP the
+// fluent chain from the matched `.url(...)` / `.uri(...)` call. Extracted from
+// java.ts (#2268) so that plugin stays under ~1000 lines; the `methodInvocation*`
+// primitives + `firstLiteralArgument` are module-internal (shared by the path
+// resolvers and the verb-walks), while the path resolver and the two verb-walks
+// are java.ts's only entry points here.
+function methodInvocationName(node) {
+    return node.type === 'method_invocation' ? (node.childForFieldName('name')?.text ?? null) : null;
+}
+function methodInvocationObject(node) {
+    return node.type === 'method_invocation' ? node.childForFieldName('object') : null;
+}
+function methodInvocationArguments(node) {
+    const argsNode = node.type === 'method_invocation' ? node.childForFieldName('arguments') : null;
+    return argsNode?.namedChildren ?? [];
+}
+function firstLiteralArgument(node) {
+    const first = methodInvocationArguments(node)[0];
+    return first?.type === 'string_literal' ? unquoteLiteral(first.text) : null;
+}
+/** Resolve a `URI.create("/path")` call to its literal path; null otherwise. */
+function extractUriCreatePath(node) {
+    if (node.type !== 'method_invocation')
+        return null;
+    if (methodInvocationObject(node)?.text !== 'URI' || methodInvocationName(node) !== 'create')
+        return null;
+    return firstLiteralArgument(node);
+}
+// Join a builder base with a sub-path using exactly one separating slash. This
+// is intentionally NOT the shared `joinPath`: `joinPath` force-prepends `/`,
+// whereas `appendPath` must preserve an absolute/host base (`fromHttpUrl`
+// "https://host/api") so the host survives until `normalizeConsumerPath` strips
+// it downstream. Do not unify the two.
+function appendPath(base, subPath) {
+    if (!base)
+        return subPath.startsWith('/') ? subPath : `/${subPath}`;
+    if (!subPath)
+        return base;
+    return `${base.replace(/\/+$/, '')}/${subPath.replace(/^\/+/, '')}`;
+}
+/**
+ * Resolve a `UriComponentsBuilder` fluent chain to its literal path. Seed
+ * methods (`fromPath`/`fromUriString`/`fromHttpUrl`) return the literal arg
+ * VERBATIM — a `fromHttpUrl("https://host/api")` seed keeps its host, which the
+ * shared `normalizeConsumerPath` later reduces to the path (the same single
+ * normalization point every other consumer path goes through). `path` and
+ * `pathSegment` append literal segments; `build`/`toUriString`/`toUri`/`encode`
+ * and the `query*` family pass through (query attributes do not change the
+ * path). Any non-literal segment or unknown call → null.
+ */
+// A UriComponentsBuilder chain deeper than this is not realistic source; cap the
+// recursion so a pathological / machine-generated chain returns null instead of
+// overflowing the stack (mirrors the project's other AST-depth guards).
+const MAX_BUILDER_DEPTH = 100;
+function extractUriComponentsBuilderPath(node, depth = 0) {
+    if (depth > MAX_BUILDER_DEPTH)
+        return null;
+    if (node.type !== 'method_invocation')
+        return null;
+    const name = methodInvocationName(node);
+    const objectNode = methodInvocationObject(node);
+    if ((name === 'fromPath' || name === 'fromUriString' || name === 'fromHttpUrl') &&
+        objectNode?.text === 'UriComponentsBuilder') {
+        // Strip any `?query` baked into the seed literal so a later `.path()` appends
+        // to a clean base; otherwise the sub-path is glued after the query
+        // (`/base?x=1/sub`) and normalizeHttpPath truncates the whole tail at `?`.
+        // A host prefix (`https://h/api`) is preserved and stripped downstream by
+        // normalizeConsumerPath.
+        const seed = firstLiteralArgument(node);
+        return seed === null ? null : seed.split('?')[0];
+    }
+    if (!objectNode)
+        return null;
+    if (name === 'path') {
+        const base = extractUriComponentsBuilderPath(objectNode, depth + 1);
+        const subPath = firstLiteralArgument(node);
+        if (base === null || subPath === null)
+            return null;
+        // Spring `UriComponentsBuilder.path(p)` appends `p` VERBATIM (no slash
+        // inserted — unlike `pathSegment`, which slash-joins), then normalizes the
+        // full path to collapse duplicate slashes. So `fromPath("/api").path("users")`
+        // → `/apiusers`, while `.path("/users")` → `/api/users`, and a trailing-slash
+        // base collapses (`/api/` + `/users` → `/api/users`). The `(?<!:)` keeps a
+        // scheme `://` in a host seed intact; the downstream normalizer is the other
+        // slash-collapser for consumer paths (see KTD2 — do not remove it).
+        return (base + subPath).replace(/(?<!:)\/{2,}/g, '/');
+    }
+    if (name === 'pathSegment') {
+        const base = extractUriComponentsBuilderPath(objectNode, depth + 1);
+        if (base === null)
+            return null;
+        const args = methodInvocationArguments(node);
+        const segments = args
+            .map((arg) => (arg.type === 'string_literal' ? unquoteLiteral(arg.text) : null))
+            .filter((segment) => segment !== null);
+        if (segments.length !== args.length)
+            return null; // a non-literal segment defeats static resolution
+        return segments.reduce((acc, segment) => appendPath(acc, segment), base);
+    }
+    if (name === 'build' ||
+        name === 'toUriString' ||
+        name === 'toUri' ||
+        name === 'encode' ||
+        name === 'query' ||
+        name === 'queryParam' ||
+        name === 'queryParams' ||
+        name === 'replaceQuery' ||
+        name === 'replaceQueryParam' ||
+        name === 'replaceQueryParams')
+        return extractUriComponentsBuilderPath(objectNode, depth + 1);
+    return null;
+}
+/**
+ * Resolve a statically-derivable path argument to a literal path: a bare
+ * string literal, a `URI.create("/x")` call, or a `UriComponentsBuilder`
+ * fluent chain. Genuinely dynamic arguments → null.
+ */
+export function extractStaticPathExpression(node) {
+    if (node.type === 'string_literal')
+        return unquoteLiteral(node.text);
+    return extractUriCreatePath(node) ?? extractUriComponentsBuilderPath(node);
+}
+// ─── Builder verb-walks ───────────────────────────────────────────────
+// OkHttp / Java-HttpClient encode the request verb on a SIBLING call elsewhere in
+// the fluent chain, not on the matched path call. Both queries capture the path
+// call (`.url(...)` / `.uri(...)`); these helpers recover the verb by scanning
+// the WHOLE chain — transparent to neutral calls (`.addHeader()`/`.header()`/
+// `.timeout()`/`.version()`) wherever they sit relative to the path call, so the
+// verb resolves whether it precedes or follows the path call.
+/** Every `method_invocation` in the fluent chain `pathCall` belongs to, ordered
+ *  innermost (next to the construction) → outermost (terminal). Lets the verb-walk
+ *  find the verb wherever it sits, and lets the root gates inspect the chain base. */
+function builderChainCalls(pathCall) {
+    let innermost = pathCall;
+    let obj = methodInvocationObject(innermost);
+    while (obj?.type === 'method_invocation') {
+        innermost = obj;
+        obj = methodInvocationObject(innermost);
+    }
+    const calls = [innermost];
+    let cur = innermost;
+    let parent = cur.parent;
+    while (parent?.type === 'method_invocation' && methodInvocationObject(parent)?.id === cur.id) {
+        calls.push(parent);
+        cur = parent;
+        parent = parent.parent;
+    }
+    return calls;
+}
+/** Scan the chain for the verb a `name`-matching helper or a `.method("LITERAL")`
+ *  call sets, resolving the LAST such call — each verb-setter overwrites the
+ *  previous at runtime, so on the (non-idiomatic) chain that sets two verbs the
+ *  one nearest the terminal wins. `null` means "verb is set but not statically
+ *  resolvable" (a non-literal/empty `.method(verb)`) → the caller skips rather
+ *  than guessing. `defaultVerb` is returned only when the chain has no verb call
+ *  at all (a bare build). `verbHelpers` are matched on the method NAME (OkHttp
+ *  helpers are lowercase, HttpClient helpers uppercase). */
+function inferBuilderVerb(pathCall, verbHelpers, defaultVerb) {
+    let lastVerbCall = null;
+    for (const call of builderChainCalls(pathCall)) {
+        if (call.id === pathCall.id)
+            continue; // the path call itself is never the verb
+        const name = methodInvocationName(call);
+        if (name === 'method' || (name !== null && verbHelpers.includes(name)))
+            lastVerbCall = call;
+    }
+    if (lastVerbCall === null)
+        return defaultVerb; // no verb call → builder default
+    const name = methodInvocationName(lastVerbCall);
+    // Explicit `.method(...)`: a non-empty string-literal verb resolves; a
+    // non-literal (variable-bound) OR empty-string verb is unresolvable → null
+    // (skip), NOT a guessed default or a malformed empty-method contract.
+    if (name === 'method') {
+        const verb = firstLiteralArgument(lastVerbCall);
+        return verb ? verb.toUpperCase() : null;
+    }
+    return name === null ? defaultVerb : name.toUpperCase(); // a verb-helper name
+}
+const OK_HTTP_VERB_HELPERS = ['get', 'head', 'post', 'put', 'delete', 'patch'];
+const HTTP_CLIENT_VERB_HELPERS = ['GET', 'POST', 'PUT', 'DELETE', 'HEAD'];
+/**
+ * Infer an OkHttp request verb by scanning the builder chain around the matched
+ * `.url(...)` call: a `.get()/.head()/.post()/.put()/.delete()/.patch()` helper
+ * (before or after `.url()`), or a `.method("VERB", …)` literal, wins. Returns
+ * `'GET'` only when the chain has NO verb call at all (a bare `.url(...).build()`
+ * — OkHttp's real default). Returns `null` for an explicit `.method(verb, …)`
+ * whose verb is a non-literal: the verb is set but not statically resolvable, so
+ * the caller skips the call rather than asserting a wrong GET (parity with the
+ * WebClient long-form variable-bound-verb behavior, which also skips).
+ */
+export function inferOkHttpMethod(urlCall) {
+    return inferBuilderVerb(urlCall, OK_HTTP_VERB_HELPERS, 'GET');
+}
+/**
+ * Infer a Java-`HttpClient` request verb by walking UP the builder chain from the
+ * matched `.uri(URI.create("..."))` call: the first `.GET()/.POST()/.PUT()/`
+ * `.DELETE()/.HEAD()` verb-helper, or a `.method("VERB", body)` literal, wins.
+ * Returns `'GET'` only when the chain has no verb call (a bare `.build()` — the
+ * builder's real default). Returns `null` for an explicit `.method(verb, …)` with
+ * a non-literal verb (skip, not a guessed GET). The scan is transparent to
+ * neutral calls anywhere in the chain (`.header()`/`.timeout()`/`.version()`),
+ * before or after `.uri()`, so neither a header/timeout hop nor a verb call's
+ * position drops the contract.
+ */
+export function inferHttpClientMethod(uriCall) {
+    return inferBuilderVerb(uriCall, HTTP_CLIENT_VERB_HELPERS, 'GET');
+}
+// ─── Builder-chain root gates (anti-overreach) ────────────────────────
+// The path queries match a bare `.url(...)` / `.uri(URI.create(...))` call on ANY
+// receiver so that a builder call BEFORE the path call (`new Request.Builder()`
+// `.addHeader(...).url(...)`, `HttpRequest.newBuilder().version(v).uri(...)`) is
+// still captured. These gates re-impose the framework anchor in JS — only a chain
+// that bottoms out on the right construction emits, so a `.url(...)`/`.uri(...)`
+// on an unrelated object does not.
+/** True when `urlCall`'s receiver chain bottoms out on a `new Request.Builder()`
+ *  object-creation (descending the `.object` chain past any intervening calls). */
+export function okHttpUrlRootsAtBuilder(urlCall) {
+    let obj = methodInvocationObject(urlCall);
+    while (obj?.type === 'method_invocation')
+        obj = methodInvocationObject(obj);
+    return (obj?.type === 'object_creation_expression' &&
+        obj.childForFieldName('type')?.text === 'Request.Builder');
+}
+/** True when `uriCall`'s receiver chain includes a `HttpRequest.newBuilder()`. */
+export function httpClientUriRootsAtNewBuilder(uriCall) {
+    let obj = methodInvocationObject(uriCall);
+    while (obj?.type === 'method_invocation') {
+        if (methodInvocationName(obj) === 'newBuilder' &&
+            methodInvocationObject(obj)?.text === 'HttpRequest')
+            return true;
+        obj = methodInvocationObject(obj);
+    }
+    return false;
+}
+/** True when a `HttpRequest.newBuilder(URI.create(...))` chain ALSO calls `.uri(...)`
+ *  later — a later `.uri()` overrides the constructor URI at runtime, so the
+ *  constructor-arg path must NOT be emitted (the `.uri()` query emits the override). */
+export function httpClientChainHasUriCall(newBuilderCall) {
+    return builderChainCalls(newBuilderCall).some((call) => call.id !== newBuilderCall.id && methodInvocationName(call) === 'uri');
+}

package/dist/core/group/extractors/http-patterns/java.js

@@ -2,6 +2,7 @@ import Java from 'tree-sitter-java';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
 import { METHOD_ANNOTATION_TO_HTTP, isRouteMemberKey, findEnclosingClass, } from '../../../ingestion/route-extractors/spring-shared.js';
 import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_RE, EXCHANGE_ANNOTATION_TO_HTTP, parseRequestLine, pushPrefix, joinPath, scanSpringInheritanceProject, OPENFEIGN_FRAMEWORK, HTTP_INTERFACE_FRAMEWORK, FEIGN_CONFIDENCE, REQUEST_LINE_CONFIDENCE, EXCHANGE_CONFIDENCE, } from './spring-consumer-shared.js';
+import { extractStaticPathExpression, inferOkHttpMethod, inferHttpClientMethod, okHttpUrlRootsAtBuilder, httpClientUriRootsAtNewBuilder, httpClientChainHasUriCall, } from './java-static-path.js';
 /**
  * Java HTTP plugin. Handles:
  *   - Spring `@RequestMapping` class prefixes + `@(Get|Post|...)Mapping` method annotations
@@ -64,17 +65,15 @@ import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_R
 // sidesteps that hazard entirely; all name/key discrimination lives in the
 // for-loop, where it reads as straight-line code.
 //
-// KNOWN LIMITATION — fully-qualified route annotations are not matched. `@ann`
-// binds `name: (identifier)`, but a FQN annotation (`@org.springframework…
-// GetMapping("/x")`) parses its name as a `scoped_identifier`, which this query
-// does not match, so its route is not extracted. (The class is still recognized
-// as a controller — `hasAnnotation` trailing-segment-matches the FQN — only the
-// route-string extraction is missed.) In practice annotations are imported and
-// written by simple name, so this is rare. It is a minor asymmetry with the
-// Kotlin plugin, whose grammar models a FQN as separate `type_identifier`
-// segments that its route queries DO match. Aligning Java would mean matching
-// `scoped_identifier` too; that is deferred to avoid re-keying existing Java
-// contracts via the predicate hazard above. Pinned by an anti-overreach test.
+// FULLY-QUALIFIED route annotations ARE matched. `@ann` binds either an
+// `identifier` (simple name) or a `scoped_identifier` (a FQN annotation such as
+// `@org.springframework…GetMapping("/x")`); the for-loop normalizes the name to
+// its trailing segment via `simpleName` before discriminating. This is a node-
+// type widening only — the query stays predicate-free, so it does NOT reintroduce
+// the bucket hazard above, and a simple name maps to itself so existing Java
+// contracts are unchanged (only previously-unmatched FQN annotations gain
+// routes). This brings Java to parity with the Kotlin plugin, whose grammar
+// already matches FQN route annotations.
 const JAVA_ROUTE_ANNOTATION_PATTERNS = compilePatterns({
     name: 'java-route-annotation',
     language: Java,
@@ -86,17 +85,17 @@ const JAVA_ROUTE_ANNOTATION_PATTERNS = compilePatterns({
           (class_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list [(string_literal) @value (element_value_array_initializer (string_literal) @value)])))) @node
           (interface_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list [(string_literal) @value (element_value_array_initializer (string_literal) @value)])))) @node
           (class_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list
                   (element_value_pair
                     key: (identifier) @key
@@ -104,7 +103,7 @@ const JAVA_ROUTE_ANNOTATION_PATTERNS = compilePatterns({
           (interface_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list
                   (element_value_pair
                     key: (identifier) @key
@@ -112,13 +111,13 @@ const JAVA_ROUTE_ANNOTATION_PATTERNS = compilePatterns({
           (method_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list [(string_literal) @value (element_value_array_initializer (string_literal) @value)])))
             name: (identifier) @member) @node
           (method_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list
                   (element_value_pair
                     key: (identifier) @key
@@ -154,7 +153,7 @@ const REST_TEMPLATE_PATTERNS = compilePatterns({
         (method_invocation
           object: (identifier) @obj (#eq? @obj "restTemplate")
           name: (identifier) @method
-          arguments: (argument_list . (string_literal) @path))
+          arguments: (argument_list . (_) @path))
       `,
         },
     ],
@@ -170,7 +169,7 @@ const REST_TEMPLATE_EXCHANGE_PATTERNS = compilePatterns({
           object: (identifier) @obj (#eq? @obj "restTemplate")
           name: (identifier) @method (#eq? @method "exchange")
           arguments: (argument_list
-            . (string_literal) @path
+            . (_) @path
             (field_access
               object: (identifier) @httpMethodCls (#eq? @httpMethodCls "HttpMethod")
               field: (identifier) @http_method)))
@@ -226,10 +225,14 @@ const WEB_CLIENT_LONG_FORM_PATTERNS = compilePatterns({
         },
     ],
 });
-// ─── Consumer: OkHttp `new Request.Builder().url("path")` ─────────────
-// Note: `Request.Builder` is a `scoped_type_identifier` whose text includes
-// the dot, so `#eq?` against the literal string matches cleanly (no need
-// to escape a regex dot).
+// ─── Consumer: OkHttp `Request.Builder()…url("path")` ─────────────────
+// Match a bare `.url("literal")` call on ANY receiver, capturing it as `@call`.
+// `okHttpUrlRootsAtBuilder` (JS) then verifies the receiver chain bottoms out on
+// `new Request.Builder()` — re-imposing the framework anchor while allowing
+// builder calls BEFORE `.url()` (`new Request.Builder().addHeader(...).url("/x")`)
+// that the old object-direct query dropped, and rejecting a `.url(...)` on an
+// unrelated object. The verb is recovered by `inferOkHttpMethod` scanning the
+// whole chain (java-static-path.ts).
 const OK_HTTP_PATTERNS = compilePatterns({
     name: 'java-okhttp',
     language: Java,
@@ -238,14 +241,21 @@ const OK_HTTP_PATTERNS = compilePatterns({
             meta: {},
             query: `
         (method_invocation
-          object: (object_creation_expression
-            type: (scoped_type_identifier) @type (#eq? @type "Request.Builder"))
           name: (identifier) @method (#eq? @method "url")
-          arguments: (argument_list . (string_literal) @path))
+          arguments: (argument_list . (string_literal) @path)) @call
       `,
         },
     ],
 });
+// Match a bare `.uri(URI.create("literal"))` call on ANY receiver, capturing it
+// as `@call`. `httpClientUriRootsAtNewBuilder` (JS) verifies the chain includes
+// `HttpRequest.newBuilder()` — allowing calls BEFORE `.uri()` (`.version(v)`
+// `.uri(...)`) that the old object-direct query dropped, and rejecting a `.uri(...)`
+// on an unrelated object (e.g. WebClient). The verb (a `.GET()/.POST()/.PUT()/`
+// `.DELETE()/.HEAD()` helper, a `.method("VERB", body)` literal, or the bare-build
+// default) is recovered by `inferHttpClientMethod` scanning the whole chain.
+// Matching `.uri(...)` regardless of a trailing `.build()` mirrors the accepted
+// OkHttp over-match posture.
 const JAVA_HTTP_CLIENT_PATTERNS = compilePatterns({
     name: 'java-http-client',
     language: Java,
@@ -254,18 +264,35 @@ const JAVA_HTTP_CLIENT_PATTERNS = compilePatterns({
             meta: {},
             query: `
         (method_invocation
-          object: (method_invocation
-            object: (method_invocation
-              object: (identifier) @builderCls (#eq? @builderCls "HttpRequest")
-              name: (identifier) @newBuilder (#eq? @newBuilder "newBuilder")
-              arguments: (argument_list))
-            name: (identifier) @uri_method (#eq? @uri_method "uri")
-            arguments: (argument_list
-              (method_invocation
-                object: (identifier) @uriCls (#eq? @uriCls "URI")
-                name: (identifier) @create (#eq? @create "create")
-                arguments: (argument_list . (string_literal) @path))))
-          name: (identifier) @http_method (#match? @http_method "^(GET|POST|PUT|DELETE)$"))
+          name: (identifier) @uri_method (#eq? @uri_method "uri")
+          arguments: (argument_list
+            (method_invocation
+              object: (identifier) @uriCls (#eq? @uriCls "URI")
+              name: (identifier) @create (#eq? @create "create")
+              arguments: (argument_list . (string_literal) @path)))) @call
+      `,
+        },
+    ],
+});
+// Constructor-arg form: `HttpRequest.newBuilder(URI.create("..."))` — the path is
+// the `newBuilder(...)` argument, with no `.uri()` call. Captures the `newBuilder`
+// call as `@call`; the emission skips it when a later `.uri(...)` overrides the
+// constructor URI (`httpClientChainHasUriCall`), so the `.uri()` query owns that case.
+const JAVA_HTTP_CLIENT_CTOR_PATTERNS = compilePatterns({
+    name: 'java-http-client-ctor',
+    language: Java,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (method_invocation
+          object: (identifier) @builderCls (#eq? @builderCls "HttpRequest")
+          name: (identifier) @newBuilder (#eq? @newBuilder "newBuilder")
+          arguments: (argument_list
+            (method_invocation
+              object: (identifier) @uriCls (#eq? @uriCls "URI")
+              name: (identifier) @create (#eq? @create "create")
+              arguments: (argument_list . (string_literal) @path)))) @call
       `,
         },
     ],
@@ -307,6 +334,17 @@ function findEnclosingInterface(node) {
 function getNodeName(node) {
     return node.childForFieldName('name')?.text ?? null;
 }
+/**
+ * Trailing segment of a possibly fully-qualified annotation name
+ * (`org.springframework.web.bind.annotation.GetMapping` → `GetMapping`). The
+ * route query binds `@ann` to either an `identifier` (simple) or a
+ * `scoped_identifier` (FQN); normalizing here lets the one for-loop discriminate
+ * on the simple name in both cases. A simple name maps to itself, so this never
+ * changes how a non-FQN annotation is classified.
+ */
+function simpleName(text) {
+    return text.split('.').pop() ?? text;
+}
 function hasAnnotation(node, names) {
     const modifiers = node.namedChildren.find((child) => child.type === 'modifiers');
     if (!modifiers)
@@ -316,9 +354,8 @@ function hasAnnotation(node, names) {
     while (stack.length > 0) {
         const cur = stack.pop();
         const annotationName = cur.childForFieldName('name')?.text ?? '';
-        const simpleName = annotationName.split('.').pop() ?? annotationName;
         if ((cur.type === 'annotation' || cur.type === 'marker_annotation') &&
-            (allowed.has(annotationName) || allowed.has(simpleName))) {
+            (allowed.has(annotationName) || allowed.has(simpleName(annotationName)))) {
             return true;
         }
         stack.push(...cur.namedChildren);
@@ -359,7 +396,13 @@ function scanRouteAnnotations(tree) {
         const valueNode = captures.value;
         if (!annNode || !node || !valueNode)
             continue;
-        const ann = annNode.text;
+        // Discrimination is on the trailing segment only (`simpleName`), so a
+        // non-Spring annotation whose last segment collides with a route annotation
+        // (e.g. `@com.evil.GetMapping("/x")`) is treated as a route. This is the
+        // same accepted trailing-segment trade-off `hasAnnotation` already makes and
+        // the intended parity with the Kotlin plugin — package-origin gating would
+        // break that parity and is deliberately not done.
+        const ann = simpleName(annNode.text);
         const keyNode = captures.key; // undefined for the positional shape
         if (node.type === 'method_declaration') {
             // Method-level: a Spring `@(Get|...)Mapping` route, or native `@RequestLine`.
@@ -630,7 +673,7 @@ export const JAVA_HTTP_PLUGIN = {
             const httpMethod = REST_TEMPLATE_TO_HTTP[methodNode.text];
             if (!httpMethod)
                 continue;
-            const path = unquoteLiteral(pathNode.text);
+            const path = extractStaticPathExpression(pathNode);
             if (path === null)
                 continue;
             out.push({
@@ -647,7 +690,7 @@ export const JAVA_HTTP_PLUGIN = {
             const pathNode = match.captures.path;
             if (!httpMethodNode || !pathNode)
                 continue;
-            const path = unquoteLiteral(pathNode.text);
+            const path = extractStaticPathExpression(pathNode);
             if (path === null)
                 continue;
             out.push({
@@ -709,37 +752,84 @@ export const JAVA_HTTP_PLUGIN = {
             });
         }
         // ─── Consumers: OkHttp Request.Builder().url("path") ────────────
+        // Match any `.url("literal")`, gate to chains rooting at `new Request.Builder()`
+        // (so a call before `.url()` is captured but an unrelated `.url()` is not), then
+        // recover the verb (`.post()`/`.method("X")`) by scanning the builder chain.
         for (const match of runCompiledPatterns(OK_HTTP_PATTERNS, tree)) {
+            const callNode = match.captures.call;
             const pathNode = match.captures.path;
-            if (!pathNode)
+            if (!callNode || !pathNode)
+                continue;
+            if (!okHttpUrlRootsAtBuilder(callNode))
                 continue;
             const path = unquoteLiteral(pathNode.text);
             if (path === null)
                 continue;
+            const method = inferOkHttpMethod(callNode);
+            // An explicit `.method(verb, …)` with a non-literal or empty verb is
+            // unresolvable (null) — emit nothing rather than a wrong GET or an empty
+            // `http::::/path` contract.
+            if (!method)
+                continue;
             out.push({
                 role: 'consumer',
                 framework: 'okhttp',
-                method: 'GET',
+                method,
                 path,
                 name: null,
                 confidence: 0.7,
             });
         }
         // ─── Consumers: Java HttpClient request builder ─────────────────
-        // Java's builder exposes GET/POST/PUT/DELETE helpers. PATCH uses
-        // `.method("PATCH", body)`, which is intentionally deferred.
+        // Match any `.uri(URI.create("..."))`, gate to chains including `HttpRequest`
+        // `.newBuilder()` (so a call before `.uri()` is captured but an unrelated
+        // `.uri()` is not); `inferHttpClientMethod` scans the chain for the verb — a
+        // `.GET()/.POST()/.PUT()/.DELETE()/.HEAD()` helper, a `.method("VERB", body)`
+        // literal, or the bare-build default GET. A variable-bound `.method(verb, …)`
+        // is unresolvable → emit nothing. Mirrors the OkHttp loop above. The
+        // constructor-arg form (`newBuilder(URI.create(...))`, no `.uri()`) follows.
         for (const match of runCompiledPatterns(JAVA_HTTP_CLIENT_PATTERNS, tree)) {
-            const httpMethodNode = match.captures.http_method;
+            const callNode = match.captures.call;
             const pathNode = match.captures.path;
-            if (!httpMethodNode || !pathNode)
+            if (!callNode || !pathNode)
+                continue;
+            if (!httpClientUriRootsAtNewBuilder(callNode))
                 continue;
             const path = unquoteLiteral(pathNode.text);
             if (path === null)
                 continue;
+            const method = inferHttpClientMethod(callNode);
+            if (!method)
+                continue;
             out.push({
                 role: 'consumer',
                 framework: 'java-http-client',
-                method: httpMethodNode.text.toUpperCase(),
+                method,
+                path,
+                name: null,
+                confidence: 0.65,
+            });
+        }
+        // Constructor-arg form: `HttpRequest.newBuilder(URI.create("..."))` with the
+        // path in the constructor and no overriding `.uri(...)` later in the chain
+        // (a later `.uri()` wins at runtime, so the loop above owns that case).
+        for (const match of runCompiledPatterns(JAVA_HTTP_CLIENT_CTOR_PATTERNS, tree)) {
+            const callNode = match.captures.call;
+            const pathNode = match.captures.path;
+            if (!callNode || !pathNode)
+                continue;
+            if (httpClientChainHasUriCall(callNode))
+                continue;
+            const path = unquoteLiteral(pathNode.text);
+            if (path === null)
+                continue;
+            const method = inferHttpClientMethod(callNode);
+            if (!method)
+                continue;
+            out.push({
+                role: 'consumer',
+                framework: 'java-http-client',
+                method,
                 path,
                 name: null,
                 confidence: 0.65,

package/dist/core/group/extractors/http-patterns/kotlin.js

@@ -95,6 +95,119 @@ catch {
 const arrayOfArg = (cap) => `(call_expression
   (simple_identifier) @arrayOf (#eq? @arrayOf "arrayOf")
   (call_suffix (value_arguments (value_argument (string_literal) ${cap}))))`;
+// ─── Kotlin OkHttp builder verb-walk (parity with java-static-path.ts) ──
+// Mirrors `inferOkHttpMethod`, adapted to the Kotlin grammar: a call `X.name(args)`
+// is a `call_expression` whose callee is a `navigation_expression` (receiver +
+// `navigation_suffix` → the method name) and whose `call_suffix` holds the
+// `value_arguments`. The chain is left-nested via `navigation_expression`, so we
+// walk UP from the matched `.url(...)` call to the sibling verb call (`.post()` /
+// `.method("X")`), exactly as the Java side does — so `.java` and `.kt` infer the
+// same verb for the same OkHttp shape.
+const OK_HTTP_VERB_HELPERS = ['get', 'head', 'post', 'put', 'delete', 'patch'];
+/** The method name a Kotlin `call_expression` invokes (its `navigation_suffix`). */
+function kotlinCallName(call) {
+    const callee = call.namedChild(0);
+    if (callee?.type !== 'navigation_expression')
+        return null;
+    for (let i = 0; i < callee.namedChildCount; i++) {
+        const child = callee.namedChild(i);
+        if (child?.type === 'navigation_suffix')
+            return child.namedChild(0)?.text ?? null;
+    }
+    return null;
+}
+/** The first string-literal argument of a Kotlin `call_expression`, else null. */
+function kotlinFirstStringArg(call) {
+    for (let i = 0; i < call.namedChildCount; i++) {
+        const callSuffix = call.namedChild(i);
+        if (callSuffix?.type !== 'call_suffix')
+            continue;
+        for (let j = 0; j < callSuffix.namedChildCount; j++) {
+            const args = callSuffix.namedChild(j);
+            if (args?.type !== 'value_arguments')
+                continue;
+            const firstArg = args.namedChild(0);
+            if (firstArg?.type !== 'value_argument')
+                return null;
+            // Positional literal `"X"`, or named-argument `name = "X"` (the label is a
+            // leading `simple_identifier` and the literal follows). A non-literal value
+            // (a variable) → null → unresolvable.
+            const positional = firstArg.namedChild(0);
+            if (positional?.type === 'string_literal')
+                return unquoteLiteral(positional.text);
+            const labeled = positional?.type === 'simple_identifier' ? firstArg.namedChild(1) : null;
+            return labeled?.type === 'string_literal' ? unquoteLiteral(labeled.text) : null;
+        }
+    }
+    return null;
+}
+/** The receiver expression a Kotlin `call_expression` is invoked on. */
+function kotlinReceiver(call) {
+    const nav = call.namedChild(0);
+    return nav?.type === 'navigation_expression' ? nav.namedChild(0) : null;
+}
+/** The call that invokes a method ON `call` as its receiver — one hop up the chain. */
+function kotlinChainParentCall(call) {
+    const nav = call.parent;
+    if (nav?.type !== 'navigation_expression' || nav.namedChild(0)?.id !== call.id)
+        return null;
+    return nav.parent?.type === 'call_expression' ? nav.parent : null;
+}
+/** Every `call_expression` in the fluent chain `pathCall` belongs to, innermost
+ *  (next to the construction) → outermost. Lets the verb-walk find a verb call
+ *  wherever it sits relative to `.url(...)` — parity with java-static-path.ts
+ *  `builderChainCalls`. */
+function kotlinBuilderChainCalls(pathCall) {
+    let innermost = pathCall;
+    let recv = kotlinReceiver(innermost);
+    while (recv?.type === 'call_expression') {
+        innermost = recv;
+        recv = kotlinReceiver(innermost);
+    }
+    const calls = [innermost];
+    let cur = innermost;
+    for (let next = kotlinChainParentCall(cur); next; next = kotlinChainParentCall(cur)) {
+        calls.push(next);
+        cur = next;
+    }
+    return calls;
+}
+/** True when `urlCall`'s receiver chain bottoms out on `Request.Builder()` — the
+ *  Kotlin anti-overreach gate (mirror of okHttpUrlRootsAtBuilder), so a `.url(...)`
+ *  on an unrelated object is rejected while a builder call before `.url()` is kept. */
+function kotlinUrlRootsAtRequestBuilder(urlCall) {
+    let cur = kotlinReceiver(urlCall);
+    while (cur?.type === 'call_expression') {
+        const recv = kotlinReceiver(cur);
+        if (recv?.type === 'simple_identifier')
+            return recv.text === 'Request' && kotlinCallName(cur) === 'Builder';
+        cur = recv;
+    }
+    return false;
+}
+/** Infer the OkHttp verb by scanning the builder chain around the matched
+ *  `.url(...)` call — parity with java-static-path.ts `inferOkHttpMethod`. The
+ *  LAST verb call wins (runtime overwrite); `null` for an unresolvable
+ *  `.method(verb)` (non-literal/empty) so the caller skips; `'GET'` when the
+ *  chain has no verb call. */
+function inferKotlinOkHttpMethod(urlCall) {
+    let lastVerbCall = null;
+    for (const call of kotlinBuilderChainCalls(urlCall)) {
+        if (call.id === urlCall.id)
+            continue;
+        const name = kotlinCallName(call);
+        if (name === 'method' || (name !== null && OK_HTTP_VERB_HELPERS.includes(name)))
+            lastVerbCall = call;
+    }
+    if (lastVerbCall === null)
+        return 'GET'; // no verb call → OkHttp default
+    const name = kotlinCallName(lastVerbCall);
+    if (name === 'method') {
+        const verb = kotlinFirstStringArg(lastVerbCall);
+        return verb ? verb.toUpperCase() : null;
+    }
+    return name === null ? 'GET' : name.toUpperCase();
+}
 /**
  * Build the plugin only if the Kotlin grammar is available. Compiling
  * the queries against a null grammar would throw at module load time
@@ -382,26 +495,25 @@ function buildKotlinPlugin(language) {
         ],
     });
     // ─── Consumer: OkHttp Request.Builder().url("/x") ─────────────────────
-    // Kotlin parses `Request.Builder()` as a `call_expression` whose
-    // callee is a `navigation_expression` (Request → .Builder), NOT as
-    // Java's `object_creation_expression`. The chain `.url("/x")` then
-    // wraps that in another `call_expression`. The query mirrors Java's
-    // `OK_HTTP_PATTERNS` (java.ts) but adapts the node types.
+    // Full parity with the Java OkHttp extraction (java.ts + java-static-path.ts),
+    // adapted to the Kotlin grammar (a call is a `call_expression` whose callee is a
+    // `navigation_expression`, not Java's `object_creation_expression`):
     //
-    // Receiver `Request` is constrained by name (#eq? @cls); a project
-    // that imports OkHttp's `Request` under an alias (`import okhttp3.Request as OkRequest`)
-    // would not be picked up — this matches the Java plugin's heuristic.
+    //   • Match a bare `.url("literal")` call on ANY receiver (capture it as `@call`);
+    //     `kotlinUrlRootsAtRequestBuilder` (JS) then verifies the receiver chain
+    //     bottoms out on `Request.Builder()` — re-imposing the framework anchor while
+    //     allowing a builder call BEFORE `.url()` (`Request.Builder().addHeader(...)`
+    //     `.url(...)`) and rejecting a `.url(...)` on an unrelated object.
+    //   • `inferKotlinOkHttpMethod` scans the whole chain for the verb (`.post(body)`
+    //     / `.get()` / `.method("X")`, before or after `.url()`) — the mirror of
+    //     `inferOkHttpMethod`. So `Request.Builder().url("/x").post(body).build()`
+    //     becomes `http::POST::/x` on both `.java` and `.kt` (pinned by the Java↔Kotlin
+    //     parity harness). A variable-bound/empty `.method(verb)` is unresolvable →
+    //     the call is skipped (not a guessed GET), matching the Java side.
     //
-    // **Known limitation — verb defaults to GET.** OkHttp encodes the
-    // verb on a *sibling* call further down the builder chain (e.g.
-    // `.post(body)` / `.get()` / `.delete()`), not on `.url(...)` itself.
-    // This query intentionally does not walk the chain to recover the
-    // verb — it emits `method: 'GET'` for every match, mirroring
-    // `java.ts:OK_HTTP_PATTERNS`. So a `Request.Builder().url("/x").post(body).build()`
-    // call becomes `http::GET::/x`, not `http::POST::/x`. This is the
-    // same trade-off Java has accepted; pinned by an anti-overreach
-    // test in `http-route-extractor.test.ts` so a future verb-walk
-    // implementation has to update this comment in lockstep.
+    // Receiver `Request` is constrained by name (in the JS gate); a project that
+    // imports OkHttp's `Request` under an alias would not be picked up — matching the
+    // Java plugin's heuristic.
     const OK_HTTP_PATTERNS = compilePatterns({
         name: 'kotlin-okhttp',
         language,
@@ -411,14 +523,9 @@ function buildKotlinPlugin(language) {
                 query: `
           (call_expression
             (navigation_expression
-              (call_expression
-                (navigation_expression
-                  (simple_identifier) @cls (#eq? @cls "Request")
-                  (navigation_suffix (simple_identifier) @builder (#eq? @builder "Builder")))
-                (call_suffix (value_arguments)))
               (navigation_suffix (simple_identifier) @method (#eq? @method "url")))
             (call_suffix
-              (value_arguments . (value_argument . (string_literal) @path))))
+              (value_arguments . (value_argument . (string_literal) @path)))) @call
         `,
             },
         ],
@@ -945,17 +1052,27 @@ function buildKotlinPlugin(language) {
                 });
             }
             // ─── Consumers: OkHttp Request.Builder().url("path") ────────────
+            // Gate to chains rooting at `Request.Builder()` (so a call before `.url()` is
+            // captured but an unrelated `.url()` is not), then recover the verb by scanning
+            // the chain (parity with Java); a variable-bound or empty `.method(verb)` is
+            // unresolvable → emit nothing rather than a GET.
             for (const match of runCompiledPatterns(OK_HTTP_PATTERNS, tree)) {
+                const callNode = match.captures.call;
                 const pathNode = match.captures.path;
-                if (!pathNode)
+                if (!callNode || !pathNode)
+                    continue;
+                if (!kotlinUrlRootsAtRequestBuilder(callNode))
                     continue;
                 const path = unquoteLiteral(pathNode.text);
                 if (path === null)
                     continue;
+                const method = inferKotlinOkHttpMethod(callNode);
+                if (!method)
+                    continue;
                 out.push({
                     role: 'consumer',
                     framework: 'okhttp',
-                    method: 'GET',
+                    method,
                     path,
                     name: null,
                     confidence: 0.7,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.9-rc.4",
+  "version": "1.6.9-rc.5",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",