graph-indexer 1.0.3 → 1.1.0

package/README.md

@@ -26,6 +26,7 @@
 - [Best practices](#best-practices)
 - [Troubleshooting](#troubleshooting)
 - [Development](#development)
+- [Security](#security)
 - [License](#license)
 
 ---
@@ -350,7 +351,9 @@ When you run `npm run mcp:index`:
 4. **Creates two indexes**: a BM25 inverted index (lexical) and per-chunk float32 embeddings via Ollama `nomic-embed-text` (optional).
 5. **Serializes to disk**: `code-index.json` + `code-index.embeddings.bin`.
 
-A background watcher daemon re-indexes changed files automatically.
+A background watcher daemon re-indexes changed files automatically. It respects
+`.gitignore` and skips `node_modules`, build output, and dot-directories, so it
+never traverses (or exhausts OS file-watcher limits on) dependency trees.
 
 ### Search pipeline
 
@@ -420,6 +423,18 @@ npm run mcp:start   # start MCP server
 
 ---
 
+## Security
+
+graph-indexer runs locally and is air-gapped by default — its only outbound call
+is to a local Ollama endpoint for embeddings (skipped entirely with
+`INDEXER_EMBEDDINGS=off`). It never executes the code it indexes, and the index
+artifacts contain source snippets, so keep them git-ignored (as `init` configures).
+
+See [SECURITY.md](SECURITY.md) for the full threat model and how to report a
+vulnerability.
+
+---
+
 ## License
 
 Released under the [MIT License](LICENSE). Copyright (c) 2026 MaquinaTech.

package/indexer.mjs

@@ -19,7 +19,7 @@ import fs from 'fs';
 import path from 'path';
 import {
     MAX_FILE_SIZE_BYTES, EXTENSIONS, getParserForFile, buildIgnoreFilter, getLocalEmbeddingsBatch,
-    extractImportsFromAST, extractSemanticChunks, resolveLocalImports
+    extractImportsFromAST, extractSemanticChunks, resolveLocalImports, buildEmbeddingPayload
 } from './parser-utils.mjs';
 import { MemoryGraphIndex, writeEmbeddingBinary } from './core-engine.mjs';
 
@@ -113,27 +113,9 @@ async function main() {
         console.time("Embedding Generation Duration");
 
         const worker = async (batch) => {
-            const textsToEmbed = batch.map(c => {
-                const dependencies = indexData.graph.dependencies[c.file_path] || [];
-                const cleanDeps = dependencies.map(d => {
-                    const depsFile = path.relative(PROJECT_ROOT, d);
-                    const chunkMatches = indexData.chunks.filter(c => c.file_path === depsFile);
-                    return chunkMatches.map(c => c.name).join(' ');
-                });
-                const topologicalContext = cleanDeps.length > 0
-                    ? `This code architectural neighborhood connects with: ${cleanDeps.join(', ')}.`
-                    : '';
-
-                return [
-                    `File Location: ${c.file_path}`,
-                    `Symbol Name: ${c.node_type} -> ${c.name}`,
-                    c.docstring ? `Developer Documentation: ${c.docstring}` : '',
-                    c.type_refs?.length ? `Type References: ${c.type_refs.join(', ')}` : '',
-                    topologicalContext,
-                    `--- Source Code ---`,
-                    c.code_snippet
-                ].filter(Boolean).join('\n');
-            });
+            const textsToEmbed = batch.map(c =>
+                buildEmbeddingPayload(c, indexData.graph.dependencies[c.file_path] || [])
+            );
 
             const embeddingsMatrix = await getLocalEmbeddingsBatch(textsToEmbed, true);
             if (embeddingsMatrix && embeddingsMatrix.length === batch.length) {

package/mcp-server.mjs

@@ -21,6 +21,15 @@ const PROJECT_ROOT = process.env.MCP_PROJECT_ROOT || process.cwd();
 const INDEX_PATH = resolve(PROJECT_ROOT, "code-index.json");
 const PID_FILE = resolve(PROJECT_ROOT, ".idx-daemon.pid");
 
+// Single source of truth for the version: graph-indexer's own package.json
+// (next to this file), never the consumer project's package.json.
+const PACKAGE_DIR = path.dirname(fileURLToPath(import.meta.url));
+function readPackageVersion() {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(PACKAGE_DIR, "package.json"), "utf-8")).version || "0.0.0";
+    } catch { return "0.0.0"; }
+}
+
 // ─── Daemon Orchestration ─────────────────────────────────────────────────────
 
 function ensureDaemonRunning() {
@@ -100,7 +109,7 @@ function pruneBodyByQuery(codeSnippet, queryTokens, maxLines = 40) {
 // ─── Server Initialization ────────────────────────────────────────────────────
 
 ensureDaemonRunning();
-const version = "1.0.3";
+const version = readPackageVersion();
 const server = new McpServer({ name: "graph-indexer", version });
 
 // Use lazy (disk-backed) vector loading for large corpora — cacheEmbeddings:false

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "graph-indexer",
-    "version": "1.0.3",
+    "version": "1.1.0",
     "description": "Zero-DB, Air-gapped, In-Memory Graph Indexer MCP Server with Hybrid RRF Search and Cross-Language Topology",
     "type": "module",
     "main": "core-engine.mjs",
@@ -26,6 +26,7 @@
     "scripts": {
         "start": "node ./mcp-server.mjs",
         "test": "node test/run.mjs",
+        "test:unit": "node test/unit.mjs",
         "test:setup": "node test/setup.mjs",
         "test:run": "node test/run.mjs",
         "test:embeddings": "OLLAMA_HOST=http://localhost:11435 node test/run-embeddings.mjs",

package/parser-utils.mjs

@@ -637,6 +637,38 @@ export function resolveLocalImports(rawImports, fromFileRelPath, projectRoot) {
     return resolved;
 }
 
+/**
+ * Build the text payload sent to the embedding model for a chunk.
+ *
+ * Shared by the bootstrap indexer (indexer.mjs) and the watch daemon
+ * (watch-daemon.mjs) so a chunk yields the SAME embedding regardless of which
+ * path embedded it first. This matters because the cache key (content_hash) is
+ * derived from code + docstring only — it does NOT include this payload — so two
+ * divergent payloads for the same hash would silently produce inconsistent
+ * embeddings across a full re-index vs. an incremental update.
+ *
+ * @param {object}   chunk        Semantic chunk: { file_path, node_type, name, docstring, type_refs, code_snippet }.
+ * @param {string[]} depRelPaths  Resolved local imports of the chunk's file (project-relative paths).
+ * @returns {string}
+ */
+export function buildEmbeddingPayload(chunk, depRelPaths = []) {
+    const neighbors = depRelPaths
+        .map(d => path.basename(d, path.extname(d)))
+        .filter(Boolean);
+    const topologicalContext = neighbors.length
+        ? `This code architectural neighborhood connects with: ${neighbors.join(', ')}.`
+        : '';
+    return [
+        `File Location: ${chunk.file_path}`,
+        `Symbol Name: ${chunk.node_type} -> ${chunk.name}`,
+        chunk.docstring ? `Developer Documentation: ${chunk.docstring}` : '',
+        chunk.type_refs?.length ? `Type References: ${chunk.type_refs.join(', ')}` : '',
+        topologicalContext,
+        `--- Source Code ---`,
+        chunk.code_snippet,
+    ].filter(Boolean).join('\n');
+}
+
 export async function getLocalEmbedding(text, graceful = true) {
     if (process.env.INDEXER_EMBEDDINGS === 'off') return null; // lexical-only mode
     const MAX_RETRIES = 3;

package/watch-daemon.mjs

@@ -22,7 +22,8 @@ import chokidar from 'chokidar';
 import { MemoryGraphIndex } from './core-engine.mjs';
 import {
     MAX_FILE_SIZE_BYTES, EXTENSIONS, getParserForFile, buildIgnoreFilter,
-    extractImportsFromAST, extractSemanticChunks, resolveLocalImports, getLocalEmbeddingsBatch
+    extractImportsFromAST, extractSemanticChunks, resolveLocalImports, getLocalEmbeddingsBatch,
+    buildEmbeddingPayload
 } from './parser-utils.mjs';
 
 const PROJECT_ROOT = process.env.MCP_PROJECT_ROOT || process.cwd();
@@ -79,23 +80,11 @@ async function processFileChange(absolutePath) {
         const chunksToEmbed = newChunks.filter(c => !db.embeddingCache.has(c.content_hash));
 
         if (chunksToEmbed.length > 0) {
-            const textsToEmbed = chunksToEmbed.map(c => {
-                const dependencies = db.graph.dependencies[c.file_path] || [];
-                const cleanDeps = dependencies.map(d => path.basename(d, path.extname(d)));
-                const topologicalContext = cleanDeps.length > 0
-                    ? `This code architectural neighborhood connects with: ${cleanDeps.join(', ')}.`
-                    : '';
-
-                // 🥇 STRICT PAYLOAD PARITY: Eliminate real-time bleed
-                return [
-                    `File Location: ${c.file_path}`,
-                    `Symbol Name: ${c.node_type} -> ${c.name}`,
-                    c.docstring ? `Developer Documentation: ${c.docstring}` : '',
-                    topologicalContext,
-                    `--- Source Code ---`,
-                    c.code_snippet
-                ].filter(Boolean).join('\n');
-            });
+            // 🥇 STRICT PAYLOAD PARITY: identical embedding payload to indexer.mjs
+            // (shared helper) so incremental updates match the bootstrap index.
+            const textsToEmbed = chunksToEmbed.map(c =>
+                buildEmbeddingPayload(c, db.graph.dependencies[c.file_path] || [])
+            );
 
             const embeddingsMatrix = await getLocalEmbeddingsBatch(textsToEmbed, true);
             if (embeddingsMatrix) {
@@ -137,8 +126,23 @@ async function processFileChange(absolutePath) {
 }
 
 process.stderr.write(`🚀 Chokidar Watcher Daemon started in: ${PROJECT_ROOT}\n`);
+
+// Only watch source files we can actually index. Critically, this prevents
+// chokidar from descending into node_modules / dist / .git / .gitignored dirs —
+// watching those would exhaust the OS file-watcher limit (ENOSPC on Linux) and
+// waste CPU/memory on large projects. The ignore decision happens at the watcher
+// level, not just in processFileChange, so ignored trees are never traversed.
+function shouldIgnore(absPath) {
+    const rel = path.relative(PROJECT_ROOT, absPath).replace(/\\/g, '/');
+    if (!rel) return false;                       // the project root itself
+    if (path.basename(absPath).startsWith('.')) return true; // dotfiles / dot-dirs
+    try { return ignoreFilter.ignores(rel); }     // node_modules, dist, .gitignore, …
+    catch { return false; }
+}
+
 const watcher = chokidar.watch(PROJECT_ROOT, {
-    ignored: /(^|[\/\\])\../, persistent: true,
+    ignored: shouldIgnore,
+    persistent: true,
     awaitWriteFinish: { stabilityThreshold: 300, pollInterval: 100 }
 });
 watcher.on('add', processFileChange).on('change', processFileChange).on('unlink', (p) => processFileChange(p));