kodingo-cli 1.3.2 → 1.3.4

package/dist/__tests__/repo-identity.test.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Real tests for repo-identity.ts — build brief "Fix repo-label
+ * contamination at the source, platform-wide" (2026-09-30).
+ *
+ * Uses real temporary git repos (real `git remote add`, real .git dirs)
+ * rather than mocking simple-git, matching this repo's own testing style
+ * (see vendoredCodeDetector.test.ts). Only the network call to the API is
+ * mocked, since there's no real server to hit in a unit test — the
+ * server-side resolve/register logic itself is covered in kodingo-api's
+ * repoIdentityResolve.test.ts.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const repo_identity_1 = require("../utils/repo-identity");
+function makeTempDir() {
+    return node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "kodingo-repo-identity-"));
+}
+(0, node_test_1.describe)("parseRepoNameFromRemote", () => {
+    for (const [url, expected] of [
+        ["git@github.com:abokidev/kodingo-cli.git", "kodingo-cli"],
+        ["https://github.com/abokidev/kodingo-cli.git", "kodingo-cli"],
+        ["https://github.com/abokidev/kodingo-cli", "kodingo-cli"],
+        ["ssh://git@github.com/abokidev/veriport.git", "veriport"],
+        ["https://github.com/abokidev/NDDC-BoardRoom.git/", "NDDC-BoardRoom"],
+    ]) {
+        (0, node_test_1.it)(`extracts "${expected}" from ${url}`, () => {
+            strict_1.default.equal((0, repo_identity_1.parseRepoNameFromRemote)(url), expected);
+        });
+    }
+});
+(0, node_test_1.describe)("getRemoteUrl — against real temporary git repos", () => {
+    let dir;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    (0, node_test_1.it)("returns the real origin fetch URL when one is configured", async () => {
+        (0, node_child_process_1.execSync)("git remote add origin git@github.com:abokidev/achieva.git", { cwd: dir });
+        const url = await (0, repo_identity_1.getRemoteUrl)(dir);
+        strict_1.default.equal(url, "git@github.com:abokidev/achieva.git");
+    });
+    (0, node_test_1.it)("returns null when the repo has no remote at all", async () => {
+        const url = await (0, repo_identity_1.getRemoteUrl)(dir);
+        strict_1.default.equal(url, null);
+    });
+    (0, node_test_1.it)("returns null for a path that isn't a git repo", async () => {
+        const bare = makeTempDir();
+        try {
+            const url = await (0, repo_identity_1.getRemoteUrl)(bare);
+            strict_1.default.equal(url, null);
+        }
+        finally {
+            node_fs_1.default.rmSync(bare, { recursive: true, force: true });
+        }
+    });
+});
+(0, node_test_1.describe)("deriveCandidateRepoName", () => {
+    let dir;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    (0, node_test_1.it)("prefers the git-remote-derived name over the local folder name — this is the whole fix", async () => {
+        (0, node_child_process_1.execSync)("git remote add origin https://github.com/abokidev/veriport.git", { cwd: dir });
+        // The local folder name is deliberately unrelated to the real repo name —
+        // this is exactly the VeriPort/"mac" shape of the original bug.
+        const { candidateName, hasRemote } = await (0, repo_identity_1.deriveCandidateRepoName)(dir);
+        strict_1.default.equal(candidateName, "veriport");
+        strict_1.default.equal(hasRemote, true);
+        strict_1.default.notEqual(candidateName, node_path_1.default.basename(dir));
+    });
+    (0, node_test_1.it)("falls back to the local folder name only when there's truly no remote", async () => {
+        const { candidateName, hasRemote } = await (0, repo_identity_1.deriveCandidateRepoName)(dir);
+        strict_1.default.equal(candidateName, node_path_1.default.basename(dir));
+        strict_1.default.equal(hasRemote, false);
+    });
+});
+(0, node_test_1.describe)("resolveCanonicalRepoName", () => {
+    let dir;
+    const originalFetch = globalThis.fetch;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+        (0, node_child_process_1.execSync)("git remote add origin https://github.com/abokidev/fot.git", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+        globalThis.fetch = originalFetch;
+    });
+    (0, node_test_1.it)("returns the server's resolved canonical name", async () => {
+        globalThis.fetch = (async () => new Response(JSON.stringify({ repoName: "fot", registered: false, matched: "single-registered" }), { status: 200 }));
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot");
+    });
+    (0, node_test_1.it)("fails open to the local candidate when the server errors", async () => {
+        globalThis.fetch = (async () => new Response("", { status: 500 }));
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot"); // git-remote-derived candidate, still better than the old folder-name behaviour
+    });
+    (0, node_test_1.it)("fails open to the local candidate when the server is unreachable", async () => {
+        globalThis.fetch = (async () => { throw new Error("network down"); });
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot");
+    });
+});

package/dist/__tests__/vendoredCodeDetector.test.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * Real tests for vendoredCodeDetector.ts — build brief "Stop capturing
+ * vendored/third-party code as if it were the client's own" (2026-09-22).
+ * Mirrors kodingo-api's own test coverage for the same, identically-
+ * designed module.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const vendoredCodeDetector_1 = require("../utils/vendoredCodeDetector");
+(0, node_test_1.describe)("isVendoredPath", () => {
+    (0, node_test_1.describe)("POSITIVE — real files confirmed polluting TestHaven/FOTX", () => {
+        for (const p of [
+            "wwwroot/lib/jquery/jquery.js",
+            "wwwroot/lib/jquery/jquery.min.js",
+            "Scripts/WebUIValidation.js",
+            "Scripts/WebForms.js",
+            "Scripts/MicrosoftAjaxWebForms.js",
+        ]) {
+            (0, node_test_1.it)(`flags ${p}`, () => {
+                strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredPath)(p).vendored, true);
+            });
+        }
+    });
+    (0, node_test_1.describe)("POSITIVE — general path/directory/filename conventions", () => {
+        for (const p of [
+            "node_modules/react/index.js",
+            "vendor/autoload.php",
+            "bower_components/angular/angular.js",
+            "jspm_packages/npm/lodash@4.js",
+            "Pods/Alamofire/Source/Request.swift",
+            ".venv/lib/python3.11/site-packages/flask/app.py",
+            "packages/Newtonsoft.Json.13.0.1/lib/net45/Newtonsoft.Json.cs",
+            "src/assets/app.min.js",
+            "src/assets/theme.min.css",
+            "jquery-3.6.0.js",
+            "bootstrap.bundle.min.js",
+            "modernizr-2.8.3.js",
+        ]) {
+            (0, node_test_1.it)(`flags ${p}`, () => {
+                strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredPath)(p).vendored, true);
+            });
+        }
+    });
+    (0, node_test_1.describe)("NEGATIVE — real, legitimate application files must NOT be flagged", () => {
+        for (const p of [
+            "src/validators/UserValidation.js",
+            "src/utils/MicrosoftAjaxHelper.cs",
+            "packages/api/src/OrderService.cs",
+            "src/lib/formatCurrency.ts",
+            "Scripts/OrderService.js",
+            "Scripts/checkout-page.js",
+            "src/services/OrderService.cs",
+            "src/controllers/CheckoutController.cs",
+        ]) {
+            (0, node_test_1.it)(`does not flag ${p}`, () => {
+                const result = (0, vendoredCodeDetector_1.isVendoredPath)(p);
+                strict_1.default.equal(result.vendored, false);
+                strict_1.default.equal(result.reason, null);
+            });
+        }
+    });
+});
+(0, node_test_1.describe)("isVendoredContent", () => {
+    (0, node_test_1.it)("flags genuinely minified-shaped content", () => {
+        const content = Array.from({ length: 5 }, () => "x".repeat(4000)).join("\n");
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredContent)(content).vendored, true);
+    });
+    (0, node_test_1.it)("does not flag a real, dense, hand-written file with normal line breaks", () => {
+        const lines = [];
+        for (let i = 0; i < 300; i++) {
+            lines.push(`        public Order GetOrder${i}(int id) { return _repo.Find(id, "status", "active"); }`);
+        }
+        const content = `namespace Acme.Orders {\n  public class OrderService {\n${lines.join("\n")}\n  }\n}`;
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredContent)(content).vendored, false);
+    });
+    (0, node_test_1.it)("flags an explicit auto-generated header", () => {
+        const content = "// <auto-generated>\n// This code was generated by a tool.\nnamespace Acme { public class Foo {} }";
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredContent)(content).vendored, true);
+    });
+    (0, node_test_1.it)("does not flag a small real file with one long line", () => {
+        const content = "const CONFIG = " + JSON.stringify({ a: 1, b: 2 });
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredContent)(content).vendored, false);
+    });
+});
+(0, node_test_1.describe)("isVendoredCode", () => {
+    (0, node_test_1.it)("flags on path alone without content", () => {
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredCode)("node_modules/react/index.js", null).vendored, true);
+    });
+    (0, node_test_1.it)("real, legitimate file is never flagged", () => {
+        const content = `export function calculateTotal(items) {\n  return items.reduce((sum, i) => sum + i.price, 0);\n}`;
+        strict_1.default.equal((0, vendoredCodeDetector_1.isVendoredCode)("src/services/OrderService.ts", content).vendored, false);
+    });
+});

package/dist/__tests__/vendoredCodeFiltering.test.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Real, end-to-end proof that vendored files never reach symbol
+ * extraction in either real local capture path — build brief "Stop
+ * capturing vendored/third-party code as if it were the client's own"
+ * (2026-09-22). Uses a real temp directory on disk (no mocking needed —
+ * these are pure filesystem + static-analysis functions), following the
+ * exact real symptom shape confirmed for TestHaven/FOTX.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const scan_repo_1 = require("../commands/scan-repo");
+const graph_builder_1 = require("../utils/graph-builder");
+let repoRoot;
+function write(relPath, content) {
+    const full = path.join(repoRoot, relPath);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content, "utf-8");
+}
+function realFunctionSource(name) {
+    return `function ${name}(x) {\n  const result = x + 1;\n  return result;\n}\n`;
+}
+(0, node_test_1.before)(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), "kortex-vendored-test-"));
+    // Real client business logic — must always survive.
+    write("src/OrderService.ts", realFunctionSource("getOrder"));
+    write("src/CheckoutController.ts", realFunctionSource("processCheckout"));
+    // Real jQuery, checked in under ASP.NET Core's real wwwroot/lib/ convention.
+    write("wwwroot/lib/jquery/jquery.js", `function domManip(a, b) { return a; }\nfunction isWindow(obj) { return obj === obj.window; }\n`);
+    // Real WebForms framework file, checked in under an ordinary Scripts/ folder.
+    write("Scripts/WebForms.js", `function WebForm_GetElementByTagName(tag) { return document.getElementsByTagName(tag); }\n`);
+    // Vendored via node_modules — already excluded at the directory-walk
+    // level by IGNORED_DIRS, included here to confirm it's genuinely never
+    // reached either way.
+    write("node_modules/some-lib/index.js", realFunctionSource("someLibInternal"));
+    // Genuinely minified, ordinary-looking filename — only real content
+    // reveals it.
+    write("src/thirdPartyBundle.js", Array.from({ length: 5 }, () => "x".repeat(4000)).join("\n"));
+});
+(0, node_test_1.after)(() => {
+    fs.rmSync(repoRoot, { recursive: true, force: true });
+});
+(0, node_test_1.describe)("scan-repo.ts — real walkFiles + extractSymbols never surface vendored files", () => {
+    (0, node_test_1.it)("walkFiles excludes the real jQuery file (path-level) but includes the client's own real files", () => {
+        const files = (0, scan_repo_1.walkFiles)(repoRoot).map(f => path.relative(repoRoot, f).split(path.sep).join("/"));
+        strict_1.default.ok(!files.includes("wwwroot/lib/jquery/jquery.js"), `jquery.js should have been excluded, got: ${JSON.stringify(files)}`);
+        strict_1.default.ok(!files.includes("Scripts/WebForms.js"), `WebForms.js should have been excluded, got: ${JSON.stringify(files)}`);
+        strict_1.default.ok(!files.includes("node_modules/some-lib/index.js"));
+        strict_1.default.ok(files.includes("src/OrderService.ts"));
+        strict_1.default.ok(files.includes("src/CheckoutController.ts"));
+        // The minified bundle passes the PATH check (ordinary name) — content
+        // filtering happens later, in extractSymbols.
+        strict_1.default.ok(files.includes("src/thirdPartyBundle.js"));
+    });
+    (0, node_test_1.it)("extractSymbols never returns real jQuery/WebForms symbols, and returns [] for the minified bundle via content-level detection", async () => {
+        const files = (0, scan_repo_1.walkFiles)(repoRoot);
+        const allSymbols = (await Promise.all(files.map(f => (0, scan_repo_1.extractSymbols)(f)))).flat();
+        const names = allSymbols.map(s => s.name);
+        strict_1.default.ok(!names.includes("domManip"), `domManip should never have been extracted, got: ${JSON.stringify(names)}`);
+        strict_1.default.ok(!names.includes("isWindow"));
+        strict_1.default.ok(!names.includes("WebForm_GetElementByTagName"));
+        strict_1.default.ok(names.includes("getOrder"));
+        strict_1.default.ok(names.includes("processCheckout"));
+        const bundleFile = files.find(f => f.endsWith("thirdPartyBundle.js"));
+        strict_1.default.ok(bundleFile);
+        const bundleSymbols = await (0, scan_repo_1.extractSymbols)(bundleFile);
+        strict_1.default.deepEqual(bundleSymbols, []);
+    });
+});
+(0, node_test_1.describe)("graph-builder.ts — real buildGraph never indexes vendored symbols", () => {
+    (0, node_test_1.it)("the real, built graph contains the client's own real functions and none of the vendored ones", async () => {
+        const graph = await (0, graph_builder_1.buildGraph)(repoRoot);
+        const names = Object.values(graph.nodes).map(n => n.name);
+        strict_1.default.ok(!names.includes("domManip"), `domManip should never appear in the graph, got: ${JSON.stringify(names)}`);
+        strict_1.default.ok(!names.includes("isWindow"));
+        strict_1.default.ok(!names.includes("WebForm_GetElementByTagName"));
+        strict_1.default.ok(!names.includes("someLibInternal"));
+        strict_1.default.ok(names.includes("getOrder"));
+        strict_1.default.ok(names.includes("processCheckout"));
+    });
+});

package/dist/commands/init.js

@@ -49,6 +49,7 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 // open is imported dynamically to avoid ESM/CJS compatibility issues on Windows
 const persistence_config_1 = require("../utils/persistence-config");
+const repo_identity_1 = require("../utils/repo-identity");
 const API_BASE = "https://kodingo-api.onrender.com";
 const APP_URL = "https://kodingo.xyz";
 const CONFIG_DIR = path.join(os.homedir(), ".kodingo");
@@ -271,17 +272,17 @@ function registerInitCommand(program) {
             (0, persistence_config_1.writeConfig)({ ...existingConfig, mode: "cloud", apiUrl, machineId });
             (0, persistence_config_1.writeWorkspaceConfig)(repoRoot, { mode: "cloud", apiUrl, token: selectedProject.token });
             ensureGitignoreEntry(repoRoot, ".kortex/");
-            // Register this repo with the project on the API
-            // This is the authoritative binding that prevents cross-project contamination
+            // Register this repo with the project on the API.
+            // This is the authoritative binding that prevents cross-project
+            // contamination — resolved from the git remote (stable across
+            // machines and folder names), not the local folder name itself,
+            // so the registration this creates is trustworthy for every future
+            // scan to resolve against.
             try {
-                const repoName = path.basename(repoRoot);
-                await fetch(`${apiUrl}/org/projects/${selectedProject.id}/repos`, {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/json",
-                        "Authorization": `Bearer ${authToken}`,
-                    },
-                    body: JSON.stringify({ repoName }),
+                await (0, repo_identity_1.resolveCanonicalRepoName)({
+                    repoRoot,
+                    apiUrl,
+                    token: selectedProject.token,
                 });
             }
             catch { }

package/dist/commands/scan-git.js

@@ -14,6 +14,7 @@ const git_listener_1 = require("../adapters/git-adapter/git-listener");
 const db_event_port_1 = require("../ports/db-event-port");
 const cloud_event_port_1 = require("../ports/cloud-event-port");
 const persistence_config_2 = require("../utils/persistence-config");
+const repo_identity_1 = require("../utils/repo-identity");
 const API_BASE_DEFAULT = "https://kodingo-api.onrender.com";
 function getCredentials(repoRoot) {
     const config = (0, persistence_config_1.readConfig)();
@@ -29,11 +30,10 @@ function getCredentials(repoRoot) {
     const apiUrl = wsEntry?.apiUrl ?? config.apiUrl ?? API_BASE_DEFAULT;
     return { token, apiUrl };
 }
-async function detectContextDecay(repoRoot, changedFiles) {
+async function detectContextDecay(repoRoot, changedFiles, repoName) {
     const { token, apiUrl } = getCredentials(repoRoot);
     if (!token)
         return;
-    const repoName = path_1.default.basename(repoRoot);
     for (const filePath of changedFiles) {
         if (!fs_1.default.existsSync(filePath))
             continue;
@@ -110,7 +110,7 @@ async function scanGitCommand(options) {
         const diffOutput = await git.diff([`${commitHash}^`, commitHash, '--name-only']).catch(() => '');
         const commitChangedFiles = diffOutput.split('\n').filter(Boolean).map((f) => path_1.default.join(repoRoot, f)).filter((f) => /\.(ts|tsx|js|jsx|py|go|rs|php|java|kt|rb)$/.test(f));
         if (token && commitChangedFiles.length > 0) {
-            const repoName = path_1.default.basename(repoRoot);
+            const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
             for (const filePath of commitChangedFiles) {
                 if (!fs_1.default.existsSync(filePath))
                     continue;

package/dist/commands/scan-repo.js

@@ -49,6 +49,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkFiles = walkFiles;
+exports.extractSymbols = extractSymbols;
 exports.scanRepoCommand = scanRepoCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -57,6 +59,8 @@ const os = __importStar(require("os"));
 const ast_parser_1 = require("../utils/ast-parser");
 const graph_builder_1 = require("../utils/graph-builder");
 const context_assembler_1 = require("../utils/context-assembler");
+const vendoredCodeDetector_1 = require("../utils/vendoredCodeDetector");
+const repo_identity_1 = require("../utils/repo-identity");
 const API_BASE = "https://kodingo-api.onrender.com";
 const SUPPORTED_EXTENSIONS = [
     ".ts", ".tsx", ".js", ".jsx",
@@ -84,7 +88,7 @@ function findRepoRoot(startPath) {
         current = parent;
     }
 }
-function walkFiles(dir) {
+function walkFiles(dir, repoRoot = dir) {
     const results = [];
     try {
         const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
@@ -93,9 +97,20 @@ function walkFiles(dir) {
                 continue;
             const fullPath = path_1.default.join(dir, entry.name);
             if (entry.isDirectory()) {
-                results.push(...walkFiles(fullPath));
+                results.push(...walkFiles(fullPath, repoRoot));
             }
             else if (entry.isFile() && SUPPORTED_EXTENSIONS.includes(path_1.default.extname(entry.name))) {
+                // Real, general vendored-code detection (build brief "Stop
+                // capturing vendored/third-party code as if it were the client's
+                // own", 2026-09-22) — IGNORED_DIRS above already prunes
+                // single-segment conventions (node_modules, vendor, .venv, ...)
+                // at real traversal speed; this catches the rest (two-segment
+                // conventions like wwwroot/lib/, minified-filename conventions,
+                // and known bundled framework files) which need the real,
+                // relative path to detect correctly.
+                const relativePath = path_1.default.relative(repoRoot, fullPath).split(path_1.default.sep).join("/");
+                if ((0, vendoredCodeDetector_1.isVendoredPath)(relativePath).vendored)
+                    continue;
                 results.push(fullPath);
             }
         }
@@ -106,6 +121,12 @@ function walkFiles(dir) {
 async function extractSymbols(filePath) {
     try {
         const source = fs_1.default.readFileSync(filePath, "utf-8");
+        // Content-level check — catches minified/auto-generated files that
+        // pass the path check (e.g. a bundled framework script checked in
+        // directly, not under a vendored-directory convention). Recognized
+        // and skipped BEFORE symbol extraction, not filtered after the fact.
+        if ((0, vendoredCodeDetector_1.isVendoredContent)(source).vendored)
+            return [];
         const nodes = await (0, ast_parser_1.parseFile)(filePath, source);
         return nodes.map(n => ({
             name: n.name,
@@ -233,7 +254,7 @@ async function scanRepoCommand(options = {}) {
     const repoRoot = options.repo
         ? path_1.default.resolve(options.repo)
         : findRepoRoot(process.cwd());
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent) {
         console.log(`\n🔍 Kortex — scanning ${repoName} for existing functions...\n`);
     }

package/dist/commands/security-scan.js

@@ -18,6 +18,7 @@ const graph_builder_1 = require("../utils/graph-builder");
 const security_code_analyzer_1 = require("../utils/security-code-analyzer");
 const context_assembler_1 = require("../utils/context-assembler");
 const ast_parser_1 = require("../utils/ast-parser");
+const repo_identity_1 = require("../utils/repo-identity");
 const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
 const SUPPORTED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs", ".php", ".java", ".kt", ".rb", ".c", ".cpp", ".html", ".phtml", ".twig", ".blade.php"];
 function walkFiles(dir) {
@@ -53,7 +54,7 @@ async function securityScanCommand(options = {}) {
             console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
         return false;
     }
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent)
         console.log(`\n🔒 Kortex Security — scanning ${repoName} for known vulnerabilities...\n`);
     try {

package/dist/commands/sync-dependencies.js

@@ -7,15 +7,12 @@
  * Run this before 'kodingo security-scan' — the scan works off whatever was
  * last synced here.
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.syncDependenciesCommand = syncDependenciesCommand;
-const path_1 = __importDefault(require("path"));
 const persistence_config_1 = require("../utils/persistence-config");
 const repo_scope_1 = require("../utils/repo-scope");
 const dependency_parser_1 = require("../utils/dependency-parser");
+const repo_identity_1 = require("../utils/repo-identity");
 async function syncDependenciesCommand(options = {}) {
     const repoRoot = (0, repo_scope_1.resolveRepoScope)(options.repo ? { repo: options.repo } : {}) ?? process.cwd();
     const config = (0, persistence_config_1.readConfig)();
@@ -27,7 +24,7 @@ async function syncDependenciesCommand(options = {}) {
             console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
         return false;
     }
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent)
         console.log(`\n🔒 Kortex Security — scanning dependencies for ${repoName}...\n`);
     const deps = (0, dependency_parser_1.extractDependencies)(repoRoot);

package/dist/utils/graph-builder.js

@@ -61,6 +61,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const ts = __importStar(require("typescript"));
 const ast_parser_1 = require("./ast-parser");
+const vendoredCodeDetector_1 = require("./vendoredCodeDetector");
 const SUPPORTED_EXTENSIONS = [
     ".ts", ".tsx", ".js", ".jsx",
     ".py", ".go", ".rs", ".php",
@@ -73,7 +74,7 @@ const IGNORED_DIRS = [
     ".venv", "venv", "env", "site-packages", "virtualenv",
     ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj",
 ];
-function walkFiles(dir) {
+function walkFiles(dir, repoRoot = dir) {
     const results = [];
     try {
         const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
@@ -82,9 +83,17 @@ function walkFiles(dir) {
                 continue;
             const fullPath = path_1.default.join(dir, entry.name);
             if (entry.isDirectory()) {
-                results.push(...walkFiles(fullPath));
+                results.push(...walkFiles(fullPath, repoRoot));
             }
             else if (entry.isFile() && SUPPORTED_EXTENSIONS.includes(path_1.default.extname(entry.name))) {
+                // Real, general vendored-code detection (build brief "Stop
+                // capturing vendored/third-party code as if it were the client's
+                // own", 2026-09-22) — a polluted graph corrupts real centrality/
+                // reachability scoring (used by attack-surface reasoning), the
+                // same real underlying problem as polluted memory capture.
+                const relativePath = path_1.default.relative(repoRoot, fullPath).split(path_1.default.sep).join("/");
+                if ((0, vendoredCodeDetector_1.isVendoredPath)(relativePath).vendored)
+                    continue;
                 results.push(fullPath);
             }
         }
@@ -109,6 +118,8 @@ async function collectAllSymbols(repoRoot) {
     for (const file of files) {
         try {
             const source = fs_1.default.readFileSync(file, "utf-8");
+            if ((0, vendoredCodeDetector_1.isVendoredContent)(source).vendored)
+                continue;
             const nodes = await (0, ast_parser_1.parseFile)(file, source);
             for (const n of nodes) {
                 all.push({ ...n, language: languageForFile(file) });

package/dist/utils/repo-identity.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRepoNameFromRemote = parseRepoNameFromRemote;
+exports.getRemoteUrl = getRemoteUrl;
+exports.deriveCandidateRepoName = deriveCandidateRepoName;
+exports.resolveCanonicalRepoName = resolveCanonicalRepoName;
+/**
+ * Resolves the canonical `repo` identity sent to the server, instead of
+ * every scan command inventing its own label from the local checkout.
+ *
+ * Root cause (build brief "Fix repo-label contamination at the source,
+ * platform-wide", 2026-09-30): every local capture path — scan-repo,
+ * security-scan, sync-dependencies, scan-git, and `kodingo init`'s own
+ * repo-registration call — independently computed `path.basename(repoRoot)`
+ * as the repo label. That's the local folder name, never a stable
+ * identifier: two developers with two different folder names for the same
+ * clone produce two different labels for the same real repo, and `init`
+ * seeded `kodingo_project_repos` (the intended source of truth) with that
+ * same unstable value, contaminating it at the first write.
+ *
+ * Fix: derive a candidate name from the git remote URL (stable across
+ * machines and folder names) and resolve it against the server's real,
+ * registered repos for this project via POST /cli/repo/resolve — which
+ * owns the single-repo / multi-repo / first-registration disambiguation.
+ * Falls back to the local folder name only when there's truly no git
+ * remote to read (e.g. a brand-new local-only repo).
+ */
+const path_1 = __importDefault(require("path"));
+const simple_git_1 = __importDefault(require("simple-git"));
+function parseRepoNameFromRemote(remoteUrl) {
+    const cleaned = remoteUrl.trim().replace(/\/+$/, "").replace(/\.git$/, "");
+    const match = cleaned.match(/[/:]([^/:]+)$/);
+    return match?.[1] || null;
+}
+async function getRemoteUrl(repoRoot) {
+    try {
+        const git = (0, simple_git_1.default)(repoRoot);
+        const remotes = await git.getRemotes(true);
+        if (!remotes.length)
+            return null;
+        const origin = remotes.find(r => r.name === "origin") ?? remotes[0];
+        return origin?.refs?.fetch || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function deriveCandidateRepoName(repoRoot) {
+    const remoteUrl = await getRemoteUrl(repoRoot);
+    const fromRemote = remoteUrl ? parseRepoNameFromRemote(remoteUrl) : null;
+    if (fromRemote)
+        return { candidateName: fromRemote, hasRemote: true };
+    return { candidateName: path_1.default.basename(repoRoot), hasRemote: false };
+}
+/**
+ * Returns the canonical repo label to send with this scan. Fails open to
+ * the locally derived candidate if the server is unreachable — a scan
+ * should never be blocked by this resolution, and the git-remote-derived
+ * candidate is already more stable than the old folder-basename behaviour
+ * even without a round-trip to the server.
+ */
+async function resolveCanonicalRepoName(params) {
+    const { candidateName, hasRemote } = await deriveCandidateRepoName(params.repoRoot);
+    try {
+        const res = await fetch(`${params.apiUrl}/cli/repo/resolve`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Kodingo-Token": params.token },
+            body: JSON.stringify({ candidateName, hasRemote }),
+        });
+        if (res.ok) {
+            const data = (await res.json());
+            if (data.repoName)
+                return data.repoName;
+        }
+    }
+    catch {
+        // offline / server unreachable — fail open below
+    }
+    return candidateName;
+}

package/dist/utils/vendoredCodeDetector.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * vendoredCodeDetector.ts
+ *
+ * Real, general, structural detection of vendored/third-party/bundled code
+ * — NOT a hardcoded library-name list as the primary mechanism. Build
+ * brief: "Stop capturing vendored/third-party code as if it were the
+ * client's own" (2026-09-22). Mirrored, identically-designed module in
+ * kodingo-api (utils/vendoredCodeDetector.ts) and kodingo-vscode
+ * (src/utils/vendoredCodeDetector.ts) — each repo has its own real,
+ * separate walk/extract pipeline with no shared low-level utility package
+ * between them (kodingo-core is explicitly scoped to decision/memory
+ * lifecycle domain logic, not general file classification), so this is
+ * duplicated by design, matching this codebase's own established
+ * precedent (e.g. IGNORED_DIRS is already independently duplicated across
+ * scan-repo.ts and security-scan.ts within this same repo). See this
+ * brief's own final report for the full reasoning.
+ *
+ * Real, confirmed evidence this fixes: an admin deep scan of a real
+ * .NET/WebForms project (TestHaven/FOTX) captured real jQuery internals
+ * (domManip, isWindow, movePrevious) and real ASP.NET WebForms framework
+ * internals (WebPartManager_InitiateWebPartDragDrop,
+ * WebForm_GetElementByTagName, Zone_UpdatePosition) as if they were the
+ * client's own business logic — diluting a real answer to "what is this
+ * project" into near-nothing.
+ *
+ * Three real, independent layers, checked cheapest/most-certain first:
+ *   1. Path/directory conventions — reliable across languages/ecosystems,
+ *      needs only the file path.
+ *   2. File-naming conventions (.min.js/.min.css) — same, path-only.
+ *   3. Content heuristics (minified shape, an explicit auto-generated
+ *      header) — needs real file content.
+ * A fourth, explicitly-acknowledged-INCOMPLETE layer: a real, growing list
+ * of specific, well-known bundled framework files. This list will NEVER be
+ * complete — it exists because layers 1-2, by design, cannot catch every
+ * real case: these specific files are frequently checked in un-minified,
+ * under an ordinarily-legitimate-looking folder name (e.g. "Scripts/",
+ * which is NOT treated as a vendored-directory convention here precisely
+ * because plenty of real WebForms projects also put their OWN
+ * app-specific JS there — see isVendoredPath's own reasoning below).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isVendoredPath = isVendoredPath;
+exports.isVendoredContent = isVendoredContent;
+exports.isVendoredCode = isVendoredCode;
+const NOT_VENDORED = { vendored: false, reason: null };
+// ── Layer 1: path/directory conventions ─────────────────────────────────────
+const VENDORED_DIR_SEGMENTS = [
+    "node_modules", "vendor", "bower_components", "jspm_packages", "pods",
+    ".venv", "venv", "site-packages",
+];
+// "wwwroot/lib/" specifically is ASP.NET Core's real, well-known convention
+// for client-side libraries pulled in via LibMan/npm — directly relevant
+// to this exact client's real stack. "lib/" alone is NOT treated as
+// vendored — an extremely common real application folder name on its own.
+const VENDORED_PATH_PAIRS = [
+    ["wwwroot", "lib"],
+];
+// Classic NuGet packages/ convention: packages/<PackageName>.<Version>/...
+// Deliberately NOT a bare "packages/" match — that would false-positive on
+// the equally common JS/TS monorepo convention (Lerna/Yarn/npm workspaces)
+// where packages/<name>/ holds the CLIENT'S OWN first-party code.
+const NUGET_VERSIONED_DIR = /^[A-Za-z0-9_.-]+\.\d+\.\d+(\.\d+)?(-[A-Za-z0-9.]+)?$/;
+function pathSegments(filePath) {
+    return filePath.replace(/\\/g, "/").split("/").filter(Boolean);
+}
+function isVendoredPath(filePath) {
+    const segments = pathSegments(filePath);
+    const lowerSegments = segments.map(s => s.toLowerCase());
+    for (const dir of VENDORED_DIR_SEGMENTS) {
+        if (lowerSegments.includes(dir)) {
+            return { vendored: true, reason: `Path contains the "${dir}/" vendored-dependency directory convention.` };
+        }
+    }
+    for (const [first, second] of VENDORED_PATH_PAIRS) {
+        for (let i = 0; i < lowerSegments.length - 1; i++) {
+            if (lowerSegments[i] === first && lowerSegments[i + 1] === second) {
+                return { vendored: true, reason: `Path contains the "${first}/${second}/" vendored-dependency directory convention.` };
+            }
+        }
+    }
+    const packagesIdx = lowerSegments.indexOf("packages");
+    if (packagesIdx !== -1 && packagesIdx + 1 < segments.length && NUGET_VERSIONED_DIR.test(segments[packagesIdx + 1])) {
+        return { vendored: true, reason: `Path matches the classic NuGet "packages/<Name>.<Version>/" vendored-package convention.` };
+    }
+    const basename = segments[segments.length - 1] ?? "";
+    if (/\.min\.(js|css)$/i.test(basename) || /-min\.(js|css)$/i.test(basename)) {
+        return { vendored: true, reason: `Filename "${basename}" follows the minified-distribution naming convention (.min.js/.min.css).` };
+    }
+    const knownFileReason = matchKnownVendoredFile(basename);
+    if (knownFileReason)
+        return { vendored: true, reason: knownFileReason };
+    return NOT_VENDORED;
+}
+// ── Layer 2: content heuristics ─────────────────────────────────────────────
+const MIN_CONTENT_LENGTH_FOR_MINIFICATION_CHECK = 5000;
+const MINIFIED_AVG_LINE_LENGTH_THRESHOLD = 500;
+const AUTO_GENERATED_HEADER_PATTERN = /<auto-generated|@generated\b|do not (edit|modify) this file|this file (is|was) auto-generated|machine[- ]generated/i;
+function isVendoredContent(content) {
+    const header = content.slice(0, 500);
+    if (AUTO_GENERATED_HEADER_PATTERN.test(header)) {
+        return { vendored: true, reason: "File header contains an explicit auto-generated marker." };
+    }
+    if (content.length >= MIN_CONTENT_LENGTH_FOR_MINIFICATION_CHECK) {
+        const lineCount = content.split("\n").length;
+        const avgLineLength = content.length / Math.max(1, lineCount);
+        if (avgLineLength > MINIFIED_AVG_LINE_LENGTH_THRESHOLD) {
+            return {
+                vendored: true,
+                reason: `Unusually long average line length (${Math.round(avgLineLength)} chars/line across ${lineCount} lines) consistent with minified/bundled code, not hand-written source.`,
+            };
+        }
+    }
+    return NOT_VENDORED;
+}
+// ── Layer 3 (secondary, explicitly incomplete): known bundled framework files ──
+const KNOWN_VENDORED_FILENAME_PATTERNS = [
+    /^jquery(-\d+(\.\d+){1,2})?(\.min)?\.js$/i,
+    /^jquery-ui(-\d+(\.\d+){1,2})?(\.min)?\.js$/i,
+    /^jquery\.validate(\.unobtrusive)?(\.min)?\.js$/i,
+    /^jquery\.unobtrusive-ajax(\.min)?\.js$/i,
+    /^WebUIValidation\.js$/i,
+    /^WebForms\.js$/i,
+    /^MicrosoftAjax(WebForms|Timer)?(\.debug)?\.js$/i,
+    /^SmartNav\.js$/i,
+    /^bootstrap(\.bundle)?(\.min)?\.(js|css)$/i,
+    /^modernizr(-\d+(\.\d+){1,2})?(\.min)?\.js$/i,
+];
+function matchKnownVendoredFile(basename) {
+    for (const pattern of KNOWN_VENDORED_FILENAME_PATTERNS) {
+        if (pattern.test(basename)) {
+            return `Filename "${basename}" matches a real, known bundled/vendored framework file (secondary, explicitly-incomplete list — see this module's own file header).`;
+        }
+    }
+    return null;
+}
+// ── Combined convenience ─────────────────────────────────────────────────────
+function isVendoredCode(filePath, content) {
+    const pathResult = isVendoredPath(filePath);
+    if (pathResult.vendored)
+        return pathResult;
+    if (content !== null)
+        return isVendoredContent(content);
+    return NOT_VENDORED;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,