mixdog 0.9.50 → 0.9.52

package/src/runtime/agent/orchestrator/tools/code-graph/build.mjs

@@ -11,7 +11,12 @@
 // no module imports its own path. The URL below is resolved against THIS
 // module's dir (tools/code-graph/), so it walks one level up to reach the
 // worker at tools/.
-import { resolve as pathResolve } from 'node:path';
+import {
+  isAbsolute,
+  relative as pathRelative,
+  resolve as pathResolve,
+  win32 as pathWin32,
+} from 'node:path';
 import { Worker } from 'node:worker_threads';
 import { acquire as acquireChildSpawnSlot, hasSpareCapacity as childSpawnHasSpareCapacity } from '../../../../shared/child-spawn-gate.mjs';
 import {
@@ -56,6 +61,46 @@ import { _findDirProjectRoot } from './project-root.mjs';
 // spawn instead of fanning out. Entry removed on settle so the next caller
 // after a failure can retry.
 const _inflightAsyncBuilds = new Map();
+const CODE_GRAPH_FILES_ARG_MAX_CHARS = 16_000;
+
+function _usesWindowsPathSemantics(value) {
+  return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\[^\\]+\\[^\\]+/.test(value);
+}
+
+function _normalizedExcludedPrefixes(cwd, excludedProjectRoots) {
+  const windows = _usesWindowsPathSemantics(cwd);
+  const relative = windows ? pathWin32.relative : pathRelative;
+  const resolve = windows ? pathWin32.resolve : pathResolve;
+  return [...new Set((excludedProjectRoots || []).map((root) => {
+    let rel = relative(cwd, resolve(root)).replace(/\\/g, '/').replace(/\/+$/, '');
+    if (windows) rel = rel.toLowerCase();
+    const absolute = windows ? pathWin32.isAbsolute(rel) : isAbsolute(rel);
+    return rel && !rel.startsWith('../') && !absolute ? rel : null;
+  }).filter(Boolean))].sort();
+}
+
+// Exported for the focused pre-cap exclusion regression.
+export function _scopeCodeGraphManifest(manifest, cwd, {
+  excludedProjectRoots = [],
+  maxFiles = CODE_GRAPH_MAX_FILES,
+} = {}) {
+  const prefixes = _normalizedExcludedPrefixes(cwd, excludedProjectRoots);
+  const windows = _usesWindowsPathSemantics(cwd);
+  const excluded = (rel) => {
+    const normalized = rel.replace(/\\/g, '/');
+    const comparable = windows ? normalized.toLowerCase() : normalized;
+    return prefixes.some((prefix) => comparable === prefix || comparable.startsWith(`${prefix}/`));
+  };
+  const scoped = (Array.isArray(manifest) ? manifest : [])
+    .filter((meta) => meta && typeof meta.rel === 'string' && !excluded(meta.rel));
+  const cap = Math.max(1, Math.floor(Number(maxFiles) || CODE_GRAPH_MAX_FILES));
+  return {
+    manifest: scoped,
+    indexed: scoped.length > cap ? scoped.slice(0, cap) : scoped,
+    truncated: scoped.length > cap,
+    prefixes,
+  };
+}
 
 export function _isCompatibleDiskCodeGraphEntry(entry, maxFiles = CODE_GRAPH_MAX_FILES) {
   return Number.isFinite(entry?.maxFiles) && entry.maxFiles === maxFiles;
@@ -150,11 +195,80 @@ export function _prepareDiskCodeGraphFastPath({
 // Worker disk writes are debounced with an unref'd timer. Drain before sending
 // success so legacy migration persists every loaded cwd before this Worker can
 // exit; a drain failure is intentionally thrown to the worker's failure path.
-export function _postCodeGraphWorkerSuccess(graph, postMessage, drainCache = drainCodeGraphCacheStrict) {
-  drainCache();
+export function _postCodeGraphWorkerSuccess(
+  graph,
+  postMessage,
+  drainCache = drainCodeGraphCacheStrict,
+  { cache = true } = {},
+) {
+  if (cache) drainCache();
   postMessage({ ok: true, signature: graph.signature, graph });
 }
 
+// Structured keys avoid both separator collisions inside roots/prefixes and
+// collisions between scoped and ordinary builds.
+export function _codeGraphInflightKey(graphCwd, {
+  scoped = false,
+  maxFiles = CODE_GRAPH_MAX_FILES,
+  prefixes = [],
+} = {}) {
+  return scoped
+    ? JSON.stringify(['scope', graphCwd, maxFiles, prefixes])
+    : JSON.stringify(['root', graphCwd]);
+}
+
+// Keep the existing binary protocol while bounding Windows command-line size.
+// Each invocation still resolves against the whole tree. Duplicate lightweight
+// reused records are merged so relationship fields survive every chunk.
+export async function _runGraphFilesChunked(
+  absRoot,
+  rels,
+  reusedMetas,
+  {
+    maxArgChars = CODE_GRAPH_FILES_ARG_MAX_CHARS,
+    runGraphFiles = _runGraphFiles,
+  } = {},
+) {
+  const budget = Math.max(1, Math.floor(Number(maxArgChars) || CODE_GRAPH_FILES_ARG_MAX_CHARS));
+  const chunks = [];
+  let chunk = [];
+  let chars = 0;
+  for (const rel of Array.isArray(rels) ? rels : []) {
+    const cost = String(rel).length + 3; // separator plus conservative quoting margin
+    if (cost > budget) throw new Error(`code-graph relative path exceeds --files argument budget: ${rel}`);
+    if (chunk.length && chars + cost > budget) {
+      chunks.push(chunk);
+      chunk = [];
+      chars = 0;
+    }
+    chunk.push(rel);
+    chars += cost;
+  }
+  if (chunk.length) chunks.push(chunk);
+
+  const merged = new Map();
+  for (const relChunk of chunks) {
+    const records = await runGraphFiles(absRoot, relChunk, reusedMetas);
+    for (const rec of Array.isArray(records) ? records : []) {
+      if (!rec || typeof rec.rel !== 'string') continue;
+      const previous = merged.get(rec.rel);
+      if (!previous) {
+        merged.set(rec.rel, rec);
+        continue;
+      }
+      const next = { ...previous, ...rec };
+      for (const field of ['resolvedImports', 'importedBy']) {
+        next[field] = [...new Set([
+          ...(Array.isArray(previous[field]) ? previous[field] : []),
+          ...(Array.isArray(rec[field]) ? rec[field] : []),
+        ])];
+      }
+      merged.set(rec.rel, next);
+    }
+  }
+  return [...merged.values()];
+}
+
 // Exported for the focused worker-protocol regression test.
 export function _codeGraphWorkerFailure(message) {
   const error = typeof message?.error === 'string' ? message.error.trim() : '';
@@ -195,15 +309,23 @@ export function prewarmCodeGraphIfProject(cwd) {
   return true;
 }
 
-export async function buildCodeGraphAsync(cwd, signal = null, { bestEffort = false } = {}) {
+export async function buildCodeGraphAsync(cwd, signal = null, {
+  bestEffort = false,
+  excludedProjectRoots = [],
+  maxFiles = CODE_GRAPH_MAX_FILES,
+} = {}) {
   if (signal?.aborted) throw new Error('aborted');
   const graphCwd = _canonicalGraphCwd(cwd);
+  const prefixes = _normalizedExcludedPrefixes(graphCwd, excludedProjectRoots);
+  const scoped = prefixes.length > 0 || maxFiles !== CODE_GRAPH_MAX_FILES;
+  const scopeOptions = scoped ? { excludedProjectRoots, maxFiles, cache: false } : null;
+  const inflightKey = _codeGraphInflightKey(graphCwd, { scoped, maxFiles, prefixes });
   const cached = _codeGraphCache.get(graphCwd);
-  if (cached?.graph && Date.now() - cached.ts < CODE_GRAPH_TTL_MS) {
+  if (!scoped && cached?.graph && Date.now() - cached.ts < CODE_GRAPH_TTL_MS) {
     _touchCodeGraphCache(graphCwd);
     return cached.graph;
   }
-  const existing = _inflightAsyncBuilds.get(graphCwd);
+  const existing = _inflightAsyncBuilds.get(inflightKey);
   if (existing) {
     if (!signal) return existing;
     let onAbort = null;
@@ -230,6 +352,12 @@ export async function buildCodeGraphAsync(cwd, signal = null, { bestEffort = fal
     // Loading the compact disk manifest/one candidate entry is synchronous but
     // bounded I/O. Do not run a manifest at all when no disk candidate exists:
     // cold/dirty misses remain entirely on the existing Worker path.
+    if (scoped) {
+      return _spawnCodeGraphWorker(
+        cwd, graphCwd, _genAtStart, signal, null, null, null,
+        { buildOptions: scopeOptions, cacheResult: false },
+      );
+    }
     return _prepareDiskCodeGraphFastPath({
       graphCwd,
       runFastPath: (diskProbe) => _runDiskCodeGraphFastPath({
@@ -251,11 +379,11 @@ export async function buildCodeGraphAsync(cwd, signal = null, { bestEffort = fal
       }),
     });
   })();
-  _inflightAsyncBuilds.set(graphCwd, promise);
+  _inflightAsyncBuilds.set(inflightKey, promise);
   try {
     return await promise;
   } finally {
-    _inflightAsyncBuilds.delete(graphCwd);
+    _inflightAsyncBuilds.delete(inflightKey);
   }
 }
 
@@ -272,6 +400,8 @@ export function _spawnCodeGraphWorker(
     getGeneration = _getCodeGraphGen,
     setMemoryCache = _setCodeGraphCache,
     setDiskCache = _setDiskCodeGraphEntry,
+    buildOptions = null,
+    cacheResult = true,
   } = {},
 ) {
   let _worker = null;
@@ -299,7 +429,7 @@ export function _spawnCodeGraphWorker(
       const workerUrl = new URL('../code-graph-prewarm-worker.mjs', import.meta.url);
       try {
         _worker = createWorker(workerUrl, {
-          workerData: { cwd, manifest, signature },
+          workerData: { cwd, manifest, signature, buildOptions },
           execArgv: [],
         });
       } catch (e) {
@@ -323,7 +453,7 @@ export function _spawnCodeGraphWorker(
         try {
           if (msg && msg.ok && msg.graph && typeof msg.signature === 'string') {
             const genStillCurrent = getGeneration(graphCwd) === genAtStart;
-            if (genStillCurrent) {
+            if (genStillCurrent && cacheResult) {
               setMemoryCache(graphCwd, { ts: Date.now(), signature: msg.signature, graph: msg.graph });
               setDiskCache(graphCwd, msg.graph);
             }
@@ -344,27 +474,34 @@ export function _spawnCodeGraphWorker(
  * buildCodeGraphAsync (worker-thread isolated) or the code_graph / find_symbol
  * tools, never this synchronous form on the main event loop.
  */
-export async function _buildCodeGraph(cwd, { manifest: suppliedManifest = null, signature: suppliedSignature = null } = {}) {
+export async function _buildCodeGraph(cwd, {
+  manifest: suppliedManifest = null,
+  signature: suppliedSignature = null,
+  excludedProjectRoots = [],
+  maxFiles = CODE_GRAPH_MAX_FILES,
+  cache = true,
+} = {}) {
   const now = Date.now();
   let _tp = performance.now();
   const _trace = (label) => { if (process.env.MIXDOG_GRAPH_TRACE) { const n = performance.now(); process.stderr.write(`[cg-trace] ${label}=${(n - _tp).toFixed(0)}ms\n`); _tp = n; } };
   const graphCwd = _canonicalGraphCwd(cwd);
   const absRoot = graphCwd;
   const _genAtStart = _getCodeGraphGen(graphCwd);
-  const cached = _codeGraphCache.get(graphCwd);
+  const cached = cache ? _codeGraphCache.get(graphCwd) : null;
   let previousGraph = cached?.graph || null;
-  _consumeCodeGraphDirtyPaths(graphCwd);
+  if (cache) _consumeCodeGraphDirtyPaths(graphCwd);
 
   // 1. Change-detect via Rust --manifest (fp/rel/size only, no parse). A
   // main-thread disk-cache validation may hand its just-computed manifest to
   // this Worker after a miss, avoiding a duplicate native process.
-  const manifest = Array.isArray(suppliedManifest) ? suppliedManifest : await _runGraphManifest(absRoot);
+  const unscopedManifest = Array.isArray(suppliedManifest) ? suppliedManifest : await _runGraphManifest(absRoot);
+  const scoped = _scopeCodeGraphManifest(unscopedManifest, absRoot, { excludedProjectRoots, maxFiles });
+  const manifest = scoped.manifest;
   const signature = typeof suppliedSignature === 'string'
     ? suppliedSignature
     : _computeGraphSignature(manifest);
   if (!Array.isArray(suppliedManifest)) _trace('manifest+sig');
-  const truncated = manifest.length > CODE_GRAPH_MAX_FILES;
-  const indexed = truncated ? manifest.slice(0, CODE_GRAPH_MAX_FILES) : manifest;
+  const { truncated, indexed } = scoped;
 
   // 2. Memory cache hit.
   if (cached && cached.signature === signature && now - cached.ts < CODE_GRAPH_TTL_MS) {
@@ -373,8 +510,8 @@ export async function _buildCodeGraph(cwd, { manifest: suppliedManifest = null,
   }
 
   // 3. Disk cache hit.
-  ensureDiskCodeGraphLoaded(now);
-  const diskEntry = getDiskCodeGraphEntry(graphCwd);
+  if (cache) ensureDiskCodeGraphLoaded(now);
+  const diskEntry = cache ? getDiskCodeGraphEntry(graphCwd) : null;
   if (_isCompatibleDiskCodeGraphEntry(diskEntry) && diskEntry.signature === signature) {
     const graph = _deserializeGraph(graphCwd, diskEntry);
     if (graph) {
@@ -406,7 +543,7 @@ export async function _buildCodeGraph(cwd, { manifest: suppliedManifest = null,
   if (freshRels.length === 0) {
     fileInfos = reusable;
   } else if (reusable.length > 0 && freshRels.length <= 256) {
-    const recs = await _runGraphFiles(absRoot, freshRels, reusable);
+    const recs = await _runGraphFilesChunked(absRoot, freshRels, reusable);
     const reusedByRel = new Map(reusable.map((info) => [info.rel, info]));
     const freshSet = new Set(freshRels);
     fileInfos = [...reusable];
@@ -425,11 +562,29 @@ export async function _buildCodeGraph(cwd, { manifest: suppliedManifest = null,
         }
       }
     }
+  } else if (scoped.prefixes.length) {
+    const recs = await _runGraphFilesChunked(absRoot, freshRels, reusable);
+    fileInfos = recs.map((rec) => _fileInfoFromRustRecord(rec, absRoot));
   } else {
     let recs = await _runGraphWalk(absRoot);
-    if (recs.length > CODE_GRAPH_MAX_FILES) recs = recs.slice(0, CODE_GRAPH_MAX_FILES);
+    if (recs.length > maxFiles) recs = recs.slice(0, maxFiles);
     fileInfos = recs.map((rec) => _fileInfoFromRustRecord(rec, absRoot));
   }
+  const allowedRels = new Set(indexed.map((meta) => meta.rel));
+  for (const info of fileInfos) {
+    info.resolvedImports = (info.resolvedImports || []).filter((rel) => allowedRels.has(rel));
+    info.importedBy = [];
+  }
+  const importedBy = new Map(fileInfos.map((info) => [info.rel, []]));
+  for (const info of fileInfos) {
+    for (const targetRel of info.resolvedImports) {
+      const sources = importedBy.get(targetRel);
+      if (sources) sources.push(info.rel);
+    }
+  }
+  for (const info of fileInfos) {
+    info.importedBy = [...new Set(importedBy.get(info.rel) || [])];
+  }
   _trace('walk+parse');
   const nodes = new Map();
   const reverse = new Map();
@@ -470,7 +625,7 @@ export async function _buildCodeGraph(cwd, { manifest: suppliedManifest = null,
     }
   }
   graph._symbolTokenIndexDirty = true;
-  if (_getCodeGraphGen(graphCwd) === _genAtStart) {
+  if (cache && _getCodeGraphGen(graphCwd) === _genAtStart) {
     _setCodeGraphCache(graphCwd, { ts: now, signature, graph });
     _setDiskCodeGraphEntry(graphCwd, graph);
     _trace('cache+disk');

package/src/runtime/agent/orchestrator/tools/code-graph/disk-cache.mjs

@@ -437,6 +437,20 @@ export function ensureDiskCodeGraphLoaded(now = Date.now()) {
   _loadDiskCodeGraphCache(now);
 }
 
+// Read-only inventory used by filesystem-root federation. This deliberately
+// does not initialize, migrate, prune, or load graph payloads: manifest keys
+// are sufficient to identify roots the user has already indexed.
+export function listCachedCodeGraphRoots() {
+  try {
+    const file = join(_codeGraphDiskDir(), 'manifest.json');
+    if (!existsSync(file)) return [];
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    return parsed && typeof parsed === 'object' ? Object.keys(parsed) : [];
+  } catch {
+    return [];
+  }
+}
+
 export function _setDiskCodeGraphEntry(cwd, graph) {
   _loadDiskCodeGraphCache();
   // Stamp the cache entry with the persistence timestamp (not the build

package/src/runtime/agent/orchestrator/tools/code-graph/dispatch.mjs

@@ -19,6 +19,12 @@ import {
   _stripEmptyArgs,
 } from './project-root.mjs';
 import { buildCodeGraphAsync, prewarmCodeGraph, prewarmCodeGraphSymbols } from './build.mjs';
+import {
+  _isFilesystemRootPath,
+  collectTrustedCodeGraphRoots,
+  formatFederatedProjectLabel,
+  owningTrustedCodeGraphRoot,
+} from './trusted-roots.mjs';
 import {
   _findSymbolHits,
   _findSymbolAcrossGraph,
@@ -51,6 +57,10 @@ function _collectGraphSymbolList(args) {
 
 const CODE_GRAPH_FILE_BATCH_CAP = 20;
 const _AGGREGATE_FILE_WILDCARD_RE = /[*?[\]{}]/;
+const ROOT_FEDERATED_MODES = new Set([
+  'overview', 'symbol', 'find_symbol', 'symbol_search', 'search',
+  'references', 'callers', 'callees', 'symbols', 'prewarm',
+]);
 
 // Absorb: file/files arriving as a JSON-stringified array
 // (file:"[\"a.mjs\",\"b.mjs\"]") — parse to a real array so the graph lookup
@@ -181,7 +191,9 @@ async function codeGraph(args, cwd, signal = null, options = {}) {
     return `prewarm scheduled: cwd=${cwd} symbols=${symbols.length}${symbols.length ? ` (${symbols.slice(0, 5).join(',')}${symbols.length > 5 ? `,+${symbols.length - 5}` : ''})` : ''}`;
   }
 
-  const graph = await buildCodeGraphAsync(cwd, signal);
+  const graph = await buildCodeGraphAsync(cwd, signal, {
+    excludedProjectRoots: options?.excludedProjectRoots,
+  });
   if (!graph || graph.nodes.size === 0) {
     throw new Error(`code_graph: cwd '${cwd}' is not an indexed/known project root or contains zero eligible files`);
   }
@@ -476,7 +488,9 @@ async function findSymbolTool(args, cwd, signal = null, options = {}) {
     else prewarmCodeGraph(cwd);
     return `prewarm scheduled: cwd=${cwd} symbols=${symbols.length}${symbols.length ? ` (${symbols.slice(0, 5).join(',')}${symbols.length > 5 ? `,+${symbols.length - 5}` : ''})` : ''}`;
   }
-  const graph = await buildCodeGraphAsync(cwd, signal);
+  const graph = await buildCodeGraphAsync(cwd, signal, {
+    excludedProjectRoots: options?.excludedProjectRoots,
+  });
   if (!graph) throw new Error(`find_symbol: cwd '${cwd}' is not an indexed/known project root or contains zero eligible files`);
   if (options?.scopedCacheOutcome && graph.truncated) {
     markScopedCacheIncomplete(options.scopedCacheOutcome);
@@ -594,6 +608,98 @@ export async function executeCodeGraphTool(name, args, cwd, signal = null, optio
   const hasAggregateFileArgs = _hasAggregateFileArgs(args);
   let effectiveCwd = baseCwd;
   const baseProjectRoot = _findDirProjectRoot(baseCwd);
+  const filesystemRootCwd = !baseProjectRoot && _isFilesystemRootPath(baseCwd);
+  if (filesystemRootCwd) {
+    const trustedRoots = collectTrustedCodeGraphRoots(baseCwd);
+    const files = _collectGraphFileList(args, { cap: false });
+    const rawMode = String(args?.mode || '').trim();
+    const canFederate = files.length > 0 || ROOT_FEDERATED_MODES.has(rawMode);
+    if (files.length) {
+      if (files.some((file) => _AGGREGATE_FILE_WILDCARD_RE.test(file))) {
+        return `Error: ${name}: wildcard-shaped file anchors are not allowed at a filesystem root`;
+      }
+      if (files.length > CODE_GRAPH_FILE_BATCH_CAP) {
+        return `Error: ${name}: file list exceeds cap of ${CODE_GRAPH_FILE_BATCH_CAP}`;
+      }
+      const routed = files.map((file) => {
+        const abs = isAbsolute(file) ? pathResolve(file) : pathResolve(baseCwd, file);
+        return {
+          file,
+          abs,
+          exists: existsSync(abs),
+          root: owningTrustedCodeGraphRoot(abs, trustedRoots),
+        };
+      });
+      const missing = routed.find((row) => !row.exists);
+      if (missing) return `Error: ${name}: file not found: ${missing.file}`;
+      const untrusted = routed.find((row) => !row.root);
+      if (untrusted) {
+        return `Error: ${name}: file anchor is not owned by a trusted project: ${untrusted.file}`;
+      }
+      if (!canFederate) {
+        return `Error: ${name}: mode '${rawMode}' cannot be routed from a filesystem root`;
+      }
+      const projectArgs = { ...args };
+      delete projectArgs.cwd;
+      const sections = [];
+      for (const { file, abs, root } of routed) {
+        const excludedProjectRoots = trustedRoots.filter((candidate) => candidate !== root
+          && owningTrustedCodeGraphRoot(candidate, [root]) === root);
+        let body;
+        try {
+          body = await executeCodeGraphTool(
+            name,
+            { ...projectArgs, file: abs, files: undefined },
+            root,
+            signal,
+            { ...options, excludedProjectRoots },
+          );
+        } catch (err) {
+          body = `Error: ${err?.message || String(err)}`;
+        }
+        sections.push(`# ${rawMode} ${file}\n# project ${formatFederatedProjectLabel(root)}\n${body}`);
+      }
+      return sections.join('\n\n');
+    }
+    if (trustedRoots.length && canFederate) {
+      const projectArgs = { ...args };
+      delete projectArgs.cwd;
+      const runOne = async (root, nextArgs) => executeCodeGraphTool(
+        name,
+        nextArgs,
+        root,
+        signal,
+        {
+          ...options,
+          excludedProjectRoots: trustedRoots.filter((candidate) => candidate !== root
+            && owningTrustedCodeGraphRoot(candidate, [root]) === root),
+        },
+      );
+      let federationWork;
+      federationWork = (async () => {
+        const sections = [];
+        for (const root of trustedRoots) {
+          let body;
+          try { body = await runOne(root, projectArgs); }
+          catch (err) { body = `Error: ${err?.message || String(err)}`; }
+          sections.push(`# project ${formatFederatedProjectLabel(root)}\n${body}`);
+        }
+        return sections.join('\n\n');
+      })();
+      if (federationWork) {
+        if (!signal) return federationWork;
+        let onAbort = null;
+        const abortP = new Promise((_, reject) => {
+          if (signal.aborted) { reject(new Error('aborted')); return; }
+          onAbort = () => reject(new Error('aborted'));
+          signal.addEventListener('abort', onAbort, { once: true });
+        });
+        return Promise.race([federationWork, abortP]).finally(() => {
+          if (onAbort) signal.removeEventListener('abort', onAbort);
+        });
+      }
+    }
+  }
   if (hasAggregateFileArgs && !baseProjectRoot) {
     const aggregateRoot = _resolveAggregateFileProjectRoot(args, baseCwd);
     if (!aggregateRoot) {

package/src/runtime/agent/orchestrator/tools/code-graph/trusted-roots.mjs

@@ -0,0 +1,93 @@
+import { statSync } from 'node:fs';
+import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
+import { listProjects } from '../../../../../standalone/projects.mjs';
+import {
+  explicitSessionCwd,
+  readLastSessionCwd,
+} from '../../../../shared/user-cwd.mjs';
+import { listCachedCodeGraphRoots } from './disk-cache.mjs';
+import { _findDirProjectRoot } from './project-root.mjs';
+
+function isDirectory(path) {
+  try { return statSync(path).isDirectory(); } catch { return false; }
+}
+
+export function _isFilesystemRootPath(value) {
+  const raw = String(value || '').trim();
+  if (!raw) return false;
+  // A bare drive designator is drive-relative on Windows. Guard it before
+  // resolve(), which may expand C: to that drive's active directory (even C:\).
+  if (/^[a-zA-Z]:$/.test(raw)) return false;
+  // Keep this platform-neutral so Windows drive-root semantics can also be
+  // regression-tested on Unix hosts.
+  if (/^[a-zA-Z]:[\\/]$/.test(raw)) return true;
+  try {
+    const abs = resolve(raw);
+    return dirname(abs) === abs;
+  } catch {
+    return false;
+  }
+}
+
+function pathKey(path) {
+  const abs = resolve(path);
+  return process.platform === 'win32' ? abs.toLowerCase() : abs;
+}
+
+export function _pathIsWithin(root, candidate) {
+  try {
+    const rel = relative(resolve(root), resolve(candidate));
+    return rel === '' || (!!rel && !rel.startsWith('..') && !isAbsolute(rel));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Return live, non-root graph targets from explicit registrations, current /
+ * recent session selection, and cache manifests. Dependencies are injectable
+ * to keep trust-source and Windows/Unix semantics tests hermetic.
+ */
+export function collectTrustedCodeGraphRoots(filesystemRoot, {
+  registered = () => listProjects().map((entry) => entry.path),
+  selected = () => [
+    explicitSessionCwd(),
+    readLastSessionCwd(),
+  ],
+  cached = listCachedCodeGraphRoots,
+  directory = isDirectory,
+  projectRoot = _findDirProjectRoot,
+} = {}) {
+  const root = resolve(filesystemRoot);
+  const rows = [
+    ...registered().map((path) => ({ path, detect: false })),
+    ...selected().map((path) => ({ path, detect: true })),
+    ...cached().map((path) => ({ path, detect: false })),
+  ];
+  const found = new Map();
+  for (const row of rows) {
+    if (!row.path) continue;
+    let candidate;
+    try { candidate = resolve(row.path); } catch { continue; }
+    if (!directory(candidate) || _isFilesystemRootPath(candidate) || !_pathIsWithin(root, candidate)) continue;
+    // A selected directory inside a sentinel project belongs to the nearest
+    // project graph. Explicit registrations and cache keys remain exact roots
+    // so registered non-sentinel projects are retained.
+    const detected = row.detect ? projectRoot(candidate) : null;
+    if (detected) candidate = resolve(detected);
+    if (_isFilesystemRootPath(candidate) || !directory(candidate) || !_pathIsWithin(root, candidate)) continue;
+    const key = pathKey(candidate);
+    if (!found.has(key)) found.set(key, candidate);
+  }
+  return [...found.values()].sort((a, b) => a.localeCompare(b));
+}
+
+export function owningTrustedCodeGraphRoot(file, roots) {
+  const matches = (roots || []).filter((root) => _pathIsWithin(root, file));
+  matches.sort((a, b) => resolve(b).length - resolve(a).length);
+  return matches[0] || null;
+}
+
+export function formatFederatedProjectLabel(root) {
+  return `${basename(root) || root} [${root}]`;
+}

package/src/runtime/agent/orchestrator/tools/code-graph-prewarm-worker.mjs

@@ -27,12 +27,21 @@ try {
   if (!cwd) {
     parentPort.postMessage({ ok: false });
   } else {
-    const graph = await _buildCodeGraph(cwd, {
+    const buildOptions = {
       manifest: Array.isArray(workerData.manifest) ? workerData.manifest : null,
       signature: typeof workerData.signature === 'string' ? workerData.signature : null,
-    });
+      ...(workerData.buildOptions && typeof workerData.buildOptions === 'object'
+        ? workerData.buildOptions
+        : {}),
+    };
+    const graph = await _buildCodeGraph(cwd, buildOptions);
     if (graph && typeof graph.signature === 'string') {
-      _postCodeGraphWorkerSuccess(graph, (message) => parentPort.postMessage(message));
+      _postCodeGraphWorkerSuccess(
+        graph,
+        (message) => parentPort.postMessage(message),
+        undefined,
+        { cache: buildOptions.cache },
+      );
     } else {
       parentPort.postMessage({ ok: false });
     }