merge: reconcile upstream through 7ba8eee4

[bompus]

Merges upstream main through 7ba8eee4 (colbymchenry#2512), one commit past the previous merge point a3fdb920. The fix: codegraph sync and the file watcher now update the files that import through a re-exporting module (a package's __init__.py or an index.ts barrel) when that module is deleted or added. Without this merge the hourly fork-sync keeps declining to promote, because upstream has a commit the fork has not taken.

Resolution. One conflict, in src/index.ts, which the fork reduced to a re-export of src/codegraph.ts. It stays as the fork has it, and upstream's three hunks in CodeGraph.sync are applied in src/codegraph.ts instead: the module-importers import, edgesBeforeResolution read before resolution starts, and the re-open of references through added modules after the failed-reference retry. src/resolution/module-importers.ts, its test and the changes to src/db/queries.ts, src/extraction/index.ts and src/resolution/import-resolver.ts merged cleanly.

One adaptation beyond the port. Upstream's createImportReader read each importer's imports with extractImportMappings, a source-text reader. In the fork that function is a stub that returns nothing, because every language's imports come from the bindings table, so the re-open found no importers and did nothing: the six new sync-module-importers tests failed four of six on the merge as it first stood. The reader now takes queries and reads the file's import binding rows through importMappingsFromBindings, as the resolver does. A Python star import still comes from the file's text, since it has no binding to bind.

CHANGELOG. scripts/changelog-reconcile.mjs flagged five upstream entries. One (colbymchenry#2512) is added. The other four (VB.NET type-name lookup, the CRLF store fix, C++ calls with no receiver, Go calls through a variable named like a standard-library package) are already in the fork's changelog from earlier merges, in the fork's own wording, so they are not added a second time.

Checks. tsc --noEmit exit 0. Full suite on Node.js 24.21.0: 697 test files, 8,913 tests passed and 37 skipped. Rust is unchanged, so the golden dumps do not move.

README rows checked. The upstream merge point on line 55 moves from a3fdb920 to 7ba8eee4. No comparison row names a measured upstream commit that this merge changes.

---

Summary by cubic

Merges upstream main through 7ba8eee4 (colbymchenry#2512): codegraph sync and the file watcher now re-resolve the files that import through a re-exporting module (a package's __init__.py or an index.ts barrel) when that module is deleted or added. Without this merge the hourly fork-sync keeps declining to promote, because upstream has a commit the fork has not taken.

Reconciliation

• The one conflict is in src/index.ts, which stays the fork's re-export of src/codegraph.ts; upstream's three hunks in CodeGraph.sync are applied in src/codegraph.ts instead.
• Upstream's createImportReader read imports with extractImportMappings, a stub in the fork, so the new tests failed four of six; the reader now reads the file's import binding rows through importMappingsFromBindings, as the resolver does.
• A Python star import still comes from the file's text, since it has no binding to bind.
• CHANGELOG.md gets only the fix(sync): imports through a re-exporting module follow it when it is deleted or added colbymchenry/codegraph#2512 entry; the four other flagged upstream entries are already in the fork's changelog in its own wording.
• tsc --noEmit passes; the full suite runs 8,913 tests with 37 skipped, and Rust is unchanged so the golden dumps do not move.

^{Written for commit e43d932. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • codegraph sync now updates dependent import links when re-exporting modules are added or removed, including Python imports that pass through package re-exports.
• Bug Fixes
  • Improved handling of stale or missing import links after files are deleted, restored, or added after indexing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0b3ed788-31cb-4174-9a49-87f1206ea911

---

📥 Commits

Reviewing files that changed from the base of the PR and between e797afc and e43d932.

---

📒 Files selected for processing (8)

• CHANGELOG.md
• README.md
• __tests__/sync-module-importers.test.ts
• src/codegraph.ts
• src/db/queries.ts
• src/extraction/index.ts
• src/resolution/import-resolver.ts
• src/resolution/module-importers.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

---

📝 Walkthrough

Walkthrough

Sync now reopens references that pass through added or removed re-exporting modules. Importer discovery includes Python package re-exports. Tests cover Python and TypeScript sync results against fresh indexes.

Changes

Module importer sync

Layer / File(s)	Summary
Import lookup and re-export discovery src/db/queries.ts, src/resolution/import-resolver.ts, src/resolution/module-importers.ts	Adds database lookups and importer discovery for direct imports and Python re-exports.
Reference reopening src/resolution/module-importers.ts	Reopens eligible references through changed modules and replaces edges when reconstruction succeeds.
Sync integration src/codegraph.ts, src/extraction/index.ts	Reopens references through added files after resolution and through removed files before deletion.
Sync tests and changelog __tests__/sync-module-importers.test.ts, CHANGELOG.md	Adds Python and TypeScript tests that compare sync results with fresh indexes. The changelog describes the re-export cases.

Upstream revision metadata

Layer / File(s)	Summary
README revision update README.md	Changes the listed upstream commit from a3fdb920 to 7ba8eee4.

---

Priority: ⬇️ Low

Merge Risk | ⚪ Minimal · up to e43d9

Merge Risk: ⚪ Minimal · up to e43d9

This merge adds re-export-aware reference recovery to sync and the file watcher. No actionable merge-blocking risk was found in the supplied changes.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to e43d9

A new source-file read bypasses the existing size limit. Changes to an already-indexed repository can therefore cause excessive memory allocation or block the process running sync. The identified exposure requires control over repository files; no new privilege or cross-project access was established.

Retained concerns

• Medium · security · inferred: The new Python importer reader bypasses source-size containment during removal recovery. A repository writer can enlarge an already-indexed importer and remove a module it imports. Recovery discovers the importer from existing graph records and synchronously reads its entire current contents before the modification pass applies bounded reading. This can stall or exhaust the process running sync. The catch handles ordinary read errors but does not bound allocation; traversal-depth limits constrain discovery, not bytes read.

Security review details

Security Blast Radius

• inferred — Affected graph mutations can reach unchanged importers throughout the opened project. Resource exhaustion can affect the process hosting sync, including a watcher using the same instance. The inspected path does not establish cross-project, tenant, credential, or infrastructure authority.

Security Findings and Attack Paths

• inferred — The availability attack requires an existing indexed Python importer and control over repository changes. Enlarging that importer while removing an imported module routes attacker-controlled bytes through discovery into an unrestricted synchronous read. Existing oversized-file handling occurs later and cannot contain this earlier read.

Trust Boundaries and Controls

• observed — Importer candidates originate in the project index, and reads join those paths to the existing project root. The helper adds neither a separate database handle nor external command execution. Its memoization, Python-only source-read gate, and exception handling do not enforce the established source-byte limit.

Resilience and Maintainability Implications

• inferred — Committed reopened references are recoverable through the pending-reference sweep. However, added-file persistence precedes importer reopening, whose trigger is returned in memory. Interruption in that interval can leave the older stale-edge condition unrepaired; the inspected ordering does not establish durable scheduling of that recovery.

Hardening Proposals

• proposed — Route Python star-import inspection through the existing bounded regular-file reader so recovery preserves the same resource-containment policy as extraction. Consider a durable added-module recovery marker if interrupted sync must guarantee convergence without a rebuild.

---

Pre-merge checks | 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately identifies the primary purpose: reconciling the fork with upstream through commit 7ba8eee. It is concise and specific.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Suppressions Explained		PASS. The reviewed diff adds no lint, type-check, or compiler suppression directive. Searches of all added lines found no eslint-disable, @ts-expect-error, @ts-ignore, Rust #[allow], ignore co…
User-Visible Changes Documented		The reviewed diff changes sync resolution for re-exporting modules and adds tests and changelog text. It does not add, remove, or rename a CLI command or flag, MCP tool or argument, supported language…

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[bompus]

Review: #479 (review)
Head: e43d932
Reason: Both findings are limits of upstream's colbymchenry#2512 algorithm (star-import consumers and named imports through ordinary Python modules are not followed), which this reconcile PR does not change; each thread has the reply and is resolved.