Skip to content

merge: reconcile upstream through a3fdb920 - #470

Merged
bompus merged 2 commits into
fork/consolidatedfrom
reconcile/upstream-a3fdb920
Oct 12, 2026
Merged

bompus merged 2 commits into
fork/consolidatedfrom
reconcile/upstream-a3fdb920

Conversation

@bompus

@bompus bompus commented Oct 12, 2026 •

Copy link
Copy Markdown
Owner

Merges upstream main through a3fdb920 (colbymchenry#2507: a Python import of a name a package re-exports links when the package appears later) into fork/consolidated. Upstream moved again right after #469 landed, so the hourly deploy would hold back again until this lands.

What changed

  • import-resolver.ts conflicted. Merged by hand: upstream's project-module check for unaliased imports, next to the fork's file-aware external-import check. Two memo clears upstream lists (pythonModuleFileMemos, PY_MODULE_SYMBOLS) are not carried because the fork has no such maps; only PROJECT_FOLDER_SUFFIXES is.
  • src/index.ts conflicted because the CodeGraph class lives in src/codegraph.ts on the fork. Upstream's three small edits there (last edge id before the failed-reference retry, passed to the stale-edge rebind) are applied to src/codegraph.ts; src/index.ts stays the fork's.
  • queries.ts, reference-tail.ts, extraction/index.ts and the upstream test merged cleanly.
  • CHANGELOG gains upstream's one new entry; the reconcile script's re-added VB.NET, CRLF, implicit-this and Go entries are left out (absent on purpose or already present). README merge point is now a3fdb920.

Golden dump

torture-multilang.dump changes one line: the unresolved Python import thing in torture.py now waits under module:relative instead of thing. That is the behavior colbymchenry#2507 adds (a reference waits for its module so a later package file relinks it).

Evidence

Full suite: 694 files, 8,886 passed, 39 skipped, exit 0. Typecheck clean. The upstream sync test file passes. No resolver or kernel code changed in this PR, so no precision or link-count run.

README rows checked: upstream merge point (changed); no other row quotes this area.


Summary by cubic

Merges upstream main through a3fdb920 into fork/consolidated, bringing upstream's fix that links a Python import of a name a package re-exports when the package appears later. The fork now sits on a newer upstream base.

Behaviorally, from fastapi import FastAPI (where fastapi/__init__.py re-exports the name from a deeper module) now links when that __init__.py is added after importers were indexed, or gains the re-export in a later edit. Before, calls through the name stayed unlinked until re-index. Two retry-ceiling adjustments support this: module keys get their own ceiling of 5,000 (vs 500 for name tails, since a large population under a module key is every importer of a restored package, not noise), and the stale-edge rebind's per-name ceiling counts only edges that existed before the failed-ref retry, so relinking every from django.urls import path no longer pushes path over the ceiling and leaves the new definitions' edges unrebound.

Merge notes

  • import-resolver.ts conflicted and was merged by hand: upstream's project-module check for unaliased imports sits next to the fork's file-aware external-import check.
  • Upstream's sync-flow edits went into src/codegraph.ts, where the fork's CodeGraph class lives; src/index.ts stays the fork's.
  • The golden dump changes one line: an unresolved Python import now waits under module:relative instead of its own name, which is the new behavior upstream adds.

Written for commit 978b2bd. Summary will update on new commits.

View guided diff Turn on auto-fix

Summary by CodeRabbit

  • Bug Fixes
    • Python imports now relink when a package gains a re-export, even if the importing files have not changed.
    • Sync can retry more waiting references for modules and packages, including imports resolved when a package is restored.
    • Project-local Python imports that cannot yet be resolved are now tracked by module, improving later resolution without changing how external and standard-library imports are handled.

colbymchenry and others added 2 commits October 11, 2026 23:19
…the package appears later (colbymchenry#2507)

`from fastapi import FastAPI` reaches `fastapi/applications.py` through
`fastapi/__init__.py`, which re-exports it and declares no node named
`FastAPI`. While that `__init__.py` was missing, or before it gained the
re-export, the calls through the name failed and were parked under the
name, which the package file that then appears or changes never carries.
A fresh index linked them; a sync never did.

An unaliased from-import of a module in the project's own folders is now
parked under the module's key, as an aliased one is (colbymchenry#2501): a relative
import, or an absolute one whose dotted path, or the package holding it,
is a project folder at any depth. An outside package's names (`from
django.db.models import Q`) keep their tails, since on netbox they would
crowd 'module:models', 'module:urls' and others past the retry ceiling.
colbymchenry#2450's by-name lookup still finds every parked ref by its own name.

Two limits made the restored package's importers wait anyway:

- A module key gets a retry ceiling of its own, 5,000 rather than the 500
  a name tail has. A large population under a module key is every
  importer of a package that was missing, not noise: fastapi's 1,069
  `from fastapi import ...` refs, Django's 2,257 under 'module:urls'.
- The CG-33 rebind's per-name ceiling counts only the edges that existed
  before the retry. Relinking every `from django.urls import path` pushed
  `path` over it, so the `path` edges the sync's new definitions moved
  were never rebound; the retry's own edges are still rebound under a
  name that stays below it, as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository YAML (base), Organization UI (inherited)
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 73a45a12-93ba-481d-82e3-6b7a2b57b395

📥 Commits

Reviewing files that changed from the base of the PR and between 63735a1 and 978b2bd.


📒 Files selected for processing (9)
  • CHANGELOG.md
  • README.md
  • __tests__/fixtures/golden/torture-multilang.dump
  • __tests__/sync-python-import-binding-retry.test.ts
  • src/codegraph.ts
  • src/db/queries.ts
  • src/db/reference-tail.ts
  • src/extraction/index.ts
  • src/resolution/import-resolver.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.



📝 Walkthrough

Walkthrough

Sync now tracks Python imports through package re-exports and allows more waiting references keyed by a module path to be retried. Resolution-edge counting can use a pre-retry edge-ID cutoff. The README updates its cited upstream commit.

Changes

Import Relinking and Retry

Layer / File(s) Summary
Python project imports and package re-exports
src/resolution/import-resolver.ts, __tests__/sync-python-import-binding-retry.test.ts, __tests__/fixtures/golden/torture-multilang.dump
Python import-tail resolution now identifies project modules. Tests cover package re-exports and compare sync results with a fresh index. The fixture records the unresolved relative import under module:relative.
Module-key retry eligibility
src/db/reference-tail.ts, src/db/queries.ts, __tests__/sync-python-import-binding-retry.test.ts, CHANGELOG.md
Module keys are identified by the module: prefix. Retry queries apply a separate ceiling to module keys. Tests cover retry limits and failed-reference keys. The changelog records the retry and re-export updates.
Bounded sync-time edge counting
src/db/queries.ts, src/extraction/index.ts, src/codegraph.ts, __tests__/sync-python-import-binding-retry.test.ts
Sync captures the maximum edge ID before retrying failed references and passes it to stale-edge resurrection. Resolution-edge counts can be limited to edges at or below that ID.

Upstream Revision Reference

Layer / File(s) Summary
README upstream commit reference
README.md
The README changes the upstream commit cited as included in fork/consolidated.

Priority: ⬇️ Low

Merge Risk | ⚪ Minimal · up to 978b2

Merge Risk: ⚪ Minimal · up to 978b2

No merge-blocking issue remains identified; merge after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 978b2

The changes preserve existing graph-update safeguards and remain within the checked project database flow. Larger retry populations increase processing work, but no new privilege escalation or cross-project access path was established. Deployment exposure and resource budgets remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — A contributor able to alter indexed project files can influence retry keys and graph-processing work. The checked path reads and replaces records in the same project database. Module-key populations of up to 5,000 now qualify for retry, while ordinary name lookups retain the 500 ceiling; neither ceiling establishes an aggregate per-sync budget.

Trust Boundaries and Controls

  • observed — Retry names and edge cutoffs are bound SQL values rather than executable syntax. QueryBuilder was already exported for SDK consumers; the changed internal callers derive their inputs from project files and database state rather than adding a new network-facing authority boundary.

Resilience and Maintainability Implications

  • observed — The retry/rebind transition retains existing containment controls: writer serialization, source-reference reconstruction, exclusion of already-refreshed and unreconstructable edges, transactional deletion plus pending-reference insertion, and edge-identity uniqueness. Resurrected references enter the existing resolution sweep. Interruption can leave partial retry progress, but that behavior predates this PR; cleanup remains in the existing finally path.

Hardening Proposals

  • proposed — For deployments that index untrusted repositories on shared workers, consider aggregate retry/rebind work budgets and workload telemetry. Per-key eligibility ceilings and SQL parameter chunking do not alone limit total processing or memory use. This is a deployment-dependent proposal, not a verified denial-of-service finding.

Pre-merge checks | Passed 6
✅ Passed checks (6 passed)
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly identifies the primary change: reconciling the fork with upstream through commit a3fdb92.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Suppressions Explained Passed PASS: The pull request adds no lint, type-check, or compiler suppression directive. The changed files contain no added eslint-disable, @ts-ignore, @ts-expect-error, #[allow(...)], noqa, or i…
User-Visible Changes Documented Passed The diff changes Python import-resolution and retry behavior, database helpers, tests, a golden fixture, CHANGELOG.md, and the fork commit reference in README.md. It does not add, remove, or rename a …

✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR


🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 9 files

Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic

Comment thread src/resolution/import-resolver.ts
Comment thread src/resolution/import-resolver.ts
Comment thread CHANGELOG.md
@bompus
bompus merged commit 3ee57b9 into fork/consolidated Oct 12, 2026
5 checks passed
@bompus
bompus deleted the reconcile/upstream-a3fdb920 branch October 12, 2026 01:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants