Summary
Directories named assets are excluded from indexing by default — reasonable for static files, but under Next.js API trees, pages/api/assets/ contains live route handlers (asset proxy endpoints, typically with dynamic [param].ts files taking attacker-controlled input). Those files are silently absent from file_hashes and produce no nodes.
To your credit, the index response DOES announce it ("excluded":{"dirs":["pages/api/assets"]}) — consumers who read that field can compensate (we are wiring that in on our side). The ask is about the default's blast radius, not silence.
Verified repro (2 minutes, CBM 0.9.0)
mkdir -p /tmp/repro/pages/api/assets /tmp/repro/pages/api/things
# a live proxy route where Next.js conventions put it:
echo 'const handler=(req:any,res:any)=>res.end("x"); export default handler;' \
> "/tmp/repro/pages/api/assets/[assetId].ts"
# controls:
echo 'const handler=(req:any,res:any)=>res.end("x"); export default handler;' > /tmp/repro/pages/api/plain.ts
echo 'const handler=(req:any,res:any)=>res.end("x"); export default handler;' > "/tmp/repro/pages/api/things/[thingId].ts"
codebase-memory-mcp cli index_repository --repo-path /tmp/repro --mode moderate --name repro
# response: "excluded":{"dirs":["pages/api/assets"],"count":1}
sqlite3 ~/.cache/codebase-memory-mcp/repro.db "SELECT rel_path FROM file_hashes WHERE project='repro';"
# observed: pages/api/plain.ts, pages/api/[direct].ts, pages/api/things/[thingId].ts
# — bracket names walk FINE; the assets/ subtree is the omissionWe hit this on a large private TypeScript monorepo, where several live API route files under assets/ directories were silently absent from the graph. Route handlers under assets/ paths are a common Next.js pattern for asset proxying, so the excluded files tend to be exactly the parameterized, input-handling endpoints a code-graph consumer most needs.
Asks
- Is the
assets exclusion configurable per project? If yes, a pointer to the setting is all we need; if not, please consider one (or an exception when the dir sits under a route tree like pages/api/ / app/api/).
- Consider not excluding directories that contain
.ts/.js source files — static-asset dirs rarely do.
Summary
Directories named
assetsare excluded from indexing by default — reasonable for static files, but under Next.js API trees,pages/api/assets/contains live route handlers (asset proxy endpoints, typically with dynamic[param].tsfiles taking attacker-controlled input). Those files are silently absent fromfile_hashesand produce no nodes.To your credit, the index response DOES announce it (
"excluded":{"dirs":["pages/api/assets"]}) — consumers who read that field can compensate (we are wiring that in on our side). The ask is about the default's blast radius, not silence.Verified repro (2 minutes, CBM 0.9.0)
We hit this on a large private TypeScript monorepo, where several live API route files under
assets/directories were silently absent from the graph. Route handlers underassets/paths are a common Next.js pattern for asset proxying, so the excluded files tend to be exactly the parameterized, input-handling endpoints a code-graph consumer most needs.Asks
assetsexclusion configurable per project? If yes, a pointer to the setting is all we need; if not, please consider one (or an exception when the dir sits under a route tree likepages/api//app/api/)..ts/.jssource files — static-asset dirs rarely do.