bug(indexer): add_package_to_graph on a flat module (six, typing_extensions) resolves to the entire site-packages directory and indexes the whole environment #1528

tools/package_resolver.py:52

_get_python_package_path falls through to:

return str(module_file.parent)

for any non-stdlib module whose spec.origin is a bare .py file rather than an __init__.py. For a flat, single-module package — six.py, typing_extensions.py — the parent directory is site-packages.

Reproduction

$ .venv/bin/python -c "
from codegraphcontext.tools.package_resolver import get_local_package_path
for m in ['six', 'typing_extensions', 'packaging', 'os']:
    print(f'{m:20} -> {get_local_package_path(m, \"python\")}')
"
six                  -> .../.venv/lib/python3.12/site-packages
typing_extensions    -> .../.venv/lib/python3.12/site-packages
packaging            -> .../.venv/lib/python3.12/site-packages/packaging
os                   -> None

Impact

add_package_to_graph(package_name="six", language="python") sets discovered_path to the whole site-packages tree and launches build_graph_from_path_async on it. That indexes every installed dependency — thousands of unrelated files — under a single Repository node named site-packages. It then also poisons the "already indexed" dedupe in indexing_handlers.py:92-97, since that entire path now registers as indexed.

six and typing_extensions are among the most commonly installed Python packages, so this is easy to hit.

Second, smaller bug in the same function

tools/package_resolver.py:43 — frozen stdlib modules (os, io, abc, … in CPython 3.11+) report spec.origin == "frozen" with no submodule_search_locations, so they resolve to None and the tool reports "Could not find package 'os'" for a module that plainly exists. Also reproduced above.

Suggested fix

For a single-file module, index the file, not its parent directory — or refuse with a clear message rather than silently widening the scope to the whole environment. Guard the fallback with a check that the parent is not a site-packages / dist-packages root.

_{Reproduced with the snippet above.}