feat(index): multi-repo workspaces index as a whole (#514) (#837)

A workspace holding several independent git repos failed two ways:

- Enumeration: a super-repo whose .gitignore hides its child repos
  (/packages/) indexed 0 of their files — git never lists ignored dirs,
  and the #193 embedded-repo recursion only fired for UNTRACKED dirs.
  Gitignored embedded repos are now discovered (ignored-dirs listing +
  bounded .git search) and enumerated by their own git ls-files.
- Change detection: git status in the parent says nothing about embedded
  repos (untracked OR ignored), so codegraph sync missed every child
  change. Status now recurses per embedded repo.

ScopeIgnore is the new single source of truth for indexer + watcher
scope: parent rules for ordinary paths, the child repo's own rules for
paths inside it, built-in defaults uniformly on full paths (a git repo
inside node_modules is an npm git-dependency, not project code), and
ancestors of embedded roots are never pruned (the Linux per-directory
watcher must descend to reach them).

Non-git workspace roots already worked via the per-directory gitignore
walk — locked in by test.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -16,6 +16,8 @@ and adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### New Features
 
+- **Workspaces holding multiple git repositories now index as a whole.** Running `codegraph init` at the root of a directory that contains several independent git repos — including the common "super-repo" layout where the parent repo's `.gitignore` hides the child repos to keep `git status` quiet — now indexes every nested project into one graph, with each child repo's own `.gitignore` respected. `codegraph sync` and live file watching pick up changes inside the nested repos too (previously change detection only consulted the parent repo, so edits in child repos were invisible until a full re-index). Git repositories inside `node_modules` (npm git-dependencies) remain excluded. (#514)
+
 - **`codegraph_explore` now explains where a flow ends instead of going silent.** When the symbols you ask about don't connect statically — because the code dispatches through a runtime mechanism like a computed call (`handlers[action.type](...)`), Python's `getattr`, a command/mediator bus (`sender.Send(new DeleteCommand(...))`), reflection, or `new Proxy` — explore now announces the exact dispatch site (file and line) where the static path stops, and when the dispatch key is visible in the source it shortlists the likely runtime targets (for example pointing a MediatR command straight at its `Handler.Handle` method). Detection is deterministic and runs only when a flow fails to connect; fully connected flows are unchanged, and nothing about indexing or the graph itself changes. Relatedly, a custom event bus whose emit and handler connect through a single synthesized hop now shows that hop explicitly (with the registration site) — it previously rendered nothing because the connection was "too short" for the flow section. (#687)
 
 - **Anonymous usage telemetry, documented field-by-field and easy to turn off.** CodeGraph now collects a small set of anonymous usage statistics — which commands and MCP tools get used, which languages get indexed, which agents connect — so language and agent support work goes where real usage is. Never any code, file paths, file or symbol names, search queries, or IP addresses; usage aggregates locally into daily totals before anything is sent, and the ingest endpoint is public, auditable code in the repository that enforces the documented field list. The installer asks up front with a visible default-on toggle (and never re-asks); everywhere else a one-line notice prints before the first send. Disable any time with `codegraph telemetry off`, `CODEGRAPH_TELEMETRY=0`, or the cross-tool `DO_NOT_TRACK=1` standard — off means off: nothing is recorded, nothing is sent, and buffered data is deleted. `TELEMETRY.md` documents every field.

__tests__/multi-repo-workspace.test.ts

@@ -0,0 +1,204 @@
+/**
+ * Multi-repo workspaces (#514): a directory holding several independent git
+ * repositories must index as a whole.
+ *
+ * Two enumeration paths are exercised:
+ *  - git path: the workspace root is itself a git repo (a "super-repo") whose
+ *    `.gitignore` hides the child repos to keep `git status` quiet. git never
+ *    lists ignored dirs, so the embedded repos were invisible (0 files). They
+ *    are now discovered via the ignored-directories listing and enumerated by
+ *    their own `git ls-files`. (#193 covered the *untracked* embedded case.)
+ *  - sync path: `git status` in the parent says nothing about embedded repos;
+ *    change detection now recurses into them.
+ *
+ * The non-git-parent case (plain folder of repos) already worked via the
+ * filesystem walk — locked in here so it stays that way.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { execFileSync } from 'child_process';
+import CodeGraph from '../src/index';
+import { scanDirectory, buildScopeIgnore, discoverEmbeddedRepoRoots } from '../src/extraction';
+
+function git(cwd: string, ...args: string[]): void {
+  execFileSync('git', args, { cwd, stdio: ['ignore', 'ignore', 'ignore'] });
+}
+
+/** git init + commit everything currently in `dir` as one repo. */
+function makeRepo(dir: string): void {
+  git(dir, 'init', '-q');
+  git(dir, 'add', '-A');
+  git(dir, '-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'init', '--allow-empty');
+}
+
+function write(file: string, content: string): void {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, content);
+}
+
+describe('multi-repo workspaces (#514)', () => {
+  let ws: string;
+
+  beforeEach(() => {
+    ws = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-multirepo-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(ws, { recursive: true, force: true });
+  });
+
+  it('indexes embedded repos hidden by the super-repo .gitignore', () => {
+    write(path.join(ws, 'packages/proj-a/src/auth.ts'), 'export function login() { return 1; }\n');
+    write(path.join(ws, 'packages/proj-b/src/billing.ts'), 'export function charge() { return 2; }\n');
+    makeRepo(path.join(ws, 'packages/proj-a'));
+    makeRepo(path.join(ws, 'packages/proj-b'));
+    write(path.join(ws, '.gitignore'), '/packages/\n');
+    write(path.join(ws, 'tools.ts'), 'export function tool() { return 0; }\n');
+    makeRepo(ws);
+
+    const files = scanDirectory(ws);
+    expect(files).toContain('packages/proj-a/src/auth.ts');
+    expect(files).toContain('packages/proj-b/src/billing.ts');
+    expect(files).toContain('tools.ts'); // the parent's own tracked code still indexes
+  });
+
+  it('keeps respecting the parent .gitignore for the parent own (non-repo) dirs', () => {
+    write(path.join(ws, 'scratch/junk.ts'), 'export function junk() { return 9; }\n');
+    write(path.join(ws, 'src/app.ts'), 'export function app() { return 1; }\n');
+    write(path.join(ws, '.gitignore'), '/scratch/\n');
+    makeRepo(ws);
+
+    const files = scanDirectory(ws);
+    expect(files).toContain('src/app.ts');
+    // scratch/ is gitignored and contains NO embedded repo — stays excluded.
+    expect(files.some((f) => f.startsWith('scratch/'))).toBe(false);
+  });
+
+  it('never descends into git repos inside node_modules (npm git-dependencies)', () => {
+    // Embedded repo first (clean), node_modules dropped in afterwards —
+    // matching reality, where node_modules is never committed.
+    write(path.join(ws, 'packages/proj-a/src/auth.ts'), 'export function login() {}\n');
+    makeRepo(path.join(ws, 'packages/proj-a'));
+    write(path.join(ws, 'packages/proj-a/node_modules/inner/src/evil2.ts'), 'export function evil2() {}\n');
+    makeRepo(path.join(ws, 'packages/proj-a/node_modules/inner')); // npm git-dep: has commits
+    // Workspace-level git-dep too.
+    write(path.join(ws, 'node_modules/git-dep/src/evil.ts'), 'export function evil() {}\n');
+    makeRepo(path.join(ws, 'node_modules/git-dep'));
+    write(path.join(ws, '.gitignore'), '/packages/\nnode_modules\n');
+    makeRepo(ws);
+
+    const files = scanDirectory(ws);
+    expect(files).toContain('packages/proj-a/src/auth.ts');
+    expect(files.some((f) => f.includes('node_modules'))).toBe(false);
+  });
+
+  it('still indexes UNTRACKED embedded repos (#193 regression)', () => {
+    write(path.join(ws, 'vendor-src/lib/src/util.ts'), 'export function util() {}\n');
+    makeRepo(path.join(ws, 'vendor-src/lib'));
+    write(path.join(ws, 'main.ts'), 'export function main() {}\n');
+    makeRepo(ws); // vendor-src/ is untracked (not ignored) — committed ws has only main.ts + nothing else
+    // NOTE: makeRepo committed vendor-src too via add -A… recreate untracked state:
+    git(ws, 'rm', '-r', '--cached', '-q', 'vendor-src');
+    git(ws, '-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'untrack');
+
+    const files = scanDirectory(ws);
+    expect(files).toContain('vendor-src/lib/src/util.ts');
+    expect(files).toContain('main.ts');
+  });
+
+  it('non-git workspace: walks children and respects each child own .gitignore', () => {
+    write(path.join(ws, 'proj-a/src/auth.ts'), 'export function login() {}\n');
+    write(path.join(ws, 'proj-a/build/out.ts'), 'export function generated() {}\n');
+    write(path.join(ws, 'proj-a/.gitignore'), 'build/\n');
+    write(path.join(ws, 'proj-b/src/billing.ts'), 'export function charge() {}\n');
+    makeRepo(path.join(ws, 'proj-a'));
+    makeRepo(path.join(ws, 'proj-b'));
+    // ws itself is NOT a git repo.
+
+    const files = scanDirectory(ws);
+    expect(files).toContain('proj-a/src/auth.ts');
+    expect(files).toContain('proj-b/src/billing.ts');
+    expect(files.some((f) => f.includes('build/'))).toBe(false);
+  });
+
+  it('does not search beyond the embedded-repo depth cap', () => {
+    // Repo buried 5 levels under the ignored dir — past EMBEDDED_REPO_SEARCH_DEPTH (4).
+    const deep = path.join(ws, 'pkgs/a/b/c/d/e');
+    write(path.join(deep, 'src/deep.ts'), 'export function deep() {}\n');
+    makeRepo(deep);
+    write(path.join(ws, 'main.ts'), 'export function main() {}\n');
+    write(path.join(ws, '.gitignore'), '/pkgs/\n');
+    makeRepo(ws);
+
+    const files = scanDirectory(ws);
+    expect(files).toContain('main.ts');
+    expect(files.some((f) => f.includes('deep.ts'))).toBe(false);
+  });
+
+  it('discovers embedded roots (ignored + untracked kinds); none for non-git roots', () => {
+    write(path.join(ws, 'packages/proj-a/src/auth.ts'), 'export function login() {}\n');
+    makeRepo(path.join(ws, 'packages/proj-a'));
+    write(path.join(ws, 'vendor-src/lib/util.ts'), 'export function util() {}\n');
+    makeRepo(path.join(ws, 'vendor-src/lib'));
+    write(path.join(ws, '.gitignore'), '/packages/\n'); // vendor-src stays untracked
+    makeRepo(ws);
+    git(ws, 'rm', '-r', '--cached', '-q', 'vendor-src');
+    git(ws, '-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'untrack');
+
+    const roots = discoverEmbeddedRepoRoots(ws);
+    expect(roots).toContain('packages/proj-a/');
+    expect(roots).toContain('vendor-src/lib/');
+
+    const plain = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-nongit-'));
+    try {
+      expect(discoverEmbeddedRepoRoots(plain)).toEqual([]);
+    } finally {
+      fs.rmSync(plain, { recursive: true, force: true });
+    }
+  });
+
+  it('ScopeIgnore: embedded files use the child rules; the watcher can descend to them', () => {
+    write(path.join(ws, 'packages/proj-a/src/auth.ts'), 'export function login() {}\n');
+    write(path.join(ws, 'packages/proj-a/.gitignore'), 'build/\n');
+    makeRepo(path.join(ws, 'packages/proj-a'));
+    write(path.join(ws, '.gitignore'), '/packages/\n');
+    makeRepo(ws);
+
+    const scope = buildScopeIgnore(ws);
+    // Inside the embedded repo: the CHILD's rules decide.
+    expect(scope.ignores('packages/proj-a/src/auth.ts')).toBe(false);
+    expect(scope.ignores('packages/proj-a/build/out.ts')).toBe(true);
+    // Under the ignored dir but NOT in any embedded repo: parent rules apply.
+    expect(scope.ignores('packages/stray.ts')).toBe(true);
+    // Directory form: ancestors of an embedded root are never pruned —
+    // the Linux per-directory watcher must descend through `packages/`.
+    expect(scope.ignores('packages/')).toBe(false);
+    // Ordinary paths: unchanged semantics.
+    expect(scope.ignores('node_modules/dep/index.ts')).toBe(true);
+    expect(scope.ignores('src/app.ts')).toBe(false);
+  });
+
+  it('sync picks up a change inside a gitignored embedded repo', async () => {
+    write(path.join(ws, 'packages/proj-a/src/auth.ts'), 'export function login() { return 1; }\n');
+    makeRepo(path.join(ws, 'packages/proj-a'));
+    write(path.join(ws, '.gitignore'), '/packages/\n');
+    makeRepo(ws);
+
+    const cg = CodeGraph.initSync(ws, { config: { include: ['**/*.ts'], exclude: [] } });
+    try {
+      await cg.indexAll();
+      expect(cg.searchNodes('login', { limit: 5 }).length).toBeGreaterThan(0);
+
+      // Change inside the embedded repo — invisible to the parent's `git status`.
+      write(path.join(ws, 'packages/proj-a/src/auth.ts'),
+        'export function login() { return 1; }\nexport function logout() { return 0; }\n');
+      await cg.sync();
+
+      expect(cg.searchNodes('logout', { limit: 5 }).length).toBeGreaterThan(0);
+    } finally {
+      cg.destroy();
+    }
+  });
+});

src/extraction/index.ts

@@ -246,6 +246,187 @@ export function buildDefaultIgnore(rootDir: string): Ignore {
   return ig;
 }
 
+/**
+ * Defaults-only ignore matcher (no root `.gitignore` merged). Used wherever the
+ * parent repo's own ignore rules must NOT apply — inside embedded child repos,
+ * whose gitignore semantics their own `git ls-files` already enforced (#514).
+ */
+function defaultsOnlyIgnore(): Ignore {
+  return ignore().add(DEFAULT_IGNORE_PATTERNS);
+}
+
+/**
+ * List the gitignored DIRECTORIES of a repo (collapsed, trailing-slash form),
+ * relative to `repoDir`. These are invisible to every other `git ls-files` /
+ * `git status` mode — and in a multi-repo workspace they are exactly where the
+ * nested project repos live (a super-repo `.gitignore`s its child repos to keep
+ * `git status` quiet; that does not make them third-party code). (#514)
+ */
+function listIgnoredDirs(repoDir: string): string[] {
+  try {
+    const out = execFileSync(
+      'git',
+      ['ls-files', '-z', '-o', '-i', '--exclude-standard', '--directory'],
+      { cwd: repoDir, encoding: 'utf-8' as const, timeout: 30000, maxBuffer: 50 * 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe'] as ['pipe', 'pipe', 'pipe'], windowsHide: true }
+    );
+    return out.split('\0').filter((e) => e.endsWith('/'));
+  } catch {
+    return [];
+  }
+}
+
+/** Max directory depth searched below an ignored dir for nested `.git` roots. */
+const EMBEDDED_REPO_SEARCH_DEPTH = 4;
+/** Max directories examined per search — a huge ignored data dir must never stall a scan/sync. */
+const EMBEDDED_REPO_SEARCH_ENTRIES = 2000;
+
+/**
+ * Find git repositories nested under `absDir` (inclusive), shallow bounded BFS.
+ * Stops descending at each repo root found — contents belong to that repo's own
+ * enumeration. Skips default-ignored dirs (`node_modules` can contain `.git`
+ * from npm git-dependencies — that never makes it project code) and CodeGraph
+ * data dirs. Depth- and entry-capped so a huge ignored tree can't stall the scan.
+ */
+function findNestedGitRepos(absDir: string, relPrefix: string): string[] {
+  const found: string[] = [];
+  const defaults = defaultsOnlyIgnore();
+  const queue: Array<{ abs: string; rel: string; depth: number }> = [
+    { abs: absDir, rel: relPrefix, depth: 0 },
+  ];
+  let examined = 0;
+  while (queue.length > 0) {
+    const { abs, rel, depth } = queue.shift()!;
+    if (++examined > EMBEDDED_REPO_SEARCH_ENTRIES) {
+      logDebug('Embedded-repo search entry cap hit — deeper repos (if any) not discovered', { under: relPrefix });
+      break;
+    }
+    if (fs.existsSync(path.join(abs, '.git'))) {
+      found.push(rel);
+      continue; // its own git handles everything below
+    }
+    if (depth >= EMBEDDED_REPO_SEARCH_DEPTH) continue;
+    let entries: fs.Dirent[];
+    try {
+      entries = fs.readdirSync(abs, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name === '.git' || isCodeGraphDataDir(entry.name)) continue;
+      const childRel = rel + entry.name + '/';
+      if (defaults.ignores(childRel)) continue;
+      queue.push({ abs: path.join(abs, entry.name), rel: childRel, depth: depth + 1 });
+    }
+  }
+  return found;
+}
+
+/**
+ * Workspace-scope ignore matcher. Ordinary paths get the root's matcher
+ * (built-in defaults + root `.gitignore`); paths inside an EMBEDDED repo get
+ * that repo's own matcher (defaults + its root `.gitignore`) — the parent's
+ * `.gitignore` hides a child repo from git, not from the index (#514). A
+ * directory path (trailing slash) that is an ANCESTOR of an embedded root is
+ * never ignored, so directory-pruning callers (the Linux per-directory
+ * watcher) still descend to reach the embedded repos.
+ *
+ * Single source of truth for indexer and watcher scope — they must not diverge.
+ */
+export class ScopeIgnore {
+  private embedded: Array<{ root: string; matcher: Ignore }>;
+  private defaults: Ignore = defaultsOnlyIgnore();
+  constructor(private rootMatcher: Ignore, embedded: Array<{ root: string; matcher: Ignore }>) {
+    // Longest root first so paths in nested embedded repos hit the innermost matcher.
+    this.embedded = [...embedded].sort((a, b) => b.root.length - a.root.length);
+  }
+
+  ignores(rel: string): boolean {
+    for (const { root, matcher } of this.embedded) {
+      if (rel.startsWith(root)) {
+        const inner = rel.slice(root.length);
+        if (inner === '') return false;
+        // Built-in defaults apply to the FULL path uniformly (#407) — an
+        // embedded repo inside node_modules (an npm git-dependency) must stay
+        // excluded even though its own rules wouldn't ignore its files.
+        return this.defaults.ignores(rel) || matcher.ignores(inner);
+      }
+    }
+    // Never prune a directory that leads to an embedded repo.
+    if (rel.endsWith('/') && this.embedded.some(({ root }) => root.startsWith(rel))) {
+      return false;
+    }
+    return this.rootMatcher.ignores(rel);
+  }
+}
+
+/**
+ * Build the workspace-scope matcher. When the caller already knows the
+ * embedded roots (the scanner discovers them during collection), pass them to
+ * skip rediscovery; otherwise they're discovered here (the watcher path).
+ */
+export function buildScopeIgnore(rootDir: string, embeddedRoots?: Iterable<string>): ScopeIgnore {
+  const roots = embeddedRoots ? [...embeddedRoots] : discoverEmbeddedRepoRoots(rootDir);
+  return new ScopeIgnore(
+    buildDefaultIgnore(rootDir),
+    roots.map((root) => ({ root, matcher: buildDefaultIgnore(path.join(rootDir, root)) })),
+  );
+}
+
+/**
+ * Standalone discovery of every embedded repo root under `rootDir` (relative,
+ * trailing-slashed) — both the untracked kind (#193) and the gitignored kind
+ * (#514), recursively (an embedded repo can embed further repos). Returns []
+ * for non-git roots: the filesystem walk handles nested repos there already.
+ */
+export function discoverEmbeddedRepoRoots(rootDir: string): string[] {
+  try {
+    execFileSync('git', ['rev-parse', '--git-dir'], { cwd: rootDir, encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+  } catch {
+    return [];
+  }
+  const out: string[] = [];
+  const defaults = defaultsOnlyIgnore();
+  const visit = (repoAbs: string, prefix: string): void => {
+    const candidates: string[] = [];
+    try {
+      const o = execFileSync(
+        'git',
+        ['ls-files', '-z', '-o', '--exclude-standard', '--directory'],
+        { cwd: repoAbs, encoding: 'utf-8', timeout: 30000, maxBuffer: 50 * 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true }
+      );
+      for (const e of o.split('\0')) {
+        if (e.endsWith('/') && !defaults.ignores(e)) {
+          candidates.push(...findNestedGitRepos(path.join(repoAbs, e), e));
+        }
+      }
+    } catch { /* untracked listing failed — ignored-side discovery still runs */ }
+    candidates.push(...findIgnoredEmbeddedRepos(repoAbs));
+    for (const rel of candidates) {
+      const full = normalizePath(prefix + rel);
+      out.push(full);
+      visit(path.join(repoAbs, rel), full);
+    }
+  };
+  visit(rootDir, '');
+  return out;
+}
+
+/**
+ * Discover embedded repos hidden by `repoDir`'s OWN ignore rules: for each
+ * gitignored directory (skipping built-in default excludes), search for nested
+ * `.git` roots. Returns repo paths relative to `repoDir`, trailing-slashed.
+ */
+function findIgnoredEmbeddedRepos(repoDir: string): string[] {
+  const defaults = defaultsOnlyIgnore();
+  const repos: string[] = [];
+  for (const dir of listIgnoredDirs(repoDir)) {
+    if (defaults.ignores(dir)) continue;
+    repos.push(...findNestedGitRepos(path.join(repoDir, dir), dir));
+  }
+  return repos;
+}
+
 /**
  * Collect git-visible files (tracked + untracked, .gitignore-respected) from the
  * git repository rooted at `repoDir`, adding each to `files` with `prefix`
@@ -257,9 +438,12 @@ export function buildDefaultIgnore(rootDir: string): Ignore {
  * skips them entirely, and untracked output reports them only as an opaque
  * "subdir/" entry (trailing slash) rather than expanding their files. Each
  * embedded repo is its own git boundary, so we re-run `git ls-files` inside it.
- * (See issue #193.)
+ * (See issue #193.) GITIGNORED embedded repos are invisible even to that —
+ * they're discovered separately via `findIgnoredEmbeddedRepos` (#514); every
+ * embedded repo root (however found) is recorded in `embeddedRoots` so callers
+ * can exempt its files from the parent's own gitignore rules.
  */
-function collectGitFiles(repoDir: string, prefix: string, files: Set<string>): void {
+function collectGitFiles(repoDir: string, prefix: string, files: Set<string>, embeddedRoots?: Set<string>): void {
   const gitOpts = { cwd: repoDir, encoding: 'utf-8' as const, timeout: 30000, maxBuffer: 50 * 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe'] as ['pipe', 'pipe', 'pipe'], windowsHide: true };
 
   // Tracked files. --recurse-submodules pulls in files from active submodules,
@@ -285,15 +469,26 @@ function collectGitFiles(repoDir: string, prefix: string, files: Set<string>): v
     if (rel.endsWith('/')) {
       // git only emits a trailing-slash directory entry for an embedded repo.
       // Guard with a .git check anyway, and skip anything else exactly as git
-      // itself skips it (we never descend into a non-repo opaque dir).
+      // itself skips it (we never descend into a non-repo opaque dir). Never
+      // descend into default-ignored locations — an embedded repo inside
+      // node_modules is an npm git-dependency, not project code.
       const childDir = path.join(repoDir, rel);
-      if (fs.existsSync(path.join(childDir, '.git'))) {
-        collectGitFiles(childDir, prefix + rel, files);
+      if (fs.existsSync(path.join(childDir, '.git')) && !defaultsOnlyIgnore().ignores(rel)) {
+        embeddedRoots?.add(normalizePath(prefix + rel));
+        collectGitFiles(childDir, prefix + rel, files, embeddedRoots);
       }
       continue;
     }
     files.add(normalizePath(prefix + rel));
   }
+
+  // Embedded repos hidden by THIS repo's ignore rules (`/packages/` in a
+  // super-repo .gitignore) never appear in any listing above — discover and
+  // recurse into them too. (#514)
+  for (const rel of findIgnoredEmbeddedRepos(repoDir)) {
+    embeddedRoots?.add(normalizePath(prefix + rel));
+    collectGitFiles(path.join(repoDir, rel), prefix + rel, files, embeddedRoots);
+  }
 }
 
 /**
@@ -329,11 +524,15 @@ function getGitVisibleFiles(rootDir: string): Set<string> | null {
     }
 
     const files = new Set<string>();
-    collectGitFiles(rootDir, '', files);
+    const embeddedRoots = new Set<string>();
+    collectGitFiles(rootDir, '', files, embeddedRoots);
     // Apply built-in default ignores uniformly — to tracked files too, since
     // committing a dependency/build dir doesn't make it project code. A
     // `.gitignore` negation (e.g. `!vendor/`) is the explicit opt-in. (issue #407)
-    const ig = buildDefaultIgnore(rootDir);
+    // Files inside an EMBEDDED repo are matched against that repo's own rules,
+    // not the parent's: the parent's .gitignore hides the child repo from git,
+    // not from the index. (#514)
+    const ig = buildScopeIgnore(rootDir, embeddedRoots);
     return new Set([...files].filter((f) => !ig.ignores(f)));
   } catch {
     return null;
@@ -354,41 +553,69 @@ interface GitChanges {
 /**
  * Use `git status` to detect changed files instead of scanning every file.
  * Returns null on failure so callers fall back to full scan.
+ *
+ * Recurses into embedded repos — both the untracked kind (#193: the parent's
+ * status collapses them to an opaque `?? subdir/` entry) and the gitignored
+ * kind (#514: they never appear in the parent's status at all) — running
+ * `git status` inside each, so changes in a multi-repo workspace sync without
+ * a full rescan. Deleting an ENTIRE embedded repo dir is the one case this
+ * cannot see (the child status that would report the deletions is gone with
+ * it); a full `codegraph index` reconciles that.
  */
 function getGitChangedFiles(rootDir: string): GitChanges | null {
   try {
-    const output = execFileSync(
-      'git',
-      ['status', '--porcelain', '--no-renames'],
-      { cwd: rootDir, encoding: 'utf-8', timeout: 10000, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true }
-    );
+    const changes: GitChanges = { modified: [], added: [], deleted: [] };
+    collectGitStatus(rootDir, '', changes);
+    return changes;
+  } catch {
+    return null;
+  }
+}
 
-    const modified: string[] = [];
-    const added: string[] = [];
-    const deleted: string[] = [];
+function collectGitStatus(repoDir: string, prefix: string, out: GitChanges): void {
+  const output = execFileSync(
+    'git',
+    ['status', '--porcelain', '--no-renames'],
+    { cwd: repoDir, encoding: 'utf-8', timeout: 10000, maxBuffer: 50 * 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true }
+  );
 
-    for (const line of output.split('\n')) {
-      if (line.length < 4) continue; // Minimum: "XY file"
+  const untrackedDirs: string[] = [];
+  for (const line of output.split('\n')) {
+    if (line.length < 4) continue; // Minimum: "XY file"
 
-      const statusCode = line.substring(0, 2);
-      const filePath = normalizePath(line.substring(3));
+    const statusCode = line.substring(0, 2);
+    const rel = normalizePath(line.substring(3));
 
-      // Skip non-source files (git status already omits .gitignored paths).
-      if (!isSourceFile(filePath)) continue;
+    // Untracked directory entries (trailing slash) may hide an embedded repo —
+    // collect for the recursion below instead of treating as a file.
+    if (statusCode === '??' && rel.endsWith('/')) {
+      untrackedDirs.push(rel);
+      continue;
+    }
 
-      if (statusCode === '??') {
-        added.push(filePath);
-      } else if (statusCode.includes('D')) {
-        deleted.push(filePath);
-      } else {
-        // M, MM, AM, A (staged), etc. — treat as modified
-        modified.push(filePath);
-      }
+    const filePath = normalizePath(prefix + rel);
+    // Skip non-source files (git status already omits .gitignored paths).
+    if (!isSourceFile(filePath)) continue;
+
+    if (statusCode === '??') {
+      out.added.push(filePath);
+    } else if (statusCode.includes('D')) {
+      out.deleted.push(filePath);
+    } else {
+      // M, MM, AM, A (staged), etc. — treat as modified
+      out.modified.push(filePath);
     }
+  }
 
-    return { modified, added, deleted };
-  } catch {
-    return null;
+  // Recurse embedded repos found under untracked dirs (at the dir itself or
+  // nested deeper) and under this repo's gitignored dirs.
+  for (const rel of untrackedDirs) {
+    for (const repoRel of findNestedGitRepos(path.join(repoDir, rel), rel)) {
+      collectGitStatus(path.join(repoDir, repoRel), prefix + repoRel, out);
+    }
+  }
+  for (const rel of findIgnoredEmbeddedRepos(repoDir)) {
+    collectGitStatus(path.join(repoDir, rel), prefix + rel, out);
   }
 }
 

src/sync/watcher.ts

@@ -24,7 +24,7 @@
  *     per-file watches are never needed.
  *
  * Excluded trees (node_modules/, dist/, .git/, …) are filtered via the
- * indexer's `buildDefaultIgnore` (built-in default-ignore dirs + the project's
+ * indexer's `buildScopeIgnore` (built-in default-ignore dirs + the project's
  * .gitignore) — on Linux they're never descended into (so they cost no watch),
  * and on macOS/Windows the single recursive stream still covers them but their
  * events are dropped before any sync is scheduled. Either way the watcher's
@@ -33,8 +33,7 @@
 
 import * as fs from 'fs';
 import * as path from 'path';
-import type { Ignore } from 'ignore';
-import { isSourceFile, buildDefaultIgnore } from '../extraction';
+import { isSourceFile, buildScopeIgnore, type ScopeIgnore } from '../extraction';
 import { logDebug, logWarn } from '../errors';
 import { normalizePath } from '../utils';
 import { isCodeGraphDataDir } from '../directory';
@@ -200,10 +199,12 @@ export class FileWatcher {
    * deterministically gate on watcher readiness.
    */
   private readyWaiters: Array<() => void> = [];
-  // The shared ignore matcher (built-in defaults + project .gitignore), built
-  // once at start(). Same source of truth the indexer uses, so watcher scope
-  // can never diverge from index scope.
-  private ignoreMatcher: Ignore | null = null;
+  // The shared scope matcher (built-in defaults + project .gitignore, with
+  // embedded child repos matched by their OWN rules — #514), built once at
+  // start(). Same source of truth the indexer uses, so watcher scope can
+  // never diverge from index scope. An embedded repo created after start()
+  // joins the scope on the next watcher restart / re-index.
+  private ignoreMatcher: ScopeIgnore | null = null;
 
   private readonly projectRoot: string;
   private readonly debounceMs: number;
@@ -244,7 +245,7 @@ export class FileWatcher {
     }
 
     // Reuse the indexer's ignore set so the watcher and indexer agree on scope.
-    this.ignoreMatcher = buildDefaultIgnore(this.projectRoot);
+    this.ignoreMatcher = buildScopeIgnore(this.projectRoot);
 
     try {
       if (this.inertForTests) {