name: express
url: https://github.com/expressjs/express
# Pinned to the latest test_commit SHA so the snapshot is deterministic and
# every test_commit below is reachable as an ancestor.
commit: b4ab7d65d7724d9309b6faaaf82ad492da2a6d35
language: javascript
size_category: small

test_commits:
  - sha: 925a1dff1e42f1b393c977b8b77757fcf633e09f
    description: "fix: bump qs minimum to ^6.14.2 for CVE-2026-2391"
    changed_files: 1
  - sha: b4ab7d65d7724d9309b6faaaf82ad492da2a6d35
    description: "test: include edge case tests for res.type()"
    changed_files: 1

entry_points:
  - "lib/application.js::app.handle"
  - "lib/express.js::createApplication"

search_queries:
  - query: "app handle"
    expected: "lib/application.js::app"
  - query: "response send"
    expected: "lib/response.js::res"
  - query: "request"
    expected: "lib/request.js::req"

# Express has only one task — JS modules use prototypes + module.exports
# heavily, so most "method" callers are not represented as proper Function
# edges in the graph. createApplication is the cleanest anchor.
multi_hop_tasks:
  - id: express-create-application-callees
    nl_query: "What express does when constructing an application"
    anchor_qualified_suffix: "lib/express.js::createapplication"
    traversal_pattern: callees_of
    expected_neighbor_names: ["mixin", "create", "init"]
    k: 10

# Questions for the agent_baseline benchmark (pure-python grep top-k vs graph
# query). See docs/REPRODUCING.md for the methodology.
agent_questions:
  - "How does app.handle process the middleware stack"
  - "Where does res.send write the response body"
  - "How does createApplication initialize an app"