4 commits

Author	SHA1	Message	Date
Gergő Magyar	999cc9f913	fix(deps): upgrade native tree-sitter to 0.25.1 (#3531) ... * fix(deps): upgrade native tree-sitter to 0.25.1 * fix(tree-sitter): preserve sync loading and update verified capture baselines Route C# scope queries through the synchronous native grammar loader so the compiled analyze module remains require-compatible on Node 22.18. Refresh only the audited empty-Python-module and renamed-PHP-fixture captures, and pin the runtime assertion to 0.25.1. Validated 479 targeted tests, all 16 scope-capture benchmark cases, Python capture/import guards, compiled C# worker parsing, build, typecheck and formatting. Performance budgets are unchanged. * fix(tree-sitter): refresh upstream vendors and preserve parser semantics * fix(ci): refresh prebuilds and support Windows ARM Refresh macOS, Linux ARM, and Windows x64 grammar binaries from the successful native CI builds. Pin node-gyp 12.4.0 so the Windows ARM jobs recognize Visual Studio 2026. Use local Git filtering for E2E to avoid PR-files API timeouts on generated parser diffs. Validation: 143 focused tests, Actionlint, and all 16 scope-capture benchmark checks passed. Full npm test run started; native database suites still running. * fix(ci): refresh Windows ARM grammar prebuilds Import all seven Windows ARM grammar artifacts from successful native build run 37965761760. Artifact filenames and SHA-256 hashes verified; all 42 native build jobs passed. Validation: 31 prebuild coverage tests passed. * fix(bench): stabilize scope capture timing guard Warm each input size seven times and use 21 median samples while retaining isolated timing blocks. Yield between languages so native finalizers release allocations outside the measured sections. Keep all fixture sizes, fingerprints, scaling formulas, and budgets unchanged. Validation: all 16 language guards passed with a 2 GB heap limit (1.38 deep-chain ratio; 1518 MB peak RSS). Linear and quadratic controls passed their expected guard outcomes. Formatting and graph change analysis passed. Full npm test is running without failures so far. * fix(parser): reduce TypeScript capture traversal cost * fix(test): await parser worker readiness before teardown * fix(parser): load C# synchronously in workers * fix(grpc): resolve native proto detections against their own file With the native proto grammar active, sibling .proto files that declare the same short service name under different packages tied in the directory-based resolveProtoConflict heuristic and both providers were dropped. A proto-origin detection already knows its defining file, so use that file's entry before falling back to the heuristic. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * ci(packaging): assert native grammars load from the installed tarball The packaged-install smoke only ran `gitnexus --version`, so a grammar that failed to load from the published package (bundled runtime, patched peer manifests, vendored prebuilds, C# sync loader, Protobuf wrapper) would ship silently; the dev-tree ABI smoke also accepts vendored grammars that report unavailable. Parse a sample for every registered grammar plus the native Protobuf plugin from the installed package, on the main thread and in a worker thread. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * ci(tree-sitter): track compatibility workarounds instead of 0.25 readiness The daily readiness report still targeted tree-sitter@0.25.0, so after the upgrade it would keep reporting "Blocked" and never close its tracking issue. Repurpose it to track what we carry for the bundled runtime: derive the target from the package.json pin, list each pack-time peer patch from prepare-tree-sitter-bundle.cjs with its drop condition (bump, wait for an upstream release, transitive, or intentionally pinned), and reword the buckets. The workflow adopts the issue opened under the old title. Also update the grammar-update-monitor header and auto-PR text, which still described the 0.21.1 runtime and a tree-sitter-c hold. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(dart): assert both nested labels target the loop; fix Zig call-shape doc The nested-label CFG test only jumped to `outer` and checked reachability, which still passes when a jump is retargeted to the inner loop (its exit reaches the outer header). Jump to both labels and assert the exact `continue` edges; dropping the inner label now fails the test. Update the Zig callable-flow comment: call_expression now wraps actuals in a required `arguments:` field. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Codex <codex@openai.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-10 13:07:59 +03:00
mengkaka	4154b63131	feat(indexing): add Objective-C semantic indexing support (#3179) ... * docs: add Objective-C fork provider notes * feat(objective-c): add deterministic provider and grammar * feat(objective-c): finalize provider MVP * fix(objective-c): harden provider integration * fix(objective-c): normalize bare macro markers * docs(objective-c): integrate provider documentation * fix(objective-c): harden resolution and header classification * fix(objective-c): complete provider follow-ups * fix: address Objective-C review follow-ups * chore: format Objective-C grammar sources * fix(objective-c): harden review follow-ups * Address PR review feedback (#3179) Keep Objective-C chunking and macro recovery aligned with the grammar, and stop Community MEMBER_OF edges from leaking into symbol context. Co-authored-by: Cursor <cursoragent@cursor.com> * Address follow-up review on ObjC chunking and language fallback. Keep preprocessor directive text from changing file-scope brace depth, group real ivar nodes, skip header modifiers, and restore Rakefile/Gemfile detection through getLanguageFromFilename. Co-authored-by: Cursor <cursoragent@cursor.com> * Parse Objective-C headers with the objc grammar in embeddings. ensureAndParse and structural extraction now use the same content classifier as ingest, including method snippets from .h files, so Protocol/Category/Class chunks are not re-parsed as C++. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3179) Keep file-scope macro elision off C line splices and @interface/@protocol/@implementation bodies, and attach ivar attributes to the following instance variable when chunking. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(bench): rebaseline Objective-C CSV emit * feat(objective-c): add workspace resolution and linear emit benches Plain .h files are classified as C++, so the ObjC pass could not resolve #import of those headers. Load a C/C#-style workspace once per pass, and keep protocol-candidate USES linear. Refs #3179 Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3179) - Compare LadybugDB labels() as a scalar when excluding Community MEMBER_OF edges. - Walk superclass members, skip file-static C sibling defs, and ignore comments in ObjC header/macro scans. Note: pre-existing failure in objective-c-provider integration (worker-pool ready timeout) not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3179) Emit Objective-C declaration captures so compilation-unit siblings can share header/implementation bindings, and keep class vs protocol visibility groups distinct. Note: pre-existing failure in worker-pool startup (GITNEXUS_WORKER_READY_TIMEOUT_MS) not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3179) Emit every comma-separated property/ivar declarator, and count @interface after a multiline block comment closes so in-declaration macros stay intact. Note: pre-existing failure in worker-pool startup (GITNEXUS_WORKER_READY_TIMEOUT_MS) not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: ximengkai <ximengkai@soyoung.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-09 09:40:21 +00:00
Gergő Magyar	96dc368d96	fix(ci): align tree-sitter readiness + grammar-update workflows on a shared manifest (#858) (#2187) ... * chore(ci): add shared vendored-grammars manifest; monitor reads it .github/vendored-grammars.json is the single source of truth for the vendored tree-sitter grammars (c/swift/kotlin/dart/proto): name, upstream coords, and policy holds. update-vendored-grammars.mjs now builds its GRAMMARS map from the manifest (behavior-preserving — same exported shape). Adds manifest-agreement tests so the loader can't silently skew from the file. * fix(ci): classify vendored grammars from manifest, drop bare "?" (#858) The readiness report decided "is this vendored?" via is_vendored_pin (a file: package.json spec) — but the 5 vendored grammars aren't in package.json, so they were misrouted through the npm path and rendered bare "?" for ABI (read from an empty node_modules), plus a spurious "? (fetch failed)" for github-only proto. Now vendored grammars are classified by membership in the shared manifest and their ABI is read from gitnexus/vendor/<name>/src/parser.c (always in a checkout). github-only vendored grammars skip the npm peer-dep fetch; the tree-sitter-c hold is surfaced from the manifest (held, not plain "Ready"); and every remaining unintrospectable value renders a labeled token, never a bare "?". --assert-current now covers the vendored grammars too instead of skipping them. Adds a stdlib unittest suite incl. a manifest⇄vendor-dir consistency guard. * docs(ci): document the shared vendored-grammars manifest Both tree-sitter workflow headers now point at .github/vendored-grammars.json as the shared source of truth; the readiness workflow gains a PR-path trigger on the manifest + test, and runs the readiness unit tests on validation events. CONTRIBUTING.md documents the manifest contract under CI automation contracts. * fix(review): apply autofix feedback - Guard manifest reads in both scripts with a clear error (was an opaque module-import traceback that crashed the script and test collection). - Never render a bare "?": relabel the npm-path ABI/version/peer sentinels and the vendored upstream-ABI miss to labeled tokens; the report is now ?-free regardless of node_modules/network, and the test is hermetic. - Add a VENDORED_NAMES ⊆ GRAMMARS guard + manifest-missing error test. - Drop now-dead is_vendored_pin/is_vendored/_(vendored)_. - Compose held + out-of-range vendored blocker reasons instead of overwriting. - Reword the shared-manifest docs to not over-claim shared upstream coords. * fix(ci): apply root prettier formatting to mjs + ts test The quality/format gate runs root `prettier --check .` (printWidth 100, the gitnexus-local config differs and falsely passed locally). * test(ci): make both tree-sitter scripts testable offline The scripts hit live npm/GitHub, which makes the report run flaky and the monitor's detect/apply logic untestable. Add hermetic seams: - readiness: --offline flag (+ GITNEXUS_TS_READINESS_OFFLINE env) no-ops the npm registry + upstream fetches; the report renders deterministically (vendored ABIs from the repo, npm columns marked 'offline', no bare '?'). 3 tests assert an offline run touches ZERO network (urlopen patched to raise). - monitor: detect() and apply() accept injected deps (vendoredVersion/ resolveUpstream/fetchSource/readAbi) so the newer/ABI/hold gating runs offline with fixtures; apply gains --dry-run (validates but writes nothing). 6 tests cover newer/same-version/held-c/ABI-15/applicable + a no-mutation dry-run. * fix(review): keep --assert-current hermetic + harden the no-bare-? invariant Tri-review findings (PR #2187): - P2 REGRESSION: --assert-current (documented 'hermetic and offline', run in CI without --offline) routed the 5 vendored grammars through vendored_drift_summary, which fetches upstream parser.c + commit sha — 10 discarded network calls per run. Fix: read the vendored ABI locally via a new vendored_abi_from_repo() helper (also used by vendored_drift_summary). Now verifiably network-free. - Unify the upstream-ABI miss sentinel: prose said 'n/a (generated at build)' while the matrix said 'n/a' — and 'generated at build' is a wrong cause (swift HAS a committed parser.c). Both now render neutral 'n/a'. - Fix the stale assert_current docstring claiming swift is prebuilt-only/no parser.c. - Guard the last latent bare-? path (vendor package.json missing 'version'). Tests: AssertCurrent (network-free guard + out-of-range via the new injection point), malformed-JSON manifest, detect() error-path, explicit npm/github undefined assertions. 17 Python + 15 vitest, all hermetic. * fix(review): use a single unittest import style (CodeQL 753) CodeQL py/import-and-import-from flagged `import unittest` + `from unittest import mock`. Collapse to `from unittest import TestCase, main, mock`. * fix(review): explicit raise in _matrix_row (CodeQL 754) CodeQL py/mixed-returns flagged the implicit fall-through after self.fail() (which it doesn't model as NoReturn). End with an explicit raise AssertionError. * test(review): replace non-null assertions with a must() guard @typescript-eslint/no-non-null-assertion flagged 4 `!` operators. Add a narrowing must<T>(value, message) helper (throws on undefined) and a named baseResolveUpstream, removing every non-null assertion. * fix(review): unguessable heredoc delimiter for the report output The report embeds the manifest `hold` field (fork-PR-editable); a fixed DRIFT_EOF delimiter in a hold value could close the $GITHUB_OUTPUT heredoc early and inject output keys. Use DRIFT_EOF_$(openssl rand -hex 16) — a value the report cannot contain. (Randomized delimiter over base64: keeps REPORT raw markdown, no consumer-side decode.) * fix(review): scope issues:write to scheduled runs (two-job split) GitHub Actions has no step-level permissions, so the only way to keep PR runs (incl. forks) from receiving `issues: write` is to split the job. A `report` job (contents:read, all events) renders the report + the PR `:⚠️:` and exposes report/exit_code as job outputs; a schedule-only `upsert-issue` job (needs: report, issues:write, no checkout) consumes them for the issue upsert + close. The 'Check upgrade readiness' check name is preserved. * fix(review): launder npm-version '?' in disposition prose The disposition bucket prose interpolated r['npm_version'] raw, so a successful 200 npm /latest response lacking a 'version' key would render a bare '?' (the matrix cell already laundered it). Add npm_version_label ('unknown' for '?') and use it in all five bucket renderers. Test a version-less npm response. * refactor(review): load_vendored_manifest returns only the consumed 'hold' The readiness script reads only the grammar names + 'hold'; the 'key' and 'upstream' fields were phantom data (upstream-drift coords live in the script's own GRAMMARS map). Narrow the return to {hold}. * fix(review): unify detect()/apply() 'newer' check for github grammars detect() compared the bare sha7 while apply() compared up.version (the full <base>-g<sha7> provenance string apply() also writes). After the bot re-vendored a github grammar once, detect() reported a perpetual false 'update available' while apply() correctly saw 'already current' — a noisy job summary + wasted --apply subprocess (the PR-exists guard absorbed it before any duplicate PR). Extract a shared isNewer(up, have) helper used by both. Tests cover equal- provenance (false), first-vendoring plain-version (true, not suppressed), and sha-advanced (true). Coupled with U12 (the detect⇄apply agreement assertion lives there once apply()'s not-newer path returns instead of process.exit). * test(review): cover main()'s out-of-range + prebuilt-only vendored ABI branches main()'s vendored-ABI classification reads through vendored_abi_from_repo (the local-read seam --assert-current uses), so patching it drives the 'Vendored (ABI out of range)' blocker branch and the prebuilt-only (vendored_abi None → 'prebuilt' cell, not '?') branch — neither reachable today since all 5 vendor dirs ship parser.c at ABI 14. * test(review): monitor-side manifest⇄vendor-dir consistency guard Mirror the Python consistency guard on the monitor side — the monitor consumes the same manifest and is the side that WRITES files from manifest `name`, so manifest/vendor-dir drift must fail CI here too. * fix(review): validate grammar names at manifest load (path-traversal guard) The manifest `name` is joined into gitnexus/vendor/<name> paths in both scripts (and apply() WRITES there), so reject any name not matching tree-sitter-[a-z0-9-]+ at the single load chokepoint — defense-in-depth even though the live trust boundary already prevents exploitation. loadManifestGrammars gains an injectable `raw` arg + export for testing; tests reject a '../etc' name in both scripts. * refactor(review): apply() throws ApplyExit; CLI maps to exit codes apply()'s 4 process.exit calls killed the vitest worker, blocking in-process tests of its error branches. Replace them with a thrown ApplyExit{code}; the not-newer (already-current) path returns `have` instead of exit(0). The isMain CLI block try/catches and maps ApplyExit.code → process.exit, so the monitor's subprocess contract (exit 0/2/3) is byte-identical (verified via subprocess smoke). Tests cover unknown-key=2, held=3, ABI-reject=3, and not-newer (returns current, no throw, no write). * refactor(review): extract vendored render helper; trim docstrings (<1000 lines) Extract the 'Vendored parsers' prose render into _render_vendored_section() so main() coordinates named phases rather than inlining a ~450-line monolith, and condense the most verbose docstrings/comments. The script drops from 1092 to 999 lines (under the 1000 bar the maintainability review flagged). Behavior-preserving: the deterministic --offline render is byte-identical before/after (verified in-place), --assert-current still passes, and the full unit suite is green. * fix(review): row-diff regex captures only the Status cell The change-detection regex captured the whole row tail as group 2, so any non-status cell drift (e.g. an upstream-ABI bump) emitted a false-positive 'change' line. Capture only the Status cell ([^|]+? before the final |$). The workflow parseRows regex and the Python _ROW_DIFF_RE stay byte-identical; the stability test now asserts group 2 is the status string (e.g. c → 'Vendored — held') and contains no pipe. * fix(ci): hoist intro string out of the list literal (CodeQL 755) The U13 extraction moved the 'Vendored parsers' intro paragraph (implicitly concatenated string literals) INTO a list literal, tripping CodeQL py/implicit-string-concatenation-in-list (reads as a possibly-missing comma between elements). Hoist it into a parenthesized `intro` variable. Render is byte-identical.	2026-06-13 16:15:49 +01:00
Gergő Magyar	cef63dd044	feat(install): toolchain-free tree-sitter via vendored prebuilds (#2113) ... * feat(install): toolchain-free tree-sitter via vendored GitNexus-built prebuilds Eliminate the C/C++-toolchain requirement at install for the at-risk grammars (dart, proto, kotlin) by generating + vendoring native prebuilds, mirroring the existing vendored tree-sitter-swift. The 10 grammars that already ship 6 upstream prebuilds stay npm dependencies (toolchain-free AND dependency-review-tracked). - .github/workflows/build-tree-sitter-prebuilds.yml: a registry-parameterized workflow that builds {dart,proto,kotlin} x {linux,darwin,win32}-{x64,arm64} prebuilds natively, validates each loads + parses on its arch, and opens a PR vendoring them. A `guard` job gates the heavy matrix to run ONLY on dispatch or a real grammar-version change — ordinary code PRs cost zero matrix minutes. - dart/proto: prefer a committed prebuild; fall back to today's source build when none matches (no behavior change until prebuilds are vendored). - kotlin: vendor it (Swift parity) instead of compiling the third-party optionalDependency from source at the user's install — supersedes #2110's optionalDependency mechanism. The ~23 MB parser.c is NOT vendored (the workflow builds from the published package); only node-types + bindings + prebuilds are. Removed from optionalDependencies; lock regenerated; probe, parser-loader note, README/.devcontainer docs, and the #2110 tests updated. DO NOT MERGE until vendor/tree-sitter-kotlin/prebuilds/ is populated by the build-tree-sitter-prebuilds workflow: until then Kotlin is unavailable (vendored with no source-build fallback). dart/proto remain fully functional throughout. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(install): guard 6/6 N-API prebuild coverage for every grammar Regression guard so a toolchain-less install can never silently lose a tree-sitter language on a supported platform-arch: - Vendored grammars (vendor/tree-sitter-*): every one MUST ship a loadable N-API prebuild for all 6 tuples {linux,darwin,win32}-{x64,arm64}. Asserts the napi_register_module_v1 entry symbol in each .node (cross-platform, no need to run the binary). Currently RED for dart/proto/kotlin until the build-tree-sitter-prebuilds workflow populates their prebuilds/ — this is the must-fill-before-merge gate (swift already passes 6/6). - npm-dependency grammars: asserts upstream ships 6/6 N-API too, catching a future platform drop. tree-sitter-c is allow-listed at 4/6 (missing linux-arm64/win32-arm64) pending #2116; the guard also fails if that gap is silently closed (prompting allow-list removal). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(install): vendor tree-sitter-c at 0.21.4 with GitNexus-built prebuilds (#2116) tree-sitter-c is the one grammar dependency upstream ships incomplete prebuilds for (4/6 — no linux-arm64/win32-arm64), AND it is a REQUIRED grammar: its own `install` (node-gyp-build) compiles from source when no prebuild matches and exits non-zero, so on a toolchain-less ARM host `npm install gitnexus` HARD-FAILS at the c step — during npm's dependency phase, before any GitNexus postinstall runs (so a postinstall "supplement" can't help). Fix: vendor c prebuild-only at the pinned 0.21.4 (Kotlin pattern), with all six prebuilds GitNexus-cross-built, and drop it from `dependencies`: - vendor/tree-sitter-c/ (bindings + node-types + manifest + prebuilds); build probe scripts/build-tree-sitter-c.cjs; added to the build workflow registry (kind 'npm' — built from c@0.21.4 source). - materialize-vendor-grammars.cjs: c is REQUIRED, so it is always materialized, even under GITNEXUS_SKIP_OPTIONAL_GRAMMARS (it needs no toolchain). - Removed from package.json dependencies + lockfile (nothing else needs npm c — tree-sitter-cpp's dep on c is dev-only and not installed). Preserves the #1242 ABI pin: vendoring 0.21.4 keeps the good ABI while closing the ARM gap. - parser-loader note + the prebuild-coverage guard + a cli-commands assertion updated; c moves from the npm-gap allow-list into the vendored 6/6 cohort. Verified: tsc clean, 31 unit tests pass, c loads/parses; the guard is RED for c/dart/proto/kotlin until the workflow populates prebuilds (the must-fill gate). Closes the operational risk in #2116. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ci): source-build fallback for vendored c/kotlin so CI is healthy pre-prebuilds The vendored prebuild-only grammars (c, kotlin) had empty prebuilds/ until the build-tree-sitter-prebuilds workflow runs, so they could not load in CI — and C is hard-required by cross-platform tests (tree-sitter-languages/parsing on ubuntu+macos+windows), which I cannot pre-build for macos/windows locally. The robust fix is a source-build fallback that works on every CI runner (all have a toolchain), mirroring dart/proto: - Vendor the grammar source (binding.gyp + src/) for c and kotlin; their build scripts now PREFER a committed prebuild (toolchain-free) and fall back to `node-gyp rebuild` from the vendored source when no prebuild matches. Verified both compile against the hoisted node-addon-api@^8 and the runtime loads. - prebuild-coverage guard is now bootstrap-tolerant: a grammar that vendors its source (binding.gyp) may have an incomplete prebuild set (the workflow fills it); a prebuild-only grammar (swift) still must ship all six. Any present prebuild must still be N-API. Guard goes green; it re-tightens per-grammar as the workflow populates prebuilds. - actionlint: silence a false-positive SC2016 (JS template literals inside the single-quoted `node -e` validate block). Note: kotlin's generated parser.c is large (~23 MB on disk; compresses heavily in git). Once the workflow populates all six kotlin prebuilds, the source serves only as the fallback and could be slimmed if desired. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(docker): re-materialize+rebuild vendored grammars after npm prune `npm prune --omit=dev` in the gitnexus CLI image drops anything not in package.json's dependency tree — including the VENDORED tree-sitter grammars (materialized by postinstall, not declared deps) and their built bindings. The `serve` image analyzes/parses repos at runtime, so re-run the grammar postinstall after the prune (in the toolchain-equipped builder) to restore them. Load-bearing for tree-sitter-c, a core REQUIRED grammar now vendored (#2116): as a former dependency it survived prune; vendored, it would not. Also restores swift/dart/proto/kotlin, which were silently pruned from the image before. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(grammars): unify tree-sitter-swift with the vendored-source build pipeline Swift was the last grammar handled differently — it shipped only upstream prebuilds, while c/dart/proto/kotlin vendor their grammar source and use a prefer-prebuild -> source-build-fallback activation script. Vendor swift's source so all five are handled identically (one uniform build path). - vendor/tree-sitter-swift: add binding.gyp (win-hardened), bindings/node/ binding.cc, src/parser.c (ABI-14 default, ~18 MB), src/scanner.c, and src/tree_sitter/ headers. The 6/6 prebuilds are retained. The legacy parser_abi13.c alternate is intentionally not vendored. - build-tree-sitter-swift.cjs: rewrite the prebuild probe into the dart-style prefer-prebuild then source-build fallback (keeps the GITNEXUS_SKIP gate and the never-exit-non-zero postinstall invariant). - build-tree-sitter-prebuilds.yml: register swift (kind 'vendored'); add its package.json to the version-gated pull_request paths and a validate snippet. - prebuild-coverage guard auto-moves swift into the source-fallback cohort (binding.gyp now present); refresh the stale "swift is prebuild-only" comments. - tests: add build-tree-sitter-swift-probe.test.ts; fix the pre-existing build-tree-sitter-kotlin-probe.test.ts breakage (it still asserted the old probe strings after kotlin's dart-style conversion); assert swift's vendored source in cli-commands.test.ts. - docs: README / .devcontainer / kotlin vendor README — swift's prebuilds are now GitNexus-cross-built from vendored source like the rest, not upstream-only. Verified: swift source-builds against node-addon-api@8 -> N-API binary -> loads against the pinned tree-sitter@0.21.1 (ABI 14) -> parses cleanly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(publish): gate a lean prebuilds-only npm tarball behind a coverage guard Vendoring grammar source (parser.c) alongside the prebuilds means the npm tarball now carries ~50 MB of generated source it almost never compiles (every supported platform-arch has a prebuild). Prepare to drop it from the published package once all prebuilds exist — safely. - .npmignore: add a GATED, commented-out "lean publish" block that excludes the source-build inputs (parser.c/scanner.c/tree_sitter/binding.gyp/binding.cc) but keeps prebuilds/ + the runtime files. Uncommenting ships prebuilds-only. - scripts/assert-publish-grammar-coverage.cjs: a prepack guard that refuses to pack/publish if the source exclusion is active while any vendored grammar still lacks 6/6 prebuilds (which would ship a grammar with no loadable binding). Wired into `prepack` (runs on npm pack + publish, incl. the publish.yml dry-run) and exposed as `npm run assert-publish-coverage`. - test: pure-core decision cases + a real-repo publish-safety check that fails CI if .npmignore is activated prematurely. Net: the prebuilds already publish today (files: ["vendor"]); this makes the future switch to a prebuilds-only tarball a one-line uncomment that can't ship a dead grammar. The guard currently reports "source + prebuilds" (only swift has 6/6 prebuilds so far) and passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(grammars): consolidate the 5 build-tree-sitter-*.cjs into one The per-grammar activation scripts (c/dart/proto/swift/kotlin) were ~95% identical — same prefer-prebuild → source-build → never-fail flow, differing only in name, target_name, required-vs-optional, and the display label in warnings. - scripts/build-tree-sitter-grammars.cjs: one registry-driven script. Bare call builds all (postinstall); `... <name>` builds only the named grammars (so the probe test can isolate one). c is `required: true` (ignores the opt-out gate); the rest honor GITNEXUS_SKIP_OPTIONAL_GRAMMARS. Per-grammar try/catch + a final process.exit(0) preserve the postinstall never-exit-non-zero invariant. - package.json: postinstall is now `materialize && build-tree-sitter-grammars.cjs` (was five chained `build-tree-sitter-<name>.cjs` calls). - tests: replace the two near-identical *-probe.test.ts files with one parameterized build-tree-sitter-grammars-probe.test.ts that also covers the required-vs-optional opt-out split and an unknown-grammar arg. - update cli-commands.test.ts postinstall assertions + the vendor c/kotlin/swift README + swift provenance to reference the consolidated script. Behavior is preserved (warnings normalized to one consistent format). Removes 5 scripts + 1 test file; adds 1 script + 1 test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ingestion): lazy-load tree-sitter-c to prevent module-load crash tree-sitter-c is now vendored prebuild-only (#2116) with 0/6 committed prebuilds, so on a toolchain-less or `--ignore-scripts` install C has no native binding. Three modules loaded it via a hard top-level `import C from 'tree-sitter-c'`, which throws ERR_MODULE_NOT_FOUND at module-load — crashing `analyze` before parser-loader's optional/severity:error degradation can run. This is the #2091/#2093 bug class (previously fixed for swift/dart/kotlin); C was left static because it used to be an always-present npm dependency. - languages/c/query.ts: load via the lazy guarded getLanguageGrammar(C), mirroring swift/query.ts; the main-thread isLanguageAvailable filter ensures the getters are reached only when C is present. - workers/parse-worker.ts: guarded `_require('tree-sitter-c')` + conditional languageMap spread, like swift/dart/kotlin. - group/extractors/include-extractor.ts: guarded `_require`; getLanguageForFile returns null for .c/.h when absent, so C include-extraction degrades to a no-op (C++ unaffected). - extend the registry-import-closure regression test (#2091/#2093) to assert C also loads lazily at registry static-import time. * fix(ci): repin attest-build-provenance to the real v2.4.0 SHA The workflow pinned actions/attest-build-provenance@bd77c077… commented `# v2.4.0`, but v2.4.0 is e8998f94… (verified via the GitHub API); bd77c077… is an untagged mid-stream commit, so the SLSA-attestation step ran unvetted action code and the comment misrepresented what runs. Repin to the real v2.4.0 commit and drop the `# PLACEHOLDER-PIN` markers on both this line and the setup-python pin (a26af69b… is already the correct v5.6.0 — only its comment was stale). Update the header NOTE accordingly. * fix(ci): skip the prebuild-PR aggregate when release App secrets are absent The aggregate job mints a GitHub App token as its first step; with RELEASE_APP_ID/RELEASE_APP_PRIVATE_KEY unset it hard-failed AFTER a full (up-to-6-runner) native build. Since the `secrets` context isn't available in a job-level `if:`, the guard job now computes a `release_app` boolean output (a step can read secrets) and emits an actionable `::notice::`; aggregate gates on it and skips cleanly, while the build job's artifacts still upload (run with open_pr=false for artifacts-only). * chore(ci): drop package-lock.json from the prebuild paths filter; widen build timeout `gitnexus/package-lock.json` changes on nearly every dependency PR, so it fired the prebuild workflow's guard job on unrelated churn (the matrix stayed correctly skipped — `gitnexus/package.json` already covers the transition-window pin, so removing the lock only drops guard noise). Also bump the native build job timeout 30 -> 45 min for headroom compiling the 23 MB kotlin / 18 MB swift parser.c, especially under arm emulation. * fix(ci): event-gate the aggregate open-PR condition explicitly `inputs.open_pr` is null on pull_request events, and the prior `inputs.open_pr != false` leg relied on GHA's direction-ambiguous null coercion (Codex F4) to decide whether to open the prebuild PR. Gate explicitly on the event: a non-fork pull_request that bumped a grammar version opens the prebuild PR (the documented flow), and `open_pr` is only consulted on workflow_dispatch — so a manual run with open_pr=false stays artifacts-only and no event's behavior rests on coercion. * fix(publish): validate the effective npm-pack contents in the coverage guard The publish guard inferred "is source shipped?" from a single .npmignore toggle line, which a partial/out-of-order edit could defeat (exclude binding.gyp but leave parser.c → unbuildable yet "source-shipping"). It now inspects the EFFECTIVE tarball via `npm pack --dry-run --ignore-scripts --json` (the --ignore-scripts avoids re-entering this guard through prepack): a grammar "ships source" only when EVERY on-disk source-build input (binding.gyp + binding.cc + parser.c + scanner.c when present + a tree_sitter header) is actually in the packed file list. This also surfaced that the gated lean-publish .npmignore block was inert: package.json's `files: ["vendor"]` allow-list overrides .npmignore for the vendored subtree, so those exclusion lines never dropped anything. Replace the dead toggle with documentation of the real mechanism (narrow the `files` field) and note the guard enforces safety on the effective pack regardless of how the slim is done. * test(prebuild): hard-gate declared-fully-prebuilt grammars on 6/6 coverage The strict 6/6 prebuild assertion was dormant whenever a grammar vendors source (binding.gyp) — which is every grammar — so a dropped prebuild passed CI silently. Add a FULLY_PREBUILT allowlist of grammars GitNexus has committed 6/6 for (today: swift); those must keep all six even with a source fallback, so losing one now fails CI. Grammars graduate into the set as the build-tree-sitter-prebuilds workflow lands their binaries. (The static-import degradation smoke is covered by the registry-import-closure regression test extended in the C lazy-load commit.) * chore(deps): promote node-gyp-build/node-addon-api to regular dependencies Every vendored grammar's index.js does `require("node-gyp-build")` at runtime to load even a prebuilt .node, so node-gyp-build is runtime-load-critical (and node-addon-api is needed for the source-build fallback). They were optionalDependencies, surviving `--omit=optional` only via the required tree-sitter's transitive edge — correct today but fragile. Promote both to regular dependencies so the contract is explicit (optionalDependencies is now empty and removed). Lock the contract with a cli-commands assertion. * chore(vendor): add Windows cflags parity block to tree-sitter-c/binding.gyp c's binding.gyp used an unconditional `cflags_c: ["-std=c11"]`, while kotlin/swift gate MSVC flags behind an `OS=='win'` condition (/std:c11 /utf-8). Inert today (no non-ASCII bytes in c's parser.c, and node-gyp ignores cflags_c on MSVC anyway), but align the three so a future source-build fallback on Windows behaves consistently. * docs(agents): correct stale optional-grammar / postinstall notes AGENTS.md still said postinstall "patches tree-sitter-swift, builds tree-sitter-proto" and that only kotlin/swift are "optional". Update to the vendored-uniform model: postinstall materializes the vendored grammars and prefers a committed prebuild (source-build only when none matches); c is required while dart/proto/swift/kotlin are optional + skippable via GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1, with non-fatal warnings only on a toolchain-less host with no matching prebuild. * fix(install): preserve the backup and warn loudly on a failed materialize rollback If renameSync(partial, dest) failed AND the rollback renameSync(backup, dest) also failed, the grammar was left unmaterialized (node_modules/<name> missing) with only a generic "could not materialize" warning — the recoverable backup at <dest>.materialize-bak was unmentioned. Emit a CRITICAL warning naming the backup path and the recovery command on that double-failure, and document that the fail-soft catch removes only the scratch `partial`, never the `backup` (which may be the sole recoverable copy). Never-throw / exit-0 contract intact. * fix(publish): make the coverage guard's npm-pack inspection script-safe The prepack guard shelled out to `npm pack --dry-run --ignore-scripts --json`, but the `--ignore-scripts` flag is not reliably honored by npm pack's prepare/prepack lifecycle on the CI npm — so build.js ran, polluted the --json stdout with `[build] …`, and the guard's JSON.parse threw. That broke every `npm pack` (packaged-install-smoke on ubuntu+windows) and failed the guard's own real-repo unit test (the only coverage-job failure). Force script-skipping via the reliable `npm_config_ignore_scripts` env config (also removes the prepack re-entry/recursion risk) and parse defensively from the JSON-array start. * fix(publish): make the coverage guard deterministic — read `files`, not `npm pack` The npm-pack-based guard timed out in CI: `npm pack`'s prepare/prepack lifecycle is not skipped by `--ignore-scripts` (flag or env config) on the CI npm, so the inner pack ran the full build (~20s+) — fine for the slow smoke job, but it blew past vitest's 30s test timeout in the coverage job (and risked re-entering this prepack guard). Replace it with a deterministic, fast (~0.1s) check that needs no subprocess: since `files: ["vendor"]` OVERRIDES `.npmignore` for the vendored subtree (so `.npmignore` can never drop vendored source — verified), the ONLY lever that can exclude source is narrowing the package.json `files` field. The guard now reads `files` directly: a grammar "ships source" iff `files` includes the vendor subtree AND the grammar carries a buildable source set on disk. A lean publish that narrows `files` while a grammar lacks 6/6 prebuilds still fails the gate. * feat(ci): vendored tree-sitter grammar update monitor Adds a weekly (+ dispatchable) workflow that checks each vendored grammar against its source-of-origin (npm for swift/kotlin, the GitHub default branch for dart/proto; c is excluded — held at 0.21.4 for ABI safety) and opens a PR re-vendoring any update that is ABI-COMPATIBLE with the pinned tree-sitter@0.21.1 (LANGUAGE_VERSION 13-14). ABI awareness is the point: most upstreams have moved to ABI 15 (newer tree-sitter), so a blind "bump to latest" would open PRs that can't build. The monitor fetches the candidate source, reads its parser.c LANGUAGE_VERSION, and only re-vendors 13/14 — incompatible updates are reported (notice + job summary), never applied. (Confirmed live: dart/proto upstreams are ABI 15 today and are correctly held; swift/kotlin are current.) The re-vendor refreshes only the source-build inputs + runtime entrypoints, preserving the GitNexus-hardened binding.gyp / README / prebuilds; the version bump then triggers build-tree-sitter-prebuilds.yml, whose ABI-validation is the final safety net so a subtly-wrong re-vendor can't silently ship. PR creation is gated on the RELEASE_APP secret (skips with a notice if absent), mirroring the build aggregate. Unit test locks the ABI gate; the script is import-safe. * feat(ci): monitor tree-sitter-c too (report-only, ABI-pinned) c was excluded from the update monitor, so an upstream c update went unnoticed. Include it, but as report-only via a `hold`: c is ABI-pinned at 0.21.4 (#1242/#858) and must not auto-bump without a tree-sitter runtime upgrade, so an available c update is detected + surfaced (notice + job summary) but never auto-PR'd — even if it were ABI-13/14. `--apply c` refuses defensively. (Live: upstream c is 0.24.1 / ABI 15 today, so c is doubly held — reported, not applied.) * fix(ci): drop the shell in the grammar monitor's github fetch (CodeQL) CodeQL flagged the GitHub-tarball fetch — it used `bash -c "gh api …/tarball/$ref > src.tgz && tar xzf src.tgz"`, interpolating the API-derived ref into a shell command (the shell-command-injection family: "this shell command depends on an uncontrolled file name"). Replace it with a shell-free path: capture `gh api`'s binary tarball as a Buffer via execFileSync, write it to a fixed file, and extract with execFileSync('tar', …). No shell, no injection surface. Verified the dart/proto fetch + ABI read still work. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-09 18:16:24 +01:00