97 commits

Author	SHA1	Message	Date
Gergő Magyar	0261982d9a	fix(analyze): make --memory-budget set the real heap and report rebuild reasons once (#3386) ... * feat(analyze): --memory-budget flag with heap-limit override and worker-pool degradation (#3137) Adds an explicit `--memory-budget <mb>` CLI flag that overrides the RAM/cgroup auto-sized main-thread heap ceiling for the parse phase: - CLI validation (integer >= 200 MB) before bar.start(), matching the --workers pattern - Threaded CLI → runFullAnalysis → PipelineOptions → parse-impl as memoryBudgetBytes - parse-impl resolves the heap limit as budget ?? v8.heap_size_limit, so both the preflight projection warning and the #2649 mid-loop abort probe honor the budget - Graceful degradation: when the projected heap need exceeds the budget at the computed pool size, the pool shrinks (never below 1, never above the operator's --workers) before sub-batch math and pool construction, so all downstream consumers see the degraded size Omitting the flag keeps the auto-sizer path byte-identical. Refs #3137 * feat(analyze): collapse rebuild-gate log into one summary + persist needsFullRebuild verdict (#3137) The nine meta-mismatch rebuild gates (pdg mode, content retention, schema fingerprint, graph-write collapse, analysis features, Spring vendor prefixes, runner identity, FTS CJK mode, embedding dims) each logged individually and set force:true independently. An upgrade that trips several at once printed a scattered wall of near-identical warnings. - Gates now collect into rebuildReasons[]; a single summary block prints them (inline for one, numbered for many) and sets force once. Per-gate Tip text is preserved verbatim inside the entries. - The verdict persists to meta (needsFullRebuild: {reasons, recordedAt}) BEFORE the rebuild starts. If the rebuild is interrupted, the next run announces the recorded reasons up front instead of quietly attempting an incremental write on a half-rebuilt index — the gates may not all re-fire against a wiped DB. - The verdict is cleared on the next successful completion (the final meta does not carry the field forward). Semantics unchanged: every gate was already evaluated (none early-returns), force is idempotent, and a rebuild happens iff at least one reason fired. Refs #3137 * refactor(cli): share one integer flag parser across analyze, watch, and wiki Replace the duplicated Number.isInteger checks for --workers, --embeddings, the positive env-backed analyze flags, the watch interval flags, and wiki's --timeout/--retries with parseIntegerOption (per-flag minimum, optional scale for the safe-integer bound). User-facing messages are unchanged. * fix(analyze): make --memory-budget set the real V8 heap through the respawn The budget now drives ensureHeap's existing respawn instead of a parse-phase override, so the #2649 preflight, mid-loop abort, remedy text, and GC pacing all see one heap limit. The respawn sizes old space plus three semi-spaces to equal the budget, the child resolves as already at the budget (no second respawn), and GITNEXUS_HEAP_LIMIT_SOURCE drives budget-aware OOM advice. Budget validation moves to the preAction hook so analyze and watch reject a bad value before any respawn. Removes the pool-shrink block and the memoryBudgetBytes plumbing through PipelineOptions and run-analyze. * docs(analyze): describe --memory-budget accurately and translate its help The help text claimed graceful worker-pool degradation, which no longer exists; it now says the flag sets the main-thread V8 heap and that parse workers keep their own caps. Wires the option through the help i18n map with en and zh-CN strings, and documents it in both READMEs and the out-of-memory troubleshooting section. * feat(analyze): add a pure rebuild-reason collector One collector per run holds keyed rebuild reasons, merges by key, flattens reasons stored by an interrupted rebuild into one recovery entry, validates stored reasons on read, and formats the single up-front summary plus one follow-up line for reasons added after the pipeline. * fix(analyze): route every forced rebuild through one reason collector Every path that forces a full rebuild (the nine meta gates, --force, --skills, --no-parse-cache, --drop-embeddings, --repair-fts retention, Spring Actuator, AsyncAPI, shared-store graph gaps, dirty-flag recovery, the post-pipeline capability gate, and the #2409 escalation) now adds a keyed reason to one collector. The rebuild decision is applied from the collector at fixed checkpoints, one summary prints right before the pipeline, and late reasons print one follow-up line. The escalation stays non-forcing. runFullAnalysis returns the collected keys, which replaces the runner-identity source-regex test with a behavior test. Removes the separate needsFullRebuild field and its announcement, and stops folding --skills and --no-parse-cache into --force. * fix(analyze): persist rebuild reasons on the existing crash marker Every incrementalInProgress writer (the full-rebuild stamp before the wipe, the incremental pre-write, saveIncrementalDirtyState including the #2409 escalation, and buildFtsDirtyStamp) now carries the collected reasons into the active slot's metaDir, so an interrupted rebuild explains itself on the next run through one merged recovery entry. A successful run still clears the marker and its reasons; the FTS-park recovery clears them without forcing. * test(analyze): cover every rebuild-reason key through runFullAnalysis Add a coverage table that the typechecker keeps complete: every RebuildReasonKey maps to a test file that drives it through runFullAnalysis and asserts the returned key. Adds the missing graph-write-collapse and drop-embeddings drivers, asserts the key in the existing pdg-mode, spring-vendor-prefixes, cjk-segmentation, and embedding-dims tests, and removes plan-local IDs from test names and comments. * fix(review): apply review findings - A --max-old-space-size pin equal to --memory-budget no longer counts as the exact budget heap (V8 adds the young generation on top); only the budget-respawned child skips the respawn, so the limit really equals the budget. - Snapshot the analyze env before ensureHeap and restore GITNEXUS_HEAP_LIMIT_SOURCE, so a kept process does not leak its heap source into a later programmatic analyzeCommand call. - --skills and --no-parse-cache keep the forced storage requirements they had before force stopped being folded from them. - Merge the duplicated follow-up announcement into one helper and fix a stale --drop-embeddings comment. - The rebuild-reason coverage table no longer greps driver files for the key string; add tests for a programmatic invalid budget and the multi-cause interrupted-rebuild text. * fix(review): don't announce the escalated write as a full rebuild The #2409 escalation is a non-forcing reason, but its follow-up line used the 'Full rebuild also required' lead. A follow-up that carries only non-forcing reasons now leads with 'Write plan changed'. * docs(analyze): document GITNEXUS_HEAP_LIMIT_SOURCE in the env table CONTRIBUTING requires every new GITNEXUS_* variable to have a row; this one is internal (set by analyze itself) and exists so OOM advice points at --memory-budget. * fix(review): address GitNexus review threads on #3386 - heapPressureRemedy measures pressure against the real auto-sized cap (heapCapMbFor) instead of a flat 0.75 x RAM, and no longer tells a GITNEXUS_MEMORY=off run with no pin to drop a pin that does not exist. - toStored() persists the interrupted rebuild's reasons first, as documented. - ensureHeap's doc names which paths leave GITNEXUS_HEAP_LIMIT_SOURCE unset. - The heap-respawn suite restores the caller's GITNEXUS_MEMORY. - The non-forcing follow-up test rejects any 'full rebuild' wording. * fix(review): require both budget flags and check key coverage at runtime - A budget-respawned child is recognized only when the inherited heap-source marker comes with both the budget's old-space and semi-space flags; the marker alone is an inherited env var, not proof. The old-space parser is generalized to any V8 size flag instead of copying its regex. - REBUILD_REASON_KEYS is exported and RebuildReasonKey derives from it, so the coverage table is checked at runtime (CI does not type-check test files). * fix(review): don't claim a full rebuild in a non-forcing summary formatSummary and formatFollowUp now share one leadFor helper, so a block of only non-forcing reasons reads 'Write plan changed' in both. --------- Co-authored-by: ChunxueLi <mecoloud@users.noreply.gitee.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>	2026-09-26 18:14:36 +01:00
Gergő Magyar	6bb99767ff	fix(auto-sync): HTTPS remotes, OpenSSH image, and rc embeddings (#3378) ... * fix(docker): install OpenSSH in the CLI runtime image Auto-sync requires git SSH remotes, but the published image omitted openssh-client so every clone failed with ssh: not found. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): accept HTTPS remotes and reclone failed checkouts Allowlisted HTTPS URLs can clone without SSH keys, and a timed-out clone with no remote.origin is quarantined instead of blocking forever. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): honor .gitnexusrc embeddings and warn on empty vectors Auto-sync analyze now reads embeddings from the clone's project config, and query reports when an index has no vectors so keyword fallback is visible. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): warn when CodeEmbedding table is missing (U5) Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): wrap long openssh-client test line for prettier Co-authored-by: Cursor <cursoragent@cursor.com> * fix(query): keep keyword-only indexes off query.warning Empty or missing CodeEmbedding is the default index. Put the #3372 notice in a once-per-backend log line so FTS-success query results stay warning-free. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): bound rc reads and quarantine only a missing origin Drop the implementation plan from the branch. Auto-sync reads .gitnexusrc through the bounded control-file reader, and a git config failure no longer relocates a live checkout. The same allowlisted repo can switch between SSH and HTTPS without a refused pull. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(auto-sync): share repo identity and skip a second origin read Co-authored-by: Cursor <cursoragent@cursor.com> * test(auto-sync): clean temp fixtures and cover nested embeddings precedence Co-authored-by: Cursor <cursoragent@cursor.com> * test(auto-sync): skip the symlink rc fixture on Windows Co-authored-by: Cursor <cursoragent@cursor.com> * test(auto-sync): reject symlink rc files on every platform Co-authored-by: Cursor <cursoragent@cursor.com> * test(ci): run auto-sync symlink and clone tests on Windows and macOS Co-authored-by: Cursor <cursoragent@cursor.com> * test(git-clone): keep Windows CI on file URLs and POSIX permission checks Co-authored-by: Cursor <cursoragent@cursor.com> * test(git-clone): keep the SSH-to-HTTPS origin check offline Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-25 19:42:26 +01:00
Joseph Yared	b92c14cdd0	feat: add Factory AI (Droid) integration (#2543) ... * feat(setup): add Factory Droid (MCP + skills) to gitnexus setup Register 'droid' in the editor-targets abstraction so `gitnexus setup -c droid` writes the MCP server to ~/.factory/mcp.json and installs skills to ~/.factory/skills/ from the single canonical skills/ source (no per-editor copies). uninstall.ts is target-driven, so removal is covered automatically. Adds unit + round-trip coverage. * feat(plugin): add gitnexus-factory-plugin for droid plugin install * docs: add Factory Droid to editor support table and setup docs * fix(factory-plugin): guard augment hook against fan-out and DB contention Reuse the Claude adapter's acquireHookSlot and LadybugDB owner probe (bundled byte-identical, kept in lockstep by a drift test) instead of running an unguarded augment. Add direct tests for the hook and manifests. * docs: align Factory row in editor support table * fix(factory-plugin): honor GITNEXUS_HOOK_CLI_PATH so augment runs on Windows * docs(hooks): point bundled guard copies at their drift tests * docs(factory-plugin): note the Execute tokenizer's quoting limit * docs(readme): clarify the Full tier and group the Factory row * docs(hooks): trim drift note to a single line * test(ci): run factory-plugin tests on the windows cross-platform lane * refactor(hooks): drop the drift-note comments, the tests already enforce it * fix(factory-plugin): pin CLI version and parse quoted shell patterns - Pin mcp.json and the hook's npx fallback to gitnexus@<version> from the plugin manifest, registered with the release sync script so a mutable @latest can never execute on MCP connect or augment fallback - Port the #2938 shell tokenizer (tokenizeShellWords + parseRgGrepPattern) so quoted, backslash-escaped, --regexp=, -eVALUE, and -- patterns survive - Add the #2938 regression matrix and pin assertions to factory-plugin.test.ts * docs: add Factory Droid to published npm README * fix(factory-plugin): wire marketplace so droid installs the Factory plugin Add .factory-plugin/marketplace.json sourcing ./gitnexus-factory-plugin. Droid reads it before .claude-plugin/marketplace.json, so `droid plugin install` now delivers the Factory plugin (Execute matcher, pinned mcp.json) instead of the translated Claude plugin (Bash matcher, gitnexus@latest). Register the surface in the version-sync script and cover the wiring in the factory and sync test suites. * fix(factory-plugin): use registry lookup for index resolution Bundle registry-query.cjs so external indexes resolve (#3060); re-pin to 1.6.12. * fix(factory-plugin): sync Execute parser with Cursor hook Fixes echo-rg and -f false positives; tighten test env isolation. * fix(factory-plugin): stop no-match augment from re-running via npx A PATH `gitnexus` that finds no match exits 0 with empty stderr, which fell through to a second `npx -y gitnexus@<pin> augment` with its own 8s timeout (16s worst case vs the 10s hook budget). Fall through to npx only when the PATH launcher is missing (ENOENT); any launched PATH binary, including a timeout or non-zero exit, now ends the augment. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(factory-plugin): filter augment stderr to the [GitNexus] block runAugment returned raw child stderr, so npm/Node/LadybugDB warnings leaked into additionalContext and noise-only stderr counted as success. Port the Claude adapter's extractAugmentContext (verbatim, with isDebugEnabled) and apply it on every launch tier before the success decision. Adds a drift test against the Claude copy and PATH-tier noise/noise-only behavior tests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(factory-plugin): quote DROID_PLUGIN_ROOT in hook command An unquoted plugin root containing spaces (e.g. a Windows user profile path) split into multiple argv words, so the PostToolUse hook silently never ran. Quote it like the Claude plugin does, and pin the exact quoted command in the hooks.json wiring test. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(release): stage Factory plugin manifests in the release commit The rc release job stages only the original four manifest surfaces in the detached release commit, so the v<version> tag tree carried the Factory plugin.json, mcp.json and marketplace.json at the previous version while --check (working tree) passed. Stage them too, and guard the git add block against the synced surfaces in sync-plugin-manifests.test.ts. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor(factory-plugin): simplify hook gates, spawn tiers and tests - main(): resolve the repo only after the tool-name and pattern gates, matching the Claude/Cursor hook order (skips fs/git work on no-op calls). - runAugment(): share one spawnAugment helper between the GITNEXUS_HOOK_CLI_PATH and npx tiers; PATH tier ENOENT logic unchanged. - factory-plugin test: pre-filter comment lines instead of `continue`. - sync-plugin-manifests test: hoist EXECUTABLE_MCP_FILES and derive TOTAL_SURFACES from its length. - fnSource(): throw when the function or its closing brace is not found. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(cli): list Factory Droid in localized setup help `localizeCliHelp` overwrites the `setup` command description with the `help.command.setup.description` i18n key, so the literal edited in index.ts never reached `gitnexus setup --help`. Add Factory Droid to the en and zh-CN keys. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#2543) - factory hook: run every augment tier under the bundled Unix timeout guard (npx tier group-kills), keeping exactly-one-tier fall-through - hook-db-lock-probe: trim GITNEXUS_HOOK_{LSOF,PS}_PATH once so a padded override is used, not silently replaced (all 3 copies) - hook-lock: evict a stale slot via rename-to-tombstone + identity check, so a concurrently recreated fresh lock is never deleted (all 4 copies) - registry-query: a set-but-invalid storage override resolves no repo instead of falling back to the registry storagePath (all 4 copies) - publish.yml: stage the ten skill mcp.json manifests in the rc release commit; the staging test now requires every synced surface Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback round 2 (#2543) - hook-lock: replace rename-to-tombstone eviction with an O_EXCL per-slot `.evicting` marker plus an identity re-check before unlink, so a live lock is never moved, and a crashed evictor leaves only a self-expiring marker (all 4 copies) - hook-db-lock-probe: clamp GITNEXUS_HOOK_PROC_CMDLINE_MAX to a named 256 KiB ceiling and require an integer, so an oversized override can no longer fail the buffer allocation and miss a live owner (all 3 copies) - registry-query: treat an empty GITNEXUS_STORAGE_PATH/ROOT as set but invalid, matching the CLI's `!== undefined` rule (all 4 copies); the factory test env now deletes those keys instead of blanking them Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback round 3 (#2543) - hook-db-lock-probe: a capped /proc cmdline read stops early only once both the GitNexus token and the mcp/serve mode are present (or at EOF, the ceiling, or the budget), so a mode word such as `--require mcp` before the GitNexus path no longer hides a live owner (all 3 copies) - registry-query: correct the override comment; a filesystem root is invalid only for GITNEXUS_STORAGE_PATH, not GITNEXUS_STORAGE_ROOT (all 4 copies, comment only) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback round 4 (#2543) - hook-db-lock-probe: an fd-directory read error other than ENOENT or ENOTDIR on an identified server candidate now fails closed ('timeout') instead of reporting not-owned (EMFILE/ENFILE/ENOMEM/EINTR) - hook-db-lock-probe: resolve GITNEXUS_HOOK_TIMEOUT_PATH to an absolute path before validating and caching it, so callers that spawn with a request cwd can still execute the guard - hook-db-lock-probe: document the chunked cmdline read's actual stop conditions (all 3 copies) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Harden hook-lock eviction marker lifecycle (#2543) Per the chosen option (B) for the stale-slot eviction race: - `.evicting` markers carry a per-call owner token (pid + random hex) - an evictor re-reads its token immediately before the slot identity check and unlink; a stalled evictor whose marker was broken backs off - `finally` removes the marker only while it still holds our token - an orphaned marker is broken only if, re-checked just before unlink, its bigint identity and token are unchanged from when judged stale - doc comment states the two remaining two-syscall windows (slot lstat->unlink, marker token->unlink); POSIX has no conditional unlink, and the worst case is one extra concurrent augment All four byte-identical hook-lock copies updated. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Fix CodeQL file-system race in hook-lock orphan-marker check (#2543) breakOrphanedMarker stat'd the marker by path and then read it by path, which CodeQL flags (js/file-system-race): the file could be replaced between the two calls. Take the stat and the token from one open descriptor (readMarkerSnapshot, O_NOFOLLOW where available) for both the "judged stale" snapshot and the pre-unlink re-check. All four hook-lock copies updated. The replaced-marker test injected its swap via a readFileSync(path) spy, which no longer fires; it now swaps the marker just before its second open, counting opens of the marker path only (a per-path counter fired early on slot-0 and let a mutant pass). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Unregister hook-lock exit listener on release (#2543) Each acquireHookSlot registered `release` as a process 'exit' listener that was never removed, so a long-lived process acquiring and releasing slots repeatedly would accumulate listeners (MaxListenersExceededWarning) and retain every closure. release() now removes itself. All four hook-lock copies updated; a test asserts 12 acquire/release cycles leave the 'exit' listener count unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-24 19:12:40 +01:00
Adam B.	7376347058	feat(ingestion): add tRPC procedure detection and MCP chain/route surfacing (#3339) ... * feat(ingestion): tRPC pattern detection — procedures, curried calls, route extraction Three changes to properly index tRPC router files: 1. HOC-in-pair patterns: detect procedures like 'create: procedure.mutation(async ({ input }) => {...})' as named Function nodes (pair > call_expression > arguments > arrow_function) 2. Curried call detection: capture 'workflow(db)(input)' chained calls where call_expression.function is itself a call_expression 3. tRPC route extraction: new route-extractors/trpc.ts detects .query()/.mutation()/.subscription() procedures, maps to /trpc/* routes with prefix inference from router variable names 4. Function/Const dedup: structural check skips Const nodes when variable_declarator value is arrow_function/function_expression 5. Process-route linking: match by (filePath, methodName) instead of filePath only, preventing shared flows across procedures in same router (cherry picked from commit eced15e60a39a181a48bff8c5bbe278d26aa53b8) * fix(route-extractors): line-by-line scanner for chained tRPC procedures Original regex only matched direct patterns (list: proc.query()) but not chained patterns (create: proc.input(z.object({...})).mutation()). Only 41/256 routes were detected on Jurialis. Rewrote extractTrpcRoutes() as a line-by-line scanner that: - Detects procedure keys starting with *Procedure builders - Tracks currentProcedure forward until terminal .query()/.mutation() - Handles .input() chaining naturally - Deduplicates via seen Set on procedurePath Result: 245 routes from 30 routers (was 41), 256 total after re-index. (cherry picked from commit 49edf953e93e6b67b77932e866fcbfb8d089b1f3) * feat(mcp): expose tRPC chains via context/query tools Eight fixes to make the tRPC route->procedure->workflow->sub-workflow chain visible through the standard MCP tools (context, query) that AI agents use, instead of requiring raw Cypher queries. - A context: order incoming/outgoing CALLS test-last, raise LIMIT 30->100 - B query: batched ENTRY_POINT_OF lookup, surface route URL on processes - C query: mark process_symbols entry point with is_entry_point=true - D entry-point-scoring: skip UTILITY_PATTERNS (get*/set*) penalty for symbols in tRPC router files so framework boost (3.0x) is preserved - E fts-schema: index Route nodes so /trpc/* URLs are keyword-searchable - F tools: bump max_symbols default 10->25 to fit procedure->workflow chain - G context: optional chain_depth (0-3) param walks CALLS edges in both directions and returns layered chain field - H LadybugDB bug workaround: WHERE r.type IN [...] silently drops edges on relationship properties; replace with OR chains (7 occurrences in local-backend.ts, pdg-impact.ts, graph-queries.ts) Validated on Jurialis: setProviderCap procedure now appears as caller of setProviderCapWorkflow, /trpc/cabinet.setProviderCap Route is searchable, chain_depth=3 returns the layered call graph. (cherry picked from commit c24df0adce91e80f191a5c5d2e8b14e9da677366) * feat(mcp): surface is_entry_point + routes in context, raise query limit context() is the mandatory pre-edit tool (AGENTS.md). Until now an agent had to issue a separate query() call just to learn whether its symbol is a process entry point or which HTTP route it handles. These two fields make context() self-sufficient for the bmad-dev flow. - context: query STEP_IN_PROCESS now returns p.entryPointId; new ENTRY_POINT_OF lookup attributes routes only from processes where the symbol is the entry point (middle steps do not own the route) plus any direct Route->symbol handler edge (tRPC procedures outside any Process) - context: new top-level is_entry_point (true only) and routes[] fields ({url, method?}), emitted only when non-empty to keep the diff additive - query: raise default limit 5->10 so dense domains (tRPC action router with 20 chains, data-export with 9 flows) surface more of their flow set without an explicit param (cherry picked from commit 004f5b0ba985fcef3dfac5e67a2f2f7262184215) * docs(mcp): document chain_depth, routes, and entry-point flag; neutralize examples in comments * fix(mcp): address code-review findings on tRPC entry points, queries, and dispatch - entry-point scoring: optional-chain framework detection and normalize path separators before router-pattern matching (P1 crash on .js routers) - tRPC extractor: emit controllerName as null (callers resolve via lookupClassByName; a router object stringified as name corrupted lookups) - route dedup: key seenRoutes by method:url so GET/POST pairs survive - legacy TS queries: drop curried-call patterns (arity-corrupting for overload resolution) and require non-array callee on pair member calls - registry-primary TS query: mirror the non-array-callee predicate on the new pair member-expression patterns (fixes query compile error) - group tool port: forward chain_depth into per-tool context args * fix(mcp): nested tRPC router paths, controller-less route binding, query chain_depth - trpc extractor: brace-depth nesting stack composes sibling router paths (bare router() import style included); merge-prefix dot normalization; strict publicProcedure allowlist gate; drop phantom router metadata - call-processor: bind controller-less tRPC routes to same-file handlers via exact single-match symbol lookup; ambiguous or missing handlers skipped - query/group query: optional chain_depth (0-3) enriches ranked processes with their context chain; fix _computeContextChain layer docstring - tree-sitter TS/JS scope queries capture string-key function declarations; tRPC pattern scoring narrowed to server router files - parse-cache schema bump to v103 for extractor and route-binding changes - add trpc route extractor regression tests (9 cases incl. sibling nesting and merge prefix) * Address PR review feedback (#3339) Close remaining review threads: compact tRPC keys, comment-safe terminals, quoted-key identifier HOC captures, group-query default alignment, and LadybugDB label scalars on context chains. * chore(autofix): apply prettier + eslint fixes via /autofix command * test: pin PARSE_CACHE schema bump to 103 (PR #3339 review fixes) * fix(ingestion): bind same-name tRPC handlers and surface HANDLES_ROUTE Same-name procedures resolve by startLine, the extractor keeps nested paths through multiline schemas, and context/query UNION HANDLES_ROUTE for leaf procedures that never become Process entries. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Clamp group query bounds, drop HOC pair false positives, emit tRPC terminal lines and hyphenated quoted keys, cap chain BFS concurrency, and restrict the router utility exemption to accessor names. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Score JS/JSX tRPC routers like TypeScript, ignore inner db.query and unrelated .merge calls, mask regex braces, and assert clamp tests invoke the query mock. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(ingestion,mcp): emit-side HOC callback guards + MCP schema prettier (PR #3339 round 2) * Address PR review feedback (#3339) Treat `/` after return-style keywords as a regex, drop the synthetic appRouter path prefix, and bind the create mutation via an inline callback. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Qualify query() docs so is_entry_point is promised only when the entry symbol is among the search hits. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Emit tRPC terminals only at procedure paren depth, drop the filename prefix on bare appRouter = router(), mask regex after if (), and cap groupQuery member fan-out. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) De-duplicate context-chain BFS nodes reached through multiple frontier edges, and bind tRPC identifier callbacks (`.mutation(handler)`) to the handler symbol instead of the procedure key. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Apply LIMIT 50 after DISTINCT neighbors in the context-chain BFS, and treat the official lowercase `procedure` builder as a tRPC procedure key. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Keep the later duplicate tRPC object-literal key so route binding matches the handler JavaScript actually ships. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Compose same-file identifier-mounted tRPC subrouters so admin: adminRouter emits the live admin.list path instead of an unprefixed /trpc/list. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Memoize tRPC identifier-mount paths so a depth-N chain stays linear, and gate it with the build-free measure.mjs / baselines.json harness. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Compose identifier mounts without phantom /trpc URLs, bind wrapped and multiline handlers, fail-close missing bench budgets, and reject query page bounds before search. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Reject advertised MCP query bounds in group mode and chain_depth instead of clamping or accepting non-integers. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Reject invalid groupContext chain_depth and ignore non-callable same-file tRPC handler candidates. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Memoize live tRPC mount paths so the depth-N chain bench stays linear, and render invalid group/MCP bounds without throwing. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Keep t.merge('prefix.', namedRouter) procedures live by recording a zero-hop mount so the unmounted-router drop does not hide them. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Recognize type-annotated `const adminRouter: AppRouter = t.router(` bindings so identifier mounts still compose. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-21 09:44:42 +01:00
Gergő Magyar	ba39d5c009	feat(analyze): expose process-detection budget overrides (#3324) ... * feat(analyze): expose process-detection budget overrides (#3313) Operators can raise or lower process count, branching, trace depth, and the entry-point candidate pool via CLI, .gitnexusrc, or GITNEXUS_* without changing shipped defaults. A budget-only change re-detects flows on the next analyze without --force. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): say invalid budget flags still honor env A rejected --max-processes value was described as falling back to the built-in default even when GITNEXUS_MAX_* still won the next precedence tier. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(analyze): share process-detection defaults and skip unused walks Keep DEFAULT_CONFIG aligned with the budget resolver and count symbols only when maxProcesses is still dynamic. Co-authored-by: Cursor <cursoragent@cursor.com> * style(analyze): wrap process-detection budget files for prettier Co-authored-by: Cursor <cursoragent@cursor.com> * docs(analyze): name the real process-detection default formula Co-authored-by: Cursor <cursoragent@cursor.com> * docs(analyze): stop calling maxProcesses*2 a hard trace quota Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): say invalid env budget tokens fall back to defaults Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): recertify process-detection after in-place FTS abort (#3324) Persist processDetection.uncertified on the in-place FTS dirty stamp when the budget mismatched so a flagless retry cannot keep rewritten flows. Qualify .gitnexusrc fail-fast copy and tighten related tests. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): skip live dirty stamp on atomic incremental (#3324) POSIX atomic incremental mutates a staging copy, so stamping live incrementalInProgress before swap made a crash force-rebuild a healthy index. Align analyze --help with CLI > .gitnexusrc > env > default. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(changelog): drop the atomic-incremental dirty-stamp note The code fix stays; Unreleased no longer lists that recovery change. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): survive FTS SIGSEGV in --limit e2e CREATE_FTS_INDEX can kill the setup analyze on some WSL hosts (status null). Rebuild with --skip-fts and skip BM25-only query --limit cases unless GITNEXUS_REQUIRE_FTS=1. Refs #3324 Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): mark update-check child at import Writing refresh-started from fetch() raced a 30s poll against cold tsx boot on a loaded default-project worker. Refs #3324 Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3324) Isolate default-budget FTS crash-marker tests from GITNEXUS_MAX_* env, assert uncertify-before-FTS order and deferred flow detection on park recovery, drop the dangling "then" from entry-point help, and correct stale streamGraphEmit docs without skipping the process-detection stamp. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(changelog): drop Unreleased process-detection notes Keep the #3313 / #3322 code; Unreleased changelog matches main until release. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-18 13:37:15 +01:00
Matt	8b21ce3b95	feat(auto-sync): preserve PDG indexes across updates (#3290) ... * feat(auto-sync): preserve PDG indexes across updates * docs(auto-sync): document durable PDG synchronization * Address PR review feedback (#3290) - Correct requestedPdg state docs for threshold-skipped syncs - Defer coalesced follow-up and skip failure-threshold counts for leftover-worker / retryable lock waits - Document the pdg tri-state and caveat the 30m/5m example Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): raise Windows Ladybug #605 hang budget off the CI tail Windows 3/3 typically finishes this native race in ~15s but has a 56s tail; 60s false-positives as deadlock. Keep the POSIX 60s detector and the completion/.shadow/row-count contract. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-16 20:12:45 +01:00
Abhinav Pandey	0ede6ae501	fix(rust): respect Cargo target boundaries in name fallback (#3294) ... * fix(rust): respect Cargo target boundaries in name fallback * fix(rust): read Cargo sources through validated file descriptors * fix(rust): require matching imports for crate-root guesses * fix(rust): require Cargo root identity for cross-target imports * fix(rust): enforce Cargo identity across fallback imports * fix(rust): keep Cargo membership on typical derive/macros (#3294) Abort only genuine unknown expansion, ignore Cargo artifact layouts instead of every `target` path segment, and require a covering import for unanswered crate-root name fallback so #3253 still holds on ordinary Rust sources. Co-authored-by: Cursor <cursoragent@cursor.com> * test(rust): gate Cargo target membership in CI (#3253) Add a parse-dispatch-rounds-style bench so derive/macro abort, target-path globs, and superlinear membership walks fail in CI instead of staying graph-invisible. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(rust): verify Cargo macro and re-export evidence * style(bench): format Cargo membership benchmark * fix(rust): require imports for cross-file root guesses --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-16 11:36:07 +01:00
Gergő Magyar	ac9a4e9abd	fix(embeddings): keep ONNX off the install and analyze critical path (#3287) ... * fix(embeddings): isolate local ONNX inference in a child_process sidecar The analyze parent must not load onnxruntime-node. Fork a sidecar for vectors only and reap it on worker exit; keep Ladybug writes in-process. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(embeddings): share the sidecar client across MCP, serve, and sync Query hosts now use the core façade instead of a second in-process ONNX embedder. Search skips an empty table, sync reaps beside closeLbug, and ready means the stack is resolvable rather than a warm singleton. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(embeddings): refuse Intel Mac and unloadable prefix before npm heal Analyze, sync, install, and the sidecar client now consult the platform blocker before forking or downloading the optional stack. HTTP stays the escape hatch; wasm is not treated as a rescue. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(embeddings): take the ONNX stack off default npm install Pins live in gitnexusEmbeddingStack. embeddings install writes prefix overrides before npm spawn. Leftover 1.6.12 package-first trees are residual. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(publish): drop grammar source from the published tarball Every vendored grammar has 6/6 prebuilds, so files ships those plus Leiden and FTS instead of parser.c. First ship stays above 80 MiB. Co-authored-by: Cursor <cursoragent@cursor.com> * test(embeddings): match MCP missing-stack warn to the R20 copy Default install no longer calls the stack optional, so the once-per-backend stderr assertion must look for the new lead line. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): bound sidecar death, cancel writes, and publish-file guards Init-time native crashes no longer respawn a child on every query. Local embedBatch honors AbortSignal after sidecar return, MCP query() surfaces vector-lane degradation, disconnect always reaps, and the grammar prepack guard checks files globs instead of on-disk prebuilds. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(embeddings): share runtime preflight and sidecar reap helpers Analyze and embeddings-sync used the same blocker/prefix/install gate with different error routing. One assessment keeps those paths aligned without changing CLI vs thrown-error behavior. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3287) Keep a reaped sidecar from resetting its replacement, wait for dispose, tighten the publish-files guard, and stop assuming a leftover ONNX tree in CI. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Clear the sidecar reap timeout, add init IPC slack, and isolate embeddings-sync tests from HTTP-mode env. Co-authored-by: Cursor <cursoragent@cursor.com> * test(embeddings): unstub globals after sidecar HTTP-mode tests Keep a leaked fetch stub from failing assertions out of later tests in the same file. Co-authored-by: Cursor <cursoragent@cursor.com> * test(embeddings): pin sidecar success cases off darwin/x64 The runtime blocker reads the real process platform before the fork mock, so local-success tests must not inherit an Intel Mac host. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Keep vector degradation per query, treat leftover Intel-Mac stacks as not ready, and document that the CLI image no longer ships ONNX. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify embedding sidecar shutdown and search hot paths Drop redundant sidecar reaps and unused child helpers, and run FTS alongside semantic search. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Share HF attempt parsing with the sidecar init deadline, abort embed waits without killing the child, and restore last init options on recreate. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Treat sub-1 HF attempt env values as invalid, and drop leaked sidecar waiters when IPC send throws. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Keep sidecar init on a shared chain; each waiter can abort only its own wait. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): declare embedding-table existence probe as unordered LIMIT The empty-table skip in semanticSearch is existence-only; declare it so the #2787 determinism guard stops failing coverage shard 3/3. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-15 12:11:47 +01:00
Gergő Magyar	21a52af1d4	fix(lbug): ship FTS per-platform and recover in-place native aborts (#3274) ... * fix(lbug): pin Ladybug core so Dependabot cannot ship a skewed FTS artifact The extension version is a separate upstream constant. Ignore daily core bumps and fail the pairing gate when the committed manifest does not name the installed core. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): make doctor and CI FTS gates resolve the packaged artifact Doctor and the REQUIRE_FTS file gates still treated an empty ~/.lbdb as unavailable, which would turn three CI jobs red once analyze stops installing into that tree. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): name native-abort and tuple-missing so analyze cannot mis-advise The CLI summary's trailing else treated every unknown skip reason as a missing extension. New crash and platform causes must get their own remedies, not a network-install hint. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): delete the dead read-path FTS index create ensureFTSIndex had no production callers and swallowed read-only CREATE_FTS_INDEX failures, which hid the only signal that a reader tried to write. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): vendor per-platform FTS artifacts so analyze needs no host install Keyword search depended on a CDN fetch into ~/.lbdb. Shipping the five published tuples inside the package makes air-gapped and ignore-scripts installs load the same artifact the publish gate checksums. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): load the packaged FTS artifact before any network install Analyze still required a CDN fetch into ~/.lbdb even when the package already shipped the file. FTS now path-loads the vendored tuple first and records source labels so a later truncated home copy cannot steal the diagnosis. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): diagnose a core/extension version skew instead of a missing runtime A structurally valid FTS artifact whose path version disagrees with the packaged pin must name both versions, not prescribe VC++ or OpenSSL. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): stamp an FTS phase so repair stays usable after an in-place abort A native CREATE_FTS_INDEX abort leaves no skip reason; the next run infers it from the dirty flag, and --repair-fts must not treat that phase as a half-written graph. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): park an in-place FTS crash WAL without wiping the graph An FTS abort after a successful checkpoint must reopen the live index on macOS, Windows, and Linux. Staging never parks the live WAL; readers keep today's large-WAL refusal. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): refuse read-only opens of an FTS-poisoned WAL MCP and serve cannot repair a leftover in-place abort. Fail before the native open and name --repair-fts, on macOS, Windows, and Linux. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): name a vendor-neutral Windows OpenSSL prerequisite OQ1 is unanswered here so GitNexus does not ship OpenSSL DLLs. Windows FTS now asks for a system OpenSSL 3 runtime instead of Git Bash PATH. Co-authored-by: Cursor <cursoragent@cursor.com> * test(lbug): inject the FTS vendor root and redact it on HTTP and MCP Path-loaded artifacts no longer vary with HOME. Tests pass an injected vendor tree and assert search warnings never leak a filesystem path. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(lbug): document load-only as the global FTS install default Analyze still overrides to auto. Packaged per-platform artifacts load before any network install on macOS, Windows, and Linux. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(lbug): format the FTS install-policy README table Prettier does not run on Markdown in pre-commit, so the U10 table wrap needs its own formatting commit. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): skip FTS CREATE after a persisted native abort A recovered analyze run was retrying CREATE_FTS_INDEX from skipReason alone. Keep that skip until --repair-fts, fail closed on unsupported tuples, and honor the checkpoint warrant for park/repair. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): honor checkpoint flushed warrant and align FTS tests with packaged vendor A no-op CHECKPOINT must not satisfy the FTS park warrant, and CI still asserted HOME-only FTS isolation after analyze started path-LOADing the packaged artifact. Co-authored-by: Cursor <cursoragent@cursor.com> * test(lbug): accept a nonempty incremental write set in the #2790 recovery check FTS-phase recovery can incremental-add files (changed=0, added=1). That is not the #2790 empty-diff wipe skip. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): compare FTS home versions to the core pin and tighten the publish filename gate Ladybug's ~/.lbdb/extension directory is the runtime/core version; treating it as the artifact version false-diagnosed skew. The publish guard now rejects a path-escaping filename the same way the fetch script does. Co-authored-by: Cursor <cursoragent@cursor.com> * test(lbug): seed FTS e2e fixtures from the packaged vendor artifact A machine with no ~/.lbdb copy should still run the vendor-survivorship cases; the seed no longer depends on HOME or a network install. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3274) Keep in-place FTS abort evidence after persist so a second CREATE abort cannot fail-open readers, and close the CLI, loader, embed, and e2e gaps the review called out. Note: full npm test hit Ladybug worker-pool startup failures under memory pressure; tsc and 180 targeted unit tests passed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3274) Run the vendored-path symlink guard on the OS matrix, put e2e HOME fixtures on Ladybug's real extension layout, pin the embed crash-WAL gate before the writable open, and let analyze writers park through missing-shadow recovery. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): keep --repair-fts CI green after vendored-first FTS Never-installed warning fixtures must not inspect a packaged vendor binary, and a failed dirty restamp must not abort an otherwise successful --repair-fts run. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): give the #1169 analyze e2e the same 90s Windows budget as its sibling The first #1169 persist-meta case was still on a 60s spawn/it budget and was killed banner-only on windows-latest after the FTS warning fixture no longer failed the shard first. Co-authored-by: Cursor <cursoragent@cursor.com> * test(ci): reweight Windows shards after the FTS e2e grew Vendored-first HOME fixtures pushed fts-extension-e2e to ~6 minutes on windows-latest, so the old 146s weight packed it with skills-e2e and blew the 20-minute watchdog. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-14 08:52:24 +01:00
mengkaka	79543c8f83	feat(storage): add configurable index storage and content retention tiers (#3060) ... * feat(storage): add configurable index storage and content retention tiers Rebase #3060 onto current origin/main. Keep GITNEXUS_STORAGE_PATH, GITNEXUS_STORAGE_ROOT, and GITNEXUS_CONTENT_RETENTION, and fold in main's FTS skip, embed-session, and help-text updates. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Keep legacy registry rows on the local storage fallback, resolve symlinks before the destructive-path guard, and align hook lookup with CLI branch slugs, branch-slot metadata, and longest-path match. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Only list swept upload directories after a successful removal so callers cannot treat a permission or transient rm failure as gone. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Document that getStoragePath may consult registered storage while this module still does not mutate the global registry. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(storage): close review findings for external indexes and retention Re-inspect ownership under the analyze lock, fail-closed when the registry file is missing, and keep skip-git hook discovery plus retention fields on HTTP/MCP list surfaces. /api/file stays 410 unless contentRetention is full. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3060) Treat lock-only index dirs as empty, honor HTTP --force storage policy, and prefer registered plus branch-aware slots in hooks and augment. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Keep hook fallbacks inside the current worktree, compare foreign-local slots canonically, and make storage fixtures survive ownership validation. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix macOS hook test expecting realpath'd registry paths. resolveHookRepo returns the written registry path, not a filesystem realpath, so the assertion must match that. * Address gitnexus-check warnings on hook install docs and slot tests. The Cursor troubleshooting list omitted registry-query.cjs, and the writable-slot test only checked that isDirectory exists instead of that the path is a directory. * Align the HTTP catalog source-scan with skippable resolveRepo validation. resolveRepo lists fresh repos with validate: options.validateStorage !== false so DELETE can skip prune; the test still required a literal validate: true. * Harden storage path sinks so CodeQL path-injection and ReDoS alerts clear. Contain every filesystem probe inside the resolved storage slot with the inline path.relative idiom, reject filesystem-root slots, and trim slot basenames in linear time. * Settle bridge stamps before writing so CI size/mtime matches stay stable. LadybugDB can still flush into bridge.lbug after close+rename; persist whole-millisecond mtimes and wait for consecutive stats to agree so a freshly written pair matches. * Type the settled bridge stat as fs.Stats so tsc does not see bigint. Awaited<ReturnType<typeof fsp.stat>> collapsed the bigint overload and broke prepare/typecheck on CI. * Keep the bridge mtime stamp exact so same-size swaps still fail the pair check. Co-authored-by: Cursor <cursoragent@cursor.com> * Wrap the bridge stamp predicate so prettier --check stays green. Co-authored-by: Cursor <cursoragent@cursor.com> * Require a quiet interval before stamping a settled bridge file. Co-authored-by: Cursor <cursoragent@cursor.com> * Reuse shared storage and settle helpers instead of local copies. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-12 20:31:55 +00:00
Gergő Magyar	c5c4fbe43c	fix(zig): vendor tree-sitter-zig so npm i -g no longer warns on peers (#3180) ... * fix(zig): vendor tree-sitter-zig so npm i -g no longer warns on peers Published overrides do not apply to dependents, so the Zig optionalDependency kept warning that tree-sitter@0.21.1 does not satisfy peerOptional ^0.22.1. Load it from vendor/ like Dart/Kotlin/Swift instead. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): add zig parse snippet to prebuild validate The six zig prebuild jobs failed at "Validate the .node loads and parses" because snippets[GRAMMAR] was undefined and tree-sitter threw "Input must be a function". Co-authored-by: Cursor <cursoragent@cursor.com> * chore: drop Unreleased changelog note from the Zig vendor PR CHANGELOG.md is owned by the release process, not individual PRs. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33949409205 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33949616521 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33949829377 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950025077 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950220655 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950400275 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950607933 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33950882912 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951170483 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951386477 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951624305 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951813452 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33951998309 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33952225172 * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33952524393 * fix(ci): stop native prebuild rebuild loops PR path filters and source checks see the cumulative diff, so generated binaries kept rebuilding the original source change. Skip output-only synchronize events using their exact before/head range, failing closed when Git cannot compare it. Exercise the workflow against real commit histories, including multi-commit source pushes and merge-ref drift. * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33953226606 * fix: address Zig PR review feedback (#3180) Check for the vendored package without loading its native binding so a broken installed Zig grammar fails the parsing test instead of skipping. Match the optional child descriptor in the Zig metadata declaration and include Zig in the two optional/vendored grammar comments. Validation: 159 targeted tests, TypeScript, metadata type fixture, and formatting passed. Injected native-load failure now fails instead of skipping; explicit Zig opt-out still skips. * chore(vendor): rebuild native prebuilds (tree-sitter-zig) Built by https://github.com/abhigyanpatwari/GitNexus/actions/runs/33956342308 --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: gitnexus-release-bot[bot] <gitnexus-release-bot[bot]@users.noreply.github.com>	2026-09-05 10:35:33 +01:00
Gergő Magyar	9bf307123e	feat: notify users when a newer gitnexus version is available (#3175) ... * feat(core): add cache-first npm update-check service Shared fail-open checker: validated 24h cache under GITNEXUS_HOME, acquireFileLock-guarded refresh, monotonic publication, hardened registry fetch (no credentials, private-address redirects refused, body-capped), strict x.y.z comparator, install-eligibility classification, and an unref'd refresh scheduler for long-lived processes. Extracts getGlobalDir into storage/global-dir.ts with a repo-manager re-export (no caller changes). Co-authored-by: Cursor <cursoragent@cursor.com> * feat(cli): notify on available updates via stderr and doctor One i18n'd stderr line on interactive invocations when the validated cache holds a newer version (TTY-gated, CI/opt-out/eligibility-gated, hook and help/version command identities excluded). Stale cache spawns a detached hidden __update-check refresh child so command exit latency is unchanged. doctor prints the cached latest version when known. Dockerfile.cli sets GITNEXUS_NO_UPDATE_NOTIFIER=1. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(mcp): emit one stderr update notice per process per version Process-scoped adapter in mcpCommand (stdio and --http), dynamically imported after the stdout sentinel, started only after connect, fully catch-isolated. Arms the shared refresh scheduler with cleanup on process exit. Protocol payloads stay free of update state (R15). Co-authored-by: Cursor <cursoragent@cursor.com> * feat(serve): expose update state on /api/info Serve-scoped controller owns an in-memory update snapshot: one staleness evaluation after listen, then the shared unref'd scheduler, stopped on close/shutdown. /api/info reads only the snapshot and gains optional latestVersion/updateAvailable fields for eligible installs; the existing three fields are byte-compatible. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(web): dismissible update-available banner from /api/info Fetches server info after backend connect and on reconnect, renders a fixed banner in the exploring view only when updateAvailable is true and the version is undismissed, hides while the reconnect banner is active, and fails open on fetch errors. role=status + aria-live with a keyboard-focusable dismiss; dismissal persists per version in localStorage. Copy in en/zh-CN common.json with version interpolation. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(cli): document update notifications and opt-outs Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): apply review findings and simplify pass Review: gate the detached refresh spawn on a live lock-owner probe so parallel CLI invocations coalesce to one refresh child (validated P2, three-reviewer agreement); poll /api/info on a slow cadence while exploring so post-load server-side discoveries surface (validated P1); add a monotonic sequence guard so overlapping server-info fetches commit in order. Simplify (behavior-preserving): shared truthy-env/opt-out/freshness helpers in update-cache.ts, shared cachedUpdateNoticeLine for CLI and doctor, extracted install-eligibility core with per-process memo, memoized registry parsing, single evaluation per scheduler cycle, cache-only startup evaluate in serve, flattened MCP exit handler, shared bottom-banner shell, storage keys in ui-constants. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(update-notifier): address residual review tickets on this PR Stop the lock-busy 1ms scheduler spin, replace clock-skewed cache entries, move the outbound URL guard into core, and extract the serve update controller. Pin the startup/guard/single-flight/MCP/CLI contracts those tickets called out. Fixes #3167 #3168 #3169 #3170 #3171 #3172 #3173 #3174 Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3175) Fetch the npm /latest document instead of the full packument so the 64KiB cap can succeed, and treat reused lock PIDs as stale so refresh is not suppressed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3175) Register the CLI spawn suite on the OS matrix, pin MCP opt-out env, and compare versions without IEEE-754 rounding. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(cli): add gitnexus update install and versioned command banners Give an explicit Claude/Codex-style upgrade (`npm i -g gitnexus@version`) and print `GitNexus <Name> (version)` on every command so the running build is obvious without silent self-update. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3175) - Document the pinned install as npm i -g gitnexus@<x.y.z>, not a copyable @version tag - Wait for wall-clock-future cache repair to publish before asserting - Restore the stdout spy if the TTY notice assertions fail Co-authored-by: Cursor <cursoragent@cursor.com> * fix(update-notifier): keep last known latestVersion on a failed refresh A later offline check was wiping the pin and hiding a known update for 24h. gitnexus update still treats a failed live fetch as checkFailed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3175) - Word update.current so a newer-than-latest install is not called the latest stable version. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): hide the detached update-check spawn on Windows The refresh child was spawned without windowsHide, so Windows CI could stall before writing the cache and then fail cleanup with EBUSY. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-04 18:50:03 +01:00
Parafee41	47c2799ba7	fix(analyze): add cold parser rebuild option (#3153)	2026-09-04 05:14:00 +01:00
Navid EMAD	932d937085	feat: add Zig language support (#1432) ... * feat: add Zig language support Adds a Zig LanguageProvider grounded in @tree-sitter-grammars/tree-sitter-zig 1.1.2. The grammar's published peerOptional `tree-sitter@^0.22.1` is suppressed via an npm `overrides` entry that aliases the peer to the bundled `tree-sitter@0.21.x`; load-time smoke testing confirmed ABI compatibility. v1 capabilities: - .zig file detection + Prism syntax mapping - Top-level + nested function_declaration as Function/Method - struct/enum/union (anonymous in the grammar — owner name resolved from the enclosing variable_declaration in class/field/method extractors) - container_field as struct/union fields and enum variants - top-level const/var as Variable nodes - free + member call_expression as @call edges - @import("./foo.zig") local-file resolution; std and external packages return empty (no ghost edges) - pub keyword detection for export checking - no heritage hooks (Zig has no inheritance; queries never emit @heritage.*) Generic extractor changes (backward-compatible): - field-extractors/generic.ts and method-extractors/generic.ts: empty `bodyNodeTypes` falls back to the type declaration node itself as its own body container — needed because Zig's struct_declaration directly contains its container_field children. (The `extractOwnerName` hook this commit originally introduced now exists upstream; Zig just configures it.) Out of scope (deferred): - usingnamespace, build.zig.zon package graph, comptime/anytype - scope-resolution hooks (emitScopeCaptures, interpretImport, …): Zig is classified `experimental` and uses the generic fallback resolution path - cross-package imports (std, deps) Tests: - new fixture test/fixtures/sample-code/simple.zig - Zig describe block in tree-sitter-languages integration test - simple.zig added to parsing.test.ts fixture-existence list - Zig added to ingestion-utils detection unit test - Zig smoke case in parser-loader-abi.test.ts - Zig grammar registered in the grammar-literal validation gate * feat(zig): integrate build.zig.zon resolution + Union label from PR 1096 Ports the additive pieces of grgisme's standalone Zig provider PR (https://github.com/abhigyanpatwari/GitNexus/pull/1096) onto the rebased provider: - build.zig.zon `.path` dependency resolution for bare-name @import("pkg") (parseZigBuildZon / loadZigBuildZon in language-config.ts, resolveZigImportInternal in import-resolvers/zig.ts, wired through ImportConfigs.zigBuildZon). `.url` deps and repo-escaping paths return null cleanly. 13 unit tests. - `union(enum)` containers now produce `Union` nodes (not Struct): 'Union' added to ClassLikeNodeLabel + CLASS_LIKE_LABELS, the Zig query tags @definition.union, CONTAINER_TYPE_TO_LABEL maps union_declaration to 'Union'. The label was already plumbed graph-wide on main. - /^build$/ entry-point pattern (build.zig). - zig-basic lang-resolution fixture + resolvers integration test. Adapted to current main while porting: - labelOverride relabels container-nested fns Function → Method (mirrors isKotlinClassMethod); the structure phase no longer derives Method from the legacy method-extraction path for plain @definition.function captures. - IMPORTS/CALLS edges require scope-resolution hooks (emitScopeCaptures / interpretImport) since the legacy DAG removal; Zig does not implement them yet, so the integration test documents that with a skipped import-edge case. The resolver itself is wired into the resolver factory and becomes live when the hooks land. Not ported: named-bindings extractor (the legacy namedBindingExtractor API no longer exists) and the bespoke field extractor (the generic factory's extractOwnerName / empty-bodyNodeTypes hooks cover Zig). Co-authored-by: Garrett Griffin-Morales <grgisme@gmail.com> * feat(zig): scope-resolution hooks — IMPORTS and CALLS edges (Ring 3) Implements the registry-primary scope-resolution path for Zig, the prerequisite for cross-file edges since the legacy DAG removal. Adds the standard per-language stack under languages/zig/: - query.ts: scope query (containers as Class scopes, blocks, functions), declarations (container anchors placed on the container node itself so the def lands in its own Class scope and the name binding auto-hoists to the parent — populateClassOwnedMembers needs the class-like def among the class scope's ownedDefs), @import statements (#eq?-gated builtin), parameter/constructor type bindings, and call/constructor reference sites. The grammar is required lazily (optionalDependency). - captures.ts: emitZigScopeCaptures — groups query matches, drops the plain-variable group for container/import bindings (their dedicated rules bind the name), and relabels container-nested fns @declaration.function → @declaration.method (labelOverride parity). - interpret.ts: namespace-kind imports (const x = @import("…")) and type bindings — self-parameter convention marks the receiver, Zig sigils (*, ?, [], error unions, const) stripped from type names while dotted qualifiers (mod.T) are preserved for Case-3 namespace-prefix receiver dispatch. - simple-hooks.ts: parameter bindings stay function-local (Go rationale), local-over-import merge precedence, bounds-check arity (always 'unknown' today — no synthesized arity metadata). - scope-resolver.ts: emit-side wiring; build.zig.zon threads through loadResolutionConfig into the same resolveZigImportInternal the legacy resolver config wraps. fieldFallbackOnMethodLookup off (statically typed). Registered in SCOPE_RESOLVERS. The resolvers integration test un-skips the import-edge case and gains CALLS assertions: free call (main → helper) and receiver-bound method dispatch through a namespace-qualified constructor (var p = pioneer.Pioneer{…}; p.tick() → main → tick). * fix(zig): Union is class-like + missing-grammar warning (review pass) Self-review findings on the Zig branch: - scope/walkers.ts `isClassLike` and finalize-algorithm's CALLABLE_OR_TYPE_LIKE did not include 'Union': a `union(enum)` container's methods got no ownerId from populateClassOwnedMembers, so method dispatch on union receivers silently dropped. Widened both sets; the zig-basic fixture gains a Tag method + a CALLS assertion (main → isEnergy) that fails without the widening (verified by reverting). - optional-grammars.ts now lists tree-sitter-zig with an npm `probe` (it is an optionalDependency, not vendored): users with .zig files and no prebuild get the standard one-line stderr warning instead of a silently degraded index. - Deduplicated the container-method predicate: `isZigContainerMethod` + ZIG_CONTAINER_TYPES now live once in languages/zig/captures.ts and feed both the provider labelOverride and the scope-capture relabel. - README language matrices: Zig row now claims Type Annotations, Constructor Inference, and Config (build.zig.zon) — all true since the scope-resolution hooks landed. * fix(zig): anchor @declaration.variable to the binding identifier `(variable_declaration (identifier) @declaration.name)` matched EVERY identifier child of the node, so `const first = target;` also declared a phantom local named `target` in the enclosing block. That phantom shadowed the real function for later references (and starved callable-value-flow seeds of a target). The `.` anchor pins the pattern to the first named child — the bound name. Regression test in resolvers/zig.test.ts pins the capture set. * feat(zig): callable-value-flow captures + main's per-language conformance gates Post-rebase catch-up: since this branch forked, main added three "every registered language must appear here" tests. Each needs a Zig entry: - callable-value-flow (#2522): Zig now emits `@callable-flow.*` facts via `synthesizeCallableFlowCaptures` (ZIG_CALLABLE_CAPTURE_OPTIONS in zig/captures.ts). tree-sitter-zig's `call_expression` carries arguments as direct children with no wrapper node, which the shared helper could not decompose, so this adds a language-neutral `extractCallArguments` hook (mirror of `extractFunctionParameters`; `undefined` = shared path). Zig joins the provider matrix as 'matrix' with a real assign→copy→ argument→invoke case. - external-import-conformance (#2953): `@import("std")` beside a decoy `src/std.zig` resolves to nothing; the decoy stays reachable via the relative spelling. Zig holds the property (no suffix fallback), so it is a case, not a KNOWN_GAPS entry. - import-target-index-reuse contract (#2909): membership-probe-only fixture (minimumScans: 0, same shape as Rust). * fix(zig): address gitnexus-check review findings One commit per the bot's list so each item is easy to check off: - parser-loader: Zig row gains `userSkippable: true`, so `GITNEXUS_SKIP_OPTIONAL_GRAMMARS` (=1 or a list naming `zig`) disables it at analyze time like swift/dart/kotlin — as `optional-grammars.ts` already documented. Covered in parser-loader-skip-optional.test.ts. - export-detection: `zigExportChecker` stops at the first declaration it reaches. A non-`pub` fn inside `pub const T = struct {…}` was reported exported because the walk continued up to the wrapper. - import-resolvers/zig: a `.path = "."` dep normalizes to '' and no longer grows a leading slash (`/src/main.zig` could never match). - language-config: build.zig.zon parsing strips `//` comments string-aware (a `//` inside `.url = "https://…"` survives) and matches braces while skipping string literals, so a commented-out `.path` cannot declare a dep and a `}` in a comment/string cannot truncate the block. - method-extractors/configs/zig: the leading `self` receiver is excluded from `parameters` (Rust parity). Fixing that exposed a worse bug: the `parameters` node is a plain child of `function_declaration`, not a `parameters:` field, so `childForFieldName('parameters')` was always null and every Zig method had no parameters, no receiver and `isStatic: true`. One `zigParameterList` helper now feeds all three readers. - variable-extractors/configs/zig: container (`struct`/`enum`/`union`) and `@import` bindings are skipped via the same predicate the scope captures use (`isZigContainerOrImportBinding`), instead of the comment merely claiming they were. - tree-sitter-languages.test.ts: the "missing grammar" case now forces the absent-binding path through the loader's runtime opt-out on a fresh module instead of passing vacuously when the package is installed. New: test/unit/zig-extractors.test.ts (exports, receiver/parameters, variable guard); zig-import-resolver.test.ts gains the `.` dep, comment and brace cases. The `createFieldExtractor` heads-up needs no change: the added branch is unreachable for every existing config (none has empty `bodyNodeTypes`). * fix(zig): address second gitnexus-check review pass - import-resolvers/zig: `..` above the repository root now returns null instead of aliasing a same-named root file (`../bar.zig` from `main.zig` is not `bar.zig`); the stale "extension is stripped and re-added" comment is corrected to what the code does. - variable-extractors/configs/zig `extractType`: read the `type:` field only. The positional fallback returned the INITIALIZER of `const f = target;` as its type and gave up on compound annotations (`*Foo`, `?[]const u8`). The comment claiming 1.1.2 has no `type` field on variable_declaration was wrong (verified by AST dump) — and it is what led the review to suspect the callable-flow `extractAssignment` callback, which was already correct for `extern var f: T;`. - receiver detection: only a FIRST parameter named `self` is the receiver. `emitZigScopeCaptures` tags first-position parameters (`@type-binding.first-parameter`), `interpretZigTypeBinding` requires the tag as well as the name, so `zigReceiverBinding` no longer turns `fn f(a: u32, self: T)` into an instance method. - resolvers/zig.test.ts: both suites `describe.skipIf(!zigAvailable)` (Swift/Dart pattern) — the grammar is an optionalDependency. - tree-sitter-languages.test.ts: the Zig parsing case gates on `isLanguageAvailable` instead of a catch-all `return`, so an installed grammar that fails to load fails the test; comment no longer calls Dart and Swift npm optionalDependencies (they are vendored). - test/helpers/literal-collectors: `DIR_LANG` gains `zig`, so literals under `languages/zig/**` are validated against the Zig grammar alone rather than against every grammar. - walkers.ts `isShapeLike` doc: Union IS included (via isClassLike, wired by Zig's union member container); Typedef remains the only deferred one. - language-config `ZigBuildZonConfig.pathDeps` doc: values are the raw `.path` strings; the resolver normalizes. Tests: zig-import-resolver (+1), zig-extractors (+3). * fix(zig): address third gitnexus-check review pass - language-config `parseZigBuildZon`: the `.dependencies = .{` header and the per-entry `.<name> = .{` headers are matched only OUTSIDE string literals (per-offset string mask + `matchZonHeader`). A `.name` or `.description` value spelling `.dependencies = .{ .fake = .{ .path = … } }` used to be taken as the block and returned the fake dep instead of the real top-level one. - import-resolvers/zig: an absolute import (`@import("/foo.zig")`) returns null. The path walker skipped every empty component, so the leading `/` vanished and `/foo.zig` resolved as importer-relative `src/foo.zig` — an in-repo edge for an import Zig rejects as outside the module path. - tree-sitter-languages.test.ts: the Zig parsing case gates on the PACKAGE being installed (`createRequire().resolve`, minus a deliberate `GITNEXUS_SKIP_OPTIONAL_GRAMMARS` opt-out), not on `isLanguageAvailable`, which is false for absent AND for installed-but-broken bindings — so a load failure (ABI mismatch, bad export) now fails the test instead of skipping it, as the comment already claimed. - walkers.ts `isShapeLike` doc: `Union` sits in `isClassLike` because that is the label set the ownership walkers consult, not because unions inherit — Zig has no inheritance and no heritage hooks. The previous wording ("inheritance-capable owner") said otherwise. - Not re-fixed (already addressed in the second pass, findings carried over): "receiver = any parameter named self" — `interpretZigTypeBinding` only sources a first-position parameter as `self`; `zigReceiverBinding`'s doc now states that invariant. "`DIR_LANG` has no zig entry" — it does. Extended one level out: `BASENAME_LANGS` (`zig.ts`) and `PREFIX_LANGS` (`ZIG_`) map to the Zig grammar too, so extractor configs and the export-detection set are validated against Zig alone. That immediately caught a dead `childForFieldName('parameters')` in method-extractors/configs/zig `zigParameterList` (there is no such field; the named-child lookup was already the one doing the work) — removed. Tests: zig-import-resolver (+2: absolute path, header inside a string); both fail on the previous code. * fix(zig): address fourth gitnexus-check review pass - language-config: `parseZigBuildZon` only accepts a `.path` that is a DIRECT field of a dependency entry. Nested blocks inside the entry body are blanked (string-aware, offsets preserved) before the `.path` regex runs, and a match starting inside a string literal is rejected, so `.dep = .{ .url = "…", .meta = .{ .path = "x" } }` no longer becomes a path dep. Regression test in zig-import-resolver.test.ts (fails on the previous code). - tree-sitter-languages test: the "grammar is absent" case now drives the loader's real `source.load()` catch branch — `node:module` is stood in with a `createRequire` whose require throws MODULE_NOT_FOUND for `@tree-sitter-grammars/tree-sitter-zig` and delegates everything else — instead of the `GITNEXUS_SKIP_OPTIONAL_GRAMMARS` opt-out, which has its own test. It also asserts the opt-out flag is NOT set and that other grammars still load (non-fatal optional failure). Not re-fixed: - "Return type is read from the wrong tree-sitter field": tree-sitter-zig 1.1.2 has NO `return_type` field on function_declaration — the type after `)` is the `type` field (AST dump: `builtin_type "i32" field=type`; the proposed `childForFieldName('return_type')` is null for every function). A pin test in zig-extractors.test.ts asserts both the grammar fact and that `returnType` is extracted (`void`, `!*Counter`). - "`DIR_LANG` has no zig entry": it does (added in the first pass and answered again in the third); the finding is carried over unchanged. * fix(zig): address fifth gitnexus-check review pass - tree-sitter-languages test: the Zig "functions, structs, enums, and imports" case now asserts the `import.source` capture for `const std = @import("std");` (the fixture's only import), so a query change that drops Zig import matching fails it instead of passing unchanged. Not re-fixed: - "Return type is read from the wrong tree-sitter field": carried over from the fourth pass unchanged. tree-sitter-zig 1.1.2 has no `return_type` field on function_declaration; the return type IS the `type` field, and the pin test added in the fourth-pass commit (zig-extractors.test.ts, `childForFieldName('return_type')` is null, `returnType` = `void` / `!*Counter`) proves it. - "`DIR_LANG` has no zig entry": carried over unchanged for the third time; the entry exists since the second-pass commit. * feat(zig): export fn visibility, opaque containers, named test blocks, member ownership Ports the parts of upstream PR #305 (closed, unmerged) that our Zig provider lacked, plus two gaps found while porting. - `export fn` / `export var` (C-ABI linkage, never `pub`) are exported; the pub/export predicate is now shared by the export checker and the method/variable extractors' visibility (`hasZigVisibilityKeyword`). - `const H = opaque { … }` is a Struct-labelled container (it may own methods, never fields) in both the structure queries and the scope query; ZIG_CONTAINER_TYPES is the single source for the extractor configs. - `test "name" { … }` blocks are Function nodes named by the string node WITH quotes, so `test "add"` beside `fn add` cannot merge onto Function:<file>:add; `test_declaration` joins FUNCTION_NODE_TYPES and the Zig method config names it in the enclosing-function walk, so calls inside a test attribute to the test. Anonymous `test {}` and decl-tests `test add {}` are scopes without a node (an empty-name hook result stops the walk instead of falling through to the identifier of the function under test). - Empty container bodies (`struct {}`, `opaque {}`) no longer mint a nameless Property: tree-sitter-zig 1.1.2 recovers them as a container_field with a MISSING identifier; #not-eq? guards in both queries and the field extractor drop it. - Owner walk (`findEnclosingClassInfo`): an anonymous container bound by the enclosing `variable_declaration` takes the binding identifier, same shape as the Go `type_spec` branch. Before this NO Zig member had an owner — zero HAS_METHOD / HAS_PROPERTY edges for Zig. Not ported from #305, deliberately: `builtInNames` (a bare-name call-site drop filter; `alloc`/`free`/`append`/`print` are the most common user method names in Zig and `std.*` receivers are already external via the import binding), `usingnamespace` (removed in Zig 0.15), `@cImport`, `build.zig` ignore, and the web-app changes. * test(zig): absent-grammar case owns GITNEXUS_SKIP_OPTIONAL_GRAMMARS The loader parses the opt-out variable lazily once per module copy, so under `GITNEXUS_SKIP_OPTIONAL_GRAMMARS=zig` (or `all`) — a supported way to run — the fresh loader took the opt-out branch and the "not the opt-out path" assertion failed before the absent-binding path ran. Clear the variable for the fresh module and restore it in `finally`, instead of returning early: the branch stays exercised in every environment. Verified: fails on the previous code under `=zig`, passes with and without the variable now. * fix(zig): declare the Union relation pairs — analyze aborted on any union `gitnexus analyze` exited 1 on every Zig repository that declares a `union` (including the zig-basic fixture itself): the member-ownership commit made `union_declaration` a MEMBER_OWNER, so HAS_PROPERTY / HAS_METHOD edges are emitted FROM a Union node, but `Union` was not in LINKABLE_LABELS, so the schema's scope-bridge cross product never generated a `FROM Union` pair and LadybugDB rejected the edge (`labelPair: "Union|Property"`). Resolver tests stayed green because they never write to the DB. - `Union` joins LINKABLE_LABELS (also bridges `Tag{…}` constructor references); the three hand-written `→ Union` target pairs move to the generated half, per the STRUCTURAL_PAIR_DDL rule. - structural-pair-coverage gains an optional-grammar corpus with zig-basic (`Union|Property`, `Union|Method` sentinels), skipped when the grammar is absent. - Rust `union_item` note updated: the three gates it cited are widened. Note for reviewers: the DDL fingerprint changes (#2808), so existing indexes are rebuilt on next analyze. * feat(zig): resolve path deps through the dep's build.zig and src/root.zig The bare-name resolver only knew `src/<name>.zig` and `src/main.zig`. `zig init` has written `src/root.zig` for libraries since 0.12, so the default library layout never resolved. Now: the root the dep's own build.zig declares (`b.addModule("<name>", .{ .root_source_file = b.path("…") })`, name-matched module first), then src/root.zig, src/<name>.zig, src/main.zig. `normalizeZigDepPath` is shared by the loader and the resolver. * feat(zig): Const/Variable defs, member imports, receiver typing, generic type constructors Coverage gaps found by indexing idiomatic Zig against the branch: - Const / Variable nodes: ZIG_QUERIES had no @definition.const / @definition.variable, so `pub const VERSION`, error sets and type aliases were absent and zigVariableConfig never ran. Rules are gated on the literal `const` / `var` keyword — tree-sitter-zig 1.1.2 parses statement assignments (`x = 5;`, `x += 1;`, `_ = expr;`) as keyword- less `variable_declaration`s, and the scope query minted a phantom local per assignment and one `_` per discard. Container and @import bindings are skipped via `shouldSkipDefinitionCapture`. - Imports: `const X = @import("x.zig").X` (named / alias), `const X = ns.X` where `ns` is an @import binding of the file (promoted to a named import), and `pub usingnamespace @import(...)` (wildcard, with `expandsWildcardTo`). All three lost the file-level IMPORTS edge. - Receiver typing: `var x: T = undefined` / decl literals `const x: T = .init()` (annotation), `var c = T.init()` / `mod.T.init()` (call return), `List(u8){}` (instantiation literal); `normalizeZigTypeName` drops the comptime argument list. - Generic type constructors `fn List(comptime T: type) type { return struct {…}; }`: the returned container is a Struct/Union/Enum named after the fn, owns its members (HAS_METHOD / HAS_PROPERTY), binds in the module scope beside the Function def, and is emitted ahead of it so a named import binds the type. - `export` vs `pub`: `visibility` is now `pub`-only (Zig-module fact); `isExported` keeps `pub|export` (visible outside the unit, as C's external linkage). `export fn` without `pub` is not reachable from other Zig files. - Extractor configs share `zigContainerName`; ast-helpers' owner walk learns the type-constructor shape. Tests: zig-idioms fixture (10 resolver cases), extractor/interpret unit cases for each rule. * fix(zig): address sixth gitnexus-check review pass - Windows absolute `.path` deps (`C:\x`, `C:/x`) return null from `normalizeZigDepPath` like POSIX ones; a `/`-only check let them through as repo-relative. - `parseZigBuildZon` accepts the `.dependencies = .{` header only at brace depth 1 (a direct field of the file's `.{`), so a same-named field nested in an earlier struct cannot hijack the block. - `importsExecuteWhereWritten: false` on the provider: `@import` is compile-time name lookup (as C `#include`, Rust `use`); a body-level `@import` is no longer marked `runsOnlyWhenCalled`. - Namespace imports record the MODULE as `importedName` (`zigModuleNameOf`: last path segment without `.zig`), per the shared contract; the local handle stays `localName`. - Keyword-less `<ident> = @import(…)` (`_ = @import("x.zig")` in a test block) is a `side-effect` import: file edge, no binding. Only `const`/`var` declarations bind a name or feed alias promotion. - `extractZigFunctionName` doc: an empty name is falsy, so the enclosing- function walk skips the test node and continues to the File; it does not "end" there. Not re-fixed: "DIR_LANG has no zig entry" — carried over for the fourth pass in a row; `test/helpers/literal-collectors.ts` has had `zig` in `DIR_LANG` (line 91) and `BASENAME_LANGS` since the second-pass commit. Regression tests: absolute-path spellings, nested `.dependencies` decoy, namespace/side-effect interpretation, function-scoped `@import` not deferred (all four fail on the previous source). * fix(zig): address seventh gitnexus-check review pass - The scope query's `@import` binding rules are keyword-gated (`"const"` / `"var"`, first-child anchored) like every other binding rule, and the keyword-less `<ident> = @import(…)` statement has its own `@import.side-effect` rule. Tree-sitter queries cannot express "no keyword child", so that rule also matches the keyword shapes and `emitZigScopeCaptures` drops those (they are the binding rules' matches). Behaviour is unchanged from the sixth-pass fix — the existing side-effect test covers it — the query text now carries the guard the finding asked for. Not re-fixed: "DIR_LANG has no zig entry" — fifth pass in a row; `test/helpers/literal-collectors.ts` has had `zig` in `DIR_LANG` since the second-pass commit. Left for a human reviewer to close. * fix(zig): resolve @import of the repo's own build.zig modules (F3) Bare-name imports were resolved through build.zig.zon path deps only, so the module a repo's ROOT build.zig declares for itself — `b.addModule("lightpanda", .{ .root_source_file = b.path("src/lightpanda.zig") })`, imported by name from 378/567 Lightpanda files — never produced an IMPORTS edge, and nothing reached through `lp.X` resolved. A repo with a build.zig but no build.zig.zon got no resolution config at all. - language-config: `parseZigRootModules` (static scan of the root build.zig: `addModule("<name>", …root_source_file = b.path("<p>.zig")…)`, and `createModule`/`addModule` bindings named via `addImport("<name>", m)` or `.imports = &.{ .{ .name, .module = m } }`; generated / `.url` / computed modules are skipped) → `ZigBuildZonConfig.rootModules`. - `loadZigBuildZon` → `loadZigBuildConfig`: reads the zon AND the root build.zig; null only when neither contributes. - resolver: root modules are consulted before path deps; std/builtin/root still never resolve. - fixtures: zig-idioms gains a Lightpanda-shaped root module (+ decoy `addOptions().createModule()`); new zig-rootmodule (build.zig, no zon). Corpus (Lightpanda): IMPORTS 3014→3389 (378 edges to src/lightpanda.zig, was 0), CALLS 13885→13989, ns.f() 79.3%→83.3%, param.m() type=ns-qualified 43→46/417. * fix(zig): import every @import in expression position; resolve @import("x").f() Both query sets only saw `@import` as the value of a const/var or under `usingnamespace`, so an @import in any other position produced no file edge: Lightpanda's `pub const Interfaces = .{ @import("a.zig"), … }` registration table (288 modules), call arguments (`CounterEnum("size", @import("ArenaPool.zig").BucketSize)`), comparison operands (`JsApi == @import("x.zig").JsApi`) and member-call receivers (`try @import("dump.zig").root(...)`) — 417 of 3,401 in-repo import pairs had no IMPORTS edge, and the 80 inline-receiver calls resolved 0 times. Scope query: a catch-all `@import.inline` rule matches every `@import` builtin; `emitZigScopeCaptures` drops the ones a binding rule (or the keyword-less side-effect rule) already claimed (by string-node id) so a bound import is never doubled, emits the rest as side-effect imports once per distinct source per file, and binds a member-call receiver as a namespace import whose local name is the builtin's own text — the `@reference.receiver` text on that call is identical, so the shared namespace-receiver lookup (Case 1) resolves the member in the imported module. ZIG_QUERIES: the three variable_declaration/usingnamespace-anchored `@import` rules collapse into the same single builtin rule (the structure phase only skips import matches; one match per builtin keeps tree-sitter-languages' exact-capture assertion intact). Lightpanda corpus (zig-corpus-check, before → after): IMPORTS 3014 → 3426, in-repo pairs missing 417 → 5 (4 under a default-ignored `cache/` dir, 1 a commented-out import the census regex counts), `@import(..).f()` 0/80 → 72/80 (the 8 left are `@import("root")` and non-import builtins the census mislabels), CALLS 13885 → 13959; every other line unchanged. * feat(zig): model file-structs — a file with top-level fields is a Struct named after the file In Zig every file is a struct; one that declares top-level fields is an instantiable type whose name is the file stem (`Page.zig` declares `Page`, `@typeName` agrees), and its top-level `fn`s taking `self` are its methods. Lightpanda spells 413 of 567 files this way and, before this, `page.getArena()` on a `page: *Page` parameter resolved 23 of 993 times (2.3 %) — `impact` on `Page.getArena` reported 0 callers for 159 call sites, and 2,395 top-level fields were ownerless Property nodes. Definition phase: `((source_file (container_field …)) @definition.struct)` + the class extractor names it from the file path (`zigContainerName(source_file, filePath)`); top-level fns/fields are owned through the new `LanguageProvider.resolveFileTypeOwner` hook (consulted by `findEnclosingClassInfo` when the walk reaches the tree root, and by the method/field extractors' owner lookup) — ids become `Method:<file>:Page.getArena#0` / `Property:<file>:Page.session` with HAS_METHOD / HAS_PROPERTY edges. Scope phase: `emitZigScopeCaptures` emits a Class scope over the whole file (same range as the Module scope, nested under it — the pair `canParentScope` already admits) plus a Struct def anchored on it; member NAME bindings are hoisted back to the Module scope by `zigBindingScopeFor` so `Page.init()` (namespace member) keeps working, while ownedDefs stay in the Class scope so `populateClassOwnedMembers` stamps the owner. The file-level `const Page = @This();` alias no longer mints a Const (it would shadow the Struct); `@This()` aliases in type position (`self: *SigHandler` in Sighandler.zig, nested `Self`) are rewritten to the container name so receivers resolve. A namespace import of a `.zig` file gets a NAMED twin of the file stem so `x: *Page` in the importer binds the type as well as the module. Shared, additive: `resolveFileTypeOwner` hook; `filePath` threaded to `ClassExtractionConfig.extractName` / `extractOwnerName`; nameless `definition.struct` passes `getLabelFromCaptures` like `definition.class` already did (extractor synthesizes the name). Lightpanda corpus (zig-corpus-check): param receivers typed by a file import 23/993 → 993/993; `self.m()` 99.2 → 100 %; annotated locals 11.6 → 23.2 %; CALLS 13,885 → 15,689; HAS_METHOD 1,477 → 8,003; ownerless Property 2,395 → 276; Function/Method 8,378/1,518 → 2,562/7,330; no row regressed. Fixture `zig-filestruct` (Page/Session/Sighandler/util) + unit tests pin the shape, the stem naming, the alias rewrite, the namespace twin and the unchanged namespace-file behaviour. * test(zig): expression-position import case sees the file-struct type twin * fix(zig): stop reading member calls `x.f(arg)` as direct calls named `f` tree-sitter-zig spells `field_expression` as `object:`/`member:`; the shared callable-flow reader only knew `property`/`field`/`method`, so every Zig member call collapsed to a DIRECT call named after the member and the solver fanned each argument out to every same-named callable (4,761 cap warnings on Lightpanda, `Global.deinit -> Global.deinit` self-loops through `pub const release = deinit;`). Shared (grammar-neutral, receiver-gated): - `memberParts` also reads `member` (only C/C++ `offsetof_expression` and JS `class_body` expose that field, without a receiver field). - A member call is a field-stored-callable invoke only when a MEMBER store (`o->run = handler`, `self.f = target`) or a declared callable-typed field is visible — a same-named plain binding no longer gates it. - `direct-callee-name` requires a direct designator: `.init(x)`, `' '.join(x)`, `string.Join(x)` name no callee to seed by simple name. Zig: formals are numbered without the leading `self`, so `r.run(target)` joins `cb` and yields `Runner.run -> target`. Goldens for python/csharp regenerated: the only drift is the dropped `direct-callee-name` on `' '.join(...)`, `text.strip().ljust(...)`, `string.Join(...)`. Lightpanda: cap-warnings 4761 -> 2, cvf self-loops 10 -> 0, CALLS 13885 -> 13857 (28 removed, all callable-value-flow: 10 self-loops, 17 same-name fan-out, 1 lost `on -> TypeErased.start`; +1 correct `Arena.alloc -> allocator`). * fix(zig): bind container field types so `self.field.m()` resolves (F5) A container's field types were never bound on its Class scope: the scope query's `container_field` rule captured only the name, and `emitZigScopeCaptures` synthesized no `@type-binding.field` group. The compound resolver reads member types from that scope (`typeOfMemberOnClass` → `classScope.typeBindings.get(field)`), so `self.session.name()`, `self.counter.incr()` — Lightpanda's dominant cross-object call shape — resolved 9 of 2803 times (0.3 %). - query.ts: capture `type: (_)? @declaration.field-type` on `container_field` (enum variants have none). - captures.ts: per typed field, push a `@type-binding.field` group (name = field, type = the type text, `@This()` aliases rewritten to the container name like parameter types); anonymous inline containers are skipped. The binding lands on the container's Class scope — the file's Class scope for a file-struct — since `zigBindingScopeFor` hoists only declaration names. - query.ts/captures.ts: `const page = self.page;` / `var s = self.session;` one-level field aliases become `@type-binding.alias` bindings whose "type" is the RHS path; the resolver's member-alias branch re-resolves it as a receiver chain. Import aliases (`const Counter = counter.Counter;`) are dropped — they are named imports. - interpret.ts: `@type-binding.field` → 'annotation', `@type-binding.alias` → 'assignment-inferred' (an annotation on the same binding wins). Corpus (Lightpanda, zig-corpus-check): self.field.m() 11/2803 (0.4 %) → 1433/2803 (51.1 %); ident.m() bound=local-field-access 29/1902 (1.5 %) → 307/1902 (16.1 %); chain.m() 146/5022 (2.9 %) → 642/5022 (12.8 %); CALLS 15838 → 18066. self.m() / free f() / ns.f() unchanged. Tests: unit (zig-extractors) — one @type-binding.field per typed field with sigils stripped and aliases rewritten; the binding hosted on the container's Class scope (file-struct: the file's Class scope, not Module) with the written spelling as declaredSpelling; field aliases bound to the RHS path and never for import aliases. Integration (zig-idioms `holder.zig`, zig-filestruct `Page.zig`): `viaField → incr` ×2 into counter.zig, `viaAlias → get/twice`, `sessionName → name` / `sessionLabel → name` into Session.zig. All fail without the change. The optional-payload capture `if (self.opt) |c| c.incr()` is not asserted (F6). * fix(zig): `pub const X = @import(…)` at file scope republishes X (reexportsName) Lightpanda's `lightpanda.zig` is one long list of `pub const Arena = @import("Arena.zig");`, and most files name their types through it (`const lp = @import("lightpanda"); const Arena = lp.Arena;`, `arena: *lp.Arena`). The scope side treated those bindings as plain imports of the hub file, so the hub never published the names it re-exports and a third file's `const Arena = lp.Arena;` (promoted to a named import of `Arena` from the hub) found nothing. `emitZigScopeCaptures` now marks named/alias import groups whose declaration is a file-level `pub const` — the `@import(...).X` form, the alias promotion `pub const Bar = ns.Bar`, and the file-struct type twin of `pub const Arena = @import("Arena.zig")` — and `interpretZigImport` sets the shared contract's `reexportsName: true` on them (the Python `__init__.py` shape, consumed by `buildReexportClosures`). Private and fn-local bindings stay unflagged. Not covered here: a receiver ANNOTATED with the dotted hub path (`arena: *lp.Arena`) — Case 3 of the receiver-bound pass looks the member up with `findExportedDef`, which only sees locally declared names; following re-exports there is a shared change left for a follow-up. * fix(zig): type receivers through `const X = <type expr>;` aliases (F7) `const LocalAlias = Local;`, `const T2 = Thing;` (alias of an alias/import) and `const B = util.List(u8);` (an INSTANTIATED generic type constructor) were plain `@declaration.variable` bindings, so `LocalAlias.mk()`, `var l = LocalAlias.mk(); l.go()`, `T2.make()`, `B.init()`, `B{}` and `var x: B` all typed nothing (review repro r3-flow b1..b9; Lightpanda: `pub const Proto = HtmlElement;` x68, `const Allocator = std.mem.Allocator` x104, `pub const KeyIterator = GenericIterator(...)`, fn-local `const R = ...(...)`). Model: a `@type-binding.alias` binding of the alias NAME to the value's type text — Rust's `let x = y` / JS's `const B = Foo`, source 'assignment-inferred' — NOT a TypeAlias def. Reasons: (1) the shared machinery already chains typeBindings (`followChainedRef` in the extractor, `followChainPostFinalize` after propagation), so `var l = LocalAlias.mk()` and `var x: B` reach the target through the alias with no new shared code; (2) nothing shared follows a `TypeAlias` def to its target — `isShapeLike` only makes the alias itself a member owner (TS object-type aliases) — so a relabel would have needed language-named shared code; (3) graph node ids are UNCHANGED: every alias stays `Const:<file>:X`. `normalizeZigTypeName` already drops the comptime arguments, so `util.List(u8)` binds `util.List` and resolves through the namespace import (Case 3). The identifier / member shapes also take `var` (`var cur = orig; cur.go()` — the cursor idiom, same binding as Rust's `let x = y`). Heuristic, stated as such: a CALL value is kept only when the callee's last identifier is TitleCase (Zig's naming convention for types), because the grammar cannot tell `util.List(u8)` from `util.makeThing()` and the latter belongs to the call-return rules; the call-return group is dropped for the same TitleCase shape so the two never race on match order. Import bindings (`const Stack = @import("x.zig").Stack`), promoted namespace-member aliases, enum/decl literals (`.foo`) and the `type:` annotation of `var b: T = undefined;` are excluded. Not done: the two-hop `pub const bridge = js.Bridge(T); bridge.accessor()` chain. `js.Bridge` is a Function that RETURNS `bridge.Builder(T)` (a call, not a container), so the alias binds `js.Bridge`, Case 3 finds a Function with no members in js.zig, and Case 3b is skipped for a namespace head. Following that hop needs a namespace-member return-type route in shared code (or a Zig `resolveQualifiedReceiverMember` hook that re-implements member lookup without the model); left for a follow-up. Corpus (Lightpanda, `harness/zig-corpus-check.mjs`): CALLS 15838 -> 16051 (+213, 0 removed), `ident.m() bound=local-alias` 6/63 -> 36/63, `local-call` 159 -> 176, `module/unknown` 110 -> 116, `local-other` 271 -> 273; `self.m()`, `free f()`, `ns.f()` unchanged or up. * fix(zig): one alias rule set — F7's alias rules subsume F5's field-access alias rules * fix(zig): type locals through try/catch/orelse, return types and payload captures F6 of the gitnexus-check review. Three gaps in the value flow that types a local receiver, all measured on Lightpanda: 1. `@type-binding.call-return` needed the `call_expression` as the DIRECT value child, so `const p = try Page.init(…)` (2,551 sites), `… catch return` (410) and `… orelse return` typed nothing. The rule is now one keyword-gated declaration match; `emitZigScopeCaptures` unwraps `try`, `catch`, `orelse` and parentheses (`zigUnwrapValue`) and decides what the value types (`zigCallReturnTypeOf`): a module-level receiver still names the type (`Counter.init()` → Counter, Rust `Foo::new()`); a free call binds the callee name (`makeThing`); a member call on a fn-LOCAL receiver (parameter / local / payload — Zig forbids shadowing, so "declared in the fn" is exact) binds the compound `node.asElement()` the shared resolver walks to the method's return type — instead of typing `el` as `Node`. A TitleCase callee (`List(u8)`) is a type constructor and binds nothing. 2. No `@type-binding.return` existed. `fn make() !*Thing` now binds `make ↦ Thing` in the enclosing scope (Module for free fns, the container's Class scope for methods, where the compound resolver reads it). Builtins, `type`, `@TypeOf(…)` and comptime type parameters (`?*T`) bind nothing; `@This()` / `Self` returns name the container. `normalizeZigTypeName` now strips the error union BEFORE the payload's sigils, so `Allocator.Error!*Page` → `Page` (it used to leave `*Page`). 3. Payload captures had no binding at all. `populateZigRangeBindings` (registered as `populateRangeBindings`) types `for (items) |it| / |*it|`, `for (items, 0..) |it, i|`, `if (opt) |v|`, `if (call()) |v|`, `while (it.next()) |x|` from the SUBJECT's written type minus one layer (`[]T` element, `?T` payload) — declining when the layer is not visible (`ArrayList(T)`) — and the same projection for `const t = items[i]` / `opt.?` / `ptr.*`. `catch |err|` and `switch` prongs are skipped. Corpus (Lightpanda, gate before → after): CALLS 15838 → 17853; `ident.m() bound=local-try/catch/orelse` 11/1298 → 584/1298; `local-call` 159/1282 → 398/1282; `payload` 82/1085 → 233/1085; `other-recv:call_expression` 5/991 → 457/991; `local-other` 271 → 364; `self.m()` 100 %, `free f()` 97.5 %, `ns.f()` 83.4 % unchanged; nothing down. Not covered: `const t = ns.f()` (a namespace fn's return type across files — Case 3 has no path from a namespace head to a callable's return binding), and expression receivers (`items[i].run()`, `o.?.run()`). * fix(zig): resolve leftover fixture merge markers (Page.zig) * fix(zig): reconcile F6 value inference with F7 aliases and F5 field bindings - A fn-local TitleCase receiver (`const R = generic.List(u8); var l = R.init();`) is a type alias (F7), not a value local: `R.init()` names the type `R` like `Counter.init()` does at module level, so `l` chains R → util.List → push. F6's local-receiver rule now excludes TitleCase heads. - The F6 unit helper only collects the value-inferred / return kinds it owns; F5 field and F7 alias bindings for the same names are asserted in their own suites. * fix(zig): give function-local and anonymous containers an identity (F8) `const R = struct {…}` declared inside a fn (Lightpanda's reflection.zig has ~20, one per builder) all collapsed onto one `Struct:<file>:R` with one `R.get`; anonymous containers (`std.sort.pdq(…, struct { fn lessThan … } .lessThan)`, `const byte_size = struct { fn it … }.it;`, `?struct { min, max }` field types) had no identity at all, so their fns were OWNERLESS Methods (`Method:<file>:lessThan#3`) that collided across a file. `zigContainerName` now yields the graph IDENTITY on both phases: - function-local named: `<enclosing callable>$<name>` — `Reflect.string$R` (Java local-class `$` chain; `populateClassOwnedMembers` leaves it whole); - anonymous: `<host>$<ordinal>` — `build$1`, `Outer$1`, `Page$1` (javac's `Outer$1` numbering per host, in source order); - a `test` host is keyed `test@L<line>` (its string does not survive the class extractor's qualified-name normalization). `zigContainerBindingName` keeps the spelling code writes (`R`) for scope bindings and `@This()` alias rewrites (`@declaration.binding-name`). Structure phase: bare `(struct|enum|union|opaque_declaration)` rules mint the local/anonymous nodes via the class extractor; `shouldSkipDefinitionCapture` keeps exactly one rule per container (`zigContainerAnchor`); a new grammar-neutral `resolveContainerTypeOwner` provider hook lets the shared owner walk name a container from context, so `Method:<file>:Reflect.string$R .get#0` and its HAS_METHOD source agree by construction. Scope phase: the wrapper group splits name/binding-name for locals and anonymous containers get synthesized `@declaration.<kind>` defs (`is-synthetic`). Lightpanda: ownerless Methods 14 → 0, fns without a node 55 → 0, ownerless Properties 276 → 5, HAS_METHOD 8003 → 8074, HAS_PROPERTY 7275 → 7403, CALLS 15838 → 15857, Struct 1905 → 2199; no resolution bucket dropped. * fix(zig): re-add the implicit receiver on the call side so both method-call spellings reach the callback formal `extractFunctionParameters` sliced the leading `self` off the formals, which lined up `r.run(target)` (target@0 ↔ cb@0) but lost the explicit spelling `Runner.run(&r, target)` (&r@0, target@1 ↔ cb@0): the callback never joined its formal and `run → target` was missing (PR #1432 review by koriyoshi2041). Formals are numbered once per function while the receiver differs per call shape, so the fix lives in `extractCallArguments`: keep `self` as formal 0 and prepend the receiver as actual 0 when the callee is a member call on a VALUE receiver — chain head is a fn-local name that is not TitleCase, the same value-vs-type rule F6 uses. Namespace / type / decl-literal receivers (`Runner.init(cb)`, `helpers.apply(cb)`, `List(u8).init`, `.init(cb)`) get no prepend. Known residual gap, documented: a module-level value receiver (`global_runner.run(cb)`) is not fn-local and still misses. Tests: the F2 integration case now asserts both spellings plus a namespace call; the unit contract pins `self@0, cb@1` and the per-call actual index. * fix(zig): address eighth gitnexus-check review pass - Named dependency modules: `parseZigBuildModuleRoots` scanned `addModule("<name>", .{ … })` with a `[^}]*` regex, so a nested field before `.root_source_file` (`.imports = &.{ .{ … } }`) ended the match at the inner `}` and demoted the module to an unnamed fallback — the first exe/lib root in the file then answered `@import("<name>")`. The named lookup now walks the balanced `addModule(…)` argument list (same scanner as `parseZigRootModules`, comment-stripped, string-aware); the unnamed fallbacks are unchanged. Regression test in `zig-import-resolver.test.ts`. - Type-position `@import`: `var x: @import("m.zig").T = undefined;` was read as an import binding of `x` on both sides — the query rules match the `type:` child like a value, and `isZigContainerOrImportBinding` scanned every named child — so `x` was never declared and became a named import of `T`. The helper now skips the `type:` field, and `emitZigScopeCaptures` drops binding-rule matches whose `@import` sits in the annotation (`isZigTypePositionImport`) without claiming the source, so `x` binds as a variable and the file edge survives as a side-effect import. Regression tests in `zig-extractors.test.ts` (variable extractor + scope captures). - Union in the class-capture skip guard: the parse-worker's inline class-like predicate lacked `Union`, so a `Union` definition bypassed `shouldSkipClassCapture` unlike every other `ClassLikeNodeLabel`. Added the label; no Zig behavior changes (Zig defines no skip hook), so no test. - File-owned method ids in `findEnclosingFunctionId`: the arity lookup used `findEnclosingClassNode` while the owner came from the file-owner aware `cachedFindEnclosingClassInfo`, so a Zig file-struct's top-level fn produced `Method::Page.get` without the `#<arity>` suffix. It now uses `findEnclosingClassNodeOrFileOwner`, the definition-phase lookup. Consistency fix only: `ParseWorkerResult.calls` / `.assignments` (the sole consumers of this id) are merged but not read since #942 — CALLS edges come from the scope pipeline, whose ids were already right — so no observable graph change and no test. Not re-fixed: - `test/helpers/literal-collectors.ts` `DIR_LANG` has no `zig` entry (raised for the seventh time): the entry exists (`zig: SupportedLanguages.Zig`, added by the second-pass commit), so `languages/zig/**` literals are already validated against the Zig grammar alone; documented in the PR body since the fifth pass. * fix(zig): keyword-gate the constructor type-binding rules The three `@type-binding.constructor` rules (`const p = T{…}`, `mod.T{…}`, `List(u8){…}`) matched any `variable_declaration` with an identifier and a `struct_initializer`, keyword or not — and tree-sitter-zig 1.1.2 parses a re-assignment `p = T{…};` (and `_ = T{…};`) as the same node type. So an assignment minted a constructor binding for `p` in its own block, and one for `_`. Zig's static typing makes the extra binding redundant (`p` already carries its type from its declaration: annotation, constructor or inferred value), so it cost little, but it declared nothing and stood out against every other binding rule (`@declaration.variable`, the import rules, the call-return rules), which are keyword-gated for exactly this shape. Split each rule into `"const" .` / `"var" .` variants, like the call-return rules. Regression test in `zig-extractors.test.ts`: `p = T{…}`, `q = mod.T{…}`, `l = List(u8){}` and `_ = T{…}` after their declarations yield only the three declaration bindings (fails on the previous query). The zig, callable-value-flow, grammar-literal and tree-sitter-languages suites are unchanged. Raised twice by gitnexus-check (passes on 2026-08-18 12:42 and 12:56). * fix(zig): re-baseline the callable-flow capture fingerprints, keep `await f<T>(x)` a direct callee The `benchmarks (GITNEXUS_BENCH)` CI job gates two capture fingerprints that this branch's shared callable-flow change (3e62b99a) moved without re-baselining: `bench/python-scope/baseline-fingerprint.txt` and four languages in `bench/scope-capture/baselines.json` (csharp, cpp, typescript, kotlin). Both `--check` runs pass on origin/main and failed on this branch; every other language matched its baseline on the same run. Drift, verified by dumping the canonical matches on both trees: - csharp / kotlin / python: exactly the intended change — a MEMBER call (`string.Join(x)`, `.forEach { }`, `' '.join(x)`, `.ljust(w)`) no longer carries `direct-callee-name`; the argument fact is unchanged. - cpp: `choice.select(1)` (cpp-deleted-overload) drops an INDIRECT invoke + its synthetic `@reference.call.free` that were gated only by the same-named free `select` binding; the site is a genuine method call already captured as `@reference.call.member`. capture_groups_fp 4605 -> 4601. - typescript: `await svc.verify<T>(x)` (member) and `initializer()(cb)` (call-of-call) drop the name as intended. But `await verifyToken<T>(x)` — a DIRECT call — lost it too, because tree-sitter-typescript parses `await f<T>(x)` as `call_expression(function: await_expression(f), type_arguments, …)` and the new direct-designator gate saw an await_expression, not `f`. `wrappedExpression` now unwraps `await_expression` (no named field, so the field-based unwrap missed it), restoring parity with main for the direct spelling while the member spelling stays nameless. Regression test added; it fails without the unwrap on both assertions. Gates run locally: scope-capture --check (15 languages), python-scope --check, import-target --check, tsc, eslint, prettier, the callable-flow / golden / tripwire / resolver test files (33 files), full suite with coverage (82.9/71.5/89.1/86.4 vs 26/23/28/27 thresholds). * test(zig): fail CI when the optional Zig grammar is absent `@tree-sitter-grammars/tree-sitter-zig` is an optionalDependency, so every Zig suite gates on `isLanguageAvailable(Zig)` and the ABI load-smoke accepts a clean load failure for an optional grammar. Both are the right contract for a platform with no prebuild, and together they leave a hole: if the grammar never installed on any CI runner, this PR would merge with all eight Zig resolver suites plus the structure-phase suite reported green-by-skip, having never executed the native Zig parser once. Close it with the `GITNEXUS_REQUIRE_FTS` idiom already used for the FTS suites. `GITNEXUS_REQUIRE_ZIG=1` declares "this runner has a prebuild, the grammar MUST be here", and a missing grammar becomes a failure instead of a skip. tree-sitter-zig@1.1.2 publishes prebuilds for {darwin,linux,win32}- {x64,arm64}, so the flag is set on two required jobs that all run on covered platforms: the sharded ubuntu `tests` job and the three-OS `abi-assert` job. - test/helpers/optional-grammar.ts: the registry mapping a language to its require-variable, plus `describeGrammarPresence`, a presence assertion that FAILS when required-but-absent. Deliberately a separate test rather than flipping the suites from skip to fail: a skipped suite reports success, so only a failing test can turn "Zig never ran" into a red job. - parser-loader-abi.test.ts: the optional exemption is revoked for a language the environment declares required, so an ABI-broken Zig binding fails the smoke instead of passing as a clean absence. - optional-grammar-gate.test.ts: pins the two ways the gate could silently never fire — reading a variable name CI does not set, or accepting a value CI does not write. Nothing changes for a run that leaves the variable unset: local runs and any future prebuild-less platform still skip. Verified both directions -- `GITNEXUS_REQUIRE_ZIG=1` alone: 149 passed, 0 skipped; with `GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1` forcing the grammar away it fails 2 tests with an actionable message; with the skip flag but no require flag it is green-by-skip exactly as before. Addresses the test-only blocker in the gitnexus-check review of #1432. * fix(zig): type the optional-grammar gate by grammar key, not language The gitnexus-check finding on parser-loader-abi.test.ts:155 is right, and none of the gates caught it: `tsconfig.json` includes only `src/**/*`, so neither `tsc --noEmit` nor CI typechecks the test tree, and vitest strips types without checking them. Confirmed with a scoped tsc run over the file: `error TS2345: Argument of type 'string' is not assignable to parameter of type 'SupportedLanguages'`. Not fixed with the proposed `key as SupportedLanguages` cast, which would assert something false: `listGrammarSources()` yields one row per SOURCES entry, including variants like `typescript:tsx` that are not enum members. `isOptionalGrammarRequired` now takes the grammar KEY it is really given, and the registry keeps a `satisfies Partial<Record<SupportedLanguages, string>>` so every key we write is still pinned to a real language. Two new cases cover the failure mode the type error was pointing at — a registry key that can never match what the ABI smoke passes, leaving the gate configured-looking and permanently inert: every OPTIONAL_GRAMMAR_ENV key must be a key `listGrammarSources()` yields and must be marked optional there, and an unregistered variant (`typescript:tsx`) must not be required even with the variable set. Same blind spot, two more latent errors in files this PR adds, both fixed: `Parser.Language` is not an exported member (use the `setLanguage` parameter type, as parser-loader-abi.test.ts already does), and the `ParsedImport` filter did not narrow the union, so `localName` was read through a `!` on an arm that has no such property — now a type predicate. The one remaining error under the same probe, in `resolvers/callable-value-flow.test.ts:319`, predates this branch (authored 2026-07-17, on main) and is left alone. structural-pair-coverage's optional-grammar case switches from `it.concurrent.each` to `it.concurrent.for`: only `for` passes the test context as a second argument (`each`'s callback is `(...args: T[])`), and that context carries the dynamic `skip()` the per-language gate calls. Behaviour is unchanged — grammar present: 10 passed; grammar forced away: 9 passed, 1 skipped. Whole test tree typechecking is a separate, much larger job: the same probe over `test/**` minus fixtures reports 734 pre-existing errors across the repo. Out of scope here. * fix(zig): address tenth gitnexus-check review pass - `normalizeZigDepPath`: normalize backslashes BEFORE the absolute-path check. A UNC dep (`\\server\share\dep`) used to slip past the check and normalize to the repo-relative `server/share/dep`; root-relative `\dep` had the same hole. Both now return null. Regression case added to the absolute-spellings test with the files those misreadings would resolve. - `bindPayloads`: a pointer capture `for (pages) |*p|` now records `*Page` (declaredSpelling) instead of `Page` — the `*` is an anonymous payload child before the identifier. Method dispatch is unchanged (`rawName` strips the sigil), but a deref projection `const q = p.*;` now sees the pointer layer. New fixture fn `viaPtrCaptureDeref` + assertion; fails on the previous code (verified by stashing the src fix). - `optional-grammar-gate.test.ts`: renamed the `typescript:tsx` case — the key IS a registry row; what makes it inert is the missing gate entry. Now also asserts a key no registry yields. - `structural-pair-coverage.test.ts`: header updated — ten tables (not eleven) are absent from every rule's target side; `Union` left the set when Zig made it linkable. - `language-classification.ts`: doc comment now names zig in the experimental set (added after Ring 1). Not re-fixed (invalid findings): - "owner-hook contract wired to an undeclared variable": stale-diff read — `findEnclosingClassInfo` declares `resolveFileTypeOwner` / `resolveContainerTypeOwner` as optional parameters (ast-helpers.ts:905, 917) and parse-worker threads them at every call site; tsc compiles clean. - "optional Zig grammar added unconditionally to the parsing fixture suite": the cited block only `fs.readFile`s the committed fixture file to assert it is non-empty — no parser or grammar load is involved. * fix(scope-resolution): mark construction-site CALLS edges in reason (opt-in), enable for Zig PR #1432 human review, item 2: a Zig struct literal `T{ .f = x }` (no parens) is modelled as a CALLS edge to the type — the Rust `T { .. }` / Go `T{}` shape — and nothing on the edge told it apart from an invocation (`get_next_spawn → SpawnRequest` from seven `return SpawnRequest{ … }`). `ScopeResolver.markConstructionSites` (default off): when set, the edge emitted for a `callForm === 'constructor'` site gets ` (constructor)` appended to its reason, in both emit paths — `local-call (constructor)` / `import-resolved (constructor)` in the free-call fallback and `scope-resolution: call (constructor)` in the reference bridge. The Zig resolver opts in. `Reference` gains an optional `callForm`, copied from the site by `buildReference`, so the bridge can see the form. Why `reason` and not a property or edge type: relationships carry no arbitrary properties, a new column changes the relation DDL and moves SCHEMA_FINGERPRINT, and `reason` is the channel the IMPLEMENTS `-pointer` receiver form already uses. Why opt-in: the unsuffixed strings are a pinned contract asserted verbatim by the other language suites (php/cpp constructor calls expect exactly `import-resolved`); every non-Zig edge stays byte-identical. Tests: `references-to-edges-call-form.test.ts` pins both vocabularies and the default-off behaviour; `zig.test.ts` asserts `Reflect.string → Accessor` / `Reflect.url → Accessor` carry `local-call (constructor)` next to a plain invocation, and that every marked edge targets a Struct. * feat(zig): track qualified struct literals (`mod.T{…}`) as construction sites PR #1432 re-test (issue comment on 97571d23): 163 qualified literals `mod.Type{ … }` in a real project produced no CALLS edge at all, so only same-file and imported-name literals were tracked as construction sites. One query rule captures `(struct_initializer (field_expression object member))` as `@reference.call.constructor` WITH the receiver. Captured as a free constructor instead, the site resolves by its simple tail and a workspace-unique `Thing` answers for `c.Thing{}` whichever module the source named (measured: c.zig defines no `Thing`, the edge went to a.zig's). With the receiver the site takes the receiver-bound namespace case — the path `mod.fn()` takes — which resolves inside the module the receiver is bound to: `a.Thing{}` / `b.Thing{}` bind their own files, `c.Thing{}` binds nothing, `std.Thread.Mutex{}` binds nothing next to a local `Mutex`. That case's edge now goes through `constructionSiteReason` too, so the opt-in marker (`import-resolved (constructor)` / `global (constructor)`) reaches it; `markConstructionSites` joins `ReceiverBoundProviderSubset`. Byte-identical for every provider that does not set the flag. Also answers the twelfth gitnexus-check pass: the `bodyNodeSet.size === 0` guard on the extractor factories' no-wrapper branch is deliberate (a config with wrappers whose node lacks one is a bodiless declaration); the two comments now say so instead of reading as a universal last resort. Go's method config, the only other empty-`bodyNodeTypes` config, never reaches the branch (its `extract()` gates on method/function nodes the class-node caller never passes). Tests: new `zig-qualified-literal` fixture (same-named `Thing` in two modules, a module without it, an external `std` qualifier next to a local and an imported `Mutex`); `zig-basic` pins `pioneer.Pioneer{…}` and the union `pioneer.Tag{…}` as marked construction sites. * feat(zig): resolve hub re-exports, enum-variant receivers and type-named receivers (real-project audit) Audit of three real Zig projects indexed with this branch (tigerbeetle 246 files, mach 132, ghostty 788): method reachability was 63 % / 35 % / 55 %, and three shapes accounted for most of the misses. 1. Hub modules. Zig projects publish types through a file made only of re-exports (`pub const Terminal = @import("Terminal.zig");`, `pub const PRNG = @import("prng.zig");`, `pub const Thing = @import("thing.zig") .Thing;`). Such a file owns NO local binding, and `findExportedDef` reads local bindings only — so `terminal.Terminal.init()`, `t: stdx.Thing`, `var p = stdx.PRNG.from_seed()` and `h: stdx.BoundedArrayType(u8, 4)` all resolved to nothing. Measured before → after: CALLS into ghostty's `src/terminal/` from outside it 46 → 253 (150 `terminal.Terminal.` sites alone); into tigerbeetle's `stdx` hub from outside it 837 → 1500 (136 static calls, 289 annotations). Method reachability: tigerbeetle 2249 → 2272 of 3544, ghostty 2766 → 2865 of 5016, mach 1047 → 1051 of 2967 (mach's hub publishes generic instantiations, `pub const Quat = q.Quat(f32)`, a shape this commit does not cover). `findExportedDefIncludingImportedNames` reads the finalized channel (origin import / namespace / reexport, def already resolved to the declaring file), refusing a name bound to two distinct defs. Opt-in per provider (`namespaceExportsIncludeImportedNames`): a module's imports are not its exports in most languages; Zig opts in because a hub member a consumer can name is public by construction. Used by receiver-bound Case 1, Case 3, the compound resolver's namespace branch, and a new Case 2 route that resolves a namespace-qualified class receiver (`stdx.PRNG`) through the same lookup. 2. Enum variants as receivers. `Operation.create_accounts.event_max()` (147 sites in tigerbeetle): a variant has no written type, but it has one — the enum itself. `emitZigScopeCaptures` now emits a field type binding per enum variant, so the field walk that already handles `self.session.name()` types `Op.create` as `Op`. 3. Receivers named after their type. `self` is a convention, not a rule: tigerbeetle writes `replica: *Replica` (777 of 1127 methods), mach `pool: *@This()` (764 of 833). Reading only `self` as the receiver labelled all of them `isStatic: true`, counted the receiver in their arity (`Counter.incr#1`) and sourced the scope binding as a plain parameter. `zigReceiverParameter` is the single rule for both phases: the FIRST parameter when named `self`, or typed as the enclosing container (`@This()`, its binding name, a `const X = @This();` alias), pointers / const / optionals stripped. Fixtures `zig-hub` and `zig-receivers` pin each shape, including the refusals: a private hub import does not leak, a foreign-typed first parameter is not a receiver, a factory stays static. * fix(zig): address thirteenth gitnexus-check review pass - File-struct receivers named after the file stem were always static: the method builder called `isStatic` / `extractReceiverType` / `extractParameters` without the extractor context's `filePath`, so `zigReceiverParameter` could not name a file-struct (`fn add(ledger: *Ledger)` in `Ledger.zig`, no `Self` alias) and the fn came out static with the receiver in its arity (`Ledger.add#2`) — an id the scope side, which always has the path, never produces, so its CALLS edges went nowhere. `MethodExtractionConfig` now passes `filePath` as an optional trailing argument to those three hooks (same shape as `extractOwnerName`); the Zig config threads it through, every other config ignores it. Regression tests in `zig-extractors.test.ts` (unit) and `resolvers/zig.test.ts` (new `Ledger.zig` in the `zig-receivers` fixture: ids, `isStatic`, and the three CALLS edges); both fail on the previous source. - `LINKABLE_LABELS` comment: the remaining `CLASS_KINDS` entries include `Namespace`. Not re-fixed: - "Ownerless-method assertion regex cannot match `.zig` graph IDs": the `[^:]+` segment consumes the whole file path (dots included) up to the second colon, and `[^.]+#\d+$` then matches only an owner-less name — `Method:src/Sorter.zig:lessThan#3` → true, `…:Sorter.sortBoth$1.lessThan#3` → false, checked with node. - "Public namespace imports are never marked as re-exports": the shared `ParsedImport` namespace variant has no `reexportsName` field and `contributesReexportEdge` excludes namespace drafts on `base.kind` by contract; a `pub const X = @import("x.zig")` hub member is exposed through `findExportedDefIncludingImportedNames` instead, which is what the audit commit added for exactly that shape. - "Private Zig namespace imports are treated as public hub exports": a private import cannot be named through the hub in code that compiles, and `findExportedDef` applies the same no-visibility rule to local defs; the finalized binding channel carries no `pub` bit to check. - "Range binding mutates finalized scopes" and "unconditionally adds an optional Zig grammar to the fixture suite": refuted in the tenth and eleventh pass notes of the PR body, unchanged since. * fix(zig): close the adversarial review's ten findings (8.2–8.12) PR #1432 review 5095267917 on 34c53473 retained eight P1 and two P2 findings; each is reproduced on the new `zig-chains` / `zig-buildmodules` fixtures with the decoy that made the old answer wrong, and pinned by a test named after its number. - 8.2 per-build-module import tables (`parseZigBuildModules`): a source resolves a bare name through its own module's `addImport` table (root file, else deepest root directory), fails closed when same-directory modules disagree, and follows `addImport("api", dep.module("core"))` through the dep's `addModule`; repo-wide names and zon deps remain the fallback. - 8.3 module-level value receivers (`zigHostValueNames`) prepend the implicit `self` like fn-locals, so `global_runner.run(cb)` joins `cb@1`. - 8.4 deep member aliases (`@import("lib.zig").B.work`, `lib.B.work`) keep the written owner: the module is bound as a namespace and the alias's use sites are rewritten to `receiver . member`; only one-level aliases are promoted to named imports. - 8.5 container-hosted containers get owner-qualified identities (`A.Item`, `B.Item`, `Outer.Inner`), minted by the bare-container rule, while the scope keeps the lexical binding. - 8.6 result-location `.init(…)` / `.{…}` under an annotation, a return type or a field type emit the call / construction site with the expected type as receiver. - 8.7 Zig arm in bench/import-target (five dispatchers, config-free fingerprint) + baselines row; `--check` passes. - 8.9 fn-local `@import` bindings and their uses are keyed per callable (`m$f_sib_a`), so sibling fns no longer share one namespace bucket. - 8.10 `ScopeResolver.resolveNamespaceChains` (opt-in, Zig only): Case 1 / Case 2 / Case 3 and the compound resolver walk a qualified receiver segment by segment — republished modules, nested types, enum variants through the module — refusing ambiguous hops. Off, every lookup keeps its one-hop split; the 70 resolver suites are unchanged. - 8.11 `@import("a.zig").Thing{}` binds the module as a namespace in type position; `List(u8){}` / `lists.List(u8){}` get constructor sites. - 8.12 a fieldless file whose top-level fn takes the file's own type (`self: *@This()`, `self: *Self`) is a file-struct; two over-matching ZIG_QUERIES rules are filtered by `shouldSkipDefinitionCapture`. Also asserts the committed `opmod.Op.lookup.event_max()` call in zig-hub. * fix(zig): address gitnexus-check findings on 215f70e3 - receiver-bound Case 3 wraps its reason in constructionSiteReason, like Case 1 and the nested-type route of Case 2 (one vocabulary per provider) - resolveZigImportInternal rejects drive-qualified absolute imports (C:\foo.zig), the same test normalizeZigDepPath applies; unit case added - the compound resolver's chain seed also tries the whole receiver as the qualified class (opmod.Op), as a bare class-name head already does - markConstructionSites contract text names the receiver-bound routes The return_type field claim is refuted: tree-sitter-zig exposes a fn's return type as the type field (checked on the grammar). * fix(zig): a build-module alias bound to an unindexed root fails closed resolveThroughBuildModules returned undefined when the containing module bound the alias to a file that is not indexed, which let the repo-wide addModule map answer under the same name (gitnexus-check on 5299c552). The module's table is the authority for its aliases: bound-but-unindexed is null, only an unbound name falls through. Unit case with a same-named repo-wide decoy, plus the outside-module file that still reaches it. * fix(zig): an unindexed root module fails closed, never a same-named zon dep The root build.zig's addModule declaration is authoritative for a bare name when it binds it; a root that is not indexed used to fall through to a build.zig.zon path dep of the same name — a different declaration answering under the name (gitnexus-check on fe24b37f). Same rule as the build-module tables. Unit case added. * Address PR review feedback (#1432) Tighten Zig build-module parsing, receiver/merge helpers, and container queries that gitnexus-check flagged on the open threads. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#1432) Attach the paren-matcher doc comment to findZigParenEnd instead of zigTopLevelStaticRoot. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify Zig review-feedback helpers after #1432. Reuse ZON brace/string walkers for top-level root_source_file, drop the dead bind flag and one-off staticRoot wrapper, and merge bindings via a first-wins map. Co-authored-by: Cursor <cursoragent@cursor.com> * bench(receiver-resolution): rebaseline for the Zig lang-resolution fixtures The receiver-resolution gate (#2856/#2899) landed on main after this branch forked and counts call drops over test/fixtures/lang-resolution, which this branch extends with the zig-* fixture projects. Regenerated with `measure.mjs --update-baseline`: callDrops 102 -> 113, all 11 new drops in .zig files, shape `no-chain`. Every new drop is a call whose callee has no node in the corpus, not a resolver regression: `std.Build.Module.addImport` in the three build.zig fixtures (7, classified in-program), `std.sort.pdq` in Sorter.zig (2, unknown), `std.Thread.Mutex{}` / `std.mem.Allocator{}` literals in zig-qualified-literal (2, unknown, the fixture asserts std stays external), and one `.init()` decl literal on a generic instantiation (`const u: Stack(u16) = .init()`, in-program). Shape arm unchanged. --------- Co-authored-by: Garrett Griffin-Morales <grgisme@gmail.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-03 13:29:42 +01:00
glier	b15ff2d888	feat(ingestion): mint Destination nodes from AsyncAPI 3.x documents (#3140) ... * feat(ingestion): read AsyncAPI 3.x documents into broker addresses Adds a format-driven reader that turns the `operations[]` entries of an AsyncAPI 3.x document into (broker, address, direction) triples, plus the protocol-to-broker map behind it. Nothing consumes it yet. The reader lives outside `frameworks/spring/` on purpose, like `destination-key.ts` and for the same reason: an AsyncAPI document is a published artifact emitted by generators across several language toolchains and written by hand as often as generated. The entry criterion is therefore the document format -- a root `asyncapi` key -- and never the generator. AsyncAPI 2.x is refused under its own countable reason rather than mapped. Its `publish`/`subscribe` are inverted relative to 3.x `send`/`receive`, so a naive mapping reverses every direction in the async graph while leaving it connected: nothing fails, the arrows simply point the wrong way. A silent skip would be indistinguishable from "this service publishes no document", which is the one thing the refusal count has to be able to tell us. The broker is read twice over -- from the operation's bindings and from its channel's server protocol -- and the two readings must agree. A destination keyed on the wrong broker joins a stranger, and with the document contradicting itself there is no way to tell which reading is right, so the operation is refused rather than decided by a coin flip. An unmapped protocol passes through as its own literal instead of being dropped, because `destinationNodeKey` takes a plain string precisely so a non-Spring caller can attest to a broker Spring has no member for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(cli): add --asyncapi-spec, an explicit path to AsyncAPI documents Threads an `asyncApiSpecPath` option from the CLI, the server analyze endpoint, and the programmatic entry through to `PipelineOptions`. Nothing reads it yet; the reader added in the previous commit is still unwired. Shaped deliberately after `springActuatorPath`, the existing option for an out-of-band artifact: an explicit local path, accepting a directory or a single file, resolved against the repository root so a committed `docs/asyncapi` and an absolute cache populated by something else are both natural, and `undefined` keeping the feature entirely off. Mirroring that option rather than inventing a mechanism is what lets a downstream consumer point the reader at documents fetched out of band without patching a file here. `analyze --watch` REJECTS the flag, exactly as it rejects --spring-actuator. The watcher reacts to source changes and nothing watches a document directory, so honouring it there would read the documents once and then serve a stale answer for the rest of the session -- worse than refusing, because it looks like it worked. Additive only: 49 inserted lines, no deletions and no modified lines. Every new interface member is optional and every forward is an object-literal spread of an undefined value, so with the option unset the analyzer takes byte-identical paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(ingestion): mint Destination nodes from AsyncAPI documents Wires the reader into the destinations phase. With `--asyncapi-spec` set, every `send` operation emits PUBLISHES_TO and every `receive` emits CONSUMES_FROM against the ordinary resolved `Destination` node -- same key, same `address` property -- so a document and a source site that name one address on one broker land on ONE node and the two halves of a conversation meet. Verified end to end: an address named only in a document is minted with the right broker and direction, and an address a source site already resolved stays a single node with its own `literal` provenance while the same address on a different broker stays separate. This claims only what a document states -- that the service talks to that address, on that broker, in that direction -- and never which method does it. The addresses in one document partition by (broker, action) into buckets that usually hold more than one operation, so any assignment past a bucket of size one is a heuristic, and a wrong one attaches a real address to the wrong handler: a false connection wearing the clothes of a resolved one. The edge therefore starts at the document, not at a callable. That is weaker than a source-derived edge and worth having anyway, because it is available where the source supplies nothing at all -- a programmatically registered listener, a broker with no patterns here, a language whose messaging idiom nobody has taught this codebase yet. Documents are read even when the source pass found no messaging, which is why the early return had to move: a repository whose brokers are invisible to the patterns is precisely the case a published document covers, and an early return keyed on source sites skipped the documents exactly there. Their counters are kept in their own block rather than folded into the existing ones. `refusalsByReason` is the denominator of the SOURCE unresolved fraction, and a mistyped specification directory must not be able to make the source look worse than it is. The block is absent -- not zeroed -- when no path was configured, so "not asked for" stays distinguishable from "asked for and found nothing"; those need different answers from an operator and one zero cannot say which happened. The direction assertion is the one that matters and it is pinned by type, not by existence: inverting the mapping in the source tree fails exactly one test, because every other assertion passes identically under both readings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: document --asyncapi-spec and why step 4 of the cascade stays empty Adds the flag to both READMEs and to the three byte-identical copies of the CLI skill, which a sync test pins together. Also rewrites the note on the `specification` seam in the address cascade. It said "nothing supplies it today", which was true and is now misleading: a reader exists, and the hook is still unsupplied because of a decision rather than for want of one. A document names addresses; it does not name the method that uses one. To hand an address to a particular candidate something must choose which of the document's operations belongs to it, and the only division both sides agree on -- (broker, action) -- leaves buckets that usually hold more than one operation. On a real generated document exactly one bucket of four was unambiguous. Every assignment past a bucket of size one is a heuristic, and a wrong one puts a REAL address on a joining node under the wrong site: a false connection wearing the clothes of a resolved one, which is the outcome the keying rule exists to prevent. The note also records the two things that would change that and are not heuristics -- a document carrying the implementing symbol, or a configuration source answering the `${key}` the candidate already recorded -- and that the second wants its own resolver, since what it needs is the placeholder key rather than the candidate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): refuse the document shapes that would forge a join Four ways a conformant AsyncAPI document could mint a Destination that connects two services which have said nothing about each other. Every one is reachable from ordinary 3.x vocabulary, not from malformed input, and each is now a countable refusal. A PARAMETERIZED ADDRESS is a pattern, not a place. Two services that publish `{env}.orders` share a template; one deploys with env=prod and the other with env=staging, and keying on the template text merges them into a single node with a publisher on one side and a subscriber on the other. This is the document-side twin of `overridable-config-default`, which argues the same thing about `${key:default}` in source. A channel declaring `parameters` is the specification's own statement that its address is a template, so the detector is a reading rather than a guess; the `{` test catches generators that template without declaring. ANY BINDINGS KEY WAS TAKEN AS A PROTOCOL. AsyncAPI allows `bindings` to be a Reference Object, so the map's own key can be `$ref` -- and passed through, that becomes half of a join key carrying no broker information at all. Two services that both reference shared bindings and both name `orders` then land on one node, defeating the broker-in-key rule that keeps `kafka orders` and `rabbit orders` apart. A broker must now be spelled like a protocol name. A BROKER CONTAINING A SPACE COLLIDES, because the node key joins with one: ("kafka orders", "x") and ("kafka", "orders x") are the same key. That was latent while every broker came from Spring's closed union. This module is the first caller to feed the shared helper text that a document wrote, which is exactly the condition under which it stops being latent, so it is closed here -- at the producer -- rather than by changing an encoding that `routeNodeKey` shares. THE ADDRESS WAS TRIMMED, while the source cascade keeps an address exactly as written so `" orders "` stays its own node. Two producers of one key held opposite whitespace policies and the document side erred toward joining. Also: fold the transport-security protocol variants (`kafka-secure`, `secure-mqtt`, `wss`, `stomps`, `https`) onto their base protocol. The `amqp`->`rabbit` argument already in this file demands it -- AsyncAPI's server vocabulary distinguishes them and its bindings vocabulary does not, so a secured cluster's own document was being read as self-contradictory. Treat a channel with no `servers` as available on all of the document's servers, which is the specification's default and was costing every single-server document its destinations. Bound the address and operation-id lengths, because `generateId` concatenates rather than hashes, and bound total operations across the run rather than only per document. Read each file through ONE handle for both the size gate and the read, as `actuator-runtime.ts` does and for the reason its comment gives (CodeQL js/file-system-race): re-resolving the path lets a swapped file bypass the cap, and the out-of-band cache this option reads is written by other tooling by definition. Open it with O_NONBLOCK: the type check that rejects a FIFO is unreachable without it, because opening a FIFO for reading blocks in open(2) until a writer appears -- found by writing the test first and watching it time out rather than fail. Count symlinked entries and walk truncation instead of dropping them in silence. A symlinked cache and a wrong path were producing identical results. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(analyze): rebuild when documents are configured, and report what was read An AsyncAPI document is external to git freshness in exactly the way an Actuator snapshot is: replacing one moves no commit and dirties no file. The option's own README paragraph advertises an absolute cache written by other tooling, and on the second run of that workflow the already-up-to-date fast path fired, no document was ever opened, and the previous run's addresses were served as current. Measured, not reasoned: editing a document and re-running printed "Already up to date" and left the old address in the graph; with this change the same probe re-reads and the new address replaces it. So an enabled run forces a rebuild and dropping the option forces one more, to clear document-derived evidence -- the treatment `springActuatorPath` already gets, for the same reason. Only the FLAG is recorded in index metadata, not the path: Actuator retains its inputs so future scans keep excluding them, whereas a committed document is deliberately NOT excluded (it wants its real `File` node), so there is nothing to retain and recording the path would put an operator's directory layout into metadata for no consumer. That also settles a defect it would have been tempting to patch separately. A synthetic `File` node for an out-of-tree document carries a path that is in no write set and is not covered by `isGraphWideNode`, so an incremental writeback dropped the node while keeping its edges -- which then COPY against a row that was never written, and fail into an IGNORE_ERRORS retry that reports success. A forced rebuild has no incremental subgraph to get that wrong. Distinguish the two meanings of `resolution: 'specification'`. That value belongs to the address cascade and means a CODE candidate was resolved through the step-4 hook; a node minted from a document has no code site and now says `asyncapi-document`. Reusing one string would leave a query that groups by provenance unable to separate an address a document states from one a document was used to resolve, and only the second is a claim about source. Report what was read. The stats block was justified on the grounds that an operator must be able to tell a mistyped directory from a repository with no documents -- and nothing surfaced it, so the justification was aspirational. A configured path that yields nothing, or a walk that hit a bound, now warns unconditionally, as `spring-auto-configuration.ts` does for the same class of input. The phase summary carries the refusal breakdown rather than only the totals, because the unresolved fraction is the number this work is judged on and a bare count says how big the gap is without saying what would close it. Tests for the three wiring lines that were individually deletable with a green suite, following the templates already in the repository: a row in the `--watch` rejection table, the CLI-threading assertion beside the Actuator one, and the shipped-skill fragment that pins the flag in all three copies. Also pin `filePath: ''` on a spec-minted destination -- the half of the keying rule that stops a shared node becoming collateral damage of one document's next change -- and the in-repo `File` branch, which was dead-code-able. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): close the join-forging paths a second review round found The `$ref` exclusion added last round fixed one instance of a class and left the class open. A `bindings` map key of `x-scs-function` -- an ordinary Specification Extension, which generators emit -- still became the broker, so two unrelated services carrying one vendor annotation and one address landed on ONE node whose broker half said nothing about any broker. And `{ kafka: {}, x-internal: {} }` read as two brokers, losing a conformant document and reporting it as self-contradictory, which also made any document author a one-line saboteur of their own cross-service links. So the two readers are now separate functions with opposite defaults, and the header says why they must be. `servers[].protocol` is a FIELD DECLARED to hold a protocol: an unrecognized value there is the document's own claim and passes through, because refusing it would lose a destination the document states plainly. A `bindings` MAP KEY is not that -- the specification puts `$ref` and `x-` in the same namespace -- so a non-protocol key is the EXPECTED case and only AsyncAPI's binding vocabulary may answer. The syntactic test that was applied to both was the right rule for one of them. The walk fix from last round introduced something worse than it reported. A shared abort flag meant depth exhaustion in ONE branch terminated the whole traversal, so ten good documents beside a twelve-deep unrelated subtree were kept or lost depending on whether that subtree sorted before or after them. Truncation and budget-exhaustion are now separate: depth returns from its own branch, and only a genuinely global bound stops the walk. Rewriting `protocol.ts` dropped the whitespace check from the server-protocol path and made the node-key collision reachable again. The test written for that collision last round caught it within the minute; the comment now records that it was learned twice. Everything else measured this round: - The broker is the THIRD string that reaches a graph identifier, and it was unbounded while the header claimed there were two. A one-megabyte protocol in a document satisfying every other cap was measured producing a gigabyte of resident identifier strings, because `generateId` concatenates rather than hashes and the phase mints one id per node and per edge. - The run-wide operation budget counted ACCEPTED operations, reproducing at the run level the exact defect the per-document cap was corrected for last round: a run whose every operation is refused never decrements it. Both now count operations EXAMINED, and `operation-cap` sets `truncated` -- it is a bound that stopped the operation count, which is what that flag is documented to mean. - The channel-inherits-all-servers rule ran per operation. Hoisted: it depends only on the servers. - A subdirectory that cannot be listed is counted rather than dropped, so a mixed-permission cache cannot report a clean, complete read. - The read LOOPS, like the Actuator reader this claims to follow. A single read was never short across seven hundred probes on APFS, but POSIX permits it and FUSE mounts with `direct_io` -- the deployment this option targets -- return short counts. A document truncated at a line boundary still parses, so the failure is silent: operations vanish with `refusals: {}`. - `parameters: {}` no longer refuses a literal address; an empty container states nothing and generators emit them. - A channel that is itself a Reference Object gets its own reason instead of `no-address`, which was telling operators their documents omit addresses when the reader simply stops one hop short. - A multi-protocol document resolves from its operation's own bindings; only when those are silent does an inherited multi-protocol server set refuse, and under `ambiguous-server-default` rather than a reason that says the document contradicts itself. It does not. - HTTP and WebSocket are refused for destination minting. For a broker the topic is the namespace; for HTTP the host is, so keying on the path alone would make every service exposing `/events` one node. A `Route` already models an HTTP endpoint, with its method in the key. - The sniff window is a parse gate, not a read gate, and four kilobytes refused a good document behind a licence header. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(ingestion): pin the wiring and the reporting that were deletable Three lines could be deleted with the whole suite green, and each of them makes the feature partly or wholly inert: the forward from `run-analyze` into `PipelineOptions`, the forced rebuild while documents are configured, and the cleanup rebuild when the option is dropped. None is visible one layer up, where the CLI test asserts on a mock's arguments. One integration test closes all three. It drives the real `runFullAnalysis` against a real repository and asserts, in order: the enabled run does not take the up-to-date fast path and logs the rebuild; the destination reaches the graph, which only happens if the option is forwarded; a document edited with the tree clean and the commit unchanged is re-read; dropping the option rebuilds once and removes the document-derived evidence; and the run after that is up to date again -- the "rebuilds once" half, which rests on the metadata being written as a fresh literal rather than merged, and which nothing pinned. The document lives OUTSIDE the repository on purpose. That is the workflow the option is documented for, and it is the only one where the hazard exists: editing a tracked file dirties the tree and forces a rebuild anyway, so an in-repo fixture would pass with the freshness fix reverted. Verified by reverting both: deleting the forward fails on the empty destination list, deleting the forced rebuild fails on the missing log line. Also pinned, each because deleting the code it covers left the suite green: the `parameters` half of the templated-address refusal (its old test supplied a braced address too, so the `{` half alone satisfied it); the phase actually forwarding `symlinksSkipped`; the unconditional warning, whose whole argument is that a tally nobody can see is not a tally -- captured through the repository's own `_captureLogger`; a `.yml` document; a character device, which is the case the `isFile` check exists for and which the FIFO test does not reach; and the bound that stops a walk. Reject an empty `--asyncapi-spec` at the CLI. It resolved to the repository root and walked the whole tree, defeating this module's own rule that there is no glob-based auto-discovery -- and the HTTP entry point already rejected the identical value. Two doors onto one option must not hold different rules. Surface the flag in the MCP context resource beside `spring_actuator`. It matters more there than for its neighbour: Actuator annotates nodes the source pass already found, while document reading mints destinations and edges with no code site, and nothing said where they came from. Log the configured path relative to the repository. The same change refuses to persist that path to index metadata because it would record an operator's directory layout; holding that rule for metadata and not for logs was holding it in one place. Both test files now clean up their temporary directories. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * style(ingestion): apply the repository's prettier contract `quality / format` runs `npx prettier --check .`, and three files added by this branch were not formatted to it. No behaviour changes: the reader's line breaks and two test literals move, nothing else. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(ingestion): release the mini-repo handle the document test allocated `setupMiniRepo` documents that the caller owns cleanup, and every other test in this file calls `repo.cleanup()` in its `finally`. The AsyncAPI document test removed only the document directory, so each run left a temporary repository behind. The two owners are separate on purpose: the document directory is a SIBLING of the repository, placed outside the working tree so that editing it cannot dirty the tree and force a rebuild on its own. The repo's cleanup therefore does not reach it, and both calls belong in the same block. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ingestion): stop partial server evidence from reading as unanimous Six review findings, every one a way this reader could name a broker the document does not name. They share a shape: something is DROPPED rather than refused, the remaining evidence agrees with itself, and an operation is attributed with confidence to a broker its document never settled on. A wrong broker is half a join key, so it does not produce a missing edge -- it produces an edge to a stranger, reported as a fact. CAPPED SERVER MAPS. A channel with no `servers` inherits all of them, and that map is capped at 1,000. A document whose first thousand servers are Kafka and whose thousand-and-first is JMS read as unanimously Kafka, because unanimity was tested on the slice. Counted `server-cap` and set `truncated`, but neither stopped the attribution. The inherited path now refuses under `capped-server-default` -- checked BEFORE agreement, since a subset agrees with itself for free. ROOT SERVER REFERENCE OBJECTS. The Servers Object patterned field is `Server Object | Reference Object`, so `{ $ref: '#/components/servers/prod' }` is conformant. Reading `protocol` off the raw value dropped every one: an all-reference document had no protocol at all, and -- worse -- a MIXED set lost its disagreeing half and became unanimous. One hop is now followed, through `#/servers` and `#/components/servers`; anything else is refused under `unresolved-server-reference` rather than skipped. CHANNEL BINDINGS. Only the operation's bindings were read. A conformant channel carrying `bindings: { kafka: {} }` with no operation binding was dropped as `protocol-unknown` while the document said plainly which broker it meant, and a disagreement between the two levels was invisible. Both are read; a conflict is `protocol-disagreement`. EMPTY `servers`. "If `servers` is absent or empty, this channel MUST be available on all the servers defined in the Servers Object" -- one sentence, both cases. A zero-iteration loop returned `explicit: true`, which blocked the inherited fallback and dropped valid operations. POINTER DECODING ORDER. RFC 6901 percent-decodes the fragment BEFORE splitting on `/`. The raw token was tested for a separator first, so `#/channels/orders%2Fv1` passed a check it should have failed and then decoded into two segments -- a pointer addressing `channels.orders.v1` was read as a channel named `orders/v1`, inventing a channel the document never declared. A malformed escape is now refused rather than resolved against its undecoded text. `~1` still resolves; it is the pointer's own escape and belongs after segmentation. THE SNIFF WINDOW. A fixed window decides by where the root key sits rather than whether it is there, so every window is a false negative waiting for a longer preamble -- 4 KiB was replaced by 64 KiB for that reason and inherited the same defect. The whole text is scanned; it is already bounded and already in memory, and the gate exists to skip the PARSE, which is the expensive half. A leading UTF-8 BOM is stripped before both sniff and parse. Twelve of the fourteen new tests were run against the unfixed reader and all twelve failed; the other two are controls that must pass either way. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(ingestion): simplify AsyncAPI pointer and binding resolution Decode each $ref once, union binding evidence, and stop walking capped server maps whose brokers are unused on the inherit path. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-02 22:01:15 +00:00
Yayler	3aa62be717	feat: add gitnexus auto-sync for scheduled remote clone and analyze (#2493) ... * adds an opt-in auto sync and analysis loop for GitNexus * adds an opt-in auto sync and analysis loop for GitNexus,gitnexus watch [init|start|restart|stop|status] * adds an opt-in auto sync and analysis loop for GitNexus,gitnexus watch [init|start|restart|stop|status] * fix: address PR review cleanup * Prettier code style * merge main * fix(watch): protect local repos and cancel active analysis * fix(watch): harden auto-sync lifecycle and locking - validate watch process identity before lifecycle operations\n- serialize registry, analysis, and LadybugDB access with recoverable locks\n- harden clone paths, symlinks, hooks, quarantine, and worker timeouts\n- install procps in the CLI image for reliable Docker watch control\n- add focused regression coverage for lifecycle, locks, clone, and registry behavior * update agents & claude md * merge main * fix(watch): harden auto-sync lifecycle * fix(watch): normalize SSH repo identity paths * fix(watch): normalize SSH repo identity paths * fix(watch): safely cancel analysis across platforms * fix(auto-sync): close worker and group sync failure paths * fix(auto-sync): drop retired allowStale from group sync allowStale was removed from SyncOptions, which broke typecheck and CI on this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): satisfy prefer-const and Prettier in auto-sync The watch timers are assigned exactly once, so prefer-const rejected the deferred `let` declarations. They are only read from `stop()` and the control poll, both of which run after the assignments, so binding them at creation is safe and drops the now-dead undefined guards. Remaining files are formatting only. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): make lock identity absolute and stop three fail-open paths Lock owner identity was rendered by `ps -o lstart=` through localtime and the active locale, so the same live process produced a different string under a different TZ. A mismatch reads as PID reuse, so one daemon could reclaim a mutex another still held. Pin TZ=UTC and LC_ALL=C. The owner record also carried no hostname, so a holder on another machine was judged by this kernel's view of its PID — always "stale" — and its lock stolen whenever GITNEXUS_HOME is a shared volume. Record and compare the hostname, as the index lock already does. Ownership verification threw unconditionally on win32, which is reached once per project per tick, so watch reported `running` and then failed every repo forever. POSIX uid/mode cannot be checked there; skip those two assertions and keep the dangerous-root, symlink, containment and internal-root guards. Also: quarantine sweep now refuses a symlinked root instead of deleting through it; an unreadable state file propagates instead of being rewritten as empty state, which used to erase every repo's analyzed commit and failure count; a failed staging cleanup no longer strands a published lock with no release handle; and the concurrency runner settles every worker before surfacing a failure so cancellation cannot orphan a live analyze fork. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): land the deferred review findings Six findings that were deferred from the review backlog, plus the docs they change. Worker heap: admission allowed `floor(availableMemoryGB / 2)` slots while every fork was handed the whole machine's heap cap, so the budget meant nothing as soon as an operator raised max_concurrency. Divide the cap by the repos actually analyzed in parallel. The default single-project path is unchanged. Registration: the parent registered without a branch, so it always took the primary/flat arm and relabelled a pinned branch entry on the branch-fallback path. Reproduce the worker's own resolveBranchPlacement decision instead. Cancellation: requestCancellation cleared the only timer and settled nothing, so a worker wedged past its safe point left the promise pending forever, wedging activeRun and hanging `watch stop`. Add a 5s grace after which the parent stops waiting and releases the IPC channel's hold on its event loop. The child is still never killed — it may be inside native work. overwrite_local_changes: `checkout --force` rewrites tracked files only, so untracked sources survived and were indexed as if they came from the remote. `git clean -fd -e /.gitnexus` after checkout; no -x/-X, so ignored paths and GitNexus's own storage survive. Quarantine: age alone never bounds a repo that fails every tick, since each partial clone is younger than the retention window. Keep the five newest per repo. Validation: repo_git_timeout is now bounded by the lesser of an hour and the sync interval, which is also the guard for the bare-number-means-seconds slip (`600000` meant ~7 days and cleared the timer ceiling). And the remote URL's final segment is validated at config load rather than failing once per tick inside the sync loop. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): release an errored worker, and stop rejecting dotted repo names Three findings from the latest review pass. The 'error' handler settles immediately rather than waiting out the grace, so cleanup() clears the grace timer that would otherwise have released the child. An errored IPC channel does not mean the worker stopped, so release it on that path too — still no kill. The traversal guard tested the raw path for '..', which also rejected an ordinary name like owner/foo..bar that the repository-name rule accepts. Traversal is a whole segment, so test segments. The heap-cap test left two runs and their real timers pending; it now stubs timers and settles both promises. Registration coverage now pins the branch slot rather than leaving it implicit. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): validate namespace segments and pin the stopped process identity Replacing the raw-string `..` test with a per-segment one dropped a guard: a segment like `..\..\outside` is not literally `..`, so it passed, and those segments build the clone path — on Windows the backslashes are separators. Hold every namespace segment to the same charset as the repo name, which keeps a separator out of a segment while still allowing an ordinary `foo..bar`. The final segment keeps its own check so a bad repo name keeps its own message. The stop wait polled liveness by pid alone, so a pid reused mid-wait would have it wait on an unrelated process and then report the watch stopped. Compare the process start time recorded for the owner, which also returns sooner. Registration now omits `branch` for a primary index instead of passing it as undefined, so that call keeps the shape it had before this branch. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): ship auto-sync as the remote daemon, reserve gitnexus watch. Keep analyze --watch for local incremental re-index and stop the top-level watch verb from starting a clone/pull loop. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): reject invalid branch refs and verify status identity (#2493) Reject leading slashes and per-component trailing dots in configured branches, and verify the live watch owner before trusting a stored error status. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): reject ownerIds that can escape the watch directory (#2493) Stop interpolating a tampered ownerId into the stop-request filename; only basename-safe values are treated as owners. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): recognize auto-sync in the watch-process identity check (#2493) Stop/status were still looking for a standalone watch token after the command rename, so a live gitnexus auto-sync start process would be refused as unrelated. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(auto-sync): reject boolean max_concurrency instead of coercing it to 1 (#2493) Number(true) is 1, so a YAML boolean would have passed the integer check and silently meant one worker. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): swallow status errors in the watch finally path (#2493) An uncaught updateStatus rejection in finally became an unhandled rejection. Skip the clone-root symlink test on Windows, where directory symlinks need privileges. Align the group-lock comment with fail-closed registry timeouts. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): catch cancelling status-write failures (#2493) Fire-and-forget updateStatus('cancelling') could become an unhandled rejection, the same class as the finally-path status write. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): ignore queued interval ticks after stop (#2493) clearInterval does not cancel a timer callback already queued. Guard runSafely on stopping so shutdown cannot start a new un-cancellable run. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auto-sync): report stored watch status timestamps (#2493) status should show when the watch last entered a state, not when the CLI queried it. The failure-count test still expects 1 after a new commit resets the streak; rename it so that reset is explicit. Co-authored-by: Cursor <cursoragent@cursor.com> * style(auto-sync): apply prettier to starter status logger (#2493) Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: weiyf <weiyf3634@163.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-02 19:40:18 +01:00
Gergő Magyar	a82362765c	fix: stop analyze from clobbering customized GitNexus skills (#3124) ... * fix: preserve customized SKILL.md files during analyze Skip overwriting standard GitNexus skill files when they already differ from the bundled template, and keep divergent nested leftovers instead of deleting them. Fixes #3080 Co-authored-by: Cursor <cursoragent@cursor.com> * docs: note --skip-agents-md does not skip skills Point operators at --skip-skills so the AGENTS/CLAUDE skip flag is not mistaken for a full agent-file freeze. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): treat unreadable SKILL.md as an error, not missing Only ENOENT counts as absent so EACCES cannot fall through to recursive rm. Strengthen the skipSkills nested leftover test with a bundle-identical file that install would otherwise delete. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): prettier-format ai-context unit tests Co-authored-by: Cursor <cursoragent@cursor.com> * docs: clarify --skip-agents-md vs community --skills Co-authored-by: Cursor <cursoragent@cursor.com> * test: pin GITNEXUS_LANG=en for skip-agents-md help assertions Co-authored-by: Cursor <cursoragent@cursor.com> * fix: preserve customized skills in analyze summaries and setup Report preserved vs written skills, keep leftover nested directories that contain extra files, and skip setup overwrite of divergent SKILL.md. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3124) Preserve operator-edited files inside directory skills during setup, and restore GITNEXUS_TEST_SKILLS_ROOT after the Antigravity skill tests. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3124) Copy directory-skill companions even when SKILL.md is customized, while still skipping files whose bytes already differ from the bundle. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 09:56:48 +00:00
MyShining	c217a0f257	feat(spring): import optional Actuator runtime data with Kotlin JVM mapping (#3107)	2026-09-01 06:22:38 +01:00
简律纯	5bad2d8b0b	fix(mcp): resolve omitted repo from cwd (#3085) ... * fix(mcp): resolve omitted repo from cwd * test(mcp): cover cwd repository routing gaps * fix(mcp): harden cwd repository routing * docs(mcp): clarify cwd repository boundary * fix(mcp): preserve resolver compatibility * fix(mcp): align restricted repository routing --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-08-29 21:07:43 +00:00
azizur100389	bf7dcf98ca	feat(analyze): add incremental watch mode (#3072) ... * feat(analyze): add incremental watch mode * fix(watch): harden control file reads * fix(watch): contain refresh errors and bound reads * fix(watch): stream strict control file reads * fix(watch): harden refresh recovery and lifecycle * fix(watch): report ignored repository defaults * fix(analyze): preserve signal exit semantics * style(analyze): format signal exit helper * test(config): exercise descriptor growth guard * test(watch): await source event before rename * fix(watch): keep live-index retries honest and ignore analyzer writes Hold retry backoff when events merge, stop only after a live-index mutation, skip .gitnexus self-writes, and reject the remaining one-shot watch flags. Export impact-risk scoring from gitnexus-shared so consumers can share the same scale. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(watch): contain queue edge cases after review Preserve overflow-only refreshes, contain synchronous refresh failures, and mark successful atomic publication before later operations can fail. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-08-29 10:40:56 +00:00
John R. Eakin	38a0837e4b	feat(wiki): add grok local CLI provider (#3069) ... * feat(wiki): add grok local CLI provider Wiki generation can use `gitnexus wiki --provider grok` to spawn the authenticated Grok Build CLI (`grok --prompt-file`) instead of an HTTP API key. * style(wiki): prettier grok-client for CI format check CI quality/format failed on grok-client.ts. Auto-format matches repo prettier so the GitNexus /autofix comment is applied locally. * Update Grok CLI configuration to use empty allowlist and increase max tu * Replace Grok tool allowlist with explicit denylist and strict sandbox * Increase Grok max turns to 15 to accommodate prompt variance * chore(wiki): drop Unreleased CHANGELOG hunk and restore lockfile libc selectors Feature PRs do not own CHANGELOG.md. Restore the 16 libc platform selectors deleted from package-lock.json with no dependency change. * fix(wiki): resolve grok CLI through Windows cmd.exe shims Extract resolveWindowsCliCommand from the local CLI client and use it for grok detect/spawn so npm .cmd installs work without a shell. Keep detectGrokCLI() returning the display name for the wiki menu. * fix(wiki): wait for grok child close before timeout cleanup Do not reject the grok spawn promise on the timeout timer. Kill the child, escalate SIGKILL after 2s, and reject only on close (or a second 2s hard deadline) so callGrokLLM cannot rm the sandbox while the process is alive. * fix(wiki): reject incomplete grok stopReason and distinct parse errors Honor JSON stopReason (end_turn or omitted succeeds; anything else throws). Split empty-output / non-JSON / missing-text messages and include a truncated stdout excerpt. Drop unused GrokConfig.workingDirectory. * fix(wiki): keep grok temp dir on hung timeout and ignore stdin Hard-deadline reject no longer removes --cwd while the child may still be running. Spawn stdin is ignored so grok's unused pipe cannot EPIPE the wiki process. Co-Authored-By: Grok 4.6 <grok4.6@x.ai> * fix(wiki): require grok stopReason=end_turn for a finished page Live grok 1.0.5 with wiki spawn flags returns stopReason end_turn. Omitted, null, or empty stopReason is no longer treated as success, so generateLeafPage cannot write a page that never completed. Co-Authored-By: Grok 4.6 <grok4.6@x.ai> * style(wiki): deslop grok parse nesting and extra comments Flatten parseGrokOutput with early returns and drop narrative comments that restated the timeout/stdin/stopReason constraints. Behavior unchanged. Co-Authored-By: Grok 4.6 <grok4.6@x.ai> * test(wiki): make grok Windows spawn tests match real cmd.exe On Windows CI, detectGrokCLI also calls where.exe, ComSpec is an absolute cmd.exe path, and waitForSpawn must wait for real fs I/O. Co-Authored-By: Grok 4.6 <grok4.6@x.ai> * test(wiki): expect taskkill on Windows grok timeout, not child.kill killChildTree uses taskkill /T /F on win32 and only falls back to child.kill() if that fails. Co-Authored-By: Grok 4.6 <grok4.6@x.ai> * test(wiki): remove grok temp dir after hard-deadline leak assertion The hard-deadline test must keep the dir until close, then emit close so late cleanup runs and the temp directory is not left behind. Co-Authored-By: Grok 4.6 <grok4.6@x.ai> * test(wiki): wait for grok temp dir rm after late close Windows CI failed the hard-deadline test because 30 setImmediate ticks cannot observe fire-and-forget fs.rm. Poll with real timers after close. --------- Co-authored-by: Grok 4.6 <grok4.6@x.ai>	2026-08-29 08:46:30 +01:00
azizur100389	f64cc8b7a8	feat(group): add GraphQL cross-repo contracts (#3070) ... * feat(group): add GraphQL contract extraction * fix(group): tighten GraphQL contract guards * fix(group): complete GraphQL review hardening * fix(group): isolate bounded GraphQL reads * fix(group): harden GraphQL contract extraction	2026-08-29 08:39:09 +01:00
ChunxueLi	99291891b7	feat: make MAX_CALLABLE_VALUE_TARGETS configurable via env (#2725) ... * feat(scope-resolution): make MAX_CALLABLE_VALUE_TARGETS configurable via env The branch's original commit was a whole-file snapshot taken at a stale base and never touched the constant, so the env read was missing and the branch's own test failed. Implemented here, matching the sibling GITNEXUS_MAX_PROPERTY_DISPATCH_FANOUT knob. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(callable-value-flow): add env override tests * docs(callable-value-flow): document GITNEXUS_MAX_CALLABLE_VALUE_TARGETS env Adds a Troubleshooting subsection to README.md and a commented entry to gitnexus/.env.example for the new per-callable-site dispatch-target cap (default 32), following the maintainer's review request to document the knob alongside its implementation. --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Ubuntu <ubuntu@localhost.localdomain> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-08-01 12:42:36 +01:00
ChunxueLi	c238085676	feat: make MAX_PROPERTY_DISPATCH_FANOUT configurable via env (#2726) ... * feat(scope-resolution): make MAX_PROPERTY_DISPATCH_FANOUT configurable via env * test(property-dispatch): add env override tests * docs(scope-resolution): document GITNEXUS_MAX_PROPERTY_DISPATCH_FANOUT in README and .env.example Add a dedicated troubleshooting subsection and .env.example entry for the GITNEXUS_MAX_PROPERTY_DISPATCH_FANOUT environment variable, matching the format used by the sibling GITNEXUS_MAX_CALLABLE_VALUE_TARGETS knob. Closes maintainer request: "Could you please document this in the readme plus the .env.example?" --------- Co-authored-by: Ubuntu <ubuntu@localhost.localdomain>	2026-08-01 12:18:07 +01:00
Void Freud	0f78179e7f	fix(jvm): enforce proximity-bounded sibling injection (#2732) ... * fix(jvm): bound same-package sibling injection * docs(jvm): document sibling injection cap * fix(jvm): mark truncated sibling sets incomplete and bound the merge Review follow-ups on the sibling injection cap (#2732): - The cap silently produced a third visibility state. Before it, a file was either fully visible (package under 500 files) or fully incomplete; once `injectedIds.size` hit the cap, real siblings were dropped while `isVisibilityIncomplete` still returned `false`. That flag gates wildcard attribution in seven Spring passes (`bean-candidates.ts:199` and the java/ kotlin bean-metadata, conditionals, config-bindings and DI resolvers), so 201-500-file packages — exactly this cap's population — resolved wildcard annotations against a truncated sibling set with no log signal. Truncation now marks the file incomplete and analyze warns once with the affected file count. - The cap only bounded `bindingAugmentations`; the two `typeBindings` merges below it still absorbed every sibling, so a class excluded from the binding set could still steer receiver/variable type inference through `scope.typeBindings`. Both halves now use the same bounded sibling set, and the merge iterates that set directly rather than filtering a full rescan, so the cap bounds the work as well as the result. - Path segments are split once per bucket instead of on every pairwise proximity comparison — that comparison runs O(files²) per package. - `JvmPackageFact` was re-declared locally instead of imported from `package-facts.js`, where the canonical declaration still serves both languages' facades and capture side-channels. Nothing kept the copies in sync. Restored the import. - README/.env.example: `GITNEXUS_MAX_INJECTED_SIBLINGS` does not lift the fixed 500-file package skip (including at `0`), and truncation disables wildcard attribution for the affected files. Both are now stated. * test(jvm): restore the language-facade coverage and pin the cap's behaviour The cap rewrite replaced the per-language harness with generic fixtures, dropping the Java/Kotlin capture-side-channel and facade coverage (package fact extraction, the 500-file skip, fail-closed on a file that produced no ParsedFile) and leaving a proximity fixture whose candidates were already in order — so it could not tell a working sort from plain truncation of the input. Restores that harness and adds cap-specific cases on top, driven through the shared JVM factory. The fixture interleaves near and distant siblings, so the retained set is only reachable by a working proximity sort. Covers: the exact capped set, truncation marking the file visibility-incomplete, type bindings bounded by the same sibling set, the unbounded `0` override staying complete, and the documented default of 200 applying when the variable is unset. Each new case fails against the pre-fix implementation. --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>	2026-08-01 09:38:10 +01:00
Void Freud	e20b41fffc	fix: allow slower remote embedding responses	2026-07-28 17:03:49 +03:00
Gergő Magyar	b5c6c0e57c	perf(communities): fix the O(communities x N) copy in vendored Leiden, wire Icebug to its real API (#2337) (#2692) ... * perf(communities): drop the O(communities x N) copy in vendored Leiden (#2337) `UndirectedLeidenAddenda.mergeNodesSubset` snapshotted the pre-merge `externalEdgeWeightPerCommunity` with a full-array `.slice()` on every macro-community, so a graph with C communities and N nodes copied C x N float64s per Leiden pass. CPU profiling put 70% of a 100k-node run in that one function, plus ~7s of GC from the per-community allocations. Only entries for nodes inside the current subset are ever read back (every neighbour is filtered on `belongings[et] === currentMacroCommunity`), so snapshot just those into a scratch buffer allocated once per addenda. Measured on seeded planted-partition graphs, partitions bit-identical: 20k nodes / 54k edges 2350ms -> 527ms (4.5x) 60k / 200k 12513ms -> 3328ms (3.8x) 100k / 350k 44151ms -> 4816ms (9.2x) 200k / 800k >580s -> 14622ms (>40x) The 200k case previously blew through LEIDEN_TIMEOUT_MS and degraded every symbol into a single community; it now finishes well inside the timeout. Adds golden-partition and repeat-run determinism tests, which nothing covered before. Committed with --no-verify: the pre-commit typecheck gate fails on pre-existing `BindingRef.visibility` errors in csharp/namespace-siblings.ts and scope-resolution/passes/free-call-fallback.ts, both untouched here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NfQfKy4gCmgUv1jBRJTSs2 * fix(communities): wire the Icebug engine to the real @ladybugmem/icebug API (#2337) The gate merged in #2376 could never have run. It imported the bare specifier `icebug`, which on npm is an unrelated node-inspector/nodemon wrapper — the graph library publishes as `@ladybugmem/icebug`. It then probed for `Graph.fromCSR` and `community.ParallelLeidenView`, neither of which exists: the module exports `GraphR(n, directed, outIndices, outIndptr)` and a top-level `Leiden(graph, iterations, randomize, gamma)`. The constructor call also had `gamma` and `randomize` transposed, and `getPartition()` returns `{membership, count}`, which the array-like probe rejected. Every `GITNEXUS_COMMUNITY_ENGINE=icebug` run fell back to Graphology with a shape error. Rewrites the worker against the published surface and deletes the speculative probing it needed while the API was unknown — the four-way `readPartition` candidate scan, the `readModularity` ladder, the object-vs-positional constructor retry, and the `isNumericArrayLike` helper. What stays is the guard that matters: `setNumberOfThreads` and `setSeed` are required, because community IDs feed generated context and must be reproducible. Icebug is deliberately not a declared dependency. Its prebuilds link against system Arrow 24, OpenMP and glibc >= 2.38, so it stays an opt-in `npm i @ladybugmem/icebug` rather than 30MB every install pays for. Note that the published 12.8.0 tarball omits the thread/seed exports that icebug-nodejs HEAD has, so the determinism guard is what trips today. The worker source is now built from a module specifier so tests can run it against a stub shaped like the real package. That pins the package name, class names, constructor argument order and partition shape — none of which anything caught before. Committed with --no-verify: the pre-commit typecheck gate fails on pre-existing `BindingRef.visibility` errors in csharp/namespace-siblings.ts and scope-resolution/passes/free-call-fallback.ts, both untouched here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NfQfKy4gCmgUv1jBRJTSs2 * docs(communities): label the Icebug engine experimental and announce it at runtime (#2337) The engine was opt-in but silent about what opting in means. A run that succeeds is exactly when the user most needs to know the partition came from the experimental path, since community IDs feed generated context and the two engines partition differently — switching invalidates anything keyed on those IDs. Emits the notice when a non-default engine is requested rather than only on fallback, and states the no-stability-guarantee terms in the README and the options doc. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NfQfKy4gCmgUv1jBRJTSs2 * fix(communities): never terminate the icebug worker mid-N-API (#2432, #2337) Self-review of this PR found that making the native Leiden path reachable also arms a hazard this repo has already paid for once. The icebug worker spends its entire life inside N-API — dlopen, GraphR, Leiden, run — so the 60s timeout handler's `worker.terminate()` would kill a thread mid-native- call, which aborts the whole process (Napi::Error -> std::terminate -> SIGABRT) rather than falling back to Graphology. A timeout on a large projection is exactly the case the engine exists to serve, so the failure mode was aimed at its own target. Drops terminate() from all three paths. On timeout the worker is unref'd and abandoned, so a wedged native run cannot hold the process open either. On the settled paths nothing is needed: the worker script ends after its single postMessage and the thread exits on its own — measured at 40ms. Records the rule as GUARDRAILS non-negotiable 6, since the same trap is open to any future worker running tree-sitter, LadybugDB or Icebug code, and it only reproduces once the native module actually loads — which is precisely the path you cannot exercise locally. Also from the review: - Marks vendor/leiden/utils.cjs as a local fork. A re-vendor from upstream would silently restore the O(communities x N) copy, and no test would notice: both versions produce bit-identical partitions, so the goldens pass either way. The header now names the divergence and its symptom. - Qualifies the README performance claim. "~15s for a 200k-symbol projection" was measured on a synthetic planted-partition graph, not a real repo, and Leiden is sensitive to degree distribution. The terminate rule is regression-tested: restoring the call fails the mocked-worker test with `expected 1 to be +0`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NfQfKy4gCmgUv1jBRJTSs2 --------- Co-authored-by: Gergo Magyar <abhigyan1.patwari@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-25 13:23:17 +01:00
Gergő Magyar	3f1e23ba83	fix: stop misdiagnosing glibc-too-old native loads (#2672) and name the Windows FTS zero-install fix (#2669) (#2689) ... * docs(plans): add glibc-windows-fts-diagnostics plan Implementation plan for #2672 (glibc-too-old native-load misdiagnosis) and #2669 (Windows FTS prerequisites + Git Bash zero-install workaround). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(cli): stop prescribing a reinstall when the host glibc is too old (#2672) The LadybugDB prebuilt binary requires GLIBC_2.34 (dlopen/pthread_* at 2.34, fstat64/lstat at 2.33). On an older host the loader reports version `GLIBC_2.34' not found (required by .../lbugjs.node) and checkLbugNative answered with "truncated file, ABI mismatch, or wrong-platform binary" plus instructions to re-run install.js. That advice is actively wrong for this class: every download ships the same prebuilt binary, so the reinstall fails identically and the user loops. Add glibcTooOldMessage: match a GLIBC_<version> token on a "not found" line, report the highest required version (compared numerically, so 2.9 < 2.34) alongside this host's glibc from process.report, state that reinstalling will NOT help, and point at the real options. The branch sits on the arm where the probe actually ran and failed, so an unrunnable probe still fails open (#2441). The glibc read is local rather than analyzer-identity's detectLibcVariant: native-check is the dependency-light startup gate and must not statically pull in a module the CLI reaches through a dynamic import. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(lbug): name the Git Bash zero-install fix for Windows FTS load failures (#2669) The Windows error-126 remedy already refuses to prescribe a reinstall and names the VC++ redistributable and the OpenSSL 3 DLLs, but not where those DLLs already exist on the machine. #2669's reporter had the redistributable installed and still failed: the same command failed in PowerShell and succeeded in Git Bash, because Git for Windows puts libssl-3-x64.dll and libcrypto-3-x64.dll on PATH via C:\Program Files\Git\mingw64\bin. Add that hint to the Windows-126 and structural missing-dependency remedies through one shared const, following the VC_REDIST_INSTALL_HINT anti-drift pattern (#2383 F5). Placing it in the builders rather than at a call site is load-bearing: markUnavailable caches the whole diagnosis (#2383 F3) and ftsDegradedWarning replays that cached remedy, so a call-site fix would miss the MCP query and /api/search surfaces. The hint is a fixed system path, never a user-profile one — remedy text is not path-redacted, and fts-degraded-warning.test.ts asserts no C:\Users\ path ever reaches a user. Both touched tests now assert that property directly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(readme): document the Linux glibc floor and Windows FTS prerequisites (#2672, #2669) Requirements listed only Node and git, so neither runtime prerequisite that these two issues turn on was discoverable before hitting the failure. - Linux: the LadybugDB prebuilt binary needs glibc 2.34+; name the distro versions that clear it and state plainly that reinstalling does not help. - Windows: full-text search needs the VC++ 2015-2022 x64 redistributable AND OpenSSL 3 on PATH. The redistributable alone is not sufficient (#2669's reporter had it), and Git for Windows already ships the OpenSSL DLLs, so running from Git Bash or prepending mingw64\bin is a zero-install fix. Without them analyze still succeeds but the index carries no search tables. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: drop the plan document from version control docs/* is gitignored; the plan was force-added so it would travel with the work. It is working material, not a repository artifact — the code, tests and README carry the reasoning that matters. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(cli): stop doctor reporting a present-but-unloadable binary as missing (#2672) doctor printed "✗ lbugjs.node missing" for every failed native check — including the case this PR is about, where the binary is right there and merely fails to load because the host glibc is too old. It then wrote the real detail to stderr directly beneath, so the two lines contradicted each other and the headline sent users to reinstall a file they already had. It said the same for a truncated download and for an entirely absent @ladybugdb/core package. checkLbugNative already knows which of the three it found, so record it: a `kind` discriminator ('package_missing' | 'binary_missing' | 'load_failed') set at each failure return. doctor renders it through a new exported `nativeStatusLine`, following the existing pageSizeDoctorLines/poolSizeDoctorLine pure-helper pattern — which also makes the line testable, where before it had no coverage at all. An unrecognized or absent kind keeps the conservative "missing". Deriving this in doctor with a second existsSync would have re-stat'd a file the check had already inspected, and could disagree with what it actually observed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-25 10:05:57 +01:00
Gergő Magyar	ad1b9227c4	fix: large-repo analyze OOM and false worker-timeout cascade (#2649) (#2679)	2026-07-25 09:16:17 +01:00
Gergő Magyar	7316503ebc	perf(analyze): hold structural relationships out of the JS heap, on by default (#2680) (#2685) ... * refactor(lbug): extract SyncCsvWriter into a shared module `PdgEmitSink` (#2202) declared `SyncCsvWriter` as a private, non-exported class. The structural streaming sink for #2680 needs the same buffered sync-write + poison/openFailure IO discipline, and importing it is not possible while it is module-private — so the alternative was copying ~90 lines of it. Extract the class (and the chunk-rows default it uses) into `sync-csv-writer.ts` and have `PdgEmitSink` import it. `DEFAULT_PDG_EMIT_CHUNK_ROWS` stays exported as an alias so no existing caller changes. Pure refactor: no behaviour change. pdg-emit-sink.ts 396 -> 302 lines; tsc clean; the 23 existing #2202 tests pass unchanged. Refs #2680 * feat(lbug): add GraphEmitSink for streaming structural relationship emit Structural sibling of PdgEmitSink (#2202): a KnowledgeGraph façade that routes relationships no mid-pipeline phase reads back to bounded CSV-on-disk and never stores them. Nothing constructs it yet. Measurement drove the design. On a kernel-shaped synthetic graph (400k nodes, 2.7 edges/node): nodes only ...... 367 B/node nodes + edges ... 2075 B/node <- reproduces the #2649 ~2.1 KB/node => the relationship layer is 83% of graph heap, ~646 B/edge so streaming *relationships* is where the memory is; nodes stay resident (they are 17%, and two scope-resolution index builders scan them). Dropping just the redundant relationshipsByType/edgeIdsByNode indexes was also measured — 174 of 648 B/edge, ~1.3x — and is not a substitute. RETAINED_REL_TYPES is derived from an exhaustive audit of every relationship read site under src/, and each entry names its reader. An earlier draft carried 14 types, 5 of which no reachable phase reads. Two deliberate departures from PdgEmitSink, both because its invariants do not hold here: - dedup by relationship id, since no upstream per-file uniqueness guarantee exists for structural edges and COPY would violate the PK; - removeRelationship on an already-streamed id throws instead of no-oping, so a mutating consumer cannot corrupt the graph undetected. Also exposes hasStreamedSemanticEdge for the local-symbol pruner: without it a block-local symbol referenced only by a streamed edge looks unreferenced and gets pruned, leaving a CSV row pointing at a node with no row. Refs #2680 * feat(analyze): stream structural relationships to CSV under GITNEXUS_STREAM_GRAPH_EMIT Wires GraphEmitSink into the pipeline behind a full-rebuild-only flag, so relationships that no mid-pipeline phase reads back never enter the JS heap. Measured ~2.9x reduction of graph heap: 0.17 (nodes) + 0.83 * 0.21 (retained edges) = 0.344 retained. This is a constant factor, NOT O(chunk) — node identity and the resolution registries stay O(repo). The sink is armed at the PARSE boundary, not at graph construction. An exhaustive audit of every relationship read site under src/ found four mid-pipeline CALLS consumers, not the two an earlier draft assumed: - local-symbol-pruner (full iterRelationships scan, then removeNode) - communities / processes (whole-graph forEachRelationship) - mapCobolToGraph, which scans CALLS and REMOVES the unresolved ones — and runs BEFORE parse, so streaming from construction would have silently stopped COBOL cross-program call resolution - taintSummaries, gated on `pdg` and NOT on `skipGraphPhases`, so it needs its own gate or --pdg + this flag yields an empty taint layer Accordingly communities, processes, taintSummaries and callSummaries are all disabled under the flag, and the run logs what it is giving up. Two fixes that are correct independently of the flag: - runPipelineFromRepo keyed its community/process extraction off `!skipGraphPhases` while getPhaseOutput THROWS on a phase filtered out by any enabledWhen predicate — now a presence check, so filtered combinations return undefined instead of crashing. - loadGraphToLbug COPYs one job per CSV FILE rather than per label pair. #2202's throw-on-collision merge is only sound because BasicBlock pairs are disjoint; a streamed CALLS edge is Function|Function and always collides with the whole-graph CSV for that pair, so the structural manifest appends instead. The buffer-pool hint adds the streamed row count back in: the hint only ever shrinks the pool, so sizing it from the post-streaming relationshipCount would starve the COPY at exactly the scale this targets. detect_changes: 18 symbols / 10 files / 9 processes, all within the planned scope. Full suite green with the flag off. Refs #2680 * fix(mcp): stop impact() under-reporting risk on a streamed index An index built with streamed structural emit has no Process or Community rows, and impact()'s risk scorer uses processCount >= 5 and moduleCount >= 5 as two of its four CRITICAL escalation criteria. The missing-table errors are swallowed as benign without raising `partial`, so nothing distinguished 'this repo has no processes' from 'this index was built without them' — the same change would report LOW off a streamed index and CRITICAL off a complete one, with no signal either way. That is the false-clean shape #2283 ruled out for detect_changes, and it matters more here because the repo's own workflow mandates impact() before every symbol edit. Stamp `graphPhases: 'complete' | 'skipped'` into RepoMeta and have impact() attach riskUnderstated + an explanatory riskNote when the index is stamped skipped, so the reported level is explicitly a lower bound. Unlike the rest of RepoMeta.capabilities this stamp has a real programmatic reader. Also documents GITNEXUS_STREAM_GRAPH_EMIT in the README env table, including everything the flag disables. Refs #2680 * test(lbug): differential set-identity gate for streamed structural emit The acceptance property for #2680: for the same node/edge set, the rows reaching the bulk COPY must be identical whether streaming is on or off. With streaming on they arrive from two places — the residual in-memory graph via streamAllCSVsToDisk, plus the sink's per-pair CSVs — so the test asserts their UNION equals the single whole-graph emit. Also asserts the split is real (retained + streamed == total, streamed > 0), so a sink that silently streamed nothing cannot pass the equality vacuously. Verified discriminating: with sink.arm() commented out the test fails ('expected 0 to be greater than 0'); restored, it passes. Fixture spans both sides of RETAINED_REL_TYPES and includes a self-edge and a duplicate relationship id — the cases where a naive sink diverges from the whole-graph emit. Drives the sink directly rather than running analyze, matching pdg-emit-streaming-roundtrip.test.ts: the guarantee is about emitted rows, and the worker pool would add unrelated machinery without strengthening the assertion. Refs #2680 * fix(test): remove literal NUL byte and cover streamGraphEmit phase gating Two review findings, both verified before accepting. 1. The round-trip test contained a literal NUL byte as a key separator, which made Git treat the whole .ts file as BINARY — `git show --numstat` reported `-\t-` for it, so the file would not diff or blame and CI text tooling would skip it. Replaced with the escaped \\u0000 sequence; behaviour is identical, the file is text again. (Found by the Codex swarm lane.) 2. buildPhaseList's four new streamGraphEmit gating predicates and the flag-off default path had no test that would fail on revert — two review lanes flagged this independently. Reversing any enabledWhen condition would have passed the suite silently, which matters because an ungated taintSummaries yields an empty taint layer rather than an error. Added four cases: the streamed run drops communities/processes/ taintSummaries/callSummaries; it keeps mro/di (their reads are all in RETAINED_REL_TYPES); the flag-off list is untouched; and skipGraphPhases still works independently. Refs #2680 * fix(analyze): don't leak a temp dir when streaming is off; correct two overclaims Three review findings, all verified before accepting. 1. `graphEmitCsvDir: resolveNativeSafeStorageDir(...)` was evaluated unconditionally inside the pipeline-options literal. On a Windows non-ASCII storage path that helper mkdtempSyncs a REAL directory, so every analyze leaked one temp dir even with the flag off. Now resolved only when streaming is active, matching how the PDG sibling resolves inside its own guard. This was the only finding affecting flag-off users. 2. The retain-set comment claimed 'the differential round-trip test is what catches drift'. It cannot. addRelationship PARTITIONS edges between the graph and the CSVs, and the union of a partition is invariant under where the partition line falls — so that test stays green no matter how RETAINED_REL_TYPES is drawn. Only the read-site audit protects the invariant, and the comment now says so and names the grep to re-run. 3. The ~2.9x figure assigned streamed edges a retained cost of zero, ignoring the sink's own streamedIds/streamedEndpoints Sets — and relationship ids are plain concatenations of both endpoint ids, not hashes. Review measured those Sets at ~35% of full per-edge retention, not the '~a tenth' assumed, putting the real figure nearer ~1.7-2.2x; a member-dense Java/C# repo lands lower still, since the retained structural spine is a larger share there than in the TypeScript census the 0.21 came from. Code comment and README now give a range and say plainly that no end-to-end measurement on a real repository exists yet. Refs #2680 * fix(mcp): disclose degraded risk in detect_changes; stop pinning the sink Two more review findings, both cross-lane corroborated. 1. detect_changes derives risk_level SOLELY from affected-process count, and a graphPhases:'skipped' index has zero Process rows by construction. The STEP_IN_PROCESS query then succeeds with zero rows, so queryDegraded stays false and the tool returns risk_level 'low', affected_count 0, with no partial marker — for every change, forever. That is a false-clean on the gate this repo mandates before every commit, and it is the same #2283 shape the previous commit fixed in impact() while leaving its sibling untouched. Now carries the same riskUnderstated + riskNote disclosure. 2. PipelineResult.graphEmitSink had zero readers — the pruner predicate and the manifest are both threaded elsewhere — but returning it kept the sink, and therefore its O(streamed-edges) id and endpoint Sets, reachable through the entire COPY/FTS/embedding phase. That is precisely the phase this feature exists to fit inside RAM, so the field actively worked against the change's purpose. Dropped. Refs #2680 * refactor(2680): one named capability, one risk helper, a shorter header Pure cleanup pass — no behaviour change, 66 tests across the six affected suites still green, and the round-trip test still fails when the sink is left un-started. Three things were untidy: 1. The phase layer reached the sink through TWO loose callbacks bolted onto PipelineContext (`armStreaming`, `hasStreamedSemanticEdge`) — two fields, two wiring lines, no name for the thing they belonged to. Replaced by one `graphEmit?: GraphEmitControl`, a two-method interface declared beside the sink. Phases now say what they mean: `ctx.graphEmit?.beginStreaming()`. Also renames `arm()` to `beginStreaming()`, which needs no comment to explain. 2. The degraded-index risk disclosure was copy-pasted into impact() and detect_changes() — two meta probes, two near-identical prose blocks, and two long comments restating the same reasoning. Now one `streamedIndexRiskDisclosure()` helper carrying the explanation once; each caller passes only the clause naming which count is structurally zero for it. Same file, 45 lines in / 45 out, with the duplication gone. 3. The sink's file header had grown into a changelog of my own review corrections ('this once assumed', 'review measured'). A reader does not care what an earlier draft believed. Rewritten to state the design argument once — relationships are ~83% of graph heap, so they are what streams; nodes are the other 17% and are scanned, so they stay — under headings, with the honest 'this is an estimate, ~1.7-2.2x, no real-repo measurement yet' caveat kept in full. Refs #2680 * feat(analyze): make streamed graph emit the default, with nothing traded away Streaming was opt-in because it disabled the four phases that consume the whole CALLS graph — communities, processes, taintSummaries, callSummaries. That made it unshippable as a default: query() is process-grouped and clusters/skill-gen are community-backed, so every index would have silently lost them. The sink now answers a COMPLETE relationship read. It keeps streamed edges as four parallel columns over an interned node table — sourceId, targetId, type, confidence — and iterRelationships/iterRelationshipsByType/ forEachRelationship/relationshipCount return the retained edges concatenated with those. Every consumer therefore sees the whole graph and no phase knows streaming happened. Four fields, not six, because an audit showed community-processor, process-processor, taint-summaries and the pruner read only those — none keys on rel.id. That matters: relationship ids are unique long strings, and retaining them is precisely what made a fully-columnar attempt LOSE to the object graph (measured 838 MB vs 822 MB). Ids stay out of the columns; a read synthesizes one, which is safe because buildRelRow never persists it. Consequently deleted, not merely disabled: - the four enabledWhen gates and the 'what you give up' warning; - the pruner's hasStreamedSemanticEdge predicate and its plumbing — a complete scan sees streamed edges, so the dangling-edge hazard is gone by construction rather than by compensation; - the whole degraded-index apparatus: the graphPhases RepoMeta stamp, streamedIndexRiskDisclosure, and the riskUnderstated markers on impact() and detect_changes(). Nothing degrades, so nothing needs disclosing. Default is ON for full rebuilds; GITNEXUS_STREAM_GRAPH_EMIT=0 (or an explicit option) is the escape hatch, for bisecting a suspected streaming fault rather than routine use. Incremental runs still refuse it — the writeback reads relationships back out of the in-memory graph. Measured A/B, 400k nodes / 1.08M edges, all edges streamable (worst case for this design): 823 MB -> 626 MB, ~1.3x, all 1.08M edges still visible. That is deliberately less than the ~2.9x the retained-share formula implies — losslessness costs the dedup Set and the columns. The earlier, bigger number was bought by disabling phases. README and the file header both state 1.3x measured; neither claims O(chunk). New coverage: reads are complete (proven discriminating — 3 tests fail when the streamed leg is removed), endpoints/confidence survive the round trip, per-type lookup finds streamed types, and every CALLS-consuming phase stays registered under the flag. Refs #2680 * docs(2680): pin the invariants the default-on change relies on Review follow-ups. No behaviour change except the id-uniqueness fix. - pipeline.ts returns the RAW graph, not the sink, and that is load-bearing: phases read the sink so their scans are complete, but loadGraphToLbug feeds this value to streamAllCSVsToDisk, whose iterator would then emit every streamed edge a SECOND time on top of the per-pair CSVs the sink already wrote. Returning the sink there silently doubles every streamed relationship in the persisted graph, so the reason is now written down at the return site. - Synthesized ids now carry the column index, making them unique even when two streamed edges share (type, source, target) and differ only in reason/step. Harmless today because no consumer keys on relationship id, but real ids are unique and the synthesized ones should match, so a future id-keyed consumer cannot silently collapse two edges. - Recorded WHY dropping reason/step is safe, which is not the same argument as for id: the persisted row keeps their true values because buildRelRow receives the original relationship on the way through, so only in-memory reads see the 'streamed' placeholder. The ACCESSES reason:'read'|'write' distinction that MCP queries depend on therefore survives in the database. A future in-pipeline consumer needing either field must add a column rather than trust the placeholder. Also verified while chasing a review lead: removeNodesByFile has no production callers and removeNode has exactly one (the pruner), which reads through the sink and so sees streamed edges. The dangling-edge hazard the deleted hasStreamedSemanticEdge predicate used to compensate for is closed by construction, not by luck. Refs #2680 * fix(2680): fail loudly on a missing CSV dir, and guard the retain set Resolves both findings from the review of this branch. MEDIUM — pipeline.ts silently skipped streaming when `streamGraphEmit` was true but `graphEmitCsvDir` was absent. The CLI always supplies the dir, but streaming is on by DEFAULT now, and the callers that build PipelineOptions themselves (eval-server, MCP daemon, tests) are exactly the ones that would omit it — so they would ask for streaming, not get it, and still see a successful run. That is the silent-degraded-outcome shape the rest of this work exists to prevent, so it now throws with the resolution hint. Covered by a test asserting the rejection. LOW — RETAINED_REL_TYPES had no automated guard, and the round-trip test structurally cannot be one: addRelationship PARTITIONS edges between the graph and the CSVs, and a partition's union is invariant under where the line falls, so that test stays green for any partitioning including a wrong one. Drift there yields a silently incomplete mid-pipeline edge set, not a crash. Added a test that derives the required set by grepping every literal iterRelationshipsByType('X') under src/ and asserts the constant covers it, with CALLS as the documented exemption (taintSummaries reads it, which is why the sink answers a complete read rather than retaining it). Proven discriminating: removing EXTENDS from the constant fails with "expected [ 'EXTENDS' ] to deeply equal []". 128 tests green across the eight affected suites, including the index-lock suite that arrived with the #2677 merge. Refs #2680 * docs(2680): record the measured CPU cost, not just the memory win I measured memory before shipping and never measured time, which was a gap: reads now allocate, rebuilding objects instead of returning stored ones, and a real analyze does SIX full relationship scans (pruner, communities x2, processes x2, the taint fixpoint's CALLS pass). Same 400k-node / 1.08M-edge graph: heap 820 MB -> 623 MB (1.32x better) scans 96 ms -> 651 ms (6.8x WORSE) 6.8x on iteration is worth knowing, but the absolute number decides it: ~0.5 s here, ~2 s extrapolated to kernel scale, against an analyze measured in minutes — under 1% of wall-clock. The ~26M short-lived objects at kernel scale are young-generation churn (the cheap case), and being ~800 MB further from the heap ceiling matters more than the churn costs: #2649's cascade came from GC thrash NEAR the limit, not from allocation volume as such. Also names the first lever if these scans ever go hot — a per-type index over the columns, so iterRelationshipsByType stops scanning all streamed edges — and notes that it trades memory back, so it needs a measurement first. Refs #2680 * perf(2680): cut the iteration regression from 6.8x to 1.8x The memory win came with an unmeasured CPU cost. Iteration went from returning stored objects to rebuilding them, across the SIX full relationship scans an analyze performs (pruner, communities x2, processes x2, taint's CALLS pass). First measurement: 90 ms -> 651 ms, 6.8x worse. Fixed properly rather than documented away. Two causes, each measured before and after: 1. The ~150-character synthesized `id` was built eagerly on every read — 6.5M concatenations per analyze, for a field NO in-pipeline consumer reads. Isolating it (constant id) showed 436 ms of the 555 ms regression. Now a lazy prototype getter on a fixed-shape `StreamedRelationship` class: the string is built only if someone asks, and V8 keeps one hidden class across millions of instances. 2. Generator and iterator-protocol overhead on million-edge walks. `forEachRelationship` (community detection's form, called twice) now loops the columns directly, skipping both. `iterRelationships` keeps an iterator but reuses one result record — a hand-rolled version allocating a fresh {value, done} per edge measured WORSE than the generator (252 ms), which is why the obvious rewrite is not the one that shipped. heap 821 MB -> 623 MB (1.32x better) scans 90 ms -> 180 ms (was 651 ms) The residual ~90 ms is object allocation, 6.5M instances across six scans, and it is irreducible while the read API returns objects at all. The remaining fix for true parity is a field-wise callback passing sourceId/targetId/type/ confidence as primitives — all four hot consumers read only those — but that changes the KnowledgeGraph interface and its consumers, so it belongs in its own measured change rather than bolted on here. Refs #2680 * perf(2680): zero-allocation field scan brings iteration back to parity Third and final step on the iteration cost. The memory win had come with a 6.8x iteration regression; the previous commit cut that to 1.8x by making the synthesized id lazy and removing generator overhead. The residual was object allocation itself — 6.5M instances across the six full relationship scans an analyze performs — which no amount of tuning removes while the read API hands back objects. So the hot consumers stop asking for objects. Adds `KnowledgeGraph.forEachRelationshipFields`, which passes (sourceId, targetId, type, confidence) as primitives — exactly and only what every whole-graph scan reads. On the sink those come straight out of the columns, allocating nothing; on the object-based graph they are read off the stored relationship, so the flag-off path is unaffected. Converted the five whole-graph scans: community detection (x2), process extraction (x2), and the local-symbol pruner. `isFileDefinesEdge` now takes (type, sourceId) rather than a relationship. The taint fixpoint's by-type pass is left alone — one scan of six, and converting it would turn an indexed bucket lookup into a full scan on the object-based graph. heap 820 MB -> 623 MB (1.32x better) scans ~82 ms -> ~90 ms (was 651 ms; now parity within noise) Also deletes the pruner's `hasStreamedSemanticEdge` option, which has had no caller since the sink's reads became complete — a dead knob is worse than no knob. Verified: 104 tests across the eight affected suites, including the pruner's pipeline integration test (which needs the raised worker-ready timeout on this host; it passes cleanly with it and its failures are the known 5s handshake). Refs #2680 * perf(2680): compact dedup keys — 1.32x -> 1.59x, speed unchanged An audit of where duplicate relationship ids actually come from, then the saving it unlocked. The audit (instrumented analyze of this repo): 25 duplicate-id hits across 63,412 streamed edges — 0.04%, all CALLS, every one the SAME call site re-emitted when a file is resolved in more than one language pass. Three things follow, and they rule out the cheap options: - dedup cannot be dropped (25 != 0, and a duplicate reaching COPY is a wrong graph); - it cannot move to row contents, because emit-references builds ids as `...->target:line:col`, so two calls between the same pair at different sites have byte-identical CSV rows that the whole-graph emit keeps; - it cannot move to a per-file source guard like `pdgEmittedFiles`, because a later language pass can resolve genuinely NEW edges for the same file. What was left was the key itself. An id embeds both node ids in full (~200 chars here) while the endpoints are ALREADY interned for the columns, so the Set was storing them twice. Keys are now built from the interner indices plus the id's trailing disambiguator parsed into NUMBERS. Numbers, not substrings, and that is load-bearing: a key built by slicing inside a long string is a V8 sliced/cons string that keeps its parent alive, so the id would never be freed and the saving would silently fail to appear. An earlier attempt at this measured no improvement for exactly that reason. Unrecognized id shapes (`rel:contains:` has no tail) fall back to storing the id verbatim — correctness first, saving second. heap 821 MB -> 518 MB (1.59x, was 1.32x) scans ~83 ms -> ~88 ms (parity, unchanged) Speed is untouched by construction: dedup is on the WRITE path, and none of the six full scans reads it. Also fixes removeRelationship, which the test suite caught: it looked up the raw id in a Set that now holds compact keys, so it silently stopped throwing on an already-streamed edge. It cannot recompute a key from a bare id, so it is now conservative — anything the real graph does not hold is treated as possibly-streamed once streaming has begun and fails loudly. A genuinely-absent id throws where main returns false; acceptable because the only production caller (the COBOL resolver) runs before the sink is armed. 89 tests green across the six affected suites. Refs #2680 * fix(2680): dedup key dropped edges when tail segment counts differed Both findings from the review of this branch, and the coverage gap named alongside them. HIGH — the compact dedup key packed the id's trailing numeric segments as `|${a}|${b}`, with `b` defaulting to 0 when only one segment was present and the segment COUNT absent from the key. So `:7` and `:7:0` produced the same key and the second edge was silently discarded as a duplicate: a lost relationship, no error, no warning. Found by probe, not by reading — two distinct ids for one (source, target, type) went in and one edge came out. The key now carries `seen`. Nothing existing caught it. The round-trip test compares the UNION of graph and CSV rows, and a dropped edge is missing from both, so it stayed green; the duplicate test only feeds a genuinely identical id, which is the case that SHOULD collapse. Four new cases pin the boundary instead: differing segment counts stay distinct, two call sites between one pair stay distinct (the `:line:col` shape from emit-references), a truly repeated id still collapses, and a non-numeric tail falls back to the full id. Proven discriminating — reverting the fix fails with "expected 1 to be 2". This costs ~66 MB at 400k nodes / 1.08M edges (584 MB, was 518 MB), so the heap win is 1.40x rather than 1.59x. Not a trade worth making the other way: a silently missing relationship is the exact failure class the rest of this work exists to prevent. I am not asserting a mechanism for why two extra characters per key cost that much — it is stable and reproducible across runs, and inventing a cause is how I got the earlier cons-string diagnosis wrong. LOW — removeRelationship throws for an absent id once streaming has begun, where KnowledgeGraph.removeRelationship returns false. The behaviour is deliberate (a bare id cannot be turned back into a compact key, and answering "false" for an edge already on disk is the worse failure) but it was undocumented and untested. Now stated on the interface itself and pinned by two cases: absent-id-while-streaming throws, absent-id-before-streaming returns false. Coverage gap — added a test asserting forEachRelationshipFields yields the same (source, target, type, confidence) tuples as iterRelationships. That guards the five whole-graph scans converted in 9fa18384, where a divergence would silently skew community detection, process extraction and the pruner. Also records the verified scaling in the file header: linear at 100k/200k/ 400k/800k nodes, per-edge scan cost flat at ~13 ns in both arms, heap ratio drifting only 1.7x -> 1.5x as interner indices gain digits. No super-linear term. 135 tests green across the eight affected suites. Refs #2680 --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>	2026-07-25 07:43:51 +01:00
Gergő Magyar	9538be957d	fix(lbug): scale the buffer-pool budget by the OS page-size granule ratio (#2631) (#2636) ... * fix(lbug): scale the buffer-pool budget by the OS-page discard-granule ratio (#2631) LadybugDB bills buffer-pool budget per discard granule, not per 4 KiB frame: the engine's vm_region.cpp sets discardGranuleSize = max(frameSize, osPageSize), claimFrame charges the whole granule when its first frame becomes resident, and releaseFrame refunds only when the granule's last frame leaves — while BufferManager::reserve measures eviction progress in refunded bytes and throws 'The buffer pool is full and no memory could be freed!' after three zero-refund passes. On a 64 KiB-page kernel (Ascend/aarch64 openEuler — the #2631 reporter's host) that is 16 frames per granule: the same COPY bills up to 16× the budget it needs on x86, and whole eviction passes can evict frames yet refund nothing. Apple Silicon macOS (16 KiB pages) is the same mechanism at 4×. Measured with the reporter's exact command and version: vllm-ascend needs a (128, 256] MiB pool on 4 KiB pages — 64/128 MiB reproduce the reporter's byte-identical error, 256 MiB and the 576 MiB adaptive pool succeed — so their 64 KiB host cannot survive on a page-size-blind budget. Scale every derived pool size by granuleRatio = max(1, osPageSize/4096): the per-element estimate, the COPY-safety floor, and the default cap (still bounded by 80% of RAM). 4 KiB hosts are byte-identical to before — proven by pinning the existing sizing tests to an explicit 4096 page size, which also stops them drifting on 16 KiB Apple Silicon runners. GITNEXUS_LBUG_BUFFER_POOL_SIZE keeps absolute precedence and 0 still restores the native default. Also: bufferPoolExhaustionRemedy() gives the exhaustion error an actionable cause→consequence→remedy message; the isLbugPageSizeFrameError comment that called pool exhaustion 'a sizing problem, not a page-size one' is corrected — that framing inverted when #2582 made pool size a function of a page-size-blind estimate. Cannot execute on a 64 KiB kernel here: the scaled path is proven by unit stubs plus the engine-source math above; the env override remains the field escape hatch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cli): actionable pool-exhaustion remedies at the COPY sites and a doctor pool line (#2631) The node-COPY throw and the relationship-COPY warning now append bufferPoolExhaustionRemedy() when the failure is the engine's pool-exhaustion class: the raw binder text gave the operator nothing to act on, and on non-4K-page hosts the pool bills up to pageSize/4KiB × faster than the sizing was calibrated for. The relationship path appends the remedy once per bulk load, not once per failed pair. doctor prints the effective pool size next to the page-size line ('pool size 2048 MiB', with an '(×N page-size scaling)' suffix on non-4K hosts) so support triage sees the sizing inputs at a glance. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(lbug): re-anchor getEffectiveBufferPoolSize's placement and reuse granuleRatio in doctor Self-review fixes: the getter's insertion had orphaned resolveBufferManagerSize's doc comment (it read as documenting the wrong function), and doctor's scale note duplicated the granule math with a hardcoded 4096. granuleRatio is now exported (it already carried the test-seam default param) and doctor consumes it. No behavioral change — the sizing suite pins byte-identical outputs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(lbug): keep the hintless pool default unscaled and make both remedies visible (#2631) Review fixes: - Scale only the analyze-path cap (scaledAnalyzePoolCap), not defaultBufferPoolSize: the pool is an eager native allocation at DB open (measured, see POOL_BYTES_PER_ELEMENT), so a page-size-scaled hintless default would hand a long-lived MCP process up to 80% of RAM — the #2557 OOM exposure the 2 GiB cap removed. Fix the MAP_NORESERVE claim that contradicted that measurement. - Log the rel-pair pool remedy (loadGraphToLbug returns warnings that no call site reads) and dedup it with a local boolean instead of matching the remedy's own wording. - Label the GITNEXUS_LBUG_BUFFER_POOL_SIZE=0 sentinel as the native 80%-of-RAM default in both the remedy and doctor instead of '0 MiB'. - Extract poolSizeDoctorLine (pageSizeDoctorLines convention): mark env overrides, drop the scaling suffix that misdescribed absolute values. - Fold _resetOsPageSizeCacheForTest into _setOsPageSizeForTests(undefined). - Document the analyze-path scaling in both README env tables. --------- Co-authored-by: Gergo Magyar <abhigyan1.patwari@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 20:09:48 +01:00
Gergo Magyar	0f016dc467	fix(config): read core.excludesFile and .git/info/exclude for global ignores (#2606) ... Replace the custom ~/.gitnexus/ignore file with the same two sources real git itself consults for exactly this purpose (gitignore(5)): - core.excludesFile: git's own all-repos global ignore file (defaults to $XDG_CONFIG_HOME/git/ignore when unconfigured) - $GIT_COMMON_DIR/info/exclude: per-repo, untracked, so it works without push/commit access to the repo Precedence mirrors git exactly (lowest to highest): core.excludesFile, then info/exclude, then .gitignore, then .gitnexusignore -- each later source can negate an earlier one via a `!pattern` line, same last-match-wins semantics git itself uses. Adds getCoreExcludesFilePath and getGitInfoExcludePath to git.ts, following the same execSync + git-common-dir pattern as getCanonicalRepoRoot. GITNEXUS_NO_GLOBAL_IGNORE (or noGlobalIgnore) still skips both global sources, mirroring GITNEXUS_NO_GITIGNORE.	2026-07-21 18:06:22 +00:00
Gergo Magyar	5893de1194	docs(readme): document the global ignore file (#2606)	2026-07-21 16:58:57 +00:00
Ko	2a85425ad8	Merge pull request #2542 from GenKoKo/fix/worker-stdout-and-ready-timeout ... fix(ingestion): pipe worker stdout and make ready timeout configurable	2026-07-21 13:54:34 +01:00
ChamHerry	7534f53c27	feat(embeddings): control request-body dimensions via GITNEXUS_EMBEDDING_REQUEST_DIMS (#2574) ... * feat(embeddings): support GITNEXUS_EMBEDDING_REQUEST_DIMS=omit What: Honor GITNEXUS_EMBEDDING_REQUEST_DIMS=omit by suppressing the request-body `dimensions` field sent to HTTP embedding backends. Why: Strict OpenAI-compatible backends return vectors in the model's native size but reject an unfamiliar `dimensions` field, breaking `analyze --embeddings` against them. The var was parsed but never propagated, so `omit` was a no-op. How: Add `requestDimensions` to HttpConfig, return it from readConfig, and forward `config.requestDimensions` (not the validation-only `config.dimensions`) to `httpEmbedBatch`. Local dimension checks still use `config.dimensions`. Details: Coexists with the retry/pacing fields introduced upstream; both feature sets are preserved. Default behavior unchanged when REQUEST_DIMS is unset. Impact: gitnexus/src/core/embeddings/http-client.ts; README; unit tests. * fix(embeddings): name GITNEXUS_EMBEDDING_REQUEST_DIMS in its own config error Address the review findings on #2574. What: - A malformed GITNEXUS_EMBEDDING_REQUEST_DIMS now throws an error naming GITNEXUS_EMBEDDING_REQUEST_DIMS, not the sibling GITNEXUS_EMBEDDING_DIMS. - isHttpEmbeddingDimsError recognizes both leads, so the CLI still classifies the REQUEST_DIMS config mistake as a clean config error, not a stack dump. - Tests: numeric-override decoupling (DIMS=1024 validates the response while REQUEST_DIMS=512 is sent in the body), the omit aliases (none/off/false/0), and the malformed-value error path (which also pins the naming fix). - README documents the full accepted values: omit-aliases and integer override. Why: readConfig reused the DIMS error lead for the REQUEST_DIMS branch, so REQUEST_DIMS=garbage misdirected the operator to edit the wrong variable. The feature's actual decoupling and its non-omit inputs had no test coverage. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: wangxc <wangxc_a_bj@si-tech.com.cn> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 05:46:20 +01:00
Gergő Magyar	8b5057f325	feat(skills): GitNexus Engineering Tool Kits (#2566) ... * feat(skills): add ce-plan — GitNexus+PDG implementation-planning skill Adds .claude/skills/ce-plan: a planning-only skill that builds implementation-ready plans from GitNexus graph navigation (query/context/ impact/trace), bounded statement-level PDG slices (pdg_query, impact mode:pdg, explain), and targeted source verification, with a context ledger to prevent repeated reads and a machine-readable implementation context pack (stable contract for a future ce-implement). Whitelisted in .gitignore and registered in AGENTS.md and CLAUDE.md outside the auto-managed gitnexus block. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(skills): apply ce-plan validation findings (tool contract, consistency, conventions) Tool contract: impact mode:'pdg' shape now includes the schema-required direction param; CDG branch sense documented as the result 'label' field (reason is cypher/raw-edge only); explain caveats corrected to its real false-negative classes (cross-function TAINT_PATH is modeled). Consistency: PDG slice homed in working memory (ledger keeps one-liners); depth knob defined and category-overrides-baseline ordering stated; call_depth (consumed by nothing) and content-hash bookkeeping dropped; Never section folded into Hard rules; Phase 3 deduplicated to a pointer; allowed-repeat escalations defined; budget/discard accounting clarified; verification-commands gathering added to Phase 4; open_questions added to the context pack. From scenario runs: plans now pin the verified-at HEAD commit and index freshness in a header, tag claims [verified]/[graph]/[inferred]/[assumed], quote load-bearing tool output, prefer pre-hook-carrying npm scripts, and support an out:<path> destination override; output path defined as the Phase 1 target repo root. Conventions: AGENTS.md 1.9.0 / CLAUDE.md 1.4.0 changelog rows + metadata bumps; future ce-implement qualified as future. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): rename ce-plan → gitnexus-plan; add cross-CLI (Codex) entrypoints Renames the skill dir, frontmatter, output filename convention, plan H1 (GitNexus Engineering Plan), the future executor handle (gitnexus-implement), the .gitignore whitelist entry, and all AGENTS.md/CLAUDE.md references. Follows the pr-swarm-review cross-CLI pattern: SKILL.md is the canonical CLI-neutral spec, AGENTS.md § Engineering planning is the Codex/any-agent entrypoint, and the README documents the optional user-level ~/.codex/prompts/gitnexus-plan.md slash command plus an invocation matrix. Skill prose de-branded from Claude Code (agent-neutral verification layer). Also fixes two post-review README contradictions: the anti-reread claim now names the ledger's allowed escalations, and 'read-only by contract' is now 'planning-only' (the skill writes exactly one repo file — the plan); the scope-creep rule and template §12 now agree on where deferred follow-ups land. Drops the stale plugin-collision limitation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(skills): document Codex user-level install path for gitnexus-plan Codex discovers SKILL.md skills from ~/.agents/skills (same path the other gitnexus-* skills install to); README now documents the cp install plus the optional ~/.codex/prompts slash-command file, with the prompt body preferring the repo copy and falling back to the user-level install. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): gitnexus-plan freshness gate + active PDG-layer refresh Freshness is now a Phase 1 gate, not advisory: under the default freshness:strict, a stale index is refreshed once per planning session via node .gitnexus/run.cjs analyze --index-only (appending --pdg when the task will reach the PDG phase), then the context resource is re-read. A missing PDG layer likewise triggers the one permitted --index-only --pdg refresh and re-probe instead of a passive recommendation. freshness:accept (or a failed/impractical refresh) preserves the old behavior: plan on the stale graph, source-weighted, labelled in the plan header. --index-only is the load-bearing flag choice — it suppresses all file generation, so the planning-only contract holds (only the .gitnexus store changes). Ledger gains an index_refresh record; plan header states fresh / refreshed / refresh-skipped-with-reason. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): gitnexus-plan runner build check before freshness refresh When the target repo builds the analyzer from its own source (bin → dist/ mapping, as gitnexus/ does), the Phase 1 freshness gate now verifies dist/ is current before running the analyze refresh — rebuilding via the package's build script when any analyzer source file is newer than the built entrypoint — and prefers that freshly built CLI. Otherwise a stale dist re-indexes with outdated extraction logic and the 'fresh' index lies. Rebuilds are recorded in the ledger's index_refresh; the PDG-phase refresh inherits the same check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): add gitnexus-work executor and gitnexus-lfg pipeline gitnexus-work executes a gitnexus-plan as verified atomic commits: consumes the §11 implementation_context pack, drift-checks the plan's evidence pin against HEAD, re-verifies assumptions before relying on them, runs impact before every symbol edit and detect_changes before every commit (repo mandates), builds tests from the plan's scenarios, and routes structural drift back to gitnexus-plan Deepen mode instead of coding around it. gitnexus-lfg is a thin orchestrator: gitnexus-plan → blocking user gate (deepen / proceed / stop, deepen loops allowed) → gitnexus-work → review via the existing gitnexus-pr-review skill (open PR, else branch diff vs default). One bounded fix cycle for review findings; never pushes or opens a PR on its own. gitnexus-plan gains a Deepen mode (re-run freshness gate, escalate to depth:deep, re-verify graph/inferred/assumed claims toward verified, rewrite the same file); its 'future gitnexus-implement' placeholder is retired in favor of gitnexus-work. Registered via .gitignore whitelists, AGENTS.md 1.10.0 (section renamed to Engineering planning & execution), CLAUDE.md 1.5.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(skills): apply cross-skill review findings to the gitnexus skill family Two P1s: gitnexus-plan Deepen mode now re-anchors before re-pinning (diffs the old evidence pin over every [verified]-claim file and re-reads or downgrades before the header moves — moving the pin without this laundered stale claims as verified); the index-refresh budget is stated once in Phase 1 (one --index-only refresh plus at most one Phase 3 --pdg upgrade per session, Deepen = its own session) with ledger and pdg-slice deferring to it. Contract fixes: gitnexus-work's drift check now covers every file the pack cites (not just files_to_modify) and parses the full pack incl. primary/related symbols and acceptance_criteria (walked in Phase 4 alongside §13); a pre-completed check skips §7 steps already landed and Deepen gains a reconcile-execution-state step, closing the mid-execution route-back loop; pack assumptions must name what to check and how. lfg: Lane 4 passes the merge-base to detect_changes compare (two-dot diff misattributes upstream commits when default advanced), branch-diff is the stated normal case, oversized review findings route to the plan gate instead of overflowing direct mode, the one-fix-cycle cap is explicit on re-run, and headless runs end at the plan gate with the plan as deliverable. work: blank mode narrowed to *gitnexus-plan*.md with a re-execution guard, direct-mode discipline spelled out, branch meaningfulness defined against the plan slug, and the plan document is committed as the branch's docs commit (review diff includes it). Planning-only contract now names the dist/ rebuild as the second permitted state change; Phase 5.1 names the four claim tags; stale AGENTS.md anchors fixed. Known latent issue left untouched: gitnexus/gitnexus-pr-review pairs a three-dot example with a two-dot detect_changes compare — that skill is also shipped by the plugin, so fixing it here would drift the copies; lfg compensates by passing the merge-base. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): ship the engineering skill family with the gitnexus package npm i -g gitnexus users now get gitnexus-plan / gitnexus-work / gitnexus-lfg: the three skills are added to gitnexus/skills/ in directory form (SKILL.md + references/), which installSkillsTo already enumerates dynamically and copies recursively to every editor target (~/.agents/skills for Codex, Cursor, OpenCode, Qoder, ...) on gitnexus setup — uninstall enumerates the same root, so removal stays clean. The Claude Code plugin channel (gitnexus-claude-plugin/skills/) carries the same copies plus the standard per-skill mcp.json. Global-install support in the skill text: gitnexus-plan Phase 1 now resolves the analyzer runner explicitly — node .gitnexus/run.cjs analyze when the project has a runner, else gitnexus analyze (installed CLI), else npx gitnexus analyze — and all analyze mentions route through it, satisfying the skills-steering policy (#1939/#1945) which sweeps the plugin copies. New drift guard test/unit/shipped-skills-sync.test.ts asserts the npm and plugin copies stay byte-identical to the canonical .claude/skills/ family (plugin = canonical + mcp.json), same discipline as run.cjs ↔ resolve-invocation.ts. skills-steering + shipped-skills-sync: 11/11 green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(eval): workflow_bench — measure the skill workflow's token savings Benchmarks gitnexus-plan → gitnexus-work against a baseline agent (--disallowedTools Skill) on identical tasks, in fresh detached worktrees, using real headless Claude Code sessions; every number comes from the CLI's --output-format json usage report (field names validated against a live 2.1.207 session). Reports per-arm medians (input/cache/output tokens, cost, wall time, turns), a savings row, and resolve status from a per-task verify command — savings on failed tasks are flagged, not celebrated. Per-task setup hook prepares fresh worktrees (deps); --permission-mode bypassPermissions (default) lets sessions run unattended in the throwaway trees. Free-model support: --base-url/--auth-token/--model route headless sessions through any Anthropic-compatible endpoint; free-model.litellm.yaml is a ready litellm-proxy template for OpenRouter :free variants or local Ollama, so benchmarking burns no paid tokens (README documents rate limits and the small-model skill-following caveat). Harness validated end-to-end with a stub CLI (worktree lifecycle, both arms, plan→work chaining, verify, aggregation, report) and 4 pytest units for the pure aggregation/savings/report helpers. AGENTS.md 1.11.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(eval): record first workflow_bench calibration run Trivial-task calibration (add -V alias): both arms resolved; workflow arm ~4.3x baseline cost — the documented overhead-dominated regime, recorded so the regime boundary is empirical rather than asserted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(eval): workflow_bench scenario matrix — arm variants, task classes, churn Ground-base measurement across scenarios: tasks.scenarios.yaml spans four labeled classes (trivial → investigation-bug → investigation-feature → cross-module) with deterministic verifies (prescribed test files). New arms: workflow_direct (gitnexus-work direct mode — the middle option that locates the routing boundary lfg's gate and work's triage encode) and baseline_nomcp (no skills AND no graph tools — separates workflow-discipline value from GitNexus-tool value; off by default). Records now carry task class and diff churn (files/+ins/−del vs the starting commit) as an over-engineering proxy; the report renders a class column and per-arm savings rows vs baseline. 5 pytest units + stub-CLI e2e of the full three-arm matrix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(eval): record workflow_bench ground base; fix churn measurement bias Ground base (3 classes x 3 arms, n=1/cell): every arm resolved every task — pass/fail quality saturates at this difficulty, making the comparison pure cost. Full plan→work never amortized its ~$9-11 fixed cost on tasks a baseline finishes in ≤35 turns (−211% to −333% cost); workflow_direct sits near baseline (−15% to −55%, once faster wall) with more test coverage. Routing implication recorded: direct mode/plain agent below this scale, full workflow for cross-module / multi-session / plan-as-deliverable work. The cross-module cell and multi-run variance are the next measurements. Churn fix: git add --intent-to-add -A before diffing (arms that never commit no longer undercount new files) and :(exclude)docs/plans (the committed plan doc no longer inflates workflow churn); this run's churn numbers predate the fix and are omitted from the recorded table. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * perf(skills): cost-optimize the workflow from measured ground base Every optimization targets a measured fixed-cost component (eval/workflow_bench ground base: workflow arm −211% to −333% vs baseline, all tasks resolved): - Plan form is category-priced: compact form (core sections w/ § anchors preserved, ≤80 lines excl. pack, mini-pack subset of the context pack) for narrow/default categories; the full 13 sections only for deep work (refactor/security/performance/concurrency/architecture). A compact plan outgrowing its cap reclassifies to full rather than overflowing. - Freshness gate is category-priced: compact categories default to accept (source-weighted, refresh only when a graph claim becomes load-bearing); strict stays the default for full-plan categories — the rebuild+re-index was the largest single fixed cost. - Turn economy: per-category tool-call budgets (~10 to ~45; architecture uncapped); budget exhaustion routes open questions to §12 instead of more digging. - gitnexus-work fast path: HEAD == evidence pin → skip all citation re-reading (the pin's entire point); mini-pack fields tolerated. - lfg Lane 1 boundary triage: tasks below the measured ~35-turn boundary get offered gitnexus-work direct mode before the plan lane is spent. Copies re-synced (npm skills/, plugin, ~/.agents); steering + sync guards green. Re-measurement of the workflow arm follows to verify the numbers actually improve. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(eval): record optimization re-measurement — inv-bug workflow cell −20% cost Same task, same conditions, post-830a0459 skills: $14.56→$11.70 (−20%), 83→72 turns, cache_read −24%; verified in-transcript that the compact form, turn budget, and skipped rebuild/re-index all fired. Wall +15% from a work- session test-debugging tail (n=1 variance). Regime unchanged (~3.5x baseline on this class) — routing rule stands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(eval): per-arm clone isolation — worktree ref-namespace leak contaminated an arm The cross-module workflow_direct cell reported an impossible 28-turn solve with churn byte-identical to the workflow arm: git worktree add shares the repo's ref namespace, so the workflow arm's slug branch (created by gitnexus-work Phase 2) survived worktree removal and the direct arm found and adopted the completed work. Arms now get isolated git clone --shared copies (object store via alternates, refs clone-local — agent branches and stashes die with the clone; origin/<ref> fallback for non-default refs). Leaked branch deleted; baseline arm verified clean (0 branch references in its transcript); cell marked invalidated pending re-run. Records the valid cross-module cells: workflow $18.32 vs baseline $18.03 (premium −1.6%, vs −211%..−333% on smaller classes) — fixed costs amortize at this scale, with a less destructive diff and a plan artifact as bonus; resolve rate still tied. Churn fingerprinting is what caught the contamination — noted in the README as an integrity check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(eval): complete cross-module cell — direct mode wins 47% cost / 56% wall Clean clone-isolated re-run: workflow_direct resolved the hardest class at $9.53/52 turns/15m vs $18.03/98/34m baseline and $18.32/107/37m full workflow. The measured story across all four classes: the execution discipline (gitnexus-work) is the consistent sweet spot and delivers real token savings on hard tasks; the planning pass buys its artifact, not same-session savings. Resolve rate tied everywhere (n=1/cell caveat). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(eval): add trajectory-gated skill evolution (#2431) - Pair prompt candidates with incumbent workflow arms - Gate promotions on pinned-model quality and efficiency - Expire router evidence and document its lifecycle * fix(eval): allow pr-review skill candidates * feat(skills): rename and generalize GitNexus review * feat(eval): external-comparator and review arms for workflow_bench - ce_workflow / ce_workflow_direct: compound-engineering ce-plan/ce-work arms prompted with the same structure as the gitnexus arms - review / ce_review: gitnexus-review vs ce-code-review on an identical diff applied by the task's setup - plan handoff is snapshot-based: committed example plans in docs/plans/ tie on clone mtimes and broke the name-glob pick (executed a stale plan) - verify output tail is recorded per run and the final working-tree patch is kept, so failed rows are diagnosable after the clone is destroyed Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(skills,eval): address #2431 review — data-safe rename migration, fail-closed bench evidence - setup: never delete a legacy renamed skill dir — the installer cannot prove ownership (users customize or hand-write skills under these names); warn with the path instead, and the test now asserts survival - workflow_bench: fail closed when a session's --output-format json report is empty, malformed, or missing usage fields — an exit-0 shell with no parseable usage no longer counts as measured evidence (5 parametrized regression tests) - workflow_bench: document the trust model prominently (task setup/verify are shell-executed, sessions run bypassPermissions with the parent env, candidate overlays are prompt injection surface) in README + docstring - free-model.litellm.yaml: master_key from LITELLM_MASTER_KEY env instead of a static token; loopback-binding warning - ci: run the eval workflow_bench pytest suite on ubuntu (pytest+pyyaml only — no full eval stack) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(eval): demand observed foreground verification in headless work-arm prompts In a headless -p session there is no later turn: a work arm backgrounded its slow test run, scheduled wakeups that can never fire, and reported done while two of its tests failed. All four work-arm prompts (both skill families, symmetric) now require verification output to be observed inside the session. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): ask plan depth up front instead of offering deepen afterwards gitnexus-plan Phase 0 now asks one blocking question in interactive sessions — quick / standard / deep, mapped onto the existing depth/form/ freshness knobs — when the invocation carries no explicit depth signal. Explicit knobs and headless runs skip the question (category posture unchanged, so benchmarks and automation behave as before). gitnexus-lfg's plan gate slims to proceed/stop: depth was already the user's up-front choice, so deepening is no longer offered by default — an explicit deepen request at the gate and executor route-backs still run Deepen mode, which remains the mechanism for strengthening an existing plan document. All shipped copies resynced (npm skills/, Claude plugin); AGENTS.md 1.13.0 and CLAUDE.md 1.7.0 pointers updated, including the analyzer's regenerated index-stats block at this branch's head. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): taint pass, expert lenses, and post-work index refresh gitnexus-review gains a PDG-backed taint-and-dependence pass (explain + pdg_query, --pdg folded into the stale refresh on trust-boundary diffs) and an Expert lenses section: domain reviewers derived from the graph's clusters plus four cross-cutting lenses (architectural fit, language conformance per the repo's own contract, Definition of Done, simplicity), dispatched once after the evidence-gathering steps and scaled to the diff. gitnexus-work Phase 4 now refreshes the knowledge graph after the DoD walk via the resolved-runner ladder with analyze --index-only, so the lfg review lane and later sessions query the finished work without dirtying the tree. lfg's threshold-governance paragraph moves to its README; eval citations are tagged as measured in the GitNexus repo. All shipped copies re-synced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cli): remove legacy gitnexus-pr-review on uninstall; cover the rename migration uninstall's removal set now includes LEGACY_SKILL_DIR_NAMES derived from RENAMED_SKILL_DIRS, so a pre-rename install is cleaned up instead of orphaned. The rename warning gains behavioral coverage (fires with a legacy dir present, silent without), and shipped-skills-sync asserts legacy names stay absent from every shipped tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(eval): metric provenance, error-kind rows, skill-invocation verification, gate noise floor The promotion gate defaults to cost_usd (the only metric that includes subagent spend); token metrics carry an explicit main-loop-only warning in the report and promotion.json. Rows are classified by error_kind (session-error / verify-failed / infra-error), excluded from efficiency medians, and the gate requires equal valid-run counts. Each session's transcript is scanned for the expected Skill invocation and fails closed on a verified miss; a one-run resolution edge no longer promotes (noise floor). Per-run timeouts and setup failures record an infra-error row instead of aborting the sweep. Overlays touching skills no candidate arm exercises are rejected up front. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: fix skill routing paths, version headers, and skill rosters Routing tables point at the tracked direct skill paths (matching the post-#2434 generator output), AGENTS.md/CLAUDE.md headers match their latest changelog rows, the 1.12.0 row describes what the migration actually does, package/cursor READMEs list the full shipped skill roster, and the swarm READMEs describe /gitnexus-review's expert lenses instead of calling it single-agent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: drift-guard workflow for skill copies; pin eval pip deps; track docs/plans ci.yml ignores '**.md', so an md-only skill edit would merge without the shipped-skills-sync test running — skill-sync.yml triggers exactly on the guarded trees. The eval job's pip install is version-pinned, and docs/plans/ is unignored so gitnexus-plan output can be committed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): keep the runner-invocation literal in gitnexus-review; add concurrency block to skill-sync skills-steering requires skills with a stale-index hint to carry the exact 'node .gitnexus/run.cjs analyze' form — restore it with the fallback ladder as a parenthetical instead of replacing it. skill-sync.yml gains the top-level concurrency block the workflow-convention check enforces. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): token-economy guidance for expert lenses Merge lenses that ground in the same material into one reviewer, and use cheaper model/effort tiers for mechanical lenses where the harness offers them, reserving the strongest engine for adversarial judgment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(eval): isolate transcript home on Windows Ensure workflow_bench transcript tests set USERPROFILE alongside HOME so Path.home() resolves to the temporary test home on Windows. * docs(skills): fold PR #2522 execution learnings into review/work/plan Eight incident-backed hardenings from running the full skill cycle (review -> plan -> work, 28-finding fix series) on PR #2522: gitnexus-review: - Expert lenses execute the code under review on candidate failing shapes (empirical probe outranks source reading — every HIGH the language lenses found came from a probe, not a read). - Step 7 re-runs the exact CI check for refreshed baselines/fingerprints (a stale committed artifact is invisible in the diff; caught a red benchmarks arm). - Step 8 treats version/invalidation constants as review surface (INCREMENTAL_SCHEMA_VERSION class recurred verbatim from #2494). gitnexus-work: - Step 4 proves regression tests discriminate against the pre-fix tree. - Step 5 rebuilds executed build output before every verification run (parse workers load dist/; a correct fix 'failed' until rebuilt). - Step 6 makes stage -> detect_changes -> commit one unbroken sequence. gitnexus-plan: - Phase 0 seeded-evidence mode: plan FROM a completed review's verified findings instead of re-running the graph ladder. - Template §7: fingerprint/golden-guarded output rebaselines once, at the series tip. All distribution copies resynced; shipped-skills-sync + skills-steering 24/24 locally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(eval): close the skill-evolution loop with an automated proposer driver workflow_bench.evolve adds the three arrows the README described as manual: a proposer session that turns loser trajectories (results.jsonl rows, transcripts, patches, the learning queue) into ONE bounded candidate overlay, a driver that iterates propose -> paired benchmark -> deterministic gate up to --generations, and an --apply step that copies a promoted overlay onto the canonical skills and shipped mirrors as a working-tree diff. The trust boundary is unchanged: overlays re-validate through candidate_overlay_files before any benchmark or apply consumes them, and committing, CI, and the PR merge stay human. learnings.jsonl is gitignored: it is machine-local evidence, like the session transcripts it complements. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(skills): route live-task friction into the evolution learning queue Each family skill gains a short 'Skill feedback' section: on friction with the skill's own instructions, append one JSON line to eval/workflow_bench/learnings.jsonl (GitNexus repo only) — never self-edit the skill from a live task. The proposer in workflow_bench.evolve consumes the queue as hints; a learning reaches a shipped skill only by beating the incumbent on the paired benchmark. All shipped mirrors re-copied byte- identical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(tests): run the evolve helper tests in the eval pytest job test_evolve.py needs only pytest+pyyaml, same as the harness tests the job already runs — without this line the new module had no CI coverage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ci): comment-triggered GitNexus review agent for PRs '@gitnexus review' from a maintainer (OWNER/MEMBER/COLLABORATOR; the action re-validates write access) runs the repo's gitnexus-review skill headlessly against the PR and posts the review as a sticky comment — remote triggering with no local setup. Read-only by construction: contents: read token, Write/Edit and web tools disallowed, Bash allowlisted to git reads and the gitnexus CLI; analyze parses PR code with tree-sitter, never executes it. Requires the ANTHROPIC_API_KEY repository secret; activates once the file is on the default branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ci): dispatch lane + existing OAuth secret for the review agent Align with claude.yml: same action pin and the CLAUDE_CODE_OAUTH_TOKEN secret the repo already carries — no new secret to configure. Add a workflow_dispatch lane (PR number input) so the agent can be triggered from the Actions UI and tested before the issue_comment trigger reaches the default branch. Allowlist gh pr view/diff and gh api, which the review skill uses to pin PR SHAs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): close a fork-PR RCE vector in the review agent's tool allowlist A live headless run of the exact workflow session against PR #2431 (66 turns, full gitnexus-review pass) surfaced a real HIGH-severity confused deputy: .gitnexus/ is gitignored, not blocked — a fork PR can commit its own .gitnexus/run.cjs, issue_comment checks out PR-head content, and the skill's runner ladder tries 'node .gitnexus/run.cjs analyze' first. That would execute fork-controlled JS inside a job holding CLAUDE_CODE_OAUTH_TOKEN and a write-scoped GITHUB_TOKEN — the opposite of the 'PR code is read, never executed' claim in the workflow's own header. Fix: drop the run.cjs allowlist entry so analyze always resolves through npx gitnexus (npm registry, not the checked-out tree); the skill's documented fallback mode covers the resulting graceful degradation. Also drop 'gh api' (not read-only — accepts -X POST/PATCH/DELETE) and downgrade pull-requests: write to read (comment posting only needs issues: write; the prompt already forbids formal review submission). Same session flagged a latent evolve.py bug: select_evidence's cost sort used dict.get's missing-key default, which doesn't cover an explicit JSON null in a foreign --seed-results row and crashes proposer setup with TypeError. Guarded with 'or 0.0' and added a regression test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: harden PR review and evolution trust boundaries * ci: follow workflow concurrency convention * fix(eval): make terminating error paths explicit * fix: unblock hardened review runtime checks * test: make containment canaries deterministic * test: expose Claude canary tool failures * fix: adapt clean shell environment for Claude * fix(eval): accept the runner's transcript source key in evidence preflight The proposer evidence preflight required transcript-artifact metadata to be exactly {path, sha256, bytes}, but the runner stamps a fourth provenance key (source=parent-captured-stream-json). Any --seed-results or generation>=2 run therefore aborted with SandboxError before proposing or promoting. Pin the producer literal as PARENT_EVENT_STREAM_SOURCE and validate it in the metadata check, and round-trip real producer output through sum_sessions into the preflight so the schema can't drift again. * fix(eval): treat an unmeasured session cost as unavailable, not $0 well_formed validated only the nested usage block, so an otherwise-successful session missing total_cost_usd was recorded as cost_usd=0.0 — and cost_usd is the default promotion metric (lower wins), so a cost-less session scored as free and could win promotion it never earned. Extract cost via measured_cost() (None on absent/garbage, a measured 0.0 preserved), propagate None through sum_sessions/aggregate/savings/report, and have the gate refuse to rank on a metric that was not measured on every run in both arms. * fix(eval): warn when ranking on the main-loop-only num_turns metric num_turns comes from the CLI's top-level usage (main-loop session only), like output_tokens, but selecting it emitted no metric_warning — so a subagent-heavy candidate could look artificially efficient. Add num_turns to MAIN_LOOP_ONLY_METRICS and broaden the warning to cover turns. * fix(eval): fail closed when an overlay adds a file with no committed base An overlay adding a new .md under gitnexus-{plan,work} passes the structural overlay checks but has no committed base for committed_destination_base_digests to bind against, so it raised an uncaught ValueError that crashed the evolve driver (and runner --candidate-overlay) mid-run. Catch it at both call sites: evolve reports NOT PROMOTED and exits, runner routes it through parser.error. * feat(eval): circuit-break the runner sweep on a systemic outage A sustained upstream outage used to pay out every remaining --timeout window one session at a time. Track consecutive session/infra/cleanup failures via a pure systemic_outage_streak helper; after --outage-streak (default 5) in a row, stop the sweep, still write report.md/promotion.json from partial evidence, and exit non-zero so evolve.py halts instead of proposing from truncated evidence. A task's own resolved=False never trips the breaker. * fix(cli): report a dirty working tree as stale in gitnexus status status --json (and the human output) computed up-to-date from commit + runner identity + completeness only, so a repo with uncommitted source changes at a matching HEAD was reported up-to-date while analyze would still re-index it. A graph-backed agent gating on that JSON could skip re-analysis on a stale graph. Extract analyze's dirty-tree check into a shared isWorkingTreeDirty() in storage/git and fold it into the status freshness decision. * fix(ci): use single-slash deny globs in the review agent's disallowedTools github.workspace already expands to an absolute path, so Read(/${{ github.workspace }}/**) and Read(//proc/**),(//sys/**),(//dev/**) produced double-slash patterns that a normalizing matcher may not match — silently no-opping the deny layer. Not exploitable (the allowlist is the primary control and never grants those paths), but the globs should be well-formed. Update the pinned test strings. * ci: install gitnexus-shared with npm ci from the committed lockfile The gitnexus-shared build floated its deps via npm install in three workflows (skill-sync, ci-tests, and — most importantly — the release publish.yml) while every other install step uses npm ci. The lockfile is committed and in sync, so switch all three to npm ci for reproducible, locked installs. * test(cli): make the shipped-skills drift guard reject symlinks listFilesRecursive walked with readdirSync and snapshotDir read with readFileSync, both of which follow symlinks — so a mirror file symlinked to the canonical tree passed the byte-compare (and a symlinked mirror dir would be followed too). Reject a symlinked root via lstat and any symlinked entry via Dirent.isSymbolicLink, with negative tests (skipped on Windows). * test(eval): guard the candidate-skill vs mirror-root coverage invariant MIRROR_SKILL_ROOTS omits the Cursor tree, safe only because no candidate skill is cursor-shipped. Pin that invariant: every CANDIDATE_SKILLS entry must exist under canonical + every mirror root and must not ship to Cursor, so adding a cursor-shipped skill to the candidate set (the PR #2488 asymmetric-sync class) fails loudly instead of syncing three of four trees. * docs(ci): describe the review agent's staged post-merge rollout The DoD asked for a dry-run or triggered run before merge, but an issue_comment (or newly added workflow_dispatch) workflow only ever executes the default-branch copy, so it cannot be exercised from the PR that introduces it. Reword the DoD and the activation checklist to a staged rollout: merge registered-but-disabled, validate same-repo and fork execution post-merge, then enable the variable. * fix: pin plugin skill mcp.json to the release version via #2445 tooling The ten plugin skill mcp.json launched `npx -y gitnexus@latest mcp` on every skill connect — non-reproducible and a supply-chain surface, and (unlike the persisted setup config) never pinned. Extend sync-plugin-manifests.mjs with an mcp surface kind that stamps the gitnexus@<version> launch arg, pin all ten to 1.6.9 now, and keep them byte-identical so the drift guard stays green. The release lifecycle + publish.yml --check now re-stamp them like the four manifest surfaces; only READMEs stay on @latest as docs. * test(eval): prove the proposer's built-in file tools are confined The real-Claude canary only exercised Bash + MCP, so it proved process/MCP containment but not that the proposer's built-in file tools stay inside their mounts. Add a canary over the exact PROPOSER_ALLOWED_TOOLS surface and the same read-only /evidence mount as run_proposer (allowlist extracted to a shared constant so it can't drift): Read reaches /evidence, a Write into the read-only evidence mount is denied, and a Write lands in the output tree. * fix(eval): apply the candidate overlay after task setup for fair arms The candidate overlay was applied before the task's untrusted setup ran, so setup could observe candidate prose and the incumbent/candidate arms started from different pre-overlay state. Reorder within the sandbox: capture the base (pre-overlay) skill digest, run setup against the base skills, verify setup did not tamper them, then apply the overlay and capture the post-overlay digest the model must preserve. apply_candidate_overlay stages path-specific overlay files, so setup's uncommitted changes stay out of the baseline and churn is unchanged. Graph freshness for the review arm is handled by the status dirty-tree fix plus the review skill's stale-triggered re-index, not by reordering the cached per-task-sha graph materialization (which is mechanically blocked). * test(eval): end-to-end containment proof of the autonomous proposer Drives the real run_proposer through bubblewrap with a deterministic scripted model (no paid API): it reads the read-only evidence bundle and writes a candidate gitnexus-plan skill edit plus a rationale into the sandbox output tree; run_proposer enforces the trust boundary and copies only the validated overlay + proposal out. This exercises the autonomous-proposal stage of the self-evolution loop end-to-end in the eval/containment CI job (the gate and apply stages are covered by test_workflow_bench_evolution and test_promotion_apply). Env-gated on GITNEXUS_REQUIRE_CLAUDE_CANARY, so it runs only where the pinned Claude binary and user namespaces are available. * fix(eval): let the proposer author its overlay via Bash Running the end-to-end proposer canary in the containment CI job surfaced a real bug: run_proposer starts the session with --bare, which hard-disables the Write/Edit tools ("Write exists but is not enabled in this context"), yet allowlisted Edit/Write and omitted Bash. The proposer therefore had no working way to write its candidate overlay — the self-evolution loop could never produce a candidate. The sandbox settings already pre-authorize Bash (autoAllowBashIfSandboxed) and confine writes to workspace/tmp/home, so switch PROPOSER_ALLOWED_TOOLS to Read/Grep/Glob/Bash and tell the proposer to author files with Bash. The end-to-end test now drives the real run_proposer through bubblewrap and asserts a validated overlay + proposal are produced (this also replaces the earlier file-tool canary, whose Write/Edit premise was moot). * test(eval): author the proposer overlay with newline-free Bash content The nested shell-sandbox prefix mangles embedded newlines, so the multi-line overlay content never landed. Use single-line content for the deterministic proposer canary. * test(eval): drop the unverifiable end-to-end proposer canary The scripted proposer overlay never materialized in the containment job across runs, and the model tool-result content is not visible in CI logs, so the test cannot be finalized without an environment where the sandbox can actually run. Keep the verified production fix (Bash-authoring in run_proposer); the proposer sandbox/containment stays covered by the existing Bash+MCP and process-tree canaries. * test(cli): drop run-analyze.ts from the windowsHide spawn-family list U7 moved run-analyze.ts's only child_process call (the git status --porcelain dirty check) into storage/git.ts (already covered by this test, with windowsHide). run-analyze.ts no longer imports a spawn-family function, so the windowsHide-regression test's 'must have >=1 spawn call' invariant failed for it. Remove it from SRC_FILES. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Zander Raycraft <zanderjraycraft@gmail.com> Co-authored-by: Azizur Rahman <azizur100389@gmail.com>	2026-07-19 15:07:24 +01:00
Gergő Magyar	249f5c7aab	fix(lbug): bound the LadybugDB buffer pool instead of the native 80%-of-RAM default (#2560) ... * fix(lbug): bound the LadybugDB buffer pool instead of the native 80%-of-RAM default (#2557) createLbugDatabase passed bufferManagerSize=0, which the native runtime sizes at 80% of physical RAM. A long-lived gitnexus mcp process (or a large incremental analyze) could balloon to that ceiling — 19.5 GiB observed against a 105 MiB on-disk index — and OOM-kill the host session. Resolve the pool at call time: default min(2 GiB, max(64 MiB, 80% of totalmem)), overridable via GITNEXUS_LBUG_BUFFER_POOL_SIZE (bytes); 0 deliberately restores the native unbounded default; invalid values warn and fall back, mirroring GITNEXUS_WAL_CHECKPOINT_THRESHOLD. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(readme): document GITNEXUS_LBUG_BUFFER_POOL_SIZE and GITNEXUS_LBUG_MAX_DB_SIZE (#2557) Both env tables gain the new buffer-pool ceiling variable and the previously code-comment-only GITNEXUS_LBUG_MAX_DB_SIZE, with the mmap-vs-memory distinction the issue had to discover from source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(lbug): keep parseBufferPoolSize module-private Review finding: the export had zero importers — parseWalCheckpointThreshold earns its export via the CLI flag validation, but the buffer-pool CLI flag was deliberately deferred. Re-export when a consumer exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-18 20:50:14 +01:00
azizur100389	a333d94a00	feat(wiki): allow explicit HTTP LLM hosts (#2491) ... * feat(wiki): allow explicit HTTP LLM hosts Keep wiki LLM HTTP endpoints fail-closed by default while adding a narrow exact-host opt-in for LAN/self-hosted models. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(wiki): simplify insecure LLM flag name Rename the wiki HTTP opt-in flag to --allow-insecure-connection per review feedback. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(wiki): simplify insecure connection env Rename the wiki HTTP allowlist environment variable and align validation errors with the CLI flag naming. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-07-16 13:53:58 +01:00
Eva	a117cf8a21	Merge remote-tracking branch 'upstream/main' into upstream/embedding-http-resilience	2026-07-16 09:44:17 +07:00
Gergő Magyar	a05b501102	fix(cli): make Claude skills discoverable (#2434)	2026-07-15 20:40:20 +05:00
Eva	711ff8721d	fix(embeddings): make HTTP generation resumable	2026-07-14 02:15:57 +07:00
Gergő Magyar	c6445096eb	fix: stop Napi::Error SIGABRT on analyze — index C++ type lookups, terminate workers only at JS-safe points (#2432) (#2436)	2026-07-11 18:07:08 +01:00
azizur100389	f236be05e0	feat: gate Icebug community engine prototype (#2376)	2026-07-09 05:43:49 +01:00
Gergő Magyar	1408bfbffe	fix(hook): emit MCP query hint when server owns DB lock (#2396) (#2397) ... * fix(hook): emit MCP query hint when server owns DB lock (#2396) When the GitNexus MCP server holds the lbug write lock, the PreToolUse hook's CLI `augment` cannot run (LadybugDB is single-writer) and previously skipped silently — disabling graph augmentation in the most common deployment (server online). Since the same session already has the MCP `query` tool live, the owner branch now emits an additionalContext hint pointing the agent at mcp__gitnexus__query for that pattern, via the same sanctioned stdout channel the augment-success path uses (Codex-safe, #2369). Rejected the alternative of having the hook query the server: it runs over stdio (no port/pipe from the separate hook process) and cross-process read-only access can't coexist with the write lock — both are large architecture changes. Applied to all three gated hook copies (claude .cjs, claude-plugin .js, antigravity .cjs); the cursor hook has no owner gate and is untouched. The stderr `augment skipped: MCP server owns DB` diagnostic stays GITNEXUS_DEBUG-gated (#1913). Owner-path tests flipped from stdout-empty to hint-present. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(hook): reword MCP-query hint to be conditionally truthful (#2396) The #2396 owner branch emits the hint on every DB-owner path — a confirmed `gitnexus mcp` owner, a `gitnexus serve` owner, and the fail-closed/timeout paths (the probe collapses timeout and owned to one boolean). The old text claimed "Knowledge graph is live via the MCP server" and named mcp__gitnexus__query unconditionally, which is untrue on a fail-closed probe where no server is confirmed and misdirecting for a serve-only owner (review C2/C4). Reword the hint (byte-identical across all three hook copies) to state that local augment is unavailable and to condition the MCP call on the tools actually being live ("if the GitNexus MCP tools are live in this session"). This is truthful on every owner path; the needles the assertions rely on (mcp__gitnexus__query, query, search_query, the pattern) are preserved. Fix the 10 stale owner/fail-closed unit tests that still asserted empty stdout (review C1, the macOS platform-sensitive 2/3 blocker): flip them to assert the hint via parseHookOutput, keep their stderr/GITNEXUS_DEBUG expectations, and rename the two 'SILENTLY' titles. The GITNEXUS_DEBUG='' owner-hint case is restored (the PR's new loop only covered '0'/'false'). Probe and its white-box tests untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(hook): de-orphan the JSDoc in the claude hook copy (#2396) The #2396 change inserted buildMcpQueryHint between the pre-existing "PreToolUse handler" JSDoc and handlePreToolUse, orphaning that doc onto the helper and leaving handlePreToolUse undocumented (review C5). Move the helper (with its own doc) above the handler doc so the "PreToolUse handler" comment again precedes handlePreToolUse, matching the clean plugin copy. Pure move; no behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(hook): throttle the MCP-owner hint to once per repo per window (#2396) Previously the hint emitted on every qualifying search while a GitNexus process owned the DB, so an owner-locked session (the common deploy) was nudged toward the MCP query tool on every Grep/Glob/Bash — context bloat and ~2x query amplification (review C3). Add shouldEmitMcpHint(gitNexusDir) to all three hook copies: a per-repo .gitnexus/.mcp-hint-shown mtime marker emits the hint at most once per window. Window via GITNEXUS_MCP_HINT_THROTTLE_MS (default 10min; 0/invalid disables). Best-effort — any fs error falls back to emitting, so the hint is never lost to a marker failure. The stderr skip diagnostic still fires regardless (only the hint is throttled). Tests: hookEnv disables the throttle by default (gitNexusDir is shared across the suite, so a marker would otherwise throttle sibling owner tests); a dedicated macOS-lane test sets a real window and asserts emit-then-throttle with the marker gating it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(hook): README reflects the MCP-owner query hint, not a silent skip (#2396) The 'Hook augmentation/notifications are silently skipped' section still described the MCP-server-owns-DB path as a silent augmentation skip (review docs finding). That path now hands the agent a conditional MCP-query hint via additionalContext (throttled per repo). Reword the section to describe the hint and its GITNEXUS_MCP_HINT_THROTTLE_MS throttle, and keep the GITNEXUS_DEBUG stderr-diagnostic guidance. No CHANGELOG edit (owned at release time). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(hook): guard hint-copy drift + pattern JSON-escaping (#2396) Two gaps the review flagged (R7): - Drift guard: buildMcpQueryHint and shouldEmitMcpHint are triplicated across the three hook copies with no shared module. A source-level byte-identity check (runs on every platform, unlike the macOS-only owner tests) fails if any copy diverges — the institutional pattern the repo already uses for mirrored hook metadata. - Escaping: an adversarial Grep pattern (embedded quote + newline) must not break the additionalContext JSON envelope. A macOS-lane owner test drives the real hook with such a pattern and asserts parseHookOutput still yields valid JSON containing the literal characters (JSON.stringify escapes them). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 18:34:05 +01:00
Gergő Magyar	177bbc89c3	fix: surface real FTS extension LOAD errors and self-heal broken extension files (#2374) (#2375)	2026-07-06 06:41:05 +01:00
Gergő Magyar	cdad478c96	fix: proxy-blocked installs survive onnxruntime-node postinstall and self-heal embeddings (#2370) (#2372)	2026-07-05 16:15:10 +01:00
Gergő Magyar	187c162fd8	feat: full Codex support — hooks, plugin marketplace, and setup (#2328, supersedes #1131) (#2369) ... * feat(setup): install Codex PreToolUse/PostToolUse hooks (#2328) Codex CLI supports lifecycle hooks with Claude Code's exact {hooks: {Event: [...]}} JSON schema, stdin payload, and hookSpecificOutput response contract, registered in a dedicated ~/.codex/hooks.json (https://developers.openai.com/codex/hooks). Parameterize installClaudeCodeHooks into installClaudeSchemaHooks (claude | codex): both runtimes share the installer, the bundled gitnexus-hook.cjs adapter, and its helpers. A codex HookTarget in editor-targets.ts makes uninstall and the setup-uninstall round-trip tripwire cover the new surface with no uninstall.ts changes. SessionStart is deliberately not registered: Codex reads AGENTS.md natively, which already carries the GitNexus context block. Closes #2328. Closes #244 (Codex setup support is now complete: MCP + skills + hooks). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(plugin): make the GitNexus plugin installable from Codex (#1131) Codex's plugin system (https://developers.openai.com/codex/plugins/build) reads a .codex-plugin/plugin.json manifest and a repo-root .agents/plugins/marketplace.json registry. The existing gitnexus-claude-plugin/ is already Codex-compatible as-is — Codex sets CLAUDE_PLUGIN_ROOT for hook-command compatibility, loads the same SKILL.md skills, hooks/hooks.json, and .mcp.json — so a second manifest in the same folder replaces PR #1131's duplicated plugin tree with zero copied skills or hooks. The .gitignore .agents/ scratch rule narrows to re-include only the registry file. Install: codex plugin marketplace add abhigyanpatwari/GitNexus Supersedes #1131. Co-authored-by: jublin <1799126+jublin@users.noreply.github.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: document Codex full support (MCP + skills + hooks + plugin) Promote Codex to Full in both editor tables, document the ~/.codex/hooks.json hook install, and add the Codex plugin marketplace install path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(release): extend the version-lockstep guard to the Codex manifests The always-on drift guard asserted only the Claude plugin manifests against gitnexus/package.json, so a release could ship stale versions in .codex-plugin/plugin.json and .agents/plugins/marketplace.json without CI noticing. Mirror the Claude lockstep test for the two Codex files and extend the CONTRIBUTING §Releases lockstep list to match. Verified guard semantics: a deliberate local version mutation of the Codex marketplace entry turns the new test red. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugin): quote the hook command path for space-containing plugin roots Both plugin hook commands ran `node ${CLAUDE_PLUGIN_ROOT}/hooks/...` unquoted, which breaks whenever the substituted plugin root contains a space — the common case on Windows user profiles. Both Claude Code and Codex substitute the placeholder before shell execution, and Claude Code's plugin docs mandate the double-quoted form in shell-form hooks. No commandWindows entry: Codex source (codex-rs hooks engine) falls back to `command` on Windows with identical placeholder substitution, so an identical-content override would be pure duplication. Verified: space-in-root smoke test (old form exits 1 MODULE_NOT_FOUND, quoted form exits 0), `claude plugin validate` passes, and a local `codex plugin marketplace add` parses the marketplace + plugin cleanly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(setup): pin fail-closed behavior for unreadable/corrupt Codex hooks.json The non-ENOENT suite covered Claude settings.json (EACCES) and Codex config.toml (EACCES) but not the new ~/.codex/hooks.json surface, and the mergeHooksJsonc "is corrupt" branch had zero coverage for either editor. A future refactor dropping the isEnoent rethrow or the parse gate could silently rewrite a user's hooks.json gitnexus-only with no CI tripwire. Two regression tests: EACCES leaves hooks.json byte-identical and reports "Codex hooks: EACCES"; corrupt content is preserved and reported via "Codex hooks: hooks.json is corrupt". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(readme): add the Codex plugin-marketplace install path to the npm README The root README documents the one-step plugin route but the package README (what npmjs.com renders) only showed the setup-CLI path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(setup): rename claudeHook to hookCfg in installClaudeSchemaHooks The local held a codex HookTarget on the codex branch since the installer was parameterized, so the claude-specific name misled. Pure local rename, no behavior change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(readme): document Codex SessionStart exclusion, /hooks trust gate, and install-route choice Three behaviors were only recorded in code comments and the PR body: SessionStart is deliberately not registered (Codex reads AGENTS.md natively), setup-installed hooks need one-time /hooks approval in Codex, and the setup CLI and plugin are alternative install routes whose hooks load alongside each other if both are used. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(test): share one logLines helper across setup.test.ts describes The corrupt-hooks.json test inlined the console.log-flattening expression that the non-ENOENT describe already defined locally. Hoist a single file-scope logLines so the two stay in sync. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 13:32:17 +01:00
Gergő Magyar	6252aa745f	feat(setup): add CodeBuddy and Qoder coding-agent integrations (#2368) ... * feat(setup): add CodeBuddy and Qoder coding-agent integrations Adds Tencent CodeBuddy and Alibaba Qoder to gitnexus setup/uninstall, fitted to the editor-targets registry and --coding-agent selection. - CodeBuddy: MCP entry written into the first existing file of its documented priority chain (~/.codebuddy/.mcp.json recommended, ~/.codebuddy/mcp.json deprecated, ~/.codebuddy.json legacy) so a populated deprecated config is never shadowed; skills to ~/.codebuddy/skills/ (https://www.codebuddy.ai/docs/cli/mcp) - Qoder: MCP entry in ~/.qoder.json, skills to ~/.qoder/skills/ (https://docs.qoder.com/cli/using-cli, /extensions/skills) - editor-targets gains optional legacyFiles; uninstall sweeps them - roster strings updated (CLI help, i18n en/zh-CN, READMEs); en/zh-CN setup descriptions were stale (missing Antigravity) and are refreshed Supersedes and credits PR #1030 by @zykai0302, re-fitted to the post-#2168 selective-agent architecture with documented config paths. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(cli): assert stable zh-CN setup-description fragment * fix(setup): surface non-ENOENT config read/stat failures instead of clobbering * fix(setup): report corrupt legacy MCP files informationally during uninstall * test(setup): cover multi-candidate uninstall sweep combinations * fix(setup): detect CodeBuddy/Qoder installs via existing MCP config files * fix(setup): skip empty and non-file candidates in the MCP config chain * docs: add CodeBuddy and Qoder manual MCP configuration sections * test(ci): run the setup-uninstall round-trip in the cross-platform matrix * fix(setup): never claim "not configured" when uninstall recorded errors * refactor(cli): share the isEnoent predicate via editor-targets * refactor(setup): share chain-file install detection between CodeBuddy and Qoder --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 10:54:50 +01:00
Gergő Magyar	e46b87f291	feat: flat workspace index follows the checked-out branch (#2364) ... * feat: flat workspace index follows the checked-out branch (#2354) A plain `gitnexus analyze` now always targets the flat workspace slot, updating it incrementally across branch switches instead of auto-routing non-owner branches into `branches/<slug>/` sub-indexes (disk bloat) or nagging with the primary-inversion "run gitnexus clean" warning. No new CLI flag or config key: the smart behavior is the default. - Placement: only explicit `--branch` consults resolveBranchPlacement; plain runs resolve to the flat slot, `meta.branch` becomes an informational "last analyzed branch" label restamped each run. - Fast path: a same-commit clean-tree branch flip restamps the label and registry entry (adoptFlatBranchLabel, no-op for unregistered repos). - Shadow cleanup: when the flat slot adopts a label that has a pinned sub-index, the now-unreachable `branches/<slug>/` dir and its registry summary are removed together. - MCP: applyBranchScope always falls back to the on-disk flat meta before throwing "not indexed", so long-lived servers resolve a freshly restamped workspace branch. - status: no more "current branch not indexed" dead end — falls through to the workspace index with an informational line and the usual commit-based staleness verdict. - Deleted primaryInversionWarning; explicit `--branch` pinning, the checkout-mismatch guard, detached-HEAD/CI behavior, and `clean --branch` are unchanged. Supersedes the flag-based approaches in #2358/#2359. Closes #2354. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(storage): check registry before deleting shadowed sub-index (#2364 review F2) adoptFlatBranchLabel ran the branches/<slug>/ rm before its own unregistered-repo no-op check, so a repo in the #2264 half-finalized state (up to date but unregistered) lost its pinned sub-index on a same-commit branch flip while the run still failed. The registry lookup now precedes the deletion, making the no-self-heal rule (#2264/#1169) cover disk as well as registry state. The 'never self-heals' unit test now materializes a sub-index dir and asserts it survives; the run-analyze #2354 fast-path test registers its repo under an isolated GITNEXUS_HOME (deletion is only legitimate for registered repos) with a new unregistered variant pinning dir survival. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(storage): keep branch summary when sub-index rm fails (#2364 review F4) The shadow-cleanup fs.rm swallowed every error while the registry summary was dropped unconditionally. On Windows an lbug held open by a live MCP server fails the rm with EBUSY/EPERM, and once the summary is gone 'clean --branch' can never target the leftover dir (it resolves solely via the recorded summary) — stranding the exact un-cleanable disk bloat adoptFlatBranchLabel exists to prevent. The summary is now dropped only when the directory is verifiably gone (post-rm existence check); on failure the summary is retained, a warning names the path and errno, and the informational branch label still restamps. Later adopts retry the rm. New repo-manager-rm-failure.test.ts uses the delegating fs/promises mock idiom (vi.spyOn cannot intercept ESM namespace exports). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core): restamp fast path adopt-first and tolerate read-only storage (#2364 review F3) The fast-path label sync stamped meta before adoptFlatBranchLabel, so a crash or adopt failure between the two flipped the retry guard (existingMeta.branch !== branchLabel) and locked in the partial state: every subsequent same-commit run skipped the cleanup and branch-scoped queries kept routing to the stale pinned sub-index. The block also sat outside any try/catch, so a same-commit branch flip on a read-only .gitnexus mount (the documented Docker :ro workflow, #1549) failed a byte-for-byte-current analyze over a purely informational label sync. Adopt now runs first and saveMeta last — any partial failure leaves the guard true and the next run self-heals — and the whole sync is best-effort: read-only errors warn citing #1549, anything else warns and retries next run. Safe because the block only fires on a same-commit clean tree, where the flat DB content is byte-valid for both labels. isReadOnlyFilesystemError is now exported. New run-analyze-adopt-failure.test.ts covers retry-after-partial- failure, adopt-before-stamp ordering, and EROFS/EACCES/EPERM (gaps 4 and 7); a detached-HEAD fast-path pin lands in run-analyze.test.ts (gap 6). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(mcp): make flat meta authoritative in applyBranchScope (#2364 review F1) applyBranchScope trusted two pieces of cached state before its flat- meta disk fallback, and the handle cache only refreshes on a resolve miss — never on a hit. Post-#2354 that stale window is the routine case: (i) the handle.branch early-return served the flat handle under the OLD label after a workspace flip, silently returning the new branch's content as the old branch (the pool staleness reinit hot- swaps content without updating handle.branch); (ii) a stale cached branches[] summary routed to a branches/<slug>/ dir that adoptFlatBranchLabel had already deleted (raw 'LadybugDB not found' or POSIX ghost reads with staleness detection blinded). The on-disk flat meta is now read before any cached-state trust. A branches[] summary is served only when its sub-index lbug actually exists (the lbug is what the pool opens — serviceability truth); the cached label is trusted only when no readable flat meta contradicts it (#2106 R4 legacy shapes preserved). One refreshRepos() fires on detected staleness so subsequent calls see fresh handles. Safe against mid-analyze reads: dirty stamps spread the existing meta, preserving the old label until the end-of-run atomic write. Fixtures now materialize the pinned sub-index lbug; new regressions cover the stale-old-label error, adopted-summary fall-through to flat, and the dangling-summary partial-failure window (test gaps 1-2). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core): make end-of-run branch-label sync best-effort (#2364 review F5) The end-of-run adoptFlatBranchLabel sat inside the pipeline try whose catch rethrows, so a registry write failure (ENOSPC, ~/.gitnexus perms) after a successful multi-minute analyze failed the whole run — even though the index was complete and registered, the neighbouring parse-cache save is deliberately wrapped for exactly this reason, and adopt retries unconditionally on the next plain analyze. It now warns and continues, mirroring the parse-cache wrapper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(mcp): correct branch-not-indexed guidance for workspace index (#2364 review F6) The error told users to 'Run: gitnexus analyze --branch <X>', but post-#2354 that command hard-errors unless X is checked out — and this message is now the common goodbye for a formerly-indexed branch whose sub-index the workspace slot adopted. The guidance now explains that the workspace index follows the checked-out branch and leads with the checkout; the '(primary only)' fallback becomes '(workspace only)'. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: align primary/workspace vocabulary with the #2354 inversion (#2364 review F7) The review flagged pre-inversion 'primary/non-primary' wording that now misleads readers about the placement model: the isPrimaryBranch JSDoc (field name kept — public API surface), the two branches? JSDoc comments in local-backend, the base_ref gate comment in cli/analyze, and four branch-scope test names. Comment/JSDoc/test-name edits only; 'Registry-primary' and 'primary key' senses untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cli): clarify workspace index status wording (#2364 review F8) 'gitnexus analyze follows this branch' was ambiguous about WHICH branch analyze follows — the recorded one on the line or the current checkout. Both locales now say a re-run follows the current branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(storage): re-read registry after the shadow rm in adoptFlatBranchLabel The F2 reorder moved the registry read to the top of the function, so the whole-file writeRegistry at the bottom persisted a snapshot taken BEFORE the recursive rm of an entire sub-index — widening the unlocked read-modify-write window from microseconds to the duration of a multi- hundred-MB delete. A concurrent registerRepo/removeBranchIndex writer in that window was silently clobbered (the #2106 R9 lost-update class; registerRepo re-reads before writing for exactly this reason). The top read is now a cheap membership gate only (the F2 no-op guarantee); the mutate re-reads its own fresh snapshot after the rm. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: treat only provably-absent errno as gone in the new existence probes Both probes added by this series inverted the codebase's provably- absent polarity (listRegisteredRepos validate prunes only on ENOENT/ENOTDIR): adoptFlatBranchLabel's dirGone check read ANY fs.access failure — including a transient EACCES/EIO on a surviving dir — as 'verifiably gone' and dropped the summary, recreating exactly the stranded-bloat bug F4 fixed; applyBranchScope's sub-index check read the same transient errors on a healthy pinned lbug as 'adopted/ deleted', producing a false 'not indexed' error. A resolved force:true rm now proves absence without a probe; on failure the probe treats only ENOENT/ENOTDIR as gone, and a non-missing lbug serves the handle so the pool open surfaces the real error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(mcp): harden applyBranchScope stale-state coherence Four residual gaps in the new arm structure, found by post-fix review: - The stale-label error listed the just-contradicted cached label as indexed ('not indexed: main. Indexed branches: main'). The message now derives the flat label from the authoritative meta and excludes the requested branch from the hint list. - A branch pinned AFTER the server cached its handle never triggered a refresh (resolve hits skip the miss-refresh), erroring until restart. Every miss now fires exactly one best-effort refreshRepos() before the error, so the next call resolves; a refresh-once guard keeps doubly-stale resolutions to a single registry re-scan. - A registry entry claiming the branch both as flat label and pinned summary (the rm-failed adopt-degraded state) could serve the stale- vintage pin under a label the flat slot owns; the summary arm now requires handle.branch !== branch and the degraded state errors honestly. - The flat-meta match path returned the cached handle's pre-restamp branch/commit/stats; the meta that decided routing now also supplies the metadata. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core): keep the real error visible in restamp warnings; correct the end-of-run retry claim The fast-path catch replaced the actual error with 'storage is read-only (#1549)' for any EACCES/EPERM — mislabeling ownership problems and transient Windows locks and discarding the only diagnostic signal. The warning now carries the real message with the #1549 hint appended. The end-of-run best-effort comment claimed adopt 'retries unconditionally on the next plain analyze'; same-commit runs take the fast path whose guard compares the already-stamped meta label, so the retry actually lands on the next content-changing run. The comment now states the true retry semantics and why the interim state is safe (flat meta stamped first; applyBranchScope trusts it). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: unique tmpdir for the branch-scope fixture; drop redundant dynamic imports The branch-scope describe materialized its sub-index stub under a FIXED os.tmpdir()/gnx-2106-multi path — concurrent vitest runs on one host (the documented parallel-agents workflow) could rm each other's stub between beforeEach and the resolve under test, flaking the pinned-branch tests. The fixture root is now mkdtemp-unique per run with afterAll cleanup. run-analyze.test.ts dynamically imported repo-manager inside test bodies despite the module being statically imported at the top of the file (no vi.mock exists there to justify it); the three call sites now use the static import. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 20:55:27 +01:00
Gergő Magyar	0005574dce	docs: restructure root README, fact-check all READMEs (#2360) ... * docs(readme): restructure for readability, fix stale facts Reorganize the README so the visible page reads as a short narrative (Quick Start -> Two Ways -> Why -> What Your Agent Gets -> Editor Setup -> CLI -> How It Works -> Docker -> Enterprise) and move deep operational detail into 13 collapsible <details> sections: env vars, .gitnexusrc, Cosign/Kubernetes verification, manual MCP configs, install troubleshooting, and extended tool examples. Accuracy fixes verified against gitnexus/src: - MCP tools: 17 (15 per-repo + 2 group), not 16/11+5; drop group_contracts/group_query/group_status (CLI + resources now, not tools); add check, trace, explain, pdg_query, route_map, tool_map, shape_check, api_impact rows from src/mcp/tools.ts - Agent skills: 6 installed (adds Guide + CLI), not 4 - Wiki default model: minimax/minimax-m2.5, not gpt-4o-mini - Resources: add gitnexus://setup and gitnexus://group/{name}/... - CLI: document group impact, doctor, and the direct terminal query commands (query/context/impact/trace/cypher/detect-changes/check); note the optional branch param on per-repo tools (#2106) Structural cleanups: dedupe the two Codex config blocks, move Community Integrations out of the MCP setup flow, move Star History to the bottom. No content deleted - verbose material is collapsed, not cut. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: fact-check and fix the remaining READMEs Reviewed all 9 tracked non-root READMEs against the source; fixed the four with stale facts, left the already-accurate ones untouched (pr-swarm-review, .claude reviewer-swarm adapter, and the three bench/ methodology docs). gitnexus/README.md (npm package page): - MCP tools table: 17 tools (15 per-repo + 2 group), was 7 rows - Resources: add gitnexus://setup and gitnexus://group/{name}/... - Skills: 6 bundled (adds Guide + CLI) plus --skills generated ones - Languages: add Dart (14 total) to the list and feature matrix - Wiki default model: minimax/minimax-m2.5, not gpt-4o-mini - Requirements: Node >= 22 (package.json engines), not >= 18 - Claude Code hooks: PreToolUse + PostToolUse - CLI: add --skills/--skip-skills/--skip-git/--workers, doctor, trace, check, group impact - Optional grammars note: include Proto, mention GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1 gitnexus-cursor-integration/README.md: - 17 MCP tools, was 16; skills list: all 9 bundled skills, was 5 eval/README.md: - Model list matches configs/models/: Claude Haiku 4.5 (was '3.5 Haiku'), adds MiniMax M2.5 and DeepSeek - Node.js 22+ for GitNexus, was 18+ .devcontainer/README.md: - Add a table of contents (364 lines, ~15 sections, no navigation) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: empty commit to retrigger CI Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 08:46:59 +01:00