3 commits

Author	SHA1	Message	Date
Felipe	c2ca132620	fix: web citation/code panel bugs and serve analyze/route hardening (#3348) ... * chore: ignore local Vercel link artifacts Keep .vercel and env files out of the repo after a local preview link. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): repair citation chips, code panel line math, stale agent state Audit findings in the web client, each verified against the source: - RightPanel: citation chips ([[path:10-20]], [[Class:Foo]]) were wired to a stub resolver that always returned null, so clicking any citation did nothing. Expose resolveFilePath from useAppState and use it. - CodeReferencesPanel: graph startLine/endLine are 1-based but were treated as 0-based, so the highlighted range and scroll target were off by one line; AI citation cards always rendered "code not available" because the snippet loader was a stub. Fetch per-citation snippets via /api/file. - useAppState: sendChatMessage read llmSettings.activeProvider outside its deps (stale provider capabilities after switching provider); initializeAgent trapped projectName at '' for callers without an override (system prompt labelled the codebase "project"); the embeddings 409 dedup matched a message the server never sends for same-repo jobs. - tools.ts impact: for path targets every symbol defined in the file shares the filePath, so the disambiguation always picked the first row and could analyze an arbitrary symbol while reporting a file impact. Prefer the File node. - useSigma: the layout timeout called stop() but never kill(), leaking one ForceAtlas2 Web Worker plus four graph listeners per completed layout. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): release repo lock on cancel, IPC-first worker cancel, route hardening Audit findings in gitnexus/src, each verified against the source: - analyze-launch: cancelJob marks the job failed before the worker exits, so the exit handler's terminal early-return skipped releaseLockOnce and the repo stayed locked ("Another job is already active") until restart. Release on terminal exit and when forkWorker bails on a terminal job. - analyze-job: cancellation now sends { type: 'cancel' } over IPC first and signals only after a 15s grace. On Windows child.kill('SIGTERM') is a forceful termination, so leading with it could kill the worker inside a LadybugDB write. Mirrors core/auto-sync/analysis-worker-launch. - api resolveRepo: a job that FAILED during the hold-queue wait fell through to the { __timedOut } sentinel ("taking longer than expected") instead of 404; only /api/repo checked the sentinel, so graph/query/search/file/grep/ embed/delete crashed on entry.storagePath with a 500 after a 5 minute hang. Return null on failed jobs and check the sentinel in every consumer. - api processes/process/clusters/cluster: resolve ?repo= through the HTTP resolver (documented policy on resolveRegisteredRepoEntry) and pass the registered absolute path to the backend; add the standard rate limiter. The raw param previously reached the MCP resolver, which runs a cwd-relative realpathSync probe + registry refresh on a bare-name miss and accepts unambiguous partial names. - api body handling: Express 5 leaves req.body undefined without a JSON content type, turning "Missing X" 400s into TypeError 500s; body-parser 4xx errors (malformed JSON, over-limit) were also reported as 500. - /api/file: the lexical path.relative check cannot see symlinks; re-check containment on realpath so a cloned repo containing evil -> /etc/passwd cannot read outside the root. - repo-manager unregisterRepo: used the lenient reader, so a transient read error (EBUSY/EPERM racing another process's atomic rename) turned into writing [] and deregistering every repo. Use the strict-if-present reader. - clean --branch: compared registry paths with raw path.resolve instead of the canonical registryPathEquals used everywhere else (macOS /private/var, Windows short names / drive-letter case) and reported indexed branches as not indexed. Tests: cancelJob IPC-before-signal contract; /api/file symlink escape (403) and in-repo symlink (200), skipped where the host cannot create symlinks. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: keep example env files visible and ignore local Cursor config .env* also hid gitnexus/.env.example and eval/.env.example. .vercel was already ignored. The web app's .cursor/ stays local, including its MCP file. Co-authored-by: Cursor <cursoragent@cursor.com> * Add realtime execution ops dashboard for Vercel monitoring. Expose /api/ops snapshots over the local serve process and a ?view=ops SPA panel so analyze/embed jobs can be watched live from the hosted web UI. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: address gitnexus-check review on cite/embed/resolve paths Pass req into resolveRepo for process/cluster routes, tighten same-repo embed 409 handling, guard empty citation paths, fix snippet retry races, and drop the lone-File ambiguity fallback. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ops): harden CORS, redact paths, and bound ops streams Restrict Vercel CORS to exact production hosts, omit raw repo paths/URLs from the unauthenticated ops feed, rate-limit and cap SSE connections, and fix dashboard SSE/poll edge cases. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): stabilize citation fetches and file impact matching Retry cancelled snippet loads without duplicate in-flight reads, cap range-less citation downloads, and make impact file matching unique-suffix-aware with a synthetic File target when LIMIT drops the File node. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web/ops): close gitnexus-check review threads on SSE and redaction Cap citation reads, reconnect ops on applied server URL, skip SSE onError after abort, and strip URL query/fragment from public repoName. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ops): abort SSE on poll fallback and harden repoName parsing Prevent dual SSE+poll after a failed safety snapshot, skip overlapping poll ticks, ignore aborted streamSSE onError, and basename Windows drive-letter URLs so ops never leaks path segments. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ops/web): close gitnexus-check threads on SSE budget and credential leak Keep finite SSE retries across short 200s, strip backend URL userinfo before ?server=, and redact progress messages on the public ops feed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) Restore 0-based GraphNode line math, redact public job poll/error fields, fix omit-?repo= 400, hold the analyze lock across cancel-during-settle, and restore the Vercel shared compile. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): contain leftover-slot reclaim to the slot and keep --stale status honest Preview and force now share one branches/ containment rule, nested junctions cannot walk a sibling index, and a mid-loop git failure no longer claims leftovers were not deleted after a successful rm. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(cli): share leftover-slot helpers without changing reclaim behavior Pull the rolling I/O pool and owned-cwd storage lookup into one place so clean --stale/--branch and leftover listing stop restating the same ownership and concurrency paths. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3348) Keep the omitted-repo snapshot instead of re-listing, stop citation and ops races, redact full public repo URLs, and restore fake timers in teardown. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3348) Store graph node citation lines as 0-based offsets and correct the default-port origin comment. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3348) Redact public SSE progress text, stop citation append retries from cancelling in-flight reads, and keep the ops dashboard from showing a stale snapshot or clearing a failed Connect. Note: pre-existing failure in incremental-index-extension-dml-gate and other lbug/env unit tests not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3348) Prune citation snippets when AI refs are cleared, and poll /api/ops at 2s so the fallback stays under the 60/min limit. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): apply prettier class order for format check (#3348) CI quality/format runs root-only npm ci, so prettier-plugin-tailwindcss sorts scrollbar-thin without the web Tailwind catalog. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) - Require a unique suffix match for graph-backed citation paths so ambiguous names like index.ts no longer open the first graph file. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) - Require a path-component boundary so unique citation suffixes cannot match filename substrings like myindex.ts Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): redact filesystem paths in ops text Unauthenticated /api/ops and poll replay worker errors. URLs were scrubbed but home-directory and Windows paths still leaked. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): omit repoPath from public SSE frames /api/ops lists job ids, so the unauthenticated progress stream must not replay the analyzed filesystem path. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): treat embed lock 409 as a busy error Analyze and embed share the same lock string. Mapping that 409 to embedding hid an in-flight analyze as a successful embed start. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): bound impact File path suffix matches Unbounded endsWith let lib/foo.ts select src/mylib/foo.ts. Require an exact path or a unique /suffix, matching resolveUniqueIndexedPath. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): keep canceled analyze slot until exit Marking failed before the worker exited let a second POST start cloneOrPull against a LadybugDB file still being written. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): skip Windows SIGTERM on job dispose child.kill('SIGTERM') is TerminateProcess there. Ask over IPC first and leave the 15s grace timer to SIGKILL. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): let process routes skip the analyze hold GET /api/processes and /api/clusters always waited up to 300s. ?awaitAnalysis=false fails fast; default still waits like /api/repo. Co-authored-by: Cursor <cursoragent@cursor.com> * test(web): cover public ops and analyze SSE user flows Lock the unauthenticated dashboard and analyze complete/fail/cancel paths so a leaked repoPath, token, or home path cannot ship unnoticed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) Keep caller cancel reasons over the worker's generic IPC, skip publish while cancel is pending, and redact scp-style remotes on the public ops feed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3348) Release the analyze slot when a worker fails to spawn, and omit branch refs from the unauthenticated ops feed. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): do not reuse an analyze job that is pending cancel A dying same-repo job still occupies the single slot; 202-reuse would attach a new client to a cancel in flight. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): hold the analyze lock until the worker exits after cancel Cancel error IPC used to drop the repo lock while the child was still checkpointing. Abort settle immediately on pending cancel so the slot is not held for a 60s disk poll. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): redact known repo paths with spaces in public ops text Known repoPath/repoUrl literals are replaced first so a clone dir with spaces cannot leak past the whitespace-bounded path regex. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): return the live job on analyze and embed DELETE Hard-coding failed made clients retry immediately and 409 while the child still occupied the slot. resolveRepo now returns not-found as soon as that job fails instead of waiting out the hold timeout. Co-authored-by: Cursor <cursoragent@cursor.com> * test(web): drive public analyze and ops through a live gitnexus serve Spawn the real backend and observe requests instead of intercepting them, so slot occupancy, redaction, and reconnect stay honest. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(web): reuse code-panel helpers and drop dead UI aliases Citation fetches already had selectedNodeFileRange and snippetRepoKey; the impact File suffix filter already handled exact paths. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3348) - Skip createJob reuse after cancel IPC is consumed while the child remains - Hold the repo lock until exit when complete IPC races a pending cancel - Scrub full remote URLs before known repoUrl prefixes in public ops text - Reject unique impact File suffix matches from a truncated LIMIT 10 page - Make live e2e helpers bound probes, clean up failed startups, and wait out the cancel slot Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): open live e2e pages on the Vite host CI actually bound Absolute 127.0.0.1:5173 navigation refused on Actions because wait-on and Vite use localhost (often ::1). Honor FRONTEND_URL when set, else pick the first of localhost / 127.0.0.1 that answers. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) Hold the analyze lock until worker exit when cancel aborts settle, and assert GitLab failure chrome does not leak host or path. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): keep live analyze e2e under the analyze rate limit POST /api/analyze allows 10 requests per minute per IP. The slot-free helper re-POSTed every 400ms while a cancelled worker was exiting, spent that budget, and the lock test's hold request got 429 instead of 202. - postAnalyze waits out a 429 using the RateLimit reset and retries - slot polling backs off to 2s and leaves a small POST budget for callers - the slot probe is a clone that fails before any worker fork, so the probe itself no longer holds the slot after reporting failed - the lock test holds the slot with a real local analyze - token and GitLab tests wait for a free slot before posting from the UI - request fetches carry a timeout; teardown signals the serve process group - an empty FRONTEND_URL falls back to the default base URL Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3348) - ops view: a `?server=` link no longer auto-connects to another origin while a deploy token is held; it prefills and waits for Connect - analyze completion: a local-path run reconnects by the path this client submitted, so duplicate basenames stay collision-safe without repoPath on the public SSE frame - stale slot cleanup: revalidate each nested directory (lstat + realpath) right before readdir, so a mid-cleanup junction swap aborts instead of walking an outside tree; list phases run sequentially so the slot-I/O cap is global - e2e: 429 backoff honours the caller deadline; the unreachable-backend ops test navigates through the resolved frontend URL - drop the unused `repo` member from the clean integration helper Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(server): reconnect after analyze by an opaque repo id Public job views and the SSE terminal frame no longer carry repoPath, and repoName is not unique, so a post-analyze reconnect by name could load a same-named sibling. The server now issues `repoId`: an HMAC of the canonical registry path under a per-process random key. It is set on complete jobs (ops view, analyze poll, SSE terminal frame) and matches the new `id` on `GET /api/repos` entries. The web client resolves it to the exact entry path on completion; unknown ids fall back to the name. This covers URL clones and folder uploads, and replaces the local-path only fallback. With reconnect off the label, public `repoName` for a branch-pinned URL clone is the repository name, not the `<repo>__<branch slug>` registry name, so the requested branch stays off the unauthenticated feed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3348) - stale slot cleanup: a descendant that vanishes before its unlink is treated as removed instead of aborting the reclaim - e2e teardown: escalate to SIGKILL on the process group when the live backend ignores SIGTERM for 5s - ops view: drop the dead initial value CodeQL flagged Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3348) - public redaction: a known repoPath now also consumes its descendant tail, so `<repoPath>/src/secret.ts` becomes `[path]` instead of `[path]/src/secret.ts`; a same-prefix sibling is left to the path scrub - e2e: the cancel test waits for the analyze slot the previous failed local-path job still holds; `fetchOps` carries the request timeout - docs: SSE terminal payload and RepoAnalyzer `onComplete` describe `repoId` resolution Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3348) - RepoAnalyzer: drop a completion that resolves after unmount, so a slow /api/repos lookup cannot switch repos after the sheet was dismissed - e2e: select the local-path input by test id (the placeholder differs on Windows); the slot probe's job wait honours the caller's deadline Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(server): assert the public SSE terminal frame in analyze-api The #2790 terminality tests still expected `repoPath` on the terminal frame. This PR replaced it with the opaque `repoId`, so assert that shape and that the analyzed path never appears in the stream. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(web): wait for the analyze slot between duplicate-repo setup runs The server now keeps the single analyze slot until the worker exits, even after its job reports complete. repo-path-identity posted the second duplicate's analyze immediately and got 409 in CI. Use the shared slot-aware POST, which also waits out a 429. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 13:27:22 +01:00
mengkaka	79543c8f83	feat(storage): add configurable index storage and content retention tiers (#3060) ... * feat(storage): add configurable index storage and content retention tiers Rebase #3060 onto current origin/main. Keep GITNEXUS_STORAGE_PATH, GITNEXUS_STORAGE_ROOT, and GITNEXUS_CONTENT_RETENTION, and fold in main's FTS skip, embed-session, and help-text updates. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Keep legacy registry rows on the local storage fallback, resolve symlinks before the destructive-path guard, and align hook lookup with CLI branch slugs, branch-slot metadata, and longest-path match. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Only list swept upload directories after a successful removal so callers cannot treat a permission or transient rm failure as gone. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Document that getStoragePath may consult registered storage while this module still does not mutate the global registry. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(storage): close review findings for external indexes and retention Re-inspect ownership under the analyze lock, fail-closed when the registry file is missing, and keep skip-git hook discovery plus retention fields on HTTP/MCP list surfaces. /api/file stays 410 unless contentRetention is full. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3060) Treat lock-only index dirs as empty, honor HTTP --force storage policy, and prefer registered plus branch-aware slots in hooks and augment. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Keep hook fallbacks inside the current worktree, compare foreign-local slots canonically, and make storage fixtures survive ownership validation. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix macOS hook test expecting realpath'd registry paths. resolveHookRepo returns the written registry path, not a filesystem realpath, so the assertion must match that. * Address gitnexus-check warnings on hook install docs and slot tests. The Cursor troubleshooting list omitted registry-query.cjs, and the writable-slot test only checked that isDirectory exists instead of that the path is a directory. * Align the HTTP catalog source-scan with skippable resolveRepo validation. resolveRepo lists fresh repos with validate: options.validateStorage !== false so DELETE can skip prune; the test still required a literal validate: true. * Harden storage path sinks so CodeQL path-injection and ReDoS alerts clear. Contain every filesystem probe inside the resolved storage slot with the inline path.relative idiom, reject filesystem-root slots, and trim slot basenames in linear time. * Settle bridge stamps before writing so CI size/mtime matches stay stable. LadybugDB can still flush into bridge.lbug after close+rename; persist whole-millisecond mtimes and wait for consecutive stats to agree so a freshly written pair matches. * Type the settled bridge stat as fs.Stats so tsc does not see bigint. Awaited<ReturnType<typeof fsp.stat>> collapsed the bigint overload and broke prepare/typecheck on CI. * Keep the bridge mtime stamp exact so same-size swaps still fail the pair check. Co-authored-by: Cursor <cursoragent@cursor.com> * Wrap the bridge stamp predicate so prettier --check stays green. Co-authored-by: Cursor <cursoragent@cursor.com> * Require a quiet interval before stamping a settled bridge file. Co-authored-by: Cursor <cursoragent@cursor.com> * Reuse shared storage and settle helpers instead of local copies. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-12 20:31:55 +00:00
Ankit Verma	8ddab9aed5	feat(api): honor branch on POST /api/analyze (#3199) ... * feat(api): honor branch on POST /api/analyze The serve route accepted a `branch` field in the request body, returned 202 and reported the job `complete` — while indexing the remote's default branch. Express drops unknown body fields, so the caller got no error and no warning; the only way to notice was to inspect the checked-out clone. Both ends of the plumbing already existed: CloneOrPullOptions.branch is honored by cloneOrPull, and AnalyzeOptions.branch already drives resolveBranchPlacement. Only the HTTP layer was missing, so this wires `branch` from the route through cloneOrPull and LaunchOptions into the worker's AnalyzeOptions. StartMessage.options is already typed as AnalyzeOptions, so the IPC protocol is unchanged. Validation reuses validateBranchName — the same function backing the CLI's `--branch` — so both entry points accept exactly the same refs and a malformed value is rejected with 400 before it can reach git. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(api): make branch part of job identity and complete ref validation Addresses the review on #3199. 1. Job dedup ignored `branch`, so a request for branch B while branch A was in flight was answered with A's job and a 202. The caller would read that as "B is indexed" — the same silent wrong-branch outcome honoring `branch` was meant to remove. Branch is now part of the dedup identity; a different-branch request falls through to the single-slot guard and gets a truthful 409 instead. 2. validateBranchName implemented only a subset of git's ref rules, so `feature.lock`, `/feature`, `feature/`, `feature//next`, `@`, `@{` and dot-prefixed components passed validation and failed later in the git subprocess — a 202 plus a background failure rather than the advertised 400. The remaining `git check-ref-format` rules are now enforced at the same chokepoint, which fixes the CLI and `.gitnexusrc` paths too. No branch git can create is affected. 3. The LaunchOptions doc claimed an explicit branch always pins `branches/<slug>/`. resolveBranchPlacement keeps the run on the flat slot when that slot has no owner, or when its owner is already this label. Comment and CHANGELOG corrected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(server): describe cloneOrPull's branch path in its contract comment The header comment predated `options.branch` and still said an existing clone is only ever `git pull --ff-only`. The implementation has a second path: with a branch it fetches that ref and runs `checkout -B <branch> origin/<branch>`, so the requested branch — not the one already checked out — ends up in the working tree. The stale comment is actively misleading: a reviewer reading it concludes that requesting a branch on an existing clone silently analyzes the default branch, which is not what happens. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(server): scope the origin check to the existing-clone path My previous comment said remote.origin is verified "in both cases", which is wrong: assertRemoteMatchesRequestedUrl runs inside `if (exists)`, so a fresh clone has no origin to check. Restructured around whether targetDir exists, which is what actually selects the behavior. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(server): cover branch job identity in JobManager's own suite The branch dedup tests were sitting in analyze-api.test.ts, but they exercise JobManager directly, so they belong beside the existing "returns existing job for same repoUrl when active" case in analyze-job.test.ts. Moved, and extended to cover the callers that omit branch entirely — the upload route, the embed manager and the existing tests — which compare undefined === undefined and are unaffected. Also pins that branch survives the whole clone -> analyze -> terminal update sequence, since it is now part of dedup identity and must not drift mid-flight. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(api): give a pinned branch its own clone and settle the slot it wrote Addresses the review on #3199. Per-branch clone directories (review option 2). One checkout per repo made `branch` one-shot: after any analyze the tree is dirty with generated AGENTS.md / CLAUDE.md / .claude/, so a pinned request 202'd and then died on cloneOrPull's porcelain refusal. Worse, a later request that OMITTED `branch` pulled whatever branch the last pin left checked out and indexed it as the default — silent wrong content, the same class as #3198 one request later. A pinned run now clones into `<repo>__<branchSlug>`, so the two requests no longer share a tree. The pinned clone registers under its directory name, because both dirs share an origin and the inferred name would otherwise collide; that name re-derives through getCloneDir, so DELETE still finds it. Finalization gate. registerRepo always records the flat `.gitnexus`, but a pinned run whose label differs from the flat slot's owner writes `branches/<slug>/`. The gate probed the flat path regardless, so it never settled, and the worker's normal exit 0 — sent ~500ms after `complete`, while the job is deliberately still non-terminal — was classified as a crash and a successful analysis was retried three times and failed. The gate now follows the placement the worker reports (isPrimaryBranch, added to the IPC allowlist under the rule that module already documents), and an exit after a terminal IPC counts as winding down, not dying. Reported by the maintainer and reproduced independently by @azizur100389. analyzeCloneOptions extracted so the token/branch combination is asserted. Inline, the branch-only case — a public URL with no token — was untested, and dropping it there would silently reindex the default branch while every other test stayed green. CHANGELOG: the previous entry claimed the newly-400'd payloads "would have failed at git", which is true of CLI --branch but wrong for HTTP, where they succeeded on the default branch. Documented as an explicit behavior change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(server): bound the branch clone-dir name to one path component `validateBranchName` allows a 255-character ref and `branchSlug` appends a dash plus 8 hash characters, so `<repo>__<slug>` reached 267 — past the 255-byte component limit on ext4/APFS/NTFS. The clone would then fail to create its target directory, which the character-only regex could not catch. Only the readable half is trimmed. The hash is a digest of the full ref and is always kept, so two long branches sharing a prefix still resolve to different directories rather than silently sharing an index. `branchSlug` itself is untouched: the per-branch index slots already use those names on disk, and shortening them there would orphan existing indexes. Also corrects two comments: the forwarding test claimed a branch selector always pins `branches/<slug>/` (it keeps the flat slot when that slot has no owner or already owns the label), and the web client's `branch` doc said omitting it means the remote default — true for a `url` request, but a `path` request is never cloned and indexes whatever that tree has checked out. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(server): bound the branch clone-dir name and unblock same-branch re-index Two defects found by testing this branch end to end, plus the review nits. 1. Path length. `validateBranchName` allows a 255-character ref and `branchSlug` appends a dash plus 8 hash characters, so `<repo>__<slug>` reached 267 — past the 255-byte component limit on ext4/APFS/NTFS, and the clone could not create its directory. Only the readable half is trimmed; the hash is a digest of the full ref and is always kept, so two long branches sharing a prefix still get separate directories. `branchSlug` itself is untouched — the per-branch index slots already use those names on disk and shortening them there would orphan existing indexes. 2. Same-branch re-index. Per-branch clone dirs stopped branches from contaminating each other, but a REPEAT pin still failed: analyze writes AGENTS.md / CLAUDE.md / .claude/ into the clone, so the second pinned run met its own dirt at the porcelain check and asked for `overwrite_local_changes`. When HEAD already matches the requested branch there is nothing to switch, so the run now takes the same `pull --ff-only` path an unpinned request takes — review option (1), alongside (2). The refusal is untouched where it matters: a real switch, or a detached HEAD, still goes through the checkout path and can still refuse. Also: repositions getCloneDir's JSDoc, which an inserted constant had orphaned; gates the pinned `registryName` on the same condition as the clone, so supplying both `url` and `path` no longer renames the operator's local repo; corrects a test comment that claimed a branch selector always pins `branches/<slug>/`; and corrects the web client's `branch` doc, which said omitting it means the remote default — true for `url`, but a `path` request is never cloned. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: drop the CHANGELOG edits from this PR Requested in review. Checking the history, no feat/fix PR here touches gitnexus/CHANGELOG.md — the only recent commit on it is `chore: release v1.6.11`, and CONTRIBUTING says release notes are generated from the merged PR title via .github/release.yml. Hand-editing an [Unreleased] section from a feature branch was my mistake, not the project's convention. The behavior change it documented (branch: null / "" / non-string now 400 where they were previously dropped and the default branch indexed) is stated in the PR description instead, which is what feeds the release notes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(server): align the clone/pull contract with the same-branch fast path Two comments I wrote went stale against my own later change. `cloneOrPull`'s header still said an existing clone with `options.branch` always fetches and runs `checkout -B`. Since the same-branch fast path landed that is only true when the branch actually differs; when it is already checked out the run takes `pull --ff-only` and no dirty-tree check applies. The header now splits on whether the branch differs, which is what the code branches on. The web client's `branch` doc said omitting it on a `url` request clones the remote default. That holds only when there is no clone yet — an existing unpinned clone is pulled on whatever branch it already has checked out. Comments only; no behavior change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Address PR review feedback (#3199) Pin a same-branch re-index to `git pull --ff-only origin <branch>` so the job cannot follow an unverified `branch.<name>.merge` while still skipping the dirty-tree refuse. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): close the #3199 holes on pinned analyze re-index Same-ref updates were a raw pull dest (force-fetch via +) or a shallow ff-merge that could not move, and a tag pin compared the tag-object SHA so re-index refused a dirty tree. Fetch the mapped remote-tracking ref, stay put on a peeled SHA match, restore only GitNexus overlays, skip the 60s settle on alreadyUpToDate, and keep branch validation in core so the HTTP route does not import the CLI. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-08 15:15:45 +01:00