4 commits

Author	SHA1	Message	Date
Gergő Magyar	22d3c2ad74	fix(cli): stop churning the committed agent guides, and nudge --index-only (#2907) (#2927) ... AGENTS.md and CLAUDE.md are the agent guides teams commit, and the injected block carried live symbol/relationship/flow counts. Those counts move with any code change, so every reindex rewrote a tracked file and produced a spurious diff that had to be restored by hand before committing real work. The write is now skipped when the volatile counts are the only delta. Counts are substituted with placeholders — not deleted — before the comparison, so --no-stats REMOVING the parenthetical is still a material change that writes through; only a numbers-only difference is suppressed. Both the verbose path and the gitnexus:keep path go through the same rule, and a project rename, a template change, or a base_ref change still rewrites as before. Live counts remain available from `gitnexus status` and `gitnexus://repo/{name}/context`. Two smaller churn sources go with it: - The file was CREATED without a trailing newline while every update path writes `.trim() + '\n'`, so the analyze right after committing a freshly created AGENTS.md dirtied it purely to append that newline. - `--no-stats` left the per-cluster `(N symbols)` counts in the skills table, which are exactly as volatile as the header parenthetical the flag removes. The stale-index hook recommended plain `gitnexus analyze` — the variant that rewrites those tracked docs — so an agent following the nudge verbatim reindexed with the most invasive flags. `formatAnalyzeCommand` takes `indexOnly` and the three hook call sites (Claude, plugin copy, Antigravity) pass it; the injected "Index stale?" line and the MCP context resource's `re_index` hint name the same `--index-only` form. Full `analyze` stays the documented way to refresh the docs and skills. Both resolve-analyze-cmd.cjs copies stay byte-identical. Claude-Session: https://claude.ai/code/session_019d85r7TrMYjWbTUT3pXccS Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-11 13:30:14 +01:00
drdave	021ac30376	feat(cli): add a bunx lane so bun-only machines can run gitnexus (#2765) ... * feat(cli): add a bunx lane to the runner ladder The ladder assumed a Node toolchain: global gitnexus, then pnpm dlx or npx in some order, with npx as the last resort. On a bun-only machine npm, npx and pnpm are all absent, so every rung fell through to npx and both the emitted hint and the generated .gitnexus/run.cjs produced a command the machine could not run at all. Add bun as a fourth mode, invoked as an install-free bunx one-shot, on two rungs: - npm 11+ with no pnpm to fall back on — bunx dodges the same arborist install crash the pnpm rung exists for (#1939); - npm and pnpm both absent — previously the dead end described above. Every pre-existing outcome is preserved: pnpm still wins on npm 11+, npx still wins on npm < 11, and pnpm still wins over bunx when npm is absent. Regression tests pin each of those. The bun PATH probe is lazy, so a machine with a Node toolchain pays no extra scan and the stale-index hook budget is unchanged. bunx takes no allow-build equivalent: bun's --trust is a bun add/install flag that writes trustedDependencies into a project package.json, which a one-shot has none of, so the argv stays flag-free. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016R9psS9gJ73MRyquoBoPKg * fix(lbug): restore the prebuilt native binary when install scripts were skipped Without this the new bunx lane resolves to a command that still fails: bun skips lifecycle scripts for a bunx fetch, so @ladybugdb/core's install script never copies lbugjs.node up from its per-platform sub-package and every native command dead-ends on 'LadybugDB native binary (lbugjs.node) is missing'. The existing guidance cannot rescue that case. It offers pnpm --allow-build, a global install, or adding trustedDependencies to a project package.json — bunx has no project package.json to add to, no per-invocation opt-in, and re-extracts the package on every run, so an out-of-band repair is wiped before the next invocation. In-process recovery is the only thing that can work. Recovery is cheap because nothing is actually absent: the binary is already on disk in @ladybugdb/core-<platform>-<arch>, and the skipped script only copied it up. Redo that copy (prebuilt only — never a source build, never a network fetch) before reporting failure. Best-effort by construction: read-only node_modules, an absent sub-package or an unsupported platform all fall through to the existing diagnostics unchanged, which a test pins. Also covers pnpm dlx without --allow-build and npm --ignore-scripts. Declare trustedDependencies so a plain `bun install` in this repo produces a working native binary too — the remedy the error message already prescribes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016R9psS9gJ73MRyquoBoPKg * fix(ai-context): name every install-free runner in the generated bootstrap note The emitted gitnexus:start block told a reader with no runner yet to run `npx gitnexus analyze`, falling back to a global npm install. Both name binaries a bun-only machine does not have, so the generated AGENTS.md and CLAUDE.md offered it no reachable bootstrap path. List npx, bunx and pnpm dlx instead of resolving one. The block is committed, so emitting the command this machine happens to resolve would make two contributors on different package managers rewrite it at each other on every analyze — the per-machine churn #1706 removed. Naming all three keeps the note machine-independent and correct everywhere. Regenerates this repo's own committed block to match. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016R9psS9gJ73MRyquoBoPKg * fix(cli): address PR #2765 review — bunx liveness, restore diagnostics, docs Addresses all five review comments on #2765. P1 — `hasBun()` was a PATH-existence check only, so a present-but-broken `bunx` shim (partial uninstall, failed `bun upgrade`) was selected with no functional validation. Because selecting `bun` also suppresses the npm-11 npx-crash warning, the result was a silent dead end: no diagnostic, and a `bunx gitnexus@latest analyze` command that only fails at execution time. Add `probeRuns()` — a real `bunx --version` liveness probe, gated behind the cheap spawn-free PATH scan so machines with npm/pnpm still pay nothing. It ignores the output on purpose (a banner or unparseable version still counts as alive); only a spawn failure, non-zero exit, or timeout rejects. Injectable via a new `bunRuns` dep so the mode tests stay host-independent. P2 — the `gitnexus-cli` skill (and both shipped mirrors) still described the pre-bunx ladder, stranding exactly this PR's audience: a bun-only machine whose agent bootstraps from that file was told to use npx/npm/pnpm, none of which exist there. All three copies now name `bunx` in the ladder and the bootstrap fallback, with a `shipped-skills-sync` fragment assertion so the gap is CI-caught (these copies are not byte-compared, only the engineering family is). P2 — `restorePrebuiltNativeBinary` collapsed every failure into `false`, so an EACCES/EROFS from `copyFileSync` was indistinguishable from "no prebuilt sub-package exists". Users on a read-only `node_modules` layer (a baked container image mounted read-only — a common CI pattern) got the generic lifecycle-script advice, which cannot fix a non-writable filesystem. Return a `RestoreOutcome` instead and route `copy-failed` to its own message. P2 — document that `trustedDependencies` only takes effect for `bun install` / `pnpm install` run inside this repo: it does nothing for a `bunx` one-shot or for a consumer's `bun add gitnexus`. The note sits on `restorePrebuiltNativeBinary` so a future maintainer cannot mistake that function for redundant and delete the thing the bunx path actually relies on. P3 — the `binary_missing` bun advice told `bunx` one-shot users to edit a package.json they do not have, and listed 1 of the 3 packages this package now trusts. Both repair messages now share one `BUN_REPAIR_LINES` const with the full package list and a `bun install -g gitnexus` alternative. Also: shortened the bootstrap note and raised the CLAUDE.md block budget 2900 -> 2950. The note has to name every install-free runner (that is the point of the bun lane), and main's own growth since this PR's last green CI had already pushed the generated block over the old ceiling. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015epfxkEMsmHFNVSFQqAkB4 * refactor(cli): simplify the #2765 review fixes Cleanup pass over the previous commit — no intended behavior change except the doctor status line noted below. Reuse: `probeRuns()` duplicated `probeVersion()`'s entire spawn setup — same argv, timeout, `windowsHide`, and the CVE-2024-27980 Windows-shim workaround — in a file with two byte-identical committed copies, so the shim rule lived at four sites. Its docstring's own objection was to the RETURN SHAPE, not to reuse, so `probeVersion` now returns `{ ran, major, minor }` and `hasBun` reads `.ran`. Existing callers only read `major`/`minor`, so nothing else changes. Also dropped a pointless `const runs = () => …` thunk (`&&` already short-circuits), and deleted a new test that was a character-for-character duplicate of `falls back to npx when npm is null-absent and pnpm is also absent` — its cheapest-first-gate rationale moved into that test's comment. Correctness in the budget comment: the claim that the bun rung is free because "pnpm is absent there, so its probe never ran" was wrong. `formatAnalyzeCommand` spawns `pnpm --version` unconditionally when no global `gitnexus` is on PATH — that spawn IS how pnpm presence is discovered. Real worst case is 5 subprocesses / ~8s, and the 8s needs Windows (`shell: true` spawns cmd.exe for an absent pnpm); on POSIX an absent pnpm ENOENTs in ~1ms. Comment now says that. Likewise "a machine with npm or pnpm never pays" was wrong for npm 11+ without pnpm — that IS the rung that pays. Altitude: `copy-failed` changed only the message text while still returning `kind: 'binary_missing'`, so `doctor` would have printed "✗ lbugjs.node missing" directly above a message saying the binary IS present — exactly the contradiction #2672 removed. Added a `binary_unwritable` kind, a doctor case, and a `nativeStatusCases` row. The binary-missing message construction moved out of `checkLbugNative` into `unrestorableBinaryFailure`, typed `Exclude<RestoreOutcome, 'restored'>` so a new outcome forces a decision instead of silently inheriting the lifecycle-script advice. Drift: the trusted-package list was hand-spelled in five places in native-check.ts, with "matches gitnexus/package.json" asserted only in a comment. All five now render from one `NATIVE_BUILD_PACKAGES` const (rendered output is byte-identical), and the test reads the list out of package.json instead of restating it, so a fourth native package fails the test rather than silently shipping stale advice. Finally, replaced the absolute CLAUDE.md block cap with the ratio the two prior justifications actually appealed to (`< 5465 * 0.55`). Raising 2700 -> 2900 -> 2950 was a ratchet with no ratchet: an absolute cap can only fail on the PR that adds the character, and the fix is always to nudge the number. Also fixed a stale runner ladder in skills-steering.test.ts that still omitted bunx. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015epfxkEMsmHFNVSFQqAkB4 --------- Co-authored-by: drdave-flexnteos <revenaugh.david@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>	2026-08-06 08:40:36 +00:00
Gergő Magyar	f01d913eef	fix(hooks): resolve gitnexus on PATH with a pure-Node scan, all-OS (#1938) (#1980)	2026-06-03 03:19:49 +01:00
Gergő Magyar	f885330b34	fix(cli): steer docs, skills, and hooks through a CLI-neutral project-local runner (#1939) (#1945) ... * fix(cli): steer npm 11 users away from npx install crash (#1939) Prefer global gitnexus or pnpm dlx in hooks and generated AI context, warn when npm 11.x would use the broken npx path, and document workarounds for the arborist node.target null failure mode. Co-authored-by: Cursor <cursoragent@cursor.com> * test(hooks): stage resolve-analyze-cmd.cjs for antigravity adapter; harden load checks The antigravity adapter gained a top-level require('./resolve-analyze-cmd.cjs') but stageAdapter() did not copy it, so the spawned adapter crashed with MODULE_NOT_FOUND. Three load-sensitive tests failed; four silent-path tests false-passed on empty stdout. Stage the helper alongside the other sibling helpers, and assert status===0 and no MODULE_NOT_FOUND on the four silent-path tests so a non-loading hook can never pass green again. Force a deterministic invocation mode in the stale-index test so the emitted analyze command no longer varies by CI-runner PATH. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): standardize invocation hints on gitnexus@latest; single-source CJS helper NPX_REF becomes a literal `gitnexus@latest` in resolve-invocation.ts, dropping the package.json require and the module-load throw (a malformed/absent version can no longer crash any CLI command at import). The safety this PR delivers is the install method steered to (global / pnpm dlx), not a pinned gitnexus version, and the in-repo CJS mirror already degraded to `latest` once copied outside the package. Make the two resolve-analyze-cmd.cjs copies byte-identical and add a parity test that fails on drift. The separate, version-pinned NPX_REF that setup.ts writes into the MCP server registration is intentional and left unchanged. Co-authored-by: Cursor <cursoragent@cursor.com> * perf(cli): move npm-11 npx warning off module load; memoize invocation mode warnIfNpm11NpxRisk() ran at index.ts module load, so every CLI invocation (including the `gitnexus mcp` stdio hot path) paid which/where + npm --version spawns — against the lazy-startup/MCP-stdout discipline (#207, #1383). Move the call into analyzeCommand, after the ensureHeap() re-exec guard, so it fires once in the working process and only for `analyze`. Memoize the PATH-probe-derived invocation mode (the GITNEXUS_INVOCATION override stays uncached) so repeated callers don't re-probe, and add a test-only reset so the cache + once-only warning flag don't leak across the unit suite. Covers the mode!=='npx', npm<11, and npm-absent suppression branches. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): detect .exe/extensionless global gitnexus shims on Windows The winGitnexusWrapper branch only matched .cmd/.bat, so a global gitnexus installed by Volta or scoop (a .exe or an extensionless shim) was missed and the hint fell back to pnpm/npx. Accept .exe and treat any non-empty `where` hit as on-PATH (the emitted hint is `gitnexus analyze` regardless of which shim resolves it). Mirror the change into both resolve-analyze-cmd.cjs copies so the TS source and the byte-identical hook mirrors stay in sync. Add Windows-mocked test cases (.exe-only, extensionless, .cmd preference, CRLF stripping) and register resolve-invocation.test.ts in cross-platform-tests.ts so the windows-latest runner exercises the branch. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): emit fixed pnpm dlx analyze command in generated AGENTS.md/CLAUDE.md ai-context baked a machine-resolved command (formatAnalyzeCommand) into git-tracked AGENTS.md/CLAUDE.md, so the stale-index hint varied per machine and churned across branches (the #1706 class). Emit the fixed string `pnpm dlx gitnexus@latest analyze` instead: committed AI-context is the most authoritative instruction an agent reads, so it must name an install-free, crash-free method — never `npx`, the npm-11 path #1939 steers away from. formatAnalyzeCommand stays exported and unit-tested in resolve-invocation.ts (it still mirrors the two .cjs hook copies); ai-context just no longer calls it. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(cli): unify hook-helper copy into one non-silent routine installClaudeCodeHooks copied its four hook helpers in separate try/catch blocks that silently swallowed failures, while installAntigravityHooks recorded an error per failed copy. Extract one copyHookHelpers(srcDir, destDir, label, result) with a single canonical helper list (including resolve-analyze-cmd.cjs) and the antigravity loop's error-reporting policy, and use it from both paths so a missing helper surfaces as a setup error instead of a silent runtime crash. Assert both the Claude and Antigravity install paths co-locate resolve-analyze-cmd.cjs next to the adapter, and that a failed copy records an error rather than passing silently. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(cli): reattach installClaudeCodeHooks JSDoc after helper extraction The extracted HOOK_HELPERS/copyHookHelpers block landed between the installClaudeCodeHooks JSDoc and its function, leaving the doc reading as if it described the helper list. Move the block above the doc so it documents the function again. No behavior change. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): enforce TS<->CJS invocation parity and guard CLI startup posture Tier-2 review found two in-scope gaps in the #1945 follow-up: - The "mirrors resolve-invocation.ts / test enforces parity" comments overclaimed: the parity test only compared the two .cjs copies to each other, so the TS source and the CJS hook copies could silently drift (NPX_REF, the per-mode command, and the Windows shim regex were hand-edited in all three this PR). Add TS<->CJS value parity (NPX_REF + formatAnalyzeCommand for every forced mode) and a source-level shim-regex parity check, and make the mirror comments accurately describe what is enforced. - No test locked the R3/R4 startup posture, so re-adding warnIfNpm11NpxRisk() (or any resolve-invocation import) at index.ts module scope -- the #207/#1383 lazy-startup regression -- would pass CI. Add a guard asserting index.ts has no module-load invocation probe and the warning is wired into analyzeCommand. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(cli): collapse npx-invocation resolver to one source of truth PR #1945 carried the gitnexus/pnpm/npx selection in three hand-synced places — the canonical hook helper, its byte-identical plugin copy, and a full TypeScript re-implementation in resolve-invocation.ts — kept in lockstep by per-mode-command and regex-extracted-by-regex parity tests. The TS formatAnalyzeCommand had no production caller (ai-context emits a fixed string), and the module memoized + exposed a test-only reset for a "repeated callers" case that has exactly one caller. Make hooks/claude/resolve-analyze-cmd.cjs the single source: extract the Windows-shim line-picking into a pure, exported pickPathMatch() and add an injectable probe to resolveInvocationMode() so the shipped logic is testable without spawning or global mocks. resolve-invocation.ts (118 -> 59 lines) now consumes that cjs via createRequire for resolveInvocationMode/NPX_REF and adds only the CLI-only npm-version probe and warning; the relative path resolves identically from src/cli/ (tsx, vitest) and dist/cli/ (shipped, hooks/ is a published sibling of dist/). Tests exercise the real shipped artifact, the NPX_REF/mode-command parity scaffolding is dropped (one implementation can't drift), and parity narrows to the two cjs copies staying byte-identical. No behavior change: hook stale-index hints and the analyze warning are byte-identical; the pre-existing setup.ts resolveGitnexusBin is untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): bound stale-index hook PATH probe under the hook budget (U1) The PostToolUse stale-index hint calls formatAnalyzeCommand(), which probes which/where; named PROBE_TIMEOUT_MS=2000 keeps git rev-parse (~3s) + up to two probes well under Claude Code's 10s hook timeout while preserving the machine-correct hint. Byte-identical in the plugin copy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): steer generated cross-repo group commands off npx (#1939) (U2) The Cross-Repo Groups block in generated AGENTS.md/CLAUDE.md still emitted bare 'npx gitnexus group ...', funneling npm-11 users into the arborist crash; switch to fixed 'pnpm dlx gitnexus@latest group ...'. Export generateGitNexusContent and add a group-branch test asserting no 'npx gitnexus' literal survives. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: align steering guidance on pnpm dlx gitnexus@latest (U3) README troubleshooting uses gitnexus@latest; the repo's own committed CLAUDE.md/AGENTS.md stale-index hint now matches the generated output (pnpm dlx gitnexus@latest analyze) so the repo dogfoods the fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(hooks): assert exact @latest analyze command and pin invocation mode (U4) Drop dead PKG_VERSION/NPX_REF version-pinned constants; the cjs always emits gitnexus@latest, so assert exact toContain(...) instead of the /@\\S+/ wildcard; pin GITNEXUS_INVOCATION in the --embeddings tests for host-independent determinism. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cli): cover resolver warn/edge branches; document probe seam (U5) Add coverage for the gitnexus-mode warn suppression, getNpmMajorVersion edge inputs (empty/pre-release/non-numeric), and the Windows non-wrapper pickPathMatch branch; widen the InvocationResolver interface to document the optional probe param. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): lower hook PATH-probe timeout to 1000ms (U1) In a linked worktree the stale-index hook runs git rev-parse --git-common-dir (~2s) + rev-parse HEAD (~3s) before up to two PATH probes; PROBE_TIMEOUT_MS=1000 holds the worst case near ~7s under Claude Code's 10s hook budget (was 2000, ~1s headroom). Byte-identical in the plugin copy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): fail closed in gitnexus setup on missing required hook helper/adapter (U2) copyHookHelpers now returns the failed REQUIRED helpers (the .cjs trio; win-rm-list-json.ps1 stays best-effort since it fails open). Both install paths skip hook registration with an actionable error when a required helper failed; the Claude path also gains the adapter-existence guard the Antigravity path already had. Prevents registering a hook that crashes MODULE_NOT_FOUND on every tool event. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(skills): steer committed skill files off npx to pnpm dlx gitnexus@latest (U3) All 26 committed skill-file copies (gitnexus/skills, .claude, plugin, cursor) used 'npx gitnexus analyze', contradicting the generated freshness line and funneling npm-11 users into the arborist crash. Replace with 'pnpm dlx gitnexus@latest analyze'; add a regression guard (skills-steering.test.ts) that globs all four locations and fails if any reintroduces it. The cli skill's non-analyze npx subcommands (status/clean/list/wiki) are left as-is (out of the analyze-funnel scope). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): guard resolver import shape; assert group-impact steering (U4) Add a load-time guard on the createRequire(resolve-analyze-cmd.cjs) cast so a drifted/renamed cjs export fails loudly at module load instead of as a late TypeError in warnIfNpm11NpxRisk. Add the missing 'group impact' assertion to the ai-context Cross-Repo Groups test, and a resolver-contract test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): auto-select invocation path with pnpm --allow-build (#1939) Probe npm/pnpm versions and PATH to pick a working analyze command without user configuration: global gitnexus first, pnpm dlx with --allow-build on npm 11+ (Ladybug native scripts), npx on npm 10 and earlier. Update docs, skills, and tests to match the canonical install-free command. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): place pnpm --allow-build before dlx, repair version-injection seam (#1939) The auto-selected install command emitted `pnpm dlx --allow-build=… analyze`, but pnpm < 10.14 keeps `dlx` in its argv escape list, so flags placed *after* `dlx` are parsed as package specs and rejected (ERR_PNPM_SPEC_NOT_SUPPORTED) on pnpm 10.2–10.13.x — strictly worse than the bare command. Move the flags before `dlx` (the position pnpm has honored since 10.2.0) in both byte-identical hook copies, the committed AGENTS.md / CLAUDE.md, and every skill tree. Also repairs the CI-red resolveInvocationMode seam: injecting `{ npmMajor: null }` to simulate an absent npm fell through `??` to the host's real `npm --version` (npm 10.x on the CI runners → routed 'npx' instead of 'pnpm'). Use an `'npmMajor' in deps` sentinel so an injected null is honored, drop the dead parseMajorVersion guard, and gate the flags on pnpm >= 10.2 via a single minor-aware probeVersion spawn (skipped for committed docs). Align the TS getNpmMajorVersion timeout to the 1s hook budget and strengthen the skills-steering guard with a pre-dlx positive assertion plus a post-dlx regression check. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: add npm-11 pnpm caveat to README Quick Starts (#1939) The root, package, and cursor-integration README Quick Starts still steered first-contact users to bare `npx gitnexus analyze` — the exact npm 11.x arborist install crash issue #1939 names as a funnel. Add a one-line pnpm `--allow-build … dlx` caveat (keeping the simple npx default for npm<=10 / pnpm / yarn users); the package README points to its existing npm-11 workaround section. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(skills): route every gitnexus-cli command off npx to pnpm dlx (#1939) The gitnexus-cli skill demonstrated analyze via `pnpm --allow-build … dlx` but still showed status/clean/wiki/list via bare `npx gitnexus` — the same package, the same npm-11 crash-prone install path — and its header claimed "all commands work via npx". Convert every subcommand to the pnpm form across all three skill copies and reconcile the header. Broaden the skills-steering guard to forbid any `npx gitnexus` command in the cli-skill copies. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(hook): probe pnpm once on the stale-index path (#1939) The stale-index hook resolved pnpm twice — `which pnpm` for mode selection then `pnpm --version` for the allow-build gate — two spawns for one tool in a ~9s/10s budget. Capture the version once in formatAnalyzeCommand and thread it through the existing deps seam (a successful `pnpm --version` proves presence), sharing a memoized PATH probe with resolveInvocationMode. Add explicit pnpm 10.0-suppress / 10.2-emit boundary tests and relabel the unknown-minor case. Both byte-identical cjs copies updated together. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(setup): single-quote POSIX hook command + assert cliPath patch applied (#1939) The hook `command` written into editor settings is shell-evaluated; the double-quoted `node "<path>"` form left `$`, backtick, and other metacharacters live in an adversarial $HOME. Single-quote the path on POSIX (Windows keeps the double-quoted form — those chars are illegal in Windows filenames). Also assert the cliPath source-literal replace() actually matched, recording an actionable error on drift instead of silently shipping a hook with an unresolved relative path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(setup): normalize expected hook path for the Windows runner (#1939) The new POSIX-escaping test built its expected hook path with path.join, which emits backslashes on the Windows runner, while setup.ts forward-slash- normalizes the path before quoting — so `expect(cmd).toBe(node '<path>')` mismatched on tests/windows-latest. Normalize the expected path the same way. Production code was already correct; only the test's expected value was platform-fragile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): steer docs/skills via a project-local runner, not a pnpm default (#1939) The prior approach hardcoded `pnpm --allow-build=… dlx gitnexus@latest <cmd>` into every committed skill + the generated AGENTS.md/CLAUDE.md, which assumes pnpm is installed. Replace it with a CLI-neutral project-local runner: - `gitnexus analyze` drops `.gitnexus/run.cjs` (a copy of the canonical `resolve-analyze-cmd.cjs`, which gains `buildRunnerArgv` + a `require.main` exec tail) next to the index. Docs/skills reference `node .gitnexus/run.cjs <cmd>`, which auto-selects the runner (global `gitnexus` → `pnpm dlx` → `npx`) at call time — no package-manager assumption. README first-run + an inline bootstrap note stay universal `npx gitnexus analyze`. - The exec tail uses `shell` on Windows so `.cmd`/`.ps1`/`.exe` shims resolve (execFileSync can't otherwise; Node blocks `.cmd` without a shell, CVE-2024-27980), and prints a diagnostic instead of a silent exit 1. Tests: runner exec-tail (real spawn, exit-code propagation + ENOENT diagnostic), copy-failure graceful degradation, and per-subcommand routing + pnpm-fallback vacuity guards. The generated CLAUDE.md block stays under the #856 token budget. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): resolve Windows .cmd version probes so pnpm steering fires (#1939) probeVersion (and the TS getNpmMajorVersion mirror) spawned npm/pnpm --version via execFileSync with no shell, so on Windows the .cmd shims ENOENT'd, the probe reported a present tool as absent, and the stale-index hook recommended the npx crash path #1939 exists to avoid. Add shell: process.platform === 'win32' to the version probes (the exec tail already does this). Parse the first version-shaped line so a Corepack/notice banner on stdout no longer defeats the parse. Carry pnpm presence separately from version so a present-but-unparseable pnpm still selects pnpm. Drop the dead probe ?? resolveOnPath coalesce. Cover resolve-analyze-cmd.cjs (+ plugin twin) with the shell-injection and windowsHide source-regression guards. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): widen pnpm allow-build for the --embeddings=N equals form (#1945) buildRunnerArgv detected embeddings via gitnexusArgs.includes('--embeddings'), which missed the equals form (--embeddings=5000) that Commander also accepts, dropping --allow-build=onnxruntime-node on pnpm 10.2+. Match both forms. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cli): cover the runner exec-tail Windows shell branch on CI (#1945) runner-exec-tail.test.ts was POSIX-only and unregistered in cross-platform-tests.ts, so the run.cjs Windows shell:true exec branch ran on no platform despite the file comment claiming windows-latest covered it. Add a .cmd-shim it.skipIf(onPosix) case and register the file in SPAWN_CLI so the windows-latest job runs it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: fix broken troubleshooting anchor in gitnexus README (#1945) The npm-11 quick-start note linked to #npx-gitnexus-crashes-with-nodetarget-is-null-npm-11, which matches no heading; the actual troubleshooting heading slugifies to #cannot-destructure-property-package-of-nodetarget-as-it-is-null. Repoint the link. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(hooks): guard resolve-analyze-cmd.cjs in antigravity e2e sanity check (#1945) The antigravity adapter top-level require()s resolve-analyze-cmd.cjs, but the beforeAll helper-presence loop did not check for it — a failed copy would surface as noisy MODULE_NOT_FOUND in downstream tests instead of the intended actionable 'Helper not installed' error. Add it to the loop. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(skills): tie a missing-runner Cannot-find-module error to recovery (#1945) Generated CLAUDE.md/AGENTS.md make `node .gitnexus/run.cjs` the primary command, but the runner is gitignored, so a fresh clone or git clean leaves an agent facing a raw MODULE_NOT_FOUND. The CLAUDE.md block is token-budget-capped (#856), so the recovery guidance lives in the cli skill (its documented home): the bootstrap note now names the `Cannot find module` error and points at `npx gitnexus analyze` to (re)generate the runner. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cli): disambiguate the MCP-pinned ref from the @latest hint (#1945) setup.ts and resolve-analyze-cmd.cjs both exported a constant named NPX_REF with different values (version-pinned for the persisted MCP entry vs. gitnexus@latest for hints). Rename setup.ts's module-private constant to MCP_PINNED_REF (value and behavior unchanged — the MCP pin stays pinned), leaving the cjs hint ref and its re-export alone. Also route the createRequire cast through 'unknown' so it reads as an explicit narrowing to the subset this module uses rather than a claim about the cjs's full export shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-02 09:00:34 +01:00