mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-20 00:11:37 +00:00
887 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
dependabot[bot]
|
0824b96d15
|
chore(deps)(deps-dev): bump @types/node in /gitnexus (#1421)
Some checks are pending
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Release Candidate / Publish release candidate to npm (push) Blocked by required conditions
Release Candidate / Build & Push RC Docker images (push) Blocked by required conditions
Release Candidate / Check if release candidate should run (push) Waiting to run
Release Candidate / ci (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.6.0 to 25.6.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.6.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Gergő Magyar
|
d3a7ce95a5
|
feat(core): adopt pino structured logger (#1336)
* feat(core): adopt pino structured logger + add no-console eslint forcing function
Adds `pino` as the project-wide structured logger via a thin wrapper at
`gitnexus/src/core/logger.ts` exposing `createLogger(name, opts?)` and a
default `logger` singleton. Migrates the only security-relevant `console.warn`
site (`bridge-db.ts` `openBridgeDbReadOnly` retry-exhaustion path) to
`bridgeLogger.debug({groupDir, err, attempts}, 'msg')`.
Pino's NDJSON output is structurally log-injection-resistant (one record per
newline, all string fields JSON-escaped) — replaces the hand-rolled
`sanitizeLogValue` pattern that PR #1329 added on the `fix/insecure-tempfile-core`
branch. PR #1329's sanitizer remains as fallback until CodeQL confirms #466
closes via pino on this branch.
Also adds an ESLint `no-console: warn` rule scoped to
`gitnexus/src/**/*.ts` (excluding `cli/`, `server/`, `test/`, `bin/`, and the
logger module itself) as the forcing function — new code can't regress.
Existing 134 sites in `core/`, `mcp/`, `config/`, `storage/` get a
`// eslint-disable-next-line no-console -- TODO(pino-migration)` marker in a
follow-up commit so lint stays clean and the remaining work is grep-able.
Operator behaviour preserved:
- `GITNEXUS_DEBUG_BRIDGE` truthy → bridgeLogger logs at debug level
- `GITNEXUS_DEBUG_BRIDGE` unset → bridgeLogger filters debug messages
- Output is NDJSON in production / CI / vitest
- pino-pretty engages only when stdout is a TTY AND CI/VITEST env unset
Tests: 11 new logger.test.ts cases (level methods, debugEnvVar gating,
destination capture, undefined Error.message safety, CR/LF/U+2028/ANSI
single-record invariant). Group test suite (388 tests) passes unchanged.
`--no-verify`: pre-commit hook fails on PR #1302's pre-existing TS regression
at `scope-resolution/pipeline/run.ts:160` on main; documented in commit
`348d0c91` and recurring across the security-fix series.
Refs: #466 (codeql js/log-injection), PR #1329 follow-up.
* chore(lint): baseline-suppress 134 existing console.* sites with TODO(pino-migration)
Mechanical pass: prepends `// eslint-disable-next-line no-console -- TODO(pino-migration)`
above each existing `console.*` call in `gitnexus/src/{config,core,mcp,storage}/`
that the new ESLint rule would otherwise flag. CLI/server are exempt at the
config level (legitimate stdout output).
Zero functional changes. Generated by an in-repo node script that consumes
`eslint --format json` output and prepends the marker line at each reported
location. Verification:
npx eslint gitnexus/src/ → 0 no-console warnings
grep -rn "TODO(pino-migration)" gitnexus/src/ | wc -l → 134
The marker tags inventory the remaining migration surface so future sweep
PRs can grep their target list. When a follow-up PR migrates a site, the
marker comment is removed alongside the `console.*` → `logger.*` swap.
`--no-verify`: same as parent commit (PR #1302 pre-existing TS regression on main).
* refactor(core): complete pino migration — replace all 134 console.* sites + flip ESLint to error
Codebase-wide sweep of every `TODO(pino-migration)` site flagged in commit
|
||
|
Copilot
|
4cd3ee3832
|
Fix ci-report step when base coverage artifact is unavailable (#1412)
Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/cdf42ff2-4b89-4c5e-a5ab-f68ff62995b0 Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> |
||
|
Copilot
|
f40973a1ca
|
fix(ci): handle expired artifacts in base coverage fetch (#1410)
The "Fetch base branch coverage" step in ci-report.yml now: - Checks up to 5 recent successful main-branch CI runs - Catches HTTP 410 (artifact expired) and tries the next run - Gracefully sets found=false if all artifacts are expired/missing This prevents the PR Report job from failing when the most recent main-branch test-reports artifact has expired. Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/a2a6b392-de09-4c76-b7ea-5de2c738cb9d Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> |
||
|
azizur100389
|
4e362ba70a
|
fix(setup): correct OpenCode skills install path in status message (#1386)
* fix(setup): correct OpenCode skills install path in status message (#1381) The log message reported ~/.config/opencode/skill/ (missing trailing s) while the actual install path was already correct (skills/). Fixes the misleading output so users see the real destination directory. * test(setup): add OpenCode plural skills-path integration test (#1381) Verifies that setup installs skills into ~/.config/opencode/skills/ (plural) and that the singular path does not exist. Co-Authored-By: Gujiassh <baiaoshh@163.com> --------- Co-authored-by: Gujiassh <baiaoshh@163.com> |
||
|
Gergő Magyar
|
48f15a3bca
|
ci(release): use fine-grained PAT for rc tag push (#1407)
The default GITHUB_TOKEN cannot be granted `workflows: write`, so
`git push --atomic` of the rc v-tag fails when its commit chain reaches
any commit that modified `.github/workflows/**`. Symptom on the most
recent run:
! [remote rejected] v1.6.4-rc.82 -> v1.6.4-rc.82
(refusing to allow a GitHub App to create or update workflow
`.github/workflows/trivy.yml` without `workflows` permission)
GitHub's rule: any ref-update that makes a workflow-modifying commit
reachable through the new ref requires `workflows: write` on the
identity performing the push, regardless of whether that commit is
already on another remote ref. The default GITHUB_TOKEN cannot hold
that permission.
Pass a fine-grained PAT (RELEASE_PUSH_TOKEN, scoped to this repo with
Contents: write + Workflows: write) into actions/checkout's `token`
input so origin is preauthed for the subsequent `git push`. The
job-level GITHUB_TOKEN keeps its scoped permissions for npm provenance
and other steps.
Required one-time setup:
1. Generate a fine-grained PAT
- Resource owner: account that owns this repo
- Repository access: Only select repositories → GitNexus
- Permissions: Contents: write, Workflows: write, Metadata: read
2. Add as repo secret named RELEASE_PUSH_TOKEN
3. Re-run the failed Release Candidate workflow with force=true
Considered and skipped: GitHub App approach (org-owned, bot identity,
short-lived tokens). Better long-term, but a fine-grained PAT is
acceptable at one-maintainer scale. Migration is mechanical if the
project later wants to switch.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
dependabot[bot]
|
8e76729750
|
chore(deps)(deps): bump @langchain/anthropic in /gitnexus-web (#1389)
Bumps [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) from 1.3.27 to 1.3.28. - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/commits) --- updated-dependencies: - dependency-name: "@langchain/anthropic" dependency-version: 1.3.28 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
fd4d4a3fee
|
chore(deps): bump docker/build-push-action from 6.19.2 to 7.1.0 (#1391)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.19.2 to 7.1.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](
|
||
|
dependabot[bot]
|
c8683d58fc
|
chore(deps): bump github/codeql-action from 3.35.3 to 4.35.3 (#1390)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.3 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](
|
||
|
Gergő Magyar
|
de63418f7e
|
fix(mcp): close MCP server timeout — stdout discipline + cold-start friction (#1383)
* fix(lbug): route diagnostic logs to stderr to avoid MCP stdio corruption
Replace console.log/console.warn with console.error in core/lbug so
diagnostic messages reach stderr and never corrupt the JSON-RPC stream
on MCP stdio. Per spec, the server MUST NOT write anything to stdout
that is not a valid MCP message.
- lbug-adapter.ts:367 - schema creation warning (MCP-reachable via lazy
DB init from tool handlers)
- lbug-adapter.ts:1047,1054 - legacy embedding fallback diagnostics
(currently HTTP-only, but covered by upcoming no-console lint rule)
- extension-loader.ts:191 - default warn handler fallback used during
DuckDB extension loading
* feat(mcp): add stdout sentinel via AsyncLocalStorage transport-write tagging
Untagged process.stdout.write calls now redirect to stderr with a
[mcp:stdout-redirect] prefix instead of corrupting the JSON-RPC frame
stream. Identification is correctness-by-construction: the transport
wraps every send() in withMcpWrite() (AsyncLocalStorage) and the
sentinel checks isMcpWrite() per call. A byte-shape heuristic would
have falsely rejected Content-Length frames (start with C, end with })
and misclassified multi-chunk writes.
- gitnexus/src/mcp/stdio-context.ts: AsyncLocalStorage helpers + factory
- gitnexus/src/mcp/server.ts: install sentinel in safeStdout Proxy,
flush summary at process exit
- gitnexus/src/mcp/compatible-stdio-transport.ts: wrap send() write in
withMcpWrite so transport frames pass through cleanly
- gitnexus/test/unit/mcp-stdout-sentinel.test.ts: 17 cases covering
pass-through, redirect, prefix, truncation (default 200 / custom),
rate limit (default 10), one-shot warning, summary, mixed sequences
* feat(eslint): forbid console.log/warn and process.stdout.write in MCP-reachable code
Add a narrow ESLint override for gitnexus/src/mcp/**, gitnexus/src/core/lbug/**,
gitnexus/src/core/embeddings/**, and gitnexus/src/cli/mcp.ts that:
- sets no-console: ['error', { allow: ['error'] }] — only console.error
survives, since stderr is the only spec-safe channel for diagnostics
while the MCP stdio transport owns stdout for JSON-RPC frames
- adds no-restricted-syntax matching MemberExpression and CallExpression
forms of process.stdout.write to close the bypass path that the
AsyncLocalStorage sentinel cannot guarantee
Migrates 18 pre-existing console.log/warn call sites in core/embeddings/
(embedder.ts, embedding-pipeline.ts) to console.error; these are reached
from gitnexus_query semantic search and would have polluted MCP stdio
once a query triggered the embedding pipeline.
Adds eslint-disable-next-line comments in pool-adapter.ts at the four
legitimate process.stdout.write sites — they ARE the captured-real-write
infrastructure used by the sentinel and the silenceStdout/restoreStdout
mechanism.
The override is forward-compatible with feat/pino-logger (PR #1336)
which adds a broader no-console rule for gitnexus/src/; the narrow rule
here is a strict subset and rebases trivially when #1336 lands.
* feat(setup): pin setup-generated MCP config to installed version, keep static configs on @latest
The user-facing MCP config that 'gitnexus setup' writes into editor configs
now references gitnexus@<installed-version> instead of gitnexus@latest, read
dynamically from gitnexus/package.json#version at module load. This skips
the npm-registry metadata roundtrip on every MCP connect and stays
reproducible until the user explicitly upgrades.
Static example configs and quickstart docs intentionally keep @latest:
- .mcp.json, gitnexus-claude-plugin/.mcp.json
- gitnexus-claude-plugin/skills/*/mcp.json (6 files)
- README.md / gitnexus/README.md MCP examples
Pinning these would create per-release version-bump churn for marginal
(~100-500ms) savings. The dominant cold-cache cost is the native rebuild
addressed separately by the GITNEXUS_SKIP_OPTIONAL_GRAMMARS env var.
README adds a one-line steer above the @latest quickstart pointing
repeated users at 'gitnexus setup' for the absolute-path config that
bypasses npx entirely.
Tests refactored to assert against the dynamic version (createRequire of
package.json) so they don't break on every release bump:
- gitnexus/test/unit/setup.test.ts
- gitnexus/test/unit/setup-jsonc.test.ts
- gitnexus/test/unit/setup-codex.test.ts
- gitnexus/test/integration/setup-skills.test.ts (regex match)
* feat(install,mcp): GITNEXUS_SKIP_OPTIONAL_GRAMMARS opt-out + missing-grammar warnings
Postinstall scripts (build-tree-sitter-dart.cjs, build-tree-sitter-proto.cjs)
gain a strict 'process.env.GITNEXUS_SKIP_OPTIONAL_GRAMMARS === "1"'
early-exit so users without a C++ toolchain (or anyone wanting fast
'npm install gitnexus') can skip the native rebuild. Strict '=1' only —
'true', 'yes', '0' and any other value fall through to the rebuild.
Add gitnexus/src/cli/optional-grammars.ts: cheap require.resolve probe for
each optional grammar, with a stderr warning helper. The warning surfaces:
- At MCP server start (cli/mcp.ts) — unconditional, since the server
serves any indexed repo and we cannot pre-filter by language.
- At 'gitnexus analyze' start (cli/analyze.ts) — conditional on the
target repo containing .dart/.proto files (cheap glob), so users with
no relevant code don't see noise.
README documents the env var with the strict '=1' value and the trade-off
(faster install, no Dart/Proto parsing until reinstalled).
* test(mcp): child-process integration test asserts end-to-end stdout discipline
Spawns 'node dist/cli/index.js mcp' as a child, drives the MCP stdio
handshake (initialize -> initialized -> tools/list), reassembles every
stdout chunk into Content-Length-framed JSON-RPC messages, and asserts
zero stray bytes. Any byte outside a valid header-then-body window is
captured and surfaced in the failure message alongside the server's
stderr — this is the regression gate for U1 (no console.log/warn in
MCP-reachable code) and U3 (AsyncLocalStorage stdout sentinel).
Time budget: 5s local / 15s CI for first frame; 10s/30s total. Asserts
the published GitNexus tool surface (list_repos, query, context, impact,
detect_changes, rename) is reported by tools/list.
Adds 'pretest:integration': 'node scripts/build.js' so 'npm run
test:integration' rebuilds dist before the spawn — closes the
'stale dist masks regression' DX gap.
* fix(mcp): address PR #1383 review — sentinel scope, grammar detection, lint, contract
Blockers:
- B2: detectMissingOptionalGrammars now actually require()s each grammar
instead of require.resolve(). For 'file:' optional dependencies the
package directory is always installed regardless of postinstall outcome,
so resolve() never threw and the missing-grammar warning never fired
for the exact target users (those who set GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1
or whose native rebuild soft-failed). require() loads the entry, which
triggers node-gyp-build and throws if .node is absent. Result memoized.
Should-fix:
- S1: Removed duplicate uncaughtException/unhandledRejection handlers from
cli/mcp.ts. server.ts:startMCPServer already registers handlers with
full stack traces; cli/mcp.ts handlers fired first with worse output and
never got a chance to exit because server.ts shuts down immediately.
- S2: Sentinel is now actually global. New setActiveStdoutWrite() in
pool-adapter so silenceStdout/restoreStdout cycles preserve a
registered wrapper instead of unwinding to raw realStdoutWrite. At
startMCPServer: install sentinel.write as process.stdout.write AND
register it as the active handler. Direct process.stdout.write calls
from anywhere (console.log, dependency banners, etc.) now route through
the sentinel instead of bypassing it. The transport's _safeStdout Proxy
remains as belt-and-suspenders.
- S3: ESLint no-restricted-syntax now also forbids destructuring of
process.stdout (covers both 'const { write } = process.stdout' shapes
and rest patterns).
Minor:
- M1: chunkToBuffer now handles plain Uint8Array (Buffer.from(u8)) instead
of falling through to String(chunk) which produced '1,2,3,...' garbage.
- M2: Untagged-write callbacks are now invoked on next tick per the
Node Writable.write contract — both within and beyond the rate-limit cap.
extractCallback handles the (chunk, cb) and (chunk, encoding, cb) overloads.
- M3: setup.ts throws early if package.json#version is missing/non-string
instead of emitting 'gitnexus@undefined'.
- M4: parser-loader.ts console.warn → console.error; ESLint scope extended
to gitnexus/src/core/tree-sitter/** so future violations are caught.
New tests cover:
- Plain Uint8Array redirect (asserts no String(chunk) garbage).
- Writable callback fired async (next-tick) for both normal and
past-rate-limit redirects.
Validation: cd gitnexus && npx tsc --noEmit clean; vitest run 7863 passed,
11 skipped; eslint clean on MCP-reachable scope; integration test green
against rebuilt dist/.
* fix(mcp): close pre-sentinel stdout window + tighten contracts
Address ce-code-review findings on PR #1383:
P1 — Sentinel install order (was: stdout corruption window during
mcpCommand pre-startup):
- Add idempotent installGlobalStdoutSentinel() to mcp/stdio-context.ts.
It captures realStdoutWrite/realStderrWrite, replaces process.stdout.write,
and registers with pool-adapter's setActiveStdoutWrite — exactly once.
- cli/mcp.ts now installs the sentinel as the FIRST line of mcpCommand,
before warnMissingOptionalGrammars (which after the B2 fix actually
require()s each native grammar binding and could emit node-gyp-build
banners to raw stdout in the pre-sentinel window).
- mcp/server.ts startMCPServer keeps a safety-net call to the same helper;
the second invocation is a no-op.
P1 — WriteFn type erasure:
- WriteFn now declared as instead of
, so the assignment
and the
setActiveStdoutWrite(sentinel.write) call don't silently cross a
type boundary.
P1 — extractCallback fragility:
- Replaced backward-scan-with-undefined-break heuristic with a strict
'last arg if function' check matching the documented Writable.write
contract. No longer breaks on a future (chunk, options, cb) overload.
P2 — _detectionCache premature memoization:
- Removed the explicit cache. Node's module cache already memoizes
require() — calling detectMissingOptionalGrammars multiple times is
cheap. Removing the module-level mutable state makes the helper
trivially testable (no need for a reset hatch).
P2 — Misleading 'reinstall' message on broken (not missing) grammars:
- detectMissingOptionalGrammars now distinguishes MODULE_NOT_FOUND /
node-gyp-build 'no native build' patterns from other errors
(SyntaxError, EACCES, native crash). Broken bindings get an
actionable stderr line naming the real failure instead of the
misleading 'reinstall to enable' hint.
Other:
- mcp/core/lbug-adapter.ts updated with a KEEP-THIS-FILE note. Tests
use the path as a vi.mock seam (calltool-dispatch.test.ts and 7
others); new non-test code may import core/lbug/pool-adapter.js
directly. The maintainability finding flagging the shim as
self-contradictory was incorrect — the shim has a real test purpose.
Validation: tsc clean, vitest 7863 passed (no regressions), eslint
clean on MCP-reachable scope, integration test green against rebuilt
dist/.
* fix(mcp): close import-time stdout corruption window
Codex's adversarial review on PR #1383 found that even though cli/mcp.ts
is loaded lazily by Commander, ITS static imports (startMCPServer,
LocalBackend, installGlobalStdoutSentinel, warnMissingOptionalGrammars)
evaluate synchronously when the module loads — well before mcpCommand's
function body runs. Three of those four imports transitively pulled in
core/lbug/pool-adapter.ts, which imports @ladybugdb/core at module top
level. The native binding's init can write to raw stdout in that
pre-sentinel window and corrupt the JSON-RPC frame stream.
Fix: shrink cli/mcp.ts's static-import closure to a single zero-dep
chain (mcp/stdio-context.js -> mcp/stdio-capture.js, both leaf-clean),
install the sentinel as the first executable statement of mcpCommand,
then dynamically import the heavy backend modules in parallel via
await Promise.all.
Per the plan at docs/plans/2026-05-06-002-fix-import-time-stdout-window-plan.md:
- U1: New leaf module gitnexus/src/mcp/stdio-capture.ts owns the
stdout-capture singleton state (realStdoutWrite, realStderrWrite,
activeStdoutWrite + setActiveStdoutWrite/getActiveStdoutWrite).
Zero non-node: imports — adding any would re-introduce the hazard.
- U2: pool-adapter.ts re-exports the relocated symbols under the
existing names so the test mock seam (8+ files use vi.mock on
mcp/core/lbug-adapter.ts which re-exports * from pool-adapter)
keeps working without churn. restoreStdout and the watchdog now
read the active handler via getActiveStdoutWrite(). stdio-context.ts
imports from stdio-capture directly.
- U3: cli/mcp.ts's static imports collapse to one
(installGlobalStdoutSentinel). startMCPServer / LocalBackend /
warnMissingOptionalGrammars become parallel await import()
inside mcpCommand, after the sentinel install.
- U4: New regression test gitnexus/test/integration/mcp/import-closure.test.ts
spawns a child Node process that imports dist/cli/mcp.js (without
invoking mcpCommand), inspects the CJS module cache via createRequire,
and asserts @ladybugdb/core (and tree-sitter native bindings) are
NOT in the static-import closure. Characterization-first: this test
was authored to fail against the pre-fix code and confirmed to do so
before U1-U3 landed.
Validation: tsc clean; vitest 7865 passed / 11 skipped (2 new U4 cases);
eslint clean on MCP-reachable scope; integration server-startup test
green against rebuilt dist/.
* fix(mcp): drop dead ESLint selector + suppress redundant grammar warning
Two minor PR #1383 review findings:
1. eslint.config.mjs: removed Selector 3 (`Property[key.name='write'].properties:has(...)`).
`.properties` is not a valid attribute on a Property node in the ESTree
AST, so the :has clause never matched — dead code. Selector 4 covers
the canonical `const { write } = process.stdout` shape; tightened its
comment to make that explicit.
2. cli/mcp.ts: removed the unconditional warnMissingOptionalGrammars call
at MCP startup. The analyze path already emits this warning at index
time with relevantExtensions filtered to the repo's actual file types,
and a repo can only be served by MCP after analyze has run. Repeating
the warning unconditionally on every MCP session was pure noise on
machines whose indexed repos don't use .dart/.proto.
* chore(mcp): address PR #1383 review nits
Three minor hygiene findings from the production-readiness review:
- cli/mcp.ts: rewrite stale comment that described
warnMissingOptionalGrammars as living inside mcpCommand. The call was
removed in
|
||
|
azizur100389
|
7639308f65
|
fix(security): replace predictable tempfile names with crypto.randomBytes (#1387) | ||
|
dependabot[bot]
|
68e4a5aece
|
chore(deps)(deps-dev): bump jsdom from 29.0.2 to 29.1.1 in /gitnexus-web (#1395)
Some checks are pending
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Release Candidate / Check if release candidate should run (push) Waiting to run
Release Candidate / ci (push) Blocked by required conditions
Release Candidate / Publish release candidate to npm (push) Blocked by required conditions
Release Candidate / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
|
||
|
dependabot[bot]
|
84564e09b8
|
chore(deps)(deps): bump react-dom from 19.2.5 to 19.2.6 in /gitnexus-web (#1396) | ||
|
dependabot[bot]
|
bc98239fb4
|
chore(deps)(deps): bump express-rate-limit in /gitnexus (#1397) | ||
|
dependabot[bot]
|
608be7655d
|
chore(deps)(deps): bump @langchain/core in /gitnexus-web (#1394) | ||
|
azizur100389
|
b486d04d75
|
refactor(lbug): extract safeClose helper to consolidate WAL flush (#1377) | ||
|
evolution
|
28df98c997
|
fix(go): use loose equality for Array.find() null checks (#1384)
* fix(go): use loose equality for Array.find() null checks (#1346, #1366) Array.find() returns undefined (not null) when no match is found, but the code checked with === null / !== null which fails to intercept it. This caused "Cannot read properties of undefined (reading 'type')" and "Cannot read properties of undefined (reading 'namedChildren')" crashes on Go files containing plain for loops, make(chan T), or other patterns where the expected tree-sitter node type is absent. * refactor(go): use strict undefined checks for Array.find() results Address review feedback: Array.find() returns undefined by spec, so check with === undefined / !== undefined instead of loose == null. |
||
|
Jorrin
|
96578aa4a8
|
feat: add optional limit arg to --embeddings flag (closes #382) (#1375) | ||
|
azizur100389
|
a418c47e29
|
fix(server): use ipKeyGenerator for IPv6 subnet normalisation (#1360) (#1374)
The custom keyGenerator in createRouteLimiter referenced req.ip without passing it through express-rate-limit's ipKeyGenerator helper. This caused ERR_ERL_KEY_GEN_IPV6 on startup when binding to 0.0.0.0, and meant each full IPv6 address got its own rate-limit counter — trivially bypassing the per-IP limit. Wrap the IP through ipKeyGenerator so IPv6 addresses are collapsed to their /56 subnet before keying the counter. The existing fallback chain (req.ip → socket.remoteAddress → 'unknown') is preserved to keep ERR_ERL_UNDEFINED_IP_ADDRESS from firing on abruptly closed connections. Tests: 3 new assertions (construction-time regression guard, source-grep for import and call site). |
||
|
1PLee
|
05ca80ea30
|
feat(ingestion): add thrift contracts impl (#1234) | ||
|
dependabot[bot]
|
e55256ba53
|
chore(deps)(deps): bump axios (#1345)
Bumps the npm_and_yarn group with 1 update in the /gitnexus-web directory: [axios](https://github.com/axios/axios). Updates `axios` from 1.15.0 to 1.16.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.15.0...v1.16.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.16.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
9d91530f94
|
chore(deps)(deps): bump express-rate-limit in /gitnexus (#1343)
Bumps [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) from 8.4.1 to 8.5.0. - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](https://github.com/express-rate-limit/express-rate-limit/compare/v8.4.1...v8.5.0) --- updated-dependencies: - dependency-name: express-rate-limit dependency-version: 8.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
azizur100389
|
46e4c979c4
|
fix(server): flush WAL after /api/embed so search sees new embeddings (#1149) (#1359) | ||
|
azizur100389
|
8fc32e6af9
|
fix(docker): add dedicated health endpoint for container healthcheck (#1147) (#1355)
Some checks are pending
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Release Candidate / Check if release candidate should run (push) Waiting to run
Release Candidate / ci (push) Blocked by required conditions
Release Candidate / Publish release candidate to npm (push) Blocked by required conditions
Release Candidate / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
|
||
|
azizur100389
|
e60e62f193
|
fix(test): widen worker pool retry timeout to prevent CI flake (#1323) (#1354) | ||
|
Christian C. Berclaz
|
816ae5e66e
|
fix(pool): wait for replacement worker online before dispatch (#1324)
* fix(test): widen worker pool retry timeout to prevent flake under load The "replaces a timed-out worker" test used 150ms idle timeout (600ms retry), which is too tight when CPU is contended during parallel test runs. Increase to 500ms (2s retry) — the test exercises the retry mechanism, not tight timing. Closes #1323 * fix(pool): wait for replacement worker to come online before dispatching Root cause: replaceWorker() spawned a new Worker but returned immediately without waiting for the thread to start. The subsequent runWorker() call started the idle timer and posted the sub-batch while the thread was still booting. Under CPU contention, thread startup latency consumed most of the retry timeout budget, causing the flake. Wait for the 'online' event before assigning the replacement worker. This ensures the idle timeout measures actual processing time, not thread startup overhead. Reverts the test timeout widening (500ms→150ms) since the root cause is now addressed. No production performance regression was found — the 30s default timeout is unaffected. Only the tight test timeouts were sensitive to startup latency. * fix(pool): harden replacement worker startup with three-event helper Address review feedback on the waitForWorkerOnline implementation: 1. Add waitForWorkerOnline helper that listens for 'online', 'error', and 'exit' events with proper cleanup after settlement. Prevents the dispatch promise from hanging if a replacement worker crashes before coming online (e.g. OOM, native addon failure). 2. Wrap replaceWorker call site in try/catch that routes failures through fail() — prevents unhandled promise rejections in the async setTimeout callback. 3. Re-check stopped flag after awaiting replacement startup — prevents injecting a live worker into a pool that was stopped by a concurrent failure during the await window. Terminates the orphaned replacement. 4. Add integration test for replacement worker crash during startup: worker throws on second load (marker-file gated), verifying the pool rejects the dispatch instead of hanging. * fix(pool): preserve original error in replacement worker catch The bare catch{} discarded the original error from waitForWorkerOnline, causing the startup-crash test regex to miss. Bind the error and include its message in the re-thrown Error. |
||
|
azizur100389
|
4048f53e35
|
fix(git): suppress stderr leak in getCurrentCommit and getGitRoot (#1172) (#1341)
* fix(git): suppress stderr leak in getCurrentCommit and getGitRoot (#1172) Node's execSync forwards the child's stderr to the parent process when the stdio option is not explicitly set. getCurrentCommit and getGitRoot both caught the resulting error but did not suppress the stderr output, causing "fatal: not a git repository" messages to leak to the terminal whenever they were called on a path outside a git worktree. Add stdio: ['ignore', 'pipe', 'ignore'] to both functions, matching the pattern already used by getRemoteUrl, getRemoteOriginUrl, and getCanonicalRepoRoot in the same file. * address review: add getGitRoot stderr test, normalize em dashes to ASCII - Add matching process.stderr.write spy test for getGitRoot (#1172) - Replace U+2014 em dashes with ASCII -- in new comments |
||
|
GoGoLin
|
027340292f
|
fix(embeddings): add CHECKPOINT before closing database to prevent WAL corruption (#1314) | ||
|
Christian C. Berclaz
|
cbe5dac8b7
|
fix(test): widen rate-limit test window to prevent flake on Windows CI (#1347) | ||
|
dependabot[bot]
|
bf11269260
|
chore(deps)(deps): bump lru-cache from 11.3.5 to 11.3.6 in /gitnexus (#1344) | ||
|
azizur100389
|
f10135649e
|
fix(server): rate-limit /api/analyze and /api/embed endpoints (#1328) (#1339)
Some checks are pending
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Release Candidate / Check if release candidate should run (push) Waiting to run
Release Candidate / ci (push) Blocked by required conditions
Release Candidate / Publish release candidate to npm (push) Blocked by required conditions
Release Candidate / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
|
||
|
azizur100389
|
3732fa1e21
|
fix(storage): derive registry name from canonical repo root, not worktree slug (#1259) (#1296) | ||
|
Gergő Magyar
|
0add072f25
|
fix(server): add per-route rate limiting on FS-touching endpoints (U4) (#1327)
* fix(server): add per-route rate limiting on FS-touching endpoints (U4) U4 of the security remediation plan. Closes the four CodeQL js/missing-rate-limiting high alerts on FS-touching routes: #180 app.get(SPA_FALLBACK_REGEX, ...) (api.ts:225) #181 app.delete('/api/repo', ...) (api.ts:845) #444 app.get('/api/file', ...) (api.ts:1158) #183 app.get('/api/grep', ...) (api.ts:1169) The threat model: file-handle / disk-I/O exhaustion from a single attacker repeating requests. The local-bound HTTP server has a small surface (localhost by default; CORS allowlist for private-network reverse-proxy deployments), so a per-IP limiter sized for interactive web-UI use is the right shape — not global throttling, not hand-rolled, not Redis-backed. Architectural choices (cite DoD as I go): - Library: express-rate-limit ^8.4.1 — canonical, ~30KB, no native deps, memory store. (DoD §2.5: third-party dep justified, reputable, no supply-chain regression — found 0 vulnerabilities on install.) - Per-route limiters (independent counters): /api/file traffic does not push /api/grep into 429. Each route gets its own createRouteLimiter() instance. - Uniform default (60 rpm/IP): single tier across all 4 routes. Tiered per-route limits are over-engineering until traffic patterns demand it. (DoD §2.3: smallest correct solution.) - trust proxy = 'loopback, linklocal, uniquelocal': honors X-Forwarded-For only from local/private origins, exactly aligned with the CORS allowlist. Without this, every request through a Docker bridge or reverse proxy would count as a single req.ip and one user would trip the per-IP limiter for everyone (residual review F5 on the U2 plan, now fixed at the source rather than deferred). - No env-var override (e.g. GITNEXUS_RATE_LIMIT_RPM) in this PR. Per scope-guardian residual review F7: env vars are feature scope, not security remediation. Add tunability if and when operators ask. (DoD §2.3 + §6 not-done: avoid scope creep.) - New helper createRouteLimiter(opts?) in validation.ts wraps rateLimit with project-uniform defaults (status, headers, message). Justified by DRY across 4 callers and one place to tune later — not speculative abstraction. (DoD §2.3.) - 429 response body matches the project's { error: '...' } JSON shape so the web UI's error display stays uniform; draft-7 RateLimit-* headers (no legacy X-RateLimit-*) so callers can read the limit and back off. Tests (6 new in test/unit/rate-limit.test.ts; 136 total server-area): - createRouteLimiter exports DEFAULT_RATE_LIMIT_RPM = 60 - Returns a different middleware instance per call (independent counters) - Produces a callable express RequestHandler (3-arg signature) - Integration: 3 requests through, 4th returns 429 with { error } body (the exact regression guard CodeQL would re-fire if the limiter were dropped from any production route) - draft-7 RateLimit response header emitted, no legacy X-RateLimit-* - 429 body matches { error: '...' } shape The integration test mounts a route that does fs.readFile (the same FS sink CodeQL flags) behind createRouteLimiter on a tiny isolated express app. Tests use { windowMs: 1000, max: 3 } to keep them fast and deterministic. Pre-commit bypassed (--no-verify) — same pre-existing TS regression on main from PR #1302; this PR does not touch the affected file. * fix(server): address U4 code-review findings — best-judgment fix pass Code review on PR #1327 surfaced a cluster of P1/P2 findings the multi- agent pipeline corroborated across reviewers (correctness, security, adversarial, testing, maintainability, project-standards, api-contract, reliability, performance, kieran-typescript). This commit applies the high-confidence fixes that improve quality without expanding scope. Scope-decision items (cloud-LB trust-proxy override, /api/analyze and /api/embed rate limiting, --no-verify Go-provider TS regression) are deferred and surfaced in the PR body's residual section. validation.ts (createRouteLimiter): - Renamed `max` to canonical `limit` (express-rate-limit v8+; `max` is the deprecated alias that now logs a deprecation notice). - Replaced `Partial<RateLimitOptions>` with a narrow RouteLimiterOverrides type exposing only { windowMs?, limit? }. Closes the security regression vector where a caller could pass `{ skip: () => true }` and silently disable limiting on a route. - Added passOnStoreError: true so a memory-store failure lets the request through rather than producing an HTML 500 from Express's default error handler (the limiter middleware fires before the route's try/catch). - Added a custom keyGenerator with req.socket?.remoteAddress fallback so abruptly closed connections do not trigger ERR_ERL_UNDEFINED_IP_ADDRESS (which would 500 the request via Express's default error handler). - Widened return type from RequestHandler to RateLimitRequestHandler so callers can access .resetKey() if needed. - Unexported DEFAULT_RATE_LIMIT_RPM (consumed only internally; the test now asserts the observable behavior — 60 requests pass under default policy — instead of pinning the constant value). api.ts: - Expanded the trust-proxy comment with a SCOPE note (process-wide effect on every middleware/route) and a CLOUD-DEPLOY CAVEAT explicitly naming AWS ALB / Cloudflare / Fly.io edge / CGNAT as topologies that need an env-var override before production deployment. Tracked as follow-up. - Raised SPA fallback limit from 60 rpm/IP to 300 rpm/IP (5 req/s sustained). The original 60 was tight enough that multi-tab browser navigation, prefetch, and service-worker revalidation could legitimately trip it; the SPA fallback only does sendFile of a constant-path index.html, so the heavier limit is fine. JSON-on-429 to HTML clients is now a much rarer code path in practice; full content-negotiation on the 429 itself is tracked as follow-up. - Dropped CodeQL alert-ID numbers (#180/#181/#183/#444) from per-route comments — those IDs rotate per scan and would rot. The rule name (js/missing-rate-limiting) is the stable anchor. gitnexus-web backend-client.ts (web-client 429 handling): - Added 'rate_limited' to BackendError.code union; populated for 429 responses. - Added retryAfterMs?: number to BackendError, parsed from the Retry-After header on 429 responses (accepts both integer-seconds and HTTP-date forms; unparseable yields undefined). - assertOk now classifies 429 as 'rate_limited' (not generic 'client') so callers can pattern-match on it. test/unit/rate-limit.test.ts — major restructure: - Each integration test now uses a fresh server + fresh limiter instance via beforeEach/afterEach. Counter state never carries between tests, eliminating the inter-test ordering dependency. - Tightened windowMs from 1000 to 100 in tests; window-rollover test now waits 200ms (2x margin) for the window to expire — eliminates the 1100ms-margin flake under slow CI. - Added "window resets after windowMs" test (proves counter rollover works, replacing the timing-fragile prior shape). - Added "Retry-After header" test (proves the 429 surfaces the spec header so clients can back off — was a coverage gap flagged by api-contract reviewer). - Strengthened the draft-7 header assertion from toBeTruthy to toMatch on the `limit=N, remaining=N, reset=N` format so a future switch to draft-8 won't pass silently. - Replaced the constant-pin assertion (DEFAULT_RATE_LIMIT_RPM = 60) with a behavioral pin: 60 requests pass under the default policy. This pins the contract, not the magic number. - New "production routes — rate-limit middleware wiring" describe block: structural assertions that grep the api.ts source for createRouteLimiter adjacent to each of the 4 protected routes plus the trust-proxy setting. Closes the gap reviewers flagged where a maintainer could drop the limiter from a route and no test would fail. Tests: 143/143 pass server-area (was 136 before this commit; +7 in rate-limit.test.ts, including the production-wiring assertions). Pre-commit bypassed (--no-verify) — same pre-existing TS regression on main from PR #1302; this PR does not touch the affected file. * docs(server): fix misleading SPA-fallback comment + Retry-After test claim PR #1327 production-readiness review surfaced two comment-correctness findings (medium + low). Both are doc-only, no behavioral change. api.ts SPA fallback comment (medium): The previous comment claimed "On 429 we content-negotiate: if the client accepts HTML (browser navigation), serve the SPA shell" — but no content-negotiation is implemented; createRouteLimiter sends a fixed JSON body via the `message` option. The follow-up note below correctly stated content-negotiation was deferred, creating a direct internal contradiction and risking a future maintainer believing the behavior was implemented. Rewrote as a single coherent block: notes that 300 rpm/IP is high enough that browser navigation rarely trips it (the cosmetic JSON-on- 429 path is low-likelihood), and that proper content negotiation is deferred and would require swapping `message` for a `handler` function. No claim of unimplemented behavior remains. rate-limit.test.ts Retry-After comment (low): The previous comment said "Either an integer-seconds form or an HTTP-date — both are spec-valid", but the assertion (`Number.isFinite (Number(retryAfter))`) only accepts integer-seconds: an HTTP-date string would parse as NaN and fail. express-rate-limit v8 emits integer-seconds, so the test passes correctly today, but the comment overstates what's actually validated. Updated comment to say ERL v8 emits integer-seconds and to flag that a future ERL switch to HTTP-date would require an additional branch. Assertion unchanged. 13/13 rate-limit tests still pass; 143/143 server-area unchanged. |
||
|
dependabot[bot]
|
ed4dad2129
|
chore(deps): bump python-dotenv (#1320)
Bumps the uv group with 1 update in the /eval directory: [python-dotenv](https://github.com/theskumar/python-dotenv). Updates `python-dotenv` from 1.0.1 to 1.2.2 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](https://github.com/theskumar/python-dotenv/compare/v1.0.1...v1.2.2) --- updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.2 dependency-type: direct:production dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Gergő Magyar
|
0844973f52
|
fix(server): harden git-clone — close 6 path-injection / CLI-injection / ReDoS alerts (U3) (#1325)
* fix(server): close 6 git-clone path-injection / CLI-injection / ReDoS alerts (U3) U3 of the security remediation plan. Closes the six high-severity CodeQL alerts in gitnexus/src/server/git-clone.ts: #185 js/polynomial-redos (line 16) #176 js/path-injection (line 209) #177 js/path-injection (line 219) #178 js/path-injection (line 230) #166 js/second-order-command-line-injection (line 221) #167 js/second-order-command-line-injection (line 221) Approach (DoD-aligned: smallest correct fix; barriers inline at sinks): extractRepoName — js/polynomial-redos (#185) The previous `url.replace(/\/+$/, '')` regex was flagged for polynomial backtracking on inputs with many trailing slashes. Replaced with an O(n) charCode loop. Also tightened the function's contract: it now throws when the last segment isn't a filesystem-safe name (^[a-zA-Z0-9._-]+$, with `.` and `..` explicitly rejected). This prevents a malicious URL like `https://github.com/owner/repo:..` from yielding a `repoName` that `getCloneDir(repoName)` would resolve outside ~/.gitnexus/repos/. getCloneDir — defense in depth Re-validates repoName against the same safe pattern at the boundary, so callers that don't go through extractRepoName (test helpers, future scripts) still can't construct an escape. cloneOrPull — js/path-injection (#176/#177/#178) Added a containment barrier at function entry using the canonical path.relative idiom CodeQL recognizes: const safeTarget = path.resolve(targetDir); const rel = path.relative(CLONE_ROOT, safeTarget); if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) throw Every downstream filesystem operation uses safeTarget, with no reassignment between barrier and sink. Same idiom as PR #1322's U2. cloneOrPull — js/second-order-command-line-injection (#166/#167) Added the `--` separator to the git clone arg list: runGit(['clone', '--depth', '1', '--', url, safeTarget]) Without it, a URL beginning with `--` (e.g. `--upload-pack=evil ...`) would be parsed by git as an option flag rather than the clone source, enabling arbitrary subprocess execution. Per residual review F2 (ce-doc-review): intentionally did NOT add a host allowlist (`GITNEXUS_ALLOWED_HOSTS=github.com,...`). The existing SSRF protection in validateGitUrl (BLOCKED_HOSTNAMES + private-IP checks) plus the new safe-name and `--` separator address all 6 CodeQL alerts without breaking the CLI's `gitnexus analyze <url>` flow for gitlab/bitbucket/self-hosted users. A host allowlist would be feature work, not security remediation. Tests: - 5 new tests in git-clone.test.ts covering: `..` traversal rejection, `.` rejection, shell-metachar rejection, empty-input rejection, `getCloneDir('..')` / `getCloneDir('foo/bar')` rejection, and a sanity check that 10k trailing slashes resolve in <100ms (the polynomial-ReDoS regression guard). - 82/82 server-area tests pass (was 77). - Existing extractRepoName cases for github/gitlab URLs and SSH form continue to pass — the safe-name pattern accepts them all. Pre-commit bypassed (--no-verify) — same pre-existing TS regression on main from PR #1302; this PR does not touch the affected file. * fix(server): address PR #1325 review — close test gaps + fix delete regression PR #1325 review identified one HIGH and one MEDIUM blocker on the U3 git-clone hardening work. Both addressed below, plus two LOW hygiene items fixed while in the file. [HIGH] cloneOrPull had zero test coverage on the security-critical paths (DoD §2.7 violation: a regression in the path.relative containment barrier or the `--` separator in clone args would not have caused any test to fail). - Extracted buildCloneArgs(url, targetDir) so the `--` separator placement can be unit-tested without mocking child_process.spawn. cloneOrPull now calls runGit(buildCloneArgs(url, safeTarget)). - Added 7 new tests in git-clone.test.ts covering: * buildCloneArgs places `--` before the URL * buildCloneArgs treats `--upload-pack=evil` as a positional argument, not a flag (the exact second-order-CLI-injection mitigation) * buildCloneArgs preserves --depth 1 before the `--` separator * cloneOrPull rejects an absolute target outside CLONE_ROOT * cloneOrPull rejects CLONE_ROOT itself (the rel === '' branch) * cloneOrPull rejects parent-directory traversal * cloneOrPull rejects a sibling directory with a common prefix (CLONE_ROOT-evil) — documents that the path.relative idiom catches what startsWith(root + sep) would have missed. - These tests do not mock spawn — the barrier throws synchronously before git is invoked, so rejections are observable directly. [MEDIUM] Functional regression in api.ts:864 DELETE /api/repo flow. The new strict getCloneDir validation throws for any name outside [a-zA-Z0-9._-], which broke deletion of locally-registered repos with names like 'my project' or 'org/repo' — they returned 500 instead of completing the delete. - Wrapped the getCloneDir(entry.name) call in try/catch since clone-dir cleanup is advisory: local repos legitimately have no clone dir, and the existing inner try/catch already handled the missing-dir case. The throw is caught and treated as 'nothing to clean up'. [LOW] Hygiene fixes flagged by the same review: - git-clone.test.ts:75 — replaced em dash (U+2014) in error message with standard ASCII; switched the manual if/throw to expect().toBeLessThan() so the timing check uses vitest's normal assertion path. - Added a comment at the cloneOrPull barrier documenting that lexical containment is the CodeQL-recognized form and that symlink escape requires pre-existing local write access (out of scope for U3 threat model; tracked for follow-up). Test results: 115/115 server-area tests pass (was 82 before this commit, +33 from earlier in this PR + 7 new in this commit). buildCloneArgs and cloneOrPull boundary failures all surface in vitest now. Pre-commit bypassed (--no-verify) — same pre-existing TS regression on main from PR #1302; this PR does not touch the affected file. * fix(server): close SSRF-bypass + wrong-repo-pull on cloneOrPull (Codex review) Codex's adversarial review on PR #1325 surfaced one HIGH: cloneOrPull's existing-clone branch ran git pull --ff-only with neither validateGitUrl nor a remote-origin match check. Combined with the API's basename-derived target dir (api.ts:1359), this opened two real-world failure modes: 1. SSRF / scheme bypass: cloneOrPull('http://127.0.0.1/myproject.git', existingDir) → pulls the existing remote without ever validating the URL. validateGitUrl only fired on the new-clone branch. 2. Wrong-repo silent analysis: Existing clone → ~/.gitnexus/repos/myproject (origin = github.com/legitorg/myproject) Request URL → gitlab.example/attacker/myproject (same basename) cloneOrPull saw the existing .git/, ran git pull --ff-only against legitorg's remote, and returned an analysis labelled with the attacker's URL. DoD §2.1 (correctness) and §2.5 (security) violations. Fixed by: 1. validateGitUrl(url) is now called unconditionally at the top of cloneOrPull, after the path-containment barrier and before the existence probe. The pull branch can no longer be reached with a URL that hasn't passed SSRF/scheme/private-IP checks. 2. Added assertRemoteMatchesRequestedUrl(targetDir, url): reads the existing clone's remote.origin.url via `git config --get` and compares it (normalized) to the requested URL. Throws on mismatch or missing remote. Called in the existing-clone branch before `git pull`. 3. Added normalizeGitUrlForCompare(url): strips trailing .git and slashes, lowercases hostname, strips default ports and userinfo, so equivalent URL forms compare equal (with/without .git, with/ without trailing slash, https://github.com:443/x vs https://github.com/x). Path comparison stays case-sensitive — Git hosts treat path as case-sensitive on the wire. 4. Added getRemoteOriginUrl(cwd): one-shot spawn that captures the remote URL or returns null (missing remote / not a git repo / spawn error). Caller decides what null means; for cloneOrPull, null on an existing .git/ is a refuse-to-pull condition. Architectural choice: did NOT take Codex's broader "rekey clone dirs by URL hash" recommendation. That changes the persisted naming scheme and affects every existing user's clones (DoD §2.4 contract change, §2.9 reversibility risk). The verify-before-pull approach closes the same vulnerability surface with strictly smaller blast radius (DoD §2.3 smallest correct solution). Tests (15 new, 59 total in git-clone.test.ts; 130/130 across server-area): - cloneOrPull rejects URLs that fail validateGitUrl even when the target shape is valid (the SSRF-bypass closure) - normalizeGitUrlForCompare: 7 tests covering .git stripping, trailing slashes, hostname case, default ports, userinfo, host/path distinction - assertRemoteMatchesRequestedUrl: 5 tests using a tmpdir + git init fixture (anywhere on disk — independent of CLONE_ROOT, no user-state pollution): accepts matching URL, accepts equivalent forms, rejects different host with same basename (the exact wrong-repo vector), rejects different owner, rejects when no remote.origin - getRemoteOriginUrl returns null for non-git directories Pre-commit bypassed (--no-verify) — same pre-existing TS regression on main from PR #1302; this PR does not touch the affected file. |
||
|
Gergő Magyar
|
c08564abc1
|
chore(deps): bump @ladybugdb/core to ^0.16.1 (#1326)
Pick up LadybugDB Node.js 0.16.1 (ANY graph dynamic property scan fix, wasm Windows paths, darwin-x64 npm publish). GitNexus lbug-config already pins 0.16.0 Database ctor semantics; no API changes. Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Copilot
|
16067f882f
|
fix: prevent premature pool resolution in worker split-and-retry path (#1321)
* Initial plan * fix: prevent premature pool resolution in worker split-and-retry path Move `activeWorkers--` from before `await replaceWorker()` to after it. This prevents `maybeDone()` from seeing `activeWorkers === 0` during the async gap when another worker finishes and picks up the split jobs. Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/b65de19d-44ad-4e43-aeb8-4464c8995524 Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> * fix: revert unrelated package-lock change and improve test comment Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/b65de19d-44ad-4e43-aeb8-4464c8995524 Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> * fix: guard replaceWorker() failure path to prevent pool hang Wrap `await replaceWorker()` in try/catch so that if worker thread creation fails, activeWorkers is decremented and fail() is called rather than leaving the count inflated and the pool hanging. Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/6bbcf4f4-106d-4120-9a29-e90b9b34640b Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> * fix: address review findings - prettier format, test timer stability, ASCII comments - Run prettier to fix CI quality/format failure (the try/catch block formatting) - Increase regression test idle timeout from 150ms to 300ms for CI stability - Add explicit 15s per-test timeout to prevent hanging on slow runners - Replace box-drawing U+2500 comment separators with ASCII hyphens Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/66404b55-f6a6-4b0e-9f07-34f0ceaba4be Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> * Apply suggestion from @magyargergo --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> |
||
|
Gergő Magyar
|
95aa10630e
|
fix(server): close js/path-injection cluster — /api/file + docker-server.mjs (U2) (#1322)
* fix(server): close path-injection cluster — sanitizer inline at sink (U2) U2 of the security remediation plan. Closes the four path-injection high alerts in /api/file (#179) and docker-server.mjs (#173/#174/#175 plus their post-refactor renumbers). Architectural approach: every filesystem sink is now immediately preceded by the canonical CodeQL-recognized sanitizer barrier: const rel = path.relative(root, candidate); if (rel.startsWith('..') || path.isAbsolute(rel)) reject; The barrier is inline at each sink — not behind a helper — because CodeQL's js/path-injection sanitizer recognition does not follow user-defined helpers across the request handler in vanilla JS. Earlier iterations of this work used assertSafePath / resolveWithinRoot helpers and a `startsWith(root + sep)` check; both were semantically correct but neither was recognized as a barrier by the analyzer. api.ts /api/file: - assertString on req.query.path (closes the type-confusion side-channel that lets `?path=a&path=b` slip past length-based guards). - Inline path.resolve + path.relative + isAbsolute + startsWith('..') check immediately before fs.readFile. docker-server.mjs: - Removed the resolvePath helper. The handler is now a single inline pipeline: decode → null-byte guard → resolve → barrier #1 → stat → pick finalPath → barrier #2 → stat + readStream. - Each barrier guards every following sink up to the next reassignment, so the analyzer can prove containment without crossing helper boundaries. - Switched all path construction from `join` to `path.resolve` for normalization (CodeQL does not treat `join` as normalizing). assertSafePath remains exported from validation.ts for non-CodeQL-sink callers; it just isn't used at this PR's sinks. Tests: 61/61 server-adjacent pass. Pre-commit bypassed (--no-verify) — pre-existing TS regression on main from PR #1302 (Go scope-resolution at scope-resolution/pipeline/run.ts:160) blocks every PR's pre-commit. Tracked separately; this PR does not touch that file. * fix(server): address PR #1322 review — wire /api/file catch + add route tests PR #1322 review (github-actions / Claude security review) identified two HIGH-severity blocking findings on the U2 path-injection cluster fix: 1. /api/file catch returned 500 for BadRequestError. assertString throws BadRequestError on array-form `?path=a&path=b`, but the catch block at api.ts:1108 only special-cased `err.code === 'ENOENT'` and otherwise returned hardcoded 500. The PR body claimed this was already fixed — it wasn't. Now uses statusFromError, which honors `err instanceof BadRequestError` per the U1 helper. 2. Zero route-level tests for /api/file. The U1 helper tests prove assertString and assertSafePath in isolation but cannot prove the route's error → status mapping, which is exactly where finding #1 lived. Changes: - api.ts /api/file catch: replaced hardcoded 500 with statusFromError(err). BadRequestError → 400 (array form), ForbiddenError → 403 (traversal), unrecognized → 500. ENOENT → 404 path is unchanged. - New gitnexus/test/unit/api-file-route.test.ts: 10 route-level tests that spin up a tiny isolated express app with the /api/file handler and exercise via real HTTP. Covers: - 200 for valid relative path + nested path - 400 for missing/empty path - 400 for ?path=a&path=b (the reproducer for finding #1) - 403 for parent-directory traversal - 403 for percent-encoded traversal (Express decodes before handler) - 403 for absolute escape - 404 for in-root non-existent path - 403 for common-prefix sibling escape (the path.relative idiom catches what startsWith(root + sep) would have missed) - docker-server.test.mjs: added two tests addressing the MEDIUM finding — encoded traversal (%2e%2e%2f) and malformed encoding (%GG). Both confirm the docker-server's inline barrier and the decodeURIComponent try/catch return 400 as expected. Test results: 71/71 pass in vitest (was 61, +10 new). Two pre-existing Windows-only failures in docker-server.test.mjs (asset cache check uses '/', tmpdir EBUSY cleanup race) are unchanged by this PR — confirmed by running the test suite against the merged base before applying this commit. Pre-commit bypassed (--no-verify) — same pre-existing TS regression on main from PR #1302; this PR does not touch the affected file. * refactor(server): extract handleFileRequest, test it directly without app.get CodeQL flagged gitnexus/test/unit/api-file-route.test.ts:81 with js/missing-rate-limiting High because the test mounted the /api/file handler on a real Express app via app.get(...) and bound a port. The query is correct for production route handlers; mounting in a test produces a false positive the analyzer cannot distinguish. The principled fix is structural, not a suppression: 1. Extracted the /api/file handler body into an exported handleFileRequest function in api.ts. The function takes (req, res, repoPath) and is a pure async function — no Express server, no route registration, no port. 2. The production /api/file route in createServer is now a thin caller that resolves the repo entry then delegates to handleFileRequest. 3. The test imports handleFileRequest and invokes it directly with a mock res object that captures status() and json() calls. No app.get, no listen, no port. Same coverage of the security wiring (10 tests covering valid path, missing path, array-form 400, traversal 403, encoded traversal 403, absolute escape 403, missing file 404, common-prefix sibling 403). Faster too — no port allocation per test. Production route behavior is unchanged. The diff is a true refactor: handler logic moved verbatim, just parameterized on repoPath rather than closure-captured from createServer's scope. 71/71 tests pass. This also cleanly separates the "is the route mounted with rate limiting" concern (production createServer wiring, addressed in plan unit U4) from the "does the handler do the right thing" concern (this test file). * style: prettier format api-file-route.test.ts |
||
|
Gergő Magyar
|
fa36254ed5
|
fix(server): close critical type-confusion + add validation helper module (#1317)
* fix(server): close js/type-confusion-through-parameter-tampering at /api/grep The /api/grep handler cast `req.query.pattern` to `string` and then guarded against `pattern.length > 200`. Express returns `string | string[] | ParsedQs` for query parameters; when a caller passes the same key twice (`?pattern=a&pattern=b`), the value arrives as an array and `.length` counts array elements, bypassing the length guard. The array is then coerced to a comma-joined string by `new RegExp(pattern, 'gim')`. Adds gitnexus/src/server/validation.ts with three helpers — assertString, assertSafePath, escapeRegExp — plus a typed BadRequestError/ForbiddenError pair. The helpers throw typed errors that the existing route try/catch blocks translate via statusFromError, which is extended to honor `err.status` for any BadRequestError instance before falling back to message-string matching. Wires assertString into /api/grep (api.ts:1118) and updates the route's catch to use statusFromError so validation rejections return 400 rather than 500. This is U1 of docs/plans/2026-05-04-001-fix-medium-to-critical-security-findings-plan.md — the foundational PR. Closes the single CodeQL critical alert and establishes the validation-helper pattern that U2-U7 reuse. Tests: 18 new unit tests in test/unit/server-validation.test.ts; 35/35 passing across the server-adjacent test files. Pre-commit hook bypassed via --no-verify due to a pre-existing TS regression on main introduced today by PR #1302 (Go scope-resolution) at gitnexus/src/core/ingestion/scope-resolution/pipeline/run.ts:160. That error is unrelated to this PR's changes (verified by re-running tsc against the unmodified base) and blocks every PR's pre-commit until fixed separately. * fix(server): close js/regex-injection at /api/grep — literal substring search by default Pivot /api/grep from "user-controlled regex" to "literal substring search by default, opt-in regex via ?regex=true". Closes the CodeQL js/regex-injection high-severity alert that PR-time CodeQL surfaced on this branch (and that the remediation plan tracks as U5). Audited callers before flipping the default: - gitnexus-web backend-client.grep() passes pattern raw, no flag → gets literal - gitnexus-web LLM tool description: "Search for exact text patterns... error messages, TODOs, variable names" — every documented use case is literal - No other callers in tree Pattern is now escaped via the validation.ts escapeRegExp helper before constructing the RegExp. The 200-char cap and try/catch on RegExp construction remain as defense-in-depth. Callers that genuinely need regex syntax (none exist today) opt in with ?regex=true or ?regex=1. This bundles plan unit U5 into the same PR as U1 because the helper landed here, the alert was surfaced by this PR's own CodeQL run, and the integration is one line at the route. The pre-existing escapeRegExp tests in test/unit/server-validation.test.ts already cover the literal-matching behavior; no new test file needed. 61/61 server-adjacent tests pass. * Potential fix for pull request finding 'CodeQL / Regular expression injection' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> |
||
|
Christian C. Berclaz
|
7be1a5a72d
|
perf(mro): replace O(n³) C3 merge loop with O(n²) head-pointer algorithm (#1316)
* perf(mro): replace O(n³) C3 merge loop with O(n²) head-pointer algorithm The C3 linearization merge loop used Array.shift() (O(n) per call) and Array.indexOf() for tail membership checks (O(n) per scan), producing O(n³) total complexity across deep single-inheritance chains. A 2000-class chain took ~43s, exceeding the 15s test timeout. Replace with: - Uint32Array head pointers (O(1) advance, no array mutation) - Pre-computed tail-count Map (O(1) membership check, decremented on head advance) The deep-chain test now completes in ~2s. Closes #1309 * fix(mro): address review findings for C3 merge optimization - Add test for C3 merge-conflict inconsistency (non-cyclic): classic A(X,Y) + B(Y,X) → C(A,B) incompatible ordering, assert fallback to BFS ancestors - Clarify tailCount decrement comment to state the invariant explicitly - Move deep-chain performance test to dedicated describe('performance') block (was incorrectly nested under 'cyclic inheritance') |
||
|
dependabot[bot]
|
e92328d474
|
chore(deps): bump the uv group across 1 directory with 4 updates (#1315)
--- updated-dependencies: - dependency-name: litellm dependency-version: 1.83.7 dependency-type: direct:production dependency-group: uv - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: uv - dependency-name: aiohttp dependency-version: 3.13.5 dependency-type: indirect dependency-group: uv - dependency-name: requests dependency-version: 2.33.0 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
681af2b956
|
chore(deps)(deps): bump the npm_and_yarn group across 1 directory with 5 updates (#1312)
Bumps the npm_and_yarn group with 5 updates in the /gitnexus-web directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.2` | | [minimatch](https://github.com/isaacs/minimatch) | `10.1.1` | `10.2.5` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [tar](https://github.com/isaacs/node-tar) | `7.5.3` | `7.5.13` | Updates `dompurify` from 3.3.3 to 3.4.2 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](https://github.com/cure53/DOMPurify/compare/3.3.3...3.4.2) Updates `minimatch` from 10.1.1 to 10.2.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](https://github.com/isaacs/minimatch/compare/v10.1.1...v10.2.5) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](https://github.com/isaacs/minimatch/compare/v10.1.1...v10.2.5) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2) Updates `tar` from 7.5.3 to 7.5.13 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-tar/compare/v7.5.3...v7.5.13) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.13 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c3d58c68b9
|
chore(deps)(deps): bump hono from 4.12.9 to 4.12.16 in /gitnexus (#1311)
Bumps [hono](https://github.com/honojs/hono) from 4.12.9 to 4.12.16. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.9...v4.12.16) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.16 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ec54a51822
|
chore(deps)(deps): bump @hono/node-server in /gitnexus (#1310)
Bumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.11 to 1.19.14. - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](https://github.com/honojs/node-server/compare/v1.19.11...v1.19.14) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 1.19.14 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Christian C. Berclaz
|
7cce07b419
|
feat(group): workspace extractors for Node, Python, Go, Java, Elixir (#1260)
* feat(group): auto-discover Node/TS workspace cross-package contracts
Scan package.json dependencies and ES/CJS imports to find PascalCase
type exports crossing workspace package boundaries. Same pipeline as
Rust workspace extractor — emits GroupManifestLink[] with type:custom.
Supports: ES named imports, default imports, CommonJS destructured
require, scoped packages (@org/pkg), subpath imports, aliased imports.
Filters to PascalCase names only (types/classes, not functions).
* feat(group): auto-discover Python workspace cross-package contracts
Scan pyproject.toml/setup.py dependencies and `from <pkg> import`
statements to find PascalCase type exports crossing workspace package
boundaries. Handles hyphenated names (PEP 503 normalization),
submodule imports, aliased imports, and optional-dependencies.
* feat(group): auto-discover Go workspace cross-module contracts
Scan go.mod require/replace directives and Go source files for
exported PascalCase type usage (pkg.TypeName) crossing module
boundaries within a group. Handles block syntax, subpackage
imports, and local replace directives.
* refactor(group): extract workspace discovery orchestrator from sync
Move per-ecosystem workspace extractor calls into a single
discoverWorkspaceLinks() orchestrator. Reduces sync.ts from 295
to 264 lines and gives a clean extension point for adding
more ecosystem extractors.
* feat(group): auto-discover Java/Kotlin workspace cross-project contracts
Scan Maven pom.xml and Gradle build files for inter-project deps,
then match Java/Kotlin import statements against known group-internal
base packages. Supports Maven dependency blocks, Gradle coordinate
and project() dependencies, static imports, and Kotlin files.
* feat(group): auto-discover Elixir workspace cross-app contracts
Scan mix.exs deps and Elixir source files for alias directives and
direct module references crossing OTP app boundaries. Handles
umbrella deps (in_umbrella), git/path deps, grouped aliases
(alias MyApp.{ModA, ModB}), underscore-to-PascalCase app name
mapping, and collapses nested submodules to top-level contracts.
* fix(group): apply PR review fixes to all workspace extractors
Address review findings from PR #1256 across Node, Python, Go, Java,
and Elixir extractors:
- Replace hardcoded IGNORE sets with shared IgnoreService
(shouldIgnorePath + loadIgnoreRules) to honor .gitnexusignore
- Qualify contract names with provider identifier to prevent
contractId collisions across providers
- Warn and skip duplicate project/module/app names
- Update all test assertions for qualified contract format
* fix(workspace): address review findings and fix CI
- Fix prettier formatting on Rust workspace extractor files
- Fix double readRegistry() call in syncGroup (hoist to function scope)
- Fix console.warn spy leak in duplicate crate test (try/finally)
- Add sync-level integration tests: workspace_deps true/false gating,
Rust and Node link discovery through syncGroup orchestrator (3 tests)
* style(workspace): fix Prettier formatting on all workspace extractors
* fix(workspace): strip qualified prefix in custom contract resolution, default workspace_deps to false
resolveSymbol for custom contracts now strips the "provider::" prefix
before querying graph nodes, so workspace-generated contracts like
"mathlex::Expression" correctly resolve to the "Expression" symbol.
Change workspace_deps default from true to false for safe rollout —
existing groups won't silently gain 6-ecosystem scans on upgrade.
* fix(workspace): address medium review findings from PR #1260
- Elixir: strip comment lines before direct module reference scan to
prevent false positives from commented-out module references
- Go: use full module path for contract naming to avoid basename
collisions between repos with identical last path segments
- Sync tests: replace toBeGreaterThanOrEqual with exact toHaveLength
assertions per DoD §2.7
- Add workspace_deps: false to makeConfig helper for type correctness
- Add Elixir test proving comment-only references do not emit links
* fix(workspace): address second-round medium review findings
- Go: add test asserting aliased imports produce 0 links, guarding the
V1 false-negative boundary at the assertion level
- Elixir: add code comment documenting that contracts use full module
names without appName:: prefix and that resolveSymbol resolution
depends on Elixir indexer storing fully-qualified names
* fix(workspace): eliminate regex backtracking in pyproject.toml parser
CodeQL flagged exponential backtracking in the [project] name regex.
Replace [^\[]*?\n (ambiguous lazy quantifier) with [^\n\[]*\n (atomic
per-line match that still stops at section boundaries).
* fix(test): use mkdtempSync for secure temp dir creation
CodeQL flagged insecure temporary file creation (High) in sync.test.ts.
Replace path.join(os.tmpdir(), predictable-name) + mkdirSync with
fs.mkdtempSync which creates temp dirs atomically with random suffix,
preventing symlink race conditions.
|
||
|
Gergő Magyar
|
6ec1f04604
|
chore(quality): exclude test/fixtures from CodeQL, ESLint, and Prettier (#1313)
Test fixtures are intentionally synthetic inputs (broken/unused code, malformed samples) used to exercise the analyzer. Quality-tool findings on them are noise, not real bugs — they were drowning out actionable signal in the GitHub Security tab. - CodeQL: add `**/test/fixtures/**` to paths-ignore in codeql.yml - ESLint: add `gitnexus-web/test/fixtures/**` to global ignores (the gitnexus/ counterpart was already ignored) - Prettier: add `gitnexus-web/test/fixtures/` to .prettierignore (same gap as ESLint) Real test files (*.test.ts) remain in scope so genuine issues like js/file-system-race and js/insecure-temporary-file in test code still surface. |
||
|
Copilot
|
1272774ec2
|
fix(setup): prefer .cmd/.bat wrapper from Windows where output (#1299)
* Initial plan * fix(setup): prefer .cmd wrapper from Windows `where` output On Windows, `where gitnexus` returns multiple entries including the POSIX shell script and the .cmd wrapper. The code previously took the first line (shell script), which cannot be spawned directly by Node.js child_process on Windows. Now we prefer the .cmd entry when available. Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/e6b54037-87fb-4195-b157-4cfcafce5f5d Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> * fix(setup): also handle .bat wrappers and add fallback test Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/e6b54037-87fb-4195-b157-4cfcafce5f5d Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> * revert package-lock.json and add CRLF/.bat/.CMD test variants - Revert package-lock.json to match base (no dependency changes needed) - Add CRLF line ending test (Windows `where` produces \r\n) - Add .bat wrapper test - Add uppercase .CMD extension test (case-insensitive regex) Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/7ed71368-b3e8-44de-9f13-85af4effaf25 Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> * chore: format code --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> Co-authored-by: Gergo Magyar <gergomagyar@icloud.com> |
||
|
Gergő Magyar
|
342721f06d
|
ci(security): add automated security and vulnerability scans (#1297)
* ci(security): add CodeQL SAST workflow for JS/TS and Python
CodeQL analyzes both languages on PR, main push, and weekly schedule.
Findings upload to the Security tab as SARIF. Advisory only on
introduction; promote to required check after baseline triage.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U1)
* ci(security): add Dependency Review PR gate
Blocks PRs introducing high+ severity dependency vulnerabilities.
Posts inline summary comment on failure. Required-check candidate
after one week of clean runs.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U2)
* ci(security): add Gitleaks secret scanning
PR runs scan the diff; main pushes scan full history.
Defense-in-depth on top of GitHub native push protection
(documented as a recommended Settings toggle in SECURITY.md).
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U3)
* ci(security): add OpenSSF Scorecard workflow
Weekly + on main push. SARIF uploads to Security tab; public
badge URL resolves after first scheduled run lands.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U4)
* ci(security): add zizmor workflow lint
Lints .github/workflows/** for known Actions security misconfigurations
(unpinned actions, dangerous interpolation, missing permissions).
Triggered only on PRs touching .github/**.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U5)
* ci(security): add Trivy container image scanning
Builds Dockerfile.cli and Dockerfile.web, then scans images for
HIGH/CRITICAL CVEs. Findings record-only on Security tab; not
PR-blocking. Weekly schedule + main push for freshness.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U6)
* docs(security): add SECURITY.md policy and Scorecard badge
Vulnerability disclosure policy points to GitHub Private Vulnerability
Reporting. Documents in-CI scans landed in this branch and recommended
admin actions for forks.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U7)
* fix(review): apply autofix feedback
- CodeQL paths-ignore: replace brace expansion (parser.{c,js}) with two
explicit entries — CodeQL uses .gitignore-style globs that do NOT support
brace expansion, so the original pattern matched no files.
- Trivy: pin aquasecurity/trivy-action from @master to @0.28.0 — mutable
refs are a supply-chain risk and are exactly what zizmor (added in this
same plan) is meant to flag.
ce-code-review run: /tmp/compound-engineering/ce-code-review/20260503-104259-279c3bc4/
* docs(review): record residual review findings
ce-code-review autofix run flagged three downstream-resolver items
that are not blockers but should land before promoting any of the new
security workflows to required PR checks.
Source: /tmp/compound-engineering/ce-code-review/20260503-104259-279c3bc4/
* fix(ci-security): address all zizmor + dependency-review violations
Resolves all GitHub Advanced Security findings on PR #1297:
- Add 'persist-credentials: false' to actions/checkout in 5 workflows
(codeql, dependency-review, gitleaks, trivy, workflow-lint). Prevents
the GITHUB_TOKEN from persisting in .git/config for downstream steps
to read. Scorecard already had it.
- Pin every net-new third-party Action to a commit SHA (was: major-tag
refs flagged by zizmor as 'unpinned action reference'):
github/codeql-action -> v3.35.3 (0daab03)
actions/dependency-review-action -> v4.9.0 (2031cfc)
gitleaks/gitleaks-action -> v2.3.9 (ff98106)
ossf/scorecard-action -> v2.4.3 (4eaacf0)
docker/build-push-action -> v6.19.2 (10e90e3)
- Bump aquasecurity/trivy-action 0.28.0 -> 0.36.0 (ed142fd). Versions
< 0.35.0 are flagged by GHSA-69fq-xp46-6x23 (briefly compromised
supply chain). Caught by Dependency Review on the introducing PR.
- Pin pipx-installed zizmor to 1.24.1 (was unpinned 'pipx install
zizmor' resolving to latest at run time).
Removes the now-stale residual-findings doc since every item it
recorded is resolved on this branch.
* fix(ci-security): clear remaining zizmor findings
After landing the new security workflows, zizmor reported 5 high+
findings against pre-existing workflows (none introduced by this PR's
new files, all introduced by zizmor's wider scope). Resolved per
research at docs.zizmor.sh and PyO3/maturin issue #2425:
Real fixes (cache-poisoning):
- publish.yml + release-candidate.yml: add 'package-manager-cache:
false' to actions/setup-node. setup-node v5+ enables caching by
default when a packageManager field is present in package.json;
explicit opt-out keeps release installs hermetic and clears the
audit. Cost: ~30s slower per release run.
Documented exemptions (dangerous-triggers, .github/zizmor.yml):
- ci-report.yml: workflow_run is REQUIRED to post sticky comments
on fork PRs (forks have read-only GITHUB_TOKEN on pull_request).
- claude.yml: pull_request_target is required by claude-code-action
to access secrets and post fork-PR review comments. PR checkouts
pin fork HEAD SHA to mitigate TOCTOU.
- pr-labeler.yml: pull_request_target on the autolabel job needs
pull-requests:write. release-drafter runs with dry-run:true and
reads config from the BASE ref only.
Each exemption carries the documented mitigation in zizmor.yml.
workflow-lint.yml now passes --config to both the SARIF and the
gate invocations.
Local 'zizmor --config .github/zizmor.yml --min-severity high .'
reports: No findings to report. Good job!
|
||
|
@aaronjmars
|
95814847bd
|
fix(security): block IPv4-compatible IPv6 and NAT64 SSRF bypasses in validateGitUrl (#1148)
* fix(security): block IPv4-compatible IPv6 and NAT64 SSRF bypasses Vulnerability: SSRF via IPv6 forms that embed IPv4 addresses Severity: high Location: gitnexus/src/server/git-clone.ts:assertNotPrivateIPv6 validateGitUrl() blocks ::ffff:x.x.x.x (IPv4-mapped) but two related forms still slipped through — both routable to the embedded IPv4 on common stacks: 1. IPv4-compatible IPv6 (RFC 4291 § 2.5.5.1, deprecated): http://[::127.0.0.1]/ — Node's URL parser collapses this to "::7f00:1" with no ::ffff: marker, so the existing check missed it. 2. NAT64 well-known prefix (RFC 6052: 64:ff9b::/96, plus RFC 8215's 64:ff9b:1::/48 local prefix): a host with NAT64 enabled translates 64:ff9b::7f00:1 to 127.0.0.1, reaching loopback. Impact: an attacker who can submit a clone URL to /api/analyze (any caller in the CORS-allowlisted origin set — localhost, RFC 1918 LAN, or gitnexus.vercel.app) could direct git clone at loopback or cloud metadata addresses (169.254.169.254 → ::a9fe:a9fe, 64:ff9b::a9fe:a9fe). Fix: extend assertNotPrivateIPv6 to reject any address compressed to ::xxxx[:yyyy] and any address starting with the NAT64 prefix 64:ff9b:. Tests added for both forms plus the cloud-metadata variants. * fix(security): block 6to4 SSRF bypass and add expanded-form regression tests Address review findings on PR #1148: - Block 6to4 (2002::/16, RFC 3056). The prefix encodes an IPv4 address in bits 17-48, so 2002:7f00:0001::* routes to 127.0.0.1 on 6to4-capable stacks. RFC 7526 deprecated the protocol and the public relay anycast has been retired, so broad-blocking has near-zero false-positive cost. - Expand the NAT64 comment to justify the broader-than-CIDR check: the whole 64:ff9b::/32 block is IANA-reserved for IPv4-IPv6 translation, so a future narrower CIDR refactor would silently re-open the bypass for 64:ff9b:1::/48 or any new translation range. - Add tests for expanded / zero-padded IPv4-compatible IPv6 forms ([0:0:0:0:0:0:7f00:1], fully zero-padded, mixed [0:...:127.0.0.1]). These pin the assumption that the WHATWG URL parser collapses these inputs to ::xxxx[:yyyy]; without them, a future Node anomaly would silently regress the bypass. - Add public IPv6 positive tests (Cloudflare 2606:4700::, Google 2001:4860::). Regression guard against over-blocking. - Add NAT64 + RFC1918 embedded-IP tests (10/8, 172.16/12, 192.168/16) to document SSRF coverage explicitly rather than relying on the prefix check. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * style: apply prettier formatting to git-clone.test.ts --------- Co-authored-by: aeonframework <aeon@aaronjmars.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Gergo Magyar <gergomagyar@icloud.com> |
||
|
evolution
|
d14d6602d5
|
feat(go): implement scope resolution hooks for Go language support (#1302) |