* feat(cli): add `gitnexus publish` for opt-in understand-quickly registry
Adds a small, opt-in command that fires a single `repository_dispatch`
event at `looptech-ai/understand-quickly` to ask the registry for an
instant resync of the current repo's entry. No graph file is uploaded;
the registry pulls from raw.githubusercontent.com per the protocol at
https://github.com/looptech-ai/understand-quickly/blob/main/docs/integrations/protocol.md.
- Pure helpers (id parsing, payload construction, validation) live in
`gitnexus-shared/src/integrations/understand-quickly.ts` so the
package stays Node-free and the same logic is testable in isolation.
- The CLI command lives in `gitnexus/src/cli/publish.ts`. Without
`UNDERSTAND_QUICKLY_TOKEN` it is a no-op (exits 0 with one
informational line); with the token it POSTs the dispatch and
surfaces 204 / 401 / 404 / 5xx distinctly.
- The id defaults to `<owner>/<repo>` parsed from the `origin` remote
and can be overridden with `--id`.
- Refuses to publish when no `.gitnexus/` index exists, with a
`gitnexus analyze` hint.
Tests: a new vitest unit covers the pure helpers (8 + 8 + 2 cases) and
the no-token no-op path with a `fetch` spy that fails the test if the
network is touched. README gets a one-paragraph "Publishing to
understand-quickly" section near the existing CLI docs.
* fix(uq-publish): address review blockers + high-severity items
Addresses CodeQL polynomial-regex (HIGH), token-gate ordering, distinct
401/403/404/422 response branches, fetch timeout, expanded test coverage,
tightened owner/repo validation, and non-GitHub remote rejection.
See response thread on PR #1425 for the per-finding rationale.
Signed-off-by: amacsmith <alex.mac@looptech.ai>
* fix(publish): address Claude review on PR #1425
- AbortError → TimeoutError: AbortSignal.timeout() throws a
DOMException with name 'TimeoutError', not Error{name:'AbortError'}.
Match the pattern used in core/embeddings/http-client.ts so the
user-facing "timed out after 15000ms" message actually fires. Update
the regression test to throw a real DOMException — the previous fake
was a false-green.
- isValidOwnerRepo: forbid trailing hyphen in the owner segment.
GitHub rejects this at account-creation time; allowing it here meant
hand-typed --id values like 'my-org-/repo' would pass our regex and
422 from GitHub.
- Add publish-command coverage to cli-index-help.test.ts (asserts on
--id, --skip-git, the registry name, and the token env var) and
cli-commands.test.ts (asserts publishCommand is exported as a
function). Catches accidental command-registration deletion.
---------
Signed-off-by: amacsmith <alex.mac@looptech.ai>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
- Cache detectCursorCLI() result to avoid spawning `agent --version`
on every LLM call
- Fix stale JSDoc in cursor-client.ts (no longer uses stdin or
stream-json)
- Remove unused WikiOptions fields (model, baseUrl, apiKey) that were
passed but never read by WikiGenerator
- Fix inconsistent progress callback phase tracking in --review
continuation path
- Add wiki CLI help test covering --provider, --review, --verbose flags
Made-with: Cursor
* Fix MCP startup transport compatibility
* Preserve CLI flags in MCP startup fix
* Harden MCP transport error handling
* Harden transport security and improve type safety
Transport hardening:
- Add MAX_BUFFER_SIZE (10 MB) cap to prevent OOM from oversized
Content-Length or unbounded newline-delimited input
- Replace recursive readNewlineMessage with iterative loop to prevent
stack overflow from consecutive empty lines
- Tighten looksLikeContentLength to require 14+ bytes before matching
- Add closed-state guard and error handling to send()
- Simplify processReadBuffer loop to break on error
- Fix loose equality (==) to strict (===)
- Widen constructor param types to ReadableStream/WritableStream
Type safety:
- Constrain createLazyAction generics so export name is validated
against the module's actual exports at compile time
- Use proper type guard instead of lint suppression
- Fix test tsconfig type errors
Regression tests for all hardening fixes (13 tests passing).
---------
Co-authored-by: Gergo Magyar <gergomagyar@icloud.com>
