Gergo Magyar
b53429e901
fix(scan): canonicalize traversal without order-sensitive bindings ( #2482 )
2026-07-16 08:31:46 +00:00
Gergo Magyar
d1a4889550
feat(eval): require bearer auth for remote binding ( #2458 )
...
Non-loopback eval-server binds now require GITNEXUS_AUTH_TOKEN with an
exact Bearer header compared in constant time. Review fixes: loopback
binds defer unreadable env file errors to a warning, and help text
notes IPv4 hostname resolution.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-16 08:28:30 +00:00
Gergo Magyar
277dfbbec7
fix(eval): defer env file read errors to binds that need a token
...
Loopback binds now warn and start when .env or .env.local exists but
cannot be read; non-loopback binds keep the fail-closed error. Help
text notes that hostnames resolve to IPv4.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-16 08:25:52 +00:00
Copilot
6496c55564
fix(mcp): context resource reads stale lastCommit/stats after out-of-process analyze ( #2438 ) ( #2439 )
...
* Initial plan
* fix(mcp): read fresh metadata from disk in context resource to fix stale staleness banner and stats (#2438 )
The context resource (gitnexus://repo/{name}/context) was serving stale
lastCommit and stats after an out-of-process `analyze --index-only` refresh.
The LocalBackend's in-memory RepoHandle is cached and only refreshes on
registry misses — never on a disk update from an external process.
Fix: read fresh metadata via loadMeta(repo.storagePath) on every context
resource read, mirroring the ensureInitialized hot-swap pattern. Use the
fresh lastCommit for the staleness check and fresh stats for the stats
block; fall back to cached values when the disk read fails.
Tests:
- 5 new unit tests in resources.test.ts covering fresh meta, fallback behavior
- 3 new integration tests in context-resource-staleness.test.ts covering
the exact reproduce sequence from the issue report
* fix(test): use @ladybugdb/core mock to prevent native addon load in integration test
The context-resource-staleness integration test used importOriginal() in
the vi.mock factories for pool-adapter.js and mcp/core/lbug-adapter.js.
That caused the real pool-adapter.ts to load @ladybugdb/core, which
tries to dlopen lbugjs.node — a native addon that requires postinstall
(not run with --ignore-scripts in CI).
Fix:
- Add a vi.mock('@ladybugdb/core') at the package boundary, matching the
pattern in lbug-pool-fts-load.test.ts and pool-wal-recovery.test.ts.
- Replace the two importOriginal()-based lbug mocks with direct factories
that provide all necessary exports (initLbug, executeQuery,
executeParameterized, closeLbug, isLbugReady) without loading the real
module.
All 3 integration tests now pass in CI (no lbugjs.node required).
* test(integration): run context staleness flow end-to-end without mocks
* Address PR review feedback (#2439 )
- Restore libc selectors for optional native packages
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
2026-07-16 09:20:18 +01:00
ArgonarioD
2c5b390d96
Merge remote-tracking branch 'upstream/main'
...
# Conflicts:
# gitnexus/src/cli/ai-context.ts
# gitnexus/src/cli/skill-gen.ts
2026-07-16 15:47:14 +08:00
dependabot[bot]
c2dc9c1191
chore(deps)(deps-dev): bump vite from 8.1.3 to 8.1.4 in /gitnexus-web ( #2497 )
...
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ) from 8.1.3 to 8.1.4.
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite )
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.1.4
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
2026-07-16 07:43:52 +01:00
dependabot[bot]
40f7502370
chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 ( #2500 )
...
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](d7f5e7f509...bb05f3f551
2026-07-16 07:03:41 +01:00
dependabot[bot]
7edf6236b5
chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 ( #2507 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](650006c6eb...af1e73f918
2026-07-16 07:03:18 +01:00
dependabot[bot]
76c61bed49
chore(deps): bump dorny/paths-filter from 4.0.1 to 4.0.2 ( #2505 )
...
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter ) from 4.0.1 to 4.0.2.
- [Release notes](https://github.com/dorny/paths-filter/releases )
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md )
- [Commits](fbd0ab8f3e...7b450fff21
2026-07-16 07:02:56 +01:00
dependabot[bot]
796f1e5874
chore(deps)(deps): bump lucide-react in /gitnexus-web ( #2503 )
...
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react ) from 1.21.0 to 1.23.0.
- [Release notes](https://github.com/lucide-icons/lucide/releases )
- [Commits](https://github.com/lucide-icons/lucide/commits/1.23.0/packages/lucide-react )
---
updated-dependencies:
- dependency-name: lucide-react
dependency-version: 1.23.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 07:02:38 +01:00
dependabot[bot]
ad7dae243a
chore(deps)(deps-dev): bump @vitejs/plugin-react in /gitnexus-web ( #2498 )
...
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react ) from 5.2.0 to 6.0.2.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases )
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.2/packages/plugin-react )
---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
dependency-version: 6.0.2
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 07:01:38 +01:00
EVA
24d8d1ea38
docs: build shared package before CLI setup ( #2448 )
...
Co-authored-by: Eva <eva@100yen.org>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
2026-07-16 07:00:21 +01:00
Eva
b37dcef771
test(communities): rebaseline canonical projection
2026-07-16 10:19:12 +07:00
Gergő Magyar
898e2a8321
Merge branch 'main' into upstream/eval-server-auth
2026-07-16 08:10:19 +05:00
bong-water-water-bong
226ec6cf99
chore(deps): npm audit fix — resolve @babel/core and brace-expansion advisories ( #2444 )
2026-07-16 08:09:39 +05:00
Eva
8a29f3c3ce
chore(security): suppress deleted auth placeholder
2026-07-16 10:08:59 +07:00
Eva
d4576630eb
fix(mcp): ignore undefined alias inputs
2026-07-16 10:07:06 +07:00
Eva
846b545680
fix(php): index import declaration directories
2026-07-16 09:58:33 +07:00
Eva
711a13c077
Merge remote-tracking branch 'upstream/main' into review/pr-2482
2026-07-16 09:54:37 +07:00
Eva
ff385a5472
Merge remote-tracking branch 'upstream/main' into upstream/community-order-2477
2026-07-16 09:51:57 +07:00
Eva
a6441b345c
Merge remote-tracking branch 'upstream/main' into upstream/parsedfile-generation-2475
2026-07-16 09:50:36 +07:00
Eva
5d1911b2ef
Merge remote-tracking branch 'upstream/main' into upstream/cypher-error-exit-2469
2026-07-16 09:49:16 +07:00
Eva
1821b01dbe
fix(embeddings): bind resume checkpoints to provider
2026-07-16 09:48:03 +07:00
Eva
a117cf8a21
Merge remote-tracking branch 'upstream/main' into upstream/embedding-http-resilience
2026-07-16 09:44:17 +07:00
Eva
6eb82713f4
Merge remote-tracking branch 'upstream/main' into upstream/file-node-embedding-fallback
2026-07-16 09:40:29 +07:00
Eva
575dc6810a
fix(mcp): validate repository policy before embedded serving
2026-07-16 09:39:06 +07:00
Eva
e0a83f098a
Merge remote-tracking branch 'upstream/main' into upstream/mcp-repository-policy
2026-07-16 09:36:31 +07:00
Eva
d4eb7560ac
fix(mcp): close read-only resource routing bypass
2026-07-16 09:34:34 +07:00
Eva
f94826157a
Merge remote-tracking branch 'upstream/main' into upstream/mcp-read-only-policy
2026-07-16 09:30:59 +07:00
Eva
3f3494fd32
fix(mcp): validate aliases without schema combinators
2026-07-16 09:29:47 +07:00
Eva
14375ebf29
Merge remote-tracking branch 'upstream/main' into upstream/mcp-parameter-aliases
2026-07-16 09:27:32 +07:00
Eva
0506f91eb9
docs(mcp): explain response budget guardrails
2026-07-16 09:26:19 +07:00
Eva
730edb5c2c
Merge remote-tracking branch 'upstream/main' into upstream/mcp-output-budget
2026-07-16 09:23:52 +07:00
Eva
1f7036dbb0
fix(ingestion): canonicalize parse node insertion
2026-07-16 09:21:38 +07:00
Eva
ed3f58d292
Merge remote-tracking branch 'upstream/main' into review/pr-2480
2026-07-16 09:17:40 +07:00
Eva
9741c48879
docs(eval): avoid secret-scanner auth fixture
2026-07-16 09:15:08 +07:00
Eva
c9fdab17f2
fix(eval): address auth configuration feedback
2026-07-16 09:13:34 +07:00
Eva
8682c8a56e
Merge remote-tracking branch 'upstream/main' into upstream/eval-server-auth
2026-07-16 09:06:59 +07:00
Gergő Magyar
a05b501102
fix(cli): make Claude skills discoverable ( #2434 )
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Publish / Classify release event (push) Waiting to run
Publish / RC guard (marker + release-PR skip) (push) Blocked by required conditions
Publish / ci (push) Blocked by required conditions
Publish / Publish to npm (push) Blocked by required conditions
Publish / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
2026-07-15 20:40:20 +05:00
Eva
e3136f593f
ci: update setup composites to setup-node v6 ( #2451 )
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Publish / Classify release event (push) Waiting to run
Publish / RC guard (marker + release-PR skip) (push) Blocked by required conditions
Publish / ci (push) Blocked by required conditions
Publish / Publish to npm (push) Blocked by required conditions
Publish / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
2026-07-14 17:11:26 +01:00
Gergő Magyar
8548f0f17f
Merge branch 'main' into upstream/node-lookup-2479
2026-07-14 12:56:11 +01:00
dependabot[bot]
9cc364713a
chore(deps)(deps): bump @ladybugdb/core in /gitnexus ( #2473 )
2026-07-14 12:55:43 +01:00
ArgonarioD
c7a9b7efc2
feat(cli): mirror skills to .agents/skills/ when .agents/ exists
...
Some agents prefer repo-local .agents/skills/ over the global install. When
.agents/ is present, mirror the standard and generated skills written to
.claude/skills/ so those agents serve up-to-date copies. Opt-in via .agents/;
absent directory leaves the layout untouched.
Co-Authored-By: Claude <noreply@anthropic.com>
2026-07-14 16:14:30 +08:00
Eva
34955b57f6
fix(php): resolve symbol-named PSR-4 imports
2026-07-14 13:12:33 +07:00
Eva
99312dfff2
test(bench): rebaseline PHP import capture shape
2026-07-14 12:51:47 +07:00
Eva
5407747c67
fix(php): resolve function imports by declaring file
2026-07-14 12:46:59 +07:00
Eva
f0f316a7b2
fix(scan): canonicalize traversal without order-sensitive Rust binding
2026-07-14 12:21:40 +07:00
dependabot[bot]
1482c0bc89
chore(deps)(deps): bump ignore from 7.0.5 to 7.0.6 in /gitnexus ( #2474 )
2026-07-14 04:51:37 +01:00
dependabot[bot]
f6c63f6c4e
chore(deps)(deps-dev): bump @types/node in /gitnexus ( #2472 )
2026-07-14 03:05:20 +01:00
Eva
031a160090
fix(scope): stabilize graph lookup collisions
2026-07-14 04:02:22 +07:00
