1442 commits

Author	SHA1	Message	Date
Felipe	c2ca132620	fix: web citation/code panel bugs and serve analyze/route hardening (#3348) ... * chore: ignore local Vercel link artifacts Keep .vercel and env files out of the repo after a local preview link. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): repair citation chips, code panel line math, stale agent state Audit findings in the web client, each verified against the source: - RightPanel: citation chips ([[path:10-20]], [[Class:Foo]]) were wired to a stub resolver that always returned null, so clicking any citation did nothing. Expose resolveFilePath from useAppState and use it. - CodeReferencesPanel: graph startLine/endLine are 1-based but were treated as 0-based, so the highlighted range and scroll target were off by one line; AI citation cards always rendered "code not available" because the snippet loader was a stub. Fetch per-citation snippets via /api/file. - useAppState: sendChatMessage read llmSettings.activeProvider outside its deps (stale provider capabilities after switching provider); initializeAgent trapped projectName at '' for callers without an override (system prompt labelled the codebase "project"); the embeddings 409 dedup matched a message the server never sends for same-repo jobs. - tools.ts impact: for path targets every symbol defined in the file shares the filePath, so the disambiguation always picked the first row and could analyze an arbitrary symbol while reporting a file impact. Prefer the File node. - useSigma: the layout timeout called stop() but never kill(), leaking one ForceAtlas2 Web Worker plus four graph listeners per completed layout. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): release repo lock on cancel, IPC-first worker cancel, route hardening Audit findings in gitnexus/src, each verified against the source: - analyze-launch: cancelJob marks the job failed before the worker exits, so the exit handler's terminal early-return skipped releaseLockOnce and the repo stayed locked ("Another job is already active") until restart. Release on terminal exit and when forkWorker bails on a terminal job. - analyze-job: cancellation now sends { type: 'cancel' } over IPC first and signals only after a 15s grace. On Windows child.kill('SIGTERM') is a forceful termination, so leading with it could kill the worker inside a LadybugDB write. Mirrors core/auto-sync/analysis-worker-launch. - api resolveRepo: a job that FAILED during the hold-queue wait fell through to the { __timedOut } sentinel ("taking longer than expected") instead of 404; only /api/repo checked the sentinel, so graph/query/search/file/grep/ embed/delete crashed on entry.storagePath with a 500 after a 5 minute hang. Return null on failed jobs and check the sentinel in every consumer. - api processes/process/clusters/cluster: resolve ?repo= through the HTTP resolver (documented policy on resolveRegisteredRepoEntry) and pass the registered absolute path to the backend; add the standard rate limiter. The raw param previously reached the MCP resolver, which runs a cwd-relative realpathSync probe + registry refresh on a bare-name miss and accepts unambiguous partial names. - api body handling: Express 5 leaves req.body undefined without a JSON content type, turning "Missing X" 400s into TypeError 500s; body-parser 4xx errors (malformed JSON, over-limit) were also reported as 500. - /api/file: the lexical path.relative check cannot see symlinks; re-check containment on realpath so a cloned repo containing evil -> /etc/passwd cannot read outside the root. - repo-manager unregisterRepo: used the lenient reader, so a transient read error (EBUSY/EPERM racing another process's atomic rename) turned into writing [] and deregistering every repo. Use the strict-if-present reader. - clean --branch: compared registry paths with raw path.resolve instead of the canonical registryPathEquals used everywhere else (macOS /private/var, Windows short names / drive-letter case) and reported indexed branches as not indexed. Tests: cancelJob IPC-before-signal contract; /api/file symlink escape (403) and in-repo symlink (200), skipped where the host cannot create symlinks. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: keep example env files visible and ignore local Cursor config .env* also hid gitnexus/.env.example and eval/.env.example. .vercel was already ignored. The web app's .cursor/ stays local, including its MCP file. Co-authored-by: Cursor <cursoragent@cursor.com> * Add realtime execution ops dashboard for Vercel monitoring. Expose /api/ops snapshots over the local serve process and a ?view=ops SPA panel so analyze/embed jobs can be watched live from the hosted web UI. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: address gitnexus-check review on cite/embed/resolve paths Pass req into resolveRepo for process/cluster routes, tighten same-repo embed 409 handling, guard empty citation paths, fix snippet retry races, and drop the lone-File ambiguity fallback. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ops): harden CORS, redact paths, and bound ops streams Restrict Vercel CORS to exact production hosts, omit raw repo paths/URLs from the unauthenticated ops feed, rate-limit and cap SSE connections, and fix dashboard SSE/poll edge cases. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): stabilize citation fetches and file impact matching Retry cancelled snippet loads without duplicate in-flight reads, cap range-less citation downloads, and make impact file matching unique-suffix-aware with a synthetic File target when LIMIT drops the File node. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web/ops): close gitnexus-check review threads on SSE and redaction Cap citation reads, reconnect ops on applied server URL, skip SSE onError after abort, and strip URL query/fragment from public repoName. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ops): abort SSE on poll fallback and harden repoName parsing Prevent dual SSE+poll after a failed safety snapshot, skip overlapping poll ticks, ignore aborted streamSSE onError, and basename Windows drive-letter URLs so ops never leaks path segments. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ops/web): close gitnexus-check threads on SSE budget and credential leak Keep finite SSE retries across short 200s, strip backend URL userinfo before ?server=, and redact progress messages on the public ops feed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) Restore 0-based GraphNode line math, redact public job poll/error fields, fix omit-?repo= 400, hold the analyze lock across cancel-during-settle, and restore the Vercel shared compile. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): contain leftover-slot reclaim to the slot and keep --stale status honest Preview and force now share one branches/ containment rule, nested junctions cannot walk a sibling index, and a mid-loop git failure no longer claims leftovers were not deleted after a successful rm. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(cli): share leftover-slot helpers without changing reclaim behavior Pull the rolling I/O pool and owned-cwd storage lookup into one place so clean --stale/--branch and leftover listing stop restating the same ownership and concurrency paths. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3348) Keep the omitted-repo snapshot instead of re-listing, stop citation and ops races, redact full public repo URLs, and restore fake timers in teardown. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3348) Store graph node citation lines as 0-based offsets and correct the default-port origin comment. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3348) Redact public SSE progress text, stop citation append retries from cancelling in-flight reads, and keep the ops dashboard from showing a stale snapshot or clearing a failed Connect. Note: pre-existing failure in incremental-index-extension-dml-gate and other lbug/env unit tests not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3348) Prune citation snippets when AI refs are cleared, and poll /api/ops at 2s so the fallback stays under the 60/min limit. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): apply prettier class order for format check (#3348) CI quality/format runs root-only npm ci, so prettier-plugin-tailwindcss sorts scrollbar-thin without the web Tailwind catalog. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) - Require a unique suffix match for graph-backed citation paths so ambiguous names like index.ts no longer open the first graph file. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) - Require a path-component boundary so unique citation suffixes cannot match filename substrings like myindex.ts Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): redact filesystem paths in ops text Unauthenticated /api/ops and poll replay worker errors. URLs were scrubbed but home-directory and Windows paths still leaked. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): omit repoPath from public SSE frames /api/ops lists job ids, so the unauthenticated progress stream must not replay the analyzed filesystem path. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): treat embed lock 409 as a busy error Analyze and embed share the same lock string. Mapping that 409 to embedding hid an in-flight analyze as a successful embed start. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): bound impact File path suffix matches Unbounded endsWith let lib/foo.ts select src/mylib/foo.ts. Require an exact path or a unique /suffix, matching resolveUniqueIndexedPath. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): keep canceled analyze slot until exit Marking failed before the worker exited let a second POST start cloneOrPull against a LadybugDB file still being written. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): skip Windows SIGTERM on job dispose child.kill('SIGTERM') is TerminateProcess there. Ask over IPC first and leave the 15s grace timer to SIGKILL. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): let process routes skip the analyze hold GET /api/processes and /api/clusters always waited up to 300s. ?awaitAnalysis=false fails fast; default still waits like /api/repo. Co-authored-by: Cursor <cursoragent@cursor.com> * test(web): cover public ops and analyze SSE user flows Lock the unauthenticated dashboard and analyze complete/fail/cancel paths so a leaked repoPath, token, or home path cannot ship unnoticed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) Keep caller cancel reasons over the worker's generic IPC, skip publish while cancel is pending, and redact scp-style remotes on the public ops feed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3348) Release the analyze slot when a worker fails to spawn, and omit branch refs from the unauthenticated ops feed. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): do not reuse an analyze job that is pending cancel A dying same-repo job still occupies the single slot; 202-reuse would attach a new client to a cancel in flight. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): hold the analyze lock until the worker exits after cancel Cancel error IPC used to drop the repo lock while the child was still checkpointing. Abort settle immediately on pending cancel so the slot is not held for a 60s disk poll. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): redact known repo paths with spaces in public ops text Known repoPath/repoUrl literals are replaced first so a clone dir with spaces cannot leak past the whitespace-bounded path regex. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(server): return the live job on analyze and embed DELETE Hard-coding failed made clients retry immediately and 409 while the child still occupied the slot. resolveRepo now returns not-found as soon as that job fails instead of waiting out the hold timeout. Co-authored-by: Cursor <cursoragent@cursor.com> * test(web): drive public analyze and ops through a live gitnexus serve Spawn the real backend and observe requests instead of intercepting them, so slot occupancy, redaction, and reconnect stay honest. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(web): reuse code-panel helpers and drop dead UI aliases Citation fetches already had selectedNodeFileRange and snippetRepoKey; the impact File suffix filter already handled exact paths. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3348) - Skip createJob reuse after cancel IPC is consumed while the child remains - Hold the repo lock until exit when complete IPC races a pending cancel - Scrub full remote URLs before known repoUrl prefixes in public ops text - Reject unique impact File suffix matches from a truncated LIMIT 10 page - Make live e2e helpers bound probes, clean up failed startups, and wait out the cancel slot Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): open live e2e pages on the Vite host CI actually bound Absolute 127.0.0.1:5173 navigation refused on Actions because wait-on and Vite use localhost (often ::1). Honor FRONTEND_URL when set, else pick the first of localhost / 127.0.0.1 that answers. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3348) Hold the analyze lock until worker exit when cancel aborts settle, and assert GitLab failure chrome does not leak host or path. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): keep live analyze e2e under the analyze rate limit POST /api/analyze allows 10 requests per minute per IP. The slot-free helper re-POSTed every 400ms while a cancelled worker was exiting, spent that budget, and the lock test's hold request got 429 instead of 202. - postAnalyze waits out a 429 using the RateLimit reset and retries - slot polling backs off to 2s and leaves a small POST budget for callers - the slot probe is a clone that fails before any worker fork, so the probe itself no longer holds the slot after reporting failed - the lock test holds the slot with a real local analyze - token and GitLab tests wait for a free slot before posting from the UI - request fetches carry a timeout; teardown signals the serve process group - an empty FRONTEND_URL falls back to the default base URL Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3348) - ops view: a `?server=` link no longer auto-connects to another origin while a deploy token is held; it prefills and waits for Connect - analyze completion: a local-path run reconnects by the path this client submitted, so duplicate basenames stay collision-safe without repoPath on the public SSE frame - stale slot cleanup: revalidate each nested directory (lstat + realpath) right before readdir, so a mid-cleanup junction swap aborts instead of walking an outside tree; list phases run sequentially so the slot-I/O cap is global - e2e: 429 backoff honours the caller deadline; the unreachable-backend ops test navigates through the resolved frontend URL - drop the unused `repo` member from the clean integration helper Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(server): reconnect after analyze by an opaque repo id Public job views and the SSE terminal frame no longer carry repoPath, and repoName is not unique, so a post-analyze reconnect by name could load a same-named sibling. The server now issues `repoId`: an HMAC of the canonical registry path under a per-process random key. It is set on complete jobs (ops view, analyze poll, SSE terminal frame) and matches the new `id` on `GET /api/repos` entries. The web client resolves it to the exact entry path on completion; unknown ids fall back to the name. This covers URL clones and folder uploads, and replaces the local-path only fallback. With reconnect off the label, public `repoName` for a branch-pinned URL clone is the repository name, not the `<repo>__<branch slug>` registry name, so the requested branch stays off the unauthenticated feed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3348) - stale slot cleanup: a descendant that vanishes before its unlink is treated as removed instead of aborting the reclaim - e2e teardown: escalate to SIGKILL on the process group when the live backend ignores SIGTERM for 5s - ops view: drop the dead initial value CodeQL flagged Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3348) - public redaction: a known repoPath now also consumes its descendant tail, so `<repoPath>/src/secret.ts` becomes `[path]` instead of `[path]/src/secret.ts`; a same-prefix sibling is left to the path scrub - e2e: the cancel test waits for the analyze slot the previous failed local-path job still holds; `fetchOps` carries the request timeout - docs: SSE terminal payload and RepoAnalyzer `onComplete` describe `repoId` resolution Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address PR review feedback (#3348) - RepoAnalyzer: drop a completion that resolves after unmount, so a slow /api/repos lookup cannot switch repos after the sheet was dismissed - e2e: select the local-path input by test id (the placeholder differs on Windows); the slot probe's job wait honours the caller's deadline Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(server): assert the public SSE terminal frame in analyze-api The #2790 terminality tests still expected `repoPath` on the terminal frame. This PR replaced it with the opaque `repoId`, so assert that shape and that the analyzed path never appears in the stream. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(web): wait for the analyze slot between duplicate-repo setup runs The server now keeps the single analyze slot until the worker exits, even after its job reports complete. repo-path-identity posted the second duplicate's analyze immediately and got 409 in CI. Use the shared slot-aware POST, which also waits out a 429. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 13:27:22 +01:00
dependabot[bot]	ca816e901a	chore(deps)(deps-dev): bump @types/node in /gitnexus (#3350) ... Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.5.1 to 26.6.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-23 07:05:23 +01:00
dependabot[bot]	3f2a06a2bd	chore(deps)(deps-dev): bump @babel/traverse in /gitnexus (#3344) ... Bumps [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) from 8.0.5 to 8.0.6. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.6/packages/babel-traverse) --- updated-dependencies: - dependency-name: "@babel/traverse" dependency-version: 8.0.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-22 07:26:59 +01:00
dependabot[bot]	f6d3891f3f	chore(deps)(deps): bump onnxruntime-common in /gitnexus (#3343) ... Bumps [onnxruntime-common](https://github.com/Microsoft/onnxruntime) from 1.29.0 to 1.30.0. - [Release notes](https://github.com/Microsoft/onnxruntime/releases) - [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md) - [Commits](https://github.com/Microsoft/onnxruntime/compare/v1.29.0...v1.30.0) --- updated-dependencies: - dependency-name: onnxruntime-common dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-22 07:26:26 +01:00
Nguyễn Đăng Minh Lực	5be80b1fc3	fix(lbug): self-heal read-only opens refused by an interrupted checkpoint (#3340) ... * fix(lbug): self-heal read-only opens refused by an interrupted checkpoint Homelab repro 2026-09-19 (image 1.6.10-20260917, @ladybugdb/core 0.19.x): a wiki pod killed mid-CHECKPOINT left the engine's checkpoint artifacts on disk (lbug.wal.checkpoint / lbug.shadow / checkpoint intent+apply locks), and every later READ-ONLY open refused with 'Cannot open database in read-only mode while checkpoint is in progress' — permanently, until a writable open (any gitnexus analyze) happened to run. Two defects, both fixed: 1. The refusal was unclassified. ensureReadOnlyConnectionUsable (direct adapter) and openReadOnlyDatabase (pool) recovered missing-shadow and shadow-replay errors but rethrew this one raw, so 'LadybugDB unavailable for __wiki__' repeated forever. Add isReadOnlyCheckpointInProgressError (LADYBUGDB-CONTRACT, live-verified against 0.19.1) and route it through the same writable-open recovery — including at OPEN time, where the refusal fires before any probe can run (pool: init() moved inside the try; direct: doInitLbug catch). 2. The existing shadow-replay recovery was not durable. Reproduction matrix on 0.19.1: the writable probe replays the WAL in MEMORY only — without an explicit CHECKPOINT the engine drops the pages at close and the follow-up read-only open silently serves the pre-checkpoint state. Both recovery paths now CHECKPOINT after the probe, which applies the replay, consumes the sidecars, and clears the checkpoint locks. Verified end-to-end: real engine 0.19.1, killed-mid-CHECKPOINT state → exact refusal → pool adapter self-heals → 80,800 rows intact, sidecars consumed. The planted-signature integration test runs on any engine version (refusal asserted only where the engine emits it, 0.19+). * docs(architecture): list checkpoint-in-flight artifacts and the read-path self-heal * fix(lbug): address review findings — shared cursor closer, tighten structural guard Both findings from the gitnexus-check review on this PR: 1. pool-adapter.ts: the recovery CHECKPOINT closed its cursor with a bare unawaited result.close?.(). Use the shared best-effort closer (closeQueryResults) the repo already funnels both adapters through, so a cursor-close failure stays cleanup and cannot escape as an unhandled rejection. 2. sidecar-recovery.test.ts: the structural regex omitted the leading negation, so as a substring match it also accepted the inverted predicate (recover ONLY shadow-replay, exclude checkpoint) — the exact regression the guard exists to prevent. Pin the full '!isReadOnlyShadowReplayError(err) && !isReadOnlyCheckpointInProgressError(err)' throw-through shape. * test(lbug): wire the recovery plant into lbug-db/LBUG_NATIVE; force the refusal on any engine pin Address the tri-review findings (all four): P1 — the planted-signature integration test was collected by the parallel 'default' project and never by the serialized 'lbug-db' project, and Windows/macOS CI never ran it: register it next to its sibling in vitest.config.ts (lbug-db include + default exclude) and in cross-platform-tests.ts LBUG_NATIVE, per TESTING.md's rule for native @ladybugdb/core suites. Verified via 'vitest list --project lbug-db'. P2 — on the committed 0.18.3 pin the plant passes as 'pool opens and count(n)=300' without ever exercising the new classifier or recovery CHECKPOINT. Add forced-refusal behavioral tests for BOTH adapters: a mocked native layer whose first read-only Database refuses with the canonical 0.19 message, asserting the exact self-heal shape (ro-refused -> writable open -> CHECKPOINT -> ro retry) and that a healthy db never triggers a writable open. The direct adapter is lazy, so its refusal is scripted at the first probe query rather than init(). P2 — the LADYBUGDB-CONTRACT header on isReadOnlyCheckpointInProgressError claimed '^0.18.0' like its siblings; only 0.19.x emits this string (0.18.3 tolerates the state). State the first-observed version so a bump reviewer validates the right binary. P2 — the pool's writable replay recovery quarantined on missing-shadow even when the error came from the post-probe CHECKPOINT, where the main file has already changed: mirror the direct adapter's probeSucceeded guard (replaySucceeded) and fail closed instead of parking a live sidecar. Also assert walBuffer.byteLength > 0 in the plant so the fixture cannot silently degrade into an empty shell on tolerant engines. * test(lbug): fix hosted-CI failures — Windows handle release, version-gated plant, prettier Address the CHANGES_REQUESTED review of the hosted run: Windows blocker (Win32 Error 33, locked file region at the pooled reopen): the fixture now makes handle release explicit — waitForFixtureRelease probe-reads the db and its residual WAL with bounded retries after every native close (plant, raw refusal probe, pool close), mirroring the adapter's own Windows handle-release probing. The WAL is re-planted from the captured bytes instead of renamed: a close-time auto-checkpoint can consume the live .wal out from under the rename (ENOENT, second flake). Version-gate the plant itself: on < 0.19 engines that tolerate the planted signature, its synthetic sidecars are not a consistent staging state for the old engine (double-apply replays surfaced as 'Person already exists in catalog' — the third flake), and no refusal can be forced there anyway. The plant now skips below 0.19 with that rationale in-file; the behavioral contract on every pin stays with the forced-refusal units, and this native suite remains registered in lbug-db + LBUG_NATIVE so Win/macOS exercise it as soon as the pin moves off 0.18.3. Also: prettier on the two flagged files (format gate). * fix(lbug): keep failed checkpoint heals from re-entering CHECKPOINT Wrap recovery failures without repeating native refusal text, skip already-wrapped errors in doInitLbug, and pin constructor-time heal plus the Windows reopen skip. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3340) - Clean each forced-heal tmpDir in afterEach so earlier cases do not leak - Compare major.minor when version-gating the interrupted-checkpoint plant Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3340) Reset the pool forced-refusal mock Database sequence in native.reset() so later tests can still script the first construction as the checkpoint victim. * Address PR review feedback (#3340) Count every MATCH on the pool forced-refusal mock and assert the writable replay probe so CHECKPOINT-without-probe cannot stay green. --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-21 19:18:16 +01:00
Adam B.	7376347058	feat(ingestion): add tRPC procedure detection and MCP chain/route surfacing (#3339) ... * feat(ingestion): tRPC pattern detection — procedures, curried calls, route extraction Three changes to properly index tRPC router files: 1. HOC-in-pair patterns: detect procedures like 'create: procedure.mutation(async ({ input }) => {...})' as named Function nodes (pair > call_expression > arguments > arrow_function) 2. Curried call detection: capture 'workflow(db)(input)' chained calls where call_expression.function is itself a call_expression 3. tRPC route extraction: new route-extractors/trpc.ts detects .query()/.mutation()/.subscription() procedures, maps to /trpc/* routes with prefix inference from router variable names 4. Function/Const dedup: structural check skips Const nodes when variable_declarator value is arrow_function/function_expression 5. Process-route linking: match by (filePath, methodName) instead of filePath only, preventing shared flows across procedures in same router (cherry picked from commit eced15e60a39a181a48bff8c5bbe278d26aa53b8) * fix(route-extractors): line-by-line scanner for chained tRPC procedures Original regex only matched direct patterns (list: proc.query()) but not chained patterns (create: proc.input(z.object({...})).mutation()). Only 41/256 routes were detected on Jurialis. Rewrote extractTrpcRoutes() as a line-by-line scanner that: - Detects procedure keys starting with *Procedure builders - Tracks currentProcedure forward until terminal .query()/.mutation() - Handles .input() chaining naturally - Deduplicates via seen Set on procedurePath Result: 245 routes from 30 routers (was 41), 256 total after re-index. (cherry picked from commit 49edf953e93e6b67b77932e866fcbfb8d089b1f3) * feat(mcp): expose tRPC chains via context/query tools Eight fixes to make the tRPC route->procedure->workflow->sub-workflow chain visible through the standard MCP tools (context, query) that AI agents use, instead of requiring raw Cypher queries. - A context: order incoming/outgoing CALLS test-last, raise LIMIT 30->100 - B query: batched ENTRY_POINT_OF lookup, surface route URL on processes - C query: mark process_symbols entry point with is_entry_point=true - D entry-point-scoring: skip UTILITY_PATTERNS (get*/set*) penalty for symbols in tRPC router files so framework boost (3.0x) is preserved - E fts-schema: index Route nodes so /trpc/* URLs are keyword-searchable - F tools: bump max_symbols default 10->25 to fit procedure->workflow chain - G context: optional chain_depth (0-3) param walks CALLS edges in both directions and returns layered chain field - H LadybugDB bug workaround: WHERE r.type IN [...] silently drops edges on relationship properties; replace with OR chains (7 occurrences in local-backend.ts, pdg-impact.ts, graph-queries.ts) Validated on Jurialis: setProviderCap procedure now appears as caller of setProviderCapWorkflow, /trpc/cabinet.setProviderCap Route is searchable, chain_depth=3 returns the layered call graph. (cherry picked from commit c24df0adce91e80f191a5c5d2e8b14e9da677366) * feat(mcp): surface is_entry_point + routes in context, raise query limit context() is the mandatory pre-edit tool (AGENTS.md). Until now an agent had to issue a separate query() call just to learn whether its symbol is a process entry point or which HTTP route it handles. These two fields make context() self-sufficient for the bmad-dev flow. - context: query STEP_IN_PROCESS now returns p.entryPointId; new ENTRY_POINT_OF lookup attributes routes only from processes where the symbol is the entry point (middle steps do not own the route) plus any direct Route->symbol handler edge (tRPC procedures outside any Process) - context: new top-level is_entry_point (true only) and routes[] fields ({url, method?}), emitted only when non-empty to keep the diff additive - query: raise default limit 5->10 so dense domains (tRPC action router with 20 chains, data-export with 9 flows) surface more of their flow set without an explicit param (cherry picked from commit 004f5b0ba985fcef3dfac5e67a2f2f7262184215) * docs(mcp): document chain_depth, routes, and entry-point flag; neutralize examples in comments * fix(mcp): address code-review findings on tRPC entry points, queries, and dispatch - entry-point scoring: optional-chain framework detection and normalize path separators before router-pattern matching (P1 crash on .js routers) - tRPC extractor: emit controllerName as null (callers resolve via lookupClassByName; a router object stringified as name corrupted lookups) - route dedup: key seenRoutes by method:url so GET/POST pairs survive - legacy TS queries: drop curried-call patterns (arity-corrupting for overload resolution) and require non-array callee on pair member calls - registry-primary TS query: mirror the non-array-callee predicate on the new pair member-expression patterns (fixes query compile error) - group tool port: forward chain_depth into per-tool context args * fix(mcp): nested tRPC router paths, controller-less route binding, query chain_depth - trpc extractor: brace-depth nesting stack composes sibling router paths (bare router() import style included); merge-prefix dot normalization; strict publicProcedure allowlist gate; drop phantom router metadata - call-processor: bind controller-less tRPC routes to same-file handlers via exact single-match symbol lookup; ambiguous or missing handlers skipped - query/group query: optional chain_depth (0-3) enriches ranked processes with their context chain; fix _computeContextChain layer docstring - tree-sitter TS/JS scope queries capture string-key function declarations; tRPC pattern scoring narrowed to server router files - parse-cache schema bump to v103 for extractor and route-binding changes - add trpc route extractor regression tests (9 cases incl. sibling nesting and merge prefix) * Address PR review feedback (#3339) Close remaining review threads: compact tRPC keys, comment-safe terminals, quoted-key identifier HOC captures, group-query default alignment, and LadybugDB label scalars on context chains. * chore(autofix): apply prettier + eslint fixes via /autofix command * test: pin PARSE_CACHE schema bump to 103 (PR #3339 review fixes) * fix(ingestion): bind same-name tRPC handlers and surface HANDLES_ROUTE Same-name procedures resolve by startLine, the extractor keeps nested paths through multiline schemas, and context/query UNION HANDLES_ROUTE for leaf procedures that never become Process entries. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Clamp group query bounds, drop HOC pair false positives, emit tRPC terminal lines and hyphenated quoted keys, cap chain BFS concurrency, and restrict the router utility exemption to accessor names. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Score JS/JSX tRPC routers like TypeScript, ignore inner db.query and unrelated .merge calls, mask regex braces, and assert clamp tests invoke the query mock. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(ingestion,mcp): emit-side HOC callback guards + MCP schema prettier (PR #3339 round 2) * Address PR review feedback (#3339) Treat `/` after return-style keywords as a regex, drop the synthetic appRouter path prefix, and bind the create mutation via an inline callback. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Qualify query() docs so is_entry_point is promised only when the entry symbol is among the search hits. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Emit tRPC terminals only at procedure paren depth, drop the filename prefix on bare appRouter = router(), mask regex after if (), and cap groupQuery member fan-out. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) De-duplicate context-chain BFS nodes reached through multiple frontier edges, and bind tRPC identifier callbacks (`.mutation(handler)`) to the handler symbol instead of the procedure key. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Apply LIMIT 50 after DISTINCT neighbors in the context-chain BFS, and treat the official lowercase `procedure` builder as a tRPC procedure key. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Keep the later duplicate tRPC object-literal key so route binding matches the handler JavaScript actually ships. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Compose same-file identifier-mounted tRPC subrouters so admin: adminRouter emits the live admin.list path instead of an unprefixed /trpc/list. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Memoize tRPC identifier-mount paths so a depth-N chain stays linear, and gate it with the build-free measure.mjs / baselines.json harness. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Compose identifier mounts without phantom /trpc URLs, bind wrapped and multiline handlers, fail-close missing bench budgets, and reject query page bounds before search. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Reject advertised MCP query bounds in group mode and chain_depth instead of clamping or accepting non-integers. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Reject invalid groupContext chain_depth and ignore non-callable same-file tRPC handler candidates. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Memoize live tRPC mount paths so the depth-N chain bench stays linear, and render invalid group/MCP bounds without throwing. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Keep t.merge('prefix.', namedRouter) procedures live by recording a zero-hop mount so the unmounted-router drop does not hide them. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3339) Recognize type-annotated `const adminRouter: AppRouter = t.router(` bindings so identifier mounts still compose. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-21 09:44:42 +01:00
Gergő Magyar	620fd18a5c	feat(cli): reclaim leftover per-branch indexes after branch delete (#3338) ... * feat(storage): classify leftover per-branch index slots Operators need a shared enumerator for deleted-branch leftovers before clean --stale or doctor can reclaim or report them. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(storage): reclaim a per-branch slot and empty branches/ Named clean --branch now shares one rm-then-registry helper so the last leftover slot can drop the empty branches directory, and a failed rm still keeps the retryable summary. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(cli): add clean --stale to reclaim leftover branch indexes Operators can drop per-branch slots whose recorded branch is gone without remembering each name, while a git-list failure stays a no-op. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(cli): report leftover branch indexes in doctor Operators can see cwd orphaned per-branch slots and their size, then reclaim them with clean --stale, without doctor deleting anything. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): keep unreadable branch slots out of stale reclaim A stat error other than ENOENT/ENOTDIR must not look like a missing directory, or clean --stale --force drops the registry row and leaves the slot on disk. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(cli): keep leftover-slot display helpers in the CLI layer Preview and doctor share one size formatter and an i18n path for registry-only rows, so storage no longer owns display copy. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): keep leftover reclaim moving after a registry drop failure Catch removeBranchIndex rejections so --stale continues, match doctor registry rows through canonicalizePath, and size leftover slots sequentially. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): match leftover-slot registry rows with canonicalizePath Use the repo-manager path contract so clean --stale and --branch still see registry-only leftover rows when cwd and the stored path differ. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): contain leftover-slot deletes and re-check live heads Refuse symlink and junction escapes under branches/, unlink slot links instead of removing through them, and skip --stale --force when a name is a local head again. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3338) - Bound listLocalHeads spawnSync with GIT_PATH_LIST_MAX_BUFFER. - Clarify that doctor leftover reporting is cwd-only, not registry-wide. - Drop the MCP/serve assumption from clean --stale delete failures. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3338) - Describe disk-only leftover slots in --stale help, not only recorded branches. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): stop doctor reclaim copy when heads cannot be listed Doctor was naming clean --stale for leftover rows even when git cannot list local heads, which is a no-op. Print the retry-git message instead (#3337). Co-authored-by: Cursor <cursoragent@cursor.com> * revert: drop Unreleased changelog notes from this branch Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cli): keep live branch pins when a tag shares the name %(refname:short) disambiguates against tags, so clean --stale treated still-local heads as leftover. Fail closed on obstructed slots and unlistable branches/ directories. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3338) Bound leftover-slot listing, revalidate paths immediately before delete, and keep registry rows when a stray disk-only directory claims a recorded branch. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-20 16:03:18 +01:00
Parafee41	ee2feb7a5b	fix(cli): announce explicit registry alias changes (#3334) ... * fix(cli): announce explicit registry alias changes * fix: handle async rename observer failures * Address PR review feedback (#3334) - Invoke onRename after withRegistryLock releases so observer I/O cannot stall the registry - Spy the rejecting observer and prove lock release via re-entrant registerRepo Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-20 08:28:28 +01:00
Twisted_Arrow	dcb2eb5cb4	fix(swift): resolve imports from Package.swift targets, not path segments (#3105) ... * fix(swift): match repeated SPM target prefixes * test(swift): cover repeated SPM target prefixes * test(swift): cover valid prefix before later partial match * docs(swift): clarify target grouping parity scope * docs(swift): clarify target grouping parity scope * docs(swift): clarify target grouping parity scope * fix(swift): resolve imports from Package.swift targets, not path segments Stop fabricating IMPORTS from import Foundation onto a same-named folder. Declare modules from Package.swift when the manifest is usable; keep Sources/* for grouping and fail-open folder resolve minus SDK names. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(swift): keep empty Package.swift declarations and nested .target() deps external An inferred Sources/* folder is grouping-only. A dependency .target(name:) is not a module. Treat both as unresolved so import Foundation cannot bind to a decoy folder. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(swift): keep implicit IMPORTS intra-group and gate linear Package.swift resolve @_exported must not paint sibling files as implicit imports. A dedicated bench pins declaration-only resolve and (t_4n/t_n)/4 linearity. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3105) Honor member-only @_exported imports, skip comments while scanning Package.swift factories, fail-open mixed helper-built target lists, and block CoreData/CoreGraphics decoy folders on the inferred path. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3105) Match path: "." as the package root, skip block-commented Package.swift factories, read import kind from the clause only, and skip capture tests when the optional Swift grammar is missing. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): scan Swift import-kind without nested regex backtracking CodeQL js/redos flagged the comment-skipping IMPORT_KIND_RE; a linear walk keeps the same kind tokens. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): linear Package.swift factory scan and gate Swift context parseSwiftPackageManifest re-walked every prefix for comments (O(n²) in factory count). Resume the scan and cover nested factories in one pass. Wire Swift into the import-target context arm now that resolveImportTarget is 5-arg. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3105) Tighten Package.swift and import-text scanners: skip comments/strings, reject escapes, treat ident + [ as incomplete, and drop the unused factory-comment wrapper. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): prettier the @_exported availability fixture Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3105) Judge Package.swift completeness from Package(...)'s own targets: argument instead of raw-text regexes, nest block comments when reading an import kind, and strip leading ./ from declared target paths. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3105) Collect Package.swift factories only from Package(targets: [...]), fail-open on computed array elements, and treat // after a label colon as a comment. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3105) Ignore stray factories when Package() exists but omits targets:. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3105) Require the Package-scan seen box so the always-true undefined guard goes away. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-19 15:50:31 +01:00
azizur100389	a578747455	fix(swift): resolve nested constructors in extensions (#3308) ... * fix(swift): resolve nested constructors in extensions * fix(swift): preserve qualified extension owners * Address PR review feedback (#3308) Recover qualified Swift extension owners through public / attribute prefixes, and stop last-dot-guessing when source text is present. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(swift): keep attribute text from stealing extension owners Bound header recovery so @available messages cannot rekey a fragment, and still inject nested types when the Class scope has no bindings. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(swift): nest comments and keep the public extension fixture valid Review follow-up: skip nested /* */ in the header scan, put the Inner.Entry decoy in a parsed file, and mark Outer/Container/Entry public so the live fixture is valid Swift. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(swift): recover Unicode identifiers as extension owners The header regex was ASCII-only, so extension Café.Container keyed as Caf and dropped nested-type siblings. Match ID_Start/ID_Continue segments instead. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(swift): skip raw strings and decode UTF-8 scope columns Header recovery treated #"..."# as an ordinary quote and sliced Tree-sitter byte columns as JS offsets, so a same-line Café prefix or a raw attribute message could steal or drop the extension owner. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-19 09:46:53 +01:00
Parafee41	795cf0e151	fix(swift): resolve inherited protocol extension calls (#3309) ... * fix(swift): resolve inherited protocol extension calls * fix(scope): gate inherited implicit receiver lookup * fix(swift): resolve call result types by exact callee * test(swift): align cache and local call expectations * fix(scope): reconcile replay diagnostics * fix(swift): preserve exact callable return types * fix(swift): capture throwing async call results * test(swift): refresh capture golden * test(swift): refresh scope capture baseline * fix(swift): require explicit callable returns * fix(scope): preserve duplicate return metadata * chore(scope): align index documentation * Address PR review feedback (#3309) Stamp only protocol/class-extension members (nested QN + SPM buckets), arity-narrow implicit-this across MRO, and keep Swift type peeling out of shared workspace-index via stripTypePreservingDecoration. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3309) Stamp extension members even when the extension declares a nested type, keep inherited class members ahead of protocol-extension defaults, and report replay-only interface-dispatch fan-out drops. Note: pre-existing failure in gitnexus tsc against an older gitnexus-shared dist not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3309) Walk inherited implicit-this owners nearest-first so a nearer override wins, and tighten Swift owner-stamp tests. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-19 07:44:35 +01:00
dependabot[bot]	f465f6fb92	chore(deps)(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /gitnexus (#3329) ... Bumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-19 07:43:35 +01:00
Gergő Magyar	ba39d5c009	feat(analyze): expose process-detection budget overrides (#3324) ... * feat(analyze): expose process-detection budget overrides (#3313) Operators can raise or lower process count, branching, trace depth, and the entry-point candidate pool via CLI, .gitnexusrc, or GITNEXUS_* without changing shipped defaults. A budget-only change re-detects flows on the next analyze without --force. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): say invalid budget flags still honor env A rejected --max-processes value was described as falling back to the built-in default even when GITNEXUS_MAX_* still won the next precedence tier. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(analyze): share process-detection defaults and skip unused walks Keep DEFAULT_CONFIG aligned with the budget resolver and count symbols only when maxProcesses is still dynamic. Co-authored-by: Cursor <cursoragent@cursor.com> * style(analyze): wrap process-detection budget files for prettier Co-authored-by: Cursor <cursoragent@cursor.com> * docs(analyze): name the real process-detection default formula Co-authored-by: Cursor <cursoragent@cursor.com> * docs(analyze): stop calling maxProcesses*2 a hard trace quota Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): say invalid env budget tokens fall back to defaults Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): recertify process-detection after in-place FTS abort (#3324) Persist processDetection.uncertified on the in-place FTS dirty stamp when the budget mismatched so a flagless retry cannot keep rewritten flows. Qualify .gitnexusrc fail-fast copy and tighten related tests. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): skip live dirty stamp on atomic incremental (#3324) POSIX atomic incremental mutates a staging copy, so stamping live incrementalInProgress before swap made a crash force-rebuild a healthy index. Align analyze --help with CLI > .gitnexusrc > env > default. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(changelog): drop the atomic-incremental dirty-stamp note The code fix stays; Unreleased no longer lists that recovery change. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): survive FTS SIGSEGV in --limit e2e CREATE_FTS_INDEX can kill the setup analyze on some WSL hosts (status null). Rebuild with --skip-fts and skip BM25-only query --limit cases unless GITNEXUS_REQUIRE_FTS=1. Refs #3324 Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): mark update-check child at import Writing refresh-started from fetch() raced a 30s poll against cold tsx boot on a loaded default-project worker. Refs #3324 Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3324) Isolate default-budget FTS crash-marker tests from GITNEXUS_MAX_* env, assert uncertify-before-FTS order and deferred flow detection on park recovery, drop the dangling "then" from entry-point help, and correct stale streamGraphEmit docs without skipping the process-detection stamp. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(changelog): drop Unreleased process-detection notes Keep the #3313 / #3322 code; Unreleased changelog matches main until release. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-18 13:37:15 +01:00
Gergő Magyar	9d95af9fc3	refactor(analyze): move detected-branch sanitization off CLI config (#3325) ... * refactor(analyze): load detected-branch sanitization from core git-ref Keep the never-throw helper next to validateBranchName so run-analyze no longer imports CLI config parsing. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): warn once when a checkout name cannot label the index After the write lock settles, emit a single onLog warning and keep writing the workspace slot. Pin that run-analyze does not import CLI analyze-config. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): escape hidden checkout names in the detect-reject warning Keep the rejected ref visible in onLog without replaying bidi or quote characters, and document that sanitizeDetectedBranch rethrows unexpected errors. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): keep detect-reject warnings on one line (#3325) Git-legal U+2028/U+2029 checkout names were rejected as whitespace but left raw in the new onLog warning, so the message split across two lines. Escape those code points in the formatter without changing validateBranchName. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(analyze): keep C1 and Unicode spaces in detect-reject warnings Escape NEL and remaining whitespace as \uXXXX so stripControlCharacters cannot drop or disguise the rejected checkout name. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-18 11:03:24 +01:00
Gergő Magyar	56feb85c97	chore: compile first-party packages with TypeScript 7 (#3311) ... * fix(web): drop TypeScript 7-incompatible tsconfig paths Remove baseUrl and the dead ../shared include so web project references typecheck under TypeScript 7. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): parse TypeScript with a TypeScript 6 API package Keep AST guards working after the named typescript package becomes 7, which no longer ships the Compiler API. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(lint): pin root TypeScript to the 6 API package Give typescript-eslint a TypeScript 6 peer so syntax-only lint still installs after CLI and web move to TypeScript 7. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(deps): compile first-party packages with TypeScript 7.0.2 Unify CLI and web on the same native compiler line as gitnexus-shared so typecheck and emit no longer split 5.x versus 7.x. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(ci): describe parent TypeScript 7 as the shared compiler Stop saying web compiles shared with TypeScript 5 now that the parent lockfile is 7. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): compile shared from parent TypeScript on Vercel and skill-evolution Stop isolated npm installs in gitnexus-shared so those paths do not pull a second TypeScript 7 optional-platform tree. Co-authored-by: Cursor <cursoragent@cursor.com> * docs: record TypeScript 7 typecheck and Dependabot major-split policy Keep contributor typecheck commands, and stop Dependabot from bumping shared onto a different TypeScript major than CLI and web. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lint): pin root TypeScript to 5.9 so npm ci satisfies eslint peers typescript-eslint 8 peers typescript below 6.0.0, so the typescript6 alias made quality lint npm ci fail with ERESOLVE. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): drop the TypeScript 6 Compiler API package TypeScript 7.0 has no classic createProgram surface, so parse-only guards now use Babel and Mode 4 uses the TypeScript 7 Checker. Co-authored-by: Cursor <cursoragent@cursor.com> * docs: align contributor setup with parent TypeScript 7 compile Stop telling clones to npm-install gitnexus-shared; CI and Vercel already emit that package from a parent lib/tsc.js shim. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(web): typecheck React JSX on TypeScript 7 with explicit DOM libs TypeScript 7 no longer implies DOM or auto-includes @types, so the web app must declare React/JSX settings while Vite keeps plugin-react. Co-authored-by: Cursor <cursoragent@cursor.com> * test: pin Vercel --include=dev and share parse-only string helpers Production npm ci omits the web TypeScript unless --include=dev is on that install. Move staticStringValue next to the other Babel walk helpers so CLI help and contract tests share one source. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-17 22:16:00 +01:00
Gergő Magyar	a2e1710ac0	fix(embeddings): stop Caching embeddings OOM on large incremental analyze (#3310) ... * fix(embeddings): spill cached vectors to a Float32 temp file Keep restore metadata in RAM and write embeddings once the in-memory row limit is exceeded so incremental analyze can survive large caches without a full-table number[] heap (#3306). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): stream CodeEmbedding cache under the connection lock Spill vectors once the in-memory limit is crossed and fail the load instead of adopting an empty snapshot, so incremental analyze cannot OOM or quietly drop the restore cache (#3306). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(analyze): restore cached embeddings from a streamed spill snapshot Hold row metadata across wipe, materialize 200-row batches, and treat cache-load failures as warn-and-continue so incremental analyze can preserve vectors without a full-table heap (#3306). Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3310) Loop spill writes until the full vector lands, keep materialize failures out of the insert catch and the Phase 4 hash skip-set, and assert spilled restore subsets by node id instead of scan order. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3310) Discard only this analyze run's embedding spills so a concurrent analyze on another index keeps its restore file, and isolate the default in-memory limit test from inherited env. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3310) Mark a node stale when any restore batch fails so leftover chunks are deleted and rembedded, and exercise a full-length bad-magic spill header. --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-17 16:18:29 +01:00
dependabot[bot]	a67e74cdb6	chore(deps)(deps): bump js-yaml from 5.4.1 to 5.4.2 in /gitnexus (#3304) ... Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.4.1 to 5.4.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.4.1...5.4.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.4.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-17 07:06:03 +01:00
Matt	8b21ce3b95	feat(auto-sync): preserve PDG indexes across updates (#3290) ... * feat(auto-sync): preserve PDG indexes across updates * docs(auto-sync): document durable PDG synchronization * Address PR review feedback (#3290) - Correct requestedPdg state docs for threshold-skipped syncs - Defer coalesced follow-up and skip failure-threshold counts for leftover-worker / retryable lock waits - Document the pdg tri-state and caveat the 30m/5m example Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): raise Windows Ladybug #605 hang budget off the CI tail Windows 3/3 typically finishes this native race in ~15s but has a 56s tail; 60s false-positives as deadlock. Keep the POSIX 60s detector and the completion/.shadow/row-count contract. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-16 20:12:45 +01:00
Abhinav Pandey	0ede6ae501	fix(rust): respect Cargo target boundaries in name fallback (#3294) ... * fix(rust): respect Cargo target boundaries in name fallback * fix(rust): read Cargo sources through validated file descriptors * fix(rust): require matching imports for crate-root guesses * fix(rust): require Cargo root identity for cross-target imports * fix(rust): enforce Cargo identity across fallback imports * fix(rust): keep Cargo membership on typical derive/macros (#3294) Abort only genuine unknown expansion, ignore Cargo artifact layouts instead of every `target` path segment, and require a covering import for unanswered crate-root name fallback so #3253 still holds on ordinary Rust sources. Co-authored-by: Cursor <cursoragent@cursor.com> * test(rust): gate Cargo target membership in CI (#3253) Add a parse-dispatch-rounds-style bench so derive/macro abort, target-path globs, and superlinear membership walks fail in CI instead of staying graph-invisible. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(rust): verify Cargo macro and re-export evidence * style(bench): format Cargo membership benchmark * fix(rust): require imports for cross-file root guesses --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-16 11:36:07 +01:00
Gergő Magyar	ebbcd5b0b4	fix(mcp): name the indexed ref on hot read tool staleness (#3291) (#3293)	2026-09-16 07:29:04 +00:00
dependabot[bot]	66421ef42f	chore(deps)(deps-dev): bump @types/node in /gitnexus (#3297)	2026-09-16 06:08:57 +01:00
Gergő Magyar	ac9a4e9abd	fix(embeddings): keep ONNX off the install and analyze critical path (#3287) ... * fix(embeddings): isolate local ONNX inference in a child_process sidecar The analyze parent must not load onnxruntime-node. Fork a sidecar for vectors only and reap it on worker exit; keep Ladybug writes in-process. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(embeddings): share the sidecar client across MCP, serve, and sync Query hosts now use the core façade instead of a second in-process ONNX embedder. Search skips an empty table, sync reaps beside closeLbug, and ready means the stack is resolvable rather than a warm singleton. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(embeddings): refuse Intel Mac and unloadable prefix before npm heal Analyze, sync, install, and the sidecar client now consult the platform blocker before forking or downloading the optional stack. HTTP stays the escape hatch; wasm is not treated as a rescue. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(embeddings): take the ONNX stack off default npm install Pins live in gitnexusEmbeddingStack. embeddings install writes prefix overrides before npm spawn. Leftover 1.6.12 package-first trees are residual. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(publish): drop grammar source from the published tarball Every vendored grammar has 6/6 prebuilds, so files ships those plus Leiden and FTS instead of parser.c. First ship stays above 80 MiB. Co-authored-by: Cursor <cursoragent@cursor.com> * test(embeddings): match MCP missing-stack warn to the R20 copy Default install no longer calls the stack optional, so the once-per-backend stderr assertion must look for the new lead line. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(review): bound sidecar death, cancel writes, and publish-file guards Init-time native crashes no longer respawn a child on every query. Local embedBatch honors AbortSignal after sidecar return, MCP query() surfaces vector-lane degradation, disconnect always reaps, and the grammar prepack guard checks files globs instead of on-disk prebuilds. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(embeddings): share runtime preflight and sidecar reap helpers Analyze and embeddings-sync used the same blocker/prefix/install gate with different error routing. One assessment keeps those paths aligned without changing CLI vs thrown-error behavior. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3287) Keep a reaped sidecar from resetting its replacement, wait for dispose, tighten the publish-files guard, and stop assuming a leftover ONNX tree in CI. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Clear the sidecar reap timeout, add init IPC slack, and isolate embeddings-sync tests from HTTP-mode env. Co-authored-by: Cursor <cursoragent@cursor.com> * test(embeddings): unstub globals after sidecar HTTP-mode tests Keep a leaked fetch stub from failing assertions out of later tests in the same file. Co-authored-by: Cursor <cursoragent@cursor.com> * test(embeddings): pin sidecar success cases off darwin/x64 The runtime blocker reads the real process platform before the fork mock, so local-success tests must not inherit an Intel Mac host. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Keep vector degradation per query, treat leftover Intel-Mac stacks as not ready, and document that the CLI image no longer ships ONNX. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify embedding sidecar shutdown and search hot paths Drop redundant sidecar reaps and unused child helpers, and run FTS alongside semantic search. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Share HF attempt parsing with the sidecar init deadline, abort embed waits without killing the child, and restore last init options on recreate. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Treat sub-1 HF attempt env values as invalid, and drop leaked sidecar waiters when IPC send throws. Co-authored-by: Cursor <cursoragent@cursor.com> * Address remaining PR review feedback (#3287) Keep sidecar init on a shared chain; each waiter can abort only its own wait. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): declare embedding-table existence probe as unordered LIMIT The empty-table skip in semanticSearch is existence-only; declare it so the #2787 determinism guard stops failing coverage shard 3/3. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-15 12:11:47 +01:00
dependabot[bot]	dcf980581c	chore(deps)(deps-dev): bump @types/node in /gitnexus (#3289) ... Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.4.1 to 26.5.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.5.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-15 07:14:30 +01:00
dependabot[bot]	29f4ce0592	chore(deps)(deps-dev): bump @babel/traverse in /gitnexus (#3284) ... Bumps [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) from 8.0.4 to 8.0.5. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.5/packages/babel-traverse) --- updated-dependencies: - dependency-name: "@babel/traverse" dependency-version: 8.0.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-14 10:57:47 +01:00
dependabot[bot]	8a10383563	chore(deps)(deps-dev): bump @babel/generator in /gitnexus (#3281) ... Bumps [@babel/generator](https://github.com/babel/babel/tree/HEAD/packages/babel-generator) from 8.0.0 to 8.0.5. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.5/packages/babel-generator) --- updated-dependencies: - dependency-name: "@babel/generator" dependency-version: 8.0.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-14 10:57:18 +01:00
Gergő Magyar	21a52af1d4	fix(lbug): ship FTS per-platform and recover in-place native aborts (#3274) ... * fix(lbug): pin Ladybug core so Dependabot cannot ship a skewed FTS artifact The extension version is a separate upstream constant. Ignore daily core bumps and fail the pairing gate when the committed manifest does not name the installed core. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): make doctor and CI FTS gates resolve the packaged artifact Doctor and the REQUIRE_FTS file gates still treated an empty ~/.lbdb as unavailable, which would turn three CI jobs red once analyze stops installing into that tree. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): name native-abort and tuple-missing so analyze cannot mis-advise The CLI summary's trailing else treated every unknown skip reason as a missing extension. New crash and platform causes must get their own remedies, not a network-install hint. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): delete the dead read-path FTS index create ensureFTSIndex had no production callers and swallowed read-only CREATE_FTS_INDEX failures, which hid the only signal that a reader tried to write. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): vendor per-platform FTS artifacts so analyze needs no host install Keyword search depended on a CDN fetch into ~/.lbdb. Shipping the five published tuples inside the package makes air-gapped and ignore-scripts installs load the same artifact the publish gate checksums. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): load the packaged FTS artifact before any network install Analyze still required a CDN fetch into ~/.lbdb even when the package already shipped the file. FTS now path-loads the vendored tuple first and records source labels so a later truncated home copy cannot steal the diagnosis. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): diagnose a core/extension version skew instead of a missing runtime A structurally valid FTS artifact whose path version disagrees with the packaged pin must name both versions, not prescribe VC++ or OpenSSL. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): stamp an FTS phase so repair stays usable after an in-place abort A native CREATE_FTS_INDEX abort leaves no skip reason; the next run infers it from the dirty flag, and --repair-fts must not treat that phase as a half-written graph. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): park an in-place FTS crash WAL without wiping the graph An FTS abort after a successful checkpoint must reopen the live index on macOS, Windows, and Linux. Staging never parks the live WAL; readers keep today's large-WAL refusal. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): refuse read-only opens of an FTS-poisoned WAL MCP and serve cannot repair a leftover in-place abort. Fail before the native open and name --repair-fts, on macOS, Windows, and Linux. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): name a vendor-neutral Windows OpenSSL prerequisite OQ1 is unanswered here so GitNexus does not ship OpenSSL DLLs. Windows FTS now asks for a system OpenSSL 3 runtime instead of Git Bash PATH. Co-authored-by: Cursor <cursoragent@cursor.com> * test(lbug): inject the FTS vendor root and redact it on HTTP and MCP Path-loaded artifacts no longer vary with HOME. Tests pass an injected vendor tree and assert search warnings never leak a filesystem path. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(lbug): document load-only as the global FTS install default Analyze still overrides to auto. Packaged per-platform artifacts load before any network install on macOS, Windows, and Linux. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(lbug): format the FTS install-policy README table Prettier does not run on Markdown in pre-commit, so the U10 table wrap needs its own formatting commit. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): skip FTS CREATE after a persisted native abort A recovered analyze run was retrying CREATE_FTS_INDEX from skipReason alone. Keep that skip until --repair-fts, fail closed on unsupported tuples, and honor the checkpoint warrant for park/repair. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): honor checkpoint flushed warrant and align FTS tests with packaged vendor A no-op CHECKPOINT must not satisfy the FTS park warrant, and CI still asserted HOME-only FTS isolation after analyze started path-LOADing the packaged artifact. Co-authored-by: Cursor <cursoragent@cursor.com> * test(lbug): accept a nonempty incremental write set in the #2790 recovery check FTS-phase recovery can incremental-add files (changed=0, added=1). That is not the #2790 empty-diff wipe skip. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): compare FTS home versions to the core pin and tighten the publish filename gate Ladybug's ~/.lbdb/extension directory is the runtime/core version; treating it as the artifact version false-diagnosed skew. The publish guard now rejects a path-escaping filename the same way the fetch script does. Co-authored-by: Cursor <cursoragent@cursor.com> * test(lbug): seed FTS e2e fixtures from the packaged vendor artifact A machine with no ~/.lbdb copy should still run the vendor-survivorship cases; the seed no longer depends on HOME or a network install. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3274) Keep in-place FTS abort evidence after persist so a second CREATE abort cannot fail-open readers, and close the CLI, loader, embed, and e2e gaps the review called out. Note: full npm test hit Ladybug worker-pool startup failures under memory pressure; tsc and 180 targeted unit tests passed. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3274) Run the vendored-path symlink guard on the OS matrix, put e2e HOME fixtures on Ladybug's real extension layout, pin the embed crash-WAL gate before the writable open, and let analyze writers park through missing-shadow recovery. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): keep --repair-fts CI green after vendored-first FTS Never-installed warning fixtures must not inspect a packaged vendor binary, and a failed dirty restamp must not abort an otherwise successful --repair-fts run. Co-authored-by: Cursor <cursoragent@cursor.com> * test(cli): give the #1169 analyze e2e the same 90s Windows budget as its sibling The first #1169 persist-meta case was still on a 60s spawn/it budget and was killed banner-only on windows-latest after the FTS warning fixture no longer failed the shard first. Co-authored-by: Cursor <cursoragent@cursor.com> * test(ci): reweight Windows shards after the FTS e2e grew Vendored-first HOME fixtures pushed fts-extension-e2e to ~6 minutes on windows-latest, so the old 146s weight packed it with skills-e2e and blew the 20-minute watchdog. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-14 08:52:24 +01:00
Gergő Magyar	c4ecf398de	chore: release v1.6.12 (#3272)	2026-09-12 22:16:01 +01:00
mengkaka	79543c8f83	feat(storage): add configurable index storage and content retention tiers (#3060) ... * feat(storage): add configurable index storage and content retention tiers Rebase #3060 onto current origin/main. Keep GITNEXUS_STORAGE_PATH, GITNEXUS_STORAGE_ROOT, and GITNEXUS_CONTENT_RETENTION, and fold in main's FTS skip, embed-session, and help-text updates. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Keep legacy registry rows on the local storage fallback, resolve symlinks before the destructive-path guard, and align hook lookup with CLI branch slugs, branch-slot metadata, and longest-path match. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Only list swept upload directories after a successful removal so callers cannot treat a permission or transient rm failure as gone. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Document that getStoragePath may consult registered storage while this module still does not mutate the global registry. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(storage): close review findings for external indexes and retention Re-inspect ownership under the analyze lock, fail-closed when the registry file is missing, and keep skip-git hook discovery plus retention fields on HTTP/MCP list surfaces. /api/file stays 410 unless contentRetention is full. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3060) Treat lock-only index dirs as empty, honor HTTP --force storage policy, and prefer registered plus branch-aware slots in hooks and augment. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3060) Keep hook fallbacks inside the current worktree, compare foreign-local slots canonically, and make storage fixtures survive ownership validation. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix macOS hook test expecting realpath'd registry paths. resolveHookRepo returns the written registry path, not a filesystem realpath, so the assertion must match that. * Address gitnexus-check warnings on hook install docs and slot tests. The Cursor troubleshooting list omitted registry-query.cjs, and the writable-slot test only checked that isDirectory exists instead of that the path is a directory. * Align the HTTP catalog source-scan with skippable resolveRepo validation. resolveRepo lists fresh repos with validate: options.validateStorage !== false so DELETE can skip prune; the test still required a literal validate: true. * Harden storage path sinks so CodeQL path-injection and ReDoS alerts clear. Contain every filesystem probe inside the resolved storage slot with the inline path.relative idiom, reject filesystem-root slots, and trim slot basenames in linear time. * Settle bridge stamps before writing so CI size/mtime matches stay stable. LadybugDB can still flush into bridge.lbug after close+rename; persist whole-millisecond mtimes and wait for consecutive stats to agree so a freshly written pair matches. * Type the settled bridge stat as fs.Stats so tsc does not see bigint. Awaited<ReturnType<typeof fsp.stat>> collapsed the bigint overload and broke prepare/typecheck on CI. * Keep the bridge mtime stamp exact so same-size swaps still fail the pair check. Co-authored-by: Cursor <cursoragent@cursor.com> * Wrap the bridge stamp predicate so prettier --check stays green. Co-authored-by: Cursor <cursoragent@cursor.com> * Require a quiet interval before stamping a settled bridge file. Co-authored-by: Cursor <cursoragent@cursor.com> * Reuse shared storage and settle helpers instead of local copies. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-12 20:31:55 +00:00
pcaceres-hazloagil	a8736a07d0	fix(lbug): checkpoint race in pool-adapter.ts + pin @ladybugdb/core to 0.18.3 (#3189) ... * fix(lbug): await evict-then-reopen so it can't race the checkpoint closeOne() closed the evicted repo's shared Database with a fire-and-forget `db.close().catch(() => {})` (no await). Both call sites that evict-then-reopen — evictLRU() right before doInitLbug opens the new connection, and the "idle & changed" path in initLbug — proceeded to open the next repo's connection immediately after, without waiting for the evicted repo's close (and the checkpoint it triggers) to finish. On the real engine the new open can then collide with that still-in-flight checkpoint, surfacing on any read as: Runtime exception: Cannot open database in read-only mode while checkpoint is in progress. Please retry later. This reproduces reliably once more than MAX_POOL_SIZE (5) distinct repos are queried within a short window (self-hosted deployments with more than a handful of active repos hit it routinely), and gets worse under genuinely concurrent requests for different repos, since nothing serialized pool mutations across callers either. Fix: - closeOne / evictLRU are now async and await their internal work (closeOne's own close() call; evictLRU's call to closeOne), closing the race within a single initLbug call. - The exported initLbug is wrapped in a small async mutex (initLbugInner does the real work) so concurrent initLbug calls for different repos serialize instead of each racing their own evict-then-reopen against the others. - closeLbug's two closeOne() calls are now awaited too — closeOne becoming async meant closeLbug could resolve before pool.delete() had actually run, which a repo-pinning test caught (isLbugReady() briefly still true right after a resolved closeLbug()). - closeOne now deletes the pool entry (and clears its pin, and notifies pool-close listeners) BEFORE the awaited db.close(), not after. Review caught that the previous order left a "zombie" entry reachable via pool.get(repoId) — closed=true, available emptied, but still present — for the duration of that await; a same-repo query/init landing in that window would see isLbugReady() as true and hit a "Connection pool integrity error" in checkout() instead of just reopening. Deleting first removes the entry entirely, so a concurrent caller takes the normal fresh-open path instead. Verified two ways: - Against the compiled bundle (`ghcr.io/abhigyanpatwari/gitnexus`, 1.6.10/1.6.11 — pool-adapter.js is byte-identical between them): an A/B docker build with 7 tiny local repos and genuinely concurrent (parallel, not sequential) /api/graph requests goes from 7/7 failing to 7/7 succeeding on a freshly-analyzed pool. - Unit tests here (mocks @ladybugdb/core the same way as lbug-pool-pinning.test.ts): one asserts the evicted repo's close() completes before the initLbug call that triggered the eviction settles; another asserts closeLbug's own promise doesn't resolve before the underlying close() does. Both gate their mock's close() on a real short delay and were confirmed to fail against code that drops the corresponding await. Note: a second, deeper issue was also observed in the docker A/B setup — repeated rounds of concurrent access show a repo that has gone through one evict+reopen cycle can become permanently unable to reopen for reads, identically with and without this fix. That did not reproduce with mocks and isn't understood yet; filed separately as #3186, which stays open and untouched by this PR — this fix closes a real, root-caused bug on its own but does not resolve #3186 by itself. Second review round caught a follow-up: the idle-timeout sweep calls closeOne(repoId) directly, outside of initLbug's poolLock. Now that closeOne deletes the pool entry before its awaited close(), an unsynchronized idle close racing a same-repo initLbug could let that initLbug treat the repo as absent while the idle close (and its checkpoint) is still in flight — reopening the same class of race this PR exists to close, just via the idle path instead of LRU eviction. Routed the idle sweep's closeOne call through withPoolLock too, so it serializes against initLbug the same way evictLRU already does. (Tried to add a mocked regression test for this specific interleaving; dropped it — the mock's dbCache-reuse path masks the difference regardless of the fix, so it could not be made to discriminate reliably. Fixed by direct code review instead, same as the note below already does for the native-engine-specific checkpoint collision.) Also removed the initLbugInner per-repoId initPromises dedup map: with every initLbug call now serialized through poolLock, a second call for a repoId already being initialized cannot observe a pending promise in initPromises (the first call always fully completes, including its finally-block cleanup, before the lock releases) — the branch was dead code the bot correctly flagged twice. Third review round caught two more follow-ups on the same theme (both introduced by making the idle sweep route through poolLock): - closeLbug()'s no-arg ("close everything") branch still calls closeOne directly in a loop over a snapshotted pool.keys(), without the lock — an initLbug racing that loop could register a fresh entry the snapshot never saw, leaving it resident after a call meant to empty the pool. Wrapped the snapshot+loop in withPoolLock. - The idle timer callback can now sit queued behind an in-progress initLbug before its turn arrives, and that init (or a concurrent touchRepo()) can refresh lastUsed in the meantime — so the pre-lock idleness check taken when the timer fired can be stale by the time it actually runs. Re-check lastUsed/checkedOut again inside the lock, right before closing, instead of trusting the outer snapshot. * fix(deps): pin @ladybugdb/core back to 0.18.3 Bisected the "checkpoint is in progress" symptom (root cause #2, not touched by the pool-adapter.ts fix in the previous commit) down to a single dependency-version-bump commit with zero application code changes: e91ea0ca, "chore(deps): bump @ladybugdb/core in /gitnexus", 0.18.3 -> 0.19.0. Confirmed both ends independently, on the actual official build (Dockerfile.cli), no engine-swapping involved: - v1.6.9 (native 0.18.3, as released): 7 tiny repos, 5 rounds of genuinely concurrent /api/graph requests each — 0/35 failures. - v1.6.10/v1.6.11 (native 0.19.1, as released): same repro — fails every round from round 2 onward. - v1.6.11 completely unmodified (not even this repo's own fix) with ONLY @ladybugdb/core downgraded to 0.18.3 (real `npm install @ladybugdb/core@0.18.3 --save-exact`, full rebuild, no application code touched): 0/56 failures across 8 rounds. That last point isolates this fully: none of GitNexus's own JS changes between 1.6.9 and 1.6.11 (including the dbIdentity/rebuild-detection logic added in #2614, or anything in sidecar-recovery.ts) are load-bearing for this symptom — the regression lives entirely in the native engine, introduced somewhere between 0.18.3 and 0.19.0. Full unit suite green with this pin (14818 passed, same 2 environment-specific flakes present on main regardless of this change — macOS realpath symlink resolution in analyzer-identity.test.ts and a subprocess retry-count assertion in review-agent-workflow.test.ts, neither touches lbug/ladybugdb). This is a pragmatic pin, not a long-term fix: 0.19.0+ presumably ships fixes of its own that 0.18.3 lacks, and the actual regression should still be root-caused and fixed upstream (tracked at LadybugDB/ladybug#919, which a maintainer is already engaging with). Recommend re-evaluating this pin once that's resolved. * fix(lbug): serialize closeLbug's single-repo branch with the pool lock Review on PR #3189 caught the same class of gap as three earlier rounds on the previous PR: closeOne now deletes the pool entry before its awaited db.close() finishes, so an initLbug(repoId, ...) racing this branch could acquire the lock right after the delete, see no cached entry, and start opening a fresh connection while this close's checkpoint is still in flight — reopening the exact race withPoolLock exists to close. The no-arg ("close everything") branch already went through the lock; this makes the single-repoId branch consistent with it. npx tsc --noEmit clean, full lbug/pool unit suite (19 files, 257 tests) green. * fix(lbug): address azizur100389's review findings on PR #3189 - pool-adapter.ts: the idle timer's in-lock recheck already re-verified lastUsed/checkedOut against a fresh snapshot, but not pinnedRepos — pinRepo() can run while the timer callback is queued behind an in-progress initLbug, and the timer would then still close a repo the caller just pinned, dropping that lease entirely (LOW finding). - Storage-version mismatches (opening an index written by a different @ladybugdb/core build, e.g. after downgrading the pinned dependency) surfaced as GitNexus's generic "unavailable, retry later" and were retried LOCK_RETRY_ATTEMPTS times for nothing, since the file's on-disk version never changes between retries (HIGH/blocking finding). Added isStorageVersionMismatchError() to lbug-config.ts and wired it into both places that actually open a LadybugDB connection: pool-adapter.ts's doInitLbug (used by MCP tools/wiki/group-sync) and lbug-adapter.ts's doInitLbug (the separate single-connection path /api/graph and /api/query use via withLbugDb). Both now fail fast with an actionable "run `gitnexus analyze --force`" message instead. In lbug-adapter.ts the check wraps both openLbugConnection and ensureReadOnlyConnectionUsable: the native engine's storage-version check isn't necessarily enforced until the first real query runs (ensureReadOnlyConnectionUsable's own probe), so openLbugConnection alone can succeed on a mismatched file. Verified end-to-end against the real native engine: registered a repo under the pinned 0.18.3 engine, swapped its .gitnexus/lbug file for one written by an unmodified v1.6.11 (0.19.1) image, restarted the server to bypass in-memory connection caching, and queried /api/graph — got the actionable message instead of the generic retry-later error. `npx tsc --noEmit` clean; full lbug/pool unit suite (36 tests, 14 files) green. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(test): export isStorageVersionMismatchError from wholesale lbug-config mocks doInitLbug's catch block (both pool-adapter.ts and lbug-adapter.ts) now calls isStorageVersionMismatchError() unconditionally on every open failure, but 5 test files wholesale-mock lbug-config.js without that export — Vitest rejects access to an undeclared mocked export, so any test driving an error through that catch block (e.g. the WAL-recovery and evict-reopen-race suites) breaks (bot finding on PR #3189). Added isStorageVersionMismatchError (stubbed to always return false — none of these suites exercise the storage-version path) and STORAGE_VERSION_MISMATCH_SUGGESTION to each mock, matching the existing isWalCorruptionError/WAL_RECOVERY_SUGGESTION pattern already there. analyze-pagesize-error.test.ts was not affected: it mocks lbug-config.js via importOriginal, so it already re-exports the real function. Verified: the 6 affected files (48 tests) pass; npx tsc --noEmit clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(test): export isStorageVersionMismatchError from remaining lbug-config mocks The previous commit fixed the 5 test files that wholesale-mock lbug-config.js via vi.mock(), but missed 4 more that mock it via vi.doMock() instead (a different Vitest API my earlier grep for vi.mock(...) didn't match): lbug-adapter-wal-schema.test.ts (8 call sites), lbug-checkpoint-lifecycle.test.ts (12 call sites), and basicblock-callee-ids-schema.test.ts / convex-metadata-persistence- contract.test.ts (1 shared mock factory each). All of these exercise lbug-adapter.ts's doInitLbug, which now also calls isStorageVersionMismatchError() unconditionally on every open failure — caught by actually running the full suite rather than trusting the `-t lbug` name filter, which doesn't match these files' test names. Verified: all 10 affected files (97 tests) pass; npx tsc --noEmit clean. Full suite rerun in progress to confirm no other gaps remain. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(lbug): fail-fast storage-version mismatch and unlock pool lock-retry Incremental analyze was warning through a version mismatch, and lock-retry sleep held the pool mutex so one analyze-locked repo blocked every other init. Fail immediately with the rebuild hint on both adapters, and sleep outside withPoolLock so other repos can open during backoff. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3189) - Serialize initLbugWithDb on withPoolLock so it cannot attach to a Database closeOne is still checkpointing. - Delete pin leases again after the awaited close so a pin acquired during teardown cannot survive onto the next init. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-12 14:49:21 +01:00
Gergő Magyar	ceaff27c1e	fix(parse-cache): retire a chunk whose durable generation could not be reset (#3271) ... * fix(parse-cache): retire a chunk whose durable generation could not be reset #3200 skipped the parse-cache write when `prepareDurableParsedFileChunk` failed, but the chunk hash was already in `usedKeys` from the lookup. When a previous generation existed on disk — reachable because the coherence gate re-dispatches a chunk whose `.v8` shard is live but whose durable shards are unreadable — `saveParseCache` copied that old shard forward, and the durable prune, which keeps exactly the saved keys, retained the mixed directory. The next run then served a warm hit out of a directory the previous run had already decided it could not account for. Retire the hash instead of only skipping the write: - `ParseCache.staleKeys` is a transient set that `saveParseCache` filters out of its key list. Filtering at save is what makes it survive the post-parse key merges in run-analyze (#2106 sibling fold, unreadable-meta retention), and it reaches both stores at once because the durable prune keeps exactly the keys `saveParseCache` returns. - The hash is retired at the reset-failure site, which runs unconditionally. The parse-cache write branch sits behind `rawResults.length > 0`, so a chunk whose worker round returns nothing would never have been retired there. - Worker-quarantined chunks get the same treatment for the same reason: they also reach the save with no in-memory entry, which is what triggers the copy-forward. That branch was previously unreachable when the worker died on the chunk and returned no results. - Guard the durable prune's non-survivor `fs.rm`. The causes that break the reset break that delete too, and it sat outside the validation try — one undeletable directory aborted the loop and cost every remaining chunk its index entry. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(review): apply review findings Retire a chunk only when a generation nobody cleared is still on disk. `prepareDurableParsedFileChunk` is rm-then-mkdir, and the catch could not tell the two apart: an rm that succeeded before a failing mkdir leaves NO directory, so the workers recreate it and write a clean generation. Retiring there discarded a good `.v8` for no safety gain — and under a correlated failure (an empty durable index turns every chunk into a re-dispatched miss, then a descriptor burst rejects the resets en masse) it would have wiped both shared stores for every branch, where the pre-#3204 posture cost only the writes. `durableChunkHasStaleShards` is the discriminator. Finish the delete guard on the path that runs before it. The staged→live overlay in `mergeStagedDurableParsedFileStore` awaited `replaceDurableChunkDir` unguarded, so on the cold-rebuild path one undeletable directory threw out of the merge before the prune ever ran — the durable index was never rewritten and a retired chunk kept its directory. Same log-and-continue treatment, plus best-effort handling of the two `.replacing` backup removals. Aggregate the prune's delete-failure warning: a store-wide cause hits every non-survivor, and one line per directory buries the message that matters. Tests: - Guard the chmod-based prune test with the repo's `skipIf` for root/Windows and assert the directory survived, so it cannot pass vacuously where the delete succeeds. - Add a two-chunk control: one chunk's reset fails, and the sibling must stay warm through the next run. One chunk plus a global spawn marker could not tell "retires the failing chunk" from "retires everything". - Add the rm-succeeded/mkdir-failed case, which must NOT retire. - Model both post-parse merges in the R4 test (the sibling fold re-adds the key, the unreadable-meta fallback unions `entries`), and move the in-memory `entries` assertion to a direct helper test — the sharded path never populates `entries`, so the old assertion proved nothing. - Type the cache factory as `ParseCache`; the `staleKeys` assertions were TS2339 and `?? false` read as a pass regardless. - Register the store test in the cross-platform filesystem list. Correct two comments that still described a quarantined chunk by the premise this fix disproves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(review): stop swallowing the backup removal in replaceDurableChunkDir Swallowing that `fs.rm` manufactured the very hazard this PR removes. When a non-empty `${to}.replacing` survives, the following `fs.rename(to, backup)` cannot overwrite it and is suppressed as "dest was missing", so `backedUp` stays false and the `fs.cp(from, to)` fallback merges the staged generation INTO the live directory — old shards alongside new, which the prune then indexes as one valid survivor. Let it throw; the per-entry guard added to `mergeStagedDurableParsedFileStore` already stops one such chunk from costing the others their prune. The post-publish backup cleanup stays best-effort, where an undeletable leftover really is litter. Also: - Make the sibling-isolation test perform the run its title claims. It asserted index membership and stopped; an index entry does not exercise the warm-hit path, so it would have passed even if the sibling re-dispatched. Each chunk now runs alone so the single spawn marker names which one re-parsed. - Correct two comments that outran the implementation: retirement is gated on shards actually surviving, and an undeletable directory is dropped from the index rather than removed from disk. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-12 12:16:45 +01:00
azizur100389	3f5ca8cdb7	fix(storage): guard stale file-lock reclamation (#3234) ... * fix(storage): guard stale file-lock reclamation * fix(storage): close lock recovery failure paths * Address PR review feedback (#3234) - Flush the lock-child stderr diagnostic before process.exit - Treat explicit NaN timeouts as the default ceiling - Document non-retryable guard timeouts on the worker IPC contract Co-authored-by: Cursor <cursoragent@cursor.com> * fix(storage): stop mislabeling live lock waits as orphan recovery A brief peer inspect must not attach guardPath or send operators to RUNBOOK delete steps. Refuse lock-free embeddings sync, stop --watch only on a true guard timeout, and drop an unreadable self-created guard before failing closed. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3234) - Verify lock/guard absence before degrading a denied main-lock create - Launch the third contender from unlinkSync, not the dead rename path - Document group-lock timeouts for unrecoverable guard leftovers Co-authored-by: Cursor <cursoragent@cursor.com> * style: prettier index-lock reclaim guard tests Co-authored-by: Cursor <cursoragent@cursor.com> * fix(storage): treat O_EXCL as the lock-file presence check CodeQL flagged existsSync-then-wx on analyze.lock. Create with wx first and only reclaim unreadable leftovers after grace, so a successor is never unlinked from a lost race. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-12 11:47:12 +01:00
Gergő Magyar	1f64becb30	fix(mcp): reject unknown tool arguments and honor depth (#3267)	2026-09-12 06:55:14 +00:00
Parafee41	68eca0ced8	fix: map deleted files to indexed symbol ranges (#3269) ... Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-12 06:14:13 +00:00
dependabot[bot]	75cc8dddbc	chore(deps)(deps): bump ignore from 7.0.8 to 7.0.9 in /gitnexus (#3265) ... Bumps [ignore](https://github.com/kaelzhang/node-ignore) from 7.0.8 to 7.0.9. - [Release notes](https://github.com/kaelzhang/node-ignore/releases) - [Commits](https://github.com/kaelzhang/node-ignore/compare/7.0.8...7.0.9) --- updated-dependencies: - dependency-name: ignore dependency-version: 7.0.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-12 06:49:34 +01:00
Sumiteshwark	68c42009df	fix(dart): anchor @name so a constructor initializer stops minting a … (#3224) ... * fix(dart): anchor @name so a constructor initializer stops minting a phantom A Dart declaration whose value is a constructor call parses the callee as a SECOND (identifier) sibling of the declared name: final TextEditingController _title = TextEditingController(); -> initialized_identifier[ identifier "_title", identifier "TextEditingController", selector ] The five graph-node rules that capture fields and top-level variables matched `(identifier) @name` without the first-child anchor, so @name bound to both siblings and the query minted a phantom Property/Variable named after the TYPE alongside the real declaration. On dart-flutter-conduit that produced a `Property TextEditingController` next to the genuine `_title` / `_body` in editor_screen.dart and login_screen.dart. static_final_declaration has the same shape, so class statics and top-level final/const were affected too, as were top-level `var`/`final` variables. All five rules now anchor @name with `.`, matching the mirror rules in languages/dart/query.ts which already anchored. Verified against the vendored grammar: the phantoms disappear and every real declaration is still captured (_title, _body, nullable field, static final, uninitialized field, top-level final, top-level var). End to end on dart-flutter-conduit: Property nodes 108 -> 106, type-shaped names 2 -> 0, real fields unchanged. The new test loads the grammar via createParserForLanguage rather than loadLanguage: loadLanguage resolves to void, so the surrounding `if (!(await loadDartOrSkip())) return;` idiom is always falsy and skips the body. Confirmed as a negative control -- reverting only the query change makes the new test fail on the exact phantom. * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3224) Correct the RHS_ONLY_TYPES comments so they state the capture invariant instead of claiming those names appear only as constructor callees. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3224) Build the Dart query with Parser.Query and parser.getLanguage() so the test no longer casts the tree (or Query/captures) through any. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-11 21:05:09 +01:00
Gergő Magyar	af2d9aec15	refactor(fts): share skip-FTS helpers and capability defaults (#3263) ... * refactor(fts): share skip-FTS helpers and capability defaults Keep analyze, repair, and HTTP open paths on one option/capability object so the same stamp cannot drift. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lbug): keep initLbug options as skipFts-only Restore the public initLbug and ensureFtsRowDmlSafe option shapes so one-arg callers stay on the pre-#3263 contract. Co-authored-by: Cursor <cursoragent@cursor.com> * revert(lbug): drop LbugInitOptions alias that tripped contract-drift Keep the session option objects as inline types so initLbug's public signature matches main byte-for-byte. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-11 20:17:18 +01:00
azizur100389	f8036ac349	feat(analyze): add explicit FTS opt-out (#3205) ... * feat(analyze): add explicit FTS opt-out * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(analyze): treat flag and env FTS opt-out as one mode Avoid a same-commit rebuild when only the skipReason discriminator changes, and advertise disablement on dirty meta before leftover indexes are wiped. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-11 14:05:28 +00:00
Aakash Sharma	d1a3edd333	perf(mcp): avoid O(n) git spawns on tools/list with many repos (#3259) ... * perf(mcp): avoid O(n) git spawns on tools/list with many repos toolSchemaRepoRequirements called listAllowedRepos -> listRepos -> checkStalenessAsync for every registered repo. With ~200 repos, this spawned 200 parallel git rev-list processes on every tools/list discovery call, causing a ~30s delay. Replaced with a lightweight countRepos() method that reads the registry file once without spawning git processes, preserving full staleness checks for list_repos. * Address PR review feedback (#3259) Count the validated registry in countRepos so tools/list cannot advertise a multi-repo schema for ENOENT ghosts, and update the unrestricted listTools mocks to that contract. Note: pre-existing failure in update-notice.test.ts (missing dist/cli/mcp.js) not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * Add a 200-repo tools/list bench for the countRepos path (#3259) Pin the #1363 comparison (listRepos git fan-out vs validated countRepos / listTools) in-tree so the latency claim can be re-run. Also drop the change-history comments on the unrestricted schema arm. Co-authored-by: Cursor <cursoragent@cursor.com> * Gate the tools/list bench with baselines and CI --check (#3259) Exact registry/schema floors plus ratio timing, no millisecond ceiling, so restoring listRepos() on tools/list fails CI. Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3259) Align unrestricted tools/list schema flags with the refreshed registry snapshot, and make the bench reject a non-positive BENCH_REPS and isolate fixtures by N. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3259) Isolate the tools/list bench from GITNEXUS_MCP_READ_ONLY and create the default fixture under mkdtempSync so CodeQL is not looking at a predictable /tmp path. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-11 13:18:28 +01:00
Gergő Magyar	7bbaf6b73b	fix(review): fail closed on foreign embedding identity and vector-width drift (#3260) ... Applied from a ce-code-review pass over this branch (run 20260911-053832-b49f88d6). - `embeddings sync` now gates EVERY checkpoint kind on embedding identity. `unverified-count` was exempted, but `decideEmbeddingResume` abandons that kind before it compares identity, so the exemption was the only thing keeping a foreign model from filling holes beside the old model's vectors — two vector spaces in one CodeEmbedding table, reported healthy. The test that asserted this run succeeds now asserts the refusal. - `embeddings sync` refuses when the index's recorded vector width differs from this run's. The column is FLOAT[N] fixed at build time and the pipeline deletes each batch's stale rows immediately before inserting, so a width change deleted rows it could not re-insert. `analyze` already forces a rebuild on the same mismatch; only a rebuild can retype the column. - `GITNEXUS_EMBEDDING_RETRY_TIMEOUTS` parses with the repo's truthy convention (`1`/`true`/`yes`). The integer parser threw on `true`, so the conventional spelling hard-failed every embedding call rather than enabling the flag or leaving it off. README names the accepted spellings. - One `persistMeta` write path replaces three inlined metadata read-modify-writes; #2790 traced two production drifts to hand-copied writers of these exact fields. - Tests: the pipeline mock now invokes `onCheckpointWindowStart`/`onCheckpoint`, so the resume contract actually executes under test. Added coverage for the incomplete-index refusal, the partial-checkpoint branch, and the body-read timeout retry site that the existing opt-in test never reached. Verified: tsc --noEmit clean; 99 tests pass across the three affected suites; prettier clean. Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-11 07:37:08 +00:00
Ankit Verma	8bd71c8335	feat(staleness): report diverged and unknown index state instead of fresh (#3257) ... * feat(staleness): report diverged and unknown index state instead of fresh A staleness check collapsed every git failure into { isStale: false, commitsBehind: 0 }. On a branch-pinned serve clone, a failed re-index leaves the recorded commit orphaned by the --depth 1 fetch; once the reflog expires and gc prunes it, rev-list fails and the index silently reads as fresh while still behind. checkStaleness / checkStalenessAsync now return an additive status: current, behind, diverged (rev-list failed but HEAD resolved and differs from lastCommit) or unknown (HEAD unresolvable, no lastCommit, timeout). isStale and commitsBehind keep their values in every case. One payload builder (core/staleness-status.ts) feeds MCP list_repos, the hot read tools and /api/repos + /api/repo. diverged carries a hint and no invented count; unknown appears on listings only. The helpers live in a pure module so existing vi.mock stubs of git-staleness stay valid. gitnexus group status no longer prints "-1 commits behind". Fixes #3256 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Address PR review feedback (#3257) - Document the `current` arm `fromHead` can return after a failed `rev-list`. The `staleness-status.ts` status list, the `fromHead` docstring and the `stalenessForTool` comment each named only `diverged`/`unknown`, so all three described a contract the helpers do not have. - Document both `unknown` rows on the group status type: no recorded commit (`indexStale: true`, `commitsBehind: -1`) and a git probe that could not answer (`indexStale: false`, `commitsBehind: 0`), which do not agree on either field. - Update both shipped `gitnexus-guide` copies to the new wire shape (`{ status, commitsBehind?, hint? }`), add a `diverged` example carrying no count, and state `unknown` is reported only by the `list_repos` listing. Presence now means "not `current`", not "behind N". Pinned in shipped-skills-sync. - Lock the timed-out `rev-list` short-circuit with staleness-timeout.test.ts: it asserts `unknown` from exactly one git spawn, so removing the `killed` guard (which would probe HEAD again and double the #3232 bound) now fails. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Claim only the uncountable gap in the diverged hint (#3257) `fromHead` reaches the `diverged` branch on any non-timeout `rev-list` failure where `rev-parse HEAD` resolves to a different SHA. It compares the two SHAs and runs no reachability check, so a transient object-read failure lands there while `lastCommit` is still an ancestor of HEAD — and the hint told the operator the commit was gone from history. `staleness-status.ts` already documents `diverged` as only "provably not at HEAD; the count is unknown", so the string was also the one place contradicting its own contract. The hint now states what the check established and hedges the usual cause: "Index is not at HEAD and the commit gap could not be counted — the recorded commit may no longer be in this clone's history." Updated with it: the `staleness.test.ts` diverged assertion, and the `diverged` example plus its lead-in sentence in both shipped `gitnexus-guide` copies (still byte-identical). `mcp/resources.ts` needs no change — it interpolates `staleness.hint`, holding no copy of the text. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(staleness): cover the remaining #3256 review test gaps The tri-review's lower-priority gaps, each now locked: - staleness-fallback.test.ts: after a failed (not timed-out) rev-list, both helpers report `current` when HEAD alone still resolves to the indexed commit, `diverged` when it resolves elsewhere, and `unknown` when it cannot be read, each from exactly rev-list + rev-parse. This complements staleness-timeout.test.ts: a timeout spawns once, any other failure probes HEAD. - list_repos carries the listing-only `unknown` and a count-free `diverged`; `current` carries nothing. - group status: a resolvable repo with no recorded commit composes to indexStale: true, commitsBehind: -1, status: unknown and renders as "STALE (? commits behind)", through the real groupStatus path rather than a hand-built row. Each test was checked against a mutation of the code it guards (the fromHead current arm, the group no-commit literal, list_repos includeUnknown); every mutation fails its test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: tech-admin3 <tech-admin@kodnest.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>	2026-09-11 08:07:37 +01:00
Parafee41	c9b391357e	fix(group): detect function-local Python imports (#3254) ... * fix(group): detect function-local Python imports * fix(group): parse Python imports structurally * fix(group): use safe Python parser wrapper * fix(group): isolate Python parse timeouts * fix(group): skip recovered indented Python from-imports Error-recovered trees can promote unclosed-docstring lookalikes into real import_from_statement nodes. Drop those indented imports, bound file reads, log parse timeouts, and add fingerprint floors for the tree-sitter scan. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-11 06:23:52 +00:00
panbergco	32a5fc3c4f	feat: Make long HTTP embedding jobs resumable (#3065) ... * Make long HTTP embedding jobs resumable Retry endpoint timeouts when explicitly configured, creating a fresh abort signal for every attempt. Add gitnexus embeddings to fill an existing index in place: every successful batch is durable, and rerunning skips vectors whose content hash still matches instead of rebuilding the structural graph. * Address PR review feedback (#3065) Hold the per-index lock around embeddings sync, fail closed on a foreign-identity partial checkpoint, and refuse to create an empty DB from leftover metadata. Use the canonical embedding count, keep closeLbug from masking the real error, load hashes instead of full vectors, and document GITNEXUS_EMBEDDING_RETRY_TIMEOUTS. Co-authored-by: Cursor <cursoragent@cursor.com> * Split embeddings sync off the install module so install no longer loads Ladybug. Share the opt-in TimeoutError wrap between fetch-throw and .json(), and cover a non-file LadybugDB path. Co-authored-by: Cursor <cursoragent@cursor.com> * Describe embeddings sync checkpoints as periodic and report cached node count. Pipeline checkpoints every 5,000 nodes, and fetchExistingEmbeddingHashes is keyed by nodeId, not vector rows. Co-authored-by: Cursor <cursoragent@cursor.com> * Leave an unverified-count checkpoint when embeddings sync cannot count rows. A finished run must not keep an interrupted window marker; the next sync should re-derive the count instead of hitting the identity gate. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: panbergco <panbergco@users.noreply.github.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-10 19:48:50 +01:00
auyua9	a4769439dd	fix(parse): retain metadata-only diff files (#3251) ... * fix(parse): retain metadata-only diff files * Address PR review feedback (#3251) Keep detect_changes honest on C-quoted, TAB-terminated, and ambiguous diff --git dests, and fail closed when a header cannot be parsed. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify parseDiffHunks dest-prefix helper (#3251) Drop the unused a/ prefix arm and the redundant empty-parse unparsed-header check. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(parse): ignore +++ inside hunks and accept mixed-quoted git headers Stop treating hunk-body lines as file headers, and parse independently C-quoted src/dest tokens on diff --git. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: ming <silverchris@foxmail.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-10 18:27:00 +01:00
Yahoo	0edf9ce0ff	fix(ruby): guard gem requires with dependency metadata (#3096) ... * docs(plans): add ruby gem require boundary plan * fix(ruby): guard gem requires with dependency metadata * fix(ruby): scope gem sources by manifest * test(ruby): model resolved lockfile specs * fix(ruby): stop local gem suffix fallthrough * docs: remove Ruby resolution plan * test(ruby): gate gem resolution correctness and scaling * test(ruby): align gem benchmark baseline with ratio gates * Address PR review feedback (#3096) - Strip a trailing .rb so local and external gem prefix matching follows Ruby's optional-suffix require. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-10 16:04:11 +01:00
JaysonAlbert	e7141ab0c1	fix(schema): persist Spring constructor-to-bean injection edges (#3239) ... Co-authored-by: Jayson Albert <momeijw@gamil.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-10 16:03:53 +01:00
Kevin Rajan	3236e2fbcd	fix(cobol): prefer copybook dirs so COPY EXTERNAL does not hit vendor decoys (#3240) ... * fix(cobol): prefer copybook dirs so COPY EXTERNAL does not hit vendor decoys COPY of an out-of-repo member first-won any same-named .cpy, so vendor/EXTERNAL.cpy became a live cobol-copy IMPORTS edge. Share one resolver between census and the regex processor: prefer copybooks/cpy/copy plus the importer dir when present, else fail-open. Drop COBOL KNOWN_GAPS. Fixes #2967 * bench(cobol): update depth budget for copybook-dir preference (#2967) COBOL resolver now prefers well-known copybook directories (copybooks/, cpy/, copy/, plus importer dir) over vendor paths when resolving COPY statements. This intentional behavior change moves the resolver from depth-free (prior measured ~0.885) to depth-sensitive (measured 1.751 on CI run 34394116972), because the new preferredCopybookDirs check walks path components. - Raise depth_budget from 1.6 to 2.4 (~1.37x the measured ratio) - Update _measured.depth_ratio from 0.885 to 1.751 - Add _cobol_copybook_dir_preference_2967 note documenting the change The COBOL fingerprints already reflect the new target set behavior (vendor/EXTERNAL.cpy correctly returns null when a copybook dir is present) per commit fc9e8270. Co-authored-by: Kevin Rajan <kvnloo@users.noreply.github.com> * bench(cobol): update baselines for copybook-dir preference (#2967) COBOL preferred-dir filtering now affects resolution outcomes. The unique-arm layouts (mixed copybooks/src dirs) drop from 1153 to 442 resolved as files outside preferred directories are correctly filtered. The collide arm (all files in svc${d}/copybooks) keeps 1153 resolved because ALL files remain in the preferred class. - Update small/deep resolved: 1153 → 442 - Update small/large/deep fingerprints for new target set - Raise heap_bound_bytes.cobol: 3500000 → 6200000 (1.5x measured 4112464 B) - Add measure.mjs exception: collide legitimately differs from small - Update _heap_bound_note with new cobol measurement context - Expand _cobol_copybook_dir_preference_2967 note to explain collide delta The collide arm now measures collision behavior within the preferred class rather than across mixed layouts — an intentional outcome of the preferred-dir semantics rather than a corpus defect. Refs #2967 Co-authored-by: Kevin Rajan <kvnloo@users.noreply.github.com> * fix(cobol): P1-A stem key with uppercase extensions, P1-B polyglot preferred-class latch P1-A: Use raw extension for path.basename so CUSTREC.CPY keys as CUSTREC - Before: path.basename('CUSTREC.CPY', '.cpy') -> 'CUSTREC.CPY' (no strip) - After: path.basename('CUSTREC.CPY', '.CPY') -> 'CUSTREC' (stripped) - Processor used raw extension; census now matches P1-B: Latch preferred-class only from copybook-tier paths - Before: docs/copy/README.md triggered hasPreferredDir = true - After: check preferred-dir only after extension filter - Processor receives polyglot allPathSet; test added Test coverage: - cobol-copy-external-imports.test.ts: processor pins for both fixes - cobol-import-target-parity.test.ts: resolver parity updated to new behavior - All existing COBOL tests pass Co-authored-by: Kevin Rajan <kvnloo@users.noreply.github.com> * test(cobol): fix Mixed.CPY integration test for P1-A behavior The integration test in cobol-import-index-reuse.test.ts had outdated expectations from before P1-A. With P1-A, path.basename uses the raw extension, so Mixed.CPY is now keyed as MIXED (extension stripped). Before (pre-P1-A): - Mixed.CPY → keyed as MIXED.CPY (uppercase ext not stripped) - COPY MIXED.CPY → found, COPY MIXED → null After (P1-A): - Mixed.CPY → keyed as MIXED (raw ext stripped) - COPY MIXED → found, COPY MIXED.CPY → null Updated test expectations to match P1-A behavior. All three validation tests now pass: - cobol-import-index-reuse.test.ts (integration, index reuse) - cobol-copy-external-imports.test.ts (processor P1-A/P1-B pins) - cobol-import-target-parity.test.ts (resolver parity) Fixes PER-994 CI failure on abhigyanpatwari/GitNexus#3240. Co-authored-by: Kevin Rajan <kvnloo@users.noreply.github.com> --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Kevin Rajan <kvnloo@users.noreply.github.com>	2026-09-10 15:42:59 +01:00
Abhinav Pandey	16307a11be	fix(flows): exclude guessed call edges from derived graph flows (#3193)	2026-09-10 13:15:30 +01:00
Abhinav Pandey	79f210c5b5	fix(go, workspace): resolve test siblings and tighten package discovery (#3191) ... * fix(go): resolve test helpers through package sibling tables * fix(workspace): discover source entries from scoped static configuration * Address PR review feedback (#3191) - Align sibling comments with the no-bare-name partition and drop the stale same-dir fallback claim. - Pin `_test.go` dot-import wildcard augmentation so a revert to nonTestFiles cannot stay green. Note: pre-existing failure in worker-pool startup crashes in the full vitest suite not addressed by this PR. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: tighten workspace discovery and index Go sibling bindings Skip leftover test/ workspace roots and extra Vite configs. Publish same-package Go names from per-package indexes instead of pairing every file. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-10 12:22:12 +01:00
Abhinav Pandey	2220f4d851	fix(resolution): label fallback guesses and preserve export visibility (#3190) ... * fix(resolution): distinguish name guesses and preserve export visibility * test(go): keep method enrichment fixture in one package * fix(resolution): address split review edge cases and evidence reporting * fix(exports): recognize imported and expression-local receivers * fix(resolution): align export and target evidence with language scope * fix(ingestion): preserve lexical import provenance through resolution * test(ci): rebalance Windows shards from measured slow suites * Address PR review feedback (#3190) - Label constructor unique-name guesses as global-name-fallback and run language vetoes - Tighten Go qualified, Rust crate::, and Ruby class-reopen fallback guards - Ignore for-loop shadowed CommonJS receivers and exclude guesses from the resolved-call census - Refresh FinalizeOutput and hook docs for lexical binding scopes Co-authored-by: Cursor <cursoragent@cursor.com> * Tighten review-feedback leftovers on fallback visibility. Qualified Go calls still respect export and test-package rules, nested Rust src/ stays a module segment, and top-level conditional this.x is treated as CommonJS. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * Address PR review feedback (#3190) - Distinguish Swift package prefixes when comparing target modules - Document lexical import binding and handledSites refusal marking - Drop the stale ci-scope-parity workflow claim and prototype-safe export verdicts Co-authored-by: Cursor <cursoragent@cursor.com> * Address PR review feedback (#3190) Supply caller source on Ruby visibility cases so they exercise the named allow branches instead of the missing-text bypass. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(resolution): label unique constructor types as name guesses A workspace-unique class hit in findClassBindingInScope was treated as an in-scope bind, so Go/JS constructor-form sites skipped the guess label and the Go unexported veto. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(resolution): keep qualified constructors precise after unique-name split Bare constructor unique-name hits stay guesses so Go can veto an unexported type. A written qualifier is now carried as rawQualifiedName so `new pkg.Foo()` and `models.Box[T]{}` can still recover the unique class without that veto. Co-authored-by: Cursor <cursoragent@cursor.com> * test(bench): rebaseline Go/Java scope-capture fingerprints for constructor qualifiers Generic Go composite literals and qualified Java `new pkg.Foo()` now carry @reference.qualified-name on existing constructor matches. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(resolution): treat import-reached unique constructors as precise C++ #include and Rust re-exports do not mint a lexical class binding. A unique type in an imported file (or imported directory) is therefore a real bind, not a name guess, so those CALLS edges stay import-resolved. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(resolution): require named or resolved imports for constructor precision Bare Go Box[T]{} is not package-qualified, and a sibling-file import of a different name is not constructor visibility. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-10 11:38:19 +01:00
ClayLeee	ab25b86807	fix(typescript): resolve tsconfig paths aliases on Windows (#3203) ... * fix(typescript): resolve tsconfig `paths` aliases on Windows `rebaseTarget` turns a `paths` target that `path.resolve` produced back into a repo-relative one, and it recognised the wildcard suffix only as `/*`. On Windows the resolved target is `C:\repo\src\*`, so the check never matched, the bare-`*` branch stripped the star, `path.relative` ate the trailing backslash, and every alias target came back as `src*`. `substituteStar` then built `srclib/date` from `@/lib/date`, nothing resolved, and every alias import was dropped as external — no IMPORTS/CALLS edge for anything reached through `@/`, so `impact` answered UNKNOWN for a repo's whole shared layer. Normalise the separator before looking at the suffix. `tsconfig-index.test.ts` already asserts the `src/*` shape and fails 4 of 13 cases on Windows without this; it only ever ran on Ubuntu, so add it to the cross-platform lane. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(typescript): make `paths` rebasing assertable from any runner `rebaseTarget` reads the platform separator, but the only suite covering it builds real directories — so on Ubuntu it sees `/` whatever the code does with `\`, and only the windows-latest lane can fail it. That is how an alias bug affecting every Windows install reached a green CI in the first place. Thread an injectable `pathApi` through `rebaseTarget` and `repoRelative` — the seam `isInside` and the `\\?\` prefix guard already use — and add a fixture-free suite that pins the win32 and POSIX branches explicitly. Deleting the separator normalisation now fails on every runner rather than only on windows-latest. Registered beside its fixture sibling in the cross-platform lane so the two halves of the same rule stay discoverable as one group. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(typescript): emit a bare `*` for a repo-root `paths` target A target naming the repo ROOT — `"*": ["./*"]` under `"baseUrl": "."` — rebases to an EMPTY repo-relative prefix, so only the suffix survived and the encoding came out as `/*`. `substituteStar` turns that into `/lib/date`, and `resolveFile` matches repo-relative keys without stripping a leading slash, so the indexed `lib/date.ts` misses and the alias is dropped as external. Emit the bare `*` for that case instead, which substitutes to `lib/date` and resolves. This is the shipped POSIX encoding as much as the Windows one, and it is what the Windows path emitted by accident before the separator was normalised — so the normalisation does not narrow what already resolved there. The common `"@/*": ["./src/*"]` is untouched: it has a real prefix and stays `src/*`. Pinned at all three levels the encoding passes through: the rebaser, on both path flavours; the loader, through a real fixture; and resolution, where `*` finds the file and `/*` does not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(test): say why the root-wildcard fixture declares no `baseUrl` The comment introduced the fixture as `"baseUrl": "."`, which the loader encodes as `''`, while the fixture passes `null` — a different scope, since `null` means the config declares no baseUrl at all and takes the paths arm alone. `null` is the right fixture and the comment was the wrong half: with `''` the baseUrl arm resolves `packages/utils/src/index` by itself, so the negative case would return null for a reason unrelated to the target encoding. Verified by substitution — `''` makes that assertion report the file instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-09-10 07:14:53 +01:00