Add CHANGELOG.md with release notes for v1.3.10 covering MCP transport
security hardening, dual-framing compatibility, lazy CLI loading, and
bug fixes from recent PRs.
* Fix MCP startup transport compatibility
* Preserve CLI flags in MCP startup fix
* Harden MCP transport error handling
* Harden transport security and improve type safety
Transport hardening:
- Add MAX_BUFFER_SIZE (10 MB) cap to prevent OOM from oversized
Content-Length or unbounded newline-delimited input
- Replace recursive readNewlineMessage with iterative loop to prevent
stack overflow from consecutive empty lines
- Tighten looksLikeContentLength to require 14+ bytes before matching
- Add closed-state guard and error handling to send()
- Simplify processReadBuffer loop to break on error
- Fix loose equality (==) to strict (===)
- Widen constructor param types to ReadableStream/WritableStream
Type safety:
- Constrain createLazyAction generics so export name is validated
against the module's actual exports at compile time
- Use proper type guard instead of lint suppression
- Fix test tsconfig type errors
Regression tests for all hardening fixes (13 tests passing).
---------
Co-authored-by: Gergo Magyar <gergomagyar@icloud.com>
Regenerated CLAUDE.md and AGENTS.md using gitnexus@1.3.9 which replaces
the old skill-router format with inline imperative instructions (PR #190).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
findEnclosingFunctionId generated IDs without :startLine suffix,
but node creation includes it. This caused every CALLS edge to
reference a non-existent source node, making the process detector
find 0 entry points and produce 0 execution flows.
Bumps to 1.3.9.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
KuzuDB's native module holds open handles that prevent Node.js from
exiting cleanly. Previously only force-exited when embeddings were used
(for ONNX Runtime segfault workaround), but the same issue affects all
analyze runs. Now always calls process.exit(0) after completion.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
CLAUDE.md and AGENTS.md now contain direct enforcement instructions instead
of a passive skill router table. Based on Vercel eval data showing skills
are skipped 56% of the time, and industry research on effective AGENTS.md
patterns from 2,500+ repos.
Key changes:
- Always/When/Never three-tier boundary structure
- RFC 2119 language (MUST, NEVER) for critical rules
- Exact tool commands with parameters inline
- Self-check checklist forcing model to verify its own work
- ~77 lines, well within the <150 line adherence threshold
Skills are still installed as bonus depth for Claude Code's skill system.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Merged PR #133 which adds AST-based Laravel Route::* extraction.
Reverted AGENTS.md, CLAUDE.md, and README.md to preserve current config,
crypto warning, Discord link, and correct language support count (12,
including Kotlin/Swift).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When a repo has no parseable files (e.g., unsupported languages or all
files filtered out), chunks.reduce returns 0, causing createASTCache(0)
to pass max:0 to LRUCache which throws TypeError. This clamps maxSize
to at least 1 and adds a progress message when no parseable files exist.
Instead of crashing the pipeline when a native tree-sitter binding
(e.g. tree-sitter-swift) fails to build, skip those files early and
warn the user with an actionable message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Resolved FUNCTION_NODE_TYPES: keep 'anonymous_function' for PHP (php_only grammar),
add Kotlin 'lambda_literal' and Swift 'init_declaration'/'deinit_declaration'
- Resolved pipeline.ts: adopt chunked pipeline structure, integrate
processRoutesFromExtracted into per-chunk worker data processing
- Resolved framework-detection.ts: use upstream AST-BASED FRAMEWORK DETECTION heading
- Fixed accumulated/mergeResult in parse-worker to include routes field
The Kotlin PR added tree-sitter-kotlin to package.json but didn't
include the lockfile update, causing npm ci to fail in CI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
forceExit killed the fork worker before local-backend.test.ts finished,
losing 12 test results. The real issue is KuzuDB's C++ destructor
segfaulting during fork process exit — all tests pass but vitest
reports the post-test crash as a failure.
dangerouslyIgnoreUnhandledErrors ignores the process-level crash
without affecting test results (98/98 tests still run and report).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
KuzuDB's C++ destructor crashes the vitest fork worker on exit,
causing a ~7 minute hang before timeout. forceExit kills the
worker immediately after tests complete.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub Actions shallow clones don't have the root commit available,
causing checkStaleness to fail silently. HEAD~1 is always available.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- 59 test files covering unit and integration tests
- vitest config with coverage thresholds and fork pooling
- Test fixtures (mini-repo + multi-language sample code)
- Add vitest + coverage-v8 to devDependencies
- Add test scripts (test, test:integration, test:all, test:watch, test:coverage)
- Move typescript to devDependencies where it belongs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add workflow_call trigger to ci.yml so publish can reuse it as a gate
- Replace minimal publish.yml with hardened pipeline:
- Full CI must pass before publish (typecheck + tests + cross-platform)
- Verify git tag matches package.json version
- Explicit build step + dry-run before real publish
- npm provenance attestation enabled
- Auto-create GitHub Release with generated notes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Merge origin/main which moves tree-sitter-swift to optionalDependencies
with conditional imports. Reorder Kotlin entries before C/C++/PHP in all
files so they don't sit adjacent to Swift entries, preventing future
merge conflicts when upstream modifies Swift support.
The PR merge reverted the Swift install fix. tree-sitter-swift must be
in optionalDependencies with conditional createRequire imports, otherwise
npm install fails on systems where the native build can't succeed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The disconnect() method was unconditionally importing embedder.js on
every graceful shutdown, which loads @huggingface/transformers and
onnxruntime-node — triggering the exact crash this branch fixes.
Since process.exit(0) follows immediately, the OS reclaims all
resources without needing disposeEmbedder(). Matches the pattern
already established in analyze.ts (lines 318-320).
Fixes#89
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add endsWith('.*') check before appending wildcard suffix to prevent
possible double-append if grammar returns identifier text that already
includes the wildcard.
The heritage query only matched bare user_type delegation specifiers
(interface implementation), missing constructor_invocation patterns
used for class extension. Adds a second heritage pattern for
constructor invocations, capturing ~3x more heritage edges.
tree-sitter-kotlin (fwcd) has no interface_declaration node — both
interfaces and classes are class_declaration nodes. Use anonymous
keyword literal matching ("interface" vs "class") to produce the
correct @definition.interface / @definition.class captures.
Verified against two real Kotlin repos: a small one (3 Interface,
92 Class) and a large one (35 Interface, 677 Class, 5998 Function).
The backend `/api/repo` endpoint returns `path` but `ServerRepoInfo`
expects `repoPath`, causing `undefined.split('/')` crash in App.tsx
when connecting to a local gitnexus serve instance.
Fixes#92
