mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-17 23:52:36 +00:00
* fix(hooks): pass windowsHide:true to every spawnSync to suppress flashing console windows on Windows
On Windows, every PostToolUse and Stop event from Claude Code (and
the Cursor integration variant) cold-spawns ``node`` / ``npx.cmd`` /
``git`` / ``lsof`` through ``child_process.spawnSync``. Without
``windowsHide: true`` in the options, Node's child_process module
asks ``CreateProcess`` to use ``STARTF_USESHOWWINDOW`` with
``SW_SHOWDEFAULT``, and a black console window flashes onto the
user's desktop for the duration of the call. Under active
editor / agent use this means a near-continuous stream of pop-up
windows — unusable in practice (reported live on a Windows 11
workstation running the gitnexus Claude plugin against an active
project; the flashes stack on the taskbar and steal focus from the
editor).
The Node fix is one option flag per spawnSync:
spawnSync(cmd, args, {
encoding: 'utf-8',
timeout,
cwd,
stdio: ['pipe', 'pipe', 'pipe'],
windowsHide: true, // <-- new
});
``windowsHide`` is a no-op on macOS/Linux (Node docs: "Hide the
subprocess console window that would normally be created on Windows
systems"), so the patch is platform-neutral and zero-risk on the
other two majors.
This commit touches every ``spawnSync`` call in the three sources
that ship the hook layer:
* gitnexus/hooks/claude/gitnexus-hook.cjs (4 sites)
* gitnexus/hooks/claude/hook-db-lock-probe.cjs (3 sites)
* gitnexus-claude-plugin/hooks/gitnexus-hook.js (6 sites)
* gitnexus-claude-plugin/hooks/hook-db-lock-probe.cjs (3 sites)
* gitnexus-cursor-integration/hooks/gitnexus-hook.cjs (3 sites)
Total: 19 spawn sites guarded. ``hook-lock.cjs`` / ``hook-lock.js``
don't spawn subprocesses; nothing else in the hooks/ dirs touches
``child_process``.
Verified on Windows 10 22H2 / Node 22.21 / gitnexus 1.6.5 by
installing the locally-built tarball and running an active Claude
Code session against a large mixed-language repo — no console
window appears for any hook fire (pre-fix: ~2-3 visible flashes per
edit). No behavioural change on Linux/macOS hosts.
* test(hooks): regression — every hook spawnSync paired with windowsHide:true
Source-level assertion that every ``spawnSync`` invocation in the
hook layer has a matching ``windowsHide: true`` in its options
object. Without the flag, Node's child_process module asks
CreateProcess to use STARTF_USESHOWWINDOW with SW_SHOWDEFAULT and
a black console window flashes onto the user's desktop for the
duration of each call — see the parent fix commit.
The check is source-level rather than behavioural because:
* the flag's effect is observable only on Windows;
* GitHub Actions runs vitest on Linux for the hook tests;
* regressing this is easy (every new spawnSync site has to remember
to add the flag), and a runtime check on a Windows-only CI leg
would still let a PR land on the main branch first.
Counts spawnSync occurrences and windowsHide:true occurrences per
file (in code, ignoring comments) and asserts equality. Five files
covered:
* gitnexus/hooks/claude/gitnexus-hook.cjs
* gitnexus/hooks/claude/hook-db-lock-probe.cjs
* gitnexus-claude-plugin/hooks/gitnexus-hook.js
* gitnexus-claude-plugin/hooks/hook-db-lock-probe.cjs
* gitnexus-cursor-integration/hooks/gitnexus-hook.cjs
Adding a new hook file requires updating the HOOK_FILES tuple. A
sanity assertion ``spawnCount > 0`` catches accidental deletion of
all spawn calls in a future refactor (would otherwise silently make
the count-equality assertion trivially true).
Sits next to the existing "no shell: true" and ".cmd extension"
regression tests in test/unit/hooks.test.ts — same shape, same
spirit.
* fix(src): extend windowsHide:true to every spawn-family call in cli/core/mcp/server
Companion to the hook-layer fix in this branch's first commit. The
same Windows console-window flash bug applies to every
``spawn`` / ``spawnSync`` / ``execFile`` / ``execFileSync`` /
``execFileAsync`` / ``execSync`` call in the source tree — not just
the hooks. The MCP local backend
(``src/mcp/local/local-backend.ts``) and the ``gitnexus serve`` git
helpers (``src/server/git-clone.ts``) are particularly bad because
they run from daemonized processes that have no parent console; the
spawned child auto-allocates one and it pops onto the user's
desktop. The CLI sites are less visible (the user is at a terminal
with an existing console; ``stdio: 'inherit'`` shares it) but the
flag is harmless there — windowsHide only suppresses NEW console
allocation, an inherited parent console is untouched. The visible
output of ``gitnexus analyze`` and friends is preserved verbatim.
The pre-existing fix at ``src/core/lbug/extension-loader.ts:96``
established the convention in this codebase. This commit applies it
uniformly.
Sites covered (21 new):
| File | Sites |
|---|---|
| src/cli/analyze.ts | 1 |
| src/cli/setup.ts | 2 |
| src/cli/wiki.ts | 3 |
| src/core/embeddings/embedder.ts | 1 |
| src/core/git-staleness.ts | 3 |
| src/core/run-analyze.ts | 1 |
| src/core/wiki/cursor-client.ts | 2 |
| src/core/wiki/generator.ts | 3 |
| src/mcp/local/local-backend.ts | 2 |
| src/server/git-clone.ts | 2 |
| src/core/lbug/extension-loader.ts | (already had it, untouched) |
Combined with the 19 hook sites from the first commit + the 1
pre-existing extension-loader site, the codebase now has uniform
``windowsHide: true`` on every spawn-family call.
Behavioural notes:
* ``windowsHide`` is documented by Node as a no-op on POSIX —
Linux/macOS hosts see byte-identical behaviour.
* ``stdio: 'inherit'`` callers (e.g. ``cli/wiki.ts:522`` opens the
editor in the user's terminal) keep their interactive UX. The
child inherits the parent's stdio handles; no new console is
allocated; the flag has nothing to hide.
* Piped callers (``stdio: ['pipe',…]``) continue to deliver every
byte of stdout/stderr back to the parent for the parent to log
/ process / re-print. No output is swallowed.
* ``execSync`` / ``execFileSync`` callers that previously had no
``stdio`` option (e.g. ``generator.ts:887`` ``execSync('git
rev-parse HEAD', { cwd })``) keep their default pipe semantics
(``.toString()`` still works) — windowsHide is added alongside
the existing ``cwd`` option.
Verified on Windows 10 22H2 / Node 22.21 by installing the locally
built tarball and exercising:
* MCP detect_changes via the local backend → no flash.
* gitnexus serve → no flash on git clone/clone-pull.
* gitnexus analyze interactively → output appears in terminal as
before, no extra window.
* test(windowsHide): extend regression to every spawn-family call in src/
Companion to the src/ patch. The hooks.test.ts regression now
covers 16 files (5 hooks + 11 source files), and asserts the
invariant for every spawn-family function — not just spawnSync.
Changes:
* Generalise countSpawnCalls() to also count spawn, execFile,
execFileSync, execFileAsync, execSync (the entire spawn-family
surface of child_process). Skip method calls (e.g. RegExp.exec)
via a negative-lookbehind on ``.``.
* Add SRC_FILES table with all 11 source-tree files that import
spawn-family functions from child_process.
* Loop over [...HOOK_FILES, ...SRC_FILES] so a regression in any
file fails the same test name.
* Tighten the assertion to ``hideCount >= spawnCount`` rather
than strict equality, because some sites (e.g. setup.ts:534
using execFileAsync via shell:true on Windows) may legitimately
add windowsHide to nested option objects in future refactors.
* Sanity gate ``spawnCount > 0`` per file catches a refactor
that deletes all spawn calls (would otherwise make the
assertion trivially true).
Manually exercised against the patched repo:
16 files, 28 total spawn-family calls, 28 windowsHide:true.
All pass.
The convention to keep this list in sync: every new file in
gitnexus/src/ that imports from 'child_process' must be added to
the SRC_FILES tuple. The cost is one line per file; the benefit
is the next contributor never has to think about windowsHide
again — the test will catch a miss before merge.
* style: prettier --write on storage/git.ts + hooks.test.ts
CI quality / format job flagged two formatting issues in the
merge-resolution commit: a long single-line options object in
storage/git.ts and similar in hooks.test.ts. prettier --write
fixes both with the project's standard wrap-and-trailing-comma
style. No semantic change.
* test(git): include windowsHide in toHaveBeenCalledWith assertion
The merge-resolution commit added windowsHide:true to the
'git rev-parse --is-inside-work-tree' execSync call in
src/storage/git.ts, but the matching strict-shape assertion in
git.test.ts:31-34 still expected the pre-patch two-key options
object {cwd, stdio}. vitest's toHaveBeenCalledWith does a deep
structural match, so the extra third key flipped the assertion
to fail.
Add windowsHide: true to the expected shape. Only this one
assertion is strict; the two siblings ('passes the correct cwd'
and the no-cwd-arg case) use expect.objectContaining and
expect.any(String) and remain green without modification.
* test(setup-codex): include windowsHide in execFile shape assertions
Same root cause as the git.test.ts fix on this branch: the windowsHide
patch added windowsHide:true to the execFile() options in
src/cli/setup.ts, but three strict-shape toHaveBeenCalledWith
assertions in setup-codex.test.ts still expected the pre-patch
{shell:true} / {shell:false} two-key options. vitest does a deep
structural match, so the extra key flipped the assertions to fail
on every CI matrix leg (ubuntu coverage + macos + windows).
Adding windowsHide:true alongside the existing 'shell' key in
all three sites.
* ci: retrigger checks
go-parity failed on a flaky onnxruntime-node postinstall network timeout
(AggregateError [ETIMEDOUT] in node ./script/install), which cascaded into
the CI Gate. No code change — empty commit to re-run the pipeline.
* fix(test): strengthen windowsHide regression assertions (PR #1794 review)
- Replace toBeGreaterThanOrEqual with exact toBe per DoD §2.7
- Remove unused `m` variable in countSpawnCalls (CodeQL finding)
- Add windowsHide: true to runGit test helper for consistency
---------
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
Co-authored-by: ManniX-ITA <35522085+ManniX-ITA@users.noreply.github.com>
Co-authored-by: Test <test@example.com>
269 lines
7.4 KiB
JavaScript
269 lines
7.4 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* GitNexus Cursor postToolUse Hook
|
|
*
|
|
* Receives a JSON event on stdin describing a finished tool call, derives a
|
|
* search pattern (Grep query, Read file basename, or rg/grep arg from a Shell
|
|
* command), runs `gitnexus augment <pattern>`, and emits the enriched context
|
|
* back as `{ additional_context: "..." }` so the agent sees it alongside the
|
|
* tool result.
|
|
*
|
|
* Replaces the legacy beforeShellExecution / augment-shell.sh pipeline:
|
|
* - Cross-platform (no bash, no jq — runs on Windows out of the box)
|
|
* - Covers Read and Grep, not just Shell rg/grep
|
|
*
|
|
* Cursor 2.4+ generic hooks: https://cursor.com/docs/agent/hooks
|
|
*/
|
|
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const { spawnSync } = require('child_process');
|
|
const { acquireHookSlot } = require('./hook-lock.cjs');
|
|
|
|
function readInput() {
|
|
try {
|
|
const data = fs.readFileSync(0, 'utf-8');
|
|
return JSON.parse(data);
|
|
} catch {
|
|
return {};
|
|
}
|
|
}
|
|
|
|
function isGlobalRegistryDir(candidate) {
|
|
if (fs.existsSync(path.join(candidate, 'meta.json'))) return false;
|
|
return (
|
|
fs.existsSync(path.join(candidate, 'registry.json')) ||
|
|
fs.existsSync(path.join(candidate, 'repos'))
|
|
);
|
|
}
|
|
|
|
function walkForGitNexusDir(startDir) {
|
|
let dir = startDir;
|
|
for (let i = 0; i < 5; i++) {
|
|
const candidate = path.join(dir, '.gitnexus');
|
|
if (fs.existsSync(candidate)) {
|
|
if (!isGlobalRegistryDir(candidate)) return candidate;
|
|
}
|
|
const parent = path.dirname(dir);
|
|
if (parent === dir) break;
|
|
dir = parent;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function findCanonicalRepoRoot(cwd) {
|
|
try {
|
|
const result = spawnSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], {
|
|
encoding: 'utf-8',
|
|
timeout: 2000,
|
|
cwd,
|
|
stdio: ['pipe', 'pipe', 'pipe'],
|
|
windowsHide: true,
|
|
});
|
|
if (result.error || result.status !== 0) return null;
|
|
const commonDir = (result.stdout || '').trim();
|
|
if (!commonDir || !path.isAbsolute(commonDir)) return null;
|
|
return path.dirname(commonDir);
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function findGitNexusDir(startDir) {
|
|
const cwd = startDir || process.cwd();
|
|
const fromCwd = walkForGitNexusDir(cwd);
|
|
if (fromCwd) return fromCwd;
|
|
const canonicalRoot = findCanonicalRepoRoot(cwd);
|
|
if (canonicalRoot && canonicalRoot !== cwd) {
|
|
return walkForGitNexusDir(canonicalRoot);
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function parseRgGrepPattern(cmd) {
|
|
const tokens = cmd.split(/\s+/);
|
|
let foundCmd = false;
|
|
let skipNext = false;
|
|
const flagsWithValues = new Set([
|
|
'-e',
|
|
'-f',
|
|
'-m',
|
|
'-A',
|
|
'-B',
|
|
'-C',
|
|
'-g',
|
|
'--glob',
|
|
'-t',
|
|
'--type',
|
|
'--include',
|
|
'--exclude',
|
|
]);
|
|
|
|
for (const token of tokens) {
|
|
if (skipNext) {
|
|
skipNext = false;
|
|
continue;
|
|
}
|
|
if (!foundCmd) {
|
|
if (/\brg$|\bgrep$/.test(token)) foundCmd = true;
|
|
continue;
|
|
}
|
|
if (token.startsWith('-')) {
|
|
if (flagsWithValues.has(token)) skipNext = true;
|
|
continue;
|
|
}
|
|
const cleaned = token.replace(/['"]/g, '');
|
|
return cleaned.length >= 3 ? cleaned : null;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Extract a search pattern from the tool input. Cursor 2.4 docs at
|
|
* https://cursor.com/docs/agent/hooks list the tool *matchers* but do not
|
|
* formally specify the per-tool tool_input field names, so we probe a
|
|
* generous set of MCP-style aliases. As a last-resort fallback for Grep
|
|
* (the highest-frequency search path) we also accept the longest plausible
|
|
* string value in tool_input. Set GITNEXUS_DEBUG=1 to log the raw payload
|
|
* to stderr if Cursor changes the contract and aliases stop matching.
|
|
*/
|
|
function pickLongestStringValue(obj) {
|
|
let best = null;
|
|
if (!obj || typeof obj !== 'object') return null;
|
|
for (const v of Object.values(obj)) {
|
|
if (typeof v === 'string' && v.length >= 3 && (!best || v.length > best.length)) {
|
|
best = v;
|
|
}
|
|
}
|
|
return best;
|
|
}
|
|
|
|
function extractPattern(toolName, toolInput) {
|
|
const t = (toolName || '').toLowerCase();
|
|
|
|
if (t === 'grep') {
|
|
const aliases = [
|
|
toolInput.query,
|
|
toolInput.pattern,
|
|
toolInput.regex,
|
|
toolInput.q,
|
|
toolInput.search,
|
|
toolInput.searchQuery,
|
|
];
|
|
for (const a of aliases) {
|
|
if (typeof a === 'string' && a.length >= 3) return a;
|
|
}
|
|
// Last resort: scan tool_input for any reasonable-looking string value.
|
|
return pickLongestStringValue(toolInput);
|
|
}
|
|
|
|
if (t === 'read') {
|
|
const filePath =
|
|
toolInput.target_file ||
|
|
toolInput.file_path ||
|
|
toolInput.filePath ||
|
|
toolInput.path ||
|
|
toolInput.file ||
|
|
'';
|
|
if (!filePath) return null;
|
|
const base = path.basename(String(filePath), path.extname(String(filePath)));
|
|
const cleaned = base.replace(/[^a-zA-Z0-9_]/g, '');
|
|
return cleaned.length >= 3 ? cleaned : null;
|
|
}
|
|
|
|
if (t === 'shell') {
|
|
const cmd = toolInput.command || '';
|
|
if (!/\brg\b|\bgrep\b/.test(cmd)) return null;
|
|
// NOTE: parseRgGrepPattern uses split(/\s+/) and cannot handle shell
|
|
// quoting. `rg "User Service" src/` returns "User" (the first token
|
|
// after the rg/grep arg, with surrounding quotes stripped) — the
|
|
// multi-word pattern is intentionally not reconstructed since BM25 is
|
|
// already token-tolerant. Quoted single tokens (`rg "validateUser"`)
|
|
// work fine.
|
|
return parseRgGrepPattern(cmd);
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
function resolveCliPath() {
|
|
try {
|
|
return require.resolve('gitnexus/dist/cli/index.js');
|
|
} catch {
|
|
return '';
|
|
}
|
|
}
|
|
|
|
function runGitNexusCli(cliPath, args, cwd, timeout) {
|
|
const isWin = process.platform === 'win32';
|
|
if (cliPath) {
|
|
return spawnSync(process.execPath, [cliPath, ...args], {
|
|
encoding: 'utf-8',
|
|
timeout,
|
|
cwd,
|
|
stdio: ['pipe', 'pipe', 'pipe'],
|
|
windowsHide: true,
|
|
});
|
|
}
|
|
return spawnSync(isWin ? 'npx.cmd' : 'npx', ['-y', 'gitnexus', ...args], {
|
|
encoding: 'utf-8',
|
|
timeout: timeout + 5000,
|
|
cwd,
|
|
stdio: ['pipe', 'pipe', 'pipe'],
|
|
windowsHide: true,
|
|
});
|
|
}
|
|
|
|
function main() {
|
|
try {
|
|
const input = readInput();
|
|
if (process.env.GITNEXUS_DEBUG) {
|
|
// Echo the payload so users can capture Cursor's actual contract when
|
|
// diagnosing why augmentation isn't firing. Stderr only — stdout is
|
|
// reserved for the JSON response Cursor consumes.
|
|
try {
|
|
process.stderr.write(
|
|
`GitNexus Cursor hook stdin: ${JSON.stringify(input).slice(0, 500)}\n`,
|
|
);
|
|
} catch {
|
|
/* never let debug logging break the hook */
|
|
}
|
|
}
|
|
const cwd = input.cwd || process.cwd();
|
|
if (!path.isAbsolute(cwd)) return;
|
|
const gitNexusDir = findGitNexusDir(cwd);
|
|
if (!gitNexusDir) return;
|
|
|
|
const toolName = input.tool_name || '';
|
|
const toolInput = input.tool_input || {};
|
|
|
|
const pattern = extractPattern(toolName, toolInput);
|
|
if (!pattern || pattern.length < 3) return;
|
|
|
|
const release = acquireHookSlot(gitNexusDir);
|
|
if (!release) return;
|
|
|
|
const cliPath = resolveCliPath();
|
|
let result = '';
|
|
try {
|
|
const child = runGitNexusCli(cliPath, ['augment', '--', pattern], cwd, 7000);
|
|
if (!child.error && child.status === 0) {
|
|
result = child.stderr || '';
|
|
}
|
|
} catch {
|
|
/* graceful failure */
|
|
} finally {
|
|
release();
|
|
}
|
|
|
|
if (result && result.trim()) {
|
|
console.log(JSON.stringify({ additional_context: result.trim() }));
|
|
}
|
|
} catch (err) {
|
|
if (process.env.GITNEXUS_DEBUG) {
|
|
console.error('GitNexus Cursor hook error:', (err.message || '').slice(0, 200));
|
|
}
|
|
}
|
|
}
|
|
|
|
main();
|