gitnexus 1.6.0 → 1.6.1

package/dist/cli/analyze.js

@@ -18,7 +18,10 @@ import { runFullAnalysis } from '../core/run-analyze.js';
 import fs from 'fs/promises';
 const HEAP_MB = 8192;
 const HEAP_FLAG = `--max-old-space-size=${HEAP_MB}`;
-/** Re-exec the process with an 8GB heap if we're currently below that. */
+/** Increase default stack size (KB) to prevent stack overflow on deep class hierarchies. */
+const STACK_KB = 4096;
+const STACK_FLAG = `--stack-size=${STACK_KB}`;
+/** Re-exec the process with an 8GB heap and larger stack if we're currently below that. */
 function ensureHeap() {
     const nodeOpts = process.env.NODE_OPTIONS || '';
     if (nodeOpts.includes('--max-old-space-size'))
@@ -26,8 +29,13 @@ function ensureHeap() {
     const v8Heap = v8.getHeapStatistics().heap_size_limit;
     if (v8Heap >= HEAP_MB * 1024 * 1024 * 0.9)
         return false;
+    // --stack-size is a V8 flag not allowed in NODE_OPTIONS on Node 24+,
+    // so pass it only as a direct CLI argument, not via the environment.
+    const cliFlags = [HEAP_FLAG];
+    if (!nodeOpts.includes('--stack-size'))
+        cliFlags.push(STACK_FLAG);
     try {
-        execFileSync(process.execPath, [HEAP_FLAG, ...process.argv.slice(1)], {
+        execFileSync(process.execPath, [...cliFlags, ...process.argv.slice(1)], {
             stdio: 'inherit',
             env: { ...process.env, NODE_OPTIONS: `${nodeOpts} ${HEAP_FLAG}`.trim() },
         });
@@ -222,7 +230,24 @@ export const analyzeCommand = async (inputPath, options) => {
         console.warn = origWarn;
         console.error = origError;
         bar.stop();
-        console.error(`\n  Analysis failed: ${err.message}\n`);
+        const msg = err.message || String(err);
+        console.error(`\n  Analysis failed: ${msg}\n`);
+        // Provide helpful guidance for known large-repo failure modes
+        if (msg.includes('Maximum call stack size exceeded') ||
+            msg.includes('call stack') ||
+            msg.includes('Map maximum size') ||
+            msg.includes('Invalid array length') ||
+            msg.includes('Invalid string length') ||
+            msg.includes('allocation failed') ||
+            msg.includes('heap out of memory') ||
+            msg.includes('JavaScript heap')) {
+            console.error('  This error typically occurs on very large repositories.');
+            console.error('  Suggestions:');
+            console.error('    1. Add large vendored/generated directories to .gitnexusignore');
+            console.error('    2. Increase Node.js heap: NODE_OPTIONS="--max-old-space-size=16384"');
+            console.error('    3. Increase stack size: NODE_OPTIONS="--stack-size=4096"');
+            console.error('');
+        }
         process.exitCode = 1;
         return;
     }

package/dist/core/group/extractors/fs-utils.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Safely read a file inside a repo, rejecting any path that escapes
+ * `repoPath` via `..` traversal or absolute segments. Returns `null` if
+ * the path is outside the repo or the file can't be read.
+ *
+ * Used by every source-scan extractor under this directory. Kept as a
+ * single shared implementation so the path-traversal guard (security-
+ * sensitive) lives in exactly one place.
+ */
+export declare function readSafe(repoPath: string, rel: string): string | null;

package/dist/core/group/extractors/fs-utils.js

@@ -0,0 +1,24 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/**
+ * Safely read a file inside a repo, rejecting any path that escapes
+ * `repoPath` via `..` traversal or absolute segments. Returns `null` if
+ * the path is outside the repo or the file can't be read.
+ *
+ * Used by every source-scan extractor under this directory. Kept as a
+ * single shared implementation so the path-traversal guard (security-
+ * sensitive) lives in exactly one place.
+ */
+export function readSafe(repoPath, rel) {
+    const abs = path.resolve(repoPath, rel);
+    const base = path.resolve(repoPath);
+    const relToBase = path.relative(base, abs);
+    if (relToBase.startsWith('..') || path.isAbsolute(relToBase))
+        return null;
+    try {
+        return fs.readFileSync(abs, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}

package/dist/core/group/extractors/grpc-extractor.d.ts

@@ -1,16 +1,25 @@
 import type { ContractExtractor, CypherExecutor } from '../contract-extractor.js';
 import type { ExtractedContract, RepoHandle } from '../types.js';
+export interface ProtoServiceInfo {
+    package: string;
+    serviceName: string;
+    methods: string[];
+    protoPath: string;
+}
+export declare function buildProtoMap(repoPath: string): Promise<Map<string, ProtoServiceInfo[]>>;
+export declare function resolveProtoConflict(_serviceName: string, sourceFilePath: string, candidates: ProtoServiceInfo[]): ProtoServiceInfo | null;
+export declare function serviceContractId(pkg: string, serviceName: string): string;
 export declare class GrpcExtractor implements ContractExtractor {
     type: "grpc";
     canExtract(_repo: RepoHandle): Promise<boolean>;
     extract(_dbExecutor: CypherExecutor | null, repoPath: string, _repo: RepoHandle): Promise<ExtractedContract[]>;
-    private parseProtoFile;
-    private scanGoProviders;
-    private scanGoConsumers;
-    private scanJavaProviders;
-    private scanJavaConsumers;
-    private scanPythonProviders;
-    private scanPythonConsumers;
-    private scanTsProviders;
+    /**
+     * Convert a plugin `GrpcDetection` into a concrete `ExtractedContract`
+     * by resolving the short service name against the proto map, building
+     * either a service-level (`grpc::pkg.Svc/*`) or method-level
+     * (`grpc::pkg.Svc/Method`) contract id, and selecting confidence
+     * based on whether the proto map had an entry.
+     */
+    private detectionToContract;
     private dedupe;
 }