gitnexus 1.6.10-rc.17 → 1.6.10-rc.18

package/dist/server/analyze-launch.d.ts

@@ -17,6 +17,12 @@ export interface LaunchDeps {
     };
     acquireRepoLock: (key: string) => string | null;
     releaseRepoLock: (key: string) => void;
+    /**
+     * Drops the server's cached LadybugDB handle (closeLbug). The worker
+     * process rewrites the repo's DB files on disk, so a connection opened
+     * before the rewrite keeps reading the pre-rewrite state until evicted.
+     */
+    closeDbHandle: () => Promise<void>;
 }
 export interface LaunchOptions {
     force?: boolean;

package/dist/server/analyze-launch.js

@@ -10,16 +10,83 @@
  * path is resolved relative to `import.meta.url`.
  */
 import path from 'path';
+import { existsSync, statSync } from 'node:fs';
 import { fork } from 'child_process';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { createRequire } from 'node:module';
-import { getStoragePath } from '../storage/repo-manager.js';
+import { canonicalizePath, getStoragePath, INDEX_METADATA_FILE, listRegisteredRepos, registryPathEquals, } from '../storage/repo-manager.js';
 import { logger } from '../core/logger.js';
 const _require = createRequire(import.meta.url);
 const MAX_WORKER_RETRIES = 2;
+/**
+ * The worker reports `complete` over IPC before its on-disk finalization
+ * (LadybugDB checkpoint + native handle release + metadata write) is visible
+ * at `getStoragePath(targetPath)` — observed up to ~6.5s behind the IPC
+ * message. Opening the database inside that window is what the pre-IPC
+ * ordering was meant to prevent and is actively dangerous: reads fail with
+ * binder errors or return an empty graph, the open can quarantine the
+ * in-flight WAL, and the native layer racing the rewrite has crashed the
+ * whole server (SIGSEGV-class exit, no output) on slow CI runners.
+ */
+const FINALIZE_SETTLE_TIMEOUT_MS = 60_000;
+const FINALIZE_SETTLE_POLL_MS = 200;
+/**
+ * Resolve once the analyzed repo's index is settled at `storagePath`: the
+ * LadybugDB file and metadata both exist AND were (re)written by THIS job
+ * (mtime >= jobStartMs — bare existence is not enough, a re-analysis leaves
+ * the previous index in place while it works), and no transient WAL/shadow/
+ * checkpoint sidecars remain (the worker's native close has finished).
+ *
+ * Never rejects. Timing out logs and proceeds (pre-gate behavior) rather
+ * than failing a job whose analysis genuinely succeeded — e.g. a no-op
+ * non-force analyze legitimately rewrites nothing.
+ */
+/**
+ * Look up the analyzed repo's registered storage path. The request's
+ * user-provided path is used only as a comparison key; the filesystem probes
+ * below run against the registry's own `storagePath` — the server-owned
+ * record readers resolve through, and not a user-controlled value
+ * (CodeQL js/path-injection).
+ */
+const registeredStoragePath = async (targetPath) => {
+    const target = canonicalizePath(path.resolve(targetPath));
+    const entries = await listRegisteredRepos();
+    const entry = entries.find((e) => registryPathEquals(canonicalizePath(e.path), target));
+    return entry?.storagePath ?? null;
+};
+const waitForSettledIndex = async (targetPath, jobStartMs) => {
+    const settled = (storagePath) => {
+        try {
+            const lbugStat = statSync(path.join(storagePath, 'lbug'));
+            const metaStat = statSync(path.join(storagePath, INDEX_METADATA_FILE));
+            return (lbugStat.mtimeMs >= jobStartMs &&
+                metaStat.mtimeMs >= jobStartMs &&
+                ['lbug.wal', 'lbug.shadow', 'lbug.wal.checkpoint'].every((f) => !existsSync(path.join(storagePath, f))));
+        }
+        catch {
+            return false; // not written yet
+        }
+    };
+    const deadline = Date.now() + FINALIZE_SETTLE_TIMEOUT_MS;
+    for (;;) {
+        // Re-resolved each round: the worker registers the repo as part of the
+        // finalization this gate is waiting out.
+        const storagePath = await registeredStoragePath(targetPath);
+        if (storagePath && settled(storagePath))
+            return;
+        if (Date.now() > deadline) {
+            logger.warn({ targetPath }, 'analyze finalization not visible after timeout; completing job anyway');
+            return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, FINALIZE_SETTLE_POLL_MS));
+    }
+};
 export function createLaunchAnalysisWorker(deps) {
-    const { jobManager, backend, acquireRepoLock, releaseRepoLock } = deps;
+    const { jobManager, backend, acquireRepoLock, releaseRepoLock, closeDbHandle } = deps;
     return function launchAnalysisWorker(job, targetPath, opts) {
+        // For waitForSettledIndex: files (re)written by this job have mtimes at or
+        // after this instant. Taken before the fork so no worker write predates it.
+        const jobStartMs = Date.now();
         // Acquire shared repo lock (keyed on storagePath to match embed handler)
         const analyzeLockKey = getStoragePath(targetPath);
         const lockErr = acquireRepoLock(analyzeLockKey);
@@ -67,10 +134,17 @@ export function createLaunchAnalysisWorker(deps) {
                 }
                 else if (msg.type === 'complete') {
                     releaseRepoLock(analyzeLockKey);
-                    // Reinitialize backend BEFORE marking complete — ensures the new repo
-                    // is queryable when the client receives the SSE complete event.
-                    backend
-                        .init()
+                    // Before marking complete: (1) wait for the worker's on-disk
+                    // finalization to settle (see waitForSettledIndex), (2) evict the
+                    // cached DB handle — same invalidation DELETE /api/repo performs, a
+                    // handle opened before the rewrite reads pre-rewrite state — and
+                    // only then (3) reinitialize the backend. This makes the ordering
+                    // comment below true in practice: the repo is actually queryable
+                    // when the client receives the SSE complete event.
+                    waitForSettledIndex(targetPath, jobStartMs)
+                        .then(() => closeDbHandle())
+                        .catch(() => { }) // best-effort: eviction failure must not fail the job
+                        .then(() => backend.init())
                         .then(() => {
                         jobManager.updateJob(job.id, { status: 'complete', repoName: msg.result.repoName });
                     })
@@ -84,6 +158,8 @@ export function createLaunchAnalysisWorker(deps) {
                 }
                 else if (msg.type === 'error') {
                     releaseRepoLock(analyzeLockKey);
+                    // A failed (force) analyze may still have rewritten DB files first.
+                    void closeDbHandle().catch(() => { });
                     jobManager.updateJob(job.id, { status: 'failed', error: msg.message });
                 }
             });

package/dist/server/api.d.ts

@@ -8,7 +8,9 @@
  * CORS is restricted to localhost, private/LAN networks, and the deployed site.
  */
 import express from 'express';
+import { type RegistryEntry } from '../storage/repo-manager.js';
 import { type GraphNode, type GraphRelationship } from '../_shared/index.js';
+import { JobManager } from './analyze-job.js';
 /**
  * Determine whether an HTTP Origin header value is allowed by CORS policy.
  *
@@ -49,6 +51,34 @@ export declare const registerWebUI: (app: express.Express, staticDir: string | n
 export declare const writeNdjsonRecord: (res: express.Response, record: GraphStreamRecord, signal?: AbortSignal) => Promise<void>;
 export declare const getNodeQuery: (table: string, includeContent: boolean) => string;
 export declare const streamGraphNdjson: (res: express.Response, includeContent?: boolean, signal?: AbortSignal) => Promise<void>;
+/**
+ * Mount an SSE progress endpoint for a JobManager.
+ * Handles: initial state, terminal events, heartbeat, event IDs, client disconnect.
+ *
+ * Terminal payloads carry `repoPath` (the analyzed path) alongside the display
+ * `repoName` so clients can reconnect by path identity — with duplicate
+ * basenames, a name-only reconnect resolves to the first same-named sibling.
+ * Exported for unit tests that lock the wire payload shape.
+ */
+export declare const mountSSEProgress: (app: express.Express, routePath: string, jm: JobManager) => void;
+/**
+ * Resolve a `?repo=` request param against the registry in two tiers:
+ *
+ *   1. Path claim — any input containing a separator ('/' or '\\', which
+ *      cover path.sep on every platform) is treated as a path claim and
+ *      resolved by canonical registry path ONLY. A miss fails closed
+ *      (null, never a basename fallback) so a stale or wrong path can
+ *      never silently retarget a same-named sibling repo (#2419).
+ *      Within this tier, only absolute or Windows-shaped ('\\') claims
+ *      are worth canonicalizing; relative claims like 'org/name' or
+ *      './repo' are rejected immediately WITHOUT touching the filesystem
+ *      — canonicalizing them would run an attacker-influenced
+ *      CWD-relative realpathSync probe on un-rate-limited GET routes,
+ *      and no legitimate caller sends relative paths.
+ *   2. Name fallback — bare names (no separators) keep the legacy
+ *      basename/name match for older callers.
+ */
+export declare const resolveRegisteredRepoEntry: (repos: RegistryEntry[], repoName?: string) => RegistryEntry | null;
 /**
  * Handle a GET /api/file request body. Extracted from createServer's route
  * registration so it can be unit-tested without spinning up an HTTP server

package/dist/server/api.js

@@ -12,7 +12,7 @@ import cors from 'cors';
 import path from 'path';
 import fs from 'fs/promises';
 import { createRequire } from 'node:module';
-import { loadMeta, listRegisteredRepos, getStoragePath } from '../storage/repo-manager.js';
+import { canonicalizePath, cloneDirBelongsToEntry, loadMeta, listRegisteredRepos, getStoragePath, registryPathEquals, } from '../storage/repo-manager.js';
 import { executeQuery, executePrepared, executeWithReusedStatement, streamQuery, flushWAL, closeLbug, withLbugDb, isReadOnlyDbError, } from '../core/lbug/lbug-adapter.js';
 import { isValidQueryParams } from '../core/lbug/query-params.js';
 import { NODE_TABLES } from '../_shared/index.js';
@@ -381,8 +381,13 @@ export const streamGraphNdjson = async (res, includeContent = false, signal) =>
 /**
  * Mount an SSE progress endpoint for a JobManager.
  * Handles: initial state, terminal events, heartbeat, event IDs, client disconnect.
+ *
+ * Terminal payloads carry `repoPath` (the analyzed path) alongside the display
+ * `repoName` so clients can reconnect by path identity — with duplicate
+ * basenames, a name-only reconnect resolves to the first same-named sibling.
+ * Exported for unit tests that lock the wire payload shape.
  */
-const mountSSEProgress = (app, routePath, jm) => {
+export const mountSSEProgress = (app, routePath, jm) => {
     app.get(routePath, (req, res) => {
         let jobId;
         try {
@@ -412,6 +417,7 @@ const mountSSEProgress = (app, routePath, jm) => {
             eventId++;
             res.write(`id: ${eventId}\nevent: ${job.status}\ndata: ${JSON.stringify({
                 repoName: job.repoName,
+                repoPath: job.repoPath,
                 error: job.error,
             })}\n\n`);
             res.end();
@@ -435,6 +441,7 @@ const mountSSEProgress = (app, routePath, jm) => {
                     const eventJob = jm.getJob(jobId);
                     res.write(`id: ${eventId}\nevent: ${progress.phase}\ndata: ${JSON.stringify({
                         repoName: eventJob?.repoName,
+                        repoPath: eventJob?.repoPath,
                         error: eventJob?.error,
                     })}\n\n`);
                     clearInterval(heartbeat);
@@ -477,6 +484,43 @@ const requestedRepo = (req) => {
     }
     return undefined;
 };
+const repoParamBasename = (repoName) => repoName.replace(/\\/g, '/').split('/').filter(Boolean).pop() ?? repoName;
+/**
+ * Resolve a `?repo=` request param against the registry in two tiers:
+ *
+ *   1. Path claim — any input containing a separator ('/' or '\\', which
+ *      cover path.sep on every platform) is treated as a path claim and
+ *      resolved by canonical registry path ONLY. A miss fails closed
+ *      (null, never a basename fallback) so a stale or wrong path can
+ *      never silently retarget a same-named sibling repo (#2419).
+ *      Within this tier, only absolute or Windows-shaped ('\\') claims
+ *      are worth canonicalizing; relative claims like 'org/name' or
+ *      './repo' are rejected immediately WITHOUT touching the filesystem
+ *      — canonicalizing them would run an attacker-influenced
+ *      CWD-relative realpathSync probe on un-rate-limited GET routes,
+ *      and no legitimate caller sends relative paths.
+ *   2. Name fallback — bare names (no separators) keep the legacy
+ *      basename/name match for older callers.
+ */
+export const resolveRegisteredRepoEntry = (repos, repoName) => {
+    if (!repoName)
+        return repos[0] ?? null;
+    const looksLikePath = path.isAbsolute(repoName) || repoName.includes('/') || repoName.includes('\\');
+    if (looksLikePath) {
+        // Relative path claims fail closed with zero filesystem probes.
+        if (!path.isAbsolute(repoName) && !repoName.includes('\\'))
+            return null;
+        const requestedPath = canonicalizePath(repoName);
+        const pathMatch = repos.find((r) => registryPathEquals(canonicalizePath(r.path), requestedPath));
+        if (pathMatch)
+            return pathMatch;
+        return null;
+    }
+    const normalizedName = repoParamBasename(repoName);
+    return (repos.find((r) => r.name === normalizedName) ||
+        repos.find((r) => r.name.toLowerCase() === normalizedName.toLowerCase()) ||
+        null);
+};
 /**
  * Handle a GET /api/file request body. Extracted from createServer's route
  * registration so it can be unit-tested without spinning up an HTTP server
@@ -703,6 +747,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
         backend,
         acquireRepoLock,
         releaseRepoLock,
+        closeDbHandle: closeLbug,
     });
     /**
      * Maximum time the hold-queue will wait for an active analysis job to complete.
@@ -713,19 +758,8 @@ export const createServer = async (port, host = '127.0.0.1') => {
     // Pass `req` to enable early exit if the client disconnects during the hold-queue wait.
     const resolveRepo = async (repoName, isRetry = false, req) => {
         const repos = await listRegisteredRepos();
-        let found = null;
-        // Normalize: if a full path is passed, extract just the basename.
-        // e.g. "C:\Users\LENOVO\.gitnexus\repos\todo.txt-cli" -> "todo.txt-cli"
-        const normalizedName = repoName ? path.basename(repoName) : undefined;
-        if (normalizedName) {
-            found =
-                repos.find((r) => r.name === normalizedName) ||
-                    repos.find((r) => r.name.toLowerCase() === normalizedName.toLowerCase()) ||
-                    null;
-        }
-        else if (repos.length > 0) {
-            found = repos[0]; // default to first repo
-        }
+        const found = resolveRegisteredRepoEntry(repos, repoName);
+        const normalizedName = repoName ? repoParamBasename(repoName) : undefined;
         // If not yet in the registry, check whether a background job is actively cloning or
         // analyzing this repo. Hold the connection open (up to 5 minutes) until it completes.
         // We only wait for in-progress jobs ('queued'|'cloning'|'analyzing') — a 'complete' job
@@ -758,7 +792,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
                         if (currentJob.status === 'complete') {
                             await backend.init();
                             const freshRepos = await listRegisteredRepos();
-                            return freshRepos.find((r) => r.name === normalizedName) || null;
+                            return resolveRegisteredRepoEntry(freshRepos, repoName);
                         }
                         await new Promise((r) => setTimeout(r, 1000));
                     }
@@ -775,7 +809,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 logger.debug({ repoName: String(normalizedName).replace(/[\r\n]/g, ' ') }, '[debug] resolveRepo 404, triggering deep init');
             }
             await backend.init();
-            return await resolveRepo(normalizedName, true, req);
+            return await resolveRepo(repoName, true, req);
         }
         return found;
     };
@@ -827,6 +861,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
             res.json(repos.map((r) => ({
                 name: r.name,
                 path: r.path,
+                repoPath: r.path,
                 indexedAt: r.indexedAt,
                 lastCommit: r.lastCommit,
                 stats: r.stats,
@@ -837,7 +872,11 @@ export const createServer = async (port, host = '127.0.0.1') => {
         }
     });
     // Get repo info
-    app.get('/api/repo', async (req, res) => {
+    // Rate-limited (CodeQL js/missing-rate-limiting): resolveRepo canonicalizes
+    // the attacker-supplied ?repo= param (realpathSync probe for absolute /
+    // Windows-shaped claims). Default 60 rpm/IP — web callers hit this route
+    // only on connect/switch, never in a polling loop.
+    app.get('/api/repo', createRouteLimiter(), async (req, res) => {
         try {
             const entry = await resolveRepo(requestedRepo(req), false, req);
             if (!entry) {
@@ -907,7 +946,10 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 catch {
                     /* repo name not eligible for a clone dir (local repo) */
                 }
-                if (cloneDir) {
+                // Only remove the clone dir when it is *this* entry's path — a local
+                // repo registered under the same name would otherwise take a cloned
+                // sibling's checkout down with it (see cloneDirBelongsToEntry).
+                if (cloneDir && cloneDirBelongsToEntry(cloneDir, entry.path)) {
                     try {
                         const stat = await fs.stat(cloneDir);
                         if (stat.isDirectory()) {

package/dist/storage/repo-manager.d.ts

@@ -54,6 +54,18 @@ export declare const canonicalizePath: (p: string) => string;
  * lookups/dedup/finalize checks all share so they answer identically.
  */
 export declare const registryPathEquals: (a: string, b: string) => boolean;
+/**
+ * Does the clone dir derived from an entry's *name* actually belong to that
+ * entry? Registry names are not unique across storage locations: a cloned
+ * repo under `~/.gitnexus/repos/<name>` and a local repo registered under the
+ * same name share a `getCloneDir(entry.name)` result. The server's delete
+ * handler must therefore never remove the clone dir based on the name alone —
+ * only when the entry's own `path` resolves to that dir (mirroring its step-2b
+ * rule that cleanup is driven off `entry.path`, so a same-named sibling's
+ * clone is never removed). Both sides are canonicalised so symlinked or
+ * differently-spelled forms of the same dir still match.
+ */
+export declare const cloneDirBelongsToEntry: (cloneDir: string, entryPath: string) => boolean;
 export interface RepoMeta {
     repoPath: string;
     lastCommit: string;

package/dist/storage/repo-manager.js

@@ -71,6 +71,18 @@ export const canonicalizePath = (p) => {
  * lookups/dedup/finalize checks all share so they answer identically.
  */
 export const registryPathEquals = (a, b) => process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
+/**
+ * Does the clone dir derived from an entry's *name* actually belong to that
+ * entry? Registry names are not unique across storage locations: a cloned
+ * repo under `~/.gitnexus/repos/<name>` and a local repo registered under the
+ * same name share a `getCloneDir(entry.name)` result. The server's delete
+ * handler must therefore never remove the clone dir based on the name alone —
+ * only when the entry's own `path` resolves to that dir (mirroring its step-2b
+ * rule that cleanup is driven off `entry.path`, so a same-named sibling's
+ * clone is never removed). Both sides are canonicalised so symlinked or
+ * differently-spelled forms of the same dir still match.
+ */
+export const cloneDirBelongsToEntry = (cloneDir, entryPath) => registryPathEquals(canonicalizePath(cloneDir), canonicalizePath(entryPath));
 /**
  * Bumped whenever incremental-indexing invariants change incompatibly.
  * v2: `BasicBlock.callees` column added (statement-precise inter-procedural

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.10-rc.17",
+  "version": "1.6.10-rc.18",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",

package/scripts/cross-platform-tests.ts

@@ -74,6 +74,11 @@ const PLATFORM_LOGIC = [
   // (macos), so the header parsing is proven on genuine binaries, not synthetic
   // buffers (the ubuntu suite covers the ELF path).
   'test/integration/extension-binary-real.test.ts',
+  // Server repo resolver branches on path shape (path.isAbsolute, backslash
+  // detection) and canonicalizePath/realpathSync, all of which differ between
+  // POSIX and Windows — the fail-closed path-claim semantics must hold on the
+  // real windows-latest path implementation (#2419/#2420).
+  'test/unit/server-api-repo-resolution.test.ts',
 ];
 
 // Native LadybugDB integration tests — exercise the @ladybugdb/core