gitnexus 1.6.10-rc.18 → 1.6.10-rc.19

package/README.md

@@ -535,6 +535,8 @@ Three env vars expose the pool's resilience layers (respawn budget, cumulative-t
 | `GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT`         | `3`                     | Max replacement spawns per slot before the slot is dropped from the active rotation.                                  |
 | `GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS`     | `5 × subBatchTimeoutMs` | Total retry wall-time budget per job before quarantining. Bounds exponentially-growing retry waits.                   |
 | `GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD` | `max(3, poolSize)`      | Per-slot consecutive deaths before the pool's circuit breaker trips. After tripping, dispatches require a fresh pool. |
+| `GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS`             | `30000`                 | Max wait at pool shutdown for a retired worker still inside native code — terminated at its next JS-safe point instead of mid-native-call, which would abort the process (`Napi::Error`, #2432). |
+| `GITNEXUS_CPP_CAPTURE_BUDGET_MS`                | `20000`                 | Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning (#2432). `0` expires immediately.           |
 
 ### Graph cleanup tuning
 

package/dist/cli/i18n/en.d.ts

@@ -243,5 +243,5 @@ export declare const en: {
     readonly 'help.option.group.contracts.type': "Filter by contract type";
     readonly 'help.option.group.contracts.repo': "Filter by repo";
     readonly 'help.option.group.contracts.unmatched': "Show only unmatched contracts";
-    readonly 'help.analyze.environment': "\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).";
+    readonly 'help.analyze.environment': "\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS=N  Max wait at pool shutdown for a retired worker still inside native code (terminated at its next safe point instead of aborting the process). Default 30000.\n  GITNEXUS_CPP_CAPTURE_BUDGET_MS=N  Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning. Default 20000.\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).";
 };

package/dist/cli/i18n/en.js

@@ -243,5 +243,5 @@ export const en = {
     'help.option.group.contracts.type': 'Filter by contract type',
     'help.option.group.contracts.repo': 'Filter by repo',
     'help.option.group.contracts.unmatched': 'Show only unmatched contracts',
-    'help.analyze.environment': '\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).',
+    'help.analyze.environment': '\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS=N  Max wait at pool shutdown for a retired worker still inside native code (terminated at its next safe point instead of aborting the process). Default 30000.\n  GITNEXUS_CPP_CAPTURE_BUDGET_MS=N  Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning. Default 20000.\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).',
 };

package/dist/cli/i18n/resources.d.ts

@@ -244,7 +244,7 @@ export declare const cliResources: {
         readonly 'help.option.group.contracts.type': "Filter by contract type";
         readonly 'help.option.group.contracts.repo': "Filter by repo";
         readonly 'help.option.group.contracts.unmatched': "Show only unmatched contracts";
-        readonly 'help.analyze.environment': "\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).";
+        readonly 'help.analyze.environment': "\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS=N  Max wait at pool shutdown for a retired worker still inside native code (terminated at its next safe point instead of aborting the process). Default 30000.\n  GITNEXUS_CPP_CAPTURE_BUDGET_MS=N  Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning. Default 20000.\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).";
     };
     readonly 'zh-CN': {
         'common.notIndexed': string;

package/dist/cli/i18n/zh-CN.js

@@ -243,5 +243,5 @@ export const zhCN = {
     'help.option.group.contracts.type': '按契约类型过滤',
     'help.option.group.contracts.repo': '按仓库过滤',
     'help.option.group.contracts.unmatched': '仅显示未匹配契约',
-    'help.analyze.environment': '\n环境变量：\n  GITNEXUS_NO_GITIGNORE=1   跳过 .gitignore 解析（仍读取 .gitnexusignore）\n  GITNEXUS_MAX_FILE_SIZE=N  覆盖大文件跳过阈值（KB）。默认 512，最大 32768。\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker 空闲超时（毫秒）。默认 30000。\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL 自动 checkpoint 阈值（字节，默认 67108864 = 64 MiB；-1 保持 Ladybug 默认约 16 MiB）。\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker 作业字节预算。默认 8388608。\n  GITNEXUS_WORKER_POOL_SIZE=N  解析 worker 数量覆盖值。默认 cores-1，最多 16。\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  并发进行中的解析分块数。默认 2。\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  每个 slot 丢弃前允许的最大替换进程数。默认 3。\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  每个作业的总重试墙钟时间。默认 5 倍子批次超时。\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  每个 slot 触发熔断的死亡次数。默认 max(3, poolSize)。\n  GITNEXUS_EMBEDDING_THREADS=N  限制 --embeddings 的本地 ONNX CPU 线程数。\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  exact-scan 回退的最大嵌入分块数。默认 10000。\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  语义/向量搜索接受的最大余弦距离（0 < N <= 2；超出则钳制为 2）。MCP 默认 0.6，其他路径默认 0.5。\n\n当参数和对应环境变量同时提供时，参数优先。\n\n提示：`.gitnexusignore` 支持 `.gitignore` 风格的取反。比如添加\n     `!__tests__/` 可以索引默认自动过滤的目录（#771）。',
+    'help.analyze.environment': '\n环境变量：\n  GITNEXUS_NO_GITIGNORE=1   跳过 .gitignore 解析（仍读取 .gitnexusignore）\n  GITNEXUS_MAX_FILE_SIZE=N  覆盖大文件跳过阈值（KB）。默认 512，最大 32768。\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker 空闲超时（毫秒）。默认 30000。\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL 自动 checkpoint 阈值（字节，默认 67108864 = 64 MiB；-1 保持 Ladybug 默认约 16 MiB）。\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker 作业字节预算。默认 8388608。\n  GITNEXUS_WORKER_POOL_SIZE=N  解析 worker 数量覆盖值。默认 cores-1，最多 16。\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  并发进行中的解析分块数。默认 2。\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  每个 slot 丢弃前允许的最大替换进程数。默认 3。\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  每个作业的总重试墙钟时间。默认 5 倍子批次超时。\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  每个 slot 触发熔断的死亡次数。默认 max(3, poolSize)。\n  GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS=N  线程池关闭时等待仍在原生代码中的已退役 worker 的最长时间（到达安全点后再终止，避免进程级 abort）。默认 30000。\n  GITNEXUS_CPP_CAPTURE_BUDGET_MS=N  C++ 捕获提取的每文件墙钟预算；超出后该文件保留部分捕获并输出警告。默认 20000。\n  GITNEXUS_EMBEDDING_THREADS=N  限制 --embeddings 的本地 ONNX CPU 线程数。\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  exact-scan 回退的最大嵌入分块数。默认 10000。\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  语义/向量搜索接受的最大余弦距离（0 < N <= 2；超出则钳制为 2）。MCP 默认 0.6，其他路径默认 0.5。\n\n当参数和对应环境变量同时提供时，参数优先。\n\n提示：`.gitnexusignore` 支持 `.gitignore` 风格的取反。比如添加\n     `!__tests__/` 可以索引默认自动过滤的目录（#771）。',
 };

package/dist/core/ingestion/languages/cpp/captures.js

@@ -12,6 +12,27 @@ import { markCppInlineNamespaceRange } from './inline-namespaces.js';
 import { extractCppTemplateConstraints } from './constraint-extractor.js';
 import { captureCppMemberLookupFacts } from './member-lookup.js';
 import { CPP_BRACED_INIT_TYPE_PREFIX } from './conversion-rank.js';
+import { logger } from '../../../logger.js';
+/**
+ * Per-file wall-clock budget for the capture-emit loop (#2432). A worker
+ * thread stuck in this loop cannot be terminated safely (terminating a
+ * thread mid-N-API call aborts the whole process with Napi::Error), so the
+ * loop must bound itself: on breach we return the captures accumulated so
+ * far with a warning — degraded coverage for one file, never a crash or a
+ * thrown error (a throw here would make the language-group catch drop every
+ * remaining file in the batch).
+ *
+ * `GITNEXUS_CPP_CAPTURE_BUDGET_MS`: unset/invalid/negative → 20000; explicit
+ * 0 → expires immediately (deterministic test hook).
+ */
+const CPP_CAPTURE_BUDGET_DEFAULT_MS = 20_000;
+function cppCaptureBudgetMs() {
+    const raw = process.env.GITNEXUS_CPP_CAPTURE_BUDGET_MS;
+    if (raw === undefined || raw === '')
+        return CPP_CAPTURE_BUDGET_DEFAULT_MS;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : CPP_CAPTURE_BUDGET_DEFAULT_MS;
+}
 export function emitCppScopeCaptures(sourceText, filePath, cachedTree) {
     let tree = cachedTree;
     if (tree === undefined) {
@@ -21,10 +42,27 @@ export function emitCppScopeCaptures(sourceText, filePath, cachedTree) {
     }
     const rawMatches = getCppScopeQuery().matches(tree.rootNode);
     const out = [];
+    // #2432: reset the per-file lookup index. The identifier-argument type
+    // lookups below used to re-walk the AST per identifier (full-tree DFS in
+    // isKnownEnumName, per-scope declaration scans) — O(calls × args × treeSize)
+    // per file, 151s on a 194KB file that parses in 46ms. The index makes each
+    // lookup O(1) after a single lazily-built pass.
+    resetCppFileLookupIndex();
     // Track ranges where typedef-struct/enum was captured as its concrete type
     // so we can suppress the duplicate @declaration.typedef match.
     const concreteTypedefRanges = new Set();
+    // #2432: per-file deadline for the loop below (see cppCaptureBudgetMs).
+    // Checked every 64 matches — post-index a single iteration is microseconds,
+    // so the check granularity costs nothing and bounds the drift past the
+    // deadline to well under a second.
+    const budgetMs = cppCaptureBudgetMs();
+    const deadline = Date.now() + budgetMs;
+    let matchIndex = 0;
     for (const m of rawMatches) {
+        if ((matchIndex++ & 63) === 0 && Date.now() >= deadline) {
+            logger.warn({ filePath, budgetMs, processedMatches: matchIndex - 1, totalMatches: rawMatches.length }, `C++ capture extraction exceeded its ${budgetMs}ms budget for ${filePath}; returning partial captures for this file (#2432).`);
+            break;
+        }
         const grouped = {};
         // Parallel tag -> captured SyntaxNode map. The tree-sitter query already
         // hands us each matched node as `c.node`, so anchors resolve via a
@@ -960,6 +998,47 @@ function inferCppBracedInitType(node) {
         ? `${CPP_BRACED_INIT_TYPE_PREFIX}${first}:${elementTypes.length}`
         : `${CPP_BRACED_INIT_TYPE_PREFIX}unknown:${elementTypes.length}`;
 }
+let fileLookupIndex = {
+    enumNames: null,
+    scopeDecls: new Map(),
+    fnParams: new Map(),
+};
+function resetCppFileLookupIndex() {
+    fileLookupIndex = { enumNames: null, scopeDecls: new Map(), fnParams: new Map() };
+}
+/**
+ * First-declaration-wins map of the scope's `declaration` children that
+ * carry a concrete (non-placeholder) type and a nameable declarator —
+ * exactly the entries the replaced per-identifier scans could match.
+ */
+function scopeDeclarationsFor(scope) {
+    const cached = fileLookupIndex.scopeDecls.get(scope.id);
+    if (cached !== undefined)
+        return cached;
+    const decls = new Map();
+    for (let i = 0; i < scope.childCount; i++) {
+        const stmt = scope.child(i);
+        if (stmt === null || stmt.type !== 'declaration')
+            continue;
+        const typeNode = stmt.childForFieldName('type');
+        if (typeNode === null)
+            continue;
+        if (typeNode.type === 'placeholder_type_specifier')
+            continue;
+        const declarator = stmt.childForFieldName('declarator');
+        if (declarator === null)
+            continue;
+        const nameChild = declaredNameNode(declarator);
+        if (nameChild === null)
+            continue;
+        const name = extractDeclaratorLeafName(nameChild);
+        if (name === '' || decls.has(name))
+            continue;
+        decls.set(name, stmt);
+    }
+    fileLookupIndex.scopeDecls.set(scope.id, decls);
+    return decls;
+}
 /**
  * Look up the declared type of a variable by scanning sibling declarations
  * in the enclosing compound_statement (function body). Handles:
@@ -991,27 +1070,14 @@ function lookupDeclaredTypeForIdentifier(identNode) {
     const paramType = lookupFunctionParameterType(scope, varName);
     if (paramType !== '')
         return paramType;
-    // Scan declarations in the scope for a matching variable name
-    for (let i = 0; i < scope.childCount; i++) {
-        const stmt = scope.child(i);
-        if (stmt === null || stmt.type !== 'declaration')
-            continue;
-        const typeNode = stmt.childForFieldName('type');
-        if (typeNode === null)
-            continue;
-        // Skip auto/placeholder types — those need chain-follow, not literal
-        if (typeNode.type === 'placeholder_type_specifier')
-            continue;
-        // Check init_declarator children for the variable name
-        const declarator = stmt.childForFieldName('declarator');
-        if (declarator === null)
-            continue;
-        const nameChild = declaredNameNode(declarator);
-        if (nameChild !== null && extractDeclaratorLeafName(nameChild) === varName) {
-            return normalizeCppTypeText(typeNode.text);
-        }
-    }
-    return '';
+    // Indexed scope-declaration lookup (#2432; was a per-identifier scan).
+    const stmt = scopeDeclarationsFor(scope).get(varName);
+    if (stmt === undefined)
+        return '';
+    const typeNode = stmt.childForFieldName('type');
+    if (typeNode === null)
+        return '';
+    return normalizeCppTypeText(typeNode.text);
 }
 function lookupDeclaredTypeClassForIdentifier(identNode) {
     const varName = identNode.text;
@@ -1026,28 +1092,20 @@ function lookupDeclaredTypeClassForIdentifier(identNode) {
     const paramTypeClass = lookupFunctionParameterTypeClass(scope, varName, identNode);
     if (paramTypeClass !== undefined)
         return paramTypeClass;
-    for (let i = 0; i < scope.childCount; i++) {
-        const stmt = scope.child(i);
-        if (stmt === null || stmt.type !== 'declaration')
-            continue;
-        const typeNode = stmt.childForFieldName('type');
-        if (typeNode === null)
-            continue;
-        if (typeNode.type === 'placeholder_type_specifier')
-            continue;
-        const declarator = stmt.childForFieldName('declarator');
-        if (declarator === null)
-            continue;
-        const nameChild = declaredNameNode(declarator);
-        if (nameChild === null || extractDeclaratorLeafName(nameChild) !== varName)
-            continue;
-        const typeClass = classifyCppParameterType(typeNode.text, nameChild.text, stmt.text.replace(/;\s*$/, ''));
-        if (isKnownEnumName(identNode, typeClass.base)) {
-            return { ...typeClass, base: `enum:${typeClass.base}` };
-        }
-        return typeClass;
+    // Indexed scope-declaration lookup (#2432; was a per-identifier scan).
+    const stmt = scopeDeclarationsFor(scope).get(varName);
+    if (stmt === undefined)
+        return unknownTypeClass('unknown');
+    const typeNode = stmt.childForFieldName('type');
+    const declarator = stmt.childForFieldName('declarator');
+    const nameChild = declarator !== null ? declaredNameNode(declarator) : null;
+    if (typeNode === null || nameChild === null)
+        return unknownTypeClass('unknown');
+    const typeClass = classifyCppParameterType(typeNode.text, nameChild.text, stmt.text.replace(/;\s*$/, ''));
+    if (isKnownEnumName(identNode, typeClass.base)) {
+        return { ...typeClass, base: `enum:${typeClass.base}` };
     }
-    return unknownTypeClass('unknown');
+    return typeClass;
 }
 function lookupFunctionParameterType(scope, varName) {
     const param = findEnclosingFunctionParameter(scope, varName);
@@ -1078,27 +1136,45 @@ function findEnclosingFunctionParameter(scope, varName) {
     let node = scope.parent;
     while (node !== null) {
         if (node.type === 'function_definition' || node.type === 'function_declarator') {
-            const fnDecl = node.type === 'function_declarator'
-                ? node
-                : findFirstDescendantOfType(node, 'function_declarator');
-            const params = fnDecl?.childForFieldName('parameters') ?? null;
-            if (params !== null) {
-                for (let i = 0; i < params.namedChildCount; i++) {
-                    const param = params.namedChild(i);
-                    if (param === null || param.type !== 'parameter_declaration')
-                        continue;
-                    const declarator = param.childForFieldName('declarator');
-                    if (declarator !== null && extractDeclaratorLeafName(declarator) === varName) {
-                        return param;
-                    }
-                }
-            }
-            return null;
+            return enclosingFunctionParametersFor(node)?.get(varName) ?? null;
         }
         node = node.parent;
     }
     return null;
 }
+/**
+ * First-wins map of a function's `parameter_declaration`s by declarator
+ * leaf name (#2432; was a per-identifier scan). `null` when the function
+ * has no parameter list — the caller returns null without walking further
+ * up, preserving the replaced scan's early-return.
+ */
+function enclosingFunctionParametersFor(fnNode) {
+    const cached = fileLookupIndex.fnParams.get(fnNode.id);
+    if (cached !== undefined)
+        return cached;
+    const fnDecl = fnNode.type === 'function_declarator'
+        ? fnNode
+        : findFirstDescendantOfType(fnNode, 'function_declarator');
+    const params = fnDecl?.childForFieldName('parameters') ?? null;
+    let index = null;
+    if (params !== null) {
+        index = new Map();
+        for (let i = 0; i < params.namedChildCount; i++) {
+            const param = params.namedChild(i);
+            if (param === null || param.type !== 'parameter_declaration')
+                continue;
+            const declarator = param.childForFieldName('declarator');
+            if (declarator === null)
+                continue;
+            const name = extractDeclaratorLeafName(declarator);
+            if (name === '' || index.has(name))
+                continue;
+            index.set(name, param);
+        }
+    }
+    fileLookupIndex.fnParams.set(fnNode.id, index);
+    return index;
+}
 function declaredNameNode(declarator) {
     if (declarator.type !== 'init_declarator')
         return declarator;
@@ -1126,24 +1202,31 @@ function normalizeCppTypeText(text) {
 function isKnownEnumName(node, typeName) {
     if (typeName === '' || typeName === 'unknown')
         return false;
-    let root = node;
-    while (root.parent !== null)
-        root = root.parent;
-    const stack = [root];
-    while (stack.length > 0) {
-        const cur = stack.pop();
-        if (cur.type === 'enum_specifier') {
-            const name = cur.childForFieldName('name');
-            if (name?.text === typeName)
-                return true;
-        }
-        for (let i = 0; i < cur.childCount; i++) {
-            const child = cur.child(i);
-            if (child !== null)
-                stack.push(child);
+    // One full-tree DFS per FILE (lazy), not per identifier argument — the
+    // per-identifier walk here was the dominant cost of #2432 (87s of a 151s
+    // extraction on a file that parses in 46ms).
+    if (fileLookupIndex.enumNames === null) {
+        let root = node;
+        while (root.parent !== null)
+            root = root.parent;
+        const names = new Set();
+        const stack = [root];
+        while (stack.length > 0) {
+            const cur = stack.pop();
+            if (cur.type === 'enum_specifier') {
+                const name = cur.childForFieldName('name');
+                if (name !== null)
+                    names.add(name.text);
+            }
+            for (let i = 0; i < cur.childCount; i++) {
+                const child = cur.child(i);
+                if (child !== null)
+                    stack.push(child);
+            }
         }
+        fileLookupIndex.enumNames = names;
     }
-    return false;
+    return fileLookupIndex.enumNames.has(typeName);
 }
 /**
  * Detect whether a `namespace_definition` AST node is inline.

package/dist/core/ingestion/workers/worker-pool.d.ts

@@ -135,6 +135,19 @@ export interface WorkerPoolOptions {
     pdg?: boolean;
     /** Per-function source-line cap for worker-side CFG construction (0 ⇒ no cap). */
     pdgMaxFunctionLines?: number;
+    /**
+     * Max wall time `terminate()` waits for a retired worker that has NOT yet
+     * reached a JS-visible safe point before giving up on terminating it
+     * (#2432). Terminating a worker thread that is inside an N-API call aborts
+     * the whole process (`Napi::Error` → `std::terminate` → SIGABRT) — and the
+     * same abort fires at plain process exit, so the drain is what makes
+     * shutdown safe. On expiry the worker is left running (unref'd, with its
+     * at-safe-point terminate listener still armed) and a diagnostic is logged.
+     * Default 30000ms — above the C++ capture budget
+     * (`GITNEXUS_CPP_CAPTURE_BUDGET_MS`, 20000ms) so the drain converges for
+     * the known pathological class. 0 ⇒ no wait (test hook).
+     */
+    shutdownDrainMs?: number;
 }
 export declare class WorkerPoolDispatchError extends Error {
     /**
@@ -193,6 +206,7 @@ interface ResolvedWorkerPoolOptions {
     maxRespawnsPerSlot: number;
     maxCumulativeTimeoutMs: number;
     consecutiveFailureThreshold: number;
+    shutdownDrainMs: number;
 }
 export declare function resolveWorkerPoolOptions(options?: WorkerPoolOptions, poolSize?: number): ResolvedWorkerPoolOptions;
 /**

package/dist/core/ingestion/workers/worker-pool.js

@@ -231,6 +231,8 @@ function nonNegativeInteger(value) {
         ? Math.floor(parsed)
         : undefined;
 }
+/** See {@link WorkerPoolOptions.shutdownDrainMs}. */
+const DEFAULT_SHUTDOWN_DRAIN_MS = 30_000;
 export function resolveWorkerPoolOptions(options = {}, poolSize) {
     const subBatchIdleTimeoutMs = positiveInteger(options.subBatchIdleTimeoutMs) ??
         positiveInteger(process.env.GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS) ??
@@ -252,6 +254,9 @@ export function resolveWorkerPoolOptions(options = {}, poolSize) {
         consecutiveFailureThreshold: positiveInteger(options.consecutiveFailureThreshold) ??
             positiveInteger(process.env.GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD) ??
             Math.max(DEFAULT_CONSECUTIVE_FAILURE_THRESHOLD_FLOOR, poolSize ?? 0),
+        shutdownDrainMs: nonNegativeInteger(options.shutdownDrainMs) ??
+            nonNegativeInteger(process.env.GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS) ??
+            DEFAULT_SHUTDOWN_DRAIN_MS,
     };
 }
 /**
@@ -608,13 +613,50 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
     // Set by `terminate()` (below). Also read by the self-healing startup loop so
     // a terminate during startup aborts pending backoff/retries (#1741).
     let terminated = false;
+    /** Resolves `true` when `promise` settles within `ms`, else `false`. The
+     *  timer is unref'd so an expiring drain never holds the process open. */
+    const settledWithin = (promise, ms) => {
+        if (ms <= 0)
+            return Promise.resolve(false);
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => resolve(false), ms);
+            timer.unref?.();
+            void promise.then(() => {
+                clearTimeout(timer);
+                resolve(true);
+            });
+        });
+    };
     const terminateTrackedWorkers = async (liveWorkers) => {
         const retired = Array.from(retiredWorkers);
         await Promise.all([
             ...liveWorkers.map((worker) => worker?.terminate().catch(() => undefined)),
-            ...retired.map((record) => record.terminate()),
+            ...retired.map(async (record) => {
+                // #2432: a retired worker that has not reached a JS-visible safe
+                // point may be inside an N-API call — terminating it aborts the
+                // WHOLE process (`Napi::Error` → std::terminate → SIGABRT). Drain:
+                // wait (bounded) for its safe point; on expiry leave it running —
+                // it is unref'd and its at-safe-point terminate listener stays
+                // armed — and log which file wedged it.
+                if (!record.safeToTerminate) {
+                    const drained = await settledWithin(record.safePoint, poolOptions.shutdownDrainMs);
+                    if (!drained) {
+                        logger.warn({
+                            workerIndex: record.workerIndex,
+                            reason: record.reason,
+                            drainMs: poolOptions.shutdownDrainMs,
+                        }, `Worker ${record.workerIndex} is still inside native code after the ` +
+                            `${poolOptions.shutdownDrainMs}ms shutdown drain; leaving it un-terminated ` +
+                            `to avoid a native abort (#2432). It will be terminated at its next safe point.`);
+                        return;
+                    }
+                }
+                await record.terminate();
+            }),
         ]);
-        retiredWorkers.clear();
+        // Undrained records stay tracked so a repeated shutdown call can retry
+        // their (now possibly safe) terminate; record.terminate() removes each
+        // drained record via its cleanup.
     };
     for (let i = 0; i < size; i++) {
         workers[i] = spawnAndCapture(workerUrl);
@@ -788,6 +830,18 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
             const retireWorkerAfterTimeout = (worker, workerIndex, reason) => {
                 let cleaned = false;
                 let terminateStarted = false;
+                let resolveSafePoint;
+                const safePoint = new Promise((resolve) => {
+                    resolveSafePoint = resolve;
+                });
+                // A message/messageerror proves the worker is executing JS again; an
+                // exit/error means the thread is gone. Either way `worker.terminate()`
+                // can no longer land mid-N-API call (#2432), so shutdown's drain may
+                // stop waiting.
+                function markSafeToTerminate() {
+                    record.safeToTerminate = true;
+                    resolveSafePoint();
+                }
                 function cleanupRetired() {
                     if (cleaned)
                         return;
@@ -806,6 +860,7 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
                     await worker.terminate().catch(() => undefined);
                 }
                 function terminateWhenBackInJs() {
+                    markSafeToTerminate();
                     void terminateRetired();
                 }
                 function onRetiredMessage(raw) {
@@ -816,8 +871,14 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
                         terminateWhenBackInJs();
                     }
                 }
-                const onRetiredError = () => cleanupRetired();
-                const onRetiredExit = () => cleanupRetired();
+                const onRetiredError = () => {
+                    markSafeToTerminate();
+                    cleanupRetired();
+                };
+                const onRetiredExit = () => {
+                    markSafeToTerminate();
+                    cleanupRetired();
+                };
                 const onRetiredMessageError = () => terminateWhenBackInJs();
                 const record = {
                     worker,
@@ -825,6 +886,8 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
                     reason,
                     cleanup: cleanupRetired,
                     terminate: terminateRetired,
+                    safeToTerminate: false,
+                    safePoint,
                 };
                 retiredWorkers.add(record);
                 worker.on('message', onRetiredMessage);
@@ -890,8 +953,25 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
                 const liveWorkers = workers.slice();
                 for (let i = 0; i < workers.length; i++)
                     workers[i] = undefined;
+                // #2432: a live worker with a job in flight may be inside an N-API
+                // call — direct terminate risks the same native abort as the retired
+                // case. Route busy workers through the retire path (terminate at
+                // their next JS-visible safe point); idle workers are parked in the
+                // JS event loop and terminate safely right away.
+                const idleWorkers = [];
+                for (let i = 0; i < liveWorkers.length; i++) {
+                    const worker = liveWorkers[i];
+                    if (worker === undefined)
+                        continue;
+                    if (busySlots.has(i)) {
+                        retireWorkerAfterTimeout(worker, i, 'circuit breaker tripped with job in flight');
+                    }
+                    else {
+                        idleWorkers.push(worker);
+                    }
+                }
                 activeSlots.clear();
-                void terminateTrackedWorkers(liveWorkers);
+                void terminateTrackedWorkers(idleWorkers);
             };
             const maybeDone = () => {
                 if (stopped)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.10-rc.18",
+  "version": "1.6.10-rc.19",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",