gitnexus 1.6.10-rc.30 → 1.6.10-rc.32

package/dist/core/ingestion/taint/typescript-model.js

@@ -35,10 +35,14 @@ export const TS_JS_TAINT_MODEL = {
         },
     ],
     sinks: [
-        // Command execution — the command string is argument 0.
+        // Command execution — shell strings are arg 0; argv-form APIs also treat
+        // the argv array at arg 1 as command/option injection surface.
         { name: 'exec', kind: 'command-injection', args: [0], module: 'child_process' },
         { name: 'execSync', kind: 'command-injection', args: [0], module: 'child_process' },
-        { name: 'spawn', kind: 'command-injection', args: [0], module: 'child_process' },
+        { name: 'spawn', kind: 'command-injection', args: [0, 1], module: 'child_process' },
+        { name: 'spawnSync', kind: 'command-injection', args: [0, 1], module: 'child_process' },
+        { name: 'execFile', kind: 'command-injection', args: [0, 1], module: 'child_process' },
+        { name: 'execFileSync', kind: 'command-injection', args: [0, 1], module: 'child_process' },
         // Code evaluation. `eval` takes code at 0; `new Function(...)` treats
         // EVERY argument as source text (params + body), so `args` is omitted
         // (= all positions) rather than pinned to 0.
@@ -53,9 +57,37 @@ export const TS_JS_TAINT_MODEL = {
         // (mysql2/pg/knex handles go by many names; receiver-conventional).
         { name: 'query', kind: 'sql-injection', args: [0], anyReceiver: true },
         { name: 'execute', kind: 'sql-injection', args: [0], anyReceiver: true },
+        // Modern DB libraries expose shorter method names with high collision
+        // rates (`map.get`, `task.run`, ...), so keep these receiver-conventional.
+        {
+            name: 'run',
+            kind: 'sql-injection',
+            args: [0],
+            receivers: ['db', 'database', 'conn', 'client', 'pool', 'stmt', 'statement', 'prepared'],
+        },
+        {
+            name: 'all',
+            kind: 'sql-injection',
+            args: [0],
+            receivers: ['db', 'database', 'conn', 'client', 'pool', 'stmt', 'statement', 'prepared'],
+        },
+        {
+            name: 'get',
+            kind: 'sql-injection',
+            args: [0],
+            receivers: ['db', 'database', 'conn', 'client', 'pool', 'stmt', 'statement', 'prepared'],
+        },
+        {
+            name: 'values',
+            kind: 'sql-injection',
+            args: [0],
+            receivers: ['db', 'database', 'conn', 'client', 'pool'],
+        },
+        { name: 'raw', kind: 'sql-injection', args: [0], receivers: ['db', 'knex', 'sequelize'] },
         // Reflected XSS — Express response writes, conventional receiver `res`.
         { name: 'send', kind: 'xss', args: [0], receivers: ['res'] },
         { name: 'write', kind: 'xss', args: [0], receivers: ['res'] },
+        { name: 'render', kind: 'xss', args: [0, 1], receivers: ['res'] },
     ],
     sanitizers: [
         // URL-encoding: neutralizes markup injection AND path separators

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.10-rc.30",
+  "version": "1.6.10-rc.32",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -52,7 +52,8 @@
     "postinstall": "node scripts/build-tree-sitter-grammars.cjs",
     "assert-publish-coverage": "node scripts/assert-publish-grammar-coverage.cjs",
     "prepare": "node scripts/build.js",
-    "prepack": "node scripts/assert-publish-grammar-coverage.cjs && node scripts/build.js"
+    "prepack": "node scripts/assert-publish-grammar-coverage.cjs && node scripts/build.js",
+    "version": "node scripts/sync-plugin-manifests.mjs"
   },
   "dependencies": {
     "@ladybugdb/core": "^0.18.0",

package/scripts/run-cross-platform.ts

@@ -48,10 +48,11 @@ try {
 
 // Per-shard watchdog, default 15 min. Sharding splits the file list by COUNT, not
 // runtime, so the heaviest spawn suites can cluster on one shard — what this
-// bounds is the *busiest* shard, not an even 1/n of wall-clock. With 3 shards
-// even that shard clears the watchdog, where the whole unsharded Windows run
-// used to trip it. Allow CI/manual runs to add headroom without editing the
-// script again.
+// bounds is the *busiest* shard, not an even 1/n of wall-clock. The busiest
+// Windows shard has grown to the default (14m57s on the v1.6.10-rc.19 green
+// run, one observed timeout since — #2449), so CI raises the budget to 20
+// minutes via GITNEXUS_CROSS_PLATFORM_TIMEOUT_MINUTES; the default stays 15
+// for local runs.
 const DEFAULT_TIMEOUT_MIN = 15;
 const timeoutMinutes = Number.parseInt(
   process.env.GITNEXUS_CROSS_PLATFORM_TIMEOUT_MINUTES ?? String(DEFAULT_TIMEOUT_MIN),
@@ -67,6 +68,7 @@ console.log(
     `${shardArg ? ` (${shardArg.replace('--shard=', 'shard ')})` : ''}...\n`,
 );
 
+const startedAt = Date.now();
 try {
   execFileSync('npx', ['vitest', 'run', ...ALL_CROSS_PLATFORM, ...(shardArg ? [shardArg] : [])], {
     cwd: ROOT,
@@ -76,9 +78,22 @@ try {
   });
 } catch (err) {
   // execFileSync sets `killed`/`signal` when the watchdog above kills vitest.
-  const e = err as { killed?: boolean; signal?: NodeJS.Signals | null };
+  const e = err as {
+    killed?: boolean;
+    signal?: NodeJS.Signals | null;
+    status?: number | null;
+    code?: string;
+  };
   if (e.killed || e.signal) {
     console.error(`vitest timed out after ${Math.round(timeoutMs / 60_000)} minutes`);
   }
+  // #2449: Windows shards have died with a bare `status: null`, empty stderr
+  // and nothing to triage from. Always leave the child's exit facts behind.
+  const elapsedSec = Math.round((Date.now() - startedAt) / 1000);
+  console.error(
+    `vitest exited abnormally: status=${e.status ?? 'null'} signal=${e.signal ?? 'none'} ` +
+      `killed=${e.killed === true} spawnCode=${e.code ?? 'none'} elapsed=${elapsedSec}s ` +
+      `budget=${Math.round(timeoutMs / 60_000)}min`,
+  );
   process.exit(1);
 }

package/scripts/sync-plugin-manifests.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+/**
+ * Fail-closed version sync for the plugin manifest surfaces (#2445).
+ *
+ * `publish.yml` bumps only `gitnexus/package.json` when it cuts an RC, so
+ * every RC tag through v1.6.10-rc.28 shipped manifests frozen at the last
+ * stable version and failed its own unit suite (the cli-commands version
+ * contract). This script pins all four manifest surfaces to the package
+ * version:
+ *
+ *   - gitnexus-claude-plugin/.claude-plugin/plugin.json   (top-level version)
+ *   - .claude-plugin/marketplace.json                     (plugins[gitnexus])
+ *   - gitnexus-claude-plugin/.codex-plugin/plugin.json    (top-level version)
+ *   - .agents/plugins/marketplace.json                    (plugins[gitnexus])
+ *
+ * Modes:
+ *   node scripts/sync-plugin-manifests.mjs           rewrite stale surfaces
+ *   node scripts/sync-plugin-manifests.mjs --check   verify only, exit 1 on drift
+ *
+ * Fail-closed: a missing file, unparseable JSON, an absent version field, or
+ * anything other than exactly one `gitnexus` marketplace entry aborts with a
+ * non-zero exit rather than letting a release ship a partial sync.
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MANIFEST_SURFACES = [
+  { file: 'gitnexus-claude-plugin/.claude-plugin/plugin.json', kind: 'plugin' },
+  { file: '.claude-plugin/marketplace.json', kind: 'marketplace' },
+  { file: 'gitnexus-claude-plugin/.codex-plugin/plugin.json', kind: 'plugin' },
+  { file: '.agents/plugins/marketplace.json', kind: 'marketplace' },
+];
+
+const PLUGIN_NAME = 'gitnexus';
+
+function readJson(filePath) {
+  let raw;
+  try {
+    raw = readFileSync(filePath, 'utf8');
+  } catch (err) {
+    throw new Error(`Cannot read manifest surface ${filePath}: ${err.message}`);
+  }
+  try {
+    return { raw, parsed: JSON.parse(raw) };
+  } catch (err) {
+    throw new Error(`Manifest surface ${filePath} is not valid JSON: ${err.message}`);
+  }
+}
+
+function versionTarget(manifest, kind, filePath) {
+  if (kind === 'plugin') {
+    if (typeof manifest.version !== 'string' || manifest.version.length === 0) {
+      throw new Error(`Manifest surface ${filePath} has no version field to sync`);
+    }
+    return manifest;
+  }
+  const entries = (Array.isArray(manifest.plugins) ? manifest.plugins : []).filter(
+    (plugin) => plugin?.name === PLUGIN_NAME,
+  );
+  if (entries.length !== 1) {
+    throw new Error(
+      `Manifest surface ${filePath} must contain exactly one "${PLUGIN_NAME}" plugin entry, found ${entries.length}`,
+    );
+  }
+  if (typeof entries[0].version !== 'string' || entries[0].version.length === 0) {
+    throw new Error(`Manifest surface ${filePath} has no version field to sync`);
+  }
+  return entries[0];
+}
+
+/**
+ * Sync (or with `check: true`, only inspect) every manifest surface under
+ * `rootDir`. Returns `{ version, synced, stale }` where `stale` lists the
+ * surfaces that did not match the package version when the run started.
+ */
+export function syncPluginManifests(rootDir, { check = false } = {}) {
+  const pkgPath = path.join(rootDir, 'gitnexus', 'package.json');
+  const version = readJson(pkgPath).parsed.version;
+  if (typeof version !== 'string' || version.length === 0) {
+    throw new Error(`No version found in ${pkgPath}`);
+  }
+
+  const synced = [];
+  const stale = [];
+  for (const { file, kind } of MANIFEST_SURFACES) {
+    const manifestPath = path.join(rootDir, file);
+    const { raw, parsed } = readJson(manifestPath);
+    const target = versionTarget(parsed, kind, manifestPath);
+    if (target.version === version) continue;
+
+    stale.push({ file, from: target.version });
+    if (check) continue;
+
+    // Textual surgery instead of re-serializing: JSON.stringify would refold
+    // arrays and fight prettier, turning a one-line version bump into
+    // formatting churn inside the release commit. The needle is built from
+    // the parsed current version, and anything other than exactly one
+    // occurrence aborts rather than guessing.
+    const needle = `"version": "${target.version}"`;
+    const occurrences = raw.split(needle).length - 1;
+    if (occurrences !== 1) {
+      throw new Error(
+        `Manifest surface ${manifestPath} has ${occurrences} occurrences of ${needle}; ` +
+          'expected exactly one, refusing to sync',
+      );
+    }
+    writeFileSync(manifestPath, raw.replace(needle, `"version": "${version}"`));
+    synced.push(file);
+  }
+
+  return { version, synced, stale };
+}
+
+const invokedDirectly =
+  process.argv[1] !== undefined && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+
+if (invokedDirectly) {
+  const check = process.argv.includes('--check');
+  const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+  const result = syncPluginManifests(rootDir, { check });
+
+  if (check && result.stale.length > 0) {
+    for (const { file, from } of result.stale) {
+      console.error(
+        `::error::${file} is at ${from} but gitnexus/package.json is at ${result.version}. ` +
+          'Run `node gitnexus/scripts/sync-plugin-manifests.mjs` and commit the result.',
+      );
+    }
+    process.exit(1);
+  }
+
+  for (const file of result.synced) {
+    console.log(`synced ${file} -> ${result.version}`);
+  }
+  console.log(
+    result.stale.length === 0 && result.synced.length === 0
+      ? `all plugin manifests already at ${result.version}`
+      : `plugin manifests now at ${result.version}`,
+  );
+}