gitnexus 1.6.11-rc.8 → 1.6.11

package/dist/mcp/tools.js

@@ -49,6 +49,8 @@ export const PDG_QUERY_MAX_LIMIT = 200;
 // Shared impact traversal depth cap. The MCP schema advertises this bound;
 // PDG direct backend callers also enforce it before running traversal.
 export const IMPACT_MAX_DEPTH = 32;
+const CWD_AWARE_REPO_OMISSION = 'Omit when only one repo is indexed, an MCP default is configured, or the GitNexus process cwd is inside a registered path without crossing an unindexed nested Git checkout; otherwise specify it explicitly.';
+const MUTATING_REPO_OMISSION = 'Omit only when one repo is indexed or an MCP default is configured; otherwise mutating tools require an explicit repo.';
 export const GITNEXUS_TOOLS = [
     {
         name: 'list_repos',
@@ -61,8 +63,10 @@ PAGINATION: Results are paginated so a large registry is not truncated by MCP/LL
 WHEN TO USE: First step when multiple repos are indexed, or to discover available repos.
 AFTER THIS: READ gitnexus://repo/{name}/context for the repo you want to work with.
 
-When multiple repos are indexed, you MUST specify the "repo" parameter
-on other tools (query, context, impact, etc.) to target the correct one.`,
+When multiple repos are indexed, repo-scoped read-only tools use the configured
+MCP default or the registered path containing the GitNexus process cwd, unless
+cwd has crossed into an unindexed nested Git checkout. If neither applies,
+specify the "repo" parameter explicitly.`,
         annotations: READ_ONLY_TOOL_ANNOTATIONS,
         inputSchema: {
             type: 'object',
@@ -148,7 +152,7 @@ SERVICE: optional monorepo path prefix (POSIX-style, case-sensitive segments). W
                 },
                 repo: {
                     type: 'string',
-                    description: 'Indexed repository name or path, or group mode "@<groupName>" / "@<groupName>/<memberPath>" (member path keys from group.yaml). Omit when only one indexed repo exists.',
+                    description: `Indexed repository name or path, or group mode "@<groupName>" / "@<groupName>/<memberPath>" (member path keys from group.yaml). ${CWD_AWARE_REPO_OMISSION}`,
                 },
                 service: {
                     type: 'string',
@@ -167,7 +171,7 @@ WHEN TO USE: Complex structural queries that search/explore can't answer. READ g
 AFTER THIS: Use context() on result symbols for deeper context.
 
 SCHEMA:
-- Nodes: File, Folder, Function, Class, Interface, Method, CodeElement, Community, Process, Route, Tool
+- Nodes: File, Folder, Function, Class, Interface, Method, CodeElement, Community, Process, Route, Tool, Destination
 - Multi-language nodes (use backticks): \`Struct\`, \`Enum\`, \`Trait\`, \`Impl\`, etc.
 - All edges via single CodeRelation table with 'type' property
 - Edge types: ${REL_TYPES.join(', ')} — CFG, REACHING_DEF, TAINTED, SANITIZES, TAINT_PATH, CDG, POST_DOMINATE are populated ONLY on indexes built with \`gitnexus analyze --pdg\` (zero rows on a default index); OVERRIDES is a legacy alias — rows are written as METHOD_OVERRIDES
@@ -227,7 +231,7 @@ TIPS:
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path. Omit if only one repo is indexed.',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
                 },
             },
             required: ['statement'],
@@ -290,7 +294,7 @@ SERVICE: optional monorepo path prefix (case-sensitive path segments). When "rep
                 },
                 repo: {
                     type: 'string',
-                    description: 'Indexed repository name or path, or group mode "@<groupName>" / "@<groupName>/<memberPath>". Omit if only one repo is indexed.',
+                    description: `Indexed repository name or path, or group mode "@<groupName>" / "@<groupName>/<memberPath>". ${CWD_AWARE_REPO_OMISSION}`,
                 },
                 service: {
                     type: 'string',
@@ -334,7 +338,7 @@ Returns: changed symbols, affected processes, and a risk summary.
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path. Omit if only one repo is indexed.',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
                 },
             },
             required: [],
@@ -373,7 +377,7 @@ A graph too large to analyze at all returns \`{ error, truncated: true }\` with
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path. Omit if only one repo is indexed.',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
                 },
             },
             required: [],
@@ -410,7 +414,7 @@ Handles disambiguation via context()'s payload verbatim: an ambiguous symbol_nam
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path. Omit if only one repo is indexed.',
+                    description: `Repository name or path. ${MUTATING_REPO_OMISSION}`,
                 },
             },
             required: ['new_name'],
@@ -438,7 +442,7 @@ Output includes:
 - summary: direct callers, processes affected, modules affected
 - affected_processes: which execution flows break and at which step
 - affected_modules: which functional areas are hit (direct vs indirect; classification-unavailable when that secondary query fails)
-- byDepth: affected symbols grouped by traversal depth (paginated by limit/offset; omitted when summaryOnly:true — use byDepthCounts for totals per depth, pagination object when truncated). Each item includes a processes:[{id,label,processType,step}] field listing the execution flows that symbol participates in. Empty when the symbol has no process membership. Can ALSO be empty when partial:true is set — either the process-aggregation pass hit its cap before detecting affected processes, or per-symbol enrichment was capped on a very large page. When partial:true, do NOT treat processes:[] as proof of no participation; cross-check the top-level affected_processes list.
+- byDepth: affected symbols grouped by traversal depth (paginated by limit/offset; omitted when summaryOnly:true — use byDepthCounts for totals per depth, pagination object when truncated). Each item includes a processes:[{id,label,processType,step}] field listing the execution flows that symbol participates in. Empty when the symbol has no process membership. Can ALSO be empty when partial:true is set — either the process-aggregation pass hit its cap before detecting affected processes, or per-symbol enrichment was capped on a very large page. When partial:true, do NOT treat processes:[] as proof of no participation; cross-check the top-level affected_processes list. An item carries staticGated:true only when the edge that reached it is provably unreachable at compile time from the indexed source (today: Zig calls inside an 'if (CONST_FALSE)' body or the else of 'if (CONST_TRUE)'); the field is absent when the edge is live or the language does not model it. Traversal and risk do NOT filter or rank on it: it is metadata for the caller to weigh.
 - epistemic: 'exact' | 'lower-bound' — whether impactedCount is the whole story. 'lower-bound' means the walk provably missed callers, so the count is a floor. Absent only on skipped probes (ambiguous-candidate lists, group fan-out).
 - boundaries: string[] — one plain-language sentence per reason the count is short. Prose for humans; branch on causes instead.
 - causes: { scopeExtractionFiles, receiverTyping, dispatchBoundary, externalBoundary, undecidedSatisfaction } — the machine-readable split of WHY, so an agent gating its own edits can tell a fixable analyzer gap from an irreducible one. Every field counts MISSING THINGS, never sentences:
@@ -542,7 +546,7 @@ SERVICE: optional monorepo path prefix (case-sensitive path segments). When "rep
                 },
                 repo: {
                     type: 'string',
-                    description: 'Indexed repository name or path, or group mode "@<groupName>" / "@<groupName>/<memberPath>". Omit if only one repo is indexed.',
+                    description: `Indexed repository name or path, or group mode "@<groupName>" / "@<groupName>/<memberPath>". ${CWD_AWARE_REPO_OMISSION}`,
                 },
                 service: {
                     type: 'string',
@@ -630,7 +634,7 @@ Findings are deliberately NOT part of impact()'s traversal or the web schema —
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path. Omit if only one repo is indexed.',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
                 },
             },
             required: [],
@@ -679,7 +683,7 @@ CONTRACT CAVEATS:
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path. Omit if only one repo is indexed.',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
                 },
             },
             required: ['mode', 'target'],
@@ -692,7 +696,7 @@ CONTRACT CAVEATS:
 WHEN TO USE: Understanding API consumption patterns, finding orphaned routes. For pre-change analysis, prefer \`api_impact\` which combines this data with mismatch detection and risk assessment.
 AFTER THIS: Use impact() on specific route handlers to see full blast radius.
 
-Returns: route nodes with their handlers, middleware wrapper chains (e.g., withAuth, withRateLimit), and consumers. Each route object includes its "method" (the HTTP verb, "*" for method-agnostic routes, or null for method-less routes).`,
+Returns: route nodes with their handlers, middleware wrapper chains (e.g., withAuth, withRateLimit), and consumers. Each route object includes its "method" (the HTTP verb, "*" for method-agnostic routes, or null for method-less routes) and "runtimeEvidence". Runtime evidence is authoritative only when runtimeEvidence.confirmed is true; source records provenance, including conflicts.`,
         annotations: READ_ONLY_TOOL_ANNOTATIONS,
         inputSchema: {
             type: 'object',
@@ -703,7 +707,7 @@ Returns: route nodes with their handlers, middleware wrapper chains (e.g., withA
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path. Omit if only one repo is indexed.',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
                 },
             },
             required: [],
@@ -721,7 +725,10 @@ Returns: tool nodes with their handler files and descriptions.`,
             type: 'object',
             properties: {
                 tool: { type: 'string', description: 'Filter by tool name. Omit for all tools.' },
-                repo: { type: 'string', description: 'Repository name or path.' },
+                repo: {
+                    type: 'string',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
+                },
             },
             required: [],
         },
@@ -733,7 +740,7 @@ Returns: tool nodes with their handler files and descriptions.`,
 WHEN TO USE: Detecting mismatches between what an API route returns and what consumers expect. Finding shape drift. For pre-change analysis, prefer \`api_impact\` which combines this data with mismatch detection and risk assessment.
 REQUIRES: Route nodes with responseKeys (extracted from .json({...}) calls during indexing).
 
-Returns routes that have both detected response keys AND consumers. Shows top-level keys each endpoint returns (e.g., data, pagination, error) and what keys each consumer accesses. Reports MISMATCH status when a consumer accesses keys not present in the route's response shape. Each route object includes its "method" (the HTTP verb, "*" for method-agnostic routes, or null for method-less routes).`,
+Returns routes that have both detected response keys AND consumers. Shows top-level keys each endpoint returns (e.g., data, pagination, error) and what keys each consumer accesses. Reports MISMATCH status when a consumer accesses keys not present in the route's response shape. Each route object includes its "method" (the HTTP verb, "*" for method-agnostic routes, or null for method-less routes) and "runtimeEvidence". Runtime evidence is authoritative only when runtimeEvidence.confirmed is true.`,
         annotations: READ_ONLY_TOOL_ANNOTATIONS,
         inputSchema: {
             type: 'object',
@@ -744,7 +751,7 @@ Returns routes that have both detected response keys AND consumers. Shows top-le
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path. Omit if only one repo is indexed.',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
                 },
             },
             required: [],
@@ -758,7 +765,7 @@ WHEN TO USE: BEFORE modifying any API route handler. Shows what consumers depend
 
 Risk levels: LOW (0-3 consumers), MEDIUM (4-9 or any mismatches), HIGH (10+ consumers or mismatches with 4+ consumers). Mismatches with confidence "low" indicate the consumer file fetches multiple routes — property attribution is approximate.
 
-Response shape is keyed on how many routes match, not on the data: exactly one match returns a single route object; two or more return { routes: [...], total: N }. The same URL can expose multiple HTTP verbs (e.g. GET and POST /api/orders are distinct routes that share the URL), so a bare-URL lookup may return the wrapped form — every route object carries its own "method" so verbs are distinguishable. Pass "method" to narrow to one verb; the single-object shape is returned only when exactly one route remains after filtering — a substring route/file match spanning several URLs can still return the wrapped form. A URL/file that exists but has no route for the given verb returns an error. Each route's "method" is the literal "*" for method-agnostic routes (e.g. Django function views), which match any "method" selector, or null for method-less routes (filesystem, Laravel resource), which never match a selector. Combines route_map, shape_check, and impact data.`,
+Response shape is keyed on how many routes match, not on the data: exactly one match returns a single route object; two or more return { routes: [...], total: N }. The same URL can expose multiple HTTP verbs (e.g. GET and POST /api/orders are distinct routes that share the URL), so a bare-URL lookup may return the wrapped form — every route object carries its own "method" so verbs are distinguishable. Pass "method" to narrow to one verb; the single-object shape is returned only when exactly one route remains after filtering — a substring route/file match spanning several URLs can still return the wrapped form. A URL/file that exists but has no route for the given verb returns an error. Each route's "method" is the literal "*" for method-agnostic routes (e.g. Django function views), which match any "method" selector, or null for method-less routes (filesystem, Laravel resource), which never match a selector. Every route also carries "runtimeEvidence"; treat it as authoritative only when runtimeEvidence.confirmed is true. Combines route_map, shape_check, and impact data.`,
         annotations: READ_ONLY_TOOL_ANNOTATIONS,
         inputSchema: {
             type: 'object',
@@ -769,7 +776,10 @@ Response shape is keyed on how many routes match, not on the data: exactly one m
                     type: 'string',
                     description: 'Optional HTTP verb — GET, POST, PUT, PATCH, DELETE, etc. — to narrow a multi-verb route or file lookup to a single method. Returns an error if no matched route uses that verb.',
                 },
-                repo: { type: 'string', description: 'Repository name or path.' },
+                repo: {
+                    type: 'string',
+                    description: `Repository name or path. ${CWD_AWARE_REPO_OMISSION}`,
+                },
             },
             required: [],
         },
@@ -794,7 +804,7 @@ WHEN TO USE: Discover groups before group_sync. Optional "name" returns a single
 
 WHEN TO USE: After changing group.yaml or re-indexing member repos.
 
-READ THE RESULT: \`missingRepos\` are configured repos with no entry in the registry (index them, or drop them from group.yaml); \`unreadableRepos\` ARE registered but this sync could not extract from them — the index would not open (version skew, lock, corruption), or an extractor failed partway — so NONE of their contracts are in this sync and a following group_impact / group_contracts is a lower bound, not a verdict. \`registryOutcome\` says what happened to the file, and the three values a call here can return each need a different response: 'written' — this run's contracts replaced contracts.json; 'preserved' — nothing could be read, so contracts.json was rewritten keeping the previous sync's contracts and cross-links verbatim and refreshing only \`missingRepos\`/\`unreadableRepos\` to describe THIS run (the file changed, the contracts in it did not, and they are as old as the last sync that succeeded); 'superseded' — nothing could be read, and another sync replaced contracts.json while this one waited for the group lock; that file was left untouched and this run's lists were NOT recorded, because they describe an older group state than what is on disk (so the registry is fresher than this response's diagnostics, not staler); 'no-prior-registry' — nothing could be read AND there was no previous contracts.json to carry forward, so none was written and this group has no contract registry on disk. Only 'no-prior-registry' means there is nothing to read: after it, group_contracts / group_impact have no registry at all rather than a stale one, so fix the repos above and re-run before trusting either. \`suppressedMatchStages\` names matching stages this sync was ASKED to skip, with the same three states as the repo lists: ABSENT means a registry written before the field existed, \`[]\` means this sync suppressed nothing, and a populated list means the cross-link set is a lower bound BY REQUEST — a later group_impact / group_contracts on it reports truncationReason 'suppressed-stage'.\n\nPARAMETERS ARE VALIDATED: \`exactOnly\` must be a real boolean — the string "false" is rejected, not coerced to true. The retired \`skipEmbeddings\` and \`allowStale\` parameters are refused by name; drop them from the call.`,
+READ THE RESULT: \`missingRepos\` are configured repos with no entry in the registry (index them, or drop them from group.yaml); \`unreadableRepos\` ARE registered but this sync could not extract from them — the index would not open (version skew, lock, corruption), or an extractor failed partway — so NONE of their contracts are in this sync and a following group_impact / group_contracts is a lower bound, not a verdict. \`degradedLinks\` is the count of persisted cross-links whose provider endpoint has no resolved graph symbol (\`degraded: true\`); re-analyze the provider so handlers resolve. \`failedRepos\` is \`{ repo, reason }[]\` for per-repo extraction throws — each also appears in \`unreadableRepos\`; \`repo\` is that group path (e.g. app/backend), not the registry display name. \`warnings\` are operator-facing run notes (e.g. bridge.lbug write failed after contracts.json was written); \`[]\` means none this run. \`registryOutcome\` says what happened to the file, and the three values a call here can return each need a different response: 'written' — this run's contracts replaced contracts.json; 'preserved' — nothing could be read, so contracts.json was rewritten keeping the previous sync's contracts and cross-links verbatim and refreshing only \`missingRepos\`/\`unreadableRepos\` to describe THIS run (the file changed, the contracts in it did not, and they are as old as the last sync that succeeded); 'superseded' — nothing could be read, and another sync replaced contracts.json while this one waited for the group lock; that file was left untouched and this run's lists were NOT recorded, because they describe an older group state than what is on disk (so the registry is fresher than this response's diagnostics, not staler); 'no-prior-registry' — nothing could be read AND there was no previous contracts.json to carry forward, so none was written and this group has no contract registry on disk. Only 'no-prior-registry' means there is nothing to read: after it, group_contracts / group_impact have no registry at all rather than a stale one, so fix the repos above and re-run before trusting either. \`suppressedMatchStages\` names matching stages this sync was ASKED to skip, with the same three states as the repo lists: ABSENT means a registry written before the field existed, \`[]\` means this sync suppressed nothing, and a populated list means the cross-link set is a lower bound BY REQUEST — a later group_impact / group_contracts on it reports truncationReason 'suppressed-stage'.\n\nPARAMETERS ARE VALIDATED: \`exactOnly\` must be a real boolean — the string "false" is rejected, not coerced to true. The retired \`skipEmbeddings\` and \`allowStale\` parameters are refused by name; drop them from the call.`,
         // Usually writes contracts.json, so conservatively non-idempotent even
         // though output is deterministic for identical input. When no configured
         // repo could be read it still rewrites the file, keeping the previous
@@ -879,7 +889,7 @@ DESTINATION TRACE (cross-repo): for an "@groupName" trace, OMIT to/to_uid/to_fil
                 },
                 repo: {
                     type: 'string',
-                    description: 'Repository name or path, or "@groupName" / "@groupName/memberPath" for a cross-repo trace over a group. Omit if only one repo is indexed.',
+                    description: `Repository name or path, or "@groupName" / "@groupName/memberPath" for a cross-repo trace over a group. ${CWD_AWARE_REPO_OMISSION}`,
                 },
             },
             required: [],

package/dist/server/analyze-launch.d.ts

@@ -28,6 +28,8 @@ export interface LaunchOptions {
     force?: boolean;
     embeddings?: boolean;
     dropEmbeddings?: boolean;
+    springActuatorPath?: string;
+    asyncApiSpecPath?: string;
     registryName?: string;
 }
 export declare function createLaunchAnalysisWorker(deps: LaunchDeps): (job: {

package/dist/server/analyze-launch.js

@@ -280,6 +280,8 @@ export function createLaunchAnalysisWorker(deps) {
                     force: !!opts.force,
                     embeddings: !!opts.embeddings,
                     dropEmbeddings: !!opts.dropEmbeddings,
+                    ...(opts.springActuatorPath ? { springActuatorPath: opts.springActuatorPath } : {}),
+                    ...(opts.asyncApiSpecPath ? { asyncApiSpecPath: opts.asyncApiSpecPath } : {}),
                     ...(opts.registryName ? { registryName: opts.registryName } : {}),
                 },
             });

package/dist/server/analyze-worker-protocol.d.ts

@@ -25,12 +25,17 @@
  */
 import type { AnalyzeOptions } from '../core/run-analyze.js';
 import type { AnalyzeResultIpc } from './analyze-worker-ipc.js';
-/** Parent → child: the single command that starts an analysis run. */
+/** Parent → child: start one analysis run. */
 export interface StartMessage {
     type: 'start';
     repoPath: string;
     options: AnalyzeOptions;
 }
+/** Parent → child: request safe cancellation at the next JS-visible checkpoint. */
+export interface CancelMessage {
+    type: 'cancel';
+}
+export type ParentMessage = StartMessage | CancelMessage;
 export interface ProgressMessage {
     type: 'progress';
     phase: string;

package/dist/server/analyze-worker.d.ts

@@ -6,6 +6,7 @@
  *
  * IPC Protocol:
  *   Parent -> Child: { type: 'start', repoPath: string, options: AnalyzeOptions }
+ *   Parent -> Child: { type: 'cancel' }
  *   Child -> Parent: { type: 'progress', phase: string, percent: number, message: string }
  *   Child -> Parent: { type: 'complete', result: AnalyzeResult }
  *   Child -> Parent: { type: 'error', message: string }

package/dist/server/analyze-worker.js

@@ -6,6 +6,7 @@
  *
  * IPC Protocol:
  *   Parent -> Child: { type: 'start', repoPath: string, options: AnalyzeOptions }
+ *   Parent -> Child: { type: 'cancel' }
  *   Child -> Parent: { type: 'progress', phase: string, percent: number, message: string }
  *   Child -> Parent: { type: 'complete', result: AnalyzeResult }
  *   Child -> Parent: { type: 'error', message: string }
@@ -46,19 +47,24 @@ process.on('unhandledRejection', (reason) => {
         setTimeout(() => process.exit(1), 500);
     }
 });
-// Handle cancellation / timeout shutdown (analyze-job.ts `cancelJob` sends
-// SIGTERM). Bounded CHECKPOINT-then-exit shared with the CLI SIGINT path (#2264):
-// skip the native close (the LadybugDB destructor can double-free after --pdg
-// writes), but don't block behind the in-flight COPY's connection lock — so a
-// single cancel can't abort or hang the worker. A CHECKPOINT failure is reported
-// to the parent over IPC, not swallowed; the exit always fires.
-process.on('SIGTERM', () => {
-    // Only report the cancellation if the analysis hasn't already reported a
-    // terminal outcome (#2264 P3) — otherwise this would flip an already-complete
-    // job to failed. The cleanup + exit below run regardless.
+// IPC cancellation is the cross-platform control path. It only records the
+// request while analysis is active; cleanup waits until the analysis promise has
+// returned to JS. SIGTERM is retained only for local process shutdown.
+let cancellationRequested = false;
+let started = false;
+function requestWorkerCancellation(source) {
+    if (cancellationRequested)
+        return;
+    cancellationRequested = true;
     if (claimTerminal()) {
-        send({ type: 'error', message: 'Analysis cancelled (worker received SIGTERM)' });
+        send({ type: 'error', message: `Analysis cancelled (${source})` });
     }
+    if (!started) {
+        // No analysis has started, so no native work needs a safe-point handshake.
+        process.exit(0);
+    }
+}
+function exitAfterCancellation() {
     if (!boundedCheckpointBeforeExit) {
         process.exit(0);
         return;
@@ -66,15 +72,19 @@ process.on('SIGTERM', () => {
     void boundedCheckpointBeforeExit({
         exitCode: 0,
         onFlushError: (err) => {
-            const message = err instanceof Error ? err.message : 'Worker checkpoint failed during SIGTERM';
+            const message = err instanceof Error ? err.message : 'Worker checkpoint failed during cancellation';
             send({ type: 'error', message });
         },
     });
-});
-// Listen for start command from parent — guarded against re-entry
-let started = false;
+}
+process.on('SIGTERM', () => requestWorkerCancellation('worker received SIGTERM'));
+// Listen for parent commands — guarded against re-entry.
 process.on('message', async (msg) => {
-    if (msg.type !== 'start' || started)
+    if (msg.type === 'cancel') {
+        requestWorkerCancellation('parent requested cancellation');
+        return;
+    }
+    if (started)
         return;
     started = true;
     try {
@@ -91,6 +101,10 @@ process.on('message', async (msg) => {
             return { analysisModule, repoManager, shutdownHelpers };
         });
         boundedCheckpointBeforeExit = prepared.loaded.shutdownHelpers.boundedCheckpointBeforeExit;
+        // A cancel can arrive while the dynamic imports are resolving. Do not begin
+        // a new analysis after that request; the finally block performs safe cleanup.
+        if (cancellationRequested)
+            return;
         // The run → finalize → report contract lives in the side-effect-free
         // analyze-worker-core seam (unit-testable without this entry module's
         // process.on side effects). It reports exactly one terminal message and
@@ -111,9 +125,13 @@ process.on('message', async (msg) => {
         }
     }
     finally {
-        // LadybugDB's native module prevents clean exit — force it (same reason the
-        // CLI uses process.exit(0)). In `finally` so the exit still fires even if the
-        // report above throws on a closed IPC channel (#2264 review P3).
-        setTimeout(() => process.exit(0), 500);
+        // A cancel must not end the process while runFullAnalysis may still be in
+        // native code. This continuation runs only after that promise has settled.
+        if (cancellationRequested)
+            exitAfterCancellation();
+        // Normal terminal outcomes still need the existing process exit because
+        // LadybugDB stays live.
+        else
+            setTimeout(() => process.exit(0), 500);
     }
 });

package/dist/server/api.d.ts

@@ -10,6 +10,7 @@
 import express from 'express';
 import { type RegistryEntry } from '../storage/repo-manager.js';
 import { type GraphNode, type GraphRelationship } from '../_shared/index.js';
+export { bindServeUpdateControllerLifecycle, buildServerInfo, createServeUpdateController, type ServerInfoResponse, type ServeUpdateController, } from './update-controller.js';
 /**
  * Determine whether an HTTP Origin header value is allowed by CORS policy.
  *
@@ -50,6 +51,10 @@ export declare const landingPageHtml: () => string;
 export declare const staticCacheControlSetHeaders: (res: express.Response, filePath: string) => void;
 export declare const registerWebUI: (app: express.Express, staticDir: string | null) => void;
 export declare const writeNdjsonRecord: (res: express.Response, record: GraphStreamRecord, signal?: AbortSignal) => Promise<void>;
+export declare const buildGraph: (includeContent?: boolean) => Promise<{
+    nodes: GraphNode[];
+    relationships: GraphRelationship[];
+}>;
 export declare const getNodeQuery: (table: string, includeContent: boolean) => string;
 export declare const streamGraphNdjson: (res: express.Response, includeContent?: boolean, signal?: AbortSignal) => Promise<void>;
 /**
@@ -111,4 +116,3 @@ export declare function validateAnalyzeToken(repoToken: unknown, repoUrl: unknow
     error: string;
 } | null;
 export declare const createServer: (port: number, host?: string) => Promise<void>;
-export {};