gitnexus 1.6.11-rc.8 → 1.6.11

package/dist/server/api.js

@@ -11,7 +11,6 @@ import express from 'express';
 import cors from 'cors';
 import path from 'path';
 import fs from 'fs/promises';
-import { createRequire } from 'node:module';
 import { canonicalizePath, cloneDirBelongsToEntry, loadMeta, saveMeta, listRegisteredRepos, getStoragePath, registryPathEquals, } from '../storage/repo-manager.js';
 import { executeQuery, executePrepared, executeWithReusedStatement, streamQuery, flushWAL, closeLbug, withLbugDb, isReadOnlyDbError, } from '../core/lbug/lbug-adapter.js';
 import { isValidQueryParams } from '../core/lbug/query-params.js';
@@ -20,15 +19,17 @@ import { searchFTSFromLbug } from '../core/search/bm25-index.js';
 import { hybridSearch } from '../core/search/hybrid-search.js';
 import { ftsDegradedWarning } from '../core/search/fts-indexes.js';
 import { LocalBackend } from '../mcp/local/local-backend.js';
-import { mountMCPEndpoints } from './mcp-http.js';
+import { installServeMcpAuth, mountMCPEndpoints } from './mcp-http.js';
 import { fileURLToPath } from 'url';
 import { isTerminalJobStatus, JobManager } from './analyze-job.js';
 import { mountSSEProgress } from './sse-progress.js';
 import { resolveEmbedRunOutcome, withMeasuredEmbeddingCount, } from './embed-run-outcome.js';
 import { decideEmbeddingResume, mintInterruptedCheckpoint } from '../core/embedding-checkpoint.js';
 import { measurePersistedEmbeddingCount, persistedEmbeddingCountOrUndefined, } from '../core/embedding-count.js';
-import { assertString, escapeRegExp, BadRequestError, createRouteLimiter } from './validation.js';
-import { extractRepoName, getCloneDir, cloneOrPull, warnIfInsecureAzureConfig, GITHUB_TOKEN_HOSTS, } from './git-clone.js';
+import { assertString, BadRequestError, createRouteLimiter } from './validation.js';
+import { parseGrepQuery, GREP_TIME_BUDGET_MS } from './grep-params.js';
+import { runGrepScanInWorker } from './grep-scan.js';
+import { extractWebRepoName, getCloneDir, cloneOrPull, warnIfInsecureAzureConfig, GITHUB_TOKEN_HOSTS, } from './git-clone.js';
 import { createAnalyzeUploadHandler } from './analyze-upload.js';
 import { assertServeAuthForPublicOrigin, createPublicOriginMatcher, createWriteOriginGuard, logOriginPolicy, PUBLIC_ORIGIN_ENV, resolveTrustProxy, TRUST_PROXY_ENV, warnIfRateLimitKeysCollapse, } from './middleware.js';
 import { createLaunchAnalysisWorker } from './analyze-launch.js';
@@ -36,8 +37,8 @@ import { UPLOAD_ROOT } from './upload-paths.js';
 import { sweepStaleUploads } from './upload-sweep.js';
 import { isRfc1918PrivateIpv4 } from './private-ip.js';
 import { logger, flushLoggerSync } from '../core/logger.js';
-const _require = createRequire(import.meta.url);
-const pkg = _require('../../package.json');
+import { bindServeUpdateControllerLifecycle, buildServerInfo, createServeUpdateController, } from './update-controller.js';
+export { bindServeUpdateControllerLifecycle, buildServerInfo, createServeUpdateController, } from './update-controller.js';
 /**
  * Determine whether an HTTP Origin header value is allowed by CORS policy.
  *
@@ -264,7 +265,18 @@ export const writeNdjsonRecord = async (res, record, signal) => {
         throw err;
     }
 };
-const buildGraph = async (includeContent = false) => {
+const ROUTE_NODE_CORE_PROJECTION = 'n.id AS id, n.name AS name, n.filePath AS filePath, ' +
+    'n.responseKeys AS responseKeys, n.errorKeys AS errorKeys, n.middleware AS middleware';
+const LEGACY_ROUTE_NODE_QUERY = `MATCH (n:\`Route\`) RETURN ${ROUTE_NODE_CORE_PROJECTION}`;
+const isMissingRouteRuntimePropertyError = (err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    const mentionsRuntimeProperty = ['runtimeConfirmed', 'runtimeSource', 'runtimeStatus'].some((property) => message.includes(property));
+    return (mentionsRuntimeProperty &&
+        (/cannot find property/i.test(message) ||
+            /property .* does not exist/i.test(message) ||
+            /property .* not found/i.test(message)));
+};
+export const buildGraph = async (includeContent = false) => {
     const nodes = [];
     for (const table of NODE_TABLES) {
         try {
@@ -274,6 +286,13 @@ const buildGraph = async (includeContent = false) => {
             }
         }
         catch (err) {
+            if (table === 'Route' && isMissingRouteRuntimePropertyError(err)) {
+                const rows = await executeQuery(LEGACY_ROUTE_NODE_QUERY);
+                for (const row of rows) {
+                    nodes.push(mapGraphNodeRow(table, row, includeContent));
+                }
+                continue;
+            }
             if (!isIgnorableGraphQueryError(err)) {
                 throw err;
             }
@@ -314,11 +333,14 @@ export const getNodeQuery = (table, includeContent) => {
         return `MATCH (n:${tableLabel}) RETURN n.id AS id, n.label AS label, n.heuristicLabel AS heuristicLabel, n.processType AS processType, n.stepCount AS stepCount, n.communities AS communities, n.entryPointId AS entryPointId, n.terminalId AS terminalId`;
     }
     if (table === 'Route') {
-        return `MATCH (n:${tableLabel}) RETURN n.id AS id, n.name AS name, n.filePath AS filePath, n.responseKeys AS responseKeys, n.errorKeys AS errorKeys, n.middleware AS middleware`;
+        return `MATCH (n:${tableLabel}) RETURN ${ROUTE_NODE_CORE_PROJECTION}, n.runtimeConfirmed AS runtimeConfirmed, n.runtimeSource AS runtimeSource, n.runtimeStatus AS runtimeStatus`;
     }
     if (table === 'Tool') {
         return `MATCH (n:${tableLabel}) RETURN n.id AS id, n.name AS name, n.filePath AS filePath, n.description AS description`;
     }
+    if (table === 'Destination') {
+        return `MATCH (n:${tableLabel}) RETURN n.id AS id, n.name AS name, n.filePath AS filePath, n.startLine AS startLine, n.endLine AS endLine, n.address AS address, n.broker AS broker, n.resolution AS resolution, n.configKey AS configKey, n.configDefault AS configDefault`;
+    }
     return includeContent
         ? `MATCH (n:${tableLabel}) RETURN n.id AS id, n.name AS name, n.filePath AS filePath, n.startLine AS startLine, n.endLine AS endLine, n.content AS content`
         : `MATCH (n:${tableLabel}) RETURN n.id AS id, n.name AS name, n.filePath AS filePath, n.startLine AS startLine, n.endLine AS endLine`;
@@ -342,6 +364,29 @@ const mapGraphNodeRow = (table, row, includeContent) => ({
         responseKeys: row.responseKeys,
         errorKeys: row.errorKeys,
         middleware: row.middleware,
+        // Normalize legacy Route projections to the modern contract. Source is
+        // provenance; only runtimeConfirmed === true is authoritative.
+        runtimeConfirmed: table === 'Route' ? (row.runtimeConfirmed ?? false) : undefined,
+        runtimeSource: table === 'Route' ? row.runtimeSource : undefined,
+        runtimeStatus: table === 'Route' ? row.runtimeStatus : undefined,
+        // The Destination overlay written by `pipeline-phases/spring-destinations.ts`.
+        // Gated on the label for the same reason as the Route columns above: no
+        // other node query projects them, so an ungated read would put a key on
+        // every node in the graph.
+        //
+        // `?? undefined` is not decoration. LadybugDB returns NULL columns as
+        // `null`, and `address` is the cross-repository JOIN KEY that a destination
+        // carries ONLY when it resolved. Passing the `null` straight through would
+        // serialize `"address": null` for every unresolved destination, turning an
+        // ABSENT property — which cannot match anything — into a PRESENT one that
+        // every other unresolved destination shares. That is the false connection
+        // the keying rule exists to prevent, reintroduced at the API boundary, so
+        // the null is normalized back to absent for all five columns alike.
+        address: table === 'Destination' ? (row.address ?? undefined) : undefined,
+        broker: table === 'Destination' ? (row.broker ?? undefined) : undefined,
+        resolution: table === 'Destination' ? (row.resolution ?? undefined) : undefined,
+        configKey: table === 'Destination' ? (row.configKey ?? undefined) : undefined,
+        configDefault: table === 'Destination' ? (row.configDefault ?? undefined) : undefined,
         heuristicLabel: row.heuristicLabel,
         cohesion: row.cohesion,
         symbolCount: row.symbolCount,
@@ -373,6 +418,15 @@ export const streamGraphNdjson = async (res, includeContent = false, signal) =>
             });
         }
         catch (err) {
+            if (table === 'Route' && isMissingRouteRuntimePropertyError(err)) {
+                await streamQuery(LEGACY_ROUTE_NODE_QUERY, async (row) => {
+                    await writeNdjsonRecord(res, {
+                        type: 'node',
+                        data: mapGraphNodeRow(table, row, includeContent),
+                    }, signal);
+                });
+                continue;
+            }
             if (!isIgnorableGraphQueryError(err)) {
                 throw err;
             }
@@ -616,6 +670,9 @@ export const createServer = async (port, host = '127.0.0.1') => {
             callback(null, isAllowedOrigin(origin));
         },
     }));
+    // Optional protocol-layer auth for the MCP route. Keep this before the
+    // global body parser so rejected requests do not consume the JSON budget.
+    installServeMcpAuth(app);
     app.use(express.json({ limit: '10mb' }));
     // Origin guard for write routes: loopback, the server's own bound host, and
     // any configured public origin — prevents CSRF from other devices.
@@ -631,6 +688,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
     await backend.init();
     const cleanupMcp = await mountMCPEndpoints(app, backend);
     const jobManager = new JobManager();
+    const updateController = createServeUpdateController();
     // Backstop: remove any upload staging dirs orphaned by a previous crash.
     void sweepStaleUploads().catch(() => { });
     // Shared repo lock — prevents concurrent analyze + embed on the same repo path,
@@ -744,21 +802,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
     });
     // Server info: version and launch context (npx / global / local dev)
     app.get('/api/info', (_req, res) => {
-        const execPath = process.env.npm_execpath ?? '';
-        const argv0 = process.argv[1] ?? '';
-        let launchContext;
-        if (execPath.includes('npx') ||
-            argv0.includes('_npx') ||
-            process.env.npm_config_prefix?.includes('_npx')) {
-            launchContext = 'npx';
-        }
-        else if (argv0.includes('node_modules')) {
-            launchContext = 'local';
-        }
-        else {
-            launchContext = 'global';
-        }
-        res.json({ version: pkg.version, launchContext, nodeVersion: process.version });
+        res.json(buildServerInfo(updateController.snapshot()));
     });
     // List all registered repos
     app.get('/api/repos', async (_req, res) => {
@@ -1126,75 +1170,29 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 res.status(404).json({ error: 'Repository not found' });
                 return;
             }
-            // Type-confusion guard (CodeQL js/type-confusion-through-parameter-tampering):
-            // req.query.pattern is `string | string[] | ParsedQs` — without an explicit
-            // type check, the `.length` guard below counts array elements instead of
-            // characters, allowing arbitrarily long patterns through.
-            const rawPattern = req.query.pattern;
-            if (rawPattern === undefined) {
-                res.status(400).json({ error: 'Missing "pattern" query parameter' });
-                return;
-            }
-            const pattern = assertString(rawPattern, 'pattern');
-            if (pattern.length === 0) {
-                res.status(400).json({ error: 'Missing "pattern" query parameter' });
-                return;
-            }
-            // Length cap: applies to both literal and regex modes as a defense-in-depth
-            // bound against pathological input.
-            if (pattern.length > 200) {
-                res.status(400).json({ error: 'Pattern too long (max 200 characters)' });
-                return;
-            }
-            // Treat user input as a literal substring in all cases to prevent
-            // regex-injection/ReDoS via attacker-controlled regex syntax.
-            const effectivePattern = escapeRegExp(pattern);
-            // Validate regex syntax (catches both opt-in user regex and any escapeRegExp bug)
-            let regex;
-            try {
-                regex = new RegExp(effectivePattern, 'gim');
-            }
-            catch {
-                res.status(400).json({ error: 'Invalid regex pattern' });
-                return;
-            }
-            const parsedLimit = Number(req.query.limit ?? 50);
-            const limit = Number.isFinite(parsedLimit)
-                ? Math.max(1, Math.min(200, Math.trunc(parsedLimit)))
-                : 50;
-            const results = [];
+            // Pattern parsing lives in grep-params.ts (unit-testable without
+            // Express + LadybugDB). Matching runs in a worker so terminate() can
+            // cut a stuck regex.test() when the wall-clock budget expires.
+            const { regex, fileFilter, limit } = parseGrepQuery(req.query);
             const repoRoot = path.resolve(entry.path);
-            // Get file paths from the graph (lightweight — no content loaded)
             const lbugPath = path.join(entry.storagePath, 'lbug');
             const fileRows = await withLbugDb(lbugPath, () => executeQuery(`MATCH (n:File) WHERE n.content IS NOT NULL RETURN n.filePath AS filePath`), { readOnly: true });
-            // Search files on disk one at a time (constant memory)
+            const filePaths = [];
             for (const row of fileRows) {
-                if (results.length >= limit)
-                    break;
                 const filePath = row.filePath || '';
-                const fullPath = path.resolve(repoRoot, filePath);
-                // Path traversal guard
-                const safeRepoRoot = repoRoot.endsWith(path.sep) ? repoRoot : repoRoot + path.sep;
-                if (!fullPath.startsWith(safeRepoRoot) && fullPath !== repoRoot)
+                if (fileFilter && !filePath.toLowerCase().includes(fileFilter))
                     continue;
-                let content;
-                try {
-                    content = await fs.readFile(fullPath, 'utf-8');
-                }
-                catch {
-                    continue; // File may have been deleted since indexing
-                }
-                const lines = content.split('\n');
-                for (let i = 0; i < lines.length; i++) {
-                    if (results.length >= limit)
-                        break;
-                    if (regex.test(lines[i])) {
-                        results.push({ filePath, line: i + 1, text: lines[i].trim().slice(0, 200) });
-                    }
-                    regex.lastIndex = 0;
-                }
+                filePaths.push(filePath);
             }
-            res.json({ results });
+            const { results, timedOut } = await runGrepScanInWorker({
+                repoRoot,
+                filePaths,
+                pattern: regex.source,
+                flags: regex.flags,
+                limit,
+                deadlineMs: Date.now() + GREP_TIME_BUDGET_MS,
+            });
+            res.json({ results, ...(timedOut ? { timedOut: true } : {}) });
         }
         catch (err) {
             res.status(statusFromError(err)).json({ error: err.message || 'Grep failed' });
@@ -1266,7 +1264,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
     // POST /api/analyze — start a new analysis job
     app.post('/api/analyze', createRouteLimiter({ limit: 10 }), requireTrustedOrigin, async (req, res) => {
         try {
-            const { url: repoUrl, path: repoLocalPath, force, embeddings, dropEmbeddings, token: repoToken, } = req.body;
+            const { url: repoUrl, path: repoLocalPath, force, embeddings, dropEmbeddings, springActuatorPath, asyncApiSpecPath, token: repoToken, } = req.body;
             // Input type validation
             if (repoUrl !== undefined && typeof repoUrl !== 'string') {
                 res.status(400).json({ error: '"url" must be a string' });
@@ -1276,6 +1274,16 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 res.status(400).json({ error: '"path" must be a string' });
                 return;
             }
+            if (springActuatorPath !== undefined &&
+                (typeof springActuatorPath !== 'string' || springActuatorPath.trim().length === 0)) {
+                res.status(400).json({ error: '"springActuatorPath" must be a non-empty string' });
+                return;
+            }
+            if (asyncApiSpecPath !== undefined &&
+                (typeof asyncApiSpecPath !== 'string' || asyncApiSpecPath.trim().length === 0)) {
+                res.status(400).json({ error: '"asyncApiSpecPath" must be a non-empty string' });
+                return;
+            }
             if (!repoUrl && !repoLocalPath) {
                 res.status(400).json({ error: 'Provide "url" (git URL) or "path" (local path)' });
                 return;
@@ -1328,7 +1336,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 try {
                     // Clone if URL provided
                     if (repoUrl && !repoLocalPath) {
-                        const repoName = extractRepoName(repoUrl);
+                        const repoName = extractWebRepoName(repoUrl);
                         targetPath = getCloneDir(repoName);
                         jobManager.updateJob(job.id, {
                             status: 'cloning',
@@ -1344,7 +1352,13 @@ export const createServer = async (port, host = '127.0.0.1') => {
                     if (!targetPath) {
                         throw new Error('No target path resolved');
                     }
-                    launchAnalysisWorker(job, targetPath, { force, embeddings, dropEmbeddings });
+                    launchAnalysisWorker(job, targetPath, {
+                        force,
+                        embeddings,
+                        dropEmbeddings,
+                        springActuatorPath,
+                        asyncApiSpecPath,
+                    });
                 }
                 catch (err) {
                     if (targetPath)
@@ -1702,11 +1716,14 @@ export const createServer = async (port, host = '127.0.0.1') => {
             resolve();
         });
         server.on('error', (err) => reject(err));
+        // `listening` is the successful startup boundary for notifier work.
+        bindServeUpdateControllerLifecycle(server, updateController);
         // Graceful shutdown — close Express + LadybugDB cleanly. Pino's default
         // destination is `sync: false` (buffered); `flushLoggerSync()` before
         // `process.exit` so records emitted during cleanup reach stderr.
         const shutdown = async () => {
             console.log('\nShutting down...');
+            updateController.stop();
             server.close();
             jobManager.dispose();
             embedJobManager.dispose();

package/dist/server/git-clone.d.ts

@@ -4,6 +4,9 @@
  * Shallow-clones repositories into the clone root (getGlobalDir()/repos/{name}/).
  * If already cloned, does git pull instead.
  */
+import { spawn } from 'child_process';
+import { validateGitUrl } from '../core/net/url-guard.js';
+export { validateGitUrl };
 export declare const REPO_NAME_PATTERN: RegExp;
 /**
  * Extract the repository name from a git URL (HTTPS or SSH).
@@ -13,18 +16,39 @@ export declare const REPO_NAME_PATTERN: RegExp;
  * clone root via path traversal.
  */
 export declare function extractRepoName(url: string): string;
-/** Get the clone target directory for a repo name. */
-export declare function getCloneDir(repoName: string): string;
 /**
- * Validate a git URL to prevent SSRF attacks.
- * Only allows https:// and http:// schemes. Blocks private/internal addresses,
- * IPv6 private ranges, cloud metadata hostnames, and numeric IP encodings.
+ * Derive a clone directory name for the web `/api/analyze` boundary.
+ *
+ * The API historically accepted Azure DevOps and similar URLs whose repo
+ * segment contains spaces or other directory-unsafe characters by sanitizing
+ * the final segment. Keep that compatibility at the web boundary while leaving
+ * `extractRepoName()` strict for internal/security-sensitive callers.
  */
-export declare function validateGitUrl(url: string): void;
+export declare function extractWebRepoName(url: string): string;
+/** Get the clone target directory for a repo name. */
+export declare function getCloneDir(repoName: string): string;
 export interface CloneProgress {
     phase: 'cloning' | 'pulling';
     message: string;
 }
+export interface CloneOrPullOptions {
+    token?: string;
+    allowedCloneRoot?: string;
+    expectedRepoName?: string;
+    quarantineRoot?: string;
+    allowAutoSyncSsh?: boolean;
+    timeoutMs?: number;
+    branch?: string;
+    overwriteLocalChanges?: boolean;
+    runGitForTest?: typeof runGit;
+}
+type RunGitOptions = {
+    token?: string;
+    url?: string;
+    timeoutMs?: number;
+    timeoutKillGraceMs?: number;
+    spawnForTest?: typeof spawn;
+};
 /**
  * Build the `git clone` argument list for a given URL and target directory.
  *
@@ -55,6 +79,7 @@ export declare function isAzureDevOpsUrl(url: string): boolean;
  */
 export declare function warnIfInsecureAzureConfig(): void;
 export declare function buildCloneArgs(url: string, targetDir: string): string[];
+export declare function buildBranchCloneArgs(url: string, targetDir: string, branch: string): string[];
 /**
  * Normalize a git URL into a comparable form.
  *
@@ -76,7 +101,7 @@ export declare function normalizeGitUrlForCompare(url: string): string;
  * remote means for its threat model — for cloneOrPull, a missing remote
  * on an existing clone is treated as a refuse-to-pull condition.
  */
-export declare function getRemoteOriginUrl(cwd: string): Promise<string | null>;
+export declare function getRemoteOriginUrl(cwd: string, timeoutMs?: number): Promise<string | null>;
 /**
  * Verify that an existing clone's `remote.origin.url` matches the requested
  * URL (after normalization). Throws on mismatch or missing remote.
@@ -91,7 +116,7 @@ export declare function getRemoteOriginUrl(cwd: string): Promise<string | null>;
  * Exported so the comparison logic is testable in isolation against any
  * tmpdir-based fixture, without needing to populate CLONE_ROOT.
  */
-export declare function assertRemoteMatchesRequestedUrl(targetDir: string, requestedUrl: string): Promise<void>;
+export declare function assertRemoteMatchesRequestedUrl(targetDir: string, requestedUrl: string, timeoutMs?: number): Promise<void>;
 /**
  * Clone or pull a git repository.
  * If targetDir doesn't exist: git clone --depth 1
@@ -116,9 +141,7 @@ export declare function assertRemoteMatchesRequestedUrl(targetDir: string, reque
  *     `--` (e.g. `--upload-pack=evil`) cannot be interpreted as a git option
  *     (CodeQL js/second-order-command-line-injection).
  */
-export declare function cloneOrPull(url: string, targetDir: string, onProgress?: (progress: CloneProgress) => void, options?: {
-    token?: string;
-}): Promise<string>;
+export declare function cloneOrPull(url: string, targetDir: string, onProgress?: (progress: CloneProgress) => void, options?: CloneOrPullOptions): Promise<string>;
 /**
  * Hosts the per-request GitHub PAT may be sent to. Exported so the
  * /api/analyze boundary check and this injection-site check share one
@@ -127,14 +150,15 @@ export declare function cloneOrPull(url: string, targetDir: string, onProgress?:
  */
 export declare const GITHUB_TOKEN_HOSTS: ReadonlySet<string>;
 /**
- * Build the spawn env for `git`. Suppresses credential prompts and, when a
- * credential resolves (see resolveGitCredential), injects a single
- * host-scoped Authorization header via the `GIT_CONFIG_*` env protocol
- * (git ≥2.31) so credentials never appear in argv or the URL. Appends after
- * any existing `GIT_CONFIG_COUNT` rather than overwriting it. Exported for
+ * Build the spawn env for managed `git` commands. Suppresses credential
+ * prompts, disables repository hooks, and injects at most one host-scoped
+ * Authorization header via the `GIT_CONFIG_*` env protocol (git ≥2.31).
+ * Managed settings append after any existing GIT_CONFIG_COUNT. Exported for
  * unit tests.
  */
 export declare function buildGitEnv(baseEnv: NodeJS.ProcessEnv, options?: {
     token?: string;
     url?: string;
 }): NodeJS.ProcessEnv;
+export declare function runGit(args: string[], cwd?: string, options?: RunGitOptions): Promise<string>;
+export declare const runGitForTest: typeof runGit;