gitnexus 1.6.5-rc.21 → 1.6.5-rc.23

package/dist/core/search/hybrid-search.d.ts

@@ -46,5 +46,8 @@ export declare const formatHybridResults: (results: HybridSearchResult[]) => str
  * Execute BM25 + semantic search and merge with RRF.
  * Uses LadybugDB FTS for always-fresh BM25 results (no cached data).
  * The semanticSearch function is injected to keep this module environment-agnostic.
+ *
+ * When FTS is unavailable (e.g. read-only MCP connection, missing indexes),
+ * falls back to semantic-only results instead of crashing (#1489).
  */
 export declare const hybridSearch: (query: string, limit: number, executeQuery: (cypher: string) => Promise<any[]>, semanticSearch: (executeQuery: (cypher: string) => Promise<any[]>, query: string, k?: number) => Promise<SemanticSearchResult[]>) => Promise<HybridSearchResult[]>;

package/dist/core/search/hybrid-search.js

@@ -23,9 +23,14 @@ const RRF_K = 60;
  */
 export const mergeWithRRF = (bm25Results, semanticResults, limit = 10) => {
     const merged = new Map();
+    // Guard against undefined/null inputs (#1489) — when FTS is unavailable
+    // in the MCP process, bm25Results can arrive as undefined and the
+    // for-loop would throw "bm25Results is not iterable".
+    const safeBm25 = bm25Results ?? [];
+    const safeSemantic = semanticResults ?? [];
     // Process BM25 results
-    for (let i = 0; i < bm25Results.length; i++) {
-        const r = bm25Results[i];
+    for (let i = 0; i < safeBm25.length; i++) {
+        const r = safeBm25[i];
         const rrfScore = 1 / (RRF_K + i + 1); // i+1 because rank starts at 1
         merged.set(r.filePath, {
             filePath: r.filePath,
@@ -36,8 +41,8 @@ export const mergeWithRRF = (bm25Results, semanticResults, limit = 10) => {
         });
     }
     // Process semantic results and merge
-    for (let i = 0; i < semanticResults.length; i++) {
-        const r = semanticResults[i];
+    for (let i = 0; i < safeSemantic.length; i++) {
+        const r = safeSemantic[i];
         const rrfScore = 1 / (RRF_K + i + 1);
         const existing = merged.get(r.filePath);
         if (existing) {
@@ -110,10 +115,22 @@ export const formatHybridResults = (results) => {
  * Execute BM25 + semantic search and merge with RRF.
  * Uses LadybugDB FTS for always-fresh BM25 results (no cached data).
  * The semanticSearch function is injected to keep this module environment-agnostic.
+ *
+ * When FTS is unavailable (e.g. read-only MCP connection, missing indexes),
+ * falls back to semantic-only results instead of crashing (#1489).
  */
 export const hybridSearch = async (query, limit, executeQuery, semanticSearch) => {
-    // Use LadybugDB FTS for always-fresh BM25 results
-    const { results: bm25Results } = await searchFTSFromLbug(query, limit);
+    // Use LadybugDB FTS for always-fresh BM25 results.
+    // If FTS fails (e.g. extension not loaded in MCP process), fall back to
+    // semantic-only search instead of crashing with "bm25Results is not iterable".
+    let bm25Results = [];
+    try {
+        const ftsResponse = await searchFTSFromLbug(query, limit);
+        bm25Results = ftsResponse?.results ?? [];
+    }
+    catch {
+        // FTS unavailable — continue with semantic-only search
+    }
     const semanticResults = await semanticSearch(executeQuery, query, limit);
     return mergeWithRRF(bm25Results, semanticResults, limit);
 };

package/dist/core/wiki/generator.js

@@ -14,6 +14,7 @@ import path from 'path';
 import { execSync, execFileSync } from 'child_process';
 import { initWikiDb, closeWikiDb, touchWikiDb, getFilesWithExports, getAllFiles, getIntraModuleCallEdges, getInterModuleCallEdges, getProcessesForFiles, getAllProcesses, getInterModuleEdgesForOverview, } from './graph-queries.js';
 import { generateHTMLViewer } from './html-viewer.js';
+import { sanitizeMermaidMarkdown } from './mermaid-sanitizer.js';
 import { callLLM, estimateTokens, } from './llm-client.js';
 import { callCursorLLM, resolveCursorConfig } from './cursor-client.js';
 import { GROUPING_SYSTEM_PROMPT, GROUPING_USER_PROMPT, MODULE_SYSTEM_PROMPT, MODULE_USER_PROMPT, PARENT_SYSTEM_PROMPT, PARENT_USER_PROMPT, OVERVIEW_SYSTEM_PROMPT, OVERVIEW_USER_PROMPT, fillTemplate, formatFileListForGrouping, formatDirectoryTree, formatCallEdges, formatProcesses, } from './prompts.js';
@@ -445,7 +446,7 @@ export class WikiGenerator {
         });
         const response = await this.invokeLLM(prompt, MODULE_SYSTEM_PROMPT, this.streamOpts(node.name));
         // Write page with front matter
-        const pageContent = `# ${node.name}\n\n${response.content}`;
+        const pageContent = sanitizeMermaidMarkdown(`# ${node.name}\n\n${response.content}`);
         await fs.writeFile(path.join(this.wikiDir, `${node.slug}.md`), pageContent, 'utf-8');
     }
     /**
@@ -480,7 +481,7 @@ export class WikiGenerator {
             CROSS_PROCESSES: formatProcesses(processes),
         });
         const response = await this.invokeLLM(prompt, PARENT_SYSTEM_PROMPT, this.streamOpts(node.name));
-        const pageContent = `# ${node.name}\n\n${response.content}`;
+        const pageContent = sanitizeMermaidMarkdown(`# ${node.name}\n\n${response.content}`);
         await fs.writeFile(path.join(this.wikiDir, `${node.slug}.md`), pageContent, 'utf-8');
     }
     // ─── Phase 3: Generate Overview ─────────────────────────────────────
@@ -516,7 +517,7 @@ export class WikiGenerator {
             TOP_PROCESSES: formatProcesses(topProcesses),
         });
         const response = await this.invokeLLM(prompt, OVERVIEW_SYSTEM_PROMPT, this.streamOpts('Generating overview', 88));
-        const pageContent = `# ${path.basename(this.repoPath)} — Wiki\n\n${response.content}`;
+        const pageContent = sanitizeMermaidMarkdown(`# ${path.basename(this.repoPath)} — Wiki\n\n${response.content}`);
         await fs.writeFile(path.join(this.wikiDir, 'overview.md'), pageContent, 'utf-8');
     }
     // ─── Incremental Updates ────────────────────────────────────────────

package/dist/core/wiki/html-viewer.js

@@ -6,6 +6,7 @@
  */
 import fs from 'fs/promises';
 import path from 'path';
+import { sanitizeMermaidMarkdown } from './mermaid-sanitizer.js';
 /**
  * Generate the wiki HTML viewer (index.html) from existing markdown pages.
  */
@@ -33,7 +34,7 @@ export async function generateHTMLViewer(wikiDir, projectName) {
     const dirEntries = await fs.readdir(wikiDir);
     for (const f of dirEntries.filter((f) => f.endsWith('.md'))) {
         const content = await fs.readFile(path.join(wikiDir, f), 'utf-8');
-        pages[f.replace(/\.md$/, '')] = content;
+        pages[f.replace(/\.md$/, '')] = sanitizeMermaidMarkdown(content);
     }
     const html = buildHTML(projectName, moduleTree, pages, meta);
     const outputPath = path.join(wikiDir, 'index.html');

package/dist/core/wiki/mermaid-sanitizer.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeMermaidMarkdown(markdown: string): string;
+export declare function sanitizeMermaidDiagram(diagram: string): string;

package/dist/core/wiki/mermaid-sanitizer.js

@@ -0,0 +1,100 @@
+const MERMAID_FENCE_RE = /```mermaid\s*\n([\s\S]*?)```/g;
+const NODE_LABEL_RE = /(\[[^\]\n]*(?:\\n)[^\]\n]*\]|\{[^}\n]*(?:\\n)[^}\n]*\}|\([^)\n]*(?:\\n)[^)\n]*\))/g;
+const EDGE_LABEL_RE = /\|([^|\n]+)\|/g;
+const UNSAFE_EDGE_LABEL_RE = /[()[\]{}<>]/;
+const UNSAFE_NODE_ID_RE = /[^A-Za-z0-9_-]/;
+const NODE_ID_RE = /^[A-Za-z0-9_.:/()-]+$/;
+const LINE_PREFIX_RE = /^(\s*(?:(?:[-A-Za-z0-9_]+)\s*:\s*)?)(.*)$/;
+const EDGE_RE = /(\s*(?:[ox])?(?:--+|==+|\.\.+)(?:[>|ox])?\|[^|\n]*\|(?:[>|ox])?|\s*(?:[ox])?(?:--+|==+|\.\.+)(?:[>|ox])?|\s*<--+>?\s*)/g;
+export function sanitizeMermaidMarkdown(markdown) {
+    return markdown.replace(MERMAID_FENCE_RE, (_match, diagram) => {
+        return '```mermaid\n' + sanitizeMermaidDiagram(diagram) + '```';
+    });
+}
+export function sanitizeMermaidDiagram(diagram) {
+    const aliases = new Map();
+    let nextAlias = 1;
+    const aliasFor = (id) => {
+        const existing = aliases.get(id);
+        if (existing)
+            return existing;
+        const base = id.replace(/[^A-Za-z0-9_-]/g, '_').replace(/^_+|_+$/g, '') || 'node';
+        let alias = base;
+        while ([...aliases.values()].includes(alias)) {
+            nextAlias += 1;
+            alias = `${base}_${nextAlias}`;
+        }
+        aliases.set(id, alias);
+        return alias;
+    };
+    return diagram
+        .split('\n')
+        .map((line) => sanitizeMermaidLine(line, aliasFor))
+        .join('\n');
+}
+function sanitizeMermaidLine(line, aliasFor) {
+    let sanitized = replaceLiteralLineBreaksInLabels(line);
+    sanitized = quoteUnsafeEdgeLabels(sanitized);
+    const prefixMatch = sanitized.match(LINE_PREFIX_RE);
+    if (!prefixMatch)
+        return sanitized;
+    const prefix = prefixMatch[1];
+    const body = prefixMatch[2];
+    if (isDirectiveLine(body))
+        return sanitized;
+    const parts = body.split(EDGE_RE);
+    if (parts.length === 1)
+        return sanitized;
+    for (let i = 0; i < parts.length; i += 2) {
+        parts[i] = sanitizeNodeReference(parts[i], aliasFor);
+    }
+    return prefix + parts.join('');
+}
+function replaceLiteralLineBreaksInLabels(line) {
+    return line.replace(NODE_LABEL_RE, (label) => label.replace(/\\n/g, '<br/>'));
+}
+function quoteUnsafeEdgeLabels(line) {
+    return line.replace(EDGE_LABEL_RE, (match, label) => {
+        const trimmed = label.trim();
+        if (!UNSAFE_EDGE_LABEL_RE.test(trimmed))
+            return match;
+        if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+            (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+            return match;
+        }
+        return `|"${escapeMermaidLabel(trimmed)}"|`;
+    });
+}
+function sanitizeNodeReference(segment, aliasFor) {
+    const match = segment.match(/^(\s*)([A-Za-z0-9_.:/()-]+)(.*?)(\s*)$/);
+    if (!match)
+        return segment;
+    const [, leading, id, suffix, trailing] = match;
+    if (!NODE_ID_RE.test(id) || !UNSAFE_NODE_ID_RE.test(id))
+        return segment;
+    const hasInlineLabel = suffix.trim().startsWith('[') || suffix.trim().startsWith('(') || suffix.trim().startsWith('{');
+    if (hasInlineLabel)
+        return `${leading}${aliasFor(id)}${suffix}${trailing}`;
+    return `${leading}${aliasFor(id)}["${escapeMermaidLabel(id)}"]${suffix}${trailing}`;
+}
+function escapeMermaidLabel(label) {
+    return label.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+function isDirectiveLine(line) {
+    const trimmed = line.trim();
+    return (trimmed === '' ||
+        trimmed.startsWith('%%') ||
+        trimmed.startsWith('graph ') ||
+        trimmed.startsWith('flowchart ') ||
+        trimmed.startsWith('sequenceDiagram') ||
+        trimmed.startsWith('classDiagram') ||
+        trimmed.startsWith('stateDiagram') ||
+        trimmed.startsWith('erDiagram') ||
+        trimmed.startsWith('journey') ||
+        trimmed.startsWith('gantt') ||
+        trimmed.startsWith('pie ') ||
+        trimmed.startsWith('mindmap') ||
+        trimmed.startsWith('timeline') ||
+        trimmed.startsWith('subgraph ') ||
+        trimmed === 'end');
+}

package/dist/mcp/local/local-backend.js

@@ -634,8 +634,10 @@ export class LocalBackend {
             timer.time('bm25', this.bm25Search(repo, searchQuery, searchLimit)),
             timer.time('vector', this.semanticSearch(repo, searchQuery, searchLimit)),
         ]);
-        const bm25Results = bm25SearchResult.results;
-        const ftsUsed = bm25SearchResult.ftsUsed;
+        // Guard against undefined results (#1489) — when FTS is entirely
+        // unavailable the search helper may return an unexpected shape.
+        const bm25Results = bm25SearchResult?.results ?? [];
+        const ftsUsed = bm25SearchResult?.ftsUsed ?? false;
         // Merge via reciprocal rank fusion
         timer.start('merge');
         const scoreMap = new Map();
@@ -651,8 +653,9 @@ export class LocalBackend {
                 scoreMap.set(key, { score: rrfScore, data: result });
             }
         }
-        for (let i = 0; i < semanticResults.length; i++) {
-            const result = semanticResults[i];
+        const safeSemanticResults = semanticResults ?? [];
+        for (let i = 0; i < safeSemanticResults.length; i++) {
+            const result = safeSemanticResults[i];
             const key = result.nodeId || result.filePath;
             const rrfScore = 1 / (60 + i);
             const existing = scoreMap.get(key);
@@ -826,7 +829,15 @@ export class LocalBackend {
      * BM25 keyword search helper - uses LadybugDB FTS for always-fresh results
      */
     async bm25Search(repo, query, limit) {
-        const { searchFTSFromLbug } = await import('../../core/search/bm25-index.js');
+        let searchFTSFromLbug;
+        try {
+            ({ searchFTSFromLbug } = await import('../../core/search/bm25-index.js'));
+        }
+        catch (err) {
+            // Module import can fail in sandboxed MCP contexts (#1489)
+            logger.warn({ err: err?.message }, 'GitNexus: bm25-index.js import failed — falling back to semantic-only');
+            return { results: [], ftsUsed: false };
+        }
         let ftsResponse;
         try {
             ftsResponse = await searchFTSFromLbug(query, limit, repo.id);
@@ -835,8 +846,10 @@ export class LocalBackend {
             logger.error({ err: err.message }, 'GitNexus: BM25/FTS search failed (FTS indexes may not exist) -');
             return { results: [], ftsUsed: false };
         }
-        const bm25Results = ftsResponse.results;
-        const ftsUsed = ftsResponse.ftsAvailable;
+        // Guard against unexpected response shape (#1489) — ftsResponse.results
+        // could be undefined when the FTS extension is unavailable in the MCP process.
+        const bm25Results = ftsResponse?.results ?? [];
+        const ftsUsed = ftsResponse?.ftsAvailable ?? false;
         const results = [];
         for (const bm25Result of bm25Results) {
             const fullPath = bm25Result.filePath;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.5-rc.21",
+  "version": "1.6.5-rc.23",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",