gitnexus 1.6.6-rc.16 → 1.6.6-rc.18

package/dist/cli/setup.js

@@ -48,11 +48,13 @@ function resolveGitnexusBin() {
             .map((l) => l.trim())
             .filter(Boolean);
         if (isWin) {
-            // On Windows, `where` returns multiple entries (e.g. the POSIX shell
-            // script AND the .cmd/.bat wrapper). Prefer the wrapper because
-            // child_process.spawn() cannot execute a shell script directly.
+            // On Windows, npm global installs can surface multiple launchers for the
+            // same package (e.g. a POSIX shell shim plus .cmd/.bat wrappers). Claude
+            // and the other MCP hosts need a directly spawnable command path, so only
+            // accept the Windows wrapper. If it is missing, fall back to the slower
+            // npx entry instead of persisting a non-spawnable shim path.
             const cmdLine = lines.find((l) => /\.(cmd|bat)$/i.test(l));
-            return cmdLine || lines[0] || null;
+            return cmdLine || null;
         }
         return lines[0] || null;
     }

package/dist/server/api.js

@@ -377,7 +377,15 @@ export const streamGraphNdjson = async (res, includeContent = false, signal) =>
  */
 const mountSSEProgress = (app, routePath, jm) => {
     app.get(routePath, (req, res) => {
-        const job = jm.getJob(req.params.jobId);
+        let jobId;
+        try {
+            jobId = assertString(req.params.jobId, 'jobId');
+        }
+        catch (err) {
+            res.status(err.status ?? 400).json({ error: err.message });
+            return;
+        }
+        const job = jm.getJob(jobId);
         if (!job) {
             res.status(404).json({ error: 'Job not found' });
             return;
@@ -417,7 +425,7 @@ const mountSSEProgress = (app, routePath, jm) => {
             try {
                 eventId++;
                 if (progress.phase === 'complete' || progress.phase === 'failed') {
-                    const eventJob = jm.getJob(req.params.jobId);
+                    const eventJob = jm.getJob(jobId);
                     res.write(`id: ${eventId}\nevent: ${progress.phase}\ndata: ${JSON.stringify({
                         repoName: eventJob?.repoName,
                         error: eventJob?.error,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.6-rc.16",
+  "version": "1.6.6-rc.18",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -60,7 +60,7 @@
     "cli-progress": "^3.12.0",
     "commander": "^14.0.3",
     "cors": "^2.8.5",
-    "express": "^4.19.2",
+    "express": "^5.2.1",
     "express-rate-limit": "^8.4.1",
     "glob": "^13.0.6",
     "graphology": "^0.26.0",
@@ -100,7 +100,7 @@
   "devDependencies": {
     "@types/cli-progress": "^3.11.6",
     "@types/cors": "^2.8.17",
-    "@types/express": "^4.17.21",
+    "@types/express": "^5.0.6",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.6.0",
     "@types/uuid": "^11.0.0",