gitnexus 1.6.6-rc.2 → 1.6.6-rc.21

package/dist/mcp/local/local-backend.js

@@ -7,14 +7,15 @@
  */
 import fs from 'fs/promises';
 import path from 'path';
-import { initLbug, executeQuery, executeParameterized, closeLbug, isLbugReady, isWriteQuery, } from '../../core/lbug/pool-adapter.js';
+import { initLbug, executeQuery, executeParameterized, closeLbug, isLbugReady, } from '../../core/lbug/pool-adapter.js';
+import { isValidQueryParams } from '../../core/lbug/query-params.js';
 import { isWalCorruptionError, WAL_RECOVERY_SUGGESTION } from '../../core/lbug/lbug-config.js';
-export { isWriteQuery };
 // Embedding imports are lazy (dynamic import) to avoid loading onnxruntime-node
 // at MCP server startup — crashes on unsupported Node ABI versions (#89)
 // git utilities available if needed
 // import { isGitRepo, getCurrentCommit, getGitRoot } from '../../storage/git.js';
-import { parseDiffHunks } from '../../storage/git.js';
+import { parseDiffHunks, getCanonicalRepoRoot, getGitRoot, } from '../../storage/git.js';
+import { realpathSync } from 'fs';
 import { listRegisteredRepos, cleanupOldKuzuFiles, } from '../../storage/repo-manager.js';
 import { GroupService } from '../../core/group/service.js';
 import { resolveAtGroupMemberRepoPath } from '../../core/group/resolve-at-member.js';
@@ -141,6 +142,7 @@ function logQueryError(context, err) {
     const msg = err instanceof Error ? err.message : String(err);
     logger.error({ context, err: msg }, 'GitNexus query failed');
 }
+const isReadOnlyDbError = (err) => /read-only database/i.test(err instanceof Error ? err.message : String(err));
 /**
  * Per-query latency telemetry for production aggregation (#553).
  *
@@ -160,6 +162,77 @@ function logQueryTiming(query, phases) {
     const truncated = query.length > 80 ? `${query.slice(0, 80)}…` : query;
     logger.debug({ query: truncated, totalMs, phases }, 'GitNexus query timing');
 }
+/** Resolve symlinks for path comparison; falls back to path.resolve on error.
+ * Uses `realpathSync.native` (not the pure-JS `realpathSync`) so that Windows
+ * 8.3 short names (e.g. RUNNER~1 → runneradmin) are expanded to long form,
+ * matching the output of `git rev-parse --show-toplevel`. */
+function tryRealpath(p) {
+    try {
+        return realpathSync.native(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+/**
+ * Resolve the git diff cwd for detect_changes, auto-detecting linked worktrees.
+ *
+ * When `launchCwd` is a linked worktree of the same canonical repository as
+ * `repoPath` (i.e. `getGitRoot(launchCwd)` differs from `repoPath` but both
+ * share the same `getCanonicalRepoRoot`), returns the worktree's git root so
+ * that `git diff` sees the correct working directory and index.
+ *
+ * Returns `repoPath` unchanged in all other cases (non-worktree, git
+ * unavailable, unrelated repo).
+ *
+ * Extracted as a module-level export so tests can pass any `launchCwd` instead
+ * of relying on `process.cwd()`, which is fixed to the server launch directory
+ * and cannot be changed mid-process.
+ */
+export function resolveWorktreeCwd(repoPath, launchCwd) {
+    try {
+        // Verify repoPath is a git root before comparing against its canonical
+        // root. If getGitRoot returns a different path, repoPath is an arbitrary
+        // subdirectory — skip both the linked-worktree guard and auto-detection
+        // and fall through to the repoPath fallback.
+        const repoGitRoot = getGitRoot(repoPath);
+        const repoCanonical = repoGitRoot && tryRealpath(repoGitRoot) === tryRealpath(repoPath)
+            ? getCanonicalRepoRoot(repoPath)
+            : null;
+        // Early exit: if repoPath is a linked worktree (differs from its canonical
+        // main-checkout root), return it unchanged. Do NOT override it with the
+        // server's launch directory — that would silently replace the explicitly-
+        // resolved worktree index with the main checkout.
+        //
+        // getCanonicalRepoRoot returns the main-checkout path for both the checkout
+        // and all linked worktrees:
+        //   repoPath === canonical → main checkout (auto-detect may fire below)
+        //   repoPath !== canonical → linked worktree (return as-is)
+        if (repoCanonical && tryRealpath(repoPath) !== tryRealpath(repoCanonical)) {
+            return repoPath;
+        }
+        const launchGitRoot = getGitRoot(launchCwd);
+        if (launchGitRoot) {
+            // Normalise via realpathSync before comparing so macOS /var → /private/var
+            // symlinks (and Windows 8.3 short names) don't create false mismatches.
+            const realLaunch = tryRealpath(launchGitRoot);
+            const realRepo = tryRealpath(repoPath);
+            if (realLaunch !== realRepo) {
+                const launchCanonical = getCanonicalRepoRoot(launchCwd);
+                // Use tryRealpath on both canonical values for cross-platform safety.
+                if (launchCanonical &&
+                    repoCanonical &&
+                    tryRealpath(launchCanonical) === tryRealpath(repoCanonical)) {
+                    return launchGitRoot;
+                }
+            }
+        }
+    }
+    catch {
+        // Best-effort; fall through to repoPath.
+    }
+    return repoPath;
+}
 export class LocalBackend {
     repos = new Map();
     contextCache = new Map();
@@ -1017,27 +1090,31 @@ export class LocalBackend {
             return [];
         }
     }
-    async executeCypher(repoName, query) {
+    async executeCypher(repoName, query, params = {}) {
         const repo = await this.resolveRepo(repoName);
-        return this.cypher(repo, { query });
+        return this.cypher(repo, { query, params });
     }
-    async cypher(repo, params) {
+    async cypher(repo, request) {
         await this.ensureInitialized(repo.id);
         if (!isLbugReady(repo.id)) {
             return { error: 'LadybugDB not ready. Index may be corrupted.' };
         }
-        // Block write operations (defense-in-depth — DB is already read-only)
-        if (isWriteQuery(params.query)) {
+        if (request.params !== undefined && !isValidQueryParams(request.params)) {
             return {
-                error: 'Write operations (CREATE, DELETE, SET, MERGE, REMOVE, DROP, ALTER, COPY, DETACH) are not allowed. The knowledge graph is read-only.',
+                error: '"params" must be a plain object with scalar values (string/number/boolean/null).',
             };
         }
         try {
-            const result = await executeQuery(repo.id, params.query);
+            const result = await executeParameterized(repo.id, request.query, request.params ?? {});
             return result;
         }
         catch (err) {
             const msg = err.message || 'Query failed';
+            if (isReadOnlyDbError(err)) {
+                return {
+                    error: 'Write operations (CREATE, DELETE, SET, MERGE, REMOVE, DROP, ALTER, COPY, DETACH) are not allowed. The knowledge graph is read-only.',
+                };
+            }
             if (isWalCorruptionError(err)) {
                 return {
                     error: msg,
@@ -1770,11 +1847,50 @@ export class LocalBackend {
         }
         let diffOutput;
         try {
+            // Resolve the cwd for git diff.
+            //
+            // In a linked worktree (e.g. /repo/wt-feature/), the user's staged and
+            // unstaged changes live in that worktree's separate working directory and
+            // index. Running `git diff` from the canonical repo root sees a different
+            // working tree and returns empty output.
+            //
+            // Resolution order (see resolveWorktreeCwd for details):
+            //   1. params.worktree — explicit override, validated against the
+            //      registered repo's canonical root.
+            //   2. Auto-detect — if the server's launch cwd (process.cwd()) is a
+            //      linked worktree of the same canonical repo, use its git root.
+            //   3. repo.repoPath — fallback (original behaviour, handled inside
+            //      resolveWorktreeCwd when no worktree is detected).
+            //
+            // Start with the auto-detected value; override with the validated
+            // explicit param when provided. This avoids a dead initial assignment.
+            let diffCwd = resolveWorktreeCwd(repo.repoPath, process.cwd());
+            if (params.worktree) {
+                if (!path.isAbsolute(params.worktree)) {
+                    return {
+                        error: `worktree must be an absolute path, got: "${params.worktree}"`,
+                    };
+                }
+                const providedResolved = path.resolve(params.worktree);
+                const repoCanonical = getCanonicalRepoRoot(repo.repoPath);
+                if (!repoCanonical) {
+                    return {
+                        error: `Could not determine canonical root for repo "${repo.repoPath}". Is git available?`,
+                    };
+                }
+                const worktreeCanonical = getCanonicalRepoRoot(providedResolved);
+                if (!worktreeCanonical || tryRealpath(worktreeCanonical) !== tryRealpath(repoCanonical)) {
+                    return {
+                        error: `worktree "${params.worktree}" is not a worktree of repo "${repo.repoPath}". Ensure the path is inside the same git repository.`,
+                    };
+                }
+                diffCwd = providedResolved;
+            }
             // maxBuffer raised from Node's 1MB default to 256MB to avoid ENOBUFS on
             // repos with large unstaged/untracked diffs (e.g. unignored build folders).
             // See issue: spawnSync git ENOBUFS in detect_changes(scope="unstaged").
             diffOutput = execFileSync('git', diffArgs, {
-                cwd: repo.repoPath,
+                cwd: diffCwd,
                 encoding: 'utf-8',
                 maxBuffer: 256 * 1024 * 1024,
             });

package/dist/mcp/tools.js

@@ -155,6 +155,10 @@ TIPS:
             type: 'object',
             properties: {
                 query: { type: 'string', description: 'Cypher query to execute' },
+                params: {
+                    type: 'object',
+                    description: 'Optional query parameters for placeholders (e.g. $name) to execute via prepared statement binding.',
+                },
                 repo: {
                     type: 'string',
                     description: 'Repository name or path. Omit if only one repo is indexed.',
@@ -218,6 +222,8 @@ Maps git diff hunks to indexed symbols, then traces which processes are impacted
 WHEN TO USE: Before committing — to understand what your changes affect. Pre-commit review, PR preparation.
 AFTER THIS: Review affected processes. Use context() on high-risk symbols. READ gitnexus://repo/{name}/process/{name} for full traces.
 
+GIT WORKTREE SUPPORT: GitNexus automatically detects when the MCP server was launched from inside a linked git worktree and runs git diff against that worktree — no extra parameters needed in the common case. Pass "worktree" explicitly only when the server was started from a different directory than the worktree you are editing (e.g., the server runs from the canonical root but your changes are in a linked worktree at a different path).
+
 Returns: changed symbols, affected processes, and a risk summary.`,
         annotations: READ_ONLY_TOOL_ANNOTATIONS,
         inputSchema: {
@@ -233,6 +239,10 @@ Returns: changed symbols, affected processes, and a risk summary.`,
                     type: 'string',
                     description: 'Branch/commit for "compare" scope (e.g., "main")',
                 },
+                worktree: {
+                    type: 'string',
+                    description: 'Absolute path to a linked git worktree. Pass this when your changes are in a worktree (the .git entry at that path is a file, not a directory). GitNexus will run git diff from that worktree so staged/unstaged changes are correctly detected.',
+                },
                 repo: {
                     type: 'string',
                     description: 'Repository name or path. Omit if only one repo is indexed.',

package/dist/server/api.d.ts

@@ -68,5 +68,8 @@ export declare const handleFileRequest: (req: {
     };
     json: (body: any) => void;
 }, repoPath: string) => Promise<void>;
+export declare const handleQueryRequest: (req: express.Request, res: express.Response, resolveRepo: (repoName?: string) => Promise<{
+    storagePath: string;
+} | undefined>) => Promise<void>;
 export declare const createServer: (port: number, host?: string) => Promise<void>;
 export {};

package/dist/server/api.js

@@ -13,8 +13,8 @@ import path from 'path';
 import fs from 'fs/promises';
 import { createRequire } from 'node:module';
 import { loadMeta, listRegisteredRepos, getStoragePath } from '../storage/repo-manager.js';
-import { executeQuery, executePrepared, executeWithReusedStatement, streamQuery, flushWAL, closeLbug, withLbugDb, } from '../core/lbug/lbug-adapter.js';
-import { isWriteQuery } from '../core/lbug/pool-adapter.js';
+import { executeQuery, executePrepared, executeWithReusedStatement, streamQuery, flushWAL, closeLbug, withLbugDb, isReadOnlyDbError, } from '../core/lbug/lbug-adapter.js';
+import { isValidQueryParams } from '../core/lbug/query-params.js';
 import { NODE_TABLES } from '../_shared/index.js';
 import { searchFTSFromLbug } from '../core/search/bm25-index.js';
 import { hybridSearch } from '../core/search/hybrid-search.js';
@@ -377,7 +377,15 @@ export const streamGraphNdjson = async (res, includeContent = false, signal) =>
  */
 const mountSSEProgress = (app, routePath, jm) => {
     app.get(routePath, (req, res) => {
-        const job = jm.getJob(req.params.jobId);
+        let jobId;
+        try {
+            jobId = assertString(req.params.jobId, 'jobId');
+        }
+        catch (err) {
+            res.status(err.status ?? 400).json({ error: err.message });
+            return;
+        }
+        const job = jm.getJob(jobId);
         if (!job) {
             res.status(404).json({ error: 'Job not found' });
             return;
@@ -417,7 +425,7 @@ const mountSSEProgress = (app, routePath, jm) => {
             try {
                 eventId++;
                 if (progress.phase === 'complete' || progress.phase === 'failed') {
-                    const eventJob = jm.getJob(req.params.jobId);
+                    const eventJob = jm.getJob(jobId);
                     res.write(`id: ${eventId}\nevent: ${progress.phase}\ndata: ${JSON.stringify({
                         repoName: eventJob?.repoName,
                         error: eventJob?.error,
@@ -533,6 +541,39 @@ export const handleFileRequest = async (req, res, repoPath) => {
         }
     }
 };
+export const handleQueryRequest = async (req, res, resolveRepo) => {
+    try {
+        const cypher = req.body.cypher;
+        if (!cypher) {
+            res.status(400).json({ error: 'Missing "cypher" in request body' });
+            return;
+        }
+        const queryParams = req.body.params;
+        if (queryParams !== undefined && !isValidQueryParams(queryParams)) {
+            res.status(400).json({
+                error: '"params" must be a plain object with scalar values (string/number/boolean/null)',
+            });
+            return;
+        }
+        const entry = await resolveRepo(requestedRepo(req));
+        if (!entry) {
+            res.status(404).json({ error: 'Repository not found' });
+            return;
+        }
+        const lbugPath = path.join(entry.storagePath, 'lbug');
+        const result = await withLbugDb(lbugPath, () => executePrepared(cypher, queryParams ?? {}), {
+            readOnly: true,
+        });
+        res.json({ result });
+    }
+    catch (err) {
+        if (isReadOnlyDbError(err)) {
+            res.status(403).json({ error: 'Write queries are not allowed via the HTTP API' });
+            return;
+        }
+        res.status(500).json({ error: err.message || 'Query failed' });
+    }
+};
 export const createServer = async (port, host = '127.0.0.1') => {
     const app = express();
     app.disable('x-powered-by');
@@ -857,7 +898,13 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 res.once('finish', markFinished);
                 res.once('close', abortStreaming);
                 try {
-                    await withLbugDb(lbugPath, async () => streamGraphNdjson(res, includeContent, abortController.signal));
+                    // Read-only open: /api/graph never writes. Write-mode opens engage
+                    // LadybugDB's checkpoint machinery (`.shadow` sidecar), which on
+                    // Windows races with the OS file handle release and trips
+                    // "Cannot open file ... lbug.shadow - Error 2". See pool-adapter.ts
+                    // which already opens read-only for the same reason, and the
+                    // /api/query precedent in PR #1655.
+                    await withLbugDb(lbugPath, async () => streamGraphNdjson(res, includeContent, abortController.signal), { readOnly: true });
                     if (!abortController.signal.aborted && !res.writableEnded) {
                         res.end();
                     }
@@ -869,7 +916,9 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 }
                 return;
             }
-            const graph = await withLbugDb(lbugPath, async () => buildGraph(includeContent));
+            const graph = await withLbugDb(lbugPath, async () => buildGraph(includeContent), {
+                readOnly: true,
+            });
             res.json(graph);
         }
         catch (err) {
@@ -892,28 +941,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
     });
     // Execute Cypher query
     app.post('/api/query', async (req, res) => {
-        try {
-            const cypher = req.body.cypher;
-            if (!cypher) {
-                res.status(400).json({ error: 'Missing "cypher" in request body' });
-                return;
-            }
-            if (isWriteQuery(cypher)) {
-                res.status(403).json({ error: 'Write queries are not allowed via the HTTP API' });
-                return;
-            }
-            const entry = await resolveRepo(requestedRepo(req));
-            if (!entry) {
-                res.status(404).json({ error: 'Repository not found' });
-                return;
-            }
-            const lbugPath = path.join(entry.storagePath, 'lbug');
-            const result = await withLbugDb(lbugPath, () => executeQuery(cypher));
-            res.json({ result });
-        }
-        catch (err) {
-            res.status(500).json({ error: err.message || 'Query failed' });
-        }
+        await handleQueryRequest(req, res, resolveRepo);
     });
     // Search (supports mode: 'hybrid' | 'semantic' | 'bm25', and optional enrichment)
     app.post('/api/search', async (req, res) => {
@@ -1039,7 +1067,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
                     return { ...r, ...enrichment };
                 }));
                 return { searchResults: enriched, ftsAvailable };
-            });
+            }, { readOnly: true });
             const response = { results: results.searchResults ?? results };
             if (results.ftsAvailable === false) {
                 response.warning =
@@ -1113,7 +1141,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
             const repoRoot = path.resolve(entry.path);
             // Get file paths from the graph (lightweight — no content loaded)
             const lbugPath = path.join(entry.storagePath, 'lbug');
-            const fileRows = await withLbugDb(lbugPath, () => executeQuery(`MATCH (n:File) WHERE n.content IS NOT NULL RETURN n.filePath AS filePath`));
+            const fileRows = await withLbugDb(lbugPath, () => executeQuery(`MATCH (n:File) WHERE n.content IS NOT NULL RETURN n.filePath AS filePath`), { readOnly: true });
             // Search files on disk one at a time (constant memory)
             for (const row of fileRows) {
                 if (results.length >= limit)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.6-rc.2",
+  "version": "1.6.6-rc.21",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -60,7 +60,7 @@
     "cli-progress": "^3.12.0",
     "commander": "^14.0.3",
     "cors": "^2.8.5",
-    "express": "^4.19.2",
+    "express": "^5.2.1",
     "express-rate-limit": "^8.4.1",
     "glob": "^13.0.6",
     "graphology": "^0.26.0",
@@ -100,7 +100,7 @@
   "devDependencies": {
     "@types/cli-progress": "^3.11.6",
     "@types/cors": "^2.8.17",
-    "@types/express": "^4.17.21",
+    "@types/express": "^5.0.6",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.6.0",
     "@types/uuid": "^11.0.0",