gitnexus 1.6.6-rc.49 → 1.6.6-rc.50

package/dist/cli/analyze.js

@@ -236,6 +236,7 @@ const runRespawnedAnalyze = (args, env) => new Promise((resolve) => {
     };
     const child = spawn(process.execPath, [...args], {
         stdio: ['inherit', 'pipe', 'pipe'],
+        windowsHide: true,
         env,
     });
     child.stdout?.on('data', (chunk) => {

package/dist/cli/setup.js

@@ -42,6 +42,7 @@ function resolveGitnexusBin() {
             encoding: 'utf-8',
             timeout: 5000,
             stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
         });
         const lines = output
             .split('\n')
@@ -454,6 +455,7 @@ async function setupCodex(result) {
         const entry = getMcpEntry();
         await execFileAsync('codex', ['mcp', 'add', 'gitnexus', '--', entry.command, ...entry.args], {
             shell: process.platform === 'win32',
+            windowsHide: true,
         });
         result.configured.push('Codex');
         return;

package/dist/cli/wiki.js

@@ -442,7 +442,7 @@ const wikiCommandImpl = async (inputPath, options) => {
                 console.log(`\n  Opening ${treeFile} in ${editor}...`);
                 console.log('  Save and close the editor when done.\n');
                 try {
-                    execFileSync(editor, [treeFile], { stdio: 'inherit' });
+                    execFileSync(editor, [treeFile], { stdio: 'inherit', windowsHide: true });
                 }
                 catch {
                     console.log(`  Could not open editor. Please edit manually:\n  ${treeFile}\n`);
@@ -556,7 +556,7 @@ const wikiCommandImpl = async (inputPath, options) => {
 // ─── Gist Publishing ───────────────────────────────────────────────────
 function hasGhCLI() {
     try {
-        execSync('gh --version', { stdio: 'ignore' });
+        execSync('gh --version', { stdio: 'ignore', windowsHide: true });
         return true;
     }
     catch {
@@ -595,7 +595,7 @@ function isGistUrl(line) {
 }
 function publishGist(htmlPath) {
     try {
-        const output = execFileSync('gh', ['gist', 'create', htmlPath, '--desc', 'Repository Wiki — generated by GitNexus', '--public'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+        const output = execFileSync('gh', ['gist', 'create', htmlPath, '--desc', 'Repository Wiki — generated by GitNexus', '--public'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true }).trim();
         // `gh gist create` prints the gist URL as a line in the output. Find the
         // first parseable Gist URL — if no line is a valid Gist URL, fail closed
         // (do NOT fall back to lines[last]: a non-Gist last line would propagate

package/dist/core/embeddings/embedder.js

@@ -68,7 +68,11 @@ function isCudaAvailable() {
     // Primary: query the dynamic linker cache — covers all architectures,
     // distro layouts, and custom install paths registered with ldconfig
     try {
-        const out = execFileSync('ldconfig', ['-p'], { timeout: 3000, encoding: 'utf-8' });
+        const out = execFileSync('ldconfig', ['-p'], {
+            timeout: 3000,
+            encoding: 'utf-8',
+            windowsHide: true,
+        });
         if (out.includes('libcublasLt.so.12'))
             return true;
     }

package/dist/core/git-staleness.js

@@ -17,6 +17,7 @@ export function checkStaleness(repoPath, lastCommit) {
             cwd: repoPath,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
         }).trim();
         const commitsBehind = parseInt(result, 10) || 0;
         if (commitsBehind > 0) {
@@ -44,6 +45,7 @@ export async function checkStalenessAsync(repoPath, lastCommit) {
         const { stdout } = await execFileAsync('git', ['rev-list', '--count', `${lastCommit}..HEAD`], {
             cwd: repoPath,
             encoding: 'utf-8',
+            windowsHide: true,
         });
         const commitsBehind = parseInt(stdout.trim(), 10) || 0;
         if (commitsBehind > 0) {
@@ -73,6 +75,7 @@ function commitsAheadOfIndexed(siblingPath, indexedCommit) {
             cwd: siblingPath,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
         }).trim();
         return parseInt(result, 10) || 0;
     }

package/dist/core/lbug/lbug-adapter.js

@@ -418,6 +418,7 @@ const reopenWritableAfterMissingShadow = async (dbPath, err) => {
     return await openLbugConnection(lbug, dbPath);
 };
 const ensureReadOnlyConnectionUsable = async (dbPath, handle) => {
+    let shadowReplayErr;
     try {
         await queryAndDrain(handle.conn, READ_ONLY_SHADOW_REPLAY_PROBE);
         return handle;
@@ -431,9 +432,22 @@ const ensureReadOnlyConnectionUsable = async (dbPath, handle) => {
             await closeLbugConnection(handle);
             throw err;
         }
+        shadowReplayErr = err;
     }
     await closeLbugConnection(handle);
-    const writable = await openLbugConnection(lbug, dbPath);
+    let writable;
+    try {
+        writable = await openLbugConnection(lbug, dbPath);
+    }
+    catch (openErr) {
+        const code = extractErrnoCode(openErr);
+        if (code === 'EROFS' || code === 'EACCES' || code === 'EPERM') {
+            throw new Error(shadowSidecarRecoveryMessage(dbPath, shadowReplayErr) +
+                '\n  The workspace appears to be read-only — mount it read-write to perform shadow replay recovery,' +
+                ' or re-run `gitnexus analyze` on a writable filesystem to rebuild the index.');
+        }
+        throw openErr;
+    }
     let missingShadowError;
     try {
         await queryAndDrain(writable.conn, READ_ONLY_SHADOW_REPLAY_PROBE);
@@ -573,89 +587,107 @@ const doInitLbug = async (dbPath, readOnly = false) => {
         vectorExtensionLoaded = false;
         ensuredFTSIndexes.clear();
     }
-    // LadybugDB stores the database as a single file (not a directory).
-    // If the path already exists, it must be a valid LadybugDB database file.
-    // Remove stale empty directories or files from older versions.
-    try {
-        const stat = await fs.lstat(dbPath);
-        if (stat.isSymbolicLink()) {
-            // Never follow symlinks — just remove the link itself
-            await fs.unlink(dbPath);
-        }
-        else if (stat.isDirectory()) {
-            // Verify path is within expected storage directory before deleting
-            const realPath = await fs.realpath(dbPath);
-            const parentDir = path.dirname(dbPath);
-            const realParent = await fs.realpath(parentDir);
-            if (!realPath.startsWith(realParent + path.sep) && realPath !== realParent) {
-                throw new Error(`Refusing to delete ${dbPath}: resolved path ${realPath} is outside storage directory`);
-            }
-            // Old-style directory database or empty leftover - remove it
-            await fs.rm(dbPath, { recursive: true, force: true });
-        }
-        // If it's a file, assume it's an existing LadybugDB database - LadybugDB will open it
-    }
-    catch (err) {
-        if (!isMissingFileError(err)) {
-            throw err;
-        }
-        // Path doesn't exist, which is what LadybugDB wants for a new database
-    }
     // ---------------------------------------------------------------------------
-    // Cross-process critical section: acquire init lock, clean orphan sidecars,
-    // and open the database. The lock prevents a TOCTOU race where another
-    // process could create a fresh DB between our access() check and the
-    // unlink() of stale sidecars.
+    // Read-only fast path: skip all filesystem mutations (path cleanup, init
+    // lock, orphan sidecar removal, mkdir) so the open succeeds on read-only
+    // filesystems such as Docker `:ro` bind mounts. The init lock exists to
+    // prevent a TOCTOU race during DB *creation* — read-only opens never
+    // create databases and don't need the lock.
     // ---------------------------------------------------------------------------
-    const releaseInitLock = await acquireInitLock(dbPath);
-    try {
-        // Crash-recovery cleanup: if the main DB file is missing, stale sidecars
-        // from an interrupted run can block fresh opens indefinitely.
+    if (readOnly) {
+        await preflightLbugSidecars(dbPath, {
+            mode: 'read-only',
+            logger,
+            allowQuarantine: false,
+        });
+        const opened = await openLbugConnection(lbug, dbPath, { readOnly: true });
+        const usable = await ensureReadOnlyConnectionUsable(dbPath, opened);
+        db = usable.db;
+        conn = usable.conn;
+        currentDbReadOnly = true;
+    }
+    else {
+        // LadybugDB stores the database as a single file (not a directory).
+        // If the path already exists, it must be a valid LadybugDB database file.
+        // Remove stale empty directories or files from older versions.
         try {
-            await fs.access(dbPath);
+            const stat = await fs.lstat(dbPath);
+            if (stat.isSymbolicLink()) {
+                // Never follow symlinks — just remove the link itself
+                await fs.unlink(dbPath);
+            }
+            else if (stat.isDirectory()) {
+                // Verify path is within expected storage directory before deleting
+                const realPath = await fs.realpath(dbPath);
+                const parentDir = path.dirname(dbPath);
+                const realParent = await fs.realpath(parentDir);
+                if (!realPath.startsWith(realParent + path.sep) && realPath !== realParent) {
+                    throw new Error(`Refusing to delete ${dbPath}: resolved path ${realPath} is outside storage directory`);
+                }
+                // Old-style directory database or empty leftover - remove it
+                await fs.rm(dbPath, { recursive: true, force: true });
+            }
+            // If it's a file, assume it's an existing LadybugDB database - LadybugDB will open it
         }
         catch (err) {
-            if (isMissingFileError(err)) {
-                // `.shadow` is documented by LadybugDB checkpointing and `.wal.checkpoint`
-                // was observed in the #1618 crash loop that motivated this recovery path.
-                const orphanSidecars = [`${dbPath}.shadow`, `${dbPath}.wal.checkpoint`];
-                for (const sidecar of orphanSidecars) {
-                    try {
-                        await fs.unlink(sidecar);
-                        logger.warn(`GitNexus: removed orphan sidecar ${path.basename(sidecar)} (no main DB file present)`);
-                    }
-                    catch (err) {
-                        if (isMissingFileError(err)) {
-                            continue;
+            if (!isMissingFileError(err)) {
+                throw err;
+            }
+            // Path doesn't exist, which is what LadybugDB wants for a new database
+        }
+        // -------------------------------------------------------------------------
+        // Cross-process critical section: acquire init lock, clean orphan sidecars,
+        // and open the database. The lock prevents a TOCTOU race where another
+        // process could create a fresh DB between our access() check and the
+        // unlink() of stale sidecars.
+        // -------------------------------------------------------------------------
+        const releaseInitLock = await acquireInitLock(dbPath);
+        try {
+            // Crash-recovery cleanup: if the main DB file is missing, stale sidecars
+            // from an interrupted run can block fresh opens indefinitely.
+            try {
+                await fs.access(dbPath);
+            }
+            catch (err) {
+                if (isMissingFileError(err)) {
+                    // `.shadow` is documented by LadybugDB checkpointing and `.wal.checkpoint`
+                    // was observed in the #1618 crash loop that motivated this recovery path.
+                    const orphanSidecars = [`${dbPath}.shadow`, `${dbPath}.wal.checkpoint`];
+                    for (const sidecar of orphanSidecars) {
+                        try {
+                            await fs.unlink(sidecar);
+                            logger.warn(`GitNexus: removed orphan sidecar ${path.basename(sidecar)} (no main DB file present)`);
+                        }
+                        catch (err) {
+                            if (isMissingFileError(err)) {
+                                continue;
+                            }
+                            const code = extractErrnoCode(err);
+                            logger.warn(`GitNexus: failed to remove orphan sidecar ${path.basename(sidecar)} (${code ?? 'UNKNOWN'}) while main DB file is missing; LadybugDB open may still fail: ${summarizeError(err)}`);
                         }
-                        const code = extractErrnoCode(err);
-                        logger.warn(`GitNexus: failed to remove orphan sidecar ${path.basename(sidecar)} (${code ?? 'UNKNOWN'}) while main DB file is missing; LadybugDB open may still fail: ${summarizeError(err)}`);
                     }
                 }
+                else {
+                    const code = extractErrnoCode(err);
+                    logger.warn(`GitNexus: unable to verify main DB file before orphan sidecar cleanup (${code ?? 'UNKNOWN'}); skipping cleanup: ${summarizeError(err)}`);
+                }
             }
-            else {
-                const code = extractErrnoCode(err);
-                logger.warn(`GitNexus: unable to verify main DB file before orphan sidecar cleanup (${code ?? 'UNKNOWN'}); skipping cleanup: ${summarizeError(err)}`);
-            }
+            // Ensure parent directory exists
+            const parentDir = path.dirname(dbPath);
+            await fs.mkdir(parentDir, { recursive: true });
+            await preflightLbugSidecars(dbPath, {
+                mode: 'write',
+                logger,
+                allowQuarantine: true,
+            });
+            const opened = await openLbugConnection(lbug, dbPath);
+            db = opened.db;
+            conn = opened.conn;
+            currentDbReadOnly = false;
+        }
+        finally {
+            await releaseInitLock();
         }
-        // Ensure parent directory exists
-        const parentDir = path.dirname(dbPath);
-        await fs.mkdir(parentDir, { recursive: true });
-        await preflightLbugSidecars(dbPath, {
-            mode: readOnly ? 'read-only' : 'write',
-            logger,
-            allowQuarantine: true,
-        });
-        const opened = readOnly
-            ? await openLbugConnection(lbug, dbPath, { readOnly: true })
-            : await openLbugConnection(lbug, dbPath);
-        const usable = readOnly ? await ensureReadOnlyConnectionUsable(dbPath, opened) : opened;
-        db = usable.db;
-        conn = usable.conn;
-        currentDbReadOnly = readOnly;
-    }
-    finally {
-        await releaseInitLock();
     }
     if (!readOnly) {
         const missingShadowError = await runSchemaCreationQueries(dbPath);

package/dist/core/run-analyze.js

@@ -179,6 +179,7 @@ export async function runFullAnalysis(repoPath, options, callbacks) {
                     ], {
                         cwd: repoPath,
                         stdio: ['ignore', 'pipe', 'ignore'],
+                        windowsHide: true,
                         encoding: 'utf8',
                     });
                     return out.trim().length > 0;

package/dist/core/wiki/cursor-client.js

@@ -26,7 +26,7 @@ export function detectCursorCLI() {
     if (cachedCursorBin !== undefined)
         return cachedCursorBin;
     try {
-        execSync('agent --version', { stdio: 'ignore' });
+        execSync('agent --version', { stdio: 'ignore', windowsHide: true });
         cachedCursorBin = 'agent';
     }
     catch {
@@ -78,6 +78,7 @@ export async function callCursorLLM(prompt, config, systemPrompt, options) {
         const child = spawn(cursorBin, args, {
             cwd: config.workingDirectory || process.cwd(),
             stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
             env: {
                 ...process.env,
                 // Ensure non-interactive mode

package/dist/core/wiki/generator.js

@@ -675,7 +675,12 @@ export class WikiGenerator {
     // ─── Helpers ────────────────────────────────────────────────────────
     getCurrentCommit() {
         try {
-            return execSync('git rev-parse HEAD', { cwd: this.repoPath }).toString().trim();
+            return execSync('git rev-parse HEAD', {
+                cwd: this.repoPath,
+                windowsHide: true,
+            })
+                .toString()
+                .trim();
         }
         catch {
             return '';
@@ -690,6 +695,7 @@ export class WikiGenerator {
             execFileSync('git', ['merge-base', '--is-ancestor', fromCommit, toCommit], {
                 cwd: this.repoPath,
                 stdio: 'ignore',
+                windowsHide: true,
             });
             return true;
         }
@@ -706,6 +712,7 @@ export class WikiGenerator {
         try {
             const output = execFileSync('git', ['diff', `${fromCommit}..${toCommit}`, '--name-only'], {
                 cwd: this.repoPath,
+                windowsHide: true,
             })
                 .toString()
                 .trim();

package/dist/mcp/local/local-backend.js

@@ -1978,6 +1978,7 @@ export class LocalBackend {
                 cwd: diffCwd,
                 encoding: 'utf-8',
                 maxBuffer: 256 * 1024 * 1024,
+                windowsHide: true,
             });
         }
         catch (err) {
@@ -2195,6 +2196,7 @@ export class LocalBackend {
                 timeout: 5000,
                 // Avoid ENOBUFS on large repos: rg -l can list many files.
                 maxBuffer: 256 * 1024 * 1024,
+                windowsHide: true,
             });
             const files = output
                 .trim()

package/dist/server/git-clone.js

@@ -262,6 +262,7 @@ export function getRemoteOriginUrl(cwd) {
         const proc = spawn('git', ['config', '--get', 'remote.origin.url'], {
             cwd,
             stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
             env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
         });
         let stdout = '';
@@ -368,6 +369,7 @@ function runGit(args, cwd) {
         const proc = spawn('git', args, {
             cwd,
             stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
             env: {
                 ...process.env,
                 // Prevent git from prompting for credentials (hangs the process)

package/dist/storage/git.js

@@ -4,7 +4,11 @@ import path from 'path';
 // Git utilities for repository detection, commit tracking, and diff analysis
 export const isGitRepo = (repoPath) => {
     try {
-        execSync('git rev-parse --is-inside-work-tree', { cwd: repoPath, stdio: 'ignore' });
+        execSync('git rev-parse --is-inside-work-tree', {
+            cwd: repoPath,
+            stdio: 'ignore',
+            windowsHide: true,
+        });
         return true;
     }
     catch {
@@ -21,6 +25,7 @@ export const getCurrentCommit = (repoPath) => {
             // "fatal: not a git repository" to stderr, which leaks to the user's
             // terminal even though the error is caught here (#1172).
             stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
         })
             .toString()
             .trim();
@@ -58,6 +63,7 @@ export const getRemoteUrl = (repoPath) => {
         raw = execSync('git config --get remote.origin.url', {
             cwd: repoPath,
             stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
         })
             .toString()
             .trim();
@@ -97,6 +103,7 @@ export const getGitRoot = (fromPath) => {
             cwd: fromPath,
             // Suppress stderr -- see getCurrentCommit comment and #1172.
             stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
         })
             .toString()
             .trim();
@@ -139,6 +146,7 @@ export const getCanonicalRepoRoot = (fromPath) => {
         const commonDir = execSync('git rev-parse --path-format=absolute --git-common-dir', {
             cwd: fromPath,
             stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
         })
             .toString()
             .trim();
@@ -247,6 +255,7 @@ export const getRemoteOriginUrl = (repoPath) => {
         const url = execSync('git config --get remote.origin.url', {
             cwd: repoPath,
             stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
         })
             .toString()
             .trim();

package/hooks/claude/gitnexus-hook.cjs

@@ -77,6 +77,7 @@ function findCanonicalRepoRoot(cwd) {
       timeout: 2000,
       cwd,
       stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
     });
     if (result.error || result.status !== 0) return null;
     const commonDir = (result.stdout || '').trim();
@@ -218,6 +219,7 @@ function runGitNexusCli(cliPath, args, cwd, timeout) {
       timeout,
       cwd,
       stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
     });
   }
   // On Windows, invoke npx.cmd directly (no shell needed)
@@ -226,6 +228,7 @@ function runGitNexusCli(cliPath, args, cwd, timeout) {
     timeout: timeout + 5000,
     cwd,
     stdio: ['pipe', 'pipe', 'pipe'],
+    windowsHide: true,
   });
 }
 
@@ -315,6 +318,7 @@ function handlePostToolUse(input) {
       timeout: 3000,
       cwd,
       stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
     });
     currentHead = (headResult.stdout || '').trim();
   } catch {

package/hooks/claude/hook-db-lock-probe.cjs

@@ -109,6 +109,7 @@ function hasGitNexusServerOwnerWindows(dbPathAbs, myPid) {
       encoding: 'utf-8',
       timeout: 6000,
       stdio: ['ignore', 'pipe', 'ignore'],
+      windowsHide: true,
       env: { ...process.env, GITNEXUS_HOOK_RM_TARGET: dbPathAbs },
     },
   );
@@ -192,6 +193,7 @@ function unixLsofPsFindGitNexusServer(dbPathAbs, myPid) {
     encoding: 'utf-8',
     timeout: 1000,
     stdio: ['ignore', 'pipe', 'ignore'],
+    windowsHide: true,
   });
   if (lsof.error) return lsof.error.code === 'ETIMEDOUT';
 
@@ -203,6 +205,7 @@ function unixLsofPsFindGitNexusServer(dbPathAbs, myPid) {
       encoding: 'utf-8',
       timeout: 500,
       stdio: ['ignore', 'pipe', 'ignore'],
+      windowsHide: true,
     });
     if (ps.error) {
       if (ps.error.code === 'ETIMEDOUT') return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.6-rc.49",
+  "version": "1.6.6-rc.50",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",