gitnexus 1.6.7 → 1.6.8-rc.10

package/hooks/claude/gitnexus-hook.cjs

@@ -110,10 +110,20 @@ function hasGitNexusServerOwner(gitNexusDir) {
   return hasGitNexusDbLockedByGitNexusServer(path.join(gitNexusDir, 'lbug'), process.pid);
 }
 
+/**
+ * Whether opt-in diagnostics should be written to the hook's stderr. Strict
+ * hook runners (e.g. Codex `PreToolUse`) validate hook output, so normal,
+ * non-error skip paths must stay silent unless the operator explicitly asks
+ * for diagnostics via GITNEXUS_DEBUG. See issue #1913.
+ */
+function isDebugEnabled() {
+  return process.env.GITNEXUS_DEBUG === '1' || process.env.GITNEXUS_DEBUG === 'true';
+}
+
 function extractAugmentContext(stderr) {
   const output = (stderr || '').trim();
   const marker = output.indexOf('[GitNexus]');
-  const debug = process.env.GITNEXUS_DEBUG === '1' || process.env.GITNEXUS_DEBUG === 'true';
+  const debug = isDebugEnabled();
   if (debug && output.length > 0) {
     // Emit the FULL discarded prefix (everything before the marker, or all of
     // it when no marker is present) so suppressed diagnostics — KuzuDB lock
@@ -250,7 +260,12 @@ function handlePreToolUse(input) {
   const pattern = extractPattern(toolName, toolInput);
   if (!pattern || pattern.length < 3) return;
   if (hasGitNexusServerOwner(gitNexusDir)) {
-    process.stderr.write('[GitNexus] augment skipped: MCP server owns DB\n');
+    // Normal skip path: the MCP server owns the DB, so the CLI augment would
+    // contend on the lock. Stay silent for strict hook runners (issue #1913);
+    // surface the reason only when diagnostics are explicitly requested.
+    if (isDebugEnabled()) {
+      process.stderr.write('[GitNexus] augment skipped: MCP server owns DB\n');
+    }
     return;
   }
 
@@ -361,7 +376,7 @@ function main() {
     const handler = handlers[input.hook_event_name || ''];
     if (handler) handler(input);
   } catch (err) {
-    if (process.env.GITNEXUS_DEBUG) {
+    if (isDebugEnabled()) {
       console.error('GitNexus hook error:', (err.message || '').slice(0, 200));
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.7",
+  "version": "1.6.8-rc.10",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -49,7 +49,7 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:cross-platform": "tsx scripts/run-cross-platform.ts",
-    "postinstall": "node scripts/materialize-vendor-grammars.cjs && node scripts/build-tree-sitter-grammars.cjs",
+    "postinstall": "node scripts/build-tree-sitter-grammars.cjs",
     "assert-publish-coverage": "node scripts/assert-publish-grammar-coverage.cjs",
     "prepare": "node scripts/build.js",
     "prepack": "node scripts/assert-publish-grammar-coverage.cjs && node scripts/build.js"

package/scripts/assert-publish-grammar-coverage.cjs

@@ -112,6 +112,24 @@ function findCoverageProblems({ grammars }) {
   return problems;
 }
 
+/**
+ * Stray local source-build outputs under `vendor/<name>/build/`. These would
+ * ship in the tarball (`files: ["vendor"]` overrides .gitignore/.npmignore) AND
+ * shadow the committed prebuilds — `node-gyp-build` resolves `build/Release`
+ * BEFORE `prebuilds/`, so a consumer on the publisher's platform would load the
+ * stray (possibly stale/wrong) binding instead of the curated prebuild. The
+ * build dir is gitignored and only appears if a maintainer source-built locally
+ * (e.g. on a no-prebuild platform); refuse to publish it. (#2144 review.)
+ */
+function findStrayBuildArtifacts(vendorDir) {
+  if (!fs.existsSync(vendorDir)) return [];
+  return fs
+    .readdirSync(vendorDir)
+    .filter((d) => /^tree-sitter-/.test(d))
+    .filter((d) => fs.existsSync(path.join(vendorDir, d, 'build')))
+    .map((d) => `vendor/${d}/build`);
+}
+
 function collectGrammars(vendorDir, shipsVendorSource) {
   if (!fs.existsSync(vendorDir)) return [];
   return fs
@@ -141,6 +159,18 @@ function main() {
     process.exit(1);
   }
 
+  const stray = findStrayBuildArtifacts(vendorDir);
+  if (stray.length > 0) {
+    console.error(
+      '[publish-guard] Refusing to publish — stray source-build output under vendor/ would\n' +
+        'ship and shadow the committed prebuilds (node-gyp-build loads build/Release before\n' +
+        'prebuilds/):',
+    );
+    for (const s of stray) console.error(`  - ${s}`);
+    console.error('\nFix: remove it before packing, e.g. `rm -rf gitnexus/vendor/*/build`.');
+    process.exit(1);
+  }
+
   const problems = findCoverageProblems({ grammars });
   if (problems.length > 0) {
     console.error('[publish-guard] Refusing to publish — a vendored grammar would ship unusable:');
@@ -163,6 +193,7 @@ if (require.main === module) main();
 
 module.exports = {
   findCoverageProblems,
+  findStrayBuildArtifacts,
   filesShipsVendorSource,
   isBuildableFromSource,
   sourceBuildSet,

package/scripts/build-tree-sitter-grammars.cjs

@@ -1,19 +1,25 @@
 #!/usr/bin/env node
 /**
- * Activate the vendored tree-sitter native bindings after
- * materialize-vendor-grammars.cjs. One registry-driven script replaces the
- * former per-grammar build-tree-sitter-<name>.cjs files (they were ~95%
- * identical).
+ * Activate the vendored tree-sitter native bindings IN PLACE under `vendor/`.
+ * One registry-driven script replaces the former per-grammar
+ * build-tree-sitter-<name>.cjs files (they were ~95% identical).
+ *
+ * The grammars (tree-sitter-c/dart/proto/swift/kotlin) are loaded from
+ * `vendor/<name>/` by absolute path at runtime (see
+ * src/core/tree-sitter/vendored-grammars.ts) and are NEVER copied into
+ * node_modules — an undeclared package under node_modules is "extraneous" to
+ * every subsequent npm/npx reify, which prunes/relocates it (Windows
+ * `EPERM: …, symlink` + a silent grammar deletion on the 2nd run; #2111/#1728).
  *
  * For each grammar the resolution order is identical:
- *   1. If the package isn't materialized (no binding.gyp) or the binding is
+ *   1. If the vendored source is absent (no binding.gyp) or the binding is
  *      already built, do nothing.
  *   2. Prefer a committed prebuild for this platform-arch (toolchain-free) via
- *      node-gyp-build — the goal once build-tree-sitter-prebuilds.yml has
- *      populated all six tuples.
+ *      node-gyp-build — `vendor/<name>/prebuilds/` ships all six tuples, so on a
+ *      supported platform this returns immediately and writes nothing.
  *   3. Otherwise source-build from the vendored grammar source (binding.gyp +
- *      src/) so parsing still works on any toolchain host — e.g. CI, before the
- *      prebuilds land.
+ *      src/) into `vendor/<name>/build/` (gitignored) so parsing still works on
+ *      a toolchain host that lacks a matching prebuild.
  *
  * HARD INVARIANT: this runs in `gitnexus`'s postinstall, so it MUST NEVER throw
  * or exit non-zero — a failure for any single grammar must not break the install.
@@ -53,7 +59,7 @@ function buildGrammar(short) {
     return;
   }
 
-  const dir = path.join(__dirname, '..', 'node_modules', `tree-sitter-${short}`);
+  const dir = path.join(__dirname, '..', 'vendor', `tree-sitter-${short}`);
   const bindingGyp = path.join(dir, 'binding.gyp');
   const bindingNode = path.join(dir, 'build', 'Release', `tree_sitter_${short}_binding.node`);
 

package/vendor/tree-sitter-c/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "main": "bindings/node/index.js",
   "types": "bindings/node/index.d.ts",
-  "_vendoredBy": "gitnexus - runtime package derived from tree-sitter-c@0.21.4 (tree-sitter/tree-sitter-c). HELD at 0.21.4 for ABI compatibility with the bundled tree-sitter@0.21.1 runtime (#1242/#858) — do not bump without the runtime upgrade. Vendored because upstream ships native prebuilds for only 4 of 6 platforms (no linux-arm64/win32-arm64, #2116), and tree-sitter-c is a REQUIRED grammar whose source build hard-fails `npm install` on a toolchain-less ARM host. GitNexus cross-builds all six prebuilds via .github/workflows/build-tree-sitter-prebuilds.yml; the C source (binding.gyp + src/) is ALSO vendored so build-tree-sitter-c.cjs can source-build the binding on a toolchain host when no prebuild matches (e.g. CI before prebuilds land). Copied to node_modules/ by materialize-vendor-grammars.cjs (no scripts.install here — #836/#1728).",
+  "_vendoredBy": "gitnexus - runtime package derived from tree-sitter-c@0.21.4 (tree-sitter/tree-sitter-c). HELD at 0.21.4 for ABI compatibility with the bundled tree-sitter@0.21.1 runtime (#1242/#858) — do not bump without the runtime upgrade. Vendored because upstream ships native prebuilds for only 4 of 6 platforms (no linux-arm64/win32-arm64, #2116), and tree-sitter-c is a REQUIRED grammar whose source build hard-fails `npm install` on a toolchain-less ARM host. GitNexus cross-builds all six prebuilds via .github/workflows/build-tree-sitter-prebuilds.yml; the C source (binding.gyp + src/) is ALSO vendored so build-tree-sitter-grammars.cjs can source-build the binding on a toolchain host when no prebuild matches (e.g. CI before prebuilds land). Loaded from vendor/ by absolute path at runtime (vendored-grammars.ts) — NEVER copied to node_modules (#2111) (no scripts.install here — #836/#1728).",
   "peerDependencies": {
     "tree-sitter": "^0.21.0"
   },

package/vendor/tree-sitter-dart/package.json

@@ -6,7 +6,7 @@
   "license": "ISC",
   "main": "bindings/node",
   "types": "bindings/node",
-  "_vendoredBy": "gitnexus - pinned to UserNobody14/tree-sitter-dart commit 80e23c07b64494f7e21090bb3450223ef0b192f4. Copied to node_modules/ by materialize-vendor-grammars.cjs; native build via build-tree-sitter-dart.cjs (#1728, #836).",
+  "_vendoredBy": "gitnexus - pinned to UserNobody14/tree-sitter-dart commit 80e23c07b64494f7e21090bb3450223ef0b192f4. Loaded from vendor/ by absolute path at runtime (vendored-grammars.ts) — NEVER copied to node_modules (#2111); native build via build-tree-sitter-grammars.cjs (#1728, #836).",
   "peerDependencies": {
     "tree-sitter": "^0.21.0"
   },

package/vendor/tree-sitter-kotlin/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "main": "bindings/node/index.js",
   "types": "bindings/node/index.d.ts",
-  "_vendoredBy": "gitnexus - runtime package derived from tree-sitter-kotlin@0.3.8 (fwcd). Unlike Swift's upstream-shipped prebuilds, upstream tree-sitter-kotlin ships SOURCE ONLY (no prebuilds/); the native prebuilds/ here are GitNexus-cross-built by .github/workflows/build-tree-sitter-prebuilds.yml. The grammar source (parser.c/scanner.c/binding.gyp + src/) is ALSO vendored so build-tree-sitter-kotlin.cjs can source-build the binding on a toolchain host when no prebuild matches (e.g. CI before prebuilds land). The generated parser.c is large (~23 MB on disk; it compresses heavily in git); once the prebuilds cover every platform-arch the source serves only as the fallback. Copied to node_modules/ by materialize-vendor-grammars.cjs (no scripts.install here — #836/#1728).",
+  "_vendoredBy": "gitnexus - runtime package derived from tree-sitter-kotlin@0.3.8 (fwcd). Unlike Swift's upstream-shipped prebuilds, upstream tree-sitter-kotlin ships SOURCE ONLY (no prebuilds/); the native prebuilds/ here are GitNexus-cross-built by .github/workflows/build-tree-sitter-prebuilds.yml. The grammar source (parser.c/scanner.c/binding.gyp + src/) is ALSO vendored so build-tree-sitter-grammars.cjs can source-build the binding on a toolchain host when no prebuild matches (e.g. CI before prebuilds land). The generated parser.c is large (~23 MB on disk; it compresses heavily in git); once the prebuilds cover every platform-arch the source serves only as the fallback. Loaded from vendor/ by absolute path at runtime (vendored-grammars.ts) — NEVER copied to node_modules (#2111) (no scripts.install here — #836/#1728).",
   "peerDependencies": {
     "tree-sitter": "^0.21.0"
   },

package/vendor/tree-sitter-proto/package.json

@@ -5,7 +5,7 @@
   "repository": "https://github.com/coder3101/tree-sitter-proto",
   "license": "MIT",
   "main": "bindings/node",
-  "_vendoredBy": "gitnexus — materialized to node_modules/ by materialize-vendor-grammars.cjs; native build via build-tree-sitter-proto.cjs. Do NOT re-add dependencies or an install script (#836, #1728).",
+  "_vendoredBy": "gitnexus — loaded from vendor/ by absolute path at runtime (vendored-grammars.ts) — NEVER copied to node_modules (#2111); native build via build-tree-sitter-grammars.cjs. Do NOT re-add dependencies or an install script (#836, #1728).",
   "peerDependencies": {
     "tree-sitter": ">=0.21.0"
   }

package/vendor/tree-sitter-swift/package.json

@@ -9,7 +9,7 @@
     "type": "git",
     "url": "git+https://github.com/alex-pinkus/tree-sitter-swift.git"
   },
-  "_vendoredBy": "gitnexus - runtime package derived from official tree-sitter-swift@0.7.1 (gitHead 88bfd19a89be9d0481b14566fb6160cccea2fe0a). Unified with Dart/Proto/Kotlin/C: the grammar source (parser.c/scanner.c/binding.gyp + src/) is ALSO vendored so build-tree-sitter-grammars.cjs can source-build the binding on a toolchain host when no prebuild matches (e.g. CI before prebuilds land); src/parser.c is the ABI-14 default (~18 MB on disk, compresses heavily in git — the upstream parser_abi13.c alternate is not vendored). The native prebuilds/ are GitNexus-cross-built by .github/workflows/build-tree-sitter-prebuilds.yml (originally upstream-shipped). Build activation runs via gitnexus/scripts/build-tree-sitter-grammars.cjs after materialize-vendor-grammars.cjs (no scripts.install here — avoids #836 / #1728).",
+  "_vendoredBy": "gitnexus - runtime package derived from official tree-sitter-swift@0.7.1 (gitHead 88bfd19a89be9d0481b14566fb6160cccea2fe0a). Unified with Dart/Proto/Kotlin/C: the grammar source (parser.c/scanner.c/binding.gyp + src/) is ALSO vendored so build-tree-sitter-grammars.cjs can source-build the binding on a toolchain host when no prebuild matches (e.g. CI before prebuilds land); src/parser.c is the ABI-14 default (~18 MB on disk, compresses heavily in git — the upstream parser_abi13.c alternate is not vendored). The native prebuilds/ are GitNexus-cross-built by .github/workflows/build-tree-sitter-prebuilds.yml (originally upstream-shipped). Build activation runs via gitnexus/scripts/build-tree-sitter-grammars.cjs (no scripts.install here — avoids #836 / #1728).",
   "peerDependencies": {
     "tree-sitter": "^0.21.1 || ^0.22.1"
   },

package/scripts/materialize-vendor-grammars.cjs

@@ -1,97 +0,0 @@
-#!/usr/bin/env node
-/**
- * Copy vendored tree-sitter grammars into node_modules/ using real files (fs.cpSync).
- *
- * Published gitnexus used to declare these as optionalDependencies with
- * `file:./vendor/...`, which makes npm symlink/junction vendor → node_modules on
- * install. Windows without Developer Mode often fails with EPERM (#1728).
- *
- * Vendor trees stay read-only in gitnexus/vendor/; build artifacts must only
- * land under node_modules/ (see #836).
- */
-const fs = require('fs');
-const path = require('path');
-
-const ROOT = path.join(__dirname, '..');
-// tree-sitter-c is a REQUIRED grammar that we vendor prebuild-only purely to
-// close upstream's ARM prebuild gap (#2116) — it needs no toolchain and is not a
-// language the user opts out of, so it is always materialized, even under
-// GITNEXUS_SKIP_OPTIONAL_GRAMMARS. The rest are optional (user-skippable, and
-// Dart/Proto compile from source) and honor the skip flag.
-const REQUIRED_VENDORED = ['tree-sitter-c'];
-const OPTIONAL_VENDORED = [
-  'tree-sitter-dart',
-  'tree-sitter-proto',
-  'tree-sitter-swift',
-  'tree-sitter-kotlin',
-];
-
-const skipOptional = process.env.GITNEXUS_SKIP_OPTIONAL_GRAMMARS === '1';
-if (skipOptional) {
-  console.warn(
-    '[gitnexus] GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1: skipping optional Dart/Proto/Swift/Kotlin materialize (required C is still materialized).',
-  );
-}
-const VENDORED_GRAMMARS = skipOptional
-  ? REQUIRED_VENDORED
-  : [...REQUIRED_VENDORED, ...OPTIONAL_VENDORED];
-
-for (const name of VENDORED_GRAMMARS) {
-  const src = path.join(ROOT, 'vendor', name);
-  const dest = path.join(ROOT, 'node_modules', name);
-
-  if (!fs.existsSync(src)) {
-    console.warn(`[gitnexus] vendor/${name} missing; skipping materialize.`);
-    continue;
-  }
-
-  // Sequence: copy src → partial; rename dest → backup; rename partial → dest;
-  // remove backup. If any step fails, restore from backup so a previously-
-  // materialized grammar is never lost. Targets the #1728 EPERM scenario plus
-  // narrower failure modes (Windows AV scanner racing on rename, EBUSY mid-swap).
-  const partial = `${dest}.materialize-tmp`;
-  const backup = `${dest}.materialize-bak`;
-  try {
-    fs.mkdirSync(path.join(ROOT, 'node_modules'), { recursive: true });
-    fs.rmSync(partial, { recursive: true, force: true });
-    fs.rmSync(backup, { recursive: true, force: true });
-    fs.cpSync(src, partial, { recursive: true, verbatim: true });
-    if (fs.existsSync(dest)) {
-      fs.renameSync(dest, backup);
-    }
-    try {
-      fs.renameSync(partial, dest);
-    } catch (renameErr) {
-      // Best-effort rollback: restore the previous dest from backup.
-      let restored = false;
-      if (fs.existsSync(backup)) {
-        try {
-          fs.renameSync(backup, dest);
-          restored = true;
-        } catch {
-          // Rollback also failed — dest is now missing. Leave the backup in
-          // place (the catch below will NOT remove it) and surface where it is.
-        }
-      }
-      if (!restored && fs.existsSync(backup)) {
-        console.warn(
-          `[gitnexus] CRITICAL: could not materialize vendor/${name} AND could not restore the ` +
-            `previous node_modules/${name}. A recoverable copy remains at ${backup} — ` +
-            `restore it (e.g. \`mv ${backup} ${dest}\`) or reinstall to recover ${name}.`,
-        );
-      }
-      throw renameErr;
-    }
-    fs.rmSync(backup, { recursive: true, force: true });
-  } catch (err) {
-    // Fail-soft: a single locked/inaccessible file (common on Windows) must not
-    // abort the whole gitnexus install. Matches build-tree-sitter-*.cjs pattern.
-    // Only remove the scratch `partial`; never the `backup` (it may be the sole
-    // recoverable copy after a failed rollback above).
-    fs.rmSync(partial, { recursive: true, force: true });
-    console.warn(`[gitnexus] Could not materialize vendor/${name}: ${err.message}`);
-    console.warn(
-      `[gitnexus] ${name} parsing will be unavailable. Other functionality is unaffected.`,
-    );
-  }
-}