gitnexus 1.6.8-rc.13 → 1.6.8-rc.15

package/dist/server/analyze-launch.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared analyze-worker launcher.
+ *
+ * Forks the analyze worker for an already-resolved repo directory and owns the
+ * lock + auto-retry + IPC machinery. Used by both the JSON `/api/analyze` route
+ * and the multipart `/api/analyze/upload` route. Dependency-injected (like
+ * createAnalyzeUploadHandler) so the seam is testable and api.ts stays smaller.
+ *
+ * NOTE: this module must live alongside analyze-worker.{ts,js} — the worker
+ * path is resolved relative to `import.meta.url`.
+ */
+import type { JobManager } from './analyze-job.js';
+export interface LaunchDeps {
+    jobManager: JobManager;
+    backend: {
+        init: () => Promise<unknown>;
+    };
+    acquireRepoLock: (key: string) => string | null;
+    releaseRepoLock: (key: string) => void;
+}
+export interface LaunchOptions {
+    force?: boolean;
+    embeddings?: boolean;
+    dropEmbeddings?: boolean;
+    registryName?: string;
+}
+export declare function createLaunchAnalysisWorker(deps: LaunchDeps): (job: {
+    id: string;
+}, targetPath: string, opts: LaunchOptions) => void;

package/dist/server/analyze-launch.js

@@ -0,0 +1,137 @@
+/**
+ * Shared analyze-worker launcher.
+ *
+ * Forks the analyze worker for an already-resolved repo directory and owns the
+ * lock + auto-retry + IPC machinery. Used by both the JSON `/api/analyze` route
+ * and the multipart `/api/analyze/upload` route. Dependency-injected (like
+ * createAnalyzeUploadHandler) so the seam is testable and api.ts stays smaller.
+ *
+ * NOTE: this module must live alongside analyze-worker.{ts,js} — the worker
+ * path is resolved relative to `import.meta.url`.
+ */
+import path from 'path';
+import { fork } from 'child_process';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { createRequire } from 'node:module';
+import { getStoragePath } from '../storage/repo-manager.js';
+import { logger } from '../core/logger.js';
+const _require = createRequire(import.meta.url);
+const MAX_WORKER_RETRIES = 2;
+export function createLaunchAnalysisWorker(deps) {
+    const { jobManager, backend, acquireRepoLock, releaseRepoLock } = deps;
+    return function launchAnalysisWorker(job, targetPath, opts) {
+        // Acquire shared repo lock (keyed on storagePath to match embed handler)
+        const analyzeLockKey = getStoragePath(targetPath);
+        const lockErr = acquireRepoLock(analyzeLockKey);
+        if (lockErr) {
+            jobManager.updateJob(job.id, { status: 'failed', error: lockErr });
+            return;
+        }
+        jobManager.updateJob(job.id, { repoPath: targetPath, status: 'analyzing' });
+        // ── Worker fork with auto-retry ──────────────────────────────
+        const callerPath = fileURLToPath(import.meta.url);
+        const isDev = callerPath.endsWith('.ts');
+        const workerFile = isDev ? 'analyze-worker.ts' : 'analyze-worker.js';
+        const workerPath = path.join(path.dirname(callerPath), workerFile);
+        const tsxHookArgs = isDev
+            ? ['--import', pathToFileURL(_require.resolve('tsx/esm')).href]
+            : [];
+        const forkWorker = () => {
+            const currentJob = jobManager.getJob(job.id);
+            if (!currentJob || currentJob.status === 'complete' || currentJob.status === 'failed')
+                return;
+            const child = fork(workerPath, [], {
+                execArgv: [...tsxHookArgs, '--max-old-space-size=8192'],
+                stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
+            });
+            // Capture stderr for crash diagnostics
+            let stderrChunks = '';
+            child.stderr?.on('data', (chunk) => {
+                stderrChunks += chunk.toString();
+                if (stderrChunks.length > 4096)
+                    stderrChunks = stderrChunks.slice(-4096);
+            });
+            child.on('message', (msg) => {
+                if (msg.type === 'progress') {
+                    jobManager.updateJob(job.id, {
+                        status: 'analyzing',
+                        progress: { phase: msg.phase, percent: msg.percent, message: msg.message },
+                    });
+                }
+                else if (msg.type === 'complete') {
+                    releaseRepoLock(analyzeLockKey);
+                    // Reinitialize backend BEFORE marking complete — ensures the new repo
+                    // is queryable when the client receives the SSE complete event.
+                    backend
+                        .init()
+                        .then(() => {
+                        jobManager.updateJob(job.id, { status: 'complete', repoName: msg.result.repoName });
+                    })
+                        .catch((err) => {
+                        logger.error({ err }, 'backend.init() failed after analyze:');
+                        jobManager.updateJob(job.id, {
+                            status: 'failed',
+                            error: 'Server failed to reload after analysis. Try again.',
+                        });
+                    });
+                }
+                else if (msg.type === 'error') {
+                    releaseRepoLock(analyzeLockKey);
+                    jobManager.updateJob(job.id, { status: 'failed', error: msg.message });
+                }
+            });
+            child.on('error', (err) => {
+                releaseRepoLock(analyzeLockKey);
+                jobManager.updateJob(job.id, {
+                    status: 'failed',
+                    error: `Worker process error: ${err.message}`,
+                });
+            });
+            child.on('exit', (code) => {
+                const j = jobManager.getJob(job.id);
+                if (!j || j.status === 'complete' || j.status === 'failed')
+                    return;
+                // Worker crashed — attempt retry if under the limit
+                if (j.retryCount < MAX_WORKER_RETRIES) {
+                    j.retryCount++;
+                    const delay = 1000 * Math.pow(2, j.retryCount - 1); // 1s, 2s
+                    const lastErr = stderrChunks.trim().split('\n').pop() || '';
+                    logger.warn(`Analyze worker crashed (code ${code}), retry ${j.retryCount}/${MAX_WORKER_RETRIES} in ${delay}ms` +
+                        (lastErr ? `: ${lastErr}` : ''));
+                    jobManager.updateJob(job.id, {
+                        status: 'analyzing',
+                        progress: {
+                            phase: 'retrying',
+                            percent: j.progress.percent,
+                            message: `Worker crashed, retrying (${j.retryCount}/${MAX_WORKER_RETRIES})...`,
+                        },
+                    });
+                    stderrChunks = '';
+                    setTimeout(forkWorker, delay);
+                }
+                else {
+                    // Exhausted retries — permanent failure
+                    releaseRepoLock(analyzeLockKey);
+                    jobManager.updateJob(job.id, {
+                        status: 'failed',
+                        error: `Worker crashed ${MAX_WORKER_RETRIES + 1} times (code ${code})${stderrChunks ? ': ' + stderrChunks.trim().split('\n').pop() : ''}`,
+                    });
+                }
+            });
+            // Register child for cancellation + timeout tracking
+            jobManager.registerChild(job.id, child);
+            // Send start command to child
+            child.send({
+                type: 'start',
+                repoPath: targetPath,
+                options: {
+                    force: !!opts.force,
+                    embeddings: !!opts.embeddings,
+                    dropEmbeddings: !!opts.dropEmbeddings,
+                    ...(opts.registryName ? { registryName: opts.registryName } : {}),
+                },
+            });
+        };
+        forkWorker();
+    };
+}

package/dist/server/analyze-upload.d.ts

@@ -0,0 +1,33 @@
+/**
+ * POST /api/analyze/upload — analyze a browser folder upload.
+ *
+ * Securely ingests the multipart upload into a sandbox (upload-ingest.ts),
+ * promotes it to a persistent app-controlled directory, and analyzes it via
+ * the same job/worker machinery as a git clone — never returning a server
+ * path to the client. Factored as a dependency-injected handler so the job
+ * machinery (createJob + the worker launcher) can be mocked in unit tests.
+ */
+import type { Request, Response } from 'express';
+import { ingestUpload } from './upload-ingest.js';
+import type { AnalyzeJob } from './analyze-job.js';
+/** Minimal job shape the handler needs (a subset of the real AnalyzeJob). */
+export type UploadJobRef = Pick<AnalyzeJob, 'id' | 'status'>;
+export interface AnalyzeUploadDeps {
+    /** Create (or throw on busy) an analysis job for the given upload dir. */
+    createJob: (params: {
+        repoPath: string;
+    }) => UploadJobRef;
+    /** Launch the analyze worker against an already-resolved repo directory. */
+    launch: (job: UploadJobRef, targetPath: string, opts: {
+        registryName: string;
+    }) => void;
+    /**
+     * Mark a created job failed. The job occupies the single analysis slot from
+     * createJob onward, so ANY error before launch must release it — otherwise a
+     * leaked non-terminal job wedges all future analyses until restart.
+     */
+    failJob: (jobId: string, error: string) => void;
+    /** Injectable for tests (defaults to the real ingestUpload). */
+    ingest?: typeof ingestUpload;
+}
+export declare function createAnalyzeUploadHandler(deps: AnalyzeUploadDeps): (req: Request, res: Response) => Promise<void>;

package/dist/server/analyze-upload.js

@@ -0,0 +1,123 @@
+/**
+ * POST /api/analyze/upload — analyze a browser folder upload.
+ *
+ * Securely ingests the multipart upload into a sandbox (upload-ingest.ts),
+ * promotes it to a persistent app-controlled directory, and analyzes it via
+ * the same job/worker machinery as a git clone — never returning a server
+ * path to the client. Factored as a dependency-injected handler so the job
+ * machinery (createJob + the worker launcher) can be mocked in unit tests.
+ */
+import path from 'path';
+import fsp from 'fs/promises';
+import { ingestUpload } from './upload-ingest.js';
+import { UPLOAD_ROOT, getUploadDir, deriveUploadName } from './upload-paths.js';
+import { BadRequestError } from './validation.js';
+/** Cap on collision-suffix attempts when allocating an upload dir name. */
+const MAX_NAME_COLLISION_TRIES = 100;
+/**
+ * Find an available upload directory name, appending `-2`, `-3`, … on
+ * collision with an existing upload. Bounded to avoid an unbounded scan.
+ */
+async function pickAvailableName(base) {
+    for (let i = 0; i < MAX_NAME_COLLISION_TRIES; i++) {
+        const name = i === 0 ? base : `${base}-${i + 1}`;
+        let dir;
+        try {
+            dir = getUploadDir(name);
+        }
+        catch {
+            continue;
+        }
+        try {
+            await fsp.access(dir);
+            // exists → try the next suffix
+        }
+        catch {
+            return name; // ENOENT → available
+        }
+    }
+    throw new BadRequestError(`Could not allocate an upload directory after ${MAX_NAME_COLLISION_TRIES} attempts`, 409);
+}
+export function createAnalyzeUploadHandler(deps) {
+    const ingest = deps.ingest ?? ingestUpload;
+    return async function handleAnalyzeUploadRequest(req, res) {
+        let stageRoot;
+        let promotedDir;
+        let createdJobId;
+        let launched = false;
+        try {
+            const result = await ingest(req);
+            stageRoot = result.stageRoot;
+            const baseName = deriveUploadName(result.topLevelName);
+            if (!baseName) {
+                throw new BadRequestError('Uploaded folder has no usable name');
+            }
+            // webkitRelativePath prefixes every entry with the picked folder, so the
+            // real repo root is stageRoot/<topLevelName>. Validate it is a directory
+            // BEFORE taking the single analysis slot — a malformed (non-folder)
+            // upload must not be able to occupy the slot.
+            const innerRoot = path.join(result.stageRoot, result.topLevelName);
+            let innerIsDir = false;
+            try {
+                innerIsDir = (await fsp.stat(innerRoot)).isDirectory();
+            }
+            catch {
+                innerIsDir = false;
+            }
+            if (!innerIsDir) {
+                throw new BadRequestError('Upload must be a folder');
+            }
+            const finalName = await pickAvailableName(baseName);
+            const finalDir = getUploadDir(finalName);
+            // createJob occupies the single analysis slot (throws 'already in
+            // progress' → 409). From here on, ANY error before launch MUST release
+            // the slot via failJob in the catch, or the server wedges all analyses.
+            let job;
+            try {
+                job = deps.createJob({ repoPath: finalDir });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : '';
+                if (msg.includes('already in progress')) {
+                    throw new BadRequestError(msg, 409);
+                }
+                throw err;
+            }
+            createdJobId = job.id;
+            // Promote staging → persistent upload dir. Both live under UPLOAD_ROOT's
+            // filesystem, so this rename stays atomic (no EXDEV).
+            await fsp.mkdir(UPLOAD_ROOT, { recursive: true });
+            await fsp.rename(innerRoot, finalDir);
+            promotedDir = finalDir;
+            const oldStage = stageRoot;
+            stageRoot = undefined;
+            await fsp.rm(oldStage, { recursive: true, force: true }).catch(() => { });
+            // Drop any crafted index the upload may have carried (a `.gitnexus`
+            // segment passes containment); the worker will build a fresh one.
+            await fsp
+                .rm(path.join(finalDir, '.gitnexus'), { recursive: true, force: true })
+                .catch(() => { });
+            deps.launch(job, finalDir, { registryName: finalName });
+            launched = true;
+            res.status(202).json({ jobId: job.id, status: job.status });
+        }
+        catch (err) {
+            // Release the single analysis slot if a job was created but never
+            // launched — otherwise the leaked queued job blocks all future analyses.
+            if (createdJobId && !launched) {
+                deps.failJob(createdJobId, err instanceof Error ? err.message : 'Upload failed');
+            }
+            if (stageRoot) {
+                await fsp.rm(stageRoot, { recursive: true, force: true }).catch(() => { });
+            }
+            if (promotedDir && !launched) {
+                await fsp.rm(promotedDir, { recursive: true, force: true }).catch(() => { });
+            }
+            if (err instanceof BadRequestError) {
+                res.status(err.status).json({ error: err.message });
+                return;
+            }
+            res.status(500).json({ error: 'Upload failed' });
+        }
+    };
+}

package/dist/server/analyze-worker.d.ts

@@ -10,4 +10,20 @@
  *   Child -> Parent: { type: 'complete', result: AnalyzeResult }
  *   Child -> Parent: { type: 'error', message: string }
  */
-export {};
+import { type AnalyzeResultIpc } from './analyze-worker-ipc.js';
+export interface ProgressMessage {
+    type: 'progress';
+    phase: string;
+    percent: number;
+    message: string;
+}
+export interface CompleteMessage {
+    type: 'complete';
+    result: AnalyzeResultIpc;
+}
+export interface ErrorMessage {
+    type: 'error';
+    message: string;
+}
+/** Child → parent IPC messages. Shared with the parent-side launcher. */
+export type WorkerMessage = ProgressMessage | CompleteMessage | ErrorMessage;

package/dist/server/api.js

@@ -20,11 +20,15 @@ import { searchFTSFromLbug } from '../core/search/bm25-index.js';
 import { hybridSearch } from '../core/search/hybrid-search.js';
 import { LocalBackend } from '../mcp/local/local-backend.js';
 import { mountMCPEndpoints } from './mcp-http.js';
-import { fork } from 'child_process';
-import { fileURLToPath, pathToFileURL } from 'url';
+import { fileURLToPath } from 'url';
 import { JobManager } from './analyze-job.js';
 import { assertString, escapeRegExp, BadRequestError, createRouteLimiter } from './validation.js';
 import { extractRepoName, getCloneDir, cloneOrPull } from './git-clone.js';
+import { createAnalyzeUploadHandler } from './analyze-upload.js';
+import { requireLocalhostOrigin } from './middleware.js';
+import { createLaunchAnalysisWorker } from './analyze-launch.js';
+import { UPLOAD_ROOT } from './upload-paths.js';
+import { sweepStaleUploads } from './upload-sweep.js';
 import { logger, flushLoggerSync } from '../core/logger.js';
 const _require = createRequire(import.meta.url);
 const pkg = _require('../../package.json');
@@ -640,6 +644,8 @@ export const createServer = async (port, host = '127.0.0.1') => {
     await backend.init();
     const cleanupMcp = mountMCPEndpoints(app, backend);
     const jobManager = new JobManager();
+    // Backstop: remove any upload staging dirs orphaned by a previous crash.
+    void sweepStaleUploads().catch(() => { });
     // Shared repo lock — prevents concurrent analyze + embed on the same repo path,
     // which would corrupt LadybugDB (analyze calls closeLbug + initLbug while embed has queries in flight).
     const activeRepoPaths = new Set();
@@ -653,6 +659,14 @@ export const createServer = async (port, host = '127.0.0.1') => {
     const releaseRepoLock = (repoPath) => {
         activeRepoPaths.delete(repoPath);
     };
+    // Launch the analyze worker for an already-resolved repo directory. Shared by
+    // the JSON /api/analyze route and the multipart /api/analyze/upload route.
+    const launchAnalysisWorker = createLaunchAnalysisWorker({
+        jobManager,
+        backend,
+        acquireRepoLock,
+        releaseRepoLock,
+    });
     /**
      * Maximum time the hold-queue will wait for an active analysis job to complete.
      * Must stay in sync with the frontend's `fetchRepoInfo({ awaitAnalysis: true })` timeout.
@@ -867,6 +881,13 @@ export const createServer = async (port, host = '127.0.0.1') => {
                         /* clone dir may not exist */
                     }
                 }
+                // 2b. Delete the uploaded repo dir if entry.path lives under
+                // UPLOAD_ROOT. Drive this off entry.path (not a name-rederived dir) so
+                // a same-named clone is never affected.
+                const resolvedEntry = path.resolve(entry.path);
+                if (resolvedEntry === UPLOAD_ROOT || resolvedEntry.startsWith(UPLOAD_ROOT + path.sep)) {
+                    await fs.rm(resolvedEntry, { recursive: true, force: true }).catch(() => { });
+                }
                 // 3. Unregister from the global registry
                 const { unregisterRepo } = await import('../storage/repo-manager.js');
                 await unregisterRepo(entry.path);
@@ -1251,7 +1272,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
     });
     // ── Analyze API ──────────────────────────────────────────────────────
     // POST /api/analyze — start a new analysis job
-    app.post('/api/analyze', createRouteLimiter({ limit: 10 }), async (req, res) => {
+    app.post('/api/analyze', createRouteLimiter({ limit: 10 }), requireLocalhostOrigin, async (req, res) => {
         try {
             const { url: repoUrl, path: repoLocalPath, force, embeddings, dropEmbeddings } = req.body;
             // Input type validation
@@ -1267,16 +1288,18 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 res.status(400).json({ error: 'Provide "url" (git URL) or "path" (local path)' });
                 return;
             }
-            // Path validation: require absolute path, reject traversal (e.g. /tmp/../etc/passwd)
-            if (repoLocalPath) {
-                if (!path.isAbsolute(repoLocalPath)) {
-                    res.status(400).json({ error: '"path" must be an absolute path' });
-                    return;
-                }
-                if (path.normalize(repoLocalPath) !== path.resolve(repoLocalPath)) {
-                    res.status(400).json({ error: '"path" must not contain traversal sequences' });
-                    return;
-                }
+            // Path validation. The previous `normalize !== resolve` guard was inert
+            // (both collapse `..` identically) and only false-rejected trailing
+            // slashes, so it is dropped. Analyzing a local path the operator names
+            // is the tool's intended capability (same as the CLI); the dangerous
+            // part was cross-origin reach, which is closed by requireLocalhostOrigin
+            // on this route. We only require an absolute path here and let the
+            // analyze worker surface a clear error if it does not exist. (We do NOT
+            // realpath/stat the path in-route: that would be a user-controlled
+            // filesystem read — CodeQL js/path-injection — for no security gain.)
+            if (repoLocalPath && !path.isAbsolute(repoLocalPath)) {
+                res.status(400).json({ error: '"path" must be an absolute path' });
+                return;
             }
             const job = jobManager.createJob({ repoUrl, repoPath: repoLocalPath });
             // If job was already running (dedup), just return its id
@@ -1308,133 +1331,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
                     if (!targetPath) {
                         throw new Error('No target path resolved');
                     }
-                    // Acquire shared repo lock (keyed on storagePath to match embed handler)
-                    const analyzeLockKey = getStoragePath(targetPath);
-                    const lockErr = acquireRepoLock(analyzeLockKey);
-                    if (lockErr) {
-                        jobManager.updateJob(job.id, { status: 'failed', error: lockErr });
-                        return;
-                    }
-                    jobManager.updateJob(job.id, { repoPath: targetPath, status: 'analyzing' });
-                    // ── Worker fork with auto-retry ──────────────────────────────
-                    //
-                    // Forks a child process with 8GB heap. If the worker crashes
-                    // (OOM, native addon segfault, etc.), it retries up to
-                    // MAX_WORKER_RETRIES times with exponential backoff before
-                    // marking the job as permanently failed.
-                    //
-                    // In dev mode (tsx), registers the tsx ESM hook via a file://
-                    // URL so the child can compile TypeScript on-the-fly.
-                    const MAX_WORKER_RETRIES = 2;
-                    const callerPath = fileURLToPath(import.meta.url);
-                    const isDev = callerPath.endsWith('.ts');
-                    const workerFile = isDev ? 'analyze-worker.ts' : 'analyze-worker.js';
-                    const workerPath = path.join(path.dirname(callerPath), workerFile);
-                    const tsxHookArgs = isDev
-                        ? ['--import', pathToFileURL(_require.resolve('tsx/esm')).href]
-                        : [];
-                    const forkWorker = () => {
-                        const currentJob = jobManager.getJob(job.id);
-                        if (!currentJob || currentJob.status === 'complete' || currentJob.status === 'failed')
-                            return;
-                        const child = fork(workerPath, [], {
-                            execArgv: [...tsxHookArgs, '--max-old-space-size=8192'],
-                            stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
-                        });
-                        // Capture stderr for crash diagnostics
-                        let stderrChunks = '';
-                        child.stderr?.on('data', (chunk) => {
-                            stderrChunks += chunk.toString();
-                            if (stderrChunks.length > 4096)
-                                stderrChunks = stderrChunks.slice(-4096);
-                        });
-                        child.on('message', (msg) => {
-                            if (msg.type === 'progress') {
-                                jobManager.updateJob(job.id, {
-                                    status: 'analyzing',
-                                    progress: { phase: msg.phase, percent: msg.percent, message: msg.message },
-                                });
-                            }
-                            else if (msg.type === 'complete') {
-                                releaseRepoLock(analyzeLockKey);
-                                // Reinitialize backend BEFORE marking complete — ensures the new
-                                // repo is queryable when the client receives the SSE complete event.
-                                backend
-                                    .init()
-                                    .then(() => {
-                                    jobManager.updateJob(job.id, {
-                                        status: 'complete',
-                                        repoName: msg.result.repoName,
-                                    });
-                                })
-                                    .catch((err) => {
-                                    logger.error({ err }, 'backend.init() failed after analyze:');
-                                    jobManager.updateJob(job.id, {
-                                        status: 'failed',
-                                        error: 'Server failed to reload after analysis. Try again.',
-                                    });
-                                });
-                            }
-                            else if (msg.type === 'error') {
-                                releaseRepoLock(analyzeLockKey);
-                                jobManager.updateJob(job.id, {
-                                    status: 'failed',
-                                    error: msg.message,
-                                });
-                            }
-                        });
-                        child.on('error', (err) => {
-                            releaseRepoLock(analyzeLockKey);
-                            jobManager.updateJob(job.id, {
-                                status: 'failed',
-                                error: `Worker process error: ${err.message}`,
-                            });
-                        });
-                        child.on('exit', (code) => {
-                            const j = jobManager.getJob(job.id);
-                            if (!j || j.status === 'complete' || j.status === 'failed')
-                                return;
-                            // Worker crashed — attempt retry if under the limit
-                            if (j.retryCount < MAX_WORKER_RETRIES) {
-                                j.retryCount++;
-                                const delay = 1000 * Math.pow(2, j.retryCount - 1); // 1s, 2s
-                                const lastErr = stderrChunks.trim().split('\n').pop() || '';
-                                logger.warn(`Analyze worker crashed (code ${code}), retry ${j.retryCount}/${MAX_WORKER_RETRIES} in ${delay}ms` +
-                                    (lastErr ? `: ${lastErr}` : ''));
-                                jobManager.updateJob(job.id, {
-                                    status: 'analyzing',
-                                    progress: {
-                                        phase: 'retrying',
-                                        percent: j.progress.percent,
-                                        message: `Worker crashed, retrying (${j.retryCount}/${MAX_WORKER_RETRIES})...`,
-                                    },
-                                });
-                                stderrChunks = '';
-                                setTimeout(forkWorker, delay);
-                            }
-                            else {
-                                // Exhausted retries — permanent failure
-                                releaseRepoLock(analyzeLockKey);
-                                jobManager.updateJob(job.id, {
-                                    status: 'failed',
-                                    error: `Worker crashed ${MAX_WORKER_RETRIES + 1} times (code ${code})${stderrChunks ? ': ' + stderrChunks.trim().split('\n').pop() : ''}`,
-                                });
-                            }
-                        });
-                        // Register child for cancellation + timeout tracking
-                        jobManager.registerChild(job.id, child);
-                        // Send start command to child
-                        child.send({
-                            type: 'start',
-                            repoPath: targetPath,
-                            options: {
-                                force: !!force,
-                                embeddings: !!embeddings,
-                                dropEmbeddings: !!dropEmbeddings,
-                            },
-                        });
-                    };
-                    forkWorker();
+                    launchAnalysisWorker(job, targetPath, { force, embeddings, dropEmbeddings });
                 }
                 catch (err) {
                     if (targetPath)
@@ -1456,6 +1353,15 @@ export const createServer = async (port, host = '127.0.0.1') => {
             }
         }
     });
+    // POST /api/analyze/upload — analyze a browser folder upload.
+    // Securely ingests the multipart upload into a sandbox, promotes it to a
+    // persistent dir, and analyzes it via the shared job/worker machinery.
+    // localhost-only (no cross-origin write reach) + conservative rate limit.
+    app.post('/api/analyze/upload', createRouteLimiter({ limit: 5 }), requireLocalhostOrigin, createAnalyzeUploadHandler({
+        createJob: (params) => jobManager.createJob(params),
+        launch: (job, targetPath, opts) => launchAnalysisWorker(job, targetPath, opts),
+        failJob: (jobId, error) => jobManager.updateJob(jobId, { status: 'failed', error }),
+    }));
     // GET /api/analyze/:jobId — poll job status
     app.get('/api/analyze/:jobId', (req, res) => {
         const job = jobManager.getJob(req.params.jobId);

package/dist/server/git-clone.d.ts

@@ -4,6 +4,7 @@
  * Shallow-clones repositories into ~/.gitnexus/repos/{name}/.
  * If already cloned, does git pull instead.
  */
+export declare const REPO_NAME_PATTERN: RegExp;
 /**
  * Extract the repository name from a git URL (HTTPS or SSH).
  *

package/dist/server/git-clone.js

@@ -17,7 +17,7 @@ const CLONE_ROOT = path.resolve(path.join(os.homedir(), '.gitnexus', 'repos'));
 // Rejecting anything else (including `..`, `/`, `\`, shell metacharacters)
 // guarantees getCloneDir(repoName) cannot escape CLONE_ROOT regardless of
 // how the caller derived repoName.
-const REPO_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
+export const REPO_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
 /**
  * Extract the repository name from a git URL (HTTPS or SSH).
  *

package/dist/server/middleware.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Shared Express route guards (alongside createRouteLimiter in validation.ts).
+ */
+import type { Request, Response } from 'express';
+/**
+ * Restrict a route to localhost browser origins. Non-browser requests (no
+ * Origin header, e.g. curl / the CLI) pass through. This closes cross-origin
+ * reach (the allow-listed public deploy + Private Network Access) to write
+ * routes without affecting read routes.
+ */
+export declare function requireLocalhostOrigin(req: Request, res: Response, next: () => void): void;

package/dist/server/middleware.js

@@ -0,0 +1,27 @@
+/**
+ * Shared Express route guards (alongside createRouteLimiter in validation.ts).
+ */
+/**
+ * Restrict a route to localhost browser origins. Non-browser requests (no
+ * Origin header, e.g. curl / the CLI) pass through. This closes cross-origin
+ * reach (the allow-listed public deploy + Private Network Access) to write
+ * routes without affecting read routes.
+ */
+export function requireLocalhostOrigin(req, res, next) {
+    const origin = req.headers.origin;
+    if (origin === undefined) {
+        next();
+        return;
+    }
+    try {
+        const hostname = new URL(origin).hostname;
+        if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1') {
+            next();
+            return;
+        }
+    }
+    catch {
+        /* malformed origin → reject */
+    }
+    res.status(403).json({ error: 'This endpoint is restricted to localhost origins' });
+}