gitnexus 1.6.9-rc.1 → 1.6.9-rc.2

package/dist/cli/analyze.js

@@ -12,7 +12,8 @@ import os from 'os';
 import { spawn } from 'child_process';
 import v8 from 'v8';
 import cliProgress from 'cli-progress';
-import { closeLbug } from '../core/lbug/lbug-adapter.js';
+import { isLbugReady } from '../core/lbug/lbug-adapter.js';
+import { boundedCheckpointBeforeExit } from '../core/lbug/shutdown-helpers.js';
 import { isLbugCheckpointIoError, isWalCorruptionError, parseWalCheckpointThreshold, WAL_RECOVERY_SUGGESTION, } from '../core/lbug/lbug-config.js';
 import { getStoragePaths, getGlobalRegistryPath, RegistryNameCollisionError, AnalysisNotFinalizedError, assertAnalysisFinalized, } from '../storage/repo-manager.js';
 import { getGitRoot, hasGitDir, getDefaultBranch } from '../storage/git.js';
@@ -508,6 +509,17 @@ export const analyzeCommand = async (inputPath, options) => {
     finally {
         restoreAnalyzeEnv(envSnap);
     }
+    // If analyzeCommandImpl returned via a soft `process.exitCode = 1` error path
+    // while LadybugDB native handles are still open, the event loop won't drain and
+    // the process would HANG (#2264 review P1). The full analyze paths skip-close the
+    // DB — handles are left open and reclaimed by process.exit — so a soft return
+    // after a real analyze must force the exit. The success path never reaches here
+    // (analyzeCommandImpl calls process.exit(0) itself); early-validation errors and
+    // unit tests that mock runFullAnalysis never open the DB, so isLbugReady() is
+    // false and the soft return is preserved.
+    if (isLbugReady()) {
+        process.exit(typeof process.exitCode === 'number' ? process.exitCode : 1);
+    }
 };
 const analyzeCommandImpl = async (inputPath, cliOptions) => {
     console.log('\n  GitNexus Analyzer\n');
@@ -867,12 +879,17 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
         aborted = true;
         bar.stop();
         console.log('\n  Interrupted — cleaning up...');
-        closeLbug()
-            .catch(() => { })
-            .finally(async () => {
-            const { flushLoggerSync } = await import('../core/logger.js');
-            flushLoggerSync();
-            process.exit(130);
+        // Bounded CHECKPOINT-then-exit (#2264 review P3): skip the native close (the
+        // LadybugDB destructor can double-free after --pdg writes), but don't hang
+        // behind a long --pdg COPY holding the connection lock — bound it so a single
+        // Ctrl-C stays responsive; the WAL replays on the next analyze. A second
+        // Ctrl-C (`if (aborted) process.exit(1)` above) remains the escape hatch.
+        void boundedCheckpointBeforeExit({
+            exitCode: 130,
+            beforeExit: async () => {
+                const { flushLoggerSync } = await import('../core/logger.js');
+                flushLoggerSync();
+            },
         });
     };
     process.on('SIGINT', sigintHandler);
@@ -964,6 +981,12 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
             // Extra fetch-wrapper names from `.gitnexusrc` (#1589/#1852 residual);
             // forwarded to the routes phase consumer scan.
             fetchWrappers: options.fetchWrappers,
+            // The CLI always process.exit()s after this returns (success path at the
+            // end of analyzeCommandImpl, error/interrupt paths via process.exit too),
+            // so the finalize close skips the native conn/db close — it can double-free
+            // in LadybugDB's ClientContext destructor after --pdg writes (#2264). The
+            // CHECKPOINT keeps the index durable; process exit reclaims the handles.
+            skipNativeCloseOnExit: true,
         }, {
             onProgress: (_phase, percent, message) => {
                 updateBar(percent, message);

package/dist/core/ingestion/workers/parse-worker.js

@@ -583,8 +583,11 @@ const processBatch = (files, onProgress) => {
                     setLanguage(language, regularFiles[0].path);
                     processFileGroup(regularFiles, language, queryString, result, onFileProcessed);
                 }
-                catch {
-                    // parser unavailable — skip this language group
+                catch (err) {
+                    // A throw here drops the whole language group — surface it to the pool
+                    // (#2264) instead of silently skipping. The old empty catch hid real
+                    // extractor/parser failures, not just an unavailable grammar.
+                    reportWarning(`Skipped ${regularFiles.length} ${language} file(s) after a processing error: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
             else {
@@ -599,8 +602,10 @@ const processBatch = (files, onProgress) => {
                     setLanguage(language, tsxFiles[0].path);
                     processFileGroup(tsxFiles, language, queryString, result, onFileProcessed);
                 }
-                catch {
-                    // parser unavailable — skip this language group
+                catch (err) {
+                    // See above — surface a tsx-group processing failure rather than
+                    // silently dropping every file in it (#2264).
+                    reportWarning(`Skipped ${tsxFiles.length} ${language} (tsx) file(s) after a processing error: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
             else {
@@ -745,6 +750,23 @@ export function extractORMQueries(filePath, content, out) {
 // per file; this module does not re-export it. Downstream consumers
 // import the function and its types directly from `route-extractors/`.
 import { extractFastAPIRouterBindings } from '../route-extractors/fastapi-router-bindings.js';
+/**
+ * Report a non-fatal worker issue to the pool over IPC so a caught error is not
+ * invisible to the operator (#2264). The pool logs it on the main thread AND
+ * resets the worker idle timer (so a worker grinding through failing files isn't
+ * falsely idle-evicted). Falls back to the local logger when there's no parent —
+ * this code also runs on the main thread in tests / the non-worker path. Fatal,
+ * group-aborting errors go through the message handler's
+ * `{ type: 'error', errorStack }` channel instead.
+ */
+function reportWarning(message) {
+    if (parentPort) {
+        parentPort.postMessage({ type: 'warning', message });
+    }
+    else {
+        logger.warn(message);
+    }
+}
 const processFileGroup = (files, language, queryString, result, onFileProcessed) => {
     let query;
     try {
@@ -752,13 +774,7 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
         query = new Parser.Query(lang, queryString);
     }
     catch (err) {
-        const message = `Query compilation failed for ${language}: ${err instanceof Error ? err.message : String(err)}`;
-        if (parentPort) {
-            parentPort.postMessage({ type: 'warning', message });
-        }
-        else {
-            logger.warn(message);
-        }
+        reportWarning(`Query compilation failed for ${language}: ${err instanceof Error ? err.message : String(err)}`);
         return;
     }
     for (const file of files) {
@@ -799,7 +815,7 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
             });
         }
         catch (err) {
-            logger.warn(`Failed to parse file ${file.path}: ${err instanceof Error ? err.message : String(err)}`);
+            reportWarning(`Failed to parse file ${file.path}: ${err instanceof Error ? err.message : String(err)}`);
             continue;
         }
         result.fileCount++;
@@ -809,7 +825,7 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
             matches = query.matches(tree.rootNode);
         }
         catch (err) {
-            logger.warn(`Query execution failed for ${file.path}: ${err instanceof Error ? err.message : String(err)}`);
+            reportWarning(`Query execution failed for ${file.path}: ${err instanceof Error ? err.message : String(err)}`);
             continue;
         }
         const concreteTypedefRanges = buildConcreteTypedefDefinitionRanges(matches);
@@ -822,14 +838,7 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
         // see parsedfile-store.ts). parse-impl flushes `result.parsedFiles` to disk
         // per chunk and does NOT retain them in main-thread heap, so this no longer
         // costs ~1× the semantic model in RAM during parse.
-        const parsedFile = extractParsedFile(provider, parseContent, file.path, (message) => {
-            if (parentPort) {
-                parentPort.postMessage({ type: 'warning', message });
-            }
-            else {
-                logger.warn(message);
-            }
-        }, tree, scopeSourceKind);
+        const parsedFile = extractParsedFile(provider, parseContent, file.path, reportWarning, tree, scopeSourceKind);
         if (parsedFile !== undefined) {
             // Capture-time side-channel (#1983): `extractParsedFile` just ran the
             // provider's `emitScopeCaptures`, which (for C++ ADL/namespace marks,
@@ -884,11 +893,7 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
                     }
                 }
                 catch (err) {
-                    const message = `CFG build failed for ${file.path}: ${err instanceof Error ? err.message : String(err)}`;
-                    if (parentPort)
-                        parentPort.postMessage({ type: 'warning', message });
-                    else
-                        logger.warn(message);
+                    reportWarning(`CFG build failed for ${file.path}: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
             result.parsedFiles.push(withChannels);
@@ -1575,7 +1580,10 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
                         constraintsTag = templateConstraintsIdTag(parsedTemplateConstraints);
                     }
                 }
-                catch {
+                catch (err) {
+                    // Optional C++ template-constraint enrichment: fall back to no tag, but
+                    // surface the failure (#2264) — matches the CFG-build warning above.
+                    reportWarning(`Template-constraint extraction failed for ${file.path}: ${err instanceof Error ? err.message : String(err)}`);
                     parsedTemplateConstraints = undefined;
                     constraintsTag = '';
                 }

package/dist/core/lbug/conn-lock.d.ts

@@ -0,0 +1 @@
+export declare const withConnLock: <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/lbug/conn-lock.js

@@ -0,0 +1,61 @@
+/**
+ * Serialize every operation on the shared singleton LadybugDB connection.
+ *
+ * LadybugDB is single-writer and its `Connection` is NOT safe for concurrent
+ * query execution: dispatching two queries on one connection at the same time
+ * lets two libuv workers mutate shared native engine state at once, corrupting
+ * the heap. This surfaced as `double free or corruption (out)` / SIGSEGV at the
+ * end of `analyze --pdg`, where the periodic WAL-checkpoint driver
+ * (`wal-checkpoint-driver.ts`) fired `CHECKPOINT` on the same connection a
+ * long-running PDG-table COPY was still using. `--pdg` makes those COPYs outlast
+ * the driver's 5 s tick, so the overlap (rare without `--pdg`) becomes reliable.
+ *
+ * Every singleton-`conn` helper in `lbug-adapter.ts` runs its full query +
+ * result-drain inside this lock, so the checkpoint driver, the bulk COPY, the
+ * embedding writeback, and the PDG edge deletes are mutually exclusive — the
+ * property that makes a strictly-serial workload stable.
+ *
+ * Implementation: a promise chain. Each caller installs a fresh unresolved tail,
+ * awaits the previous holder's tail, runs, then releases its own in `finally`
+ * (so a thrown op never wedges the connection). FIFO and non-reentrant: a wrapped
+ * helper MUST NOT call another wrapped helper — the inner call would await its own
+ * holder's tail and deadlock. The re-entry guard below catches this and throws
+ * instead of hanging. A boolean flag can't do this: a legitimately-queued
+ * top-level caller also runs while the lock is held, so only AsyncLocalStorage —
+ * which marks the *async context* of the running `fn` — distinguishes a true
+ * nested call from normal contention.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+let tail = Promise.resolve();
+// Set (to `true`) only inside a holding `fn`'s async context. A withConnLock call
+// that observes it set is a nested/re-entrant call from within a critical section.
+const inCriticalSection = new AsyncLocalStorage();
+export const withConnLock = async (fn) => {
+    if (inCriticalSection.getStore()) {
+        throw new Error('conn-lock re-entry: a withConnLock-wrapped helper called another wrapped ' +
+            'helper, which would deadlock the single LadybugDB connection. Run the inner ' +
+            'work outside the lock, or inline it. See src/core/lbug/conn-lock.ts.');
+    }
+    const prior = tail;
+    let release;
+    tail = new Promise((resolve) => {
+        release = resolve;
+    });
+    await prior;
+    try {
+        return await inCriticalSection.run(true, fn);
+    }
+    finally {
+        release();
+    }
+};
+/**
+ * Test-only: reset the lock chain to a fresh resolved tail. Production code has
+ * no reason to call this — a leaked-but-resolved tail is harmless — but unit
+ * tests want a clean chain per case.
+ *
+ * @internal
+ */
+export const _resetConnLockForTests = () => {
+    tail = Promise.resolve();
+};

package/dist/core/lbug/lbug-adapter.d.ts

@@ -176,6 +176,27 @@ export declare const tryFlushWAL: () => Promise<boolean>;
  * @see closeLbug — safeClose + module state reset (full teardown)
  */
 export declare const safeClose: () => Promise<void>;
+/**
+ * CHECKPOINT for durability, then DELIBERATELY skip the native connection/database
+ * teardown. The name encodes the contract — there is no boolean flag to misuse:
+ * call this ONLY from a path that guarantees a `process.exit` immediately after
+ * (the CLI analyze success/SIGINT paths and the forked worker).
+ *
+ * LadybugDB's ClientContext/Connection destructor can double-free after large
+ * --pdg writes (gdb: `double free or corruption` in ClientContext::~ClientContext
+ * via NodeConnection::Close), aborting the process AFTER a fully-written,
+ * checkpointed index. flushWAL already persisted the data; process exit reclaims
+ * the native handles. We leave the handles referenced and module state intact so a
+ * GC finalizer cannot run the same destructor before exit, and any post-analyze
+ * read reuses the live connection. Mirrors the pool adapter's fire-and-forget
+ * native teardown (pool-adapter.ts) and the ONNX native-cleanup philosophy.
+ * Workaround for a LadybugDB engine bug (to be reported upstream).
+ *
+ * SAFETY: only valid when a process.exit is guaranteed to follow. Long-lived
+ * callers (MCP server, tests) leave `skipNativeCloseOnExit` unset, so
+ * runFullAnalysis closes for real via {@link closeLbug} — never this.
+ */
+export declare const closeLbugBeforeExit: () => Promise<void>;
 export declare const closeLbug: () => Promise<void>;
 export declare const isLbugReady: () => boolean;
 /**