gitnexus 1.6.9 → 1.6.10-aptos.0

package/dist/server/api.d.ts

@@ -8,7 +8,9 @@
  * CORS is restricted to localhost, private/LAN networks, and the deployed site.
  */
 import express from 'express';
+import { type RegistryEntry } from '../storage/repo-manager.js';
 import { type GraphNode, type GraphRelationship } from '../_shared/index.js';
+import { JobManager } from './analyze-job.js';
 /**
  * Determine whether an HTTP Origin header value is allowed by CORS policy.
  *
@@ -49,6 +51,34 @@ export declare const registerWebUI: (app: express.Express, staticDir: string | n
 export declare const writeNdjsonRecord: (res: express.Response, record: GraphStreamRecord, signal?: AbortSignal) => Promise<void>;
 export declare const getNodeQuery: (table: string, includeContent: boolean) => string;
 export declare const streamGraphNdjson: (res: express.Response, includeContent?: boolean, signal?: AbortSignal) => Promise<void>;
+/**
+ * Mount an SSE progress endpoint for a JobManager.
+ * Handles: initial state, terminal events, heartbeat, event IDs, client disconnect.
+ *
+ * Terminal payloads carry `repoPath` (the analyzed path) alongside the display
+ * `repoName` so clients can reconnect by path identity — with duplicate
+ * basenames, a name-only reconnect resolves to the first same-named sibling.
+ * Exported for unit tests that lock the wire payload shape.
+ */
+export declare const mountSSEProgress: (app: express.Express, routePath: string, jm: JobManager) => void;
+/**
+ * Resolve a `?repo=` request param against the registry in two tiers:
+ *
+ *   1. Path claim — any input containing a separator ('/' or '\\', which
+ *      cover path.sep on every platform) is treated as a path claim and
+ *      resolved by canonical registry path ONLY. A miss fails closed
+ *      (null, never a basename fallback) so a stale or wrong path can
+ *      never silently retarget a same-named sibling repo (#2419).
+ *      Within this tier, only absolute or Windows-shaped ('\\') claims
+ *      are worth canonicalizing; relative claims like 'org/name' or
+ *      './repo' are rejected immediately WITHOUT touching the filesystem
+ *      — canonicalizing them would run an attacker-influenced
+ *      CWD-relative realpathSync probe on un-rate-limited GET routes,
+ *      and no legitimate caller sends relative paths.
+ *   2. Name fallback — bare names (no separators) keep the legacy
+ *      basename/name match for older callers.
+ */
+export declare const resolveRegisteredRepoEntry: (repos: RegistryEntry[], repoName?: string) => RegistryEntry | null;
 /**
  * Handle a GET /api/file request body. Extracted from createServer's route
  * registration so it can be unit-tested without spinning up an HTTP server

package/dist/server/api.js

@@ -12,12 +12,13 @@ import cors from 'cors';
 import path from 'path';
 import fs from 'fs/promises';
 import { createRequire } from 'node:module';
-import { loadMeta, listRegisteredRepos, getStoragePath } from '../storage/repo-manager.js';
+import { canonicalizePath, cloneDirBelongsToEntry, loadMeta, saveMeta, listRegisteredRepos, getStoragePath, registryPathEquals, } from '../storage/repo-manager.js';
 import { executeQuery, executePrepared, executeWithReusedStatement, streamQuery, flushWAL, closeLbug, withLbugDb, isReadOnlyDbError, } from '../core/lbug/lbug-adapter.js';
 import { isValidQueryParams } from '../core/lbug/query-params.js';
 import { NODE_TABLES } from '../_shared/index.js';
 import { searchFTSFromLbug } from '../core/search/bm25-index.js';
 import { hybridSearch } from '../core/search/hybrid-search.js';
+import { ftsDegradedWarning } from '../core/search/fts-indexes.js';
 import { LocalBackend } from '../mcp/local/local-backend.js';
 import { mountMCPEndpoints } from './mcp-http.js';
 import { fileURLToPath } from 'url';
@@ -380,8 +381,13 @@ export const streamGraphNdjson = async (res, includeContent = false, signal) =>
 /**
  * Mount an SSE progress endpoint for a JobManager.
  * Handles: initial state, terminal events, heartbeat, event IDs, client disconnect.
+ *
+ * Terminal payloads carry `repoPath` (the analyzed path) alongside the display
+ * `repoName` so clients can reconnect by path identity — with duplicate
+ * basenames, a name-only reconnect resolves to the first same-named sibling.
+ * Exported for unit tests that lock the wire payload shape.
  */
-const mountSSEProgress = (app, routePath, jm) => {
+export const mountSSEProgress = (app, routePath, jm) => {
     app.get(routePath, (req, res) => {
         let jobId;
         try {
@@ -411,6 +417,7 @@ const mountSSEProgress = (app, routePath, jm) => {
             eventId++;
             res.write(`id: ${eventId}\nevent: ${job.status}\ndata: ${JSON.stringify({
                 repoName: job.repoName,
+                repoPath: job.repoPath,
                 error: job.error,
             })}\n\n`);
             res.end();
@@ -434,6 +441,7 @@ const mountSSEProgress = (app, routePath, jm) => {
                     const eventJob = jm.getJob(jobId);
                     res.write(`id: ${eventId}\nevent: ${progress.phase}\ndata: ${JSON.stringify({
                         repoName: eventJob?.repoName,
+                        repoPath: eventJob?.repoPath,
                         error: eventJob?.error,
                     })}\n\n`);
                     clearInterval(heartbeat);
@@ -476,6 +484,43 @@ const requestedRepo = (req) => {
     }
     return undefined;
 };
+const repoParamBasename = (repoName) => repoName.replace(/\\/g, '/').split('/').filter(Boolean).pop() ?? repoName;
+/**
+ * Resolve a `?repo=` request param against the registry in two tiers:
+ *
+ *   1. Path claim — any input containing a separator ('/' or '\\', which
+ *      cover path.sep on every platform) is treated as a path claim and
+ *      resolved by canonical registry path ONLY. A miss fails closed
+ *      (null, never a basename fallback) so a stale or wrong path can
+ *      never silently retarget a same-named sibling repo (#2419).
+ *      Within this tier, only absolute or Windows-shaped ('\\') claims
+ *      are worth canonicalizing; relative claims like 'org/name' or
+ *      './repo' are rejected immediately WITHOUT touching the filesystem
+ *      — canonicalizing them would run an attacker-influenced
+ *      CWD-relative realpathSync probe on un-rate-limited GET routes,
+ *      and no legitimate caller sends relative paths.
+ *   2. Name fallback — bare names (no separators) keep the legacy
+ *      basename/name match for older callers.
+ */
+export const resolveRegisteredRepoEntry = (repos, repoName) => {
+    if (!repoName)
+        return repos[0] ?? null;
+    const looksLikePath = path.isAbsolute(repoName) || repoName.includes('/') || repoName.includes('\\');
+    if (looksLikePath) {
+        // Relative path claims fail closed with zero filesystem probes.
+        if (!path.isAbsolute(repoName) && !repoName.includes('\\'))
+            return null;
+        const requestedPath = canonicalizePath(repoName);
+        const pathMatch = repos.find((r) => registryPathEquals(canonicalizePath(r.path), requestedPath));
+        if (pathMatch)
+            return pathMatch;
+        return null;
+    }
+    const normalizedName = repoParamBasename(repoName);
+    return (repos.find((r) => r.name === normalizedName) ||
+        repos.find((r) => r.name.toLowerCase() === normalizedName.toLowerCase()) ||
+        null);
+};
 /**
  * Handle a GET /api/file request body. Extracted from createServer's route
  * registration so it can be unit-tested without spinning up an HTTP server
@@ -678,7 +723,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
     // Initialize MCP backend (multi-repo, shared across all MCP sessions)
     const backend = new LocalBackend();
     await backend.init();
-    const cleanupMcp = mountMCPEndpoints(app, backend);
+    const cleanupMcp = await mountMCPEndpoints(app, backend);
     const jobManager = new JobManager();
     // Backstop: remove any upload staging dirs orphaned by a previous crash.
     void sweepStaleUploads().catch(() => { });
@@ -702,6 +747,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
         backend,
         acquireRepoLock,
         releaseRepoLock,
+        closeDbHandle: closeLbug,
     });
     /**
      * Maximum time the hold-queue will wait for an active analysis job to complete.
@@ -712,19 +758,8 @@ export const createServer = async (port, host = '127.0.0.1') => {
     // Pass `req` to enable early exit if the client disconnects during the hold-queue wait.
     const resolveRepo = async (repoName, isRetry = false, req) => {
         const repos = await listRegisteredRepos();
-        let found = null;
-        // Normalize: if a full path is passed, extract just the basename.
-        // e.g. "C:\Users\LENOVO\.gitnexus\repos\todo.txt-cli" -> "todo.txt-cli"
-        const normalizedName = repoName ? path.basename(repoName) : undefined;
-        if (normalizedName) {
-            found =
-                repos.find((r) => r.name === normalizedName) ||
-                    repos.find((r) => r.name.toLowerCase() === normalizedName.toLowerCase()) ||
-                    null;
-        }
-        else if (repos.length > 0) {
-            found = repos[0]; // default to first repo
-        }
+        const found = resolveRegisteredRepoEntry(repos, repoName);
+        const normalizedName = repoName ? repoParamBasename(repoName) : undefined;
         // If not yet in the registry, check whether a background job is actively cloning or
         // analyzing this repo. Hold the connection open (up to 5 minutes) until it completes.
         // We only wait for in-progress jobs ('queued'|'cloning'|'analyzing') — a 'complete' job
@@ -757,7 +792,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
                         if (currentJob.status === 'complete') {
                             await backend.init();
                             const freshRepos = await listRegisteredRepos();
-                            return freshRepos.find((r) => r.name === normalizedName) || null;
+                            return resolveRegisteredRepoEntry(freshRepos, repoName);
                         }
                         await new Promise((r) => setTimeout(r, 1000));
                     }
@@ -774,7 +809,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 logger.debug({ repoName: String(normalizedName).replace(/[\r\n]/g, ' ') }, '[debug] resolveRepo 404, triggering deep init');
             }
             await backend.init();
-            return await resolveRepo(normalizedName, true, req);
+            return await resolveRepo(repoName, true, req);
         }
         return found;
     };
@@ -826,6 +861,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
             res.json(repos.map((r) => ({
                 name: r.name,
                 path: r.path,
+                repoPath: r.path,
                 indexedAt: r.indexedAt,
                 lastCommit: r.lastCommit,
                 stats: r.stats,
@@ -836,7 +872,11 @@ export const createServer = async (port, host = '127.0.0.1') => {
         }
     });
     // Get repo info
-    app.get('/api/repo', async (req, res) => {
+    // Rate-limited (CodeQL js/missing-rate-limiting): resolveRepo canonicalizes
+    // the attacker-supplied ?repo= param (realpathSync probe for absolute /
+    // Windows-shaped claims). Default 60 rpm/IP — web callers hit this route
+    // only on connect/switch, never in a polling loop.
+    app.get('/api/repo', createRouteLimiter(), async (req, res) => {
         try {
             const entry = await resolveRepo(requestedRepo(req), false, req);
             if (!entry) {
@@ -906,7 +946,10 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 catch {
                     /* repo name not eligible for a clone dir (local repo) */
                 }
-                if (cloneDir) {
+                // Only remove the clone dir when it is *this* entry's path — a local
+                // repo registered under the same name would otherwise take a cloned
+                // sibling's checkout down with it (see cloneDirBelongsToEntry).
+                if (cloneDir && cloneDirBelongsToEntry(cloneDir, entry.path)) {
                     try {
                         const stat = await fs.stat(cloneDir);
                         if (stat.isDirectory()) {
@@ -921,7 +964,10 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 // UPLOAD_ROOT. Drive this off entry.path (not a name-rederived dir) so
                 // a same-named clone is never affected.
                 const resolvedEntry = path.resolve(entry.path);
-                if (resolvedEntry === UPLOAD_ROOT || resolvedEntry.startsWith(UPLOAD_ROOT + path.sep)) {
+                const safeUploadRoot = UPLOAD_ROOT.endsWith(path.sep)
+                    ? UPLOAD_ROOT
+                    : UPLOAD_ROOT + path.sep;
+                if (resolvedEntry === UPLOAD_ROOT || resolvedEntry.startsWith(safeUploadRoot)) {
                     await fs.rm(resolvedEntry, { recursive: true, force: true }).catch(() => { });
                 }
                 // 3. Unregister from the global registry
@@ -1140,8 +1186,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
             }, { readOnly: true });
             const response = { results: results.searchResults ?? results };
             if (results.ftsAvailable === false) {
-                response.warning =
-                    'FTS indexes missing — keyword search degraded. Run: gitnexus analyze --repair-fts (or gitnexus analyze --force) to rebuild indexes.';
+                response.warning = ftsDegradedWarning();
             }
             res.json(response);
         }
@@ -1219,7 +1264,8 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 const filePath = row.filePath || '';
                 const fullPath = path.resolve(repoRoot, filePath);
                 // Path traversal guard
-                if (!fullPath.startsWith(repoRoot + path.sep) && fullPath !== repoRoot)
+                const safeRepoRoot = repoRoot.endsWith(path.sep) ? repoRoot : repoRoot + path.sep;
+                if (!fullPath.startsWith(safeRepoRoot) && fullPath !== repoRoot)
                     continue;
                 let content;
                 try {
@@ -1477,16 +1523,14 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 status: 'analyzing',
                 progress: { phase: 'analyzing', percent: 0, message: 'Starting embedding generation...' },
             });
+            const embedController = new AbortController();
+            embedJobManager.registerAbortController(job.id, embedController);
             // 30-minute timeout for embedding jobs (same as analyze jobs)
             const EMBED_TIMEOUT_MS = 30 * 60 * 1000;
             const embedTimeout = setTimeout(() => {
                 const current = embedJobManager.getJob(job.id);
                 if (current && current.status !== 'complete' && current.status !== 'failed') {
-                    releaseRepoLock(repoLockPath);
-                    embedJobManager.updateJob(job.id, {
-                        status: 'failed',
-                        error: 'Embedding timed out (30 minute limit)',
-                    });
+                    embedJobManager.cancelJob(job.id, 'Embedding timed out (30 minute limit)');
                 }
             }, EMBED_TIMEOUT_MS);
             // Run embedding pipeline asynchronously
@@ -1495,6 +1539,36 @@ export const createServer = async (port, host = '127.0.0.1') => {
                     const lbugPath = path.join(entry.storagePath, 'lbug');
                     await withLbugDb(lbugPath, async () => {
                         const { runEmbeddingPipeline } = await import('../core/embeddings/embedding-pipeline.js');
+                        const { resolveEmbeddingIdentity } = await import('../core/embeddings/embedding-identity.js');
+                        const embeddingIdentity = resolveEmbeddingIdentity();
+                        let embeddingMeta = await loadMeta(entry.storagePath);
+                        if (!embeddingMeta) {
+                            throw new Error('Repository metadata is missing; run gitnexus analyze first');
+                        }
+                        const priorCheckpoint = embeddingMeta.embeddingCheckpoint;
+                        if (priorCheckpoint && priorCheckpoint.provider !== embeddingIdentity.provider) {
+                            throw new Error('Cannot resume embedding checkpoint: the embedding provider configuration differs.');
+                        }
+                        if (priorCheckpoint &&
+                            (priorCheckpoint.model !== embeddingIdentity.model ||
+                                priorCheckpoint.dimensions !== embeddingIdentity.dimensions)) {
+                            throw new Error(`Cannot resume embedding checkpoint: it uses ${priorCheckpoint.model} at ` +
+                                `${priorCheckpoint.dimensions} dimensions, but this run resolves ` +
+                                `${embeddingIdentity.model} at ${embeddingIdentity.dimensions}.`);
+                        }
+                        const forceReembedNodeIds = new Set(priorCheckpoint?.pendingNodeIds ?? []);
+                        const saveEmbeddingCheckpoint = async (checkpoint, pendingNodeIds) => {
+                            embeddingMeta = {
+                                ...embeddingMeta,
+                                embeddingCheckpoint: {
+                                    at: new Date().toISOString(),
+                                    ...checkpoint,
+                                    ...embeddingIdentity,
+                                    pendingNodeIds,
+                                },
+                            };
+                            await saveMeta(entry.storagePath, embeddingMeta);
+                        };
                         // Fetch existing content hashes for incremental embedding.
                         // Delegated to lbug-adapter which owns the DB query logic and legacy-fallback handling.
                         const { fetchExistingEmbeddingHashes } = await import('../core/lbug/lbug-adapter.js');
@@ -1520,15 +1594,25 @@ export const createServer = async (port, host = '127.0.0.1') => {
                             });
                         }, {}, // config: use defaults
                         undefined, // skipNodeIds
-                        existingEmbeddings);
+                        existingEmbeddings, {
+                            signal: embedController.signal,
+                            forceReembedNodeIds,
+                            onCheckpointWindowStart: async ({ nodeIds, ...checkpoint }) => {
+                                await saveEmbeddingCheckpoint(checkpoint, nodeIds);
+                            },
+                            onCheckpoint: async (checkpoint) => {
+                                await flushWAL();
+                                await saveEmbeddingCheckpoint(checkpoint, []);
+                            },
+                        });
                         // Flush WAL so subsequent /api/search requests see the new
                         // embeddings immediately (#1149). In the CLI path closeLbug()
                         // handles this during process exit, but the server keeps the
                         // connection open for other routes — a CHECKPOINT is enough.
                         await flushWAL();
+                        embeddingMeta = { ...embeddingMeta, embeddingCheckpoint: undefined };
+                        await saveMeta(entry.storagePath, embeddingMeta);
                     });
-                    clearTimeout(embedTimeout);
-                    releaseRepoLock(repoLockPath);
                     // Don't overwrite 'failed' if the job was cancelled while the pipeline was running
                     const current = embedJobManager.getJob(job.id);
                     if (!current || current.status !== 'failed') {
@@ -1536,8 +1620,6 @@ export const createServer = async (port, host = '127.0.0.1') => {
                     }
                 }
                 catch (err) {
-                    clearTimeout(embedTimeout);
-                    releaseRepoLock(repoLockPath);
                     const current = embedJobManager.getJob(job.id);
                     if (!current || current.status !== 'failed') {
                         embedJobManager.updateJob(job.id, {
@@ -1546,6 +1628,10 @@ export const createServer = async (port, host = '127.0.0.1') => {
                         });
                     }
                 }
+                finally {
+                    clearTimeout(embedTimeout);
+                    releaseRepoLock(repoLockPath);
+                }
             })();
             res.status(202).json({ jobId: job.id, status: 'analyzing' });
         }

package/dist/server/mcp-http.d.ts

@@ -9,4 +9,4 @@
  */
 import type { Express } from 'express';
 import type { LocalBackend } from '../mcp/local/local-backend.js';
-export declare function mountMCPEndpoints(app: Express, backend: LocalBackend): () => Promise<void>;
+export declare function mountMCPEndpoints(app: Express, backend: LocalBackend): Promise<() => Promise<void>>;

package/dist/server/mcp-http.js

@@ -8,9 +8,11 @@
  * Used by server/api.ts to wire up the full web server.
  */
 import { createStreamableHttpHandler } from '../mcp/http-transport.js';
+import { createMcpRepositoryPolicy } from '../mcp/repository-policy.js';
 import { logger } from '../core/logger.js';
-export function mountMCPEndpoints(app, backend) {
-    const { handler, cleanup } = createStreamableHttpHandler(backend);
+export async function mountMCPEndpoints(app, backend) {
+    const repositoryPolicy = await createMcpRepositoryPolicy(backend);
+    const { handler, cleanup } = createStreamableHttpHandler(backend, { repositoryPolicy });
     app.all('/api/mcp', (req, res) => {
         void handler(req, res).catch((err) => {
             logger.error({ err }, 'MCP HTTP request failed:');

package/dist/server/upload-ingest.js

@@ -65,7 +65,8 @@ export function resolveContainedDest(stageRoot, rel) {
     }
     const dest = path.resolve(stageRoot, segments.join(path.sep));
     // Suffix path.sep so a sibling prefix (/sandbox-evil vs /sandbox) can't pass.
-    if (dest !== stageRoot && !dest.startsWith(stageRoot + path.sep)) {
+    const safePrefix = stageRoot.endsWith(path.sep) ? stageRoot : stageRoot + path.sep;
+    if (dest !== stageRoot && !dest.startsWith(safePrefix)) {
         throw new BadRequestError('Upload path escapes the sandbox');
     }
     return dest;

package/dist/server/validation.js

@@ -77,7 +77,8 @@ export function assertSafePath(rawPath, root) {
     }
     const resolvedRoot = path.resolve(root);
     const fullPath = path.resolve(resolvedRoot, rawPath);
-    if (fullPath !== resolvedRoot && !fullPath.startsWith(resolvedRoot + path.sep)) {
+    const safePrefix = resolvedRoot.endsWith(path.sep) ? resolvedRoot : resolvedRoot + path.sep;
+    if (fullPath !== resolvedRoot && !fullPath.startsWith(safePrefix)) {
         throw new ForbiddenError('Path traversal denied');
     }
     return fullPath;

package/dist/storage/git.d.ts

@@ -1,3 +1,12 @@
+/**
+ * True when the working tree has uncommitted changes that analyze would
+ * re-index, even at a matching HEAD. Excludes the paths GitNexus writes during
+ * analyze (.gitnexus/, .claude/, .cursor/, AGENTS.md, CLAUDE.md) so its own
+ * output never counts as dirty (regression vs PR #1233 behavior). Conservative
+ * on any git failure. Shared so `analyze`'s fast-path gate and `status`'s
+ * freshness report agree on what "dirty" means.
+ */
+export declare const isWorkingTreeDirty: (repoPath: string) => boolean;
 export declare const isGitRepo: (repoPath: string) => boolean;
 export declare const getCurrentCommit: (repoPath: string) => string;
 /**
@@ -56,6 +65,28 @@ export declare const getGitRoot: (fromPath: string) => string | null;
  * path if the caller later resolved it from a different directory.
  */
 export declare const getCanonicalRepoRoot: (fromPath: string) => string | null;
+/**
+ * Path to the repo's `$GIT_COMMON_DIR/info/exclude` file — git's own
+ * per-repo, untracked exclude list (same tier as `.gitignore` in
+ * precedence, but never committed, so it works even when the caller has
+ * no write access to the repo's tracked content). Shared across every
+ * linked worktree of a repo, matching git's own resolution (#2606).
+ *
+ * Returns `null` when `fromPath` is not inside a git repository or `git`
+ * is unavailable; callers should treat that the same as "no file".
+ */
+export declare const getGitInfoExcludePath: (fromPath: string) => string | null;
+/**
+ * Path to git's own global, all-repos ignore file: the value of
+ * `core.excludesFile` (any config scope — system/global/local, resolved
+ * the same way `git` itself would from `fromPath`), or git's documented
+ * default of `$XDG_CONFIG_HOME/git/ignore` when unset (gitignore(5)).
+ * Lowest-precedence source, mirroring git's own behavior (#2606).
+ *
+ * Never throws: an unset key or unavailable `git` falls through to the
+ * default path, which is always computable without `git`.
+ */
+export declare const getCoreExcludesFilePath: (fromPath: string) => string;
 /**
  * Resolve `fromPath` to the directory whose basename should drive the
  * registry name (#1259) — the *identity root*. Three outcomes:

package/dist/storage/git.js

@@ -1,8 +1,44 @@
-import { execSync } from 'child_process';
+import { execFileSync, execSync } from 'child_process';
 import { statSync } from 'fs';
 import path from 'path';
+import os from 'os';
 // Git utilities for repository detection, commit tracking, and diff analysis
 const chompGitOutput = (value) => value.toString().replace(/\r?\n$/, '');
+/**
+ * True when the working tree has uncommitted changes that analyze would
+ * re-index, even at a matching HEAD. Excludes the paths GitNexus writes during
+ * analyze (.gitnexus/, .claude/, .cursor/, AGENTS.md, CLAUDE.md) so its own
+ * output never counts as dirty (regression vs PR #1233 behavior). Conservative
+ * on any git failure. Shared so `analyze`'s fast-path gate and `status`'s
+ * freshness report agree on what "dirty" means.
+ */
+export const isWorkingTreeDirty = (repoPath) => {
+    try {
+        const out = execFileSync('git', [
+            'status',
+            '--porcelain',
+            '--',
+            '.',
+            ':(exclude).gitnexus',
+            ':(exclude).gitnexus/**',
+            ':(exclude).claude',
+            ':(exclude).claude/**',
+            ':(exclude).cursor',
+            ':(exclude).cursor/**',
+            ':(exclude)AGENTS.md',
+            ':(exclude)CLAUDE.md',
+        ], {
+            cwd: repoPath,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+            encoding: 'utf8',
+        });
+        return out.trim().length > 0;
+    }
+    catch {
+        return true; // conservative on git failure
+    }
+};
 export const isGitRepo = (repoPath) => {
     try {
         execSync('git rev-parse --is-inside-work-tree', {
@@ -163,6 +199,80 @@ export const getCanonicalRepoRoot = (fromPath) => {
         return null;
     }
 };
+// getGitInfoExcludePath/getCoreExcludesFilePath are called once per repo
+// PER language/contract extractor during group sync (#2606) — an N-repo
+// group fans out to 6+ extractors each calling these, so an uncached
+// execSync per call turns into O(extractors × repos) blocking subprocess
+// spawns. Both resolve to the same value for the same fromPath for the
+// life of the process (git config/exclude files don't change mid-run), so
+// memoize by fromPath. ponytail: process-lifetime cache, never invalidated
+// — fine for one-shot CLI runs; the long-lived MCP server would need a
+// TTL or explicit invalidation if a user edits core.excludesFile mid-session.
+const gitInfoExcludePathCache = new Map();
+const coreExcludesFilePathCache = new Map();
+/**
+ * Path to the repo's `$GIT_COMMON_DIR/info/exclude` file — git's own
+ * per-repo, untracked exclude list (same tier as `.gitignore` in
+ * precedence, but never committed, so it works even when the caller has
+ * no write access to the repo's tracked content). Shared across every
+ * linked worktree of a repo, matching git's own resolution (#2606).
+ *
+ * Returns `null` when `fromPath` is not inside a git repository or `git`
+ * is unavailable; callers should treat that the same as "no file".
+ */
+export const getGitInfoExcludePath = (fromPath) => {
+    const cached = gitInfoExcludePathCache.get(fromPath);
+    if (cached !== undefined)
+        return cached;
+    let result;
+    try {
+        const commonDir = chompGitOutput(execSync('git rev-parse --path-format=absolute --git-common-dir', {
+            cwd: fromPath,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        }));
+        result = commonDir ? path.join(path.resolve(commonDir), 'info', 'exclude') : null;
+    }
+    catch {
+        result = null;
+    }
+    gitInfoExcludePathCache.set(fromPath, result);
+    return result;
+};
+/**
+ * Path to git's own global, all-repos ignore file: the value of
+ * `core.excludesFile` (any config scope — system/global/local, resolved
+ * the same way `git` itself would from `fromPath`), or git's documented
+ * default of `$XDG_CONFIG_HOME/git/ignore` when unset (gitignore(5)).
+ * Lowest-precedence source, mirroring git's own behavior (#2606).
+ *
+ * Never throws: an unset key or unavailable `git` falls through to the
+ * default path, which is always computable without `git`.
+ */
+export const getCoreExcludesFilePath = (fromPath) => {
+    const cached = coreExcludesFilePathCache.get(fromPath);
+    if (cached !== undefined)
+        return cached;
+    let result;
+    try {
+        const configured = chompGitOutput(execSync('git config --get --type=path core.excludesFile', {
+            cwd: fromPath,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        }));
+        if (configured)
+            result = configured;
+    }
+    catch {
+        // Unset, or git unavailable — fall through to git's documented default.
+    }
+    if (!result) {
+        const xdgConfigHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+        result = path.join(xdgConfigHome, 'git', 'ignore');
+    }
+    coreExcludesFilePathCache.set(fromPath, result);
+    return result;
+};
 /**
  * Resolve `fromPath` to the directory whose basename should drive the
  * registry name (#1259) — the *identity root*. Three outcomes:

package/dist/storage/parse-cache.js

@@ -52,7 +52,13 @@ import { fileURLToPath } from 'url';
 // the main thread (the #1983 OOM). Because the two stores share this version,
 // any future change to the `ParsedFile` serialization shape MUST bump
 // SCHEMA_BUMP so both invalidate in lockstep.
-const SCHEMA_BUMP = 10; // PR #2200: Property nodes gained `rawDeclaredType` + `annotations` (Spring DI); warm caches must invalidate or the DI phase silently no-ops on replayed pre-upgrade nodes
+// v20: Java/Kotlin capture side-channels persist package and class-annotation
+// facts for shared Spring Bean resolution.
+// v19: Java enum constant bodies emit E$N Class nodes; anonymous naming uses
+// JLS 13.1 immediate-host chains (#2555).
+// v18: Worker$N anonymous bodies. v17: callable-value-flow operand identity.
+// v16: direct callee identity.
+const SCHEMA_BUMP = 20;
 const GITNEXUS_PKG_VERSION = (() => {
     try {
         // package.json sits at gitnexus/package.json — two levels up from

package/dist/storage/parsedfile-store.d.ts

@@ -100,6 +100,14 @@ export declare const persistParsedFileShardSync: (storagePath: string, shardId:
 export declare const loadParsedFilesForPaths: (storagePath: string, wantPaths: ReadonlySet<string>) => Promise<Map<string, ParsedFile>>;
 /** Durable store dir — a sibling of `parsedfile-store/`, NEVER cleared per run. */
 export declare const getDurableParsedFileDir: (storagePath: string) => string;
+/**
+ * Start a fresh durable generation for one content-addressed parse chunk.
+ * The main thread calls this once before dispatching a cache miss, before any
+ * worker can write that chunk. Recreating the directory immediately keeps the
+ * worker-side mkdir memoization valid while preventing old worker shard names
+ * from accumulating across analyses.
+ */
+export declare const prepareDurableParsedFileChunk: (durableDir: string, chunkHash: string) => Promise<void>;
 /**
  * Synchronous durable-shard writer for use INSIDE a parse worker, alongside
  * {@link persistParsedFileShardSync}. Writes the SAME bytes to a content-addressed