graph-indexer 3.0.0 → 3.0.1

package/CHANGELOG.md

@@ -4,6 +4,58 @@ All notable changes to graph-indexer are documented here. Dates are in YYYY-MM-D
 
 ---
 
+## [3.0.1] — 2026-10-23
+
+A security release. Upgrading is recommended for everyone; nothing else changes.
+
+### Security
+
+- **Node.js 22.23.4+, 24.22.1+ or 26.12.1+** is now required (`engines`). These are the October
+  2026 Node.js security releases, which fix CVE-2026-111497 (out-of-bounds write in the Brotli
+  decoder, remote code execution) and nine other vulnerabilities in TLS, DNS, HTTP keep-alive,
+  `crypto.randomUUID()` and the Permission Model. graph-indexer does not decompress Brotli itself,
+  but it runs inside the Node.js process the user has installed.
+- **npx no longer runs a copy of graph-indexer from the repository.** Started from a repository
+  that ships `node_modules/graph-indexer` (3.x) with its `.bin` entry, `npx -y graph-indexer@3`
+  ran that code instead of the published package: the Claude Code plugin's hooks and MCP server,
+  the OpenCode / Kilo Code plugin and the configurations written by `init` did, on opening the
+  repository. Every npx command now passes `--prefix` so only the published package runs. Re-run
+  `npx -y --prefix / graph-indexer@3 init` to rewrite existing configurations.
+- **`check_changes` refuses a `base` that git would read as an option.** `base: "--output=<file>"`
+  made `git diff` create or truncate any file the user can write. A revision must not start with
+  `-` or contain whitespace.
+- **`read_code` reads only files inside the repository.** `../../etc/hosts` and a tracked symbolic
+  link to a file elsewhere were read and served. Paths are now resolved (`..` and links) and must
+  stay under the root; `.git/` and `.graph-indexer/` are not served. `search_text` and
+  `check_changes` skip links out of the repository too.
+- **`search_text` stops a regular expression that backtracks catastrophically** (`(a+)+$`) after
+  5 s and says so, instead of blocking the server and every other request.
+- **The suggested test commands quote every file name** (a test file named `t$(cmd).test.ts`
+  reaches the runner as a name, not as a command substitution), since agents run those commands
+  as they are; test names that are not plain identifiers get no command.
+- **git runs nothing that the indexed repository's own config names**: `core.fsmonitor`, hooks
+  (`core.hooksPath`), signature verification (`log.showSignature`), clean/smudge/process filters,
+  `diff.external` and textconv drivers are switched off on every git call, for repositories copied
+  together with their `.git` directory. Required filters such as Git LFS's no longer fail the diff.
+- **A `.graph-indexer` committed as a symbolic link is refused** instead of having the index (which
+  contains excerpts of the source) written wherever it points. The directory is created with mode
+  0700. The hook clients only talk to a socket, and a socket directory, owned by the user.
+- **Manifests are read only as small regular files inside the repository**: a `tsconfig.json`,
+  `package.json` or `go.mod` linked to `/dev/zero` no longer hangs the indexer.
+- **A file whose syntax makes queries super-linear** (tens of thousands of chained calls) is given
+  up after 15 s instead of stalling the index.
+- **A field assigned an element of itself** (`self.impl = self.impl[0]`) no longer overflows the
+  indexer's stack.
+- **Names are escaped as regular expressions** wherever they are matched in text, not only `$`, and
+  a `file:name` target no longer backtracks polynomially.
+- **`init` does not write through links the repository committed** (`CLAUDE.md` → `~/.zshrc`,
+  `.claude` → `~/.claude`); it stops and names the file.
+- **Per-session hook state** lives in a per-user directory with mode 0700 and is written
+  atomically, so another user of a shared temp directory cannot read it or redirect the write.
+- On Windows, the hook clients quote the arguments they hand to `cmd.exe`.
+
+---
+
 ## [3.0.0] — 2026-09-23
 
 A rewrite around one goal: give coding agents answers that are exact, current and small.

package/README.md

@@ -9,7 +9,7 @@
 
   <a href="https://www.npmjs.com/package/graph-indexer"><img src="https://img.shields.io/npm/v/graph-indexer?color=007acc&style=for-the-badge" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/graph-indexer"><img src="https://img.shields.io/npm/dt/graph-indexer?color=4caf50&style=for-the-badge" alt="NPM Downloads"></a>
-  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node.js-%3E%3D22.5-brightgreen?style=for-the-badge&logo=nodedotjs" alt="Node.js 22.5+"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node.js-22.23.4%2B%20%7C%2024.22.1%2B%20%7C%2026.12.1%2B-brightgreen?style=for-the-badge&logo=nodedotjs" alt="Node.js 22.23.4+, 24.22.1+ or 26.12.1+"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-yellow.svg?style=for-the-badge" alt="License: MIT"></a>
 </div>
 
@@ -40,14 +40,18 @@ instead of reading whole files and grepping.
 
 ## Quick start
 
-Requires **Node.js 22.5+** (for the built-in `node:sqlite`).
+Requires **Node.js 22.23.4+, 24.22.1+ or 26.12.1+** (the built-in `node:sqlite`, and the October 2026
+Node.js security releases, which fix CVE-2026-111497).
 
 ```bash
 cd your-repo
-npx graph-indexer init      # wires the MCP server into the agents it detects
-npx graph-indexer index     # optional: build the index now (the server also does it on start)
+npx -y --prefix / graph-indexer@3 init    # wires the MCP server into the agents it detects
+npx -y --prefix / graph-indexer@3 index   # optional: build the index now (the server also does it on start)
 ```
 
+`--prefix /` makes npx run the published package even in a repository that ships its own
+`node_modules/graph-indexer`.
+
 `init` writes project-level MCP configuration for the agents it finds (`.mcp.json` for Claude
 Code, `.cursor/mcp.json`, `.vscode/mcp.json`, `.gemini/settings.json`, `opencode.json` for
 OpenCode and Kilo Code, `.junie/mcp/mcp.json`, `.zed/settings.json`; it prints the Codex TOML
@@ -70,7 +74,7 @@ Any MCP client can run the server over stdio:
 ```json
 {
   "mcpServers": {
-    "graph-indexer": { "command": "npx", "args": ["-y", "graph-indexer@3", "serve", "--repo", "/path/to/repo"] }
+    "graph-indexer": { "command": "npx", "args": ["-y", "--prefix", "/", "graph-indexer@3", "serve", "--repo", "/path/to/repo"] }
   }
 }
 ```
@@ -81,7 +85,7 @@ VS Code uses `"servers"` instead of `"mcpServers"` and `"type": "stdio"`. Codex
 ```toml
 [mcp_servers.graph-indexer]
 command = "npx"
-args = ["-y", "graph-indexer@3", "serve", "--repo", "/path/to/repo"]
+args = ["-y", "--prefix", "/", "graph-indexer@3", "serve", "--repo", "/path/to/repo"]
 ```
 
 Without `--repo` the server indexes the git repository containing its working directory
@@ -276,7 +280,7 @@ Version 3 is a rewrite; see the [changelog](CHANGELOG.md). In short: the tools c
 `check_changes`, `outline`), the
 embedding, Ollama, reranker and daemon options are gone (search is lexical plus graph and needs
 no model), grammars are bundled instead of installed on first use, and Node.js 22.5+ is required.
-Re-run `npx graph-indexer init` to update agent configuration; old `.graph-indexer/` contents are
+Re-run `npx -y --prefix / graph-indexer@3 init` to update agent configuration; old `.graph-indexer/` contents are
 replaced automatically.
 
 ## License

package/SECURITY.md

@@ -33,13 +33,24 @@ graph-indexer is a local developer tool. Its threat model follows from a few del
   (`node:sqlite`, `node:fs`, `node:child_process`, …) and the vendored WebAssembly runtime.
 - **No code execution.** Source files are parsed into syntax trees; the indexed code is never
   imported, evaluated or run. The only subprocesses are read-only git commands
-  (`git rev-parse`, `git ls-files`, `git diff`, `git log`) run in the indexed repository with
-  fixed arguments; no tool input is passed to them.
+  (`git rev-parse`, `git ls-files`, `git diff`, `git log`, `git show`) run in the indexed repository
+  with fixed arguments. The only tool input they take is the `base` revision of `check_changes`,
+  which is refused when git could read it as an option. Every git call switches off what the
+  repository's own git config could run: `core.fsmonitor`, hooks, signature verification,
+  clean/smudge/process filters, `diff.external` and textconv drivers.
+- **No code from the repository through npx.** Every `npx` command graph-indexer runs or writes into
+  an agent's configuration passes `--prefix`, so a `node_modules/graph-indexer` that the repository
+  ships is never run in place of the published package.
 - **Stays inside the repository.** Only files listed by git (or found by a `.gitignore`-aware
   walk) under the repository root are indexed. Symlinks are followed only when their target
   resolves inside the repository, so a link to a file elsewhere on the machine is never read,
   indexed or served. Paths given to the tools (`read_code "file.ts:42"`, `outline`,
-  `change_impact`) are looked up in the index, never opened directly from disk.
+  `change_impact`) are resolved (`..` and symbolic links) and must stay inside the repository;
+  `.git/` and `.graph-indexer/` are never served. Manifests (`package.json`, `tsconfig.json`,
+  `go.mod`) are read only as small regular files inside the repository.
+- **Bounded work.** A regular expression given to `search_text` runs under a 5 s budget, and a file
+  whose syntax makes the structural queries super-linear is given up after 15 s, so neither can
+  block the server.
 - **Read-only tools.** All MCP tools are read-only (`readOnlyHint: true`) and never modify
   the repository.
 - **stdio transport.** The MCP server talks to the local client over stdin/stdout. It does not
@@ -51,10 +62,16 @@ graph-indexer is a local developer tool. Its threat model follows from a few del
   both sides check before using it. It answers the same read-only queries as the CLI.
   `GRAPH_INDEXER_RESIDENT=0` disables it.
 - **Local artifacts.** The index is a SQLite database in `<repo>/.graph-indexer/` (git-ignored by
-  `init`). It contains excerpts of your source code — treat it with the same sensitivity as the
+  `init`, mode 0700; a `.graph-indexer` that is a symbolic link is refused). It contains excerpts of your source code — treat it with the same sensitivity as the
   repository itself and do not commit or share it. Deleting the directory is always safe; it is
   rebuilt on the next run.
 
+## Runtime
+
+graph-indexer runs in the Node.js the user installs. It requires a release that includes the
+October 2026 Node.js security fixes (22.23.4+, 24.22.1+ or 26.12.1+; CVE-2026-111497 and others).
+Keep Node.js updated to the latest patch release of a supported line.
+
 ## Operational guidance
 
 - Run the server only on repositories you trust and intend to index.

package/integrations/claude-code/.claude-plugin/plugin.json

@@ -1,8 +1,9 @@
 {
   "name": "graph-indexer",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Live code graph for Claude Code: exact references, structural grep, change impact and a post-edit check, from a local index with no model or network.",
   "author": { "name": "MaquinaTech", "url": "https://github.com/MaquinaTech" },
   "homepage": "https://github.com/MaquinaTech/graph-indexer",
-  "license": "MIT"
+  "license": "MIT",
+  "icon": "https://raw.githubusercontent.com/MaquinaTech/graph-indexer/main/assets/logo.jpg"
 }

package/integrations/claude-code/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "graph-indexer": {
       "command": "npx",
-      "args": ["-y", "graph-indexer@3", "serve"]
+      "args": ["-y", "--prefix", "/", "graph-indexer@3.0.1", "serve"]
     }
   }
 }

package/integrations/claude-code/hooks/gi-hook.mjs

@@ -43,11 +43,12 @@ export function socketPath(root) {
 
 function trusted(file, root) {
     if (WIN) return true;
-    const dir = path.dirname(file);
-    if (dir === path.join(path.resolve(root), '.graph-indexer')) return fs.existsSync(file);
+    const mine = (st) => !process.getuid || st.uid === process.getuid();
     try {
-        const st = fs.lstatSync(dir);
-        return fs.existsSync(file) && st.isDirectory() && (!process.getuid || st.uid === process.getuid()) && (st.mode & 0o077) === 0;
+        const sock = fs.lstatSync(file), dir = fs.lstatSync(path.dirname(file));
+        const inRepo = path.dirname(file) === path.join(path.resolve(root), '.graph-indexer');
+        // the socket and its directory are ours, not links or listeners planted by the repository or another user
+        return sock.isSocket() && mine(sock) && dir.isDirectory() && mine(dir) && (inRepo || (dir.mode & 0o077) === 0);
     } catch { return false; }
 }
 
@@ -85,8 +86,11 @@ async function main() {
     const root = findRepoRoot(input.cwd || process.cwd());
     const reply = await ask(root, { op: 'hook', event, input }, 2500);
     if (reply) { if (reply.out) process.stdout.write(reply.out + '\n'); return; }
-    // no resident yet: the full hook through npx (it starts one for the next calls)
-    const child = spawn(WIN ? 'npx.cmd' : 'npx', ['-y', 'graph-indexer@3', 'hook', event], { stdio: ['pipe', 'inherit', 'ignore'], shell: WIN });
+    // no resident yet: the full hook through npx (it starts one for the next calls); --prefix keeps
+    // npx from running a graph-indexer that the repository ships in its own node_modules
+    // (on Windows npx.cmd needs a shell, so the home directory is quoted for cmd.exe)
+    const home = WIN ? `"${os.homedir()}"` : os.homedir();
+    const child = spawn(WIN ? 'npx.cmd' : 'npx', ['-y', '--prefix', home, 'graph-indexer@3', 'hook', event], { stdio: ['pipe', 'inherit', 'ignore'], shell: WIN });
     child.on('error', () => { /* fail open */ });
     child.stdin.on('error', () => { /* fail open */ });
     child.stdin.end(raw);

package/integrations/opencode/graph-indexer.js

@@ -19,8 +19,9 @@ import { spawn } from 'node:child_process';
 
 const PROTOCOL = 1;
 const WIN = process.platform === 'win32';
-// how to start a resident when none answers (rewritten by `init --local` and installed binaries)
-const DAEMON = ['npx', '-y', 'graph-indexer@3', 'daemon'];
+// how to start a resident when none answers (rewritten by `init --local` and installed binaries);
+// --prefix keeps npx from running a graph-indexer that the repository ships in its own node_modules
+const DAEMON = ['npx', '-y', '--prefix', os.homedir(), 'graph-indexer@3', 'daemon'];
 // OpenCode tool ids → the tool names graph-indexer's hook understands
 const TOOLS = { read: 'Read', grep: 'Grep', bash: 'Bash', edit: 'Edit', write: 'Write' };
 
@@ -46,12 +47,12 @@ function socketPath(root) {
 
 function trusted(file, root) {
     if (WIN) return true;
-    if (!fs.existsSync(file)) return false;
-    const dir = path.dirname(file);
-    if (dir === path.join(path.resolve(root), '.graph-indexer')) return true;
+    const mine = (st) => !process.getuid || st.uid === process.getuid();
     try {
-        const st = fs.lstatSync(dir);
-        return st.isDirectory() && (!process.getuid || st.uid === process.getuid()) && (st.mode & 0o077) === 0;
+        const sock = fs.lstatSync(file), dir = fs.lstatSync(path.dirname(file));
+        const inRepo = path.dirname(file) === path.join(path.resolve(root), '.graph-indexer');
+        // the socket and its directory are ours, not links or listeners planted by the repository or another user
+        return sock.isSocket() && mine(sock) && dir.isDirectory() && mine(dir) && (inRepo || (dir.mode & 0o077) === 0);
     } catch { return false; }
 }
 
@@ -107,7 +108,11 @@ export const GraphIndexer = async ({ directory, worktree } = {}) => {
                 if (!reply) {
                     if (!started) {
                         started = true;
-                        const child = spawn(DAEMON[0], [...DAEMON.slice(1), '--repo', root], { detached: true, stdio: 'ignore', windowsHide: true, shell: WIN });
+                        // cmd.exe (npx.cmd needs a shell on Windows) would run `&`, `|`… in a path: quote
+                        // every argument, and give up on one that a quote cannot hold
+                        const args = [...DAEMON.slice(1), '--repo', root];
+                        if (WIN && args.some(a => /["%\r\n]/.test(a))) return;
+                        const child = spawn(DAEMON[0], WIN ? args.map(a => `"${a}"`) : args, { detached: true, stdio: 'ignore', windowsHide: true, shell: WIN });
                         child.on('error', () => { /* optional */ });
                         child.unref();
                     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "graph-indexer",
-    "version": "3.0.0",
+    "version": "3.0.1",
     "description": "Live code graph and search for AI coding agents over MCP: tree-sitter (WASM) symbols, scope/import/type-aware references, call graphs, change impact and hybrid search — local, zero-dependency, no native builds.",
     "type": "module",
     "main": "src/query/intel.mjs",
@@ -34,7 +34,7 @@
         "index": "node bin/graph-indexer.mjs index"
     },
     "engines": {
-        "node": ">=22.5.0"
+        "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
     },
     "repository": {
         "type": "git",

package/src/cli/hook.mjs

@@ -31,7 +31,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { findRepoRoot, dataDir, DATA_DIR_NAME } from '../util/paths.mjs';
+import { findRepoRoot, dataDir, DATA_DIR_NAME, readRepoFile } from '../util/paths.mjs';
 import { specForPath } from '../parse/languages.mjs';
 
 const MAX_CONTEXT = 1500;
@@ -78,16 +78,26 @@ function responseText(input) {
 /** Navigation calls since the last edit and definitions already shown, per session (crawl detector). */
 function sessionState(input) {
     const id = String(input.session_id ?? input.sessionId ?? input.conversation_id ?? 'default').replace(/[^\w.-]/g, '_').slice(0, 80);
-    const file = path.join(os.tmpdir(), 'graph-indexer-hooks', `${id}.json`);
+    // a per-user directory closed to others: in a shared temp dir another user could otherwise read
+    // the state or plant links that the next save writes through
+    const dir = path.join(os.tmpdir(), `graph-indexer-hooks-${process.getuid?.() ?? 'user'}`);
+    const file = path.join(dir, `${id}.json`);
+    const privateDir = () => {
+        if (process.platform === 'win32') return true;
+        try { const d = fs.lstatSync(dir); return d.isDirectory() && d.uid === process.getuid() && (d.mode & 0o077) === 0; } catch { return false; }
+    };
     let st = { nav: 0, shown: [] };
-    try { st = { ...st, ...JSON.parse(fs.readFileSync(file, 'utf8')) }; } catch { /* first call */ }
+    try { if (privateDir() && fs.lstatSync(file).isFile()) st = { ...st, ...JSON.parse(fs.readFileSync(file, 'utf8')) }; } catch { /* first call */ }
     return {
         st,
         save() {
             try {
-                fs.mkdirSync(path.dirname(file), { recursive: true });
+                fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+                if (!privateDir()) return;
                 st.shown = st.shown.slice(-400);
-                fs.writeFileSync(file, JSON.stringify(st));
+                const tmp = `${file}.${process.pid}.tmp`;
+                fs.writeFileSync(tmp, JSON.stringify(st), { flag: 'wx', mode: 0o600 });
+                fs.renameSync(tmp, file);
             } catch { /* optional */ }
         },
     };
@@ -269,7 +279,7 @@ async function afterRead(root, input, state, crawling, acquire) {
 const RULES = `How to look code up in this repository (graph-indexer):
 - Several things at once: several tool calls in one message, or one search with alternatives — not one search per turn.
 - The function or the 50–100 lines you need, not whole files; to find a definition, search for its definition line (\`def name\`, \`class Name\`) across the package in one search.
-- Exact uses of a function or class, even when other code shares its name: find_references (\`npx graph-indexer refs NAME\` in a shell). Before changing what other code relies on: change_impact; when you are done: check_changes, then run the tests it names, once.`;
+- Exact uses of a function or class, even when other code shares its name: find_references (\`npx -y --prefix / graph-indexer@3 refs NAME\` in a shell). Before changing what other code relies on: change_impact; when you are done: check_changes, then run the tests it names, once.`;
 
 async function sessionLine(root, { rules = false, acquire }) {
     if (!hasIndex(root)) return null; // being built in the background (spawnResident); say nothing yet
@@ -280,7 +290,7 @@ async function sessionLine(root, { rules = false, acquire }) {
         const st = intel.stats();
         const line = `graph-indexer has a live index of this repository (${st.files} files, ${st.symbols} symbols). Its MCP tools answer with exact locations: find_references (exact uses, even when other code shares the name), change_impact (what a change affects and which tests to run), check_changes (what an edit broke, and the closest tests), call_graph, read_code (symbols or ranges by name, with where each name they use is defined), search_text, search_code and outline.`;
         // the managed block of `init` already carries the rules; otherwise add them
-        const carried = ['CLAUDE.md', 'AGENTS.md'].some(f => { try { return fs.readFileSync(path.join(root, f), 'utf8').includes('<!-- graph-indexer:start -->'); } catch { return false; } });
+        const carried = ['CLAUDE.md', 'AGENTS.md'].some(f => (readRepoFile(root, f) ?? '').includes('<!-- graph-indexer:start -->'));
         return rules || !carried ? `${line}\n${RULES}` : line;
     } finally { ix.release(); }
 }

package/src/cli/init.mjs

@@ -52,13 +52,17 @@ function readJson(p) {
     try { return JSON.parse(fs.readFileSync(p, 'utf8').replace(/^\s*\/\/.*$/gm, '')); } catch { return null; }
 }
 
+// --prefix /: npx would otherwise run a graph-indexer 3.x found in the repository's own node_modules
+// (code the repository ships) instead of the published package
+const NPX_ARGS = ['-y', '--prefix', '/', 'graph-indexer@3'];
+
 function serverEntry(agent, { local }) {
     const here = path.dirname(fileURLToPath(import.meta.url));
     const bin = path.resolve(here, '../../bin/graph-indexer.mjs');
     const repoArgs = agent.workspaceVar ? ['--repo', agent.workspaceVar] : [];
     const base = local
         ? { command: process.execPath, args: [bin, 'serve', ...repoArgs] }
-        : { command: 'npx', args: ['-y', 'graph-indexer@3', 'serve', ...repoArgs] };
+        : { command: 'npx', args: [...NPX_ARGS, 'serve', ...repoArgs] };
     if (agent.opencode) return { type: 'local', command: [base.command, ...base.args], enabled: true };
     if (agent.zed) return { ...base, env: {} };
     return agent.vscode ? { type: 'stdio', ...base } : base;
@@ -70,7 +74,24 @@ function configFile(agent, repo) {
     return agent.file;
 }
 
-function upsertBlock(file, dryRun) {
+/**
+ * Write `file` under `repo` without following a link the repository committed (`CLAUDE.md` →
+ * ~/.zshrc, `.claude` → ~/.claude): such a target is refused instead of written through.
+ */
+function writeInRepo(repo, file, content) {
+    const rootReal = fs.realpathSync(repo);
+    const inside = (p) => { const r = fs.realpathSync(p); return r === rootReal || r.startsWith(rootReal + path.sep); };
+    let dir = path.dirname(file);
+    while (!fs.existsSync(dir)) dir = path.dirname(dir);
+    let link = false;
+    try { link = fs.lstatSync(file).isSymbolicLink(); } catch { /* a new file */ }
+    if (link || !inside(dir)) throw new Error(`${path.relative(repo, file)} leads outside the repository (a symbolic link); not written`);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    if (!inside(path.dirname(file))) throw new Error(`${path.relative(repo, file)} leads outside the repository (a symbolic link); not written`);
+    fs.writeFileSync(file, content);
+}
+
+function upsertBlock(repo, file, dryRun) {
     const exists = fs.existsSync(file);
     const text = exists ? fs.readFileSync(file, 'utf8') : '';
     let next;
@@ -80,7 +101,7 @@ function upsertBlock(file, dryRun) {
         next = (text.trimEnd() ? text.trimEnd() + '\n\n' : '') + SNIPPET + '\n';
     }
     if (next === text) return 'unchanged';
-    if (!dryRun) fs.writeFileSync(file, next);
+    if (!dryRun) writeInRepo(repo, file, next);
     return exists ? 'updated' : 'created';
 }
 
@@ -100,7 +121,7 @@ function cliCommand(local) {
     const bin = path.resolve(here, '../../bin/graph-indexer.mjs');
     if (local) return `${JSON.stringify(process.execPath)} ${JSON.stringify(bin)}`;
     const installed = installedBin();
-    return installed ? JSON.stringify(installed) : 'npx -y graph-indexer@3';
+    return installed ? JSON.stringify(installed) : ['npx', ...NPX_ARGS].join(' ');
 }
 
 /** The command that starts graph-indexer, as an argv array (for the OpenCode/Kilo Code plugin). */
@@ -108,7 +129,7 @@ function cliArgv(local) {
     const here = path.dirname(fileURLToPath(import.meta.url));
     if (local) return [process.execPath, path.resolve(here, '../../bin/graph-indexer.mjs')];
     const installed = installedBin();
-    return installed ? [installed] : ['npx', '-y', 'graph-indexer@3'];
+    return installed ? [installed] : ['npx', ...NPX_ARGS];
 }
 
 /**
@@ -128,8 +149,7 @@ function writeOpenCodePlugin(repo, local, dryRun) {
         const file = path.join(repo, rel);
         const same = fs.existsSync(file) && fs.readFileSync(file, 'utf8') === src;
         if (!same && !dryRun) {
-            fs.mkdirSync(path.dirname(file), { recursive: true });
-            fs.writeFileSync(file, src);
+            writeInRepo(repo, file, src);
         }
         out.push(`${same ? 'already in' : 'written to'} ${rel}`);
     }
@@ -160,8 +180,7 @@ function upsertClaudeHooks(repo, local, dryRun) {
     }
     const changed = before !== JSON.stringify(cfg.hooks);
     if (changed && !dryRun) {
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, JSON.stringify(cfg, null, 2) + '\n');
+        writeInRepo(repo, file, JSON.stringify(cfg, null, 2) + '\n');
     }
     return `Claude Code hooks: ${changed ? 'written to' : 'already in'} .claude/settings.json (post-edit check, grep disambiguation, session line)`;
 }
@@ -178,8 +197,7 @@ function upsertClaudeHelper(repo, dryRun) {
     if (have === want) return `Claude Code: structural helper already in ${rel}`;
     if (have != null && !have.includes("graph-indexer's index")) return `Claude Code: ${rel} exists and is not graph-indexer's, so it was left as is`;
     if (!dryRun) {
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, want);
+        writeInRepo(repo, file, want);
     }
     return `Claude Code: structural helper ${have == null ? 'written to' : 'updated in'} ${rel} (a sub-agent on a small model that answers call-site, caller, subclass and impact questions from the index)`;
 }
@@ -221,8 +239,7 @@ export async function runInit({ opt, flag, repo: repoArg = null }) {
             cfg[a.key]['graph-indexer'] = entry;
             const changed = before !== JSON.stringify(entry);
             if (changed && !dryRun) {
-                fs.mkdirSync(path.dirname(file), { recursive: true });
-                fs.writeFileSync(file, JSON.stringify(cfg, null, 2) + '\n');
+                writeInRepo(repo, file, JSON.stringify(cfg, null, 2) + '\n');
             }
             report.push(`${a.label}: ${changed ? (before === 'null' ? 'added' : 'updated') : 'already configured'} ${rel}`);
         } else if (key === 'codex') {
@@ -239,17 +256,17 @@ export async function runInit({ opt, flag, repo: repoArg = null }) {
     if (hooks && chosen.includes('opencode')) report.push(writeOpenCodePlugin(repo, local, dryRun));
     if (!noInstructions) {
         const targets = [...new Set(chosen.map(k => AGENTS[k].instructions))];
-        for (const t of targets) report.push(`${t}: ${upsertBlock(path.join(repo, t), dryRun)} graph-indexer instructions block`);
+        for (const t of targets) report.push(`${t}: ${upsertBlock(repo, path.join(repo, t), dryRun)} graph-indexer instructions block`);
     }
     // keep the index out of version control
     const gi = path.join(repo, '.gitignore');
     const giText = fs.existsSync(gi) ? fs.readFileSync(gi, 'utf8') : '';
     if (!/^\/?\.graph-indexer\/?$/m.test(giText)) {
-        if (!dryRun) fs.writeFileSync(gi, (giText.trimEnd() ? giText.trimEnd() + '\n' : '') + '.graph-indexer/\n');
+        if (!dryRun) writeInRepo(repo, gi, (giText.trimEnd() ? giText.trimEnd() + '\n' : '') + '.graph-indexer/\n');
         report.push('.gitignore: added .graph-indexer/');
     }
     process.stdout.write(`graph-indexer init ${dryRun ? '(dry run) ' : ''}in ${repo}\n  ${report.join('\n  ')}\n\n` +
-        `Other agents (Claude Desktop, JetBrains AI Assistant, Cline): add an MCP server with command "npx" and args ["-y","graph-indexer@3","serve","--repo","${repo}"].\n` +
-        `Build the index now with: npx graph-indexer index   (the server also builds it on first start)\n` +
+        `Other agents (Claude Desktop, JetBrains AI Assistant, Cline): add an MCP server with command "npx" and args ${JSON.stringify([...NPX_ARGS, 'serve', '--repo', repo])}.\n` +
+        `Build the index now with: npx ${NPX_ARGS.join(' ')} index   (the server also builds it on first start)\n` +
         (hooks ? '' : `Optional: graph-indexer init --hooks adds Claude Code hooks (edit check after each edit, grep disambiguation).\n`));
 }

package/src/cli/resident.mjs

@@ -44,15 +44,25 @@ export function socketPath(root) {
     return path.join(os.tmpdir(), `graph-indexer-${process.getuid?.() ?? 'user'}`, `${hash}.sock`);
 }
 
-/** A per-user directory in the temp dir must belong to us and be closed to everyone else. */
+const mine = (st) => (process.getuid ? st.uid === process.getuid() : true);
+
+/**
+ * The socket's directory must be a real directory of ours (not a link the repository committed);
+ * a per-user directory in the temp dir must also be closed to everyone else.
+ */
 function privateDir(dir, root) {
-    if (WIN || dir === path.join(path.resolve(root), DATA_DIR_NAME)) return true;
+    if (WIN) return true;
     try {
         const st = fs.lstatSync(dir);
-        return st.isDirectory() && (process.getuid ? st.uid === process.getuid() : true) && (st.mode & 0o077) === 0;
+        return st.isDirectory() && mine(st) && (dir === path.join(path.resolve(root), DATA_DIR_NAME) || (st.mode & 0o077) === 0);
     } catch { return false; }
 }
 
+/** A socket of ours, not a file or a listener someone else put there. */
+function ownSocket(file) {
+    try { const st = fs.lstatSync(file); return st.isSocket() && mine(st); } catch { return false; }
+}
+
 const disabled = () => process.env.GRAPH_INDEXER_RESIDENT === '0';
 /** GRAPH_INDEXER_RESIDENT=require: answer only through a resident, never by opening the index (tests, debugging). */
 export const residentRequired = () => process.env.GRAPH_INDEXER_RESIDENT === 'require';
@@ -64,7 +74,7 @@ export const residentRequired = () => process.env.GRAPH_INDEXER_RESIDENT === 're
 export function askResident(root, request, { version, connectMs = 250, totalMs = 5000 } = {}) {
     if (disabled()) return Promise.resolve(null);
     const file = socketPath(root);
-    if (!WIN && (!fs.existsSync(file) || !privateDir(path.dirname(file), root))) return Promise.resolve(null);
+    if (!WIN && (!ownSocket(file) || !privateDir(path.dirname(file), root))) return Promise.resolve(null);
     return new Promise((resolve) => {
         let done = false, connected = false, buf = '';
         const sock = net.createConnection(file);

package/src/index/discover.mjs

@@ -6,7 +6,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
+import { gitSync } from '../util/git.mjs';
 import { specForPath } from '../parse/languages.mjs';
 
 export const MAX_FILE_BYTES = 1_500_000;
@@ -24,14 +24,12 @@ const SKIP_DIRS = new Set([
 const GENERATED_FILE = /(\.min\.(js|css|mjs)$|\.bundle\.js$|[.-]bundle\.[cm]?js$|\.chunk\.js$|\.map$|\.pb\.go$|_pb2(_grpc)?\.py$|\.pb\.(cc|h)$|\.generated\.\w+$|\.g\.dart$|\.designer\.cs$|(^|\/)generated\/|\.d\.ts\.map$)/i;
 
 function isGitRepo(root) {
-    const r = spawnSync('git', ['rev-parse', '--is-inside-work-tree'], { cwd: root, encoding: 'utf8' });
+    const r = gitSync(root, ['rev-parse', '--is-inside-work-tree']);
     return r.status === 0 && r.stdout.trim() === 'true';
 }
 
 function gitListFiles(root) {
-    const r = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
-        cwd: root, encoding: 'utf8', maxBuffer: 1 << 30,
-    });
+    const r = gitSync(root, ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], { maxBuffer: 1 << 30 });
     if (r.status !== 0) return null;
     return r.stdout.split('\0').filter(Boolean);
 }

package/src/index/modules.mjs

@@ -5,12 +5,13 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { readRepoFile } from '../util/paths.mjs';
 
 const ECMA_EXTS = ['.ts', '.tsx', '.d.ts', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts'];
 
-function readJson(p) {
+function readJson(root, rel) {
     try {
-        const text = fs.readFileSync(p, 'utf8').replace(/\/\*[\s\S]*?\*\/|^\s*\/\/.*$/gm, '').replace(/,(\s*[}\]])/g, '$1');
+        const text = readRepoFile(root, rel).replace(/\/\*[\s\S]*?\*\/|^\s*\/\/.*$/gm, '').replace(/,(\s*[}\]])/g, '$1');
         return JSON.parse(text);
     } catch { return null; }
 }
@@ -53,7 +54,7 @@ export class ModuleResolver {
         this.packages = new Map();
         const pkgJsons = [...this.files].length ? this.#findManifests('package.json') : [];
         for (const rel of pkgJsons) {
-            const j = readJson(path.join(this.root, rel));
+            const j = readJson(this.root, rel);
             if (j?.name) this.packages.set(j.name, { dir: path.posix.dirname(rel), json: j });
         }
         // tsconfig paths and baseUrl, per project: a file resolves through the nearest tsconfig.json
@@ -73,7 +74,7 @@ export class ModuleResolver {
         this.goModules = [];
         for (const rel of this.#findManifests('go.mod')) {
             try {
-                const m = /^module\s+(\S+)/m.exec(fs.readFileSync(path.join(this.root, rel), 'utf8'));
+                const m = /^module\s+(\S+)/m.exec(readRepoFile(this.root, rel) ?? '');
                 if (m) this.goModules.push({ module: m[1], dir: path.posix.dirname(rel) });
             } catch { /* unreadable */ }
         }
@@ -82,7 +83,7 @@ export class ModuleResolver {
 
     /** compilerOptions of a tsconfig file, following relative `extends` (a child's paths replace its parent's). */
     #tsOptions(rel, depth = 0) {
-        const j = readJson(path.join(this.root, rel));
+        const j = readJson(this.root, rel);
         if (!j || depth > 5) return null;
         const dir = path.posix.dirname(rel);
         let out = { paths: null, pathsDir: null, baseUrl: null };

package/src/index/resolver.mjs

@@ -16,8 +16,12 @@
 import path from 'node:path';
 import { normalizeType } from '../parse/extract.mjs';
 import { fits, sigArity } from '../parse/arity.mjs';
+import { escapeRegExp } from '../util/regex.mjs';
 
 const TYPE_KINDS = new Set(['class', 'interface', 'struct', 'enum', 'trait', 'type', 'object', 'module', 'impl']);
+// element accesses one descriptor may stack (`xs[i][j]`…): a field assigned an element of itself
+// (`self.impl = self.impl[0]`) would add one on every lookup, with no end
+const MAX_ELEM = 8;
 const VALUE_TYPED_KINDS = new Set(['variable', 'constant', 'field', 'property']);
 const CALLABLE_KINDS = new Set(['function', 'method', 'constructor', 'macro']);
 const MEMBER_HOLDERS = new Set(['class', 'interface', 'struct', 'enum', 'trait', 'object', 'impl', 'module']);
@@ -100,7 +104,7 @@ function paramType(param) {
  */
 export function callbackParamTypeText(sig, name, i, j) {
     if (!sig) return null;
-    const m = new RegExp(`(?:^|[^\\w$])${name.replace(/[$]/g, '\\$')}\\s*(?:<[^()]*>)?\\s*\\(`).exec(sig);
+    const m = new RegExp(`(?:^|[^\\w$])${escapeRegExp(name)}\\s*(?:<[^()]*>)?\\s*\\(`).exec(sig);
     const list = m ? bracketed(sig, m.index + m[0].length - 1) : null;
     let type = list ? paramType(splitTopLevel(list.inner)[i] ?? '') : null;
     if (!type) return null;
@@ -376,7 +380,10 @@ export class Resolver {
      */
     typeFromString(str, fileId, elem = 0) {
         if (!str) return null;
-        if (str.startsWith('call:') || str.startsWith('cb:') || str.includes('#')) return this.resolveRecvType(str + '[]'.repeat(elem), fileId, null);
+        if (str.startsWith('call:') || str.startsWith('cb:') || str.includes('#')) {
+            const desc = str + '[]'.repeat(elem);
+            return desc.split('[]').length - 1 > MAX_ELEM ? null : this.resolveRecvType(desc, fileId, null);
+        }
         let s = str;
         for (let i = 0; i < elem; i++) {
             if (!s.endsWith('[]') && !s.endsWith('{}')) {

package/src/mcp/tools.mjs

@@ -12,6 +12,7 @@ import { checkChanges } from '../query/check.mjs';
 import { definitionsUsed, testsUsing } from '../query/read.mjs';
 import { factsForRange, renderFacts } from '../query/facts.mjs';
 import fs from 'node:fs';
+import { withinRoot } from '../util/paths.mjs';
 
 const TYPE_KINDS = new Set(['class', 'interface', 'struct', 'enum', 'trait', 'type', 'object', 'module', 'impl']);
 const VALUE_KINDS = new Set(['field', 'property', 'variable', 'constant']);
@@ -421,7 +422,7 @@ async function toolRead(intel, { targets = [], target = null, full = false, max_
 }
 
 function isFile(intel, rel) {
-    try { return fs.statSync(path.join(intel.root, rel)).isFile(); } catch { return false; }
+    try { return withinRoot(intel.root, rel) && fs.statSync(path.join(intel.root, rel)).isFile(); } catch { return false; }
 }
 
 async function readOne(intel, raw, { full, maxLines, seen }) {

package/src/parse/arity.mjs

@@ -4,6 +4,7 @@
  * ({ n, open }, open = a spread/splat makes n a lower bound). Used by the edit checker to spot
  * call sites that no longer match a changed signature, without compiling anything.
  */
+import { escapeRegExp } from '../util/regex.mjs';
 
 const PARAM_LIST_TYPES = new Set(['formal_parameters', 'parameters', 'parameter_list', 'function_value_parameters', 'method_parameters',
     'lambda_parameters', 'block_parameters', 'parameter_clause']);
@@ -117,7 +118,7 @@ export function callArgc(call) {
  */
 export function sigArity(sig, name) {
     if (!sig) return null;
-    const m = new RegExp(`(?:^|[^\\w$])${name.replace(/[$]/g, '\\$')}\\s*(?:<[^()]*>)?\\s*\\(`).exec(sig);
+    const m = new RegExp(`(?:^|[^\\w$])${escapeRegExp(name)}\\s*(?:<[^()]*>)?\\s*\\(`).exec(sig);
     if (!m) return null;
     let depth = 0, cur = '', min = 0, max = 0, done = false;
     const param = (p) => {

package/src/parse/extract.mjs

@@ -334,9 +334,16 @@ export async function extractFile(spec, source, relPath) {
     }
 }
 
+// query time can grow super-linearly with the syntax (60,000 chained calls in a 360 KB file take
+// minutes): such a file is given up after this long instead of stalling the whole index
+const QUERY_BUDGET_MS = 15_000;
+
 function extractFromTree(spec, query, tree, source, relPath) {
     const root = tree.rootNode;
-    const matches = query.matches(root);
+    const deadline = Date.now() + QUERY_BUDGET_MS;
+    let gaveUp = false;
+    const matches = query.matches(root, { progressCallback: () => (gaveUp = Date.now() > deadline) });
+    if (gaveUp) throw new Error(`gave up after ${QUERY_BUDGET_MS / 1000} s of queries (pathological syntax)`);
 
     const defs = [];          // { node, nameNode, kind, owner }
     const rawRefs = [];       // { node, nameNode, kind, recvNode }

package/src/query/check.mjs

@@ -11,19 +11,20 @@
  *   inherited     subclasses that inherit a changed member (they run the new code) or override it
  *   tests         the test files that exercise the changed code, and the command to run them
  */
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
 import { specForPath, isConstructor } from '../parse/languages.mjs';
 import { prepareLanguage, extractFile } from '../parse/extract.mjs';
 import { paramArity, callAt, callArgc, fits, describeArity } from '../parse/arity.mjs';
 import { testCommands, testCaseCommands } from './testcmd.mjs';
+import { escapeRegExp } from '../util/regex.mjs';
+import { readRepoFile, isRevision } from '../util/paths.mjs';
+import { MAX_FILE_BYTES } from '../index/discover.mjs';
+import { gitSync } from '../util/git.mjs';
 
 const CALLABLE = new Set(['function', 'method', 'constructor']);
 const MEMBER_KINDS = new Set(['class', 'interface', 'struct', 'trait', 'enum', 'object', 'impl', 'module', 'type']);
 
 function git(root, args) {
-    const r = spawnSync('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 1 << 28 });
+    const r = gitSync(root, args, { maxBuffer: 1 << 28 });
     return r.status === 0 ? r.stdout : null;
 }
 
@@ -143,6 +144,7 @@ function unionFits(argc, arities) {
 
 export async function checkChanges(intel, { base = 'HEAD', files = null, tests = true } = {}) {
     const root = intel.root;
+    if (!isRevision(base)) return { error: `Not a git revision: ${base}` };
     const changed = changedFiles(root, base);
     if (!changed) return { error: `git diff against ${base} failed — is this a git repository with that commit?` };
     // the edited files must be re-indexed now, whatever the file watcher has seen so far
@@ -158,8 +160,8 @@ export async function checkChanges(intel, { base = 'HEAD', files = null, tests =
         let v = null;
         const spec = specForPath(rel);
         try {
-            if (spec) {
-                const src = fs.readFileSync(path.join(root, rel), 'utf8');
+            const src = spec ? readRepoFile(root, rel, MAX_FILE_BYTES) : null;
+            if (src !== null) {
                 const { parser } = await prepareLanguage(spec);
                 v = { tree: parser.parse(src), lines: src.split(/\r?\n/), src, spec };
             }
@@ -276,7 +278,7 @@ export async function checkChanges(intel, { base = 'HEAD', files = null, tests =
         const files = new Map();
         const mentions = (p, word) => {
             const key = p + '\u0000' + word;
-            if (!files.has(key)) { const lines = intel.fileLines(p); files.set(key, !!lines && lines.some(l => new RegExp(`\\b${word.replace(/[$]/g, '\\$')}\\b`).test(l))); }
+            if (!files.has(key)) { const lines = intel.fileLines(p); files.set(key, !!lines && lines.some(l => new RegExp(`\\b${escapeRegExp(word)}\\b`).test(l))); }
             return files.get(key);
         };
         rows = rows.filter(r => {

package/src/query/intel.mjs

@@ -7,15 +7,16 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
 import { Store } from '../store/db.mjs';
 import { Indexer } from '../index/indexer.mjs';
 import { SearchEngine } from '../search/search.mjs';
 import { computeCentrality, loadGraph } from '../index/graph.mjs';
 import { confidenceLabel } from '../index/resolver.mjs';
-import { dataDir } from '../util/paths.mjs';
+import { dataDir, withinRoot, isRevision } from '../util/paths.mjs';
 import { isConstructor } from '../parse/languages.mjs';
 import { sigArity } from '../parse/arity.mjs';
+import { escapeRegExp } from '../util/regex.mjs';
+import { gitSync } from '../util/git.mjs';
 
 const TYPE_KINDS = new Set(['class', 'interface', 'struct', 'enum', 'trait', 'type', 'object', 'module', 'impl']);
 const CALLABLE = new Set(['function', 'method', 'constructor', 'macro']);
@@ -128,6 +129,7 @@ export class CodeIntel {
 
     // ── source access ────────────────────────────────────────────────────────────
     fileLines(rel) {
+        if (!withinRoot(this.root, rel)) return null;
         const abs = path.join(this.root, rel);
         let st;
         try { st = fs.statSync(abs); } catch { return null; }
@@ -162,7 +164,7 @@ export class CodeIntel {
                 ORDER BY (s.end_line - s.start_line) ASC LIMIT 1`, file.replace(/^\.\//, ''), Number(line), Number(line));
             return { matches: rows.map(r => this.sym(r.id)), how: 'location' };
         }
-        m = /^(.+?\.[A-Za-z0-9]+)[:#](.+)$/.exec(t);
+        m = /^([^:#]+?\.[A-Za-z0-9]+)[:#](.+)$/.exec(t);
         if (m) {
             const [, file, q] = m;
             const rows = this.store.all(`SELECT s.id FROM symbols s JOIN files f ON f.id = s.file_id WHERE f.path = ? AND (s.qname = ? OR s.name = ? OR s.qname LIKE ?) ORDER BY s.qname = ? DESC, s.start_line LIMIT ?`,
@@ -367,7 +369,7 @@ export class CodeIntel {
             const ids = [...family];
             for (const { path: p } of this.store.all(`SELECT DISTINCT f.path FROM refs r JOIN files f ON f.id = r.file_id WHERE r.dst_id IN (${ids.map(() => '?').join(',')})`, ...ids)) files.add(p);
         } else files.add(sym.path);
-        const name = sym.name.replace(/[$]/g, '\\$');
+        const name = escapeRegExp(sym.name);
         const lit = new RegExp(`(['"\`])(?:[\\w.]*\\.)?${name}\\1`);
         const title = /^\s*(?:describe|it|test|context|suite)(?:\.\w+)?\s*\(/;
         const out = [];
@@ -451,7 +453,7 @@ export class CodeIntel {
             return { total: rows.length, plausible, typeNames: [] };
         }
         const names = [...typeNames];
-        const wordRe = new RegExp(`\\b(${names.map(n => n.replace(/[$]/g, '\\$')).join('|')})\\b`);
+        const wordRe = new RegExp(`\\b(${names.map(n => escapeRegExp(n)).join('|')})\\b`);
         const lower = names.map(n => n.toLowerCase());
         const mentions = new Map();
         const plausible = rows.filter(r => {
@@ -575,7 +577,8 @@ export class CodeIntel {
     // ── impact ───────────────────────────────────────────────────────────────────
     /** Symbols overlapping the working-tree diff (git), as impact seeds. */
     diffSeeds(base = 'HEAD') {
-        const r = spawnSync('git', ['diff', '-U0', '--no-color', base, '--'], { cwd: this.root, encoding: 'utf8', maxBuffer: 1 << 28 });
+        if (!isRevision(base)) return { error: `Not a git revision: ${base}`, seeds: [], files: [] };
+        const r = gitSync(this.root, ['diff', '-U0', '--no-color', base, '--'], { maxBuffer: 1 << 28 });
         if (r.status !== 0) return { error: (r.stderr || 'git diff failed').trim(), seeds: [], files: [] };
         const changes = new Map();
         let file = null;
@@ -587,7 +590,7 @@ export class CodeIntel {
                 (changes.get(file) ?? changes.set(file, []).get(file)).push([start, Math.max(start, start + len - 1)]);
             }
         }
-        const untracked = spawnSync('git', ['ls-files', '--others', '--exclude-standard'], { cwd: this.root, encoding: 'utf8' });
+        const untracked = gitSync(this.root, ['ls-files', '--others', '--exclude-standard']);
         for (const f of (untracked.stdout || '').split('\n').filter(Boolean)) if (!changes.has(f)) changes.set(f, [[1, 1e9]]);
         const seeds = new Set();
         for (const [f, ranges] of changes) {
@@ -604,7 +607,7 @@ export class CodeIntel {
     /** Files that historically change together with the given files (git log, bounded). */
     coChange(files, { commits = 400, limit = 8 } = {}) {
         if (!this._cochange || this._cochangeAt < Date.now() - 600_000) {
-            const r = spawnSync('git', ['log', `-n${commits}`, '--name-only', '--pretty=format:%x00'], { cwd: this.root, encoding: 'utf8', maxBuffer: 1 << 28 });
+            const r = gitSync(this.root, ['log', `-n${commits}`, '--name-only', '--pretty=format:%x00'], { maxBuffer: 1 << 28 });
             const counts = new Map(); const pair = new Map();
             if (r.status === 0) {
                 for (const block of r.stdout.split('\0')) {

package/src/query/testcmd.mjs

@@ -6,16 +6,24 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { readRepoFile } from '../util/paths.mjs';
 
-function readJson(p) { try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; } }
+function readJson(root, rel) { try { return JSON.parse(readRepoFile(root, rel)); } catch { return null; } }
 const exists = (root, rel) => fs.existsSync(path.join(root, rel));
+// commands are pasted into a shell as they are: a file named `t$(cmd).test.ts` (repository content)
+// must reach the test runner as a name, never run as a command substitution
+const plain = (s) => /^[\w./@+=:,-]+$/.test(s);
+/** One shell word: as is when plain, else single-quoted. */
+const q = (s) => (plain(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`);
+// a name that would read as an option, or a test identifier that is not a plain word, gets no command
+const shellSafe = (s) => !s.startsWith('-') && !/[\0\r\n]/.test(s);
 
 /** Nearest package.json above a file (monorepos have one per package). */
 function nearestPackage(root, rel) {
     let dir = path.posix.dirname(rel);
     for (;;) {
-        const p = path.join(root, dir === '.' ? '' : dir, 'package.json');
-        if (fs.existsSync(p)) return { dir: dir === '.' ? '' : dir, pkg: readJson(p) ?? {} };
+        const p = path.posix.join(dir === '.' ? '' : dir, 'package.json');
+        if (exists(root, p)) return { dir: dir === '.' ? '' : dir, pkg: readJson(root, p) ?? {} };
         if (dir === '.' || dir === '' || dir === '/') return null;
         dir = path.posix.dirname(dir);
     }
@@ -23,7 +31,7 @@ function nearestPackage(root, rel) {
 
 function jsRunner(root, rel) {
     const near = nearestPackage(root, rel);
-    const top = readJson(path.join(root, 'package.json')) ?? {};
+    const top = readJson(root, 'package.json') ?? {};
     const pkgs = [near?.pkg, top].filter(Boolean);
     const deps = Object.assign({}, ...pkgs.map(p => ({ ...p.dependencies, ...p.devDependencies })));
     const scripts = pkgs.map(p => p.scripts?.test ?? '').join(' ');
@@ -38,7 +46,7 @@ function jsRunner(root, rel) {
 
 function pyRunner(root) {
     if (exists(root, 'tests/runtests.py')) return { kind: 'django' };
-    const pyproject = (() => { try { return fs.readFileSync(path.join(root, 'pyproject.toml'), 'utf8'); } catch { return ''; } })();
+    const pyproject = readRepoFile(root, 'pyproject.toml') ?? '';
     if (exists(root, 'pytest.ini') || exists(root, 'conftest.py') || /\[tool\.pytest/.test(pyproject) || exists(root, 'tox.ini')) return { kind: 'pytest' };
     return { kind: 'unittest' };
 }
@@ -51,7 +59,7 @@ function pyRunner(root) {
 export function testCommands(root, files) {
     const groups = new Map();
     const add = (key, f) => (groups.get(key) ?? groups.set(key, []).get(key)).push(f);
-    for (const f of files) {
+    for (const f of files.filter(shellSafe)) {
         const ext = path.posix.extname(f);
         if (/\.[cm]?[jt]sx?$/.test(ext)) add(`js:${jsRunner(root, f)}`, f);
         else if (ext === '.py') add('py', f);
@@ -64,19 +72,20 @@ export function testCommands(root, files) {
     }
     const out = [];
     for (const [key, fs_] of groups) {
-        if (key.startsWith('js:')) out.push(`${key.slice(3)} ${fs_.join(' ')}`);
+        if (key.startsWith('js:')) out.push(`${key.slice(3)} ${fs_.map(q).join(' ')}`);
         else if (key === 'py') {
             const r = pyRunner(root);
-            if (r.kind === 'django') out.push(`python tests/runtests.py ${[...new Set(fs_.map(f => f.replace(/^tests\//, '').replace(/\/[^/]*$/, '').replace(/\//g, '.')))].join(' ')}`);
-            else if (r.kind === 'pytest') out.push(`python -m pytest -q ${fs_.join(' ')}`);
-            else out.push(`python -m unittest ${fs_.map(f => f.replace(/\.py$/, '').replace(/\//g, '.')).join(' ')}`);
-        } else if (key === 'go') out.push(`go test ${[...new Set(fs_.map(f => './' + path.posix.dirname(f)))].join(' ')}`);
+            if (r.kind === 'django') out.push(`python tests/runtests.py ${[...new Set(fs_.map(f => f.replace(/^tests\//, '').replace(/\/[^/]*$/, '').replace(/\//g, '.')))].map(q).join(' ')}`);
+            else if (r.kind === 'pytest') out.push(`python -m pytest -q ${fs_.map(q).join(' ')}`);
+            else out.push(`python -m unittest ${fs_.map(f => q(f.replace(/\.py$/, '').replace(/\//g, '.'))).join(' ')}`);
+        } else if (key === 'go') out.push(`go test ${[...new Set(fs_.map(f => './' + path.posix.dirname(f)))].map(q).join(' ')}`);
         else if (key === 'rs') out.push('cargo test');
         else if (key === 'jvm') {
-            const classes = [...new Set(fs_.map(f => path.posix.basename(f).replace(/\.\w+$/, '')))].join(',');
+            const classes = [...new Set(fs_.map(f => path.posix.basename(f).replace(/\.\w+$/, '')).filter(c => /^\w+$/.test(c)))].join(',');
+            if (!classes) continue;
             out.push(exists(root, 'pom.xml') ? `mvn -q test -Dtest=${classes}` : `./gradlew test ${classes.split(',').map(c => `--tests '*${c}'`).join(' ')}`);
-        } else if (key === 'rb') out.push(exists(root, '.rspec') || fs_.some(f => f.endsWith('_spec.rb')) ? `bundle exec rspec ${fs_.join(' ')}` : `bundle exec ruby -Itest ${fs_[0]}`);
-        else if (key === 'php') out.push(`vendor/bin/phpunit ${fs_.join(' ')}`);
+        } else if (key === 'rb') out.push(exists(root, '.rspec') || fs_.some(f => f.endsWith('_spec.rb')) ? `bundle exec rspec ${fs_.map(q).join(' ')}` : `bundle exec ruby -Itest ${q(fs_[0])}`);
+        else if (key === 'php') out.push(`vendor/bin/phpunit ${fs_.map(q).join(' ')}`);
         else if (key === 'cs') out.push('dotnet test');
     }
     return out;
@@ -90,6 +99,8 @@ export function testCommands(root, files) {
  */
 export function testCaseCommands(root, cases) {
     const out = [];
+    const word = (s) => /^\w+$/.test(s);
+    cases = cases.filter(c => shellSafe(c.path) && plain(c.path) && word(c.name) && (!c.cls || word(c.cls)));
     const py = cases.filter(c => c.path.endsWith('.py'));
     if (py.length) {
         const r = pyRunner(root);

package/src/query/textsearch.mjs

@@ -7,15 +7,26 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
+import vm from 'node:vm';
+import { withinRoot } from '../util/paths.mjs';
+import { gitSync } from '../util/git.mjs';
 
 const MAX_FILE_BYTES = 1_500_000;
+// a caller's pattern gets this much matching time per search (reading files does not count): one
+// with catastrophic backtracking (`(a+)+$`) is stopped instead of blocking the server
+const REGEX_BUDGET_MS = 5000;
+const SCAN = new vm.Script(`(() => {
+    if (!re.test(text)) return null;
+    const lines = text.split(/\\r?\\n/), hits = [];
+    for (let i = 0; i < lines.length; i++) if (re.test(lines[i])) hits.push(i);
+    return { lines, hits };
+})()`);
 const SKIP_DIRS = /(^|\/)(node_modules|\.git|\.graph-indexer|dist|build|out|target|coverage|__pycache__|\.venv|venv|\.next|\.nuxt|\.cache|vendor)\//;
 const EXAMPLE_PATH = /(^|\/)(docs?_src|docs?|examples?|samples?|demos?|tutorials?|benchmarks?|playground)\//i;
 const COMMENT_LINE = /^\s*(\/\/|#(?![!\[])|\*|\/\*|<!--|--\s|;;|%)/;
 
 function listFiles(root) {
-    const r = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], { cwd: root, encoding: 'utf8', maxBuffer: 1 << 30 });
+    const r = gitSync(root, ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], { maxBuffer: 1 << 30 });
     if (r.status === 0) return r.stdout.split('\0').filter(Boolean).filter(p => !SKIP_DIRS.test(p));
     const out = [];
     const stack = [''];
@@ -98,25 +109,32 @@ export async function textSearch(intel, { pattern, path: prefix = null, literal
     const indexed = new Map(intel.store.all('SELECT id, path, is_test FROM files').map(f => [f.path, f]));
     const matches = [];
     let total = 0, nfiles = 0;
+    const ctx = vm.createContext({ re, text: '' });
+    let budget = REGEX_BUDGET_MS;
     for (const rel of files) {
         let text;
         try {
+            if (!withinRoot(root, rel)) continue;
             const st = fs.statSync(path.join(root, rel));
             if (!st.isFile() || st.size > MAX_FILE_BYTES) continue;
             text = fs.readFileSync(path.join(root, rel), 'utf8');
         } catch { continue; }
-        if (!re.test(text)) continue;
         if (text.indexOf('\0') >= 0 && text.indexOf('\0') < 8000) continue; // binary
-        const lines = text.split(/\r?\n/);
-        let any = false;
-        for (let i = 0; i < lines.length; i++) {
-            if (!re.test(lines[i])) continue;
-            any = true;
+        ctx.text = text;
+        let scan;
+        const t0 = performance.now();
+        try { scan = SCAN.runInContext(ctx, { timeout: Math.max(1, Math.ceil(budget)) }); } catch (e) {
+            if (e.code !== 'ERR_SCRIPT_EXECUTION_TIMEOUT') throw e;
+            return { error: `The regular expression took more than ${REGEX_BUDGET_MS / 1000} s (catastrophic backtracking?). Simplify it, or pass literal: true to search for the text as is.` };
+        }
+        budget -= performance.now() - t0;
+        if (!scan?.hits.length) continue;
+        nfiles++;
+        const f = indexed.get(rel);
+        for (const i of scan.hits) {
             total++;
-            const f = indexed.get(rel);
-            matches.push({ path: rel, line: i + 1, text: lines[i], fileId: f?.id ?? null, isTest: !!f?.is_test, code: !!f });
+            matches.push({ path: rel, line: i + 1, text: scan.lines[i], fileId: f?.id ?? null, isTest: !!f?.is_test, code: !!f });
         }
-        if (any) nfiles++;
     }
     const ident = identifierOf(pattern, literal);
     // annotate: enclosing definition, and what an identifier match refers to

package/src/util/git.mjs

@@ -0,0 +1,30 @@
+/**
+ * git, run so that an indexed repository's own config cannot make it execute anything: no
+ * fsmonitor, no hooks, no signature verification, no external diff or textconv, and every
+ * clean/smudge/process filter switched off. A repository copied with its .git directory (an
+ * archive, a shared folder) is not trusted.
+ */
+import { spawnSync } from 'node:child_process';
+
+const COMMAND_KEY = /^(filter\.[^\n]+)\.(clean|smudge|process)$|^diff\.[^\n]+\.(textconv|command)$/;
+
+function hardening(root) {
+    const args = ['-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-c', 'diff.external=', '-c', 'log.showSignature=false'];
+    const r = spawnSync('git', ['config', '--name-only', '--get-regexp', '^(filter|diff)\\.'], { cwd: root, encoding: 'utf8' });
+    for (const key of (r.status === 0 ? r.stdout : '').split('\n')) {
+        const m = COMMAND_KEY.exec(key);
+        if (!m) continue;
+        args.push('-c', `${key}=`);
+        // a required filter (Git LFS sets one) would otherwise fail the diff once its command is blank
+        if (m[1]) args.push('-c', `${m[1]}.required=false`);
+    }
+    return args;
+}
+
+const NO_TOOLS = { diff: ['--no-ext-diff', '--no-textconv'], log: ['--no-ext-diff', '--no-textconv', '--no-show-signature'] };
+
+/** spawnSync('git', args) in `root`, hardened as above; diff and log never run external tools. */
+export function gitSync(root, args, opts = {}) {
+    const sub = NO_TOOLS[args[0]] ? [args[0], ...NO_TOOLS[args[0]], ...args.slice(1)] : args;
+    return spawnSync('git', [...hardening(root), ...sub], { cwd: root, encoding: 'utf8', ...opts });
+}

package/src/util/paths.mjs

@@ -6,7 +6,12 @@ export const DATA_DIR_NAME = '.graph-indexer';
 
 export function dataDir(root) {
     const dir = path.join(root, DATA_DIR_NAME);
-    fs.mkdirSync(dir, { recursive: true });
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // a .graph-indexer the repository committed as a link would put the index (excerpts of the
+    // source) wherever it points
+    const st = fs.lstatSync(dir);
+    if (!st.isDirectory()) throw new Error(`${dir} is not a directory (a symbolic link?); remove it and run again`);
+    if ((st.mode & 0o077) !== 0) { try { fs.chmodSync(dir, 0o700); } catch { /* read-only */ } }
     const gi = path.join(dir, '.gitignore');
     if (!fs.existsSync(gi)) { try { fs.writeFileSync(gi, '*\n'); } catch { /* read-only */ } }
     return dir;
@@ -22,3 +27,37 @@ export function findRepoRoot(start) {
         dir = parent;
     }
 }
+
+const realRoots = new Map();
+
+/**
+ * `rel` names a file inside the repository once `..` and symlinks are resolved, so a tool target
+ * like `../../etc/hosts` or a tracked link to ~/.ssh/… is never read. The index's own data and git's
+ * internals are not served either.
+ */
+export function withinRoot(root, rel) {
+    let realRoot = realRoots.get(root);
+    if (!realRoot) { try { realRoot = fs.realpathSync(root); } catch { realRoot = path.resolve(root); } realRoots.set(root, realRoot); }
+    let real;
+    try { real = fs.realpathSync(path.join(root, rel)); } catch { return false; }
+    if (real !== realRoot && !real.startsWith(realRoot + path.sep)) return false;
+    const top = path.relative(realRoot, real).split(path.sep)[0];
+    return top !== '.git' && top !== DATA_DIR_NAME;
+}
+
+/** A git revision given by a caller: never an option (`--output=…`), whitespace or NUL. */
+export const isRevision = (s) => typeof s === 'string' && s.length > 0 && s.length <= 256 && !s.startsWith('-') && !/[\s\0]/.test(s);
+
+/**
+ * A small regular file of the repository (a manifest, a config), or null: never a device, a FIFO,
+ * a file larger than `maxBytes` or a link out of the root — a `tsconfig.json` linked to /dev/zero
+ * would otherwise hang the indexer.
+ */
+export function readRepoFile(root, rel, maxBytes = 2_000_000) {
+    if (!withinRoot(root, rel)) return null;
+    try {
+        const abs = path.join(root, rel);
+        const st = fs.statSync(abs);
+        return st.isFile() && st.size <= maxBytes ? fs.readFileSync(abs, 'utf8') : null;
+    } catch { return null; }
+}

package/src/util/regex.mjs

@@ -0,0 +1,2 @@
+/** A string as a literal inside a regular expression: every metacharacter escaped. */
+export const escapeRegExp = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');