graph-indexer 3.1.0 → 3.1.1

package/CHANGELOG.md

@@ -4,6 +4,58 @@ All notable changes to graph-indexer are documented here. Dates are in YYYY-MM-D
 
 ---
 
+## [3.1.1] — 2026-11-13
+
+A security release. Upgrading is recommended for everyone; nothing else changes. Most of these need a
+repository that was copied together with its `.git` directory (an archive, a shared folder) or that
+commits symbolic links; one needs only a hostile tool call.
+
+### Security
+
+- **git runs nothing the indexed repository's config names, on every call.** Two git calls bypassed
+  the hardening added in 3.0.1, so a repository with `core.fsmonitor` set in its `.git/config` ran
+  that command: the post-tool hook's `git status` (after every shell command the agent ran) and the
+  `models` view's `git ls-files`. Every git call now goes through one hardened function.
+- **Filter and diff drivers named with `=` are switched off too.** git splits a `-c` argument at the
+  first `=`, so the override for a driver named `x=y` set another key and left its clean filter or
+  textconv command on, running it from `check_changes`, `change_impact` and the hook. The overrides
+  now go through git's environment (`GIT_CONFIG_COUNT`), which holds any name; a git older than 2.31
+  is not run at all on such a repository. git no longer descends into submodules, whose own config
+  the overrides do not cover.
+- **`.git/` is not served under another letter case.** On a case-insensitive file system (macOS,
+  Windows) `read_code ".GIT/config"` read `.git/config`, which can hold credentials in remote URLs.
+- **Nothing is written through links committed inside `.graph-indexer/`.** A repository that
+  shipped `.graph-indexer/index.db-wal` or `resident.started` as a link to `~/.zshrc` had that file
+  overwritten. Links inside the directory are now removed before anything is written, and an index
+  committed to the repository is not opened (the database also runs in SQLite's defensive mode with
+  `trusted_schema` off).
+- **Files under a linked directory stay out.** A tracked `link/secret.ts`, where `link` points
+  outside the repository, was indexed and served, because only the last component of a path was
+  checked. Every component is now resolved, and devices and FIFOs are skipped instead of read.
+- **`Cargo.toml`, `svelte.config.*`, `pom.xml`, `build.gradle`, `.gitignore`, Prisma schemas and
+  migrations are read only as small regular files inside the repository**, like `package.json` and
+  `tsconfig.json` already were: a `Cargo.toml` linked to `/dev/zero` grew the indexer past 5 GB, and a
+  `schema.prisma` linked to a file elsewhere was read and shown.
+- **`find_files` stops a glob that backtracks catastrophically** (`*a*a*a*a*a*a*a*a*b`: 97 s on one
+  file name) after 5 s, as `search_text` does for regular expressions.
+- **`.gitignore` patterns are matched without backtracking** (repositories without git), and
+  `search_text` annotates its matches in linear time and keeps at most 50,000 of them: 10,000 matches
+  in one file took 14 s, now about 1 s.
+- **Tool arguments are held to their schema's bounds** (`depth`, `limit`, list lengths) whatever
+  the MCP client sends.
+- **Windows: nothing named `git`, `npx` or `graph-indexer` is run from the repository.** A bare
+  command is looked up in the working directory first there, so a committed `git.exe` or `npx.cmd`
+  ran. git is looked up on PATH only; the Claude Code and OpenCode plugins start npx from the home
+  directory; `init` writes npx's absolute path; and `init` no longer takes a `graph-indexer` found
+  through a relative or `node_modules/.bin` PATH entry.
+- **Windows: another user cannot answer for the resident.** The named pipe's name now carries a
+  random id kept in `.graph-indexer/`, so it cannot be created first by someone who only knows the
+  repository's path.
+- `SECURITY.md` now states the one network access there is (the opt-in, hash-checked
+  `semantic install`) and lists every file read outside the index.
+
+---
+
 ## [3.1.0] — 2026-11-08
 
 ### Added

package/SECURITY.md

@@ -25,32 +25,43 @@ are not maintained; please upgrade to the latest version.
 
 graph-indexer is a local developer tool. Its threat model follows from a few deliberate choices:
 
-- **No network.** graph-indexer makes no outbound connections: no telemetry, no model
-  downloads, no grammar installs. The tree-sitter runtime and all grammars ship inside the
-  package as WebAssembly (versions and SHA-256 checksums in `vendor/grammars/manifest.json`),
-  so there is no install-time or first-run download and no native build step.
+- **No network.** graph-indexer makes no outbound connections: no telemetry, no grammar
+  installs. The tree-sitter runtime and all grammars ship inside the package as WebAssembly
+  (versions and SHA-256 checksums in `vendor/grammars/manifest.json`), so there is no install-time
+  or first-run download and no native build step. The one exception is explicit and opt-in:
+  `graph-indexer semantic install` downloads the optional embedding model from huggingface.co at a
+  pinned revision and installs it only if every file's SHA-256 matches the digest in the source.
 - **No dependencies.** The package has no npm dependencies; it uses only Node.js built-ins
   (`node:sqlite`, `node:fs`, `node:child_process`, …) and the vendored WebAssembly runtime.
 - **No code execution.** Source files are parsed into syntax trees; the indexed code is never
   imported, evaluated or run. The only subprocesses are read-only git commands
-  (`git rev-parse`, `git ls-files`, `git diff`, `git log`, `git show`) run in the indexed repository
-  with fixed arguments. The only tool input they take is the `base` revision of `check_changes`,
-  which is refused when git could read it as an option. Every git call switches off what the
-  repository's own git config could run: `core.fsmonitor`, hooks, signature verification,
-  clean/smudge/process filters, `diff.external` and textconv drivers.
+  (`git rev-parse`, `git ls-files`, `git status`, `git diff`, `git log`, `git show`) run in the
+  indexed repository with fixed arguments, all through one function (`src/util/git.mjs`). The only
+  tool input they take is the `base` revision of `check_changes`, which is refused when git could
+  read it as an option. Every git call switches off what the repository's own git config could
+  run: `core.fsmonitor`, hooks, signature verification, clean/smudge/process filters, `diff.external`
+  and textconv drivers. The overrides are passed through git's environment (`GIT_CONFIG_COUNT`), which
+  holds any driver name verbatim, including one containing `=`; with a git older than 2.31 that
+  cannot, a repository naming such a driver gets no git call at all. git does not descend into
+  submodules (`--ignore-submodules=all`), whose own config the overrides do not cover. On Windows,
+  `git` and `npx` are looked up on PATH only, never in the repository (the working directory).
 - **No code from the repository through npx.** Every `npx` command graph-indexer runs or writes into
   an agent's configuration passes `--prefix`, so a `node_modules/graph-indexer` that the repository
   ships is never run in place of the published package.
 - **Stays inside the repository.** Only files listed by git (or found by a `.gitignore`-aware
-  walk) under the repository root are indexed. Symlinks are followed only when their target
-  resolves inside the repository, so a link to a file elsewhere on the machine is never read,
-  indexed or served. Paths given to the tools (`read_code "file.ts:42"`, `outline`,
-  `change_impact`) are resolved (`..` and symbolic links) and must stay inside the repository;
-  `.git/` and `.graph-indexer/` are never served. Manifests (`package.json`, `tsconfig.json`,
-  `go.mod`) are read only as small regular files inside the repository.
-- **Bounded work.** A regular expression given to `search_text` runs under a 5 s budget, and a file
-  whose syntax makes the structural queries super-linear is given up after 15 s, so neither can
-  block the server.
+  walk) under the repository root are indexed. Every component of a file's path is resolved, so
+  neither a symbolic link to a file elsewhere on the machine nor a file under a linked directory is
+  read, indexed or served; devices and FIFOs are skipped. Paths given to the tools
+  (`read_code "file.ts:42"`, `outline`, `change_impact`) are resolved the same way and must stay
+  inside the repository; `.git/` and `.graph-indexer/` are never served, in any letter case on a
+  case-insensitive file system. Manifests and other files read outside the index (`package.json`,
+  `tsconfig.json`, `go.mod`, `Cargo.toml`, `svelte.config.*`, `pom.xml`, `build.gradle`, `.gitignore`,
+  Prisma schemas, migrations) are read only as small regular files inside the repository.
+- **Bounded work.** A regular expression given to `search_text` and a glob given to `find_files`
+  run under a 5 s budget, `.gitignore` patterns are matched without backtracking, `search_text`
+  annotates at most 50,000 matching lines, and a file whose syntax makes the structural queries
+  super-linear is given up after 15 s, so none of them can block the server. Tool arguments are held
+  to the bounds their schema declares (depths, limits, list lengths) whatever the client sends.
 - **Read-only tools.** All MCP tools are read-only (`readOnlyHint: true`) and never modify
   the repository.
 - **stdio transport.** The MCP server talks to the local client over stdin/stdout. It does not
@@ -59,10 +70,14 @@ graph-indexer is a local developer tool. Its threat model follows from a few del
   hooks, also answers hook and CLI queries over a Unix domain socket (a named pipe on Windows),
   never TCP. The socket lives in `<repo>/.graph-indexer/` with mode 0600; when that path is too
   long for a socket, in a per-user directory in the temp dir with mode 0700 whose owner and mode
-  both sides check before using it. It answers the same read-only queries as the CLI.
+  both sides check before using it. On Windows the pipe's name carries a random id that each
+  resident writes to `.graph-indexer/`, so another user of the machine cannot create the pipe first
+  and answer in its place. It answers the same read-only queries as the CLI.
   `GRAPH_INDEXER_RESIDENT=0` disables it.
 - **Local artifacts.** The index is a SQLite database in `<repo>/.graph-indexer/` (git-ignored by
-  `init`, mode 0700; a `.graph-indexer` that is a symbolic link is refused). It contains excerpts of your source code — treat it with the same sensitivity as the
+  `init`, mode 0700; a `.graph-indexer` that is a symbolic link is refused, symbolic links inside it
+  are removed before anything is written there, and an index committed to the repository is not
+  opened). It contains excerpts of your source code — treat it with the same sensitivity as the
   repository itself and do not commit or share it. Deleting the directory is always safe; it is
   rebuilt on the next run.
 

package/integrations/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "graph-indexer",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Live code graph for Claude Code: exact references, structural grep, change impact and a post-edit check, from a local index with no model or network.",
   "author": { "name": "MaquinaTech", "url": "https://github.com/MaquinaTech" },
   "homepage": "https://github.com/MaquinaTech/graph-indexer",

package/integrations/claude-code/skills/setup/SKILL.md

@@ -12,13 +12,13 @@ allow plugins to start local programs, so the user must approve this step.
 2. Ask the user to confirm, then run from the repository root:
 
    ```bash
-   claude mcp add graph-indexer -- npx -y --prefix / graph-indexer@3.1.0 serve
+   claude mcp add graph-indexer -- npx -y --prefix / graph-indexer@3.1.1 serve
    ```
 
    `--prefix /` makes npx run only the published package, never a copy shipped inside the repository.
    The version is pinned on purpose: update it by hand when a newer graph-indexer is released.
 
-3. Optional, with the user's consent: `npx -y --prefix / graph-indexer@3.1.0 init --hooks` also writes the
+3. Optional, with the user's consent: `npx -y --prefix / graph-indexer@3.1.1 init --hooks` also writes the
    Claude Code hooks (an edit check after each edit, grep disambiguation) to `.claude/settings.json`.
 4. Restart Claude Code, or run `/mcp`, and confirm `graph-indexer` is connected.
 

package/integrations/claude-code-local/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "graph-indexer",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Live code graph for Claude Code: exact references, structural grep, change impact and a post-edit check, from a local index with no model or network.",
   "author": { "name": "MaquinaTech", "url": "https://github.com/MaquinaTech" },
   "homepage": "https://github.com/MaquinaTech/graph-indexer",

package/integrations/claude-code-local/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "graph-indexer": {
       "command": "npx",
-      "args": ["-y", "--prefix", "/", "graph-indexer@3.1.0", "serve"]
+      "args": ["-y", "--prefix", "/", "graph-indexer@3.1.1", "serve"]
     }
   }
 }

package/integrations/claude-code-local/README.md

@@ -3,7 +3,7 @@
 This folder is the plugin with everything wired in: the MCP server (`.mcp.json`), the hooks
 (`hooks/`) and the `code-structure` sub-agent. The plugin directory lists only plugins made of
 Markdown and JSON (see `../claude-code`), so this one is not listed there. To use it, copy the
-folder or point a local marketplace at it. `npx -y --prefix / graph-indexer@3.1.0 init --hooks`
+folder or point a local marketplace at it. `npx -y --prefix / graph-indexer@3.1.1 init --hooks`
 gives the same result without a plugin.
 
 Each release must update the version in `.mcp.json`, `hooks/gi-hook.mjs` and

package/integrations/claude-code-local/hooks/gi-hook.mjs

@@ -21,7 +21,7 @@ import { pathToFileURL } from 'node:url';
 
 const PROTOCOL = 1;
 // the exact release this plugin version runs through npx (never a range): keep it equal to package.json's version
-export const VERSION = '3.1.0';
+export const VERSION = '3.1.1';
 const WIN = process.platform === 'win32';
 
 export function findRepoRoot(start) {
@@ -37,7 +37,13 @@ export function findRepoRoot(start) {
 export function socketPath(root) {
     const abs = path.resolve(root);
     const hash = crypto.createHash('sha256').update(abs).digest('hex').slice(0, 16);
-    if (WIN) return `\\\\.\\pipe\\graph-indexer-${hash}`;
+    // a pipe name anyone could compute would let another user of the machine create it first and
+    // answer as the resident: the name carries a random id kept in the private data directory
+    if (WIN) {
+        let id = '';
+        try { id = fs.readFileSync(path.join(abs, '.graph-indexer', 'resident.pipe-id'), 'utf8').trim(); } catch { /* no resident yet */ }
+        return /^[0-9a-f]{32}$/.test(id) ? `\\\\.\\pipe\\graph-indexer-${hash}-${id}` : null;
+    }
     const inRepo = path.join(abs, '.graph-indexer', 'resident.sock');
     if (Buffer.byteLength(inRepo) <= 100) return inRepo;
     return path.join(os.tmpdir(), `graph-indexer-${process.getuid?.() ?? 'user'}`, `${hash}.sock`);
@@ -57,7 +63,7 @@ function trusted(file, root) {
 /** The resident's answer ({ out }) or null. `any: true`: this client has no logic of its own to match. */
 function ask(root, request, totalMs) {
     const file = socketPath(root);
-    if (!trusted(file, root)) return Promise.resolve(null);
+    if (!file || !trusted(file, root)) return Promise.resolve(null);
     return new Promise((resolve) => {
         let done = false, buf = '';
         const sock = net.createConnection(file);
@@ -91,8 +97,11 @@ async function main() {
     // no resident yet: the full hook through npx (it starts one for the next calls); --prefix keeps
     // npx from running a graph-indexer that the repository ships in its own node_modules
     // (on Windows npx.cmd needs a shell, so the home directory is quoted for cmd.exe)
-    const home = WIN ? `"${os.homedir()}"` : os.homedir();
-    const child = spawn(WIN ? 'npx.cmd' : 'npx', ['-y', '--prefix', home, `graph-indexer@${VERSION}`, 'hook', event], { stdio: ['pipe', 'inherit', 'ignore'], shell: WIN });
+    // It runs from the home directory with the repository passed explicitly: cmd.exe looks for
+    // npx.cmd in the working directory first, which here would be the repository's.
+    if (WIN && /["%\r\n]/.test(root)) return;
+    const q = (a) => (WIN ? `"${a}"` : a);
+    const child = spawn(WIN ? 'npx.cmd' : 'npx', ['-y', '--prefix', q(os.homedir()), `graph-indexer@${VERSION}`, 'hook', event, '--repo', q(root)], { cwd: os.homedir(), stdio: ['pipe', 'inherit', 'ignore'], shell: WIN });
     child.on('error', () => { /* fail open */ });
     child.stdin.on('error', () => { /* fail open */ });
     child.stdin.end(raw);

package/integrations/opencode/graph-indexer.js

@@ -39,7 +39,13 @@ function findRepoRoot(start) {
 function socketPath(root) {
     const abs = path.resolve(root);
     const hash = crypto.createHash('sha256').update(abs).digest('hex').slice(0, 16);
-    if (WIN) return `\\\\.\\pipe\\graph-indexer-${hash}`;
+    // a pipe name anyone could compute would let another user of the machine create it first and
+    // answer as the resident: the name carries a random id kept in the private data directory
+    if (WIN) {
+        let id = '';
+        try { id = fs.readFileSync(path.join(abs, '.graph-indexer', 'resident.pipe-id'), 'utf8').trim(); } catch { /* no resident yet */ }
+        return /^[0-9a-f]{32}$/.test(id) ? `\\\\.\\pipe\\graph-indexer-${hash}-${id}` : null;
+    }
     const inRepo = path.join(abs, '.graph-indexer', 'resident.sock');
     if (Buffer.byteLength(inRepo) <= 100) return inRepo;
     return path.join(os.tmpdir(), `graph-indexer-${process.getuid?.() ?? 'user'}`, `${hash}.sock`);
@@ -58,7 +64,7 @@ function trusted(file, root) {
 
 function ask(root, request, totalMs) {
     const file = socketPath(root);
-    if (!trusted(file, root)) return Promise.resolve(null);
+    if (!file || !trusted(file, root)) return Promise.resolve(null);
     return new Promise((resolve) => {
         let done = false, buf = '';
         const sock = net.createConnection(file);
@@ -112,7 +118,8 @@ export const GraphIndexer = async ({ directory, worktree } = {}) => {
                         // every argument, and give up on one that a quote cannot hold
                         const args = [...DAEMON.slice(1), '--repo', root];
                         if (WIN && args.some(a => /["%\r\n]/.test(a))) return;
-                        const child = spawn(DAEMON[0], WIN ? args.map(a => `"${a}"`) : args, { detached: true, stdio: 'ignore', windowsHide: true, shell: WIN });
+                        // from the home directory: cmd.exe would look for npx.cmd in the repository first
+                        const child = spawn(DAEMON[0], WIN ? args.map(a => `"${a}"`) : args, { cwd: os.homedir(), detached: true, stdio: 'ignore', windowsHide: true, shell: WIN });
                         child.on('error', () => { /* optional */ });
                         child.unref();
                     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "graph-indexer",
-    "version": "3.1.0",
+    "version": "3.1.1",
     "description": "Live code graph and search for AI coding agents over MCP: tree-sitter (WASM) symbols, scope/import/type-aware references, call graphs, change impact and hybrid search — local, zero-dependency, no native builds.",
     "type": "module",
     "main": "src/query/intel.mjs",

package/src/cli/hook.mjs

@@ -29,9 +29,10 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { findRepoRoot, dataDir, DATA_DIR_NAME, readRepoFile } from '../util/paths.mjs';
+import { gitSync } from '../util/git.mjs';
 import { codeSpecForPath as specForPath } from '../parse/languages.mjs'; // hooks report on code files only
 
 const MAX_CONTEXT = 1500;
@@ -333,7 +334,8 @@ async function afterRead(root, input, state, crawling, acquire) {
  */
 function shellEdits(root, state) {
     let r;
-    try { r = spawnSync('git', ['-C', root, 'status', '--porcelain', '--untracked-files=all', '-z'], { encoding: 'utf8', timeout: 1500 }); } catch { return []; }
+    // hardened (gitSync): a repository's core.fsmonitor or filters would otherwise run
+    try { r = gitSync(root, ['status', '--porcelain', '--untracked-files=all', '-z'], { timeout: 1500 }); } catch { return []; }
     if (r.status !== 0 || typeof r.stdout !== 'string') return [];
     const seen = state.st.mtimes ??= {};
     const changed = [];

package/src/cli/init.mjs

@@ -58,13 +58,23 @@ function readJson(p) {
 // (code the repository ships) instead of the published package
 const NPX_ARGS = ['-y', '--prefix', '/', 'graph-indexer@3'];
 
+/**
+ * npx, by absolute path on Windows: there a bare `npx` is looked up in the working directory (the
+ * repository) before PATH, so an `npx.cmd`/`npx.exe` the repository ships would run instead.
+ */
+function npxCommand() {
+    if (process.platform !== 'win32') return 'npx';
+    const f = path.join(path.dirname(process.execPath), 'npx.cmd');
+    return fs.existsSync(f) ? f : 'npx';
+}
+
 function serverEntry(agent, { local }) {
     const here = path.dirname(fileURLToPath(import.meta.url));
     const bin = path.resolve(here, '../../bin/graph-indexer.mjs');
     const repoArgs = agent.workspaceVar ? ['--repo', agent.workspaceVar] : [];
     const base = local
         ? { command: process.execPath, args: [bin, 'serve', ...repoArgs] }
-        : { command: 'npx', args: [...NPX_ARGS, 'serve', ...repoArgs] };
+        : { command: npxCommand(), args: [...NPX_ARGS, 'serve', ...repoArgs] };
     if (agent.opencode) return { type: 'local', command: [base.command, ...base.args], enabled: true };
     if (agent.zed) return { ...base, env: {} };
     return agent.vscode ? { type: 'stdio', ...base } : base;
@@ -110,7 +120,9 @@ function upsertBlock(repo, file, dryRun) {
 /** An installed `graph-indexer` executable on PATH, if any (hooks start in ~0.1 s instead of npx's ~1 s). */
 function installedBin() {
     for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
-        if (!dir) continue;
+        // only absolute entries, never a project's own bin directory: a PATH with `.` or
+        // `node_modules/.bin` would otherwise find a graph-indexer the repository ships
+        if (!dir || !path.isAbsolute(dir) || /(^|[\\/])node_modules[\\/]\.bin[\\/]?$/.test(dir)) continue;
         const f = path.join(dir, process.platform === 'win32' ? 'graph-indexer.cmd' : 'graph-indexer');
         try { if (fs.statSync(f).isFile()) return f; } catch { /* not here */ }
     }
@@ -123,7 +135,7 @@ function cliCommand(local) {
     const bin = path.resolve(here, '../../bin/graph-indexer.mjs');
     if (local) return `${JSON.stringify(process.execPath)} ${JSON.stringify(bin)}`;
     const installed = installedBin();
-    return installed ? JSON.stringify(installed) : ['npx', ...NPX_ARGS].join(' ');
+    return installed ? JSON.stringify(installed) : [npxCommand() === 'npx' ? 'npx' : JSON.stringify(npxCommand()), ...NPX_ARGS].join(' ');
 }
 
 /** The command that starts graph-indexer, as an argv array (for the OpenCode/Kilo Code plugin). */
@@ -131,7 +143,7 @@ function cliArgv(local) {
     const here = path.dirname(fileURLToPath(import.meta.url));
     if (local) return [process.execPath, path.resolve(here, '../../bin/graph-indexer.mjs')];
     const installed = installedBin();
-    return installed ? [installed] : ['npx', ...NPX_ARGS];
+    return installed ? [installed] : [npxCommand(), ...NPX_ARGS];
 }
 
 /**

package/src/cli/resident.mjs

@@ -37,7 +37,13 @@ const WIN = process.platform === 'win32';
 export function socketPath(root) {
     const abs = path.resolve(root);
     const hash = crypto.createHash('sha256').update(abs).digest('hex').slice(0, 16);
-    if (WIN) return `\\\\.\\pipe\\graph-indexer-${hash}`;
+    // a pipe name anyone could compute would let another user of the machine create it first and
+    // answer as the resident: the name carries a random id kept in the private data directory
+    if (WIN) {
+        let id = '';
+        try { id = fs.readFileSync(path.join(abs, '.graph-indexer', 'resident.pipe-id'), 'utf8').trim(); } catch { /* no resident yet */ }
+        return /^[0-9a-f]{32}$/.test(id) ? `\\\\.\\pipe\\graph-indexer-${hash}-${id}` : null;
+    }
     const inRepo = path.join(abs, DATA_DIR_NAME, 'resident.sock');
     // Unix socket paths are limited to 104–108 bytes
     if (Buffer.byteLength(inRepo) <= 100) return inRepo;
@@ -74,7 +80,7 @@ export const residentRequired = () => process.env.GRAPH_INDEXER_RESIDENT === 're
 export function askResident(root, request, { version, connectMs = 250, totalMs = 5000 } = {}) {
     if (disabled()) return Promise.resolve(null);
     const file = socketPath(root);
-    if (!WIN && (!ownSocket(file) || !privateDir(path.dirname(file), root))) return Promise.resolve(null);
+    if (!file || (!WIN && (!ownSocket(file) || !privateDir(path.dirname(file), root)))) return Promise.resolve(null);
     return new Promise((resolve) => {
         let done = false, connected = false, buf = '';
         const sock = net.createConnection(file);
@@ -114,7 +120,7 @@ export function askResident(root, request, { version, connectMs = 250, totalMs =
  */
 export async function startResident({ root, version, handle, log = () => {}, idleMs = 0, onIdle = null, wanted = () => true }) {
     if (disabled()) return null;
-    const file = socketPath(root);
+    let file = socketPath(root);
     if (!WIN) {
         const dir = path.dirname(file);
         try { fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { /* checked below */ }
@@ -123,6 +129,15 @@ export async function startResident({ root, version, handle, log = () => {}, idl
     // another resident may serve this repository already; a dead one leaves its socket file behind
     if (await askResident(root, { op: 'ping' }, { version, connectMs: 300, totalMs: 1500 })) return null;
     if (!WIN) { try { fs.unlinkSync(file); } catch { /* none */ } }
+    else {
+        // a fresh pipe id for this resident (see socketPath)
+        const idFile = path.join(path.resolve(root), DATA_DIR_NAME, 'resident.pipe-id');
+        try {
+            fs.mkdirSync(path.dirname(idFile), { recursive: true });
+            fs.writeFileSync(idFile, crypto.randomBytes(16).toString('hex'), { mode: 0o600 });
+        } catch (e) { log(`resident: cannot write ${idFile} (${e.message}); not listening`); return null; }
+        file = socketPath(root);
+    }
 
     let last = Date.now();
     const server = net.createServer((sock) => {

package/src/index/discover.mjs

@@ -7,6 +7,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { gitSync } from '../util/git.mjs';
+import { readRepoFile, withinRoot } from '../util/paths.mjs';
 import { specForPath } from '../parse/languages.mjs';
 
 export const MAX_FILE_BYTES = 1_500_000;
@@ -34,26 +35,56 @@ function gitListFiles(root) {
     return r.stdout.split('\0').filter(Boolean);
 }
 
+/**
+ * A .gitignore pattern as a matcher that cannot backtrack: `*` (within a name), `?`, `**` (across
+ * names), anything else literal. A regular expression of many stars (`*a*a*a*a*a*b`) takes seconds
+ * per long path; this keeps the set of positions reachable after each token, so a match costs
+ * pattern length × path length. Unanchored, it may start at any name; it must end at the end of
+ * the path or at a `/` (a directory and everything under it).
+ */
+function globMatcher(glob, anchored) {
+    const tokens = [];
+    for (let i = 0; i < glob.length; i++) {
+        if (glob[i] === '*') {
+            let j = i; while (glob[j + 1] === '*') j++;
+            tokens.push(j > i ? '**' : '*'); i = j;
+        } else tokens.push(glob[i] === '?' ? '?' : { c: glob[i] });
+    }
+    return (s) => {
+        const n = s.length;
+        let cur = new Uint8Array(n + 1);
+        cur[0] = 1;
+        if (!anchored) for (let k = 0; k < n; k++) if (s[k] === '/') cur[k + 1] = 1;
+        for (const t of tokens) {
+            const next = new Uint8Array(n + 1);
+            let any = false;
+            if (t === '**') { let on = 0; for (let p = 0; p <= n; p++) { on |= cur[p]; next[p] = on; any ||= !!on; } }
+            else if (t === '*') { let on = 0; for (let p = 0; p <= n; p++) { on |= cur[p]; next[p] = on; any ||= !!on; if (s[p] === '/') on = 0; } }
+            else if (t === '?') { for (let p = 0; p < n; p++) if (cur[p] && s[p] !== '/') { next[p + 1] = 1; any = true; } }
+            else { for (let p = 0; p < n; p++) if (cur[p] && s[p] === t.c) { next[p + 1] = 1; any = true; } }
+            if (!any) return false;
+            cur = next;
+        }
+        for (let p = 0; p <= n; p++) if (cur[p] && (p === n || s[p] === '/')) return true;
+        return false;
+    };
+}
+
 /** Minimal .gitignore → predicate (used only outside git repos). */
 function loadGitignore(root) {
     const rules = [];
-    try {
-        for (let line of fs.readFileSync(path.join(root, '.gitignore'), 'utf8').split(/\r?\n/)) {
-            line = line.trim();
-            if (!line || line.startsWith('#')) continue;
-            const neg = line.startsWith('!');
-            if (neg) line = line.slice(1);
-            const dirOnly = line.endsWith('/');
-            if (dirOnly) line = line.slice(0, -1);
-            const anchored = line.startsWith('/') || line.includes('/');
-            line = line.replace(/^\//, '');
-            const re = line.split('**').map(seg => seg.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]')).join('.*');
-            rules.push({ neg, re: new RegExp(anchored ? `^${re}(/|$)` : `(^|/)${re}(/|$)`) });
-        }
-    } catch { /* no .gitignore */ }
+    for (let line of (readRepoFile(root, '.gitignore') ?? '').split(/\r?\n/)) {
+        line = line.trim();
+        if (!line || line.startsWith('#')) continue;
+        const neg = line.startsWith('!');
+        if (neg) line = line.slice(1);
+        if (line.endsWith('/')) line = line.slice(0, -1);
+        const anchored = line.startsWith('/') || line.includes('/');
+        rules.push({ neg, test: globMatcher(line.replace(/^\//, ''), anchored) });
+    }
     return (rel) => {
         let ignored = false;
-        for (const r of rules) if (r.re.test(rel)) ignored = !r.neg;
+        for (const r of rules) if (r.test(rel)) ignored = !r.neg;
         return ignored;
     };
 }
@@ -95,28 +126,19 @@ export function discoverFiles(root, opts = {}) {
         viaGit = rels !== null;
     }
     if (!rels) rels = walk(root, loadGitignore(root));
-    const files = rels.map(r => r.replace(/\\/g, '/')).filter(r => isIndexablePath(r, opts) && (!viaGit || insideRoot(root, r)));
+    const files = rels.map(r => r.replace(/\\/g, '/')).filter(r => isIndexablePath(r, opts) && insideRoot(root, r));
     files.sort();
     return { files, viaGit };
 }
 
-const realRoots = new Map();
-
 /**
- * A tracked file must resolve inside the repository: symlinks are followed only when their target
- * stays under the root, so a link to /etc/… or ~/.ssh/… is never read, indexed or served.
+ * A tracked file must resolve inside the repository: every component of its path is resolved, so
+ * neither a link to /etc/… or ~/.ssh/… nor a file under a linked directory (`link/secret.ts` with
+ * `link` → elsewhere, which git lists from its index without looking) is read, indexed or served.
  */
 export function insideRoot(root, rel) {
-    const abs = path.join(root, rel);
-    let st;
-    try { st = fs.lstatSync(abs); } catch { return true; } // vanished: the caller handles deletion
-    if (!st.isSymbolicLink()) return true;
-    let realRoot = realRoots.get(root);
-    if (!realRoot) { try { realRoot = fs.realpathSync(root); } catch { realRoot = root; } realRoots.set(root, realRoot); }
-    try {
-        const target = fs.realpathSync(abs);
-        return target === realRoot || target.startsWith(realRoot + path.sep);
-    } catch { return false; } // dangling link
+    try { fs.lstatSync(path.join(root, rel)); } catch { return true; } // vanished: the caller handles deletion
+    return withinRoot(root, rel);
 }
 
 /** Heuristic: minified / generated content that slipped past the name filters. */

package/src/index/indexer.mjs

@@ -98,7 +98,7 @@ export class Indexer {
         const toParse = [];
         for (const rel of files) {
             const st = safeStat(path.join(this.root, rel));
-            if (!st || st.size > MAX_FILE_BYTES) { if (known.has(rel)) removed.push(rel); continue; }
+            if (!st || !st.isFile() || st.size > MAX_FILE_BYTES) { if (known.has(rel)) removed.push(rel); continue; }
             const k = known.get(rel);
             if (k && k.size === st.size && k.mtime_ms === Math.floor(st.mtimeMs)) continue;
             toParse.push({ rel, st, prev: k ?? null });

package/src/index/modules.mjs

@@ -86,8 +86,7 @@ export class ModuleResolver {
         // .svelte-kit/tsconfig.json that a repository does not carry, so read svelte.config itself
         for (const rel of [...this.#findManifests('svelte.config.js'), ...this.#findManifests('svelte.config.ts')]) {
             const dir = path.posix.dirname(rel), at = (p) => path.posix.normalize(dir === '.' ? p : `${dir}/${p}`);
-            let text = '';
-            try { text = fs.readFileSync(path.join(this.root, rel), 'utf8'); } catch { /* unreadable */ }
+            const text = readRepoFile(this.root, rel) ?? '';
             const lib = /\bfiles\s*:\s*\{[^}]*\blib\s*:\s*['"]([^'"]+)['"]/.exec(text)?.[1] ?? 'src/lib';
             const aliases = [['$lib', lib]];
             const block = /\balias\s*:\s*\{([^}]*)\}/.exec(text)?.[1] ?? '';
@@ -110,8 +109,8 @@ export class ModuleResolver {
         this.rustCrates = new Map();
         this.rustPackages = [];
         for (const rel of this.#findManifests('Cargo.toml')) {
-            let text;
-            try { text = fs.readFileSync(path.join(this.root, rel), 'utf8'); } catch { continue; }
+            const text = readRepoFile(this.root, rel);
+            if (text == null) continue;
             const dir = path.posix.dirname(rel), at = (p) => (dir === '.' ? p : `${dir}/${p}`);
             if (/^\[package\]\s*$/m.test(text)) this.rustPackages.push(dir);
             const table = (name) => { const m = new RegExp(`^\\[${name}\\]\\s*$([\\s\\S]*?)(?=^\\[|(?![\\s\\S]))`, 'm').exec(text); return m?.[1] ?? ''; };

package/src/mcp/server.mjs

@@ -10,6 +10,32 @@
 import readline from 'node:readline';
 import { TOOLS, LEGACY_TOOLS, SERVER_INSTRUCTIONS, callTool } from './tools.mjs';
 
+const MAX_ITEMS = 100;          // an array argument with no maxItems of its own
+const MAX_STRING = 200_000;     // a string argument (an issue pasted as a query is long, not this long)
+
+/**
+ * The arguments as the tool's schema bounds them: numbers clamped to minimum/maximum, arrays cut
+ * to maxItems (else MAX_ITEMS), strings to MAX_STRING. A client is not trusted to respect the schema,
+ * and `depth: 1e9` or ten thousand queries would otherwise hold the server.
+ */
+export function boundArgs(schema, raw) {
+    const args = raw && typeof raw === 'object' && !Array.isArray(raw) ? { ...raw } : {};
+    const props = schema?.properties ?? {};
+    const str = (v) => (typeof v === 'string' && v.length > MAX_STRING ? v.slice(0, MAX_STRING) : v);
+    for (const [k, v] of Object.entries(args)) {
+        const p = props[k];
+        if (typeof v === 'number' && p && (p.type === 'integer' || p.type === 'number')) {
+            let n = Number.isFinite(v) ? v : (p.default ?? p.minimum ?? 0);
+            if (p.type === 'integer') n = Math.trunc(n);
+            if (p.minimum != null) n = Math.max(p.minimum, n);
+            if (p.maximum != null) n = Math.min(p.maximum, n);
+            args[k] = n;
+        } else if (Array.isArray(v)) args[k] = v.slice(0, p?.maxItems ?? MAX_ITEMS).map(str);
+        else args[k] = str(v);
+    }
+    return args;
+}
+
 export const SUPPORTED_VERSIONS = ['2026-07-28', '2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
 const LATEST_HANDSHAKE = '2025-11-25';
 const META_VERSION = 'io.modelcontextprotocol/protocolVersion';
@@ -105,7 +131,7 @@ export class McpServer {
                     const name = params?.name;
                     const tool = TOOLS.find(t => t.name === name) ?? LEGACY_TOOLS.find(t => t.name === name);
                     if (!tool) { this.#error(id, -32602, `Unknown tool: ${name}`); return; }
-                    const args = params?.arguments ?? {};
+                    const args = boundArgs(tool.inputSchema, params?.arguments);
                     const missing = (tool.inputSchema.required ?? []).filter(k => args[k] === undefined || args[k] === null || args[k] === '');
                     if (missing.length) {
                         done({ content: [{ type: 'text', text: `Missing required argument(s): ${missing.join(', ')}.` }], isError: true });

package/src/mcp/tools.mjs

@@ -412,7 +412,7 @@ async function toolText(intel, { pattern, path: p = null, literal = false, ignor
         if (sm.unbound) parts.push(`${sm.unbound} unbound`);
         if (sm.text) parts.push(`${sm.text} in comments/strings/other text`);
         if (sm.nonCode) parts.push(`${sm.nonCode} in non-code files`);
-        out.push(`"${sm.ident}" across all ${r.total} matches: ${parts.join(', ')}.`);
+        out.push(`"${sm.ident}" across ${r.annotated < r.total ? `the first ${r.annotated} of` : 'all'} ${r.total} matches: ${parts.join(', ')}.`);
     }
     out.push(...definitionRescue(intel, pattern, literal, r));
     return out.join('\n');

package/src/parse/lang/sfc.mjs

@@ -14,6 +14,7 @@
  * out, as are HTML elements and the frameworks' own (`<Transition>`, `<svelte:self>`).
  */
 import { typescript } from './ecma.mjs';
+import { escapeRegExp } from '../../util/regex.mjs';
 
 const BUILTIN = new Set(['Transition', 'TransitionGroup', 'KeepAlive', 'Teleport', 'Suspense', 'Component', 'Slot', 'Template', 'RouterView', 'RouterLink']);
 
@@ -65,7 +66,7 @@ function rewrite(source, kind) {
         ranges = ranges.filter(([a, b]) => source.slice(a, b).trim());
     }
     if (!ranges.length) return lines.join('\n');
-    const known = (name) => !BUILTIN.has(name) && new RegExp(`\\b${name}\\b`).test(scriptText);
+    const known = (name) => !BUILTIN.has(name) && new RegExp(`\\b${escapeRegExp(name)}\\b`).test(scriptText);
     const tags = [];
     for (const [a, b] of ranges) {
         const markup = source.slice(a, b).replace(/<!--[\s\S]*?-->/g, (c) => c.replace(/[^\n]/g, ' '));
@@ -115,7 +116,7 @@ const sfc = (id, extensions) => ({
         // its template's tags are that import, so the component itself takes another name
         const root = d.node.tree?.rootNode ?? d.node.parent;
         const imports = (root?.namedChildren ?? []).filter(c => c.type === 'import_statement').map(c => c.text).join('\n');
-        return new RegExp(`\\b${comp}\\b`).test(imports) ? `${comp}Component` : comp;
+        return new RegExp(`\\b${escapeRegExp(comp)}\\b`).test(imports) ? `${comp}Component` : comp;
     },
     rewriteSource: (source) => rewrite(source, id),
     testFile: /(^|\/)(__tests__|tests?|spec|e2e)\//,

package/src/query/injection-spring.mjs

@@ -42,6 +42,7 @@ const ANNOTATION = /@[\w.]+(?:\s*\((?:[^()"]|"[^"]*"|\((?:[^()"]|"[^"]*")*\))*\)
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { readRepoFile } from '../util/paths.mjs';
 
 const BUILD_FILES = ['pom.xml', 'build.gradle', 'build.gradle.kts'];
 
@@ -53,8 +54,7 @@ const strip = (s) => String(s ?? '').trim().replace(/\s+/g, ' ');
 function moduleDeps(root, mods) {
     const info = new Map();
     for (const m of mods) {
-        const dir = path.join(root, m);
-        const pom = read(path.join(dir, 'pom.xml'));
+        const pom = read(root, m, 'pom.xml');
         if (pom != null) {
             let body = pom;
             for (let prev; prev !== body;) { prev = body; body = body.replace(/<!--[\s\S]*?-->/g, ''); }
@@ -63,7 +63,7 @@ function moduleDeps(root, mods) {
             info.set(m, { names: [own, path.posix.basename(m)].filter(Boolean), deps: ds });
             continue;
         }
-        const gradle = read(path.join(dir, 'build.gradle')) ?? read(path.join(dir, 'build.gradle.kts'));
+        const gradle = read(root, m, 'build.gradle') ?? read(root, m, 'build.gradle.kts');
         if (gradle != null) info.set(m, { names: [path.posix.basename(m)], deps: [...gradle.matchAll(/project\(\s*(?:path\s*[:=]\s*)?['"]:?([\w:.-]+)['"]/g)].map(x => x[1].split(':').pop()) });
     }
     const byName = new Map();
@@ -73,7 +73,8 @@ function moduleDeps(root, mods) {
     return out;
 }
 
-function read(f) { try { return fs.readFileSync(f, 'utf8'); } catch { return null; } }
+/** A build file of module `m`: a small regular file inside the repository, or null. */
+const read = (root, m, name) => readRepoFile(root, path.posix.join(m || '.', name));
 
 /** Spring's default bean name: `FooService` → `fooService`, but `URLMapper` stays `URLMapper`. */
 const beanName = (cls) => /^[A-Z]{2}/.test(cls) ? cls : cls[0].toLowerCase() + cls.slice(1);

package/src/query/injection.mjs

@@ -19,6 +19,7 @@
  */
 
 import { collectSpring } from './injection-spring.mjs';
+import { escapeRegExp } from '../util/regex.mjs';
 
 const PROVIDE = /\bprovide\s*:\s*([^,}\n]+?)\s*(?:,|}|$)/;
 const USE = /\buse(Class|Existing|Factory|Value)\s*:\s*([^,}\n]*)/;
@@ -42,7 +43,7 @@ function symRow(intel, id) {
 function stringValue(intel, s) {
     if (s.kind !== 'constant' && s.kind !== 'variable') return null;
     const l = intel.fileLines(s.path)?.[s.start_line - 1] ?? '';
-    return new RegExp(`\\b${s.name}\\s*(?::[^=]+)?=\\s*(['"\`])([^'"\`]*)\\1\\s*;?\\s*$`).exec(l)?.[2] ?? null;
+    return new RegExp(`\\b${escapeRegExp(s.name)}\\s*(?::[^=]+)?=\\s*(['"\`])([^'"\`]*)\\1\\s*;?\\s*$`).exec(l)?.[2] ?? null;
 }
 
 /**

package/src/query/intel.mjs

@@ -12,7 +12,7 @@ import { Indexer } from '../index/indexer.mjs';
 import { SearchEngine } from '../search/search.mjs';
 import { computeCentrality, loadGraph } from '../index/graph.mjs';
 import { confidenceLabel } from '../index/resolver.mjs';
-import { dataDir, withinRoot, isRevision } from '../util/paths.mjs';
+import { dataDir, withinRoot, isRevision, DATA_DIR_NAME } from '../util/paths.mjs';
 import { isConstructor } from '../parse/languages.mjs';
 import { sigArity } from '../parse/arity.mjs';
 import { escapeRegExp } from '../util/regex.mjs';
@@ -27,6 +27,7 @@ const EXAMPLE_PATH = /(^|\/)(docs?_src|docs?|examples?|samples?|demos?|tutorials
 export class CodeIntel {
     constructor({ root, dbPath = null, log = () => {}, watch = false }) {
         this.root = path.resolve(root);
+        this.ownDb = dbPath == null;
         this.dbPath = dbPath ?? path.join(dataDir(this.root), 'index.db');
         this.log = log;
         this.watchEnabled = watch;
@@ -49,6 +50,13 @@ export class CodeIntel {
      * MCP server so the first tool call never times out on a large repository.
      */
     async open({ onProgress = null, background = false } = {}) {
+        // an index the repository ships (a crafted index.db, its -wal) is never opened: it was not
+        // built here and would be answered from as if it had been
+        if (this.ownDb) {
+            const r = gitSync(this.root, ['ls-files', '-z', '--', DATA_DIR_NAME]);
+            const tracked = r.status === 0 ? r.stdout.split('\0').filter(Boolean) : [];
+            if (tracked.length) throw new Error(`${DATA_DIR_NAME}/ is committed to this repository (${tracked.length} file${tracked.length === 1 ? '' : 's'}); graph-indexer does not use an index it did not build. Remove it from the repository (git rm -r --cached ${DATA_DIR_NAME}) and run again.`);
+        }
         this.store = new Store(this.dbPath);
         this.ix = new Indexer({ root: this.root, store: this.store, log: this.log });
         this.ix.load();

package/src/query/orm.mjs

@@ -28,7 +28,8 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
+import { gitSync } from '../util/git.mjs';
+import { readRepoFile } from '../util/paths.mjs';
 
 const PRISMA_OPS = 'findUnique|findUniqueOrThrow|findFirst|findFirstOrThrow|findMany|create|createMany|createManyAndReturn|update|updateMany|updateManyAndReturn|upsert|delete|deleteMany|count|aggregate|groupBy';
 const PRISMA_CALL = new RegExp(`\\b(prisma\\w*|\\w*Prisma|db|tx|trx|client|transaction)\\s*\\.\\s*([a-z]\\w*)\\s*\\.\\s*(${PRISMA_OPS})\\s*[(<]`, 'g');
@@ -45,7 +46,7 @@ const decorators = (s) => { try { return JSON.parse(s.decorators || '[]'); } cat
 
 /** Repository files matching a test, indexed or not (`*.prisma`, migration `.sql`): git's list, else a bounded walk. */
 function repoFiles(root, test) {
-    const r = spawnSync('git', ['-C', root, 'ls-files', '-z', '--cached', '--others', '--exclude-standard'], { encoding: 'utf8', timeout: 5000, maxBuffer: 64 << 20 });
+    const r = gitSync(root, ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], { timeout: 5000, maxBuffer: 64 << 20 });
     if (r.status === 0 && r.stdout) return r.stdout.split('\0').filter(f => f && test(f));
     const out = [];
     const walk = (dir, depth) => {
@@ -65,7 +66,8 @@ function repoFiles(root, test) {
 function readLines(intel, rel) {
     const l = intel.fileLines(rel);
     if (l) return l;
-    try { return fs.readFileSync(path.join(intel.root, rel), 'utf8').split(/\r?\n/); } catch { return null; }
+    // not indexed (a .prisma file, a migration): still only a regular file inside the repository
+    return readRepoFile(intel.root, rel)?.split(/\r?\n/) ?? null;
 }
 
 /** Prisma models of every `.prisma` file. */

package/src/query/textsearch.mjs

@@ -15,12 +15,14 @@ const MAX_FILE_BYTES = 1_500_000;
 // a caller's pattern gets this much matching time per search (reading files does not count): one
 // with catastrophic backtracking (`(a+)+$`) is stopped instead of blocking the server
 const REGEX_BUDGET_MS = 5000;
+const MAX_KEPT = 50_000;
 const SCAN = new vm.Script(`(() => {
     if (!re.test(text)) return null;
     const lines = text.split(/\\r?\\n/), hits = [];
     for (let i = 0; i < lines.length; i++) if (re.test(lines[i])) hits.push(i);
     return { lines, hits };
 })()`);
+const GLOB_FILTER = new vm.Script(`paths.filter(p => re.test(onName ? p.slice(p.lastIndexOf('/') + 1) : p))`);
 const SKIP_DIRS = /(^|\/)(node_modules|\.git|\.graph-indexer|dist|build|out|target|coverage|__pycache__|\.venv|venv|\.next|\.nuxt|\.cache|vendor)\//;
 const EXAMPLE_PATH = /(^|\/)(docs?_src|docs?|examples?|samples?|demos?|tutorials?|benchmarks?|playground)\//i;
 const COMMENT_LINE = /^\s*(\/\/|#(?![!\[])|\*|\/\*|<!--|--\s|;;|%)/;
@@ -54,7 +56,7 @@ function globSource(glob) {
             i++;
             if (glob[i + 1] === '/') { i++; re += '(?:.*/)?'; } else re += '.*';
         } else if (c === '?') re += '[^/]';
-        else if (c === '[' && glob.indexOf(']', i + 2) > i) { const j = glob.indexOf(']', i + 2); re += glob.slice(i, j + 1).replace(/^\[!/, '[^'); i = j; }
+        else if (c === '[' && glob.indexOf(']', i + 2) > i) { const j = glob.indexOf(']', i + 2); re += '[' + glob.slice(i + 1, j).replace(/^!/, '^').replace(/\\/g, '\\\\') + ']'; i = j; }
         else if (c === '{' && glob.indexOf('}', i) > i) { const j = glob.indexOf('}', i); re += `(?:${glob.slice(i + 1, j).split(',').map(escapeRe).join('|')})`; i = j; }
         else re += escapeRe(c);
     }
@@ -71,7 +73,16 @@ export function findFiles(root, pattern, { path: prefix = null } = {}) {
     if (/[*?[{]/.test(pattern)) {
         const onName = !pattern.includes('/');
         const re = new RegExp(onName ? `^${globSource(pattern)}$` : `(^|/)${globSource(pattern.replace(/^\.?\//, ''))}$`);
-        test = (p) => re.test(onName ? p.slice(p.lastIndexOf('/') + 1) : p);
+        // a glob of many stars (`*a*a*a*a*a*a*b`) backtracks for minutes on one long name: matched
+        // under the same budget as search_text's expressions, so it cannot block the server
+        const paths = listFiles(root).filter(p => !pre || p === pre || p.startsWith(pre + '/'));
+        const ctx = vm.createContext({ re, paths, onName });
+        try {
+            return GLOB_FILTER.runInContext(ctx, { timeout: REGEX_BUDGET_MS }).sort();
+        } catch (e) {
+            if (e.code !== 'ERR_SCRIPT_EXECUTION_TIMEOUT') throw e;
+            throw new Error(`The glob took more than ${REGEX_BUDGET_MS / 1000} s to match (too many wildcards?). Use fewer wildcards.`);
+        }
     } else {
         const t = pattern.toLowerCase();
         test = (p) => p.toLowerCase().includes(t);
@@ -133,7 +144,8 @@ export async function textSearch(intel, { pattern, path: prefix = null, literal
         const f = indexed.get(rel);
         for (const i of scan.hits) {
             total++;
-            matches.push({ path: rel, line: i + 1, text: scan.lines[i], fileId: f?.id ?? null, isTest: !!f?.is_test, code: !!f });
+            // counted, but kept (and annotated) only up to a bound: memory and time stay bounded
+            if (matches.length < MAX_KEPT) matches.push({ path: rel, line: i + 1, text: scan.lines[i], fileId: f?.id ?? null, isTest: !!f?.is_test, code: !!f });
         }
     }
     const ident = identifierOf(pattern, literal);
@@ -149,13 +161,22 @@ export async function textSearch(intel, { pattern, path: prefix = null, literal
             WHERE r.file_id = ? AND r.name = ?`, f.id, ident) : [];
         const refsAt = new Map();
         for (const r of refs) (refsAt.get(r.line) ?? refsAt.set(r.line, []).get(r.line)).push(r);
+        // innermost definition around each matched line, ignoring ones that start on it (inline
+        // classes, the def itself): one sweep over the definitions in start order, writing only the
+        // matched lines, instead of every definition for every match
+        const wanted = new Map(ms.map(m => [m.line, null]));
+        const lines = [...wanted.keys()].sort((a, b) => a - b);
+        for (const s of syms) {
+            let lo = 0, hi = lines.length;
+            while (lo < hi) { const mid = (lo + hi) >> 1; if (lines[mid] <= s.start_line) lo = mid + 1; else hi = mid; }
+            for (let k = lo; k < lines.length && lines[k] <= s.end_line; k++) wanted.set(lines[k], s);
+        }
+        const defAt = new Map();
+        if (summary) for (const s of syms) if (s.name === ident && !defAt.has(s.name_line)) defAt.set(s.name_line, s);
         for (const m of ms) {
-            // innermost definition around the line, ignoring ones that start on it (inline classes, the def itself)
-            let encl = null;
-            for (const s of syms) if (s.start_line < m.line && s.end_line >= m.line && (!encl || s.start_line >= encl.start_line)) encl = s;
-            m.encl = encl?.qname ?? null;
+            m.encl = wanted.get(m.line)?.qname ?? null;
             if (!summary) continue;
-            const def = syms.find(s => s.name === ident && s.name_line === m.line);
+            const def = defAt.get(m.line);
             const rs = refsAt.get(m.line) ?? [];
             if (def) { m.what = 'def'; m.target = def.qname; summary.defs++; continue; }
             const bound = rs.filter(r => r.dst_id != null);
@@ -174,5 +195,5 @@ export async function textSearch(intel, { pattern, path: prefix = null, literal
         }
     }
     matches.sort((a, b) => rank(a.path, a.isTest) + (a.code ? 0 : 1) - (rank(b.path, b.isTest) + (b.code ? 0 : 1)) || a.path.localeCompare(b.path) || a.line - b.line);
-    return { total, files: nfiles, shown: matches.slice(0, limit), all: matches, summary, truncated: matches.length > limit };
+    return { total, files: nfiles, shown: matches.slice(0, limit), all: matches, summary, truncated: total > limit, annotated: matches.length };
 }

package/src/store/db.mjs

@@ -128,11 +128,21 @@ CREATE VIRTUAL TABLE IF NOT EXISTS file_fts USING fts5(
 `;
 
 export class Store {
+    /**
+     * An index.db the repository shipped is not trusted: defensive mode refuses the statements that
+     * can corrupt the file (writable_schema, …) and an untrusted schema may not call functions.
+     */
+    #harden() {
+        try { this.db.enableDefensive?.(true); } catch { /* older Node */ }
+        this.db.exec('PRAGMA trusted_schema = OFF;');
+    }
+
     constructor(dbPath) {
         this.path = dbPath;
         this.stmts = new Map();
         fs.mkdirSync(path.dirname(dbPath), { recursive: true });
         this.db = new DatabaseSync(dbPath);
+        this.#harden();
         this.db.exec('PRAGMA journal_mode = WAL; PRAGMA synchronous = NORMAL; PRAGMA temp_store = MEMORY; PRAGMA cache_size = -65536; PRAGMA busy_timeout = 5000;');
         const v = this.#schemaVersion();
         if (v !== null && v !== SCHEMA_VERSION) {
@@ -140,6 +150,7 @@ export class Store {
             this.db.close();
             for (const suffix of ['', '-wal', '-shm']) { try { fs.unlinkSync(dbPath + suffix); } catch { /* none */ } }
             this.db = new DatabaseSync(dbPath);
+            this.#harden();
             this.db.exec('PRAGMA journal_mode = WAL; PRAGMA synchronous = NORMAL; PRAGMA temp_store = MEMORY; PRAGMA cache_size = -65536; PRAGMA busy_timeout = 5000;');
         }
         this.db.exec(SCHEMA);

package/src/util/git.mjs

@@ -1,30 +1,79 @@
 /**
  * git, run so that an indexed repository's own config cannot make it execute anything: no
- * fsmonitor, no hooks, no signature verification, no external diff or textconv, and every
- * clean/smudge/process filter switched off. A repository copied with its .git directory (an
- * archive, a shared folder) is not trusted.
+ * fsmonitor, no hooks, no signature verification, no external diff or textconv, every
+ * clean/smudge/process filter switched off, and no descent into submodules (whose own config the
+ * overrides below do not cover). A repository copied with its .git directory (an archive, a shared
+ * folder) is not trusted. Every git call graph-indexer makes goes through gitSync.
  */
 import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
 
 const COMMAND_KEY = /^(filter\.[^\n]+)\.(clean|smudge|process)$|^diff\.[^\n]+\.(textconv|command)$/;
 
+let gitBin = null;
+/**
+ * The git executable. On Windows a bare `git` is looked up in the working directory before PATH,
+ * so a `git.exe` committed at the repository root would run instead: look it up on PATH only.
+ */
+export function gitExecutable() {
+    if (gitBin) return gitBin;
+    gitBin = 'git';
+    if (process.platform === 'win32') {
+        const exts = (process.env.PATHEXT || '.EXE;.CMD;.BAT').split(';').filter(Boolean);
+        for (const dir of (process.env.PATH || process.env.Path || '').split(path.delimiter)) {
+            if (!dir || !path.isAbsolute(dir)) continue;
+            const hit = exts.map(e => path.join(dir, 'git' + e.toLowerCase())).find(f => { try { return fs.statSync(f).isFile(); } catch { return false; } });
+            if (hit) { gitBin = hit; break; }
+        }
+    }
+    return gitBin;
+}
+
+let envConfig = null;
+/** git ≥ 2.31 takes config from GIT_CONFIG_COUNT/KEY/VALUE, which carry a key verbatim. */
+function supportsEnvConfig() {
+    if (envConfig != null) return envConfig;
+    const m = /(\d+)\.(\d+)/.exec(spawnSync(gitExecutable(), ['--version'], { encoding: 'utf8' }).stdout ?? '');
+    return (envConfig = !!m && (+m[1] > 2 || (+m[1] === 2 && +m[2] >= 31)));
+}
+
+/**
+ * The overrides for `root`: fixed ones, plus one blanking each command its config names. Those go
+ * in the environment, not as `-c key=`: git splits a `-c` at the first `=`, and a driver may be
+ * named `x=y`, so `-c filter.x=y.clean=` would set `filter.x` and leave the real command on.
+ * Returns null when the overrides cannot be expressed (an old git and such a name): git is not run.
+ */
 function hardening(root) {
-    const args = ['-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-c', 'diff.external=', '-c', 'log.showSignature=false'];
-    const r = spawnSync('git', ['config', '--name-only', '--get-regexp', '^(filter|diff)\\.'], { cwd: root, encoding: 'utf8' });
-    for (const key of (r.status === 0 ? r.stdout : '').split('\n')) {
+    const pairs = [['core.fsmonitor', 'false'], ['core.hooksPath', '/dev/null'], ['diff.external', ''], ['log.showSignature', 'false']];
+    const r = spawnSync(gitExecutable(), ['config', '-z', '--name-only', '--get-regexp', '^(filter|diff)\\.'], { cwd: root, encoding: 'utf8' });
+    for (const key of (r.status === 0 ? r.stdout : '').split('\0')) {
         const m = COMMAND_KEY.exec(key);
         if (!m) continue;
-        args.push('-c', `${key}=`);
+        pairs.push([key, '']);
         // a required filter (Git LFS sets one) would otherwise fail the diff once its command is blank
-        if (m[1]) args.push('-c', `${m[1]}.required=false`);
+        if (m[1]) pairs.push([`${m[1]}.required`, 'false']);
+    }
+    if (supportsEnvConfig()) {
+        const base = Number(process.env.GIT_CONFIG_COUNT) || 0;
+        const env = { GIT_CONFIG_COUNT: String(base + pairs.length) };
+        pairs.forEach(([k, v], i) => { env[`GIT_CONFIG_KEY_${base + i}`] = k; env[`GIT_CONFIG_VALUE_${base + i}`] = v; });
+        return { args: [], env };
     }
-    return args;
+    if (pairs.some(([k]) => k.includes('='))) return null;
+    return { args: pairs.flatMap(([k, v]) => ['-c', `${k}=${v}`]), env: {} };
 }
 
-const NO_TOOLS = { diff: ['--no-ext-diff', '--no-textconv'], log: ['--no-ext-diff', '--no-textconv', '--no-show-signature'] };
+const NO_TOOLS = {
+    diff: ['--no-ext-diff', '--no-textconv', '--ignore-submodules=all'],
+    log: ['--no-ext-diff', '--no-textconv', '--no-show-signature'],
+    status: ['--ignore-submodules=all'],
+};
 
 /** spawnSync('git', args) in `root`, hardened as above; diff and log never run external tools. */
 export function gitSync(root, args, opts = {}) {
     const sub = NO_TOOLS[args[0]] ? [args[0], ...NO_TOOLS[args[0]], ...args.slice(1)] : args;
-    return spawnSync('git', [...hardening(root), ...sub], { cwd: root, encoding: 'utf8', ...opts });
+    const h = hardening(root);
+    if (!h) return { status: 1, stdout: '', stderr: 'git not run: the repository config names a filter or diff driver this git cannot switch off', error: null };
+    return spawnSync(gitExecutable(), [...h.args, ...sub], { cwd: root, encoding: 'utf8', ...opts, env: { ...process.env, ...opts.env, ...h.env } });
 }

package/src/util/paths.mjs

@@ -12,6 +12,11 @@ export function dataDir(root) {
     const st = fs.lstatSync(dir);
     if (!st.isDirectory()) throw new Error(`${dir} is not a directory (a symbolic link?); remove it and run again`);
     if ((st.mode & 0o077) !== 0) { try { fs.chmodSync(dir, 0o700); } catch { /* read-only */ } }
+    // nor may a link inside it (`index.db-wal` → ~/.zshrc, `resident.started` → ~/.ssh/…) send the
+    // index's writes elsewhere: everything in here is ours, so a link is never legitimate
+    try {
+        for (const e of fs.readdirSync(dir, { withFileTypes: true })) if (e.isSymbolicLink()) fs.unlinkSync(path.join(dir, e.name));
+    } catch { /* read-only */ }
     const gi = path.join(dir, '.gitignore');
     if (!fs.existsSync(gi)) { try { fs.writeFileSync(gi, '*\n'); } catch { /* read-only */ } }
     return dir;
@@ -37,11 +42,13 @@ const realRoots = new Map();
  */
 export function withinRoot(root, rel) {
     let realRoot = realRoots.get(root);
-    if (!realRoot) { try { realRoot = fs.realpathSync(root); } catch { realRoot = path.resolve(root); } realRoots.set(root, realRoot); }
+    if (!realRoot) { try { realRoot = fs.realpathSync.native(root); } catch { realRoot = path.resolve(root); } realRoots.set(root, realRoot); }
     let real;
-    try { real = fs.realpathSync(path.join(root, rel)); } catch { return false; }
+    // the native realpath gives the name as stored on disk, so on a case-insensitive file system
+    // (macOS, Windows) `.GIT/config` resolves to `.git/config` and is refused like it
+    try { real = fs.realpathSync.native(path.join(root, rel)); } catch { return false; }
     if (real !== realRoot && !real.startsWith(realRoot + path.sep)) return false;
-    const top = path.relative(realRoot, real).split(path.sep)[0];
+    const top = path.relative(realRoot, real).split(path.sep)[0].toLowerCase();
     return top !== '.git' && top !== DATA_DIR_NAME;
 }