knodin 0.10.5 → 0.10.6

package/dist/bin/cli.js

@@ -401,7 +401,13 @@ function formatStatusHuman(result) {
     const semanticNote = result.semanticReadiness && result.semanticReadiness !== "ready"
         ? ` Semantic search coverage is ${result.semanticReadiness}: \`search\` will under-return until embedding completes (\`knodin index\`).`
         : "";
-    const coverage = `${result.coverage.sourceFiles} source files, ${result.coverage.indexedFiles} indexed files, ${result.coverage.filesWithSymbols} files with symbols${formatCoverageGaps(result.coverage.skipped)}${mirrorNote}${semanticNote}`;
+    // `countsUnknown` means the graph could not be read, so these are placeholders
+    // rather than measurements. Printing "0 indexed files" makes an absent graph
+    // indistinguishable from a fully destroyed one.
+    const indexedCounts = result.coverage.countsUnknown
+        ? "indexed and symbol counts unknown; the graph could not be read"
+        : `${result.coverage.indexedFiles} indexed files, ${result.coverage.filesWithSymbols} files with symbols`;
+    const coverage = `${result.coverage.sourceFiles} source files, ${indexedCounts}${formatCoverageGaps(result.coverage.skipped)}${mirrorNote}${semanticNote}`;
     if (result.status === "indexing" && result.activity) {
         const count = result.activity.phaseTotal === undefined
             ? ""
@@ -437,8 +443,18 @@ function formatStatusHuman(result) {
         return `Graph content is intact but evidence is stale (${coverage}).${result.verification.mode === "persisted-audit"
             ? ` Cached deep-audit evidence is from ${result.verification.auditVerifiedAt ?? "an earlier run"}; freshness was probed ${result.verification.verifiedAt ?? "now"}. Run \`knodin status --deep\` for an exact current audit.`
             : ""}\n${freshnessLine}${lifecycleLine}${integrationLine}Run \`knodin wait --fresh\` or issue a graph query to reconcile bounded drift.\n`;
-    const outstanding = result.missing.files.length + result.missing.records.length;
-    const firstIssue = result.missing.files[0] ?? result.missing.records[0];
+    // When the graph could not be read, every source file lands in `missing.files`
+    // because none of them are indexed. That is ONE structural problem, not one
+    // per file: a 94-file repository with no database reported "95 issue(s)" and
+    // led with an arbitrary source filename, so an absent graph read as damage
+    // proportional to repository size. `missing.files` still carries the repair
+    // worklist — only the count and the headline shown to a human change here.
+    const outstanding = result.coverage.countsUnknown
+        ? result.missing.records.length
+        : result.missing.files.length + result.missing.records.length;
+    const firstIssue = result.coverage.countsUnknown
+        ? result.missing.records[0]
+        : (result.missing.files[0] ?? result.missing.records[0]);
     const detail = firstIssue ? ` First issue: ${firstIssue}.` : "";
     const repairCommand = result.lifecycle?.status === "degraded" &&
         result.missing.records.every((record) => result.lifecycle?.issues.includes(record))

package/dist/src/diagnostics.js

@@ -528,8 +528,19 @@ function scrubText(raw, repo) {
     };
     for (const exact of [repo, os.homedir()].filter(Boolean).sort((a, b) => b.length - a.length))
         replace(new RegExp(exact.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`), "g"), "<path>");
-    replace(/\b(?:ghp|github_pat|sk|xox[baprs])-[-A-Za-z0-9_]{10,}\b/g, "<secret>");
-    replace(/\b(?:password|passwd|token|secret|api[_-]?key|authorization)\s*[=:]\s*[^\s,;]+/gi, "$1=<secret>");
+    // Either separator. GitHub issues its tokens with an UNDERSCORE after the
+    // prefix, so a hyphen-only pattern matched a shape GitHub never mints and
+    // missed every shape it does — a real token in an error message survived
+    // scrubbing and reached the bundle a user shares (KNODIN-10). Slack and
+    // OpenAI really do use a hyphen, so both separators must be accepted.
+    replace(/\b(?:ghp|github_pat|sk|xox[baprs])[-_][-A-Za-z0-9_]{10,}\b/g, "<secret>");
+    // The value pattern stops at whitespace, so `authorization: Bearer <token>`
+    // used to match only the word "Bearer" and leave the credential in place —
+    // the standard header form leaked the one thing worth redacting (KNODIN-10).
+    // An optional scheme is consumed first so the credential after it is the
+    // part that gets replaced. Only known schemes are skipped, so an ordinary
+    // `password=x next word` still redacts one value rather than eating prose.
+    replace(/\b(?:password|passwd|token|secret|api[_-]?key|authorization)\s*[=:]\s*(?:(?:bearer|basic|digest|token)\s+)?[^\s,;]+/gi, "<secret>");
     replace(/\b[A-Z]:\\(?:[^\s<>:"|?*]+\\)*[^\s<>:"|?*]*/g, "<path>");
     replace(/(?:^|[\s('"`])\/(?:[^\s)'"`]+\/)*[^\s)'"`]*/g, "<path>");
     replace(/\b(?:[A-Za-z0-9_.-]+\/)+(?:[A-Za-z0-9_.-]+\.[A-Za-z0-9]{1,12})\b/g, "<path>");

package/dist/src/engine/candidate-database.js

@@ -1,6 +1,8 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { isSealedDatabase } from "./seal.js";
+import { Database } from "./sqlite.js";
 import { resolveDbPath, resolveStateDir } from "./state-paths.js";
 const PROMOTION_SCHEMA_VERSION = 1;
 const CANDIDATES_DIRECTORY = "candidates";
@@ -166,6 +168,29 @@ export function recoverInterruptedPromotion(repo) {
     fsyncDirectory(path.dirname(marker));
     return outcome;
 }
+/**
+ * Whether the database currently at the active path carries embedded source.
+ *
+ * An active database that cannot be opened reports false ON PURPOSE. Replacing
+ * a damaged graph is exactly what promotion exists to do, and a graph too
+ * corrupt to open is the ordinary case for that — refusing here would break
+ * repair for the situation it is most needed in. The trade is deliberate: a
+ * sealed artifact that is ALSO unreadable can still be replaced, but such an
+ * artifact is already unrecoverable.
+ */
+function activeDatabaseIsSealed(activePath) {
+    let db = null;
+    try {
+        db = new Database(activePath, { readonly: true });
+        return isSealedDatabase(db);
+    }
+    catch {
+        return false;
+    }
+    finally {
+        db?.close();
+    }
+}
 /** Same-filesystem, marker-backed promotion. Caller must close and audit both databases first. */
 export function promoteCandidateFile(repo, candidate) {
     assertCandidate(repo, candidate);
@@ -176,6 +201,18 @@ export function promoteCandidateFile(repo, candidate) {
     for (const suffix of ["-wal", "-shm"])
         if (fs.existsSync(`${candidate.databasePath}${suffix}`))
             throw new Error("candidate database has uncheckpointed sidecar files");
+    // Promotion REPLACES the active database. When that file is a sealed
+    // artifact, replacing it destroys the only copy of the source embedded in
+    // it. `repair` reaches here with a candidate built from the working tree,
+    // so an artifact sitting at the active path was emptied by a command whose
+    // entire purpose is to make a graph healthier (KNODIN-9).
+    //
+    // This is the chokepoint rather than a guard inside `repair`, because every
+    // promotion has the same consequence regardless of which caller arrives.
+    // An ordinary working graph is never sealed, so normal promotion and repair
+    // are unaffected.
+    if (fs.existsSync(activePath) && activeDatabaseIsSealed(activePath))
+        throw new Error("active database is a sealed artifact; promotion would replace it");
     fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
     fsyncFile(candidate.databasePath);
     const backupPath = path.join(stateDir, `db.sqlite.backup.${Date.now()}.${crypto.randomUUID().slice(0, 8)}`);

package/dist/src/engine/index.js

@@ -8860,6 +8860,16 @@ export async function getOrInitDb(repoPath, options = {}) {
             // Runs after the CREATE TABLEs below, since the table must exist.
             const needsOrphanPurge = storedVersion < KNODIN_SCHEMA_VERSION;
             const needsEmbeddingRepresentationRefresh = storedVersion >= 22 && storedVersion < 23;
+            // An artifact sealed by an older build carries that build's schema
+            // version, so a newer knodin opening it for write lands here and drops
+            // every table below — including the embedded source, which no working
+            // tree can supply again. Today's artifacts report the current version
+            // and never reach it; one from a single release ago would.
+            //
+            // Refuse rather than skip: skipping would leave the caller holding a
+            // database it believes is writable and current, and it is neither.
+            if (storedVersion < LAST_REBUILD_SCHEMA_VERSION && isSealedDatabase(db))
+                throw new Error("refusing to rebuild the schema of a sealed artifact: it would drop the embedded source, which is the only copy");
             if (storedVersion < LAST_REBUILD_SCHEMA_VERSION) {
                 db.run("DROP TRIGGER IF EXISTS after_symbol_insert;");
                 db.run("DROP TRIGGER IF EXISTS after_symbol_delete;");
@@ -12941,6 +12951,9 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 let indexedFiles = 0;
                 let filesWithSymbols = 0;
                 let lastSuccessfulReconciliation = null;
+                // No database, or counters that threw, means the zeros below were
+                // never measured.
+                let countsUnknown = !db;
                 if (db) {
                     try {
                         schemaVersion =
@@ -12957,7 +12970,10 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     }
                     catch {
                         // A schema migration can briefly make counters unavailable;
-                        // the live operation remains the authoritative status.
+                        // the live operation remains the authoritative status. Whatever
+                        // was read before the throw is partial, so report the counts as
+                        // unknown rather than presenting a half-filled tally as measured.
+                        countsUnknown = true;
                     }
                     if (!activeDb)
                         db.close();
@@ -12980,6 +12996,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                             ? Math.round((Math.min(indexedFiles, sourceFiles.length) / sourceFiles.length) * 10000) / 100
                             : 100,
                         skipped,
+                        ...(countsUnknown ? { countsUnknown: true } : {}),
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: { files: [], records: [] },
@@ -13011,6 +13028,8 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         filesWithSymbols: 0,
                         percent: sourceFiles.length ? 0 : 100,
                         skipped: buildCoverageSkips(collected.skippedByExtension, null),
+                        // There is no database to count, so these are placeholders.
+                        countsUnknown: true,
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: {
@@ -13183,6 +13202,9 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         filesWithSymbols: 0,
                         percent: sourceFiles.length ? 0 : 100,
                         skipped: coverageSkips,
+                        // The schema is not one this build can read, so index_state is
+                        // not counted here even though rows may well exist.
+                        countsUnknown: true,
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: { files: sourceFiles, records: schemaProblems },
@@ -13531,7 +13553,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         else
                             counts.indexed++;
                     }
-                    else {
+                    else if (shouldPurgeMissingFile(db)) {
                         db.run("BEGIN TRANSACTION;");
                         try {
                             deleteSymbolsForFile(db, file);
@@ -13547,6 +13569,17 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         }
                         counts.removed++;
                     }
+                    else {
+                        // A sealed artifact's rows ARE the artifact: it has no working
+                        // tree, so "this file is missing" is its normal condition rather
+                        // than drift to clean up (KNODIN-9).
+                        //
+                        // This was the sixth purge site and the only unguarded one.
+                        // `removeIndexState` above carries its own guard, which is why
+                        // the damage looked so strange: index_state survived while the
+                        // symbols, references and dependencies around it were deleted.
+                        counts.skipped++;
+                    }
                     committedWork = true;
                     setMeta(db, "repairPostprocessingPending", "1");
                     completedFiles = fileIndex + 1;

package/dist/src/failure-diagnosis.js

@@ -26,7 +26,13 @@ const CODE_EXTENSIONS = [
     ".cpp",
     ".h",
     ".hpp",
-];
+    // Longest first. `referenceAt` takes the FIRST extension that matches at a
+    // cursor, so a shorter extension listed earlier wins and truncates the path:
+    // `src/main.cpp:3:4` parsed as `src/main.c` with no line, pointing diagnosis
+    // at a file that does not exist. `.tsx` only worked because it happened to
+    // precede `.ts`. Sorting makes longest-match the rule rather than an
+    // accident of list order.
+].sort((left, right) => right.length - left.length);
 const MAX_ANALYSIS_BYTES = 4 * 1024 * 1024;
 const MAX_SOURCE_FILE_BYTES = 1024 * 1024;
 const MAX_MANIFEST_BYTES = 256 * 1024;

package/docs/releases/0.10.6.md

@@ -0,0 +1,139 @@
+# knodin 0.10.6
+
+Four fixes, continuing the theme 0.10.2 through 0.10.5 have been working on: **a
+result that looks complete while quietly being wrong**. Three of the four were
+found the same way — by writing a test per case and watching which ones failed,
+rather than by reading the code and deciding it looked correct.
+
+Two of them disclose credentials, so read that section first if you have ever
+attached a diagnostics bundle to a support request.
+
+## Credentials survived redaction
+
+`knodin` scrubs secrets out of recorded failures before they can reach a
+diagnostics bundle — the artefact a user hands to someone else when asking for
+help. Two things it claimed to redact, it did not.
+
+**GitHub tokens were never redacted at all.** The pattern required a hyphen
+after the prefix:
+
+```
+\b(?:ghp|github_pat|sk|xox[baprs])-[-A-Za-z0-9_]{10,}\b
+```
+
+GitHub issues both its formats with an *underscore*. So the two GitHub
+alternatives matched a shape GitHub never mints and missed every shape it does.
+Slack and OpenAI genuinely do use a hyphen, so the separator now accepts either
+rather than being swapped.
+
+**An authorization header leaked the credential and redacted its label.** The
+value pattern stops at whitespace, so for the standard form
+
+```
+authorization: Bearer <token>
+```
+
+it matched only the word `Bearer` — replacing the part that identifies the
+header and preserving the part that authenticates. Exactly inverted. An optional
+known scheme is now consumed first, so the credential after it is what gets
+replaced.
+
+This was quiet in an unhelpful way. The journal stores only a *fingerprint* of
+the scrubbed message, never the message, so an unredacted credential is
+invisible locally and appears only in the bundle that gets shared. The tests
+assert redaction by fingerprint equivalence for that reason, and by
+value-independence — two messages differing only in the secret must fingerprint
+identically — which is how the `Bearer` case was found. An assertion written
+against expected output text would have passed, because the output *did* contain
+a redaction marker.
+
+Redaction is on by default, so this needed no unusual configuration to hit.
+
+A second redactor, in output compression, has different gaps in the opposite
+direction: it catches GitHub classic but not fine-grained, and misses Slack and
+OpenAI. Neither pattern list is a superset of the other. That one is filed
+rather than patched here, because adding three regexes to one of two diverging
+lists would only re-create the problem later.
+
+## `repair` emptied a sealed artifact
+
+Pointed at a sealed artifact, `knodin repair` deleted its symbols, references
+and dependencies. A sealed artifact's embedded source is the only copy of that
+source, so this was unrecoverable.
+
+0.10.5 audited five sites that purge rows for files missing from disk and
+guarded all five. This was a **sixth**, in repair's own removal branch, which
+never consulted the guard.
+
+It also explains a symptom that made no sense while the mechanism was unknown:
+`index_state` survived intact while everything around it was deleted.
+`removeIndexState`, called *inside* that same block, carries its own guard and
+declined correctly — so the damage was the guard working on one line and being
+absent from the four above it.
+
+Two adjacent hazards are guarded alongside it: a schema rebuild would drop every
+table of an artifact sealed by an older build, and promotion would overwrite a
+sealed artifact sitting at the active path.
+
+## `status` reported an unreadable graph as a measured zero
+
+A 94-file repository whose database was missing printed:
+
+```
+Graph or lifecycle needs repair: 95 issue(s) found
+(94 source files, 0 indexed files, 0 files with symbols)
+First issue: <an arbitrary source file>
+```
+
+`repair`, seconds later, reported 94 indexed and 53 with symbols. The two
+commands never counted differently. `status` was rendering a graph it could not
+read as a measurement of zero.
+
+The `95` was arithmetic, not a tally: the issue count is
+`missing.files + missing.records`, and the no-database branch fills
+`missing.files` with every source file. Ninety-four files plus one record. So
+the count scaled with repository size, and a graph that had simply never been
+built read as damage proportional to how much code you have.
+
+Three sites emitted zeros they had not measured, and now report the counts as
+unknown instead:
+
+```
+Graph or lifecycle needs repair: 1 issue(s) found
+(3 source files, indexed and symbol counts unknown; the graph could not be read)
+First issue: local index database is missing
+```
+
+`missing.files` is deliberately still populated. `repair` consumes it as its
+worklist and `seal` reads it as dirty paths, so emptying it — the obvious way to
+stop the count inflating — would have left repair with nothing to do.
+
+## C++ diagnostics pointed at files that do not exist
+
+Source extensions are matched first-listed rather than longest, and `.c`
+preceded `.cpp`. A C++ stack frame did not merely lose precision:
+
+```
+in    at f (src/main.cpp:3:4)
+was   { path: "src/main.c", line: null, column: null }
+now   { path: "src/main.cpp", line: 3, column: 4 }
+```
+
+A path to a file that does not exist, with the location dropped. `.tsx` worked
+only because it happened to precede `.ts`; longest-match is now the rule rather
+than an accident of list order.
+
+## Coverage measures the parse path again
+
+Not a shipped behaviour change, but worth recording because it changes what the
+project's own numbers mean.
+
+Generic source files are parsed off the main thread, and v8 coverage instruments
+only the isolate it runs in — so everything the parse path did executed inside a
+worker thread where it could not be observed, and was reported as untested. On
+an identical set of shards, with no test changed, disabling parse workers for
+the coverage run alone moved branch coverage from 74.85% to 77.16%: 414 branches
+the suite was already exercising.
+
+Sixteen functions had been sitting in the uncovered map looking like dead code.
+They were not.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "knodin",
-	"version": "0.10.5",
+	"version": "0.10.6",
 	"knodin": {
 		"compatibility": "compatible"
 	},
@@ -23,32 +23,44 @@
 		"knodin": "dist/bin/launcher.js"
 	},
 	"files": [
+		"*.wasm",
+		"benchmarks/competitors/SYNTHESIS.md",
 		"dist",
-		"skills",
-		"docs/prompts/declare-multi-repository-system.md",
-		"docs/DEAD-CODE-AND-IMPACT.md",
-		"docs/DOCTOR-AND-UPDATES.md",
 		"docs/BACKUP-RETENTION.md",
-		"docs/DIAGNOSTICS.md",
 		"docs/BEHAVIORAL-CONTRACT.md",
-		"docs/DEMO.md",
+		"docs/CLI.md",
+		"docs/COMMAND-OUTPUT-COMPRESSION.md",
 		"docs/COMPARISON.md",
 		"docs/COMPETITIVE-LANDSCAPE-2026-08.md",
-		"docs/INDEXING-POLICY-AND-PROVENANCE.md",
+		"docs/CONTAINED-EXECUTION.md",
+		"docs/DEAD-CODE-AND-IMPACT.md",
+		"docs/DEMO.md",
+		"docs/DIAGNOSTICS.md",
+		"docs/DOCTOR-AND-UPDATES.md",
+		"docs/GIT-HISTORY-REVIEW.md",
 		"docs/HANDOFF.md",
+		"docs/INDEXING-POLICY-AND-PROVENANCE.md",
 		"docs/INSTALLATION.md",
 		"docs/MCP.md",
-		"docs/COMMAND-OUTPUT-COMPRESSION.md",
-		"docs/CONTAINED-EXECUTION.md",
 		"docs/PROGRESSIVE-EVIDENCE.md",
-		"docs/GIT-HISTORY-REVIEW.md",
-		"docs/SCIP-IMPORT.md",
-		"docs/CLI.md",
 		"docs/PT-ACCESS-RECOMMENDATION.md",
-		"docs/REPOSITORIES-AND-WORKTREES.md",
 		"docs/RELEASE-0.3-EVIDENCE.md",
-		"docs/SIGNED-UPDATES.md",
+		"docs/REPOSITORIES-AND-WORKTREES.md",
+		"docs/SCIP-IMPORT.md",
 		"docs/SHARED-INDEX-CONTRACT.md",
+		"docs/SIGNED-UPDATES.md",
+		"docs/SYSTEMS-AND-RELATIONSHIPS.md",
+		"docs/TELEMETRY.md",
+		"docs/TOKEN-OPTIMIZER-SCORECARD.md",
+		"docs/assets/knodin-favicon.svg",
+		"docs/prompts/declare-multi-repository-system.md",
+		"docs/releases/0.10.0.md",
+		"docs/releases/0.10.1.md",
+		"docs/releases/0.10.2.md",
+		"docs/releases/0.10.3.md",
+		"docs/releases/0.10.4.md",
+		"docs/releases/0.10.5.md",
+		"docs/releases/0.10.6.md",
 		"docs/releases/0.3.0.md",
 		"docs/releases/0.4.0.md",
 		"docs/releases/0.4.1.md",
@@ -71,25 +83,14 @@
 		"docs/releases/0.8.6.md",
 		"docs/releases/0.8.7.md",
 		"docs/releases/0.9.0.md",
-		"docs/releases/0.10.0.md",
-		"docs/releases/0.10.1.md",
-		"docs/releases/0.10.2.md",
-		"docs/releases/0.10.3.md",
-		"docs/releases/0.10.4.md",
-		"docs/releases/0.10.5.md",
-		"docs/assets/knodin-favicon.svg",
-		"docs/SYSTEMS-AND-RELATIONSHIPS.md",
-		"docs/TELEMETRY.md",
-		"docs/TOKEN-OPTIMIZER-SCORECARD.md",
-		"benchmarks/competitors/SYNTHESIS.md",
 		"roadmap/competitive-roadmap.md",
 		"schemas/release-attestation-v1.schema.json",
-		"schemas/support-bundle-v2.schema.json",
-		"schemas/shared-index-config-v1.schema.json",
 		"schemas/shared-index-branch-pointer-v1.schema.json",
+		"schemas/shared-index-config-v1.schema.json",
 		"schemas/shared-index-manifest-v1.schema.json",
 		"schemas/shared-index-provenance-v1.schema.json",
-		"*.wasm"
+		"schemas/support-bundle-v2.schema.json",
+		"skills"
 	],
 	"engines": {
 		"node": ">=24.0.0"