kotadb 2.1.0-next.20260203213653 → 2.1.0-next.20260203220618

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kotadb",
-  "version": "2.1.0-next.20260203213653",
+  "version": "2.1.0-next.20260203220618",
   "description": "Local-only code intelligence tool for CLI agents. SQLite-backed repository indexing and code search via MCP.",
   "type": "module",
   "module": "src/index.ts",
@@ -54,8 +54,8 @@
     "@asteasolutions/zod-to-openapi": "^8.4.0",
     "@modelcontextprotocol/sdk": "^1.25.0",
     "@sentry/node": "^10.25.0",
-    "@typescript-eslint/parser": "^8.0.0",
-    "@typescript-eslint/types": "^8.54.0",
+    "@typescript-eslint/parser": "8.54.0",
+    "@typescript-eslint/types": "8.54.0",
     "bcryptjs": "^2.4.3",
     "chokidar": "^5.0.0",
     "cors": "^2.8.6",
@@ -75,5 +75,8 @@
     "lint-staged": "^16.2.4",
     "supertest": "^7.1.4",
     "typescript": "^5.9.3"
+  },
+  "overrides": {
+    "@typescript-eslint/types": "8.54.0"
   }
 }

package/src/indexer/ast-parser.ts

@@ -42,6 +42,24 @@ export interface ParseError {
 	column?: number;
 }
 
+/**
+ * Type guard to validate that an AST node is a valid Program.
+ * Provides runtime type validation to prevent version compatibility issues.
+ *
+ * @param ast - Unknown AST node to validate
+ * @returns true if ast is a valid Program node
+ */
+function isValidProgram(ast: unknown): ast is TSESTree.Program {
+	return (
+		ast !== null &&
+		typeof ast === "object" &&
+		"type" in ast &&
+		ast.type === "Program" &&
+		"body" in ast &&
+		Array.isArray(ast.body)
+	);
+}
+
 /**
  * Result of parsing a file, including partial AST recovery information.
  */
@@ -103,7 +121,7 @@ function createParseError(error: unknown): ParseError {
 
 /**
  * Parse a file with error-tolerant options enabled.
- * Uses allowInvalidAST to attempt partial recovery.
+ * Uses allowInvalidAST to attempt partial recovery and validates result.
  */
 function parseWithRecoveryOptions(filePath: string, content: string): TSESTree.Program | null {
 	try {
@@ -119,6 +137,18 @@ function parseWithRecoveryOptions(filePath: string, content: string): TSESTree.P
 			allowInvalidAST: true,
 			errorOnUnknownASTType: false,
 		});
+
+		// Validate the returned AST is actually a Program node
+		if (!isValidProgram(ast)) {
+			const astType = typeof ast === "object" && ast !== null && "type" in ast ? (ast as any).type : typeof ast;
+			logger.warn(`Parser returned invalid Program type for ${filePath}`, {
+				file_path: filePath,
+				ast_type: astType,
+				recovery: "failed_validation",
+			});
+			return null;
+		}
+
 		return ast;
 	} catch {
 		// Even with recovery options, parsing can still fail
@@ -159,6 +189,18 @@ export function parseFileWithRecovery(filePath: string, content: string): ParseR
 			tokens: true,
 			filePath,
 		});
+
+		// Validate the returned AST is actually a Program node
+		if (!isValidProgram(ast)) {
+			const astType = typeof ast === "object" && ast !== null && "type" in ast ? (ast as any).type : typeof ast;
+			logger.warn(`Parser returned invalid Program type for ${filePath}`, {
+				file_path: filePath,
+				ast_type: astType,
+				recovery: "failed_validation",
+			});
+			throw new Error(`Invalid AST type returned: expected Program, got ${astType}`);
+		}
+
 		return {
 			ast,
 			errors: [],