weavatrix 0.1.0

package/src/scan/discover.inventory.js

@@ -0,0 +1,78 @@
+// Filesystem inventory helpers for repo discovery: size proxy, file/extension census, last commit.
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+
+// Directories never worth walking when sizing a repo (vendored deps, build output, caches).
+const SIZE_SKIP_DIRS = new Set([
+  ".git", "node_modules", "dist", "build", "out", ".next", "coverage", "vendor",
+  ".venv", "venv", "env", "target", "__pycache__", ".idea", ".vscode", ".cache", "bin", "obj"
+]);
+
+// Cheap "size" proxy: count source files in the working tree (skipping the heavy dirs above).
+// Bounded so a pathological tree can't stall the scan.
+export function repoFileCount(dir) {
+  let count = 0;
+  const stack = [dir];
+  while (stack.length) {
+    const cur = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync(cur, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!SIZE_SKIP_DIRS.has(entry.name)) stack.push(join(cur, entry.name));
+      } else if (entry.isFile()) {
+        if (++count >= 100000) return count;
+      }
+    }
+  }
+  return count;
+}
+
+export function repoInventory(dir) {
+  let count = 0;
+  const ext = {};
+  const files = new Set();
+  const stack = [dir];
+  while (stack.length) {
+    const cur = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync(cur, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!SIZE_SKIP_DIRS.has(entry.name)) stack.push(join(cur, entry.name));
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (++count >= 100000) return { count, ext, files };
+      const full = join(cur, entry.name);
+      const rel = full.slice(dir.length).replace(/^[\\/]/, "").replace(/\\/g, "/").toLowerCase();
+      files.add(rel);
+      const m = entry.name.toLowerCase().match(/(\.[a-z0-9]+)$/);
+      if (m) ext[m[1]] = (ext[m[1]] || 0) + 1;
+    }
+  }
+  return { count, ext, files };
+}
+
+// Last commit time (ms) read straight from .git/logs/HEAD — no `git` spawn. Each reflog line is
+// "<old> <new> <Name> <email> <unixtime> <tz>\t<message>"; the unixtime is the token before the tz.
+export function repoLastCommit(dir) {
+  try {
+    const log = readFileSync(join(dir, ".git", "logs", "HEAD"), "utf8").trimEnd();
+    if (!log) return 0;
+    const lastLine = log.slice(log.lastIndexOf("\n") + 1).split("\t")[0];
+    const tokens = lastLine.trim().split(/\s+/);
+    const unixTime = Number(tokens[tokens.length - 2]);
+    return Number.isFinite(unixTime) ? unixTime * 1000 : 0;
+  } catch {
+    return 0;
+  }
+}

package/src/scan/discover.js

@@ -0,0 +1,5 @@
+// Discover local git repos under a folder, browse child folders, and persist per-repo run results.
+// Facade: implementation lives in discover.inventory.js (fs walking / git metadata),
+// discover.stack.js (framework + badge detection) and discover.list.js (repo/folder listing).
+export { cleanVersion, detectFramework, detectRepoStack } from "./discover.stack.js";
+export { listGitRepos, repoBaseName, listChildFolders } from "./discover.list.js";

package/src/scan/discover.list.js

@@ -0,0 +1,79 @@
+// Repo listing: describe direct child git repos of a folder and browse child folders.
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { ROOT_DIR } from "../config.js";
+import { repoFileCount, repoInventory, repoLastCommit } from "./discover.inventory.js";
+import { detectFramework, detectRepoStack } from "./discover.stack.js";
+
+function reposDefaultFolder() {
+  return join(ROOT_DIR, "..", "..");
+}
+
+function describeRepo(dir, name) {
+  const has = (file) => existsSync(join(dir, file));
+  // RUNTIME first — a Bun/Deno project also has a package.json, so check its markers before falling
+  // back to "node". (Fixes Bun repos like edge-analytics being mislabelled "node".)
+  let language = "other";
+  if (has("bun.lock") || has("bun.lockb") || has("bunfig.toml")) language = "bun";
+  else if (has("deno.json") || has("deno.jsonc") || has("deno.lock")) language = "deno";
+  else if (has("package.json")) language = "node";
+  else if (has("go.mod")) language = "go";
+  else if (has("pom.xml") || has("build.gradle")) language = "java";
+  else if (has("requirements.txt") || has("pyproject.toml") || has("setup.py") || has("Pipfile")) language = "python";
+  else if (has("Cargo.toml")) language = "rust";
+  else if (has("composer.json")) language = "php";
+  else if (has("Gemfile")) language = "ruby";
+  // framework detection uses the JS-ecosystem table for bun/deno too (they run npm packages)
+  const fwRuntime = language === "bun" || language === "deno" ? "node" : language;
+  const inventory = repoInventory(dir);
+  const stack = detectRepoStack(dir, inventory);
+  language = stack.languages[0]?.id || stack.runtimes[0]?.id || language;
+  const stackRunsJs = stack.runtimes.some((badge) => ["node", "bun", "deno"].includes(badge.id)) || ["javascript", "typescript"].includes(language);
+  const stackFwRuntime = stackRunsJs ? "node" : language;
+  return {
+    name,
+    path: dir,
+    language,
+    stack,
+    framework: detectFramework(dir, stackFwRuntime || fwRuntime),
+    knipEligible: has("package.json"),
+    size: inventory.count || repoFileCount(dir),
+    lastCommit: repoLastCommit(dir)
+  };
+}
+
+// Only DIRECT child git repos of the opened folder. We do not descend into folders or into
+// repos, so nested/sub-repos are not listed.
+export function listGitRepos(folder) {
+  const root = folder && String(folder).trim() ? String(folder).trim() : reposDefaultFolder();
+  if (!existsSync(root)) throw new Error(`Folder not found: ${root}`);
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch (error) {
+    throw new Error(`Cannot read folder: ${error.message}`);
+  }
+  const repos = entries
+    .filter((entry) => entry.isDirectory() && existsSync(join(root, entry.name, ".git")))
+    .map((entry) => describeRepo(join(root, entry.name), entry.name))
+    .sort((left, right) => left.name.localeCompare(right.name));
+  return { root, repos };
+}
+
+export function repoBaseName(repoPath) {
+  return String(repoPath).split(/[\\/]/).filter(Boolean).pop() || repoPath;
+}
+
+export function listChildFolders(folder) {
+  const root = folder && existsSync(folder) ? folder : reposDefaultFolder();
+  const entries = readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules")
+    .map((entry) => ({
+      name: entry.name,
+      path: join(root, entry.name),
+      isRepo: existsSync(join(root, entry.name, ".git"))
+    }))
+    .sort((left, right) => left.name.localeCompare(right.name));
+  const parent = join(root, "..");
+  return { path: root, parent: parent !== root ? parent : null, entries };
+}

package/src/scan/discover.stack.js

@@ -0,0 +1,227 @@
+// Stack detection for repo cards: frameworks, languages/runtimes, test/infra/deploy badges.
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { INFRA_SERVICES } from "../infra/infra-registry.js";
+import { depMatches, depsFromManifest } from "../infra/infra.js";
+import { repoInventory } from "./discover.inventory.js";
+
+// Web/app frameworks worth surfacing on the repo card, per ecosystem. token → display name; first
+// match (in array order) wins, so list server frameworks before generic UI libs. Versions come from
+// the manifest's declared range (not the installed lockfile — close enough for "which version").
+const FRAMEWORKS = {
+  node: [
+    ["@nestjs/core", "NestJS"], ["express", "Express"], ["fastify", "Fastify"], ["koa", "Koa"],
+    ["@hapi/hapi", "Hapi"], ["hapi", "Hapi"], ["restify", "Restify"], ["hono", "Hono"],
+    ["@adonisjs/core", "AdonisJS"], ["@feathersjs/feathers", "Feathers"], ["sails", "Sails"],
+    ["next", "Next.js"], ["nuxt", "Nuxt"], ["@sveltejs/kit", "SvelteKit"], ["@remix-run/server-runtime", "Remix"],
+    ["@angular/core", "Angular"], ["react", "React"], ["vue", "Vue"], ["svelte", "Svelte"],
+  ],
+  python: [
+    ["django", "Django"], ["fastapi", "FastAPI"], ["flask", "Flask"], ["sanic", "Sanic"],
+    ["tornado", "Tornado"], ["aiohttp", "aiohttp"], ["falcon", "Falcon"], ["bottle", "Bottle"],
+  ],
+  go: [
+    ["github.com/gin-gonic/gin", "Gin"], ["github.com/labstack/echo", "Echo"], ["github.com/gofiber/fiber", "Fiber"],
+    ["github.com/go-chi/chi", "Chi"], ["github.com/gorilla/mux", "Gorilla"], ["github.com/beego/beego", "Beego"],
+  ],
+};
+
+// "^5.2.0" / "~4.18" / "v1.9.1" / ">=2,<3" / "==4.2" → "5.2" (major.minor, range operators stripped).
+export function cleanVersion(raw) {
+  const m = String(raw || "").match(/(\d+)(?:\.(\d+))?/);
+  return m ? (m[2] != null ? `${m[1]}.${m[2]}` : m[1]) : "";
+}
+
+// Read a manifest and return the first framework {name, version} it declares. Cheap: one file read.
+export function detectFramework(dir, runtime) {
+  const read = (file) => { try { return readFileSync(join(dir, file), "utf8"); } catch { return ""; } };
+  const list = FRAMEWORKS[runtime];
+  if (!list) return null;
+  if (runtime === "node") {
+    let pkg;
+    try { pkg = JSON.parse(read("package.json")); } catch { return null; }
+    const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+    for (const [tok, label] of list) if (deps[tok] != null) return { name: label, version: cleanVersion(deps[tok]) };
+  } else if (runtime === "python") {
+    const text = (read("requirements.txt") + "\n" + read("pyproject.toml") + "\n" + read("Pipfile")).toLowerCase();
+    for (const [tok, label] of list) {
+      const m = text.match(new RegExp(`(?:^|[\\s"'\\[])${tok}\\s*[~^>=<! ]*\\s*([0-9][0-9.]*)`, "m"));
+      if (m || new RegExp(`(?:^|[\\s"'\\[])${tok}(?:$|[\\s"'\\],~^>=<])`, "m").test(text)) return { name: label, version: m ? cleanVersion(m[1]) : "" };
+    }
+  } else if (runtime === "go") {
+    const text = read("go.mod");
+    for (const [tok, label] of list) {
+      const m = text.match(new RegExp(`${tok.replace(/[.\\]/g, "\\$&")}(?:/v\\d+)?\\s+v([0-9][0-9.]*)`));
+      if (m) return { name: label, version: cleanVersion(m[1]) };
+    }
+  }
+  return null;
+}
+
+function readRootFile(dir, file) {
+  try {
+    return readFileSync(join(dir, file), "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function readPackage(dir) {
+  try {
+    return JSON.parse(readRootFile(dir, "package.json"));
+  } catch {
+    return null;
+  }
+}
+
+function packageDeps(pkg, includeDev = true) {
+  if (!pkg || typeof pkg !== "object") return {};
+  return {
+    ...(pkg.dependencies || {}),
+    ...(pkg.optionalDependencies || {}),
+    ...(pkg.peerDependencies || {}),
+    ...(includeDev ? pkg.devDependencies || {} : {})
+  };
+}
+
+function manifestDeps(dir) {
+  const out = new Set();
+  for (const file of [
+    "package.json", "go.mod", "go.sum", "requirements.txt", "constraints.txt", "pyproject.toml",
+    "Pipfile", "Cargo.toml", "pom.xml", "build.gradle", "build.gradle.kts", "composer.json", "Gemfile"
+  ]) {
+    if (!existsSync(join(dir, file))) continue;
+    for (const dep of depsFromManifest(file, readRootFile(dir, file))) out.add(dep);
+  }
+  return out;
+}
+
+function addBadge(list, seen, id, label, extra = {}) {
+  if (!id || seen.has(id)) return;
+  seen.add(id);
+  list.push({ id, label, ...extra });
+}
+
+function infraDisplayName(service) {
+  const names = {
+    postgres: "Postgres",
+    mysql: "MySQL",
+    mariadb: "MariaDB",
+    sqlserver: "SQL Server",
+    sqlite: "SQLite",
+    mongodb: "MongoDB",
+    dynamodb: "DynamoDB",
+    elasticsearch: "Elastic",
+    clickhouse: "ClickHouse",
+    influxdb: "InfluxDB",
+    timescaledb: "Timescale",
+    redis: "Redis",
+    valkey: "Valkey",
+    memcached: "Memcached",
+    kafka: "Kafka",
+    rabbitmq: "RabbitMQ",
+    "gcp-pubsub": "Pub/Sub",
+    "azure-servicebus": "Service Bus",
+    keycloak: "Keycloak",
+    "firebase-auth": "Firebase Auth",
+    "oidc-generic": "OIDC",
+    "azure-blob": "Azure Blob"
+  };
+  return names[service.id] || String(service.name || service.id || "").replace(/_/g, " ").replace(/\b\w/g, (m) => m.toUpperCase());
+}
+
+function detectInfraBadges(prodDeps) {
+  const badges = [];
+  const seen = new Set();
+  const visibleKinds = new Set(["db", "ts", "cache", "queue", "cloud"]);
+  for (const service of INFRA_SERVICES) {
+    if (!visibleKinds.has(service.kind)) continue;
+    const hit = (service.deps || []).some((token) => [...prodDeps].some((dep) => depMatches(dep, token)));
+    if (hit) addBadge(badges, seen, service.id, infraDisplayName(service), { kind: service.kind });
+  }
+  return badges;
+}
+
+function detectTestBadges({ dir, pkg, inventory, allDeps }) {
+  const badges = [];
+  const seen = new Set();
+  const deps = new Set(Object.keys(allDeps || {}).map((x) => x.toLowerCase()));
+  const scripts = Object.values(pkg?.scripts || {}).join("\n").toLowerCase();
+  const hasDep = (...names) => names.some((name) => deps.has(name.toLowerCase()));
+  const hasFile = (re) => [...(inventory.files || [])].some((file) => re.test(file));
+  const hasScript = (re) => re.test(scripts);
+
+  if (hasDep("@playwright/test", "playwright") || hasFile(/(^|\/)playwright\.config\.[cm]?[jt]s$/) || hasScript(/\bplaywright\b/)) {
+    addBadge(badges, seen, "playwright", "Playwright", { kind: "e2e" });
+  }
+  if (hasDep("vitest") || hasFile(/(^|\/)vitest\.config\.[cm]?[jt]s$/) || hasScript(/\bvitest\b/)) {
+    addBadge(badges, seen, "vitest", "Vitest", { kind: "unit" });
+  }
+  if (hasDep("jest", "@jest/globals", "ts-jest") || hasFile(/(^|\/)jest\.config\.[cm]?[jt]s$/) || hasScript(/\bjest\b/)) {
+    addBadge(badges, seen, "jest", "Jest", { kind: "unit" });
+  }
+  if (hasDep("cypress") || hasFile(/(^|\/)cypress\.config\.[cm]?[jt]s$/) || hasScript(/\bcypress\b/)) {
+    addBadge(badges, seen, "cypress", "Cypress", { kind: "e2e" });
+  }
+  if (hasDep("mocha") || hasScript(/\bmocha\b/)) addBadge(badges, seen, "mocha", "Mocha", { kind: "unit" });
+  if (hasDep("ava") || hasScript(/\bava\b/)) addBadge(badges, seen, "ava", "AVA", { kind: "unit" });
+  if (hasDep("pytest") || existsSync(join(dir, "pytest.ini")) || hasFile(/(^|\/)test_.*\.py$/)) {
+    addBadge(badges, seen, "pytest", "pytest", { kind: "unit" });
+  }
+  if (existsSync(join(dir, "go.mod")) && hasFile(/_test\.go$/)) addBadge(badges, seen, "go-test", "go test", { kind: "unit" });
+  if (existsSync(join(dir, "Cargo.toml")) && hasFile(/(^|\/)tests\/.*\.rs$/)) addBadge(badges, seen, "cargo-test", "cargo test", { kind: "unit" });
+  return badges;
+}
+
+// Deployment / infra-as-code tooling, detected by file presence. inventory.files is a lowercased,
+// "/"-joined recursive path list (vendored/build dirs already skipped), so a repo's Dockerfile,
+// skaffold.yaml, k8s manifests, helm chart or *.tf light up even when nested.
+function detectDeployBadges(inventory) {
+  const badges = [];
+  const seen = new Set();
+  const files = [...(inventory.files || [])];
+  const hasFile = (re) => files.some((file) => re.test(file));
+  if (hasFile(/(^|\/)(dockerfile|containerfile)(\.[\w.-]+)?$/) || hasFile(/\.dockerfile$/)) addBadge(badges, seen, "docker", "Docker", { kind: "container" });
+  if (hasFile(/(^|\/)(docker-)?compose(\.[\w.-]+)?\.ya?ml$/)) addBadge(badges, seen, "compose", "Compose", { kind: "container" });
+  if (hasFile(/(^|\/)skaffold(\.[\w.-]+)?\.ya?ml$/)) addBadge(badges, seen, "skaffold", "Skaffold", { kind: "deploy" });
+  if (hasFile(/(^|\/)chart\.ya?ml$/) || hasFile(/(^|\/)helm\//)) addBadge(badges, seen, "helm", "Helm", { kind: "orchestration" });
+  if (hasFile(/(^|\/)kustomization\.ya?ml$/) || hasFile(/(^|\/)(k8s|kubernetes|manifests)\/.*\.ya?ml$/)) addBadge(badges, seen, "kubernetes", "K8s", { kind: "orchestration" });
+  if (hasFile(/(^|\/)[^/]+\.tf$/)) addBadge(badges, seen, "terraform", "Terraform", { kind: "iac" });
+  return badges;
+}
+
+export function detectRepoStack(dir, inventory = repoInventory(dir)) {
+  const has = (file) => existsSync(join(dir, file));
+  const pkg = readPackage(dir);
+  const allDeps = packageDeps(pkg, true);
+  const prodDeps = manifestDeps(dir);
+  const ext = inventory.ext || {};
+  const languages = [];
+  const runtimes = [];
+  const seenLang = new Set();
+  const seenRuntime = new Set();
+  const depNames = new Set(Object.keys(allDeps).map((x) => x.toLowerCase()));
+
+  const hasTs = !!(ext[".ts"] || ext[".tsx"] || has("tsconfig.json") || depNames.has("typescript"));
+  const hasJs = !!(ext[".js"] || ext[".jsx"] || ext[".mjs"] || ext[".cjs"] || pkg);
+  if (hasTs) addBadge(languages, seenLang, "typescript", "TS", { title: "TypeScript" });
+  if (hasJs) addBadge(languages, seenLang, "javascript", "JS", { title: "JavaScript" });
+  if (ext[".go"] || has("go.mod")) addBadge(languages, seenLang, "go", "Go", { title: "Go" });
+  if (ext[".py"] || has("requirements.txt") || has("pyproject.toml") || has("setup.py") || has("Pipfile")) addBadge(languages, seenLang, "python", "Python");
+  if (ext[".java"] || has("pom.xml") || has("build.gradle")) addBadge(languages, seenLang, "java", "Java");
+  if (ext[".rs"] || has("Cargo.toml")) addBadge(languages, seenLang, "rust", "Rust");
+  if (ext[".php"] || has("composer.json")) addBadge(languages, seenLang, "php", "PHP");
+  if (ext[".rb"] || has("Gemfile")) addBadge(languages, seenLang, "ruby", "Ruby");
+
+  if (has("bun.lock") || has("bun.lockb") || has("bunfig.toml")) addBadge(runtimes, seenRuntime, "bun", "Bun");
+  if (has("deno.json") || has("deno.jsonc") || has("deno.lock")) addBadge(runtimes, seenRuntime, "deno", "Deno");
+  if (pkg && !seenRuntime.has("bun") && !seenRuntime.has("deno")) addBadge(runtimes, seenRuntime, "node", "Node");
+
+  return {
+    languages,
+    runtimes,
+    tests: detectTestBadges({ dir, pkg, inventory, allDeps }),
+    infra: detectInfraBadges(prodDeps),
+    deploy: detectDeployBadges(inventory)
+  };
+}

package/src/scan/search.core.js

@@ -0,0 +1,24 @@
+// Orchestrator for the cross-repo search: picks ripgrep → git grep → pure-Node engine per the
+// configured engine and delegates to the matching module. Split out of search.js.
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { resolveRg, rgSearch } from "./search.rg.js";
+import { gitSearch } from "./search.git.js";
+import { nodeSearch } from "./search.node.js";
+
+// repos: array of absolute repo paths; mode: "content" | "filename"; engine/rgPath: see resolveRg.
+// Returns { ok, engine, truncated, results:[{repo, path, line, column, preview}] }.
+export async function searchAcrossRepos({ repos, query, mode = "content", cap = 300, engine = "auto", rgPath = "", gitPath = "" } = {}) {
+  const roots = [...new Set((Array.isArray(repos) ? repos : []).filter((p) => p && existsSync(p)).map((p) => resolve(p)))].sort((a, b) => b.length - a.length);
+  const q = String(query || "");
+  if (!roots.length || q.trim().length < 2) return { ok: true, engine: "none", truncated: false, results: [] };
+  const rg = await resolveRg(engine, rgPath);
+  const git = (engine === "auto" || engine === "git") ? String(gitPath || "").trim() || "git" : "";
+  try {
+    if (rg) return await rgSearch(rg, roots, q, mode, cap);
+    if (git) return await gitSearch(git, roots, q, mode, cap);
+    return await nodeSearch(roots, q, mode, cap);
+  } catch (error) {
+    return { ok: false, error: error.message, engine: rg ? "ripgrep" : git ? "git-grep" : "node-fallback", results: [] };
+  }
+}

package/src/scan/search.git.js

@@ -0,0 +1,102 @@
+// git grep / git ls-files engine for the cross-repo search — the fast native fallback when no
+// ripgrep can be resolved (falls back to the pure-Node scanner per repo). Split out of search.js.
+import { join } from "node:path";
+import { runCommand } from "../process.js";
+import { repoBaseName } from "./discover.js";
+import { SKIP_DIRS, nodeSearch } from "./search.node.js";
+
+// ---- git grep native fallback ------------------------------------------------------------------
+const GIT_PATHSPECS = [
+  ".",
+  ...[...SKIP_DIRS].map((dir) => `:(exclude)${dir}/**`)
+];
+
+function gitArgs(root, subcommand, args) {
+  return ["-C", root, "-c", "core.quotePath=false", subcommand, ...args];
+}
+
+function parseGitGrepLine(line) {
+  const m = /^(.+?):(\d+):(\d+):(.*)$/.exec(line);
+  if (!m) return null;
+  return {
+    relPath: m[1],
+    line: Number(m[2]) || 0,
+    column: Math.max(0, (Number(m[3]) || 1) - 1),
+    preview: m[4]
+  };
+}
+
+function pathHasSkippedDir(relPath) {
+  return String(relPath || "")
+    .split(/[\\/]+/)
+    .some((part) => SKIP_DIRS.has(part));
+}
+
+async function gitSearchRoot(git, root, query, mode, cap) {
+  if (mode === "filename") {
+    const r = await runCommand(git, gitArgs(root, "ls-files", ["-z", "--cached", "--others", "--exclude-standard", "--", ...GIT_PATHSPECS]), { timeoutMs: 15000 });
+    if (r.exitCode !== 0) return { ok: false, error: (r.stderr || r.stdout || "git ls-files failed").slice(0, 300) };
+    const lower = query.toLowerCase();
+    const ci = query === lower;
+    const hitIdx = (s) => (ci ? s.toLowerCase().indexOf(lower) : s.indexOf(query));
+    const files = String(r.stdout || "").split("\0").filter(Boolean);
+    const results = [];
+    for (const relPath of files) {
+      if (results.length >= cap) break;
+      if (pathHasSkippedDir(relPath)) continue;
+      const idx = hitIdx(relPath);
+      if (idx >= 0) results.push({ repo: repoBaseName(root), path: join(root, relPath), line: 0, column: idx, preview: relPath.replace(/\\/g, "/") });
+    }
+    return { ok: true, truncated: files.length > results.length && results.length >= cap, results };
+  }
+
+  const r = await runCommand(
+    git,
+    gitArgs(root, "grep", ["-n", "--column", "-I", "--untracked", "-F", "-e", query, "--", ...GIT_PATHSPECS]),
+    { timeoutMs: 20000 }
+  );
+  if (r.exitCode !== 0 && r.exitCode !== 1) return { ok: false, error: (r.stderr || r.stdout || "git grep failed").slice(0, 300) };
+  const lines = String(r.stdout || "").split(/\r?\n/).filter(Boolean);
+  const results = [];
+  for (const line of lines) {
+    if (results.length >= cap) break;
+    const parsed = parseGitGrepLine(line);
+    if (!parsed || pathHasSkippedDir(parsed.relPath)) continue;
+    results.push({
+      repo: repoBaseName(root),
+      path: join(root, parsed.relPath),
+      line: parsed.line,
+      column: parsed.column,
+      preview: parsed.preview.slice(0, 400)
+    });
+  }
+  return { ok: true, truncated: lines.length > results.length && results.length >= cap, results };
+}
+
+export async function gitSearch(git, roots, query, mode, cap) {
+  const results = [];
+  let truncated = false;
+  let usedNodeFallback = false;
+  for (const root of roots) {
+    if (results.length >= cap) {
+      truncated = true;
+      break;
+    }
+    let r;
+    try {
+      r = await gitSearchRoot(git, root, query, mode, cap - results.length);
+    } catch {
+      r = { ok: false };
+    }
+    if (!r.ok) {
+      usedNodeFallback = true;
+      const fallback = await nodeSearch([root], query, mode, cap - results.length);
+      results.push(...fallback.results);
+      truncated ||= fallback.truncated;
+      continue;
+    }
+    results.push(...r.results);
+    truncated ||= r.truncated;
+  }
+  return { ok: true, engine: usedNodeFallback ? "git-grep+node-fallback" : "git-grep", truncated, results };
+}

package/src/scan/search.js

@@ -0,0 +1,9 @@
+// Fast cross-repo search: file NAMES + TEXT inside files, across every open repo at once. Backed by
+// ripgrep when one can be resolved (bundled / VS Code / Cursor / PATH), git grep as a fast native
+// fallback, and finally a dependency-free Node fs-walk fallback. One reusable searchAcrossRepos() so
+// a future MCP server can call the same code.
+// Facade: the implementation lives in search.rg.js (ripgrep), search.git.js (git grep),
+// search.node.js (pure-Node walker), search.core.js (orchestrator) and search.preview.js.
+export { resolveRgInfo, resolveRg } from "./search.rg.js";
+export { searchAcrossRepos } from "./search.core.js";
+export { readFileForPreview, writeFileForPreview } from "./search.preview.js";

package/src/scan/search.node.js

@@ -0,0 +1,83 @@
+// Dependency-free Node fs-walk search engine for the cross-repo search, plus the shared SKIP_DIRS
+// list. Split out of search.js.
+import { statSync } from "node:fs";
+import { readFile, opendir } from "node:fs/promises";
+import { join, relative } from "node:path";
+import { repoBaseName } from "./discover.js";
+
+export const SKIP_DIRS = new Set([".git", "node_modules", "dist", "build", "out", "coverage", ".next", ".cache", ".turbo", "vendor", "__pycache__", ".venv"]);
+
+// ---- Node fs-walk fallback (no ripgrep) ---------------------------------------------------------
+export async function nodeSearch(roots, query, mode, cap) {
+  const isContent = mode !== "filename";
+  const lower = query.toLowerCase();
+  const ci = query === lower; // smart-case: case-insensitive unless the query has an uppercase letter
+  const hit = (s) => (ci ? s.toLowerCase().includes(lower) : s.includes(query));
+  const hitIdx = (s) => (ci ? s.toLowerCase().indexOf(lower) : s.indexOf(query));
+  const results = [];
+  let truncated = false;
+  async function walk(dir, root) {
+    if (results.length >= cap) {
+      truncated = true;
+      return;
+    }
+    let dh;
+    try {
+      dh = await opendir(dir);
+    } catch {
+      return;
+    }
+    for await (const ent of dh) {
+      if (results.length >= cap) {
+        truncated = true;
+        break;
+      }
+      const full = join(dir, ent.name);
+      if (ent.isDirectory()) {
+        if (!SKIP_DIRS.has(ent.name)) await walk(full, root);
+        continue;
+      }
+      if (!ent.isFile()) continue;
+      const relPath = relative(root, full).replace(/\\/g, "/");
+      if (!isContent) {
+        const nameIdx = hitIdx(ent.name);
+        const relIdx = hitIdx(relPath);
+        if (nameIdx >= 0 || relIdx >= 0) results.push({ repo: repoBaseName(root), path: full, line: 0, column: Math.max(0, relIdx >= 0 ? relIdx : nameIdx), preview: relPath });
+        continue;
+      }
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.size > 1500000) continue;
+      let buf;
+      try {
+        buf = await readFile(full);
+      } catch {
+        continue;
+      }
+      if (buf.includes(0)) continue; // binary
+      const linesArr = buf.toString("utf8").split(/\r?\n/);
+      let fileHits = 0;
+      for (let i = 0; i < linesArr.length; i++) {
+        if (results.length >= cap) {
+          truncated = true;
+          break;
+        }
+        const idx = hitIdx(linesArr[i]);
+        if (idx >= 0) {
+          results.push({ repo: repoBaseName(root), path: full, line: i + 1, column: idx, preview: linesArr[i].slice(0, 400) });
+          fileHits++;
+          if (fileHits >= 40) break; // match rgSearch's --max-count 40 per file
+        }
+      }
+    }
+  }
+  for (const root of roots) {
+    if (results.length >= cap) break;
+    await walk(root, root);
+  }
+  return { ok: true, engine: "node-fallback", truncated, results };
+}

package/src/scan/search.preview.js

@@ -0,0 +1,49 @@
+// In-app search preview file access: read/write a file's text ONLY if it sits under one of the
+// known repo roots. Split out of search.js.
+import { existsSync, statSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+
+// Resolve a preview/edit target ONLY if it sits UNDER one of the known repo roots — the shared guard
+// for files:read and files:write. Returns { ok:true, path } or { ok:false, error }.
+function resolveRepoFilePath(filePath, repos) {
+  const roots = (Array.isArray(repos) ? repos : []).filter(Boolean).map((p) => resolve(p));
+  const abs = resolve(String(filePath || ""));
+  if (!abs || !roots.some((r) => abs === r || abs.startsWith(r + sep))) return { ok: false, error: "Path is outside the known repos" };
+  if (!existsSync(abs)) return { ok: false, error: "File not found" };
+  return { ok: true, path: abs };
+}
+
+// Read a file's text for the in-app preview — only if it sits UNDER one of the known repo roots.
+export async function readFileForPreview(filePath, repos) {
+  const resolved = resolveRepoFilePath(filePath, repos);
+  if (resolved.ok === false) return resolved;
+  const abs = resolved.path;
+  let st;
+  try {
+    st = statSync(abs);
+  } catch {
+    return { ok: false, error: "Cannot stat file" };
+  }
+  if (st.size > 2000000) return { ok: false, error: "File too large to preview (>2 MB) — open it in VS Code." };
+  try {
+    return { ok: true, path: abs, content: await readFile(abs, "utf8") };
+  } catch (error) {
+    return { ok: false, error: error.message };
+  }
+}
+
+// Write edited text back from the Search preview's Edit mode — same repo-root guard as the read, and
+// only over files that already exist (the in-app editor touches up files, it never creates them).
+export async function writeFileForPreview(filePath, repos, content) {
+  const resolved = resolveRepoFilePath(filePath, repos);
+  if (resolved.ok === false) return resolved;
+  const text = String(content ?? "");
+  if (text.length > 2000000) return { ok: false, error: "Edited text too large to save (>2 MB) — use VS Code." };
+  try {
+    await writeFile(resolved.path, text, "utf8");
+    return { ok: true, path: resolved.path };
+  } catch (error) {
+    return { ok: false, error: error.message };
+  }
+}