weavatrix 0.3.7 → 0.3.9

package/src/analysis/internal-audit/repo-files.js

@@ -1,7 +1,6 @@
 import {readFileSync, readdirSync} from 'node:fs'
 import {join} from 'node:path'
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../../child-env.js'
+import {runGit} from '../../git-exec.js'
 import {filterWeavatrixIgnored} from '../../path-ignore.js'
 
 export const readText = (path) => {
@@ -29,10 +28,7 @@ const SKIP_DIRS = new Set([
 
 export function listRepoFiles(repoRoot) {
     try {
-        const result = spawnSync('git', ['-C', repoRoot, 'ls-files', '--cached', '--others', '--exclude-standard', '-z'], {
-            encoding: 'utf8', windowsHide: true, timeout: 15_000, maxBuffer: 32 * 1024 * 1024,
-            env: childProcessEnv(),
-        })
+        const result = runGit(repoRoot, ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], {timeout: 15_000, maxBuffer: 32 * 1024 * 1024})
         if (result.status === 0) {
             const files = String(result.stdout || '').split('\0').filter(Boolean).map((file) => file.replace(/\\/g, '/'))
             return filterWeavatrixIgnored(repoRoot, files)

package/src/git-exec.js

@@ -0,0 +1,67 @@
+// The single chokepoint for launching git. Every git subprocess in the package routes through here,
+// so there is one place that applies `-C <repoRoot>` containment, a credential-stripped child
+// environment, a hidden Windows window and a bounded timeout — instead of a dozen near-identical
+// spawnSync wrappers scattered across the analysis, graph and MCP layers.
+import { spawnSync, spawn } from "node:child_process";
+import { childProcessEnv } from "./child-env.js";
+
+// Synchronous git. Returns the raw spawnSync result ({status, stdout, stderr, error}) so callers keep
+// their existing status/stdout/error handling. encoding defaults to "utf8" (pass "buffer" for binary
+// stdout); maxBuffer and stdio are forwarded only when provided so Node's defaults are preserved.
+export function runGit(repoRoot, args, options = {}) {
+  const spawnOptions = {
+    encoding: options.encoding ?? "utf8",
+    windowsHide: true,
+    timeout: options.timeout ?? 8000,
+    env: childProcessEnv(options.env),
+  };
+  if (options.maxBuffer != null) spawnOptions.maxBuffer = options.maxBuffer;
+  if (options.stdio != null) spawnOptions.stdio = options.stdio;
+  return spawnSync("git", ["-C", repoRoot, ...args], spawnOptions);
+}
+
+// Streaming git for the history collector: byte-bounded stdout, a hard timeout that SIGKILLs the child,
+// and a resolved {stdout, stderr, exitCode, truncated}. The caller owns cwd/env so reads can be scoped
+// to a specific worktree.
+export function boundedGitCommand(command, args, options) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd, env: options.env, shell: false, windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    const stdout = [], stderr = [];
+    let stdoutBytes = 0, stderrBytes = 0, truncated = false, timedOut = false, settled = false;
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      callback();
+    };
+    const stop = () => { try { child.kill("SIGKILL"); } catch { /* process already exited */ } };
+    const timer = setTimeout(() => { timedOut = true; stop(); }, options.timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+      if (truncated) return;
+      const remaining = options.maxOutputBytes - stdoutBytes;
+      if (remaining <= 0) { truncated = true; stop(); return; }
+      const kept = chunk.length <= remaining ? chunk : chunk.subarray(0, remaining);
+      stdout.push(kept); stdoutBytes += kept.length;
+      if (kept.length !== chunk.length) { truncated = true; stop(); }
+    });
+    child.stderr?.on("data", (chunk) => {
+      const remaining = 64 * 1024 - stderrBytes;
+      if (remaining <= 0) return;
+      const kept = chunk.length <= remaining ? chunk : chunk.subarray(0, remaining);
+      stderr.push(kept); stderrBytes += kept.length;
+    });
+    child.on("error", (error) => finish(() => reject(error)));
+    child.on("close", (exitCode) => finish(() => {
+      if (timedOut) return reject(new Error("git history collection timed out"));
+      resolve({
+        stdout: Buffer.concat(stdout),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        exitCode: Number(exitCode ?? 1),
+        truncated,
+      });
+    }));
+  });
+}

package/src/graph/freshness-probe.js

@@ -2,10 +2,9 @@
 // authority when something changed; this exact Git/worktree token is safe to cache in-process and in
 // versioned graph metadata when HEAD + dirty/untracked/control-file content remain unchanged.
 import {createHash} from 'node:crypto'
-import {spawnSync} from 'node:child_process'
 import {readFileSync, statSync} from 'node:fs'
 import {createRequire} from 'node:module'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 import {createRepoBoundary} from '../repo-path.js'
 
 const REPOSITORY_FRESHNESS_PROBE_V = 1
@@ -34,9 +33,7 @@ const CONTROL_FILES = ['.gitignore', '.weavatrixignore', '.weavatrix.json']
 const MAX_CONTROL_BYTES = 1_000_000
 
 function git(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {
-        encoding: 'buffer', timeout: 8000, windowsHide: true, env: childProcessEnv(), maxBuffer: 16 * 1024 * 1024,
-    })
+    const result = runGit(repoRoot, args, {encoding: 'buffer', maxBuffer: 16 * 1024 * 1024})
     return result.status === 0 ? Buffer.from(result.stdout || '') : null
 }
 

package/src/graph/internal-builder.langs.js

@@ -5,10 +5,9 @@
 // build works — and Electron main runs Node, so this needs no external runtime.
 import { readdirSync, statSync, realpathSync } from "node:fs";
 import { join, extname, dirname } from "node:path";
-import { execFileSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { isPathInside } from "../repo-path.js";
-import { childProcessEnv } from "../child-env.js";
+import { runGit } from "../git-exec.js";
 import { filterWeavatrixIgnored } from "../path-ignore.js";
 import {trustedGrammarWasm, trustedRuntimeWasm} from './parser-artifact-boundary.js'
 import LANG_JS from "./builder/lang-js.js";
@@ -112,17 +111,11 @@ function walkFallback(dir, acc = [], seen = new Set(), depth = 0, rootReal = nul
 // A repository may be opened without Git (or Git may be unavailable), so failure is deliberately a signal to
 // use the boundary-safe walker above rather than a build failure.
 function gitFileUniverse(dir) {
-  let raw;
-  try {
-    raw = execFileSync("git", ["-C", dir, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
-      encoding: "utf8",
-      windowsHide: true,
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 15_000,
-      maxBuffer: 64 * 1024 * 1024,
-      env: childProcessEnv(),
-    });
-  } catch { return null; }
+  const lsFiles = runGit(dir, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
+    stdio: ["ignore", "pipe", "ignore"], timeout: 15_000, maxBuffer: 64 * 1024 * 1024,
+  });
+  if (lsFiles.status !== 0 || lsFiles.error) return null;
+  const raw = lsFiles.stdout;
 
   // `git -C <dir>` also succeeds when <dir> is merely nested under some parent repository. If that
   // nested directory is ignored by the parent, `ls-files` is empty even though <dir> can be a valid
@@ -130,17 +123,11 @@ function gitFileUniverse(dir) {
   // that one ambiguous case, fall back to the boundary-safe walker. Preserve an empty universe for
   // an actual Git root so ignored files do not leak back into its graph.
   if (!raw) {
-    try {
-      const top = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
-        encoding: "utf8",
-        windowsHide: true,
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 15_000,
-        maxBuffer: 1024 * 1024,
-        env: childProcessEnv(),
-      }).trim();
-      if (realpathSync.native(top) !== realpathSync.native(dir)) return null;
-    } catch { return null; }
+    const top = runGit(dir, ["rev-parse", "--show-toplevel"], {
+      stdio: ["ignore", "pipe", "ignore"], timeout: 15_000, maxBuffer: 1024 * 1024,
+    });
+    if (top.status !== 0 || top.error) return null;
+    if (realpathSync.native(String(top.stdout).trim()) !== realpathSync.native(dir)) return null;
   }
 
   let rootReal;

package/src/mcp/git-output.mjs

@@ -1,10 +1,7 @@
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 
 export function gitLines(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {
-        encoding: 'utf8', timeout: 8000, env: childProcessEnv(), windowsHide: true,
-    })
+    const result = runGit(repoRoot, args)
     if (result.status !== 0) return null
     return String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
 }

package/src/mcp/graph/context-state.mjs

@@ -1,7 +1,6 @@
 import {readFileSync, statSync} from 'node:fs'
 import {join} from 'node:path'
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../../child-env.js'
+import {runGit} from '../../git-exec.js'
 import {resolveRepoPath} from '../../repo-path.js'
 import {mergePrecisionOverlay, precisionSemanticInputsMatch, readPrecisionOverlay} from '../../precision/lsp-overlay.js'
 
@@ -14,19 +13,19 @@ export function graphStaleness(ctx) {
     try { info.builtAt = statSync(ctx.graphPath).mtime } catch { /* no graph file */ }
     if (ctx.repoRoot && info.builtAt) {
         try {
-            const head = spawnSync('git', ['-C', ctx.repoRoot, 'log', '-1', '--format=%cI'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+            const head = runGit(ctx.repoRoot, ['log', '-1', '--format=%cI'], {timeout: 4000})
             const iso = (head.stdout || '').trim()
             if (head.status === 0 && iso) {
                 info.headAt = new Date(iso)
                 if (info.headAt > info.builtAt) {
                     info.stale = true
-                    const count = spawnSync('git', ['-C', ctx.repoRoot, 'rev-list', '--count', `--since=${info.builtAt.toISOString()}`, 'HEAD'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+                    const count = runGit(ctx.repoRoot, ['rev-list', '--count', `--since=${info.builtAt.toISOString()}`, 'HEAD'], {timeout: 4000})
                     if (count.status === 0) info.behind = Number(count.stdout.trim()) || null
                 }
             }
         } catch { /* git unavailable */ }
         try {
-            const status = spawnSync('git', ['-C', ctx.repoRoot, 'status', '--porcelain'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+            const status = runGit(ctx.repoRoot, ['status', '--porcelain'], {timeout: 4000})
             if (status.status === 0) {
                 let newer = 0
                 for (const line of String(status.stdout || '').split(/\r?\n/).filter(Boolean).slice(0, 200)) {

package/src/mcp/health/audit-format.mjs

@@ -1,6 +1,5 @@
-import {spawnSync} from 'node:child_process'
 import {summarizeFindings} from '../../analysis/findings.js'
-import {childProcessEnv} from '../../child-env.js'
+import {runGit} from '../../git-exec.js'
 import {createPathClassifier, hasPathClass} from '../../path-classification.js'
 
 const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
@@ -179,9 +178,7 @@ export const formatOrdinaryAudit = (audit, args, findings = audit.findings, head
 }
 
 export const gitUntracked = (repoRoot) => {
-    const result = spawnSync('git', ['-C', repoRoot, 'ls-files', '--others', '--exclude-standard'], {
-        encoding: 'utf8', timeout: 8000, maxBuffer: 2 * 1024 * 1024, env: childProcessEnv(), windowsHide: true,
-    })
+    const result = runGit(repoRoot, ['ls-files', '--others', '--exclude-standard'], {maxBuffer: 2 * 1024 * 1024})
     if (result.status !== 0) return {
         ok: false,
         files: [],

package/src/mcp/tools-impact-change.mjs

@@ -1,7 +1,6 @@
 // Symbol-aware change_impact implementation, isolated from the other hot impact tools so its
 // classifier/evidence contract can be tested without perturbing get_dependents or graph_diff.
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 import {fileOfId} from '../graph/node-id.js'
 import {classifyChangeImpact} from '../analysis/change-classification.js'
 import {readCoverageForRepo} from '../analysis/coverage-reports.js'
@@ -12,7 +11,7 @@ import {gitLines} from './git-output.mjs'
 import {toolResult} from './tool-result.mjs'
 
 function gitValue(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
+    const result = runGit(repoRoot, args)
     if (result.status !== 0) return null
     return String(result.stdout || '').trim() || null
 }

package/src/mcp-rg.mjs

@@ -1,9 +1,7 @@
 import { readdirSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { spawnSync } from 'node:child_process'
-import { childProcessEnv } from './child-env.js'
 import { createRequire } from 'node:module'
-import process from 'node:process'
+import { runCommandSync } from './process.js'
 
 const rgInInstall = (base) => [
     join(base, 'resources', 'app', 'node_modules', '@vscode', 'ripgrep', 'bin', 'rg.exe'),
@@ -43,7 +41,7 @@ export function createRgResolver(selfDir) {
         } catch { /* optional packaged ripgrep path */ }
         for (const c of editorRgCandidates()) if (existsSync(c)) return (rgPath = c)
         try {
-            const probe = spawnSync(process.platform === 'win32' ? 'where' : 'which', ['rg'], {encoding: 'utf8', env: childProcessEnv(), timeout: 3000, windowsHide: true})
+            const probe = runCommandSync(process.platform === 'win32' ? 'where' : 'which', ['rg'], {timeout: 3000})
             const p = probe.status === 0 ? probe.stdout.split(/\r?\n/)[0].trim() : ''
             if (p && existsSync(p)) return (rgPath = p)
         } catch { /* optional PATH probe */ }

package/src/mcp-source-tools.mjs

@@ -1,8 +1,7 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
-import { spawnSync } from 'node:child_process'
 import { extname, isAbsolute, join, relative, resolve } from 'node:path'
 import { resolveRepoPath } from './repo-path.js'
-import { childProcessEnv } from './child-env.js'
+import { runCommandSync } from './process.js'
 import { toolResult } from './mcp/tool-result.mjs'
 
 const SEARCH_SKIP = new Set(['.git', 'node_modules', 'dist', 'build', 'out', '.next', 'coverage', 'vendor', '.venv', 'venv', 'env', 'target', '__pycache__', '.idea', '.vscode', '.cache', 'bin', 'obj', 'weavatrix-graphs'])
@@ -11,7 +10,7 @@ const MAX_SEARCH_FILE_BYTES = 1024 * 1024
 const MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024
 const MAX_SOURCE_CONTEXT_LINES = 1000
 
-function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spawnRg = spawnSync) {
+function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spawnRg = runCommandSync) {
     const rg = resolveRg()
     if (!rg) return null
     // Exclude node_modules explicitly: --hidden + the default gitignore stack is the only thing that
@@ -24,7 +23,7 @@ function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spa
     // against repository-relative paths on Windows too. Passing an absolute search root makes rg
     // compare the glob with a drive-prefixed path and silently return no matches.
     args.push('--', query, '.')
-    const res = spawnRg(rg, args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000, env: childProcessEnv() })
+    const res = spawnRg(rg, args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000 })
     if (res.status !== 0 && res.status !== 1) return null
     const out = []
     for (const line of (res.stdout || '').split(/\r?\n/)) {
@@ -93,7 +92,7 @@ function nodeGrep(repoRoot, query, { isRegex, glob, maxResults }) {
     return out
 }
 
-export function searchCode({ repoRoot, resolveRg, spawnRg = spawnSync }, { query, is_regex = false, max_results = 40, glob } = {}) {
+export function searchCode({ repoRoot, resolveRg, spawnRg = runCommandSync }, { query, is_regex = false, max_results = 40, glob } = {}) {
     if (!query) return 'Provide a "query" string.'
     if (!repoRoot || !existsSync(repoRoot)) return 'Source search unavailable: repo root not provided to this MCP server.'
     const max = Math.max(1, Math.min(200, Number(max_results) || 40))

package/src/process.js

@@ -1,5 +1,5 @@
 // Subprocess runner shared by the search engines and security sweeps.
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { childProcessEnv } from "./child-env.js";
 
 // Windows: .cmd/.ps1 shims (npx, etc.) can't be spawned directly by Node — they need a
@@ -76,3 +76,20 @@ export function runCommand(command, args = [], options = {}) {
     child.on("close", (code) => finish(() => (timedOut ? reject(new Error("Command timed out")) : resolve({ stdout, stderr, exitCode: code }))));
   });
 }
+
+// Synchronous run-and-collect variant for callers that resolve a real binary and read its output in
+// one shot (ripgrep resolution/search, tar extraction). These launch a resolved .exe or bare binary
+// directly, so no shell quoting is needed; the child env is stripped of connector secrets and a
+// bounded timeout/buffer applies. Returns the raw spawnSync result ({status, stdout, stderr, error}).
+export function runCommandSync(command, args = [], options = {}) {
+  const spawnOptions = {
+    cwd: options.cwd || undefined,
+    encoding: options.encoding ?? "utf8",
+    env: childProcessEnv(options.env),
+    windowsHide: true,
+  };
+  if (options.timeout != null) spawnOptions.timeout = options.timeout;
+  if (options.maxBuffer != null) spawnOptions.maxBuffer = options.maxBuffer;
+  if (options.stdio != null) spawnOptions.stdio = options.stdio;
+  return spawnSync(command, args, spawnOptions);
+}