weavatrix 0.3.8 → 0.3.9

package/docs/releases/v0.3.9.md

@@ -0,0 +1,36 @@
+# Weavatrix 0.3.9
+
+0.3.9 consolidates every subprocess launch behind a small number of audited
+chokepoints. Tool behavior and output are unchanged — verified byte-identical
+against 0.3.8 on real repositories.
+
+## Single-chokepoint subprocess execution
+
+Git and other subprocess launches were scattered across roughly fifteen modules,
+each with its own near-identical spawn wrapper. They now route through two
+focused modules:
+
+- **git** — every git command runs through `src/git-exec.js`: `runGit` for
+  synchronous run-and-collect calls and `boundedGitCommand` for the streaming
+  history collector.
+- **everything else** — ripgrep resolution and search, `tar` archive extraction,
+  and `where`/`which` binary probing run through `src/process.js`: the existing
+  async `runCommand` plus a new synchronous `runCommandSync`.
+
+Every launch now applies the same credential-stripped child environment,
+`windowsHide`, bounded timeout, and `-C <repoRoot>`/`cwd` containment in one
+place. The number of modules importing `node:child_process` drops from fifteen
+to four — the two runners plus the long-lived language-server client — removing
+duplicated wrappers and making the whole process surface auditable from a single
+point.
+
+This is a pure refactor: graph construction, change impact, Health, history and
+search produce identical results. A byte-level comparison of the entire graph
+(every node, edge and external import, hashed with SHA-256) against the published
+0.3.8 matched exactly on the analytics, controller-rest-api and Weavatrix
+repositories.
+
+## Minor
+
+Removed two redundant module imports (`node:perf_hooks`, `node:process`) that
+re-imported values already available as Node globals.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -42,6 +42,7 @@
     "docs/releases/v0.3.6.md",
     "docs/releases/v0.3.7.md",
     "docs/releases/v0.3.8.md",
+    "docs/releases/v0.3.9.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/scripts/run-agent-task-benchmark.mjs

@@ -1,6 +1,5 @@
 import {readFileSync} from 'node:fs'
 import {pathToFileURL} from 'node:url'
-import {performance} from 'node:perf_hooks'
 import {retrieveTaskContext} from '../src/analysis/task-retrieval.js'
 
 function graphFixture() {

package/src/analysis/change-classification.js

@@ -1,6 +1,5 @@
 // Symbol-aware git-diff classification for change_impact.
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 import {createPathClassifier} from '../path-classification.js'
 import {parseZeroContextDiff} from './change-classification/diff-parser.js'
 import {
@@ -33,13 +32,10 @@ function recoverBoundedDiff(repoRoot, base, files, limits) {
             fallbackFiles.push(...files.slice(index))
             break
         }
-        const result = spawnSync('git', [
-            '-C', repoRoot, 'diff', '--no-ext-diff', '--find-renames', '--no-color',
+        const result = runGit(repoRoot, [
+            'diff', '--no-ext-diff', '--find-renames', '--no-color',
             '--unified=0', String(base), '--', files[index],
-        ], {
-            encoding: 'utf8', windowsHide: true, timeout: Math.min(2_000, remainingMs),
-            maxBuffer: remainingBytes + 1, env: childProcessEnv(),
-        })
+        ], {timeout: Math.min(2_000, remainingMs), maxBuffer: remainingBytes + 1})
         const chunk = String(result.stdout || '')
         if (result.status !== 0 || !chunk || Buffer.byteLength(chunk) > remainingBytes) {
             fallbackFiles.push(files[index])
@@ -51,11 +47,8 @@ function recoverBoundedDiff(repoRoot, base, files, limits) {
 }
 
 function runGitDiff(repoRoot, base, limits) {
-    const args = ['-C', repoRoot, 'diff', '--no-ext-diff', '--find-renames', '--no-color', '--unified=0', String(base), '--']
-    const result = spawnSync('git', args, {
-        encoding: 'utf8', windowsHide: true, timeout: 12_000,
-        maxBuffer: limits.maxDiffBytes + 1, env: childProcessEnv(),
-    })
+    const args = ['diff', '--no-ext-diff', '--find-renames', '--no-color', '--unified=0', String(base), '--']
+    const result = runGit(repoRoot, args, {timeout: 12_000, maxBuffer: limits.maxDiffBytes + 1})
     const output = String(result.stdout || '')
     const oversized = result.error?.code === 'ENOBUFS' || Buffer.byteLength(output) > limits.maxDiffBytes
     if (result.status === 0 && !oversized) return {available: true, text: output, error: null}
@@ -63,12 +56,9 @@ function runGitDiff(repoRoot, base, limits) {
     let fallbackTruncated = false
     let recoveredText = ''
     if (oversized) {
-        const names = spawnSync('git', [
-            '-C', repoRoot, 'diff', '--name-only', '-z', '--no-ext-diff', '--find-renames', String(base), '--',
-        ], {
-            encoding: 'utf8', windowsHide: true, timeout: 12_000,
-            maxBuffer: Math.max(64 * 1024, limits.maxFiles * 4_096), env: childProcessEnv(),
-        })
+        const names = runGit(repoRoot, [
+            'diff', '--name-only', '-z', '--no-ext-diff', '--find-renames', String(base), '--',
+        ], {timeout: 12_000, maxBuffer: Math.max(64 * 1024, limits.maxFiles * 4_096)})
         if (names.status === 0) {
             const all = String(names.stdout || '').split('\0').map(normalizeChangePath).filter(Boolean)
             const boundedFiles = [...new Set(all)].sort((a, b) => a.localeCompare(b)).slice(0, limits.maxFiles)

package/src/analysis/git-history/collector.js

@@ -1,4 +1,3 @@
-import {spawn} from 'node:child_process'
 import {isWeavatrixIgnored} from '../../path-ignore.js'
 import {
     boundedHistoryInteger,
@@ -10,48 +9,7 @@ import {
 const HEADER_SEPARATOR = '\x1e'
 const FIELD_SEPARATOR = '\x1f'
 
-export function boundedGitCommand(command, args, options) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
-            cwd: options.cwd, env: options.env, shell: false, windowsHide: true,
-            stdio: ['ignore', 'pipe', 'pipe'],
-        })
-        const stdout = [], stderr = []
-        let stdoutBytes = 0, stderrBytes = 0, truncated = false, timedOut = false, settled = false
-        const finish = (callback) => {
-            if (settled) return
-            settled = true
-            clearTimeout(timer)
-            callback()
-        }
-        const stop = () => { try { child.kill('SIGKILL') } catch { /* process already exited */ } }
-        const timer = setTimeout(() => { timedOut = true; stop() }, options.timeoutMs)
-        child.stdout?.on('data', (chunk) => {
-            if (truncated) return
-            const remaining = options.maxOutputBytes - stdoutBytes
-            if (remaining <= 0) { truncated = true; stop(); return }
-            const kept = chunk.length <= remaining ? chunk : chunk.subarray(0, remaining)
-            stdout.push(kept); stdoutBytes += kept.length
-            if (kept.length !== chunk.length) { truncated = true; stop() }
-        })
-        child.stderr?.on('data', (chunk) => {
-            const remaining = 64 * 1024 - stderrBytes
-            if (remaining <= 0) return
-            const kept = chunk.length <= remaining ? chunk : chunk.subarray(0, remaining)
-            stderr.push(kept); stderrBytes += kept.length
-        })
-        child.on('error', (error) => finish(() => reject(error)))
-        child.on('close', (exitCode) => finish(() => {
-            if (timedOut) return reject(new Error('git history collection timed out'))
-            resolve({
-                stdout: Buffer.concat(stdout),
-                stderr: Buffer.concat(stderr).toString('utf8'),
-                exitCode: Number(exitCode ?? 1),
-                truncated,
-            })
-        }))
-    })
-}
+// git subprocess execution (sync runGit + streaming boundedGitCommand) lives in ../../git-exec.js.
 
 const statNumber = (value) => value === '-'
     ? {value: 0, binary: true}

package/src/analysis/git-history.js

@@ -3,7 +3,8 @@ import {childProcessEnv} from '../child-env.js'
 import {createRepoBoundary} from '../repo-path.js'
 import {loadWeavatrixIgnore} from '../path-ignore.js'
 import {buildGitHistoryAnalytics} from './git-history/analytics.js'
-import {boundedGitCommand, parseGitNumstatLog} from './git-history/collector.js'
+import {parseGitNumstatLog} from './git-history/collector.js'
+import {boundedGitCommand} from '../git-exec.js'
 import {
     boundedHistoryInteger,
     GIT_FORMAT,

package/src/analysis/git-ref-graph.js

@@ -4,18 +4,15 @@
 import {mkdtempSync, mkdirSync, rmSync} from 'node:fs'
 import {join} from 'node:path'
 import {tmpdir} from 'node:os'
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
+import {runCommandSync} from '../process.js'
 import {buildInternalGraph} from '../graph/internal-builder.js'
 import {filterGraphForMode} from '../graph/graph-filter.js'
 
 const SAFE_REF = /^(?!-)[A-Za-z0-9][A-Za-z0-9._\/@{}+~^-]{0,199}$/
 
 function git(repoRoot, args, timeout = 15_000) {
-    return spawnSync('git', ['-C', repoRoot, ...args], {
-        encoding: 'utf8', timeout, env: childProcessEnv(), windowsHide: true,
-        maxBuffer: 4 * 1024 * 1024,
-    })
+    return runGit(repoRoot, args, {timeout, maxBuffer: 4 * 1024 * 1024})
 }
 
 export function resolveGitCommit(repoRoot, requestedRef) {
@@ -41,10 +38,7 @@ export async function withGitRefCheckout(repoRoot, requestedRef, operation) {
         if (archived.status !== 0) {
             return {ok: false, error: `git archive failed for ${resolved.ref}: ${String(archived.stderr || '').trim() || 'unknown error'}`}
         }
-        const extracted = spawnSync('tar', ['-xf', archive, '-C', checkout], {
-            encoding: 'utf8', timeout: 60_000, env: childProcessEnv(), windowsHide: true,
-            maxBuffer: 4 * 1024 * 1024,
-        })
+        const extracted = runCommandSync('tar', ['-xf', archive, '-C', checkout], {timeout: 60_000, maxBuffer: 4 * 1024 * 1024})
         if (extracted.status !== 0) {
             return {ok: false, error: `temporary Git archive extraction failed: ${String(extracted.stderr || '').trim() || 'tar unavailable'}`}
         }

package/src/analysis/internal-audit/repo-files.js

@@ -1,7 +1,6 @@
 import {readFileSync, readdirSync} from 'node:fs'
 import {join} from 'node:path'
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../../child-env.js'
+import {runGit} from '../../git-exec.js'
 import {filterWeavatrixIgnored} from '../../path-ignore.js'
 
 export const readText = (path) => {
@@ -29,10 +28,7 @@ const SKIP_DIRS = new Set([
 
 export function listRepoFiles(repoRoot) {
     try {
-        const result = spawnSync('git', ['-C', repoRoot, 'ls-files', '--cached', '--others', '--exclude-standard', '-z'], {
-            encoding: 'utf8', windowsHide: true, timeout: 15_000, maxBuffer: 32 * 1024 * 1024,
-            env: childProcessEnv(),
-        })
+        const result = runGit(repoRoot, ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], {timeout: 15_000, maxBuffer: 32 * 1024 * 1024})
         if (result.status === 0) {
             const files = String(result.stdout || '').split('\0').filter(Boolean).map((file) => file.replace(/\\/g, '/'))
             return filterWeavatrixIgnored(repoRoot, files)

package/src/git-exec.js

@@ -0,0 +1,67 @@
+// The single chokepoint for launching git. Every git subprocess in the package routes through here,
+// so there is one place that applies `-C <repoRoot>` containment, a credential-stripped child
+// environment, a hidden Windows window and a bounded timeout — instead of a dozen near-identical
+// spawnSync wrappers scattered across the analysis, graph and MCP layers.
+import { spawnSync, spawn } from "node:child_process";
+import { childProcessEnv } from "./child-env.js";
+
+// Synchronous git. Returns the raw spawnSync result ({status, stdout, stderr, error}) so callers keep
+// their existing status/stdout/error handling. encoding defaults to "utf8" (pass "buffer" for binary
+// stdout); maxBuffer and stdio are forwarded only when provided so Node's defaults are preserved.
+export function runGit(repoRoot, args, options = {}) {
+  const spawnOptions = {
+    encoding: options.encoding ?? "utf8",
+    windowsHide: true,
+    timeout: options.timeout ?? 8000,
+    env: childProcessEnv(options.env),
+  };
+  if (options.maxBuffer != null) spawnOptions.maxBuffer = options.maxBuffer;
+  if (options.stdio != null) spawnOptions.stdio = options.stdio;
+  return spawnSync("git", ["-C", repoRoot, ...args], spawnOptions);
+}
+
+// Streaming git for the history collector: byte-bounded stdout, a hard timeout that SIGKILLs the child,
+// and a resolved {stdout, stderr, exitCode, truncated}. The caller owns cwd/env so reads can be scoped
+// to a specific worktree.
+export function boundedGitCommand(command, args, options) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd, env: options.env, shell: false, windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    const stdout = [], stderr = [];
+    let stdoutBytes = 0, stderrBytes = 0, truncated = false, timedOut = false, settled = false;
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      callback();
+    };
+    const stop = () => { try { child.kill("SIGKILL"); } catch { /* process already exited */ } };
+    const timer = setTimeout(() => { timedOut = true; stop(); }, options.timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+      if (truncated) return;
+      const remaining = options.maxOutputBytes - stdoutBytes;
+      if (remaining <= 0) { truncated = true; stop(); return; }
+      const kept = chunk.length <= remaining ? chunk : chunk.subarray(0, remaining);
+      stdout.push(kept); stdoutBytes += kept.length;
+      if (kept.length !== chunk.length) { truncated = true; stop(); }
+    });
+    child.stderr?.on("data", (chunk) => {
+      const remaining = 64 * 1024 - stderrBytes;
+      if (remaining <= 0) return;
+      const kept = chunk.length <= remaining ? chunk : chunk.subarray(0, remaining);
+      stderr.push(kept); stderrBytes += kept.length;
+    });
+    child.on("error", (error) => finish(() => reject(error)));
+    child.on("close", (exitCode) => finish(() => {
+      if (timedOut) return reject(new Error("git history collection timed out"));
+      resolve({
+        stdout: Buffer.concat(stdout),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        exitCode: Number(exitCode ?? 1),
+        truncated,
+      });
+    }));
+  });
+}

package/src/graph/freshness-probe.js

@@ -2,10 +2,9 @@
 // authority when something changed; this exact Git/worktree token is safe to cache in-process and in
 // versioned graph metadata when HEAD + dirty/untracked/control-file content remain unchanged.
 import {createHash} from 'node:crypto'
-import {spawnSync} from 'node:child_process'
 import {readFileSync, statSync} from 'node:fs'
 import {createRequire} from 'node:module'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 import {createRepoBoundary} from '../repo-path.js'
 
 const REPOSITORY_FRESHNESS_PROBE_V = 1
@@ -34,9 +33,7 @@ const CONTROL_FILES = ['.gitignore', '.weavatrixignore', '.weavatrix.json']
 const MAX_CONTROL_BYTES = 1_000_000
 
 function git(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {
-        encoding: 'buffer', timeout: 8000, windowsHide: true, env: childProcessEnv(), maxBuffer: 16 * 1024 * 1024,
-    })
+    const result = runGit(repoRoot, args, {encoding: 'buffer', maxBuffer: 16 * 1024 * 1024})
     return result.status === 0 ? Buffer.from(result.stdout || '') : null
 }
 

package/src/graph/internal-builder.langs.js

@@ -5,10 +5,9 @@
 // build works — and Electron main runs Node, so this needs no external runtime.
 import { readdirSync, statSync, realpathSync } from "node:fs";
 import { join, extname, dirname } from "node:path";
-import { execFileSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { isPathInside } from "../repo-path.js";
-import { childProcessEnv } from "../child-env.js";
+import { runGit } from "../git-exec.js";
 import { filterWeavatrixIgnored } from "../path-ignore.js";
 import {trustedGrammarWasm, trustedRuntimeWasm} from './parser-artifact-boundary.js'
 import LANG_JS from "./builder/lang-js.js";
@@ -112,17 +111,11 @@ function walkFallback(dir, acc = [], seen = new Set(), depth = 0, rootReal = nul
 // A repository may be opened without Git (or Git may be unavailable), so failure is deliberately a signal to
 // use the boundary-safe walker above rather than a build failure.
 function gitFileUniverse(dir) {
-  let raw;
-  try {
-    raw = execFileSync("git", ["-C", dir, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
-      encoding: "utf8",
-      windowsHide: true,
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 15_000,
-      maxBuffer: 64 * 1024 * 1024,
-      env: childProcessEnv(),
-    });
-  } catch { return null; }
+  const lsFiles = runGit(dir, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
+    stdio: ["ignore", "pipe", "ignore"], timeout: 15_000, maxBuffer: 64 * 1024 * 1024,
+  });
+  if (lsFiles.status !== 0 || lsFiles.error) return null;
+  const raw = lsFiles.stdout;
 
   // `git -C <dir>` also succeeds when <dir> is merely nested under some parent repository. If that
   // nested directory is ignored by the parent, `ls-files` is empty even though <dir> can be a valid
@@ -130,17 +123,11 @@ function gitFileUniverse(dir) {
   // that one ambiguous case, fall back to the boundary-safe walker. Preserve an empty universe for
   // an actual Git root so ignored files do not leak back into its graph.
   if (!raw) {
-    try {
-      const top = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
-        encoding: "utf8",
-        windowsHide: true,
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 15_000,
-        maxBuffer: 1024 * 1024,
-        env: childProcessEnv(),
-      }).trim();
-      if (realpathSync.native(top) !== realpathSync.native(dir)) return null;
-    } catch { return null; }
+    const top = runGit(dir, ["rev-parse", "--show-toplevel"], {
+      stdio: ["ignore", "pipe", "ignore"], timeout: 15_000, maxBuffer: 1024 * 1024,
+    });
+    if (top.status !== 0 || top.error) return null;
+    if (realpathSync.native(String(top.stdout).trim()) !== realpathSync.native(dir)) return null;
   }
 
   let rootReal;

package/src/mcp/git-output.mjs

@@ -1,10 +1,7 @@
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 
 export function gitLines(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {
-        encoding: 'utf8', timeout: 8000, env: childProcessEnv(), windowsHide: true,
-    })
+    const result = runGit(repoRoot, args)
     if (result.status !== 0) return null
     return String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
 }

package/src/mcp/graph/context-state.mjs

@@ -1,7 +1,6 @@
 import {readFileSync, statSync} from 'node:fs'
 import {join} from 'node:path'
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../../child-env.js'
+import {runGit} from '../../git-exec.js'
 import {resolveRepoPath} from '../../repo-path.js'
 import {mergePrecisionOverlay, precisionSemanticInputsMatch, readPrecisionOverlay} from '../../precision/lsp-overlay.js'
 
@@ -14,19 +13,19 @@ export function graphStaleness(ctx) {
     try { info.builtAt = statSync(ctx.graphPath).mtime } catch { /* no graph file */ }
     if (ctx.repoRoot && info.builtAt) {
         try {
-            const head = spawnSync('git', ['-C', ctx.repoRoot, 'log', '-1', '--format=%cI'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+            const head = runGit(ctx.repoRoot, ['log', '-1', '--format=%cI'], {timeout: 4000})
             const iso = (head.stdout || '').trim()
             if (head.status === 0 && iso) {
                 info.headAt = new Date(iso)
                 if (info.headAt > info.builtAt) {
                     info.stale = true
-                    const count = spawnSync('git', ['-C', ctx.repoRoot, 'rev-list', '--count', `--since=${info.builtAt.toISOString()}`, 'HEAD'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+                    const count = runGit(ctx.repoRoot, ['rev-list', '--count', `--since=${info.builtAt.toISOString()}`, 'HEAD'], {timeout: 4000})
                     if (count.status === 0) info.behind = Number(count.stdout.trim()) || null
                 }
             }
         } catch { /* git unavailable */ }
         try {
-            const status = spawnSync('git', ['-C', ctx.repoRoot, 'status', '--porcelain'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+            const status = runGit(ctx.repoRoot, ['status', '--porcelain'], {timeout: 4000})
             if (status.status === 0) {
                 let newer = 0
                 for (const line of String(status.stdout || '').split(/\r?\n/).filter(Boolean).slice(0, 200)) {

package/src/mcp/health/audit-format.mjs

@@ -1,6 +1,5 @@
-import {spawnSync} from 'node:child_process'
 import {summarizeFindings} from '../../analysis/findings.js'
-import {childProcessEnv} from '../../child-env.js'
+import {runGit} from '../../git-exec.js'
 import {createPathClassifier, hasPathClass} from '../../path-classification.js'
 
 const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
@@ -179,9 +178,7 @@ export const formatOrdinaryAudit = (audit, args, findings = audit.findings, head
 }
 
 export const gitUntracked = (repoRoot) => {
-    const result = spawnSync('git', ['-C', repoRoot, 'ls-files', '--others', '--exclude-standard'], {
-        encoding: 'utf8', timeout: 8000, maxBuffer: 2 * 1024 * 1024, env: childProcessEnv(), windowsHide: true,
-    })
+    const result = runGit(repoRoot, ['ls-files', '--others', '--exclude-standard'], {maxBuffer: 2 * 1024 * 1024})
     if (result.status !== 0) return {
         ok: false,
         files: [],

package/src/mcp/tools-impact-change.mjs

@@ -1,7 +1,6 @@
 // Symbol-aware change_impact implementation, isolated from the other hot impact tools so its
 // classifier/evidence contract can be tested without perturbing get_dependents or graph_diff.
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 import {fileOfId} from '../graph/node-id.js'
 import {classifyChangeImpact} from '../analysis/change-classification.js'
 import {readCoverageForRepo} from '../analysis/coverage-reports.js'
@@ -12,7 +11,7 @@ import {gitLines} from './git-output.mjs'
 import {toolResult} from './tool-result.mjs'
 
 function gitValue(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
+    const result = runGit(repoRoot, args)
     if (result.status !== 0) return null
     return String(result.stdout || '').trim() || null
 }

package/src/mcp-rg.mjs

@@ -1,9 +1,7 @@
 import { readdirSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { spawnSync } from 'node:child_process'
-import { childProcessEnv } from './child-env.js'
 import { createRequire } from 'node:module'
-import process from 'node:process'
+import { runCommandSync } from './process.js'
 
 const rgInInstall = (base) => [
     join(base, 'resources', 'app', 'node_modules', '@vscode', 'ripgrep', 'bin', 'rg.exe'),
@@ -43,7 +41,7 @@ export function createRgResolver(selfDir) {
         } catch { /* optional packaged ripgrep path */ }
         for (const c of editorRgCandidates()) if (existsSync(c)) return (rgPath = c)
         try {
-            const probe = spawnSync(process.platform === 'win32' ? 'where' : 'which', ['rg'], {encoding: 'utf8', env: childProcessEnv(), timeout: 3000, windowsHide: true})
+            const probe = runCommandSync(process.platform === 'win32' ? 'where' : 'which', ['rg'], {timeout: 3000})
             const p = probe.status === 0 ? probe.stdout.split(/\r?\n/)[0].trim() : ''
             if (p && existsSync(p)) return (rgPath = p)
         } catch { /* optional PATH probe */ }

package/src/mcp-source-tools.mjs

@@ -1,8 +1,7 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
-import { spawnSync } from 'node:child_process'
 import { extname, isAbsolute, join, relative, resolve } from 'node:path'
 import { resolveRepoPath } from './repo-path.js'
-import { childProcessEnv } from './child-env.js'
+import { runCommandSync } from './process.js'
 import { toolResult } from './mcp/tool-result.mjs'
 
 const SEARCH_SKIP = new Set(['.git', 'node_modules', 'dist', 'build', 'out', '.next', 'coverage', 'vendor', '.venv', 'venv', 'env', 'target', '__pycache__', '.idea', '.vscode', '.cache', 'bin', 'obj', 'weavatrix-graphs'])
@@ -11,7 +10,7 @@ const MAX_SEARCH_FILE_BYTES = 1024 * 1024
 const MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024
 const MAX_SOURCE_CONTEXT_LINES = 1000
 
-function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spawnRg = spawnSync) {
+function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spawnRg = runCommandSync) {
     const rg = resolveRg()
     if (!rg) return null
     // Exclude node_modules explicitly: --hidden + the default gitignore stack is the only thing that
@@ -24,7 +23,7 @@ function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spa
     // against repository-relative paths on Windows too. Passing an absolute search root makes rg
     // compare the glob with a drive-prefixed path and silently return no matches.
     args.push('--', query, '.')
-    const res = spawnRg(rg, args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000, env: childProcessEnv() })
+    const res = spawnRg(rg, args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000 })
     if (res.status !== 0 && res.status !== 1) return null
     const out = []
     for (const line of (res.stdout || '').split(/\r?\n/)) {
@@ -93,7 +92,7 @@ function nodeGrep(repoRoot, query, { isRegex, glob, maxResults }) {
     return out
 }
 
-export function searchCode({ repoRoot, resolveRg, spawnRg = spawnSync }, { query, is_regex = false, max_results = 40, glob } = {}) {
+export function searchCode({ repoRoot, resolveRg, spawnRg = runCommandSync }, { query, is_regex = false, max_results = 40, glob } = {}) {
     if (!query) return 'Provide a "query" string.'
     if (!repoRoot || !existsSync(repoRoot)) return 'Source search unavailable: repo root not provided to this MCP server.'
     const max = Math.max(1, Math.min(200, Number(max_results) || 40))

package/src/process.js

@@ -1,5 +1,5 @@
 // Subprocess runner shared by the search engines and security sweeps.
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { childProcessEnv } from "./child-env.js";
 
 // Windows: .cmd/.ps1 shims (npx, etc.) can't be spawned directly by Node — they need a
@@ -76,3 +76,20 @@ export function runCommand(command, args = [], options = {}) {
     child.on("close", (code) => finish(() => (timedOut ? reject(new Error("Command timed out")) : resolve({ stdout, stderr, exitCode: code }))));
   });
 }
+
+// Synchronous run-and-collect variant for callers that resolve a real binary and read its output in
+// one shot (ripgrep resolution/search, tar extraction). These launch a resolved .exe or bare binary
+// directly, so no shell quoting is needed; the child env is stripped of connector secrets and a
+// bounded timeout/buffer applies. Returns the raw spawnSync result ({status, stdout, stderr, error}).
+export function runCommandSync(command, args = [], options = {}) {
+  const spawnOptions = {
+    cwd: options.cwd || undefined,
+    encoding: options.encoding ?? "utf8",
+    env: childProcessEnv(options.env),
+    windowsHide: true,
+  };
+  if (options.timeout != null) spawnOptions.timeout = options.timeout;
+  if (options.maxBuffer != null) spawnOptions.maxBuffer = options.maxBuffer;
+  if (options.stdio != null) spawnOptions.stdio = options.stdio;
+  return spawnSync(command, args, spawnOptions);
+}