fix: resolve merge conflicts with main

Author: carlos-alm

.claude/hooks/guard-git.sh

@@ -22,12 +22,12 @@ if [ -z "$COMMAND" ]; then
 fi
 
 # Act on git and gh commands (may appear after cd "..." &&)
-if ! echo "$COMMAND" | grep -qE '(^|\s|&&\s*)(git|gh)\s+'; then
+if ! echo "$COMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)(git|gh)[[:space:]]+'; then
   exit 0
 fi
 
 # Normalize: strip `git -C "<path>"` / `git -C <path>` so downstream subcommand
-# patterns (git\s+push, git\s+commit, …) match regardless of whether `-C` is
+# patterns (git[[:space:]]+push, git[[:space:]]+commit, …) match regardless of whether `-C` is
 # present. detect_work_dir still inspects the raw $COMMAND to find the target.
 # The unquoted pattern requires a non-quote first char so it does not mis-match
 # the opening `"` of a quoted path (which would leave a trailing `path"` in
@@ -53,34 +53,34 @@ deny() {
 # --- Block dangerous commands ---
 
 # git add . / git add -A / git add --all (broad staging)
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+add\s+(\.\s*$|-A|--all)'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+add[[:space:]]+(\.[[:space:]]*$|-A|--all)'; then
   deny "BLOCKED: 'git add .' / 'git add -A' stages ALL changes including other sessions' work. Stage specific files instead: git add <file1> <file2>"
 fi
 
 # git reset (unstaging / hard reset)
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+reset'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+reset'; then
   deny "BLOCKED: 'git reset' can unstage or destroy other sessions' work. To unstage your own files, use: git restore --staged <file>"
 fi
 
 # git checkout -- <file> (reverting files)
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+checkout\s+--'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+checkout[[:space:]]+--'; then
   deny "BLOCKED: 'git checkout -- <file>' reverts working tree changes and may destroy other sessions' edits. If you need to discard your own changes, be explicit about which files."
 fi
 
 # git restore (reverting) — EXCEPT git restore --staged (safe unstaging)
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+restore'; then
-  if ! echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+restore\s+--staged'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+restore'; then
+  if ! echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+restore[[:space:]]+--staged'; then
     deny "BLOCKED: 'git restore <file>' reverts working tree changes and may destroy other sessions' edits. To unstage files safely, use: git restore --staged <file>"
   fi
 fi
 
 # git clean (delete untracked files)
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+clean'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+clean'; then
   deny "BLOCKED: 'git clean' deletes untracked files that may belong to other sessions."
 fi
 
 # git stash (hides all changes)
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+stash'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+stash'; then
   deny "BLOCKED: 'git stash' hides all working tree changes including other sessions' work. In worktree mode, commit your changes directly instead."
 fi
 
@@ -158,21 +158,21 @@ validate_branch_name() {
 
 # --- Branch name validation on push ---
 
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+push'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+push'; then
   validate_branch_name push
 fi
 
 # --- Branch name validation on gh pr create ---
 
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)gh\s+pr\s+create'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)gh[[:space:]]+pr[[:space:]]+create'; then
   # `gh pr create` does not use `git -C`; detect_work_dir falls through to the
   # `cd` path or cwd. No subcommand hint to pass.
   validate_branch_name
 fi
 
 # --- Commit validation against edit log ---
 
-if echo "$NCOMMAND" | grep -qE '(^|\s|&&\s*)git\s+commit'; then
+if echo "$NCOMMAND" | grep -qE '(^|[[:space:]]|&&[[:space:]]*)git[[:space:]]+commit'; then
   # Resolve the target worktree so the edit log and staged-file listing come
   # from the same repo the commit targets (e.g. `git -C <pr-worktree> commit`).
   WORK_DIR=$(detect_work_dir commit)

.github/workflows/ci.yml

@@ -21,6 +21,13 @@ jobs:
         with:
           node-version: 22
 
+      # Runs before `npm install` because npm 11 silently strips the `libc`
+      # field from optional-dependency lockfile entries (see #1160). If the
+      # check ran post-install we'd flag every CI run instead of the PRs that
+      # actually introduce the regression.
+      - name: Verify lockfile libc discriminators
+        run: node scripts/verify-lockfile-libc.mjs
+
       - name: Install dependencies
         timeout-minutes: 20
         shell: bash
@@ -277,6 +284,18 @@ jobs:
           CODEGRAPH_PARITY: '1'
         run: npx vitest run tests/engines/ tests/integration/build-parity.test.ts --reporter=verbose
 
+      # Isolated regression canary for #1147 — runs only the dropped-language-gap
+      # suite so a failure surfaces under a clear step name and can't be masked
+      # by pollution from neighbouring tests in the larger `test` job. The gap
+      # repair path (#1083) is load-bearing for engine parity but easy to break
+      # silently — the bug shape is "node row never re-inserted", which only
+      # this test exercises directly.
+      - name: Dropped-language gap regression guard (#1147)
+        shell: bash
+        env:
+          CODEGRAPH_PARITY: '1'
+        run: npx vitest run tests/integration/dropped-language-gap.test.ts --reporter=verbose
+
   rust-check:
     runs-on: ubuntu-latest
     name: Rust compile check

package-lock.json

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+// Verifies that @optave/codegraph-linux-* entries in package-lock.json declare
+// the `libc` discriminator. npm 11 silently strips this field when generating
+// the lockfile on non-Linux hosts (and sometimes on Linux too), even though the
+// published packages declare it. Without it, npm cannot disambiguate
+// linux-x64-gnu vs linux-x64-musl when resolving from the lockfile and may
+// install (or load) the wrong native binary on Alpine/musl hosts.
+//
+// Run via `npm run lint` (or directly) in CI to catch silent regressions from
+// Dependabot bumps and contributor `npm install` runs.
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const EXPECTED_LIBC = {
+  '@optave/codegraph-linux-arm64-gnu': 'glibc',
+  '@optave/codegraph-linux-x64-gnu': 'glibc',
+  '@optave/codegraph-linux-x64-musl': 'musl',
+};
+
+// Resolve relative to this script's location so it works regardless of CWD
+// (e.g. running `node scripts/verify-lockfile-libc.mjs` from the `scripts/`
+// subdirectory still finds the repo-root lockfile).
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const lockfilePath = resolve(__dirname, '..', 'package-lock.json');
+const lock = JSON.parse(readFileSync(lockfilePath, 'utf8'));
+const failures = [];
+
+for (const [pkgName, expectedLibc] of Object.entries(EXPECTED_LIBC)) {
+  const entry = lock.packages?.[`node_modules/${pkgName}`];
+  if (!entry) {
+    failures.push(`${pkgName}: missing from package-lock.json`);
+    continue;
+  }
+  const libc = entry.libc;
+  if (!Array.isArray(libc) || !libc.includes(expectedLibc)) {
+    failures.push(
+      `${pkgName}: expected libc=["${expectedLibc}"], got ${JSON.stringify(libc)}`,
+    );
+  }
+}
+
+if (failures.length > 0) {
+  console.error('package-lock.json libc discriminator check failed:\n');
+  for (const f of failures) console.error(`  - ${f}`);
+  console.error(
+    '\nnpm install may have stripped the libc field. Restore it by editing\n' +
+      'package-lock.json so each @optave/codegraph-linux-* entry includes\n' +
+      'its libc field (see expected values above). Tracked in #1160.',
+  );
+  process.exit(1);
+}
+
+console.log('package-lock.json libc discriminators OK');

scripts/verify-lockfile-libc.mjs

@@ -149,16 +149,16 @@ describe('snapshotSave', () => {
   // snapshotSave. better-sqlite3 is synchronous, so Promise-based
   // concurrency would queue two sequential microtasks — only separate
   // threads exercise the TOCTOU race.
-  const nodeMajor = Number(process.versions.node.split('.')[0]);
   const raceWorkerPath = path.join(__dirname, 'snapshot-race-worker.mjs');
   // --import requires a URL (file://…) or a bare/relative specifier, not a
   // drive-letter path on Windows. Use the file:// URL directly.
   const loaderUrl = new URL('../../scripts/ts-resolve-loader.js', import.meta.url).href;
-  const raceExecArgv = [
-    nodeMajor >= 23 ? '--strip-types' : '--experimental-strip-types',
-    '--import',
-    loaderUrl,
-  ];
+  // `--experimental-strip-types` is accepted by Worker execArgv across all
+  // supported Node versions (≥ 22.6); the unprefixed `--strip-types` flag
+  // is not in the Worker allowlist on Node 24 and causes
+  // ERR_WORKER_INVALID_EXEC_ARGV. On Node ≥ 23.6 type stripping is on by
+  // default, so the flag is a harmless no-op there.
+  const raceExecArgv = ['--experimental-strip-types', '--import', loaderUrl];
   const spawnSaveWorker = (workerData: {
     dbPath: string;
     name: string;