fix binary graph refresh and dependency audit

[indrazm]

Summary

• treat invalid UTF-8 files as metadata-only during graph freshness checks
• preserve real I/O errors, handle deletion races, and support text/binary transitions
• skip unchanged metadata-only files through the snapshot fast path
• update Astro, Wrangler, and transitive website dependencies to clear the pnpm audit

Root cause

Initial indexing tolerated files that could not be decoded as UTF-8, but persisted-graph freshness retried them as text and treated the decode failure as fatal. This prevented CLI queries and MCP initialization on projects containing unrecognized binary extensions.

Impact

Persisted graphs now remain usable with .gpg, .icc, .p12, .fdf, .z, .ctg.z, and other invalid UTF-8 files. Valid text remains searchable, and genuine filesystem failures still surface.

Fixes #34

Validation

• cargo fmt -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --locked (240 tests)
• cargo build --locked
• cargo run -p xtask -- gen-skill --check
• cargo run -p xtask -- perf-gate
• pnpm install --frozen-lockfile
• pnpm build
• pnpm audit --audit-level moderate

Summary by CodeRabbit

• Bug Fixes

  • Improved file refresh handling when files are deleted or become unavailable.
  • Binary and non-UTF-8 files are now handled safely without disrupting indexing.
  • File changes are detected more accurately, including metadata-only updates.
  • Added clearer error reporting for unexpected file-reading failures.

• Tests

  • Added coverage for binary files, text-to-binary transitions, deleted files, metadata changes, and command-line workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 387dafac-61e7-4c8b-8819-ba2ae941bf0d

📥 Commits

Reviewing files that changed from the base of the PR and between dbc13b2 and a53c254.

📒 Files selected for processing (1)

• tests/cli_graph.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• tests/cli_graph.rs

---

📝 Walkthrough

Walkthrough

The freshness path now walks file metadata, reads bytes during refresh, handles binary and missing files, and reports other read errors with context. Tests cover MCP startup with binary files. Frontend dependency ranges were also updated.

Changes

Freshness refresh

Layer / File(s)	Summary
Metadata traversal and refresh handling src/walker.rs, src/freshness.rs	WalkedFile was replaced by WalkedFileMeta. Refresh now compares metadata, reads raw bytes, handles missing files, and stores invalid UTF-8 files as metadata-only entries.
Refresh regression and MCP validation src/freshness.rs, tests/cli_graph.rs	Tests cover metadata-only changes, binary/text transitions, missing files, read errors, and MCP startup with non-UTF-8 files.

Frontend tooling updates

Layer / File(s)	Summary
Frontend dependency range update www/package.json	The astro and wrangler dependency ranges were updated.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCP
  participant Freshness
  participant Filesystem
  participant Graph
  MCP->>Freshness: check graph freshness
  Freshness->>Filesystem: read file metadata
  Filesystem-->>Freshness: metadata
  Freshness->>Filesystem: read file bytes when needed
  Filesystem-->>Freshness: bytes or read error
  Freshness->>Graph: update indexed or metadata-only entry
  Graph-->>MCP: refreshed graph status

Loading

Possibly related PRs

• anvia-hq/lexa#22: Uses the metadata-based file refresh flow for automatic graph refresh.
• anvia-hq/lexa#24: Also changes src/freshness.rs and metadata-only refresh behavior.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The Astro and Wrangler dependency updates are unrelated to the directly linked binary-file MCP freshness issue.	Move the website dependency updates to a separate pull request, or link an issue that explicitly requires the dependency audit changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the binary graph refresh fix and dependency audit changes.
Linked Issues check	✅ Passed	The changes handle binary files, deletion races, metadata-only refreshes, and genuine read errors required by issue #34.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fix-binary-refresh-and-dependency-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/cli_graph.rs`:
- Around line 85-115: Bound the MCP subprocess lifecycle in the test around
lexa() and the response read: enforce deadlines for receiving the
newline-terminated response and for child.wait() after stdin closes. If either
timeout expires, kill the child and reap it before failing the test, while
preserving the existing success assertion when both operations complete.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 90f36bc9-97d1-4473-aa39-554afea64235

📥 Commits

Reviewing files that changed from the base of the PR and between 1ec7ccc and dbc13b2.

⛔ Files ignored due to path filters (1)

• www/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• src/freshness.rs
• src/walker.rs
• tests/cli_graph.rs
• www/package.json

💤 Files with no reviewable changes (1)

• src/walker.rs