On-disk persistance layer

.github/workflows/install-script.yml

@@ -1,8 +1,10 @@
 # Smoke-test scripts/install.sh on Linux + macOS against the latest published
 # release. The script is the public install path served at get.gortex.dev, so
-# any change must prove it still produces a working `gortex` binary on both
-# OSes and both architectures GitHub-hosted runners cover (x64 always; arm64
-# darwin via the macos-14 runner — Linux arm64 is exercised in C5 release).
+# any change must prove it still produces a working `gortex` binary. Coverage:
+# Linux x64 (ubuntu-latest) and macOS arm64 (macos-14). Intel macOS is not
+# tested here — GitHub retired its Intel (macos-13) runners, and install.sh is
+# arch-agnostic (only the downloaded artifact differs). Linux arm64 is
+# exercised in the release flow.
 name: install-script
 
 on:
@@ -35,7 +37,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-13, macos-14]
+        os: [ubuntu-latest, macos-14]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/release.yml

@@ -98,18 +98,16 @@ jobs:
             -w /go/src/gortex \
             -e GITHUB_TOKEN \
             -e HOMEBREW_TAP_TOKEN \
-            -e SCOOP_BUCKET_TOKEN \
             ghcr.io/goreleaser/goreleaser-cross:v1.26 \
             release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Personal access token with `repo` scope on zzet/homebrew-tap.
           # GITHUB_TOKEN can only push to the source repo, not the tap.
           HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          # Same story for the Scoop bucket — a PAT with `repo` scope on
-          # gortexhq/scoop-bucket. Required for the `scoops` block in
-          # .goreleaser.yml to push the Windows manifest.
-          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}
+          # (SCOOP_BUCKET_TOKEN is consumed by the release-windows job's
+          # "Publish Scoop manifest" step, not here — goreleaser builds no
+          # windows artifact, so it has no scoop manifest to push.)
 
       # goreleaser-cross runs as root inside the container, so everything
       # in dist/ is owned by root:root on the host. The subsequent cosign
@@ -208,6 +206,164 @@ jobs:
             rm -rf /tmp/macos-signing
           fi
 
+  # Windows is built on a NATIVE windows runner: the CGo tree-sitter
+  # bindings need a real C/C++ toolchain (mingw-w64 ships on PATH there),
+  # and goreleaser-cross targets unix only. This job builds a statically
+  # linked, self-contained .exe (no runtime DLLs to ship), zips it,
+  # cosign-signs, and appends the zip to the release the `release` job
+  # already created.
+  release-windows:
+    needs: release
+    runs-on: windows-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version: '1.26'
+
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v2.4.1
+
+      - name: Build gortex.exe (static mingw runtime)
+        shell: bash
+        env:
+          CGO_ENABLED: "1"
+        run: |
+          set -euo pipefail
+          VER="${GITHUB_REF#refs/tags/}"
+          # -extldflags=-static folds the mingw C/C++ runtime (libstdc++,
+          # libgcc, libwinpthread) into the .exe so it ships as a single
+          # self-contained binary — nothing to bundle alongside. The C++
+          # stdlib is in the link at all because some tree-sitter grammars
+          # carry C++ external scanners (e.g. go-sitter-forest norg); static
+          # linking just puts it inside the .exe instead of a DLL.
+          go build \
+            -ldflags "-s -w -X main.version=${VER} -X main.commit=$(git rev-parse --short HEAD) -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ) -extldflags=-static" \
+            -o gortex.exe ./cmd/gortex/
+
+      - name: Verify gortex.exe is self-contained
+        shell: bash
+        run: |
+          set -euo pipefail
+          # The static link must leave no dependency on a mingw runtime DLL;
+          # a partially static .exe would fail to start where that DLL is
+          # absent. If objdump is available, fail the release on any leaked
+          # mingw runtime import.
+          objdump=""
+          for cand in objdump x86_64-w64-mingw32-objdump; do
+            command -v "$cand" >/dev/null 2>&1 && { objdump="$cand"; break; }
+          done
+          if [ -n "$objdump" ]; then
+            echo "imported DLLs:"; "$objdump" -p gortex.exe | grep -i 'DLL Name' || true
+            if "$objdump" -p gortex.exe | grep -iqE 'libstdc\+\+|libgcc_s|libwinpthread'; then
+              echo "FATAL: gortex.exe still imports a mingw runtime DLL — static link incomplete"
+              exit 1
+            fi
+            echo "ok: no mingw runtime DLL imports"
+          else
+            echo "WARN: objdump not found; skipping self-containment check"
+          fi
+
+      - name: Zip (gortex_windows_amd64.zip)
+        shell: pwsh
+        run: Compress-Archive -Path gortex.exe -DestinationPath gortex_windows_amd64.zip -Force
+
+      - name: Sign + upload to release
+        shell: bash
+        env:
+          COSIGN_YES: "true"
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          cosign sign-blob \
+            --output-signature gortex_windows_amd64.zip.sig \
+            --output-certificate gortex_windows_amd64.zip.pem \
+            gortex_windows_amd64.zip
+          TAG="${GITHUB_REF#refs/tags/}"
+          gh release upload "$TAG" \
+            gortex_windows_amd64.zip \
+            gortex_windows_amd64.zip.sig \
+            gortex_windows_amd64.zip.pem \
+            --clobber
+
+          # Append the windows zip's sha256 to the release checksums.txt so
+          # the one-line installer (scripts/install.ps1, which verifies
+          # against checksums.txt) covers windows too — the unix goreleaser
+          # run only hashed its own artifacts. needs:release guarantees
+          # checksums.txt already exists.
+          sha="$(sha256sum gortex_windows_amd64.zip | awk '{print $1}')"
+          gh release download "$TAG" --pattern checksums.txt --clobber 2>/dev/null || : > checksums.txt
+          if ! grep -q "gortex_windows_amd64.zip" checksums.txt; then
+            printf '%s  gortex_windows_amd64.zip\n' "$sha" >> checksums.txt
+            gh release upload "$TAG" checksums.txt --clobber
+          fi
+
+      - name: Publish Scoop manifest
+        # Push a refreshed `gortex` manifest to gortexhq/scoop-bucket so
+        # `scoop install gortex` resolves this release. SCOOP_BUCKET_TOKEN is
+        # a PAT with `repo` scope on that bucket (GITHUB_TOKEN can only push
+        # to the source repo). Non-blocking + self-skipping: a bucket hiccup
+        # must not fail a release whose binary already shipped, and a
+        # token-less fork just skips it.
+        continue-on-error: true
+        shell: bash
+        env:
+          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${SCOOP_BUCKET_TOKEN:-}" ]; then
+            echo "SCOOP_BUCKET_TOKEN not set; skipping scoop manifest publish"
+            exit 0
+          fi
+          TAG="${GITHUB_REF#refs/tags/}"
+          VER="${TAG#v}"
+          URL="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/gortex_windows_amd64.zip"
+          SHA="$(sha256sum gortex_windows_amd64.zip | awk '{print $1}')"
+
+          # Build the manifest with jq so escaping + validity are guaranteed.
+          # `bin` shims gortex.exe; checkver/autoupdate let scoop's tooling
+          # track future releases (the $version token is literal on purpose).
+          jq -n \
+            --arg version "$VER" \
+            --arg url "$URL" \
+            --arg hash "$SHA" \
+            --arg homepage "https://github.com/${GITHUB_REPOSITORY}" \
+            --arg autourl "https://github.com/${GITHUB_REPOSITORY}/releases/download/v\$version/gortex_windows_amd64.zip" \
+            '{
+               version: $version,
+               description: "Code intelligence engine that indexes repositories into an in-memory knowledge graph.",
+               homepage: $homepage,
+               license: "Apache-2.0",
+               architecture: { "64bit": { url: $url, hash: $hash } },
+               bin: "gortex.exe",
+               checkver: "github",
+               autoupdate: { architecture: { "64bit": { url: $autourl } } }
+             }' > gortex.json
+
+          # Token in the clone URL — GitHub Actions masks the secret in logs.
+          git clone "https://x-access-token:${SCOOP_BUCKET_TOKEN}@github.com/gortexhq/scoop-bucket.git" scoop-bucket
+          cd scoop-bucket
+          # Honour the bucket's layout: scoop reads manifests from the repo
+          # root or a bucket/ subdir. Update in place if one exists, else use
+          # the conventional bucket/ subdir.
+          if [ -f gortex.json ]; then dest="gortex.json"; else mkdir -p bucket; dest="bucket/gortex.json"; fi
+          cp ../gortex.json "$dest"
+          git add "$dest"
+          if git diff --cached --quiet; then
+            echo "scoop manifest already current for ${VER}"
+          else
+            git config user.name  "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git commit -m "gortex: ${VER}"
+            git push
+            echo "published scoop manifest ${VER} -> $dest"
+          fi
+
   # SLSA-3 provenance via the OpenSSF reusable workflow. This runs in a
   # separate, isolated job that the `release` job can't tamper with —
   # that isolation is what elevates us from SLSA-2 to SLSA-3. Output is

.gitignore

@@ -51,3 +51,14 @@ eval/scripts/
 eval/logs/
 
 internal_docs/
+
+# Ad-hoc bench/probe tooling — kept locally, not part of the repo.
+bench/all-tools-bench/
+bench/daemon-bench/
+bench/edge-diff/
+bench/multi-repo-bench/
+bench/node-diff/
+bench/store-bench/
+bench/unresolved-audit/
+bench/run-linux.sh
+bench/run-linux-rest.sh

.goreleaser.yml

@@ -1,8 +1,11 @@
 version: 2
 
 # Run inside ghcr.io/goreleaser/goreleaser-cross — the Docker image ships
-# cross-compile toolchains for all four targets below so CGO (tree-sitter)
-# links cleanly on a single Linux runner. See .github/workflows/release.yml.
+# cross-compile toolchains so CGO (tree-sitter) links cleanly on a single
+# Linux runner. This config builds the UNIX targets only (linux + darwin).
+# Windows is built separately on a native windows runner (see the
+# `release-windows` job in release.yml) because the CGo tree-sitter
+# bindings need a real C/C++ toolchain there.
 before:
   hooks:
     - go mod tidy
@@ -19,30 +22,14 @@ builds:
       # Version (see internal/version). Commit lands in the +build slot so
       # `gortex version` output round-trips as canonical semver.
       - -s -w -X main.version={{.Version}} -X main.commit={{.ShortCommit}} -X main.date={{.Date}}
-      # Statically link the mingw-w64 C/C++ runtime (libstdc++, libgcc,
-      # winpthread) into the Windows binary. CGO is on for tree-sitter and
-      # some grammar scanners ship C++; without -static the released
-      # gortex.exe dynamically links libstdc++-6.dll et al., which are not
-      # present on a stock Windows box — the binary fails to start with a
-      # missing-DLL error. No-op on linux/darwin, which keep their normal
-      # dynamic libc/libc++.
-      - '{{ if eq .Os "windows" }}-extldflags "-static"{{ end }}'
     env:
       - CGO_ENABLED=1
     goos:
       - linux
       - darwin
-      - windows
     goarch:
       - amd64
       - arm64
-    ignore:
-      # windows/arm64 needs an aarch64-w64-mingw32 cross-toolchain that
-      # the goreleaser-cross image doesn't ship; windows/amd64 covers
-      # every mainstream Windows dev box. Revisit when the image gains
-      # the llvm-mingw arm64 target.
-      - goos: windows
-        goarch: arm64
     # Per-target CC + CXX. goreleaser-cross exposes these cross-toolchains
     # on PATH; CGO needs both set per target triple because some deps
     # (tree-sitter yaml scanner, etc.) ship C++. Without CXX, the system
@@ -69,11 +56,6 @@ builds:
         env:
           - CC=aarch64-linux-gnu-gcc
           - CXX=aarch64-linux-gnu-g++
-      - goos: windows
-        goarch: amd64
-        env:
-          - CC=x86_64-w64-mingw32-gcc
-          - CXX=x86_64-w64-mingw32-g++
     # Per-target build hook. Fires after each Mach-O / ELF is linked,
     # before the archive step. The script is a no-op for non-darwin
     # targets, so we don't need a per-override hook list.
@@ -151,20 +133,8 @@ homebrew_casks:
       executable: gortex
       shell_parameter_format: cobra
 
-# Scoop manifest — `scoop install gortex` on Windows. goreleaser commits
-# the generated manifest (pointing at the signed windows/amd64 .zip in
-# this release) to a separate bucket repo on every tagged release,
-# exactly like the Homebrew cask above.
-scoops:
-  - name: gortex
-    repository:
-      owner: gortexhq
-      name: scoop-bucket
-      # GITHUB_TOKEN can only push to the source repo, so the bucket
-      # needs its own PAT with `repo` scope on gortexhq/scoop-bucket,
-      # stored as SCOOP_BUCKET_TOKEN in repo secrets. release.yml wires
-      # it in.
-      token: "{{ .Env.SCOOP_BUCKET_TOKEN }}"
-    homepage: "https://github.com/zzet/gortex"
-    description: "Code intelligence engine that indexes repositories into an in-memory knowledge graph."
-    license: "Custom"
+# NOTE: goreleaser does NOT generate the Scoop manifest — windows is built by
+# the separate `release-windows` job (native runner) and isn't an artifact of
+# this goreleaser-cross run, so goreleaser has no windows zip to point at. That
+# job publishes the manifest to gortexhq/scoop-bucket itself (see its "Publish
+# Scoop manifest" step in release.yml).

bench/perf/main.go

@@ -32,7 +32,7 @@ var benchCacheDir string
 func main() {
 	repos := flag.String("repos", "gin,nestjs,react", "comma-separated repo set. Forms: preset slug (gin/nestjs/react/linux), owner/repo, https URL, or local:/path")
 	includeLinux := flag.Bool("include-linux", false, "include the linux kernel preset (multi-GB clone; skipped by default)")
-	cacheDir := flag.String("cache-dir", "", "cache directory for clones (default ~/.cache/gortex/bench)")
+	cacheDir := flag.String("cache-dir", "", "cache directory for clones (default ~/.gortex/cache/bench)")
 	queriesPath := flag.String("queries", "bench/perf/queries.json", "JSON file with the search-bench query set")
 	out := flag.String("out", "", "output table path (default stdout)")
 	format := flag.String("format", "markdown", "markdown | csv | json")

cmd/gortex/backend.go

@@ -0,0 +1,73 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"go.uber.org/zap"
+
+	"github.com/zzet/gortex/internal/graph"
+	"github.com/zzet/gortex/internal/platform"
+)
+
+// openBackend constructs the graph.Store the daemon will run
+// against. Picks the implementation by the --backend flag:
+//
+//   - "memory" (default) — in-process *graph.Graph; nothing
+//     persists across runs; matches every existing test fixture.
+//
+// Returns the store, a cleanup func the caller must defer (closes
+// the underlying handle on disk-backed stores), and any error
+// constructing or opening the store.
+//
+// The actual per-backend Open* helpers live in their own
+// build-tagged files (backend_memory.go is always built; the
+// disk-backed ones are gated by build tags). This file is the
+// shared dispatch.
+func openBackend(name, path string, bufferPoolMB uint64, logger *zap.Logger) (graph.Store, func(), error) {
+	switch strings.ToLower(strings.TrimSpace(name)) {
+	case "", "memory", "mem", "in-memory":
+		s := graph.New()
+		return s, func() {}, nil
+	case "sqlite", "sqlite3":
+		resolved, err := resolveBackendPath(path, "store.sqlite")
+		if err != nil {
+			return nil, nil, err
+		}
+		logger.Info("opening sqlite backend", zap.String("path", resolved))
+		return openSqliteBackend(resolved, bufferPoolMB)
+	default:
+		return nil, nil, fmt.Errorf("unknown --backend %q (expected: memory, sqlite)", name)
+	}
+}
+
+// resolveBackendPath turns an empty --backend-path into a default
+// under the unified store directory (~/.gortex/store/<filename>, or the
+// XDG_DATA_HOME equivalent). Otherwise expands ~ and returns the
+// absolute path. Creates the parent directory if missing — the
+// disk-backed stores expect the parent dir to exist.
+func resolveBackendPath(in, filename string) (string, error) {
+	in = strings.TrimSpace(in)
+	if in == "" {
+		in = filepath.Join(platform.StoreDir(), filename)
+	} else if strings.HasPrefix(in, "~/") {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return "", fmt.Errorf("resolve home dir: %w", err)
+		}
+		in = filepath.Join(home, in[2:])
+	}
+	abs, err := filepath.Abs(in)
+	if err != nil {
+		return "", fmt.Errorf("abs path %q: %w", in, err)
+	}
+	// The on-disk store opens the leaf path (file or directory). We
+	// MkdirAll the parent so the path is reachable; the store itself
+	// creates the leaf.
+	if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
+		return "", fmt.Errorf("mkdir parent %q: %w", filepath.Dir(abs), err)
+	}
+	return abs, nil
+}