[colbymchenry]

Fixes the watchdog from #856 — which did not actually work in the real daemon. I caught this by live-testing it (not just unit tests) against a real codegraph serve --mcp.

What was wrong

The worker-thread watchdog stalled exactly when it was needed. V8 isolates in one process coordinate on global safepoints: when any thread requests a GC, every other thread must reach a safepoint first. A main thread wedged in a tight, non-allocating loop never reaches one — so the watchdog worker deadlocks on its next safepoint check before it can SIGKILL. And #850's hot loop (SourcePositionTableIterator::Advance, a non-allocating C++ table walk) is precisely that shape.

The unit/integration tests passed only because the toy test process had no heap/GC pressure. Live evidence (real daemon, CODEGRAPH_WATCHDOG_TIMEOUT_MS=2000, main thread wedged):

[CodeGraph watchdog] armed: timeoutMs=2000 checkMs=400 maxStaleChecks=5
[CodeGraph watchdog-worker] counter=1 ... counter=2 ... counter=3   ← worker goes silent at the wedge
{ "how": "HARD_TIMEOUT — still alive after 8s (watchdog did NOT fire)" }

The fix

Move the watchdog to a separate child process. It shares no isolate or heap with the parent, so the wedge can't touch it, and it kills via the kernel (SIGKILL is honoured regardless of parent thread state). The parent heartbeats a byte to the child's stdin each tick; if it stops for the timeout, the child SIGKILLs the parent; when the parent exits the pipe closes and the child exits (no orphan). Child cwd pinned to os.tmpdir() so it can't hold a dir open (Windows cleanup).

Validated live (the whole point)

Same real-daemon test, after the fix:

{ "how": "child exit: code=null signal=SIGKILL", "elapsedMs": 3390 }
[CodeGraph] Main thread unresponsive for ~2s — killing the wedged process so a fresh one can start (#850).

• Layer 1 (uncaught exception) live: real daemon → bounded log → exit code=1. ✓
• Layer 2 (wedge) live: real daemon → SIGKILL in ~timeout, death-rattle in the log, no orphaned watchdog. ✓
• New regression test reproduces the worker-stalling case (a non-allocating wedge under ~40MB heap pressure) — it would fail on the old worker-thread design.

Notes

Public API, install points (src/mcp/index.ts), and the [Unreleased] CHANGELOG entry are unchanged — that entry describes the now-working behavior, and the broken worker version was never released (lived only on main). Full suite green (75 files, 1505 passed / 2 skipped). Windows path is portable by design but not yet run on the VM.

🤖 Generated with Claude Code