fix(pg18): unpack array params for IN clauses; adopt core 0.3.1 list helper

[smart-knowledge-systems]

Summary

Fixes codeindex search, codeindex xref, and the dedup/MCP code paths after the PG15→PG18 migration. The root cause is a bun:sql driver bug: it encodes JS arrays via Array.prototype.toString and ships "a,b,c" over the wire instead of a Postgres array literal. PG15 was lenient enough to occasionally tolerate the malformed encoding for int[]; PG18 rejects it cleanly with malformed array literal / number of array dimensions (102) exceeds the maximum allowed (6) errors.

Type casts ($1::int[]) do not help — params must be unpacked into individual placeholders.

What changed

Search/dedup/MCP — replaced every ANY($N) with IN ($1, $2, ...), unpacking the array into separate bind vars. Empty-array short-circuits added in MCP files.ts to preserve the "no access" semantics that previously relied on [] being truthy + ANY(empty) matching no rows.

Xref — uses the new pg(arr) list helper from @easier-idx/core@0.3.1 (smart-knowledge-systems/easier-idx#5). Tagged-template syntax: pg`WHERE id IN ${pg(fileIdArray)}`. The earlier cast workaround (pg as unknown as <T>(value: T) => unknown) was always broken at runtime — returned a Promise that got encoded as [object Promise] — so xref was unusable on either PG15 or PG18 since that workaround was added.

Repo store ops — StoreOps in core 0.3.x added a required transaction method. Switched from hand-rolled inline ops to the upstream createPgStoreOps / createSqliteStoreOps factories instead of re-implementing transactions here.

Commits

• bdcfe51 fix(search): replace ANY($N) with IN ($1,$2,...) for PG18 compat
• 579eac1 fix(search): replace ANY($N) with IN ($1,$2,...) in query.ts
• 5335338 fix(xref): replace ANY(${arr}) with IN ${sql(arr)} for PG18 compat
• c6f5b01 fix(dedup): replace ANY array params with IN placeholders for PG18
• 2d5b00a fix(mcp): replace ANY array params with IN placeholders for PG18
• d8b7132 chore(deps): bump @easier-idx/core to 0.3.1, drop xref cast workaround
• 546ee75 refactor(repo): use createPgStoreOps/createSqliteStoreOps from core 0.3.1

Test plan

• bun run check — typecheck + lint + prettier all clean
• codeindex search 'rate limiting' --top-n 3 — returns ranked JSON results, no array-dimensions errors
• codeindex xref getPg — returns cross-repo definitions and consumers (was broken before this PR even on PG15 due to the cast workaround returning a Promise)
• codeindex reindex smoke against an updated working tree
• MCP file tools — verify empty-scope short-circuit still returns 0 rows for unauthorized repos

Upstream context

The Bun array encoding bug is tracked in oven-sh/bun#29552 (open since Apr 2026, has the actual fix, not yet merged). When that ships and we upgrade Bun, the IN ($1,$2,...) workarounds remain valid and arguably more CockroachDB-portable than ANY($N::int[]).

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR addresses a bun:sql driver incompatibility with PostgreSQL 18 where JS arrays passed to ANY($N) clauses were serialized as comma-separated strings instead of valid Postgres array literals, causing malformed array literal and array dimensions exceed maximum errors. All affected ANY($N::type[]) usages are replaced with IN ($1, $2, …) positional placeholders, and the large-hash dedup code paths are upgraded to a chunked temp-table strategy to avoid the 65535-bind-parameter ceiling.

• Search / MCP / dedup paths: every ANY($N) is replaced with positional IN expansion; empty-array short-circuits are added where ANY([]) previously silently matched no rows.
• Xref path: adopts the new pg(arr) list helper from @easier-idx/core@0.3.1, replacing a broken cast workaround that returned a Promise object at runtime.
• StoreOps: hand-rolled factories replaced with upstream createPgStoreOps / createSqliteStoreOps, picking up the new required transaction method in core 0.3.x.

Confidence Score: 5/5

Safe to merge — all changed code paths have been updated consistently and the fixes are mechanically correct.

Every ANY($N) call site is correctly migrated to positional IN placeholders with matching param arrays. The large-hash dedup paths are now protected by a well-structured chunked temp-table strategy. The xref fix eliminates a latent runtime breakage (Promise-as-parameter) that predates this PR. The StoreOps refactor is a clean net reduction in custom code. No incorrectly constructed placeholder index offsets, no missed empty-array guards, and no new cross-cutting concerns were introduced.

No files require special attention.

Important Files Changed

Filename	Overview
src/dedup/global-store-pg.ts	Replaces ANY array params with IN placeholders for small bounded arrays; uses a chunked temp-table approach for large live-hash sets in countBlobsExcept/deleteBlobsExcept, addressing the 65535-param ceiling concern from the previous review thread.
src/mcp/tools/files.ts	All four MCP tool handlers now expand repo IDs into IN ($1,$2,...) placeholders; empty-array short-circuits correctly preserve the 'no access' semantics.
src/search/query.ts	withSnippets fully parameterizes both repo IDs and file paths; withCrossRepoEdges reuses $1..$N across both IN clauses with a single bind — valid PostgreSQL wire-protocol behavior.
src/search/search-pg.ts	Repo IDs and file paths both properly parameterized; redundant integer validation guard removed since parameterized binding makes injection impossible.
src/xref.ts	Adopts pg(arr) list helper from core 0.3.1, replacing a broken cast workaround that returned a Promise at runtime.
src/repo.ts	Hand-rolled StoreOps replaced with createPgStoreOps/createSqliteStoreOps from core 0.3.1, eliminating ~25 lines of boilerplate.
package.json	Bumps @easier-idx/core from ^0.2.1 to ^0.3.1 to pull in the pg(arr) helper and factory functions.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant search-pg/query as search-pg / query.ts
    participant files.ts as mcp/files.ts
    participant global-store-pg as dedup/global-store-pg.ts
    participant xref.ts
    participant PG18 as PostgreSQL 18

    Note over Caller,PG18: Before: ANY($N::int[]) bun:sql encodes as a,b,c PG18 rejects

    Caller->>search-pg/query: searchPg / withSnippets
    search-pg/query->>PG18: WHERE repo_id IN ($1,$2) AND file_path IN ($3,$4,...)
    PG18-->>search-pg/query: rows

    Caller->>files.ts: getFileDependencies / getCrossRepoEdges
    files.ts->>files.ts: "scopedRepoIds.length===0 short-circuit []"
    files.ts->>PG18: WHERE repo_id IN ($1,$2,...)
    PG18-->>files.ts: rows

    Caller->>global-store-pg as dedup/global-store-pg.ts: countBlobsExcept / deleteBlobsExcept
    global-store-pg->>PG18: BEGIN
    global-store-pg->>PG18: CREATE TEMP TABLE _live_hashes ON COMMIT DROP
    loop chunks of 5000
        global-store-pg->>PG18: INSERT INTO _live_hashes VALUES ($1),($2),...
    end
    global-store-pg->>PG18: SELECT/DELETE WHERE NOT EXISTS _live_hashes
    PG18-->>global-store-pg: result
    global-store-pg->>PG18: COMMIT drops _live_hashes

    Caller->>xref.ts: xrefPg
    xref.ts->>PG18: WHERE content_hash IN pg(definitionHashes)
    PG18-->>xref.ts: rows

Loading

_{Reviews (2): Last reviewed commit: "refactor(search): reuse single placehold..." | Re-trigger Greptile}

[greptile-apps]

$N placeholder reuse is valid but inconsistent with sibling code

The getCrossRepoEdges query uses the same placeholders string ($1,$2,…$N) for both source_repo_id IN (…) and target_repo_id IN (…), passing a single copy of scopedRepoIds in params. PostgreSQL's wire protocol supports $N reuse within a query, so this is functionally correct. However, withCrossRepoEdges in src/search/query.ts handles the same pattern with separate placeholders/placeholders2 index ranges and two copies of the array — a style divergence that may confuse future readers. Consider aligning to one convention.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[smart-knowledge-systems]

@greptile-apps Both P2 issues addressed; please re-review:

1. src/dedup/global-store-pg.ts — large liveHashes parameter limit — countBlobsExcept/deleteBlobsExcept now load live hashes into a _live_hashes temp table in 5000-row chunks and filter via NOT EXISTS, so the 65535 bind-parameter ceiling no longer caps dedup set size (ef1fc4f).
2. src/search/query.ts — placeholder-reuse style divergence — withCrossRepoEdges now reuses the same $1..$N placeholders for both IN clauses and binds the repo-id list once, matching the style in getCrossRepoEdges (6c3b0d5).

(Note: greptile's prior pass was on 546ee75; main has since been merged at 960d16d, which may need a fresh look.)

Ready for re-review.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 696f0b1d-1abe-4a70-9cc2-736d78647a13

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}