fix(memory): improve extraction, indexing, and scanner reliability

[badrus123]

Summary

Fixes correctness and stability issues across ForgeGuard's memory subsystem, scanner, duplication detection, coverage handling, MCP schema, and command runner.

OMP integration has been removed from this PR. It remains out of scope until suiflex/kurir provides native OMP skill-directory, hook-file, and hook-registration support.

Changes

• Memory extraction
  • Correctly identify exported Rust items with attributes or doc comments and keep signatures free of decorators.
  • Extract exported JavaScript/TypeScript arrow functions and function expressions.
  • Normalize Python raw route strings and qualified superclass names.
• Memory store and indexing
  • Add a 5-second SQLite busy timeout.
  • Preserve schema metadata correctly and rebuild on schema mismatch.
  • Refresh stale indexes across commits, remove deleted or newly unindexable files, and preserve imported artifact metadata.
  • Fix receiver-scoped caller/callee counts and module-name normalization.
• Queries and tracing
  • Ignore write keywords inside Cypher string literals and avoid splitting clauses inside quoted text.
  • Keep inbound and outbound trace branches separate during bidirectional traversal.
• Core scanner and gate
  • Scan secrets before returning on syntax errors.
  • Respect maximum file size in semantic duplicate checks.
  • Add accurate duplicate finding ranges and support arrow-function clone scopes.
  • Normalize duplicate baseline evidence and merge duplicate LCOV records.
• Runner and CLI reliability
  • Terminate timed-out Unix process groups portably and fail closed when SBOM commands produce no valid JSON.
  • Require both stdin and stdout terminals before launching the init wizard.
  • Use typed MCP detail/direction arguments and keep JSON stdout valid when MCP registration fails.
  • Correct the Codex stop-hook block payload.

User-visible result

• Code-memory queries handle decorated Rust symbols, JavaScript/TypeScript arrows, Python routes, quoted Cypher values, and bidirectional traces correctly.
• Concurrent memory access waits briefly instead of failing immediately on SQLite contention.
• Timed-out checks do not leave descendant processes running.
• OMP support is intentionally deferred to a follow-up after native kurir support is released.

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --locked --workspace
• cargo build --locked --workspace --release
• sh tests/install_test.sh
• sh tests/wizard_test.sh
• forgeguard gate --changed --output compact
• Required guardener / forgeguard check

[mulhamna]

Hey @badrus123, thanks for putting this together!

The bugfixes across the memory subsystem & core scanner look really solid:

• AST extraction in Rust (skipping attributes/doc comments in signature and is_exported) and TS arrow function exports address real edge cases nicely.
• Cypher parser fix stripping string literals before checking forbidden write keywords avoids false positives on common identifier names like delete or select.
• Adding the 5s busy_timeout to SQLite and killing process groups on runner timeout are great stability improvements.

That said, I have a few major architectural concerns regarding the OMP harness integration:

1. Bypassing the Kurir Abstraction:
   Across our repos, all harness handling (resolving skill directories, hook file discovery, and hook mutation) is standardized and delegated to suiflex/kurir. In kurir 0.2.0, skills_dir(Harness::Omp) and hook_file(Harness::Omp) are not yet implemented.
2. Borrowing Harness::Codex in init.rs:
   In install_omp, calling skill_directory(Harness::Codex, scope) to borrow Codex's skill directory bypasses the Kurir contract and introduces brittle coupling.
3. Collision on .agents/hooks.json:
   .agents/hooks.json is currently owned by Antigravity. Forcing OMP hooks into the same file via install_antigravity_simple_hook means lifecycle events (Stop, PreInvocation) will overwrite each other whenever both harnesses are configured or when running --agent all.

Suggested Path Forward:

• Split this PR:
  1. PR 1 (Core & Memory Fixes): Extract the memory extraction, Cypher parser, SQLite timeout, runner timeout, and duplication fixes. This part is clean, well-tested, and ready to merge immediately.
  2. OMP Support: Standardize OMP in suiflex/kurir first (implementing proper skills_dir, hook_file, and hook registration). Once a new kurir release is out, we can bump the dependency in ForgeGuard and consume OMP natively without borrowing other harnesses or conflicting on hook files.

What do you think?