fix: sequential WASM grammar loading to fix crash on Node.js v20

web-tree-sitter ≤0.24.x has a race condition when loading multiple WASM
grammars concurrently via Promise.all(). The Emscripten glue code shares
global state during instantiation, causing cross-language symbol
contamination (e.g., 'bad export type for
tree_sitter_javascript_external_scanner_create: undefined').

This manifests on Node.js ≤20 but not ≥22 due to differences in V8's
WebAssembly.instantiate isolation behavior.

Fix: load grammars sequentially with a for..of loop instead of
Promise.all(). Also add graceful per-grammar error handling so one
failed grammar doesn't crash the entire scanner.

Also switch CLI and MCP server to workspace:* for @opencodereview/core
to ensure they always use the local build during development.

Closes: warden-core#499

Author: raye-deng

packages/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@opencodereview/cli",
   "version": "2.1.4",
-  "description": "Detect AI-hallucinated packages, phantom dependencies, and stale APIs in your codebase. Open-source CI/CD quality gate with local Ollama support — zero API cost.",
+  "description": "Detect AI-hallucinated packages, phantom dependencies, and stale APIs in your codebase. Open-source CI/CD quality gate with local Ollama support \u2014 zero API cost.",
   "type": "module",
   "bin": {
     "opencodereview": "./dist/index.js",
@@ -91,7 +91,7 @@
     "url": "https://github.com/raye-deng/open-code-review/issues"
   },
   "dependencies": {
-    "@opencodereview/core": "^2.1.1",
+    "@opencodereview/core": "workspace:*",
     "glob": "^10.3.0"
   },
   "devDependencies": {

packages/core/src/parser/manager.ts

@@ -127,16 +127,34 @@ export class ParserManager {
       },
     });
 
-    // Load grammars for all supported languages
+    // Load grammars for all supported languages SEQUENTIALLY.
+    // web-tree-sitter ≤0.24.x has a race condition when loading multiple
+    // WASM grammars concurrently via Promise.all() — the Emscripten glue
+    // code shares global state during instantiation, causing cross-language
+    // symbol contamination (e.g., "bad export type for
+    // 'tree_sitter_javascript_external_scanner_create': undefined").
+    // This manifests on Node.js ≤20 but not on Node.js ≥22 due to
+    // differences in V8's WebAssembly.instantiate isolation.
+    // See: https://github.com/nicolo-ribaudo/tree-sitter/nicolo-ribaudo/tree-sitter/issues/5172
     const languages = Object.keys(GRAMMAR_FILES) as SupportedLanguage[];
-    const loadPromises = languages.map(async (lang) => {
+    const errors: Array<{ lang: SupportedLanguage; error: Error }> = [];
+    for (const lang of languages) {
       const grammarFile = GRAMMAR_FILES[lang];
-      const grammarPath = resolveGrammarPath(grammarFile);
-      const language = await Parser.Language.load(grammarPath);
-      this.languages.set(lang, language);
-    });
-
-    await Promise.all(loadPromises);
+      try {
+        const grammarPath = resolveGrammarPath(grammarFile);
+        const language = await Parser.Language.load(grammarPath);
+        this.languages.set(lang, language);
+      } catch (err) {
+        // Non-fatal: log and continue so other languages still work.
+        // The grammar file may be missing or ABI-incompatible.
+        errors.push({ lang, error: err as Error });
+      }
+    }
+    if (errors.length > 0 && this.languages.size === 0) {
+      // All grammars failed — this is fatal.
+      const msgs = errors.map(e => `  ${e.lang}: ${e.error.message}`).join('\n');
+      throw new Error(`Failed to load any tree-sitter grammars:\n${msgs}`);
+    }
     this._initialized = true;
   }
 

packages/mcp-server/package.json

@@ -41,7 +41,7 @@
   "homepage": "https://codes.evallab.ai",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
-    "@opencodereview/core": "^2.1.1",
+    "@opencodereview/core": "workspace:*",
     "zod": "^3.24.0"
   },
   "devDependencies": {