Stream large files instead of loading into memory

- addresses latest review feedback for PR #119
- search-ql-code: check file size via lstatSync before reading; stream
  large files (>5 MB) line-by-line instead of skipping them
- evaluator-log-parser: replace readFileSync with streaming async
  generator (createReadStream + readline) for brace-depth JSON parsing;
  parseEvaluatorLog now reads the file once instead of twice
- profile-codeql-query: convert local parser to streaming with Map-based
  lookups instead of O(n) events.find()
- database-copier: use lstat in removeLockFiles to skip symlinks; throw
  on fatal mkdir failures for proper fallback in EnvironmentBuilder
- Validate contextLines/maxResults with schema bounds and clamping
- Add environment-builder test for syncAll-throws fallback

Author: data-douser

extensions/vscode/src/bridge/database-copier.ts

@@ -1,5 +1,5 @@
 import { existsSync } from 'fs';
-import { cp, mkdir, readdir, rm, stat, unlink } from 'fs/promises';
+import { cp, lstat, mkdir, readdir, rm, stat, unlink } from 'fs/promises';
 import { join } from 'path';
 import type { Logger } from '../common/logger';
 
@@ -34,10 +34,10 @@ export class DatabaseCopier {
     try {
       await mkdir(this.destinationBase, { recursive: true });
     } catch (err) {
-      this.logger.error(
-        `Failed to create managed database directory ${this.destinationBase}: ${err instanceof Error ? err.message : String(err)}`,
-      );
-      return [];
+      const msg =
+        `Failed to create managed database directory ${this.destinationBase}: ${err instanceof Error ? err.message : String(err)}`;
+      this.logger.error(msg);
+      throw new Error(msg, { cause: err });
     }
 
     const copied: string[] = [];
@@ -137,8 +137,8 @@ async function isCodeQLDatabase(dirPath: string): Promise<boolean> {
 
 /**
  * Recursively remove all `.lock` files under the given directory.
- * These are empty sentinel files created by the CodeQL query server in
- * `<dataset>/default/cache/.lock`.
+ * Uses lstat to avoid following symlinks, keeping deletion scoped to
+ * the copied database tree.
  */
 async function removeLockFiles(dir: string): Promise<void> {
   let entries: string[];
@@ -151,7 +151,11 @@ async function removeLockFiles(dir: string): Promise<void> {
   for (const entry of entries) {
     const fullPath = join(dir, entry);
     try {
-      const st = await stat(fullPath);
+      const st = await lstat(fullPath);
+      // Skip symlinks to avoid traversing outside the database directory
+      if (st.isSymbolicLink()) {
+        continue;
+      }
       if (st.isDirectory()) {
         await removeLockFiles(fullPath);
       } else if (entry === '.lock') {

extensions/vscode/test/bridge/environment-builder.test.ts

@@ -206,6 +206,15 @@ describe('EnvironmentBuilder', () => {
     vscode.workspace.getConfiguration = originalGetConfig;
   });
 
+  it('should fall back to source dirs when syncAll throws', async () => {
+    mockCopier.syncAll.mockRejectedValue(new Error('Failed to create managed database directory'));
+    builder.invalidate();
+    const env = await builder.build();
+    expect(env.CODEQL_DATABASES_BASE_DIRS).toBe(
+      ['/mock/global-storage/GitHub.vscode-codeql', '/mock/workspace-storage/ws-123/GitHub.vscode-codeql'].join(delimiter),
+    );
+  });
+
   it('should append user-configured dirs to CODEQL_QUERY_RUN_RESULTS_DIRS', async () => {
     const vscode = await import('vscode');
     const originalGetConfig = vscode.workspace.getConfiguration;