gitnexus 1.6.10-rc.21 → 1.6.10-rc.211

package/dist/cli/eval-server.js

@@ -16,7 +16,8 @@
  * Usage:
  *   gitnexus eval-server                        # default port 4848, binds 127.0.0.1
  *   gitnexus eval-server --port 4848            # explicit port
- *   gitnexus eval-server --host 0.0.0.0         # reachable from other VMs / containers
+ *   GITNEXUS_AUTH_TOKEN=... gitnexus eval-server --host 0.0.0.0
+ *   GITNEXUS_AUTH_TOKEN=... gitnexus eval-server --host devbox.local
  *   gitnexus eval-server --idle-timeout 300     # auto-shutdown after 300s idle
  *
  * READY signal format: GITNEXUS_EVAL_SERVER_READY:<host>:<port>
@@ -30,12 +31,16 @@
  */
 import http from 'http';
 import crypto from 'node:crypto';
+import { lookup } from 'node:dns/promises';
 import { isIPv4, isIPv6 } from 'node:net';
-import { writeSync } from 'node:fs';
+import { readFileSync, writeSync } from 'node:fs';
+import path from 'node:path';
+import { parseEnv } from 'node:util';
 import { LocalBackend, } from '../mcp/local/local-backend.js';
 import { logger } from '../core/logger.js';
 import { cliInfo, cliWarn, cliError } from './cli-message.js';
 import { formatDetectChangesResult } from './detect-changes-format.js';
+import { formatSymbolLine } from './format-symbol.js';
 export { formatDetectChangesResult } from './detect-changes-format.js';
 /**
  * Validate the --host value. Accepts IPv4, IPv6, or "localhost".
@@ -50,6 +55,86 @@ export function validateHost(raw) {
         return raw;
     return null;
 }
+function isHostname(raw) {
+    if (!raw || raw.length > 253 || /^[\d.]+$/.test(raw))
+        return false;
+    return raw
+        .split('.')
+        .every((label) => label.length > 0 &&
+        label.length <= 63 &&
+        /^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$/.test(label));
+}
+/** Resolve a DNS bind name once so validation and listen() use the same concrete address. */
+export async function resolveEvalServerBindHost(raw, resolveHostname = async (hostname) => (await lookup(hostname, { family: 4 })).address) {
+    const directHost = validateHost(raw);
+    if (directHost && directHost !== 'localhost')
+        return directHost;
+    if (directHost !== 'localhost' && !isHostname(raw))
+        return null;
+    try {
+        const address = await resolveHostname(raw);
+        return isIPv4(address) ? address : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readAuthTokenFile(filePath) {
+    try {
+        return parseEnv(readFileSync(filePath, 'utf8')).GITNEXUS_AUTH_TOKEN?.trim() || undefined;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw new Error(`Unable to read eval-server authentication from ${filePath}`, { cause: error });
+    }
+}
+/** Resolve the bearer token from the shell, then .env.local, then .env. */
+export function resolveEvalServerAuthToken(env, cwd = process.cwd()) {
+    if (Object.hasOwn(env, 'GITNEXUS_AUTH_TOKEN')) {
+        return env.GITNEXUS_AUTH_TOKEN?.trim() || undefined;
+    }
+    return (readAuthTokenFile(path.join(cwd, '.env.local')) ?? readAuthTokenFile(path.join(cwd, '.env')));
+}
+/** True only for literal loopback addresses; DNS names are resolved before this check. */
+export function isEvalServerLoopbackHost(host) {
+    return host === 'localhost' || host === '::1' || (isIPv4(host) && host.startsWith('127.'));
+}
+/**
+ * Resolve the bearer token for a concrete bind host. An unreadable `.env` /
+ * `.env.local` only matters when the binding actually requires a token, so
+ * loopback binds degrade to a warning instead of refusing to start; any
+ * non-loopback bind keeps the fail-closed error.
+ */
+export function resolveEvalServerAuthTokenForHost(host, env, cwd = process.cwd()) {
+    try {
+        return { token: resolveEvalServerAuthToken(env, cwd) };
+    }
+    catch (error) {
+        if (isEvalServerLoopbackHost(host)) {
+            const reason = error instanceof Error ? error.message : String(error);
+            return { warning: `${reason} Continuing without authentication on loopback host ${host}.` };
+        }
+        throw error;
+    }
+}
+/** Refuse exposure of the eval-server query surface without authentication. */
+export function assertSecureEvalServerBinding(host, authToken) {
+    if (!authToken && !isEvalServerLoopbackHost(host)) {
+        throw new Error(`Refusing to start eval-server on non-loopback host ${host} without authentication. ` +
+            'Set GITNEXUS_AUTH_TOKEN or bind to 127.0.0.1, localhost, or ::1.');
+    }
+}
+/** Validate the exact Bearer header while keeping token comparison constant-time. */
+export function isEvalServerBearerAuthorized(authorization, authToken) {
+    if (!authToken)
+        return true;
+    const expected = Buffer.from(`Bearer ${authToken}`, 'utf8');
+    const supplied = typeof authorization === 'string' ? Buffer.from(authorization, 'utf8') : null;
+    const sameLength = supplied?.length === expected.length;
+    const candidate = sameLength && supplied ? supplied : Buffer.alloc(expected.length);
+    return crypto.timingSafeEqual(candidate, expected) && sameLength;
+}
 // ─── Text Formatters ──────────────────────────────────────────────────
 // Convert structured JSON results into compact, LLM-friendly text.
 // Design: minimize tokens, maximize actionability.
@@ -81,7 +166,7 @@ export function formatQueryResult(result) {
     if (defs.length > 0) {
         lines.push(`Standalone definitions:`);
         for (const d of defs.slice(0, 8)) {
-            lines.push(`  ${d.type || 'Symbol'} ${d.name} → ${d.filePath || '?'}`);
+            lines.push(formatSymbolLine(d.type, d.name, d.filePath));
         }
         if (defs.length > 8)
             lines.push(`  ... and ${defs.length - 8} more`);
@@ -545,15 +630,38 @@ export async function evalServerCommand(options) {
     const port = parseInt(options?.port || '4848');
     const idleTimeoutSec = parseInt(options?.idleTimeout || '0');
     const rawHost = options?.host ?? '127.0.0.1';
-    const host = validateHost(rawHost);
+    const host = await resolveEvalServerBindHost(rawHost);
     if (!host) {
         cliError(`Invalid --host value "${rawHost}":\n` +
-            `  Must be an IP address or "localhost".\n\n` +
+            `  Must be an IP address or a hostname that resolves to a local IPv4 address.\n\n` +
             `  Examples:\n` +
             `    gitnexus eval-server --host 127.0.0.1    (loopback only, default)\n` +
-            `    gitnexus eval-server --host 0.0.0.0      (all network interfaces)\n` +
-            `    gitnexus eval-server --host 192.168.1.5  (specific interface)\n` +
-            `    gitnexus eval-server --host localhost     (OS-resolved loopback)\n`, { flag: '--host', value: rawHost });
+            `    GITNEXUS_AUTH_TOKEN=... gitnexus eval-server --host 0.0.0.0\n` +
+            `    GITNEXUS_AUTH_TOKEN=... gitnexus eval-server --host 192.168.1.5\n` +
+            `    gitnexus eval-server --host localhost     (resolved IPv4 loopback)\n` +
+            `    GITNEXUS_AUTH_TOKEN=... gitnexus eval-server --host devbox.local\n`, { flag: '--host', value: rawHost });
+        process.exit(1);
+    }
+    let authToken;
+    try {
+        const resolved = resolveEvalServerAuthTokenForHost(host, process.env);
+        authToken = resolved.token;
+        if (resolved.warning)
+            cliWarn(resolved.warning);
+    }
+    catch (error) {
+        cliError(error instanceof Error
+            ? error.message
+            : 'Unable to read eval-server authentication configuration.');
+        process.exit(1);
+    }
+    try {
+        assertSecureEvalServerBinding(host, authToken);
+    }
+    catch (error) {
+        cliError(error instanceof Error ? error.message : 'Refusing insecure eval-server binding.', {
+            host,
+        });
         process.exit(1);
     }
     const backend = new LocalBackend();
@@ -589,6 +697,13 @@ export async function evalServerCommand(options) {
     // shut down locally without a token.)
     const shutdownToken = crypto.randomBytes(24).toString('hex');
     const server = http.createServer(async (req, res) => {
+        if (!isEvalServerBearerAuthorized(req.headers.authorization, authToken)) {
+            res.setHeader('Content-Type', 'application/json');
+            res.setHeader('WWW-Authenticate', 'Bearer');
+            res.writeHead(401);
+            res.end(JSON.stringify({ error: 'Unauthorized' }));
+            return;
+        }
         resetIdleTimer();
         try {
             // Health check
@@ -680,7 +795,7 @@ export async function evalServerCommand(options) {
                         `  Run \`ip addr\` (Linux) or \`ipconfig\` (Windows) to list available addresses.\n\n`) +
                 `  Common fixes:\n` +
                 `    gitnexus eval-server --host 127.0.0.1  (loopback, this machine only)\n` +
-                `    gitnexus eval-server --host 0.0.0.0    (all interfaces, reachable from other VMs)\n`, { code: err.code, port, host });
+                `    GITNEXUS_AUTH_TOKEN=... gitnexus eval-server --host 0.0.0.0\n`, { code: err.code, port, host });
         }
         else if (err.code === 'EACCES') {
             cliError(`\nGitNexus eval-server failed to start:\n` +
@@ -723,6 +838,9 @@ export async function evalServerCommand(options) {
             `  GET  /health        — health check`,
             `  POST /shutdown      — graceful shutdown`,
         ];
+        if (authToken) {
+            bannerLines.push('  Bearer authentication enabled');
+        }
         if (idleTimeoutSec > 0) {
             bannerLines.push(`  Auto-shutdown after ${idleTimeoutSec}s idle`);
         }
@@ -730,6 +848,7 @@ export async function evalServerCommand(options) {
             port: boundPort,
             host,
             idleTimeoutSec: idleTimeoutSec > 0 ? idleTimeoutSec : undefined,
+            authEnabled: Boolean(authToken),
             endpoints: [
                 'POST /tool/query',
                 'POST /tool/context',

package/dist/cli/format-symbol.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Symbol listing line — the one rendering of `Type name → path` shared by every
+ * formatter that lists symbols. Kept in its own tool-neutral module so a new
+ * consumer does not have to import it from another tool's formatter.
+ */
+/**
+ * One indented `Type name → path` listing line for a symbol. Shared by the
+ * `detect_changes` CLI formatter and the eval-server `query` formatter so the
+ * two renderings cannot drift apart.
+ *
+ * `||`, not `??`: a node whose label came back as an EMPTY STRING (several node
+ * types do — see enrichCandidateLabels) still needs the placeholder, and `??`
+ * would print the empty string instead.
+ */
+export declare function formatSymbolLine(type: string | undefined, name: string | undefined, filePath: string | undefined): string;

package/dist/cli/format-symbol.js

@@ -0,0 +1,17 @@
+/**
+ * Symbol listing line — the one rendering of `Type name → path` shared by every
+ * formatter that lists symbols. Kept in its own tool-neutral module so a new
+ * consumer does not have to import it from another tool's formatter.
+ */
+/**
+ * One indented `Type name → path` listing line for a symbol. Shared by the
+ * `detect_changes` CLI formatter and the eval-server `query` formatter so the
+ * two renderings cannot drift apart.
+ *
+ * `||`, not `??`: a node whose label came back as an EMPTY STRING (several node
+ * types do — see enrichCandidateLabels) still needs the placeholder, and `??`
+ * would print the empty string instead.
+ */
+export function formatSymbolLine(type, name, filePath) {
+    return `  ${type || 'Symbol'} ${name || '?'} → ${filePath || '?'}`;
+}

package/dist/cli/generated-skill.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Metadata for one repo-specific skill file generated from a detected
+ * community.
+ *
+ * Produced by `skill-gen`'s `generateSkillFiles` and consumed by `ai-context`
+ * when it lists the generated skills in AGENTS.md / CLAUDE.md. It lives in this
+ * leaf module rather than in either of those so the consumer does not have to
+ * import the producer for a type — `ai-context` already supplies the
+ * `.agents/` mirror check that `skill-gen` calls, and the two directions
+ * together made an import cycle.
+ */
+export interface GeneratedSkillInfo {
+    name: string;
+    label: string;
+    symbolCount: number;
+    fileCount: number;
+}

package/dist/cli/generated-skill.js

@@ -0,0 +1 @@
+export {};

package/dist/cli/group.js

@@ -213,9 +213,30 @@ export function registerGroupCommands(program) {
             else {
                 const summary = raw?.summary;
                 const risk = raw?.risk;
-                console.log(`Group impact for "${name}" (${String(opts.repo)}): risk=${risk ?? '?'}`);
+                // A truncated fan-out under-reports risk (mergeRisk only grows with
+                // traversed crossings), and the default human output used to print a
+                // bare `risk=` indistinguishable from a complete run — the JSON
+                // already carried `truncated`, but nobody reading the terminal saw it.
+                const riskFloor = raw?.riskEpistemic === 'lower-bound' ? '+' : '';
+                const boundaryOnly = raw?.cross?.filter((entry) => entry.fanout_status === 'not_attempted').length ?? 0;
+                console.log(`Group impact for "${name}" (${String(opts.repo)}): risk=${risk ?? '?'}${riskFloor}`);
                 if (summary) {
-                    console.log(`  direct=${summary.direct ?? 0} processes=${summary.processes_affected ?? 0} cross=${summary.cross_repo_hits ?? 0}`);
+                    const boundaryNote = boundaryOnly > 0 ? ` (${boundaryOnly} boundary-only)` : '';
+                    console.log(`  direct=${summary.direct ?? 0} processes=${summary.processes_affected ?? 0} cross=${summary.cross_repo_hits ?? 0}${boundaryNote}`);
+                }
+                if (riskFloor) {
+                    // `truncated` has two independent causes that point at different
+                    // subsystems, so the note must name the one that actually fired:
+                    // dropped crossings, or a local walk that never finished (most
+                    // often the impact chunk cap, which any symbol with more than a
+                    // thousand locally-impacted nodes hits on every run). `dropped` is
+                    // deduped to distinct repos before it reaches here, so it counts
+                    // repos — reporting it as crossings understates a fan-out cap the
+                    // same way #2787's totals did.
+                    const dropped = raw?.truncatedRepos ?? [];
+                    console.log(dropped.length > 0
+                        ? `  risk is a LOWER BOUND — fan-out stopped early; crossings to ${dropped.length} repo(s) not traversed: ${dropped.join(', ')}`
+                        : '  risk is a LOWER BOUND — the local impact walk did not complete (every bridge crossing was traversed)');
                 }
             }
         }

package/dist/cli/help-i18n.js

@@ -53,6 +53,7 @@ const OPTION_DESCRIPTION_KEYS = {
     'analyze|--skills': 'help.option.analyze.skills',
     'analyze|--skip-agents-md': 'help.option.analyze.skipAgentsMd',
     'analyze|--no-stats': 'help.option.analyze.noStats',
+    'analyze|--self-commit': 'help.option.analyze.selfCommit',
     'analyze|--skip-skills': 'help.option.analyze.skipSkills',
     'analyze|--index-only': 'help.option.analyze.indexOnly',
     'analyze|--skip-git': 'help.option.skipGit',
@@ -75,6 +76,7 @@ const OPTION_DESCRIPTION_KEYS = {
     'mcp|--auth-token <token>': 'help.option.mcp.authToken',
     'serve|-p, --port <port>': 'help.option.port',
     'serve|--host <host>': 'help.option.serve.host',
+    'status|--json': 'help.option.status.json',
     'uninstall|-f, --force': 'help.option.uninstall.force',
     'clean|-f, --force': 'help.option.force.confirmation',
     'clean|--all': 'help.option.clean.all',
@@ -92,6 +94,7 @@ const OPTION_DESCRIPTION_KEYS = {
     'wiki|--concurrency <n>': 'help.option.wiki.concurrency',
     'wiki|--timeout <seconds>': 'help.option.wiki.timeout',
     'wiki|--retries <n>': 'help.option.wiki.retries',
+    'wiki|--allow-insecure-connection <host>': 'help.option.wiki.allowInsecureConnection',
     'wiki|--gist': 'help.option.wiki.gist',
     'wiki|-v, --verbose': 'help.option.verbose',
     'wiki|--review': 'help.option.wiki.review',

package/dist/cli/i18n/en.d.ts

@@ -26,6 +26,8 @@ export declare const en: {
     readonly 'status.indexed': "Indexed";
     readonly 'status.indexedCommit': "Indexed commit";
     readonly 'status.currentCommit': "Current commit";
+    readonly 'status.indexRunnerIdentity': "Indexed analyzer runner identity";
+    readonly 'status.currentRunnerIdentity': "Current analyzer runner identity";
     readonly 'status.branch': "Branch";
     readonly 'status.detached': "(detached HEAD)";
     readonly 'status.workspaceIndexLabel': "Workspace index: last analyzed on '{{primary}}' (re-run gitnexus analyze to follow the current branch)";
@@ -52,10 +54,13 @@ export declare const en: {
     readonly 'tool.usage.query': "Usage: gitnexus query [search_query]  or  gitnexus query --query <text>";
     readonly 'tool.usage.context': "Usage: gitnexus context <symbol_name> [--uid <uid>] [--file <path>]";
     readonly 'tool.usage.impact': "Usage: gitnexus impact <symbol_name> [--uid <uid>] [--file <path>] [--kind <kind>] [--direction upstream|downstream]";
-    readonly 'tool.usage.trace': "Usage: gitnexus trace <from> <to> [--from-uid <uid>] [--to-uid <uid>] [--depth <n>]";
+    readonly 'tool.usage.trace': "Usage: gitnexus trace <from> <to> [-f|--file <path>] [--from-file <path>] [--to-file <path>] [--from-uid <uid>] [--to-uid <uid>] [--depth <n>]";
     readonly 'tool.usage.cypher': "Usage: gitnexus cypher <cypher_query>";
     readonly 'tool.warn.unknownKind': "--kind '{{kind}}' is not a known symbol kind (e.g. Function, Class, Method); it will not narrow the result.";
     readonly 'tool.detectChanges.noChanges': "No changes detected.";
+    readonly 'tool.detectChanges.partial': "PARTIAL RESULT: a graph query failed, so changed symbols may be missing. Do not read this as a clean pre-commit check.";
+    readonly 'tool.detectChanges.truncated': "LISTING CAPPED: the changed-symbol list was capped, so it does not name every changed symbol. The counts and risk level still cover all of them.";
+    readonly 'tool.detectChanges.truncatedDegraded': "LISTING CAPPED: the changed-symbol list was capped. The run also degraded, so the counts are a lower bound, not a total.";
     readonly 'tool.detectChanges.changesSummary': "Changes: {{files}} files, {{symbols}} symbols";
     readonly 'tool.detectChanges.affectedProcesses': "Affected processes: {{count}}";
     readonly 'tool.detectChanges.riskLevel': "Risk level: {{risk}}";
@@ -151,7 +156,8 @@ export declare const en: {
     readonly 'help.option.analyze.skills': "Generate repo-specific skill files from detected communities (no-op when --index-only is also set).";
     readonly 'help.option.analyze.skipAgentsMd': "Skip updating the gitnexus section in AGENTS.md and CLAUDE.md";
     readonly 'help.option.analyze.noStats': "Omit volatile file/symbol counts from AGENTS.md and CLAUDE.md";
-    readonly 'help.option.analyze.skipSkills': "Skip installing standard GitNexus skill files under .claude/skills/gitnexus/. Does not suppress community skills from --skills (those use .claude/skills/generated/). Use --index-only to skip all AI-context file injection.";
+    readonly 'help.option.analyze.selfCommit': "Auto-commit AGENTS.md/CLAUDE.md changes after analyze (opt-in, off by default). Scoped to only those two files (never `git add -A`); no-ops if neither exists, neither changed, or the repo has no git identity configured.";
+    readonly 'help.option.analyze.skipSkills': "Skip installing standard GitNexus skill files directly under .claude/skills/ and .agents/skills/. Does not suppress community skills from --skills (those use .claude/skills/gitnexus-area-*). Use --index-only to skip all AI-context file injection.";
     readonly 'help.option.analyze.indexOnly': "Pure index mode: skip all file injection (AGENTS.md, CLAUDE.md, skills)";
     readonly 'help.option.skipGit': "Treat the provided path/cwd as the index root and skip parent git-root discovery";
     readonly 'help.option.analyze.name': "Register this repo under a custom name in ~/.gitnexus/registry.json (disambiguates repos whose paths share a basename, e.g. two different .../app folders)";
@@ -178,16 +184,17 @@ export declare const en: {
     readonly 'help.option.clean.branch': "Delete only the named branch index (not the workspace index)";
     readonly 'help.option.clean.lbugSidecars': "Clean parked LadybugDB recovery sidecars (missing-shadow WAL quarantines and dirty-recovery parks)";
     readonly 'help.option.wiki.force': "Force full regeneration even if up to date";
-    readonly 'help.option.wiki.provider': "LLM provider: openai, openrouter, azure, custom, cursor, claude, codex, or opencode (default: openai)";
-    readonly 'help.option.wiki.model': "LLM model or Azure deployment name (default: minimax/minimax-m2.5)";
+    readonly 'help.option.wiki.provider': "LLM provider: minimax, openai, openrouter, azure, custom, cursor, claude, codex, or opencode (default: minimax)";
+    readonly 'help.option.wiki.model': "LLM model or deployment name (default: MiniMax-M3)";
     readonly 'help.option.wiki.baseUrl': "LLM API base URL. Azure v1: https://{resource}.openai.azure.com/openai/v1";
     readonly 'help.option.wiki.apiKey': "LLM API key or Azure api-key (saved to ~/.gitnexus/config.json)";
     readonly 'help.option.wiki.apiVersion': "Azure api-version query param, e.g. 2024-10-21 (legacy Azure API only)";
-    readonly 'help.option.wiki.reasoningModel': "Mark deployment as reasoning model (o1/o3/o4-mini) — strips temperature, uses max_completion_tokens";
-    readonly 'help.option.wiki.noReasoningModel': "Disable reasoning model mode (overrides saved config)";
+    readonly 'help.option.wiki.reasoningModel': "Enable reasoning mode; MiniMax-M3 uses adaptive thinking";
+    readonly 'help.option.wiki.noReasoningModel': "Disable reasoning mode; MiniMax-M3 disables thinking";
     readonly 'help.option.wiki.concurrency': "Parallel LLM calls (default: 3)";
     readonly 'help.option.wiki.timeout': "LLM request timeout in seconds (default: disabled)";
     readonly 'help.option.wiki.retries': "Max LLM retry attempts per request (default: 3)";
+    readonly 'help.option.wiki.allowInsecureConnection': "Allow exact host(s) for http:// LLM base URLs (comma-separated; HTTPS is preferred)";
     readonly 'help.option.wiki.gist': "Publish wiki as a public GitHub Gist after generation";
     readonly 'help.option.wiki.review': "Stop after grouping to review module structure before generating pages";
     readonly 'help.option.wiki.lang': "Output language for generated documentation (e.g. english, chinese, spanish, japanese)";
@@ -221,7 +228,7 @@ export declare const en: {
     readonly 'help.option.detectChanges.limit': "Max changed symbols to return";
     readonly 'help.option.cypher.limit': "Max result rows to return";
     readonly 'help.option.check.cycles': "Detect circular imports and fail when any are found";
-    readonly 'help.option.evalServer.host': "Bind address (default: 127.0.0.1, use 0.0.0.0 to expose to all interfaces)";
+    readonly 'help.option.evalServer.host': "Bind address or resolvable hostname (default: 127.0.0.1; non-loopback requires GITNEXUS_AUTH_TOKEN; hostnames resolve to IPv4)";
     readonly 'help.option.evalServer.idleTimeout': "Auto-shutdown after N seconds idle (0 = disabled)";
     readonly 'help.option.embeddings.install.cuda': "Also download the CUDA GPU binaries (runs onnxruntime-node's NuGet postinstall; set GLOBAL_AGENT_HTTPS_PROXY behind a proxy)";
     readonly 'help.option.embeddings.install.force': "Install into the runtime prefix even when the stack already resolves";
@@ -230,6 +237,7 @@ export declare const en: {
     readonly 'help.option.group.sync.exactOnly': "Exact match only";
     readonly 'help.option.group.sync.allowStale': "Skip stale index warnings";
     readonly 'help.option.group.sync.verbose': "Show each cross-link detail";
+    readonly 'help.option.status.json': "Emit machine-readable index and analyzer provenance";
     readonly 'help.option.json': "JSON output";
     readonly 'help.option.group.impact.target': "Symbol or file name to analyze";
     readonly 'help.option.group.impact.repo': "Member path from group.yaml (e.g. app/backend), not the indexed repo name";
@@ -243,5 +251,6 @@ export declare const en: {
     readonly 'help.option.group.contracts.type': "Filter by contract type";
     readonly 'help.option.group.contracts.repo': "Filter by repo";
     readonly 'help.option.group.contracts.unmatched': "Show only unmatched contracts";
-    readonly 'help.analyze.environment': "\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS=N  Max wait at pool shutdown for a retired worker still inside native code (terminated at its next safe point instead of aborting the process). Default 30000.\n  GITNEXUS_CPP_CAPTURE_BUDGET_MS=N  Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning. Default 20000.\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).";
+    readonly 'help.identityCache.environment': "\nAnalyzer identity cache:\n  GITNEXUS_ANALYZER_IDENTITY_CACHE_DIR=/absolute/protected/dir\n    Operator-trusted persistent cache for warm cross-process status. The directory must pre-exist, be outside the GitNexus package/build roots, and contain no symlink or junction components. Defaults remain fail-closed on platforms without POSIX ownership APIs.";
+    readonly 'help.analyze.environment': "\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_ANALYZER_IDENTITY_CACHE_DIR=/absolute/protected/dir  Operator-trusted persistent analyzer identity cache; must pre-exist, be outside package/build roots, and contain no symlink/junction components.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS=N  Max wait at pool shutdown for a retired worker still inside native code (terminated at its next safe point instead of aborting the process). Default 30000.\n  GITNEXUS_CPP_CAPTURE_BUDGET_MS=N  Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning. Default 20000.\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).";
 };

package/dist/cli/i18n/en.js

@@ -26,6 +26,8 @@ export const en = {
     'status.indexed': 'Indexed',
     'status.indexedCommit': 'Indexed commit',
     'status.currentCommit': 'Current commit',
+    'status.indexRunnerIdentity': 'Indexed analyzer runner identity',
+    'status.currentRunnerIdentity': 'Current analyzer runner identity',
     'status.branch': 'Branch',
     'status.detached': '(detached HEAD)',
     'status.workspaceIndexLabel': "Workspace index: last analyzed on '{{primary}}' (re-run gitnexus analyze to follow the current branch)",
@@ -52,10 +54,15 @@ export const en = {
     'tool.usage.query': 'Usage: gitnexus query [search_query]  or  gitnexus query --query <text>',
     'tool.usage.context': 'Usage: gitnexus context <symbol_name> [--uid <uid>] [--file <path>]',
     'tool.usage.impact': 'Usage: gitnexus impact <symbol_name> [--uid <uid>] [--file <path>] [--kind <kind>] [--direction upstream|downstream]',
-    'tool.usage.trace': 'Usage: gitnexus trace <from> <to> [--from-uid <uid>] [--to-uid <uid>] [--depth <n>]',
+    'tool.usage.trace': 'Usage: gitnexus trace <from> <to> [-f|--file <path>] [--from-file <path>] [--to-file <path>] [--from-uid <uid>] [--to-uid <uid>] [--depth <n>]',
     'tool.usage.cypher': 'Usage: gitnexus cypher <cypher_query>',
     'tool.warn.unknownKind': "--kind '{{kind}}' is not a known symbol kind (e.g. Function, Class, Method); it will not narrow the result.",
     'tool.detectChanges.noChanges': 'No changes detected.',
+    'tool.detectChanges.partial': 'PARTIAL RESULT: a graph query failed, so changed symbols may be missing. Do not read this as a clean pre-commit check.',
+    'tool.detectChanges.truncated': 'LISTING CAPPED: the changed-symbol list was capped, so it does not name every changed symbol. The counts and risk level still cover all of them.',
+    // The reassurance above is only true on its own. When the run also degraded,
+    // `changed_count` was summed from the batches that SUCCEEDED, so it is a floor.
+    'tool.detectChanges.truncatedDegraded': 'LISTING CAPPED: the changed-symbol list was capped. The run also degraded, so the counts are a lower bound, not a total.',
     'tool.detectChanges.changesSummary': 'Changes: {{files}} files, {{symbols}} symbols',
     'tool.detectChanges.affectedProcesses': 'Affected processes: {{count}}',
     'tool.detectChanges.riskLevel': 'Risk level: {{risk}}',
@@ -151,7 +158,8 @@ export const en = {
     'help.option.analyze.skills': 'Generate repo-specific skill files from detected communities (no-op when --index-only is also set).',
     'help.option.analyze.skipAgentsMd': 'Skip updating the gitnexus section in AGENTS.md and CLAUDE.md',
     'help.option.analyze.noStats': 'Omit volatile file/symbol counts from AGENTS.md and CLAUDE.md',
-    'help.option.analyze.skipSkills': 'Skip installing standard GitNexus skill files under .claude/skills/gitnexus/. Does not suppress community skills from --skills (those use .claude/skills/generated/). Use --index-only to skip all AI-context file injection.',
+    'help.option.analyze.selfCommit': 'Auto-commit AGENTS.md/CLAUDE.md changes after analyze (opt-in, off by default). Scoped to only those two files (never `git add -A`); no-ops if neither exists, neither changed, or the repo has no git identity configured.',
+    'help.option.analyze.skipSkills': 'Skip installing standard GitNexus skill files directly under .claude/skills/ and .agents/skills/. Does not suppress community skills from --skills (those use .claude/skills/gitnexus-area-*). Use --index-only to skip all AI-context file injection.',
     'help.option.analyze.indexOnly': 'Pure index mode: skip all file injection (AGENTS.md, CLAUDE.md, skills)',
     'help.option.skipGit': 'Treat the provided path/cwd as the index root and skip parent git-root discovery',
     'help.option.analyze.name': 'Register this repo under a custom name in ~/.gitnexus/registry.json (disambiguates repos whose paths share a basename, e.g. two different .../app folders)',
@@ -178,16 +186,17 @@ export const en = {
     'help.option.clean.branch': 'Delete only the named branch index (not the workspace index)',
     'help.option.clean.lbugSidecars': 'Clean parked LadybugDB recovery sidecars (missing-shadow WAL quarantines and dirty-recovery parks)',
     'help.option.wiki.force': 'Force full regeneration even if up to date',
-    'help.option.wiki.provider': 'LLM provider: openai, openrouter, azure, custom, cursor, claude, codex, or opencode (default: openai)',
-    'help.option.wiki.model': 'LLM model or Azure deployment name (default: minimax/minimax-m2.5)',
+    'help.option.wiki.provider': 'LLM provider: minimax, openai, openrouter, azure, custom, cursor, claude, codex, or opencode (default: minimax)',
+    'help.option.wiki.model': 'LLM model or deployment name (default: MiniMax-M3)',
     'help.option.wiki.baseUrl': 'LLM API base URL. Azure v1: https://{resource}.openai.azure.com/openai/v1',
     'help.option.wiki.apiKey': 'LLM API key or Azure api-key (saved to ~/.gitnexus/config.json)',
     'help.option.wiki.apiVersion': 'Azure api-version query param, e.g. 2024-10-21 (legacy Azure API only)',
-    'help.option.wiki.reasoningModel': 'Mark deployment as reasoning model (o1/o3/o4-mini) — strips temperature, uses max_completion_tokens',
-    'help.option.wiki.noReasoningModel': 'Disable reasoning model mode (overrides saved config)',
+    'help.option.wiki.reasoningModel': 'Enable reasoning mode; MiniMax-M3 uses adaptive thinking',
+    'help.option.wiki.noReasoningModel': 'Disable reasoning mode; MiniMax-M3 disables thinking',
     'help.option.wiki.concurrency': 'Parallel LLM calls (default: 3)',
     'help.option.wiki.timeout': 'LLM request timeout in seconds (default: disabled)',
     'help.option.wiki.retries': 'Max LLM retry attempts per request (default: 3)',
+    'help.option.wiki.allowInsecureConnection': 'Allow exact host(s) for http:// LLM base URLs (comma-separated; HTTPS is preferred)',
     'help.option.wiki.gist': 'Publish wiki as a public GitHub Gist after generation',
     'help.option.wiki.review': 'Stop after grouping to review module structure before generating pages',
     'help.option.wiki.lang': 'Output language for generated documentation (e.g. english, chinese, spanish, japanese)',
@@ -221,7 +230,7 @@ export const en = {
     'help.option.detectChanges.limit': 'Max changed symbols to return',
     'help.option.cypher.limit': 'Max result rows to return',
     'help.option.check.cycles': 'Detect circular imports and fail when any are found',
-    'help.option.evalServer.host': 'Bind address (default: 127.0.0.1, use 0.0.0.0 to expose to all interfaces)',
+    'help.option.evalServer.host': 'Bind address or resolvable hostname (default: 127.0.0.1; non-loopback requires GITNEXUS_AUTH_TOKEN; hostnames resolve to IPv4)',
     'help.option.evalServer.idleTimeout': 'Auto-shutdown after N seconds idle (0 = disabled)',
     'help.option.embeddings.install.cuda': "Also download the CUDA GPU binaries (runs onnxruntime-node's NuGet postinstall; set GLOBAL_AGENT_HTTPS_PROXY behind a proxy)",
     'help.option.embeddings.install.force': 'Install into the runtime prefix even when the stack already resolves',
@@ -230,6 +239,7 @@ export const en = {
     'help.option.group.sync.exactOnly': 'Exact match only',
     'help.option.group.sync.allowStale': 'Skip stale index warnings',
     'help.option.group.sync.verbose': 'Show each cross-link detail',
+    'help.option.status.json': 'Emit machine-readable index and analyzer provenance',
     'help.option.json': 'JSON output',
     'help.option.group.impact.target': 'Symbol or file name to analyze',
     'help.option.group.impact.repo': 'Member path from group.yaml (e.g. app/backend), not the indexed repo name',
@@ -243,5 +253,6 @@ export const en = {
     'help.option.group.contracts.type': 'Filter by contract type',
     'help.option.group.contracts.repo': 'Filter by repo',
     'help.option.group.contracts.unmatched': 'Show only unmatched contracts',
-    'help.analyze.environment': '\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS=N  Max wait at pool shutdown for a retired worker still inside native code (terminated at its next safe point instead of aborting the process). Default 30000.\n  GITNEXUS_CPP_CAPTURE_BUDGET_MS=N  Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning. Default 20000.\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).',
+    'help.identityCache.environment': '\nAnalyzer identity cache:\n  GITNEXUS_ANALYZER_IDENTITY_CACHE_DIR=/absolute/protected/dir\n    Operator-trusted persistent cache for warm cross-process status. The directory must pre-exist, be outside the GitNexus package/build roots, and contain no symlink or junction components. Defaults remain fail-closed on platforms without POSIX ownership APIs.',
+    'help.analyze.environment': '\nEnvironment variables:\n  GITNEXUS_NO_GITIGNORE=1   Skip .gitignore parsing (still reads .gitnexusignore)\n  GITNEXUS_MAX_FILE_SIZE=N  Override large-file skip threshold (KB). Default 512, max 32768.\n  GITNEXUS_ANALYZER_IDENTITY_CACHE_DIR=/absolute/protected/dir  Operator-trusted persistent analyzer identity cache; must pre-exist, be outside package/build roots, and contain no symlink/junction components.\n  GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=N  Worker idle timeout in milliseconds. Default 30000.\n  GITNEXUS_WAL_CHECKPOINT_THRESHOLD=N  LadybugDB WAL auto-checkpoint threshold in bytes (default 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).\n  GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES=N  Worker job byte budget. Default 8388608.\n  GITNEXUS_WORKER_POOL_SIZE=N  Parse worker count override. Default cores-1 capped at 16.\n  GITNEXUS_PARSE_CHUNK_CONCURRENCY=N  Concurrent in-flight parse chunks. Default 2.\n  GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT=N  Max replacement spawns per slot before drop. Default 3.\n  GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS=N  Total retry wall-time per job. Default 5x sub-batch timeout.\n  GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD=N  Per-slot deaths to trip circuit breaker. Default max(3, poolSize).\n  GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS=N  Max wait at pool shutdown for a retired worker still inside native code (terminated at its next safe point instead of aborting the process). Default 30000.\n  GITNEXUS_CPP_CAPTURE_BUDGET_MS=N  Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning. Default 20000.\n  GITNEXUS_EMBEDDING_THREADS=N  Limit local ONNX CPU threads for --embeddings.\n  GITNEXUS_SEMANTIC_EXACT_SCAN_LIMIT=N  Max embedding chunks for exact-scan fallback. Default 10000.\n  GITNEXUS_VECTOR_MAX_DISTANCE=N  Max accepted semantic/vector cosine distance (0 < N <= 2; higher values clamp to 2). Default 0.6 for MCP, 0.5 elsewhere.\n\nFlags override the corresponding env vars when both are provided.\n\nTip: `.gitnexusignore` supports `.gitignore`-style negation. Add e.g.\n     `!__tests__/` to index a directory that is auto-filtered by default (#771).',
 };