gitnexus 1.6.4 → 1.6.5-rc.10

package/README.md

@@ -33,7 +33,7 @@ To configure MCP for your editor, run `npx gitnexus setup` once — or set it up
 | Editor | MCP | Skills | Hooks (auto-augment) | Support |
 |--------|-----|--------|---------------------|---------|
 | **Claude Code** | Yes | Yes | Yes (PreToolUse) | **Full** |
-| **Cursor** | Yes | Yes | — | MCP + Skills |
+| **Cursor** | Yes | Yes | Yes (postToolUse, [manual install](../gitnexus-cursor-integration/README.md#hook-install)) | **Full** |
 | **Codex** | Yes | Yes | — | MCP + Skills |
 | **Windsurf** | Yes | — | — | MCP |
 | **OpenCode** | Yes | Yes | — | MCP + Skills |

package/dist/cli/ai-context.d.ts

@@ -17,6 +17,7 @@ interface RepoStats {
 export interface AIContextOptions {
     skipAgentsMd?: boolean;
     noStats?: boolean;
+    skipSkills?: boolean;
 }
 /**
  * Generate AI context files after indexing

package/dist/cli/ai-context.js

@@ -68,20 +68,31 @@ async function findGroupsContainingRegistryName(registryName) {
     }
     return hits;
 }
-function generateGitNexusContent(projectName, stats, generatedSkills, groupNames, noStats) {
+function generateGitNexusContent(projectName, stats, generatedSkills, groupNames, noStats, skipSkills) {
     const generatedRows = generatedSkills && generatedSkills.length > 0
         ? generatedSkills
             .map((s) => `| Work in the ${s.label} area (${s.symbolCount} symbols) | \`.claude/skills/generated/${s.name}/SKILL.md\` |`)
             .join('\n')
         : '';
-    const skillsTable = `| Task | Read this skill file |
-|------|---------------------|
-| Understand architecture / "How does X work?" | \`.claude/skills/gitnexus/gitnexus-exploring/SKILL.md\` |
+    // Standard skill rows reference files installed by installSkills(). When
+    // --skip-skills suppresses that install, these rows must be omitted — else
+    // AGENTS.md/CLAUDE.md would direct agents to read files that don't exist.
+    // Community skills (generatedRows) live in .claude/skills/generated/ and
+    // are independent of --skip-skills, so they remain when present.
+    const standardSkillsRows = skipSkills
+        ? ''
+        : `| Understand architecture / "How does X work?" | \`.claude/skills/gitnexus/gitnexus-exploring/SKILL.md\` |
 | Blast radius / "What breaks if I change X?" | \`.claude/skills/gitnexus/gitnexus-impact-analysis/SKILL.md\` |
 | Trace bugs / "Why is X failing?" | \`.claude/skills/gitnexus/gitnexus-debugging/SKILL.md\` |
 | Rename / extract / split / refactor | \`.claude/skills/gitnexus/gitnexus-refactoring/SKILL.md\` |
 | Tools, resources, schema reference | \`.claude/skills/gitnexus/gitnexus-guide/SKILL.md\` |
-| Index, status, clean, wiki CLI commands | \`.claude/skills/gitnexus/gitnexus-cli/SKILL.md\` |${generatedRows ? '\n' + generatedRows : ''}`;
+| Index, status, clean, wiki CLI commands | \`.claude/skills/gitnexus/gitnexus-cli/SKILL.md\` |`;
+    const tableBody = [standardSkillsRows, generatedRows].filter(Boolean).join('\n');
+    const skillsTable = tableBody
+        ? `| Task | Read this skill file |
+|------|---------------------|
+${tableBody}`
+        : '';
     return `${GITNEXUS_START_MARKER}
 # GitNexus — Code Intelligence
 
@@ -119,11 +130,13 @@ ${groupNames && groupNames.length > 0
 This repository is listed under GitNexus **group(s): ${groupNames.join(', ')}** (see \`~/.gitnexus/groups/\`). For cross-repo analysis, use MCP tools \`impact\`, \`query\`, and \`context\` with \`repo\` set to \`@<groupName>\` or \`@<groupName>/<memberPath>\` (paths match keys in that group’s \`group.yaml\`). Use \`group_list\` / \`group_sync\` for membership and sync. From the terminal: \`npx gitnexus group list\`, \`npx gitnexus group sync <name>\`, \`npx gitnexus group impact <name> --target <symbol> --repo <group-path>\`.
 
 `
-        : ''}## CLI
+        : ''}${skillsTable
+        ? `## CLI
 
 ${skillsTable}
 
-${GITNEXUS_END_MARKER}`;
+`
+        : ''}${GITNEXUS_END_MARKER}`;
 }
 /**
  * Check if a file exists
@@ -246,7 +259,7 @@ Use GitNexus tools to accomplish this task.
  */
 export async function generateAIContextFiles(repoPath, _storagePath, projectName, stats, generatedSkills, options) {
     const groupNames = await findGroupsContainingRegistryName(projectName);
-    const content = generateGitNexusContent(projectName, stats, generatedSkills, groupNames, options?.noStats);
+    const content = generateGitNexusContent(projectName, stats, generatedSkills, groupNames, options?.noStats, options?.skipSkills);
     const createdFiles = [];
     if (!options?.skipAgentsMd) {
         // Create AGENTS.md (standard for Cursor, Windsurf, OpenCode, Cline, etc.)
@@ -262,10 +275,15 @@ export async function generateAIContextFiles(repoPath, _storagePath, projectName
         createdFiles.push('AGENTS.md (skipped via --skip-agents-md)');
         createdFiles.push('CLAUDE.md (skipped via --skip-agents-md)');
     }
-    // Install skills to .claude/skills/gitnexus/
-    const installedSkills = await installSkills(repoPath);
-    if (installedSkills.length > 0) {
-        createdFiles.push(`.claude/skills/gitnexus/ (${installedSkills.length} skills)`);
+    // Install skills to .claude/skills/gitnexus/ (unless --skip-skills)
+    if (!options?.skipSkills) {
+        const installedSkills = await installSkills(repoPath);
+        if (installedSkills.length > 0) {
+            createdFiles.push(`.claude/skills/gitnexus/ (${installedSkills.length} skills)`);
+        }
+    }
+    else {
+        createdFiles.push('.claude/skills/gitnexus/ (skipped via --skip-skills)');
     }
     return { files: createdFiles };
 }

package/dist/cli/analyze.d.ts

@@ -29,6 +29,10 @@ export interface AnalyzeOptions {
     skipAgentsMd?: boolean;
     /** Omit volatile symbol/relationship counts from AGENTS.md and CLAUDE.md. */
     noStats?: boolean;
+    /** Skip installing standard GitNexus skill files to .claude/skills/gitnexus/. */
+    skipSkills?: boolean;
+    /** Pure index mode: skip all file injection (AGENTS.md, CLAUDE.md, skills). */
+    indexOnly?: boolean;
     /** Index the folder even when no .git directory is present. */
     skipGit?: boolean;
     /**
@@ -59,4 +63,18 @@ export interface AnalyzeOptions {
     embeddingSubBatchSize?: string;
     embeddingDevice?: string;
 }
+/**
+ * Whether the post-index skill step should run.
+ *
+ * The gated block does two things in sequence: (1) generates the community
+ * skill files from `--skills`, and (2) re-runs `generateAIContextFiles` so
+ * AGENTS.md/CLAUDE.md can reference the freshly written skills. Both are
+ * suppressed together — `--index-only` drops the entire step, not just the
+ * community-skill write. Name retained for the test contract; see call site
+ * in `analyzeCommand` for the AGENTS.md/CLAUDE.md re-generation it also gates.
+ *
+ * Kept as a pure helper so the `--index-only --skills` contract is unit-tested
+ * without booting the full analyze pipeline (#742 review).
+ */
+export declare const shouldGenerateCommunitySkillFiles: (options: Pick<AnalyzeOptions, "skills" | "indexOnly"> | undefined, pipelineResult: unknown) => boolean;
 export declare const analyzeCommand: (inputPath?: string, options?: AnalyzeOptions) => Promise<void>;

package/dist/cli/analyze.js

@@ -86,6 +86,20 @@ function ensureHeap() {
     }
     return true;
 }
+/**
+ * Whether the post-index skill step should run.
+ *
+ * The gated block does two things in sequence: (1) generates the community
+ * skill files from `--skills`, and (2) re-runs `generateAIContextFiles` so
+ * AGENTS.md/CLAUDE.md can reference the freshly written skills. Both are
+ * suppressed together — `--index-only` drops the entire step, not just the
+ * community-skill write. Name retained for the test contract; see call site
+ * in `analyzeCommand` for the AGENTS.md/CLAUDE.md re-generation it also gates.
+ *
+ * Kept as a pure helper so the `--index-only --skills` contract is unit-tested
+ * without booting the full analyze pipeline (#742 review).
+ */
+export const shouldGenerateCommunitySkillFiles = (options, pipelineResult) => Boolean(options?.skills && pipelineResult && !options?.indexOnly);
 export const analyzeCommand = async (inputPath, options) => {
     if (ensureHeap())
         return;
@@ -151,6 +165,15 @@ export const analyzeCommand = async (inputPath, options) => {
         process.env.GITNEXUS_EMBEDDING_DEVICE = options.embeddingDevice;
     }
     console.log('\n  GitNexus Analyzer\n');
+    // `--index-only` is the stronger contract — it suppresses every form of file
+    // injection, including community skill writes that `--skills` would normally
+    // produce. Surface the override explicitly so users don't wonder why a
+    // pipeline re-index ran but no skill files appeared. The pipeline still
+    // re-runs (see `force: options?.force || options?.skills` below); the warning
+    // is purely about the dropped post-index write step.
+    if (options?.indexOnly && options?.skills) {
+        console.log('  Note: --index-only overrides --skills; community skill files will not be written.\n');
+    }
     let repoPath;
     if (inputPath) {
         repoPath = path.resolve(inputPath);
@@ -285,6 +308,9 @@ export const analyzeCommand = async (inputPath, options) => {
     const t0 = Date.now();
     // ── Run shared analysis orchestrator ───────────────────────────────
     try {
+        const skipAll = options?.indexOnly;
+        const skipAgentsMd = skipAll || options?.skipAgentsMd;
+        const skipSkills = skipAll || options?.skipSkills;
         const result = await runFullAnalysis(repoPath, {
             // Pipeline re-index — OR'd with --skills because skill generation
             // needs a fresh pipelineResult. Has no bearing on the registry
@@ -294,7 +320,8 @@ export const analyzeCommand = async (inputPath, options) => {
             embeddingsNodeLimit,
             dropEmbeddings: options?.dropEmbeddings,
             skipGit: options?.skipGit,
-            skipAgentsMd: options?.skipAgentsMd,
+            skipAgentsMd,
+            skipSkills,
             noStats: options?.noStats,
             registryName: options?.name,
             // Registry-collision bypass — its own CLI flag, intentionally NOT
@@ -335,8 +362,10 @@ export const analyzeCommand = async (inputPath, options) => {
         // exit code and an actionable error instead of being mistaken for
         // a healthy index.
         await assertAnalysisFinalized(repoPath);
-        // Skill generation (CLI-only, uses pipeline result from analysis)
-        if (options?.skills && result.pipelineResult) {
+        // Skill generation (CLI-only, uses pipeline result from analysis).
+        // Gated so `--index-only --skills` skips community skill writes too
+        // (`shouldGenerateCommunitySkillFiles` — see unit test).
+        if (shouldGenerateCommunitySkillFiles(options, result.pipelineResult)) {
             updateBar(99, 'Generating skill files...');
             try {
                 const { generateSkillFiles } = await import('./skill-gen.js');
@@ -364,7 +393,7 @@ export const analyzeCommand = async (inputPath, options) => {
                         communities: s.communities,
                         clusters: aggregatedClusterCount,
                         processes: s.processes,
-                    }, skillResult.skills, { skipAgentsMd: options?.skipAgentsMd, noStats: options?.noStats });
+                    }, skillResult.skills, { skipAgentsMd, skipSkills, noStats: options?.noStats });
                 }
             }
             catch {

package/dist/cli/augment.d.ts

@@ -2,7 +2,7 @@
  * Augment CLI Command
  *
  * Fast-path command for platform hooks.
- * Shells out from Claude Code PreToolUse / Cursor beforeShellExecution hooks.
+ * Shells out from Claude Code PreToolUse / Cursor postToolUse hooks.
  *
  * Usage: gitnexus augment <pattern>
  * Returns enriched text to stdout.

package/dist/cli/augment.js

@@ -2,7 +2,7 @@
  * Augment CLI Command
  *
  * Fast-path command for platform hooks.
- * Shells out from Claude Code PreToolUse / Cursor beforeShellExecution hooks.
+ * Shells out from Claude Code PreToolUse / Cursor postToolUse hooks.
  *
  * Usage: gitnexus augment <pattern>
  * Returns enriched text to stdout.

package/dist/cli/index.js

@@ -21,9 +21,14 @@ program
     'Optional [limit] overrides the 50,000-node safety cap; pass 0 to disable the cap entirely.')
     .option('--drop-embeddings', 'Drop existing embeddings on rebuild. By default, an `analyze` without `--embeddings` ' +
     'preserves any embeddings already present in the index.')
-    .option('--skills', 'Generate repo-specific skill files from detected communities')
+    .option('--skills', 'Generate repo-specific skill files from detected communities ' +
+    '(no-op when --index-only is also set).')
     .option('--skip-agents-md', 'Skip updating the gitnexus section in AGENTS.md and CLAUDE.md')
     .option('--no-stats', 'Omit volatile file/symbol counts from AGENTS.md and CLAUDE.md')
+    .option('--skip-skills', 'Skip installing standard GitNexus skill files under .claude/skills/gitnexus/. ' +
+    'Does not suppress community skills from --skills (those use .claude/skills/generated/). ' +
+    'Use --index-only to skip all AI-context file injection.')
+    .option('--index-only', 'Pure index mode: skip all file injection (AGENTS.md, CLAUDE.md, skills)')
     .option('--skip-git', 'Treat the provided path/cwd as the index root and skip parent git-root discovery')
     .option('--name <alias>', 'Register this repo under a custom name in ~/.gitnexus/registry.json ' +
     '(disambiguates repos whose paths share a basename, e.g. two different .../app folders)')

package/dist/core/augmentation/engine.d.ts

@@ -2,8 +2,8 @@
  * Augmentation Engine
  *
  * Lightweight, fast-path enrichment of search patterns with knowledge graph context.
- * Designed to be called from platform hooks (Claude Code PreToolUse, Cursor beforeShellExecution)
- * when an agent runs grep/glob/search.
+ * Designed to be called from platform hooks (Claude Code PreToolUse, Cursor postToolUse)
+ * when an agent runs grep/glob/read/search.
  *
  * Performance target: <500ms cold start, <200ms warm.
  *

package/dist/core/augmentation/engine.js

@@ -2,8 +2,8 @@
  * Augmentation Engine
  *
  * Lightweight, fast-path enrichment of search patterns with knowledge graph context.
- * Designed to be called from platform hooks (Claude Code PreToolUse, Cursor beforeShellExecution)
- * when an agent runs grep/glob/search.
+ * Designed to be called from platform hooks (Claude Code PreToolUse, Cursor postToolUse)
+ * when an agent runs grep/glob/read/search.
  *
  * Performance target: <500ms cold start, <200ms warm.
  *

package/dist/core/embeddings/ast-utils.js

@@ -5,6 +5,7 @@
  */
 import { getLanguageFromFilename } from '../../_shared/index.js';
 import { createParserForLanguage, isLanguageAvailable, resolveLanguageKey, } from '../tree-sitter/parser-loader.js';
+import { parseSourceSafe } from '../tree-sitter/safe-parse.js';
 const parserCache = new Map();
 /**
  * Ensure parser is initialized and language is loaded, then parse content.
@@ -22,7 +23,7 @@ export const ensureAndParse = async (content, filePath) => {
         parserInstance = await createParserForLanguage(language, filePath);
         parserCache.set(parserKey, parserInstance);
     }
-    return parserInstance.parse(content);
+    return parseSourceSafe(parserInstance, content);
 };
 const FUNCTION_LIKE_TYPES = new Set([
     'function_declaration',

package/dist/core/embeddings/http-client.js

@@ -30,8 +30,11 @@ const readConfig = () => {
     const rawDims = process.env.GITNEXUS_EMBEDDING_DIMS;
     let dimensions;
     if (rawDims !== undefined) {
+        if (!/^\d+$/.test(rawDims)) {
+            throw new Error(`GITNEXUS_EMBEDDING_DIMS must be a positive integer, got "${rawDims}"`);
+        }
         const parsed = parseInt(rawDims, 10);
-        if (Number.isNaN(parsed) || parsed <= 0) {
+        if (parsed <= 0) {
             throw new Error(`GITNEXUS_EMBEDDING_DIMS must be a positive integer, got "${rawDims}"`);
         }
         dimensions = parsed;
@@ -73,9 +76,22 @@ const safeUrl = (url) => {
  * @param model - Model name for the request body
  * @param apiKey - Bearer token (only used in Authorization header)
  * @param batchIndex - Logical batch number (for error context)
- * @param attempt - Current retry attempt (internal)
+ * @param dimensions - Optional output-vector size. When provided, sent as
+ *   the `dimensions` field in the request body. Endpoints that implement
+ *   Matryoshka truncation (OpenAI text-embedding-3-*, Cohere embed-v3,
+ *   Voyage) return a truncated vector at that size; endpoints that do not
+ *   recognise the field may ignore it or return 400. Leave
+ *   `GITNEXUS_EMBEDDING_DIMS` unset for strict backends that reject
+ *   unknown fields.
  */
-const httpEmbedBatch = async (url, batch, model, apiKey, batchIndex = 0) => {
+const httpEmbedBatch = async (url, batch, model, apiKey, batchIndex = 0, dimensions) => {
+    const requestBody = {
+        input: batch,
+        model,
+    };
+    if (dimensions !== undefined) {
+        requestBody.dimensions = dimensions;
+    }
     let resp;
     try {
         resp = await resilientFetch(url, {
@@ -85,7 +101,7 @@ const httpEmbedBatch = async (url, batch, model, apiKey, batchIndex = 0) => {
                 'Content-Type': 'application/json',
                 Authorization: `Bearer ${apiKey}`,
             },
-            body: JSON.stringify({ input: batch, model }),
+            body: JSON.stringify(requestBody),
         }, {
             breakerKey: HTTP_BREAKER_KEY,
             retry: { maxAttempts: HTTP_MAX_RETRIES + 1, baseDelayMs: HTTP_RETRY_BACKOFF_MS },
@@ -130,7 +146,7 @@ export const httpEmbed = async (texts) => {
     for (let i = 0; i < texts.length; i += HTTP_BATCH_SIZE) {
         const batch = texts.slice(i, i + HTTP_BATCH_SIZE);
         const batchIndex = Math.floor(i / HTTP_BATCH_SIZE);
-        const items = await httpEmbedBatch(url, batch, config.model, config.apiKey, batchIndex);
+        const items = await httpEmbedBatch(url, batch, config.model, config.apiKey, batchIndex, config.dimensions);
         if (items.length !== batch.length) {
             throw new Error(`Embedding endpoint returned ${items.length} vectors for ${batch.length} texts ` +
                 `(${safeUrl(url)}, batch ${batchIndex})`);
@@ -164,7 +180,7 @@ export const httpEmbedQuery = async (text) => {
     if (!config)
         throw new Error('HTTP embedding not configured');
     const url = `${config.baseUrl}/embeddings`;
-    const items = await httpEmbedBatch(url, [text], config.model, config.apiKey);
+    const items = await httpEmbedBatch(url, [text], config.model, config.apiKey, 0, config.dimensions);
     if (!items.length) {
         throw new Error(`Embedding endpoint returned empty response (${safeUrl(url)})`);
     }

package/dist/core/group/extractors/grpc-extractor.js

@@ -3,6 +3,7 @@ import { glob } from 'glob';
 import Parser from 'tree-sitter';
 import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import { readSafe } from './fs-utils.js';
+import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 import { logger } from '../../logger.js';
 import { GRPC_SCAN_GLOB, getPluginForFile, hasProtoPlugin, } from './grpc-patterns/index.js';
 /**
@@ -352,7 +353,7 @@ export class GrpcExtractor {
             let detections = [];
             try {
                 parser.setLanguage(plugin.language);
-                const tree = parser.parse(content);
+                const tree = parseSourceSafe(parser, content);
                 detections = plugin.scan(tree);
             }
             catch {

package/dist/core/group/extractors/http-patterns/python.js

@@ -5,6 +5,7 @@ import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-s
  *   - FastAPI `@app.get("/path")` provider decorators
  *   - `requests.get/post/...("url")` consumer calls
  *   - Generic `requests.request("METHOD", "url")` consumer calls
+ *   - `httpx.AsyncClient` instances calling `.get/.post/...("url")`
  */
 const FASTAPI_VERBS = {
     get: 'GET',
@@ -65,11 +66,142 @@ const REQUESTS_GENERIC_PATTERNS = compilePatterns({
         },
     ],
 });
+// ─── Consumer: httpx.AsyncClient assignments ────────────────────────
+// NOTE: This targeted detector only tracks explicit `httpx.AsyncClient(...)`
+// construction. Direct imports (`from httpx import AsyncClient`) and module
+// aliases (`import httpx as hx`) and annotated assignments (`client: httpx.AsyncClient = ...`)
+// are intentionally left for a follow-up. Module-scope clients are only matched
+// at module scope; calls inside functions require a function/class-local tracked
+// client to avoid false positives from same-name local variables.
+const HTTPX_ASYNC_CLIENT_ASSIGN_PATTERNS = compilePatterns({
+    name: 'python-httpx-async-client-assign',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (assignment
+          left: (_) @client
+          right: (call
+            function: (attribute
+              object: (identifier) @module (#eq? @module "httpx")
+              attribute: (identifier) @client_class (#eq? @client_class "AsyncClient"))))
+      `,
+        },
+    ],
+});
+// ─── Consumer: async with httpx.AsyncClient() as client ──────────────
+const HTTPX_ASYNC_CLIENT_WITH_ALIAS_PATTERNS = compilePatterns({
+    name: 'python-httpx-async-client-with-alias',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (as_pattern
+          (call
+            function: (attribute
+              object: (identifier) @module (#eq? @module "httpx")
+              attribute: (identifier) @client_class (#eq? @client_class "AsyncClient")))
+          (as_pattern_target (identifier) @client))
+      `,
+        },
+    ],
+});
+function getScopeKey(node, preferClass = false) {
+    if (preferClass) {
+        let current = node;
+        while (current) {
+            if (current.type === 'class_definition') {
+                return `class:${current.startIndex}:${current.endIndex}`;
+            }
+            current = current.parent;
+        }
+    }
+    let current = node;
+    while (current) {
+        if (current.type === 'function_definition') {
+            return `function:${current.startIndex}:${current.endIndex}`;
+        }
+        current = current.parent;
+    }
+    return 'module';
+}
+function trackedClientScopeKey(clientNode) {
+    return getScopeKey(clientNode.parent, clientNode.text.includes('.'));
+}
+function callScopeKeys(clientNode) {
+    const keys = new Set();
+    const preferClass = clientNode.text.includes('.');
+    const nearestScope = getScopeKey(clientNode.parent, preferClass);
+    keys.add(nearestScope);
+    return [...keys];
+}
+function collectHttpxAsyncClients(tree) {
+    const clients = new Map();
+    const addClient = (clientNode) => {
+        if (!clientNode)
+            return;
+        const scopeKey = trackedClientScopeKey(clientNode);
+        const clientText = clientNode.text;
+        const scopes = clients.get(clientText) ?? new Set();
+        scopes.add(scopeKey);
+        clients.set(clientText, scopes);
+    };
+    for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_ASSIGN_PATTERNS, tree)) {
+        addClient(match.captures.client);
+    }
+    for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_WITH_ALIAS_PATTERNS, tree)) {
+        addClient(match.captures.client);
+    }
+    return clients;
+}
+function hasTrackedHttpxAsyncClient(clients, clientNode) {
+    const scopes = clients.get(clientNode.text);
+    if (!scopes)
+        return false;
+    return callScopeKeys(clientNode).some((scopeKey) => scopes.has(scopeKey));
+}
+// ─── Consumer: httpx AsyncClient .get/.post/...("url") ──────────────
+const HTTPX_ASYNC_CLIENT_VERB_PATTERNS = compilePatterns({
+    name: 'python-httpx-async-client-verb',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (call
+          function: (attribute
+            object: (_) @client
+            attribute: (identifier) @method (#match? @method "^(get|post|put|delete|patch)$"))
+          arguments: (argument_list . (string) @path))
+      `,
+        },
+    ],
+});
+// ─── Consumer: httpx AsyncClient .request("METHOD", "url") ─────────
+const HTTPX_ASYNC_CLIENT_GENERIC_PATTERNS = compilePatterns({
+    name: 'python-httpx-async-client-generic',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (call
+          function: (attribute
+            object: (_) @client
+            attribute: (identifier) @method (#eq? @method "request"))
+          arguments: (argument_list . (string) @http_method (string) @path))
+      `,
+        },
+    ],
+});
 export const PYTHON_HTTP_PLUGIN = {
     name: 'python-http',
     language: Python,
     scan(tree) {
         const out = [];
+        const httpxAsyncClients = collectHttpxAsyncClients(tree);
         // Providers: FastAPI
         for (const match of runCompiledPatterns(FASTAPI_PATTERNS, tree)) {
             const methodNode = match.captures.method;
@@ -128,6 +260,49 @@ export const PYTHON_HTTP_PLUGIN = {
                 confidence: 0.7,
             });
         }
+        // Consumers: httpx.AsyncClient.<verb>("url")
+        for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_VERB_PATTERNS, tree)) {
+            const clientNode = match.captures.client;
+            const methodNode = match.captures.method;
+            const pathNode = match.captures.path;
+            if (!clientNode || !methodNode || !pathNode)
+                continue;
+            if (!hasTrackedHttpxAsyncClient(httpxAsyncClients, clientNode))
+                continue;
+            const path = unquoteLiteral(pathNode.text);
+            if (path === null)
+                continue;
+            out.push({
+                role: 'consumer',
+                framework: 'python-httpx',
+                method: methodNode.text.toUpperCase(),
+                path,
+                name: null,
+                confidence: 0.7,
+            });
+        }
+        // Consumers: httpx.AsyncClient.request("METHOD", "url")
+        for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_GENERIC_PATTERNS, tree)) {
+            const clientNode = match.captures.client;
+            const methodNode = match.captures.http_method;
+            const pathNode = match.captures.path;
+            if (!clientNode || !methodNode || !pathNode)
+                continue;
+            if (!hasTrackedHttpxAsyncClient(httpxAsyncClients, clientNode))
+                continue;
+            const methodRaw = unquoteLiteral(methodNode.text);
+            const path = unquoteLiteral(pathNode.text);
+            if (methodRaw === null || path === null)
+                continue;
+            out.push({
+                role: 'consumer',
+                framework: 'python-httpx',
+                method: methodRaw.toUpperCase(),
+                path,
+                name: null,
+                confidence: 0.7,
+            });
+        }
         return out;
     },
 };

package/dist/core/group/extractors/http-route-extractor.js

@@ -3,6 +3,7 @@ import { glob } from 'glob';
 import Parser from 'tree-sitter';
 import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import { readSafe } from './fs-utils.js';
+import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 import { getPluginForFile, HTTP_SCAN_GLOB } from './http-patterns/index.js';
 /**
  * Language-agnostic orchestrator for HTTP route (provider + consumer)
@@ -154,7 +155,7 @@ export class HttpRouteExtractor {
             }
             try {
                 parser.setLanguage(plugin.language);
-                const tree = parser.parse(content);
+                const tree = parseSourceSafe(parser, content);
                 const detections = plugin.scan(tree);
                 cachedDetections.set(rel, detections);
                 return detections;

package/dist/core/group/extractors/include-extractor.js

@@ -8,6 +8,7 @@ import { readSafe } from './fs-utils.js';
 import { buildSuffixIndex } from '../../ingestion/import-resolvers/utils.js';
 import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import { getMaxFileSizeBytes } from '../../ingestion/utils/max-file-size.js';
+import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 import { logger } from '../../logger.js';
 /**
  * Cross-repo C/C++ `#include` dependency extractor.
@@ -457,7 +458,7 @@ export class IncludeExtractor {
             let extractionSource;
             try {
                 parser.setLanguage(lang);
-                const tree = parser.parse(content);
+                const tree = parseSourceSafe(parser, content);
                 let matches;
                 try {
                     matches = query.matches(tree.rootNode);

package/dist/core/group/extractors/thrift-extractor.js

@@ -1,6 +1,7 @@
 import { glob } from 'glob';
 import Parser from 'tree-sitter';
 import { readSafe } from './fs-utils.js';
+import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 import { getPluginForFile, THRIFT_SCAN_GLOB, } from './thrift-patterns/index.js';
 function normalizeThriftPath(rel) {
     return rel.replace(/\\/g, '/');
@@ -228,7 +229,7 @@ export class ThriftExtractor {
             let detections = [];
             try {
                 parser.setLanguage(plugin.language);
-                const tree = parser.parse(content);
+                const tree = parseSourceSafe(parser, content);
                 detections = plugin.scan(tree);
             }
             catch {

package/dist/core/group/extractors/tree-sitter-scanner.js

@@ -1,4 +1,5 @@
 import Parser from 'tree-sitter';
+import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 /**
  * Compile a LanguagePatterns bundle. Call this once per plugin, at
  * module load time, and export the result. Throws if any pattern
@@ -60,7 +61,7 @@ export function scanFile(parser, plugin, content) {
     let tree;
     try {
         parser.setLanguage(plugin.language);
-        tree = parser.parse(content);
+        tree = parseSourceSafe(parser, content);
     }
     catch {
         return [];