gitnexus 1.6.7-rc.1 → 1.6.7-rc.3

package/dist/core/ingestion/scope-resolution/pipeline/phase.js

@@ -27,6 +27,7 @@ import { getPhaseOutput } from '../../pipeline-phases/types.js';
 import { getLanguageFromFilename } from '../../../../_shared/index.js';
 import { readFileContents } from '../../filesystem-walker.js';
 import { runScopeResolution } from './run.js';
+import { isLanguageAvailable } from '../../../tree-sitter/parser-loader.js';
 import { buildGraphNodeLookup } from '../graph-bridge/node-lookup.js';
 import { SCOPE_RESOLVERS } from './registry.js';
 import { isDev, isSemanticModelValidatorEnabled } from '../../utils/env.js';
@@ -120,6 +121,16 @@ export const scopeResolutionPhase = {
             const fileLang = getLanguageFromFilename(f.path);
             if (fileLang === null)
                 continue;
+            // Skip files whose grammar isn't available (optional grammars like
+            // swift/dart/kotlin on an install where the binding is absent or the
+            // user set GITNEXUS_SKIP_OPTIONAL_GRAMMARS). The parse phase already
+            // excluded and warned about these (parse-impl.ts); without this guard the
+            // file would fall through to the main-thread re-extract in run.ts and
+            // throw "Unsupported language" (caught, but noisy, and it needlessly
+            // loads the grammar on the main thread). `isLanguageAvailable` is
+            // memoized, so this stays O(1) per language. (#2091, #2093)
+            if (!isLanguageAvailable(fileLang))
+                continue;
             let bucket = filesByLang.get(fileLang);
             if (bucket === undefined) {
                 bucket = [];

package/dist/core/ingestion/taint/source-sink-config.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Source/sink/sanitizer config model (issue #2080, taint/PDG substrate M0).
+ *
+ * The per-language taint configuration *shape*. M0 ships only the type and an
+ * (empty) registry seam — no analysis consumes it yet. M3 (#2083, intra-proc
+ * taint) populates per-language specs and reads them when emitting TAINTED /
+ * SANITIZES edges.
+ *
+ * Kept deliberately minimal: enough for M3 to express "callable X is a
+ * source / sink / sanitizer, optionally for argument position N" without M0
+ * committing to matcher semantics it cannot yet validate. The shape is
+ * expected to grow (e.g. sanitizer escape conditions, return-position taint)
+ * when M3 makes contact with real flows; that is a forward-declared-interface
+ * design choice, not a finished contract.
+ */
+/**
+ * Identifies a callable that participates in taint flow. `name` is matched
+ * against a resolved callable (simple or qualified name — exact matching
+ * semantics are M3's call). `args` optionally narrows to specific 0-based
+ * argument positions that carry taint (for a source/sink) or clear it (for a
+ * sanitizer); omit to mean "unspecified / all".
+ */
+export interface TaintCallableMatcher {
+    readonly name: string;
+    readonly args?: readonly number[];
+}
+/**
+ * The taint configuration for a single language: which callables introduce
+ * taint (sources), which are dangerous to reach with tainted input (sinks),
+ * and which clear taint (sanitizers).
+ */
+export interface SourceSinkSanitizerSpec {
+    readonly sources: readonly TaintCallableMatcher[];
+    readonly sinks: readonly TaintCallableMatcher[];
+    readonly sanitizers: readonly TaintCallableMatcher[];
+}

package/dist/core/ingestion/taint/source-sink-config.js

@@ -0,0 +1,16 @@
+/**
+ * Source/sink/sanitizer config model (issue #2080, taint/PDG substrate M0).
+ *
+ * The per-language taint configuration *shape*. M0 ships only the type and an
+ * (empty) registry seam — no analysis consumes it yet. M3 (#2083, intra-proc
+ * taint) populates per-language specs and reads them when emitting TAINTED /
+ * SANITIZES edges.
+ *
+ * Kept deliberately minimal: enough for M3 to express "callable X is a
+ * source / sink / sanitizer, optionally for argument position N" without M0
+ * committing to matcher semantics it cannot yet validate. The shape is
+ * expected to grow (e.g. sanitizer escape conditions, return-position taint)
+ * when M3 makes contact with real flows; that is a forward-declared-interface
+ * design choice, not a finished contract.
+ */
+export {};

package/dist/core/ingestion/taint/source-sink-registry.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Per-language source/sink/sanitizer registry seam (issue #2080).
+ *
+ * A keyed registry of {@link SourceSinkSanitizerSpec} by language id. M0 stands
+ * up the empty seam — no language is registered and nothing in the pipeline
+ * reads it. M3 (#2083) registers per-language specs and queries this registry
+ * when emitting taint edges.
+ *
+ * The store is module-level (matching the codebase's other per-language
+ * registries). {@link clearSourceSinkRegistry} resets it for test isolation.
+ */
+import type { SourceSinkSanitizerSpec } from './source-sink-config.js';
+/**
+ * Register the taint config for a language. Last-write-wins: re-registering
+ * the same `languageId` overwrites the previous spec (so M3 can override a
+ * built-in default). Returns nothing.
+ */
+export declare function registerSourceSinkConfig(languageId: string, spec: SourceSinkSanitizerSpec): void;
+/**
+ * Look up the taint config for a language. Returns `undefined` when no spec is
+ * registered (the M0 default for every language) — never throws.
+ */
+export declare function getSourceSinkConfig(languageId: string): SourceSinkSanitizerSpec | undefined;
+/** Language ids that currently have a registered spec. Empty in M0. */
+export declare function registeredTaintLanguages(): string[];
+/** Reset the registry. Primarily for test isolation. */
+export declare function clearSourceSinkRegistry(): void;

package/dist/core/ingestion/taint/source-sink-registry.js

@@ -0,0 +1,35 @@
+/**
+ * Per-language source/sink/sanitizer registry seam (issue #2080).
+ *
+ * A keyed registry of {@link SourceSinkSanitizerSpec} by language id. M0 stands
+ * up the empty seam — no language is registered and nothing in the pipeline
+ * reads it. M3 (#2083) registers per-language specs and queries this registry
+ * when emitting taint edges.
+ *
+ * The store is module-level (matching the codebase's other per-language
+ * registries). {@link clearSourceSinkRegistry} resets it for test isolation.
+ */
+const registry = new Map();
+/**
+ * Register the taint config for a language. Last-write-wins: re-registering
+ * the same `languageId` overwrites the previous spec (so M3 can override a
+ * built-in default). Returns nothing.
+ */
+export function registerSourceSinkConfig(languageId, spec) {
+    registry.set(languageId, spec);
+}
+/**
+ * Look up the taint config for a language. Returns `undefined` when no spec is
+ * registered (the M0 default for every language) — never throws.
+ */
+export function getSourceSinkConfig(languageId) {
+    return registry.get(languageId);
+}
+/** Language ids that currently have a registered spec. Empty in M0. */
+export function registeredTaintLanguages() {
+    return [...registry.keys()];
+}
+/** Reset the registry. Primarily for test isolation. */
+export function clearSourceSinkRegistry() {
+    registry.clear();
+}

package/dist/core/ingestion/workers/parse-worker.js

@@ -18,6 +18,19 @@ import { getProvider } from '../languages/index.js';
 import { getTreeSitterBufferSize, getTreeSitterContentByteLength, TREE_SITTER_MAX_BUFFER, } from '../constants.js';
 import { ARRAY_METHOD_HOC_BLOCKLIST_SET, DEFAULT_EXPORT_IDENTIFIER_BLOCKLIST_SET, deriveDefaultExportHocName, } from '../ts-js-hoc-utils.js';
 import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
+// ── Worker grammar loading — enforcement boundary (#2091/#2093, #2101) ───────
+// The worker maintains its own grammar table (the guarded `_require`s below +
+// `languageMap`) and intentionally does NOT consult the runtime
+// `GITNEXUS_SKIP_OPTIONAL_GRAMMARS` opt-out. It does not need to: the MAIN
+// THREAD's `parseableScanned` filter (pipeline-phases/parse-impl.ts, gated on
+// `parser-loader.isLanguageAvailable`, which honors the runtime opt-out and a
+// genuinely-absent binding alike) excludes files of an unavailable/opted-out
+// language BEFORE any chunk is dispatched, so the worker never receives them.
+// That main-thread filter is the single enforcement point. Any future change
+// that dispatches files to the worker WITHOUT first passing them through
+// `isLanguageAvailable` must re-introduce the gate here. (The cleaner end-state
+// — routing this table through `parser-loader.getLanguageGrammar` so there is
+// one loader — is the deferred Tier-1 consolidation.)
 // tree-sitter-swift is an optionalDependency — may not be installed
 const _require = createRequire(import.meta.url);
 let Swift = null;

package/dist/core/lbug/csv-generator.js

@@ -232,6 +232,9 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir) => {
     const routeWriter = new BufferedCSVWriter(path.join(csvDir, 'route.csv'), 'id,name,filePath,responseKeys,errorKeys,middleware');
     // Tool nodes for MCP tool definitions
     const toolWriter = new BufferedCSVWriter(path.join(csvDir, 'tool.csv'), 'id,name,filePath,description');
+    // BasicBlock nodes — taint/PDG substrate (issue #2080). No `name` column;
+    // blocks are identified by id + source span. Emitted by no phase yet.
+    const basicBlockWriter = new BufferedCSVWriter(path.join(csvDir, 'basicblock.csv'), 'id,filePath,startLine,endLine,text');
     // Multi-language node types share the same CSV shape (no isExported column)
     const multiLangHeader = 'id,name,filePath,startLine,endLine,content,description';
     const MULTI_LANG_TYPES = [
@@ -380,6 +383,15 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir) => {
                     escapeCSVField(node.properties.description || ''),
                 ].join(','));
                 break;
+            case 'BasicBlock':
+                await basicBlockWriter.addRow([
+                    escapeCSVField(node.id),
+                    escapeCSVField(node.properties.filePath || ''),
+                    escapeCSVNumber(node.properties.startLine, -1),
+                    escapeCSVNumber(node.properties.endLine, -1),
+                    escapeCSVField(node.properties.text || ''),
+                ].join(','));
+                break;
             default: {
                 // Code element nodes (Function, Class, Interface, CodeElement)
                 const writer = codeWriterMap[node.label];
@@ -433,6 +445,7 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir) => {
         sectionWriter,
         routeWriter,
         toolWriter,
+        basicBlockWriter,
         ...multiLangWriters.values(),
     ];
     await Promise.all(allWriters.map((w) => w.finish()));
@@ -465,6 +478,7 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir) => {
         ['Section', sectionWriter],
         ['Route', routeWriter],
         ['Tool', toolWriter],
+        ['BasicBlock', basicBlockWriter],
         ...Array.from(multiLangWriters.entries()).map(([name, w]) => [name, w]),
     ];
     for (const [name, writer] of tableMap) {

package/dist/core/lbug/lbug-adapter.js

@@ -962,6 +962,10 @@ const getCopyQuery = (table, filePath) => {
     if (table === 'Tool') {
         return `COPY ${t}(id, name, filePath, description) FROM "${filePath}" ${COPY_CSV_OPTS}`;
     }
+    if (table === 'BasicBlock') {
+        // Taint/PDG substrate (issue #2080) — no name column.
+        return `COPY ${t}(id, filePath, startLine, endLine, text) FROM "${filePath}" ${COPY_CSV_OPTS}`;
+    }
     if (table === 'Method') {
         return `COPY ${t}(id, name, filePath, startLine, endLine, isExported, content, description, parameterCount, returnType) FROM "${filePath}" ${COPY_CSV_OPTS}`;
     }
@@ -1011,6 +1015,10 @@ export const insertNodeToLbug = async (label, properties, dbPath) => {
                 : '';
             query = `CREATE (n:Section {id: ${escapeValue(properties.id)}, name: ${escapeValue(properties.name)}, filePath: ${escapeValue(properties.filePath)}, startLine: ${properties.startLine || 0}, endLine: ${properties.endLine || 0}, level: ${properties.level || 1}, content: ${escapeValue(properties.content || '')}${descPart}})`;
         }
+        else if (label === 'BasicBlock') {
+            // Taint/PDG substrate (issue #2080) — no name column.
+            query = `CREATE (n:BasicBlock {id: ${escapeValue(properties.id)}, filePath: ${escapeValue(properties.filePath)}, startLine: ${properties.startLine || 0}, endLine: ${properties.endLine || 0}, text: ${escapeValue(properties.text || '')}})`;
+        }
         else if (TABLES_WITH_EXPORTED.has(label)) {
             const descPart = properties.description
                 ? `, description: ${escapeValue(properties.description)}`
@@ -1094,6 +1102,10 @@ export const batchInsertNodesToLbug = async (nodes, dbPath) => {
                         : '';
                     query = `MERGE (n:Section {id: ${escapeValue(properties.id)}}) SET n.name = ${escapeValue(properties.name)}, n.filePath = ${escapeValue(properties.filePath)}, n.startLine = ${properties.startLine || 0}, n.endLine = ${properties.endLine || 0}, n.level = ${properties.level || 1}, n.content = ${escapeValue(properties.content || '')}${descPart}`;
                 }
+                else if (label === 'BasicBlock') {
+                    // Taint/PDG substrate (issue #2080) — no name column.
+                    query = `MERGE (n:BasicBlock {id: ${escapeValue(properties.id)}}) SET n.filePath = ${escapeValue(properties.filePath)}, n.startLine = ${properties.startLine || 0}, n.endLine = ${properties.endLine || 0}, n.text = ${escapeValue(properties.text || '')}`;
+                }
                 else if (TABLES_WITH_EXPORTED.has(label)) {
                     const descPart = properties.description
                         ? `, n.description = ${escapeValue(properties.description)}`

package/dist/core/lbug/schema.d.ts

@@ -42,7 +42,8 @@ export declare const MODULE_SCHEMA: string;
 export declare const ROUTE_SCHEMA = "\nCREATE NODE TABLE Route (\n  id STRING,\n  name STRING,\n  filePath STRING,\n  responseKeys STRING[],\n  errorKeys STRING[],\n  middleware STRING[],\n  PRIMARY KEY (id)\n)";
 export declare const TOOL_SCHEMA = "\nCREATE NODE TABLE Tool (\n  id STRING,\n  name STRING,\n  filePath STRING,\n  description STRING,\n  PRIMARY KEY (id)\n)";
 export declare const SECTION_SCHEMA = "\nCREATE NODE TABLE Section (\n  id STRING,\n  name STRING,\n  filePath STRING,\n  startLine INT64,\n  endLine INT64,\n  level INT64,\n  content STRING,\n  description STRING,\n  PRIMARY KEY (id)\n)";
-export declare const RELATION_SCHEMA = "\nCREATE REL TABLE CodeRelation (\n  FROM File TO File,\n  FROM File TO Folder,\n  FROM File TO Function,\n  FROM File TO Class,\n  FROM File TO Interface,\n  FROM File TO Method,\n  FROM File TO CodeElement,\n  FROM File TO `Struct`,\n  FROM File TO `Enum`,\n  FROM File TO `Macro`,\n  FROM File TO `Typedef`,\n  FROM File TO `Union`,\n  FROM File TO `Namespace`,\n  FROM File TO `Trait`,\n  FROM File TO `Impl`,\n  FROM File TO `TypeAlias`,\n  FROM File TO `Const`,\n  FROM File TO `Static`,\n  FROM File TO `Variable`,\n  FROM File TO `Property`,\n  FROM File TO `Record`,\n  FROM File TO `Delegate`,\n  FROM File TO `Annotation`,\n  FROM File TO `Constructor`,\n  FROM File TO `Template`,\n  FROM File TO `Module`,\n  FROM File TO Section,\n  FROM Folder TO Folder,\n  FROM Folder TO File,\n  FROM Function TO Function,\n  FROM Function TO Method,\n  FROM Function TO Class,\n  FROM Function TO Community,\n  FROM Function TO `Macro`,\n  FROM Function TO `Struct`,\n  FROM Function TO `Template`,\n  FROM Function TO `Enum`,\n  FROM Function TO `Namespace`,\n  FROM Function TO `TypeAlias`,\n  FROM Function TO `Module`,\n  FROM Function TO `Impl`,\n  FROM Function TO Interface,\n  FROM Function TO `Constructor`,\n  FROM Function TO `Const`,\n  FROM Function TO `Typedef`,\n  FROM Function TO `Union`,\n  FROM Function TO `Property`,\n  FROM Function TO CodeElement,\n  FROM Class TO Method,\n  FROM Class TO Function,\n  FROM Class TO Class,\n  FROM Class TO Interface,\n  FROM Class TO Community,\n  FROM Class TO `Template`,\n  FROM Class TO `TypeAlias`,\n  FROM Class TO `Struct`,\n  FROM Class TO `Enum`,\n  FROM Class TO `Annotation`,\n  FROM Class TO `Constructor`,\n  FROM Class TO `Trait`,\n  FROM Class TO `Macro`,\n  FROM Class TO `Impl`,\n  FROM Class TO `Union`,\n  FROM Class TO `Namespace`,\n  FROM Class TO `Typedef`,\n  FROM Class TO `Property`,\n  FROM Method TO Function,\n  FROM Method TO Method,\n  FROM Method TO Class,\n  FROM Method TO Community,\n  FROM Method TO `Template`,\n  FROM Method TO `Struct`,\n  FROM Method TO `TypeAlias`,\n  FROM Method TO `Enum`,\n  FROM Method TO `Macro`,\n  FROM Method TO `Namespace`,\n  FROM Method TO `Module`,\n  FROM Method TO `Impl`,\n  FROM Method TO Interface,\n  FROM Method TO `Constructor`,\n  FROM Method TO `Property`,\n  FROM Method TO CodeElement,\n  FROM `Template` TO `Template`,\n  FROM `Template` TO Function,\n  FROM `Template` TO Method,\n  FROM `Template` TO Class,\n  FROM `Template` TO `Struct`,\n  FROM `Template` TO `TypeAlias`,\n  FROM `Template` TO `Enum`,\n  FROM `Template` TO `Macro`,\n  FROM `Template` TO Interface,\n  FROM `Template` TO `Constructor`,\n  FROM `Module` TO `Module`,\n  FROM Section TO Section,\n  FROM Section TO File,\n  FROM File TO Route,\n  FROM Function TO Route,\n  FROM Method TO Route,\n  FROM File TO Tool,\n  FROM Function TO Tool,\n  FROM Method TO Tool,\n  FROM CodeElement TO Community,\n  FROM Interface TO Community,\n  FROM Interface TO Function,\n  FROM Interface TO Method,\n  FROM Interface TO Class,\n  FROM Interface TO Interface,\n  FROM Interface TO `TypeAlias`,\n  FROM Interface TO `Struct`,\n  FROM Interface TO `Constructor`,\n  FROM Interface TO `Property`,\n  FROM `Struct` TO Community,\n  FROM `Struct` TO `Trait`,\n  FROM `Struct` TO `Struct`,\n  FROM `Struct` TO Class,\n  FROM `Struct` TO `Enum`,\n  FROM `Struct` TO Function,\n  FROM `Struct` TO Method,\n  FROM `Struct` TO Interface,\n  FROM `Struct` TO `Constructor`,\n  FROM `Struct` TO `Property`,\n  FROM `Enum` TO `Enum`,\n  FROM `Enum` TO Community,\n  FROM `Enum` TO Class,\n  FROM `Enum` TO Interface,\n  FROM `Macro` TO Community,\n  FROM `Macro` TO Function,\n  FROM `Macro` TO Method,\n  FROM `Module` TO Function,\n  FROM `Module` TO Method,\n  FROM `Typedef` TO Community,\n  FROM `Union` TO Community,\n  FROM `Namespace` TO Community,\n  FROM `Namespace` TO `Struct`,\n  FROM `Trait` TO Method,\n  FROM `Trait` TO `Constructor`,\n  FROM `Trait` TO `Property`,\n  FROM `Trait` TO Community,\n  FROM `Impl` TO Method,\n  FROM `Impl` TO `Constructor`,\n  FROM `Impl` TO `Property`,\n  FROM `Impl` TO Community,\n  FROM `Impl` TO `Trait`,\n  FROM `Impl` TO `Struct`,\n  FROM `Impl` TO `Impl`,\n  FROM `TypeAlias` TO Community,\n  FROM `TypeAlias` TO `Trait`,\n  FROM `TypeAlias` TO Class,\n  FROM `Const` TO Community,\n  FROM `Static` TO Community,\n  FROM `Variable` TO Community,\n  FROM `Property` TO Community,\n  FROM `Record` TO Method,\n  FROM `Record` TO `Constructor`,\n  FROM `Record` TO `Property`,\n  FROM `Record` TO Community,\n  FROM `Delegate` TO Community,\n  FROM `Annotation` TO Community,\n  FROM `Constructor` TO Community,\n  FROM `Constructor` TO Interface,\n  FROM `Constructor` TO Class,\n  FROM `Constructor` TO Method,\n  FROM `Constructor` TO Function,\n  FROM `Constructor` TO `Constructor`,\n  FROM `Constructor` TO `Struct`,\n  FROM `Constructor` TO `Macro`,\n  FROM `Constructor` TO `Template`,\n  FROM `Constructor` TO `TypeAlias`,\n  FROM `Constructor` TO `Enum`,\n  FROM `Constructor` TO `Annotation`,\n  FROM `Constructor` TO `Impl`,\n  FROM `Constructor` TO `Namespace`,\n  FROM `Constructor` TO `Module`,\n  FROM `Constructor` TO `Property`,\n  FROM `Constructor` TO `Typedef`,\n  FROM `Template` TO Community,\n  FROM `Module` TO Community,\n  FROM Function TO Process,\n  FROM Method TO Process,\n  FROM Class TO Process,\n  FROM Interface TO Process,\n  FROM `Struct` TO Process,\n  FROM `Constructor` TO Process,\n  FROM `Module` TO Process,\n  FROM `Macro` TO Process,\n  FROM `Impl` TO Process,\n  FROM `Typedef` TO Process,\n  FROM `TypeAlias` TO Process,\n  FROM `Enum` TO Process,\n  FROM `Union` TO Process,\n  FROM `Namespace` TO Process,\n  FROM `Trait` TO Process,\n  FROM `Const` TO Process,\n  FROM `Static` TO Process,\n  FROM `Variable` TO Process,\n  FROM `Property` TO Process,\n  FROM `Record` TO Process,\n  FROM `Delegate` TO Process,\n  FROM `Annotation` TO Process,\n  FROM `Template` TO Process,\n  FROM CodeElement TO Process,\n  FROM Route TO Process,\n  FROM Tool TO Process,\n  type STRING,\n  confidence DOUBLE,\n  reason STRING,\n  step INT32\n)";
+export declare const BASICBLOCK_SCHEMA = "\nCREATE NODE TABLE BasicBlock (\n  id STRING,\n  filePath STRING,\n  startLine INT64,\n  endLine INT64,\n  text STRING,\n  PRIMARY KEY (id)\n)";
+export declare const RELATION_SCHEMA = "\nCREATE REL TABLE CodeRelation (\n  FROM File TO File,\n  FROM File TO Folder,\n  FROM File TO Function,\n  FROM File TO Class,\n  FROM File TO Interface,\n  FROM File TO Method,\n  FROM File TO CodeElement,\n  FROM File TO `Struct`,\n  FROM File TO `Enum`,\n  FROM File TO `Macro`,\n  FROM File TO `Typedef`,\n  FROM File TO `Union`,\n  FROM File TO `Namespace`,\n  FROM File TO `Trait`,\n  FROM File TO `Impl`,\n  FROM File TO `TypeAlias`,\n  FROM File TO `Const`,\n  FROM File TO `Static`,\n  FROM File TO `Variable`,\n  FROM File TO `Property`,\n  FROM File TO `Record`,\n  FROM File TO `Delegate`,\n  FROM File TO `Annotation`,\n  FROM File TO `Constructor`,\n  FROM File TO `Template`,\n  FROM File TO `Module`,\n  FROM File TO Section,\n  FROM Folder TO Folder,\n  FROM Folder TO File,\n  FROM Function TO Function,\n  FROM Function TO Method,\n  FROM Function TO Class,\n  FROM Function TO Community,\n  FROM Function TO `Macro`,\n  FROM Function TO `Struct`,\n  FROM Function TO `Template`,\n  FROM Function TO `Enum`,\n  FROM Function TO `Namespace`,\n  FROM Function TO `TypeAlias`,\n  FROM Function TO `Module`,\n  FROM Function TO `Impl`,\n  FROM Function TO Interface,\n  FROM Function TO `Constructor`,\n  FROM Function TO `Const`,\n  FROM Function TO `Typedef`,\n  FROM Function TO `Union`,\n  FROM Function TO `Property`,\n  FROM Function TO CodeElement,\n  FROM Class TO Method,\n  FROM Class TO Function,\n  FROM Class TO Class,\n  FROM Class TO Interface,\n  FROM Class TO Community,\n  FROM Class TO `Template`,\n  FROM Class TO `TypeAlias`,\n  FROM Class TO `Struct`,\n  FROM Class TO `Enum`,\n  FROM Class TO `Annotation`,\n  FROM Class TO `Constructor`,\n  FROM Class TO `Trait`,\n  FROM Class TO `Macro`,\n  FROM Class TO `Impl`,\n  FROM Class TO `Union`,\n  FROM Class TO `Namespace`,\n  FROM Class TO `Typedef`,\n  FROM Class TO `Property`,\n  FROM Method TO Function,\n  FROM Method TO Method,\n  FROM Method TO Class,\n  FROM Method TO Community,\n  FROM Method TO `Template`,\n  FROM Method TO `Struct`,\n  FROM Method TO `TypeAlias`,\n  FROM Method TO `Enum`,\n  FROM Method TO `Macro`,\n  FROM Method TO `Namespace`,\n  FROM Method TO `Module`,\n  FROM Method TO `Impl`,\n  FROM Method TO Interface,\n  FROM Method TO `Constructor`,\n  FROM Method TO `Property`,\n  FROM Method TO CodeElement,\n  FROM `Template` TO `Template`,\n  FROM `Template` TO Function,\n  FROM `Template` TO Method,\n  FROM `Template` TO Class,\n  FROM `Template` TO `Struct`,\n  FROM `Template` TO `TypeAlias`,\n  FROM `Template` TO `Enum`,\n  FROM `Template` TO `Macro`,\n  FROM `Template` TO Interface,\n  FROM `Template` TO `Constructor`,\n  FROM `Module` TO `Module`,\n  FROM Section TO Section,\n  FROM Section TO File,\n  FROM File TO Route,\n  FROM Function TO Route,\n  FROM Method TO Route,\n  FROM File TO Tool,\n  FROM Function TO Tool,\n  FROM Method TO Tool,\n  FROM CodeElement TO Community,\n  FROM Interface TO Community,\n  FROM Interface TO Function,\n  FROM Interface TO Method,\n  FROM Interface TO Class,\n  FROM Interface TO Interface,\n  FROM Interface TO `TypeAlias`,\n  FROM Interface TO `Struct`,\n  FROM Interface TO `Constructor`,\n  FROM Interface TO `Property`,\n  FROM `Struct` TO Community,\n  FROM `Struct` TO `Trait`,\n  FROM `Struct` TO `Struct`,\n  FROM `Struct` TO Class,\n  FROM `Struct` TO `Enum`,\n  FROM `Struct` TO Function,\n  FROM `Struct` TO Method,\n  FROM `Struct` TO Interface,\n  FROM `Struct` TO `Constructor`,\n  FROM `Struct` TO `Property`,\n  FROM `Enum` TO `Enum`,\n  FROM `Enum` TO Community,\n  FROM `Enum` TO Class,\n  FROM `Enum` TO Interface,\n  FROM `Macro` TO Community,\n  FROM `Macro` TO Function,\n  FROM `Macro` TO Method,\n  FROM `Module` TO Function,\n  FROM `Module` TO Method,\n  FROM `Typedef` TO Community,\n  FROM `Union` TO Community,\n  FROM `Namespace` TO Community,\n  FROM `Namespace` TO `Struct`,\n  FROM `Trait` TO Method,\n  FROM `Trait` TO `Constructor`,\n  FROM `Trait` TO `Property`,\n  FROM `Trait` TO Community,\n  FROM `Impl` TO Method,\n  FROM `Impl` TO `Constructor`,\n  FROM `Impl` TO `Property`,\n  FROM `Impl` TO Community,\n  FROM `Impl` TO `Trait`,\n  FROM `Impl` TO `Struct`,\n  FROM `Impl` TO `Impl`,\n  FROM `TypeAlias` TO Community,\n  FROM `TypeAlias` TO `Trait`,\n  FROM `TypeAlias` TO Class,\n  FROM `Const` TO Community,\n  FROM `Static` TO Community,\n  FROM `Variable` TO Community,\n  FROM `Property` TO Community,\n  FROM `Record` TO Method,\n  FROM `Record` TO `Constructor`,\n  FROM `Record` TO `Property`,\n  FROM `Record` TO Community,\n  FROM `Delegate` TO Community,\n  FROM `Annotation` TO Community,\n  FROM `Constructor` TO Community,\n  FROM `Constructor` TO Interface,\n  FROM `Constructor` TO Class,\n  FROM `Constructor` TO Method,\n  FROM `Constructor` TO Function,\n  FROM `Constructor` TO `Constructor`,\n  FROM `Constructor` TO `Struct`,\n  FROM `Constructor` TO `Macro`,\n  FROM `Constructor` TO `Template`,\n  FROM `Constructor` TO `TypeAlias`,\n  FROM `Constructor` TO `Enum`,\n  FROM `Constructor` TO `Annotation`,\n  FROM `Constructor` TO `Impl`,\n  FROM `Constructor` TO `Namespace`,\n  FROM `Constructor` TO `Module`,\n  FROM `Constructor` TO `Property`,\n  FROM `Constructor` TO `Typedef`,\n  FROM `Template` TO Community,\n  FROM `Module` TO Community,\n  FROM Function TO Process,\n  FROM Method TO Process,\n  FROM Class TO Process,\n  FROM Interface TO Process,\n  FROM `Struct` TO Process,\n  FROM `Constructor` TO Process,\n  FROM `Module` TO Process,\n  FROM `Macro` TO Process,\n  FROM `Impl` TO Process,\n  FROM `Typedef` TO Process,\n  FROM `TypeAlias` TO Process,\n  FROM `Enum` TO Process,\n  FROM `Union` TO Process,\n  FROM `Namespace` TO Process,\n  FROM `Trait` TO Process,\n  FROM `Const` TO Process,\n  FROM `Static` TO Process,\n  FROM `Variable` TO Process,\n  FROM `Property` TO Process,\n  FROM `Record` TO Process,\n  FROM `Delegate` TO Process,\n  FROM `Annotation` TO Process,\n  FROM `Template` TO Process,\n  FROM CodeElement TO Process,\n  FROM Route TO Process,\n  FROM Tool TO Process,\n  FROM BasicBlock TO BasicBlock,\n  type STRING,\n  confidence DOUBLE,\n  reason STRING,\n  step INT32\n)";
 export declare const EMBEDDING_DIMS: number;
 /** HNSW vector index name for the CodeEmbedding table. */
 export declare const EMBEDDING_INDEX_NAME = "code_embedding_idx";

package/dist/core/lbug/schema.js

@@ -201,6 +201,22 @@ CREATE NODE TABLE Section (
   description STRING,
   PRIMARY KEY (id)
 )`;
+// Taint/PDG substrate (issue #2080) — intra-procedural control-flow node.
+// Emitted by no phase yet; M1 (#2081) populates these behind an opt-in.
+// REACHING_DEF carries its variable name in the relation's existing `reason`
+// column (see RELATION_SCHEMA) — LadybugDB has no secondary index on rel
+// properties, so a dedicated indexed column would buy nothing for the
+// variable-filtered path query (M0/S1 verdict). No `name` column: blocks are
+// identified by id + source span, not a symbol name.
+export const BASICBLOCK_SCHEMA = `
+CREATE NODE TABLE BasicBlock (
+  id STRING,
+  filePath STRING,
+  startLine INT64,
+  endLine INT64,
+  text STRING,
+  PRIMARY KEY (id)
+)`;
 // ============================================================================
 // RELATION TABLE SCHEMA
 // Single table with 'type' property - connects all node tables
@@ -410,6 +426,7 @@ CREATE REL TABLE ${REL_TABLE_NAME} (
   FROM CodeElement TO Process,
   FROM Route TO Process,
   FROM Tool TO Process,
+  FROM BasicBlock TO BasicBlock,
   type STRING,
   confidence DOUBLE,
   reason STRING,
@@ -490,6 +507,11 @@ export const NODE_SCHEMA_QUERIES = [
     ROUTE_SCHEMA,
     // MCP tools
     TOOL_SCHEMA,
+    // Taint/PDG substrate (issue #2080) — must be appended here, not just
+    // declared above: SCHEMA_QUERIES (the list initLbug actually runs) is built
+    // from NODE_SCHEMA_QUERIES. Omitting this leaves the BasicBlock table
+    // uncreated and the bulk-COPY round-trip fails with "table does not exist".
+    BASICBLOCK_SCHEMA,
 ];
 export const REL_SCHEMA_QUERIES = [RELATION_SCHEMA];
 export const SCHEMA_QUERIES = [...NODE_SCHEMA_QUERIES, ...REL_SCHEMA_QUERIES, EMBEDDING_SCHEMA];

package/dist/core/tree-sitter/parser-loader.d.ts

@@ -15,6 +15,14 @@ export interface GrammarSourceDescriptor {
 export declare const listGrammarSources: () => GrammarSourceDescriptor[];
 export declare const resolveLanguageKey: (language: SupportedLanguages, filePath?: string) => string;
 export declare const isLanguageAvailable: (language: SupportedLanguages, filePath?: string) => boolean;
+/**
+ * True when `language`'s grammar is being treated as unavailable specifically
+ * because of the runtime GITNEXUS_SKIP_OPTIONAL_GRAMMARS opt-out — as opposed
+ * to a genuinely-missing/broken native binding. Lets callers surface an
+ * accurate "skipped on purpose" message instead of a spurious "npm rebuild"
+ * recovery hint. Returns false for required grammars and for an absent env.
+ */
+export declare const isGrammarRuntimeSkipped: (language: SupportedLanguages, filePath?: string) => boolean;
 export declare const getLanguageGrammar: (language: SupportedLanguages, filePath?: string) => unknown;
 export declare const loadParser: () => Promise<Parser>;
 export declare const loadLanguage: (language: SupportedLanguages, filePath?: string) => Promise<void>;

package/dist/core/tree-sitter/parser-loader.js

@@ -86,6 +86,7 @@ const SOURCES = {
     [SupportedLanguages.Swift]: {
         load: () => _require('tree-sitter-swift'),
         optional: true,
+        userSkippable: true,
         unavailableNote: 'Swift parsing disabled: vendored `tree-sitter-swift` (under ' +
             '`gitnexus/vendor/tree-sitter-swift`) failed to load. ' +
             'Likely cause: no prebuilt `.node` for this platform/architecture. ' +
@@ -94,6 +95,7 @@ const SOURCES = {
     [SupportedLanguages.Dart]: {
         load: () => _require('tree-sitter-dart'),
         optional: true,
+        userSkippable: true,
         unavailableNote: 'Dart parsing disabled: vendored `tree-sitter-dart` (under ' +
             '`gitnexus/vendor/tree-sitter-dart`) failed to load. ' +
             'Likely cause: native compile failed at install (missing python3/make/g++). ' +
@@ -102,6 +104,7 @@ const SOURCES = {
     [SupportedLanguages.Kotlin]: {
         load: () => _require('tree-sitter-kotlin'),
         optional: true,
+        userSkippable: true,
         unavailableNote: 'Kotlin parsing disabled: `tree-sitter-kotlin` is an optionalDependency ' +
             'and is not installed (or its native binding failed to build).',
     },
@@ -112,6 +115,43 @@ export const listGrammarSources = () => Object.entries(SOURCES).map(([key, sourc
 }));
 const loadCache = new Map();
 const logged = new Set();
+// Parsed form of GITNEXUS_SKIP_OPTIONAL_GRAMMARS, resolved lazily ONCE per
+// process. The env is set before analyze runs, so re-reading + re-allocating a
+// Set on every call was wasted work (and a latent trap for any future per-file
+// caller). `vi.resetModules()` gives the unit tests a fresh module — and thus a
+// fresh memo — per case, so this stays test-friendly.
+//   'all' → every userSkippable grammar; Set → only the named ids
+//   (and `tree-sitter-<id>` spellings); null → env unset/empty (nothing).
+let _skipDirective;
+const skipDirective = () => {
+    if (_skipDirective !== undefined)
+        return _skipDirective;
+    const raw = (process.env.GITNEXUS_SKIP_OPTIONAL_GRAMMARS ?? '').trim().toLowerCase();
+    if (raw === '')
+        return (_skipDirective = null);
+    if (raw === '1' || raw === 'true' || raw === 'all' || raw === '*')
+        return (_skipDirective = 'all');
+    return (_skipDirective = new Set(raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .flatMap((s) => [s, s.replace(/^tree-sitter-/, '')])));
+};
+const isRuntimeSkippedGrammar = (key, source) => {
+    // Only grammars explicitly flagged user-skippable (swift/dart/kotlin) — never
+    // required deps that use the optional machinery for ABI safety (C carries no
+    // `userSkippable`).
+    if (source.userSkippable !== true)
+        return false;
+    const directive = skipDirective();
+    if (directive === null)
+        return false;
+    if (directive === 'all')
+        return true;
+    // `key` is the SupportedLanguages value (e.g. `swift`); the directive Set
+    // already holds both the bare id and the `tree-sitter-<id>` spelling.
+    return directive.has(key) || directive.has(`tree-sitter-${key}`);
+};
 const logFailure = (key, result) => {
     if (result.ok === true)
         return;
@@ -148,6 +188,24 @@ const loadGrammar = (key) => {
         loadCache.set(key, result);
         return result;
     }
+    // Runtime opt-out: treat a user-skipped optional grammar exactly like an
+    // absent binding (non-fatal unavailable + one warning), without attempting
+    // the native load. See `isRuntimeSkippedGrammar`.
+    if (isRuntimeSkippedGrammar(key, source)) {
+        // Deliberate opt-out: emit an accurate "disabled on purpose" note rather
+        // than `source.unavailableNote` (which blames a missing/unbuilt binding and
+        // would mislead a user who set the env intentionally — #2101 review).
+        const result = {
+            ok: false,
+            error: new Error('runtime opt-out'),
+            note: `${key} parsing disabled via GITNEXUS_SKIP_OPTIONAL_GRAMMARS (unset it to re-enable).`,
+            fatal: false,
+            severity: 'warn',
+        };
+        loadCache.set(key, result);
+        logFailure(key, result);
+        return result;
+    }
     let result;
     try {
         result = { ok: true, grammar: source.load() };
@@ -168,6 +226,18 @@ const loadGrammar = (key) => {
     return result;
 };
 export const isLanguageAvailable = (language, filePath) => loadGrammar(resolveLanguageKey(language, filePath)).ok;
+/**
+ * True when `language`'s grammar is being treated as unavailable specifically
+ * because of the runtime GITNEXUS_SKIP_OPTIONAL_GRAMMARS opt-out — as opposed
+ * to a genuinely-missing/broken native binding. Lets callers surface an
+ * accurate "skipped on purpose" message instead of a spurious "npm rebuild"
+ * recovery hint. Returns false for required grammars and for an absent env.
+ */
+export const isGrammarRuntimeSkipped = (language, filePath) => {
+    const key = resolveLanguageKey(language, filePath);
+    const source = SOURCES[key];
+    return source !== undefined && isRuntimeSkippedGrammar(key, source);
+};
 export const getLanguageGrammar = (language, filePath) => {
     const key = resolveLanguageKey(language, filePath);
     const result = loadGrammar(key);

package/dist/server/api.d.ts

@@ -47,6 +47,7 @@ export declare const landingPageHtml: () => string;
 export declare const staticCacheControlSetHeaders: (res: express.Response, filePath: string) => void;
 export declare const registerWebUI: (app: express.Express, staticDir: string | null) => void;
 export declare const writeNdjsonRecord: (res: express.Response, record: GraphStreamRecord, signal?: AbortSignal) => Promise<void>;
+export declare const getNodeQuery: (table: string, includeContent: boolean) => string;
 export declare const streamGraphNdjson: (res: express.Response, includeContent?: boolean, signal?: AbortSignal) => Promise<void>;
 /**
  * Handle a GET /api/file request body. Extracted from createServer's route

package/dist/server/api.js

@@ -290,8 +290,16 @@ const buildGraph = async (includeContent = false) => {
 const GRAPH_RELATIONSHIP_QUERY = `MATCH (a)-[r:CodeRelation]->(b) RETURN a.id AS sourceId, b.id AS targetId, ` +
     `r.type AS type, r.confidence AS confidence, r.reason AS reason, r.step AS step`;
 const quoteNodeTable = (table) => `\`${table.replace(/`/g, '``')}\``;
-const getNodeQuery = (table, includeContent) => {
+export const getNodeQuery = (table, includeContent) => {
     const tableLabel = quoteNodeTable(table);
+    if (table === 'BasicBlock') {
+        // Taint/PDG substrate (issue #2080) — BasicBlock has no name/content
+        // columns. Project only its declared columns: a default `n.name`
+        // projection raises a Ladybug "Cannot find property name" binder error
+        // (not matched by isIgnorableGraphQueryError), which would 500 the graph
+        // endpoint the moment BasicBlock joins NODE_TABLES, even on an empty table.
+        return `MATCH (n:${tableLabel}) RETURN n.id AS id, n.filePath AS filePath, n.startLine AS startLine, n.endLine AS endLine, n.text AS text`;
+    }
     if (table === 'File') {
         return includeContent
             ? `MATCH (n:${tableLabel}) RETURN n.id AS id, n.name AS name, n.filePath AS filePath, n.content AS content`
@@ -320,10 +328,17 @@ const mapGraphNodeRow = (table, row, includeContent) => ({
     id: row.id ?? row[0],
     label: table,
     properties: {
-        name: row.name ?? row.label ?? row[1],
+        // `?? ''` keeps NodeProperties.name a `string` even for label rows that
+        // project no name/label column (BasicBlock — taint/PDG substrate #2080).
+        // Without it, BasicBlock rows carry name:undefined (masked by the cast
+        // below) and the web layer (Header search, circles/tree layout) derefs
+        // `.name` unguarded → TypeError once M1 emits blocks. `row.text` gives a
+        // BasicBlock a sensible fallback name before the empty-string floor.
+        name: row.name ?? row.label ?? row.text ?? row[1] ?? '',
         filePath: row.filePath ?? row[2],
         startLine: row.startLine,
         endLine: row.endLine,
+        text: row.text,
         content: includeContent ? row.content : undefined,
         responseKeys: row.responseKeys,
         errorKeys: row.errorKeys,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.7-rc.1",
+  "version": "1.6.7-rc.3",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",