gitnexus 1.6.7 → 1.6.8-rc.10

package/dist/cli/index.js

@@ -34,6 +34,9 @@ program
     .option('--skip-agents-md', 'Skip updating the gitnexus section in AGENTS.md and CLAUDE.md')
     .option('--default-branch <branch>', 'Default branch used in the generated regression-compare example (base_ref). ' +
     'Falls back to .gitnexusrc, then auto-detected origin/HEAD, then "main".')
+    .option('--branch <name>', 'Index the working tree under a specific branch slot (multi-branch indexing). ' +
+    'Defaults to the checked-out branch; the primary/first-indexed branch keeps the ' +
+    'flat index and others get their own. Distinct from --default-branch (cosmetic base_ref).')
     .option('--no-stats', 'Omit volatile file/symbol counts from AGENTS.md and CLAUDE.md')
     .option('--skip-skills', 'Skip installing standard GitNexus skill files under .claude/skills/gitnexus/. ' +
     'Does not suppress community skills from --skills (those use .claude/skills/generated/). ' +
@@ -89,6 +92,7 @@ program
     .description('Delete GitNexus index for current repo')
     .option('-f, --force', 'Skip confirmation prompt')
     .option('--all', 'Clean all indexed repos')
+    .option('--branch <name>', 'Delete only the named branch index (not the primary)')
     .option('--lbug-sidecars', 'Clean quarantined LadybugDB missing-shadow WAL sidecars')
     .action(createLazyAction(() => import('./clean.js'), 'cleanCommand'));
 program
@@ -135,6 +139,7 @@ program
     .command('query <search_query>')
     .description('Search the knowledge graph for execution flows related to a concept')
     .option('-r, --repo <name>', 'Target repository (omit if only one indexed)')
+    .option('--branch <name>', 'Scope to a specific branch index (multi-branch repos)')
     .option('-c, --context <text>', 'Task context to improve ranking')
     .option('-g, --goal <text>', 'What you want to find')
     .option('-l, --limit <n>', 'Max processes to return (default: 5)')
@@ -144,6 +149,7 @@ program
     .command('context [name]')
     .description('360-degree view of a code symbol: callers, callees, processes')
     .option('-r, --repo <name>', 'Target repository')
+    .option('--branch <name>', 'Scope to a specific branch index (multi-branch repos)')
     .option('-u, --uid <uid>', 'Direct symbol UID (zero-ambiguity lookup)')
     .option('-f, --file <path>', 'File path to disambiguate common names')
     .option('--content', 'Include full symbol source code')
@@ -153,6 +159,7 @@ program
     .description('Blast radius analysis: what breaks if you change a symbol')
     .option('-d, --direction <dir>', 'upstream (dependants) or downstream (dependencies)', 'upstream')
     .option('-r, --repo <name>', 'Target repository')
+    .option('--branch <name>', 'Scope to a specific branch index (multi-branch repos)')
     .option('-u, --uid <uid>', 'Direct symbol UID (zero-ambiguity lookup)')
     .option('-f, --file <path>', 'File path to disambiguate common names')
     .option('--kind <kind>', 'Kind filter to disambiguate common names (e.g. Function, Class, Method)')
@@ -166,6 +173,7 @@ program
     .command('cypher <query>')
     .description('Execute raw Cypher query against the knowledge graph')
     .option('-r, --repo <name>', 'Target repository')
+    .option('--branch <name>', 'Scope to a specific branch index (multi-branch repos)')
     .action(createLbugLazyAction(() => import('./tool.js'), 'cypherCommand'));
 program
     .command('detect-changes')
@@ -174,6 +182,7 @@ program
     .option('-s, --scope <scope>', 'What to analyze: unstaged, staged, all, or compare', 'unstaged')
     .option('-b, --base-ref <ref>', 'Branch/commit for compare scope (e.g. main)')
     .option('-r, --repo <name>', 'Target repository')
+    .option('--branch <name>', 'Scope to a specific branch index (multi-branch repos)')
     .action(createLbugLazyAction(() => import('./tool.js'), 'detectChangesCommand'));
 // ─── Eval Server (persistent daemon for SWE-bench) ─────────────────
 program

package/dist/cli/list.js

@@ -31,6 +31,8 @@ export const listCommand = async () => {
         console.log(`    ${t('common.path')}:    ${entry.path}`);
         console.log(`    ${t('list.indexed')}: ${indexedDate}`);
         console.log(`    ${t('list.commit')}:  ${commitShort}`);
+        if (entry.branch)
+            console.log(`    ${t('list.branch')}:  ${entry.branch}`);
         console.log(`    ${t('list.stats')}:   ${t('list.statsValue', {
             files: stats.files ?? 0,
             symbols: stats.nodes ?? 0,
@@ -40,6 +42,16 @@ export const listCommand = async () => {
             console.log(`    ${t('list.clusters')}:   ${stats.communities}`);
         if (stats.processes)
             console.log(`    ${t('list.processes')}:  ${stats.processes}`);
+        // Per-branch indexes (#2106). Only rendered when extra branches were
+        // indexed for this path, so single-branch output is unchanged.
+        if (entry.branches && entry.branches.length > 0) {
+            console.log(`    ${t('list.branchIndexes')}:`);
+            for (const b of entry.branches) {
+                const bCommit = b.lastCommit?.slice(0, 7) || t('list.unknown');
+                const bIndexed = new Date(b.indexedAt).toLocaleString();
+                console.log(`      ${t('list.branchLine', { branch: b.branch, commit: bCommit, indexed: bIndexed })}`);
+            }
+        }
         console.log('');
     }
 };

package/dist/cli/optional-grammars.d.ts

@@ -1,15 +1,13 @@
 /**
  * Optional grammar availability check.
  *
- * tree-sitter-dart, tree-sitter-proto, and tree-sitter-swift are vendored
- * under vendor/ and materialized into node_modules/ at postinstall. Dart
- * and Proto are built from source with node-gyp; Swift ships platform
- * prebuilds activated via node-gyp-build. tree-sitter-kotlin is a declared
- * optionalDependency (not vendored). All can be skipped via
+ * tree-sitter-dart, -proto, -swift, and -kotlin are vendored under vendor/ and
+ * loaded from there by absolute path (NEVER copied into node_modules — see
+ * core/tree-sitter/vendored-grammars.ts / #2111). Each ships committed platform
+ * prebuilds activated via node-gyp-build. All can be skipped via
  * GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1 (postinstall scripts), or can silently
- * soft-fail when the toolchain is missing (Dart/Proto), when no prebuild
- * matches the host platform (Swift), or when the optional install was
- * skipped or its native build failed (Kotlin).
+ * soft-fail when no prebuild matches the host platform (and a source build was
+ * unavailable / not attempted).
  *
  * Either path produces the same observable: the .node binding is absent
  * at runtime. This helper detects that condition and surfaces a single

package/dist/cli/optional-grammars.js

@@ -1,26 +1,23 @@
 /**
  * Optional grammar availability check.
  *
- * tree-sitter-dart, tree-sitter-proto, and tree-sitter-swift are vendored
- * under vendor/ and materialized into node_modules/ at postinstall. Dart
- * and Proto are built from source with node-gyp; Swift ships platform
- * prebuilds activated via node-gyp-build. tree-sitter-kotlin is a declared
- * optionalDependency (not vendored). All can be skipped via
+ * tree-sitter-dart, -proto, -swift, and -kotlin are vendored under vendor/ and
+ * loaded from there by absolute path (NEVER copied into node_modules — see
+ * core/tree-sitter/vendored-grammars.ts / #2111). Each ships committed platform
+ * prebuilds activated via node-gyp-build. All can be skipped via
  * GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1 (postinstall scripts), or can silently
- * soft-fail when the toolchain is missing (Dart/Proto), when no prebuild
- * matches the host platform (Swift), or when the optional install was
- * skipped or its native build failed (Kotlin).
+ * soft-fail when no prebuild matches the host platform (and a source build was
+ * unavailable / not attempted).
  *
  * Either path produces the same observable: the .node binding is absent
  * at runtime. This helper detects that condition and surfaces a single
  * stderr line per missing grammar so users learn why .dart/.proto/.swift/.kt
  * support is unavailable instead of silently getting a degraded index.
  */
-import { createRequire } from 'module';
 import { SupportedLanguages } from '../_shared/index.js';
 import { isGrammarRuntimeSkipped } from '../core/tree-sitter/parser-loader.js';
+import { requireVendoredGrammar } from '../core/tree-sitter/vendored-grammars.js';
 import { cliWarn } from './cli-message.js';
-const _require = createRequire(import.meta.url);
 const OPTIONAL_GRAMMARS = [
     {
         name: 'tree-sitter-dart',
@@ -76,7 +73,7 @@ export function detectMissingOptionalGrammars() {
             continue;
         }
         try {
-            _require(g.pkg);
+            requireVendoredGrammar(g.pkg);
         }
         catch (err) {
             const code = err?.code;

package/dist/cli/status.js

@@ -3,8 +3,9 @@
  *
  * Shows the indexing status of the current repository.
  */
-import { findRepo, getStoragePaths, hasKuzuIndex } from '../storage/repo-manager.js';
-import { getCurrentCommit, isGitRepo, getGitRoot } from '../storage/git.js';
+import path from 'path';
+import { findRepo, getStoragePaths, loadMeta, hasKuzuIndex } from '../storage/repo-manager.js';
+import { getCurrentCommit, getCurrentBranch, isGitRepo, getGitRoot } from '../storage/git.js';
 import { t } from './i18n/index.js';
 export const statusCommand = async () => {
     const cwd = process.cwd();
@@ -28,10 +29,30 @@ export const statusCommand = async () => {
         return;
     }
     const currentCommit = getCurrentCommit(repo.repoPath);
-    const isUpToDate = currentCommit === repo.meta.lastCommit;
+    const currentBranch = getCurrentBranch(repo.repoPath);
+    // Pick the index matching the checked-out branch (#2106). The flat index
+    // belongs to the primary branch (repo.meta.branch); when the current branch
+    // differs and has its own index, report that one. Legacy/no-branch metas and
+    // detached HEAD fall through to the flat index (unchanged behavior).
+    let activeMeta = repo.meta;
+    let currentBranchIndexed = true;
+    if (currentBranch && repo.meta.branch && currentBranch !== repo.meta.branch) {
+        const { metaPath } = getStoragePaths(repo.repoPath, currentBranch);
+        const branchMeta = await loadMeta(path.dirname(metaPath));
+        if (branchMeta)
+            activeMeta = branchMeta;
+        else
+            currentBranchIndexed = false;
+    }
     console.log(`${t('status.repository')}: ${repo.repoPath}`);
-    console.log(`${t('status.indexed')}: ${new Date(repo.meta.indexedAt).toLocaleString()}`);
-    console.log(`${t('status.indexedCommit')}: ${repo.meta.lastCommit?.slice(0, 7)}`);
+    console.log(`${t('status.branch')}: ${currentBranch ?? t('status.detached')}`);
+    if (!currentBranchIndexed) {
+        console.log(`${t('status.status')}: ${t('status.branchNotIndexed', { primary: repo.meta.branch ?? '' })}`);
+        return;
+    }
+    const isUpToDate = currentCommit === activeMeta.lastCommit;
+    console.log(`${t('status.indexed')}: ${new Date(activeMeta.indexedAt).toLocaleString()}`);
+    console.log(`${t('status.indexedCommit')}: ${activeMeta.lastCommit?.slice(0, 7)}`);
     console.log(`${t('status.currentCommit')}: ${currentCommit?.slice(0, 7)}`);
     console.log(`${t('status.status')}: ${isUpToDate ? t('status.upToDate') : t('status.stale')}`);
 };

package/dist/cli/tool.d.ts

@@ -16,6 +16,7 @@
  */
 export declare function queryCommand(queryText: string, options?: {
     repo?: string;
+    branch?: string;
     context?: string;
     goal?: string;
     limit?: string;
@@ -23,6 +24,7 @@ export declare function queryCommand(queryText: string, options?: {
 }): Promise<void>;
 export declare function contextCommand(name: string, options?: {
     repo?: string;
+    branch?: string;
     file?: string;
     uid?: string;
     content?: boolean;
@@ -30,6 +32,7 @@ export declare function contextCommand(name: string, options?: {
 export declare function impactCommand(target?: string, options?: {
     direction?: string;
     repo?: string;
+    branch?: string;
     uid?: string;
     file?: string;
     kind?: string;
@@ -41,9 +44,11 @@ export declare function impactCommand(target?: string, options?: {
 }): Promise<void>;
 export declare function cypherCommand(query: string, options?: {
     repo?: string;
+    branch?: string;
 }): Promise<void>;
 export declare function detectChangesCommand(options?: {
     scope?: string;
     baseRef?: string;
     repo?: string;
+    branch?: string;
 }): Promise<void>;

package/dist/cli/tool.js

@@ -68,6 +68,7 @@ export async function queryCommand(queryText, options) {
         limit: options?.limit ? parseInt(options.limit) : undefined,
         include_content: options?.content ?? false,
         repo: options?.repo,
+        branch: options?.branch,
     });
     output(result);
 }
@@ -88,6 +89,7 @@ export async function contextCommand(name, options) {
         file_path: options?.file,
         include_content: options?.content ?? false,
         repo: options?.repo,
+        branch: options?.branch,
     });
     output(result);
 }
@@ -126,6 +128,7 @@ export async function impactCommand(target, options) {
             maxDepth: options?.depth ? parseInt(options.depth, 10) : undefined,
             includeTests: options?.includeTests ?? false,
             repo: options?.repo,
+            branch: options?.branch,
             limit: parsedLimit,
             offset: parsedOffset,
             summaryOnly: options?.summaryOnly ?? undefined,
@@ -153,6 +156,7 @@ export async function cypherCommand(query, options) {
     const result = await backend.callTool('cypher', {
         query,
         repo: options?.repo,
+        branch: options?.branch,
     });
     output(result);
 }
@@ -162,6 +166,7 @@ export async function detectChangesCommand(options) {
         scope: options?.scope || 'unstaged',
         base_ref: options?.baseRef,
         repo: options?.repo,
+        branch: options?.branch,
     });
     output(formatDetectChangesResult(result));
 }

package/dist/core/embeddings/embedder.js

@@ -21,6 +21,7 @@ import { isHttpMode, getHttpDimensions, httpEmbed } from './http-client.js';
 import { resolveEmbeddingConfig } from './config.js';
 import { applyHfEnvOverrides, isHfDownloadFailure, withHfDownloadRetry } from './hf-env.js';
 import { getLocalEmbeddingRuntimeBlocker } from './runtime-support.js';
+import { ensureOnnxRuntimeCommonResolvable } from './onnxruntime-common-resolver.js';
 import { logger } from '../logger.js';
 /**
  * Check whether the onnxruntime-node package that @huggingface/transformers
@@ -147,6 +148,9 @@ export const initEmbedder = async (onProgress, config = {}, forceDevice) => {
         try {
             // Lazy-load transformers.js only after the runtime guard has passed, so
             // unsupported platforms never reach the native ONNX import (#1515).
+            // Under pnpm-strict / `pnpm dlx`, transformers' phantom `onnxruntime-common`
+            // import is unresolvable; register the fallback resolver first (#307).
+            ensureOnnxRuntimeCommonResolvable();
             const { pipeline, env } = await import('@huggingface/transformers');
             // Configure transformers.js environment
             env.allowLocalModels = false;

package/dist/core/embeddings/embedding-pipeline.js

@@ -16,8 +16,8 @@ import { extractStructuralNames } from './structural-extractor.js';
 import { EMBEDDABLE_LABELS, isShortLabel, LABEL_METHOD, LABELS_WITH_EXPORTED, STRUCTURAL_LABELS, collectBestChunks, } from './types.js';
 import { resolveEmbeddingConfig } from './config.js';
 import { rankExactEmbeddingRows } from './exact-search.js';
-import { EMBEDDING_TABLE_NAME, EMBEDDING_INDEX_NAME, CREATE_VECTOR_INDEX_QUERY, STALE_HASH_SENTINEL, } from '../lbug/schema.js';
-import { loadVectorExtension } from '../lbug/lbug-adapter.js';
+import { EMBEDDING_TABLE_NAME, EMBEDDING_INDEX_NAME, STALE_HASH_SENTINEL } from '../lbug/schema.js';
+import { loadVectorExtension, createVectorIndex } from '../lbug/lbug-adapter.js';
 import { getExactScanLimit } from '../platform/capabilities.js';
 import { logger } from '../logger.js';
 const isDev = process.env.NODE_ENV === 'development';
@@ -153,24 +153,35 @@ export const batchInsertEmbeddings = async (executeWithReusedStatement, updates)
     await executeWithReusedStatement(cypher, paramsList);
 };
 /**
- * Create the vector index for semantic search
-
- * Now indexes the separate CodeEmbedding table.
- * Delegates extension loading to lbug-adapter's loadVectorExtension(),
- * which owns the VECTOR extension lifecycle and state tracking.
-
+ * Create the vector index for semantic search (indexes the CodeEmbedding table).
+ *
+ * Keeps the embedding-specific extension-install policy gate here
+ * (ensureVectorExtensionAvailable → resolveEmbeddingInstallPolicy, default
+ * `auto` for the analyze write path), then delegates the actual
+ * `CALL CREATE_VECTOR_INDEX(...)` to the adapter, which runs it through the
+ * unprepared `conn.query()` path. It must NOT go through the injected
+ * `executeQuery` (prepared `conn.prepare()`): LadybugDB cannot prepare that
+ * procedure and fails with "We do not support prepare multiple statements" —
+ * the silent degrade in #2114.
  */
-const createVectorIndex = async (executeQuery) => {
+const buildVectorIndex = async () => {
+    // This pre-check applies the embedding-specific install policy
+    // (resolveEmbeddingInstallPolicy, default `auto` for analyze) before reaching
+    // the adapter. The adapter's createVectorIndex() calls loadVectorExtension()
+    // again, but that's a no-op here: once this gate loads VECTOR the module-level
+    // `vectorExtensionLoaded` flag is set, so the adapter's second call
+    // short-circuits without re-resolving the policy — no double install.
     if (!(await ensureVectorExtensionAvailable()))
         return false;
     try {
-        await executeQuery(CREATE_VECTOR_INDEX_QUERY);
-        return true;
+        return await createVectorIndex();
     }
     catch (error) {
-        if (isDev) {
-            logger.warn({ error }, 'Vector index creation warning:');
-        }
+        // Surface this even outside dev: it silently downgrades a user-requested
+        // feature (semantic search) to exact scan. Log under `err` so pino's
+        // standard serializer captures the message/stack — logging under `error`
+        // serialized an Error to `{}` (the empty `{"error":{}}` reported in #2114).
+        logger.warn({ err: error }, 'Vector index creation failed; semantic search will use exact-scan fallback');
         return false;
     }
 };
@@ -283,7 +294,7 @@ export const runEmbeddingPipeline = async (executeQuery, executeWithReusedStatem
             // Ensure the vector index exists even when no new nodes need embedding.
             // A prior crash or first-time incremental run may have left CodeEmbedding
             // rows without ever reaching index creation.
-            const vectorIndexReady = await createVectorIndex(executeQuery);
+            const vectorIndexReady = await buildVectorIndex();
             onProgress({
                 phase: 'ready',
                 percent: 100,
@@ -403,7 +414,7 @@ export const runEmbeddingPipeline = async (executeQuery, executeWithReusedStatem
         if (isDev) {
             logger.info('📇 Creating vector index...');
         }
-        const vectorIndexReady = await createVectorIndex(executeQuery);
+        const vectorIndexReady = await buildVectorIndex();
         onProgress({
             phase: 'ready',
             percent: 100,

package/dist/core/embeddings/onnxruntime-common-resolver.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Idempotently install the onnxruntime-common resolution fallback. Call once
+ * immediately before the dynamic `import('@huggingface/transformers')` on the
+ * local-embedding path.
+ */
+export declare const ensureOnnxRuntimeCommonResolvable: () => void;

package/dist/core/embeddings/onnxruntime-common-resolver.js

@@ -0,0 +1,130 @@
+/**
+ * Make `@huggingface/transformers`' phantom `onnxruntime-common` import
+ * resolvable under strict package-manager layouts (#307, #2069).
+ *
+ * ## Why
+ * transformers' shipped `dist/transformers.node.mjs` does a bare
+ * `import 'onnxruntime-common'`, but transformers' `package.json` never declares
+ * onnxruntime-common (it lists onnxruntime-node / onnxruntime-web / sharp). With
+ * npm's flat `node_modules` — or pnpm with hoisting — the package is hoisted to
+ * a directory on transformers' resolution path and the import resolves by
+ * accident. Under pnpm's isolated store (and therefore `pnpm dlx` / `pnpx`), a
+ * package only sees its *declared* deps, so the import dies with
+ * `ERR_MODULE_NOT_FOUND` before `analyze --embeddings` can run.
+ *
+ * Declaring onnxruntime-common in gitnexus' own dependencies (#2074) does NOT
+ * fix this under pnpm: Node resolves the bare specifier from *transformers'*
+ * module scope, not ours, and overrides/resolutions can only re-version an
+ * existing edge, never add the missing one.
+ *
+ * ## What this does
+ * Install a synchronous, in-thread ESM resolution hook (`module.registerHooks`,
+ * Node >= 22.15) that redirects `onnxruntime-common` to a copy gitnexus can
+ * resolve — but only when the default resolver fails. The redirect target is
+ * preferentially the `onnxruntime-common` that `onnxruntime-node` (the native
+ * binding transformers actually loads) itself depends on, so the redirected copy
+ * is version-matched to that binding even under `pnpm dlx` — where gitnexus'
+ * npm-style `overrides` block does NOT apply, because it is honoured only from a
+ * root manifest and gitnexus is a transitive dependency there. It falls back to
+ * gitnexus' own direct `onnxruntime-common` dependency when that chain can't be
+ * walked. onnxruntime-common is a stable, pure-JS package whose `Tensor` surface
+ * is unchanged across 1.24–1.26, so either target is API-compatible. On working
+ * layouts the default resolver succeeds first and the hook never fires, so
+ * behaviour is unchanged.
+ *
+ * `registerHooks` (synchronous, in-thread) is preferred over the older
+ * `module.register` (async, off-thread, now deprecated — DEP0205, removed in
+ * Node 26): the redirect is a one-line conditional that needs no worker thread,
+ * no separate hook module, and no `data` marshalling.
+ *
+ * ## Safety
+ * Best-effort and idempotent. The hook is installed lazily, only on the
+ * local-embedding code path (after parsing), so it is never registered during
+ * analysis, in the parse workers, or in HTTP embedding mode. Once installed it
+ * is process-global: its resolve closure runs for every subsequent module
+ * resolution, but it passes all of them through untouched and only substitutes a
+ * result for the exact `onnxruntime-common` specifier when that specifier is
+ * genuinely absent — so it cannot mask an unrelated resolution error, and the
+ * per-resolution cost is a single string comparison.
+ *
+ * `module.registerHooks` is marked `@experimental` and requires Node >= 22.15
+ * (the gitnexus engines floor is >= 22.0.0). On older runtimes it is absent and
+ * this is a graceful no-op: embeddings then resolve onnxruntime-common exactly
+ * as before — fine on hoisted layouts. Any failure during installation is
+ * swallowed.
+ */
+import { registerHooks, createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { logger } from '../logger.js';
+let attempted = false;
+/**
+ * Compute the file: URL the hook redirects `onnxruntime-common` to.
+ *
+ * Prefer the copy `onnxruntime-node` (the native binding transformers loads)
+ * depends on, so the redirected module is version-matched to the binding even
+ * under `pnpm dlx`, where transformers keeps its own pinned onnxruntime-node.
+ * The walk resolves transformers' MAIN entry — NOT `@huggingface/transformers/
+ * package.json`, which transformers' `exports` map blocks
+ * (`ERR_PACKAGE_PATH_NOT_EXPORTED`) — then onnxruntime-node, then its
+ * onnxruntime-common. Falls back to gitnexus' own direct dependency (always
+ * resolvable from our scope) when any step fails.
+ */
+const resolveOnnxRuntimeCommonUrl = () => {
+    const require = createRequire(import.meta.url);
+    try {
+        const transformersMain = require.resolve('@huggingface/transformers');
+        const ortNodePkg = createRequire(transformersMain).resolve('onnxruntime-node/package.json');
+        const common = createRequire(ortNodePkg).resolve('onnxruntime-common');
+        return pathToFileURL(common).href;
+    }
+    catch {
+        return pathToFileURL(require.resolve('onnxruntime-common')).href;
+    }
+};
+/**
+ * Idempotently install the onnxruntime-common resolution fallback. Call once
+ * immediately before the dynamic `import('@huggingface/transformers')` on the
+ * local-embedding path.
+ */
+export const ensureOnnxRuntimeCommonResolvable = () => {
+    if (attempted)
+        return;
+    // Mark attempted up-front: a failed attempt must not retry on every
+    // initEmbedder() call, and the hook is process-global — once is enough.
+    attempted = true;
+    try {
+        // Node < 22.15 (the gitnexus engines floor is >= 22.0.0): no synchronous
+        // hooks API. Degrade gracefully — the import still works on hoisted layouts.
+        if (typeof registerHooks !== 'function')
+            return;
+        const redirectUrl = resolveOnnxRuntimeCommonUrl();
+        registerHooks({
+            resolve(specifier, context, nextResolve) {
+                if (specifier !== 'onnxruntime-common')
+                    return nextResolve(specifier, context);
+                // Honour a real, package-manager-provided copy when one is on the path
+                // (npm / hoisted pnpm); only substitute ours when the specifier is
+                // genuinely absent.
+                try {
+                    return nextResolve(specifier, context);
+                }
+                catch (err) {
+                    // The phantom import surfaces as ERR_MODULE_NOT_FOUND (or, for a
+                    // present-but-exports-broken copy, ERR_PACKAGE_PATH_NOT_EXPORTED).
+                    // Rethrow anything else so a genuinely broken install is not masked.
+                    const code = err?.code;
+                    if (code === 'ERR_MODULE_NOT_FOUND' || code === 'ERR_PACKAGE_PATH_NOT_EXPORTED') {
+                        return { url: redirectUrl, shortCircuit: true };
+                    }
+                    throw err;
+                }
+            },
+        });
+        logger.debug({ redirectUrl }, 'Installed onnxruntime-common resolution fallback (#307)');
+    }
+    catch (err) {
+        // Never block embeddings on the fallback. On layouts where the package
+        // manager already resolves onnxruntime-common this is unnecessary anyway.
+        logger.debug({ err: err instanceof Error ? err.message : String(err) }, 'onnxruntime-common resolution fallback not installed');
+    }
+};

package/dist/core/group/extractors/grpc-patterns/proto.js

@@ -1,23 +1,27 @@
 import { createRequire } from 'node:module';
+import { requireVendoredGrammar } from '../../../tree-sitter/vendored-grammars.js';
 import { compilePatterns, runCompiledPatterns, } from '../tree-sitter-scanner.js';
 /**
  * Protobuf (.proto) tree-sitter plugin for gRPC contract extraction.
  *
- * Uses `tree-sitter-proto` (coder3101/tree-sitter-proto) as an
- * optionalDependency — if the grammar is not installed (e.g. native
- * compilation failed on an unusual platform), the plugin exports
- * `null` and the orchestrator falls back to the existing manual
- * string-sanitizing parser.
+ * Uses `tree-sitter-proto` (coder3101/tree-sitter-proto), loaded from
+ * `vendor/` by absolute path (NEVER copied into node_modules — see
+ * vendored-grammars.ts / #2111). If the grammar's binding cannot be loaded
+ * (e.g. no prebuild for an unusual platform), the plugin exports `null` and the
+ * orchestrator falls back to the existing manual string-sanitizing parser.
  *
  * The grammar is vendored in `vendor/tree-sitter-proto/` with
  * parser.c regenerated against tree-sitter-cli 0.24 (ABI version 14)
  * so it is compatible with the project's tree-sitter 0.21.1 runtime
  * (which loads ABI 13–14).
  */
+// Only for `tree-sitter` (a real npm dependency) in the smoke-test below;
+// the vendored grammar goes through requireVendoredGrammar (never a bare
+// `_require('tree-sitter-proto')`, which would force a node_modules copy — #2111).
 const _require = createRequire(import.meta.url);
 let ProtoGrammar = null;
 try {
-    ProtoGrammar = _require('tree-sitter-proto');
+    ProtoGrammar = requireVendoredGrammar('tree-sitter-proto');
 }
 catch {
     // Grammar not installed — PROTO_GRPC_PLUGIN will be null.

package/dist/core/group/extractors/http-patterns/java.js

@@ -1,31 +1,6 @@
 import Java from 'tree-sitter-java';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
-/**
- * Java HTTP plugin. Handles:
- *   - Spring `@RequestMapping` class prefixes + `@(Get|Post|...)Mapping` method annotations
- *   - Spring `RestTemplate.getForObject/...`, `exchange(...)`
- *   - Spring `WebClient.method(HttpMethod.X, ...)`, `WebClient.get().uri(...)`
- *   - OkHttp `new Request.Builder().url("...")`
- *   - OpenFeign interfaces with Spring MVC method annotations or
- *     native `@RequestLine("METHOD /path")` annotations
- *   - Java / Apache HttpClient literal request construction
- *
- * Every route-defining annotation (class/interface `@RequestMapping`
- * prefixes, `@FeignClient(path)` prefixes, `@(Get|...)Mapping` method
- * routes and native `@RequestLine`s) is matched by a single consolidated
- * query (`JAVA_ROUTE_ANNOTATION_PATTERNS`) in one pass via
- * `scanRouteAnnotations`. The `scan` function then walks up from each
- * matched method to its enclosing class/interface to combine the prefix
- * with the method path. Call-site consumers (RestTemplate, WebClient,
- * OkHttp, Java/Apache HttpClient) keep their own focused queries.
- */
-const METHOD_ANNOTATION_TO_HTTP = {
-    GetMapping: 'GET',
-    PostMapping: 'POST',
-    PutMapping: 'PUT',
-    DeleteMapping: 'DELETE',
-    PatchMapping: 'PATCH',
-};
+import { METHOD_ANNOTATION_TO_HTTP, isRouteMemberKey, findEnclosingClass, } from '../../../ingestion/route-extractors/spring-shared.js';
 // ─── Route-defining annotations (one generic query, one pass) ─────────
 // Every Java route-mapper annotation shares one shape: an annotation carrying a
 // single string argument — positional `"..."` or named `key = "..."` — on a
@@ -300,19 +275,9 @@ const APACHE_HTTP_CLIENT_PATTERNS = compilePatterns({
     ],
 });
 /**
- * Find the nearest enclosing class/interface declaration ancestor for
- * a node, or null if the node is top-level. Tree-sitter's
- * SyntaxNode.parent walks one level at a time.
+ * Find the nearest enclosing interface declaration ancestor for a node, or
+ * null if the node is top-level.
  */
-function findEnclosingClass(node) {
-    let cur = node.parent;
-    while (cur) {
-        if (cur.type === 'class_declaration')
-            return cur;
-        cur = cur.parent;
-    }
-    return null;
-}
 function findEnclosingInterface(node) {
     let cur = node.parent;
     while (cur) {
@@ -369,18 +334,6 @@ function hasAnnotation(node, names) {
     }
     return false;
 }
-/**
- * A named annotation argument contributes a route only when its member key is
- * `path` or `value`; a positional argument (no key node) always qualifies.
- * This is the JS-side replacement for the in-query `^(path|value)$` filter and
- * drops Spring's non-route string attributes (`produces`, `consumes`,
- * `headers`, `name`, `params`) that would otherwise be mis-read as routes.
- */
-function isRouteMemberKey(keyNode) {
-    if (!keyNode)
-        return true;
-    return keyNode.text === 'path' || keyNode.text === 'value';
-}
 /**
  * Resolve every Java route-defining annotation in a single tree-sitter pass.
  *

package/dist/core/group/extractors/http-patterns/kotlin.js

@@ -1,4 +1,4 @@
-import { createRequire } from 'node:module';
+import { requireVendoredGrammar } from '../../../tree-sitter/vendored-grammars.js';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
 /**
  * Kotlin HTTP plugin (Spring providers + consumers).
@@ -52,15 +52,15 @@ import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-s
  *         value_argument
  *           string_literal                ← the path
  *
- * tree-sitter-kotlin is an optional npm dependency — when its native
- * binding is unavailable the plugin gracefully exports `null` and
- * `http-patterns/index.ts` skips registration for `.kt`/`.kts` files.
+ * tree-sitter-kotlin is a vendored grammar loaded from `vendor/` by absolute
+ * path (NEVER copied into node_modules — see vendored-grammars.ts / #2111) —
+ * when its native binding is unavailable the plugin gracefully exports `null`
+ * and `http-patterns/index.ts` skips registration for `.kt`/`.kts` files.
  */
-const _require = createRequire(import.meta.url);
-/** Loaded lazily; null when the grammar binding isn't installed. */
+/** Loaded lazily; null when the grammar binding isn't available. */
 let Kotlin = null;
 try {
-    Kotlin = _require('tree-sitter-kotlin');
+    Kotlin = requireVendoredGrammar('tree-sitter-kotlin');
 }
 catch {
     Kotlin = null;