gitnexus 1.6.8-rc.4 → 1.6.8-rc.40

package/README.md

@@ -34,7 +34,7 @@ That's it. This indexes the codebase, installs agent skills, registers Claude Co
 
 To configure MCP for your editor, run `npx gitnexus setup` once — or set it up manually below.
 
-`gitnexus setup` auto-detects your editors and writes the correct global MCP config. You only need to run it once.
+`gitnexus setup` auto-detects your editors and writes the correct global MCP config. You only need to run it once. To configure only selected integrations, pass `--coding-agent`/`-c` with a comma-separated list or repeat the option, for example `gitnexus setup -c cursor,codex`.
 
 ### Editor Support
 
@@ -134,7 +134,7 @@ Your AI agent gets these tools automatically:
 | `rename`         | Multi-file coordinated rename with graph + text search           | Optional     |
 | `cypher`         | Raw Cypher graph queries                                         | Optional     |
 
-> With one indexed repo, the `repo` param is optional. With multiple, specify which: `query({query: "auth", repo: "my-app"})`.
+> With one indexed repo, the `repo` param is optional. With multiple, specify which: `query({search_query: "auth", repo: "my-app"})`.
 
 ## MCP Resources
 
@@ -158,7 +158,7 @@ Your AI agent gets these tools automatically:
 ## CLI Commands
 
 ```bash
-gitnexus setup                   # Configure MCP for your editors (one-time)
+gitnexus setup                   # Configure MCP for detected editors (one-time; use -c to select)
 gitnexus uninstall               # Preview removal of GitNexus MCP/skills/hooks (add --force to apply)
 gitnexus analyze [path]          # Index a repository (or update stale index)
 gitnexus analyze --repair-fts    # Fast path: rebuild/verify only FTS indexes on existing index data

package/dist/_shared/graph/types.d.ts

@@ -79,7 +79,21 @@ export type RelationshipType = 'CONTAINS' | 'CALLS' | 'INHERITS' | 'METHOD_OVERR
  | 'SANITIZES'
 /** Materialized source→sink taint path. Working name — final name/representation
  *  is confirmed when M3/M4 emits it; no persisted edge exists before then. */
- | 'TAINT_PATH';
+ | 'TAINT_PATH'
+/** Control-dependence edge (PDG, issue #2085 M5): block `dependent` (target)
+ *  executes only because the branch at block `controller` (source) took a
+ *  given side. The branch sense (`'T'` | `'F'`) rides the relation's existing
+ *  `reason` column — mirroring how `CFG` stores its edge kind there — since
+ *  the single `CodeRelation` table has no dedicated label column. */
+ | 'CDG'
+/** Debug-only post-dominator-tree edge (#2085 M5): a block → its immediate
+ *  post-dominator, emitted behind the `GITNEXUS_PDG_EMIT_POST_DOMINATE` env
+ *  flag for inspection. Never emitted in a normal `--pdg` run. Note: as a
+ *  member of this exported union it is a forward-compatibility commitment —
+ *  removing it later is a breaking schema change — and it is deliberately
+ *  excluded from `VALID_RELATION_TYPES` so it never enters impact-style
+ *  symbol-space traversal (same posture as the taint substrate edges). */
+ | 'POST_DOMINATE';
 export interface GraphNode {
     id: string;
     label: NodeLabel;

package/dist/_shared/graph/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graph/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,GACX,MAAM,GACN,WAAW,GACX,QAAQ,GACR,MAAM,GACN,aAAa,GACb,WAAW,GACX,SAAS,GAET,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,WAAW,GACX,OAAO,GACP,MAAM,GACN,WAAW,GACX,OAAO,GACP,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,MAAM,GAGN,YAAY,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEjC,WAAW,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,GACT,MAAM,GACN,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,OAAO,GACP,SAAS;AACX;;;;;;qEAMqE;GACnE,qBAAqB;AACvB;;;;;;gEAMgE;GAC9D,aAAa;AAOf,6EAA6E;GAC3E,KAAK;AACP;;;;qCAIqC;GACnC,cAAc;AAChB,qDAAqD;GACnD,SAAS;AACX,6CAA6C;GAC3C,WAAW;AACb;8EAC8E;GAC5E,YAAY,CAAC;AAEjB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graph/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,GACX,MAAM,GACN,WAAW,GACX,QAAQ,GACR,MAAM,GACN,aAAa,GACb,WAAW,GACX,SAAS,GAET,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,WAAW,GACX,OAAO,GACP,MAAM,GACN,WAAW,GACX,OAAO,GACP,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,MAAM,GAGN,YAAY,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEjC,WAAW,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,GACT,MAAM,GACN,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,OAAO,GACP,SAAS;AACX;;;;;;qEAMqE;GACnE,qBAAqB;AACvB;;;;;;gEAMgE;GAC9D,aAAa;AAOf,6EAA6E;GAC3E,KAAK;AACP;;;;qCAIqC;GACnC,cAAc;AAChB,qDAAqD;GACnD,SAAS;AACX,6CAA6C;GAC3C,WAAW;AACb;8EAC8E;GAC5E,YAAY;AACd;;;;qEAIqE;GACnE,KAAK;AACP;;;;;;0EAM0E;GACxE,eAAe,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL"}

package/dist/_shared/lbug/schema-constants.d.ts

@@ -10,7 +10,7 @@
 export declare const NODE_TABLES: readonly ["File", "Folder", "Function", "Class", "Interface", "Method", "CodeElement", "Community", "Process", "Section", "Struct", "Enum", "Macro", "Typedef", "Union", "Namespace", "Trait", "Impl", "TypeAlias", "Const", "Static", "Variable", "Property", "Record", "Delegate", "Annotation", "Constructor", "Template", "Module", "Route", "Tool", "BasicBlock"];
 export type NodeTableName = (typeof NODE_TABLES)[number];
 export declare const REL_TABLE_NAME = "CodeRelation";
-export declare const REL_TYPES: readonly ["CONTAINS", "DEFINES", "IMPORTS", "CALLS", "EXTENDS", "IMPLEMENTS", "HAS_METHOD", "HAS_PROPERTY", "ACCESSES", "METHOD_OVERRIDES", "OVERRIDES", "METHOD_IMPLEMENTS", "MEMBER_OF", "STEP_IN_PROCESS", "HANDLES_ROUTE", "FETCHES", "HANDLES_TOOL", "ENTRY_POINT_OF", "WRAPS", "QUERIES", "CFG", "REACHING_DEF", "TAINTED", "SANITIZES", "TAINT_PATH"];
+export declare const REL_TYPES: readonly ["CONTAINS", "DEFINES", "IMPORTS", "CALLS", "EXTENDS", "IMPLEMENTS", "HAS_METHOD", "HAS_PROPERTY", "ACCESSES", "METHOD_OVERRIDES", "OVERRIDES", "METHOD_IMPLEMENTS", "MEMBER_OF", "STEP_IN_PROCESS", "HANDLES_ROUTE", "FETCHES", "HANDLES_TOOL", "ENTRY_POINT_OF", "WRAPS", "QUERIES", "CFG", "REACHING_DEF", "TAINTED", "SANITIZES", "TAINT_PATH", "CDG", "POST_DOMINATE"];
 export type RelType = (typeof REL_TYPES)[number];
 export declare const EMBEDDING_TABLE_NAME = "CodeEmbedding";
 //# sourceMappingURL=schema-constants.d.ts.map

package/dist/_shared/lbug/schema-constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-constants.d.ts","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,WAAW,wWAkCd,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C,eAAO,MAAM,SAAS,8VA6BZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,eAAO,MAAM,oBAAoB,kBAAkB,CAAC"}
+{"version":3,"file":"schema-constants.d.ts","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,WAAW,wWAkCd,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C,eAAO,MAAM,SAAS,sXAmCZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,eAAO,MAAM,oBAAoB,kBAAkB,CAAC"}

package/dist/_shared/lbug/schema-constants.js

@@ -72,6 +72,12 @@ export const REL_TYPES = [
     'TAINTED',
     'SANITIZES',
     'TAINT_PATH',
+    // Control dependence (PDG, issue #2085 M5) — CDG carries its 'T'|'F' branch
+    // label in the relation's `reason` column; POST_DOMINATE is debug-only
+    // (behind GITNEXUS_PDG_EMIT_POST_DOMINATE). Both are BasicBlock→BasicBlock,
+    // reusing the existing FROM BasicBlock TO BasicBlock pair in RELATION_SCHEMA.
+    'CDG',
+    'POST_DOMINATE',
 ];
 export const EMBEDDING_TABLE_NAME = 'CodeEmbedding';
 //# sourceMappingURL=schema-constants.js.map

package/dist/_shared/lbug/schema-constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-constants.js","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM;IACN,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;IACR,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,WAAW;IACX,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,2EAA2E;IAC3E,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU;IACV,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,WAAW,EAAE,mEAAmE;IAChF,mBAAmB;IACnB,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,KAAK;IACL,cAAc;IACd,SAAS;IACT,WAAW;IACX,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"schema-constants.js","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM;IACN,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;IACR,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,WAAW;IACX,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,2EAA2E;IAC3E,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU;IACV,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,WAAW,EAAE,mEAAmE;IAChF,mBAAmB;IACnB,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,KAAK;IACL,cAAc;IACd,SAAS;IACT,WAAW;IACX,YAAY;IACZ,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,KAAK;IACL,eAAe;CACP,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC"}

package/dist/_shared/scope-resolution/parsed-file.d.ts

@@ -96,5 +96,26 @@ export interface ParsedFile {
      * side effects — the contract default) leave this undefined.
      */
     readonly captureSideChannel?: unknown;
+    /**
+     * Per-function control-flow graphs for this file (#2081 M1, PDG/taint
+     * substrate). A DISTINCT field from {@link captureSideChannel} — different
+     * producer, consumer, and lifecycle: the worker builds it from the
+     * tree-sitter AST via `LanguageProvider.cfgVisitor` (only on a `--pdg` run),
+     * and scope-resolution emits BasicBlock nodes + CFG edges from it while the
+     * disk-backed ParsedFile store is still live (it is NOT a capture-time
+     * marker the resolver restores into module maps). Kept separate so a future
+     * change to either channel's shape invalidates independently.
+     *
+     * Shared / ingestion code treats this as opaque (`unknown`) per AGENTS.md.
+     * Concretely it is a `readonly FunctionCfg[]` (see
+     * `core/ingestion/cfg/types.ts`) — plain JSON-serializable data (no AST
+     * refs, no class instances) so it round-trips through the parse cache and
+     * the `parsedfile-store` (whose interning reviver keys on `nodeId`, which
+     * these blocks/edges deliberately lack).
+     *
+     * Optional: `undefined` on non-`--pdg` runs and for languages with no
+     * `cfgVisitor` — the default for every run today.
+     */
+    readonly cfgSideChannel?: unknown;
 }
 //# sourceMappingURL=parsed-file.d.ts.map

package/dist/_shared/scope-resolution/parsed-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsed-file.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/parsed-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC"}
+{"version":3,"file":"parsed-file.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/parsed-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC"}

package/dist/_shared/scope-resolution/symbol-definition.d.ts

@@ -54,6 +54,10 @@ export interface SymbolDefinition {
      *  Currently used by C++ overload ranking to exclude explicit constructors
      *  from implicit user-defined conversion candidates. */
     isExplicit?: boolean;
+    /** True when the callable is declared unavailable (for example C++ `= delete`).
+     *  Unavailable callables still participate in overload selection, but a
+     *  selected unavailable target must suppress edge emission. */
+    isDeleted?: boolean;
     /** Links Method/Constructor/Property to owning Class/Struct/Trait nodeId */
     ownerId?: string;
     /** #1982/#1993: bridge-held enclosing-namespace path (e.g. `NS1`, `Outer.Inner`)

package/dist/_shared/scope-resolution/symbol-definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symbol-definition.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/symbol-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACjE,4CAA4C;IAC5C,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3E,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB;;+FAE2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;iHAC6G;IAC7G,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;uFACmF;IACnF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;4FACwF;IACxF,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5C,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;yEAKqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;4DAEwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;iEAO6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}
+{"version":3,"file":"symbol-definition.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/symbol-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACjE,4CAA4C;IAC5C,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3E,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB;;+FAE2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;iHAC6G;IAC7G,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;uFACmF;IACnF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;4FACwF;IACxF,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5C,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;yEAKqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;4DAEwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;mEAE+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;iEAO6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/cli/ai-context.d.ts

@@ -24,6 +24,12 @@ export interface AIContextOptions {
      * plain caller that omits it gets "main", preserving prior behavior.
      */
     defaultBranch?: string;
+    /**
+     * Whether the index was built with `--pdg` (#2086 M6). Gates the `pdg_query`
+     * line in the generated block — without the PDG layer the tool only returns a
+     * "no PDG layer" note, so advertising it on a non-`--pdg` index is noise.
+     */
+    hasPdg?: boolean;
 }
 /**
  * Strip backticks from a branch name before it is embedded in a Markdown
@@ -32,7 +38,31 @@ export interface AIContextOptions {
  * the generation sink so the embedding is provably safe regardless of caller.
  */
 export declare function markdownSafeBranch(branch: string): string;
-export declare function generateGitNexusContent(projectName: string, stats: RepoStats, generatedSkills?: GeneratedSkillInfo[], groupNames?: string[], noStats?: boolean, skipSkills?: boolean, runnerPath?: string, defaultBranch?: string): string;
+/** Options for {@link generateGitNexusContent} (collapsed from positional
+ *  params, #2188 review — six `undefined`s to reach `hasPdg` was the smell). */
+export interface GitNexusContentOptions {
+    generatedSkills?: GeneratedSkillInfo[];
+    groupNames?: string[];
+    noStats?: boolean;
+    skipSkills?: boolean;
+    /** Project-relative path to the runner `gitnexus analyze` drops next to the
+     *  index (#1945). Referenced by docs so a single CLI-neutral command resolves
+     *  the available runner (global `gitnexus` → `pnpm dlx` → `npx`) at call time. */
+    runnerPath?: string;
+    /** Default branch for the regression-compare example (#243). Configurable so
+     *  projects on `develop`/`master`/etc. don't get `base_ref: "main"` rewritten
+     *  back over their fix on every analyze. The value is embedded inside a
+     *  Markdown inline-code span: validateBranchName rejects backticks upstream,
+     *  and `markdownSafeBranch` strips any remaining backtick here as defense in
+     *  depth, so JSON.stringify's quote/escape handling is sufficient and the
+     *  branch cannot break out of the span (#1996 tri-review P1). */
+    defaultBranch?: string;
+    /** Whether the index was built with `--pdg` (#2086 M6). Gates the pdg_query
+     *  line below — false (default) omits it, so a non-pdg index doesn't advertise
+     *  a tool that only returns a "no PDG layer" note. */
+    hasPdg?: boolean;
+}
+export declare function generateGitNexusContent(projectName: string, stats: RepoStats, opts?: GitNexusContentOptions): string;
 /**
  * Generate AI context files after indexing
  */

package/dist/cli/ai-context.js

@@ -77,19 +77,8 @@ async function findGroupsContainingRegistryName(registryName) {
 export function markdownSafeBranch(branch) {
     return branch.replace(/`/g, '');
 }
-export function generateGitNexusContent(projectName, stats, generatedSkills, groupNames, noStats, skipSkills, 
-// Project-relative path to the runner `gitnexus analyze` drops next to the
-// index (#1945). Referenced by docs so a single CLI-neutral command resolves
-// the available runner (global `gitnexus` → `pnpm dlx` → `npx`) at call time.
-runnerPath = '.gitnexus/run.cjs', 
-// Default branch for the regression-compare example (#243). Configurable so
-// projects on `develop`/`master`/etc. don't get `base_ref: "main"` rewritten
-// back over their fix on every analyze. The value is embedded inside a
-// Markdown inline-code span: validateBranchName rejects backticks upstream,
-// and `markdownSafeBranch` strips any remaining backtick here as defense in
-// depth, so JSON.stringify's quote/escape handling is sufficient and the
-// branch cannot break out of the span (#1996 tri-review P1).
-defaultBranch = 'main') {
+export function generateGitNexusContent(projectName, stats, opts = {}) {
+    const { generatedSkills, groupNames, noStats, skipSkills, runnerPath = '.gitnexus/run.cjs', defaultBranch = 'main', hasPdg = false, } = opts;
     const generatedRows = generatedSkills && generatedSkills.length > 0
         ? generatedSkills
             .map((s) => `| Work in the ${s.label} area (${s.symbolCount} symbols) | \`.claude/skills/generated/${s.name}/SKILL.md\` |`)
@@ -134,8 +123,11 @@ This project is indexed by GitNexus as **${projectName}**${noStats ? '' : ` (${s
 - **MUST run impact analysis before editing any symbol.** Before modifying a function, class, or method, run \`impact({target: "symbolName", direction: "upstream"})\` and report the blast radius (direct callers, affected processes, risk level) to the user.
 - **MUST run \`detect_changes()\` before committing** to verify your changes only affect expected symbols and execution flows. For regression review, compare against the default branch: \`detect_changes({scope: "compare", base_ref: ${JSON.stringify(markdownSafeBranch(defaultBranch))}})\`.
 - **MUST warn the user** if impact analysis returns HIGH or CRITICAL risk before proceeding with edits.
-- When exploring unfamiliar code, use \`query({query: "concept"})\` to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
+- When exploring unfamiliar code, use \`query({search_query: "concept"})\` to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
 - When you need full context on a specific symbol — callers, callees, which execution flows it participates in — use \`context({name: "symbolName"})\`.
+- For security review, \`explain({target: "fileOrSymbol"})\` lists taint findings (source→sink flows; needs \`analyze --pdg\`).${hasPdg
+        ? `\n- For control/data dependence, \`pdg_query({mode: "controls", target: "fileOrSymbol"})\` answers "under what condition does X run?" (CDG, incl. guard clauses) and \`pdg_query({mode: "flows", target, variable})\` traces "where does variable Y flow?" (REACHING_DEF). \`--pdg\` layer.`
+        : ''}
 
 ## Never Do
 
@@ -348,7 +340,15 @@ export async function generateAIContextFiles(repoPath, storagePath, projectName,
     catch (err) {
         logger.warn(`Could not write GitNexus runner to ${runnerPath}: ${String(err)}`);
     }
-    const content = generateGitNexusContent(projectName, stats, generatedSkills, groupNames, options?.noStats, options?.skipSkills, runnerPath, options?.defaultBranch ?? 'main');
+    const content = generateGitNexusContent(projectName, stats, {
+        generatedSkills,
+        groupNames,
+        noStats: options?.noStats,
+        skipSkills: options?.skipSkills,
+        runnerPath,
+        defaultBranch: options?.defaultBranch ?? 'main',
+        hasPdg: options?.hasPdg ?? false,
+    });
     const createdFiles = [];
     if (!options?.skipAgentsMd) {
         // Create AGENTS.md (standard for Cursor, Windsurf, OpenCode, Cline, etc.)

package/dist/cli/analyze-config.js

@@ -63,6 +63,7 @@ const KEY_SPECS = {
     skipContextFiles: { target: 'skipAgentsMd', kind: 'boolean' },
     skipAiContext: { target: 'skipAgentsMd', kind: 'boolean' },
     skipSkills: { target: 'skipSkills', kind: 'boolean' },
+    pdg: { target: 'pdg', kind: 'boolean' },
     indexOnly: { target: 'indexOnly', kind: 'boolean' },
     stats: { target: 'stats', kind: 'boolean' },
     noStats: { target: 'stats', kind: 'boolean-negate' },
@@ -78,6 +79,22 @@ const KEY_SPECS = {
     embeddingBatchSize: { target: 'embeddingBatchSize', kind: 'numeric-string' },
     embeddingSubBatchSize: { target: 'embeddingSubBatchSize', kind: 'numeric-string' },
     embeddingDevice: { target: 'embeddingDevice', kind: 'string' },
+    // #1589/#1852 residual — extra fetch-wrapper function names to treat as HTTP
+    // consumers. The auto-detector only flags functions that call the bare global
+    // `fetch()`; a wrapper built on axios / a custom client, or named outside the
+    // built-in convention set, is otherwise invisible to route_map consumers.
+    // Listing it here adds it to the cross-file consumer scan.
+    fetchWrappers: { target: 'fetchWrappers', kind: 'string-array' },
+    // Auth token AND dims are intentionally CLI/env-only — no embeddingAuthToken
+    // or embeddingDims key here:
+    //   - the token keeps secrets out of a committed .gitnexusrc;
+    //   - dims cannot take effect from .gitnexusrc anyway — schema.ts reads
+    //     GITNEXUS_EMBEDDING_DIMS at module-load (before .gitnexusrc is loaded in
+    //     analyzeCommandImpl), so a config value would size nothing and silently
+    //     mismatch the vector column. Use --embedding-dims or GITNEXUS_EMBEDDING_DIMS.
+    // (URL/MODEL are safe as config keys: they are read lazily at runtime, not at module-load.)
+    embeddingBaseUrl: { target: 'embeddingBaseUrl', kind: 'string' },
+    embeddingModel: { target: 'embeddingModel', kind: 'string' },
 };
 /** Top-level container key for the nested form; not itself an `AnalyzeOptions` field. */
 const NESTED_KEY = 'analyze';
@@ -195,6 +212,39 @@ const normalizeValue = (kind, value, key) => {
             }
             return trimmed;
         }
+        case 'string-array': {
+            // Generic shared validator — `source` already names the config key, so
+            // messages here stay key-agnostic (no fetch-wrapper coupling in the
+            // shared normalizer; #1589/#1852 review F7).
+            if (!Array.isArray(value)) {
+                throw new GitNexusRcError(`${source} must be an array of strings.`);
+            }
+            const names = [];
+            for (const item of value) {
+                if (typeof item !== 'string') {
+                    throw new GitNexusRcError(`${source} entries must all be strings.`);
+                }
+                const trimmed = item.trim();
+                if (!trimmed) {
+                    throw new GitNexusRcError(`${source} entries must not be empty.`);
+                }
+                assertNoHiddenChars(trimmed, source);
+                // Values may be interpolated into a RegExp downstream. Restrict to
+                // identifier / member-access shapes so a config value can never smuggle
+                // regex metacharacters into a consumer.
+                if (!/^[A-Za-z_$][A-Za-z0-9_$.]*$/.test(trimmed)) {
+                    throw new GitNexusRcError(`${source} entry "${trimmed}" must be an identifier or member name ` +
+                        `(letters, digits, _, $, . — e.g. "client.get").`);
+                }
+                names.push(trimmed);
+            }
+            if (names.length === 0) {
+                throw new GitNexusRcError(`${source} must list at least one string.`);
+            }
+            // De-duplicate and cap to a sane bound so a pathological config cannot
+            // blow up the consumer scan's alternation.
+            return Array.from(new Set(names)).slice(0, 100);
+        }
         case 'numeric-string': {
             // Mirror Commander's contract: these options reach the existing CLI
             // validation as strings. Accept a JSON number or a string; normalize to a

package/dist/cli/analyze.d.ts

@@ -37,6 +37,12 @@ export interface AnalyzeOptions {
     verbose?: boolean;
     /** Skip AGENTS.md and CLAUDE.md gitnexus block updates. */
     skipAgentsMd?: boolean;
+    /**
+     * Build the control-flow-graph / PDG substrate (#2081 M1). Opt-in; off by
+     * default. Threaded to both the worker (CFG build) and scope-resolution
+     * (BasicBlock/CFG emit).
+     */
+    pdg?: boolean;
     /**
      * Stats inclusion in AGENTS.md and CLAUDE.md.
      *
@@ -58,6 +64,14 @@ export interface AnalyzeOptions {
      * before being threaded into the generated AGENTS.md / CLAUDE.md content.
      */
     defaultBranch?: string;
+    /**
+     * Index-branch selector (#2106). From `--branch`. Distinct from
+     * `defaultBranch` (cosmetic base_ref): this routes the index to a per-branch
+     * slot. NOT sourced from `.gitnexusrc` — the `.gitnexusrc` `branch` key is an
+     * alias for `defaultBranch` and must not change index placement. Defaults to
+     * the checked-out branch inside `runFullAnalysis` when omitted.
+     */
+    branch?: string;
     /** Pure index mode: skip all file injection (AGENTS.md, CLAUDE.md, skills). */
     indexOnly?: boolean;
     /** Index the folder even when no .git directory is present. */
@@ -93,6 +107,22 @@ export interface AnalyzeOptions {
     embeddingBatchSize?: string;
     embeddingSubBatchSize?: string;
     embeddingDevice?: string;
+    /**
+     * Extra fetch-wrapper function names to treat as HTTP consumers (#1589/#1852
+     * residual). Supplied via `.gitnexusrc` `fetchWrappers: [...]`. Threaded into
+     * the routes phase, where the cross-file consumer scan unions them with the
+     * auto-detected `fetch()` wrappers so a custom/axios-based wrapper named
+     * outside the built-in convention still produces `route_map` consumers.
+     */
+    fetchWrappers?: string[];
+    /** OpenAI-compatible embeddings base URL (incl. /v1). Overrides GITNEXUS_EMBEDDING_URL. */
+    embeddingBaseUrl?: string;
+    /** Embedding model name. Overrides GITNEXUS_EMBEDDING_MODEL. */
+    embeddingModel?: string;
+    /** Bearer token for the embeddings endpoint. Overrides GITNEXUS_EMBEDDING_API_KEY. Never logged. */
+    embeddingAuthToken?: string;
+    /** Embedding vector dimensions (positive integer string). Overrides GITNEXUS_EMBEDDING_DIMS. */
+    embeddingDims?: string;
 }
 /**
  * Whether the post-index skill step should run.

package/dist/cli/analyze.js

@@ -23,8 +23,10 @@ import { warnMissingOptionalGrammars, getOptionalGrammarExtensions } from './opt
 import { glob } from 'glob';
 import fs from 'fs/promises';
 import { cliError } from './cli-message.js';
+import { EMBEDDING_DIMS_ERROR, normalizeEmbeddingDims } from './embedding-dims.js';
 import { formatElapsed } from './format-elapsed.js';
 import { isHfDownloadFailure } from '../core/embeddings/hf-env.js';
+import { safeUrl } from '../core/embeddings/http-client.js';
 import { isLocalEmbeddingRuntimeBlockerMessage } from '../core/embeddings/runtime-support.js';
 import { warnIfNpm11NpxRisk } from './resolve-invocation.js';
 // Capture stderr.write at module load BEFORE anything (LadybugDB native
@@ -446,6 +448,10 @@ const ANALYZE_CLI_ENV_KEYS = [
     'GITNEXUS_EMBEDDING_SUB_BATCH_SIZE',
     'GITNEXUS_EMBEDDING_DEVICE',
     'GITNEXUS_ANALYZE_PROGRESS_ACTIVE',
+    'GITNEXUS_EMBEDDING_URL',
+    'GITNEXUS_EMBEDDING_MODEL',
+    'GITNEXUS_EMBEDDING_API_KEY',
+    'GITNEXUS_EMBEDDING_DIMS',
 ];
 const snapshotAnalyzeEnv = () => {
     const snap = {};
@@ -551,6 +557,21 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
             return;
         }
     }
+    // Validate the index-branch selector (#2106) the same way, so a malformed
+    // `--branch` exits before any expensive analysis starts. Capture the TRIMMED
+    // return so a whitespace-padded value (e.g. " feature" from shell completion)
+    // normalizes before the checked-out-branch mismatch guard and slug — otherwise
+    // it would false-reject on-branch or create a ghost index when detached.
+    if (cliOptions?.branch !== undefined) {
+        try {
+            cliOptions.branch = validateBranchName(cliOptions.branch, '--branch');
+        }
+        catch (err) {
+            cliError(`  ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exitCode = 1;
+            return;
+        }
+    }
     // ── Load .gitnexusrc and merge: CLI flags override config (#243) ───
     // Parse/validate before the progress bar so a malformed config produces an
     // actionable error and exits before any expensive analysis starts.
@@ -675,6 +696,95 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
         }
         process.env.GITNEXUS_EMBEDDING_DEVICE = options.embeddingDevice;
     }
+    // --- Custom HTTP embedding endpoint flags (override GITNEXUS_EMBEDDING_* env vars) ---
+    const anyHttpEmbedFlag = options.embeddingBaseUrl !== undefined ||
+        options.embeddingModel !== undefined ||
+        options.embeddingAuthToken !== undefined ||
+        options.embeddingDims !== undefined;
+    if (options.embeddingBaseUrl !== undefined) {
+        const url = options.embeddingBaseUrl.trim();
+        if (url.length === 0) {
+            cliError('  --embedding-base-url must not be empty.\n');
+            process.exitCode = 1;
+            return;
+        }
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            cliError(`  --embedding-base-url is not a valid URL: "${url}".\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            cliError('  --embedding-base-url must use http:// or https://.\n');
+            process.exitCode = 1;
+            return;
+        }
+        // http-client strips trailing slashes; store as given (trimmed).
+        process.env.GITNEXUS_EMBEDDING_URL = url;
+    }
+    if (options.embeddingModel !== undefined) {
+        const model = options.embeddingModel.trim();
+        if (model.length === 0) {
+            cliError('  --embedding-model must not be empty.\n');
+            process.exitCode = 1;
+            return;
+        }
+        process.env.GITNEXUS_EMBEDDING_MODEL = model;
+    }
+    if (options.embeddingAuthToken !== undefined) {
+        const token = options.embeddingAuthToken.trim();
+        if (token.length === 0) {
+            cliError('  --embedding-auth-token must not be empty.\n');
+            process.exitCode = 1;
+            return;
+        }
+        // Never log the token value.
+        process.env.GITNEXUS_EMBEDDING_API_KEY = token;
+    }
+    // Validate + normalize dims through the same shared helper the preAction
+    // hook uses, so the CLI path, this direct/programmatic-call path, schema.ts
+    // (parseInt) and http-client (/^\d+$/) all agree on one canonical value.
+    if (options.embeddingDims !== undefined) {
+        const dims = normalizeEmbeddingDims(options.embeddingDims);
+        if (dims === null) {
+            cliError(`  ${EMBEDDING_DIMS_ERROR}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        process.env.GITNEXUS_EMBEDDING_DIMS = dims;
+    }
+    // Custom-endpoint UX, emitting at most ONE message that reflects THIS run's
+    // intent (not ambient env). Order matters — the first matching branch wins:
+    //   1. flags given but --embeddings absent: the endpoint won't be used, so
+    //      say only that (no contradictory "Using…" line).
+    //   2. embeddings enabled + a complete endpoint (flags or env): confirm it,
+    //      masking the URL via safeUrl() since a base URL may carry credentials
+    //      in userinfo (http://user:pass@host) or a query token (?api_key=…)
+    //      that must not land in stdout/CI logs. The auth token is never printed.
+    //   3. embeddings enabled but only one of URL/MODEL supplied via flags:
+    //      http-client.isHttpMode() needs BOTH, so warn about the fallback.
+    // Gating on embeddingsEnabled also stops the old behaviour of printing
+    // "Using custom embedding endpoint" on every analyze run whenever the env
+    // vars happened to be set.
+    if (anyHttpEmbedFlag && !embeddingsEnabled) {
+        console.log('  Note: --embedding-* flags only apply when --embeddings is also passed; ' +
+            'no embeddings will be generated this run.\n');
+    }
+    else if (embeddingsEnabled &&
+        process.env.GITNEXUS_EMBEDDING_URL &&
+        process.env.GITNEXUS_EMBEDDING_MODEL) {
+        console.log(`  Using custom embedding endpoint: ${safeUrl(process.env.GITNEXUS_EMBEDDING_URL)} ` +
+            `(model: ${process.env.GITNEXUS_EMBEDDING_MODEL})\n`);
+    }
+    else if (embeddingsEnabled &&
+        anyHttpEmbedFlag &&
+        (process.env.GITNEXUS_EMBEDDING_URL || process.env.GITNEXUS_EMBEDDING_MODEL)) {
+        console.log('  Note: custom HTTP embeddings require BOTH --embedding-base-url and --embedding-model ' +
+            '(or the matching env vars). Falling back to local ONNX embeddings.\n');
+    }
     if (options.repairFts && options.force) {
         cliError('  Cannot combine `--repair-fts` with `--force`. ' +
             'Use `--repair-fts` for fast FTS-only repair, or `--force` for a full rebuild.\n');
@@ -826,9 +936,15 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
             skipGit: options.skipGit,
             skipAgentsMd,
             skipSkills,
+            // CFG/PDG substrate opt-in (#2081 M1) — threaded to both sinks downstream.
+            pdg: options.pdg === true,
             // Resolved default branch (CLI > .gitnexusrc > auto-detect > "main")
             // threaded into the generated regression-compare example (#243).
             defaultBranch: resolvedDefaultBranch,
+            // Index-branch selector (#2106). Read straight from the CLI flag (not
+            // the .gitnexusrc-merged options) so the cosmetic defaultBranch config
+            // can never change index placement. Undefined → auto-detect in pipeline.
+            branch: cliOptions?.branch,
             // commander.js `.option('--no-stats', …)` registers the flag as
             // `options.stats` (boolean, default true; `false` when the user
             // passed --no-stats). Reading `options.noStats` here returns
@@ -845,6 +961,9 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
             // GITNEXUS_WORKER_POOL_SIZE env mutation. `undefined` defers to the
             // env / auto-formula fallback inside the pipeline.
             workerPoolSize,
+            // Extra fetch-wrapper names from `.gitnexusrc` (#1589/#1852 residual);
+            // forwarded to the routes phase consumer scan.
+            fetchWrappers: options.fetchWrappers,
         }, {
             onProgress: (_phase, percent, message) => {
                 updateBar(percent, message);
@@ -863,13 +982,19 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
             // preserving the rest of the block (incl. --skills community rows). No-op
             // when the value already matches, so a routine up-to-date run is silent
             // (#1996 tri-review P2).
+            // Only refresh the repo-root AGENTS.md/CLAUDE.md base_ref for the
+            // PRIMARY/flat index (#2106 R2). A non-primary branch's up-to-date
+            // analyze must not churn the committed AGENTS.md — this mirrors the
+            // in-pipeline `if (!placement.branch)` gate around generateAIContextFiles.
             let baseRefRefreshed = [];
-            try {
-                const { refreshBaseRefLine } = await import('./ai-context.js');
-                baseRefRefreshed = (await refreshBaseRefLine(repoPath, resolvedDefaultBranch, { skipAgentsMd })).files;
-            }
-            catch {
-                /* best-effort — never fail the fast path over a context refresh */
+            if (result.isPrimaryBranch !== false) {
+                try {
+                    const { refreshBaseRefLine } = await import('./ai-context.js');
+                    baseRefRefreshed = (await refreshBaseRefLine(repoPath, resolvedDefaultBranch, { skipAgentsMd })).files;
+                }
+                catch {
+                    /* best-effort — never fail the fast path over a context refresh */
+                }
             }
             clearInterval(elapsedTimer);
             process.removeListener('SIGINT', sigintHandler);
@@ -948,6 +1073,7 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
                         // Mirror runFullAnalysis `noStats` bridge (#1477) — same expression;
                         // exercised on the `--skills` path by analyze-no-stats-bridge.test.ts.
                         noStats: options.stats === false,
+                        hasPdg: options.pdg === true,
                     });
                 }
             }

package/dist/cli/clean.d.ts

@@ -8,4 +8,5 @@ export declare const cleanCommand: (options?: {
     force?: boolean;
     all?: boolean;
     lbugSidecars?: boolean;
+    branch?: string;
 }) => Promise<void>;