gitnexus 1.6.8-rc.9 → 1.6.8

package/README.md

@@ -34,7 +34,7 @@ That's it. This indexes the codebase, installs agent skills, registers Claude Co
 
 To configure MCP for your editor, run `npx gitnexus setup` once — or set it up manually below.
 
-`gitnexus setup` auto-detects your editors and writes the correct global MCP config. You only need to run it once.
+`gitnexus setup` auto-detects your editors and writes the correct global MCP config. You only need to run it once. To configure only selected integrations, pass `--coding-agent`/`-c` with a comma-separated list or repeat the option, for example `gitnexus setup -c cursor,codex`.
 
 ### Editor Support
 
@@ -134,7 +134,7 @@ Your AI agent gets these tools automatically:
 | `rename`         | Multi-file coordinated rename with graph + text search           | Optional     |
 | `cypher`         | Raw Cypher graph queries                                         | Optional     |
 
-> With one indexed repo, the `repo` param is optional. With multiple, specify which: `query({query: "auth", repo: "my-app"})`.
+> With one indexed repo, the `repo` param is optional. With multiple, specify which: `query({search_query: "auth", repo: "my-app"})`.
 
 ## MCP Resources
 
@@ -158,7 +158,7 @@ Your AI agent gets these tools automatically:
 ## CLI Commands
 
 ```bash
-gitnexus setup                   # Configure MCP for your editors (one-time)
+gitnexus setup                   # Configure MCP for detected editors (one-time; use -c to select)
 gitnexus uninstall               # Preview removal of GitNexus MCP/skills/hooks (add --force to apply)
 gitnexus analyze [path]          # Index a repository (or update stale index)
 gitnexus analyze --repair-fts    # Fast path: rebuild/verify only FTS indexes on existing index data

package/dist/_shared/graph/types.d.ts

@@ -46,6 +46,9 @@ export type NodeProperties = {
     errorKeys?: string[];
     middleware?: string[];
     text?: string;
+    /** BasicBlock: space-joined leaf callee names invoked in the block — the
+     *  statement-precise inter-procedural reach substrate for impact mode. */
+    callees?: string;
     [key: string]: unknown;
 };
 export type RelationshipType = 'CONTAINS' | 'CALLS' | 'INHERITS' | 'METHOD_OVERRIDES' | 'METHOD_IMPLEMENTS' | 'IMPORTS' | 'USES' | 'DEFINES' | 'DECORATES' | 'IMPLEMENTS' | 'EXTENDS' | 'HAS_METHOD' | 'HAS_PROPERTY' | 'ACCESSES' | 'MEMBER_OF' | 'STEP_IN_PROCESS' | 'HANDLES_ROUTE' | 'FETCHES' | 'HANDLES_TOOL' | 'ENTRY_POINT_OF' | 'WRAPS' | 'QUERIES'
@@ -79,7 +82,34 @@ export type RelationshipType = 'CONTAINS' | 'CALLS' | 'INHERITS' | 'METHOD_OVERR
  | 'SANITIZES'
 /** Materialized source→sink taint path. Working name — final name/representation
  *  is confirmed when M3/M4 emits it; no persisted edge exists before then. */
- | 'TAINT_PATH';
+ | 'TAINT_PATH'
+/** Control-dependence edge (PDG, issue #2085 M5): block `dependent` (target)
+ *  executes only because the branch at block `controller` (source) took a
+ *  given side. The branch sense (`'T'` | `'F'`) rides the relation's existing
+ *  `reason` column — mirroring how `CFG` stores its edge kind there — since
+ *  the single `CodeRelation` table has no dedicated label column. */
+ | 'CDG'
+/** Debug-only post-dominator-tree edge (#2085 M5): a block → its immediate
+ *  post-dominator, emitted behind the `GITNEXUS_PDG_EMIT_POST_DOMINATE` env
+ *  flag for inspection. Never emitted in a normal `--pdg` run. Note: as a
+ *  member of this exported union it is a forward-compatibility commitment —
+ *  removing it later is a breaking schema change — and it is deliberately
+ *  excluded from `VALID_RELATION_TYPES` so it never enters impact-style
+ *  symbol-space traversal (same posture as the taint substrate edges). */
+ | 'POST_DOMINATE'
+/** Per-callee dependence SUMMARY edge (PDG FU-C): a self-loop on a
+ *  Function/Method/Constructor node carrying that callee's RETURN-VALUE
+ *  ASCENT — which formal-parameter indices flow to the function's return
+ *  value, encoded as a versioned bitset in the relation's existing `reason`
+ *  column (the same single-channel pattern `CFG`/`REACHING_DEF`/`CDG` use,
+ *  since the lone `CodeRelation` table has no dedicated label column). A
+ *  later consumer phase lets an interprocedural slice ascend a callee's
+ *  return effect into the caller continuation. Like the taint substrate
+ *  edges it is an internal PDG-engine edge: deliberately EXCLUDED from
+ *  `VALID_RELATION_TYPES` and the web schema so it never leaks into
+ *  callgraph-style impact/relationship surfaces. Emitted only under `--pdg`;
+ *  a default analyze emits zero. */
+ | 'CALL_SUMMARY';
 export interface GraphNode {
     id: string;
     label: NodeLabel;

package/dist/_shared/graph/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graph/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,GACX,MAAM,GACN,WAAW,GACX,QAAQ,GACR,MAAM,GACN,aAAa,GACb,WAAW,GACX,SAAS,GAET,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,WAAW,GACX,OAAO,GACP,MAAM,GACN,WAAW,GACX,OAAO,GACP,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,MAAM,GAGN,YAAY,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEjC,WAAW,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,GACT,MAAM,GACN,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,OAAO,GACP,SAAS;AACX;;;;;;qEAMqE;GACnE,qBAAqB;AACvB;;;;;;gEAMgE;GAC9D,aAAa;AAOf,6EAA6E;GAC3E,KAAK;AACP;;;;qCAIqC;GACnC,cAAc;AAChB,qDAAqD;GACnD,SAAS;AACX,6CAA6C;GAC3C,WAAW;AACb;8EAC8E;GAC5E,YAAY,CAAC;AAEjB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graph/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,GACX,MAAM,GACN,WAAW,GACX,QAAQ,GACR,MAAM,GACN,aAAa,GACb,WAAW,GACX,SAAS,GAET,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,WAAW,GACX,OAAO,GACP,MAAM,GACN,WAAW,GACX,OAAO,GACP,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,MAAM,GAGN,YAAY,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEjC,WAAW,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;8EAC0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,GACT,MAAM,GACN,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,OAAO,GACP,SAAS;AACX;;;;;;qEAMqE;GACnE,qBAAqB;AACvB;;;;;;gEAMgE;GAC9D,aAAa;AAOf,6EAA6E;GAC3E,KAAK;AACP;;;;qCAIqC;GACnC,cAAc;AAChB,qDAAqD;GACnD,SAAS;AACX,6CAA6C;GAC3C,WAAW;AACb;8EAC8E;GAC5E,YAAY;AACd;;;;qEAIqE;GACnE,KAAK;AACP;;;;;;0EAM0E;GACxE,eAAe;AACjB;;;;;;;;;;;oCAWoC;GAClC,cAAc,CAAC;AAEnB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL"}

package/dist/_shared/language-detection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"language-detection.d.ts","sourceRoot":"","sources":["../src/language-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AA+CpD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,OACQ,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,kBAAkB,GAAG,IAkB/E,CAAC;AAwDF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,UAAU,MAAM,KAAG,MAUhE,CAAC"}
+{"version":3,"file":"language-detection.d.ts","sourceRoot":"","sources":["../src/language-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAyDpD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,OACQ,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,kBAAkB,GAAG,IAkB/E,CAAC;AAwDF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,UAAU,MAAM,KAAG,MAUhE,CAAC"}

package/dist/_shared/language-detection.js

@@ -29,7 +29,17 @@ const EXTENSION_MAP = {
     [SupportedLanguages.Python]: ['.py'],
     [SupportedLanguages.Java]: ['.java'],
     [SupportedLanguages.C]: ['.c'],
-    [SupportedLanguages.CPlusPlus]: ['.cpp', '.cc', '.cxx', '.h', '.hpp', '.hxx', '.hh'],
+    [SupportedLanguages.CPlusPlus]: [
+        '.cpp',
+        '.cc',
+        '.cxx',
+        '.h',
+        '.hpp',
+        '.hxx',
+        '.hh',
+        '.cu',
+        '.cuh',
+    ],
     [SupportedLanguages.CSharp]: ['.cs'],
     [SupportedLanguages.Go]: ['.go'],
     [SupportedLanguages.Ruby]: ['.rb', '.rake', '.gemspec'],

package/dist/_shared/language-detection.js.map

@@ -1 +1 @@
-{"version":3,"file":"language-detection.js","sourceRoot":"","sources":["../src/language-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,6DAA6D;AAC7D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,UAAU;IACV,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;CACX,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,aAAa,GAAkD;IACnE,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAChE,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAChE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC;IACpC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;IACpC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;IAC9B,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IACpF,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC;IACpC,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAChC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;IACvD,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;IAClC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;IAChF,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;IAC5C,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC;IACtC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;IACpC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;IAClC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;CACP,CAAC,CAAC,wBAAwB;AAEnF,kFAAkF;AAClF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;AACxD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAGpD,EAAE,CAAC;IACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAgB,EAAW,EAAE,CACnE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAgB,EAA6B,EAAE;IACrF,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,qCAAqC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IAED,qDAAqD;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACvD,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,kBAAkB,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,GAAuC;IACrD,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,YAAY;IAC7C,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,YAAY;IAC7C,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,GAAG;IAC3B,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,KAAK;IACrC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,IAAI;IAC7B,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO;IACnC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,YAAY;IACtC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO;CACS,CAAC,CAAC,wBAAwB;AAExE,qEAAqE;AACrE,MAAM,oBAAoB,GAA2B;IACnD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,EAAE,EAAE,UAAU;IACd,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,oEAAoE;AACpE,MAAM,sBAAsB,GAA2B;IACrD,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,QAAgB,EAAU,EAAE;IACxE,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvD,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IACrD,IAAI,GAAG,IAAI,GAAG,IAAI,oBAAoB;QAAE,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,QAAQ,IAAI,sBAAsB;QAAE,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"language-detection.js","sourceRoot":"","sources":["../src/language-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,6DAA6D;AAC7D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,UAAU;IACV,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;CACX,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,aAAa,GAAkD;IACnE,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAChE,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAChE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC;IACpC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;IACpC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;IAC9B,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC9B,MAAM;QACN,KAAK;QACL,MAAM;QACN,IAAI;QACJ,MAAM;QACN,MAAM;QACN,KAAK;QACL,KAAK;QACL,MAAM;KACP;IACD,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC;IACpC,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAChC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;IACvD,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;IAClC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;IAChF,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;IAC5C,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC;IACtC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;IACpC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;IAClC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;CACP,CAAC,CAAC,wBAAwB;AAEnF,kFAAkF;AAClF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;AACxD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAGpD,EAAE,CAAC;IACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAgB,EAAW,EAAE,CACnE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAgB,EAA6B,EAAE;IACrF,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,qCAAqC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IAED,qDAAqD;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACvD,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,kBAAkB,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,GAAuC;IACrD,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,YAAY;IAC7C,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,YAAY;IAC7C,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,GAAG;IAC3B,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,KAAK;IACrC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,IAAI;IAC7B,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK;IAC/B,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ;IACrC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO;IACnC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM;IACjC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,YAAY;IACtC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO;CACS,CAAC,CAAC,wBAAwB;AAExE,qEAAqE;AACrE,MAAM,oBAAoB,GAA2B;IACnD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,EAAE,EAAE,UAAU;IACd,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,oEAAoE;AACpE,MAAM,sBAAsB,GAA2B;IACrD,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,QAAgB,EAAU,EAAE;IACxE,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvD,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IACrD,IAAI,GAAG,IAAI,GAAG,IAAI,oBAAoB;QAAE,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,QAAQ,IAAI,sBAAsB;QAAE,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/_shared/lbug/schema-constants.d.ts

@@ -10,7 +10,7 @@
 export declare const NODE_TABLES: readonly ["File", "Folder", "Function", "Class", "Interface", "Method", "CodeElement", "Community", "Process", "Section", "Struct", "Enum", "Macro", "Typedef", "Union", "Namespace", "Trait", "Impl", "TypeAlias", "Const", "Static", "Variable", "Property", "Record", "Delegate", "Annotation", "Constructor", "Template", "Module", "Route", "Tool", "BasicBlock"];
 export type NodeTableName = (typeof NODE_TABLES)[number];
 export declare const REL_TABLE_NAME = "CodeRelation";
-export declare const REL_TYPES: readonly ["CONTAINS", "DEFINES", "IMPORTS", "CALLS", "EXTENDS", "IMPLEMENTS", "HAS_METHOD", "HAS_PROPERTY", "ACCESSES", "METHOD_OVERRIDES", "OVERRIDES", "METHOD_IMPLEMENTS", "MEMBER_OF", "STEP_IN_PROCESS", "HANDLES_ROUTE", "FETCHES", "HANDLES_TOOL", "ENTRY_POINT_OF", "WRAPS", "QUERIES", "CFG", "REACHING_DEF", "TAINTED", "SANITIZES", "TAINT_PATH"];
+export declare const REL_TYPES: readonly ["CONTAINS", "DEFINES", "IMPORTS", "CALLS", "EXTENDS", "IMPLEMENTS", "HAS_METHOD", "HAS_PROPERTY", "ACCESSES", "METHOD_OVERRIDES", "OVERRIDES", "METHOD_IMPLEMENTS", "MEMBER_OF", "STEP_IN_PROCESS", "HANDLES_ROUTE", "FETCHES", "HANDLES_TOOL", "ENTRY_POINT_OF", "WRAPS", "QUERIES", "CFG", "REACHING_DEF", "TAINTED", "SANITIZES", "TAINT_PATH", "CDG", "POST_DOMINATE"];
 export type RelType = (typeof REL_TYPES)[number];
 export declare const EMBEDDING_TABLE_NAME = "CodeEmbedding";
 //# sourceMappingURL=schema-constants.d.ts.map

package/dist/_shared/lbug/schema-constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-constants.d.ts","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,WAAW,wWAkCd,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C,eAAO,MAAM,SAAS,8VA6BZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,eAAO,MAAM,oBAAoB,kBAAkB,CAAC"}
+{"version":3,"file":"schema-constants.d.ts","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,WAAW,wWAkCd,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C,eAAO,MAAM,SAAS,sXAmCZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,eAAO,MAAM,oBAAoB,kBAAkB,CAAC"}

package/dist/_shared/lbug/schema-constants.js

@@ -72,6 +72,12 @@ export const REL_TYPES = [
     'TAINTED',
     'SANITIZES',
     'TAINT_PATH',
+    // Control dependence (PDG, issue #2085 M5) — CDG carries its 'T'|'F' branch
+    // label in the relation's `reason` column; POST_DOMINATE is debug-only
+    // (behind GITNEXUS_PDG_EMIT_POST_DOMINATE). Both are BasicBlock→BasicBlock,
+    // reusing the existing FROM BasicBlock TO BasicBlock pair in RELATION_SCHEMA.
+    'CDG',
+    'POST_DOMINATE',
 ];
 export const EMBEDDING_TABLE_NAME = 'CodeEmbedding';
 //# sourceMappingURL=schema-constants.js.map

package/dist/_shared/lbug/schema-constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-constants.js","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM;IACN,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;IACR,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,WAAW;IACX,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,2EAA2E;IAC3E,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU;IACV,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,WAAW,EAAE,mEAAmE;IAChF,mBAAmB;IACnB,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,KAAK;IACL,cAAc;IACd,SAAS;IACT,WAAW;IACX,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"schema-constants.js","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM;IACN,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;IACR,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,WAAW;IACX,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,2EAA2E;IAC3E,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU;IACV,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,WAAW,EAAE,mEAAmE;IAChF,mBAAmB;IACnB,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,KAAK;IACL,cAAc;IACd,SAAS;IACT,WAAW;IACX,YAAY;IACZ,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,KAAK;IACL,eAAe;CACP,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC"}

package/dist/_shared/scope-resolution/parsed-file.d.ts

@@ -96,5 +96,26 @@ export interface ParsedFile {
      * side effects — the contract default) leave this undefined.
      */
     readonly captureSideChannel?: unknown;
+    /**
+     * Per-function control-flow graphs for this file (#2081 M1, PDG/taint
+     * substrate). A DISTINCT field from {@link captureSideChannel} — different
+     * producer, consumer, and lifecycle: the worker builds it from the
+     * tree-sitter AST via `LanguageProvider.cfgVisitor` (only on a `--pdg` run),
+     * and scope-resolution emits BasicBlock nodes + CFG edges from it while the
+     * disk-backed ParsedFile store is still live (it is NOT a capture-time
+     * marker the resolver restores into module maps). Kept separate so a future
+     * change to either channel's shape invalidates independently.
+     *
+     * Shared / ingestion code treats this as opaque (`unknown`) per AGENTS.md.
+     * Concretely it is a `readonly FunctionCfg[]` (see
+     * `core/ingestion/cfg/types.ts`) — plain JSON-serializable data (no AST
+     * refs, no class instances) so it round-trips through the parse cache and
+     * the `parsedfile-store` (whose interning reviver keys on `nodeId`, which
+     * these blocks/edges deliberately lack).
+     *
+     * Optional: `undefined` on non-`--pdg` runs and for languages with no
+     * `cfgVisitor` — the default for every run today.
+     */
+    readonly cfgSideChannel?: unknown;
 }
 //# sourceMappingURL=parsed-file.d.ts.map

package/dist/_shared/scope-resolution/parsed-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsed-file.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/parsed-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC"}
+{"version":3,"file":"parsed-file.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/parsed-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC"}

package/dist/_shared/scope-resolution/symbol-definition.d.ts

@@ -18,6 +18,8 @@ export interface ParameterTypeClass {
     indirection: 'value' | 'lvalue-ref' | 'rvalue-ref' | 'pointer' | 'unknown';
     /** Number of pointer markers when indirection is `pointer`; otherwise 0. */
     pointerDepth: number;
+    /** Normalized top-level template arguments, when a language preserves them. */
+    templateArguments?: string[];
 }
 export interface SymbolDefinition {
     nodeId: string;
@@ -54,6 +56,10 @@ export interface SymbolDefinition {
      *  Currently used by C++ overload ranking to exclude explicit constructors
      *  from implicit user-defined conversion candidates. */
     isExplicit?: boolean;
+    /** True when the callable is declared unavailable (for example C++ `= delete`).
+     *  Unavailable callables still participate in overload selection, but a
+     *  selected unavailable target must suppress edge emission. */
+    isDeleted?: boolean;
     /** Links Method/Constructor/Property to owning Class/Struct/Trait nodeId */
     ownerId?: string;
     /** #1982/#1993: bridge-held enclosing-namespace path (e.g. `NS1`, `Outer.Inner`)

package/dist/_shared/scope-resolution/symbol-definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symbol-definition.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/symbol-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACjE,4CAA4C;IAC5C,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3E,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB;;+FAE2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;iHAC6G;IAC7G,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;uFACmF;IACnF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;4FACwF;IACxF,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5C,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;yEAKqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;4DAEwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;iEAO6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}
+{"version":3,"file":"symbol-definition.d.ts","sourceRoot":"","sources":["../../src/scope-resolution/symbol-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACjE,4CAA4C;IAC5C,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3E,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB;;+FAE2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;iHAC6G;IAC7G,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;uFACmF;IACnF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;4FACwF;IACxF,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5C,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;yEAKqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;4DAEwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;mEAE+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;iEAO6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/cli/ai-context.d.ts

@@ -24,6 +24,12 @@ export interface AIContextOptions {
      * plain caller that omits it gets "main", preserving prior behavior.
      */
     defaultBranch?: string;
+    /**
+     * Whether the index was built with `--pdg` (#2086 M6). Gates the `pdg_query`
+     * line in the generated block — without the PDG layer the tool only returns a
+     * "no PDG layer" note, so advertising it on a non-`--pdg` index is noise.
+     */
+    hasPdg?: boolean;
 }
 /**
  * Strip backticks from a branch name before it is embedded in a Markdown
@@ -32,7 +38,31 @@ export interface AIContextOptions {
  * the generation sink so the embedding is provably safe regardless of caller.
  */
 export declare function markdownSafeBranch(branch: string): string;
-export declare function generateGitNexusContent(projectName: string, stats: RepoStats, generatedSkills?: GeneratedSkillInfo[], groupNames?: string[], noStats?: boolean, skipSkills?: boolean, runnerPath?: string, defaultBranch?: string): string;
+/** Options for {@link generateGitNexusContent} (collapsed from positional
+ *  params, #2188 review — six `undefined`s to reach `hasPdg` was the smell). */
+export interface GitNexusContentOptions {
+    generatedSkills?: GeneratedSkillInfo[];
+    groupNames?: string[];
+    noStats?: boolean;
+    skipSkills?: boolean;
+    /** Project-relative path to the runner `gitnexus analyze` drops next to the
+     *  index (#1945). Referenced by docs so a single CLI-neutral command resolves
+     *  the available runner (global `gitnexus` → `pnpm dlx` → `npx`) at call time. */
+    runnerPath?: string;
+    /** Default branch for the regression-compare example (#243). Configurable so
+     *  projects on `develop`/`master`/etc. don't get `base_ref: "main"` rewritten
+     *  back over their fix on every analyze. The value is embedded inside a
+     *  Markdown inline-code span: validateBranchName rejects backticks upstream,
+     *  and `markdownSafeBranch` strips any remaining backtick here as defense in
+     *  depth, so JSON.stringify's quote/escape handling is sufficient and the
+     *  branch cannot break out of the span (#1996 tri-review P1). */
+    defaultBranch?: string;
+    /** Whether the index was built with `--pdg` (#2086 M6). Gates the pdg_query
+     *  line below — false (default) omits it, so a non-pdg index doesn't advertise
+     *  a tool that only returns a "no PDG layer" note. */
+    hasPdg?: boolean;
+}
+export declare function generateGitNexusContent(projectName: string, stats: RepoStats, opts?: GitNexusContentOptions): string;
 /**
  * Generate AI context files after indexing
  */

package/dist/cli/ai-context.js

@@ -77,19 +77,8 @@ async function findGroupsContainingRegistryName(registryName) {
 export function markdownSafeBranch(branch) {
     return branch.replace(/`/g, '');
 }
-export function generateGitNexusContent(projectName, stats, generatedSkills, groupNames, noStats, skipSkills, 
-// Project-relative path to the runner `gitnexus analyze` drops next to the
-// index (#1945). Referenced by docs so a single CLI-neutral command resolves
-// the available runner (global `gitnexus` → `pnpm dlx` → `npx`) at call time.
-runnerPath = '.gitnexus/run.cjs', 
-// Default branch for the regression-compare example (#243). Configurable so
-// projects on `develop`/`master`/etc. don't get `base_ref: "main"` rewritten
-// back over their fix on every analyze. The value is embedded inside a
-// Markdown inline-code span: validateBranchName rejects backticks upstream,
-// and `markdownSafeBranch` strips any remaining backtick here as defense in
-// depth, so JSON.stringify's quote/escape handling is sufficient and the
-// branch cannot break out of the span (#1996 tri-review P1).
-defaultBranch = 'main') {
+export function generateGitNexusContent(projectName, stats, opts = {}) {
+    const { generatedSkills, groupNames, noStats, skipSkills, runnerPath = '.gitnexus/run.cjs', defaultBranch = 'main', hasPdg = false, } = opts;
     const generatedRows = generatedSkills && generatedSkills.length > 0
         ? generatedSkills
             .map((s) => `| Work in the ${s.label} area (${s.symbolCount} symbols) | \`.claude/skills/generated/${s.name}/SKILL.md\` |`)
@@ -131,11 +120,16 @@ This project is indexed by GitNexus as **${projectName}**${noStats ? '' : ` (${s
 
 ## Always Do
 
-- **MUST run impact analysis before editing any symbol.** Before modifying a function, class, or method, run \`impact({target: "symbolName", direction: "upstream"})\` and report the blast radius (direct callers, affected processes, risk level) to the user.
+- **MUST run impact analysis before editing any symbol.** Before modifying a function, class, or method, run \`impact({target: "symbolName", direction: "upstream"})\` and report the blast radius (direct callers, affected processes, risk level) to the user.${hasPdg
+        ? ` For unified PDG impact, add \`mode: "pdg"\` with optional \`line: <N>\` — it returns statement-level \`affectedStatements\` over CDG + REACHING_DEF and inter-procedural symbols in \`interproceduralByDepth\`/\`byDepth\`; no-layer/degraded PDG results are UNKNOWN-risk notes (\`--pdg\` layer).`
+        : ''}
 - **MUST run \`detect_changes()\` before committing** to verify your changes only affect expected symbols and execution flows. For regression review, compare against the default branch: \`detect_changes({scope: "compare", base_ref: ${JSON.stringify(markdownSafeBranch(defaultBranch))}})\`.
 - **MUST warn the user** if impact analysis returns HIGH or CRITICAL risk before proceeding with edits.
-- When exploring unfamiliar code, use \`query({query: "concept"})\` to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
+- When exploring unfamiliar code, use \`query({search_query: "concept"})\` to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
 - When you need full context on a specific symbol — callers, callees, which execution flows it participates in — use \`context({name: "symbolName"})\`.
+- For security review, \`explain({target: "fileOrSymbol"})\` lists taint findings (source→sink flows; needs \`analyze --pdg\`).${hasPdg
+        ? `\n- For control/data dependence, \`pdg_query({mode: "controls", target: "fileOrSymbol"})\` answers "under what condition does X run?" (CDG, incl. guard clauses) and \`pdg_query({mode: "flows", target, variable})\` traces "where does variable Y flow?" (REACHING_DEF). \`--pdg\` layer.`
+        : ''}
 
 ## Never Do
 
@@ -348,7 +342,15 @@ export async function generateAIContextFiles(repoPath, storagePath, projectName,
     catch (err) {
         logger.warn(`Could not write GitNexus runner to ${runnerPath}: ${String(err)}`);
     }
-    const content = generateGitNexusContent(projectName, stats, generatedSkills, groupNames, options?.noStats, options?.skipSkills, runnerPath, options?.defaultBranch ?? 'main');
+    const content = generateGitNexusContent(projectName, stats, {
+        generatedSkills,
+        groupNames,
+        noStats: options?.noStats,
+        skipSkills: options?.skipSkills,
+        runnerPath,
+        defaultBranch: options?.defaultBranch ?? 'main',
+        hasPdg: options?.hasPdg ?? false,
+    });
     const createdFiles = [];
     if (!options?.skipAgentsMd) {
         // Create AGENTS.md (standard for Cursor, Windsurf, OpenCode, Cline, etc.)

package/dist/cli/analyze-config.js

@@ -63,6 +63,7 @@ const KEY_SPECS = {
     skipContextFiles: { target: 'skipAgentsMd', kind: 'boolean' },
     skipAiContext: { target: 'skipAgentsMd', kind: 'boolean' },
     skipSkills: { target: 'skipSkills', kind: 'boolean' },
+    pdg: { target: 'pdg', kind: 'boolean' },
     indexOnly: { target: 'indexOnly', kind: 'boolean' },
     stats: { target: 'stats', kind: 'boolean' },
     noStats: { target: 'stats', kind: 'boolean-negate' },
@@ -84,6 +85,16 @@ const KEY_SPECS = {
     // built-in convention set, is otherwise invisible to route_map consumers.
     // Listing it here adds it to the cross-file consumer scan.
     fetchWrappers: { target: 'fetchWrappers', kind: 'string-array' },
+    // Auth token AND dims are intentionally CLI/env-only — no embeddingAuthToken
+    // or embeddingDims key here:
+    //   - the token keeps secrets out of a committed .gitnexusrc;
+    //   - dims cannot take effect from .gitnexusrc anyway — schema.ts reads
+    //     GITNEXUS_EMBEDDING_DIMS at module-load (before .gitnexusrc is loaded in
+    //     analyzeCommandImpl), so a config value would size nothing and silently
+    //     mismatch the vector column. Use --embedding-dims or GITNEXUS_EMBEDDING_DIMS.
+    // (URL/MODEL are safe as config keys: they are read lazily at runtime, not at module-load.)
+    embeddingBaseUrl: { target: 'embeddingBaseUrl', kind: 'string' },
+    embeddingModel: { target: 'embeddingModel', kind: 'string' },
 };
 /** Top-level container key for the nested form; not itself an `AnalyzeOptions` field. */
 const NESTED_KEY = 'analyze';

package/dist/cli/analyze.d.ts

@@ -37,6 +37,12 @@ export interface AnalyzeOptions {
     verbose?: boolean;
     /** Skip AGENTS.md and CLAUDE.md gitnexus block updates. */
     skipAgentsMd?: boolean;
+    /**
+     * Build the control-flow-graph / PDG substrate (#2081 M1). Opt-in; off by
+     * default. Threaded to both the worker (CFG build) and scope-resolution
+     * (BasicBlock/CFG emit).
+     */
+    pdg?: boolean;
     /**
      * Stats inclusion in AGENTS.md and CLAUDE.md.
      *
@@ -109,6 +115,14 @@ export interface AnalyzeOptions {
      * outside the built-in convention still produces `route_map` consumers.
      */
     fetchWrappers?: string[];
+    /** OpenAI-compatible embeddings base URL (incl. /v1). Overrides GITNEXUS_EMBEDDING_URL. */
+    embeddingBaseUrl?: string;
+    /** Embedding model name. Overrides GITNEXUS_EMBEDDING_MODEL. */
+    embeddingModel?: string;
+    /** Bearer token for the embeddings endpoint. Overrides GITNEXUS_EMBEDDING_API_KEY. Never logged. */
+    embeddingAuthToken?: string;
+    /** Embedding vector dimensions (positive integer string). Overrides GITNEXUS_EMBEDDING_DIMS. */
+    embeddingDims?: string;
 }
 /**
  * Whether the post-index skill step should run.

package/dist/cli/analyze.js

@@ -23,8 +23,10 @@ import { warnMissingOptionalGrammars, getOptionalGrammarExtensions } from './opt
 import { glob } from 'glob';
 import fs from 'fs/promises';
 import { cliError } from './cli-message.js';
+import { EMBEDDING_DIMS_ERROR, normalizeEmbeddingDims } from './embedding-dims.js';
 import { formatElapsed } from './format-elapsed.js';
 import { isHfDownloadFailure } from '../core/embeddings/hf-env.js';
+import { safeUrl } from '../core/embeddings/http-client.js';
 import { isLocalEmbeddingRuntimeBlockerMessage } from '../core/embeddings/runtime-support.js';
 import { warnIfNpm11NpxRisk } from './resolve-invocation.js';
 // Capture stderr.write at module load BEFORE anything (LadybugDB native
@@ -446,6 +448,10 @@ const ANALYZE_CLI_ENV_KEYS = [
     'GITNEXUS_EMBEDDING_SUB_BATCH_SIZE',
     'GITNEXUS_EMBEDDING_DEVICE',
     'GITNEXUS_ANALYZE_PROGRESS_ACTIVE',
+    'GITNEXUS_EMBEDDING_URL',
+    'GITNEXUS_EMBEDDING_MODEL',
+    'GITNEXUS_EMBEDDING_API_KEY',
+    'GITNEXUS_EMBEDDING_DIMS',
 ];
 const snapshotAnalyzeEnv = () => {
     const snap = {};
@@ -690,6 +696,95 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
         }
         process.env.GITNEXUS_EMBEDDING_DEVICE = options.embeddingDevice;
     }
+    // --- Custom HTTP embedding endpoint flags (override GITNEXUS_EMBEDDING_* env vars) ---
+    const anyHttpEmbedFlag = options.embeddingBaseUrl !== undefined ||
+        options.embeddingModel !== undefined ||
+        options.embeddingAuthToken !== undefined ||
+        options.embeddingDims !== undefined;
+    if (options.embeddingBaseUrl !== undefined) {
+        const url = options.embeddingBaseUrl.trim();
+        if (url.length === 0) {
+            cliError('  --embedding-base-url must not be empty.\n');
+            process.exitCode = 1;
+            return;
+        }
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            cliError(`  --embedding-base-url is not a valid URL: "${url}".\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            cliError('  --embedding-base-url must use http:// or https://.\n');
+            process.exitCode = 1;
+            return;
+        }
+        // http-client strips trailing slashes; store as given (trimmed).
+        process.env.GITNEXUS_EMBEDDING_URL = url;
+    }
+    if (options.embeddingModel !== undefined) {
+        const model = options.embeddingModel.trim();
+        if (model.length === 0) {
+            cliError('  --embedding-model must not be empty.\n');
+            process.exitCode = 1;
+            return;
+        }
+        process.env.GITNEXUS_EMBEDDING_MODEL = model;
+    }
+    if (options.embeddingAuthToken !== undefined) {
+        const token = options.embeddingAuthToken.trim();
+        if (token.length === 0) {
+            cliError('  --embedding-auth-token must not be empty.\n');
+            process.exitCode = 1;
+            return;
+        }
+        // Never log the token value.
+        process.env.GITNEXUS_EMBEDDING_API_KEY = token;
+    }
+    // Validate + normalize dims through the same shared helper the preAction
+    // hook uses, so the CLI path, this direct/programmatic-call path, schema.ts
+    // (parseInt) and http-client (/^\d+$/) all agree on one canonical value.
+    if (options.embeddingDims !== undefined) {
+        const dims = normalizeEmbeddingDims(options.embeddingDims);
+        if (dims === null) {
+            cliError(`  ${EMBEDDING_DIMS_ERROR}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        process.env.GITNEXUS_EMBEDDING_DIMS = dims;
+    }
+    // Custom-endpoint UX, emitting at most ONE message that reflects THIS run's
+    // intent (not ambient env). Order matters — the first matching branch wins:
+    //   1. flags given but --embeddings absent: the endpoint won't be used, so
+    //      say only that (no contradictory "Using…" line).
+    //   2. embeddings enabled + a complete endpoint (flags or env): confirm it,
+    //      masking the URL via safeUrl() since a base URL may carry credentials
+    //      in userinfo (http://user:pass@host) or a query token (?api_key=…)
+    //      that must not land in stdout/CI logs. The auth token is never printed.
+    //   3. embeddings enabled but only one of URL/MODEL supplied via flags:
+    //      http-client.isHttpMode() needs BOTH, so warn about the fallback.
+    // Gating on embeddingsEnabled also stops the old behaviour of printing
+    // "Using custom embedding endpoint" on every analyze run whenever the env
+    // vars happened to be set.
+    if (anyHttpEmbedFlag && !embeddingsEnabled) {
+        console.log('  Note: --embedding-* flags only apply when --embeddings is also passed; ' +
+            'no embeddings will be generated this run.\n');
+    }
+    else if (embeddingsEnabled &&
+        process.env.GITNEXUS_EMBEDDING_URL &&
+        process.env.GITNEXUS_EMBEDDING_MODEL) {
+        console.log(`  Using custom embedding endpoint: ${safeUrl(process.env.GITNEXUS_EMBEDDING_URL)} ` +
+            `(model: ${process.env.GITNEXUS_EMBEDDING_MODEL})\n`);
+    }
+    else if (embeddingsEnabled &&
+        anyHttpEmbedFlag &&
+        (process.env.GITNEXUS_EMBEDDING_URL || process.env.GITNEXUS_EMBEDDING_MODEL)) {
+        console.log('  Note: custom HTTP embeddings require BOTH --embedding-base-url and --embedding-model ' +
+            '(or the matching env vars). Falling back to local ONNX embeddings.\n');
+    }
     if (options.repairFts && options.force) {
         cliError('  Cannot combine `--repair-fts` with `--force`. ' +
             'Use `--repair-fts` for fast FTS-only repair, or `--force` for a full rebuild.\n');
@@ -841,6 +936,8 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
             skipGit: options.skipGit,
             skipAgentsMd,
             skipSkills,
+            // CFG/PDG substrate opt-in (#2081 M1) — threaded to both sinks downstream.
+            pdg: options.pdg === true,
             // Resolved default branch (CLI > .gitnexusrc > auto-detect > "main")
             // threaded into the generated regression-compare example (#243).
             defaultBranch: resolvedDefaultBranch,
@@ -976,6 +1073,7 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
                         // Mirror runFullAnalysis `noStats` bridge (#1477) — same expression;
                         // exercised on the `--skills` path by analyze-no-stats-bridge.test.ts.
                         noStats: options.stats === false,
+                        hasPdg: options.pdg === true,
                     });
                 }
             }

package/dist/cli/embedding-dims.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Strict positive-integer normalization for the `--embedding-dims` flag /
+ * `GITNEXUS_EMBEDDING_DIMS` value.
+ *
+ * Single source of truth shared by two write paths:
+ *   1. the `analyze` `preAction` hook (CLI path) — it must set the env var
+ *      BEFORE `schema.ts` reads `GITNEXUS_EMBEDDING_DIMS` at module-load time
+ *      (the static import chain `analyze.ts → run-analyze.ts → schema.ts`
+ *      bakes `FLOAT[dims]` into the vector-table DDL), and
+ *   2. `analyzeCommandImpl` (direct / programmatic-call path, which bypasses
+ *      the commander hook).
+ *
+ * Keep this module dependency-free. `index.ts` imports it eagerly, so pulling
+ * in anything that transitively loads `schema.ts` (e.g. `analyze.ts`) — or
+ * even `cli-message.ts`, which drags in the logger + i18n — would defeat the
+ * lazy `import('./analyze.js')` the hook exists to enable. Callers print the
+ * error themselves (the hook to stderr, the impl via `cliError`).
+ *
+ * Trim-then-validate, matching the sibling URL/MODEL/TOKEN flags: surrounding
+ * whitespace is tolerated, but the remaining value must be all digits and
+ * `> 0`. This rejects scientific notation (`1e3`), hex (`0x10`), fractions
+ * (`3.5`), signs (`+5`/`-5`), and trailing junk (`4096x`) so the three
+ * downstream readers — `schema.ts` (`parseInt`), `http-client.ts` (`/^\d+$/`),
+ * and this helper — all agree on one canonical value. Without it, `1e3` parsed
+ * to `FLOAT[1]` at module-load but requested 1000-dim vectors at runtime.
+ */
+/** Shared error message so both call sites surface identical wording. */
+export declare const EMBEDDING_DIMS_ERROR = "--embedding-dims must be a positive integer.";
+/**
+ * Returns the canonical positive-integer string (e.g. `"007"` → `"7"`), or
+ * `null` when the input is not a strict positive integer.
+ */
+export declare const normalizeEmbeddingDims: (raw: string) => string | null;

package/dist/cli/embedding-dims.js

@@ -0,0 +1,39 @@
+/**
+ * Strict positive-integer normalization for the `--embedding-dims` flag /
+ * `GITNEXUS_EMBEDDING_DIMS` value.
+ *
+ * Single source of truth shared by two write paths:
+ *   1. the `analyze` `preAction` hook (CLI path) — it must set the env var
+ *      BEFORE `schema.ts` reads `GITNEXUS_EMBEDDING_DIMS` at module-load time
+ *      (the static import chain `analyze.ts → run-analyze.ts → schema.ts`
+ *      bakes `FLOAT[dims]` into the vector-table DDL), and
+ *   2. `analyzeCommandImpl` (direct / programmatic-call path, which bypasses
+ *      the commander hook).
+ *
+ * Keep this module dependency-free. `index.ts` imports it eagerly, so pulling
+ * in anything that transitively loads `schema.ts` (e.g. `analyze.ts`) — or
+ * even `cli-message.ts`, which drags in the logger + i18n — would defeat the
+ * lazy `import('./analyze.js')` the hook exists to enable. Callers print the
+ * error themselves (the hook to stderr, the impl via `cliError`).
+ *
+ * Trim-then-validate, matching the sibling URL/MODEL/TOKEN flags: surrounding
+ * whitespace is tolerated, but the remaining value must be all digits and
+ * `> 0`. This rejects scientific notation (`1e3`), hex (`0x10`), fractions
+ * (`3.5`), signs (`+5`/`-5`), and trailing junk (`4096x`) so the three
+ * downstream readers — `schema.ts` (`parseInt`), `http-client.ts` (`/^\d+$/`),
+ * and this helper — all agree on one canonical value. Without it, `1e3` parsed
+ * to `FLOAT[1]` at module-load but requested 1000-dim vectors at runtime.
+ */
+/** Shared error message so both call sites surface identical wording. */
+export const EMBEDDING_DIMS_ERROR = '--embedding-dims must be a positive integer.';
+/**
+ * Returns the canonical positive-integer string (e.g. `"007"` → `"7"`), or
+ * `null` when the input is not a strict positive integer.
+ */
+export const normalizeEmbeddingDims = (raw) => {
+    const trimmed = raw.trim();
+    if (!/^\d+$/.test(trimmed) || parseInt(trimmed, 10) <= 0) {
+        return null;
+    }
+    return String(parseInt(trimmed, 10));
+};

package/dist/cli/eval-server.d.ts

@@ -50,5 +50,13 @@ export declare function formatListReposResult(result: {
     repositories: RepoListing[];
     pagination?: ListReposPagination;
 }): string;
+export declare function getNextStepHint(toolName: string, result?: any): string;
 export declare function evalServerCommand(options?: EvalServerOptions): Promise<void>;
+/**
+ * Tools the eval-server exposes over HTTP — the read-only query surface the
+ * banner advertises. `LocalBackend.callTool` ALSO dispatches write-side / heavier
+ * tools (rename, shape_check, tool_map, …); the allowlist keeps a stray
+ * `POST /tool/<name>` from reaching those through this Docker/eval-harness server.
+ */
+export declare const EVAL_SERVER_TOOLS: ReadonlySet<string>;
 export declare const MAX_BODY_SIZE: number;