gitnexus 1.6.8-rc.9 → 1.6.8

package/dist/core/ingestion/languages/swift.js

@@ -21,6 +21,7 @@ import { createVariableExtractor } from '../variable-extractors/generic.js';
 import { swiftVariableConfig } from '../variable-extractors/configs/swift.js';
 import { createCallExtractor } from '../call-extractors/generic.js';
 import { swiftCallConfig } from '../call-extractors/configs/swift.js';
+import { createSwiftCfgVisitor } from '../cfg/visitors/swift.js';
 import { emitSwiftScopeCaptures, interpretSwiftImport, interpretSwiftTypeBinding, swiftBindingScopeFor, swiftImportOwningScope, swiftReceiverBinding, swiftMergeBindings, swiftArityCompatibility, } from './swift/index.js';
 /** Swift init/deinit declarations have special names and Constructor label. */
 const swiftExtractFunctionName = (node) => {
@@ -226,6 +227,7 @@ export const swiftProvider = defineLanguage({
     // ── Scope-based resolution hooks (RFC #909 Ring 3, issue #937). See
     //    languages/swift/ for the implementations. ──────────────────────
     emitScopeCaptures: emitSwiftScopeCaptures,
+    cfgVisitor: createSwiftCfgVisitor(),
     interpretImport: interpretSwiftImport,
     interpretTypeBinding: interpretSwiftTypeBinding,
     bindingScopeFor: swiftBindingScopeFor,

package/dist/core/ingestion/languages/typescript.js

@@ -9,6 +9,7 @@ import { SupportedLanguages } from '../../../_shared/index.js';
 import { defineLanguage } from '../language-provider.js';
 import { createClassExtractor } from '../class-extractors/generic.js';
 import { typescriptClassConfig, javascriptClassConfig, } from '../class-extractors/configs/typescript-javascript.js';
+import { createTypeScriptCfgVisitor } from '../cfg/visitors/typescript.js';
 import { typeConfig as typescriptConfig } from '../type-extractors/typescript.js';
 import { tsExportChecker } from '../export-detection.js';
 import { createImportResolver } from '../import-resolvers/resolver-factory.js';
@@ -293,6 +294,8 @@ export const typescriptProvider = defineLanguage({
     // canonical capture vocabulary in ./typescript/query.ts
     // (TYPESCRIPT_SCOPE_QUERY constant).
     emitScopeCaptures: emitTsScopeCaptures,
+    // CFG/PDG substrate (#2081 M1) — runs in the worker on a --pdg run.
+    cfgVisitor: createTypeScriptCfgVisitor(),
     interpretImport: interpretTsImport,
     interpretTypeBinding: interpretTsTypeBinding,
     bindingScopeFor: tsBindingScopeFor,
@@ -352,6 +355,8 @@ export const javascriptProvider = defineLanguage({
     // JSDoc type bindings) live in ./javascript/captures.ts.
     // See ./javascript/index.ts for the full per-module rationale.
     emitScopeCaptures: emitJsScopeCaptures,
+    // CFG/PDG substrate (#2081 M1) — TS and JS share the same grammar family.
+    cfgVisitor: createTypeScriptCfgVisitor(),
     interpretImport: interpretJsImport,
     interpretTypeBinding: interpretJsTypeBinding,
     bindingScopeFor: jsBindingScopeFor,

package/dist/core/ingestion/languages/vue.js

@@ -27,6 +27,7 @@ import { createCallExtractor } from '../call-extractors/generic.js';
 import { typescriptCallConfig } from '../call-extractors/configs/typescript-javascript.js';
 import { interpretTsImport, interpretTsTypeBinding, tsBindingScopeFor, tsImportOwningScope, tsReceiverBinding, typescriptMergeBindings, typescriptArityCompatibility, resolveTsImportTarget, } from './typescript/index.js';
 import { emitVueScopeCaptures } from './vue/captures.js';
+import { createTypeScriptCfgVisitor } from '../cfg/visitors/typescript.js';
 const VUE_SPECIFIC_BUILT_INS = [
     'ref',
     'reactive',
@@ -74,6 +75,11 @@ export const vueProvider = defineLanguage({
     variableExtractor: createVariableExtractor(typescriptVariableConfig),
     classExtractor: vueClassExtractor,
     builtInNames: VUE_BUILT_INS,
+    // Vue SFC <script> blocks are extracted and parsed with the TypeScript
+    // grammar (parse-worker GRAMMAR_BY_LANGUAGE[Vue] = TypeScript.typescript),
+    // so the TS CFG visitor builds CFGs for the script's functions verbatim —
+    // no Vue-specific visitor needed (#2195).
+    cfgVisitor: createTypeScriptCfgVisitor(),
     // Scope-resolution pipeline hooks (RFC #909 Ring 3)
     emitScopeCaptures: emitVueScopeCaptures,
     interpretImport: interpretTsImport,

package/dist/core/ingestion/method-extractors/configs/c-cpp.js

@@ -33,18 +33,12 @@ function findFunctionDeclarator(node) {
     }
     return null;
 }
-/**
- * Detect `= delete` and `= default` special member function declarations.
- * These are not callable methods and should be suppressed from extraction.
- * tree-sitter-cpp ^0.23.4 emits `delete_method_clause` / `default_method_clause`
- * as named children of the function_definition node.
- */
-function isDeletedOrDefaulted(node) {
+/** Detect a C++ special member clause by its tree-sitter node type. */
+function hasSpecialMethodClause(node, clauseType) {
     for (let i = 0; i < node.namedChildCount; i++) {
         const child = node.namedChild(i);
-        if (child?.type === 'delete_method_clause' || child?.type === 'default_method_clause') {
+        if (child?.type === clauseType)
             return true;
-        }
     }
     return false;
 }
@@ -57,10 +51,6 @@ function extractCppMethodName(node) {
     const funcDecl = findFunctionDeclarator(node);
     if (!funcDecl)
         return undefined;
-    // Suppress `= delete` and `= default` special members — these are not callable
-    // methods and should not appear in HAS_METHOD edges.
-    if (isDeletedOrDefaulted(node))
-        return undefined;
     const nameNode = funcDecl.childForFieldName('declarator');
     if (!nameNode)
         return undefined;
@@ -360,6 +350,9 @@ export const cppMethodConfig = {
         }
         return false;
     },
+    isDeleted(node) {
+        return hasSpecialMethodClause(node, 'delete_method_clause');
+    },
 };
 // ---------------------------------------------------------------------------
 // C config (minimal — C has no classes/methods, only struct function pointers)

package/dist/core/ingestion/method-extractors/generic.js

@@ -198,6 +198,7 @@ function buildMethod(node, ownerNode, context, config) {
         ...(config.isAsync?.(node) ? { isAsync: true } : {}),
         ...(config.isPartial?.(node) ? { isPartial: true } : {}),
         ...(config.isConst?.(node) ? { isConst: true } : {}),
+        ...(config.isDeleted?.(node) ? { isDeleted: true } : {}),
         annotations: config.extractAnnotations?.(node) ?? [],
         sourceFile: context.filePath,
         line: node.startPosition.row + 1,

package/dist/core/ingestion/method-types.d.ts

@@ -27,6 +27,7 @@ export interface MethodInfo {
     isAsync?: boolean;
     isPartial?: boolean;
     isConst?: boolean;
+    isDeleted?: boolean;
     annotations: string[];
     sourceFile: string;
     line: number;
@@ -74,6 +75,7 @@ export interface MethodExtractionConfig {
     isAsync?: (node: SyntaxNode) => boolean;
     isPartial?: (node: SyntaxNode) => boolean;
     isConst?: (node: SyntaxNode) => boolean;
+    isDeleted?: (node: SyntaxNode) => boolean;
     /** Owner node types where member functions are effectively static (e.g.
      *  Ruby singleton_class, Kotlin companion_object / object_declaration).
      *  When the ownerNode matches one of these types, isStatic is forced true. */

package/dist/core/ingestion/model/symbol-table.d.ts

@@ -102,6 +102,7 @@ export interface AddMetadata {
     templateArguments?: string[];
     ownerId?: string;
     qualifiedName?: string;
+    isDeleted?: boolean;
 }
 /**
  * Pure read-only view over the file and callable indexes. Does NOT

package/dist/core/ingestion/model/symbol-table.js

@@ -136,6 +136,7 @@ export const createSymbolTable = () => {
                 ? { templateArguments: metadata.templateArguments }
                 : {}),
             ...(metadata?.ownerId !== undefined ? { ownerId: metadata.ownerId } : {}),
+            ...(metadata?.isDeleted === true ? { isDeleted: true } : {}),
         };
         // A. File Index — unconditional.
         if (!fileIndex.has(filePath)) {

package/dist/core/ingestion/mro-processor.js

@@ -74,6 +74,9 @@ function buildAdjacency(graph) {
     }
     return { parentMap, methodMap, parentEdgeType };
 }
+/** Confidence for a single-ancestor override edge (a subclass overriding one parent
+ *  method via class inheritance) — same tier as MRO-ordered resolution. */
+const SINGLE_ANCESTOR_OVERRIDE_CONFIDENCE = 0.9;
 /** Resolve by MRO order — first ancestor in linearized order wins. */
 function resolveByMroOrder(methodName, defs, mroOrder, reasonPrefix) {
     for (const ancestorId of mroOrder) {
@@ -266,6 +269,112 @@ export function computeMRO(graph) {
             ambiguities,
         });
     }
+    // ── Single-ancestor override detection ──────────────────────────────────
+    // The collision loop above only emits when a method is defined in 2+ ancestors
+    // (defs.length < 2 is skipped). A subclass overriding a single parent method via
+    // class inheritance is the common case. Applicability is derived automatically from
+    // the language's existing MRO strategy — no separate per-language flag: every
+    // strategy resolves overrides by inheritance order EXCEPT `qualified-syntax` (Rust),
+    // where a same-named method is a trait implementation (METHOD_IMPLEMENTS), not an
+    // override. The EXTENDS-only walk below reinforces this structurally.
+    const emittedOverrideEdgeIds = new Set();
+    // Follow only EXTENDS (class-inheritance) parents and skip Interface/Trait ancestors:
+    // satisfying an interface/trait default method is a METHOD_IMPLEMENTS relationship
+    // (handled by emitMethodImplementsEdges), not an override. This also structurally
+    // excludes languages without class inheritance (e.g. Rust traits use IMPLEMENTS).
+    const extendsParentsOf = (nodeId) => (parentMap.get(nodeId) ?? []).filter((pid) => {
+        if (parentEdgeType.get(nodeId)?.get(pid) !== 'EXTENDS')
+            return false;
+        const pn = graph.getNode(pid);
+        return !!pn && pn.label !== 'Interface' && pn.label !== 'Trait';
+    });
+    for (const classId of parentMap.keys()) {
+        const classNode = graph.getNode(classId);
+        const language = classNode?.properties.language;
+        if (!language)
+            continue;
+        // Language-aware gate, reusing the MRO model we already maintain (not a new flag).
+        if (getProvider(language).mroStrategy === 'qualified-syntax')
+            continue;
+        const ownMethods = methodMap.get(classId) ?? [];
+        const extendsParents = extendsParentsOf(classId);
+        if (extendsParents.length === 0 || ownMethods.length === 0)
+            continue;
+        const orderedAncestorMethods = [];
+        {
+            const visited = new Set();
+            const queue = [...extendsParents];
+            while (queue.length > 0) {
+                const ancestorId = queue.shift();
+                if (visited.has(ancestorId))
+                    continue;
+                visited.add(ancestorId);
+                const ancestorName = graph.getNode(ancestorId)?.properties.name;
+                const methodsByName = new Map();
+                for (const mid of methodMap.get(ancestorId) ?? []) {
+                    const mn = graph.getNode(mid);
+                    if (!mn || mn.label === 'Property' || typeof mn.properties.name !== 'string')
+                        continue;
+                    const entry = {
+                        methodId: mid,
+                        paramTypes: mn.properties.parameterTypes ?? [],
+                        paramCount: mn.properties.parameterCount,
+                    };
+                    const bucket = methodsByName.get(mn.properties.name);
+                    if (bucket)
+                        bucket.push(entry);
+                    else
+                        methodsByName.set(mn.properties.name, [entry]);
+                }
+                orderedAncestorMethods.push({
+                    className: typeof ancestorName === 'string' ? ancestorName : '<anonymous>',
+                    methodsByName,
+                });
+                queue.push(...extendsParentsOf(ancestorId));
+            }
+        }
+        for (const methodId of ownMethods) {
+            const methodNode = graph.getNode(methodId);
+            if (!methodNode || methodNode.label === 'Property' || !methodNode.properties.name)
+                continue;
+            const methodName = methodNode.properties.name;
+            const ownParamTypes = methodNode.properties.parameterTypes ?? [];
+            const ownParamCount = methodNode.properties.parameterCount;
+            // Nearest ancestor (BFS order) defining this method by name AND signature, so a
+            // same-named overload (e.g. foo(int) vs foo()) is not mistaken for an override.
+            for (const { className, methodsByName } of orderedAncestorMethods) {
+                const sameName = methodsByName.get(methodName);
+                if (!sameName)
+                    continue;
+                const matches = sameName.filter((m) => parameterTypesMatch(ownParamTypes, m.paramTypes, ownParamCount, m.paramCount).match);
+                if (matches.length === 0)
+                    continue; // name present but no signature match — look deeper
+                // Emit only when the match is unambiguous (exactly one candidate); >1 means the
+                // override target cannot be pinned, so emit nothing. Either way stop — a closer
+                // ancestor shadows anything deeper.
+                if (matches.length === 1) {
+                    const matchingMethodId = matches[0].methodId;
+                    // Target the ancestor METHOD node (not the class), key the id on the method
+                    // so distinct overrides stay distinct, and count only edges actually added
+                    // (addRelationship is first-writer-wins, so a duplicate id is dropped).
+                    const overrideId = generateId('METHOD_OVERRIDES', `${classId}->${matchingMethodId}`);
+                    if (!emittedOverrideEdgeIds.has(overrideId)) {
+                        emittedOverrideEdgeIds.add(overrideId);
+                        graph.addRelationship({
+                            id: overrideId,
+                            sourceId: classId,
+                            targetId: matchingMethodId,
+                            type: 'METHOD_OVERRIDES',
+                            confidence: SINGLE_ANCESTOR_OVERRIDE_CONFIDENCE,
+                            reason: `single-ancestor override: ${className}::${methodName}()`,
+                        });
+                        overrideEdges++;
+                    }
+                }
+                break; // nearest ancestor shadows deeper ones
+            }
+        }
+    }
     const methodImplementsEdges = emitMethodImplementsEdges(graph, parentMap, methodMap, parentEdgeType, ancestorsMap, edgeTypesMap);
     return { entries, overrideEdges, ambiguityCount, methodImplementsEdges };
 }

package/dist/core/ingestion/parsing-processor.js

@@ -49,6 +49,7 @@ export const mergeChunkResults = (graph, symbolTable, chunkResults, exportedType
                 templateArguments: sym.templateArguments,
                 ownerId: sym.ownerId,
                 qualifiedName: sym.qualifiedName,
+                isDeleted: sym.isDeleted,
             });
         }
         if (exportedTypeMap) {
@@ -144,6 +145,28 @@ chunkHash) => {
             .join(', ');
         logger.warn(`  Skipped unsupported languages: ${summary}`);
     }
+    // Per-language CFG skip telemetry (#2195): functions skipped during the worker
+    // CFG walk, bucketed by reason. Only surfaced for a `--pdg` run (otherwise
+    // `cfgSkipped` is empty). Warn ONLY when a robustness-relevant bucket
+    // (too-deeply-nested / build-error) is non-zero — a too-many-lines skip is the
+    // expected, benign minified/generated-code case and would otherwise be spam.
+    const cfgSkipped = new Map();
+    for (const result of chunkResults) {
+        for (const [lang, counts] of Object.entries(result.cfgSkipped ?? {})) {
+            const prev = cfgSkipped.get(lang) ?? { tooManyLines: 0, tooDeeplyNested: 0, buildError: 0 };
+            cfgSkipped.set(lang, {
+                tooManyLines: prev.tooManyLines + counts.tooManyLines,
+                tooDeeplyNested: prev.tooDeeplyNested + counts.tooDeeplyNested,
+                buildError: prev.buildError + counts.buildError,
+            });
+        }
+    }
+    for (const [lang, c] of cfgSkipped) {
+        if (c.tooDeeplyNested > 0 || c.buildError > 0) {
+            logger.warn(`  CFG functions skipped (${lang}): ${c.tooDeeplyNested} too-deeply-nested, ` +
+                `${c.buildError} build-error(s), ${c.tooManyLines} over line cap`);
+        }
+    }
     // Clone-safety telemetry (#2112): files whose parse output carried a value
     // the structured-clone algorithm couldn't serialize across the worker
     // boundary. The worker sanitized/dropped the offending value so the run

package/dist/core/ingestion/pipeline-phases/call-summaries.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Phase: callSummaries (PDG FU-C, U-C3)
+ *
+ * The whole-program CALL_SUMMARY materialisation pass — the dependence-engine
+ * SIBLING of `taintSummaries`. Runs AFTER scope-resolution (where the resolved
+ * `CALLS` graph lives in `ctx.graph` and the per-function RETURN-VALUE ASCENT
+ * summaries were harvested in-phase) and emits one `CALL_SUMMARY` self-loop edge
+ * per harvested callee. A later consumer phase (NOT this task) decodes the
+ * bitset to ascend a callee's return effect into the caller continuation.
+ *
+ * Opt-in: registered with `enabledWhen: (o) => o.pdg === true`. A default
+ * `analyze` run never includes it, so the graph is byte-identical and emits ZERO
+ * CALL_SUMMARY edges. No always-on phase depends on it.
+ *
+ * @deps    scopeResolution, pruneLocalSymbols
+ * @reads   scopeResolution output (callSummaries)
+ * @writes  graph (CALL_SUMMARY self-loop edges)
+ */
+import type { PipelinePhase } from './types.js';
+export interface CallSummariesOutput {
+    /** Per-callee summaries fed to the emit. */
+    summaries: number;
+    /** CALL_SUMMARY edges persisted. */
+    edgesEmitted: number;
+}
+export declare const callSummariesPhase: PipelinePhase<CallSummariesOutput>;

package/dist/core/ingestion/pipeline-phases/call-summaries.js

@@ -0,0 +1,46 @@
+/**
+ * Phase: callSummaries (PDG FU-C, U-C3)
+ *
+ * The whole-program CALL_SUMMARY materialisation pass — the dependence-engine
+ * SIBLING of `taintSummaries`. Runs AFTER scope-resolution (where the resolved
+ * `CALLS` graph lives in `ctx.graph` and the per-function RETURN-VALUE ASCENT
+ * summaries were harvested in-phase) and emits one `CALL_SUMMARY` self-loop edge
+ * per harvested callee. A later consumer phase (NOT this task) decodes the
+ * bitset to ascend a callee's return effect into the caller continuation.
+ *
+ * Opt-in: registered with `enabledWhen: (o) => o.pdg === true`. A default
+ * `analyze` run never includes it, so the graph is byte-identical and emits ZERO
+ * CALL_SUMMARY edges. No always-on phase depends on it.
+ *
+ * @deps    scopeResolution, pruneLocalSymbols
+ * @reads   scopeResolution output (callSummaries)
+ * @writes  graph (CALL_SUMMARY self-loop edges)
+ */
+import { getPhaseOutput } from './types.js';
+import { emitCallSummaries, DEFAULT_PDG_MAX_CALL_SUMMARY_EDGES, } from '../taint/call-summary-emit.js';
+import { logger } from '../../logger.js';
+const EMPTY = { summaries: 0, edgesEmitted: 0 };
+export const callSummariesPhase = {
+    name: 'callSummaries',
+    deps: ['scopeResolution', 'pruneLocalSymbols'],
+    async execute(ctx, deps) {
+        const scope = getPhaseOutput(deps, 'scopeResolution');
+        const summaries = scope.callSummaries;
+        if (summaries.length === 0)
+            return EMPTY;
+        const maxEdges = ctx.options?.pdgMaxCallSummaryEdges ?? DEFAULT_PDG_MAX_CALL_SUMMARY_EDGES;
+        const emit = emitCallSummaries(ctx.graph, summaries, { maxEdges }, (m) => logger.warn(m));
+        if (emit.edgesDropped > 0) {
+            logger.warn(`[call-summary] capped: ${emit.edgesDropped} CALL_SUMMARY edge(s) dropped by the ` +
+                `per-run cap (${maxEdges}) — raise pdgMaxCallSummaryEdges if intentional`);
+        }
+        if (emit.skippedMissingEndpoint > 0) {
+            logger.debug(`[call-summary] ${emit.skippedMissingEndpoint} summary/summaries skipped (callee node ` +
+                `missing from graph)`);
+        }
+        if (emit.edgesEmitted > 0) {
+            logger.debug(`[call-summary] ${summaries.length} summaries → ${emit.edgesEmitted} CALL_SUMMARY edge(s)`);
+        }
+        return { summaries: summaries.length, edgesEmitted: emit.edgesEmitted };
+    },
+};

package/dist/core/ingestion/pipeline-phases/index.d.ts

@@ -15,6 +15,8 @@ export { ormPhase, type ORMOutput } from './orm.js';
 export { crossFilePhase, type CrossFileOutput } from './cross-file.js';
 export { scopeResolutionPhase, type ScopeResolutionOutput, } from '../scope-resolution/pipeline/phase.js';
 export { pruneLocalSymbolsPhase, type PruneLocalSymbolsOutput } from './prune-local-symbols.js';
+export { taintSummariesPhase, type TaintSummariesOutput } from './taint-summaries.js';
+export { callSummariesPhase, type CallSummariesOutput } from './call-summaries.js';
 export { mroPhase, type MROOutput } from './mro.js';
 export { communitiesPhase, type CommunitiesOutput } from './communities.js';
 export { processesPhase, type ProcessesOutput } from './processes.js';

package/dist/core/ingestion/pipeline-phases/index.js

@@ -16,6 +16,8 @@ export { ormPhase } from './orm.js';
 export { crossFilePhase } from './cross-file.js';
 export { scopeResolutionPhase, } from '../scope-resolution/pipeline/phase.js';
 export { pruneLocalSymbolsPhase } from './prune-local-symbols.js';
+export { taintSummariesPhase } from './taint-summaries.js';
+export { callSummariesPhase } from './call-summaries.js';
 export { mroPhase } from './mro.js';
 export { communitiesPhase } from './communities.js';
 export { processesPhase } from './processes.js';

package/dist/core/ingestion/pipeline-phases/parse-impl.d.ts

@@ -26,27 +26,6 @@ type ScannedFile = {
     size: number;
 };
 type ProgressFn = (progress: PipelineProgress) => void;
-/**
- * Handle a worker-pool startup failure by FAILING FAST with the captured cause
- * (#1741). The pool self-heals *transient* worker crashes on its own — a
- * bounded, jittered startup restart loop (see worker-pool.ts) — so this is
- * reached only when that self-heal is EXHAUSTED, or a deterministic crash-loop
- * was detected, or the pool could not even be constructed. In every such case
- * the workers genuinely cannot start.
- *
- * There is no sequential parser to silently degrade to — that fallback was
- * removed (and it had masked a worker-startup regression as a 2-hour "stuck"
- * run in #1741, rc99: a dropped `logger.warn` plus an unbounded sequential
- * grind). GitNexus surfaces the real crash and aborts so the operator fixes the
- * worker startup (commonly a missing build). The pool's own crash
- * classification (`crashClass` on WorkerPoolInitializationError) sharpens the
- * message.
- *
- * @throws always — an actionable Error carrying the captured worker crash.
- * @internal Exported for unit tests; production callers are the parse loop's
- *           two worker-startup catch sites below.
- */
-export declare function handleWorkerStartupFailure(err: Error): never;
 /**
  * Chunked parse + resolve loop.
  *

package/dist/core/ingestion/pipeline-phases/parse-impl.js

@@ -18,6 +18,7 @@ import { BindingAccumulator, enrichExportedTypeMap, } from '../binding-accumulat
 import { mergeChunkResults, dispatchChunkParse } from '../parsing-processor.js';
 import { fileContentHash, computeChunkHash, loadParseCacheChunk, persistParseCacheChunk, PARSE_CACHE_VERSION, } from '../../../storage/parse-cache.js';
 import { clearParsedFileStore, persistParsedFileChunk, getDurableParsedFileDir, loadDurableParsedFileIndex, restoreDurableParsedFileShard, } from '../../../storage/parsedfile-store.js';
+import { DEFAULT_PDG_MAX_FUNCTION_LINES } from '../cfg/collect.js';
 import { processRoutesFromExtracted, buildExportedTypeMapFromGraph, } from '../call-processor.js';
 import { createSemanticModel } from '../model/index.js';
 import { getLanguageFromFilename, } from '../../../_shared/index.js';
@@ -319,6 +320,10 @@ export async function runChunkedParseAndResolve(graph, scannedFiles, allPaths, t
                 // Initialized below before the chunk loop (same deferred-init pattern
                 // as `parsedFileStorePath`); this closure only runs from the loop.
                 durableParsedFileStoragePath: durableParsedFileDir,
+                // CFG/PDG opt-in (#2081 M1) — baked into each worker's workerData so the
+                // worker builds + attaches cfgSideChannel. Off by default.
+                pdg: options?.pdg === true,
+                pdgMaxFunctionLines: options?.pdgMaxFunctionLines,
                 // Fan each chunk across the whole pool (#worker-idle): without this a
                 // chunk smaller than the 8 MB sub-batch cap became a single job on a
                 // single worker. Honors an explicit `subBatchMaxBytes` / env override.
@@ -566,7 +571,19 @@ export async function runChunkedParseAndResolve(graph, scannedFiles, allPaths, t
                     filePath: f.path,
                     contentHash: fileContentHash(f.content),
                 }));
-                chunkHash = computeChunkHash(entries);
+                chunkHash = computeChunkHash(entries, 
+                // Only worker-visible pdg config participates in the key —
+                // pdgMaxEdgesPerFunction is emit-time-only and deliberately
+                // excluded (see PdgCacheKey in parse-cache.ts; #2099 F3). The line
+                // cap is RESOLVED to the worker's default before folding so an
+                // explicit-default run shares the default run's keys (the worker
+                // output is byte-identical either way).
+                options?.pdg === true
+                    ? {
+                        pdg: true,
+                        maxFunctionLines: options?.pdgMaxFunctionLines ?? DEFAULT_PDG_MAX_FUNCTION_LINES,
+                    }
+                    : false);
             }
             const cachedRaw = chunkHash && parseCache ? await loadParseCacheChunk(parseCache, chunkHash) : undefined;
             // Track every chunk hash we touched so the orchestrator can

package/dist/core/ingestion/pipeline-phases/routes.d.ts

@@ -14,6 +14,15 @@ import type { PipelinePhase } from './types.js';
 export interface RouteEntry {
     filePath: string;
     source: string;
+    /**
+     * HTTP verb for this route when ingestion knows it structurally
+     * (Spring/Laravel framework routes and decorator routes carry
+     * `httpMethod`; filesystem-derived routes — Next.js/Expo/PHP file
+     * routes — do not, so this stays undefined for them). Persisted onto
+     * the Route node so downstream contract extraction can read the verb
+     * from the graph instead of re-parsing the handler source.
+     */
+    method?: string;
 }
 export interface RoutesOutput {
     routeRegistry: Map<string, RouteEntry>;
@@ -26,4 +35,5 @@ export interface TemplateFetchCall {
 export declare const isTemplateRouteCandidate: (filePath: string) => boolean;
 export declare function extractTemplateStaticFetchCalls(filePath: string, content: string, namedRouteUrls?: ReadonlyMap<string, string>): TemplateFetchCall[];
 export declare function normalizeExtractedRoutePath(routePath: string, prefix: string | null): string;
+export declare function normalizeRouteMethod(raw: string | null | undefined): string | undefined;
 export declare const routesPhase: PipelinePhase<RoutesOutput>;

package/dist/core/ingestion/pipeline-phases/routes.js

@@ -97,6 +97,32 @@ export function normalizeExtractedRoutePath(routePath, prefix) {
 function escapeRegex(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+/**
+ * Canonicalize a route's HTTP verb for persistence on the Route node.
+ * Returns an upper-cased standard method, or `undefined` when the value
+ * is not a real HTTP verb. Laravel `Route::resource` / `apiResource`
+ * surface `httpMethod` values like `resource` / `apiResource` (they
+ * expand to several verbs at runtime), so they must not be stored as a
+ * method — leaving them `undefined` keeps the column clean and lets the
+ * contract extractor fall back to its source-scan path for those routes.
+ */
+const VALID_HTTP_METHODS = new Set([
+    'GET',
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+    'HEAD',
+    'OPTIONS',
+    'TRACE',
+    'CONNECT',
+]);
+export function normalizeRouteMethod(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const verb = raw.trim().toUpperCase();
+    return VALID_HTTP_METHODS.has(verb) ? verb : undefined;
+}
 export const routesPhase = {
     name: 'routes',
     deps: ['parse'],
@@ -166,6 +192,7 @@ export const routesPhase = {
             addRoute(routeUrl, {
                 filePath: route.filePath,
                 source: 'framework-route',
+                method: normalizeRouteMethod(route.httpMethod),
             });
             if (route.routeName && !namedRouteRegistry.has(route.routeName)) {
                 namedRouteRegistry.set(route.routeName, routeUrl);
@@ -176,6 +203,7 @@ export const routesPhase = {
             addRoute(url, {
                 filePath: dr.filePath,
                 source: `decorator-${dr.decoratorName}`,
+                method: normalizeRouteMethod(dr.httpMethod),
             });
         }
         let handlerContents;
@@ -183,7 +211,7 @@ export const routesPhase = {
             const handlerPaths = [...routeRegistry.values()].map((e) => e.filePath);
             handlerContents = await readFileContents(ctx.repoPath, handlerPaths);
             for (const [routeURL, entry] of routeRegistry) {
-                const { filePath: handlerPath, source: routeSource } = entry;
+                const { filePath: handlerPath, source: routeSource, method: routeMethod } = entry;
                 const content = handlerContents.get(handlerPath);
                 const { responseKeys, errorKeys } = content
                     ? handlerPath.endsWith('.php')
@@ -199,6 +227,7 @@ export const routesPhase = {
                     properties: {
                         name: routeURL,
                         filePath: handlerPath,
+                        ...(routeMethod ? { method: routeMethod } : {}),
                         ...(responseKeys ? { responseKeys } : {}),
                         ...(errorKeys ? { errorKeys } : {}),
                         ...(middleware && middleware.length > 0 ? { middleware } : {}),

package/dist/core/ingestion/pipeline-phases/taint-summaries.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Phase: taintSummaries (#2084 M4 U3/U5)
+ *
+ * The interprocedural taint fixpoint. Runs AFTER scope-resolution (where the
+ * complete, resolved `CALLS` graph lives in `ctx.graph` and the per-function
+ * summaries were harvested in-phase) and composes those summaries to find
+ * source→sink flows that cross function and file boundaries.
+ *
+ * Opt-in: registered with `enabledWhen: (o) => o.pdg === true` (the first real
+ * pdg-gated phase). A default `analyze` run never includes it, so the graph is
+ * byte-identical. No always-on phase depends on it (a filtered-out dep would
+ * throw in `getPhaseOutput`).
+ *
+ * @deps    scopeResolution, pruneLocalSymbols
+ * @reads   graph (CALLS edges, Function/Method nodes), scopeResolution output
+ *          (functionSummaries)
+ * @writes  graph (TAINT_PATH edges)
+ */
+import type { PipelinePhase } from './types.js';
+export interface TaintSummariesOutput {
+    /** Function summaries fed to the fixpoint. */
+    summaries: number;
+    /** Cross-function findings (pre-cap). */
+    findings: number;
+    /** TAINT_PATH edges persisted. */
+    edgesEmitted: number;
+    /** Call sites whose callee did not resolve to a summary edge (diagnostics). */
+    unmatchedCallSites: number;
+}
+export declare const taintSummariesPhase: PipelinePhase<TaintSummariesOutput>;