release: v1.6.4-rc.94

.github/actions/setup-gitnexus-web/action.yml

@@ -1,5 +1,5 @@
 name: Setup GitNexus Web
-description: Setup Node.js 22, build gitnexus-shared, install web dependencies
+description: Setup Node.js 20.19+ (vite 7 floor), build gitnexus-shared, install web dependencies
 
 runs:
   using: composite
@@ -7,7 +7,9 @@ runs:
     - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         # Vite 7 requires Node ^20.19.0 || >=22.12.0 (require(esm) support).
-        node-version: 22
+        # Pin explicitly so we don't depend on the floating "20" alias resolving
+        # to a high enough patch version on every runner image.
+        node-version: '20.19.0'
         cache: npm
         cache-dependency-path: gitnexus-web/package-lock.json
 

.github/actions/setup-gitnexus/action.yml

@@ -1,5 +1,5 @@
 name: Setup GitNexus
-description: Setup Node.js 22, install dependencies, and optionally build
+description: Setup Node.js 20, install dependencies, and optionally build
 
 inputs:
   build:
@@ -12,7 +12,7 @@ runs:
   steps:
     - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
-        node-version: 22
+        node-version: 20
         cache: npm
         cache-dependency-path: gitnexus/package-lock.json
 

.github/dependabot.yml

@@ -7,8 +7,6 @@ updates:
     directory: /
     schedule:
       interval: weekly
-    cooldown:
-      default-days: 7
     open-pull-requests-limit: 5
     commit-message:
       prefix: chore
@@ -17,36 +15,6 @@ updates:
       - dependencies
       - ci
 
-  # Keep pinned Docker base-image digests current for the root Dockerfiles.
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: chore(deps)
-      include: scope
-    labels:
-      - dependencies
-      - ci
-
-  # Keep the nested test-image Docker base digest current as well.
-  - package-ecosystem: docker
-    directory: /gitnexus
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: chore(deps)
-      include: scope
-    labels:
-      - dependencies
-      - ci
-
   # Gitnexus npm deps — tree-sitter grammars checked daily so we catch
   # new releases that unblock the tree-sitter 0.25 upgrade ASAP. Grammars
   # are grouped so lockstep bumps produce a single PR. The tree-sitter
@@ -57,11 +25,6 @@ updates:
     directory: /gitnexus
     schedule:
       interval: daily
-    cooldown:
-      default-days: 7
-      semver-major-days: 30
-      semver-minor-days: 7
-      semver-patch-days: 3
     open-pull-requests-limit: 10
     commit-message:
       prefix: chore(deps)
@@ -91,11 +54,6 @@ updates:
     directory: /gitnexus-web
     schedule:
       interval: weekly
-    cooldown:
-      default-days: 7
-      semver-major-days: 30
-      semver-minor-days: 7
-      semver-patch-days: 3
     open-pull-requests-limit: 5
     commit-message:
       prefix: chore(deps)
@@ -109,11 +67,6 @@ updates:
     directory: /gitnexus-shared
     schedule:
       interval: weekly
-    cooldown:
-      default-days: 7
-      semver-major-days: 30
-      semver-minor-days: 7
-      semver-patch-days: 3
     open-pull-requests-limit: 5
     commit-message:
       prefix: chore(deps)

.github/workflows/ci-e2e.yml

@@ -3,9 +3,6 @@ name: E2E Tests
 on:
   workflow_call:
 
-permissions:
-  contents: read
-
 jobs:
   check-changes:
     name: Check web module changes

.github/workflows/ci-quality.yml

@@ -3,9 +3,6 @@ name: Quality Checks
 on:
   workflow_call:
 
-permissions:
-  contents: read
-
 jobs:
   format:
     runs-on: ubuntu-latest
@@ -14,7 +11,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
+          node-version: 20
           cache: npm
           cache-dependency-path: package-lock.json
       - run: npm ci
@@ -27,7 +24,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
+          node-version: 20
           cache: npm
           cache-dependency-path: package-lock.json
       - run: npm ci

.github/workflows/ci-report.yml

@@ -95,33 +95,31 @@ jobs:
 
           # Validate PR number is a positive integer (artifact comes from
           # untrusted fork code, so treat contents defensively).
-          PR_NUM=$(tr -d '[:space:]' < "$DIR/pr_number")
+          PR_NUM=$(cat "$DIR/pr_number" | tr -d '[:space:]')
           if ! [[ "$PR_NUM" =~ ^[0-9]+$ ]]; then
             echo "skip=true" >> "$GITHUB_OUTPUT"
             echo "::error::Invalid PR number in artifact: '$PR_NUM'"
             exit 0
           fi
 
+          echo "skip=false"              >> "$GITHUB_OUTPUT"
+          echo "pr_number=$PR_NUM"       >> "$GITHUB_OUTPUT"
           # Validate job-result strings against known GitHub Actions values.
           # Artifact contents come from the PR workflow (potentially untrusted
           # fork code), so we whitelist to prevent newline injection into
           # GITHUB_OUTPUT.
           validate_result() {
             local val
-            val=$(tr -d '[:space:]' < "$1")
+            val=$(cat "$1" | tr -d '[:space:]')
             case "$val" in
               success|failure|cancelled|skipped) echo "$val" ;;
               *) echo "unknown" ;;
             esac
           }
 
-          {
-            echo "skip=false"
-            echo "pr_number=$PR_NUM"
-            echo "quality=$(validate_result "$DIR/quality_result")"
-            echo "tests=$(validate_result "$DIR/tests_result")"
-            echo "e2e=$(validate_result "$DIR/e2e_result")"
-          } >> "$GITHUB_OUTPUT"
+          echo "quality=$(validate_result "$DIR/quality_result")"        >> "$GITHUB_OUTPUT"
+          echo "tests=$(validate_result "$DIR/tests_result")"            >> "$GITHUB_OUTPUT"
+          echo "e2e=$(validate_result "$DIR/e2e_result")"                >> "$GITHUB_OUTPUT"
 
       - name: Checkout (for vitest config)
         if: steps.meta.outputs.skip != 'true'
@@ -281,17 +279,14 @@ jobs:
             fi
           }
 
-          # `_` placeholder for the suite-count column — positional
-          # readability for sum_results' 6-field output, but the value
-          # isn't surfaced in the report (suites are tracked per-test
-          # framework, not as a top-line metric).
-          read -r CLI_T CLI_P CLI_F CLI_S _ CLI_D <<< "$(sum_results "$RESULTS_FILE")"
-          read -r WEB_T WEB_P WEB_F WEB_S _ WEB_D <<< "$(sum_results "$WEB_RESULTS_FILE")"
+          read CLI_T CLI_P CLI_F CLI_S CLI_SU CLI_D <<< "$(sum_results "$RESULTS_FILE")"
+          read WEB_T WEB_P WEB_F WEB_S WEB_SU WEB_D <<< "$(sum_results "$WEB_RESULTS_FILE")"
 
           TOTAL=$((CLI_T + WEB_T))
           PASSED=$((CLI_P + WEB_P))
           FAILED=$((CLI_F + WEB_F))
           SKIPPED=$((CLI_S + WEB_S))
+          SUITES=$((CLI_SU + WEB_SU))
           DURATION=$((CLI_D > WEB_D ? CLI_D : WEB_D))
 
           # ── Status helpers ──

.github/workflows/ci-scope-parity.yml

@@ -28,9 +28,6 @@ name: Scope Resolution Parity
 on:
   workflow_call:
 
-permissions:
-  contents: read
-
 jobs:
   discover:
     name: Discover migrated languages

.github/workflows/ci-tests.yml

@@ -3,9 +3,6 @@ name: Tests
 on:
   workflow_call:
 
-permissions:
-  contents: read
-
 jobs:
   tests:
     name: ubuntu / coverage

.github/workflows/ci.yml

@@ -6,19 +6,16 @@ on:
     paths-ignore: ['**.md', 'docs/**', 'LICENSE']
   workflow_call:
 
-permissions:
-  contents: read
-
 # Concurrency convention: see CONTRIBUTING.md → "GitHub Actions — Concurrency Convention".
 # Hardcoded `CI-` prefix (not `${{ github.workflow }}`) because this workflow is
-# invoked as a reusable workflow from publish.yml. In called-workflow context
-# `github.workflow` evaluation is ambiguous across GitHub Actions versions, and a
-# prefix that could resolve to the caller's name would share a concurrency group
-# with the caller → deadlock. A literal prefix is immune. Direct `pull_request`
-# invocations use `CI-<ref>`; invocations from a reusable-workflow caller fall
-# into a per-run-unique group that never serializes with the caller. `push` to
-# main is handled by publish.yml (RC mode), which calls this workflow once
-# before publishing.
+# invoked as a reusable workflow from publish.yml and release-candidate.yml. In
+# called-workflow context `github.workflow` evaluation is ambiguous across GitHub
+# Actions versions, and a prefix that could resolve to the caller's name would
+# share a concurrency group with the caller → deadlock. A literal prefix is
+# immune. Direct `pull_request` invocations use `CI-<ref>`; invocations from a
+# reusable-workflow caller fall into a per-run-unique group that never serializes
+# with the caller. `push` to main is handled by release-candidate.yml, which
+# calls this workflow once before publishing.
 concurrency:
   group: ${{ github.event_name == 'pull_request' && format('CI-{0}', github.ref) || format('CI-nested-{0}', github.run_id) }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.github/workflows/claude.yml

@@ -19,9 +19,6 @@ on:
   pull_request_review:
     types: [submitted]
 
-permissions:
-  contents: read
-
 # Concurrency convention: see CONTRIBUTING.md → "GitHub Actions — Concurrency Convention".
 # Serialize per-PR/issue to avoid racing comments.
 concurrency:
@@ -158,8 +155,6 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           allowed_non_write_users: '*'
           show_full_output: true
-          # Review posts use Bash (`gh`, etc.); default mode asks for approval — impossible in CI.
-          claude_args: '--dangerously-skip-permissions'
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'
-          prompt: '/code-review:code-review https://github.com/${{ github.repository }}/pull/${{ steps.pr.outputs.number }} --comment'
+          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ steps.pr.outputs.number }}'

.github/workflows/codeql.yml

@@ -17,9 +17,6 @@ on:
     # already-merged code without waiting for the next PR.
     - cron: '0 6 * * 1'
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.github/workflows/dependency-review.yml

@@ -10,9 +10,6 @@ on:
   pull_request:
     branches: [main]
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/docker.yml

@@ -25,18 +25,6 @@ on:
           a gitnexus/package.json whose version matches the tag.
         required: true
         type: string
-    # Explicit secret contract — callers pass these by name. Replaces the
-    # blanket `secrets: inherit` pattern (zizmor `secrets-inherit` audit).
-    # GHCR auth uses the implicit GITHUB_TOKEN; only Docker Hub credentials
-    # need to be passed through.
-    secrets:
-      DOCKERHUB_USERNAME:
-        required: true
-      DOCKERHUB_TOKEN:
-        required: true
-
-permissions:
-  contents: read
 
 # Concurrency convention: see CONTRIBUTING.md → "GitHub Actions — Concurrency Convention".
 # Tag refs are unique per release, so distinct tags run in parallel.
@@ -82,7 +70,7 @@ jobs:
 
     steps:
       # Only the workflow_call path requires a non-empty `inputs.tag` — callers
-      # (publish.yml in RC mode) must pass the RC tag explicitly. On direct
+      # (e.g. release-candidate.yml) must pass the RC tag explicitly. On direct
       # tag pushes the tag comes from `github.ref`, so `inputs.tag` is always
       # empty and validating it here would break every real release (#1064).
       # The downstream "Verify tag matches gitnexus/package.json version" step
@@ -144,7 +132,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
 
       - name: Log in to GitHub Container Registry
         if: ${{ github.event_name != 'pull_request' && !inputs.dry_run }}

.github/workflows/gitleaks.yml

@@ -12,9 +12,6 @@ on:
   push:
     branches: [main]
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.github/workflows/pr-autofix-apply.yml

@@ -1,595 +0,0 @@
-name: PR Autofix (apply)
-
-# CHATOPS HALF of the autofix pipeline.
-#
-# Triggered when a contributor comments `/autofix` on a PR. Validates
-# permission, locates the most recent successful `pr-autofix.yml`
-# artifact for the PR's current head SHA, applies the patch to the PR
-# head, and pushes a commit back to the PR branch.
-#
-# This workflow runs from the default branch's copy of the file
-# regardless of where the comment originates -- that's the trust
-# anchor. Comment body and author login are untrusted; both flow
-# through env vars and pattern-matched, never interpolated into shell.
-#
-# Fork PR support: `git push` with the GITHUB_TOKEN succeeds against
-# fork branches only when the contributor enabled "Allow edits by
-# maintainers" on the PR (the default). When they disabled it, we
-# fail loud with a 👎 reaction and an explanation comment.
-
-on:
-  issue_comment:
-    types: [created]
-
-concurrency:
-  # Per-PR scope. issue_comment events expose `github.event.issue.number`
-  # for both PR and Issue comments; the `pull_request != null` guard on
-  # the job ensures we only run on PRs, so this number is the PR number.
-  # cancel-in-progress: false — a second `/autofix` should wait for the
-  # first to finish (idempotency check on the second invocation handles
-  # the no-op case).
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number }}
-  cancel-in-progress: false
-
-permissions: {}
-
-jobs:
-  apply:
-    name: apply-autofix
-    # Pre-filter at the workflow level so non-PR comments and unrelated
-    # comments don't even spawn a runner. The job-level body re-check
-    # below (Step 1) is the strict gate.
-    if: >-
-      github.event.issue.pull_request != null
-      && startsWith(github.event.comment.body, '/autofix')
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      # React on the triggering comment + post reply comments.
-      pull-requests: write
-      # Push the apply commit to the PR head branch.
-      contents: write
-      # Required by actions/download-artifact to fetch artifacts produced
-      # by a different workflow run.
-      actions: read
-    steps:
-      - name: Validate comment body precisely
-        id: body
-        env:
-          BODY: ${{ github.event.comment.body }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          # Whole-line, case-sensitive match: `^/autofix\s*$`. The
-          # workflow-level startsWith guard is coarse — `please don't
-          # /autofix this code` would pass that filter but fail this one.
-          # We exit silently (no reaction) on body mismatch so quoted
-          # text in unrelated discussions doesn't get a visible response.
-          if [[ ! "${BODY}" =~ ^/autofix[[:space:]]*$ ]]; then
-            echo "Body did not match strict /autofix regex — exiting silently."
-            echo "match=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "match=true" >> "$GITHUB_OUTPUT"
-
-      - name: Validate commenter permission
-        id: perm
-        if: steps.body.outputs.match == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          COMMENTER: ${{ github.event.comment.user.login }}
-          PR_AUTHOR: ${{ github.event.issue.user.login }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          # Retry wrapper for transient 5xx / 429 / network blips.
-          # Mirrors the helper in pr-autofix-publish.yml. Used on
-          # idempotent GETs only; reactions/comment-POSTs are NOT
-          # wrapped (retrying a POST would dupe the resource).
-          gh_retry() {
-            local n=0 max=3
-            while true; do
-              if gh "$@"; then return 0; fi
-              n=$((n+1))
-              if [ "$n" -ge "$max" ]; then return 1; fi
-              sleep $((n * 2))
-            done
-          }
-
-          # Allowlist the commenter login before it flows into a URL.
-          # GitHub usernames: alphanumeric + dashes, max 39 chars.
-          if ! [[ "${COMMENTER}" =~ ^[A-Za-z0-9-]{1,39}$ ]]; then
-            echo "::error::Invalid commenter login format: $(printf '%q' "${COMMENTER}")"
-            echo "allowed=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Self-comparison: PR author can always /autofix their own PR.
-          if [ "${COMMENTER}" = "${PR_AUTHOR}" ]; then
-            echo "Commenter is PR author — granting access."
-            echo "allowed=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Repo permission lookup. admin/write/maintain are sufficient.
-          # Distinguish API failure (5xx, 429, network) from genuine
-          # permission denial (404 = not a collaborator). Conflating them
-          # would silently refuse a legitimate maintainer with a public
-          # 👎 every time GitHub blips. gh_retry handles transient blips;
-          # the stderr-grep distinguishes 404 from persistent failure.
-          perm_stderr=$(mktemp)
-          if permission=$(gh_retry api "repos/${GH_REPO}/collaborators/${COMMENTER}/permission" \
-                --jq '.permission' 2>"$perm_stderr"); then
-            echo "Commenter permission: ${permission}"
-            case "${permission}" in
-              admin|write|maintain)
-                echo "allowed=true" >> "$GITHUB_OUTPUT"
-                ;;
-              *)
-                echo "allowed=false" >> "$GITHUB_OUTPUT"
-                ;;
-            esac
-          else
-            err=$(cat "$perm_stderr")
-            echo "Permission lookup stderr: ${err}" >&2
-            # 404 (not a collaborator) is a genuine deny.
-            # Anything else is a transient API/network failure.
-            if grep -qE "HTTP 404|Not Found" "$perm_stderr"; then
-              echo "allowed=false" >> "$GITHUB_OUTPUT"
-            else
-              echo "::error::Permission lookup failed transiently — refusing to act."
-              echo "allowed=api-failed" >> "$GITHUB_OUTPUT"
-            fi
-          fi
-
-      - name: React 😕 on transient permission-API failure
-        if: steps.body.outputs.match == 'true' && steps.perm.outputs.allowed == 'api-failed'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          COMMENT_ID: ${{ github.event.comment.id }}
-          PR: ${{ github.event.issue.number }}
-          RUN_ID: ${{ github.run_id }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-            -f content="confused" >/dev/null
-          gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-            -f body="⚠️ Couldn't verify your repo permission (transient GitHub API failure). Please comment \`/autofix\` again. ([apply run](https://github.com/${GH_REPO}/actions/runs/${RUN_ID}))" \
-            >/dev/null
-          exit 1
-
-      - name: React 👎 on permission denial
-        if: steps.body.outputs.match == 'true' && steps.perm.outputs.allowed == 'false'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          COMMENT_ID: ${{ github.event.comment.id }}
-          PR: ${{ github.event.issue.number }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-            -f content="-1" >/dev/null
-          gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-            -f body="🚫 \`/autofix\` is restricted to users with write access or the PR author. Comment ignored." \
-            >/dev/null
-          # Hard exit so the rest of the job is skipped.
-          exit 1
-
-      - name: React 👀 to acknowledge
-        if: steps.perm.outputs.allowed == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          COMMENT_ID: ${{ github.event.comment.id }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-            -f content="eyes" >/dev/null
-
-      - name: Resolve PR head and locate autofix run
-        id: locate
-        if: steps.perm.outputs.allowed == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          PR: ${{ github.event.issue.number }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          # Same retry wrapper used in the permission step, repeated
-          # because each YAML `run:` block is a fresh bash session.
-          gh_retry() {
-            local n=0 max=3
-            while true; do
-              if gh "$@"; then return 0; fi
-              n=$((n+1))
-              if [ "$n" -ge "$max" ]; then return 1; fi
-              sleep $((n * 2))
-            done
-          }
-
-          # Fetch PR metadata. All fields here are server-controlled API
-          # output, but we still allowlist before exporting so anything
-          # weird short-circuits before $GITHUB_OUTPUT. Wrapped in
-          # gh_retry so transient blips don't surface as "no autofix run
-          # found" with a wrong remediation.
-          if ! pr_json=$(gh_retry api "repos/${GH_REPO}/pulls/${PR}"); then
-            echo "::error::PR metadata fetch failed after retries."
-            echo "found_status=api-failed" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          head_sha=$(jq -r '.head.sha' <<< "${pr_json}")
-          head_ref=$(jq -r '.head.ref' <<< "${pr_json}")
-          head_repo=$(jq -r '.head.repo.full_name' <<< "${pr_json}")
-
-          [[ "${head_sha}"  =~ ^[0-9a-f]{40}$                         ]] || { echo "::error::Bad head_sha";  exit 1; }
-          [[ "${head_ref}"  =~ ^[A-Za-z0-9._/-]+$                     ]] || { echo "::error::Bad head_ref";  exit 1; }
-          [[ "${head_repo}" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$      ]] || { echo "::error::Bad head_repo"; exit 1; }
-
-          # Find the latest successful pr-autofix.yml run for this head SHA.
-          if ! runs_json=$(gh_retry api "repos/${GH_REPO}/actions/workflows/pr-autofix.yml/runs?head_sha=${head_sha}&per_page=10"); then
-            echo "::error::Workflow run lookup failed after retries."
-            echo "found_status=api-failed" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          run_id=$(jq -r '[.workflow_runs[] | select(.conclusion == "success")] | .[0].id // empty' <<< "${runs_json}")
-
-          if [ -n "${run_id}" ] && [[ "${run_id}" =~ ^[0-9]+$ ]]; then
-            echo "found_status=success" >> "$GITHUB_OUTPUT"
-            {
-              echo "found=true"
-              echo "head_sha=${head_sha}"
-              echo "head_ref=${head_ref}"
-              echo "head_repo=${head_repo}"
-              echo "run_id=${run_id}"
-            } >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # No successful run. Distinguish "still running" (producer in
-          # flight after a recent push) from "never ran / all failed".
-          # in_progress / queued / pending / waiting cover the GitHub
-          # workflow-run lifecycle states that precede success/failure.
-          in_progress=$(jq -r '[.workflow_runs[] | select(.status == "in_progress" or .status == "queued" or .status == "pending" or .status == "waiting")] | length' <<< "${runs_json}")
-          if [ "${in_progress:-0}" -gt 0 ]; then
-            echo "::warning::pr-autofix run is still in progress for head ${head_sha}."
-            echo "found_status=in-progress" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No successful pr-autofix run found for head ${head_sha}."
-            echo "found_status=not-found" >> "$GITHUB_OUTPUT"
-          fi
-          # Existing `found` boolean is preserved so downstream gates
-          # (`steps.locate.outputs.found == 'true'`) still work.
-          echo "found=false" >> "$GITHUB_OUTPUT"
-
-      - name: Reply when locate did not yield a usable run
-        if: steps.perm.outputs.allowed == 'true' && steps.locate.outputs.found != 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          COMMENT_ID: ${{ github.event.comment.id }}
-          PR: ${{ github.event.issue.number }}
-          FOUND_STATUS: ${{ steps.locate.outputs.found_status }}
-          RUN_ID: ${{ github.run_id }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          run_url="https://github.com/${GH_REPO}/actions/runs/${RUN_ID}"
-          case "${FOUND_STATUS}" in
-            in-progress)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="confused" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="⏳ A pr-autofix run is still in progress for this PR's current head SHA. Wait for it to finish, then comment \`/autofix\` again. ([apply run](${run_url}))" \
-                >/dev/null
-              ;;
-            api-failed)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="confused" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="⚠️ Couldn't reach the GitHub API to look up the autofix run (transient failure after retries). Please comment \`/autofix\` again. ([apply run](${run_url}))" \
-                >/dev/null
-              ;;
-            *)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="-1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="🤔 No successful autofix run found for this PR's current head SHA. Push a new commit to trigger one, then comment \`/autofix\` again." \
-                >/dev/null
-              ;;
-          esac
-          exit 1
-
-      # Pinned to v8.0.1. Same SHA as pr-autofix-publish.yml.
-      # `continue-on-error: true` lets the workflow proceed when the
-      # artifact is expired or pruned (1-day retention). The apply
-      # step distinguishes "patch file missing entirely" (artifact-
-      # expired) from "patch file zero bytes" (genuinely empty patch).
-      - name: Download autofix artifact
-        if: steps.locate.outputs.found == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        continue-on-error: true
-        with:
-          name: autofix
-          run-id: ${{ steps.locate.outputs.run_id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          path: autofix-in
-
-      # Pinned to v5.0.4. Verify SHA via:
-      #   gh api repos/actions/checkout/git/refs/tags/v5.0.4
-      #
-      # `persist-credentials: false` disables the default behavior where
-      # actions/checkout writes the GITHUB_TOKEN into `.git/config` as an
-      # extraheader. That default is convenient (subsequent git commands
-      # auth automatically) but it means the token is sitting on disk in
-      # the checkout directory — an `actions/upload-artifact` step on
-      # this directory would leak the token. We don't upload, but
-      # zizmor's `credential-persistence` lint flags it defensively.
-      # Push auth is provided inline at push time via the URL.
-      - name: Checkout PR head
-        if: steps.locate.outputs.found == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5.0.4
-        with:
-          repository: ${{ steps.locate.outputs.head_repo }}
-          ref: ${{ steps.locate.outputs.head_sha }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          persist-credentials: false
-          # Fetch full history so the push doesn't hit shallow-clone errors.
-          fetch-depth: 0
-          path: pr-checkout
-
-      - name: Apply patch and push
-        id: apply
-        if: steps.locate.outputs.found == 'true'
-        env:
-          HEAD_REF: ${{ steps.locate.outputs.head_ref }}
-          HEAD_REPO: ${{ steps.locate.outputs.head_repo }}
-          # The SHA we resolved earlier in `locate` — this is what the
-          # remote ref MUST still equal at push time. If the contributor
-          # force-pushed between resolve and now, the lease fails and
-          # we surface that distinctly from a fork-without-maintainer
-          # -edit push failure.
-          HEAD_SHA: ${{ steps.locate.outputs.head_sha }}
-          # Auth for the push only — never persisted to disk. Provided
-          # via env to avoid interpolating into the shell command line.
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        shell: bash
-        working-directory: pr-checkout
-        run: |
-          set -euo pipefail
-          patch="../autofix-in/autofix.patch"
-
-          # Distinguish artifact-expired (file missing entirely, because
-          # actions/download-artifact ran with continue-on-error and the
-          # 1-day retention had elapsed) from genuinely empty patch
-          # (file present, zero bytes, formatter found nothing).
-          if [ ! -e "$patch" ]; then
-            echo "::warning::Patch file does not exist — autofix artifact likely expired."
-            echo "result=artifact-expired" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [ ! -s "$patch" ]; then
-            echo "::warning::Empty patch — nothing to apply."
-            echo "result=empty-patch" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Sensitive-paths guard: refuse to apply patches that touch
-          # `.github/` — workflow files, action definitions, CODEOWNERS,
-          # dependabot config, etc. A malicious PR could ship a custom
-          # prettier/ESLint config that reformats workflow YAML; the
-          # producer would then capture those edits in autofix.patch,
-          # and a maintainer running `/autofix` would push them under
-          # `contents: write`. The default GITHUB_TOKEN lacks `workflows`
-          # scope so the platform would reject workflow-file pushes
-          # anyway, but that surfaces as a generic `push-failed` and
-          # misleads users into enabling maintainer-edit. Reject early
-          # with a specific reason. CODEOWNERS and dependabot.yml live
-          # under .github/ but outside .github/workflows/ — the broader
-          # match is intentional (they all govern trust boundaries).
-          if grep -qE '^(diff --git|---|\+\+\+) [ab]?/?\.github/' "$patch"; then
-            echo "::warning::Patch touches .github/ — refusing to apply (sensitive paths)."
-            echo "result=sensitive-paths" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Re-entrancy guard: if HEAD itself is an autofix bot commit,
-          # refuse to apply again. Without this, lint/formatter config
-          # drift between runs could pump arbitrary apply commits into
-          # the same PR if an automated agent watches the sticky and
-          # re-fires `/autofix` on each new "fixes-available" surface.
-          # The contributor can still get out by force-pushing a
-          # human-authored commit to revert the autofix and re-trigger.
-          head_author=$(git log -1 --format='%ae' HEAD)
-          head_subject=$(git log -1 --format='%s' HEAD)
-          if [ "${head_author}" = "41898282+github-actions[bot]@users.noreply.github.com" ] \
-             && [[ "${head_subject}" =~ ^chore\(autofix\) ]]; then
-            echo "::warning::HEAD is an autofix bot commit — refusing to re-apply (loop guard)."
-            echo "result=loop-prevented" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Idempotency probe: does the forward apply work?
-          if git apply --check "$patch" 2>/dev/null; then
-            echo "Patch applies cleanly — proceeding."
-          elif git apply --check --reverse "$patch" 2>/dev/null; then
-            # Reverse-check passes => the patch is already applied to
-            # the current tree. Treat as success no-op.
-            echo "Patch is already applied (reverse-check passed) — no-op."
-            echo "result=already-applied" >> "$GITHUB_OUTPUT"
-            exit 0
-          else
-            echo "::error::Patch does not apply (stale or conflicting)."
-            echo "result=stale" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Wrap the apply/commit phase so any non-zero exit sets a
-          # meaningful `result=` instead of leaving it unset (which would
-          # send the user to the `*` "unexpected state" arm with a
-          # non-actionable confused-emoji reply).
-          if ! {
-            git config user.email "41898282+github-actions[bot]@users.noreply.github.com" &&
-            git config user.name  "github-actions[bot]" &&
-            git apply "$patch" &&
-            git add -A &&
-            git commit -m "chore(autofix): apply prettier + eslint fixes via /autofix command"
-          }; then
-            echo "::error::git apply / config / commit failed after idempotency probe passed."
-            echo "result=apply-failed" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Push to the PR head branch with a lease against the resolved
-          # SHA. The lease ensures the remote ref still points at HEAD_SHA
-          # when the push lands — if the contributor force-pushed in the
-          # window between resolve and now, the lease fails and we return
-          # `lease-failed` (NOT `push-failed`, which would mislead users
-          # into enabling maintainer-edit). For fork PRs, the push still
-          # requires "Allow edits by maintainers" to be enabled.
-          #
-          # Auth is supplied inline via `-c http.<base>.extraheader` (NOT
-          # via a `https://x-access-token:TOKEN@…` URL — those leak into
-          # process listings and `git remote -v` output). The header is
-          # set per-invocation; it never lands in `.git/config` on disk.
-          # The token is base64-encoded for the Basic auth header per
-          # GitHub's documented pattern for this scope.
-          push_url="https://github.com/${HEAD_REPO}.git"
-          auth_header="Authorization: Basic $(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 -w0)"
-          # GitHub's secret-masker only masks the raw token, not its
-          # base64-encoded form. Mask the encoded value so any subsequent
-          # log line (set -x, GIT_TRACE, error spew) gets ***-redacted.
-          echo "::add-mask::${auth_header}"
-          push_stderr=$(mktemp)
-          if git -c http.extraheader="${auth_header}" \
-                push --force-with-lease="refs/heads/${HEAD_REF}:${HEAD_SHA}" \
-                "${push_url}" "HEAD:${HEAD_REF}" 2>"$push_stderr"; then
-            echo "result=applied" >> "$GITHUB_OUTPUT"
-          else
-            cat "$push_stderr" >&2
-            # `--force-with-lease` reports "stale info" when the remote
-            # ref has moved past the expected SHA. Other lease-failure
-            # phrases git emits include "remote rejected" (server-side
-            # reject), "non-fast-forward", and the literal flag name. Match
-            # any of those to distinguish from auth/network/maintainer-
-            # edit failures.
-            if grep -qE "stale info|force-with-lease|rejected.*non-fast-forward|remote rejected|! \[rejected\]" "$push_stderr"; then
-              echo "::error::git push lease failed — branch moved during apply."
-              echo "result=lease-failed" >> "$GITHUB_OUTPUT"
-            else
-              echo "::error::git push failed — likely fork without maintainer-edit enabled."
-              echo "result=push-failed" >> "$GITHUB_OUTPUT"
-            fi
-            exit 0
-          fi
-
-      - name: React and reply on outcome
-        if: always() && steps.locate.outputs.found == 'true' && steps.apply.outcome != 'skipped'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          COMMENT_ID: ${{ github.event.comment.id }}
-          PR: ${{ github.event.issue.number }}
-          RESULT: ${{ steps.apply.outputs.result }}
-          RUN_ID: ${{ github.run_id }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          run_url="https://github.com/${GH_REPO}/actions/runs/${RUN_ID}"
-
-          case "${RESULT}" in
-            applied)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="+1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="✅ Applied autofix and pushed a commit. ([apply run](${run_url}))" \
-                >/dev/null
-              ;;
-            already-applied)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="+1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="✅ Autofix is already applied — no changes needed." \
-                >/dev/null
-              ;;
-            empty-patch)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="+1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="✅ No autofix to apply — formatter found nothing." \
-                >/dev/null
-              ;;
-            artifact-expired)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="confused" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="⏳ The autofix artifact for this PR's head SHA has expired (1-day retention). Push a new commit to regenerate it, then comment \`/autofix\` again. ([apply run](${run_url}))" \
-                >/dev/null
-              exit 1
-              ;;
-            loop-prevented)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="confused" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="🔁 Refusing to re-apply autofix on top of an existing autofix commit. If formatter rules drifted and you genuinely need another pass, push a human-authored commit (or revert the existing autofix commit) before commenting \`/autofix\` again. ([apply run](${run_url}))" \
-                >/dev/null
-              exit 1
-              ;;
-            sensitive-paths)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="-1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="🛑 Refusing to apply: the autofix patch touches files under \`.github/\` (workflow / CODEOWNERS / dependabot config). Apply formatter changes to those files manually in a regular commit so they get human review. ([apply run](${run_url}))" \
-                >/dev/null
-              exit 1
-              ;;
-            stale)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="-1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="⚠️ The autofix patch is stale or conflicts with the current head — push a new commit to regenerate, then comment \`/autofix\` again. ([apply run](${run_url}))" \
-                >/dev/null
-              exit 1
-              ;;
-            apply-failed)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="-1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="⚠️ Autofix applied cleanly in the dry run, but \`git apply\` / \`git commit\` failed when actually landing the patch. This usually means a race with concurrent edits or a corrupt patch. See logs: ${run_url}" \
-                >/dev/null
-              exit 1
-              ;;
-            push-failed)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="-1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="⚠️ Couldn't push the autofix commit. If this is a fork PR, please tick **Allow edits by maintainers** in the PR sidebar, then comment \`/autofix\` again. ([apply run](${run_url}))" \
-                >/dev/null
-              exit 1
-              ;;
-            lease-failed)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="-1" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="⚠️ The PR head moved while autofix was applying — a new commit landed in the window between resolve and push. Comment \`/autofix\` again to retry against the latest head. ([apply run](${run_url}))" \
-                >/dev/null
-              exit 1
-              ;;
-            *)
-              gh api -X POST "repos/${GH_REPO}/issues/comments/${COMMENT_ID}/reactions" \
-                -f content="confused" >/dev/null
-              gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-                -f body="❓ Autofix run finished in an unexpected state (\`${RESULT:-unknown}\`). See logs: ${run_url}" \
-                >/dev/null
-              exit 1
-              ;;
-          esac

.github/workflows/pr-autofix-publish.yml

@@ -1,316 +0,0 @@
-name: PR Autofix (publish)
-
-# TRUSTED HALF of the autofix pipeline.
-#
-# Triggered by `pr-autofix.yml` completing on a PR (including fork PRs).
-# Downloads the diff artifact produced by the untrusted job, verifies
-# its claimed PR identity against the workflow_run authority, then
-# posts (or edits) a single sticky summary comment plus a
-# `gitnexus/autofix` Check Run. This job NEVER checks out fork code —
-# it only consumes the diff (data) and calls the GitHub API. That
-# isolation is what makes it safe to run under `pull-requests: write`
-# on fork-triggered events.
-#
-# The sticky comment is the contributor signal: heading
-# "## :sparkles: PR Autofix" in the PR's top-level comments, with a
-# fenced `gitnexus-autofix` JSON block carrying machine-readable state
-# for AI agents. Contributors apply the patch by commenting `/autofix`
-# on the PR — handled by the separate `pr-autofix-apply.yml` workflow.
-
-on:
-  workflow_run:
-    workflows: ['PR Autofix']
-    types: [completed]
-
-concurrency:
-  # Key on PR identity, NOT workflow_run.id — workflow_run.id is per-run
-  # unique, which would defeat serialization and let two parallel
-  # publishes both POST a sticky summary comment. CONTRIBUTING.md
-  # § GitHub Actions — Concurrency Convention names this anti-pattern
-  # explicitly. For fork PRs, `pull_requests[]` is empty in the
-  # workflow_run payload, so we fall back to head-repo + head-branch.
-  group: ${{ github.workflow }}-${{ github.event.workflow_run.pull_requests[0].number || format('{0}/{1}', github.event.workflow_run.head_repository.full_name, github.event.workflow_run.head_branch) }}
-  cancel-in-progress: false
-
-permissions: {}
-
-jobs:
-  publish:
-    name: publish-autofix
-    if: >-
-      github.event.workflow_run.event == 'pull_request'
-      && github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      pull-requests: write
-      # Required by actions/download-artifact to fetch artifacts produced
-      # by a different workflow run.
-      actions: read
-      # Required to create the `gitnexus/autofix` Check Run that reports
-      # the outcome (clean / fixes-available) to the PR's Checks tab.
-      # Branch protection or agents can grep the conclusion + output
-      # title without parsing the sticky comment.
-      checks: write
-    steps:
-      # Pinned to v8.0.1. Verify SHA via:
-      #   gh api repos/actions/download-artifact/git/refs/tags/v8.0.1
-      - name: Download autofix artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: autofix
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          path: autofix-in
-
-      - name: Read and validate metadata
-        id: meta
-        shell: bash
-        run: |
-          set -euo pipefail
-          test -f autofix-in/metadata.json
-          jq . autofix-in/metadata.json
-
-          # The artifact comes from the untrusted half running fork code.
-          # Every field is allowlist-validated before it can flow into
-          # $GITHUB_OUTPUT. A newline in head_ref would otherwise let a
-          # malicious branch name inject a second `pr_number=N` line and
-          # redirect this job's reviewdog suggestions / sticky summary
-          # comment onto a victim PR under github-actions[bot] with
-          # pull-requests: write.
-          assert_field() {
-            local key="$1" pattern="$2" value
-            value=$(jq -r ".${key} // empty" autofix-in/metadata.json)
-            if [ -z "$value" ] || ! [[ "$value" =~ $pattern ]]; then
-              echo "::error::metadata.${key} failed allowlist (got: $(printf '%q' "$value"))"
-              exit 1
-            fi
-            printf '%s' "$value"
-          }
-
-          SCHEMA=$(assert_field    schema         '^gitnexus\.pr-autofix/v[0-9]+$')
-          PR_NUMBER=$(assert_field pr_number      '^[0-9]+$')
-          HEAD_SHA=$(assert_field  head_sha       '^[0-9a-f]{40}$')
-          HEAD_REF=$(assert_field  head_ref       '^[A-Za-z0-9._/-]+$')
-          HEAD_REPO=$(assert_field head_repo      '^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$')
-          BASE_REPO=$(assert_field base_repo      '^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$')
-          CHANGED=$(assert_field   changed_lines  '^[0-9]+$')
-
-          # Defence-in-depth: refuse to act if the artifact claims to
-          # belong to a different repo than the one that triggered us.
-          if [ "$BASE_REPO" != "${GITHUB_REPOSITORY}" ]; then
-            echo "::error::Artifact base_repo does not match \$GITHUB_REPOSITORY — refusing to publish."
-            exit 1
-          fi
-
-          {
-            echo "schema=${SCHEMA}"
-            echo "pr_number=${PR_NUMBER}"
-            echo "head_sha=${HEAD_SHA}"
-            echo "head_ref=${HEAD_REF}"
-            echo "head_repo=${HEAD_REPO}"
-            echo "base_repo=${BASE_REPO}"
-            echo "changed_lines=${CHANGED}"
-          } >> "$GITHUB_OUTPUT"
-
-      # Cross-verify the artifact's claimed identity against the
-      # GitHub-controlled workflow_run event. The previous step's
-      # allowlist only proves the fields are well-formed — not that
-      # they refer to the PR/SHA that actually triggered this run.
-      # A fork-controlled `npm run lint:fix` could plausibly mutate
-      # metadata.json to reference another PR or SHA, redirecting our
-      # write-scoped sticky/check-run onto an attacker-chosen target.
-      #
-      # Authority sources are all server-controlled GitHub event fields:
-      #   - workflow_run.head_sha
-      #   - workflow_run.head_repository.full_name
-      #   - workflow_run.pull_requests[].number  (within-repo PRs only;
-      #     empty array on fork PRs — fall back to commits/{sha}/pulls)
-      #
-      # Mismatch => fail loud BEFORE any sticky/check-run side effect.
-      - name: Verify metadata against workflow_run authority
-        id: verify
-        if: steps.meta.outputs.changed_lines != '0'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          META_PR_NUMBER: ${{ steps.meta.outputs.pr_number }}
-          META_HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
-          META_HEAD_REPO: ${{ steps.meta.outputs.head_repo }}
-          WF_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-          WF_HEAD_REPO: ${{ github.event.workflow_run.head_repository.full_name }}
-          WF_PR_NUMBERS: ${{ toJSON(github.event.workflow_run.pull_requests.*.number) }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          # 1) head_sha must match exactly. workflow_run.head_sha is the
-          # commit GitHub actually ran the producer against — definitive.
-          if [ "${META_HEAD_SHA}" != "${WF_HEAD_SHA}" ]; then
-            echo "::error::Artifact head_sha (${META_HEAD_SHA}) does not match workflow_run.head_sha (${WF_HEAD_SHA}) — refusing to publish."
-            exit 1
-          fi
-
-          # 2) head_repo must match exactly. Same authority anchor.
-          if [ "${META_HEAD_REPO}" != "${WF_HEAD_REPO}" ]; then
-            echo "::error::Artifact head_repo (${META_HEAD_REPO}) does not match workflow_run.head_repository (${WF_HEAD_REPO}) — refusing to publish."
-            exit 1
-          fi
-
-          # 3) pr_number must reference an open PR with this head SHA.
-          # Within-repo PRs: workflow_run.pull_requests[] is populated.
-          # Fork PRs: that array is empty by GitHub design — fall back
-          # to the REST commit-to-PRs lookup. Fail closed if the lookup
-          # finds no matching open PR (avoids attacker-forged PR ids).
-          allowed_numbers=$(jq -c '.' <<< "${WF_PR_NUMBERS}")
-          if [ "${allowed_numbers}" = "[]" ]; then
-            echo "workflow_run.pull_requests is empty (fork PR) — falling back to commits/{sha}/pulls."
-            allowed_numbers=$(gh api "repos/${GH_REPO}/commits/${WF_HEAD_SHA}/pulls" \
-              --jq '[.[] | select(.state == "open") | .number]' 2>/dev/null || echo "[]")
-            if [ "${allowed_numbers}" = "[]" ]; then
-              echo "::error::No open PR found for head ${WF_HEAD_SHA} via commits/{sha}/pulls — refusing to publish."
-              exit 1
-            fi
-          fi
-
-          if ! jq -e --argjson n "${META_PR_NUMBER}" 'index($n) != null' <<< "${allowed_numbers}" >/dev/null; then
-            echo "::error::Artifact pr_number (${META_PR_NUMBER}) is not in the authoritative PR list (${allowed_numbers}) — refusing to publish."
-            exit 1
-          fi
-
-          echo "Verified: metadata identity matches workflow_run authority (PR=${META_PR_NUMBER}, head_sha=${META_HEAD_SHA}, head_repo=${META_HEAD_REPO})."
-
-      - name: Upsert sticky summary comment
-        # Only post when ci-quality found something fixable (= the
-        # autofix patch is non-empty). When prettier/eslint are clean
-        # the patch is zero bytes and the sticky comment is pure noise,
-        # so we skip it.
-        if: >-
-          always()
-          && steps.meta.outputs.pr_number != ''
-          && steps.meta.outputs.changed_lines != '0'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          PR: ${{ steps.meta.outputs.pr_number }}
-          CHANGED: ${{ steps.meta.outputs.changed_lines }}
-          HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
-          RUN_ID: ${{ github.run_id }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          # Stable heading + marker — agents grep for these exact strings.
-          marker="<!-- gitnexus:pr-autofix-summary -->"
-          heading="## :sparkles: PR Autofix"
-
-          # Single state. The /autofix slash command works for any diff
-          # size — there's no 3K cap and no no-overlap dead-end because
-          # the apply workflow uses `git apply` + push, not the GitHub
-          # review-comment API.
-          ui_state="fixes-available"
-          prose="Found fixable formatting / unused-import issues across **${CHANGED}** changed lines. **Comment \`/autofix\` on this PR to apply them**, or run \`npm run lint:fix && npm run format\` locally."
-
-          # Machine-readable JSON block — agents parse this instead of
-          # regexing English. Fenced code-block info string is
-          # `gitnexus-autofix` so agents can locate it without ambiguity.
-          # Schema bumped from v1 -> v2: adds `apply_command`. The v1
-          # field set is preserved as a superset, but the `state` enum
-          # is redefined (v1: suggestions-posted | skipped-too-large |
-          # diff-no-overlap; v2: fixes-available). v1 readers checking
-          # `schema == 'gitnexus.pr-autofix/v1'` see an unfamiliar version
-          # and fall back to prose, which is the intended migration path.
-          json=$(jq -n -c \
-            --arg state        "${ui_state}" \
-            --argjson pr_number "${PR}" \
-            --argjson changed_lines "${CHANGED}" \
-            --arg head_sha     "${HEAD_SHA}" \
-            --arg run_id       "${RUN_ID}" \
-            '{schema:"gitnexus.pr-autofix/v2", state:$state, pr_number:$pr_number, changed_lines:$changed_lines, head_sha:$head_sha, run_id:$run_id, apply_command:"/autofix"}')
-
-          # Multi-line quoted string instead of a column-0 heredoc — YAML's
-          # `run: |` block ends as soon as a content line dedents below the
-          # block's first-line indent, which would mis-parse the workflow.
-          body="${marker}
-          ${heading}
-
-          ${prose}
-
-          \`\`\`gitnexus-autofix
-          ${json}
-          \`\`\`"
-          # Strip the leading 10-space indent that the YAML block requires
-          # so the rendered comment body starts at column 0.
-          body="$(printf '%s\n' "$body" | sed 's/^          //')"
-
-          # Small retry wrapper for transient 5xx / rate-limit responses
-          # on the GitHub REST API. Three tries with linear backoff. We
-          # only retry GET (idempotent) and PATCH on a known comment id
-          # (idempotent). POST is NOT wrapped — retrying a comment-create
-          # would create duplicates if the first attempt actually landed.
-          gh_retry() {
-            local n=0 max=3
-            while true; do
-              if gh "$@"; then return 0; fi
-              n=$((n+1))
-              if [ "$n" -ge "$max" ]; then return 1; fi
-              sleep $((n * 2))
-            done
-          }
-
-          # Find existing bot comment by the marker and edit-in-place; else create.
-          # CRITICAL: filter by `.user.login == "github-actions[bot]"`. A regular
-          # user posting a comment containing the marker would otherwise be the
-          # `head -n1` match; PATCH on someone else's comment 403s, `set -e`
-          # aborts, and the bot is permanently DoS'd for that PR.
-          existing=$(gh_retry api "repos/${GH_REPO}/issues/${PR}/comments" \
-            --paginate --jq ".[] | select(.user.login == \"github-actions[bot]\" and (.body | contains(\"${marker}\"))) | .id" \
-            | head -n1 || true)
-
-          if [ -n "${existing}" ]; then
-            gh_retry api -X PATCH "repos/${GH_REPO}/issues/comments/${existing}" \
-              -f body="${body}" >/dev/null
-            echo "Updated comment ${existing}."
-          else
-            gh api -X POST "repos/${GH_REPO}/issues/${PR}/comments" \
-              -f body="${body}" >/dev/null
-            echo "Created summary comment."
-          fi
-
-      - name: Emit gitnexus/autofix Check Run
-        # Stable check name `gitnexus/autofix` so PR-watching agents can
-        # `gh pr checks <pr>` and read the conclusion + title without
-        # parsing the sticky comment. Two outcomes:
-        #   clean            → conclusion: success
-        #   fixes-available  → conclusion: neutral
-        # `neutral` does not block branch-protection required-checks but
-        # is visually distinct from a green pass.
-        if: always() && steps.meta.outputs.head_sha != ''
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
-          CHANGED: ${{ steps.meta.outputs.changed_lines }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [ "${CHANGED}" = "0" ]; then
-            conclusion="success"
-            title="Formatting clean"
-            summary="Prettier and ESLint --fix produced no changes."
-          else
-            conclusion="neutral"
-            title="Autofix available — comment /autofix to apply"
-            summary="Comment \`/autofix\` on this PR to apply formatter + unused-import fixes (works at any diff size). Or run \`npm run lint:fix && npm run format\` locally."
-          fi
-
-          gh api -X POST "repos/${GH_REPO}/check-runs" \
-            -f name="gitnexus/autofix" \
-            -f head_sha="${HEAD_SHA}" \
-            -f status="completed" \
-            -f conclusion="${conclusion}" \
-            -f "output[title]=${title}" \
-            -f "output[summary]=${summary}" \
-            >/dev/null
-          echo "Posted check-run gitnexus/autofix=${conclusion} (${title})"

.github/workflows/pr-autofix.yml

@@ -1,146 +0,0 @@
-name: PR Autofix
-
-# UNTRUSTED HALF of the autofix pipeline.
-#
-# Runs `npm run lint:fix` + `npm run format` against the PR head
-# (including fork heads) and uploads the resulting diff as an artifact.
-# This job has NO privileged token and CANNOT post to the PR. The trusted
-# `pr-autofix-publish.yml` workflow downloads the artifact via
-# `workflow_run` and posts a sticky summary comment + Check Run.
-# Contributors apply the patch by commenting `/autofix` on the PR —
-# handled by the separate `pr-autofix-apply.yml` ChatOps workflow.
-#
-# Why the split:
-#   ESLint loads plugins from fork-controlled `node_modules`, so running
-#   it in a job with `pull-requests: write` would let a malicious fork PR
-#   ship a poisoned eslint plugin and execute arbitrary code under that
-#   token. By keeping fork code execution in this job (token: read-only)
-#   and posting from a separate trusted job that never touches fork
-#   code, we get the autofix UX for fork PRs without the supply-chain
-#   hole. (See autofix.ci for the same pattern.)
-#
-# Removes unused imports via `eslint-plugin-unused-imports`, already in
-# devDependencies and wired into the `lint` config.
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-    # Skip lockfile / generated-file PRs entirely — `action-suggester`
-    # cannot post on diffs > ~3k lines (GitHub returns 406) and these
-    # paths produce massive diffs no human wants suggested back inline.
-    paths-ignore:
-      - '**/package-lock.json'
-      - '**/*.snap'
-      - '**/dist/**'
-      - '**/node_modules/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  # Don't cancel in-flight runs; the publish workflow may already be
-  # downloading the artifact and a cancelled untrusted run produces no
-  # signal at all (worse DX than waiting).
-  cancel-in-progress: false
-
-# This workflow runs untrusted fork code. Top-level deny-all and NO
-# job-level grants — the job can only read its own checkout.
-permissions: {}
-
-jobs:
-  autofix:
-    name: autofix
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # PR head commit (not the synthetic merge ref) — we need the
-          # exact tree the contributor pushed so suggestions line up.
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          persist-credentials: false
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
-
-      # `--ignore-scripts` blocks pre/postinstall lifecycle hooks. ESLint
-      # plugins still load from node_modules (that is the actual escape
-      # hatch on a typical fork), but this job has no token to abuse —
-      # which is the whole point of the split.
-      - run: npm ci --ignore-scripts
-
-      - name: ESLint --fix (removes unused imports)
-        run: npm run lint:fix
-        # Lint errors that --fix can't auto-resolve must not block the
-        # diff artifact — partial fixes are still useful as suggestions.
-        continue-on-error: true
-
-      - name: Prettier --write
-        run: npm run format
-        continue-on-error: true
-
-      - name: Capture diff and metadata
-        id: capture
-        # Pass GitHub-context values via env: rather than `${{ }}`
-        # interpolated directly into the bash body. `head.ref` and
-        # `head.repo.full_name` are fork-controlled strings; expanding
-        # them into shell source is the canonical template-injection
-        # vector zizmor flags. Even though this job has `permissions: {}`,
-        # routing through env: makes it impossible for a future scope
-        # grant to turn into RCE. Inside bash, reference as `$HEAD_REF`
-        # etc. — the values are then plain strings, not code.
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          HEAD_REF: ${{ github.event.pull_request.head.ref }}
-          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
-          BASE_REPO: ${{ github.repository }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          mkdir -p autofix-out
-
-          # Produce a unified diff of the working tree vs. the PR head.
-          # Empty diff => nothing to suggest; the publish job short-circuits.
-          git diff --no-color > autofix-out/autofix.patch
-
-          # NOTE: `changed_lines` is the line-count of the patch file,
-          # (hunk headers + context lines + added/removed). Surfaced in
-          # the sticky comment so contributors and AI agents have a
-          # quick size hint before invoking `/autofix`.
-          changed_lines=$(wc -l < autofix-out/autofix.patch | tr -d ' ')
-          echo "changed_lines=${changed_lines}" >> "$GITHUB_OUTPUT"
-
-          # Carry PR identity over to the trusted job. workflow_run
-          # context is base-repo-only, so the publish job needs these
-          # to call the GitHub PR API on the right resource.
-          # CONTRACT: keep this schema in sync with pr-autofix-publish.yml's
-          # `assert_field` validators and the agent-facing JSON block in
-          # the sticky comment. Bump `schema` when changing field names.
-          jq -n \
-            --arg     schema        'gitnexus.pr-autofix/v1' \
-            --argjson pr_number     "${PR_NUMBER}" \
-            --arg     head_sha      "${HEAD_SHA}" \
-            --arg     head_ref      "${HEAD_REF}" \
-            --arg     head_repo     "${HEAD_REPO}" \
-            --arg     base_repo     "${BASE_REPO}" \
-            --argjson changed_lines "${changed_lines}" \
-            '{schema:$schema, pr_number:$pr_number, head_sha:$head_sha, head_ref:$head_ref, head_repo:$head_repo, base_repo:$base_repo, changed_lines:$changed_lines}' \
-            > autofix-out/metadata.json
-
-          echo "--- metadata ---"
-          cat autofix-out/metadata.json
-          echo "--- diff (head) ---"
-          head -c 2000 autofix-out/autofix.patch || true
-
-      # Pinned to v7.0.1. Verify SHA via:
-      #   gh api repos/actions/upload-artifact/git/refs/tags/v7.0.1
-      - name: Upload autofix artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: autofix
-          path: autofix-out/
-          retention-days: 1
-          if-no-files-found: error

.github/workflows/pr-labeler.yml

@@ -35,9 +35,6 @@ on:
   pull_request_target:
     types: [opened, edited, reopened]
 
-permissions:
-  contents: read
-
 # Concurrency convention: see CONTRIBUTING.md → "GitHub Actions — Concurrency Convention".
 # Include `github.event_name` so `pull_request` (validate-title) and
 # `pull_request_target` (autolabel) runs for the same PR do NOT share a slot

.github/workflows/publish.yml

@@ -1,421 +1,61 @@
-name: Publish
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Sole publisher for the `gitnexus` npm package, GitHub Releases, and Docker
-# images. Replaces the former two-workflow design — see issue #1609 for the
-# double-publish race this unification closes.
-#
-# Two release modes, both routed through this file:
-#   • Release candidate (rc)  — triggered by push to `main` or workflow_dispatch.
-#       The RC path computes the next rc version, applies it in-CI, pushes a
-#       detached release commit with v<X.Y.Z>-rc.<N> + rc/<SHA> marker
-#       atomically, then publishes to npm with --tag rc and creates a GitHub
-#       prerelease. RC-only docker.yml invocation follows.
-#   • Stable                  — triggered by push of a v<X.Y.Z> tag (no -rc.*
-#       suffix). Verifies package.json matches the tag, publishes to npm with
-#       --tag latest, creates a stable GitHub Release. No docker (RC-only).
-#
-# ⚠️  SELF-TRIGGER INVARIANT — DO NOT WEAKEN ⚠️
-# The `tags:` filter below uses a negative glob `'!v*-rc.*'` to prevent the
-# workflow from re-triggering itself when the RC path pushes its own v-tag.
-# Without this exclusion, every RC publish double-fires (the bug fixed by
-# #1609). If a NEW prerelease channel is introduced (e.g. `-beta.N`,
-# `-alpha.N`, `-next.N`), the negative-glob list MUST be extended in
-# lock-step or self-trigger returns. The same invariant applies to the
-# `Classify` step further below — its accepted-tag regex must align with
-# the trigger filter's exclusion list.
-# ─────────────────────────────────────────────────────────────────────────────
+name: Publish to npm
 
 on:
   push:
-    branches: [main]
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - 'LICENSE'
     tags:
-      # Negative-globbed exclusion of RC tags this workflow itself produces
-      # (see the SELF-TRIGGER INVARIANT in the header comment).
       - 'v*'
-      - '!v*-rc.*'
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: >-
-          Cycle policy. 'auto' (default) continues the active rc cycle on
-          this branch if there is one, otherwise bumps patch from latest.
-          Choose 'patch' / 'minor' / 'major' to explicitly start or reset
-          an rc cycle.
-        required: false
-        default: 'auto'
-        type: choice
-        options:
-          - auto
-          - patch
-          - minor
-          - major
-      force:
-        description: 'Publish even when HEAD already has an rc marker'
-        required: false
-        default: 'false'
-        type: choice
-        options:
-          - 'false'
-          - 'true'
-# Workflow-level deny-all; each job declares the minimum it needs.
-permissions: {}
 
-# Distinct refs (refs/heads/main, refs/tags/v*) run in parallel. The
-# release-PR-skip in rc-guard is the load-bearing invariant that prevents
-# an RC main-push and a stable tag-push colliding on the same release commit.
+# No workflow-level permissions — scoped per job below.
+
+# Concurrency convention: see CONTRIBUTING.md → "GitHub Actions — Concurrency Convention".
+# Tag refs are unique per release, so distinct tags run in parallel. Re-pushes of the
+# same tag serialize. cancel-in-progress: false — never cancel a publish mid-flight.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
-  # ── Phase 1: classify the triggering event into a release mode ─────────────
-  route:
-    name: Classify release event
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    permissions:
-      contents: read
-    outputs:
-      mode: ${{ steps.classify.outputs.mode }}
-      head_sha: ${{ steps.classify.outputs.head_sha }}
-      bump_input: ${{ inputs.bump }}
-      force_input: ${{ inputs.force }}
-    steps:
-      - name: Classify
-        id: classify
-        shell: bash
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          GH_REF: ${{ github.ref }}
-          GH_REF_NAME: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-
-          HEAD_SHA="${GITHUB_SHA}"
-          echo "head_sha=${HEAD_SHA}" >> "$GITHUB_OUTPUT"
-
-          # Sanitize before logging (annotation-injection defense in depth).
-          REF_SAFE="${GH_REF//::/__}"
-          REF_NAME_SAFE="${GH_REF_NAME//::/__}"
-          echo "event=${EVENT_NAME} ref=${REF_SAFE} ref_name=${REF_NAME_SAFE}"
-
-          MODE=""
-          case "${EVENT_NAME}" in
-            workflow_dispatch)
-              # Manual dispatch is only valid on main — that's the only ref
-              # where a real publish makes sense.
-              if [ "${GH_REF}" = "refs/heads/main" ]; then
-                MODE="rc"
-              else
-                echo "::error::workflow_dispatch is only permitted on refs/heads/main (got ${REF_SAFE})."
-                exit 1
-              fi
-              ;;
-            push)
-              case "${GH_REF}" in
-                refs/heads/main)
-                  MODE="rc"
-                  ;;
-                refs/tags/v*)
-                  # The trigger filter already excluded v*-rc.* tags. Anything
-                  # reaching here is either a stable semver or a malformed v*.
-                  TAG="${GH_REF#refs/tags/}"
-                  if [[ "${TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-                    MODE="stable"
-                  else
-                    echo "::error::malformed v* tag rejected: ${REF_NAME_SAFE}"
-                    echo "::error::stable tags must match ^v[0-9]+\\.[0-9]+\\.[0-9]+\$"
-                    exit 1
-                  fi
-                  ;;
-                *)
-                  echo "::error::unexpected push ref ${REF_SAFE} reached publish workflow."
-                  exit 1
-                  ;;
-              esac
-              ;;
-            *)
-              echo "::error::unsupported event ${EVENT_NAME}."
-              exit 1
-              ;;
-          esac
-
-          echo "mode=${MODE}" >> "$GITHUB_OUTPUT"
-          echo "Classified as mode=${MODE}"
-
-  # ── Phase 2 (RC only): dedup marker + release-PR skip ──────────────────────
-  rc-guard:
-    name: RC guard (marker + release-PR skip)
-    needs: route
-    if: needs.route.outputs.mode == 'rc'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      should_run: ${{ steps.decide.outputs.should_run }}
-      head_sha: ${{ steps.decide.outputs.head_sha }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-          # rc-guard reads only — no git pushes from this job. Skip the
-          # default extraheader credential persistence (artipacked audit).
-          persist-credentials: false
-
-      - name: Decide
-        id: decide
-        shell: bash
-        env:
-          FORCE: ${{ inputs.force }}
-          BUMP_INPUT: ${{ inputs.bump }}
-          EVENT_NAME: ${{ github.event_name }}
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          HEAD_SHA=$(git rev-parse HEAD)
-          echo "head_sha=$HEAD_SHA" >> "$GITHUB_OUTPUT"
-
-          if [ "$FORCE" = "true" ]; then
-            echo "Force flag set — running regardless of marker tag."
-            echo "should_run=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Explicit cycle reset on dispatch bypasses dedup.
-          if [ "$EVENT_NAME" = "workflow_dispatch" ] \
-             && [ -n "${BUMP_INPUT:-}" ] \
-             && [ "${BUMP_INPUT:-auto}" != "auto" ]; then
-            echo "Explicit bump=$BUMP_INPUT — bypassing marker dedup."
-            echo "should_run=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # ── Skip when the merge commit corresponds to a release ───────────
-          # This skip is load-bearing: it prevents an RC build firing on the
-          # release-PR commit from racing the imminent stable-tag push on the
-          # same SHA. Two complementary checks:
-          #   1. HEAD subject matches `chore: release vX.Y.Z` (the canonical
-          #      release-PR title). Anchored to require the bare title or the
-          #      squash-merge `(#NNNN)` suffix exactly. Case-insensitive so
-          #      `Chore: Release v1.2.3` (IDE auto-capitalization) still
-          #      matches — prior commit-author conventions left the door open.
-          #   2. Squash-merged PR carries the `release` label.
-          # Either match suppresses the rc build — stable releases publish on
-          # the v-tag instead.
-          HEAD_SUBJECT="$(git log -1 --pretty=%s HEAD)"
-          # Sanitize GitHub-Actions annotation prefixes before logging — even
-          # though %s strips newlines, a crafted subject containing `::error::`
-          # could forge log annotations.
-          HEAD_SUBJECT_SAFE="${HEAD_SUBJECT//::/__}"
-          RELEASE_SUBJECT_RE='^chore:[[:space:]]*release[[:space:]]+v[0-9]+\.[0-9]+\.[0-9]+([[:space:]]+\(#[0-9]+\))?$'
-          shopt -s nocasematch
-          if [[ "$HEAD_SUBJECT" =~ $RELEASE_SUBJECT_RE ]]; then
-            shopt -u nocasematch
-            echo "HEAD commit subject matches a release commit — skipping rc."
-            echo "  subject (sanitised): $HEAD_SUBJECT_SAFE"
-            echo "should_run=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          shopt -u nocasematch
-
-          # Squash-merge commits include `(#NNNN)` at the end of the subject.
-          if [[ "$HEAD_SUBJECT" =~ \(#([0-9]+)\)[[:space:]]*$ ]]; then
-            PR_NUM="${BASH_REMATCH[1]}"
-            echo "Detected squash-merge of PR #$PR_NUM — checking labels."
-            if LABELS_JSON="$(gh pr view "$PR_NUM" --repo "$REPO" --json labels 2>/dev/null)"; then
-              if printf '%s' "$LABELS_JSON" | jq -e '.labels[] | select(.name == "release")' >/dev/null; then
-                echo "PR #$PR_NUM has the 'release' label — skipping rc."
-                echo "should_run=false" >> "$GITHUB_OUTPUT"
-                exit 0
-              fi
-              echo "PR #$PR_NUM has no 'release' label — proceeding."
-            else
-              # Lookup failure is not fatal — fall through to dedup check.
-              echo "::warning::Could not read labels for PR #${PR_NUM} — falling through."
-            fi
-          fi
-
-          # Dedup: is there already an rc/<HEAD_SHA> marker pointing at HEAD?
-          MARKER="rc/${HEAD_SHA}"
-          if git rev-parse "refs/tags/$MARKER" >/dev/null 2>&1; then
-            echo "HEAD already has marker $MARKER — skipping."
-            echo "should_run=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "No marker on HEAD — proceeding."
-            echo "should_run=true" >> "$GITHUB_OUTPUT"
-          fi
-
-  # ── Phase 3: reusable CI gate ──────────────────────────────────────────────
-  # Runs for both rc (when guard says go) and stable. No `secrets:` passed —
-  # ci.yml and its entire reusable-workflow chain (ci-quality, ci-tests,
-  # ci-e2e, ci-scope-parity, ci-report) reference zero `secrets.*` values;
-  # passing any would be unused surface. GITHUB_TOKEN is implicit.
   ci:
-    needs: [route, rc-guard]
-    if: ${{ always() && (needs.route.outputs.mode == 'stable' || needs.rc-guard.outputs.should_run == 'true') }}
     uses: ./.github/workflows/ci.yml
     permissions:
       contents: read
       actions: read
+      # No pull-requests:write — `ci.yml`'s save-pr-meta job is gated on
+      # `github.event_name == 'pull_request'`, so it never runs during a
+      # tag-triggered publish. Least-privilege for release-critical paths.
 
-  # ── Phase 4: publish to npm + push refs (RC path) ──────────────────────────
-  # INVARIANT: `timeout-minutes` MUST stay below the App-token TTL (~60 min
-  # for actions/create-github-app-token installation tokens). The atomic
-  # tag-push step relies on the token minted at job start; if the job ever
-  # runs longer than the TTL, the push fails with an opaque 401. If you
-  # need to raise the timeout, re-mint the token immediately before the
-  # `Create and push rc tags` step instead.
   publish:
-    name: Publish to npm
-    needs: [route, rc-guard, ci]
-    if: ${{ always() && needs.ci.result == 'success' && (needs.route.outputs.mode == 'stable' || needs.rc-guard.outputs.should_run == 'true') }}
+    needs: ci
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 15
     permissions:
-      # contents: write — RC path needs it for `git push --atomic` (v-tag +
-      # marker). Stable path runs in the same job and inherits the grant; it
-      # never invokes `git push`, so the elevated scope is unused there.
-      # id-token: write — npm provenance attestation.
       contents: write
       id-token: write
-    outputs:
-      # Two distinct step IDs feed this output; exactly one fires per run.
-      vtag: ${{ steps.rc-tags.outputs.vtag || steps.stable-vtag.outputs.vtag }}
     steps:
-      # ── Mint short-lived GitHub App token (RC only) ──────────────────────
-      # Industry direction (2025-2026): GitHub Apps with
-      # `actions/create-github-app-token` over long-lived PATs for
-      # workflow-touching tag pushes. Same fine-grained permission surface,
-      # ~1h expiry, not tied to a user seat, organizationally auditable.
-      # Replaces a prior fine-grained PAT.
-      #
-      # Required secrets (set in repo Settings → Secrets and variables → Actions):
-      #   secrets.RELEASE_APP_ID         — the App's numeric ID
-      #   secrets.RELEASE_APP_PRIVATE_KEY — the App's PEM private key
-      # (The App ID is technically not sensitive — it's visible on the App's
-      # settings page — but storing it as a secret is harmless and avoids
-      # mixing storage classes for the same App.)
-      # The App must be installed on this repository with:
-      #   - Contents: write         (push the v-tag and rc marker)
-      #   - Workflows: write        (because the v-tag's tree may touch
-      #                              .github/workflows/**, which the default
-      #                              GITHUB_TOKEN cannot author)
-      #   - Metadata: read          (required for the `gh api /users/<slug>[bot]`
-      #                              bot-identity lookup in the tag-push step)
-      - name: Mint GitHub App token (RC)
-        if: needs.route.outputs.mode == 'rc'
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          # `client-id` is the renamed input that supersedes the deprecated
-          # `app-id` in v3.x. The action accepts the App's numeric ID or
-          # its Client ID under this name. We pass the numeric App ID,
-          # which the action resolves correctly.
-          client-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-
-      # ── Separate checkout steps per mode ─────────────────────────────────
-      # Conditional `token:` expressions are footguns: empty string passed to
-      # actions/checkout fails opaquely, and `|| github.token` silently
-      # degrades a missing token to GITHUB_TOKEN, masking auth failures until
-      # the eventual `git push`. Two distinct steps make the auth contract
-      # explicit and fail loudly at checkout when the App token mint failed
-      # on the RC path.
-      - name: Checkout (RC)
-        if: needs.route.outputs.mode == 'rc'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-          # Short-lived GitHub App installation token. Required because the
-          # v-tag push lands at a SHA whose tree may touch
-          # `.github/workflows/**`, which the default GITHUB_TOKEN cannot
-          # author.
-          token: ${{ steps.app-token.outputs.token }}
-          # Do not persist the token in .git/config (artipacked audit). The
-          # RC tag push uses an inline `http.extraheader` at push time only;
-          # the credential never lands on disk. See the
-          # `Create and push rc tags` step below.
-          persist-credentials: false
-
-      - name: Checkout (stable)
-        if: needs.route.outputs.mode == 'stable'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        # No `token:` — actions/checkout uses GITHUB_TOKEN by default. Stable
-        # path performs no git pushes; the default scope is sufficient.
-        with:
-          # No git pushes from the stable path either. Skip credential
-          # persistence (artipacked audit).
-          persist-credentials: false
-
-      - name: Working-tree sanity
-        # Defense in depth (mirrors the vtag integrity gate, but on the input side):
-        # if a route-mode regression skipped both checkout `if:` gates, all
-        # downstream steps would run on a bare runner and produce confusing
-        # ENOENT errors. Fail loudly and early here instead.
-        shell: bash
-        run: |
-          if [ ! -f gitnexus/package.json ]; then
-            echo "::error::no working tree at gitnexus/package.json — route classification likely failed silently."
-            exit 1
-          fi
-
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          # Node 24 ships with npm >= 11.5.x, which is the minimum that
-          # supports npm Trusted Publishing OIDC. Node 22 ships with npm
-          # 10.9.x (no OIDC) and `npm install -g npm@latest` to self-upgrade
-          # is fragile — it can crash the in-flight reify with
-          # `MODULE_NOT_FOUND` on `promise-retry` etc. Bumping the Node
-          # version is the clean fix; the package's `engines` field is
-          # `>=22.0.0` so consumer-side compatibility is unaffected (this
-          # Node version is only used during publish, not by package users).
-          node-version: 24
-          # `registry-url:` is intentionally OMITTED. Under npm Trusted
-          # Publishing, OIDC only engages when no credential is configured.
-          # Setting `registry-url:` would make setup-node write
-          # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into the
-          # runner's .npmrc AND export NODE_AUTH_TOKEN from its `token:`
-          # input (default github.token). `npm publish` would then attempt
-          # GITHUB_TOKEN as the npm token, get rejected with 404, and OIDC
-          # would never be tried. See actions/setup-node#1440 and the GitHub
-          # Community discussion #176761 for the upstream bug and consensus
-          # workaround.
-          #
-          # Hermetic install for published artifacts — opt out of the v5+
-          # default packageManager-based caching (clears the zizmor
-          # cache-poisoning audit). ~30s slower per release; runs rarely.
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+          # Hermetic install for the published artifact — no cache carry-over
+          # from non-tag contexts. setup-node v5+ caches by default when a
+          # packageManager field is present in package.json, so the explicit
+          # opt-out is required to clear the zizmor cache-poisoning audit.
+          # ~30s slower per release; runs rarely.
           package-manager-cache: false
-
       - name: Build gitnexus-shared
         run: npm install && npm run build
         working-directory: gitnexus-shared
 
-      - name: Install gitnexus dependencies
-        run: npm ci
+      - run: npm ci
         working-directory: gitnexus
 
-      # ── Stable-only: verify the tag and package.json agree ───────────────
-      - name: Verify version consistency (stable)
-        if: needs.route.outputs.mode == 'stable'
+      - name: Verify version consistency
         shell: bash
-        working-directory: gitnexus
         run: |
-          set -euo pipefail
           TAG_VERSION="${GITHUB_REF#refs/tags/v}"
-          # Stable mode REJECTS prerelease suffixes — those are filtered at
-          # trigger by the negative-glob filter, but defend at the bash layer too.
-          if ! [[ "$TAG_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Stable tag must be ^v[0-9]+.[0-9]+.[0-9]+$ — got v$TAG_VERSION"
+          if ! [[ "$TAG_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Tag does not follow semver: v$TAG_VERSION"
             exit 1
           fi
           PKG_VERSION=$(node -p "require('./package.json').version")
@@ -424,376 +64,24 @@ jobs:
             exit 1
           fi
           echo "Version verified: $PKG_VERSION"
-
-      # ── RC-only: compute the next rc version against the live registry ──
-      - name: Resolve rc version (rc)
-        id: rc-version
-        if: needs.route.outputs.mode == 'rc'
-        shell: bash
         working-directory: gitnexus
-        env:
-          BUMP_INPUT: ${{ inputs.bump }}
-          EVENT_NAME: ${{ github.event_name }}
-          PKG_NAME: gitnexus
-        run: |
-          set -euo pipefail
 
-          # 1. Current published `latest` — the floor for any new rc base.
-          #    Only E404 ("never published") falls back to package.json; any
-          #    other error (network, auth, malformed response) fails fast
-          #    (retry-loud policy: never silently substitute on transient errors).
-          NPM_STDERR_LATEST="$(mktemp)"
-          if CURRENT_LATEST="$(npm view "$PKG_NAME" version 2>"$NPM_STDERR_LATEST")"; then
-            :
-          else
-            if grep -qiE 'E404|not found' "$NPM_STDERR_LATEST"; then
-              CURRENT_LATEST="$(node -p "require('./package.json').version")"
-              echo "Package not on registry (E404) — seeding from package.json: $CURRENT_LATEST"
-            else
-              echo "::error::npm registry unreachable for 'view version':" >&2
-              cat "$NPM_STDERR_LATEST" >&2
-              rm -f "$NPM_STDERR_LATEST"
-              exit 1
-            fi
-          fi
-          rm -f "$NPM_STDERR_LATEST"
-          CURRENT_LATEST_CLEAN="${CURRENT_LATEST%%-*}"
-
-          # 2. Full version list — needed for the counter and active-cycle
-          #    inference. Same E404-only fallback.
-          NPM_STDERR_VERSIONS="$(mktemp)"
-          if VERSIONS_JSON="$(npm view "$PKG_NAME" versions --json 2>"$NPM_STDERR_VERSIONS")"; then
-            :
-          else
-            if grep -qiE 'E404|not found' "$NPM_STDERR_VERSIONS"; then
-              VERSIONS_JSON='[]'
-              echo "No published versions for $PKG_NAME yet (E404)."
-            else
-              echo "::error::npm registry unreachable for 'view versions':" >&2
-              cat "$NPM_STDERR_VERSIONS" >&2
-              rm -f "$NPM_STDERR_VERSIONS"
-              exit 1
-            fi
-          fi
-          rm -f "$NPM_STDERR_VERSIONS"
-
-          # 3. Base selection.
-          #    - workflow_dispatch + bump != auto → explicit cycle reset.
-          #    - Otherwise (push, or dispatch with bump=auto) → continue the
-          #      highest active rc base > latest if any; else patch from latest.
-          # Curated wrapper around `npx semver` — bare npx errors are noisy
-          # and don't distinguish registry-unreachable from invalid-bump-spec.
-          semver_bump() {
-            local kind="$1" current="$2" stderr_file out
-            stderr_file="$(mktemp)"
-            if out="$(npx --yes -p semver@7 semver -i "$kind" "$current" 2>"$stderr_file")"; then
-              rm -f "$stderr_file"
-              printf '%s' "$out"
-              return 0
-            fi
-            echo "::error::semver bump failed (kind=${kind}, current=${current}):" >&2
-            cat "$stderr_file" >&2
-            rm -f "$stderr_file"
-            return 1
-          }
-
-          if [ "$EVENT_NAME" = "workflow_dispatch" ] \
-             && [ -n "${BUMP_INPUT:-}" ] \
-             && [ "${BUMP_INPUT:-auto}" != "auto" ]; then
-            BASE="$(semver_bump "$BUMP_INPUT" "$CURRENT_LATEST_CLEAN")"
-            echo "Explicit bump=$BUMP_INPUT → BASE=$BASE"
-          else
-            cat > /tmp/active_base.mjs <<'NODESCRIPT'
-          const latest = process.env.LATEST;
-          let v;
-          try { v = JSON.parse(process.env.VERSIONS_JSON); } catch { v = []; }
-          if (!Array.isArray(v)) v = [v];
-          const parse = s => s.split(".").map(n => parseInt(n, 10));
-          const gt = (a, b) => {
-            const [A, B] = [parse(a), parse(b)];
-            for (let i = 0; i < 3; i++) if (A[i] !== B[i]) return A[i] > B[i];
-            return false;
-          };
-          const bases = new Set();
-          for (const s of v) {
-            const m = /^(\d+\.\d+\.\d+)-rc\.\d+$/.exec(s);
-            if (m && gt(m[1], latest)) bases.add(m[1]);
-          }
-          if (!bases.size) { process.stdout.write(""); process.exit(0); }
-          const sorted = [...bases].sort((a, b) => gt(a, b) ? 1 : -1);
-          process.stdout.write(sorted[sorted.length - 1]);
-          NODESCRIPT
-            ACTIVE_BASE="$(LATEST="$CURRENT_LATEST_CLEAN" VERSIONS_JSON="$VERSIONS_JSON" node /tmp/active_base.mjs)"
-            if [ -n "$ACTIVE_BASE" ]; then
-              BASE="$ACTIVE_BASE"
-              echo "Continuing active rc cycle → BASE=$BASE"
-            else
-              BASE="$(semver_bump patch "$CURRENT_LATEST_CLEAN")"
-              echo "No active rc cycle → patch bump from latest → BASE=$BASE"
-            fi
-          fi
-
-          # 4. Counter: 1 + max existing N for `${BASE}-rc.*`, else 1.
-          cat > /tmp/next_rc.mjs <<'NODESCRIPT'
-          const base = process.env.BASE;
-          const prefix = base + "-rc.";
-          let v;
-          try { v = JSON.parse(process.env.VERSIONS_JSON); } catch { v = []; }
-          if (!Array.isArray(v)) v = [v];
-          const ns = v
-            .filter(s => typeof s === "string" && s.startsWith(prefix))
-            .map(s => parseInt(s.slice(prefix.length), 10))
-            .filter(n => Number.isInteger(n) && n >= 0);
-          process.stdout.write(String(ns.length ? Math.max(...ns) + 1 : 1));
-          NODESCRIPT
-          NEXT_N="$(BASE="$BASE" VERSIONS_JSON="$VERSIONS_JSON" node /tmp/next_rc.mjs)"
-          RC_VERSION="${BASE}-rc.${NEXT_N}"
-          echo "Computed rc: $RC_VERSION"
-
-          # 5. Defensive: if the exact version already exists on the registry
-          #    (race with another run), abort before re-publishing.
-          NPM_STDERR_EXISTS="$(mktemp)"
-          if npm view "$PKG_NAME@$RC_VERSION" version 2>"$NPM_STDERR_EXISTS" >/dev/null; then
-            rm -f "$NPM_STDERR_EXISTS"
-            echo "::error::Version $RC_VERSION already exists on npm — aborting."
-            exit 1
-          else
-            if grep -qiE 'E404|not found' "$NPM_STDERR_EXISTS"; then
-              rm -f "$NPM_STDERR_EXISTS"
-              # Version doesn't exist — safe to proceed.
-            else
-              echo "::error::npm registry unreachable for existence check:" >&2
-              cat "$NPM_STDERR_EXISTS" >&2
-              rm -f "$NPM_STDERR_EXISTS"
-              exit 1
-            fi
-          fi
-
-          {
-            echo "base=$BASE"
-            echo "rc_n=$NEXT_N"
-            echo "rc_version=$RC_VERSION"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Apply rc version in-CI
-        if: needs.route.outputs.mode == 'rc'
-        shell: bash
-        working-directory: gitnexus
-        run: |
-          set -euo pipefail
-          npm version "${{ steps.rc-version.outputs.rc_version }}" \
-            --no-git-tag-version --allow-same-version
-
-      - name: Build gitnexus
+      - name: Build
         run: npm run build
         working-directory: gitnexus
 
       - name: Dry-run publish
-        # Cheap verification that the tarball assembles before the real publish.
-        shell: bash
+        run: npm publish --dry-run
         working-directory: gitnexus
-        env:
-          NPM_TAG: ${{ needs.route.outputs.mode == 'rc' && 'rc' || 'latest' }}
-        run: npm publish --dry-run --tag "$NPM_TAG"
 
-      # ── Acquire the "rc lock" BEFORE publishing (idempotency anchor) ─────
-      # We create two refs and push atomically:
-      #   v<RC_VERSION>  → annotated tag on a detached release commit whose
-      #                    tree contains the rewritten package.json, so the
-      #                    tag's source matches the npm tarball.
-      #   rc/<HEAD_SHA>  → lightweight tag on HEAD; the guard's dedup key.
-      # Push fails → nothing published. Push succeeds, npm fails → marker
-      # blocks retries until manual cleanup (see Rollback Runbook in plan).
-      - name: Create and push rc tags
-        id: rc-tags
-        if: needs.route.outputs.mode == 'rc'
-        shell: bash
-        working-directory: gitnexus
-        env:
-          RC_VERSION: ${{ steps.rc-version.outputs.rc_version }}
-          HEAD_SHA: ${{ needs.rc-guard.outputs.head_sha }}
-          # Short-lived GitHub App token. Auth is supplied inline at push
-          # time via `http.extraheader` (per GitHub's documented
-          # x-access-token Basic pattern). It is NOT persisted in
-          # .git/config (artipacked audit) — checkout above ran with
-          # `persist-credentials: false`.
-          PUSH_TOKEN: ${{ steps.app-token.outputs.token }}
-          # App's slug from create-github-app-token (e.g. `gitnexus-release-bot`).
-          # Used to attribute the release commit to the App identity rather
-          # than the generic github-actions[bot]. The bot's numeric user-id
-          # is resolved at runtime via the GitHub API (the action does not
-          # expose it directly as of v3.2.0).
-          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          set -euo pipefail
-          VTAG="v${RC_VERSION}"
-          MARKER="rc/${HEAD_SHA}"
-
-          # Resolve the App's bot user-id and construct the noreply email
-          # in the GitHub-canonical `<id>+<slug>[bot]@users.noreply.github.com`
-          # shape. `[bot]` is part of the actual login on GitHub.
-          #
-          # The lookup is wrapped in a bounded retry because the first RC
-          # after App installation may hit propagation delay (404), and
-          # transient api.github.com 5xx during heavy org activity is a real
-          # failure class. Without retry, every transient blip aborts the
-          # entire release after CI has already succeeded.
-          BOT_LOGIN="${APP_SLUG}[bot]"
-          BOT_USER_ID=""
-          api_stderr="$(mktemp)"
-          for attempt in 1 2 3; do
-            if BOT_USER_ID="$(gh api "/users/${BOT_LOGIN}" --jq .id 2>"$api_stderr")" \
-               && [[ "${BOT_USER_ID}" =~ ^[0-9]+$ ]]; then
-              break
-            fi
-            BOT_USER_ID=""
-            if [ "$attempt" -lt 3 ]; then
-              echo "::warning::bot user-id lookup attempt ${attempt} failed; retrying in $((attempt * 5))s"
-              sleep $((attempt * 5))
-            fi
-          done
-          if ! [[ "${BOT_USER_ID}" =~ ^[0-9]+$ ]]; then
-            echo "::error::Could not resolve bot user-id for ${BOT_LOGIN} after 3 attempts."
-            echo "::error::gh api stderr:"
-            cat "$api_stderr" >&2 || true
-            echo "::error::Common causes: (a) newly-installed App — user record still propagating to /users/ (wait ~5min, redispatch with force=true); (b) App lacks Metadata: read permission; (c) transient api.github.com 5xx (redispatch)."
-            rm -f "$api_stderr"
-            exit 1
-          fi
-          rm -f "$api_stderr"
-          git config user.name  "${BOT_LOGIN}"
-          git config user.email "${BOT_USER_ID}+${BOT_LOGIN}@users.noreply.github.com"
-
-          # Detached release commit with the version bump — main stays
-          # pristine, but the v-tag's tree matches the published package
-          # exactly (release-integrity).
-          git add package.json package-lock.json 2>/dev/null || git add package.json
-          git commit -m "release: ${VTAG}" --allow-empty
-          RELEASE_SHA="$(git rev-parse HEAD)"
-          echo "Detached release commit: $RELEASE_SHA"
-
-          git tag -a "$VTAG" "$RELEASE_SHA" -m "$VTAG"
-          git tag "$MARKER" "$HEAD_SHA"
-
-          # Inline auth header. The base64-encoded form is masked as well
-          # as the raw token, because GitHub's secret-masker only masks the
-          # raw value — any subsequent `set -x` / GIT_TRACE line would
-          # otherwise expose the encoded credential.
-          #
-          # `set +x` wraps the compute+mask pair so that if an operator
-          # enables ACTIONS_STEP_DEBUG=true for triage (which turns on
-          # `set -x` globally), the assignment is NOT traced for the one
-          # line between compute and mask-registration. Without this wrap,
-          # debug mode would log `+ auth_header='Authorization: Basic <encoded>'`
-          # exposing a still-valid (~1h) App token.
-          { set +x; } 2>/dev/null
-          auth_header="Authorization: Basic $(printf 'x-access-token:%s' "${PUSH_TOKEN}" | base64 -w0)"
-          echo "::add-mask::${auth_header}"
-          # Re-enable tracing only when explicitly requested via step-debug.
-          if [ "${ACTIONS_STEP_DEBUG:-false}" = "true" ]; then set -x; fi
-
-          # Atomic push of both refs. If either would clobber an existing
-          # remote ref, the push fails and we stop before npm publish.
-          git -c http.extraheader="${auth_header}" \
-              push --atomic origin "refs/tags/$VTAG" "refs/tags/$MARKER"
-
-          {
-            echo "vtag=$VTAG"
-            echo "marker=$MARKER"
-            echo "release_sha=$RELEASE_SHA"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Set vtag (stable)
-        id: stable-vtag
-        if: needs.route.outputs.mode == 'stable'
-        shell: bash
-        # github.ref_name flows in via env to avoid templating into the
-        # shell source (template-injection audit). Even though refs are
-        # constrained by git naming rules, the env-passthrough pattern
-        # makes injection structurally impossible.
-        env:
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          echo "vtag=${REF_NAME}" >> "$GITHUB_OUTPUT"
-
-      # ── vtag integrity gate ──────────────────────────────────────────────
-      # Fail closed before any artifact-producing step (npm publish, Release,
-      # Docker) runs against an empty or mode-mismatched vtag. Prevents the
-      # silent "Release named main" / "Docker tagged from ref fallback"
-      # failure modes that the previous draft was vulnerable to.
-      - name: vtag integrity gate
-        id: vtag-gate
-        shell: bash
-        env:
-          MODE: ${{ needs.route.outputs.mode }}
-          VTAG: ${{ steps.rc-tags.outputs.vtag || steps.stable-vtag.outputs.vtag }}
-        run: |
-          set -euo pipefail
-
-          if [ -z "$VTAG" ]; then
-            echo "::error::vtag is empty — refusing to create GitHub Release or trigger Docker."
-            exit 1
-          fi
-
-          case "$MODE" in
-            rc)
-              if ! [[ "$VTAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
-                echo "::error::vtag '${VTAG}' does not match rc shape ^v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+$"
-                exit 1
-              fi
-              ;;
-            stable)
-              if ! [[ "$VTAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-                echo "::error::vtag '${VTAG}' does not match stable shape ^v[0-9]+.[0-9]+.[0-9]+$"
-                exit 1
-              fi
-              ;;
-            *)
-              echo "::error::unknown mode '${MODE}' at vtag integrity gate."
-              exit 1
-              ;;
-          esac
-
-          echo "vtag verified: ${VTAG} (mode=${MODE})"
-          echo "vtag=${VTAG}" >> "$GITHUB_OUTPUT"
-
-      # npm Trusted Publishing (GA'd 2025-07-31). OIDC authentication only
-      # engages when no npm credential is configured anywhere — the absence
-      # is the signal. Two upstream behaviors had to be neutralized for
-      # this to work:
-      #
-      #   1. setup-node's `registry-url:` is omitted (see the setup-node
-      #      step above). With it, setup-node writes
-      #      `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into
-      #      .npmrc and exports NODE_AUTH_TOKEN from `token:` (defaulting
-      #      to github.token). npm publish then sends GITHUB_TOKEN as the
-      #      bearer credential and the registry returns 404. OIDC is never
-      #      tried because npm thinks it already has a credential.
-      #   2. The runner's bundled npm (10.9.x on Node 22) has no OIDC
-      #      support; the upgrade step above pins it to >= 11.5.1.
-      #
-      # Provenance is auto-attached by the registry on trusted-publisher
-      # publishes — no --provenance flag needed.
-      #
-      # Prerequisite: register the package as a trusted publisher at
-      # https://www.npmjs.com/package/gitnexus/access (Publishing access →
-      # Trusted Publishers → GitHub Actions):
-      #   Owner:       abhigyanpatwari
-      #   Repository:  GitNexus
-      #   Workflow:    publish.yml
-      #   Environment: (none)
       - name: Publish to npm
-        shell: bash
+        run: npm publish --provenance --access public
         working-directory: gitnexus
         env:
-          NPM_TAG: ${{ needs.route.outputs.mode == 'rc' && 'rc' || 'latest' }}
-        run: npm publish --access public --tag "$NPM_TAG"
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      # ── Stable-only: pull CHANGELOG body if present ──────────────────────
-      - name: Extract release notes from CHANGELOG (stable)
+      - name: Extract release notes from CHANGELOG
         id: changelog
-        if: needs.route.outputs.mode == 'stable'
         shell: bash
         run: |
           VERSION="${GITHUB_REF#refs/tags/v}"
@@ -809,90 +97,5 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2
         with:
-          tag_name: ${{ steps.vtag-gate.outputs.vtag }}
-          name: >-
-            ${{ needs.route.outputs.mode == 'rc'
-                && format('Release Candidate {0}', steps.vtag-gate.outputs.vtag)
-                || steps.vtag-gate.outputs.vtag }}
-          prerelease: ${{ needs.route.outputs.mode == 'rc' }}
-          make_latest: ${{ needs.route.outputs.mode == 'stable' && 'true' || 'false' }}
-          # Stable: prefer CHANGELOG body, fall back to auto-generated.
-          # RC: always auto-generated + the prerelease body block below.
-          body_path: >-
-            ${{ needs.route.outputs.mode == 'stable' && steps.changelog.outputs.fallback == 'false'
-                && '/tmp/release-notes.md' || '' }}
-          generate_release_notes: >-
-            ${{ needs.route.outputs.mode == 'rc'
-                || steps.changelog.outputs.fallback == 'true' }}
-          body: >-
-            ${{ needs.route.outputs.mode == 'rc' && format(
-              'Automated release candidate build from `main`.{0}{0}**npm:** `npm install gitnexus@rc`{0}**Version:** `{1}`{0}**Target base:** `{2}` (rc #{3}){0}**Source commit (main):** {4}{0}**Release commit (versioned tree):** {5}{0}{0}Release candidates are pre-stable builds intended for early testing. Stable releases remain on the `latest` dist-tag.',
-              '\n',
-              steps.rc-version.outputs.rc_version,
-              steps.rc-version.outputs.base,
-              steps.rc-version.outputs.rc_n,
-              needs.rc-guard.outputs.head_sha,
-              steps.rc-tags.outputs.release_sha
-            ) || '' }}
-
-      # ── RC partial-failure cleanup ───────────────────────────────────────
-      # If anything after the atomic tag-push step failed (npm publish
-      # blew up, GitHub Release call timed out, etc.), the v-tag and
-      # rc/<SHA> marker are already on origin. External consumers
-      # (Renovate, Dependabot, Releases RSS) can ingest a phantom tag for
-      # a version that was never published to npm. This step deletes them
-      # automatically so the operator's recovery is just "redispatch with
-      # force=true on the next commit", not a manual ref cleanup.
-      #
-      # Scoped strictly to RC + real (non-dry-run) + the rc-tags step
-      # actually produced a vtag (otherwise nothing to clean up). The
-      # App token is still valid (~1h TTL, job timeout 20min).
-      - name: Cleanup pushed tags on partial failure
-        if: ${{ failure() && needs.route.outputs.mode == 'rc' && steps.rc-tags.outputs.vtag != '' }}
-        shell: bash
-        working-directory: gitnexus
-        env:
-          VTAG: ${{ steps.rc-tags.outputs.vtag }}
-          MARKER: ${{ steps.rc-tags.outputs.marker }}
-          PUSH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          set -uo pipefail
-          echo "::warning::Publish step failed after tag push. Cleaning up remote refs to prevent phantom-version ingestion by downstream consumers."
-
-          { set +x; } 2>/dev/null
-          auth_header="Authorization: Basic $(printf 'x-access-token:%s' "${PUSH_TOKEN}" | base64 -w0)"
-          echo "::add-mask::${auth_header}"
-          if [ "${ACTIONS_STEP_DEBUG:-false}" = "true" ]; then set -x; fi
-
-          # Delete v-tag and marker. Each delete is best-effort — if one
-          # is already absent (atomic push partially rejected, or earlier
-          # cleanup ran), the other still gets attempted.
-          for ref in "refs/tags/${VTAG}" "refs/tags/${MARKER}"; do
-            if git -c http.extraheader="${auth_header}" push origin --delete "${ref}" 2>&1; then
-              echo "deleted origin ${ref}"
-            else
-              echo "::warning::could not delete origin ${ref} — may already be absent or protected. Manual cleanup may be required."
-            fi
-          done
-
-          echo "::notice::Cleanup complete. To retry the release, redispatch the workflow with force=true on the same SHA, or push a new commit to main."
-
-  # ── Phase 5 (RC only): Docker images ───────────────────────────────────────
-  # R6: Docker remains RC-only. Stable Docker builds are explicitly deferred.
-  # Secrets are passed explicitly (not via `secrets: inherit`) so the
-  # callee's secret surface is auditable from the caller's source.
-  docker:
-    name: Build & Push RC Docker images
-    needs: [route, publish]
-    if: ${{ needs.route.outputs.mode == 'rc' && needs.publish.outputs.vtag != '' }}
-    uses: ./.github/workflows/docker.yml
-    secrets:
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    with:
-      tag: ${{ needs.publish.outputs.vtag }}
+          body_path: ${{ steps.changelog.outputs.fallback == 'false' && '/tmp/release-notes.md' || '' }}
+          generate_release_notes: ${{ steps.changelog.outputs.fallback == 'true' }}

.github/workflows/release-candidate.yml

@@ -0,0 +1,409 @@
+name: Release Candidate
+
+on:
+  # Publish a release-candidate build whenever a merge/commit lands on main.
+  # Docs/README-only changes are filtered out so prose updates don't
+  # cut a release.
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: >-
+          Cycle policy. 'auto' (default) continues the active rc cycle on
+          this branch if there is one, otherwise bumps patch from latest.
+          Choose 'patch' / 'minor' / 'major' to explicitly start or reset
+          an rc cycle.
+        required: false
+        default: 'auto'
+        type: choice
+        options:
+          - auto
+          - patch
+          - minor
+          - major
+      force:
+        description: 'Publish even when HEAD already has an rc marker'
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'false'
+          - 'true'
+
+# No workflow-level permissions — scoped per job below.
+permissions: {}
+
+# Concurrency convention: see CONTRIBUTING.md → "GitHub Actions — Concurrency Convention".
+# Serialize all runs on the same ref (push + workflow_dispatch) to prevent two publishes
+# racing on the rc counter. cancel-in-progress: false — the earlier merge publishes first.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # ── Skip when HEAD already has an rc marker (retry / duplicate dispatch) ──
+  # The marker is a lightweight tag `rc/<HEAD_SHA>` pushed *before* `npm
+  # publish`, so a failed publish leaves the marker in place and the guard
+  # refuses to re-publish. Recovery path after a partial failure:
+  #   git push --delete origin rc/<HEAD_SHA> v<RC_VERSION>
+  # then redispatch with force=true.
+  guard:
+    name: Check if release candidate should run
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      should_run: ${{ steps.decide.outputs.should_run }}
+      head_sha: ${{ steps.decide.outputs.head_sha }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Decide
+        id: decide
+        shell: bash
+        env:
+          FORCE: ${{ inputs.force }}
+          BUMP_INPUT: ${{ inputs.bump }}
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          HEAD_SHA=$(git rev-parse HEAD)
+          echo "head_sha=$HEAD_SHA" >> "$GITHUB_OUTPUT"
+
+          if [ "$FORCE" = "true" ]; then
+            echo "Force flag set — running regardless of marker tag."
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # An explicit cycle reset on dispatch (bump != auto) also bypasses
+          # the dedup guard — the maintainer is deliberately asking for a
+          # new rc from the same commit.
+          if [ "$EVENT_NAME" = "workflow_dispatch" ] \
+             && [ -n "${BUMP_INPUT:-}" ] \
+             && [ "${BUMP_INPUT:-auto}" != "auto" ]; then
+            echo "Explicit bump=$BUMP_INPUT — bypassing marker dedup."
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Dedup: is there already an rc/<HEAD_SHA> marker pointing at HEAD?
+          MARKER="rc/${HEAD_SHA}"
+          if git rev-parse "refs/tags/$MARKER" >/dev/null 2>&1; then
+            echo "HEAD already has marker $MARKER — skipping."
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "No marker on HEAD — proceeding."
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  # ── Reuse the stable CI workflow ─────────────────────────────────────
+  ci:
+    needs: guard
+    if: needs.guard.outputs.should_run == 'true'
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+    secrets: inherit
+
+  # ── Publish the rc build to npm + create GitHub prerelease ───────────
+  publish:
+    name: Publish release candidate to npm
+    needs: [guard, ci]
+    if: needs.guard.outputs.should_run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      # The default GITHUB_TOKEN cannot be granted `workflows: write`, so
+      # tag pushes that reach a commit which modified `.github/workflows/**`
+      # are rejected with: "refusing to allow a GitHub App to create or
+      # update workflow ... without `workflows` permission". We pass a
+      # fine-grained PAT (RELEASE_PUSH_TOKEN, scoped to this repo with
+      # Contents: write + Workflows: write) to `actions/checkout` so that
+      # the subsequent `git push --atomic` of the v-tag and rc marker
+      # carries the PAT's identity. Job-level GITHUB_TOKEN keeps its
+      # scoped permissions for everything else (npm provenance, etc.).
+      contents: write # push rc tag + marker (via PAT)
+      id-token: write # npm provenance
+    outputs:
+      vtag: ${{ steps.reltag.outputs.vtag }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          # Use the PAT so `origin` is preauthed for `git push`. Without
+          # this the default GITHUB_TOKEN is wired into the remote, and a
+          # workflows-touching tag push is rejected — see the permissions
+          # block above.
+          token: ${{ secrets.RELEASE_PUSH_TOKEN }}
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+          # Hermetic install — release-candidate produces shipped artifacts.
+          # setup-node v5+ caches by default when a packageManager field is
+          # present in package.json; explicit opt-out is required to clear
+          # the zizmor cache-poisoning audit. See cache-poisoning audit.
+          package-manager-cache: false
+
+      - name: Build gitnexus-shared
+        run: npm install && npm run build
+        working-directory: gitnexus-shared
+
+      - name: Install gitnexus dependencies
+        run: npm ci
+        working-directory: gitnexus
+
+      - name: Resolve rc version
+        id: version
+        shell: bash
+        working-directory: gitnexus
+        env:
+          BUMP_INPUT: ${{ inputs.bump }}
+          EVENT_NAME: ${{ github.event_name }}
+          PKG_NAME: gitnexus
+        run: |
+          set -euo pipefail
+
+          # 1. Current published `latest` — the floor for any new rc base.
+          #    Only E404 ("never published") falls back to package.json; any
+          #    other error (network, auth, malformed response) fails fast.
+          NPM_STDERR_LATEST="$(mktemp)"
+          if CURRENT_LATEST="$(npm view "$PKG_NAME" version 2>"$NPM_STDERR_LATEST")"; then
+            :
+          else
+            if grep -q 'E404' "$NPM_STDERR_LATEST"; then
+              CURRENT_LATEST="$(node -p "require('./package.json').version")"
+              echo "Package not on registry (E404) — seeding from package.json: $CURRENT_LATEST"
+            else
+              echo "::error::npm registry unreachable for 'view version':" >&2
+              cat "$NPM_STDERR_LATEST" >&2
+              rm -f "$NPM_STDERR_LATEST"
+              exit 1
+            fi
+          fi
+          rm -f "$NPM_STDERR_LATEST"
+          CURRENT_LATEST_CLEAN="${CURRENT_LATEST%%-*}"
+
+          # 2. Full version list — needed for the counter and for active-cycle
+          #    inference. Same E404-only fallback.
+          NPM_STDERR_VERSIONS="$(mktemp)"
+          if VERSIONS_JSON="$(npm view "$PKG_NAME" versions --json 2>"$NPM_STDERR_VERSIONS")"; then
+            :
+          else
+            if grep -q 'E404' "$NPM_STDERR_VERSIONS"; then
+              VERSIONS_JSON='[]'
+              echo "No published versions for $PKG_NAME yet (E404)."
+            else
+              echo "::error::npm registry unreachable for 'view versions':" >&2
+              cat "$NPM_STDERR_VERSIONS" >&2
+              rm -f "$NPM_STDERR_VERSIONS"
+              exit 1
+            fi
+          fi
+          rm -f "$NPM_STDERR_VERSIONS"
+
+          # 3. Base selection.
+          #    - workflow_dispatch + bump ∈ {patch,minor,major} → explicit cycle
+          #      reset from latest.
+          #    - Everything else (push, or dispatch with bump=auto) → continue
+          #      the highest active rc base > latest if one exists; else
+          #      default to patch from latest.
+          if [ "$EVENT_NAME" = "workflow_dispatch" ] \
+             && [ -n "${BUMP_INPUT:-}" ] \
+             && [ "${BUMP_INPUT:-auto}" != "auto" ]; then
+            BASE="$(npx --yes -p semver@7 semver -i "$BUMP_INPUT" "$CURRENT_LATEST_CLEAN")"
+            echo "Explicit bump=$BUMP_INPUT → BASE=$BASE"
+          else
+            cat > /tmp/active_base.mjs <<'NODESCRIPT'
+          const latest = process.env.LATEST;
+          let v;
+          try { v = JSON.parse(process.env.VERSIONS_JSON); } catch { v = []; }
+          if (!Array.isArray(v)) v = [v];
+          const parse = s => s.split(".").map(n => parseInt(n, 10));
+          const gt = (a, b) => {
+            const [A, B] = [parse(a), parse(b)];
+            for (let i = 0; i < 3; i++) if (A[i] !== B[i]) return A[i] > B[i];
+            return false;
+          };
+          const bases = new Set();
+          for (const s of v) {
+            const m = /^(\d+\.\d+\.\d+)-rc\.\d+$/.exec(s);
+            if (m && gt(m[1], latest)) bases.add(m[1]);
+          }
+          if (!bases.size) { process.stdout.write(""); process.exit(0); }
+          const sorted = [...bases].sort((a, b) => gt(a, b) ? 1 : -1);
+          process.stdout.write(sorted[sorted.length - 1]);
+          NODESCRIPT
+            ACTIVE_BASE="$(LATEST="$CURRENT_LATEST_CLEAN" VERSIONS_JSON="$VERSIONS_JSON" node /tmp/active_base.mjs)"
+            if [ -n "$ACTIVE_BASE" ]; then
+              BASE="$ACTIVE_BASE"
+              echo "Continuing active rc cycle → BASE=$BASE"
+            else
+              BASE="$(npx --yes -p semver@7 semver -i patch "$CURRENT_LATEST_CLEAN")"
+              echo "No active rc cycle → patch bump from latest → BASE=$BASE"
+            fi
+          fi
+
+          # 4. Counter: 1 + max existing N for `${BASE}-rc.*`, else 1.
+          cat > /tmp/next_rc.mjs <<'NODESCRIPT'
+          const base = process.env.BASE;
+          const prefix = base + "-rc.";
+          let v;
+          try { v = JSON.parse(process.env.VERSIONS_JSON); } catch { v = []; }
+          if (!Array.isArray(v)) v = [v];
+          const ns = v
+            .filter(s => typeof s === "string" && s.startsWith(prefix))
+            .map(s => parseInt(s.slice(prefix.length), 10))
+            .filter(n => Number.isInteger(n) && n >= 0);
+          process.stdout.write(String(ns.length ? Math.max(...ns) + 1 : 1));
+          NODESCRIPT
+          NEXT_N="$(BASE="$BASE" VERSIONS_JSON="$VERSIONS_JSON" node /tmp/next_rc.mjs)"
+          RC_VERSION="${BASE}-rc.${NEXT_N}"
+          echo "Computed rc: $RC_VERSION"
+
+          # 5. Defensive: if the exact version already exists on the registry
+          #    (e.g., race with another run), abort before re-publishing.
+          #    Same E404-only pattern used above — a transient network
+          #    failure must fail loudly, not pretend the version is missing.
+          NPM_STDERR_EXISTS="$(mktemp)"
+          if npm view "$PKG_NAME@$RC_VERSION" version 2>"$NPM_STDERR_EXISTS" >/dev/null; then
+            rm -f "$NPM_STDERR_EXISTS"
+            echo "::error::Version $RC_VERSION already exists on npm — aborting."
+            exit 1
+          else
+            if grep -qiE 'E404|not found' "$NPM_STDERR_EXISTS"; then
+              rm -f "$NPM_STDERR_EXISTS"
+              # Version doesn't exist — safe to proceed.
+            else
+              echo "::error::npm registry unreachable for existence check:" >&2
+              cat "$NPM_STDERR_EXISTS" >&2
+              rm -f "$NPM_STDERR_EXISTS"
+              exit 1
+            fi
+          fi
+
+          echo "base=$BASE"             >> "$GITHUB_OUTPUT"
+          echo "rc_n=$NEXT_N"           >> "$GITHUB_OUTPUT"
+          echo "rc_version=$RC_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Apply rc version in-CI
+        shell: bash
+        working-directory: gitnexus
+        run: |
+          set -euo pipefail
+          npm version "${{ steps.version.outputs.rc_version }}" \
+            --no-git-tag-version --allow-same-version
+
+      - name: Build gitnexus
+        run: npm run build
+        working-directory: gitnexus
+
+      - name: Dry-run publish
+        run: npm publish --dry-run --tag rc
+        working-directory: gitnexus
+
+      # ── Acquire the "rc lock" BEFORE publishing (fixes idempotency) ─────
+      # We create two tags and push them atomically:
+      #   v<RC_VERSION>      → annotated tag on a detached release commit
+      #                        whose tree contains the rewritten package.json
+      #                        (so the tag's source matches the npm tarball)
+      #   rc/<HEAD_SHA>      → lightweight tag on HEAD; the guard's dedup key
+      # If this push fails, nothing is published — safe.
+      # If this push succeeds but npm publish fails, the marker stays on
+      # the remote and blocks retries until an operator manually cleans up.
+      - name: Create and push rc tags
+        id: reltag
+        shell: bash
+        working-directory: gitnexus
+        env:
+          RC_VERSION: ${{ steps.version.outputs.rc_version }}
+          HEAD_SHA: ${{ needs.guard.outputs.head_sha }}
+        run: |
+          set -euo pipefail
+          VTAG="v${RC_VERSION}"
+          MARKER="rc/${HEAD_SHA}"
+          git config user.name  'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+
+          # Detached release commit with the version bump — keeps `main`
+          # pristine but gives the v-tag a tree that matches the published
+          # package contents exactly (fixes release-integrity gap).
+          git add package.json package-lock.json 2>/dev/null || git add package.json
+          git commit -m "release: ${VTAG}" --allow-empty
+          RELEASE_SHA="$(git rev-parse HEAD)"
+          echo "Detached release commit: $RELEASE_SHA"
+
+          # Annotated release tag on the release commit.
+          git tag -a "$VTAG" "$RELEASE_SHA" -m "$VTAG"
+          # Lightweight marker on the user-visible HEAD for the guard.
+          git tag "$MARKER" "$HEAD_SHA"
+
+          # Atomic push of both refs. If either would clobber an existing
+          # remote ref, the push fails and we stop before npm publish.
+          git push --atomic origin "refs/tags/$VTAG" "refs/tags/$MARKER"
+
+          echo "vtag=$VTAG"     >> "$GITHUB_OUTPUT"
+          echo "marker=$MARKER" >> "$GITHUB_OUTPUT"
+          echo "release_sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to npm (rc dist-tag)
+        run: npm publish --provenance --access public --tag rc
+        working-directory: gitnexus
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub prerelease
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2
+        with:
+          tag_name: ${{ steps.reltag.outputs.vtag }}
+          name: Release Candidate ${{ steps.reltag.outputs.vtag }}
+          prerelease: true
+          make_latest: 'false'
+          generate_release_notes: true
+          body: |
+            Automated release candidate build from `main`.
+
+            **npm:** `npm install gitnexus@rc`
+            **Version:** `${{ steps.version.outputs.rc_version }}`
+            **Target base:** `${{ steps.version.outputs.base }}` (rc #${{ steps.version.outputs.rc_n }})
+            **Source commit (main):** ${{ needs.guard.outputs.head_sha }}
+            **Release commit (versioned tree):** ${{ steps.reltag.outputs.release_sha }}
+
+            Release candidates are pre-stable builds intended for early testing.
+            Stable releases remain on the `latest` dist-tag.
+
+  # ── Build & push RC Docker images ────────────────────────────────────
+  # Calls docker.yml as a reusable workflow so that the build, signing, and
+  # attestation logic stays in one place. The publish job exposes `vtag`
+  # (e.g. `v1.2.3-rc.1`) as an output so we can pass it as the tag input.
+  # RC images are signed with Cosign keyless signing; the OIDC identity
+  # will be `docker.yml@refs/heads/main` (the caller's ref) rather than a
+  # tag ref — see README.md § Docker for the correct verify command for RCs.
+  docker:
+    name: Build & Push RC Docker images
+    needs: [guard, publish]
+    if: needs.guard.outputs.should_run == 'true' && needs.publish.outputs.vtag != ''
+    uses: ./.github/workflows/docker.yml
+    # Reusable workflows do not receive caller secrets unless inherited; without
+    # this, DOCKERHUB_* / GITHUB_TOKEN are empty in docker.yml → "Username and
+    # password required" on Docker Hub login (see same pattern on `ci:` above).
+    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    with:
+      tag: ${{ needs.publish.outputs.vtag }}

.github/workflows/trivy.yml

@@ -1,28 +1,19 @@
 name: Trivy Image Scan
 
 # Builds Dockerfile.cli and Dockerfile.web, then scans the resulting images
-# for OS-package and language-package CVEs at MEDIUM+ severity.
+# for OS-package and language-package CVEs at HIGH/CRITICAL severity.
 # Findings upload to the Security tab; record-only (does not block merges).
 #
-# Trigger on Dockerfile changes in PRs so base-image/npm-layer remediation can
-# be verified before merge without running image scans on every PR.
+# NOT triggered on PRs — image builds are slow and base-image CVE churn
+# shouldn't gate feature delivery.
 
 on:
-  pull_request:
-    paths:
-      - 'Dockerfile.cli'
-      - 'Dockerfile.web'
-      - 'gitnexus/Dockerfile.test'
-      - '.github/workflows/trivy.yml'
   push:
     branches: [main]
   schedule:
     - cron: '0 8 * * 1'
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
@@ -70,7 +61,7 @@ jobs:
           image-ref: scan-target:${{ matrix.image.name }}
           format: sarif
           output: trivy-${{ matrix.image.name }}.sarif
-          severity: MEDIUM,HIGH,CRITICAL
+          severity: HIGH,CRITICAL
           # Hides CVEs with no available fix in the base image.
           ignore-unfixed: true
           exit-code: '0'

.github/workflows/workflow-lint.yml

@@ -1,13 +1,10 @@
-name: Workflow Lint
+name: Workflow Lint (zizmor)
 
-# Lints .github/workflows/** for both:
-#   - actionlint: YAML syntax, expression typing, shellcheck inside `run:`
-#     blocks, unknown contexts, deprecated runner labels.
-#   - zizmor: security misconfigurations — unpinned actions, dangerous
-#     `${{ }}` interpolation, missing per-job permissions, etc.
+# Lints .github/workflows/** for known GitHub Actions security misconfigurations:
+# unpinned Actions, dangerous ${{ ... }} interpolation in run: blocks,
+# missing per-job permissions:, etc.
 #
-# Scoped to PRs that touch .github/** only — keeps off the typical PR
-# critical path.
+# Scoped to PRs that touch .github/** only — keeps off the typical PR critical path.
 
 on:
   pull_request:
@@ -15,35 +12,11 @@ on:
     paths:
       - '.github/**'
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  actionlint:
-    name: actionlint
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      # Pinned to v2.1.2. Verify SHA via:
-      #   gh api repos/raven-actions/actionlint/git/refs/tags/v2.1.2
-      # The action wraps the upstream `rhysd/actionlint` binary and emits
-      # GitHub-annotation-formatted findings on PRs.
-      - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2
-        with:
-          fail-on-error: true
-
   zizmor:
     runs-on: ubuntu-latest
     timeout-minutes: 10

.github/zizmor.yml

@@ -14,15 +14,6 @@ rules:
       # no checkout of fork code occurs. Header comment in the file documents.
       - ci-report.yml
 
-      # workflow_run is the trusted half of the autofix pipeline. The
-      # untrusted half (pr-autofix.yml) runs fork code with permissions:{}
-      # and produces only a diff artifact (data, not executable code). The
-      # publish job consumes the artifact, allowlist-validates every field
-      # of metadata.json before exporting to $GITHUB_OUTPUT, never checks
-      # out fork code, and never executes anything fork-controlled. Header
-      # comment in the file documents the split.
-      - pr-autofix-publish.yml
-
       # pull_request_target needed by claude-code-action to access secrets
       # and post review comments on fork PRs. Mitigated by: PR checkouts pin
       # the fork's HEAD SHA (not the branch ref) to prevent TOCTOU races,
@@ -37,8 +28,7 @@ rules:
       - pr-labeler.yml
 
   # Note: cache-poisoning is NOT exempted. The two prior findings in
-  # publish.yml and the former release-candidate.yml were fixed structurally
-  # by dropping `cache: npm` from those workflows (matches the pattern used
-  # by PyO3/maturin for the same audit). After the publish-workflow
-  # unification (issue #1609), only publish.yml remains; the same
-  # cache-poisoning hardening applies there.
+  # publish.yml and release-candidate.yml were fixed structurally by
+  # dropping `cache: npm` from those workflows (matches the pattern used
+  # by PyO3/maturin for the same audit). See the commit that added this
+  # file for the rationale.

AGENTS.md

@@ -149,16 +149,11 @@ Indexed as **GitNexus** (4325 symbols, 10556 relationships, 300 execution flows)
 ## Keeping the Index Fresh
 
 ```bash
-npx gitnexus analyze                 # incremental by default; preserves embeddings
-npx gitnexus analyze --force         # full rebuild from scratch (opt out of incremental)
+npx gitnexus analyze                 # basic refresh; preserves any existing embeddings
 npx gitnexus analyze --embeddings    # also generate embeddings for new/changed nodes
 npx gitnexus analyze --drop-embeddings  # explicit opt-in to wipe existing embeddings
 ```
 
-`analyze` runs **incrementally by default**. The pipeline still parses every file every run (cross-file resolution requires it), but tree-sitter parsing is **served from a content-addressed cache** under `.gitnexus/parse-cache/` (per-chunk JSON shards plus `index.json`) for chunks whose file contents haven't changed since the last run. Older installs may still have a legacy single file `.gitnexus/parse-cache.json`, which is read for backward compatibility but no longer written. Only changed-file rows (and their importers) are rewritten in LadybugDB; unchanged-file rows are preserved. Output is byte-equivalent to a full rebuild. Pass `--force` to wipe and re-index from scratch (e.g., to recover from a corrupt index, or after upgrading GitNexus).
-
-The parse cache key is **content-addressed and version-tagged**: it survives `--force` runs, and is automatically invalidated by a `gitnexus` package upgrade (so a new tree-sitter grammar doesn't silently replay stale parse output). Safe to delete the whole `.gitnexus/parse-cache/` directory (and remove any legacy `.gitnexus/parse-cache.json` if present) at any time — it'll be rebuilt on the next analyze.
-
 Check `.gitnexus/meta.json` `stats.embeddings` (0 = none). A plain `analyze` no longer drops existing vectors — pass `--drop-embeddings` to wipe.
 
 > Claude Code: PostToolUse hook detects a stale index after `git commit` and `git merge` and prompts the agent to run `analyze`. The hook does not invoke `analyze` itself.
@@ -174,20 +169,6 @@ Check `.gitnexus/meta.json` `stats.embeddings` (0 = none). A plain `analyze` no
 | Tools/resources/schema reference | `.claude/skills/gitnexus/gitnexus-guide/SKILL.md` |
 | CLI commands (index, status, clean, wiki) | `.claude/skills/gitnexus/gitnexus-cli/SKILL.md` |
 
-## Hook env knobs
-
-The Claude Code hook (`gitnexus/hooks/claude/gitnexus-hook.cjs` and the mirrored plugin copy under `gitnexus-claude-plugin/hooks/`) honours these env vars. Defaults work for normal installations; set them only to override resolution. All path overrides ignore values that do not exist on disk and fall through to the standard resolution chain.
-
-| Env var | Type | Default | Purpose |
-|---------|------|---------|---------|
-| `GITNEXUS_HOOK_CLI_PATH` | path | resolved via package layout / `require.resolve` | Override path to the `gitnexus` CLI entry the hook spawns for `augment`. |
-| `GITNEXUS_HOOK_LSOF_PATH` | path | `lsof` on `PATH` (with `/usr/bin/lsof`, `/usr/sbin/lsof`, `/sbin/lsof` fallbacks) | Override POSIX `lsof` location for the DB-lock probe. |
-| `GITNEXUS_HOOK_PS_PATH` | path | `ps` on `PATH` (with `/bin/ps`, `/usr/bin/ps` fallbacks) | Override POSIX `ps` location. |
-| `GITNEXUS_HOOK_POWERSHELL_PATH` | path | `%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe` (then `SysWOW64`, then `powershell.exe` on `PATH`) | Override Windows PowerShell location used by the Restart-Manager probe. |
-| `GITNEXUS_HOOK_LINUX_PROC_BUDGET_MS` | integer ms | `1200` | Max wall-clock for the Linux `/proc` fd scan before bailing out to the `lsof` fallback. |
-| `GITNEXUS_HOOK_RM_TARGET` | path | derived | Restart-Manager target file (the LadybugDB path under `.gitnexus/`). Set internally by the hook; rarely overridden manually. |
-| `GITNEXUS_DEBUG` | boolean (`1`/`true`) | unset | Verbose stderr from the hook: prints discarded augment-stderr prefixes and one-shot `.ps1` load-failure warnings. |
-
 <!-- gitnexus:end -->
 
 ## Repo reference

CONTRIBUTING.md

@@ -30,17 +30,17 @@ Format: `<type>[(scope)][!]: <subject>`
 
 Allowed types and the release-notes section each one lands in (defined in `.github/release.yml`):
 
-| Type               | Label applied   | Release-notes section                                        |
-| ------------------ | --------------- | ------------------------------------------------------------ |
-| `feat`             | `enhancement`   | 🚀 Features                                                  |
-| `fix`              | `bug`           | 🐛 Bug Fixes                                                 |
-| `perf`             | `performance`   | 🏎️ Performance                                               |
-| `refactor`         | `refactor`      | 🔄 Refactoring                                               |
-| `test`             | `test`          | 🧪 Tests                                                     |
-| `ci`               | `ci`            | 👷 CI/CD                                                     |
-| `build` / `deps`   | `dependencies`  | 📦 Dependencies                                              |
-| `docs`             | `documentation` | (grouped under Other Changes unless a Docs section is added) |
-| `chore` / `revert` | `chore`         | (excluded from release notes)                                |
+| Type | Label applied | Release-notes section |
+|------|---------------|-----------------------|
+| `feat` | `enhancement` | 🚀 Features |
+| `fix` | `bug` | 🐛 Bug Fixes |
+| `perf` | `performance` | 🏎️ Performance |
+| `refactor` | `refactor` | 🔄 Refactoring |
+| `test` | `test` | 🧪 Tests |
+| `ci` | `ci` | 👷 CI/CD |
+| `build` / `deps` | `dependencies` | 📦 Dependencies |
+| `docs` | `documentation` | (grouped under Other Changes unless a Docs section is added) |
+| `chore` / `revert` | `chore` | (excluded from release notes) |
 
 Append `!` to the type (e.g. `feat(api)!: drop /v1 endpoint`) or include `BREAKING CHANGE:` in the PR body to flag a breaking change — the labeler then adds the `breaking` label and the 💥 Breaking Changes section is rendered first.
 
@@ -81,17 +81,17 @@ Every workflow under `.github/workflows/` MUST declare a top-level `concurrency:
   - **Merge queue (`merge_group`)**: when this event is added, use `${{ github.workflow }}-${{ github.event.merge_group.head_ref }}` with `cancel-in-progress: false` (every queue entry is a distinct ref; never cancel).
 - **`cancel-in-progress` policy:**
 
-  | Event                                    | `cancel-in-progress` | Why                              |
-  | ---------------------------------------- | -------------------- | -------------------------------- |
-  | `pull_request` CI run                    | `true`               | New push supersedes old run      |
-  | `push` to `main`                         | `false`              | Every main commit gets validated |
-  | Tag push (`v*` publish)                  | `false`              | Never cancel mid-publish         |
-  | `push` to `main` for release-candidate   | `false`              | Never cancel mid-RC publish      |
-  | `workflow_dispatch` (release/publish)    | `false`              | Manual runs are intentional      |
-  | `workflow_run` (sticky-comment reports)  | `false`              | Serialize, don't race            |
-  | Per-PR bot workflows (`@claude`, review) | `false`              | Serialize comments per PR        |
-  | PR-meta re-checks (pr-description-check) | `true`               | Cheap, latest wins               |
-  | Single-slot utilities (triage sweep)     | `true`               | Latest dispatch supersedes       |
+  | Event | `cancel-in-progress` | Why |
+  |-------|----------------------|-----|
+  | `pull_request` CI run | `true` | New push supersedes old run |
+  | `push` to `main` | `false` | Every main commit gets validated |
+  | Tag push (`v*` publish) | `false` | Never cancel mid-publish |
+  | `push` to `main` for release-candidate | `false` | Never cancel mid-RC publish |
+  | `workflow_dispatch` (release/publish) | `false` | Manual runs are intentional |
+  | `workflow_run` (sticky-comment reports) | `false` | Serialize, don't race |
+  | Per-PR bot workflows (`@claude`, review) | `false` | Serialize comments per PR |
+  | PR-meta re-checks (pr-description-check) | `true` | Cheap, latest wins |
+  | Single-slot utilities (triage sweep) | `true` | Latest dispatch supersedes |
 
 - For workflows that serve multiple events at once (e.g. `ci.yml` handles `pull_request`, `push`, and `workflow_call`), make `cancel-in-progress` event-aware:
 
@@ -103,59 +103,22 @@ Every workflow under `.github/workflows/` MUST declare a top-level `concurrency:
 
 - When adding a new workflow, copy the concurrency block from an existing workflow of the same event shape.
 
-## CI automation contracts
-
-Two workflows produce machine-readable signals on every PR. Coding agents and humans alike can rely on the names and shapes below — change them with intent.
-
-### `gitnexus/autofix`
-
-`pr-autofix.yml` (untrusted) + `pr-autofix-publish.yml` (trusted) run `prettier --write` and `eslint --fix` against the PR head and surface a single ChatOps button on the PR. Three signals are emitted:
-
-| Surface           | Where                                                                                                                                                                                                                                                                                                   | Notes                                                                  |
-| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
-| Sticky PR comment | Top-level comment with the HTML marker `<!-- gitnexus:pr-autofix-summary -->` and heading `## :sparkles: PR Autofix`. Only posted when there is something to fix; clean PRs stay silent.                                                                                                                | Edit-in-place via marker; one comment per PR.                          |
-| Fenced JSON block | Inside the sticky, fenced as `gitnexus-autofix`. Schema `gitnexus.pr-autofix/v2` with fields `state` (`fixes-available`), `pr_number`, `head_sha`, `changed_lines`, `run_id`, and `apply_command` (literal `/autofix`). | Parseable signal — preferred over regexing prose. v1 fields preserved as a superset. |
-| Check Run         | Stable name `gitnexus/autofix` on the PR head SHA. Conclusion: `success` (clean) or `neutral` (`fixes-available`). The neutral title is `Autofix available — comment /autofix to apply`.                                                                                                                | Surfaced under PR Checks; readable via `gh pr checks <pr>`.            |
-
-To detect outcome from an agent: `gh pr checks <pr> --json name,conclusion,output | jq '.[] | select(.name == "gitnexus/autofix")'`.
-
-Forks are supported. The untrusted half runs fork code with `permissions: {}` and ships the diff as an artifact; the trusted publish job consumes only the diff (data, not code) and posts the comment + check run.
-
-#### Applying autofix
-
-Comment `/autofix` on the PR (whole-line, no arguments). The `pr-autofix-apply.yml` workflow:
-
-1. Validates the comment body matches `^/autofix\s*$` exactly. Quoted or inline mentions are silently ignored.
-2. Validates the commenter has `admin`, `write`, or `maintain` permission on the repo, OR is the PR author. Other commenters get a 👎 reaction and a refusal reply.
-3. Locates the most recent successful `pr-autofix.yml` run for the PR's current head SHA, downloads its `autofix` artifact, applies the patch, and pushes a `chore(autofix): ...` commit back to the PR head branch.
-4. Reacts ✅ on success, 👎 on stale-patch / push-failure, and posts a short reply with the apply-run URL in either case.
-
-The apply workflow runs from the default branch's copy of the file regardless of where the comment originates — that's the trust anchor. There is no diff-size cap (the apply workflow uses `git apply` + push, not the GitHub review-comment API).
-
-For fork PRs, the push succeeds only when the contributor has **Allow edits by maintainers** enabled on the PR (the default). When they have disabled it, the workflow fails loud with a 👎 reaction and an explanation comment.
-
-Re-invoking `/autofix` after a successful apply is a safe no-op — the workflow detects the already-applied state via `git apply --check --reverse` and reacts ✅ without pushing.
-
-**Sensitive paths.** The apply workflow refuses any patch that touches `.github/` (workflow files, CODEOWNERS, dependabot config). A malicious PR could ship a custom prettier or ESLint config that reformats workflow YAML; if accepted, those edits would be pushed under `contents: write` without human review. Apply formatter changes to files under `.github/` manually in a normal commit so they get the same review every other workflow change gets.
-
 ## AI-assisted contributions
 
 If you use coding agents, follow project context files (e.g. `AGENTS.md`, `CLAUDE.md`) and avoid drive-by refactors unrelated to the issue. Prefer incremental, test-backed changes.
 
 ## Releases
 
-One workflow ships `gitnexus` to npm — `.github/workflows/publish.yml`. It
-routes between two modes based on the triggering event:
+Two publish workflows ship `gitnexus` to npm:
 
-- **Stable mode** — triggered by pushing any `v<X.Y.Z>` tag (no `-rc.*`
-  suffix; RC tags are excluded at trigger via a negative glob). Publishes to
-  the `latest` dist-tag with a changelog-backed GitHub release. Maintainers
-  are expected to tag from `main` as a convention; the workflow itself does
-  not enforce branch reachability. No Docker build (RC-only).
-- **Release-candidate mode** — runs on every push to `main` (typically a
-  merged PR) plus manual `workflow_dispatch`. Docs-only changes are skipped
-  via `paths-ignore`. Publishes to the `rc` dist-tag with version
-  `X.Y.Z-rc.N` and a GitHub prerelease, where:
+- **Stable** (`.github/workflows/publish.yml`) — triggered by pushing any `v*`
+  tag. Publishes to the `latest` dist-tag with a changelog-backed GitHub
+  release. Maintainers are expected to tag from `main` as a convention; the
+  workflow itself does not enforce branch reachability.
+- **Release Candidate** (`.github/workflows/release-candidate.yml`) — runs on
+  every push to `main` (typically a merged PR) plus manual dispatch. Docs-only
+  changes are skipped via `paths-ignore`. Publishes to the `rc` dist-tag with
+  version `X.Y.Z-rc.N` and a GitHub prerelease, where:
   - `X.Y.Z` is selected automatically. On push (and on dispatch with
     `bump: auto`, the default) the workflow **continues the active rc cycle**:
     if the registry already has `X.Y.Z-rc.*` versions with `X.Y.Z` > current
@@ -172,64 +135,37 @@ routes between two modes based on the triggering event:
     caller's ref — see README.md § Docker for the verify command).
 
   Idempotency: the workflow pushes an `rc/<HEAD_SHA>` marker tag and a
-  `v<RC>` release tag **atomically, before** calling `npm publish`. The
-  RC guard refuses to re-run once the marker exists, so a post-publish
-  failure will not mint a duplicate rc for the same commit. The `v<RC>`
-  tag points at a detached release commit whose `package.json` matches
-  the npm tarball exactly (traceable releases). The RC tag is excluded
-  from this workflow's `push: tags:` filter, so it does **not** re-trigger
-  publishing — preventing the double-publish failure mode tracked in #1609.
-  Recovery after a partial failure: the workflow's `if: failure()` cleanup
-  step in the `publish` job auto-deletes the v-tag and marker on most
-  post-publish failures, so the typical retry is just:
-
-  ```bash
-  gh workflow run publish.yml --ref main -f force=true
-  # or push a new commit to main, which will cut a fresh RC
-  ```
-
-  If auto-cleanup didn't run (e.g. the cleanup step itself failed, or the
-  failure happened in the route/rc-guard phase before the marker was
-  pushed), manual cleanup is:
+  `v<RC>` release tag **atomically, before** calling `npm publish`. The guard
+  refuses to re-run once the marker exists, so a post-publish failure will
+  not mint a duplicate rc for the same commit. The `v<RC>` tag points at a
+  detached release commit whose `package.json` matches the npm tarball
+  exactly (traceable releases). Recovery after a partial failure:
 
   ```bash
   git push --delete origin rc/<HEAD_SHA> v<RC>
-  # then redispatch with force: true
+  # then redispatch the workflow with force: true
   ```
 
-  **Release-PR-skip subject pattern.** The rc-guard job recognizes a
-  squash-merged release commit by matching the commit subject against
-  `^chore: release vX.Y.Z` (optionally followed by ` (#NNNN)` for the
-  squash-merge PR-number suffix). Match is case-insensitive — `Chore: Release v1.2.3`
-  works too. PRs that should suppress the RC build must either use this
-  subject shape, or carry the `release` label so the label-based fallback
-  fires. Other release-style subjects (`chore(release): v1.2.3`,
-  `release: v1.2.3`) will NOT trigger the skip — please name the release
-  PR exactly `chore: release vX.Y.Z` to keep the dedup deterministic.
-
   **Docker-only partial failure:** if `publish` succeeds (npm tarball + tags
   are live) but the `docker` job subsequently fails (e.g. GHCR flakiness),
   the npm RC is already published and the `rc/<HEAD_SHA>` marker is in place.
-  Recovery without cutting a new RC:
+  Re-running `release-candidate.yml` with `force: true` will abort at the
+  "Version already exists on npm" guard. To recover without cutting a new RC:
 
   ```bash
-  # Re-run only the failed docker job from the original workflow run:
-  gh run rerun <run-id> --failed
+  # 1. Manually trigger only the docker workflow, passing the existing RC tag:
+  gh workflow run docker.yml --ref main -f tag=v<RC_VERSION>
+  # (requires a workflow_dispatch trigger on docker.yml — see note below)
   ```
 
-  Find the run ID via `gh run list --workflow=publish.yml --branch main`.
-  `docker.yml` intentionally has no `workflow_dispatch` trigger (images are
-  tag-driven by design), so the gh-run-rerun path is the supported recovery.
-
-  **GitHub Release transient failure** (npm publish succeeded, Release step
-  failed): the npm artifact is live but no GitHub Release page exists.
-  Recover by either re-running the failed job (`gh run rerun <run-id> --failed`),
-  or creating the Release manually:
-
-  ```bash
-  gh release create v<RC> --prerelease --generate-notes        # RC
-  gh release create v<X.Y.Z> --notes-file gitnexus/CHANGELOG.md # stable
-  ```
+  Because `docker.yml` intentionally has no `workflow_dispatch` (images are
+  tag-driven by design), the practical recovery options are:
+  - Wait for the next commit on `main`, which will cut a new RC that includes
+    the Docker build.
+  - Manually run `docker build` + `docker push` locally and sign with Cosign
+    against the same digest.
+  - Delete `rc/<HEAD_SHA>` and `v<RC>` tags, then redispatch with `force:
+    true` to re-run the full RC pipeline (cuts a new RC number).
 
 The rc workflow never moves `latest`. To verify after a change, inspect dist-tags:
 

Dockerfile.cli

@@ -1,32 +1,24 @@
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
-# Pinned npm version used to replace the bundled npm in the upstream Node
-# image. Bumping requires a coordinated update in Dockerfile.web and
-# gitnexus/Dockerfile.test so all images bootstrap the same npm.
-ARG NPM_VERSION=11.14.1
 
-# -- Builder -----------------------------------------------------------
+# ── Builder ────────────────────────────────────────────────────────────
 # Native modules (tree-sitter-*, onnxruntime-node, node-gyp builds for
 # tree-sitter-proto / tree-sitter-swift) require python3 + a C/C++ toolchain.
-# node:22-bookworm-slim
-FROM node:22-bookworm-slim@sha256:9f6d5975c7dca860947d3915877f85607946403fc55349f39b4bc3688448bb6e AS builder
-ARG NPM_VERSION
+FROM node:22-trixie-slim AS builder
 
 WORKDIR /app
 
-RUN npx --yes npm@${NPM_VERSION} install -g npm@${NPM_VERSION}
-
 # Toolchain for node-gyp / native builds.
 RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ git && rm -rf /var/lib/apt/lists/*
 
-# Build gitnexus-shared first - gitnexus depends on it as a workspace.
+# Build gitnexus-shared first — gitnexus depends on it as a workspace.
 COPY gitnexus-shared/package.json gitnexus-shared/package-lock.json ./gitnexus-shared/
 RUN npm ci --prefix gitnexus-shared
 COPY gitnexus-shared ./gitnexus-shared
 RUN rm -f gitnexus-shared/tsconfig.tsbuildinfo
 RUN npm run build --prefix gitnexus-shared
 
-# Copy the full gitnexus package before installing - `npm ci` triggers
+# Copy the full gitnexus package before installing — `npm ci` triggers
 # `postinstall` (patches tree-sitter-swift, builds the vendored
 # tree-sitter-proto) and `prepare` (compiles TypeScript via scripts/build.js),
 # both of which need the source tree.
@@ -36,15 +28,11 @@ RUN npm ci --prefix gitnexus
 # Drop dev dependencies for a smaller runtime layer.
 RUN npm prune --omit=dev --prefix gitnexus
 
-# -- Runtime -----------------------------------------------------------
-# node:22-bookworm-slim
-FROM node:22-bookworm-slim@sha256:9f6d5975c7dca860947d3915877f85607946403fc55349f39b4bc3688448bb6e AS runtime
+# ── Runtime ────────────────────────────────────────────────────────────
+FROM node:22-trixie-slim AS runtime
 
-# curl for the healthcheck; git for cloning; ca-certificates for TLS verification.
-RUN apt-get update && apt-get install -y --no-install-recommends curl git ca-certificates && rm -rf /var/lib/apt/lists/* \
-    && rm -rf /usr/local/lib/node_modules/npm \
-    && rm -rf /usr/local/lib/node_modules/corepack \
-    && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack
+# curl for the healthcheck; git so `gitnexus` can clone repos at runtime.
+RUN apt-get update && apt-get install -y --no-install-recommends curl git && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -55,21 +43,11 @@ RUN mkdir -p /data/gitnexus && chown -R node:node /data
 COPY --from=builder --chown=node:node /app/gitnexus/dist ./gitnexus/dist
 COPY --from=builder --chown=node:node /app/gitnexus/node_modules ./gitnexus/node_modules
 COPY --from=builder --chown=node:node /app/gitnexus/package.json ./gitnexus/package.json
-COPY --from=builder --chown=node:node /app/gitnexus/scripts/install-duckdb-extension.mjs ./gitnexus/scripts/install-duckdb-extension.mjs
 COPY --from=builder --chown=node:node /app/gitnexus/vendor ./gitnexus/vendor
 
-# Expose the `gitnexus` binary on PATH so the documented Docker workflow
-# (`docker compose exec gitnexus-server gitnexus index /workspace/<repo>`)
-# works without users having to invoke `node /app/gitnexus/dist/cli/index.js`.
-# `npm prune --omit=dev` in the builder stage strips `node_modules/.bin/`
-# entries, so the `gitnexus` bin declared in package.json (`dist/cli/index.js`,
-# which already carries `#!/usr/bin/env node` and 755 perms) is otherwise
-# unreachable from $PATH.
-RUN ln -s /app/gitnexus/dist/cli/index.js /usr/local/bin/gitnexus
-
 USER node
 
-# The web UI defaults to http://localhost:4747 - keep that contract.
+# The web UI defaults to http://localhost:4747 — keep that contract.
 ENV GITNEXUS_HOME=/data/gitnexus \
     NODE_ENV=production \
     PORT=4747

Dockerfile.web

@@ -1,17 +1,10 @@
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
-# Pinned npm version — keep in sync with Dockerfile.cli and
-# gitnexus/Dockerfile.test.
-ARG NPM_VERSION=11.14.1
 
-# node:22-bookworm-slim
-FROM --platform=$BUILDPLATFORM node:22-bookworm-slim@sha256:9f6d5975c7dca860947d3915877f85607946403fc55349f39b4bc3688448bb6e AS builder
-ARG NPM_VERSION
+FROM --platform=$BUILDPLATFORM node:22-alpine AS builder
 
 WORKDIR /app
 
-RUN npx --yes npm@${NPM_VERSION} install -g npm@${NPM_VERSION}
-
 COPY gitnexus-shared/package.json gitnexus-shared/package-lock.json ./gitnexus-shared/
 RUN npm ci --prefix gitnexus-shared
 
@@ -26,13 +19,9 @@ RUN npm ci --prefix gitnexus-web
 COPY gitnexus-web ./gitnexus-web
 RUN npm run build --prefix gitnexus-web
 
-# node:22-bookworm-slim
-FROM node:22-bookworm-slim@sha256:9f6d5975c7dca860947d3915877f85607946403fc55349f39b4bc3688448bb6e AS runtime
+FROM node:22-alpine AS runtime
 
-RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/* \
-    && rm -rf /usr/local/lib/node_modules/npm \
-    && rm -rf /usr/local/lib/node_modules/corepack \
-    && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack
+RUN apk add --no-cache curl
 
 WORKDIR /app
 

GUARDRAILS.md

@@ -30,15 +30,9 @@ Format: **Trigger → Instruction → Reason**. Append new Signs when the same m
 ### Stale graph after edits
 
 - **Trigger:** MCP warns index is behind `HEAD`, or search doesn't match latest commit.
-- **Do:** `npx gitnexus analyze` (plus `--embeddings` if used). Runs incrementally by default — the pipeline parses every file every run (cross-file resolution requires it), but tree-sitter dispatch is skipped for unchanged file chunks via the content-addressed cache, and only changed-file rows (plus their importers, transitively) are rewritten in LadybugDB.
+- **Do:** `npx gitnexus analyze` (plus `--embeddings` if used).
 - **Why:** Tools query LadybugDB from last analyze; git changes are invisible until re-indexed.
 
-### Index seems corrupt or "incremental" is misbehaving
-
-- **Trigger:** `analyze` produces unexpected results, or `meta.json.incrementalInProgress` is set, or the index is in a half-state after a crash.
-- **Do:** `npx gitnexus analyze --force` to rebuild from scratch. The dirty-flag check forces this automatically when a previous incremental run didn't complete cleanly, but `--force` is the manual escape hatch. Safe to delete the `.gitnexus/parse-cache/` directory (and any legacy `.gitnexus/parse-cache.json`) at any time — content-addressed, will be regenerated.
-- **Why:** Incremental writeback is selective DB row replacement; if the on-disk state is inconsistent for any reason, a full rebuild is the cheapest path back to a known-good index.
-
 ### Embeddings vanished after analyze
 
 - **Trigger:** Semantic search quality drops; `stats.embeddings` in `meta.json` is 0 after refresh.

README.md

@@ -120,7 +120,7 @@ To configure MCP for your editor, run `npx gitnexus setup` once — or set it up
 | Editor                | MCP | Skills | Hooks (auto-augment) | Support        |
 | --------------------- | --- | ------ | -------------------- | -------------- |
 | **Claude Code** | Yes | Yes    | Yes (PreToolUse + PostToolUse) | **Full** |
-| **Cursor**      | Yes | Yes    | Yes (postToolUse, [manual install](gitnexus-cursor-integration/README.md#hook-install)) | **Full** |
+| **Cursor**      | Yes | Yes    | —                   | MCP + Skills   |
 | **Codex**       | Yes | Yes    | —                   | MCP + Skills   |
 | **Windsurf**    | Yes | —     | —                   | MCP            |
 | **OpenCode**    | Yes | Yes    | —                   | MCP + Skills   |
@@ -214,7 +214,6 @@ gitnexus clean --all --force     # Delete all indexes
 gitnexus wiki [path]             # Generate repository wiki from knowledge graph
 gitnexus wiki --model <model>    # Wiki with custom LLM model (default: gpt-4o-mini)
 gitnexus wiki --base-url <url>   # Wiki with custom LLM API base URL
-gitnexus publish                 # Notify the understand-quickly registry (opt-in, see below)
 
 # Repository groups (multi-repo / monorepo service tracking)
 gitnexus group create <name>                                   # Create a repository group
@@ -229,12 +228,6 @@ gitnexus group status <name>     # Check staleness of repos in a group
 
 If `analyze` reports a worker parse timeout on a large or unusual repository, it keeps running and falls back safely. To give slow worker jobs more time, use `gitnexus analyze --worker-timeout 60` or set `GITNEXUS_WORKER_SUB_BATCH_TIMEOUT_MS=60000`. For very large files, `GITNEXUS_WORKER_SUB_BATCH_MAX_BYTES` controls the worker job byte budget.
 
-#### Publishing to understand-quickly (opt-in)
-
-[`looptech-ai/understand-quickly`](https://github.com/looptech-ai/understand-quickly) is a public registry of code-knowledge graphs that lists `gitnexus@1` as a first-class format. After registering your repo once (`npx @understand-quickly/cli add` or the [wizard](https://looptech-ai.github.io/understand-quickly/add.html)), `gitnexus publish` fires a single `repository_dispatch` event so the registry resyncs your entry on demand instead of waiting for the nightly job.
-
-It is opt-in and a no-op without `UNDERSTAND_QUICKLY_TOKEN` — a fine-grained GitHub PAT with `Repository dispatches: write` on the registry repo. Nothing else happens; no graph file is uploaded. See the [protocol spec](https://github.com/looptech-ai/understand-quickly/blob/main/docs/integrations/protocol.md) for the full contract.
-
 ### What Your AI Agent Gets
 
 **16 tools** exposed via MCP (11 per-repo + 5 group):
@@ -429,7 +422,7 @@ The Docker images are version-locked to the npm package:
   Both registries receive the same digest from a single build step, so you can
   pull from either and the signature verifies identically.
 - Release-candidate images (e.g. `:1.7.0-rc.1`) are published alongside each
-  RC npm release. They are built by `publish.yml` calling `docker.yml`
+  RC npm release. They are built by `release-candidate.yml` calling `docker.yml`
   as a reusable workflow after the RC tag is created and pushed.
 - `:latest` is auto-promoted only from non-prerelease tags by the Docker
   metadata action, so it always points at a real, npm-published version.
@@ -462,7 +455,7 @@ registries because both sets of tags were signed at the same digest in one
 workflow run.
 
 **Release candidates** — signed from `refs/heads/main` (the caller's ref when
-`publish.yml` invokes `docker.yml` as a reusable workflow):
+`release-candidate.yml` invokes `docker.yml` as a reusable workflow):
 
 ```bash
 cosign verify ghcr.io/abhigyanpatwari/gitnexus:1.7.0-rc.1 \
@@ -722,12 +715,6 @@ gitnexus wiki --base-url https://api.anthropic.com/v1
 
 # Force full regeneration
 gitnexus wiki --force
-
-
-# Increase the timeout or retries for large codebase or slow LLM providers
-gitnexus wiki --timeout <seconds> # LLM request timeout in seconds (default: disabled)
-gitnexus wiki --retries <n>      # Max LLM retry attempts per request (default: 3)
-
 ```
 
 The wiki generator reads the indexed graph structure, groups files into modules via LLM, generates per-module documentation pages, and creates an overview page — all with cross-references to the knowledge graph.

eslint-rules/require-safe-parse.mjs

@@ -1,95 +0,0 @@
-/**
- * Custom ESLint rule: require `parseSourceSafe(parser, content, ...)` instead
- * of direct `<parser>.parse(<content>, ...)` calls.
- *
- * Background: tree-sitter's Node.js native binding crashes with SIGSEGV on
- * Windows when handed a JS string longer than 32 767 chars. The crash happens
- * inside the binding's V8 string-to-buffer conversion and cannot be intercepted
- * by JavaScript `try/catch`. `parseSourceSafe` (in
- * `gitnexus/src/core/tree-sitter/safe-parse.ts`) routes large inputs through
- * the chunked-callback overload of `parser.parse(input, ...)` which bypasses
- * the broken conversion path. PR #1433 fixed every direct call site at the
- * time; this rule prevents new direct calls from creeping in.
- *
- * The rule is auto-fixable for the call-site rewrite. It does NOT auto-add the
- * import (computing the correct relative path per file is brittle); after the
- * call rewrite runs, the consumer file's `tsc` will complain about an
- * undefined identifier and the developer adds the import. This is the same
- * tradeoff `unused-imports/no-unused-imports` makes in the opposite direction.
- *
- * False-positive suppression:
- * - Skips calls whose receiver is a known non-tree-sitter library (`JSON`,
- *   `URL`, `marked`, `Number`).
- * - Skips calls whose first argument is a string-literal (grammar-load smoke
- *   tests like `_testParser.parse('service X { rpc Y (R) returns (R); }')`).
- * - Skips test files (`.test.ts`/`.test.tsx`/`.spec.ts`).
- * - Skips the `safe-parse.ts` helper itself.
- */
-
-const SKIPPED_RECEIVERS = new Set(['JSON', 'URL', 'marked', 'Number', 'Math']);
-
-export default {
-  meta: {
-    type: 'problem',
-    docs: {
-      description:
-        'Require parseSourceSafe instead of direct tree-sitter `<parser>.parse(content, ...)` calls (Windows SIGSEGV protection)',
-      recommended: true,
-    },
-    fixable: 'code',
-    schema: [],
-    messages: {
-      useSafeParse:
-        'Direct `{{receiver}}.parse(...)` can SIGSEGV on Windows for inputs > 32 767 chars (uncatchable from JS). Use `parseSourceSafe({{receiver}}, ...)` from `core/tree-sitter/safe-parse.js`. Auto-fix rewrites the call; add the missing import yourself.',
-    },
-  },
-  create(context) {
-    const filename = context.filename ?? context.getFilename();
-    // Don't lint the helper itself or test files.
-    if (filename.includes('safe-parse')) return {};
-    if (/[.](?:test|spec)\.tsx?$/.test(filename)) return {};
-
-    const sourceCode = context.sourceCode ?? context.getSourceCode();
-
-    return {
-      CallExpression(node) {
-        const callee = node.callee;
-        if (callee.type !== 'MemberExpression') return;
-        if (callee.computed) return;
-        if (callee.property.type !== 'Identifier') return;
-        if (callee.property.name !== 'parse') return;
-
-        // Skip known non-tree-sitter receivers.
-        if (callee.object.type === 'Identifier' && SKIPPED_RECEIVERS.has(callee.object.name)) {
-          return;
-        }
-
-        // Smoke tests pass a string literal directly; those are trivially safe.
-        const firstArg = node.arguments[0];
-        if (!firstArg) return;
-        if (firstArg.type === 'Literal' && typeof firstArg.value === 'string') return;
-        if (firstArg.type === 'TemplateLiteral' && firstArg.expressions.length === 0) return;
-
-        const receiverText = sourceCode.getText(callee.object);
-        // Receiver-text-shape skip: anything matching well-known JS APIs that
-        // happen to have a `.parse(<expr>)` shape but aren't tree-sitter.
-        if (
-          /^(JSON|URL|marked|Number|Math|Date|globalThis\.JSON)\b/.test(receiverText) ||
-          /\bjson\.parse\b/i.test(receiverText)
-        ) {
-          return;
-        }
-
-        context.report({
-          node,
-          messageId: 'useSafeParse',
-          data: { receiver: receiverText },
-          fix(fixer) {
-            const argsText = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
-            return fixer.replaceText(node, `parseSourceSafe(${receiverText}, ${argsText})`);
-          },
-        });
-      },
-    };
-  },
-};

eslint.config.mjs

@@ -3,15 +3,6 @@ import tsParser from '@typescript-eslint/parser';
 import unusedImports from 'eslint-plugin-unused-imports';
 import reactHooks from 'eslint-plugin-react-hooks';
 import prettierConfig from 'eslint-config-prettier';
-import requireSafeParse from './eslint-rules/require-safe-parse.mjs';
-
-// Local plugin hosting custom rules that enforce GitNexus-specific invariants
-// (currently: the Windows-SIGSEGV-safe parser entrypoint).
-const gitnexusLocalPlugin = {
-  rules: {
-    'require-safe-parse': requireSafeParse,
-  },
-};
 
 // Selectors that protect MCP-reachable code from corrupting the JSON-RPC
 // stdio frame stream. The MCP-reachable block below uses these directly;
@@ -144,23 +135,6 @@ export default [
     },
   },
 
-  // Windows SIGSEGV protection: every tree-sitter parse in `core/` must route
-  // through parseSourceSafe. Direct `<parser>.parse(content, ...)` crashes on
-  // Windows for inputs > 32 767 chars (V8 string-conversion bug, uncatchable
-  // from JS). The rule auto-fixes the call site; the developer adds the
-  // missing import after the fix runs. Out of scope: tests (skipped by the
-  // rule), the helper itself (`safe-parse.ts`), and the `grpc-patterns/proto.ts`
-  // grammar-load smoke test (filtered by string-literal-arg skip in the rule).
-  {
-    files: ['gitnexus/src/core/**/*.ts'],
-    plugins: {
-      gitnexus: gitnexusLocalPlugin,
-    },
-    rules: {
-      'gitnexus/require-safe-parse': 'error',
-    },
-  },
-
   // React-specific rules for gitnexus-web
   {
     files: ['gitnexus-web/src/**/*.{ts,tsx}'],

eval/uv.lock

@@ -2278,11 +2278,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.6.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
 ]
 
 [[package]]

gitnexus-claude-plugin/hooks/gitnexus-hook.js

@@ -14,8 +14,6 @@
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
-const { acquireHookSlot } = require('./hook-lock.js');
-const { hasGitNexusDbLockedByGitNexusServer } = require('./hook-db-lock-probe.cjs');
 
 /**
  * Read JSON input from stdin synchronously.
@@ -104,28 +102,6 @@ function findGitNexusDir(startDir) {
   return null;
 }
 
-function hasGitNexusServerOwner(gitNexusDir) {
-  return hasGitNexusDbLockedByGitNexusServer(path.join(gitNexusDir, 'lbug'), process.pid);
-}
-
-function extractAugmentContext(stderr) {
-  const output = (stderr || '').trim();
-  const marker = output.indexOf('[GitNexus]');
-  const debug = process.env.GITNEXUS_DEBUG === '1' || process.env.GITNEXUS_DEBUG === 'true';
-  if (debug && output.length > 0) {
-    // Emit the FULL discarded prefix (everything before the marker, or all of
-    // it when no marker is present) so suppressed diagnostics — LadybugDB lock
-    // warnings, parser errors, etc. — remain recoverable on the hook's own
-    // stderr. The untruncated payload lets operators see exactly what was
-    // filtered out instead of a 180-char JSON-quoted preview.
-    const discarded = marker === -1 ? output : output.slice(0, marker).trim();
-    if (discarded.length > 0) {
-      process.stderr.write(`[GitNexus hook] augment stderr discarded prefix:\n${discarded}\n`);
-    }
-  }
-  return marker === -1 ? '' : output.slice(marker).trim();
-}
-
 /**
  * Extract search pattern from tool input.
  */
@@ -193,15 +169,6 @@ function extractPattern(toolName, toolInput) {
  */
 function runGitNexusCli(args, cwd, timeout) {
   const isWin = process.platform === 'win32';
-  const hookCli = process.env.GITNEXUS_HOOK_CLI_PATH;
-  if (hookCli !== undefined && String(hookCli).trim() && fs.existsSync(String(hookCli))) {
-    return spawnSync(process.execPath, [String(hookCli), ...args], {
-      encoding: 'utf-8',
-      timeout,
-      cwd,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-  }
 
   // Detect whether 'gitnexus' is on PATH (cheap check, no execution)
   let useDirectBinary = false;
@@ -250,8 +217,7 @@ function sendHookResponse(hookEventName, message) {
 function handlePreToolUse(input) {
   const cwd = input.cwd || process.cwd();
   if (!path.isAbsolute(cwd)) return;
-  const gitNexusDir = findGitNexusDir(cwd);
-  if (!gitNexusDir) return;
+  if (!findGitNexusDir(cwd)) return;
 
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
@@ -260,28 +226,19 @@ function handlePreToolUse(input) {
 
   const pattern = extractPattern(toolName, toolInput);
   if (!pattern || pattern.length < 3) return;
-  if (hasGitNexusServerOwner(gitNexusDir)) {
-    process.stderr.write('[GitNexus] augment skipped: MCP server owns DB\n');
-    return;
-  }
-
-  const release = acquireHookSlot(gitNexusDir);
-  if (!release) return;
 
   let result = '';
   try {
     const child = runGitNexusCli(['augment', '--', pattern], cwd, 7000);
     if (!child.error && child.status === 0) {
-      result = extractAugmentContext(child.stderr || '');
+      result = child.stderr || '';
     }
   } catch {
     /* graceful failure */
-  } finally {
-    release();
   }
 
-  if (result) {
-    sendHookResponse('PreToolUse', result);
+  if (result && result.trim()) {
+    sendHookResponse('PreToolUse', result.trim());
   }
 }
 

gitnexus-claude-plugin/hooks/hook-db-lock-probe.cjs

@@ -1,238 +0,0 @@
-/**
- * Cross-platform best-effort probe: does another process hold dbPath open
- * with a command line that looks like a GitNexus MCP/serve server?
- *
- * Backends (no user-installed Sysinternals):
- * - Linux: scan procfs under /proc (per-PID fd entries) via stat(2) (dev+inode); works without lsof;
- *   optional lsof fallback when proc scan finds nothing.
- * - macOS / *BSD / etc.: trusted lsof + ps (absolute paths first).
- * - Windows: Restart Manager (rstrtmgr) via bundled PowerShell script +
- *   Win32_Process for command lines; trusted powershell.exe under %SystemRoot%.
- *
- * Fail-open on most errors; fail-closed only on lsof ETIMEDOUT (Unix) or
- * PowerShell ETIMEDOUT (Windows), matching the hook contract.
- */
-
-const fs = require('fs');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-function isGitNexusServerCommand(command) {
-  const hasServerMode = /(?:^|\s)(mcp|serve)(?:\s|$)/.test(command);
-  const hasGitNexus =
-    /(?:^|[/\\\s])gitnexus(?:\.cmd)?(?:\s|$)/.test(command) ||
-    /node_modules[/\\]gitnexus[/\\]/.test(command);
-  return hasServerMode && hasGitNexus;
-}
-
-function resolveHookBinary(tool) {
-  const envKey = tool === 'lsof' ? 'GITNEXUS_HOOK_LSOF_PATH' : 'GITNEXUS_HOOK_PS_PATH';
-  const fromEnv = process.env[envKey];
-  if (fromEnv && String(fromEnv).trim() && fs.existsSync(String(fromEnv))) {
-    return String(fromEnv);
-  }
-  const candidates =
-    tool === 'lsof'
-      ? ['/usr/bin/lsof', '/usr/sbin/lsof', '/sbin/lsof', tool]
-      : ['/bin/ps', '/usr/bin/ps', tool];
-  for (const candidate of candidates) {
-    if (candidate === tool) return tool;
-    try {
-      if (fs.existsSync(candidate)) return candidate;
-    } catch {
-      /* ignore */
-    }
-  }
-  return tool;
-}
-
-function resolveWindowsPowerShellPath() {
-  const fromEnv = process.env.GITNEXUS_HOOK_POWERSHELL_PATH;
-  if (fromEnv && String(fromEnv).trim() && fs.existsSync(String(fromEnv).trim())) {
-    return String(fromEnv).trim();
-  }
-  const root = process.env.SystemRoot || 'C:\\Windows';
-  const ps = path.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-  if (fs.existsSync(ps)) return ps;
-  const psWow = path.join(root, 'SysWOW64', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-  if (fs.existsSync(psWow)) return psWow;
-  return 'powershell.exe';
-}
-
-// Sentinel:
-//   undefined = not loaded yet (try the read)
-//   string    = encoded PowerShell command (successful load)
-//   null      = load attempted and failed (do not retry; warning already emitted)
-let windowsRmListPsEncodedCommandCache;
-let windowsRmListPsLoadFailureWarned = false;
-function getWindowsRmListEncodedCommand() {
-  if (windowsRmListPsEncodedCommandCache !== undefined) {
-    return windowsRmListPsEncodedCommandCache;
-  }
-  try {
-    const ps1Path = path.join(__dirname, 'win-rm-list-json.ps1');
-    const src = fs
-      .readFileSync(ps1Path, 'utf8')
-      .replace(/^\uFEFF/, '')
-      .replace(/\r\n/g, '\n');
-    windowsRmListPsEncodedCommandCache = Buffer.from(src, 'utf16le').toString('base64');
-  } catch (err) {
-    windowsRmListPsEncodedCommandCache = null;
-    if (
-      !windowsRmListPsLoadFailureWarned &&
-      (process.env.GITNEXUS_DEBUG === '1' || process.env.GITNEXUS_DEBUG === 'true')
-    ) {
-      windowsRmListPsLoadFailureWarned = true;
-      const msg = err && err.message ? String(err.message).slice(0, 200) : 'unknown';
-      process.stderr.write(`[GitNexus hook] win-rm-list-json.ps1 load failed: ${msg}\n`);
-    }
-  }
-  return windowsRmListPsEncodedCommandCache;
-}
-
-function hasGitNexusServerOwnerWindows(dbPathAbs, myPid) {
-  const encoded = getWindowsRmListEncodedCommand();
-  if (!encoded) return false;
-  const psExe = resolveWindowsPowerShellPath();
-  const r = spawnSync(
-    psExe,
-    [
-      '-NoProfile',
-      '-NonInteractive',
-      '-ExecutionPolicy',
-      'Bypass',
-      '-STA',
-      '-EncodedCommand',
-      encoded,
-    ],
-    {
-      encoding: 'utf-8',
-      timeout: 6000,
-      stdio: ['ignore', 'pipe', 'ignore'],
-      env: { ...process.env, GITNEXUS_HOOK_RM_TARGET: dbPathAbs },
-    },
-  );
-  // ETIMEDOUT means the PowerShell probe didn't return in time; treat as 'unresponsive process holds DB' → fail-closed (skip augment).
-  if (r.error) return r.error.code === 'ETIMEDOUT';
-  if (r.status !== 0) return false;
-  let rows;
-  try {
-    rows = JSON.parse(String(r.stdout || '').trim() || '[]');
-  } catch {
-    return false;
-  }
-  if (!Array.isArray(rows)) return false;
-  for (const row of rows) {
-    const procId = Number(row.pid);
-    const cmd = String(row.cmd || '');
-    if (!Number.isFinite(procId) || procId === myPid) continue;
-    if (isGitNexusServerCommand(cmd)) return true;
-  }
-  return false;
-}
-
-function readLinuxCmdline(pidStr) {
-  try {
-    return fs.readFileSync(`/proc/${pidStr}/cmdline`, 'utf8').replace(/\0+/g, ' ').trim();
-  } catch {
-    return '';
-  }
-}
-
-function linuxProcScanFindGitNexusServer(dbPathAbs, myPid) {
-  const raw = process.env.GITNEXUS_HOOK_LINUX_PROC_BUDGET_MS;
-  const budget = Number(raw && String(raw).trim()) ? Number.parseInt(String(raw), 10) : 1200;
-  const start = Date.now();
-  let targetStat;
-  try {
-    targetStat = fs.statSync(dbPathAbs);
-  } catch {
-    return false;
-  }
-  let procEntries;
-  try {
-    procEntries = fs.readdirSync('/proc', { withFileTypes: true });
-  } catch {
-    return false;
-  }
-  for (const ent of procEntries) {
-    if (Date.now() - start > budget) return false;
-    if (!ent.isDirectory() || !/^\d+$/.test(ent.name)) continue;
-    const pid = Number.parseInt(ent.name, 10);
-    if (!Number.isFinite(pid) || pid === myPid) continue;
-    const fdDir = path.join('/proc', ent.name, 'fd');
-    let fds;
-    try {
-      fds = fs.readdirSync(fdDir);
-    } catch {
-      continue;
-    }
-    let holds = false;
-    for (const fd of fds) {
-      if (Date.now() - start > budget) return false;
-      try {
-        const st = fs.statSync(path.join(fdDir, fd));
-        if (st.dev === targetStat.dev && st.ino === targetStat.ino) {
-          holds = true;
-          break;
-        }
-      } catch {
-        /* ignore */
-      }
-    }
-    if (!holds) continue;
-    if (isGitNexusServerCommand(readLinuxCmdline(ent.name))) return true;
-  }
-  return false;
-}
-
-function unixLsofPsFindGitNexusServer(dbPathAbs, myPid) {
-  const lsofPath = resolveHookBinary('lsof');
-  const lsof = spawnSync(lsofPath, ['-nP', '-t', '--', dbPathAbs], {
-    encoding: 'utf-8',
-    timeout: 1000,
-    stdio: ['ignore', 'pipe', 'ignore'],
-  });
-  if (lsof.error) return lsof.error.code === 'ETIMEDOUT';
-
-  const pids = (lsof.stdout || '').split(/\s+/).filter(Boolean);
-  const psPath = resolveHookBinary('ps');
-  for (const pid of pids) {
-    if (Number(pid) === myPid) continue;
-    const ps = spawnSync(psPath, ['-p', pid, '-o', 'command='], {
-      encoding: 'utf-8',
-      timeout: 500,
-      stdio: ['ignore', 'pipe', 'ignore'],
-    });
-    if (ps.error) {
-      if (ps.error.code === 'ETIMEDOUT') return true;
-      continue;
-    }
-    if (isGitNexusServerCommand(ps.stdout || '')) return true;
-  }
-  return false;
-}
-
-/**
- * @param {string} dbPath Absolute or relative path to the DB file (e.g. .../lbug).
- * @param {number} myPid Current process PID (hook runner), excluded from matches.
- */
-function hasGitNexusDbLockedByGitNexusServer(dbPath, myPid) {
-  if (!fs.existsSync(dbPath)) return false;
-  const dbPathAbs = path.resolve(dbPath);
-
-  if (process.platform === 'win32') {
-    return hasGitNexusServerOwnerWindows(dbPathAbs, myPid);
-  }
-
-  if (process.platform === 'linux') {
-    if (linuxProcScanFindGitNexusServer(dbPathAbs, myPid)) return true;
-    return unixLsofPsFindGitNexusServer(dbPathAbs, myPid);
-  }
-
-  return unixLsofPsFindGitNexusServer(dbPathAbs, myPid);
-}
-
-module.exports = {
-  hasGitNexusDbLockedByGitNexusServer,
-};

gitnexus-claude-plugin/hooks/hook-lock.js

@@ -1,119 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-
-const HOOK_LOCK_SUBDIR = '.hook-locks';
-const HOOK_LOCK_MAX_INFLIGHT = 3;
-const HOOK_LOCK_STALE_MS = 30000;
-
-function acquireHookSlot(gitNexusDir) {
-  const lockDir = path.join(gitNexusDir, HOOK_LOCK_SUBDIR);
-  try {
-    fs.mkdirSync(lockDir, { recursive: true });
-  } catch {
-    // Cannot create lock dir (read-only fs, cross-user perm denial, out of
-    // inodes, etc.) — fail closed by returning null. Caller skips augment.
-    // Fail-open here would let N concurrent hooks all proceed unguarded and
-    // reintroduce the #1486 fan-out the guard exists to prevent.
-    return null;
-  }
-
-  const myPidStr = String(process.pid);
-
-  for (let slot = 0; slot < HOOK_LOCK_MAX_INFLIGHT; slot++) {
-    const slotPath = path.join(lockDir, `slot-${slot}.lock`);
-    for (let attempt = 0; attempt < 2; attempt++) {
-      try {
-        fs.writeFileSync(slotPath, myPidStr, { flag: 'wx' });
-        let released = false;
-        const release = () => {
-          if (released) return;
-          released = true;
-          try {
-            // Only unlink if we still own the slot. If we appeared stale and
-            // another hook took over, the file now belongs to it — leave alone.
-            const content = fs.readFileSync(slotPath, 'utf-8').trim();
-            if (content === myPidStr) fs.unlinkSync(slotPath);
-          } catch {
-            /* already removed or unreadable */
-          }
-        };
-        process.on('exit', release);
-        return release;
-      } catch {
-        // Slot exists. Decide whether to take it over.
-        // Open once and inspect mtime + content via the same fd so there's
-        // no TOCTOU between the metadata check and the content read
-        // (codeql js/file-system-race).
-        let fd;
-        try {
-          fd = fs.openSync(slotPath, 'r');
-        } catch {
-          continue; // Vanished between EEXIST and open — retry this slot.
-        }
-        let isLive = false;
-        let mtimeMs = Date.now();
-        try {
-          mtimeMs = fs.fstatSync(fd).mtimeMs;
-          const buf = Buffer.alloc(32);
-          const n = fs.readSync(fd, buf, 0, 32, 0);
-          const ownerStr = buf.slice(0, n).toString('utf-8').trim();
-          if (ownerStr === '') {
-            // Owner created the file but hasn't written its PID yet. The
-            // wx open+write window is microseconds; give it the benefit
-            // of the doubt and treat as live.
-            isLive = true;
-          } else {
-            const owner = Number.parseInt(ownerStr, 10);
-            if (Number.isFinite(owner) && owner > 0) {
-              try {
-                process.kill(owner, 0);
-                isLive = true;
-              } catch (e) {
-                // ESRCH = process gone → treat as dead. EPERM = process exists
-                // but owned by another user (cross-user lock dir) → still alive,
-                // keep the slot. Anything else: be conservative, assume alive.
-                if (e && e.code === 'ESRCH') {
-                  isLive = false;
-                } else {
-                  isLive = true;
-                }
-              }
-            }
-          }
-        } catch {
-          /* unreadable — treat as dead */
-        } finally {
-          try {
-            fs.closeSync(fd);
-          } catch {
-            /* already closed */
-          }
-        }
-        // For slots younger than HOOK_LOCK_STALE_MS, PID-liveness wins —
-        // a slow-but-alive hook is never wrongly evicted. For older slots,
-        // age is the final arbiter as a defense against PID reuse on long-
-        // abandoned slots. 30s >> the 7s augment timeout, so a healthy run
-        // never crosses this threshold.
-        if (isLive && Date.now() - mtimeMs > HOOK_LOCK_STALE_MS) {
-          isLive = false;
-        }
-        if (isLive) break; // Try the next slot.
-        try {
-          fs.unlinkSync(slotPath);
-        } catch {
-          /* another hook beat us to it — retry will hit EEXIST */
-        }
-        // Loop and retry this slot.
-      }
-    }
-  }
-
-  return null;
-}
-
-module.exports = {
-  HOOK_LOCK_SUBDIR,
-  HOOK_LOCK_MAX_INFLIGHT,
-  HOOK_LOCK_STALE_MS,
-  acquireHookSlot,
-};

gitnexus-claude-plugin/hooks/win-rm-list-json.ps1

@@ -1,76 +0,0 @@
-$ErrorActionPreference = 'Stop'
-$target = $env:GITNEXUS_HOOK_RM_TARGET
-if ([string]::IsNullOrWhiteSpace($target)) { Write-Output '[]'; exit 0 }
-$target = (Resolve-Path -LiteralPath $target).ProviderPath
-
-if (-not ([Management.Automation.PSTypeName]'GitNexusHookRm.Native').Type) {
-Add-Type @'
-using System;
-using System.Runtime.InteropServices;
-namespace GitNexusHookRm {
-  public static class Native {
-    public const int ErrorMoreData = 234;
-    [StructLayout(LayoutKind.Sequential, Pack = 4)]
-    public struct RM_UNIQUE_PROCESS {
-      public int dwProcessId;
-      public long ProcessStartTime;
-    }
-    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-    public struct RM_PROCESS_INFO {
-      public RM_UNIQUE_PROCESS Process;
-      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
-      public string strAppName;
-      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 64)]
-      public string strServiceShortName;
-      public uint ApplicationType;
-      public uint AppStatus;
-      public uint TSSessionId;
-      public uint bRestartable;
-    }
-    [DllImport("rstrtmgr.dll", CharSet = CharSet.Unicode)]
-    public static extern int RmStartSession(out uint pSessionHandle, uint dwSessionFlags, string strSessionKey);
-    [DllImport("rstrtmgr.dll", CharSet = CharSet.Unicode)]
-    public static extern int RmRegisterResources(uint pSessionHandle, uint nFiles, string[] rgsFileNames, uint nApplications, IntPtr rgApplications, uint nServices, string[] rgsServiceNames);
-    [DllImport("rstrtmgr.dll")]
-    public static extern int RmGetList(uint dwSessionHandle, out uint pnProcInfoNeeded, ref uint pnProcInfo, [In, Out] RM_PROCESS_INFO[] rgAffectedApps, ref uint lpdwRebootReasons);
-    [DllImport("rstrtmgr.dll")]
-    public static extern int RmEndSession(uint pSessionHandle);
-  }
-}
-'@
-}
-
-$h = [uint32]0
-$key = [guid]::NewGuid().ToString('N')
-$rmErr = [GitNexusHookRm.Native]::RmStartSession([ref]$h, 0, $key)
-if ($rmErr -ne 0) { Write-Output '[]'; exit 0 }
-$files = @($target)
-$err = [GitNexusHookRm.Native]::RmRegisterResources($h, 1, $files, 0, [IntPtr]::Zero, 0, $null)
-if ($err -ne 0) {
-  [void][GitNexusHookRm.Native]::RmEndSession($h)
-  Write-Output '[]'
-  exit 0
-}
-$need = [uint32]0
-$n = [uint32]0
-$reboot = [uint32]0
-$err = [GitNexusHookRm.Native]::RmGetList($h, [ref]$need, [ref]$n, $null, [ref]$reboot)
-if ($err -ne [GitNexusHookRm.Native]::ErrorMoreData) {
-  [void][GitNexusHookRm.Native]::RmEndSession($h)
-  Write-Output '[]'
-  exit 0
-}
-$n = $need
-$buf = New-Object GitNexusHookRm.Native+RM_PROCESS_INFO[] ([int]$n)
-$err = [GitNexusHookRm.Native]::RmGetList($h, [ref]$need, [ref]$n, $buf, [ref]$reboot)
-[void][GitNexusHookRm.Native]::RmEndSession($h)
-if ($err -ne 0) { Write-Output '[]'; exit 0 }
-
-$out = @()
-for ($i = 0; $i -lt [int]$n; $i++) {
-  $procId = $buf[$i].Process.dwProcessId
-  $p = Get-CimInstance -ClassName Win32_Process -Filter "ProcessId=$procId" -ErrorAction SilentlyContinue
-  $cmd = if ($p) { $p.CommandLine } else { '' }
-  $out += [PSCustomObject]@{ pid = [int]$procId; cmd = $cmd }
-}
-ConvertTo-Json -InputObject @($out) -Compress

gitnexus-claude-plugin/skills/gitnexus-cli/SKILL.md

@@ -62,8 +62,6 @@ Generates repository documentation from the knowledge graph using an LLM. Requir
 | `--api-key <key>` | LLM API key |
 | `--concurrency <n>` | Parallel LLM calls (default: 3) |
 | `--gist` | Publish wiki as a public GitHub Gist |
-| `--timeout <seconds>` | LLM request timeout in seconds (default: disabled) |
-| `--retries <n>` | Max LLM retry attempts per request (default: 3) |
 
 ### list — Show all indexed repos
 

gitnexus-cursor-integration/README.md

@@ -1,91 +0,0 @@
-# GitNexus — Cursor integration
-
-Static config that adds GitNexus knowledge-graph augmentation and skill files to Cursor.
-
-> **Hooks require Cursor 2.4+.** Earlier versions don't expose `postToolUse` and the hook will silently no-op.
-
-## What you get
-
-| Layer                     | What it does                                                                                                                              | How it's installed                                                              |
-| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
-| **MCP**                   | `gitnexus` MCP server with 16 tools (`query`, `context`, `impact`, `detect_changes`, `rename`, …)                                         | `npx gitnexus setup` writes `~/.cursor/mcp.json` automatically.                 |
-| **Skills**                | `/gitnexus-exploring`, `/gitnexus-debugging`, `/gitnexus-impact-analysis`, `/gitnexus-refactoring`, `/gitnexus-pr-review` markdown skills | `npx gitnexus setup` copies them to `~/.cursor/skills/gitnexus/`.               |
-| **Hooks** _(this README)_ | `postToolUse` hook that enriches `Shell` / `Read` / `Grep` tool calls with graph context — same augmentation Claude Code gets             | **Manual** — copy the files described below into your project's `.cursor/`. |
-
-## Hook install
-
-Cursor 2.4+ reads `.cursor/hooks.json` from the project root and runs hook commands with the project root as the working directory ([docs](https://cursor.com/docs/agent/hooks)).
-
-From this repo's `gitnexus-cursor-integration/hooks/`, copy the files below into your **project root**:
-
-```text
-<your-project>/
-├── .cursor/
-│   └── hooks.json              ← from gitnexus-cursor-integration/hooks/hooks.json
-└── hooks/
-    ├── gitnexus-hook.cjs       ← from gitnexus-cursor-integration/hooks/gitnexus-hook.cjs
-    └── hook-lock.cjs           ← from gitnexus-cursor-integration/hooks/hook-lock.cjs
-```
-
-Equivalent shell commands (run from your project root, with `$GITNEXUS_REPO` pointing at a clone of this repo):
-
-```bash
-mkdir -p .cursor hooks
-cp "$GITNEXUS_REPO/gitnexus-cursor-integration/hooks/hooks.json"        .cursor/hooks.json
-cp "$GITNEXUS_REPO/gitnexus-cursor-integration/hooks/gitnexus-hook.cjs" hooks/gitnexus-hook.cjs
-cp "$GITNEXUS_REPO/gitnexus-cursor-integration/hooks/hook-lock.cjs"     hooks/hook-lock.cjs
-```
-
-If you already have a `.cursor/hooks.json`, merge the `hooks.postToolUse` array rather than overwriting.
-
-### Verify
-
-1. Index the project: `npx gitnexus analyze`
-2. Reload the Cursor window so it picks up the new hook config.
-3. Ask the agent something that triggers `Read` / `Grep` / `Shell rg`. You should see a `[GitNexus]` block appended to the tool result.
-4. Diagnose silent no-ops by setting `GITNEXUS_DEBUG=1` in your shell environment — the hook will write Cursor's raw event payload to stderr so you can verify field names.
-
-### What's installed manually vs. automated
-
-| Step                                                                 | Automated by `gitnexus setup`? |
-| -------------------------------------------------------------------- | ------------------------------ |
-| `~/.cursor/mcp.json`                                                 | ✅                             |
-| `~/.cursor/skills/gitnexus/*`                                        | ✅                             |
-| `<project>/.cursor/hooks.json` + `<project>/hooks/gitnexus-hook.cjs` + `<project>/hooks/hook-lock.cjs` | ❌ — copy manually (see above) |
-
-Hook install is per-project (Cursor scopes hooks to a project root); skills and MCP config are global.
-
-## Hook contract
-
-The hook receives a JSON event on stdin matching Cursor 2.4's `postToolUse` shape:
-
-```json
-{
-  "tool_name": "Grep" | "Read" | "Shell",
-  "tool_input": { /* tool-specific */ },
-  "tool_output": { /* optional */ },
-  "cwd": "/absolute/path/to/project"
-}
-```
-
-It writes augmentation context to stdout as:
-
-```json
-{ "additional_context": "[GitNexus] …" }
-```
-
-Empty stdout means "no augmentation, continue normally" — the hook never blocks the tool.
-
-### Pattern extraction per tool
-
-| Tool    | Pattern source                                                                                                         | Notes                                                                                                |
-| ------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
-| `Grep`  | `tool_input.query` (also `pattern`, `regex`, `q`, `search`, `searchQuery`)                                             | Last-resort fallback: longest string value in `tool_input` (≥ 3 chars).                              |
-| `Read`  | basename of `tool_input.target_file` (also `file_path`, `filePath`, `path`, `file`), stripped to identifier characters | `auth/handler.ts` → `handler`.                                                                       |
-| `Shell` | First positional argument after `rg` / `grep` in `tool_input.command`                                                  | Best-effort tokenizer; quoted multi-word patterns (`rg "User Service"`) extract the first word only. |
-
-## Troubleshooting
-
-- **Nothing happens** — Confirm Cursor is on 2.4+ and the project root has `.cursor/hooks.json` plus both hook files at `hooks/gitnexus-hook.cjs` and `hooks/hook-lock.cjs`. Then `npx gitnexus list` to confirm the project is indexed.
-- **`gitnexus` not found** — The hook prefers a locally-resolvable `gitnexus/dist/cli/index.js` and falls back to `npx -y gitnexus`. Install globally with `npm i -g gitnexus` to skip the npx cold-start latency.
-- **Wrong pattern extracted** — Set `GITNEXUS_DEBUG=1` and run a tool call. The raw stdin payload is logged to stderr; use it to confirm Cursor's actual `tool_input` field names against the table above. If they differ, file an issue with the captured payload.

gitnexus-cursor-integration/hooks/augment-shell.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# GitNexus beforeShellExecution hook for Cursor
+# Receives JSON on stdin with { command, cwd, timeout }
+# Returns JSON on stdout with { permission, agent_message }
+#
+# Extracts search pattern from grep/rg commands, runs gitnexus augment,
+# and injects the enriched context via agent_message.
+
+INPUT=$(cat)
+
+COMMAND=$(echo "$INPUT" | jq -r '.command // empty' 2>/dev/null)
+
+if [ -z "$COMMAND" ]; then
+  echo '{"permission":"allow"}'
+  exit 0
+fi
+
+# Skip non-search commands
+case "$COMMAND" in
+  cd\ *|npm\ *|yarn\ *|pnpm\ *|git\ commit*|git\ push*|git\ pull*|mkdir\ *|rm\ *|cp\ *|mv\ *|echo\ *|cat\ *)
+    echo '{"permission":"allow"}'
+    exit 0
+    ;;
+esac
+
+# Extract search pattern from rg/grep commands
+PATTERN=""
+if echo "$COMMAND" | grep -qE '\brg\b'; then
+  PATTERN=$(echo "$COMMAND" | sed -n "s/.*\brg\s\+\(--[^ ]*\s\+\)*['\"]\\?\([^'\";\| >]*\\).*/\2/p")
+elif echo "$COMMAND" | grep -qE '\bgrep\b'; then
+  PATTERN=$(echo "$COMMAND" | sed -n "s/.*\bgrep\s\+\(-[^ ]*\s\+\)*['\"]\\?\([^'\";\| >]*\\).*/\2/p")
+fi
+
+if [ -z "$PATTERN" ] || [ ${#PATTERN} -lt 3 ]; then
+  echo '{"permission":"allow"}'
+  exit 0
+fi
+
+# Run gitnexus augment
+RESULT=$(npx -y gitnexus augment "$PATTERN" 2>/dev/null)
+
+if [ -n "$RESULT" ]; then
+  # Escape for JSON
+  ESCAPED=$(echo "$RESULT" | jq -Rs .)
+  echo "{\"permission\":\"allow\",\"agent_message\":$ESCAPED}"
+else
+  echo '{"permission":"allow"}'
+fi
+
+exit 0

gitnexus-cursor-integration/hooks/gitnexus-hook.cjs

@@ -1,266 +0,0 @@
-#!/usr/bin/env node
-/**
- * GitNexus Cursor postToolUse Hook
- *
- * Receives a JSON event on stdin describing a finished tool call, derives a
- * search pattern (Grep query, Read file basename, or rg/grep arg from a Shell
- * command), runs `gitnexus augment <pattern>`, and emits the enriched context
- * back as `{ additional_context: "..." }` so the agent sees it alongside the
- * tool result.
- *
- * Replaces the legacy beforeShellExecution / augment-shell.sh pipeline:
- *   - Cross-platform (no bash, no jq — runs on Windows out of the box)
- *   - Covers Read and Grep, not just Shell rg/grep
- *
- * Cursor 2.4+ generic hooks: https://cursor.com/docs/agent/hooks
- */
-
-const fs = require('fs');
-const path = require('path');
-const { spawnSync } = require('child_process');
-const { acquireHookSlot } = require('./hook-lock.cjs');
-
-function readInput() {
-  try {
-    const data = fs.readFileSync(0, 'utf-8');
-    return JSON.parse(data);
-  } catch {
-    return {};
-  }
-}
-
-function isGlobalRegistryDir(candidate) {
-  if (fs.existsSync(path.join(candidate, 'meta.json'))) return false;
-  return (
-    fs.existsSync(path.join(candidate, 'registry.json')) ||
-    fs.existsSync(path.join(candidate, 'repos'))
-  );
-}
-
-function walkForGitNexusDir(startDir) {
-  let dir = startDir;
-  for (let i = 0; i < 5; i++) {
-    const candidate = path.join(dir, '.gitnexus');
-    if (fs.existsSync(candidate)) {
-      if (!isGlobalRegistryDir(candidate)) return candidate;
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
-function findCanonicalRepoRoot(cwd) {
-  try {
-    const result = spawnSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], {
-      encoding: 'utf-8',
-      timeout: 2000,
-      cwd,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    if (result.error || result.status !== 0) return null;
-    const commonDir = (result.stdout || '').trim();
-    if (!commonDir || !path.isAbsolute(commonDir)) return null;
-    return path.dirname(commonDir);
-  } catch {
-    return null;
-  }
-}
-
-function findGitNexusDir(startDir) {
-  const cwd = startDir || process.cwd();
-  const fromCwd = walkForGitNexusDir(cwd);
-  if (fromCwd) return fromCwd;
-  const canonicalRoot = findCanonicalRepoRoot(cwd);
-  if (canonicalRoot && canonicalRoot !== cwd) {
-    return walkForGitNexusDir(canonicalRoot);
-  }
-  return null;
-}
-
-function parseRgGrepPattern(cmd) {
-  const tokens = cmd.split(/\s+/);
-  let foundCmd = false;
-  let skipNext = false;
-  const flagsWithValues = new Set([
-    '-e',
-    '-f',
-    '-m',
-    '-A',
-    '-B',
-    '-C',
-    '-g',
-    '--glob',
-    '-t',
-    '--type',
-    '--include',
-    '--exclude',
-  ]);
-
-  for (const token of tokens) {
-    if (skipNext) {
-      skipNext = false;
-      continue;
-    }
-    if (!foundCmd) {
-      if (/\brg$|\bgrep$/.test(token)) foundCmd = true;
-      continue;
-    }
-    if (token.startsWith('-')) {
-      if (flagsWithValues.has(token)) skipNext = true;
-      continue;
-    }
-    const cleaned = token.replace(/['"]/g, '');
-    return cleaned.length >= 3 ? cleaned : null;
-  }
-  return null;
-}
-
-/**
- * Extract a search pattern from the tool input. Cursor 2.4 docs at
- * https://cursor.com/docs/agent/hooks list the tool *matchers* but do not
- * formally specify the per-tool tool_input field names, so we probe a
- * generous set of MCP-style aliases. As a last-resort fallback for Grep
- * (the highest-frequency search path) we also accept the longest plausible
- * string value in tool_input. Set GITNEXUS_DEBUG=1 to log the raw payload
- * to stderr if Cursor changes the contract and aliases stop matching.
- */
-function pickLongestStringValue(obj) {
-  let best = null;
-  if (!obj || typeof obj !== 'object') return null;
-  for (const v of Object.values(obj)) {
-    if (typeof v === 'string' && v.length >= 3 && (!best || v.length > best.length)) {
-      best = v;
-    }
-  }
-  return best;
-}
-
-function extractPattern(toolName, toolInput) {
-  const t = (toolName || '').toLowerCase();
-
-  if (t === 'grep') {
-    const aliases = [
-      toolInput.query,
-      toolInput.pattern,
-      toolInput.regex,
-      toolInput.q,
-      toolInput.search,
-      toolInput.searchQuery,
-    ];
-    for (const a of aliases) {
-      if (typeof a === 'string' && a.length >= 3) return a;
-    }
-    // Last resort: scan tool_input for any reasonable-looking string value.
-    return pickLongestStringValue(toolInput);
-  }
-
-  if (t === 'read') {
-    const filePath =
-      toolInput.target_file ||
-      toolInput.file_path ||
-      toolInput.filePath ||
-      toolInput.path ||
-      toolInput.file ||
-      '';
-    if (!filePath) return null;
-    const base = path.basename(String(filePath), path.extname(String(filePath)));
-    const cleaned = base.replace(/[^a-zA-Z0-9_]/g, '');
-    return cleaned.length >= 3 ? cleaned : null;
-  }
-
-  if (t === 'shell') {
-    const cmd = toolInput.command || '';
-    if (!/\brg\b|\bgrep\b/.test(cmd)) return null;
-    // NOTE: parseRgGrepPattern uses split(/\s+/) and cannot handle shell
-    // quoting. `rg "User Service" src/` returns "User" (the first token
-    // after the rg/grep arg, with surrounding quotes stripped) — the
-    // multi-word pattern is intentionally not reconstructed since BM25 is
-    // already token-tolerant. Quoted single tokens (`rg "validateUser"`)
-    // work fine.
-    return parseRgGrepPattern(cmd);
-  }
-
-  return null;
-}
-
-function resolveCliPath() {
-  try {
-    return require.resolve('gitnexus/dist/cli/index.js');
-  } catch {
-    return '';
-  }
-}
-
-function runGitNexusCli(cliPath, args, cwd, timeout) {
-  const isWin = process.platform === 'win32';
-  if (cliPath) {
-    return spawnSync(process.execPath, [cliPath, ...args], {
-      encoding: 'utf-8',
-      timeout,
-      cwd,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-  }
-  return spawnSync(isWin ? 'npx.cmd' : 'npx', ['-y', 'gitnexus', ...args], {
-    encoding: 'utf-8',
-    timeout: timeout + 5000,
-    cwd,
-    stdio: ['pipe', 'pipe', 'pipe'],
-  });
-}
-
-function main() {
-  try {
-    const input = readInput();
-    if (process.env.GITNEXUS_DEBUG) {
-      // Echo the payload so users can capture Cursor's actual contract when
-      // diagnosing why augmentation isn't firing. Stderr only — stdout is
-      // reserved for the JSON response Cursor consumes.
-      try {
-        process.stderr.write(
-          `GitNexus Cursor hook stdin: ${JSON.stringify(input).slice(0, 500)}\n`,
-        );
-      } catch {
-        /* never let debug logging break the hook */
-      }
-    }
-    const cwd = input.cwd || process.cwd();
-    if (!path.isAbsolute(cwd)) return;
-    const gitNexusDir = findGitNexusDir(cwd);
-    if (!gitNexusDir) return;
-
-    const toolName = input.tool_name || '';
-    const toolInput = input.tool_input || {};
-
-    const pattern = extractPattern(toolName, toolInput);
-    if (!pattern || pattern.length < 3) return;
-
-    const release = acquireHookSlot(gitNexusDir);
-    if (!release) return;
-
-    const cliPath = resolveCliPath();
-    let result = '';
-    try {
-      const child = runGitNexusCli(cliPath, ['augment', '--', pattern], cwd, 7000);
-      if (!child.error && child.status === 0) {
-        result = child.stderr || '';
-      }
-    } catch {
-      /* graceful failure */
-    } finally {
-      release();
-    }
-
-    if (result && result.trim()) {
-      console.log(JSON.stringify({ additional_context: result.trim() }));
-    }
-  } catch (err) {
-    if (process.env.GITNEXUS_DEBUG) {
-      console.error('GitNexus Cursor hook error:', (err.message || '').slice(0, 200));
-    }
-  }
-}
-
-main();

gitnexus-cursor-integration/hooks/hook-lock.cjs

@@ -1,119 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-
-const HOOK_LOCK_SUBDIR = '.hook-locks';
-const HOOK_LOCK_MAX_INFLIGHT = 3;
-const HOOK_LOCK_STALE_MS = 30000;
-
-function acquireHookSlot(gitNexusDir) {
-  const lockDir = path.join(gitNexusDir, HOOK_LOCK_SUBDIR);
-  try {
-    fs.mkdirSync(lockDir, { recursive: true });
-  } catch {
-    // Cannot create lock dir (read-only fs, cross-user perm denial, out of
-    // inodes, etc.) — fail closed by returning null. Caller skips augment.
-    // Fail-open here would let N concurrent hooks all proceed unguarded and
-    // reintroduce the #1486 fan-out the guard exists to prevent.
-    return null;
-  }
-
-  const myPidStr = String(process.pid);
-
-  for (let slot = 0; slot < HOOK_LOCK_MAX_INFLIGHT; slot++) {
-    const slotPath = path.join(lockDir, `slot-${slot}.lock`);
-    for (let attempt = 0; attempt < 2; attempt++) {
-      try {
-        fs.writeFileSync(slotPath, myPidStr, { flag: 'wx' });
-        let released = false;
-        const release = () => {
-          if (released) return;
-          released = true;
-          try {
-            // Only unlink if we still own the slot. If we appeared stale and
-            // another hook took over, the file now belongs to it — leave alone.
-            const content = fs.readFileSync(slotPath, 'utf-8').trim();
-            if (content === myPidStr) fs.unlinkSync(slotPath);
-          } catch {
-            /* already removed or unreadable */
-          }
-        };
-        process.on('exit', release);
-        return release;
-      } catch {
-        // Slot exists. Decide whether to take it over.
-        // Open once and inspect mtime + content via the same fd so there's
-        // no TOCTOU between the metadata check and the content read
-        // (codeql js/file-system-race).
-        let fd;
-        try {
-          fd = fs.openSync(slotPath, 'r');
-        } catch {
-          continue; // Vanished between EEXIST and open — retry this slot.
-        }
-        let isLive = false;
-        let mtimeMs = Date.now();
-        try {
-          mtimeMs = fs.fstatSync(fd).mtimeMs;
-          const buf = Buffer.alloc(32);
-          const n = fs.readSync(fd, buf, 0, 32, 0);
-          const ownerStr = buf.slice(0, n).toString('utf-8').trim();
-          if (ownerStr === '') {
-            // Owner created the file but hasn't written its PID yet. The
-            // wx open+write window is microseconds; give it the benefit
-            // of the doubt and treat as live.
-            isLive = true;
-          } else {
-            const owner = Number.parseInt(ownerStr, 10);
-            if (Number.isFinite(owner) && owner > 0) {
-              try {
-                process.kill(owner, 0);
-                isLive = true;
-              } catch (e) {
-                // ESRCH = process gone → treat as dead. EPERM = process exists
-                // but owned by another user (cross-user lock dir) → still alive,
-                // keep the slot. Anything else: be conservative, assume alive.
-                if (e && e.code === 'ESRCH') {
-                  isLive = false;
-                } else {
-                  isLive = true;
-                }
-              }
-            }
-          }
-        } catch {
-          /* unreadable — treat as dead */
-        } finally {
-          try {
-            fs.closeSync(fd);
-          } catch {
-            /* already closed */
-          }
-        }
-        // For slots younger than HOOK_LOCK_STALE_MS, PID-liveness wins —
-        // a slow-but-alive hook is never wrongly evicted. For older slots,
-        // age is the final arbiter as a defense against PID reuse on long-
-        // abandoned slots. 30s >> the 7s augment timeout, so a healthy run
-        // never crosses this threshold.
-        if (isLive && Date.now() - mtimeMs > HOOK_LOCK_STALE_MS) {
-          isLive = false;
-        }
-        if (isLive) break; // Try the next slot.
-        try {
-          fs.unlinkSync(slotPath);
-        } catch {
-          /* another hook beat us to it — retry will hit EEXIST */
-        }
-        // Loop and retry this slot.
-      }
-    }
-  }
-
-  return null;
-}
-
-module.exports = {
-  HOOK_LOCK_SUBDIR,
-  HOOK_LOCK_MAX_INFLIGHT,
-  HOOK_LOCK_STALE_MS,
-  acquireHookSlot,
-};

gitnexus-cursor-integration/hooks/hooks.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
   "hooks": {
-    "postToolUse": [
+    "beforeShellExecution": [
       {
-        "matcher": "Shell|Read|Grep",
-        "command": "node ./hooks/gitnexus-hook.cjs",
-        "timeout": 10
+        "command": "./hooks/augment-shell.sh",
+        "timeout": 5,
+        "matcher": "\\brg\\b|\\bgrep\\b"
       }
     ]
   }

gitnexus-shared/package.json

@@ -10,10 +10,6 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
-    },
-    "./test-helpers": {
-      "types": "./dist/test-helpers.d.ts",
-      "default": "./dist/test-helpers.js"
     }
   },
   "scripts": {

gitnexus-shared/src/index.ts

@@ -26,7 +26,7 @@ export type { PipelinePhase, PipelineProgress } from './pipeline.js';
 
 // ─── Scope-based resolution — RFC #909 (Ring 1 #910) ────────────────────────
 // Data model (RFC §2)
-export type { ParameterTypeClass, SymbolDefinition } from './scope-resolution/symbol-definition.js';
+export type { SymbolDefinition } from './scope-resolution/symbol-definition.js';
 export type {
   ScopeId,
   DefId,
@@ -129,7 +129,6 @@ export type {
   RegistryProviders,
   OwnerScopedContributor,
   ArityVerdict,
-  ConstraintContext,
 } from './scope-resolution/registries/context.js';
 
 // Scope tree spine + position lookup (RFC §2.2 + §3.1; Ring 2 SHARED #912)
@@ -144,34 +143,6 @@ export type { ScopeTree } from './scope-resolution/scope-tree.js';
 export { buildPositionIndex } from './scope-resolution/position-index.js';
 export type { PositionIndex } from './scope-resolution/position-index.js';
 
-// Resilient fetch primitives — bounded retries + per-process circuit breaker.
-// Test-only helpers (`__resetBreakerRegistry__`, `classifyOutcome`) are
-// reachable via the separate `gitnexus-shared/test-helpers` subpath; do
-// NOT add them here. Production consumers must not call them.
-export { withRetry, computeBackoffMs } from './integrations/retry.js';
-export type { RetryOptions, RetryDecision } from './integrations/retry.js';
-export { CircuitBreaker, CircuitOpenError, getBreaker } from './integrations/circuit-breaker.js';
-export type { CircuitBreakerOptions } from './integrations/circuit-breaker.js';
-export {
-  resilientFetch,
-  ResilientFetchExhaustedError,
-  RETRY_AFTER_CAP_MS,
-  parseRetryAfter,
-} from './integrations/resilient-fetch.js';
-export type { ResilientFetchOptions } from './integrations/resilient-fetch.js';
-
-// Understand-Quickly registry integration (opt-in)
-export {
-  UNDERSTAND_QUICKLY_DISPATCH_URL,
-  UNDERSTAND_QUICKLY_EVENT_TYPE,
-  UNDERSTAND_QUICKLY_TOKEN_ENV,
-  buildUqDispatchPayload,
-  isValidOwnerRepo,
-  parseOwnerRepoFromRemote,
-  stripGitSuffix,
-} from './integrations/understand-quickly.js';
-export type { UqDispatchPayload } from './integrations/understand-quickly.js';
-
 // Shadow-mode diff + aggregation (RFC §6.3; Ring 2 SHARED #918)
 export { diffResolutions } from './scope-resolution/shadow/diff.js';
 export type {

gitnexus-shared/src/integrations/circuit-breaker.ts

@@ -1,273 +0,0 @@
-/**
- * Per-process circuit breaker.
- *
- * Closed -> Open transition fires after `failureThreshold` consecutive
- * failures. While Open, `check` throws `CircuitOpenError` until
- * `cooldownMs` has elapsed since the breaker tripped. The first call
- * after the cooldown enters Half-Open and consumes the *probe permit*:
- * a recorded success returns to Closed; a recorded failure flips back
- * to Open with a fresh timestamp.
- *
- * Half-open admits exactly one in-flight probe at a time. Concurrent
- * callers attempting `check()` while a probe is outstanding receive
- * `CircuitOpenError` with `retryAfterMs = halfOpenRetryAfterMs` (default
- * 1000ms; configurable). This prevents the recovery-time thundering
- * herd that defeats the breaker's "fail fast" promise.
- *
- * Outcome reporting splits permit-release from state-resolution:
- *   - `recordSuccess` — releases the probe permit, resets the failure
- *     counter, transitions to Closed. Reserved for true 2xx/3xx outcomes.
- *   - `recordFailure` — releases the probe permit, increments the
- *     consecutive-failure counter, transitions to Open with a fresh
- *     `openedAt` (when called from Half-Open or when the threshold
- *     trips from Closed).
- *   - `recordNeutral` — releases the probe permit, BUT leaves state and
- *     counter untouched. Used for outcomes that are neither evidence of
- *     backend health nor evidence of backend failure (caller-driven
- *     cancellation, local timeout, terminal 4xx client errors). Critical
- *     design point: if `recordNeutral` did not release the permit, a
- *     single `TimeoutError` from per-attempt `AbortSignal.timeout` would
- *     route through `recordNeutral` and permanently park the breaker in
- *     half-open until process restart. Releasing the permit while leaving
- *     state half-open keeps the "neutral doesn't claim health" semantic
- *     without creating that wedge.
- *
- * Pairing invariant: every successful `check()` MUST be paired with
- * exactly one `record*()` on every code path including throws. Direct
- * consumers should wrap the protected operation in `try/finally`:
- *
- *   breaker.check();
- *   try {
- *     const result = await operation();
- *     breaker.recordSuccess();
- *     return result;
- *   } catch (err) {
- *     // classify err and call recordFailure / recordNeutral / etc.
- *     throw err;
- *   }
- *
- * `resilientFetch`'s catch-all on `fetchImpl` already satisfies this
- * for that consumer.
- *
- * Atomicity model: the half-open gate relies on JavaScript event-loop
- * single-threadedness within a synchronous `check()` body. There is no
- * `await` inside `check()`; concurrent callers serialize on microtask
- * order, and exactly one observes `probeInFlight === false`. Do not
- * introduce `await` inside `check()` without revisiting the gate. If
- * this code is ever ported to a runtime with shared-memory threads
- * (Node `worker_threads` with `SharedArrayBuffer`, Web Workers with
- * shared registries), the boolean must become an atomic CAS — Resilience4j
- * and Hystrix use atomic permits *because* they run in JVM thread pools.
- *
- * Runtime-agnostic: depends only on a `now()` clock and standard JS —
- * no Node-only imports. Tests inject `now` to advance the clock
- * deterministically without `vi.useFakeTimers()`.
- */
-
-export class CircuitOpenError extends Error {
-  override readonly name = 'CircuitOpenError';
-  /** Approximate wait time before the breaker may transition to Half-Open
-   *  (or before the in-flight probe is expected to resolve). */
-  readonly retryAfterMs: number;
-
-  constructor(retryAfterMs: number, key?: string) {
-    super(
-      key
-        ? `Circuit '${key}' is open; retry in ${Math.ceil(retryAfterMs / 1000)}s`
-        : `Circuit is open; retry in ${Math.ceil(retryAfterMs / 1000)}s`,
-    );
-    this.retryAfterMs = retryAfterMs;
-  }
-}
-
-export interface CircuitBreakerOptions {
-  /** Consecutive failures required to trip Closed -> Open. */
-  failureThreshold?: number;
-  /** Milliseconds Open before the next call may probe (Half-Open). */
-  cooldownMs?: number;
-  /**
-   * Milliseconds to suggest in `CircuitOpenError.retryAfterMs` when the
-   * breaker is Half-Open with the probe permit consumed. Default 1000ms.
-   * Consumers with long-running protected ops (LLM streaming, large
-   * uploads) should raise this — the cooldown clock is no longer the
-   * right answer because cooldown has elapsed. Returning 0 invites
-   * retry storms; returning the full cooldown misleads about wait.
-   */
-  halfOpenRetryAfterMs?: number;
-  /** Optional key for error messages and registry lookups. */
-  key?: string;
-  /** Clock override — defaults to `Date.now`. Tests inject deterministic time. */
-  now?: () => number;
-}
-
-type State = 'closed' | 'open' | 'half-open';
-
-export class CircuitBreaker {
-  private readonly failureThreshold: number;
-  private readonly cooldownMs: number;
-  private readonly halfOpenRetryAfterMs: number;
-  private readonly key: string | undefined;
-  private readonly now: () => number;
-
-  private state: State = 'closed';
-  private consecutiveFailures = 0;
-  private openedAt: number | null = null;
-  /**
-   * True between a successful `check()` and the next `record*()` call
-   * during Half-Open. Gates concurrent callers from stampeding a still-
-   * recovering dependency. Boolean rather than counter — single-permit
-   * is the conservative end of the Hystrix/Resilience4j spectrum.
-   */
-  private probeInFlight = false;
-
-  constructor(opts: CircuitBreakerOptions = {}) {
-    this.failureThreshold = opts.failureThreshold ?? 3;
-    this.cooldownMs = opts.cooldownMs ?? 30_000;
-    this.halfOpenRetryAfterMs = opts.halfOpenRetryAfterMs ?? 1_000;
-    this.key = opts.key;
-    this.now = opts.now ?? (() => Date.now());
-  }
-
-  /**
-   * Throw `CircuitOpenError` if the breaker won't admit this call.
-   * Otherwise consume the half-open probe permit (if applicable) and
-   * return so the caller can attempt the protected work.
-   *
-   * Three rejection paths:
-   *   1. Open and still in cooldown → throws with `retryAfterMs` =
-   *      remaining cooldown.
-   *   2. Open with cooldown elapsed AND a probe is already in flight
-   *      (race: another caller transitioned to half-open and grabbed
-   *      the permit on a microtask before us) → throws with
-   *      `halfOpenRetryAfterMs`.
-   *   3. Half-Open with probe in flight → throws with `halfOpenRetryAfterMs`.
-   *
-   * **Pairing invariant**: every successful return from `check()` MUST
-   * be paired with exactly one `recordSuccess` / `recordFailure` /
-   * `recordNeutral` on every code path including thrown exceptions.
-   * Failing to pair leaves the probe permit consumed forever and
-   * wedges the breaker. See file-header JSDoc for the canonical
-   * try/finally pattern.
-   */
-  check(): void {
-    if (this.state === 'open' && this.openedAt !== null) {
-      const elapsed = this.now() - this.openedAt;
-      if (elapsed < this.cooldownMs) {
-        throw new CircuitOpenError(this.cooldownMs - elapsed, this.key);
-      }
-      // Cooldown elapsed — transition to Half-Open. The very next
-      // `probeInFlight` check below decides whether THIS caller gets
-      // the permit or hits the gate.
-      this.state = 'half-open';
-    }
-
-    if (this.state === 'half-open') {
-      if (this.probeInFlight) {
-        throw new CircuitOpenError(this.halfOpenRetryAfterMs, this.key);
-      }
-      this.probeInFlight = true;
-    }
-    // Closed state falls through silently.
-  }
-
-  recordSuccess(): void {
-    this.probeInFlight = false;
-    this.consecutiveFailures = 0;
-    this.state = 'closed';
-    this.openedAt = null;
-  }
-
-  recordFailure(): void {
-    this.probeInFlight = false;
-    this.consecutiveFailures += 1;
-    if (this.state === 'half-open' || this.consecutiveFailures >= this.failureThreshold) {
-      this.state = 'open';
-      this.openedAt = this.now();
-    }
-  }
-
-  /**
-   * Releases the probe permit BUT leaves state and counter untouched.
-   * Use when an attempt produced a response or error that should not
-   * influence breaker health in either direction — caller-driven aborts,
-   * local AbortSignal timeouts, terminal 4xx client errors.
-   *
-   * Why permit-release-without-state-resolution: if `recordNeutral` did
-   * not clear `probeInFlight`, a single `TimeoutError` from per-attempt
-   * `AbortSignal.timeout` (which routes through neutral classification)
-   * would permanently park the breaker in half-open. Since timeouts are
-   * an *expected* outcome under flaky-dependency conditions, the cited
-   * "per-attempt timeout bounds the stuck state" mitigation would itself
-   * be the trigger for a permanent wedge. Releasing the permit closes
-   * that loop while keeping the "neutral doesn't claim dependency
-   * health" semantic.
-   *
-   * Calling `recordSuccess` for these would erase legitimate prior
-   * failure signal; calling `recordFailure` would trip the breaker for
-   * outcomes the backend isn't responsible for.
-   */
-  recordNeutral(): void {
-    this.probeInFlight = false;
-    // State and consecutiveFailures are preserved by design.
-  }
-
-  /**
-   * Pure read — no state mutation, no permit accounting. Returns the
-   * *would-be* state at the current instant: 'half-open' if the breaker
-   * is open with cooldown elapsed (regardless of whether a probe is in
-   * flight), 'open' if open and still in cooldown, 'closed' otherwise.
-   *
-   * Inspection-only; safe to call from tests without consuming a probe
-   * permit. The implicit Open -> Half-Open transition that mutates
-   * `state` lives in `check()` only.
-   */
-  getState(): State {
-    if (this.state === 'open' && this.openedAt !== null) {
-      const elapsed = this.now() - this.openedAt;
-      if (elapsed >= this.cooldownMs) return 'half-open';
-    }
-    return this.state;
-  }
-  getConsecutiveFailures(): number {
-    return this.consecutiveFailures;
-  }
-  /** Inspection-only test accessor for the half-open probe permit. */
-  isProbeInFlight(): boolean {
-    return this.probeInFlight;
-  }
-  /** Timestamp (ms since epoch) when the breaker last transitioned to Open,
-   *  or `null` if it's currently Closed. Useful for computing remaining
-   *  cooldown without consuming a probe permit via `check()`. */
-  getOpenedAt(): number | null {
-    return this.openedAt;
-  }
-  /** Configured cooldown duration in milliseconds. */
-  getCooldownMs(): number {
-    return this.cooldownMs;
-  }
-}
-
-// ─── Per-process registry ────────────────────────────────────────────
-//
-// Single shared map keyed on caller-chosen strings. Used by
-// `resilient-fetch.ts` so multiple call sites targeting the same logical
-// endpoint share breaker state. Per-process only — not persisted.
-
-const registry = new Map<string, CircuitBreaker>();
-
-export function getBreaker(key: string, opts?: CircuitBreakerOptions): CircuitBreaker {
-  let breaker = registry.get(key);
-  if (!breaker) {
-    breaker = new CircuitBreaker({ ...opts, key });
-    registry.set(key, breaker);
-  }
-  return breaker;
-}
-
-/**
- * Test-only: clear all registered breakers. Tests must call this in
- * `beforeEach` to prevent breaker state from leaking across test cases.
- */
-export function __resetBreakerRegistry__(): void {
-  registry.clear();
-}

gitnexus-shared/src/integrations/resilient-fetch.ts

@@ -1,279 +0,0 @@
-/**
- * `resilientFetch` — fetch wrapped in retry + circuit breaker, with
- * GitHub-flavoured retry classification baked in (Retry-After parsing,
- * 401/403/404/422 treated as terminal client errors).
- *
- * Designed for the `gitnexus publish` GitHub `repository_dispatch`
- * call, but the classification rules apply to any GitHub REST endpoint.
- * Runtime-agnostic — no Node-only imports.
- */
-
-import {
-  CircuitBreaker,
-  CircuitOpenError,
-  getBreaker,
-  type CircuitBreakerOptions,
-} from './circuit-breaker.js';
-import { computeBackoffMs, type RetryOptions } from './retry.js';
-
-export { CircuitOpenError };
-
-export interface ResilientFetchOptions {
-  /** Optional fetch implementation override. Defaults to `globalThis.fetch`. */
-  fetchImpl?: typeof fetch;
-  /**
-   * Logical key for the breaker. Defaults to `<host><pathname>` of the
-   * request URL — call sites targeting the same endpoint share breaker
-   * state regardless of query-string differences.
-   */
-  breakerKey?: string;
-  /** Per-call breaker override. Used for tests and one-off configuration. */
-  breaker?: CircuitBreaker;
-  /** Tuning knobs for the breaker registered under `breakerKey`. */
-  breakerOptions?: CircuitBreakerOptions;
-  /** Tuning knobs for the retry helper. */
-  retry?: Partial<Pick<RetryOptions, 'maxAttempts' | 'baseDelayMs' | 'capDelayMs'>> & {
-    sleep?: RetryOptions['sleep'];
-    random?: RetryOptions['random'];
-  };
-  /** Clock override propagated into Retry-After HTTP-date math and breaker. */
-  now?: () => number;
-}
-
-/** Cap on any single Retry-After wait — protects CLI from a buggy registry. */
-export const RETRY_AFTER_CAP_MS = 30_000;
-
-const DEFAULT_RETRY = {
-  maxAttempts: 3,
-  baseDelayMs: 500,
-  capDelayMs: 5_000,
-};
-
-/**
- * Parse a `Retry-After` header value into milliseconds.
- * Accepts either a delta-seconds integer (`"30"`) or an HTTP-date.
- * Returns null on parse failure or negative deltas.
- */
-export function parseRetryAfter(value: string | null, now: () => number = Date.now): number | null {
-  if (!value) return null;
-  const trimmed = value.trim();
-  if (trimmed === '') return null;
-
-  if (/^[0-9]+$/.test(trimmed)) {
-    const seconds = parseInt(trimmed, 10);
-    if (Number.isNaN(seconds) || seconds < 0) return null;
-    return seconds * 1000;
-  }
-
-  const target = Date.parse(trimmed);
-  if (Number.isNaN(target)) return null;
-  const delta = target - now();
-  return delta >= 0 ? delta : 0;
-}
-
-/** Internal: outcome classification used by the resilientFetch loop. */
-type Outcome =
-  | { kind: 'success'; resp: Response }
-  | { kind: 'terminal-client'; resp: Response } // 4xx other than 429: no retry, breaker neutral
-  | { kind: 'retryable-status'; resp: Response; afterMs: number | undefined } // 5xx, 429
-  | { kind: 'terminal-network'; err: unknown } // TimeoutError or AbortError: no retry, breaker neutral
-  | { kind: 'retryable-network'; err: unknown }; // DNS, ECONNRESET, etc.
-
-/** Exported for unit tests. */
-export function classifyOutcome(
-  result: { kind: 'error'; err: unknown } | { kind: 'response'; resp: Response },
-  now: () => number,
-): Outcome {
-  if (result.kind === 'error') {
-    // Both timer-fired aborts (`AbortSignal.timeout()` → `TimeoutError`)
-    // and caller-driven aborts (`AbortController.abort()` → `AbortError`)
-    // are terminal: retrying against an already-aborted signal would
-    // fail again immediately, and neither outcome reflects backend
-    // health. They route through the breaker's neutral path.
-    if (
-      result.err instanceof DOMException &&
-      (result.err.name === 'TimeoutError' || result.err.name === 'AbortError')
-    ) {
-      return { kind: 'terminal-network', err: result.err };
-    }
-    return { kind: 'retryable-network', err: result.err };
-  }
-  const resp = result.resp;
-  if (resp.status >= 200 && resp.status < 400) return { kind: 'success', resp };
-  if (resp.status === 429) {
-    // `resp.headers` is always present on a real `Response`, but tests
-    // sometimes stub `fetch` with a plain `{ ok, status }` object. Be
-    // defensive — a missing `Retry-After` falls through to exponential
-    // backoff, which is the correct behaviour anyway.
-    const retryAfterHeader =
-      typeof resp.headers?.get === 'function' ? resp.headers.get('Retry-After') : null;
-    const parsed = parseRetryAfter(retryAfterHeader, now);
-    return {
-      kind: 'retryable-status',
-      resp,
-      afterMs: parsed !== null ? Math.min(parsed, RETRY_AFTER_CAP_MS) : undefined,
-    };
-  }
-  if (resp.status >= 500) return { kind: 'retryable-status', resp, afterMs: undefined };
-  return { kind: 'terminal-client', resp };
-}
-
-const defaultSleep = (ms: number): Promise<void> =>
-  new Promise((resolve) => setTimeout(resolve, ms));
-
-function defaultBreakerKey(input: string | URL): string {
-  try {
-    const url = typeof input === 'string' ? new URL(input) : input;
-    return `${url.host}${url.pathname}`;
-  } catch {
-    return String(input);
-  }
-}
-
-/** Final error thrown when retries are exhausted on a 5xx / 429. */
-export class ResilientFetchExhaustedError extends Error {
-  override readonly name = 'ResilientFetchExhaustedError';
-  constructor(public readonly response: Response) {
-    super(`Request failed after retries (HTTP ${response.status})`);
-  }
-}
-
-/**
- * Wrap `fetch` with bounded retries and a per-process circuit breaker.
- *
- * Semantics:
- * - 5xx and 429 responses are retried; 429 honors `Retry-After` (capped).
- * - Network throws are retried unless they are `TimeoutError` DOMExceptions.
- * - Timeouts and 4xx (other than 429) are returned/thrown without retry
- *   AND without incrementing the breaker — they reflect caller config
- *   or local network state, not registry health.
- * - Each `fetch` call carries the caller-supplied `signal` (e.g. an
- *   `AbortSignal.timeout()`) — that timeout bounds each individual
- *   attempt, not the whole retry sequence.
- * - When the breaker is open, throws `CircuitOpenError` synchronously
- *   without invoking `fetch`.
- * - When retries are exhausted on a 5xx / 429, throws
- *   `ResilientFetchExhaustedError` carrying the last response.
- *
- * Cumulative wall-clock budget:
- *   maxAttempts × (per-attempt-timeout + capDelayMs)
- *   With defaults (3, 500ms base, 5000ms cap) and a typical 15s per-attempt
- *   timeout from the caller's signal, worst case is ~3 × (15s + 5s) = 60s.
- *   Callers that want a tighter total bound should reduce `maxAttempts` or
- *   wrap `resilientFetch` in their own outer `AbortSignal.timeout()`.
- */
-export async function resilientFetch(
-  input: string | URL,
-  init: RequestInit | undefined,
-  opts: ResilientFetchOptions = {},
-): Promise<Response> {
-  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
-  const now = opts.now ?? (() => Date.now());
-  const breaker =
-    opts.breaker ?? getBreaker(opts.breakerKey ?? defaultBreakerKey(input), opts.breakerOptions);
-
-  const retryConfig = {
-    maxAttempts: opts.retry?.maxAttempts ?? DEFAULT_RETRY.maxAttempts,
-    baseDelayMs: opts.retry?.baseDelayMs ?? DEFAULT_RETRY.baseDelayMs,
-    capDelayMs: opts.retry?.capDelayMs ?? DEFAULT_RETRY.capDelayMs,
-  };
-  const sleep = opts.retry?.sleep ?? defaultSleep;
-  const random = opts.retry?.random ?? Math.random;
-
-  // Fail fast on an open breaker, before invoking fetch.
-  breaker.check();
-
-  for (let attempt = 0; attempt < retryConfig.maxAttempts; attempt++) {
-    let result: { kind: 'error'; err: unknown } | { kind: 'response'; resp: Response };
-    try {
-      // CodeQL js/server-side-request-forgery — flagged because `input`
-      // is caller-supplied. Suppressed: every concrete caller passes
-      // either a hardcoded URL constant (UNDERSTAND_QUICKLY_DISPATCH_URL,
-      // OpenRouter base URL) or a value derived from configuration
-      // (env vars, saved settings, the local backend URL). User-input
-      // request fields (e.g. PR title, repo name) never flow into
-      // `input`. Validating URL shape here would push false-positive
-      // rejection onto every caller — wrong layer for the check.
-      // lgtm[js/server-side-request-forgery]
-      // codeql[js/server-side-request-forgery]
-      const resp = await fetchImpl(input, init);
-      result = { kind: 'response', resp };
-    } catch (err) {
-      result = { kind: 'error', err };
-    }
-
-    const outcome = classifyOutcome(result, now);
-
-    switch (outcome.kind) {
-      case 'success':
-        breaker.recordSuccess();
-        return outcome.resp;
-
-      case 'terminal-client':
-        // 4xx: do not count as breaker failure (the server is healthy
-        // and rejecting our request — auth, scope, or routing). But
-        // also do NOT call recordSuccess: a 401 sandwiched between
-        // 5xx responses would otherwise erase the running outage
-        // signal. The breaker's neutral path leaves state untouched.
-        breaker.recordNeutral();
-        return outcome.resp;
-
-      case 'terminal-network':
-        // Either `AbortSignal.timeout()` fired locally OR an external
-        // caller cancelled the request via AbortController. The server
-        // never had a chance to answer; this reflects the user's
-        // network or an explicit cancel, not registry health. Don't
-        // punish the breaker AND don't reset its outage signal.
-        breaker.recordNeutral();
-        throw outcome.err;
-
-      case 'retryable-status':
-        if (attempt + 1 >= retryConfig.maxAttempts) {
-          breaker.recordFailure();
-          throw new ResilientFetchExhaustedError(outcome.resp);
-        }
-        await sleep(
-          computeBackoffMs(
-            attempt,
-            retryConfig.baseDelayMs,
-            retryConfig.capDelayMs,
-            outcome.afterMs,
-            random,
-          ),
-        );
-        break;
-
-      case 'retryable-network':
-        if (attempt + 1 >= retryConfig.maxAttempts) {
-          breaker.recordFailure();
-          throw outcome.err;
-        }
-        await sleep(
-          computeBackoffMs(
-            attempt,
-            retryConfig.baseDelayMs,
-            retryConfig.capDelayMs,
-            undefined,
-            random,
-          ),
-        );
-        break;
-
-      default: {
-        // Exhaustiveness guard. If a sixth `Outcome` kind is added in
-        // future, TypeScript will refuse to assign it to `never` and
-        // this line forces the maintainer to add an explicit arm
-        // rather than silently fall through to retry/no-retry behaviour.
-        const _exhaustive: never = outcome;
-        throw new Error(`resilientFetch: unhandled outcome ${JSON.stringify(_exhaustive)}`);
-      }
-    }
-  }
-
-  // Unreachable: every iteration of the loop either returns (success
-  // / terminal-client) or throws (terminal-network / retry exhaustion).
-  // The throw is here purely so TypeScript's control-flow analysis sees
-  // the function never falls off the end without producing `Promise<Response>`.
-  /* c8 ignore next 2 */
-  throw new Error('resilientFetch: retry loop terminated unexpectedly');
-}

gitnexus-shared/src/integrations/retry.ts

@@ -1,105 +0,0 @@
-/**
- * Bounded retry helper with full-jitter exponential backoff.
- *
- * Runtime-agnostic: depends only on `setTimeout`, `Math.random`, and the
- * Promise machinery — no Node-only imports. Safe to consume from CLI,
- * server, or browser callers.
- *
- * Pattern reference: gitnexus/src/core/embeddings/http-client.ts. This
- * helper is the upgraded form: classification is caller-supplied (so
- * 4xx-vs-5xx-vs-timeout decisions live with the protocol that knows
- * them), backoff is exponential with full jitter, and an optional
- * `afterMs` lets callers honor `Retry-After` headers.
- */
-
-export interface RetryOptions {
-  /** Initial delay before the first retry attempt, in milliseconds. */
-  baseDelayMs: number;
-  /** Upper bound on any single delay, in milliseconds. */
-  capDelayMs: number;
-  /** Total attempts including the first call. Must be >= 1. */
-  maxAttempts: number;
-  /**
-   * Decide whether to retry after a thrown error.
-   * Return `{retry:false}` to terminate immediately and rethrow.
-   * Return `{retry:true}` to retry with exponential-backoff jitter.
-   * Return `{retry:true, afterMs}` to wait at least `afterMs` (still
-   * subject to `capDelayMs`) — used by callers parsing `Retry-After`.
-   */
-  isRetryable: (err: unknown, attempt: number) => RetryDecision;
-  /** Sleep override — defaults to `setTimeout`. Tests inject fake timers. */
-  sleep?: (ms: number) => Promise<void>;
-  /** Random override — defaults to `Math.random`. Tests inject seeded values. */
-  random?: () => number;
-}
-
-export type RetryDecision = { retry: false } | { retry: true; afterMs?: number };
-
-const defaultSleep = (ms: number): Promise<void> =>
-  new Promise((resolve) => setTimeout(resolve, ms));
-
-/**
- * Compute the delay before the next retry attempt.
- *
- * - When the caller specifies `afterMs` (e.g., from `Retry-After`), use
- *   `min(afterMs, capDelayMs)` so a misbehaving server can't pin the
- *   client for an arbitrarily long wait.
- * - Otherwise compute full-jitter exponential backoff:
- *   `random() * min(cap, base * 2^attempt)`. Full jitter (rather than
- *   "equal jitter") avoids retry-storm thundering herd, per AWS
- *   guidance on backoff strategies.
- */
-export function computeBackoffMs(
-  attempt: number,
-  baseDelayMs: number,
-  capDelayMs: number,
-  afterMs: number | undefined,
-  random: () => number,
-): number {
-  if (afterMs !== undefined) {
-    return Math.min(Math.max(0, afterMs), capDelayMs);
-  }
-  const exponential = baseDelayMs * Math.pow(2, attempt);
-  const upper = Math.min(capDelayMs, exponential);
-  return Math.floor(random() * upper);
-}
-
-/**
- * Execute `fn` with bounded retries.
- *
- * The classification of "retryable" is the caller's responsibility — see
- * `resilient-fetch.ts` for the GitHub-dispatch-specific rules. This
- * helper is the mechanical retry loop only.
- */
-export async function withRetry<T>(
-  fn: (attempt: number) => Promise<T>,
-  opts: RetryOptions,
-): Promise<T> {
-  if (opts.maxAttempts < 1) {
-    throw new Error(`withRetry: maxAttempts must be >= 1, got ${opts.maxAttempts}`);
-  }
-  const sleep = opts.sleep ?? defaultSleep;
-  const random = opts.random ?? Math.random;
-
-  let lastError: unknown;
-  for (let attempt = 0; attempt < opts.maxAttempts; attempt++) {
-    try {
-      return await fn(attempt);
-    } catch (err) {
-      lastError = err;
-      const decision = opts.isRetryable(err, attempt);
-      if (!decision.retry) throw err;
-      // Don't sleep after the final attempt.
-      if (attempt + 1 >= opts.maxAttempts) break;
-      const delayMs = computeBackoffMs(
-        attempt,
-        opts.baseDelayMs,
-        opts.capDelayMs,
-        decision.afterMs,
-        random,
-      );
-      if (delayMs > 0) await sleep(delayMs);
-    }
-  }
-  throw lastError;
-}

gitnexus-shared/src/integrations/understand-quickly.ts

@@ -1,151 +0,0 @@
-/**
- * Understand-Quickly registry integration helpers.
- *
- * Pure, runtime-agnostic logic for opting in to publishing a GitNexus
- * index to the [`looptech-ai/understand-quickly`](https://github.com/looptech-ai/understand-quickly)
- * registry. Lives in `gitnexus-shared` so both the Node CLI and any
- * future browser-side surface can construct identical dispatch payloads.
- *
- * Network I/O lives in the CLI command (`gitnexus/src/cli/publish.ts`)
- * to keep this module free of Node-only imports — see the comment at
- * the top of `gitnexus-shared/src/graph/types.ts`.
- *
- * The protocol contract (single dispatch event, no graph upload) is
- * documented at:
- *   https://github.com/looptech-ai/understand-quickly/blob/main/docs/integrations/protocol.md
- */
-
-/**
- * URL of the registry repo's repository_dispatch endpoint. Hardcoded
- * because the registry is the canonical home for this integration —
- * users who want a private registry can fork and patch.
- */
-export const UNDERSTAND_QUICKLY_DISPATCH_URL =
-  'https://api.github.com/repos/looptech-ai/understand-quickly/dispatches';
-
-/**
- * Event type the registry's sync workflow listens for.
- * See `looptech-ai/understand-quickly/.github/workflows/sync.yml`.
- */
-export const UNDERSTAND_QUICKLY_EVENT_TYPE = 'sync-entry';
-
-/** Environment variable that gates the dispatch. */
-export const UNDERSTAND_QUICKLY_TOKEN_ENV = 'UNDERSTAND_QUICKLY_TOKEN';
-
-export interface UqDispatchPayload {
-  event_type: typeof UNDERSTAND_QUICKLY_EVENT_TYPE;
-  client_payload: {
-    /** `<owner>/<repo>` shape — must match the registered entry. */
-    id: string;
-  };
-}
-
-/**
- * Build the JSON body for the `repository_dispatch` ping. Pure — no
- * env reads, no network. Validates that `id` looks like `owner/repo`
- * (one slash, no whitespace, both halves non-empty) so a misconfigured
- * caller fails loudly before the round-trip.
- */
-export function buildUqDispatchPayload(id: string): UqDispatchPayload {
-  if (!isValidOwnerRepo(id)) {
-    throw new Error(
-      `[understand-quickly] expected id of the form "owner/repo", got "${id}". ` +
-        `The registry uses this string to look up your entry in registry.json — ` +
-        `it must match the GitHub owner/repo of the source code, not a local path.`,
-    );
-  }
-  return {
-    event_type: UNDERSTAND_QUICKLY_EVENT_TYPE,
-    client_payload: { id },
-  };
-}
-
-/**
- * `owner/repo` validation. Conservative on purpose: GitHub's actual
- * naming rules are looser, but we want to catch local paths
- * (`/Users/...`), bare slugs (`my-repo`), and accidental whitespace.
- *
- * Matches GitHub's published slug rules:
- *   owner: starts with alnum, then alnum/hyphen only, must end with
- *          alnum (no trailing hyphen — GitHub rejects this at account
- *          creation, so a `my-org-/repo` input would otherwise pass us
- *          and 422 from GitHub). No underscore, no dot. Length cap 39.
- *   repo:  any of alnum/dot/hyphen/underscore. Length cap 100.
- */
-export function isValidOwnerRepo(id: string): boolean {
-  return /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?\/[A-Za-z0-9._-]{1,100}$/.test(id);
-}
-
-/**
- * Strip a single trailing `.git` (case-insensitive) and any trailing
- * slashes from a URL-ish string. Bounded linear: each character is
- * visited at most twice, no backtracking.
- *
- * Replaces `s.replace(/\.git\/*$/i, '').replace(/\/+$/, '')` which
- * CodeQL's polynomial-regex check (codeql/js/polynomial-redos) flags as
- * a worst-case O(n²) on adversarial input like "////.../x".
- */
-export function stripGitSuffix(input: string): string {
-  let end = input.length;
-  // Trim trailing '/'.
-  while (end > 0 && input.charCodeAt(end - 1) === 0x2f) end--;
-  // Drop one trailing '.git' (case-insensitive).
-  if (end >= 4) {
-    const tail = input.slice(end - 4, end).toLowerCase();
-    if (tail === '.git') end -= 4;
-  }
-  // Trim trailing '/' that may have sat between '.git' and the rest.
-  while (end > 0 && input.charCodeAt(end - 1) === 0x2f) end--;
-  return input.slice(0, end);
-}
-
-/**
- * Parse `owner/repo` out of a git remote URL. Mirrors the heuristic in
- * `gitnexus/src/storage/git.ts:parseRepoNameFromUrl` but keeps both
- * halves so we can build a registry id. Returns `null` on shapes we
- * don't recognise.
- *
- * Examples:
- *   git@github.com:looptech-ai/understand-quickly.git
- *   https://github.com/looptech-ai/understand-quickly
- *   ssh://git@github.com/looptech-ai/understand-quickly.git
- */
-export function parseOwnerRepoFromRemote(url: string | null | undefined): string | null {
-  if (!url) return null;
-  const trimmed = url.trim();
-  if (!trimmed) return null;
-  // Strip a trailing `.git` (case-insensitive) and any trailing slashes
-  // so https://h/o/r and https://h/o/r.git collapse to the same id.
-  // Bounded-linear helper avoids the polynomial-regex CodeQL alert.
-  const stripped = stripGitSuffix(trimmed);
-
-  // SCP-form SSH (`git@host:owner/repo`). Capture host so we can reject
-  // non-GitHub remotes — a GitLab origin like
-  // `https://gitlab.example.com/group/sub/project.git` would otherwise
-  // silently dispatch the wrong id (LOW 9).
-  const ssh = stripped.match(/^[^@]+@([^:]+):([^/]+)\/([^/]+)$/);
-  if (ssh) {
-    const host = ssh[1].toLowerCase();
-    if (host !== 'github.com' && host !== 'www.github.com') return null;
-    return `${ssh[2]}/${ssh[3]}`;
-  }
-
-  // URL forms (https://, ssh://, git://, file://) — last two path segments.
-  const url2 = stripped.match(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/([^/]+)\/(.+)$/);
-  if (url2) {
-    // Strip optional `userinfo@` (e.g. `ssh://git@github.com/...`).
-    const authority = url2[1];
-    const atIdx = authority.lastIndexOf('@');
-    const hostAndPort = atIdx >= 0 ? authority.slice(atIdx + 1) : authority;
-    // Strip `:port` suffix if present.
-    const colonIdx = hostAndPort.indexOf(':');
-    const host = (colonIdx >= 0 ? hostAndPort.slice(0, colonIdx) : hostAndPort).toLowerCase();
-    if (host !== 'github.com' && host !== 'www.github.com') return null;
-    const segments = url2[2].split('/').filter(Boolean);
-    if (segments.length >= 2) {
-      const [owner, repo] = segments.slice(-2);
-      return `${owner}/${repo}`;
-    }
-  }
-  return null;
-}

gitnexus-shared/src/scope-resolution/finalize-algorithm.ts

@@ -833,16 +833,7 @@ function expandWildcard(
   if (target === undefined) return [edge];
 
   const names = hooks.expandsWildcardTo(edge.targetModuleScope, workspace);
-  if (names.length === 0) {
-    // Resolved wildcard with zero propagating names is still a real file-
-    // level dependency (e.g. a C++ header that only declares classes —
-    // `#include` is a valid IMPORTS edge, but unqualified-binding names
-    // are correctly empty since class methods require `Class::method`).
-    // Preserve the original wildcard edge so the file→file IMPORTS edge
-    // survives; downstream binding materialization sees no propagated
-    // names because the edge has no `targetExportedName`/`localName`.
-    return [edge];
-  }
+  if (names.length === 0) return [];
 
   const expanded: ImportEdge[] = [];
   for (const name of names) {

gitnexus-shared/src/scope-resolution/method-dispatch-index.ts

@@ -40,27 +40,11 @@ export interface MethodDispatchIndex {
   readonly mroByOwnerDefId: ReadonlyMap<DefId, readonly DefId[]>;
   /** Interfaces / traits → classes that implement them. */
   readonly implsByInterfaceDefId: ReadonlyMap<DefId, readonly DefId[]>;
-  /**
-   * Optional parallel MRO view that EXCLUDES mixin-like augmentation
-   * (e.g., PHP traits). Populated only when the input supplies
-   * `computeExtendsOnlyMro`. Used by the super-branch dispatch in
-   * `receiver-bound-calls` so that `parent::method()` walks the
-   * inheritance chain only, not the trait-augmented one. Undefined for
-   * languages without mixin-like semantics — callers should fall back
-   * to `mroFor` when this is missing.
-   */
-  readonly extendsOnlyMroByOwnerDefId?: ReadonlyMap<DefId, readonly DefId[]>;
 
   /** `mroByOwnerDefId.get`, with an empty frozen array on miss. */
   mroFor(ownerDefId: DefId): readonly DefId[];
   /** `implsByInterfaceDefId.get`, with an empty frozen array on miss. */
   implementorsOf(interfaceDefId: DefId): readonly DefId[];
-  /**
-   * `extendsOnlyMroByOwnerDefId.get`, with an empty frozen array on miss.
-   * Undefined when `extendsOnlyMroByOwnerDefId` was not populated; callers
-   * should treat this as equivalent to `mroFor` for non-mixin languages.
-   */
-  readonly extendsOnlyMroFor?: (ownerDefId: DefId) => readonly DefId[];
 }
 
 export interface MethodDispatchInput {
@@ -97,25 +81,12 @@ export interface MethodDispatchInput {
    * write-wins policy and fires at most once per unique owner.
    */
   readonly implementsOf: (ownerDefId: DefId) => readonly DefId[];
-  /**
-   * Optional: return the EXTENDS-only ancestor chain for `ownerDefId`,
-   * excluding the owner itself AND any mixin-like augmentation (e.g.,
-   * PHP traits). Languages without mixin semantics leave this undefined
-   * and the index's `extendsOnlyMroByOwnerDefId` stays unpopulated.
-   *
-   * Same contract as `computeMro`: pure, deterministic, `[]` on no parents.
-   * Called at most once per unique owner (first-write-wins).
-   */
-  readonly computeExtendsOnlyMro?: (ownerDefId: DefId) => readonly DefId[];
 }
 
 // ─── Builder ────────────────────────────────────────────────────────────────
 
 export function buildMethodDispatchIndex(input: MethodDispatchInput): MethodDispatchIndex {
   const mroByOwnerDefId = new Map<DefId, readonly DefId[]>();
-  const extendsOnlyByOwnerDefId = input.computeExtendsOnlyMro
-    ? new Map<DefId, readonly DefId[]>()
-    : undefined;
   const implsBuilding = new Map<DefId, DefId[]>();
   const implsSeen = new Map<DefId, Set<DefId>>();
 
@@ -126,14 +97,6 @@ export function buildMethodDispatchIndex(input: MethodDispatchInput): MethodDisp
       const chain = input.computeMro(ownerId);
       mroByOwnerDefId.set(ownerId, Object.freeze(chain.slice()));
     }
-    if (
-      input.computeExtendsOnlyMro !== undefined &&
-      extendsOnlyByOwnerDefId !== undefined &&
-      !extendsOnlyByOwnerDefId.has(ownerId)
-    ) {
-      const extOnly = input.computeExtendsOnlyMro(ownerId);
-      extendsOnlyByOwnerDefId.set(ownerId, Object.freeze(extOnly.slice()));
-    }
 
     for (const ifaceId of input.implementsOf(ownerId)) {
       let seen = implsSeen.get(ifaceId);
@@ -158,7 +121,7 @@ export function buildMethodDispatchIndex(input: MethodDispatchInput): MethodDisp
     implsByInterfaceDefId.set(ifaceId, Object.freeze(owners.slice()));
   }
 
-  return wrapIndex(mroByOwnerDefId, implsByInterfaceDefId, extendsOnlyByOwnerDefId);
+  return wrapIndex(mroByOwnerDefId, implsByInterfaceDefId);
 }
 
 // ─── Internal ───────────────────────────────────────────────────────────────
@@ -168,9 +131,8 @@ const EMPTY: readonly DefId[] = Object.freeze([]);
 function wrapIndex(
   mroByOwnerDefId: Map<DefId, readonly DefId[]>,
   implsByInterfaceDefId: Map<DefId, readonly DefId[]>,
-  extendsOnlyMroByOwnerDefId: Map<DefId, readonly DefId[]> | undefined,
 ): MethodDispatchIndex {
-  const base: MethodDispatchIndex = {
+  return {
     mroByOwnerDefId,
     implsByInterfaceDefId,
     mroFor(ownerDefId: DefId): readonly DefId[] {
@@ -180,14 +142,4 @@ function wrapIndex(
       return implsByInterfaceDefId.get(interfaceDefId) ?? EMPTY;
     },
   };
-  if (extendsOnlyMroByOwnerDefId !== undefined) {
-    return {
-      ...base,
-      extendsOnlyMroByOwnerDefId,
-      extendsOnlyMroFor(ownerDefId: DefId): readonly DefId[] {
-        return extendsOnlyMroByOwnerDefId.get(ownerDefId) ?? EMPTY;
-      },
-    };
-  }
-  return base;
 }

gitnexus-shared/src/scope-resolution/registries/context.ts

@@ -30,43 +30,10 @@ export interface RegistryProviders {
    * when absent, every candidate receives `'unknown'` (neutral signal).
    */
   arityCompatibility?(callsite: Callsite, def: SymbolDefinition): ArityVerdict;
-
-  /**
-   * Language-specific constraint compatibility between a callsite and a
-   * candidate `def`. Mirrors `arityCompatibility` and shares its three-valued
-   * verdict shape; the third value `'unknown'` MUST keep the candidate
-   * (monotonicity: adding a predicate can only narrow correctly, never
-   * produce a wrong edge). Consulted by `narrowOverloadCandidates` after
-   * arity + type filters when a candidate carries `templateConstraints`.
-   *
-   * Optional; when absent the constraint filter is a pass-through. Languages
-   * with no constrained-overload semantics leave this undefined.
-   */
-  constraintCompatibility?(
-    callsite: Callsite,
-    def: SymbolDefinition,
-    ctx: ConstraintContext,
-  ): ArityVerdict;
 }
 
 export type ArityVerdict = 'compatible' | 'unknown' | 'incompatible';
 
-/**
- * Context threaded into `constraintCompatibility`. Kept minimal in the
- * Tier-A scope (only `argumentTypes`, riding here until a separate
- * `Callsite`-widening refactor moves them onto the call site directly).
- * Future Tier-B graph-aware predicates (`is_base_of_v`, etc.) will widen
- * this interface with `lookupTypeByName` and similar helpers.
- */
-export interface ConstraintContext {
-  /**
-   * Per-slot argument types at the call site, normalized per the language
-   * adapter. Empty string means unknown. Same convention as
-   * `narrowOverloadCandidates`' `argTypes` parameter.
-   */
-  readonly argumentTypes?: readonly string[];
-}
-
 // ─── Owner-scoped contributor (concrete shape for `RegistryContributor`) ────
 
 /**

gitnexus-shared/src/scope-resolution/registries/lookup-core.ts

@@ -423,30 +423,13 @@ function applyArityFilter(
   }
 
   let anyCompatible = false;
-  let anyUnknown = false;
   for (const state of perCandidate.values()) {
     const verdict = arityFn(callsite, state.def);
     state.signals.arityVerdict = verdict;
     if (verdict === 'compatible') anyCompatible = true;
-    else if (verdict === 'unknown') anyUnknown = true;
   }
 
-  // When ALL candidates are 'incompatible' (none compatible, none unknown),
-  // the call is genuinely arity-broken — drop every candidate so the
-  // registry returns no resolution. This matches the PHP variadic case
-  // f(int $req, ...$rest) called with zero args: every candidate definitively
-  // rejects, and emitting an edge to a definitively-rejected callable is
-  // a false positive. When some candidates are 'unknown' (missing metadata),
-  // keep the set so downstream evidence can break the tie — that's the
-  // original safety-fallback behavior.
-  if (!anyCompatible) {
-    if (!anyUnknown) {
-      for (const defId of perCandidate.keys()) {
-        perCandidate.delete(defId);
-      }
-    }
-    return;
-  }
+  if (!anyCompatible) return;
 
   // Filter: when at least one compatible candidate exists, drop incompatibles.
   for (const [defId, state] of perCandidate) {

gitnexus-shared/src/scope-resolution/symbol-definition.ts

@@ -11,17 +11,6 @@
 
 import type { NodeLabel } from '../graph/types.js';
 
-export interface ParameterTypeClass {
-  /** Normalized base type, matching the coarse `parameterTypes` vocabulary when known. */
-  base: string;
-  /** Top-level cv signal preserved from the original C++ parameter spelling. */
-  cv: 'none' | 'const' | 'volatile' | 'const volatile' | 'unknown';
-  /** Coarse value/reference/pointer shape. */
-  indirection: 'value' | 'lvalue-ref' | 'rvalue-ref' | 'pointer' | 'unknown';
-  /** Number of pointer markers when indirection is `pointer`; otherwise 0. */
-  pointerDepth: number;
-}
-
 export interface SymbolDefinition {
   nodeId: string;
   filePath: string;
@@ -37,22 +26,10 @@ export interface SymbolDefinition {
   /** Per-parameter type names for overload disambiguation (e.g. ['int', 'String']).
    *  Populated when parameter types are resolvable from AST (any typed language). */
   parameterTypes?: string[];
-  /** Additive per-parameter type shape sidecar for languages that need cv/ref/pointer distinctions.
-   *  Does not participate in graph node identity unless a resolver explicitly opts in. */
-  parameterTypeClasses?: ParameterTypeClass[];
   /** Raw return type text extracted from AST (e.g. 'User', 'Promise<User>') */
   returnType?: string;
   /** Declared type for non-callable symbols — fields/properties (e.g. 'Address', 'List<User>') */
   declaredType?: string;
-  /** Generic/template specialization arguments for class-like symbols (e.g. ['User'], ['T*']). */
-  templateArguments?: string[];
-  /** Per-language constraint payload for template / generic overloads
-   *  (e.g. C++ `enable_if_t<P, T>` predicate trees, C++20 `requires` clauses).
-   *  Opaque to shared code — the producing language adapter owns the shape
-   *  and is the only consumer. Read via the optional
-   *  `ScopeResolver.constraintCompatibility` hook during overload narrowing.
-   *  Absent for symbols that have no constraints (the common case). */
-  templateConstraints?: unknown;
   /** Links Method/Constructor/Property to owning Class/Struct/Trait nodeId */
   ownerId?: string;
 }

gitnexus-shared/src/test-helpers.ts

@@ -1,13 +0,0 @@
-/**
- * Test-only helpers.
- *
- * Symbols here are reachable from `gitnexus-shared/test-helpers` so test
- * suites can reset shared registries or exercise internal classifiers,
- * but they are deliberately NOT re-exported from the main `gitnexus-shared`
- * barrel. Production consumers should never import this module — calling
- * `__resetBreakerRegistry__()` from a tool implementation would silently
- * nuke every circuit breaker process-wide.
- */
-
-export { __resetBreakerRegistry__ } from './integrations/circuit-breaker.js';
-export { classifyOutcome } from './integrations/resilient-fetch.js';

gitnexus-web/package-lock.json

@@ -8,9 +8,9 @@
       "name": "gitnexus",
       "version": "0.0.0",
       "dependencies": {
-        "@langchain/anthropic": "^1.3.29",
+        "@langchain/anthropic": "^1.3.28",
         "@langchain/core": "^1.1.44",
-        "@langchain/google-genai": "^2.1.30",
+        "@langchain/google-genai": "^2.1.28",
         "@langchain/langgraph": "^1.2.9",
         "@langchain/ollama": "^1.2.6",
         "@langchain/openai": "^1.4.5",
@@ -26,10 +26,10 @@
         "graphology-layout-forceatlas2": "^0.10.1",
         "graphology-layout-noverlap": "^0.4.2",
         "graphology-utils": "^2.3.0",
-        "langchain": "^1.3.5",
+        "langchain": "^1.3.4",
         "lru-cache": "^11.2.4",
-        "lucide-react": "^1.14.0",
-        "mermaid": "^11.15.0",
+        "lucide-react": "^1.11.0",
+        "mermaid": "^11.14.0",
         "mnemonist": "^0.39.0",
         "pandemonium": "^2.4.0",
         "react": "^19.2.5",
@@ -49,7 +49,7 @@
         "@testing-library/jest-dom": "^6.9.1",
         "@testing-library/react": "^16.3.2",
         "@testing-library/user-event": "^14.6.1",
-        "@types/dompurify": "^3.2.0",
+        "@types/dompurify": "^3.0.5",
         "@types/node": "^25.6.0",
         "@types/react": "^19.2.14",
         "@types/react-dom": "^19.2.3",
@@ -60,7 +60,7 @@
         "jsdom": "^29.1.1",
         "tree-sitter-wasms": "^0.1.13",
         "typescript": "^5.4.5",
-        "vite": "^8.0.11",
+        "vite": "^8.0.10",
         "vitest": "^4.1.5",
         "wait-on": "^9.0.5"
       },
@@ -95,9 +95,9 @@
       }
     },
     "node_modules/@anthropic-ai/sdk": {
-      "version": "0.91.1",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.91.1.tgz",
-      "integrity": "sha512-LAmu761tSN9r66ixvmciswUj/ZC+1Q4iAfpedTfSVLeswRwnY3n2Nb6Tsk+cLPP28aLOPWeMgIuTuCcMC6W/iw==",
+      "version": "0.90.0",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.90.0.tgz",
+      "integrity": "sha512-MzZtPabJF1b0FTDl6Z6H5ljphPwACLGP13lu8MTiB8jXaW/YXlpOp+Po2cVou3MPM5+f5toyLnul9whKCy7fBg==",
       "license": "MIT",
       "dependencies": {
         "json-schema-to-ts": "^3.1.1"
@@ -528,10 +528,41 @@
       "integrity": "sha512-gAmrUZSGtKc3AiBL71iNWxDsyUC5uMaKKGdvzYsBoTW/xi42JQHl7eKV2OYzCUqvc+D2RCcf7EXY2iCyFIk6og==",
       "license": "MIT"
     },
+    "node_modules/@chevrotain/cst-dts-gen": {
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-12.0.0.tgz",
+      "integrity": "sha512-fSL4KXjTl7cDgf0B5Rip9Q05BOrYvkJV/RrBTE/bKDN096E4hN/ySpcBK5B24T76dlQ2i32Zc3PAE27jFnFrKg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/gast": "12.0.0",
+        "@chevrotain/types": "12.0.0"
+      }
+    },
+    "node_modules/@chevrotain/gast": {
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-12.0.0.tgz",
+      "integrity": "sha512-1ne/m3XsIT8aEdrvT33so0GUC+wkctpUPK6zU9IlOyJLUbR0rg4G7ZiApiJbggpgPir9ERy3FRjT6T7lpgetnQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/types": "12.0.0"
+      }
+    },
+    "node_modules/@chevrotain/regexp-to-ast": {
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/regexp-to-ast/-/regexp-to-ast-12.0.0.tgz",
+      "integrity": "sha512-p+EW9MaJwgaHguhoqwOtx/FwuGr+DnNn857sXWOi/mClXIkPGl3rn7hGNWvo31HA3vyeQxjqe+H36yZJwYU8cA==",
+      "license": "Apache-2.0"
+    },
     "node_modules/@chevrotain/types": {
-      "version": "11.1.2",
-      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-11.1.2.tgz",
-      "integrity": "sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw==",
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-12.0.0.tgz",
+      "integrity": "sha512-S+04vjFQKeuYw0/eW3U52LkAHQsB1ASxsPGsLPUyQgrZ2iNNibQrsidruDzjEX2JYfespXMG0eZmXlhA6z7nWA==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/@chevrotain/utils": {
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-12.0.0.tgz",
+      "integrity": "sha512-lB59uJoaGIfOOL9knQqQRfhl9g7x8/wqFkp13zTdkRu1huG9kg6IJs1O8hqj9rs6h7orGxHJUKb+mX3rPbWGhA==",
       "license": "Apache-2.0"
     },
     "node_modules/@cspotcode/source-map-support": {
@@ -1365,25 +1396,25 @@
       }
     },
     "node_modules/@langchain/anthropic": {
-      "version": "1.3.29",
-      "resolved": "https://registry.npmjs.org/@langchain/anthropic/-/anthropic-1.3.29.tgz",
-      "integrity": "sha512-ep1qBIcV07bajsg3fDqMd39rYwoRLOEK/6lk+MCxlm1YB5SRoKKJAZANrblQ/4RYhZJnxf95c6BSQu8VoNbVAQ==",
+      "version": "1.3.28",
+      "resolved": "https://registry.npmjs.org/@langchain/anthropic/-/anthropic-1.3.28.tgz",
+      "integrity": "sha512-gOF8oXJL8xDdYes2KXNI9vFm/9TldBBBHOjuCdt27kganVaQKzLvTw5kV6R4mjbnFagV5CWteNH7APLZYCpdwg==",
       "license": "MIT",
       "dependencies": {
-        "@anthropic-ai/sdk": "^0.91.1",
+        "@anthropic-ai/sdk": "^0.90.0",
         "zod": "^3.25.76 || ^4"
       },
       "engines": {
         "node": ">=20"
       },
       "peerDependencies": {
-        "@langchain/core": "^1.1.45"
+        "@langchain/core": "^1.1.42"
       }
     },
     "node_modules/@langchain/core": {
-      "version": "1.1.45",
-      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.1.45.tgz",
-      "integrity": "sha512-Y/wvuglLTMKJahkl4QD9dBIdF/z/CxZJWdTfHJF/q2jtlJtoFf6Mb5JpGxZfsi3mBY6NSG941FSLTcqhCKrhBA==",
+      "version": "1.1.44",
+      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.1.44.tgz",
+      "integrity": "sha512-RePW1IjGCHr9ua2vcby3aE8mOOz3EnwDZxMEGbNDT91kf14eqkJqxDXvaZFviGdcN9DTrxM5RPQNAHmwSm4tbg==",
       "license": "MIT",
       "dependencies": {
         "@cfworker/json-schema": "^4.0.2",
@@ -1402,18 +1433,32 @@
       }
     },
     "node_modules/@langchain/google-genai": {
-      "version": "2.1.30",
-      "resolved": "https://registry.npmjs.org/@langchain/google-genai/-/google-genai-2.1.30.tgz",
-      "integrity": "sha512-0wKgy1NvV89fw5MwYiOOhh18SnUEH20z6MZrPV6Tj2hMAA3jAHVSLlIcCQ2mDRJo2r1aHLV8MDXhzkvD1tEHoQ==",
+      "version": "2.1.28",
+      "resolved": "https://registry.npmjs.org/@langchain/google-genai/-/google-genai-2.1.28.tgz",
+      "integrity": "sha512-iTzNYWST8hTRqOXZdme18tq5GnCUwtrrJECE51ZCjg6Vg0mPsV44amdC+/bc+UK0+uphKWESGWs277aAyM2MlA==",
       "license": "MIT",
       "dependencies": {
-        "@google/generative-ai": "^0.24.0"
+        "@google/generative-ai": "^0.24.0",
+        "uuid": "^11.1.0"
       },
       "engines": {
         "node": ">=20"
       },
       "peerDependencies": {
-        "@langchain/core": "^1.1.43"
+        "@langchain/core": "^1.1.41"
+      }
+    },
+    "node_modules/@langchain/google-genai/node_modules/uuid": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
+      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/esm/bin/uuid"
       }
     },
     "node_modules/@langchain/langgraph": {
@@ -1634,12 +1679,12 @@
       }
     },
     "node_modules/@mermaid-js/parser": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz",
-      "integrity": "sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.0.tgz",
+      "integrity": "sha512-gxK9ZX2+Fex5zu8LhRQoMeMPEHbc73UKZ0FQ54YrQtUxE1VVhMwzeNtKRPAu5aXks4FasbMe4xB4bWrmq6Jlxw==",
       "license": "MIT",
       "dependencies": {
-        "@chevrotain/types": "~11.1.1"
+        "langium": "^4.0.0"
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
@@ -1699,9 +1744,9 @@
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.128.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.128.0.tgz",
-      "integrity": "sha512-huv1Y/LzBJkBVHt3OlC7u0zHBW9qXf1FdD7sGmc1rXc2P1mTwHssYv7jyGx5KAACSCH+9B3Bhn6Z9luHRvf7pQ==",
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.127.0.tgz",
+      "integrity": "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/Boshen"
@@ -1724,9 +1769,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.18.tgz",
-      "integrity": "sha512-lIDyUAfD7U3+BWKzdxMbJcsYHuqXqmGz40aeRqvuAm3y5TkJSYTBW2RDrn65DJFPQqVjUAUqq5uz8urzQ8aBdQ==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-s70pVGhw4zqGeFnXWvAzJDlvxhlRollagdCCKRgOsgUOH3N1l0LIxf83AtGzmb5SiVM4Hjl5HyarMRfdfj3DaQ==",
       "cpu": [
         "arm64"
       ],
@@ -1740,9 +1785,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.18.tgz",
-      "integrity": "sha512-apJq2ktnGp27nSInMR5Vcj8kY6xJzDAvfdIFlpDcAK/w4cDO58qVoi1YQsES/SKiFNge/6e4CUzgjfHduYqWpQ==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-4ksWc9n0mhlZpZ9PMZgTGjeOPRu8MB1Z3Tz0Mo02eWfWCHMW1zN82Qz/pL/rC+yQa+8ZnutMF0JjJe7PjwasYw==",
       "cpu": [
         "arm64"
       ],
@@ -1756,9 +1801,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.18.tgz",
-      "integrity": "sha512-5Ofot8xbs+pxRHJqm9/9N/4sTQOvdrwEsmPE9pdLEEoAbdZtG6F2LMDfO1sp6ZAtXJuJV/21ew2srq3W8NXB5g==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-SUSDOI6WwUVNcWxd02QEBjLdY1VPHvlEkw6T/8nYG322iYWCTxRb1vzk4E+mWWYehTp7ERibq54LSJGjmouOsw==",
       "cpu": [
         "x64"
       ],
@@ -1772,9 +1817,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.18.tgz",
-      "integrity": "sha512-7h8eeOTT1eyqJyx64BFCnWZpNm486hGWt2sqeLLgDxA0xI1oGZ9H7gK1S85uNGmBhkdPwa/6reTxfFFKvIsebw==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-hwnz3nw9dbJ05EDO/PvcjaaewqqDy7Y1rn1UO81l8iIK1GjenME75dl16ajbvSSMfv66WXSRCYKIqfgq2KCfxw==",
       "cpu": [
         "x64"
       ],
@@ -1788,9 +1833,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.18.tgz",
-      "integrity": "sha512-eRcm/HVt9U/JFu5RKAEKwGQYtDCKWLiaH6wOnsSEp6NMBb/3Os8LgHZlNyzMpFVNmiiMFlfb2zEnebfzJrHFmg==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.17.tgz",
+      "integrity": "sha512-IS+W7epTcwANmFSQFrS1SivEXHtl1JtuQA9wlxrZTcNi6mx+FDOYrakGevvvTwgj2JvWiK8B29/qD9BELZPyXQ==",
       "cpu": [
         "arm"
       ],
@@ -1804,9 +1849,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.18.tgz",
-      "integrity": "sha512-SOrT/cT4ukTmgnrEz/Hg3m7LBnuCLW9psDeMKrimRWY4I8DmnO7Lco8W2vtqPmMkbVu8iJ+g4GFLVLLOVjJ9DQ==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.17.tgz",
+      "integrity": "sha512-e6usGaHKW5BMNZOymS1UcEYGowQMWcgZ71Z17Sl/h2+ZziNJ1a9n3Zvcz6LdRyIW5572wBCTH/Z+bKuZouGk9Q==",
       "cpu": [
         "arm64"
       ],
@@ -1820,9 +1865,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.18.tgz",
-      "integrity": "sha512-QWjdxN1HJCpBTAcZ5N5F7wju3gVPzRzSpmGzx7na0c/1qpN9CFil+xt+l9lV/1M6/gqHSNXCiqPfwhVJPeLnug==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.17.tgz",
+      "integrity": "sha512-b/CgbwAJpmrRLp02RPfhbudf5tZnN9nsPWK82znefso832etkem8H7FSZwxrOI9djcdTP7U6YfNhbRnh7djErg==",
       "cpu": [
         "arm64"
       ],
@@ -1836,9 +1881,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.18.tgz",
-      "integrity": "sha512-ugCOyj7a4d9h3q9B+wXmf6g3a68UsjGh6dob5DHevHGMwDUbhsYNbSPxJsENcIttJZ9jv7qGM2UesLw5jqIhdg==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.17.tgz",
+      "integrity": "sha512-4EII1iNGRUN5WwGbF/kOh/EIkoDN9HsupgLQoXfY+D1oyJm7/F4t5PYU5n8SWZgG0FEwakyM8pGgwcBYruGTlA==",
       "cpu": [
         "ppc64"
       ],
@@ -1852,9 +1897,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.18.tgz",
-      "integrity": "sha512-kKWRhbsotpXkGbcd5dllUWg5gEXcDAa8u5YnP9AV5DYNbvJHGzzuwv7dpmhc8NqKMJldl0a+x76IHbspEpEmdA==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.17.tgz",
+      "integrity": "sha512-AH8oq3XqQo4IibpVXvPeLDI5pzkpYn0WiZAfT05kFzoJ6tQNzwRdDYQ45M8I/gslbodRZwW8uxLhbSBbkv96rA==",
       "cpu": [
         "s390x"
       ],
@@ -1868,9 +1913,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.18.tgz",
-      "integrity": "sha512-uCo8ElcCIAMyYAZyuIZ81oFkhTSIllNvUCHCAlbhlN4ji3uC28h7IIdlXyIvGO7HsuqnV9p3rD/bpH7XhIyhRw==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.17.tgz",
+      "integrity": "sha512-cLnjV3xfo7KslbU41Z7z8BH/E1y5mzUYzAqih1d1MDaIGZRCMqTijqLv76/P7fyHuvUcfGsIpqCdddbxLLK9rA==",
       "cpu": [
         "x64"
       ],
@@ -1884,9 +1929,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.18.tgz",
-      "integrity": "sha512-XNOQZtuE6yUIvx4rwGemwh8kpL1xvU41FXy/s9K7T/3JVcqGzo3NfKM2HrbrGgfPYGFW42f07Wk++aOC6B9NWA==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.17.tgz",
+      "integrity": "sha512-0phclDw1spsL7dUB37sIARuis2tAgomCJXAHZlpt8PXZ4Ba0dRP1e+66lsRqrfhISeN9bEGNjQs+T/Fbd7oYGw==",
       "cpu": [
         "x64"
       ],
@@ -1900,9 +1945,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.18.tgz",
-      "integrity": "sha512-tSn/kzrfa7tNOXr7sEacDBN4YsIqTyLqh45IO0nHDwtpKIDNDJr+VFojt+4klSpChxB29JLyduSsE0MKEwa65A==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-0ag/hEgXOwgw4t8QyQvUCxvEg+V0KBcA6YuOx9g0r02MprutRF5dyljgm3EmR02O292UX7UeS6HzWHAl6KgyhA==",
       "cpu": [
         "arm64"
       ],
@@ -1916,9 +1961,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.18.tgz",
-      "integrity": "sha512-+J9YGmc+czgqlhYmwun3S3O0FIZhsH8ep2456xwjAdIOmuJxM7xz4P4PtrxU+Bz17a/5bqPA8o3HAAoX0teUdg==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.17.tgz",
+      "integrity": "sha512-LEXei6vo0E5wTGwpkJ4KoT3OZJRnglwldt5ziLzOlc6qqb55z4tWNq2A+PFqCJuvWWdP53CVhG1Z9NtToDPJrA==",
       "cpu": [
         "wasm32"
       ],
@@ -1934,9 +1979,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.18.tgz",
-      "integrity": "sha512-zsu47DgU0FQzSwi6sU9dZoEdUv7pc1AptSEz/Z8HBg54sV0Pbs3N0+CrIbTsgiu6EyoaNN9CHboqbLaz9lhOyQ==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.17.tgz",
+      "integrity": "sha512-gUmyzBl3SPMa6hrqFUth9sVfcLBlYsbMzBx5PlexMroZStgzGqlZ26pYG89rBb45Mnia+oil6YAIFeEWGWhoZA==",
       "cpu": [
         "arm64"
       ],
@@ -1950,9 +1995,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.18.tgz",
-      "integrity": "sha512-7H+3yqGgmnlDTRRhw/xpYY9J1kf4GC681nVc4GqKhExZTDrVVrV2tsOR9kso0fvgBdcTCcQShx4SLLoHgaLwhg==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.17.tgz",
+      "integrity": "sha512-3hkiolcUAvPB9FLb3UZdfjVVNWherN1f/skkGWJP/fgSQhYUZpSIRr0/I8ZK9TkF3F7kxvJAk0+IcKvPHk9qQg==",
       "cpu": [
         "x64"
       ],
@@ -2755,14 +2800,13 @@
       "license": "MIT"
     },
     "node_modules/@types/dompurify": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-3.2.0.tgz",
-      "integrity": "sha512-Fgg31wv9QbLDA0SpTOXO3MaxySc4DKGLi8sna4/Utjo4r3ZRPdCt4UQee8BWr+Q5z21yifghREPJGYaEOEIACg==",
-      "deprecated": "This is a stub types definition. dompurify provides its own type definitions, so you do not need this installed.",
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-3.0.5.tgz",
+      "integrity": "sha512-1Wg0g3BtQF7sSb27fJQAKck1HECM6zV1EB66j8JH9i3LCjYabJa0FSdiSgsD5K/RbrsR0SiraKacLB+T8ZVYAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "dompurify": "*"
+        "@types/trusted-types": "*"
       }
     },
     "node_modules/@types/estree": {
@@ -2865,8 +2909,8 @@
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
       "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
-      "license": "MIT",
-      "optional": true
+      "devOptional": true,
+      "license": "MIT"
     },
     "node_modules/@types/unist": {
       "version": "3.0.3",
@@ -3598,6 +3642,34 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/chevrotain": {
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-12.0.0.tgz",
+      "integrity": "sha512-csJvb+6kEiQaqo1woTdSAuOWdN0WTLIydkKrBnS+V5gZz0oqBrp4kQ35519QgK6TpBThiG3V1vNSHlIkv4AglQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/cst-dts-gen": "12.0.0",
+        "@chevrotain/gast": "12.0.0",
+        "@chevrotain/regexp-to-ast": "12.0.0",
+        "@chevrotain/types": "12.0.0",
+        "@chevrotain/utils": "12.0.0"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/chevrotain-allstar": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/chevrotain-allstar/-/chevrotain-allstar-0.4.1.tgz",
+      "integrity": "sha512-PvVJm3oGqrveUVW2Vt/eZGeiAIsJszYweUcYwcskg9e+IubNYKKD+rHHem7A6XVO22eDAL+inxNIGAzZ/VIWlA==",
+      "license": "MIT",
+      "dependencies": {
+        "lodash-es": "^4.17.21"
+      },
+      "peerDependencies": {
+        "chevrotain": "^12.0.0"
+      }
+    },
     "node_modules/chownr": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
@@ -4555,16 +4627,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/es-toolkit": {
-      "version": "1.46.1",
-      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.46.1.tgz",
-      "integrity": "sha512-5eNtXOs3tbfxXOj04tjjseeWkRWaoCjdEI+96DgwzZoe6c9juL49pXlzAFTI72aWC9Y8p7168g6XIKjh7k6pyQ==",
-      "license": "MIT",
-      "workspaces": [
-        "docs",
-        "benchmarks"
-      ]
-    },
     "node_modules/esbuild": {
       "version": "0.27.0",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.0.tgz",
@@ -5581,21 +5643,53 @@
       "integrity": "sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw=="
     },
     "node_modules/langchain": {
-      "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/langchain/-/langchain-1.3.5.tgz",
-      "integrity": "sha512-QSB8TEo6G1tWupgNt1Osm8ylLLoOMq1lLw5NeijnIwRPI5BqdBjUn4/U8usbjEJJcQnbXSK2qTKgTx7zvblnBw==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/langchain/-/langchain-1.3.4.tgz",
+      "integrity": "sha512-umrD+ZC6vr0Q0U1lC5PoIMMQqgnP+7QhaIdAXCeZiSX2GPVBiVR7Ed2ZR+3MPvz1yWrRtIm17wPaovkND+wOXg==",
       "license": "MIT",
       "dependencies": {
         "@langchain/langgraph": "^1.2.9",
         "@langchain/langgraph-checkpoint": "^1.0.1",
         "langsmith": ">=0.5.0 <1.0.0",
+        "uuid": "^11.1.0",
         "zod": "^3.25.76 || ^4"
       },
       "engines": {
         "node": ">=20"
       },
       "peerDependencies": {
-        "@langchain/core": "^1.1.42"
+        "@langchain/core": "^1.1.41"
+      }
+    },
+    "node_modules/langchain/node_modules/uuid": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
+      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/esm/bin/uuid"
+      }
+    },
+    "node_modules/langium": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/langium/-/langium-4.2.2.tgz",
+      "integrity": "sha512-JUshTRAfHI4/MF9dH2WupvjSXyn8JBuUEWazB8ZVJUtXutT0doDlAv1XKbZ1Pb5sMexa8FF4CFBc0iiul7gbUQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@chevrotain/regexp-to-ast": "~12.0.0",
+        "chevrotain": "~12.0.0",
+        "chevrotain-allstar": "~0.4.1",
+        "vscode-languageserver": "~9.0.1",
+        "vscode-languageserver-textdocument": "~1.0.11",
+        "vscode-uri": "~3.1.0"
+      },
+      "engines": {
+        "node": ">=20.10.0",
+        "npm": ">=10.2.3"
       }
     },
     "node_modules/langsmith": {
@@ -5947,9 +6041,9 @@
       }
     },
     "node_modules/lucide-react": {
-      "version": "1.14.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.14.0.tgz",
-      "integrity": "sha512-+1mdWcfSJVUsaTIjN9zoezmUhfXo5l0vP7ekBMPo3jcS/aIkxHnXqAPsByszMZx/Y8oQBRJxJx5xg+RH3urzxA==",
+      "version": "1.11.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.11.0.tgz",
+      "integrity": "sha512-UOhjdztXCgdBReRcIhsvz2siIBogfv/lhJEIViCpLt924dO+GDms9T7DNoucI23s6kEPpe988m5N0D2ajnzb2g==",
       "license": "ISC",
       "peerDependencies": {
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
@@ -6341,14 +6435,14 @@
       }
     },
     "node_modules/mermaid": {
-      "version": "11.15.0",
-      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.15.0.tgz",
-      "integrity": "sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==",
+      "version": "11.14.0",
+      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.14.0.tgz",
+      "integrity": "sha512-GSGloRsBs+JINmmhl0JDwjpuezCsHB4WGI4NASHxL3fHo3o/BRXTxhDLKnln8/Q0lRFRyDdEjmk1/d5Sn1Xz8g==",
       "license": "MIT",
       "dependencies": {
         "@braintree/sanitize-url": "^7.1.1",
         "@iconify/utils": "^3.0.2",
-        "@mermaid-js/parser": "^1.1.1",
+        "@mermaid-js/parser": "^1.1.0",
         "@types/d3": "^7.4.3",
         "@upsetjs/venn.js": "^2.0.0",
         "cytoscape": "^3.33.1",
@@ -6359,14 +6453,27 @@
         "dagre-d3-es": "7.0.14",
         "dayjs": "^1.11.19",
         "dompurify": "^3.3.1",
-        "es-toolkit": "^1.45.1",
         "katex": "^0.16.25",
         "khroma": "^2.1.0",
+        "lodash-es": "^4.17.23",
         "marked": "^16.3.0",
         "roughjs": "^4.6.6",
         "stylis": "^4.3.6",
         "ts-dedent": "^2.2.0",
-        "uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0"
+        "uuid": "^11.1.0"
+      }
+    },
+    "node_modules/mermaid/node_modules/uuid": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
+      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/esm/bin/uuid"
       }
     },
     "node_modules/micromark": {
@@ -7122,9 +7229,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
+      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
       "funding": [
         {
           "type": "github",
@@ -7501,9 +7608,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+      "version": "8.5.10",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz",
+      "integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -7853,13 +7960,13 @@
       "license": "Unlicense"
     },
     "node_modules/rolldown": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.18.tgz",
-      "integrity": "sha512-phmyKBpuBdRYDf4hgyynGAYn/rDDe+iZXKVJ7WX5b1zQzpLkP5oJRPGsfJuHdzPMlyyEO/4sPW6yfSx2gf7lVg==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.17.tgz",
+      "integrity": "sha512-ZrT53oAKrtA4+YtBWPQbtPOxIbVDbxT0orcYERKd63VJTF13zPcgXTvD4843L8pcsI7M6MErt8QtON6lrB9tyA==",
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.128.0",
-        "@rolldown/pluginutils": "1.0.0-rc.18"
+        "@oxc-project/types": "=0.127.0",
+        "@rolldown/pluginutils": "1.0.0-rc.17"
       },
       "bin": {
         "rolldown": "bin/cli.mjs"
@@ -7868,27 +7975,27 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.0-rc.18",
-        "@rolldown/binding-darwin-arm64": "1.0.0-rc.18",
-        "@rolldown/binding-darwin-x64": "1.0.0-rc.18",
-        "@rolldown/binding-freebsd-x64": "1.0.0-rc.18",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.18",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.18",
-        "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.18",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.18",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.18",
-        "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.18",
-        "@rolldown/binding-linux-x64-musl": "1.0.0-rc.18",
-        "@rolldown/binding-openharmony-arm64": "1.0.0-rc.18",
-        "@rolldown/binding-wasm32-wasi": "1.0.0-rc.18",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.18",
-        "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.18"
+        "@rolldown/binding-android-arm64": "1.0.0-rc.17",
+        "@rolldown/binding-darwin-arm64": "1.0.0-rc.17",
+        "@rolldown/binding-darwin-x64": "1.0.0-rc.17",
+        "@rolldown/binding-freebsd-x64": "1.0.0-rc.17",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.17",
+        "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.17",
+        "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.17",
+        "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.17",
+        "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.17",
+        "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.17",
+        "@rolldown/binding-linux-x64-musl": "1.0.0-rc.17",
+        "@rolldown/binding-openharmony-arm64": "1.0.0-rc.17",
+        "@rolldown/binding-wasm32-wasi": "1.0.0-rc.17",
+        "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.17",
+        "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.17"
       }
     },
     "node_modules/rolldown/node_modules/@rolldown/pluginutils": {
-      "version": "1.0.0-rc.18",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.18.tgz",
-      "integrity": "sha512-CUY5Mnhe64xQBGZEEXQ5WyZwsc1JU3vAZLIxtrsBt3LO6UOb+C8GunVKqe9sT8NeWb4lqSaoJtp2xo6GxT1MNw==",
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.17.tgz",
+      "integrity": "sha512-n8iosDOt6Ig1UhJ2AYqoIhHWh/isz0xpicHTzpKBeotdVsTEcxsSA/i3EVM7gQAj0rU27OLAxCjzlj15IWY7bg==",
       "license": "MIT"
     },
     "node_modules/roughjs": {
@@ -8608,15 +8715,15 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.0.11",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.11.tgz",
-      "integrity": "sha512-Jz1mxtUBR5xTT65VOdJZUUeoyLtqljmFkiUXhPTLZka3RDc9vpi/xXkyrnsdRcm2lIi3l3GPMnAidTsEGIj3Ow==",
+      "version": "8.0.10",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.10.tgz",
+      "integrity": "sha512-rZuUu9j6J5uotLDs+cAA4O5H4K1SfPliUlQwqa6YEwSrWDZzP4rhm00oJR5snMewjxF5V/K3D4kctsUTsIU9Mw==",
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
-        "postcss": "^8.5.14",
-        "rolldown": "1.0.0-rc.18",
+        "postcss": "^8.5.10",
+        "rolldown": "1.0.0-rc.17",
         "tinyglobby": "^0.2.16"
       },
       "bin": {
@@ -8633,7 +8740,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.18",
+        "@vitejs/devtools": "^0.1.0",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
@@ -8781,6 +8888,55 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/vscode-jsonrpc": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-8.2.0.tgz",
+      "integrity": "sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/vscode-languageserver": {
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver/-/vscode-languageserver-9.0.1.tgz",
+      "integrity": "sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g==",
+      "license": "MIT",
+      "dependencies": {
+        "vscode-languageserver-protocol": "3.17.5"
+      },
+      "bin": {
+        "installServerIntoExtension": "bin/installServerIntoExtension"
+      }
+    },
+    "node_modules/vscode-languageserver-protocol": {
+      "version": "3.17.5",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-protocol/-/vscode-languageserver-protocol-3.17.5.tgz",
+      "integrity": "sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg==",
+      "license": "MIT",
+      "dependencies": {
+        "vscode-jsonrpc": "8.2.0",
+        "vscode-languageserver-types": "3.17.5"
+      }
+    },
+    "node_modules/vscode-languageserver-textdocument": {
+      "version": "1.0.12",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-textdocument/-/vscode-languageserver-textdocument-1.0.12.tgz",
+      "integrity": "sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA==",
+      "license": "MIT"
+    },
+    "node_modules/vscode-languageserver-types": {
+      "version": "3.17.5",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.17.5.tgz",
+      "integrity": "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg==",
+      "license": "MIT"
+    },
+    "node_modules/vscode-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.1.0.tgz",
+      "integrity": "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==",
+      "license": "MIT"
+    },
     "node_modules/w3c-xmlserializer": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",

gitnexus-web/package.json

@@ -19,9 +19,9 @@
   },
   "dependencies": {
     "gitnexus-shared": "file:../gitnexus-shared",
-    "@langchain/anthropic": "^1.3.29",
+    "@langchain/anthropic": "^1.3.28",
     "@langchain/core": "^1.1.44",
-    "@langchain/google-genai": "^2.1.30",
+    "@langchain/google-genai": "^2.1.28",
     "@langchain/langgraph": "^1.2.9",
     "@langchain/ollama": "^1.2.6",
     "@langchain/openai": "^1.4.5",
@@ -36,10 +36,10 @@
     "graphology-layout-forceatlas2": "^0.10.1",
     "graphology-layout-noverlap": "^0.4.2",
     "graphology-utils": "^2.3.0",
-    "langchain": "^1.3.5",
+    "langchain": "^1.3.4",
     "lru-cache": "^11.2.4",
-    "lucide-react": "^1.14.0",
-    "mermaid": "^11.15.0",
+    "lucide-react": "^1.11.0",
+    "mermaid": "^11.14.0",
     "mnemonist": "^0.39.0",
     "pandemonium": "^2.4.0",
     "react": "^19.2.5",
@@ -59,7 +59,7 @@
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/dompurify": "^3.2.0",
+    "@types/dompurify": "^3.0.5",
     "@types/node": "^25.6.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
@@ -70,7 +70,7 @@
     "jsdom": "^29.1.1",
     "tree-sitter-wasms": "^0.1.13",
     "typescript": "^5.4.5",
-    "vite": "^8.0.11",
+    "vite": "^8.0.10",
     "vitest": "^4.1.5",
     "wait-on": "^9.0.5"
   }

gitnexus-web/src/core/llm/settings-service.ts

@@ -20,7 +20,6 @@ import {
   ProviderConfig,
 } from './types';
 import { DEFAULT_OPENROUTER_BASE_URL, DEFAULT_OLLAMA_BASE_URL } from '../../config/ui-constants';
-import { resilientFetch } from 'gitnexus-shared';
 
 const STORAGE_KEY = 'gitnexus-llm-settings';
 
@@ -408,10 +407,7 @@ export const getAvailableModels = (provider: LLMProvider): string[] => {
  */
 export const fetchOpenRouterModels = async (): Promise<Array<{ id: string; name: string }>> => {
   try {
-    const response = await resilientFetch(`${DEFAULT_OPENROUTER_BASE_URL}/models`, undefined, {
-      breakerKey: 'openrouter-models',
-      retry: { maxAttempts: 2, baseDelayMs: 500, capDelayMs: 2_000 },
-    });
+    const response = await fetch(`${DEFAULT_OPENROUTER_BASE_URL}/models`);
     if (!response.ok) throw new Error('Failed to fetch models');
     const data = await response.json();
     return data.data.map((model: any) => ({

gitnexus-web/src/services/backend-client.ts

@@ -7,7 +7,6 @@
  */
 
 import type { GraphNode, GraphRelationship } from 'gitnexus-shared';
-import { CircuitOpenError, ResilientFetchExhaustedError, resilientFetch } from 'gitnexus-shared';
 
 // ── Types ──────────────────────────────────────────────────────────────────
 
@@ -205,32 +204,8 @@ export function streamSSE<T = unknown>(url: string, handlers: SSEHandlers<T>): A
 
 let _backendUrl = 'http://localhost:4747';
 
-/**
- * Validate that a backend URL is a safe http:// or https:// origin before
- * storing it as the fetch target base (CodeQL js/client-side-request-forgery).
- *
- * Throws if the URL uses a non-HTTP scheme (e.g. javascript:, data:, file://).
- * All other well-formed http/https URLs are accepted — the client intentionally
- * supports connecting to remote GitNexus servers, not just localhost.
- */
-export function validateBackendUrl(url: string): void {
-  let parsed: URL;
-  try {
-    parsed = new URL(url);
-  } catch {
-    // Do not echo raw input — it may contain credentials.
-    throw new Error('Invalid backend URL: must be a well-formed http:// or https:// URL');
-  }
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-    // Use parsed.protocol only (scheme), not the full URL, to avoid leaking credentials.
-    throw new Error(`Backend URL must use http:// or https:// (got ${parsed.protocol})`);
-  }
-}
-
 export const setBackendUrl = (url: string): void => {
-  const trimmed = url.replace(/\/$/, '');
-  validateBackendUrl(trimmed);
-  _backendUrl = trimmed;
+  _backendUrl = url.replace(/\/$/, '');
 };
 
 export const getBackendUrl = (): string => _backendUrl;
@@ -262,90 +237,28 @@ export function normalizeServerUrl(input: string): string {
 const DEFAULT_TIMEOUT_MS = 30_000;
 const PROBE_TIMEOUT_MS = 2_000;
 
-/** Idempotent HTTP methods. Other verbs (POST, PATCH, PUT, DELETE) get
- *  a single-attempt retry budget by default to avoid duplicate side
- *  effects on retry — a POST that 5xx'd may have already executed
- *  server-side. Callers that have idempotency keys or otherwise know
- *  their mutation is safe to retry can opt in via `forceRetry`. */
-const IDEMPOTENT_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
-
 const fetchWithTimeout = async (
   url: string,
   init: RequestInit = {},
   timeoutMs: number = DEFAULT_TIMEOUT_MS,
-  /**
-   * Force a retry budget on non-idempotent methods. Default false.
-   * Pass true only when the endpoint is known-idempotent (e.g. DELETE
-   * of a known-deleted resource — second call is a 404 / no-op) AND
-   * the duplicate-side-effect window is acceptable.
-   */
-  forceRetry = false,
 ): Promise<Response> => {
-  // Merge the external caller signal (if any) with an
-  // `AbortSignal.timeout()` so a timer-fired abort produces a
-  // `DOMException` with `name === 'TimeoutError'` — which
-  // `resilientFetch` correctly classifies as terminal-network (no
-  // retry, no breaker hit). A manual `AbortController.abort()` would
-  // produce `name === 'AbortError'` and route through the
-  // retryable-network branch, which mis-penalizes the breaker for
-  // user-side network slowness.
-  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  const controller = new AbortController();
+  // Merge external signal if provided
   const externalSignal = init.signal;
-  const signal = externalSignal ? AbortSignal.any([timeoutSignal, externalSignal]) : timeoutSignal;
-
-  const method = (init.method ?? 'GET').toUpperCase();
-  const isIdempotent = IDEMPOTENT_METHODS.has(method);
-  const maxAttempts = isIdempotent || forceRetry ? 2 : 1;
-
-  // Key the breaker by the current backend origin so switching backend
-  // URLs (e.g. recovering from a flapping local server by pointing at
-  // a different host) gives the new origin a fresh breaker state. A
-  // single shared `'web-backend'` key would otherwise leave a user
-  // locked out for the full cooldown after one bad host trips the
-  // circuit. The malformed-URL fallback is defensive — `setBackendUrl`
-  // normalizes input, so this branch shouldn't fire in practice.
-  let breakerKey: string;
-  try {
-    breakerKey = `web-backend:${new URL(_backendUrl).origin}`;
-  } catch {
-    breakerKey = 'web-backend:invalid';
+  if (externalSignal) {
+    externalSignal.addEventListener('abort', () => controller.abort());
   }
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
 
   try {
-    // Bounded retries + 5xx/429 handling are delegated to resilientFetch.
-    // Method-aware budget: idempotent verbs retry once on transient
-    // backend failures; mutations (POST/PATCH/PUT/DELETE) default to
-    // single-attempt to avoid duplicate side effects.
-    const response = await resilientFetch(
-      url,
-      { ...init, signal },
-      {
-        breakerKey,
-        retry: { maxAttempts, baseDelayMs: 250, capDelayMs: 1500 },
-      },
-    );
+    const response = await fetch(url, { ...init, signal: controller.signal });
     return response;
   } catch (error: unknown) {
-    if (error instanceof CircuitOpenError) {
-      throw new BackendError(
-        `GitNexus backend at ${_backendUrl} is unhealthy; retry in ${Math.ceil(error.retryAfterMs / 1000)}s`,
-        0,
-        'network',
-      );
-    }
-    if (error instanceof ResilientFetchExhaustedError) {
-      // Fall through to caller — surface the raw response so assertOk
-      // can craft the BackendError with the right code.
-      return error.response;
-    }
-    if (error instanceof DOMException && error.name === 'TimeoutError') {
-      throw new BackendError(`Request to ${url} timed out after ${timeoutMs}ms`, 0, 'timeout');
-    }
     if (error instanceof DOMException && error.name === 'AbortError') {
-      // External caller-driven cancellation — `timeoutSignal` would
-      // have surfaced as TimeoutError above, so this branch covers
-      // only the externally-aborted case.
-      throw new BackendError('Request aborted', 0, 'network');
+      if (externalSignal?.aborted) {
+        throw new BackendError('Request aborted', 0, 'network');
+      }
+      throw new BackendError(`Request to ${url} timed out after ${timeoutMs}ms`, 0, 'timeout');
     }
     if (error instanceof TypeError) {
       throw new BackendError(
@@ -355,6 +268,8 @@ const fetchWithTimeout = async (
       );
     }
     throw error;
+  } finally {
+    clearTimeout(timer);
   }
 };
 

gitnexus-web/test/unit/backend-client-retry.test.ts

@@ -1,110 +0,0 @@
-/**
- * Method-aware retry budget + timeout-as-TimeoutError verification for
- * backend-client's `fetchWithTimeout`.
- *
- * Closes review findings on PR #1448:
- *   - Non-idempotent POST/DELETE must NOT be retried by default —
- *     a 5xx on `startAnalyze` could otherwise start a duplicate job.
- *   - Timer-fired timeout must surface as `DOMException(name='TimeoutError')`,
- *     not `AbortError`, so resilientFetch routes it through the
- *     terminal-network branch (no retry, no breaker hit).
- */
-
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { getBreaker } from 'gitnexus-shared';
-import { __resetBreakerRegistry__ } from 'gitnexus-shared/test-helpers';
-import { fetchRepos, setBackendUrl, startAnalyze } from '../../src/services/backend-client';
-
-const BASE = 'http://localhost:4747';
-
-describe('backend-client retry budget (method-aware)', () => {
-  beforeEach(() => {
-    __resetBreakerRegistry__();
-    setBackendUrl(BASE);
-  });
-
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it('GET retries once on transient 503 (idempotent verb)', async () => {
-    let n = 0;
-    const fetchMock = vi.fn(async () => {
-      n += 1;
-      if (n === 1) return new Response('boom', { status: 503 });
-      return new Response('[]', {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      });
-    });
-    vi.stubGlobal('fetch', fetchMock);
-
-    const repos = await fetchRepos();
-    expect(repos).toEqual([]);
-    // 1 retry budget on idempotent GET → 2 total fetch calls.
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-  });
-
-  it('POST does NOT retry on 503 by default (non-idempotent verb)', async () => {
-    const fetchMock = vi.fn(async () => new Response('boom', { status: 503 }));
-    vi.stubGlobal('fetch', fetchMock);
-
-    await expect(startAnalyze({ path: '/tmp/repo' })).rejects.toBeTruthy();
-    // Single attempt — never duplicates a job-start POST.
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-  });
-
-  it('switching backend URL after a circuit opens reaches a fresh breaker (U3)', async () => {
-    // Pre-open the breaker for host-A by directly recording 3 failures.
-    setBackendUrl('http://host-a.test:4747');
-    const aKey = 'web-backend:http://host-a.test:4747';
-    const breakerA = getBreaker(aKey);
-    breakerA.recordFailure();
-    breakerA.recordFailure();
-    breakerA.recordFailure();
-    expect(breakerA.getState()).toBe('open');
-
-    // Switch to host-B and make a request — must succeed against the
-    // new origin without tripping the host-A circuit. Under the old
-    // single-key behaviour the call would throw CircuitOpenError.
-    setBackendUrl('http://host-b.test:4747');
-    const fetchMock = vi.fn(
-      async () =>
-        new Response('[]', {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        }),
-    );
-    vi.stubGlobal('fetch', fetchMock);
-
-    const repos = await fetchRepos();
-    expect(repos).toEqual([]);
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // Host-A's breaker is still open in cooldown.
-    expect(breakerA.getState()).toBe('open');
-    // Host-B has its own (fresh) breaker.
-    const bKey = 'web-backend:http://host-b.test:4747';
-    expect(getBreaker(bKey).getState()).toBe('closed');
-    expect(getBreaker(bKey).getConsecutiveFailures()).toBe(0);
-  });
-
-  it('breaker not incremented when timeout fires (TimeoutError, not AbortError)', async () => {
-    // Reject directly with a TimeoutError DOMException, mimicking what
-    // `fetch` produces when its `AbortSignal.timeout()`-wired signal
-    // fires. The real-fetch path goes signal.reason → reject(reason);
-    // we shortcut that here so the test doesn't have to wait the
-    // 30-second default timeout.
-    const fetchMock = vi.fn(async () => {
-      throw new DOMException('aborted by timeout', 'TimeoutError');
-    });
-    vi.stubGlobal('fetch', fetchMock);
-
-    await expect(fetchRepos()).rejects.toMatchObject({ code: 'timeout' });
-
-    // The breaker must not have been penalized for a local timeout.
-    expect(getBreaker(`web-backend:${BASE}`).getConsecutiveFailures()).toBe(0);
-    // Timeout is terminal — no retry attempted.
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-  });
-});

gitnexus-web/test/unit/server-connection.test.ts

@@ -1,11 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
-import {
-  fetchGraph,
-  getBackendUrl,
-  normalizeServerUrl,
-  setBackendUrl,
-  validateBackendUrl,
-} from '../../src/services/backend-client';
+import { fetchGraph, normalizeServerUrl, setBackendUrl } from '../../src/services/backend-client';
 
 describe('normalizeServerUrl', () => {
   it('adds http:// to localhost', () => {
@@ -171,61 +165,3 @@ describe('fetchGraph', () => {
     });
   });
 });
-
-describe('validateBackendUrl', () => {
-  it('allows http:// URLs', () => {
-    expect(() => validateBackendUrl('http://localhost:4747')).not.toThrow();
-    expect(() => validateBackendUrl('http://127.0.0.1:4747')).not.toThrow();
-  });
-
-  it('allows https:// URLs', () => {
-    expect(() => validateBackendUrl('https://gitnexus.example.com')).not.toThrow();
-    expect(() => validateBackendUrl('https://my-server.internal:4747')).not.toThrow();
-  });
-
-  it('rejects non-http schemes', () => {
-    expect(() => validateBackendUrl('javascript:alert(1)')).toThrow('must use http:// or https://');
-    expect(() => validateBackendUrl('file:///etc/passwd')).toThrow('must use http:// or https://');
-    expect(() => validateBackendUrl('data:text/plain,evil')).toThrow(
-      'must use http:// or https://',
-    );
-  });
-
-  it('rejects malformed URLs', () => {
-    expect(() => validateBackendUrl('not-a-url')).toThrow('Invalid backend URL');
-  });
-
-  it('does not include the raw URL in error messages (credential hygiene)', () => {
-    const urlWithCreds = 'javascript:alert("sk-secret")';
-    let msg = '';
-    try {
-      validateBackendUrl(urlWithCreds);
-    } catch (e) {
-      msg = (e as Error).message;
-    }
-    expect(msg).not.toContain('sk-secret');
-    expect(msg).not.toContain(urlWithCreds);
-  });
-});
-
-describe('setBackendUrl', () => {
-  it('accepts valid http URLs', () => {
-    expect(() => setBackendUrl('http://localhost:4747')).not.toThrow();
-  });
-
-  it('accepts valid https URLs', () => {
-    expect(() => setBackendUrl('https://my-server.example.com')).not.toThrow();
-  });
-
-  it('rejects non-http/https schemes', () => {
-    expect(() => setBackendUrl('javascript:alert(1)')).toThrow('must use http:// or https://');
-    expect(() => setBackendUrl('file:///etc/passwd')).toThrow('must use http:// or https://');
-  });
-
-  it('does not mutate _backendUrl when validation fails', () => {
-    setBackendUrl('http://localhost:4747');
-    expect(() => setBackendUrl('javascript:alert(1)')).toThrow();
-    // State must be preserved — validation must happen before the assignment
-    expect(getBackendUrl()).toBe('http://localhost:4747');
-  });
-});

gitnexus/.claude/settings.local.json

@@ -1,18 +1,5 @@
 {
   "permissions": {
-    "allow": [
-      "mcp__plugin_claude-mem_mcp-search__get_observations",
-      "Skill(gitnexus-exploring)",
-      "Bash(npx gitnexus *)",
-      "mcp__obsidian-memory__search_nodes",
-      "mcp__obsidian-memory__add_observations",
-      "WebSearch",
-      "WebFetch(domain:cppreference.net)",
-      "Bash(xargs grep -l \"templateArguments\\\\|parameterTypes\")",
-      "Bash(gh issue *)",
-      "Bash(gh pr *)"
-    ]
-  },
-  "enableAllProjectMcpServers": true,
-  "enabledMcpjsonServers": ["gitnexus"]
+    "allow": ["mcp__plugin_claude-mem_mcp-search__get_observations"]
+  }
 }

gitnexus/CHANGELOG.md

@@ -4,127 +4,6 @@ All notable changes to GitNexus will be documented in this file.
 
 ## [Unreleased]
 
-## [1.6.5] - 2026-05-16
-
-### Added
-
-- **C++ ADL V2** — Argument-Dependent Lookup overhaul. Class-typed reference args (incl. rvalue refs) contribute associated namespaces (#1595); class-pointer args and template-specialization args (with nested template args) included (#1592, #1596); base-class associated namespaces walked via MRO (#1597); free-function reference args contribute enclosing namespace (#1598); ordinary and ADL free-call candidates merged before overload selection (#1599)
-- **C++ standard-conversion-sequence ranking** for overload resolution (#1606)
-- **C++ scope-resolution migration** — C++ now runs on the registry-primary RFC #909 path (#938, #1520); template-body `this->` + `using ns::name` calls resolved in the scope resolver (#1590); template specializations disambiguated in class graph IDs and receiver routing (#1587); EXTENDS edges for template and qualified template bases (#1581)
-- **PHP scope-resolution migration** — PHP moved to scope-based resolution (#938, #1497, supersedes #1124)
-- **Java scope-resolution migration** — RFC #909 Ring 3 (#1482)
-- **C scope-resolution migration** — RFC #909 Ring 3 (#1481)
-- **Incremental indexing** — `gitnexus analyze` now reuses a parse cache, writes back to DB, and short-circuits scope resolution when nothing changed (#1479)
-- **`gitnexus:keep` marker** — preserves custom context sections (#605, #1508)
-- **`gitnexus analyze --skip-skills` and `--index-only`** flags (#742, #1485)
-- **`gitnexus wiki --timeout` and `--retries` flags** — mitigate timeout aborts on large module pages (#1543)
-- **HTTP embedding `dimensions` parameter** — now forwarded to the embedding endpoint (#1498)
-- **Cursor 2.4 `postToolUse` hooks** — upgraded for Read/Grep/Shell coverage (#1467)
-
-### Fixed
-
-- **Cross-file type propagation** — resolved a stall on large repos (#1626)
-- **C++ inline-namespace ambiguity** — detect same-name ambiguity across inline namespace children (#1564, #1600); workspace-wide dependent-base name resolution for cross-file templates (#1586)
-- **Parse cache persistence** — sharded on large repos to avoid corruption (#1580)
-- **TypeScript ESM `.js` extension** — fallback applied to tsconfig path-alias resolution (#1530) and `.js` → `.ts` source resolution (#1525)
-- **Markdown CRLF line endings** — section heading parser now handles them (#1469)
-- **`gitnexus analyze --no-stats`** — actually omits volatile counts (#1477, #1478)
-- **`ensureGitNexusIgnored`** — tolerate read-only workspaces (#1549, #1550)
-- **Claude augment hook** — skipped when GitNexus server owns the DB (#1493)
-- **Docker runtime image** — symlink `gitnexus` binary onto `$PATH` (#1551); install `ca-certificates` for TLS verification (#1545, #1547); include duckdb installer script (#1502)
-- **Windows reliability** — fix 32767-char tree-sitter crash and VECTOR-extension SIGSEGV (#1433); platform-aware `tsc` build command for win32 (#1531)
-- **Search / FTS** — guard against undefined `bm25Results` when FTS is unavailable (#1489, #1540); CONTAINS fallback in augment when FTS indexes unavailable (#1476)
-- **Wiki** — sanitize generated mermaid diagrams (#1539)
-- **Hooks** — cap concurrent augment subprocesses to prevent runaway fan-out (#1486, #1510)
-- **LadybugDB** — drain checkpoint result before close (#1506); recover `gitnexus analyze` from orphan sidecars when the main DB file is missing (#1622)
-- **Group / contracts** — detect `httpx` async consumers (#1408)
-- **Server hardening** — sanitize repo name to prevent argument injection on `/api/analyze` (#1305)
-
-### Changed
-
-- **CI release pipeline unified under `publish.yml`** — single source of truth for npm publish, provenance, and GitHub Release creation (#1610)
-- **CI: skip RC build on release PRs** — release/* branches no longer cut redundant RCs (#1474)
-- **CI (Claude review): make `/review` reliably post PR comments** (#1522); allow Bash in code-review job without interactive approval (#1523)
-- **CI publish (post-merge fixes)** — bump publish job to Node 24 for npm OIDC support (#1628); engage npm Trusted Publishing OIDC properly (#1627)
-- **Tests** — remove flaky regression test for resource exhaustion (#1521); de-flake regex linearity assertions in U8 (#1475)
-
-### Chore / Dependencies
-
-- `vitest` 4.1.5 → 4.1.6 in /gitnexus (#1605)
-- `@langchain/google-genai` bump in /gitnexus-web (#1554)
-- `vite` 8.0.10 → 8.0.11 in /gitnexus-web (#1555)
-- `mermaid` bump (#1514)
-- `protobufjs` 7.5.5 → 7.5.8 + `@protobufjs/utf8` in /gitnexus (#1535, #1536)
-- `urllib3` bump in /eval uv group (#1512)
-- GitHub Actions: `sigstore/cosign-installer` 4.1.1 → 4.1.2 (#1557)
-
-## [1.6.4] - 2026-05-10
-
-### Added
-
-- **`gitnexus publish`** — opt-in command to push your indexed graph to the understand-quickly registry for shareable browsing (#1425)
-- **`IncludeExtractor` for C++** — cross-repo include tracking joins the group contract pipeline (#1156)
-- **Unreal Engine C++ support** — strips reflection macros (`UCLASS`, `UFUNCTION`, `UPROPERTY`, etc.) before tree-sitter parses, so UE projects index cleanly (#1439)
-- **Thrift contracts extractor** — group-mode contract detection for Apache Thrift IDL (#1234)
-- **Workspace extractors for Node, Python, Go, Java, Elixir** — group-mode auto-discovery of cross-package boundaries (#1260)
-- **Rust workspace cross-crate contracts** — auto-discovery of `[workspace]` member crates and their cross-crate links (#1256)
-- **Go scope-resolution hooks** — Go joins Python / C# / TypeScript on the registry-primary RFC #909 path (#1302)
-- **TypeScript registry-primary scope resolution (Ring 3)** — TypeScript fully migrated to scope-based resolution (#1050)
-- **Configurable group cross-link path exclusions** — reduces false-positive contract links in vendored / monorepo trees (#1093)
-- **MCP tool safety annotations** — every MCP tool advertises read-only / mutating semantics so hosts can prompt appropriately (#1127)
-- **`--embeddings <limit>` opt-in cap** — bound the embeddings pass on huge graphs (closes #382, #1375)
-- **Pino structured logger** — replaces ad-hoc console output across the core with structured JSON logs (with pretty-print for TTY) (#1336)
-- **Shared resilient-fetch helper** — single retries + circuit breaker module reused by HF / Docker / publish flows (#1448)
-- **`/autofix` ChatOps button** — fork-safe PR autofix pipeline replaces the inline reviewdog flow (#1446, #1458)
-- **Automated security & vulnerability scans** in CI (#1297, #1455)
-
-### Fixed
-
-- **FTS read-only DB cluster** — hook resolves canonical repo root and guards read-only FTS ensure; missing-FTS warning is now surfaced. Closes #1255, #1287, #1170, #1449, #1440, #1216, #1438 (#1226, #1418, #1107, #1123)
-- **WAL corruption recovery** — quarantine corrupted `.wal` files instead of failing analyze; CHECKPOINT before close prevents recurrence; `safeClose` consolidates flush. Closes #1402, #1236, #1273, #1361 (#1417, #1314, #1377)
-- **Embedding download failures** — actionable HF_ENDPOINT guidance, retries, timeout, and circuit breaker; bridge `HF_ENDPOINT` to transformers.js; iterative DFS; HF cache via `os.homedir()`. Closes #1378, #1437, #1205 (#1419, #1252, #1078)
-- **Windows reliability** — pin tree-sitter-c/cpp to fix segfault, prefer `.cmd`/`.bat` from `where` output, robust LadybugDB lock acquisition for CI integration tests, surface silent finalize-skips so analyze cannot exit 0 without persisting. Closes #1242, #1427, #1447, #1468, #1400; partial #1218 (#1243, #1299, #1430, #1237, #1226, #1235)
-- **DuckDB / LadybugDB native** — bumped to 0.16.0 then 0.16.1; prevent extension install hangs; CHECKPOINT before close; WAL quarantine on corruption. Closes #1162, #1160, #273 (#1235, #1326, #1129, #1314, #1417)
-- **C# scope-resolution "Cannot add property" crashes** — generic typed properties included in context and impact, fixing crashes on Unity ECS partial structs and on properties whose name matches the class name. Closes #1426, #1465 (#1399)
-- **C# frozen-bucket regression** + scope-resolution I8 hardening — closes #1066 (#1082, #1085)
-- **Scope resolution** — same-range Module-as-parent for top-level scopes (closes #1086) (#1087); avoid variadic reference-site aggregation (#1112); skip empty scope extraction (#1100); classify Python class methods as Method (#1102)
-- **Python** — index repos with empty `__init__.py` and >32 KB files (#1163); walk ancestors for multi-segment dotted imports (#1241); deterministic multi-segment suffix fallback (#1253)
-- **TypeScript** — capture missed CALLS edges from HOF callbacks and JSX (#1175); name HOC-wrapped const declarations (`forwardRef` / `memo` / `useCallback` / `useMemo` / `observer`) (#1261); pair-with-arrow `@declaration.function` anchored on inner arrow
-- **Go** — loose equality for `Array.find()` null checks (#1384)
-- **Swift** — switched to the official prebuilt parser runtime (#1130)
-- **Server hardening cluster (U2–U8)** — JS path-injection on `/api/file` + docker-server (U2, #1322); git-clone path/CLI-injection / ReDoS hardening (U3, #1325); per-route rate limiting on FS-touching endpoints (U4, #1327); URL/regex/tag-filter sanitization (U7, #1330); ReDoS in cobol-preprocessor + rust-workspace + cross-impact resource exhaustion (U8, #1331); critical type-confusion + validation helper (#1317); rate-limit `/api/analyze` and `/api/embed` (closes #1328, #1339); IPv6 ipKeyGenerator (closes #1360, #1374); IPv4-compatible IPv6 / NAT64 SSRF bypasses in `validateGitUrl` (closes #1148, 95814847); predictable tempfile names → `crypto.randomBytes` (#1387); log-injection / http-to-file-access / client-side request forgery (#1456); pin Docker Node base images + Trivy verification + Dependabot policy (#1455)
-- **Group / contracts** — `runExactMatch` honours `.gitnexusignore` via shared `IgnoreService` (closes #1185, #1247); custom manifest links resolved against graph symbols (#1254); `IgnoreService` EACCES test under uid=0 (#1108)
-- **MCP** — close MCP server timeout via stdout discipline + cold-start friction (#1383); avoid `git` from non-repo cwd in sibling-cwd match (closes #1138, #1293); start MCP bridge correctly when using `npx` (#1114); project `tool_map` flows from handlers (#1113); parallelize staleness checks in `list_repos` (#1416)
-- **Storage / CLI** — derive registry name from canonical repo root, not worktree slug (closes #1259, #1296); `--skip-git` treats cwd as index root (#1245); keep GitNexus ignores inside `.gitnexus/` (#1248); surface silent finalize-skips so `analyze` cannot exit 0 without persisting (closes #1169, #1237); ignore global registry during staleness checks (#1141); use `os.homedir()` instead of `process.env.HOME` for HF cache dir (#1078); correct OpenCode skills install path in status message (#1386)
-- **Docker / server** — dedicated health endpoint for container healthcheck (closes #1147, #1355); HEAD probe so SSE heartbeat doesn't time out healthcheck (#1182); flush WAL after `/api/embed` so search sees new embeddings (closes #1149, #1359); platform-aware semantic fallback (#1150); skip vector index query on unsupported platforms (closes #1178, #1181); serve web UI at root path instead of 404 (#1048)
-- **Worker pool** — wait for replacement worker online before dispatch (#1324); prevent premature pool resolution in worker split-and-retry path (#1321); recover worker parse stalls (#1121); widened CI flake-tolerant timeouts (#1323, #1347, #1354)
-- **Embeddings storage** — CHECKPOINT before closing DB to prevent WAL corruption (#1314)
-- **Performance** — replace O(n³) C3 merge loop with O(n²) head-pointer algorithm (#1316)
-- **Install** — vendor tree-sitter-dart source (#1125)
-- **Git utils** — suppress stderr leak in `getCurrentCommit` and `getGitRoot` (closes #1172, #1341)
-- **Search** — load FTS during core DB init (#1123); create FTS indexes during `analyze` (#1107); surface warning when FTS indexes are missing (#1418)
-- **Hooks** — clarify `PostToolUse` hook is notification-only, not auto-reindex (#1070)
-- **Docs** — README Web UI section corrected (closes #1110, #1159, #2ff3e64f); Goliath capitalisation typo (#1126)
-- **CI** — fork-safe PR autofix pipeline (#1446); consolidated Claude review workflow (#1258); fine-grained PAT for RC tag push (#1407); handle expired artifacts in base coverage fetch (#1410, #1412); allow expected legacy parity failures (#1099); avoid duplicate main push checks; isolate native LadybugDB / CLI e2e flakes; seed e2e with a small fixture repo (#1249); configure e2e GitNexus home at runtime; widen rate-limit test window for Windows CI (#1347)
-
-### Changed
-
-- **`gitnexus publish` artefact contract** — universal opt-in publish format introduced (#1425, #1458)
-- **Refactor: per-language patterns consolidated into `LanguageProvider`** (#1279)
-- **Refactor: `safeClose` helper** consolidates WAL flush across LadybugDB call sites (#1377)
-- **Quality: exclude `test/fixtures` from CodeQL, ESLint, and Prettier** (#1313)
-- **Regression coverage** for `.gitnexusignore` behaviour with `--skip-git` (#1450)
-
-### Chore / Dependencies
-
-- `@ladybugdb/core` 0.16.0 → 0.16.1 (#1235, #1326)
-- `@anthropic-ai/sdk` (#1442), `@langchain/anthropic` (#1389), `@langchain/core` (#1394), `@langchain/openai` (#1215)
-- `hono` 4.12.9 → 4.12.18 + `@hono/node-server` (#1310, #1311, #1443)
-- `axios` (#1345), `fast-uri` 3.1.0 → 3.1.2 (#1441), `lru-cache` 11.3.5 → 11.3.6 (#1344), `mnemonist` 0.40.3 → 0.40.4 (#1239), `express-rate-limit` (#1343, #1397), `onnxruntime-node` (#1213, #1435), `uuid` 13 → 14 in /gitnexus-web (#1211, after revert #1222 / re-land #1250 + #1208)
-- `react`/`@types/react` (#1210), `react-dom` 19.2.5 → 19.2.6 (#1396), `react-zoom-pan-pinch` (#1214), `jsdom` 29.0.2 → 29.1.1 (#1395)
-- npm_and_yarn group bump (#1312), uv group bump (#1315), `python-dotenv` (#1320), `@types/node` (#1212, #1421, #1436)
-- GitHub Actions: `docker/build-push-action` 6.19.2 → 7.1.0 (#1391), `github/codeql-action` 3.35.3 → 4.35.3 (#1390)
-
 ## [1.6.3] - 2026-04-24
 
 ### Added

gitnexus/Dockerfile.test

@@ -1,15 +1,6 @@
-# Pinned npm version — keep in sync with the root Dockerfile.cli and
-# Dockerfile.web.
-ARG NPM_VERSION=11.14.1
-
-# node:22-bookworm-slim
-FROM node:22-bookworm-slim@sha256:9f6d5975c7dca860947d3915877f85607946403fc55349f39b4bc3688448bb6e
-ARG NPM_VERSION
+FROM node:20-bookworm
 WORKDIR /app
-RUN npx --yes npm@${NPM_VERSION} install -g npm@${NPM_VERSION} \
-    && apt-get -o Acquire::Check-Valid-Until=false -o Acquire::Check-Date=false update \
-    && apt-get install -y python3 make g++ \
-    && rm -rf /var/lib/apt/lists/*
+RUN apt-get -o Acquire::Check-Valid-Until=false -o Acquire::Check-Date=false update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 COPY . .
 RUN npm ci --ignore-scripts \
     && npm rebuild tree-sitter-swift 2>&1 \

gitnexus/README.md

@@ -33,7 +33,7 @@ To configure MCP for your editor, run `npx gitnexus setup` once — or set it up
 | Editor | MCP | Skills | Hooks (auto-augment) | Support |
 |--------|-----|--------|---------------------|---------|
 | **Claude Code** | Yes | Yes | Yes (PreToolUse) | **Full** |
-| **Cursor** | Yes | Yes | Yes (postToolUse, [manual install](../gitnexus-cursor-integration/README.md#hook-install)) | **Full** |
+| **Cursor** | Yes | Yes | — | MCP + Skills |
 | **Codex** | Yes | Yes | — | MCP + Skills |
 | **Windsurf** | Yes | — | — | MCP |
 | **OpenCode** | Yes | Yes | — | MCP + Skills |

gitnexus/hooks/claude/gitnexus-hook.cjs

@@ -14,8 +14,6 @@
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
-const { acquireHookSlot } = require('./hook-lock.cjs');
-const { hasGitNexusDbLockedByGitNexusServer } = require('./hook-db-lock-probe.cjs');
 
 /**
  * Read JSON input from stdin synchronously.
@@ -104,28 +102,6 @@ function findGitNexusDir(startDir) {
   return null;
 }
 
-function hasGitNexusServerOwner(gitNexusDir) {
-  return hasGitNexusDbLockedByGitNexusServer(path.join(gitNexusDir, 'lbug'), process.pid);
-}
-
-function extractAugmentContext(stderr) {
-  const output = (stderr || '').trim();
-  const marker = output.indexOf('[GitNexus]');
-  const debug = process.env.GITNEXUS_DEBUG === '1' || process.env.GITNEXUS_DEBUG === 'true';
-  if (debug && output.length > 0) {
-    // Emit the FULL discarded prefix (everything before the marker, or all of
-    // it when no marker is present) so suppressed diagnostics — KuzuDB lock
-    // warnings, parser errors, etc. — remain recoverable on the hook's own
-    // stderr. The untruncated payload lets operators see exactly what was
-    // filtered out instead of a 180-char JSON-quoted preview.
-    const discarded = marker === -1 ? output : output.slice(0, marker).trim();
-    if (discarded.length > 0) {
-      process.stderr.write(`[GitNexus hook] augment stderr discarded prefix:\n${discarded}\n`);
-    }
-  }
-  return marker === -1 ? '' : output.slice(marker).trim();
-}
-
 /**
  * Extract search pattern from tool input.
  */
@@ -191,10 +167,6 @@ function extractPattern(toolName, toolInput) {
  * 3. Fall back to npx (returns empty string)
  */
 function resolveCliPath() {
-  const fromEnv = process.env.GITNEXUS_HOOK_CLI_PATH;
-  if (fromEnv !== undefined && String(fromEnv).trim() && fs.existsSync(String(fromEnv))) {
-    return String(fromEnv);
-  }
   let cliPath = path.resolve(__dirname, '..', '..', 'dist', 'cli', 'index.js');
   if (!fs.existsSync(cliPath)) {
     try {
@@ -235,8 +207,7 @@ function runGitNexusCli(cliPath, args, cwd, timeout) {
 function handlePreToolUse(input) {
   const cwd = input.cwd || process.cwd();
   if (!path.isAbsolute(cwd)) return;
-  const gitNexusDir = findGitNexusDir(cwd);
-  if (!gitNexusDir) return;
+  if (!findGitNexusDir(cwd)) return;
 
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
@@ -245,29 +216,20 @@ function handlePreToolUse(input) {
 
   const pattern = extractPattern(toolName, toolInput);
   if (!pattern || pattern.length < 3) return;
-  if (hasGitNexusServerOwner(gitNexusDir)) {
-    process.stderr.write('[GitNexus] augment skipped: MCP server owns DB\n');
-    return;
-  }
-
-  const release = acquireHookSlot(gitNexusDir);
-  if (!release) return;
 
   const cliPath = resolveCliPath();
   let result = '';
   try {
     const child = runGitNexusCli(cliPath, ['augment', '--', pattern], cwd, 7000);
     if (!child.error && child.status === 0) {
-      result = extractAugmentContext(child.stderr || '');
+      result = child.stderr || '';
     }
   } catch {
     /* graceful failure */
-  } finally {
-    release();
   }
 
-  if (result) {
-    sendHookResponse('PreToolUse', result);
+  if (result && result.trim()) {
+    sendHookResponse('PreToolUse', result.trim());
   }
 }
 

gitnexus/hooks/claude/hook-db-lock-probe.cjs

@@ -1,238 +0,0 @@
-/**
- * Cross-platform best-effort probe: does another process hold dbPath open
- * with a command line that looks like a GitNexus MCP/serve server?
- *
- * Backends (no user-installed Sysinternals):
- * - Linux: scan procfs under /proc (per-PID fd entries) via stat(2) (dev+inode); works without lsof;
- *   optional lsof fallback when proc scan finds nothing.
- * - macOS / *BSD / etc.: trusted lsof + ps (absolute paths first).
- * - Windows: Restart Manager (rstrtmgr) via bundled PowerShell script +
- *   Win32_Process for command lines; trusted powershell.exe under %SystemRoot%.
- *
- * Fail-open on most errors; fail-closed only on lsof ETIMEDOUT (Unix) or
- * PowerShell ETIMEDOUT (Windows), matching the hook contract.
- */
-
-const fs = require('fs');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-function isGitNexusServerCommand(command) {
-  const hasServerMode = /(?:^|\s)(mcp|serve)(?:\s|$)/.test(command);
-  const hasGitNexus =
-    /(?:^|[/\\\s])gitnexus(?:\.cmd)?(?:\s|$)/.test(command) ||
-    /node_modules[/\\]gitnexus[/\\]/.test(command);
-  return hasServerMode && hasGitNexus;
-}
-
-function resolveHookBinary(tool) {
-  const envKey = tool === 'lsof' ? 'GITNEXUS_HOOK_LSOF_PATH' : 'GITNEXUS_HOOK_PS_PATH';
-  const fromEnv = process.env[envKey];
-  if (fromEnv && String(fromEnv).trim() && fs.existsSync(String(fromEnv))) {
-    return String(fromEnv);
-  }
-  const candidates =
-    tool === 'lsof'
-      ? ['/usr/bin/lsof', '/usr/sbin/lsof', '/sbin/lsof', tool]
-      : ['/bin/ps', '/usr/bin/ps', tool];
-  for (const candidate of candidates) {
-    if (candidate === tool) return tool;
-    try {
-      if (fs.existsSync(candidate)) return candidate;
-    } catch {
-      /* ignore */
-    }
-  }
-  return tool;
-}
-
-function resolveWindowsPowerShellPath() {
-  const fromEnv = process.env.GITNEXUS_HOOK_POWERSHELL_PATH;
-  if (fromEnv && String(fromEnv).trim() && fs.existsSync(String(fromEnv).trim())) {
-    return String(fromEnv).trim();
-  }
-  const root = process.env.SystemRoot || 'C:\\Windows';
-  const ps = path.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-  if (fs.existsSync(ps)) return ps;
-  const psWow = path.join(root, 'SysWOW64', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-  if (fs.existsSync(psWow)) return psWow;
-  return 'powershell.exe';
-}
-
-// Sentinel:
-//   undefined = not loaded yet (try the read)
-//   string    = encoded PowerShell command (successful load)
-//   null      = load attempted and failed (do not retry; warning already emitted)
-let windowsRmListPsEncodedCommandCache;
-let windowsRmListPsLoadFailureWarned = false;
-function getWindowsRmListEncodedCommand() {
-  if (windowsRmListPsEncodedCommandCache !== undefined) {
-    return windowsRmListPsEncodedCommandCache;
-  }
-  try {
-    const ps1Path = path.join(__dirname, 'win-rm-list-json.ps1');
-    const src = fs
-      .readFileSync(ps1Path, 'utf8')
-      .replace(/^\uFEFF/, '')
-      .replace(/\r\n/g, '\n');
-    windowsRmListPsEncodedCommandCache = Buffer.from(src, 'utf16le').toString('base64');
-  } catch (err) {
-    windowsRmListPsEncodedCommandCache = null;
-    if (
-      !windowsRmListPsLoadFailureWarned &&
-      (process.env.GITNEXUS_DEBUG === '1' || process.env.GITNEXUS_DEBUG === 'true')
-    ) {
-      windowsRmListPsLoadFailureWarned = true;
-      const msg = err && err.message ? String(err.message).slice(0, 200) : 'unknown';
-      process.stderr.write(`[GitNexus hook] win-rm-list-json.ps1 load failed: ${msg}\n`);
-    }
-  }
-  return windowsRmListPsEncodedCommandCache;
-}
-
-function hasGitNexusServerOwnerWindows(dbPathAbs, myPid) {
-  const encoded = getWindowsRmListEncodedCommand();
-  if (!encoded) return false;
-  const psExe = resolveWindowsPowerShellPath();
-  const r = spawnSync(
-    psExe,
-    [
-      '-NoProfile',
-      '-NonInteractive',
-      '-ExecutionPolicy',
-      'Bypass',
-      '-STA',
-      '-EncodedCommand',
-      encoded,
-    ],
-    {
-      encoding: 'utf-8',
-      timeout: 6000,
-      stdio: ['ignore', 'pipe', 'ignore'],
-      env: { ...process.env, GITNEXUS_HOOK_RM_TARGET: dbPathAbs },
-    },
-  );
-  // ETIMEDOUT means the PowerShell probe didn't return in time; treat as 'unresponsive process holds DB' → fail-closed (skip augment).
-  if (r.error) return r.error.code === 'ETIMEDOUT';
-  if (r.status !== 0) return false;
-  let rows;
-  try {
-    rows = JSON.parse(String(r.stdout || '').trim() || '[]');
-  } catch {
-    return false;
-  }
-  if (!Array.isArray(rows)) return false;
-  for (const row of rows) {
-    const procId = Number(row.pid);
-    const cmd = String(row.cmd || '');
-    if (!Number.isFinite(procId) || procId === myPid) continue;
-    if (isGitNexusServerCommand(cmd)) return true;
-  }
-  return false;
-}
-
-function readLinuxCmdline(pidStr) {
-  try {
-    return fs.readFileSync(`/proc/${pidStr}/cmdline`, 'utf8').replace(/\0+/g, ' ').trim();
-  } catch {
-    return '';
-  }
-}
-
-function linuxProcScanFindGitNexusServer(dbPathAbs, myPid) {
-  const raw = process.env.GITNEXUS_HOOK_LINUX_PROC_BUDGET_MS;
-  const budget = Number(raw && String(raw).trim()) ? Number.parseInt(String(raw), 10) : 1200;
-  const start = Date.now();
-  let targetStat;
-  try {
-    targetStat = fs.statSync(dbPathAbs);
-  } catch {
-    return false;
-  }
-  let procEntries;
-  try {
-    procEntries = fs.readdirSync('/proc', { withFileTypes: true });
-  } catch {
-    return false;
-  }
-  for (const ent of procEntries) {
-    if (Date.now() - start > budget) return false;
-    if (!ent.isDirectory() || !/^\d+$/.test(ent.name)) continue;
-    const pid = Number.parseInt(ent.name, 10);
-    if (!Number.isFinite(pid) || pid === myPid) continue;
-    const fdDir = path.join('/proc', ent.name, 'fd');
-    let fds;
-    try {
-      fds = fs.readdirSync(fdDir);
-    } catch {
-      continue;
-    }
-    let holds = false;
-    for (const fd of fds) {
-      if (Date.now() - start > budget) return false;
-      try {
-        const st = fs.statSync(path.join(fdDir, fd));
-        if (st.dev === targetStat.dev && st.ino === targetStat.ino) {
-          holds = true;
-          break;
-        }
-      } catch {
-        /* ignore */
-      }
-    }
-    if (!holds) continue;
-    if (isGitNexusServerCommand(readLinuxCmdline(ent.name))) return true;
-  }
-  return false;
-}
-
-function unixLsofPsFindGitNexusServer(dbPathAbs, myPid) {
-  const lsofPath = resolveHookBinary('lsof');
-  const lsof = spawnSync(lsofPath, ['-nP', '-t', '--', dbPathAbs], {
-    encoding: 'utf-8',
-    timeout: 1000,
-    stdio: ['ignore', 'pipe', 'ignore'],
-  });
-  if (lsof.error) return lsof.error.code === 'ETIMEDOUT';
-
-  const pids = (lsof.stdout || '').split(/\s+/).filter(Boolean);
-  const psPath = resolveHookBinary('ps');
-  for (const pid of pids) {
-    if (Number(pid) === myPid) continue;
-    const ps = spawnSync(psPath, ['-p', pid, '-o', 'command='], {
-      encoding: 'utf-8',
-      timeout: 500,
-      stdio: ['ignore', 'pipe', 'ignore'],
-    });
-    if (ps.error) {
-      if (ps.error.code === 'ETIMEDOUT') return true;
-      continue;
-    }
-    if (isGitNexusServerCommand(ps.stdout || '')) return true;
-  }
-  return false;
-}
-
-/**
- * @param {string} dbPath Absolute or relative path to the DB file (e.g. .../lbug).
- * @param {number} myPid Current process PID (hook runner), excluded from matches.
- */
-function hasGitNexusDbLockedByGitNexusServer(dbPath, myPid) {
-  if (!fs.existsSync(dbPath)) return false;
-  const dbPathAbs = path.resolve(dbPath);
-
-  if (process.platform === 'win32') {
-    return hasGitNexusServerOwnerWindows(dbPathAbs, myPid);
-  }
-
-  if (process.platform === 'linux') {
-    if (linuxProcScanFindGitNexusServer(dbPathAbs, myPid)) return true;
-    return unixLsofPsFindGitNexusServer(dbPathAbs, myPid);
-  }
-
-  return unixLsofPsFindGitNexusServer(dbPathAbs, myPid);
-}
-
-module.exports = {
-  hasGitNexusDbLockedByGitNexusServer,
-};

gitnexus/hooks/claude/hook-lock.cjs

@@ -1,119 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-
-const HOOK_LOCK_SUBDIR = '.hook-locks';
-const HOOK_LOCK_MAX_INFLIGHT = 3;
-const HOOK_LOCK_STALE_MS = 30000;
-
-function acquireHookSlot(gitNexusDir) {
-  const lockDir = path.join(gitNexusDir, HOOK_LOCK_SUBDIR);
-  try {
-    fs.mkdirSync(lockDir, { recursive: true });
-  } catch {
-    // Cannot create lock dir (read-only fs, cross-user perm denial, out of
-    // inodes, etc.) — fail closed by returning null. Caller skips augment.
-    // Fail-open here would let N concurrent hooks all proceed unguarded and
-    // reintroduce the #1486 fan-out the guard exists to prevent.
-    return null;
-  }
-
-  const myPidStr = String(process.pid);
-
-  for (let slot = 0; slot < HOOK_LOCK_MAX_INFLIGHT; slot++) {
-    const slotPath = path.join(lockDir, `slot-${slot}.lock`);
-    for (let attempt = 0; attempt < 2; attempt++) {
-      try {
-        fs.writeFileSync(slotPath, myPidStr, { flag: 'wx' });
-        let released = false;
-        const release = () => {
-          if (released) return;
-          released = true;
-          try {
-            // Only unlink if we still own the slot. If we appeared stale and
-            // another hook took over, the file now belongs to it — leave alone.
-            const content = fs.readFileSync(slotPath, 'utf-8').trim();
-            if (content === myPidStr) fs.unlinkSync(slotPath);
-          } catch {
-            /* already removed or unreadable */
-          }
-        };
-        process.on('exit', release);
-        return release;
-      } catch {
-        // Slot exists. Decide whether to take it over.
-        // Open once and inspect mtime + content via the same fd so there's
-        // no TOCTOU between the metadata check and the content read
-        // (codeql js/file-system-race).
-        let fd;
-        try {
-          fd = fs.openSync(slotPath, 'r');
-        } catch {
-          continue; // Vanished between EEXIST and open — retry this slot.
-        }
-        let isLive = false;
-        let mtimeMs = Date.now();
-        try {
-          mtimeMs = fs.fstatSync(fd).mtimeMs;
-          const buf = Buffer.alloc(32);
-          const n = fs.readSync(fd, buf, 0, 32, 0);
-          const ownerStr = buf.slice(0, n).toString('utf-8').trim();
-          if (ownerStr === '') {
-            // Owner created the file but hasn't written its PID yet. The
-            // wx open+write window is microseconds; give it the benefit
-            // of the doubt and treat as live.
-            isLive = true;
-          } else {
-            const owner = Number.parseInt(ownerStr, 10);
-            if (Number.isFinite(owner) && owner > 0) {
-              try {
-                process.kill(owner, 0);
-                isLive = true;
-              } catch (e) {
-                // ESRCH = process gone → treat as dead. EPERM = process exists
-                // but owned by another user (cross-user lock dir) → still alive,
-                // keep the slot. Anything else: be conservative, assume alive.
-                if (e && e.code === 'ESRCH') {
-                  isLive = false;
-                } else {
-                  isLive = true;
-                }
-              }
-            }
-          }
-        } catch {
-          /* unreadable — treat as dead */
-        } finally {
-          try {
-            fs.closeSync(fd);
-          } catch {
-            /* already closed */
-          }
-        }
-        // For slots younger than HOOK_LOCK_STALE_MS, PID-liveness wins —
-        // a slow-but-alive hook is never wrongly evicted. For older slots,
-        // age is the final arbiter as a defense against PID reuse on long-
-        // abandoned slots. 30s >> the 7s augment timeout, so a healthy run
-        // never crosses this threshold.
-        if (isLive && Date.now() - mtimeMs > HOOK_LOCK_STALE_MS) {
-          isLive = false;
-        }
-        if (isLive) break; // Try the next slot.
-        try {
-          fs.unlinkSync(slotPath);
-        } catch {
-          /* another hook beat us to it — retry will hit EEXIST */
-        }
-        // Loop and retry this slot.
-      }
-    }
-  }
-
-  return null;
-}
-
-module.exports = {
-  HOOK_LOCK_SUBDIR,
-  HOOK_LOCK_MAX_INFLIGHT,
-  HOOK_LOCK_STALE_MS,
-  acquireHookSlot,
-};

gitnexus/hooks/claude/win-rm-list-json.ps1

@@ -1,76 +0,0 @@
-$ErrorActionPreference = 'Stop'
-$target = $env:GITNEXUS_HOOK_RM_TARGET
-if ([string]::IsNullOrWhiteSpace($target)) { Write-Output '[]'; exit 0 }
-$target = (Resolve-Path -LiteralPath $target).ProviderPath
-
-if (-not ([Management.Automation.PSTypeName]'GitNexusHookRm.Native').Type) {
-Add-Type @'
-using System;
-using System.Runtime.InteropServices;
-namespace GitNexusHookRm {
-  public static class Native {
-    public const int ErrorMoreData = 234;
-    [StructLayout(LayoutKind.Sequential, Pack = 4)]
-    public struct RM_UNIQUE_PROCESS {
-      public int dwProcessId;
-      public long ProcessStartTime;
-    }
-    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-    public struct RM_PROCESS_INFO {
-      public RM_UNIQUE_PROCESS Process;
-      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
-      public string strAppName;
-      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 64)]
-      public string strServiceShortName;
-      public uint ApplicationType;
-      public uint AppStatus;
-      public uint TSSessionId;
-      public uint bRestartable;
-    }
-    [DllImport("rstrtmgr.dll", CharSet = CharSet.Unicode)]
-    public static extern int RmStartSession(out uint pSessionHandle, uint dwSessionFlags, string strSessionKey);
-    [DllImport("rstrtmgr.dll", CharSet = CharSet.Unicode)]
-    public static extern int RmRegisterResources(uint pSessionHandle, uint nFiles, string[] rgsFileNames, uint nApplications, IntPtr rgApplications, uint nServices, string[] rgsServiceNames);
-    [DllImport("rstrtmgr.dll")]
-    public static extern int RmGetList(uint dwSessionHandle, out uint pnProcInfoNeeded, ref uint pnProcInfo, [In, Out] RM_PROCESS_INFO[] rgAffectedApps, ref uint lpdwRebootReasons);
-    [DllImport("rstrtmgr.dll")]
-    public static extern int RmEndSession(uint pSessionHandle);
-  }
-}
-'@
-}
-
-$h = [uint32]0
-$key = [guid]::NewGuid().ToString('N')
-$rmErr = [GitNexusHookRm.Native]::RmStartSession([ref]$h, 0, $key)
-if ($rmErr -ne 0) { Write-Output '[]'; exit 0 }
-$files = @($target)
-$err = [GitNexusHookRm.Native]::RmRegisterResources($h, 1, $files, 0, [IntPtr]::Zero, 0, $null)
-if ($err -ne 0) {
-  [void][GitNexusHookRm.Native]::RmEndSession($h)
-  Write-Output '[]'
-  exit 0
-}
-$need = [uint32]0
-$n = [uint32]0
-$reboot = [uint32]0
-$err = [GitNexusHookRm.Native]::RmGetList($h, [ref]$need, [ref]$n, $null, [ref]$reboot)
-if ($err -ne [GitNexusHookRm.Native]::ErrorMoreData) {
-  [void][GitNexusHookRm.Native]::RmEndSession($h)
-  Write-Output '[]'
-  exit 0
-}
-$n = $need
-$buf = New-Object GitNexusHookRm.Native+RM_PROCESS_INFO[] ([int]$n)
-$err = [GitNexusHookRm.Native]::RmGetList($h, [ref]$need, [ref]$n, $buf, [ref]$reboot)
-[void][GitNexusHookRm.Native]::RmEndSession($h)
-if ($err -ne 0) { Write-Output '[]'; exit 0 }
-
-$out = @()
-for ($i = 0; $i -lt [int]$n; $i++) {
-  $procId = $buf[$i].Process.dwProcessId
-  $p = Get-CimInstance -ClassName Win32_Process -Filter "ProcessId=$procId" -ErrorAction SilentlyContinue
-  $cmd = if ($p) { $p.CommandLine } else { '' }
-  $out += [PSCustomObject]@{ pid = [int]$procId; cmd = $cmd }
-}
-ConvertTo-Json -InputObject @($out) -Compress

gitnexus/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "gitnexus",
-  "version": "1.6.5",
+  "version": "1.6.4-rc.94",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "gitnexus",
-      "version": "1.6.5",
+      "version": "1.6.4-rc.94",
       "hasInstallScript": true,
       "license": "PolyForm-Noncommercial-1.0.0",
       "dependencies": {
@@ -63,7 +63,7 @@
         "vitest": "^4.0.18"
       },
       "engines": {
-        "node": ">=22.0.0"
+        "node": ">=20.0.0"
       },
       "optionalDependencies": {
         "node-addon-api": "^8.0.0",
@@ -142,9 +142,9 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.9.2.tgz",
+      "integrity": "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -1572,9 +1572,9 @@
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.130.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.130.0.tgz",
-      "integrity": "sha512-ibD2usx9JRu7f5pu2tMKMI4cpA4NgXJQoYRP4pQ7Pxmn1l6k/53qWtQWZayhYy3X4QZkt90Ot+mJEaeXouio6Q==",
+      "version": "0.126.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.126.0.tgz",
+      "integrity": "sha512-oGfVtjAgwQVVpfBrbtk4e1XDyWHRFta6BS3GWVzrF8xYBT2VGQAk39yJS/wFSMrZqoiCU4oghT3Ch0HaHGIHcQ==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -1600,9 +1600,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/codegen": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
-      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.4.tgz",
+      "integrity": "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/eventemitter": {
@@ -1628,9 +1628,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/inquire": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.1.tgz",
-      "integrity": "sha512-mnzgDV26ueAvk7rsbt9L7bE0SuAoqyuys/sMMrmVcN5x9VsxpcG3rqAUSgDyLp0UZlmNfIbQ4fHfCtreVBk8Ew==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz",
+      "integrity": "sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/path": {
@@ -1646,15 +1646,15 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/utf8": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.1.tgz",
-      "integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.0.tgz",
+      "integrity": "sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.1.tgz",
-      "integrity": "sha512-fJI3I0r3C3Oj/zdBCpaCmBRZYf07xpaq4yCfDDoSFm+beWNzbIl26puW8RraUdugoJw/95zerNOn6jasAhzSmg==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.16.tgz",
+      "integrity": "sha512-rhY3k7Bsae9qQfOtph2Pm2jZEA+s8Gmjoz4hhmx70K9iMQ/ddeae+xhRQcM5IuVx5ry1+bGfkvMn7D6MJggVSA==",
       "cpu": [
         "arm64"
       ],
@@ -1669,9 +1669,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.1.tgz",
-      "integrity": "sha512-cKnAhWEsV7TPcA/5EAteDp6KcJZBQ2G+BqE7zayMMi7kMvwRsbv7WT9aOnn0WNl4SKEIf43vjS31iUPu80nzXg==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.16.tgz",
+      "integrity": "sha512-rNz0yK078yrNn3DrdgN+PKiMOW8HfQ92jQiXxwX8yW899ayV00MLVdaCNeVBhG/TbH3ouYVObo8/yrkiectkcQ==",
       "cpu": [
         "arm64"
       ],
@@ -1686,9 +1686,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.1.tgz",
-      "integrity": "sha512-YKrVwQjIRBPo+5G/u03wGjbdy4q7pyzCe93DK9VJ7zkVmeg8LJ7GbgsiHWdR4xSoe4CAXRD7Bcjgbtr64bkXNg==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.16.tgz",
+      "integrity": "sha512-r/OmdR00HmD4i79Z//xO06uEPOq5hRXdhw7nzkxQxwSavs3PSHa1ijntdpOiZ2mzOQ3fVVu8C1M19FoNM+dMUQ==",
       "cpu": [
         "x64"
       ],
@@ -1703,9 +1703,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.1.tgz",
-      "integrity": "sha512-z/oBsREo46SsFqBwYtFe0kpJeBijAT48O/WXLI4suiCLBkr03RTtTJMCzSdDd2znlh8VJizL09XVkQgk8IZonw==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.16.tgz",
+      "integrity": "sha512-KcRE5w8h0OnjUatG8pldyD14/CQ5Phs1oxfR+3pKDjboHRo9+MkqQaiIZlZRpsxC15paeXme/I127tUa9TXJ6g==",
       "cpu": [
         "x64"
       ],
@@ -1720,9 +1720,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.1.tgz",
-      "integrity": "sha512-ik8q7GM11zxvYxFc2PeDcT6TBvhCQMaUxfph/M5l9sKuTs/Sjg3L+Byw0F7w0ZVLBZmx30P+gG0ECzzN+MFcmQ==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.16.tgz",
+      "integrity": "sha512-bT0guA1bpxEJ/ZhTRniQf7rNF8ybvXOuWbNIeLABaV5NGjx4EtOWBTSRGWFU9ZWVkPOZ+HNFP8RMcBokBiZ0Kg==",
       "cpu": [
         "arm"
       ],
@@ -1737,9 +1737,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.1.tgz",
-      "integrity": "sha512-QoSx2EkyrrdZ6kcyE8stqZ62t0Yra8Fs5ia9lOxJrh6TMQJK7gQKmscdTHf7pOXKREKrVwOtJcQG3qVSfc866A==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.16.tgz",
+      "integrity": "sha512-+tHktCHWV8BDQSjemUqm/Jl/TPk3QObCTIjmdDy/nlupcujZghmKK2962LYrqFpWu+ai01AN/REOH3NEpqvYQg==",
       "cpu": [
         "arm64"
       ],
@@ -1754,9 +1754,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.1.tgz",
-      "integrity": "sha512-uwNwFpwKeNiZawfAWBgg0VIztPTV3ihhh1vV334h9ivnNLorxnQMU6Fz8wG1Zb4Qh9LC1/MkcyT3YlDXG3Rsgg==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.16.tgz",
+      "integrity": "sha512-3fPzdREH806oRLxpTWW1Gt4tQHs0TitZFOECB2xzCFLPKnSOy90gwA7P29cksYilFO6XVRY1kzga0cL2nRjKPg==",
       "cpu": [
         "arm64"
       ],
@@ -1771,9 +1771,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.1.tgz",
-      "integrity": "sha512-zY1bul7OWr7DFBiJ++wofXvnr8B45ce3QsQUhKrIhXsygAh7bTkwyeM1bi1a2g5C/yC/N8TZyGDEoMfm/l9mpg==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.16.tgz",
+      "integrity": "sha512-EKwI1tSrLs7YVw+JPJT/G2dJQ1jl9qlTTTEG0V2Ok/RdOenRfBw2PQdLPyjhIu58ocdBfP7vIRN/pvMsPxs/AQ==",
       "cpu": [
         "ppc64"
       ],
@@ -1788,9 +1788,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.1.tgz",
-      "integrity": "sha512-0frlsT/f4Ft6I7SMESTKnF3cZsdicQn1dCMkF/jT9wDLE+gGoiQfv1nmT9e+s7s/fekvvy6tZM2jHvI2tkbJDQ==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.16.tgz",
+      "integrity": "sha512-Uknladnb3Sxqu6SEcqBldQyJUpk8NleooZEc0MbRBJ4inEhRYWZX0NJu12vNf2mqAq7gsofAxHrGghiUYjhaLQ==",
       "cpu": [
         "s390x"
       ],
@@ -1805,9 +1805,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.1.tgz",
-      "integrity": "sha512-XABVmGp9Tg0WspTVvwduTc4fpqy6JnAUrSQe6OuyqD/03nI7r0O9OWUkMIwFrjKAIqolvqoA4ZrJppgwE0Gxmw==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.16.tgz",
+      "integrity": "sha512-FIb8+uG49sZBtLTn+zt1AJ20TqVcqWeSIyoVt0or7uAWesgKaHbiBh6OpA/k9v0LTt+PTrb1Lao133kP4uVxkg==",
       "cpu": [
         "x64"
       ],
@@ -1822,9 +1822,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.1.tgz",
-      "integrity": "sha512-bV4fzswuzVcKD90o/VM6QqKxnxlDq0g2BISDLNVmxrnhpv1DDbyPhCIjYfvzYLV+MvkKKnQt2Q6AO86SEBULUQ==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.16.tgz",
+      "integrity": "sha512-RuERhF9/EgWxZEXYWCOaViUWHIboceK4/ivdtQ3R0T44NjLkIIlGIAVAuCddFxsZ7vnRHtNQUrt2vR2n2slB2w==",
       "cpu": [
         "x64"
       ],
@@ -1839,9 +1839,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.1.tgz",
-      "integrity": "sha512-/Mh0Zhq3OP7fVs0kcQHZP6lZEthMGTaSf8UBQYSFEZDWGXXlEC+nJ6EqenaK2t4LBXMe3A+K/G2BVXXdtOr4PQ==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.16.tgz",
+      "integrity": "sha512-mXcXnvd9GpazCxeUCCnZ2+YF7nut+ZOEbE4GtaiPtyY6AkhZWbK70y1KK3j+RDhjVq5+U8FySkKRb/+w0EeUwA==",
       "cpu": [
         "arm64"
       ],
@@ -1856,9 +1856,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.1.tgz",
-      "integrity": "sha512-+1xc9X45l8ufsBAm6Gjvx2qDRIY9lTVt0cgWNcJ+1gdhXvkbxePA60yRTwSTuXL09CMhyJmjpV7E3NoyxbqFQQ==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.16.tgz",
+      "integrity": "sha512-3Q2KQxnC8IJOLqXmUMoYwyIPZU9hzRbnHaoV3Euz+VVnjZKcY8ktnNP8T9R4/GGQtb27C/UYKABxesKWb8lsvQ==",
       "cpu": [
         "wasm32"
       ],
@@ -1866,8 +1866,8 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
+        "@emnapi/core": "1.9.2",
+        "@emnapi/runtime": "1.9.2",
         "@napi-rs/wasm-runtime": "^1.1.4"
       },
       "engines": {
@@ -1875,9 +1875,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.9.2.tgz",
+      "integrity": "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -1886,9 +1886,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.1.tgz",
-      "integrity": "sha512-1D+UqZdfnuR+Jy1GgMJwi85bD40H21uNmOPRWQhw4oRSuolZ/B5rixZ45DK2KXOTCvmVCecauWgEhbw8bI7tOw==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.16.tgz",
+      "integrity": "sha512-tj7XRemQcOcFwv7qhpUxMTBbI5mWMlE4c1Omhg5+h8GuLXzyj8HviYgR+bB2DMDgRqUE+jiDleqSCRjx4aYk/Q==",
       "cpu": [
         "arm64"
       ],
@@ -1903,9 +1903,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.1.tgz",
-      "integrity": "sha512-INAycaWuhlOK3wk4mRHGsdgwYWmd9cChdPdE9bwWmy6rn9VqVNYNFGhOdXrofXUxwHIncSiPNb8tNm8knDVIeQ==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.16.tgz",
+      "integrity": "sha512-PH5DRZT+F4f2PTXRXR8uJxnBq2po/xFtddyabTJVJs/ZYVHqXPEgNIr35IHTEa6bpa0Q8Awg+ymkTaGnKITw4g==",
       "cpu": [
         "x64"
       ],
@@ -1920,9 +1920,9 @@
       }
     },
     "node_modules/@rolldown/pluginutils": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
-      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.16.tgz",
+      "integrity": "sha512-45+YtqxLYKDWQouLKCrpIZhke+nXxhsw+qAHVzHDVwttyBlHNBVs2K25rDXrZzhpTp9w1FlAlvweV1H++fdZoA==",
       "dev": true,
       "license": "MIT"
     },
@@ -1941,9 +1941,9 @@
       "license": "MIT"
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
+      "integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2065,9 +2065,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "25.6.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.2.tgz",
-      "integrity": "sha512-sokuT28dxf9JT5Kady1fsXOvI4HVpjZa95NKT5y9PNTIrs2AsobR4GFAA90ZG8M+nxVRLysCXsVj6eGC7Vbrlw==",
+      "version": "25.6.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.1.tgz",
+      "integrity": "sha512-coJCN8O1q4AGyyqCAUSP06P+SrMTu18BkEj3NVAK07q6QUneD2wzj3CLv9+yP+BMeZQlMvneXqqvDe3w+xcq7g==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~7.19.0"
@@ -2132,14 +2132,14 @@
       }
     },
     "node_modules/@vitest/coverage-v8": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.6.tgz",
-      "integrity": "sha512-36l628fQ/9a/8ihy97eOtEnvWQEdqULQOJtcaxtoNq0G1w3Mxd4szSahOaMM9/NGyZ+hyKcMtIW/WIxq0XQViQ==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.5.tgz",
+      "integrity": "sha512-38C0/Ddb7HcRG0Z4/DUem8x57d2p9jYgp18mkaYswEOQBGsI1CG4f/hjm0ZCeaJfWhSZ4k7jgs29V1Zom7Ki9A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^1.0.2",
-        "@vitest/utils": "4.1.6",
+        "@vitest/utils": "4.1.5",
         "ast-v8-to-istanbul": "^1.0.0",
         "istanbul-lib-coverage": "^3.2.2",
         "istanbul-lib-report": "^3.0.1",
@@ -2153,8 +2153,8 @@
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "@vitest/browser": "4.1.6",
-        "vitest": "4.1.6"
+        "@vitest/browser": "4.1.5",
+        "vitest": "4.1.5"
       },
       "peerDependenciesMeta": {
         "@vitest/browser": {
@@ -2163,16 +2163,16 @@
       }
     },
     "node_modules/@vitest/expect": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.6.tgz",
-      "integrity": "sha512-7EHDquPthALSV0jhhjgEW8FXaviMx7rSqu8W6oqCoAuOhKov814P99QDV1pxMA3QPv21YudvJngIhjrNI4opLg==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.5.tgz",
+      "integrity": "sha512-PWBaRY5JoKuRnHlUHfpV/KohFylaDZTupcXN1H9vYryNLOnitSw60Mw9IAE2r67NbwwzBw/Cc/8q9BK3kIX8Kw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.6",
-        "@vitest/utils": "4.1.6",
+        "@vitest/spy": "4.1.5",
+        "@vitest/utils": "4.1.5",
         "chai": "^6.2.2",
         "tinyrainbow": "^3.1.0"
       },
@@ -2181,13 +2181,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.6.tgz",
-      "integrity": "sha512-MCFc63czMjEInOlcY2cpQCvCN+KgbAn+60xu9cMgP4sKaLC5JNAKw7JH8QdAnoAC88hW1IiSNZ+GgVXlN1UcMQ==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.5.tgz",
+      "integrity": "sha512-/x2EmFC4mT4NNzqvC3fmesuV97w5FC903KPmey4gsnJiMQ3Be1IlDKVaDaG8iqaLFHqJ2FVEkxZk5VmeLjIItw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.6",
+        "@vitest/spy": "4.1.5",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -2208,9 +2208,9 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.6.tgz",
-      "integrity": "sha512-h5SxD/IzNhZYnrSZRsUZQIC+vD0GY8cUvq0iwsmkFKixRCKLLWqCXa/FIQ4S1R+sI+PGoojkHsdNrbZiM9Qpgw==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.5.tgz",
+      "integrity": "sha512-7I3q6l5qr03dVfMX2wCo9FxwSJbPdwKjy2uu/YPpU3wfHvIL4QHwVRp57OfGrDFeUJ8/8QdfBKIV12FTtLn00g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2221,13 +2221,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.6.tgz",
-      "integrity": "sha512-nOPCmn2+yD0ZNmKdsXGv/UxMMWbMuKeD6GyYncNwdkYDxpQvrPSKYj2rWuDjC2Y4b6w6hjip5dBKFzEUuZe3vA==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.5.tgz",
+      "integrity": "sha512-2D+o7Pr82IEO46YPpoA/YU0neeyr6FTerQb5Ro7BUnBuv6NQtT/kmVnczngiMEBhzgqz2UZYl5gArejsyERDSQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.6",
+        "@vitest/utils": "4.1.5",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -2235,14 +2235,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.6.tgz",
-      "integrity": "sha512-YhsdE6xAVfTDmzjxL2ZDUvjj+ZsgyOKe+TdQzqkD72wIOmHka8NuGQ6NpTNZv9D2Z63fbwWKJPeVpEw4EQgYxw==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.5.tgz",
+      "integrity": "sha512-zypXEt4KH/XgKGPUz4eC2AvErYx0My5hfL8oDb1HzGFpEk1P62bxSohdyOmvz+d9UJwanI68MKwr2EquOaOgMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.6",
-        "@vitest/utils": "4.1.6",
+        "@vitest/pretty-format": "4.1.5",
+        "@vitest/utils": "4.1.5",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -2251,9 +2251,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.6.tgz",
-      "integrity": "sha512-JFKxMx6udhwKh/Ldo270e17QX710vgunMkuPAvXjHSvC6oqLWAHhVhjg/I71q0u0CBSErIODV1Kjv0FQNSWjdg==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.5.tgz",
+      "integrity": "sha512-2lNOsh6+R2Idnf1TCZqSwYlKN2E/iDlD8sgU59kYVl+OMDmvldO1VDk39smRfpUNwYpNRVn3w4YfuC7KfbBnkQ==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -2261,13 +2261,13 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.6.tgz",
-      "integrity": "sha512-FxIY+U81R3LGKCxaHHFRQ5+g6/iRgGLmeHWdp2Amj4ljQRrEIWHmZyDfDYBRZlpyqA7qKxtS9DD1dhk8RnRIVQ==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.5.tgz",
+      "integrity": "sha512-76wdkrmfXfqGjueGgnb45ITPyUi1ycZ4IHgC2bhPDUfWHklY/q3MdLOAB+TF1e6xfl8NxNY0ZYaPCFNWSsw3Ug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.6",
+        "@vitest/pretty-format": "4.1.5",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -3110,9 +3110,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
+      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
       "funding": [
         {
           "type": "github",
@@ -3476,9 +3476,9 @@
       "license": "MIT"
     },
     "node_modules/hono": {
-      "version": "4.12.18",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.18.tgz",
-      "integrity": "sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==",
+      "version": "4.12.16",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.16.tgz",
+      "integrity": "sha512-jN0ZewiNAWSe5khM3EyCmBb250+b40wWbwNILNfEvq84VREWwOIkuUsFONk/3i3nqkz7Oe1PcpM2mwQEK2L9Kg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -4151,9 +4151,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
+      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
       "dev": true,
       "funding": [
         {
@@ -4282,15 +4282,15 @@
       }
     },
     "node_modules/onnxruntime-common": {
-      "version": "1.26.0",
-      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.26.0.tgz",
-      "integrity": "sha512-qVyMR4lcWgbkc4getFV+GQijsTnbg/siteoqcDwa3sI/LxbrMSNw4ePyvCq/ymdQaRomCA7YuWmhzsswxvymdw==",
+      "version": "1.25.1",
+      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.25.1.tgz",
+      "integrity": "sha512-kKvYQFdos4LWJqhZ+nmKu3NT8NXzw8I5x9fNUKe1rNKcPfNKnYXUtW7JBpcKFsvLtrJashRgVYSbFap4cHxvNg==",
       "license": "MIT"
     },
     "node_modules/onnxruntime-node": {
-      "version": "1.26.0",
-      "resolved": "https://registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.26.0.tgz",
-      "integrity": "sha512-OHl6PiOEOqxaLHL0N9eFrbzS7IGmu3BtJNH3RTEnRAheCIkfc3gjcjl4sGcjp9C22ZC9YTquDOxSdT/stBQ6BQ==",
+      "version": "1.25.1",
+      "resolved": "https://registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.25.1.tgz",
+      "integrity": "sha512-N0M58CGTiTsLkPpx9bxmRFi24GT6r67Qei/GrBEIiDyntcYdXU5vQZp112ypydG9vEKRFgbgUYQJnEi+jll8dg==",
       "hasInstallScript": true,
       "license": "MIT",
       "os": [
@@ -4301,7 +4301,7 @@
       "dependencies": {
         "adm-zip": "^0.5.16",
         "global-agent": "^4.1.3",
-        "onnxruntime-common": "1.26.0"
+        "onnxruntime-common": "1.25.1"
       }
     },
     "node_modules/onnxruntime-web": {
@@ -4498,9 +4498,9 @@
       "license": "MIT"
     },
     "node_modules/postcss": {
-      "version": "8.5.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+      "version": "8.5.10",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz",
+      "integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
       "dev": true,
       "funding": [
         {
@@ -4543,22 +4543,22 @@
       "license": "MIT"
     },
     "node_modules/protobufjs": {
-      "version": "7.5.8",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.8.tgz",
-      "integrity": "sha512-dvpCIeLPbXZS/Ete7yLaO7RenOdken2NHKykBXbsaGxZT0UTltcarBciw+A78SRQs9iMAAVpsYA+l8b1hTePIA==",
+      "version": "7.5.5",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.5.tgz",
+      "integrity": "sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "@protobufjs/aspromise": "^1.1.2",
         "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/codegen": "^2.0.4",
         "@protobufjs/eventemitter": "^1.1.0",
         "@protobufjs/fetch": "^1.1.0",
         "@protobufjs/float": "^1.0.2",
-        "@protobufjs/inquire": "^1.1.1",
+        "@protobufjs/inquire": "^1.1.0",
         "@protobufjs/path": "^1.1.2",
         "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.1",
+        "@protobufjs/utf8": "^1.1.0",
         "@types/node": ">=13.7.0",
         "long": "^5.0.0"
       },
@@ -4703,14 +4703,14 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.1.tgz",
-      "integrity": "sha512-X0KQHljNnEkWNqqiz9zJrGunh1B0HgOxLXvnFpCOcadzcy5qohZ3tqMEUg00vncoRovXuK3ZqCT9KnnKzoInFQ==",
+      "version": "1.0.0-rc.16",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.16.tgz",
+      "integrity": "sha512-rzi5WqKzEZw3SooTt7cgm4eqIoujPIyGcJNGFL7iPEuajQw7vxMHUkXylu4/vhCkJGXsgRmxqMKXUpT6FEgl0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.130.0",
-        "@rolldown/pluginutils": "^1.0.0"
+        "@oxc-project/types": "=0.126.0",
+        "@rolldown/pluginutils": "1.0.0-rc.16"
       },
       "bin": {
         "rolldown": "bin/cli.mjs"
@@ -4719,21 +4719,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.1",
-        "@rolldown/binding-darwin-arm64": "1.0.1",
-        "@rolldown/binding-darwin-x64": "1.0.1",
-        "@rolldown/binding-freebsd-x64": "1.0.1",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.1",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.1",
-        "@rolldown/binding-linux-arm64-musl": "1.0.1",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.1",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.1",
-        "@rolldown/binding-linux-x64-gnu": "1.0.1",
-        "@rolldown/binding-linux-x64-musl": "1.0.1",
-        "@rolldown/binding-openharmony-arm64": "1.0.1",
-        "@rolldown/binding-wasm32-wasi": "1.0.1",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.1",
-        "@rolldown/binding-win32-x64-msvc": "1.0.1"
+        "@rolldown/binding-android-arm64": "1.0.0-rc.16",
+        "@rolldown/binding-darwin-arm64": "1.0.0-rc.16",
+        "@rolldown/binding-darwin-x64": "1.0.0-rc.16",
+        "@rolldown/binding-freebsd-x64": "1.0.0-rc.16",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.16",
+        "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.16",
+        "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.16",
+        "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.16",
+        "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.16",
+        "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.16",
+        "@rolldown/binding-linux-x64-musl": "1.0.0-rc.16",
+        "@rolldown/binding-openharmony-arm64": "1.0.0-rc.16",
+        "@rolldown/binding-wasm32-wasi": "1.0.0-rc.16",
+        "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.16",
+        "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.16"
       }
     },
     "node_modules/router": {
@@ -5612,16 +5612,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.0.13",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.13.tgz",
-      "integrity": "sha512-MFtjBYgzmSxmgA4RAfjIyXWpGe1oALnjgUTzzV7QLx/TKxCzjtMH6Fd9/eVK+5Fg1qNoz5VAwsmMs/NofrmJvw==",
+      "version": "8.0.9",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.9.tgz",
+      "integrity": "sha512-t7g7GVRpMXjNpa67HaVWI/8BWtdVIQPCL2WoozXXA7LBGEFK4AkkKkHx2hAQf5x1GZSlcmEDPkVLSGahxnEEZw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
-        "postcss": "^8.5.14",
-        "rolldown": "1.0.1",
+        "postcss": "^8.5.10",
+        "rolldown": "1.0.0-rc.16",
         "tinyglobby": "^0.2.16"
       },
       "bin": {
@@ -5638,7 +5638,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.18",
+        "@vitejs/devtools": "^0.1.0",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
@@ -5690,19 +5690,19 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.6.tgz",
-      "integrity": "sha512-6lvjbS3p9b4CrdCmguzbh2/4uoXhGE2q71R4OX5sqF9R1bo9Xd6fGrMAfvp5wnCzlBnFVdCOp6onuTQVbo8iUQ==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.5.tgz",
+      "integrity": "sha512-9Xx1v3/ih3m9hN+SbfkUyy0JAs72ap3r7joc87XL6jwF0jGg6mFBvQ1SrwaX+h8BlkX6Hz9shdd1uo6AF+ZGpg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.6",
-        "@vitest/mocker": "4.1.6",
-        "@vitest/pretty-format": "4.1.6",
-        "@vitest/runner": "4.1.6",
-        "@vitest/snapshot": "4.1.6",
-        "@vitest/spy": "4.1.6",
-        "@vitest/utils": "4.1.6",
+        "@vitest/expect": "4.1.5",
+        "@vitest/mocker": "4.1.5",
+        "@vitest/pretty-format": "4.1.5",
+        "@vitest/runner": "4.1.5",
+        "@vitest/snapshot": "4.1.5",
+        "@vitest/spy": "4.1.5",
+        "@vitest/utils": "4.1.5",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -5730,12 +5730,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.6",
-        "@vitest/browser-preview": "4.1.6",
-        "@vitest/browser-webdriverio": "4.1.6",
-        "@vitest/coverage-istanbul": "4.1.6",
-        "@vitest/coverage-v8": "4.1.6",
-        "@vitest/ui": "4.1.6",
+        "@vitest/browser-playwright": "4.1.5",
+        "@vitest/browser-preview": "4.1.5",
+        "@vitest/browser-webdriverio": "4.1.5",
+        "@vitest/coverage-istanbul": "4.1.5",
+        "@vitest/coverage-v8": "4.1.5",
+        "@vitest/ui": "4.1.5",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"

gitnexus/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.5",
+  "version": "1.6.4-rc.94",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -116,6 +116,6 @@
     }
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=20.0.0"
   }
 }

gitnexus/scripts/build.js

@@ -21,15 +21,11 @@ const SHARED_DEST = path.join(DIST, '_shared');
 
 // ── 1. Build gitnexus-shared ───────────────────────────────────────
 console.log('[build] compiling gitnexus-shared…');
-const tscCmd =
-  process.platform === 'win32'
-    ? path.join('node_modules', '.bin', 'tsc.cmd')
-    : path.join('node_modules', '.bin', 'tsc');
-execSync(tscCmd, { cwd: SHARED_ROOT, stdio: 'inherit', timeout: 120_000 });
+execSync('npx tsc', { cwd: SHARED_ROOT, stdio: 'inherit', timeout: 120_000 });
 
 // ── 2. Build gitnexus ──────────────────────────────────────────────
 console.log('[build] compiling gitnexus…');
-execSync(tscCmd, { cwd: ROOT, stdio: 'inherit', timeout: 120_000 });
+execSync('npx tsc', { cwd: ROOT, stdio: 'inherit', timeout: 120_000 });
 
 // ── 3. Copy shared dist ────────────────────────────────────────────
 console.log('[build] copying shared module into dist/_shared…');

gitnexus/src/cli/ai-context.ts

@@ -28,7 +28,6 @@ interface RepoStats {
 export interface AIContextOptions {
   skipAgentsMd?: boolean;
   noStats?: boolean;
-  skipSkills?: boolean;
 }
 
 const GITNEXUS_START_MARKER = '<!-- gitnexus:start -->';
@@ -95,7 +94,6 @@ function generateGitNexusContent(
   generatedSkills?: GeneratedSkillInfo[],
   groupNames?: string[],
   noStats?: boolean,
-  skipSkills?: boolean,
 ): string {
   const generatedRows =
     generatedSkills && generatedSkills.length > 0
@@ -107,26 +105,14 @@ function generateGitNexusContent(
           .join('\n')
       : '';
 
-  // Standard skill rows reference files installed by installSkills(). When
-  // --skip-skills suppresses that install, these rows must be omitted — else
-  // AGENTS.md/CLAUDE.md would direct agents to read files that don't exist.
-  // Community skills (generatedRows) live in .claude/skills/generated/ and
-  // are independent of --skip-skills, so they remain when present.
-  const standardSkillsRows = skipSkills
-    ? ''
-    : `| Understand architecture / "How does X work?" | \`.claude/skills/gitnexus/gitnexus-exploring/SKILL.md\` |
+  const skillsTable = `| Task | Read this skill file |
+|------|---------------------|
+| Understand architecture / "How does X work?" | \`.claude/skills/gitnexus/gitnexus-exploring/SKILL.md\` |
 | Blast radius / "What breaks if I change X?" | \`.claude/skills/gitnexus/gitnexus-impact-analysis/SKILL.md\` |
 | Trace bugs / "Why is X failing?" | \`.claude/skills/gitnexus/gitnexus-debugging/SKILL.md\` |
 | Rename / extract / split / refactor | \`.claude/skills/gitnexus/gitnexus-refactoring/SKILL.md\` |
 | Tools, resources, schema reference | \`.claude/skills/gitnexus/gitnexus-guide/SKILL.md\` |
-| Index, status, clean, wiki CLI commands | \`.claude/skills/gitnexus/gitnexus-cli/SKILL.md\` |`;
-
-  const tableBody = [standardSkillsRows, generatedRows].filter(Boolean).join('\n');
-  const skillsTable = tableBody
-    ? `| Task | Read this skill file |
-|------|---------------------|
-${tableBody}`
-    : '';
+| Index, status, clean, wiki CLI commands | \`.claude/skills/gitnexus/gitnexus-cli/SKILL.md\` |${generatedRows ? '\n' + generatedRows : ''}`;
 
   return `${GITNEXUS_START_MARKER}
 # GitNexus — Code Intelligence
@@ -167,15 +153,11 @@ This repository is listed under GitNexus **group(s): ${groupNames.join(', ')}**
 
 `
     : ''
-}${
-    skillsTable
-      ? `## CLI
+}## CLI
 
 ${skillsTable}
 
-`
-      : ''
-  }${GITNEXUS_END_MARKER}`;
+${GITNEXUS_END_MARKER}`;
 }
 
 /**
@@ -199,9 +181,7 @@ async function fileExists(filePath: string): Promise<boolean> {
 async function upsertGitNexusSection(
   filePath: string,
   content: string,
-  projectName: string,
-  stats: RepoStats,
-): Promise<'created' | 'updated' | 'appended' | 'preserved'> {
+): Promise<'created' | 'updated' | 'appended'> {
   const exists = await fileExists(filePath);
 
   if (!exists) {
@@ -225,50 +205,7 @@ async function upsertGitNexusSection(
   );
 
   if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
-    const existingSection = existingContent.substring(
-      startIdx,
-      endIdx + GITNEXUS_END_MARKER.length,
-    );
-
-    // If the existing section contains <!-- gitnexus:keep -->, preserve the user's
-    // custom layout and only update the stats line (node/edge/flow counts).
-    // This lets teams trim the verbose default template to a lean format without
-    // having it overwritten on every `gitnexus analyze`.
-    //
-    // Note: the keep-marker check operates on `existingSection` (the substring
-    // between valid section markers identified by findSectionMarkerIndex), so
-    // a keep marker in user prose OUTSIDE the GitNexus block has no effect.
-    if (existingSection.includes('<!-- gitnexus:keep -->')) {
-      // Build the new stats line from the caller-provided values directly.
-      // We do NOT re-extract from `content` because:
-      //   (a) first-bold extraction is fragile if the template evolves
-      //   (b) the parenthesized-text fallback can match unrelated tuples
-      //       like `({target: "symbolName", direction: "upstream"})`
-      //       when noStats is set
-      // Passing projectName + stats explicitly makes the contract obvious.
-      // noStats controls template generation, not keep-section stat updates — the user opted into a stats line by keeping it.
-      const newStatsInner = `${stats.nodes || 0} symbols, ${stats.edges || 0} relationships, ${stats.processes || 0} execution flows`;
-      const statsLine = `Indexed as **${projectName}** (${newStatsInner})`;
-
-      // Match either canonical phrasing at line start (`^` with `m` flag) so we
-      // cannot replace prose embedded mid-paragraph. Deliberately no `$`: text
-      // after the closing `)` on the same line (e.g. ". MCP tools.") stays intact.
-      const statsPattern = /^(?:Indexed as|indexed by GitNexus as) \*\*[^*]+\*\* \([^)]+\)/m;
-
-      if (statsPattern.test(existingSection)) {
-        const updatedSection = existingSection.replace(statsPattern, statsLine);
-        const before = existingContent.substring(0, startIdx);
-        const after = existingContent.substring(endIdx + GITNEXUS_END_MARKER.length);
-        await fs.writeFile(filePath, (before + updatedSection + after).trim() + '\n', 'utf-8');
-        return 'updated';
-      }
-      // Keep marker present but no stats line matched. Section is preserved
-      // unchanged on disk; return a distinct status so callers/CLI output
-      // don't mis-report this as 'updated' (which would imply a write).
-      return 'preserved';
-    }
-
-    // No keep marker — replace existing section with full verbose content
+    // Replace existing section
     const before = existingContent.substring(0, startIdx);
     const after = existingContent.substring(endIdx + GITNEXUS_END_MARKER.length);
     const newContent = before + content + after;
@@ -382,33 +319,28 @@ export async function generateAIContextFiles(
     generatedSkills,
     groupNames,
     options?.noStats,
-    options?.skipSkills,
   );
   const createdFiles: string[] = [];
 
   if (!options?.skipAgentsMd) {
     // Create AGENTS.md (standard for Cursor, Windsurf, OpenCode, Cline, etc.)
     const agentsPath = path.join(repoPath, 'AGENTS.md');
-    const agentsResult = await upsertGitNexusSection(agentsPath, content, projectName, stats);
+    const agentsResult = await upsertGitNexusSection(agentsPath, content);
     createdFiles.push(`AGENTS.md (${agentsResult})`);
 
     // Create CLAUDE.md (for Claude Code)
     const claudePath = path.join(repoPath, 'CLAUDE.md');
-    const claudeResult = await upsertGitNexusSection(claudePath, content, projectName, stats);
+    const claudeResult = await upsertGitNexusSection(claudePath, content);
     createdFiles.push(`CLAUDE.md (${claudeResult})`);
   } else {
     createdFiles.push('AGENTS.md (skipped via --skip-agents-md)');
     createdFiles.push('CLAUDE.md (skipped via --skip-agents-md)');
   }
 
-  // Install skills to .claude/skills/gitnexus/ (unless --skip-skills)
-  if (!options?.skipSkills) {
-    const installedSkills = await installSkills(repoPath);
-    if (installedSkills.length > 0) {
-      createdFiles.push(`.claude/skills/gitnexus/ (${installedSkills.length} skills)`);
-    }
-  } else {
-    createdFiles.push('.claude/skills/gitnexus/ (skipped via --skip-skills)');
+  // Install skills to .claude/skills/gitnexus/
+  const installedSkills = await installSkills(repoPath);
+  if (installedSkills.length > 0) {
+    createdFiles.push(`.claude/skills/gitnexus/ (${installedSkills.length} skills)`);
   }
 
   return { files: createdFiles };

gitnexus/src/cli/analyze.ts

@@ -13,7 +13,6 @@ import { execFileSync } from 'child_process';
 import v8 from 'v8';
 import cliProgress from 'cli-progress';
 import { closeLbug } from '../core/lbug/lbug-adapter.js';
-import { isWalCorruptionError, WAL_RECOVERY_SUGGESTION } from '../core/lbug/lbug-config.js';
 import {
   getStoragePaths,
   getGlobalRegistryPath,
@@ -118,22 +117,8 @@ export interface AnalyzeOptions {
   verbose?: boolean;
   /** Skip AGENTS.md and CLAUDE.md gitnexus block updates. */
   skipAgentsMd?: boolean;
-  /**
-   * Stats inclusion in AGENTS.md and CLAUDE.md.
-   *
-   * Commander.js represents `--no-stats` as `stats: boolean` (default
-   * `true`; `false` when the user passes `--no-stats`), NOT as
-   * `noStats: boolean`. Reading the negated form would always be
-   * `undefined` and the flag would silently no-op (#1477). Consumers
-   * that want "did the user request --no-stats?" should compare with
-   * `=== false` to distinguish the explicit-off case from the
-   * default-on case.
-   */
-  stats?: boolean;
-  /** Skip installing standard GitNexus skill files to .claude/skills/gitnexus/. */
-  skipSkills?: boolean;
-  /** Pure index mode: skip all file injection (AGENTS.md, CLAUDE.md, skills). */
-  indexOnly?: boolean;
+  /** Omit volatile symbol/relationship counts from AGENTS.md and CLAUDE.md. */
+  noStats?: boolean;
   /** Index the folder even when no .git directory is present. */
   skipGit?: boolean;
   /**
@@ -165,24 +150,6 @@ export interface AnalyzeOptions {
   embeddingDevice?: string;
 }
 
-/**
- * Whether the post-index skill step should run.
- *
- * The gated block does two things in sequence: (1) generates the community
- * skill files from `--skills`, and (2) re-runs `generateAIContextFiles` so
- * AGENTS.md/CLAUDE.md can reference the freshly written skills. Both are
- * suppressed together — `--index-only` drops the entire step, not just the
- * community-skill write. Name retained for the test contract; see call site
- * in `analyzeCommand` for the AGENTS.md/CLAUDE.md re-generation it also gates.
- *
- * Kept as a pure helper so the `--index-only --skills` contract is unit-tested
- * without booting the full analyze pipeline (#742 review).
- */
-export const shouldGenerateCommunitySkillFiles = (
-  options: Pick<AnalyzeOptions, 'skills' | 'indexOnly'> | undefined,
-  pipelineResult: unknown,
-): boolean => Boolean(options?.skills && pipelineResult && !options?.indexOnly);
-
 export const analyzeCommand = async (inputPath?: string, options?: AnalyzeOptions) => {
   if (ensureHeap()) return;
 
@@ -278,18 +245,6 @@ export const analyzeCommand = async (inputPath?: string, options?: AnalyzeOption
 
   console.log('\n  GitNexus Analyzer\n');
 
-  // `--index-only` is the stronger contract — it suppresses every form of file
-  // injection, including community skill writes that `--skills` would normally
-  // produce. Surface the override explicitly so users don't wonder why a
-  // pipeline re-index ran but no skill files appeared. The pipeline still
-  // re-runs (see `force: options?.force || options?.skills` below); the warning
-  // is purely about the dropped post-index write step.
-  if (options?.indexOnly && options?.skills) {
-    console.log(
-      '  Note: --index-only overrides --skills; community skill files will not be written.\n',
-    );
-  }
-
   let repoPath: string;
   if (inputPath) {
     repoPath = path.resolve(inputPath);
@@ -444,9 +399,6 @@ export const analyzeCommand = async (inputPath?: string, options?: AnalyzeOption
 
   // ── Run shared analysis orchestrator ───────────────────────────────
   try {
-    const skipAll = options?.indexOnly;
-    const skipAgentsMd = skipAll || options?.skipAgentsMd;
-    const skipSkills = skipAll || options?.skipSkills;
     const result = await runFullAnalysis(
       repoPath,
       {
@@ -458,14 +410,8 @@ export const analyzeCommand = async (inputPath?: string, options?: AnalyzeOption
         embeddingsNodeLimit,
         dropEmbeddings: options?.dropEmbeddings,
         skipGit: options?.skipGit,
-        skipAgentsMd,
-        skipSkills,
-        // commander.js `.option('--no-stats', …)` registers the flag as
-        // `options.stats` (boolean, default true; `false` when the user
-        // passed --no-stats). Reading `options?.noStats` here returns
-        // undefined every time, so the flag was a no-op on the markdown
-        // rewrite path before this fix. See #1477.
-        noStats: options?.stats === false,
+        skipAgentsMd: options?.skipAgentsMd,
+        noStats: options?.noStats,
         registryName: options?.name,
         // Registry-collision bypass — its own CLI flag, intentionally NOT
         // overloading --force. A user who hits the collision guard should
@@ -510,10 +456,8 @@ export const analyzeCommand = async (inputPath?: string, options?: AnalyzeOption
     // a healthy index.
     await assertAnalysisFinalized(repoPath);
 
-    // Skill generation (CLI-only, uses pipeline result from analysis).
-    // Gated so `--index-only --skills` skips community skill writes too
-    // (`shouldGenerateCommunitySkillFiles` — see unit test).
-    if (shouldGenerateCommunitySkillFiles(options, result.pipelineResult)) {
+    // Skill generation (CLI-only, uses pipeline result from analysis)
+    if (options?.skills && result.pipelineResult) {
       updateBar(99, 'Generating skill files...');
       try {
         const { generateSkillFiles } = await import('./skill-gen.js');
@@ -553,13 +497,7 @@ export const analyzeCommand = async (inputPath?: string, options?: AnalyzeOption
               processes: s.processes,
             },
             skillResult.skills,
-            {
-              skipAgentsMd,
-              skipSkills,
-              // Mirror runFullAnalysis `noStats` bridge (#1477) — same expression;
-              // exercised on the `--skills` path by analyze-no-stats-bridge.test.ts.
-              noStats: options?.stats === false,
-            },
+            { skipAgentsMd: options?.skipAgentsMd, noStats: options?.noStats },
           );
         }
       } catch {
@@ -639,20 +577,6 @@ export const analyzeCommand = async (inputPath?: string, options?: AnalyzeOption
       return;
     }
 
-    // WAL corruption — the index file is unreadable. Give a clear recovery
-    // path without a confusing stack trace (the native error message alone
-    // is enough signal).
-    if (isWalCorruptionError(err) || msg.includes('LadybugDB WAL corruption')) {
-      cliError(
-        `  The GitNexus index has a corrupted WAL file.\n` +
-          `  This usually happens when a previous analysis was interrupted mid-write.\n` +
-          `  ${WAL_RECOVERY_SUGGESTION}\n`,
-        { recoveryHint: 'wal-corruption' },
-      );
-      process.exitCode = 1;
-      return;
-    }
-
     // HF download failure — show clean guidance without the raw stack trace.
     // Checked before writeFatalToStderr so the user sees one focused message
     // rather than a stack-trace dump followed by a second remediation block.

gitnexus/src/cli/augment.ts

@@ -2,7 +2,7 @@
  * Augment CLI Command
  *
  * Fast-path command for platform hooks.
- * Shells out from Claude Code PreToolUse / Cursor postToolUse hooks.
+ * Shells out from Claude Code PreToolUse / Cursor beforeShellExecution hooks.
  *
  * Usage: gitnexus augment <pattern>
  * Returns enriched text to stdout.

gitnexus/src/cli/index.ts

@@ -33,20 +33,9 @@ program
     'Drop existing embeddings on rebuild. By default, an `analyze` without `--embeddings` ' +
       'preserves any embeddings already present in the index.',
   )
-  .option(
-    '--skills',
-    'Generate repo-specific skill files from detected communities ' +
-      '(no-op when --index-only is also set).',
-  )
+  .option('--skills', 'Generate repo-specific skill files from detected communities')
   .option('--skip-agents-md', 'Skip updating the gitnexus section in AGENTS.md and CLAUDE.md')
   .option('--no-stats', 'Omit volatile file/symbol counts from AGENTS.md and CLAUDE.md')
-  .option(
-    '--skip-skills',
-    'Skip installing standard GitNexus skill files under .claude/skills/gitnexus/. ' +
-      'Does not suppress community skills from --skills (those use .claude/skills/generated/). ' +
-      'Use --index-only to skip all AI-context file injection.',
-  )
-  .option('--index-only', 'Pure index mode: skip all file injection (AGENTS.md, CLAUDE.md, skills)')
   .option(
     '--skip-git',
     'Treat the provided path/cwd as the index root and skip parent git-root discovery',
@@ -161,8 +150,6 @@ program
   )
   .option('--no-reasoning-model', 'Disable reasoning model mode (overrides saved config)')
   .option('--concurrency <n>', 'Parallel LLM calls (default: 3)', '3')
-  .option('--timeout <seconds>', 'LLM request timeout in seconds (default: disabled)')
-  .option('--retries <n>', 'Max LLM retry attempts per request (default: 3)')
   .option('--gist', 'Publish wiki as a public GitHub Gist after generation')
   .option('-v, --verbose', 'Enable verbose output (show LLM commands and responses)')
   .option('--review', 'Stop after grouping to review module structure before generating pages')
@@ -173,18 +160,6 @@ program
   .description('Augment a search pattern with knowledge graph context (used by hooks)')
   .action(createLazyAction(() => import('./augment.js'), 'augmentCommand'));
 
-program
-  .command('publish [path]')
-  .description(
-    'Notify the understand-quickly registry that this repo has a fresh GitNexus index. ' +
-      'Opt-in: requires UNDERSTAND_QUICKLY_TOKEN (fine-grained PAT with ' +
-      '`Repository dispatches: write` on looptech-ai/understand-quickly). ' +
-      'No-op without the token. See https://github.com/looptech-ai/understand-quickly.',
-  )
-  .option('--id <owner/repo>', 'Override the registry id (defaults to the origin remote)')
-  .option('--skip-git', 'Treat cwd as the repo root and skip parent git-root discovery')
-  .action(createLazyAction(() => import('./publish.js'), 'publishCommand'));
-
 // ─── Direct Tool Commands (no MCP overhead) ────────────────────────
 // These invoke LocalBackend directly for use in eval, scripts, and CI.
 

gitnexus/src/cli/publish.ts

@@ -1,232 +0,0 @@
-/**
- * `gitnexus publish` — opt-in ping to the understand-quickly registry.
- *
- * Fires a single `repository_dispatch` event at
- * `looptech-ai/understand-quickly` so the registry knows to refresh its
- * entry for the current repo. Does NOT upload anything: per the
- * understand-quickly protocol, the registry pulls the graph from a
- * raw-GitHub URL the user controls.
- *
- *   https://github.com/looptech-ai/understand-quickly/blob/main/docs/integrations/protocol.md
- *
- * Defaults:
- *   - Without `UNDERSTAND_QUICKLY_TOKEN` in the env, this is a no-op
- *     (prints one informational line, exit 0). Same shape as the
- *     `--publish` patterns in sibling tools.
- *   - With the token, fires the dispatch and reports the response code.
- *
- * The `id` is derived from the repo's `origin` remote unless the caller
- * passes `--id <owner/repo>` explicitly. We deliberately do NOT auto-add
- * the repo to the registry — registration is one-time and uses the
- * `npx @understand-quickly/cli add` path documented in the protocol.
- */
-
-import path from 'path';
-import {
-  UNDERSTAND_QUICKLY_DISPATCH_URL,
-  UNDERSTAND_QUICKLY_TOKEN_ENV,
-  buildUqDispatchPayload,
-  isValidOwnerRepo,
-  parseOwnerRepoFromRemote,
-} from 'gitnexus-shared';
-import { getGitRoot, getRemoteOriginUrl, getCurrentCommit } from '../storage/git.js';
-import { hasIndex } from '../storage/repo-manager.js';
-import { cliInfo, cliError } from './cli-message.js';
-
-export interface PublishOptions {
-  /** Override the auto-derived `owner/repo` id. */
-  id?: string;
-  /** Treat the cwd as the repo root (skip git-root walk). */
-  skipGit?: boolean;
-}
-
-const REGISTER_HINT =
-  'Register your repo once with: npx @understand-quickly/cli add\n' +
-  'Or use the wizard: https://looptech-ai.github.io/understand-quickly/add.html';
-
-/**
- * Hard cap on the dispatch fetch to keep CI publish steps from stalling
- * for the OS TCP timeout (~2 min) when api.github.com is unreachable.
- * Matches the pattern used in `src/core/embeddings/http-client.ts`.
- */
-const DISPATCH_TIMEOUT_MS = 15_000;
-
-export const publishCommand = async (
-  inputPath?: string,
-  options: PublishOptions = {},
-): Promise<void> => {
-  // ── 0. Token gate FIRST — guarantees true no-op without the token. ──
-  // The README, CLI --help, and PR body all promise "exit 0 without
-  // UNDERSTAND_QUICKLY_TOKEN". Doing the index/repo-root checks before
-  // the token gate would make those promises false for users who haven't
-  // run `gitnexus analyze` yet but want to verify the command is wired.
-  const token = process.env[UNDERSTAND_QUICKLY_TOKEN_ENV];
-  if (!token) {
-    cliInfo(
-      `[understand-quickly] ${UNDERSTAND_QUICKLY_TOKEN_ENV} is not set — skipping dispatch.\n` +
-        `Set it to a fine-grained PAT with "Repository dispatches: write" on ` +
-        `looptech-ai/understand-quickly to enable instant resync.\n` +
-        `(Without the token, the registry's nightly sync still picks up your entry.)`,
-      { skipped: 'no-token' },
-    );
-    return;
-  }
-
-  // ── 1. Resolve the repo root (same precedence as `analyze`) ──────────
-  let repoPath: string;
-  if (inputPath) {
-    repoPath = path.resolve(inputPath);
-  } else if (options.skipGit) {
-    repoPath = path.resolve(process.cwd());
-  } else {
-    const gitRoot = getGitRoot(process.cwd());
-    if (!gitRoot) {
-      cliError(
-        '[understand-quickly] not inside a git repository.\n' +
-          'Run from a repo, or pass --skip-git to publish from the current directory.',
-      );
-      process.exitCode = 1;
-      return;
-    }
-    repoPath = gitRoot;
-  }
-
-  // ── 2. Confirm a GitNexus index exists ───────────────────────────────
-  // Publishing without an index is almost always a mistake — the
-  // registry's nightly sync would fetch a stale or missing graph file
-  // and mark the entry `missing`. Refuse loudly with a fix-it hint.
-  if (!(await hasIndex(repoPath))) {
-    cliError(
-      `[understand-quickly] no GitNexus index found at ${repoPath}/.gitnexus.\n` +
-        'Run `gitnexus analyze` first, then re-run `gitnexus publish`.',
-    );
-    process.exitCode = 1;
-    return;
-  }
-
-  // ── 3. Derive the registry id ─────────────────────────────────────────
-  const id =
-    options.id ?? parseOwnerRepoFromRemote(getRemoteOriginUrl(repoPath) ?? undefined) ?? null;
-  if (!id || !isValidOwnerRepo(id)) {
-    cliError(
-      `[understand-quickly] could not derive a registry id from this repo.\n` +
-        `Pass --id <owner/repo> explicitly (e.g. --id looptech-ai/${path.basename(repoPath)}).\n` +
-        REGISTER_HINT,
-    );
-    process.exitCode = 1;
-    return;
-  }
-
-  // ── 4. Fire the dispatch ─────────────────────────────────────────────
-  const payload = buildUqDispatchPayload(id);
-  let response: Response;
-  try {
-    response = await fetch(UNDERSTAND_QUICKLY_DISPATCH_URL, {
-      method: 'POST',
-      headers: {
-        Accept: 'application/vnd.github+json',
-        Authorization: `Bearer ${token}`,
-        'X-GitHub-Api-Version': '2022-11-28',
-        'Content-Type': 'application/json',
-        'User-Agent': 'gitnexus-cli',
-      },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(DISPATCH_TIMEOUT_MS),
-    });
-  } catch (err) {
-    // `AbortSignal.timeout()` throws a `DOMException` with `name ===
-    // 'TimeoutError'` on Node 18.14+ (and on browsers/Bun). It is NOT
-    // a plain `AbortError`. Match the pattern used in
-    // gitnexus/src/core/embeddings/http-client.ts so the user sees the
-    // targeted "timed out" message instead of a generic "operation
-    // was aborted".
-    const isTimeout = err instanceof DOMException && err.name === 'TimeoutError';
-    if (isTimeout) {
-      cliError(
-        `[understand-quickly] dispatch timed out after ${DISPATCH_TIMEOUT_MS}ms. ` +
-          `Check network access to api.github.com and retry.`,
-        { id },
-      );
-    } else {
-      const msg = err instanceof Error ? err.message : String(err);
-      cliError(`[understand-quickly] dispatch network error: ${msg}`, { id });
-    }
-    process.exitCode = 1;
-    return;
-  }
-
-  // GitHub returns 204 on success. Distinct branches for 401/403/404/422
-  // so users debug without checking the docs.
-  if (response.status === 204) {
-    await response.body?.cancel().catch(() => {});
-    // `getCurrentCommit` is only meaningful in the success path — moving
-    // it inside this branch removes a wasted child-process spawn on every
-    // error response (LOW 7).
-    const commit = getCurrentCommit(repoPath);
-    cliInfo(
-      `[understand-quickly] dispatched sync-entry for ${id}` +
-        (commit ? ` @ ${commit.slice(0, 7)}` : '') +
-        '.\n' +
-        `Note: a 204 only confirms GitHub accepted the dispatch. Whether the ` +
-        `registry workflow finds an entry for "${id}" is logged at ` +
-        `https://github.com/looptech-ai/understand-quickly/actions/workflows/sync.yml`,
-      { id, commit, status: response.status },
-    );
-    return;
-  }
-
-  if (response.status === 401) {
-    cliError(
-      `[understand-quickly] dispatch returned 401 — the ${UNDERSTAND_QUICKLY_TOKEN_ENV} value is invalid or expired.\n` +
-        `Regenerate a fine-grained PAT at https://github.com/settings/personal-access-tokens ` +
-        `with Repository access scoped to looptech-ai/understand-quickly and the ` +
-        `"Repository dispatches: write" permission, then retry.`,
-      { id, status: response.status },
-    );
-    process.exitCode = 1;
-    return;
-  }
-
-  if (response.status === 403) {
-    cliError(
-      `[understand-quickly] dispatch returned 403 — the token authenticated but ` +
-        `lacks the "Repository dispatches: write" permission on ` +
-        `looptech-ai/understand-quickly. Edit the PAT scopes and retry.`,
-      { id, status: response.status },
-    );
-    process.exitCode = 1;
-    return;
-  }
-
-  if (response.status === 404) {
-    cliError(
-      `[understand-quickly] dispatch returned 404 — the token cannot reach ` +
-        `looptech-ai/understand-quickly. Verify the PAT has Repository access to ` +
-        `that exact repo (not just your own org).`,
-      { id, status: response.status },
-    );
-    process.exitCode = 1;
-    return;
-  }
-
-  if (response.status === 422) {
-    // Malformed event_type / client_payload — a code bug in this CLI,
-    // not a user mistake. Surface so we get bug reports.
-    const body422 = await response.text().catch(() => '');
-    cliError(
-      `[understand-quickly] dispatch returned 422 (this is a CLI bug; please report).\n` +
-        `Body: ${body422 || '(empty)'}`,
-      { id, status: response.status },
-    );
-    process.exitCode = 1;
-    return;
-  }
-
-  // 5xx and anything else → bubble the body so the user has something to act on.
-  const body = await response.text().catch(() => '');
-  cliError(
-    `[understand-quickly] dispatch failed with HTTP ${response.status}: ${body || '(empty body)'}`,
-    { id, status: response.status },
-  );
-  process.exitCode = 1;
-};

gitnexus/src/cli/serve.ts

@@ -1,7 +1,6 @@
 import { createServer } from '../server/api.js';
 import { logger, flushLoggerSync } from '../core/logger.js';
 import { cliError } from './cli-message.js';
-import { isWalCorruptionError, WAL_RECOVERY_SUGGESTION } from '../core/lbug/lbug-config.js';
 
 // Catch anything that would cause a silent exit. Pino v10's default
 // destination is `sync: false` (SonicBoom buffered) — call
@@ -35,13 +34,7 @@ export const serveCommand = async (options?: { port?: string; host?: string }) =
   try {
     await createServer(port, host);
   } catch (err: any) {
-    if (isWalCorruptionError(err)) {
-      cliError(
-        `\nGitNexus server could not start: the index has a corrupted WAL file.\n` +
-          `  ${WAL_RECOVERY_SUGGESTION}\n`,
-        { recoveryHint: 'wal-corruption' },
-      );
-    } else if (err.code === 'EADDRINUSE') {
+    if (err.code === 'EADDRINUSE') {
       cliError(
         `\nFailed to start GitNexus server:\n` +
           `  ${err.message || err}\n\n` +

gitnexus/src/cli/setup.ts

@@ -364,33 +364,6 @@ async function installClaudeCodeHooks(result: SetupResult): Promise<void> {
       // Script not found in source — skip
     }
 
-    try {
-      await fs.copyFile(
-        path.join(pluginHooksPath, 'hook-lock.cjs'),
-        path.join(destHooksDir, 'hook-lock.cjs'),
-      );
-    } catch {
-      // Helper not found in source — skip
-    }
-
-    try {
-      await fs.copyFile(
-        path.join(pluginHooksPath, 'hook-db-lock-probe.cjs'),
-        path.join(destHooksDir, 'hook-db-lock-probe.cjs'),
-      );
-    } catch {
-      // Helper not found in source — skip
-    }
-
-    try {
-      await fs.copyFile(
-        path.join(pluginHooksPath, 'win-rm-list-json.ps1'),
-        path.join(destHooksDir, 'win-rm-list-json.ps1'),
-      );
-    } catch {
-      // Helper not found in source — skip
-    }
-
     const hookPath = path.join(destHooksDir, 'gitnexus-hook.cjs').replace(/\\/g, '/');
     // Escape backslashes FIRST, then quotes (CodeQL js/incomplete-sanitization).
     // The previous shape `replace(/"/g, '\\"')` alone would let `path\with"quote`

gitnexus/src/cli/wiki.ts

@@ -33,25 +33,6 @@ export interface WikiCommandOptions {
   provider?: LLMProvider;
   verbose?: boolean;
   review?: boolean;
-  timeout?: string;
-  retries?: string;
-}
-
-function parsePositiveIntegerOption(
-  value: string | undefined,
-  flag: string,
-  multiplier = 1,
-): number | undefined {
-  if (value === undefined) return undefined;
-  const trimmed = value.trim();
-  if (!/^[1-9]\d*$/.test(trimmed)) {
-    throw new Error(`${flag} must be a positive integer`);
-  }
-  const parsed = parseInt(trimmed, 10);
-  if (parsed > Math.floor(Number.MAX_SAFE_INTEGER / multiplier)) {
-    throw new Error(`${flag} is too large`);
-  }
-  return parsed;
 }
 
 /**
@@ -144,17 +125,6 @@ export const wikiCommand = async (inputPath?: string, options?: WikiCommandOptio
     return;
   }
 
-  let timeoutSeconds: number | undefined;
-  let retries: number | undefined;
-  try {
-    timeoutSeconds = parsePositiveIntegerOption(options?.timeout, '--timeout', 1000);
-    retries = parsePositiveIntegerOption(options?.retries, '--retries');
-  } catch (error) {
-    console.log(`  Error: ${(error as Error).message}\n`);
-    process.exitCode = 1;
-    return;
-  }
-
   // ── Resolve LLM config (with interactive fallback) ─────────────────
   // Save any CLI overrides immediately
   if (
@@ -377,14 +347,6 @@ export const wikiCommand = async (inputPath?: string, options?: WikiCommandOptio
     }
   }
 
-  // ── Apply per-run overrides not saved to config ────────────────────
-  if (timeoutSeconds !== undefined) {
-    llmConfig.requestTimeoutMs = timeoutSeconds * 1000;
-  }
-  if (retries !== undefined) {
-    llmConfig.maxAttempts = retries;
-  }
-
   // ── Setup progress bar with elapsed timer ──────────────────────────
   const bar = new cliProgress.SingleBar(
     {
@@ -589,8 +551,6 @@ export const wikiCommand = async (inputPath?: string, options?: WikiCommandOptio
 
     if (err.message?.includes('No source files')) {
       console.log(`\n  ${err.message}\n`);
-    } else if (err.message?.includes('LLM request timed out after')) {
-      console.log(`\n  Timeout: ${err.message}\n`);
     } else if (err.message?.includes('content filter')) {
       // Content filter block — actionable message
       console.log(`\n  Content Filter: ${err.message}\n`);

gitnexus/src/config/ignore-service.ts

@@ -25,8 +25,6 @@ const DEFAULT_IGNORE_LIST = new Set([
   'bower_components',
   'jspm_packages',
   'vendor', // PHP/Go
-  'third_party', // C/C++ (Google-style vendored dependencies)
-  '3rdparty', // C/C++ (alternate spelling, also Qt convention)
   // 'packages' removed - commonly used for monorepo source code (lerna, pnpm, yarn workspaces)
   'venv',
   '.venv',

gitnexus/src/core/augmentation/engine.ts

@@ -2,8 +2,8 @@
  * Augmentation Engine
  *
  * Lightweight, fast-path enrichment of search patterns with knowledge graph context.
- * Designed to be called from platform hooks (Claude Code PreToolUse, Cursor postToolUse)
- * when an agent runs grep/glob/read/search.
+ * Designed to be called from platform hooks (Claude Code PreToolUse, Cursor beforeShellExecution)
+ * when an agent runs grep/glob/search.
  *
  * Performance target: <500ms cold start, <200ms warm.
  *
@@ -86,9 +86,6 @@ async function findRepoForCwd(cwd: string): Promise<{
 export async function augment(pattern: string, cwd?: string): Promise<string> {
   if (!pattern || pattern.length < 3) return '';
 
-  const patternFirstWord = pattern.trim().replace(/'/g, "''").split(/\s+/)[0];
-  if (!patternFirstWord || patternFirstWord.length < 2) return '';
-
   const workDir = cwd || process.cwd();
 
   try {
@@ -107,7 +104,9 @@ export async function augment(pattern: string, cwd?: string): Promise<string> {
     }
 
     // Step 1: BM25 search (fast, no embeddings)
-    const { results: bm25Results, ftsAvailable } = await searchFTSFromLbug(pattern, 10, repoId);
+    const { results: bm25Results } = await searchFTSFromLbug(pattern, 10, repoId);
+
+    if (bm25Results.length === 0) return '';
 
     // Step 2: Map BM25 file results to symbols
     const symbolMatches: Array<{
@@ -125,7 +124,7 @@ export async function augment(pattern: string, cwd?: string): Promise<string> {
           repoId,
           `
           MATCH (n) WHERE n.filePath = '${escaped}'
-          AND n.name CONTAINS '${patternFirstWord}'
+          AND n.name CONTAINS '${pattern.replace(/'/g, "''").split(/\s+/)[0]}'
           RETURN n.id AS id, n.name AS name, labels(n)[0] AS type, n.filePath AS filePath
           LIMIT 3
         `,
@@ -144,29 +143,6 @@ export async function augment(pattern: string, cwd?: string): Promise<string> {
       }
     }
 
-    // When FTS indexes are unavailable (read-only DB, first run before indexes are built),
-    // fall back to a direct name CONTAINS query so enrichment still works.
-    if (symbolMatches.length === 0 && !ftsAvailable) {
-      const fallbackRows = await executeQuery(
-        repoId,
-        `
-        MATCH (n)
-        WHERE n.name CONTAINS '${patternFirstWord}'
-        RETURN n.id AS id, n.name AS name, labels(n)[0] AS type, n.filePath AS filePath
-        LIMIT 5
-      `,
-      ).catch(() => []);
-      for (const sym of fallbackRows) {
-        symbolMatches.push({
-          nodeId: sym.id || sym[0],
-          name: sym.name || sym[1],
-          type: sym.type || sym[2],
-          filePath: sym.filePath || sym[3],
-          score: 1.0,
-        });
-      }
-    }
-
     if (symbolMatches.length === 0) return '';
 
     // Step 3: Batch-fetch callers/callees/processes/cohesion for top matches

gitnexus/src/core/embeddings/ast-utils.ts

@@ -10,7 +10,6 @@ import {
   isLanguageAvailable,
   resolveLanguageKey,
 } from '../tree-sitter/parser-loader.js';
-import { parseSourceSafe } from '../tree-sitter/safe-parse.js';
 
 const parserCache = new Map<string, any>();
 
@@ -30,7 +29,7 @@ export const ensureAndParse = async (content: string, filePath: string): Promise
     parserCache.set(parserKey, parserInstance);
   }
 
-  return parseSourceSafe(parserInstance, content);
+  return parserInstance.parse(content);
 };
 
 const FUNCTION_LIKE_TYPES = new Set([

gitnexus/src/core/embeddings/hf-env.ts

@@ -1,8 +1,6 @@
 import os from 'node:os';
 import { join } from 'node:path';
 
-import { CircuitBreaker, withRetry } from 'gitnexus-shared';
-
 // ---------------------------------------------------------------------------
 // Download resilience defaults
 // ---------------------------------------------------------------------------
@@ -110,19 +108,70 @@ export function isNetworkFetchError(message: string): boolean {
 /** @internal Used by `withHfDownloadRetry` to mark a circuit-open rejection. */
 export const CIRCUIT_OPEN_TAG = 'hf-circuit-open';
 
+/** Circuit-breaker states. */
+type CircuitState = 'closed' | 'open' | 'half-open';
+
 /**
- * Module-level singleton shared by both embedder entry points
- * (`core/embeddings/embedder.ts` + `mcp/core/embedder.ts`). Per-process
- * only — not persisted across restarts. Backed by the shared
- * `CircuitBreaker` from `gitnexus-shared` (same state machine, same
- * semantics, plus the single-permit half-open gate that prevents
- * recovery-time stampedes).
+ * Circuit breaker for HuggingFace model downloads.
+ *
+ * After `failureThreshold` consecutive network failures the circuit opens and
+ * all subsequent calls to `withHfDownloadRetry` fail immediately without
+ * issuing any network requests. After `resetTimeoutMs` the circuit enters the
+ * half-open state and the next call is attempted — if it succeeds the circuit
+ * closes again; if it fails the circuit re-opens.
+ *
+ * Exported for unit-testing; production code should use the module-level
+ * `hfDownloadCircuit` singleton.
  */
-export const hfDownloadCircuit = new CircuitBreaker({
-  failureThreshold: CB_FAILURE_THRESHOLD,
-  cooldownMs: CB_RESET_TIMEOUT_MS,
-  key: 'hf-download',
-});
+export class HfDownloadCircuitBreaker {
+  private _state: CircuitState = 'closed';
+  private _failures = 0;
+  /** Timestamp of the last recorded failure (ms since epoch). */
+  lastFailureAt = 0;
+
+  constructor(
+    readonly failureThreshold: number = CB_FAILURE_THRESHOLD,
+    readonly resetTimeoutMs: number = CB_RESET_TIMEOUT_MS,
+  ) {}
+
+  /** Effective state, factoring in the reset-timeout transition. */
+  get state(): CircuitState {
+    if (this._state === 'open' && Date.now() - this.lastFailureAt > this.resetTimeoutMs) {
+      this._state = 'half-open';
+    }
+    return this._state;
+  }
+
+  /** Returns true when the circuit is open and calls should be rejected. */
+  isOpen(): boolean {
+    return this.state === 'open';
+  }
+
+  /** Record a successful call — resets the failure counter and closes the circuit. */
+  recordSuccess(): void {
+    this._failures = 0;
+    this._state = 'closed';
+  }
+
+  /** Record a failed call — increments the counter and opens the circuit when the threshold is reached. */
+  recordFailure(): void {
+    this._failures++;
+    this.lastFailureAt = Date.now();
+    if (this._failures >= this.failureThreshold) {
+      this._state = 'open';
+    }
+  }
+
+  /** @internal Reset to initial state (used in tests). */
+  reset(): void {
+    this._failures = 0;
+    this._state = 'closed';
+    this.lastFailureAt = 0;
+  }
+}
+
+/** Module-level singleton shared by both embedder entry points. */
+export const hfDownloadCircuit = new HfDownloadCircuitBreaker();
 
 // ---------------------------------------------------------------------------
 // Retry + timeout wrapper
@@ -170,6 +219,11 @@ export function withDownloadTimeout<T>(fn: () => Promise<T>, timeoutMs: number):
   });
 }
 
+/** @internal Async sleep (exposed for testing). */
+export function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 export interface HfRetryOptions {
   /** Maximum total attempts including the initial one (default: `HF_MAX_ATTEMPTS`). */
   maxAttempts?: number;
@@ -181,7 +235,7 @@ export interface HfRetryOptions {
    * Circuit-breaker instance to use. Defaults to the module-level
    * `hfDownloadCircuit` singleton. Pass a fresh instance in tests.
    */
-  circuit?: CircuitBreaker;
+  circuit?: HfDownloadCircuitBreaker;
   /**
    * Optional callback invoked before each retry (not the initial attempt).
    * @param attempt - 1-based retry number
@@ -241,74 +295,49 @@ export async function withHfDownloadRetry<T>(
     circuit = hfDownloadCircuit,
     onRetry,
   } = options;
-  if (circuit.getState() === 'open') {
-    // Compute remaining cooldown without consuming a probe permit.
-    const openedAt = circuit.getOpenedAt();
-    const secsUntilReset =
-      openedAt !== null ? Math.ceil((circuit.getCooldownMs() - (Date.now() - openedAt)) / 1000) : 0;
+  if (circuit.isOpen()) {
+    const secsUntilReset = Math.ceil(
+      (circuit.resetTimeoutMs - (Date.now() - circuit.lastFailureAt)) / 1000,
+    );
     throw new Error(
       `${CIRCUIT_OPEN_TAG}: HuggingFace download circuit is open after repeated network failures` +
         (secsUntilReset > 0 ? ` — will reset in ~${secsUntilReset}s` : ''),
     );
   }
 
-  // Retry budget delegated to `withRetry` from gitnexus-shared. The
-  // HF-specific bits — per-attempt timeout, network-vs-non-network
-  // classification, circuit-breaker recording, onRetry callback — wire
-  // through the `isRetryable` callback. `circuitTripped` is the
-  // sentinel that lets us replace the final thrown error with a
-  // CIRCUIT_OPEN_TAG message when the breaker tripped mid-loop.
-  let circuitTripped = false;
+  let lastError: Error = new Error('unknown error');
 
-  try {
-    return await withRetry(
-      async () => {
-        const result = await withDownloadTimeout(fn, timeoutMs);
-        circuit.recordSuccess();
-        return result;
-      },
-      {
-        maxAttempts,
-        baseDelayMs,
-        // Disable the cap to match the bespoke pure-exponential
-        // progression. With the default `HF_MAX_ATTEMPTS_CAP = 10` and
-        // `baseDelayMs = 2000`, the largest possible delay is
-        // `2000 * 2^9 = ~17 minutes` — bounded enough not to need a cap.
-        capDelayMs: Number.MAX_SAFE_INTEGER,
-        isRetryable: (err, attempt) => {
-          const error = err instanceof Error ? err : new Error(String(err));
-          if (!isNetworkFetchError(error.message)) {
-            // Non-network error (e.g. CUDA unavailable) — propagate
-            // without retry. Use recordNeutral so the breaker's existing
-            // failure-count progress isn't reset by a non-network failure
-            // that says nothing about the CDN's health.
-            circuit.recordNeutral();
-            return { retry: false };
-          }
-          circuit.recordFailure();
-          if (circuit.getState() === 'open') {
-            // Circuit just tripped — fail fast, no more retries.
-            circuitTripped = true;
-            return { retry: false };
-          }
-          // Mirror the bespoke onRetry contract: fire only when there's
-          // actually a next attempt.
-          if (attempt + 1 < maxAttempts) {
-            onRetry?.(attempt + 1, maxAttempts, error);
-          }
-          return { retry: true };
-        },
-      },
-    );
-  } catch (err) {
-    if (circuitTripped) {
-      throw new Error(
-        `${CIRCUIT_OPEN_TAG}: HuggingFace download circuit opened after ${CB_FAILURE_THRESHOLD} consecutive failures`,
-      );
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    try {
+      const result = await withDownloadTimeout(fn, timeoutMs);
+      circuit.recordSuccess();
+      return result;
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+
+      if (!isNetworkFetchError(lastError.message)) {
+        // Non-network error (e.g. CUDA unavailable) — propagate without retry
+        throw lastError;
+      }
+
+      circuit.recordFailure();
+
+      if (circuit.isOpen()) {
+        // Circuit just tripped — fail fast, no more retries
+        throw new Error(
+          `${CIRCUIT_OPEN_TAG}: HuggingFace download circuit opened after ${circuit.failureThreshold} consecutive failures`,
+        );
+      }
+
+      if (attempt < maxAttempts - 1) {
+        const delay = baseDelayMs * Math.pow(2, attempt);
+        onRetry?.(attempt + 1, maxAttempts, lastError);
+        await sleep(delay);
+      }
     }
-    // All retries exhausted — rethrow the last network error so
-    // isNetworkFetchError patterns in the calling code still match and
-    // surface HF_ENDPOINT guidance.
-    throw err;
   }
+
+  // All retries exhausted — throw the last network error so isNetworkFetchError
+  // patterns in the calling code still match and surface HF_ENDPOINT guidance.
+  throw lastError;
 }

gitnexus/src/core/embeddings/http-client.ts

@@ -3,22 +3,13 @@
  *
  * Shared fetch+retry logic for OpenAI-compatible /v1/embeddings endpoints.
  * Imported by both the core embedder (batch) and MCP embedder (query).
- *
- * Network resilience is delegated to `resilientFetch` from
- * `gitnexus-shared` — bounded retries with exponential-backoff jitter,
- * `Retry-After` honored on 429, and an in-process circuit breaker that
- * fails fast on a flapping endpoint. Per-attempt timeout is enforced
- * via `AbortSignal.timeout` on the underlying fetch.
  */
 
-import { CircuitOpenError, ResilientFetchExhaustedError, resilientFetch } from 'gitnexus-shared';
-
 const HTTP_TIMEOUT_MS = 30_000;
 const HTTP_MAX_RETRIES = 2;
 const HTTP_RETRY_BACKOFF_MS = 1_000;
 const HTTP_BATCH_SIZE = 64;
 const DEFAULT_DIMS = 384;
-const HTTP_BREAKER_KEY = 'embeddings-http';
 
 interface HttpConfig {
   baseUrl: string;
@@ -40,11 +31,8 @@ const readConfig = (): HttpConfig | null => {
   const rawDims = process.env.GITNEXUS_EMBEDDING_DIMS;
   let dimensions: number | undefined;
   if (rawDims !== undefined) {
-    if (!/^\d+$/.test(rawDims)) {
-      throw new Error(`GITNEXUS_EMBEDDING_DIMS must be a positive integer, got "${rawDims}"`);
-    }
     const parsed = parseInt(rawDims, 10);
-    if (parsed <= 0) {
+    if (Number.isNaN(parsed) || parsed <= 0) {
       throw new Error(`GITNEXUS_EMBEDDING_DIMS must be a positive integer, got "${rawDims}"`);
     }
     dimensions = parsed;
@@ -94,13 +82,7 @@ interface EmbeddingItem {
  * @param model - Model name for the request body
  * @param apiKey - Bearer token (only used in Authorization header)
  * @param batchIndex - Logical batch number (for error context)
- * @param dimensions - Optional output-vector size. When provided, sent as
- *   the `dimensions` field in the request body. Endpoints that implement
- *   Matryoshka truncation (OpenAI text-embedding-3-*, Cohere embed-v3,
- *   Voyage) return a truncated vector at that size; endpoints that do not
- *   recognise the field may ignore it or return 400. Leave
- *   `GITNEXUS_EMBEDDING_DIMS` unset for strict backends that reject
- *   unknown fields.
+ * @param attempt - Current retry attempt (internal)
  */
 const httpEmbedBatch = async (
   url: string,
@@ -108,60 +90,46 @@ const httpEmbedBatch = async (
   model: string,
   apiKey: string,
   batchIndex = 0,
-  dimensions?: number,
+  attempt = 0,
 ): Promise<EmbeddingItem[]> => {
-  const requestBody: { input: string[]; model: string; dimensions?: number } = {
-    input: batch,
-    model,
-  };
-  if (dimensions !== undefined) {
-    requestBody.dimensions = dimensions;
-  }
-
   let resp: Response;
   try {
-    resp = await resilientFetch(
-      url,
-      {
-        method: 'POST',
-        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
-        headers: {
-          'Content-Type': 'application/json',
-          Authorization: `Bearer ${apiKey}`,
-        },
-        body: JSON.stringify(requestBody),
+    resp = await fetch(url, {
+      method: 'POST',
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${apiKey}`,
       },
-      {
-        breakerKey: HTTP_BREAKER_KEY,
-        retry: { maxAttempts: HTTP_MAX_RETRIES + 1, baseDelayMs: HTTP_RETRY_BACKOFF_MS },
-      },
-    );
+      body: JSON.stringify({ input: batch, model }),
+    });
   } catch (err) {
-    if (err instanceof CircuitOpenError) {
-      throw new Error(
-        `Embedding endpoint circuit open (${safeUrl(url)}, batch ${batchIndex}): retry in ${Math.ceil(err.retryAfterMs / 1000)}s`,
-      );
-    }
-    if (err instanceof DOMException && err.name === 'TimeoutError') {
+    // Timeouts should not be retried — the server is unresponsive.
+    // AbortSignal.timeout() throws DOMException with name 'TimeoutError'.
+    const isTimeout = err instanceof DOMException && err.name === 'TimeoutError';
+    if (isTimeout) {
       throw new Error(
         `Embedding request timed out after ${HTTP_TIMEOUT_MS}ms (${safeUrl(url)}, batch ${batchIndex})`,
       );
     }
-    if (err instanceof ResilientFetchExhaustedError) {
-      throw new Error(
-        `Embedding endpoint returned ${err.response.status} (${safeUrl(url)}, batch ${batchIndex})`,
-      );
+    // DNS, connection errors — retry with backoff
+    if (attempt < HTTP_MAX_RETRIES) {
+      const delay = HTTP_RETRY_BACKOFF_MS * (attempt + 1);
+      await new Promise((r) => setTimeout(r, delay));
+      return httpEmbedBatch(url, batch, model, apiKey, batchIndex, attempt + 1);
     }
     const reason = err instanceof Error ? err.message : String(err);
     throw new Error(`Embedding request failed (${safeUrl(url)}, batch ${batchIndex}): ${reason}`);
   }
 
   if (!resp.ok) {
-    // resilientFetch already retried 5xx/429; any non-OK response here is
-    // a terminal client error (4xx other than 429).
-    throw new Error(
-      `Embedding endpoint returned ${resp.status} (${safeUrl(url)}, batch ${batchIndex})`,
-    );
+    const status = resp.status;
+    if ((status === 429 || status >= 500) && attempt < HTTP_MAX_RETRIES) {
+      const delay = HTTP_RETRY_BACKOFF_MS * (attempt + 1);
+      await new Promise((r) => setTimeout(r, delay));
+      return httpEmbedBatch(url, batch, model, apiKey, batchIndex, attempt + 1);
+    }
+    throw new Error(`Embedding endpoint returned ${status} (${safeUrl(url)}, batch ${batchIndex})`);
   }
 
   const data = (await resp.json()) as { data: EmbeddingItem[] };
@@ -187,14 +155,7 @@ export const httpEmbed = async (texts: string[]): Promise<Float32Array[]> => {
   for (let i = 0; i < texts.length; i += HTTP_BATCH_SIZE) {
     const batch = texts.slice(i, i + HTTP_BATCH_SIZE);
     const batchIndex = Math.floor(i / HTTP_BATCH_SIZE);
-    const items = await httpEmbedBatch(
-      url,
-      batch,
-      config.model,
-      config.apiKey,
-      batchIndex,
-      config.dimensions,
-    );
+    const items = await httpEmbedBatch(url, batch, config.model, config.apiKey, batchIndex);
 
     if (items.length !== batch.length) {
       throw new Error(
@@ -237,14 +198,7 @@ export const httpEmbedQuery = async (text: string): Promise<number[]> => {
   if (!config) throw new Error('HTTP embedding not configured');
 
   const url = `${config.baseUrl}/embeddings`;
-  const items = await httpEmbedBatch(
-    url,
-    [text],
-    config.model,
-    config.apiKey,
-    0,
-    config.dimensions,
-  );
+  const items = await httpEmbedBatch(url, [text], config.model, config.apiKey);
   if (!items.length) {
     throw new Error(`Embedding endpoint returned empty response (${safeUrl(url)})`);
   }

gitnexus/src/core/group/bridge-db.ts

@@ -722,15 +722,13 @@ export async function openBridgeDbReadOnly(groupDir: string): Promise<BridgeHand
       await new Promise((r) => setTimeout(r, delay));
     }
   }
-  // Strip CRLF from user-controlled strings before logging to close
-  // CodeQL js/log-injection. Pino's NDJSON serialization already
-  // JSON-escapes all values, but we sanitize here as a defence-in-depth
-  // measure so CodeQL can see the taint flow is broken.
-  const safeGroupDir = String(groupDir).replace(/[\r\n]/g, ' ');
-  const safeErrMsg =
-    lastErr instanceof Error ? String(lastErr.message).replace(/[\r\n]/g, ' ') : undefined;
+  // Pino's NDJSON serialization is structurally injection-resistant
+  // (CodeQL js/log-injection): groupDir and err.message are JSON-escaped
+  // by the serializer, so no manual CRLF / U+2028 / ANSI sanitization is
+  // needed. Demoted to debug — only fires when the bridge truly gave up
+  // after retries, and operators only need it at debug verbosity.
   bridgeLogger.debug(
-    { groupDir: safeGroupDir, errMsg: safeErrMsg, attempts: LBUG_OPEN_RETRY_ATTEMPTS },
+    { groupDir, err: lastErr, attempts: LBUG_OPEN_RETRY_ATTEMPTS },
     'openBridgeDbReadOnly gave up',
   );
   return null;

gitnexus/src/core/group/config-parser.ts

@@ -4,26 +4,9 @@ import type { GroupConfig, GroupManifestLink, ContractType, ContractRole } from
 const _require = createRequire(import.meta.url);
 const yaml = _require('js-yaml') as typeof import('js-yaml');
 
-const VALID_CONTRACT_TYPES: ContractType[] = [
-  'http',
-  'grpc',
-  'thrift',
-  'topic',
-  'lib',
-  'custom',
-  'include',
-];
+const VALID_CONTRACT_TYPES: ContractType[] = ['http', 'grpc', 'thrift', 'topic', 'lib', 'custom'];
 const VALID_ROLES: ContractRole[] = ['provider', 'consumer'];
 
-// Defaults matter for backward compatibility: any group.yaml that omits a
-// `detect.<type>` key inherits its value from this constant. Adding a new
-// extractor that defaults to `true` silently changes the behavior of every
-// existing group on the next sync. New extractors must default to `false`
-// (opt-in) so operators consciously enable them via group.yaml.
-//
-// `includes`: opt-in. The C/C++ IncludeExtractor (PR #1156) ships disabled by
-// default; enable with `detect.includes: true` for groups containing C/C++
-// repos that need cross-repo header tracking.
 const DEFAULT_DETECT = {
   http: true,
   grpc: true,
@@ -31,7 +14,6 @@ const DEFAULT_DETECT = {
   topics: true,
   shared_libs: true,
   embedding_fallback: true,
-  includes: false,
   workspace_deps: false,
 };
 

gitnexus/src/core/group/extractors/grpc-extractor.ts

@@ -5,7 +5,6 @@ import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import type { ContractExtractor, CypherExecutor } from '../contract-extractor.js';
 import type { ExtractedContract, RepoHandle } from '../types.js';
 import { readSafe } from './fs-utils.js';
-import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 import { logger } from '../../logger.js';
 import {
   GRPC_SCAN_GLOB,
@@ -429,7 +428,7 @@ export class GrpcExtractor implements ContractExtractor {
       let detections: GrpcDetection[] = [];
       try {
         parser.setLanguage(plugin.language);
-        const tree = parseSourceSafe(parser, content);
+        const tree = parser.parse(content);
         detections = plugin.scan(tree);
       } catch {
         continue;

gitnexus/src/core/group/extractors/http-patterns/python.ts

@@ -1,4 +1,3 @@
-import type Parser from 'tree-sitter';
 import Python from 'tree-sitter-python';
 import {
   compilePatterns,
@@ -13,7 +12,6 @@ import type { HttpDetection, HttpLanguagePlugin } from './types.js';
  *   - FastAPI `@app.get("/path")` provider decorators
  *   - `requests.get/post/...("url")` consumer calls
  *   - Generic `requests.request("METHOD", "url")` consumer calls
- *   - `httpx.AsyncClient` instances calling `.get/.post/...("url")`
  */
 
 const FASTAPI_VERBS: Record<string, string> = {
@@ -79,161 +77,11 @@ const REQUESTS_GENERIC_PATTERNS = compilePatterns({
   ],
 } satisfies LanguagePatterns<Record<string, never>>);
 
-// ─── Consumer: httpx.AsyncClient assignments ────────────────────────
-// NOTE: This targeted detector only tracks explicit `httpx.AsyncClient(...)`
-// construction. Direct imports (`from httpx import AsyncClient`) and module
-// aliases (`import httpx as hx`) and annotated assignments (`client: httpx.AsyncClient = ...`)
-// are intentionally left for a follow-up. Module-scope clients are only matched
-// at module scope; calls inside functions require a function/class-local tracked
-// client to avoid false positives from same-name local variables.
-const HTTPX_ASYNC_CLIENT_ASSIGN_PATTERNS = compilePatterns({
-  name: 'python-httpx-async-client-assign',
-  language: Python,
-  patterns: [
-    {
-      meta: {},
-      query: `
-        (assignment
-          left: (_) @client
-          right: (call
-            function: (attribute
-              object: (identifier) @module (#eq? @module "httpx")
-              attribute: (identifier) @client_class (#eq? @client_class "AsyncClient"))))
-      `,
-    },
-  ],
-} satisfies LanguagePatterns<Record<string, never>>);
-
-// ─── Consumer: async with httpx.AsyncClient() as client ──────────────
-const HTTPX_ASYNC_CLIENT_WITH_ALIAS_PATTERNS = compilePatterns({
-  name: 'python-httpx-async-client-with-alias',
-  language: Python,
-  patterns: [
-    {
-      meta: {},
-      query: `
-        (as_pattern
-          (call
-            function: (attribute
-              object: (identifier) @module (#eq? @module "httpx")
-              attribute: (identifier) @client_class (#eq? @client_class "AsyncClient")))
-          (as_pattern_target (identifier) @client))
-      `,
-    },
-  ],
-} satisfies LanguagePatterns<Record<string, never>>);
-
-function getScopeKey(node: Parser.SyntaxNode | null, preferClass = false): string {
-  if (preferClass) {
-    let current: Parser.SyntaxNode | null = node;
-    while (current) {
-      if (current.type === 'class_definition') {
-        return `class:${current.startIndex}:${current.endIndex}`;
-      }
-      current = current.parent;
-    }
-  }
-
-  let current: Parser.SyntaxNode | null = node;
-  while (current) {
-    if (current.type === 'function_definition') {
-      return `function:${current.startIndex}:${current.endIndex}`;
-    }
-    current = current.parent;
-  }
-
-  return 'module';
-}
-
-function trackedClientScopeKey(clientNode: Parser.SyntaxNode): string {
-  return getScopeKey(clientNode.parent, clientNode.text.includes('.'));
-}
-
-function callScopeKeys(clientNode: Parser.SyntaxNode): string[] {
-  const keys = new Set<string>();
-  const preferClass = clientNode.text.includes('.');
-  const nearestScope = getScopeKey(clientNode.parent, preferClass);
-
-  keys.add(nearestScope);
-
-  return [...keys];
-}
-
-function collectHttpxAsyncClients(tree: Parser.Tree): Map<string, Set<string>> {
-  const clients = new Map<string, Set<string>>();
-
-  const addClient = (clientNode: Parser.SyntaxNode | undefined) => {
-    if (!clientNode) return;
-    const scopeKey = trackedClientScopeKey(clientNode);
-    const clientText = clientNode.text;
-    const scopes = clients.get(clientText) ?? new Set<string>();
-    scopes.add(scopeKey);
-    clients.set(clientText, scopes);
-  };
-
-  for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_ASSIGN_PATTERNS, tree)) {
-    addClient(match.captures.client);
-  }
-
-  for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_WITH_ALIAS_PATTERNS, tree)) {
-    addClient(match.captures.client);
-  }
-
-  return clients;
-}
-
-function hasTrackedHttpxAsyncClient(
-  clients: Map<string, Set<string>>,
-  clientNode: Parser.SyntaxNode,
-): boolean {
-  const scopes = clients.get(clientNode.text);
-  if (!scopes) return false;
-
-  return callScopeKeys(clientNode).some((scopeKey) => scopes.has(scopeKey));
-}
-
-// ─── Consumer: httpx AsyncClient .get/.post/...("url") ──────────────
-const HTTPX_ASYNC_CLIENT_VERB_PATTERNS = compilePatterns({
-  name: 'python-httpx-async-client-verb',
-  language: Python,
-  patterns: [
-    {
-      meta: {},
-      query: `
-        (call
-          function: (attribute
-            object: (_) @client
-            attribute: (identifier) @method (#match? @method "^(get|post|put|delete|patch)$"))
-          arguments: (argument_list . (string) @path))
-      `,
-    },
-  ],
-} satisfies LanguagePatterns<Record<string, never>>);
-
-// ─── Consumer: httpx AsyncClient .request("METHOD", "url") ─────────
-const HTTPX_ASYNC_CLIENT_GENERIC_PATTERNS = compilePatterns({
-  name: 'python-httpx-async-client-generic',
-  language: Python,
-  patterns: [
-    {
-      meta: {},
-      query: `
-        (call
-          function: (attribute
-            object: (_) @client
-            attribute: (identifier) @method (#eq? @method "request"))
-          arguments: (argument_list . (string) @http_method (string) @path))
-      `,
-    },
-  ],
-} satisfies LanguagePatterns<Record<string, never>>);
-
 export const PYTHON_HTTP_PLUGIN: HttpLanguagePlugin = {
   name: 'python-http',
   language: Python,
   scan(tree) {
     const out: HttpDetection[] = [];
-    const httpxAsyncClients = collectHttpxAsyncClients(tree);
 
     // Providers: FastAPI
     for (const match of runCompiledPatterns(FASTAPI_PATTERNS, tree)) {
@@ -289,45 +137,6 @@ export const PYTHON_HTTP_PLUGIN: HttpLanguagePlugin = {
       });
     }
 
-    // Consumers: httpx.AsyncClient.<verb>("url")
-    for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_VERB_PATTERNS, tree)) {
-      const clientNode = match.captures.client;
-      const methodNode = match.captures.method;
-      const pathNode = match.captures.path;
-      if (!clientNode || !methodNode || !pathNode) continue;
-      if (!hasTrackedHttpxAsyncClient(httpxAsyncClients, clientNode)) continue;
-      const path = unquoteLiteral(pathNode.text);
-      if (path === null) continue;
-      out.push({
-        role: 'consumer',
-        framework: 'python-httpx',
-        method: methodNode.text.toUpperCase(),
-        path,
-        name: null,
-        confidence: 0.7,
-      });
-    }
-
-    // Consumers: httpx.AsyncClient.request("METHOD", "url")
-    for (const match of runCompiledPatterns(HTTPX_ASYNC_CLIENT_GENERIC_PATTERNS, tree)) {
-      const clientNode = match.captures.client;
-      const methodNode = match.captures.http_method;
-      const pathNode = match.captures.path;
-      if (!clientNode || !methodNode || !pathNode) continue;
-      if (!hasTrackedHttpxAsyncClient(httpxAsyncClients, clientNode)) continue;
-      const methodRaw = unquoteLiteral(methodNode.text);
-      const path = unquoteLiteral(pathNode.text);
-      if (methodRaw === null || path === null) continue;
-      out.push({
-        role: 'consumer',
-        framework: 'python-httpx',
-        method: methodRaw.toUpperCase(),
-        path,
-        name: null,
-        confidence: 0.7,
-      });
-    }
-
     return out;
   },
 };

gitnexus/src/core/group/extractors/http-route-extractor.ts

@@ -5,7 +5,6 @@ import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import type { ContractExtractor, CypherExecutor } from '../contract-extractor.js';
 import type { ExtractedContract, RepoHandle } from '../types.js';
 import { readSafe } from './fs-utils.js';
-import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 import { getPluginForFile, HTTP_SCAN_GLOB, type HttpDetection } from './http-patterns/index.js';
 
 /**
@@ -173,7 +172,7 @@ export class HttpRouteExtractor implements ContractExtractor {
       }
       try {
         parser.setLanguage(plugin.language);
-        const tree = parseSourceSafe(parser, content);
+        const tree = parser.parse(content);
         const detections = plugin.scan(tree);
         cachedDetections.set(rel, detections);
         return detections;

gitnexus/src/core/group/extractors/include-extractor.ts

@@ -1,611 +0,0 @@
-import * as path from 'node:path';
-import * as fs from 'node:fs/promises';
-import { glob } from 'glob';
-import Parser from 'tree-sitter';
-import C from 'tree-sitter-c';
-import Cpp from 'tree-sitter-cpp';
-import type { ContractExtractor, CypherExecutor } from '../contract-extractor.js';
-import type { ExtractedContract, RepoHandle } from '../types.js';
-import { readSafe } from './fs-utils.js';
-import { buildSuffixIndex, type SuffixIndex } from '../../ingestion/import-resolvers/utils.js';
-import { createIgnoreFilter } from '../../../config/ignore-service.js';
-import { getMaxFileSizeBytes } from '../../ingestion/utils/max-file-size.js';
-import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
-import { logger } from '../../logger.js';
-
-/**
- * Cross-repo C/C++ `#include` dependency extractor.
- *
- * **Provider side:** registers every `.h/.hpp/.hxx/.hh` file in the repo
- * as a provider contract with `include::<relative-path>`.
- *
- * **Consumer side:** parses all C/C++ source/header files for `#include "…"`
- * directives, attempts suffix-based resolution against the repo's own file
- * list (reusing the same algorithm as the single-repo ingestion pipeline),
- * and emits unresolved include paths as consumer contracts.
- *
- * Matching: a consumer's `include::map/base/dice_map_view.h` in repo A
- * matches a provider's `include::map/base/dice_map_view.h` in repo B via
- * exact contract-id equality in `runExactMatch`.
- */
-
-// ---------- constants ----------
-
-const HEADER_EXTENSIONS = new Set(['.h', '.hpp', '.hxx', '.hh']);
-
-// Source = headers (provider-eligible) ∪ implementation files (.c/.cpp/.cc/.cxx).
-// Spread keeps the subset relationship explicit so a future contributor adding
-// a new header extension to HEADER_EXTENSIONS does not have to remember to
-// also add it here.
-const SOURCE_EXTENSIONS = new Set<string>([...HEADER_EXTENSIONS, '.c', '.cpp', '.cc', '.cxx']);
-
-const INCLUDE_QUERY_SRC = '(preproc_include path: (_) @import.source) @import';
-
-/**
- * Well-known C/C++ standard library headers that can appear in `#include "…"`
- * form (some projects use quotes for system headers).
- */
-const SYSTEM_HEADERS = new Set([
-  // C standard
-  'assert.h',
-  'complex.h',
-  'ctype.h',
-  'errno.h',
-  'fenv.h',
-  'float.h',
-  'inttypes.h',
-  'iso646.h',
-  'limits.h',
-  'locale.h',
-  'math.h',
-  'setjmp.h',
-  'signal.h',
-  'stdalign.h',
-  'stdarg.h',
-  'stdatomic.h',
-  'stdbool.h',
-  'stddef.h',
-  'stdint.h',
-  'stdio.h',
-  'stdlib.h',
-  'stdnoreturn.h',
-  'string.h',
-  'tgmath.h',
-  'threads.h',
-  'time.h',
-  'uchar.h',
-  'wchar.h',
-  'wctype.h',
-  // C++ standard (extensionless)
-  'algorithm',
-  'any',
-  'array',
-  'atomic',
-  'barrier',
-  'bit',
-  'bitset',
-  'cassert',
-  'cctype',
-  'cerrno',
-  'cfenv',
-  'cfloat',
-  'charconv',
-  'chrono',
-  'cinttypes',
-  'climits',
-  'clocale',
-  'cmath',
-  'codecvt',
-  'compare',
-  'complex',
-  'concepts',
-  'condition_variable',
-  'coroutine',
-  'csetjmp',
-  'csignal',
-  'cstdarg',
-  'cstddef',
-  'cstdint',
-  'cstdio',
-  'cstdlib',
-  'cstring',
-  'ctime',
-  'cuchar',
-  'cwchar',
-  'cwctype',
-  'deque',
-  'exception',
-  'execution',
-  'expected',
-  'filesystem',
-  'format',
-  'forward_list',
-  'fstream',
-  'functional',
-  'future',
-  'generator',
-  'initializer_list',
-  'iomanip',
-  'ios',
-  'iosfwd',
-  'iostream',
-  'istream',
-  'iterator',
-  'latch',
-  'limits',
-  'list',
-  'locale',
-  'map',
-  'mdspan',
-  'memory',
-  'memory_resource',
-  'mutex',
-  'new',
-  'numbers',
-  'numeric',
-  'optional',
-  'ostream',
-  'print',
-  'queue',
-  'random',
-  'ranges',
-  'ratio',
-  'regex',
-  'scoped_allocator',
-  'semaphore',
-  'set',
-  'shared_mutex',
-  'source_location',
-  'span',
-  'spanstream',
-  'sstream',
-  'stack',
-  'stacktrace',
-  'stdexcept',
-  'stdfloat',
-  'stop_token',
-  'streambuf',
-  'string',
-  'string_view',
-  'strstream',
-  'syncstream',
-  'system_error',
-  'thread',
-  'tuple',
-  'type_traits',
-  'typeindex',
-  'typeinfo',
-  'unordered_map',
-  'unordered_set',
-  'utility',
-  'valarray',
-  'variant',
-  'vector',
-  'version',
-]);
-
-/** Path prefixes that indicate system/kernel headers. */
-const SYSTEM_PATH_PREFIXES = [
-  'sys/',
-  'net/',
-  'netinet/',
-  'arpa/',
-  'linux/',
-  'asm/',
-  'bits/',
-  'gnu/',
-  'mach/',
-  'machine/',
-  'xlocale/',
-];
-
-/** Regex fallback for files that exceed tree-sitter's 32 KB parse limit. */
-const INCLUDE_REGEX = /^[ \t]*#\s*include\s*"([^"]+)"/gm;
-
-// ---------- helpers ----------
-
-/**
- * Normalize an include path to a canonical lowercase forward-slash form.
- *
- * IMPORTANT — case-folding caveat (PR #1156 review finding #3):
- *   Header paths are lowercased so consumer `#include "Foo/Bar.h"` and
- *   provider file `Foo/Bar.h` normalize to the same contract-id. This is
- *   the right trade-off on case-insensitive filesystems (macOS, Windows)
- *   but on case-sensitive Linux filesystems two distinct headers `Foo.h`
- *   and `foo.h` in the same repo will collide onto the same provider
- *   contract-id; only one survives `dedupe()`. The gain (reliable
- *   cross-platform matching) outweighs the cost (extremely rare header
- *   casing collisions inside a single repo).
- */
-function normalizeIncludePath(raw: string): string {
-  return raw.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+/g, '/').toLowerCase();
-}
-
-/**
- * Strip C/C++ block comments from a source blob. Used only by the
- * regex-fallback path to avoid emitting consumer contracts for
- * commented-out #include directives. Line comments (`// …`) cannot hide
- * #include directives because the regex anchors on start-of-line.
- * See PR #1156 review finding #5.
- */
-function stripBlockComments(src: string): string {
-  return src.replace(/\/\*[\s\S]*?\*\//g, '');
-}
-
-function isAngleBracketInclude(rawNodeText: string): boolean {
-  const trimmed = rawNodeText.trim();
-  return trimmed.startsWith('<') && trimmed.endsWith('>');
-}
-
-function isSystemHeader(cleanedPath: string): boolean {
-  // Check well-known standard headers
-  if (SYSTEM_HEADERS.has(cleanedPath)) return true;
-  // Check system path prefixes
-  const lower = cleanedPath.toLowerCase();
-  return SYSTEM_PATH_PREFIXES.some((prefix) => lower.startsWith(prefix));
-}
-
-function isHeaderFile(filePath: string): boolean {
-  return HEADER_EXTENSIONS.has(path.extname(filePath).toLowerCase());
-}
-
-function getLanguageForFile(filePath: string): unknown | null {
-  const ext = path.extname(filePath).toLowerCase();
-  switch (ext) {
-    case '.c':
-    case '.h':
-      return C;
-    case '.cpp':
-    case '.cc':
-    case '.cxx':
-    case '.hpp':
-    case '.hxx':
-    case '.hh':
-      return Cpp;
-    default:
-      return null;
-  }
-}
-
-/**
- * Check whether an include path resolves to a file inside the local repo.
- *
- * Uses *exact full-path* matching on the suffix index — we never accept a
- * truncated suffix match. For `#include "foo/bar.h"` this checks:
- *   (a) a file whose path ends with the full `foo/bar.h`
- *   (b) if the include omitted the extension, a file whose path ends with
- *       the include + one of the C/C++ header extensions
- *
- * Returns `true` when a local file matches — caller should suppress the
- * cross-repo consumer contract.
- *
- * See PR #1156 review finding #4 (suffixResolve ambiguity).
- */
-function isLocalInclude(cleaned: string, suffixIndex: SuffixIndex): boolean {
-  const candidates = [cleaned];
-  if (!/\.[a-zA-Z0-9]+$/.test(cleaned)) {
-    for (const ext of ['.h', '.hpp', '.hxx', '.hh']) candidates.push(cleaned + ext);
-  }
-  for (const c of candidates) {
-    if (suffixIndex.get(c) || suffixIndex.getInsensitive(c)) return true;
-  }
-  return false;
-}
-
-// ---------- main class ----------
-
-export class IncludeExtractor implements ContractExtractor {
-  type = 'include' as const;
-
-  /**
-   * Always returns `true`. NOT called by `sync.ts`, which gates extraction via
-   * `config.detect.includes` instead (see `sync.ts:174`). Kept solely to satisfy
-   * the `ContractExtractor` interface so the type stays uniform across extractors.
-   */
-  async canExtract(_repo: RepoHandle): Promise<boolean> {
-    return true;
-  }
-
-  async extract(
-    dbExecutor: CypherExecutor | null,
-    repoPath: string,
-    _repo: RepoHandle,
-  ): Promise<ExtractedContract[]> {
-    // 1. Build the local file list using the same discovery as ingestion
-    //    (createIgnoreFilter + getMaxFileSizeBytes). This guarantees the
-    //    universe of provider/consumer paths matches the universe of File
-    //    nodes in the LadybugDB graph — so no cross-link points at a UID
-    //    that group impact cannot fan out to.
-    //    (PR #1156 Codex follow-up: discovery aligned with ingestion.)
-    const allFiles = await this.discoverIndexableFiles(repoPath);
-    const normalizedFiles = allFiles.map((f) => f.replace(/\\/g, '/'));
-    const suffixIndex = buildSuffixIndex(normalizedFiles, allFiles);
-
-    // 2. Provider: register all header files
-    const providers = await this.extractProviders(dbExecutor, repoPath, allFiles);
-
-    // 3. Consumer: filter the shared discovery list for source extensions
-    //    and parse #include directives in those files.
-    const sourceFiles = allFiles.filter((f) =>
-      SOURCE_EXTENSIONS.has(path.extname(f).toLowerCase()),
-    );
-    const consumers = await this.extractConsumers(repoPath, sourceFiles, suffixIndex);
-
-    return this.dedupe([...providers, ...consumers]);
-  }
-
-  /**
-   * Discover repo-relative file paths using exactly the same rules the
-   * ingestion pipeline uses (`walkRepositoryPaths` in
-   * `gitnexus/src/core/ingestion/filesystem-walker.ts`):
-   *   - `createIgnoreFilter` honors `.gitignore`, `.gitnexusignore`, the
-   *     hardcoded ignore list, and `.gitnexusignore` last-match-wins
-   *     negation.
-   *   - `getMaxFileSizeBytes()` drops files larger than the cap so we
-   *     never emit `File:<rel>` UIDs for files ingestion would skip.
-   *
-   * Uses sequential stat — there is no `READ_CONCURRENCY` batching here
-   * because group sync runs at startup-time, not the ingestion hot path,
-   * and parallelism gains are not worth the import-graph weight.
-   *
-   * MAINTENANCE: if `walkRepositoryPaths` changes its glob options, ignore
-   * filter shape, or size-cap logic, mirror those changes here. The two
-   * implementations exist because the consumers need different return
-   * shapes (string[] vs ScannedFile[]) and different concurrency, but
-   * they MUST agree on which files are reachable — that is what makes
-   * `File:<rel>` UIDs in cross-links correspond to graph File nodes.
-   */
-  private async discoverIndexableFiles(repoPath: string): Promise<string[]> {
-    const ignoreFilter = await createIgnoreFilter(repoPath);
-    const maxFileSizeBytes = getMaxFileSizeBytes();
-
-    const candidates = await glob('**/*', {
-      cwd: repoPath,
-      nodir: true,
-      dot: false,
-      ignore: ignoreFilter,
-    });
-
-    const survivors: string[] = [];
-    for (const rel of candidates) {
-      try {
-        const stat = await fs.stat(path.join(repoPath, rel));
-        if (stat.size > maxFileSizeBytes) continue;
-        survivors.push(rel);
-      } catch (err) {
-        // ENOENT is the documented benign race (glob enumerated a file
-        // that was deleted before we stat'd it — same race
-        // walkRepositoryPaths absorbs via Promise.allSettled). Anything
-        // else (EACCES, EMFILE, EIO) deserves a warning so an operator
-        // can spot a permission/resource problem instead of silently
-        // shipping fewer contracts than expected.
-        const code = (err as NodeJS.ErrnoException | undefined)?.code;
-        if (code !== 'ENOENT') {
-          logger.warn(
-            { err: (err as Error).message, file: rel, repoPath },
-            '⚠️ IncludeExtractor: stat failed during discovery; skipping file',
-          );
-        }
-      }
-    }
-    return survivors;
-  }
-
-  // ---------- provider extraction ----------
-
-  private async extractProviders(
-    dbExecutor: CypherExecutor | null,
-    repoPath: string,
-    allFiles: string[],
-  ): Promise<ExtractedContract[]> {
-    // Strategy A: graph-assisted
-    if (dbExecutor) {
-      const graphProviders = await this.extractProvidersGraph(dbExecutor, repoPath);
-      if (graphProviders.length > 0) return graphProviders;
-    }
-    // Strategy B: filesystem fallback
-    return this.extractProvidersFallback(repoPath, allFiles);
-  }
-
-  private async extractProvidersGraph(
-    db: CypherExecutor,
-    repoPath: string,
-  ): Promise<ExtractedContract[]> {
-    try {
-      const rows = await db(
-        `MATCH (f:File)
-         WHERE f.filePath =~ '.*\\\\.(h|hpp|hxx|hh)$'
-         RETURN f.filePath AS filePath, f.id AS fileId`,
-      );
-      // gitnexus analyze stores absolute paths in the File.filePath column.
-      // Provider contract IDs MUST be repo-relative — otherwise the consumer
-      // emits `include::map/base/view.h` and the provider emits
-      // `include::/abs/path/to/repo/map/base/view.h`, which never match
-      // through runExactMatch and the cross-link silently disappears.
-      // (PR #1156 follow-up review: graph provider absolute-path bug.)
-      const normalizedRepoPath = path.resolve(repoPath);
-      const out: ExtractedContract[] = [];
-      for (const r of rows) {
-        if (typeof r.filePath !== 'string' || !r.filePath) continue;
-        const absolute = r.filePath as string;
-        const rel = path.relative(normalizedRepoPath, absolute);
-        // Skip rows that resolve outside the repo (e.g., system headers
-        // somehow indexed, or stale absolute paths from a different machine).
-        // path.relative returns a `..`-prefixed path or an absolute path
-        // when the target is outside the base — both are wrong for our IDs.
-        if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) continue;
-        const normalizedRel = rel.replace(/\\/g, '/');
-        out.push({
-          contractId: `include::${normalizeIncludePath(normalizedRel)}`,
-          type: 'include' as const,
-          role: 'provider' as const,
-          symbolUid: String(r.fileId ?? ''),
-          symbolRef: { filePath: normalizedRel, name: path.basename(normalizedRel) },
-          symbolName: path.basename(normalizedRel),
-          confidence: 1.0,
-          meta: { source: 'graph' },
-        });
-      }
-      return out;
-    } catch {
-      return [];
-    }
-  }
-
-  private extractProvidersFallback(_repoPath: string, allFiles: string[]): ExtractedContract[] {
-    return allFiles
-      .filter((f) => isHeaderFile(f))
-      .map((f) => {
-        const filePath = f.replace(/\\/g, '/');
-        return {
-          contractId: `include::${normalizeIncludePath(filePath)}`,
-          type: 'include' as const,
-          role: 'provider' as const,
-          symbolUid: `File:${filePath}`,
-          symbolRef: { filePath, name: path.basename(filePath) },
-          symbolName: path.basename(filePath),
-          confidence: 0.95,
-          meta: { source: 'filesystem' },
-        };
-      });
-  }
-
-  // ---------- consumer extraction ----------
-
-  private async extractConsumers(
-    repoPath: string,
-    sourceFiles: string[],
-    suffixIndex: SuffixIndex,
-  ): Promise<ExtractedContract[]> {
-    const parser = new Parser();
-    const out: ExtractedContract[] = [];
-    // Compile the include query once per grammar to avoid re-compilation per file
-    const queryCache = new Map<unknown, Parser.Query>();
-
-    for (const rel of sourceFiles) {
-      const lang = getLanguageForFile(rel);
-      if (!lang) continue;
-
-      const content = readSafe(repoPath, rel);
-      if (!content) continue;
-
-      let query = queryCache.get(lang);
-      if (!query) {
-        try {
-          query = new Parser.Query(lang, INCLUDE_QUERY_SRC);
-          queryCache.set(lang, query);
-        } catch {
-          continue;
-        }
-      }
-
-      // Collect raw include paths: tree-sitter first, regex fallback for large files.
-      // `extractionSource` is stamped on each emitted consumer contract so
-      // regex-fallback contracts stay auditable post-hoc (PR #1156 review finding #6).
-      let rawIncludes: string[];
-      let extractionSource: 'tree_sitter' | 'regex_fallback';
-      try {
-        parser.setLanguage(lang);
-        const tree = parseSourceSafe(parser, content);
-        let matches: Parser.QueryMatch[];
-        try {
-          matches = query.matches(tree.rootNode);
-        } catch {
-          matches = [];
-        }
-        rawIncludes = [];
-        extractionSource = 'tree_sitter';
-        for (const match of matches) {
-          const sourceNode = match.captures.find((c) => c.name === 'import.source');
-          if (!sourceNode) continue;
-          const rawText = sourceNode.node.text;
-          if (isAngleBracketInclude(rawText)) continue;
-          const cleaned = rawText.replace(/['"<>]/g, '');
-          if (cleaned && cleaned.length <= 2048) rawIncludes.push(cleaned);
-        }
-      } catch {
-        // tree-sitter failed (e.g. file > 32 KB) — fall back to regex.
-        // Strip block comments first so we don't emit a consumer contract
-        // for a commented-out #include (PR #1156 review finding #5).
-        rawIncludes = [];
-        extractionSource = 'regex_fallback';
-        const scanTarget = stripBlockComments(content);
-        INCLUDE_REGEX.lastIndex = 0;
-        let m: RegExpExecArray | null;
-        while ((m = INCLUDE_REGEX.exec(scanTarget)) !== null) {
-          if (m[1] && m[1].length <= 2048) rawIncludes.push(m[1]);
-        }
-      }
-
-      for (const cleaned of rawIncludes) {
-        // Filter: skip known system headers and system path prefixes
-        if (isSystemHeader(cleaned)) continue;
-
-        // Skip relative-up includes: `#include "../include/foo.h"` is
-        // almost always an intra-repo reference. The suffix index is built
-        // from repo-relative paths, so isLocalInclude can never match
-        // `../foo.h`, and emitting it as a consumer contract just pollutes
-        // the registry with an entry no provider can ever satisfy.
-        // (PR #1156 follow-up review: `../` relative includes produce
-        // spurious consumer contracts.)
-        if (cleaned.startsWith('../') || cleaned.startsWith('..\\')) continue;
-
-        // Skip macro-style includes: `#include PLATFORM_HEADER` parses as an
-        // identifier under tree-sitter's `(_) @import.source` wildcard. The
-        // identifier text passes the strip/clean step unchanged, so without
-        // this guard we would emit `include::platform_header` as a consumer
-        // contract — and no provider in any repo will ever expose a contract
-        // for a macro identifier (no file is named `PLATFORM_HEADER`). The
-        // contract would sit permanently orphaned in the registry. Real
-        // header references always contain a path separator (`/`, `\`) or an
-        // extension dot (`foo.h`), so an absent both is a reliable signal we
-        // are looking at a macro identifier. (PR #1156 follow-up review:
-        // macro includes emit orphaned consumer contracts.)
-        if (!/[./\\]/.test(cleaned)) continue;
-
-        // Local resolution (PR #1156 review finding #4): only accept an
-        // exact-suffix match on the *full* include path. The generic
-        // suffixResolve() iterates all truncated suffixes, which would
-        // silently suppress a cross-repo `#include "map/base/view.h"`
-        // when the local repo has any `internal/view.h` — a realistic
-        // false-negative in large C++ codebases. Here we only resolve
-        // locally if a file path ends with the complete include string
-        // (optionally re-appending one of the C/C++ header extensions
-        // when the include already omits it).
-        if (isLocalInclude(cleaned, suffixIndex)) continue;
-
-        // Unresolved: emit as consumer contract
-        const normalizedRel = rel.replace(/\\/g, '/');
-        out.push({
-          contractId: `include::${normalizeIncludePath(cleaned)}`,
-          type: 'include' as const,
-          role: 'consumer' as const,
-          symbolUid: `File:${normalizedRel}`,
-          symbolRef: { filePath: normalizedRel, name: cleaned },
-          symbolName: cleaned,
-          confidence: 0.85,
-          meta: {
-            source: extractionSource,
-            includePath: cleaned,
-          },
-        });
-      }
-    }
-
-    return out;
-  }
-
-  // ---------- deduplication ----------
-
-  private dedupe(items: ExtractedContract[]): ExtractedContract[] {
-    const seen = new Set<string>();
-    const out: ExtractedContract[] = [];
-    for (const c of items) {
-      const k = `${c.contractId}|${c.role}|${c.symbolRef.filePath}`;
-      if (seen.has(k)) continue;
-      seen.add(k);
-      out.push(c);
-    }
-    return out;
-  }
-}

gitnexus/src/core/group/extractors/manifest-extractor.ts

@@ -274,14 +274,6 @@ export class ManifestExtractor {
            LIMIT 1`,
           { contract: link.contract },
         );
-      } else if (link.type === 'include') {
-        rows = await executor(
-          `MATCH (f:File) WHERE f.filePath = $contract
-           RETURN f.id AS uid, f.name AS name, f.filePath AS filePath
-           ORDER BY f.filePath ASC
-           LIMIT 1`,
-          { contract: link.contract },
-        );
       } else if (link.type === 'custom') {
         // Workspace extractors produce qualified contracts like "mathlex::Expression".
         // Graph nodes store the unqualified symbol name ("Expression"), so strip
@@ -366,8 +358,6 @@ export class ManifestExtractor {
         return `lib::${contract}`;
       case 'custom':
         return `custom::${contract}`;
-      case 'include':
-        return `include::${contract}`;
       default: {
         const _exhaustive: never = type;
         throw new Error(`Unhandled ContractType: ${String(_exhaustive)}`);

gitnexus/src/core/group/extractors/thrift-extractor.ts

@@ -3,7 +3,6 @@ import Parser from 'tree-sitter';
 import type { ContractExtractor, CypherExecutor } from '../contract-extractor.js';
 import type { ExtractedContract, RepoHandle } from '../types.js';
 import { readSafe } from './fs-utils.js';
-import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 import {
   getPluginForFile,
   THRIFT_SCAN_GLOB,
@@ -218,10 +217,6 @@ export async function buildThriftContext(repoPath: string): Promise<ThriftContex
     cwd: repoPath,
     absolute: false,
     nodir: true,
-    // TODO(#1156-followup): replace this hand-rolled list with createIgnoreFilter
-    // (the canonical ingestion ignore filter, like include-extractor.ts now uses).
-    // New entries to DEFAULT_IGNORE_LIST in src/config/ignore-service.ts (e.g.
-    // third_party, 3rdparty added in commit a9936a9b) silently do not apply here.
     ignore: ['**/node_modules/**', '**/.git/**', '**/vendor/**', '**/dist/**', '**/build/**'],
   });
   const namespacesByThrift = new Map<string, string>();
@@ -295,10 +290,6 @@ export class ThriftExtractor implements ContractExtractor {
       cwd: repoPath,
       absolute: false,
       nodir: true,
-      // TODO(#1156-followup): replace this hand-rolled list with createIgnoreFilter
-      // (the canonical ingestion ignore filter, like include-extractor.ts now uses).
-      // New entries to DEFAULT_IGNORE_LIST in src/config/ignore-service.ts (e.g.
-      // third_party, 3rdparty added in commit a9936a9b) silently do not apply here.
       ignore: ['**/node_modules/**', '**/.git/**', '**/vendor/**', '**/dist/**', '**/build/**'],
     });
 
@@ -312,7 +303,7 @@ export class ThriftExtractor implements ContractExtractor {
       let detections: ThriftDetection[] = [];
       try {
         parser.setLanguage(plugin.language);
-        const tree = parseSourceSafe(parser, content);
+        const tree = parser.parse(content);
         detections = plugin.scan(tree);
       } catch {
         continue;

gitnexus/src/core/group/extractors/tree-sitter-scanner.ts

@@ -1,5 +1,4 @@
 import Parser from 'tree-sitter';
-import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 
 /**
  * Shared, language-agnostic tree-sitter scanning utilities used by group
@@ -156,7 +155,7 @@ export function scanFile<TMeta>(
   let tree: Parser.Tree;
   try {
     parser.setLanguage(plugin.language);
-    tree = parseSourceSafe(parser, content);
+    tree = parser.parse(content);
   } catch {
     return [];
   }

gitnexus/src/core/group/matching.ts

@@ -107,8 +107,6 @@ export function normalizeContractId(id: string): string {
       return `topic::${rest.trim().toLowerCase()}`;
     case 'lib':
       return `lib::${rest.toLowerCase()}`;
-    case 'include':
-      return `include::${rest.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+/g, '/').toLowerCase()}`;
     default:
       return id;
   }

gitnexus/src/core/group/storage.ts

@@ -4,7 +4,6 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { randomBytes } from 'node:crypto';
 import type { ContractRegistry } from './types.js';
-import { retryRename } from './bridge-db.js';
 
 /**
  * Build an unpredictable suffix for atomic-write tmp files. Replaces the
@@ -60,13 +59,7 @@ export async function writeContractRegistry(
   } finally {
     await handle.close();
   }
-  // retryRename absorbs the documented Windows EPERM/EBUSY/EACCES race that
-  // fires when AV scanners or another concurrent rename briefly hold the
-  // destination handle between rename calls. Same helper bridge-db.ts uses
-  // (lines 304, 583, 587, 595, 605, 677) for the bridge.lbug atomic swap —
-  // single source of truth for the Windows-rename pattern across the group
-  // package.
-  await retryRename(tmpPath, targetPath);
+  await fsp.rename(tmpPath, targetPath);
 }
 
 export async function readContractRegistry(groupDir: string): Promise<ContractRegistry | null> {

gitnexus/src/core/group/sync.ts

@@ -8,14 +8,12 @@ import { HttpRouteExtractor } from './extractors/http-route-extractor.js';
 import { GrpcExtractor } from './extractors/grpc-extractor.js';
 import { ThriftExtractor } from './extractors/thrift-extractor.js';
 import { TopicExtractor } from './extractors/topic-extractor.js';
-import { IncludeExtractor } from './extractors/include-extractor.js';
 import { ManifestExtractor } from './extractors/manifest-extractor.js';
 import { discoverWorkspaceLinks } from './extractors/workspace-extractor.js';
 import { buildProviderIndex, runExactMatch, runWildcardMatch } from './matching.js';
 import { detectServiceBoundaries, assignService } from './service-boundary-detector.js';
 import type { CypherExecutor } from './contract-extractor.js';
 import { writeContractRegistry } from './storage.js';
-import { writeBridge } from './bridge-db.js';
 import type { ContractRegistry } from './types.js';
 
 import { logger } from '../logger.js';
@@ -102,7 +100,6 @@ export async function syncGroup(config: GroupConfig, opts?: SyncOptions): Promis
     const grpcEx = new GrpcExtractor();
     const thriftEx = new ThriftExtractor();
     const topicEx = new TopicExtractor();
-    const includeEx = new IncludeExtractor();
     dbExecutors = new Map<string, CypherExecutor>();
     const openPoolIds: string[] = [];
 
@@ -171,17 +168,6 @@ export async function syncGroup(config: GroupConfig, opts?: SyncOptions): Promis
             }
           }
 
-          if (config.detect.includes) {
-            const extracted = await includeEx.extract(executor, handle.repoPath, handle);
-            for (const c of extracted) {
-              autoContracts.push({
-                ...c,
-                repo: groupPath,
-                service: assignService(c.symbolRef.filePath, boundaries),
-              });
-            }
-          }
-
           const metaPath = path.join(handle.storagePath, 'meta.json');
           try {
             const raw = await fs.readFile(metaPath, 'utf-8');
@@ -284,28 +270,6 @@ export async function syncGroup(config: GroupConfig, opts?: SyncOptions): Promis
 
   if (opts?.groupDir && !opts.skipWrite) {
     await writeContractRegistry(opts.groupDir, registry);
-    // writeBridge failure (disk full, schema error, permission denied) must
-    // not mask the registry — contracts.json was just written successfully
-    // and is the canonical source of truth. A stale or absent bridge
-    // degrades impact queries to empty results, which is recoverable on
-    // the next sync. Surface the failure as a warning so operators can
-    // act, but do not propagate it.
-    // (PR #1156 follow-up review: writeBridge error in sync.ts propagates
-    // uncaught.)
-    try {
-      await writeBridge(opts.groupDir, {
-        contracts: allContracts,
-        crossLinks,
-        repoSnapshots,
-        missingRepos,
-      });
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      logger.warn(
-        { err: msg, groupDir: opts.groupDir },
-        '⚠️ writeBridge failed; contracts.json is intact but bridge.lbug is stale. Re-run `gitnexus group sync` to retry.',
-      );
-    }
   }
 
   return {

gitnexus/src/core/group/types.ts

@@ -1,4 +1,4 @@
-export type ContractType = 'http' | 'grpc' | 'thrift' | 'topic' | 'lib' | 'custom' | 'include';
+export type ContractType = 'http' | 'grpc' | 'thrift' | 'topic' | 'lib' | 'custom';
 export type MatchType = 'exact' | 'manifest' | 'wildcard' | 'bm25' | 'embedding';
 export type ContractRole = 'provider' | 'consumer';
 
@@ -28,7 +28,6 @@ export interface DetectConfig {
   topics: boolean;
   shared_libs: boolean;
   embedding_fallback: boolean;
-  includes: boolean;
   workspace_deps: boolean;
 }
 

gitnexus/src/core/incremental/shadow-candidates.ts

@@ -1,76 +0,0 @@
-/**
- * Shadow-candidate path derivation for incremental indexing.
- *
- * Background — Bugbot review on PR #1479:
- *   queryImporters() on a NEWLY ADDED file returns 0 importers in the
- *   pre-pipeline DB, because the new file's IMPORTS rows haven't been
- *   written yet. But pre-existing files may have IMPORTS edges that
- *   *resolved to a sibling path*, and the newcomer can now steal that
- *   resolution under standard JS/TS module-resolution rules. Without
- *   pulling those pre-existing files into the writable set, their
- *   stale CALLS edges remain pointing at the OLD resolution target.
- *
- * Given an added file path, this helper enumerates the pre-existing
- * file paths whose import-resolution claim the newcomer can steal.
- * Caller filters the candidates against the prior-run `fileHashes`
- * map so we only query importers of paths that actually existed.
- *
- * Shadow patterns covered (resolution-priority-aware):
- *
- *   (a) Same basename, different extension —
- *       added `foo/bar.ts` shadows `foo/bar.{tsx,js,jsx,mjs,cjs,d.ts}`.
- *   (b) Bare-file beats directory-style index —
- *       added `foo/bar.ts` shadows `foo/bar/index.{ts,tsx,...}`.
- *   (c) Directory-index beats bare-file —
- *       added `foo/index.ts` shadows `foo.{ts,tsx,...}` (rare but real,
- *       e.g. converting a single-file module into a directory module).
- *
- * Resolution-order priority is conservatively wide: we enumerate ALL
- * common extensions because we don't know which the importer actually
- * specified, and over-seeding is harmless (extra BFS work, but the
- * subgraph extract still gates write-back by file membership).
- *
- * Cross-platform path separators: candidates are emitted with both `/`
- * and `\` for shadow pattern (b), since the caller's prior fileHashes
- * map may use either depending on the OS that wrote it.
- */
-
-const SHADOW_EXTS = ['.d.ts', '.tsx', '.ts', '.jsx', '.js', '.mjs', '.cjs'];
-
-/**
- * Enumerate pre-existing paths whose import-resolution `added` can steal.
- *
- * @param added — repo-relative path of a newly-added file
- * @returns deduplicated list of candidate paths (NOT filtered against
- *          any known-files set — caller does that)
- */
-export const shadowCandidatesFor = (added: string): string[] => {
-  const ext = SHADOW_EXTS.find((e) => added.endsWith(e));
-  if (!ext) return [];
-
-  const noExt = added.slice(0, -ext.length);
-  const out = new Set<string>();
-
-  // (a) Same basename, different extension.
-  for (const alt of SHADOW_EXTS) {
-    if (alt !== ext) out.add(noExt + alt);
-  }
-
-  // (b) Bare file beats sibling directory-style index.
-  for (const idx of SHADOW_EXTS) {
-    out.add(`${noExt}/index${idx}`);
-    out.add(`${noExt}\\index${idx}`);
-  }
-
-  // (c) New `foo/index.ext` shadows old `foo.ext`.
-  const idxSuffixSlash = '/index';
-  const idxSuffixBack = '\\index';
-  let dir: string | null = null;
-  if (noExt.endsWith(idxSuffixSlash)) dir = noExt.slice(0, -idxSuffixSlash.length);
-  else if (noExt.endsWith(idxSuffixBack)) dir = noExt.slice(0, -idxSuffixBack.length);
-  if (dir !== null) {
-    for (const alt of SHADOW_EXTS) out.add(dir + alt);
-  }
-
-  return [...out];
-};

gitnexus/src/core/incremental/subgraph-extract.ts

@@ -1,123 +0,0 @@
-/**
- * Subgraph extraction for incremental DB writeback.
- *
- * Given the FULL ctx.graph produced by the pipeline (all files parsed,
- * all phases run) and the set of file paths whose DB rows must be
- * replaced, produce a smaller KnowledgeGraph that contains:
- *
- *   - Every node whose `properties.filePath` is in `toWriteSet`.
- *   - Every graph-wide node (Community, Process) — these are regenerated
- *     each run by the communities/processes phases and must be fully
- *     rewritten.
- *   - Every relationship where AT LEAST ONE endpoint is in the writable
- *     set above. Relationships entirely between unchanged-file nodes
- *     are skipped — their rows are still in the DB and re-inserting
- *     them would PK-conflict at COPY time.
- *
- * The resulting subgraph is what gets passed to `loadGraphToLbug` after
- * the orchestrator has deleted the corresponding DB rows. Hydrated
- * unchanged-file rows are never touched in the DB.
- *
- * # Cross-file edge consistency (Finding 1)
- *
- * `extractChangedSubgraph` intentionally does NOT expand the set it is
- * given — expansion is the orchestrator's job, so the SAME expanded set
- * can be fed to both `deleteNodesForFile` and this function (asymmetry
- * between the delete set and the write set silently corrupts the DB).
- * `computeEffectiveWriteSet` below performs the boundary-crossing 1-hop
- * walk; the orchestrator composes it with its importer-BFS expansion and
- * passes the result here.
- *
- * Why the 1-hop walk is needed: consider a barrel re-export change —
- * file C (a barrel) shifts `export { foo } from './b'` to
- * `export { foo } from './d'`. After scope resolution, file A's CALLS
- * edge to `foo` resolves to D instead of B, even though A's content is
- * byte-for-byte identical:
- *
- *   - Old A→B edge survives in DB (neither A nor B is changed → not deleted)
- *   - New A→D edge is missing (neither A nor D in writable set → skipped)
- *
- * Pulling the unchanged-side file of every writable-boundary-crossing
- * edge into the write set fixes both halves: the orchestrator's
- * `DETACH DELETE` cleans up the stale unchanged-side rows, and the new
- * cross-file edges land because at least one endpoint is now writable.
- *
- * Limitation (documented): if a file X *stopped* importing from a
- * changed file C, X has no edge to C in the new graph, so this 1-hop
- * walk doesn't catch it. The orchestrator's importer-BFS (which reads
- * IMPORTS from the pre-pipeline DB) covers that case instead.
- */
-
-import type { GraphNode, GraphRelationship } from 'gitnexus-shared';
-import { createKnowledgeGraph } from '../graph/graph.js';
-import type { KnowledgeGraph } from '../graph/types.js';
-
-const isGraphWide = (label: string): boolean => label === 'Community' || label === 'Process';
-
-/**
- * Build a Map<nodeId, filePath> for every File-bound node in the graph.
- * Graph-wide nodes (Community/Process) have no filePath and are filtered.
- */
-const indexNodeFilePaths = (fullGraph: KnowledgeGraph): Map<string, string> => {
-  const idx = new Map<string, string>();
-  fullGraph.forEachNode((n: GraphNode) => {
-    const fp = n.properties?.filePath as string | undefined;
-    if (fp) idx.set(n.id, fp);
-  });
-  return idx;
-};
-
-export const extractChangedSubgraph = (
-  fullGraph: KnowledgeGraph,
-  toWriteSet: ReadonlySet<string>,
-): KnowledgeGraph => {
-  const sub = createKnowledgeGraph();
-  const writableNodeIds = new Set<string>();
-
-  fullGraph.forEachNode((n: GraphNode) => {
-    const filePath = n.properties?.filePath as string | undefined;
-    const include = (filePath && toWriteSet.has(filePath)) || isGraphWide(n.label);
-    if (include) {
-      sub.addNode(n);
-      writableNodeIds.add(n.id);
-    }
-  });
-
-  fullGraph.forEachRelationship((r: GraphRelationship) => {
-    if (writableNodeIds.has(r.sourceId) || writableNodeIds.has(r.targetId)) {
-      sub.addRelationship(r);
-    }
-  });
-
-  return sub;
-};
-
-/**
- * Public — derive the EFFECTIVE write-set: `toWriteSet` expanded by one
- * hop along every edge in the new graph that crosses the writable
- * boundary (one endpoint in a writable file, the other in an unchanged
- * file). The unchanged-side file is pulled in so its stale rows are
- * deleted + rewritten in lockstep with the changed side.
- *
- * Single pass over the edge list. Does NOT mutate `toWriteSet`. The
- * orchestrator MUST feed the returned set to both `deleteNodesForFile`
- * and `extractChangedSubgraph` — feeding the unexpanded set to either
- * one leaves stale rows or PK-conflicts at COPY time.
- */
-export const computeEffectiveWriteSet = (
-  fullGraph: KnowledgeGraph,
-  toWriteSet: ReadonlySet<string>,
-): Set<string> => {
-  const nodeFilePaths = indexNodeFilePaths(fullGraph);
-  const expanded = new Set<string>(toWriteSet);
-  fullGraph.forEachRelationship((r: GraphRelationship) => {
-    const sourcePath = nodeFilePaths.get(r.sourceId);
-    const targetPath = nodeFilePaths.get(r.targetId);
-    if (!sourcePath || !targetPath) return; // skip edges to graph-wide nodes
-    const sourceWritable = toWriteSet.has(sourcePath);
-    const targetWritable = toWriteSet.has(targetPath);
-    if (sourceWritable && !targetWritable) expanded.add(targetPath);
-    else if (targetWritable && !sourceWritable) expanded.add(sourcePath);
-  });
-  return expanded;
-};

gitnexus/src/core/ingestion/call-processor.ts

@@ -40,16 +40,13 @@ import { getLanguageFromFilename, SupportedLanguages } from 'gitnexus-shared';
 import { isRegistryPrimary } from './registry-primary-flag.js';
 import { isVerboseIngestionEnabled } from './utils/verbose.js';
 import { yieldToEventLoop } from './utils/event-loop.js';
-import { parseSourceSafe } from '../tree-sitter/safe-parse.js';
 import {
-  CLASS_CONTAINER_TYPES,
   FUNCTION_NODE_TYPES,
+  findEnclosingClassId,
   findEnclosingClassInfo,
   genericFuncName,
   inferFunctionLabel,
 } from './utils/ast-helpers.js';
-import type { FieldInfo, FieldExtractorContext } from './field-types.js';
-import type { LanguageProvider } from './language-provider.js';
 import { typeTagForId, constTagForId, buildCollisionGroups } from './utils/method-props.js';
 import type { MethodInfo } from './method-types.js';
 import {
@@ -79,62 +76,6 @@ import type { LiteralTypeInferrer } from './type-extractors/types.js';
 import type { SyntaxNode } from './utils/ast-helpers.js';
 
 import { logger } from '../logger.js';
-
-// ── Property-prepass helpers (parity with parse-worker.ts) ──
-// These mirror the sequential-path equivalents in parse-worker.ts so the main-
-// thread `processCalls` pre-pass produces byte-identical Property nodes/symbols
-// to the worker pool. Drift between the two paths breaks the
-// `incremental ≡ --force` invariant the moment a repo crosses the worker
-// threshold between runs.
-
-/** Walk up to the nearest enclosing class/struct/interface AST node. */
-const findEnclosingClassNode = (node: SyntaxNode): SyntaxNode | null => {
-  let current = node.parent;
-  while (current) {
-    if (CLASS_CONTAINER_TYPES.has(current.type)) return current;
-    current = current.parent;
-  }
-  return null;
-};
-
-/** No-op SymbolTable stub for FieldExtractorContext — matches parse-worker. */
-const NOOP_SYMBOL_TABLE: SymbolTableReader = {
-  lookupExact: () => undefined,
-  lookupExactFull: () => undefined,
-  lookupExactAll: () => [],
-  lookupCallableByName: () => [],
-  getFiles: () => [][Symbol.iterator](),
-  getStats: () => ({ fileCount: 0 }),
-};
-
-/**
- * Extract (and cache) field info for a class node. Cache is passed in so it
- * stays scoped to a single `processCalls` invocation rather than leaking
- * across analyze runs (worker uses module-level caching because each worker
- * process is short-lived; the main thread is not).
- *
- * Cache key is `${filePath}:${classNode.startIndex}` — startIndex alone is a
- * per-file byte offset, so almost every Ruby/Python file's leading class lands
- * at byte 0 and would collide across files in the shared map.
- */
-const getFieldInfo = (
-  classNode: SyntaxNode,
-  provider: LanguageProvider,
-  context: FieldExtractorContext,
-  cache: Map<string, Map<string, FieldInfo>>,
-): Map<string, FieldInfo> | undefined => {
-  if (!provider.fieldExtractor) return undefined;
-  const cacheKey = `${context.filePath}:${classNode.startIndex}`;
-  const cached = cache.get(cacheKey);
-  if (cached) return cached;
-  const result = provider.fieldExtractor.extract(classNode, context);
-  if (!result?.fields?.length) return undefined;
-  const map = new Map<string, FieldInfo>();
-  for (const field of result.fields) map.set(field.name, field);
-  cache.set(cacheKey, map);
-  return map;
-};
-
 /** Per-file resolved type bindings for exported symbols.
  *  Populated during call processing, consumed by Phase 14 re-resolution pass. */
 export type ExportedTypeMap = Map<string, Map<string, string>>;
@@ -766,15 +707,6 @@ export const processCalls = async (
   importedRawReturnTypesMap?: ReadonlyMap<string, ReadonlyMap<string, string>>,
   heritageMap?: HeritageMap,
   bindingAccumulator?: BindingAccumulator,
-  /**
-   * Optional cache for compiled `Parser.Query` objects keyed by language name.
-   * When provided, compiled queries are reused across calls instead of being
-   * re-compiled from the query string for every file. Callers that invoke
-   * `processCalls` many times with single-file batches (e.g. the cross-file
-   * propagation phase) should pass a long-lived map here to avoid O(N)
-   * query recompilation overhead.
-   */
-  compiledQueryCache?: Map<SupportedLanguages, Parser.Query>,
 ): Promise<ExtractedHeritage[]> => {
   const parser = await loadParser();
   const collectedHeritage: ExtractedHeritage[] = [];
@@ -783,7 +715,6 @@ export const processCalls = async (
     propertyName: string;
     filePath: string;
     srcId: string;
-    line?: number;
   }[] = [];
   // Phase P cross-file: accumulate heritage across files for cross-file isSubclassOf.
   // Used as a secondary check when per-file parentMap lacks the relationship — helps
@@ -838,10 +769,9 @@ export const processCalls = async (
 
     let tree = astCache.get(file.path);
     if (!tree) {
-      const parseContent = provider.preprocessSource?.(file.content, file.path) ?? file.content;
       try {
-        tree = parseSourceSafe(parser, parseContent, undefined, {
-          bufferSize: getTreeSitterBufferSize(parseContent),
+        tree = parser.parse(file.content, undefined, {
+          bufferSize: getTreeSitterBufferSize(file.content),
         });
       } catch (parseError) {
         continue;
@@ -852,11 +782,7 @@ export const processCalls = async (
     let matches;
     try {
       const lang = parser.getLanguage();
-      let query = compiledQueryCache?.get(language);
-      if (!query) {
-        query = new Parser.Query(lang, queryStr);
-        compiledQueryCache?.set(language, query);
-      }
+      const query = new Parser.Query(lang, queryStr);
       matches = query.matches(tree.rootNode);
     } catch (queryError) {
       logger.warn({ queryError }, `Query error for ${file.path}:`);
@@ -932,120 +858,6 @@ export const processCalls = async (
     prepared.push({ file, language, provider, tree, matches, parentMap, typeEnv });
   }
 
-  // ── Property-registration pre-pass ──
-  // Register all routed properties (e.g. Ruby attr_accessor) BEFORE the
-  // resolution loop so cross-file field-type lookups (e.g.
-  // `user.address.save → Address#save`) succeed regardless of file
-  // processing order. This MUST stay in lockstep with the equivalent
-  // worker-path block in parse-worker.ts (kind === 'properties') — any
-  // divergence between the two paths breaks the `incremental ≡ --force`
-  // invariant once a repo crosses the worker threshold between runs.
-  const fieldInfoCache = new Map<string, Map<string, FieldInfo>>();
-  for (const { file, language, provider, matches, typeEnv } of prepared) {
-    const callRouter = provider.callRouter;
-    if (!callRouter) continue;
-    matches.forEach((match) => {
-      const captureMap: Record<string, any> = {};
-      match.captures.forEach((c) => (captureMap[c.name] = c.node));
-      if (!captureMap['call']) return;
-      const callNameNode = captureMap['call.name'];
-      if (!callNameNode) return;
-      const routed = callRouter(callNameNode.text, captureMap['call']);
-      if (!routed || routed.kind !== 'properties') return;
-
-      const propEnclosingInfo = findEnclosingClassInfo(
-        captureMap['call'],
-        file.path,
-        provider.resolveEnclosingOwner,
-      );
-      const propEnclosingClassId = propEnclosingInfo?.classId ?? null;
-
-      // Enrich routed properties with FieldExtractor metadata so types
-      // discovered from constructor assignments (e.g. `@address = Address.new`)
-      // are propagated even when the routing payload itself lacks declaredType.
-      let routedFieldMap: Map<string, FieldInfo> | undefined;
-      if (provider.fieldExtractor && typeEnv) {
-        const classNode = findEnclosingClassNode(captureMap['call']);
-        if (classNode) {
-          routedFieldMap = getFieldInfo(
-            classNode,
-            provider,
-            {
-              typeEnv,
-              symbolTable: NOOP_SYMBOL_TABLE,
-              filePath: file.path,
-              language,
-            },
-            fieldInfoCache,
-          );
-        }
-      }
-
-      const fileId = generateId('File', file.path);
-      for (const item of routed.items) {
-        const routedFieldInfo = routedFieldMap?.get(item.propName);
-        const propQualifiedName = propEnclosingInfo
-          ? `${propEnclosingInfo.className}.${item.propName}`
-          : item.propName;
-        const nodeId = generateId('Property', `${file.path}:${propQualifiedName}`);
-        graph.addNode({
-          id: nodeId,
-          label: 'Property',
-          properties: {
-            name: item.propName,
-            filePath: file.path,
-            startLine: item.startLine,
-            endLine: item.endLine,
-            language,
-            isExported: true,
-            description: item.accessorType,
-            ...(item.declaredType
-              ? { declaredType: item.declaredType }
-              : routedFieldInfo?.type
-                ? { declaredType: routedFieldInfo.type }
-                : {}),
-            ...(routedFieldInfo?.visibility !== undefined
-              ? { visibility: routedFieldInfo.visibility }
-              : {}),
-            ...(routedFieldInfo?.isStatic !== undefined
-              ? { isStatic: routedFieldInfo.isStatic }
-              : {}),
-            ...(routedFieldInfo?.isReadonly !== undefined
-              ? { isReadonly: routedFieldInfo.isReadonly }
-              : {}),
-          },
-        });
-        ctx.model.symbols.add(file.path, item.propName, nodeId, 'Property', {
-          ...(propEnclosingClassId ? { ownerId: propEnclosingClassId } : {}),
-          ...(item.declaredType
-            ? { declaredType: item.declaredType }
-            : routedFieldInfo?.type
-              ? { declaredType: routedFieldInfo.type }
-              : {}),
-        });
-        const relId = generateId('DEFINES', `${fileId}->${nodeId}`);
-        graph.addRelationship({
-          id: relId,
-          sourceId: fileId,
-          targetId: nodeId,
-          type: 'DEFINES',
-          confidence: 1.0,
-          reason: '',
-        });
-        if (propEnclosingClassId) {
-          graph.addRelationship({
-            id: generateId('HAS_PROPERTY', `${propEnclosingClassId}->${nodeId}`),
-            sourceId: propEnclosingClassId,
-            targetId: nodeId,
-            type: 'HAS_PROPERTY',
-            confidence: 1.0,
-            reason: '',
-          });
-        }
-      }
-    });
-  }
-
   // ── Resolution loop: verify constructor bindings and resolve calls ──
   // The accumulator (if present) is now fully populated from the preparation
   // loop above, so verifyConstructorBindings sees all provider bindings
@@ -1119,13 +931,7 @@ export const processCalls = async (
           // Defer resolution: Ruby attr_accessor properties are registered during
           // this same loop, so cross-file lookups fail if the declaring file hasn't
           // been processed yet. Collect now, resolve after all files are done.
-          pendingWrites.push({
-            receiverTypeName,
-            propertyName,
-            filePath: file.path,
-            srcId,
-            line: captureMap['assignment'].startPosition.row + 1,
-          });
+          pendingWrites.push({ receiverTypeName, propertyName, filePath: file.path, srcId });
         }
         // Assignment-only capture (no @call sibling): skip the rest of this
         // forEach iteration — this acts as a `continue` in the match loop.
@@ -1245,8 +1051,47 @@ export const processCalls = async (
             return;
 
           case 'properties': {
-            // Properties already registered in the pre-pass above.
-            // Skip to avoid duplicate nodes/edges.
+            const fileId = generateId('File', file.path);
+            const propEnclosingClassId = findEnclosingClassId(captureMap['call'], file.path);
+            for (const item of routed.items) {
+              const nodeId = generateId('Property', `${file.path}:${item.propName}`);
+              graph.addNode({
+                id: nodeId,
+                label: 'Property',
+                properties: {
+                  name: item.propName,
+                  filePath: file.path,
+                  startLine: item.startLine,
+                  endLine: item.endLine,
+                  language,
+                  isExported: true,
+                  description: item.accessorType,
+                },
+              });
+              ctx.model.symbols.add(file.path, item.propName, nodeId, 'Property', {
+                ...(propEnclosingClassId ? { ownerId: propEnclosingClassId } : {}),
+                ...(item.declaredType ? { declaredType: item.declaredType } : {}),
+              });
+              const relId = generateId('DEFINES', `${fileId}->${nodeId}`);
+              graph.addRelationship({
+                id: relId,
+                sourceId: fileId,
+                targetId: nodeId,
+                type: 'DEFINES',
+                confidence: 1.0,
+                reason: '',
+              });
+              if (propEnclosingClassId) {
+                graph.addRelationship({
+                  id: generateId('HAS_PROPERTY', `${propEnclosingClassId}->${nodeId}`),
+                  sourceId: propEnclosingClassId,
+                  targetId: nodeId,
+                  type: 'HAS_PROPERTY',
+                  confidence: 1.0,
+                  reason: '',
+                });
+              }
+            }
             return;
           }
 
@@ -1535,10 +1380,7 @@ export const processCalls = async (
     );
     if (fieldOwner) {
       graph.addRelationship({
-        id: generateId(
-          'ACCESSES',
-          `${pw.srcId}:${fieldOwner.nodeId}:write${pw.line !== undefined ? `:${pw.line}` : ''}`,
-        ),
+        id: generateId('ACCESSES', `${pw.srcId}:${fieldOwner.nodeId}:write`),
         sourceId: pw.srcId,
         targetId: fieldOwner.nodeId,
         type: 'ACCESSES',
@@ -3135,10 +2977,7 @@ export const processAssignmentsFromExtracted = (
     const fieldOwner = resolveFieldOwnership(receiverTypeName, asn.propertyName, asn.filePath, ctx);
     if (!fieldOwner) continue;
     graph.addRelationship({
-      id: generateId(
-        'ACCESSES',
-        `${asn.sourceId}:${fieldOwner.nodeId}:write${asn.line !== undefined ? `:${asn.line}` : ''}`,
-      ),
+      id: generateId('ACCESSES', `${asn.sourceId}:${fieldOwner.nodeId}:write`),
       sourceId: asn.sourceId,
       targetId: fieldOwner.nodeId,
       type: 'ACCESSES',
@@ -3441,10 +3280,9 @@ export const extractFetchCallsFromFiles = async (
 
     let tree = astCache.get(file.path);
     if (!tree) {
-      const parseContent = provider.preprocessSource?.(file.content, file.path) ?? file.content;
       try {
-        tree = parseSourceSafe(parser, parseContent, undefined, {
-          bufferSize: getTreeSitterBufferSize(parseContent),
+        tree = parser.parse(file.content, undefined, {
+          bufferSize: getTreeSitterBufferSize(file.content),
         });
       } catch {
         continue;