GitNexus v1.6.8

The Program Dependence Graph release. Opt-in PDG-backed impact analysis and taint tracking, built out across every supported language — plus multi-branch indexing, private-repo cloning, and a streamable-HTTP MCP server.

✨ Highlights

• 🎯 PDG-backed impact analysis — impact gains an opt-in mode: 'pdg' that runs statement-level and inter-procedural program slicing for a far more precise blast radius, validated by a mutation oracle. The default call-graph mode is unchanged. (#2227)
• 🧬 A full Program Dependence Graph substrate — control-flow graphs, reaching-definitions data dependence, and control dependence (post-dominators + a Ferrante-style CDG) now exist for every supported language. All of it is opt-in behind --pdg; a default analyze run stays byte-identical. (#2197, [#2160], [#2188], [#2211])
• 🔬 Taint analysis — intra-procedural tracking over the PDG plus inter-procedural taint via function summaries propagated over resolved CALLS edges. (#2164, [#2179])
• 🌿 Multi-branch indexing — analyze and query a repository per branch, each stored under its own subdirectory, with the primary-branch layout untouched. (#2137)
• 🔐 Private repositories — clone private GitHub repos with a PAT, with Azure DevOps Server support. (#2223)
• 🔌 MCP gains a trace tool and an HTTP server — shortest call path between two symbols, and gitnexus mcp --http over Streamable HTTP (with legacy SSE). (#2173, [#2141])

🚀 Added

• PDG-backed impact analysis (opt-in) — impact gains a mode: 'pdg' that runs statement-level and inter-procedural program slicing for far more precise blast radius, with resolved-callee-id soundness and validation by a mutation oracle; the default call-graph mode is unchanged (#2227)
• Program Dependence Graph substrate across the language matrix — a control-flow-graph layer landed for TS/JS (#2099) and was extended to PDG/CFG visitors for every supported language (#2197); on top of it an intra-procedural REACHING_DEF data-dependence layer (#2160), value-position branches (if/when/switch/match/try used as expressions) modeled as control dependence (#2211), and full control dependence via post-dominators + a Ferrante-style CDG (#2188). All layers are opt-in behind --pdg; a default analyze run stays byte-identical (#2082, [#2085], [#2205], [#2207], [#2195])
• Taint analysis — intra-procedural taint tracking over the PDG (#2164) plus inter-procedural taint via function summaries propagated over resolved CALLS edges (#2179) (#2083, [#2084])
• Multi-branch indexing and branch-scoped querying — analyze and query a repository per branch, with each branch stored under its own subdirectory and the primary branch layout left unchanged (#2137, [#2106])
• Private GitHub repos via PAT + Azure DevOps Server support — gitnexus analyze can clone private GitHub repositories with a personal access token and supports Azure DevOps Server remotes (#2223, [#2076], [#2210])
• MCP trace tool — returns the shortest call path between two symbols (#2173)
• MCP HTTP server — gitnexus mcp --http exposes the server over Streamable HTTP with legacy SSE transport support (#2141)
• HTTP route extraction — Java Spring route annotations are now extracted into Route nodes (#2078), and the HTTP method is persisted on each Route node (#2234, [#2138])
• gitnexus analyze circular import cycle check (#2166)
• gitnexus analyze embeddings flags — --embeddings-baseurl, --embeddings-model, --embeddings-auth-token, and --embeddings-dims to point analyze at a custom embeddings provider (#2140)
• gitnexus setup coding-agent integration selection — choose which coding-agent integrations to install during setup (#2168)
• C++ CUDA source extensions parsed — .cu/.cuh files are now ingested (#2213)

🐛 Fixed

• impact() / route_map under-reporting blast radius — name-resolution gaps that caused callers and routes to be dropped are fixed, with ambiguous symbols reported per-candidate (#2136, [#2129], [#1858], [#1852])
• Single-ancestor method override detection in the MRO processor (#2199)
• MCP query / cypher parameter names — renamed so Claude Code can invoke them, while still accepting the legacy parameter (#2186)
• C++ overload resolution — homogeneous braced-init overloads are now ranked (#2214), deleted overload winners are suppressed (#2094), and the C++ hook layer handles pack-base comments and missing hook overrides (#2247)
• Large-repo analyze crash — the pipeline now survives non-cloneable worker results instead of aborting (#2135, [#2112])
• Embeddings — onnxruntime-common resolves under pnpm-strict / pnpm dlx installs (#2139, [#307]), and the VECTOR index is created via conn.query rather than the prepared-statement path that silently skipped it (#2114)
• Vendored tree-sitter grammars — loaded from vendor/ by absolute path so analyze finds them regardless of CWD (#2144, [#2111])
• Registry wipe on transient I/O errors prevented — a failed read no longer clears the repository registry (#2124)
• Server roots resolve from GITNEXUS_HOME — clone, upload, and mapping roots honor the configured home directory (#2229)
• Wiki generation keeps the graph DB pinned so it is not evicted mid-generation (#2232)
• Group sync pins repositories so large groups resolve their cross-repo links (#2191)
• Web viewer — a chat-only mode for large projects prevents the WebUI from hanging (#2185, [#2178]), and the broken Browse-for-folder control was replaced with an upload directory picker (#1850)
• Hooks — the augment CLI child is wrapped in the orphan guard (#2169), db-lock probe subprocesses are bounded and gated behind a hook slot (#2165), and the MCP-owned-DB augment-skip diagnostic is silenced for strict hook runners (#2134, [#2163], [#1913])
• Docker image ships runtime-needed published assets — hooks/ and skills/ are copied into the image so gitnexus analyze no longer crashes with MODULE_NOT_FOUND (#2132, [#2130])
• gitnexus analyze preserves trailing spaces in git roots (#2192)
• Write-route origin guard scoped to the server's own bound host (#2172)
• Impact PDG Mutation Report workflow — fixed three latent oracle bugs (dist-CLI invocation under Node ≥ 22.18 type-stripping, undeclared @babel/* deps, and a recall-gated check filter) so the mutation oracle CI runs green (#2258)

🔧 Changed

• tree-sitter readiness/summary CI hardened — readiness and grammar-update workflows aligned on a shared manifest (#2187, [#858]), readiness summary counts kept current (#2196), and the summary now fails on parse drift (#2246)
• Devcontainer simplified — Dockerfile and devcontainer.json no longer pin version args for the AI CLIs (#2174)

⚡ Performance

• Graph-DB emit/persistence — cut overall emit/persistence wall time (#2215) and overlap node COPY with relationship emit (#2226) (#2203)
• PDG/CFG emit — streaming/chunked PDG graph emit for full-kernel-scale repos (#2216, [#2202]) and an SSA-sparse reaching-defs solver replacing the dense-set worklist (#2212, [#2201])
• Hook db-lock scan — cmdline-first on Linux, dropping the lsof fallback (#2183, [#2180])

📥 Upgrade

:::bash
npm install -g gitnexus@1.6.8

Then re-index to pick up the new graph layers:

:::bash
gitnexus analyze            # standard re-index
gitnexus analyze --pdg      # opt in to the PDG/taint layers

Full changelog: v1.6.7...v1.6.8