Implements security improvements inspired by PR #16 (credit: MO2k4):
- Add validatePathWithinRoot() to prevent path traversal attacks in
extraction and context building
- Clamp MCP tool inputs (limit, depth, maxDepth) to sane ranges
- Use atomic writes (temp file + rename) for config saves
- Add symlink cycle detection in directory scanning to prevent infinite loops
- Replace all JSON.parse calls in db/queries.ts with safeJsonParse fallbacks
to handle corrupted database metadata gracefully
- Add cross-process FileLock for DB write operations (indexAll, indexFiles,
sync) to prevent concurrent writes from CLI, MCP server, and git hooks
- Remove unused path import from context/index.ts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds support for Dart and Liquid languages with tree-sitter parsing.
Improves accuracy of code symbol extraction for existing languages.
Indexes project files to enhance code navigation features.
Migrates build system to facilitate code contributions.
Removes git hook functionality.
Integrates Sentry for error tracking and reporting.
Enhances project initialization and configuration loading.
The nomic-ai model is now downloaded during npm install via a postinstall
script and stored globally in ~/.codegraph/models (shared across projects)
instead of per-project in .codegraph/models.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add note that installer updates ~/.claude/CLAUDE.md in Quick Start
- Rename "Recommended: Add Global Instructions" to "Global Instructions Reference"
- Clarify that instructions are added automatically, shown for reference
- Bump version to 0.2.7
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The hybrid approach (Claude's native Explore agents using codegraph tools)
is more effective than a custom explore tool because Explore agents already
know what format the main session needs.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add 'liquid' to Language type and default include patterns
- Create LiquidExtractor with regex-based extraction (tree-sitter-liquid has ABI issues)
- Extract render/include/section references as component nodes
- Extract schema blocks as constant nodes with parsed names
- Extract assign statements as variable nodes
- Create file relationship edges for snippet/section references
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added claude-md-template.ts with the instructions template
- Installer writes to ~/.claude/CLAUDE.md (global) or ./.claude/CLAUDE.md (local)
- Smart detection: updates existing CodeGraph section or appends if not found
- Uses HTML comment markers for reliable section replacement on upgrades
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The installer runs `npm install -g @colbymchenry/codegraph` so users
can simply run `codegraph init -i` instead of the full npx command.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Users running via npx don't have the codegraph command installed
globally. Update installer message and README to use
npx @colbymchenry/codegraph init -i instead.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Change static import to dynamic import() for @xenova/transformers
which is an ESM-only package. This fixes ERR_REQUIRE_ESM when
running via npx in CommonJS environments.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace placeholder metrics with actual benchmark results (29% fewer tokens, 25% fewer tool calls)
- Add full benchmark data table in collapsible section
- Add ASCII architecture diagram showing how CodeGraph integrates with Explore agents
- Explain the hybrid approach: agents query the graph instead of scanning files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add centered npx command in hero section (Next.js style)
- Simplify Quick Start to 3 steps using interactive installer
- Move manual setup and global instructions to collapsible details
- Add install command to CLI usage and commands sections
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- New `codegraph install` command and auto-run when invoked with no args
- Beautiful ASCII banner using figlet
- Interactive prompts for global (~/.claude) or local (./.claude) installation
- Writes MCP server config to claude.json
- Writes auto-allow permissions to settings.json
- For local installs: auto-initializes project, indexes, and installs git hooks
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Updated documentation to recommend instructing Explore agents to use
CodeGraph tools (search, callers, callees, context) for faster code
exploration instead of file scanning.
Benchmark results show ~30% fewer tokens and ~25% fewer tool calls
when Explore agents leverage CodeGraph for graph-based lookups.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Instead of returning file paths for Claude to read separately,
codegraph_explore now:
- Reads relevant files internally using fs
- Extracts code snippets for key symbols (functions, types, APIs)
- Includes the code directly in the response
- Returns a synthesis with data flow and key code included
This matches native explore agent behavior where file reading
happens in the sub-agent context, keeping main context clean.
Bump version to 0.1.8
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Move warnings to TOP of output so Claude sees them first
- If existing implementations found: "STOP: Similar implementations exist!"
- If feature request: "BEFORE PLANNING: Use AskUserQuestion to clarify..."
- Update tool description to emphasize checking existing code first
- Fixes issue where Claude listed questions but never asked them
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Pattern generation now uses multiple naming conventions:
PascalCase, snake_case, and camelCase
- Common suffixes/prefixes work across languages (Service,
Handler, Controller, handle_, create_, etc.)
- Removed JS/React-specific patterns like useBundle, SwapDialog
- Bump version to 0.1.6
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add codegraph_explore MCP tool for deep exploration with condensed output
- Expand default exclude patterns for framework build outputs (.next, .nuxt, .expo, etc.)
- Increase node ID hash length from 16 to 32 chars to prevent collisions
- Add feature request detection with UX clarification reminders
- Update README with MCP tools reference and best practices
- Update CLAUDE.md with context usage guidelines
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add centered hero with key metrics (2x faster, 40% fewer tokens, zero API costs)
- Add side-by-side comparison table showing before/after CodeGraph
- Add real-world benchmark results from Sign in with Apple test
- Add 6-feature grid highlighting key capabilities
- Update all section headers with emojis
- Add badges for npm, license, and Node.js version
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add evaluation test suite with TypeScript and Python fixtures
- Fix MCP server to defer CodeGraph init until rootUri received
- Fix call edge extraction by calling resolveReferences() after indexAll/sync
- Fix glob matching for root-level files (e.g., **/*.py now matches auth.py)
- Fix duplicate node extraction for methods inside classes
- Update context tests to use buildContext for semantic search + graph traversal
- Export unused formatter functions to fix build
Evaluation results:
- TypeScript: 96% precision, 79% recall, 85% F1
- Python: 99% precision, 80% recall, 85% F1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
