- Add validateProjectPath() to reject sensitive system directories
- Add isPathWithinRoot/isPathWithinRootReal for symlink-aware path checks
- Replace hand-rolled glob-to-regex with picomatch to prevent ReDoS
- Add isSafeRegex() to reject custom patterns with nested quantifiers
- Replace FileLock with PID-tracking version that detects stale locks
- Add symlink detection in removeDirectory/listDirectoryContents
- Add subdirectory name validation in ensureSubdirectory
- Add atomicWriteFileSync and corrupted file backup in config-writer
- Add MCP input validation (validateString) for all tool handlers
- Fix CLAUDE.md section replacement to handle ### subsections correctly
All grammar packages now have compatible peer deps with tree-sitter 0.21.x,
resulting in zero warnings during npm install. Downgraded grammars:
c 0.24.1→0.23.2, php 0.24.2→0.23.11, python 0.23.6→0.23.4,
rust 0.24.0→0.23.1, swift 0.7.1→0.6.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reduces peer dependency warnings during install by upgrading grammars that
have newer versions accepting ^0.22.x: c 0.23.4→0.24.1, php 0.23.11→0.24.2,
rust 0.23.2→0.24.0. Python 0.23.6 and swift 0.7.1 already compatible.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
tree-sitter-kotlin doesn't ship prebuilt binaries for win32-x64, causing
npm install to fail on Windows without Visual Studio. All grammars are now
optional since the runtime already handles missing parsers gracefully.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds support for Dart and Liquid languages with tree-sitter parsing.
Improves accuracy of code symbol extraction for existing languages.
Indexes project files to enhance code navigation features.
Migrates build system to facilitate code contributions.
Removes git hook functionality.
Integrates Sentry for error tracking and reporting.
Enhances project initialization and configuration loading.
- Add 'liquid' to Language type and default include patterns
- Create LiquidExtractor with regex-based extraction (tree-sitter-liquid has ABI issues)
- Extract render/include/section references as component nodes
- Extract schema blocks as constant nodes with parsed names
- Extract assign statements as variable nodes
- Create file relationship edges for snippet/section references
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- New `codegraph install` command and auto-run when invoked with no args
- Beautiful ASCII banner using figlet
- Interactive prompts for global (~/.claude) or local (./.claude) installation
- Writes MCP server config to claude.json
- Writes auto-allow permissions to settings.json
- For local installs: auto-initializes project, indexes, and installs git hooks
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add codegraph_explore MCP tool for deep exploration with condensed output
- Expand default exclude patterns for framework build outputs (.next, .nuxt, .expo, etc.)
- Increase node ID hash length from 16 to 32 chars to prevent collisions
- Add feature request detection with UX clarification reminders
- Update README with MCP tools reference and best practices
- Update CLAUDE.md with context usage guidelines
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Colby McHenry
Martin Oehlert
