colbymchenry/codegraph

This release delivers a major architectural shift toward self-contained distribution, bundling a vendored Node runtime and SQLite to eliminate external dependencies and native build steps. The codebase expands significantly with a new Rust-based extraction kernel for faster parsing across dozens of languages, alongside deep framework-aware resolution for C\#, Go, and more. Operational improvements include a new interactive daemon manager, enhanced search with field-qualified queries, and robust CLI progress animations. The release also introduces a new Starlight-based documentation site, an anonymous telemetry system, and comprehensive test coverage for the new features.

A new Python script, \assets/generate-language-tiles.py\, has been added to automatically generate 104x104px SVG tiles for each supported language. These tiles, which feature the language's vector mark and name rendered as vector outlines using the Archivo typeface, are saved to \assets/languages/\. This ensures the README's language grid renders consistently across GitHub's secure static mode, which blocks web fonts.

assets · high confidence

The telemetry-dashboard directory now contains a private admin interface for viewing anonymous usage data stored in Cloudflare D1. The dashboard is protected by a shared password (ADMIN\_PASSWORD) and a signed, HttpOnly cookie (SESSION\_SECRET) for session management. It provides a grid of panels displaying metrics such as active machines, installs, uninstalls, and tool calls, with a time-range filter that applies to all panels. The frontend is a plain static site (no framework) that fetches data from the dashboard's own API endpoints, which are all gated by the session check. The README documents the API, the session model, and how to deploy and run local checks.

telemetry-dashboard · high confidence

A new rule file (.cursor/rules/codegraph.mdc) was added to guide the AI on using the CodeGraph MCP server. It instructs the model to prefer the \codegraph\_explore\ tool for structural queries, outlines best practices for direct answering and trust in AST-based results, and provides instructions for handling index staleness or uninitialized states.

.cursor · high confidence

The scripts/add-lang directory now includes the necessary tooling to support Lua and Luau. This includes a benchmarking script (bench.sh) to test extraction and retrieval performance, a grammar checker (check-grammar.mjs) to validate the tree-sitter grammar's health under the project's runtime, a script (dump-ast.mjs) to inspect the AST structure for mapping, and a verification script (verify-extraction.mjs) to ensure the extractor is correctly identifying symbols. These scripts enable the codegraph to parse, index, and query Lua and Luau codebases.

scripts/add-lang · high confidence

The extraction engine now supports parsing Astro component files, CFML (ColdFusion) source and script files, and Delphi DFM/FMX form files, each with their own specialized extractors. Additionally, the system now captures function-as-value references (callbacks, event handlers, and registration sites) across supported languages, enabling better impact analysis for callback-based patterns. A new \generated-detection\ module identifies tool-generated files to improve search relevance by down-ranking stubs and boilerplate.

src/extraction · high confidence

The codegraph-kernel now includes pre-compiled C sources for the Dart, Kotlin, Lua, and Scala language grammars. These are vendored directly into the build process (via build.rs) to ensure consistent parsing behavior and avoid dependency conflicts with the Rust crates.io versions. The build script compiles the parser and scanner C files for each language, ensuring that the kernel can parse these languages without relying on external tree-sitter crate dependencies that might have incompatible versions or different lineage.

codegraph-kernel · high confidence

Added new language extractors for ArkTS (HarmonyOS), C/C++, ColdFusion (script and query), COBOL, C\#, Dart, Erlang, and Go, enabling the system to parse and index code in these languages. The ArkTS extractor leverages the TypeScript extractor with specific handling for declarative UI components and reactive decorators. The C/C++ extractor introduces logic to recover function names from macro-mangled definitions and handle template arguments. CFML support covers both script and query contexts. COBOL extraction handles fixed-format source, copybooks, and CICS/SQL extensions. C\# extraction now handles record structs, conditional compilation directives, and property/field indexing. Dart extraction supports factory constructors and static final constants. Erlang extraction merges function clauses and handles record types and macros. Go extraction resolves method receivers and type aliases. These additions broaden the scope of code analysis and impact tracking across a wider set of technologies.

src/extraction/languages · high confidence

The resolution engine now supports a broader set of frameworks and languages, enabling deeper cross-language and cross-framework traceability. New framework resolvers have been added for Astro (file-based routing and virtual modules), CICS/COBOL (transaction-to-program mapping), C\# (ASP.NET Core routes and service/repository patterns), Drupal 8–11 (YAML routes, hook implementations, and controller/form handlers), Expo Modules (Swift/Kotlin native method extraction), Express/Node.js (route extraction and inline handler calls), React Native Fabric (Codegen spec parsing and legacy Paper view managers), Go (Gin/Echo/Chi/http handlers with URL-shaped path validation), and Cargo workspaces (Rust crate resolution). Additionally, the Express resolver now validates that route paths are URL-shaped to avoid false positives from non-route method calls, and the Cargo workspace helper parses member crates to resolve \use\ references across workspace members.

src/resolution/frameworks · high confidence

The installer now prompts users to join the CodeGraph Pro beta waitlist after installation or upgrade, storing their choice so they are not asked again. It also supports configuring multiple agent targets (Claude Code, Cursor, Codex CLI, opencode, Hermes Agent, Gemini CLI, Antigravity IDE, Kiro, and GitHub Copilot in VS Code, the Copilot CLI, and JetBrains IDEs) instead of only Claude. The installer writes a compact instructions block into each agent's config file, ensuring subagents and non-MCP harnesses can use CodeGraph. A new clack-based interactive UI replaces the previous prompts, and the installer uses a multi-target architecture to write MCP server config and instructions for all selected agents.

src/installer · high confidence

The installer now configures CodeGraph for a wider range of AI coding assistants. New targets include Google's Antigravity IDE and Gemini CLI, OpenAI's Codex CLI, GitHub Copilot CLI, JetBrains IDEs, VS Code, Cursor, and Hermes Agent. Existing targets for Claude Code and the Claude prompt hook have been updated to fix configuration paths and ensure proper cleanup. Each target writes the appropriate MCP server configuration to the correct location for that tool, ensuring the CodeGraph MCP server is available to the respective AI assistant.

src/installer/targets · high confidence

Added a new \src/sync\ module that provides a fallback mechanism for keeping the code graph up-to-date when the live file watcher is disabled. This includes \git-hooks.ts\ to install and manage \post-commit\, \post-merge\, and \post-checkout\ hooks that trigger \codegraph sync\ in the background. The \watch-policy.ts\ module detects WSL2 environments and mounts on \/mnt/\*\ drives, disabling the native file watcher in those cases to prevent startup stalls. The \watcher.ts\ module implements a cross-platform file watcher that uses a single recursive watch on macOS/Windows and per-directory inotify watches on Linux, with bounds on file descriptors and inotify watches to prevent resource exhaustion. The \worktree.ts\ module detects when a query borrows a different git worktree's index, providing warnings to users about potential stale results.

src/sync · high confidence

Added new modules for graph traversal and querying within the code knowledge graph. The \GraphTraverser\ class provides BFS and DFS traversal algorithms with support for depth limits, edge/node kind filtering, and node limits. The \GraphQueryManager\ class exposes higher-level query functions including \getContext\ (returning a node's full context with ancestors, children, and references), \getFileDependencies\/\getFileDependents\ (resolving cross-file dependencies via the symbol graph rather than just import edges), and \findByQualifiedName\ for searching symbols by pattern.

src/graph · high confidence

Adds an interactive CLI for managing background MCP daemons, allowing users to list and stop them via a new \codegraph daemon\ command. The \src/mcp\ directory now includes a shared daemon architecture (\daemon.ts\) that lets one \codegraph serve --mcp\ process serve multiple concurrent clients, improving resource sharing and cold-start performance. Supporting modules (\daemon-manager.ts\, \daemon-paths.ts\, \daemon-registry.ts\) handle process lifecycle, socket path resolution, and global registry management. Additionally, new modules (\explore-dedup.ts\, \explore-diagnostics.ts\, \dynamic-boundaries.ts\, \early-ppid.ts\, \engine.ts\) introduce source deduplication, per-file allocation diagnostics, dynamic-dispatch boundary detection, and engine initialization logic.

src/mcp · high confidence

CodeGraph now ships as a self-contained bundle that includes a vendored Node runtime and SQLite, eliminating the need for users to have Node.js installed and removing the dependency on native SQLite addons. This change introduces a new \BUNDLING.md\ guide and a \scripts/build-bundle.sh\ script that packages the app, dependencies, and platform-specific Node binaries into distributable archives (\.tar.gz\ for Unix, \.zip\ for Windows). The release pipeline is updated to build these bundles and publish npm shims that invoke them, ensuring consistent behavior across all platforms. Additionally, \.dockerignore\ and \.gitignore\ are added to exclude build artifacts, local configs, and test directories from version control and container contexts.

(repo-wide) · high confidence

A new telemetry worker has been introduced to collect anonymous usage data, replacing the previous PostHog integration. The system stores raw events in a Cloudflare D1 database and generates daily rollups for the admin dashboard. It enforces a strict allowlist for events and properties, ensuring no personal data, file paths, or IP addresses are stored. The worker includes a password-gated admin endpoint for manual rollup triggers and a nightly cron job to aggregate data and purge raw events after 90 days.

telemetry-worker · high confidence

The project has introduced a new documentation site built with Astro and Starlight. This addition provides a structured, navigable knowledge base for users, featuring a custom theme, a dynamic GitHub star counter, and a dedicated header with Docs and Languages links. The site includes comprehensive guides on installation, configuration, and usage, as well as reference documentation for the CLI, API, and supported languages.

site · high confidence

The extraction pipeline now supports a native Rust-based kernel for significantly faster processing of TypeScript, Java, Python, Go, C/C++, Rust, C\#, Ruby, PHP, Swift, Kotlin, R, Scala, Dart, Lua, and Luau. This new kernel replaces the previous WebAssembly-based extraction path for these languages, providing byte-identical results with improved performance. The system includes a loader that dynamically loads the native module, verifies ABI compatibility, and gracefully falls back to the existing WASM extraction path if the kernel is unavailable or incompatible. A routing mechanism ensures that only supported languages are routed to the kernel, with a kill-switch environment variable to disable the kernel entirely if needed.

src/extraction/kernel · high confidence

Added a suite of bash scripts in scripts/agent-eval to run A/B tests comparing agent behavior with and without codegraph. The new scripts include ab-adoption.sh to measure tool choice (Read vs codegraph\_node), ab-hook.sh to test a PreToolUse redirect hook, ab-impl.sh and ab-sufficiency.sh to test implementation and understanding tasks, and ab-new-vs-baseline.sh to compare specific codegraph changes. These scripts automate running the Claude CLI against target repositories, parsing JSONL logs, and comparing metrics like residual context occupancy, explore sufficiency, and allocation efficiency.

scripts/agent-eval · high confidence

A new context module has been introduced, featuring a ContextBuilder that constructs task context by combining full-text search with graph traversal. The module includes a formatter that converts context into optimized Markdown and JSON outputs, with logic to sort and filter generated files (like .pb.go) to prioritize hand-written code. It also provides a subgraph tree formatter for visualizing relationships. This refactors and replaces the previous context-building logic with a more structured, configurable approach.

src/context · high confidence

The resolution subsystem introduces several new modules to improve reference resolution and dynamic-dispatch synthesis. A new C/C++ function-pointer synthesizer bridges indirect calls through struct fields and macro-built command tables, while a GoFrame route synthesizer connects reflective route declarations to their controller methods. Additionally, a cooperative-yield utility prevents the liveness watchdog from killing long-running resolution passes, and an LRU cache implementation bounds memory usage during resolution. These changes enhance the accuracy of call-graph edges for specific language patterns and improve indexer stability on large codebases.

src/resolution · high confidence

The scripts directory now includes build-bundle.sh, pack-npm.sh, and npm-shim.js to create self-contained, per-platform bundles that include a vendored Node runtime with node:sqlite built-in. This replaces the previous approach of relying on the user's system Node or native addons like better-sqlite3. The npm package now ships as a thin installer that locates and executes the bundled runtime, ensuring consistent behavior across all platforms without requiring system-level dependencies.

scripts · high confidence

The src directory now includes new modules for managing the .codegraph data directory (src/directory.ts), project configuration via codegraph.json (src/project-config.ts), and enhanced security validation (src/utils.ts). The directory module introduces the CODEGRAPH\_DIR environment variable override, allowing separate index directories for environments like Windows and WSL. The project config module adds support for custom file extensions, including, excluding, and forcing specific files into the index. Security is strengthened with path validation that resolves symlinks to prevent out-of-root reads, sensitive path blocking, and config leaf node handling that surfaces only keys, never values, to avoid leaking secrets.

src · high confidence

A change to existing behaviour in src/extraction/wasm — 24 commits, 29 files.

src/extraction/wasm · medium confidence · unverified

The CLI entry point now enforces Node.js version compatibility at startup, blocking execution on Node 25.x (due to a V8 WASM JIT bug) and on versions older than 20. It also replaces the previous error-handling approach with a robust fatal handler that logs a bounded, hang-proof error message to stderr and exits immediately, preventing detached MCP daemons from orphaning or spinning at 100% CPU. Additionally, the installer's pre-uninstall cleanup is improved to ensure agent instructions are not duplicated and that CLI binaries are properly removed.

src/bin · high confidence

The database layer has been refactored to use Node's built-in \node:sqlite\ module, removing the previous \better-sqlite3\ dependency and its associated WASM fallbacks. This change simplifies the distribution by bundling a compatible Node runtime, ensuring that the database layer is self-contained and does not require native build steps. The \sqlite-adapter.ts\ file now wraps \node:sqlite\ to maintain a consistent interface for the rest of the codebase. Additionally, the \index.ts\ file introduces a WAL (Write-Ahead Logging) valve to manage WAL file growth, preventing unbounded expansion during bulk indexing operations.

src/db · high confidence

Search now supports field-qualified queries (e.g., \kind:function\, \lang:typescript\, \path:\, \name:\) to filter results by symbol type, language, file path, or name. The search tokenizer was improved to split camelCase/PascalCase identifiers and apply code-aware stop words, while the ranking algorithm was adjusted to down-weight the project name and score path relevance per query word rather than per sub-token. Additionally, stem variants are generated for search terms to broaden matching, and a fuzzy typo fallback is included for name matches.

src/search · high confidence

The \codegraph upgrade\ command now supports self-updating the CLI across all installation methods (npm, bundle, source) by re-running the canonical installer script, ensuring the download and PATH logic never drifts between first-install and upgrade. The \codegraph uninstall\ command has been expanded to remove CLI binaries and shims in addition to agent configs, preventing leftover files on the system. Additionally, the CLI now detects and displays a non-blocking notice when a newer CodeGraph release is available, and respects the \NO\_COLOR\ environment variable for plain output when stdout is piped.

src/upgrade · high confidence

The UI layer now uses a background worker thread to render transient progress animations, preventing the CLI from freezing while the main thread is blocked by SQLite. To ensure consistent output, color detection logic was extracted into a new \color.ts\ module that respects \NO\_COLOR\, \--no-color\, and \FORCE\_COLOR\ environment variables. Additionally, a new \glyphs.ts\ module provides a safe ASCII fallback for Windows consoles that may not support UTF-8, ensuring that the main thread's persistent status lines and the worker's transient animation frames remain readable and aligned across all platforms.

src/ui · high confidence

Added CodeGraph evaluation framework for API testing; Added factory-closure-ts test fixture; Added integration tests for the full pipeline, LRU cache, and MCP input limits; Added test coverage for adaptive explore sizing, Android resource exclusion, ArkTS resolution, batched ref cleanup, beta signup, and C/C++ function-pointer dispatch; Added test fixtures for dense-header-ts and starved-cluster-ts.

Added new test fixtures for the explore feature, including \ambient-decls-ts\, \dense-header-ts\, \displacement-ts\, \factory-closure-ts\, \oversize-member-ts\, \starved-cluster-ts\, and \tail-render-ts\ (each with a \package.json\), plus a \payroll-go\ Go module fixture. Updated the Rust kernel's \Cargo.toml\ to include tree-sitter grammars for C, C++, C\#, Java, JavaScript, Lua/Luau, PHP, Python, R, Ruby, Rust, Swift, and TypeScript, with specific version pins to match the WebAssembly parsers. Updated the main \package.json\ to include \@clack/prompts\, \commander\, \fast-string-width\, \fast-wrap-ansi\, \ignore\, \jsonc-parser\, \picomatch\, \sisteransi\, \tree-sitter-wasms\, and \web-tree-sitter\. Added \site\ and \telemetry-dashboard\ and \telemetry-worker\ project configurations and lockfiles.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 58 → 42 (-15.6)
• Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

• Code Health 60 → 63 (+3.0)
• Architecture 74 → 69 (-4.6)
• Maturity 70 → 67 (-2.7)
• Readiness 53 → 24 (-29.0)
• Security 54 → 51 (-3.1)

• Boundary-crossing change coupling: tree-sitter.ts ↔ name-matcher.ts (src/extraction/tree-sitter.ts)
• Change coupling: langs.rs ↔ grammars.ts (codegraph-kernel/src/langs.rs)
• Change coupling: langs.rs ↔ index.ts (codegraph-kernel/src/langs.rs)
• Change coupling: lib.rs ↔ grammars.ts (codegraph-kernel/src/lib.rs)
• Change coupling: lib.rs ↔ index.ts (codegraph-kernel/src/lib.rs)
• Change coupling: migrations.ts ↔ queries.ts (src/db/migrations.ts)
• Change coupling: server-instructions.ts ↔ tools.ts (src/mcp/server-instructions.ts)
• Coverage not included — suite not readable by the collector
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• Further sole-owners (lower concentration)
• High CVE: [GHSA redacted] (site/package-lock.json)
• High vulnerability: [GHSA redacted] (site/package-lock.json)
• High vulnerability: [GHSA redacted] (site/package-lock.json)
• High vulnerability: [GHSA redacted] (site/package-lock.json)
• Hotspot: src/resolution/c-fnptr-synthesizer.ts (src/resolution/c-fnptr-synthesizer.ts)
• Hotspot: src/resolution/callback-synthesizer.ts (src/resolution/callback-synthesizer.ts)
• Hotspot: src/resolution/import-resolver.ts (src/resolution/import-resolver.ts)
• Hotspot: src/resolution/name-matcher.ts (src/resolution/name-matcher.ts)
• Low vulnerability: [GHSA redacted] (site/package-lock.json)
• Low vulnerability: [GHSA redacted] (telemetry-worker/package-lock.json)
• …and 2 more

• Boundary-crossing change coupling: extraction-version.ts ↔ index.ts (src/extraction/extraction-version.ts)
• Boundary-crossing change coupling: extraction-version.ts ↔ name-matcher.ts (src/extraction/extraction-version.ts)
• Boundary-crossing change coupling: index.ts ↔ tools.ts (src/context/index.ts)
• Boundary-crossing change coupling: kernel-parity.mjs ↔ grammars.ts (scripts/kernel-parity.mjs)
• Boundary-crossing change coupling: kernel-parity.mjs ↔ index.ts (scripts/kernel-parity.mjs)
• Boundary-crossing change coupling: migrations.ts ↔ index.ts (src/db/migrations.ts)
• Boundary-crossing change coupling: tree-sitter.ts ↔ index.ts (src/extraction/tree-sitter.ts)
• Change coupling: index.ts ↔ parse-worker.ts (src/extraction/index.ts)
• Dimension evaluation failed
• FileTooLong: public/panels.js (telemetry-dashboard/public/panels.js)
• High CVE: [GHSA redacted] (site/package-lock.json)
• High CVE: [GHSA redacted] (telemetry-dashboard/package-lock.json)
• High CVE: [GHSA redacted] (site/package-lock.json)
• High CVE: [GHSA redacted] (site/package-lock.json)
• High CVE: [GHSA redacted] (package-lock.json)
• High CVE: [GHSA redacted] (telemetry-worker/package-lock.json)
• High CVE: [GHSA redacted] (telemetry-worker/package-lock.json)
• High: security finding (details withheld)
• High: security finding (details withheld)
• Hotspot: tests/fixtures/tail-render-ts/src/lib/session-store.ts (tests/fixtures/tail-render-ts/src/lib/session-store.ts)
• …and 39 more

• 81 commits — 59 feature/other, 22 fixes

• scripts/agent-eval — 17 commits
• tests/fixtures — 16 commits
• (root) — 13 commits
• docs/benchmarks — 13 commits
• src/mcp — 11 commits
• docs/design — 4 commits
• tests/explore-allocation-1500.test.ts — 1 commit
• tests/explore-allocation-e2e.test.ts — 1 commit
• tests/explore-factory-closure.test.ts — 1 commit
• tests/sync-rebuild-convergence.test.ts — 1 commit
• src/db — 1 commit
• src/installer — 1 commit
• telemetry-dashboard/scripts — 1 commit

• fix: Merge pull request #1498 from colbymchenry/bugfix/CG-16
• fix: Merge pull request #1527 from colbymchenry/bugfix/CG-38
• fix: docs(benchmarks): re-derive the token figures the result.usage bug touched
• fix: docs(benchmarks): record CG-38 as open, and correct the regression claim
• fix: docs(benchmarks): record the CG-30 A/B — deterministic win, no behavioural regression
• fix: docs(benchmarks): record the CG-31 A/B — no regression, four repos stop truncating
• fix: fix(explore): a funded whole-file buy must also fit the render ceiling (CG-21)
• fix: fix(explore): bound how far an oversize cluster member may overshoot (CG-30)
• fix: fix(explore): damp ambient declaration files on flow queries (CG-28)
• fix: fix(explore): fund the guard from room that exists, and cut the epilogue first (CG-31)
• fix: fix(explore): guarantee an agent-named symbol renders, wherever it sits (CG-38)
• fix: fix(explore): hold back what is still owed below a clustered render (CG-31)
• fix: fix(explore): keep the drift warning out of the cuttable epilogue (CG-31)
• fix: fix(explore): pay every admitted file on every render path (CG-26)
• fix: fix(explore): recognize Wrangler-style "generated by … by running" banners (CG-25)
• fix: fix(explore): restore the CG-30 bound d652c14 reverted
• fix: fix(explore): shrink a later cluster into the remainder instead of dropping it (CG-36)
• fix: fix(explore): spend the reservation instead of dropping it (CG-21, #1500)
• fix: test(agent-eval): drop the duplicated fixed-overhead line (CG-7)
• fix: test(agent-eval): price codegraph's fixed context cost alongside its residual (CG-7)
• …and 61 more

• Containers 0 added · 0 removed · contexts 0 added · 2 removed · edges 0 added · 0 removed

• .
• php

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

colbymchenry/codegraph was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.