vitali87/code-graph-rag v0.0.484

on GitHub

Highlights

• Cross-project endpoint linking: client request URLs now resolve to server route handlers across projects, with support for gateway and proxy prefix rewrites, options-object route registrations, generated Go routes, and template-literal and Sprintf URL placeholders.
• RPC awareness for Go: connect-go generated client calls emit RPC sinks, and RPC clients are bound whether declared as struct fields, parameters, or aggregated across a package.
• Multi-project graphs: per-project metadata, scoped semantic search, bounded cross-project reads, and absolute-path keying for Folder and File nodes so projects no longer merge into each other.
• Cost visibility: the CLI now shows per-turn and session token usage and cost (#80).
• Findings engine: pattern, smell and security rules extended to 11 more languages, plus precision fixes for Go, Lua, Rust and Ruby rules.
• Dead-code and call-graph accuracy: a large batch of Dart getter and callback fixes, C++ constructor, destructor and prototype handling, and OS entry-point rooting for C and C++.
• Supply-chain hardening: SLSA provenance attached to release artefacts, actions pinned by hash, and the project now holds the OpenSSF Best Practices passing badge.

What's Changed

• chore: contract comments and drop (H) markers in core library by @vitali87 in #841
• chore: contract comments and drop remaining (H) markers in tests (part 1) by @vitali87 in #842
• chore: contract comments in tests (part 2) by @vitali87 in #843
• chore: remove retired (H) comment marker from non-Python files by @vitali87 in #844
• feat(findings): add pattern, smell and security rules for 11 more languages by @vitali87 in #840
• docs: align all documentation with current code by @vitali87 in #845
• fix(findings): eliminate Go sqli_concat and hardcoded_secret false positives by @vitali87 in #847
• chore: aesthetic polish tier 1 (constant dedupe, docstrings, dead-code hoist) by @vitali87 in #846
• fix(findings): tighten Lua findings-rule precision (secret/factory/module-return/global) by @vitali87 in #848
• fix: cross-project retrieval via absolute_path and collision-safe MCP project naming by @vitali87 in #849
• fix: skip live tool-calling assertions on local Ollama orchestrators by @vitali87 in #850
• fix: poll for the debounced flush instead of racing the timer thread by @vitali87 in #853
• feat: multi-project metadata, scoped semantic search, and bounded cross-project reads by @vitali87 in #852
• feat: link client request URLs to server route handlers across projects by @vitali87 in #854
• fix(endpoints): skip all-parameter templates when linking client URLs by @vitali87 in #856
• refactor(calls): collapse duplicated filtered-calls blocks into one helper by @vitali87 in #851
• fix(findings): anchor rust command_new and ruby swallowed_rescue to end stopBy over-match by @vitali87 in #855
• fix(graph): drop unanchored shared Resource and ExternalModule nodes by @vitali87 in #857
• refactor: extract FunctionRegistryTrie and BoundedASTCache into own modules by @vitali87 in #860
• fix(vector): purge the vector store when the graph database is cleaned by @vitali87 in #858
• fix(vector): close the vector store client at exit instead of interpreter shutdown by @vitali87 in #861
• feat: show per-turn and session token usage and cost (#80) by @vitali87 in #862
• fix(updater): discard the hash cache when the graph no longer holds the project by @vitali87 in #863
• fix(dart): reference tear-off callback arguments so dead-code keeps them by @vitali87 in #865
• fix(index): ignore android .cxx and dart .dart_tool build caches by @vitali87 in #868
• fix(dart): root dead-code at @OverRide methods of external bases by @vitali87 in #864
• fix(deadcode): root c and c++ os entry points by @vitali87 in #867
• fix(updater): delete prior module subtrees on a cacheless rebuild of an indexed project by @vitali87 in #866
• feat(dart): track getter reads as REFERENCES so read-only getters stop reporting dead by @vitali87 in #870
• fix(dart): reference getters read from class field initializers by @vitali87 in #872
• fix(dart): receiver-position getter reads and ternary arguments swallowed by low-precedence operators by @vitali87 in #874
• fix: interpolated string resources keep placeholders instead of truncating by @vitali87 in #880
• fix: gate endpoint links on sink direction compatibility by @vitali87 in #881
• fix: resolve router and blueprint mount prefixes into endpoint templates by @vitali87 in #882
• fix: scope endpoint identity by project and honour the URL host when linking by @vitali87 in #883
• fix: render JS template-literal substitutions as URL placeholders by @vitali87 in #887
• fix(dart): bind undeclared receivers via the external base's type arguments by @vitali87 in #889
• feat: extract call-registered routes into endpoint resources by @vitali87 in #890
• fix: render Go Sprintf format verbs as URL placeholders by @vitali87 in #888
• fix(cpp): recover declaration-shaped stack constructions into ctor calls by @vitali87 in #891
• fix(cpp): emit implicit base ctor and dtor lifecycle calls by @vitali87 in #894
• fix(cpp): drop free-function prototypes duplicating bodied definitions by @vitali87 in #895
• docs: add SkillsLLM security check badge to README by @vitali87 in #899
• docs: enable Codecov, SonarCloud, Scorecard, PyPI and CI badges in README by @vitali87 in #900
• fix: key Folder and File nodes on absolute path to stop cross-project merging by @vitali87 in #898
• fix(cpp): singleton accessor chain loses both onward edges by @vitali87 in #901
• fix: harden shell tests against slow Windows spawns and surface timeout cause by @vitali87 in #903
• fix(shell): surface spawn errors with failing segment and executable by @vitali87 in #904
• fix: resolve SonarCloud new-code quality gate failures by @vitali87 in #906
• fix: test modules must not emit ENDPOINT resources by @vitali87 in #916
• ci: pin split-score actions by hash and attach SLSA provenance to releases by @vitali87 in #918
• fix: extract options-object route registrations (app.endpoint, fastify/hapi route) by @vitali87 in #914
• fix: accept rootful relative URLs as RESOLVES_TO candidates by @vitali87 in #915
• feat: prefix-tolerant endpoint matching for gateway and proxy rewrites by @vitali87 in #919
• fix: extract generated Go routes (const-concat paths, attribute handlers) by @vitali87 in #917
• fix: accept object method shorthand as options-object handler evidence by @vitali87 in #921
• feat: tolerate bounded mount prefixes on the template side by @vitali87 in #924
• fix: link same-path multi-method groups from inferred matches by @vitali87 in #926
• feat: emit RPC sinks for connect-go generated client calls by @vitali87 in #927
• feat: bind RPC clients declared as struct fields and parameters by @vitali87 in #928
• feat: aggregate RPC client fields across a Go package by @vitali87 in #929
• docs: add OpenSSF Best Practices badge to README by @vitali87 in #932
• ci: push version bumps with a deploy key instead of GITHUB_TOKEN by @vitali87 in #933

Full Changelog: v0.0.421...v0.0.484