Adds a CBM_WORKERS env knob (clamped to [1, 256], invalid values warned
and ignored) that explicitly sets the parallel-indexing worker count.
In containers, sysconf(_SC_NPROCESSORS_ONLN) reports host CPUs rather
than the cgroup's effective quota, so a 1-vCPU pod on a 16-core node
otherwise spawns ~16 workers — the dominant OOMKill driver. When unset,
behaviour is unchanged.
From #364.
- New top-level "Hybrid LSP" section above "Language Support" with a
short explanation of why tree-sitter alone is insufficient, what the
clean-room LSP layer does, a per-language coverage table (Python,
TS/JS/JSX/TSX, PHP, C#, Go, C/C++) marking what's new in v0.7.0 and
what was sharpened, and the two-layer architecture.
- Hero paragraph + indexing-pipeline bullet now list the full v0.7.0
Hybrid-LSP language set and link to the new section.
- Tests badge bumped 2812 → 3615 (from the ubuntu-latest CI log of the
published v0.7.0 release run).
- New "Hybrid LSP — 6 languages" badge linking to the new section.
- VirusTotal click-through badge + per-binary scans table refreshed to
the v0.7.0 binaries (linux-amd64/arm64, darwin-amd64/arm64,
windows-amd64) using the hashes from the published release body.
The previous PreToolUse hook gated Grep/Glob/Read/Search with 'exit 2'
on the first call per session, which broke Claude Code's
read-before-edit invariant (issue #362) and could deny tool calls under
upgrade/missing-binary failure modes.
Replace it with a structurally non-blocking augmenter:
- New 'codebase-memory-mcp hook-augment' subcommand reads the hook JSON
from stdin and, for Grep/Glob, queries search_graph (in-process, no
shell) and emits hookSpecificOutput.additionalContext. Every failure
path (no project, short token, missing binary, slow query, timeout)
exits 0 with no stdout — the hook physically cannot block a tool call.
- 300 ms SIGALRM/_exit(0) in-process deadline; 5 s settings.json timeout
backstop. Output is written exactly once at the very end, so a
mid-work timeout yields a clean no-op (never partial JSON).
- Matcher narrowed to 'Grep|Glob' (Read explicitly excluded) for Claude;
Gemini matcher narrowed to 'google_search|grep_search' (excludes
read_file) for the same reason.
- The installed shim is a thin wrapper that delegates to the binary;
legacy filename 'cbm-code-discovery-gate' is kept so existing
settings.json entries upgrade with zero migration. Installer refuses
to embed binary paths containing a double quote (shim injection
defense).
- Per-agent 'old matchers' lists let upsert/remove clean up historical
matcher strings during upgrade.
- Smoke tests (8d/8e/8l) updated to assert the new behavior and
regress-test against re-introducing Read in the matcher or 'exit 2'
in the shim.
- Session reminder text updated: 'always Read a file before editing it'
replaces the prior 'fall back to Read only for text content'.
(cherry picked from commit f72c8e68c4d91e52911a569a967ad782ce5472b2)
Adds an Arch Linux install section to the README pointing at the community-maintained `codebase-memory-mcp-bin` AUR package, with both yay and paru one-liners. README-only change.
- README badges: languages 66->155, agents 10->11, tests 2586->2812 (actual count from v0.6.1 test run)
- README: VirusTotal table, primary VT badge link, all '66 languages' references, expanded language list with all newly added grammars
- server.json: bump 0.5.5->0.6.1 (was two releases behind), update all download URLs and sha256s
- pkg/scoop, homebrew, aur, chocolatey, winget: bump to 0.6.1 with new sha256s from v0.6.1 checksums.txt
- pkg/winget: new 0.6.1/ manifest directory (winget keeps version history; 0.6.0/ retained)
- pkg/npm/README: language and agent counts
Adds per-label/type property key discovery via json_each() so users can
see which properties are available for Cypher queries without trial and
error. Base columns listed first, JSON keys appended (capped at 50).
Closes#179.
Based on #181 by dLo999.
Co-Authored-By: Dustin Obrecht <dustin@kurtnoble.com>
Detect ~/.kiro/ directory, auto-configure MCP at ~/.kiro/settings/mcp.json
using standard mcpServers format. Adds install, uninstall, detection, and test.
Based on #174 by dLo999, rebased onto refactored install infrastructure.
Co-Authored-By: Dustin Obrecht <dustin@kurtnoble.com>
- SECURITY.md: new Transparency & Disclaimer section at the top with
honest description of filesystem access patterns and liability scope;
new Help Us Stay Secure section actively inviting security research
with a defined scope and promise of fast response + public credit
- README.md: Security & Trust callout after the intro paragraph — brief,
direct, links to SECURITY.md for full context
checksums.txt contains hashes of .tar.gz/.zip archives; VirusTotal
indexes the extracted binaries. Updated README table and badge to use
correct binary SHA-256 hashes for v0.6.0. Updated release.yml to hash
extracted binaries from the binaries/ directory for future releases.
- Adds VirusTotal (0/72) and SLSA Level 3 badges to the header
- Adds Security section with per-binary VirusTotal scan links for v0.6.0
- Adds step in release.yml to auto-append a Security Verification table
with per-binary VirusTotal links to every release's notes going forward
Compute K=64 MinHash signatures from normalized AST node-type trigrams
during function extraction, then generate SIMILAR_TO edges via LSH
(b=32, r=2) for function pairs with Jaccard >= 0.95.
- src/simhash/minhash.{h,c}: MinHash compute, Jaccard, hex encode/decode,
LSH index with band hashing for O(n) candidate generation
- src/pipeline/pass_similarity.c: post-pass reads fingerprints from node
properties, builds LSH index, emits SIMILAR_TO edges with jaccard and
same_file metadata. Same-language only, max 10 edges per node.
- internal/cbm/cbm.h: fingerprint fields on CBMDefinition
- internal/cbm/extract_defs.c: compute_fingerprint() hook at 3 extraction
sites after complexity, skip functions with < 10 AST body nodes
- pass_definitions.c + pass_parallel.c: serialize fingerprint to "fp" hex
in properties_json for both sequential and parallel pipeline paths
- pipeline.c + pipeline_incremental.c: register pass_similarity in both
full and incremental post-pass lists
- tests/test_simhash.c: 28 tests across 4 suites (core, LSH, edge gen,
pipeline integration with generated Go project + incremental)
install.sh: one-liner for macOS/Linux — detects OS/arch (Rosetta-
aware), downloads release, verifies checksum, extracts, signs on
macOS, runs install -y for all 10 agents. Supports --ui flag and
CBM_DOWNLOAD_URL env var for testing.
install.ps1: one-liner for Windows — Invoke-WebRequest + Expand-
Archive + Unblock-File (strips MOTW), installs to %LOCALAPPDATA%,
adds to user PATH via [Environment]::SetEnvironmentVariable.
CI pre-signing: add codesign --sign - step for macOS builds in
both dry-run.yml and release.yml, before archiving. Release
binaries now ship pre-signed.
Phase 12 smoke tests: real HTTP download via local artifact server,
checksum verification, archive extraction, binary verification.
Runs only when SMOKE_DOWNLOAD_URL is set (CI provides it).
Phase 13 smoke tests: install.sh E2E — runs full script with local
URL + isolated HOME, verifies binary placed, signed, runs, and
agent configs created.
CI HTTP server: smoke jobs start python3 HTTP server serving the
built binary as a tar.gz/zip archive + checksums.txt. Enables
Phases 12-13 in CI on all platforms.
Update security allowlist: remove system() entry (eliminated),
add cbm_popen for pgrep. Update README with one-liner Quick Start.
- clang-format: fix alignment in userconfig.c and userconfig.h
- Magic number 1280 → PATH_BUF_SZ named constant
- Remove dead g-- before break in dedup loop (cppcheck)
- Add "Custom File Extensions" section to README documenting
.codebase-memory.json and global config
- OpenClaw: detect ~/.openclaw/, write MCP config to openclaw.json
- VS Code was already wired in PR #79 but not counted in README
- Agent struct initializer uses memset instead of counting booleans
- README updated: 8 → 10 agents
- Add field('path', ...) to Magma load_statement grammar rule so
parse_generic_imports() finds the import path via field lookup
instead of the broken text fallback (which only extracted 1 per file)
- Fix passImports() to resolve file-path imports (e.g. "utils.mag",
"lib/helpers.h") via fqn.ModuleQN() when raw path doesn't match
any node QN — general fix benefiting any file-path-based import
- Add TestMagmaImport_Regression and TestMagmaCall_Regression
- Update language count 59 → 63 in README, docs/index.html, marketing
- Languages: 35 -> 59
- Add Gemini CLI, VS Code, Zed to supported clients list
- Update benchmark description to match v7 methodology
- Update meta tags and comparison table
- Replace Go-binding tree-sitter with vendored C grammars compiled via
CGo (internal/cbm/); eliminates all Go module/linker fragility
- Add 32 new languages: Clojure, CMake, COBOL, Common Lisp, CUDA, Elm,
Emacs Lisp, Fortran, F#, GLSL, GraphQL, INI, JSON, Julia, Makefile,
Markdown, Meson, Nix, Protobuf, Svelte, Verilog, Vim Script, Vue, XML
(plus C, C#, Erlang, SQL, YAML quality improvements)
- Adaptive worker concurrency and mmap prefetch for faster indexing
- Graph buffer: batched SQLite writes for 3-5x throughput improvement
- Fix cancellation test: use 50ms timeout (pipeline now indexes 212-file
Erlang repo in ~400ms, well under the old 2s deadline)
- Fix isTestFunction: add "Test" prefix for C#, "test" prefix for Scala
New tools:
- get_architecture: codebase architecture overview with 12 selectable aspects
(languages, packages, entry_points, routes, hotspots, boundaries, services,
layers, clusters, file_tree, adr)
- manage_adr: CRUD for Architecture Decision Records with 6 fixed sections,
section filtering, validation, and discovery of existing architecture docs
Architecture analysis fixes:
- Fix qnToPackage extracting segment[2] for meaningful sub-packages instead
of segment[1] which collapsed everything to top-level dirs
- Filter test functions from entry_points, hotspots, and routes using both
is_test property (Module/File nodes) and file_path pattern matching
- Filter boundaries to Function/Method/Class nodes only
- Add FindArchitectureDocs for discovering existing architecture documentation
Naming corrections:
- Rename Leiden to Louvain throughout (algorithm is simplified Louvain,
not actual Leiden which requires CPM-based refinement)
- leiden.go -> louvain.go with all symbols renamed
- Remove unused ClusterInfo.Modularity field (always zero)
Other changes:
- Case-insensitive search by default for search_graph and search_code
- Remove read_file and list_directory tools (handled by coding agents natively)
- Update tool descriptions and README for 8000 char ADR limit
- Release workflow: build binary as `codebase-memory-mcp` (not
`codebase-memory-mcp-<os>-<arch>`) inside tarballs. Users extract
and get the correct name without renaming.
- Codex CLI: replace broken `codex mcp add/remove` calls with direct
config.toml manipulation. Codex uses [mcp_servers.<name>] sections,
not CLI subcommands.
- README: add explicit extract-and-move step to Quick Start.
- Feature line: list all 35 languages including Obj-C, Swift, Dart,
Perl, Groovy, Erlang, R, SCSS, SQL, Dockerfile
- Performance section: updated with Django (49K nodes) and Linux
kernel stress test numbers from the v0.3.0 benchmark
- Architecture section: 25 → 35 language specs
- Token efficiency: reference 35 real-world repos instead of single project
Add CLI mode for direct tool invocation from the shell — every MCP tool
can now be called without an MCP client. Useful for testing, scripting,
and CI pipelines.
Query engine rewrite: SQL LIKE pre-filtering extracts literal substrings
from regex patterns before scanning, batch degree counting replaces
per-node queries, and schema queries use id→label maps instead of 3-way
JOINs. Cypher relationship queries up to 600x faster on large graphs.
Incremental reindex 4x faster via content-hash skip optimization.
Upgrade to Go 1.26 (Green Tea GC) and SQLite v1.46.1.
Auto-sync: background watcher polls indexed projects for file changes
(mtime+size) and triggers incremental re-indexing automatically. Adaptive
polling interval scales with repo size (1s-60s). Non-blocking — uses
TryLock to skip if manual index_repository is in progress.
WithTransaction: changed signature to return a transaction-scoped Store
instead of mutating the shared querier field. Eliminates a data race
where concurrent read handlers could use a committed transaction.
Infrastructure file indexing: new pipeline pass indexes Dockerfiles,
docker-compose, cloudbuild, .env, Terraform, and YAML config files as
InfraFile nodes with structured properties.
Also includes: indexMu mutex on Server for safe concurrent access,
Claude Code skill file in repo, updated README with auto-sync docs.
Lead with pre-built binary download (no toolchain needed), then setup
scripts for automation, then build-from-source for contributors.
- Add platform table with all 5 targets including linux-arm64
- Add Windows SmartScreen guidance for unsigned binary
- Document checksums.txt for integrity verification
- Credit @Flipper1994 for WSL2 workaround (closes#1)
MCP server that indexes codebases into a queryable knowledge graph.
Single Go binary, SQLite storage, 12 languages via tree-sitter.
Features: call graph, cross-service HTTP linking, dead code detection,
route nodes, Cypher queries, incremental reindex, JSON config scanning.
yangsec888