Code-Graph-RAG Files

Highlights

• Cross-project endpoint linking: client request URLs now resolve to server route handlers across projects, with support for gateway and proxy prefix rewrites, options-object route registrations, generated Go routes, and template-literal and Sprintf URL placeholders.
• RPC awareness for Go: connect-go generated client calls emit RPC sinks, and RPC clients are bound whether declared as struct fields, parameters, or aggregated across a package.
• Multi-project graphs: per-project metadata, scoped semantic search, bounded cross-project reads, and absolute-path keying for Folder and File nodes so projects no longer merge into each other.
• Cost visibility: the CLI now shows per-turn and session token usage and cost (#80).
• Findings engine: pattern, smell and security rules extended to 11 more languages, plus precision fixes for Go, Lua, Rust and Ruby rules.
• Dead-code and call-graph accuracy: a large batch of Dart getter and callback fixes, C++ constructor, destructor and prototype handling, and OS entry-point rooting for C and C++.
• Supply-chain hardening: SLSA provenance attached to release artefacts, actions pinned by hash, and the project now holds the OpenSSF Best Practices passing badge.

What's Changed

• chore: contract comments and drop (H) markers in core library by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/841
• chore: contract comments and drop remaining (H) markers in tests (part 1) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/842
• chore: contract comments in tests (part 2) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/843
• chore: remove retired (H) comment marker from non-Python files by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/844
• feat(findings): add pattern, smell and security rules for 11 more languages by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/840
• docs: align all documentation with current code by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/845
• fix(findings): eliminate Go sqli_concat and hardcoded_secret false positives by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/847
• chore: aesthetic polish tier 1 (constant dedupe, docstrings, dead-code hoist) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/846
• fix(findings): tighten Lua findings-rule precision (secret/factory/module-return/global) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/848
• fix: cross-project retrieval via absolute_path and collision-safe MCP project naming by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/849
• fix: skip live tool-calling assertions on local Ollama orchestrators by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/850
• fix: poll for the debounced flush instead of racing the timer thread by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/853
• feat: multi-project metadata, scoped semantic search, and bounded cross-project reads by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/852
• feat: link client request URLs to server route handlers across projects by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/854
• fix(endpoints): skip all-parameter templates when linking client URLs by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/856
• refactor(calls): collapse duplicated filtered-calls blocks into one helper by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/851
• fix(findings): anchor rust command_new and ruby swallowed_rescue to end stopBy over-match by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/855
• fix(graph): drop unanchored shared Resource and ExternalModule nodes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/857
• refactor: extract FunctionRegistryTrie and BoundedASTCache into own modules by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/860
• fix(vector): purge the vector store when the graph database is cleaned by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/858
• fix(vector): close the vector store client at exit instead of interpreter shutdown by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/861
• feat: show per-turn and session token usage and cost (#80) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/862
• fix(updater): discard the hash cache when the graph no longer holds the project by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/863
• fix(dart): reference tear-off callback arguments so dead-code keeps them by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/865
• fix(index): ignore android .cxx and dart .dart_tool build caches by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/868
• fix(dart): root dead-code at @override methods of external bases by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/864
• fix(deadcode): root c and c++ os entry points by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/867
• fix(updater): delete prior module subtrees on a cacheless rebuild of an indexed project by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/866
• feat(dart): track getter reads as REFERENCES so read-only getters stop reporting dead by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/870
• fix(dart): reference getters read from class field initializers by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/872
• fix(dart): receiver-position getter reads and ternary arguments swallowed by low-precedence operators by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/874
• fix: interpolated string resources keep placeholders instead of truncating by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/880
• fix: gate endpoint links on sink direction compatibility by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/881
• fix: resolve router and blueprint mount prefixes into endpoint templates by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/882
• fix: scope endpoint identity by project and honour the URL host when linking by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/883
• fix: render JS template-literal substitutions as URL placeholders by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/887
• fix(dart): bind undeclared receivers via the external base's type arguments by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/889
• feat: extract call-registered routes into endpoint resources by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/890
• fix: render Go Sprintf format verbs as URL placeholders by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/888
• fix(cpp): recover declaration-shaped stack constructions into ctor calls by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/891
• fix(cpp): emit implicit base ctor and dtor lifecycle calls by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/894
• fix(cpp): drop free-function prototypes duplicating bodied definitions by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/895
• docs: add SkillsLLM security check badge to README by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/899
• docs: enable Codecov, SonarCloud, Scorecard, PyPI and CI badges in README by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/900
• fix: key Folder and File nodes on absolute path to stop cross-project merging by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/898
• fix(cpp): singleton accessor chain loses both onward edges by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/901
• fix: harden shell tests against slow Windows spawns and surface timeout cause by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/903
• fix(shell): surface spawn errors with failing segment and executable by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/904
• fix: resolve SonarCloud new-code quality gate failures by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/906
• fix: test modules must not emit ENDPOINT resources by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/916
• ci: pin split-score actions by hash and attach SLSA provenance to releases by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/918
• fix: extract options-object route registrations (app.endpoint, fastify/hapi route) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/914
• fix: accept rootful relative URLs as RESOLVES_TO candidates by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/915
• feat: prefix-tolerant endpoint matching for gateway and proxy rewrites by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/919
• fix: extract generated Go routes (const-concat paths, attribute handlers) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/917
• fix: accept object method shorthand as options-object handler evidence by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/921
• feat: tolerate bounded mount prefixes on the template side by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/924
• fix: link same-path multi-method groups from inferred matches by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/926
• feat: emit RPC sinks for connect-go generated client calls by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/927
• feat: bind RPC clients declared as struct fields and parameters by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/928
• feat: aggregate RPC client fields across a Go package by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/929
• docs: add OpenSSF Best Practices badge to README by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/932
• ci: push version bumps with a deploy key instead of GITHUB_TOKEN by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/933

Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.0.421...v0.0.484