@codragraph/cli 1.6.2

package/dist/cli/clean.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Clean Command
+ *
+ * Removes the .codragraph index from the current repository.
+ * Also unregisters it from the global registry.
+ */
+export declare const cleanCommand: (options?: {
+    force?: boolean;
+    all?: boolean;
+}) => Promise<void>;

package/dist/cli/clean.js

@@ -0,0 +1,78 @@
+/**
+ * Clean Command
+ *
+ * Removes the .codragraph index from the current repository.
+ * Also unregisters it from the global registry.
+ */
+import fs from 'fs/promises';
+import { findRepo, unregisterRepo, listRegisteredRepos, assertSafeStoragePath, UnsafeStoragePathError, } from '../storage/repo-manager.js';
+export const cleanCommand = async (options) => {
+    // --all flag: clean all indexed repos
+    if (options?.all) {
+        if (!options?.force) {
+            const entries = await listRegisteredRepos();
+            if (entries.length === 0) {
+                console.log('No indexed repositories found.');
+                return;
+            }
+            console.log(`This will delete CodraGraph indexes for ${entries.length} repo(s):`);
+            for (const entry of entries) {
+                console.log(`  - ${entry.name} (${entry.path})`);
+            }
+            console.log('\nRun with --force to confirm deletion.');
+            return;
+        }
+        const entries = await listRegisteredRepos();
+        for (const entry of entries) {
+            // Safety guard (#1003 review — @magyargergo): same rationale as
+            // remove.ts. `~/.codragraph/registry.json` is user-writable, so a
+            // corrupted or hand-edited entry could point storagePath at the
+            // repo root, an empty string, or anywhere else — and
+            // fs.rm(recursive: true) on any of those would be catastrophic.
+            // Skip poisoned entries without touching disk, but keep going
+            // through the rest of the registry (preserves the existing
+            // per-repo error-tolerance semantics of `clean --all`).
+            try {
+                assertSafeStoragePath(entry);
+            }
+            catch (err) {
+                if (err instanceof UnsafeStoragePathError) {
+                    console.error(`Refusing to clean ${entry.name}: ${err.message}`);
+                    continue;
+                }
+                throw err;
+            }
+            try {
+                await fs.rm(entry.storagePath, { recursive: true, force: true });
+                await unregisterRepo(entry.path);
+                console.log(`Deleted: ${entry.name} (${entry.storagePath})`);
+            }
+            catch (err) {
+                console.error(`Failed to delete ${entry.name}:`, err);
+            }
+        }
+        return;
+    }
+    // Default: clean current repo
+    const cwd = process.cwd();
+    const repo = await findRepo(cwd);
+    if (!repo) {
+        console.log('No indexed repository found in this directory.');
+        return;
+    }
+    const repoName = repo.repoPath.split(/[/\\]/).pop() || repo.repoPath;
+    if (!options?.force) {
+        console.log(`This will delete the CodraGraph index for: ${repoName}`);
+        console.log(`   Path: ${repo.storagePath}`);
+        console.log('\nRun with --force to confirm deletion.');
+        return;
+    }
+    try {
+        await fs.rm(repo.storagePath, { recursive: true, force: true });
+        await unregisterRepo(repo.repoPath);
+        console.log(`Deleted: ${repo.storagePath}`);
+    }
+    catch (err) {
+        console.error('Failed to delete:', err);
+    }
+};

package/dist/cli/config.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `codragraph config` CLI subcommands — manage the unified
+ * `~/.codragraph/config.json`. The file is shared by:
+ *   - the codragraph CLI (wiki, semantic ops)
+ *   - the codragraph-harness inference providers
+ *   - the web settings panel (writes via /api/config)
+ *
+ * Subcommands:
+ *   codragraph config list                          show configured providers
+ *   codragraph config get <provider>                show one provider's settings (key redacted)
+ *   codragraph config set <provider> --api-key <K>  store a key
+ *   codragraph config set <provider> --base-url <U> --model <M>
+ *   codragraph config remove <provider>             clear one provider
+ *   codragraph config path                          print the config-file path
+ */
+export declare const configListCommand: () => Promise<void>;
+export declare const configGetCommand: (provider: string) => Promise<void>;
+export interface ConfigSetOpts {
+    apiKey?: string;
+    baseUrl?: string;
+    model?: string;
+    apiVersion?: string;
+    reasoningModel?: boolean;
+}
+export declare const configSetCommand: (provider: string, opts: ConfigSetOpts) => Promise<void>;
+export declare const configRemoveCommand: (provider: string) => Promise<void>;
+export declare const configPathCommand: () => Promise<void>;

package/dist/cli/config.js

@@ -0,0 +1,106 @@
+/**
+ * `codragraph config` CLI subcommands — manage the unified
+ * `~/.codragraph/config.json`. The file is shared by:
+ *   - the codragraph CLI (wiki, semantic ops)
+ *   - the codragraph-harness inference providers
+ *   - the web settings panel (writes via /api/config)
+ *
+ * Subcommands:
+ *   codragraph config list                          show configured providers
+ *   codragraph config get <provider>                show one provider's settings (key redacted)
+ *   codragraph config set <provider> --api-key <K>  store a key
+ *   codragraph config set <provider> --base-url <U> --model <M>
+ *   codragraph config remove <provider>             clear one provider
+ *   codragraph config path                          print the config-file path
+ */
+import { getGlobalConfigPath, getProviderConfig, listProviderConfigs, loadCLIConfig, removeProviderConfig, setProviderConfig, } from '../storage/repo-manager.js';
+const VALID_PROVIDERS = [
+    'claude',
+    'openai',
+    'opencode',
+    'openrouter',
+    'azure',
+    'cursor',
+    'custom',
+];
+const validateProvider = (raw) => {
+    if (!VALID_PROVIDERS.includes(raw)) {
+        throw new Error(`Unknown provider "${raw}". Valid: ${VALID_PROVIDERS.join(', ')}`);
+    }
+    return raw;
+};
+const redactKey = (key) => {
+    if (!key)
+        return '(unset)';
+    if (key.length <= 8)
+        return '****';
+    return `${key.slice(0, 4)}…${key.slice(-4)}`;
+};
+export const configListCommand = async () => {
+    const entries = await listProviderConfigs();
+    if (entries.length === 0) {
+        console.log(`(no providers configured — set one with: codragraph config set <provider> --api-key <KEY>)`);
+        console.log(`config file: ${getGlobalConfigPath()}`);
+        return;
+    }
+    console.log('provider'.padEnd(12), 'apiKey'.padEnd(8), 'model'.padEnd(28), 'baseUrl');
+    for (const e of entries) {
+        console.log(e.name.padEnd(12), (e.hasKey ? 'set' : '(unset)').padEnd(8), (e.model ?? '—').padEnd(28), e.baseUrl ?? '—');
+    }
+    console.log('');
+    console.log(`config file: ${getGlobalConfigPath()}`);
+};
+export const configGetCommand = async (provider) => {
+    const name = validateProvider(provider);
+    const config = await loadCLIConfig();
+    const cfg = getProviderConfig(config, name);
+    if (!cfg) {
+        console.log(`(${name}: not configured)`);
+        return;
+    }
+    console.log(`${name}:`);
+    console.log(`  apiKey:  ${redactKey(cfg.apiKey)}`);
+    if (cfg.model)
+        console.log(`  model:   ${cfg.model}`);
+    if (cfg.baseUrl)
+        console.log(`  baseUrl: ${cfg.baseUrl}`);
+    if (cfg.apiVersion)
+        console.log(`  apiVersion: ${cfg.apiVersion}`);
+    if (cfg.isReasoningModel !== undefined)
+        console.log(`  isReasoningModel: ${cfg.isReasoningModel}`);
+};
+export const configSetCommand = async (provider, opts) => {
+    const name = validateProvider(provider);
+    const patch = {};
+    if (opts.apiKey !== undefined)
+        patch.apiKey = opts.apiKey;
+    if (opts.baseUrl !== undefined)
+        patch.baseUrl = opts.baseUrl;
+    if (opts.model !== undefined)
+        patch.model = opts.model;
+    if (opts.apiVersion !== undefined)
+        patch.apiVersion = opts.apiVersion;
+    if (opts.reasoningModel !== undefined)
+        patch.isReasoningModel = opts.reasoningModel;
+    if (Object.keys(patch).length === 0) {
+        console.error('Nothing to set. Pass at least one of: --api-key, --base-url, --model, --api-version, --reasoning-model');
+        process.exitCode = 1;
+        return;
+    }
+    await setProviderConfig(name, patch);
+    console.log(`✓ ${name} updated`);
+    if (patch.apiKey)
+        console.log(`  apiKey:  ${redactKey(patch.apiKey)}`);
+    if (patch.model)
+        console.log(`  model:   ${patch.model}`);
+    if (patch.baseUrl)
+        console.log(`  baseUrl: ${patch.baseUrl}`);
+};
+export const configRemoveCommand = async (provider) => {
+    const name = validateProvider(provider);
+    await removeProviderConfig(name);
+    console.log(`✓ ${name} cleared from ${getGlobalConfigPath()}`);
+};
+export const configPathCommand = async () => {
+    console.log(getGlobalConfigPath());
+};

package/dist/cli/eval-server.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Eval Server — Lightweight HTTP server for SWE-bench evaluation
+ *
+ * Keeps LadybugDB warm in memory so tool calls from the agent are near-instant.
+ * Designed to run inside Docker containers during SWE-bench evaluation.
+ *
+ * KEY DESIGN: Returns LLM-friendly text, not raw JSON.
+ * Raw JSON wastes tokens and is hard for models to parse. The text formatter
+ * converts structured results into compact, readable output that models
+ * can immediately act on. Next-step hints guide the agent through a
+ * productive tool-chaining workflow (query → context → impact → fix).
+ *
+ * Architecture:
+ *   Agent bash cmd → curl localhost:PORT/tool/query → eval-server → LocalBackend → format → text
+ *
+ * Usage:
+ *   codragraph eval-server                    # default port 4848
+ *   codragraph eval-server --port 4848        # explicit port
+ *   codragraph eval-server --idle-timeout 300 # auto-shutdown after 300s idle
+ *
+ * API:
+ *   POST /tool/:name   — Call a tool. Body is JSON arguments. Returns formatted text.
+ *   GET  /health       — Health check. Returns {"status":"ok","repos":[...]}
+ *   POST /shutdown     — Graceful shutdown.
+ */
+export interface EvalServerOptions {
+    port?: string;
+    idleTimeout?: string;
+}
+export declare function formatQueryResult(result: any): string;
+export declare function formatContextResult(result: any): string;
+export declare function formatImpactResult(result: any): string;
+export declare function formatCypherResult(result: any): string;
+export declare function formatDetectChangesResult(result: any): string;
+export declare function formatListReposResult(result: any): string;
+export declare function evalServerCommand(options?: EvalServerOptions): Promise<void>;
+export declare const MAX_BODY_SIZE: number;

package/dist/cli/eval-server.js

@@ -0,0 +1,398 @@
+/**
+ * Eval Server — Lightweight HTTP server for SWE-bench evaluation
+ *
+ * Keeps LadybugDB warm in memory so tool calls from the agent are near-instant.
+ * Designed to run inside Docker containers during SWE-bench evaluation.
+ *
+ * KEY DESIGN: Returns LLM-friendly text, not raw JSON.
+ * Raw JSON wastes tokens and is hard for models to parse. The text formatter
+ * converts structured results into compact, readable output that models
+ * can immediately act on. Next-step hints guide the agent through a
+ * productive tool-chaining workflow (query → context → impact → fix).
+ *
+ * Architecture:
+ *   Agent bash cmd → curl localhost:PORT/tool/query → eval-server → LocalBackend → format → text
+ *
+ * Usage:
+ *   codragraph eval-server                    # default port 4848
+ *   codragraph eval-server --port 4848        # explicit port
+ *   codragraph eval-server --idle-timeout 300 # auto-shutdown after 300s idle
+ *
+ * API:
+ *   POST /tool/:name   — Call a tool. Body is JSON arguments. Returns formatted text.
+ *   GET  /health       — Health check. Returns {"status":"ok","repos":[...]}
+ *   POST /shutdown     — Graceful shutdown.
+ */
+import http from 'http';
+import { writeSync } from 'node:fs';
+import { LocalBackend } from '../mcp/local/local-backend.js';
+// ─── Text Formatters ──────────────────────────────────────────────────
+// Convert structured JSON results into compact, LLM-friendly text.
+// Design: minimize tokens, maximize actionability.
+export function formatQueryResult(result) {
+    if (result.error)
+        return `Error: ${result.error}`;
+    const lines = [];
+    const processes = result.processes || [];
+    const symbols = result.process_symbols || [];
+    const defs = result.definitions || [];
+    if (processes.length === 0 && defs.length === 0) {
+        return 'No matching execution flows found. Try a different search term or use grep.';
+    }
+    lines.push(`Found ${processes.length} execution flow(s):\n`);
+    for (let i = 0; i < processes.length; i++) {
+        const p = processes[i];
+        lines.push(`${i + 1}. ${p.summary} (${p.step_count} steps, ${p.symbol_count} symbols)`);
+        // Show symbols belonging to this process
+        const procSymbols = symbols.filter((s) => s.process_id === p.id);
+        for (const s of procSymbols.slice(0, 6)) {
+            const loc = s.startLine ? `:${s.startLine}` : '';
+            lines.push(`   ${s.type} ${s.name} → ${s.filePath}${loc}`);
+        }
+        if (procSymbols.length > 6) {
+            lines.push(`   ... and ${procSymbols.length - 6} more`);
+        }
+        lines.push('');
+    }
+    if (defs.length > 0) {
+        lines.push(`Standalone definitions:`);
+        for (const d of defs.slice(0, 8)) {
+            lines.push(`  ${d.type || 'Symbol'} ${d.name} → ${d.filePath || '?'}`);
+        }
+        if (defs.length > 8)
+            lines.push(`  ... and ${defs.length - 8} more`);
+    }
+    return lines.join('\n').trim();
+}
+export function formatContextResult(result) {
+    if (result.error)
+        return `Error: ${result.error}`;
+    if (result.status === 'ambiguous') {
+        const lines = [
+            `Multiple symbols named '${result.candidates?.[0]?.name || '?'}'. Disambiguate with file path:\n`,
+        ];
+        for (const c of result.candidates || []) {
+            lines.push(`  ${c.kind} ${c.name} → ${c.filePath}:${c.line || '?'}  (uid: ${c.uid})`);
+        }
+        lines.push(`\nRe-run: codragraph-context "${result.candidates?.[0]?.name}" "<file_path>"`);
+        return lines.join('\n');
+    }
+    const sym = result.symbol;
+    if (!sym)
+        return 'Symbol not found.';
+    const lines = [];
+    const loc = sym.startLine ? `:${sym.startLine}-${sym.endLine}` : '';
+    lines.push(`${sym.kind} ${sym.name} → ${sym.filePath}${loc}`);
+    lines.push('');
+    // Incoming refs (who calls/imports/extends this)
+    const incoming = result.incoming || {};
+    const incomingCount = Object.values(incoming).reduce((sum, arr) => sum + arr.length, 0);
+    if (incomingCount > 0) {
+        lines.push(`Called/imported by (${incomingCount}):`);
+        for (const [relType, refs] of Object.entries(incoming)) {
+            for (const ref of refs.slice(0, 10)) {
+                lines.push(`  ← [${relType}] ${ref.kind} ${ref.name} → ${ref.filePath}`);
+            }
+        }
+        lines.push('');
+    }
+    // Outgoing refs (what this calls/imports)
+    const outgoing = result.outgoing || {};
+    const outgoingCount = Object.values(outgoing).reduce((sum, arr) => sum + arr.length, 0);
+    if (outgoingCount > 0) {
+        lines.push(`Calls/imports (${outgoingCount}):`);
+        for (const [relType, refs] of Object.entries(outgoing)) {
+            for (const ref of refs.slice(0, 10)) {
+                lines.push(`  → [${relType}] ${ref.kind} ${ref.name} → ${ref.filePath}`);
+            }
+        }
+        lines.push('');
+    }
+    // Processes
+    const procs = result.processes || [];
+    if (procs.length > 0) {
+        lines.push(`Participates in ${procs.length} execution flow(s):`);
+        for (const p of procs) {
+            lines.push(`  • ${p.name} (step ${p.step_index}/${p.step_count})`);
+        }
+    }
+    if (sym.content) {
+        lines.push('');
+        lines.push(`Source:`);
+        lines.push(sym.content);
+    }
+    return lines.join('\n').trim();
+}
+export function formatImpactResult(result) {
+    if (result.error) {
+        const suggestion = result.suggestion ? `\nSuggestion: ${result.suggestion}` : '';
+        return `Error: ${result.error}${suggestion}`;
+    }
+    const target = result.target;
+    const direction = result.direction;
+    const byDepth = result.byDepth || {};
+    const total = result.impactedCount || 0;
+    if (total === 0) {
+        return `${target?.name || '?'}: No ${direction} dependencies found. This symbol appears isolated.`;
+    }
+    const lines = [];
+    const dirLabel = direction === 'upstream' ? 'depends on this (will break if changed)' : 'this depends on';
+    lines.push(`Blast radius for ${target?.kind || ''} ${target?.name} (${direction}): ${total} symbol(s) ${dirLabel}`);
+    if (result.partial) {
+        lines.push('⚠️  Partial results — graph traversal was interrupted. Deeper impacts may exist.');
+    }
+    lines.push('');
+    const depthLabels = {
+        1: 'WILL BREAK (direct)',
+        2: 'LIKELY AFFECTED (indirect)',
+        3: 'MAY NEED TESTING (transitive)',
+    };
+    for (const depth of [1, 2, 3]) {
+        const items = byDepth[depth];
+        if (!items || items.length === 0)
+            continue;
+        lines.push(`d=${depth}: ${depthLabels[depth] || ''} (${items.length})`);
+        for (const item of items.slice(0, 12)) {
+            const conf = item.confidence < 1 ? ` (conf: ${item.confidence})` : '';
+            lines.push(`  ${item.type} ${item.name} → ${item.filePath} [${item.relationType}]${conf}`);
+        }
+        if (items.length > 12) {
+            lines.push(`  ... and ${items.length - 12} more`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n').trim();
+}
+export function formatCypherResult(result) {
+    if (result.error)
+        return `Error: ${result.error}`;
+    if (Array.isArray(result)) {
+        if (result.length === 0)
+            return 'Query returned 0 rows.';
+        // Format as simple table
+        const keys = Object.keys(result[0]);
+        const lines = [`${result.length} row(s):\n`];
+        for (const row of result.slice(0, 30)) {
+            const parts = keys.map((k) => `${k}: ${row[k]}`);
+            lines.push(`  ${parts.join(' | ')}`);
+        }
+        if (result.length > 30) {
+            lines.push(`  ... ${result.length - 30} more rows`);
+        }
+        return lines.join('\n');
+    }
+    return typeof result === 'string' ? result : JSON.stringify(result, null, 2);
+}
+export function formatDetectChangesResult(result) {
+    if (result.error)
+        return `Error: ${result.error}`;
+    const summary = result.summary || {};
+    const lines = [];
+    if (summary.changed_count === 0) {
+        return 'No changes detected.';
+    }
+    lines.push(`Changes: ${summary.changed_files || 0} files, ${summary.changed_count || 0} symbols`);
+    lines.push(`Affected processes: ${summary.affected_count || 0}`);
+    lines.push(`Risk level: ${summary.risk_level || 'unknown'}\n`);
+    const changed = result.changed_symbols || [];
+    if (changed.length > 0) {
+        lines.push(`Changed symbols:`);
+        for (const s of changed.slice(0, 15)) {
+            lines.push(`  ${s.type} ${s.name} → ${s.filePath}`);
+        }
+        if (changed.length > 15)
+            lines.push(`  ... and ${changed.length - 15} more`);
+        lines.push('');
+    }
+    const affected = result.affected_processes || [];
+    if (affected.length > 0) {
+        lines.push(`Affected execution flows:`);
+        for (const p of affected.slice(0, 10)) {
+            const steps = (p.changed_steps || []).map((s) => s.symbol).join(', ');
+            lines.push(`  • ${p.name} (${p.step_count} steps) — changed: ${steps}`);
+        }
+    }
+    return lines.join('\n').trim();
+}
+export function formatListReposResult(result) {
+    if (!Array.isArray(result) || result.length === 0) {
+        return 'No indexed repositories.';
+    }
+    const lines = ['Indexed repositories:\n'];
+    for (const r of result) {
+        const stats = r.stats || {};
+        lines.push(`  ${r.name} — ${stats.nodes || '?'} symbols, ${stats.edges || '?'} relationships, ${stats.processes || '?'} flows`);
+        lines.push(`    Path: ${r.path}`);
+        lines.push(`    Indexed: ${r.indexedAt}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Format a tool result as compact, LLM-friendly text.
+ */
+function formatToolResult(toolName, result) {
+    switch (toolName) {
+        case 'query':
+            return formatQueryResult(result);
+        case 'context':
+            return formatContextResult(result);
+        case 'impact':
+            return formatImpactResult(result);
+        case 'cypher':
+            return formatCypherResult(result);
+        case 'detect_changes':
+            return formatDetectChangesResult(result);
+        case 'list_repos':
+            return formatListReposResult(result);
+        default:
+            return typeof result === 'string' ? result : JSON.stringify(result, null, 2);
+    }
+}
+// ─── Next-Step Hints ──────────────────────────────────────────────────
+// Guide the agent to the logical next tool call.
+// Critical for tool chaining: query → context → impact → fix.
+function getNextStepHint(toolName) {
+    switch (toolName) {
+        case 'query':
+            return '\n---\nNext: Pick a symbol above and run codragraph-context "<name>" to see all its callers, callees, and execution flows.';
+        case 'context':
+            return '\n---\nNext: To check what breaks if you change this, run codragraph-impact "<name>" upstream';
+        case 'impact':
+            return '\n---\nNext: Review d=1 items first (WILL BREAK). Read the source with cat to understand the code, then make your fix.';
+        case 'cypher':
+            return '\n---\nNext: To explore a result symbol in depth, run codragraph-context "<name>"';
+        case 'detect_changes':
+            return '\n---\nNext: Run codragraph-context "<symbol>" on high-risk changed symbols to check their callers.';
+        default:
+            return '';
+    }
+}
+// ─── Server ───────────────────────────────────────────────────────────
+export async function evalServerCommand(options) {
+    const port = parseInt(options?.port || '4848');
+    const idleTimeoutSec = parseInt(options?.idleTimeout || '0');
+    const backend = new LocalBackend();
+    const ok = await backend.init();
+    if (!ok) {
+        console.error('CodraGraph eval-server: No indexed repositories found. Run: codragraph analyze');
+        process.exit(1);
+    }
+    const repos = await backend.listRepos();
+    console.error(`CodraGraph eval-server: ${repos.length} repo(s) loaded: ${repos.map((r) => r.name).join(', ')}`);
+    let idleTimer = null;
+    function resetIdleTimer() {
+        if (idleTimeoutSec <= 0)
+            return;
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(async () => {
+            console.error('CodraGraph eval-server: Idle timeout reached, shutting down');
+            await backend.disconnect();
+            process.exit(0);
+        }, idleTimeoutSec * 1000);
+    }
+    const server = http.createServer(async (req, res) => {
+        resetIdleTimer();
+        try {
+            // Health check
+            if (req.method === 'GET' && req.url === '/health') {
+                res.setHeader('Content-Type', 'application/json');
+                res.writeHead(200);
+                res.end(JSON.stringify({ status: 'ok', repos: repos.map((r) => r.name) }));
+                return;
+            }
+            // Shutdown
+            if (req.method === 'POST' && req.url === '/shutdown') {
+                res.setHeader('Content-Type', 'application/json');
+                res.writeHead(200);
+                res.end(JSON.stringify({ status: 'shutting_down' }));
+                setTimeout(async () => {
+                    await backend.disconnect();
+                    server.close();
+                    process.exit(0);
+                }, 100);
+                return;
+            }
+            // Tool calls: POST /tool/:name
+            const toolMatch = req.url?.match(/^\/tool\/(\w+)$/);
+            if (req.method === 'POST' && toolMatch) {
+                const toolName = toolMatch[1];
+                const body = await readBody(req);
+                let args = {};
+                if (body.trim()) {
+                    try {
+                        args = JSON.parse(body);
+                    }
+                    catch {
+                        res.setHeader('Content-Type', 'text/plain');
+                        res.writeHead(400);
+                        res.end('Error: Invalid JSON body');
+                        return;
+                    }
+                }
+                // Call tool, format result as text, append next-step hint
+                const result = await backend.callTool(toolName, args);
+                const formatted = formatToolResult(toolName, result);
+                const hint = getNextStepHint(toolName);
+                res.setHeader('Content-Type', 'text/plain');
+                res.writeHead(200);
+                res.end(formatted + hint);
+                return;
+            }
+            // 404
+            res.setHeader('Content-Type', 'text/plain');
+            res.writeHead(404);
+            res.end('Not found. Use POST /tool/:name or GET /health');
+        }
+        catch (err) {
+            res.setHeader('Content-Type', 'text/plain');
+            res.writeHead(500);
+            res.end(`Error: ${err.message || 'Internal error'}`);
+        }
+    });
+    server.listen(port, '127.0.0.1', () => {
+        console.error(`CodraGraph eval-server: listening on http://127.0.0.1:${port}`);
+        console.error(`  POST /tool/query    — search execution flows`);
+        console.error(`  POST /tool/context  — 360-degree symbol view`);
+        console.error(`  POST /tool/impact   — blast radius analysis`);
+        console.error(`  POST /tool/cypher   — raw Cypher query`);
+        console.error(`  GET  /health        — health check`);
+        console.error(`  POST /shutdown      — graceful shutdown`);
+        if (idleTimeoutSec > 0) {
+            console.error(`  Auto-shutdown after ${idleTimeoutSec}s idle`);
+        }
+        try {
+            // Use fd 1 directly — LadybugDB captures process.stdout (#324)
+            writeSync(1, `CODRAGRAPH_EVAL_SERVER_READY:${port}\n`);
+        }
+        catch {
+            // stdout may not be available (e.g., broken pipe)
+        }
+    });
+    resetIdleTimer();
+    const shutdown = async () => {
+        console.error('CodraGraph eval-server: shutting down...');
+        await backend.disconnect();
+        server.close();
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+}
+export const MAX_BODY_SIZE = 1024 * 1024; // 1MB
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let totalSize = 0;
+        req.on('data', (chunk) => {
+            totalSize += chunk.length;
+            if (totalSize > MAX_BODY_SIZE) {
+                req.destroy(new Error('Request body too large (max 1MB)'));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+        req.on('error', reject);
+    });
+}