ctxloom-pro 1.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +208 -0
- package/README.md +619 -0
- package/dist/ASTParser-3QJ637L6.js +8 -0
- package/dist/DependencyGraph-FGTNORTW.js +10 -0
- package/dist/VectorStore-UQNBYPBV.js +8 -0
- package/dist/chunk-5CJIMX6D.js +1599 -0
- package/dist/chunk-IHXVD5SO.js +35 -0
- package/dist/chunk-II2DPYRJ.js +352 -0
- package/dist/chunk-PSLPRDPL.js +139 -0
- package/dist/chunk-RE2V3FRF.js +1052 -0
- package/dist/chunk-XNKTZGDX.js +125 -0
- package/dist/chunk-ZYDVY7VZ.js +140 -0
- package/dist/dashboard-LVSRXGZN.js +13 -0
- package/dist/embedder-RECRKXTB.js +14 -0
- package/dist/index.d.ts +1 -0
- package/dist/index.js +5617 -0
- package/dist/logger-2FVN3AGZ.js +7 -0
- package/dist/rules-OMDOX7IJ.js +15 -0
- package/dist/setup/postinstall.d.ts +1 -0
- package/dist/setup/postinstall.js +42 -0
- package/dist/wasm/tree-sitter-tsx.wasm +0 -0
- package/dist/wasm/tree-sitter-typescript.wasm +0 -0
- package/dist/wasm/tree-sitter.wasm +0 -0
- package/dist/workers/indexerWorker.d.ts +2 -0
- package/dist/workers/indexerWorker.js +29 -0
- package/package.json +98 -0
package/README.md
ADDED
|
@@ -0,0 +1,619 @@
|
|
|
1
|
+
# ctxloom — The Universal Code Context Engine
|
|
2
|
+
|
|
3
|
+
A local-first MCP server that gives AI coding assistants deep structural understanding of your codebase through hybrid **Vector + AST + Graph** search, with **Skeletonization** for 92% token reduction.
|
|
4
|
+
|
|
5
|
+
No API keys. No cloud. No Python. Everything runs on your machine.
|
|
6
|
+
|
|
7
|
+
## Quick Start
|
|
8
|
+
|
|
9
|
+
**Prerequisites:** Node.js 20+ and an MCP-compatible AI tool (Claude Code, Cursor, Windsurf, etc.)
|
|
10
|
+
|
|
11
|
+
```bash
|
|
12
|
+
# 1. Install globally
|
|
13
|
+
npm install -g ctxloom-pro
|
|
14
|
+
|
|
15
|
+
# 2. Auto-configure your AI tools (one-time)
|
|
16
|
+
ctxloom setup
|
|
17
|
+
|
|
18
|
+
# 3. Index your project (once per project)
|
|
19
|
+
cd /path/to/your/project
|
|
20
|
+
ctxloom index
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
### Manual Configuration
|
|
24
|
+
|
|
25
|
+
```jsonc
|
|
26
|
+
// ~/.claude/claude_desktop_config.json (or equivalent)
|
|
27
|
+
{
|
|
28
|
+
"mcpServers": {
|
|
29
|
+
"ctxloom": {
|
|
30
|
+
"command": "npx",
|
|
31
|
+
"args": ["-y", "ctxloom"]
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
}
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
> If installed globally: `"command": "ctxloom"` with `"args": []`.
|
|
38
|
+
|
|
39
|
+
---
|
|
40
|
+
|
|
41
|
+
## GitHub App — ctxloom-bot
|
|
42
|
+
|
|
43
|
+

|
|
44
|
+
|
|
45
|
+
Get automated risk analysis and reviewer suggestions on every pull request.
|
|
46
|
+
|
|
47
|
+
<!-- TODO: Add demo GIF showing bot posting summary + inline comment on a PR -->
|
|
48
|
+
|
|
49
|
+
- Posts a risk-scored summary comment on every PR, combining blast radius, churn, and coupling data
|
|
50
|
+
- Adds inline review comments at the specific lines that carry the highest structural risk
|
|
51
|
+
- Suggests reviewers based on ownership data mined from git history
|
|
52
|
+
- Responds to `/ctxloom` slash commands (e.g. `/ctxloom blast-radius`, `/ctxloom risk`) directly in PR threads
|
|
53
|
+
|
|
54
|
+
See [`apps/pr-bot/README.md`](apps/pr-bot/README.md) for full installation and self-hosting instructions.
|
|
55
|
+
|
|
56
|
+
---
|
|
57
|
+
|
|
58
|
+
## Web Dashboard
|
|
59
|
+
|
|
60
|
+

|
|
61
|
+
|
|
62
|
+
A local web dashboard that visualises your codebase's graph, risk, ownership, and community data in real time.
|
|
63
|
+
|
|
64
|
+
```bash
|
|
65
|
+
# Index first (with git history for full data)
|
|
66
|
+
ctxloom index --with-git
|
|
67
|
+
|
|
68
|
+
# Launch the dashboard
|
|
69
|
+
ctxloom dashboard
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
Visit `http://localhost:7842` — no browser extension required.
|
|
73
|
+
|
|
74
|
+
### Views
|
|
75
|
+
|
|
76
|
+
| View | What it shows |
|
|
77
|
+
|------|---------------|
|
|
78
|
+
| **Overview** | File count, edge count, communities, git status, risk breakdown donut, top architectural hubs |
|
|
79
|
+
| **Dependency Graph** | Interactive D3 force-directed graph — hover for details, click to highlight neighbours, search to pan, community legend, risk rings |
|
|
80
|
+
| **Risk** | Sortable table: composite risk score (churn × 0.3 + bug density × 0.3 + bus factor × 0.2 + coupling × 0.2), filterable by filename |
|
|
81
|
+
| **Communities** | Auto-detected Louvain modules — expandable cluster cards showing member files |
|
|
82
|
+
| **Ownership** | Per-file primary owner, share %, bus factor warnings — filterable by file or contributor |
|
|
83
|
+
| **Guide** | In-app reference explaining every metric and how to interpret it |
|
|
84
|
+
|
|
85
|
+
### Interactivity
|
|
86
|
+
|
|
87
|
+
- **Click any filename** across Risk, Ownership, and Communities to open a file preview drawer with the full source and an **Open in IDE** button (launches VS Code, Cursor, or system default)
|
|
88
|
+
- **↻ Refresh** button in Overview re-indexes the context in-place without restarting the server
|
|
89
|
+
- The server **auto-reloads** when `.ctxloom/graph-snapshot.json` changes — run `ctxloom index` in a separate terminal and the dashboard updates automatically
|
|
90
|
+
|
|
91
|
+
### Risk tiers
|
|
92
|
+
|
|
93
|
+
| Tier | Score | Meaning |
|
|
94
|
+
|------|-------|---------|
|
|
95
|
+
| critical | > 0.8 | Urgent — high churn, sole owner, heavily coupled |
|
|
96
|
+
| high | > 0.6 | Address soon |
|
|
97
|
+
| medium | > 0.3 | Monitor |
|
|
98
|
+
| low | ≤ 0.3 | Acceptable |
|
|
99
|
+
|
|
100
|
+
---
|
|
101
|
+
|
|
102
|
+
## Reviewer Suggestions
|
|
103
|
+
|
|
104
|
+
Suggest PR reviewers based on git ownership, co-change history, and recent activity — no static CODEOWNERS to maintain:
|
|
105
|
+
|
|
106
|
+
```bash
|
|
107
|
+
# Suggest reviewers for staged files
|
|
108
|
+
ctxloom review-suggest
|
|
109
|
+
|
|
110
|
+
# Suggest reviewers for specific files
|
|
111
|
+
ctxloom review-suggest src/auth.ts src/api/session.ts
|
|
112
|
+
|
|
113
|
+
# Show per-factor score breakdown
|
|
114
|
+
ctxloom review-suggest src/auth.ts --explain
|
|
115
|
+
|
|
116
|
+
# Generate / update .github/CODEOWNERS
|
|
117
|
+
ctxloom review-suggest --emit-codeowners --write
|
|
118
|
+
|
|
119
|
+
# Map git author emails to GitHub handles
|
|
120
|
+
GITHUB_TOKEN=<token> ctxloom authors-sync
|
|
121
|
+
```
|
|
122
|
+
|
|
123
|
+
### Scoring
|
|
124
|
+
|
|
125
|
+
Each candidate is scored across four factors:
|
|
126
|
+
|
|
127
|
+
| Factor | Weight | Source |
|
|
128
|
+
|--------|--------|--------|
|
|
129
|
+
| Ownership share | 50% | Blame-weighted commit history |
|
|
130
|
+
| Co-change recency | 25% | Files changed together in last 90 days |
|
|
131
|
+
| Recent activity | 15% | Commits in last 30/90 days |
|
|
132
|
+
| Bus-factor boost | 10% | Diversity nudge when bus factor ≤ 2 |
|
|
133
|
+
|
|
134
|
+
Candidates inactive for > 180 days are excluded automatically.
|
|
135
|
+
|
|
136
|
+
### GitHub Action
|
|
137
|
+
|
|
138
|
+
Add to `.github/workflows/review.yml`:
|
|
139
|
+
|
|
140
|
+
```yaml
|
|
141
|
+
name: Reviewer suggestions
|
|
142
|
+
on:
|
|
143
|
+
pull_request:
|
|
144
|
+
types: [opened, synchronize, reopened]
|
|
145
|
+
jobs:
|
|
146
|
+
suggest:
|
|
147
|
+
runs-on: ubuntu-latest
|
|
148
|
+
permissions:
|
|
149
|
+
pull-requests: write
|
|
150
|
+
contents: read
|
|
151
|
+
steps:
|
|
152
|
+
- uses: actions/checkout@v4
|
|
153
|
+
with:
|
|
154
|
+
fetch-depth: 0
|
|
155
|
+
- uses: kodiii/ctxloom-review-suggest@v1
|
|
156
|
+
with:
|
|
157
|
+
max: 3
|
|
158
|
+
```
|
|
159
|
+
|
|
160
|
+
### Email → GitHub handle mapping
|
|
161
|
+
|
|
162
|
+
Create `.ctxloom/authors.yml` to map or exclude authors:
|
|
163
|
+
|
|
164
|
+
```yaml
|
|
165
|
+
mappings:
|
|
166
|
+
alice@company.com: alice-gh
|
|
167
|
+
bob@company.com: bobsmith
|
|
168
|
+
ignore:
|
|
169
|
+
- bot@dependabot.com
|
|
170
|
+
```
|
|
171
|
+
|
|
172
|
+
---
|
|
173
|
+
|
|
174
|
+
## Architecture Rules Engine
|
|
175
|
+
|
|
176
|
+
Enforce architectural boundaries as a CI lint step — no runtime overhead, no flaky tests.
|
|
177
|
+
|
|
178
|
+
```bash
|
|
179
|
+
# Check rules against the indexed dependency graph
|
|
180
|
+
ctxloom rules check
|
|
181
|
+
|
|
182
|
+
# JSON output (for CI parsers)
|
|
183
|
+
ctxloom rules check --json
|
|
184
|
+
|
|
185
|
+
# Skip re-indexing, use existing snapshot
|
|
186
|
+
ctxloom rules check --use-snapshot
|
|
187
|
+
|
|
188
|
+
# Limit text output to N violations (default: 50)
|
|
189
|
+
ctxloom rules check --limit=20
|
|
190
|
+
```
|
|
191
|
+
|
|
192
|
+
### Configuration
|
|
193
|
+
|
|
194
|
+
Create `.ctxloom/rules.yml` in your project root:
|
|
195
|
+
|
|
196
|
+
```yaml
|
|
197
|
+
version: 1
|
|
198
|
+
rules:
|
|
199
|
+
- name: domain must not import infra
|
|
200
|
+
type: no-import
|
|
201
|
+
from: "src/domain/**"
|
|
202
|
+
to: "src/infra/**"
|
|
203
|
+
severity: error # optional — defaults to "error"
|
|
204
|
+
|
|
205
|
+
- name: no circular via shared
|
|
206
|
+
type: no-import
|
|
207
|
+
from: "src/features/**"
|
|
208
|
+
to: "src/shared/legacy/**"
|
|
209
|
+
severity: warning
|
|
210
|
+
```
|
|
211
|
+
|
|
212
|
+
### Rule fields
|
|
213
|
+
|
|
214
|
+
| Field | Required | Description |
|
|
215
|
+
|-------|----------|-------------|
|
|
216
|
+
| `name` | ✅ | Human-readable rule label (shown in violations) |
|
|
217
|
+
| `type` | ✅ | Always `no-import` in v1 |
|
|
218
|
+
| `from` | ✅ | picomatch glob — files that must not import |
|
|
219
|
+
| `to` | ✅ | picomatch glob — files that must not be imported |
|
|
220
|
+
| `severity` | ❌ | `error` (default) or `warning` |
|
|
221
|
+
|
|
222
|
+
Globs use [picomatch](https://github.com/micromatch/picomatch) syntax with `{ dot: true }` for dotfiles.
|
|
223
|
+
|
|
224
|
+
### Exit codes
|
|
225
|
+
|
|
226
|
+
| Code | Meaning |
|
|
227
|
+
|------|---------|
|
|
228
|
+
| 0 | Clean (or warnings only) |
|
|
229
|
+
| 1 | One or more `error`-severity violations found |
|
|
230
|
+
| 2 | Config file invalid or I/O error |
|
|
231
|
+
|
|
232
|
+
### CI integration
|
|
233
|
+
|
|
234
|
+
```yaml
|
|
235
|
+
# .github/workflows/rules.yml
|
|
236
|
+
name: Architecture rules
|
|
237
|
+
on: [push, pull_request]
|
|
238
|
+
jobs:
|
|
239
|
+
check:
|
|
240
|
+
runs-on: ubuntu-latest
|
|
241
|
+
steps:
|
|
242
|
+
- uses: actions/checkout@v4
|
|
243
|
+
- uses: actions/setup-node@v4
|
|
244
|
+
with: { node-version: '20' }
|
|
245
|
+
- run: npm install -g ctxloom-pro
|
|
246
|
+
- run: ctxloom index
|
|
247
|
+
- run: ctxloom rules check --json
|
|
248
|
+
```
|
|
249
|
+
|
|
250
|
+
### MCP tool
|
|
251
|
+
|
|
252
|
+
The `ctx_rules_check` tool exposes the same engine to your AI assistant:
|
|
253
|
+
|
|
254
|
+
```json
|
|
255
|
+
// Request
|
|
256
|
+
{}
|
|
257
|
+
|
|
258
|
+
// Response (schemaVersion: 1)
|
|
259
|
+
{
|
|
260
|
+
"schemaVersion": 1,
|
|
261
|
+
"violations": [
|
|
262
|
+
{
|
|
263
|
+
"rule": "domain must not import infra",
|
|
264
|
+
"severity": "error",
|
|
265
|
+
"from": "src/domain/user.ts",
|
|
266
|
+
"to": "src/infra/db.ts"
|
|
267
|
+
}
|
|
268
|
+
],
|
|
269
|
+
"warnings": []
|
|
270
|
+
}
|
|
271
|
+
```
|
|
272
|
+
|
|
273
|
+
The tool reads `.ctxloom/rules.yml` and the live dependency graph on every call — no restart required when config changes.
|
|
274
|
+
|
|
275
|
+
### Limitations (v1)
|
|
276
|
+
|
|
277
|
+
- **Direct imports only** — transitive violations are not detected
|
|
278
|
+
- **Snapshot staleness** — `--use-snapshot` skips re-indexing; stale graphs may miss recent violations
|
|
279
|
+
- Rule type `no-import` only; more rule types planned for v2
|
|
280
|
+
|
|
281
|
+
---
|
|
282
|
+
|
|
283
|
+
## How ctxloom Compares
|
|
284
|
+
|
|
285
|
+
| Feature | ctxloom | code-review-graph | Others |
|
|
286
|
+
|---------|---------|-------------------|--------|
|
|
287
|
+
| Zero Python dependencies | ✅ Pure JS/TS | ❌ Python required | varies |
|
|
288
|
+
| Local-first (no cloud) | ✅ | ✅ | varies |
|
|
289
|
+
| Blast radius analysis | ✅ `ctx_blast_radius` | ✅ | ❌ |
|
|
290
|
+
| Community / cluster detection | ✅ Louvain (pure JS) | ✅ Leiden (Python) | ❌ |
|
|
291
|
+
| Architecture overview | ✅ `ctx_architecture_overview` | ✅ | ❌ |
|
|
292
|
+
| Execution flow tracing | ✅ `ctx_execution_flow` | ❌ | ❌ |
|
|
293
|
+
| Refactor rename preview | ✅ `ctx_refactor_preview` | ❌ | ❌ |
|
|
294
|
+
| Wiki generation (no LLM) | ✅ `ctx_wiki_generate` | ✅ | ❌ |
|
|
295
|
+
| Graph export (Gephi/Obsidian) | ✅ `ctx_graph_export` | ✅ | ❌ |
|
|
296
|
+
| Cross-repo search | ✅ `ctx_cross_repo_search` | ✅ | ❌ |
|
|
297
|
+
| All-in-one code review packet | ✅ `ctx_git_diff_review` | ✅ | ❌ |
|
|
298
|
+
| Tree-sitter AST | ✅ TS/JS/Python/Go/Rust/Java/C#/Ruby/Kotlin/Swift/PHP/Dart/Vue — 13 languages | ✅ Multi-language | varies |
|
|
299
|
+
| Token reduction (skeletonization) | ✅ **92% measured on real repos** | ✅ | ❌ |
|
|
300
|
+
| npm install size | ✅ <5 MB (lazy grammars) | ❌ Large | varies |
|
|
301
|
+
| MCP protocol native | ✅ | ✅ | varies |
|
|
302
|
+
| PR-native review comments | ✅ ctxloom-bot posts on every PR | ❌ | ❌ |
|
|
303
|
+
|
|
304
|
+
> Token reduction is measured, not estimated. See [`benchmarks/README.md`](benchmarks/README.md).
|
|
305
|
+
|
|
306
|
+
---
|
|
307
|
+
|
|
308
|
+
## Tools — 32 total
|
|
309
|
+
|
|
310
|
+
### Search & Context
|
|
311
|
+
|
|
312
|
+
| Tool | Description |
|
|
313
|
+
|------|-------------|
|
|
314
|
+
| `ctx_search` | Hybrid semantic + graph search (vector similarity + import graph expansion) |
|
|
315
|
+
| `ctx_get_file` | Safe file read with path traversal protection (5 MB max) |
|
|
316
|
+
| `ctx_get_context_packet` | Smart multi-file context: primary file + dependency skeletons + reverse importers |
|
|
317
|
+
| `ctx_similar_files` | Find semantically similar files via vector embeddings |
|
|
318
|
+
| `ctx_cross_repo_search` | Federated semantic search across all registered repos |
|
|
319
|
+
| `ctx_full_text_search` | Hybrid keyword+vector search with regex support and configurable context lines |
|
|
320
|
+
|
|
321
|
+
### Graph Intelligence
|
|
322
|
+
|
|
323
|
+
| Tool | Description |
|
|
324
|
+
|------|-------------|
|
|
325
|
+
| `ctx_blast_radius` | "What breaks if I change this?" — import + call graph traversal |
|
|
326
|
+
| `ctx_hub_nodes` | Top-N files by import degree (architectural chokepoints) |
|
|
327
|
+
| `ctx_bridge_nodes` | Top-N files by betweenness centrality (graph connectors) |
|
|
328
|
+
| `ctx_community_list` | Louvain community detection — cluster files into architectural modules |
|
|
329
|
+
| `ctx_architecture_overview` | High-level summary: communities, hub files, cross-community coupling |
|
|
330
|
+
| `ctx_knowledge_gaps` | Isolated files, untested hubs, dead code candidates |
|
|
331
|
+
| `ctx_surprising_connections` | Circular deps, cross-community imports, prod→test violations |
|
|
332
|
+
| `ctx_find_large_functions` | Find functions/classes exceeding a line-count threshold, sorted by size descending |
|
|
333
|
+
|
|
334
|
+
### Code Navigation
|
|
335
|
+
|
|
336
|
+
| Tool | Description |
|
|
337
|
+
|------|-------------|
|
|
338
|
+
| `ctx_get_call_graph` | Bidirectional call graph traversal with configurable depth |
|
|
339
|
+
| `ctx_get_definition` | Symbol definition lookup via AST index |
|
|
340
|
+
| `ctx_execution_flow` | DFS call graph traversal from entry point with cycle detection |
|
|
341
|
+
| `ctx_refactor_preview` | Read-only symbol rename diff preview — see every change before applying |
|
|
342
|
+
| `ctx_apply_refactor` | Write symbol renames to disk atomically (supports dry_run) |
|
|
343
|
+
|
|
344
|
+
### Review & Export
|
|
345
|
+
|
|
346
|
+
| Tool | Description |
|
|
347
|
+
|------|-------------|
|
|
348
|
+
| `ctx_git_diff_review` | All-in-one code review packet: git diffs + skeletons + blast radius |
|
|
349
|
+
| `ctx_wiki_generate` | Generate `.ctxloom/wiki/` — one Markdown page per community (no LLM needed) |
|
|
350
|
+
| `ctx_graph_export` | Export graph to GraphML, DOT, Obsidian, SVG, or interactive D3.js HTML |
|
|
351
|
+
| `ctx_suggested_questions` | Graph-driven code review questions without LLM |
|
|
352
|
+
| `ctx_detect_changes` | Risk-scored change analysis — critical/high/medium/low priority |
|
|
353
|
+
| `ctx_graph_snapshot` | Save a named checkpoint of the dependency graph |
|
|
354
|
+
| `ctx_graph_diff` | Diff two named snapshots — added/removed nodes and edges |
|
|
355
|
+
|
|
356
|
+
### Utilities
|
|
357
|
+
|
|
358
|
+
| Tool | Description |
|
|
359
|
+
|------|-------------|
|
|
360
|
+
| `ctx_get_rules` | Inject project rules from `.cursorrules`, `CLAUDE.md`, `CONTEXT.md`, `.ctxloomrc` |
|
|
361
|
+
| `ctx_status` | Server status: graph size, vector store count, initialization state |
|
|
362
|
+
| `ctx_get_workflow` | Return a pre-written tool sequence for review/debug/onboard/refactor/audit workflows |
|
|
363
|
+
| `ctx_rules_check` | Check `.ctxloom/rules.yml` against the live dependency graph — returns `{schemaVersion:1, violations, warnings}` |
|
|
364
|
+
|
|
365
|
+
---
|
|
366
|
+
|
|
367
|
+
## Risk Overlay (Git History)
|
|
368
|
+
|
|
369
|
+
ctxloom fuses your git history onto the structural graph to produce a *risk map* — showing which files are historically risky, not just structurally coupled.
|
|
370
|
+
|
|
371
|
+
### Enable
|
|
372
|
+
|
|
373
|
+
Re-index with the `--with-git` flag (enabled by default):
|
|
374
|
+
|
|
375
|
+
```
|
|
376
|
+
ctxloom . --with-git --git-window-days=365
|
|
377
|
+
```
|
|
378
|
+
|
|
379
|
+
First run mines the last 365 days of commits (~30–90s on large repos). Subsequent runs are incremental.
|
|
380
|
+
|
|
381
|
+
### New tools
|
|
382
|
+
|
|
383
|
+
| Tool | Description |
|
|
384
|
+
|------|-------------|
|
|
385
|
+
| `ctx_git_coupling` | Given a file, returns top co-changed siblings with confidence score, shared commit count, and recency data. Surfaces "historically this file changes with X" — invisible to static analysis. |
|
|
386
|
+
| `ctx_risk_overlay` | Given a list of files, returns a per-file risk score (0–1) combining churn, bug-fix density, bus-factor ownership, and coupling fan-out. |
|
|
387
|
+
|
|
388
|
+
### Enriched tools
|
|
389
|
+
|
|
390
|
+
Existing tools gain a `risk` block when the overlay is active:
|
|
391
|
+
|
|
392
|
+
- **`ctx_detect_changes`** — each changed file now includes churn bucket, bug density, top coupled siblings, and ownership.
|
|
393
|
+
- **`ctx_blast_radius`** — adds a `historicalCoupling` section listing files that co-change with the seed set historically but are not reachable via imports ("historical surprise" surface).
|
|
394
|
+
|
|
395
|
+
### Privacy
|
|
396
|
+
|
|
397
|
+
The overlay is **local only**. No code or commit metadata is sent anywhere. The sidecar is stored at `.ctxloom/git-overlay.json` alongside the graph snapshot.
|
|
398
|
+
|
|
399
|
+
### Opt out
|
|
400
|
+
|
|
401
|
+
Pass `--no-git` to disable the overlay entirely. Tools degrade gracefully — the `risk` block becomes `null` and the note `"Re-index with --with-git to enable risk data."` appears in responses.
|
|
402
|
+
|
|
403
|
+
---
|
|
404
|
+
|
|
405
|
+
## CLI Commands
|
|
406
|
+
|
|
407
|
+
```
|
|
408
|
+
ctxloom Start MCP server (Stdio transport)
|
|
409
|
+
ctxloom index Index current directory + build dependency graph
|
|
410
|
+
ctxloom dashboard Open the web dashboard (port 7842)
|
|
411
|
+
ctxloom dashboard --port=N Start on a custom port
|
|
412
|
+
ctxloom dashboard --open Open browser automatically
|
|
413
|
+
ctxloom setup Detect and configure MCP-compatible AI tools (interactive)
|
|
414
|
+
ctxloom register <path> Register a repo for cross-repo search
|
|
415
|
+
ctxloom repos List all registered repos
|
|
416
|
+
ctxloom grammars Show grammar cache status
|
|
417
|
+
ctxloom grammars --download Pre-download all language grammars
|
|
418
|
+
ctxloom rules check Check .ctxloom/rules.yml against the dependency graph
|
|
419
|
+
ctxloom rules check --json JSON output (schemaVersion: 1)
|
|
420
|
+
ctxloom rules check --use-snapshot Skip re-indexing, use existing graph snapshot
|
|
421
|
+
ctxloom rules check --limit=N Limit text output to N violations (default: 50)
|
|
422
|
+
ctxloom --help Show help
|
|
423
|
+
```
|
|
424
|
+
|
|
425
|
+
---
|
|
426
|
+
|
|
427
|
+
## Language Support
|
|
428
|
+
|
|
429
|
+
| Language | Import Graph | Symbol Index | Skeletonization |
|
|
430
|
+
|----------|-------------|--------------|-----------------|
|
|
431
|
+
| TypeScript / JavaScript | ✅ Full AST | ✅ | ✅ |
|
|
432
|
+
| Python | ✅ Relative imports | ✅ | ✅ |
|
|
433
|
+
| Rust | ✅ `mod` resolution | ✅ | ✅ |
|
|
434
|
+
| Go | ✅ Relative paths | ✅ | ✅ |
|
|
435
|
+
| Java | ✅ Dot-to-slash | ✅ | ✅ |
|
|
436
|
+
| C# | ✅ Namespace resolution | ✅ | ✅ |
|
|
437
|
+
| Ruby | ✅ Relative paths | ✅ | ✅ |
|
|
438
|
+
| Kotlin | ✅ Package imports | ✅ | ✅ |
|
|
439
|
+
| Swift | ✅ Module imports | ✅ | ✅ |
|
|
440
|
+
| PHP | ✅ PSR-4 + require_once | ✅ | ❌ |
|
|
441
|
+
| Dart | ✅ Relative imports | ✅ | ❌ |
|
|
442
|
+
| Vue SFC | ✅ Script block | ✅ | ❌ |
|
|
443
|
+
| Jupyter Notebook | ✅ Python cell imports | ✅ | ❌ |
|
|
444
|
+
|
|
445
|
+
---
|
|
446
|
+
|
|
447
|
+
## Architecture
|
|
448
|
+
|
|
449
|
+
```
|
|
450
|
+
┌─────────────────────────────────────────────────────────┐
|
|
451
|
+
│ MCP Interface │
|
|
452
|
+
│ (Stdio transport) │
|
|
453
|
+
├──────────────────────────────────────────────────────────┤
|
|
454
|
+
│ 32 Tools (ToolRegistry) │
|
|
455
|
+
│ Search · Graph Intelligence · Navigation · Review │
|
|
456
|
+
├──────────────────────────────────────────────────────────┤
|
|
457
|
+
│ Context Engine │
|
|
458
|
+
│ ┌────────────┐ ┌──────────────┐ ┌─────────────────┐ │
|
|
459
|
+
│ │ Dependency │ │ VectorDB │ │ Skeletonizer │ │
|
|
460
|
+
│ │ Graph │ │ (LanceDB) │ │ (tree-sitter) │ │
|
|
461
|
+
│ └────────────┘ └──────────────┘ └─────────────────┘ │
|
|
462
|
+
│ ┌────────────┐ ┌──────────────┐ ┌─────────────────┐ │
|
|
463
|
+
│ │ CallGraph │ │ Community │ │ WikiGenerator │ │
|
|
464
|
+
│ │ Index │ │ Detector │ │ GraphExporter │ │
|
|
465
|
+
│ └────────────┘ └──────────────┘ └─────────────────┘ │
|
|
466
|
+
├──────────────────────────────────────────────────────────┤
|
|
467
|
+
│ File Watcher (chokidar, 200ms debounce) │
|
|
468
|
+
│ Incremental graph updates + re-embedding │
|
|
469
|
+
├──────────────────────────────────────────────────────────┤
|
|
470
|
+
│ Snapshot Manager (atomic writes) │
|
|
471
|
+
│ .ctxloom/graph-snapshot.json + call-graph-snapshot │
|
|
472
|
+
└──────────────────────────────────────────────────────────┘
|
|
473
|
+
```
|
|
474
|
+
|
|
475
|
+
### How search works
|
|
476
|
+
|
|
477
|
+
1. **Embed** — query is embedded with `sentence-transformers/all-MiniLM-L6-v2` (local, 384-dim)
|
|
478
|
+
2. **Vector search** — ANN query against pre-indexed file embeddings in LanceDB
|
|
479
|
+
3. **Graph expansion** — results expanded via import graph (importers + imports get a small score boost)
|
|
480
|
+
4. **Skeletonize** — dependency files reduced to signature-only views (functions, classes, exports) cutting token usage by ~92%
|
|
481
|
+
|
|
482
|
+
---
|
|
483
|
+
|
|
484
|
+
## Performance
|
|
485
|
+
|
|
486
|
+
Benchmarks run on every PR. To run locally:
|
|
487
|
+
|
|
488
|
+
```bash
|
|
489
|
+
npx tsx benchmarks/benchmark.ts
|
|
490
|
+
```
|
|
491
|
+
|
|
492
|
+
See [`benchmarks/README.md`](benchmarks/README.md) for methodology and how to reproduce results independently.
|
|
493
|
+
|
|
494
|
+
## Token reduction benchmarks
|
|
495
|
+
|
|
496
|
+
Measured on real open-source repos with realistic review scenarios (skeletonization applies to JS/TS files; Python and Rust show graph indexing metrics only):
|
|
497
|
+
|
|
498
|
+
| Repository | Language | Files | Raw tokens | Skeleton tokens | Reduction |
|
|
499
|
+
|---|---|---|---|---|---|
|
|
500
|
+
| expressjs/express | JavaScript | 141 | ~4,646 | ~390 | **92%** |
|
|
501
|
+
| sindresorhus/got | TypeScript | 71 | ~10,807 | ~742 | **93%** |
|
|
502
|
+
| pallets/flask | Python | 83 | n/a | n/a | n/a |
|
|
503
|
+
| SergioBenitez/Rocket | Rust | 495 | ~1,281 | ~90 | **93%** |
|
|
504
|
+
| fastify/fastify | JavaScript | 258 | ~2,136 | ~202 | **91%** |
|
|
505
|
+
| **Average (JS/TS/RS)** | | | | | **92%** |
|
|
506
|
+
|
|
507
|
+
Token counts use the standard 4 chars/token approximation. Results saved in [`benchmarks/public-repos-results.json`](benchmarks/public-repos-results.json). Run `npm run bench:repos` to reproduce.
|
|
508
|
+
|
|
509
|
+
---
|
|
510
|
+
|
|
511
|
+
## Security
|
|
512
|
+
|
|
513
|
+
- **Path traversal prevention** — all file inputs validated against project root (CWE-22), symlink-aware
|
|
514
|
+
- **Shell injection prevention** — `execFileSync` with argument arrays; no shell string interpolation
|
|
515
|
+
- **XML injection prevention** — all user-controlled strings escaped before XML output
|
|
516
|
+
- **File size limits** — files over 5 MB rejected by `PathValidator` and skipped by indexer
|
|
517
|
+
- **Input bounds** — `limit` capped at 100, `depth` capped at 20 across all tools
|
|
518
|
+
- **Atomic snapshot writes** — written to `.tmp` then renamed; prevents torn reads
|
|
519
|
+
- **Snapshot schema validation** — validated before hydration; prevents prototype pollution
|
|
520
|
+
|
|
521
|
+
---
|
|
522
|
+
|
|
523
|
+
## Environment Variables
|
|
524
|
+
|
|
525
|
+
| Variable | Description | Default |
|
|
526
|
+
|----------|-------------|---------|
|
|
527
|
+
| `CTXLOOM_ROOT` | Project root directory | Current working directory |
|
|
528
|
+
| `LOG_LEVEL` | Logging verbosity: `debug` / `info` / `warn` / `error` | `info` |
|
|
529
|
+
| `CTXLOOM_GRAMMAR_CDN` | CDN base URL for grammar downloads (air-gapped environments) | Built-in |
|
|
530
|
+
|
|
531
|
+
---
|
|
532
|
+
|
|
533
|
+
## Build from Source
|
|
534
|
+
|
|
535
|
+
```bash
|
|
536
|
+
git clone https://github.com/kodiii/ctxloom.git
|
|
537
|
+
cd ctxloom
|
|
538
|
+
npm install
|
|
539
|
+
npm run build
|
|
540
|
+
ctxloom index
|
|
541
|
+
node dist/index.js
|
|
542
|
+
```
|
|
543
|
+
|
|
544
|
+
---
|
|
545
|
+
|
|
546
|
+
## Project Structure
|
|
547
|
+
|
|
548
|
+
```
|
|
549
|
+
src/
|
|
550
|
+
├── index.ts # CLI entry point
|
|
551
|
+
├── server.ts # MCP server (Stdio transport)
|
|
552
|
+
├── tools/
|
|
553
|
+
│ ├── registry.ts # ToolRegistry: register/dispatch
|
|
554
|
+
│ ├── search.ts # ctx_search
|
|
555
|
+
│ ├── file.ts # ctx_get_file
|
|
556
|
+
│ ├── context-packet.ts # ctx_get_context_packet
|
|
557
|
+
│ ├── call-graph.ts # ctx_get_call_graph
|
|
558
|
+
│ ├── definition.ts # ctx_get_definition
|
|
559
|
+
│ ├── rules.ts # ctx_get_rules
|
|
560
|
+
│ ├── rules-check.ts # ctx_rules_check
|
|
561
|
+
│ ├── similar-files.ts # ctx_similar_files
|
|
562
|
+
│ ├── status.ts # ctx_status
|
|
563
|
+
│ ├── blast-radius.ts # ctx_blast_radius
|
|
564
|
+
│ ├── hub-nodes.ts # ctx_hub_nodes
|
|
565
|
+
│ ├── bridge-nodes.ts # ctx_bridge_nodes
|
|
566
|
+
│ ├── community-list.ts # ctx_community_list
|
|
567
|
+
│ ├── architecture-overview.ts # ctx_architecture_overview
|
|
568
|
+
│ ├── knowledge-gaps.ts # ctx_knowledge_gaps
|
|
569
|
+
│ ├── surprising-connections.ts # ctx_surprising_connections
|
|
570
|
+
│ ├── wiki-generate.ts # ctx_wiki_generate
|
|
571
|
+
│ ├── graph-export.ts # ctx_graph_export
|
|
572
|
+
│ ├── git-diff-review.ts # ctx_git_diff_review
|
|
573
|
+
│ ├── refactor-preview.ts # ctx_refactor_preview
|
|
574
|
+
│ ├── execution-flow.ts # ctx_execution_flow
|
|
575
|
+
│ └── cross-repo-search.ts # ctx_cross_repo_search
|
|
576
|
+
├── rules/
|
|
577
|
+
│ ├── types.ts # Rule, RulesConfig, Violation, CheckResult, RulesConfigError
|
|
578
|
+
│ ├── loadConfig.ts # YAML + zod config loader
|
|
579
|
+
│ ├── RulesChecker.ts # picomatch glob engine — graph edges → violations
|
|
580
|
+
│ ├── reporter.ts # formatText (human) + formatJson (schemaVersion: 1)
|
|
581
|
+
│ └── index.ts # barrel export
|
|
582
|
+
├── graph/
|
|
583
|
+
│ ├── DependencyGraph.ts # In-memory graph + snapshot + multi-language
|
|
584
|
+
│ ├── CallGraphIndex.ts # Symbol-level call edges (TypeScript/JS)
|
|
585
|
+
│ ├── CommunityDetector.ts # Louvain clustering (graphology)
|
|
586
|
+
│ ├── WikiGenerator.ts # Hash-cached community Markdown wiki
|
|
587
|
+
│ └── GraphExporter.ts # GraphML / DOT / Obsidian export
|
|
588
|
+
├── ast/
|
|
589
|
+
│ ├── ASTParser.ts # tree-sitter multi-language parser
|
|
590
|
+
│ └── Skeletonizer.ts # Signature-only code views
|
|
591
|
+
├── db/
|
|
592
|
+
│ └── VectorStore.ts # LanceDB vector storage
|
|
593
|
+
├── indexer/
|
|
594
|
+
│ └── embedder.ts # HuggingFace embeddings + file collection
|
|
595
|
+
├── grammars/
|
|
596
|
+
│ └── GrammarLoader.ts # Lazy grammar download + SHA-256 verify
|
|
597
|
+
├── security/
|
|
598
|
+
│ └── PathValidator.ts # Path traversal protection (CWE-22)
|
|
599
|
+
├── watcher/
|
|
600
|
+
│ └── FileWatcher.ts # chokidar (200ms debounce, incremental)
|
|
601
|
+
├── setup/
|
|
602
|
+
│ ├── clients.ts # 13-client registry + detection
|
|
603
|
+
│ └── setup-wizard.ts # Interactive setup CLI
|
|
604
|
+
└── utils/
|
|
605
|
+
├── logger.ts # Structured JSON-lines logger (stderr)
|
|
606
|
+
└── importExtractor.ts # Regex import extraction (Python/Rust/Go/Java)
|
|
607
|
+
|
|
608
|
+
benchmarks/
|
|
609
|
+
├── benchmark.ts # Benchmark suite (graph build + search + compression)
|
|
610
|
+
└── README.md # Methodology and reproducibility guide
|
|
611
|
+
```
|
|
612
|
+
|
|
613
|
+
---
|
|
614
|
+
|
|
615
|
+
## License
|
|
616
|
+
|
|
617
|
+
[AGPL-3.0](./LICENSE) © [Codzign](https://github.com/kodiii)
|
|
618
|
+
|
|
619
|
+
ctxloom is open-source under the GNU Affero General Public License v3.0. You are free to use, modify, and distribute it under the same terms. Commercial use requires a paid license — see [ctxloom.com/pricing](https://ctxloom.com/pricing).
|