ctxloom-pro 1.0.6 → 1.0.8

package/apps/dashboard/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@ctxloom/dashboard",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev:server": "tsx server/index.ts",
+    "dev:client": "vite",
+    "build:server": "tsup --config tsup.server.config.ts",
+    "build:client": "vite build",
+    "build": "npm run build:server && npm run build:client",
+    "test": "vitest run",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@ctxloom/core": "*",
+    "cors": "^2.8.5",
+    "express": "^4.18.0",
+    "open": "^10.1.0"
+  },
+  "devDependencies": {
+    "@testing-library/jest-dom": "^6.4.0",
+    "@testing-library/react": "^16.0.0",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/cors": "^2.8.17",
+    "@types/d3": "^7.4.0",
+    "@types/express": "^4.17.21",
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
+    "@types/supertest": "^6.0.0",
+    "@vitejs/plugin-react": "^4.3.0",
+    "autoprefixer": "^10.4.0",
+    "d3": "^7.9.0",
+    "jsdom": "^24.0.0",
+    "postcss": "^8.4.0",
+    "react": "^18.3.0",
+    "react-dom": "^18.3.0",
+    "react-router-dom": "^6.23.0",
+    "recharts": "^2.12.0",
+    "supertest": "^7.0.0",
+    "tailwindcss": "^3.4.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.7.0",
+    "vite": "^5.3.0",
+    "vitest": "^3.0.0"
+  }
+}

package/dist/VectorStore-HOSUSLV7.js

@@ -0,0 +1,8 @@
+import {
+  VectorStore
+} from "./chunk-NEHYSE2Y.js";
+import "./chunk-TYDMSHV7.js";
+export {
+  VectorStore
+};
+//# sourceMappingURL=VectorStore-HOSUSLV7.js.map

package/dist/{chunk-NC4L5MCD.js → chunk-NEHYSE2Y.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-YXMXRVFH.js";
+} from "./chunk-TYDMSHV7.js";
 
 // packages/core/src/db/VectorStore.ts
 import lancedb from "@lancedb/lancedb";
@@ -141,4 +141,4 @@ var VectorStore = class {
 export {
   VectorStore
 };
-//# sourceMappingURL=chunk-NC4L5MCD.js.map
+//# sourceMappingURL=chunk-NEHYSE2Y.js.map

package/dist/chunk-TYDMSHV7.js

@@ -0,0 +1,62 @@
+// packages/core/src/utils/logger.ts
+var LEVELS = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+var ANSI = {
+  reset: "\x1B[0m",
+  dim: "\x1B[2m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m"
+};
+function getConfiguredLevel() {
+  const raw = (process.env["LOG_LEVEL"] ?? "info").toLowerCase();
+  return raw in LEVELS ? raw : "info";
+}
+function getMode() {
+  if (process.env["CTXLOOM_LOG_MODE"] === "cli") return "cli";
+  if (process.env["CTXLOOM_LOG_MODE"] === "json") return "json";
+  return process.argv.length > 2 ? "cli" : "json";
+}
+function isTTY() {
+  return process.stderr.isTTY === true;
+}
+function writeJson(level, msg, extra) {
+  const entry = { ts: (/* @__PURE__ */ new Date()).toISOString(), level, msg };
+  if (extra) Object.assign(entry, extra);
+  process.stderr.write(JSON.stringify(entry) + "\n");
+}
+function writeCli(level, msg, extra) {
+  if (level === "debug" || level === "info") return;
+  const color = level === "error" ? ANSI.red : ANSI.yellow;
+  const icon = level === "error" ? isTTY() ? "\u2717" : "X" : isTTY() ? "\u26A0" : "!";
+  const prefix = isTTY() ? `${color}${icon}${ANSI.reset}` : icon;
+  let line = `  ${prefix} ${msg}`;
+  if (extra && Object.keys(extra).length > 0) {
+    const pairs = Object.entries(extra).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
+    const dim = isTTY() ? `${ANSI.dim}${pairs}${ANSI.reset}` : pairs;
+    line += ` ${dim}`;
+  }
+  process.stderr.write(line + "\n");
+}
+function write(level, msg, extra) {
+  if (LEVELS[level] < LEVELS[getConfiguredLevel()]) return;
+  if (getMode() === "cli") {
+    writeCli(level, msg, extra);
+  } else {
+    writeJson(level, msg, extra);
+  }
+}
+var logger = {
+  debug: (msg, extra) => write("debug", msg, extra),
+  info: (msg, extra) => write("info", msg, extra),
+  warn: (msg, extra) => write("warn", msg, extra),
+  error: (msg, extra) => write("error", msg, extra)
+};
+
+export {
+  logger
+};
+//# sourceMappingURL=chunk-TYDMSHV7.js.map

package/dist/{chunk-MZRK5LFU.js → chunk-U3AVIYSJ.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-YXMXRVFH.js";
+} from "./chunk-TYDMSHV7.js";
 
 // packages/core/src/indexer/embedder.ts
 import { pipeline } from "@huggingface/transformers";
@@ -89,7 +89,7 @@ function collectFiles(dir, results = []) {
   return results;
 }
 async function indexDirectory(rootDir, onProgress) {
-  const { VectorStore } = await import("./VectorStore-G6RNAVQC.js");
+  const { VectorStore } = await import("./VectorStore-HOSUSLV7.js");
   const store = new VectorStore(path.join(rootDir, ".ctxloom", "vectors.lancedb"));
   await store.init();
   const files = collectFiles(rootDir);
@@ -142,4 +142,4 @@ export {
   collectFiles,
   indexDirectory
 };
-//# sourceMappingURL=chunk-MZRK5LFU.js.map
+//# sourceMappingURL=chunk-U3AVIYSJ.js.map

package/dist/{chunk-KPNCYRWW.js → chunk-UMFIYUGI.js}

@@ -1,13 +1,13 @@
 import {
   VectorStore
-} from "./chunk-NC4L5MCD.js";
+} from "./chunk-NEHYSE2Y.js";
 import {
   collectFiles,
   generateEmbedding
-} from "./chunk-MZRK5LFU.js";
+} from "./chunk-U3AVIYSJ.js";
 import {
   logger
-} from "./chunk-YXMXRVFH.js";
+} from "./chunk-TYDMSHV7.js";
 
 // packages/core/src/graph/DependencyGraph.ts
 import fs6 from "fs";
@@ -339,7 +339,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("python");
       this.pyLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("Python grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -352,7 +352,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("go");
       this.goLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("Go grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -365,7 +365,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("rust");
       this.rustLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("Rust grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -378,7 +378,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("java");
       this.javaLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("Java grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -388,7 +388,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("csharp");
       this.csLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("C# grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -398,7 +398,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("ruby");
       this.rubyLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("Ruby grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -408,7 +408,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("kotlin");
       this.kotlinLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("Kotlin grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -418,7 +418,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("swift");
       this.swiftLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("Swift grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -428,7 +428,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("php");
       this.phpLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("PHP grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -438,7 +438,7 @@ var ASTParser = class {
       const wasmPath = await this.grammarLoader.ensureGrammar("dart");
       this.dartLang = await TreeSitter.Language.load(wasmPath);
     } catch (err) {
-      const { logger: logger2 } = await import("./logger-SVRJYSFC.js");
+      const { logger: logger2 } = await import("./logger-PDXPCKJ6.js");
       logger2.warn("Dart grammar unavailable", { detail: err instanceof Error ? err.message : String(err) });
     }
   }
@@ -5442,9 +5442,9 @@ function registerGraphExportTool(registry, ctx) {
 
 // packages/core/src/tools/git-diff-review.ts
 import { z as z16 } from "zod";
-import { exec as exec2 } from "child_process";
+import { execFile } from "child_process";
 import { promisify as promisify2 } from "util";
-var execAsync2 = promisify2(exec2);
+var execFileAsync = promisify2(execFile);
 var Schema16 = z16.object({
   changed_files: z16.array(z16.string()).optional().describe(
     "Changed file paths (relative to project root). Omit to auto-detect from git diff HEAD~1."
@@ -5462,8 +5462,13 @@ function escapeXML16(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 async function getFileDiff(projectRoot, file) {
+  if (file.includes("\0") || file.startsWith("-")) return "";
   try {
-    const { stdout } = await execAsync2(`git diff HEAD~1 -- "${file}"`, { cwd: projectRoot });
+    const { stdout } = await execFileAsync(
+      "git",
+      ["diff", "HEAD~1", "--", file],
+      { cwd: projectRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
     return stdout.trim();
   } catch {
     return "";
@@ -5504,10 +5509,15 @@ function registerGitDiffReviewTool(registry, ctx) {
     },
     async (args) => {
       const { changed_files, depth, use_git, include_skeletons, max_diff_lines } = Schema16.parse(args);
-      let files = changed_files ?? [];
+      const validator = ctx.getPathValidator();
+      let files = (changed_files ?? []).filter((f) => validator.isWithinRoot(f));
       if (files.length === 0 && use_git) {
         try {
-          const { stdout } = await execAsync2("git diff HEAD~1 --name-only", { cwd: ctx.projectRoot });
+          const { stdout } = await execFileAsync(
+            "git",
+            ["diff", "HEAD~1", "--name-only"],
+            { cwd: ctx.projectRoot, maxBuffer: 10 * 1024 * 1024 }
+          );
           files = stdout.trim().split("\n").filter(Boolean);
         } catch {
           logger.warn("git diff failed \u2014 no changed files detected");
@@ -6083,9 +6093,9 @@ function registerApplyRefactorTool(registry, ctx) {
 
 // packages/core/src/tools/detect-changes.ts
 import { z as z21 } from "zod";
-import { exec as exec3 } from "child_process";
+import { exec as exec2 } from "child_process";
 import { promisify as promisify3 } from "util";
-var execAsync3 = promisify3(exec3);
+var execAsync2 = promisify3(exec2);
 var Schema21 = z21.object({
   changed_files: z21.array(z21.string()).optional(),
   use_git: z21.boolean().optional().default(true),
@@ -6099,7 +6109,7 @@ function escapeXML21(text) {
 }
 async function detectChangedFiles2(projectRoot) {
   try {
-    const { stdout } = await execAsync3("git diff HEAD~1 --name-only", { cwd: projectRoot });
+    const { stdout } = await execAsync2("git diff HEAD~1 --name-only", { cwd: projectRoot });
     return stdout.trim().split("\n").filter(Boolean);
   } catch {
     logger.warn("git diff failed for detect_changes");
@@ -6263,7 +6273,7 @@ function registerFullTextSearchTool(registry, ctx) {
       const { query, mode, case_sensitive, limit, context_lines } = Schema22.parse(args);
       if (mode === "semantic") {
         try {
-          const { generateEmbedding: generateEmbedding2 } = await import("./embedder-MUH5U4NC.js");
+          const { generateEmbedding: generateEmbedding2 } = await import("./embedder-BV7V7BHZ.js");
           const store = await ctx.getStore();
           const embedding = await generateEmbedding2(query);
           const results = await store.search(embedding, limit);
@@ -6300,7 +6310,7 @@ function registerFullTextSearchTool(registry, ctx) {
       let merged = keywordResults.slice(0, limit);
       if (mode === "hybrid") {
         try {
-          const { generateEmbedding: generateEmbedding2 } = await import("./embedder-MUH5U4NC.js");
+          const { generateEmbedding: generateEmbedding2 } = await import("./embedder-BV7V7BHZ.js");
           const store = await ctx.getStore();
           const embedding = await generateEmbedding2(query);
           const vectorResults = await store.search(embedding, Math.ceil(limit / 2));
@@ -6334,9 +6344,9 @@ function registerFullTextSearchTool(registry, ctx) {
 
 // packages/core/src/tools/suggested-questions.ts
 import { z as z23 } from "zod";
-import { exec as exec4 } from "child_process";
+import { exec as exec3 } from "child_process";
 import { promisify as promisify4 } from "util";
-var execAsync4 = promisify4(exec4);
+var execAsync3 = promisify4(exec3);
 var Schema23 = z23.object({
   changed_files: z23.array(z23.string()).optional(),
   use_git: z23.boolean().optional().default(true)
@@ -6347,7 +6357,7 @@ function escapeXML23(text) {
 }
 async function detectChangedFiles3(projectRoot) {
   try {
-    const { stdout } = await execAsync4("git diff HEAD~1 --name-only", { cwd: projectRoot });
+    const { stdout } = await execAsync3("git diff HEAD~1 --name-only", { cwd: projectRoot });
     return stdout.trim().split("\n").filter(Boolean);
   } catch {
     logger.warn("git diff failed for suggested_questions");
@@ -7154,9 +7164,9 @@ function registerRulesCheckTool(registry, ctx) {
 
 // packages/core/src/tools/get-affected-flows.ts
 import { z as z31 } from "zod";
-import { exec as exec5 } from "child_process";
+import { exec as exec4 } from "child_process";
 import { promisify as promisify5 } from "util";
-var execAsync5 = promisify5(exec5);
+var execAsync4 = promisify5(exec4);
 var Schema27 = z31.object({
   changed_files: z31.array(z31.string()).optional().describe(
     "Changed file paths (relative). Defaults to auto-detection from git diff HEAD~1."
@@ -7211,7 +7221,7 @@ function buildFlow(entrySymbol, entryFile, maxDepth, maxSteps, graph, callIdx) {
 }
 async function detectChangedFiles4(projectRoot) {
   try {
-    const { stdout } = await execAsync5("git diff HEAD~1 --name-only", { cwd: projectRoot });
+    const { stdout } = await execAsync4("git diff HEAD~1 --name-only", { cwd: projectRoot });
     return stdout.trim().split("\n").filter(Boolean);
   } catch {
     logger.warn("git diff failed for get_affected_flows \u2014 no changed files detected");
@@ -8021,7 +8031,7 @@ var LicenseStore = class {
     } catch (err) {
       if (process.env["CTXLOOM_DEBUG"]) {
         const detail = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`[ctxloom] LicenseStore.read failed at ${this.filePath}: ${detail}
+        process.stderr.write(`[ctxloom] LicenseStore.read failed: ${detail}
 `);
       }
       return null;
@@ -8029,7 +8039,10 @@ var LicenseStore = class {
   }
   async write(license) {
     mkdirSync(path28.dirname(this.filePath), { recursive: true });
-    writeFileSync(this.filePath, JSON.stringify(license, null, 2), "utf8");
+    writeFileSync(this.filePath, JSON.stringify(license, null, 2), {
+      encoding: "utf8",
+      mode: 384
+    });
     if (process.platform !== "win32") {
       chmodSync(this.filePath, 384);
     }
@@ -8253,15 +8266,16 @@ async function startTrial(email, opts = {}) {
 }
 
 // packages/core/src/license/telemetry.ts
+var TELEMETRY_DISABLED = process.env["CTXLOOM_NO_TELEMETRY"] === "1" || process.env["DO_NOT_TRACK"] === "1";
 var POSTHOG_HOST = "https://eu.i.posthog.com";
-var POSTHOG_KEY = process.env["POSTHOG_API_KEY"] ?? "phc_xAusXPkHxhjhzRguxcyylLO6s5Hn1ZNNeThATGP4Dlf";
-var SENTRY_DSN = process.env["SENTRY_DSN"] ?? "https://e52f4c5fdc82eca82dadb4261e474069@o4508531702497280.ingest.de.sentry.io/4511256875368528";
+var POSTHOG_KEY = process.env["POSTHOG_API_KEY"] ?? (true ? "phc_CiDkmFLcZ2K6uCpcoSUQLmFrnnUvsyXGhSxopX5TVKE6" : "");
+var SENTRY_DSN = process.env["SENTRY_DSN"] ?? (true ? "https://81c94a0f04a8e242dee493ac1e17f733@o4508531702497280.ingest.de.sentry.io/4511256875368528" : "");
 function track(event, distinctId, props = {}) {
-  if (!POSTHOG_KEY) return;
+  if (TELEMETRY_DISABLED || !POSTHOG_KEY) return;
   void sendPostHog(event, distinctId, props);
 }
 function captureError(err, context = {}) {
-  if (!SENTRY_DSN) return;
+  if (TELEMETRY_DISABLED || !SENTRY_DSN) return;
   void sendSentry(err, context);
 }
 async function sendPostHog(event, distinctId, props) {
@@ -8406,4 +8420,4 @@ export {
   track,
   captureError
 };
-//# sourceMappingURL=chunk-KPNCYRWW.js.map
+//# sourceMappingURL=chunk-UMFIYUGI.js.map

package/dist/{dashboard-LVSRXGZN.js → dashboard-MD73U3AR.js}

@@ -3,11 +3,11 @@ import path from "path";
 import { fileURLToPath } from "url";
 var __dirname = path.dirname(fileURLToPath(import.meta.url));
 async function startDashboard(options) {
-  const serverPath = path.resolve(__dirname, "../apps/dashboard/server/index.js");
+  const serverPath = path.resolve(__dirname, "../apps/dashboard/dist/server/index.js");
   const mod = await import(serverPath);
   await mod.startDashboard(options);
 }
 export {
   startDashboard
 };
-//# sourceMappingURL=dashboard-LVSRXGZN.js.map
+//# sourceMappingURL=dashboard-MD73U3AR.js.map

package/dist/{embedder-MUH5U4NC.js → embedder-BV7V7BHZ.js}

@@ -3,12 +3,12 @@ import {
   collectFiles,
   generateEmbedding,
   indexDirectory
-} from "./chunk-MZRK5LFU.js";
-import "./chunk-YXMXRVFH.js";
+} from "./chunk-U3AVIYSJ.js";
+import "./chunk-TYDMSHV7.js";
 export {
   EMBEDDING_DIMENSION,
   collectFiles,
   generateEmbedding,
   indexDirectory
 };
-//# sourceMappingURL=embedder-MUH5U4NC.js.map
+//# sourceMappingURL=embedder-BV7V7BHZ.js.map

package/dist/index.js

@@ -34,17 +34,17 @@ import {
   startTrial,
   track,
   writeCODEOWNERS
-} from "./chunk-KPNCYRWW.js";
+} from "./chunk-UMFIYUGI.js";
 import {
   VectorStore
-} from "./chunk-NC4L5MCD.js";
+} from "./chunk-NEHYSE2Y.js";
 import {
   generateEmbedding,
   indexDirectory
-} from "./chunk-MZRK5LFU.js";
+} from "./chunk-U3AVIYSJ.js";
 import {
   logger
-} from "./chunk-YXMXRVFH.js";
+} from "./chunk-TYDMSHV7.js";
 
 // src/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -55,10 +55,13 @@ import fs from "fs";
 var PROJECT_ROOT = (() => {
   if (process.env.CTXLOOM_ROOT) return process.env.CTXLOOM_ROOT;
   const cwd = process.cwd();
-  logger.warn(
-    "CTXLOOM_ROOT not set \u2014 defaulting to cwd. Set CTXLOOM_ROOT in your MCP server config to point at the project you want to index.",
-    { cwd }
-  );
+  const isCli = process.argv.length > 2;
+  if (!isCli) {
+    logger.warn(
+      "CTXLOOM_ROOT not set \u2014 defaulting to cwd. Set CTXLOOM_ROOT in your MCP server config to point at the project you want to index.",
+      { cwd }
+    );
+  }
   return cwd;
 })();
 var DB_PATH = path.join(PROJECT_ROOT, ".ctxloom", "vectors.lancedb");
@@ -571,14 +574,12 @@ function buildActivityFromOverlay(store) {
     lastCommitTimestamp
   }));
 }
-var LICENSE_BYPASS = process.env["CTXLOOM_LICENSE_BYPASS"] === "1";
 var LICENSE_GATE_BYPASS_COMMANDS = /* @__PURE__ */ new Set(["trial", "activate", "deactivate", "status", "--help"]);
 async function checkLicense() {
-  if (LICENSE_BYPASS) return;
   if (command !== void 0 && LICENSE_GATE_BYPASS_COMMANDS.has(command)) return;
   const ciKey = process.env["CTXLOOM_LICENSE_KEY"];
   if (ciKey) {
-    const { ApiClient } = await import("./src-GYVQEDV5.js");
+    const { ApiClient } = await import("./src-D3CS3BFE.js");
     const client = new ApiClient(process.env["CTXLOOM_API_BASE"]);
     try {
       const result = await client.validate(ciKey, "ci-ephemeral");
@@ -934,7 +935,7 @@ async function main() {
       );
       const open = args.includes("--open") || args.includes("-o");
       const root = process.env.CTXLOOM_ROOT ?? process.cwd();
-      const { startDashboard } = await import("./dashboard-LVSRXGZN.js");
+      const { startDashboard } = await import("./dashboard-MD73U3AR.js");
       await startDashboard({ root, port, open });
       break;
     }
@@ -1099,7 +1100,7 @@ Suggested reviewers for ${files.length} file(s):`);
         process.stderr.write("[ctxloom] --limit must be a non-negative integer (0 for unlimited)\n");
         process.exit(2);
       }
-      const { loadRulesConfig, RulesChecker, formatText, formatJson, RulesConfigError } = await import("./src-GYVQEDV5.js");
+      const { loadRulesConfig, RulesChecker, formatText, formatJson, RulesConfigError } = await import("./src-D3CS3BFE.js");
       let config;
       try {
         config = await loadRulesConfig(root);
@@ -1123,7 +1124,7 @@ Suggested reviewers for ${files.length} file(s):`);
       }
       let graph;
       if (useSnapshot) {
-        const { DependencyGraph: DG } = await import("./src-GYVQEDV5.js");
+        const { DependencyGraph: DG } = await import("./src-D3CS3BFE.js");
         graph = new DG();
         const loaded = await graph.loadSnapshotOnly(root);
         if (!loaded) {
@@ -1132,7 +1133,7 @@ Suggested reviewers for ${files.length} file(s):`);
         }
       } else {
         process.stderr.write("[ctxloom] Building dependency graph...\n");
-        const { ASTParser: ASTParser2, DependencyGraph: DependencyGraph2 } = await import("./src-GYVQEDV5.js");
+        const { ASTParser: ASTParser2, DependencyGraph: DependencyGraph2 } = await import("./src-D3CS3BFE.js");
         let parser;
         try {
           parser = new ASTParser2();

package/dist/logger-PDXPCKJ6.js

@@ -0,0 +1,7 @@
+import {
+  logger
+} from "./chunk-TYDMSHV7.js";
+export {
+  logger
+};
+//# sourceMappingURL=logger-PDXPCKJ6.js.map

package/dist/{src-GYVQEDV5.js → src-D3CS3BFE.js}

@@ -69,19 +69,19 @@ import {
   startTrial,
   track,
   writeCODEOWNERS
-} from "./chunk-KPNCYRWW.js";
+} from "./chunk-UMFIYUGI.js";
 import {
   VectorStore
-} from "./chunk-NC4L5MCD.js";
+} from "./chunk-NEHYSE2Y.js";
 import {
   EMBEDDING_DIMENSION,
   collectFiles,
   generateEmbedding,
   indexDirectory
-} from "./chunk-MZRK5LFU.js";
+} from "./chunk-U3AVIYSJ.js";
 import {
   logger
-} from "./chunk-YXMXRVFH.js";
+} from "./chunk-TYDMSHV7.js";
 export {
   ASTParser,
   ApiClient,
@@ -160,4 +160,4 @@ export {
   track,
   writeCODEOWNERS
 };
-//# sourceMappingURL=src-GYVQEDV5.js.map
+//# sourceMappingURL=src-D3CS3BFE.js.map

package/dist/workers/indexerWorker.js

@@ -1,16 +1,31 @@
 import {
   VectorStore
-} from "../chunk-NC4L5MCD.js";
+} from "../chunk-NEHYSE2Y.js";
 import {
   generateEmbedding
-} from "../chunk-MZRK5LFU.js";
-import "../chunk-YXMXRVFH.js";
+} from "../chunk-U3AVIYSJ.js";
+import "../chunk-TYDMSHV7.js";
 
 // packages/core/src/workers/indexerWorker.ts
 import { parentPort, workerData } from "worker_threads";
 import path from "path";
+import { z } from "zod";
+var WorkerDataSchema = z.object({
+  filePath: z.string().min(1),
+  content: z.string(),
+  root: z.string().min(1),
+  dbPath: z.string().min(1)
+});
 async function run() {
-  const { filePath, content, root, dbPath } = workerData;
+  const parsed = WorkerDataSchema.safeParse(workerData);
+  if (!parsed.success) {
+    parentPort?.postMessage({
+      status: "error",
+      error: `invalid workerData: ${parsed.error.message}`
+    });
+    return;
+  }
+  const { filePath, content, root, dbPath } = parsed.data;
   let store = null;
   try {
     const relPath = path.relative(root, filePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ctxloom-pro",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "ctxloom — The Universal Code Context Engine. A local-first MCP server providing intelligent code context via hybrid Vector + AST + Graph search with Skeletonization (92% token reduction).",
   "type": "module",
   "main": "dist/index.js",
@@ -21,11 +21,16 @@
   "files": [
     "dist/**/*",
     "!dist/**/*.map",
+    "apps/dashboard/dist/**/*",
+    "!apps/dashboard/dist/**/*.map",
+    "apps/dashboard/package.json",
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsup",
-    "prepublishOnly": "tsup",
+    "build": "tsup && npm run -w @ctxloom/dashboard build",
+    "build:cli": "tsup",
+    "build:dashboard": "npm run -w @ctxloom/dashboard build",
+    "prepublishOnly": "tsup && npm run -w @ctxloom/dashboard build",
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
     "test": "vitest run",

package/dist/VectorStore-G6RNAVQC.js

@@ -1,8 +0,0 @@
-import {
-  VectorStore
-} from "./chunk-NC4L5MCD.js";
-import "./chunk-YXMXRVFH.js";
-export {
-  VectorStore
-};
-//# sourceMappingURL=VectorStore-G6RNAVQC.js.map