knodin 0.7.6 → 0.8.3

package/docs/releases/0.7.4.md

@@ -0,0 +1,17 @@
+# knodin 0.7.4
+
+This patch release preserves the opt-in diagnostics and support-bundle workflow
+introduced in 0.7.3 while hardening the structural cold-start parser.
+
+- Replaces a potentially super-linear declaration-matching expression with a
+  bounded, linear parser for typed function declarations.
+- Handles balanced parameter lists without mistaking calls or control-flow
+  statements for declarations.
+- Adds regression coverage for typed declarations, nested calls, and negative
+  structural matches.
+
+Diagnostics remain local and disabled until a user enables them. Knodin never
+uploads a diagnostics bundle automatically; the user must inspect and
+deliberately share it for troubleshooting.
+
+This remains an ordinary 0.x release, not a dogfood-only build and not GA.

package/docs/releases/0.7.5.md

@@ -0,0 +1,20 @@
+# knodin 0.7.5
+
+This patch release makes the one-tool MCP gateway more resilient and corrects
+the immutable-package handoff used by internal Artifactory publication.
+
+- Serializes parallel gateway operations so expensive graph requests do not
+  compete for the same local engine and database resources.
+- Emits MCP progress notifications for queued and long-running operations when
+  the client supplies a progress token.
+- Returns stable, actionable tool-error details while keeping the MCP transport
+  available for subsequent requests.
+- On release retries, downloads npm's immutable archive, verifies its registry
+  integrity, proves its unpacked content matches the release build, and uses
+  those exact bytes for attestations and downstream publication.
+
+Diagnostics remain local and disabled until a user enables them. Knodin never
+uploads a diagnostics bundle automatically; the user must inspect and
+deliberately share it for troubleshooting.
+
+This remains an ordinary 0.x release, not a dogfood-only build and not GA.

package/docs/releases/0.8.0.md

@@ -0,0 +1,74 @@
+# knodin 0.8.0
+
+This release makes repository-wide setup more dependable, strengthens the
+one-tool MCP gateway, adds a whole-repository architecture visualization, and
+completes the move to knodin's authoritative source repository.
+
+It is a minor rather than a patch release because `knodin visualize` and
+`knodin index` each gain a new user-facing capability. Note that npm published
+0.7.6 from the previous source repository; 0.7.7 was prepared but never
+released, and its changes are included here.
+
+- Repository initialization is uncapped by default, preventing large checkouts
+  from being terminated at the former 768 MiB ceiling. Teams that need a bound
+  can set `repositoryInitialization.memoryLimitMiB` or pass
+  `--memory-limit-mib`; the minimum configured limit is 128 MiB.
+- Multi-repository initialization reports bounded progress and per-repository
+  outcomes while continuing to skip linked worktrees by default.
+- `knodin visualize --scope repo` draws the repository's dependency graph as a
+  self-contained SVG artifact, with `--granularity file` or `symbol`. It reads
+  every recorded dependency rather than a ranked summary, states how much the
+  node, edge, and byte budgets withheld, and distinguishes edges backed by a
+  narrow source declaration from heuristic or inferred ones. Coordinates are
+  computed when the artifact is written, so it contains no script, makes no
+  network request, and reproduces byte-identical output from identical
+  evidence. The `--max-bytes` ceiling rises to 2097152 to accommodate it.
+- `knodin index --sarif <file>` imports another analyzer's findings from a SARIF
+  log. SARIF rather than a specific tool means one importer covers Salesforce
+  Code Analyzer, ESLint, Semgrep, CodeQL, PMD and Trivy. Findings are stored
+  separately from symbols and references and never merged into them: knodin
+  resolves references from source, while a finding is another tool's judgement
+  about a location. What the graph adds is ranking, since an analyzer reports
+  findings file by file and cannot know which files matter. Locations resolve
+  through symlinks, and a finding that cannot be placed inside the repository is
+  counted rather than attached to a guessed path.
+- Every import bound is now overridable, for both SARIF and SCIP, and each
+  refusal names the flag and a value that would admit the input. A ceiling the
+  operator cannot move is just a failure. Two limits remain outside knodin's
+  control and are reported as such: a SARIF log is parsed whole, so one beyond
+  roughly 512 MiB cannot be read by this runtime at all, and a smaller log can
+  still exhaust the default heap.
+- `knodin index --scip <file>` no longer treats the SCIP index itself as a
+  source file to index. Command-scoped flag values were being mistaken for
+  positional paths.
+- Indexing no longer overflows the call stack on large repositories. Appending
+  the file list by spreading it as arguments exceeded the runtime's argument
+  limit; observed on a 40,000-file checkout.
+- Independent CLI or MCP processes can no longer run repair concurrently
+  against one worktree. A second repair reports the holding process and its
+  start time, and a lease left by a crashed process recovers automatically.
+- Invoking knodin from a Node.js 20 project no longer fails. The launcher
+  locates a supported Node.js 24 or newer runtime and relaunches into it,
+  exiting with that runtime's status or signal. The Node.js 20-to-24 handoff
+  is covered by unit tests; the packaged smoke test certifies it on Node.js 26
+  only.
+- The MCP gateway enforces documented freshness and diagnostics bounds at the
+  schema boundary and resolves Git only from trusted installation locations.
+- Diagnostics documentation now uses `sinceHours` consistently, and repository
+  documentation accurately describes the 250 ms memory-enforcement interval.
+- Package metadata, release verification, and mirror policy now point to the
+  authoritative `DTS-Productivity-Engineering/knodin` repository. Homebrew
+  installs from the `knodin/homebrew-tap` formula, which consumes the published
+  npm tarball, and the Enterprise Apps GHES repository remains a read-only
+  mirror.
+- Competitive outcome and behavior-contract evaluations remain reproducible
+  from checked-in fixtures without turning narrow results into unsupported
+  superiority claims.
+
+Knodin remains local-first: indexing and diagnostics do not require a hosted
+service, authentication, or source-code upload. Diagnostics bundles are created
+only on explicit request and are never uploaded automatically.
+
+This is an ordinary 0.x release, not a GA declaration. External certification
+and enterprise-governance evidence remain outside this release and are not
+claimed by it.

package/docs/releases/0.8.2.md

@@ -0,0 +1,34 @@
+# knodin 0.8.2
+
+This patch release makes command startup resilient to a deleted working
+directory and completes a full-baseline Sonar audit of the repository.
+
+- `knodin --version` no longer crashes with `uv_cwd` when the directory inherited
+  by the process has been removed. Cold structural and compression fast paths now
+  resolve the working directory only when the selected command actually needs a
+  repository. The built launcher is exercised from a deleted directory as part
+  of release verification.
+- Fixes inert Terraform indexing code that prepared reference and dependency
+  inserts from collections that could only be empty.
+- Makes the impact-query test-file regular expression's alternation explicit,
+  preserving its intended matching precedence.
+- Records the disposition of the complete Sonar baseline: 1,351 retained issue
+  records were inspected, including 375 that were open at the start. Correctness
+  findings were fixed; security and maintainability findings rejected after
+  validation now have checked-in, rule-scoped exclusions and rationale.
+- The post-remediation SonarQube scan passes its quality gate with zero open and
+  zero unresolved issues. The exclusions do not disable unreviewed rules,
+  coverage, duplication analysis, or the quality gate.
+
+If Homebrew is invoked from a directory that has already been deleted, change
+to an existing directory before upgrading because Homebrew itself requires a
+valid working directory:
+
+```sh
+cd /
+brew update
+brew upgrade knodin/tap/knodin
+knodin --version
+```
+
+This remains an ordinary 0.x release, not a dogfood-only build and not GA.

package/docs/releases/0.8.3.md

@@ -0,0 +1,47 @@
+# knodin 0.8.3
+
+This release strengthens Knodin's source-evidenced graph across repository
+lifecycle, cross-substrate analysis, and bounded organization-scale workflows.
+
+- Adds bounded repository-wide resource reachability for source-proven
+  environment, file, fetch, console, and database paths. Results retain stable
+  identities, exact evidence, explicit unsupported cases, freshness, response
+  budgets, and deterministic continuation.
+- Resolves source-proven TypeScript dependency-injection wiring for supported
+  Inversify and tsyringe forms. Framework and registry scoping, ambiguity,
+  conditional wiring, incremental refresh, and removal are represented without
+  guessing across containers or frameworks.
+- Proves exact Salesforce Flow-to-Apex paths from Flow action metadata to unique
+  `@InvocableMethod` targets, including targeted Apex refresh, source evidence,
+  omissions, freshness, and bounded responses.
+- Makes repair converge truthfully across schema migration, empty repositories,
+  final verification failure, and future-schema refusal. Scoped repairs avoid
+  unrelated TypeScript DI reads while still rebuilding affected DI evidence.
+- Strengthens the public behavioral contract and positioning with replayed
+  production CLI, MCP, and engine responses. C97-C101 evidence is independently
+  replayable and source-bound; failed performance experiments remain recorded
+  as limitations rather than superiority claims.
+- Prevents stale package and barrel-resolution caches, avoids caching transient
+  filesystem failures, and keeps independent engine instances from closing
+  resources still owned by another instance.
+- Reuses a bounded, generation-scoped resource corpus so warm reachability
+  queries do not reread every indexed source file while still failing closed on
+  disk drift.
+- Bounds cross-substrate evidence consistently with the outer response budget,
+  fixes member-call reachability false positives, and makes evidence verifiers
+  recompute their claim-bearing gates instead of trusting stored booleans.
+- Removes duplicated progress-worker and response-budget machinery, updates the
+  audited development dependency set, and fixes lifecycle evaluation owners so
+  the complete test process terminates.
+- Records that pull requests are intentionally expensive because Sonar and the
+  complete repository gates run on each review stream; compatible work should
+  be stacked into one coherent PR rather than opened automatically as many small
+  PRs.
+
+The one-process semantic-residency evaluation remains a retained no-go: neither
+in-process ONNX disposal, worker threads, quantized weights, nor vector/cache
+eviction met the repeatable memory gate without violating the local one-process
+product boundary. Knodin retains lazy loading and bounded caches rather than
+claiming unsupported reclamation.
+
+This remains an ordinary 0.x release, not a dogfood-only build and not GA.

package/package.json

@@ -1,23 +1,141 @@
 {
 	"name": "knodin",
-	"version": "0.7.6",
+	"version": "0.8.3",
 	"description": "knodin — source-evidenced local code intelligence with known bounds. Stable identity, fresh evidence, truthful budgets, and recoverable bounded views.",
 	"license": "MIT",
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/knodin/knodin.git"
+		"url": "git+https://github.com/DTS-Productivity-Engineering/knodin.git"
 	},
-	"homepage": "https://github.com/knodin/knodin#readme",
+	"homepage": "https://github.com/DTS-Productivity-Engineering/knodin#readme",
 	"bugs": {
-		"url": "https://github.com/knodin/knodin/issues"
+		"url": "https://github.com/DTS-Productivity-Engineering/knodin/issues"
+	},
+	"publishConfig": {
+		"access": "public",
+		"registry": "https://registry.npmjs.org/"
 	},
 	"type": "module",
 	"bin": {
 		"knodin": "dist/bin/launcher.js"
 	},
+	"files": [
+		"dist",
+		"docs/DEAD-CODE-AND-IMPACT.md",
+		"docs/DOCTOR-AND-UPDATES.md",
+		"docs/DIAGNOSTICS.md",
+		"docs/BEHAVIORAL-CONTRACT.md",
+		"docs/DEMO.md",
+		"docs/COMPARISON.md",
+		"docs/COMPETITIVE-LANDSCAPE-2026-08.md",
+		"docs/INDEXING-POLICY-AND-PROVENANCE.md",
+		"docs/HANDOFF.md",
+		"docs/INSTALLATION.md",
+		"docs/MCP.md",
+		"docs/COMMAND-OUTPUT-COMPRESSION.md",
+		"docs/CONTAINED-EXECUTION.md",
+		"docs/PROGRESSIVE-EVIDENCE.md",
+		"docs/GIT-HISTORY-REVIEW.md",
+		"docs/SCIP-IMPORT.md",
+		"docs/CLI.md",
+		"docs/PT-ACCESS-RECOMMENDATION.md",
+		"docs/REPOSITORIES-AND-WORKTREES.md",
+		"docs/RELEASE-0.3-EVIDENCE.md",
+		"docs/SIGNED-UPDATES.md",
+		"docs/releases/0.3.0.md",
+		"docs/releases/0.4.0.md",
+		"docs/releases/0.4.1.md",
+		"docs/releases/0.4.2.md",
+		"docs/releases/0.4.3.md",
+		"docs/releases/0.5.0.md",
+		"docs/releases/0.5.1.md",
+		"docs/releases/0.6.0.md",
+		"docs/releases/0.7.0.md",
+		"docs/releases/0.7.1.md",
+		"docs/releases/0.7.2.md",
+		"docs/releases/0.7.3.md",
+		"docs/releases/0.7.4.md",
+		"docs/releases/0.7.5.md",
+		"docs/releases/0.8.0.md",
+		"docs/releases/0.8.2.md",
+		"docs/releases/0.8.3.md",
+		"docs/assets/knodin-favicon.svg",
+		"docs/SYSTEMS-AND-RELATIONSHIPS.md",
+		"docs/TELEMETRY.md",
+		"docs/TOKEN-OPTIMIZER-SCORECARD.md",
+		"benchmarks/competitors/SYNTHESIS.md",
+		"roadmap/competitive-roadmap.md",
+		"schemas/release-attestation-v1.schema.json",
+		"schemas/support-bundle-v2.schema.json",
+		"*.wasm"
+	],
 	"engines": {
 		"node": ">=24.0.0"
 	},
+	"scripts": {
+		"prepack": "npm run build",
+		"hooks:install": "tsx scripts/prepare-hooks.ts",
+		"dev": "tsx watch src/server.ts",
+		"start": "tsx src/server.ts",
+		"cli": "tsx bin/cli.ts",
+		"clean": "node scripts/clean-dist.mjs",
+		"build": "npm run clean && tsc -p tsconfig.build.json",
+		"typecheck": "tsc --noEmit",
+		"test": "tsx scripts/run-vitest-shards.ts",
+		"test:handles": "vitest run --reporter=verbose --reporter=hanging-process",
+		"test:watch": "vitest --watch",
+		"test:coverage": "tsx scripts/run-vitest-shards.ts --coverage",
+		"scan:sonar": "npm run test:coverage && sh scripts/run-sonar-scan.sh",
+		"mirror:sync": "sh tools/hooks/sync-ghes-mirror.sh",
+		"test:pack-install": "tsx scripts/pack-install-smoke.ts",
+		"test:package-managers": "tsx scripts/package-manager-smoke.ts",
+		"test:naming-screen": "node --test scripts/naming-screen.test.js",
+		"measure:schema": "tsx scripts/measure-tool-schema.ts",
+		"check:dependency-deprecations": "tsx scripts/check-dependency-deprecations.ts",
+		"check:hygiene": "node scripts/check-repository-hygiene.mjs",
+		"check:roadmap": "tsx scripts/check-roadmap.ts",
+		"verify:c79": "tsx scripts/verify-c79.ts",
+		"bench:c80": "tsx benchmarks/evaluations/c80-structural-routing/runner.ts",
+		"verify:c80": "tsx scripts/verify-c80.ts",
+		"bench:c81": "tsx benchmarks/evaluations/c81-powered-benchmark/runner.ts",
+		"verify:c81": "tsx scripts/verify-c81.ts",
+		"bench:c82": "tsx benchmarks/evaluations/c82-compress-diagnose/runner.ts",
+		"verify:c82": "tsx scripts/verify-c82.ts",
+		"bench:c83": "tsx benchmarks/evaluations/c83-progressive-evidence/runner.ts",
+		"verify:c83": "tsx scripts/verify-c83.ts",
+		"bench:c84": "tsx benchmarks/evaluations/c84-scip-import/runner.ts",
+		"verify:c84": "tsx scripts/verify-c84.ts",
+		"bench:c85": "tsx benchmarks/evaluations/c85-git-history/runner.ts",
+		"verify:c85": "tsx scripts/verify-c85.ts",
+		"bench:c86": "tsx benchmarks/evaluations/c86-static-embeddings/runner.ts",
+		"verify:c86": "tsx scripts/verify-c86.ts",
+		"bench:c87": "tsx benchmarks/evaluations/c87-structural-cold-start/runner.ts",
+		"verify:c87": "tsx scripts/verify-c87.ts",
+		"bench:c88": "tsx benchmarks/evaluations/c88-contained-execution/runner.ts",
+		"verify:c88": "tsx scripts/verify-c88.ts",
+		"bench:c93": "tsx benchmarks/evaluations/c93-engineering-outcomes/runner.ts",
+		"verify:c93": "tsx scripts/verify-c93.ts",
+		"verify:c95": "tsx scripts/verify-c95.ts && vitest run src/__tests__/unit/behavior-contract.spec.ts src/__tests__/unit/failure-diagnosis.spec.ts src/__tests__/unit/impact.spec.ts src/__tests__/unit/freshness.spec.ts",
+		"bench:c97": "tsx benchmarks/evaluations/c97-one-process-semantic-residency/runner.ts",
+		"verify:c97": "tsx scripts/verify-c97.ts",
+		"bench:c98": "tsx benchmarks/evaluations/c98-resource-reachability/runner.ts",
+		"verify:c98": "tsx scripts/verify-c98.ts && vitest run src/__tests__/unit/resource-reachability.spec.ts",
+		"bench:c99": "tsx benchmarks/evaluations/c99-typescript-di/runner.ts",
+		"verify:c99": "tsx scripts/verify-c99.ts && vitest run src/__tests__/unit/typescript-di.spec.ts",
+		"bench:c100": "tsx benchmarks/evaluations/c100-flow-apex-path/runner.ts",
+		"verify:c100": "tsx scripts/verify-c100.ts && vitest run src/__tests__/unit/salesforce-metadata.spec.ts",
+		"bench:c101": "tsx benchmarks/evaluations/c101-contract-positioning/runner.ts",
+		"verify:c101": "tsx scripts/verify-c101.ts",
+		"bench:ann": "bun scripts/ann-bench.ts",
+		"bench:perf": "tsx scripts/perf-bench.ts",
+		"bench:competitive": "tsx scripts/competitive-bakeoff.ts",
+		"bench:token-optimizer": "tsx benchmarks/evaluations/token-optimizer-20260730/runner.ts",
+		"audit:token-optimizer": "tsx scripts/token-optimizer-source-audit.ts",
+		"release:attestation": "tsx scripts/release-attestation.ts",
+		"release:preflight": "tsx scripts/release-preflight.ts",
+		"lint": "biome check .",
+		"lint:fix": "biome check --write ."
+	},
 	"dependencies": {
 		"@huggingface/transformers": "^4.2.0",
 		"@modelcontextprotocol/sdk": "^1.30.0",
@@ -31,5 +149,22 @@
 		"web-tree-sitter-sfapex": "2.4.1",
 		"yaml": "2.9.0",
 		"zod": "^4.3.6"
+	},
+	"overrides": {
+		"@hono/node-server": "^2.0.5",
+		"adm-zip": "^0.6.0",
+		"fast-uri": "^4.1.1",
+		"sharp": "^0.35.3"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "2.4.6",
+		"@types/bun": "^1.3.14",
+		"@types/node": "^24.10.0",
+		"@vitest/coverage-v8": "^4.1.10",
+		"ajv": "8.20.0",
+		"lefthook": "^2.1.5",
+		"tsx": "^4.21.0",
+		"typescript": "^5.9.3",
+		"vitest": "^4.1.3"
 	}
 }