kodingo-cli 1.0.38 → 1.1.1

package/dist/cli.js

@@ -14,6 +14,9 @@ const deny_1 = require("./commands/deny");
 const scan_git_1 = require("./commands/scan-git");
 const scan_claude_1 = require("./commands/scan-claude");
 const scan_repo_1 = require("./commands/scan-repo");
+const sync_graph_1 = require("./commands/sync-graph");
+const sync_dependencies_1 = require("./commands/sync-dependencies");
+const security_scan_1 = require("./commands/security-scan");
 const init_1 = require("./commands/init");
 const install_hook_1 = require("./commands/install-hook");
 const update_1 = require("./commands/update");
@@ -231,6 +234,36 @@ program
         payload.repo = String(options.repo);
     await (0, scan_repo_1.scanRepoCommand)(payload);
 });
+program
+    .command("sync-graph")
+    .description("Build and sync the structural relationship graph for the current repo")
+    .option("--repo <path>", "repo path to scan")
+    .action(async (options) => {
+    const payload = {};
+    if (options.repo)
+        payload.repo = String(options.repo);
+    await (0, sync_graph_1.syncGraphCommand)(payload);
+});
+program
+    .command("sync-dependencies")
+    .description("Extract and sync declared dependencies for security scanning")
+    .option("--repo <path>", "repo path to scan")
+    .action(async (options) => {
+    const payload = {};
+    if (options.repo)
+        payload.repo = String(options.repo);
+    await (0, sync_dependencies_1.syncDependenciesCommand)(payload);
+});
+program
+    .command("security-scan")
+    .description("Scan synced dependencies for known vulnerabilities")
+    .option("--repo <path>", "repo path to scan")
+    .action(async (options) => {
+    const payload = {};
+    if (options.repo)
+        payload.repo = String(options.repo);
+    await (0, security_scan_1.securityScanCommand)(payload);
+});
 program
     .command("context")
     .description("Get affirmed memories for a file — designed for AI agents")

package/dist/commands/init.js

@@ -289,7 +289,24 @@ function registerInitCommand(program) {
             catch { }
             console.log(`✔ Connected. Token saved to ${persistence_config_1.CONFIG_PATH}`);
             console.log("\nKortex is now watching this repo.");
-            console.log("Run `kodingo install-hook` to capture memories on every commit.\n");
+            // Install the git hook automatically — no manual step required.
+            // This is what triggers scan-git and sync-dependencies on every future
+            // commit, silently in the background.
+            try {
+                const { installHookCommand } = await Promise.resolve().then(() => __importStar(require("./install-hook")));
+                await installHookCommand({ repo: repoRoot });
+                console.log("✔ Git hook installed — memories and dependency data will stay current automatically on every commit.\n");
+            }
+            catch (err) {
+                console.log(`⚠ Could not auto-install git hook (${err.message}). Run \`kodingo install-hook\` manually to enable automatic capture.\n`);
+            }
+            // Initial dependency sync — so security scanning has data immediately,
+            // rather than waiting for the next commit to trigger the hook.
+            try {
+                const { syncDependenciesCommand } = await Promise.resolve().then(() => __importStar(require("./sync-dependencies")));
+                await syncDependenciesCommand({ repo: repoRoot, silent: true });
+            }
+            catch { }
             // Auto-scan existing codebase
             try {
                 const { scanRepoCommand } = await Promise.resolve().then(() => __importStar(require("./scan-repo")));

package/dist/commands/install-hook.js

@@ -18,6 +18,8 @@ async function installHookCommand(options) {
         "# <kodingo>",
         "# Kodingo: auto-infer decision memory from git commits",
         `"${kodingoBin}" scan-git --repo "$(git rev-parse --show-toplevel)" &`,
+        "# Kodingo Security: keep dependency data current for vulnerability scanning",
+        `"${kodingoBin}" sync-dependencies --repo "$(git rev-parse --show-toplevel)" &`,
         "# </kodingo>",
     ].join("\n");
     // Pre-commit hook — runs synchronously to enforce guardrails

package/dist/commands/scan-repo.js

@@ -55,6 +55,8 @@ const path_1 = __importDefault(require("path"));
 const persistence_config_1 = require("../utils/persistence-config");
 const os = __importStar(require("os"));
 const ast_parser_1 = require("../utils/ast-parser");
+const graph_builder_1 = require("../utils/graph-builder");
+const context_assembler_1 = require("../utils/context-assembler");
 const API_BASE = "https://kodingo-api.onrender.com";
 const SUPPORTED_EXTENSIONS = [
     ".ts", ".tsx", ".js", ".jsx",
@@ -124,7 +126,8 @@ async function fetchExistingSymbols(token, repo, apiUrl) {
             if (!res.ok)
                 break;
             const data = await res.json();
-            for (const m of data.memories ?? []) {
+            const page = data.data ?? [];
+            for (const m of page) {
                 if (m.symbol) {
                     // Store both symbol-only and symbol::repo keys for accurate matching
                     known.add(m.symbol);
@@ -133,8 +136,8 @@ async function fetchExistingSymbols(token, repo, apiUrl) {
                 }
             }
             offset += limit;
-            if (offset >= (data.total ?? 0))
-                break;
+            if (page.length < limit)
+                break; // fewer than a full page means we've reached the end
         }
     }
     catch { }
@@ -150,12 +153,29 @@ async function sendSignal(token, apiUrl, memoryId, weightClass) {
     }
     catch { }
 }
-async function inferAndCapture(token, symbol, repo) {
+async function inferAndCapture(token, symbol, repo, graph, repoRoot) {
     try {
-        const inferRes = await fetch(`${API_BASE}/infer`, {
+        // Use contextual inference when the graph knows this symbol — richer, structure-grounded reasoning.
+        // Falls back to isolated /infer for symbols the graph didn't resolve (e.g. parse failures).
+        const useContextual = graph && symbol.fingerprint && graph.nodes[symbol.fingerprint];
+        const endpoint = useContextual ? "/infer/contextual" : "/infer";
+        let body = { symbol: symbol.name, code: symbol.code };
+        if (useContextual && graph && symbol.fingerprint) {
+            const assembled = (0, context_assembler_1.assembleContext)(repoRoot, graph, symbol.fingerprint);
+            if (assembled) {
+                body = {
+                    symbol: symbol.name,
+                    code: symbol.code,
+                    callers: assembled.callers.map(c => ({ name: c.name, snippet: c.snippet, confidence: c.confidence })),
+                    callees: assembled.callees.map(c => ({ name: c.name, snippet: c.snippet, confidence: c.confidence })),
+                    weakestConfidence: assembled.weakestConfidence,
+                };
+            }
+        }
+        const inferRes = await fetch(`${API_BASE}${endpoint}`, {
             method: "POST",
             headers: { "Content-Type": "application/json", "X-Kodingo-Token": token },
-            body: JSON.stringify({ symbol: symbol.name, code: symbol.code }),
+            body: JSON.stringify(body),
         });
         if (!inferRes.ok)
             return false;
@@ -217,8 +237,27 @@ async function scanRepoCommand(options = {}) {
     }
     // Fetch all existing memory symbols in one bulk call
     const { known: existingSymbols, idMap: existingIds } = await fetchExistingSymbols(token, repoName, apiUrl);
-    // Shuffle so repeated runs cover different parts of the codebase
-    const shuffled = [...allSymbols].sort(() => Math.random() - 0.5);
+    // Build (or reuse) the structural graph — used to order symbols by
+    // centrality (most structurally critical first) instead of randomly,
+    // and to assemble context for richer, structure-grounded inference.
+    let graph = null;
+    try {
+        graph = await (0, graph_builder_1.buildGraph)(repoRoot);
+        (0, graph_builder_1.saveGraph)(repoRoot, graph);
+    }
+    catch {
+        graph = null;
+    }
+    const ordered = graph
+        ? [...allSymbols].sort((a, b) => {
+            const centralityA = a.fingerprint && graph.nodes[a.fingerprint] ? graph.nodes[a.fingerprint].centrality : -1;
+            const centralityB = b.fingerprint && graph.nodes[b.fingerprint] ? graph.nodes[b.fingerprint].centrality : -1;
+            if (centralityA !== centralityB)
+                return centralityB - centralityA;
+            return Math.random() - 0.5;
+        })
+        : [...allSymbols].sort(() => Math.random() - 0.5);
+    const shuffled = ordered;
     // Filter locally — no per-symbol API calls needed
     const toCapture = [];
     const seen = new Set();
@@ -253,7 +292,7 @@ async function scanRepoCommand(options = {}) {
     let captured = 0;
     for (let i = 0; i < toCapture.length; i += BATCH_SIZE) {
         const batch = toCapture.slice(i, i + BATCH_SIZE);
-        const results = await Promise.all(batch.map(sym => inferAndCapture(token, sym, repoName)));
+        const results = await Promise.all(batch.map(sym => inferAndCapture(token, sym, repoName, graph, repoRoot)));
         const batchCaptured = results.filter(Boolean).length;
         captured += batchCaptured;
         if (!options.silent) {

package/dist/commands/security-scan.js

@@ -0,0 +1,217 @@
+"use strict";
+/**
+ * kodingo security-scan
+ *
+ * Triggers a vulnerability scan against whatever dependencies were last
+ * synced via 'kodingo sync-dependencies', then prints a ranked report.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityScanCommand = securityScanCommand;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const persistence_config_1 = require("../utils/persistence-config");
+const repo_scope_1 = require("../utils/repo-scope");
+const graph_builder_1 = require("../utils/graph-builder");
+const security_code_analyzer_1 = require("../utils/security-code-analyzer");
+const context_assembler_1 = require("../utils/context-assembler");
+const ast_parser_1 = require("../utils/ast-parser");
+const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next"]);
+const SUPPORTED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs", ".php", ".java", ".kt", ".rb", ".c", ".cpp"];
+function walkFiles(dir) {
+    const results = [];
+    try {
+        const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (IGNORED_DIRS.has(entry.name))
+                continue;
+            const fullPath = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                results.push(...walkFiles(fullPath));
+            }
+            else if (entry.isFile() && SUPPORTED_EXTENSIONS.includes(path_1.default.extname(entry.name))) {
+                results.push(fullPath);
+            }
+        }
+    }
+    catch { }
+    return results;
+}
+const SEVERITY_ICON = {
+    critical: "🔴", high: "🟠", moderate: "🟡", low: "🔵", unknown: "⚪",
+};
+async function securityScanCommand(options = {}) {
+    const repoRoot = (0, repo_scope_1.resolveRepoScope)(options.repo ? { repo: options.repo } : {}) ?? process.cwd();
+    const config = (0, persistence_config_1.readConfig)();
+    const wsConfig = (0, persistence_config_1.readWorkspaceConfig)(repoRoot);
+    const token = wsConfig?.token ?? "";
+    const apiUrl = wsConfig?.apiUrl ?? config.apiUrl ?? "https://kodingo-api.onrender.com";
+    if (!token) {
+        if (!options.silent)
+            console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
+        return false;
+    }
+    const repoName = path_1.default.basename(repoRoot);
+    if (!options.silent)
+        console.log(`\n🔒 Kortex Security — scanning ${repoName} for known vulnerabilities...\n`);
+    try {
+        const scanRes = await fetch(`${apiUrl}/security/scan`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Kodingo-Token": token },
+            body: JSON.stringify({ repo: repoName }),
+        });
+        if (!scanRes.ok) {
+            if (!options.silent)
+                console.error(`  ✖ Scan failed: ${scanRes.status} ${await scanRes.text()}`);
+            return false;
+        }
+        const scanData = await scanRes.json();
+        if (scanData.message) {
+            if (!options.silent)
+                console.log(`  ${scanData.message}`);
+            return true;
+        }
+        if (!options.silent)
+            console.log(`  Checked ${scanData.scanned} dependencies against known vulnerability databases\n`);
+        const findingsRes = await fetch(`${apiUrl}/security/findings?repo=${encodeURIComponent(repoName)}`, {
+            headers: { "X-Kodingo-Token": token },
+        });
+        if (!findingsRes.ok)
+            return true; // scan itself succeeded even if the report fetch fails
+        const { findings } = await findingsRes.json();
+        if (findings.length === 0) {
+            if (!options.silent)
+                console.log("  ✔ No known vulnerabilities found in your dependencies.");
+            return true;
+        }
+        if (!options.silent) {
+            console.log(`  ⚠ ${findings.length} vulnerabilit${findings.length === 1 ? "y" : "ies"} found:\n`);
+            for (const f of findings) {
+                const icon = SEVERITY_ICON[f.severity] ?? "⚪";
+                console.log(`  ${icon} ${f.severity.toUpperCase()} — ${f.package_name}@${f.version}`);
+                console.log(`     ${f.summary}`);
+                if (f.fixed_version)
+                    console.log(`     Fix: upgrade to ${f.fixed_version} or later`);
+                if (f.alsoAffectsRepoCount && f.alsoAffectsRepoCount > 0) {
+                    console.log(`     ⚠ Also present in ${f.alsoAffectsRepoCount} other repo${f.alsoAffectsRepoCount === 1 ? "" : "s"} in this project`);
+                }
+                console.log(`     ${f.vulnerability_id}\n`);
+            }
+        }
+        // ── Code-level analysis — Layer 1 (local) + Layer 2 (server LLM judgment) ──
+        if (!options.silent)
+            console.log(`\n🔍 Analysing code for vulnerable patterns and missing auth...\n`);
+        try {
+            const graph = await (0, graph_builder_1.buildGraph)(repoRoot);
+            (0, graph_builder_1.saveGraph)(repoRoot, graph);
+            const files = walkFiles(repoRoot);
+            const symbols = [];
+            for (const file of files) {
+                try {
+                    const source = fs_1.default.readFileSync(file, "utf-8");
+                    symbols.push(...(await (0, ast_parser_1.parseFile)(file, source)));
+                }
+                catch { }
+            }
+            const candidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols);
+            if (candidates.length === 0) {
+                if (!options.silent)
+                    console.log("  ✔ No suspicious patterns detected.");
+            }
+            else {
+                const codeScanRes = await fetch(`${apiUrl}/security/scan-code`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", "X-Kodingo-Token": token },
+                    body: JSON.stringify({ repo: repoName, candidates }),
+                });
+                if (codeScanRes.ok) {
+                    const codeResult = await codeScanRes.json();
+                    if (!options.silent) {
+                        console.log(`  Checked ${codeResult.scanned} candidates — ${codeResult.findingsCreated} confirmed, ${codeResult.dismissed} dismissed as false positives after review\n`);
+                    }
+                }
+                else if (!options.silent) {
+                    console.error(`  ✖ Code analysis failed: ${codeScanRes.status}`);
+                }
+            }
+        }
+        catch (err) {
+            if (!options.silent)
+                console.error(`  ✖ Code analysis failed: ${err.message}`);
+        }
+        // ── Decision drift — does current code still honour past decisions? ──────
+        if (!options.silent)
+            console.log(`\n📜 Checking for drift from past decisions...\n`);
+        try {
+            const graph = await (0, graph_builder_1.buildGraph)(repoRoot);
+            const files = walkFiles(repoRoot);
+            const symbols = [];
+            for (const file of files) {
+                try {
+                    const source = fs_1.default.readFileSync(file, "utf-8");
+                    symbols.push(...(await (0, ast_parser_1.parseFile)(file, source)));
+                }
+                catch { }
+            }
+            const symbolNames = Array.from(new Set(symbols.map(s => s.name)));
+            if (symbolNames.length > 0) {
+                const candidatesRes = await fetch(`${apiUrl}/security/decision-drift-candidates`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", "X-Kodingo-Token": token },
+                    body: JSON.stringify({ repo: repoName, symbols: symbolNames.slice(0, 3000) }),
+                });
+                if (candidatesRes.ok) {
+                    const { matches } = await candidatesRes.json();
+                    if (matches.length === 0) {
+                        if (!options.silent)
+                            console.log("  No symbols with affirmed decisions found yet.");
+                    }
+                    else {
+                        const checks = [];
+                        for (const match of matches) {
+                            const sym = symbols.find(s => s.name === match.symbol);
+                            if (!sym)
+                                continue;
+                            const assembled = (0, context_assembler_1.assembleContext)(repoRoot, graph, sym.fingerprint);
+                            if (!assembled)
+                                continue;
+                            checks.push({
+                                symbol: match.symbol,
+                                file: sym.file,
+                                fingerprint: sym.fingerprint,
+                                currentBody: assembled.targetBody,
+                                decisionTitle: match.decisionTitle,
+                                decisionContent: match.decisionContent,
+                            });
+                        }
+                        if (checks.length > 0) {
+                            const driftRes = await fetch(`${apiUrl}/security/scan-decision-drift`, {
+                                method: "POST",
+                                headers: { "Content-Type": "application/json", "X-Kodingo-Token": token },
+                                body: JSON.stringify({ repo: repoName, checks }),
+                            });
+                            if (driftRes.ok) {
+                                const driftResult = await driftRes.json();
+                                if (!options.silent) {
+                                    console.log(`  Checked ${driftResult.scanned} symbols against past decisions — ${driftResult.findingsCreated} drifted, ${driftResult.noDrift} still honoured\n`);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        catch (err) {
+            if (!options.silent)
+                console.error(`  ✖ Decision drift check failed: ${err.message}`);
+        }
+        return true;
+    }
+    catch (err) {
+        if (!options.silent)
+            console.error(`  ✖ Scan failed: ${err.message}`);
+        return false;
+    }
+}

package/dist/commands/sync-dependencies.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * kodingo sync-dependencies
+ *
+ * Extracts declared dependencies from the current repo (package.json/lock,
+ * composer.json/lock) and syncs them to the server for security scanning.
+ * Run this before 'kodingo security-scan' — the scan works off whatever was
+ * last synced here.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncDependenciesCommand = syncDependenciesCommand;
+const path_1 = __importDefault(require("path"));
+const persistence_config_1 = require("../utils/persistence-config");
+const repo_scope_1 = require("../utils/repo-scope");
+const dependency_parser_1 = require("../utils/dependency-parser");
+async function syncDependenciesCommand(options = {}) {
+    const repoRoot = (0, repo_scope_1.resolveRepoScope)(options.repo ? { repo: options.repo } : {}) ?? process.cwd();
+    const config = (0, persistence_config_1.readConfig)();
+    const wsConfig = (0, persistence_config_1.readWorkspaceConfig)(repoRoot);
+    const token = wsConfig?.token ?? "";
+    const apiUrl = wsConfig?.apiUrl ?? config.apiUrl ?? "https://kodingo-api.onrender.com";
+    if (!token) {
+        if (!options.silent)
+            console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
+        return false;
+    }
+    const repoName = path_1.default.basename(repoRoot);
+    if (!options.silent)
+        console.log(`\n🔒 Kortex Security — scanning dependencies for ${repoName}...\n`);
+    const deps = (0, dependency_parser_1.extractDependencies)(repoRoot);
+    if (deps.length === 0) {
+        if (!options.silent)
+            console.log("  No package.json or composer.json found. Nothing to sync.");
+        return true;
+    }
+    if (!options.silent)
+        console.log(`  Found ${deps.length} dependencies`);
+    try {
+        const res = await fetch(`${apiUrl}/security/sync`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Kodingo-Token": token },
+            body: JSON.stringify({
+                repo: repoName,
+                dependencies: deps.map(d => ({
+                    ecosystem: d.ecosystem,
+                    packageName: d.packageName,
+                    version: d.version,
+                    manifestFile: d.manifestFile,
+                })),
+            }),
+        });
+        if (!res.ok) {
+            if (!options.silent)
+                console.error(`  ✖ Sync failed: ${res.status} ${await res.text()}`);
+            return false;
+        }
+        if (!options.silent)
+            console.log(`\n✔ Synced ${deps.length} dependencies for ${repoName}`);
+        return true;
+    }
+    catch (err) {
+        if (!options.silent)
+            console.error(`  ✖ Sync failed: ${err.message}`);
+        return false;
+    }
+}

package/dist/commands/sync-graph.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * kodingo sync-graph
+ *
+ * Builds the structural relationship graph for the current repo, diffs it
+ * against the previously saved local graph, and syncs only the diff to the
+ * server. Safe to run repeatedly — nodes are upserted, edges are additive
+ * with soft-delete on removal.
+ *
+ * Designed to be fast on repeat runs since only changed files need re-parsing
+ * in a future incremental version; for now it does a full local rebuild but
+ * only transmits the diff over the network.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncGraphCommand = syncGraphCommand;
+const path_1 = __importDefault(require("path"));
+const persistence_config_1 = require("../utils/persistence-config");
+const repo_scope_1 = require("../utils/repo-scope");
+const graph_builder_1 = require("../utils/graph-builder");
+async function syncGraphCommand(options = {}) {
+    const repoRoot = (0, repo_scope_1.resolveRepoScope)(options.repo ? { repo: options.repo } : {}) ?? process.cwd();
+    const config = (0, persistence_config_1.readConfig)();
+    const wsConfig = (0, persistence_config_1.readWorkspaceConfig)(repoRoot);
+    const token = wsConfig?.token ?? "";
+    const apiUrl = wsConfig?.apiUrl ?? config.apiUrl ?? "https://kodingo-api.onrender.com";
+    if (!token) {
+        if (!options.silent)
+            console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
+        return false;
+    }
+    const repoName = path_1.default.basename(repoRoot);
+    if (!options.silent)
+        console.log(`\n🧠 Kortex — building structural graph for ${repoName}...\n`);
+    const previous = (0, graph_builder_1.loadGraph)(repoRoot);
+    const current = await (0, graph_builder_1.buildGraph)(repoRoot);
+    const diff = (0, graph_builder_1.diffGraphs)(previous, current);
+    if (diff.added.length === 0 && diff.removed.length === 0 && diff.edgesAdded.length === 0 && diff.edgesRemoved.length === 0) {
+        if (!options.silent)
+            console.log("  ✔ No structural changes detected. Graph is up to date.");
+        return true;
+    }
+    if (!options.silent) {
+        console.log(`  ${diff.added.length} symbols, ${diff.edgesAdded.length} new relationships detected`);
+    }
+    // Chunk large syncs to respect the server's per-request caps (2000 nodes / 10000 edges)
+    const NODE_CHUNK = 1500;
+    const EDGE_CHUNK = 8000;
+    try {
+        for (let i = 0; i < diff.added.length || i === 0; i += NODE_CHUNK) {
+            const nodeChunk = diff.added.slice(i, i + NODE_CHUNK);
+            const edgeChunk = i === 0 ? diff.edgesAdded.slice(0, EDGE_CHUNK) : [];
+            const res = await fetch(`${apiUrl}/graph/sync`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", "X-Kodingo-Token": token },
+                body: JSON.stringify({
+                    repo: repoName,
+                    added: nodeChunk.map(n => ({
+                        fingerprint: n.fingerprint,
+                        name: n.name,
+                        file: path_1.default.relative(repoRoot, n.file),
+                        type: n.type,
+                        language: n.language,
+                        startLine: n.startLine,
+                        endLine: n.endLine,
+                        resolutionTier: n.resolutionTier,
+                        fanIn: n.fanIn,
+                        fanOut: n.fanOut,
+                        centrality: n.centrality,
+                        rawCalls: n.rawCalls,
+                    })),
+                    removed: i === 0 ? diff.removed : [],
+                    edgesAdded: edgeChunk.map(e => ({
+                        fromFingerprint: e.from,
+                        toFingerprint: e.to,
+                        edgeType: e.type,
+                        confidence: e.confidence,
+                        file: path_1.default.relative(repoRoot, e.file),
+                        line: e.line,
+                    })),
+                    edgesRemoved: i === 0 ? diff.edgesRemoved.map(e => ({ fromFingerprint: e.from, toFingerprint: e.to })) : [],
+                }),
+            });
+            if (!res.ok) {
+                if (!options.silent)
+                    console.error(`  ✖ Sync failed: ${res.status} ${await res.text()}`);
+                return false;
+            }
+            if (diff.added.length === 0)
+                break; // ensure single-iteration exit when nothing to chunk
+        }
+    }
+    catch (err) {
+        if (!options.silent)
+            console.error(`  ✖ Sync failed: ${err.message}`);
+        return false;
+    }
+    (0, graph_builder_1.saveGraph)(repoRoot, current);
+    if (!options.silent) {
+        console.log(`\n✔ Graph synced — ${Object.keys(current.nodes).length} symbols, ${current.edges.length} relationships tracked for ${repoName}`);
+    }
+    return true;
+}

package/dist/test-buildgraph-debug.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const graph_builder_1 = require("./utils/graph-builder");
+async function main() {
+    const repoRoot = process.argv[2];
+    const graph = await (0, graph_builder_1.buildGraph)(repoRoot);
+    const node = Object.values(graph.nodes).find(n => n.name === "projectRoutes");
+    console.log(node);
+}
+main();

package/dist/test-calls-debug.js

@@ -0,0 +1,16 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const ast_parser_1 = require("./utils/ast-parser");
+async function main() {
+    const filePath = process.argv[2];
+    const source = fs_1.default.readFileSync(filePath, "utf-8");
+    const symbols = await (0, ast_parser_1.parseFile)(filePath, source);
+    for (const s of symbols) {
+        console.log(`${s.name}: calls = [${s.calls.join(", ")}]`);
+    }
+}
+main();