memtrace 0.8.63 → 1.0.0

package/hooks/userprompt-claude.sh

@@ -162,11 +162,20 @@ LOCK_FILE="$LOCK_DIR/$SESSION_ID.lock"
 # entirely so every fire proceeds (useful for debugging & tests).
 if (( DEBOUNCE_SECS > 0 )) && [[ -f "$LOCK_FILE" ]]; then
     NOW=$(date +%s)
-    # `stat -f %m` is BSD/macOS, `stat -c %Y` is GNU/Linux. Try
-    # both; if neither works (extremely unusual) we treat the lock
-    # as fresh enough to suppress, on the principle that "we just
-    # touched it" is the safer default than "spam the daemon".
-    LAST="$(stat -f %m "$LOCK_FILE" 2>/dev/null || stat -c %Y "$LOCK_FILE" 2>/dev/null || printf '%s' "$NOW")"
+    # `stat -c %Y` is GNU/Linux, while `stat -f %m` is BSD/macOS.
+    # GNU stat accepts `-f` for a different operation and exits zero,
+    # so an `cmd_a || cmd_b` fallback can capture filesystem details
+    # instead of an mtime. Validate each result before accepting it.
+    LAST=""
+    if LAST="$(stat -c %Y "$LOCK_FILE" 2>/dev/null)" && [[ "$LAST" =~ ^[0-9]+$ ]]; then
+        :
+    elif LAST="$(stat -f %m "$LOCK_FILE" 2>/dev/null)" && [[ "$LAST" =~ ^[0-9]+$ ]]; then
+        :
+    else
+        # If neither form works (extremely unusual), treat the lock as
+        # freshly touched rather than spamming the daemon.
+        LAST="$NOW"
+    fi
     if [[ "$LAST" =~ ^[0-9]+$ ]]; then
         AGE=$((NOW - LAST))
         if (( AGE < DEBOUNCE_SECS )); then

package/installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memtrace-skills",
-  "version": "0.8.63",
+  "version": "1.0.0",
   "description": "Memtrace skills for AI coding agents — codebase exploration, temporal evolution, impact analysis, and more.",
   "type": "module",
   "bin": {

package/installer/skills/commands/memtrace-quality.md

@@ -9,7 +9,7 @@ allowed-tools:
   - mcp__memtrace__get_evolution
 metadata:
   author: "Syncable <support@syncable.dev>"
-  version: "1.0.0"
+  version: "1.1.0"
   category: development
 user-invocable: true
 ---
@@ -22,7 +22,7 @@ Code quality via graph analysis — dead code, complexity hotspots, repository s
 
 | Tool | Purpose | Required | Key optional |
 |------|---------|----------|--------------|
-| `find_dead_code` | Zero-caller symbols | `repo_id` | `include_tests`, `limit`, `kinds[]` |
+| `find_dead_code` | Symbols unreachable from roots | `repo_id` | `include_tests`, `limit`, `min_confidence`, `include_historical` |
 | `find_most_complex_functions` | Ranked complexity hotspots | `repo_id` | **`top_n`** (def 20) — not `limit` |
 | `calculate_cyclomatic_complexity` | Score one symbol | `repo_id`, **`target`** | — |
 | `get_repository_stats` | Repository overview | `repo_id` | `branch` |
@@ -42,10 +42,20 @@ Full parameter spec for every Memtrace tool: `references/mcp-parameters.md` (bun
 ### 2. Dead code
 
 ```json
-{ "repo_id": "memdb", "include_tests": false, "limit": 50 }
+{ "repo_id": "memdb", "include_tests": false, "limit": 50, "min_confidence": "high" }
 ```
 
-Exported symbols and entry points excluded by default. Results are candidates, not proof — callers via dynamic dispatch or reflection are invisible to the graph; verify before deleting.
+`find_dead_code` seeds **roots** (`main`, exported symbols, HANDLES targets,
+`trait_impl`, Magalz/framework allowlists), BFS-walks CALLS / REFERENCES /
+MAKES_API_CALL forward, and reports Function/Method nodes **unreachable from
+roots**. Each row includes `confidence` (`high` / `medium` / `low`) and
+`confidence_score` (Skylos-style penalties for dynamic languages, ambiguous
+hook names, methods). Use `min_confidence: "high"` for CI-safe cleanup;
+omit or `"low"` to see all bands.
+
+Results are still candidates, not proof — unmodeled dynamic dispatch can look
+live or dead incorrectly. Verify before deleting. Prefer false-live over
+false-dead.
 
 ### 3. Complexity hotspots
 
@@ -72,7 +82,7 @@ Ordered by call-graph out-degree.
 
 | Result | Carries |
 |--------|---------|
-| Dead-code entry (`find_dead_code`) | Symbol name + kind with zero graph callers — e.g. `format_legacy` (Function) |
+| Dead-code entry (`find_dead_code`) | Name, kind, path, `reason` (`unreachable from roots`), `confidence`, `confidence_score` |
 | Complexity row (`find_most_complex_functions`) | Symbol, complexity score, risk level — e.g. `processOrder` — 27, Critical |
 | Single score (`calculate_cyclomatic_complexity`) | Cyclomatic complexity for `target` |
 | Stats (`get_repository_stats`) | Node counts by kind, edge counts, community and process counts for `repo_id`/`branch` |
@@ -81,6 +91,8 @@ Ordered by call-graph out-degree.
 
 | Mistake | Reality |
 |---------|---------|
+| Treating every dead-code row as deletable | Filter with `min_confidence: "high"`; still verify framework/dynamic use |
+| Assuming “no inbound edge” is the model | Dead means unreachable from roots, not merely unreferenced |
 | `find_most_complex_functions(limit: 10)` | Param is **`top_n`** |
 | `calculate_cyclomatic_complexity(symbol_id=...)` | Required param is **`target`** |
 | Only looking at the highest complexity | Medium-complexity functions that are growing (check `get_evolution`) are often more urgent |

package/installer/skills/workflows/memtrace-refactoring-guide.md

@@ -35,7 +35,7 @@ Run these three tools in parallel to build a candidate list:
 Call `find_most_complex_functions` with `top_n: 20`
 
 **b) Dead code:**
-Call `find_dead_code` to find unused symbols
+Call `find_dead_code` (prefer `min_confidence: "high"`) for symbols unreachable from roots
 
 **c) Architectural bottlenecks:**
 Call `find_bridge_symbols` to find chokepoints with too much responsibility
@@ -122,7 +122,7 @@ For each item, include:
 |-----------|--------|
 | Complex + volatile + high blast radius | Highest priority — but plan carefully; incremental approach |
 | Complex + stable + low blast radius | Can wait; refactor when you're already touching nearby code |
-| Dead code with zero callers | Run Cortex provenance/recall first; zero callers is not proof that no decision/contract keeps it |
+| Dead code (`unreachable from roots`, high confidence) | Run Cortex provenance/recall first; reachability is not proof that no decision/contract keeps it |
 | Bridge symbol with many dependents | Extract interface first, then refactor implementation behind it |
 | Symbol in cross-repo API | Coordinate with consumers; backward-compatible changes only |
 | Cortex returns a held ban/contract | Preserve it or ask before overriding it |

package/lib/cuda-ep.js

@@ -8,9 +8,9 @@
 // ships as a GitHub release asset instead (`memtrace-windows-x86_64-
 // cuda-ep.zip`, sha256 recorded in the release's `checksums.txt`), and
 // this module fetches it at install time for hosts that can actually
-// use it. The engine probes CUDA -> DirectML -> CPU at startup, so a
-// missing DLL is never fatal — NVIDIA users just silently land on
-// DirectML, which is what this fetch exists to avoid.
+// use it. The bundled Windows runtime probes CUDA -> CPU at startup, so
+// a missing DLL is never fatal — NVIDIA users safely land on CPU. A
+// custom ONNX Runtime can additionally expose DirectML.
 //
 // Placement contract: the engine's dylib discovery looks next to the
 // running binary (`bridge_ort_dylib_env` in the Rust CLI), so the DLL

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memtrace",
-  "version": "0.8.63",
+  "version": "1.0.0",
   "description": "Code intelligence graph — MCP server + AI agent skills + visualization UI",
   "keywords": [
     "mcp",
@@ -40,12 +40,12 @@
     "fs-extra": "^11.0.0"
   },
   "optionalDependencies": {
-    "@memtrace/darwin-arm64": "0.8.63",
-    "@memtrace/linux-x64": "0.8.63",
-    "@memtrace/linux-arm64": "0.8.63",
-    "@memtrace/win32-x64": "0.8.63",
-    "@memtrace/linux-x64-noavx2": "0.8.63",
-    "@memtrace/win32-x64-noavx2": "0.8.63"
+    "@memtrace/darwin-arm64": "1.0.0",
+    "@memtrace/linux-x64": "1.0.0",
+    "@memtrace/linux-arm64": "1.0.0",
+    "@memtrace/win32-x64": "1.0.0",
+    "@memtrace/linux-x64-noavx2": "1.0.0",
+    "@memtrace/win32-x64-noavx2": "1.0.0"
   },
   "engines": {
     "node": ">=18"

package/skills/commands/memtrace-quality.md

@@ -9,7 +9,7 @@ allowed-tools:
   - mcp__memtrace__get_evolution
 metadata:
   author: "Syncable <support@syncable.dev>"
-  version: "1.0.0"
+  version: "1.1.0"
   category: development
 user-invocable: true
 ---
@@ -22,7 +22,7 @@ Code quality via graph analysis — dead code, complexity hotspots, repository s
 
 | Tool | Purpose | Required | Key optional |
 |------|---------|----------|--------------|
-| `find_dead_code` | Zero-caller symbols | `repo_id` | `include_tests`, `limit`, `kinds[]` |
+| `find_dead_code` | Symbols unreachable from roots | `repo_id` | `include_tests`, `limit`, `min_confidence`, `include_historical` |
 | `find_most_complex_functions` | Ranked complexity hotspots | `repo_id` | **`top_n`** (def 20) — not `limit` |
 | `calculate_cyclomatic_complexity` | Score one symbol | `repo_id`, **`target`** | — |
 | `get_repository_stats` | Repository overview | `repo_id` | `branch` |
@@ -42,10 +42,20 @@ Full parameter spec for every Memtrace tool: `references/mcp-parameters.md` (bun
 ### 2. Dead code
 
 ```json
-{ "repo_id": "memdb", "include_tests": false, "limit": 50 }
+{ "repo_id": "memdb", "include_tests": false, "limit": 50, "min_confidence": "high" }
 ```
 
-Exported symbols and entry points excluded by default. Results are candidates, not proof — callers via dynamic dispatch or reflection are invisible to the graph; verify before deleting.
+`find_dead_code` seeds **roots** (`main`, exported symbols, HANDLES targets,
+`trait_impl`, Magalz/framework allowlists), BFS-walks CALLS / REFERENCES /
+MAKES_API_CALL forward, and reports Function/Method nodes **unreachable from
+roots**. Each row includes `confidence` (`high` / `medium` / `low`) and
+`confidence_score` (Skylos-style penalties for dynamic languages, ambiguous
+hook names, methods). Use `min_confidence: "high"` for CI-safe cleanup;
+omit or `"low"` to see all bands.
+
+Results are still candidates, not proof — unmodeled dynamic dispatch can look
+live or dead incorrectly. Verify before deleting. Prefer false-live over
+false-dead.
 
 ### 3. Complexity hotspots
 
@@ -72,7 +82,7 @@ Ordered by call-graph out-degree.
 
 | Result | Carries |
 |--------|---------|
-| Dead-code entry (`find_dead_code`) | Symbol name + kind with zero graph callers — e.g. `format_legacy` (Function) |
+| Dead-code entry (`find_dead_code`) | Name, kind, path, `reason` (`unreachable from roots`), `confidence`, `confidence_score` |
 | Complexity row (`find_most_complex_functions`) | Symbol, complexity score, risk level — e.g. `processOrder` — 27, Critical |
 | Single score (`calculate_cyclomatic_complexity`) | Cyclomatic complexity for `target` |
 | Stats (`get_repository_stats`) | Node counts by kind, edge counts, community and process counts for `repo_id`/`branch` |
@@ -81,6 +91,8 @@ Ordered by call-graph out-degree.
 
 | Mistake | Reality |
 |---------|---------|
+| Treating every dead-code row as deletable | Filter with `min_confidence: "high"`; still verify framework/dynamic use |
+| Assuming “no inbound edge” is the model | Dead means unreachable from roots, not merely unreferenced |
 | `find_most_complex_functions(limit: 10)` | Param is **`top_n`** |
 | `calculate_cyclomatic_complexity(symbol_id=...)` | Required param is **`target`** |
 | Only looking at the highest complexity | Medium-complexity functions that are growing (check `get_evolution`) are often more urgent |

package/skills/workflows/memtrace-refactoring-guide.md

@@ -35,7 +35,7 @@ Run these three tools in parallel to build a candidate list:
 Call `find_most_complex_functions` with `top_n: 20`
 
 **b) Dead code:**
-Call `find_dead_code` to find unused symbols
+Call `find_dead_code` (prefer `min_confidence: "high"`) for symbols unreachable from roots
 
 **c) Architectural bottlenecks:**
 Call `find_bridge_symbols` to find chokepoints with too much responsibility
@@ -122,7 +122,7 @@ For each item, include:
 |-----------|--------|
 | Complex + volatile + high blast radius | Highest priority — but plan carefully; incremental approach |
 | Complex + stable + low blast radius | Can wait; refactor when you're already touching nearby code |
-| Dead code with zero callers | Run Cortex provenance/recall first; zero callers is not proof that no decision/contract keeps it |
+| Dead code (`unreachable from roots`, high confidence) | Run Cortex provenance/recall first; reachability is not proof that no decision/contract keeps it |
 | Bridge symbol with many dependents | Extract interface first, then refactor implementation behind it |
 | Symbol in cross-repo API | Coordinate with consumers; backward-compatible changes only |
 | Cortex returns a held ban/contract | Preserve it or ask before overriding it |