milens 0.6.5 → 0.6.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (91) hide show
  1. package/.agents/skills/analyzer/SKILL.md +5 -5
  2. package/.agents/skills/docs/SKILL.md +4 -3
  3. package/.agents/skills/milens/SKILL.md +1 -1
  4. package/.agents/skills/root/SKILL.md +3 -3
  5. package/.agents/skills/server/SKILL.md +10 -9
  6. package/.agents/skills/store/SKILL.md +2 -2
  7. package/README.md +166 -166
  8. package/adapters/claude-code/CLAUDE.md +36 -15
  9. package/adapters/codex/.codex/codex.md +38 -23
  10. package/adapters/copilot/.github/copilot-instructions.md +29 -22
  11. package/adapters/gemini/.gemini/context.md +33 -10
  12. package/adapters/opencode/AGENTS.md +36 -15
  13. package/dist/agents-md.d.ts.map +1 -1
  14. package/dist/agents-md.js +51 -2
  15. package/dist/agents-md.js.map +1 -1
  16. package/dist/analyzer/engine.d.ts +3 -0
  17. package/dist/analyzer/engine.d.ts.map +1 -1
  18. package/dist/analyzer/engine.js +342 -8
  19. package/dist/analyzer/engine.js.map +1 -1
  20. package/dist/analyzer/resolver.d.ts +2 -0
  21. package/dist/analyzer/resolver.d.ts.map +1 -1
  22. package/dist/analyzer/resolver.js +187 -9
  23. package/dist/analyzer/resolver.js.map +1 -1
  24. package/dist/analyzer/review.d.ts.map +1 -1
  25. package/dist/analyzer/review.js +254 -32
  26. package/dist/analyzer/review.js.map +1 -1
  27. package/dist/analyzer/scope-resolver.d.ts +42 -0
  28. package/dist/analyzer/scope-resolver.d.ts.map +1 -0
  29. package/dist/analyzer/scope-resolver.js +687 -0
  30. package/dist/analyzer/scope-resolver.js.map +1 -0
  31. package/dist/cli.js +294 -1
  32. package/dist/cli.js.map +1 -1
  33. package/dist/parser/extract.d.ts +6 -1
  34. package/dist/parser/extract.d.ts.map +1 -1
  35. package/dist/parser/extract.js +14 -2
  36. package/dist/parser/extract.js.map +1 -1
  37. package/dist/parser/lang-css.d.ts.map +1 -1
  38. package/dist/parser/lang-css.js +7 -1
  39. package/dist/parser/lang-css.js.map +1 -1
  40. package/dist/parser/lang-go.d.ts.map +1 -1
  41. package/dist/parser/lang-go.js +16 -0
  42. package/dist/parser/lang-go.js.map +1 -1
  43. package/dist/parser/lang-html.d.ts +4 -0
  44. package/dist/parser/lang-html.d.ts.map +1 -1
  45. package/dist/parser/lang-html.js +40 -1
  46. package/dist/parser/lang-html.js.map +1 -1
  47. package/dist/parser/lang-java.d.ts.map +1 -1
  48. package/dist/parser/lang-java.js +12 -0
  49. package/dist/parser/lang-java.js.map +1 -1
  50. package/dist/parser/lang-js.d.ts.map +1 -1
  51. package/dist/parser/lang-js.js +3 -0
  52. package/dist/parser/lang-js.js.map +1 -1
  53. package/dist/parser/lang-php.d.ts.map +1 -1
  54. package/dist/parser/lang-php.js +11 -0
  55. package/dist/parser/lang-php.js.map +1 -1
  56. package/dist/parser/lang-py.d.ts.map +1 -1
  57. package/dist/parser/lang-py.js +14 -0
  58. package/dist/parser/lang-py.js.map +1 -1
  59. package/dist/parser/lang-ruby.d.ts.map +1 -1
  60. package/dist/parser/lang-ruby.js +20 -0
  61. package/dist/parser/lang-ruby.js.map +1 -1
  62. package/dist/parser/lang-rust.d.ts.map +1 -1
  63. package/dist/parser/lang-rust.js +27 -4
  64. package/dist/parser/lang-rust.js.map +1 -1
  65. package/dist/parser/lang-ts.d.ts.map +1 -1
  66. package/dist/parser/lang-ts.js +3 -0
  67. package/dist/parser/lang-ts.js.map +1 -1
  68. package/dist/parser/lang-vue.d.ts +17 -1
  69. package/dist/parser/lang-vue.d.ts.map +1 -1
  70. package/dist/parser/lang-vue.js +177 -0
  71. package/dist/parser/lang-vue.js.map +1 -1
  72. package/dist/parser/language-provider.d.ts +27 -0
  73. package/dist/parser/language-provider.d.ts.map +1 -0
  74. package/dist/parser/language-provider.js +2 -0
  75. package/dist/parser/language-provider.js.map +1 -0
  76. package/dist/server/mcp.d.ts.map +1 -1
  77. package/dist/server/mcp.js +224 -50
  78. package/dist/server/mcp.js.map +1 -1
  79. package/dist/server/watcher.d.ts +8 -0
  80. package/dist/server/watcher.d.ts.map +1 -1
  81. package/dist/server/watcher.js +10 -8
  82. package/dist/server/watcher.js.map +1 -1
  83. package/dist/skills.js +163 -42
  84. package/dist/skills.js.map +1 -1
  85. package/dist/store/schema.sql +1 -1
  86. package/dist/uninstall.d.ts +54 -0
  87. package/dist/uninstall.d.ts.map +1 -0
  88. package/dist/uninstall.js +795 -0
  89. package/dist/uninstall.js.map +1 -0
  90. package/docs/README.md +4 -1
  91. package/package.json +1 -1
package/README.md CHANGED
@@ -8,6 +8,7 @@
8
8
  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/node-%3E%3D20-brightgreen" alt="node"></a>
9
9
  <a href="https://github.com/fuze210699/milens/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="license"></a>
10
10
  <img src="https://img.shields.io/badge/tools-41-purple" alt="41 tools">
11
+ <img src="https://img.shields.io/badge/languages-12-blue" alt="12 languages">
11
12
  <img src="https://img.shields.io/badge/prompts-7-orange" alt="7 prompts">
12
13
  <img src="https://img.shields.io/badge/security-50%2B-red" alt="50+ rules">
13
14
  <img src="https://img.shields.io/badge/harnesses-7-lightgrey" alt="7 harnesses">
@@ -35,42 +36,44 @@ npx milens analyze -p . --force
35
36
 
36
37
  ## What is Milens?
37
38
 
38
- Milens is a code intelligence platform that gives AI coding agents instant understanding of your codebase. 41 MCP tools, 7 sub-agent prompts, 7 CLI workflows, and 50 security rules. It builds a knowledge graph of your entire project every function, class, import, call, and inheritance chain — then exposes it through MCP tools. Agents query the graph instead of searching files. **70% fewer tokens** per session, **zero broken dependencies**, and a system that **learns from every session**.
39
+ Milens builds a **knowledge graph** of your codebasefunctions, classes, imports, calls, and inheritance chains — then exposes it through 41 MCP tools. AI agents query the graph instead of reading files.
39
40
 
40
- - **Analyze once.** Tree-sitter parses 12 languages into a SQLite knowledge graph.
41
- - **Query instantly.** FTS5 search, recursive CTE traversal — all in-database.
42
- - **Edit safely.** Every tool returns a blast radius before you change anything.
43
- - **Scan automatically.** 50+ security rules run in one call, not ten greps.
44
- - **Learn continuously.** Annotations persist across sessions. Patterns auto-promote to rules.
41
+ - **Parse 12 languages.** Tree-sitter WASM TS, JS, Python, Java, Go, Rust, PHP, Ruby, Vue, HTML, CSS, Markdown.
42
+ - **Query instantly.** FTS5 + recursive CTE — all in SQLite, no API calls.
43
+ - **Edit safely.** Blast radius before every change. Symbol-level PR review with cross-file impact.
44
+ - **Scan once.** 50+ security rules in one call instead of multiple greps.
45
+ - **Learn continuously.** Annotations persist across sessions. High-confidence patterns can be promoted to rules.
46
+ - **Dual-path resolver.** Legacy proximity + scope-graph compared for parity.
47
+ - **Verify accuracy.** 8 test projects with expected.json validate precision/recall across all languages.
45
48
 
46
- Fully offline. Zero telemetry. Localhost-only MCP server. One command to bootstrap.
49
+ Fully offline. Zero telemetry. MCP server on `127.0.0.1`. Get started with `npx milens init`.
47
50
 
48
51
  ---
49
52
 
50
53
  ## Architecture
51
54
 
52
55
  ```
53
- npx milens init
54
-
55
- ┌─────▼──────┐
56
- │ Analyzer │ ── Parse 12 langs
57
- └─────┬──────┘ (tree-sitter WASM)
58
-
59
- ┌─────▼──────┐
60
- Store │ ── SQLite + FTS5
61
- └─────┬──────┘ (symbols, links, metadata)
62
-
63
- ┌─────▼──────┐
64
- │ Server │ ── MCP stdio/HTTP
65
- └─────┬──────┘ 41 tools
66
-
67
- ┌──────────┴──────────┐
68
- ▼ ▼
69
- AI Agent (MCP) CLI (terminal)
70
-
71
- Pipeline stages: Parser (tree-sitter CST) → Analyzer (symbol extraction + dependency resolution) → Store (SQLite insert + index) → Server (MCP tool dispatch)
56
+ Source files (12 languages)
57
+
58
+
59
+ Parser ── tree-sitter WASM → CST
60
+
61
+
62
+ Analyzer ── extractFromTree() + dual-path resolver
63
+ ├── Legacy: proximity-based (resolveLinksWithStats)
64
+ │ └── Scope: scope-graph-based (resolveWithScopes) parity check
65
+
66
+
67
+ Store ──── SQLite + FTS5 (symbols, links, metadata, embeddings)
68
+
69
+
70
+ Server ─── MCP stdio/HTTP (41 tools)
71
+
72
+ ├── AI Agent (MCP client)
73
+ └── CLI (terminal)
72
74
  ```
73
75
 
76
+
74
77
  ---
75
78
 
76
79
  ## Quick Start
@@ -101,7 +104,12 @@ Then connect your editor:
101
104
  ```bash
102
105
  # Claude Code
103
106
  claude mcp add milens -- npx -y milens serve -p .
107
+ ```
104
108
 
109
+ <details>
110
+ <summary><b>More editors</b> — Cursor, OpenCode, Codex, Gemini, Zed</summary>
111
+
112
+ ```bash
105
113
  # Cursor — .cursor/mcp.json
106
114
  { "mcpServers": { "milens": { "command": "npx", "args": ["-y", "milens", "serve", "-p", "."] } } }
107
115
 
@@ -120,6 +128,8 @@ args = ["-y", "milens", "serve", "-p", "."]
120
128
  { "mcp_servers": { "milens": { "command": "npx", "args": ["-y", "milens", "serve", "-p", "."] } } }
121
129
  ```
122
130
 
131
+ </details>
132
+
123
133
  Open your AI agent. It auto-loads `AGENTS.md` with codebase context. You're ready.
124
134
 
125
135
  ---
@@ -128,31 +138,38 @@ Open your AI agent. It auto-loads `AGENTS.md` with codebase context. You're read
128
138
 
129
139
  | Situation | Without Milens | With Milens |
130
140
  |---|---|---|
131
- | **Understand a new codebase** | Agent reads 15 files blind (~30,000 tokens) | `codebase_summary()` — 500 tokens |
141
+ | **Understand a new codebase** | Agent reads many files blind | `codebase_summary()` — compact overview |
132
142
  | **Edit a function safely** | No idea what depends on it | `impact({target, depth: 3})` — exact blast radius |
133
- | **Find all references** | Grep 5 times, read 8 files | `context({name})` — incoming + outgoing, one call |
134
- | **Review a PR** | Read diff, guess risk | `review_pr()` — every symbol scored CRITICAL/HIGH/MEDIUM/LOW |
135
- | **Security audit** | 10 manual greps | `security_scan()`50 rules, one tool call |
136
- | **Start a new session** | Zero context | `recall()` — agent remembers every past lesson |
137
- | **Write tests** | Guess what needs testing | `test_plan()` — mock strategy + 3 scenarios |
138
- | **Find dead code** | Manual search | `find_dead_code()` — every symbol with zero references |
143
+ | **Find all references** | Grep multiple times, read several files | `context({name})` — incoming + outgoing, one call |
144
+ | **Review a PR** | Read diff, guess risk | `review_pr()` — changed symbols scored by blast radius + test coverage |
145
+ | **Review a PR accurately** | Review guesses which functions changed | Symbol-level diff via git show flags only actually changed symbols |
146
+ | **Clean uninstall** | Manually delete files, hooks, configs | `milens uninstall` — scan 11 categories, interactive or auto |
147
+ | **Security audit** | Multiple manual greps | `security_scan()` — 50+ rules, one tool call |
148
+ | **Start a new session** | Zero context | `recall()` — retrieves past annotations |
149
+ | **Write tests** | Guess what needs testing | `test_plan()` — dependency-aware strategy + scenarios |
150
+ | **Find dead code** | Manual search | `find_dead_code()` — exported symbols with zero references |
139
151
 
140
- **Average savings: ~70% fewer tokens per session. ~50% faster task completion.**
152
+ *And many more see [real-world scenarios →](docs/scenarios.html)*
141
153
 
142
154
  ---
143
155
 
144
- ## Features at a Glance
156
+ ## Features
145
157
 
146
158
  | Feature | Description |
147
159
  |---|---|
148
- | 🔍 Code Intelligence | 41 MCP tools — query, impact, context, trace, routes |
149
- | 🛡️ Security Scanner | 50 rules, 9 categories, OWASP-mapped, dependency audit |
150
- | 🤖 Sub-Agent Prompts | 7 prompts — plan, review, tdd, security, architect, debug, dead_code_remove |
151
- | 🔄 CLI Workflows | 7 commands — tdd, review, plan, onboard, security-scan, refactor, handoff |
152
- | 📊 Metrics | 7 quantified metrics TER, LR, CQI, BRR, TCGR, DCER, CTR |
153
- | 🧠 Learning Engine | Annotate Recall Evolve confidence-based knowledge base |
154
- | 🔌 12 Languages | TS, JS, Python, Java, Go, Rust, PHP, Ruby, Vue, HTML, CSS, Markdown |
155
- | 🖥️ 7 Editors | Claude Code, Cursor, Copilot, OpenCode, Codex, Gemini CLI, Zed |
160
+ | **Code Intelligence** | 41 MCP tools — search, impact, context, trace, routes |
161
+ | **Security Scanner** | 50+ rules across 9 categories + dependency audit |
162
+ | **Sub-Agent Prompts** | 7 prompts — plan, review, tdd, security, architect, debug, dead_code_remove |
163
+ | **CLI Workflows** | 7 commands — tdd, review, plan, onboard, security-scan, refactor, handoff |
164
+ | **Uninstall** | Full cleanup11 trace categories, interactive or auto |
165
+ | **Metrics** | 7 metrics TER, LR, CQI, BRR, TCGR, DCER, CTR |
166
+ | **Learning Engine** | Annotate Recall Evolve confidence-based annotations |
167
+ | **12 Languages** | TS, JS, Python, Java, Go, Rust, PHP, Ruby, Vue, HTML, CSS, Markdown |
168
+ | **Cross-Language Linking** | HTML class → CSS selectors, Vue template → script symbols |
169
+ | **Type Bindings & MRO** | Infer types from constructors. C3, first-wins, ruby-mixin strategies |
170
+ | **Accuracy Validation** | 8 test projects with expected.json for precision/recall |
171
+ | **Symbol-Level PR Diff** | `review_pr` diffs actual symbols between commits, not entire files |
172
+ | **7 Editor Adapters** | Claude Code, Cursor, Copilot, OpenCode, Codex, Gemini, Zed |
156
173
 
157
174
  ---
158
175
 
@@ -162,39 +179,69 @@ Open your AI agent. It auto-loads `AGENTS.md` with codebase context. You're read
162
179
 
163
180
  | Command | Description |
164
181
  |---|---|
165
- | `analyze` | Index codebase into knowledge graph |
182
+ | `init` | Bootstrap milens: index + AGENTS.md + skills + hooks |
183
+ | `analyze` | Index a codebase: parse symbols, resolve dependencies, build search index |
166
184
  | `serve` | Start MCP server (stdio/HTTP) |
167
- | `search` | FTS5 search across symbols |
168
- | `status` | Index health check |
169
- | `metrics` | 7-metric quality report |
170
- | `init` | Bootstrap project with profile presets |
171
- | `watch` | Auto-reindex on file changes |
185
+ | `watch` | Watch files for changes and auto re-index |
186
+ | `status` | Show index status |
172
187
 
173
- ### Workflows
188
+ ### Search & Inspect
174
189
 
175
190
  | Command | Description |
176
191
  |---|---|
177
- | `milens workflow tdd` | Test coverage gaps + risk-prioritized untested symbols |
178
- | `milens workflow review` | PR risk analysis git diff + heat scoring |
179
- | `milens workflow plan` | Codebase summary domains, top hubs |
180
- | `milens workflow onboard` | Onboarding report — structure, entry points, next steps |
181
- | `milens workflow security-scan` | Full security audit with all 50 rules |
182
- | `milens workflow refactor` | Dead code detection + candidates |
183
- | `milens workflow handoff` | Session knowledge summary + promotable annotations |
192
+ | `search <query>` | Search symbols by name |
193
+ | `inspect <symbol>` | 360° view: refs, deps, hierarchy |
194
+ | `impact <symbol>` | Blast radius: what breaks if this symbol changes? |
195
+
196
+ ### Maintenance
197
+
198
+ | Command | Description |
199
+ |---|---|
200
+ | `clean` | Remove index for a repository |
201
+ | `uninstall` | Remove all milens traces: injected blocks, generated files, hooks, cron, database, registry, MCP configs, deps, env vars |
202
+ | `upgrade` | Upgrade milens: clear npx cache, rebuild index while keeping annotations/sessions |
203
+ | `list` | List all indexed repositories |
184
204
 
185
205
  ### Security
186
206
 
187
207
  | Command | Description |
188
208
  |---|---|
189
- | `security scan` | Scan for vulnerabilities (scope, severity filterable) |
190
- | `security deps` | Audit dependencies against offline CVE database |
209
+ | `security scan` | Scan project for vulnerabilities (50+ rules, scope/severity filterable) |
210
+ | `security deps` | Audit dependencies for known vulnerabilities |
191
211
 
192
- ### Maintenance
212
+ ### Quality & Evolution
193
213
 
194
214
  | Command | Description |
195
215
  |---|---|
216
+ | `metrics` | Compute code quality and efficiency metrics |
196
217
  | `evolve` | Promote high-confidence annotations to rules/skills |
197
- | `hooks` | Session lifecycle hook management |
218
+ | `orchestrate` | Full review cycle: detect changes → risk → coverage gaps → dead code |
219
+
220
+ ### Workflows
221
+
222
+ | Command | Description |
223
+ |---|---|
224
+ | `workflow tdd` | Test coverage gaps + risk-prioritized untested symbols |
225
+ | `workflow review` | PR risk analysis — git diff + heat scoring |
226
+ | `workflow plan` | Codebase summary — domains, top hubs |
227
+ | `workflow onboard` | Onboarding report — structure, entry points |
228
+ | `workflow security-scan` | Full security audit |
229
+ | `workflow refactor` | Dead code detection + candidates |
230
+ | `workflow handoff` | Session knowledge summary |
231
+
232
+ ### Hooks
233
+
234
+ | Command | Description |
235
+ |---|---|
236
+ | `hooks enable` | Turn on all hooks |
237
+ | `hooks disable` | Turn off hooks |
238
+ | `hooks profile <name>` | Apply hook presets (minimal, standard, full) |
239
+
240
+ ### Dashboard
241
+
242
+ | Command | Description |
243
+ |---|---|
244
+ | `dashboard` | Open usage analytics dashboard in browser |
198
245
 
199
246
  ---
200
247
 
@@ -205,50 +252,50 @@ Open your AI agent. It auto-loads `AGENTS.md` with codebase context. You're read
205
252
  | Tool | Description |
206
253
  |---|---|
207
254
  | `query` | Find symbol definitions by name (FTS5) |
208
- | `grep` | Text search ALL files (templates, styles, configs, docs) |
255
+ | `grep` | Text search across all files — code, templates, configs, docs |
209
256
  | `context` | 360° view: incoming refs + outgoing deps |
210
257
  | `get_file_symbols` | All symbols in a file |
211
258
  | `get_type_hierarchy` | Inheritance/implementation tree |
212
- | `semantic_search` | Hybrid FTS5 + vector search |
213
- | `find_similar` | Find symbols similar by topology |
259
+ | `semantic_search` | Hybrid FTS5 + vector search (requires `--embeddings`) |
260
+ | `find_similar` | Find symbols topologically similar |
214
261
 
215
262
  ### Impact & Safety
216
263
 
217
264
  | Tool | Description |
218
265
  |---|---|
219
- | `impact` | Blast radius: what breaks if target changes |
220
- | `edit_check` | Pre-edit safety: callers + export status + re-export chains |
266
+ | `impact` | Blast radius what breaks if this symbol changes? |
267
+ | `edit_check` | Pre-edit safety: callers, export status, re-export chains, warnings |
221
268
  | `overview` | Combined context + impact + grep in one call |
222
269
  | `detect_changes` | Git diff → affected symbols + dependents |
223
270
  | `find_dead_code` | Exported symbols with zero incoming references |
224
271
  | `pre_commit_check` | Pre-commit risk: review_pr + dead code + coverage gaps |
225
- | `compare_impact` | Compare impact graph before/after edit — detects regressions |
272
+ | `compare_impact` | Compare impact graph before/after edit |
226
273
 
227
274
  ### Review & Testing
228
275
 
229
276
  | Tool | Description |
230
277
  |---|---|
231
- | `review_pr` | PR risk assessment: scored by blast radius + test coverage |
232
- | `review_symbol` | Single symbol deep-dive: role, heat, dependents, risk |
233
- | `codebase_summary` | Compact ~500 token overview |
234
- | `test_plan` | Dependency-aware test plan: mocks, strategies, scenarios |
278
+ | `review_pr` | PR risk assessment: symbol-level diff via git show, cross-file impact |
279
+ | `review_symbol` | Single symbol deep-dive: role, heat, dependents, test status, risk |
280
+ | `codebase_summary` | Compact codebase overview: domains, top hubs, coverage |
281
+ | `test_plan` | Dependency-aware test strategy: mocks, scenarios |
235
282
  | `test_generate` | Auto-generate test file with framework detection |
236
283
  | `test_coverage_gaps` | Untested exported symbols sorted by risk |
237
- | `test_impact` | Which tests to run for current changes |
284
+ | `test_impact` | Map code changes to which test files to run |
238
285
 
239
286
  ### Orchestration
240
287
 
241
288
  | Tool | Description |
242
289
  |---|---|
243
- | `orchestrate` | Full cycle: changesrisk → gaps → dead code → action plan |
290
+ | `orchestrate` | detect_changes review_primpactcoverage gaps → dead code → action plan |
244
291
 
245
292
  ### Understanding
246
293
 
247
294
  | Tool | Description |
248
295
  |---|---|
249
- | `smart_context` | Intent-aware context: understand/edit/debug/test |
296
+ | `smart_context` | Intent-aware: understand/edit/debug/test |
250
297
  | `trace` | Execution flow: call chains from entrypoints to target |
251
- | `routes` | Detect framework routes/endpoints |
298
+ | `routes` | Detect framework routes/endpoints (Express, FastAPI, NestJS, etc.) |
252
299
  | `explain_relationship` | Shortest dependency path between two symbols |
253
300
  | `domains` | Domain clusters: files forming logical modules |
254
301
 
@@ -258,7 +305,7 @@ Open your AI agent. It auto-loads `AGENTS.md` with codebase context. You're read
258
305
  |---|---|
259
306
  | `annotate` | Record a note about a symbol (persists across sessions) |
260
307
  | `recall` | Retrieve annotations from past sessions |
261
- | `session_start` | Register agent session |
308
+ | `session_start` | Register agent session for multi-agent coordination |
262
309
  | `session_end` | End session and record stats |
263
310
  | `session_context` | Get session metadata + annotations |
264
311
  | `handoff` | Transfer context between agent sessions |
@@ -267,30 +314,30 @@ Open your AI agent. It auto-loads `AGENTS.md` with codebase context. You're read
267
314
 
268
315
  | Tool | Description |
269
316
  |---|---|
270
- | `security_scan` | Scan for vulnerabilities (50+ rules, 9 categories) |
317
+ | `security_scan` | Scan for vulnerabilities 50+ rules, 9 categories |
271
318
  | `fix_apply` | Apply security fix to a file (creates backup) |
272
319
 
273
320
  ### Hooks
274
321
 
275
322
  | Tool | Description |
276
323
  |---|---|
277
- | `hook_onFileChange` | Re-analyze changed files + impact summary |
324
+ | `hook_onFileChange` | Trigger when files are modified → impact summary |
278
325
  | `hook_preCompact` | Save metrics snapshot before context compaction |
279
- | `hook_postCompact` | Restore context by recalling annotations |
326
+ | `hook_postCompact` | Restore context by recalling annotations after compaction |
280
327
 
281
- ### Developer
328
+ ### Codebase Overview
282
329
 
283
330
  | Tool | Description |
284
331
  |---|---|
285
- | `ast_explore` | Parse code snippet to S-expression AST tree |
286
- | `test_query` | Run tree-sitter query against code snippet |
332
+ | `status` | Index stats: symbols, links, files, coverage, staleness |
333
+ | `repos` | List all indexed repositories with summary stats |
287
334
 
288
- ### Overview
335
+ ### Developer
289
336
 
290
337
  | Tool | Description |
291
338
  |---|---|
292
- | `status` | Index stats: symbols, links, files, coverage |
293
- | `repos` | List all indexed repositories |
339
+ | `ast_explore` | Parse code snippet to S-expression AST tree |
340
+ | `test_query` | Run tree-sitter query against code snippet |
294
341
 
295
342
  ---
296
343
 
@@ -298,7 +345,7 @@ Open your AI agent. It auto-loads `AGENTS.md` with codebase context. You're read
298
345
 
299
346
  | Prompt | Purpose |
300
347
  |---|---|
301
- | `milens-planner` | 5-step implementation planning with blast radius |
348
+ | `milens-planner` | Implementation planning with blast radius + test strategy |
302
349
  | `milens-reviewer` | PR review — risk scan → deep dive → dead code → security |
303
350
  | `milens-tester` | TDD — coverage gaps → test plans → implement → verify |
304
351
  | `milens-security` | Security audit — secrets, injection, unicode, crypto, config |
@@ -310,7 +357,7 @@ Open your AI agent. It auto-loads `AGENTS.md` with codebase context. You're read
310
357
 
311
358
  ## Security (50+ Rules)
312
359
 
313
- All 50 rules map to **OWASP Top 10 (2021)**. One tool call covers what used to take 10 manual greps.
360
+ Rules cover common vulnerability patterns. One `security_scan()` call replaces multiple manual greps.
314
361
 
315
362
  | Category | Rules | Detects |
316
363
  |---|---|---|
@@ -326,34 +373,13 @@ All 50 rules map to **OWASP Top 10 (2021)**. One tool call covers what used to t
326
373
 
327
374
  ```bash
328
375
  milens security scan --scope secrets --severity HIGH --format json
329
- milens security deps # Offline CVE check (35 CVEs, 5 ecosystems)
376
+ milens security deps # Offline CVE database check
330
377
  ```
331
378
 
332
379
  From an AI agent: `security_scan({scope: "all", severity: "HIGH"})`
333
380
 
334
381
  ---
335
382
 
336
- ## Supported Languages
337
-
338
- 12 languages through tree-sitter:
339
-
340
- | Language | Files | Imports | Calls | Heritage |
341
- |---|---|---|---|---|
342
- | TypeScript | `.ts` `.tsx` | ESM + CJS + decorators | ✓ | extends / implements |
343
- | JavaScript | `.js` `.jsx` `.mjs` `.cjs` | ESM + CJS | ✓ | extends |
344
- | Python | `.py` | import + relative | ✓ + decorators | extends |
345
- | Java | `.java` | import + static | ✓ + annotations | extends / implements |
346
- | Go | `.go` | import + go.mod | ✓ | embedding |
347
- | Rust | `.rs` | use | ✓ + macros | trait impl |
348
- | PHP | `.php` | use + include | ✓ + static, new | extends + traits |
349
- | Ruby | `.rb` | require | ✓ | extends |
350
- | Vue | `.vue` | ESM | ✓ template refs | extends |
351
- | HTML | `.html` `.htm` | `<script src>` `<link>` | ✓ inline | — |
352
- | CSS | `.css` | `@import` | — | — |
353
- | Markdown | `.md` `.mdx` | local `[links]()` | — | headings as sections |
354
-
355
- **Framework detection** (via `routes()`)**: Express, FastAPI, NestJS, Flask, Django, Go net/http, Gin, PHP Laravel, Rails, Sinatra, Spring.
356
-
357
383
  ---
358
384
 
359
385
  ## Editor Adapters
@@ -375,7 +401,7 @@ Each adapter is in the `adapters/` directory with ready-to-copy config files and
375
401
  ### Profile Selection
376
402
 
377
403
  ```bash
378
- MILENS_PROFILE=minimal milens serve # 10 tools — ~500 token overhead
404
+ MILENS_PROFILE=minimal milens serve # 10 tools — lighter footprint
379
405
  MILENS_PROFILE=standard milens serve # 25 tools — full daily coding
380
406
  milens serve --profile full # 41 tools — everything
381
407
  ```
@@ -441,71 +467,42 @@ milens hooks disable --hook preCommit # Turn off one hook
441
467
 
442
468
  ---
443
469
 
444
- ## Pricing
445
-
446
- | Tier | Price | Key Features |
447
- |---|---|---|
448
- | **Free** | $0 | All 41 tools, 7 prompts, 7 workflows, 50+ security rules, CLI, community support. MIT core. |
449
-
450
- [Full pricing details →](docs/pricing.md)
451
-
452
- ---
453
-
454
- ## Changelog
455
-
456
- ### v0.6.5 (May 2026)
457
-
458
- - 14 new test files (168 → 554 tests, 23% → 58% coverage)
459
- - 7 CLI workflow commands: tdd, review, plan, onboard, security-scan, refactor, handoff
460
- - Enhanced orchestrator with snapshot persistence
461
- - Compare impact for regression detection
462
- - Coverage thresholds in vitest.config.ts
463
- - CI/CD: milens-ci-test.yml workflow
464
- - 41 MCP tools in full profile (up from 33)
465
-
466
- ### v0.6.0 (March 2026)
467
-
468
- - 41 MCP tools, 7 sub-agent prompts
469
- - Learning engine: annotate → recall → evolve
470
- - Offline CVE database with 35+ CVEs across 5 ecosystems
471
- - 7 editor harness adapters
472
- - Hook system with 6 event triggers
473
-
474
- [Full changelog →](https://github.com/fuze210699/milens/releases)
475
-
476
- ---
477
-
478
470
  ## Security & Privacy
479
471
 
480
- **Zero network. Zero telemetry. Zero data leaving your machine.**
472
+ Milens runs entirely on your machine. **No network calls. No telemetry. No data ever leaves your device.**
481
473
 
482
- | Layer | Guarantee |
474
+ | What you worry about | How milens protects you |
483
475
  |---|---|
484
- | **Data** | Index stored in `.milens/` per repo (gitignored). No source code in registry. |
485
- | **Network** | HTTP binds `127.0.0.1` only. No outbound connections. |
486
- | **Input** | User regex validated against ReDoS. FTS5 tokens quoted as literals. |
487
- | **File access** | All paths bounded to repo root. No traversal possible. |
488
- | **Git** | `execFileSync` with arg arrays. No shell interpolation. |
489
- | **Embeddings** | Optional. Generated locally via Xenova transformers. No API calls. |
476
+ | Source code leaking | Index stored in `.milens/` per repo, gitignored by default. Registry tracks repo paths only — zero source code stored. |
477
+ | Network calls | MCP server binds `127.0.0.1` exclusively. No outbound connections. Works fully offline. |
478
+ | Shell injection | All system calls use `execFileSync` with argument arrays no string interpolation into shell. |
479
+ | Path traversal | File paths bounded to repo root. Symlinks outside root are rejected. |
480
+ | Dependency CVEs | Optional `security deps` audit against offline CVE database. No external API calls. |
481
+ | Embeddings privacy | Optional. Generated locally via Xenova transformers. No data sent to any service. |
482
+ | Input attacks | Regex validated against ReDoS. FTS5 tokens passed as SQLite literals. |
490
483
 
491
- ---
484
+ Everything that touches your code stays on your filesystem. Built for production use with zero trust required.
492
485
 
493
- ## Development
486
+ ---
494
487
 
495
- ```bash
496
- git clone https://github.com/fuze210699/milens.git
497
- cd milens
498
- npm install
499
- npm run build # tsc → dist/
500
- npm test # vitest (554 tests, 30 test files)
501
- npm run lint # tsc --noEmit
502
- npm run self-analyze # Index milens with milens
503
- npm run self-serve # Start MCP on port 3100
504
- ```
488
+ ## Supported Languages
505
489
 
506
- **Tech Stack:** TypeScript (ESM) · tree-sitter (WASM) · SQLite (better-sqlite3 + FTS5) · MCP SDK · Vitest · Commander
490
+ <p align="center">
491
+ <img src="https://img.shields.io/badge/TypeScript-.ts%20.tsx-3178C6?logo=typescript&logoColor=white" alt="TS">
492
+ <img src="https://img.shields.io/badge/JavaScript-.js%20.jsx-F7DF1E?logo=javascript&logoColor=black" alt="JS">
493
+ <img src="https://img.shields.io/badge/Python-.py-3776AB?logo=python&logoColor=white" alt="PY">
494
+ <img src="https://img.shields.io/badge/Java-.java-ED8B00?logo=openjdk&logoColor=white" alt="Java">
495
+ <img src="https://img.shields.io/badge/Go-.go-00ADD8?logo=go&logoColor=white" alt="Go">
496
+ <img src="https://img.shields.io/badge/Rust-.rs-000000?logo=rust&logoColor=white" alt="Rust">
497
+ <img src="https://img.shields.io/badge/PHP-.php-777BB4?logo=php&logoColor=white" alt="PHP">
498
+ <img src="https://img.shields.io/badge/Ruby-.rb%20.rake-CC342D?logo=ruby&logoColor=white" alt="Ruby">
499
+ <img src="https://img.shields.io/badge/Vue-.vue-4FC08D?logo=vuedotjs&logoColor=white" alt="Vue">
500
+ <img src="https://img.shields.io/badge/HTML-.html%20.htm-E34F26?logo=html5&logoColor=white" alt="HTML">
501
+ <img src="https://img.shields.io/badge/CSS-.css-1572B6?logo=css3&logoColor=white" alt="CSS">
502
+ <img src="https://img.shields.io/badge/Markdown-.md%20.mdx-000000?logo=markdown&logoColor=white" alt="MD">
503
+ </p>
507
504
 
508
- ---
505
+ 12 languages parsed via tree-sitter WASM. [Full support details →](docs/languages.md)
509
506
 
510
507
  ## License
511
508
 
@@ -518,6 +515,9 @@ See [LICENSE](LICENSE) for details.
518
515
  <p align="center">
519
516
  <a href="https://github.com/fuze210699/milens">GitHub</a> ·
520
517
  <a href="https://github.com/fuze210699/milens/tree/main/docs">Docs</a> ·
518
+ <a href="https://github.com/fuze210699/milens/blob/main/docs/cli.md">CLI</a> ·
519
+ <a href="https://github.com/fuze210699/milens/blob/main/docs/accuracy.md">Accuracy</a> ·
520
+ <a href="https://github.com/fuze210699/milens/blob/main/docs/languages.md">Languages</a> ·
521
521
  <a href="https://github.com/fuze210699/milens/blob/main/docs/pricing.md">Pricing</a> ·
522
522
  <a href="https://github.com/fuze210699/milens/blob/main/CONTRIBUTING.md">Contribute</a>
523
523
  </p>
@@ -1,24 +1,45 @@
1
1
  # Milens — Code Intelligence for Claude Code
2
2
 
3
- Milens is an MCP server that provides deep code intelligence: symbol search, dependency graphs, blast-radius analysis, and pre-commit change detection.
3
+ ## ⚠️ BEFORE ANYTHING ELSE
4
4
 
5
- ## Available Tools
5
+ This project is indexed by **milens**. You have MCP tools that are faster and more accurate than reading files directly.
6
+
7
+ **HARD RULE: Use milens tools BEFORE built-in search/read tools.**
8
+
9
+ | Situation | Built-in approach (❌) | Milens approach (✅) |
10
+ |---|---|---|
11
+ | Understand a function | Read 3-10 files | `mcp_milens_overview({name: "X"})` — 1 call |
12
+ | Find references | grep in files | `mcp_milens_grep({pattern: "X"})` — searches everything |
13
+ | Check edit safety | Hope nothing breaks | `mcp_milens_impact({target: "X"})` — exact blast radius |
14
+ | Start working | Read README, explore files | `mcp_milens_codebase_summary()` — 500 token overview |
15
+ | Before commit | `git diff` manually | `mcp_milens_detect_changes()` — symbols + risk scores |
16
+
17
+ **If you skip milens tools, you're wasting tokens and risking breaking changes.**
18
+
19
+ ## ⭐ Core Tools (Use Every Session)
6
20
 
7
21
  | Tool | Purpose |
8
22
  |---|---|
9
- | `mcp_milens_query` | Find symbol definitions by name |
10
- | `mcp_milens_grep` | Text search across ALL project files |
11
- | `mcp_milens_context` | 360° view: callers + callees |
12
- | `mcp_milens_impact` | Blast radius before editing |
13
- | `mcp_milens_detect_changes` | Pre-commit scope check |
14
- | `mcp_milens_overview` | Combined context + impact + grep |
15
- | `mcp_milens_edit_check` | Pre-edit safety check |
16
- | `mcp_milens_explain_relationship` | Shortest path between two symbols |
17
- | `mcp_milens_get_file_symbols` | All symbols in a file |
18
- | `mcp_milens_get_type_hierarchy` | Class inheritance tree |
19
- | `mcp_milens_find_dead_code` | Unused exported symbols |
20
- | `mcp_milens_trace` | Trace execution flows from entrypoints |
21
- | `mcp_milens_status` | Index health check |
23
+ | `mcp_milens_overview` | **Use this first.** Context + impact + grep combined. 1 call replaces 3-5 file reads. |
24
+ | `mcp_milens_impact` | Blast radius BEFORE editing. Shows what WILL BREAK. |
25
+ | `mcp_milens_edit_check` | Pre-edit safety: callers, export status, re-export chains, test coverage |
26
+ | `mcp_milens_context` | 360° view: incoming refs + outgoing deps |
27
+ | `mcp_milens_query` | Find symbol definitions by name (camelCase/PascalCase/snake_case) |
28
+ | `mcp_milens_grep` | Text search ALL project files (code, templates, docs, configs, styles) |
29
+ | `mcp_milens_detect_changes` | Pre-commit: changed symbols + dependents + risk scores |
30
+ | `mcp_milens_codebase_summary` | 500-token project overview. Use instead of reading README. |
31
+
32
+ ### 🔧 Situational Tools (Use When Needed)
33
+
34
+ | Tool | Purpose | Use when... |
35
+ |---|---|---|
36
+ | `mcp_milens_guard_edit_check` | Hard pre-edit gate with audit tracking | Before every edit |
37
+ | `mcp_milens_trace` | Execution flow from entrypoints | Debugging call chains |
38
+ | `mcp_milens_explain_relationship` | Shortest path between two symbols | Understanding connections |
39
+ | `mcp_milens_get_file_symbols` | All symbols in a file with ref/dep counts | Exploring a file |
40
+ | `mcp_milens_get_type_hierarchy` | Inheritance/implementation tree | Class exploration |
41
+ | `mcp_milens_find_dead_code` | Unused exported symbols | Before major refactors |
42
+ | `mcp_milens_status` | Index health: symbols, links, files, coverage | Session start |
22
43
 
23
44
  All tool calls must include `repo` set to the absolute workspace root.
24
45