nikolai-vysotskyi/trace-mcp

1.44.0 (2026-07-02)

Features

• analysis: add get_file_health_timeline (complexity+coupling+churn merge) (84a889d)
• analysis: add get_graph_timeline (simplified commit-sampling tier) (ee30168)
• analytics: track semantic-degraded searches + near-duplicate rephrased queries (a3becf2)
• cfg: model loop back-edges, loop-exit edges, and try/catch merge nodes (8b58c13)
• daemon: serve registered subprojects read-mostly (no watcher, ephemeral) (208be4c)
• daemon: subproject-aware session binding (#209) (bb96ecf)
• eval: health-metric calibration harness + honest triage language (caae2c9)
• iac: K8s Resource nodes, multi-doc, Kustomize modules, compose build links (391d03e)
• iac: resolve Kustomize/compose path-string imports to real manifest nodes (4da5e48)
• memory: decision staleness verification (Task 3) (dce53ea)
• memory: hybrid retrieval for decisions + tracked benchmark (Task 9) (05cb7fb)
• memory: progressive disclosure of decisions (Task 12) (1222cef)
• memory: search-time heat decay + auto-supersession (Task 11) (6bcf60b)
• quality: SARIF 2.1.0 output for scan_security, detect_antipatterns, check_quality_gates (37a0047)
• quality: type-aware taint pruning to cut false positives (62a2a6a)
• refactor: re-enable extract_function with AST free-variable analysis (296a2b8)
• refactor: rebuild apply_codemod on ast-grep AST engine (c3e823c)
• scip: SCIP ingestion with scip_resolved edge tier (3b5a970)
• taint: array-destructuring source + lock-in multi-hop/coercion regressions (106eb5c)
• tools: register get_federation_impact, get_file_health_timeline, get_graph_timeline (1ebf5bc)

Bug Fixes

• cache: scope pagerank + search caches per-DB (WeakMap), not by db.name (24c42ec)
• cfg: emit post-nested-block statement as its own node (13ee9c1)
• cfg: stop mis-classifying do-prefixed identifiers as do-while loops (3f7a8e0)
• codemod: a pattern with zero matches is success, not an error (6d1bc99)
• codemod: lazy-load @ast-grep/napi so a missing native binding degrades instead of crashing the server (643e7d5)
• daemon: FK-recovery hard-resets index tables instead of looping (848623d)
• extract-function: stop misclassifying shadowed/multi-return slices, make confidence reflect it (4175a41)
• hcl: persist + resolve Terraform module source imports edge (970a144)
• indexer: keep symbols_fts in sync on incremental reindex (6807b0f)
• indexer: scope indexing to most-specific registered project (#209) (32e2930)
• memory: break decision-store circular import via shared decision-types (5892529)
• memory: decision retrieval bench script was broken and measuring stale data (e6259b4)
• memory: fail open when decision verification throws internally (3850eb9)
• registry: match extensionless language files by basename (cfa018b)
• revert 6 dead-code false positives from get_dead_code confidence-1.0 batch (0a18f42)
• sarif: emit the canonical OASIS $schema URL, not a dead 404 (511ef78)
• security: eliminate 3x command injection in install-app.ts (ff9eca6)
• security: eliminate command injection in ask --repo git clone (b052f9a)
• security: validate table identifier before DDL in Vec0Index (CWE-89) (6285f0b)
• session: tighten unbatched-call hint, broaden tracked tool set (fbccd6e)
• taint: line-aware type pruning to prevent hidden string-injection (edb6815)
• taint: propagate taint through string concat and template literals (05194ee)
• types: narrow SearchResult | FlatSearchResult before _meta/_near_misses access (76ef9ce)
• types: null-guard decisionStore inside nested closures in memory.ts (ac98c3a)
• types: remove invalid type assertion in updateCallSites (739295b)
• types: replace zod v3 ZodEffects with v4 ZodPipe/ZodTransform (22c5294)
• types: widen tsconfig rootDir to repo root to fix TS6059 (f526ba3)

Performance

• ai: optional sqlite-vec ANN index for vector search (256305f)
• analysis: batch per-period churn queries in getGraphTimeline into one git call (a3f846b)
• analysis: cross-call cache for buildFileGraph + edge bottlenecks (5f43b89)
• analytics: replace tool_calls JOIN sessions with IN-subquery filter (f76afa6)
• complexity: strip strings/comments once per symbol, not twice (106dc58)
• context: hoist repeated graph/file loads in context assembly (42d5d33)
• daemon: grace-TTL release of idle project stores + idle heartbeat backoff (9a3a3f4)
• db: add hot-path indexes idx_symbols_parent/exported, idx_edges_resolved (schema v30) (cc49d47)
• indexer: bulk-create symbol nodes per file batch (2N->1 statements) (dbba80b)
• indexer: evict per-batch file content cache to bound in-process RSS (405f3ae)
• memory: batch decision-verification blob reads via git cat-file --batch (a079eac)
• memory: dedupe getStats() on the wake-up hot path (02972d7)
• memory: memoize git subprocess spawns in decision verification (28ba56c)
• scoring: avoid expensive filtered COUNT in PageRank cache-hit check (7d0e751)
• topology: memoize endpoint-path normalization in linkClientCallsToEndpoints (cd3a756)
• topology: O(N^2)->O(N) cross-service edges; fix FK-safe repo removal (c0140da)

Refactoring

• api: split ask-sessions-routes dispatcher into per-route handlers (a166ca7)
• api: split memory-routes dispatcher into per-route handlers (60bafa9)
• eval: extract main() helpers in calibrate-health-metrics (F -> D) (fe62553)
• indexer: extract FileCollector from IndexingPipeline.collectFiles (9fc7bb2)
• indexer: extract RenameDetector from IndexingPipeline.detectRenames (2c72d9a)
• lsp: extract ensureFileOpen/enrichSymbol from enrichLanguage (cyclomatic 11 -> 6) (5337939)
• lsp: extract logging/drain helpers from flushInternal (cyclomatic 10 -> 5) (17a158b)
• lsp: extract resolveServers helpers in config.ts (cyclomatic 19 -> 1) (693a22d)
• memory: extract MemoOperations from DecisionStore god-class (1ce07d2)
• memory: extract MutationOperations (write-path) from DecisionStore (5af82ad)
• memory: extract QueryOperations (read-path) from DecisionStore (478f91b)
• memory: extract ReviewOperations from DecisionStore (c88242f)
• memory: extract SchedulerState + Consolidation ops from DecisionStore (b68847f)
• memory: extract SessionOperations from DecisionStore (7eca034)
• python: decompose PythonLanguagePlugin.extractClass into helpers (class cyclomatic 153 to 66) (3562333)
• server: decompose installToolGate into tool-gate-helpers (cyclomatic 154 to 26) (634078e)
• subproject: extract contract resolution and source-service lookup in manager (4f0a28e)
• subproject: extract rename detection out of diffSchemas (1e1feb5)
• subproject: extract URL resolution and dedupe line-counting in scanner (61268b5)
• subproject: split per-repo search logic out of subprojectSearch (1690413)
• tools: extract get_context_bundle + get_feature_context into navigation/context-tools.ts (b64478f)
• tools: extract get_task_context into navigation/task-context-tools.ts (89a2f4f)
• tools: extract point-lookup tools into navigation/lookup-tools.ts (b79a318)
• tools: extract search + suggest_queries into navigation/search-tools.ts (ddc7cf8)
• tools: hoist memo helpers out of registerMemoryTools closure (b2cd23b)
• tools: reduce registerNavigationTools to thin orchestrator (cyclomatic 183 -> 1) (bc292c7)
• topology: decompose TopologyStore god-class into per-entity modules (125 -> 49) (f2b3221)

Documentation

• fix CLAUDE.md/AGENTS.md drift (dead path, false-positive tool refs, oversized section) (40a1b90)
• reflect shipped gap-closures + adversarial validation findings (4ae193b)
• refresh competitor comparison (June 2026) + new entrants (cc5c332)

Tests

• ai: add AnthropicProvider unit tests (b3152a8)
• ai: add ask-shared.ts unit tests (resolveProvider, gatherContext, factories) (35b1838)
• ai: add GeminiProvider unit tests (4827f32)
• ai: add OnnxProvider unit tests (842501d)
• ai: add OpenAIProvider unit tests (e6fbe6a)
• api: characterize ask-sessions-routes HTTP contract before split (0c6afe3)
• cli: add behavioral coverage for clients and check commands (cdf04e8)
• cli: add behavioral coverage for consent, bundles, status commands (41fc3d6)
• cli: add behavioral coverage for preflight, prune, remove commands (78d8b87)
• codemod: add CI smoke test for @ast-grep/napi native binding resolution (a7980ab)
• eval: widen MRR baseline tolerance to dataset granularity (3479053)
• iac: adversarial hardening for K8s/Kustomize/compose edge cases (a0682a6)
• lsp: add unit tests for LspBridge orchestrator (8f9482f)
• lsp: add unit tests for LspClient JSON-RPC transport (0617a15)
• lsp: add unit tests for LspEnrichmentPass (392386c)
• lsp: add unit tests for LspServerManager lifecycle (9666574)
• lsp: add unit tests for symbol <-> LSP position mappers (30e89ba)
• memory: adversarial supersession non-triggers (Task 11) (e3ace69)
• memory: end-to-end heat-decay ranking with real timestamps (Task 11) (cdc3e15)
• memory: end-to-end staleness scenarios (file deletion, in-place edit) (6dce0c8)
• memory: progressive-disclosure error handling + content-leak hardening (Task 12) (5c8f198)
• memory: query_decisions hybrid retrieval wiring at the tool-handler level (Task 9) (54d2a8a)
• refactor: fix extract_function preview fixture to a genuine single-return case (cc799cc)
• refactor: fix legacy zero-match assertion missed by the targeted re-run (4268172)
• subproject: add behavioral coverage for subproject-helpers.ts (5462d6a)

Chores

• ai: remove 5 unused retrieval-mode result interfaces (541b9fb)
• deps: bump hono 4.12.27 + js-yaml 4.3.0 via pnpm.overrides (security) (9d26f76)
• deps: declare vite >=8.0.16 override (fs.deny bypass + launch-editor NTLMv2 advisories) (f348a80)
• deps: override esbuild >=0.28.1 (fixes dev-server arbitrary file read on Windows) (51f1446)
• deps: override undici >=7.28.0 (fixes SOCKS5 proxy pool cross-origin + TLS bypass advisories) (14bcdd5)
• deps: tighten protobufjs override to >=8.6.0 (fixes unknown-field memory amplification + property-shadowing advisories) (d44aaba)
• lsp: remove TextDocumentPositionParams — orphaned by prior removal (3472c41)
• plugin: sync manifest versions to 1.43.4 (956902b)
• release: 1.43.4 (4998247)
• remove 5 verified-dead leaf exports (f8066ac)
• remove confirmed-dead exports from fresh dead-code sweep (a862c06)
• remove dead extractCashierConfig cascade + WorkspaceResolver (b2e9375)
• remove verified dead code (4 symbols, confirmed via search_text) (dbcff51)
• ruby: remove confirmed-dead filePathToModule and isAllCaps helpers (cc9b90e)

CI/CD

• add informational-only quality-gates report job (a1b0f26)

Upgrade

npm install -g trace-mcp@latest
trace-mcp init