v0.2.0

Changed

• Project renamed to HonestCode — the package, CLI, and environment
  variables were renamed for a distinct brand identity (no longer riding on
  the "CodeGraph" family name):
  • PyPI package repograph-honest-mcp → honestcode
  • Python module repograph_honest → honestcode
  • CLI commands repograph-honest / repograph-honest-mcp →
    honestcode / honestcode-mcp
  • Environment variables REPOGRAPH_* → HONESTCODE_*
  • Project binding directory .repograph/ → .honestcode/
  • GitHub repository Fengrru/repograph-honest-mcp → Fengrru/honestcode

Fixed

• Pin mcp>=1.6.0,<2.0 — mcp 2.0 removed mcp.server.fastmcp, breaking
  the server import in fresh environments; the constraint keeps the 1.x API
  until the code is adapted.
• Align pre-commit hooks with ruff — ruff-pre-commit bumped to
  v0.16.1 (from v0.11.13), removing the stale UP038 rule drift that failed
  the lint job.
• Sandbox: best-effort resource limits — each setrlimit call in the
  POSIX preexec_fn is now guarded individually. Some platforms (e.g. macOS
  CI runners) reject certain limits, and a single failure inside
  preexec_fn killed the child before it could run, breaking all sandbox
  tests on macOS.

Added

• Persistent call graph (SQLite) — graph/graph_store.py persists the
  project-wide definitions/references graph next to the symbol index, keyed by
  content hashes of every source file. explore_call_graph and
  find_dead_code now read from disk instead of re-parsing on every call:
  measured ~1 ms hot (was ~285 ms / ~340 ms).
• FTS5 full-text search — search_code narrows regex scans to candidate
  files via an FTS5 virtual table.
• explore_impact tool — blast radius of a symbol: transitively impacted
  symbols/files via bidirectional call-graph BFS.
• affected_files tool — trace a git diff through the call graph to
  find affected files and tests (CI-friendly).
• File watcher — zero-dependency polling watcher with debounce;
  index_project(watch=True), CLI watch, and stop_watching.
• Project binding & client install — honestcode init / uninit /
  install / root: .honestcode/ binding plus auto-configuration of
  Cursor, VS Code and Claude Code MCP configs.
• Multi-language support (optional) — honestcode[multi-language]
  extras with tree-sitter symbol extraction for JS/TS/Go/Rust/Java.
• External-repo benchmarks — scripts/benchmark.py gains --repo,
  --repos, --format markdown|json.
• CLI (honestcode command) with a 1:1 subcommand for every MCP tool,
  JSON output, non-zero exit codes for CI.
• HONESTCODE_TOOLS environment variable now actually controls which
  tools the MCP server exposes.
• SSE transport — honestcode-mcp --transport sse --host 0.0.0.0 --port 8000.
• False-positive regression tests and explore_call_graph callees tests.

Fixed

• scan_file false positives — defined-symbol set now includes
  parameters/self/cls, from X import Y / import X as Y names, loop
  targets, walrus assignments, and the full builtins module.
• explore_call_graph callees — reference contexts now use
  module-qualified names so queries actually return callees.
• check_api dead branch, StructureExtractor no longer requires
  tree-sitter-python, MCP index_project(watch=True) now works,
  affected_files honors max_depth.
• Environment variables actually read — HONESTCODE_TIMEOUT,
  HONESTCODE_MEMORY_MB, HONESTCODE_INDEX_DIR now honored.
• install --client cursor writes the right mcpServers key.
• Call-graph reference lines, true cache status reporting, multi-language
  false positives, file-aware callee matching, Poetry dict dependencies,
  sandbox secret scrubbing, SQLite connection leak, module-path matching,
  tree-sitter type_identifier nodes, CLI execute --known-names.
• Dead code removed and SandboxExecutor(timeout=0, ...) fixed.

Changed

• Dropped tree-sitter and tree-sitter-python runtime dependencies — the
  extractor parses with the standard-library ast module.
• [project.scripts] now declares two entry points: honestcode-mcp (MCP
  server) and honestcode (CLI).
• README architecture diagram and module layout updated.