feat: registry hardening, single-repo MCP, and strategic repositioning

[carlos-alm]

Summary

• Registry hardening: input validation, path traversal prevention, and structural analysis (src/structure.js) with hotspot detection, coupling metrics, and module-level overview
• Single-repo MCP default: MCP server now defaults to single-repo mode — tools have no repo property and list_repos is not exposed unless --multi-repo is explicitly enabled
• Security fixes: eliminate SQL interpolation in hotspotsData, add NULLS LAST to hotspots ORDER BY, break parser.js ↔ constants.js circular dependency
• Publish workflow hardening: pin checkout to main, sync native package versions, skip version push on release events, harden version resolution
• Strategic repositioning: reframe project messaging from "zero cloud / fully local" to "always-fresh incremental graph at zero cost, optionally enhanced with your LLM provider" across README, COMPETITIVE_ANALYSIS.md, and FOUNDATION.md
• New docs: competitive analysis (21 tools), foundation principles, dogfooding guide, v1.5.0 changelog

Test plan

• npm test passes (new tests for structure, MCP single-repo, registry validation, CLI)
• codegraph build . works in single-repo mode by default
• codegraph mcp exposes no repo property without --multi-repo
• codegraph map and structural analysis commands return valid output

[greptile-apps]

Greptile Summary

Strategic repositioning of project messaging from "zero cloud / fully local" to "always-fresh incremental graph at zero cost, optionally enhanced with your LLM provider."

Key changes:

• README.md: Added detailed comparison table explaining why competitors can't keep up with commits (full re-indexing, cloud API dependencies). Shifted tagline and feature list to emphasize incremental rebuilds and optional LLM enhancement
• FOUNDATION.md: Reordered principles — "The graph is always current" is now Principle 1 (previously "Zero-infrastructure deployment"). Added Principle 4 on zero-cost core with optional LLM layer
• COMPETITIVE_ANALYSIS.md: Updated project summary in ranking table and strengths section to highlight incremental rebuilds and dual-mode (local + optional cloud enhancement)

Gap identified:
The messaging describes LLM provider integration (OpenAI, Anthropic APIs) as a current feature, but the codebase only implements local embeddings via @huggingface/transformers. The llm.provider config infrastructure exists but isn't consumed. ROADMAP.md Phase 3 lists "Intelligent Embeddings" with LLM-generated descriptions as a planned feature.

Files not updated in this PR that contain conflicting messaging:

• SECURITY.md: still says "zero network calls — no data ever leaves your machine"
• ROADMAP.md: still says "zero cloud dependency by default"

Confidence Score: 4/5

• Documentation-only PR with clear strategic intent, well-executed messaging shift, but creates expectation gap for unimplemented feature
• This is a documentation-only PR with no code changes, so there's no risk of introducing bugs or breaking functionality. The writing is clear and the repositioning strategy is coherent. However, the messaging positions LLM provider integration as a current capability when it's actually planned (ROADMAP Phase 3). This creates a gap between marketing and reality that should be addressed before merge.
• README.md needs the most attention due to the LLM enhancement claims that aren't yet implemented. Also consider updating SECURITY.md and ROADMAP.md to align with the new messaging.

Important Files Changed

Filename	Overview
COMPETITIVE_ANALYSIS.md	Repositioned project description from "zero-cloud" to "sub-second incremental rebuilds + zero-cost core + optional LLM enhancement"
FOUNDATION.md	Updated Principle 1 from "Zero-infrastructure deployment" to "The graph is always current", reframed Principle 4 to focus on zero-cost core with optional LLM layer
README.md	Major messaging shift: added incremental rebuild comparison table, updated tagline, feature list, and competitive positioning to emphasize always-fresh graph and optional LLM enhancement

_{Last reviewed commit: a403acc}

[greptile-apps]

_{3 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Claims "bring your own LLM provider and codegraph enhances search" but LLM provider integration (OpenAI/Anthropic APIs) isn't implemented — only local embeddings exist via @huggingface/transformers. This positioning describes a planned feature (listed in ROADMAP Phase 3) as if it's current functionality.

[greptile-apps]

Updated from "No data leaves your machine. Ever." to "Your code only goes where you choose to send it." — but SECURITY.md still says "zero network calls — no data ever leaves your machine" and ROADMAP.md says "zero cloud dependency by default". These files should be updated to align with the new messaging that acknowledges optional cloud LLM features.