Skip to content

v0.16.0 — production hardening pass

Choose a tag to compare

View all tags
@sdsrss sdsrss released this 22 Apr 23:24
· 1135 commits to main since this release
v0.16.0
101fe5b

Summary

Architecture audit surfaced nine correctness / safety gaps — this release addresses all of them plus four items from a follow-up code review. Schema auto-migrates; no user action required.

Algorithmic correctness

  • RRF blend factor fix — SCORE_BLEND_FACTOR = 0.1 silently dominated RRF by ~100× at k=30 (rank-0 RRF ≈ 0.0164 vs. max blend = 0.1), inverting the docstring's own "doesn't override rank ordering" contract and effectively converting RRF into per-source-raw-score ranking. Replaced with adaptive blend_scale = 0.5 / ((k+1)(k+2)) — mathematically half the smallest adjacent-rank RRF gap. Semantic search results shift (for the better) on queries where one source returns a high-raw-score item at a late rank.

Data safety — schema v7 embedding-dim guard

  • SCHEMA_VERSION 6 → 7. New meta table records embedding_dim; mismatch on open → atomic DROP + rebuild node_vectors at current EMBEDDING_DIM. Prevents silent crash-on-INSERT when a user rebuilds the binary at a different dim (e.g., swaps embedding model).
  • v6 → v7 upgrade path introspects on-disk vec0 DDL via sqlite_master.sql (float[N]) and rebuilds if the existing table's dim ≠ current.

Concurrency hardening

  • Bounded watcher channel (sync_channel(4096)) — no more unbounded memory growth on bulk fs events; merkle rescan covers any dropped events.
  • Secondary MCP instances (flock denied) open DB strictly SQLITE_OPEN_READ_ONLY | query_only=ON; eliminates the race where a secondary could run migrations / the INDEX_VERSION DELETE sweep on the primary's DB.

Contract strengthening

  • ParsedRelation.source_language is now stamped by the parser; resolver hard-errors on mismatch (bail!, not debug_assert!) so parser regressions fail in release builds too.
  • Phase-3 startup auto-repair (repair_null_context_strings) now actually fires on every session start — previously only via explicit pipeline paths, contradicting the README's own claim.

Documentation accuracy

  • README HTTP route tracing now correctly lists only the frameworks extract_route_pattern actually implements (Express, Flask/FastAPI, Go net/http). ASP.NET/Rails/Laravel/Vapor claims removed.

CI + release

  • ci.yml — matrix {ubuntu, macos, windows} × {no-embed, with-embed} (was ubuntu-only); toolchain pinned to @1.95.0.
  • release.yml — new smoke-verify job runs after publish on all 3 OSes: npm install with retry-backoff, --version exact match, incremental-index + map --json on a tmp git repo. Catches missing platform binaries, find-binary.js regressions, and version-sync drift before users hit them.

Testing

  • +18 unit tests: RRF invariants ×4, schema v7 paths ×5, readonly ×2, source_language stamp ×1.
  • 382 tests pass total: 250 unit + 56 integration + 44 hardening + 19 parser + 6 CLI + 6 plugin + 1 routing.
  • Clippy 1.95 clean on both feature modes.

Deferred

L3 refactor — splitting tools.rs (2236 LOC), relations.rs (2174), queries.rs (2783) into focused modules — requires a dedicated session with plan-mode review and ships separately.

Install

```bash
npm install -g @sdsrs/code-graph@0.16.0

or

npx -y @sdsrs/code-graph@0.16.0
```

Claude Code users see the update via the plugin's auto-update hook.

Full Changelog: v0.15.2...v0.16.0

Assets 9
Loading