v0.9.4

[0.9.4] - 2026-05-24

New Features

• Request-to-handler flows now trace end-to-end across many web stacks, with new or improved route resolution for Express, Rails, Spring (Java and Kotlin), Django/DRF, Laravel, Flask, FastAPI, Gin, chi, ASP.NET, Drupal, Axum, actix, Vapor, Play, Vue/Nuxt, Svelte/SvelteKit, and React Router.
• codegraph_trace, codegraph_callees, and codegraph_explore now follow flows that have no static call edge — callback and observer registration, EventEmitter, React re-renders and JSX children, Flutter setState to build, C++ virtual overrides, and Java/Kotlin interface-to-implementation dispatch (like Spring's @Autowired service calls) — and each bridged hop is labeled inline in trace with where it was wired up.
• codegraph_trace now returns a self-contained flow dossier: every hop shows its full body inline plus the destination's own outgoing calls, so a single trace usually answers a "how does X reach Y" question without a follow-up explore, node, or Read.
• codegraph_explore now leads with the execution flow when your query names the symbols of a flow, finding the call path among those symbols (including across dynamic-dispatch hops) so you get a trace-quality answer without switching tools.
• codegraph_node and codegraph_trace now emit line-numbered source (matching codegraph_explore and Read), so you can cite or edit exact lines without re-reading the file just to recover line numbers.
• New CODEGRAPH_MCP_TOOLS environment variable lets you expose only a chosen subset of codegraph tools over MCP (e.g. trace,search,node,context) without editing your client's MCP config; unset exposes all of them.
• Release archives now ship with a SHA256SUMS file, and the npm launcher verifies the bundle it downloads against it, aborting on a mismatch (releases published before this change skip verification rather than failing).

Fixes

• Several static-extraction and resolution correctness fixes underpin the routing work above: C++ inheritance edges that were previously missing, Dart methods that were extracted signature-only, Python handlers named index/get/update that were being silently dropped, and an explore output-budget issue that under-returned source on repos with very large files.
• codegraph serve --mcp no longer keeps running after its parent agent is force-killed (OOM, kill -9, or container teardown) on Linux, where it used to hold inotify watches, file descriptors, and the SQLite WAL indefinitely; the server now shuts down as soon as its parent process changes, tunable via CODEGRAPH_PPID_POLL_MS (#277).
• Installing @colbymchenry/codegraph through a registry mirror that hadn't yet mirrored the matching per-platform package no longer fails with no prebuilt bundle for <platform>; the launcher now downloads the bundle from GitHub Releases and caches it, with CODEGRAPH_NO_DOWNLOAD=1 to disable the fallback and CODEGRAPH_DOWNLOAD_BASE to point it at your own mirror (#303).
• install.sh no longer fails with 403 / "could not resolve latest version" on shared or cloud hosts that exhaust GitHub's unauthenticated API rate limit; it now resolves the version through the unthrottled releases redirect, and CODEGRAPH_VERSION accepts a bare version like 0.9.4 as well as v0.9.4 (#325).