feat: dev publish workflow, parser refactor, and quality-of-life improvements

.claude/.gitignore

@@ -0,0 +1 @@
+session-edits.log

.claude/hooks/check-readme.sh

@@ -3,7 +3,14 @@
 # Runs as a PreToolUse hook on Bash tool calls.
 
 INPUT=$(cat)
-COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+COMMAND=$(echo "$INPUT" | node -e "
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    const p=JSON.parse(d).tool_input?.command||'';
+    if(p)process.stdout.write(p);
+  });
+" 2>/dev/null) || true
 
 # Only act on git commit commands
 if ! echo "$COMMAND" | grep -qE '^\s*git\s+commit'; then
@@ -30,13 +37,16 @@ if [ "$NEEDS_CHECK" -gt 0 ]; then
   [ "$CLAUDE_STAGED" -eq 0 ] && MISSING="${MISSING:+$MISSING, }CLAUDE.md"
   [ "$ROADMAP_STAGED" -eq 0 ] && MISSING="${MISSING:+$MISSING, }ROADMAP.md"
 
-  jq -n --arg missing "$MISSING" '{
-    hookSpecificOutput: {
-      hookEventName: "PreToolUse",
-      permissionDecision: "deny",
-      permissionDecisionReason: ($missing + " not staged but source files were changed. Review whether these docs need updating — README.md (language support table, feature list, command docs), CLAUDE.md (architecture table, supported languages, key design decisions), and ROADMAP.md (phase status, new features, deliverables). If they truly do not need changes, re-run the commit with docs check acknowledged.")
-    }
-  }'
+  node -e "
+    const missing = process.argv[1];
+    console.log(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: missing + ' not staged but source files were changed. Review whether these docs need updating — README.md (language support table, feature list, command docs), CLAUDE.md (architecture table, supported languages, key design decisions), and ROADMAP.md (phase status, new features, deliverables). If they truly do not need changes, re-run the commit with docs check acknowledged.'
+      }
+    }));
+  " "$MISSING"
   exit 0
 fi
 

.claude/hooks/enrich-context.sh

@@ -10,7 +10,15 @@ INPUT=$(cat)
 
 # Extract file path based on tool type
 # Read tool uses tool_input.file_path, Grep uses tool_input.path
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+FILE_PATH=$(echo "$INPUT" | node -e "
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    const o=JSON.parse(d).tool_input||{};
+    const p=o.file_path||o.path||'';
+    if(p)process.stdout.write(p);
+  });
+" 2>/dev/null) || true
 
 # Guard: no file path found
 if [ -z "$FILE_PATH" ]; then
@@ -30,8 +38,9 @@ fi
 
 # Convert absolute path to relative (strip project dir prefix)
 REL_PATH="$FILE_PATH"
-if [[ "$FILE_PATH" == "${CLAUDE_PROJECT_DIR}"* ]]; then
-  REL_PATH="${FILE_PATH#"${CLAUDE_PROJECT_DIR}"/}"
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+if [[ "$FILE_PATH" == "${PROJECT_DIR}"* ]]; then
+  REL_PATH="${FILE_PATH#"${PROJECT_DIR}"/}"
 fi
 # Normalize backslashes to forward slashes (Windows compatibility)
 REL_PATH="${REL_PATH//\\//}"
@@ -50,13 +59,22 @@ if [ -z "$DEPS" ] || [ "$DEPS" = "null" ]; then
 fi
 
 # Output as informational context (never deny)
-echo "$DEPS" | jq -c '{
-  hookSpecificOutput: (
-    "Codegraph context for " + (.file // "unknown") + ":\n" +
-    "  Imports: " + ((.results[0].imports // []) | length | tostring) + " files\n" +
-    "  Imported by: " + ((.results[0].importedBy // []) | length | tostring) + " files\n" +
-    "  Definitions: " + ((.results[0].definitions // []) | length | tostring) + " symbols"
-  )
-}' 2>/dev/null || true
+echo "$DEPS" | node -e "
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    try {
+      const o=JSON.parse(d);
+      const r=o.results?.[0]||{};
+      const imports=(r.imports||[]).length;
+      const importedBy=(r.importedBy||[]).length;
+      const defs=(r.definitions||[]).length;
+      const file=o.file||'unknown';
+      console.log(JSON.stringify({
+        hookSpecificOutput: 'Codegraph context for '+file+':\\n  Imports: '+imports+' files\\n  Imported by: '+importedBy+' files\\n  Definitions: '+defs+' symbols'
+      }));
+    } catch(e) {}
+  });
+" 2>/dev/null || true
 
 exit 0

.claude/hooks/guard-git.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# guard-git.sh — PreToolUse hook for Bash tool calls
+# Blocks dangerous git commands that interfere with parallel sessions
+# and validates commits against the session edit log.
+
+set -euo pipefail
+
+INPUT=$(cat)
+
+# Extract the command from tool_input JSON
+COMMAND=$(echo "$INPUT" | node -e "
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    const p=JSON.parse(d).tool_input?.command||'';
+    if(p)process.stdout.write(p);
+  });
+" 2>/dev/null) || true
+
+if [ -z "$COMMAND" ]; then
+  exit 0
+fi
+
+# Only act on git commands
+if ! echo "$COMMAND" | grep -qE '^\s*git\s+'; then
+  exit 0
+fi
+
+deny() {
+  local reason="$1"
+  node -e "
+    console.log(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: process.argv[1]
+      }
+    }));
+  " "$reason"
+  exit 0
+}
+
+# --- Block dangerous commands ---
+
+# git add . / git add -A / git add --all (broad staging)
+if echo "$COMMAND" | grep -qE '^\s*git\s+add\s+(\.\s*$|-A|--all)'; then
+  deny "BLOCKED: 'git add .' / 'git add -A' stages ALL changes including other sessions' work. Stage specific files instead: git add <file1> <file2>"
+fi
+
+# git reset (unstaging / hard reset)
+if echo "$COMMAND" | grep -qE '^\s*git\s+reset'; then
+  deny "BLOCKED: 'git reset' can unstage or destroy other sessions' work. To unstage your own files, use: git restore --staged <file>"
+fi
+
+# git checkout -- <file> (reverting files)
+if echo "$COMMAND" | grep -qE '^\s*git\s+checkout\s+--'; then
+  deny "BLOCKED: 'git checkout -- <file>' reverts working tree changes and may destroy other sessions' edits. If you need to discard your own changes, be explicit about which files."
+fi
+
+# git restore (reverting) — EXCEPT git restore --staged (safe unstaging)
+if echo "$COMMAND" | grep -qE '^\s*git\s+restore'; then
+  if ! echo "$COMMAND" | grep -qE '^\s*git\s+restore\s+--staged'; then
+    deny "BLOCKED: 'git restore <file>' reverts working tree changes and may destroy other sessions' edits. To unstage files safely, use: git restore --staged <file>"
+  fi
+fi
+
+# git clean (delete untracked files)
+if echo "$COMMAND" | grep -qE '^\s*git\s+clean'; then
+  deny "BLOCKED: 'git clean' deletes untracked files that may belong to other sessions."
+fi
+
+# git stash (hides all changes)
+if echo "$COMMAND" | grep -qE '^\s*git\s+stash'; then
+  deny "BLOCKED: 'git stash' hides all working tree changes including other sessions' work. In worktree mode, commit your changes directly instead."
+fi
+
+# --- Commit validation against edit log ---
+
+if echo "$COMMAND" | grep -qE '^\s*git\s+commit'; then
+  PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+  LOG_FILE="$PROJECT_DIR/.claude/session-edits.log"
+
+  # If no edit log exists, allow (backward compat for sessions without tracking)
+  if [ ! -f "$LOG_FILE" ] || [ ! -s "$LOG_FILE" ]; then
+    exit 0
+  fi
+
+  # Get unique edited files from log
+  EDITED_FILES=$(awk '{print $2}' "$LOG_FILE" | sort -u)
+
+  # Get staged files
+  STAGED_FILES=$(git diff --cached --name-only 2>/dev/null) || true
+
+  if [ -z "$STAGED_FILES" ]; then
+    exit 0
+  fi
+
+  # Find staged files that weren't edited in this session
+  UNEXPECTED=""
+  while IFS= read -r staged_file; do
+    if ! echo "$EDITED_FILES" | grep -qxF "$staged_file"; then
+      UNEXPECTED="${UNEXPECTED:+$UNEXPECTED, }$staged_file"
+    fi
+  done <<< "$STAGED_FILES"
+
+  if [ -n "$UNEXPECTED" ]; then
+    deny "BLOCKED: These staged files were NOT edited in this session: $UNEXPECTED. They may belong to another session. Commit only your files: git commit <your-files> -m \"msg\""
+  fi
+fi
+
+exit 0

.claude/hooks/rebuild-graph.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# rebuild-graph.sh — PostToolUse hook for Edit and Write tools
+# Incrementally rebuilds the codegraph after source file edits.
+# Always exits 0 (informational only, never blocks).
+
+set -euo pipefail
+
+INPUT=$(cat)
+
+# Extract file path using node (jq may not be available on Windows)
+FILE_PATH=$(echo "$INPUT" | node -e "
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    const p=JSON.parse(d).tool_input?.file_path||'';
+    if(p)process.stdout.write(p);
+  });
+" 2>/dev/null) || true
+
+if [ -z "$FILE_PATH" ]; then
+  exit 0
+fi
+
+# Only rebuild for source files codegraph tracks
+# Skip docs, configs, test fixtures, and non-code files
+case "$FILE_PATH" in
+  *.js|*.ts|*.tsx|*.jsx|*.py|*.go|*.rs|*.java|*.cs|*.php|*.rb|*.tf|*.hcl)
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+
+# Skip test fixtures — they're copied to tmp dirs anyway
+if echo "$FILE_PATH" | grep -qE '(fixtures|__fixtures__|testdata)/'; then
+  exit 0
+fi
+
+# Guard: codegraph DB must exist (project has been built at least once)
+DB_PATH="${CLAUDE_PROJECT_DIR:-.}/.codegraph/graph.db"
+if [ ! -f "$DB_PATH" ]; then
+  exit 0
+fi
+
+# Run incremental build (skips unchanged files via hash check)
+if command -v codegraph &>/dev/null; then
+  codegraph build "${CLAUDE_PROJECT_DIR:-.}" -d "$DB_PATH" 2>/dev/null || true
+else
+  node "${CLAUDE_PROJECT_DIR}/src/cli.js" build "${CLAUDE_PROJECT_DIR:-.}" -d "$DB_PATH" 2>/dev/null || true
+fi
+
+exit 0

.claude/hooks/track-edits.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# track-edits.sh — PostToolUse hook for Edit and Write tools
+# Logs each edited file path to .claude/session-edits.log so that
+# guard-git.sh can validate commits against actually-edited files.
+# In worktrees each session gets its own log automatically.
+# Always exits 0 (informational only, never blocks).
+
+set -euo pipefail
+
+INPUT=$(cat)
+
+# Extract file_path from tool_input JSON
+FILE_PATH=$(echo "$INPUT" | node -e "
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    const p=JSON.parse(d).tool_input?.file_path||'';
+    if(p)process.stdout.write(p);
+  });
+" 2>/dev/null) || true
+
+if [ -z "$FILE_PATH" ]; then
+  exit 0
+fi
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+LOG_FILE="$PROJECT_DIR/.claude/session-edits.log"
+
+# Normalize to relative path with forward slashes
+REL_PATH=$(node -e "
+  const path = require('path');
+  const abs = path.resolve(process.argv[1]);
+  const base = path.resolve(process.argv[2]);
+  const rel = path.relative(base, abs).split(path.sep).join('/');
+  process.stdout.write(rel);
+" "$FILE_PATH" "$PROJECT_DIR" 2>/dev/null) || true
+
+if [ -z "$REL_PATH" ]; then
+  exit 0
+fi
+
+# Append timestamped entry
+mkdir -p "$(dirname "$LOG_FILE")"
+echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $REL_PATH" >> "$LOG_FILE"
+
+exit 0

.claude/settings.json

@@ -8,6 +8,11 @@
             "type": "command",
             "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/check-readme.sh\"",
             "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-git.sh\"",
+            "timeout": 10
           }
         ]
       },
@@ -31,6 +36,23 @@
           }
         ]
       }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/rebuild-graph.sh\"",
+            "timeout": 30
+          },
+          {
+            "type": "command",
+            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/track-edits.sh\"",
+            "timeout": 5
+          }
+        ]
+      }
     ]
   }
 }

.github/workflows/embedding-regression.yml

@@ -0,0 +1,41 @@
+name: Embedding Regression
+
+on:
+  schedule:
+    - cron: '0 6 * * 1' # Monday 6am UTC
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'src/embedder.js'
+      - 'tests/search/**'
+      - 'package.json'
+
+concurrency:
+  group: embedding-regression-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  embedding-regression:
+    runs-on: ubuntu-latest
+    name: Embedding regression tests
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Cache HuggingFace models
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/huggingface
+          key: hf-models-minilm-v1
+
+      - name: Run embedding regression tests
+        run: npx vitest run tests/search/embedding-regression.test.js