versions.json

{
  "$comment": "Release registry consumed by `cppgraph status` (update/rebuild advice) and by scripts/install.sh (default checkout target). `latest` is the newest STABLE version tag (null until the first release is cut → installers fall back to the main branch). Each `releases` entry: `version` (matches the git tag, with or without a leading 'v'), `rebuild` (which layer of the index stack adopting it invalidates: \"none\" = query-code only, the existing store stays valid; \"store\" = rebuild the SQLite store from the existing .scip, no recompile; \"reindex\" = re-run scip-clang then rebuild the store), optional one-line `notes`, and an optional `url` to that release's changelog (keep detail in the CHANGELOG/GitHub release, not here). Sort releases oldest->newest. Example entry: {\"version\": \"0.1.0\", \"rebuild\": \"reindex\", \"notes\": \"reference index format changed\", \"url\": \"https://github.com/rakiz/cppgraph/releases/tag/v0.1.0\"}.",
  "$comment_scip_clang": "`scip_clang` pins the indexer dependency by `version` (upstream scip-clang release tag; drives the download URL and the source clone in docker/build-scip-clang-patched-linux) plus `rebuild` (impact of adopting a DIFFERENT version, same vocabulary as releases: \"reindex\" in practice since a new indexer changes the .scip). `patchset_version` is independent of that upstream `version`: it pins THIS repo's own patch bundle applied on top of the tag (see $comment_patchset), and is stamped into a downloaded \"patched\" binary's scip-clang.json sidecar so `cppgraph status` can tell when the installed binary predates the current patchset. `stock_sha256` pins the sha256 of each stock (upstream sourcegraph/scip-clang) release asset `setup_cmd._download_scip` may fetch, keyed by asset name — the download refuses any asset missing from this table (never an unverified binary) and is verified against it before being moved into place; the patched variant needs no entry (it verifies against its release's own `.sha256` sidecar). Bump the entries whenever `version` changes. The *variant* (stock vs patched) is still a capability level, not a staleness axis: a graph's variant is independent of the locally installed binary (a patched-indexed graph can be copied to a stock-only machine), and `cppgraph status` reports the installed/graph variant for information, advising re-indexing only on a version change; what a graph actually carries (file vs symbol granularity) is surfaced via has_attributed_refs / the usage_view.",
  "$comment_patchset": "Patchset history — THIS repo's patch bundle on top of the pinned upstream tag, independent of `version`: 1 = enclosing_range (sourcegraph/scip-clang PR #504) only; 2 = + the ForwardDefinition declaration-site fix (scip-clang-patches/forward-definition-on-v0.4.0.patch); 3 = + the ReadAccess/WriteAccess syntactic classifier (scip-clang-patches/read-write-access-on-v0.4.0.patch); 4 = + the SymbolInformation.kind syntactic classifier (scip-clang-patches/kind-on-v0.4.0.patch); 5 = + SymbolInformation.signature_documentation for defined/pure-virtual functions & methods (scip-clang-patches/signature-documentation-on-v0.4.0.patch), which also widened forward-definition's addTo hunk to -U2 context (it could mis-land once enough lines shift above it — see that patch's header); 6 = + Relationship.is_type_definition for fields / file-scope variables / static data members (scip-clang-patches/typed-by-on-v0.4.0.patch), which also widened typed-by's emitDocumentOccurrencesAndSymbols hunk to -U2 context (its -U1 context also closes MacroIndexer's sibling function — see that patch's header). 7 = + an enclosing_range for definitions introduced through a macro (scip-clang-patches/enclosing-range-macro-on-v0.4.0.patch): falls back to a function body's extent when the declaration range is cross-file (a gtest TEST()/TEST_F() body, a leading macro like MONGO_COMPILER_ALWAYS_INLINE), so calls inside them get attributed instead of dropped. Depends on the #504 patch and applies LAST. Bump it whenever a patch is added/removed/changed (NOT when upstream releases) — scripts/publish-scip-clang-patched.sh folds it into the release tag; see TODO.md's scip-clang section.",
  "scip_clang": {
    "version": "0.4.0",
    "rebuild": "reindex",
    "patchset_version": 7,
    "stock_sha256": {
      "scip-clang-arm64-darwin": "ff042fbc8a029f09f4b69fc7692e290e21c52923593207ee52d4e7439473ec64",
      "scip-clang-x86_64-linux": "06fd18c576f979a726c651594644ec4a35db4f471f2160b3f72eb89fa6001784"
    }
  },
  "latest": "0.4.10",
  "releases": [
    {
      "version": "0.1.0",
      "rebuild": "none",
      "notes": "First release. No store/schema change — safe to update in place.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.1.0"
    },
    {
      "version": "0.2.0",
      "rebuild": "store",
      "notes": "Store schema v4 across the release (`symbols.end_line` at v3 for `line_span`, `symbols.documentation` at v4 for `explain` doc comments), plus a dozen new read-only query commands (ranking/stats, `outline`/`class_members`, architecture facts like `boundary_violations`/`api_surface`/`dependency_cost`, `file:line` symbol resolution) and a generated CLI reference doc. v2/v3 stores keep working — the migration is store-level, no re-index: rebuild from the existing .scip (`cppgraph build`) to get the new columns; `update` migrates only files it actually touches, and `enrich-refs` migrates the schema shape without backfilling `end_line`/`documentation`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.2.0"
    },
    {
      "version": "0.3.0",
      "rebuild": "store",
      "notes": "Store schema v5 (`refs.roles`, `symbols.scip_kind`, `symbols.signature_documentation`, `symbols.is_out_of_project`) plus five new scip-clang syntactic-classifier patches on top of #504 (patchset 1→6): ForwardDefinition (fixes the declaration-site phantom-caller bug on stock-shaped graphs too), ReadAccess/WriteAccess (`--access {read,write}` on `references`/`find_references`), `SymbolInformation.kind` (`scip_kind` field), `signature_documentation` (signatures without a source read), and `Relationship.is_type_definition` (new `typed-by` edge kind: field/variable → its declared type, on `impact`/`reachable-from`/`boundary-violations`). Also consumes stock scip-clang's `Index.external_symbols` (`Node.is_out_of_project`, no patch needed — always-on, +~21% node count). v2–v4 stores keep working — store-level migration only, no re-index: rebuild from the existing `.scip` (`cppgraph build`) to get the new columns; `update`/`enrich-refs` migrate the schema shape without backfilling the new columns' data. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.3.0"
    },
    {
      "version": "0.3.1",
      "rebuild": "none",
      "notes": "Bugfixes only — no schema change (still v5), safe to update in place. Fixes a signature-attribution bug (a field could render a neighbouring function/operator's signature) and CLI/MCP crashing with a raw traceback instead of a clean error on a too-new store schema. Sharper hint on ambiguous name resolution (type vs. member vs. operator candidates). Plus regression tests closing gaps found in a migration-test audit (store schema, scip-clang binary staleness, scip.proto compatibility). Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.3.1"
    },
    {
      "version": "0.4.0",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. CLI/MCP parity work (find gains --hide-trivial/--limit/--root and overload grouping; every hyphen/underscore subcommand now answers to both spellings) plus a full read-only codebase audit's findings: a real sweep-line attribution bug (co-starting nested definitions could misattribute a call/reference to the wrong enclosing symbol), stale docs (viz/README.md's missing path/cycle/boundary-violation modes, a resolved caller false-positive still described as open), dead code removed (Graph's unused in-memory query engine), a schema-compat perf anti-pattern replaced (get_node/find/references_of no longer probe legacy schemas via exception cascades), and a context-expansion filtering gap (--exclude-tests now reaches path/cycle mode's depth expansion). Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.0"
    },
    {
      "version": "0.4.1",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. Adds `update --rescope`: widens a graph's recorded index scope (a wider subtree filter and/or turning tests on) by re-indexing only the newly in-scope translation units, instead of requiring a full `init --from-scratch` reindex. Widening only — a narrowing or an orthogonal filter change is refused with a pointer to a full rebuild. Verified end-to-end against a real scip-clang run, not just mocked unit tests. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.1"
    },
    {
      "version": "0.4.2",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. Hardening release: scip-clang downloads are now atomic (a failed or unverified download no longer deletes a working binary) and the stock variant is verified against pinned sha256s; the standalone HTML viewer escapes its inlined JSON (no </script> breakout); the MCP stale-check logs failures to stderr instead of swallowing them. CLI: line-span / no-incoming-calls / global-init-references are the canonical subcommand names; underscore spellings still work but are no longer listed in --help. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.2"
    },
    {
      "version": "0.4.3",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. scip-clang patchset 7 adds an `enclosing_range` fallback for macro-introduced definitions (gtest `TEST`/`TEST_F` bodies and macro-decorated inlines), restoring the call edges cppgraph previously dropped there; adopting it needs the patched binary re-downloaded and the graph re-indexed. Also six CLI/graph fixes (a `find` token-measurement bug, `explain` name display, exact-type name resolution, a graph-build version stamp, a `build --help` crash, a warning on a stale compile_commands.json) and a fully re-measured `COMPARISON.md`. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.3"
    },
    {
      "version": "0.4.4",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. `cppgraph update` now notices when the graph was indexed with an older scip-clang patchset than the installed patched binary and, with your explicit consent (never silently — indexing is long), re-indexes the recorded scope; `status` reports the graph stale and names both patchsets, and the installed-binary advice states the two steps (update the binary, then re-index). A graph built before patchset tracking (cppgraph < 0.4.4, no recorded patchset) is deduced pre-current so p6→p7 users are covered. Partial updates never change the recorded patchset. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.4"
    },
    {
      "version": "0.4.5",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. Opt-in Masora fact injection: with `CPPGRAPH_MASORA=1` (default off; without a Masora installation nothing changes at all), the single-symbol queries append up to two terse fact lines about the symbol they answer on, spawned from `masora facts` with a 2 s budget — statuses as labels, refuted knowledge rendered as `masora NOT: …`, never advice, and every failure mode degrades to no injection rather than an error. Needs a Masora installation plus a configured base and index to do anything. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.5"
    },
    {
      "version": "0.4.6",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. Masora injection hardening per the integration contract §9.8: the fact count is configurable (`CPPGRAPH_MASORA_MAX_FACTS`, default 2, higher allowed; the ≤60-token budget still wins with a visible cap) and input hygiene lands on both surfaces — unknown MCP tool parameters are rejected with an explicit error naming them (FastMCP used to silently drop them, returning unfiltered results), and a path-prefix filter matching no indexed file is an explicit error naming the prefix (MCP + CLI; a valid prefix with zero query matches stays a normal result). Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.6"
    },
    {
      "version": "0.4.7",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. A bundled `/cppgraph` agent slash command ships in-repo (`commands/cppgraph.md`) and `cppgraph setup` installs it into the Claude Code and opencode user command dirs (stage S3c, same detection and keep-if-identical statuses as the bundled skill); it routes on the first word of `$ARGUMENTS` — `status` (drift + update advice), `help`, `index` (the agent-driven non-interactive index flow), `update` (non-destructive re-run with the recorded scope), else a free-form graph query. `scripts/uninstall.sh` now also offers to remove the installed skill and command files, fixing the skill's pre-existing uninstall gap (one ask, `--dry-run`-aware, a skill dir removed only when left empty). Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.7"
    },
    {
      "version": "0.4.8",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. Masora fact injection (opt-in via `CPPGRAPH_MASORA`) moves to facts contract v2: each fact now carries four git-context stamps (`established_relation`/`established_commit`/`off_version`/`context_ordering`, required — a fact missing one rejects the document, fail-closed), and when the context matters an indented `context:` line renders under the fact line (off-version, established ahead / on another line, unproven, degraded ordering) — statuses are never re-judged from the stamps. A `masora` binary answering with any other contract version now surfaces a one-line update advisory (update cppgraph / update masora) instead of silently injecting nothing. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.8"
    },
    {
      "version": "0.4.9",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. Masora injection adapts to facts contract v3: `find`/`outline` inject too — ONE batched `masora facts` spawn per response carrying every result symbol as repeated `--symbol` flags (the ≤2-facts / ≤60-token budget stays per response, the truncation line visible); each fact on a multi-symbol response renders `— <anchor_leaf>` so the reader knows WHICH queried symbol it answers for; the zero-fact rendering is differentiated — masora's `presence_hint` renders verbatim on an empty base (masora owns the wording, the cppgraph hardcoded literal is gone) and a filtered no-match renders the derived `<n> lineage(s) examined, none matched` staleness line; every freshly built store now writes the `symbol_format` meta row (= 1), which masora's reader gates on like the schema version. Strict v3 parsing, no dual-version window: a v2 producer surfaces the 'update masora' advisory. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.9"
    },
    {
      "version": "0.4.10",
      "rebuild": "none",
      "notes": "No schema change (still v5), safe to update in place. `cppgraph setup` now links the CLI onto PATH: the venv's `cppgraph` binary is symlinked into `~/.local/bin` (where other per-user tools like masora already live), so shells and spawned sub-agents — which do not inherit MCP servers — can invoke a bare `cppgraph`. Skipped when a `cppgraph` is already on PATH; never clobbers a non-symlink file; repoints a stale/dangling link; notes when the dir isn't on PATH. `scripts/uninstall.sh` detects the link (only when it points into the repo's venv, dangling included) and offers to remove it — the `~/.local/bin` dir itself is never touched. Full detail in `CHANGELOG.md`.",
      "url": "https://github.com/rakiz/cppgraph/releases/tag/v0.4.10"
    }
  ]
}